Commit ccd5267a authored by Leigh B. Stoller's avatar Leigh B. Stoller

Add nat rule for sshd inside container. Allows ssh to the physical

host by port number, which is redirected into the container.
parent 359214cb
......@@ -57,7 +57,8 @@ sub Cleanup();
# Locals
my $CTRLIPFILE = "/var/emulab/boot/myip";
my $VMPATH = "/var/emulab/vms";
my $IPTABLES = "/sbin/iptables";
#
# Parse command arguments. Once we return from getopts, all that should be
# left are the required arguments.
......@@ -260,6 +261,16 @@ else {
$rebooting = 1;
}
my $cnet_mac = ipToMac($vnconfig{'CTRLIP'});
my $ext_ctrlip = `cat $CTRLIPFILE`;
chomp($ext_ctrlip);
if ($ext_ctrlip !~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/) {
# cannot/should not really go on if this happens.
MyFatal("error prior to vnodePreConfigControlNetwork($vnodeid): " .
" could not find valid ip in $CTRLIPFILE!");
}
my $longdomain = "${eid}.${pid}.${DOMAINNAME}";
#
# Call back to do things to the container before it boots.
#
......@@ -274,6 +285,21 @@ sub callback($)
return -1;
}
}
#
# Set up sshd port to listen on. If the vnode has its own IP
# then listen on both 22 and the per-vnode port.
#
if (system('grep -q -e EmulabJail $path/etc/ssh/sshd_config')) {
if (exists($vnconfig{'SSHDPORT'}) && $vnconfig{'SSHDPORT'} ne "") {
my $sshdport = $vnconfig{'SSHDPORT'};
system("echo '# EmulabJail' >> $path/etc/ssh/sshd_config");
system("echo 'Port $sshdport' >> $path/etc/ssh/sshd_config");
if ($vnconfig{'CTRLIP'} ne $ext_ctrlip) {
system("echo 'Port 22' >> $path/etc/ssh/sshd_config");
}
}
}
return 0;
}
......@@ -283,16 +309,6 @@ if (safeLibOp($vnodeid,'vnodePreConfig',1,1,$vnodeid,$vmid,\&callback)) {
}
# OP: control net preconfig
my $cnet_mac = ipToMac($vnconfig{'CTRLIP'});
my $ext_ctrlip = `cat $CTRLIPFILE`;
chomp($ext_ctrlip);
if ($ext_ctrlip !~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/) {
# cannot/should not really go on if this happens.
MyFatal("error prior to vnodePreConfigControlNetwork($vnodeid): " .
" could not find valid ip in $CTRLIPFILE!");
}
my $longdomain = "${eid}.${pid}.${DOMAINNAME}";
if (safeLibOp($vnodeid,'vnodePreConfigControlNetwork',1,1,
$vnodeid,$vmid,$vnconfig{'CTRLIP'},
$vnconfig{'CTRLMASK'},$cnet_mac,
......@@ -313,6 +329,17 @@ if (safeLibOp($vnodeid,'vnodeConfigDevices',1,1,$vnodeid,$vmid)) {
MyFatal("vnodeConfigDevices failed");
}
#
# Route to inner sshd
#
if (exists($vnconfig{'SSHDPORT'}) && $vnconfig{'SSHDPORT'} ne "") {
my $sshdport = $vnconfig{'SSHDPORT'};
my $ctrlip = $vnconfig{'CTRLIP'};
system("$IPTABLES -v -t nat -A PREROUTING -p tcp -d $ext_ctrlip ".
"--dport $sshdport -j DNAT --to-destination $ctrlip:$sshdport");
}
#
# Start the container. If all goes well, this will exit cleanly, with the
# it running in its new context. Still, lets protect it with a timer
......@@ -431,6 +458,14 @@ sub Cleanup()
return 0
if (! -e "$VNDIR/vnode.info" || !defined($vmid));
if (exists($vnconfig{'SSHDPORT'}) && $vnconfig{'SSHDPORT'} ne "") {
my $sshdport = $vnconfig{'SSHDPORT'};
my $ctrlip = $vnconfig{'CTRLIP'};
system("$IPTABLES -v -t nat -D PREROUTING -p tcp -d $ext_ctrlip ".
"--dport $sshdport -j DNAT --to-destination $ctrlip:$sshdport");
}
# if not halted, try that first
my ($ret,$err) = safeLibOp($vnodeid,'vnodeState',1,0,$vnodeid,$vmid);
if ($err) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment