User-AS: support bind IP for user attachment point

scionlab/forms/user_as_form.py

@@ -13,7 +13,7 @@
 # limitations under the License.
 from crispy_forms.bootstrap import AppendedText
 from crispy_forms.helper import FormHelper
-from crispy_forms.layout import Layout, Field, Column, Row, Div
+from crispy_forms.layout import Layout, Field, HTML, Column, Row, Div
 from django import forms
 from django.forms import modelformset_factory
 from django.core.exceptions import ValidationError
@@ -46,8 +46,21 @@ def _crispy_helper(instance):
  ),
  Div(
  Row(
- Column('public_ip', css_class='col-md-5'),
- Column('provide_vpn', css_class='col-md-5'),
+ Column('public_ip', css_class='col-md-6'),
+ Column('provide_vpn', css_class='col-md-4'),
+ ),
+ Row(
+ HTML("""<button type="button" class="btn btn-link bind-row-collapser collapsed"
+ aria-expanded="false" aria-controls="bind-row">
+ Show binding options for NAT
+ <i class="fa fa-plus-circle"></i>
+ <i class="fa fa-minus-circle"></i>
+ </button>""")
+ ),
+ Row(
+ Column(AppendedText('bind_ip', '<span class="fa fa-external-link-square"/>'),
+ css_class='col-md-6'),
+ css_class="bind-row"
  ),
  css_class="card-body", css_id="user-ap-card-body",
  ),
@@ -104,6 +117,12 @@ class UserASForm(forms.Form):
  label="Public IP",
  help_text="Public IP Address to be used for connections to child ASes"
  )
+ bind_ip = forms.GenericIPAddressField(
+ required=False,
+ label="Bind IP address",
+ help_text="(Optional) Specify the local IP "
+ "if your border router is behind a NAT/firewall etc.",
+ )
  provide_vpn = forms.BooleanField(
  required=False,
  label="Provide VPN",
@@ -144,6 +163,7 @@ def __init__(self, data=None, *args, **kwargs):
  'label': self.instance.label,
  'installation_type': self.instance.installation_type,
  'public_ip': host.public_ip,
+ 'bind_ip': host.bind_ip,
  'become_user_ap': is_ap,
  'provide_vpn': has_vpn
  })
@@ -193,6 +213,7 @@ def save(self, commit=True):
  installation_type=self.cleaned_data['installation_type'],
  label=self.cleaned_data['label'],
  public_ip=self.cleaned_data['public_ip'],
+ bind_ip=self.cleaned_data['bind_ip'],
  wants_user_ap=self.cleaned_data['become_user_ap'],
  wants_vpn=self.cleaned_data['provide_vpn'],
  )
@@ -203,6 +224,7 @@ def save(self, commit=True):
  installation_type=self.cleaned_data['installation_type'],
  label=self.cleaned_data['label'],
  public_ip=self.cleaned_data['public_ip'],
+ bind_ip=self.cleaned_data['bind_ip'],
  wants_user_ap=self.cleaned_data['become_user_ap'],
  wants_vpn=self.cleaned_data['provide_vpn'],
  )

scionlab/models/user_as.py

@@ -51,7 +51,8 @@ def create(self,
  owner: User,
  installation_type: str,
  isd: int,
- public_ip: str = "",
+ public_ip: str = None,
+ bind_ip: str = None,
  wants_user_ap: bool = False,
  wants_vpn: bool = False,
  as_id: str = None,
@@ -62,6 +63,7 @@ def create(self,
  :param str installation_type:
  :param int isd:
  :param str public_ip: optional public IP address for the host of the AS
+ :param str bind_ip: optional bind IP address for the host of the AS
  :param bool wants_user_ap: optional boolean if the User AS should be AP
  :param str wants_vpn: optional boolean if the User AP should provide a VPN
  :param str as_id: optional as_id, if None is given, the next free ID is chosen
@@ -90,7 +92,7 @@ def create(self,
 
  user_as.generate_keys()
  user_as.generate_certs()
- user_as.init_default_services(public_ip=public_ip)
+ user_as.init_default_services(public_ip=public_ip, bind_ip=bind_ip)
 
  if wants_user_ap:
  host = user_as.hosts.first()
@@ -148,7 +150,7 @@ class Meta:
  def get_absolute_url(self):
  return urls.reverse('user_as_detail', kwargs={'pk': self.pk})
 
- def update(self, label: str, installation_type: str, public_ip: str = "",
+ def update(self, label: str, installation_type: str, public_ip: str = None, bind_ip: str = None,
  wants_user_ap: bool = False, wants_vpn: bool = False):
  """
  Updates the `UserAS` fields and immediately saves
@@ -161,7 +163,7 @@ def update(self, label: str, installation_type: str, public_ip: str = "",
  self._unset_bind_ips_for_vagrant()
  self.installation_type = installation_type
  host = self.host
- host.update(public_ip=public_ip)
+ host.update(public_ip=public_ip, bind_ip=bind_ip)
  if self.is_attachment_point():
  # the case has_vpn and not wants_vpn will be ignored here because it's not allowed
  ap = self.attachment_point_info

scionlab/openvpn_config.py

@@ -213,7 +213,7 @@ def generate_vpn_server_config(vpn):
  server_vpn_subnet = vpn.vpn_subnet()
 
  server_config = string.Template(server_config_tmpl).substitute(
- ServerPublicIP=vpn.server.public_ip,
+ ServerPublicIP=vpn.server.bind_ip or vpn.server.public_ip,
  ServerPort=vpn.server_port,
  ServerVPNIP=vpn.server_vpn_ip,
  Netmask=server_vpn_subnet.netmask,

scionlab/templates/scionlab/partials/user_as_form_script.html

@@ -65,7 +65,7 @@
  }
  $('.bind-row-collapser').each(function() {
  // Init collapser and bind-row
- let bind_row = $(this).closest('.attachment').find('.bind-row')
+ let bind_row = $(this).closest('.card-body').find('.bind-row')
  bind_row.addClass('collapse')
  if (!should_collapse_bind_row(bind_row)) {
  bind_row.addClass('show')
@@ -74,7 +74,7 @@
  });
  $('.bind-row-collapser').click(function() {
  // Toggle collapse state for collapser and bind-row
- let bind_row = $(this).closest('.attachment').find('.bind-row')
+ let bind_row = $(this).closest('.card-body').find('.bind-row')
  $(this).toggleClass('collapsed')
  bind_row.collapse('toggle')
  });