Networking: Adding Base Networking Support for CC using iproute2

[mcastelino]

Networking: Basic Networking Support

Support for a single network docker container. Support the default docker networks none and bridge.

docker net=none and docker net=bridge

This commit includes support for

• Discovering the first docker CNM created network interface with a valid IPv4 address
  • Discovering IPv4 address, subnet, MAC address and default gateway
• Sending IP Configuration Parameters into the guest kernel
• Sending in the hostname to the guest kernel
• Creation of a single tap interface that can be used to connect the VM to a single container network
• Configuration of the MAC address via QEMU
• Quick and dirty iproute2 implementation that creates and integration
  bridge and connects it to the container interface (veth)
  and the tap interface (tap)
• Reprogramming of the veth MAC to one that does not conflict with the MAC that is now assigned to the tap within the VM

Limitations:

• Multiple networks are not supported
• IPv4+IPv6 containers are not supported due the kernel command line limitations.
• Setup latency is high due to the use of iproute2 commands
• Does not propagate routes from the namespace into the VM

Future Work:
This implementation uses shell invocation vs netlink commands.
A future refined implementation will use netlink based interface to configure networking.
Future implementation will use a cloud-init based configuration that allows for IPv4 and IPv6 support

Overall Flow

• From the parent process, create the netns (this will propagate into the child)
• Fork the parent process and have the child wait on its networking configuration pipe
• Capture the child pid in the parent
• From the parent process:
  a. Create state file (include the PID)
  b. Run hooks (sending PID to docker)
  - Docker CNM now populate the namespace with networking
  c. Create the network
  • Do this by scanning the network namespace in the parent
  • And create the appropriate plumbing
    d. Build the netcfg (key=value) concatenated network string
    • This uses what we scanned and what we created
      d. Send the netcfg to the child
      e. From the child process, receive the netcfg blob, parse it and add it to the process arguments
      f. From the child process, execve(qemu).
  • The child process arguments will contain the networking ones.
  • We have to wait to launch qemu till we get the network parameters as the parameters
    are needed to specify the tap interface(s) to be used by QEMU and to wait for the
    values of the kernel networking
    parameters

Note: In theory we can send the pid of the parent itself, but by doing so we may cause docker to record the pid somewhere, and this may cause issues elsewhere.

[jcvenegas]

The plan to get a deafult gateway is use the namespace interface as well ? I've created an issue about this #55

[jodh-intel]

This needs a check like the following:

if (! tap) {

    return false;
}

[jodh-intel]

LGTM. Tested and lookups and external connectivity now work for me. +1.

[sameo]

Looks good to me as well.