cgroup-network-helper.sh 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258
  1. #!/usr/bin/env bash
  2. # shellcheck disable=SC1117
  3. # cgroup-network-helper.sh
  4. # detect container and virtual machine interfaces
  5. #
  6. # (C) 2017 Costa Tsaousis
  7. # SPDX-License-Identifier: GPL-3.0-or-later
  8. #
  9. # This script is called as root (by cgroup-network), with either a pid, or a cgroup path.
  10. # It tries to find all the network interfaces that belong to the same cgroup.
  11. #
  12. # It supports several method for this detection:
  13. #
  14. # 1. cgroup-network (the binary father of this script) detects veth network interfaces,
  15. # by examining iflink and ifindex IDs and switching namespaces
  16. # (it also detects the interface name as it is used by the container).
  17. #
  18. # 2. this script, uses /proc/PID/fdinfo to find tun/tap network interfaces.
  19. #
  20. # 3. this script, calls virsh to find libvirt network interfaces.
  21. #
  22. # -----------------------------------------------------------------------------
  23. # the system path is cleared by cgroup-network
  24. # shellcheck source=/dev/null
  25. [ -f /etc/profile ] && source /etc/profile
  26. export LC_ALL=C
  27. PROGRAM_NAME="$(basename "${0}")"
  28. logdate() {
  29. date "+%Y-%m-%d %H:%M:%S"
  30. }
  31. log() {
  32. local status="${1}"
  33. shift
  34. echo >&2 "$(logdate): ${PROGRAM_NAME}: ${status}: ${*}"
  35. }
  36. warning() {
  37. log WARNING "${@}"
  38. }
  39. error() {
  40. log ERROR "${@}"
  41. }
  42. info() {
  43. log INFO "${@}"
  44. }
  45. fatal() {
  46. log FATAL "${@}"
  47. exit 1
  48. }
  49. debug=0
  50. debug() {
  51. [ "${debug}" = "1" ] && log DEBUG "${@}"
  52. }
  53. # -----------------------------------------------------------------------------
  54. # check for BASH v4+ (required for associative arrays)
  55. [ $(( BASH_VERSINFO[0] )) -lt 4 ] && \
  56. fatal "BASH version 4 or later is required (this is ${BASH_VERSION})."
  57. # -----------------------------------------------------------------------------
  58. # parse the arguments
  59. pid=
  60. cgroup=
  61. while [ ! -z "${1}" ]
  62. do
  63. case "${1}" in
  64. --cgroup) cgroup="${2}"; shift 1;;
  65. --pid|-p) pid="${2}"; shift 1;;
  66. --debug|debug) debug=1;;
  67. *) fatal "Cannot understand argument '${1}'";;
  68. esac
  69. shift
  70. done
  71. if [ -z "${pid}" ] && [ -z "${cgroup}" ]
  72. then
  73. fatal "Either --pid or --cgroup is required"
  74. fi
  75. # -----------------------------------------------------------------------------
  76. set_source() {
  77. [ ${debug} -eq 1 ] && echo "SRC ${*}"
  78. }
  79. # -----------------------------------------------------------------------------
  80. # veth interfaces via cgroup
  81. # cgroup-network can detect veth interfaces by itself (written in C).
  82. # If you seek for a shell version of what it does, check this:
  83. # https://github.com/netdata/netdata/issues/474#issuecomment-317866709
  84. # -----------------------------------------------------------------------------
  85. # tun/tap interfaces via /proc/PID/fdinfo
  86. # find any tun/tap devices linked to a pid
  87. proc_pid_fdinfo_iff() {
  88. local p="${1}" # the pid
  89. debug "Searching for tun/tap interfaces for pid ${p}..."
  90. set_source "fdinfo"
  91. grep "^iff:.*" "${NETDATA_HOST_PREFIX}/proc/${p}/fdinfo"/* 2>/dev/null | cut -f 2
  92. }
  93. find_tun_tap_interfaces_for_cgroup() {
  94. local c="${1}" # the cgroup path
  95. # for each pid of the cgroup
  96. # find any tun/tap devices linked to the pid
  97. if [ -f "${c}/emulator/cgroup.procs" ]
  98. then
  99. local p
  100. for p in $(< "${c}/emulator/cgroup.procs" )
  101. do
  102. proc_pid_fdinfo_iff "${p}"
  103. done
  104. fi
  105. }
  106. # -----------------------------------------------------------------------------
  107. # virsh domain network interfaces
  108. virsh_cgroup_to_domain_name() {
  109. local c="${1}" # the cgroup path
  110. debug "extracting a possible virsh domain from cgroup ${c}..."
