1 | #!/usr/bin/perl -w |
---|
2 | |
---|
3 | # Kevin Lahey, lahey@isi.edu |
---|
4 | # July 11, 2007 |
---|
5 | |
---|
6 | # Set up ssh tunnel infrastructure for federation: |
---|
7 | # |
---|
8 | # * Parse the configuration file provided. |
---|
9 | # |
---|
10 | # * Figure out whether we're the initiator or the reciever; if we're |
---|
11 | # the receiver, we just need to set up ssh keys and exit. |
---|
12 | # |
---|
13 | # * Pick out the experimental interface, remove the IP address |
---|
14 | # |
---|
15 | # * Create a layer 2 ssh tunnel, set up bridging, and hang loose. |
---|
16 | # |
---|
17 | |
---|
18 | use strict; |
---|
19 | use Getopt::Std; |
---|
20 | use POSIX qw(strftime); |
---|
21 | use Sys::Hostname; |
---|
22 | use IO::File; |
---|
23 | use File::Copy; |
---|
24 | |
---|
25 | my $IFCONFIG = "/sbin/ifconfig"; |
---|
26 | my $TMCC = "/usr/local/etc/emulab/tmcc"; |
---|
27 | # If a special version of ssh is required, it will be installed in |
---|
28 | # /usr/local/bin/ssh. Otherwise use the usual one. |
---|
29 | my $SSH = -x "/usr/local/bin/ssh" ? "/usr/local/bin/ssh" : "/usr/bin/ssh"; |
---|
30 | my $NC = "/usr/bin/nc"; |
---|
31 | my $SSH_PORT = 22; |
---|
32 | my $ROUTE_GET = "/sbin/route get"; # XXX: works on FreeBSD, but should |
---|
33 | # should be 'ip route get' for Linux |
---|
34 | my $sshd_config = "/etc/ssh/sshd_config"; # Probably should be a param |
---|
35 | |
---|
36 | # Ports that are forwarded between testbeds |
---|
37 | my $TMCD_PORT = 7777; |
---|
38 | my $SMBFS_PORT = 139; |
---|
39 | my $PUBSUB_PORT = 16505; |
---|
40 | my $SEER_PORT = 16606; |
---|
41 | |
---|
42 | |
---|
43 | my $remote_pubsub_port = $PUBSUB_PORT - 1; # There will be a local |
---|
44 | # pubsubd running, so we |
---|
45 | # dodge the port on the |
---|
46 | # remote tunnel node. |
---|
47 | die "Cannot exec $SSH" unless -x $SSH; |
---|
48 | |
---|
49 | sub setup_bridging; |
---|
50 | sub setup_tunnel_cfg; |
---|
51 | sub parse_config; |
---|
52 | |
---|
53 | # Option use is as follows: |
---|
54 | # -f filename containing config file |
---|
55 | # -d turn on debugging output |
---|
56 | # -r remotely invoked |
---|
57 | # (if remotely invoked the last two args are the tun interface |
---|
58 | # number and the remote address of the tunnel) |
---|
59 | |
---|
60 | my $usage = "Usage: fed-tun.pl [-r] [-d] [-f config-filename] [count addr]\n"; |
---|
61 | |
---|
62 | my %opts; # Note that this is used for both getops and the options file |
---|
63 | my @expected_opts = qw(active tunnelcfg bossname fsname type |
---|
64 | peer pubkeys privkeys); |
---|
65 | my $filename; |
---|
66 | my $remote; |
---|
67 | my $debug = 1; |
---|
68 | my $count; |
---|
69 | my $addr; |
---|
70 | my $active; |
---|
71 | my $type; |
---|
72 | my $tunnelcfg; |
---|
73 | my @ssh_port_fwds; # Queue of ssh portforwarders to start. The |
---|
74 | # -L or -R is in here. |
---|
75 | my $remote_script_dir; # location of the other sides fed-tun.pl |
---|
76 | my $event_repeater; # The pathname of the event repeater |
---|
77 | my $remote_config_file; # Config file for the other side |
---|
78 | |
---|
79 | if ($#ARGV != 0 && !getopts('df:rn', \%opts)) { |
---|
80 | die "$usage"; |
---|
81 | } |
---|
82 | |
---|
83 | if (defined($opts{'d'})) { |
---|
84 | $debug = 1; |
---|
85 | } |
---|
86 | |
---|
87 | if (defined($opts{'f'})) { |
---|
88 | $filename = $opts{'f'}; |
---|
89 | } |
---|
90 | |
---|
91 | if (defined($opts{'r'})) { |
---|
92 | $remote = 1; |
---|
93 | die "$usage" if ($#ARGV != 1); |
---|
94 | |
---|
95 | $count = pop @ARGV; |
---|
96 | $addr = pop @ARGV; |
---|
97 | } |
---|
98 | |
---|
99 | die "$usage" if (!defined($remote) && !defined($filename)); |
---|
100 | |
---|
101 | if (defined($filename)) { |
---|
102 | &parse_config("$filename", \%opts) || |
---|
103 | die "Cannot read config file $filename: $!\n"; |
---|
104 | |
---|
105 | foreach my $opt (@expected_opts) { |
---|
106 | warn "Missing $opt option\n" if (!defined($opts{$opt})); |
---|
107 | } |
---|
108 | |
---|
109 | $active = 1 if ($opts{'active'} =~ /true/i); |
---|
110 | $tunnelcfg = 1 if ($opts{'tunnelcfg'} =~ /true/i); |
---|
111 | $type = $opts{'type'}; |
---|
112 | $type =~ tr/A-Z/a-z/; |
---|
113 | $remote_script_dir = $opts{'remotescriptdir'} || "."; |
---|
114 | $event_repeater = $opts{'eventrepeater'}; |
---|
115 | $remote_config_file = $opts{'remoteconfigfile'}; |
---|
116 | $remote_config_file = "-f $remote_config_file" if $remote_config_file; |
---|
117 | |
---|
118 | if (defined($opts{'fsname'})) { |
---|
119 | push(@ssh_port_fwds,"-R :$SMBFS_PORT:$opts{'fsname'}:$SMBFS_PORT"); |
---|
120 | } |
---|
121 | |
---|
122 | if (defined($opts{'bossname'})) { |
---|
123 | push(@ssh_port_fwds, "-R :$TMCD_PORT:$opts{'bossname'}:$TMCD_PORT"); |
---|
124 | } |
---|
125 | |
---|
126 | if (defined($opts{'eventservername'})) { |
---|
127 | push(@ssh_port_fwds,"-R ". |
---|
128 | ":$remote_pubsub_port:$opts{'eventservername'}:$PUBSUB_PORT"); |
---|
129 | } |
---|
130 | if (defined($opts{'remoteeventservername'})) { |
---|
131 | push(@ssh_port_fwds,"-L :$remote_pubsub_port:" . |
---|
132 | "$opts{'remoteeventservername'}:$PUBSUB_PORT"); |
---|
133 | } |
---|
134 | |
---|
135 | # Forward connections to seer from remote TBs to control in this TB |
---|
136 | if (defined($opts{'seercontrol'})) { |
---|
137 | push(@ssh_port_fwds,"-R :$SEER_PORT:$opts{seercontrol}:$SEER_PORT"); |
---|
138 | } |
---|
139 | |
---|
140 | # -n just starts the ssh tap tunnel |
---|
141 | @ssh_port_fwds = () if ($opts{'type'} eq 'experiment' || $opts{'n'}); |
---|
142 | |
---|
143 | print "ssh_port_fwds = ", join("\n",@ssh_port_fwds), "\n" if ($debug); |
---|
144 | } |
---|
145 | |
---|
146 | # Both sides need to have GatewayPorts and PermitTunnel set. Copy the existing |
---|
147 | # sshd_config, making sure GatewayPorts and PermitTunnel are set to yes, |
---|
148 | # replace the original, and restart sshd. |
---|
149 | my $ports_on = 0; |
---|
150 | my $tunnel_on = 0; |
---|
151 | |
---|
152 | my $conf = new IO::File($sshd_config) || die "Can't open $sshd_config: $!\n"; |
---|
153 | my $new_conf = new IO::File(">/tmp/sshd_config") || |
---|
154 | die "Can't open new ssh_config: $!\n"; |
---|
155 | |
---|
156 | while(<$conf>) { |
---|
157 | s/^\s*GatewayPorts.*/GatewayPorts yes/ && do { |
---|
158 | print $new_conf $_ unless $ports_on++; |
