PNG  IHDRxsBIT|d pHYs+tEXtSoftwarewww.inkscape.org<,tEXtComment File Manager

File Manager

Path: /opt/alt/python311/lib/python3.11/site-packages/pyroute2/netns/

Viewing File: __init__.py

'''
Basic network namespace management
==================================

Pyroute2 provides basic namespaces management support.
Here's a quick overview of typical netns tasks and
related pyroute2 tools.

Move an interface to a namespace
--------------------------------

Though this task is managed not via `netns` module, it
should be mentioned here as well. To move an interface
to a netns, one should provide IFLA_NET_NS_FD nla in
a set link RTNL request. The nla is an open FD number,
that refers to already created netns. The pyroute2
library provides also a possibility to specify not a
FD number, but a netns name as a string. In that case
the library will try to lookup the corresponding netns
in the standard location.

Create veth and move the peer to a netns with IPRoute::

    from pyroute2 import IPRoute
    ipr = IPRoute()
    ipr.link('add', ifname='v0p0', kind='veth', peer='v0p1')
    idx = ipr.link_lookup(ifname='v0p1')
    ipr.link('set', index=idx, net_ns_fd='netns_name')

Spawn a process within a netns
------------------------------

For that purpose one can use `NSPopen` API. It works just
as normal `Popen`, but starts a process within a netns.

Network namespace management
----------------------------

Please be aware, that in order to run system calls the
library uses `ctypes` module. It can fail on platforms
where SELinux is enforced. If the Python interpreter,
loading this module, dumps the core, one can check the
SELinux state with `getenforce` command.

'''

import ctypes
import ctypes.util
import errno
import io
import logging
import os
import os.path
import socket
from typing import Optional

from pyroute2 import config
from pyroute2.common import USE_DEFAULT_TIMEOUT, basestring, get_time
from pyroute2.process import ChildProcess, ChildProcessReturnValue

log = logging.getLogger(__name__)

try:
    file = file
except NameError:
    file = io.IOBase

# FIXME: arch reference
__NR = {
    'x86_': {'64bit': 308},
    'i386': {'32bit': 346},
    'i686': {'32bit': 346},
    'mips': {'32bit': 4344, '64bit': 5303},  # FIXME: NABI32?
    'loon': {'64bit': 268},
    'armv': {'32bit': 375},
    'aarc': {'32bit': 375, '64bit': 268},  # FIXME: EABI vs. OABI?
    'ppc6': {'64bit': 350},
    's390': {'64bit': 339},
    'loongarch64': {'64bit': 268},
    'risc': {'64bit': 268},
    'sw_6': {'64bit': 501},
}
__NR_setns = __NR.get(config.machine[:4], {}).get(config.arch, 308)

CLONE_NEWNET = 0x40000000
MNT_DETACH = 0x00000002
MS_BIND = 4096
MS_REC = 16384
MS_SHARED = 1 << 20
NETNS_RUN_DIR = '/var/run/netns'

__saved_ns = []
__libc = None


def _get_netnspath(name):
    netnspath = name
    dirname = os.path.dirname(name)
    if not dirname:
        netnspath = '%s/%s' % (NETNS_RUN_DIR, name)
    if hasattr(netnspath, 'encode'):
        netnspath = netnspath.encode('ascii')
    return netnspath


def _get_libc(libc=None):
    global __libc
    if libc is not None:
        return libc
    if __libc is None:
        __libc = ctypes.CDLL(ctypes.util.find_library('c'), use_errno=True)
    return __libc


def listnetns(nspath=None):
    '''
    List available network namespaces.
    '''
    if nspath:
        nsdir = nspath
    else:
        nsdir = NETNS_RUN_DIR
    try:
        return os.listdir(nsdir)
    except FileNotFoundError:
        return []


def _get_ns_by_inode(nspath=NETNS_RUN_DIR):
    '''
    Return a dict with inode as key and
    namespace name as value
    '''
    ns_by_dev_inode = {}
    for ns_name in listnetns(nspath=nspath):
        ns_path = os.path.join(nspath, ns_name)
        try:
            st = os.stat(ns_path)
        except FileNotFoundError:
            # The path disappeared from the FS while listing, ignore it
            continue
        if st.st_dev not in ns_by_dev_inode:
            ns_by_dev_inode[st.st_dev] = {}
        ns_by_dev_inode[st.st_dev][st.st_ino] = ns_name

    return ns_by_dev_inode


def ns_pids(nspath=NETNS_RUN_DIR):
    '''
    List pids in all netns

    If a pid is in a unknown netns do not return it
    '''
    result = {}
    ns_by_dev_inode = _get_ns_by_inode(nspath)

