source: fedkit/fed-tun.pl @ b814529

axis_examplecompt_changesinfo-opsversion-1.30version-2.00version-3.01version-3.02
Last change on this file since b814529 was d501c38, checked in by Kevin Lahey <lahey@…>, 17 years ago

Tweaks to ensure that the tap interface is up before we configure the
tunnel.

  • Property mode set to 100755
File size: 8.6 KB
Line 
1#!/usr/bin/perl -w
2
3# Kevin Lahey, lahey@isi.edu
4# July 11, 2007
5
6# Set up ssh tunnel infrastructure for federation:
7#
8# * Parse the configuration file provided.
9#
10# * Figure out whether we're the initiator or the reciever;  if we're
11#   the receiver, we just need to set up ssh keys and exit.
12#
13# * Pick out the experimental interface, remove the IP address
14#
15# * Create a layer 2 ssh tunnel, set up bridging, and hang loose.
16
17use strict;
18use Getopt::Std;
19use POSIX qw(strftime);
20use Sys::Hostname;
21use IO::File;
22
23my $IFCONFIG = "/sbin/ifconfig";
24my $TMCC = "/usr/local/etc/emulab/tmcc";
25my $SSH = "/usr/local/bin/ssh";
26my $NC = "/usr/bin/nc";
27my $SSH_PORT = 22;
28
29sub setup_bridging;
30sub setup_tunnel_cfg;
31sub parse_config;
32
33# Option use is as follows:
34#    -f         filename containing config file
35#    -d         turn on debugging output
36#    -r         remotely invoked
37#               (if remotely invoked the last two args are the tun interface
38#               number and the remote address of the tunnel)
39
40my $usage = "Usage: fed-tun.pl [-r] [-d] [-f config-filename] [count addr]\n";
41
42my %opts;
43my @expected_opts = qw(active tunnelcfg bossname fsname type
44                       peer pubkeys privkeys);
45my $filename;
46my $remote;
47my $debug = 1;
48my $count;
49my $addr;
50my $active;
51my $type;
52my $tunnelcfg;
53my $ssh_port_fwds = "";
54my $remote_script_dir;          # location of the other sides fed-tun.pl
55
56if ($#ARGV != 0 && !getopts('df:r', \%opts)) {
57    die "$usage";
58}
59
60if (defined($opts{'d'})) {
61    $debug = 1;
62}
63
64if (defined($opts{'f'})) {
65    $filename = $opts{'f'};
66}
67
68if (defined($opts{'r'})) {
69    $remote = 1;
70    die "$usage" if ($#ARGV != 1);
71   
72    $count = pop @ARGV;
73    $addr = pop @ARGV;
74}
75
76die "$usage" if (!defined($remote) && !defined($filename));
77
78if (defined($filename)) {
79    &parse_config("$filename", \%opts) || 
80        die "Cannot read config file $filename: $!\n";
81
82    foreach my $opt (@expected_opts) {
83        warn "Missing $opt option\n" if (!defined($opts{$opt}));
84    }
85
86    $active = 1 if ($opts{'active'} =~ /true/i);
87    $tunnelcfg = 1 if ($opts{'tunnelcfg'} =~ /true/i);
88    $type = $opts{'type'};
89    $type =~ tr/A-Z/a-z/;
90    $remote_script_dir = $opts{'remotescriptdir'} || ".";
91
92    if (defined($opts{'fsname'})) {
93        $ssh_port_fwds = "-R :139:$opts{'fsname'}:139 ";
94    }
95
96    if (defined($opts{'bossname'})) {
97        $ssh_port_fwds .= "-R :7777:$opts{'bossname'}:7777 ";
98    }
99
100    $ssh_port_fwds = "" if ($opts{'type'} eq 'experiment');
101
102    print "ssh_port_fwds = $ssh_port_fwds\n" if ($debug);
103}
104
105# Need these to make the Ethernet tap and bridge to work...
