kiss-ns

#!/bin/bash
# author: yin-jianhong@163.com
# version: v0.9
# dependency: systemd-nspawn tmux
# used to create light container/ns for nfs/cifs test on RHEL/CentOS 7 or later

LANG=C
P=$0; [[ $0 = /* ]] && P=${0##*/}
NSHome=/opt/NS

switchroot() {
	local P=$0 SH=; [[ $0 = /* ]] && P=${0##*/}; [[ -e $P && ! -x $P ]] && SH=$SHELL
	[[ $(id -u) != 0 ]] && {
		echo -e "\E[1;4m{WARN} $P need root permission, switch to:\n  sudo $SH $P $@\E[0m"
		exec sudo $SH $P "$@"
	}
}

Usage() {
	cat <<-EOF
	Usage:
	  $P <-n nsname> [options] [exec -- cmdline | ps | del | install pkgs | {jj|jinja} pkgs ]
	  $P ls

	Options:
	  -h, --help           ; show this help info
	  -n {nsname}          ; ns(name space) name
	  -p {pkgs}            ; packages you want in ns(name space)
	  -d                   ; debug mode
	  -v                   ; verbose mode, output more info
	  -q                   ; quiet mode: intend suppress the outputs of command rsync, yum
	  --veth-ip {ip1,ip2}  ; ip address pair for veth pair; ip1 for host side and ip2 for ns side
	  --macvlan-ip {ip1[,ip2...]} ; ip address[es] for ns macvlan if[s]; all for ns side
	  --bind {src[:dst]}   ; see systemd-nspawn --bind
	  --robind {src[:dst]} ; see systemd-nspawn --bind-ro
	  --vol, --volatile {yes|no}  ; see systemd-nspawn --volatile. default is no
	  --clone {ns}         ; clone from ns
	  --noboot             ; no boot
	  -x[arg]              ; expected return code of sub-command exec, if doesn't match output test fail msg
	                       ; e.g: -x  or  -x0  or  -x1,2,3  or  -x1,10,100-200

	Examples create ns by using mini fs tree + host /usr:
	  # same as example ns1, but use a it's own fs tree instead reuse host os tree
	  #  so you can do anything in this ns, and don't worry about any impact on the host
	  $P jj nsmini bash   # create rootfs template nsmini
	  $P -n ns0 --veth-ip 192.168.0.1,192.168.0.2 --noboot -robind=/usr --clone nsmini
	  $P -n ns1 --veth-ip 192.168.1.1,192.168.1.2 --macvlan-ip 192.168.254.11 -bind=/usr --clone nsmini

	Examples create ns by using absolute own fs tree:
	  $P jj nsbase iproute iputils nfs-utils --clone nsmini   # create rootfs template nsbase
	  $P -n ns2 --veth-ip 192.168.2.1,192.168.2.2 --macvlan-ip 192.168.254.12,192.168.253.12 --clone nsbase
	  $P -n ns3 --veth-ip 192.168.3.1,192.168.3.2 --macvlan-ip 192.168.254.13,192.168.253.13 --clone nsbase

	Examples sub-command:
	  $P ls                                # list all ns
	  $P ps ns3                            # show ps tree of ns3
	  $P del ns3                           # delete/remove ns3 but keep rootdir
	  $P delete ns3                        # delete/remove ns3 and it's rootdir
	  $P install ns2 cifs-utils            # install cifs-utils in ns2

	  $P exec -v -x ns2 ip addr show             # exec command in ns2
	  $P exec -v -x ns2 -- ls -l /               # exec command in ns2

	  sudo systemctl start nfs-server
	  sudo exportfs -o ro,no_root_squash "*:/usr/share"
	  sudo addmacvlan macvlan-host
	  sudo addressup macvlan-host 192.168.254.254
	  sudo firewall-cmd --add-service=nfs --add-service=mountd --add-service=rpc-bind
	  $P exec -v -x ns2 -- mkdir -p /mnt/nfs                # exec command in ns2
	  $P exec -v -x ns2 -- showmount -e 192.168.2.1         # exec command in ns2
	  $P exec -v -x ns2 -- mount 192.168.2.1:/ /mnt/nfs     # exec command in ns2
	  $P exec -v -x ns2 -- showmount -e 192.168.254.254     # exec command in ns2
	  $P exec -v -x ns2 -- mount 192.168.254.254:/ /mnt/nfs # exec command in ns2

