#!/bin/sh
# Description: Manage namespaces.
# Depends on: sh, util-linux, iproute2, procps
# Optional: iptables -t nat -A POSTROUTING -j MASQUERADE && echo 1 > /proc/sys/net/ipv4/ip_forward

NS=$(dirname $0)
NSROOT=$NS/root/$2
RUN=$NS/run/$2

cgroups="cpu,memory,devices"

test -f "$NS/rc.conf" && . $NS/rc.conf

start() {
    check $@

    test -f $RUN && PID=$(cat $RUN)
    ps -p $PID >/dev/null 2>&1 && echo $2 is running with $PID && exit 1

    eval "addr=\"\$$2_addr\""
    eval "onstart=\"\$$2_onstart\""

    if test -n "$addr"; then
        ip link add br0 type bridge >/dev/null 2>&1
        ip link set br0 up >/dev/null 2>&1
        ip addr add 10.0.0.1/24 dev br0 >/dev/null 2>&1

        ip link add veth_$2 type veth peer name veth0 >/dev/null 2>&1
        ip link set veth_$2 up >/dev/null 2>&1
        ip link set veth_$2 master br0 >/dev/null 2>&1
    fi

    ip netns add $2 >/dev/null 2>&1

    test -n "$addr" && ip link set veth0 netns $2 >/dev/null 2>&1

    ip netns exec $2 ip link set lo up >/dev/null 2>&1

    if test -n "$addr"; then
        ip netns exec $2 ip addr add $addr/24 dev veth0 >/dev/null 2>&1
        ip netns exec $2 ip link set veth0 up >/dev/null 2>&1
        ip netns exec $2 ip route add default via 10.0.0.1 >/dev/null 2>&1

        cp /etc/resolv.conf $NSROOT/etc
    fi

    cp $NS/init $NSROOT

    cgroupfs-mount

    cgcreate -g "$cgroups:/$2"

    cgset -r cpu.shares="512" "$2"
    cgset -r memory.limit_in_bytes="$((512 * 1000000))" "$2"

    cgset -r devices.deny="a *:* rwm" "$2"
    cgset -r devices.allow="c 1:3 rwm" "$2"
    cgset -r devices.allow="c 1:5 rwm" "$2"
    cgset -r devices.allow="c 1:7 rwm" "$2"
    cgset -r devices.allow="c 1:8 rwm" "$2"
    cgset -r devices.allow="c 1:9 rwm" "$2"
    cgset -r devices.allow="c 5:0 rwm" "$2"
    cgset -r devices.allow="c 5:2 rwm" "$2"
    cgset -r devices.allow="c 136:* rwm" "$2"

    setsid cgexec -g "$cgroups:$2" \
        ip netns exec $2 \
        unshare -fmuipC \
        env -i container="$2" \
        chroot $NSROOT sh -c " exec /init" &

    PID=$!

    until pgrep -P $PID >/dev/null 2>&1; do :; done

    echo $(pgrep -P $PID) > $RUN

# mount -t devtmpfs -o nosuid,size=52k,nr_inodes=2048,mode=755 none /dev
# mount -t devpts -o nosuid,noexec,relatime,mode=600 none /dev/pts

#     printf '%s\n' "
# hostname $2
# mount -t proc none /proc
# " | $0 run $2 sh -

    test -n "$onstart" && printf '%s' "$onstart" | $0 run $2 sh -

    echo "$2: started"
}

stop() {
    check $@
    PID=$(test -f $RUN && cat $RUN)
    kill -9 $PID >/dev/null 2>&1

    eval "addr=\"\$$2_addr\""

    test -n "$addr" && ip link del veth_$2 >/dev/null 2>&1
    ip netns delete $2 >/dev/null 2>&1

    test -f $RUN && rm $RUN

    cgdelete -g "$cgroups:$2"

    echo "$2: stopped"
}

run() {
    check $@
    test -f $RUN && PID=$(cat $RUN)

    if ps -p $PID >/dev/null 2>&1; then
        true
    else
         echo "$2 is not running" && exit 1
    fi

    container="$2"

    shift
    shift
    cgexec -g "$cgroups:$container" ip netns exec $container nsenter -t $PID -m -u -i -p -C env -i container="$container" chroot $NSROOT "$@"
}

check() {
    test -z "$2" && echo Please, specify container name && exit 1
    test ! -d $NSROOT && echo $NSROOT directory does not exists && exit 1
}

status() {
    check $@
    ps -p $(cat $RUN 2>/dev/null) >/dev/null 2>&1
    retval=$?
    if test ! -d $NSROOT;
    then
        echo "$2 does not exists"
    elif test -f $RUN && test "$retval" -eq 0;
    then
        echo "$2 is running with pid $(cat $RUN 2>/dev/null)"
    elif test -f $RUN && test "$retval" -ne 0;
    then
        echo "$2 is not running but pid file $RUN exists"
    else
        echo "$2 is not running"
    fi
}

restart() {
    check $@
    stop $@
    sleep 1
    start $@
}

init() {
    mkdir -p $NS/root
    mkdir -p $NS/run
    touch $NS/rc.conf
    cat << EOF > $NS/rc.conf
#!/bin/sh

# blue_addr="10.0.0.2"
# blue_onstart="/etc/rc.d/nginx start"
EOF

    cat << EOF > $NS/init
#!/bin/sh

while :;
do
    sleep 86400
done
EOF
    chmod +x $NS/init
}

help() {
    cat << EOF
Usage: $0 [COMMAND] [NAMESPACE] [OPTION]...
Manage namespaces.

Commands:
  start   initialize namespace, chroot; copy and start /init in background
  stop    kill /init
  restart stop and start namespace
  run     exec command in running namespace
  check   check if namespace exists in $NSROOT directory, returns 1 on fail
  init    create folders, rc.conf and init file in directory of this script
EOF
}

case $1 in
    check|status|start|stop|restart|run|init) $1 $@ ;;
    *) help ;;
esac