Unverified Commit 44091ace authored by Kroese's avatar Kroese Committed by GitHub
Browse files

feat: Improved networking (#481)

parent 4bee6de2

src/boot.sh

+8 −0
Original line number Diff line number Diff line
@@ -104,4 +104,12 @@ if [[ "$TPM" == [Yy1]* ]]; then 


fi



if [[ "${BOOT_MODE,,}" == "windows"* ]]; then

  if [ -e /sys/module/kvm/parameters/ignore_msrs ]; then

    if [ "$(cat /sys/module/kvm/parameters/ignore_msrs)" == "N" ]; then

      echo 1 | tee /sys/module/kvm/parameters/ignore_msrs > /dev/null 2>&1 || true

    fi

  fi

fi



return 0

src/network.sh

+18 −10
Original line number Diff line number Diff line
@@ -36,8 +36,8 @@ configureDHCP() { 
  { ip link add link "$VM_NET_DEV" name "$VM_NET_TAP" address "$VM_NET_MAC" type macvtap mode bridge ; rc=$?; } || :



  if (( rc != 0 )); then

    error "Cannot create macvtap interface. Please make sure the network type is 'macvlan' and not 'ipvlan',"

    error "and that the NET_ADMIN capability has been added to the container: --cap-add NET_ADMIN" && exit 16

    error "Cannot create macvtap interface. Please make sure that the network type is 'macvlan' and not 'ipvlan',"

    error "that your kernel is recent (>4) and supports it, and that the container has the NET_ADMIN capability set." && exit 16

  fi



  while ! ip link set "$VM_NET_TAP" up; do
@@ -116,7 +116,7 @@ getPorts() { 
    [ -z "$list" ] && list="$vnc" || list="$list,$vnc"

  fi



  [ -z "$list" ] && return 0

  [ -z "$list" ] && echo "" && return 0



  if [[ "$list" != *","* ]]; then

    echo " ! --dport $list"
@@ -143,12 +143,15 @@ configureNAT() { 


  # Check port forwarding flag

  if [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then

    { sysctl -w net.ipv4.ip_forward=1 ; rc=$?; } || :

    if (( rc != 0 )); then

    { sysctl -w net.ipv4.ip_forward=1 > /dev/null; rc=$?; } || :

    if (( rc != 0 )) || [[ $(< /proc/sys/net/ipv4/ip_forward) -eq 0 ]]; then

      error "IP forwarding is disabled. $ADD_ERR --sysctl net.ipv4.ip_forward=1" && exit 24

    fi

  fi



  local tables="The 'ip_tables' kernel module is not loaded. Try this command: sudo modprobe ip_tables iptable_nat"

  local tuntap="The 'tun' kernel module is not available. Try this command: 'sudo modprobe tun' or run the container with 'privileged: true'."



  # Create a bridge with a static IP for the VM guest



  VM_NET_IP='20.20.20.21'
@@ -167,7 +170,9 @@ configureNAT() { 
  done



  # QEMU Works with taps, set tap to the bridge created

  ip tuntap add dev "$VM_NET_TAP" mode tap

  if ! ip tuntap add dev "$VM_NET_TAP" mode tap; then

    error "$tuntap" && exit 31

  fi



  while ! ip link set "$VM_NET_TAP" up promisc on; do

    info "Waiting for TAP to become available..."
@@ -182,14 +187,17 @@ configureNAT() { 


  exclude=$(getPorts "$HOST_PORTS")



  iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -j MASQUERADE

  if ! iptables -t nat -A POSTROUTING -o "$VM_NET_DEV" -j MASQUERADE; then

    error "$tables" && exit 30

  fi



  # shellcheck disable=SC2086

  iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p tcp${exclude} -j DNAT --to "$VM_NET_IP"

  iptables -t nat -A PREROUTING -i "$VM_NET_DEV" -d "$IP" -p udp  -j DNAT --to "$VM_NET_IP"



  if (( KERNEL > 4 )); then

    # Hack for guest VMs complaining about "bad udp checksums in 5 packets"

    iptables -A POSTROUTING -t mangle -p udp --dport bootpc -j CHECKSUM --checksum-fill || true

    iptables -A POSTROUTING -t mangle -p udp --dport bootpc -j CHECKSUM --checksum-fill > /dev/null 2>&1 || true

  fi



  NET_OPTS="-netdev tap,ifname=$VM_NET_TAP,script=no,downscript=no,id=hostnet0"
@@ -297,8 +305,8 @@ fi 


if [[ "$DHCP" == [Yy1]* ]]; then



  if [[ "$GATEWAY" == "172."* ]] && [[ "$DEBUG" != [Yy1]* ]]; then

    error "You can only enable DHCP while the container is on a macvlan network!" && exit 26

  if [[ "$GATEWAY" == "172."* ]]; then

    warn "your gateway IP starts with 172.* which is often a sign that you are not on a macvlan network (required for DHCP)!"

  fi



  # Configuration for DHCP IP

src/reset.sh

+1 −1
Original line number Diff line number Diff line
@@ -44,7 +44,7 @@ KERNEL=$(echo "$SYS" | cut -b 1) 
MINOR=$(echo "$SYS" | cut -d '.' -f2)

ARCH=$(dpkg --print-architecture)

RAM="$(free -g | grep Mem: | awk '{print $7}')/$(free -g | grep Mem: | awk '{print $2}') GB"

CPU=$(lscpu | grep 'Model name' | cut -f 2 -d ":" | awk '{$1=$1}1' | sed 's# @.*##g' | sed s/"(R)"//g | sed 's/[^[:alnum:] ]\+/ /g' | sed 's/  */ /g')

CPU=$(lscpu | grep -m 1 'Model name' | cut -f 2 -d ":" | awk '{$1=$1}1' | sed 's# @.*##g' | sed s/"(R)"//g | sed 's/[^[:alnum:] ]\+/ /g' | sed 's/  */ /g')



# Check system