X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/aa7b44fc6db3cb338b9aa830e547960a9904e329..8e560396523ba90ad84adf0a1c0f3cfd71912cb0:/cookbooks/networking/recipes/default.rb diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb index 831d7ce84..4d3974b96 100644 --- a/cookbooks/networking/recipes/default.rb +++ b/cookbooks/networking/recipes/default.rb @@ -40,23 +40,22 @@ netplan = { node[:networking][:interfaces].each do |name, interface| if interface[:interface] if interface[:role] && (role = node[:networking][:roles][interface[:role]]) - if role[interface[:family]] - node.default[:networking][:interfaces][name][:prefix] = role[interface[:family]][:prefix] - node.default[:networking][:interfaces][name][:gateway] = role[interface[:family]][:gateway] - node.default[:networking][:interfaces][name][:routes] = role[interface[:family]][:routes] + if interface[:inet] && role[:inet] + node.default[:networking][:interfaces][name][:inet][:prefix] = role[:inet][:prefix] + node.default[:networking][:interfaces][name][:inet][:gateway] = role[:inet][:gateway] + node.default[:networking][:interfaces][name][:inet][:routes] = role[:inet][:routes] + end + + if interface[:inet6] && role[:inet6] + node.default[:networking][:interfaces][name][:inet6][:prefix] = role[:inet6][:prefix] + node.default[:networking][:interfaces][name][:inet6][:gateway] = role[:inet6][:gateway] + node.default[:networking][:interfaces][name][:inet6][:routes] = role[:inet6][:routes] end node.default[:networking][:interfaces][name][:metric] = role[:metric] node.default[:networking][:interfaces][name][:zone] = role[:zone] end - if interface[:address] - prefix = node[:networking][:interfaces][name][:prefix] - - node.default[:networking][:interfaces][name][:netmask] = (~IPAddr.new(interface[:address]).mask(0)).mask(prefix) - node.default[:networking][:interfaces][name][:network] = IPAddr.new(interface[:address]).mask(prefix) - end - interface = node[:networking][:interfaces][name] deviceplan = if interface[:interface] =~ /^(.*)\.(\d+)$/ @@ -81,8 +80,12 @@ node[:networking][:interfaces].each do |name, interface| } end - if interface[:address] - deviceplan["addresses"].push("#{interface[:address]}/#{prefix}") + if interface[:inet] + deviceplan["addresses"].push("#{interface[:inet][:address]}/#{interface[:inet][:prefix]}") + end + + if interface[:inet6] + deviceplan["addresses"].push("#{interface[:inet6][:address]}/#{interface[:inet6][:prefix]}") end if interface[:mtu] @@ -104,49 +107,71 @@ node[:networking][:interfaces].each do |name, interface| deviceplan["parameters"]["lacp-rate"] = interface[:bond][:lacprate] if interface[:bond][:lacprate] end - if interface[:gateway] && interface[:gateway] != interface[:address] - if interface[:family] == "inet" - default_route = "0.0.0.0/0" - elsif interface[:family] == "inet6" - default_route = "::/0" + if interface[:inet] + if interface[:inet][:gateway] && interface[:inet][:gateway] != interface[:inet][:address] + deviceplan["routes"].push( + "to" => "0.0.0.0/0", + "via" => interface[:inet][:gateway], + "metric" => interface[:metric], + "on-link" => true + ) + end + + if interface[:inet][:routes] + interface[:inet][:routes].each do |to, parameters| + next if parameters[:via] == interface[:inet][:address] + + route = { + "to" => to + } + + route["type"] = parameters[:type] if parameters[:type] + route["via"] = parameters[:via] if parameters[:via] + route["metric"] = parameters[:metric] if parameters[:metric] + + deviceplan["routes"].push(route) + end end + end - deviceplan["routes"].push( - "to" => default_route, - "via" => interface[:gateway], - "metric" => interface[:metric], - "on-link" => true - ) - - # This ordering relies on systemd-networkd adding routes - # in reverse order and will need moving before the previous - # route once that is fixed: - # - # https://github.com/systemd/systemd/issues/5430 - # https://github.com/systemd/systemd/pull/10938 - if interface[:family] == "inet6" && - !interface[:network].include?