Statistics
| Branch: | Tag: | Revision:

root / kvm-vif-bridge @ ed7f0f2a

History | View | Annotate | Download (4.4 kB)

1 cf51ea5b Dimitris Aragiorgis
#!/bin/bash
2 cf51ea5b Dimitris Aragiorgis
3 cf51ea5b Dimitris Aragiorgis
# This is an example of a Ganeti kvm ifup script that configures network
4 cf51ea5b Dimitris Aragiorgis
# interfaces based on the initial deployment of the Okeanos project
5 cf51ea5b Dimitris Aragiorgis
6 cf51ea5b Dimitris Aragiorgis
TAP_CONSTANT_MAC=cc:47:52:4e:45:54 # GRNET in hex :-)
7 cf51ea5b Dimitris Aragiorgis
MAC2EUI64=/usr/bin/mac2eui64
8 cf51ea5b Dimitris Aragiorgis
NFDHCPD_STATE_DIR=/var/lib/nfdhcpd
9 cf51ea5b Dimitris Aragiorgis
10 7d163a24 Dimitris Aragiorgis
function clear_tap {
11 7d163a24 Dimitris Aragiorgis
 
12 7d163a24 Dimitris Aragiorgis
 arptables -D OUTPUT -o $INTERFACE --opcode request -j mangle >/dev/null 2>&1
13 7d163a24 Dimitris Aragiorgis
 while ip rule del dev $INTERFACE; do :; done
14 7d163a24 Dimitris Aragiorgis
 iptables -D FORWARD -i $INTERFACE -p udp --dport 67 -j DROP 2>/dev/null
15 7d163a24 Dimitris Aragiorgis
16 7d163a24 Dimitris Aragiorgis
17 7d163a24 Dimitris Aragiorgis
}
18 7d163a24 Dimitris Aragiorgis
19 cf51ea5b Dimitris Aragiorgis
function routed_setup_ipv4 {
20 cf51ea5b Dimitris Aragiorgis
	# get the link's default gateway
21 ed7f0f2a Dimitris Aragiorgis
	gw=$GATEWAY
22 cf51ea5b Dimitris Aragiorgis
23 cf51ea5b Dimitris Aragiorgis
	# mangle ARPs to come from the gw's IP
24 cf51ea5b Dimitris Aragiorgis
	arptables -A OUTPUT -o $INTERFACE --opcode request -j mangle --mangle-ip-s "$gw"
25 cf51ea5b Dimitris Aragiorgis
26 cf51ea5b Dimitris Aragiorgis
	# route interface to the proper routing table
27 cf51ea5b Dimitris Aragiorgis
	ip rule add dev $INTERFACE table $TABLE
28 cf51ea5b Dimitris Aragiorgis
29 cf51ea5b Dimitris Aragiorgis
	# static route mapping IP -> INTERFACE
30 cf51ea5b Dimitris Aragiorgis
	ip route replace $IP proto static dev $INTERFACE table $TABLE
31 cf51ea5b Dimitris Aragiorgis
32 cf51ea5b Dimitris Aragiorgis
	# Enable proxy ARP
33 cf51ea5b Dimitris Aragiorgis
	echo 1 > /proc/sys/net/ipv4/conf/$INTERFACE/proxy_arp
34 cf51ea5b Dimitris Aragiorgis
}
35 cf51ea5b Dimitris Aragiorgis
36 cf51ea5b Dimitris Aragiorgis
function routed_setup_ipv6 {
37 cf51ea5b Dimitris Aragiorgis
	# Add a routing entry for the eui-64
38 ed7f0f2a Dimitris Aragiorgis
	prefix=$SUBNET6
39 ed7f0f2a Dimitris Aragiorgis
	uplink=$GATEWAY6
40 cf51ea5b Dimitris Aragiorgis
	eui64=$($MAC2EUI64 $MAC $prefix)
41 cf51ea5b Dimitris Aragiorgis
42 cf51ea5b Dimitris Aragiorgis
	while ip -6 rule del dev $INTERFACE; do :; done
43 cf51ea5b Dimitris Aragiorgis
	ip -6 rule add dev $INTERFACE table $TABLE
44 cf51ea5b Dimitris Aragiorgis
	ip -6 ro replace $eui64/128 dev $INTERFACE table $TABLE
45 cf51ea5b Dimitris Aragiorgis
	ip -6 neigh add proxy $eui64 dev $uplink
46 cf51ea5b Dimitris Aragiorgis
47 cf51ea5b Dimitris Aragiorgis
	# disable proxy NDP since we're handling this on userspace
48 cf51ea5b Dimitris Aragiorgis
	# this should be the default, but better safe than sorry
49 cf51ea5b Dimitris Aragiorgis
	echo 0 > /proc/sys/net/ipv6/conf/$INTERFACE/proxy_ndp
50 cf51ea5b Dimitris Aragiorgis
}
51 cf51ea5b Dimitris Aragiorgis
52 cf51ea5b Dimitris Aragiorgis
# pick a firewall profile per NIC, based on tags (and apply it)
53 cf51ea5b Dimitris Aragiorgis
function routed_setup_firewall {
54 cf51ea5b Dimitris Aragiorgis
	ifprefix="synnefo:network:$INTERFACE_INDEX:"
55 cf51ea5b Dimitris Aragiorgis
	for tag in $TAGS; do
56 cf51ea5b Dimitris Aragiorgis
		case ${tag#$ifprefix} in
57 cf51ea5b Dimitris Aragiorgis
		protected)
58 cf51ea5b Dimitris Aragiorgis
			chain=protected
59 cf51ea5b Dimitris Aragiorgis
		;;
60 cf51ea5b Dimitris Aragiorgis
		unprotected)
61 cf51ea5b Dimitris Aragiorgis
			chain=unprotected
62 cf51ea5b Dimitris Aragiorgis
		;;
63 cf51ea5b Dimitris Aragiorgis
		limited)
64 cf51ea5b Dimitris Aragiorgis
			chain=limited
65 cf51ea5b Dimitris Aragiorgis
		;;
66 cf51ea5b Dimitris Aragiorgis
		esac
67 cf51ea5b Dimitris Aragiorgis
	done
68 cf51ea5b Dimitris Aragiorgis
69 cf51ea5b Dimitris Aragiorgis
	# Flush any old rules. We have to consider all chains, since
70 cf51ea5b Dimitris Aragiorgis
	# we are not sure the instance was on the same chain, or had the same
71 cf51ea5b Dimitris Aragiorgis
	# tap interface.
72 cf51ea5b Dimitris Aragiorgis
	for oldchain in protected unprotected limited; do
73 cf51ea5b Dimitris Aragiorgis
		iptables  -D FORWARD -o $INTERFACE -j $oldchain 2>/dev/null
74 cf51ea5b Dimitris Aragiorgis
		ip6tables -D FORWARD -o $INTERFACE -j $oldchain 2>/dev/null
75 cf51ea5b Dimitris Aragiorgis
	done
76 cf51ea5b Dimitris Aragiorgis
77 cf51ea5b Dimitris Aragiorgis
	if [ "x$chain" != "x" ]; then
78 cf51ea5b Dimitris Aragiorgis
		iptables  -A FORWARD -o $INTERFACE -j $chain
79 cf51ea5b Dimitris Aragiorgis
		ip6tables -A FORWARD -o $INTERFACE -j $chain
80 cf51ea5b Dimitris Aragiorgis
	fi
81 cf51ea5b Dimitris Aragiorgis
}
82 cf51ea5b Dimitris Aragiorgis
83 7d163a24 Dimitris Aragiorgis
function setup_nfdhcpd {
84 cf51ea5b Dimitris Aragiorgis
	umask 022
85 ed7f0f2a Dimitris Aragiorgis
  FILE=$NFDHCPD_STATE_DIR/$INTERFACE
86 ed7f0f2a Dimitris Aragiorgis
	cat >$FILE <<EOF
87 cf51ea5b Dimitris Aragiorgis
IFACE=$1
88 cf51ea5b Dimitris Aragiorgis
