Skip to content
Toggle navigation
P
Projects
G
Groups
S
Snippets
Help
Gelencsér Szabolcs
/
fwdriver
This project
Loading...
Sign in
Toggle navigation
Go to a project
Project
Repository
Issues
0
Merge Requests
0
Wiki
Members
Activity
Graph
Charts
Create a new issue
Commits
Issue Boards
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Commit
514712db
authored
Mar 18, 2014
by
Bach Dániel
Committed by
Bach Dániel
Mar 18, 2014
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
code refactoring
parent
f6dc0c99
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
186 additions
and
149 deletions
+186
-149
fw.py
+27
-45
ovs.py
+142
-103
utils.py
+17
-1
No files found.
fw.py
View file @
514712db
...
...
@@ -5,11 +5,12 @@ import json
import
logging
from
ovs
import
Switch
from
utils
import
(
NETNS
,
ns_exec
,
sudo
,
ADDRESSES
,
dhcp_no_free_re
,
dhcp_ack_re
)
DHCP_LOGFILE
=
getenv
(
'DHCP_LOGFILE'
,
'/var/log/syslog'
)
VLAN_CONF
=
getenv
(
'VLAN_CONF'
,
'vlan.conf'
)
FIREWALL_CONF
=
getenv
(
'FIREWALL_CONF'
,
'firewall.conf'
)
from
utils
import
NETNS
,
ns_exec
,
sudo
,
ADDRESSES
,
UPLINK
celery
=
Celery
(
'tasks'
,
backend
=
'amqp'
,
)
celery
.
conf
.
update
(
CELERY_TASK_RESULT_EXPIRES
=
300
,
...
...
@@ -20,9 +21,7 @@ logger = logging.getLogger(__name__)
@task
(
name
=
"firewall.reload_firewall"
)
def
reload_firewall
(
data4
,
data6
,
onstart
=
False
):
print
"fw"
def
reload_firewall
(
data4
,
data6
,
save_config
=
True
):
ns_exec
(
NETNS
,
(
'/sbin/ip6tables-restore'
,
'-c'
),
'
\n
'
.
join
(
data6
[
'filter'
])
+
'
\n
'
)
...
...
@@ -30,40 +29,41 @@ def reload_firewall(data4, data6, onstart=False):
(
'
\n
'
.
join
(
data4
[
'filter'
])
+
'
\n
'
+
'
\n
'
.
join
(
data4
[
'nat'
])
+
'
\n
'
))
if
onstart
is
False
:
if
save_config
:
with
open
(
FIREWALL_CONF
,
'w'
)
as
f
:
json
.
dump
([
data4
,
data6
],
f
)
logger
.
info
(
"Firewall configuration is reloaded."
)
@task
(
name
=
"firewall.reload_firewall_vlan"
)
def
reload_firewall_vlan
(
data
,
onstart
=
Fals
e
):
print
"fw vlan"
def
reload_firewall_vlan
(
data
,
save_config
=
Tru
e
):
# Add additional addresses from config
for
k
,
v
in
ADDRESSES
.
items
():
data
[
k
][
'addresses'
]
=
data
[
k
][
'addresses'
]
+
v
try
:
data
[
UPLINK
[
0
]]
=
{
'interfaces'
:
UPLINK
}
except
:
pass
data
[
k
][
'addresses'
]
+=
v
br
=
Switch
(
'firewall'
)
br
.
migrate
(
data
)
if
onstart
is
False
:
if
save_config
:
with
open
(
VLAN_CONF
,
'w'
)
as
f
:
json
.
dump
(
data
,
f
)
GATEWAY
=
getenv
(
'GATEWAY'
,
'152.66.243.254'
)
try
:
ns_exec
(
NETNS
,
(
'/sbin/ip'
,
'ro'
,
'add'
,
'default'
,
'via'
,
GATEWAY
))
ns_exec
(
NETNS
,
(
'/sbin/ip'
,
'ro'
,
'add'
,
'10.12.0.0/22'
,
'via'
,
'10.12.255.253'
))
ns_exec
(
NETNS
,
(
'/sbin/ip'
,
'ro'
,
'add'
,
'default'
,
'via'
,
getenv
(
'GATEWAY'
,
'152.66.243.254'
)))
except
:
pass
logger
.
info
(
"Interface (vlan) configuration is reloaded."
