ffho_net.py 47 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495
  1. #!/usr/bin/python
  2. import collections
  3. from functools import cmp_to_key
  4. import ipaddress
  5. import re
  6. from copy import deepcopy
  7. mac_prefix = "f2"
  8. # VRF configuration map
  9. vrf_info = {
  10. 'vrf_external' : {
  11. 'table' : 1023,
  12. 'fwmark' : [ '0x1', '0x1023' ],
  13. },
  14. }
  15. #
  16. # Default parameters added to any given bonding interface,
  17. # if not specified at the interface configuration.
  18. default_bond_config = {
  19. 'bond-mode': '802.3ad',
  20. 'bond-min-links': '1',
  21. 'bond-xmit-hash-policy': 'layer3+4'
  22. }
  23. #
  24. # Default parameters added to any given bridge interface,
  25. # if not specified at the interface configuration.
  26. default_bridge_config = {
  27. 'bridge-fd' : '0',
  28. 'bridge-stp' : 'no',
  29. 'bridge-ports-condone-regex' : '^[a-zA-Z0-9]+_(v[0-9]{1,4}|eth[0-9])$',
  30. }
  31. #
  32. # Hop penalty to be set if none is explicitly specified.
  33. # Check if one of these roles is configured for any given node, use first match.
  34. default_hop_penalty_by_role = {
  35. 'bbr' : 5,
  36. 'bras' : 50,
  37. 'batman_gw' : 50,
  38. 'batman_ext': 50,
  39. }
  40. batman_role_evaluation_order = [ 'bbr', 'batman_gw', 'bras' ]
  41. # By default we do not set any penalty on an interface and rely on the
  42. # regular hop penalty to do the right thing. We only want set another
  43. # penalty, if there are additional paths and we want to influnce which
  44. # path is being taken. One example are routers which have a wifi link
  45. # to the local backbone as well as a VPN link to a gateway, or a fiber
  46. # link plus a wifi backup link.
  47. default_batman_iface_penalty_by_role = {
  48. 'default' : 0,
  49. 'WBBL' : 5,
  50. 'WBBL_backup' : 10,
  51. 'VPN_intergw' : 80,
  52. 'VPN_node' : 100,
  53. }
  54. #
  55. # Default interface attributes to be added to GRE interface to AS201701 when
  56. # not already present in pillar interface configuration.
  57. GRE_FFRL_attrs = {
  58. 'mode' : 'gre',
  59. 'method' : 'tunnel',
  60. 'mtu' : '1400',
  61. 'ttl' : '64',
  62. }
  63. # The IPv4/IPv6 prefix used for Loopback IPs
  64. loopback_prefix = {
  65. 'v4' : '10.132.255.',
  66. 'v6' : '2a03:2260:2342:ffff::',
  67. }
  68. # The DNS zone base names used for generating zone files from IP address
  69. # configured on nodes interfaces.
  70. DNS_zone_names = {
  71. 'forward' : 'ffho.net',
  72. 'rev_v4' : [
  73. '132.10.in-addr.arpa',
  74. '30.172.in-addr.arpa',
  75. ],
  76. 'rev_v6' : [
  77. '2.4.3.2.0.6.2.2.3.0.a.2.ip6.arpa',
  78. ]
  79. }
  80. # MTU configuration
  81. MTU = {
  82. # The default MTU for any interface which does not have a MTU configured
  83. # explicitly in the pillar node config or does not get a MTU configured
  84. # by any means of this SDN stuff here.
  85. 'default' : 1500,
  86. # A batman underlay device, probably a VXLAN or VLAN interface.
  87. #
  88. # 1500
  89. # + 60 B.A.T.M.A.N. adv header + network coding (activated by default by Debian)
  90. 'batman_underlay_iface' : 1560,
  91. # VXLAN underlay device, probably a VLAN within $POP or between two BBRs.
  92. #
  93. # 1560
  94. # + 14 Inner Ethernet Frame
  95. # + 8 VXLAN Header
  96. # + 8 UDP Header
  97. # + 20 IPv4 Header
  98. 'vxlan_underlay_iface' : 1610,
  99. }
  100. ################################################################################
  101. # #
  102. # Internal data types and functions #
  103. # #
  104. # Touching anything below will void any warranty you never had ;) #
  105. # #
  106. ################################################################################
  107. ################################################################################
  108. # Data types #
  109. ################################################################################
  110. class Prefix (object):
  111. """An internet address with a prefix length.
  112. The given address is expected to be of format ip/plen in CIDR notation.
  113. The IP as well as the prefix length and address family will be stored
  114. in attributes.
  115. .. code-block:: pycon
  116. >>> a = Prefix ('10.132.23.42/24')
  117. >>> str (a.ip)
  118. '10.132.23.42'
  119. >>> str (a.af)
  120. '4'
  121. >>> str (a.plen)
  122. '24'
  123. >>> str (a.netmask)
  124. '255.255.255.0'
  125. >>> str (a.network_address)
  126. '10.132.23.0'
  127. """
  128. def __init__ (self, prefix):
  129. self.prefix = prefix
  130. self.ip_network = ipaddress.ip_network (u'%s' % prefix, strict = False)
  131. def __eq__ (self, other):
  132. if isinstance (other, Prefix):
  133. return self.ip_network == other.ip_network
  134. return NotImplemented
  135. def __lt__ (self, other):
  136. if isinstance (other, Prefix):
  137. return self.ip_network < other.ip_network
  138. return NotImplemented
  139. def __str__ (self):
  140. return self.prefix
  141. @property
  142. def ip (self):
  143. return self.prefix.split ('/')[0]
  144. @property
  145. def af (self):
  146. return self.ip_network.version
  147. @property
  148. def plen (self):
  149. return self.ip_network.prefixlen
  150. @property
  151. def netmask (self):
  152. return self.ip_network.netmask
  153. @property
  154. def network_address (self):
  155. return self.ip_network.network_address
  156. ################################################################################
  157. # Functions #
  158. ################################################################################
  159. sites = None
  160. def _get_site_no (sites_config, site_name):
  161. global sites
  162. if sites == None:
  163. sites = {}
  164. for site in sites_config:
  165. if site.startswith ("_"):
  166. continue
  167. sites[site] = sites_config[site].get ("site_no", -2)
  168. return sites.get (site_name, -1)
  169. #
  170. # Generate a MAC address after the format f2:dd:dd:ss:nn:nn where
  171. # dd:dd is the hexadecimal reprensentation of the nodes device_id
  172. # ff:ff representing the gluon nodes
  173. #
  174. # ss is the hexadecimal reprensentation of the site_id the interface is connected to
  175. #
  176. # nn:nn is the decimal representation of the network the interface is connected to, with
  177. # 00:00 being the BATMAN interface
  178. # 00:0d being the dummy interface
  179. # 00:0f being the VEth internal side interface
  180. # 00:e0 being an external instance BATMAN interface
  181. # 00:ed being an external instance dummy interface
  182. # 00:e1 being an inter-gw-vpn interface
  183. # 00:e4 being an nodes fastd tunnel interface of IPv4 transport
  184. # 00:e6 being an nodes fastd tunnel interface of IPv6 transport
  185. # 00:ef being an extenral instance VEth interface side
  186. # 02:xx being a connection to local Vlan 2xx
  187. # xx:xx being a VXLAN tunnel for site ss, with xx being the underlay VLAN ID (1xyz, 2xyz)
  188. # ff:ff being the gluon next-node interface
  189. def gen_batman_iface_mac (site_no, device_no, network):
  190. net_type_map = {
  191. 'bat' : "00:00",
  192. 'dummy' : "00:0d",
  193. 'int2ext' : "00:0f",
  194. 'bat-e' : "00:e0",
  195. 'intergw' : "00:e1",
  196. 'nodes4' : "00:e4",
  197. 'nodes6' : "00:e6",
  198. 'dummy-e' : "00:ed",
  199. 'ext2int' : "00:ef",
  200. }
  201. # Well-known network type?
  202. if network in net_type_map:
  203. last = net_type_map[network]
  204. elif type (network) == int:
  205. last = re.sub (r'(\d{2})(\d{2})', '\g<1>:\g<2>', "%04d" % network)
  206. else:
  207. last = "ee:ee"
  208. # Convert device_no to hex, format number to 4 digits with leading zeros and : betwwen 2nd and 3rd digit
  209. device_no_hex = re.sub (r'([0-9a-fA-F]{2})([0-9a-fA-F]{2})', '\g<1>:\g<2>', "%04x" % int (device_no))
  210. # Format site_no to two digit number with leading zero
  211. site_no_hex = "%02d" % int (site_no)
  212. return "%s:%s:%s:%s" % (mac_prefix, device_no_hex, site_no_hex, last)
  213. # Gather B.A.T.M.A.N. related config options for real batman devices (e.g. bat0)
  214. # as well as for batman member interfaces (e.g. eth0.100, fastd ifaces etc.)
  215. def _update_batman_config (node_config, iface, sites_config):
  216. try:
  217. node_batman_hop_penalty = int (node_config['batman']['hop-penalty'])
  218. except (KeyError,ValueError):
  219. node_batman_hop_penalty = None
  220. iface_config = node_config['ifaces'][iface]
  221. iface_type = iface_config.get ('type', 'inet')
  222. batman_config = {}
  223. for item in list (iface_config.keys ()):
  224. value = iface_config.get (item)
  225. if item.startswith ('batman-'):
  226. batman_config[item] = value
  227. iface_config.pop (item)
  228. # B.A.T.M.A.N. device (e.g. bat0)
  229. if iface_type == 'batman':
  230. if 'batman-hop-penalty' not in batman_config:
  231. # If there's a hop penalty set for the node, but not for the interface
  232. # apply the nodes hop penalty
  233. if node_batman_hop_penalty:
  234. batman_config['batman-hop-penalty'] = node_batman_hop_penalty
  235. # If there's no hop penalty set for the node, use a default hop penalty
  236. # for the roles the node might have, if any
  237. else:
  238. node_roles = node_config.get ('roles', [])
  239. for role in batman_role_evaluation_order:
  240. if role in node_roles:
  241. batman_config['batman-hop-penalty'] = default_hop_penalty_by_role[role]
  242. break
  243. if 'batman_ext' in node_roles and iface.endswith('-ext'):
  244. batman_config['batman-hop-penalty'] = default_hop_penalty_by_role['batman_ext']
  245. # If batman ifaces were specified as a list - which they should -
  246. # generate a sorted list of interface names as string representation
  247. if 'batman-ifaces' in batman_config and type (batman_config['batman-ifaces']) == list:
  248. batman_iface_str = " ".join (sorted (batman_config['batman-ifaces']))
  249. batman_config['batman-ifaces'] = batman_iface_str
  250. # B.A.T.M.A.N. member interface (e.g. eth.100, fastd ifaces, etc.)
  251. elif iface_type == 'batman_iface':
  252. # Generate unique MAC address for every batman iface, as B.A.T.M.A.N.
  253. # will get puzzled with multiple interfaces having the same MAC and
  254. # do nasty things.
  255. site = iface_config.get ('site')
  256. site_no = _get_site_no (sites_config, site)
  257. device_no = node_config.get ('id')
  258. network = 1234
  259. # Generate a unique BATMAN-MAC for this interfaces
  260. match = re.search (r'^vlan(\d+)', iface)
  261. if match:
  262. network = int (match.group (1))
  263. iface_config['hwaddress'] = gen_batman_iface_mac (site_no, device_no, network)
  264. iface_config['batman'] = batman_config
  265. # Mangle bond specific config items with default values and store them in
  266. # separate sub-dict for easier access and configuration.
  267. def _update_bond_config (config):
  268. bond_config = default_bond_config.copy ()
  269. to_pop = []
  270. for item, value in config.items ():
  271. if item.startswith ('bond-'):
  272. bond_config[item] = value
  273. to_pop.append (item)
  274. for item in to_pop:
  275. config.pop (item)
  276. if bond_config['bond-mode'] not in ['2', 'balance-xor', '4', '802.3ad']:
  277. bond_config.pop ('bond-xmit-hash-policy')
  278. config['bond'] = bond_config
  279. # Mangle bridge specific config items with default values and store them in
  280. # separate sub-dict for easier access and configuration.
  281. def _update_bridge_config (config):
  282. bridge_config = default_bridge_config.copy ()
  283. for item in list (config.keys ()):
  284. value = config.get (item)
  285. if not item.startswith ('bridge-'):
  286. continue
  287. bridge_config[item] = value
  288. config.pop (item)
  289. # Fix any salt mangled string interpretation back to real string.
  290. if type (value) == bool:
  291. bridge_config[item] = "yes" if value else "no"
  292. # If bridge ports were specified as a list - which they should -
  293. # generate a sorted list of interface names as string representation
  294. if 'bridge-ports' in bridge_config and type (bridge_config['bridge-ports']) == list:
  295. bridge_ports_str = " ".join (sorted (bridge_config['bridge-ports']))
  296. if not bridge_ports_str:
  297. bridge_ports_str = "none"
  298. bridge_config['bridge-ports'] = bridge_ports_str
  299. if config.get ('vlan-mode') == 'tagged':
  300. bridge_config['bridge-vlan-aware'] = 'yes'
  301. if config.get ('tagged_vlans'):
  302. bridge_config['bridge-vids'] = " ".join (map (str, config['tagged_vlans']))
  303. config['bridge'] = bridge_config
  304. # Generate config options for vlan-aware-bridge member interfaces
  305. def _update_bridge_member_config (config):
  306. bridge_config = {}
  307. if config.get ('tagged_vlans'):
  308. bridge_config['bridge-vids'] = " ".join (map (str, config['tagged_vlans']))
  309. config['bridge'] = bridge_config
  310. # Move vlan specific config items into a sub-dict for easier access and pretty-printing
  311. # in the configuration file
  312. def _update_vlan_config (config):
  313. vlan_config = {}
  314. for item in list (config.keys ()):
  315. value = config.get (item)
  316. if item.startswith ('vlan-'):
  317. vlan_config[item] = value
  318. config.pop (item)
  319. config['vlan'] = vlan_config
  320. # Pimp Veth interfaces
  321. # * Add peer interface name IF not present
  322. # * Add link-type veth IF not present
  323. def _update_veth_config (interface, config):
  324. veth_peer_name = {
  325. 'veth_ext2int' : 'veth_int2ext',
  326. 'veth_int2ext' : 'veth_ext2int'
  327. }
  328. if interface not in veth_peer_name:
  329. return
  330. if 'link-type' not in config:
  331. config['link-type'] = 'veth'
  332. if 'veth-peer-name' not in config:
  333. config['veth-peer-name'] = veth_peer_name[interface]
  334. # The given MTU to the given interface - presented by it's interface config dict -
  335. # IFF no MTU has already been set in the node pillar.
  336. #
  337. # @param ifaces: All interface configuration (as dict)
  338. # @param iface_name: Name of the interface to set MTU for
  339. # @param mtu: The MTU value to set (integer)
  340. # When <mtu> is <= 0, the <mtu> configured for <iface_name>
  341. # will be used to set the MTU of the upper interface, and the
  342. # default MTU if none is configured explicitly.
  343. def _set_mtu_to_iface_and_upper (ifaces, iface_name, mtu):
  344. iface_config = ifaces.get (iface_name)
  345. # By default we assume that we should set the given MTU value as the 'automtu'
  346. # attribute to allow distinction between manually set and autogenerated MTU
  347. # values.
  348. set_automtu = True
  349. # If a mtu values <= 0 is given, use the MTU configured for this interface
  350. # or, if none is set, the default value when configuring the vlan-raw-device.
  351. if mtu <= 0:
  352. set_automtu = False
  353. mtu = iface_config.get ('mtu', MTU['default'])
  354. # If this interface already has a MTU set - probably because someone manually
  355. # specified one in the node pillar - we do not touch the MTU of this interface.
  356. # Nevertheless it's worth looking at any underlying interface.
  357. if 'mtu' in iface_config:
  358. set_automtu = False
  359. # There might be - read: "we have" - a situation where on top of e.g. bond0
  360. # there are vlans holding VXLAN communicaton as well as VLANs directly carrying
  361. # BATMAN traffic. Now depending on which interface is evaluated first, the upper
  362. # MTU is either correct, or maybe to small.
  363. #
  364. # If any former autogenerated MTU is greater-or-equal than the one we want to
  365. # set now, we'll ignore it, and go for the greater one.
  366. elif 'automtu' in iface_config and iface_config['automtu'] >= mtu:
  367. set_automtu = False
  368. # If we still consider this a good move, set given MTU to this device.
  369. if set_automtu:
  370. iface_config['automtu'] = mtu
  371. # If this is a VLAN - which it probably is - fix the MTU of the underlying interface, too.
  372. # Check for 'vlan-raw-device' in iface_config and in vlan subconfig (yeah, that's not ideal).
  373. vlan_raw_device = None
  374. if 'vlan-raw-device' in iface_config:
  375. vlan_raw_device = iface_config['vlan-raw-device']
  376. elif 'vlan' in iface_config and 'vlan-raw-device' in iface_config['vlan']:
  377. vlan_raw_device = iface_config['vlan']['vlan-raw-device']
  378. if vlan_raw_device:
  379. vlan_raw_device_config = ifaces.get (vlan_raw_device, None)
  380. # vlan-raw-device might point to ethX which usually isn't configured explicitly
  381. # as ifupdown2 simply will bring it up anyway by itself. To set the MTU of such
  382. # an interface we have to add a configuration stanza for it here.
  383. if vlan_raw_device_config == None:
  384. vlan_raw_device_config = {}
  385. ifaces[vlan_raw_device] = vlan_raw_device_config
  386. # If there is a manually set MTU for this device, we don't do nothin'
  387. if 'mtu' in vlan_raw_device_config:
  388. return
  389. if 'automtu' in vlan_raw_device_config and vlan_raw_device_config['automtu'] >= mtu:
  390. return
  391. vlan_raw_device_config['automtu'] = mtu
  392. # Generate configuration entries for any batman related interfaces not
  393. # configured explicitly, but asked for implicitly by role batman and a
  394. # (list of) site(s) specified in the node config.
  395. def _generate_batman_interface_config (node_config, ifaces, sites_config):
  396. # No role 'batman', nothing to do
  397. roles = node_config.get ('roles', [])
  398. if 'batman' not in roles:
  399. return
  400. # Should there be a 2nd external BATMAN instance?
  401. batman_ext = 'batman_ext' in roles or 'bras' in roles
  402. device_no = node_config.get ('id', -1)
  403. for site in node_config.get ('sites', []):
  404. site_no = _get_site_no (sites_config, site)
  405. # Predefine interface names for regular/external BATMAN instance
  406. # and possible VEth link pair for connecting both instances.
  407. bat_site_if = "bat-%s" % site
  408. dummy_site_if = "dummy-%s" % site
  409. bat_site_if_ext = "bat-%s-ext" % site
  410. dummy_site_if_ext = "dummy-%s-e" % site
  411. int2ext_site_if = "i2e-%s" % site
  412. ext2int_site_if = "e2i-%s" % site
  413. site_ifaces = {
  414. # Regular BATMAN interface, always present
  415. bat_site_if : {
  416. 'type' : 'batman',
  417. # int2ext_site_if will be added automagically if requred
  418. 'batman-ifaces' : [ dummy_site_if ],
  419. 'batman-ifaces-ignore-regex': '.*_.*',
  420. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, 'bat'),
  421. },
  422. # Dummy interface always present in regular BATMAN instance
  423. dummy_site_if : {
  424. 'link-type' : 'dummy',
  425. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, 'dummy'),
  426. 'mtu' : MTU['batman_underlay_iface'],
  427. },
  428. # Optional 2nd "external" BATMAN instance
  429. bat_site_if_ext : {
  430. 'type' : 'batman',
  431. 'batman-ifaces' : [ dummy_site_if_ext, ext2int_site_if ],
  432. 'batman-ifaces-ignore-regex': '.*_.*',
  433. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, 'bat-e'),
  434. 'ext_only' : True,
  435. },
  436. # Optional dummy interface always present in 2nd "external" BATMAN instance
  437. dummy_site_if_ext : {
  438. 'link-type' : 'dummy',
  439. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, 'dummy-e'),
  440. 'ext_only' : True,
  441. 'mtu' : MTU['batman_underlay_iface'],
  442. },
  443. # Optional VEth interface pair - internal side
  444. int2ext_site_if : {
  445. 'link-type' : 'veth',
  446. 'veth-peer-name' : ext2int_site_if,
  447. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, 'int2ext'),
  448. 'mtu' : MTU['batman_underlay_iface'],
  449. 'ext_only' : True,
  450. },
  451. # Optional VEth interface pair - "external" side
  452. ext2int_site_if : {
  453. 'link-type' : 'veth',
  454. 'veth-peer-name' : int2ext_site_if,
  455. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, 'ext2int'),
  456. 'mtu' : MTU['batman_underlay_iface'],
  457. 'ext_only' : True,
  458. },
  459. }
  460. for iface, iface_config_tmpl in site_ifaces.items ():
  461. # Ignore any interface only relevant when role batman_ext is set
  462. # but it isn't
  463. if not batman_ext and iface_config_tmpl.get ('ext_only', False):
  464. continue
  465. # Remove ext_only key so we don't leak it into ifaces dict
  466. if 'ext_only' in iface_config_tmpl:
  467. del iface_config_tmpl['ext_only']
  468. # If there is no trace of the desired iface config yet...
