meta-google: gbmc-bridge: Set default route source

This change ensures that ULA addresses don't get used as the source
when trying to send packets outside the machine.

Change-Id: I46413a2587634a79f0c0fc4051587e39a9fdcf50
Signed-off-by: William A. Kennington III <wak@google.com>

2 files changed, 67 insertions, 0 deletions

diff --git a/meta-google/recipes-google/networking/gbmc-bridge.bb b/meta-google/recipes-google/networking/gbmc-bridge.bb
index 6c51a2806..fc7dfbfb3 100644
--- a/meta-google/recipes-google/networking/gbmc-bridge.bb
+++ b/meta-google/recipes-google/networking/gbmc-bridge.bb
@@ -18,6 +18,7 @@ SRC_URI += " \
   file://gbmc-br-from-ra.sh \
   file://gbmc-br-ensure-ra.sh \
   file://gbmc-br-ensure-ra.service \
+  file://gbmc-br-gw-src.sh \
   file://gbmc-br-nft.sh \
   "
 
@@ -90,6 +91,7 @@ do_install() {
   install -d -m0755 "$mondir"
   install -m0644 ${WORKDIR}/gbmc-br-ula.sh "$mondir"/
   install -m0644 ${WORKDIR}/gbmc-br-from-ra.sh "$mondir"/
+  install -m0644 ${WORKDIR}/gbmc-br-gw-src.sh "$mondir"/
   install -m0644 ${WORKDIR}/gbmc-br-nft.sh "$mondir"/
 
   install -d -m0755 ${D}${libexecdir}
diff --git a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh
new file mode 100644
index 000000000..1364efd7b
--- /dev/null
+++ b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh
@@ -0,0 +1,65 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[ -z "${gbmc_br_gw_src_lib-}" ] || return
+
+gbmc_br_gw_src_ip=
+declare -A gbmc_br_gw_src_routes=()
+
+gbmc_br_gw_src_update() {
+  [ -n "$gbmc_br_gw_src_ip" ] || return
+
+  local route
+  for route in "${!gbmc_br_gw_src_routes[@]}"; do
+    [[ "$route" != *" src $gbmc_br_gw_src_ip "* ]] || continue
+    echo "gBMC Bridge Updating GW source [$gbmc_br_gw_src_ip]: $route" >&2
+    ip route change $route src "$gbmc_br_gw_src_ip"
+    unset 'gbmc_br_gw_src_routes[$route]'
+  done
+}
+
+gbmc_br_gw_src_hook() {
+  # We only want to match default gateway routes that are dynamic
+  # (have an expiration time). These will be updated with our preferred
+  # source.
+  if [[ "$change" == 'route' && "$route" == 'default '*':'* ]]; then
+    if [[ "$route" =~ ^(.*)( +expires +[^ ]+)(.*)$ ]]; then
+      route="${BASH_REMATCH[1]}${BASH_REMATCH[3]}"
+    fi
+    if [ "$action" = 'add' -a -z "${gbmc_br_gw_src_routes["$route"]}" ]; then
+      gbmc_br_gw_src_routes["$route"]=1
+      gbmc_br_gw_src_update
+    elif [ "$action" = 'del' -a -n "${gbmc_br_gw_src_routes["$route"]}" ]; then
+      unset 'gbmc_br_gw_src_routes[$route]'
+      gbmc_br_gw_src_update
+    fi
+  # Match only global IP addresses on the bridge that match the BMC stateless
+  # prefix (<mpfx>:fd00:). So 2002:af4:3480:2248:fd00:6345:3069:9186 would be
+  # matched as the preferred source IP for outoging traffic.
+  elif [ "$change" = 'addr' -a "$intf" = 'gbmcbr' -a "$scope" = 'global' ] &&
+       [[ "$fam" == 'inet6' && "$ip" =~ ^([^:]+:){4}fd00:.*$ ]] &&
+       [[ "$flags" != *tentative* ]]; then
+    if [ "$action" = 'add' -a "$ip" != "$gbmc_br_gw_src_ip" ]; then
+      gbmc_br_gw_src_ip="$ip"
+      gbmc_br_gw_src_update
+    fi
+    if [ "$action" = 'del' -a "$ip" = "$gbmc_br_gw_src_ip" ]; then
+      gbmc_br_gw_src_ip=
+    fi
+  fi
+}
+
+GBMC_IP_MONITOR_HOOKS+=(gbmc_br_gw_src_hook)
+
+gbmc_br_gw_src_lib=1