06-网络模式与实现

type NetworkManager struct {
    bridgeName string
    subnet     *net.IPNet
    gateway    net.IP
    ipam       *IPAM
    containers map[string]*ContainerNetwork
    mu         sync.RWMutex
}

type ContainerNetwork struct {
    ID        string
    IP        net.IP
    HostVeth  string
    ContVeth  string
    Bridge    string
    CreatedAt time.Time
}

type IPAM struct {
    Subnet    *net.IPNet
    Gateway   net.IP
    Allocated map[string]bool
    file      string
    mu        sync.Mutex
}

func NewIPAM(stateFile, cidr string) (*IPAM, error) {
    ip, ipNet, err := net.ParseCIDR(cidr)
    if err != nil {
        return nil, err
    }
    
    i := &IPAM{
        Subnet:    ipNet,
        Gateway:   ip,
        Allocated: make(map[string]bool),
        file:      stateFile,
    }
    
    // 加载已分配的 IP
    _ = i.load()
    return i, nil
}

func (i *IPAM) Allocate() (net.IP, error) {
    i.mu.Lock()
    defer i.mu.Unlock()
    
    start := binaryInc(i.Gateway)
    for ip := start; i.Subnet.Contains(ip); ip = binaryInc(ip) {
        if !i.Allocated[ip.String()] {
            i.Allocated[ip.String()] = true
            i.save()
            return ip, nil
        }
    }
    return nil, fmt.Errorf("no available IP in %s", i.Subnet.String())
}

func (i *IPAM) Release(ip net.IP) {
    i.mu.Lock()
    defer i.mu.Unlock()
    delete(i.Allocated, ip.String())
    i.save()
}

func binaryInc(ip net.IP) net.IP {
    res := make(net.IP, len(ip))
    copy(res, ip)
    for j := len(res) - 1; j >= 0; j-- {
        res[j]++
        if res[j] != 0 {
            break
        }
    }
    return res
}

func (nm *NetworkManager) CreateContainerNetwork(containerID string) (*ContainerNetwork, error) {
    nm.mu.Lock()
    defer nm.mu.Unlock()
    
    // 分配 IP
    ip, err := nm.ipam.Allocate()
    if err != nil {
        return nil, err
    }
    
    // 创建 veth 对
    hostVeth, contVeth, err := createVethPair(containerID)
    if err != nil {
        nm.ipam.Release(ip)
        return nil, err
    }
    
    // 配置网络
    if err := nm.configureContainerNetwork(hostVeth, contVeth, ip); err != nil {
        nm.ipam.Release(ip)
        _ = netlink.LinkDel(hostVeth)
        return nil, err
    }
    
    cn := &ContainerNetwork{
        ID:        containerID,
        IP:        ip,
        HostVeth:  hostVeth,
        ContVeth:  contVeth,
        Bridge:    nm.bridgeName,
        CreatedAt: time.Now(),
    }
    
    nm.containers[containerID] = cn
    return cn, nil
}

func createVethPair(containerID string) (string, string, error) {
    hostVeth := fmt.Sprintf("vethh-%s", containerID[:8])
    contVeth := fmt.Sprintf("vethc-%s", containerID[:8])
    
    // 创建 veth 对
    link := &netlink.Veth{
        LinkAttrs: netlink.LinkAttrs{
            Name: hostVeth,
        },
        PeerName: contVeth,
    }
    
    if err := netlink.LinkAdd(link); err != nil {
        return "", "", fmt.Errorf("create veth pair: %w", err)
    }
    
    // 启动 host 端
    if err := netlink.LinkSetUp(link); err != nil {
        _ = netlink.LinkDel(link)
        return "", "", fmt.Errorf("bring up host veth: %w", err)
    }
    
    return hostVeth, contVeth, nil
}

func (nm *NetworkManager) configureContainerNetwork(hostVeth, contVeth string, ip net.IP) error {
    // 1. 将 host veth 添加到 bridge
    hostLink, err := netlink.LinkByName(hostVeth)
    if err != nil {
        return err
    }
    
    bridgeLink, err := netlink.LinkByName(nm.bridgeName)
    if err != nil {
        return err
    }
    
    if err := netlink.LinkSetMaster(hostLink, bridgeLink); err != nil {
        return fmt.Errorf("add veth to bridge: %w", err)
    }
    
    // 2. 配置容器端网络
    contLink, err := netlink.LinkByName(contVeth)
    if err != nil {
        return err
    }
    
    // 设置 IP 地址
    addr := &netlink.Addr{
        IPNet: &net.IPNet{
            IP:   ip,
            Mask: nm.subnet.Mask,
        },
    }
    if err := netlink.AddrAdd(contLink, addr); err != nil {
        return fmt.Errorf("set container IP: %w", err)
    }
    
    // 启动容器端
    if err := netlink.LinkSetUp(contLink); err != nil {
        return fmt.Errorf("bring up container veth: %w", err)
    }
    
    // 3. 设置默认路由
    route := &netlink.Route{
        Dst:       &net.IPNet{IP: net.IPv4zero, Mask: net.CIDRMask(0, 32)},
        Gw:        nm.gateway,
        LinkIndex: contLink.Attrs().Index,
    }
    if err := netlink.RouteAdd(route); err != nil {
        return fmt.Errorf("add default route: %w", err)
    }
    
    return nil
}

type NetworkMode string

const (
    NetworkModeBridge  NetworkMode = "bridge"
    NetworkModeHost    NetworkMode = "host"
    NetworkModeNone    NetworkMode = "none"
    NetworkModeMacvlan NetworkMode = "macvlan"
)

func (nm *NetworkManager) SetupNetwork(mode NetworkMode, containerID string) (*ContainerNetwork, error) {
    switch mode {
    case NetworkModeBridge:
        return nm.CreateContainerNetwork(containerID)
    
    case NetworkModeHost:
        return nm.setupHostNetwork(containerID)
    
    case NetworkModeNone:
        return nm.setupNoneNetwork(containerID)
    
    case NetworkModeMacvlan:
        return nm.setupMacvlanNetwork(containerID)
    
    default:
        return nil, fmt.Errorf("unsupported network mode: %s", mode)
    }
}

func (nm *NetworkManager) setupHostNetwork(containerID string) (*ContainerNetwork, error) {
    // Host 模式：直接使用宿主机网络
    return &ContainerNetwork{
        ID:        containerID,
        IP:        nil, // 使用宿主机 IP
        HostVeth:  "",
        ContVeth:  "",
        Bridge:    "host",
        CreatedAt: time.Now(),
    }, nil
}

func (nm *NetworkManager) setupNoneNetwork(containerID string) (*ContainerNetwork, error) {
    // None 模式：无网络配置
    return &ContainerNetwork{
        ID:        containerID,
        IP:        nil,
        HostVeth:  "",
        ContVeth:  "",
        Bridge:    "none",
        CreatedAt: time.Now(),
    }, nil
}

func (nm *NetworkManager) CleanupContainerNetwork(containerID string) error {
    nm.mu.Lock()
    defer nm.mu.Unlock()
    
    cn, exists := nm.containers[containerID]
    if !exists {
        return fmt.Errorf("container %s not found", containerID)
    }
    
    // 释放 IP
    if cn.IP != nil {
        nm.ipam.Release(cn.IP)
    }
    
    // 删除 veth 对
    if cn.HostVeth != "" {
        if link, err := netlink.LinkByName(cn.HostVeth); err == nil {
            _ = netlink.LinkDel(link)
        }
    }
    
    delete(nm.containers, containerID)
    return nil
}