gfwleak/solutions-tsg-scripts
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
zhangzhihan
2020-09-10 20:12:17 +08:00
parent 1d210d18c4
commit 1d0943fdb0
27 changed files with 339 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
roles/clotho/templates/clotho.conf.j2
View File

@@ -3,5 +3,5 @@ BROKER_LIST={{ log_kafkabrokers.address }}
[SYSTEM]
NIC_NAME={{ nic_mgr.name }}
LOG_LEVEL=10
LOG_LEVEL={{ clotho_log_level }}
LOG_PATH=log/clotho

8
roles/kernel-ml/tasks/main.yml
View File

@@ -28,12 +28,18 @@
- tsg_access_type == 4
- t_kernel_ml.changed
- name: "grub2-mkconfig"
- name: "BIOS:grub2-mkconfig"
shell: grub2-mkconfig -o /boot/grub2/grub.cfg
when:
- tsg_access_type == 4
- t_kernel_ml.changed
- name: "UEFI:grub2-mkconfig"
shell: grub2-mkconfig -o /boot/efi/EFI/centos/grub.cfg
when:
- tsg_access_type == 4
- t_kernel_ml.changed
- name: "reboot"
reboot:
when: t_kernel_ml.changed

4
roles/kni/templates/kni.conf.j2
View File

@@ -3,7 +3,7 @@ log_path = ./log/kni/kni.log
log_level = {{ kni_log_level }}
tfe_node_count = {{ kni.global.tfe_node_count }}
manage_eth = {{ nic_mgr.name }}
{% if tsg_running_type == 0 %}
{% if tsg_running_type != 2 %}
deploy_mode = tun
{% else %}
deploy_mode = normal
@@ -14,7 +14,7 @@ dst_mac_addr = fe:65:b7:03:50:bd
{% if tsg_access_type == 4 %}
[tfe0]
enabled = 1
dev_eth_symbol = {{ nic_data_incoming.vf1_name }}
dev_eth_symbol = {{ ATCA_data_incoming.vf1_name }}
ip_addr = 192.168.100.1
{% elif tsg_running_type == 2 %}
[tfe0]

