admin/CLICD
1
0
Fork 0
mirror of https://github.com/MengMengCode/CLICD.git synced 2026-08-04 21:31:23 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
8bad52bd9e37591849106e93ab9ae1829315cb9e
CLICD/backend/internal/lxc/ipv6.go
T
MengMengCode 8bad52bd9e FIX ##30
2026-07-17 00:27:31 +08:00

2025 lines
57 KiB
Go
Raw Blame History

package lxc
import (
"context"
"encoding/binary"
"fmt"
"math/big"
"net/netip"
"os"
"os/exec"
"path/filepath"
"sort"
"strconv"
"strings"
"time"
"clicd/internal/config"
)
const ipv6GatewayLinkLocal = "fe80::1"
const MaxPublicIPAssignments = 64
type IPv6PrefixInfo struct {
Interface string `json:"interface"`
Address string `json:"address"`
Prefix string `json:"prefix"`
PrefixLen int `json:"prefix_len"`
Gateway string `json:"gateway"`
IsTunnel bool `json:"is_tunnel"`
Source string `json:"source"`
}
type PublicIPInfo struct {
Address string `json:"address"`
Interface string `json:"interface"`
Prefix string `json:"prefix"`
PrefixLen int `json:"prefix_len,omitempty"`
SubnetMask string `json:"subnet_mask,omitempty"`
Gateway string `json:"gateway,omitempty"`
IsTunnel bool `json:"is_tunnel"`
Source string `json:"source"`
}
type PublicIPv4ScanResult struct {
PublicIPInfo
Status string `json:"status"`
Usable bool `json:"usable"`
Reason string `json:"reason"`
}
type IPv6Status struct {
Available bool `json:"available"`
Reachable bool `json:"reachable"`
Reason string `json:"reason"`
Prefixes []IPv6PrefixInfo `json:"prefixes"`
}
func (m *Manager) DetectIPv6Status() IPv6Status {
status := IPv6Status{}
prefixes := DetectPublicIPv6Prefixes()
status.Prefixes = prefixes
if len(prefixes) == 0 {
status.Reason = "no usable public IPv6 prefix found; /128 single-address IPv6 is not assignable"
return status
}
status.Reachable = ipv6ConnectivityOK()
if !status.Reachable {
status.Reason = "host has an IPv6 prefix, but outbound IPv6 connectivity test failed"
return status
}
status.Available = true
status.Reason = "usable public IPv6 prefix detected"
return status
}
func DetectPublicIPv6Prefixes() []IPv6PrefixInfo {
if configured := ConfiguredPublicIPv6Prefixes(); len(configured) > 0 {
return configured
}
return detectPublicIPv6Prefixes(detectIPv6DefaultRoutes())
}
func DetectHostPublicIPv6Prefixes() []IPv6PrefixInfo {
return detectPublicIPv6Prefixes(detectIPv6DefaultRoutes())
}
func ConfiguredPublicIPv6Prefixes() []IPv6PrefixInfo {
if config.AppConfig == nil || len(config.AppConfig.PublicIPv6Prefixes) == 0 {
return nil
}
detected := detectPublicIPv6Prefixes(detectIPv6DefaultRoutes())
defaultIface := ""
defaultGateway := ""
for _, item := range detected {
if defaultIface == "" {
defaultIface = item.Interface
}
if defaultGateway == "" {
defaultGateway = item.Gateway
}
}
result := make([]IPv6PrefixInfo, 0, len(config.AppConfig.PublicIPv6Prefixes))
for _, item := range config.AppConfig.PublicIPv6Prefixes {
address := strings.TrimSpace(item.Address)
prefixText := strings.TrimSpace(item.Prefix)
if prefixText == "" && address != "" && item.PrefixLen > 0 {
prefixText = address + "/" + strconv.Itoa(item.PrefixLen)
}
prefix, err := netip.ParsePrefix(prefixText)
if err != nil || !prefix.Addr().Is6() {
continue
}
iface := strings.TrimSpace(item.Interface)
if iface == "" {
iface = defaultIface
}
gateway := strings.TrimSpace(item.Gateway)
if gateway == "" {
gateway = defaultGateway
}
addr := strings.TrimSpace(item.Address)
if addr == "" {
addr = prefix.Addr().String()
}
result = append(result, IPv6PrefixInfo{
Interface: iface,
Address: addr,
Prefix: prefix.Masked().String(),
PrefixLen: prefix.Bits(),
Gateway: gateway,
IsTunnel: isTunnelLikeInterface(iface),
Source: "manual",
})
}
sort.SliceStable(result, func(i, j int) bool {
return result[i].Prefix < result[j].Prefix
})
return result
}
func DetectPublicIPv4() PublicIPInfo {
addresses := detectPublicIPv4LocalAddresses()
if len(addresses) == 0 {
return PublicIPInfo{}
}
return addresses[0]
}
func DetectPublicIPv4Candidates() []PublicIPInfo {
return ConfiguredPublicIPv4Pool()
}
func DetectFreePublicIPv4Candidates(skipContainerID int) []PublicIPInfo {
used := assignedPublicIPv4Map(skipContainerID)
candidates := DetectPublicIPv4Candidates()
result := make([]PublicIPInfo, 0, len(candidates))
for _, item := range candidates {
if item.Address == "" || used[item.Address] {
continue
}
result = append(result, item)
}
return result
}
func ConfiguredPublicIPv4Pool() []PublicIPInfo {
if config.AppConfig == nil {
return nil
}
localAddrs := detectPublicIPv4LocalAddresses()
primaryHostIP := ""
defaultIface := ""
defaultPrefixLen := 32
defaultRoutes := detectIPv4DefaultRoutes()
gateways := ipv4GatewaysByInterface(defaultRoutes)
if len(localAddrs) > 0 {
primaryHostIP = localAddrs[0].Address
defaultIface = localAddrs[0].Interface
if localAddrs[0].PrefixLen > 0 {
defaultPrefixLen = localAddrs[0].PrefixLen
}
}
type candidate struct {
info PublicIPInfo
score int
}
candidatesByAddr := map[string]candidate{}
addCandidate := func(info PublicIPInfo, score int) {
if info.Address == "" || info.Address == primaryHostIP || (info.Gateway != "" && info.Address == info.Gateway) {
return
}
if existing, ok := candidatesByAddr[info.Address]; ok && existing.score >= score {
return
}
candidatesByAddr[info.Address] = candidate{info: info, score: score}
}
defaultIfaces := map[string]bool{}
for _, route := range defaultRoutes {
defaultIfaces[route.Interface] = true
}
for _, item := range config.AppConfig.PublicIPv4Pool {
address := strings.TrimSpace(item.Address)
if address == "" {
continue
}
addr, err := netip.ParseAddr(address)
if err != nil || !addr.Is4() {
continue
}
address = addr.String()
iface := strings.TrimSpace(item.Interface)
gateway := strings.TrimSpace(item.Gateway)
if iface == "" && gateway != "" {
iface = ipv4InterfaceForGateway(gateway, defaultRoutes)
}
if iface == "" {
iface = defaultIface
}
if gateway == "" && iface != "" {
gateway = gateways[iface]
}
prefixLen := item.PrefixLen
if prefixLen <= 0 || prefixLen > 32 {
if gatewayAddr, err := netip.ParseAddr(gateway); err == nil && gatewayAddr.Is4() {
prefixLen = inferPublicIPv4PrefixLen(addr, gatewayAddr, iface, localAddrs)
}
if prefixLen <= 0 || prefixLen > 32 {
prefixLen = defaultPrefixLen
}
}
score := publicInterfaceScore(iface, defaultIfaces)
addCandidate(PublicIPInfo{
Address: address,
Interface: iface,
Prefix: ipv4PrefixString(addr, prefixLen),
PrefixLen: prefixLen,
SubnetMask: ipv4SubnetMask(prefixLen),
Gateway: gateway,
IsTunnel: isTunnelLikeInterface(iface),
Source: "manual",
}, score+50)
}
candidates := make([]candidate, 0, len(candidatesByAddr))
for _, item := range candidatesByAddr {
candidates = append(candidates, item)
}
sort.SliceStable(candidates, func(i, j int) bool {
if candidates[i].score == candidates[j].score {
return compareIPv4Strings(candidates[i].info.Address, candidates[j].info.Address) < 0
}
return candidates[i].score > candidates[j].score
})
result := make([]PublicIPInfo, 0, len(candidates))
for _, c := range candidates {
result = append(result, c.info)
}
return result
}
func NormalizePublicIPv4Pool(items []config.PublicIPv4Assignment) ([]config.PublicIPv4Assignment, error) {
localAddrs := detectPublicIPv4LocalAddresses()
primaryHostIP := ""
defaultIface := ""
defaultRoutes := detectIPv4DefaultRoutes()
