From ebdc1503df8721626bf7b956647128f5d0939788 Mon Sep 17 00:00:00 2001 From: Eugene Yakubovich Date: Mon, 30 Mar 2015 16:04:56 -0700 Subject: [PATCH] mdsvc: no more 169.254.196.255 address Since the spec requires AC_METADATA_URL env var, well known IP is no longer needed. This removes the iptables manipulation. Instead the IP address of the host is passed in the AC_METADATA_URL. This host IP is the address of the host end of the default veth. --- common/common.go | 9 +++---- networking/net/net.go | 4 +++ networking/net/veth/veth.go | 3 ++- networking/net_plugin.go | 8 +++--- networking/networking.go | 5 +++- rkt/metadata_service.go | 24 +---------------- stage1/init/init.go | 53 ++++++++++++++++++++----------------- 7 files changed, 47 insertions(+), 59 deletions(-) diff --git a/common/common.go b/common/common.go index 1c6bfc0..d936c56 100644 --- a/common/common.go +++ b/common/common.go @@ -19,6 +19,7 @@ package common import ( "bufio" "fmt" + "net" "os" "os/exec" "path/filepath" @@ -36,9 +37,7 @@ const ( Stage1IDFilename = "stage1ID" OverlayPreparedFilename = "overlay-prepared" - MetadataServiceIP = "169.254.169.255" - MetadataServicePubPort = 80 - MetadataServicePrvPort = 2375 + MetadataServicePort = 2375 MetadataServiceRegSock = "/run/rkt/metadata-svc.sock" ) @@ -99,8 +98,8 @@ func ImageManifestPath(root string, imageID types.Hash) string { } // MetadataServicePublicURL returns the public URL used to host the metadata service -func MetadataServicePublicURL() string { - return fmt.Sprintf("http://%v:%v", MetadataServiceIP, MetadataServicePubPort) +func MetadataServicePublicURL(ip net.IP) string { + return fmt.Sprintf("http://%v:%v", ip, MetadataServicePort) } func GetRktLockFD() (int, error) { diff --git a/networking/net/net.go b/networking/net/net.go index 85cb0dc..856522d 100644 --- a/networking/net/net.go +++ b/networking/net/net.go @@ -63,6 +63,10 @@ func LoadNet(path string, n interface{}) error { type IfConfig struct { IP gonet.IP `json:"ip,omitempty"` IP6 gonet.IP `json:"ip6,omitempty"` + + // these are "extensions" and only meaningful for default net + HostIP gonet.IP `json:"hostIP,omitempty"` + HostIP6 gonet.IP `json:"hostIP6,omitempty"` } func PrintIfConfig(conf *IfConfig) error { diff --git a/networking/net/veth/veth.go b/networking/net/veth/veth.go index 1ec21ef..e5ed368 100644 --- a/networking/net/veth/veth.go +++ b/networking/net/veth/veth.go @@ -116,7 +116,8 @@ func cmdAdd(args *util.CmdArgs) error { } return rktnet.PrintIfConfig(&rktnet.IfConfig{ - IP: ipConf.IP.IP, + IP: ipConf.IP.IP, + HostIP: ipConf.Gateway, }) } diff --git a/networking/net_plugin.go b/networking/net_plugin.go index c904307..ca915cc 100644 --- a/networking/net_plugin.go +++ b/networking/net_plugin.go @@ -32,18 +32,18 @@ import ( const UserNetPluginsPath = "/usr/lib/rkt/plugins/net" const BuiltinNetPluginsPath = "usr/lib/rkt/plugins/net" -func (e *containerEnv) netPluginAdd(n *Net, netns, args, ifName string) (net.IP, error) { +func (e *containerEnv) netPluginAdd(n *Net, netns, args, ifName string) (ip, hostIP net.IP, err error) { output, err := e.execNetPlugin("ADD", n, netns, args, ifName) if err != nil { - return nil, err + return nil, nil, err } ifConf := rktnet.IfConfig{} if err = json.Unmarshal(output, &ifConf); err != nil { - return nil, fmt.Errorf("error parsing %q output: %v", n.Name, err) + return nil, nil, fmt.Errorf("error parsing %q output: %v", n.Name, err) } - return ifConf.IP, nil + return ifConf.IP, ifConf.HostIP, nil } func (e *containerEnv) netPluginDel(n *Net, netns, args, ifName string) error { diff --git a/networking/networking.go b/networking/networking.go index 471bd46..2ff6534 100644 --- a/networking/networking.go +++ b/networking/networking.go @@ -39,6 +39,7 @@ type activeNet struct { Net ifName string ip net.IP + hostIP net.IP // kludge for default network } // "base" struct that's populated from the beginning @@ -54,6 +55,7 @@ type Networking struct { containerEnv MetadataIP net.IP + HostIP net.IP contID types.UUID hostNS *os.File @@ -112,6 +114,7 @@ func Setup(rktRoot string, contID types.UUID) (*Networking, error) { // last net is the