From b047855b80754d78cab4d3161ad0e97c21f479bc Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Mon, 30 Nov 2020 20:03:00 +0800 Subject: nptv6: T2518: Initial support for nat66 (NPT) --- data/templates/firewall/nftables-nat.tmpl | 2 +- data/templates/firewall/nftables-nat66.tmpl | 101 ++++++++++++++++++++++++++++ data/templates/proxy-ndp/ndppd.conf.tmpl | 41 +++++++++++ 3 files changed, 143 insertions(+), 1 deletion(-) create mode 100644 data/templates/firewall/nftables-nat66.tmpl create mode 100644 data/templates/proxy-ndp/ndppd.conf.tmpl (limited to 'data/templates') diff --git a/data/templates/firewall/nftables-nat.tmpl b/data/templates/firewall/nftables-nat.tmpl index 5480447f2..499733225 100644 --- a/data/templates/firewall/nftables-nat.tmpl +++ b/data/templates/firewall/nftables-nat.tmpl @@ -118,7 +118,7 @@ {% endmacro %} # Start with clean NAT table -flush table nat +flush table ip nat {% if helper_functions == 'remove' %} {# NAT if going to be disabled - remove rules and targets from nftables #} {% set base_command = 'delete rule ip raw' %} diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.tmpl new file mode 100644 index 000000000..af533812e --- /dev/null +++ b/data/templates/firewall/nftables-nat66.tmpl @@ -0,0 +1,101 @@ +#!/usr/sbin/nft -f + +{% macro nptv6_rule(rule,config, chain) %} + +{% set src_prefix = "ip6 saddr " + config.source.prefix if config.source is defined and config.source.prefix is defined and config.source.prefix is not none %} +{% set dest_address = "ip6 daddr " + config.destination.address if config.destination is defined and config.destination.address is defined and config.destination.address is not none %} + +{% if chain == "PREROUTING" %} +{% set interface = " iifname \"" + config.inbound_interface + "\"" if config.inbound_interface is defined and config.inbound_interface != 'any' else '' %} +{% set trns_address = "dnat to " + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} +{% elif chain == "POSTROUTING" %} +{% set interface = " oifname \"" + config.outbound_interface + "\"" if config.outbound_interface is defined and config.outbound_interface != 'any' else '' %} +{% set trns_prefix = "snat prefix to " + config.translation.prefix if config.translation is defined and config.translation.prefix is defined and config.translation.prefix is not none %} +{% endif %} +{% set comment = "NPT-NAT-" + rule %} +{% if rule.log %} +{% set base_log = "[NPT-DST-" + rule %} +{% set log = base_log + "]" %} +{% endif %} +{% set output = "add rule ip6 nat " + chain + interface %} +{# Count packets #} +{% set output = output + " counter" %} + +{# Special handling of log option, we must repeat the entire rule before the #} +{# NAT translation options are added, this is essential #} +{% if log %} +{% set log_output = output + " log prefix \"" + log + "\" comment \"" + comment + "\"" %} +{% endif %} + +{% if src_prefix %} +{% set output = output + " " + src_prefix %} +{% endif %} + + +{% if dest_address %} +{% set output = output + " " + dest_address %} +{% endif %} + +{% if trns_prefix %} +{% set output = output + " " + trns_prefix %} +{% endif %} + +{% if trns_address %} +{% set output = output + " " + trns_address %} +{% endif %} + + +{% if comment %} +{% set output = output + " comment \"" + comment + "\"" %} +{% endif %} + +{{ log_output if log_output }} +{{ output }} +{% endmacro %} + +# Start with clean NAT table +flush table ip6 nat + +{% if helper_functions == 'remove' %} +{# NAT if going to be disabled - remove rules and targets from nftables #} + + + +{% set base_command = "delete rule ip6 raw" %} + +{{base_command}} PREROUTING handle {{ pre_ct_conntrack }} +{{base_command}} OUTPUT handle {{ out_ct_conntrack }} + +delete chain ip6 raw NAT_CONNTRACK + +{% elif helper_functions == 'add' %} +{# NAT if enabled - add targets to nftables #} +add chain ip6 raw NAT_CONNTRACK +add rule ip6 raw NAT_CONNTRACK counter accept + +{% set base_command = "add rule ip6 raw" %} + + +{{ base_command }} PREROUTING position {{ pre_ct_conntrack }} counter jump NAT_CONNTRACK +{{ base_command }} OUTPUT position {{ out_ct_conntrack }} counter jump NAT_CONNTRACK + +{% endif %} + +# +# Destination NAT66 rules build up here +# +{% if destination is defined and destination.rule is defined and destination.rule is not none %} +{% for rule, config in destination.rule.items() if config.disable is not defined %} +{{ nptv6_rule(rule, config, 'PREROUTING') }} +{% endfor %} +{% endif %} + +# +# Source NAT66 rules build up here +# +{% if source is defined and source.rule is defined and source.rule is not none %} +{% for rule, config in source.rule.items() if config.disable is not defined %} +{{ nptv6_rule(rule, config, 'POSTROUTING') }} +{% endfor %} +{% endif %} + diff --git a/data/templates/proxy-ndp/ndppd.conf.tmpl b/data/templates/proxy-ndp/ndppd.conf.tmpl new file mode 100644 index 000000000..9bf120b3a --- /dev/null +++ b/data/templates/proxy-ndp/ndppd.conf.tmpl @@ -0,0 +1,41 @@ +######################################################## +# +# autogenerated by nat66.py +# +# The configuration file must define one upstream +# interface. +# +# For some services, such as nat66, because it runs +# stateless, it needs to rely on NDP Proxy to respond +# to NDP requests. +# +# When using nat66 source rules, NDP Proxy needs +# to be enabled +# +######################################################## + + +{% for i in interface %} + +{%- if not interface[i].disable %} + +proxy {{ i }} { + router {{ interface[i].router }} + timeout {{ interface[i].timeout }} + ttl {{ interface[i].ttl }} +{% for p in interface[i].prefix %} + rule {{ p }} { +{% if interface[i].prefix[p].mode == 'auto' %} + auto +{% elif interface[i].prefix[p].mode == 'static' %} + static +{% elif interface[i].prefix[p].mode == 'iface' and interface[i].prefix[p].iface %} + iface {{ interface[i].prefix[p].iface }} +{% endif %} + } +{%- endfor %} +} + +{%- endif %} + +{% endfor %} -- cgit v1.2.3 From af6a647bfecbc601b5c5dd7077f496b933228fce Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Sun, 17 Jan 2021 18:58:36 +0800 Subject: nptv6: T2518: Improved template generation --- data/templates/proxy-ndp/ndppd.conf.tmpl | 51 ++++++++++++----- smoketest/scripts/cli/test_nat66.py | 96 +++++++++++++++++++++++++++----- src/conf_mode/nat66.py | 65 +++------------------ 3 files changed, 125 insertions(+), 87 deletions(-) (limited to 'data/templates') diff --git a/data/templates/proxy-ndp/ndppd.conf.tmpl b/data/templates/proxy-ndp/ndppd.conf.tmpl index 9bf120b3a..a73f25a85 100644 --- a/data/templates/proxy-ndp/ndppd.conf.tmpl +++ b/data/templates/proxy-ndp/ndppd.conf.tmpl @@ -14,28 +14,49 @@ # ######################################################## +{% set global = namespace(ndppd_interfaces = [],ndppd_prefixs = []) %} -{% for i in interface %} -{%- if not interface[i].disable %} +{% if source is defined and source.rule is defined and source.rule is not none %} +{% for rule, config in source.rule.items() if config.disable is not defined %} +{% if config.outbound_interface is defined %} +{% if config.outbound_interface not in global.ndppd_interfaces %} +{% set global.ndppd_interfaces = global.ndppd_interfaces + [config.outbound_interface] %} +{% endif %} +{% if config.translation.prefix is defined %} +{% set global.ndppd_prefixs = global.ndppd_prefixs + [{'interface':config.outbound_interface,'rule':config.translation.prefix}] %} +{% endif %} +{% endif %} +{% endfor %} +{% endif %} + +{% if destination is defined and destination.rule is defined and destination.rule is not none %} +{% for rule, config in destination.rule.items() if config.disable is not defined %} +{% if config.inbound_interface is defined %} +{% if config.inbound_interface not in global.ndppd_interfaces %} +{% set global.ndppd_interfaces = global.ndppd_interfaces + [config.inbound_interface] %} +{% endif %} +{% if config.translation.address is defined %} +{% set global.ndppd_prefixs = global.ndppd_prefixs + [{'interface':config.inbound_interface,'rule':config.translation.address}] %} +{% endif %} +{% endif %} +{% endfor %} +{% endif %} + +{% for i in global.ndppd_interfaces %} proxy {{ i }} { - router {{ interface[i].router }} - timeout {{ interface[i].timeout }} - ttl {{ interface[i].ttl }} -{% for p in interface[i].prefix %} + router yes + timeout 500 + ttl 30000 +{% for map in global.ndppd_prefixs %} +{% if map['interface'] == i %} +{% set p = map['rule'] %} rule {{ p }} { -{% if interface[i].prefix[p].mode == 'auto' %} - auto -{% elif interface[i].prefix[p].mode == 'static' %} static -{% elif interface[i].prefix[p].mode == 'iface' and interface[i].prefix[p].iface %} - iface {{ interface[i].prefix[p].iface }} -{% endif %} } -{%- endfor %} +{% endif %} +{% endfor %} } -{%- endif %} - {% endfor %} diff --git a/smoketest/scripts/cli/test_nat66.py b/smoketest/scripts/cli/test_nat66.py index c1514270d..f94f77b60 100755 --- a/smoketest/scripts/cli/test_nat66.py +++ b/smoketest/scripts/cli/test_nat66.py @@ -20,10 +20,13 @@ import json import unittest from vyos.configsession import ConfigSession +from vyos.configsession import ConfigSessionError from vyos.util import cmd +from vyos.util import dict_search base_path = ['nat66'] -snat_pattern = 'nftables[?rule].rule[?chain].