Merge branch 'master' of code.ungleich.ch:uncloud/uncloud

Signed-off-by: Nico Schottelius <nico@nico-notebook.schottelius.org>

archive/uncloud_etcd_based/uncloud/hack/hackcloud/.gitignore

@@ -0,0 +1,3 @@
+*.iso
+radvdpid
+foo

archive/uncloud_etcd_based/uncloud/hack/hackcloud/__init__.py

@@ -0,0 +1 @@
+

archive/uncloud_etcd_based/uncloud/hack/hackcloud/etcd-client.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+etcdctl  --cert=$HOME/vcs/ungleich-dot-cdist/files/etcd/nico.pem \
+         --key=/home/nico/vcs/ungleich-dot-cdist/files/etcd/nico-key.pem \
+         --cacert=$HOME/vcs/ungleich-dot-cdist/files/etcd/ca.pem \
+         --endpoints https://etcd1.ungleich.ch:2379,https://etcd2.ungleich.ch:2379,https://etcd3.ungleich.ch:2379 "$@"

archive/uncloud_etcd_based/uncloud/hack/hackcloud/ifdown.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo $@

archive/uncloud_etcd_based/uncloud/hack/hackcloud/ifup.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+dev=$1; shift
+
+# bridge is setup from outside
+ip link set dev "$dev" master ${bridge}
+ip link set dev "$dev" up

archive/uncloud_etcd_based/uncloud/hack/hackcloud/mac-last

@@ -0,0 +1 @@
+000000000252

archive/uncloud_etcd_based/uncloud/hack/hackcloud/mac-prefix

@@ -0,0 +1 @@
+02:00

archive/uncloud_etcd_based/uncloud/hack/hackcloud/net.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+set -x
+
+netid=100
+dev=wlp2s0
+dev=wlp0s20f3
+#dev=wlan0
+
+ip=2a0a:e5c1:111:888::48/64
+vxlandev=vxlan${netid}
+bridgedev=br${netid}
+
+ip -6 link add ${vxlandev} type vxlan \
+    id ${netid} \
+    dstport 4789 \
+    group ff05::${netid} \
+    dev ${dev} \
+    ttl 5
+
+ip link set ${vxlandev} up
+
+
+ip link add ${bridgedev} type bridge
+ip link set ${bridgedev} up
+
+ip link set ${vxlandev} master ${bridgedev} up
+
+ip addr add ${ip} dev ${bridgedev}

archive/uncloud_etcd_based/uncloud/hack/hackcloud/nftrules

@@ -0,0 +1,31 @@
+flush ruleset
+
+table bridge filter {
+    chain prerouting {
+        type filter hook prerouting priority 0;
+        policy accept;
+
+        ibrname br100 jump br100
+    }
+
+    chain br100 {
+        # Allow all incoming traffic from outside
+        iifname vxlan100 accept
+
+        # Default blocks: router advertisements, dhcpv6, dhcpv4
+        icmpv6 type nd-router-advert drop
+        ip6 version 6 udp sport 547 drop
+        ip  version 4 udp sport 67 drop
+
+        jump br100_vmlist
+        drop
+    }
+    chain br100_vmlist {
+        # VM1
+        iifname tap1 ether saddr 02:00:f0:a9:c4:4e ip6 saddr 2a0a:e5c1:111:888:0:f0ff:fea9:c44e accept
+
+        # VM2
+        iifname v343a-0 ether saddr 02:00:f0:a9:c4:4f ip6 saddr 2a0a:e5c1:111:888:0:f0ff:fea9:c44f accept
+        iifname v343a-0 ether saddr 02:00:f0:a9:c4:4f ip6 saddr 2a0a:e5c1:111:1234::/64 accept
+    }
+}

