1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
|
#!/usr/bin/env python3
#
# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
from sys import exit
from sys import argv
from vyos.config import Config
from vyos.configdict import list_diff
from vyos.configverify import has_frr_protocol_in_dict
from vyos.frrender import FRRender
from vyos.frrender import get_frrender_dict
from vyos.ifconfig import Section
from vyos.utils.dict import dict_search
from vyos.utils.process import is_systemd_service_running
from vyos.utils.system import sysctl_write
from vyos import ConfigError
from vyos import airbag
airbag.enable()
def get_config(config=None):
if config:
conf = config
else:
conf = Config()
return get_frrender_dict(conf, argv)
def verify(config_dict):
if not has_frr_protocol_in_dict(config_dict, 'segment_routing'):
return None
sr = config_dict['segment_routing']
if 'srv6' in sr:
srv6_enable = False
for _, interface_config in dict_search('interface', sr, {}).items():
if 'srv6' in interface_config:
srv6_enable = True
break
if not srv6_enable:
raise ConfigError('SRv6 should be enabled on at least one interface!')
# Check for database import having more than one protocol
if tmp := dict_search('traffic_engineering.database_import_protocol', sr):
if {'isis', 'ospf'} <= set(tmp.keys()):
raise ConfigError('SR-TE database import: IS-IS and OSPF are mutually exclusive!')
for segment_list in dict_search('traffic_engineering.segment_list', sr, []):
sl_data = dict_search(f'traffic_engineering.segment_list.{segment_list}', sr)
indices = sl_data.get('index') if sl_data else None
if indices is None:
raise ConfigError(f'SR-TE segment list "{segment_list}": '\
'at least one index is required!')
for index, index_data in indices.items():
error_msg = f'SR-TE segment list "{segment_list}", index "{index}"'
nai = index_data.get('nai')
mpls = index_data.get('mpls')
if not nai and not mpls:
raise ConfigError(f'{error_msg}: "mpls" or "nai" is required!')
if nai:
if 'adjacency' in nai and 'prefix' in nai:
raise ConfigError(f'{error_msg}: "prefix" and "adjacency" are mutually exclusive!')
for nai_type in ('adjacency', 'prefix'):
nai_data = nai.get(nai_type)
if not nai_data:
continue
if 'ipv4' in nai_data and 'ipv6' in nai_data:
raise ConfigError(f'{error_msg}, nai {nai_type}: "ipv4" and "ipv6" are '
'mutually exclusive!')
for af, af_config in nai_data.items():
af_ctx = f'{error_msg}, nai {nai_type} {af}'
if nai_type == 'adjacency':
has_src = 'source_identifier' in af_config
has_dst = 'destination_identifier' in af_config
if has_src != has_dst:
missing = 'destination-identifier' if has_src else 'source-identifier'
raise ConfigError(f'{af_ctx}: "{missing}" is required!')
else:
if 'prefix_identifier' not in af_config:
raise ConfigError(f'{af_ctx}: "prefix-identifier" is required!')
for pfx, pfx_data in af_config['prefix_identifier'].items():
pfx_ctx = f'{af_ctx}, prefix "{pfx}"'
if 'algorithm' not in pfx_data:
raise ConfigError(f'{pfx_ctx}: "algorithm" is required!')
if alg := pfx_data.get('algorithm'):
if {'spf', 'strict_spf'} <= set(alg.keys()):
raise ConfigError(f'{pfx_ctx}: "spf" and "strict-spf" '
'are mutually exclusive!')
return None
def generate(config_dict):
if config_dict and not is_systemd_service_running('vyos-configd.service'):
FRRender().generate(config_dict)
return None
def apply(config_dict):
if not has_frr_protocol_in_dict(config_dict, 'segment_routing'):
return None
sr = config_dict['segment_routing']
current_interfaces = Section.interfaces()
sr_interfaces = list(sr.get('interface', {}).keys())
for interface in list_diff(current_interfaces, sr_interfaces):
# Disable processing of IPv6-SR packets
sysctl_write(['net', 'ipv6', 'conf', interface, 'seg6_enabled'], '0')
for interface, interface_config in sr.get('interface', {}).items():
# Accept or drop SR-enabled IPv6 packets on this interface
if 'srv6' in interface_config:
sysctl_write(['net', 'ipv6', 'conf', interface, 'seg6_enabled'], '1')
# Define HMAC policy for ingress SR-enabled packets on this interface
# It's a redundant check as HMAC has a default value - but better safe
# then sorry
tmp = dict_search('srv6.hmac', interface_config)
if tmp == 'accept':
sysctl_write(['net', 'ipv6', 'conf', interface, 'seg6_require_hmac'], '0')
elif tmp == 'drop':
sysctl_write(['net', 'ipv6', 'conf', interface, 'seg6_require_hmac'], '1')
elif tmp == 'ignore':
sysctl_write(['net', 'ipv6', 'conf', interface, 'seg6_require_hmac'], '-1')
else:
sysctl_write(['net', 'ipv6', 'conf', interface, 'seg6_enabled'], '0')
if config_dict and not is_systemd_service_running('vyos-configd.service'):
FRRender().apply()
return None
if __name__ == '__main__':
try:
c = get_config()
verify(c)
generate(c)
apply(c)
except ConfigError as e:
print(e)
exit(1)
|
