Skip to content

Commit 4d5c4fa

Browse files
yuyicaiyuyicai
authored
Merge pull request #449 from kubenetworks/tun-ip-cidr
feat: change tun ip cidr
2 parents 547501f + 3a4bfa9 commit 4d5c4fa

17 files changed

+89
-34
lines changed

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -656,7 +656,7 @@ OK: 8 MiB in 19 packages
656656
Hello world!/opt/microservices #
657657
658658
/opt/microservices # curl authors:9080/health -H "foo: bar"
659-
>>Received request: GET /health from 223.254.0.109:57930
659+
>>Received request: GET /health from 198.19.0.109:57930
660660
Hello world!/opt/microservices #
661661
/opt/microservices # curl localhost:9080/health
662662
{"status":"Authors is healthy"}/opt/microservices # exit

‎README_ZH.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -580,7 +580,7 @@ OK: 8 MiB in 19 packages
580580
Hello world!/opt/microservices #
581581
582582
/opt/microservices # curl authors:9080/health -H "foo: bar"
583-
>>Received request: GET /health from 223.254.0.109:57930
583+
>>Received request: GET /health from 198.19.0.109:57930
584584
Hello world!/opt/microservices #
585585
/opt/microservices # curl localhost:9080/health
586586
{"status":"Authors is healthy"}/opt/microservices # exit

‎charts/kubevpn/templates/deployment.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -52,13 +52,13 @@ spec:
5252
- -c
5353
env:
5454
- name: CIDR4
55-
value: 223.254.0.0/16
55+
value: 198.19.0.0/16
5656
- name: CIDR6
57-
value: efff:ffff:ffff:ffff::/64
57+
value: 2001:2::/64
5858
- name: TunIPv4
59-
value: 223.254.0.100/16
59+
value: 198.19.0.100/16
6060
- name: TunIPv6
61-
value: efff:ffff:ffff:ffff:ffff:ffff:ffff:9999/64
61+
value: 2001:2::9999/64
6262
envFrom:
6363
- secretRef:
6464
name: {{ include "kubevpn.fullname" . }}

‎cmd/kubevpn/cmds/serve.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ func CmdServe(_ cmdutil.Factory) *cobra.Command {
3131
`)),
3232
Example: templates.Examples(i18n.T(`
3333
# serve node
34-
kubevpn serve -L "tcp://:10800" -L "tun://127.0.0.1:8422?net=223.254.0.123/32"
34+
kubevpn serve -L "tcp://:10800" -L "tun://127.0.0.1:8422?net=198.19.0.123/32"
3535
`)),
3636
PreRun: func(*cobra.Command, []string) {
3737
util.InitLoggerForServer(config.Debug)

‎cmd/kubevpn/cmds/ssh.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ import (
2626
)
2727

2828
// CmdSSH
29-
// Remember to use network mask 32, because ssh using unique network CIDR 223.255.0.0/16
29+
// Remember to use network mask 32, because ssh using unique network CIDR 198.18.0.0/16
3030
func CmdSSH(_ cmdutil.Factory) *cobra.Command {
3131
var sshConf = &pkgssh.SshConfig{}
3232
var extraCIDR []string

‎cmd/kubevpn/cmds/sshdaemon.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import (
1414
)
1515

1616
// CmdSSHDaemon
17-
// set local tun ip 223.254.0.1/32, remember to use mask 32
17+
// set local tun ip 198.19.0.1/32, remember to use mask 32
1818
func CmdSSHDaemon(_ cmdutil.Factory) *cobra.Command {
1919
var clientIP string
2020
cmd := &cobra.Command{
@@ -24,7 +24,7 @@ func CmdSSHDaemon(_ cmdutil.Factory) *cobra.Command {
2424
Long: templates.LongDesc(i18n.T(`Ssh daemon server`)),
2525
Example: templates.Examples(i18n.T(`
2626
# SSH daemon server
27-
kubevpn ssh-daemon --client-ip 223.254.0.123/32
27+
kubevpn ssh-daemon --client-ip 198.19.0.123/32
2828
`)),
2929
PreRunE: func(cmd *cobra.Command, args []string) error {
3030
err := daemon.StartupDaemon(cmd.Context())