---|
159 | next; |
---|
160 | }; |
---|
161 | s/^\s*PermitTunnel.*/PermitTunnel yes/ && do { |
---|
162 | print $new_conf $_ unless $tunnel_on++; |
---|
163 | next; |
---|
164 | }; |
---|
165 | print $new_conf $_; |
---|
166 | } |
---|
167 | print $new_conf "GatewayPorts yes\n" unless $ports_on; |
---|
168 | print $new_conf "PermitTunnel yes\n" unless $tunnel_on; |
---|
169 | $conf->close(); |
---|
170 | $new_conf->close(); |
---|
171 | |
---|
172 | copy("/tmp/sshd_config", $sshd_config) || |
---|
173 | die "Cannot replace $sshd_config: $!\n"; |
---|
174 | |
---|
175 | system("/etc/rc.d/sshd restart"); |
---|
176 | |
---|
177 | # Need these to make the Ethernet tap and bridge to work... |
---|
178 | system("kldload /boot/kernel/bridgestp.ko") |
---|
179 | if -r "/boot/kernel/bridgestp.ko"; |
---|
180 | system("kldload /boot/kernel/if_bridge.ko"); |
---|
181 | system("kldload /boot/kernel/if_tap.ko"); |
---|
182 | |
---|
183 | if ($tunnelcfg && !$remote) { |
---|
184 | # Most Emulab-like testbeds use globally-routable addresses on the |
---|
185 | # control net; at DETER, we isolate the control net from the Internet. |
---|
186 | # On DETER-like testbeds, we need to create special tunneling nodes |
---|
187 | # with external access. Set up the external addresses as necessary. |
---|
188 | &setup_tunnel_cfg(%opts); |
---|
189 | } |
---|
190 | |
---|
191 | if (!$remote) { |
---|
192 | system("umask 077 && cp $opts{'privkeys'} /root/.ssh/id_rsa"); |
---|
193 | system("umask 077 && cp $opts{'pubkeys'} /root/.ssh/id_rsa.pub"); |
---|
194 | system("umask 077 && cat $opts{'pubkeys'} >> /root/.ssh/authorized_keys"); |
---|
195 | } |
---|
196 | |
---|
197 | if ($active) { |
---|
198 | # If we're the initiator, open up a separate tunnel to the remote |
---|
199 | # host for each of the different experiment net interfaces on this |
---|
200 | # machine. Execute this startup script on the far end, but with |
---|
201 | # the -r option to indicate that it's getting invoked remotely and |
---|
202 | # we should just handle the remote-end tasks. |
---|
203 | |
---|
204 | # Set up synchronization, so that the various user machines won't try to |
---|
205 | # contact boss before the tunnels are set up. (Thanks jjh!) |
---|
206 | |
---|
207 | do { |
---|
208 | system("$NC -z $opts{'peer'} $SSH_PORT"); |
---|
209 | } until (!$?); |
---|
210 | |
---|
211 | # XXX: Do we need to clear out previously created bridge interfaces? |
---|
212 | |
---|
213 | my $count = 0; |
---|
214 | my @SSHCMD; |
---|
215 | |
---|
216 | # If we are just setting up a control net connection, just fire up |
---|
217 | # ssh with the null command, and hang loose. |
---|
218 | |
---|
219 | if ($type eq "control") { |
---|
220 | foreach my $fwd (@ssh_port_fwds) { |
---|
221 | system("$SSH -N $fwd -Nno \"StrictHostKeyChecking no\" ". |
---|
222 | "$opts{'peer'} &"); #or die "Failed to run ssh"; |
---|
223 | } |
---|
224 | |
---|
225 | exit; |
---|
226 | } |
---|
227 | |
---|
228 | open(IFFILE, "/var/emulab/boot/ifmap") || die "couldn't open ifmap\n"; |
---|
229 | while (<IFFILE>) { |
---|
230 | my @a = split(' '); |
---|
231 | my $iface = $a[0]; |
---|
232 | my $addr = $a[1]; |
---|
233 | my $bridge = "bridge" . $count; |
---|
234 | my $tun = "tap" . $count; |
---|
235 | my $cmd; |
---|
236 | |
---|
237 | print "Found $iface, $addr, to bridge on $bridge\n" if ($debug); |
---|
238 | |
---|
239 | # Note that we're going to fire off an ssh which will never return; |
---|
240 | # we need the connection to stay up to keep the tunnel up. |
---|
241 | # In order to check for problems, we open it this way and read |
---|
242 | # the expected single line of output when the tunnel is connected. |
---|
243 | # To make debugging easier and to degrade more gracefully, I've split |
---|
244 | # these out into multiple processes. |
---|
245 | |
---|
246 | foreach my $fwd (@ssh_port_fwds) { |
---|
247 | $cmd = "$SSH -N $fwd -o \"StrictHostKeyChecking no\" ". |
---|
248 | "$opts{'peer'} &"; |
---|
249 | |
---|
250 | print "$cmd\n" if $debug; |
---|
251 | system("$cmd"); # or die "Failed to run ssh"; |
---|
252 | } |
---|
253 | # The Tunnel option specifies the level to tunnel at. Ethernet creates |
---|
254 | # a tap device rather than a tun device. Strict host key checking |
---|
255 | # avoids asking the user to OK a strange host key. |
---|
256 | $cmd = "$SSH -w $count:$count -o \"Tunnel ethernet\" " . |
---|
257 | "-o \"StrictHostKeyChecking no\" " . |
---|
258 | "$opts{'peer'} \"$remote_script_dir/fed-tun.pl " . |
---|
259 | "$remote_config_file -r $addr $count\" & |"; |
---|
260 | |
---|
261 | print "$cmd\n" if $debug; |
---|
262 | |
---|
263 | open(SSHCMD, $cmd) |
---|
264 | or die "Failed to run ssh"; |
---|
265 | # Wait for the other end to report its work done. This string comes |
---|
266 | # from the block below (after the elsif) -- tvf |
---|
267 | my $check; # Make sure something ran... |
---|
268 | |
---|
269 | while ($check = <SSHCMD>) { |
---|
270 | last if $check =~ /^Remote connection all/; |
---|
271 | } |
---|
272 | print "Got line [$check] from remote side\n" if ($debug); |
---|
273 | |
---|
274 | &setup_bridging($tun, $bridge, $iface, $addr); |
---|
275 | $count++; |
---|
276 | @ssh_port_fwds = (); # only do this on the first connection |
---|
277 | } |
---|
278 | close(IFFILE); |
---|
279 | |
---|
280 | # Start a local event repeater (unless we're missing parameters |
---|
281 | die "Missing event repeater params (No config file ?)\n" |
---|
282 | unless $event_repeater && $opts{'remoteexperiment'} && |
---|
283 | $opts{'localexperiment'}; |
---|
284 | |
---|
285 | print "Starting event repeater\n" if $debug; |
---|
286 | |
---|
287 | print("$event_repeater -M -P $remote_pubsub_port -S localhost " . |
---|
288 | "-E $opts{'remoteexperiment'} -e $opts{'localexperiment'}\n") |
---|
289 | if $debug; |
---|
290 | # Connect to the forwarded pubsub port on this host to listen to the |
---|
291 | # other experiment's events, and to the local experiment to forward |
---|
292 | # events. |
---|
293 | system("$event_repeater -M -P $remote_pubsub_port -S localhost " . |
---|
294 | "-E $opts{'remoteexperiment'} -e $opts{'localexperiment'}"); |
---|
295 | warn "Event repeater returned $?\n" if $?; |
---|
296 | } elsif ($remote) { |
---|
297 | # We're on the remote system; figure out which interface to |