gateways := ipv4GatewaysByInterface(defaultRoutes)
localMap := map[string]bool{}
if len(localAddrs) > 0 {
primaryHostIP = localAddrs[0].Address
defaultIface = localAddrs[0].Interface
}
for _, local := range localAddrs {
localMap[local.Address] = true
}
assigned := assignedPublicIPv4Map(0)
seen := map[string]bool{}
result := make([]config.PublicIPv4Assignment, 0, len(items))
for _, item := range items {
raw := strings.TrimSpace(item.Address)
if raw == "" {
continue
}
gateway := strings.TrimSpace(item.Gateway)
if gateway == "" && item.Interface != "" {
gateway = gateways[strings.TrimSpace(item.Interface)]
}
if gateway == "" {
return nil, fmt.Errorf("gateway is required for IPv4 %s", raw)
}
gatewayAddr, err := netip.ParseAddr(gateway)
if err != nil || !gatewayAddr.Is4() {
return nil, fmt.Errorf("gateway %s is not a valid IPv4 address", gateway)
}
gateway = gatewayAddr.String()
iface := strings.TrimSpace(item.Interface)
if iface == "" {
iface = ipv4InterfaceForGateway(gateway, defaultRoutes)
}
if iface == "" {
iface = defaultIface
}
if iface == "" {
return nil, fmt.Errorf("interface is required for IPv4 %s", raw)
}
addresses, prefixLen, singleInput, err := expandPublicIPv4Input(raw, item.PrefixLen, gatewayAddr, iface, localAddrs)
if err != nil {
return nil, err
}
addedFromInput := 0
skippedReasons := []string{}
for _, addr := range addresses {
if !addr.Is4() || !isPublicIPv4(addr) {
if singleInput {
return nil, fmt.Errorf("IPv4 %s is not a valid public IPv4 address", addr.String())
}
continue
}
address := addr.String()
switch {
case address == primaryHostIP:
if singleInput {
return nil, fmt.Errorf("IPv4 %s is the host primary IPv4 and cannot be allocated", address)
}
skippedReasons = append(skippedReasons, address+" is the host primary IPv4")
continue
case address == gateway:
if singleInput {
return nil, fmt.Errorf("IPv4 %s is the gateway and cannot be allocated", address)
}
skippedReasons = append(skippedReasons, address+" is the gateway")
continue
case seen[address]:
continue
case ipv4AddressResponds(iface, address) && !localMap[address] && !assigned[address]:
if singleInput {
return nil, fmt.Errorf("IPv4 %s responds on the network and cannot be allocated", address)
}
skippedReasons = append(skippedReasons, address+" responds on the network")
continue
}
seen[address] = true
result = append(result, config.PublicIPv4Assignment{
Address: address,
Interface: iface,
PrefixLen: prefixLen,
Gateway: gateway,
})
addedFromInput++
}
if singleInput && addedFromInput == 0 {
if len(skippedReasons) > 0 {
return nil, fmt.Errorf("IPv4 %s is not allocatable: %s", raw, strings.Join(skippedReasons, "; "))
}
return nil, fmt.Errorf("IPv4 %s is not allocatable", raw)
}
}
if len(result) == 0 && len(items) > 0 {
return nil, fmt.Errorf("no allocatable public IPv4 address found in the submitted pool")
}
sort.SliceStable(result, func(i, j int) bool {
return compareIPv4Strings(result[i].Address, result[j].Address) < 0
})
return result, nil
}
func expandPublicIPv4Input(raw string, requestedPrefixLen int, gateway netip.Addr, iface string, localAddrs []PublicIPInfo) ([]netip.Addr, int, bool, error) {
if strings.Contains(raw, "/") {
prefix, err := netip.ParsePrefix(raw)
if err != nil || !prefix.Addr().Is4() {
return nil, 0, false, fmt.Errorf("invalid IPv4 segment: %s", raw)
}
prefix = prefix.Masked()
if prefix.Bits() < 24 {
return nil, 0, false, fmt.Errorf("IPv4 segment %s is too large; use /24 or smaller", prefix.String())
}
return ipv4HostsInPrefix(prefix), prefix.Bits(), prefix.Bits() == 32, nil
}
addr, err := netip.ParseAddr(raw)
if err != nil || !addr.Is4() {
return nil, 0, true, fmt.Errorf("IPv4 %s is not a valid public IPv4 address", raw)
}
prefixLen := requestedPrefixLen
if prefixLen <= 0 || prefixLen > 32 {
prefixLen = inferPublicIPv4PrefixLen(addr, gateway, iface, localAddrs)
}
if prefixLen <= 0 || prefixLen > 32 {
prefixLen = 32
}
return []netip.Addr{addr}, prefixLen, true, nil
}
func ipv4GatewaysByInterface(routes []routeInfo) map[string]string {
gateways := map[string]string{}
for _, route := range routes {
if route.Interface != "" && route.Gateway != "" && gateways[route.Interface] == "" {
gateways[route.Interface] = route.Gateway
}
}
return gateways
}
func ipv4InterfaceForGateway(gateway string, defaultRoutes []routeInfo) string {
gateway = strings.TrimSpace(gateway)
if gateway == "" {
return ""
}
for _, route := range defaultRoutes {
if route.Gateway == gateway && route.Interface != "" {
return route.Interface
}
}
out, err := exec.Command("ip", "-4", "route", "get", gateway).Output()
if err != nil {
return ""
}
fields := strings.Fields(string(out))
for i := 0; i < len(fields)-1; i++ {
if fields[i] == "dev" {
return normalizeIface(fields[i+1])
}
}
return ""
}
func assignedPublicIPv4Map(skipContainerID int) map[string]bool {
assigned := map[string]bool{}
if config.AppConfig == nil {
return assigned
}
for _, c := range config.AppConfig.Containers {
if skipContainerID > 0 && c.ID == skipContainerID {
continue
}
for _, item := range c.PublicIPv4s {
if address := strings.TrimSpace(item.Address); address != "" {
assigned[address] = true
}
}
}
return assigned
}
func inferPublicIPv4PrefixLen(addr netip.Addr, gateway netip.Addr, iface string, localAddrs []PublicIPInfo) int {
best := 0
consider := func(prefixText string, prefixIface string) {
if iface != "" && prefixIface != "" && iface != prefixIface {
return
}
prefix, err := netip.ParsePrefix(prefixText)
if err != nil || !prefix.Addr().Is4() || !prefix.Contains(addr) {
return
}
if gateway.IsValid() && gateway.Is4() && !prefix.Contains(gateway) {
return
}
if bits := prefix.Bits(); bits > best {
best = bits
}
}
for _, local := range localAddrs {
if local.Prefix != "" {
consider(local.Prefix, local.Interface)
continue
}
if local.Address != "" && local.PrefixLen > 0 {
consider(local.Address+"/"+strconv.Itoa(local.PrefixLen), local.Interface)
}
}
out, err := exec.Command("ip", "-4", "route", "show").Output()
if err != nil {
return best
}
for _, line := range strings.Split(string(out), "\n") {
fields := strings.Fields(line)
if len(fields) == 0 || fields[0] == "default" {
continue
}
if !strings.Contains(fields[0], "/") {
continue
}
routeIface := ""
for i := 0; i < len(fields)-1; i++ {
if fields[i] == "dev" {
routeIface = normalizeIface(fields[i+1])
break
}
}
consider(fields[0], routeIface)
}
return best
}
func ipv4PrefixString(addr netip.Addr, prefixLen int) string {
if prefixLen <= 0 || prefixLen > 32 {
prefixLen = 32
}
prefix, err := netip.ParsePrefix(addr.String() + "/" + strconv.Itoa(prefixLen))
if err != nil {
return addr.String() + "/" + strconv.Itoa(prefixLen)
}
return prefix.Masked().String()
}
func ipv4SubnetMask(prefixLen int) string {
if prefixLen < 0 || prefixLen > 32 {
return ""
}
var mask uint32
if prefixLen > 0 {
mask = ^uint32(0) << uint(32-prefixLen)
}
return uint32ToIPv4(mask).String()
}
func NormalizePublicIPv6Prefixes(items []config.PublicIPv6Prefix) ([]config.PublicIPv6Prefix, error) {
detected := detectPublicIPv6Prefixes(detectIPv6DefaultRoutes())
defaultIface := ""
defaultGateway := ""
for _, item := range detected {
if defaultIface == "" {
defaultIface = item.Interface
}
if defaultGateway == "" {
defaultGateway = item.Gateway
}
}