  469. if iface not in ifaces:
  470. # ... just place our template there.
  471. ifaces[iface] = iface_config_tmpl
  472. # If there should be an 2nd external BATMAN instance make sure
  473. # the internal side of the VEth iface pair is connected to the
  474. # internal BATMAN instance.
  475. if batman_ext and iface == bat_site_if:
  476. iface_config_tmpl['batman-ifaces'].append (int2ext_site_if)
  477. # If there already is an interface configuration try to enhance it with
  478. # meaningful values from our template and force correct hwaddress to be
  479. # used.
  480. else:
  481. iface_config = ifaces[iface]
  482. # Force hwaddress to be what we expect.
  483. if 'hwaddress' in iface_config_tmpl:
  484. iface_config['hwaddress'] = iface_config_tmpl['hwaddress']
  485. # Copy every attribute of the config template missing in iface config
  486. for attr in iface_config_tmpl:
  487. if attr not in iface_config:
  488. iface_config[attr] = iface_config_tmpl[attr]
  489. # Configure bat_site_if to be part of br-<site>, if present
  490. site_bridge = "br-%s" % site
  491. if site_bridge in ifaces:
  492. bridge_config = ifaces.get (site_bridge)
  493. bridge_ports = bridge_config.get ('bridge-ports', None)
  494. # There are bridge-ports configured already, but bat_site_if is not present
  495. if bridge_ports and bat_site_if not in bridge_ports:
  496. if type (bridge_ports) == list:
  497. bridge_ports.append (bat_site_if)
  498. else:
  499. bridge_config['bridge-ports'] += ' ' + bat_site_if
  500. # There are no bridge-ports configured
  501. if not bridge_ports:
  502. bridge_config['bridge-ports'] = bat_site_if
  503. # Make sure there is a bridge present for every site where a mesh_breakout
  504. # interface should be configured.
  505. for iface in list (ifaces.keys ()):
  506. config = ifaces.get (iface)
  507. iface_type = config.get ('type', 'inet')
  508. if iface_type not in ['mesh_breakout', 'batman_iface']:
  509. continue
  510. site = config.get ('site')
  511. site_bridge = "br-%s" % site
  512. batman_site_if = "bat-%s" % site
  513. if iface_type == 'mesh_breakout':
  514. # If the bridge has already been defined (with an IP maybe) make
  515. # sure that the corresbonding batman device is part of the bridge-
  516. # ports.
  517. if site_bridge in ifaces:
  518. bridge_config = ifaces.get (site_bridge)
  519. # If there already is/are (a) bridge-port(s) defined, add
  520. # the batman and the breakout interfaces if not present...
  521. bridge_ports = bridge_config.get ('bridge-ports', None)
  522. if bridge_ports:
  523. for dev in (batman_site_if, iface):
  524. if not dev in bridge_ports:
  525. if type (bridge_ports) == list:
  526. bridge_ports.append (dev)
  527. else:
  528. bridge_config['bridge-ports'] += ' ' + dev
  529. # ...if there is no bridge-port defined yet, just used
  530. # the batman and breakout iface.
  531. else:
  532. bridge_config['bridge-ports'] = [ iface, batman_site_if ]
  533. # If the bridge isn't present alltogether, add it.
  534. else:
  535. ifaces[site_bridge] = {
  536. 'bridge-ports' : [ iface, batman_site_if ],
  537. }
  538. elif iface_type == 'batman_iface':
  539. batman_ifaces = ifaces[batman_site_if]['batman-ifaces']
  540. if iface not in batman_ifaces:
  541. if type (batman_ifaces) == list:
  542. batman_ifaces.append (iface)
  543. else:
  544. batman_ifaces += ' ' + iface
  545. # Use the MTU configured for this interface or, if none is set,
  546. # the default value for batman underlay iface.
  547. mtu = config.get('mtu', MTU['batman_underlay_iface'])
  548. _set_mtu_to_iface_and_upper (ifaces, iface, mtu)
  549. #
  550. # Generate any implicitly defined VXLAN interfaces defined in the nodes iface
  551. # defined in pillar.
  552. # The keyword "batman_connect_sites" on an interface will trigger the
  553. # generation of a VXLAN overlay interfaces.
  554. def _generate_vxlan_interface_config (node_config, ifaces, sites_config):
  555. # No role 'batman', nothing to do
  556. if 'batman' not in node_config.get ('roles', []):
  557. return
  558. # Sites configured on this node. Nothing to do, if none.
  559. my_sites = node_config.get ('sites', [])
  560. if len (my_sites) == 0:
  561. return
  562. # As we're still here we can now safely assume that a B.A.T.M.A.N.
  563. # device has been configured for every site specified in sites list.
  564. device_no = node_config.get ('id', -1)
  565. for iface in list (ifaces.keys ()):
  566. iface_config = ifaces.get (iface)
  567. batman_connect_sites = iface_config.get ('batman_connect_sites', [])
  568. iface_has_prefixes = len (iface_config.get ('prefixes', {})) != 0
  569. # If we got a string, convert it to a list with a single element
  570. if type (batman_connect_sites) == str:
  571. batman_connect_sites = [ batman_connect_sites ]
  572. # If the list of sites to connect is empty, there's nothing to do here.
  573. if len (batman_connect_sites) == 0:
  574. continue
  575. # Set the MTU of this (probably) VLAN device to the MTU required for a VXLAN underlay
  576. # device, where B.A.T.M.A.N. adv. is to be expected within the VXLAN overlay.
  577. _set_mtu_to_iface_and_upper (ifaces, iface, MTU['vxlan_underlay_iface'])
  578. # If the string 'all' is part of the list, blindly use all sites configured for this node
  579. if 'all' in batman_connect_sites:
  580. batman_connect_sites = my_sites
  581. for site in batman_connect_sites:
  582. # Silenty ignore sites not configured on this node
  583. if site not in my_sites:
  584. continue
  585. # iface_name := vx_<last 5 chars of underlay iface>_<site> stripped to 15 chars
  586. vx_iface = ("vx_%s_%s" % (re.sub ('vlan', 'v', iface)[-5:], re.sub (r'[_-]', '', site)))[:15]
  587. site_no = _get_site_no (sites_config, site)
  588. bat_iface = "bat-%s" % site
  589. # If there's no batman interface for this site, there's no point
  590. # in setting up a VXLAN interfaces
  591. if bat_iface not in ifaces:
  592. continue
  593. # bail out if VXLAN tunnel already configured
  594. if vx_iface in ifaces:
  595. continue
  596. try:
  597. iface_id = int (re.sub ('vlan', '', iface))
  598. # Gather interface specific mcast address.
  599. # The address is derived from the vlan-id of the underlying interface,
  600. # assuming that it in fact is a vlan interface.
  601. # Mangle the vlan-id into two 2 digit values, eliminating any leading zeros.