85
roles/mrzcpd/tasks/main.yml
View File

@@ -21,20 +21,30 @@
when: nic_traffic_mirror is defined
#- name: "update mrglobal.conf.tun_mode - tun_server"
# template:
# src: "{{ role_path }}/templates//mrglobal.conf.tun_mode.j2"
# dest: /opt/mrzcpd/etc/mrglobal.conf
# when:
# - tsg_access_type == 0
- name: "update mrglobal.conf.inline - mcn0"
- name: "copy mrapp.sapp4.conf to destination server"
template:
src: "{{ role_path }}/templates/inline_device/mrglobal.conf.inline_device.j2"
src: "{{ role_path }}/templates/mrapp.sapp4.conf "
dest: /opt/mrzcpd/etc/mrapp.sapp4.conf
when:
- tsg_access_type == 4
- name: "update mrglobal.conf.adc_inline"
template:
src: "{{ role_path }}/templates/adc_inline/mrglobal.conf.adc_inline.j2"
dest: /opt/mrzcpd/etc/mrglobal.conf
when:
- nic_traffic_mirror is not defined
- tsg_access_type == 1
- tsg_running_type == 2
- name: "update mrglobal.conf.server_inline"
template:
src: "{{ role_path }}/templates/server_inline/mrglobal.conf.server_inline.j2"
dest: /opt/mrzcpd/etc/mrglobal.conf
when:
- nic_traffic_mirror is not defined
- tsg_access_type == 1
- tsg_running_type != 2
- name: "update mrglobal.conf.allot - mcn0"
template:
@@ -53,21 +63,39 @@
- tsg_access_type == 3
- name: "update mrglobal.conf.ATCA_40G - mcn0"
- name: "update mrglobal.conf.ATCA_Vlan_Flipping"
template:
src: "{{ role_path }}/templates/ATCA_40G/mrglobal.conf.ATCA_40G.j2"
src: "{{ role_path }}/templates/ATCA_Vlan_Flipping/mrglobal.conf.ATCA_Vlan_Flipping.j2"
dest: /opt/mrzcpd/etc/mrglobal.conf
when:
- nic_traffic_mirror is not defined
- tsg_access_type == 4
- tsg_access_type == 4
- name: "update mrtunnat.conf.inline - mcn0"
- name: "update mrglobal.conf.ATCA_VXLAN"
template:
src: "{{ role_path }}/templates/inline_device/mrtunnat.conf.inline_device.j2"
src: "{{ role_path }}/templates/ATCA_VXLAN/mrglobal.conf.ATCA_VXLAN.j2"
dest: /opt/mrzcpd/etc/mrglobal.conf
when:
- nic_traffic_mirror is not defined
- tsg_access_type == 5
- name: "update mrtunnat.conf.adc_inline"
template:
src: "{{ role_path }}/templates/adc_inline/mrtunnat.conf.adc_inline.j2"
dest: /opt/mrzcpd/etc/mrtunnat.conf
when:
- nic_traffic_mirror is not defined
- tsg_access_type == 1
- tsg_running_type == 2
- name: "update mrtunnat.conf.server_inline"
template:
src: "{{ role_path }}/templates/server_inline/mrtunnat.conf.server_inline.j2"
dest: /opt/mrzcpd/etc/mrtunnat.conf
when:
- nic_traffic_mirror is not defined
- tsg_access_type == 1
- tsg_running_type != 2
- name: "update mrtunnat.conf.allot_access - mcn0"
template:
@@ -85,14 +113,22 @@
- nic_traffic_mirror is not defined
- tsg_access_type == 3
- name: "update mrtunnat.conf.ATCA_40G - mcn0"
- name: "update mrtunnat.conf.ATCA_Vlan_Flipping"
template:
src: "{{ role_path }}/templates/ATCA_40G/mrtunnat.conf.ATCA_40G.j2"
src: "{{ role_path }}/templates/ATCA_Vlan_Flipping/mrtunnat.conf.ATCA_Vlan_Flipping.j2"
dest: /opt/mrzcpd/etc/mrtunnat.conf
when:
- nic_traffic_mirror is not defined
- tsg_access_type == 4
- name: "update mrtunnat.conf.ATCA_VXLAN"
template:
src: "{{ role_path }}/templates/ATCA_VXLAN/mrtunnat.conf.ATCA_VXLAN.j2"
dest: /opt/mrzcpd/etc/mrtunnat.conf
when:
- nic_traffic_mirror is not defined
- tsg_access_type == 5
- name: "enable mrenv"
systemd:
name: mrenv
@@ -124,3 +160,20 @@
enabled: no
daemon_reload: yes
when: nic_traffic_mirror is defined
- name: "mask mrzcpd on server_tun_mode"
systemd:
name: mrzcpd
enabled: no
masked: yes
when:
- tsg_access_type == 0
- name: "mask mrtunnat on server_tun_mode"
systemd:
name: mrtunnat
enabled: no
masked: yes
when:
- tsg_access_type == 0

57
roles/mrzcpd/templates/ATCA_VXLAN/mrglobal.conf.ATCA_VXLAN.j2 Normal file
View File

