Question

我有一个透明的防火墙（运行VyOS），可以在每侧的路由器之间传递BGP流量。当桥接器一侧的链路发生故障时，我想关闭另一侧的链路，这样路由器就可以清除其BGP信息，而无需等待2:30分钟的计时器到期。

这是我的剧本：

netplugd

当我手动运行脚本时，它运行正常。当netplugd运行它时，会导致netplugd崩溃。我在前台运行了root@firewall00:~# netplugd -F /etc/netplug/netplug bond0 probe -> pid 10277 /etc/netplug/netplug bond1 probe -> pid 10278 /etc/netplug/netplug bond2 probe -> pid 10279 /etc/netplug/netplug bond3 probe -> pid 10280 /etc/netplug/netplug bond4 probe -> pid 10281 /etc/netplug/netplug bond5 probe -> pid 10282 /etc/netplug/netplug bond6 probe -> pid 10283 /etc/netplug/netplug bond7 probe -> pid 10284 /etc/netplug/netplug bond8 probe -> pid 10285 /etc/netplug/netplug bond9 probe -> pid 10286 /etc/netplug/netplug bond10 probe -> pid 10287 /etc/netplug/netplug bond11 probe -> pid 10288 /etc/netplug/netplug bond12 probe -> pid 10289 /etc/netplug/netplug bond13 probe -> pid 10290 /etc/netplug/netplug bond14 probe -> pid 10291 /etc/netplug/netplug bond15 probe -> pid 10292 /etc/netplug/netplug br0 probe -> pid 10293 /etc/netplug/netplug br1 probe -> pid 10294 /etc/netplug/netplug br2 probe -> pid 10295 /etc/netplug/netplug br3 probe -> pid 10296 /etc/netplug/netplug br4 probe -> pid 10297 /etc/netplug/netplug br5 probe -> pid 10298 /etc/netplug/netplug br6 probe -> pid 10299 /etc/netplug/netplug br7 probe -> pid 10300 /etc/netplug/netplug br8 probe -> pid 10301 /etc/netplug/netplug br9 probe -> pid 10302 /etc/netplug/netplug br10 probe -> pid 10303 /etc/netplug/netplug br11 probe -> pid 10304 /etc/netplug/netplug br12 probe -> pid 10305 /etc/netplug/netplug br13 probe -> pid 10306 /etc/netplug/netplug br14 probe -> pid 10307 /etc/netplug/netplug br15 probe -> pid 10308 /etc/netplug/netplug eth0 probe -> pid 10309 /etc/netplug/netplug eth1 probe -> pid 10310 /etc/netplug/netplug eth2 probe -> pid 10311 /etc/netplug/netplug eth3 probe -> pid 10312 /etc/netplug/netplug eth4 probe -> pid 10313 /etc/netplug/netplug eth5 probe -> pid 10314 /etc/netplug/netplug eth6 probe -> pid 10315 /etc/netplug/netplug eth7 probe -> pid 10316 /etc/netplug/netplug eth8 probe -> pid 10317 /etc/netplug/netplug eth9 probe -> pid 10318 /etc/netplug/netplug eth10 probe -> pid 10319 /etc/netplug/netplug eth11 probe -> pid 10320 /etc/netplug/netplug eth12 probe -> pid 10321 /etc/netplug/netplug eth13 probe -> pid 10322 /etc/netplug/netplug eth14 probe -> pid 10323 /etc/netplug/netplug eth15 probe -> pid 10324 /etc/netplug/netplug eth3 in -> pid 10325 /etc/netplug/netplug eth0 in -> pid 10326 /etc/netplug/netplug eth1 in -> pid 10327 /etc/netplug/netplug br0 in -> pid 10328 br0: state INNING pid 10328 exited status 0 eth3: state INNING pid 10325 exited status 0 eth0: state INNING pid 10326 exited status 0 eth1: state INNING pid 10327 exited status 0 eth2: state DOWN flags 0x00001003 UP,BROADCAST,MULTICAST -> 0x00011043 UP,BROADCAST,RUNNING,MULTICAST,10000 /etc/netplug/netplug eth2 in -> pid 10337 eth2: state INNING pid 10337 exited status 0 eth2: state ACTIVE flags 0x00011043 UP,BROADCAST,RUNNING,MULTICAST,10000 -> 0x00001003 UP,BROADCAST,MULTICAST /etc/netplug/netplug eth2 out -> pid 10340 my-bridge-ctl[10344]: Acquired lock, running my-bridge-ctl[10349]: Interface eth2 (br0 inside - net1138a) went down. Member of bridge br0 (no desc). my-bridge-ctl[10353]: Handling br0 member interface eth2 (/sys/devices/virtual/net/br0/brif/eth2). eth2: state OUTING flags 0x00001003 UP,BROADCAST,MULTICAST -> 0x00001002 BROADCAST,MULTICAST eth2: state DOWNANDOUT flags 0x00001002 BROADCAST,MULTICAST -> 0x00001003 UP,BROADCAST,MULTICAST Error: eth2: unexpected state DOWNANDOUT for UP root@firewall00:~# my-bridge-ctl[10357]: Interface eth2 bounced. my-bridge-ctl[10359]: Handling br0 member interface eth3 (/sys/devices/virtual/net/br0/brif/eth3). my-bridge-ctl[10386]: Interface eth3 bounced. my-bridge-ctl[10389]: Finished以确保我捕获了所有输出：

Error: eth2: unexpected state DOWNANDOUT for UP

错误为netlogd 我无法弄清楚是什么导致String formDigestValue = j.get("d").get("GetContextWebInformation").get("FormDigestValue").toString();达到这一点。

Answer 1

这可能是netplugd，reported in Debian in December 2011中的错误。以下补丁是在2013年1月提出的，在2014年11月被接受（in 1.2.9.2-2），并于2015年5月发布。（这是一个非常缓慢的错误修复过程。）

--- a/if_info.c
+++ b/if_info.c
@@ -186,6 +186,7 @@
         if (newflags & IFF_UP) {
             switch(info->state) {
             case ST_DOWN:
+            case ST_DOWNANDOUT:
                 info->state = ST_INACTIVE;
                 break;

VyOS netplug存储库does not have此补丁。

我建议您与VyOS人员讨论添加该补丁的问题。

Answer 2

Moshe的回答让我更仔细地看一下netplugd来源。当netplugd处理链接断开脚本并且链接再次关闭时，将使用状态ST_DOWNANDOUT。提到的补丁只是隐藏了这种情况。我在我的脚本中添加了每个接口锁，现在工作正常。

最终代码在这里：https://gist.github.com/yakatz/f16824ea3a4597d35737463c612eb8a3#file-my-bridge-ctl-sh

linkdown脚本杀死netplugd

2 个答案: