From c7cf070fb94fe7f8c94cac9014df438075bfc64e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexander=20B=C3=B6hm?= Date: Mon, 20 Dec 2021 19:35:06 +0100 Subject: [PATCH] WIP --- .env | 32 ++++++++ .gitignore | 2 + Vagrantfile | 152 +++++++++++++++++++++++++++++++++++ batman/Dockerfile | 34 ++++++-- batman/entry-point.sh | 54 +++++++++---- docker-compose.yml | 28 ++++--- playbook.yml | 179 ++++++++++++++++++++++++++++++++++++++++++ requirements.yml | 3 + restart.sh | 5 ++ 9 files changed, 454 insertions(+), 35 deletions(-) create mode 100644 .env create mode 100644 .gitignore create mode 100644 Vagrantfile create mode 100644 playbook.yml create mode 100644 requirements.yml create mode 100755 restart.sh diff --git a/.env b/.env new file mode 100644 index 0000000..b326759 --- /dev/null +++ b/.env @@ -0,0 +1,32 @@ +BATMAN_BRIDGE_IPV4=172.29.0.1/24 +BATMAN_BRIDGE_IPV6=fc00:1234:5678::1/24 +BATMAN_BRIDGE=br-batman0 +BATMAN_FORWARD_GATEWAY4=172.28.0.2 +BATMAN_FORWARD_GATEWAY6=fc00:172:28::2 +BATMAN_LIMIT_DOWNLOAD=1000 +BATMAN_LIMIT_UPLOAD=1000 + +WIREGUARD_CONFIG=/wireguard.conf + +FASTD_ON_UP_MASTER_INTERFACE= +FASTD_BATMAN_INTERFACE=bat0 +FASTD_SECRET_KEY=90f0637239cdf4c27dc80ee8a755ae4922769d045c86cc2086a96a3a281ed04a +FASTD_LOG_LEVEL=debug +FASTD_DONT_VERIFY_PEERS=1 +FASTD_INTERFACE= +FASTD_PEER_LIMIT=10 +FASTD_MTU=1300 + +DHCPD_V4_NET=172.29.0.0 +DHCPD_V4_RANGE=172.29.0.16 172.29.0.32 +DHCPD_V4_GATEWAY=172.29.0.1 +DHCPD_V6_NET=fc00:1234:5678::/64 +DHCPD_V6_RANGE=fc00:1234:5678::1000 fc00:1234:5678::1fff +DHCPD_INTERFACE=br-batman0 + +RADVD_INTERFACE=br-batman0 +RADVD_PREFIX=fc00:1234:5678::/64 +RADVD_SOURCE_LL_ADDRESS=on +RADVD_ADV_MANAGEMENT_FLAG=on +RADVD_OTHER_CONFIG_FLAG=on +RADVD_MTU=1300 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..718bf30 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +# vagrant environment +/.vagrant diff --git a/Vagrantfile b/Vagrantfile new file mode 100644 index 0000000..9b06479 --- /dev/null +++ b/Vagrantfile @@ -0,0 +1,152 @@ +# -*- mode: ruby -*- +# vi: set ft=ruby : + +def configure_node(config, name, ip, vpn_server) + config.vm.define name do |node| + node.vm.guest = "linux" + node.vm.box = "freifunk-leipzig/openwrt" + node.vm.boot_timeout = 60 + node.ssh.shell = "/bin/ash" + node.vm.network "private_network", ip: ip, auto_config: false + + node.vm.provider "virtualbox" do |vb| + vb.memory = "256" + vb.linked_clone = true + vb.customize ["modifyvm", :id, "--nic3", "intnet", "--intnet3", "gluon-supernode-wan", "--nictype3", "virtio"] + end + + node.vm.synced_folder './', '/vagrant', disabled: true + + node.vm.provision "shell", inline: <<-SHELL +opkg update +opkg install fastd kmod-batman-adv batctl-full vim + +cat >/etc/config/fastd </etc/config/network << EOF +config interface 'loopback' + option ifname 'lo' + option proto 'static' + option ipaddr '127.0.0.1' + option netmask '255.0.0.0' + +config globals 'globals' + option ula_prefix 'fdec:4589:e690::/48' + +config interface 'vagrant' + option ifname 'eth0' + option proto 'static' + option ipaddr '10.0.2.15' + option netmask '255.255.255.0' + +config interface 'private' + option ifname 'eth1' + option proto 'static' + option ipaddr '#{ip}' + option netmask '255.255.255.0' + +config interface 'bat0' + option auto '1' + option proto 'batadv' + option routing_algo 'BATMAN_IV' + option ap_isolation 0 + option fragmentation 1 + option gw_mode 'client' + option multicast_mode 1 + option mtu '1426' + option fixed_mtu '1' + +config interface 'vpn' + option auto '1' + option ifname 'fastd-vpn' + option proto 'batadv_hardif' + option master 'bat0' + +config interface 'mesh' + option auto '1' + option ifname 'bat0' + option proto 'dhcp' + +config interface 'mesh6' + option auto '1' + option ifname 'bat0' + option proto 'dhcpv6' + +EOF + +/etc/init.d/fastd restart +/etc/init.d/network restart +#sleep 3 +#ip route del default dev eth0 || true +SHELL + end +end + +def configure_supernode(config, name, ip) + config.vm.define name do |node| + node.vm.hostname = name + node.vm.box = "generic/debian11" + node.vm.synced_folder ".", "/vagrant_data" + node.vm.network "forwarded_port", guest: 10000, host: 10000, protocol: "udp" + node.vm.network "private_network", ip: ip + + node.vm.provider "virtualbox" do |vb| + vb.memory = "512" + vb.linked_clone = true + vb.customize ["modifyvm", :id, "--nic1", "nat", "--nictype1", "virtio"] + # the pseudo wan net without any ip configuration + vb.customize ["modifyvm", :id, "--nic2", "intnet", "--intnet2", "gluon-supernode-wan", "--nictype2", "virtio"] + end + + node.vm.provision "shell", inline: <<-SHELL + # reactivate ipv6 which disable per default in the vagrant box + sed 's/^net.ipv6.conf.all.disable_ipv6 = 1//' -i /etc/sysctl.conf + sysctl -w net.ipv6.conf.all.disable_ipv6=0 + + export DEBIAN_FRONTEND=noninteractive + apt-get update + apt-get install -y docker.io docker-compose + + adduser vagrant docker || true + + # give docker daemon some time + sleep 3 + SHELL + + node.vm.provision "shell", privileged: false, inline: <<-SHELL + cd /vagrant_data + docker-compose up -d batman_network fastd_server dhcpd_v4 dhcpd_v6 radvd wireguard + SHELL + + end +end + +Vagrant.configure("2") do |config| + configure_supernode(config, "supernode", "192.168.56.1") + configure_node(config, "node", "192.168.56.2", "192.168.56.1") +end diff --git a/batman/Dockerfile b/batman/Dockerfile index 9659f1b..0f526e8 100644 --- a/batman/Dockerfile +++ b/batman/Dockerfile @@ -1,6 +1,26 @@ FROM docker.io/library/debian:bullseye ARG DEBIAN_FRONTEND=noninteractive + + +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + batctl \ + iproute2 \ + nftables \ + inetutils-ping \ + inetutils-traceroute \ + curl \ + wireguard-tools \ + radvd \ + && rm -rf /var/lib/apt/lists /var/cache/apt/archives + +RUN mv /usr/bin/wg-quick /usr/bin/wg-quick.org && \ + egrep -v 'sysctl -q net.ipv4.conf.all.src_valid_mark=1' /usr/bin/wg-quick.org >/usr/bin/wg-quick && \ + chmod +x /usr/bin/wg-quick + +COPY entry-point.sh /entry-point.sh + ENV BATMAN_INTERFACE=bat0 ENV BATMAN_BRIDGE=br-batman0 ENV BATMAN_BRIDGE_IPV4= @@ -8,11 +28,11 @@ ENV BATMAN_BRIDGE_IPV6= ENV BATMAN_FORWARD_GATEWAY4= ENV BATMAN_FORWARD_GATEWAY6= ENV BATMAN_FORWARD_TABLE=5000 - -RUN apt-get update && \ - apt-get install -y batctl iproute2 nftables inetutils-ping inetutils-traceroute curl && \ - rm -rf /var/lib/apt/lists /var/cache/apt/archives - -COPY entry-point.sh /entry-point.sh - +ENV RADVD_INTERFACE= +ENV RADVD_ADV_MANAGEMENT_FLAG=off +ENV RADVD_MTU=1500 +ENV RADVD_ADV_MANAGEMENT_FLAG= +ENV RADVD_SOURCE_LL_ADDRESS= +ENV RADVD_PREFIX= +ENV WIREGUARD_INTERFACE=wg0 ENTRYPOINT ["/bin/bash", "/entry-point.sh"] diff --git a/batman/entry-point.sh b/batman/entry-point.sh index 9fdcadd..ff0098e 100644 --- a/batman/entry-point.sh +++ b/batman/entry-point.sh @@ -2,36 +2,58 @@ set -e batctl meshif ${BATMAN_INTERFACE} interface create -ip link add ${BATMAN_BRIDGE} type bridge -ip link set ${BATMAN_INTERFACE} master ${BATMAN_BRIDGE} ip link set ${BATMAN_INTERFACE} up -ip link set ${BATMAN_BRIDGE} up # setup ips if [ "${BATMAN_BRIDGE_IPV4}" ] ; then - ip -4 addr add ${BATMAN_BRIDGE_IPV4} dev ${BATMAN_BRIDGE} + ip -4 addr add ${BATMAN_BRIDGE_IPV4} dev ${BATMAN_INTERFACE} fi if [ "${BATMAN_BRIDGE_IPV6}" ] ; then - ip -6 addr add ${BATMAN_BRIDGE_IPV6} dev ${BATMAN_BRIDGE} + ip -6 addr add ${BATMAN_BRIDGE_IPV6} dev ${BATMAN_INTERFACE} fi # mark node as dhcp server batctl meshif ${BATMAN_INTERFACE} gw server ${BATMAN_LIMIT_DOWNLOAD}Mbit/${BATMAN_LIMIT_UPLOAD}Mbit -# configure routing -ip rule add iif ${BATMAN_BRIDGE} table ${BATMAN_FORWARD_TABLE} -[ "${BATMAN_FORWARD_GATEWAY4}" ] && \ - ip -4 route add table ${BATMAN_FORWARD_TABLE} default via ${BATMAN_FORWARD_GATEWAY4} -[ "${BATMAN_FORWARD_GATEWAY6}" ] && \ - ip -6 route add table ${BATMAN_FORWARD_TABLE} default via ${BATMAN_FORWARD_GATEWAY6} - nft add table ip nat || true nft add chain 'ip nat POSTROUTING { type nat hook postrouting priority srcnat; policy accept; }' || true nft add rule nat POSTROUTING counter masquerade || true nft add table ip6 nat || true nft add chain 'ip6 nat POSTROUTING { type nat hook postrouting priority srcnat; policy accept; }' || true -nft add rule ip6 nat counter masquerade || true +nft add rule ip6 nat POSTROUTING counter masquerade || true + +# remove dns defintion, because resolv.conf is write protected in the container +if [ "${WIREGUARD_CONFIG}" ] ; then \ + egrep -v '^\s*DNS\s*=' ${WIREGUARD_CONFIG} >/etc/wireguard/${WIREGUARD_INTERFACE}.conf + wg-quick up ${WIREGUARD_INTERFACE} + ip rule add iif br-batman0 table 5000 +fi + +cat >/etc/radvd.conf <>/etc/radvd.conf +[ "${RADVD_MTU}" ] && \ + echo " AdvLinkMTU ${RADVD_MTU};" >>/etc/radvd.conf +[ "${RADVD_SOURCE_LL_ADDRESS}" ] && \ + echo " AdvSourceLLAddress ${RADVD_SOURCE_LL_ADDRESS};" >>/etc/radvd.conf +[ "${RADVD_OTHER_CONFIG_FLAG}" ] && \ + echo " AdvOtherConfigFlag ${RADVD_OTHER_CONFIG_FLAG};" >>/etc/radvd.conf + +cat >>/etc/radvd.conf <