IP=$IP
89 cf51ea5b Dimitris Aragiorgis
MAC=$MAC
90 cf51ea5b Dimitris Aragiorgis
LINK=$TABLE
91 cf51ea5b Dimitris Aragiorgis
HOSTNAME=$INSTANCE
92 cf51ea5b Dimitris Aragiorgis
TAGS="$TAGS"
93 cf51ea5b Dimitris Aragiorgis
EOF
94 ed7f0f2a Dimitris Aragiorgis
if [ -n $GATEWAY ]; then
95 ed7f0f2a Dimitris Aragiorgis
 echo GATEWAY=$GATEWAY >> $FILE
96 ed7f0f2a Dimitris Aragiorgis
fi
97 ed7f0f2a Dimitris Aragiorgis
if [ -n $SUBNET ]; then
98 ed7f0f2a Dimitris Aragiorgis
 echo SUBNET=$SUBNET >> $FILE
99 ed7f0f2a Dimitris Aragiorgis
fi
100 ed7f0f2a Dimitris Aragiorgis
if [ -n $GATEWAY6 ]; then
101 ed7f0f2a Dimitris Aragiorgis
 echo GATEWAY6=$GATEWAY6 >> $FILE
102 ed7f0f2a Dimitris Aragiorgis
fi
103 ed7f0f2a Dimitris Aragiorgis
if [ -n $SUBNET6 ]; then
104 ed7f0f2a Dimitris Aragiorgis
 echo SUBNET6=$SUBNET6 >> $FILE
105 ed7f0f2a Dimitris Aragiorgis
fi
106 ed7f0f2a Dimitris Aragiorgis
107 cf51ea5b Dimitris Aragiorgis
}
108 cf51ea5b Dimitris Aragiorgis
109 7d163a24 Dimitris Aragiorgis
function clear_ebtables {
110 cf51ea5b Dimitris Aragiorgis
  TAP=$INTERFACE
111 cf51ea5b Dimitris Aragiorgis
  FROM=FROM${TAP^^}
112 cf51ea5b Dimitris Aragiorgis
  TO=TO${TAP^^}
113 cf51ea5b Dimitris Aragiorgis
  
114 7d163a24 Dimitris Aragiorgis
  exist=$(ebtables -L | grep $TAP)
115 cf51ea5b Dimitris Aragiorgis
  
116 7d163a24 Dimitris Aragiorgis
  if [ ! -z "$exist" ]; then
117 7d163a24 Dimitris Aragiorgis
    ebtables -D INPUT -i $TAP -j $FROM
118 7d163a24 Dimitris Aragiorgis
    ebtables -D FORWARD -i $TAP -j $FROM
119 7d163a24 Dimitris Aragiorgis
    ebtables -D FORWARD -o $TAP -j $TO
120 7d163a24 Dimitris Aragiorgis
    ebtables -D OUTPUT -o $TAP -j $TO
121 7d163a24 Dimitris Aragiorgis
122 7d163a24 Dimitris Aragiorgis
    ebtables -X $FROM
123 7d163a24 Dimitris Aragiorgis
    ebtables -X $TO
124 7d163a24 Dimitris Aragiorgis
  fi
125 f6f980d5 Dimitris Aragiorgis
}
126 f6f980d5 Dimitris Aragiorgis
127 7d163a24 Dimitris Aragiorgis
function setup_ebtables {
128 f6f980d5 Dimitris Aragiorgis
  TAP=$INTERFACE
129 f6f980d5 Dimitris Aragiorgis
  FROM=FROM${TAP^^}
130 f6f980d5 Dimitris Aragiorgis
  TO=TO${TAP^^}
131 cf51ea5b Dimitris Aragiorgis
132 cf51ea5b Dimitris Aragiorgis
  ebtables -N $FROM
133 7d163a24 Dimitris Aragiorgis
  # do not allow changes in ip-mac pair
134 cf51ea5b Dimitris Aragiorgis
  ebtables -A $FROM --ip-source \! $IP -p ipv4 -j DROP
135 cf51ea5b Dimitris Aragiorgis
  ebtables -A $FROM -s \! $MAC -j DROP 
136 cf51ea5b Dimitris Aragiorgis
  ebtables -A FORWARD -i $TAP -j $FROM 
137 cf51ea5b Dimitris Aragiorgis
  ebtables -N $TO
138 cf51ea5b Dimitris Aragiorgis
  ebtables -A FORWARD -o $TAP -j $TO
