first commit
This commit is contained in:
root
commit
bb377472b0
|
|
@ -0,0 +1,5 @@
|
|||
wit-hypervisor (1.0) unstable; urgency=low
|
||||
|
||||
* Initial release.
|
||||
|
||||
-- Toby Paler <toby@wit.com> Wed, 25 Jul 2018 22:54:00 +0100
|
||||
|
|
@ -0,0 +1 @@
|
|||
7
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
Source: wit-hypervisor
|
||||
Section: config
|
||||
Priority: extra
|
||||
Maintainer: toby <toby@wit.com>
|
||||
Build-Depends: debhelper (>= 7.0.0~), config-package-dev (>= 4.15), lynx
|
||||
Standards-Version: 3.9.2
|
||||
|
||||
Package: wit-hypervisor
|
||||
Architecture: all
|
||||
Depends: ${misc:Depends}, sed, tcpdump, mtr-tiny, iproute2, ifupdown, ipmitool, iptables, lldpd, strongswan, telnet, netcat, fping, curl, wget, ifstat, rsyslog, ncurses-term, net-tools, bridge-utils, vlan
|
||||
Provides: ${diverted-files}
|
||||
Conflicts: ${diverted-files}
|
||||
Description: Installs basic network packages and
|
||||
configures the box as hypervisor or datanode.
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
wit-hypervisor package.
|
||||
|
||||
Author: Toby <toby@wit.com>
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
#!/bin/sh
|
||||
# postinst script for #PACKAGE#
|
||||
#
|
||||
# see: dh_installdeb(1)
|
||||
|
||||
set -e
|
||||
|
||||
# summary of how this script can be called:
|
||||
# * <postinst> `configure' <most-recently-configured-version>
|
||||
# * <old-postinst> `abort-upgrade' <new version>
|
||||
# * <conflictor's-postinst> `abort-remove' `in-favour' <package>
|
||||
# <new-version>
|
||||
# * <postinst> `abort-remove'
|
||||
# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
|
||||
# <failed-install-package> <version> `removing'
|
||||
# <conflicting-package> <version>
|
||||
# for details, see https://www.debian.org/doc/debian-policy/ or
|
||||
# the debian-policy package
|
||||
|
||||
|
||||
case "$1" in
|
||||
configure)
|
||||
|
||||
systemctl stop systemd-networkd.socket
|
||||
systemctl stop systemd-networkd.service
|
||||
systemctl stop systemd-networkd-wait-online
|
||||
systemctl disable systemd-networkd.service
|
||||
systemctl disable systemd-networkd.socket
|
||||
systemctl disable systemd-networkd-wait-online
|
||||
|
||||
systemctl enable firewall
|
||||
systemctl restart systemd-timesyncd
|
||||
systemctl restart strongswan
|
||||
|
||||
update-grub
|
||||
|
||||
sysctl -p /etc/sysctl.d/10-frr.conf
|
||||
|
||||
;;
|
||||
|
||||
abort-upgrade|abort-remove|abort-deconfigure)
|
||||
;;
|
||||
|
||||
*)
|
||||
echo "postinst called with unknown argument \`$1'" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# dh_installdeb will replace this with shell code automatically
