summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--data/templates/firewall/nftables-nat66.tmpl17
-rw-r--r--data/templates/frr/bgp.frr.tmpl27
-rw-r--r--interface-definitions/include/bgp-afi-maximum-paths.xml.i51
-rw-r--r--interface-definitions/nat66.xml.in19
-rw-r--r--interface-definitions/protocols-bgp.xml.in31
-rw-r--r--smoketest/configs/bgp-big-as-cloud4
-rwxr-xr-xsmoketest/scripts/cli/test_nat66.py35
-rwxr-xr-xsmoketest/scripts/cli/test_protocols_bgp.py8
-rwxr-xr-xsrc/conf_mode/nat66.py9
-rwxr-xr-xsrc/migration-scripts/nat66/0-to-12
-rwxr-xr-xsrc/migration-scripts/quagga/8-to-961
11 files changed, 169 insertions, 95 deletions
diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.tmpl
index b1a8f7a16..cdaeaad6a 100644
--- a/data/templates/firewall/nftables-nat66.tmpl
+++ b/data/templates/firewall/nftables-nat66.tmpl
@@ -13,8 +13,20 @@
{% endif %}
{% set trns_address = dnat_type + config.translation.address if config.translation is defined and config.translation.address is defined and config.translation.address is not none %}
{% elif chain == "POSTROUTING" %}
+{% if config.translation is defined and config.translation.address is defined and config.translation.address is not none %}
+{% if config.translation.address == 'masquerade' %}
+{% set trns_address = config.translation.address %}
+{% else %}
+{% if config.translation.address | is_ip_network %}
+{# support 1:1 network translation #}
+{% set snat_type = "snat prefix to " %}
+{% else %}
+{% set snat_type = "snat to " %}
+{% endif %}
+{% set trns_address = snat_type + config.translation.address %}
+{% endif %}
+{% endif %}
{% set interface = " oifname \"" + config.outbound_interface + "\"" if config.outbound_interface is defined else '' %}
-{% set trns_prefix = "snat prefix to " + config.translation.prefix if config.translation is defined and config.translation.prefix is defined and config.translation.prefix is not none %}
{% endif %}
{% set comment = "NPT-NAT-" + rule %}
{% if rule.log %}
@@ -35,9 +47,6 @@
{% if dest_address %}
{% set output = output + " " + dest_address %}
{% endif %}
-{% if trns_prefix %}
-{% set output = output + " " + trns_prefix %}
-{% endif %}
{% if trns_address %}
{% set output = output + " " + trns_address %}
{% endif %}
diff --git a/data/templates/frr/bgp.frr.tmpl b/data/templates/frr/bgp.frr.tmpl
index b7abbff5c..3101de7ea 100644
--- a/data/templates/frr/bgp.frr.tmpl
+++ b/data/templates/frr/bgp.frr.tmpl
@@ -208,11 +208,11 @@ router bgp {{ asn }}
aggregate-address {{ ip }}{{ ' as-set' if afi_config.aggregate_address[ip].as_set is defined }}{{ ' summary-only' if afi_config.aggregate_address[ip].summary_only is defined }}
{% endfor %}
{% endif %}
-{% if afi_config.maximum_paths is defined and afi_config.maximum_paths is not none %}
- maximum-paths {{ afi_config.maximum_paths }}
+{% if afi_config.maximum_paths is defined and afi_config.maximum_paths.ebgp is defined and afi_config.maximum_paths.ebgp is not none %}
+ maximum-paths {{ afi_config.maximum_paths.ebgp }}
{% endif %}
-{% if afi_config.maximum_paths_ibgp is defined and afi_config.maximum_paths_ibgp is not none %}
- maximum-paths ibgp {{ afi_config.maximum_paths_ibgp }}
+{% if afi_config.maximum_paths is defined and afi_config.maximum_paths.ibgp is defined and afi_config.maximum_paths.ibgp is not none %}
+ maximum-paths ibgp {{ afi_config.maximum_paths.ibgp }}
{% endif %}
{% if afi_config.redistribute is defined and afi_config.redistribute is not none %}
{% for protocol in afi_config.redistribute %}
@@ -287,25 +287,6 @@ router bgp {{ asn }}
{% endfor %}
{% endif %}
!
-{# set protocols bgp xxxx maximum-paths ibgp x, Generated by default for afi_4 #}
-{# We don't have this parameter in afi_6. But this is supported in FRR #}
-{% if maximum_paths is defined and maximum_paths is not none %}
-{% if maximum_paths.ebgp is defined and maximum_paths.ebgp is not none %}
- !
- address-family ipv4 unicast
- maximum-paths {{ maximum_paths.ebgp }}
- exit-address-family
- !
-{% endif %}
-{% if maximum_paths.ibgp is defined and maximum_paths.ibgp is not none %}
- !
- address-family ipv4 unicast
- maximum-paths ibgp {{ maximum_paths.ibgp }}
- exit-address-family
- !
-{% endif %}
-{% endif %}
- !
{% if peer_group is defined and peer_group is not none %}
{% for peer, config in peer_group.items() %}
{{ bgp_neighbor(peer, config, true) }}
diff --git a/interface-definitions/include/bgp-afi-maximum-paths.xml.i b/interface-definitions/include/bgp-afi-maximum-paths.xml.i
index 5ee0d13a3..62133c375 100644
--- a/interface-definitions/include/bgp-afi-maximum-paths.xml.i
+++ b/interface-definitions/include/bgp-afi-maximum-paths.xml.i
@@ -1,26 +1,33 @@
<!-- included start from bgp-afi-maximum-paths.xml.i -->
-<leafNode name="maximum-paths">
+<node name="maximum-paths">
<properties>
- <help>Forward packets over multiple paths (eBGP)</help>
- <valueHelp>
- <format>u32:1-256</format>
- <description>Number of paths to consider</description>
- </valueHelp>
- <constraint>
- <validator name="numeric" argument="--range 1-256"/>
- </constraint>
+ <help>Forward packets over multiple paths</help>
</properties>
-</leafNode>
-<leafNode name="maximum-paths-ibgp">
- <properties>
- <help>Forward packets over multiple paths (iBGP)</help>
- <valueHelp>
- <format>u32:1-256</format>
- <description>Number of paths to consider</description>
- </valueHelp>
- <constraint>
- <validator name="numeric" argument="--range 1-256"/>
- </constraint>
- </properties>
-</leafNode>
+ <children>
+ <leafNode name="ebgp">
+ <properties>
+ <help>eBGP maximum paths</help>
+ <valueHelp>
+ <format>u32:1-256</format>
+ <description>Number of paths to consider</description>
+ </valueHelp>
+ <constraint>
+ <validator name="numeric" argument="--range 1-256"/>
+ </constraint>
+ </properties>
+ </leafNode>
+ <leafNode name="ibgp">
+ <properties>
+ <help>iBGP maximum paths</help>
+ <valueHelp>
+ <format>u32:1-256</format>
+ <description>Number of paths to consider</description>
+ </valueHelp>
+ <constraint>
+ <validator name="numeric" argument="--range 1-256"/>
+ </constraint>
+ </properties>
+ </leafNode>
+ </children>
+</node>
<!-- included end -->
diff --git a/interface-definitions/nat66.xml.in b/interface-definitions/nat66.xml.in
index b45ebc0a8..d5e1226f9 100644
--- a/interface-definitions/nat66.xml.in
+++ b/interface-definitions/nat66.xml.in
@@ -70,18 +70,31 @@
</node>
<node name="translation">
<properties>
- <help>Translated IPv6 prefix options</help>
+ <help>Translated IPv6 address options</help>
</properties>
<children>
- <leafNode name="prefix">
+ <leafNode name="address">
<properties>
- <help>IPv6 prefix to translate to</help>
+ <help>IPv6 address to translate to</help>
+ <completionHelp>
+ <list>masquerade</list>
+ </completionHelp>
+ <valueHelp>
+ <format>ipv6</format>
+ <description>IPv6 address</description>
+ </valueHelp>
<valueHelp>
<format>ipv6net</format>
<description>IPv6 prefix</description>
</valueHelp>
+ <valueHelp>
+ <format>masquerade</format>
+ <description>NAT to the primary address of outbound-interface</description>
+ </valueHelp>
<constraint>
+ <validator name="ipv6-address"/>
<validator name="ipv6-prefix"/>
+ <regex>(masquerade)</regex>
</constraint>
</properties>
</leafNode>
diff --git a/interface-definitions/protocols-bgp.xml.in b/interface-definitions/protocols-bgp.xml.in
index c2a123313..96a0b1315 100644
--- a/interface-definitions/protocols-bgp.xml.in
+++ b/interface-definitions/protocols-bgp.xml.in
@@ -350,37 +350,6 @@
</node>
</children>
</node>
- <node name="maximum-paths">
- <properties>
- <help>BGP multipaths</help>
- </properties>
- <children>
- <leafNode name="ebgp">
- <properties>
- <help>Maximum ebgp multipaths</help>
- <valueHelp>
- <format>u32:1-255</format>
- <description>EBGP multipaths</description>
- </valueHelp>
- <constraint>
- <validator name="numeric" argument="--range 1-255"/>
- </constraint>
- </properties>
- </leafNode>
- <leafNode name="ibgp">
- <properties>
- <help>Maximum ibgp multipaths</help>
- <valueHelp>