139 f6f980d5 Dimitris Aragiorgis
  #accept dhcp responses from host (nfdhcpd)
140 f6f980d5 Dimitris Aragiorgis
  ebtables -A $TO -p ipv4 --ip-protocol=udp  --ip-destination-port=68 -j ACCEPT
141 cf51ea5b Dimitris Aragiorgis
  if [ $TYPE == "private" ]; then 
142 cf51ea5b Dimitris Aragiorgis
    if [ ! -z $GATEWAY ]; then 
143 7d163a24 Dimitris Aragiorgis
      # allow packets from/to router (for masquerading
144 cf51ea5b Dimitris Aragiorgis
      ebtables -A $TO -s $ROUTER_MAC -j ACCEPT 
145 7d163a24 Dimitris Aragiorgis
      ebtables -A INPUT -i $TAP -j $FROM 
146 7d163a24 Dimitris Aragiorgis
      ebtables -A OUTPUT -o $TAP -j $TO
147 cf51ea5b Dimitris Aragiorgis
    fi
148 7d163a24 Dimitris Aragiorgis
    # allow only packets from the same mac prefix 
149 7d163a24 Dimitris Aragiorgis
    ebtables -A $TO -s \! $MAC/$MAC_MASK -j DROP 
150 cf51ea5b Dimitris Aragiorgis
  fi
151 cf51ea5b Dimitris Aragiorgis
}
152 cf51ea5b Dimitris Aragiorgis
153 cf51ea5b Dimitris Aragiorgis
154 cf51ea5b Dimitris Aragiorgis
TABLE=rt_$NETWORK
155 cf51ea5b Dimitris Aragiorgis
156 cf51ea5b Dimitris Aragiorgis
source /var/lib/snf-network/networks/$NETWORK
157 cf51ea5b Dimitris Aragiorgis
158 cf51ea5b Dimitris Aragiorgis
159 cf51ea5b Dimitris Aragiorgis
if [ "$MODE" = "routed" ]; then
160 cf51ea5b Dimitris Aragiorgis
	# special proxy-ARP/NDP routing mode
161 7d163a24 Dimitris Aragiorgis
  clear_tap
162 cf51ea5b Dimitris Aragiorgis
	# use a constant predefined MAC address for the tap
163 cf51ea5b Dimitris Aragiorgis
	ip link set $INTERFACE addr $TAP_CONSTANT_MAC
164 cf51ea5b Dimitris Aragiorgis
	# bring the tap up
165 cf51ea5b Dimitris Aragiorgis
	ifconfig $INTERFACE 0.0.0.0 up
166 cf51ea5b Dimitris Aragiorgis
167 cf51ea5b Dimitris Aragiorgis
	# Drop unicast BOOTP/DHCP packets
168 cf51ea5b Dimitris Aragiorgis
	iptables -A FORWARD -i $INTERFACE -p udp --dport 67 -j DROP
169 cf51ea5b Dimitris Aragiorgis
170 cf51ea5b Dimitris Aragiorgis
	routed_setup_ipv4
171 ed7f0f2a Dimitris Aragiorgis
	routed_setup_ipv6
172 ed7f0f2a Dimitris Aragiorgis
	routed_setup_firewall
173 7d163a24 Dimitris Aragiorgis
	setup_nfdhcpd $INTERFACE
174 7d163a24 Dimitris Aragiorgis
  clear_ebtables >/dev/null 2>&1
175 cf51ea5b Dimitris Aragiorgis
elif [ "$MODE" = "bridged" ]; then
176 7d163a24 Dimitris Aragiorgis
  clear_tap
177 7d163a24 Dimitris Aragiorgis
  clear_ebtables >/dev/null 2>&1
178 cf51ea5b Dimitris Aragiorgis
	ifconfig $INTERFACE 0.0.0.0 up
179 cf51ea5b Dimitris Aragiorgis
	brctl addif $BRIDGE $INTERFACE
180 7d163a24 Dimitris Aragiorgis
	setup_nfdhcpd $BRIDGE
181 7d163a24 Dimitris Aragiorgis
  setup_ebtables
182 cf51ea5b Dimitris Aragiorgis
fi