{chain: chain, comment: comment, prefix: { network: expr[].match.right.prefix.addr | [0], prefix: expr[].match.right.prefix.len | [0]},saddr: {network: expr[].snat.addr.prefix.addr | [0], prefix: expr[].snat.addr.prefix.len | [0]}}' +src_path = base_path + ['source'] +dst_path = base_path + ['destination'] class TestNAT66(unittest.TestCase): def setUp(self): @@ -37,26 +40,91 @@ class TestNAT66(unittest.TestCase): self.session.commit() def test_source_nat66(self): + source_prefix = 'fc00::/64' + translation_prefix = 'fc01::/64' + self.session.set(src_path + ['rule', '1', 'outbound-interface', 'eth1']) + self.session.set(src_path + ['rule', '1', 'source', 'prefix', source_prefix]) + self.session.set(src_path + ['rule', '1', 'translation', 'prefix', translation_prefix]) + + # check validate() - outbound-interface must be defined + self.session.commit() + + tmp = cmd('sudo nft -j list table ip6 nat') + data_json = jmespath.search('nftables[?rule].rule[?chain]', json.loads(tmp)) + + for idx in range(0, len(data_json)): + data = data_json[idx] + + self.assertEqual(data['chain'], 'POSTROUTING') + self.assertEqual(data['family'], 'ip6') + self.assertEqual(data['table'], 'nat') + + iface = dict_search('match.right', data['expr'][0]) + address = dict_search('match.right.prefix.addr', data['expr'][2]) + mask = dict_search('match.right.prefix.len', data['expr'][2]) + translation_address = dict_search('snat.addr.prefix.addr', data['expr'][3]) + translation_mask = dict_search('snat.addr.prefix.len', data['expr'][3]) + + self.assertEqual(iface, 'eth1') + # check for translation address + self.assertEqual(f'{translation_address}/{translation_mask}', translation_prefix) + + self.assertEqual(f'{address}/{mask}', source_prefix) + + def test_destination_nat66(self): + source_address = 'fc00::1' + translation_address = 'fc01::1' + self.session.set(dst_path + ['rule', '1', 'inbound-interface', 'eth1']) + self.session.set(dst_path + ['rule', '1', 'destination', 'address', source_address]) + self.session.set(dst_path + ['rule', '1', 'translation', 'address', translation_address]) + + # check validate() - outbound-interface must be defined + self.session.commit() + + tmp = cmd('sudo nft -j list table ip6 nat') + data_json = jmespath.search('nftables[?rule].rule[?chain]', json.loads(tmp)) + + for idx in range(0, len(data_json)): + data = data_json[idx] + + self.assertEqual(data['chain'], 'PREROUTING') + self.assertEqual(data['family'], 'ip6') + self.assertEqual(data['table'], 'nat') - path = base_path + ['source'] + iface = dict_search('match.right', data['expr'][0]) + dnat_addr = dict_search('dnat.addr', data['expr'][3]) + + self.assertEqual(dnat_addr, translation_address) + self.assertEqual(iface, 'eth1') + + def test_snat_required_translation_prefix(self): + # T2813: Ensure translation address is specified + rule = '5' source_prefix = 'fc00::/64' translation_prefix = 'fc00:2::/64' - self.session.set(path + ['rule', '1', 'outbound-interface', 'eth1']) - self.session.set(path + ['rule', '1', 'source', 'prefix', source_prefix]) - self.session.set(path + ['rule', '1', 'translation', 'prefix', translation_prefix]) + self.session.set(src_path + ['rule', rule, 'source', 'prefix', source_prefix]) # check validate() - outbound-interface must be defined + with self.assertRaises(ConfigSessionError): + self.session.commit() + self.session.set(src_path + ['rule', rule, 'outbound-interface', 'eth0']) + + # check validate() - translation address not specified + with self.assertRaises(ConfigSessionError): + self.session.commit() + + self.session.set(src_path + ['rule', rule, 'translation', 'prefix', translation_prefix]) self.session.commit() - tmp = cmd('sudo nft -j list table ip6 nat') - nftable_json = json.loads(tmp) - condensed_json = jmespath.search(snat_pattern, nftable_json)[0] - - self.assertEqual(condensed_json['comment'], 'NPT-NAT-1') - self.assertEqual(condensed_json['prefix']['network'], source_prefix.split('/')[0]) - self.assertEqual(str(condensed_json['prefix']['prefix']), source_prefix.split('/')[1]) - self.assertEqual(condensed_json['saddr']['network'], translation_prefix.split('/')[0]) - self.assertEqual(str(condensed_json['saddr']['prefix']), translation_prefix.split('/')[1]) + def