seen := map[string]bool{}
result := make([]config.PublicIPv6Prefix, 0, len(items))
for _, item := range items {
raw := strings.TrimSpace(item.Prefix)
if raw == "" {
raw = strings.TrimSpace(item.Address)
if raw != "" && !strings.Contains(raw, "/") && item.PrefixLen > 0 {
raw += "/" + strconv.Itoa(item.PrefixLen)
}
}
if raw == "" {
continue
}
prefix, err := netip.ParsePrefix(raw)
if err != nil || !prefix.Addr().Is6() {
return nil, fmt.Errorf("invalid IPv6 prefix: %s", raw)
}
if prefix.Bits() > 120 {
return nil, fmt.Errorf("IPv6 prefix %s is too small for allocation", prefix.String())
}
if !isPublicIPv6(prefix.Addr()) {
return nil, fmt.Errorf("IPv6 prefix %s is not public", prefix.String())
}
key := prefix.Masked().String()
if seen[key] {
continue
}
iface := strings.TrimSpace(item.Interface)
if iface == "" {
iface = defaultIface
}
if iface == "" {
return nil, fmt.Errorf("interface is required for IPv6 prefix %s", key)
}
gateway := strings.TrimSpace(item.Gateway)
if gateway == "" {
gateway = defaultGateway
}
seen[key] = true
result = append(result, config.PublicIPv6Prefix{
Address: prefix.Addr().String(),
Prefix: key,
PrefixLen: prefix.Bits(),
Interface: iface,
Gateway: gateway,
})
}
sort.SliceStable(result, func(i, j int) bool {
return result[i].Prefix < result[j].Prefix
})
return result, nil
}
func ScanPublicIPv4Segment(cidr string, iface string, gateway string, verify bool, limit int) ([]PublicIPv4ScanResult, error) {
if limit <= 0 || limit > 256 {
limit = 256
}
cidr = strings.TrimSpace(cidr)
if cidr == "" {
if host := DetectPublicIPv4(); host.Prefix != "" {
cidr = host.Prefix
}
}
prefix, err := netip.ParsePrefix(cidr)
if err != nil || !prefix.Addr().Is4() {
return nil, fmt.Errorf("invalid IPv4 segment: %s", cidr)
}
prefix = prefix.Masked()
bits := prefix.Bits()
if bits < 24 {
return nil, fmt.Errorf("IPv4 segment %s is too large; use /24 or smaller", prefix.String())
}
localAddrs := detectPublicIPv4LocalAddresses()
primaryHostIP := ""
defaultIface := strings.TrimSpace(iface)
defaultPrefixLen := bits
defaultRoutes := detectIPv4DefaultRoutes()
gateway = strings.TrimSpace(gateway)
if gateway == "" && defaultIface != "" {
gateway = ipv4GatewaysByInterface(defaultRoutes)[defaultIface]
}
if gateway != "" {
gatewayAddr, err := netip.ParseAddr(gateway)
if err != nil || !gatewayAddr.Is4() {
return nil, fmt.Errorf("gateway %s is not a valid IPv4 address", gateway)
}
gateway = gatewayAddr.String()
}
if defaultIface == "" && gateway != "" {
defaultIface = ipv4InterfaceForGateway(gateway, defaultRoutes)
}
localMap := map[string]bool{}
for _, local := range localAddrs {
if primaryHostIP == "" {
primaryHostIP = local.Address
}
if defaultIface == "" {
defaultIface = local.Interface
}
localMap[local.Address] = true
}
if defaultIface == "" {
return nil, fmt.Errorf("interface is required")
}
if gateway == "" {
return nil, fmt.Errorf("gateway is required")
}
assigned := map[string]bool{}
for _, c := range config.AppConfig.Containers {
for _, item := range c.PublicIPv4s {
if item.Address != "" {
assigned[item.Address] = true
}
}
}
inPool := map[string]bool{}
for _, item := range config.AppConfig.PublicIPv4Pool {
if item.Address != "" {
inPool[item.Address] = true
}
}
addresses := ipv4HostsInPrefix(prefix)
if len(addresses) > limit {
return nil, fmt.Errorf("IPv4 segment %s has %d hosts; limit is %d", prefix.String(), len(addresses), limit)
}
results := make([]PublicIPv4ScanResult, 0, len(addresses))
for _, addr := range addresses {
address := addr.String()
info := PublicIPInfo{
Address: address,
Interface: defaultIface,
Prefix: prefix.String(),
PrefixLen: defaultPrefixLen,
SubnetMask: ipv4SubnetMask(defaultPrefixLen),
Gateway: gateway,
IsTunnel: isTunnelLikeInterface(defaultIface),
Source: "scan",
}
result := PublicIPv4ScanResult{PublicIPInfo: info, Status: "unknown", Reason: "not checked"}
switch {
case address == primaryHostIP:
result.Status = "host"
result.Reason = "host primary IPv4"
case address == gateway:
result.Status = "gateway"
result.Reason = "default gateway"
case assigned[address]:
result.Status = "assigned"
result.Usable = true
result.Reason = "already assigned to a container"
case inPool[address]:
result.Status = "pool"
result.Usable = true
result.Reason = "already in allocation pool"
case localMap[address]:
result.Status = "configured"
result.Usable = true
result.Reason = "already configured on host"
case ipv4AddressResponds(defaultIface, address):
result.Status = "in_use"
result.Reason = "address responds on the network"
case verify:
if ok, reason := verifyIPv4SourceUsable(defaultIface, address); ok {
result.Status = "available"
result.Usable = true
result.Reason = reason
} else {
result.Status = "unknown"
result.Reason = reason
}
default:
result.Status = "available"
result.Usable = true
result.Reason = "no duplicate response detected; source routing not verified"
}
results = append(results, result)
}
return results, nil
}
func ipv4HostsInPrefix(prefix netip.Prefix) []netip.Addr {
bits := prefix.Bits()
base := ipv4ToUint32(prefix.Masked().Addr())
count := uint64(1) << uint(32-bits)
if bits == 32 {
return []netip.Addr{uint32ToIPv4(base)}
}
start := uint64(base)
end := start + count - 1
if bits <= 30 {
start++
end--
}
result := make([]netip.Addr, 0, count)
for value := start; value <= end; value++ {
result = append(result, uint32ToIPv4(uint32(value)))
}
return result
}
func ipv4AddressResponds(iface, address string) bool {
if commandExists("arping") {
if exec.Command("arping", "-D", "-I", iface, "-c", "2", "-w", "3", address).Run() != nil {
return true
}
return false
}
return exec.Command("ping", "-4", "-I", iface, "-c", "1", "-W", "1", address).Run() == nil
}
func verifyIPv4SourceUsable(iface, address string) (bool, string) {
cidr := address + "/32"
added := false
if exec.Command("ip", "-4", "addr", "show", "dev", iface, "to", cidr).Run() != nil {
output, err := exec.Command("ip", "-4", "addr", "add", cidr, "dev", iface, "label", iface+":clicdscan").CombinedOutput()
if err != nil {
return false, "failed to temporarily bind address: " + strings.TrimSpace(string(output))
}
added = true
}
if added {
defer exec.Command("ip", "-4", "addr", "del", cidr, "dev", iface).Run()
}
if commandExists("curl") {
for _, target := range []string{"https://api.ipify.org", "https://ifconfig.me/ip", "http://ifconfig.me/ip"} {
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
out, err := exec.CommandContext(ctx, "curl", "-4", "-sS", "--interface", address, "--max-time", "4", target).Output()
cancel()
if err == nil && strings.TrimSpace(string(out)) == address {
return true, "source IPv4 verified by external check"
}
}
}
for _, target := range []string{"1.1.1.1", "8.8.8.8"} {
if exec.Command("ping", "-4", "-I", address, "-c", "1", "-W", "2", target).Run() == nil {
return true, "source IPv4 can reach external network"
}
}
return false, "no duplicate response, but source IPv4 verification failed"
}
func commandExists(name string) bool {
_, err := exec.LookPath(name)
return err == nil
}
func detectPublicIPv4LocalAddresses() []PublicIPInfo {
out, err := exec.Command("ip", "-4", "-o", "addr", "show", "scope", "global").Output()
if err != nil {
return nil
}
defaultRoutes := detectIPv4DefaultRoutes()
defaultIfaces := map[string]bool{}
