slirp4netns.sh: Implement API socket option for port forwarding

Introduce the equivalent of the --api-socket option from slirp4netns:
spawn a subshell to handle requests, netcat binds to a UNIX domain
socket and jq parses messages.

Three minor differences compared to slirp4netns:

- IPv6 ports are forwarded too

- error messages are not as specific, for example we don't tell
  apart malformed JSON requests from invalid parameters

- host addresses are always 0.0.0.0 and ::1, pasta doesn't bind on
  specific addresses for different ports

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

slirp4netns.sh

@@ -12,13 +12,20 @@
 #
 # WARNING: Draft quality, not really tested
 #
-# Copyright (c) 2021 Red Hat GmbH
+# Copyright (c) 2021-2022 Red Hat GmbH
 # Author: Stefano Brivio <sbrivio@redhat.com>
 
 PASTA_PID="$(mktemp)"
 PASTA_OPTS="-q --ipv4-only -a 10.0.2.0 -n 24 -g 10.0.2.2 -m 1500 --no-ndp --no-dhcpv6 --no-dhcp -P ${PASTA_PID}"
 PASTA="$(command -v ./pasta || command -v pasta || :)"
 
+API_SOCKET=
+API_DIR="$(mktemp -d)"
+PORTS_DIR="${API_DIR}/ports"
+FIFO_REQ="${API_DIR}/req.fifo"
+FIFO_RESP="${API_DIR}/resp.fifo"
+PORT_ARGS=
+
 USAGE_RET=1
 NOTFOUND_RET=127
 
