neutron-l3-agent revision 6380
4049N/A#!/usr/bin/python2.7
2521N/A
5403N/A# Copyright (c) 2014, 2016, Oracle and/or its affiliates. All rights reserved.
2521N/A#
2521N/A# Licensed under the Apache License, Version 2.0 (the "License"); you may
2521N/A# not use this file except in compliance with the License. You may obtain
2521N/A# a copy of the License at
2521N/A#
2521N/A# http://www.apache.org/licenses/LICENSE-2.0
2521N/A#
2521N/A# Unless required by applicable law or agreed to in writing, software
2521N/A# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
2521N/A# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
2521N/A# License for the specific language governing permissions and limitations
2521N/A# under the License.
2521N/A
6029N/Aimport ConfigParser
2521N/Aimport os
2892N/Aimport re
5577N/Afrom subprocess import CalledProcessError, Popen, PIPE, check_call
2521N/Aimport sys
2521N/A
2892N/Aimport netaddr
6380N/Afrom openstack_common import is_ml2_plugin, kill_contract
2521N/Aimport smf_include
2521N/A
5577N/Afrom neutron.agent.solaris import packetfilter
5403N/Afrom neutron_vpnaas.services.vpn.device_drivers.solaris_ipsec import \
5403N/A get_vpn_interfaces
5403N/Afrom neutron_vpnaas.services.vpn.device_drivers.solaris_ipsec import \
5403N/A shutdown_vpn
2583N/A
2521N/A
3998N/Adef set_hostmodel(value):
3998N/A cmd = ["/usr/sbin/ipadm", "show-prop", "-p", "hostmodel",
3998N/A "-co", "current", "ipv4"]
3998N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
3998N/A output, error = p.communicate()
3998N/A if p.returncode != 0:
3998N/A print "failed to retrieve hostmodel ipadm property"
3998N/A return False
3998N/A if output.strip() == value:
3998N/A return True
5577N/A cmd = ["/usr/bin/pfexec", "/usr/sbin/ipadm", "set-prop", "-t", "-p",
5577N/A "hostmodel=%s" % value, "ipv4"]
3998N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
3998N/A output, error = p.communicate()
3998N/A if p.returncode != 0:
3998N/A print "failed to set ipadm hostmodel property to %s" % value
3998N/A return False
3998N/A return True
3998N/A
3998N/A
6380N/Adef cleanup_l3_agent_datalinks():
6380N/A cmd = ["/usr/sbin/dladm", "show-link", "-p", "-o", "link"]
6380N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
6380N/A output, error = p.communicate()
6380N/A if p.returncode != 0:
6380N/A print "failed to retrieve datalink names"
6380N/A return smf_include.SMF_EXIT_ERR_FATAL
6380N/A
6380N/A dlnames = output.splitlines()
6380N/A # L3 agent datalinks are always 15 characters in length. They start
6380N/A # with either 'l3i' or 'l3e', end with '_0', and in between they are
6380N/A # hexadecimal digits.
6380N/A prog = re.compile('l3[ie][0-9A-Fa-f\_]{10}_0')
6380N/A retcode = smf_include.SMF_EXIT_OK
6380N/A is_ml2 = is_ml2_plugin()
6380N/A for dlname in dlnames:
6380N/A if prog.search(dlname) is None:
6380N/A continue
6380N/A try:
6380N/A # first remove the IP
6380N/A check_call(["/usr/bin/pfexec", "/usr/sbin/ipadm", "delete-ip",
6380N/A dlname])
6380N/A except:
6380N/A # It is possible that the IP was already deleted but not the
6380N/A # datalink. So we continue and try and delete the datalink.
6380N/A pass
6380N/A try:
6380N/A # next remove the VNIC
6380N/A check_call(["/usr/bin/pfexec", "/usr/sbin/dladm", "delete-vnic",
6380N/A dlname])
6380N/A # remove the OVS Port
6380N/A if is_ml2:
6380N/A ovs_bridge = get_ovs_bridge(dlname)
6380N/A if ovs_bridge:
6380N/A check_call(["/usr/bin/pfexec", "/usr/sbin/ovs-vsctl", "--",
6380N/A "--if-exists", "del-port", ovs_bridge, dlname])
6380N/A except CalledProcessError as err:
6380N/A print "failed to remove datalink '%s' used by L3 agent: %s" % \
6380N/A (dlname, err)
6380N/A retcode = smf_include.SMF_EXIT_ERR_FATAL
6380N/A return retcode
6380N/A
6380N/A
2521N/Adef start():
2521N/A # verify paths are valid
6029N/A for f in sys.argv[2:6]:
2521N/A if not os.path.exists(f) or not os.access(f, os.R_OK):
2521N/A print '%s does not exist or is not readable' % f
2521N/A return smf_include.SMF_EXIT_ERR_CONFIG
2521N/A
6380N/A # We need to remove VNICs associated with L3 agent if any were left over.
6380N/A # Before that, we need to first remove the PF rules added under
6380N/A # _auto/neutron:l3:agent anchor and then remove the IP interfaces on which
6380N/A # the rules were applied.
6380N/A pf = packetfilter.PacketFilter('_auto/neutron:l3:agent')
6380N/A pf.remove_anchor_recursively()
6380N/A ret_code = cleanup_l3_agent_datalinks()
6380N/A if ret_code != smf_include.SMF_EXIT_OK:
6380N/A return ret_code
6380N/A
2583N/A # System-wide forwarding (either ipv4 or ipv6 or both) must be enabled
2583N/A # before neutron-l3-agent can be started.
