meta-google: gbmc-ncsi-config: Only impersonate host under NCSI
This adds a flag to the interface based on the presence of the NCSI
state machine. Non-NCSI connections will not impersonate the CN to avoid
breaking flat network topologies where the BMC and CN share an ethernet
channel.
Tested: On a machine without an NCSI stack to verify the impersonation
record is not present. Also on a machine with NCSI to prove that
impersonation is still working.
Change-Id: Ifb8048abe443c60a333e7eff7cdc9d063a8c656a
Signed-off-by: William A. Kennington III <wak@google.com>
diff --git a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-deprecated-ips.sh.in b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-deprecated-ips.sh.in
index a1b16ca..5d6411d 100644
--- a/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-deprecated-ips.sh.in
+++ b/meta-google/recipes-google/ncsi/files/gbmc-ncsi-br-deprecated-ips.sh.in
@@ -19,11 +19,15 @@
gbmc_ncsi_br_deprecated_ips_init=
gbmc_ncsi_br_deprecated_ips_confip=
gbmc_ncsi_br_deprecated_ips_lastip=
+gbmc_ncsi_br_deprecated_ips_lastncsi=
+gbmc_ncsi_br_deprecated_ips_confncsi=
gbmc_ncsi_br_deprecated_ips_update() {
[ -n "$gbmc_ncsi_br_deprecated_ips_init" ] || return
- [ "$gbmc_ncsi_br_deprecated_ips_confip" != "$gbmc_ncsi_br_deprecated_ips_lastip" ] || return
+ [ "$gbmc_ncsi_br_deprecated_ips_confip" != "$gbmc_ncsi_br_deprecated_ips_lastip" ] || \
+ [ "$gbmc_ncsi_br_deprecated_ips_confncsi" != "$gbmc_ncsi_br_deprecated_ips_lastncsi" ] || return
gbmc_ncsi_br_deprecated_ips_confip="$gbmc_ncsi_br_deprecated_ips_lastip"
+ gbmc_ncsi_br_deprecated_ips_confncsi="$gbmc_ncsi_br_deprecated_ips_lastncsi"
printf 'gBMC NCSI Deprecated Addrs: %s\n' \
"${gbmc_ncsi_br_deprecated_ips_lastip:-(deleted)}" >&2
@@ -46,20 +50,24 @@
fi
pfx_bytes[8]=0
pfx_bytes[9]=0
- local host_pfx="$(ip_bytes_to_str pfx_bytes)"
+ local host_pfx=
+ if [ -n "${gbmc_ncsi_br_deprecated_ips_confncsi}" ]; then
+ # Only impersonate the host if we have an NCSI state machine
+ host_pfx="$(ip_bytes_to_str pfx_bytes)"
+ fi
read -r -d '' contents <<EOF
[Network]
IPv6ProxyNDP=yes
IPv6ProxyNDPAddress=$pfx
IPv6ProxyNDPAddress=$stateless_pfx
-IPv6ProxyNDPAddress=$host_pfx
+${host_pfx:+IPv6ProxyNDPAddress=}$host_pfx
${stateless_ip:+IPv6ProxyNDPAddress=}$stateless_ip
EOF
read -r -d '' nfcontents <<EOF
table inet filter {
chain ncsi_input {
ip6 saddr != $pfx/76 ip6 daddr $pfx/76 goto ncsi_gbmc_br_pub_input
- ip6 daddr $host_pfx/64 goto ncsi_legacy_input
+ ${host_pfx:+ip6 daddr $host_pfx/64 goto ncsi_legacy_input}
}
chain ncsi_forward {
ip6 saddr != $pfx/76 ip6 daddr $pfx/76 accept
@@ -128,6 +136,14 @@
gbmc_ncsi_br_deprecated_ips_lastip=
gbmc_ip_monitor_defer
fi
+ elif [ "$change" = 'link' -a "$action" = 'add' -a "$intf" = '@NCSI_IF@' ]; then
+ if ip link show '@NCSI_IF@' | grep -q '^ *alias ncsi$'; then
+ gbmc_ncsi_br_deprecated_ips_lastncsi=1
+ gbmc_ip_monitor_defer
+ else
+ gbmc_ncsi_br_deprecated_ips_lastncsi=
+ gbmc_ip_monitor_defer
+ fi
fi
}