|
||||
# generated by other debhelper scripts.
|
||||
|
||||
#DEBHELPER#
|
||||
|
||||
exit 0
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
#!/bin/sh
|
||||
# preinst script for #PACKAGE#
|
||||
#
|
||||
# see: dh_installdeb(1)
|
||||
|
||||
set -e
|
||||
|
||||
# summary of how this script can be called:
|
||||
# * <new-preinst> `install'
|
||||
# * <new-preinst> `install' <old-version>
|
||||
# * <new-preinst> `upgrade' <old-version>
|
||||
# * <old-preinst> `abort-upgrade' <new-version>
|
||||
# for details, see https://www.debian.org/doc/debian-policy/ or
|
||||
# the debian-policy package
|
||||
|
||||
|
||||
case "$1" in
|
||||
install|upgrade)
|
||||
|
||||
[ -z "$NODE_ID" ] && export NODE_ID=$(ip -4 -br addr | grep 10.0. | awk '{ print $3 }' | awk 'BEGIN{FS="[./]"} { print $4 }')
|
||||
|
||||
MGMT_ID=$(ip -4 -br addr | grep 10.0. | awk '{ print $3 }' | awk 'BEGIN{FS="[./]"} { print $3 }')
|
||||
|
||||
|
||||
[ "$MGMT_ID" -ge 0 -a "$MGMT_ID" -lt 16 ] && export DOMAINNAME=.usw1.wit.com
|
||||
[ "$MGMT_ID" -ge 16 -a "$MGMT_ID" -lt 32 ] && export DOMAINNAME=.usw2.wit.com
|
||||
|
||||
|
||||
[ ${HOSTNAME:0:1} = h ] && export HOSTTYPE=hypervisor
|
||||
[ ${HOSTNAME:0:1} = d ] && export HOSTTYPE=datanode
|
||||
|
||||
|
||||
[ $HOSTTYPE = hypervisor -a $DOMAINNAME = .usw1.wit.com ] && export TIER_ID=2
|
||||
[ $HOSTTYPE = datanode -a $DOMAINNAME = .usw1.wit.com ] && export TIER_ID=4
|
||||
[ $HOSTTYPE = hypervisor -a $DOMAINNAME = .usw2.wit.com ] && export TIER_ID=18
|
||||
[ $HOSTTYPE = datanode -a $DOMAINNAME = .usw2.wit.com ] && export TIER_ID=20
|
||||
|
||||
|
||||
if [ -z "$TIER_ID" ]; then
|
||||
echo "Unable to autodetect TIER_ID, looks like we deal with a special node, please set in environment"
|
||||
exit 2
|
||||
fi
|
||||
if [ -z "$DOMAINNAME" ]; then
|
||||
echo "Unable to autodetect DOMAINNAME, looks like we deal with a special case, please set in environment and/or update the code"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
|
||||
;;
|
||||
|
||||
abort-upgrade)
|
||||
;;
|
||||
|
||||
*)
|
||||
echo "preinst called with unknown argument \`$1'" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
# dh_installdeb will replace this with shell code automatically
|
||||
# generated by other debhelper scripts.
|
||||
|
||||
#DEBHELPER#
|
||||
|
||||
exit 0
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
#!/usr/bin/make -f
|
||||
|
||||
%:
|
||||
dh $@ --with=config-package
|
||||
|
|
@ -0,0 +1 @@
|
|||
3.0 (native)
|
||||
|
|
@ -0,0 +1 @@
|
|||
/etc/systemd/network/*
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
files/vrf.conf etc/iproute2/rt_tables.d
|
||||
files/vrf-dhcp-enter etc/dhcp/dhclient-enter-hooks.d
|
||||
files/vrf-dhcp-exit etc/dhcp/dhclient-exit-hooks.d
|
||||
files/rc.local etc
|
||||
files/10-frr.conf etc/sysctl.d
|
||||
files/wit-gc usr/local/bin
|
||||
files/resolv.conf etc
|
||||
files/bashrc-witaddon root
|
||||
files/qemu-ifdown etc/libvirt/hooks
|
||||
files/qemu-ifup-public etc/libvirt/hooks
|
||||
files/qemu-ifup etc/libvirt/hooks
|
||||
files/firewall etc/init.d
|
||||
files/frr.conf etc/frr
|
