2 containers.h -- Container Management API
3 Copyright (C) 2018 Guus Sliepen <guus@meshlink.io>
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 2 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License along
16 with this program; if not, write to the Free Software Foundation, Inc.,
17 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
25 #include "containers.h"
26 #include "common_handlers.h"
28 char *lxc_path = NULL;
30 static char container_ips[10][100];
32 /* Return the handle to an existing container after finding it by container name */
33 struct lxc_container *find_container(const char *name) {
34 struct lxc_container **test_containers;
35 char **container_names;
36 int num_containers, i;
38 assert((num_containers = list_all_containers(lxc_path, &container_names,
39 &test_containers)) != -1);
41 for(i = 0; i < num_containers; i++) {
42 if(strcmp(container_names[i], name) == 0) {
43 return test_containers[i];
50 /* Rename a Container */
51 void rename_container(const char *old_name, const char *new_name) {
52 char rename_command[200];
54 struct lxc_container *old_container;
56 /* Stop the old container if its still running */
57 assert(old_container = find_container(old_name));
58 old_container->shutdown(old_container, CONTAINER_SHUTDOWN_TIMEOUT);
59 /* Call stop() in case shutdown() fails - one of these two will always succeed */
60 old_container->stop(old_container);
61 /* Rename the Container */
62 /* TO DO: Perform this operation using the LXC API - currently does not work via the API,
63 need to investigate and determine why it doesn't work, and make it work */
64 assert(snprintf(rename_command, sizeof(rename_command),
65 "%s/" LXC_UTIL_REL_PATH "/" LXC_RENAME_SCRIPT " %s %s %s", meshlink_root_path, lxc_path,
66 old_name, new_name) >= 0);
67 rename_status = system(rename_command);
68 PRINT_TEST_CASE_MSG("Container '%s' rename status: %d\n", old_name, rename_status);
69 assert(rename_status == 0);
72 char *run_in_container(const char *cmd, const char *container_name, bool daemonize) {
73 char container_find_name[1000];
74 struct lxc_container *container;
77 assert(container_name);
78 assert(snprintf(container_find_name, sizeof(container_find_name), "%s_%s",
79 state_ptr->test_case_name, container_name) >= 0);
80 assert(container = find_container(container_find_name));
82 return run_in_container_ex(cmd, container, daemonize);
85 char *execute_in_container(const char *cmd, const char *container_name, bool daemonize) {
86 struct lxc_container *container;
89 assert(container_name);
90 assert(container = find_container(container_name));
92 return run_in_container_ex(cmd, container, daemonize);
95 /* Run 'cmd' inside the Container created for 'node' and return the first line of the output
96 or NULL if there is no output - useful when, for example, a meshlink invite is generated
97 by a node running inside a Container
98 'cmd' is run as a daemon if 'daemonize' is true - this mode is useful for running node
99 simulations in Containers
100 The caller is responsible for freeing the returned string */
101 char *run_in_container_ex(const char *cmd, struct lxc_container *container, bool daemonize) {
103 size_t output_len = 0;
105 /* Run the command within the Container, either as a daemon or foreground process */
106 /* TO DO: Perform this operation using the LXC API - currently does not work using the API
107 Need to determine why it doesn't work, and make it work */
109 char run_script_path[100];
110 char *attach_argv[4];
112 assert(snprintf(run_script_path, sizeof(run_script_path), "%s/" LXC_UTIL_REL_PATH "/" LXC_RUN_SCRIPT,
113 meshlink_root_path) >= 0);
114 attach_argv[0] = run_script_path;
115 attach_argv[1] = (char *)cmd;
116 attach_argv[2] = container->name;
117 attach_argv[3] = NULL;
119 /* To daemonize, create a child process and detach it from its parent (this program) */
121 assert(daemon(1, 0) != -1); // Detach from the parent process
122 assert(execv(attach_argv[0], attach_argv) != -1); // Run exec() in the child process
125 char *attach_command;
126 size_t attach_command_len;
128 attach_command_len = strlen(meshlink_root_path) + strlen(LXC_UTIL_REL_PATH) + strlen(LXC_RUN_SCRIPT) + strlen(cmd) + strlen(container->name) + 10;
129 attach_command = malloc(attach_command_len);
130 assert(attach_command);
132 assert(snprintf(attach_command, attach_command_len,
133 "%s/" LXC_UTIL_REL_PATH "/" LXC_RUN_SCRIPT " \"%s\" %s", meshlink_root_path, cmd,
134 container->name) >= 0);
136 assert(attach_fp = popen(attach_command, "r"));
137 free(attach_command);
138 /* If the command has an output, strip out any trailing carriage returns or newlines and
139 return it, otherwise return NULL */
143 if(getline(&output, &output_len, attach_fp) != -1) {
144 i = strlen(output) - 1;
146 while(output[i] == '\n' || output[i] == '\r') {
150 output[i + 1] = '\0';
156 assert(pclose(attach_fp) != -1);
162 /* Wait for a starting Container to obtain an IP Address, then save that IP for future use */
163 void container_wait_ip(int node) {
164 char container_name[100];