---|
298 | # tweak, based on the IP address passed in. |
---|
299 | |
---|
300 | my $iter = 0; |
---|
301 | my $iface; |
---|
302 | |
---|
303 | open(RTFILE, "$ROUTE_GET $addr |") || die "couldn't do $ROUTE_GET\n"; |
---|
304 | while (<RTFILE>) { |
---|
305 | if (/interface: (\w+)/) { |
---|
306 | $iface = $1; |
---|
307 | } |
---|
308 | } |
---|
309 | close(RTFILE); |
---|
310 | |
---|
311 | die "Couldn't find interface to use." if (!defined($iface)); |
---|
312 | my $bridge = "bridge" . $count; |
---|
313 | my $tun = "tap" . $count; |
---|
314 | |
---|
315 | &setup_bridging($tun, $bridge, $iface, $addr); |
---|
316 | print "Remote connection all set up!\n"; # Trigger other end with output |
---|
317 | |
---|
318 | # If this is the first remote invocation on a control gateway, start the |
---|
319 | # event repeater. |
---|
320 | |
---|
321 | if ( $count == 0 && $type ne "experiment" ) { |
---|
322 | my $remote_pubsub_port = $PUBSUB_PORT - 1; # There will be a local |
---|
323 | # pubsubd running, so we |
---|
324 | # dodge the port on the |
---|
325 | # remote tunnel node. |
---|
326 | # Make sure we have the relevant parameters |
---|
327 | die "Missing event repeater params (No config file ?)\n" |
---|
328 | unless $event_repeater && $opts{'remoteexperiment'} && |
---|
329 | $opts{'localexperiment'}; |
---|
330 | |
---|
331 | print "Starting event repeater\n" if $debug; |
---|
332 | |
---|
333 | # Connect to the forwarded pubsub port on this host to listen to the |
---|
334 | # other experiment's events, and to the local experiment to forward |
---|
335 | # events. |
---|
336 | system("$event_repeater -P $remote_pubsub_port -S localhost " . |
---|
337 | "-E $opts{'remoteexperiment'} -e $opts{'localexperiment'}"); |
---|
338 | warn "Event repeater returned $?\n" if $?; |
---|
339 | } |
---|
340 | } else { |
---|
341 | print "inactive end of a connection, finishing" if ($debug); |
---|
342 | } |
---|
343 | |
---|
344 | print "all done!\n" if ($debug); |
---|
345 | exit; |
---|
346 | |
---|
347 | |
---|
348 | # Set up the bridging for the new stuff... |
---|
349 | |
---|
350 | sub setup_bridging($; $; $; $) { |
---|
351 | my ($tun, $bridge, $iface, $addr) = @_; |
---|
352 | |
---|
353 | print "Waiting to see if new iface $tun is up\n" if ($debug); |
---|
354 | |
---|
355 | do { |
---|
356 | sleep 1; |
---|
357 | system("$IFCONFIG $tun"); |
---|
358 | } until (!$?); |
---|
359 | |
---|
360 | print "setting up $bridge with $iface and nuking $addr\n" if ($debug); |
---|
361 | |
---|
362 | system("ifconfig $bridge create"); |
---|
363 | system("ifconfig $iface delete $addr"); |
---|
364 | system("ifconfig $bridge addm $iface up"); |
---|
365 | system("ifconfig $bridge addm $tun"); |
---|
366 | } |
---|
367 | |
---|
368 | # Set up tunnel info for DETER-like testbeds. |
---|
369 | |
---|
370 | sub setup_tunnel_cfg { |
---|
371 | my (%opts) = @_; |
---|
372 | my $tunnel_iface = "em0"; # XXX |
---|
373 | my $tunnel_ip; |
---|
374 | my $tunnel_mask; |
---|
375 | my $tunnel_mac; |
---|
376 | my $tunnel_router; |
---|
377 | |
---|
378 | print "Opening $TMCC tunnelip\n" if ($debug); |
---|
379 | |
---|
380 | open(TMCD, "$TMCC tunnelip |") || die "tmcc failed\n"; |