‎cmd/kubevpn/cmds/status_test.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ func TestPrintProxyAndClone(t *testing.T) {
2929
RuleList: []*rpc.ProxyRule{
3030
{
3131
Headers: map[string]string{"user": "naison"},
32-
LocalTunIPv4: "223.254.0.103",
33-
LocalTunIPv6: "efff:ffff:ffff:ffff:ffff:ffff:ffff:999d",
32+
LocalTunIPv4: "198.19.0.103",
33+
LocalTunIPv6: "2001:2::999d",
3434
CurrentDevice: false,
3535
PortMap: map[int32]int32{8910: 8910},
3636
},
@@ -98,8 +98,8 @@ func TestPrintProxy(t *testing.T) {
9898
RuleList: []*rpc.ProxyRule{
9999
{
100100
Headers: map[string]string{"user": "naison"},
101-
LocalTunIPv4: "223.254.0.103",
102-
LocalTunIPv6: "efff:ffff:ffff:ffff:ffff:ffff:ffff:999d",
101+
LocalTunIPv4: "198.19.0.103",
102+
LocalTunIPv6: "2001:2::999d",
103103
CurrentDevice: false,
104104
PortMap: map[int32]int32{8910: 8910},
105105
},

‎pkg/config/config.go

+25-8
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,10 @@ const (
3535
VolumeEnvoyConfig = "envoy-config"
3636
VolumeSyncthing = "syncthing"
3737

38-
innerIPv4Pool = "223.254.0.100/16"
38+
// innerIPv4Pool is used as tun ip
39+
// 198.19.0.0/16 network is part of the 198.18.0.0/15 (reserved for benchmarking).
40+
// https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
41+
innerIPv4Pool = "198.19.0.100/16"
3942
// 原因：在docker环境中，设置docker的 gateway 和 subnet，不能 inner 的冲突，也不能和 docker的 172.17 冲突
4043
// 不然的话，请求会不通的
4144
// 解决的问题：在 k8s 中的 名叫 kubernetes 的 service ip 为
@@ -51,10 +54,11 @@ const (
5154
// }
5255
//]
5356
// 如果不创建 network，那么是无法请求到 这个 kubernetes 的 service 的
54-
dockerInnerIPv4Pool = "223.255.0.100/16"
57+
dockerInnerIPv4Pool = "198.18.0.100/16"
5558

56-
//The IPv6 address prefixes FE80::/10 and FF02::/16 are not routable
57-
innerIPv6Pool = "efff:ffff:ffff:ffff:ffff:ffff:ffff:9999/64"
59+
// 2001:2::/64 network is part of the 2001:2::/48 (reserved for benchmarking)
60+
// https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
61+
innerIPv6Pool = "2001:2::9999/64"
5862

5963
DefaultNetDir = "/etc/cni/net.d"
6064

@@ -116,10 +120,23 @@ var (
116120
)
117121

118122
func init() {
119-
RouterIP, CIDR, _ = net.ParseCIDR(innerIPv4Pool)
120-
RouterIP6, CIDR6, _ = net.ParseCIDR(innerIPv6Pool)
121-
DockerRouterIP, DockerCIDR, _ = net.ParseCIDR(dockerInnerIPv4Pool)
122-
dir, _ := os.UserHomeDir()
123+
var err error
124+
RouterIP, CIDR, err = net.ParseCIDR(innerIPv4Pool)
125+
if err != nil {
126+
panic(err)
127+
}
128+
RouterIP6, CIDR6, err = net.ParseCIDR(innerIPv6Pool)
129+
if err != nil {
130+
panic(err)
131+
}
132+
DockerRouterIP, DockerCIDR, err = net.ParseCIDR(dockerInnerIPv4Pool)
133+
if err != nil {
134+
panic(err)
135+
}
136+
dir, err := os.UserHomeDir()
137+
if err != nil {
138+
panic(err)
139+
}
123140
DaemonPath = filepath.Join(dir, HOME, Daemon)
124141
HomePath = filepath.Join(dir, HOME)
125142
PprofPath = filepath.Join(dir, HOME, Daemon, PProfDir)

‎pkg/core/gvisortunendpoint.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ func (h *gvisorTCPHandler) readFromTCPConnWriteToEndpoint(ctx context.Context, c
9797
}
9898

9999
h.addRoute(src, conn)
100-
// inner ip like 223.254.0.100/102/103 connect each other
100+
// inner ip like 198.19.0.100/102/103 connect each other
101101
if config.CIDR.Contains(dst) || config.CIDR6.Contains(dst) {
102102
log.Tracef("[TUN-RAW] Forward to TUN device, SRC: %s, DST: %s, Length: %d", src.String(), dst.String(), read)
103103
util.SafeWrite(h.packetChan, &datagramPacket{

‎pkg/core/route.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@ type TCPUDPacket struct {
2727
}
2828

2929
// Route example:
30-
// -L "tcp://:10800" -L "tun://:8422?net=223.254.0.100/16"
31-
// -L "tun:/10.233.24.133:8422?net=223.254.0.102/16&route=223.254.0.0/16"
32-
// -L "tun:/127.0.0.1:8422?net=223.254.0.102/16&route=223.254.0.0/16,10.233.0.0/16" -F "tcp://127.0.0.1:10800"
30+
// -L "tcp://:10800" -L "tun://:8422?net=198.19.0.100/16"
31+
// -L "tun:/10.233.24.133:8422?net=198.19.0.102/16&route=198.19.0.0/16"
32+
// -L "tun:/127.0.0.1:8422?net=198.19.0.102/16&route=198.19.0.0/16,10.233.0.0/16" -F "tcp://127.0.0.1:10800"
3333
type Route struct {
3434
ServeNodes []string // -L tun
3535
ChainNode string // -F tcp

‎pkg/daemon/daemon.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ func (o *SvrOption) Start(ctx context.Context) error {
9999
grpc_health_v1.RegisterHealthServer(svr, health.NewServer())
100100
defer cleanup()
101101
reflection.Register(svr)
102-
// [tun-client] 223.254.0.101 - 127.0.0.1:8422: dial tcp 127.0.0.1:55407: connect: can't assign requested address
102+
// [tun-client] 198.19.0.101 - 127.0.0.1:8422: dial tcp 127.0.0.1:55407: connect: can't assign requested address
103103
http.DefaultTransport.(*http.Transport).MaxIdleConnsPerHost = 100
104104
// startup a http server
105105
// With downgrading-capable gRPC server, which can also handle HTTP.

‎pkg/dev/docker_utils.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ func RunLogsSinceNow(name string, follow bool) error {
9090
}
9191

9292
// CreateNetwork
93-
// docker create kubevpn-traffic-manager --labels owner=config.ConfigMapPodTrafficManager --subnet 223.255.0.0/16 --gateway 223.255.0.100
93+
// docker create kubevpn-traffic-manager --labels owner=config.ConfigMapPodTrafficManager --subnet 198.18.0.0/16 --gateway 198.18.0.100
9494
func CreateNetwork(ctx context.Context, name string) (string, error) {
9595
args := []string{
9696
"network",

‎pkg/handler/connect.go

+38
Original file line numberDiff line numberDiff line change
@@ -905,6 +905,44 @@ func (c *ConnectOptions) upgradeDeploy(ctx context.Context) error {
905905
_, err = polymorphichelpers.UpdatePodSpecForObjectFn(obj, func(spec *v1.PodSpec) error {
906906
for i := range spec.Containers {
907907
spec.Containers[i].Image = clientImg
908+
909+
// update tun cidr for vpn
910+
if spec.Containers[i].Name == config.ContainerSidecarVPN {
911+
innerIpv4CIDR := net.IPNet{IP: config.RouterIP, Mask: config.CIDR.Mask}
912+
innerIpv6CIDR := net.IPNet{IP: config.RouterIP6, Mask: config.CIDR6.Mask}
913+
envVars := []v1.EnvVar{
914+
{
915+
Name: "CIDR4",
916+
Value: config.CIDR.String(),
917+
},
918+
{
919+
Name: "CIDR6",
920+
Value: config.CIDR6.String(),
921+
},
922+
{
923+
Name: config.EnvInboundPodTunIPv4,
924+
Value: innerIpv4CIDR.String(),
925+
},
926+
{
927+
Name: config.EnvInboundPodTunIPv6,
928+
Value: innerIpv6CIDR.String(),
929+
},
930+
}
931+
932+
for _, env := range envVars {
933+
found := false
934+
for j, existing := range spec.Containers[i].Env {
935+
if existing.Name == env.Name {
936+
spec.Containers[i].Env[j].Value = env.Value
937+
found = true
938+
break
939+
}
940+
}
941+
if !found {
942+
spec.Containers[i].Env = append(spec.Containers[i].Env, env)
943+
}
944+
}
945+
}
908946
}
909947
return nil
910948
})

‎pkg/inject/exchange.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ func AddContainer(spec *corev1.PodSpec, c util.PodRouteConfig) {
7979
},
8080
Command: []string{"/bin/sh", "-c"},
8181
// https://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html#ss6.2
82-
// for curl -g -6 [efff:ffff:ffff:ffff:ffff:ffff:ffff:999a]:9080/health or curl 127.0.0.1:9080/health hit local PC
82+
// for curl -g -6 [2001:2::999a]:9080/health or curl 127.0.0.1:9080/health hit local PC
8383
// output chain
8484
// iptables -t nat -A OUTPUT -o lo ! -p icmp -j DNAT --to-destination ${LocalTunIPv4}
8585
// ip6tables -t nat -A OUTPUT -o lo ! -p icmp -j DNAT --to-destination ${LocalTunIPv6}

‎pkg/util/networkpolicy_windows.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ func decode(in []byte) ([]byte, error) {
9696
// AddAllowFirewallRule
9797
// for ping local tun device ip, if not add this firewall, can not ping local tun IP on windows
9898
func AddAllowFirewallRule(ctx context.Context) {
99-
// netsh advfirewall firewall add rule name=kubevpn-traffic-manager dir=in action=allow enable=yes remoteip=223.254.0.100/16,efff:ffff:ffff:ffff:ffff:ffff:ffff:9999/64,LocalSubnet
99+
// netsh advfirewall firewall add rule name=kubevpn-traffic-manager dir=in action=allow enable=yes remoteip=198.19.0.100/16,2001:2::9999/64,LocalSubnet
100100
cmd := exec.CommandContext(ctx, "netsh", []string{
101101
"advfirewall",
102102
"firewall",

‎pkg/util/util_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,8 @@ func TestName(t *testing.T) {
6565

6666
func TestPing(t *testing.T) {
6767
defer util.Run()()
68-
SrcIP := net.ParseIP("223.254.0.102").To4()
69-
DstIP := net.ParseIP("223.254.0.100").To4()
68+
SrcIP := net.ParseIP("198.19.0.102").To4()
69+
DstIP := net.ParseIP("198.19.0.100").To4()
7070

7171
icmpLayer := layers.ICMPv4{
7272
TypeCode: layers.CreateICMPv4TypeCode(layers.ICMPv4TypeEchoRequest, 0),

‎pkg/webhook/pods.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ func (h *admissionReviewHandler) handleCreate(ar v1.AdmissionReview) *v1.Admissi
7272
return &v1.AdmissionResponse{UID: ar.Request.UID, Allowed: true}
7373
}
7474
// if create pod kubevpn-traffic-manager, just ignore it
75-
// because 223.254.0.100 is reserved
75+
// because 198.19.0.100 is reserved
7676
if x, _, _ := net.ParseCIDR(value); config.RouterIP.Equal(x) {
7777
return &v1.AdmissionResponse{UID: ar.Request.UID, Allowed: true}
7878
}
@@ -163,7 +163,7 @@ func (h *admissionReviewHandler) handleDelete(ar v1.AdmissionReview) *v1.Admissi
163163
return &v1.AdmissionResponse{Allowed: true}
164164
}
165165
// if delete pod kubevpn-traffic-manager, just ignore it
166-
// because 223.254.0.100 is reserved
166+
// because 198.19.0.100 is reserved
167167
if x, _, _ := net.ParseCIDR(value); config.RouterIP.Equal(x) {
168168
return &v1.AdmissionResponse{Allowed: true}
169169
}

0 commit comments

Comments
 (0)