Merge pull request #4108 from sarthurdev/wlb_python

wlb: T4470: Migrate WAN Load Balancer to XML/Python

2 files changed, 64 insertions, 134 deletions

diff --git a/data/templates/load-balancing/nftables-wlb.j2 b/data/templates/load-balancing/nftables-wlb.j2
new file mode 100644
index 000000000..75604aca1
--- /dev/null
+++ b/data/templates/load-balancing/nftables-wlb.j2
@@ -0,0 +1,64 @@
+#!/usr/sbin/nft -f
+
+{% if first_install is not vyos_defined %}
+delete table ip vyos_wanloadbalance
+{% endif %}
+table ip vyos_wanloadbalance {
+    chain wlb_nat_postrouting {
+        type nat hook postrouting priority srcnat - 1; policy accept;
+{% for ifname, health_conf in interface_health.items() if health_state[ifname].if_addr %}
+{%     if disable_source_nat is not vyos_defined %}
+{%         set state = health_state[ifname] %}
+        ct mark {{ state.mark }} counter snat to {{ state.if_addr }}
+{%     endif %}
+{% endfor %}
+    }
+
+    chain wlb_mangle_prerouting {
+        type filter hook prerouting priority mangle; policy accept;
+{% for ifname, health_conf in interface_health.items() %}
+{%     set state = health_state[ifname] %}
+{%     if sticky_connections is vyos_defined %}
+        iifname "{{ ifname }}" ct state new ct mark set {{ state.mark }}
+{%     endif %}
+{% endfor %}
+{% if rule is vyos_defined %}
+{%     for rule_id, rule_conf in rule.items() %}
+{%         if rule_conf.exclude is vyos_defined %}
+        {{ rule_conf | wlb_nft_rule(rule_id, exclude=True, action='accept') }}
+{%         else %}
+{%             set limit = rule_conf.limit is vyos_defined %}
+        {{ rule_conf | wlb_nft_rule(rule_id, limit=limit, weight=True, health_state=health_state) }}
+        {{ rule_conf | wlb_nft_rule(rule_id, restore_mark=True) }}
+{%         endif %}
+{%     endfor %}
+{% endif %}
+    }
+
+    chain wlb_mangle_output {
+        type filter hook output priority -150; policy accept;
+{% if enable_local_traffic is vyos_defined %}
+        meta mark != 0x0 counter accept
+        meta l4proto icmp counter accept
+        ip saddr 127.0.0.0/8 ip daddr 127.0.0.0/8 counter accept
+{%     if rule is vyos_defined %}
+{%         for rule_id, rule_conf in rule.items() %}
+{%             if rule_conf.exclude is vyos_defined  %}
+        {{ rule_conf | wlb_nft_rule(rule_id, local=True, exclude=True, action='accept') }}
+{%             else %}
+{%                 set limit = rule_conf.limit is vyos_defined %}
+        {{ rule_conf | wlb_nft_rule(rule_id, local=True, limit=limit, weight=True, health_state=health_state) }}
+        {{ rule_conf | wlb_nft_rule(rule_id, local=True, restore_mark=True) }}
+{%             endif %}
+{%         endfor %}
+{%     endif %}
+{% endif %}
+    }
+
+{% for ifname, health_conf in interface_health.items() %}
+{%     set state = health_state[ifname] %}
+    chain wlb_mangle_isp_{{ ifname }} {
+        meta mark set {{ state.mark }} ct mark set {{ state.mark }} counter accept
+    }
+{% endfor %}
+}
diff --git a/data/templates/load-balancing/wlb.conf.j2 b/data/templates/load-balancing/wlb.conf.j2
deleted file mode 100644
index 7f04d797e..000000000
--- a/data/templates/load-balancing/wlb.conf.j2
+++ /dev/null
@@ -1,134 +0,0 @@
-### Autogenerated by load-balancing_wan.py ###
-
-{% if disable_source_nat is vyos_defined %}
-disable-source-nat
-{% endif %}
-{% if enable_local_traffic is vyos_defined %}
-enable-local-traffic
-{% endif %}
-{% if sticky_connections is vyos_defined %}
-sticky-connections inbound
-{% endif %}
-{% if flush_connections is vyos_defined %}
-flush-conntrack
-{% endif %}
-{% if hook is vyos_defined %}
-hook "{{ hook }}"
-{% endif %}
-{% if interface_health is vyos_defined %}
-health {
-{%     for interface, interface_config in interface_health.items() %}
-    interface {{ interface }} {
-{%         if interface_config.failure_count is vyos_defined %}
-        failure-ct  {{ interface_config.failure_count }}
-{%         endif %}
-{%         if interface_config.success_count is vyos_defined %}
-        success-ct  {{ interface_config.success_count }}
-{%         endif %}
-{%         if interface_config.nexthop is vyos_defined %}
-        nexthop {{ interface_config.nexthop }}
-{%         endif %}
-{%         if interface_config.test is vyos_defined %}