||||
files/interfaces etc/network
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
/etc/network/interfaces sed -e "s/TIERID/$TIER_ID/g"
|
||||
/etc/frr/frr.conf sed -e "s/VTEPINDEX/$NODE_ID/" -e "s/TIERID/$TIER_ID/" -e "s/TIERASN/$(printf "%03d" $TIER_ID)/" -e "s/VTEPASN/$(printf "%03d" $NODE_ID)/"
|
||||
/etc/hosts sed -e "/.*debcore1/d" -e "/.*$MYHOSTNAME/d" -e "$ s/$/\n10.1.$TIER_ID.$NODE_ID\t$MYHOSTNAME/"
|
||||
/etc/frr/daemons sed -e 's/bgpd=no/bgpd=yes/' -e 's/zebra=no/zebra=yes/'
|
||||
/etc/ssh/sshd_config sed -e '/PasswordAuthentication/d' -e '$ s/$/\nPasswordAuthentication no/'
|
||||
/etc/systemd/timesyncd.conf sed -e 's/#NTP=.*/NTP=ipv6.ntp.ubuntu.com/g'
|
||||
/etc/default/grub sed -e '/GRUB_CMDLINE_LINUX_DEFAULT=/d' -e '/GRUB_CMDLINE_LINUX=/d' -e '/GRUB_SERIAL_COMMAND=/d' -e '/GRUB_TERMINAL=/d' -e '$ s/$/\nGRUB_CMDLINE_LINUX_DEFAULT=""\nGRUB_CMDLINE_LINUX="console=tty0 console=ttyS1,115200n8"\nGRUB_TERMINAL=serial\nGRUB_SERIAL_COMMAND="serial --speed=115200 --unit=1 --word=8 --parity=no --stop=1"/'
|
||||
/root/.bashrc sed -e '/.*bashrc-witaddon.*/d' -e '$ /$/\nsource ~/bashrc-witaddon/'
|
||||
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
# Enables IPv4/IPv6 Routing
|
||||
net.ipv4.ip_forward = 1
|
||||
net.ipv6.conf.all.forwarding=1
|
||||
|
||||
# Routing
|
||||
net.ipv6.route.max_size=131072
|
||||
net.ipv4.conf.all.ignore_routes_with_linkdown=1
|
||||
net.ipv6.conf.all.ignore_routes_with_linkdown=1
|
||||
|
||||
|
||||
# Best Settings for Peering w/ BGP Unnumbered
|
||||
# and OSPF Neighbors
|
||||
net.ipv4.conf.all.rp_filter = 0
|
||||
net.ipv4.conf.default.rp_filter = 0
|
||||
net.ipv4.conf.lo.rp_filter = 0
|
||||
net.ipv4.conf.all.forwarding = 1
|
||||
net.ipv4.conf.default.forwarding = 1
|
||||
net.ipv4.conf.default.arp_announce = 2
|
||||
net.ipv4.conf.default.arp_notify = 1
|
||||
net.ipv4.conf.default.arp_ignore=1
|
||||
net.ipv4.conf.all.arp_announce = 2
|
||||
net.ipv4.conf.all.arp_notify = 1
|
||||
net.ipv4.conf.all.arp_ignore=1
|
||||
net.ipv4.icmp_errors_use_inbound_ifaddr=1
|
||||
|
||||
# Miscellaneous Settings
|
||||
|
||||
# Keep ipv6 permanent addresses on an admin down
|
||||
net.ipv6.conf.all.keep_addr_on_down=1
|
||||
|
||||
# igmp
|
||||
net.ipv4.igmp_max_memberships=1000
|
||||
net.ipv4.neigh.default.mcast_solicit = 10
|
||||
|
||||
# MLD
|
||||
net.ipv6.mld_max_msf=512
|
||||
|
||||
# Garbage Collection Settings for ARP and Neighbors
|
||||
net.ipv4.neigh.default.gc_thresh2=7168
|
||||
net.ipv4.neigh.default.gc_thresh3=8192
|
||||
net.ipv4.neigh.default.base_reachable_time_ms=14400000
|
||||
net.ipv6.neigh.default.gc_thresh2=3584
|
||||
net.ipv6.neigh.default.gc_thresh3=4096
|
||||
net.ipv6.neigh.default.base_reachable_time_ms=14400000
|
||||
|
||||
# Use neigh information on selection of nexthop for multipath hops
|
||||
net.ipv4.fib_multipath_use_neigh=1
|
||||
|
||||
# Allows Apps to Work with VRF
|
||||
net.ipv4.tcp_l3mdev_accept=1
|
||||
|
||||
|
||||
# disable forwarding for mgmt interface
|
||||
net.ipv6.conf.mgmt1.forwarding = 0
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
