T160: nat64: prototype #1408

vfreex · 2022-07-11T18:54:30Z

Use tayga to do NAT64 translation.

Example usage:

# Stateful NAT64
set interfaces nat64 nat64eth0 ipv4-address '192.168.64.1'
set interfaces nat64 nat64eth0 ipv6-address '2001:db8::1'
set interfaces nat64 nat64eth0 stateful ipv4-pool '192.168.64.0/24'
set interfaces nat64 nat64eth0 stateful prefix '2001:db8:64::/96'
commit
set protocols static route 192.168.64.0/24 interface nat64eth0
set protocols static route6 2001:db8:64::/96 interface nat64eth0
commit

ping6 2001:db8:64::8.8.8.8
PING 2001:db8:64::8.8.8.8(2001:db8:64::808:808) 56 data bytes
64 bytes from 2001:db8:64::808:808: icmp_seq=1 ttl=113 time=46.5 ms
64 bytes from 2001:db8:64::808:808: icmp_seq=2 ttl=113 time=47.1 ms
64 bytes from 2001:db8:64::808:808: icmp_seq=3 ttl=113 time=46.7 ms
64 bytes from 2001:db8:64::808:808: icmp_seq=4 ttl=113 time=47.0 ms
^C
--- 2001:db8:64::8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 8ms
rtt min/avg/max/mdev = 46.518/46.836/47.138/0.290 ms


# static 1-1 mappings
set interfaces nat64 nat64eth0 host-mapping ipv6 2001:db8:1000::100 ipv4 192.168.64.100
set interfaces nat64 nat64eth0 host-mapping ipv6 2001:db8:1000::101 ipv4 192.168.64.101

Change Summary

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Code style update (formatting, renaming)
Refactoring (no functional changes)
Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
Other (please describe):

Related Task(s)

https://phabricator.vyos.net/T160

Component(s) name

Proposed changes

How to test

Checklist:

I have read the CONTRIBUTING document
I have linked this PR to one or more Phabricator Task(s)
I have run the components SMOKETESTS if applicable
My commit headlines contain a valid Task id
My change requires a change to the documentation
I have updated the documentation accordingly

vfreex · 2022-07-11T18:57:45Z

This is just a prototype to explore how to integrate tayga into VyOS.

data/templates/tayga/tayga.conf.j2

c-po · 2022-07-12T05:11:04Z

data/templates/tayga/tayga.conf.j2

+#
+# Optional.
+#
+{% if stateful.ipv4_pool is defined %}


please use vyos_defined

src/conf_mode/interfaces-nat64.py

c-po · 2022-07-12T05:13:51Z

src/conf_mode/interfaces-nat64.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2021 VyOS maintainers and contributors


Can be 2022 ;)

c-po · 2022-07-12T05:14:45Z

src/conf_mode/interfaces-nat64.py

+        # bail out early
+        return None
+
+    verify_vrf(nat64)


I see no use of a VRF - I guess its a copy/paste issue ...

Besides VRF, I also copy-pasted other common config options like netns, mtu, mirror, redirect. I assume those options will be honored by the base class method Interface.update. However I didn't test them. If my assumption is wrong, I can remove them.

Well we should start low and not asume VRF works out of the box. It needs to be tested and could be added later on. In general I like the idea of a per VRF nat64 gateway - but we need to check if the daemon supports it. Please drop:

netns

mirror

redirect

src/conf_mode/interfaces-nat64.py

interface-definitions/interfaces-nat64.xml.in

Use [tayga][1] to do NAT64 translation. Example usage: ``` set interfaces nat64 nat64eth0 ipv4-address '192.168.64.1' set interfaces nat64 nat64eth0 ipv6-address '2001:db8::1' set interfaces nat64 nat64eth0 stateful ipv4-pool '192.168.64.0/24' set interfaces nat64 nat64eth0 stateful prefix '2001:db8:64::/96' commit set protocols static route 192.168.64.0/24 interface nat64eth0 set protocols static route6 2001:db8:64::/96 interface nat64eth0 commit ping6 2001:db8:64::8.8.8.8 PING 2001:db8:64::8.8.8.8(2001:db8:64::808:808) 56 data bytes 64 bytes from 2001:db8:64::808:808: icmp_seq=1 ttl=113 time=46.5 ms 64 bytes from 2001:db8:64::808:808: icmp_seq=2 ttl=113 time=47.1 ms 64 bytes from 2001:db8:64::808:808: icmp_seq=3 ttl=113 time=46.7 ms 64 bytes from 2001:db8:64::808:808: icmp_seq=4 ttl=113 time=47.0 ms ^C --- 2001:db8:64::8.8.8.8 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 8ms rtt min/avg/max/mdev = 46.518/46.836/47.138/0.290 ms set interfaces nat64 nat64eth0 host-mapping ipv6 2001:db8:1000::100 ipv4 192.168.64.100 set interfaces nat64 nat64eth0 host-mapping ipv6 2001:db8:1000::101 ipv4 192.168.64.101 commit ``` [1]: http://www.litech.org/tayga/

