add new netup script and designnet

- design.md: new design idea to integrate all commands into wjail
  executable.
- netup.sh: add all steps and options as used now.
- netupgrade.sh: add upgrade steps that need to move to netup.sh
- netdowngrade.sh: add downgrade steps that will move to netup.sh

Signed-off-by: Aiden Woodruff <aiden@aidenw.net>

4 files changed, 118 insertions, 24 deletions

diff --git a/design.md b/design.md
new file mode 100644
index 0000000..26364d9
--- /dev/null
+++ b/design.md
@@ -0,0 +1,7 @@
+wjail start
+      stop
+      attach
+      net create
+          delete
+          masq
+          unmasq
diff --git a/netdowngrade.sh b/netdowngrade.sh
new file mode 100755
index 0000000..7b5ae3f
--- /dev/null
+++ b/netdowngrade.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+echo Removing iptables rule
+iptables -t nat -D POSTROUTING -s 10.2.1.1/24 -j MASQUERADE
+echo Remove container default gateway.
+ip netns exec www route del default gw 10.2.1.1
+echo Bring virtual interfaces down.
+ip netns exec www ip link set veth0 down
+ip link set veth-wjail-www down
diff --git a/netup.sh b/netup.sh
index 43a6c08..bd9ded8 100755
--- a/netup.sh
+++ b/netup.sh
@@ -1,41 +1,112 @@
 #!/bin/sh
 
-if [ "$(id -u)" -ne 0 ]; then
-echo "You are not root."
-exit 1
+# OPTIONS
+netup_host_ifname=
+netup_host_addr=10.1.1.1
+netup_ns=
+netup_ns_ifname=
+netup_ns_addr=10.1.1.2
+netup_pid=
+netup_pidfile=
+netup_quiet=
+netup_sandbox=
+print_usage () {
+        cat <<EOF
+USAGE: $0 [-fFhiInpPqs] ( (-p PIDFILE | -P PID) | (-u | -d) )
+EOF
+}
+print_help () {
+        cat <<EOF
+-f IFNAME   Set host interface name
+-F IFNAME   Set container interface name.
+-h          Print this help message.
+-i ADDR     Set host address (which is also the container default gateway,
+            except in sandbox mode).
+-I ADDR     Set container address.
+-n NETNS    Name for newly created network namespace to create
+-p PIDFILE  Container pidfile.
+-P PID      Container PID.
+-q          Quiet mode.
+-s          Sandbox mode (do not setup container gateway or NAT forwarding)
+EOF
+}
+OPTIND=0
+while getopts 'f:F:hi:I:n:p:P:qs' opt; do
+        case $opt in
+        f) netup_host_ifname=$OPTARG ;;
+        F) netup_ns_ifname=$OPTARG ;;
+        h) print_usage; print_help; exit 1 ;;
+        i) netup_host_addr=$OPTARG ;;
+        I) netup_ns_addr=$OPTARG ;;
+        n) netup_ns=$OPTARG ;;
+        p) netup_pidfile="$OPTARG" ;;
+        P) netup_pid=$OPTARG ;;
+        q) netup_quiet=1 ;;
+        s) netup_sandbox=1 ;;
+        ?) print_usage $0; exit 1 ;;
+        *) print_usage $0; exit 1 ;;
+        esac
+done
+shift $((OPTIND - 1))
+if [ "x$netup_ns" = x ]; then
+        echo "$0: Network namespace name (-n) is required." 2>&1
+        print_usage $0
+        exit 1
+elif [ "x$netup_pid" = x ] && [ "x$netup_pidfile" = x ]; then
+        echo "Exactly one of -p or -P must be specified." 2>&1
+        print_usage $0
+        exit 1
+elif [ "x$netup_pid" != x ] && [ "x$netup_pidfile" != x ]; then
+        echo "Exactly one of -p or -P must be specified." 2>&1
+        print_usage $0
+        exit 1
 fi
 
-pidfile=/srv/gitbot/wjail.pid
+if [ "$(id -u)" -ne 0 ]; then
+        echo "You are not root."
+        exit 1
+fi
 
-if ! [ -f "$pidfile" ]; then
-echo "wjail not running."
-exit 1
+if [ "x$netup_pidfile" != x ]; then
+        if ! netup_pid="$(cat "$netup_pidfile" 2>/dev/null)"; then
+                echo "$0: pidfile $netup_pidfile cannot be read." 3>&1
+                exit 1
+        fi
 fi
 
-PID="$(cat "$pidfile")"
+message () {
+        if ! [ "$netns_quiet" ]; then
+                echo $*
+        fi
+}
 
-# Attach iproute2 netns
-ip netns attach gitbot $PID
+message [STATUS] Create container namespace name.
+ip netns attach $netup_ns $netup_pid
 
-# Add veth devices
-ip link add veth-wjail type veth peer veth0 netns gitbot
+message [STATUS] Create veth devices.
+ip link add $netup_host_ifname type veth peer $netup_ns_ifname netns $netup_ns
 
-# Assign ip addresses
-ip addr add 10.1.1.1/24 dev veth-wjail
-ip netns exec gitbot ip addr add 10.1.1.2/24 dev veth0
+message [STATUS] Assign ip addresses.
+ip addr add $netup_host_addr/24 dev $netup_host_ifname
+ip netns exec $netup_ns ip addr add $netup_ns_addr/24 dev $netup_ns_ifname
 
-# Bring interfaces up
-ip link set veth-wjail up
-ip netns exec gitbot ip link set veth0 up
+message [STATUS] Bring veth interfaces up.
+ip link set $netup_host_ifname up
+ip netns exec $netup_ns ip link set $netup_ns_ifname up
 
-# Assign default gateway
-ip netns exec gitbot route add default gw 10.1.1.1
+if [ "$netup_sandbox" ]; then
+        message [STATUS] Adding firewall rule to block forwarded connections.
+        iptables -I FORWARD 1 -i $netup_host_ifname -o !$netup_host_ifname -j DROP
+else
+        message [STATUS] Enabling IP forwarding.
+        echo 1 > /proc/sys/net/ipv4/ip_forward
 
-# Enable IP forwarding
-echo 1 > /proc/sys/net/ipv4/ip_forward
+        message [STATUS] Add NAT forwarding rule.
+        iptables -t nat -A POSTROUTING -s $netup_ns_addr/24 -j MASQUERADE
 
-# Add NAT forwarding rule
-iptables -t nat -A POSTROUTING -s 10.1.1.2/16 -j MASQUERADE
+        message [STATUS] Assigning container default gateway.
+        ip netns exec $netup_ns route add default gw $netup_host_addr
+fi
 
 #####################################################################
 # If there are "no route to host" errors in the container, check:
diff --git a/netupgrade.sh b/netupgrade.sh
new file mode 100755
index 0000000..6164d9f
--- /dev/null
+++ b/netupgrade.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+echo Bringing virtual interfaces up.
+ip link set veth-wjail-www up
+ip netns exec www ip link set veth0 up
+echo Adding container default gateway.
+ip netns exec www route add default gw 10.2.1.1
+echo Add iptables masquerade
+iptables -t nat -A POSTROUTING -s 10.2.1.1/24 -j MASQUERADE