167 assert(snprintf(container_name, sizeof(container_name), "%s_%s", state_ptr->test_case_name,
168 state_ptr->node_names[node]) >= 0);
169 ip = container_wait_ip_ex(container_name);
171 strncpy(container_ips[node], ip, sizeof(container_ips[node])); // Save the IP for future use
172 PRINT_TEST_CASE_MSG("Node '%s' has IP Address %s\n", state_ptr->node_names[node],
173 container_ips[node]);
177 char *container_wait_ip_ex(const char *container_name) {
178 struct lxc_container *test_container;
179 char lxcls_command[200];
187 assert(test_container = find_container(container_name));
188 assert(snprintf(lxcls_command, sizeof(lxcls_command),
189 "lxc-ls -f | grep %s | tr -s ' ' | cut -d ' ' -f 5", test_container->name) >= 0);
190 PRINT_TEST_CASE_MSG("Waiting for Container '%s' to acquire IP\n", test_container->name);
191 assert(ip = malloc(20));
196 while(!ip_found && timeout) {
197 assert(lxcls_fp = popen(lxcls_command, "r")); // Run command
198 assert(getline((char **)&ip, &ip_len, lxcls_fp) != -1); // Read its output
199 /* Strip newlines and carriage returns from output */
202 while(ip[i] == '\n' || ip[i] == '\r') {
207 ip_found = (strcmp(ip, "-") != 0); // If the output is not "-", IP has been acquired
208 assert(pclose(lxcls_fp) != -1);
213 // Fail if IP cannot be read
219 /* Create all required test containers */
220 void create_containers(const char *node_names[], int num_nodes) {
222 char container_name[100];
223 int create_status, snapshot_status, snap_restore_status;
224 struct lxc_container *first_container = NULL;
226 for(i = 0; i < num_nodes; i++) {
227 assert(snprintf(container_name, sizeof(container_name), "run_%s", node_names[i]) >= 0);
229 /* If this is the first Container, create it otherwise restore the snapshot saved
230 for the first Container to create an additional Container */
232 assert(first_container = lxc_container_new(container_name, NULL));
233 assert(!first_container->is_defined(first_container));
234 create_status = first_container->createl(first_container, "download", NULL, NULL,
235 LXC_CREATE_QUIET, "-d", "ubuntu", "-r", "trusty", "-a", choose_arch, NULL);
236 fprintf(stderr, "Container '%s' create status: %d - %s\n", container_name,
237 first_container->error_num, first_container->error_string);
238 assert(create_status);
239 snapshot_status = first_container->snapshot(first_container, NULL);
240 fprintf(stderr, "Container '%s' snapshot status: %d - %s\n", container_name,
241 first_container->error_num, first_container->error_string);
242 assert(snapshot_status != -1);
244 assert(first_container);
245 snap_restore_status = first_container->snapshot_restore(first_container, "snap0",
247 fprintf(stderr, "Snapshot restore to Container '%s' status: %d - %s\n", container_name,
248 first_container->error_num, first_container->error_string);
249 assert(snap_restore_status);
254 /* Setup Containers required for a test
255 This function should always be invoked in a CMocka context
256 after setting the state of the test case to an instance of black_box_state_t */
257 void setup_containers(void **state) {
258 black_box_state_t *test_state = (black_box_state_t *)(*state);
259 int i, confbase_del_status;
260 char build_command[200];
261 struct lxc_container *test_container, *new_container;
262 char container_find_name[100];
263 char container_new_name[100];
264 int create_status, build_status;
266 PRINT_TEST_CASE_HEADER();
268 for(i = 0; i < test_state->num_nodes; i++) {
269 /* Find the run_<node-name> Container or create it if it doesn't exist */
270 assert(snprintf(container_find_name, sizeof(container_find_name), "run_%s",
271 test_state->node_names[i]) >= 0);
273 if(!(test_container = find_container(container_find_name))) {
274 assert(test_container = lxc_container_new(container_find_name, NULL));
275 assert(!test_container->is_defined(test_container));
276 create_status = test_container->createl(test_container, "download", NULL, NULL,
277 LXC_CREATE_QUIET, "-d", "ubuntu", "-r", "trusty", "-a", choose_arch, NULL);
278 PRINT_TEST_CASE_MSG("Container '%s' create status: %d - %s\n", container_find_name,
279 test_container->error_num, test_container->error_string);
280 assert(create_status);
283 /* Stop the Container if it's running */
284 test_container->shutdown(test_container, CONTAINER_SHUTDOWN_TIMEOUT);
285 /* Call stop() in case shutdown() fails
286 One of these two calls will always succeed */
287 test_container->stop(test_container);
288 /* Rename the Container to make it specific to this test case,
289 if a Container with the target name already exists, skip this step */
290 assert(snprintf(container_new_name, sizeof(container_new_name), "%s_%s",
291 test_state->test_case_name, test_state->node_names[i]) >= 0);
293 if(!(new_container = find_container(container_new_name))) {
294 rename_container(test_container->name, container_new_name);
295 assert(new_container = find_container(container_new_name));
298 /* Start the Container */
299 assert(new_container->start(new_container, 0, NULL));
300 /* Build the Container by copying required files into it */
