ffho_net.py 37 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153
  1. #!/usr/bin/python
  2. import collections
  3. import re
  4. mac_prefix = "f2"
  5. # VRF configuration map
  6. vrf_info = {
  7. 'vrf_external' : {
  8. 'table' : 1023,
  9. 'fwmark' : [ '0x1', '0x1023' ],
  10. },
  11. }
  12. #
  13. # Default parameters added to any given bonding interface,
  14. # if not specified at the interface configuration.
  15. default_bond_config = {
  16. 'bond-mode': '802.3ad',
  17. 'bond-min-links': '1',
  18. 'bond-xmit-hash-policy': 'layer3+4'
  19. }
  20. #
  21. # Default parameters added to any given bonding interface,
  22. # if not specified at the interface configuration.
  23. default_bridge_config = {
  24. 'bridge-fd' : '0',
  25. 'bridge-stp' : 'no'
  26. }
  27. #
  28. # Hop penalty to set if none is explicitly specified
  29. # Check if one of these roles is configured for any given node, use first match.
  30. default_hop_penalty_by_role = {
  31. 'bbr' : 5,
  32. 'bras' : 50,
  33. 'batman_gw' : 50,
  34. }
  35. batman_role_evaluation_order = [ 'bbr', 'batman_gw', 'bras' ]
  36. #
  37. # Default interface attributes to be added to GRE interface to AS201701 when
  38. # not already present in pillar interface configuration.
  39. GRE_FFRL_attrs = {
  40. 'mode' : 'gre',
  41. 'method' : 'tunnel',
  42. 'mtu' : '1400',
  43. 'ttl' : '64',
  44. }
  45. # The IPv4/IPv6 prefix use for Loopback IPs
  46. loopback_prefix = {
  47. 'v4' : '10.132.255.',
  48. 'v6' : '2a03:2260:2342:ffff::',
  49. }
  50. # The DNS zone base names used for generating zone files from IP address
  51. # configured on nodes interfaces.
  52. DNS_zone_names = {
  53. 'forward' : 'ffho.net',
  54. 'rev_v4' : [
  55. '132.10.in-addr.arpa',
  56. '30.172.in-addr.arpa',
  57. ],
  58. 'rev_v6' : [
  59. '2.4.3.2.0.6.2.2.3.0.a.2.ip6.arpa',
  60. ]
  61. }
  62. # MTU configuration
  63. MTU = {
  64. # The default MTU for any interface which does not have a MTU configured
  65. # explicitly in the pillar node config or does not get a MTU configured
  66. # by any means of this SDN stuff here.
  67. 'default' : 1500,
  68. # A batman underlay device, probably a VXLAN or VLAN interface.
  69. #
  70. # 1500
  71. # + 60 B.A.T.M.A.N. adv header + network coding (activated by default by Debian)
  72. 'batman_underlay_iface' : 1560,
  73. # VXLAN underlay device, probably a VLAN with $POP or between two BBRs.
  74. #
  75. # 1560
  76. # + 14 Inner Ethernet Frame
  77. # + 8 VXLAN Header
  78. # + 8 UDP Header
  79. # + 20 IPv4 Header
  80. 'vxlan_underlay_iface' : 1610,
  81. }
  82. ################################################################################
  83. # Internal functions #
  84. # #
  85. # Touching anything below will void any warranty you never had ;) #
  86. # #
  87. ################################################################################
  88. sites = None
  89. def _get_site_no (sites_config, site_name):
  90. global sites
  91. if sites == None:
  92. sites = {}
  93. for site in sites_config:
  94. if site.startswith ("_"):
  95. continue
  96. sites[site] = sites_config[site].get ("site_no", -2)
  97. return sites.get (site_name, -1)
  98. #
  99. # Generate a MAC address after the format f2:dd:dd:ss:nn:nn where
  100. # dd:dd is the hexadecimal reprensentation of the nodes device_id
  101. # ff:ff representing the gluon nodes
  102. #
  103. # ss is the hexadecimal reprensentation of the site_id the interface is connected to
  104. #
  105. # nn:nn is the decimal representation of the network the interface is connected to, with
  106. # 00:00 being the dummy interface
  107. # 00:0f being the VEth internal side interface
  108. # 00:e0 being an external instance dummy interface
  109. # 00:e1 being an inter-gw-vpn interface
  110. # 00:e4 being an nodes fastd tunnel interface of IPv4 transport
  111. # 00:e6 being an nodes fastd tunnel interface of IPv6 transport
  112. # 00:ef being an extenral instance VEth interface side
  113. # 02:xx being a connection to local Vlan 2xx
  114. # 1b:24 being the ibss 2.4GHz bssid
  115. # 1b:05 being the ibss 5GHz bssid
  116. # xx:xx being a VXLAN tunnel for site ss, with xx being a the underlay VLAN ID (1xyz, 2xyz)
  117. # ff:ff being the gluon next-node interface
  118. def gen_batman_iface_mac (site_no, device_no, network):
  119. net_type_map = {
  120. 'dummy' : "00:00",
  121. 'int2ext' : "00:0f",
  122. 'dummy-e' : "00:e0",
  123. 'intergw' : "00:e1",
  124. 'nodes4' : "00:e4",
  125. 'nodes6' : "00:e6",
  126. 'ext2int' : "00:ef",
  127. }
  128. # Well-known network type?
