From a93ea04589918d9f984c11892b1a712cab811a3c Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Thu, 13 May 2021 17:20:48 +0200
Subject: op-mode: conntrack: T3535: add XML command definitions

---
 op-mode-definitions/conntrack-sync.xml.in |  36 +++++++++++
 src/op_mode/conntrack_sync.py             | 100 ++++++++++++++++++++++++++++++
 2 files changed, 136 insertions(+)
 create mode 100644 op-mode-definitions/conntrack-sync.xml.in
 create mode 100755 src/op_mode/conntrack_sync.py

diff --git a/op-mode-definitions/conntrack-sync.xml.in b/op-mode-definitions/conntrack-sync.xml.in
new file mode 100644
index 000000000..cd0ec5cc8
--- /dev/null
+++ b/op-mode-definitions/conntrack-sync.xml.in
@@ -0,0 +1,36 @@
+<?xml version="1.0"?>
+<interfaceDefinition>
+  <node name="reset">
+    <children>
+      <node name="conntrack-sync">
+        <properties>
+          <help>Reset connection syncing parameters</help>
+        </properties>
+        <children>
+          <leafNode name="external-cache">
+            <properties>
+              <help>Reset external cache and request resync with other systems</help>
+            </properties>
+            <command>${vyos_op_scripts_dir}/conntrack_sync.py --reset-cache-external</command>
+          </leafNode>
+          <leafNode name="internal-cache">
+            <properties>
+              <help>Reset internal cache and request resync with other systems</help>
+            </properties>
+            <command>${vyos_op_scripts_dir}/conntrack_sync.py --reset-cache-internal</command>
+          </leafNode>
+        </children>
+      </node>
+    </children>
+  </node>
+  <node name="restart">
+    <children>
+      <leafNode name="conntrack-sync">
+        <properties>
+          <help>Restart connection tracking synchronization service</help>
+        </properties>
+        <command>${vyos_op_scripts_dir}/conntrack_sync.py --restart</command>
+      </leafNode>
+    </children>
+  </node>
+</interfaceDefinition>
diff --git a/src/op_mode/conntrack_sync.py b/src/op_mode/conntrack_sync.py
new file mode 100755
index 000000000..48017c58a
--- /dev/null
+++ b/src/op_mode/conntrack_sync.py
@@ -0,0 +1,100 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import syslog
+
+from argparse import ArgumentParser
+from vyos.configquery import CliShellApiConfigQuery
+from vyos.util import call
+from vyos.util import run
+
+conntrackd_bin = '/usr/sbin/conntrackd'
+conntrackd_config = '/run/conntrackd/conntrackd.conf'
+
+parser = ArgumentParser(description='Conntrack Sync')
+parser.add_argument('--restart', help='Restart connection tracking synchronization service', action='store_true')
+parser.add_argument('--reset-cache-internal', help='Reset internal cache', action='store_true')
+parser.add_argument('--reset-cache-external', help='Reset external cache', action='store_true')
+
+def is_configured():
+    """ Check if conntrack-sync service is configured """
+    config = CliShellApiConfigQuery()
+    if not config.exists(['service', 'conntrack-sync']):
+        print('Service conntrackd-sync not configured!')
+        exit(1)
+
+def send_bulk_update():
+    """ send bulk update of internal-cache to other systems """
+    tmp = run(f'{conntrackd_bin} -c {conntrackd_config} -B')
+    if tmp > 0:
+        print('ERROR: failed to send bulk update to other conntrack-sync systems')
+
+def request_sync():
+    """ request resynchronization with other systems """
+    tmp = run(f'{conntrackd_bin} -c {conntrackd_config} -n')
+    if tmp > 0:
+        print('ERROR: failed to request resynchronization of external cache')
+
+def flush_cache(direction):
+    """ flush conntrackd cache (internal or external) """
+    if direction not in ['internal', 'external']:
+        raise ValueError()
+    tmp = run(f'{conntrackd_bin} -c {conntrackd_config} -f {direction}')
+    if tmp > 0:
+        print('ERROR: failed to clear {direction} cache')
+
+if __name__ == '__main__':
+    args = parser.parse_args()
+    syslog.openlog(ident='conntrack-tools', logoption=syslog.LOG_PID,
+                   facility=syslog.LOG_INFO)
+
+    if args.restart:
+        is_configured()
+
+        syslog.syslog('Restarting conntrack sync service...')
+        call('systemctl restart conntrackd.service')
+        # request resynchronization with other systems
+        request_sync()
+        # send bulk update of internal-cache to other systems
+        send_bulk_update()
+
+    elif args.reset_cache_external:
+        is_configured()
+        syslog.syslog('Resetting external cache of conntrack sync service...')
+
+        # flush the external cache
+        flush_cache('external')
+        # request resynchronization with other systems
+        request_sync()
+
+    elif args.reset_cache_internal:
+        is_configured()
+        syslog.syslog('Resetting internal cache of conntrack sync service...')
+        # flush the internal cache
+        flush_cache('internal')
+
+        # request resynchronization of internal cache with kernel conntrack table
+        tmp = run(f'{conntrackd_bin} -c {conntrackd_config} -R')
+        if tmp > 0:
+            print('ERROR: failed to resynchronize internal cache with kernel conntrack table')
+
+        # send bulk update of internal-cache to other systems
+        send_bulk_update()
+
+    else:
+        parser.print_help()
+        exit(1)
-- 
cgit v1.2.3