-{%             for test_rule, test_config in interface_config.test.items() %}
-        rule {{ test_rule }} {
-{%                 if test_config.type is vyos_defined %}
-{%                     set type_translate = {'ping': 'ping', 'ttl': 'udp', 'user-defined': 'user-defined'} %}
-            type {{ type_translate[test_config.type] }} {
-{%                     if test_config.ttl_limit is vyos_defined and test_config.type == 'ttl' %}
-                ttl {{ test_config.ttl_limit }}
-{%                     endif %}
-{%                     if test_config.test_script is vyos_defined and test_config.type == 'user-defined' %}
-                test-script {{ test_config.test_script }}
-{%                     endif %}
-{%                     if test_config.target is vyos_defined %}
-                target {{ test_config.target }}
-{%                     endif %}
-                resp-time {{ test_config.resp_time | int * 1000 }}
-            }
-{%                 endif %}
-        }
-{%             endfor %}
-{%         endif %}
-    }
-{%     endfor %}
-}
-{% endif %}
-
-{% if rule is vyos_defined %}
-{%     for rule, rule_config in rule.items() %}
-rule {{ rule }} {
-{%         if rule_config.exclude is vyos_defined  %}
-    exclude
-{%         endif %}
-{%         if rule_config.failover is vyos_defined  %}
-    failover
-{%         endif %}
-{%         if rule_config.limit is vyos_defined %}
-    limit {
-{%             if rule_config.limit.burst is vyos_defined %}
-        burst {{ rule_config.limit.burst }}
-{%             endif %}
-{%             if rule_config.limit.rate is vyos_defined %}
-        rate {{ rule_config.limit.rate }}
-{%             endif %}
-{%             if rule_config.limit.period is vyos_defined %}
-        period {{ rule_config.limit.period }}
-{%             endif %}
-{%             if rule_config.limit.threshold is vyos_defined %}
-        thresh {{ rule_config.limit.threshold }}
-{%             endif %}
-        }
-{%         endif %}
-{%         if rule_config.per_packet_balancing is vyos_defined  %}
-    per-packet-balancing
-{%         endif %}
-{%         if rule_config.protocol is vyos_defined  %}
-    protocol {{ rule_config.protocol }}
-{%         endif %}
-{%         if rule_config.destination is vyos_defined %}
-    destination {
-{%             if rule_config.destination.address is vyos_defined  %}
-        address "{{ rule_config.destination.address }}"
-{%             endif %}
-{%             if rule_config.destination.port is vyos_defined  %}
-{%                 if '-' in rule_config.destination.port %}
-        port-ipt "-m multiport  --dports {{ rule_config.destination.port | replace('-', ':') }}"
-{%                 elif ',' in rule_config.destination.port %}
-        port-ipt "-m multiport  --dports {{ rule_config.destination.port }}"
-{%                 else %}
-        port-ipt " --dport {{ rule_config.destination.port }}"
-{%                 endif %}
-{%             endif %}
-    }
-{%         endif %}
-{%         if rule_config.source is vyos_defined %}
-    source {
-{%             if rule_config.source.address is vyos_defined  %}
-        address "{{ rule_config.source.address }}"
-{%             endif %}
-{%             if rule_config.source.port is vyos_defined  %}
-{%                 if '-' in rule_config.source.port %}
-        port-ipt "-m multiport  --sports {{ rule_config.source.port | replace('-', ':') }}"
-{%                 elif ',' in rule_config.destination.port %}
-        port-ipt "-m multiport  --sports {{ rule_config.source.port }}"
-{%                 else %}
-        port.ipt " --sport {{ rule_config.source.port }}"
-{%                 endif %}
-{%             endif %}
-    }
-{%         endif %}
-{%         if rule_config.inbound_interface is vyos_defined  %}
-    inbound-interface {{ rule_config.inbound_interface }}
-{%         endif %}
-{%         if rule_config.interface is vyos_defined  %}
-{%             for interface, interface_config in rule_config.interface.items() %}
-    interface {{ interface }} {
-{%                 if interface_config.weight is vyos_defined %}
-        weight {{ interface_config.weight }}
-{%                 endif %}
-    }
-{%             endfor %}
-{%         endif %}
-}
-{%     endfor %}
-{% endif %}