Add commands to inspect and clean up stale NAT namespaces, veth links, bridges, and firewall rules.HEADmaster

Signed-off-by: Richard Qin <richard.qin.x@gmail.com>

4 files changed, 83 insertions, 1 deletions

diff --git a/debian-container/README b/debian-container/README
index 0328def..eceb2b3 100644
--- a/debian-container/README
+++ b/debian-container/README
@@ -55,6 +55,11 @@ sudo ./debian-container.sh enter test-1 --mount /home/richard/data:/data:ro
 sudo ./debian-container.sh exec test-1 -- uname -a
 sudo ./debian-container.sh exec test-1 --network host -- apt-get update
 sudo ./debian-container.sh exec test-1 --network nat -- apt-get update
+
+查看和清理 NAT 网络资源：
+
+sudo ./debian-container.sh network-status
+sudo ./debian-container.sh network-clean
 sudo ./debian-container.sh exec test-1 --mount /home/richard/project:/workspace:rw -- make -C /workspace
 
 列出和查看容器：
diff --git a/debian-container/debian-container.sh b/debian-container/debian-container.sh
index da7a4f2..288a6e8 100755
--- a/debian-container/debian-container.sh
+++ b/debian-container/debian-container.sh
@@ -31,7 +31,7 @@ esac
 dc_require_root
 
 case "$DC_ACTION" in
-  base-create|init|enter|exec|resize|delete)
+  base-create|init|enter|exec|resize|delete|network-clean)
     # 防止多个会话同时读写同一 ext4 镜像。
     dc_acquire_lock
     ;;
@@ -53,6 +53,8 @@ esac
 case "$DC_ACTION" in
   base-create) dc_base_create "$@" ;;
   base-info)   dc_manifest_info "$@" ;;
+  network-status) dc_network_status ;;
+  network-clean)  dc_network_clean ;;
   init)    dc_init "$@" ;;
   _init)   dc_init_rootfs "$@" ;;
   enter)   dc_enter "$@" ;;
diff --git a/debian-container/lib/common.sh b/debian-container/lib/common.sh
index 075cd15..f829f11 100644
--- a/debian-container/lib/common.sh
+++ b/debian-container/lib/common.sh
@@ -51,6 +51,8 @@ dc_usage() {
 命令：
   base-create [选项]  下载一次并创建 debootstrap 软件包 tarball
   base-info TAR      查看基础 tarball 的 manifest
+  network-status     查看 NAT 网络资源
+  network-clean      清理 NAT 残留资源
   init NAME [选项]    创建指定名称的容器镜像
   enter NAME [选项]   进入指定容器
   exec NAME [选项]    在指定容器中执行命令
diff --git a/debian-container/lib/network.sh b/debian-container/lib/network.sh
index a5a31dd..efe0d47 100644
--- a/debian-container/lib/network.sh
+++ b/debian-container/lib/network.sh
@@ -100,3 +100,76 @@ dc_network_nat_run() {
     unshare --mount --uts --ipc --pid --fork --propagation private -- \
     bash "$DC_SCRIPT" "$child_action" "$DC_INSTANCE" "$@"
 }
+
+dc_network_nat_namespaces() {
+  ip netns list | awk '$1 ~ /^rutils-/ { print $1 }'
+}
+
+dc_network_status() {
+  local namespace
+  local link
+
+  dc_require_commands awk ip nft
+  echo "网桥：$DC_NAT_BRIDGE"
+  if ip link show "$DC_NAT_BRIDGE" >/dev/null 2>&1; then
+    ip -brief addr show dev "$DC_NAT_BRIDGE"
+  else
+    echo '状态：不存在'
+  fi
+
+  echo 'network namespace：'
+  while read -r namespace; do
+    [[ -n "$namespace" ]] || continue
+    echo "  $namespace"
+    ip netns pids "$namespace" | awk '{ print "    pid: " $0 }'
+  done < <(dc_network_nat_namespaces)
+
+  echo 'veth：'
+  while read -r link; do
+    [[ -n "$link" ]] || continue
+    echo "  $link"
+  done < <(ip -o link show | awk -F': ' '$2 ~ /^rvh[0-9]+@/ { sub(/@.*/, "", $2); print $2 }')
+
+  echo 'nftables：'
+  if nft list table ip rutils_nat >/dev/null 2>&1; then
+    nft list table ip rutils_nat
+  else
+    echo '  rutils_nat 不存在'
+  fi
+}
+
+dc_network_clean() {
+  local namespace
+  local link
+  local active=0
+
+  dc_require_commands awk ip nft
+  while read -r namespace; do
+    [[ -n "$namespace" ]] || continue
+    if [[ -n "$(ip netns pids "$namespace")" ]]; then
+      echo "保留活动 namespace：$namespace"
+      active=1
+    else
+      ip netns delete "$namespace"
+      echo "已删除 namespace：$namespace"
+    fi
+  done < <(dc_network_nat_namespaces)
+
+  if ((active == 0)); then
+    while read -r link; do
+      [[ -n "$link" ]] || continue
+      ip link delete "$link" 2>/dev/null || true
+      echo "已删除 veth：$link"
+    done < <(ip -o link show | awk -F': ' '$2 ~ /^rvh[0-9]+@/ { sub(/@.*/, "", $2); print $2 }')
+
+    nft delete table ip rutils_nat 2>/dev/null || true
+    if ip link show "$DC_NAT_BRIDGE" >/dev/null 2>&1; then
+      ip link set "$DC_NAT_BRIDGE" down
+      ip link delete "$DC_NAT_BRIDGE" type bridge
+    fi
+    echo '已清理 NAT 网桥和 nftables 规则。'
+  else
+    echo '存在活动 namespace，保留 veth。'
+    echo '存在活动 namespace，保留 NAT 网桥和 nftables 规则。'
+  fi
+}