neutron-l3-agent revision 5403
b614993b942a5222f6d88ae5e9974334484d74f2nd#!/usr/bin/python2.7
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd# Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.
b614993b942a5222f6d88ae5e9974334484d74f2nd#
b614993b942a5222f6d88ae5e9974334484d74f2nd# Licensed under the Apache License, Version 2.0 (the "License"); you may
b614993b942a5222f6d88ae5e9974334484d74f2nd# not use this file except in compliance with the License. You may obtain
b614993b942a5222f6d88ae5e9974334484d74f2nd# a copy of the License at
b614993b942a5222f6d88ae5e9974334484d74f2nd#
b614993b942a5222f6d88ae5e9974334484d74f2nd# http://www.apache.org/licenses/LICENSE-2.0
b614993b942a5222f6d88ae5e9974334484d74f2nd#
b614993b942a5222f6d88ae5e9974334484d74f2nd# Unless required by applicable law or agreed to in writing, software
b614993b942a5222f6d88ae5e9974334484d74f2nd# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
b614993b942a5222f6d88ae5e9974334484d74f2nd# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
b614993b942a5222f6d88ae5e9974334484d74f2nd# License for the specific language governing permissions and limitations
b614993b942a5222f6d88ae5e9974334484d74f2nd# under the License.
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2ndimport os
b614993b942a5222f6d88ae5e9974334484d74f2ndimport re
b614993b942a5222f6d88ae5e9974334484d74f2ndimport sys
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2ndimport netaddr
b614993b942a5222f6d88ae5e9974334484d74f2ndimport smf_include
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2ndfrom subprocess import CalledProcessError, Popen, PIPE, check_call
b614993b942a5222f6d88ae5e9974334484d74f2ndfrom neutron_vpnaas.services.vpn.device_drivers.solaris_ipsec import \
b614993b942a5222f6d88ae5e9974334484d74f2nd get_vpn_interfaces
b614993b942a5222f6d88ae5e9974334484d74f2ndfrom neutron_vpnaas.services.vpn.device_drivers.solaris_ipsec import \
b614993b942a5222f6d88ae5e9974334484d74f2nd shutdown_vpn
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nddef set_hostmodel(value):
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd = ["/usr/sbin/ipadm", "show-prop", "-p", "hostmodel",
b614993b942a5222f6d88ae5e9974334484d74f2nd "-co", "current", "ipv4"]
b614993b942a5222f6d88ae5e9974334484d74f2nd p = Popen(cmd, stdout=PIPE, stderr=PIPE)
b614993b942a5222f6d88ae5e9974334484d74f2nd output, error = p.communicate()
b614993b942a5222f6d88ae5e9974334484d74f2nd if p.returncode != 0:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "failed to retrieve hostmodel ipadm property"
b614993b942a5222f6d88ae5e9974334484d74f2nd return False
b614993b942a5222f6d88ae5e9974334484d74f2nd if output.strip() == value:
b614993b942a5222f6d88ae5e9974334484d74f2nd return True
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd = ["/usr/sbin/ipadm", "set-prop", "-t", "-p", "hostmodel=%s" % value,
b614993b942a5222f6d88ae5e9974334484d74f2nd "ipv4"]
b614993b942a5222f6d88ae5e9974334484d74f2nd p = Popen(cmd, stdout=PIPE, stderr=PIPE)
b614993b942a5222f6d88ae5e9974334484d74f2nd output, error = p.communicate()
b614993b942a5222f6d88ae5e9974334484d74f2nd if p.returncode != 0:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "failed to set ipadm hostmodel property to %s" % value
b614993b942a5222f6d88ae5e9974334484d74f2nd return False
b614993b942a5222f6d88ae5e9974334484d74f2nd return True
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nddef start():
b614993b942a5222f6d88ae5e9974334484d74f2nd # verify paths are valid
b614993b942a5222f6d88ae5e9974334484d74f2nd for f in sys.argv[2:5]:
b614993b942a5222f6d88ae5e9974334484d74f2nd if not os.path.exists(f) or not os.access(f, os.R_OK):
b614993b942a5222f6d88ae5e9974334484d74f2nd print '%s does not exist or is not readable' % f
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_CONFIG
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd # System-wide forwarding (either ipv4 or ipv6 or both) must be enabled
b614993b942a5222f6d88ae5e9974334484d74f2nd # before neutron-l3-agent can be started.
