4623N/A#!/usr/bin/python2.7
2605N/A
6033N/A# Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.
2605N/A#
2605N/A# Licensed under the Apache License, Version 2.0 (the "License"); you may
2605N/A# not use this file except in compliance with the License. You may obtain
2605N/A# a copy of the License at
2605N/A#
2605N/A# http://www.apache.org/licenses/LICENSE-2.0
2605N/A#
2605N/A# Unless required by applicable law or agreed to in writing, software
2605N/A# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
2605N/A# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
2605N/A# License for the specific language governing permissions and limitations
2605N/A# under the License.
2605N/A
2605N/Aimport os
2900N/Aimport re
2605N/Aimport sys
2605N/A
2900N/Aimport netaddr
2605N/Aimport smf_include
2605N/A
2900N/Afrom subprocess import CalledProcessError, Popen, PIPE, check_call
6033N/Afrom neutron_vpnaas.services.vpn.device_drivers.solaris_ipsec import \
6033N/A get_vpn_interfaces
6033N/Afrom neutron_vpnaas.services.vpn.device_drivers.solaris_ipsec import \
6033N/A shutdown_vpn
2681N/A
2605N/A
4070N/Adef set_hostmodel(value):
4070N/A cmd = ["/usr/sbin/ipadm", "show-prop", "-p", "hostmodel",
4070N/A "-co", "current", "ipv4"]
4070N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
4070N/A output, error = p.communicate()
4070N/A if p.returncode != 0:
4070N/A print "failed to retrieve hostmodel ipadm property"
4070N/A return False
4070N/A if output.strip() == value:
4070N/A return True
4070N/A cmd = ["/usr/sbin/ipadm", "set-prop", "-t", "-p", "hostmodel=%s" % value,
4070N/A "ipv4"]
4070N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
4070N/A output, error = p.communicate()
4070N/A if p.returncode != 0:
4070N/A print "failed to set ipadm hostmodel property to %s" % value
4070N/A return False
4070N/A return True
4070N/A
4070N/A
2605N/Adef start():
2605N/A # verify paths are valid
6033N/A for f in sys.argv[2:5]:
2605N/A if not os.path.exists(f) or not os.access(f, os.R_OK):
2605N/A print '%s does not exist or is not readable' % f
2605N/A return smf_include.SMF_EXIT_ERR_CONFIG
2605N/A
2681N/A # System-wide forwarding (either ipv4 or ipv6 or both) must be enabled
2681N/A # before neutron-l3-agent can be started.
2681N/A cmd = ["/usr/sbin/ipadm", "show-prop", "-c", "-p", "forwarding",
2681N/A "-o", "current", "ipv4"]
2681N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
2681N/A output, error = p.communicate()
2681N/A if p.returncode != 0:
2681N/A print "failed to determine if IPv4 forwarding is enabled or not"
2681N/A return smf_include.SMF_EXIT_ERR_FATAL
2681N/A v4fwding = "on" in output
2681N/A
2681N/A cmd = ["/usr/sbin/ipadm", "show-prop", "-c", "-p", "forwarding",
2681N/A "-o", "current", "ipv6"]
2681N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
2681N/A output, error = p.communicate()
2681N/A if p.returncode != 0:
2681N/A print "failed to determine if IPv6 forwarding is enabled or not"
2681N/A return smf_include.SMF_EXIT_ERR_FATAL
2681N/A v6fwding = "on" in output
2681N/A
2681N/A if not any((v4fwding, v6fwding)):
2900N/A print "System-wide IPv4 or IPv6 (or both) forwarding must be " \
2900N/A "enabled before enabling neutron-l3-agent"
2681N/A return smf_include.SMF_EXIT_ERR_CONFIG
2681N/A
6033N/A cmd = "/usr/lib/neutron/neutron-l3-agent --config-file %s " \
6033N/A "--config-file %s --config-file %s" % tuple(sys.argv[2:5])
6033N/A
6033N/A # The VPNaaS shutdown should unplumb all IP tunnels it created. But
6033N/A # be paranoid and check for lingering tunnels created by OpenStack
6033N/A # that may have been left behind if the OpenStack device driver exits
6033N/A # unexpectedly. OpenStack VPN configuration is created when the service
6033N/A # starts. Errors will occur if old IP tunnels still exist.
