-
Notifications
You must be signed in to change notification settings - Fork 0
/
client.py
executable file
·344 lines (301 loc) · 16.2 KB
/
client.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
import argparse
import ipaddress
import shutil
from ruamel.yaml import YAML
from jinja2 import Environment, FileSystemLoader
from io import StringIO
import os
import enum
ruamel_yaml_default_mode = YAML()
ruamel_yaml_default_mode.width = 2048 # type: ignore
class ACTIONS(enum.Enum):
ADD_WATCHER = "add_watcher"
STOP_WATCHER = "stop_watcher"
GET_STATUS = "get_status"
class WATCHER_CONFIG:
P2P_VETH_SUPERNET_W_MASK = "169.254.0.0/16"
WATCHER_ROOT_FOLDER = "watcher"
WATCHER_TEMPLATE_FOLDER_NAME = "watcher-template"
WATCHER_TEMPLATE_CONFIG_FILE = "config.yml"
ROUTER_NODE_NAME = "router"
ROUTER_ISIS_SYSTEMID = "49.{area_num}.{watcher_num}.{gre_num}.1111.00"
WATCHER_NODE_NAME = "isis-watcher"
ISIS_FILTER_NODE_NAME = "receive_only_filter"
ISIS_FILTER_NODE_IMAGE = "vadims06/isis-filter-xdp:latest"
PROTOCOL = "isis"
def __init__(self, watcher_num):
self.watcher_num = watcher_num
# default
self.gre_tunnel_network_device_ip = ""
self.gre_tunnel_ip_w_mask_network_device = ""
self.gre_tunnel_ip_w_mask_watcher = ""
self.gre_tunnel_number = 0
self.isis_area_num = 1
self.host_interface_device_ip = ""
def gen_next_free_number(self):
""" Each Watcher installation has own sequense number starting from 1 """
return len( self.get_existed_watchers() ) + 1
@staticmethod
def get_existed_watchers():
""" Return a list of watcher folders """
watcher_root_folder_path = os.path.join(os.getcwd(), WATCHER_CONFIG.WATCHER_ROOT_FOLDER)
return [file for file in os.listdir(watcher_root_folder_path) if os.path.isdir(os.path.join(watcher_root_folder_path, file)) and file.startswith("watcher") and not file.endswith("template")]
@property
def p2p_veth_network_obj(self):
p2p_super_network_obj = ipaddress.ip_network(self.P2P_VETH_SUPERNET_W_MASK)
return self.get_nth_elem_from_iter(p2p_super_network_obj.subnets(new_prefix=24), self.watcher_num + 1)
@property
def p2p_veth_watcher_ip_obj(self):
return self.get_nth_elem_from_iter(self.p2p_veth_network_obj.hosts(), 2)
@property
def p2p_veth_watcher_ip_w_mask(self):
return f"{str(self.p2p_veth_watcher_ip_obj)}/{self.p2p_veth_network_obj.prefixlen}"
@property
def p2p_veth_watcher_ip_w_slash_32_mask(self):
return f"{str(self.p2p_veth_watcher_ip_obj)}/32"
@property
def p2p_veth_watcher_ip(self):
return str(self.p2p_veth_watcher_ip_obj)
@property
def p2p_veth_host_ip_obj(self):
return self.get_nth_elem_from_iter(self.p2p_veth_network_obj.hosts(), 1)
@property
def p2p_veth_host_ip_w_mask(self):
return f"{str(self.p2p_veth_host_ip_obj)}/{self.p2p_veth_network_obj.prefixlen}"
@property
def host_veth(self):
return f"vhost{self.gre_tunnel_number}"
@property
def watcher_root_folder_path(self):
return os.path.join(os.getcwd(), self.WATCHER_ROOT_FOLDER)
@property
def watcher_folder_name(self):
return f"watcher{self.watcher_num}-gre{self.gre_tunnel_number}"
@property
def watcher_log_file_name(self):
return f"{self.watcher_folder_name}.{self.PROTOCOL}.log"
@property
def watcher_folder_path(self):
return os.path.join(self.watcher_root_folder_path, self.watcher_folder_name)
@property
def watcher_template_path(self):
return os.path.join(self.watcher_root_folder_path, self.WATCHER_TEMPLATE_FOLDER_NAME)
@property
def router_template_path(self):
return os.path.join(self.watcher_template_path, self.ROUTER_NODE_NAME)
@property
def router_folder_path(self):
return os.path.join(self.watcher_folder_path, self.ROUTER_NODE_NAME)
@property
def watcher_config_template_yml(self):
watcher_template_path = os.path.join(self.watcher_root_folder_path, self.WATCHER_TEMPLATE_FOLDER_NAME)
with open(os.path.join(watcher_template_path, self.WATCHER_TEMPLATE_CONFIG_FILE)) as f:
return ruamel_yaml_default_mode.load(f)
@property
def isis_watcher_template_path(self):
return os.path.join(self.watcher_template_path, self.WATCHER_NODE_NAME)
@property
def isis_watcher_folder_path(self):
return os.path.join(self.watcher_folder_path, self.WATCHER_NODE_NAME)
@property
def netns_name(self):
watcher_config_yml = self.watcher_config_template_yml
if not watcher_config_yml.get("prefix"):
return f"clab-{self.watcher_folder_name}-{self.ROUTER_NODE_NAME}"
elif watcher_config_yml["prefix"] == "__lab-name":
return f"{self.watcher_folder_name}-{self.ROUTER_NODE_NAME}"
elif watcher_config_yml["prefix"] != "":
return f"{watcher_config_yml['prefix']}-{self.watcher_folder_name}-{self.ROUTER_NODE_NAME}"
return self.ROUTER_NODE_NAME
@staticmethod
def do_check_ip(ip_address_w_mask):
try:
return str(ipaddress.ip_interface(ip_address_w_mask).ip)
except:
return ""
@staticmethod
def _get_digit_net_mask(ip_address_w_mask):
return ipaddress.ip_interface(ip_address_w_mask).network.prefixlen
@staticmethod
def get_nth_elem_from_iter(iterator, number):
while number > 0:
value = iterator.__next__()
number -= 1
return value
@staticmethod
def is_network_the_same(ip_address_w_mask_1, ip_address_w_mask_2):
return ipaddress.ip_interface(ip_address_w_mask_1).network == ipaddress.ip_interface(ip_address_w_mask_2).network
def create_folder_with_settings(self):
# watcher folder
os.mkdir(self.watcher_folder_path)
# isis-watcher folder
watcher_logs_folder_path = os.path.join(self.watcher_root_folder_path, "logs")
if not os.path.exists(watcher_logs_folder_path):
os.mkdir(watcher_logs_folder_path)
#os.mkdir(isis_watcher_folder_path)
shutil.copyfile(
src=os.path.join(self.isis_watcher_template_path, "watcher.log"),
dst=os.path.join(watcher_logs_folder_path, self.watcher_log_file_name),
)
os.chmod(os.path.join(watcher_logs_folder_path, self.watcher_log_file_name), 0o755)
# router folder inside watcher
os.mkdir(self.router_folder_path)
for file_name in ["daemons", "isisd.log"]:
shutil.copyfile(
src=os.path.join(self.router_template_path, file_name),
dst=os.path.join(self.router_folder_path, file_name)
)
os.chmod(os.path.join(self.router_folder_path, "isisd.log"), 0o777)
# Config generation
env = Environment(
loader=FileSystemLoader(self.router_template_path)
)
# frr.conf
frr_template = env.get_template("frr.template")
frr_config = frr_template.render(
system_id=self.ROUTER_ISIS_SYSTEMID.format(
area_num=str(self.isis_area_num).zfill(4),
watcher_num=str(self.watcher_num).zfill(4),
gre_num=str(self.gre_tunnel_number).zfill(4),
),
watcher_name=self.watcher_folder_name,
)
with open(os.path.join(self.router_folder_path, "frr.conf"), "w") as f:
f.write(frr_config)
# vtysh.conf
vtysh_template = env.get_template("vtysh.template")
vtysh_config = vtysh_template.render(watcher_name=self.watcher_folder_name)
with open(os.path.join(self.router_folder_path, "vtysh.conf"), "w") as f:
f.write(vtysh_config)
# containerlab config
watcher_config_yml = self.watcher_config_template_yml
watcher_config_yml["name"] = self.watcher_folder_name
watcher_config_yml['topology']['nodes']['h1']['exec'] = self.exec_cmds()
watcher_config_yml['topology']['links'] = [{'endpoints': [f'{self.ROUTER_NODE_NAME}:veth1', f'host:{self.host_veth}']}]
