Statistics
| Branch: | Tag: | Revision:

root / kvm-vif-bridge @ ed7f0f2a

History | View | Annotate | Download (4.4 kB)

1
#!/bin/bash
2

    
3
# This is an example of a Ganeti kvm ifup script that configures network
4
# interfaces based on the initial deployment of the Okeanos project
5

    
6
TAP_CONSTANT_MAC=cc:47:52:4e:45:54 # GRNET in hex :-)
7
MAC2EUI64=/usr/bin/mac2eui64
8
NFDHCPD_STATE_DIR=/var/lib/nfdhcpd
9

    
10
function clear_tap {
11
 
12
 arptables -D OUTPUT -o $INTERFACE --opcode request -j mangle >/dev/null 2>&1
13
 while ip rule del dev $INTERFACE; do :; done
14
 iptables -D FORWARD -i $INTERFACE -p udp --dport 67 -j DROP 2>/dev/null
15

    
16

    
17
}
18

    
19
function routed_setup_ipv4 {
20
	# get the link's default gateway
21
	gw=$GATEWAY
22

    
23
	# mangle ARPs to come from the gw's IP
24
	arptables -A OUTPUT -o $INTERFACE --opcode request -j mangle --mangle-ip-s "$gw"
25

    
26
	# route interface to the proper routing table
27
	ip rule add dev $INTERFACE table $TABLE
28

    
29
	# static route mapping IP -> INTERFACE
30
	ip route replace $IP proto static dev $INTERFACE table $TABLE
31

    
32
	# Enable proxy ARP
33
	echo 1 > /proc/sys/net/ipv4/conf/$INTERFACE/proxy_arp
34
}
35

    
36
function routed_setup_ipv6 {
37
	# Add a routing entry for the eui-64
38
	prefix=$SUBNET6
39
	uplink=$GATEWAY6
40
	eui64=$($MAC2EUI64 $MAC $prefix)
41

    
42
	while ip -6 rule del dev $INTERFACE; do :; done
43
	ip -6 rule add dev $INTERFACE table $TABLE
44
	ip -6 ro replace $eui64/128 dev $INTERFACE table $TABLE
45
	ip -6 neigh add proxy $eui64 dev $uplink
46

    
47
	# disable proxy NDP since we're handling this on userspace
48
	# this should be the default, but better safe than sorry
49
	echo 0 > /proc/sys/net/ipv6/conf/$INTERFACE/proxy_ndp
50
}
51

    
52
# pick a firewall profile per NIC, based on tags (and apply it)
53
function routed_setup_firewall {
54
	ifprefix="synnefo:network:$INTERFACE_INDEX:"
55
	for tag in $TAGS; do
56
		case ${tag#$ifprefix} in
57
		protected)
58
			chain=protected
59
		;;
60
		unprotected)
61
			chain=unprotected
62
		;;
63
		limited)
64
			chain=limited
65
		;;
66
		esac
67
	done
68

    
69
	# Flush any old rules. We have to consider all chains, since
70
	# we are not sure the instance was on the same chain, or had the same
71
	# tap interface.
72
	for oldchain in protected unprotected limited; do
73
		iptables  -D FORWARD -o $INTERFACE -j $oldchain 2>/dev/null
74
		ip6tables -D FORWARD -o $INTERFACE -j $oldchain 2>/dev/null
75
	done
76

    
77
	if [ "x$chain" != "x" ]; then
78
		iptables  -A FORWARD -o $INTERFACE -j $chain
79
		ip6tables -A FORWARD -o $INTERFACE -j $chain
80
	fi
81
}
82

    
83
function setup_nfdhcpd {
84
	umask 022
85
  FILE=$NFDHCPD_STATE_DIR/$INTERFACE
86
	cat >$FILE <<EOF
87
IFACE=$1
88
IP=$IP
89
MAC=$MAC
90
LINK=$TABLE
91
HOSTNAME=$INSTANCE
92
TAGS="$TAGS"
93
EOF
94
if [ -n $GATEWAY ]; then
95
 echo GATEWAY=$GATEWAY >> $FILE
96
fi
97
if [ -n $SUBNET ]; then
98
 echo SUBNET=$SUBNET >> $FILE
99
fi
100
if [ -n $GATEWAY6 ]; then
101
 echo GATEWAY6=$GATEWAY6 >> $FILE
102
fi
103
if [ -n $SUBNET6 ]; then
104
 echo SUBNET6=$SUBNET6 >> $FILE
105
fi
106

    
107
}
108

    
109
function clear_ebtables {
110
  TAP=$INTERFACE
111
  FROM=FROM${TAP^^}
112
  TO=TO${TAP^^}
113
  
114
  exist=$(ebtables -L | grep $TAP)
115
  
116
  if [ ! -z "$exist" ]; then
117
    ebtables -D INPUT -i $TAP -j $FROM
118
    ebtables -D FORWARD -i $TAP -j $FROM
119
    ebtables -D FORWARD -o $TAP -j $TO
120
    ebtables -D OUTPUT -o $TAP -j $TO
121

    
122
    ebtables -X $FROM
123
    ebtables -X $TO
124
  fi
125
}
126

    
127
function setup_ebtables {
128
  TAP=$INTERFACE
129
  FROM=FROM${TAP^^}
130
  TO=TO${TAP^^}
131

    
132
  ebtables -N $FROM
133
  # do not allow changes in ip-mac pair
134
  ebtables -A $FROM --ip-source \! $IP -p ipv4 -j DROP
135
  ebtables -A $FROM -s \! $MAC -j DROP 
136
  ebtables -A FORWARD -i $TAP -j $FROM 
137
  ebtables -N $TO
138
  ebtables -A FORWARD -o $TAP -j $TO
139
  #accept dhcp responses from host (nfdhcpd)
140
  ebtables -A $TO -p ipv4 --ip-protocol=udp  --ip-destination-port=68 -j ACCEPT
141
  if [ $TYPE == "private" ]; then 
142
    if [ ! -z $GATEWAY ]; then 
143
      # allow packets from/to router (for masquerading
144
      ebtables -A $TO -s $ROUTER_MAC -j ACCEPT 
145
      ebtables -A INPUT -i $TAP -j $FROM 
146
      ebtables -A OUTPUT -o $TAP -j $TO
147
    fi
148
    # allow only packets from the same mac prefix 
149
    ebtables -A $TO -s \! $MAC/$MAC_MASK -j DROP 
150
  fi
151
}
152

    
153

    
154
TABLE=rt_$NETWORK
155

    
156
source /var/lib/snf-network/networks/$NETWORK
157

    
158

    
159
if [ "$MODE" = "routed" ]; then
160
	# special proxy-ARP/NDP routing mode
161
  clear_tap
162
	# use a constant predefined MAC address for the tap
163
	ip link set $INTERFACE addr $TAP_CONSTANT_MAC
164
	# bring the tap up
165
	ifconfig $INTERFACE 0.0.0.0 up
166

    
167
	# Drop unicast BOOTP/DHCP packets
168
	iptables -A FORWARD -i $INTERFACE -p udp --dport 67 -j DROP
169

    
170
	routed_setup_ipv4
171
	routed_setup_ipv6
172
	routed_setup_firewall
173
	setup_nfdhcpd $INTERFACE
174
  clear_ebtables >/dev/null 2>&1
175
elif [ "$MODE" = "bridged" ]; then
176
  clear_tap
177
  clear_ebtables >/dev/null 2>&1
178
	ifconfig $INTERFACE 0.0.0.0 up
179
	brctl addif $BRIDGE $INTERFACE
180
	setup_nfdhcpd $BRIDGE
181
  setup_ebtables
182
fi