)
@task
(
name
=
"firewall.reload_dhcp"
)
def
reload_dhcp
(
data
):
print
"dhcp"
with
open
(
'/tools/dhcp3/dhcpd.conf.generated'
,
'w'
)
as
f
:
with
open
(
'/etc/dhcp/dhcpd.conf.generated'
,
'w'
)
as
f
:
f
.
write
(
"
\n
"
.
join
(
data
)
+
"
\n
"
)
sudo
((
'/etc/init.d/isc-dhcp-server'
,
'restart'
))
logger
.
info
(
"DHCP configuration is reloaded."
)
def
ipset_save
(
data
):
...
...
@@ -88,8 +88,8 @@ def ipset_restore(l_add, l_del):
ipset
=
[]
ipset
.
append
(
'create blacklist hash:ip family inet hashsize '
'4096 maxelem 65536'
)
ipset
=
ipset
+
[
'add blacklist
%
s'
%
x
for
x
in
l_add
]
ipset
=
ipset
+
[
'del blacklist
%
s'
%
x
for
x
in
l_del
]
ipset
+=
[
'add blacklist
%
s'
%
x
for
x
in
l_add
]
ipset
+=
[
'del blacklist
%
s'
%
x
for
x
in
l_del
]
ns_exec
(
NETNS
,
(
'/usr/sbin/ipset'
,
'restore'
,
'-exist'
),
'
\n
'
.
join
(
ipset
)
+
'
\n
'
)
...
...
@@ -97,26 +97,9 @@ def ipset_restore(l_add, l_del):
@task
(
name
=
"firewall.reload_blacklist"
)
def
reload_blacklist
(
data
):
print
"blacklist"
l_add
,
l_del
=
ipset_save
(
data
)
ipset_restore
(
l_add
,
l_del
)
# 2013-06-26 12:16:59 DHCPACK on 10.4.0.14 to 5c:b5:24:e6:5c:81
# (android_b555bfdba7c837d) via vlan0004
dhcp_ack_re
=
re
.
compile
(
r'\S DHCPACK on (?P<ip>[0-9.]+) to '
r'(?P<mac>[a-zA-Z0-9:]+) '
r'(\((?P<hostname>[^)]+)\) )?'
r'via (?P<interface>[a-zA-Z0-9]+)'
)
# 2013-06-25 11:08:38 DHCPDISCOVER from 48:5b:39:8e:82:78
# via vlan0005: network 10.5.0.0/16: no free leases
dhcp_no_free_re
=
re
.
compile
(
r'\S DHCPDISCOVER '
r'from (?P<mac>[a-zA-Z0-9:]+) '
r'via (?P<interface>[a-zA-Z0-9]+):'
)
logger
.
info
(
"Blacklist configuration is reloaded."
)
@task
(
name
=
"firewall.get_dhcp_clients"
)
...
...
@@ -153,9 +136,8 @@ def start_firewall():
with
open
(
FIREWALL_CONF
,
'r'
)
as
f
:
data4
,
data6
=
json
.
load
(
f
)
reload_firewall
(
data4
,
data6
,
True
)
except
:
print
'nemsikerult:('
# raise
except
Exception
as
e
:
logger
.
error
(
'Unhandled exception:
%
s'
,
unicode
(
e
))
def
start_networking
():
...
...