for _, route := range defaultRoutes {
defaultIfaces[route.Interface] = true
}
type candidate struct {
info PublicIPInfo
score int
}
var candidates []candidate
seen := map[string]bool{}
for _, line := range strings.Split(string(out), "\n") {
fields := strings.Fields(line)
if len(fields) < 4 || fields[2] != "inet" {
continue
}
iface := normalizeIface(fields[1])
if isContainerLikeInterface(iface) {
continue
}
prefix, err := netip.ParsePrefix(fields[3])
if err != nil || !prefix.Addr().Is4() || !isPublicIPv4(prefix.Addr()) {
continue
}
key := iface + "|" + prefix.Addr().String()
if seen[key] {
continue
}
seen[key] = true
score := publicInterfaceScore(iface, defaultIfaces)
candidates = append(candidates, candidate{
info: PublicIPInfo{
Address: prefix.Addr().String(),
Interface: iface,
Prefix: prefix.Masked().String(),
PrefixLen: prefix.Bits(),
SubnetMask: ipv4SubnetMask(prefix.Bits()),
Gateway: ipv4GatewayForInterface(defaultRoutes, iface),
IsTunnel: isTunnelLikeInterface(iface),
Source: "local",
},
score: score,
})
}
sort.SliceStable(candidates, func(i, j int) bool {
return candidates[i].score > candidates[j].score
})
result := make([]PublicIPInfo, 0, len(candidates))
for _, c := range candidates {
result = append(result, c.info)
}
return result
}
func AllocatePublicIPv4Assignments(id int, requested []string, count int, auto bool) ([]config.PublicIPv4Assignment, error) {
var err error
count, err = NormalizePublicIPAllocationCount(requested, count)
if err != nil {
return nil, err
}
candidates := DetectPublicIPv4Candidates()
if len(candidates) == 0 {
if len(requested) > 0 || auto {
return nil, fmt.Errorf("public IPv4 allocation is unavailable: no usable public IPv4 address found")
}
return nil, nil
}
byAddress := map[string]PublicIPInfo{}
for _, item := range candidates {
byAddress[item.Address] = item
}
used := map[string]bool{}
for _, c := range config.AppConfig.Containers {
if c.ID == id {
continue
}
for _, item := range c.PublicIPv4s {
if item.Address != "" {
used[item.Address] = true
}
}
}
result := []config.PublicIPv4Assignment{}
selected := map[string]bool{}
for _, raw := range requested {
raw = strings.TrimSpace(raw)
if raw == "" || selected[raw] {
continue
}
addr, err := netip.ParseAddr(raw)
if err != nil || !addr.Is4() {
return nil, fmt.Errorf("requested IPv4 %s is not valid", raw)
}
raw = addr.String()
if selected[raw] {
continue
}
info, ok := byAddress[raw]
if !ok {
return nil, fmt.Errorf("requested IPv4 %s is not an allocatable public IPv4", raw)
}
if used[raw] {
return nil, fmt.Errorf("requested IPv4 %s is already assigned", raw)
}
selected[raw] = true
used[raw] = true
result = append(result, config.PublicIPv4Assignment{Address: info.Address, Interface: info.Interface, PrefixLen: info.PrefixLen, Gateway: info.Gateway})
}
if len(result) >= count || !auto {
return result, nil
}
for _, info := range candidates {
if used[info.Address] || selected[info.Address] {
continue
}
used[info.Address] = true
selected[info.Address] = true
result = append(result, config.PublicIPv4Assignment{Address: info.Address, Interface: info.Interface, PrefixLen: info.PrefixLen, Gateway: info.Gateway})
if len(result) >= count {
return result, nil
}
}
if len(result) == 0 {
return nil, fmt.Errorf("no free public IPv4 address is available")
}
if len(result) < count {
return nil, fmt.Errorf("only %d free public IPv4 address(es) are available; %d requested", len(result), count)
}
return result, nil
}
func NormalizePublicIPAllocationCount(requested []string, count int) (int, error) {
if len(requested) > MaxPublicIPAssignments {
return 0, fmt.Errorf("IP address count cannot exceed %d", MaxPublicIPAssignments)
}
if count <= 0 {
count = 1
}
if len(requested) > count {
count = len(requested)
}
if count > MaxPublicIPAssignments {
return 0, fmt.Errorf("IP address count cannot exceed %d", MaxPublicIPAssignments)
}
return count, nil
}
func EnsureAssignedPublicIPv4s(assignments []config.PublicIPv4Assignment) {
for _, assignment := range assignments {
addr := strings.TrimSpace(assignment.Address)
iface := strings.TrimSpace(assignment.Interface)
if addr == "" || iface == "" {
continue
}
prefixLen := assignment.PrefixLen
if prefixLen <= 0 || prefixLen > 32 {
if info, ok := publicIPv4InfoByAddress(addr); ok && info.PrefixLen > 0 {
prefixLen = info.PrefixLen
if iface == "" {
iface = info.Interface
}
}
}
if prefixLen <= 0 || prefixLen > 32 {
prefixLen = 32
}
prefixLen = publicIPv4BindingPrefixLen(assignment, prefixLen)
cidr := fmt.Sprintf("%s/%d", addr, prefixLen)
if publicIPv4AddressBound(addr, iface) {
continue
}
if output, err := exec.Command("ip", "-4", "addr", "add", cidr, "dev", iface, "label", iface+":clicd").CombinedOutput(); err != nil {
fmt.Printf("Warning: failed to add assigned public IPv4 %s to %s: %v, output: %s\n", cidr, iface, err, string(output))
}
}
}
func publicIPv4BindingPrefixLen(assignment config.PublicIPv4Assignment, prefixLen int) int {
if prefixLen <= 0 || prefixLen > 32 {
return 32
}
addr, addrErr := netip.ParseAddr(strings.TrimSpace(assignment.Address))
gateway, gatewayErr := netip.ParseAddr(strings.TrimSpace(assignment.Gateway))
if addrErr != nil || gatewayErr != nil || !addr.Is4() || !gateway.Is4() {
return prefixLen
}
prefix, err := netip.ParsePrefix(addr.String() + "/" + strconv.Itoa(prefixLen))
if err != nil {
return prefixLen
}
if !prefix.Masked().Contains(gateway) {
return 32
}
return prefixLen
}
func publicIPv4AddressBound(address string, iface string) bool {
out, err := exec.Command("ip", "-4", "-o", "addr", "show", "dev", iface).Output()
if err != nil {
return false
}
for _, line := range strings.Split(string(out), "\n") {
fields := strings.Fields(line)
if len(fields) < 4 || fields[2] != "inet" {
continue
}
prefix, err := netip.ParsePrefix(fields[3])
if err == nil && prefix.Addr().String() == address {
return true
}
}
return false
}
func EnsureAllAssignedPublicIPv4s() {
for i := range config.AppConfig.Containers {
EnsureAssignedPublicIPv4s(config.AppConfig.Containers[i].PublicIPv4s)
}
}
func publicIPv4InfoByAddress(address string) (PublicIPInfo, bool) {
for _, info := range DetectPublicIPv4Candidates() {
if info.Address == address {
return info, true
}
}
return PublicIPInfo{}, false
}
func detectPublicIPv6Prefixes(defaultRoutes []routeInfo) []IPv6PrefixInfo {
out, err := exec.Command("ip", "-6", "-o", "addr", "show", "scope", "global").Output()
if err != nil {
return nil
}
defaultIfaces := map[string]bool{}
gateways := map[string]string{}
for _, route := range defaultRoutes {
defaultIfaces[route.Interface] = true
if route.Gateway != "" && gateways[route.Interface] == "" {
gateways[route.Interface] = route.Gateway
}
}
type candidate struct {
info IPv6PrefixInfo
score int
}
var candidates []candidate
seen := map[string]bool{}
for _, line := range strings.Split(string(out), "\n") {
fields := strings.Fields(line)
if len(fields) < 4 || fields[2] != "inet6" {
continue
}
iface := normalizeIface(fields[1])
if isContainerLikeInterface(iface) {
continue
}
prefix, err := netip.ParsePrefix(fields[3])
if err != nil || !prefix.Addr().Is6() {
continue
}
addr := prefix.Addr()
if !isPublicIPv6(addr) {
continue
}
// Require at least 8 host bits. /128 is a single address, not a usable segment.
