[Network] Add support for MacVTap interfaces

[Vesnica]

I'm following the getting started guide, and trying to bind a macvtap to guest, which always give me this:

2020-05-28T14:03:41.904918179 [anonymous-instance:ERROR:src/api_server/src/parsed_request.rs:90] Received Error. Status code: 400 Bad Request. Message: Cannot open TAP device. Invalid name/permissions. CreateTap(Os { code: 22, kind: InvalidInput, message: Invalid argument })

I use following command to create macvtap and try to setup network for guest:

sudo ip link add link eno1 name macvtap0 type macvtap mode bridge
curl --unix-socket /tmp/firecracker.socket -i \
         -X PUT 'http://localhost/network-interfaces/eth0' \
         -H 'Accept: application/json'           \
         -H 'Content-Type: application/json'     \
         -d "{
                \"iface_id\": \"eth0\",
                \"host_dev_name\": \"macvtap0\"
            }"

firecracker version: 0.21.1

[sandreim]

Hi @Vesnica! Firecracker does not support macvtap yet. What is your exact usecase ? Macvtap simplifies the networking setup, but otherwise you can still use tap + bridge.

[Vesnica]

@sandreim Using a bridge requires me to reconfig my network (move ip to bridge etc), using macvtap can avoid these troubles.

I'm looking forward to this feature.

[pothos]

To accepting macvtap devices you can either require them to be in the format /dev/tapXY and then opening here

firecracker/src/devices/src/virtio/net/tap.rs

Line 113 in 49003d0

b"/dev/net/tun\0".as_ptr() as *const c_char,

and skipping that step

firecracker/src/devices/src/virtio/net/tap.rs

Line 123 in 49003d0

let ifreq = IfReqBuilder::new()

Actually it would be nicer if the XY number for /dev/tapXY is detected from its interface name via something like let mut ifreq = ifreq_for(name);; ifreq_ioctl(socketfd, &mut ifreq, SIOCGIFINDEX).map(|ifindex| ifindex as usize);

[pothos]

Here is a small helper script for testing during development. It uses the passthru mode to forward the current default NIC to the VM (temporarily blocking access of the kernel network stack). This also works when on a WiFi (but not for too long since wpa_supplicant can't renew the authentification while the VM uses the NIC).

#!/bin/bash
set -euo pipefail

if [ $# = 1 ]; then
  IFN="$1"
else
  IFN="$(ip route get 1 | grep -o 'dev.*' | cut -d ' ' -f 2)"
  echo "Detected $IFN based on default route"
fi
TAP="$IFN"pass
echo "Creating macvtap is passthru mode for $IFN (normal kernel network access will be blocked)"
echo "When done using it, delete with:"
echo "  sudo ip link delete $TAP"
sudo ip link add link "$IFN" name "$TAP" type macvtap mode passthru
MAC="$(cat "/sys/class/net/$IFN/address")"
sudo ip link set "$TAP" address "$MAC" up
DEV="/dev/tap$(cat "/sys/class/net/$TAP/ifindex")"
sudo chown "$USER:$USER" "$DEV"
echo "Ready! MAC: $MAC DEV: $DEV IFACE: $TAP"

[raduiliescu]

I am renaming this item and I'm adding it on the Firecracker roadmap as a research item.