@@ -0,0 +1,57 @@
[device]
device={{ATCA_data_incoming.vf0_name}},{{ ATCA_data_incoming.vf1_name }},vxlan_user,vxlan_fwd
sz_tunnel=8192
sz_buffer=32
[device:{{ATCA_data_incoming.vf0_name}}]
mtu=4096
clear_tx_flags=1
hw_strip_crc=1
in_addr={{ ATCA_VXLAN.keepalive_ip }}
in_mask={{ ATCA_VXLAN.keepalive_mask }}
#rssmode=3
[device:{{ ATCA_data_incoming.vf1_name }}]
mtu=4096
clear_tx_flags=1
vlan-filter=1
vlan-strip=1
vlan-id-allow=4095
vlan-pvid=0
vlan-pvid-mode=2
hw_strip_crc=1
sz_tunnel=8192
sz_buffer=0
[service]
# lcore id for i/o service, use comma to split
iocore={{ mrzcpd.iocore }}
distmode=1
hashmode=0
idle_threshold=10000
[eal]
virtaddr=0x7f40c4a00000
loglevel=7
[keepalive]
check_spinlock=0
[ctrlzone]
ctrlzone0=tunnat,64
[pool]
create_mode=3
sz_direct_pktmbuf=4194304
sz_indirect_pktmbuf=8192
sz_cache=256
sz_data=4096
[forward]
nr_forward_rule=6
forward_rule_0=pv,{{ATCA_data_incoming.vf0_name}},{{ATCA_data_incoming.vf0_name}}
forward_rule_1=vp,{{ATCA_data_incoming.vf0_name}},{{ATCA_data_incoming.vf0_name}}
forward_rule_2=vv,vxlan_fwd,vxlan_user
forward_rule_3=vv,vxlan_user,vxlan_fwd
forward_rule_4=pv,{{ ATCA_data_incoming.vf1_name }},{{ ATCA_data_incoming.vf1_name }}
forward_rule_5=vp,{{ ATCA_data_incoming.vf1_name }},{{ ATCA_data_incoming.vf1_name }}

20
roles/mrzcpd/templates/ATCA_VXLAN/mrtunnat.conf.ATCA_VXLAN.j2 Normal file
View File

@@ -0,0 +1,20 @@
[tunnat]
lcore_id={{ mrtunnat.lcore_id }}
appsym=tunnat
phydev={{ATCA_data_incoming.vf0_name}}
virtdev=vxlan_fwd
nr_max_sessions=524280
nr_slots=1048576
expire_time=60
reverse_tunnel=0
use_recent_tunnel=0
use_link_info_table=1
use_tuple4_as_sskey=0
ctrlzone_addr_info_type=2
idle_threshold=10000
[vlan_flipping]
enable=0
c_router_vlan_id_0=1000
i_router_vlan_id_0=1001
en_mac_flipping_0=0

18
roles/mrzcpd/templates/ATCA_40G/mrglobal.conf.ATCA_40G.j2 → roles/mrzcpd/templates/ATCA_Vlan_Flipping/mrglobal.conf.ATCA_Vlan_Flipping.j2
View File

@@ -1,20 +1,20 @@
[device]
device={{nic_data_incoming.vf0_name}},{{ nic_data_incoming.vf1_name }},vxlan_user,vxlan_fwd
device={{ATCA_data_incoming.vf0_name}},{{ ATCA_data_incoming.vf1_name }},vxlan_user,vxlan_fwd
sz_tunnel=8192
sz_buffer=32
[device:{{nic_data_incoming.vf0_name}}]
[device:{{ATCA_data_incoming.vf0_name}}]
mtu=4096
clear_tx_flags=1
vlan-filter=1
vlan-strip=1
vlan-id-allow={{ VlanFlipping.vlanID_1 }},{{ VlanFlipping.vlanID_2 }},{{ VlanFlipping.vlanID_3 }},{{ VlanFlipping.vlanID_4 }}
vlan-id-allow={{ ATCA_VlanFlipping.vlanID_1 }},{{ ATCA_VlanFlipping.vlanID_2 }},{{ ATCA_VlanFlipping.vlanID_3 }},{{ ATCA_VlanFlipping.vlanID_4 }}
vlan-pvid=0
vlan-pvid-mode=2
hw_strip_crc=1
rssmode=3
#rssmode=3
[device:{{ nic_data_incoming.vf1_name }}]
[device:{{ ATCA_data_incoming.vf1_name }}]
mtu=4096
clear_tx_flags=1
vlan-filter=1
@@ -52,9 +52,9 @@ sz_data=4096
[forward]
nr_forward_rule=6
forward_rule_0=pv,{{nic_data_incoming.vf0_name}},{{nic_data_incoming.vf0_name}}
forward_rule_1=vp,{{nic_data_incoming.vf0_name}},{{nic_data_incoming.vf0_name}}
forward_rule_0=pv,{{ATCA_data_incoming.vf0_name}},{{ATCA_data_incoming.vf0_name}}
forward_rule_1=vp,{{ATCA_data_incoming.vf0_name}},{{ATCA_data_incoming.vf0_name}}
forward_rule_2=vv,vxlan_fwd,vxlan_user
forward_rule_3=vv,vxlan_user,vxlan_fwd
forward_rule_4=pv,{{ nic_data_incoming.vf1_name }},{{ nic_data_incoming.vf1_name }}
forward_rule_5=vp,{{ nic_data_incoming.vf1_name }},{{ nic_data_incoming.vf1_name }}
forward_rule_4=pv,{{ ATCA_data_incoming.vf1_name }},{{ ATCA_data_incoming.vf1_name }}
forward_rule_5=vp,{{ ATCA_data_incoming.vf1_name }},{{ ATCA_data_incoming.vf1_name }}