archive/uncloud_etcd_based/uncloud/hack/hackcloud/nftrules-v2

@@ -0,0 +1,64 @@
+flush ruleset
+
+table bridge filter {
+    chain prerouting {
+        type filter hook prerouting priority 0;
+        policy accept;
+
+        ibrname br100 jump netpublic
+    }
+
+    chain netpublic {
+        iifname vxlan100 jump from_uncloud
+
+        # Default blocks: router advertisements, dhcpv6, dhcpv4
+        icmpv6 type nd-router-advert drop
+        ip6 version 6 udp sport 547 drop
+        ip  version 4 udp sport 67 drop
+
+        # Individual blocks
+#        iifname tap1 jump vm1
+    }
+
+    chain vm1 {
+        ether saddr != 02:00:f0:a9:c4:4e drop
+        ip6   saddr != 2a0a:e5c1:111:888:0:f0ff:fea9:c44e drop
+    }
+
+    chain from_uncloud {
+        accept
+    }
+}
+
+# table ip6 filter {
+#         chain forward {
+#                 type filter hook forward priority 0;
+
+#        #         policy drop;
+
+#                 ct state established,related accept;
+
+#         }
+
+# }
+
+# table ip filter {
+#         chain input {
+#                 type filter hook input priority filter; policy drop;
+#                 iif "lo" accept
+#                 icmp type { echo-reply, destination-unreachable, source-quench, redirect, echo-request, router-advertisement, router-solicitation, time-exceeded, parameter-problem, timestamp-request, timestamp-reply, info-request, info-reply, address-mask-request, address-mask-reply } accept
+#                 ct state established,related accept
+#                 tcp dport { 22 } accept
+#                 log prefix "firewall-ipv4: "
+#                 udp sport 67 drop
+#         }
+
+#         chain forward {
+#                 type filter hook forward priority filter; policy drop;
+#                 log prefix "firewall-ipv4: "
+#         }
+
+#         chain output {
+#                 type filter hook output priority filter; policy accept;
+#         }
+# }

archive/uncloud_etcd_based/uncloud/hack/hackcloud/radvd.conf

@@ -0,0 +1,13 @@
+interface br100
+{
+  AdvSendAdvert on;
+  MinRtrAdvInterval 3;
+  MaxRtrAdvInterval 5;
+  AdvDefaultLifetime 3600;
+
+  prefix 2a0a:e5c1:111:888::/64 {
+  };
+
+  RDNSS 2a0a:e5c0::3 2a0a:e5c0::4 { AdvRDNSSLifetime 6000; };
+  DNSSL place7.ungleich.ch {  AdvDNSSLLifetime 6000; } ;
+};

archive/uncloud_etcd_based/uncloud/hack/hackcloud/radvd.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+radvd -C ./radvd.conf  -n -p ./radvdpid

archive/uncloud_etcd_based/uncloud/hack/hackcloud/vm-2.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+
+vmid=$1; shift
+
+qemu=/usr/bin/qemu-system-x86_64
+
+accel=kvm
+#accel=tcg
+
+memory=1024
+cores=2
+uuid=732e08c7-84f8-4d43-9571-263db4f80080
+
+export bridge=br100
+
+$qemu -name uc${vmid} \
+      -machine pc,accel=${accel} \
+      -m ${memory} \
+      -smp ${cores} \
+      -uuid ${uuid} \
+      -drive file=alpine-virt-3.11.2-x86_64.iso,media=cdrom \
+      -drive file=alpine-virt-3.11.2-x86_64.iso,media=cdrom \
+      -netdev tap,id=netmain,script=./ifup.sh \
+      -device virtio-net-pci,netdev=netmain,id=net0,mac=02:00:f0:a9:c4:4e

archive/uncloud_etcd_based/uncloud/hack/hackcloud/vm.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# if [ $# -ne 1 ]; then
+#     echo "$0: owner"
+#     exit 1
+# fi
+
+qemu=/usr/bin/qemu-system-x86_64
+
+accel=kvm
+#accel=tcg
+
+memory=1024
+cores=2
+uuid=$(uuidgen)
+mac=$(./mac-gen.py)
+owner=nico
+
+export bridge=br100
+
+set -x
+$qemu -name "uncloud-${uuid}" \
+      -machine pc,accel=${accel} \
+      -m ${memory} \
+      -smp ${cores} \
+      -uuid ${uuid} \
+      -drive file=alpine-virt-3.11.2-x86_64.iso,media=cdrom \
+      -netdev tap,id=netmain,script=./ifup.sh,downscript=./ifdown.sh \
+      -device virtio-net-pci,netdev=netmain,id=net0,mac=${mac}