From 4c8d882e9125fb45977f74a217e9d716138d6291 Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Tue, 9 Mar 2021 00:39:20 +0800 Subject: nptv6: T2518: Support IPv6 address translation --- data/templates/firewall/nftables-nat66.tmpl | 11 ++++--- interface-definitions/nat66.xml.in | 19 ++++++++++-- smoketest/scripts/cli/test_nat66.py | 34 +++++++++++++++++++-- src/conf_mode/nat66.py | 9 +++--- src/migration-scripts/nat66/1-to-2 | 46 +++++++++++++++++++++++++++++ 5 files changed, 106 insertions(+), 13 deletions(-) create mode 100755 src/migration-scripts/nat66/1-to-2 diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.tmpl index b1a8f7a16..9f5d49ba7 100644 --- a/data/templates/firewall/nftables-nat66.tmpl +++ b/data/templates/firewall/nftables-nat66.tmpl @@ -13,8 +13,14 @@ {% endif %} {% set trns_address = dnat_type + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} {% elif chain == "POSTROUTING" %} +{% if config.translation.address | is_ip_network %} +{# support 1:1 network translation #} +{% set snat_type = "snat prefix to " %} +{% else %} +{% set snat_type = "snat to " %} +{% endif %} {% set interface = " oifname \"" + config.outbound_interface + "\"" if config.outbound_interface is defined else '' %} -{% set trns_prefix = "snat prefix to " + config.translation.prefix if config.translation is defined and config.translation.prefix is defined and config.translation.prefix is not none %} +{% set trns_address = snat_type + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} {% endif %} {% set comment = "NPT-NAT-" + rule %} {% if rule.log %} @@ -35,9 +41,6 @@ {% if dest_address %} {% set output = output + " " + dest_address %} {% endif %} -{% if trns_prefix %} -{% set output = output + " " + trns_prefix %} -{% endif %} {% if trns_address %} {% set output = output + " " + trns_address %} {% endif %} diff --git a/interface-definitions/nat66.xml.in b/interface-definitions/nat66.xml.in index b45ebc0a8..d5e1226f9 100644 --- a/interface-definitions/nat66.xml.in +++ b/interface-definitions/nat66.xml.in @@ -70,18 +70,31 @@ - Translated IPv6 prefix options + Translated IPv6 address options - + - IPv6 prefix to translate to + IPv6 address to translate to + + masquerade + + + ipv6 + IPv6 address + ipv6net IPv6 prefix + + masquerade + NAT to the primary address of outbound-interface + + + (masquerade) diff --git a/smoketest/scripts/cli/test_nat66.py b/smoketest/scripts/cli/test_nat66.py index ccc4196e0..d2cb60025 100755 --- a/smoketest/scripts/cli/test_nat66.py +++ b/smoketest/scripts/cli/test_nat66.py @@ -44,7 +44,7 @@ class TestNAT66(unittest.TestCase): translation_prefix = 'fc01::/64' self.session.set(src_path + ['rule', '1', 'outbound-interface', 'eth1']) self.session.set(src_path + ['rule', '1', 'source', 'prefix', source_prefix]) - self.session.set(src_path + ['rule', '1', 'translation', 'prefix', translation_prefix]) + self.session.set(src_path + ['rule', '1', 'translation', 'address', translation_prefix]) # check validate() - outbound-interface must be defined self.session.commit() @@ -70,6 +70,36 @@ class TestNAT66(unittest.TestCase): self.assertEqual(f'{translation_address}/{translation_mask}', translation_prefix) self.assertEqual(f'{address}/{mask}', source_prefix) + def test_source_nat66_address(self): + source_prefix = 'fc00::/64' + translation_address = 'fc00::1' + self.session.set(src_path + ['rule', '1', 'outbound-interface', 'eth1']) + self.session.set(src_path + ['rule', '1', 'source', 'prefix', source_prefix]) + self.session.set(src_path + ['rule', '1', 'translation', 'address', translation_address]) + + # check validate() - outbound-interface must be defined + self.session.commit() + + tmp = cmd('sudo nft -j list table