301 assert(snprintf(build_command, sizeof(build_command),
302 "%s/" LXC_UTIL_REL_PATH "/" LXC_BUILD_SCRIPT " %s %s %s +x >/dev/null",
303 meshlink_root_path, test_state->test_case_name, test_state->node_names[i],
304 meshlink_root_path) >= 0);
305 build_status = system(build_command);
306 PRINT_TEST_CASE_MSG("Container '%s' build Status: %d\n", new_container->name,
308 assert(build_status == 0);
309 /* Restart the Container after building it and wait for it to acquire an IP */
310 new_container->shutdown(new_container, CONTAINER_SHUTDOWN_TIMEOUT);
311 new_container->stop(new_container);
312 new_container->start(new_container, 0, NULL);
313 container_wait_ip(i);
317 /* Destroy all Containers with names containing 'run_' - Containers saved for debugging will
318 have names beginning with test_case_ ; 'run_' is reserved for temporary Containers
319 intended to be re-used for the next test */
320 void destroy_containers(void) {
321 struct lxc_container **test_containers;
322 char **container_names;
323 int num_containers, i;
325 assert((num_containers = list_all_containers(lxc_path, &container_names,
326 &test_containers)) != -1);
328 for(i = 0; i < num_containers; i++) {
329 if(strstr(container_names[i], "run_")) {
330 fprintf(stderr, "Destroying Container '%s'\n", container_names[i]);
331 /* Stop the Container - it cannot be destroyed till it is stopped */
332 test_containers[i]->shutdown(test_containers[i], CONTAINER_SHUTDOWN_TIMEOUT);
333 /* Call stop() in case shutdown() fails
334 One of these two calls will always succeed */
335 test_containers[i]->stop(test_containers[i]);
336 /* Destroy the Container */
337 test_containers[i]->destroy(test_containers[i]);
338 /* Call destroy_with_snapshots() in case destroy() fails
339 one of these two calls will always succeed */
340 test_containers[i]->destroy_with_snapshots(test_containers[i]);
345 /* Restart all the Containers being used in the current test case i.e. Containers with
346 names beginning with <test-case-name>_<node-name> */
347 void restart_all_containers(void) {
348 char container_name[100];
349 struct lxc_container *test_container;
352 for(i = 0; i < state_ptr->num_nodes; i++) {
353 /* Shutdown, then start the Container, then wait for it to acquire an IP Address */
354 assert(snprintf(container_name, sizeof(container_name), "%s_%s", state_ptr->test_case_name,
355 state_ptr->node_names[i]) >= 0);
356 assert(test_container = find_container(container_name));
357 test_container->shutdown(test_container, CONTAINER_SHUTDOWN_TIMEOUT);
358 test_container->stop(test_container);
359 test_container->start(test_container, 0, NULL);
360 container_wait_ip(i);
364 /* Run the gen_invite command inside the 'inviter' container to generate an invite
365 for 'invitee', and return the generated invite which is output on the terminal */
366 char *invite_in_container(const char *inviter, const char *invitee) {
367 char invite_command[200];
370 assert(snprintf(invite_command, sizeof(invite_command),
371 "LD_LIBRARY_PATH=/home/ubuntu/test/.libs /home/ubuntu/test/gen_invite %s %s "
372 "2> gen_invite.log", inviter, invitee) >= 0);
373 assert(invite_url = run_in_container(invite_command, inviter, false));
374 PRINT_TEST_CASE_MSG("Invite Generated from '%s' to '%s': %s\n", inviter,
375 invitee, invite_url);
380 /* Run the gen_invite command inside the 'inviter' container to generate an invite
381 for 'invitee' belonging to pparticular submesh, and return the generated invite
382 which is output on the terminal */
383 char *submesh_invite_in_container(const char *inviter, const char *invitee, const char *submesh) {
384 char invite_command[200];
387 assert(snprintf(invite_command, sizeof(invite_command),
388 "LD_LIBRARY_PATH=/home/ubuntu/test/.libs /home/ubuntu/test/gen_invite %s %s %s "
389 "2> gen_invite.log", inviter, invitee, submesh) >= 0);
390 assert(invite_url = run_in_container(invite_command, inviter, false));
391 PRINT_TEST_CASE_MSG("Invite Generated from '%s' to '%s': %s\n", inviter,
392 invitee, invite_url);
397 /* Run the node_sim_<nodename> program inside the 'node''s container */
398 void node_sim_in_container(const char *node, const char *device_class, const char *invite_url) {
399 char *node_sim_command;
400 size_t node_sim_command_len;
402 node_sim_command_len = 500 + (invite_url ? strlen(invite_url) : 0);
403 node_sim_command = calloc(1, node_sim_command_len);
404 assert(node_sim_command);
405 assert(snprintf(node_sim_command, node_sim_command_len,
406 "LD_LIBRARY_PATH=/home/ubuntu/test/.libs /home/ubuntu/test/node_sim_%s %s %s %s "
407 "1>&2 2>> node_sim_%s.log", node, node, device_class,
408 (invite_url) ? invite_url : "", node) >= 0);
409 run_in_container(node_sim_command, node, true);
410 PRINT_TEST_CASE_MSG("node_sim_%s started in Container\n", node);
412 free(node_sim_command);
415 /* Run the node_sim_<nodename> program inside the 'node''s container with event handling capable */
416 void node_sim_in_container_event(const char *node, const char *device_class,
417 const char *invite_url, const char *clientId, const char *import) {