@@ -163,13 +145,13 @@ def start_networking():
with
open
(
VLAN_CONF
,
'r'
)
as
f
:
data
=
json
.
load
(
f
)
reload_firewall_vlan
(
data
,
True
)
except
:
print
'nemsikerult:('
# raise
except
Exception
as
e
:
logger
.
error
(
'Unhandled exception:
%
s'
,
unicode
(
e
))
def
main
():
start_networking
()
start_firewall
()
main
()
ovs.py
View file @
514712db
from
netaddr
import
IPNetwork
from
subprocess
import
CalledProcessError
import
logging
from
utils
import
NETNS
,
sudo
,
ns_exec
,
MAC
from
utils
import
NETNS
,
sudo
,
ns_exec
,
HA
logger
=
logging
.
getLogger
(
__name__
)
logger
.
setLevel
(
logging
.
INFO
)
class
IPDevice
:
def
__init__
(
self
,
devname
):
self
.
devname
=
devname
class
Interface
(
object
):
def
__init__
(
self
,
name
,
data
,
with_show
=
False
):
# {"interfaces": ["eth1"], "tag": 2, "trunks": [1, 2, 3],
# "type": "internal", "addresses": ["193.006.003.130/24", "None"]}
self
.
name
=
name
self
.
is_veth
=
data
.
get
(
'type'
,
'external'
)
==
'internal'
try
:
self
.
untagged
=
int
(
data
[
'tag'
])
except
(
TypeError
,
KeyError
):
self
.
untagged
=
None
try
:
self
.
tagged
=
frozenset
(
int
(
i
)
for
i
in
data
[
'trunks'
])
except
(
TypeError
,
KeyError
):
self
.
tagged
=
frozenset
()
if
with_show
:
data
[
'addresses'
]
=
self
.
show
()
try
:
self
.
addresses
=
frozenset
(
IPNetwork
(
i
)
for
i
in
data
[
'addresses'
]
if
i
!=
'None'
)
except
(
TypeError
,
KeyError
):
self
.
addresses
=
frozenset
()
def
__repr__
(
self
):
return
'<Interface:
%
s veth=
%
s|
%
s>'
%
(
self
.
name
,
self
.
is_veth
,
(
self
.
untagged
,
self
.
tagged
,
self
.
addresses
))
def
__eq__
(
self
,
other
):
return
self
.
__dict__
==
other
.
__dict__
def
__hash__
(
self
):
r
=
reduce
(
lambda
acc
,
x
:
acc
^
hash
(
x
),
(
self
.
name
,
self
.
is_veth
,
self
.
untagged
,
self
.
tagged
),
0
)
return
r
@property
def
external_name
(
self
):
if
self
.
is_veth
:
return
'
%
s-EXTERNAL'
%
self
.
name
else
:
return
self
.
name
def
_run
(
self
,
*
args
):
args
=
(
'/sbin/ip'
,
'addr'
,
)
+
args
...
...
@@ -14,40 +59,46 @@ class IPDevice:
def
show
(
self
):
retval
=
[]
for
line
in
self
.
_run
(
'show'
,
self
.
devname
,
'scope'
,
'global'
)
.
splitlines
():
t
=
line
.
split
()
if
len
(
t
)
>
0
and
t
[
0
]
in
(
'inet'
,
'inet6'
):
retval
.
append
(
IPNetwork
(
t
[
1
]))
logging
.
debug
(
'[ip-
%
s] show:
%
s'
%
(
self
.
devname
,
str
(
retval
)))
try
:
for
line
in
self
.
_run
(
'show'
,
self
.
name
,
'scope'
,
'global'
)
.
splitlines
():
t
=
line
.
split
()
if
len
(
t
)
>
0
and
t
[
0
]
in
(
'inet'
,
'inet6'
):
retval
.
append
(
IPNetwork
(
t
[
1
]))
except
CalledProcessError
:
pass
logger
.
debug
(
'[ip-
%
s] show:
%
s'
%
(
self
.
name
,
str
(
retval
)))
return
retval
def
delete
(
self
,
address
):
self
.
_run
(
'del'
,
str
(
address
),
'dev'
,
self
.
dev
name
)
def
delete
_address
(
self
,
address
):
self
.