    for pid in os.listdir('/proc'):
        if not pid.isdigit():
            continue
        try:
            st = os.stat(os.path.join('/proc', pid, 'ns', 'net'))
        except OSError as e:
            if e.errno in (errno.EACCES, errno.ENOENT):
                continue
            raise
        try:
            ns_name = ns_by_dev_inode[st.st_dev][st.st_ino]
        except KeyError:
            continue
        if ns_name not in result:
            result[ns_name] = []
        result[ns_name].append(int(pid))
    return result


def pid_to_ns(pid=1, nspath=NETNS_RUN_DIR):
    '''
    Return netns name which matches the given pid,
    None otherwise
    '''
    try:
        st = os.stat(os.path.join('/proc', str(pid), 'ns', 'net'))
        ns_by_dev_inode = _get_ns_by_inode(nspath)
        return ns_by_dev_inode[st.st_dev][st.st_ino]
    except OSError as e:
        if e.errno in (errno.EACCES, errno.ENOENT):
            return None
        raise
    except KeyError:
        return None


def _create(netns, libc=None, pid=None):
    libc = _get_libc(libc)
    netnspath = _get_netnspath(netns)
    netnsdir = os.path.dirname(netnspath)

    # init netnsdir
    try:
        os.mkdir(netnsdir)
    except OSError as e:
        if e.errno != errno.EEXIST:
            raise

    # this code is ported from iproute2
    done = False
    while libc.mount(b'', netnsdir, b'none', MS_SHARED | MS_REC, None) != 0:
        if done:
            raise OSError(ctypes.get_errno(), 'share rundir failed', netns)
        if (
            libc.mount(netnsdir, netnsdir, b'none', MS_BIND | MS_REC, None)
            != 0
        ):
            raise OSError(ctypes.get_errno(), 'mount rundir failed', netns)
        done = True

    # create mountpoint
    os.close(os.open(netnspath, os.O_RDONLY | os.O_CREAT | os.O_EXCL, 0))

    # unshare
    if pid is None:
        pid = 'self'
        if libc.unshare(CLONE_NEWNET) < 0:
            raise OSError(ctypes.get_errno(), 'unshare failed', netns)

    # bind the namespace
    if (
        libc.mount(
            '/proc/{}/ns/net'.format(pid).encode('utf-8'),
            netnspath,
            b'none',
            MS_BIND,
            None,
        )
        < 0
    ):
        raise OSError(ctypes.get_errno(), 'mount failed', netns)


@config.mock_if('mock_netns')
def create(netns, libc=None):
    '''
    Create a network namespace.
    '''
    proc = ChildProcess(target=_create, args=[netns, libc])
    proc.run()
    proc.communicate()
    proc.stop(kill=True)
    proc.close()


@config.mock_if('mock_netns')
def attach(netns, pid, libc=None):
    '''
    Attach the network namespace of the process `pid`
    to `netns` as if it were created with `create`.
    '''
    _create(netns, libc, pid)


@config.mock_if('mock_netns')
def remove(netns, libc=None):
    '''
    Remove a network namespace.
    '''
    libc = _get_libc(libc)
    netnspath = _get_netnspath(netns)
    libc.umount2(netnspath, MNT_DETACH)
    os.unlink(netnspath)


@config.mock_if('mock_netns')
def setns(netns, flags=os.O_CREAT, libc=None, fork=True):
    '''
    Set netns for the current process.

    The flags semantics is the same as for the `open(2)`
    call:

        - O_CREAT -- create netns, if doesn't exist
        - O_CREAT | O_EXCL -- create only if doesn't exist

    Note that "main" netns has no name. But you can access it with::

        setns('foo')  # move to netns foo
        setns('/proc/1/ns/net')  # go back to default netns

    See also `pushns()`/`popns()`/`dropns()`

    Changed in 0.5.1: the routine closes the ns fd if it's
    not provided via arguments.
    '''
    newfd = False
    libc = _get_libc(libc)
    if isinstance(netns, basestring):
        netnspath = _get_netnspath(netns)
        if os.path.basename(netns) in listnetns(os.path.dirname(netns)):
            if flags & (os.O_CREAT | os.O_EXCL) == (os.O_CREAT | os.O_EXCL):
                raise OSError(errno.EEXIST, 'netns exists', netns)
        else:
            if flags & os.O_CREAT:
                if fork:
                    create(netns, libc=libc)
                else:
                    _create(netns, libc=libc)
        nsfd = os.open(netnspath, os.O_RDONLY)
        newfd = True
    elif isinstance(netns, file):
        nsfd = netns.fileno()
    elif isinstance(netns, int):
        nsfd = netns
    else:
        raise RuntimeError('netns should be a string or an open fd')
    error = libc.syscall(__NR_setns, nsfd, CLONE_NEWNET)
    if newfd:
        os.close(nsfd)
    if error != 0:
        raise OSError(ctypes.get_errno(), 'failed to open netns', netns)


