Commit 96630917 authored by Stratos Psomadakis's avatar Stratos Psomadakis
Browse files

Remove kvm-vif-bridge script from repo

kvm-vif-bridge is provided by snf-network. Remove it from the synnefo
repo to avoid confusion.
parent 98efc321
#!/bin/bash
# This is an example of a Ganeti kvm ifup script that configures network
# interfaces based on the initial deployment of the Okeanos project
TAP_CONSTANT_MAC=cc:47:52:4e:45:54 # GRNET in hex :-)
MAC2EUI64=/usr/bin/mac2eui64
NFDHCPD_STATE_DIR=/var/lib/nfdhcpd
function routed_setup_ipv4 {
# get the link's default gateway
gw=$(ip route list table $LINK | sed -n 's/default via \([^ ]\+\).*/\1/p' | head -1)
# mangle ARPs to come from the gw's IP
arptables -D OUTPUT -o $INTERFACE --opcode request -j mangle >/dev/null 2>&1
arptables -A OUTPUT -o $INTERFACE --opcode request -j mangle --mangle-ip-s "$gw"
# route interface to the proper routing table
while ip rule del dev $INTERFACE; do :; done
ip rule add dev $INTERFACE table $LINK
# static route mapping IP -> INTERFACE
ip route replace $IP table $LINK proto static dev $INTERFACE
# Enable proxy ARP
echo 1 > /proc/sys/net/ipv4/conf/$INTERFACE/proxy_arp
}
function routed_setup_ipv6 {
# Add a routing entry for the eui-64
prefix=$(ip -6 route list table $LINK | awk '/\/64/ {print $1; exit}')
uplink=$(ip -6 route list table $LINK | sed -n 's/default via .* dev \([^ ]\+\).*/\1/p' | head -1)
eui64=$($MAC2EUI64 $MAC $prefix)
while ip -6 rule del dev $INTERFACE; do :; done
ip -6 rule add dev $INTERFACE table $LINK
ip -6 ro replace $eui64/128 dev $INTERFACE table $LINK
ip -6 neigh add proxy $eui64 dev $uplink
# disable proxy NDP since we're handling this on userspace
# this should be the default, but better safe than sorry
echo 0 > /proc/sys/net/ipv6/conf/$INTERFACE/proxy_ndp
}
# pick a firewall profile per NIC, based on tags (and apply it)
function routed_setup_firewall {
ifprefix="synnefo:network:$INTERFACE_INDEX:"
for tag in $TAGS; do
case ${tag#$ifprefix} in
protected)
chain=protected
;;
unprotected)
chain=unprotected
;;
limited)
chain=limited
;;
esac
done
# Flush any old rules. We have to consider all chains, since
# we are not sure the instance was on the same chain, or had the same
# tap interface.
for oldchain in protected unprotected limited; do
iptables -D FORWARD -o $INTERFACE -j $oldchain 2>/dev/null
ip6tables -D FORWARD -o $INTERFACE -j $oldchain 2>/dev/null
done
if [ "x$chain" != "x" ]; then
iptables -A FORWARD -o $INTERFACE -j $chain
ip6tables -A FORWARD -o $INTERFACE -j $chain
fi
}
function routed_setup_nfdhcpd {
umask 022
cat >$NFDHCPD_STATE_DIR/$INTERFACE <<EOF
IP=$IP
MAC=$MAC
LINK=$LINK
HOSTNAME=$INSTANCE
TAGS="$TAGS"
EOF
}
if [ "$MODE" = "routed" ]; then
# special proxy-ARP/NDP routing mode
# use a constant predefined MAC address for the tap
ip link set $INTERFACE addr $TAP_CONSTANT_MAC
# bring the tap up
ifconfig $INTERFACE 0.0.0.0 up
# Drop unicast BOOTP/DHCP packets
iptables -D FORWARD -i $INTERFACE -p udp --dport 67 -j DROP 2>/dev/null
iptables -A FORWARD -i $INTERFACE -p udp --dport 67 -j DROP
routed_setup_ipv4
routed_setup_ipv6
routed_setup_firewall
routed_setup_nfdhcpd
elif [ "$MODE" = "bridged" ]; then
ifconfig $INTERFACE 0.0.0.0 up
brctl addif $BRIDGE $INTERFACE
rm -f $NFDHCPD_STATE_DIR/$INTERFACE
fi
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment