Changeset 0608d96

Timestamp:

Feb 21, 2014 11:04:53 AM (11 years ago)

Author:

Ted Faber <faber@…>

Branches:

master

Children:

ea0e8cb

Parents:

f1f9aec

Message:

Linux nat

File:

• fedd/federation/desktop_access.py (modified) (2 diffs)

fedd/federation/desktop_access.py

@@ -75 +75 @@
         if self.ospfd is None:
             self.ospfd = '/usr/local/sbin/ospfd'
+
+        # If this is a linux box that will be NATing, the iptables value
+        # must be the path of the iptables command and the nat_interface must
+        # be the nat interface.
+        self.iptables = config.get('access', 'iptables')
+        self.nat_interface = config.get('access', 'nat_interface')
 
         self.ssh_identity = None
@@ -407 +413 @@
             print >>f, 'ifconfig tap0 %s netmask 255.255.255.0 up' % \
                     my_addr
-            # self.set_route('10.0.0.0/8', f, exp_peer)
             print >>f, '%s -d -f %s' % (self.zebra, zebra_conf)
             print >>f, '%s -d -f %s' % (self.ospfd, ospfd_conf)
+            if self.iptables is not None and self.nat_interface is not None:
+                print >>f, '%s -t nat -A POSTROUTING -o %s -j MASQUERADE' %\
+                        (self.iptables, self.nat_interface)
+                print >>f, ('%s -A FORWARD -i %s -o tap0 -m state ' +
+                    '--state RELATED,ESTABLISHED -j ACCEPT') % \
+                            (self.iptables, self.nat_interface)
+                print >>f, '%s -A FORWARD -i tap0 -o %s -j ACCEPT' % \
+                        (self.iptables, self.nat_interface)
             f.close()
             os.chmod(cscript, 0755)
             f = open(dscript, 'w')
             print >>f, '#!/bin/sh'
+            if self.iptables is not None and self.nat_interface is not None:
+                print >>f, '%s -t nat -D POSTROUTING -o %s -j MASQUERADE' %\
+                        (self.iptables, self.nat_interface)
+                print >>f, ('%s -D FORWARD -i %s -o tap0 -m state ' +
+                    '--state RELATED,ESTABLISHED -j ACCEPT') % \
+                            (self.iptables, self.nat_interface)
+                print >>f, '%s -D FORWARD -i tap0 -o %s -j ACCEPT' % \
+                        (self.iptables, self.nat_interface)
+            # Linux ?
             print >>f, 'ifconfig tap0 destroy'
             self.unset_route(peer, f)
-            #self.unset_route('10.0.0.0/8', f)
             print >>f, 'mv /etc/hosts.DETER.fedd.hold /etc/hosts'
             print >>f, 'kill `cat /var/run/quagga/ospfd.pid`'
             print >>f, 'kill `cat /var/run/quagga/zebra.pid`'
+            if self.iptables is not None and self.nat_interface is not None:
+                print >>f, '%s -t nat -D POSTROUTING -o %s -j MASQUERADE' %\
+                        (self.iptables, self.nat_interface)
+                print >>f, ('%s -D FORWARD -i %s -o tap0 -m state ' +
+                    '--state RELATED,ESTABLISHED -j ACCEPT') % \
+                            (self.iptables, self.nat_interface)
+                print >>f, '%s -D FORWARD -i tap0 -o %s -j ACCEPT' % \
+                        (self.iptables, self.nat_interface)
             f.close()
             os.chmod(dscript, 0755)