@config.mock_if('mock_netns')
def pushns(newns=None, libc=None):
    '''
    Save the current netns in order to return to it later. If newns is
    specified, change to it::

        # --> the script in the "main" netns
        netns.pushns("test")
        # --> changed to "test", the "main" is saved
        netns.popns()
        # --> "test" is dropped, back to the "main"
    '''
    global __saved_ns
    __saved_ns.append(os.open('/proc/self/ns/net', os.O_RDONLY))
    if newns is not None:
        setns(newns, libc=libc)


@config.mock_if('mock_netns')
def popns(libc=None):
    '''
    Restore the previously saved netns.
    '''
    global __saved_ns
    fd = __saved_ns.pop()
    try:
        setns(fd, libc=libc)
    except Exception:
        __saved_ns.append(fd)
        raise
    os.close(fd)


@config.mock_if('mock_netns')
def dropns(libc=None):
    '''
    Discard the last saved with `pushns()` namespace
    '''
    global __saved_ns
    fd = __saved_ns.pop()
    try:
        os.close(fd)
    except Exception:
        pass


def _create_socket_child(nsname, flags, family, socket_type, proto, libc=None):
    setns(nsname, flags=flags, libc=libc, fork=False)
    sock = socket.socket(family, socket_type, proto)
    return ChildProcessReturnValue(b'', [sock])


@config.mock_if('mock_netns')
def create_socket(
    netns: Optional[str] = None,
    family: int = socket.AF_INET,
    socket_type: int = socket.SOCK_STREAM,
    proto: int = 0,
    fileno: Optional[int] = None,
    flags: int = os.O_CREAT,
    libc: Optional[ctypes.CDLL] = None,
    timeout: int = USE_DEFAULT_TIMEOUT,
) -> socket.socket:
    if fileno is not None and netns is not None:
        raise TypeError('you can not specify both fileno and netns')
    if fileno is not None:
        return socket.socket(fileno=fileno)
    if netns is None:
        return socket.socket(family, socket_type, proto)
    if timeout == USE_DEFAULT_TIMEOUT:
        timeout = config.default_create_socket_timeout

    start_time = get_time()
    while get_time() - start_time < timeout:
        with ChildProcess(
            target=_create_socket_child,
            args=[netns, flags, family, socket_type, proto, libc],
        ) as proc:
            try:
                return socket.socket(
                    fileno=proc.get_fds(
                        timeout=config.default_communicate_timeout
                    )[0]
                )
            except TimeoutError:
                continue

