From c5989a799856476ec45adf40c35df57dbf53a559 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Thu, 13 May 2021 19:46:14 +0200 Subject: vyos.template: T3535: add helper for IP address conversion Support getting the IPv4 addresses from a given interface and support to strip CIDR mask from address. --- python/vyos/template.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/python/vyos/template.py b/python/vyos/template.py index 3fbb33acb..e1986b1e4 100644 --- a/python/vyos/template.py +++ b/python/vyos/template.py @@ -121,6 +121,14 @@ def render( ################################## # Custom template filters follow # ################################## +@register_filter('ip_from_cidr') +def ip_from_cidr(prefix): + """ Take an IPv4/IPv6 CIDR host and strip cidr mask. + Example: + 192.0.2.1/24 -> 192.0.2.1, 2001:db8::1/64 -> 2001:db8::1 + """ + from ipaddress import ip_interface + return str(ip_interface(prefix).ip) @register_filter('address_from_cidr') def address_from_cidr(prefix): @@ -361,3 +369,9 @@ def natural_sort(iterable): return [convert(c) for c in re.split('([0-9]+)', str(key))] return sorted(iterable, key=alphanum_key) + +@register_filter('get_ipv4') +def get_ipv4(interface): + """ Get interface IPv4 addresses""" + from vyos.ifconfig import Interface + return Interface(interface).get_addr_v4() -- cgit v1.2.3 From 0ab290275fac027672eb9613500b8705ab64fe72 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Thu, 13 May 2021 19:47:15 +0200 Subject: vyos.ifconfig: T3535: add helper to get only IPv4 or IPv6 interface addresses --- python/vyos/ifconfig/interface.py | 39 +++++++++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 10 deletions(-) diff --git a/python/vyos/ifconfig/interface.py b/python/vyos/ifconfig/interface.py index ff05cab0e..a08872509 100644 --- a/python/vyos/ifconfig/interface.py +++ b/python/vyos/ifconfig/interface.py @@ -743,28 +743,37 @@ class Interface(Control): """ self.set_interface('proxy_arp_pvlan', enable) - def get_addr(self): + def get_addr_v4(self): """ - Retrieve assigned IPv4 and IPv6 addresses from given interface. + Retrieve assigned IPv4 addresses from given interface. This is done using the netifaces and ipaddress python modules. Example: >>> from vyos.ifconfig import Interface - >>> Interface('eth0').get_addrs() - ['172.16.33.30/24', 'fe80::20c:29ff:fe11:a174/64'] + >>> Interface('eth0').get_addr_v4() + ['172.16.33.30/24'] """ - ipv4 = [] - ipv6 = [] - - if AF_INET in ifaddresses(self.config['ifname']).keys(): + if AF_INET in ifaddresses(self.config['ifname']): for v4_addr in ifaddresses(self.config['ifname'])[AF_INET]: # we need to manually assemble a list of IPv4 address/prefix prefix = '/' + \ str(IPv4Network('0.0.0.0/' + v4_addr['netmask']).prefixlen) ipv4.append(v4_addr['addr'] + prefix) + return ipv4 - if AF_INET6 in ifaddresses(self.config['ifname']).keys(): + def get_addr_v6(self): + """ + Retrieve assigned IPv6 addresses from given interface. + This is done using the netifaces and ipaddress python modules. + + Example: + >>> from vyos.ifconfig import Interface + >>> Interface('eth0').get_addr_v6() + ['fe80::20c:29ff:fe11:a174/64'] + """ + ipv6 = [] + if AF_INET6 in ifaddresses(self.config['ifname']): for v6_addr in ifaddresses(self.config['ifname'])[AF_INET6]: # Note that currently expanded netmasks are not supported. That means # 2001:db00::0/24 is a valid argument while 2001:db00::0/ffff:ff00:: not. @@ -777,8 +786,18 @@ class Interface(Control): # addresses v6_addr['addr'] = v6_addr['addr'].split('%')[0] ipv6.append(v6_addr['addr'] + prefix) + return ipv6 + + def get_addr(self): + """ + Retrieve assigned IPv4 and IPv6 addresses from given interface. - return ipv4 + ipv6 + Example: + >>> from vyos.ifconfig import Interface + >>> Interface('eth0').get_addr() + ['172.16.33.30/24', 'fe80::20c:29ff:fe11:a174/64'] + """ + return self.get_addr_v4() + self.get_addr_v6() def add_addr(self, addr): """ -- cgit v1.2.3 From 4d11715bd936d5d111bb3cd6e289ef2b3c3c218a Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Tue, 11 May 2021 19:15:51 +0200 Subject: conntrack: T3535: migrate codebase from vyatta-conntrack-sync --- data/templates/conntrackd/conntrackd.conf.tmpl | 107 +++++++++++++ debian/control | 3 + .../service_conntrack-sync.xml.in | 168 +++++++++++++++++++++ src/conf_mode/conntrack_sync.py | 106 +++++++++++++ .../system/conntrackd.service.d/override.conf | 8 + src/migration-scripts/conntrack-sync/1-to-2 | 61 ++++++++ src/validators/ipv4 | 3 + src/validators/ipv4-multicast | 3 + src/validators/ipv6-multicast | 3 + 9 files changed, 462 insertions(+) create mode 100644 data/templates/conntrackd/conntrackd.conf.tmpl create mode 100644 interface-definitions/service_conntrack-sync.xml.in create mode 100755 src/conf_mode/conntrack_sync.py create mode 100644 src/etc/systemd/system/conntrackd.service.d/override.conf create mode 100755 src/migration-scripts/conntrack-sync/1-to-2 create mode 100755 src/validators/ipv4 create mode 100755 src/validators/ipv4-multicast create mode 100755 src/validators/ipv6-multicast diff --git a/data/templates/conntrackd/conntrackd.conf.tmpl b/data/templates/conntrackd/conntrackd.conf.tmpl new file mode 100644 index 000000000..86501023f --- /dev/null +++ b/data/templates/conntrackd/conntrackd.conf.tmpl @@ -0,0 +1,107 @@ +# autogenerated by conntrack_sync.py + +# Synchronizer settings +Sync { + Mode FTFW { + DisableExternalCache {{ 'on' if disable_external_cache is defined else 'off' }} + } +{% for iface, iface_config in interface.items() %} +{% if loop.first %} +{% if iface_config.peer is defined and iface_config.peer is not none %} + UDP { +{% if listen_address is defined and listen_address is not none %} + IPv4_address {{ listen_address }} +{% endif %} + IPv4_Destination_Address {{ iface_config.peer }} + Port 3780 +{% else %} +{% set ip_address = iface | get_ipv4 %} + Multicast { + IPv4_address {{ mcast_group }} + Group 3780 + IPv4_interface {{ ip_address[0] | ip_from_cidr }} +{% endif %} + Interface {{ iface }} +{% endif %} +{% endfor %} + SndSocketBuffer {{ sync_queue_size | int *1024 *1024 }} + RcvSocketBuffer {{ sync_queue_size | int *1024 *1024 }} + Checksum on + } +{% if expect_sync is defined and expect_sync is not none %} + Options { +{% if 'all' in expect_sync %} + ExpectationSync on +{% else %} + ExpectationSync { +{% for protocol in expect_sync %} + {{ protocol }} +{% endfor %} +{% endif %} + } + } +{% endif %} +} +Helper { + Type rpc inet tcp { + QueueNum 3 + Policy rpc { + ExpectMax 1 + ExpectTimeout 300 + } + } + Type rpc inet udp { + QueueNum 4 + Policy rpc { + ExpectMax 1 + ExpectTimeout 300 + } + } + Type tns inet tcp { + QueueNum 5 + Policy tns { + ExpectMax 1 + ExpectTimeout 300 + } + } +} + +# General settings +General { + Nice -20 + HashSize {{ hash_size }} + HashLimit {{ table_size | int *2 }} + LogFile off + Syslog on + LockFile /var/lock/conntrack.lock + UNIX { + Path /run/conntrackd/conntrackd.ctl + Backlog 20 + } + NetlinkBufferSize {{ 2 *1024 *1024 }} + NetlinkBufferSizeMaxGrowth {{ event_listen_queue_size | int *1024 *1024 }} + NetlinkOverrunResync off + NetlinkEventsReliable on +{% if ignore_address is defined or accept_protocol is defined %} + Filter From Userspace { +{% if ignore_address is defined and ignore_address is not none %} + Address Ignore { +{% for address in ignore_address if address | is_ipv4 %} + IPv4_address {{ address }} +{% endfor %} +{% for address in ignore_address if address | is_ipv6 %} + IPv6_address {{ address }} +{% endfor %} + } +{% endif %} +{% if accept_protocol is defined and accept_protocol is not none %} + Protocol Accept { +{% for protocol in accept_protocol %} + {{ protocol | upper }} +{% endfor %} + } +{% endif %} + } +{% endif %} +} + diff --git a/debian/control b/debian/control index 851152d95..de030310e 100644 --- a/debian/control +++ b/debian/control @@ -35,6 +35,7 @@ Depends: bmon, bsdmainutils, conntrack, + conntrackd, conserver-client, conserver-server, console-data, @@ -67,6 +68,8 @@ Depends: lcdproc, libatomic1, libndp-tools, + libnetfilter-conntrack3, + libnfnetlink0, libpam-radius-auth (>= 1.5.0), libvyosconfig0, lldpd, diff --git a/interface-definitions/service_conntrack-sync.xml.in b/interface-definitions/service_conntrack-sync.xml.in new file mode 100644 index 000000000..45d211479 --- /dev/null +++ b/interface-definitions/service_conntrack-sync.xml.in @@ -0,0 +1,168 @@ + + + + + + + Connection tracking synchronization + 995 + + + + + Protocols for which local conntrack entries will be synced + + tcp udp icmp sctp + + + tcp + Sync Transmission Control Protocol conntrack entries + + + udp + Sync User Datagram Protocol conntrack entries + + + icmp + Sync Internet Control Message Protocol conntrack entries + + + sctp + Sync Stream Control Transmission Protocol conntrack entries + + + ^(tcp|udp|icmp|sctp)$ + + Allowed protocols: tcp udp icmp or sctp + + + + + + Directly injects the flow-states into the in-kernel Connection Tracking System of the backup firewall. + + + + + + Queue size for local conntrack events + + u32 + Queue size in MB + + + 8 + + + + Protocol for which expect entries need to be synchronized + + all ftp sip h323 nfs sqlnet + + + ^(all|ftp|sip|h323|nfs|sqlnet)$ + + Invalid protocol + + + + + + Failover mechanism to use for conntrack-sync + + + + + Cluster as failover-mechanism to use for conntrack-sync + + + + + Cluster group [DEPRECATED] + + + + + + + VRRP as failover-mechanism to use for conntrack-sync + + + + + VRRP sync group [REQUIRED] + + high-availability vrrp sync-group + + + + + + + + + + IP addresses for which local conntrack entries will not be synced + + ipv4 + IPv4 address to ignore + + + ipv4net + IPv4 prefix to ignore + + + ipv6 + IPv6 address to ignore + + + ipv6net + IPv6 prefix to ignore + + + + + + + + + + + Interface to use for syncing conntrack entries + + + + + + + + IP address of the peer to send the UDP conntrack info too. This disable multicast. + + + + + #include + + + Multicast group to use for syncing conntrack entries + + + + + 225.0.0.50 + + + + Queue size for syncing conntrack entries + + u32 + Queue size in MB + + + 1 + + + + + + diff --git a/src/conf_mode/conntrack_sync.py b/src/conf_mode/conntrack_sync.py new file mode 100755 index 000000000..c1c90d1fc --- /dev/null +++ b/src/conf_mode/conntrack_sync.py @@ -0,0 +1,106 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2021 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import os + +from sys import exit +from vyos.config import Config +from vyos.configdict import dict_merge +from vyos.configverify import verify_interface_exists +from vyos.util import call +from vyos.util import read_file +from vyos.template import render +from vyos.template import get_ipv4 +from vyos.validate import is_addr_assigned +from vyos.xml import defaults +from vyos import ConfigError +from vyos import airbag +airbag.enable() + +config_file = '/run/conntrackd/conntrackd.conf' + +def get_config(config=None): + if config: + conf = config + else: + conf = Config() + base = ['service', 'conntrack-sync'] + if not conf.exists(base): + return None + + conntrack = conf.get_config_dict(base, key_mangling=('-', '_'), + get_first_key=True) + # We have gathered the dict representation of the CLI, but there are default + # options which we need to update into the dictionary retrived. + default_values = defaults(base) + conntrack = dict_merge(default_values, conntrack) + + conntrack['hash_size'] = read_file('/sys/module/nf_conntrack/parameters/hashsize') + conntrack['table_size'] = read_file('/proc/sys/net/netfilter/nf_conntrack_max') + + return conntrack + +def verify(conntrack): + if not conntrack: + return None + + if 'interface' not in conntrack: + raise ConfigError('Interface not defined!') + + for interface in conntrack['interface']: + verify_interface_exists(interface) + # Interface must not only exist, it must also carry an IP address + if len(get_ipv4(interface)) < 1: + raise ConfigError(f'Interface {interface} requires an IP address!') + + if 'expect_sync' in conntrack: + if len(conntrack['expect_sync']) > 1 and 'all' in conntrack['expect_sync']: + raise ConfigError('Cannot configure all with other protocol') + + if 