f-15: ia: first subnet try

Signed-off-by: GnomeZworc <nicolas.boufidjeline@g3e.fr>

cmd/subnet/main.go

@@ -0,0 +1,93 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+
+	configuration "git.g3e.fr/syonad/two/internal/config/agent"
+	"git.g3e.fr/syonad/two/internal/subnet"
+	"git.g3e.fr/syonad/two/pkg/db/kv"
+
+	"github.com/dgraph-io/badger/v4"
+)
+
+var (
+	name       = flag.String("name", "", "Subnet name (ex: sn-00001)")
+	vpcName    = flag.String("vpc", "", "VPC name")
+	vxlanID    = flag.String("vxlan-id", "", "VXLAN ID")
+	localIP    = flag.String("local-ip", "", "Local VTEP IP")
+	gatewayIP  = flag.String("gateway-ip", "", "Gateway IP")
+	cidr       = flag.String("cidr", "", "Subnet CIDR (ex: 10.10.10.0/24)")
+	action     = flag.String("action", "", "Action à effectuer")
+	conf_file  = flag.String("conf", "/etc/two/agent.yml", "Configuration file")
+)
+
+var DB *badger.DB
+
+func main() {
+	flag.Parse()
+
+	conf, err := configuration.LoadConfig(*conf_file)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+
+	DB = kv.InitDB(kv.Config{
+		Path: conf.Database.Path,
+	}, false)
+	defer DB.Close()
+
+	switch *action {
+	case "create":
+		if *name == "" || *vpcName == "" || *vxlanID == "" || *localIP == "" || *gatewayIP == "" || *cidr == "" {
+			fmt.Println("create requires: -name -vpc -vxlan-id -local-ip -gateway-ip -cidr")
+			os.Exit(1)
+		}
+		kv.AddInDB(DB, "subnet/"+*name+"/state", "creating")
+		kv.AddInDB(DB, "subnet/"+*name+"/vpc", *vpcName)
+		kv.AddInDB(DB, "subnet/"+*name+"/vxlan_id", *vxlanID)
+		kv.AddInDB(DB, "subnet/"+*name+"/local_ip", *localIP)
+		kv.AddInDB(DB, "subnet/"+*name+"/gateway_ip", *gatewayIP)
+		kv.AddInDB(DB, "subnet/"+*name+"/cidr", *cidr)
+		if err := subnet.CreateSubnet(DB, *name); err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+
+	case "delete":
+		if *name == "" {
+			fmt.Println("delete requires: -name")
+			os.Exit(1)
+		}
+		kv.AddInDB(DB, "subnet/"+*name+"/state", "deleting")
+		if err := subnet.DeleteSubnet(DB, *name); err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		}
+		if state, err := kv.GetFromDB(DB, "subnet/"+*name+"/state"); err != nil {
+			fmt.Println(err)
+			os.Exit(1)
+		} else if state == "deleted" {
+			kv.DeleteInDB(DB, "subnet/"+*name)
+		}
+
+	case "check":
+		if *name == "" {
+			fmt.Println("check requires: -name")
+			os.Exit(1)
+		}
+		if state, err := kv.GetFromDB(DB, "subnet/"+*name+"/state"); err != nil {
+			os.Exit(1)
+		} else if state != "created" {
+			os.Exit(1)
+		}
+
+	default:
+		fmt.Printf("Available commands:\n - create\n - delete\n - check\n")
+		os.Exit(1)
+	}
+
+	os.Exit(0)
+}

internal/netif/addr.go

@@ -0,0 +1,21 @@
+package netif
+
+import (
+	"net"
+
+	"github.com/vishvananda/netlink"
+)
+
+func AddrAdd(iface string, ip net.IP) error {
+	link, err := netlink.LinkByName(iface)
+	if err != nil {
+		return err
+	}
+	addr := &netlink.Addr{
+		IPNet: &net.IPNet{
+			IP:   ip,
+			Mask: net.CIDRMask(32, 32),
+		},
+	}
+	return netlink.AddrAdd(link, addr)
+}