  602. iface_id_4digit = "%04d" % iface_id
  603. octet2 = int (iface_id_4digit[0:2])
  604. octet3 = int (iface_id_4digit[2:4])
  605. vni = octet2 * 256 * 256 + octet3 * 256 + site_no
  606. vtep_config = {
  607. 'vxlan-id' : vni,
  608. 'vxlan-physdev' : iface,
  609. }
  610. # If there are prefixes configured on this underlay interface go for legacy IPv4 Multicast (for now)
  611. if iface_has_prefixes:
  612. vtep_config['vxlan-svcnodeip'] = "225.%s.%s.%s" % (octet2, octet3, site_no)
  613. else:
  614. vtep_config['vxlan-remote-group'] = "ff42:%s::%s" % (iface_id, site_no)
  615. except ValueError as v:
  616. vtep_config = {
  617. 'vxlan-config-error' : str (v),
  618. }
  619. iface_id = 9999
  620. mcast_ip = "225.0.0.%s" % site_no
  621. vni = site_no
  622. # Add the VXLAN interface
  623. ifaces[vx_iface] = {
  624. 'vxlan' : vtep_config,
  625. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, iface_id),
  626. 'mtu' : MTU['batman_underlay_iface'],
  627. }
  628. iface_penalty = get_batman_iface_penalty (iface)
  629. if iface_penalty:
  630. ifaces[vx_iface]['batman'] = {
  631. 'batman-hop-penalty' : iface_penalty
  632. }
  633. # If the batman interface for this site doesn't have any interfaces
  634. # set up - which basicly cannot happen - add this VXLAN tunnel as
  635. # the first in the list.
  636. if not 'batman-ifaces' in ifaces[bat_iface]:
  637. ifaces[bat_iface]['batman-ifaces'] = [ vx_iface ]
  638. continue
  639. # In the hope there already are interfaces for batman set up already
  640. # add this VXLAN tunnel to the list
  641. batman_ifaces = ifaces[bat_iface]['batman-ifaces']
  642. if vx_iface not in batman_ifaces:
  643. if type (batman_ifaces) == list:
  644. batman_ifaces.append (vx_iface)
  645. else:
  646. batman_ifaces += ' ' + vx_iface
  647. #
  648. # Generate implicitly defined VRFs according to the vrf_info dict at the top
  649. # of this file
  650. def _generate_vrfs (ifaces):
  651. for iface in list (ifaces.keys ()):
  652. iface_config = ifaces.get (iface)
  653. vrf = iface_config.get ('vrf', None)
  654. if vrf and vrf not in ifaces:
  655. conf = vrf_info.get (vrf, {})
  656. table = conf.get ('table', 1234)
  657. fwmark = conf.get ('fwmark', None)
  658. ifaces[vrf] = {
  659. 'vrf-table' : table,
  660. }
  661. # Create ip rule's for any fwmarks defined
  662. if fwmark:
  663. up = []
  664. # Make sure we are dealing with a list even if there is only one mark to be set up
  665. if type (fwmark) in (str, int):
  666. fwmark = [ fwmark ]
  667. # Create ip rule entries for IPv4 and IPv6 for every fwmark
  668. for mark in fwmark:
  669. up.append ("ip rule add fwmark %s table %s" % (mark, table))
  670. up.append ("ip -6 rule add fwmark %s table %s" % (mark, table))
  671. ifaces[vrf]['up'] = up
  672. def _generate_ffrl_gre_tunnels (ifaces):
  673. for iface, iface_config in ifaces.items ():
  674. # We only care for GRE_FFRL type interfaces
  675. if iface_config.get ('type', '') != 'GRE_FFRL':
  676. continue
  677. # Copy default values to interface config
  678. for attr, val in GRE_FFRL_attrs.items ():
  679. if not attr in iface_config:
  680. iface_config[attr] = val
  681. # Guesstimate local IPv4 tunnel endpoint address from tunnel-physdev
  682. if not 'local' in iface_config and 'tunnel-physdev' in iface_config:
  683. try:
  684. physdev_prefixes = [p.split ('/')[0] for p in ifaces[iface_config['tunnel-physdev']]['prefixes'] if '.' in p]
  685. if len (physdev_prefixes) == 1:
  686. iface_config['local'] = physdev_prefixes[0]
  687. except KeyError:
  688. pass
  689. def _generate_loopback_ips (ifaces, node_config, node_id):
  690. # If this node has primary_ips set and filled there are either IPs
  691. # configured on lo or IPs on another interface - possibly ones on
  692. # the only interface present - are considered as primary IPs.
  693. if node_config.get ('primary_ips', False):
  694. return
  695. v4_ip = "%s/32" % get_primary_ip (node_config, 'v4').ip
  696. v6_ip = "%s/128" % get_primary_ip (node_config, 'v6').ip
  697. # Interface lo already present?
  698. if 'lo' not in ifaces:
  699. ifaces['lo'] = { 'prefixes' : [] }
  700. # Add 'prefixes' list if not present
  701. if 'prefixes' not in ifaces['lo']:
  702. ifaces['lo']['prefixes'] = []
  703. prefixes = ifaces['lo']['prefixes']
  704. if v4_ip not in prefixes:
  705. prefixes.append (v4_ip)
  706. if v6_ip not in prefixes:
  707. prefixes.append (v6_ip)
  708. # Generate interface descriptions / aliases for auto generated or manually
  709. # created interfaces. Currently this only is done for bridges associated
  710. # with BATMAN instanzes.
  711. #
  712. # @param node_config: The configuration of the given node (as dict)
  713. # @param sites_config Global sites configuration (as dict)
  714. def _update_interface_desc (node_config, sites_config):
  715. # Currently we only care for nodes with batman role.
  716. if 'batman' not in node_config.get ('roles', []):
  717. return
  718. for iface, iface_config in node_config.get ('ifaces', {}).items ():
  719. if 'desc' in sites_config:
  720. continue
  721. # If the interface name looks like a bridge for a BATMAN instance
  722. # try to get the name of the corresponding site
  723. match = re.search (r'^br-([a-z_-]+)$', iface)
  724. if match and match.group (1) in sites_config:
  725. try:
  726. iface_config['desc'] = sites_config[match.group (1)]['name']
  727. except KeyError:
  728. pass
  729. ################################################################################
  730. # Public functions #
  731. ################################################################################
  732. # Generate network interface configuration for given node.
  733. #
  734. # This function will read the network configuration from pillar and will
  735. # * enhance it with all default values configured at the top this file
  736. # * auto generate any implicitly configured
  737. # * VRFs
  738. # * B.A.T.M.A.N. instances and interfaces
  739. # * VXLAN interfaces to connect B.A.T.M.A.N. sites
  740. # * Loopback IPs derived from numeric node ID
  741. #
  742. # @param: node_config Pillar node configuration (as dict)
  743. # @param: sites_config Pillar sites configuration (as dict)
  744. # @param: node_id Minion name / Pillar node configuration key
  745. def get_interface_config (node_config, sites_config, node_id = ""):
  746. # Make a copy of the node_config dictionary to suppress side-effects.
  747. # This function deletes some keys from the node_config which will break
  748. # any re-run of this function or other functions relying on the node_config
  749. # to be complete.