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd = ["/usr/sbin/ipadm", "show-prop", "-c", "-p", "forwarding",
b614993b942a5222f6d88ae5e9974334484d74f2nd "-o", "current", "ipv4"]
b614993b942a5222f6d88ae5e9974334484d74f2nd p = Popen(cmd, stdout=PIPE, stderr=PIPE)
b614993b942a5222f6d88ae5e9974334484d74f2nd output, error = p.communicate()
b614993b942a5222f6d88ae5e9974334484d74f2nd if p.returncode != 0:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "failed to determine if IPv4 forwarding is enabled or not"
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_FATAL
b614993b942a5222f6d88ae5e9974334484d74f2nd v4fwding = "on" in output
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd = ["/usr/sbin/ipadm", "show-prop", "-c", "-p", "forwarding",
b614993b942a5222f6d88ae5e9974334484d74f2nd "-o", "current", "ipv6"]
b614993b942a5222f6d88ae5e9974334484d74f2nd p = Popen(cmd, stdout=PIPE, stderr=PIPE)
b614993b942a5222f6d88ae5e9974334484d74f2nd output, error = p.communicate()
b614993b942a5222f6d88ae5e9974334484d74f2nd if p.returncode != 0:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "failed to determine if IPv6 forwarding is enabled or not"
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_FATAL
b614993b942a5222f6d88ae5e9974334484d74f2nd v6fwding = "on" in output
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd if not any((v4fwding, v6fwding)):
b614993b942a5222f6d88ae5e9974334484d74f2nd print "System-wide IPv4 or IPv6 (or both) forwarding must be " \
b614993b942a5222f6d88ae5e9974334484d74f2nd "enabled before enabling neutron-l3-agent"
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_CONFIG
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd = "/usr/lib/neutron/neutron-l3-agent --config-file %s " \
b614993b942a5222f6d88ae5e9974334484d74f2nd "--config-file %s --config-file %s" % tuple(sys.argv[2:5])
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd # The VPNaaS shutdown should unplumb all IP tunnels it created. But
b614993b942a5222f6d88ae5e9974334484d74f2nd # be paranoid and check for lingering tunnels created by OpenStack
b614993b942a5222f6d88ae5e9974334484d74f2nd # that may have been left behind if the OpenStack device driver exits
b614993b942a5222f6d88ae5e9974334484d74f2nd # unexpectedly. OpenStack VPN configuration is created when the service
b614993b942a5222f6d88ae5e9974334484d74f2nd # starts. Errors will occur if old IP tunnels still exist.
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd vpn_ifs = get_vpn_interfaces()
b614993b942a5222f6d88ae5e9974334484d74f2nd if vpn_ifs:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "Error: Found existing IP tunnel interface(s)."
b614993b942a5222f6d88ae5e9974334484d74f2nd print "Use ipadm(1M) and dladm(1M) to remove it/them."
b614993b942a5222f6d88ae5e9974334484d74f2nd print "Then use svcadm(1M) to clear the service."