	EOF
}

run() {
	[[ $# -eq 0 ]] && return 0

	[[ "$DEBUG" = yes ]] && echo "[sys]" "$@"
	"$@"
}

addmacvlan() {
	local fname=${FUNCNAME[0]}
	Usage() { echo -e "Usage:\n  $fname [-updev=updev] [-mode={bridge|vepa|private|passthru}] mv1 [mv2 ...]"; }

	local updev=$(get-default-if.sh)
	local mode=bridge

	# parse options
	local mvs=()
	for arg; do
		case "$arg" in
		updev=*|-updev=*) val=${arg#*=}; [[ -n "$val" ]] && updev="$val";;
		mode=*|-mode=*)  val=${arg#*=}; [[ -n "$val" ]] && mode="$val";;
		-*)       echo "{WARN} unkown option '${arg}'" >&2;;
		*)        mvs+=($arg);;
		esac
	done

	if [[ "${#mvs[@]}" = 0 ]]; then
		Usage >&2
		return 1
	fi

	for mv in $mvs; do
		run ip link add link $updev name ${mv} type macvlan mode $mode
	done
}
addressup() {
	local if=$1
	local addr=$2

	xaddr() {
		local addr=$1
		[[ "$addr" =~ .*/[1-9]+$ ]] || addr+=/24
		echo $addr
	}

	run ip link set dev $if up
	run ip addr add $(xaddr $addr) dev $if
}
_nsaddressup() {
	local initpid=$1
	local if=$2
	local addr=$3

	xaddr() {
		local addr=$1
		[[ "$addr" =~ .*/[1-9]+$ ]] || addr+=/24
		echo $addr
	}

	run _nsexec $initpid ip link set dev $if up
	run _nsexec $initpid ip addr add $(xaddr $addr) dev $if
}

is_valid_ip() {
    local  ip=$1
    local  stat=1

    ip=${ip%/*}
    if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
        ip=(${ip//./ })
        [[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
            && ${ip[2]} -le 255 && ${ip[3]} -le 255 ]]
        stat=$?
    fi
    return $stat
}

ns_init_pid() {
	local ns=$1
	local ppid initpid

	ppid=$(tmux -L ns:$ns list-panes -a -F '#{session_name} #{pane_pid}' | awk -v ns="$ns" '$1 == ns {print $2}')
	initpid=$(pgrep -f ^/usr/lib/systemd/systemd -P "$ppid") || {
		initpid=$(pgrep -f ^-bash -P "$ppid") || {
			return 1
		}
	}
	echo $initpid
}

ns_pstree() {
	local ns=$1

	ps axf | awk -v nsname=$ns '
		BEGIN {
			prefixlen=0
			gettmux=0
			pattern="tmux -L ns:" nsname " .* systemd-nspawn .*$"
		}
		$0 ~ pattern {
			gettmux=1
			prefixlen=length(gensub(pattern, "", 1))
			print $0
			next
		}
		gettmux == 1 {
			if (substr($0, prefixlen+1, 1) == " ") {
				print $0
			} else {
				gettmux=2
				exit
			}
		}
	'
}