- <format>u32:1-255</format>
- <description>EBGP multipaths</description>
- </valueHelp>
- <constraint>
- <validator name="numeric" argument="--range 1-255"/>
- </constraint>
- </properties>
- </leafNode>
- </children>
- </node>
<node name="listen">
<properties>
<help>Listen for and accept BGP dynamic neighbors from range</help>
diff --git a/smoketest/configs/bgp-big-as-cloud b/smoketest/configs/bgp-big-as-cloud
index df3ae015c..694243d1e 100644
--- a/smoketest/configs/bgp-big-as-cloud
+++ b/smoketest/configs/bgp-big-as-cloud
@@ -1186,6 +1186,10 @@ protocols {
}
}
}
+ maximum-paths {
+ ebgp 8
+ ibgp 16
+ }
neighbor 192.0.16.209 {
address-family {
ipv4-unicast {
diff --git a/smoketest/scripts/cli/test_nat66.py b/smoketest/scripts/cli/test_nat66.py
index ccc4196e0..4838fb8d8 100755
--- a/smoketest/scripts/cli/test_nat66.py
+++ b/smoketest/scripts/cli/test_nat66.py
@@ -44,7 +44,7 @@ class TestNAT66(unittest.TestCase):
translation_prefix = 'fc01::/64'
self.session.set(src_path + ['rule', '1', 'outbound-interface', 'eth1'])
self.session.set(src_path + ['rule', '1', 'source', 'prefix', source_prefix])
- self.session.set(src_path + ['rule', '1', 'translation', 'prefix', translation_prefix])
+ self.session.set(src_path + ['rule', '1', 'translation', 'address', translation_prefix])
# check validate() - outbound-interface must be defined
self.session.commit()
@@ -70,6 +70,36 @@ class TestNAT66(unittest.TestCase):
self.assertEqual(f'{translation_address}/{translation_mask}', translation_prefix)
self.assertEqual(f'{address}/{mask}', source_prefix)
+ def test_source_nat66_address(self):
+ source_prefix = 'fc00::/64'
+ translation_address = 'fc00::1'
+ self.session.set(src_path + ['rule', '1', 'outbound-interface', 'eth1'])
+ self.session.set(src_path + ['rule', '1', 'source', 'prefix', source_prefix])
+ self.session.set(src_path + ['rule', '1', 'translation', 'address', translation_address])
+
+ # check validate() - outbound-interface must be defined
+ self.session.commit()
+
+ tmp = cmd('sudo nft -j list table ip6 nat')
+ data_json = jmespath.search('nftables[?rule].rule[?chain]', json.loads(tmp))
+
+ for idx in range(0, len(data_json)):
+ data = data_json[idx]
+
+ self.assertEqual(data['chain'], 'POSTROUTING')
+ self.assertEqual(data['family'], 'ip6')
+ self.assertEqual(data['table'], 'nat')
+
+ iface = dict_search('match.right', data['expr'][0])
+ address = dict_search('match.right.prefix.addr', data['expr'][2])
+ mask = dict_search('match.right.prefix.len', data['expr'][2])
+ snat_address = dict_search('snat.addr', data['expr'][3])
+
+ self.assertEqual(iface, 'eth1')
+ # check for translation address
+ self.assertEqual(snat_address, translation_address)
+ self.assertEqual(f'{address}/{mask}', source_prefix)
+
def test_destination_nat66(self):
destination_address = 'fc00::1'
translation_address = 'fc01::1'
@@ -127,7 +157,6 @@ class TestNAT66(unittest.TestCase):
# T2813: Ensure translation address is specified
rule = '5'
source_prefix = 'fc00::/64'
- translation_prefix = 'fc00:2::/64'
self.session.set(src_path + ['rule', rule, 'source', 'prefix', source_prefix])
# check validate() - outbound-interface must be defined
@@ -139,7 +168,7 @@ class TestNAT66(unittest.TestCase):
with self.assertRaises(ConfigSessionError):
self.session.commit()
- self.session.set(src_path + ['rule', rule, 'translation', 'prefix', translation_prefix])
+ self.session.set(src_path + ['rule', rule, 'translation', 'address', 'masquerade'])
self.session.commit()
def test_nat66_no_rules(self):
diff --git a/smoketest/scripts/cli/test_protocols_bgp.py b/smoketest/scripts/cli/test_protocols_bgp.py
index f22b47551..9aa1541cf 100755
--- a/smoketest/scripts/cli/test_protocols_bgp.py
+++ b/smoketest/scripts/cli/test_protocols_bgp.py
@@ -237,10 +237,10 @@ class TestProtocolsBGP(unittest.TestCase):
self.session.set(base_path + ['parameters', 'ebgp-requires-policy'])
# AFI maximum path support
- self.session.set(base_path + ['address-family', 'ipv4-unicast', 'maximum-paths', max_path_v4])