PROMPT_COMMAND='export VRF=$(ip vrf identify $$)'
|
||||
PS1=$PS1'[${VRF:=default}] '
|
||||
|
||||
function chvrf() {
|
||||
ip vrf exec $1 /bin/bash
|
||||
}
|
||||
|
||||
alias ll='ls -lha'
|
||||
|
|
@ -0,0 +1,100 @@
|
|||
#!/bin/bash
|
||||
### BEGIN INIT INFO
|
||||
# Provides: scriptname
|
||||
# Required-Start: $network
|
||||
# Required-Stop: $network
|
||||
# Default-Start: 2 3 4 5
|
||||
# Default-Stop: 0 1 6
|
||||
# Short-Description: iptables
|
||||
# Description: Enable firewall rules
|
||||
### END INIT INFO
|
||||
|
||||
exec 1> >(logger -s -t $(basename $0)) 2>&1
|
||||
|
||||
case $1 in
|
||||
start)
|
||||
echo -n "firewall start..."
|
||||
### IPv4
|
||||
iptables -P INPUT ACCEPT
|
||||
iptables -F INPUT
|
||||
#unencrypted traffic
|
||||
iptables -A INPUT -s 10.1.0.0/16 -p esp -j ACCEPT
|
||||
iptables -A INPUT -s 10.1.0.0/16 -p udp --dport 500 --sport 500 -j ACCEPT
|
||||
iptables -A INPUT -s 10.1.0.0/16 -p udp --dport 4500 --sport 4500 -j ACCEPT
|
||||
iptables -A INPUT -p icmp -j ACCEPT
|
||||
#traffic we wanna see from the VPN
|
||||
iptables -A INPUT -m policy --pol ipsec --dir in -s 10.1.0.0/16 -p udp --dport 4789 -m policy --pol ipsec --dir in -j ACCEPT # vxlan traffic
|
||||
iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -s 10.1.0.0/16 -p tcp --dports 49152:49215 -j ACCEPT # libvirt live migration
|
||||
#iptables -A INPUT -m policy --pol ipsec --dir in -m multiport -s 10.1.0.0/16 -p tcp --dports 6800:7300 -j ACCEPT # ceph traffic
|
||||
|
||||
##### DROP the rest
|
||||
iptables -P INPUT DROP
|
||||
|
||||
|
||||
#### IPv6
|
||||
ip6tables -P INPUT ACCEPT
|
||||
ip6tables -F INPUT
|
||||
ip6tables -A INPUT -p ipv6-icmp -j ACCEPT
|
||||
ip6tables -A INPUT -s fe80::/10 -p tcp --sport 179 -j ACCEPT
|
||||
ip6tables -A INPUT -s fe80::/10 -p tcp --dport 179 -j ACCEPT
|
||||
ip6tables -A INPUT -s 2001:4860:4860::8888 -p udp --sport 53 -j ACCEPT
|
||||
ip6tables -A INPUT -s 2001:4860:4860::8844 -p udp --sport 53 -j ACCEPT
|
||||
ip6tables -A INPUT -s 2001:67c:1560:8003::c7 -p udp --sport 123 -j ACCEPT
|
||||
ip6tables -A INPUT -s 2001:67c:1560:8003::c8 -p udp --sport 123 -j ACCEPT
|
||||
### DROP the rest
|
||||
ip6tables -P INPUT DROP
|
||||
|
||||
|
||||
#special tables
|
||||
iptables -t mangle -F
|
||||
iptables -t nat -F
|
||||
iptables -t raw -F
|
||||
|
||||
ip6tables -t mangle -F
|
||||
ip6tables -t nat -F
|
||||
ip6tables -t raw -F
|
||||
|
||||
|
||||
ip6tables -t raw -A PREROUTING -j NOTRACK
|
||||
ip6tables -t raw -A OUTPUT -j NOTRACK
|
||||
##### temp rules till we get VRF in place in the factory, just flip the 3 rules below
|
||||
if ip link show dev mgmt >/dev/null 2>&1; then
|
||||
iptables -t raw -A PREROUTING ! -i mgmt1 -j NOTRACK
|
||||
iptables -t raw -A OUTPUT ! -o mgmt -j NOTRACK
|
||||
iptables -A INPUT -i mgmt -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
iptables -A INPUT -i mgmt -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT
|
||||
else
|
||||
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT
|
||||
fi
|
||||
##### end temp rules
|
||||
|
||||
|
||||
;;
|
||||
|
||||
stop)
|
||||
echo -n "firewall stop..."