418 char *node_sim_command;
419 size_t node_sim_command_len;
421 assert(node && device_class && clientId && import);
422 node_sim_command_len = 500 + (invite_url ? strlen(invite_url) : 0);
423 node_sim_command = calloc(1, node_sim_command_len);
424 assert(node_sim_command);
425 assert(snprintf(node_sim_command, node_sim_command_len,
426 "LD_LIBRARY_PATH=/home/ubuntu/test/.libs /home/ubuntu/test/node_sim_%s %s %s %s %s %s "
427 "1>&2 2>> node_sim_%s.log", node, node, device_class,
428 clientId, import, (invite_url) ? invite_url : "", node) >= 0);
429 run_in_container(node_sim_command, node, true);
430 PRINT_TEST_CASE_MSG("node_sim_%s(Client Id :%s) started in Container with event handling\n%s\n",
431 node, clientId, node_sim_command);
433 free(node_sim_command);
436 /* Run the node_step.sh script inside the 'node''s container to send the 'sig' signal to the
437 node_sim program in the container */
438 void node_step_in_container(const char *node, const char *sig) {
439 char node_step_command[1000];
441 assert(snprintf(node_step_command, sizeof(node_step_command),
442 "/home/ubuntu/test/node_step.sh lt-node_sim_%s %s 1>&2 2> node_step.log",
444 run_in_container(node_step_command, node, false);
445 PRINT_TEST_CASE_MSG("Signal %s sent to node_sim_%s\n", sig, node);
448 /* Change the IP Address of the Container running 'node'
449 Changes begin from X.X.X.254 and continue iteratively till an available address is found */
450 void change_ip(int node) {
454 char *last_dot_in_ip;
455 int last_ip_byte = 254;
457 char copy_command[200];
458 char container_name[100];
459 struct lxc_container *container;
462 /* Get IP Address of LXC Bridge Interface - this will be set up as the Gateway Address
463 of the Static IP assigned to the Container */
464 assert(gateway_addr = get_ip(lxc_bridge));
465 /* Get Netmask of LXC Brdige Interface */
466 assert(netmask = get_netmask(lxc_bridge));
468 /* Replace last byte of Container's IP with 254 to form the new Container IP */
469 assert(container_ips[node]);
470 strncpy(new_ip, container_ips[node], sizeof(new_ip));
471 assert(last_dot_in_ip = strrchr(new_ip, '.'));
472 assert(snprintf(last_dot_in_ip + 1, 4, "%d", last_ip_byte) >= 0);
474 /* Check that the new IP does not match the Container's existing IP
475 if it does, iterate till it doesn't */
476 /* TO DO: Make sure the IP does not conflict with any other running Container */
477 while(strcmp(new_ip, container_ips[node]) == 0) {
479 assert(snprintf(last_dot_in_ip + 1, 4, "%d", last_ip_byte) >= 0);
482 /* Create new 'interfaces' file for Container */
483 assert(if_fp = fopen("interfaces", "w"));
484 fprintf(if_fp, "auto lo\n");
485 fprintf(if_fp, "iface lo inet loopback\n");
486 fprintf(if_fp, "\n");
487 fprintf(if_fp, "auto eth0\n");
488 fprintf(if_fp, "iface eth0 inet static\n");
489 fprintf(if_fp, "\taddress %s\n", new_ip);
490 fprintf(if_fp, "\tnetmask %s\n", netmask);
491 fprintf(if_fp, "\tgateway %s\n", gateway_addr);
492 assert(fclose(if_fp) != EOF);
494 /* Copy 'interfaces' file into Container's /etc/network path */
495 assert(snprintf(copy_command, sizeof(copy_command),
496 "%s/" LXC_UTIL_REL_PATH "/" LXC_COPY_SCRIPT " interfaces %s_%s /etc/network/interfaces",
497 meshlink_root_path, state_ptr->test_case_name, state_ptr->node_names[node]) >= 0);
498 copy_file_stat = system(copy_command);
499 PRINT_TEST_CASE_MSG("Container '%s_%s' 'interfaces' file copy status: %d\n",
500 state_ptr->test_case_name, state_ptr->node_names[node], copy_file_stat);
501 assert(copy_file_stat == 0);
503 /* Restart Container to apply new IP Address */
504 assert(snprintf(container_name, sizeof(container_name), "%s_%s", state_ptr->test_case_name,
505 state_ptr->node_names[node]) >= 0);
506 assert(container = find_container(container_name));
507 container->shutdown(container, CONTAINER_SHUTDOWN_TIMEOUT);
508 /* Call stop() in case shutdown() fails
509 One of these two calls with always succeed */
510 container->stop(container);
511 assert(container->start(container, 0, NULL));
513 strncpy(container_ips[node], new_ip, sizeof(new_ip)); // Save the new IP Address
514 PRINT_TEST_CASE_MSG("Node '%s' IP Address changed to %s\n", state_ptr->node_names[node],
515 container_ips[node]);
518 char **get_container_interface_ips(const char *container_name, const char *interface_name) {
520 struct lxc_container *container = find_container(container_name);
523 char **interfaces = container->get_interfaces(container);
529 for(i = 0; interfaces[i]; i++) {
530 if(!strcasecmp(interfaces[i], interface_name)) {
531 ips = container->get_ips(container, interface_name, "inet", 0);
542 /* Install an app in a container */
543 void install_in_container(const char *node, const char *app) {
544 char install_cmd[100];
546 assert(snprintf(install_cmd, sizeof(install_cmd),
547 "apt-get install %s -y >> /dev/null", app) >= 0);
548 char *ret = run_in_container(install_cmd, node, false);
549 // TODO: Check in container whether app has installed or not with a timeout
553 /* Return container's IP address */
