Merge pull request #779 from c-po/isis-vrf

ISIS: add VRF support

3 files changed, 218 insertions, 106 deletions

diff --git a/src/conf_mode/protocols_isis.py b/src/conf_mode/protocols_isis.py
index b7afad473..bcd9960ed 100755
--- a/src/conf_mode/protocols_isis.py
+++ b/src/conf_mode/protocols_isis.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020 VyOS maintainers and contributors
+# Copyright (C) 2020-2021 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -17,143 +17,197 @@
 import os
 
 from sys import exit
+from sys import argv
 
 from vyos.config import Config
+from vyos.configdict import dict_merge
 from vyos.configdict import node_changed
-from vyos import ConfigError
+from vyos.configverify import verify_interface_exists
 from vyos.util import call
 from vyos.util import dict_search
-from vyos.template import render
+from vyos.util import get_interface_config
 from vyos.template import render_to_string
+from vyos import ConfigError
 from vyos import frr
 from vyos import airbag
 airbag.enable()
 
+frr_daemon = 'isisd'
+
 def get_config(config=None):
     if config:
         conf = config
     else:
         conf = Config()
-    base = ['protocols', 'isis']
 
-    isis = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+    vrf = None
+    if len(argv) > 1:
+        vrf = argv[1]
+
+    base_path = ['protocols', 'isis']
+
+    # eqivalent of the C foo ? 'a' : 'b' statement
+    base = vrf and ['vrf', 'name', vrf, 'protocols', 'isis'] or base_path
+    isis = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                get_first_key=True)
+
+    # Assign the name of our VRF context. This MUST be done before the return
+    # statement below, else on deletion we will delete the default instance
+    # instead of the VRF instance.
+    if vrf: isis['vrf'] = vrf
+
+    # As we no re-use this Python handler for both VRF and non VRF instances for
+    # IS-IS we need to find out if any interfaces changed so properly adjust
+    # the FRR configuration and not by acctident change interfaces from a
+    # different VRF.
+    interfaces_removed = node_changed(conf, base + ['interface'])
+    if interfaces_removed:
+        isis['interface_removed'] = list(interfaces_removed)
+
+    # Bail out early if configuration tree does not exist
+    if not conf.exists(base):
+        isis.update({'deleted' : ''})
+        return isis
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify()
+    base = ['policy']
+    tmp = conf.get_config_dict(base, key_mangling=('-', '_'))
+    # Merge policy dict into OSPF dict
+    isis = dict_merge(tmp, isis)
 
     return isis
 
 def verify(isis):
     # bail out early - looks like removal from running config
-    if not isis:
+    if not isis or 'deleted' in isis:
         return None
 