if prefix.Bits() > 120 {
continue
}
masked := prefix.Masked()
key := iface + "|" + masked.String()
if seen[key] {
continue
}
seen[key] = true
score := publicInterfaceScore(iface, defaultIfaces)
if masked.Bits() <= 64 {
score += 20
}
info := IPv6PrefixInfo{
Interface: iface,
Address: addr.String(),
Prefix: masked.String(),
PrefixLen: masked.Bits(),
Gateway: gateways[iface],
IsTunnel: isTunnelLikeInterface(iface),
Source: "local",
}
candidates = append(candidates, candidate{info: info, score: score})
}
sort.SliceStable(candidates, func(i, j int) bool {
return candidates[i].score > candidates[j].score
})
result := make([]IPv6PrefixInfo, 0, len(candidates))
for _, c := range candidates {
result = append(result, c.info)
}
return result
}
type routeInfo struct {
Interface string
Gateway string
Metric int
}
func detectIPv4DefaultRoutes() []routeInfo {
out, err := exec.Command("ip", "-4", "route", "show", "default").Output()
if err != nil {
return nil
}
return parseDefaultRoutes(string(out))
}
func ipv4GatewayForInterface(routes []routeInfo, iface string) string {
for _, route := range routes {
if route.Interface == iface && route.Gateway != "" {
return route.Gateway
}
}
return ""
}
func detectIPv6DefaultRoutes() []routeInfo {
out, err := exec.Command("ip", "-6", "route", "show", "default").Output()
if err != nil {
return nil
}
return parseDefaultRoutes(string(out))
}
func parseDefaultRoutes(output string) []routeInfo {
var routes []routeInfo
for _, line := range strings.Split(output, "\n") {
fields := strings.Fields(line)
if len(fields) == 0 || fields[0] != "default" {
continue
}
route := routeInfo{Metric: 1024}
for i := 1; i < len(fields)-1; i++ {
switch fields[i] {
case "dev":
route.Interface = normalizeIface(fields[i+1])
case "via":
route.Gateway = fields[i+1]
case "metric":
metric, err := strconv.Atoi(fields[i+1])
if err == nil {
route.Metric = metric
}
}
}
if route.Interface != "" {
routes = append(routes, route)
}
}
sort.SliceStable(routes, func(i, j int) bool {
return routes[i].Metric < routes[j].Metric
})
return routes
}
func ipv6ConnectivityOK() bool {
targets := [][]string{
{"ping", "-6", "-c", "1", "-W", "2", "2606:4700:4700::1111"},
{"ping", "-6", "-c", "1", "-W", "2", "2001:4860:4860::8888"},
{"ping6", "-c", "1", "-W", "2", "2606:4700:4700::1111"},
}
for _, args := range targets {
if exec.Command(args[0], args[1:]...).Run() == nil {
return true
}
}
return false
}
func isContainerLikeInterface(iface string) bool {
prefixes := []string{
"lo", "lxc", "docker", "br-", "veth", "virbr", "cni", "flannel", "cali",
"kube", "dummy", "ifb", "zt", "zerotier",
}
for _, prefix := range prefixes {
if iface == prefix || strings.HasPrefix(iface, prefix) {
return true
}
}
return false
}
func normalizeIface(iface string) string {
iface = strings.TrimSuffix(iface, ":")
if at := strings.Index(iface, "@"); at >= 0 {
iface = iface[:at]
}
return iface
}
func publicInterfaceScore(iface string, defaultIfaces map[string]bool) int {
score := 0
if defaultIfaces[iface] {
score += 100
}
if isTunnelLikeInterface(iface) {
score -= 120
} else {
score += 80
}
if isLikelyPhysicalInterface(iface) {
score += 40
}
if operState(iface) == "up" {
score += 10
}
return score
}
func isLikelyPhysicalInterface(iface string) bool {
prefixes := []string{"eth", "ens", "eno", "enp", "em", "bond", "team"}
for _, prefix := range prefixes {
if strings.HasPrefix(iface, prefix) {
return true
}
}
return false
}
func isTunnelLikeInterface(iface string) bool {
lower := strings.ToLower(iface)
prefixes := []string{
"wg", "wgcf", "warp", "cloudflare", "tun", "tap", "tailscale", "ts",
"vpn", "ppp", "ipsec", "gre", "gretap", "sit", "he-", "nebula", "zt",
}
for _, prefix := range prefixes {
if lower == prefix || strings.HasPrefix(lower, prefix) {
return true
}
}
return strings.Contains(lower, "warp") || strings.Contains(lower, "cloudflare")
}
func operState(iface string) string {
path, err := safeSysClassNetFile(iface, "operstate")
if err != nil {
return ""
}
data, err := os.ReadFile(path)
if err != nil {
return ""
}
return strings.TrimSpace(string(data))
}
func safeSysClassNetFile(iface string, filename string) (string, error) {
iface = strings.TrimSpace(iface)
filename = strings.TrimSpace(filename)
if iface == "" || filename == "" || len(iface) > 64 || len(filename) > 64 {
return "", fmt.Errorf("invalid sysfs network path")
}
if iface == "." || iface == ".." || filename == "." || filename == ".." {
return "", fmt.Errorf("invalid sysfs network path")
}
if strings.ContainsAny(iface, "/\\\x00") || strings.ContainsAny(filename, "/\\\x00") {
return "", fmt.Errorf("invalid sysfs network path")
}
base := filepath.Clean("/sys/class/net")
path := filepath.Clean(filepath.Join(base, iface, filename))
if !strings.HasPrefix(path, base+string(os.PathSeparator)) {
return "", fmt.Errorf("invalid sysfs network path")
}
return path, nil
}
func isPublicIPv4(addr netip.Addr) bool {
if !addr.IsGlobalUnicast() || addr.IsPrivate() || addr.IsLoopback() || addr.IsLinkLocalUnicast() {
return false
}
raw := addr.As4()
if raw[0] == 100 && raw[1] >= 64 && raw[1] <= 127 {
return false
}
if raw[0] == 192 && raw[1] == 0 && raw[2] == 0 {
return false
}
if raw[0] == 192 && raw[1] == 0 && raw[2] == 2 {
return false
}
if raw[0] == 198 && (raw[1] == 18 || raw[1] == 19 || raw[1] == 51 && raw[2] == 100) {
return false
}
if raw[0] == 203 && raw[1] == 0 && raw[2] == 113 {
return false
}
return true
}
func ipv4ToUint32(addr netip.Addr) uint32 {
raw := addr.As4()
return binary.BigEndian.Uint32(raw[:])
}
func uint32ToIPv4(value uint32) netip.Addr {
var raw [4]byte
binary.BigEndian.PutUint32(raw[:], value)
return netip.AddrFrom4(raw)
}
func compareIPv4Strings(a, b string) int {
addrA, errA := netip.ParseAddr(a)
addrB, errB := netip.ParseAddr(b)
if errA == nil && errB == nil && addrA.Is4() && addrB.Is4() {
rawA := addrA.As4()
rawB := addrB.As4()
