Skip to content

Commit 398c15f

Browse files
sorahsorah
committed
show-01: basic routing setup
https://scrapbox.io/rknet/show-01 #186 Flow: client netns -> main netns -> backbone -> main netns -> server netns main netns performs SNAT from client netns (IPv4 and IPv6 source address randomization) and connects to cs-01, and DNAT to server netns (IPv4 public address conversion and IPv6 destination address randomization).
1 parent 7dc58f6 commit 398c15f

File tree

11 files changed

+532
-0
lines changed

11 files changed

+532
-0
lines changed

‎itamae/hosts.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,10 @@ nat-62.venue.rubykaigi.net:
1818
properties:
1919
run_list:
2020
- hosts/nat-62.venue.rubykaigi.net/default.rb
21+
22+
show-01.venue.rubykaigi.net:
23+
properties:
24+
run_list:
25+
- hosts/show-01.venue.rubykaigi.net/default.rb
26+
27+

‎itamae/hosts/show-01.venue.rubykaigi.net/default.rb

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
node.reverse_merge!(
2+
bird: {
3+
router_id: '10.33.100.75',
4+
},
5+
show: {
6+
addresses: {
7+
client4: '10.33.39.0/24',
8+
client4_range: '10.33.39.1-10.33.39.254',
9+
client6: '2001:df0:8500:ca5a::/64',
10+
client6_range: '2001:df0:8500:ca5a:1000:0000:0000:0000-2001:df0:8500:ca5a:1fff:ffff:ffff:fffe',
11+
client6_snat: '2001:df0:8500:ca5a:1::/68',
12+
13+
server4: '192.50.220.175',
14+
server4_pref64n: '2001:df0:8500:ca64:a9:8200:' 'c032:dcaf',
15+
server6: '2001:df0:8500:ca5b::ffff',
16+
server6_cidr: '2001:df0:8500:ca5b::/64',
17+
server6_dnat: '2001:df0:8500:ca5b:0::/68',
18+
19+
client4_internal: '169.254.0.75',
20+
client6_internal: '2001:df0:8500:ca5a:1::e0ee',
21+
server4_internal: '169.254.1.75',
22+
server6_internal: '2001:df0:8500:ca5b:1::e1ee',
23+
},
24+
interfaces: {
25+
management: {
26+
name: 'enp11s0f0',
27+
duid: '00:00:ba:2c:33:00:75',
28+
},
29+
servers: [
30+
{
31+
name: 'enp12s0f1',
32+
local_as: 65075,
33+
peer_as: 65010,
34+
link4: {
35+
peer: '10.33.22.80',
36+
local: '10.33.22.81',
37+
},
38+
link6: {
39+
peer: '2001:df0:8500:ca22:80::a',
40+
local: '2001:df0:8500:ca22:80::b',
41+
},
42+
},
43+
{
44+
name: 'enp5s0',
45+
local_as: 65075,
46+
peer_as: 65010,
47+
link4: {
48+
peer: '10.33.22.82',
49+
local: '10.33.22.83',
50+
},
51+
link6: {
52+
peer: '2001:df0:8500:ca22:82::a',
53+
local: '2001:df0:8500:ca22:82::b',
54+
},
55+
},
56+
],
57+
client: {
58+
name: 'enp2s0',
59+
local_as: 65075,
60+
peer_as: 65030,
61+
link4: {
62+
peer: '10.33.22.84',
63+
local: '10.33.22.85',
64+
},
65+
link6: {
66+
peer: '2001:df0:8500:ca22:84::a',
67+
local: '2001:df0:8500:ca22:84::b',
68+
},
69+
},
70+
},
71+
},
72+
)
73+
include_role 'show'

‎itamae/roles/plat/templates/etc/bird/bird.conf.d/plat.conf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,7 @@ protocol bgp bgp_inside {
195195
import filter {
196196
filter_bgp_community();
197197
if bgp_path ~ [= * <%= inside.fetch(:peer_as) %> =] then accept; # accept only direct path
198+
if bgp_path ~ [= * 65075 =] then accept; # accept show-01 path XXX:
198199
reject;
199200
};
200201
export filter {
@@ -209,6 +210,7 @@ protocol bgp bgp_inside {
209210
import filter {
210211
filter_bgp_community();
211212
if bgp_path ~ [= * <%= inside.fetch(:peer_as) %> =] then accept; # accept only direct path
213+
if bgp_path ~ [= * 65075 =] then accept; # accept show-01 path XXX:
212214
reject;
213215
};
214216
export filter {

‎itamae/roles/show/default.rb

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
node.reverse_merge!(
2+
systemd_networkd: {
3+
manage_foreign_routes: false,
4+
},
5+
show: {
6+
},
7+
bird: {
8+
#router_id:
9+
},
10+
)
11+
include_role 'base'
12+
13+
include_cookbook 'ruby'
14+
include_cookbook 'nftables'
15+
include_cookbook 'bird'
16+
17+
file '/etc/rk-show.json' do
18+
content "#{JSON.pretty_generate(node.fetch(:show))}\n"
19+
owner 'root'
20+
group 'root'
21+
mode '0644'
22+
end
23+
24+
template '/usr/local/bin/rk-ensure-veth' do
25+
owner 'root'
26+
group 'root'
27+
mode '0755'
28+
end
29+
template '/etc/systemd/system/rk-ensure-veth.service' do
30+
owner 'root'
31+
group 'root'
32+
mode '0644'
33+
notifies :run, 'execute[systemctl daemon-reload]', :immediately
34+
end
35+
service 'rk-ensure-veth.service' do
36+
action [:enable, :start]
37+
end
38+
39+
template '/etc/systemd/network/00-management.network' do
40+
owner 'root'
41+
group 'root'
42+
mode '0644'
43+
end
44+
45+
46+
node.dig(:show, :interfaces, :servers).each_with_index do |server, i|
47+
template "/etc/systemd/network/00-server#{i}.network" do
48+
variables(iface: server)
49+
source 'templates/etc/systemd/network/00-server.network'
50+
owner 'root'
51+
group 'root'
52+
mode '0644'
53+
end
54+
end
55+
56+
template "/etc/systemd/network/00-client.network" do
57+
variables(iface: node.dig(:show, :interfaces, :client))
58+
owner 'root'
59+
group 'root'
60+
mode '0644'
61+
end
62+
63+
template '/etc/nftables/show.conf' do
64+
owner 'root'
65+
group 'root'
66+
mode '0644'
67+
notifies :reload, 'service[nftables]'
68+
end
69+
70+
template "/etc/bird/bird.conf.d/show.conf" do
71+
owner 'root'
72+
group 'root'
73+
mode '0644'
74+
notifies :reload, 'service[bird]'
75+
end

