7 Commits

Author SHA1 Message Date
Tore Anderson
5e085f1b17 Release clatd v2.1.0
New feature:

* Support for RFC 8781 PLAT prefix discovery through the PREF64 Router
  Advertisement option. Relies on systemd-networkd's support for the
  same being enabled. (See issue #32.)

Bugfixes:

* Create any missing leading directories in the Makefile's install
  target. (See pull request #47, thanks @DanielG!)
* Apply metadata mark earlier in the nftables pipeline. This makes clatd
  interoperate with the IPv6 reverse path filtering as implemented by
  NixOS. (See pull request #49, thanks @jmbaur!)
2025-03-21 08:46:54 +01:00
Tore Anderson
06c567b9cb Merge pull request #49 from jmbaur/chain-priority
Decrease priority number for prerouting chain. This makes clatd work out of the box on NixOS, which does IPv6 reverse path filtering at priority `mangle + 10`.
2025-03-21 08:19:36 +01:00
Jared Baur
f86f1cabb8 Decrease priority number for prerouting chain
This allows for clatd to work OOTB on distros shipping firewalls that do
reverse-path filtering based on conntrack marks in the "mangle" priority
(i.e. -150).
2025-03-20 15:20:14 -07:00
Tore Anderson
f812070f60 Separate DNS64 servers with spaces in debug output 2025-03-20 22:26:58 +01:00
Tore Anderson
f91d96b991 Get PLAT prefix from systemd-networkd, if possible
Makes clatd check if systemd-networkd is aware of any PLAT prefix (which
it may have learned from the PREF64 Router Advertisement option, cf. RFC
8781).

If a prefix is obtained from systemd-network, DNS64-based PLAT prefix
discovery is skipped, as mandated by
https://datatracker.ietf.org/doc/draft-ietf-v6ops-prefer8781/.

However, if the dns64-servers config option is set, clatd will use
DNS64-based PLAT prefix discovery towards the specified servers, and it
will not query systemd-networkd at all.

Closes #32
2025-02-22 10:00:45 +01:00
Tore Anderson
b93a5526a5 Merge pull request #47 from DanielG/fix-makefile
Fix Makefile for distros
2025-02-21 13:07:50 +01:00
Daniel Gröber
6f98967f0e Fix Makefile for distros
The first declared target (previously 'install') is use when make is called
without a target argument. This breaks the assumptions of distros.

Further install needs -D to creat the necessary target directories or it
behaves as cp and the target dirs need to exist already.
2025-02-21 12:49:05 +01:00
2 changed files with 8 additions and 5 deletions

View File

@@ -7,9 +7,11 @@ DNF_OR_YUM:=$(shell which dnf || which yum)
SYSTEMCTL:=$(shell which systemctl)
TAYGA:=$(shell which tayga)
all:
install:
# Install the main script
install -m0755 clatd $(DESTDIR)$(PREFIX)/sbin/clatd
install -D -m0755 clatd $(DESTDIR)$(PREFIX)/sbin/clatd
# Install manual page if pod2man is installed
pod2man --name clatd --center "clatd - a CLAT implementation for Linux" --section 8 README.pod $(DESTDIR)$(PREFIX)/share/man/man8/clatd.8 && gzip -f9 $(DESTDIR)$(PREFIX)/share/man/man8/clatd.8 || echo "pod2man is required to generate manual page"
# Install systemd service file if applicable for this system

9
clatd
View File

@@ -27,7 +27,7 @@ use strict;
use IPC::Cmd qw(can_run);
use Net::IP;
my $VERSION = "2.0.0";
my $VERSION = "2.1.0";
#
# Populate the global config hash with the default values
@@ -357,7 +357,8 @@ sub get_plat_prefix_from_dns64 {
$res->nameservers(map {
Net::IP->new($_)->version() == 4 ? "::ffff:$_" : $_;
} $res->nameservers);
d2("Nameservers after Net::DNS bug workaround: ", $res->nameservers);
d2("Nameservers after Net::DNS bug workaround: ",
join(" ", $res->nameservers));
my $pkt = $res->query('ipv4only.arpa', 'AAAA');
if(!$pkt) {
@@ -1055,13 +1056,13 @@ if(cfgint("ctmark")) {
or err("'nft -f-' failed to execute");
print $fd "add table ip6 clatd\n";
print $fd "add chain ip6 clatd prerouting ",
"{ type filter hook prerouting priority 0; }\n";
"{ type filter hook prerouting priority mangle; }\n";
print $fd "add rule ip6 clatd prerouting",
" iif ", cfg("clat-dev"),
" ip6 saddr ", cfg("clat-v6-addr"),
" ip6 daddr ", cfg("plat-prefix"),
" ct mark set ", cfgint("ctmark"),
# set meta mark as well, to placate firewalld's IPv6_rpfilter
# set meta mark as well, to placate firewalld's IPv6_rpfilter and NixOS' rpfilter rules
" meta mark set ", cfgint("ctmark"), " counter\n";
print $fd "add rule ip6 clatd prerouting",
" iif ", cfg("plat-dev"),