Statistics
| Branch: | Tag: | Revision:

root / kvm-vif-bridge @ e27db5e5

History | View | Annotate | Download (4.7 kB)

1
#!/bin/bash
2

    
3
# This is an example of a Ganeti kvm ifup script that configures network
4
# interfaces based on the initial deployment of the Okeanos project
5

    
6
TAP_CONSTANT_MAC=cc:47:52:4e:45:54 # GRNET in hex :-)
7
MAC2EUI64=/usr/bin/mac2eui64
8
NFDHCPD_STATE_DIR=/var/lib/nfdhcpd
9

    
10
function clear_routed_setup_ipv4 {
11

    
12
 arptables -D OUTPUT -o $INTERFACE --opcode request -j mangle
13
 while ip rule del dev $INTERFACE; do :; done
14
 iptables -D FORWARD -i $INTERFACE -p udp --dport 67 -j DROP
15

    
16
}
17

    
18
function clear_routed_setup_ipv6 {
19

    
20
 while ip -6 rule del dev $INTERFACE; do :; done
21

    
22
}
23

    
24

    
25
function clear_routed_setup_firewall {
26

    
27
  for oldchain in protected unprotected limited; do
28
    iptables  -D FORWARD -o $INTERFACE -j $oldchain
29
    ip6tables -D FORWARD -o $INTERFACE -j $oldchain
30
  done
31

    
32
}
33

    
34
function clear_ebtables {
35
  TAP=$INTERFACE
36
  FROM=FROM${TAP^^}
37
  TO=TO${TAP^^}
38

    
39
  ebtables -D INPUT -i $TAP -j $FROM
40
  ebtables -D FORWARD -i $TAP -j $FROM
41
  ebtables -D FORWARD -o $TAP -j $TO
42
  ebtables -D OUTPUT -o $TAP -j $TO
43

    
44
  ebtables -X $FROM
45
  ebtables -X $TO
46
}
47

    
48

    
49

    
50
function routed_setup_ipv4 {
51

    
52
	# mangle ARPs to come from the gw's IP
53
	arptables -A OUTPUT -o $INTERFACE --opcode request -j mangle --mangle-ip-s    "$GATEWAY"
54

    
55
	# route interface to the proper routing table
56
	ip rule add dev $INTERFACE table $TABLE 
57

    
58
	# static route mapping IP -> INTERFACE
59
	ip route replace $IP proto static dev $INTERFACE table $TABLE
60

    
61
	# Enable proxy ARP
62
	echo 1 > /proc/sys/net/ipv4/conf/$INTERFACE/proxy_arp
63
}
64

    
65
function routed_setup_ipv6 {
66
	# Add a routing entry for the eui-64
67
	prefix=$SUBNET6
68
	uplink=$PUBLIC_VLAN
69
	eui64=$($MAC2EUI64 $MAC $prefix)
70

    
71
  
72
	ip -6 rule add dev $INTERFACE table $TABLE
73
	ip -6 ro replace $eui64/128 dev $INTERFACE table $TABLE
74
	ip -6 neigh add proxy $eui64 dev $uplink 
75

    
76
	# disable proxy NDP since we're handling this on userspace
77
	# this should be the default, but better safe than sorry
78
	echo 0 > /proc/sys/net/ipv6/conf/$INTERFACE/proxy_ndp
79
}
80

    
81
# pick a firewall profile per NIC, based on tags (and apply it)
82
function routed_setup_firewall {
83
	ifprefix="synnefo:network:$INTERFACE_INDEX:"
84
	for tag in $TAGS; do
85
		case ${tag#$ifprefix} in
86
		protected)
87
			chain=protected
88
		;;
89
		unprotected)
90
			chain=unprotected
91
		;;
92
		limited)
93
			chain=limited
94
		;;
95
		esac
96
	done
97

    
98
	if [ "x$chain" != "x" ]; then
99
		iptables  -A FORWARD -o $INTERFACE -j $chain
100
		ip6tables -A FORWARD -o $INTERFACE -j $chain
101
	fi
102
}
103

    
104
function setup_ebtables {
105
  TAP=$INTERFACE
106
  FROM=FROM${TAP^^}
107
  TO=TO${TAP^^}
108