  129. if network in net_type_map:
  130. last = net_type_map[network]
  131. elif type (network) == int:
  132. last = re.sub (r'(\d{2})(\d{2})', '\g<1>:\g<2>', "%04d" % network)
  133. else:
  134. last = "ee:ee"
  135. # Convert device_no to hex, format number to 4 digits with leading zeros and : betwwen 2nd and 3rd digit
  136. device_no_hex = re.sub (r'([0-9a-fA-F]{2})([0-9a-fA-F]{2})', '\g<1>:\g<2>', "%04x" % int (device_no))
  137. # Format site_no to two digit number with leading zero
  138. site_no_hex = "%02d" % int (site_no)
  139. return "%s:%s:%s:%s" % (mac_prefix, device_no_hex, site_no_hex, last)
  140. # Gather B.A.T.M.A.N. related config options for real batman devices (e.g. bat0)
  141. # as well as for batman member interfaces (e.g. eth0.100, fastd ifaces etc.)
  142. def _update_batman_config (node_config, iface, sites_config):
  143. try:
  144. node_batman_hop_penalty = int (node_config['batman']['hop-penalty'])
  145. except KeyError,ValueError:
  146. node_batman_hop_penalty = None
  147. iface_config = node_config['ifaces'][iface]
  148. iface_type = iface_config.get ('type', 'inet')
  149. batman_config = {}
  150. for item, value in iface_config.items ():
  151. if item.startswith ('batman-'):
  152. batman_config[item] = value
  153. iface_config.pop (item)
  154. # B.A.T.M.A.N. device (e.g. bat0)
  155. if iface_type == 'batman':
  156. if 'batman-hop-penalty' not in batman_config:
  157. # If there's a hop penalty set for the node, but not for the interface
  158. # apply the nodes hop penalty
  159. if node_batman_hop_penalty:
  160. batman_config['batman-hop-penalty'] = node_batman_hop_penalty
  161. # If there's no hop penalty set for the node, use a default hop penalty
  162. # for the roles the node might have, if any
  163. else:
  164. node_roles = node_config.get ('roles', [])
  165. for role in batman_role_evaluation_order:
  166. if role in node_roles:
  167. batman_config['batman-hop-penalty'] = default_hop_penalty_by_role[role]
  168. # If batman ifaces were specified as a list - which they should -
  169. # generate a sorted list of interface names as string representation
  170. if 'batman-ifaces' in batman_config and type (batman_config['batman-ifaces']) == list:
  171. batman_iface_str = " ".join (sorted (batman_config['batman-ifaces']))
  172. batman_config['batman-ifaces'] = batman_iface_str
  173. # B.A.T.M.A.N. member interface (e.g. eth.100, fastd ifaces, etc.)
  174. elif iface_type == 'batman_iface':
  175. # Generate unique MAC address for every batman iface, as B.A.T.M.A.N.
  176. # will get puzzled with multiple interfaces having the same MAC and
  177. # do nasty things.
  178. site = iface_config.get ('site')
  179. site_no = _get_site_no (sites_config, site)
  180. device_no = node_config.get ('id')
  181. network = 1234
  182. # Generate a unique BATMAN-MAC for this interfaces
  183. match = re.search (r'^vlan(\d+)', iface)
  184. if match:
  185. network = int (match.group (1))
  186. iface_config['hwaddress'] = gen_batman_iface_mac (site_no, device_no, network)
  187. iface_config['batman'] = batman_config
  188. # Mangle bond specific config items with default values and store them in
  189. # separate sub-dict for easier access and configuration.
  190. def _update_bond_config (config):
  191. bond_config = default_bond_config.copy ()
  192. for item, value in config.items ():
  193. if item.startswith ('bond-'):
  194. bond_config[item] = value
  195. config.pop (item)
  196. if bond_config['bond-mode'] not in ['2', 'balance-xor', '4', '802.3ad']:
  197. bond_config.pop ('bond-xmit-hash-policy')
  198. config['bond'] = bond_config
  199. # Mangle bridge specific config items with default values and store them in
  200. # separate sub-dict for easier access and configuration.
  201. def _update_bridge_config (config):
  202. bridge_config = default_bridge_config.copy ()
  203. for item, value in config.items ():
  204. if item.startswith ('bridge-'):
  205. bridge_config[item] = value
  206. config.pop (item)
  207. # Fix and salt mangled string interpretation back to real string.
  208. if type (value) == bool:
  209. bridge_config[item] = "yes" if value else "no"
  210. # If bridge ports were specified as a list - which they should -
  211. # generate a sorted list of interface names as string representation
  212. if 'bridge-ports' in bridge_config and type (bridge_config['bridge-ports']) == list:
  213. bridge_ports_str = " ".join (sorted (bridge_config['bridge-ports']))
  214. bridge_config['bridge-ports'] = bridge_ports_str
  215. config['bridge'] = bridge_config
  216. # Move vlan specific config items into a sub-dict for easier access and pretty-printing
  217. # in the configuration file
  218. def _update_vlan_config (config):
  219. vlan_config = {}
  220. for item, value in config.items ():
  221. if item.startswith ('vlan-'):
  222. vlan_config[item] = value
  223. config.pop (item)
  224. config['vlan'] = vlan_config
  225. # Pimp Veth interfaces
  226. # * Add peer interface name IF not present
  227. # * Add link-type veth IF not present
  228. def _update_veth_config (interface, config):
  229. veth_peer_name = {
  230. 'veth_ext2int' : 'veth_int2ext',
  231. 'veth_int2ext' : 'veth_ext2int'
  232. }
  233. if interface not in veth_peer_name:
  234. return
  235. if 'link-type' not in config:
  236. config['link-type'] = 'veth'
  237. if 'veth-peer-name' not in config:
  238. config['veth-peer-name'] = veth_peer_name[interface]
  239. # The the given MTU to the given interface - presented by it's interface config dict -
  240. # IFF no MTU has already been set in the node pillar.
