pvc/node-daemon/pvcnoded/objects/VXNetworkInstance.py

930 lines
37 KiB
Python
Raw Normal View History

2018-09-23 15:26:41 -04:00
#!/usr/bin/env python3
# VXNetworkInstance.py - Class implementing a PVC VM network and run by pvcnoded
2018-09-23 15:26:41 -04:00
# Part of the Parallel Virtual Cluster (PVC) system
#
2021-03-25 17:01:55 -04:00
# Copyright (C) 2018-2021 Joshua M. Boniface <joshua@boniface.me>
2018-09-23 15:26:41 -04:00
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 3.
2018-09-23 15:26:41 -04:00
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <https://www.gnu.org/licenses/>.
#
###############################################################################
import os
import time
from textwrap import dedent
2018-09-23 15:26:41 -04:00
2021-06-01 12:17:25 -04:00
import daemon_lib.common as common
2018-09-23 15:26:41 -04:00
2018-10-14 22:14:29 -04:00
class VXNetworkInstance(object):
2018-09-23 15:26:41 -04:00
# Initialization function
def __init__(self, vni, zkhandler, config, logger, this_node, dns_aggregator):
2018-09-23 15:26:41 -04:00
self.vni = vni
self.zkhandler = zkhandler
self.config = config
self.logger = logger
self.this_node = this_node
self.dns_aggregator = dns_aggregator
self.cluster_dev = config['cluster_dev']
self.cluster_mtu = config['cluster_mtu']
self.bridge_dev = config['bridge_dev']
self.bridge_mtu = config['bridge_mtu']
2018-09-23 15:26:41 -04:00
self.nettype = self.zkhandler.read(('network.type', self.vni))
2019-03-15 11:28:49 -04:00
if self.nettype == 'bridged':
self.base_nic = 'vlan{}'.format(self.vni)
self.bridge_nic = 'vmbr{}'.format(self.vni)
self.max_mtu = self.bridge_mtu
2019-03-15 11:28:49 -04:00
self.logger.out(
'Creating new bridged network',
prefix='VNI {}'.format(self.vni),
state='i'
2019-03-15 11:28:49 -04:00
)
self.init_bridged()
elif self.nettype == 'managed':
self.base_nic = 'vxlan{}'.format(self.vni)
self.bridge_nic = 'vmbr{}'.format(self.vni)
self.max_mtu = self.cluster_mtu - 50
2019-03-15 11:28:49 -04:00
self.logger.out(
'Creating new managed network',
prefix='VNI {}'.format(self.vni),
state='i'
2019-03-15 11:28:49 -04:00
)
self.init_managed()
else:
self.base_nic = None
self.bridge_nic = None
self.max_mtu = 0
2019-03-15 11:28:49 -04:00
self.logger.out(
'Invalid network type {}'.format(self.nettype),
prefix='VNI {}'.format(self.vni),
state='i'
2019-03-15 11:28:49 -04:00
)
pass
# Initialize a bridged network
def init_bridged(self):
self.old_description = None
self.description = None
try:
self.vx_mtu = self.zkhandler.read(('network.mtu', self.vni))
self.validateNetworkMTU()
except Exception:
self.vx_mtu = None
2019-03-15 11:28:49 -04:00
# Zookeper handlers for changed states
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network', self.vni))
2019-03-15 11:28:49 -04:00
def watch_network_description(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
if data and self.description != data.decode('ascii'):
self.old_description = self.description
self.description = data.decode('ascii')
# Try block for migration purposes
try:
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.mtu', self.vni))
def watch_network_mtu(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
if data and str(self.vx_mtu) != data.decode('ascii'):
self.vx_mtu = data.decode('ascii')
self.validateNetworkMTU()
self.updateNetworkMTU()
except Exception:
2021-10-12 17:11:03 -04:00
self.validateNetworkMTU()
2019-03-15 11:28:49 -04:00
self.createNetworkBridged()
# Initialize a managed network
def init_managed(self):
2018-09-30 13:52:46 -04:00
self.old_description = None
self.description = None
self.domain = None
2019-12-08 23:32:03 -05:00
self.name_servers = None
self.ip6_gateway = self.zkhandler.read(('network.ip6.gateway', self.vni))
self.ip6_network = self.zkhandler.read(('network.ip6.network', self.vni))