554 char *get_container_ip(const char *node_name) {
558 for(i = 0; i < state_ptr->num_nodes; i++) {
559 if(!strcasecmp(state_ptr->node_names[i], node_name)) {
565 if(i == state_ptr->num_nodes) {
569 n = strlen(container_ips[node]) + 1;
572 strncpy(ip, container_ips[node], n);
577 /* Simulate a network failure by adding NAT rule in the container with it's IP address */
578 void block_node_ip(const char *node) {
582 node_ip = get_container_ip(node);
584 assert(snprintf(block_cmd, sizeof(block_cmd), "iptables -A OUTPUT -p all -s %s -j DROP", node_ip) >= 0);
585 run_in_container(block_cmd, node, false);
587 assert(snprintf(block_cmd, sizeof(block_cmd), "iptables -A INPUT -p all -s %s -j DROP", node_ip) >= 0);
588 run_in_container(block_cmd, node, false);
590 assert(snprintf(block_cmd, sizeof(block_cmd), "iptables -A FORWARD -p all -s %s -j DROP", node_ip) >= 0);
591 run_in_container(block_cmd, node, false);
596 void accept_port_rule(const char *node, const char *chain, const char *protocol, int port) {
599 assert(port >= 0 && port < 65536);
600 assert(!strcmp(chain, "INPUT") || !strcmp(chain, "FORWARD") || !strcmp(chain, "OUTPUT"));
601 assert(!strcmp(protocol, "all") || !strcmp(protocol, "tcp") || !strcmp(protocol, "udp") || !strcmp(protocol, "icmp"));
602 assert(snprintf(block_cmd, sizeof(block_cmd), "iptables -A %s -p %s --dport %d -j ACCEPT", chain, protocol, port) >= 0);
603 run_in_container(block_cmd, node, false);
606 /* Restore the network that was blocked before by the NAT rule with it's own IP address */
607 void unblock_node_ip(const char *node) {
608 char unblock_cmd[100];
611 node_ip = get_container_ip(node);
613 assert(snprintf(unblock_cmd, sizeof(unblock_cmd), "iptables -D OUTPUT -p all -s %s -j DROP", node_ip) >= 0);
614 run_in_container(unblock_cmd, node, false);
616 assert(snprintf(unblock_cmd, sizeof(unblock_cmd), "iptables -D INPUT -p all -s %s -j DROP", node_ip) >= 0);
617 run_in_container(unblock_cmd, node, false);
619 assert(snprintf(unblock_cmd, sizeof(unblock_cmd), "iptables -D FORWARD -p all -s %s -j DROP", node_ip) >= 0);
620 run_in_container(unblock_cmd, node, false);
623 char *block_icmp(const char *container_name) {
625 assert(container_name);
626 assert(snprintf(block_cmd, sizeof(block_cmd), "iptables -A FORWARD -p icmp -j DROP") >= 0);
627 return execute_in_container(block_cmd, container_name, false);
630 char *unblock_icmp(const char *container_name) {
632 assert(container_name);
633 assert(snprintf(block_cmd, sizeof(block_cmd), "iptables -D FORWARD -p icmp -j DROP") >= 0);
634 return execute_in_container(block_cmd, container_name, false);
637 char *change_container_mtu(const char *container_name, const char *interface_name, int mtu) {
639 assert(container_name);
640 assert(snprintf(cmd, sizeof(cmd), "ifconfig %s mtu %d", interface_name, mtu) >= 0);
641 return execute_in_container(cmd, container_name, false);
644 char *flush_conntrack(const char *container_name) {
645 assert(container_name);
647 return execute_in_container("conntrack -F", container_name, false);
650 void flush_nat_rules(const char *container_name, const char *chain) {
654 assert(container_name);
655 assert(snprintf(flush_cmd, sizeof(flush_cmd), "iptables -F %s", chain ? chain : "") >= 0);
656 ret = execute_in_container("iptables -F", container_name, false);
660 void add_full_cone_nat_rules(const char *container_name, const char *pub_interface, const char *priv_interface_listen_address) {
664 char **pub_interface_ips = get_container_interface_ips(container_name, pub_interface);
665 assert(pub_interface_ips[0]);
666 char *pub_interface_ip = pub_interface_ips[0];
668 assert(snprintf(nat_cmd, sizeof(nat_cmd),
669 "%s/" LXC_UTIL_REL_PATH "/" LXC_NAT_FULL_CONE " %s %s %s %s >/dev/null",
670 meshlink_root_path, container_name, pub_interface, pub_interface_ip, priv_interface_listen_address) >= 0);
671 assert(system(nat_cmd) == 0);
672 free(pub_interface_ips);
675 /* Create a NAT and a bridge, bridge connected to NAT and containers to be NATed can be switched
676 to the NAT bridge from lxcbr0 */
677 void nat_create(const char *nat_name, const char *nat_bridge, int nat_type) {
678 char build_command[200];
679 assert(snprintf(build_command, sizeof(build_command),
680 "%s/" LXC_UTIL_REL_PATH "/" LXC_NAT_BUILD " %s %s %s >/dev/stderr",
681 meshlink_root_path, nat_name, nat_bridge, meshlink_root_path) >= 0);
682 assert(system(build_command) == 0);
685 void nat_destroy(const char *nat_name) {
686 char build_command[200];
687 assert(snprintf(build_command, sizeof(build_command),
688 "%s/" LXC_UTIL_REL_PATH "/" LXC_NAT_DESTROY " %s +x >/dev/null",
689 meshlink_root_path, nat_name) >= 0);
690 assert(system(build_command) == 0);
693 /* Switches a container from current bridge to a new bridge */
694 void container_switch_bridge(const char *container_name, char *lxc_conf_path, const char *current_bridge, const char *new_bridge) {
695 char config_path[500];
697 struct lxc_container *container;
701 PRINT_TEST_CASE_MSG("Switiching container %s from bridge '%s' to bridge '%s'", container_name, current_bridge, new_bridge);