  241. #
  242. # @param ifaces: All interface configuration (as dict)
  243. # @param iface_name: Name of the interface to set MTU for
  244. # @param mtu: The MTU value to set (integer)
  245. def _set_mtu_to_iface_and_upper (ifaces, iface_name, mtu):
  246. iface_config = ifaces.get (iface_name)
  247. # If this interface already has a MTU set - probably because someone manually
  248. # specified one in the node pillar - we do not do anything here.
  249. if 'mtu' in iface_config:
  250. return
  251. # Set given MTU to this device.
  252. iface_config['mtu'] = mtu
  253. # If this is a VLAN - which it probably is - fix the MTU of the underlying interface, too.
  254. if 'vlan-raw-device' in iface_config:
  255. vlan_raw_device = iface_config['vlan-raw-device']
  256. vlan_raw_device_config = ifaces.get (vlan_raw_device, None)
  257. # vlan-raw-device might point to ethX which usually isn't configured explicitly
  258. # as ifupdown2 simply will bring it up anyway by itself. To set the MTU of such
  259. # an interface we have to add a configuration stanza for it here.
  260. if vlan_raw_device_config == None:
  261. vlan_raw_device_config = {}
  262. ifaces[vlan_raw_device] = vlan_raw_device_config
  263. if not 'mtu' in vlan_raw_device_config:
  264. vlan_raw_device_config['mtu'] = mtu
  265. # Generate configuration entries for any batman related interfaces not
  266. # configured explicitly, but asked for implicitly by role batman and a
  267. # (list of) site(s) specified in the node config.
  268. def _generate_batman_interface_config (node_config, ifaces, sites_config):
  269. # No role 'batman', nothing to do
  270. roles = node_config.get ('roles', [])
  271. if 'batman' not in roles:
  272. return
  273. # Should there be a 2nd external BATMAN instance?
  274. batman_ext = 'batman_ext' in roles or 'bras' in roles
  275. device_no = node_config.get ('id', -1)
  276. for site in node_config.get ('sites', []):
  277. site_no = _get_site_no (sites_config, site)
  278. # Predefine interface names for regular/external BATMAN instance
  279. # and possible VEth link pair for connecting both instances.
  280. bat_site_if = "bat-%s" % site
  281. dummy_site_if = "dummy-%s" % site
  282. bat_site_if_ext = "bat-%s-ext" % site
  283. dummy_site_if_ext = "dummy-%s-e" % site
  284. int2ext_site_if = "i2e-%s" % site
  285. ext2int_site_if = "e2i-%s" % site
  286. site_ifaces = {
  287. # Regular BATMAN interface, always present
  288. bat_site_if : {
  289. 'type' : 'batman',
  290. # int2ext_site_if will be added automagically if requred
  291. 'batman-ifaces' : [ dummy_site_if ],
  292. 'batman-ifaces-ignore-regex': '.*_.*',
  293. },
  294. # Dummy interface always present in regular BATMAN instance
  295. dummy_site_if : {
  296. 'link-type' : 'dummy',
  297. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, 'dummy'),
  298. 'mtu' : MTU['batman_underlay_iface'],
  299. },
  300. # Optional 2nd "external" BATMAN instance
  301. bat_site_if_ext : {
  302. 'type' : 'batman',
  303. 'batman-ifaces' : [ dummy_site_if_ext, ext2int_site_if ],
  304. 'batman-ifaces-ignore-regex': '.*_.*',
  305. 'ext_only' : True,
  306. },
  307. # Optional dummy interface always present in 2nd "external" BATMAN instance
  308. dummy_site_if_ext : {
  309. 'link-type' : 'dummy',
  310. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, 'dummy-e'),
  311. 'ext_only' : True,
  312. 'mtu' : MTU['batman_underlay_iface'],
  313. },
  314. # Optional VEth interface pair - internal side
  315. int2ext_site_if : {
  316. 'link-type' : 'veth',
  317. 'veth-peer-name' : ext2int_site_if,
  318. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, 'int2ext'),
  319. 'mtu' : MTU['batman_underlay_iface'],
  320. 'ext_only' : True,
  321. },
  322. # Optional VEth interface pair - "external" side
  323. ext2int_site_if : {
  324. 'link-type' : 'veth',
  325. 'veth-peer-name' : int2ext_site_if,
  326. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, 'ext2int'),
  327. 'mtu' : MTU['batman_underlay_iface'],
  328. 'ext_only' : True,
  329. },
  330. }
  331. for iface, iface_config_tmpl in site_ifaces.items ():
  332. # Ignore any interface only relevant when role batman_ext is set
  333. # but it isn't
  334. if not batman_ext and iface_config_tmpl.get ('ext_only', False):
  335. continue
  336. # Remove ext_only key so we don't leak it into ifaces dict
  337. if 'ext_only' in iface_config_tmpl:
  338. del iface_config_tmpl['ext_only']
  339. # If there is no trace of the desired iface config yet...
  340. if iface not in ifaces:
  341. # ... just place our template there.
  342. ifaces[iface] = iface_config_tmpl
  343. # If there should be an 2nd external BATMAN instance make sure
  344. # the internal side of the VEth iface pair is connected to the
  345. # internal BATMAN instance.
  346. if batman_ext and iface == bat_site_if:
  347. iface_config_tmpl['batman-ifaces'].append (int2ext_site_if)
  348. # If there already is an interface configuration try to enhance it with
  349. # meaningful values from our template and force correct hwaddress to be
  350. # used.
  351. else:
  352. iface_config = ifaces[iface]
  353. # Force hwaddress to be what we expect.