quote() {
	local at=$1
	if [[ -z "$at" ]]; then
		echo -n "'' "
	elif [[ "$at" =~ [^[:print:]]+ || "$at" = *$'\t'* || "$at" = *$'\n'* ]]; then
		builtin printf %q "$at"; echo -n " "
	elif [[ "$at" =~ "'" && ! "$at" =~ ([\`\"$]+|\\\\) ]]; then
		echo -n "\"$at\" "
	else
		echo -n "$at" | sed -r -e ':a;$!{N;ba};' \
			-e "s/'+/'\"&\"'/g" -e "s/^/'/" -e "s/$/' /" \
			-e "s/^''//" -e "s/'' $/ /"
	fi
}
getReusableCommandLine() {
	#if only one parameter, treat it as a piece of script
	[[ $# = 1 ]] && { echo "$1"; return; }

	local shpattern='^[][0-9a-zA-Z~@%^_+=:,./-]+$'

	for at; do
		if [[ "$at" =~ $shpattern ]]; then
			echo -n "$at "
		else
			quote "$at"
		fi
	done
	echo
}

_nsexec() {
	local initpid=$1
	shift
	local _cmdline=$(getReusableCommandLine "$@")

	nsenter --target "$initpid" --mount --uts --ipc --net --pid -- bash -c "$_cmdline"
}

nsexec() {
	local ns=$1
	local nsdir=$NSHome/$ns
	shift
	local initpid=$(ns_init_pid $ns)
	[[ "$VERBOSE" = yes ]] && {
		cmdLine=$(getReusableCommandLine "$@")
		echo "[NS:$ns]> ${cmdLine//\\/\\\\}" | GREP_COLORS='ms=01;36' grep --color . >&2
	}
	_nsexec "$initpid" "$@"
	rc=$?

	faillog() { echo -e "\033[41m{TEST:FAIL} $*\033[0m"; }
	[[ -n "$expectedrc" ]] && {
		[[ " ${expectedrc[@]} " != *" $rc "* ]] && {
			faillog "return code: expect $expectedRC, but got $rc"
		}
	}

	return $rc
}

expandrc() {
	local rcrange=$1
	local rclist=()
	for rc in ${rcrange//,/ }; do
		if [[ "$rc" =~ [0-9]+ ]]; then
			rclist+=($rc)
		elif [[ "$rc" =~ [0-9]+-[0-9]+ ]]; then
			eval rclist+=({${rc/-/..}})
		fi
	done
	echo -n ${rclist[@]}
}

xaddr() {
	local addr=$1
	[[ "$addr" =~ .*/[1-9]+$ ]] || addr+=/24
	echo $addr
}

chroot_install() {
	local releasever
	local rootfs=$1; shift

	rm -rf $rootfs/etc/yum.repos.d

	echo -e "{NS:INFO} chroot($rootfs) and install pkgs ..."
	if command -v dnf >/dev/null; then
		releasever=$(rpm -q --qf "%{version}" -f /etc/os-release)
		read repo < <(LANG=C dnf whatprovides bash|awk '$1 == "Repo" && $3 != "@System" {print $3}')
		dnf $yumOpt --setopt=strict=0 --disablerepo=* --enablerepo=$repo --nogpg --installroot=$rootfs --releasever=$releasever install -y "$@"
		dnf $yumOpt -y --nogpg --installroot=$rootfs clean all 2>/dev/null
		rm -rf $rootfs/var/cache/dnf/*
	else
		read repo < <(LANG=C yum whatprovides bash|awk '$1 == "Repo" && $3 != "installed" {print $3}')
		yum $yumOpt --setopt=strict=0 --disablerepo=* --enablerepo=$repo --nogpg --installroot=$rootfs install -y "$@"
		yum $yumOpt -y --nogpg --installroot=$rootfs clean all 2>/dev/null
		rm -rf $rootfs/var/cache/yum/*
	fi
}

nsjinja() {
	local ns=$1
	local rootdir=$NSHome/$ns
	shift
	echo -e "{NS:INFO} creating NS template $NS($rootdir) ..."
	if [[ -n "$CLONE" && -d "$NSHome/$CLONE" && ! -d $rootdir ]]; then
		mkdir -p $rootdir
		echo -e "- {NS:INFO} clone from $NSHome/$CLONE ..."
		rsync -a --info=progress2 $rsyncOpt $NSHome/$CLONE/  $rootdir/.
	fi
	chroot_install $rootdir "$@"
	echo
}