    raise TimeoutError('could not start netns socket within timeout')
b IDATxytVսϓ22 A@IR :hCiZ[v*E:WũZA ^dQeQ @ !jZ'>gsV仿$|?g)&x-EIENT ;@xT.i%-X}SvS5.r/UHz^_$-W"w)Ɗ/@Z &IoX P$K}JzX:;` &, ŋui,e6mX ԵrKb1ԗ)DADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADADA݀!I*]R;I2$eZ#ORZSrr6mteffu*((Pu'v{DIߔ4^pIm'77WEEE;vƎ4-$]'RI{\I&G :IHJ DWBB=\WR޽m o$K(V9ABB.}jѢv`^?IOȅ} ڶmG}T#FJ`56$-ھ}FI&v;0(h;Б38CӧOWf!;A i:F_m9s&|q%=#wZprrrla A &P\\СC[A#! {olF} `E2}MK/vV)i{4BffV\|ۭX`b@kɶ@%i$K z5zhmX[IXZ` 'b%$r5M4º/l ԃߖxhʔ)[@=} K6IM}^5k㏷݆z ΗÿO:gdGBmyT/@+Vɶ纽z񕏵l.y޴it뭷zV0[Y^>Wsqs}\/@$(T7f.InݺiR$푔n.~?H))\ZRW'Mo~v Ov6oԃxz! S,&xm/yɞԟ?'uaSѽb,8GלKboi&3t7Y,)JJ c[nzӳdE&KsZLӄ I?@&%ӟ۶mSMMњ0iؐSZ,|J+N ~,0A0!5%Q-YQQa3}$_vVrf9f?S8`zDADADADADADADADADAdqP,تmMmg1V?rSI꒟]u|l RCyEf٢9 jURbztѰ!m5~tGj2DhG*{H9)꒟ר3:(+3\?/;TUݭʴ~S6lڧUJ*i$d(#=Yݺd{,p|3B))q:vN0Y.jkק6;SɶVzHJJЀ-utѹսk>QUU\޲~]fFnK?&ߡ5b=z9)^|u_k-[y%ZNU6 7Mi:]ۦtk[n X(e6Bb."8cۭ|~teuuw|ήI-5"~Uk;ZicEmN/:]M> cQ^uiƞ??Ңpc#TUU3UakNwA`:Y_V-8.KKfRitv޲* 9S6ֿj,ՃNOMߤ]z^fOh|<>@Å5 _/Iu?{SY4hK/2]4%it5q]GGe2%iR| W&f*^]??vq[LgE_3f}Fxu~}qd-ږFxu~I N>\;͗O֊:̗WJ@BhW=y|GgwܷH_NY?)Tdi'?խwhlmQi !SUUsw4kӺe4rfxu-[nHtMFj}H_u~w>)oV}(T'ebʒv3_[+vn@Ȭ\S}ot}w=kHFnxg S 0eޢm~l}uqZfFoZuuEg `zt~? b;t%>WTkķh[2eG8LIWx,^\thrl^Ϊ{=dž<}qV@ ⠨Wy^LF_>0UkDuʫuCs$)Iv:IK;6ֲ4{^6եm+l3>݆uM 9u?>Zc }g~qhKwڭeFMM~pМuqǿz6Tb@8@Y|jx](^]gf}M"tG -w.@vOqh~/HII`S[l.6nØXL9vUcOoB\xoǤ'T&IǍQw_wpv[kmO{w~>#=P1Pɞa-we:iǏlHo׈꒟f9SzH?+shk%Fs:qVhqY`jvO'ρ?PyX3lх]˾uV{ݞ]1,MzYNW~̈́ joYn}ȚF߾׮mS]F z+EDxm/d{F{-W-4wY듏:??_gPf ^3ecg ҵs8R2מz@TANGj)}CNi/R~}c:5{!ZHӋӾ6}T]G]7W6^n 9*,YqOZj:P?Q DFL|?-^.Ɵ7}fFh׶xe2Pscz1&5\cn[=Vn[ĶE鎀uˌd3GII k;lNmشOuuRVfBE]ۣeӶu :X-[(er4~LHi6:Ѻ@ԅrST0trk%$Č0ez" *z"T/X9|8.C5Feg}CQ%͞ˣJvL/?j^h&9xF`њZ(&yF&Iݻfg#W;3^{Wo^4'vV[[K';+mӍִ]AC@W?1^{එyh +^]fm~iԵ]AB@WTk̏t uR?l.OIHiYyԶ]Aˀ7c:q}ힽaf6Z~қm(+sK4{^6}T*UUu]n.:kx{:2 _m=sAߤU@?Z-Vކеz왍Nэ{|5 pڶn b p-@sPg]0G7fy-M{GCF'%{4`=$-Ge\ eU:m+Zt'WjO!OAF@ik&t݆ϥ_ e}=]"Wz_.͜E3leWFih|t-wZۍ-uw=6YN{6|} |*={Ѽn.S.z1zjۻTH]흾 DuDvmvK.`V]yY~sI@t?/ϓ. m&["+P?MzovVЫG3-GRR[(!!\_,^%?v@ҵő m`Y)tem8GMx.))A]Y i`ViW`?