_run
(
'del'
,
str
(
address
),
'dev'
,
self
.
name
)
def
add
(
self
,
address
):
self
.
_run
(
'add'
,
str
(
address
),
'dev'
,
self
.
dev
name
)
def
add
_address
(
self
,
address
):
self
.
_run
(
'add'
,
str
(
address
),
'dev'
,
self
.
name
)
def
up
(
self
):
ns_exec
(
NETNS
,
(
'/sbin/ip'
,
'link'
,
'set'
,
'up'
,
self
.
devname
))
if
self
.
is_veth
:
ns_exec
(
NETNS
,
(
'/sbin/ip'
,
'link'
,
'set'
,
'up'
,
self
.
name
))
sudo
((
'/sbin/ip'
,
'link'
,
'set'
,
'up'
,
self
.
external_name
))
def
migrate
(
self
,
new_addresses
):
def
migrate
(
self
):
old_addresses
=
[
str
(
x
)
for
x
in
self
.
show
()]
new_addresses
=
[
str
(
x
)
for
x
in
new_
addresses
]
delete
=
list
(
set
(
old_addresses
)
-
set
(
new_addresses
))
add
=
list
(
set
(
new_addresses
)
-
set
(
old_addresses
))
new_addresses
=
[
str
(
x
)
for
x
in
self
.
addresses
]
to_
delete
=
list
(
set
(
old_addresses
)
-
set
(
new_addresses
))
to_
add
=
list
(
set
(
new_addresses
)
-
set
(
old_addresses
))
logg
ing
.
debug
(
'[ip-
%
s] delete:
%
s'
%
(
self
.
devname
,
str
(
delete
)))
logg
ing
.
debug
(
'[ip-
%
s] add:
%
s'
%
(
self
.
devname
,
str
(
add
)))
logg
er
.
debug
(
'[ip-
%
s] delete:
%
s'
%
(
self
.
name
,
str
(
to_
delete
)))
logg
er
.
debug
(
'[ip-
%
s] add:
%
s'
%
(
self
.
name
,
str
(
to_
add
)))
for
i
in
delete
:
self
.
delete
(
i
)
for
i
in
to_
delete
:
self
.
delete
_address
(
i
)
for
i
in
add
:
self
.
add
(
i
)
for
i
in
to_
add
:
self
.
add
_address
(
i
)
class
Switch
:
class
Switch
(
object
)
:
def
__init__
(
self
,
brname
):
self
.
brname
=
brname
try
:
...
...
@@ -64,98 +115,86 @@ class Switch:
return
sudo
(
args
)
def
list_ports
(
self
):
retval
=
{}
ovs
=
{}
bridge
=
None
port
=
None
for
line
in
self
.
_run
(
'show'
)
.
splitlines
():
t
=
line
.
split
()
if
t
[
0
]
==
'Bridge'
:
bridge
=
t
[
1
]
retval
[
bridge
]
=
{}
ovs
[
bridge
]
=
{}
elif
t
[
0
]
==
'Port'
:
port
=
t
[
1
]
.
replace
(
'"'
,
''
)
# valahol idezojel van
retval
[
bridge
][
port
]
=
{}
retval
[
bridge
][
port
][
'interfaces'
]
=
[]
elif
t
[
0
]
==
'Interface'
:
interface
=
t
[
1
]
.
replace
(
'"'
,
''
)
# valahol idezojel van
retval
[
bridge
][
port
][
'interfaces'
]
.
append
(
interface
)
if
port
.
endswith
(
'-EXTERNAL'
):
port
=
port
.
rstrip
(
'-EXTERNAL'
)
type
=
'internal'
else
:
type
=
'external'
ovs
[
bridge
][
port
]
=
{
'type'
:
type
}
elif
t
[
0
]
==
'tag:'
:
tag
=
int
(
t
[
1
])
retval
[
bridge
][
port
][
'tag'
]
=
tag
elif
t
[
0
]
==
'type:'
:
retval
[
bridge
][
port
][
'type'
]
=
t
[
1
]
ovs
[
bridge
][
port
][
'tag'
]
=
int
(
t
[
1
])
elif
t
[
0
]
==
'trunks:'
:
trunks
=
[
int
(
p
.