'listen_address' in conntrack: + address = conntrack['listen_address'] + if not is_addr_assigned(address): + raise ConfigError(f'Specified listen-address {address} not assigned to any interface!') + + return None + +def generate(conntrack): + if not conntrack: + if os.path.isfile(config_file): + os.unlink(config_file) + return None + + render(config_file, 'conntrackd/conntrackd.conf.tmpl', conntrack) + + return None + +def apply(conntrack): + if not conntrack: + call('systemctl stop conntrackd.service') + return None + + call('systemctl restart conntrackd.service') + return None + +if __name__ == '__main__': + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + exit(1) diff --git a/src/etc/systemd/system/conntrackd.service.d/override.conf b/src/etc/systemd/system/conntrackd.service.d/override.conf new file mode 100644 index 000000000..eb611e0d9 --- /dev/null +++ b/src/etc/systemd/system/conntrackd.service.d/override.conf @@ -0,0 +1,8 @@ +[Unit] +After= +After=vyos-router.service +ConditionPathExists=/run/conntrackd/conntrackd.conf + +[Service] +ExecStart= +ExecStart=/usr/sbin/conntrackd -C /run/conntrackd/conntrackd.conf diff --git a/src/migration-scripts/conntrack-sync/1-to-2 b/src/migration-scripts/conntrack-sync/1-to-2 new file mode 100755 index 000000000..3a76fc0e0 --- /dev/null +++ b/src/migration-scripts/conntrack-sync/1-to-2 @@ -0,0 +1,61 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2021 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +# VyOS 1.2 crux allowed configuring a lower or upper case loglevel. This +# is no longer supported as the input data is validated and will lead to +# an error. If user specifies an upper case logleve, make it lowercase + +from sys import argv +from sys import exit + +from vyos.configtree import ConfigTree + +if (len(argv) < 1): + print("Must specify file name!") + exit(1) + +file_name = argv[1] + +with open(file_name, 'r') as f: + config_file = f.read() + +base = ['service', 'conntrack-sync'] +config = ConfigTree(config_file) + +if not config.exists(base): + # Nothing to do + exit(0) +else: + base_accept_proto = base + ['accept-protocol'] + if config.exists(base_accept_proto): + tmp = config.return_value(base_accept_proto) + config.delete(base_accept_proto) + for protocol in tmp.split(','): + config.set(base_accept_proto, value=protocol, replace=False) + + base_ignore_addr = base + ['ignore-address', 'ipv4'] + if config.exists(base_ignore_addr): + tmp = config.return_values(base_ignore_addr) + config.delete(base_ignore_addr) + for address in tmp: + config.set(base + ['ignore-address'], value=address, replace=False) + + try: + with open(file_name, 'w') as f: + f.write(config.to_string()) + except OSError as e: + print("Failed to save the modified config: {}".format(e)) + exit(1) diff --git a/src/validators/ipv4 b/src/validators/ipv4 new file mode 100755 index 000000000..53face090 --- /dev/null +++ b/src/validators/ipv4 @@ -0,0 +1,3 @@ +#!/bin/sh + +ipaddrcheck --is-ipv4 $1 diff --git a/src/validators/ipv4-multicast b/src/validators/ipv4-multicast new file mode 100755 index 000000000..e5cbc9532 --- /dev/null +++ b/src/validators/ipv4-multicast @@ -0,0 +1,3 @@ +#!/bin/sh + +ipaddrcheck --is-ipv4-multicast $1 diff --git a/src/validators/ipv6-multicast b/src/validators/ipv6-multicast new file mode 100755 index 000000000..66cd90c9c --- /dev/null +++ b/src/validators/ipv6-multicast @@ -0,0 +1,3 @@ +#!/bin/sh + +ipaddrcheck --is-ipv6-multicast $1 -- cgit v1.2.3 From a93ea04589918d9f984c11892b1a712cab811a3c Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Thu, 13 May 2021 17:20:48 +0200 Subject: op-mode: conntrack: T3535: add XML command definitions --- op-mode-definitions/conntrack-sync.xml.in | 36 +++++++++++ src/op_mode/conntrack_sync.py | 100 ++++++++++++++++++++++++++++++ 2 files changed, 136 insertions(+) create mode 100644 op-mode-definitions/conntrack-sync.xml.in create mode 100755 src/op_mode/conntrack_sync.py diff --git a/op-mode-definitions/conntrack-sync.xml.in b/op-mode-definitions/conntrack-sync.xml.in new file mode 100644 index 