vfreex · 2022-07-22T04:20:41Z

Fixed MTU check.

jack9603301 · 2022-08-03T12:55:10Z

Are you going to implement NAT64? This is a nice feature!

vfreex · 2022-08-09T22:18:54Z

@jack9603301 Hi, this is just a prototype PR to show how to implement NAT64 with tayga. I just tested the basic functionalities of NAT64 for this PR. It would be nice if someone can take over this work and get it into vyos.

Also as I posted in https://phabricator.vyos.net/T160, I know a lot of people want Jool because of its performance. However it would require a much larger effort to integrate and I am not sure how to get the firewall integrated correctly with Jool either. Another concern is that an out-of-tree kernel module could be hard to maintenance in the long term, unless it gets merged into upstream kernel.

So my take is:

If someone can get NAT64 implemented with Jool, go for it.
Otherwise, tayga sounds like something we can have NOW.

Another high performance option is using VPP. I don't know if vyos has a plan to integrate VPP, but I do have some thoughts and a working demo to show how to integrate it.

c-po · 2022-08-31T17:05:43Z

src/conf_mode/interfaces-nat64.py

+        # bail out early
+        return None
+
+    verify_vrf(nat64)


Well we should start low and not asume VRF works out of the box. It needs to be tested and could be added later on. In general I like the idea of a per VRF nat64 gateway - but we need to check if the daemon supports it. Please drop:

netns

mirror

redirect

c-po · 2022-08-31T17:06:25Z

src/conf_mode/interfaces-nat64.py

+            shutil.rmtree(configd, ignore_errors=True)
+        return None
+
+    call(f'systemctl restart tayga@{ifname}.service')


Please use reload-or-restart instead. Even it reload is yet not supported we should stick to a pattern if possible.

src/etc/systemd/system/tayga@.service

c-po · 2022-08-31T17:07:20Z

interface-definitions/interfaces-nat64.xml.in

+                      <help>Description</help>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="disable">


Please use #include <include/generic-disable-node.xml.i> instead

c-po · 2022-08-31T17:07:33Z

interface-definitions/interfaces-nat64.xml.in

+                  </constraint>
+                </properties>
+                <children>
+                  <leafNode name="description">


Please use #include <include/generic-description.xml.i>

jack9603301 · 2022-08-31T17:15:55Z

@jack9603301 Hi, this is just a prototype PR to show how to implement NAT64 with tayga. I just tested the basic functionalities of NAT64 for this PR. It would be nice if someone can take over this work and get it into vyos.

Also as I posted in https://phabricator.vyos.net/T160, I know a lot of people want Jool because of its performance. However it would require a much larger effort to integrate and I am not sure how to get the firewall integrated correctly with Jool either. Another concern is that an out-of-tree kernel module could be hard to maintenance in the long term, unless it gets merged into upstream kernel.

So my take is:
* If someone can get NAT64 implemented with Jool, go for it.

* Otherwise, tayga sounds like something we can have NOW.
Another high performance option is using VPP. I don't know if vyos has a plan to integrate VPP, but I do have some thoughts and a working demo to show how to integrate it.

I think now may be an opportunity. I found the following link:

Now there is no difficulty in maintaining its kernel module, it seems that debian has helped us maintain it

Maybe we need a little experimentation to make sure it works

But that means vyos needs to maintain each version of jool-dkms by itself

Also about VPP, I don't think vyos should and won't use VPP because VPP depends on DPDK

c-po · 2022-09-08T05:32:28Z

python/vyos/ifconfig/nat64.py

+        config_file = f'/run/tayga/{self.ifname}.conf'
+        call(f"tayga -c {config_file} --mktun")
+
+    def update(self, config):


This is not required as the base class handles it all.

vfreex · 2022-09-17T09:43:21Z

Thanks for the review and suggestions. I have updated the PR to address all the issues.