# Watcher
watcher_config_yml['topology']['nodes'][self.WATCHER_NODE_NAME]['network-mode'] = f"container:{self.ROUTER_NODE_NAME}"
watcher_config_yml['topology']['nodes'][self.WATCHER_NODE_NAME]['binds'].append(f"../logs/{self.watcher_log_file_name}:/home/watcher/watcher/logs/watcher.log")
# IS-IS XDP filter, listen only
watcher_config_yml['topology']['nodes'][self.ISIS_FILTER_NODE_NAME]['image'] = self.ISIS_FILTER_NODE_IMAGE
watcher_config_yml['topology']['nodes'][self.ISIS_FILTER_NODE_NAME]['network-mode'] = "host"
watcher_config_yml['topology']['nodes'][self.ISIS_FILTER_NODE_NAME]['env']['VTAP_HOST_INTERFACE'] = self.host_veth
# Enable GRE after XDP filter
watcher_config_yml['topology']['nodes']['h2']['exec'] = [f'sudo ip netns exec {self.netns_name} ip link set up dev gre1']
with open(os.path.join(self.watcher_folder_path, "config.yml"), "w") as f:
s = StringIO()
ruamel_yaml_default_mode.dump(watcher_config_yml, s)
f.write(s.getvalue())
def do_add_watcher_prechecks(self):
if os.path.exists(self.watcher_folder_path):
raise ValueError(f"Watcher{self.watcher_num} with GRE{self.gre_tunnel_number} already exists")
# TODO, check if GRE with the same tunnel destination already exist
@staticmethod
def do_print_banner():
print("""
+---------------------------+
| Watcher Host | +-------------------+
| +------------+ | | Network device |
| | netns FRR | | | |
| | Tunnel [4] | | Tunnel [4] |
| | gre1 [3]TunnelIP----+-----------------------+[2]TunnelIP |
| | eth1------+-vhost1 | +-----+ | IS-IS area num [5]|
| | | Host IP[6]+-------+ LAN |--------[1]Device IP |
| | | | +-----+ | |
| +------------+ | | |
| | +-------------------+
+---------------------------+
""")
def add_watcher_dialog(self):
while not self.gre_tunnel_network_device_ip:
self.gre_tunnel_network_device_ip = self.do_check_ip(input("[1]Network device IP [x.x.x.x]: "))
while not self.gre_tunnel_ip_w_mask_network_device:
self.gre_tunnel_ip_w_mask_network_device = input("[2]GRE Tunnel IP on network device with mask [x.x.x.x/yy]: ")
if not self.do_check_ip(self.gre_tunnel_ip_w_mask_network_device):
print("IP address is not correct")
self.gre_tunnel_ip_w_mask_network_device = ""
elif self._get_digit_net_mask(self.gre_tunnel_ip_w_mask_network_device) == 32:
print("Please provide non /32 subnet for tunnel network")
self.gre_tunnel_ip_w_mask_network_device = ""
elif self.gre_tunnel_ip_w_mask_network_device == self.gre_tunnel_network_device_ip:
print("Tunnel IP address shouldn't be the same as physical device IP address")
self.gre_tunnel_ip_w_mask_network_device = ""
while not self.gre_tunnel_ip_w_mask_watcher:
self.gre_tunnel_ip_w_mask_watcher = input("[3]GRE Tunnel IP on Watcher with mask [x.x.x.x/yy]: ")
if not self.do_check_ip(self.gre_tunnel_ip_w_mask_watcher):
print("IP address is not correct")
self.gre_tunnel_ip_w_mask_watcher = ""
elif self._get_digit_net_mask(self.gre_tunnel_ip_w_mask_watcher) == 32:
print("Please provide non /32 subnet for tunnel network")
self.gre_tunnel_ip_w_mask_watcher = ""
elif not self.is_network_the_same(self.gre_tunnel_ip_w_mask_network_device, self.gre_tunnel_ip_w_mask_watcher):
print("Tunnel's network doesn't match")
self.gre_tunnel_ip_w_mask_watcher = ""
elif self.gre_tunnel_ip_w_mask_network_device == self.gre_tunnel_ip_w_mask_watcher:
print("Tunnel' IP addresses must be different on endpoints")
self.gre_tunnel_ip_w_mask_watcher = ""
while not self.gre_tunnel_number:
self.gre_tunnel_number = input("[4]GRE Tunnel number: ")