(interface[:gateway]) && - !IPAddr.new("fe80::/64").include?(interface[:gateway]) + if interface[:inet6] + if interface[:inet6][:gateway] && interface[:inet6][:gateway] != interface[:inet6][:address] deviceplan["routes"].push( - "to" => interface[:gateway], - "scope" => "link" + "to" => "::/0", + "via" => interface[:inet6][:gateway], + "metric" => interface[:metric], + "on-link" => true ) + + # This ordering relies on systemd-networkd adding routes + # in reverse order and will need moving before the previous + # route once that is fixed: + # + # https://github.com/systemd/systemd/issues/5430 + # https://github.com/systemd/systemd/pull/10938 + if !IPAddr.new(interface[:inet6][:address]).mask(interface[:inet6][:prefix]).include?(interface[:inet6][:gateway]) && + !IPAddr.new("fe80::/64").include?(interface[:inet6][:gateway]) + deviceplan["routes"].push( + "to" => interface[:inet6][:gateway], + "scope" => "link" + ) + end end - end - if interface[:routes] - interface[:routes].each do |to, parameters| - next if parameters[:via] == interface[:address] + if interface[:inet6][:routes] + interface[:inet6][:routes].each do |to, parameters| + next if parameters[:via] == interface[:inet6][:address] - route = { - "to" => to - } + route = { + "to" => to + } - route["type"] = parameters[:type] if parameters[:type] - route["via"] = parameters[:via] if parameters[:via] - route["metric"] = parameters[:metric] if parameters[:metric] + route["type"] = parameters[:type] if parameters[:type] + route["via"] = parameters[:via] if parameters[:via] + route["metric"] = parameters[:metric] if parameters[:metric] - deviceplan["routes"].push(route) + deviceplan["routes"].push(route) + end end end else @@ -230,9 +255,7 @@ if node[:networking][:wireguard][:enabled] next if gateway.name == node.name next unless gateway[:networking][:wireguard] && gateway[:networking][:wireguard][:enabled] - allowed_ips = gateway.interfaces(:role => :internal).map do |interface| - "#{interface[:network]}/#{interface[:prefix]}" - end + allowed_ips = gateway.ipaddresses(:role => :internal).map(&:subnet) node.default[:networking][:wireguard][:peers] << { :public_key => gateway[:networking][:wireguard][:public_key], @@ -242,9 +265,7 @@ if node[:networking][:wireguard][:enabled] end search(:node, "roles:prometheus") do |server| - allowed_ips = server.interfaces(:role => :internal).map do |interface| - "#{interface[:network]}/#{interface[:prefix]}" - end + allowed_ips = server.ipaddresses(:role => :internal).map(&:subnet) if server[:networking][:private_address] allowed_ips << "#{server[:networking][:private_address]}/32" @@ -278,9 +299,7 @@ if node[:networking][:wireguard][:enabled] } elsif node[:roles].include?("shenron") search(:node, "roles:gateway") do |gateway| - allowed_ips = gateway.interfaces(:role => :internal).map do |interface| - "#{interface[:network]}/#{interface[:prefix]}" - end + allowed_ips = gateway.ipaddresses(:role => :internal).map(&:subnet) node.default[:networking][:wireguard][:peers] << { :public_key => gateway[:networking][:wireguard][:public_key], @@ -304,35 +323,19 @@ if node[:networking][:wireguard][:enabled] mode "644" end - if node[:lsb][:release].to_f < 20.04 - execute "ip-link-delete-wg0" do - action :nothing - command "ip link delete wg0" - subscribes :run, "template[/etc/systemd/network/wireguard.netdev]" - only_if { ::File.exist?