  750. node_config = deepcopy (node_config)
  751. # Get config of this node and dict of all configured ifaces
  752. ifaces = node_config.get ('ifaces', {})
  753. # Generate configuration entries for any batman related interfaces not
  754. # configured explicitly, but asked for implicitly by role <batman> and
  755. # a (list of) site(s) specified in the node config.
  756. _generate_batman_interface_config (node_config, ifaces, sites_config)
  757. # Generate VXLAN tunnels for every interfaces specifying 'batman_connect_sites'
  758. _generate_vxlan_interface_config (node_config, ifaces, sites_config)
  759. # Enhance ifaces configuration with some meaningful defaults for
  760. # bonding, bridge and vlan interfaces, MAC address for batman ifaces, etc.
  761. for interface in list (ifaces.keys ()):
  762. config = ifaces.get (interface)
  763. iface_type = config.get ('type', 'inet')
  764. # Remove any disable interfaces here as they aren't relevant for /e/n/i
  765. if config.get ('enabled', True) == False:
  766. del ifaces[interface]
  767. continue
  768. if 'batman-ifaces' in config or iface_type.startswith ('batman'):
  769. _update_batman_config (node_config, interface, sites_config)
  770. if 'bond-slaves' in config:
  771. _update_bond_config (config)
  772. # FIXME: This maybe will not match on bridges without any member ports configured!
  773. if 'bridge-ports' in config or interface.startswith ('br-'):
  774. _update_bridge_config (config)
  775. if 'bridge-member' in config:
  776. _update_bridge_member_config (config)
  777. if 'vlan-raw-device' in config or 'vlan-id' in config:
  778. _update_vlan_config (config)
  779. _set_mtu_to_iface_and_upper (ifaces, interface, 0)
  780. # Pimp configuration for VEth link pairs
  781. if interface.startswith ('veth_'):
  782. _update_veth_config (interface, config)
  783. # Auto generate Loopback IPs IFF not present
  784. _generate_loopback_ips (ifaces, node_config, node_id)
  785. # Auto generated VRF devices for any VRF found in ifaces and not already configured.
  786. _generate_vrfs (ifaces)
  787. # Pimp GRE_FFRL type inteface configuration with default values
  788. _generate_ffrl_gre_tunnels (ifaces)
  789. # Drop any config parameters used in node interface configuration not
  790. # relevant anymore for config file generation.
  791. for interface, config in ifaces.items ():
  792. # Set default MTU if not already set manually or by any earlier function
  793. if interface != 'lo' and ('mtu' not in config):
  794. # Set the MTU value of this interface to the autogenerated value (if any)
  795. # or set the default, when no automtu is present.
  796. config['mtu'] = config.get ('automtu', MTU['default'])
  797. for key in [ 'automtu', 'enabled', 'batman_connect_sites', 'bridge-member', 'has_gateway', 'ospf', 'site', 'type', 'tagged_vlans', 'vlan-mode' ]:
  798. if key in config:
  799. config.pop (key)
  800. # Remove route metric on non-router nodes
  801. if 'metric' in config and not 'router' in node_config.get ('roles', []):
  802. config.pop ('metric')
  803. # This leaves 'auto', 'prefixes' and 'desc' as keys which should not be directly
  804. # printed into the remaining configuration. These are handled within the jinja
  805. # interface template.
  806. # Generate meaningful interface descriptions / aliases where useful
  807. _update_interface_desc (node_config, sites_config)
  808. return ifaces
  809. vlan_vxlan_iface_re = re.compile (r'^vlan(\d+)|^vx_v(\d+)_(\w+)')
  810. def _cmp (x, y):
  811. if x < y:
  812. return -1
  813. elif x == y:
  814. return 0
  815. else:
  816. return 1
  817. def _iface_sort (iface_a, iface_b):
  818. a = vlan_vxlan_iface_re.search (iface_a)
  819. b = vlan_vxlan_iface_re.search (iface_b)
  820. # At least one interface didn't match, do regular comparison
  821. if not a or not b:
  822. return _cmp (iface_a, iface_b)
  823. # Extract VLAN ID from VLAN interface (if given) or VXLAN
  824. vid_a = a.group (1) if a.group (1) else a.group (2)
  825. vid_b = b.group (1) if b.group (1) else b.group (2)
  826. # If it's different type of interfaces (one VLAN, one VXLAN), do regular comparison
  827. if (a.group (1) == None) != (b.group (1) == None):
  828. return _cmp (iface_a, iface_b)
  829. # Ok, t's two VLAN or two VXLAN interfaces
  830. # If it's VXLAN interfaces and the VLAN ID is the same, sort by site name
  831. if a.group (2) and vid_a == vid_b:
  832. return _cmp (a.groups (2), b.groups (2))
  833. # If it's two VLANs or two VXLANs with different VLAN IDs, sort by VLAN ID
  834. else:
  835. return _cmp (int (vid_a), int (vid_b))
  836. def get_interface_list (ifaces):
  837. iface_list = []
  838. for iface in sorted (ifaces.keys (), key = cmp_to_key (_iface_sort)):
  839. iface_list.append (iface)
  840. return iface_list
  841. # Generate entries for /etc/bat-hosts for every batman interface we will configure on any node.
  842. # For readability purposes superflous/redundant information is being stripped/supressed.
  843. # As these names will only show up in batctl calls with a specific site, site_names in interfaces
  844. # are stripped. Dummy interfaces are stripped as well.
  845. def gen_bat_hosts (nodes_config, sites_config):
  846. bat_hosts = {}
  847. for node_id in sorted (nodes_config.keys ()):
  848. node_config = nodes_config.get (node_id)
  849. node_name = node_id.split ('.')[0]
  850. if 'batman' not in node_config['roles']:
  851. continue
  852. ifaces = get_interface_config (node_config, sites_config, node_id)
  853. for iface in sorted (ifaces):
  854. iface_config = ifaces.get (iface)
  855. hwaddress = iface_config.get ('hwaddress', None)
  856. if hwaddress == None:
  857. continue
  858. entry_name = node_name
  859. match = re.search (r'^dummy-(.+)(-e)?$', iface)
  860. if match:
  861. if match.group (2):
  862. entry_name += "-e"
  863. # Append site to make name unique
  864. entry_name += "/%s" % match.group (1)
  865. else:
  866. entry_name += "/%s" % re.sub (r'^(vx_.*|i2e|e2i)[_-](.*)$', '\g<1>/\g<2>', iface)
  867. bat_hosts[hwaddress] = entry_name
  868. if 'fastd' in node_config.get ('roles', []):
  869. device_no = node_config.get ('id')
  870. for site in node_config.get ('sites', []):
  871. site_no = _get_site_no (sites_config, site)
  872. for network in ('intergw', 'nodes4', 'nodes6'):
  873. hwaddress = gen_batman_iface_mac (site_no, device_no, network)
  874. bat_hosts[hwaddress] = "%s/%s/%s" % (node_name, network, site)
  875. return bat_hosts
  876. # Return the appropriate hop penalty to configure for the given interface.