strip
(
'[,]'
))
for
p
in
t
[
1
:]]
retval
[
bridge
][
port
][
'trunks'
]
=
trunks
return
retval
.
get
(
self
.
brname
,
{})
def
add_port
(
self
,
name
,
interfaces
,
tag
,
trunks
,
internal
=
True
):
if
len
(
interfaces
)
>
1
:
# bond
params
=
[
'add-bond'
,
self
.
brname
,
name
]
+
interfaces
+
[
'tag=
%
d'
%
int
(
tag
)]
else
:
params
=
[
'add-port'
,
self
.
brname
,
name
]
if
tag
is
not
None
and
(
trunks
is
None
or
len
(
trunks
)
==
0
):
params
=
params
+
[
'tag=
%
d'
%
int
(
tag
)]
if
internal
:
params
=
params
+
[
'--'
,
'set'
,
'Interface'
,
interfaces
[
0
],
'type=internal'
,
'mac=
%
s'
%
MAC
]
if
trunks
is
not
None
and
len
(
trunks
)
>
0
:
params
.
append
(
'trunks=
%
s'
%
trunks
)
ovs
[
bridge
][
port
][
'trunks'
]
=
trunks
# Create Interface objects
return
[
Interface
(
name
,
data
,
with_show
=
True
)
for
name
,
data
in
ovs
.
get
(
self
.
brname
,
{})
.
items
()
if
name
!=
self
.
brname
]
def
add_port
(
self
,
interface
):
params
=
[
'add-port'
,
self
.
brname
,
interface
.
external_name
]
if
interface
.
untagged
and
not
interface
.
tagged
:
params
.
append
(
'tag=
%
d'
%
int
(
interface
.
untagged
))
if
interface
.
tagged
:
params
.
append
(
'trunks=
%
s'
%
list
(
interface
.
tagged
))
self
.
_run
(
*
params
)
if
not
internal
:
# move interface into namespace
try
:
if
interface
.
is_veth
:
sudo
((
'/sbin/ip'
,
'link'
,
'add'
,
interface
.
external_name
,
'type'
,
'veth'
,
'peer'
,
'name'
,
interface
.
name
))
self
.
_setns
(
interface
.
name
)
except
:
pass
def
delete_port
(
self
,
interface
):
self
.
_run
(
'del-port'
,
self
.
brname
,
interface
.
external_name
)
if
interface
.
is_veth
:
try
:
s
elf
.
_setns
(
name
)
except
:
s
udo
((
'/sbin/ip'
,
'link'
,
'del'
,
interface
.
external_name
)
)
except
CalledProcessError
:
pass
def
delete_port
(
self
,
name
):
self
.
_run
(
'del-port'
,
self
.
brname
,
name
)
def
migrate
(
self
,
new_ports
):
old_ports
=
self
.
list_ports
()
add
=
[]
delete
=
[]
for
port
,
data
in
new_ports
.
items
():
if
port
not
in
old_ports
:
# new port
add
.
append
(
port
)
elif
(
old_ports
[
port
]
.
get
(
'tag'
,
None
)
!=
new_ports
[
port
]
.
get
(
'tag'
,
None
)
or
old_ports
[
port
]
.
get
(
'trunks'
,
None
)
!=
new_ports
[
port
]
.
get
(
'trunks'
,
None
)
or
old_ports
[
port
]
.
get
(
'interfaces'
,
None
)
!=
new_ports
[
port
]
.
get
(
'interfaces'
,
None
)):
# modified port
delete
.
append
(
port
)
add
.
append
(
port
)
delete
=
delete
+
list
(
set
(
old_ports
.
keys
())
-
set
(
new_ports
.
keys
()))
delete
.
remove
(
self
.
brname
)
logging
.