  354. if 'hwaddress' in iface_config_tmpl:
  355. iface_config['hwaddress'] = iface_config_tmpl['hwaddress']
  356. # Copy every attribute of the config template missing in iface config
  357. for attr in iface_config_tmpl:
  358. if attr not in iface_config:
  359. iface_config[attr] = iface_config_tmpl[attr]
  360. # Make sure there is a bridge present for every site where a mesh_breakout
  361. # interface should be configured.
  362. for iface, config in ifaces.items ():
  363. iface_type = config.get ('type', 'inet')
  364. if iface_type not in ['mesh_breakout', 'batman_iface']:
  365. continue
  366. site = config.get ('site')
  367. site_bridge = "br-%s" % site
  368. batman_site_if = "bat-%s" % site
  369. if iface_type == 'mesh_breakout':
  370. # If the bridge has already been defined (with an IP maybe) make
  371. # sure that the corresbonding batman device is part of the bridge-
  372. # ports.
  373. if site_bridge in ifaces:
  374. bridge_config = ifaces.get (site_bridge)
  375. # If there already is/are (a) bridge-port(s) defined, add
  376. # the batman and the breakout interfaces if not present...
  377. bridge_ports = bridge_config.get ('bridge-ports', None)
  378. if bridge_ports:
  379. for dev in (batman_site_if, iface):
  380. if not dev in bridge_ports:
  381. if type (bridge_ports) == list:
  382. bridge_ports.append (dev)
  383. else:
  384. bridge_config['bridge-ports'] += ' ' + dev
  385. # ...if there is no bridge-port defined yet, just used
  386. # the batman and breakout iface.
  387. else:
  388. bridge_config['bridge-ports'] = [ iface, batman_site_if ]
  389. # If the bridge isn't present alltogether, add it.
  390. else:
  391. ifaces[site_bridge] = {
  392. 'bridge-ports' : [ iface, batman_site_if ],
  393. }
  394. elif iface_type == 'batman_iface':
  395. batman_ifaces = ifaces[bat_site_if]['batman-ifaces']
  396. if iface not in batman_ifaces:
  397. if type (batman_ifaces) == list:
  398. batman_ifaces.append (iface)
  399. else:
  400. batman_ifaces += ' ' + iface
  401. _set_mtu_to_iface_and_upper (ifaces, iface, MTU['batman_underlay_iface'])
  402. #
  403. # Generate any implicitly defined VXLAN interfaces defined in the nodes iface
  404. # defined in pillar.
  405. # The keyword "batman_connect_sites" on an interface will trigger the
  406. # generation of a VXLAN overlay interfaces.
  407. def _generate_vxlan_interface_config (node_config, ifaces, sites_config):
  408. # No role 'batman', nothing to do
  409. if 'batman' not in node_config.get ('roles', []):
  410. return
  411. # Sites configured on this node. Nothing to do, if none.
  412. my_sites = node_config.get ('sites', [])
  413. if len (my_sites) == 0:
  414. return
  415. # As we're still here we can now safely assume that a B.A.T.M.A.N.
  416. # device has been configured for every site specified in sites list.
  417. device_no = node_config.get ('id', -1)
  418. for iface, iface_config in ifaces.items ():
  419. batman_connect_sites = iface_config.get ('batman_connect_sites', [])
  420. # If we got a string, convert it to a list with a single element
  421. if type (batman_connect_sites) == str:
  422. batman_connect_sites = [ batman_connect_sites ]
  423. # If there the list of sites to connect is empty, there's nothing to do here.
  424. if len (batman_connect_sites) == 0:
  425. continue
  426. # Set the MTU of this (probably) VLAN device to the MTU required for a VXLAN underlay
  427. # device, where B.A.T.M.A.N. adv. is to be expected within the VXLAN overlay.
  428. _set_mtu_to_iface_and_upper (ifaces, iface, MTU['vxlan_underlay_iface'])
  429. # If the string 'all' is part of the list, blindly use all sites configured for this node
  430. if 'all' in batman_connect_sites:
  431. batman_connect_sites = my_sites
  432. for site in batman_connect_sites:
  433. # Silenty ignore sites not configured on this node
  434. if site not in my_sites:
  435. continue
  436. # iface_name := vx_<last 5 chars of underlay iface>_<site> stripped to 15 chars
  437. vx_iface = ("vx_%s_%s" % (re.sub ('vlan', 'v', iface)[-5:], re.sub (r'[_-]', '', site)))[:15]
  438. site_no = _get_site_no (sites_config, site)
  439. vni = 100 + site_no
  440. bat_iface = "bat-%s" % site
  441. try:
  442. iface_id = int (re.sub ('vlan', '', iface))
  443. # Gather interface specific mcast address.
  444. # The address is derived from the vlan-id of the underlying interface,
  445. # assuming that it in fact is a vlan interface.
  446. # Mangle the vlan-id into two 2 digit values, eliminating any leading zeros.
  447. iface_id_4digit = "%04d" % iface_id
  448. octet2 = int (iface_id_4digit[0:2])
  449. octet3 = int (iface_id_4digit[2:4])
  450. mcast_ip = "225.%s.%s.%s" % (octet2, octet3, site_no)
  451. vni = octet2 * 256 * 256 + octet3 * 256 + site_no
  452. except ValueError:
  453. iface_id = 9999
  454. mcast_ip = "225.0.0.%s" % site_no
  455. vni = site_no
  456. # bail out if VXLAN tunnel already configured
  457. if vx_iface in ifaces:
  458. continue
  459. # If there's no batman interface for this site, there's no point
  460. # in setting up a VXLAN interfaces
  461. if bat_iface not in ifaces:
  462. continue
  463. # Add the VXLAN interface
  464. ifaces[vx_iface] = {
  465. 'vxlan' : {
  466. 'vxlan-id' : vni,
  467. 'vxlan-svcnodeip' : mcast_ip,
  468. 'vxlan-physdev' : iface,
  469. },
  470. 'hwaddress' : gen_batman_iface_mac (site_no, device_no, iface_id),
  471. 'mtu' : MTU['batman_underlay_iface'],
  472. }
  473. # If the batman interface for this site doesn't have any interfaces
  474. # set up - which basicly cannot happen - add this VXLAN tunnel as
  475. # the first in the list.