for i := range rawA {
if rawA[i] < rawB[i] {
return -1
}
if rawA[i] > rawB[i] {
return 1
}
}
return 0
}
return strings.Compare(a, b)
}
func isPublicIPv6(addr netip.Addr) bool {
if !addr.IsGlobalUnicast() || addr.IsPrivate() || addr.IsLoopback() || addr.IsLinkLocalUnicast() {
return false
}
return !strings.HasPrefix(addr.String(), "2001:db8:")
}
func (m *Manager) allocateIPv6ForContainer(id int) (string, int, string, error) {
assignments, err := m.allocateIPv6AssignmentsForContainer(id, nil, 1, true)
if err != nil {
return "", 0, "", err
}
if len(assignments) == 0 {
return "", 0, "", fmt.Errorf("no free IPv6 address")
}
return assignments[0].Address, assignments[0].PrefixLen, assignments[0].Interface, nil
}
func (m *Manager) allocateIPv6AssignmentsForContainer(id int, requested []string, count int, auto bool) ([]config.IPv6Assignment, error) {
var err error
count, err = NormalizePublicIPAllocationCount(requested, count)
if err != nil {
return nil, err
}
status := m.DetectIPv6Status()
if !status.Available {
return nil, fmt.Errorf("public IPv6 allocation is unavailable: %s", status.Reason)
}
prefixes := make([]struct {
info IPv6PrefixInfo
prefix netip.Prefix
}, 0, len(status.Prefixes))
for _, prefixInfo := range status.Prefixes {
prefix, err := netip.ParsePrefix(prefixInfo.Prefix)
if err != nil {
continue
}
prefixes = append(prefixes, struct {
info IPv6PrefixInfo
prefix netip.Prefix
}{info: prefixInfo, prefix: prefix})
}
if len(prefixes) == 0 {
return nil, fmt.Errorf("public IPv6 allocation is unavailable: no valid IPv6 prefix")
}
used := map[string]bool{}
hostAddrs := map[string]bool{}
for _, p := range status.Prefixes {
hostAddrs[p.Address] = true
}
for _, c := range config.AppConfig.Containers {
if c.ID == id {
continue
}
if c.IPv6 != "" {
used[c.IPv6] = true
}
for _, ip := range c.IPv6Addresses {
if ip.Address != "" {
used[ip.Address] = true
}
}
}
result := []config.IPv6Assignment{}
selected := map[string]bool{}
for _, raw := range requested {
raw = strings.TrimSpace(raw)
if raw == "" || selected[raw] {
continue
}
addr, err := netip.ParseAddr(raw)
if err != nil || !addr.Is6() {
return nil, fmt.Errorf("requested IPv6 %s is not valid", raw)
}
matchIndex := -1
for i, item := range prefixes {
if item.prefix.Contains(addr) {
matchIndex = i
break
}
}
if matchIndex < 0 {
return nil, fmt.Errorf("requested IPv6 %s is not in the configured IPv6 prefixes", raw)
}
if hostAddrs[raw] {
return nil, fmt.Errorf("requested IPv6 %s is used by host", raw)
}
if used[raw] {
return nil, fmt.Errorf("requested IPv6 %s is already assigned", raw)
}
selected[raw] = true
used[raw] = true
result = append(result, config.IPv6Assignment{Address: raw, PrefixLen: prefixes[matchIndex].prefix.Bits(), Interface: prefixes[matchIndex].info.Interface})
}
if len(result) >= count || !auto {
return result, nil
}
for _, item := range prefixes {
for offset := uint64(0x1000 + id); offset < 0x100000; offset++ {
addr, err := ipv6Add(item.prefix.Masked().Addr(), offset)
if err != nil || !item.prefix.Contains(addr) {
break
}
candidate := addr.String()
if !used[candidate] && !hostAddrs[candidate] {
used[candidate] = true
result = append(result, config.IPv6Assignment{Address: candidate, PrefixLen: item.prefix.Bits(), Interface: item.info.Interface})
if len(result) >= count {
return result, nil
}
}
}
}
return nil, fmt.Errorf("no free IPv6 address in configured prefixes")
}
func ipv6Add(base netip.Addr, offset uint64) (netip.Addr, error) {
raw := base.As16()
value := big.NewInt(0).SetBytes(raw[:])
add := make([]byte, 8)
binary.BigEndian.PutUint64(add, offset)
value.Add(value, big.NewInt(0).SetBytes(add))
bytes := value.Bytes()
if len(bytes) > 16 {
return netip.Addr{}, fmt.Errorf("IPv6 address overflow")
}
padded := make([]byte, 16)
copy(padded[16-len(bytes):], bytes)
var out [16]byte
copy(out[:], padded)
return netip.AddrFrom16(out), nil
}
func ipv6AssignmentAddresses(assignments []config.IPv6Assignment) []string {
values := make([]string, 0, len(assignments))
for _, item := range assignments {
if strings.TrimSpace(item.Address) != "" {
values = append(values, strings.TrimSpace(item.Address))
}
}
return values
}
func normalizeIPv6List(values []string) []string {
seen := map[string]bool{}
result := make([]string, 0, len(values))
for _, value := range values {
value = strings.TrimSpace(value)
if value == "" || seen[value] {
continue
}
seen[value] = true
result = append(result, value)
}
return result
}
func shellQuotedIPv6List(values []string) string {
values = normalizeIPv6List(values)
if len(values) == 0 {
return "''"
}
quoted := make([]string, 0, len(values))
for _, value := range values {
quoted = append(quoted, shellQuote(value))
}
return strings.Join(quoted, " ")
}
func (m *Manager) AssignIPv6(id int) (*config.Container, error) {
c := config.FindContainer(id)
if c == nil {
return nil, fmt.Errorf("container not found: %d", id)
}
if c.IPv6 == "" {
assignments, err := m.allocateIPv6AssignmentsForContainer(id, nil, 1, true)
if err != nil {
return nil, err
}
c.IPv6Addresses = append(c.IPv6Addresses, assignments...)
c.NormalizeNetworkAssignments()
config.SaveConfig()
}
if err := m.applyIPv6Config(c.LxcName(), c.IPv6AddressStrings()...); err != nil {
return nil, err
}
rootfsPath := filepath.Join(m.LxcPath, c.LxcName(), "rootfs")
if _, err := os.Stat(rootfsPath); err == nil {
if err := installContainerIPv6Init(rootfsPath, c.IPv6AddressStrings()...); err != nil {
fmt.Printf("Warning: failed to install IPv6 init in %s: %v\n", c.LxcName(), err)
}
}
if err := m.ApplyIPv6(id); err != nil {
return nil, err
}
return c, nil
}
func (m *Manager) UpdateIPv6Assignments(id int, requested []string, count int, auto bool) (*config.Container, error) {
c := config.FindContainer(id)
if c == nil {
return nil, fmt.Errorf("container not found: %d", id)
}
oldAssignments := append([]config.IPv6Assignment(nil), c.IPv6Addresses...)
oldPrimary := c.IPv6
oldPrimaryPrefixLen := c.IPv6PrefixLen
oldPrimaryInterface := c.IPv6Interface
assignments := []config.IPv6Assignment{}
if auto || len(requested) > 0 {
allocated, err := m.allocateIPv6AssignmentsForContainer(id, requested, count, auto)
if err != nil {
return nil, err
}
assignments = allocated
}
for _, assignment := range oldAssignments {
uplink := assignment.Interface
if uplink == "" {
uplink = oldPrimaryInterface
}
removeHostIPv6Routing(assignment.Address, uplink)
}
if len(oldAssignments) == 0 && oldPrimary != "" {
removeHostIPv6Routing(oldPrimary, oldPrimaryInterface)
oldAssignments = append(oldAssignments, config.IPv6Assignment{Address: oldPrimary, PrefixLen: oldPrimaryPrefixLen, Interface: oldPrimaryInterface})
}
c.IPv6 = ""
c.IPv6PrefixLen = 0
c.IPv6Interface = ""
c.IPv6Addresses = assignments
c.NormalizeNetworkAssignments()
config.SaveConfig()
if err := m.applyIPv6Config(c.LxcName(), c.IPv6AddressStrings()...); err != nil {
return nil, err
}
rootfsPath := filepath.Join(m.LxcPath, c.LxcName(), "rootfs")
if _, err := os.Stat(rootfsPath); err == nil {
if len(c.IPv6Addresses) == 0 {
if err := removeContainerIPv6Init(rootfsPath); err != nil {
fmt.Printf("Warning: failed to remove IPv6 init in %s: %v\n", c.LxcName(), err)
}
} else if err := installContainerIPv6Init(rootfsPath, c.IPv6AddressStrings()...); err != nil {
fmt.Printf("Warning: failed to install IPv6 init in %s: %v\n", c.LxcName(), err)
}
}
status, _ := m.GetContainerStatus(c.LxcName())
if status == "running" {
m.removeGuestIPv6Addresses(c.LxcName(), oldAssignments)
}
if len(c.IPv6Addresses) > 0 {
if err := m.ApplyIPv6(id); err != nil {
return nil, err
}
} else if status == "running" {
m.removeGuestIPv6DefaultRoute(c.LxcName())
if err := ApplyFirewallRules(c.ID); err != nil {
fmt.Printf("Warning: failed to re-apply firewall rules after IPv6 removal for %s: %v\n", c.Name, err)
}
}
return c, nil
}
func (m *Manager) applyIPv6Config(lxcName string, ipv6s ...string) error {
configFile := filepath.Join(m.LxcPath, lxcName, "config")
data, err := os.ReadFile(configFile)
if err != nil {
return fmt.Errorf("failed to read container config: %v", err)
}
lines := strings.Split(string(data), "\n")
next := make([]string, 0, len(lines)+4)
for _, line := range lines {
trimmed := strings.TrimSpace(line)
if strings.Contains(trimmed, "# clicd managed: public IPv6") ||
strings.HasPrefix(trimmed, "lxc.net.0.ipv6.address") ||
strings.HasPrefix(trimmed, "lxc.net.0.ipv6.gateway") {
continue
}
next = append(next, line)
}
ipv6s = normalizeIPv6List(ipv6s)
if len(ipv6s) > 0 {
next = append(next, "", "# clicd managed: public IPv6 routed /128")
for _, ipv6 := range ipv6s {
next = append(next, fmt.Sprintf("lxc.net.0.ipv6.address = %s/128", ipv6))
}
next = append(next, "lxc.net.0.ipv6.gateway = auto")
}
return os.WriteFile(configFile, []byte(strings.Join(next, "\n")), 0644)
}
func (m *Manager) ApplyIPv6(id int) error {
c := config.FindContainer(id)
if c == nil {
return fmt.Errorf("container not found: %d", id)
}
if c.IPv6 == "" && len(c.IPv6Addresses) == 0 {
return nil
}
c.NormalizeNetworkAssignments()
if c.IPv6Interface == "" {
status := m.DetectIPv6Status()
if len(status.Prefixes) == 0 {
return fmt.Errorf("failed to detect IPv6 uplink for %s", c.IPv6)
}
c.IPv6Interface = status.Prefixes[0].Interface
c.IPv6PrefixLen = status.Prefixes[0].PrefixLen
for i := range c.IPv6Addresses {
if c.IPv6Addresses[i].Interface == "" {
c.IPv6Addresses[i].Interface = c.IPv6Interface
}
if c.IPv6Addresses[i].PrefixLen == 0 {
c.IPv6Addresses[i].PrefixLen = c.IPv6PrefixLen
}
}
config.SaveConfig()
}
rootfsPath := filepath.Join(m.LxcPath, c.LxcName(), "rootfs")
if _, err := os.Stat(rootfsPath); err == nil {
if err := installContainerIPv6Init(rootfsPath, c.IPv6AddressStrings()...); err != nil {
fmt.Printf("Warning: failed to install IPv6 init in %s: %v\n", c.LxcName(), err)
}
}
for _, assignment := range c.IPv6Addresses {
uplink := assignment.Interface
if uplink == "" {
uplink = c.IPv6Interface
}
if err := ensureHostIPv6Routing(assignment.Address, uplink); err != nil {
return err
}
}
status, _ := m.GetContainerStatus(c.LxcName())
if status != "running" {
return nil
}
addrs := shellQuotedIPv6List(c.IPv6AddressStrings())
cmd := exec.Command("lxc-attach", "-n", c.LxcName(), "--", "sh", "-c",
fmt.Sprintf("for ip in %s; do ip -6 addr replace \"$ip/128\" dev eth0; done && ip -6 route replace default via %s dev eth0 metric 100",
addrs, shellQuote(ipv6GatewayLinkLocal)))
output, err := cmd.CombinedOutput()
if err != nil {
return fmt.Errorf("failed to apply IPv6 inside container: %v, output: %s", err, string(output))
}
for _, assignment := range c.IPv6Addresses {
uplink := assignment.Interface
if uplink == "" {
uplink = c.IPv6Interface
}
removeIPv6NAT66(assignment.Address, uplink)
}
if !containerIPv6ConnectivityOK(c.LxcName()) {
for _, assignment := range c.IPv6Addresses {
uplink := assignment.Interface
if uplink == "" {
uplink = c.IPv6Interface
}
ensureIPv6NAT66(assignment.Address, uplink)
}
}
if err := ApplyFirewallRules(c.ID); err != nil {
fmt.Printf("Warning: failed to re-apply firewall rules after IPv6 setup for %s: %v\n", c.Name, err)
}
return nil
}
func ensureHostIPv6Routing(ipv6, uplink string) error {
if uplink == "" {
return fmt.Errorf("missing IPv6 uplink interface")
}
runQuiet("sysctl", "-w", "net.ipv6.conf.all.forwarding=1")
runQuiet("sysctl", "-w", "net.ipv6.conf."+uplink+".accept_ra=2")
runQuiet("sysctl", "-w", "net.ipv6.conf."+uplink+".proxy_ndp=1")
runQuiet("ip", "link", "set", "lxcbr0", "up")
runQuiet("ip", "-6", "addr", "add", ipv6GatewayLinkLocal+"/64", "dev", "lxcbr0")
if out, err := exec.Command("ip", "-6", "route", "replace", ipv6+"/128", "dev", "lxcbr0").CombinedOutput(); err != nil {
return fmt.Errorf("failed to add IPv6 host route: %v, output: %s", err, string(out))
}
if out, err := exec.Command("ip", "-6", "neigh", "replace", "proxy", ipv6, "dev", uplink).CombinedOutput(); err != nil {
return fmt.Errorf("failed to add IPv6 proxy NDP: %v, output: %s", err, string(out))
}
ensureIPv6ForwardRules(ipv6)
return nil
}
func installContainerIPv6Init(rootfsPath string, ipv6s ...string) error {
ipv6s = normalizeIPv6List(ipv6s)
if len(ipv6s) == 0 {
return nil
}
for _, ipv6 := range ipv6s {
if _, err := netip.ParseAddr(ipv6); err != nil {
return fmt.Errorf("invalid IPv6 address %q: %w", ipv6, err)
}
}
scriptPath := filepath.Join(rootfsPath, "usr", "local", "sbin", "clicd-ipv6-init")
if err := os.MkdirAll(filepath.Dir(scriptPath), 0755); err != nil {
return err
}
script := `#!/bin/sh
IPV6_ADDRS="` + strings.Join(ipv6s, " ") + `"
IPV6_GW=` + shellQuote(ipv6GatewayLinkLocal) + `
IFACE="${CLICD_IPV6_IFACE:-eth0}"
command -v ip >/dev/null 2>&1 || exit 0
i=0
while [ "$i" -lt 30 ]; do
if ip link show dev "$IFACE" >/dev/null 2>&1; then
break
fi
i=$((i + 1))
sleep 1
done
ip link set dev "$IFACE" up >/dev/null 2>&1 || true
for IPV6_ADDR in $IPV6_ADDRS; do
ip -6 addr replace "$IPV6_ADDR/128" dev "$IFACE" >/dev/null 2>&1 || true
done
ip -6 route replace default via "$IPV6_GW" dev "$IFACE" metric 100 >/dev/null 2>&1 || true
exit 0
`
if err := os.WriteFile(scriptPath, []byte(script), 0755); err != nil {
return err
}
osRelease := ""
if data, err := os.ReadFile(filepath.Join(rootfsPath, "etc", "os-release")); err == nil {
osRelease = strings.ToLower(string(data))
}
hasSystemd := dirExists(filepath.Join(rootfsPath, "etc", "systemd", "system"))
hasOpenRC := fileExists(filepath.Join(rootfsPath, "sbin", "openrc-run")) || strings.Contains(osRelease, "alpine")
if hasSystemd {
if err := installContainerIPv6Systemd(rootfsPath); err != nil {
return err
}
}
if hasOpenRC {
if err := installContainerIPv6OpenRC(rootfsPath); err != nil {
return err
}
}
if !hasSystemd && !hasOpenRC {
if err := installContainerIPv6SysV(rootfsPath); err != nil {
return err
}
}
return nil
}
func removeContainerIPv6Init(rootfsPath string) error {
paths := []string{
filepath.Join(rootfsPath, "usr", "local", "sbin", "clicd-ipv6-init"),
filepath.Join(rootfsPath, "etc", "systemd", "system", "clicd-ipv6.service"),
filepath.Join(rootfsPath, "etc", "systemd", "system", "multi-user.target.wants", "clicd-ipv6.service"),
filepath.Join(rootfsPath, "etc", "init.d", "clicd-ipv6"),
filepath.Join(rootfsPath, "etc", "runlevels", "default", "clicd-ipv6"),
}
for _, level := range []string{"2", "3", "4", "5"} {
paths = append(paths, filepath.Join(rootfsPath, "etc", "rc"+level+".d", "S99clicd-ipv6"))
}
for _, path := range paths {
if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
return err
}
}
return nil
}
func installContainerIPv6Systemd(rootfsPath string) error {
servicePath := filepath.Join(rootfsPath, "etc", "systemd", "system", "clicd-ipv6.service")
if err := os.MkdirAll(filepath.Dir(servicePath), 0755); err != nil {
return err
}
service := `[Unit]
Description=CLICD IPv6 setup
After=network-online.target network.target
Wants=network-online.target
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/clicd-ipv6-init
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
`
if err := os.WriteFile(servicePath, []byte(service), 0644); err != nil {
return err
}
wantsDir := filepath.Join(rootfsPath, "etc", "systemd", "system", "multi-user.target.wants")
if err := os.MkdirAll(wantsDir, 0755); err != nil {
return err
}
return replaceSymlink("../clicd-ipv6.service", filepath.Join(wantsDir, "clicd-ipv6.service"))
}
func installContainerIPv6OpenRC(rootfsPath string) error {
initPath := filepath.Join(rootfsPath, "etc", "init.d", "clicd-ipv6")
if err := os.MkdirAll(filepath.Dir(initPath), 0755); err != nil {
return err
}
initScript := `#!/sbin/openrc-run
name="CLICD IPv6 setup"
description="Apply CLICD IPv6 settings"
depend() {
after net networking
need net
}
start() {
ebegin "Applying CLICD IPv6"
/usr/local/sbin/clicd-ipv6-init
eend $?
