From f0c8d0be34ca3475b6e7f5da71cedb0bd4b5fd96 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Wed, 14 Apr 2021 20:31:21 +0200 Subject: policy: T2425: rename files from policy-list to policy --- interface-definitions/policy-lists.xml.in | 1266 ----------------------------- interface-definitions/policy.xml.in | 1266 +++++++++++++++++++++++++++++ src/conf_mode/policy-lists.py | 117 --- src/conf_mode/policy.py | 117 +++ 4 files changed, 1383 insertions(+), 1383 deletions(-) delete mode 100644 interface-definitions/policy-lists.xml.in create mode 100644 interface-definitions/policy.xml.in delete mode 100755 src/conf_mode/policy-lists.py create mode 100755 src/conf_mode/policy.py diff --git a/interface-definitions/policy-lists.xml.in b/interface-definitions/policy-lists.xml.in deleted file mode 100644 index a0bea2ce2..000000000 --- a/interface-definitions/policy-lists.xml.in +++ /dev/null @@ -1,1266 +0,0 @@ - - - - - - Routing policy - - - - - IP access-list filter - 470 - - u32:1-99 - IP standard access list - - - u32:100-199 - IP extended access list - - - u32:1300-1999 - IP standard access list (expanded range) - - - u32:2000-2699 - IP extended access list (expanded range) - - - - #include - - - Rule for this access-list - - u32:1-65535 - Access-list rule number - - - - - - - #include - #include - - - Destination network or address - - - - - Any IP address to match - - - - - - Single host IP address to match - - ipv4 - Host address to match - - - - - - - - - Network/netmask to match (requires network be defined) - - ipv4 - Inverse-mask to match - - - - - - - - - Network/netmask to match (requires inverse-mask be defined) - - ipv4net - Inverse-mask to match - - - - - - - - - - - Source network or address to match - - - - - Any IP address to match - - - - - - Single host IP address to match - - ipv4 - Host address to match - - - - - - - - - Network/netmask to match (requires network be defined) - - ipv4 - Inverse-mask to match - - - - - - - - - Network/netmask to match (requires inverse-mask be defined) - - ipv4net - Inverse-mask to match - - - - - - - - - - - - - - - IPv6 access-list filter - 470 - - txt - Name of IPv6 access-list - - - - #include - - - Rule for this access-list6 - - u32:1-65535 - Access-list6 rule number - - - - - - - #include - #include - - - Source IPv6 network to match - - - - - Any IP address to match - - - - - - Exact match of the network prefixes - - - - - - Network/netmask to match - - ipv6net - IPv6 address and prefix length - - - - - - - - - - - - - - - Border Gateway Protocol (BGP) autonomous system path filter - 470 - - txt - AS path list name - - - - #include - - - Rule for this as-path-list - - u32:1-65535 - AS path list rule number - - - - - - - #include - #include - - - Regular expression to match against an AS path - - <asn> - AS path regular expression (ex: "64501 64502") - - - - - - - - - - Border Gateway Protocol (BGP) autonomous system path filter - 470 - - txt - Border Gateway Protocol (BGP) community-list filter - - - - #include - - - Rule for this BGP community list - - u32:1-65535 - Community-list rule number - - - - - - - #include - #include - - - Regular expression to match against a community list - - <aa:nn> - Community list regular expression or one of: internet, local-AS, no-advertise, no-export - - - - - - - - - - Border Gateway Protocol (BGP) extended community-list filter - 490 - - txt - Border Gateway Protocol (BGP) extended community-list filter - - - - #include - - - Rule for this BGP extended community list - - u32:1-65535 - Extended community-list rule number - - - - - - - #include - #include - - - Regular expression to match against an extended community list - - <aa:nn:nn> - Extended community list regular expression - - - <rt aa:nn:nn> - Extended community list regular expression - - - <soo aa:nn> - Extended community list regular expression - - - - - - - - - - Border Gateway Protocol (BGP) large-community-list filter - 470 - - txt - Border Gateway Protocol (BGP) large-community-list filter - - - - #include - - - Rule for this BGP extended community list - - u32:1-65535 - Large community-list rule number - - - - - - - #include - #include - - - Regular expression to match against a large community list - - <aa:nn:nn> - Large community list regular expression - - - - - - - - - - IP prefix-list filter - 470 - - txt - Prefix list name - - - - #include - - - Rule for this prefix-list - - u32:1-65535 - Prefix-list rule number - - - - - - - #include - #include - - - Prefix length to match a netmask greater than or equal to it - - u32:0-32 - Netmask greater than length - - - - - - - - - Prefix length to match a netmask less than or equal to it - - u32:0-32 - Netmask less than length - - - - - - - - - Prefix to match - - ipv4net - Prefix to match against - - - - - - - - - - - - - IPv6 prefix-list filter - 470 - - txt - Prefix list name - - - - #include - - - Rule for this prefix-list6 - - u32:1-65535 - Prefix-list rule number - - - - - - - #include - #include - - - Prefix length to match a netmask greater than or equal to it - - u32:0-128 - Netmask greater than length - - - - - - - - - Prefix length to match a netmask less than or equal to it - - u32:0-128 - Netmask less than length - - - - - - - - - Prefix to match - - ipv6net - IPv6 prefix - - - - - - - - - - - - - IP route-map - 470 - - txt - Route map name - - - - #include - - - Rule for this route-map - - u32:1-65535 - Route-map rule number - - - - - - - #include - - - Call another route-map on match - - txt - Route map name - - - policy route-map - - - - - - Jump to a different rule in this route-map on a match - - u32:1-65535 - Rule number - - - - #include - - - Route parameters to match - - - - - BGP as-path-list to match - - policy as-path-list - - - - - - BGP community-list to match - - - - - BGP community-list to match - - policy community-list - - - - - - Community-list to exactly match - - - - - - - - BGP extended community to match - - policy extcommunity-list - - - - - - First hop interface of a route to match - - - - - - - - IP prefix parameters to match - - - - - IP address of route to match - - - - - IP access-list to match - - u32:1-99 - IP standard access list - - - u32:100-199 - IP extended access list - - - u32:1300-1999 - IP standard access list (expanded range) - - - u32:2000-2699 - IP extended access list (expanded range) - - - - - - IP prefix-list to match - - policy prefix-list - - - - - - - - - IP next-hop of route to match - - ipv4 - Next-hop IPv4 router address - - - - - - IP access-list to match - - u32:1-99 - IP standard access list - - - u32:100-199 - IP extended access list - - - u32:1300-1999 - IP standard access list (expanded range) - - - u32:2000-2699 - IP extended access list (expanded range) - - - - - - IP prefix-list to match - - policy prefix-list - - - - - - - - test - - - - - IP access-list to match - - u32:1-99 - IP standard access list - - - u32:100-199 - IP extended access list - - - u32:1300-1999 - IP standard access list (expanded range) - - - u32:2000-2699 - IP extended access list (expanded range) - - - - - - IP prefix-list to match - - policy prefix-list - - - - - - - - - - IPv6 prefix parameters to match - - - - - IPv6 address of route to match - - - - - IPv6 access-list to match - - txt - IPV6 access list name - - - policy access-list6 - - - - - - IPv6 prefix-list to match - - policy prefix-list6 - - - - - - - - IPv6 next-hop of route to match - - ipv4 - Peer IP address - - - - - - - - - - - Match BGP large communities - - - - - BGP large-community-list to match - - policy large-community-list - - - - - - - - local-preference_help - - u32:0-4294967295 - Local Preference - - - - - - - - - Metric of route to match - - u32:1-65535 - Route metric - - - - - - - - - Border Gateway Protocol (BGP) origin code to match - - egp igp incomplete - - - egp - Exterior gateway protocol origin - - - igp - Interior gateway