106
107system("kldload /boot/kernel/if_bridge.ko");
108system("kldload /boot/kernel/if_tap.ko");
109
110if ($tunnelcfg && !$remote) {
111    # Most Emulab-like testbeds use globally-routable addresses on the
112    # control net;  at DETER, we isolate the control net from the Internet.
113    # On DETER-like testbeds, we need to create special tunneling nodes
114    # with external access.  Set up the external addresses as necessary.
115    &setup_tunnel_cfg(%opts);
116}
117
118if (!$remote) {
119    system("umask 077 && cp $opts{'privkeys'} /root/.ssh/id_rsa");
120    system("umask 077 && cp $opts{'pubkeys'} /root/.ssh/id_rsa.pub");
121    system("umask 077 && cat $opts{'pubkeys'} >> /root/.ssh/authorized_keys");
122}
123
124if ($active) {
125    # If we're the initiator, open up a separate tunnel to the remote
126    # host for each of the different experiment net interfaces on this
127    # machine.  Execute this startup script on the far end, but with
128    # the -r option to indicate that it's getting invoked remotely and
129    # we should just handle the remote-end tasks.
130
131    # Set up synchronization, so that the various user machines won't try to
132    # contact boss before the tunnels are set up.  (Thanks jjh!)
133
134    do {
135        system("$NC -z $opts{'peer'} $SSH_PORT");
136    } until (!$?);
137
138    # XXX:  Do we need to clear out previously created bridge interfaces?
139
140    my $count = 0;
141    my @SSHCMD;
142
143    # If we are just setting up a control net connection, just fire up
144    # ssh with the null command, and hang loose.
145
146    if ($type eq "control") {
147        system("$SSH $ssh_port_fwds -Nno \"StrictHostKeyChecking no\" $opts{'peer'} &"); #or die "Failed to run ssh";
148
149        exit;
150    }
151
152    open(IFFILE, "/var/emulab/boot/ifmap") || die "couldn't open ifmap\n";
153    while (<IFFILE>) {
154        my @a = split(' ');
155        my $iface = $a[0];
156        my $addr = $a[1];
157        my $bridge = "bridge" . $count;
158        my $tun = "tap" . $count;
159
160        print "Found $iface, $addr, to bridge on $bridge\n" if ($debug);
161
162        # Note that we're going to fire off an ssh which will never return;
163        # we need the connection to stay up to keep the tunnel up.
164        # In order to check for problems, we open it this way and read
165        # the expected single line of output when the tunnel is connected.
166
167        open($SSHCMD[$count], "$SSH -w $count:$count $ssh_port_fwds -o \"StrictHostKeyChecking no\" $opts{'peer'}  \"$remote_script_dir/fed-tun.pl -r $addr $count\" |") or die "Failed to run ssh";
168
169        my $check = <$SSHCMD[$count]>;  # Make sure something ran...
170        print "Got line [$check] from remote side\n" if ($debug);
171
172        &setup_bridging($tun, $bridge, $iface, $addr);
173        $count++;
174        $ssh_port_fwds = "";  # only do this on the first connection
175    }
176    close(IFFILE);
177} elsif ($remote) {
178    # We're on the remote system;  for now, we just grab and use
179    # the one experimental interface.  Later, we'll actually look
180    # at the address passed to match up the appropriate interfaces.
181
182    my $iter = 0;
183
184    open(IFFILE, "/var/emulab/boot/ifmap") || die "couldn't open ifmap\n";
185    while (<IFFILE>) {
186        die "Argh, too many experimental interfaces!" if ($iter > 0);
187        my @a = split(' ');
188        my $iface = $a[0];
189        my $addr = $a[1];
190        my $bridge = "bridge" . $count;
191        my $tun = "tap" . $count;
192
193        &setup_bridging($tun, $bridge, $iface, $addr);
194        $iter++;
195    }
196    close(IFFILE);
197
198    print "Remote connection all set up!\n";  # Trigger other end with output
199} else {
200    print "inactive end of a connection, finishing" if ($debug);
201}
202
203print "all done!\n" if ($debug);
204exit;
205
206
207# Set up the bridging for the new stuff...
208
209sub setup_bridging($; $; $; $) {
210    my ($tun, $bridge, $iface, $addr) = @_;
211
212    print "Waiting to see if new iface $tun is up\n" if ($debug);
213
214    do {
215        sleep 1;
216        system("$IFCONFIG $tun");
217    } until (!$?);
218
219    print "setting up $bridge with $iface and nuking $addr\n" if ($debug);
220
221    system("ifconfig $bridge create");
222    system("ifconfig $iface delete $addr");
223    system("ifconfig $bridge addm $iface up");
224    system("ifconfig $bridge addm $tun");
225}
226
227# Set up tunnel info for DETER-like testbeds.
228
229sub setup_tunnel_cfg {
230    my (%opts) = @_;
231    my $tunnel_iface = "em0";   # XXX
232    my $tunnel_ip;
233    my $tunnel_mask;
234    my $tunnel_mac;
235    my $tunnel_router;
236
237    print "Opening $TMCC tunnelip\n" if ($debug);
238
239    open(TMCD, "$TMCC tunnelip |") || die "tmcc failed\n";
240    print "Opened $TMCC tunnelip\n" if ($debug);
241    while (<TMCD>) {
242        print "got one line from tmcc\n" if ($debug);
243        print if ($debug);
244        if (/^TUNNELIP=([0-9.]*) TUNNELMASK=([0-9.]*) TUNNELMAC=(\w*) TUNNELROUTER=([0-9.]*)$/) {
245            $tunnel_ip = $1;
246            $tunnel_mask = $2;
247            $tunnel_mac = $3;
248            $tunnel_router = $4;
249        }
250    }
251    close(TMCD);
252
253    die "Unable to determine tunnel node configuration information"
254        if (!defined($tunnel_router));
255
256    print "tunnel options:  ip=$tunnel_ip mask=$tunnel_mask mac=$tunnel_mac router=$tunnel_router\n" if ($debug);
257
258    # Sadly, we ignore the tunnel mac for now -- we should eventually
259    # use it to determine which interface to use, just like the
260    # Emulab startup scripts.
261
262    system("ifconfig $tunnel_iface $tunnel_ip" .
263           ($tunnel_mask ? " netmask $tunnel_mask" : ""));
264    warn "configuration of tunnel interface failed" if ($?);
265       
266    system("route add $opts{'peer'} $tunnel_router");
267    warn "configuration routes via tunnel interface failed" if ($?);
268
269    print "setup_tunnel_cfg done\n" if ($debug);
270}
271
272# Trick config-file parsing code from Ted Faber:
273
274# Parse the config file.  The format is a colon-separated parameter name
275# followed by the value of that parameter to the end of the line.  This parses
276# that format and puts the parameters into the referenced hash.  Parameter
277# names are mapped to lower case, parameter values are unchanged.  Returns 0 on
278# failure (e.g. file open) and 1 on success.
279sub parse_config {
280    my($file, $href) = @_;
281    my($fh) = new IO::File($file);
282       
283    unless ($fh) {
284        warn "Can't open $file: $!\n";
285        return 0;
286    }
287
288    while (<$fh>) {
289        next if /^\s*#/ || /^\s*$/;     # Skip comments & blanks
290        chomp;
291        /^([^:]+):\s*(.*)/ && do {
292            my($key) = $1; 
293
294            $key =~ tr/A-Z/a-z/;
295            $href->{$key} = $2;
296            next;
297        };
298        warn "Unparasble line in $file: $_\n";
299    }
300    $fh->close();   # It will close when it goes out of scope, but...
301    return 1;
302}
Note: See TracBrowser for help on using the repository browser.