Revision d2b16e51 kvm-vif-bridge
| b/kvm-vif-bridge | ||
|---|---|---|
| 7 | 7 |
MAC2EUI64=/usr/bin/mac2eui64 |
| 8 | 8 |
NFDHCPD_STATE_DIR=/var/lib/nfdhcpd |
| 9 | 9 |
|
| 10 |
|
|
| 11 |
|
|
| 10 | 12 |
function clear_tap {
|
| 11 |
|
|
| 13 |
|
|
| 12 | 14 |
arptables -D OUTPUT -o $INTERFACE --opcode request -j mangle >/dev/null 2>&1 |
| 13 | 15 |
while ip rule del dev $INTERFACE; do :; done |
| 14 | 16 |
iptables -D FORWARD -i $INTERFACE -p udp --dport 67 -j DROP 2>/dev/null |
| ... | ... | |
| 17 | 19 |
} |
| 18 | 20 |
|
| 19 | 21 |
function routed_setup_ipv4 {
|
| 20 |
# get the link's default gateway |
|
| 21 |
gw=$GATEWAY |
|
| 22 | 22 |
|
| 23 | 23 |
# mangle ARPs to come from the gw's IP |
| 24 |
arptables -A OUTPUT -o $INTERFACE --opcode request -j mangle --mangle-ip-s "$gw"
|
|
| 24 |
arptables -A OUTPUT -o $INTERFACE --opcode request -j mangle --mangle-ip-s "$GATEWAY"
|
|
| 25 | 25 |
|
| 26 | 26 |
# route interface to the proper routing table |
| 27 | 27 |
ip rule add dev $INTERFACE table $TABLE |
| ... | ... | |
| 83 | 83 |
function setup_nfdhcpd {
|
| 84 | 84 |
umask 022 |
| 85 | 85 |
FILE=$NFDHCPD_STATE_DIR/$INTERFACE |
| 86 |
#IFACE is the interface from which the packet seems to arrive |
|
| 87 |
#needed in bridged mode where the packets seems to arrive from the |
|
| 88 |
#bridge and not from the tap |
|
| 86 | 89 |
cat >$FILE <<EOF |
| 87 | 90 |
IFACE=$1 |
| 88 | 91 |
IP=$IP |
| 89 | 92 |
MAC=$MAC |
| 90 |
LINK=$TABLE |
|
| 91 | 93 |
HOSTNAME=$INSTANCE |
| 92 | 94 |
TAGS="$TAGS" |
| 93 | 95 |
EOF |
| 94 |
if [ -n $GATEWAY ]; then
|
|
| 96 |
if [ -n "$GATEWAY" ]; then
|
|
| 95 | 97 |
echo GATEWAY=$GATEWAY >> $FILE |
| 96 | 98 |
fi |
| 97 |
if [ -n $SUBNET ]; then
|
|
| 99 |
if [ -n "$SUBNET" ]; then
|
|
| 98 | 100 |
echo SUBNET=$SUBNET >> $FILE |
| 99 | 101 |
fi |
| 100 |
if [ -n $GATEWAY6 ]; then
|
|
| 102 |
if [ -n "$GATEWAY6" ]; then
|
|
| 101 | 103 |
echo GATEWAY6=$GATEWAY6 >> $FILE |
| 102 | 104 |
fi |
| 103 |
if [ -n $SUBNET6 ]; then
|
|
| 105 |
if [ -n "$SUBNET6" ]; then
|
|
| 104 | 106 |
echo SUBNET6=$SUBNET6 >> $FILE |
| 105 | 107 |
fi |
| 106 | 108 |
|
| ... | ... | |
| 110 | 112 |
TAP=$INTERFACE |
| 111 | 113 |
FROM=FROM${TAP^^}
|
| 112 | 114 |
TO=TO${TAP^^}
|
| 113 |
|
|
| 115 |
|
|
| 114 | 116 |
exist=$(ebtables -L | grep $TAP) |
| 115 |
|
|
| 117 |
|
|
| 116 | 118 |
if [ ! -z "$exist" ]; then |
| 117 | 119 |
ebtables -D INPUT -i $TAP -j $FROM |
| 118 | 120 |
ebtables -D FORWARD -i $TAP -j $FROM |
| ... | ... | |
| 132 | 134 |
ebtables -N $FROM |
| 133 | 135 |
# do not allow changes in ip-mac pair |
| 134 | 136 |
ebtables -A $FROM --ip-source \! $IP -p ipv4 -j DROP |
| 135 |
ebtables -A $FROM -s \! $MAC -j DROP
|
|
| 136 |
ebtables -A FORWARD -i $TAP -j $FROM
|
|
| 137 |
ebtables -A $FROM -s \! $MAC -j DROP |
|
| 138 |
ebtables -A FORWARD -i $TAP -j $FROM |
|
| 137 | 139 |
ebtables -N $TO |
| 138 | 140 |
ebtables -A FORWARD -o $TAP -j $TO |
| 139 | 141 |
#accept dhcp responses from host (nfdhcpd) |
| 140 | 142 |
ebtables -A $TO -p ipv4 --ip-protocol=udp --ip-destination-port=68 -j ACCEPT |
| 141 |
if [ $TYPE == "private" ]; then
|
|
| 142 |
if [ ! -z $GATEWAY ]; then
|
|
| 143 |
if [ "$TYPE" == "private" ]; then
|
|
| 144 |
if [ ! -z "$GATEWAY" ]; then
|
|
| 143 | 145 |
# allow packets from/to router (for masquerading |
| 144 |
ebtables -A $TO -s $ROUTER_MAC -j ACCEPT
|
|
| 145 |
ebtables -A INPUT -i $TAP -j $FROM
|
|
| 146 |
ebtables -A $TO -s $ROUTER_MAC -j ACCEPT |
|
| 147 |
ebtables -A INPUT -i $TAP -j $FROM |
|
| 146 | 148 |
ebtables -A OUTPUT -o $TAP -j $TO |
| 147 | 149 |
fi |
| 148 |
# allow only packets from the same mac prefix
|
|
| 149 |
ebtables -A $TO -s \! $MAC/$MAC_MASK -j DROP
|
|
| 150 |
# allow only packets from the same mac prefix |
|
| 151 |
ebtables -A $TO -s \! $MAC/$MAC_MASK -j DROP |
|
| 150 | 152 |
fi |
| 151 | 153 |
} |
| 152 | 154 |
|
| 153 | 155 |
|
| 154 |
TABLE=rt_$NETWORK |
|
| 155 | 156 |
|
| 156 |
source /var/lib/snf-network/networks/$NETWORK |
|
| 157 |
DEFAULT=/etc/default/snf-network |
|
| 158 |
source $DEFAULT |
|
| 159 |
source $CONF |
|
| 157 | 160 |
|
| 161 |
NODEINFRAFILE=$SHAREDDIR/infra/$(hostname) |
|
| 162 |
|
|
| 163 |
if [ -e "$NODEINFRAFILE" ]; then |
|
| 164 |
source $NODEINFRAFILE |
|
| 165 |
fi |
|
| 166 |
|
|
| 167 |
|
|
| 168 |
NETFILE=$SHAREDDIR/networks/$NETWORK |
|
| 169 |
if [ -e "$NETFILE" ]; then |
|
| 170 |
source $NETFILE |
|
| 171 |
fi |
|
| 158 | 172 |
|
| 159 | 173 |
if [ "$MODE" = "routed" ]; then |
| 174 |
TABLE=rt_$NETWORK |
|
| 160 | 175 |
# special proxy-ARP/NDP routing mode |
| 161 | 176 |
clear_tap |
| 162 | 177 |
# use a constant predefined MAC address for the tap |
| ... | ... | |
| 179 | 194 |
brctl addif $BRIDGE $INTERFACE |
| 180 | 195 |
setup_nfdhcpd $BRIDGE |
| 181 | 196 |
setup_ebtables |
| 182 |
fi |
|
| 197 |
fi |
|
Also available in: Unified diff