protocol origin - - - incomplete - Incomplete origin - - - ^(egp|igp|incomplete)$ - - - - - - Peer address to match - - ipv4 - Peer IP address - - - - - - - - - Match RPKI validation result - - invalid notfound valid - - - invalid - Match invalid entries - - - notfound - Match notfound entries - - - valid - Match valid entries - - - ^(invalid|notfound|valid)$ - - - - - - Route tag to match - - u32:1-65535 - Route tag - - - - - - - - - - - Exit policy on matches - - - - - Rule number to goto on match - - u32:1-65535 - Rule number - - - - - - - - - Next sequence number to goto on match - - - - - - - - Route parameters - - - - - Border Gateway Protocol (BGP) aggregator attribute - - - - - AS number of an aggregation - - u32:1-4294967295 - Rule number - - - - - - - - - IP address of an aggregation - - ipv4 - IP address - - - - - - - - - - - Remove ASN(s) from a Border Gateway Protocol (BGP) AS-path attribute - - txt - BGP AS path exclude string (ex: "456 64500 45001") - - - - - - as-path-prepend_help - - txt - BGP AS path prepend string (ex: "64501 64501") - - - - - - Border Gateway Protocol (BGP) atomic aggregate attribute - - - - - Set route target value - - <aa:nn> - ExtCommunity in format: asn:value - - - - - - Border Gateway Protocol (BGP) communities matching a community-list - - - - - BGP communities with a community-list - - txt - BGP communities with a community-list - - - - - - Delete BGP communities matching the community-list - - - - - - - - community_help - - local-AS no-advertise no-export internet additive none - - - <aa:nn> - Community in 4 octet AS:value format - - - local-AS - local-AS - - - no-advertise - no-advertise - - - no-export - no-export - - - internet - internet - - - additive - additive - - - none - none - - - - - - - Locally significant administrative distance - - u32:0-255 - Distance value - - - - - - - - - Set route target value - - txt - ASN:nn_or_IP_address:nn VPN extended community - - - - - - Set Site of Origin value - - txt - ASN:nn_or_IP_address:nn VPN extended community - - - - - - Nexthop IP address - - ipv4 - IP address - - - - - - - - - Nexthop IPv6 address - - - - - Nexthop IPv6 global address - - ipv6 - IPv6 address and prefix length - - - - - - - - - Nexthop IPv6 local address - - ipv6 - IPv6 address and prefix length - - - - - - - - - - - Set BGP large community value - - txt - ASN:nn:mm BGP large community - - - policy large-community-list - - - - - - Border Gateway Protocol (BGP) local preference attribute - - u32:0-4294967295 - Local preference value - - - - - - - - - Destination routing protocol metric - - <+/-metric> - Add or subtract metric - - - u32:0-4294967295 - Metric value - - - - - - - - - Open Shortest Path First (OSPF) external metric-type - - type-1 type-2 - - - type-1 - OSPF external type 1 metric - - - type-2 - OSPF external type 2 metric - - - ^(type-1|type-2)$ - - - - - - origin_help - - igp egp incomplete - - - igp - Interior gateway protocol origin - - - egp - Exterior gateway protocol origin - - - incomplete - Incomplete origin - - - ^(igp|egp|incomplete)$ - - - - - - Border Gateway Protocol (BGP) originator ID attribute - - ipv4 - Orignator IP address - - - - - - - - - Source address for route - - ipv4 - IPv4 address - - - ipv6 - IPv6 address - - - - - - - - - - Set prefixes to table - - u32:1-200 - Table value - - - - - - - - - Tag value for routing protocol - - u32:1-65535 - Tag value - - - - - - - - - Border Gateway Protocol (BGP) weight attribute - - u32:0-4294967295 - BGP weight - - - - - - - - - - - - - - - diff --git a/interface-definitions/policy.xml.in b/interface-definitions/policy.xml.in new file mode 100644 index 000000000..7cf20d3de --- /dev/null +++ b/interface-definitions/policy.xml.in @@ -0,0 +1,1266 @@ + + + + + + Routing policy + + + + + IP access-list filter + 470 + + u32:1-99 + IP standard access list + + + u32:100-199 + IP extended access list + + + u32:1300-1999 + IP standard access list (expanded