  877. def get_batman_iface_penalty (iface):
  878. if iface.startswith ('vlan'):
  879. vid = int (re.sub ('vlan', '', iface))
  880. if 2000 <= vid < 2100:
  881. return default_batman_iface_penalty_by_role.get ('WBBL')
  882. if 2200 <= vid < 2300:
  883. return default_batman_iface_penalty_by_role.get ('WBBL_backup')
  884. if 'intergw' in iface:
  885. return default_batman_iface_penalty_by_role.get ('VPN_intergw')
  886. if 'nodes' in iface:
  887. return default_batman_iface_penalty_by_role.get ('VPN_node')
  888. return default_batman_iface_penalty_by_role.get ('default', 0)
  889. # Generate eBGP session parameters for FFRL Transit from nodes pillar information.
  890. def get_ffrl_bgp_config (ifaces, proto):
  891. _generate_ffrl_gre_tunnels (ifaces)
  892. sessions = {}
  893. for iface in sorted (ifaces):
  894. # We only care for GRE tunnels to the FFRL Backbone
  895. if not iface.startswith ('gre_ffrl_'):
  896. continue
  897. iface_config = ifaces.get (iface)
  898. # Search for IPv4/IPv6 prefix as defined by proto parameter
  899. local = None
  900. neighbor = None
  901. for prefix in iface_config.get ('prefixes', []):
  902. if (proto == 'v4' and '.' in prefix) or (proto == 'v6' and ':' in prefix):
  903. local = prefix.split ('/')[0]
  904. # Calculate neighbor IP as <local IP> - 1
  905. neighbor = str (ipaddress.ip_address (u'%s' % local) - 1)
  906. break
  907. # Strip gre_ prefix iface name and use it as identifier for the eBGP session.
  908. name = re.sub ('gre_ffrl_', 'ffrl_', iface)
  909. sessions[name] = {
  910. 'local' : local,
  911. 'neighbor' : neighbor,
  912. 'bgp_local_pref' : iface_config.get ('bgp_local_pref', None),
  913. }
  914. return sessions
  915. # Get list of IP address configured on given interface on given node.
  916. #
  917. # @param: node_config Pillar node configuration (as dict)
  918. # @param: iface_name Name of the interface defined in pillar node config
  919. # OR name of VRF ("vrf_<something>") whichs ifaces are
  920. # to be examined.
  921. # @param: with_mask Don't strip the netmask from the prefix. (Default false)
  922. def get_node_iface_ips (node_config, iface_name, with_mask = False):
  923. ips = {
  924. 'v4' : [],
  925. 'v6' : [],
  926. }
  927. ifaces = node_config.get ('ifaces', {})
  928. ifaces_names = [ iface_name ]
  929. if iface_name.startswith ('vrf_'):
  930. # Reset list of ifaces_names to consider
  931. ifaces_names = []
  932. vrf = iface_name
  933. for iface, iface_config in ifaces.items ():
  934. # Ignore any iface NOT in the given VRF
  935. if iface_config.get ('vrf', None) != vrf:
  936. continue
  937. # Ignore any VEth pairs
  938. if iface.startswith ('veth'):
  939. continue
  940. ifaces_names.append (iface)
  941. try:
  942. for iface in ifaces_names:
  943. for prefix in ifaces[iface]['prefixes']:
  944. ip_ver = 'v6' if ':' in prefix else 'v4'
  945. if not with_mask:
  946. prefix = prefix.split ('/')[0]
  947. ips[ip_ver].append (prefix)
  948. except KeyError:
  949. pass
  950. return ips
  951. #
  952. # Get the primary IP(s) of the given node
  953. #
  954. # @param node_config: Pillar node configuration (as dict)
  955. # @param af: Address family
  956. def get_primary_ip (node_config, af):
  957. # Compatility glue
  958. if 'primary_ips' not in node_config:
  959. return Prefix ("%s%s" % (loopback_prefix[af], node_config['id']))
  960. return Prefix (node_config['primary_ips'][af])
  961. #
  962. # Get the router id (read: IPv4 Lo-IP) out of the given node config.
  963. def get_router_id (node_config, node_id):
  964. return get_primary_ip (node_config, 'v4').ip
  965. # Compute minions OSPF interface configuration according to FFHO routing policy
  966. # See https://wiki.ffho.net/infrastruktur:vlans for information about Vlans
  967. #
  968. # Costs are based on the following reference values:
  969. #
  970. # Iface speed | Cost
  971. # ------------+---------
  972. # 100 Gbit/s | 1
  973. # 40 Gbit/s | 2
  974. # 25 Gbit/s | 4
  975. # 20 Gbit/s | 5
  976. # 10 Gbit/s | 10
  977. # 1 Gbit/s | 100
  978. # 100 Mbit/s | 1000
  979. # VPN | 10000
  980. #
  981. def get_ospf_interface_config (node_config, grains_id):
  982. ospf_node_config = node_config.get ('ospf', {})
  983. ospf_interfaces = {}
  984. for iface, iface_config in node_config.get ('ifaces', {}).items ():
  985. # By default we don't speak OSPF on interfaces
  986. ospf_on = False
  987. # Defaults for OSPF interfaces
  988. ospf_config = {
  989. 'stub' : True, # Active/Passive interface
  990. 'cost' : 12345,
  991. # 'type' # Area type
  992. }
  993. # OSPF configuration for interface present?
  994. ospf_config_pillar = iface_config.get ('ospf', {})
  995. # Should be completely ignore this interface?