11
roles/mrzcpd/templates/ATCA_40G/mrtunnat.conf.ATCA_40G.j2 → roles/mrzcpd/templates/ATCA_Vlan_Flipping/mrtunnat.conf.ATCA_Vlan_Flipping.j2
View File

@@ -1,7 +1,7 @@
[tunnat]
lcore_id={{ mrtunnat.lcore_id }}
appsym=tunnat
phydev={{nic_data_incoming.vf0_name}}
phydev={{ATCA_data_incoming.vf0_name}}
virtdev=vxlan_fwd
nr_max_sessions=524280
nr_slots=1048576
@@ -15,10 +15,9 @@ idle_threshold=10000
[vlan_flipping]
enable=1
c_router_vlan_id_0={{ VlanFlipping.vlanID_1 }}
i_router_vlan_id_0={{ VlanFlipping.vlanID_2 }}
c_router_vlan_id_0={{ ATCA_VlanFlipping.vlanID_1 }}
i_router_vlan_id_0={{ ATCA_VlanFlipping.vlanID_2 }}
en_mac_flipping_0=0
en_mac_flipping_0=0
c_router_vlan_id_1={{ VlanFlipping.vlanID_3 }}
i_router_vlan_id_1={{ VlanFlipping.vlanID_4 }}
c_router_vlan_id_1={{ ATCA_VlanFlipping.vlanID_3 }}
i_router_vlan_id_1={{ ATCA_VlanFlipping.vlanID_4 }}
en_mac_flipping_1=0

4
roles/mrzcpd/templates/inline_device/mrglobal.conf.inline_device.j2 → roles/mrzcpd/templates/adc_inline/mrglobal.conf.adc_inline.j2
View File

@@ -4,8 +4,8 @@ sz_tunnel=8192
sz_buffer=0
[device:{{nic_data_incoming.name}}]
in_addr={{inline_device_config.ip}}
in_mask={{inline_device_config.mask}}
in_addr={{inline_device_config.keepalive_ip}}
in_mask={{inline_device_config.keepalive_mask}}
jumbo_frame=1
max_rx_pkt_len=15360
clear_tx_flags=1

0
roles/mrzcpd/templates/inline_device/mrtunnat.conf.inline_device.j2 → roles/mrzcpd/templates/adc_inline/mrtunnat.conf.adc_inline.j2
View File

2
roles/mrzcpd/templates/mrapp.sapp4.conf Normal file
View File

@@ -0,0 +1,2 @@
[bpfdump:vxlan_user]
enable=1

47
roles/mrzcpd/templates/server_inline/mrglobal.conf.server_inline.j2 Normal file
View File