  476. if not 'batman-ifaces' in ifaces[bat_iface]:
  477. ifaces[bat_iface]['batman-ifaces'] = [ vx_iface ]
  478. continue
  479. # In the hope there already are interfaces for batman set up already
  480. # add this VXLAN tunnel to the list
  481. batman_ifaces = ifaces[bat_iface]['batman-ifaces']
  482. if vx_iface not in batman_ifaces:
  483. if type (batman_ifaces) == list:
  484. batman_ifaces.append (vx_iface)
  485. else:
  486. batman_ifaces += ' ' + vx_iface
  487. #
  488. # Generate implicitly defined VRFs according to the vrf_info dict at the top
  489. # of this file
  490. def _generate_vrfs (ifaces):
  491. for iface, iface_config in ifaces.items ():
  492. vrf = iface_config.get ('vrf', None)
  493. if vrf and vrf not in ifaces:
  494. conf = vrf_info.get (vrf, {})
  495. table = conf.get ('table', 1234)
  496. fwmark = conf.get ('fwmark', None)
  497. ifaces[vrf] = {
  498. 'vrf-table' : table,
  499. }
  500. # Create ip rule's for any fwmarks defined
  501. if fwmark:
  502. up = []
  503. # Make sure we are dealing with a list even if there is only one mark to be set up
  504. if type (fwmark) in (str, int):
  505. fwmark = [ fwmark ]
  506. # Create ip rule entries for IPv4 and IPv6 for every fwmark
  507. for mark in fwmark:
  508. up.append ("ip rule add fwmark %s table %s" % (mark, table))
  509. up.append ("ip -6 rule add fwmark %s table %s" % (mark, table))
  510. ifaces[vrf]['up'] = up
  511. def _generate_ffrl_gre_tunnels (ifaces):
  512. for iface, iface_config in ifaces.items ():
  513. # We only care for GRE_FFRL type interfaces
  514. if iface_config.get ('type', '') != 'GRE_FFRL':
  515. continue
  516. # Copy default values to interface config
  517. for attr, val in GRE_FFRL_attrs.items ():
  518. if not attr in iface_config:
  519. iface_config[attr] = val
  520. # Guesstimate local IPv4 tunnel endpoint address from tunnel-physdev
  521. if not 'local' in iface_config and 'tunnel-physdev' in iface_config:
  522. try:
  523. physdev_prefixes = [p.split ('/')[0] for p in ifaces[iface_config['tunnel-physdev']]['prefixes'] if '.' in p]
  524. if len (physdev_prefixes) == 1:
  525. iface_config['local'] = physdev_prefixes[0]
  526. except KeyError:
  527. pass
  528. def _generate_loopback_ips (ifaces, node_config, node_id):
  529. v4_ip = "%s/32" % get_loopback_ip (node_config, node_id, 'v4')
  530. v6_ip = "%s/128" % get_loopback_ip (node_config, node_id, 'v6')
  531. # Interface lo already present?
  532. if 'lo' not in ifaces:
  533. ifaces['lo'] = { 'prefixes' : [] }
  534. # Add 'prefixes' list if not present
  535. if 'prefixes' not in ifaces['lo']:
  536. ifaces['lo']['prefixes'] = []
  537. prefixes = ifaces['lo']['prefixes']
  538. if v4_ip not in prefixes:
  539. prefixes.append (v4_ip)
  540. if v6_ip not in prefixes:
  541. prefixes.append (v6_ip)
  542. # Generate interface descriptions / aliases for auto generated or manually
  543. # created interfaces. Currently this only is done for bridges associated
  544. # with BATMAN instanzes.
  545. #
  546. # @param node_config: The configuration of the given node (as dict)
  547. # @param sites_config Global sites configuration (as dict)
  548. def _update_interface_desc (node_config, sites_config):
  549. # Currently we only care for nodes with batman role.
  550. if 'batman' not in node_config.get ('roles', []):
  551. return
  552. for iface, iface_config in node_config.get ('ifaces', {}):
  553. if 'desc' in sites_config:
  554. continue
  555. # If the interface name looks like a bridge for a BATMAN instance
  556. # try to get the name of the corresponding site
  557. match = re.search (r'^br-([a-z-_]+)$', iface)
  558. if match and match in sites:
  559. try:
  560. iface_config['desc'] = sites[match.group (1)]['name']
  561. except KeyError:
  562. pass
  563. ################################################################################
  564. # Public functions #
  565. ################################################################################
  566. # Generate network interface configuration for given node.
  567. #
  568. # This function will read the network configuration from pillar and will
  569. # * enhance it with all default values configured at the top this file
  570. # * auto generate any implicitly configured
  571. # * VRFs
  572. # * B.A.T.M.A.N. instances and interfaces
  573. # * VXLAN interfaces to connect B.A.T.M.A.N. sites
  574. # * Loopback IPs derived from numeric node ID
  575. #
  576. # @param: node_config Pillar node configuration (as dict)
  577. # @param: sites_config Pillar sites configuration (as dict)
  578. # @param: node_id Minion name / Pillar node configuration key
  579. def get_interface_config (node_config, sites_config, node_id = ""):
  580. # Get config of this node and dict of all configured ifaces
  581. ifaces = node_config.get ('ifaces', {})
  582. # Generate configuration entries for any batman related interfaces not
  583. # configured explicitly, but asked for implicitly by role <batman> and
  584. # a (list of) site(s) specified in the node config.
  585. _generate_batman_interface_config (node_config, ifaces, sites_config)
  586. # Generate VXLAN tunnels for every interfaces specifying 'batman_connect_sites'
  587. _generate_vxlan_interface_config (node_config, ifaces, sites_config)
  588. # Enhance ifaces configuration with some meaningful defaults for
  589. # bonding, bridge and vlan interfaces, MAC address for batman ifaces, etc.
  590. for interface, config in ifaces.items ():
  591. if type (config) not in [ dict, collections.OrderedDict ]:
  592. raise Exception ("Configuration for interface %s on node %s seems broken!" % (interface, node_id))
  593. iface_type = config.get ('type', 'inet')
  594. if 'batman-ifaces' in config or iface_type.startswith ('batman'):
  595. _update_batman_config (node_config, interface, sites_config)
  596. if 'bond-slaves' in config:
  597. _update_bond_config (config)
  598. # FIXME: This maybe will not match on bridges without any member ports configured!
  599. if 'bridge-ports' in config or interface.startswith ('br-'):
  600. _update_bridge_config (config)
  601. if 'vlan-raw-device' in config or 'vlan-id' in config:
  602. _update_vlan_config (config)
  603. # Pimp configuration for VEth link pairs
  604. if interface.startswith ('veth_'):
  605. _update_veth_config (interface, config)
  606. # Auto generate Loopback IPs IFF not present
  607. _generate_loopback_ips (ifaces, node_config, node_id)
  608. # Auto generated VRF devices for any VRF found in ifaces and not already configured.
  609. _generate_vrfs (ifaces)
  610. # Pimp GRE_FFRL type inteface configuration with default values
  611. _generate_ffrl_gre_tunnels (ifaces)
  612. # Drop any config parameters used in node interface configuration not
  613. # relevant anymore for config file generation.
  614. for interface, config in ifaces.items ():
  615. # Set default MTU if not already set manually or by any earlier function
  616. if interface != 'lo' and ('mtu' not in config):
  617. config['mtu'] = MTU['default']
  618. for key in [ 'batman_connect_sites', 'ospf', 'site', 'type' ]:
  619. if key in config:
  620. config.pop (key)
  621. # This leaves 'auto', 'prefixes' and 'desc' as keys which should not be directly
  622. # printed into the remaining configuration. These are handled within the jinja
  623. # interface template.
  624. # Generate meaningful interface descriptions / aliases where useful
  625. _update_interface_desc (node_config, sites_config)
  626. return ifaces
  627. # Generate entries for /etc/bat-hosts for every batman interface we will configure on any node.
  628. # For readability purposes superflous/redundant information is being stripped/supressed.
  629. # As these names will only show up in batctl calls with a specific site, site_names in interfaces
  630. # are stripped. Dummy interfaces are stripped as well.
  631. def gen_bat_hosts (nodes_config, sites_config):
  632. bat_hosts = {}
  633. for node_id in sorted (nodes_config.keys ()):
  634. node_config = nodes_config.get (node_id)
  635. node_name = node_id.split ('.')[0]
  636. ifaces = get_interface_config (node_config, sites_config, node_id)
  637. for iface in sorted (ifaces):
  638. iface_config = ifaces.get (iface)
  639. hwaddress = iface_config.get ('hwaddress', None)
  640. if hwaddress == None:
  641. continue
  642. entry_name = node_name
  643. match = re.search (r'^dummy-(.+)(-e)?$', iface)
  644. if match:
  645. if match.group (2):
  646. entry_name += "-e"
  647. # Append site to make name unique
  648. entry_name += "/%s" % match.group (1)
  649. else:
  650. entry_name += "/%s" % re.sub (r'^(vx_.*|i2e|e2i)[_-](.*)$', '\g<1>/\g<2>', iface)
  651. bat_hosts[hwaddress] = entry_name
  652. if 'fastd' in node_config.get ('roles', []):
  653. device_no = node_config.get ('id')
  654. for site in node_config.get ('sites', []):
  655. site_no = _get_site_no (sites_config, site)
  656. for network in ('intergw', 'nodes4', 'nodes6'):
  657. hwaddress = gen_batman_iface_mac (site_no, device_no, network)
  658. bat_hosts[hwaddress] = "%s/%s/%s" % (node_name, network, site)
  659. return bat_hosts
  660. # Generate eBGP session parameters for FFRL Transit from nodes pillar information.
  661. def get_ffrl_bgp_config (ifaces, proto):
  662. from ipcalc import IP
  663. _generate_ffrl_gre_tunnels (ifaces)
  664. sessions = {}
  665. for iface in sorted (ifaces):
  666. # We only care for GRE tunnels to the FFRL Backbone
  667. if not iface.startswith ('gre_ffrl_'):
  668. continue
  669. iface_config = ifaces.get (iface)
  670. # Search for IPv4/IPv6 prefix as defined by proto parameter
  671. local = None
  672. neighbor = None
  673. for prefix in iface_config.get ('prefixes', []):
  674. if (proto == 'v4' and '.' in prefix) or (proto == 'v6' and ':' in prefix):
  675. local = prefix.split ('/')[0]
  676. # Calculate neighbor IP as <local IP> - 1
  677. if proto == 'v4':
  678. neighbor = str (IP (int (IP (local)) - 1, version = 4))
  679. else:
  680. neighbor = str (IP (int (IP (local)) - 1, version = 6))
  681. break
  682. # Strip gre_ prefix iface name and use it as identifier for the eBGP session.
