Synnefo » snf-network

#!/bin/bash

# This is an example of a Ganeti kvm ifup script that configures network

# interfaces based on the initial deployment of the Okeanos project

TAP_CONSTANT_MAC=cc:47:52:4e:45:54 # GRNET in hex :-)

MAC2EUI64=/usr/bin/mac2eui64

NFDHCPD_STATE_DIR=/var/lib/nfdhcpd

function clear_tap {

 arptables -D OUTPUT -o $INTERFACE --opcode request -j mangle >/dev/null 2>&1

 while ip rule del dev $INTERFACE; do :; done

 iptables -D FORWARD -i $INTERFACE -p udp --dport 67 -j DROP 2>/dev/null

}

function routed_setup_ipv4 {

	# mangle ARPs to come from the gw's IP

	arptables -A OUTPUT -o $INTERFACE --opcode request -j mangle --mangle-ip-s    "$GATEWAY"

	# route interface to the proper routing table

	ip rule add dev $INTERFACE table $TABLE

	# static route mapping IP -> INTERFACE

	ip route replace $IP proto static dev $INTERFACE table $TABLE

	# Enable proxy ARP

	echo 1 > /proc/sys/net/ipv4/conf/$INTERFACE/proxy_arp

}

function routed_setup_ipv6 {

	# Add a routing entry for the eui-64

	prefix=$SUBNET6

	uplink=$GATEWAY6

	eui64=$($MAC2EUI64 $MAC $prefix)

	while ip -6 rule del dev $INTERFACE; do :; done

	ip -6 rule add dev $INTERFACE table $TABLE

	ip -6 ro replace $eui64/128 dev $INTERFACE table $TABLE

	ip -6 neigh add proxy $eui64 dev $uplink

	# disable proxy NDP since we're handling this on userspace

	# this should be the default, but better safe than sorry

	echo 0 > /proc/sys/net/ipv6/conf/$INTERFACE/proxy_ndp

}

# pick a firewall profile per NIC, based on tags (and apply it)

function routed_setup_firewall {

	ifprefix="synnefo:network:$INTERFACE_INDEX:"

	for tag in $TAGS; do

		case ${tag#$ifprefix} in

		protected)

			chain=protected

		;;

		unprotected)

			chain=unprotected

		;;

		limited)

			chain=limited

		;;

		esac

	done

	# Flush any old rules. We have to consider all chains, since

	# we are not sure the instance was on the same chain, or had the same

	# tap interface.

	for oldchain in protected unprotected limited; do

		iptables  -D FORWARD -o $INTERFACE -j $oldchain 2>/dev/null

		ip6tables -D FORWARD -o $INTERFACE -j $oldchain 2>/dev/null

	done

	if [ "x$chain" != "x" ]; then

		iptables  -A FORWARD -o $INTERFACE -j $chain

		ip6tables -A FORWARD -o $INTERFACE -j $chain

	fi

}

function setup_nfdhcpd {

	umask 022

  FILE=$NFDHCPD_STATE_DIR/$INTERFACE

  #IFACE is the interface from which the packet seems to arrive

  #needed in bridged mode where the packets seems to arrive from the

  #bridge and not from the tap

	cat >$FILE <<EOF

IFACE=$1

IP=$IP

MAC=$MAC

HOSTNAME=$INSTANCE

TAGS="$TAGS"

EOF

if [ -n "$GATEWAY" ]; then

 echo GATEWAY=$GATEWAY >> $FILE

fi

if [ -n "$SUBNET" ]; then

 echo SUBNET=$SUBNET >> $FILE

fi

if [ -n "$GATEWAY6" ]; then

 echo GATEWAY6=$GATEWAY6 >> $FILE

fi

if [ -n "$SUBNET6" ]; then

 echo SUBNET6=$SUBNET6 >> $FILE

fi

}

function clear_ebtables {

  TAP=$INTERFACE

  FROM=FROM${TAP^^}

  TO=TO${TAP^^}

  exist=$(ebtables -L | grep $TAP)

  if [ ! -z "$exist" ]; then

    ebtables -D INPUT -i $TAP -j $FROM

    ebtables -D FORWARD -i $TAP -j $FROM

    ebtables -D FORWARD -o $TAP -j $TO

    ebtables -D OUTPUT -o $TAP -j $TO

    ebtables -X $FROM

    ebtables -X $TO

  fi

}

function setup_ebtables {

  TAP=$INTERFACE

  FROM=FROM${TAP^^}

  TO=TO${TAP^^}

  ebtables -N $FROM

  # do not allow changes in ip-mac pair

  ebtables -A $FROM --ip-source \! $IP -p ipv4 -j DROP

  ebtables -A $FROM -s \! $MAC -j DROP

  ebtables -A FORWARD -i $TAP -j $FROM

  ebtables -N $TO

  ebtables -A FORWARD -o $TAP -j $TO

  #accept dhcp responses from host (nfdhcpd)

  ebtables -A $TO -p ipv4 --ip-protocol=udp  --ip-destination-port=68 -j ACCEPT

  if [ "$TYPE" == "private" ]; then

    if [ ! -z "$GATEWAY" ]; then

      # allow packets from/to router (for masquerading

      ebtables -A $TO -s $ROUTER_MAC -j ACCEPT

      ebtables -A INPUT -i $TAP -j $FROM

      ebtables -A OUTPUT -o $TAP -j $TO

    fi

    # allow only packets from the same mac prefix

    ebtables -A $TO -s \! $MAC/$MAC_MASK -j DROP

  fi

}

DEFAULT=/etc/default/snf-network

source $DEFAULT

source $CONF

NODEINFRAFILE=$SHAREDDIR/infra/$(hostname)

if [ -e "$NODEINFRAFILE" ]; then

  source $NODEINFRAFILE

fi

NETFILE=$SHAREDDIR/networks/$NETWORK

if [ -e "$NETFILE" ]; then

  source $NETFILE

fi

if [ "$MODE" = "routed" ]; then

  TABLE=rt_$NETWORK

	# special proxy-ARP/NDP routing mode

  clear_tap

	# use a constant predefined MAC address for the tap

	ip link set $INTERFACE addr $TAP_CONSTANT_MAC

	# bring the tap up

	ifconfig $INTERFACE 0.0.0.0 up

	# Drop unicast BOOTP/DHCP packets

	iptables -A FORWARD -i $INTERFACE -p udp --dport 67 -j DROP

	routed_setup_ipv4

	routed_setup_ipv6

	routed_setup_firewall

	setup_nfdhcpd $INTERFACE

  clear_ebtables >/dev/null 2>&1

elif [ "$MODE" = "bridged" ]; then

  clear_tap

  clear_ebtables >/dev/null 2>&1

	ifconfig $INTERFACE 0.0.0.0 up

	brctl addif $BRIDGE $INTERFACE

	setup_nfdhcpd $BRIDGE

  setup_ebtables

fi