dev/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #318604 from jmbaur/pref64-networkd

Browse Source 
nixos/systemd-networkd: add PREF64 related options
This commit is contained in:
Florian Klink 2024-06-12 22:09:54 +03:00 committed by GitHub
commit eabd9c36d9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 95 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
nixos/lib/systemd-network-units.nix
View File

@ -147,7 +147,10 @@ in {
'' + optionalString (def.ipv6SendRAConfig != { }) ''
[IPv6SendRA]
${attrsToSection def.ipv6SendRAConfig}
'' + flip concatMapStrings def.ipv6Prefixes (x: ''
'' + flip concatMapStrings def.ipv6PREF64Prefixes (x: ''
[IPv6PREF64Prefix]
${attrsToSection x}
'') + flip concatMapStrings def.ipv6Prefixes (x: ''
[IPv6Prefix]
${attrsToSection x}
'') + flip concatMapStrings def.ipv6RoutePrefixes (x: ''

20
nixos/modules/system/boot/networkd.nix
View File

@ -952,6 +952,7 @@ let
"UseGateway"
"UseRoutePrefix"
"Token"
"UsePREF64"
])
(assertValueOneOf "UseDNS" boolValues)
(assertValueOneOf "UseDomains" (boolValues ++ ["route"]))
@ -962,6 +963,7 @@ let
(assertValueOneOf "UseMTU" boolValues)
(assertValueOneOf "UseGateway" boolValues)
(assertValueOneOf "UseRoutePrefix" boolValues)
(assertValueOneOf "UsePREF64" boolValues)
];
sectionDHCPServer = checkUnitConfig "DHCPServer" [
@ -1033,6 +1035,14 @@ let
(assertValueOneOf "EmitDomains" boolValues)
];
sectionIPv6PREF64Prefix = checkUnitConfigWithLegacyKey "ipv6PREF64PrefixConfig" "IPv6PREF64Prefix" [
(assertOnlyFields [
"Prefix"
"LifetimeSec"
])
(assertInt "LifetimeSec")
];
sectionIPv6Prefix = checkUnitConfigWithLegacyKey "ipv6PrefixConfig" "IPv6Prefix" [
(assertOnlyFields [
"AddressAutoconfiguration"
@ -2013,6 +2023,16 @@ let
'';
};
ipv6PREF64Prefixes = mkOption {
default = [];
example = [ { Prefix = "64:ff9b::/96"; } ];
type = types.listOf (mkSubsectionType "ipv6PREF64PrefixConfig" check.network.sectionIPv6PREF64Prefix);
description = ''
A list of IPv6PREF64Prefix sections to be added to the unit. See
{manpage}`systemd.network(5)` for details.
'';
};
dhcpServerStaticLeases = mkOption {
default = [];
example = [ { MACAddress = "65:43:4a:5b:d8:5f"; Address = "192.168.1.42"; } ];

95
nixos/tests/clatd.nix
View File

@ -6,8 +6,8 @@
# Client | clat Address: 192.0.0.1/32 (configured via clatd)
# | Route: default
# |
# | eth1 Address: 2001:db8::2/64
# | | Route: default via 2001:db8::1
# | eth1 Address: Assigned via SLAAC within 2001:db8::/64
# | | Route: default via IPv6LL address
# +--|---
# | VLAN 3
# +--|---
@ -31,7 +31,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
{
name = "clatd";
meta = with pkgs.lib.maintainers; {
maintainers = [ hax404 ];
maintainers = [ hax404 jmbaur ];
};
nodes = {
@ -66,18 +66,19 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
};
# The router is configured with static IPv4 addresses towards the server
# and IPv6 addresses towards the client. For NAT64, the Well-Known prefix
# 64:ff9b::/96 is used. NAT64 is done with TAYGA which provides the
# tun-interface nat64 and does the translation over it. The IPv6 packets
# are sent to this interfaces and received as IPv4 packets and vice versa.
# As TAYGA only translates IPv6 addresses to dedicated IPv4 addresses, it
# needs a pool of IPv4 addresses which must be at least as big as the
# expected amount of clients. In this test, the packets from the pool are
# directly routed towards the client. In normal cases, there would be a
# second source NAT44 to map all clients behind one IPv4 address.
# and IPv6 addresses towards the client. DNS64 is exposed towards the
# client so clatd is able to auto-discover the PLAT prefix. For NAT64, the
# Well-Known prefix 64:ff9b::/96 is used. NAT64 is done with TAYGA which
# provides the tun-interface nat64 and does the translation over it. The
# IPv6 packets are sent to this interfaces and received as IPv4 packets and
# vice versa. As TAYGA only translates IPv6 addresses to dedicated IPv4
# addresses, it needs a pool of IPv4 addresses which must be at least as
# big as the expected amount of clients. In this test, the packets from the
# pool are directly routed towards the client. In normal cases, there would
# be a second source NAT44 to map all clients behind one IPv4 address.
router = {
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
"net.ipv4.conf.all.forwarding" = 1;
"net.ipv6.conf.all.forwarding" = 1;
};
@ -102,6 +103,36 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
};
};
systemd.network.networks."40-eth2" = {
networkConfig.IPv6SendRA = true;
ipv6Prefixes = [ { Prefix = "2001:db8::/64"; } ];
ipv6PREF64Prefixes = [ { Prefix = "64:ff9b::/96"; } ];
ipv6SendRAConfig = {
EmitDNS = true;
DNS = "_link_local";
};
};
services.resolved.extraConfig = ''
DNSStubListener=no
'';
networking.extraHosts = ''
192.0.0.171 ipv4only.arpa
192.0.0.170 ipv4only.arpa
'';
services.coredns = {
enable = true;
config = ''
.:53 {
bind ::
hosts /etc/hosts
dns64 64:ff9b::/96
}
'';
};
services.tayga = {
enable = true;
ipv4 = {
@ -127,10 +158,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
};
};
# The client is configured with static IPv6 addresses. It has also a static
# default route towards the router. To reach the IPv4-only server, the
# client starts the clat daemon which starts and configures the local
# IPv4 -> IPv6 translation via Tayga.
# The client uses SLAAC to assign IPv6 addresses. To reach the IPv4-only
# server, the client starts the clat daemon which starts and configures the
# local IPv4 -> IPv6 translation via Tayga after discovering the PLAT
# prefix via DNS64.
client = {
virtualisation.vlans = [
3 # towards router
@ -145,25 +176,36 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
enable = true;
networks."vlan1" = {
matchConfig.Name = "eth1";
address = [
"2001:db8::2/64"
];
routes = [
{ Destination = "::/0"; Gateway = "2001:db8::1"; }
];
# NOTE: clatd does not actually use the PREF64 prefix discovered by
# systemd-networkd (nor does systemd-networkd do anything with it,
# yet), but we set this to confirm it works. See the test script
# below.
ipv6AcceptRAConfig.UsePREF64 = true;
};
};
services.clatd = {
enable = true;
settings.plat-prefix = "64:ff9b::/96";
# NOTE: Perl's Net::DNS resolver does not seem to work well querying
# for AAAA records to systemd-resolved's default IPv4 bind address
# (127.0.0.53), so we add an IPv6 listener address to systemd-resolved
# and tell clatd to use that instead.
settings.dns64-servers = "::1";
};
# Allow clatd to find dns server. See comment above.
services.resolved.extraConfig = ''
DNSStubListenerExtra=::1
'';
environment.systemPackages = [ pkgs.mtr ];
};
};
testScript = ''
import json
start_all()
# wait for all machines to start up
@ -178,6 +220,11 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
'journalctl -u clatd -e | grep -q "Starting up TAYGA, using config file"'
)
with subtest("networkd exports PREF64 prefix"):
assert json.loads(client.succeed("networkctl status eth1 --json=short"))[
"NDisc"
]["PREF64"][0]["Prefix"] == [0x0, 0x64, 0xFF, 0x9B] + ([0] * 12)
with subtest("Test ICMP"):
client.wait_until_succeeds("ping -c 3 100.64.0.2 >&2")