}
`
if err := os.WriteFile(initPath, []byte(initScript), 0755); err != nil {
return err
}
runlevelDir := filepath.Join(rootfsPath, "etc", "runlevels", "default")
if err := os.MkdirAll(runlevelDir, 0755); err != nil {
return err
}
return replaceSymlink(filepath.Join("..", "..", "init.d", "clicd-ipv6"), filepath.Join(runlevelDir, "clicd-ipv6"))
}
func installContainerIPv6SysV(rootfsPath string) error {
initDir := filepath.Join(rootfsPath, "etc", "init.d")
if err := os.MkdirAll(initDir, 0755); err != nil {
return err
}
initPath := filepath.Join(initDir, "clicd-ipv6")
initScript := `#!/bin/sh
### BEGIN INIT INFO
# Provides: clicd-ipv6
# Required-Start: $network
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop:
# Short-Description: CLICD IPv6 setup
### END INIT INFO
case "$1" in
start|restart|force-reload)
/usr/local/sbin/clicd-ipv6-init
;;
stop|status)
exit 0
;;
*)
echo "Usage: $0 {start|stop|restart|force-reload|status}"
exit 1
;;
esac
exit 0
`
if err := os.WriteFile(initPath, []byte(initScript), 0755); err != nil {
return err
}
for _, level := range []string{"2", "3", "4", "5"} {
rcDir := filepath.Join(rootfsPath, "etc", "rc"+level+".d")
if !dirExists(rcDir) {
continue
}
if err := replaceSymlink(filepath.Join("..", "init.d", "clicd-ipv6"), filepath.Join(rcDir, "S99clicd-ipv6")); err != nil {
return err
}
}
return nil
}
func replaceSymlink(target, linkPath string) error {
if current, err := os.Readlink(linkPath); err == nil && current == target {
return nil
}
if err := os.Remove(linkPath); err != nil && !os.IsNotExist(err) {
return err
}
return os.Symlink(target, linkPath)
}
func fileExists(path string) bool {
info, err := os.Stat(path)
return err == nil && !info.IsDir()
}
func dirExists(path string) bool {
info, err := os.Stat(path)
return err == nil && info.IsDir()
}
func ensureIPv6ForwardRules(ipv6 string) {
rules := [][]string{
{"FORWARD", "-i", "lxcbr0", "-s", ipv6 + "/128", "-j", "ACCEPT"},
{"FORWARD", "-o", "lxcbr0", "-d", ipv6 + "/128", "-j", "ACCEPT"},
}
for _, rule := range rules {
check := append([]string{"-C"}, rule...)
add := append([]string{"-A"}, rule...)
if exec.Command("ip6tables", check...).Run() != nil {
exec.Command("ip6tables", add...).Run()
}
}
}
func removeHostIPv6Routing(ipv6, uplink string) {
removeIPv6NAT66(ipv6, uplink)
removeIPv6ForwardRules(ipv6)
runQuiet("ip", "-6", "route", "del", ipv6+"/128", "dev", "lxcbr0")
if uplink != "" {
runQuiet("ip", "-6", "neigh", "del", "proxy", ipv6, "dev", uplink)
}
}
func removeIPv6ForwardRules(ipv6 string) {
rules := [][]string{
{"FORWARD", "-i", "lxcbr0", "-s", ipv6 + "/128", "-j", "ACCEPT"},
{"FORWARD", "-o", "lxcbr0", "-d", ipv6 + "/128", "-j", "ACCEPT"},
}
for _, rule := range rules {
del := append([]string{"-D"}, rule...)
for exec.Command("ip6tables", del...).Run() == nil {
}
}
}
func containerIPv6ConnectivityOK(lxcName string) bool {
targets := []string{"2606:4700:4700::1111", "2001:4860:4860::8888"}
for _, target := range targets {
if exec.Command("lxc-attach", "-n", lxcName, "--", "ping", "-6", "-c", "1", "-W", "2", target).Run() == nil {
return true
}
}
return false
}
func (m *Manager) removeGuestIPv6Addresses(lxcName string, assignments []config.IPv6Assignment) {
addrs := ipv6AssignmentAddresses(assignments)
if len(addrs) == 0 {
return
}
quoted := shellQuotedIPv6List(addrs)
_ = exec.Command("lxc-attach", "-n", lxcName, "--", "sh", "-c",
fmt.Sprintf("for ip in %s; do ip -6 addr del \"$ip/128\" dev eth0 2>/dev/null || true; done", quoted)).Run()
}
func (m *Manager) removeGuestIPv6DefaultRoute(lxcName string) {
_ = exec.Command("lxc-attach", "-n", lxcName, "--", "sh", "-c",
fmt.Sprintf("ip -6 route del default via %s dev eth0 2>/dev/null || true", shellQuote(ipv6GatewayLinkLocal))).Run()
}
func ensureIPv6NAT66(ipv6, uplink string) {
if ipv6 == "" || uplink == "" {
return
}
rule := []string{"POSTROUTING", "-s", ipv6 + "/128", "-o", uplink, "-j", "MASQUERADE"}
check := append([]string{"-t", "nat", "-C"}, rule...)
add := append([]string{"-t", "nat", "-A"}, rule...)
if exec.Command("ip6tables", check...).Run() != nil {
exec.Command("ip6tables", add...).Run()
}
}
func removeIPv6NAT66(ipv6, uplink string) {
if ipv6 == "" || uplink == "" {
return
}
rule := []string{"POSTROUTING", "-s", ipv6 + "/128", "-o", uplink, "-j", "MASQUERADE"}
del := append([]string{"-t", "nat", "-D"}, rule...)
for exec.Command("ip6tables", del...).Run() == nil {
}
}
func runQuiet(name string, args ...string) {
_ = exec.Command(name, args...).Run()
}
func (m *Manager) AssignedIPv6Count() int {
count := 0
for _, c := range config.AppConfig.Containers {
if strings.TrimSpace(c.IPv6) != "" {
count++
}
}
return count
}
func IPv6PrefixCapacity(prefixLen int) string {
if prefixLen <= 0 || prefixLen > 128 {
return "0"
}
hostBits := 128 - prefixLen
if hostBits > 32 {
return "large"
}
return strconv.FormatUint(uint64(1)<<uint(hostBits), 10)
}
Reference in New Issue View Git Blame Copy Permalink