self.ip6_cidrnetmask = self.zkhandler.read(('network.ip6.network', self.vni)).split('/')[-1]
self.dhcp6_flag = self.zkhandler.read(('network.ip6.dhcp', self.vni))
self.ip4_gateway = self.zkhandler.read(('network.ip4.gateway', self.vni))
self.ip4_network = self.zkhandler.read(('network.ip4.network', self.vni))
self.ip4_cidrnetmask = self.zkhandler.read(('network.ip4.network', self.vni)).split('/')[-1]
self.dhcp4_flag = self.zkhandler.read(('network.ip4.dhcp', self.vni))
self.dhcp4_start = self.zkhandler.read(('network.ip4.dhcp_start', self.vni))
self.dhcp4_end = self.zkhandler.read(('network.ip4.dhcp_end', self.vni))
try:
self.vx_mtu = self.zkhandler.read(('network.mtu', self.vni))
self.validateNetworkMTU()
except Exception:
self.vx_mtu = None
2019-03-15 11:28:49 -04:00
self.nftables_netconf_filename = '{}/networks/{}.nft'.format(self.config['nft_dynamic_directory'], self.vni)
self.firewall_rules = []
2018-10-03 23:38:25 -04:00
self.dhcp_server_daemon = None
2019-03-15 11:28:49 -04:00
self.dnsmasq_hostsdir = '{}/{}'.format(self.config['dnsmasq_dynamic_directory'], self.vni)
2018-10-09 00:24:59 -04:00
self.dhcp_reservations = []
2018-09-23 15:26:41 -04:00
# Create the network hostsdir
common.run_os_command(
'/bin/mkdir --parents {}'.format(
self.dnsmasq_hostsdir
)
)
2018-10-17 20:05:22 -04:00
self.firewall_rules_base = """# Rules for network {vxlannic}
add chain inet filter {vxlannic}-in
add chain inet filter {vxlannic}-out
add rule inet filter {vxlannic}-in counter
add rule inet filter {vxlannic}-out counter
# Allow ICMP traffic into the router from network
add rule inet filter input ip protocol icmp meta iifname {bridgenic} counter accept
2018-11-18 00:55:04 -05:00
add rule inet filter input ip6 nexthdr icmpv6 meta iifname {bridgenic} counter accept
2018-10-25 11:43:38 -04:00
# Allow DNS, DHCP, and NTP traffic into the router from network
2018-10-17 20:05:22 -04:00
add rule inet filter input tcp dport 53 meta iifname {bridgenic} counter accept
add rule inet filter input udp dport 53 meta iifname {bridgenic} counter accept
add rule inet filter input udp dport 67 meta iifname {bridgenic} counter accept
2018-10-25 11:43:38 -04:00
add rule inet filter input udp dport 123 meta iifname {bridgenic} counter accept
2018-11-18 00:55:04 -05:00
add rule inet filter input ip6 nexthdr udp udp dport 547 meta iifname {bridgenic} counter accept
2019-12-11 17:04:29 -05:00
# Allow metadata API into the router from network
add rule inet filter input tcp dport 80 meta iifname {bridgenic} counter accept
2018-10-17 20:05:22 -04:00
# Block traffic into the router from network
add rule inet filter input meta iifname {bridgenic} counter drop
""".format(
vxlannic=self.base_nic,
2018-10-17 20:05:22 -04:00
bridgenic=self.bridge_nic
)
2018-11-14 00:19:43 -05:00
self.firewall_rules_v4 = """# Jump from forward chain to this chain when matching net (IPv4)
add rule inet filter forward ip daddr {netaddr4} counter jump {vxlannic}-in
add rule inet filter forward ip saddr {netaddr4} counter jump {vxlannic}-out
""".format(
netaddr4=self.ip4_network,
vxlannic=self.base_nic,
2018-11-14 00:19:43 -05:00
)
self.firewall_rules_v6 = """# Jump from forward chain to this chain when matching net (IPv4)
add rule inet filter forward ip6 daddr {netaddr6} counter jump {vxlannic}-in
add rule inet filter forward ip6 saddr {netaddr6} counter jump {vxlannic}-out
""".format(
netaddr6=self.ip6_network,
vxlannic=self.base_nic,
2018-11-14 00:19:43 -05:00
)
self.firewall_rules_in = self.zkhandler.children(('network.rule.in', self.vni))
self.firewall_rules_out = self.zkhandler.children(('network.rule.out', self.vni))
2018-10-17 20:05:22 -04:00
2018-09-23 15:26:41 -04:00
# Zookeper handlers for changed states
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network', self.vni))
