diff options
Diffstat (limited to 'python/vyos/configverify.py')
| -rw-r--r-- | python/vyos/configverify.py | 72 |
1 files changed, 61 insertions, 11 deletions
diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py index abd91583d..5a4d14c68 100644 --- a/python/vyos/configverify.py +++ b/python/vyos/configverify.py @@ -89,6 +89,49 @@ def verify_vrf(config): 'Interface "{ifname}" cannot be both a member of VRF "{vrf}" ' 'and bridge "{is_bridge_member}"!'.format(**config)) +def verify_tunnel(config): + """ + This helper is used to verify the common part of the tunnel + """ + from vyos.template import is_ipv4 + from vyos.template import is_ipv6 + + if 'encapsulation' not in config: + raise ConfigError('Must configure the tunnel encapsulation for '\ + '{ifname}!'.format(**config)) + + if 'local_ip' not in config and 'dhcp_interface' not in config: + raise ConfigError('local-ip is mandatory for tunnel') + + if 'remote_ip' not in config and config['encapsulation'] != 'gre': + raise ConfigError('remote-ip is mandatory for tunnel') + + if {'local_ip', 'dhcp_interface'} <= set(config): + raise ConfigError('Can not use both local-ip and dhcp-interface') + + if config['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre', 'ip6erspan']: + error_ipv6 = 'Encapsulation mode requires IPv6' + if 'local_ip' in config and not is_ipv6(config['local_ip']): + raise ConfigError(f'{error_ipv6} local-ip') + + if 'remote_ip' in config and not is_ipv6(config['remote_ip']): + raise ConfigError(f'{error_ipv6} remote-ip') + else: + error_ipv4 = 'Encapsulation mode requires IPv4' + if 'local_ip' in config and not is_ipv4(config['local_ip']): + raise ConfigError(f'{error_ipv4} local-ip') + + if 'remote_ip' in config and not is_ipv4(config['remote_ip']): + raise ConfigError(f'{error_ipv4} remote-ip') + + if config['encapsulation'] in ['sit', 'gre-bridge']: + if 'source_interface' in config: + raise ConfigError('Option source-interface can not be used with ' \ + 'encapsulation "sit" or "gre-bridge"') + elif config['encapsulation'] == 'gre': + if 'local_ip' in config and is_ipv6(config['local_ip']): + raise ConfigError('Can not use local IPv6 address is for mGRE tunnels') + def verify_eapol(config): """ Common helper function used by interface implementations to perform @@ -209,6 +252,13 @@ def verify_vlan_config(config): Common helper function used by interface implementations to perform recurring validation of interface VLANs """ + + # VLAN and Q-in-Q IDs are not allowed to overlap + if 'vif' in config and 'vif_s' in config: + duplicate = list(set(config['vif']) & set(config['vif_s'])) + if duplicate: + raise ConfigError(f'Duplicate VLAN id "{duplicate[0]}" used for vif and vif-s interfaces!') + # 802.1q VLANs for vlan in config.get('vif', {}): vlan = config['vif'][vlan] @@ -217,17 +267,17 @@ def verify_vlan_config(config): verify_vrf(vlan) # 802.1ad (Q-in-Q) VLANs - for vlan in config.get('vif_s', {}): - vlan = config['vif_s'][vlan] - verify_dhcpv6(vlan) - verify_address(vlan) - verify_vrf(vlan) - - for vlan in config.get('vif_s', {}).get('vif_c', {}): - vlan = config['vif_c'][vlan] - verify_dhcpv6(vlan) - verify_address(vlan) - verify_vrf(vlan) + for s_vlan in config.get('vif_s', {}): + s_vlan = config['vif_s'][s_vlan] + verify_dhcpv6(s_vlan) + verify_address(s_vlan) + verify_vrf(s_vlan) + + for c_vlan in s_vlan.get('vif_c', {}): + c_vlan = s_vlan['vif_c'][c_vlan] + verify_dhcpv6(c_vlan) + verify_address(c_vlan) + verify_vrf(c_vlan) def verify_accel_ppp_base_service(config): """ |