neutron-l3-agent revision 5577
2521N/A#!/usr/bin/python2.7
2521N/A
2521N/A# Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.
2521N/A#
2521N/A# Licensed under the Apache License, Version 2.0 (the "License"); you may
2521N/A# not use this file except in compliance with the License. You may obtain
2521N/A# a copy of the License at
2521N/A#
2521N/A# http://www.apache.org/licenses/LICENSE-2.0
2521N/A#
2521N/A# Unless required by applicable law or agreed to in writing, software
2521N/A# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
2521N/A# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
2521N/A# License for the specific language governing permissions and limitations
2521N/A# under the License.
2521N/A
2521N/Aimport os
2521N/Aimport re
2521N/Afrom subprocess import CalledProcessError, Popen, PIPE, check_call
2521N/Aimport sys
2521N/A
2521N/Aimport netaddr
2521N/Aimport smf_include
2521N/A
2521N/A
2521N/Afrom neutron.agent.solaris import packetfilter
2521N/Afrom neutron_vpnaas.services.vpn.device_drivers.solaris_ipsec import \
2521N/A get_vpn_interfaces
2521N/Afrom neutron_vpnaas.services.vpn.device_drivers.solaris_ipsec import \
2521N/A shutdown_vpn
2521N/A
2521N/A
2521N/Adef set_hostmodel(value):
2521N/A cmd = ["/usr/sbin/ipadm", "show-prop", "-p", "hostmodel",
2521N/A "-co", "current", "ipv4"]
2521N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
output, error = p.communicate()
if p.returncode != 0:
print "failed to retrieve hostmodel ipadm property"
return False
if output.strip() == value:
return True
cmd = ["/usr/bin/pfexec", "/usr/sbin/ipadm", "set-prop", "-t", "-p",
"hostmodel=%s" % value, "ipv4"]
p = Popen(cmd, stdout=PIPE, stderr=PIPE)
output, error = p.communicate()
if p.returncode != 0:
print "failed to set ipadm hostmodel property to %s" % value
return False
return True
def start():
# verify paths are valid
for f in sys.argv[2:5]:
if not os.path.exists(f) or not os.access(f, os.R_OK):
print '%s does not exist or is not readable' % f
return smf_include.SMF_EXIT_ERR_CONFIG
# System-wide forwarding (either ipv4 or ipv6 or both) must be enabled
# before neutron-l3-agent can be started.
cmd = ["/usr/sbin/ipadm", "show-prop", "-c", "-p", "forwarding",
"-o", "current", "ipv4"]
p = Popen(cmd, stdout=PIPE, stderr=PIPE)
output, error = p.communicate()
if p.returncode != 0:
print "failed to determine if IPv4 forwarding is enabled or not"
return smf_include.SMF_EXIT_ERR_FATAL
v4fwding = "on" in output
cmd = ["/usr/sbin/ipadm", "show-prop", "-c", "-p", "forwarding",
"-o", "current", "ipv6"]
p = Popen(cmd, stdout=PIPE, stderr=PIPE)
output, error = p.communicate()
if p.returncode != 0:
print "failed to determine if IPv6 forwarding is enabled or not"
return smf_include.SMF_EXIT_ERR_FATAL
v6fwding = "on" in output
if not any((v4fwding, v6fwding)):
print "System-wide IPv4 or IPv6 (or both) forwarding must be " \
"enabled before enabling neutron-l3-agent"
return smf_include.SMF_EXIT_ERR_CONFIG
# remove any stale PF rules under _auto/neutron:l3:agent anchor
pf = packetfilter.PacketFilter('_auto/neutron:l3:agent')
pf.remove_anchor_recursively()
cmd = "/usr/bin/pfexec /usr/lib/neutron/neutron-l3-agent " \
"--config-file %s --config-file %s --config-file %s" % \
tuple(sys.argv[2:5])
# The VPNaaS shutdown should unplumb all IP tunnels it created. But
# be paranoid and check for lingering tunnels created by OpenStack
# that may have been left behind if the OpenStack device driver exits
# unexpectedly. OpenStack VPN configuration is created when the service
# starts. Errors will occur if old IP tunnels still exist.
vpn_ifs = get_vpn_interfaces()
if vpn_ifs:
print "Error: Found existing IP tunnel interface(s)."
print "Use ipadm(1M) and dladm(1M) to remove it/them."
print "Then use svcadm(1M) to clear the service."
print "Use the following commands to remove:"
for interface in vpn_ifs:
ifn = interface.group(0)
print "\t# ipadm delete-ip %s; dladm delete-iptun %s" % (ifn, ifn)
return smf_include.SMF_EXIT_ERR_CONFIG
# set the hostmodel property if necessary
if not set_hostmodel("src-priority"):
return smf_include.SMF_EXIT_ERR_FATAL
return smf_include.smf_subprocess(cmd)
def stop():
shutdown_vpn()
try:
# first kill the SMF contract
check_call(["/usr/bin/pkill", "-c", sys.argv[2]])
except CalledProcessError as err:
print "failed to kill the SMF contract: %s" % (err)
# We need to first remove the PF rules added under _auto/neutron:l3:agent
# anchor and then remove the IP interfaces on which the rules were applied.
pf = packetfilter.PacketFilter('_auto/neutron:l3:agent')
pf.remove_anchor_recursively()
# remove VNICs associated with L3 agent
cmd = ["/usr/sbin/ipadm", "show-if", "-p", "-o", "ifname"]
p = Popen(cmd, stdout=PIPE, stderr=PIPE)
output, error = p.communicate()
if p.returncode != 0:
print "failed to retrieve IP interface names"
return smf_include.SMF_EXIT_ERR_CONFIG
ifnames = output.splitlines()
# L3 agent datalinks are always 15 characters in length. They start
# with either 'l3i' or 'l3e', end with '_0', and in between they are
# hexadecimal digits.
prog = re.compile('l3[ie][0-9A-Fa-f\_]{10}_0')
for ifname in ifnames:
if not prog.search(ifname):
continue
try:
# first remove the IP
check_call(["/usr/bin/pfexec", "/usr/sbin/ipadm", "delete-ip",
ifname])
# next remove the VNIC
check_call(["/usr/bin/pfexec", "/usr/sbin/dladm", "delete-vnic",
ifname])
except CalledProcessError as err:
print "failed to remove datalinks used by L3 agent: %s" % (err)
return smf_include.SMF_EXIT_ERR_FATAL
# finally reset the hostmodel property
if not set_hostmodel("weak"):
return smf_include.SMF_EXIT_ERR_FATAL
return smf_include.SMF_EXIT_OK
if __name__ == "__main__":
os.putenv("LC_ALL", "C")
smf_include.smf_main()