2018-09-23 15:26:41 -04:00
def watch_network_description(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
if data and self.description != data.decode('ascii'):
self.old_description = self.description
2018-09-23 15:26:41 -04:00
self.description = data.decode('ascii')
if self.dhcp_server_daemon:
self.stopDHCPServer()
self.startDHCPServer()
2018-09-23 15:26:41 -04:00
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.domain', self.vni))
2018-09-30 13:52:46 -04:00
def watch_network_domain(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
if data and self.domain != data.decode('ascii'):
2018-09-30 13:52:46 -04:00
domain = data.decode('ascii')
if self.dhcp_server_daemon:
self.dns_aggregator.remove_network(self)
2018-09-30 13:52:46 -04:00
self.domain = domain
if self.dhcp_server_daemon:
self.dns_aggregator.add_network(self)
self.stopDHCPServer()
self.startDHCPServer()
2018-09-30 13:52:46 -04:00
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.nameservers', self.vni))
2019-12-08 23:32:03 -05:00
def watch_network_name_servers(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
if data and self.name_servers != data.decode('ascii'):
name_servers = data.decode('ascii').split(',')
if self.dhcp_server_daemon:
self.dns_aggregator.remove_network(self)
2019-12-08 23:32:03 -05:00
self.name_servers = name_servers
if self.dhcp_server_daemon:
self.dns_aggregator.add_network(self)
self.stopDHCPServer()
self.startDHCPServer()
2019-12-08 23:32:03 -05:00
# Try block for migration purposes
try:
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.mtu', self.vni))
def watch_network_mtu(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
if data and str(self.vx_mtu) != data.decode('ascii'):
self.vx_mtu = data.decode('ascii')
self.validateNetworkMTU()
self.updateNetworkMTU()
except Exception:
2021-10-12 17:11:03 -04:00
self.validateNetworkMTU()
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.ip6.network', self.vni))
2018-11-14 00:19:43 -05:00
def watch_network_ip6_network(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
2018-11-14 00:19:43 -05:00
if data and self.ip6_network != data.decode('ascii'):
ip6_network = data.decode('ascii')
self.ip6_network = ip6_network
self.ip6_cidrnetmask = ip6_network.split('/')[-1]
if self.dhcp_server_daemon:
self.stopDHCPServer()
self.startDHCPServer()
2018-09-23 15:26:41 -04:00
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.ip6.gateway', self.vni))
def watch_network_gateway6(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
2018-11-14 00:19:43 -05:00
if data and self.ip6_gateway != data.decode('ascii'):
orig_gateway = self.ip6_gateway
if self.this_node.router_state in ['primary', 'takeover']:
2018-09-30 19:19:06 -04:00
if orig_gateway:
2018-11-14 00:19:43 -05:00
self.removeGateway6Address()
2018-11-18 00:55:04 -05:00
self.ip6_gateway = data.decode('ascii')
if self.this_node.router_state in ['primary', 'takeover']:
2018-11-14 00:19:43 -05:00
self.createGateway6Address()
2018-11-18 00:55:04 -05:00
if self.dhcp_server_daemon:
self.stopDHCPServer()
self.startDHCPServer()
if self.dhcp_server_daemon:
self.stopDHCPServer()
self.startDHCPServer()
2018-09-23 15:26:41 -04:00
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.ip6.dhcp', self.vni))
def watch_network_dhcp6_status(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
2020-11-07 12:58:54 -05:00
if data and self.dhcp6_flag != (data.decode('ascii') == 'True'):
self.dhcp6_flag = (data.decode('ascii') == 'True')
if self.dhcp6_flag and not self.dhcp_server_daemon and self.this_node.router_state in ['primary', 'takeover']:
2018-09-30 13:52:46 -04:00
self.startDHCPServer()
elif self.dhcp_server_daemon and not self.dhcp4_flag and self.this_node.router_state in ['primary', 'takeover']:
self.stopDHCPServer()
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.ip4.network', self.vni))
2018-11-14 00:19:43 -05:00
def watch_network_ip4_network(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
2018-11-14 00:19:43 -05:00
if data and self.ip4_network != data.decode('ascii'):
ip4_network = data.decode('ascii')
self.ip4_network = ip4_network
self.ip4_cidrnetmask = ip4_network.split('/')[-1]
if self.dhcp_server_daemon:
self.stopDHCPServer()
self.startDHCPServer()
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.ip4.gateway', self.vni))
def watch_network_gateway4(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
2018-11-14 00:19:43 -05:00
if data and self.ip4_gateway != data.decode('ascii'):
orig_gateway = self.ip4_gateway
if self.this_node.router_state in ['primary', 'takeover']:
2018-11-14 00:19:43 -05:00
if orig_gateway:
self.removeGateway4Address()
2018-11-18 00:55:04 -05:00
self.ip4_gateway = data.decode('ascii')
if self.this_node.router_state in ['primary', 'takeover']:
2018-11-14 00:19:43 -05:00
self.createGateway4Address()
2018-11-18 00:55:04 -05:00
if self.dhcp_server_daemon:
self.stopDHCPServer()
self.startDHCPServer()
if self.dhcp_server_daemon:
self.stopDHCPServer()
self.startDHCPServer()
2018-11-14 00:19:43 -05:00
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.ip4.dhcp', self.vni))
def watch_network_dhcp4_status(data, stat, event=''):
2018-11-14 00:19:43 -05:00
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
2020-11-07 12:58:54 -05:00
if data and self.dhcp4_flag != (data.decode('ascii') == 'True'):
self.dhcp4_flag = (data.decode('ascii') == 'True')
if self.dhcp4_flag and not self.dhcp_server_daemon and self.this_node.router_state in ['primary', 'takeover']:
2018-11-14 00:19:43 -05:00
self.startDHCPServer()
elif self.dhcp_server_daemon and not self.dhcp6_flag and self.this_node.router_state in ['primary', 'takeover']:
2018-11-14 00:19:43 -05:00
self.stopDHCPServer()
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.ip4.dhcp_start', self.vni))
2018-11-14 00:19:43 -05:00
def watch_network_dhcp4_start(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
if data and self.dhcp4_start != data.decode('ascii'):
self.dhcp4_start = data.decode('ascii')
if self.dhcp_server_daemon:
self.stopDHCPServer()
self.startDHCPServer()
2018-11-14 00:19:43 -05:00
@self.zkhandler.zk_conn.DataWatch(self.zkhandler.schema.path('network.ip4.dhcp_end', self.vni))
2018-11-14 00:19:43 -05:00
def watch_network_dhcp4_end(data, stat, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
if data and self.dhcp4_end != data.decode('ascii'):
self.dhcp4_end = data.decode('ascii')
if self.dhcp_server_daemon:
self.stopDHCPServer()
self.startDHCPServer()
@self.zkhandler.zk_conn.ChildrenWatch(self.zkhandler.schema.path('network.reservation', self.vni))
def watch_network_dhcp_reservations(new_reservations, event=''):
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
if self.dhcp_reservations != new_reservations:
old_reservations = self.dhcp_reservations
self.dhcp_reservations = new_reservations
if self.this_node.router_state in ['primary', 'takeover']:
self.updateDHCPReservations(old_reservations, new_reservations)
if self.dhcp_server_daemon:
self.stopDHCPServer()
self.startDHCPServer()
@self.zkhandler.zk_conn.ChildrenWatch(self.zkhandler.schema.path('network.rule.in', self.vni))
def watch_network_firewall_rules_in(new_rules, event=''):
2018-10-04 00:10:13 -04:00
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
2018-10-17 20:05:22 -04:00
# Don't run on the first pass
if self.firewall_rules_in != new_rules:
self.firewall_rules_in = new_rules
self.updateFirewallRules()
@self.zkhandler.zk_conn.ChildrenWatch(self.zkhandler.schema.path('network.rule.out', self.vni))
def watch_network_firewall_rules_out(new_rules, event=''):
