10

I am running some application in multiple network namespace. And I need to create socket connection to the loopback address + a specific port in each of the name space. Note that the "specific port" is the same across all network namespaces. Is there a way I can create a socket connection like this in python?

Appreciate any pointer!

2
  • Can you clarify your question? It sounds like you're asking, "how to I open a tcp socket with Python?", for which there are already lots of examples and documentation out there. As long as your are running your Python code inside the target network namespace there is nothing special you need in your code; it will operate just like code running in the global network namespace.
    – larsks
    Commented Mar 4, 2015 at 4:08
  • Thanks for the question. My question is more to connect to multiple network namespace within a single program/process. I understand that I could have each tcp socket open in each of its own process by starting the process in a particular namespace but in that case, I will have as many process as the # of namespace...trying to avoid this.
    – jackiesyu
    Commented Mar 4, 2015 at 18:03

2 Answers 2

21

This was a fun problem.

Update: I liked it so much that I packed up the solution as an installable Python module, available from https://github.com/larsks/python-netns.

You can access another network namespace through the use of the setns() system call. This call isn't exposed natively by Python, so in order to use it you would either (a) need to find a third-party module that wraps it, or (b) use something like the ctypes module to make it available in your Python code.

Using the second option (ctypes), I came up with this code:

#!/usr/bin/python

import argparse
import os
import select
import socket
import subprocess

# Python doesn't expose the `setns()` function manually, so
# we'll use the `ctypes` module to make it available.
from ctypes import cdll
libc = cdll.LoadLibrary('libc.so.6')
setns = libc.setns


# This is just a convenience function that will return the path
# to an appropriate namespace descriptor, give either a path,
# a network namespace name, or a pid.
def get_ns_path(nspath=None, nsname=None, nspid=None):
    if nsname:
        nspath = '/var/run/netns/%s' % nsname
    elif nspid:
        nspath = '/proc/%d/ns/net' % nspid

    return nspath

# This is a context manager that on enter assigns the process to an
# alternate network namespace (specified by name, filesystem path, or pid)
# and then re-assigns the process to its original network namespace on
# exit.
class Namespace (object):
    def __init__(self, nsname=None, nspath=None, nspid=None):
        self.mypath = get_ns_path(nspid=os.getpid())
        self.targetpath = get_ns_path(nspath,
                                  nsname=nsname,
                                  nspid=nspid)

        if not self.targetpath:
            raise ValueError('invalid namespace')

    def __enter__(self):
        # before entering a new namespace, we open a file descriptor
        # in the current namespace that we will use to restore
        # our namespace on exit.
        self.myns = open(self.mypath)
        with open(self.targetpath) as fd:
            setns(fd.fileno(), 0)

    def __exit__(self, *args):
        setns(self.myns.fileno(), 0)
        self.myns.close()


# This is a wrapper for socket.socket() that creates the socket inside the
# specified network namespace.
def nssocket(ns, *args):
    with Namespace(nsname=ns):
        s = socket.socket(*args)
        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        return s


def main():
    # Create a socket inside the 'red' namespace
    red = nssocket('red')
    red.bind(('0.0.0.0', 7777))
    red.listen(10)

    # Create a socket inside the 'blue' namespace
    blue = nssocket('blue')
    blue.bind(('0.0.0.0', 7777))
    blue.listen(10)

    poll = select.poll()
    poll.register(red, select.POLLIN)
    poll.register(blue, select.POLLIN)

    sockets = {
        red.fileno(): {
            'socket': red,
            'label': 'red',
        },
        blue.fileno(): {
            'socket': blue,
            'label': 'blue',
        }
    }

    while True:
        events = poll.poll()

        for fd, event in events:
            sock = sockets[fd]['socket']
            label = sockets[fd]['label']

            if sock in [red, blue]:
                newsock, client = sock.accept()
                sockets[newsock.fileno()] = {
                    'socket': newsock,
                    'label': label,
                    'client': client,
                }

                poll.register(newsock, select.POLLIN)
            elif event & select.POLLIN:
                data = sock.recv(1024)
                if not data:
                    print 'closing fd %d (%s)' % (fd, label)
                    poll.unregister(sock)
                    sock.close()
                    continue
                print 'DATA %s [%d]: %s' % (label, fd, data)


if __name__ == '__main__':
    main()

Prior to running this code, I created two network namespaces:

# ip netns add red
# ip netns add blue

I added an interface inside of each namespace, so that the final configuration looked like this:

# ip netns exec red ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
816: virt-0-0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default 
    link/ether f2:9b:6a:fd:87:77 brd ff:ff:ff:ff:ff:ff
    inet 192.168.115.2/24 scope global virt-0-0
       valid_lft forever preferred_lft forever
    inet6 fe80::f09b:6aff:fefd:8777/64 scope link 
       valid_lft forever preferred_lft forever

# ip netns exec blue ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
817: virt-1-0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default 
    link/ether 82:94:6a:1b:13:16 brd ff:ff:ff:ff:ff:ff
    inet 192.168.113.2/24 scope global virt-1-0
       valid_lft forever preferred_lft forever
    inet6 fe80::8094:6aff:fe1b:1316/64 scope link 
       valid_lft forever preferred_lft forever

Running the code (as root, because you need to be root in order to make use of the setns call), I can connect to either 192.168.115.2:7777 (the red namespace) or 192.168.113.2:7777 (the blue namespace) and things work as expected.

4
  • Thanks so much for this! It worked for me! Is there a way to only run the setns() or the like functions as root while everything else still as user?
    – jackiesyu
    Commented Mar 5, 2015 at 2:44
  • Thanks a ton. On github.com/larsks/python-netns you mentioned that a socket inside the namespace can be created by sock = netns.socket(netns.get_ns_path(nsname='myns')) . I am being able to socket but when i try to connect this socket to a server port and address it says "Network is unreachable" . Can you please share an example of how to send a traffic from this socket connection.
    – ViFI
    Commented Jun 2, 2018 at 15:52
  • Have you created any network interfaces inside your namespace? What are their addresses? Do you have a route from inside the namespace the address to which you're trying to connect?
    – larsks
    Commented Jun 3, 2018 at 1:17
  • 1
    I've added an example.
    – larsks
    Commented Jun 3, 2018 at 1:34
1

I just came across this post while looking into network namespaces and using python to interact with them. In regards to your question about non-root users running the setns(), or similar functions, I believe that is achievable. In a small script that creates the red and blue namespaces mentioned in this post, you could also set a linux capability inside of the new namespace that would allow non-root users to attach and bind. Directly from the man page, we see this description: call setns(2) (requires CAP_SYS_ADMIN in the target namespace);

Capabilities can be added to binaries such as the python2.7 or it can also be added to systemd processes. For example, if you look at the default openvpn-server service file on a centos 7 or RHEL 7 you can see added capabilities so that it can run without root privileges: CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN.....

I know this isn't an answer to the original question, but I do not have enough reputation to reply to comments at the moment. I would suggest looking at capabilities and all of the options provided if you are security conscious and looking to run code as non-root users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.