|
| 1 | +#!/usr/bin/env python3 |
| 2 | +# |
| 3 | +# Copyright (C) 2022 VyOS maintainers and contributors |
| 4 | +# |
| 5 | +# This program is free software; you can redistribute it and/or modify |
| 6 | +# it under the terms of the GNU General Public License version 2 or later as |
| 7 | +# published by the Free Software Foundation. |
| 8 | +# |
| 9 | +# This program is distributed in the hope that it will be useful, |
| 10 | +# but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 11 | +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 12 | +# GNU General Public License for more details. |
| 13 | +# |
| 14 | +# You should have received a copy of the GNU General Public License |
| 15 | +# along with this program. If not, see <http://www.gnu.org/licenses/>. |
| 16 | + |
| 17 | +import os |
| 18 | + |
| 19 | +from vyos.utils.process import run |
| 20 | + |
| 21 | +dhclient_lease = '/var/lib/dhcp/dhclient_{0}.lease' |
| 22 | + |
| 23 | +def nft_rule(rule_conf, rule_id, local=False, exclude=False, limit=False, weight=None, health_state=None, action=None, restore_mark=False): |
| 24 | + output = [] |
| 25 | + |
| 26 | + if 'inbound_interface' in rule_conf: |
| 27 | + ifname = rule_conf['inbound_interface'] |
| 28 | + if local and not exclude: |
| 29 | + output.append(f'oifname != "{ifname}"') |
| 30 | + elif not local: |
| 31 | + output.append(f'iifname "{ifname}"') |
| 32 | + |
| 33 | + if 'protocol' in rule_conf and rule_conf['protocol'] != 'all': |
| 34 | + protocol = rule_conf['protocol'] |
| 35 | + |
| 36 | + if protocol == 'tcp_udp': |
| 37 | + protocol = '{ tcp, udp }' |
| 38 | + |
| 39 | + output.append(f'meta l4proto {protocol}') |
| 40 | + |
| 41 | + for direction in ['source', 'destination']: |
| 42 | + if direction not in rule_conf: |
| 43 | + continue |
| 44 | + |
| 45 | + direction_conf = rule_conf[direction] |
| 46 | + prefix = direction[:1] |
| 47 | + |
| 48 | + if 'address' in direction_conf: |
| 49 | + operator = '' |
| 50 | + address = direction_conf['address'] |
| 51 | + if address[:1] == '!': |
| 52 | + operator = '!=' |
| 53 | + address = address[1:] |
| 54 | + output.append(f'ip {prefix}addr {operator} {address}') |
| 55 | + |
| 56 | + if 'port' in direction_conf: |
| 57 | + operator = '' |
| 58 | + port = direction_conf['port'] |
| 59 | + if port[:1] == '!': |
| 60 | + operator = '!=' |
| 61 | + port = port[1:] |
| 62 | + output.append(f'th {prefix}port {operator} {port}') |
| 63 | + |
| 64 | + if 'source_based_routing' not in rule_conf and not restore_mark: |
| 65 | + output.append('ct state new') |
| 66 | + |
| 67 | + if limit and 'limit' in rule_conf and 'rate' in rule_conf['limit']: |
| 68 | + output.append(f'limit rate {rule_conf["limit"]["rate"]}/{rule_conf["limit"]["period"]}') |
| 69 | + if 'burst' in rule_conf['limit']: |
| 70 | + output.append(f'burst {rule_conf["limit"]["burst"]} packets') |
| 71 | + |
| 72 | + output.append('counter') |
| 73 | + |
| 74 | + if restore_mark: |
| 75 | + output.append('meta mark set ct mark') |
| 76 | + elif weight: |
| 77 | + weights, total_weight = wlb_weight_interfaces(rule_conf, health_state) |
| 78 | + if len(weights) > 1: # Create weight-based verdict map |
| 79 | + vmap_str = ", ".join(f'{weight} : jump wlb_mangle_isp_{ifname}' for ifname, weight in weights) |
| 80 | + output.append(f'numgen random mod {total_weight} vmap {{ {vmap_str} }}') |
| 81 | + elif len(weights) == 1: # Jump to single ISP |
| 82 | + ifname, _ = weights[0] |
| 83 | + output.append(f'jump wlb_mangle_isp_{ifname}') |
| 84 | + else: # No healthy interfaces |
| 85 | + return "" |
| 86 | + elif action: |
| 87 | + output.append(action) |
| 88 | + |
| 89 | + return " ".join(output) |
| 90 | + |
| 91 | +def wlb_weight_interfaces(rule_conf, health_state): |
| 92 | + interfaces = [(ifname, int(if_conf.get('weight', 1))) for ifname, if_conf in rule_conf['interface'].items() if health_state[ifname]['state']] |
| 93 | + |
| 94 | + if not interfaces: |
| 95 | + return [], 0 |
| 96 | + |
| 97 | + if 'failover' in rule_conf: |
| 98 | + for ifpair in sorted(interfaces, key=lambda i: i[1], reverse=True): |
| 99 | + return [ifpair], ifpair[1] # Return highest weight interface that is ACTIVE when in failover |
| 100 | + |
| 101 | + total_weight = sum(weight for ifname, weight in interfaces) |
| 102 | + out = [] |
| 103 | + start = 0 |
| 104 | + for ifname, weight in sorted(interfaces, key=lambda i: i[1]): # build weight ranges |
| 105 | + end = start + weight - 1 |
| 106 | + out.append((ifname, f'{start}-{end}' if end > start else start)) |
| 107 | + start = weight |
| 108 | + |
| 109 | + return out, total_weight |
| 110 | + |
| 111 | +def health_ping_host(host, ifname, count=1, wait_time=0): |
| 112 | + cmd_str = f'ping -c {count} -W {wait_time} -I {ifname} {host}' |
| 113 | + rc = run(cmd_str) |
| 114 | + return rc == 0 |
| 115 | + |
| 116 | +def health_ping_host_ttl(host, ifname, count=1, ttl_limit=0): |
| 117 | + cmd_str = f'ping -c {count} -t {ttl_limit} -I {ifname} {host}' |
| 118 | + rc = run(cmd_str) |
| 119 | + return rc != 0 |
| 120 | + |
| 121 | +def parse_dhcp_nexthop(ifname): |
| 122 | + lease_file = dhclient_lease.format(ifname) |
| 123 | + |
| 124 | + if not os.path.exists(lease_file): |
| 125 | + return False |
| 126 | + |
| 127 | + with open(lease_file, 'r') as f: |
| 128 | + for line in f.readlines(): |
| 129 | + data = line.replace('\n', '').split('=') |
| 130 | + if data[0] == 'new_routers': |
| 131 | + return data[1].replace("'", '').split(" ")[0] |
| 132 | + |
| 133 | + return None |
0 commit comments