_nsdelete() {
	local opt=
	local ns=$1
	[[ $ns = /* ]] && { opt=$ns; shift; ns=$1; }

	echo -e "\n{NS:INFO} remove ns $ns ..."

	echo -e "- {NS:INFO} umount all networking fs on $ns ..."
	nsexec $ns umount -a -t nfs,nfs4,cifs

	local macvlan4ns=${ns}.
	local iflist=$(nsexec $ns ip a s | awk -F'[: @]+' -v pre=mv-${macvlan4ns} '/^[0-9]+:/ {if ($2 ~ "^" pre "[0-9]*$") print $2}'|xargs)
	echo -e "- {NS:INFO} remove macvlan ifs in ns: {${iflist// /,}} ..."
	for dev in $iflist; do
		nsexec $ns ip link del "$dev"
	done

	echo -e "- {NS:INFO} systemd-run -M $ns poweroff #..."
	systemd-run -M $ns "poweroff"
	ns_pstree $ns | awk 'NF > 4 {print $1}' |tac|sed '$d'| xargs kill 2>/dev/null
	sleep 1
	ns_pstree $ns | awk 'NF > 4 {print $1}' |tac|sed '$d'| xargs kill -9 2>/dev/null

	echo -e "- {NS:INFO} remove veth ifs @host ..."
	run ip link del ve-$ns 2>/dev/null
	echo -e "- {NS:INFO} remove macvlan ifs @host ..."
	for dev in $(ip a s | awk -F'[: @]+' -v pre=${macvlan4ns} '/^[0-9]+:/ {if ($2 ~ "^" pre "[0-9]*$") print $2}'); do
		run ip link del "$dev"
	done
	[[ $opt = /h* ]] && {
		NSdir=$NSHome/$ns
		rm -rf $NSdir
	}
	return 0
}
nsdelete() {
	local opt=
	local nslist=()

	for arg; do
		[[ $arg = /* ]] && opt=$arg || nslist+=($arg)
	done

	for ns in "${nslist[@]}"; do
		_nsdelete $opt $ns
	done
}

ns_list() {
	machinectl -l | awk '$2 != "vm" && $2 != "machines"'
}

BOOT_OPT=-b
NET_MACVLAN_OPTS=
BIND_OPTS=
VOLATILE_OPT=
MachineOpt=
NS_VETH_IP=
NS_MACVLAN_IPS=
HOST_VETH_IP=
InitPid=
INIT_PKG=systemd

# command line parse
_at=`getopt -o hn:p:dvx::q \
	--long help \
	--long veth-ip: \
	--long macvlan-ip: \
	--long bind: \
	--long robind: \
	--long volatile: --long vol: \
	--long clone: \
	--long noboot \
    -a -n "$0" -- "$@"`
eval set -- "$_at"
while true; do
	case "$1" in
	-h|--help) Usage; shift 1; exit 0;;
	-n) NS="$2"; shift 2;;
	-p) PKGS+="$2"; shift 2;;
	-d) DEBUG=yes; shift 1;;
	-v) VERBOSE=yes; shift 1;;
	-q) QUIET=yes; shift 1;;
	--veth-ip) read HOST_VETH_IP NS_VETH_IP <<<"${2//,/ }"; shift 2;;
	--macvlan-ip) NS_MACVLAN_IPS="${2//,/ }"; shift 2;;
	--bind) BIND_OPTS+="--bind=$2 "; shift 2;;
	--robind) BIND_OPTS+="--bind-ro=$2 "; shift 2;;
	--volatile|--vol) VOLATILE_OPT="--volatile=$2"; shift 2;;
	--clone) CLONE=$2; shift 2;;
	-x) expectedRC=${2:-0}; expectedrc=$(expandrc ${expectedRC#=}); shift 2;;
	--noboot) BOOT_OPT=; INIT_PKG="bash"; shift 1;;
	--) shift; break;;
	esac
done