---|
381 | print "Opened $TMCC tunnelip\n" if ($debug); |
---|
382 | while (<TMCD>) { |
---|
383 | print "got one line from tmcc\n" if ($debug); |
---|
384 | print if ($debug); |
---|
385 | if (/^TUNNELIP=([0-9.]*) TUNNELMASK=([0-9.]*) TUNNELMAC=(\w*) TUNNELROUTER=([0-9.]*)$/) { |
---|
386 | $tunnel_ip = $1; |
---|
387 | $tunnel_mask = $2; |
---|
388 | $tunnel_mac = $3; |
---|
389 | $tunnel_router = $4; |
---|
390 | } |
---|
391 | } |
---|
392 | close(TMCD); |
---|
393 | |
---|
394 | die "Unable to determine tunnel node configuration information" |
---|
395 | if (!defined($tunnel_router)); |
---|
396 | |
---|
397 | print "tunnel options: ip=$tunnel_ip mask=$tunnel_mask mac=$tunnel_mac router=$tunnel_router\n" if ($debug); |
---|
398 | |
---|
399 | # Sadly, we ignore the tunnel mac for now -- we should eventually |
---|
400 | # use it to determine which interface to use, just like the |
---|
401 | # Emulab startup scripts. |
---|
402 | |
---|
403 | system("ifconfig $tunnel_iface $tunnel_ip" . |
---|
404 | ($tunnel_mask ? " netmask $tunnel_mask" : "") . " up"); |
---|
405 | warn "configuration of tunnel interface failed" if ($?); |
---|
406 | |
---|
407 | # Sometimes the insertion of DNS names lags a bit. Retry this |
---|
408 | # configuration a few times to let DNS catch up. Might want to really |
---|
409 | # check the DNS name before we try this... |
---|
410 | my $config_succeeded = 0; |
---|
411 | my $tries = 0; |
---|
412 | my $max_retries = 30; |
---|
413 | |
---|
414 | do { |
---|
415 | system("route add $opts{'peer'} $tunnel_router"); |
---|
416 | if ( $? ) { |
---|
417 | warn "configuration routes via tunnel interface failed"; |
---|
418 | $tries++; |
---|
419 | sleep(10); |
---|
420 | } |
---|
421 | else { $config_succeeded = 1; } |
---|
422 | } until ( $config_succeeded || $tries > $max_retries ); |
---|
423 | |
---|
424 | print "setup_tunnel_cfg done\n" if ($debug); |
---|
425 | } |
---|
426 | |
---|
427 | # Trick config-file parsing code from Ted Faber: |
---|
428 | |
---|
429 | # Parse the config file. The format is a colon-separated parameter name |
---|
430 | # followed by the value of that parameter to the end of the line. This parses |
---|
431 | # that format and puts the parameters into the referenced hash. Parameter |
---|
432 | # names are mapped to lower case, parameter values are unchanged. Returns 0 on |
---|
433 | # failure (e.g. file open) and 1 on success. |
---|
434 | sub parse_config { |
---|
435 | my($file, $href) = @_; |
---|
436 | my($fh) = new IO::File($file); |
---|
437 | |
---|
438 | unless ($fh) { |
---|
439 | warn "Can't open $file: $!\n"; |
---|
440 | return 0; |
---|
441 | } |
---|
442 | |
---|
443 | while (<$fh>) { |
---|
444 | next if /^\s*#/ || /^\s*$/; # Skip comments & blanks |
---|
445 | chomp; |
---|
446 | /^([^:]+):\s*(.*)/ && do { |
---|
447 | my($key) = $1; |
---|
448 | |
---|
449 | $key =~ tr/A-Z/a-z/; |
---|
450 | $href->{$key} = $2; |
---|
451 | next; |
---|
452 | }; |
---|
453 | warn "Unparasble line in $file: $_\n"; |
---|
454 | } |
---|
455 | $fh->close(); # It will close when it goes out of scope, but... |
---|
456 | return 1; |
---|
457 | } |
---|