|
||||
|
||||
#### Firewall rules
|
||||
iptables -P INPUT ACCEPT
|
||||
iptables -F
|
||||
iptables -t raw -F
|
||||
iptables -t nat -F
|
||||
iptables -t mangle -F
|
||||
|
||||
ip6tables -P INPUT ACCEPT
|
||||
ip6tables -F
|
||||
ip6tables -t raw -F
|
||||
ip6tables -t nat -F
|
||||
ip6tables -t mangle -F
|
||||
|
||||
echo " done"
|
||||
;;
|
||||
restart)
|
||||
#$0 stop
|
||||
$0 start
|
||||
;;
|
||||
*)
|
||||
echo "use $0 [start|stop|restart]"
|
||||
;;
|
||||
esac
|
||||
|
|
@ -0,0 +1,78 @@
|
|||
frr defaults datacenter
|
||||
username cumulus nopassword
|
||||
!
|
||||
service integrated-vtysh-config
|
||||
!
|
||||
log syslog informational
|
||||
!
|
||||
interface feth1
|
||||
ipv6 nd ra-interval 10
|
||||
no ipv6 nd suppress-ra
|
||||
!
|
||||
interface feth2
|
||||
ipv6 nd ra-interval 10
|
||||
no ipv6 nd suppress-ra
|
||||
!
|
||||
router bgp 4200TIERASNVTEPASN
|
||||
bgp router-id 10.1.TIERID.VTEPINDEX
|
||||
no bgp default ipv4-unicast
|
||||
coalesce-time 1000
|
||||
bgp bestpath as-path multipath-relax
|
||||
bgp bestpath compare-routerid
|
||||
neighbor fabric peer-group
|
||||
neighbor fabric remote-as external
|
||||
neighbor fabric capability extended-nexthop
|
||||
neighbor feth1 interface peer-group fabric
|
||||
neighbor feth2 interface peer-group fabric
|
||||
!
|
||||
address-family ipv4 unicast
|
||||
redistribute kernel route-map EIP
|
||||
redistribute connected route-map LOOPBACK
|
||||
neighbor fabric activate
|
||||
neighbor fabric addpath-tx-all-paths
|
||||
neighbor fabric soft-reconfiguration inbound
|
||||
exit-address-family
|
||||
!
|
||||
address-family ipv6 unicast
|
||||
redistribute kernel route-map EIPv6
|
||||
redistribute connected route-map LOOPBACKv6
|
||||
neighbor fabric activate
|
||||
neighbor fabric addpath-tx-all-paths
|
||||
neighbor fabric soft-reconfiguration inbound
|
||||
exit-address-family
|
||||
!
|
||||
address-family l2vpn evpn
|
||||
neighbor fabric activate
|
||||
advertise-all-vni
|
||||
exit-address-family
|
||||
!