702 lxc_path_temp = lxc_path;
703 lxc_path = lxc_conf_path;
704 container = find_container(container_name);
706 lxc_path = lxc_path_temp;
707 assert(snprintf(config_path, sizeof(config_path), "%s/%s/config", lxc_conf_path, container_name) >= 0);
708 FILE *fp = fopen(config_path, "r");
710 FILE *fp_temp = fopen(".temp_file", "w");
713 char search_str[500];
716 while((fgets(buffer, sizeof(buffer), fp)) != NULL) {
717 if(sscanf(buffer, "lxc.net.%d.link", &net_no) == 1) {
721 if((ptr = strstr(buffer, current_bridge)) != NULL) {
722 len = strlen(current_bridge);
724 if(((*(ptr - 1) == ' ') || (*(ptr - 1) == '\t') || (*(ptr - 1) == '=')) && ((ptr[len] == '\n') || (ptr[len] == '\t') || (ptr[len] == '\0') || (ptr[len] == ' '))) {
725 sprintf(buffer, "lxc.net.%d.link = %s\n", net_no, new_bridge);
730 fputs(buffer, fp_temp);
736 rename(".temp_file", config_path);
738 /* Restart the Container after building it and wait for it to acquire an IP */
741 assert(snprintf(cmd, sizeof(cmd), "lxc-stop %s", container_name) >= 0);
742 sys_ret = system(cmd);
743 assert(snprintf(cmd, sizeof(cmd), "lxc-start %s", container_name) >= 0);
744 sys_ret = system(cmd);
745 assert(sys_ret == 0);
746 ip = container_wait_ip_ex(container_name);
747 PRINT_TEST_CASE_MSG("Obtained IP address: %s for container %s after switching bridge", ip, container_name);
751 /* Takes bridgeName as input parameter and creates a bridge */
752 void create_bridge(const char *bridgeName) {
753 char command[100] = "brctl addbr ";
754 strcat(command, bridgeName);
755 int create_bridge_status = system(command);
756 assert(create_bridge_status == 0);
757 PRINT_TEST_CASE_MSG("%s bridge created\n", bridgeName);
760 /* Add interface for the bridge created */
761 void add_interface(const char *bridgeName, const char *interfaceName) {
762 char command[100] = "brctl addif ";
763 char cmd[100] = "dhclient ";
765 strcat(command, bridgeName);
766 strcat(command, " ");
767 strcat(command, interfaceName);
768 int addif_status = system(command);
769 assert(addif_status == 0);
770 strcat(cmd, bridgeName);
771 int dhclient_status = system(cmd);
772 assert(dhclient_status == 0);
773 PRINT_TEST_CASE_MSG("Added interface for %s\n", bridgeName);
776 /* Create a veth pair and bring them up */
777 void add_veth_pair(const char *vethName1, const char *vethName2) {
778 char command[100] = "ip link add ";
779 char upCommand1[100] = "ip link set ";
780 char upCommand2[100] = "ip link set ";
782 strcat(command, vethName1);
783 strcat(command, " type veth peer name ");
784 strcat(command, vethName2);
785 int link_add_status = system(command);
786 assert(link_add_status == 0);
787 strcat(upCommand1, vethName1);
788 strcat(upCommand1, " up");
789 int link_set_veth1_status = system(upCommand1);
790 assert(link_set_veth1_status == 0);
791 strcat(upCommand2, vethName2);
792 strcat(upCommand2, " up");
793 int link_set_veth2_status = system(upCommand2);
794 assert(link_set_veth2_status == 0);
795 PRINT_TEST_CASE_MSG("Added veth pairs %s and %s\n", vethName1, vethName2);
798 /* Bring the interface up for the bridge created */
799 void bring_if_up(const char *bridgeName) {
800 char command[300] = "ifconfig ";
801 char dhcommand[300] = "dhclient ";
802 strcat(command, bridgeName);
803 strcat(command, " up");
804 int if_up_status = system(command);
805 assert(if_up_status == 0);
807 PRINT_TEST_CASE_MSG("Interface brought up for %s created\n", bridgeName);
811 * Replace all occurrences of a given a word in string.
813 void replaceAll(char *str, const char *oldWord, const char *newWord) {
814 char *pos, temp[BUFSIZ];
817 owlen = strlen(oldWord);
819 while((pos = strstr(str, oldWord)) != NULL) {
823 strcat(str, newWord);
824 strcat(str, temp + index + owlen);
828 /* Switches the bridge for a given container */
829 void switch_bridge(const char *containerName, const char *currentBridge, const char *newBridge) {
830 char command[100] = "lxc-stop -n ";
831 char command_start[100] = "lxc-start -n ";
832 PRINT_TEST_CASE_MSG("Switching %s container to %s\n", containerName, newBridge);
833 strcat(command, containerName);
834 strcat(command_start, containerName);
835 int container_stop_status = system(command);
836 assert(container_stop_status == 0);
840 char path[300] = "/var/lib/lxc/";
841 strcat(path, containerName);
842 strcat(path, "/config");
845 /* Open all required files */
846 fPtr = fopen(path, "r");
847 fTemp = fopen("replace.tmp", "w");
849 if(fPtr == NULL || fTemp == NULL) {
850 PRINT_TEST_CASE_MSG("\nUnable to open file.\n");
851 PRINT_TEST_CASE_MSG("Please check whether file exists and you have read/write privilege.\n");
855 while((fgets(buffer, BUFSIZ, fPtr)) != NULL) {
856 replaceAll(buffer, currentBridge, newBridge);
857 fputs(buffer, fTemp);
863 rename("replace.tmp", path);
864 PRINT_TEST_CASE_MSG("Switching procedure done successfully\n");
865 int container_start_status = system(command_start);
866 assert(container_start_status == 0);
870 /* Bring the interface down for the bridge created */
871 void bring_if_down(const char *bridgeName) {
