neutron-l3-agent revision 6029
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#!/usr/bin/python2.7
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User#
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User# Licensed under the Apache License, Version 2.0 (the "License"); you may
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User# not use this file except in compliance with the License. You may obtain
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# a copy of the License at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# http://www.apache.org/licenses/LICENSE-2.0
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# Unless required by applicable law or agreed to in writing, software
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# License for the specific language governing permissions and limitations
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# under the License.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinimport ConfigParser
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinimport os
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinimport re
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinfrom subprocess import CalledProcessError, Popen, PIPE, check_call
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinimport sys
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinimport netaddr
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinfrom openstack_common import is_ml2_plugin
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinimport smf_include
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinfrom neutron.agent.solaris import packetfilter
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinfrom neutron_vpnaas.services.vpn.device_drivers.solaris_ipsec import \
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User get_vpn_interfaces
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinfrom neutron_vpnaas.services.vpn.device_drivers.solaris_ipsec import \
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein shutdown_vpn
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User
1700442a7751c2bbdafe2d039cebbd8316496957Tinderbox Userdef set_hostmodel(value):
5347c0fcb04eaea19d9f39795646239f487c6207Tinderbox User cmd = ["/usr/sbin/ipadm", "show-prop", "-p", "hostmodel",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "-co", "current", "ipv4"]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein p = Popen(cmd, stdout=PIPE, stderr=PIPE)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein output, error = p.communicate()
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if p.returncode != 0:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein print "failed to retrieve hostmodel ipadm property"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User return False
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if output.strip() == value:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein return True
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User cmd = ["/usr/bin/pfexec", "/usr/sbin/ipadm", "set-prop", "-t", "-p",
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User "hostmodel=%s" % value, "ipv4"]
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User p = Popen(cmd, stdout=PIPE, stderr=PIPE)
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User output, error = p.communicate()
010a51c427bfb6ab658fc0056955a1a5b69810beTinderbox User if p.returncode != 0:
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User print "failed to set ipadm hostmodel property to %s" % value
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User return False
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User return True
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox Userdef start():
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein # verify paths are valid
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein for f in sys.argv[2:6]:
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews if not os.path.exists(f) or not os.access(f, os.R_OK):
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein print '%s does not exist or is not readable' % f
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User return smf_include.SMF_EXIT_ERR_CONFIG
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User # System-wide forwarding (either ipv4 or ipv6 or both) must be enabled
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User # before neutron-l3-agent can be started.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User cmd = ["/usr/sbin/ipadm", "show-prop", "-c", "-p", "forwarding",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein "-o", "current", "ipv4"]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein p = Popen(cmd, stdout=PIPE, stderr=PIPE)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein output, error = p.communicate()
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if p.returncode != 0:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein print "failed to determine if IPv4 forwarding is enabled or not"
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User return smf_include.SMF_EXIT_ERR_FATAL
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User v4fwding = "on" in output
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User cmd = ["/usr/sbin/ipadm", "show-prop", "-c", "-p", "forwarding",
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User "-o", "current", "ipv6"]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein p = Popen(cmd, stdout=PIPE, stderr=PIPE)
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User output, error = p.communicate()
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User if p.returncode != 0:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein print "failed to determine if IPv6 forwarding is enabled or not"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein return smf_include.SMF_EXIT_ERR_FATAL
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein v6fwding = "on" in output
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if not any((v4fwding, v6fwding)):
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt print "System-wide IPv4 or IPv6 (or both) forwarding must be " \
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt "enabled before enabling neutron-l3-agent"
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt return smf_include.SMF_EXIT_ERR_CONFIG
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User # remove any stale PF rules under _auto/neutron:l3:agent anchor
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt pf = packetfilter.PacketFilter('_auto/neutron:l3:agent')
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein pf.remove_anchor_recursively()
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User cmd = "/usr/bin/pfexec /usr/lib/neutron/neutron-l3-agent " \
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User "--config-file %s --config-file %s --config-file %s" % \
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User tuple(sys.argv[2:5])
2b4d1b54f6ca406b8233d9e6fea9593df6dad035Tinderbox User if is_ml2_plugin():
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein cmd += " --config-file %s" % sys.argv[5]
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User # The VPNaaS shutdown should unplumb all IP tunnels it created. But
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt # be paranoid and check for lingering tunnels created by OpenStack
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein # that may have been left behind if the OpenStack device driver exits
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User # unexpectedly. OpenStack VPN configuration is created when the service
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User # starts. Errors will occur if old IP tunnels still exist.