test_nat66_no_rules(self): + # T3206: deleting all rules but keep the direction 'destination' or + # 'source' resulteds in KeyError: 'rule'. + # + # Test that both 'nat destination' and 'nat source' nodes can exist + # without any rule + self.session.set(src_path) + self.session.set(dst_path) + self.session.commit() if __name__ == '__main__': unittest.main(verbosity=2) diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py index fdfffe335..69373c054 100755 --- a/src/conf_mode/nat66.py +++ b/src/conf_mode/nat66.py @@ -65,9 +65,10 @@ def get_config(config=None): for direction in ['source', 'destination']: if direction in nat: default_values = defaults(base + [direction, 'rule']) - for rule in nat[direction]['rule']: - nat[direction]['rule'][rule] = dict_merge(default_values, - nat[direction]['rule'][rule]) + if 'rule' in nat[direction]: + for rule in nat[direction]['rule']: + nat[direction]['rule'][rule] = dict_merge(default_values, + nat[direction]['rule'][rule]) # read in current nftable (once) for further processing tmp = cmd('nft -j list table ip6 raw') @@ -144,60 +145,9 @@ def verify(nat): return None -def nat66_conf_to_ndp_proxy_conf(nat): - ndpproxy = { - 'interface': {} - } - if not nat or 'deleted' in nat: - # no need to verify the CLI as NAT66 is going to be deactivated - return None - # Detect and convert the default configuration of the configured interface - source_rule = dict_search('source.rule', nat) - if source_rule: - for rule,config in source_rule.items(): - interface_ndp = { - 'router': 'yes', - 'timeout': 500, - 'ttl': 30000, - 'prefix': {} - } - if config['outbound_interface'] not in ndpproxy['interface']: - ndpproxy['interface'].update({config['outbound_interface']: interface_ndp}) - for rule,config in source_rule.items(): - if config['outbound_interface'] in ndpproxy['interface']: - prefix = dict_search('translation.prefix', config) - if prefix: - nat66_prefix = config['translation']['prefix'] - if nat66_prefix not in ndpproxy['interface'][config['outbound_interface']]['prefix']: - ndpproxy['interface'][config['outbound_interface']]['prefix'].update({nat66_prefix: {'mode':'auto'}}) - - # Detect and convert the default configuration of the configured interface - destination_rule = dict_search('destination.rule', nat) - if destination_rule: - for rule,config in destination_rule.items(): - interface_ndp = { - 'router': 'yes', - 'timeout': 500, - 'ttl': 30000, - 'prefix': {} - } - if config['inbound_interface'] not in ndpproxy['interface']: - ndpproxy['interface'].update({config['inbound_interface']: interface_ndp}) - for rule,config in destination_rule.items(): - if rule['interface'] in ndpproxy['interface']: - prefix = dict_search('destination.address', config) - if prefix: - nat66_address = config['destination']['address'] - if nat66_prefix not in ndpproxy['interface'][config['inbound_interface']]['prefix']: - ndpproxy['interface'][config['inbound_interface']]['prefix'].update({nat66_prefix: {'mode':'auto'}}) - - return ndpproxy - -def generate(nat,ndp_proxy): +def generate(nat): render(iptables_nat_config, 'firewall/nftables-nat66.tmpl', nat, permission=0o755) - if ndp_proxy == None: - return None - render(ndppd_config, 'proxy-ndp/ndppd.conf.tmpl', ndp_proxy, permission=0o755) + render(ndppd_config, 'proxy-ndp/ndppd.conf.tmpl', nat, permission=0o755) return None def apply(nat): @@ -213,8 +163,7 @@ if __name__ == '__main__': check_kmod(k_mod) c = get_config() verify(c) - ndp_proxy = nat66_conf_to_ndp_proxy_conf(c) - generate(c,ndp_proxy) + generate(c) apply(c) except ConfigError as e: print(e) -- cgit v1.2.3 From 35e89dcc0311514c0388b7ccab51b379113bf104 Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Wed, 20 Jan 2021 16:38:36 +0800 Subject: nptv6: T2518: Support many to many DNPT(DNAT66) --- data/templates/firewall/nftables-nat66.tmpl | 8 ++++++- interface-definitions/nat66.xml.in | 14 ++++++++++-- smoketest/scripts/cli/test_nat66.py | 33 ++++++++++++++++++++++++++--- 3 files changed, 49 insertions(+), 6 deletions(-) (limited to 'data/templates') diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.tmpl index af533812e..1a739cbe2 100644 --- a/data/templates/firewall/nftables-nat66.tmpl +++ b/data/templates/firewall/nftables-nat66.tmpl @@ -7,7 +7,13 @@ {% if chain == "PREROUTING" %} {% set interface = " iifname \"" + config.inbound_interface + "\"" if config.inbound_interface is defined and config.inbound_interface != 'any' else '' %} -{% set trns_address = "dnat to " + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} +{% if config.translation.address | is_ip_network %} +{# support 1:1 network translation #} +{% set dnat_type = "dnat prefix to " %} +{% else %} +{% set dnat_type = "dnat to " %} +{% endif %} +{% set trns_address = dnat_type + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} {% elif chain == "POSTROUTING" %} {% set interface = " oifname \"" + config.outbound_interface + "\"" if config.outbound_interface is defined and config.outbound_interface != 'any' else '' %} {% set trns_prefix = "snat prefix to " + config.translation.prefix if config.translation is defined and config.translation.prefix is defined and config.translation.prefix is not none %} diff --git a/interface-definitions/nat66.xml.in b/interface-definitions/nat66.xml.in index b8e8a8859..36b55f658 100644 --- a/interface-definitions/nat66.xml.in +++ b/interface-definitions/nat66.xml.in @@ -141,13 +141,18 @@ - IPv6 address to be translated + IPv6 address or prefix to be translated ipv6 IPv6 address + + ipv6net + IPv6 prefix + + @@ -160,13 +165,18 @@ - IPv6 address to translate to + IPv6 address or prefix to translate to ipv6 IPv6 address + + ipv6net + IPv6 prefix + + diff --git a/smoketest/scripts/cli/test_nat66.py b/smoketest/scripts/cli/test_nat66.py index f94f77b60..042c61ace 100755 --- a/smoketest/scripts/cli/test_nat66.py +++ b/smoketest/scripts/cli/test_nat66.py @@ -72,10 +72,10 @@ class TestNAT66(unittest.TestCase): self.assertEqual(f'{address}/{mask}', source_prefix) def test_destination_nat66(self): - source_address = 'fc00::1' + destination_address = 'fc00::1' translation_address = 'fc01::1' self.session.set(dst_path + ['rule', '1', 'inbound-interface', 'eth1']) - self.session.set(dst_path + ['rule', '1', 'destination', 'address', source_address]) + self.session.set(dst_path + ['rule', '1', 'destination', 'address', destination_address]) self.session.set(dst_path + ['rule', '1', 'translation', 'address', translation_address]) # check validate() - outbound-interface must be defined @@ -96,8 +96,35 @@ class TestNAT66(unittest.TestCase): self.assertEqual(dnat_addr, translation_address) self.assertEqual(iface, 'eth1') + + def test_destination_nat66_prefix(self): + destination_prefix = 'fc00::/64' + translation_prefix = 'fc01::/64' + self.session.set(dst_path + ['rule', '1', 'inbound-interface', 'eth1']) + self.session.set(dst_path + ['rule', '1', 'destination', 'address', destination_prefix]) + self.session.set(dst_path + ['rule', '1', 'translation', 'address', translation_prefix]) + + # check validate() - outbound-interface must be defined + self.session.commit() + + tmp = cmd('sudo nft -j list table ip6 nat') + data_json = jmespath.search('nftables[?rule].rule[?chain]', json.loads(tmp)) + + for idx in range(0, len(data_json)): + data = data_json[idx] + + self.assertEqual(data['chain'], 'PREROUTING') + self.assertEqual(data['family'], 'ip6') + self.assertEqual(data['table'], 'nat') + + iface = dict_search('match.right', data['expr'][0]) + translation_address = dict_search('dnat.addr.prefix.addr', data['expr'][3]) + translation_mask = dict_search('dnat.addr.prefix.len', data['expr'][3]) + + self.assertEqual(f'{translation_address}/{translation_mask}', translation_prefix) + self.assertEqual(iface, 'eth1') - def test_snat_required_translation_prefix(self): + def test_source_nat66_required_translation_prefix(self): # T2813: Ensure translation address is specified rule = '5' source_prefix = 'fc00::/64' -- cgit v1.2.3 From f58a41bccecd6765eb9bc376809197fd2fb36b0c Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Thu, 21 Jan 2021 01:20:02 +0800 Subject: nptv6: T2518: DNPT does not need NDP agent --- data/templates/proxy-ndp/ndppd.conf.tmpl | 13 ------------- 1 file changed, 13 deletions(-) (limited to 'data/templates') diff --git a/data/templates/proxy-ndp/ndppd.conf.tmpl b/data/templates/proxy-ndp/ndppd.conf.tmpl index a73f25a85..f9485a1cb 100644 --- a/data/templates/proxy-ndp/ndppd.conf.tmpl +++ b/data/templates/proxy-ndp/ndppd.conf.tmpl @@ -30,19 +30,6 @@ {% endfor %} {% endif %} -{% if destination is defined and destination.rule is defined and destination.rule is not none %} -{% for rule, config in destination.rule.items() if config.disable is not defined %} -{% if config.inbound_interface is defined %} -{% if config.inbound_interface