-    for process, isis_config in isis.items():
-        # If more then one isis process is defined (Frr only supports one)
-        # http://docs.frrouting.org/en/latest/isisd.html#isis-router
-        if len(isis) > 1:
-            raise ConfigError('Only one isis process can be defined')
-
-        # If network entity title (net) not defined
-        if 'net' not in isis_config:
-            raise ConfigError('ISIS net format iso is mandatory!')
-
-        # If interface not set
-        if 'interface' not in isis_config:
-            raise ConfigError('ISIS interface is mandatory!')
-
-        # If md5 and plaintext-password set at the same time
-        if 'area_password' in isis_config:
-            if {'md5', 'plaintext_password'} <= set(isis_config['encryption']):
-                raise ConfigError('Can not use both md5 and plaintext-password for ISIS area-password!')
-
-        # If one param from delay set, but not set others
-        if 'spf_delay_ietf' in isis_config:
-            required_timers = ['holddown', 'init_delay', 'long_delay', 'short_delay', 'time_to_learn']
-            exist_timers = []
-            for elm_timer in required_timers:
-                if elm_timer in isis_config['spf_delay_ietf']:
-                    exist_timers.append(elm_timer)
-
-            exist_timers = set(required_timers).difference(set(exist_timers))
-            if len(exist_timers) > 0:
-                raise ConfigError('All types of delay must be specified: ' + ', '.join(exist_timers).replace('_', '-'))
-
-        # If Redistribute set, but level don't set
-        if 'redistribute' in isis_config:
-            proc_level = isis_config.get('level','').replace('-','_')
-            for proto, proto_config in isis_config.get('redistribute', {}).get('ipv4', {}).items():
+    if 'net' not in isis:
+        raise ConfigError('Network entity is mandatory!')
+
+    # last byte in IS-IS area address must be 0
+    tmp = isis['net'].split('.')
+    if int(tmp[-1]) != 0:
+        raise ConfigError('Last byte of IS-IS network entity title must always be 0!')
+
+    # If interface not set
+    if 'interface' not in isis:
+        raise ConfigError('Interface used for routing updates is mandatory!')
+
+    for interface in isis['interface']:
+        verify_interface_exists(interface)
+        if 'vrf' in isis:
+            # If interface specific options are set, we must ensure that the
+            # interface is bound to our requesting VRF. Due to the VyOS
+            # priorities the interface is bound to the VRF after creation of
+            # the VRF itself, and before any routing protocol is configured.
+            vrf = isis['vrf']
+            tmp = get_interface_config(interface)
+            if 'master' not in tmp or tmp['master'] != vrf:
+                raise ConfigError(f'Interface {interface} is not a member of VRF {vrf}!')
+
+    # If md5 and plaintext-password set at the same time
+    if 'area_password' in isis:
+        if {'md5', 'plaintext_password'} <= set(isis['encryption']):
+            raise ConfigError('Can not use both md5 and plaintext-password for ISIS area-password!')
+
+    # If one param from delay set, but not set others
+    if 'spf_delay_ietf' in isis:
+        required_timers = ['holddown', 'init_delay', 'long_delay', 'short_delay', 'time_to_learn']
+        exist_timers = []
+        for elm_timer in required_timers:
+            if elm_timer in isis['spf_delay_ietf']:
+                exist_timers.append(elm_timer)
+
+        exist_timers = set(required_timers).difference(set(exist_timers))
+        if len(exist_timers) > 0:
+            raise ConfigError('All types of delay must be specified: ' + ', '.join(exist_timers).replace('_', '-'))
+
+    # If Redistribute set, but level don't set
+    if 'redistribute' in isis:
+        proc_level = isis.get('level','').replace('-','_')
+        for afi in ['ipv4']:
+            if afi not in isis['redistribute']:
+                continue
+
+            for proto, proto_config in isis['redistribute'][afi].items():
                 if 'level_1' not in proto_config and 'level_2' not in proto_config:
-                    raise ConfigError('Redistribute level-1 or level-2 should be specified in \"protocols isis {} redistribute ipv4 {}\"'.format(process, proto))
-            for redistribute_level in proto_config.keys():
-                if proc_level and proc_level != 'level_1_2' and proc_level != redistribute_level:
-                    raise ConfigError('\"protocols isis {0} redistribute ipv4 {2} {3}\" cannot be used with \"protocols isis {0} level {1}\"'.format(process, proc_level, proto, redistribute_level))
-
-        # Segment routing checks
-        if dict_search('segment_routing', isis_config):
-            if dict_search('segment_routing.global_block', isis_config):
-                high_label_value = dict_search('segment_routing.global_block.high_label_value', isis_config)
-                low_label_value = dict_search('segment_routing.global_block.low_label_value', isis_config)
-                # If segment routing global block high value is blank, throw error
-                if low_label_value and not high_label_value:
-                    raise ConfigError('Segment routing global block high value must not be left blank')
-                # If segment routing global block low value is blank, throw error
-                if high_label_value and not low_label_value:
-                    raise ConfigError('Segment routing global block low value must not be left blank')
-                # If segment routing global block low value is higher than the high value, throw error
-                if int(low_label_value) > int(high_label_value):
-                    raise ConfigError('Segment routing global block low value must be lower than high value')
-                
-            if dict_search('segment_routing.local_block', isis_config):
-                high_label_value = dict_search('segment_routing.local_block.high_label_value', isis_config)
-                low_label_value = dict_search('segment_routing.local_block.low_label_value', isis_config)
-                # If segment routing local block high value is blank, throw error
-                if low_label_value and not high_label_value:
-                    raise ConfigError('Segment routing local block high value must not be left blank')
-                # If segment routing local block low value is blank, throw error
-                if high_label_value and not low_label_value:
-                    raise ConfigError('Segment routing local block low value must not be left blank')
-                # If segment routing local block low value is higher than the high value, throw error
-                if int(low_label_value) > int(high_label_value):
-                    raise ConfigError('Segment routing local block low value must be lower than high value')
+                    raise ConfigError(f'Redistribute level-1 or level-2 should be specified in ' \
+                                      f'"protocols isis {process} redistribute {afi} {proto}"!')
+
+                for redistr_level, redistr_config in proto_config.items():
+                    if proc_level and proc_level != 'level_1_2' and proc_level != redistr_level:
+                        raise ConfigError(f'"protocols isis {process} redistribute {afi} {proto} {redistr_level}" ' \
+                                          f'can not be used with \"protocols isis {process} level {proc_level}\"')
+
+                    if 'route_map' in redistr_config:
+                        name = redistr_config['route_map']
+                        tmp = name.replace('-', '_')
+                        if dict_search(f'policy.route_map.{tmp}', isis) == None:
+                            raise ConfigError(f'Route-map {name} does not exist!')
+
+    # Segment routing checks
+    if dict_search('segment_routing.global_block', isis):
+        high_label_value = dict_search('segment_routing.global_block.high_label_value', isis)
+        low_label_value = dict_search('segment_routing.global_block.low_label_value', isis)
+
+        # If segment routing global block high value is blank, throw error
+        if (low_label_value and not high_label_value) or (high_label_value and not low_label_value):
+            raise ConfigError('Segment routing global block requires both low and high value!')
+
+        # If segment routing global block low value is higher than the high value, throw error
+        if int(low_label_value) > int(high_label_value):
+            raise ConfigError('Segment routing global block low value must be lower than high value')
+
+    if dict_search('segment_routing.local_block', isis):
+        high_label_value = dict_search('segment_routing.local_block.high_label_value', isis)
+        low_label_value = dict_search('segment_routing.local_block.low_label_value', isis)
+
+        # If segment routing local block high value is blank, throw error
+        if (low_label_value and not high_label_value) or (high_label_value and not low_label_value):
+            raise ConfigError('Segment routing local block requires both high and low value!')
+
+        # If segment routing local block low value is higher than the high value, throw error
+        if int(low_label_value) > int(high_label_value):
+            raise ConfigError('Segment routing local block low value must be lower than high value')
 
     return None
 
 def generate(isis):
-    if not isis:
+    if not isis or 'deleted' in isis:
         isis['new_frr_config'] = ''
         return None
 
-    # only one ISIS process is supported, so we can directly send the first key
-    # of the config dict
-    process = list(isis.keys())[0]
-    isis[process]['process'] = process
-
-    isis['new_frr_config'] = render_to_string('frr/isis.frr.tmpl',
-                                              isis[process])
-
+    isis['new_frr_config'] = render_to_string('frr/isis.frr.tmpl', isis)
     return None
 
 def apply(isis):
     # Save original configuration prior to starting any commit actions
     frr_cfg = frr.FRRConfig()
-    frr_cfg.load_configuration(daemon='isisd')
-    frr_cfg.modify_section(r'interface \S+', '')
-    frr_cfg.modify_section(f'router isis \S+', '')
+    frr_cfg.load_configuration(frr_daemon)
+
+    # Generate empty helper string which can be ammended to FRR commands,
+    # it will be either empty (default VRF) or contain the "vrf <name" statement
+    vrf = ''
+    if 'vrf' in isis:
+        vrf = 'vrf ' + isis['vrf']
+
+    frr_cfg.modify_section(f'^router isis VyOS {vrf}', '')
+    for key in ['interface', 'interface_removed']:
+        if key not in isis:
+            continue
+        for interface in isis[key]:
+            frr_cfg.modify_section(f'^interface {interface}{vrf}$', '')
+
     frr_cfg.add_before(r'(ip prefix-list .*|route-map .*|line vty)', isis['new_frr_config'])
-    frr_cfg.commit_configuration(daemon='isisd')
+    frr_cfg.commit_configuration(frr_daemon)
 