  683. name = re.sub ('gre_ffrl_', 'ffrl_', iface)
  684. sessions[name] = {
  685. 'local' : local,
  686. 'neighbor' : neighbor,
  687. 'bgp_local_pref' : iface_config.get ('bgp_local_pref', None),
  688. }
  689. return sessions
  690. # Get list of IP address configured on given interface on given node.
  691. #
  692. # @param: node_config Pillar node configuration (as dict)
  693. # @param: iface_name Name of the interface defined in pillar node config
  694. # OR name of VRF ("vrf_<something>") whichs ifaces are
  695. # to be examined.
  696. def get_node_iface_ips (node_config, iface_name):
  697. ips = {
  698. 'v4' : [],
  699. 'v6' : [],
  700. }
  701. ifaces = node_config.get ('ifaces', {})
  702. ifaces_names = [ iface_name ]
  703. if iface_name.startswith ('vrf_'):
  704. # Reset list of ifaces_names to consider
  705. ifaces_names = []
  706. vrf = iface_name
  707. for iface, iface_config in ifaces.items ():
  708. # Ignore any iface NOT in the given VRF
  709. if iface_config.get ('vrf', None) != vrf:
  710. continue
  711. # Ignore any VEth pairs
  712. if iface.startswith ('veth'):
  713. continue
  714. ifaces_names.append (iface)
  715. try:
  716. for iface in ifaces_names:
  717. for prefix in ifaces[iface]['prefixes']:
  718. ip_ver = 'v6' if ':' in prefix else 'v4'
  719. ips[ip_ver].append (prefix.split ('/')[0])
  720. except KeyError:
  721. pass
  722. return ips
  723. #
  724. # Get the lookback IP of the given node for the given proto
  725. #
  726. # @param node_config: Pillar node configuration (as dict)
  727. # @param node_id: Minion name / Pillar node configuration key
  728. # @param proto: { 'v4', 'v6' }
  729. def get_loopback_ip (node_config, node_id, proto):
  730. if proto not in [ 'v4', 'v6' ]:
  731. raise Exception ("get_loopback_ip(): Invalid proto: \"%s\"." % proto)
  732. if not proto in loopback_prefix:
  733. raise Exception ("get_loopback_ip(): No loopback_prefix configured for IP%s in ffno_net module!" % proto)
  734. if not 'id' in node_config:
  735. raise Exception ("get_loopback_ip(): No 'id' configured in pillar for node \"%s\"!" % node_id)
  736. # Every rule has an exception.
  737. # If there is a loopback_overwrite configuration for this node, use this instead of
  738. # the generated IPs.
  739. if 'loopback_override' in node_config:
  740. if proto not in node_config['loopback_override']:
  741. raise Exception ("get_loopback_ip(): No loopback_prefix configured for IP%s in node config / loopback_override!" % proto)
  742. return node_config['loopback_override'][proto]
  743. return "%s%s" % (loopback_prefix.get (proto), node_config.get ('id'))
  744. #
  745. # Get the router id (read: IPv4 Lo-IP) out of the given node config.
  746. def get_router_id (node_config, node_id):
  747. return get_loopback_ip (node_config, node_id, 'v4')
  748. # Compute minions OSPF interface configuration according to FFHO routing policy
  749. # See https://wiki.ffho.net/infrastruktur:vlans for information about Vlans
  750. def get_ospf_interface_config (node_config, grains_id):
  751. ospf_node_config = node_config.get ('ospf', {})
  752. ospf_interfaces = {}
  753. for iface, iface_config in node_config.get ('ifaces', {}).items ():
  754. # By default we don't speak OSPF on interfaces
  755. ospf_on = False
  756. # Defaults for OSPF interfaces
  757. ospf_config = {
  758. 'stub' : True, # Active/Passive interface
  759. 'cost' : 12345,
  760. # 'type' # Area type
  761. }
  762. # OSPF configuration for interface given?
  763. ospf_config_pillar = iface_config.get ('ospf', {})
  764. # Local Gigabit Ethernet based connections (PTP or L2 subnets), cost 10
  765. if re.search (r'^(br-?|br\d+\.|vlan)10\d\d$', iface):
  766. ospf_on = True
  767. ospf_config['stub'] = False
  768. ospf_config['cost'] = 10
  769. ospf_config['desc'] = "Wired Gigabit connection"
  770. # AF-X based WBBL connection
  771. elif re.search (r'^vlan20\d\d$', iface):
  772. ospf_on = True
  773. ospf_config['stub'] = False
  774. ospf_config['cost'] = 100
  775. ospf_config['desc'] = "AF-X based WBBL connection"
  776. # Non-AF-X based WBBL connection
  777. elif re.search (r'^vlan22\d\d$', iface):
  778. ospf_on = True
  779. ospf_config['stub'] = False
  780. ospf_config['cost'] = 1000
  781. ospf_config['desc'] = "Non-AF-X based WBBL connection"
  782. # Management Vlans
  783. elif re.search (r'^vlan30\d\d$', iface):
  784. ospf_on = True
  785. ospf_config['stub'] = True
  786. ospf_config['cost'] = 10
  787. # Active OSPF on OpenVPN tunnels, cost 10000
  788. elif iface.startswith ('ovpn-'):
  789. ospf_on = True
  790. ospf_config['stub'] = False
  791. ospf_config['cost'] = 10000
  792. # Inter-Core links should have cost 5000
  793. if iface.startswith ('ovpn-cr') and grains_id.startswith ('cr'):
  794. ospf_config['cost'] = 5000
  795. # OpenVPN tunnels to EdgeRouters
  796. elif iface.startswith ('ovpn-er-'):
  797. ospf_config['type'] = 'broadcast'
  798. # Configure Out-of-band OpenVPN tunnels as stub interfaces,
  799. # so recursive next-hop lookups for OOB-BGP-session will work.