2018-10-17 20:05:22 -04:00
if event and event.type == 'DELETED':
# The key has been deleted after existing before; terminate this watcher
# because this class instance is about to be reaped in Daemon.py
return False
# Don't run on the first pass
if self.firewall_rules_out != new_rules:
self.firewall_rules_out = new_rules
self.updateFirewallRules()
2019-03-15 11:28:49 -04:00
self.createNetworkManaged()
self.createFirewall()
2018-10-03 23:38:25 -04:00
2018-09-24 01:34:20 -04:00
def getvni(self):
return self.vni
def validateNetworkMTU(self):
update_mtu = False
# Explicitly set the MTU to max_mtu if unset (in Zookeeper too assuming the key exists)
if self.vx_mtu == '' or self.vx_mtu is None:
self.logger.out(
'MTU not specified; setting to maximum MTU {} instead'.format(self.max_mtu),
prefix='VNI {}'.format(self.vni),
state='w'
)
self.vx_mtu = self.max_mtu
update_mtu = True
# Set MTU to an integer (if it's not)
2021-10-09 19:03:31 -04:00
if not isinstance(self.vx_mtu, int):
self.vx_mtu = int(self.vx_mtu)
# Ensure the MTU is valid
if self.vx_mtu > self.max_mtu:
self.logger.out(
'MTU {} is larger than maximum MTU {}; setting to maximum MTU instead'.format(self.vx_mtu, self.max_mtu),
prefix='VNI {}'.format(self.vni),
state='w'
)
self.vx_mtu = self.max_mtu
update_mtu = True
if update_mtu:
# Try block for migration purposes
try:
self.zkhandler.write([
(('network.mtu', self.vni), self.vx_mtu)
])
except Exception as e:
self.logger.out(
'Could not update MTU in Zookeeper: {}'.format(e),
prefix='VNI {}'.format(self.vni),
state='w'
)
def updateNetworkMTU(self):
2021-10-09 18:56:18 -04:00
self.logger.out(
'Setting network MTU to {}'.format(self.vx_mtu),
prefix='VNI {}'.format(self.vni),
state='i'
)
# Set MTU of base and bridge NICs
common.run_os_command(
'ip link set {} mtu {} up'.format(
self.base_nic,
self.vx_mtu
)
)
common.run_os_command(
'ip link set {} mtu {} up'.format(
self.bridge_nic,
self.vx_mtu
)
)
def updateDHCPReservations(self, old_reservations_list, new_reservations_list):
for reservation in new_reservations_list:
if reservation not in old_reservations_list:
# Add new reservation file
filename = '{}/{}'.format(self.dnsmasq_hostsdir, reservation)
ipaddr = self.zkhandler.read(('network.reservation', self.vni, 'reservation.ip', reservation))
entry = '{},{}'.format(reservation, ipaddr)
# Write the entry
with open(filename, 'w') as outfile:
outfile.write(entry)
for reservation in old_reservations_list:
if reservation not in new_reservations_list:
# Remove old reservation file
filename = '{}/{}'.format(self.dnsmasq_hostsdir, reservation)
try:
os.remove(filename)
self.dhcp_server_daemon.signal('hup')
2020-11-06 18:55:10 -05:00
except Exception:
pass
2018-10-17 20:05:22 -04:00
def updateFirewallRules(self):
2018-11-14 00:19:43 -05:00
if not self.ip4_network:
return
2018-10-17 20:05:22 -04:00
self.logger.out(
'Updating firewall rules',
prefix='VNI {}'.format(self.vni),
state='i'
2018-10-17 20:05:22 -04:00
)
ordered_acls_in = {}
ordered_acls_out = {}
sorted_acl_list = {'in': [], 'out': []}
full_ordered_rules = []
for acl in self.firewall_rules_in:
2021-06-13 20:56:17 -04:00
order = self.zkhandler.read(('network.rule.in', self.vni, 'rule.order', acl))
2018-10-17 20:05:22 -04:00
ordered_acls_in[order] = acl
for acl in self.firewall_rules_out:
2021-06-13 20:56:17 -04:00
order = self.zkhandler.read(('network.rule.out', self.vni, 'rule.order', acl))
2018-10-17 20:05:22 -04:00
ordered_acls_out[order] = acl
2018-10-17 20:05:22 -04:00
for order in sorted(ordered_acls_in.keys()):
sorted_acl_list['in'].append(ordered_acls_in[order])
for order in sorted(ordered_acls_out.keys()):
sorted_acl_list['out'].append(ordered_acls_out[order])
2020-11-06 19:44:14 -05:00
for direction in 'in', 'out':
2018-10-17 20:05:22 -04:00