    
109
  ebtables -N $FROM
110
  # do not allow changes in ip-mac pair
111
  if [ -n "$IP"]; then
112
    ebtables -A $FROM --ip-source \! $IP -p ipv4 -j DROP
113
  fi
114
  ebtables -A $FROM -s \! $MAC -j DROP
115
  ebtables -A FORWARD -i $TAP -j $FROM
116
  ebtables -N $TO
117
  ebtables -A FORWARD -o $TAP -j $TO
118
  #accept dhcp responses from host (nfdhcpd)
119
  ebtables -A $TO -p ipv4 --ip-protocol=udp  --ip-destination-port=68 -j ACCEPT
120
  if [ "$TYPE" == "private" ]; then
121
    if [ ! -z "$GATEWAY" -a $ENABLE_MASQ ]; then
122
      # allow packets from/to router (for masquerading
123
      ebtables -A $TO -s $ROUTER_MAC -j ACCEPT
124
      ebtables -A INPUT -i $TAP -j $FROM
125
      ebtables -A OUTPUT -o $TAP -j $TO
126
    fi
127
    # allow only packets from the same mac prefix
128
    ebtables -A $TO -s \! $MAC/$MAC_MASK -j DROP
129
  fi
130
}
131

    
132

    
133
function setup_nfdhcpd {
134
	umask 022
135
  FILE=$NFDHCPD_STATE_DIR/$INTERFACE
136
  #IFACE is the interface from which the packet seems to arrive
137
  #needed in bridged mode where the packets seems to arrive from the
138
  #bridge and not from the tap
139
	cat >$FILE <<EOF
140
INDEV=$1
141
IP=$IP
142
MAC=$MAC
143
HOSTNAME=$INSTANCE
144
TAGS="$TAGS"
145
GATEWAY=$GATEWAY
146
SUBNET=$SUBNET 
147
GATEWAY6=$GATEWAY6 
148
SUBNET6=$SUBNET6 
149
EUI64=$($MAC2EUI64 $MAC $SUBNET6 2>/dev/null)
150
EOF
151

    
152
}
153

    
154

    
155
DEFAULT=/etc/default/snf-network
156
source $DEFAULT
157
source $CONF
158

    
159
NODEINFRAFILE=$SHAREDDIR/infra/$(hostname)
160

    
161
if [ -e "$NODEINFRAFILE" ]; then
162
  source $NODEINFRAFILE
163
fi
164

    
165
CLUSTERINFRAFILE=$SHAREDDIR/infra/cluster
166

    
167
if [ -e "$CLUSTERINFRAFILE" ]; then
168
  source $CLUSTERINFRAFILE
169
fi
170

    
171
NETFILE=$SHAREDDIR/networks/$NETWORK
172

    
173
if [ -e "$NETFILE" ]; then
174
  source $NETFILE
175
fi
176

    
177

    
178
TABLE=rt_$NETWORK
179
clear_routed_setup_ipv4 > /dev/null 2>&1
180
clear_routed_setup_ipv6 > /dev/null 2>&1
181
clear_routed_setup_firewall > /dev/null 2>&1
182
clear_ebtables > /dev/null 2>&1
183

    
184
if [ "$MODE" = "routed" ]; then
185
	# use a constant predefined MAC address for the tap
186
	ip link set $INTERFACE addr $TAP_CONSTANT_MAC
187
	# bring the tap up
188
	ifconfig $INTERFACE 0.0.0.0 up
189

    
190
	# Drop unicast BOOTP/DHCP packets
191
	iptables -A FORWARD -i $INTERFACE -p udp --dport 67 -j DROP
192

    
193
	routed_setup_ipv4 > /dev/null 2>&1
194
	routed_setup_ipv6 > /dev/null 2>&1
195
	routed_setup_firewall > /dev/null 2>&1
196
	setup_nfdhcpd $INTERFACE
197
elif [ "$MODE" = "bridged" ]; then
198
	ifconfig $INTERFACE 0.0.0.0 up
199
	brctl addif $BRIDGE $INTERFACE
200
	setup_nfdhcpd $BRIDGE
201
  setup_ebtables > /dev/null 2>&1
202
fi