6033N/A
6033N/A vpn_ifs = get_vpn_interfaces()
6033N/A if vpn_ifs:
6033N/A print "Error: Found existing IP tunnel interface(s)."
6033N/A print "Use ipadm(1M) and dladm(1M) to remove it/them."
6033N/A print "Then use svcadm(1M) to clear the service."
6033N/A print "Use the following commands to remove:"
6033N/A for ifn in vpn_ifs:
6033N/A print "\t# ipadm delete-ip %s; dladm delete-iptun %s" % (ifn, ifn)
6033N/A
6033N/A return smf_include.SMF_EXIT_ERR_CONFIG
6033N/A
4070N/A # set the hostmodel property if necessary
4070N/A if not set_hostmodel("src-priority"):
4070N/A return smf_include.SMF_EXIT_ERR_FATAL
4070N/A
6033N/A return smf_include.smf_subprocess(cmd)
2605N/A
2900N/A
2949N/Adef remove_ipfilter_rules(version):
2949N/A # remove IP Filter rules added by neutron-l3-agent
2949N/A cmd = ["/usr/bin/pfexec", "/usr/sbin/ipfstat", "-io"]
2949N/A if version == 6:
2949N/A cmd.insert(2, "-6")
2949N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
2949N/A output, error = p.communicate()
2949N/A if p.returncode != 0:
2949N/A print "failed to retrieve IP Filter rules"
2949N/A return smf_include.SMF_EXIT_ERR_FATAL
2949N/A
2949N/A ipfilters = output.splitlines()
2949N/A # L3 agent IP Filter rules are of the form
2949N/A # block in quick on l3i64cbb496_a_0 from ... to pool/15417332
2949N/A prog = re.compile('on l3i[0-9A-Fa-f\_]{10}_0')
2949N/A ippool_names = []
2949N/A for ipf in ipfilters:
2949N/A if not prog.search(ipf):
2949N/A continue
2949N/A # capture the IP pool name
3202N/A if 'pool/' in ipf:
3202N/A ippool_names.append(ipf.split('pool/')[1])
2949N/A
2949N/A try:
2949N/A # remove the IP Filter rule
2949N/A p = Popen(["echo", ipf], stdout=PIPE)
2949N/A cmd = ["/usr/bin/pfexec", "/usr/sbin/ipf", "-r", "-f", "-"]
2949N/A if version == 6:
2949N/A cmd.insert(2, "-6")
2949N/A check_call(cmd, stdin=p.stdout)
2949N/A except CalledProcessError as err:
2949N/A print "failed to remove IP Filter rule %s: %s" % (ipf, err)
2949N/A return smf_include.SMF_EXIT_ERR_FATAL
2949N/A
2949N/A # remove IP Pools added by neutron-l3-agent
2949N/A for ippool_name in ippool_names:
2949N/A try:
2949N/A check_call(["/usr/bin/pfexec", "/usr/sbin/ippool", "-R",
2949N/A "-m", ippool_name, "-t", "tree"])
2949N/A except CalledProcessError as err:
2949N/A print "failed to remove IP Pool %s: %s" % (ippool_name, err)
2949N/A return smf_include.SMF_EXIT_ERR_FATAL
2949N/A return smf_include.SMF_EXIT_OK
2949N/A
2949N/A
2900N/Adef stop():
6033N/A shutdown_vpn()
2900N/A try:
2900N/A # first kill the SMF contract
2900N/A check_call(["/usr/bin/pkill", "-c", sys.argv[2]])
2900N/A except CalledProcessError as err:
2900N/A print "failed to kill the SMF contract: %s" % (err)
2900N/A
3202N/A # We need to first remove the IP filter rules and then remove
3202N/A # the IP interfaces on which the rules were applied.