|
||||
ip prefix-list LOOPBACK seq 5 permit 10.1.0.0/16 ge 32
|
||||
ip prefix-list WITV4 seq 5 permit 168.245.146.0/24 ge 25
|
||||
ip prefix-list WITV4 seq 10 permit 170.199.210.0/24 ge 25
|
||||
ip prefix-list WITV4 seq 15 permit 170.199.211.0/24 ge 25
|
||||
ip prefix-list WITV4 seq 20 permit 170.199.212.0/24 ge 25
|
||||
ip prefix-list WITV4 seq 25 permit 170.199.213.0/24 ge 25
|
||||
ip prefix-list WITV4 seq 30 permit 170.199.214.0/24 ge 25
|
||||
ip prefix-list WITV4 seq 35 permit 170.199.215.0/24 ge 25
|
||||
ip prefix-list WITV4 seq 40 permit 170.199.216.0/24 ge 25
|
||||
ip prefix-list WITV4 seq 45 permit 170.199.217.0/24 ge 25
|
||||
!
|
||||
ipv6 prefix-list LOOPBACK seq 5 permit 2604:bbc0::/96 ge 128
|
||||
ipv6 prefix-list WITV6-CUSTOMERS seq 5 permit 2604:bbc0:1::/48 ge 64
|
||||
!
|
||||
route-map EIPv6 permit 5
|
||||
match ipv6 address prefix-list WITV6-CUSTOMERS
|
||||
!
|
||||
route-map EIP permit 5
|
||||
match ip address prefix-list WITV4
|
||||
!
|
||||
route-map LOOPBACK permit 5
|
||||
description "permit loopback ips"
|
||||
match ip address prefix-list LOOPBACK
|
||||
!
|
||||
route-map LOOPBACKv6 permit 5
|
||||
description "permit ipv6 loopback ips"
|
||||
match ipv6 address prefix-list LOOPBACK
|
||||
!
|
||||
line vty
|
||||
!
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
auto lo
|
||||
iface lo inet loopback
|
||||
|
||||
auto lo:0
|
||||
iface lo:0 inet static
|
||||
address 10.1.TIERID.VTEPINDEX/32
|
||||
|
||||
iface lo:0 inet6 static
|
||||
address 2604:bbc0::TIERID:VTEPINDEX/128
|
||||
|
||||
auto mgmt1
|
||||
iface mgmt1 inet6 auto
|
||||
iface mgmt1 inet dhcp
|
||||
pre-up /bin/ip link add mgmt type vrf table mgmt
|
||||
pre-up /bin/ip link set up dev mgmt
|
||||
pre-up /bin/ip link set master mgmt dev mgmt1
|
||||
post-down /bin/ip link del dev mgmt
|
||||
|
||||
|
||||
auto feth1
|
||||
iface feth1 inet manual
|
||||
mtu 9000
|
||||
|
||||
auto feth2
|
||||
iface feth2 inet manual
|
||||
mtu 9000
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
#!/bin/bash
|
||||
set -e
|
||||
IFACE=$1
|
||||
|
||||
|
||||
### IPv4 is IFACE public and has a route? if so, nuke it
|
||||
for route in $(vtysh -c "show ip route kernel" | grep "$IFACE" | awk '{ print $2 }')
|
||||
do
|
||||
echo "removing route for $IFACE: $route"
|
||||
ip route del $route
|
||||
done
|
||||
#### IPv6 is IFACE public and has a route? if so, nuke it
|
||||
#for route in $(vtysh -c "show ipv6 route kernel" | grep "$IFACE" | awk '{ print $2 }')