internal/netif/route_linux.go

@@ -0,0 +1,21 @@
+//go:build linux
+
+package netif
+
+import (
+	"net"
+
+	"github.com/vishvananda/netlink"
+)
+
+func RouteAdd(iface string, subnet *net.IPNet) error {
+	link, err := netlink.LinkByName(iface)
+	if err != nil {
+		return err
+	}
+	return netlink.RouteAdd(&netlink.Route{
+		LinkIndex: link.Attrs().Index,
+		Dst:       subnet,
+		Scope:     netlink.SCOPE_LINK,
+	})
+}

internal/netif/route_other.go

@@ -0,0 +1,9 @@
+//go:build !linux
+
+package netif
+
+import "net"
+
+func RouteAdd(_ string, _ *net.IPNet) error {
+	return nil
+}

internal/netif/vxlan.go

@@ -0,0 +1,20 @@
+package netif
+
+import (
+	"net"
+
+	"github.com/vishvananda/netlink"
+)
+
+func CreateVxlan(name string, vxlanID int, localIP net.IP) error {
+	vxlan := &netlink.Vxlan{
+		LinkAttrs: netlink.LinkAttrs{
+			Name: name,
+		},
+		VxlanId:  vxlanID,
+		Port:     4789,
+		SrcAddr:  localIP,
+		Learning: false,
+	}
+	return netlink.LinkAdd(vxlan)
+}