872 char command[300] = "ip link set dev ";
873 strcat(command, bridgeName);
874 strcat(command, " down");
875 int if_down_status = system(command);
876 assert(if_down_status == 0);
877 PRINT_TEST_CASE_MSG("Interface brought down for %s created\n", bridgeName);
880 /* Delete interface for the bridge created */
881 void del_interface(const char *bridgeName, const char *interfaceName) {
882 char command[300] = "brctl delif ";
883 strcat(command, bridgeName);
884 strcat(command, interfaceName);
885 int if_delete_status = system(command);
886 assert(if_delete_status == 0);
887 PRINT_TEST_CASE_MSG("Deleted interface for %s\n", bridgeName);
890 /* Takes bridgeName as input parameter and deletes a bridge */
891 void delete_bridge(const char *bridgeName) {
892 bring_if_down(bridgeName);
893 char command[300] = "brctl delbr ";
894 strcat(command, bridgeName);
895 int bridge_delete = system(command);
896 assert(bridge_delete == 0);
897 PRINT_TEST_CASE_MSG("%s bridge deleted\n", bridgeName);
901 /* Creates container on a specified bridge with added interface */
902 void create_container_on_bridge(const char *containerName, const char *bridgeName, const char *ifName) {
903 char command[100] = "lxc-create -t download -n ";
904 char cmd[100] = " -- -d ubuntu -r trusty -a ";
905 char start[100] = "lxc-start -n ";
907 char path[300] = "/var/lib/lxc/";
908 strcat(path, containerName);
909 strcat(path, "/config");
910 strcat(command, containerName);
911 strcat(command, cmd);
912 strcat(command, choose_arch);
913 int container_create_status = system(command);
914 assert(container_create_status == 0);
916 assert(fPtr = fopen(path, "a+"));
917 fprintf(fPtr, "lxc.net.0.name = eth0\n");
919 fprintf(fPtr, "lxc.net.1.type = veth\n");
920 fprintf(fPtr, "lxc.net.1.flags = up\n");
921 fprintf(fPtr, "lxc.net.1.link = %s\n", bridgeName);
922 fprintf(fPtr, "lxc.net.1.name = %s\n", ifName);
923 fprintf(fPtr, "lxc.net.1.hwaddr = 00:16:3e:ab:xx:xx\n");
925 strcat(start, containerName);
926 int container_start_status = system(start);
927 assert(container_start_status == 0);
929 PRINT_TEST_CASE_MSG("Created %s on %s with interface name %s\n", containerName, bridgeName, ifName);
932 /* Configures dnsmasq and iptables for the specified container with inputs of listen address and dhcp range */
933 void config_dnsmasq(const char *containerName, const char *ifName, const char *listenAddress, const char *dhcpRange) {
934 char command[500] = "echo \"apt-get install dnsmasq iptables -y\" | lxc-attach -n ";
935 strcat(command, containerName);
936 strcat(command, " --");
937 int iptables_install_status = system(command);
938 assert(iptables_install_status == 0);
940 char com1[300] = "echo \"echo \"interface=eth1\" >> /etc/dnsmasq.conf\" | lxc-attach -n ";
941 strcat(com1, containerName);
943 int dnsmasq_status = system(com1);
944 assert(dnsmasq_status == 0);
946 char com2[300] = "echo \"echo \"bind-interfaces\" >> /etc/dnsmasq.conf\" | lxc-attach -n ";
947 strcat(com2, containerName);
949 dnsmasq_status = system(com2);
950 assert(dnsmasq_status == 0);
952 char com3[300] = "echo \"echo \"listen-address=";
953 strcat(com3, listenAddress);
954 strcat(com3, "\" >> /etc/dnsmasq.conf\" | lxc-attach -n ");
955 strcat(com3, containerName);
957 dnsmasq_status = system(com3);
958 assert(dnsmasq_status == 0);
960 char com4[300] = "echo \"echo \"dhcp-range=";
961 strcat(com4, dhcpRange);
962 strcat(com4, "\" >> /etc/dnsmasq.conf\" | lxc-attach -n ");
963 strcat(com4, containerName);
965 dnsmasq_status = system(com4);
966 assert(dnsmasq_status == 0);
968 char cmd[300] = "echo \"ifconfig ";
971 strcat(cmd, listenAddress);
972 strcat(cmd, " netmask 255.255.255.0 up\" | lxc-attach -n ");
973 strcat(cmd, containerName);
975 dnsmasq_status = system(cmd);
976 assert(dnsmasq_status == 0);
978 char com[500] = "echo \"service dnsmasq restart >> /dev/null\" | lxc-attach -n ";
979 strcat(com, containerName);
981 dnsmasq_status = system(com);
982 assert(dnsmasq_status == 0);
984 PRINT_TEST_CASE_MSG("Configured dnsmasq in %s with interface name %s, listen-address = %s, dhcp-range = %s\n", containerName, ifName, listenAddress, dhcpRange);
987 /* Configure the NAT rules inside the container */
988 void config_nat(const char *containerName, const char *listenAddress) {
989 char *last_dot_in_ip;
990 int last_ip_byte = 0;
991 char new_ip[300] = {0};
992 strncpy(new_ip, listenAddress, sizeof(new_ip));
993 assert(last_dot_in_ip = strrchr(new_ip, '.'));
994 assert(snprintf(last_dot_in_ip + 1, 4, "%d", last_ip_byte) >= 0);
995 char comd[300] = "echo \"iptables -t nat -A POSTROUTING -s ";
996 strcat(comd, new_ip);
997 strcat(comd, "/24 ! -d ");
998 strcat(comd, new_ip);
999 strcat(comd, "/24 -j MASQUERADE\" | lxc-attach -n ");
1000 strcat(comd, containerName);
1001 strcat(comd, " --");
1002 int conf_nat_status = system(comd);
1003 assert(conf_nat_status == 0);
1005 PRINT_TEST_CASE_MSG("Configured NAT on %s\n", containerName);
1008 /* Creates a NAT layer on a specified bridge with certain dhcp range to allocate ips for nodes */