|
||||
# do
|
||||
# echo "removing route for $IFACE: $route"
|
||||
# ip route del $route
|
||||
#done
|
||||
|
||||
|
||||
### is IFACE private and has a local bridge?
|
||||
BRIDGE=$(readlink -f /sys/devices/virtual/net/$IFACE/brport/bridge || true)
|
||||
|
||||
if [ ! -z $BRIDGE ]; then
|
||||
BRIDGE=${BRIDGE##*/}
|
||||
echo "removing $IFACE from $BRIDGE"
|
||||
brctl delif $BRIDGE $IFACE
|
||||
if ! ls /sys/devices/virtual/net/$BRIDGE/brif/ | grep -qv vxlan; then #if so is the *local* bridge now empty? if so, nuke the whole bridge including tunnel endpoint
|
||||
echo "removing unused bridge: $BRIDGE"
|
||||
ip link del dev $(ls /sys/devices/virtual/net/$BRIDGE/brif/ | grep vxlan)
|
||||
ip link set down $BRIDGE
|
||||
brctl delbr $BRIDGE
|
||||
fi
|
||||
fi
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
#!/bin/bash
|
||||
set -e
|
||||
IFACE=$1
|
||||
# vm<vm_id>.<num>
|
||||
|
||||
CLUSTER=$(curl -s -H 'X-Wit-Auth: true' http://10.0.0.1:4000/get-by-iface/${IFACE} | sed 's/"//g' | awk '{print $1}')
|
||||
|
||||
if ! [[ $CLUSTER =~ ^[0-9]+$ ]]; then
|
||||
echo "CLUSTER seems not to be valid"
|
||||
exit 10
|
||||
fi
|
||||
|
||||
LOOPBACKIP=$(hostname -i)
|
||||
BRIDGE=br${CLUSTER}
|
||||
VXLAN=vxlan${CLUSTER}
|
||||
VNI=${CLUSTER}
|
||||
|
||||
ip link set up ${IFACE}
|
||||
|
||||
if ! ip link show dev ${VXLAN} &>/dev/null; then
|
||||
ip link add ${VXLAN} type vxlan id ${VNI} dstport 4789 local ${LOOPBACKIP} nolearning
|
||||
ip link set up ${VXLAN}
|
||||
fi
|
||||
|
||||
if ! ip link show dev ${BRIDGE} &>/dev/null; then
|
||||
brctl addbr ${BRIDGE}
|
||||
brctl stp ${BRIDGE} off
|
||||
brctl addif ${BRIDGE} ${VXLAN}
|
||||
ip link set up dev ${BRIDGE}
|
||||
bridge vlan del dev ${BRIDGE} vid 1 self
|
||||
echo 1 >/sys/class/net/${BRIDGE}/bridge/vlan_filtering
|
||||
fi
|
||||
|
||||
brctl addif ${BRIDGE} ${IFACE}
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
#!/bin/bash
|
||||
set -e
|
||||
IFACE=$1
|
||||
|
||||
maxprefixv6=64
|
||||
maxprefixv4=29
|
||||
|
||||
publicmac=52:54:00:00:00:11
|
||||
|
||||
|
||||
IP=$(curl -s -H 'X-Wit-Auth: true' http://10.0.0.1:4000/get-by-iface/${IFACE} | sed 's/"//g' | awk '{print $2}')
|
||||
|
||||
if [ -z $IP ]; then
|
||||
echo "got nothing back from the API"
|
||||
exit 10
|
||||
fi
|
||||
|
||||
eui64() {
|
||||
local macaddr="$1"
|
||||
printf "%02x%s" $(( 16#${macaddr:0:2} ^ 2#00000010 )) "${macaddr:2}" \
|
||||
| sed -E -e 's/([0-9a-zA-Z]{2})*/0x\0|/g' \
|
||||
| tr -d ':\n' \
|
||||
| xargs -d '|' \
|
||||
printf "fe80::%02x%02x:%02xff:fe%02x:%02x%02x"
|
||||
}
|
||||
|
||||
|
||||
|
||||
ip link set up ${IFACE}
|
||||
arp -i ${IFACE} -Ds 169.254.0.1 ${IFACE} netmask 255.255.255.255 pub
|
||||
|
||||
|
||||
|
||||
IFS=',' read -ra IPS <<< "$IP"
|
||||
for IP in "${IPS[@]}"; do
|
||||
if [[ $IP =~ ^170.199.21[0-9]\.[0-9]{1,3}/([0-9]{2})$ ]]; then ### we got a IPv4 prefix < maxprefixv4
|
||||
|
||||
if [ ${BASH_REMATCH[1]} -lt $maxprefixv4 ]; then
|
||||
echo "we don't support such a big customer net?"