000000000..cd0ec5cc8 --- /dev/null +++ b/op-mode-definitions/conntrack-sync.xml.in @@ -0,0 +1,36 @@ + + + + + + + Reset connection syncing parameters + + + + + Reset external cache and request resync with other systems + + ${vyos_op_scripts_dir}/conntrack_sync.py --reset-cache-external + + + + Reset internal cache and request resync with other systems + + ${vyos_op_scripts_dir}/conntrack_sync.py --reset-cache-internal + + + + + + + + + + Restart connection tracking synchronization service + + ${vyos_op_scripts_dir}/conntrack_sync.py --restart + + + + diff --git a/src/op_mode/conntrack_sync.py b/src/op_mode/conntrack_sync.py new file mode 100755 index 000000000..48017c58a --- /dev/null +++ b/src/op_mode/conntrack_sync.py @@ -0,0 +1,100 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2021 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import os +import syslog + +from argparse import ArgumentParser +from vyos.configquery import CliShellApiConfigQuery +from vyos.util import call +from vyos.util import run + +conntrackd_bin = '/usr/sbin/conntrackd' +conntrackd_config = '/run/conntrackd/conntrackd.conf' + +parser = ArgumentParser(description='Conntrack Sync') +parser.add_argument('--restart', help='Restart connection tracking synchronization service', action='store_true') +parser.add_argument('--reset-cache-internal', help='Reset internal cache', action='store_true') +parser.add_argument('--reset-cache-external', help='Reset external cache', action='store_true') + +def is_configured(): + """ Check if conntrack-sync service is configured """ + config = CliShellApiConfigQuery() + if not config.exists(['service', 'conntrack-sync']): + print('Service conntrackd-sync not configured!') + exit(1) + +def send_bulk_update(): + """ send bulk update of internal-cache to other systems """ + tmp = run(f'{conntrackd_bin} -c {conntrackd_config} -B') + if tmp > 0: + print('ERROR: failed to send bulk update to other conntrack-sync systems') + +def request_sync(): + """ request resynchronization with other systems """ + tmp = run(f'{conntrackd_bin} -c {conntrackd_config} -n') + if tmp > 0: + print('ERROR: failed to request resynchronization of external cache') + +def flush_cache(direction): + """ flush conntrackd cache (internal or external) """ + if direction not in ['internal', 'external']: + raise ValueError() + tmp = run(f'{conntrackd_bin} -c {conntrackd_config} -f {direction}') + if tmp > 0: + print('ERROR: failed to clear {direction} cache') + +if __name__ == '__main__': + args = parser.parse_args() + syslog.openlog(ident='conntrack-tools', logoption=syslog.LOG_PID, + facility=syslog.LOG_INFO) + + if args.restart: + is_configured() + + syslog.syslog('Restarting conntrack sync service...') + call('systemctl restart conntrackd.service') + # request resynchronization with other systems + request_sync() + # send bulk update of internal-cache to other systems + send_bulk_update() + + elif args.reset_cache_external: + is_configured() + syslog.syslog('Resetting external cache of conntrack sync service...') + + # flush the external cache + flush_cache('external') + # request resynchronization with other systems + request_sync() + + elif args.reset_cache_internal: + is_configured() + syslog.syslog('Resetting internal cache of conntrack sync service...') + # flush the internal cache + flush_cache('internal') + + # request resynchronization of internal cache with kernel conntrack table + tmp = run(f'{conntrackd_bin} -c {conntrackd_config} -R') + if tmp > 0: + print('ERROR: failed to resynchronize internal cache with kernel conntrack table') + + # send bulk update of internal-cache to other systems + send_bulk_update() + + else: + parser.print_help() + exit(1) -- cgit v1.2.3 From 26210f3465dac5edac18c7b7c1cda18531a7483e Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 14 May 2021 21:08:50 +0200 Subject: conntrack: T3535: remove deprecated options from template --- data/templates/conntrackd/conntrackd.conf.tmpl | 2 -- 1 file changed, 2 deletions(-) diff --git a/data/templates/conntrackd/conntrackd.conf.tmpl