@@ -112,6 +119,172 @@ opt() {
 	esac
 }
 
+# start() - Start pasta
+start() {
+	${PASTA} ${PASTA_OPTS} ${PORT_ARGS} ${ns_spec}
+	[ ${RFD} -ne 0 ] && echo "1" >&${RFD} || :
+}
+
+# start() - Terminate pasta process
+stop() {
+	kill $(cat ${PASTA_PID})
+}
+
+# api_insert() - Handle add_hostfwd request, update PORT_ARGS
+# $1:	Protocol, "tcp" or "udp"
+# $2:	Host port
+# $3:	Guest port
+api_insert() {
+	__id=
+	__next_id=1	# slirp4netns starts from ID 1
+	PORT_ARGS=
+
+	for __entry in $(ls ${PORTS_DIR}); do
+		PORT_ARGS="${PORT_ARGS} $(cat "${PORTS_DIR}/${__entry}")"
+
+		if [ -z "${__id}" ] && [ ${__entry} -ne ${__next_id} ]; then
+			__id=${__next_id}
+		fi
+
+		__next_id=$((__next_id + 1))
+	done
+	[ -z "${__id}" ] && __id=${__next_id}
+
+	# Invalid ports are accepted by slirp4netns, store them as empty files.
+	# Unknown protocols aren't.
+
+	case ${1} in
+	"tcp") opt="-t" ;;
+	"udp") opt="-u" ;;
+	*)
+		echo '{"error":{"desc":"bad request: add_hostfwd: bad arguments.proto"}}'
+		return
+		;;
+	esac
+
+	if [ ${2} -ge 0 ] && [ ${2} -le 65535 ] && \
+	   [ ${3} -ge 0 ] && [ ${3} -le 65535 ]; then
+		echo "${opt} ${2}:${3}" > "${PORTS_DIR}/${__id}"
+		PORT_ARGS="${PORT_ARGS} ${opt} ${2}:${3}"
+	else
+		:> "${PORTS_DIR}/${__id}"
+	fi
+
+	echo "{ \"return\": {\"id\": ${__id}}}"
+
+	NEED_RESTART=1
+}
+
+# api_list_one() - Print a single port forwarding entry in JSON
+# $1:	ID
+# $2:	protocol option, -t or -u
+# $3:	host port
+# $4:	guest port
+api_list_one() {
+	[ "${2}" = "-t" ] && __proto="tcp" || __proto="udp"
+
+	printf '{"id": %i, "proto": "%s", "host_addr": "0.0.0.0", "host_port": %i, "guest_addr": "%s", "guest_port": %i}' \
+		"${1}" "${__proto}" "${3}" "${A4}" "${4}"
+}
+
+# api_list() - Handle list_hostfwd request: list port forwarding entries in JSON
+api_list() {
+	printf '{ "return": {"entries": ['
+
+	__first=1
+	for __entry in $(ls "${PORTS_DIR}"); do
+		[ ${__first} -eq 0 ] && printf ", " || __first=0
+		IFS=' :'
+		api_list_one ${__entry} $(cat ${PORTS_DIR}/${__entry})
+		unset IFS
+	done
+
+	printf ']}}'
+}
+
+# api_delete() - Handle remove_hostfwd request: delete entry, update PORT_ARGS
+# $1:	Entry ID -- caller *must* ensure it's a number
+api_delete() {
+	if [ ! -f "${PORTS_DIR}/${1}" ]; then
+		printf '{"error":{"desc":"bad request: remove_hostfwd: bad arguments.id"}}'
+		return
+	fi
+
+	rm "${PORTS_DIR}/${1}"
+
+	PORT_ARGS=
+	for __entry in $(ls ${PORTS_DIR}); do
+		PORT_ARGS="${PORT_ARGS} $(cat "${PORTS_DIR}/${__entry}")"
+	done
+
+	printf '{"return":{}}'
+
+	NEED_RESTART=1
+}
+
+# api_error() - Print generic error in JSON
+api_error() {
+	printf '{"error":{"desc":"bad request"}}'
+}
+
+# api_handler() - Entry point for slirp4netns-like API socket handler
+api_handler() {
+	trap 'exit 0' INT QUIT TERM
+	mkdir "${PORTS_DIR}"
+
+	while true; do
+		mkfifo "${FIFO_REQ}" "${FIFO_RESP}"
+
+		cat "${FIFO_RESP}" | nc -l -U "${API_SOCKET}" | \
+			tee /dev/null >"${FIFO_REQ}" & READER_PID=${!}
+
+		__req="$(dd count=1 2>/dev/null <${FIFO_REQ})"
+
+		>&2 echo "apifd event"
+		>&2 echo "api_handler: got request: ${__req}"
+
+		eval $(echo "${__req}" |
+			(jq -r 'to_entries | .[0] |
+			 .key + "=" + (.value | @sh)' ||
+			 printf 'execute=ERR'))
+
+		if [ "${execute}" != "list_hostfwd" ]; then
+			eval $(echo "${__req}" |
+				(jq -r '.arguments | to_entries | .[] |
+				 .key + "=" + (.value | @sh)' ||
+				 printf 'execute=ERR'))
+		fi
+
+		NEED_RESTART=0
+		case ${execute} in
+		"add_hostfwd")
+			api_insert "${proto}" "${host_port}" "${guest_port}"
+			__restart=1
+			;;
+		"list_hostfwd")
+			api_list
+			;;
+		"remove_hostfwd")
+			case ${id} in
+			''|*[!0-9]*)	api_error ;;
+			*)		api_delete "${id}"; __restart=1 ;;
+			esac
+			;;
+		*)
+			api_error
+			;;
+		esac >"${FIFO_RESP}"
+
+		kill ${READER_PID}
+
+		rm "${FIFO_REQ}" "${FIFO_RESP}"
+
+		[ ${NEED_RESTART} -eq 1 ] && { stop; start; }
+	done
+
+	exit 0
+}
+
 # usage() - Print slirpnetns(1) usage and exit indicating failure
 # $1:	Invalid option name, if any
 usage() {
@@ -177,7 +350,7 @@ while getopts ce:r:m:6a:hv-: OPT 2>/dev/null; do
 	r | ready-fd)		opt u32 RFD				      ;;
 	m | mtu)		opt mtu MTU && sub -m ${MTU}		      ;;
 	6 | enable-ipv6)	V6=1					      ;;
-	a | api-socket)		opt str API				      ;;
+	a | api-socket)		opt str API_SOCKET			      ;;
 	cidr)			opt net4 A4 M4 && sub -a ${A4} -n ${M4}	      ;;
 	disable-host-loopback)	add "--no-map-gw" && no_map_gw=1	      ;;
 	netns-type)		: Autodetected				      ;;
@@ -203,14 +376,15 @@ if [ ${v6} -eq 1 ]; then
 	add "-a $(gen_addr6) -g fd00::2 -D fd00::3"
 fi
 
-${PASTA} ${PASTA_OPTS} ${ns_spec} && \
+start
-	[ ${RFD} -ne 0 ] && echo "1" >&${RFD}
+[ -n "${API_SOCKET}" ] && api_handler </dev/null &
+trap "stop; rm -rf ${API_DIR}; rm -f ${API_SOCKET}; rm ${PASTA_PID}" EXIT
+trap 'exit 0' INT QUIT TERM
 
-trap "kill $(cat ${PASTA_PID}); rm ${PASTA_PID}" INT TERM EXIT
+>&2 echo "sent tapfd=5 for ${ifname}"
+>&2 echo "received tapfd=5"
 
 cat << EOF
-sent tapfd=5 for ${ifname}
-received tapfd=5
 Starting slirp
 * MTU:             ${MTU}
 * Network:         ${A4}
@@ -219,6 +393,7 @@ Starting slirp
 * DNS:             10.0.2.3
 * Recommended IP:  10.0.2.100
 EOF
+[ -n "${API_SOCKET}" ] && echo "* API socket:      ${API_SOCKET}"
 
 if [ ${no_map_gw} -eq 0 ]; then
 	echo "WARNING: 127.0.0.1:* on the host is accessible as 10.0.2.2 (set --disable-host-loopback to prohibit connecting to 127.0.0.1:*)"