Add doc section for /etc/default/snf-network

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Fix typo in docs

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Do not set default value for IFUP_EXTRA_SCRIPT

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
arptables do not support -m comment

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Drop packets with different src IP in routed mode

In routed setup do not allow packets coming from a
TAP to have different source IP that the one that they
suppose to have.

This reduces chances for udp attacks originating
inside the datacenter.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Save ip commands as well

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add verbose logging during all stages

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Basic support for openvswitch

Actually steal code from kvm-ifup script shipped
with official Ganeti.

Please note that nfdhcpd will not be functional because
get_physindev() will not return the proper value
(instead of the ifindex of the tap device, it will return the
one of the ovs bridge).

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add helper bridge in case of openvswitch

Since ebtables/iptables do not work on openvswitch bridges
we add a helper bridge between tap interface and ovs bridge
and connect them both with and two veth peers.

This will make MAC filtering used for private networks work
as long as nfdhcpd will be able to parse the packet mangled
and coming from the linux bridge correctly.

Lets assume the tap interface is tap1 and the ovs bridge is ovs-br.
With this patch we end up with:

tap1 -> tap1-br -> tap1-to-ovs-br -> ovs-br-to-tap3 -> ovs-br
           |                  \        /                  |
     (linux bridge)          (veth peers)           (openvswitch)

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add kerberos authentication support for nsupdate

Up until now snf-network used nsupdate with a keyfile to
dynamically update DNS entries on an external nameserver
(bind9). This patch adds support for authenticating against an
AD controller using Kerberos.

Specifically we use "k5start -H" to ensure there is a happy ticket,
otherwise use a keytab containing the password to obtain a ticket
automatically. Finally, we use nsupdate in GSS-TSIG mode (-g option) to
update AD-integrated DNS server.

The keytab file can be added with:

 # ktutil -v add -V 1 -e aes256-cts -p PRINCIPAL

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add doc section wrt kerberos authentication

..that explains how to configure snf-network in order to use
it for dynamic DNS update against an AD controller.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Merge branch 'develop' into debian-develop
Add kerberos related settings in defaults

KERBEROS_PRINCIPAL is the service principal used with:
 # k5util -v add -p

KERBEROS_KEYTAB is by default /etc/krb5.keytab

KERBEROS_KSTART_ARGS default to "-H 1 -l 1h" (i.e. checks
for a happy ticket and sets the ticket lifetime upon renewal)

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>