# __prepare__
command -v tmux >/dev/null || dep+=\ tmux
command -v firewall-cmd >/dev/null || dep+=\ firewalld
command -v rsync >/dev/null || dep+=\ rsync
command -v systemd-nspawn >/dev/null || dep+=\ systemd-container
[[ -n "$dep" ]] && {
	echo -e "{NS:INFO} install dependences ..."
	sudo yum install -y $dep >&2
}

[[ "$QUIET" = yes ]] && {
	yumOpt=-q
	rsyncOpt=-q
}

# __main__
subcmd=$1
case $subcmd in
jj|jinja) switchroot "$@"; shift
	[[ -z "$NS" ]] && { NS=$1; shift; }
	[[ -z "$NS" ]] && { Usage >&2; exit 1; }
	nsjinja $NS "$@"
	exit $?;;
exec|exe|ex|e) switchroot "$@"; shift
	[[ -z "$NS" ]] && { NS=$1; shift; }
	[[ -z "$NS" ]] && { Usage >&2; exit 1; }
	nsexec $NS "$@"
	exit $?;;
install|ins*) switchroot "$@"; shift
	[[ -z "$NS" ]] && { NS=$1; shift; }
	[[ -z "$NS" ]] && { Usage >&2; exit 1; }
	NSdir=$NSHome/$NS
	chroot_install $NSdir "$@"
	exit $?;;
ps) shift
	[[ -z "$NS" ]] && { NS=$1; shift; }
	[[ -z "$NS" ]] && { Usage >&2; exit 1; }
	ns_pstree $NS
	exit $?;;
del*|del|de|d) switchroot "$@"; shift
	[[ -z "$NS" ]] && { NS=$1; shift; }
	[[ -z "$NS" ]] && { Usage >&2; exit 1; }
	nsdelete $NS "$@" $(test $subcmd = delete && echo /home)
	exit $?;;
ls) shift
	ns_list
	exit $?;;
creat*) shift
	;;
esac

[[ -z "$NS" ]] && { Usage >&2; exit 1; }

switchroot "$@";

NSdir=$NSHome/$NS

#remove existed one
[[ -d $NSdir ]] && {
	echo -e "\n{NS:INFO} remove existed ns and/or rootfs $NSdir ..."
	$0 delete "$NS" 2>/dev/null
}

echo -e "\n{NS:INFO} creating macvlan if for NS ..."
macvlan4ns=${NS}.
loop=0
for addr in $NS_MACVLAN_IPS; do
	is_valid_ip "$addr" || { echo -e "\n{NS:WARN} '$addr' is not a valid address"|grep --color=always . >&2; continue; }
	ifname=${macvlan4ns}$((loop++))
	addmacvlan $ifname
	NET_MACVLAN_OPTS+="--network-macvlan=${ifname} "
done

mkdir -p $NSdir
echo -e "\n{NS:INFO} creating fs tree for NS $NSdir ..."
if [[ -n "$CLONE" && -d "$NSHome/$CLONE" ]]; then
	rsync -a --info=progress2 $rsyncOpt $NSHome/$CLONE/  $NSdir/.
	systemd-machine-id-setup --root $NSdir
fi
if rpm --root $NSdir -q $INIT_PKG; then
	systemd-machine-id-setup --root $NSdir
else
	chroot_install $NSdir $INIT_PKG $PKGS
	\cp -rf /etc/yum.repos.d $NSdir/etc/.
	\cp /etc/{passwd,group,shadow,resolv.conf} $NSdir/etc/.
	test -d $NSdir/etc/systemd && \cp /etc/systemd/resolved.conf $NSdir/etc/systemd/.
fi
MachineOpt="-D $NSdir"