internal/subnet/create.go

@@ -0,0 +1,186 @@
+package subnet
+
+import (
+	"fmt"
+	"net"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	"git.g3e.fr/syonad/two/internal/dhcp"
+	"git.g3e.fr/syonad/two/internal/netif"
+	"git.g3e.fr/syonad/two/internal/netns"
+	"git.g3e.fr/syonad/two/pkg/db/kv"
+	"git.g3e.fr/syonad/two/pkg/systemd"
+
+	"github.com/dgraph-io/badger/v4"
+)
+
+func CreateSubnet(db *badger.DB, subnetName string) error {
+	state, err := kv.GetFromDB(db, "subnet/"+subnetName+"/state")
+	if err != nil {
+		return err
+	}
+	if state != "creating" {
+		return nil
+	}
+
+	// lecture des paramètres depuis la DB
+	vpcName, err := kv.GetFromDB(db, "subnet/"+subnetName+"/vpc")
+	if err != nil {
+		return fmt.Errorf("get vpc: %w", err)
+	}
+
+	vxlanIDStr, err := kv.GetFromDB(db, "subnet/"+subnetName+"/vxlan_id")
+	if err != nil {
+		return fmt.Errorf("get vxlan_id: %w", err)
+	}
+	vxlanID, err := strconv.Atoi(vxlanIDStr)
+	if err != nil {
+		return fmt.Errorf("parse vxlan_id: %w", err)
+	}
+
+	localIPStr, err := kv.GetFromDB(db, "subnet/"+subnetName+"/local_ip")
+	if err != nil {
+		return fmt.Errorf("get local_ip: %w", err)
+	}
+	localIP := net.ParseIP(localIPStr)
+	if localIP == nil {
+		return fmt.Errorf("invalid local_ip: %s", localIPStr)
+	}
+
+	gatewayIPStr, err := kv.GetFromDB(db, "subnet/"+subnetName+"/gateway_ip")
+	if err != nil {
+		return fmt.Errorf("get gateway_ip: %w", err)
+	}
+	gatewayIP := net.ParseIP(gatewayIPStr)
+	if gatewayIP == nil {
+		return fmt.Errorf("invalid gateway_ip: %s", gatewayIPStr)
+	}
+
+	cidr, err := kv.GetFromDB(db, "subnet/"+subnetName+"/cidr")
+	if err != nil {
+		return fmt.Errorf("get cidr: %w", err)
+	}
+	_, subnet, err := net.ParseCIDR(cidr)
+	if err != nil {
+		return fmt.Errorf("parse cidr: %w", err)
+	}
+
+	// subnet_id = partie après le premier '-' (ex: "sn-00001" -> "00001")
+	subnetID := strings.SplitN(subnetName, "-", 2)[1]
+	bridge := "br-" + subnetID
+	vxlanIface := fmt.Sprintf("vxlan-%d", vxlanID)
+
+	// veth pair
+	if err := netif.CreateVethToNetns("v-"+subnetID+"-e", "v-"+subnetID+"-i", "/var/run/netns/"+vpcName, 1500); err != nil {
+		return fmt.Errorf("create veth: %w", err)
+	}
+
+	// bridge dans le root netns
+	if err := netif.CreateBridge(bridge, 1500); err != nil {
+		return fmt.Errorf("create bridge: %w", err)
+	}
+
+	// bridge dans le netns VPC
+	if err := netns.Call(vpcName, func() error {
+		return netif.CreateBridge(bridge, 1500)
+	}); err != nil {
+		return fmt.Errorf("create bridge in netns: %w", err)
+	}
+
+	// vxlan
+	if err := netif.CreateVxlan(vxlanIface, vxlanID, localIP); err != nil {
+		return fmt.Errorf("create vxlan: %w", err)
+	}
+
+	// ajout des interfaces dans les bridges
+	if err := netif.BridgeSetMaster("v-"+subnetID+"-e", bridge); err != nil {
+		return fmt.Errorf("add veth-e to bridge: %w", err)
+	}
+	if err := netns.Call(vpcName, func() error {
+		return netif.BridgeSetMaster("v-"+subnetID+"-i", bridge)
+	}); err != nil {
+		return fmt.Errorf("add veth-i to bridge in netns: %w", err)
+	}
+	if err := netif.BridgeSetMaster(vxlanIface, bridge); err != nil {
+		return fmt.Errorf("add vxlan to bridge: %w", err)
+	}
+
+	// montée des interfaces dans le root netns
+	for _, iface := range []string{"v-" + subnetID + "-e", vxlanIface, bridge} {
+		if err := netif.LinkSetUp(iface); err != nil {
+			return fmt.Errorf("set up %s: %w", iface, err)
+		}
+	}
+
+	// montée des interfaces dans le netns VPC
+	if err := netns.Call(vpcName, func() error {
+		for _, iface := range []string{"v-" + subnetID + "-i", bridge} {
+			if err := netif.LinkSetUp(iface); err != nil {
+				return fmt.Errorf("set up %s: %w", iface, err)
+			}
+		}
+		return nil
+	}); err != nil {
+		return fmt.Errorf("set up interfaces in netns: %w", err)
+	}
+
+	// IP gateway (/32) sur le bridge interne
+	if err := netns.Call(vpcName, func() error {
+		return netif.AddrAdd(bridge, gatewayIP)
+	}); err != nil {
+		return fmt.Errorf("add addr to bridge in netns: %w", err)
+	}
+
+	// route subnet (scope link) dans le netns VPC
+	if err := netns.Call(vpcName, func() error {
+		return netif.RouteAdd(bridge, subnet)
+	}); err != nil {
+		return fmt.Errorf("add route in netns: %w", err)
+	}
+
+	// ebtables : drop ARP Request vers la gateway sur ce bridge
+	if err := exec.Command("ebtables", "-A", "FORWARD",
+		"--out-interface", bridge,
+		"-p", "arp",
+		"--arp-op", "Request",
+		"--arp-ip-dst", gatewayIP.String(),
+		"-j", "DROP").Run(); err != nil {
+		return fmt.Errorf("ebtables arp rule: %w", err)
+	}
+
+	// ebtables : drop trafic DHCP sur ce bridge
+	if err := exec.Command("ebtables", "-A", "FORWARD",
+		"--out-interface", bridge,
+		"-p", "IPv4",
+		"--ip-protocol", "udp",
+		"--ip-source-port", "67:68",
+		"--ip-destination-port", "67:68",
+		"-j", "DROP").Run(); err != nil {
+		return fmt.Errorf("ebtables dhcp rule: %w", err)
+	}
+
+	// génération de la config dnsmasq et démarrage du service
+	conf := dhcp.Config{
+		Network: subnet,
+		Gateway: gatewayIP,
+		Name:    vpcName + "_" + bridge,
+		ConfDir: "/etc/dnsmasq.d",
+	}
+	if _, err := dhcp.GenerateConfig(conf); err != nil {
+		return fmt.Errorf("generate dhcp config: %w", err)
+	}
+
+	svc, err := systemd.New()
+	if err != nil {
+		return fmt.Errorf("connect to systemd: %w", err)
+	}
+	defer svc.Close()
+
+	if err := svc.Start("dnsmasq@" + conf.Name + ".service"); err != nil {
+		return fmt.Errorf("start dnsmasq: %w", err)
+	}
+
+	return kv.AddInDB(db, "subnet/"+subnetName+"/state", "created")
+}