range) + + + u32:2000-2699 + IP extended access list (expanded range) + + + + #include + + + Rule for this access-list + + u32:1-65535 + Access-list rule number + + + + + + + #include + #include + + + Destination network or address + + + + + Any IP address to match + + + + + + Single host IP address to match + + ipv4 + Host address to match + + + + + + + + + Network/netmask to match (requires network be defined) + + ipv4 + Inverse-mask to match + + + + + + + + + Network/netmask to match (requires inverse-mask be defined) + + ipv4net + Inverse-mask to match + + + + + + + + + + + Source network or address to match + + + + + Any IP address to match + + + + + + Single host IP address to match + + ipv4 + Host address to match + + + + + + + + + Network/netmask to match (requires network be defined) + + ipv4 + Inverse-mask to match + + + + + + + + + Network/netmask to match (requires inverse-mask be defined) + + ipv4net + Inverse-mask to match + + + + + + + + + + + + + + + IPv6 access-list filter + 470 + + txt + Name of IPv6 access-list + + + + #include + + + Rule for this access-list6 + + u32:1-65535 + Access-list6 rule number + + + + + + + #include + #include + + + Source IPv6 network to match + + + + + Any IP address to match + + + + + + Exact match of the network prefixes + + + + + + Network/netmask to match + + ipv6net + IPv6 address and prefix length + + + + + + + + + + + + + + + Border Gateway Protocol (BGP) autonomous system path filter + 470 + + txt + AS path list name + + + + #include + + + Rule for this as-path-list + + u32:1-65535 + AS path list rule number + + + + + + + #include + #include + + + Regular expression to match against an AS path + + <asn> + AS path regular expression (ex: "64501 64502") + + + + + + + + + + Border Gateway Protocol (BGP) autonomous system path filter + 470 + + txt + Border Gateway Protocol (BGP) community-list filter + + + + #include + + + Rule for this BGP community list + + u32:1-65535 + Community-list rule number + + + + + + + #include + #include + + + Regular expression to match against a community list + + <aa:nn> + Community list regular expression or one of: internet, local-AS, no-advertise, no-export + + + + + + + + + + Border Gateway Protocol (BGP) extended community-list filter + 490 + + txt + Border Gateway Protocol (BGP) extended community-list filter + + + + #include + + + Rule for this BGP extended community list + + u32:1-65535 + Extended community-list rule number + + + + + + + #include + #include + + + Regular expression to match against an extended community list + + <aa:nn:nn> + Extended community list regular expression + + + <rt aa:nn:nn> + Extended community list regular expression + + + <soo aa:nn> + Extended community list regular expression + + + + + + + + + + Border Gateway Protocol (BGP) large-community-list filter + 470 + + txt + Border Gateway Protocol (BGP) large-community-list filter + + + + #include + + + Rule for this BGP extended community list + + u32:1-65535 + Large community-list rule number + + + + + + + #include + #include + + + Regular expression to match against a large community list + + <aa:nn:nn> + Large community list regular expression + + + + + + + + + + IP prefix-list filter + 470 + + txt + Prefix list name + + + + #include + + + Rule for this prefix-list + + u32:1-65535 + Prefix-list rule number + + + + + + + #include + #include + + + Prefix length to match a netmask greater than or equal to it + + u32:0-32 + Netmask greater than length + + + + + + + + + Prefix length to match a netmask less than or equal to it + + u32:0-32 + Netmask less than length + + + + + + + + + Prefix to match + + ipv4net + Prefix to match against + + + + + + + + + + + + + IPv6 prefix-list filter + 470 + + txt + Prefix list name + + + + #include + + + Rule for this prefix-list6 + + u32:1-65535 + Prefix-list rule number + + + + + + + #include + #include + + + Prefix length to match a netmask greater than or equal to it + + u32:0-128 + Netmask greater than length + + + + + + + + + Prefix length to match a netmask less than or equal to it + + u32:0-128 + Netmask less than length + + + + + + + + + Prefix to match + + ipv6net + IPv6 prefix + + + + + + + + + + + + + IP route-map + 470 + + txt + Route map name + + + + #include + + + Rule for this route-map + + u32:1-65535 + Route-map rule number + + + + + + + #include + + + Call another route-map on match + + txt + Route map name + + + policy route-map + + + + + + Jump to a different rule in this route-map on a match + + u32:1-65535 + Rule number + + + + #include + + + Route parameters to match + + + + + BGP as-path-list to match + + policy as-path-list + + + + + + BGP community-list to match + + + + + BGP community-list to match + + policy community-list + + + + + + Community-list to exactly match + + + + + + + + BGP extended community to match + + policy extcommunity-list + + + + + + First hop interface of a route to match + + + + + + + + IP prefix parameters to match + + + + + IP address of route to match + + + + + IP access-list to match + + u32:1-99 + IP standard access list + + + u32:100-199 + IP extended access list + + + u32:1300-1999 + IP standard access list (expanded range) + + + u32:2000-2699 + IP extended access list (expanded range) + + + + + + IP prefix-list to match + + policy prefix-list + + + + + + + + + IP next-hop of route to match + + ipv4 + Next-hop IPv4 router address + + + + + + IP access-list to match + + u32:1-99 + IP standard access list + + + u32:100-199 + IP extended access list + + + u32:1300-1999 + IP standard access list (expanded range) + + + u32:2000-2699 + IP extended access list (expanded range) + + + + + + IP prefix-list to match + + policy prefix-list + + + + + + + + test + + + + + IP access-list to match + + u32:1-99 + IP standard access list + + + u32:100-199 + IP extended access list + + + u32:1300-1999 + IP standard access list (expanded range) + + + u32:2000-2699 + IP extended access list (expanded range) + + + + + + IP prefix-list to match + + policy prefix-list + + + + + + + + + + IPv6 prefix parameters to match + + + + + IPv6 address of route to match + + + + + IPv6 access-list to match + + txt + IPV6 access list name + + + policy access-list6 + + + + + + IPv6 prefix-list to match + + policy prefix-list6 + + + + + + + + IPv6 next-hop of route to match + + ipv4 + Peer IP address + + + + + + + + + + + Match BGP large communities + + + + + BGP large-community-list to match + + policy large-community-list + + + + + + + + local-preference_help + + u32:0-4294967295 + Local Preference + + + + + + + + + Metric of route to match + + u32:1-65535 + Route metric + + + + + + + + + Border Gateway Protocol (BGP) origin code to match + + egp igp incomplete + + + egp + Exterior gateway protocol origin + + + igp + Interior gateway protocol origin + + + incomplete + Incomplete origin + + + ^(egp|igp|incomplete)$ + + + + + + Peer address to match + + ipv4 + Peer IP address + + + + + + + + + Match RPKI validation result + + invalid notfound valid + + + invalid + Match invalid entries + + + notfound + Match notfound entries + + + valid + Match valid entries + + + ^(invalid|notfound|valid)$ + + + + + + Route tag to match + + u32:1-65535 + Route tag + + + + + + + + + + + Exit policy on matches + + + + + Rule number to goto on match + + u32:1-65535 + Rule number + + + + + + + + + Next sequence number to goto on match + + + + + + + + Route parameters + + + + + Border Gateway Protocol (BGP) aggregator attribute + + + + + AS number of an aggregation + + u32:1-4294967295 + Rule number + + + + + + + + + IP address of an aggregation + + ipv4 + IP address + + + + + + + + + + + Remove ASN(s) from a Border Gateway Protocol (BGP) AS-path attribute + + txt + BGP AS path exclude string (ex: "456 64500 45001") + + + + + + as-path-prepend_help + + txt + BGP AS path prepend string (ex: "64501 64501") + + + + + + Border Gateway Protocol (BGP) atomic aggregate attribute + + + + + Set route target value + + <aa:nn> + ExtCommunity in format: asn:value + + + + + + Border Gateway Protocol (BGP) communities matching a community-list + + + + + BGP communities with a community-list + + txt + BGP communities with a community-list + + + + + + Delete BGP communities matching the community-list + + + + + + + + community_help + + local-AS no-advertise no-export internet additive none + + + <aa:nn> + Community in 4 octet AS:value format + + + local-AS + local-AS + + + no-advertise + no-advertise + + + no-export + no-export + + + internet + internet + + + additive + additive + + + none + none + + + + + + + Locally significant administrative distance + + u32:0-255 + Distance value + + + + + + + + + Set route target value + + txt + ASN:nn_or_IP_address:nn VPN extended community + + + + + + Set Site of Origin value + + txt + ASN:nn_or_IP_address:nn VPN extended community + + + + + + Nexthop IP address + + ipv4 + IP address + + + + + + + + + Nexthop IPv6 address + + + + + Nexthop IPv6 global address + + ipv6 + IPv6 address and prefix length + + + + + + + + + Nexthop IPv6 local address + + ipv6 + IPv6 address and prefix length + + + + + + + + + + + Set BGP large community value + + txt + ASN:nn:mm BGP large community + + + policy large-community-list + + + + + + Border Gateway Protocol (BGP) local preference attribute + + u32:0-4294967295 + Local preference value + + + + + + + + + Destination routing protocol metric + + <+/-metric> + Add or subtract metric + + + u32:0-4294967295 + Metric value + + + + + + + + + Open Shortest Path First (OSPF) external metric-type + + type-1 type-2 + + + type-1 + OSPF external type 1 metric + + + type-2 + OSPF external type 2 metric + + + ^(type-1|type-2)$ + + + + + + origin_help + + igp egp incomplete + + + igp + Interior gateway protocol origin + + + egp + Exterior gateway protocol origin + + + incomplete + Incomplete origin + + + ^(igp|egp|incomplete)$ + + + + + + Border Gateway Protocol (BGP) originator ID attribute + + ipv4 + Orignator IP address + + + + + + + + + Source address for route + + ipv4 + IPv4 address + + + ipv6 + IPv6 address + + + + + + + + + + Set prefixes to table + + u32:1-200 + Table value + + + + + + + + + Tag value for routing protocol + + u32:1-65535 + Tag value + + + + + + + + + Border Gateway Protocol (BGP) weight attribute + + u32:0-4294967295 + BGP weight + + + + + + + + + + + + + + + diff --git a/src/conf_mode/policy-lists.py b/src/conf_mode/policy-lists.py deleted file mode 100755 index 94a020e7b..000000000 --- a/src/conf_mode/policy-lists.py +++ /dev/null @@ -1,117 +0,0 @@ -#!/usr/bin/env python3 -# -# Copyright (C) 2021 VyOS maintainers and contributors -# -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 or later as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . - -import os - -from sys import exit - -from vyos.config import Config -from vyos.configdict import dict_merge -from vyos.template import render -from vyos.template import render_to_string -from vyos.util import call -from vyos.util import dict_search -from vyos import ConfigError -from vyos import frr -from vyos import airbag -from pprint import pprint -airbag.enable() - -config_file = r'/tmp/policy.frr' -frr_daemon = 'zebra' - -DEBUG = os.path.exists('/tmp/policy.debug') -if DEBUG: - import logging - lg = logging.getLogger("vyos.frr") - lg.setLevel(logging.DEBUG) - ch = logging.StreamHandler() - lg.addHandler(ch) - -def get_config(config=None): - if config: - conf = config - else: - conf = Config() - base = ['npolicy'] - policy = conf.get_config_dict(base, key_mangling=('-', '_')) - - # Bail out early if configuration tree does not exist - if not conf.exists(base): - return policy - - pprint(policy) - exit(1) - return policy - -def verify(policy): - if not policy: - return None - - return None - -def generate(policy): - if not policy: - policy['new_frr_config'] = '' - return None - - # render(config) not needed, its