for acl in sorted_acl_list[direction]:
rule_prefix = "add rule inet filter vxlan{}-{} counter".format(self.vni, direction)
2021-06-13 20:56:17 -04:00
rule_data = self.zkhandler.read((f'network.rule.{direction}', self.vni, 'rule.rule', acl))
2018-10-17 20:05:22 -04:00
rule = '{} {}'.format(rule_prefix, rule_data)
full_ordered_rules.append(rule)
2018-11-14 00:19:43 -05:00
firewall_rules = self.firewall_rules_base
if self.ip6_gateway != 'None':
firewall_rules += self.firewall_rules_v6
if self.ip4_gateway != 'None':
firewall_rules += self.firewall_rules_v4
2018-10-17 20:05:22 -04:00
output = "{}\n# User rules\n{}\n".format(
firewall_rules,
'\n'.join(full_ordered_rules))
2018-10-17 20:05:22 -04:00
with open(self.nftables_netconf_filename, 'w') as nfnetfile:
nfnetfile.write(dedent(output))
# Reload firewall rules
nftables_base_filename = '{}/base.nft'.format(self.config['nft_dynamic_directory'])
2021-06-01 12:17:25 -04:00
common.reload_firewall_rules(nftables_base_filename, logger=self.logger)
2019-03-15 11:28:49 -04:00
# Create bridged network configuration
def createNetworkBridged(self):
self.logger.out(
'Creating bridged vLAN device {} on interface {}'.format(
self.base_nic,
self.bridge_dev
2019-03-15 11:28:49 -04:00
),
prefix='VNI {}'.format(self.vni),
state='i'
2019-03-15 11:28:49 -04:00
)
# Create vLAN interface
2019-03-15 11:28:49 -04:00
common.run_os_command(
'ip link add link {} name {} type vlan id {}'.format(
self.bridge_dev,
self.base_nic,
2019-03-15 11:28:49 -04:00
self.vni
)
)
# Create bridge interface
2019-03-15 11:28:49 -04:00
common.run_os_command(
'brctl addbr {}'.format(
self.bridge_nic
)
)
self.updateNetworkMTU()
# Disable tx checksum offload on bridge interface (breaks DHCP on Debian < 9)
common.run_os_command(
'ethtool -K {} tx off'.format(
self.bridge_nic
)
)
# Disable IPv6 on bridge interface (prevents leakage)
2019-03-15 11:28:49 -04:00
common.run_os_command(
'sysctl net.ipv6.conf.{}.disable_ipv6=1'.format(
2019-03-15 11:28:49 -04:00
self.bridge_nic
)
)
# Add vLAN interface to bridge interface
common.run_os_command(
'brctl addif {} {}'.format(
self.bridge_nic,
self.base_nic
)
)
2019-03-15 11:28:49 -04:00
# Create managed network configuration
def createNetworkManaged(self):
self.logger.out(
'Creating VXLAN device on interface {}'.format(
self.cluster_dev
),
prefix='VNI {}'.format(self.vni),
state='i'
)
# Create VXLAN interface
common.run_os_command(
'ip link add {} type vxlan id {} dstport 4789 dev {}'.format(
self.base_nic,
self.vni,
self.cluster_dev
)
)
# Create bridge interface
common.run_os_command(
'brctl addbr {}'.format(
self.bridge_nic
)
)
self.updateNetworkMTU()
# Disable tx checksum offload on bridge interface (breaks DHCP on Debian < 9)
common.run_os_command(
'ethtool -K {} tx off'.format(
self.bridge_nic
)
)
# Disable IPv6 DAD on bridge interface
2018-11-27 22:19:14 -05:00
common.run_os_command(
'sysctl net.ipv6.conf.{}.accept_dad=0'.format(
self.bridge_nic
)
)
# Add VXLAN interface to bridge interface
common.run_os_command(
'brctl addif {} {}'.format(
self.bridge_nic,
self.base_nic
)
)
def createFirewall(self):
if self.nettype == 'managed':
# For future use
self.updateFirewallRules()
2018-11-14 00:19:43 -05:00
def createGateways(self):
if self.nettype == 'managed':
if self.ip6_gateway != 'None':
self.createGateway6Address()
if self.ip4_gateway != 'None':
self.createGateway4Address()
2018-11-14 00:19:43 -05:00
def createGateway6Address(self):
if self.this_node.router_state in ['primary', 'takeover']:
self.logger.out(
'Creating gateway {}/{} on interface {}'.format(
2018-11-14 00:19:43 -05:00
self.ip6_gateway,
self.ip6_cidrnetmask,
self.bridge_nic
),
prefix='VNI {}'.format(self.vni),
state='i'
)
2018-11-14 00:19:43 -05:00
common.createIPAddress(self.ip6_gateway, self.ip6_cidrnetmask, self.bridge_nic)