NETWORK_VETH_OPT=
[[ -n "$HOST_VETH_IP" && -n "$NS_VETH_IP" ]] && NETWORK_VETH_OPT=--network-veth

CMD="systemd-nspawn $BIND_OPTS $VOLATILE_OPT $NETWORK_VETH_OPT $NET_MACVLAN_OPTS $BOOT_OPT $MachineOpt"
echo -e "\n{NS:INFO} [creating NS $NS]: $CMD"
run tmux -L ns:$NS new -s $NS -d "$CMD"

echo -e "\n{NS:INFO} waiting NS $NSdir start ..."
sleep 1
for ((i=0; i<4; i++)); do InitPid=$(ns_init_pid $NS) && break; sleep 1; done
[[ -z "$InitPid" ]] && {
	$CMD
	echo -e "\n{NS:ERR} something is wrong, exit ."
	$0 del "$NS" 2>/dev/null
	exit 1
}

echo -e "\n{NS:INFO} NS info"
ns_list
ns_pstree $NS

# post setup
hostvethif=ve-$NS
if [[ -n "$HOST_VETH_IP" && -n "$NS_VETH_IP" ]]; then
	is_valid_ip $HOST_VETH_IP || { HOST_VETH_IP=; echo -e "\n{NS:WARN} '$HOST_VETH_IP' is not a valid address"|grep --color=always . >&2; }
	is_valid_ip $NS_VETH_IP || { NS_VETH_IP=; echo -e "\n{NS:WARN} '$NS_VETH_IP' is not a valid address"|grep --color=always . >&2; }

	echo -e "\n{NS:INFO} setup veth host side $hostvethif $HOST_VETH_IP"
	addressup $hostvethif $HOST_VETH_IP
	ip a s $hostvethif

	vifidx=$(ip a s $hostvethif|sed -nr -e '/.*@if([0-9]+): .*/{s//\1/;p}')
	nsvethif=$(_nsexec "$InitPid" ip a s | awk -F[@:\ ]+ '/^'$vifidx':/{print $2}')
	echo -e "\n{NS:INFO} setup veth ns($NS) side: $nsvethif $NS_VETH_IP"
	_nsaddressup "$InitPid"  $nsvethif $NS_VETH_IP
	_nsexec "$InitPid" ip a s $nsvethif

	#add default route
	echo -e "\n{NS:INFO} add default route for $NS: ip route add default via $HOST_VETH_IP dev $nsvethif"
	_nsexec "$InitPid" ip route add default via $HOST_VETH_IP dev $nsvethif
	_nsexec "$InitPid" sysctl -w net.ipv4.conf.all.rp_filter=2

	#enable NAT
	echo -e "\n{NS:INFO} enable ip forward and NAT"
	sysctl -w net.ipv4.conf.all.forwarding=1
	systemctl start firewalld
	firewall-cmd --permanent --zone=public --add-masquerade
	firewall-cmd --reload
	#iptables -A POSTROUTING -s ${HOST_VETH_IP%.*}.0/24 -j MASQUERADE -t nat
else
	:
fi

echo -e "\n{NS:INFO} => setup macvlan ns side:"
loop=0
for addr in $NS_MACVLAN_IPS; do
	is_valid_ip "$addr" || { echo -e "\n{NS:WARN} '$addr' is not a valid address"|grep --color=always . >&2; continue; }
	nsifname=mv-${macvlan4ns}$((loop++))
	echo -e "\n{NS:INFO} setup macvlan if $nsifname $addr"
	_nsaddressup "$InitPid" $nsifname $addr
	_nsexec "$InitPid" ip a s $nsifname
done

[[ -n "$HOST_VETH_IP" && -n "$NS_VETH_IP" ]] && {
	echo -e "\n{NS:INFO} ping veth nic $NS_VETH_IP ($hostvethif -> $nsvethif)"
	ping -c 2 $NS_VETH_IP
}