@jack9603301 Re JOOL, I would like to see a prototype in a separate PR. I may have a look at it as well if I have enough time.

github-actions · 2022-12-12T15:20:25Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

sever-sever · 2023-03-29T12:12:28Z

@vfreex could you resolve conflicts?

vfreex · 2023-06-29T17:28:44Z

@sever-sever This PR means to be a demo and I don't think it is going to be merged as is. I will probably won't keep this PR up to date unless I see people are agreed to implement it this way.

dmbaturin · 2023-08-31T15:00:21Z

TAYGA hasn't been updated since 2011 and since it's a userspace implementation, it's going to be a huge performance concern. We will look into adding nftables support to Jool instead.

github-actions bot assigned vfreex Jul 11, 2022

github-actions bot requested review from c-po, dmbaturin, jestabro, DmitriyEshenko, sever-sever and zdc July 11, 2022 18:54

c-po requested changes Jul 12, 2022

View reviewed changes

sever-sever reviewed Jul 12, 2022

View reviewed changes

src/conf_mode/interfaces-nat64.py Outdated Show resolved Hide resolved

vfreex force-pushed the add-nat64 branch 3 times, most recently from fab60f8 to d7df919 Compare July 12, 2022 20:40

sever-sever reviewed Jul 12, 2022

View reviewed changes

interface-definitions/interfaces-nat64.xml.in Outdated Show resolved Hide resolved

vfreex force-pushed the add-nat64 branch from d7df919 to 451ddb2 Compare July 12, 2022 21:06

vfreex force-pushed the add-nat64 branch from 451ddb2 to b6af276 Compare July 22, 2022 04:19

andamasov requested a review from c-po August 30, 2022 20:02

c-po requested changes Aug 31, 2022

View reviewed changes

c-po requested a review from sever-sever August 31, 2022 17:08

c-po reviewed Sep 8, 2022

View reviewed changes

Address review suggestions

1bd419a

github-actions bot added the state: conflict label Dec 12, 2022

sever-sever removed the request for review from DmitriyEshenko March 13, 2023 10:17

sever-sever requested a review from c-po March 13, 2023 10:17

c-po force-pushed the current branch from 6a6ea8e to 93724b5 Compare June 29, 2023 07:07

c-po added the current label Aug 25, 2023

dmbaturin closed this Aug 31, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

T160: nat64: prototype #1408

T160: nat64: prototype #1408

vfreex commented Jul 11, 2022 •

edited

Loading

vfreex commented Jul 11, 2022

c-po Jul 12, 2022

c-po Jul 12, 2022

c-po Jul 12, 2022

vfreex Jul 12, 2022

c-po Aug 31, 2022

vfreex commented Jul 22, 2022

jack9603301 commented Aug 3, 2022

vfreex commented Aug 9, 2022

c-po Aug 31, 2022

c-po Aug 31, 2022

c-po Aug 31, 2022

c-po Aug 31, 2022

jack9603301 commented Aug 31, 2022 •

edited

Loading

c-po Sep 8, 2022

vfreex commented Sep 17, 2022

github-actions bot commented Dec 12, 2022

sever-sever commented Mar 29, 2023

vfreex commented Jun 29, 2023

dmbaturin commented Aug 31, 2023

T160: nat64: prototype #1408

T160: nat64: prototype #1408

Conversation

vfreex commented Jul 11, 2022 • edited Loading

Change Summary

Types of changes

Related Task(s)

Component(s) name

Proposed changes

How to test

Checklist:

vfreex commented Jul 11, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vfreex commented Jul 22, 2022

jack9603301 commented Aug 3, 2022

vfreex commented Aug 9, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jack9603301 commented Aug 31, 2022 • edited Loading

Choose a reason for hiding this comment

vfreex commented Sep 17, 2022

github-actions bot commented Dec 12, 2022

sever-sever commented Mar 29, 2023

vfreex commented Jun 29, 2023

dmbaturin commented Aug 31, 2023

vfreex commented Jul 11, 2022 •

edited

Loading

jack9603301 commented Aug 31, 2022 •

edited

Loading