  800. elif iface.startswith ('oob-'):
  801. ospf_on = True
  802. ospf_config['stub'] = True
  803. ospf_config['cost'] = 1000
  804. # OSPF explicitly enabled for interface
  805. elif 'ospf' in iface_config:
  806. ospf_on = True
  807. # iface ospf parameters will be applied later
  808. # Go on if OSPF should not be actived
  809. if not ospf_on:
  810. continue
  811. # Explicit OSPF interface configuration parameters take precendence over generated ones
  812. for attr, val in ospf_config_pillar:
  813. ospf_config[attr] = val
  814. # Convert boolean values to 'yes' / 'no' string values
  815. for attr, val in ospf_config.items ():
  816. if type (val) == bool:
  817. ospf_config[attr] = 'yes' if val else 'no'
  818. # Store interface configuration
  819. ospf_interfaces[iface] = ospf_config
  820. return ospf_interfaces
  821. # Return (possibly empty) subset of Traffic Engineering entries from 'te' pillar entry
  822. # relevenant for this minion and protocol (IPv4 / IPv6)
  823. def get_te_prefixes (te_node_config, grains_id, proto):
  824. te_config = {}
  825. for prefix, prefix_config in te_node_config.get ('prefixes', {}).items ():
  826. prefix_proto = 'v6' if ':' in prefix else 'v4'
  827. # Should this TE policy be applied on this node and is the prefix
  828. # of the proto we are looking for?
  829. if grains_id in prefix_config.get ('nodes', []) and prefix_proto == proto:
  830. te_config[prefix] = prefix_config
  831. return te_config
  832. def generate_DNS_entries (nodes_config, sites_config):
  833. import ipaddress
  834. forward_zone_name = ""
  835. forward_zone = []
  836. zones = {
  837. # <forward_zone_name>: [],
  838. # <rev_zone1_name>: [],
  839. # <rev_zone2_name>: [],
  840. # ...
  841. }
  842. # Fill zones dict with zones configured in DNS_zone_names at the top of this file.
  843. # Make sure the zone base names provided start with a leading . so the string
  844. # operations later can be done easily and safely. Proceed with fingers crossed.
  845. for entry, value in DNS_zone_names.items ():
  846. if entry == "forward":
  847. zone = value
  848. if not zone.startswith ('.'):
  849. zone = ".%s" % zone
  850. zones[zone] = forward_zone
  851. forward_zone_name = zone
  852. if entry in [ 'rev_v4', 'rev_v6' ]:
  853. for zone in value:
  854. if not zone.startswith ('.'):
  855. zone = ".%s" % zone
  856. zones[zone] = []
  857. # Process all interfaace of all nodes defined in pillar and generate forward
  858. # and reverse entries for all zones defined in DNS_zone_names. Automagically
  859. # put reverse entries into correct zone.
  860. for node_id in sorted (nodes_config):
  861. node_config = nodes_config.get (node_id)
  862. ifaces = get_interface_config (node_config, sites_config, node_id)
  863. for iface in sorted (ifaces):
  864. iface_config = ifaces.get (iface)
  865. # We only care for interfaces with IPs configured
  866. prefixes = iface_config.get ("prefixes", None)
  867. if prefixes == None:
  868. continue
  869. # Ignore any interface in $VRF
  870. if iface_config.get ('vrf', "") in [ 'vrf_external' ]:
  871. continue
  872. for prefix in sorted (prefixes):
  873. ip = ipaddress.ip_address (u'%s' % prefix.split ('/')[0])
  874. proto = 'v%s' % ip.version
  875. # The entry name is
  876. # <node_id> when interface 'lo'
  877. # <node_name>.srv.<residual> when interface 'srv' (or magically detected internal srv record)
  878. # <interface>.<node_id> else
  879. entry_name = node_id
  880. if iface != "lo":
  881. entry_name = "%s.%s" % (iface, node_id)
  882. elif iface == 'srv' or re.search (r'^(10.132.251|2a03:2260:2342:f251:)', prefix):
  883. entry_name = re.sub (r'^([^.]+)\.(.+)$', r'\g<1>.srv.\g<2>', entry_name)
  884. # Strip forward zone name from entry_name and store forward entry
  885. # with correct entry type for found IP address.
  886. forward_entry_name = re.sub (forward_zone_name, "", entry_name)
  887. forward_entry_name = re.sub (forward_zone_name, "", entry_name)
  888. forward_entry_typ = "A" if ip.version == 4 else "AAAA"
  889. forward_zone.append ("%s IN %s %s" % (forward_entry_name, forward_entry_typ, ip))
  890. # Find correct reverse zone, if configured and strip reverse zone name
  891. # from calculated reverse pointer name. Store reverse entry if we found
  892. # a zone for it. If no configured reverse zone did match, this reverse
  893. # entry will be ignored.
  894. for zone in zones:
  895. if ip.reverse_pointer.find (zone) > 0:
  896. PTR_entry = re.sub (zone, "", ip.reverse_pointer)
  897. zones[zone].append ("%s IN PTR %s." % (PTR_entry, entry_name))
  898. break
  899. return zones
  900. # Convert the CIDR network from the given prefix into a dotted netmask
  901. def cidr_to_dotted_mask (prefix):
  902. from ipcalc import Network
  903. return str (Network (prefix).netmask ())