‎itamae/roles/show/templates/etc/bird/bird.conf.d/show.conf

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
# vim: set ft=bird nofoldenable:
2+
ipv4 table main4;
3+
ipv6 table main6;
4+
ipv4 table client4;
5+
ipv6 table client6;
6+
ipv4 table server4;
7+
ipv6 table server6;
8+
9+
protocol kernel kernel_main4 {
10+
kernel table 254;
11+
merge paths on;
12+
ipv4 {
13+
table main4;
14+
export all;
15+
};
16+
}
17+
18+
protocol kernel kernel_main6 {
19+
kernel table 254;
20+
merge paths on;
21+
ipv6 {
22+
table main6;
23+
export all;
24+
};
25+
}
26+
27+
protocol kernel kernel_client4 {
28+
kernel table 100;
29+
merge paths on;
30+
ipv4 {
31+
table client4;
32+
export all;
33+
};
34+
}
35+
protocol kernel kernel_client6 {
36+
kernel table 100;
37+
merge paths on;
38+
ipv6 {
39+
table client6;
40+
export all;
41+
};
42+
}
43+
44+
protocol kernel kernel_server4 {
45+
kernel table 101;
46+
merge paths on;
47+
ipv4 {
48+
table server4;
49+
export all;
50+
};
51+
}
52+
53+
protocol kernel kernel_server6 {
54+
kernel table 101;
55+
merge paths on;
56+
ipv6 {
57+
table server6;
58+
export all;
59+
};
60+
}
61+
62+
protocol static static_main4 {
63+
ipv4 {
64+
table main4;
65+
};
66+
igp table main4;
67+
igp table main6;
68+
69+
route <%= node.dig(:show, :addresses).fetch(:client4_internal) %>/32 via fe80::b%'veth_c0';
70+
route <%= node.dig(:show, :addresses).fetch(:server4_internal) %>/32 via fe80::b%'veth_s0';
71+
}
72+
protocol static static_main6 {
73+
ipv6 {
74+
table main6;
75+
};
76+
igp table main4;
77+
igp table main6;
78+
79+
route <%= node.dig(:show, :addresses).fetch(:client6_internal) %>/128 via fe80::b%'veth_c0';
80+
route <%= node.dig(:show, :addresses).fetch(:server6_internal) %>/128 via fe80::b%'veth_s0';
81+
}
82+
83+
protocol static static_client4 {
84+
ipv4 {
85+
table client4;
86+
};
87+
88+
route <%= node.dig(:show, :addresses).fetch(:client4) %> blackhole;
89+
}
90+
protocol static static_client6 {
91+
ipv6 {
92+
table client6;
93+
};
94+
95+
route <%= node.dig(:show, :addresses).fetch(:client6) %> blackhole;
96+
}
97+
98+
protocol static static_server4 {
99+
ipv4 {
100+
table server4;
101+
};
102+
103+
route <%= node.dig(:show, :addresses).fetch(:server4) %>/32 blackhole;
104+
}
105+
protocol static static_server6 {
106+
ipv6 {
107+
table server6;
108+
};
109+
110+
route <%= node.dig(:show, :addresses).fetch(:server6) %>/128 blackhole;
111+
route <%= node.dig(:show, :addresses).fetch(:server6_cidr) %> blackhole;
112+
}
113+
114+
# er
115+
<%- servers = node.dig(:show, :interfaces).fetch(:servers); servers.each_with_index do |server, i| -%>
116+
protocol bgp bgp_server<%= i %> {
117+
local as <%= server.fetch(:local_as) %>;
118+
neighbor <%= server.fetch(:link6).fetch(:peer) %> as <%= server.fetch(:peer_as) %>;
119+
120+
ipv4 {
121+
table server4;
122+
import all;
123+
export filter {
124+
if proto = "static_server4" then accept;
125+
reject;
126+
};
127+
};
128+
ipv6 {
129+
table server6;
130+
import all;
131+
export filter {
132+
if proto = "static_server6" then accept;
133+
reject;
134+
};
135+
};
136+
}
137+
<%- end -%>
138+
139+
# cs
140+
<%- client = node.dig(:show, :interfaces).fetch(:client) -%>
141+
protocol bgp bgp_client {
142+
local as <%= client.fetch(:local_as) %>;
143+
neighbor <%= client.fetch(:link6).fetch(:peer) %> as <%= client.fetch(:peer_as) %>;
144+
145+
ipv4 {
146+
table client4;
147+
extended next hop on;
148+
import all;
149+
export filter {
150+
if proto = "static_client4" then accept;
151+
reject;
152+
};
153+
};
154+
ipv6 {
155+
table client6;
156+
import all;
157+
export filter {
158+
if proto = "static_client6" then accept;
159+
reject;
160+
};
161+
};
162+
}

0 commit comments

Comments
 (0)