internal/subnet/delete.go

@@ -0,0 +1,95 @@
+package subnet
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+
+	"git.g3e.fr/syonad/two/internal/netif"
+	"git.g3e.fr/syonad/two/internal/netns"
+	"git.g3e.fr/syonad/two/pkg/db/kv"
+	"git.g3e.fr/syonad/two/pkg/systemd"
+
+	"github.com/dgraph-io/badger/v4"
+)
+
+func DeleteSubnet(db *badger.DB, subnetName string) error {
+	state, err := kv.GetFromDB(db, "subnet/"+subnetName+"/state")
+	if err != nil {
+		return err
+	}
+	if state != "deleting" {
+		return nil
+	}
+
+	vpcName, err := kv.GetFromDB(db, "subnet/"+subnetName+"/vpc")
+	if err != nil {
+		return fmt.Errorf("get vpc: %w", err)
+	}
+
+	vxlanIDStr, err := kv.GetFromDB(db, "subnet/"+subnetName+"/vxlan_id")
+	if err != nil {
+		return fmt.Errorf("get vxlan_id: %w", err)
+	}
+
+	subnetID := strings.SplitN(subnetName, "-", 2)[1]
+	bridge := "br-" + subnetID
+	vxlanIface := "vxlan-" + vxlanIDStr
+
+	// arrêt du service dnsmasq
+	svc, err := systemd.New()
+	if err != nil {
+		return fmt.Errorf("connect to systemd: %w", err)
+	}
+	defer svc.Close()
+
+	svcName := "dnsmasq@" + vpcName + "_" + bridge + ".service"
+	if err := svc.Stop(svcName); err != nil {
+		return fmt.Errorf("stop dnsmasq: %w", err)
+	}
+
+	// suppression de la config dnsmasq
+	if err := os.Remove("/etc/dnsmasq.d/" + vpcName + "_" + bridge + ".conf"); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove dnsmasq config: %w", err)
+	}
+
+	// suppression des règles ebtables
+	exec.Command("ebtables", "-D", "FORWARD",
+		"--out-interface", bridge,
+		"-p", "arp",
+		"--arp-op", "Request",
+		"-j", "DROP").Run()
+
+	exec.Command("ebtables", "-D", "FORWARD",
+		"--out-interface", bridge,
+		"-p", "IPv4",
+		"--ip-protocol", "udp",
+		"--ip-source-port", "67:68",
+		"--ip-destination-port", "67:68",
+		"-j", "DROP").Run()
+
+	// suppression du bridge dans le netns VPC
+	if err := netns.Call(vpcName, func() error {
+		return netif.DeleteLink(bridge)
+	}); err != nil {
+		return fmt.Errorf("delete bridge in netns: %w", err)
+	}
+
+	// suppression du vxlan
+	if err := netif.DeleteLink(vxlanIface); err != nil {
+		return fmt.Errorf("delete vxlan: %w", err)
+	}
+
+	// suppression du veth pair (supprime les deux côtés)
+	if err := netif.DeleteLink("v-" + subnetID + "-e"); err != nil {
+		return fmt.Errorf("delete veth: %w", err)
+	}
+
+	// suppression du bridge dans le root netns
+	if err := netif.DeleteLink(bridge); err != nil {
+		return fmt.Errorf("delete bridge: %w", err)
+	}
+
+	return kv.AddInDB(db, "subnet/"+subnetName+"/state", "deleted")
+}