1009 void create_nat_layer(const char *containerName, const char *bridgeName, const char *ifName, const char *listenAddress, char *dhcpRange) {
1010 create_bridge(bridgeName);
1011 bring_if_up(bridgeName);
1012 create_container_on_bridge(containerName, bridgeName, ifName);
1013 config_dnsmasq(containerName, ifName, listenAddress, dhcpRange);
1014 config_nat(containerName, listenAddress);
1015 PRINT_TEST_CASE_MSG("NAT layer created with %s\n", containerName);
1018 /* Destroys the NAT layer created */
1019 void destroy_nat_layer(const char *containerName, const char *bridgeName) {
1020 bring_if_down(bridgeName);
1021 delete_bridge(bridgeName);
1022 char command[100] = "lxc-stop -n ";
1023 strcat(command, containerName);
1024 int container_stop_status = system(command);
1025 assert(container_stop_status == 0);
1026 char destroy[100] = "lxc-destroy -n ";
1027 strcat(destroy, containerName);
1028 strcat(destroy, " -s");
1029 int container_destroy_status = system(destroy);
1030 assert(container_destroy_status == 0);
1031 PRINT_TEST_CASE_MSG("NAT layer destroyed with %s\n", containerName);
1034 /* Add incoming firewall rules for ipv4 addresses with packet type and port number */
1035 void incoming_firewall_ipv4(const char *packetType, int portNumber) {
1037 snprintf(buf, sizeof(buf), "%d", portNumber);
1038 assert(system("iptables -F") == 0);
1039 assert(system("iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") == 0);
1040 assert(system("iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT") == 0);
1041 char command[100] = "iptables -A INPUT -p ";
1042 strcat(command, packetType);
1043 strcat(command, " --dport ");
1044 strcat(command, buf);
1045 strcat(command, " -j ACCEPT");
1046 assert(system(command) == 0);
1048 assert(system("iptables -A INPUT -j DROP") == 0);
1049 PRINT_TEST_CASE_MSG("Firewall for incoming requests added on IPv4");
1050 assert(system("iptables -L") == 0);
1053 /* Add incoming firewall rules for ipv6 addresses with packet type and port number */
1054 void incoming_firewall_ipv6(const char *packetType, int portNumber) {
1056 snprintf(buf, sizeof(buf), "%d", portNumber);
1057 assert(system("ip6tables -F") == 0);
1058 assert(system("ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") == 0);
1059 assert(system("ip6tables -A INPUT -s ::1 -d ::1 -j ACCEPT") == 0);
1060 char command[100] = "ip6tables -A INPUT -p ";
1061 strcat(command, packetType);
1062 strcat(command, " --dport ");
1063 strcat(command, buf);
1064 strcat(command, " -j ACCEPT");
1065 assert(system(command) == 0);
1067 assert(system("ip6tables -A INPUT -j DROP") == 0);
1068 PRINT_TEST_CASE_MSG("Firewall for incoming requests added on IPv6");
1069 assert(system("ip6tables -L") == 0);
1072 /* Add outgoing firewall rules for ipv4 addresses with packet type and port number */
1073 void outgoing_firewall_ipv4(const char *packetType, int portNumber) {
1075 snprintf(buf, sizeof(buf), "%d", portNumber);
1076 assert(system("iptables -F") == 0);
1077 assert(system("iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") == 0);
1078 assert(system("iptables -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT") == 0);
1079 char command[100] = "iptables -A OUTPUT -p ";
1080 strcat(command, packetType);
1081 strcat(command, " --dport ");
1082 strcat(command, buf);
1083 strcat(command, " -j ACCEPT");
1084 assert(system(command) == 0);
1086 assert(system("iptables -A OUTPUT -j DROP") == 0);
1087 PRINT_TEST_CASE_MSG("Firewall for outgoing requests added on IPv4");
1088 assert(system("iptables -L") == 0);
1091 /* Add outgoing firewall rules for ipv6 addresses with packet type and port number */
1092 void outgoing_firewall_ipv6(const char *packetType, int portNumber) {
1094 snprintf(buf, sizeof(buf), "%d", portNumber);
1095 assert(system("ip6tables -F") == 0);
1096 assert(system("ip6tables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") == 0);
1097 assert(system("ip6tables -A OUTPUT -s ::1 -d ::1 -j ACCEPT") == 0);
1098 char command[100] = "ip6tables -A OUTPUT -p ";
1099 strcat(command, packetType);
1100 strcat(command, " --dport ");
1101 strcat(command, buf);
1102 strcat(command, " -j ACCEPT");
1103 assert(system(command) == 0);
1105 assert(system("ip6tables -A OUTPUT -j DROP") == 0);
1106 PRINT_TEST_CASE_MSG("Firewall for outgoing requests added on IPv6");
1107 assert(system("ip6tables -L") == 0);
1110 void bridge_add(const char *bridge_name) {
1113 assert(bridge_name);
1114 assert(snprintf(cmd, sizeof(cmd), "brctl addbr %s", bridge_name) >= 0);
1115 assert(system(cmd) == 0);
1116 assert(snprintf(cmd, sizeof(cmd), "ifconfig %s up", bridge_name) >= 0);
1117 assert(system(cmd) == 0);
1120 void bridge_delete(const char *bridge_name) {
1123 assert(bridge_name);
1124 assert(snprintf(cmd, sizeof(cmd), "brctl delbr %s", bridge_name) >= 0);
1125 assert(system(cmd) == 0);
1128 void bridge_add_interface(const char *bridge_name, const char *interface_name) {
1131 assert(bridge_name || interface_name);
1132 assert(snprintf(cmd, sizeof(cmd), "brctl addif %s %s", bridge_name, interface_name) >= 0);
1133 assert(system(cmd) == 0);