def createGateway4Address(self):
if self.this_node.router_state in ['primary', 'takeover']:
2018-11-14 00:19:43 -05:00
self.logger.out(
'Creating gateway {}/{} on interface {}'.format(
self.ip4_gateway,
self.ip4_cidrnetmask,
self.bridge_nic
),
prefix='VNI {}'.format(self.vni),
state='i'
2018-11-14 00:19:43 -05:00
)
common.createIPAddress(self.ip4_gateway, self.ip4_cidrnetmask, self.bridge_nic)
def startDHCPServer(self):
if self.this_node.router_state in ['primary', 'takeover'] and self.nettype == 'managed':
self.logger.out(
'Starting dnsmasq DHCP server on interface {}'.format(
self.bridge_nic
),
prefix='VNI {}'.format(self.vni),
state='i'
)
2018-11-18 00:55:04 -05:00
2018-10-03 23:38:25 -04:00
# Recreate the environment we need for dnsmasq
pvcnoded_config_file = os.environ['PVCD_CONFIG_FILE']
2018-10-03 23:38:25 -04:00
dhcp_environment = {
'DNSMASQ_BRIDGE_INTERFACE': self.bridge_nic,
'PVCD_CONFIG_FILE': pvcnoded_config_file
2018-10-03 23:38:25 -04:00
}
2018-11-18 00:55:04 -05:00
# Define the dnsmasq config fragments
2018-11-14 00:19:43 -05:00
dhcp_configuration_base = [
2018-10-03 23:38:25 -04:00
'--domain-needed',
'--bogus-priv',
'--no-hosts',
2018-11-14 00:19:43 -05:00
'--dhcp-authoritative',
2018-10-03 23:38:25 -04:00
'--filterwin2k',
'--expand-hosts',
'--domain-needed',
2018-10-03 23:38:25 -04:00
'--domain={}'.format(self.domain),
'--local=/{}/'.format(self.domain),
2018-11-14 00:19:43 -05:00
'--log-facility=-',
2018-11-18 00:55:04 -05:00
'--log-dhcp',
2018-11-14 00:19:43 -05:00
'--keep-in-foreground',
2018-10-03 23:38:25 -04:00
'--leasefile-ro',
'--dhcp-script={}/pvcnoded/dnsmasq-zookeeper-leases.py'.format(os.getcwd()),
2018-10-03 23:38:25 -04:00
'--dhcp-hostsdir={}'.format(self.dnsmasq_hostsdir),
2018-11-14 00:19:43 -05:00
'--bind-interfaces',
2018-10-03 23:38:25 -04:00
]
2018-11-14 00:19:43 -05:00
dhcp_configuration_v4 = [
'--listen-address={}'.format(self.ip4_gateway),
'--auth-zone={}'.format(self.domain),
2018-11-14 00:19:43 -05:00
'--auth-peer={}'.format(self.ip4_gateway),
'--auth-server={}'.format(self.ip4_gateway),
2018-11-14 00:19:43 -05:00
'--auth-sec-servers={}'.format(self.ip4_gateway),
2020-01-06 22:31:37 -05:00
]
dhcp_configuration_v4_dhcp = [
2018-11-14 00:19:43 -05:00
'--dhcp-option=option:ntp-server,{}'.format(self.ip4_gateway),
'--dhcp-range={},{},48h'.format(self.dhcp4_start, self.dhcp4_end),
]
dhcp_configuration_v6 = [
'--listen-address={}'.format(self.ip6_gateway),
'--auth-zone={}'.format(self.domain),
2018-11-14 00:19:43 -05:00
'--auth-peer={}'.format(self.ip6_gateway),
'--auth-server={}'.format(self.ip6_gateway),
2018-11-14 00:19:43 -05:00
'--auth-sec-servers={}'.format(self.ip6_gateway),
'--dhcp-option=option6:dns-server,[{}]'.format(self.ip6_gateway),
'--dhcp-option=option6:sntp-server,[{}]'.format(self.ip6_gateway),
'--enable-ra',
2018-11-18 00:55:04 -05:00
]
dhcp_configuration_v6_dualstack = [
2018-11-14 00:19:43 -05:00
'--dhcp-range=net:{nic},::,constructor:{nic},ra-stateless,ra-names'.format(nic=self.bridge_nic),
]
2018-11-18 00:55:04 -05:00
dhcp_configuration_v6_only = [
'--auth-server={}'.format(self.ip6_gateway),
2018-11-18 00:55:04 -05:00
'--dhcp-range=net:{nic},::2,::ffff:ffff:ffff:ffff,constructor:{nic},64,24h'.format(nic=self.bridge_nic),
]
# Assemble the DHCP configuration
2018-11-14 00:19:43 -05:00
dhcp_configuration = dhcp_configuration_base
if self.dhcp6_flag:
dhcp_configuration += dhcp_configuration_v6
2018-11-18 00:55:04 -05:00
if self.dhcp4_flag:
dhcp_configuration += dhcp_configuration_v6_dualstack
else:
dhcp_configuration += dhcp_configuration_v6_only
2020-01-06 22:31:37 -05:00
else:
dhcp_configuration += dhcp_configuration_v4
if self.dhcp4_flag:
2020-11-06 19:44:14 -05:00
dhcp_configuration += dhcp_configuration_v4_dhcp