     # If FRR config is blank, rerun the blank commit x times due to frr-reload
     # behavior/bug not properly clearing out on one commit.
     if isis['new_frr_config'] == '':
         for a in range(5):
-            frr_cfg.commit_configuration(daemon='isisd')
-
-    # Debugging
-    '''
-    print('')
-    print('--------- DEBUGGING ----------')
-    print(f'Existing config:\n{frr_cfg["original_config"]}\n\n')
-    print(f'Replacement config:\n{isis["new_frr_config"]}\n\n')
-    print(f'Modified config:\n{frr_cfg["modified_config"]}\n\n')
-   '''
+            frr_cfg.commit_configuration(frr_daemon)
 
     return None
 
diff --git a/src/conf_mode/protocols_ospf.py b/src/conf_mode/protocols_ospf.py
index 08347aa52..a655eaeca 100755
--- a/src/conf_mode/protocols_ospf.py
+++ b/src/conf_mode/protocols_ospf.py
@@ -154,11 +154,10 @@ def verify(ospf):
                                   f'concurrently for {interface}!')
 
             if 'vrf' in ospf:
-                # If interface specific options are set, we must ensure that
-                # the interface is bound to our requesting VRF. Due to the VyOS
-                # priorities the interface is bound to the VRF after creation
-                # of the VRF itself, and before any routing protocol is
-                # configured.
+            # If interface specific options are set, we must ensure that the
+            # interface is bound to our requesting VRF. Due to the VyOS
+            # priorities the interface is bound to the VRF after creation of
+            # the VRF itself, and before any routing protocol is configured.
                 vrf = ospf['vrf']
                 tmp = get_interface_config(interface)
                 if 'master' not in tmp or tmp['master'] != vrf:
@@ -179,17 +178,18 @@ def apply(ospf):
     frr_cfg = frr.FRRConfig()
     frr_cfg.load_configuration(frr_daemon)
 
+    # Generate empty helper string which can be ammended to FRR commands,
+    # it will be either empty (default VRF) or contain the "vrf <name" statement
+    vrf = ''
     if 'vrf' in ospf:
-        vrf = ospf['vrf']
-        frr_cfg.modify_section(f'^router ospf vrf {vrf}$', '')
-    else:
-        frr_cfg.modify_section('^router ospf$', '')
+        vrf = ' vrf ' + ospf['vrf']
 
+    frr_cfg.modify_section(f'^router ospf{vrf}$', '')
     for key in ['interface', 'interface_removed']:
         if key not in ospf:
             continue
         for interface in ospf[key]:
-            frr_cfg.modify_section(f'^interface {interface}$', '')
+            frr_cfg.modify_section(f'^interface {interface}{vrf}$', '')
 
     frr_cfg.add_before(r'(ip prefix-list .*|route-map .*|line vty)', ospf['new_frr_config'])
     frr_cfg.commit_configuration(frr_daemon)
diff --git a/src/migration-scripts/isis/0-to-1 b/src/migration-scripts/isis/0-to-1
new file mode 100755
index 000000000..6773f4009
--- /dev/null
+++ b/src/migration-scripts/isis/0-to-1
@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# T3417: migrate IS-IS tagNode to node as we can only have one IS-IS process
+
+from sys import argv
+from sys import exit
+
+from vyos.configtree import ConfigTree
+
+if (len(argv) < 1):
+    print("Must specify file name!")
+    exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+base = ['protocols', 'isis']
+config = ConfigTree(config_file)
+
+if not config.exists(base):
+    # Nothing to do
+    exit(0)
+
+# Only one IS-IS process is supported, thus this operation is save
+isis_base = base + config.list_nodes(base)
+
+# We need a temporary copy of the config
+tmp_base = ['protocols', 'isis2']
+config.copy(isis_base, tmp_base)
+
+# Now it's save to delete the old configuration
+config.delete(base)
+
+# Rename temporary copy to new final config and set domain key
+config.rename(tmp_base, 'isis')
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    sys.exit(1)