("/sys/class/net/wg0") } - end - - service "systemd-networkd" do - action :nothing - subscribes :restart, "template[/etc/systemd/network/wireguard.netdev]" - subscribes :restart, "template[/etc/systemd/network/wireguard.network]" - not_if { kitchen? } - end - else - execute "networkctl-delete-wg0" do - action :nothing - command "networkctl delete wg0" - subscribes :run, "template[/etc/systemd/network/wireguard.netdev]" - only_if { ::File.exist?("/sys/class/net/wg0") } - end + execute "networkctl-delete-wg0" do + action :nothing + command "networkctl delete wg0" + subscribes :run, "template[/etc/systemd/network/wireguard.netdev]" + only_if { ::File.exist?("/sys/class/net/wg0") } + end - execute "networkctl-reload" do - action :nothing - command "networkctl reload" - subscribes :run, "template[/etc/systemd/network/wireguard.netdev]" - subscribes :run, "template[/etc/systemd/network/wireguard.network]" - not_if { kitchen? } - end + execute "networkctl-reload" do + action :nothing + command "networkctl reload" + subscribes :run, "template[/etc/systemd/network/wireguard.netdev]" + subscribes :run, "template[/etc/systemd/network/wireguard.network]" + not_if { kitchen? } end end @@ -383,7 +386,7 @@ link "/etc/resolv.conf" do to "../run/systemd/resolve/stub-resolv.conf" end -hosts = { "inet" => [], "inet6" => [] } +hosts = { :inet => [], :inet6 => [] } search(:node, "networking:interfaces").collect do |n| next if n[:fqdn] == node[:fqdn] @@ -391,7 +394,8 @@ search(:node, "networking:interfaces").collect do |n| n.interfaces.each do |interface| next unless interface[:role] == "external" - hosts[interface[:family]] << interface[:address] + hosts[:inet] << interface[:inet][:address] if interface[:inet] + hosts[:inet6] << interface[:inet6][:address] if interface[:inet6] end end @@ -409,22 +413,34 @@ template "/etc/nftables.conf" do group "root" mode "755" variables :interfaces => interfaces, :hosts => hosts - notifies :restart, "service[nftables]" + notifies :reload, "service[nftables]" end -stop_commands = [ - "-/usr/sbin/nft delete table inet filter", - "-/usr/sbin/nft delete table inet chef-filter" -] +directory "/var/lib/nftables" do + owner "root" + group "root" + mode "755" +end -stop_commands << "-/usr/sbin/nft delete table ip nat" if node[:roles].include?("gateway") -stop_commands << "-/usr/sbin/nft delete table ip chef-nat" if node[:roles].include?("gateway") +template "/usr/local/bin/nftables" do + source "nftables.erb" + owner "root" + group "root" + mode "755" +end systemd_service "nftables-stop" do + action :delete service "nftables" dropin "stop" - exec_reload "" - exec_stop stop_commands +end + +systemd_service "nftables-chef" do + service "nftables" + dropin "chef" + exec_start "/usr/local/bin/nftables start" + exec_reload "/usr/local/bin/nftables reload" + exec_stop "/usr/local/bin/nftables stop" end if node[:networking][:firewall][:enabled] @@ -438,17 +454,11 @@ else end if node[:networking][:wireguard][:enabled] - wireguard_source = if node[:roles].include?("gateway") - "net" - else - "osm" - end - firewall_rule "accept-wireguard" do action :accept - source wireguard_source - dest "fw" - proto "udp" + context :incoming + protocol :udp + source :osm unless node[:roles].include?("gateway") dest_ports "51820" source_ports "51820" end @@ -456,9 +466,8 @@ end firewall_rule "accept-http" do action :accept - source "net" - dest "fw" - proto "tcp:syn" + context :incoming + protocol :tcp dest_ports %w[http https] rate_limit node[:networking][:firewall][:http_rate_limit] connection_limit node[:networking][:firewall][:http_connection_limit]