From 80765e58edd669210d4dfb27f894e9976648876a Mon Sep 17 00:00:00 2001 From: brent s Date: Mon, 18 May 2020 04:59:00 -0400 Subject: [PATCH] okay. let's give this a shot. --- utils/he_ipv6/TODO | 7 +-- utils/he_ipv6/config.py | 6 ++ utils/he_ipv6/example.tunnelbroker.xml | 48 +++++++++++---- utils/he_ipv6/ra.py | 10 +--- utils/he_ipv6/ref | 7 +++ utils/he_ipv6/tpl/_common.j2 | 13 +++- utils/he_ipv6/tpl/dnsmasq.include.j2 | 47 +++++++++++++++ utils/he_ipv6/tpl/radvd.conf.j2 | 40 +++++++++---- utils/he_ipv6/tunnel.py | 82 ++++++++++++++++++++------ utils/he_ipv6/tunnelbroker.py | 24 -------- 10 files changed, 203 insertions(+), 81 deletions(-) diff --git a/utils/he_ipv6/TODO b/utils/he_ipv6/TODO index 49b2d62..ad27de4 100644 --- a/utils/he_ipv6/TODO +++ b/utils/he_ipv6/TODO @@ -1,4 +1,3 @@ -* fix creds -** needs user/password, and the updateKey is unique per-tunnel so move it into an element in there. -** need to get user/password into HEConf somehow. if i can get ?tid= working for the URL, that'd be perfect. -^ need to use updateKey for tunnel-specific xml +DHCPv6: +* NTP server in ? (dnsmasq: option6:ntpserver,...) +* bootfile-(url|param) in ? (dnsmasq: option6:*) diff --git a/utils/he_ipv6/config.py b/utils/he_ipv6/config.py index b44f165..fb4df2b 100644 --- a/utils/he_ipv6/config.py +++ b/utils/he_ipv6/config.py @@ -233,6 +233,12 @@ class Config(BaseConfig): tun_creds_id = tun_xml.attrib['creds'] creds = self.creds[tun_creds_id] update_key = tun_xml.find('updateKey').text.strip() + # TODO: do I instead want to use HEConfig() and fetch the single unified config? + # Pros: + # * I wouldn't completely die on a misconfigured tunnel in the user config. + # Cons: + # * We'd have to skip missing tunnels (bad auth at HE, etc.) + # * We would use more memory and take more time during init. he_conf = HETunnelConfig(tun_id, creds, update_key) tun = tunnel.Tunnel(tun_xml, he_conf, self.creds[tun_creds_id]) self.tunnels[tun_id] = tun diff --git a/utils/he_ipv6/example.tunnelbroker.xml b/utils/he_ipv6/example.tunnelbroker.xml index 94667c3..c00ea72 100644 --- a/utils/he_ipv6/example.tunnelbroker.xml +++ b/utils/he_ipv6/example.tunnelbroker.xml @@ -48,6 +48,8 @@ the "ra" child element under for further details. If you are using dnsmasq, you will want to edit dnsmasq.conf to *include* the generated file, most likely, as it only generates configuration for IPv6 options. + If this is not specified, NO RA/DHCPv6 management will be done *regardless* of any "re" child elements for below + "assign" objects. --> true - true + true - + - false + false false @@ -105,7 +130,7 @@ true - false + false @@ -116,7 +141,8 @@ diff --git a/utils/he_ipv6/ra.py b/utils/he_ipv6/ra.py index 1ddc623..62240e0 100644 --- a/utils/he_ipv6/ra.py +++ b/utils/he_ipv6/ra.py @@ -43,14 +43,8 @@ class RAConf(object): return(None) def generate(self, assignments): - ns = {} - for a in assignments: - if len(a.iface_addrs) > 3: - ns_addrs = a.iface_addrs[:3] - else: - ns_addrs = a.iface_addrs - ns[a.iface] = ns_addrs - self.cfgstr = self.tpl.render(assignments = assignments, nameservers = ns) + self.cfgstr = self.tpl.render(assignments = assignments) + return(None) def write(self): if not self.cfgstr: diff --git a/utils/he_ipv6/ref b/utils/he_ipv6/ref index f190ea3..f74a390 100644 --- a/utils/he_ipv6/ref +++ b/utils/he_ipv6/ref @@ -32,3 +32,10 @@ # https://tools.ietf.org/html/rfc5175 # https://tools.ietf.org/html/rfc6104 # https://tools.ietf.org/html/rfc7772 +# DHCPv6 +# https://tools.ietf.org/html/rfc3315 +# https://tools.ietf.org/html/rfc3646 +# https://tools.ietf.org/html/rfc4649 +# https://tools.ietf.org/html/rfc8415 +## +# https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/xe-3s/ip6f-xe-3s-book/ip6-rfcs.pdf diff --git a/utils/he_ipv6/tpl/_common.j2 b/utils/he_ipv6/tpl/_common.j2 index 3ad3443..02486e9 100644 --- a/utils/he_ipv6/tpl/_common.j2 +++ b/utils/he_ipv6/tpl/_common.j2 @@ -5,12 +5,19 @@ {%- set mtu = 1480 -%} {#- Minimum seconds allowed between sending unsolicited multicast RAs. 3 < x < (0.75 * max_inter) -#} {#- If using Mobile Extensions, 0.33 < x (0.75 * max_inter) -#} -{%- set min_inter = 60 -%} +{%- set min_inter = 10 -%} {#- Maximum seconds allowed between sending unsolicited multicast RAs. 4 < x < 1800 -#} {#- If using Mobile Extensions, 0.07 < x 1800 -#} -{%- set max_inter = 600 -%} +{%- set max_inter = 60 -%} {#- Minimum seconds between sending multicast RAs (solicited and unsolicited). -#} {#- If using Mobile Extensions, 0.03 < x -#} {%- set min_delay = 3 -%} +{#- The lifetime associated with the default router in units of seconds. 0 OR max_inter < x < 9000 -#} +{%- set lifetime = 9000 -%} {#- ## DHCPv6 OPTIONS ## -#} -{#- Obviously, these only works for DNSMasq. -#} +{#- Obviously, these only work for DNSMasq. -#} +{#- How long the lease should last until a new one is requested. -#} +{#- This is also used for *SLAAC addresses* in radvd. -#} +{%- set lease_life = 21600 -%}{#- 6 hours -#} +{#- How long should the options be valid for. -#} +{%- set opts_life = lease_life -%} diff --git a/utils/he_ipv6/tpl/dnsmasq.include.j2 b/utils/he_ipv6/tpl/dnsmasq.include.j2 index 09b100b..ecceed6 100644 --- a/utils/he_ipv6/tpl/dnsmasq.include.j2 +++ b/utils/he_ipv6/tpl/dnsmasq.include.j2 @@ -1,2 +1,49 @@ +{%- import '_common.j2' as common_opts with context -%} # This file should be *included* in your dnsmasq configuration. +# Generated by he_ipv6. +# See "dnsmasq --help dhcp6" for matching option identifers ("dhcp-option = ..., option6: