From cad1a9f46b032d18c4481b70ab5cbf7b04546733 Mon Sep 17 00:00:00 2001 From: GnomeZworc Date: Sat, 11 Apr 2026 23:27:07 +0200 Subject: [PATCH] f-15: ia: first subnet try Signed-off-by: GnomeZworc --- cmd/subnet/main.go | 93 +++++++++++++++++ internal/netif/addr.go | 21 ++++ internal/netif/route_linux.go | 21 ++++ internal/netif/route_other.go | 9 ++ internal/netif/vxlan.go | 20 ++++ internal/subnet/create.go | 186 ++++++++++++++++++++++++++++++++++ internal/subnet/delete.go | 95 +++++++++++++++++ 7 files changed, 445 insertions(+) create mode 100644 cmd/subnet/main.go create mode 100644 internal/netif/addr.go create mode 100644 internal/netif/route_linux.go create mode 100644 internal/netif/route_other.go create mode 100644 internal/netif/vxlan.go create mode 100644 internal/subnet/create.go create mode 100644 internal/subnet/delete.go diff --git a/cmd/subnet/main.go b/cmd/subnet/main.go new file mode 100644 index 0000000..05ecd47 --- /dev/null +++ b/cmd/subnet/main.go @@ -0,0 +1,93 @@ +package main + +import ( + "flag" + "fmt" + "os" + + configuration "git.g3e.fr/syonad/two/internal/config/agent" + "git.g3e.fr/syonad/two/internal/subnet" + "git.g3e.fr/syonad/two/pkg/db/kv" + + "github.com/dgraph-io/badger/v4" +) + +var ( + name = flag.String("name", "", "Subnet name (ex: sn-00001)") + vpcName = flag.String("vpc", "", "VPC name") + vxlanID = flag.String("vxlan-id", "", "VXLAN ID") + localIP = flag.String("local-ip", "", "Local VTEP IP") + gatewayIP = flag.String("gateway-ip", "", "Gateway IP") + cidr = flag.String("cidr", "", "Subnet CIDR (ex: 10.10.10.0/24)") + action = flag.String("action", "", "Action à effectuer") + conf_file = flag.String("conf", "/etc/two/agent.yml", "Configuration file") +) + +var DB *badger.DB + +func main() { + flag.Parse() + + conf, err := configuration.LoadConfig(*conf_file) + if err != nil { + fmt.Println(err) + os.Exit(1) + } + + DB = kv.InitDB(kv.Config{ + Path: conf.Database.Path, + }, false) + defer DB.Close() + + switch *action { + case "create": + if *name == "" || *vpcName == "" || *vxlanID == "" || *localIP == "" || *gatewayIP == "" || *cidr == "" { + fmt.Println("create requires: -name -vpc -vxlan-id -local-ip -gateway-ip -cidr") + os.Exit(1) + } + kv.AddInDB(DB, "subnet/"+*name+"/state", "creating") + kv.AddInDB(DB, "subnet/"+*name+"/vpc", *vpcName) + kv.AddInDB(DB, "subnet/"+*name+"/vxlan_id", *vxlanID) + kv.AddInDB(DB, "subnet/"+*name+"/local_ip", *localIP) + kv.AddInDB(DB, "subnet/"+*name+"/gateway_ip", *gatewayIP) + kv.AddInDB(DB, "subnet/"+*name+"/cidr", *cidr) + if err := subnet.CreateSubnet(DB, *name); err != nil { + fmt.Println(err) + os.Exit(1) + } + + case "delete": + if *name == "" { + fmt.Println("delete requires: -name") + os.Exit(1) + } + kv.AddInDB(DB, "subnet/"+*name+"/state", "deleting") + if err := subnet.DeleteSubnet(DB, *name); err != nil { + fmt.Println(err) + os.Exit(1) + } + if state, err := kv.GetFromDB(DB, "subnet/"+*name+"/state"); err != nil { + fmt.Println(err) + os.Exit(1) + } else if state == "deleted" { + kv.DeleteInDB(DB, "subnet/"+*name) + } + + case "check": + if *name == "" { + fmt.Println("check requires: -name") + os.Exit(1) + } + if state, err := kv.GetFromDB(DB, "subnet/"+*name+"/state"); err != nil { + os.Exit(1) + } else if state != "created" { + os.Exit(1) + } + + default: + fmt.Printf("Available commands:\n - create\n - delete\n - check\n") + os.Exit(1) + } + + os.Exit(0) +} diff --git a/internal/netif/addr.go b/internal/netif/addr.go new file mode 100644 index 0000000..b45b6aa --- /dev/null +++ b/internal/netif/addr.go @@ -0,0 +1,21 @@ +package netif + +import ( + "net" + + "github.com/vishvananda/netlink" +) + +func AddrAdd(iface string, ip net.IP) error { + link, err := netlink.LinkByName(iface) + if err != nil { + return err + } + addr := &netlink.Addr{ + IPNet: &net.IPNet{ + IP: ip, + Mask: net.CIDRMask(32, 32), + }, + } + return netlink.AddrAdd(link, addr) +} diff --git a/internal/netif/route_linux.go b/internal/netif/route_linux.go new file mode 100644 index 0000000..f68d191 --- /dev/null +++ b/internal/netif/route_linux.go @@ -0,0 +1,21 @@ +//go:build linux + +package netif + +import ( + "net" + + "github.com/vishvananda/netlink" +) + +func RouteAdd(iface string, subnet *net.IPNet) error { + link, err := netlink.LinkByName(iface) + if err != nil { + return err + } + return netlink.RouteAdd(&netlink.Route{ + LinkIndex: link.Attrs().Index, + Dst: subnet, + Scope: netlink.SCOPE_LINK, + }) +} diff --git a/internal/netif/route_other.go b/internal/netif/route_other.go new file mode 100644 index 0000000..685c5bf --- /dev/null +++ b/internal/netif/route_other.go @@ -0,0 +1,9 @@ +//go:build !linux + +package netif + +import "net" + +func RouteAdd(_ string, _ *net.IPNet) error { + return nil +} diff --git a/internal/netif/vxlan.go b/internal/netif/vxlan.go new file mode 100644 index 0000000..eacae7c --- /dev/null +++ b/internal/netif/vxlan.go @@ -0,0 +1,20 @@ +package netif + +import ( + "net" + + "github.com/vishvananda/netlink" +) + +func CreateVxlan(name string, vxlanID int, localIP net.IP) error { + vxlan := &netlink.Vxlan{ + LinkAttrs: netlink.LinkAttrs{ + Name: name, + }, + VxlanId: vxlanID, + Port: 4789, + SrcAddr: localIP, + Learning: false, + } + return netlink.LinkAdd(vxlan) +} diff --git a/internal/subnet/create.go b/internal/subnet/create.go new file mode 100644 index 0000000..9bfe02a --- /dev/null +++ b/internal/subnet/create.go @@ -0,0 +1,186 @@ +package subnet + +import ( + "fmt" + "net" + "os/exec" + "strconv" + "strings" + + "git.g3e.fr/syonad/two/internal/dhcp" + "git.g3e.fr/syonad/two/internal/netif" + "git.g3e.fr/syonad/two/internal/netns" + "git.g3e.fr/syonad/two/pkg/db/kv" + "git.g3e.fr/syonad/two/pkg/systemd" + + "github.com/dgraph-io/badger/v4" +) + +func CreateSubnet(db *badger.DB, subnetName string) error { + state, err := kv.GetFromDB(db, "subnet/"+subnetName+"/state") + if err != nil { + return err + } + if state != "creating" { + return nil + } + + // lecture des paramètres depuis la DB + vpcName, err := kv.GetFromDB(db, "subnet/"+subnetName+"/vpc") + if err != nil { + return fmt.Errorf("get vpc: %w", err) + } + + vxlanIDStr, err := kv.GetFromDB(db, "subnet/"+subnetName+"/vxlan_id") + if err != nil { + return fmt.Errorf("get vxlan_id: %w", err) + } + vxlanID, err := strconv.Atoi(vxlanIDStr) + if err != nil { + return fmt.Errorf("parse vxlan_id: %w", err) + } + + localIPStr, err := kv.GetFromDB(db, "subnet/"+subnetName+"/local_ip") + if err != nil { + return fmt.Errorf("get local_ip: %w", err) + } + localIP := net.ParseIP(localIPStr) + if localIP == nil { + return fmt.Errorf("invalid local_ip: %s", localIPStr) + } + + gatewayIPStr, err := kv.GetFromDB(db, "subnet/"+subnetName+"/gateway_ip") + if err != nil { + return fmt.Errorf("get gateway_ip: %w", err) + } + gatewayIP := net.ParseIP(gatewayIPStr) + if gatewayIP == nil { + return fmt.Errorf("invalid gateway_ip: %s", gatewayIPStr) + } + + cidr, err := kv.GetFromDB(db, "subnet/"+subnetName+"/cidr") + if err != nil { + return fmt.Errorf("get cidr: %w", err) + } + _, subnet, err := net.ParseCIDR(cidr) + if err != nil { + return fmt.Errorf("parse cidr: %w", err) + } + + // subnet_id = partie après le premier '-' (ex: "sn-00001" -> "00001") + subnetID := strings.SplitN(subnetName, "-", 2)[1] + bridge := "br-" + subnetID + vxlanIface := fmt.Sprintf("vxlan-%d", vxlanID) + + // veth pair + if err := netif.CreateVethToNetns("v-"+subnetID+"-e", "v-"+subnetID+"-i", "/var/run/netns/"+vpcName, 1500); err != nil { + return fmt.Errorf("create veth: %w", err) + } + + // bridge dans le root netns + if err := netif.CreateBridge(bridge, 1500); err != nil { + return fmt.Errorf("create bridge: %w", err) + } + + // bridge dans le netns VPC + if err := netns.Call(vpcName, func() error { + return netif.CreateBridge(bridge, 1500) + }); err != nil { + return fmt.Errorf("create bridge in netns: %w", err) + } + + // vxlan + if err := netif.CreateVxlan(vxlanIface, vxlanID, localIP); err != nil { + return fmt.Errorf("create vxlan: %w", err) + } + + // ajout des interfaces dans les bridges + if err := netif.BridgeSetMaster("v-"+subnetID+"-e", bridge); err != nil { + return fmt.Errorf("add veth-e to bridge: %w", err) + } + if err := netns.Call(vpcName, func() error { + return netif.BridgeSetMaster("v-"+subnetID+"-i", bridge) + }); err != nil { + return fmt.Errorf("add veth-i to bridge in netns: %w", err) + } + if err := netif.BridgeSetMaster(vxlanIface, bridge); err != nil { + return fmt.Errorf("add vxlan to bridge: %w", err) + } + + // montée des interfaces dans le root netns + for _, iface := range []string{"v-" + subnetID + "-e", vxlanIface, bridge} { + if err := netif.LinkSetUp(iface); err != nil { + return fmt.Errorf("set up %s: %w", iface, err) + } + } + + // montée des interfaces dans le netns VPC + if err := netns.Call(vpcName, func() error { + for _, iface := range []string{"v-" + subnetID + "-i", bridge} { + if err := netif.LinkSetUp(iface); err != nil { + return fmt.Errorf("set up %s: %w", iface, err) + } + } + return nil + }); err != nil { + return fmt.Errorf("set up interfaces in netns: %w", err) + } + + // IP gateway (/32) sur le bridge interne + if err := netns.Call(vpcName, func() error { + return netif.AddrAdd(bridge, gatewayIP) + }); err != nil { + return fmt.Errorf("add addr to bridge in netns: %w", err) + } + + // route subnet (scope link) dans le netns VPC + if err := netns.Call(vpcName, func() error { + return netif.RouteAdd(bridge, subnet) + }); err != nil { + return fmt.Errorf("add route in netns: %w", err) + } + + // ebtables : drop ARP Request vers la gateway sur ce bridge + if err := exec.Command("ebtables", "-A", "FORWARD", + "--out-interface", bridge, + "-p", "arp", + "--arp-op", "Request", + "--arp-ip-dst", gatewayIP.String(), + "-j", "DROP").Run(); err != nil { + return fmt.Errorf("ebtables arp rule: %w", err) + } + + // ebtables : drop trafic DHCP sur ce bridge + if err := exec.Command("ebtables", "-A", "FORWARD", + "--out-interface", bridge, + "-p", "IPv4", + "--ip-protocol", "udp", + "--ip-source-port", "67:68", + "--ip-destination-port", "67:68", + "-j", "DROP").Run(); err != nil { + return fmt.Errorf("ebtables dhcp rule: %w", err) + } + + // génération de la config dnsmasq et démarrage du service + conf := dhcp.Config{ + Network: subnet, + Gateway: gatewayIP, + Name: vpcName + "_" + bridge, + ConfDir: "/etc/dnsmasq.d", + } + if _, err := dhcp.GenerateConfig(conf); err != nil { + return fmt.Errorf("generate dhcp config: %w", err) + } + + svc, err := systemd.New() + if err != nil { + return fmt.Errorf("connect to systemd: %w", err) + } + defer svc.Close() + + if err := svc.Start("dnsmasq@" + conf.Name + ".service"); err != nil { + return fmt.Errorf("start dnsmasq: %w", err) + } + + return kv.AddInDB(db, "subnet/"+subnetName+"/state", "created") +} diff --git a/internal/subnet/delete.go b/internal/subnet/delete.go new file mode 100644 index 0000000..650aa6f --- /dev/null +++ b/internal/subnet/delete.go @@ -0,0 +1,95 @@ +package subnet + +import ( + "fmt" + "os" + "os/exec" + "strings" + + "git.g3e.fr/syonad/two/internal/netif" + "git.g3e.fr/syonad/two/internal/netns" + "git.g3e.fr/syonad/two/pkg/db/kv" + "git.g3e.fr/syonad/two/pkg/systemd" + + "github.com/dgraph-io/badger/v4" +) + +func DeleteSubnet(db *badger.DB, subnetName string) error { + state, err := kv.GetFromDB(db, "subnet/"+subnetName+"/state") + if err != nil { + return err + } + if state != "deleting" { + return nil + } + + vpcName, err := kv.GetFromDB(db, "subnet/"+subnetName+"/vpc") + if err != nil { + return fmt.Errorf("get vpc: %w", err) + } + + vxlanIDStr, err := kv.GetFromDB(db, "subnet/"+subnetName+"/vxlan_id") + if err != nil { + return fmt.Errorf("get vxlan_id: %w", err) + } + + subnetID := strings.SplitN(subnetName, "-", 2)[1] + bridge := "br-" + subnetID + vxlanIface := "vxlan-" + vxlanIDStr + + // arrêt du service dnsmasq + svc, err := systemd.New() + if err != nil { + return fmt.Errorf("connect to systemd: %w", err) + } + defer svc.Close() + + svcName := "dnsmasq@" + vpcName + "_" + bridge + ".service" + if err := svc.Stop(svcName); err != nil { + return fmt.Errorf("stop dnsmasq: %w", err) + } + + // suppression de la config dnsmasq + if err := os.Remove("/etc/dnsmasq.d/" + vpcName + "_" + bridge + ".conf"); err != nil && !os.IsNotExist(err) { + return fmt.Errorf("remove dnsmasq config: %w", err) + } + + // suppression des règles ebtables + exec.Command("ebtables", "-D", "FORWARD", + "--out-interface", bridge, + "-p", "arp", + "--arp-op", "Request", + "-j", "DROP").Run() + + exec.Command("ebtables", "-D", "FORWARD", + "--out-interface", bridge, + "-p", "IPv4", + "--ip-protocol", "udp", + "--ip-source-port", "67:68", + "--ip-destination-port", "67:68", + "-j", "DROP").Run() + + // suppression du bridge dans le netns VPC + if err := netns.Call(vpcName, func() error { + return netif.DeleteLink(bridge) + }); err != nil { + return fmt.Errorf("delete bridge in netns: %w", err) + } + + // suppression du vxlan + if err := netif.DeleteLink(vxlanIface); err != nil { + return fmt.Errorf("delete vxlan: %w", err) + } + + // suppression du veth pair (supprime les deux côtés) + if err := netif.DeleteLink("v-" + subnetID + "-e"); err != nil { + return fmt.Errorf("delete veth: %w", err) + } + + // suppression du bridge dans le root netns + if err := netif.DeleteLink(bridge); err != nil { + return fmt.Errorf("delete bridge: %w", err) + } + + return kv.AddInDB(db, "subnet/"+subnetName+"/state", "deleted") +}