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ ${BASH_REMATCH[1]} -gt 32 ]; then
|
||||
echo "prefix is invalid"
|
||||
continue
|
||||
fi
|
||||
|
||||
echo "we got IPv4 with prefix ${BASH_REMATCH[0]}"
|
||||
ip route add ${IP} dev ${IFACE}
|
||||
|
||||
elif [[ $IP =~ ^2604:bbc0:[0-9,a-f,:]{1,444}/([0-9]{2,3})$ ]]; then ### we got a PIv6 prefix < masprefixv6
|
||||
|
||||
if [ ${BASH_REMATCH[1]} -lt $maxprefixv6 ]; then
|
||||
echo "we don't support such a big customer net?"
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ ${BASH_REMATCH[1]} -gt 128 ]; then
|
||||
echo "prefix is invalid"
|
||||
continue
|
||||
fi
|
||||
|
||||
echo "we got IPv6 with prefix ${BASH_REMATCH[0]}"
|
||||
ip route add ${IP} dev ${IFACE} via $(eui64 $publicmac)
|
||||
|
||||
else ### don't know what we have but something we can't work with
|
||||
echo "Unable to detect with what prefix I'm working with"
|
||||
fi
|
||||
done
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
|
||||
echo lldp stop | /usr/bin/tee /sys/kernel/debug/i40e/*/command
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
nameserver 2001:4860:4860::8888
|
||||
nameserver 2001:4860:4860::8844
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
vrfid=$(ip -o -d link show dev ${interface} 2>/dev/null | egrep ' vrf_slave table [0-9]*' | sed -e 's/.*vrf_slave table \([0-9]*\) .*/\1/')
|
||||
|
||||
if [ "$reason" = "BOUND" ] && [ "$vrfid" != "" ]; then
|
||||
/sbin/ip route flush table $vrfid
|
||||
vrfgateway=$new_routers
|
||||
new_routers=""
|
||||
fi
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
if [ "$reason" = "BOUND" ] && [ "$vrfid" != "" ]; then
|
||||
/sbin/ip route add default via $vrfgateway table $vrfid
|
||||
fi
|
||||
|
|
@ -0,0 +1 @@
|
|||
1001 mgmt
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
#!/bin/bash
|
||||
|
||||
EMPTYBR=$(for br in /sys/devices/virtual/net/br*; do if [ ! -d $br ]; then continue; fi; ls $br/brif/ | grep -qv vxlan || echo ${br##*/br}; done)
|
||||
|
||||
for id in $EMPTYBR
|
||||
do
|
||||
echo "removing unused customer bridge/vxlan id: $id"
|
||||
ip link del dev vxlan$id
|
||||
ip link set down br$id
|
||||
brctl delbr br$id
|
||||
done
|
||||
|
||||
|
||||
|
||||
for route in $(vtysh -c "show ip route kernel" | grep 'unknown inactive' | awk '{ print $3 }')
|
||||
do
|
||||
echo "removing zombie route: $route"
|
||||
ip route add blackhole $route
|
||||
ip route del $route
|
||||
done
|
||||
|
||||
#for route in $(vtysh -c "show ipv6 route kernel" | grep 'unknown inactive' | awk '{ print $3 }')
|
||||
# do
|
||||
# echo "removing zombie route: $route"
|
||||
# ip route add blackhole $route
|
||||
# ip route del $route
|
||||
#done
|
||||
Loading…
Reference in New Issue