  111. # extract for the cgroup path
  112. sed -n -e "s|.*/machine-qemu\\\\x2d[0-9]\+\\\\x2d\(.*\)\.scope$|\1|p" \
  113. -e "s|.*/machine/\(.*\)\.libvirt-qemu$|\1|p" \
  114. <<EOF
  115. ${c}
  116. EOF
  117. }
  118. virsh_find_all_interfaces_for_cgroup() {
  119. local c="${1}" # the cgroup path
  120. # the virsh command
  121. local virsh
  122. # shellcheck disable=SC2230
  123. virsh="$(which virsh 2>/dev/null || command -v virsh 2>/dev/null)"
  124. if [ ! -z "${virsh}" ]
  125. then
  126. local d
  127. d="$(virsh_cgroup_to_domain_name "${c}")"
  128. if [ ! -z "${d}" ]
  129. then
  130. debug "running: virsh domiflist ${d}; to find the network interfaces"
  131. # match only 'network' interfaces from virsh output
  132. set_source "virsh"
  133. "${virsh}" -r domiflist "${d}" |\
  134. sed -n \
  135. -e "s|^\([^[:space:]]\+\)[[:space:]]\+network[[:space:]]\+\([^[:space:]]\+\)[[:space:]]\+[^[:space:]]\+[[:space:]]\+[^[:space:]]\+$|\1 \1_\2|p" \
  136. -e "s|^\([^[:space:]]\+\)[[:space:]]\+bridge[[:space:]]\+\([^[:space:]]\+\)[[:space:]]\+[^[:space:]]\+[[:space:]]\+[^[:space:]]\+$|\1 \1_\2|p"
  137. else
  138. debug "no virsh domain extracted from cgroup ${c}"
  139. fi
  140. else
  141. debug "virsh command is not available"
  142. fi
  143. }
  144. # -----------------------------------------------------------------------------
  145. find_all_interfaces_of_pid_or_cgroup() {
  146. local p="${1}" c="${2}" # the pid and the cgroup path
  147. if [ ! -z "${pid}" ]
  148. then
  149. # we have been called with a pid
  150. proc_pid_fdinfo_iff "${p}"
  151. elif [ ! -z "${c}" ]
  152. then
  153. # we have been called with a cgroup
  154. info "searching for network interfaces of cgroup '${c}'"
  155. find_tun_tap_interfaces_for_cgroup "${c}"
  156. virsh_find_all_interfaces_for_cgroup "${c}"
  157. else
  158. error "Either a pid or a cgroup path is needed"
  159. return 1
  160. fi
  161. return 0
  162. }
  163. # -----------------------------------------------------------------------------
  164. # an associative array to store the interfaces
  165. # the index is the interface name as seen by the host
  166. # the value is the interface name as seen by the guest / container
  167. declare -A devs=()
  168. # store all interfaces found in the associative array
  169. # this will also give the unique devices, as seen by the host
  170. last_src=
  171. # shellcheck disable=SC2162
  172. while read host_device guest_device
  173. do
  174. [ -z "${host_device}" ] && continue
  175. [ "${host_device}" = "SRC" ] && last_src="${guest_device}" && continue
  176. # the default guest_device is the host_device
  177. [ -z "${guest_device}" ] && guest_device="${host_device}"
  178. # when we run in debug, show the source
  179. debug "Found host device '${host_device}', guest device '${guest_device}', detected via '${last_src}'"
  180. if [ -z "${devs[${host_device}]}" ] || [ "${devs[${host_device}]}" = "${host_device}" ]; then
  181. devs[${host_device}]="${guest_device}"
  182. fi
  183. done < <( find_all_interfaces_of_pid_or_cgroup "${pid}" "${cgroup}" )
  184. # print the interfaces found, in the format netdata expects them
  185. found=0
  186. for x in "${!devs[@]}"
  187. do
  188. found=$((found + 1))
  189. echo "${x} ${devs[${x}]}"
  190. done
  191. debug "found ${found} network interfaces for pid '${pid}', cgroup '${cgroup}', run as ${USER}, ${UID}"
  192. # let netdata know if we found any
  193. [ ${found} -eq 0 ] && exit 1
  194. exit 0