debug
(
'[ovs delete:
%
s'
%
(
delete
,
))
logging
.
debug
(
'[ovs] add:
%
s'
%
(
add
,
))
for
i
in
delete
:
if
not
i
.
startswith
(
'gre'
):
self
.
delete_port
(
i
)
for
i
in
add
:
internal
=
new_ports
[
i
]
.
get
(
'type'
,
''
)
==
'internal'
tag
=
new_ports
[
i
]
.
get
(
'tag'
,
None
)
trunks
=
new_ports
[
i
]
.
get
(
'trunks'
,
[])
interfaces
=
new_ports
[
i
][
'interfaces'
]
self
.
add_port
(
i
,
interfaces
,
tag
,
trunks
,
internal
)
for
port
,
data
in
new_ports
.
items
():
interface
=
IPDevice
(
devname
=
port
)
old_interfaces
=
self
.
list_ports
()
new_interfaces
=
[
Interface
(
port
,
data
)
for
port
,
data
in
new_ports
.
items
()]
add
=
[
i
for
i
in
new_interfaces
if
i
not
in
old_interfaces
]
delete
=
[
i
for
i
in
old_interfaces
if
i
not
in
new_interfaces
]
add
=
list
(
set
(
new_interfaces
)
.
difference
(
set
(
old_interfaces
)))
delete
=
list
(
set
(
old_interfaces
)
.
difference
(
set
(
new_interfaces
)))
logger
.
debug
(
'[ovs delete]:
%
s'
%
delete
)
logger
.
debug
(
'[ovs add]:
%
s'
%
add
)
for
interface
in
delete
:
self
.
delete_port
(
interface
)
for
interface
in
add
:
self
.
add_port
(
interface
)
for
interface
in
new_interfaces
:
try
:
interface
.
migrate
([
IPNetwork
(
x
)
for
x
in
data
.
get
(
'addresses'
,
[])
if
x
!=
'None'
])
if
data
.
get
(
'type'
,
''
)
==
'internal'
:
if
interface
.
is_veth
or
not
HA
:
interface
.
up
()
except
:
pass
except
CalledProcessError
as
e
:
logger
.
warning
(
e
)
try
:
interface
.
migrate
()
except
CalledProcessError
as
e
:
logger
.
warning
(
e
)
utils.py
View file @
514712db
...
...
@@ -2,6 +2,7 @@ from os import getenv, devnull
import
subprocess
as
sp
import
logging
import
json
import
re
logging
.
basicConfig
()
logger
=
logging
.
getLogger
(
__name__
)
...
...
@@ -9,8 +10,23 @@ logger.setLevel(logging.DEBUG)
NETNS
=
getenv
(
'NETNS'
,
'fw'
)
MAC
=
getenv
(
'MAC'
)
UPLINK
=
json
.
loads
(
getenv
(
'UPLINK'
,
'[]'
))
ADDRESSES
=
json
.
loads
(
getenv
(
'ADDRESSES'
,
'{}'
))
HA
=
bool
(
getenv
(
'HA'
,
False
))
# 2013-06-26 12:16:59 DHCPACK on 10.4.0.14 to 5c:b5:24:e6:5c:81
# (android_b555bfdba7c837d) via vlan0004
dhcp_ack_re
=
re
.
compile
(
r'\S DHCPACK on (?P<ip>[0-9.]+) to '
r'(?P<mac>[a-zA-Z0-9:]+) '
r'(\((?P<hostname>[^)]+)\) )?'
r'via (?P<interface>[a-zA-Z0-9]+)'
)
# 2013-06-25 11:08:38 DHCPDISCOVER from 48:5b:39:8e:82:78
# via vlan0005: network 10.5.0.0/16: no free leases
dhcp_no_free_re
=
re
.
compile
(
r'\S DHCPDISCOVER '
r'from (?P<mac>[a-zA-Z0-9:]+) '
r'via (?P<interface>[a-zA-Z0-9]+):'
)
def
sudo
(
args
,
stdin
=
None
):
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment