1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
|
# This test verifies that we can ping an IPv4-only server from an IPv6-only
# client via a NAT64 router using CLAT on the client. The hosts and networks
# are configured as follows:
#
# +------
# Client | clat Address: 192.0.0.1/32 (configured via clatd)
# | Route: default
# |
# | eth1 Address: Assigned via SLAAC within 2001:db8::/64
# | | Route: default via IPv6LL address
# +--|---
# | VLAN 3
# +--|---
# | eth2 Address: 2001:db8::1/64
# Router |
# | nat64 Address: fde7:6c52:047e::1/128
# | Route: fde7:6c52:047e::/96
# | Address: 192.0.2.0/32
# | Route: 192.0.2.0/24
# |
# | eth1 Address: 100.64.0.1/24
# +--|---
# | VLAN 2
# +--|---
# Server | eth1 Address: 100.64.0.2/24
# | Route: 192.0.2.0/24 via 100.64.0.1
# +------
{ lib, ... }:
{
name = "clatd";
meta.maintainers = with lib.maintainers; [
hax404
jmbaur
];
nodes = {
# The server is configured with static IPv4 addresses.
# To reach the IPv4 address pool of the NAT64 gateway, there is a static
# route configured. In normal cases, where the router would also source NAT
# the pool addresses to one IPv4 addresses, this would not be needed.
server = {
virtualisation.vlans = [
2 # towards router
];
networking = {
useDHCP = false;
interfaces.eth1 = lib.mkForce { };
};
systemd.network = {
enable = true;
networks."vlan1" = {
matchConfig.Name = "eth1";
address = [
"100.64.0.2/24"
];
routes = [
{
Destination = "192.0.2.0/24";
Gateway = "100.64.0.1";
}
];
};
};
};
# The router is configured with static IPv4 addresses towards the server
# and IPv6 addresses towards the client. DNS64 is exposed towards the
# client so clatd is able to auto-discover the PLAT prefix. For NAT64, the
# ULA prefix fde7:6c52:047e::/96 is used. NAT64 is done with TAYGA which
# provides the tun-interface nat64 and does the translation over it. The
# IPv6 packets are sent to this interfaces and received as IPv4 packets and
# vice versa. As TAYGA only translates IPv6 addresses to dedicated IPv4
# addresses, it needs a pool of IPv4 addresses which must be at least as
# big as the expected amount of clients. In this test, the packets from the
# pool are directly routed towards the client. In normal cases, there would
# be a second source NAT44 to map all clients behind one IPv4 address.
router = {
boot.kernel.sysctl = {
"net.ipv4.conf.all.forwarding" = 1;
"net.ipv6.conf.all.forwarding" = 1;
};
virtualisation.vlans = [
2 # towards server
3 # towards client
];
networking = {
useDHCP = false;
useNetworkd = true;
firewall.enable = false;
interfaces.eth1 = lib.mkForce {
ipv4 = {
addresses = [
{
address = "100.64.0.1";
prefixLength = 24;
}
];
};
};
interfaces.eth2 = lib.mkForce {
ipv6 = {
addresses = [
{
address = "2001:db8::1";
prefixLength = 64;
}
];
};
};
};
systemd.network.networks."40-eth2" = {
networkConfig.IPv6SendRA = true;
ipv6Prefixes = [ { Prefix = "2001:db8::/64"; } ];
ipv6PREF64Prefixes = [ { Prefix = "fde7:6c52:047e::/96"; } ];
ipv6SendRAConfig = {
EmitDNS = true;
DNS = "_link_local";
};
};
services.resolved.settings.Resolve.DNSStubListener = false;
networking.extraHosts = ''
192.0.0.171 ipv4only.arpa
192.0.0.170 ipv4only.arpa
'';
services.coredns = {
enable = true;
config = ''
.:53 {
bind ::
hosts /etc/hosts
dns64 fde7:6c52:047e::/96
}
'';
};
services.tayga = {
enable = true;
ipv4 = {
address = "192.0.2.0";
router = {
address = "192.0.2.1";
};
pool = {
address = "192.0.2.0";
prefixLength = 24;
};
};
ipv6 = {
address = "2001:db8::1";
router = {
address = "fde7:6c52:047e::1";
};
pool = {
address = "fde7:6c52:047e::";
prefixLength = 96;
};
};
};
};
# The client uses SLAAC to assign IPv6 addresses. To reach the IPv4-only
# server, the client starts the clat daemon which starts and configures the
# local IPv4 -> IPv6 translation via Tayga after discovering the PLAT
# prefix via DNS64.
client =
{ pkgs, ... }:
{
virtualisation.vlans = [
3 # towards router
];
networking = {
useDHCP = false;
interfaces.eth1 = lib.mkForce { };
};
systemd.network = {
enable = true;
networks."vlan1" = {
matchConfig.Name = "eth1";
ipv6AcceptRAConfig.UsePREF64 = true;
};
};
services.clatd.enable = true;
environment.systemPackages = [ pkgs.mtr ];
};
};
testScript = ''
import json
start_all()
# wait for all machines to start up
for machine in client, router, server:
machine.wait_for_unit("network.target")
with subtest("Wait for tayga and clatd"):
router.wait_for_unit("tayga.service")
client.wait_for_unit("clatd.service")
# clatd checks if this system has IPv4 connectivity for 10 seconds
client.wait_until_succeeds(
'journalctl -u clatd -e | grep -q "Starting up TAYGA, using config file"'
)
with subtest("networkd exports PREF64 prefix"):
assert json.loads(client.succeed("networkctl status eth1 --json=short"))[
"NDisc"
]["PREF64"][0]["Prefix"] == [0xfd, 0xe7, 0x6c, 0x52, 0x04, 0x7e] + ([0] * 10)
with subtest("Test ICMP"):
client.wait_until_succeeds("ping -c3 100.64.0.2 >&2")
with subtest("Test ICMP and show a traceroute"):
client.wait_until_succeeds("mtr --show-ips --report-wide 100.64.0.2 >&2")
client.log(client.execute("systemd-analyze security clatd.service")[1])
'';
}
|
