diff options
author | William A. Kennington III <wak@google.com> | 2021-05-06 00:44:41 +0300 |
---|---|---|
committer | William A. Kennington III <wak@google.com> | 2021-05-10 12:50:24 +0300 |
commit | cd40c7e803406f66c45338291c20b3cb6076964b (patch) | |
tree | 650776ebdb425dd2361c7b65ad633d6bba686d08 /meta-google/recipes-google | |
parent | 53527f3f24e5df5d0344f057cdb85dde7e596955 (diff) | |
download | openbmc-cd40c7e803406f66c45338291c20b3cb6076964b.tar.xz |
meta-google: gbmc-bridge: Set default route source
This change ensures that ULA addresses don't get used as the source
when trying to send packets outside the machine.
Change-Id: I46413a2587634a79f0c0fc4051587e39a9fdcf50
Signed-off-by: William A. Kennington III <wak@google.com>
Diffstat (limited to 'meta-google/recipes-google')
-rw-r--r-- | meta-google/recipes-google/networking/gbmc-bridge.bb | 2 | ||||
-rw-r--r-- | meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh | 65 |
2 files changed, 67 insertions, 0 deletions
diff --git a/meta-google/recipes-google/networking/gbmc-bridge.bb b/meta-google/recipes-google/networking/gbmc-bridge.bb index 6c51a2806..fc7dfbfb3 100644 --- a/meta-google/recipes-google/networking/gbmc-bridge.bb +++ b/meta-google/recipes-google/networking/gbmc-bridge.bb @@ -18,6 +18,7 @@ SRC_URI += " \ file://gbmc-br-from-ra.sh \ file://gbmc-br-ensure-ra.sh \ file://gbmc-br-ensure-ra.service \ + file://gbmc-br-gw-src.sh \ file://gbmc-br-nft.sh \ " @@ -90,6 +91,7 @@ do_install() { install -d -m0755 "$mondir" install -m0644 ${WORKDIR}/gbmc-br-ula.sh "$mondir"/ install -m0644 ${WORKDIR}/gbmc-br-from-ra.sh "$mondir"/ + install -m0644 ${WORKDIR}/gbmc-br-gw-src.sh "$mondir"/ install -m0644 ${WORKDIR}/gbmc-br-nft.sh "$mondir"/ install -d -m0755 ${D}${libexecdir} diff --git a/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh new file mode 100644 index 000000000..1364efd7b --- /dev/null +++ b/meta-google/recipes-google/networking/gbmc-bridge/gbmc-br-gw-src.sh @@ -0,0 +1,65 @@ +# Copyright 2021 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +[ -z "${gbmc_br_gw_src_lib-}" ] || return + +gbmc_br_gw_src_ip= +declare -A gbmc_br_gw_src_routes=() + +gbmc_br_gw_src_update() { + [ -n "$gbmc_br_gw_src_ip" ] || return + + local route + for route in "${!gbmc_br_gw_src_routes[@]}"; do + [[ "$route" != *" src $gbmc_br_gw_src_ip "* ]] || continue + echo "gBMC Bridge Updating GW source [$gbmc_br_gw_src_ip]: $route" >&2 + ip route change $route src "$gbmc_br_gw_src_ip" + unset 'gbmc_br_gw_src_routes[$route]' + done +} + +gbmc_br_gw_src_hook() { + # We only want to match default gateway routes that are dynamic + # (have an expiration time). These will be updated with our preferred + # source. + if [[ "$change" == 'route' && "$route" == 'default '*':'* ]]; then + if [[ "$route" =~ ^(.*)( +expires +[^ ]+)(.*)$ ]]; then + route="${BASH_REMATCH[1]}${BASH_REMATCH[3]}" + fi + if [ "$action" = 'add' -a -z "${gbmc_br_gw_src_routes["$route"]}" ]; then + gbmc_br_gw_src_routes["$route"]=1 + gbmc_br_gw_src_update + elif [ "$action" = 'del' -a -n "${gbmc_br_gw_src_routes["$route"]}" ]; then + unset 'gbmc_br_gw_src_routes[$route]' + gbmc_br_gw_src_update + fi + # Match only global IP addresses on the bridge that match the BMC stateless + # prefix (<mpfx>:fd00:). So 2002:af4:3480:2248:fd00:6345:3069:9186 would be + # matched as the preferred source IP for outoging traffic. + elif [ "$change" = 'addr' -a "$intf" = 'gbmcbr' -a "$scope" = 'global' ] && + [[ "$fam" == 'inet6' && "$ip" =~ ^([^:]+:){4}fd00:.*$ ]] && + [[ "$flags" != *tentative* ]]; then + if [ "$action" = 'add' -a "$ip" != "$gbmc_br_gw_src_ip" ]; then + gbmc_br_gw_src_ip="$ip" + gbmc_br_gw_src_update + fi + if [ "$action" = 'del' -a "$ip" = "$gbmc_br_gw_src_ip" ]; then + gbmc_br_gw_src_ip= + fi + fi +} + +GBMC_IP_MONITOR_HOOKS+=(gbmc_br_gw_src_hook) + +gbmc_br_gw_src_lib=1 |