From 7606fa6081e2f6d76982056ca93003e6c5dbd685 Mon Sep 17 00:00:00 2001 From: sever-sever Date: Tue, 17 Nov 2020 15:14:42 +0000 Subject: policy-conf: T439: Add policy local-route PBR --- Makefile | 1 + data/configd-include.json | 1 + interface-definitions/policy-local-route.xml.in | 67 ++++++++++++++ smoketest/scripts/cli/test_policy_local-route.py | 61 +++++++++++++ src/conf_mode/policy-local-route.py | 110 +++++++++++++++++++++++ 5 files changed, 240 insertions(+) create mode 100644 interface-definitions/policy-local-route.xml.in create mode 100755 smoketest/scripts/cli/test_policy_local-route.py create mode 100755 src/conf_mode/policy-local-route.py diff --git a/Makefile b/Makefile index fffd1c9c3..662b1b1e2 100644 --- a/Makefile +++ b/Makefile @@ -80,6 +80,7 @@ interface_definitions: $(BUILD_DIR) $(obj) rm -rf $(TMPL_DIR)/protocols/nbgp rm -rf $(TMPL_DIR)/protocols/isis rm -f $(TMPL_DIR)/protocols/static/node.def + rm -f $(TMPL_DIR)/policy/node.def rm -f $(TMPL_DIR)/system/node.def rm -f $(TMPL_DIR)/vpn/node.def rm -f $(TMPL_DIR)/vpn/ipsec/node.def diff --git a/data/configd-include.json b/data/configd-include.json index 2e44405ee..346e98838 100644 --- a/data/configd-include.json +++ b/data/configd-include.json @@ -29,6 +29,7 @@ "lldp.py", "nat.py", "ntp.py", +"policy-local-route.py", "protocols_igmp.py", "protocols_isis.py", "protocols_mpls.py", diff --git a/interface-definitions/policy-local-route.xml.in b/interface-definitions/policy-local-route.xml.in new file mode 100644 index 000000000..5536c71c8 --- /dev/null +++ b/interface-definitions/policy-local-route.xml.in @@ -0,0 +1,67 @@ + + + + + + + + IPv4 policy route of local traffic + + + + + Policy local-route rule set number + + + <1-32765> + Local-route rule number (1-219) + + + + + + + + + Packet modifications + + + + + Routing table to forward packet with + + <1-200> + Table number + + + main + + + + + + + + Source address or prefix + + ipv4 + Address to match against + + + ipv4net + Prefix to match against + + + + + + + + + + + + + + + diff --git a/smoketest/scripts/cli/test_policy_local-route.py b/smoketest/scripts/cli/test_policy_local-route.py new file mode 100755 index 000000000..490bf6b47 --- /dev/null +++ b/smoketest/scripts/cli/test_policy_local-route.py @@ -0,0 +1,61 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import os +import unittest + +from vyos.configsession import ConfigSession +from vyos.configsession import ConfigSessionError +from vyos.util import cmd +from vyos.util import process_named_running + +class PolicyLocalRouteTest(unittest.TestCase): + def setUp(self): + self.session = ConfigSession(os.getpid()) + self._sources = ['203.0.113.1', '203.0.113.2'] + + def tearDown(self): + # Delete all policies + self.session.delete(['policy', 'local-route']) + self.session.commit() + del self.session + + # Test set table for some sources + def test_table_id(self): + base = ['policy', 'local-route'] + rule = '50' + table = '23' + for src in self._sources: + self.session.set(base + ['rule', rule, 'set', 'table', table]) + self.session.set(base + ['rule', rule, 'source', src]) + + self.session.commit() + + # Check generated configuration + + # Expected values + original = """ + 50: from 203.0.113.1 lookup 23 + 50: from 203.0.113.2 lookup 23 + """ + tmp = cmd('ip rule show prio 50') + original = original.split() + tmp = tmp.split() + + self.assertEqual(tmp, original) + +if __name__ == '__main__': + unittest.main() diff --git a/src/conf_mode/policy-local-route.py b/src/conf_mode/policy-local-route.py new file mode 100755 index 000000000..c4024dce4 --- /dev/null +++ b/src/conf_mode/policy-local-route.py @@ -0,0 +1,110 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2020 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import os + +from sys import exit + +from vyos.config import Config +from vyos.configdict import dict_merge +from vyos.configdict import node_changed +from vyos.configdict import leaf_node_changed +from vyos.template import render +from vyos.util import call +from vyos import ConfigError +from vyos import airbag +airbag.enable() + + +def get_config(config=None): + + if config: + conf = config + else: + conf = Config() + base = ['policy', 'local-route'] + pbr = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True) + + # delete policy local-route + dict = {} + tmp = node_changed(conf, ['policy', 'local-route', 'rule']) + if tmp: + for rule in (tmp or []): + src = leaf_node_changed(conf, ['policy', 'local-route', 'rule', rule, 'source']) + if src: + dict = dict_merge({'rule_remove' : {rule : {'source' : src}}}, dict) + pbr.update(dict) + + # delete policy local-route rule x source x.x.x.x + if 'rule' in pbr: + for rule in pbr['rule']: + src = leaf_node_changed(conf, ['policy', 'local-route', 'rule', rule, 'source']) + if src: + dict = dict_merge({'rule_remove' : {rule : {'source' : src}}}, dict) + pbr.update(dict) + + return pbr + +def verify(pbr): + # bail out early - looks like removal from running config + if not pbr: + return None + + if 'rule' in pbr: + for rule in pbr['rule']: + if 'source' not in pbr['rule'][rule]: + raise ConfigError('Source address required!') + else: + if 'set' not in pbr['rule'][rule] or 'table' not in pbr['rule'][rule]['set']: + raise ConfigError('Table set is required!') + + return None + +def generate(pbr): + if not pbr: + return None + + return None + +def apply(pbr): + if not pbr: + return None + + # Delete old rule if needed + if 'rule_remove' in pbr: + for rule in pbr['rule_remove']: + for src in pbr['rule_remove'][rule]['source']: + call(f'ip rule del prio {rule} from {src}') + + # Generate new config + if 'rule' in pbr: + for rule in pbr['rule']: + table = pbr['rule'][rule]['set']['table'] + if pbr['rule'][rule]['source']: + for src in pbr['rule'][rule]['source']: + call(f'ip rule add prio {rule} from {src} lookup {table}') + + return None + +if __name__ == '__main__': + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + exit(1) -- cgit v1.2.3