2900N/A
2949N/A # remove IPv4 Filter rules added by neutron-l3-agent
2949N/A rv = remove_ipfilter_rules(4)
2949N/A if rv != smf_include.SMF_EXIT_OK:
2949N/A return rv
2900N/A
2949N/A # remove IPv6 Filter rules added by neutron-l3-agent
2949N/A rv = remove_ipfilter_rules(6)
2949N/A if rv != smf_include.SMF_EXIT_OK:
2949N/A return rv
2900N/A
2900N/A # remove IP NAT rules added by neutron-l3-agent
2900N/A cmd = ["/usr/bin/pfexec", "/usr/sbin/ipnat", "-lR"]
2900N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
2900N/A output, error = p.communicate()
2900N/A if p.returncode != 0:
2900N/A print "failed to retrieve IP NAT rules"
2900N/A return smf_include.SMF_EXIT_ERR_FATAL
2900N/A
2900N/A ipnat_rules = output.splitlines()
2900N/A # L3 agent IP NAT rules are of the form
4070N/A # bimap l3e64ccc496_a_0 .... OR
4070N/A # rdr l3iedf345cc96_a_0 ....
4070N/A prog = re.compile('l3[ie][0-9A-Fa-f\_]{10}_0')
2900N/A for ipnat_rule in ipnat_rules:
2900N/A if not prog.search(ipnat_rule):
2900N/A continue
2900N/A # remove the IP NAT rule
2900N/A try:
2900N/A p = Popen(["echo", ipnat_rule], stdout=PIPE)
2900N/A check_call(["/usr/bin/pfexec", "/usr/sbin/ipnat", "-r", "-f", "-"],
2900N/A stdin=p.stdout)
2900N/A except CalledProcessError as err:
2900N/A print "failed to remove IP NAT rule %s: %s" % (ipnat_rule, err)
2900N/A return smf_include.SMF_EXIT_ERR_FATAL
2900N/A
3202N/A # remove VNICs associated with L3 agent
3202N/A cmd = ["/usr/sbin/ipadm", "show-if", "-p", "-o", "ifname"]
3202N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
3202N/A output, error = p.communicate()
3202N/A if p.returncode != 0:
3202N/A print "failed to retrieve IP interface names"
3202N/A return smf_include.SMF_EXIT_ERR_CONFIG
3202N/A
3202N/A ifnames = output.splitlines()
3202N/A # L3 agent datalinks are always 15 characters in length. They start
3202N/A # with either 'l3i' or 'l3e', end with '_0', and in between they are
3202N/A # hexadecimal digits.
3202N/A prog = re.compile('l3[ie][0-9A-Fa-f\_]{10}_0')
3202N/A for ifname in ifnames:
3202N/A if not prog.search(ifname):
3202N/A continue
3202N/A try:
3202N/A # first remove the IP
3202N/A check_call(["/usr/bin/pfexec", "/usr/sbin/ipadm", "delete-ip",
3202N/A ifname])
3202N/A # next remove the VNIC
3202N/A check_call(["/usr/bin/pfexec", "/usr/sbin/dladm", "delete-vnic",
3202N/A ifname])
3202N/A except CalledProcessError as err:
3202N/A print "failed to remove datalinks used by L3 agent: %s" % (err)
3202N/A return smf_include.SMF_EXIT_ERR_FATAL
3202N/A
4070N/A # finally reset the hostmodel property
4070N/A if not set_hostmodel("weak"):
4070N/A return smf_include.SMF_EXIT_ERR_FATAL
2900N/A return smf_include.SMF_EXIT_OK
2900N/A
2605N/Aif __name__ == "__main__":
2605N/A os.putenv("LC_ALL", "C")
2605N/A smf_include.smf_main()