ip6 nat') + data_json = jmespath.search('nftables[?rule].rule[?chain]', json.loads(tmp)) + + for idx in range(0, len(data_json)): + data = data_json[idx] + + self.assertEqual(data['chain'], 'POSTROUTING') + self.assertEqual(data['family'], 'ip6') + self.assertEqual(data['table'], 'nat') + + iface = dict_search('match.right', data['expr'][0]) + address = dict_search('match.right.prefix.addr', data['expr'][2]) + mask = dict_search('match.right.prefix.len', data['expr'][2]) + snat_address = dict_search('snat.addr', data['expr'][3]) + + self.assertEqual(iface, 'eth1') + # check for translation address + self.assertEqual(snat_address, translation_address) + self.assertEqual(f'{address}/{mask}', source_prefix) + def test_destination_nat66(self): destination_address = 'fc00::1' translation_address = 'fc01::1' @@ -139,7 +169,7 @@ class TestNAT66(unittest.TestCase): with self.assertRaises(ConfigSessionError): self.session.commit() - self.session.set(src_path + ['rule', rule, 'translation', 'prefix', translation_prefix]) + self.session.set(src_path + ['rule', rule, 'translation', 'address', translation_prefix]) self.session.commit() def test_nat66_no_rules(self): diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py index dc3cd550c..ce1db316c 100755 --- a/src/conf_mode/nat66.py +++ b/src/conf_mode/nat66.py @@ -28,6 +28,7 @@ from vyos.util import cmd from vyos.util import check_kmod from vyos.util import dict_search from vyos.template import is_ipv6 +from vyos.template import is_ip_network from vyos.xml import defaults from vyos import ConfigError from vyos import airbag @@ -116,10 +117,10 @@ def verify(nat): if config['outbound_interface'] not in interfaces(): print(f'WARNING: rule "{rule}" interface "{config["outbound_interface"]}" does not exist on this system') - prefix = dict_search('translation.prefix', config) - if prefix != None: - if not is_ipv6(prefix): - raise ConfigError(f'Warning: IPv6 prefix {prefix} is not a valid address prefix') + addr = dict_search('translation.address', config) + if addr != None: + if addr != 'masquerade' and not is_ipv6(addr): + raise ConfigError(f'Warning: IPv6 address {addr} is not a valid address') prefix = dict_search('source.prefix', config) if prefix != None: diff --git a/src/migration-scripts/nat66/1-to-2 b/src/migration-scripts/nat66/1-to-2 new file mode 100755 index 000000000..9c3998ec1 --- /dev/null +++ b/src/migration-scripts/nat66/1-to-2 @@ -0,0 +1,46 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +from sys import argv,exit +from vyos.configtree import ConfigTree + +if (len(argv) < 1): + print("Must specify file name!") + exit(1) + +file_name = argv[1] + +with open(file_name, 'r') as f: + config_file = f.read() + +config = ConfigTree(config_file) + +base = ['nat66', 'source'] + +if not config.exists(base): + # Nothing to do + exit(0) + +for rule in config.list_nodes(base + ['rule']): + rule_base = base + ['rule', rule] + config.rename(rule_base + ['translation', 'prefix'], 'address') + +try: + with open(file_name, 'w') as f: + f.write(config.to_string()) +except OSError as e: + print("Failed to save the modified config: {}".format(e)) + exit(1) -- cgit v1.2.3 From 988be4157422975bec75122e875b722f7c933966 Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Tue, 9 Mar 2021 14:08:38 +0800 Subject: nptv6: T2518: Support masquerade and cancel new migrators --- data/templates/firewall/nftables-nat66.tmpl | 20 ++++++++----- smoketest/scripts/cli/test_nat66.py | 3 +- src/migration-scripts/nat66/0-to-1 | 2 +- src/migration-scripts/nat66/1-to-2 | 46 ----------------------------- 4 files changed, 15 insertions(+), 56 deletions(-) delete mode 100755 src/migration-scripts/nat66/1-to-2 diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.tmpl index 9f5d49ba7..cdaeaad6a 100644 --- a/data/templates/firewall/nftables-nat66.tmpl +++ b/data/templates/firewall/nftables-nat66.tmpl @@ -13,14 +13,20 @@ {% endif %} {% set trns_address = dnat_type + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} {% elif chain == "POSTROUTING" %} -{% if config.translation.address | is_ip_network %} -{# support 1:1 network translation #} -{% set snat_type = "snat prefix to " %} -{% else %} -{% set snat_type = "snat to " %} -{% endif %} +{% if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} +{% if config.translation.address == 'masquerade' %} +{% set trns_address = config.translation.address %} +{% else %} +{% if config.translation.address | is_ip_network %} +{# support 1:1 network translation #} +{% set snat_type = "snat prefix to " %} +{% else %} +{% set snat_type = "snat to " %} +{% endif %} +{% set trns_address = snat_type + config.translation.address %} +{% endif %} +{% endif %} {% set interface = " oifname \"" + config.outbound_interface + "\"" if config.outbound_interface is defined else '' %} -{% set trns_address = snat_type + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} {% endif %} {% set comment = "NPT-NAT-" + rule %} {% if rule.log %} diff --git a/smoketest/scripts/cli/test_nat66.py b/smoketest/scripts/cli/test_nat66.py index d2cb60025..4838fb8d8 100755 --- a/smoketest/scripts/cli/test_nat66.py +++ b/smoketest/scripts/cli/test_nat66.py @@ -157,7 +157,6 @@ class TestNAT66(unittest.TestCase): # T2813: Ensure translation address is specified rule = '5' source_prefix = 'fc00::/64' - translation_prefix = 'fc00:2::/64' self.session.set(src_path + ['rule', rule, 'source', 'prefix', source_prefix]) # check validate() - outbound-interface must be defined @@ -169,7 +168,7 @@ class TestNAT66(unittest.TestCase): with self.assertRaises(ConfigSessionError): self.session.commit() - self.session.set(src_path + ['rule', rule, 'translation', 'address', translation_prefix]) + self.session.set(src_path + ['rule', rule, 'translation', 'address', 'masquerade']) self.session.commit() def test_nat66_no_rules(self): diff --git a/src/migration-scripts/nat66/0-to-1 b/src/migration-scripts/nat66/0-to-1 index 74d64c07b..83b421926 100755 --- a/src/migration-scripts/nat66/0-to-1 +++ b/src/migration-scripts/nat66/0-to-1 @@ -49,7 +49,7 @@ def merge_npt(config,base,rule): if config.exists(base + ['translation','prefix']): tmp = config.return_value(base + ['translation','prefix']) - config.set(merge_base + ['translation','prefix'],value=tmp) + config.set(merge_base + ['translation','address'],value=tmp) if not config.exists(['nat', 'nptv6']): # Nothing to do diff --git a/src/migration-scripts/nat66/1-to-2 b/src/migration-scripts/nat66/1-to-2 deleted file mode 100755 index 9c3998ec1..000000000 --- a/src/migration-scripts/nat66/1-to-2 +++ /dev/null @@ -1,46 +0,0 @@ -#!/usr/bin/env python3 -# -# Copyright (C) 2020 VyOS maintainers and contributors -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . - -from sys import argv,exit -from vyos.configtree import ConfigTree - -if (len(argv) < 1): - print("Must specify file name!") - exit(1) - -file_name = argv[1] - -with open(file_name, 'r') as f: - config_file = f.read() - -config = ConfigTree(config_file) - -base = ['nat66', 'source'] - -if not config.exists(base): - # Nothing to do - exit(0) - -for rule in config.list_nodes(base + ['rule']): - rule_base = base + ['rule', rule] - config.rename(rule_base + ['translation', 'prefix'], 'address') - -try: - with open(file_name, 'w') as f: - f.write(config.to_string()) -except OSError as e: - print("Failed to save the modified config: {}".format(e)) - exit(1) -- cgit v1.2.3