2583N/A cmd = ["/usr/sbin/ipadm", "show-prop", "-c", "-p", "forwarding",
2583N/A "-o", "current", "ipv4"]
2583N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
2583N/A output, error = p.communicate()
2583N/A if p.returncode != 0:
2583N/A print "failed to determine if IPv4 forwarding is enabled or not"
2583N/A return smf_include.SMF_EXIT_ERR_FATAL
2583N/A v4fwding = "on" in output
2583N/A
2583N/A cmd = ["/usr/sbin/ipadm", "show-prop", "-c", "-p", "forwarding",
2583N/A "-o", "current", "ipv6"]
2583N/A p = Popen(cmd, stdout=PIPE, stderr=PIPE)
2583N/A output, error = p.communicate()
2583N/A if p.returncode != 0:
2583N/A print "failed to determine if IPv6 forwarding is enabled or not"
2583N/A return smf_include.SMF_EXIT_ERR_FATAL
2583N/A v6fwding = "on" in output
2583N/A
2583N/A if not any((v4fwding, v6fwding)):
2892N/A print "System-wide IPv4 or IPv6 (or both) forwarding must be " \
2892N/A "enabled before enabling neutron-l3-agent"
2583N/A return smf_include.SMF_EXIT_ERR_CONFIG
2583N/A
5577N/A # remove any stale PF rules under _auto/neutron:l3:agent anchor
5577N/A pf = packetfilter.PacketFilter('_auto/neutron:l3:agent')
5577N/A pf.remove_anchor_recursively()
5577N/A
5577N/A cmd = "/usr/bin/pfexec /usr/lib/neutron/neutron-l3-agent " \
5577N/A "--config-file %s --config-file %s --config-file %s" % \
5577N/A tuple(sys.argv[2:5])
6029N/A if is_ml2_plugin():
6029N/A cmd += " --config-file %s" % sys.argv[5]
5403N/A
5403N/A # The VPNaaS shutdown should unplumb all IP tunnels it created. But
5403N/A # be paranoid and check for lingering tunnels created by OpenStack
5403N/A # that may have been left behind if the OpenStack device driver exits
5403N/A # unexpectedly. OpenStack VPN configuration is created when the service
5403N/A # starts. Errors will occur if old IP tunnels still exist.
5403N/A
5403N/A vpn_ifs = get_vpn_interfaces()
5403N/A if vpn_ifs:
5403N/A print "Error: Found existing IP tunnel interface(s)."
5403N/A print "Use ipadm(1M) and dladm(1M) to remove it/them."
5403N/A print "Then use svcadm(1M) to clear the service."
5403N/A print "Use the following commands to remove:"
5628N/A for ifn in vpn_ifs:
5403N/A print "\t# ipadm delete-ip %s; dladm delete-iptun %s" % (ifn, ifn)
5403N/A
5403N/A return smf_include.SMF_EXIT_ERR_CONFIG
5403N/A
3998N/A # set the hostmodel property if necessary
3998N/A if not set_hostmodel("src-priority"):
3998N/A return smf_include.SMF_EXIT_ERR_FATAL
3998N/A
5403N/A return smf_include.smf_subprocess(cmd)
2521N/A
2892N/A
6380N/Adef get_ovs_bridge(dlname):
6029N/A # retrieve the right OVS bridge based on the interface name
6380N/A if dlname.startswith('l3i'):
6029N/A config_file = '/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini'
6029N/A section = "ovs"
6029N/A option = "integration_bridge"
6029N/A else:
6029N/A config_file = '/etc/neutron/l3_agent.ini'
6029N/A section = "DEFAULT"
6029N/A option = "external_network_bridge"
6029N/A parser = ConfigParser.ConfigParser()
6029N/A parser.read(config_file)
6029N/A try:
6029N/A ovs_bridge = parser.get(section, option)
6029N/A except ConfigParser.NoOptionError:
6029N/A ovs_bridge = None
6029N/A return ovs_bridge
6029N/A
6029N/A
2892N/Adef stop():
5403N/A shutdown_vpn()
6380N/A # Keep issuing SIGTERM until the contract is empty. This way we will catch
6380N/A # any child processes missed because they were getting forked.
6380N/A # 50 attempts will be made at intervals of 2 seconds. Typically, we
6380N/A # will only need 0 or 1 additional attempt before the contract is empty but
6380N/A # we chose to err on the side of caution. In the worst case, we will use
6380N/A # 100 seconds in the below loop which will leave 500 seconds (timeout is
6380N/A # 600s) for the other cleanup tasks, after which the service will be put to
6380N/A # maintenance state if the contract was not killed successfully.
6380N/A if not kill_contract(50, 2, sys.argv[2]):
6380N/A return smf_include.SMF_EXIT_ERR_FATAL
2892N/A
5577N/A # We need to first remove the PF rules added under _auto/neutron:l3:agent
5577N/A # anchor and then remove the IP interfaces on which the rules were applied.
5577N/A pf = packetfilter.PacketFilter('_auto/neutron:l3:agent')
5577N/A pf.remove_anchor_recursively()
2892N/A
3162N/A # remove VNICs associated with L3 agent
6380N/A ret_code = cleanup_l3_agent_datalinks()
3162N/A
3998N/A # finally reset the hostmodel property
6380N/A if not set_hostmodel("weak") or ret_code != smf_include.SMF_EXIT_OK:
3998N/A return smf_include.SMF_EXIT_ERR_FATAL
2892N/A return smf_include.SMF_EXIT_OK
2892N/A
2521N/Aif __name__ == "__main__":
2521N/A os.putenv("LC_ALL", "C")
2521N/A smf_include.smf_main()