Merge pull request #1076 from DmitriyEshenko/current-22112021-01

tftp: T4012: Add TFTP VRF support

6 files changed, 78 insertions, 4 deletions

diff --git a/data/templates/tftp-server/default.tmpl b/data/templates/tftp-server/default.tmpl
index 6b2d6a903..a7edf60ad 100644
--- a/data/templates/tftp-server/default.tmpl
+++ b/data/templates/tftp-server/default.tmpl
@@ -1,2 +1,7 @@
 ### Autogenerated by tftp_server.py ###
 DAEMON_ARGS="--listen --user tftp --address {{ listen_address }} {{ "--create --umask 000" if allow_upload is defined }} --secure {{ directory }}"
+{% if vrf is defined %}
+VRF_ARGS="ip vrf exec {{ vrf }}"
+{% else %}
+VRF_ARGS=""
+{% endif %}
diff --git a/interface-definitions/include/listen-address-vrf.xml.i b/interface-definitions/include/listen-address-vrf.xml.i
new file mode 100644
index 000000000..7ec9eace4
--- /dev/null
+++ b/interface-definitions/include/listen-address-vrf.xml.i
@@ -0,0 +1,25 @@
+<!-- include start from listen-address-vrf.xml.i -->
+<tagNode name="listen-address">
+  <properties>
+    <help>Local IP addresses for service to listen on</help>
+    <completionHelp>
+      <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
+    </completionHelp>
+    <valueHelp>
+      <format>ipv4</format>
+      <description>IP address to listen for incoming connections</description>
+    </valueHelp>
+    <valueHelp>
+      <format>ipv6</format>
+      <description>IPv6 address to listen for incoming connections</description>
+    </valueHelp>
+    <constraint>
+      <validator name="ipv4-address"/>
+      <validator name="ipv6-address"/>
+    </constraint>
+  </properties>
+  <children>
+    #include <include/interface/vrf.xml.i>
+  </children>
+</tagNode>
+<!-- include end -->
diff --git a/interface-definitions/tftp-server.xml.in b/interface-definitions/tftp-server.xml.in
index 037c097ca..4963eab3c 100644
--- a/interface-definitions/tftp-server.xml.in
+++ b/interface-definitions/tftp-server.xml.in
@@ -24,7 +24,7 @@
           <leafNode name="port">
             <defaultValue>69</defaultValue>
           </leafNode>
-          #include <include/listen-address.xml.i>
+          #include <include/listen-address-vrf.xml.i>
         </children>
       </node>
     </children>
diff --git a/smoketest/scripts/cli/test_service_tftp-server.py b/smoketest/scripts/cli/test_service_tftp-server.py
index 1a1bf0cdf..b57c33f26 100755
--- a/smoketest/scripts/cli/test_service_tftp-server.py
+++ b/smoketest/scripts/cli/test_service_tftp-server.py
@@ -20,6 +20,7 @@ from psutil import process_iter
 from base_vyostest_shim import VyOSUnitTestSHIM
 
 from vyos.configsession import ConfigSessionError
+from vyos.util import cmd
 from vyos.util import read_file
 from vyos.util import process_named_running
 from vyos.template import is_ipv6
@@ -29,6 +30,7 @@ base_path = ['service', 'tftp-server']
 dummy_if_path = ['interfaces', 'dummy', 'dum69']
 address_ipv4 = '192.0.2.1'
 address_ipv6 = '2001:db8::1'
+vrf = 'mgmt'
 
 class TestServiceTFTPD(VyOSUnitTestSHIM.TestCase):
     def setUp(self):
@@ -97,5 +99,42 @@ class TestServiceTFTPD(VyOSUnitTestSHIM.TestCase):
                 count += 1
         self.assertEqual(count, len(address))
 
+    def test_03_tftpd_vrf(self):
+        directory = '/tmp'
+        port = '69' # default port
+
+        self.cli_set(base_path + ['allow-upload'])
+        self.cli_set(base_path + ['directory', directory])
+        self.cli_set(base_path + ['listen-address', address_ipv4, 'vrf', vrf])
+
+        # VRF does yet not exist - an error must be thrown
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
+        self.cli_set(['vrf', 'name', vrf, 'table', '1338'])
+        self.cli_set(dummy_if_path + ['vrf', vrf])
+
+        # commit changes
+        self.cli_commit()
+
+        config = read_file('/etc/default/tftpd0')
+        # verify listen IP address
+        self.assertIn(f'{address_ipv4}:{port} -4', config)
+        # verify directory
+        self.assertIn(directory, config)
+        # verify upload
+        self.assertIn('--create --umask 000', config)
+
+        # Check for running process
+        self.assertTrue(process_named_running(PROCESS_NAME))
+
+        # Check for process in VRF
+        tmp = cmd(f'ip vrf pids {vrf}')
+        self.assertIn(PROCESS_NAME, tmp)
+
+        # delete VRF
+        self.cli_delete(dummy_if_path + ['vrf'])
+        self.cli_delete(['vrf', 'name', vrf])
+
 if __name__ == '__main__':
     unittest.main(verbosity=2)
diff --git a/src/conf_mode/tftp_server.py b/src/conf_mode/tftp_server.py
index 2409eec1f..ef726670c 100755
--- a/src/conf_mode/tftp_server.py
+++ b/src/conf_mode/tftp_server.py
@@ -24,6 +24,7 @@ from sys import exit
 
 from vyos.config import Config
 from vyos.configdict import dict_merge
+from vyos.configverify import verify_vrf
 from vyos.template import render
 from vyos.template import is_ipv4
 from vyos.util import call
@@ -65,10 +66,11 @@ def verify(tftpd):
     if 'listen_address' not in tftpd:
         raise ConfigError('TFTP server listen address must be configured!')
 
-    for address in tftpd['listen_address']:
+    for address, address_config in tftpd['listen_address'].items():
         if not is_addr_assigned(address):
             print(f'WARNING: TFTP server listen address "{address}" not ' \
                   'assigned to any interface!')
+        verify_vrf(address_config)
 
     return None
 
@@ -83,7 +85,7 @@ def generate(tftpd):
         return None
 
     idx = 0
-    for address in tftpd['listen_address']:
+    for address, address_config in tftpd['listen_address'].items():
         config = deepcopy(tftpd)
         port = tftpd['port']
         if is_ipv4(address):
@@ -91,6 +93,9 @@ def generate(tftpd):
         else:
             config['listen_address'] = f'[{address}]:{port} -6'
 
+        if 'vrf' in address_config:
+            config['vrf'] = address_config['vrf']
+
         file = config_file + str(idx)
         render(file, 'tftp-server/default.tmpl', config)
         idx = idx + 1
diff --git a/src/systemd/tftpd@.service b/src/systemd/tftpd@.service
index 266bc0962..a674bf598 100644
--- a/src/systemd/tftpd@.service
+++ b/src/systemd/tftpd@.service
@@ -7,7 +7,7 @@ RequiresMountsFor=/run
 Type=forking
 #NotifyAccess=main
 EnvironmentFile=-/etc/default/tftpd%I
-ExecStart=/usr/sbin/in.tftpd "$DAEMON_ARGS"
+ExecStart=/bin/sh -c "${VRF_ARGS} /usr/sbin/in.tftpd ${DAEMON_ARGS}"
 Restart=on-failure
 
 [Install]