not in global.ndppd_interfaces %} -{% set global.ndppd_interfaces = global.ndppd_interfaces + [config.inbound_interface] %} -{% endif %} -{% if config.translation.address is defined %} -{% set global.ndppd_prefixs = global.ndppd_prefixs + [{'interface':config.inbound_interface,'rule':config.translation.address}] %} -{% endif %} -{% endif %} -{% endfor %} -{% endif %} - {% for i in global.ndppd_interfaces %} proxy {{ i }} { -- cgit v1.2.3 From 01e1759d16afbc9f95b64da76eee97fc06729dc8 Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Thu, 21 Jan 2021 01:25:43 +0800 Subject: nptv6: T2518: outbound_interface cannot be any, inbound_interface can be any --- data/templates/firewall/nftables-nat66.tmpl | 2 +- interface-definitions/nat66.xml.in | 1 + src/conf_mode/nat66.py | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) (limited to 'data/templates') diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.tmpl index 1a739cbe2..80150c7a4 100644 --- a/data/templates/firewall/nftables-nat66.tmpl +++ b/data/templates/firewall/nftables-nat66.tmpl @@ -15,7 +15,7 @@ {% endif %} {% set trns_address = dnat_type + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %} {% elif chain == "POSTROUTING" %} -{% set interface = " oifname \"" + config.outbound_interface + "\"" if config.outbound_interface is defined and config.outbound_interface != 'any' else '' %} +{% set interface = " oifname \"" + config.outbound_interface + "\"" if config.outbound_interface is defined else '' %} {% set trns_prefix = "snat prefix to " + config.translation.prefix if config.translation is defined and config.translation.prefix is defined and config.translation.prefix is not none %} {% endif %} {% set comment = "NPT-NAT-" + rule %} diff --git a/interface-definitions/nat66.xml.in b/interface-definitions/nat66.xml.in index 36b55f658..b56a76b4c 100644 --- a/interface-definitions/nat66.xml.in +++ b/interface-definitions/nat66.xml.in @@ -130,6 +130,7 @@ Inbound interface of NAT traffic + any diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py index 69373c054..a5c74259f 100755 --- a/src/conf_mode/nat66.py +++ b/src/conf_mode/nat66.py @@ -117,7 +117,7 @@ def verify(nat): raise ConfigError(f'{err_msg}\n' \ 'outbound-interface not specified') else: - if config['outbound_interface'] not in 'any' and config['outbound_interface'] not in interfaces(): + if config['outbound_interface'] not in interfaces(): print(f'WARNING: rule "{rule}" interface "{config["outbound_interface"]}" does not exist on this system') -- cgit v1.2.3 From d05593e68ff0978c278b13a42f246edcfad3902d Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Fri, 22 Jan 2021 13:16:55 +0800 Subject: nptv6: T2518: Optimized implementation --- data/templates/proxy-ndp/ndppd.conf.tmpl | 4 ++-- src/conf_mode/nat66.py | 14 ++++++++++---- src/systemd/ndppd.service | 6 +++--- 3 files changed, 15 insertions(+), 9 deletions(-) (limited to 'data/templates') diff --git a/data/templates/proxy-ndp/ndppd.conf.tmpl b/data/templates/proxy-ndp/ndppd.conf.tmpl index f9485a1cb..6ef9f3f8b 100644 --- a/data/templates/proxy-ndp/ndppd.conf.tmpl +++ b/data/templates/proxy-ndp/ndppd.conf.tmpl @@ -37,8 +37,8 @@ proxy {{ i }} { timeout 500 ttl 30000 {% for map in global.ndppd_prefixs %} -{% if map['interface'] == i %} -{% set p = map['rule'] %} +{% if map.interface == i %} +{% set p = map.rule %} rule {{ p }} { static } diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py index a5c74259f..7190961e8 100755 --- a/src/conf_mode/nat66.py +++ b/src/conf_mode/nat66.py @@ -151,10 +151,16 @@ def generate(nat): return None def apply(nat): - cmd(f'{iptables_nat_config}') - cmd('systemctl restart ndppd') - if os.path.isfile(iptables_nat_config): - os.unlink(iptables_nat_config) + if not nat: + return None + else: + cmd(f'{iptables_nat_config}') + if 'deleted' in nat or not dict_search('source.rule', nat): + cmd('systemctl stop ndppd') + else: + cmd('systemctl restart ndppd') + if os.path.isfile(iptables_nat_config): + os.unlink(iptables_nat_config) return None diff --git a/src/systemd/ndppd.service b/src/systemd/ndppd.service index 566172fb0..db471c518 100644 --- a/src/systemd/ndppd.service +++ b/src/systemd/ndppd.service @@ -1,13 +1,13 @@ [Unit] Description=NDP Proxy Daemon -After=network.target vyos-router.service +After=vyos-router.service ConditionPathExists=/run/ndppd/ndppd.conf StartLimitIntervalSec=0 [Service] -ExecStart=/usr/sbin/ndppd -d -p /var/run/ndppd/ndppd.pid -c /var/run/ndppd/ndppd.conf +ExecStart=/usr/sbin/ndppd -d -p /run/ndppd/ndppd.pid -c /run/ndppd/ndppd.conf Type=forking -PIDFile=/var/run/ndppd/ndppd.pid +PIDFile=/run/ndppd/ndppd.pid Restart=on-failure RestartSec=20 -- cgit v1.2.3 From c7a967b2d9c83fe4825d1ca672a9aa15615c5a99 Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Sat, 23 Jan 2021 17:19:53 +0800 Subject: nptv6: T2518: Remove trailing spaces --- data/templates/firewall/nftables-nat66.tmpl | 1 - data/templates/proxy-ndp/ndppd.conf.tmpl | 1 - src/migration-scripts/nat66/0-to-1 | 1 - 3 files changed, 3 deletions(-) (limited to 'data/templates') diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.tmpl index 80150c7a4..45506ca09 100644 --- a/data/templates/firewall/nftables-nat66.tmpl +++ b/data/templates/firewall/nftables-nat66.tmpl @@ -104,4 +104,3 @@ add rule ip6 raw NAT_CONNTRACK counter accept {{ nptv6_rule(rule, config, 'POSTROUTING') }} {% endfor %} {% endif %} - diff --git a/data/templates/proxy-ndp/ndppd.conf.tmpl b/data/templates/proxy-ndp/ndppd.conf.tmpl index 6ef9f3f8b..844b644b7 100644 --- a/data/templates/proxy-ndp/ndppd.conf.tmpl +++ b/data/templates/proxy-ndp/ndppd.conf.tmpl @@ -45,5 +45,4 @@ proxy {{ i }} { {% endif %} {% endfor %} } - {% endfor %} diff --git a/src/migration-scripts/nat66/0-to-1 b/src/migration-scripts/nat66/0-to-1 index 67024cf77..602c5f5c1 100755 --- a/src/migration-scripts/nat66/0-to-1 +++ b/src/migration-scripts/nat66/0-to-1 @@ -70,4 +70,3 @@ try: except OSError as e: print("Failed to save the modified config: {}".format(e)) exit(1) - -- cgit v1.2.3 From af91cdbf23157f7b6b7696de9bc27dafca6d7dee Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Sat, 23 Jan 2021 21:44:44 +0800 Subject: nptv6: T2518: Use better variable names --- data/templates/proxy-ndp/ndppd.conf.tmpl | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) (limited to 'data/templates') diff --git a/data/templates/proxy-ndp/ndppd.conf.tmpl b/data/templates/proxy-ndp/ndppd.conf.tmpl index 844b644b7..4393be169 100644 --- a/data/templates/proxy-ndp/ndppd.conf.tmpl +++ b/data/templates/proxy-ndp/ndppd.conf.tmpl @@ -30,16 +30,15 @@ {% endfor %} {% endif %} -{% for i in global.ndppd_interfaces %} +{% for interface in global.ndppd_interfaces %} -proxy {{ i }} { +proxy {{ interface }} { router yes timeout 500 ttl 30000 {% for map in global.ndppd_prefixs %} -{% if map.interface == i %} -{% set p = map.rule %} - rule {{ p }} { +{% if map.interface == interface %} + rule {{ map.rule }} { static } {% endif %} -- cgit v1.2.3 From 41b4f00972917ea950842d53eaede0a4308bc663 Mon Sep 17 00:00:00 2001 From: jack9603301 Date: Sun, 24 Jan 2021 13:18:24 +0800 Subject: nptv6: T2518: Delete redundant blank lines --- data/templates/firewall/nftables-nat66.tmpl | 21 --------------------- data/templates/proxy-ndp/ndppd.conf.tmpl | 3 --- smoketest/scripts/cli/test_nat66.py | 1 - src/conf_mode/nat66.py | 9 ++------- src/migration-scripts/nat66/0-to-1 | 1 - 5 files changed, 2 insertions(+), 33 deletions(-) (limited to 'data/templates') diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.tmpl index 45506ca09..b1a8f7a16 100644 --- a/data/templates/firewall/nftables-nat66.tmpl +++ b/data/templates/firewall/nftables-nat66.tmpl @@ -1,10 +1,8 @@ #!/usr/sbin/nft -f {% macro nptv6_rule(rule,config, chain) %} - {% set src_prefix = "ip6 saddr " + config.source.prefix if config.source is defined and config.source.prefix is defined and config.source.prefix is not none %} {% set dest_address = "ip6 daddr " + config.destination.address if config.destination is defined and config.destination.address is defined and config.destination.address is not none %} - {% if chain == "PREROUTING" %} {% set interface = " iifname \"" + config.inbound_interface + "\"" if config.inbound_interface is defined and config.inbound_interface != 'any' else '' %} {% if config.translation.address | is_ip_network %} @@ -26,49 +24,35 @@ {% set output = "add rule ip6 nat " + chain + interface %} {# Count packets #} {% set output = output + " counter" %} - {# Special handling of log option, we must repeat the entire rule before the #} {# NAT translation options are added, this is essential #} {% if log %} {% set log_output = output + " log prefix \"" + log + "\" comment \"" + comment + "\"" %} {% endif %} - {% if src_prefix %} {% set output = output + " " + src_prefix %} {% endif %} - - {% if dest_address %} {% set output = output + " " + dest_address %} {% endif %} - {% if trns_prefix %} {% set