  996. if ospf_config_pillar.get ('ignore', False):
  997. continue
  998. # Ignore interfaces without any IPs configured
  999. if not iface_config.get ('prefixes'):
  1000. continue
  1001. # Wireless Local Links (WLL)
  1002. if re.search (r'^vlan90\d$', iface):
  1003. ospf_on = True
  1004. ospf_config['stub'] = True
  1005. ospf_config['cost'] = 10
  1006. ospf_config['desc'] = "Wireless Local Link (WLL)"
  1007. # Local Gigabit Ethernet based connections (PTP or L2 subnets), cost 10
  1008. elif re.search (r'^(br-?|br\d+\.|vlan)10\d\d$', iface):
  1009. ospf_on = True
  1010. ospf_config['stub'] = False
  1011. ospf_config['cost'] = 100
  1012. ospf_config['desc'] = "Wired Gigabit connection"
  1013. # 10/20 Gbit/s Dark Fiber connection
  1014. elif re.search (r'^vlan12\d\d$', iface):
  1015. ospf_on = True
  1016. ospf_config['stub'] = False
  1017. ospf_config['cost'] = 10
  1018. ospf_config['desc'] = "Wired 10Gb/s connection"
  1019. # VLL connection
  1020. elif re.search (r'^vlan15\d\d$', iface):
  1021. ospf_on = True
  1022. ospf_config['stub'] = False
  1023. ospf_config['cost'] = 200
  1024. ospf_config['desc'] = "VLL connection"
  1025. # WBBL connection
  1026. elif re.search (r'^vlan20\d\d$', iface):
  1027. ospf_on = True
  1028. ospf_config['stub'] = False
  1029. ospf_config['cost'] = 1000
  1030. ospf_config['desc'] = "WBBL connection"
  1031. # Legacy WBBL connection
  1032. elif re.search (r'^vlan22\d\d$', iface):
  1033. ospf_on = True
  1034. ospf_config['stub'] = False
  1035. ospf_config['cost'] = 1000
  1036. ospf_config['desc'] = "WBBL connection"
  1037. # Management Vlans
  1038. elif re.search (r'^vlan30\d\d$', iface):
  1039. ospf_on = True
  1040. ospf_config['stub'] = True
  1041. ospf_config['cost'] = 10
  1042. # OPS Vlans
  1043. elif re.search (r'^vlan39\d\d$', iface):
  1044. ospf_on = True
  1045. ospf_config['stub'] = True
  1046. ospf_config['cost'] = 10
  1047. # Active OSPF on OpenVPN tunnels, cost 10000
  1048. elif iface.startswith ('ovpn-'):
  1049. ospf_on = True
  1050. ospf_config['stub'] = False
  1051. ospf_config['cost'] = 10000
  1052. # Inter-Core links should have cost 5000
  1053. if iface.startswith ('ovpn-cr') and grains_id.startswith ('cr'):
  1054. ospf_config['cost'] = 5000
  1055. # OpenVPN tunnels to EdgeRouters
  1056. elif iface.startswith ('ovpn-er-'):
  1057. ospf_config['type'] = 'broadcast'
  1058. # Active OSPF on Wireguard tunnels, cost 10000
  1059. elif iface.startswith ('wg-'):
  1060. ospf_on = True
  1061. ospf_config['stub'] = False
  1062. ospf_config['cost'] = 10000
  1063. # Inter-Core links should have cost 5000
  1064. if iface.startswith ('wg-cr') and grains_id.startswith ('cr'):
  1065. ospf_config['cost'] = 5000
  1066. # OSPF explicitly enabled for interface
  1067. elif 'ospf' in iface_config:
  1068. ospf_on = True
  1069. # iface ospf parameters will be applied later
  1070. # Go on if OSPF should not be actived
  1071. if not ospf_on:
  1072. continue
  1073. # Explicit OSPF interface configuration parameters take precendence over generated ones
  1074. for attr, val in ospf_config_pillar.items ():
  1075. ospf_config[attr] = val
  1076. # Store interface configuration
  1077. ospf_interfaces[iface] = ospf_config
  1078. return ospf_interfaces
  1079. # Return (possibly empty) subset of Traffic Engineering entries from 'te' pillar entry
  1080. # relevenant for this minion and protocol (IPv4 / IPv6)
  1081. def get_te_prefixes (te_node_config, grains_id, proto):
  1082. te_config = {}
  1083. for prefix, prefix_config in te_node_config.get ('prefixes', {}).items ():
  1084. prefix_proto = 'v6' if ':' in prefix else 'v4'
  1085. # Should this TE policy be applied on this node and is the prefix
  1086. # of the proto we are looking for?
  1087. if grains_id in prefix_config.get ('nodes', []) and prefix_proto == proto:
  1088. te_config[prefix] = prefix_config
  1089. return te_config
  1090. def generate_DNS_entries (nodes_config, sites_config):
  1091. forward_zone_name = ""
  1092. forward_zone = []
  1093. zones = {
  1094. # <forward_zone_name>: [],
  1095. # <rev_zone1_name>: [],
  1096. # <rev_zone2_name>: [],
  1097. # ...
  1098. }
  1099. # Fill zones dict with zones configured in DNS_zone_names at the top of this file.
  1100. # Make sure the zone base names provided start with a leading . so the string
  1101. # operations later can be done easily and safely. Proceed with fingers crossed.
  1102. for entry, value in DNS_zone_names.items ():
  1103. if entry == "forward":
  1104. zone = value
  1105. if not zone.startswith ('.'):
  1106. zone = ".%s" % zone
  1107. zones[zone] = forward_zone
  1108. forward_zone_name = zone
  1109. if entry in [ 'rev_v4', 'rev_v6' ]:
  1110. for zone in value:
  1111. if not zone.startswith ('.'):
  1112. zone = ".%s" % zone
  1113. zones[zone] = []
  1114. # Process all interfaace of all nodes defined in pillar and generate forward
  1115. # and reverse entries for all zones defined in DNS_zone_names. Automagically
  1116. # put reverse entries into correct zone.
  1117. for node_id in sorted (nodes_config):
  1118. node_config = nodes_config.get (node_id)
  1119. ifaces = get_interface_config (node_config, sites_config, node_id)
  1120. for iface in sorted (ifaces):
  1121. iface_config = ifaces.get (iface)
  1122. # We only care for interfaces with IPs configured
  1123. prefixes = iface_config.get ("prefixes", None)
  1124. if prefixes == None:
  1125. continue
  1126. # Ignore any interface in $VRF
  1127. if iface_config.get ('vrf', "") in [ 'vrf_external' ]:
  1128. continue
  1129. for prefix in sorted (prefixes):
  1130. ip = ipaddress.ip_address (u'%s' % prefix.split ('/')[0])
  1131. proto = 'v%s' % ip.version
  1132. # The entry name is
  1133. # <node_id> when interface 'lo'
  1134. # <node_name>.srv.<residual> when interface 'srv' (or magically detected internal srv record)
  1135. # <interface>.<node_id> else
  1136. entry_name = node_id
  1137. if iface != "lo":
  1138. entry_name = "%s.%s" % (iface, node_id)
  1139. elif iface == 'srv' or re.search (r'^(10.132.251|2a03:2260:2342:f251:)', prefix):
  1140. entry_name = re.sub (r'^([^.]+)\.(.+)$', r'\g<1>.srv.\g<2>', entry_name)
  1141. # Strip forward zone name from entry_name and store forward entry
  1142. # with correct entry type for found IP address.
  1143. forward_entry_name = re.sub (forward_zone_name, "", entry_name)
  1144. forward_entry_name = re.sub (forward_zone_name, "", entry_name)
  1145. forward_entry_typ = "A" if ip.version == 4 else "AAAA"
  1146. forward_zone.append ("%s IN %s %s" % (forward_entry_name, forward_entry_typ, ip))
  1147. # Find correct reverse zone, if configured and strip reverse zone name
  1148. # from calculated reverse pointer name. Store reverse entry if we found
  1149. # a zone for it. If no configured reverse zone did match, this reverse
  1150. # entry will be ignored.
  1151. for zone in zones:
  1152. if ip.reverse_pointer.find (zone) > 0:
  1153. PTR_entry = re.sub (zone, "", ip.reverse_pointer)
  1154. zones[zone].append ("%s IN PTR %s." % (PTR_entry, entry_name))
  1155. break
  1156. return zones
  1157. # Convert the CIDR network from the given prefix into a dotted netmask
  1158. def cidr_to_dotted_mask (prefix):
  1159. return str (ipaddress.ip_network (prefix, strict = False).netmask)
  1160. def is_subprefix (prefix, subprefix):
  1161. p = ipaddress.ip_network (prefix, strict = False)
  1162. s = ipaddress.ip_network (subprefix, strict = False)
  1163. return s.subnet_of (p)
  1164. # Return the network address of the given prefix
  1165. def get_network_address (prefix, with_prefixlen = False):
  1166. net_h = ipaddress.ip_network (u'%s' % prefix, strict = False)
  1167. network = str (net_h.network_address)
  1168. if with_prefixlen:
  1169. network += "/%s" % net_h.prefixlen
  1170. return network