2018-11-18 00:55:04 -05:00
2018-10-03 23:38:25 -04:00
# Start the dnsmasq process in a thread
2018-11-14 00:19:43 -05:00
print('/usr/sbin/dnsmasq {}'.format(' '.join(dhcp_configuration)))
2018-10-03 23:38:25 -04:00
self.dhcp_server_daemon = common.run_os_daemon(
'/usr/sbin/dnsmasq {}'.format(
' '.join(dhcp_configuration)
),
environment=dhcp_environment,
logfile='{}/dnsmasq-{}.log'.format(self.config['dnsmasq_log_directory'], self.vni)
)
2019-03-15 11:28:49 -04:00
# Remove network
2018-09-23 15:26:41 -04:00
def removeNetwork(self):
2019-03-15 11:28:49 -04:00
if self.nettype == 'bridged':
self.removeNetworkBridged()
elif self.nettype == 'managed':
self.removeNetworkManaged()
# Remove bridged network configuration
def removeNetworkBridged(self):
self.logger.out(
'Removing VNI device on interface {}'.format(
self.cluster_dev
2019-03-15 11:28:49 -04:00
),
prefix='VNI {}'.format(self.vni),
state='i'
2019-03-15 11:28:49 -04:00
)
common.run_os_command(
'ip link set {} down'.format(
self.bridge_nic
)
)
common.run_os_command(
'ip link set {} down'.format(
self.base_nic
2019-03-15 11:28:49 -04:00
)
)
common.run_os_command(
'brctl delif {} {}'.format(
self.bridge_nic,
self.base_nic
2019-03-15 11:28:49 -04:00
)
)
common.run_os_command(
'brctl delbr {}'.format(
self.bridge_nic
)
)
common.run_os_command(
'ip link delete {}'.format(
self.base_nic
2019-03-15 11:28:49 -04:00
)
)
# Remove managed network configuration
def removeNetworkManaged(self):
self.logger.out(
'Removing VNI device on interface {}'.format(
self.cluster_dev
),
prefix='VNI {}'.format(self.vni),
state='i'
)
common.run_os_command(
'ip link set {} down'.format(
self.bridge_nic
)
)
common.run_os_command(
'ip link set {} down'.format(
self.base_nic
)
)
common.run_os_command(
'brctl delif {} {}'.format(
self.bridge_nic,
self.base_nic
)
)
common.run_os_command(
'brctl delbr {}'.format(
self.bridge_nic
)
)
common.run_os_command(
'ip link delete {}'.format(
self.base_nic
)
)
def removeFirewall(self):
2018-10-17 20:05:22 -04:00
self.logger.out(
'Removing firewall rules',
prefix='VNI {}'.format(self.vni),
state='i'
2018-10-17 20:05:22 -04:00
)
try:
os.remove(self.nftables_netconf_filename)
2020-11-06 18:55:10 -05:00
except Exception:
2018-10-17 20:05:22 -04:00
pass
# Reload firewall rules
nftables_base_filename = '{}/base.nft'.format(self.config['nft_dynamic_directory'])
2021-06-01 12:17:25 -04:00
common.reload_firewall_rules(nftables_base_filename, logger=self.logger)
2018-11-14 00:19:43 -05:00
def removeGateways(self):
2019-03-17 13:19:44 -04:00
if self.nettype == 'managed':
if self.ip6_gateway != 'None':
self.removeGateway6Address()
if self.ip4_gateway != 'None':
self.removeGateway4Address()
2018-11-14 00:19:43 -05:00
def removeGateway6Address(self):
self.logger.out(
'Removing gateway {}/{} from interface {}'.format(
self.ip6_gateway,
self.ip6_cidrnetmask,
self.bridge_nic
),
prefix='VNI {}'.format(self.vni),
state='i'
2018-11-14 00:19:43 -05:00
)
common.removeIPAddress(self.ip6_gateway, self.ip6_cidrnetmask, self.bridge_nic)
def removeGateway4Address(self):
self.logger.out(
'Removing gateway {}/{} from interface {}'.format(
2018-11-14 00:19:43 -05:00
self.ip4_gateway,
self.ip4_cidrnetmask,
self.bridge_nic
),
prefix='VNI {}'.format(self.vni),
state='i'
)
2018-11-14 00:19:43 -05:00
common.removeIPAddress(self.ip4_gateway, self.ip4_cidrnetmask, self.bridge_nic)
def stopDHCPServer(self):
2019-03-17 12:35:25 -04:00
if self.nettype == 'managed' and self.dhcp_server_daemon:
self.logger.out(
'Stopping dnsmasq DHCP server on interface {}'.format(
self.bridge_nic
),
prefix='VNI {}'.format(self.vni),
state='i'
)
# Terminate, then kill
self.dhcp_server_daemon.signal('term')
time.sleep(0.2)
self.dhcp_server_daemon.signal('kill')
2018-11-14 00:19:43 -05:00
self.dhcp_server_daemon = None