@@ -0,0 +1,47 @@
[device]
device={{inline_device_config.data_incoming}},vxlan_user,vxlan_fwd
sz_tunnel=8192
sz_buffer=0
[device:{{inline_device_config.data_incoming}}]
in_addr={{inline_device_config.keepalive_ip}}
in_mask={{inline_device_config.keepalive_mask}}
jumbo_frame=1
max_rx_pkt_len=15360
clear_tx_flags=1
#[device:]
#jumbo_frame=1
#max_rx_pkt_len=15360
#clear_tx_flags=1
#promisc=1
[service]
# lcore id for i/o service, use comma to split
iocore={{ mrzcpd.iocore }}
distmode=2
hashmode=0
[eal]
virtaddr=0x7f40c4a00000
loglevel=7
[keepalive]
check_spinlock=0
[ctrlzone]
ctrlzone0=tunnat,64
[pool]
create_mode=3
sz_direct_pktmbuf=4194304
sz_indirect_pktmbuf=8192
sz_cache=256
sz_data=4096
[forward]
nr_forward_rule=4
forward_rule_0=pv,{{inline_device_config.data_incoming}},{{inline_device_config.data_incoming}}
forward_rule_1=vp,{{inline_device_config.data_incoming}},{{inline_device_config.data_incoming}}
forward_rule_2=vv,vxlan_fwd,vxlan_user
forward_rule_3=vv,vxlan_user,vxlan_fwd

18
roles/mrzcpd/templates/server_inline/mrtunnat.conf.server_inline.j2 Normal file
View File

@@ -0,0 +1,18 @@
[tunnat]
lcore_id={{ mrtunnat.lcore_id }}
appsym=tunnat
phydev={{inline_device_config.data_incoming}}
virtdev=vxlan_fwd
nr_max_sessions=524280
nr_slots=1048576
expire_time=60
reverse_tunnel=0
use_recent_tunnel=0
use_tuple4_as_sskey=1
ctrlzone_addr_info_type=2
[vlan_flipping]
enable=0
c_router_vlan_id_0=1000
i_router_vlan_id_0=1001
en_mac_flipping_0=0

8
roles/sapp/tasks/main.yml
View File

@@ -41,10 +41,10 @@
when: tsg_access_type == 1
- name: "copy sapp.service destination server"
copy:
src: "{{ role_path }}/files/sapp.service"
dest: /usr/lib/systemd/system/
- name: "Template sapp.service destination server"
template:
src: "{{ role_path }}/templates/sapp.service.j2"
dest: /usr/lib/systemd/system/sapp.service
mode: 0755
- name: "enable sapp"

6
roles/sapp/templates/gdev.conf.j2
View File

@@ -1,5 +1,11 @@
[Module]
{% if tsg_running_type == 2 %}
pcapdevice={{ nic_data_incoming.name }}
sendto_gdev_card={{ nic_data_incoming.name }}
sendto_gdev_ip={{ inline_device_config.ip }}
{% else %}
pcapdevice={{ inline_device_config.data_incoming }}
sendto_gdev_card={{ inline_device_config.data_incoming }}
sendto_gdev_ip={{ inline_device_config.keepalive_ip }}
{% endif %}
gdev_status_switch=1

2
roles/sapp/files/sapp.service → roles/sapp/templates/sapp.service.j2
View File

@@ -1,7 +1,9 @@
[Unit]
Description=sapp service
{% if tsg_running_type != 0 %}
Requires=mrzcpd.service
After=mrzcpd.service
{% endif %}
[Service]
WorkingDirectory=/home/mesasoft/sapp_run
ExecStart=/home/mesasoft/sapp_run/sapp

2
roles/tfe/files/tfe.service
View File

@@ -8,7 +8,7 @@ After=tfe-env.service
Type=notify
ExecStart=/opt/tsg/tfe/bin/tfe
WorkingDirectory=/opt/tsg/tfe/
TimeoutSec=3600s
TimeoutSec=7200s
RestartSec=10s
Restart=always
LimitNOFILE=524288

6
roles/tfe/templates/tfe-env-config.j2
View File

@@ -1,6 +1,6 @@
{% if tsg_access_type == 4 %}
TFE_DEVICE_DATA_INCOMING={{ nic_data_incoming.vf2_name }}
{% elif tsg_running_type == 0 %}
TFE_DEVICE_DATA_INCOMING={{ ATCA_data_incoming.vf2_name }}
{% elif tsg_running_type != 2 %}
TFE_DEVICE_DATA_INCOMING=tun_kni
{% else %}
TFE_DEVICE_DATA_INCOMING={{ nic_data_incoming.name }}
@@ -14,7 +14,7 @@ TFE_PEER_MAC_DATA_INCOMING=aa:bb:cc:dd:ee:ff
TFE_LOCAL_IP_DATA_INCOMING=172.16.241.2
TFE_PEER_IP_DATA_INCOMING=172.16.241.1
{% if tsg_running_type == 0 %}
{% if tsg_running_type != 2 %}
TFE_WATCHDOG_DEVICE={{ nic_inner_ctrl.name }}
TFE_WATCHDOG_IP=192.168.100.1
{% endif %}