b614993b942a5222f6d88ae5e9974334484d74f2nd print "Use the following commands to remove:"
b614993b942a5222f6d88ae5e9974334484d74f2nd for interface in vpn_ifs:
b614993b942a5222f6d88ae5e9974334484d74f2nd ifn = interface.group(0)
b614993b942a5222f6d88ae5e9974334484d74f2nd print "\t# ipadm delete-ip %s; dladm delete-iptun %s" % (ifn, ifn)
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_CONFIG
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd # set the hostmodel property if necessary
b614993b942a5222f6d88ae5e9974334484d74f2nd if not set_hostmodel("src-priority"):
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_FATAL
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.smf_subprocess(cmd)
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nddef remove_ipfilter_rules(version):
b614993b942a5222f6d88ae5e9974334484d74f2nd # remove IP Filter rules added by neutron-l3-agent
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd = ["/usr/bin/pfexec", "/usr/sbin/ipfstat", "-io"]
b614993b942a5222f6d88ae5e9974334484d74f2nd if version == 6:
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd.insert(2, "-6")
b614993b942a5222f6d88ae5e9974334484d74f2nd p = Popen(cmd, stdout=PIPE, stderr=PIPE)
b614993b942a5222f6d88ae5e9974334484d74f2nd output, error = p.communicate()
b614993b942a5222f6d88ae5e9974334484d74f2nd if p.returncode != 0:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "failed to retrieve IP Filter rules"
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_FATAL
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd ipfilters = output.splitlines()
b614993b942a5222f6d88ae5e9974334484d74f2nd # L3 agent IP Filter rules are of the form
b614993b942a5222f6d88ae5e9974334484d74f2nd # block in quick on l3i64cbb496_a_0 from ... to pool/15417332
b614993b942a5222f6d88ae5e9974334484d74f2nd prog = re.compile('on l3i[0-9A-Fa-f\_]{10}_0')
b614993b942a5222f6d88ae5e9974334484d74f2nd ippool_names = []
b614993b942a5222f6d88ae5e9974334484d74f2nd for ipf in ipfilters:
b614993b942a5222f6d88ae5e9974334484d74f2nd if not prog.search(ipf):
b614993b942a5222f6d88ae5e9974334484d74f2nd continue
b614993b942a5222f6d88ae5e9974334484d74f2nd # capture the IP pool name
b614993b942a5222f6d88ae5e9974334484d74f2nd if 'pool/' in ipf:
b614993b942a5222f6d88ae5e9974334484d74f2nd ippool_names.append(ipf.split('pool/')[1])
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd try:
b614993b942a5222f6d88ae5e9974334484d74f2nd # remove the IP Filter rule
b614993b942a5222f6d88ae5e9974334484d74f2nd p = Popen(["echo", ipf], stdout=PIPE)
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd = ["/usr/bin/pfexec", "/usr/sbin/ipf", "-r", "-f", "-"]
b614993b942a5222f6d88ae5e9974334484d74f2nd if version == 6:
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd.insert(2, "-6")
b614993b942a5222f6d88ae5e9974334484d74f2nd check_call(cmd, stdin=p.stdout)
b614993b942a5222f6d88ae5e9974334484d74f2nd except CalledProcessError as err:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "failed to remove IP Filter rule %s: %s" % (ipf, err)
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_FATAL
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd # remove IP Pools added by neutron-l3-agent
b614993b942a5222f6d88ae5e9974334484d74f2nd for ippool_name in ippool_names:
b614993b942a5222f6d88ae5e9974334484d74f2nd try:
b614993b942a5222f6d88ae5e9974334484d74f2nd check_call(["/usr/bin/pfexec", "/usr/sbin/ippool", "-R",
b614993b942a5222f6d88ae5e9974334484d74f2nd "-m", ippool_name, "-t", "tree"])
b614993b942a5222f6d88ae5e9974334484d74f2nd except CalledProcessError as err:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "failed to remove IP Pool %s: %s" % (ippool_name, err)
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_FATAL
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_OK
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nddef stop():
b614993b942a5222f6d88ae5e9974334484d74f2nd shutdown_vpn()
b614993b942a5222f6d88ae5e9974334484d74f2nd try:
b614993b942a5222f6d88ae5e9974334484d74f2nd # first kill the SMF contract
b614993b942a5222f6d88ae5e9974334484d74f2nd check_call(["/usr/bin/pkill", "-c", sys.argv[2]])
b614993b942a5222f6d88ae5e9974334484d74f2nd except CalledProcessError as err:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "failed to kill the SMF contract: %s" % (err)
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd # We need to first remove the IP filter rules and then remove
b614993b942a5222f6d88ae5e9974334484d74f2nd # the IP interfaces on which the rules were applied.