b/data/templates/conntrackd/conntrackd.conf.tmpl index 86501023f..6f9fa51b0 100644 --- a/data/templates/conntrackd/conntrackd.conf.tmpl +++ b/data/templates/conntrackd/conntrackd.conf.tmpl @@ -68,7 +68,6 @@ Helper { # General settings General { - Nice -20 HashSize {{ hash_size }} HashLimit {{ table_size | int *2 }} LogFile off @@ -76,7 +75,6 @@ General { LockFile /var/lock/conntrack.lock UNIX { Path /run/conntrackd/conntrackd.ctl - Backlog 20 } NetlinkBufferSize {{ 2 *1024 *1024 }} NetlinkBufferSizeMaxGrowth {{ event_listen_queue_size | int *1024 *1024 }} -- cgit v1.2.3 From cd59f198366ce58a01887e4f900a746d5b10b161 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 14 May 2021 21:26:01 +0200 Subject: conntrack: T3535: remove cluster CLI nodes --- interface-definitions/service_conntrack-sync.xml.in | 12 ------------ src/migration-scripts/conntrack-sync/1-to-2 | 5 +++++ 2 files changed, 5 insertions(+), 12 deletions(-) diff --git a/interface-definitions/service_conntrack-sync.xml.in b/interface-definitions/service_conntrack-sync.xml.in index 45d211479..2953ae390 100644 --- a/interface-definitions/service_conntrack-sync.xml.in +++ b/interface-definitions/service_conntrack-sync.xml.in @@ -71,18 +71,6 @@ Failover mechanism to use for conntrack-sync - - - Cluster as failover-mechanism to use for conntrack-sync - - - - - Cluster group [DEPRECATED] - - - - VRRP as failover-mechanism to use for conntrack-sync diff --git a/src/migration-scripts/conntrack-sync/1-to-2 b/src/migration-scripts/conntrack-sync/1-to-2 index 3a76fc0e0..ebbd8c35a 100755 --- a/src/migration-scripts/conntrack-sync/1-to-2 +++ b/src/migration-scripts/conntrack-sync/1-to-2 @@ -53,6 +53,11 @@ else: for address in tmp: config.set(base + ['ignore-address'], value=address, replace=False) + # we no longer support cluster mode + base_cluster = base + ['failover-mechanism', 'cluster'] + if config.exists(base_cluster): + config.delete(base_cluster) + try: with open(file_name, 'w') as f: f.write(config.to_string()) -- cgit v1.2.3 From 3fc9b2fb79fd3e27a5034804e5243fe2e4ec40c3 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Fri, 14 May 2021 21:26:25 +0200 Subject: conntrack: T3535: check for VRRP group definition --- interface-definitions/service_conntrack-sync.xml.in | 2 +- src/conf_mode/conntrack_sync.py | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/interface-definitions/service_conntrack-sync.xml.in b/interface-definitions/service_conntrack-sync.xml.in index 2953ae390..088cd78f6 100644 --- a/interface-definitions/service_conntrack-sync.xml.in +++ b/interface-definitions/service_conntrack-sync.xml.in @@ -78,7 +78,7 @@ - VRRP sync group [REQUIRED] + VRRP sync group high-availability vrrp sync-group diff --git a/src/conf_mode/conntrack_sync.py b/src/conf_mode/conntrack_sync.py index c1c90d1fc..e0a414745 100755 --- a/src/conf_mode/conntrack_sync.py +++ b/src/conf_mode/conntrack_sync.py @@ -21,6 +21,7 @@ from vyos.config import Config from vyos.configdict import dict_merge from vyos.configverify import verify_interface_exists from vyos.util import call +from vyos.util import dict_search from vyos.util import read_file from vyos.template import render from vyos.template import get_ipv4 @@ -51,6 +52,9 @@ def get_config(config=None): conntrack['hash_size'] = read_file('/sys/module/nf_conntrack/parameters/hashsize') conntrack['table_size'] = read_file('/proc/sys/net/netfilter/nf_conntrack_max') + conntrack['vrrp'] = conf.get_config_dict(['high-availability', 'vrrp', 'sync-group'], + get_first_key=True) + return conntrack def verify(conntrack): @@ -75,6 +79,12 @@ def verify(conntrack): if not is_addr_assigned(address): raise ConfigError(f'Specified listen-address {address} not assigned to any interface!') + vrrp_group = dict_search('failover_mechanism.vrrp.sync_group', conntrack) + if vrrp_group == None: + raise ConfigError(f'No VRRP sync-group defined!') + if vrrp_group not in conntrack['vrrp']: + raise ConfigError(f'VRRP sync-group {vrrp_group} not configured!') + return None def generate(conntrack): -- cgit v1.2.3