^~!S#^+ѽGZj?Vģ0.))A꨷lzL*]OXrY`DBBLOj{-MH'ii-ϰ ok7^ )쭡b]UXSְmռY|5*cֽk0B7镹%ڽP#8nȎq}mJr23_>lE5$iwui+ H~F`IjƵ@q \ @#qG0".0" l`„.0! ,AQHN6qzkKJ#o;`Xv2>,tێJJ7Z/*A .@fفjMzkg @TvZH3Zxu6Ra'%O?/dQ5xYkU]Rֽkق@DaS^RSּ5|BeHNN͘p HvcYcC5:y #`οb;z2.!kr}gUWkyZn=f Pvsn3p~;4p˚=ē~NmI] ¾ 0lH[_L hsh_ғߤc_њec)g7VIZ5yrgk̞W#IjӪv>՞y睝M8[|]\շ8M6%|@PZڨI-m>=k='aiRo-x?>Q.}`Ȏ:Wsmu u > .@,&;+!!˱tﭧDQwRW\vF\~Q7>spYw$%A~;~}6¾ g&if_=j,v+UL1(tWake:@Ș>j$Gq2t7S?vL|]u/ .(0E6Mk6hiۺzښOrifޱxm/Gx> Lal%%~{lBsR4*}{0Z/tNIɚpV^#Lf:u@k#RSu =S^ZyuR/.@n&΃z~B=0eg뺆#,Þ[B/?H uUf7y Wy}Bwegל`Wh(||`l`.;Ws?V@"c:iɍL֯PGv6zctM̠':wuW;d=;EveD}9J@B(0iհ bvP1{\P&G7D޴Iy_$-Qjm~Yrr&]CDv%bh|Yzni_ˆR;kg}nJOIIwyuL}{ЌNj}:+3Y?:WJ/N+Rzd=hb;dj͒suݔ@NKMԄ jqzC5@y°hL m;*5ezᕏ=ep XL n?מ:r`۵tŤZ|1v`V뽧_csج'ߤ%oTuumk%%%h)uy]Nk[n 'b2 l.=͜E%gf$[c;s:V-͞WߤWh-j7]4=F-X]>ZLSi[Y*We;Zan(ӇW|e(HNNP5[= r4tP &0<pc#`vTNV GFqvTi*Tyam$ߏWyE*VJKMTfFw>'$-ؽ.Ho.8c"@DADADADADADADADADA~j*֘,N;Pi3599h=goضLgiJ5փy~}&Zd9p֚ e:|hL``b/d9p? fgg+%%hMgXosج, ΩOl0Zh=xdjLmhݻoO[g_l,8a]٭+ӧ0$I]c]:粹:Teꢢ"5a^Kgh,&= =՟^߶“ߢE ܹS J}I%:8 IDAT~,9/ʃPW'Mo}zNƍ쨓zPbNZ~^z=4mswg;5 Y~SVMRXUյڱRf?s:w ;6H:ºi5-maM&O3;1IKeamZh͛7+##v+c ~u~ca]GnF'ټL~PPPbn voC4R,ӟgg %hq}@#M4IÇ Oy^xMZx ) yOw@HkN˖-Sǎmb]X@n+i͖!++K3gd\$mt$^YfJ\8PRF)77Wא!Cl$i:@@_oG I{$# 8磌ŋ91A (Im7֭>}ߴJq7ޗt^ -[ԩSj*}%]&' -ɓ'ꫯVzzvB#;a 7@GxI{j޼ƌ.LÇWBB7`O"I$/@R @eee@۷>}0,ɒ2$53Xs|cS~rpTYYY} kHc %&k.], @ADADADADADADADADA@lT<%''*Lo^={رc5h %$+CnܸQ3fҥK}vUVVs9G R,_{xˇ3o߾;TTTd}馛]uuuG~iԩ@4bnvmvfϞ /Peeeq}}za I~,誫{UWW뮻}_~YƍSMMMYχ֝waw\ďcxꩧtEƍկ_?۷5@u?1kNׯWzz/wy>}zj3 k(ٺuq_Zvf̘:~ ABQ&r|!%KҥKgԞ={<_X-z !CyFUUz~ ABQIIIjݺW$UXXDٳZ~ ABQƍecW$<(~<RSSvZujjjԧOZQu@4 8m&&&jԩg$ď1h ͟?_{768@g =@`)))5o6m3)ѣƌJ;wҿUTT /KZR{~a=@0o<*狔iFɶ[ˎ;T]]OX@?K.ۈxN pppppppppppppppppPfl߾] ,{ァk۶mڿo5BTӦMӴiӴ|r DB2e|An!Dy'tkΝ[A $***t5' "!駟oaDnΝ:t֭[gDШQ06qD;@ x M6v(PiizmZ4ew"@̴ixf [~-Fٱc&IZ2|n!?$@{[HTɏ#@hȎI# _m(F /6Z3z'\r,r!;w2Z3j=~GY7"I$iI.p_"?pN`y DD?: _  Gÿab7J !Bx@0 Bo cG@`1C[@0G @`0C_u V1 aCX>W ` | `!<S `"<. `#c`?cAC4 ?c p#~@0?:08&_MQ1J h#?/`7;I  q 7a wQ A 1 Hp !#<8/#@1Ul7=S=K.4Z?E_$i@!1!E4?`P_  @Bă10#: "aU,xbFY1 [n|n #'vEH:`xb #vD4Y hi.i&EΖv#O H4IŶ}:Ikh @tZRF#(tXҙzZ ?I3l7q@õ|ۍ1,GpuY Ꮿ@hJv#xxk$ v#9 5 }_$c S#=+"K{F*m7`#%H:NRSp6I?sIՖ{Ap$I$I:QRv2$Z @UJ*$]<FO4IENDB`