default n.MetadataIP = n.nets[len(n.nets)-1].ip + n.HostIP = n.nets[len(n.nets)-1].hostIP return &n, nil } @@ -197,7 +200,7 @@ func (e *containerEnv) setupNets(netns string, nets []Net) ([]activeNet, error) break } - an.ip, err = e.netPluginAdd(&nt, netns, nt.args, an.ifName) + an.ip, an.hostIP, err = e.netPluginAdd(&nt, netns, nt.args, an.ifName) if err != nil { err = fmt.Errorf("error adding network %q: %v", nt.Name, err) break diff --git a/rkt/metadata_service.go b/rkt/metadata_service.go index 5078708..ef7c196 100644 --- a/rkt/metadata_service.go +++ b/rkt/metadata_service.go @@ -26,7 +26,6 @@ import ( "net/http" "net/url" "os" - "os/exec" "os/signal" "path/filepath" "strconv" @@ -61,7 +60,6 @@ var ( hmacKey [sha512.Size]byte flagListenPort int - flagSrcAddrs string flagNoIdle bool exitCh = make(chan os.Signal, 1) @@ -73,24 +71,10 @@ const ( func init() { commands = append(commands, cmdMetadataService) - cmdMetadataService.Flags.StringVar(&flagSrcAddrs, "src-addr", "0.0.0.0/0", "source address/range for iptables") - cmdMetadataService.Flags.IntVar(&flagListenPort, "listen-port", common.MetadataServicePrvPort, "listen port") + cmdMetadataService.Flags.IntVar(&flagListenPort, "listen-port", common.MetadataServicePort, "listen port") cmdMetadataService.Flags.BoolVar(&flagNoIdle, "no-idle", false, "exit when last container is unregistered") } -func modifyIPTables(action string) error { - return exec.Command( - "iptables", - "-t", "nat", - action, "PREROUTING", - "-p", "tcp", - "-d", common.MetadataServiceIP, - "--dport", strconv.Itoa(common.MetadataServicePubPort), - "-j", "REDIRECT", - "--to-port", strconv.Itoa(flagListenPort), - ).Run() -} - func queryValue(u *url.URL, key string) string { vals, ok := u.Query()[key] if !ok || len(vals) != 1 { @@ -541,12 +525,6 @@ func runMetadataService(args []string) (exit int) { return 1 } - if err := modifyIPTables("-A"); err != nil { - stderr("Error setting up iptables: %v", err) - return 1 - } - defer modifyIPTables("-D") - go runRegistrationServer(unixl) go runPublicServer(tcpl) diff --git a/stage1/init/init.go b/stage1/init/init.go index 5d5bf27..00d20f1 100644 --- a/stage1/init/init.go +++ b/stage1/init/init.go @@ -185,7 +185,28 @@ func stage1() int { } mirrorLocalZoneInfo(c.Root) - c.MetadataServiceURL = common.MetadataServicePublicURL() + + if privNet { + n, err := networking.Setup(root, c.UUID) + if err != nil { + fmt.Fprintf(os.Stderr, "Failed to setup network: %v\n", err) + return 6 + } + defer n.Teardown() + + c.MetadataServiceURL = common.MetadataServicePublicURL(n.HostIP) + + if err = n.EnterContNS(); err != nil { + fmt.Fprintf(os.Stderr, "Failed to switch to container netns: %v\n", err) + return 6 + } + + if err = registerContainer(c, n.MetadataIP); err != nil { + fmt.Fprintf(os.Stderr, "Failed to register container: %v\n", err) + return 6 + } + defer unregisterContainer(c) + } if err = c.ContainerToSystemd(interactive); err != nil { fmt.Fprintf(os.Stderr, "Failed to configure systemd: %v\n", err) @@ -198,28 +219,9 @@ func stage1() int { return 3 } + var execFn func() error + if privNet { - // careful not to make another local err variable. - // cmd.Run sets the one from parent scope - var n *networking.Networking - n, err = networking.Setup(root, c.UUID) - if err != nil { - fmt.Fprintf(os.Stderr, "Failed to setup network: %v\n", err) - return 6 - } - defer n.Teardown() - - if err = n.EnterContNS(); err != nil { - fmt.Fprintf(os.Stderr, "Failed to switch to container netns: %v\n", err) - return 6 - } - - if err = registerContainer(c, n.MetadataIP); err != nil { - fmt.Fprintf(os.Stderr, "Failed to register container: %v\n", err) - return 6 - } - defer unregisterContainer(c) - cmd := exec.Cmd{ Path: args[0], Args: args, @@ -228,13 +230,14 @@ func stage1() int { Stderr: os.Stderr, Env: env, } - err = withClearedCloExec(lfd, cmd.Run) + execFn = cmd.Run } else { - err = withClearedCloExec(lfd, func() error { + execFn = func() error { return syscall.Exec(args[0], args, env) - }) + } } + err = withClearedCloExec(lfd, execFn) if err != nil { fmt.Fprintf(os.Stderr, "Failed to execute nspawn: %v\n", err) return 5