output = output + " " + trns_prefix %} {% endif %} - {% if trns_address %} {% set output = output + " " + trns_address %} {% endif %} - - {% if comment %} {% set output = output + " comment \"" + comment + "\"" %} {% endif %} - {{ log_output if log_output }} {{ output }} {% endmacro %} # Start with clean NAT table flush table ip6 nat - {% if helper_functions == 'remove' %} {# NAT if going to be disabled - remove rules and targets from nftables #} - - - {% set base_command = "delete rule ip6 raw" %} - {{base_command}} PREROUTING handle {{ pre_ct_conntrack }} {{base_command}} OUTPUT handle {{ out_ct_conntrack }} @@ -78,13 +62,9 @@ delete chain ip6 raw NAT_CONNTRACK {# NAT if enabled - add targets to nftables #} add chain ip6 raw NAT_CONNTRACK add rule ip6 raw NAT_CONNTRACK counter accept - {% set base_command = "add rule ip6 raw" %} - - {{ base_command }} PREROUTING position {{ pre_ct_conntrack }} counter jump NAT_CONNTRACK {{ base_command }} OUTPUT position {{ out_ct_conntrack }} counter jump NAT_CONNTRACK - {% endif %} # @@ -95,7 +75,6 @@ add rule ip6 raw NAT_CONNTRACK counter accept {{ nptv6_rule(rule, config, 'PREROUTING') }} {% endfor %} {% endif %} - # # Source NAT66 rules build up here # diff --git a/data/templates/proxy-ndp/ndppd.conf.tmpl b/data/templates/proxy-ndp/ndppd.conf.tmpl index 4393be169..0137d8135 100644 --- a/data/templates/proxy-ndp/ndppd.conf.tmpl +++ b/data/templates/proxy-ndp/ndppd.conf.tmpl @@ -15,8 +15,6 @@ ######################################################## {% set global = namespace(ndppd_interfaces = [],ndppd_prefixs = []) %} - - {% if source is defined and source.rule is defined and source.rule is not none %} {% for rule, config in source.rule.items() if config.disable is not defined %} {% if config.outbound_interface is defined %} @@ -31,7 +29,6 @@ {% endif %} {% for interface in global.ndppd_interfaces %} - proxy {{ interface }} { router yes timeout 500 diff --git a/smoketest/scripts/cli/test_nat66.py b/smoketest/scripts/cli/test_nat66.py index 042c61ace..ccc4196e0 100755 --- a/smoketest/scripts/cli/test_nat66.py +++ b/smoketest/scripts/cli/test_nat66.py @@ -68,7 +68,6 @@ class TestNAT66(unittest.TestCase): self.assertEqual(iface, 'eth1') # check for translation address self.assertEqual(f'{translation_address}/{translation_mask}', translation_prefix) - self.assertEqual(f'{address}/{mask}', source_prefix) def test_destination_nat66(self): diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py index f58db04e0..b90939a2f 100755 --- a/src/conf_mode/nat66.py +++ b/src/conf_mode/nat66.py @@ -80,19 +80,16 @@ def get_config(config=None): if not conf.exists(base): nat['helper_functions'] = 'remove' - nat['pre_ct_conntrack'] = get_handler(condensed_json, 'PREROUTING', 'NAT_CONNTRACK') nat['out_ct_conntrack'] = get_handler(condensed_json, 'OUTPUT','NAT_CONNTRACK') - nat['deleted'] = '' - return nat # check if NAT66 connection tracking helpers need to be set up - this has to # be done only once if not get_handler(condensed_json, 'PREROUTING', 'NAT_CONNTRACK'): nat['helper_functions'] = 'add' - + # Retrieve current table handler positions nat['pre_ct_conntrack'] = get_handler(condensed_json, 'PREROUTING', 'VYATTA_CT_PREROUTING_HOOK') nat['out_ct_conntrack'] = get_handler(condensed_json, 'OUTPUT','VYATTA_CT_OUTPUT_HOOK') @@ -120,18 +117,16 @@ def verify(nat): if config['outbound_interface'] not in interfaces(): print(f'WARNING: rule "{rule}" interface "{config["outbound_interface"]}" does not exist on this system') - prefix = dict_search('translation.prefix', config) if prefix != None: if not is_ipv6(prefix): raise ConfigError(f'Warning: IPv6 prefix {prefix} is not a valid address prefix') - + prefix = dict_search('source.prefix', config) if prefix != None: if not is_ipv6(prefix): raise ConfigError(f'{err_msg} source-prefix not specified') - if dict_search('destination.rule', nat): for rule, config in dict_search('destination.rule', nat).items(): err_msg = f'Destination NAT66 configuration error in rule {rule}:' diff --git a/src/migration-scripts/nat66/0-to-1 b/src/migration-scripts/nat66/0-to-1 index 602c5f5c1..74d64c07b 100755 --- a/src/migration-scripts/nat66/0-to-1 +++ b/src/migration-scripts/nat66/0-to-1 @@ -51,7 +51,6 @@ def merge_npt(config,base,rule): tmp = config.return_value(base + ['translation','prefix']) config.set(merge_base + ['translation','prefix'],value=tmp) - if not config.exists(['nat', 'nptv6']): # Nothing to do exit(0) -- cgit v1.2.3