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater vpn_ifs = get_vpn_interfaces()
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if vpn_ifs:
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater print "Error: Found existing IP tunnel interface(s)."
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User print "Use ipadm(1M) and dladm(1M) to remove it/them."
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User print "Then use svcadm(1M) to clear the service."
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User print "Use the following commands to remove:"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User for ifn in vpn_ifs:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User print "\t# ipadm delete-ip %s; dladm delete-iptun %s" % (ifn, ifn)
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User return smf_include.SMF_EXIT_ERR_CONFIG
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User # set the hostmodel property if necessary
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User if not set_hostmodel("src-priority"):
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User return smf_include.SMF_EXIT_ERR_FATAL
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User return smf_include.smf_subprocess(cmd)
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updaterdef get_ovs_bridge(ifname):
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User # retrieve the right OVS bridge based on the interface name
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User if ifname.startswith('l3i'):
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User config_file = '/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini'
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt section = "ovs"
bbbf2e27d3a981163dab139497d6b2dc85449db0Tinderbox User option = "integration_bridge"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User else:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User config_file = '/etc/neutron/l3_agent.ini'
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User section = "DEFAULT"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User option = "external_network_bridge"
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User parser = ConfigParser.ConfigParser()
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User parser.read(config_file)
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User try:
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater ovs_bridge = parser.get(section, option)
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt except ConfigParser.NoOptionError:
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater ovs_bridge = None
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User return ovs_bridge
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Huntdef stop():
bcf15a19ae0efa72a22cdfb50666a3c6ce39eb9fTinderbox User shutdown_vpn()
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User try:
fd2597f75693a2279fdf588bd40dfe2407c42028Tinderbox User # first kill the SMF contract
983df82baf1d7d0b668c98cf45928a19f175c6e7Tinderbox User check_call(["/usr/bin/pkill", "-c", sys.argv[2]])
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User except CalledProcessError as err:
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User print "failed to kill the SMF contract: %s" % (err)
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User # We need to first remove the PF rules added under _auto/neutron:l3:agent
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User # anchor and then remove the IP interfaces on which the rules were applied.
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User pf = packetfilter.PacketFilter('_auto/neutron:l3:agent')
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User pf.remove_anchor_recursively()
983df82baf1d7d0b668c98cf45928a19f175c6e7Tinderbox User
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User # remove VNICs associated with L3 agent
260e8e04b0dc24cb884c789b5d9eb046457f264eTinderbox User cmd = ["/usr/sbin/ipadm", "show-if", "-p", "-o", "ifname"]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein p = Popen(cmd, stdout=PIPE, stderr=PIPE)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein output, error = p.communicate()
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews if p.returncode != 0:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein print "failed to retrieve IP interface names"
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User return smf_include.SMF_EXIT_ERR_CONFIG
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ifnames = output.splitlines()
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews # L3 agent datalinks are always 15 characters in length. They start
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein # with either 'l3i' or 'l3e', end with '_0', and in between they are
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt # hexadecimal digits.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein prog = re.compile('l3[ie][0-9A-Fa-f\_]{10}_0')
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt err_delete = False
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User for ifname in ifnames:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein if prog.search(ifname) is None:
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt continue
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein try:
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User # first remove the IP
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt check_call(["/usr/bin/pfexec", "/usr/sbin/ipadm", "delete-ip",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ifname])
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User # next remove the VNIC
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt check_call(["/usr/bin/pfexec", "/usr/sbin/dladm", "delete-vnic",
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein ifname])
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User # remove the OVS Port
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User if is_ml2_plugin():
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User ovs_bridge = get_ovs_bridge(ifname)
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User if ovs_bridge:
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User check_call(["/usr/bin/pfexec", "/usr/sbin/ovs-vsctl", "--",
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User "--if-exists", "del-port", ovs_bridge, ifname])
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User except CalledProcessError as err:
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User print "failed to remove datalink '%s' used by L3 agent: %s" % \
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User (ifname, err)
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User err_delete = True
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User # finally reset the hostmodel property
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt if not set_hostmodel("weak") or err_delete:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein return smf_include.SMF_EXIT_ERR_FATAL
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt return smf_include.SMF_EXIT_OK
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinif __name__ == "__main__":
14a656f94b1fd0ababd84a772228dfa52276ba15Evan Hunt os.putenv("LC_ALL", "C")
af40ebed6257e4ac1996144530b3de317cf4da11Tinderbox User smf_include.smf_main()
a1ad6695ed6f988406cf155aa26376f84f73bcb9Automatic Updater