if not self.gre_tunnel_number.isdigit():
print("Please provide any positive number")
self.gre_tunnel_number = ""
# ISIS settings
self.isis_area_num = input("[5]IS-IS area number: ")
# Host interface name for NAT
while not self.host_interface_device_ip:
self.host_interface_device_ip = self.do_check_ip(input("[6]Watcher host IP address: "))
def exec_cmds(self):
return [
f'ip netns exec {self.netns_name} ip address add {self.p2p_veth_watcher_ip_w_mask} dev veth1',
f'ip netns exec {self.netns_name} ip route add {self.gre_tunnel_network_device_ip} via {str(self.p2p_veth_host_ip_obj)}',
f'ip address add {self.p2p_veth_host_ip_w_mask} dev {self.host_veth}',
f'ip netns exec {self.netns_name} ip tunnel add gre1 mode gre local {str(self.p2p_veth_watcher_ip_obj)} remote {self.gre_tunnel_network_device_ip}',
f'ip netns exec {self.netns_name} ip address add {self.gre_tunnel_ip_w_mask_watcher} dev gre1',
f'sudo iptables -t nat -A POSTROUTING -p gre -s {self.p2p_veth_watcher_ip} -d {self.gre_tunnel_network_device_ip} -j SNAT --to-source {self.host_interface_device_ip}',
f'sudo iptables -t nat -A PREROUTING -p gre -s {self.gre_tunnel_network_device_ip} -d {self.host_interface_device_ip} -j DNAT --to-destination {self.p2p_veth_watcher_ip}',
f'sudo iptables -t filter -A FORWARD -p gre -s {self.p2p_veth_watcher_ip} -d {self.gre_tunnel_network_device_ip} -i {self.host_veth} -j ACCEPT',
f'sudo iptables -t filter -A FORWARD -p gre -s {self.gre_tunnel_network_device_ip} -j ACCEPT', # do not set output interface
f'sudo ip netns exec {self.netns_name} ip link set mtu 1600 dev veth1', # for xdp
# enable GRE after applying XDP filter
#f'sudo ip netns exec {self.netns_name} ip link set up dev gre1',
f'sudo ip link set mtu 1600 dev {self.host_veth}',
f'sudo conntrack -D --dst {self.gre_tunnel_network_device_ip} -p 47',
f'sudo conntrack -D --src {self.gre_tunnel_network_device_ip} -p 47',
]
@classmethod
def parse_command_args(cls, args):
allowed_actions = [actions.value for actions in ACTIONS]
if args.action not in allowed_actions:
raise ValueError(f"Not allowed action. Supported actions: {', '.join(allowed_actions)}")
watcher_num = args.watcher_num if args.watcher_num else len( cls.get_existed_watchers() ) + 1
watcher_obj = cls(watcher_num)
watcher_obj.run_command(args.action)
def run_command(self, action):
method = getattr(self, action)
return method()
def add_watcher(self):
self.do_print_banner()
self.add_watcher_dialog()
self.do_add_watcher_prechecks()
# create folder
self.create_folder_with_settings()
print(f"Config has been successfully generated!")
def stop_watcher(self):
raise NotImplementedError("Not implemented yet. Please run manually `sudo clab destroy --topo <path to config.yml>`")
def get_status(self):
# TODO add IS-IS neighborship status
raise NotImplementedError("Not implemented yet. Please run manually `sudo docker ps -f label=clab-node-name=router`")
if __name__ == '__main__':
parser = argparse.ArgumentParser(
description="Provisioning Watcher instances for tracking IS-IS topology changes"
)
parser.add_argument(
"--action", required=True, help="Options: add_watcher, stop_watcher, get_status"
)
parser.add_argument(
"--watcher_num", required=False, default=0, help="Number of watcher"
)
args = parser.parse_args()
allowed_actions = [actions.value for actions in ACTIONS]
if args.action not in allowed_actions:
raise ValueError(f"Not allowed action. Supported actions: {', '.join(allowed_actions)}")
watcher_conf = WATCHER_CONFIG.parse_command_args(args)