only for debug - # render(config_file, 'frr/policy.frr.tmpl', policy) - # policy['new_frr_config'] = render_to_string('frr/policy.frr.tmpl') - - return None - -def apply(policy): - # Save original configuration prior to starting any commit actions - # frr_cfg = frr.FRRConfig() - # frr_cfg.load_configuration(frr_daemon) - # frr_cfg.modify_section(f'ip', '') - # frr_cfg.add_before(r'(line vty)', policy['new_frr_config']) - - # Debugging - if DEBUG: - from pprint import pprint - print('') - print('--------- DEBUGGING ----------') - pprint(dir(frr_cfg)) - print('Existing config:\n') - for line in frr_cfg.original_config: - print(line) - print(f'Replacement config:\n') - print(f'{policy["new_frr_config"]}') - print(f'Modified config:\n') - print(f'{frr_cfg}') - - # frr_cfg.commit_configuration(frr_daemon) - - # If FRR config is blank, rerun the blank commit x times due to frr-reload - # behavior/bug not properly clearing out on one commit. - # if policy['new_frr_config'] == '': - # for a in range(5): - # frr_cfg.commit_configuration(frr_daemon) - - - return None - -if __name__ == '__main__': - try: - c = get_config() - verify(c) - generate(c) - apply(c) - except ConfigError as e: - print(e) - exit(1) diff --git a/src/conf_mode/policy.py b/src/conf_mode/policy.py new file mode 100755 index 000000000..94a020e7b --- /dev/null +++ b/src/conf_mode/policy.py @@ -0,0 +1,117 @@ +#!/usr/bin/env python3 +# +# Copyright (C) 2021 VyOS maintainers and contributors +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 or later as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import os + +from sys import exit + +from vyos.config import Config +from vyos.configdict import dict_merge +from vyos.template import render +from vyos.template import render_to_string +from vyos.util import call +from vyos.util import dict_search +from vyos import ConfigError +from vyos import frr +from vyos import airbag +from pprint import pprint +airbag.enable() + +config_file = r'/tmp/policy.frr' +frr_daemon = 'zebra' + +DEBUG = os.path.exists('/tmp/policy.debug') +if DEBUG: + import logging + lg = logging.getLogger("vyos.frr") + lg.setLevel(logging.DEBUG) + ch = logging.StreamHandler() + lg.addHandler(ch) + +def get_config(config=None): + if config: + conf = config + else: + conf = Config() + base = ['npolicy'] + policy = conf.get_config_dict(base, key_mangling=('-', '_')) + + # Bail out early if configuration tree does not exist + if not conf.exists(base): + return policy + + pprint(policy) + exit(1) + return policy + +def verify(policy): + if not policy: + return None + + return None + +def generate(policy): + if not policy: + policy['new_frr_config'] = '' + return None + + # render(config) not needed, its only for debug + # render(config_file, 'frr/policy.frr.tmpl', policy) + # policy['new_frr_config'] = render_to_string('frr/policy.frr.tmpl') + + return None + +def apply(policy): + # Save original configuration prior to starting any commit actions + # frr_cfg = frr.FRRConfig() + # frr_cfg.load_configuration(frr_daemon) + # frr_cfg.modify_section(f'ip', '') + # frr_cfg.add_before(r'(line vty)', policy['new_frr_config']) + + # Debugging + if DEBUG: + from pprint import pprint + print('') + print('--------- DEBUGGING ----------') + pprint(dir(frr_cfg)) + print('Existing config:\n') + for line in frr_cfg.original_config: + print(line) + print(f'Replacement config:\n') + print(f'{policy["new_frr_config"]}') + print(f'Modified config:\n') + print(f'{frr_cfg}') + + # frr_cfg.commit_configuration(frr_daemon) + + # If FRR config is blank, rerun the blank commit x times due to frr-reload + # behavior/bug not properly clearing out on one commit. + # if policy['new_frr_config'] == '': + # for a in range(5): + # frr_cfg.commit_configuration(frr_daemon) + + + return None + +if __name__ == '__main__': + try: + c = get_config() + verify(c) + generate(c) + apply(c) + except ConfigError as e: + print(e) + exit(1) -- cgit v1.2.3