Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Backport release-24.05] nixos/systemd-networkd: add PREF64 related options #327190

Closed
wants to merge 2 commits into from
Closed

[Backport release-24.05] nixos/systemd-networkd: add PREF64 related options #327190

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0c39948
nixos/systemd-networkd: add PREF64 related options
jmbaur Jun 9, 2024
965ec22
nixos/clatd: make client fetch PLAT prefix dynamically
jmbaur Jun 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion nixos/lib/systemd-network-units.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,10 @@ in {
'' + optionalString (def.ipv6SendRAConfig != { }) ''
[IPv6SendRA]
${attrsToSection def.ipv6SendRAConfig}
'' + flip concatMapStrings def.ipv6Prefixes (x: ''
'' + flip concatMapStrings def.ipv6PREF64Prefixes (x: ''
[IPv6PREF64Prefix]
${attrsToSection x.ipv6PREF64PrefixConfig}
'') + flip concatMapStrings def.ipv6Prefixes (x: ''
[IPv6Prefix]
${attrsToSection x.ipv6PrefixConfig}
'') + flip concatMapStrings def.ipv6RoutePrefixes (x: ''
Expand Down
35 changes: 35 additions & 0 deletions nixos/modules/system/boot/networkd.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -963,6 +963,7 @@ let
"UseGateway"
"UseRoutePrefix"
"Token"
"UsePREF64"
])
(assertValueOneOf "UseDNS" boolValues)
(assertValueOneOf "UseDomains" (boolValues ++ ["route"]))
Expand All @@ -973,6 +974,7 @@ let
(assertValueOneOf "UseMTU" boolValues)
(assertValueOneOf "UseGateway" boolValues)
(assertValueOneOf "UseRoutePrefix" boolValues)
(assertValueOneOf "UsePREF64" boolValues)
];

sectionDHCPServer = checkUnitConfig "DHCPServer" [
Expand Down Expand Up @@ -1044,6 +1046,14 @@ let
(assertValueOneOf "EmitDomains" boolValues)
];

sectionIPv6PREF64Prefix = checkUnitConfig "IPv6PREF64Prefix" [
(assertOnlyFields [
"Prefix"
"LifetimeSec"
])
(assertInt "LifetimeSec")
];

sectionIPv6Prefix = checkUnitConfig "IPv6Prefix" [
(assertOnlyFields [
"AddressAutoconfiguration"
Expand Down Expand Up @@ -1987,6 +1997,21 @@ let
};
};

ipv6PREF64PrefixOptions = {
options = {
ipv6PREF64PrefixConfig = mkOption {
default = {};
example = { Prefix = "64:ff9b::/96"; };
type = types.addCheck (types.attrsOf unitOption) check.network.sectionIPv6PREF64Prefix;
description = ''
Each attribute in this set specifies an option in the
`[IPv6PREF64Prefix]` section of the unit. See
{manpage}`systemd.network(5)` for details.
'';
};
};
};

ipv6RoutePrefixOptions = {
options = {
ipv6RoutePrefixConfig = mkOption {
Expand Down Expand Up @@ -2174,6 +2199,16 @@ let
'';
};

ipv6PREF64Prefixes = mkOption {
default = [];
example = [ { ipv6PREF64PrefixConfig = { Prefix = "64:ff9b::/96"; }; } ];
type = with types; listOf (submodule ipv6PREF64PrefixOptions);
description = ''
A list of IPv6PREF64Prefix sections to be added to the unit. See
{manpage}`systemd.network(5)` for details.
'';
};

dhcpServerStaticLeases = mkOption {
default = [];
example = [ { dhcpServerStaticLeaseConfig = { MACAddress = "65:43:4a:5b:d8:5f"; Address = "192.168.1.42"; }; } ];
Expand Down
95 changes: 71 additions & 24 deletions nixos/tests/clatd.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@
# Client | clat Address: 192.0.0.1/32 (configured via clatd)
# | Route: default
# |
# | eth1 Address: 2001:db8::2/64
# | | Route: default via 2001:db8::1
# | eth1 Address: Assigned via SLAAC within 2001:db8::/64
# | | Route: default via IPv6LL address
# +--|---
# | VLAN 3
# +--|---
Expand All @@ -31,7 +31,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
{
name = "clatd";
meta = with pkgs.lib.maintainers; {
maintainers = [ hax404 ];
maintainers = [ hax404 jmbaur ];
};

nodes = {
Expand Down Expand Up @@ -66,18 +66,19 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
};

# The router is configured with static IPv4 addresses towards the server
# and IPv6 addresses towards the client. For NAT64, the Well-Known prefix
# 64:ff9b::/96 is used. NAT64 is done with TAYGA which provides the
# tun-interface nat64 and does the translation over it. The IPv6 packets
# are sent to this interfaces and received as IPv4 packets and vice versa.
# As TAYGA only translates IPv6 addresses to dedicated IPv4 addresses, it
# needs a pool of IPv4 addresses which must be at least as big as the
# expected amount of clients. In this test, the packets from the pool are
# directly routed towards the client. In normal cases, there would be a
# second source NAT44 to map all clients behind one IPv4 address.
# and IPv6 addresses towards the client. DNS64 is exposed towards the
# client so clatd is able to auto-discover the PLAT prefix. For NAT64, the
# Well-Known prefix 64:ff9b::/96 is used. NAT64 is done with TAYGA which
# provides the tun-interface nat64 and does the translation over it. The
# IPv6 packets are sent to this interfaces and received as IPv4 packets and
# vice versa. As TAYGA only translates IPv6 addresses to dedicated IPv4
# addresses, it needs a pool of IPv4 addresses which must be at least as
# big as the expected amount of clients. In this test, the packets from the
# pool are directly routed towards the client. In normal cases, there would
# be a second source NAT44 to map all clients behind one IPv4 address.
router = {
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
"net.ipv4.conf.all.forwarding" = 1;
"net.ipv6.conf.all.forwarding" = 1;
};

Expand All @@ -102,6 +103,36 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
};
};

systemd.network.networks."40-eth2" = {
networkConfig.IPv6SendRA = true;
ipv6Prefixes = [ { ipv6PrefixConfig = { Prefix = "2001:db8::/64"; }; } ];
ipv6PREF64Prefixes = [ { ipv6PREF64PrefixConfig = { Prefix = "64:ff9b::/96"; }; } ];
ipv6SendRAConfig = {
EmitDNS = true;
DNS = "_link_local";
};
};

services.resolved.extraConfig = ''
DNSStubListener=no
'';

networking.extraHosts = ''
192.0.0.171 ipv4only.arpa
192.0.0.170 ipv4only.arpa
'';

services.coredns = {
enable = true;
config = ''
.:53 {
bind ::
hosts /etc/hosts
dns64 64:ff9b::/96
}
'';
};

services.tayga = {
enable = true;
ipv4 = {
Expand All @@ -127,10 +158,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
};
};

# The client is configured with static IPv6 addresses. It has also a static
# default route towards the router. To reach the IPv4-only server, the
# client starts the clat daemon which starts and configures the local
# IPv4 -> IPv6 translation via Tayga.
# The client uses SLAAC to assign IPv6 addresses. To reach the IPv4-only
# server, the client starts the clat daemon which starts and configures the
# local IPv4 -> IPv6 translation via Tayga after discovering the PLAT
# prefix via DNS64.
client = {
virtualisation.vlans = [
3 # towards router
Expand All @@ -145,25 +176,36 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
enable = true;
networks."vlan1" = {
matchConfig.Name = "eth1";
address = [
"2001:db8::2/64"
];
routes = [
{ routeConfig = { Destination = "::/0"; Gateway = "2001:db8::1"; }; }
];

# NOTE: clatd does not actually use the PREF64 prefix discovered by
# systemd-networkd (nor does systemd-networkd do anything with it,
# yet), but we set this to confirm it works. See the test script
# below.
ipv6AcceptRAConfig.UsePREF64 = true;
};
};

services.clatd = {
enable = true;
settings.plat-prefix = "64:ff9b::/96";
# NOTE: Perl's Net::DNS resolver does not seem to work well querying
# for AAAA records to systemd-resolved's default IPv4 bind address
# (127.0.0.53), so we add an IPv6 listener address to systemd-resolved
# and tell clatd to use that instead.
settings.dns64-servers = "::1";
};

# Allow clatd to find dns server. See comment above.
services.resolved.extraConfig = ''
DNSStubListenerExtra=::1
'';

environment.systemPackages = [ pkgs.mtr ];
};
};

testScript = ''
import json

start_all()

# wait for all machines to start up
Expand All @@ -178,6 +220,11 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
'journalctl -u clatd -e | grep -q "Starting up TAYGA, using config file"'
)

with subtest("networkd exports PREF64 prefix"):
assert json.loads(client.succeed("networkctl status eth1 --json=short"))[
"NDisc"
]["PREF64"][0]["Prefix"] == [0x0, 0x64, 0xFF, 0x9B] + ([0] * 12)

with subtest("Test ICMP"):
client.wait_until_succeeds("ping -c 3 100.64.0.2 >&2")

Expand Down
Loading