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd # remove IPv4 Filter rules added by neutron-l3-agent
b614993b942a5222f6d88ae5e9974334484d74f2nd rv = remove_ipfilter_rules(4)
b614993b942a5222f6d88ae5e9974334484d74f2nd if rv != smf_include.SMF_EXIT_OK:
b614993b942a5222f6d88ae5e9974334484d74f2nd return rv
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd # remove IPv6 Filter rules added by neutron-l3-agent
b614993b942a5222f6d88ae5e9974334484d74f2nd rv = remove_ipfilter_rules(6)
b614993b942a5222f6d88ae5e9974334484d74f2nd if rv != smf_include.SMF_EXIT_OK:
b614993b942a5222f6d88ae5e9974334484d74f2nd return rv
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd # remove IP NAT rules added by neutron-l3-agent
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd = ["/usr/bin/pfexec", "/usr/sbin/ipnat", "-lR"]
b614993b942a5222f6d88ae5e9974334484d74f2nd p = Popen(cmd, stdout=PIPE, stderr=PIPE)
b614993b942a5222f6d88ae5e9974334484d74f2nd output, error = p.communicate()
b614993b942a5222f6d88ae5e9974334484d74f2nd if p.returncode != 0:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "failed to retrieve IP NAT rules"
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_FATAL
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd ipnat_rules = output.splitlines()
b614993b942a5222f6d88ae5e9974334484d74f2nd # L3 agent IP NAT rules are of the form
b614993b942a5222f6d88ae5e9974334484d74f2nd # bimap l3e64ccc496_a_0 .... OR
b614993b942a5222f6d88ae5e9974334484d74f2nd # rdr l3iedf345cc96_a_0 ....
b614993b942a5222f6d88ae5e9974334484d74f2nd prog = re.compile('l3[ie][0-9A-Fa-f\_]{10}_0')
b614993b942a5222f6d88ae5e9974334484d74f2nd for ipnat_rule in ipnat_rules:
b614993b942a5222f6d88ae5e9974334484d74f2nd if not prog.search(ipnat_rule):
b614993b942a5222f6d88ae5e9974334484d74f2nd continue
b614993b942a5222f6d88ae5e9974334484d74f2nd # remove the IP NAT rule
b614993b942a5222f6d88ae5e9974334484d74f2nd try:
b614993b942a5222f6d88ae5e9974334484d74f2nd p = Popen(["echo", ipnat_rule], stdout=PIPE)
b614993b942a5222f6d88ae5e9974334484d74f2nd check_call(["/usr/bin/pfexec", "/usr/sbin/ipnat", "-r", "-f", "-"],
b614993b942a5222f6d88ae5e9974334484d74f2nd stdin=p.stdout)
b614993b942a5222f6d88ae5e9974334484d74f2nd except CalledProcessError as err:
b614993b942a5222f6d88ae5e9974334484d74f2nd print "failed to remove IP NAT rule %s: %s" % (ipnat_rule, err)
b614993b942a5222f6d88ae5e9974334484d74f2nd return smf_include.SMF_EXIT_ERR_FATAL
b614993b942a5222f6d88ae5e9974334484d74f2nd
b614993b942a5222f6d88ae5e9974334484d74f2nd # remove VNICs associated with L3 agent
b614993b942a5222f6d88ae5e9974334484d74f2nd cmd = ["/usr/sbin/ipadm", "show-if", "-p", "-o", "ifname"]
b614993b942a5222f6d88ae5e9974334484d74f2nd p = Popen(cmd, stdout=PIPE, stderr=PIPE)
output, error = p.communicate()
if p.returncode != 0:
print "failed to retrieve IP interface names"
return smf_include.SMF_EXIT_ERR_CONFIG
ifnames = output.splitlines()
# L3 agent datalinks are always 15 characters in length. They start
# with either 'l3i' or 'l3e', end with '_0', and in between they are
# hexadecimal digits.
prog = re.compile('l3[ie][0-9A-Fa-f\_]{10}_0')
for ifname in ifnames:
if not prog.search(ifname):
continue
try:
# first remove the IP
check_call(["/usr/bin/pfexec", "/usr/sbin/ipadm", "delete-ip",
ifname])
# next remove the VNIC
check_call(["/usr/bin/pfexec", "/usr/sbin/dladm", "delete-vnic",
ifname])
except CalledProcessError as err:
print "failed to remove datalinks used by L3 agent: %s" % (err)
return smf_include.SMF_EXIT_ERR_FATAL
# finally reset the hostmodel property
if not set_hostmodel("weak"):
return smf_include.SMF_EXIT_ERR_FATAL
return smf_include.SMF_EXIT_OK
if __name__ == "__main__":
os.putenv("LC_ALL", "C")
smf_include.smf_main()