- self.session.set(base_path + ['address-family', 'ipv4-unicast', 'maximum-paths-ibgp', max_path_v4ibgp])
- self.session.set(base_path + ['address-family', 'ipv6-unicast', 'maximum-paths', max_path_v6])
- self.session.set(base_path + ['address-family', 'ipv6-unicast', 'maximum-paths-ibgp', max_path_v6ibgp])
+ self.session.set(base_path + ['address-family', 'ipv4-unicast', 'maximum-paths', 'ebgp', max_path_v4])
+ self.session.set(base_path + ['address-family', 'ipv4-unicast', 'maximum-paths', 'ibgp', max_path_v4ibgp])
+ self.session.set(base_path + ['address-family', 'ipv6-unicast', 'maximum-paths', 'ebgp', max_path_v6])
+ self.session.set(base_path + ['address-family', 'ipv6-unicast', 'maximum-paths', 'ibgp', max_path_v6ibgp])
# commit changes
self.session.commit()
diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py
index dc3cd550c..ce1db316c 100755
--- a/src/conf_mode/nat66.py
+++ b/src/conf_mode/nat66.py
@@ -28,6 +28,7 @@ from vyos.util import cmd
from vyos.util import check_kmod
from vyos.util import dict_search
from vyos.template import is_ipv6
+from vyos.template import is_ip_network
from vyos.xml import defaults
from vyos import ConfigError
from vyos import airbag
@@ -116,10 +117,10 @@ def verify(nat):
if config['outbound_interface'] not in interfaces():
print(f'WARNING: rule "{rule}" interface "{config["outbound_interface"]}" does not exist on this system')
- prefix = dict_search('translation.prefix', config)
- if prefix != None:
- if not is_ipv6(prefix):
- raise ConfigError(f'Warning: IPv6 prefix {prefix} is not a valid address prefix')
+ addr = dict_search('translation.address', config)
+ if addr != None:
+ if addr != 'masquerade' and not is_ipv6(addr):
+ raise ConfigError(f'Warning: IPv6 address {addr} is not a valid address')
prefix = dict_search('source.prefix', config)
if prefix != None:
diff --git a/src/migration-scripts/nat66/0-to-1 b/src/migration-scripts/nat66/0-to-1
index 74d64c07b..83b421926 100755
--- a/src/migration-scripts/nat66/0-to-1
+++ b/src/migration-scripts/nat66/0-to-1
@@ -49,7 +49,7 @@ def merge_npt(config,base,rule):
if config.exists(base + ['translation','prefix']):
tmp = config.return_value(base + ['translation','prefix'])
- config.set(merge_base + ['translation','prefix'],value=tmp)
+ config.set(merge_base + ['translation','address'],value=tmp)
if not config.exists(['nat', 'nptv6']):
# Nothing to do
diff --git a/src/migration-scripts/quagga/8-to-9 b/src/migration-scripts/quagga/8-to-9
new file mode 100755
index 000000000..15c44924f
--- /dev/null
+++ b/src/migration-scripts/quagga/8-to-9
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+# - T3391: Migrate "maximum-paths" setting from "protocols bgp asn maximum-paths"
+# under the IPv4 address-family tree. Reason is we currently have no way in
+# configuring this for IPv6 address-family. This mimics the FRR configuration.
+
+from sys import argv
+from sys import exit
+from vyos.configtree import ConfigTree
+
+if (len(argv) < 2):
+ print("Must specify file name!")
+ exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+ config_file = f.read()
+
+base = ['protocols', 'bgp']
+config = ConfigTree(config_file)
+
+if not config.exists(base):
+ # Nothing to do
+ exit(0)
+
+# Check if BGP is actually configured and obtain the ASN
+asn_list = config.list_nodes(base)
+if asn_list:
+ # There's always just one BGP node, if any
+ bgp_base = base + [asn_list[0]]
+
+ maximum_paths = bgp_base + ['maximum-paths']
+ if config.exists(maximum_paths):
+ for bgp_type in ['ebgp', 'ibgp']:
+ if config.exists(maximum_paths + [bgp_type]):
+ new_base = bgp_base + ['address-family', 'ipv4-unicast', 'maximum-paths']
+ config.set(new_base)
+ config.copy(maximum_paths + [bgp_type], new_base + [bgp_type])
+ config.delete(maximum_paths)
+
+try:
+ with open(file_name, 'w') as f:
+ f.write(config.to_string())
+except OSError as e:
+ print("Failed to save the modified config: {}".format(e))
+ exit(1)
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-24 13:41:02 +0000