2
roles/tfe/templates/tfe.conf.j2
View File

@@ -55,7 +55,7 @@ enable_health_check=1
passthrough_all_tcp=0
[traffic_mirror]
{% if tsg_running_type == 0 %}
{% if tsg_running_type != 2 %}
device=lo
type=0
{% else %}

24
roles/tsg-env-tun-mode/templates/setup.j2
View File

@@ -11,17 +11,17 @@ ethtool -K {{ packet_io.external_interface }} tso off
ethtool -K {{ packet_io.external_interface }} gso off
ethtool -K {{ packet_io.external_interface }} gro off
{% elif tsg_access_type == 4 %}
echo 3 > /sys/class/net/{{ nic_data_incoming.ethname }}/device/sriov_numvfs
ip link set {{ nic_data_incoming.ethname }} vf 1 vlan 4095
ip link set {{ nic_data_incoming.ethname }} vf 2 vlan 4095
ip link set {{ nic_data_incoming.ethname }} vf 0 trust on
ip link set {{ nic_data_incoming.ethname }} vf 1 trust on
ip link set {{ nic_data_incoming.ethname }} vf 2 trust on
ip link set {{ nic_data_incoming.ethname }} vf 1 mac 00:0e:c6:d6:72:c1
ip link set {{ nic_data_incoming.ethname }} vf 2 mac fe:65:b7:03:50:bd
ip link set {{ nic_data_incoming.ethname }} vf 0 spoofchk off
ip link set {{ nic_data_incoming.vf0_name }} up
ip link set {{ nic_data_incoming.vf1_name }} up
ip link set {{ nic_data_incoming.vf2_name }} up
echo 3 > /sys/class/net/{{ ATCA_data_incoming.ethname }}/device/sriov_numvfs
ip link set {{ ATCA_data_incoming.ethname }} vf 1 vlan 4095
ip link set {{ ATCA_data_incoming.ethname }} vf 2 vlan 4095
ip link set {{ ATCA_data_incoming.ethname }} vf 0 trust on
ip link set {{ ATCA_data_incoming.ethname }} vf 1 trust on
ip link set {{ ATCA_data_incoming.ethname }} vf 2 trust on
ip link set {{ ATCA_data_incoming.ethname }} vf 1 mac 00:0e:c6:d6:72:c1
ip link set {{ ATCA_data_incoming.ethname }} vf 2 mac fe:65:b7:03:50:bd
ip link set {{ ATCA_data_incoming.ethname }} vf 0 spoofchk off
ip link set {{ ATCA_data_incoming.vf0_name }} up
ip link set {{ ATCA_data_incoming.vf1_name }} up
ip link set {{ ATCA_data_incoming.vf2_name }} up
{% endif %}

2
roles/tsg-env-tun-mode/templates/tsg-env_stop.j2
View File

@@ -4,5 +4,5 @@ echo 0 >/sys/class/net/{{ nic_mgr.name }}/device/sriov_numvfs
ifconfig {{ nic_mgr.name }}.100 down
vconfig rem {{ nic_mgr.name }}.100
{% if tsg_access_type == 4 %}
echo 0 >/sys/class/net/{{ nic_data_incoming.ethname }}/device/sriov_numvfs
echo 0 >/sys/class/net/{{ ATCA_data_incoming.ethname }}/device/sriov_numvfs
{% endif %}

2
roles/tsg_device_tag/tasks/main.yml
View File

@@ -1,6 +1,6 @@
- name: "create /opt/tsg/etc/"
file:
path: /opt/proxy_status
path: /opt/tsg/etc
state: directory
- name: "Template tsg_device_tag.json"