ifstate 1.13.6__py3-none-any.whl → 2.0.0rc1__py3-none-any.whl

libifstate/routing/__init__.py

@@ -1,6 +1,6 @@
 from libifstate.util import logger, IfStateLogging
 from libifstate.exception import RouteDuplicate, netlinkerror_classes
-from ipaddress import ip_address, ip_network, IPv6Network
+from ipaddress import ip_address, ip_interface, ip_network, IPv6Network
 from pyroute2.netlink.rtnl.fibmsg import FR_ACT_VALUES
 from pyroute2.netlink.rtnl import rt_type
 import collections.abc
@@ -15,6 +15,147 @@ from socket import AF_INET, AF_INET6
 def route_matches(r1, r2, fields=('dst', 'priority', 'proto'), indent=None):
     return _matches(r1, r2, fields, indent)
 
+def parse_route(route, implicit_defaults=True):
+    rt = {}
+
+    if implicit_defaults:
+        rt['type'] = route.get('type', 'unicast')
+
+    if 'to' in route:
+        dst = ip_network(route['to'])
+        rt['dst'] = dst.with_prefixlen
+        has_to = True
+    else:
+        has_to = False
+
+    for key, lookup in RT_LOOKUPS_DICT.items():
+        try:
+            if implicit_defaults:
+                rt[key] = route.get(key, RT_LOOKUPS_DEFAULTS[key])
+                rt[key] = lookup.lookup_id(rt[key])
+            else:
+                if key in route:
+                    rt[key] = route[key]
+                    rt[key] = lookup.lookup_id(rt[key])
+        except KeyError as err:
+            # mapping not available - catch exception and skip it
+            logger.warning('ignoring unknown %s "%s"', key, rt[key],
+                            extra={'iface': rt['dst']})
+            rt[key] = RT_LOOKUPS_DEFAULTS[key]
+
+    if 'type' in rt and type(rt['type']) == str:
+        rt['type'] = rt_type[rt['type']]
+
+    if 'dev' in route:
+        rt['oif'] = route['dev']
+
+    if 'via' in route:
+        via = ip_address(route['via'])
+
+        if not has_to or via.version == dst.version:
+            rt['gateway'] = str(via)
+        else:
+            if via.version == 4:
+                rt['via'] = {
+                    'family': int(AF_INET),
+                    'addr': str(via),
+                }
+            else:
+                rt['via'] = {
+                    'family': int(AF_INET6),
+                    'addr': str(via),
+                }
+
+    if 'src' in route:
+        rt['prefsrc'] = route['src']
+
+    if 'preference' in route:
+        rt['priority'] = route['preference']
+    elif has_to and implicit_defaults:
+        if isinstance(dst, IPv6Network):
+            rt['priority'] = 1024
+        else:
+            rt['priority'] = 0
+
+    if 'vrrp' in route:
+        rt['_vrrp'] = route['vrrp']
+
+    return rt
+
+def parse_routes(routes, implicit_defaults=True):
+    return [parse_route(route, implicit_defaults) for route in routes]
+
+def parse_rule(rule, implicit_defaults=True):
+    ru = {}
+
+    if implicit_defaults:
+        ru['table'] = RTLookups.tables.lookup_id(rule.get('table', 254))
+        ru['protocol'] = RTLookups.protos.lookup_id(rule.get('proto', 0))
+        ru['tos'] = rule.get('tos', 0)
+    else:
+        if 'table' in rule:
+            ru['table'] = RTLookups.tables.lookup_id(rule['table'])
+        if 'proto' in rule:
+            ru['protocol'] = RTLookups.protos.lookup_id(rule['proto'])
+        if 'tos' in rule:
+            ru['tos'] = rule['tos']
+
+    if 'action' in rule and type(rule['action']) == str:
+        ru['action'] = {
+            "to_tbl": "FR_ACT_TO_TBL",
+            "unicast": "FR_ACT_UNICAST",
+            "blackhole": "FR_ACT_BLACKHOLE",
+            "unreachable": "FR_ACT_UNREACHABLE",
+            "prohibit": "FR_ACT_PROHIBIT",
+            "nat": "FR_ACT_NAT",
+        }.get(rule['action'], rule['action'])
+    elif implicit_defaults:
+        ru['action'] = "FR_ACT_TO_TBL"
+
+    if 'fwmark' in rule:
+        ru['fwmark'] = rule['fwmark']
+
+    if 'ipproto' in rule:
+        if type(rule['ipproto']) == str:
+            ru['ip_proto'] = socket.getprotobyname(rule['ipproto'])
+        else:
+            ru['ip_proto'] = rule['ipproto']
+
+    if 'to' in rule:
+        ru['dst'] = str(ip_network(rule['to']).network_address)
+        ru['dst_len'] = ip_network(rule['to']).prefixlen
+
+    if 'from' in rule:
+        if  rule['from'] != "all":
+            ru['src'] = str(ip_interface(rule['from']).ip)
+            ru['src_len'] = ip_network(ip_interface(rule['from']).network).prefixlen
+        else:
+            ru['src'] = "0.0.0.0"
+            ru['src_len'] = 0
+
+    if 'iif' in rule:
+        ru['iifname'] = rule['iif']
+
+    if 'oif' in rule:
+        ru['oifname'] = rule['oif']
+
+    if 'priority' in rule:
+        ru['priority'] = rule['priority']
+
+    if 'vrrp' in rule:
+        ru['_vrrp'] = rule['vrrp']
+
+    if 'family' in rule:
+        assert rule['family'] in ("AF_INET", "inet", 2, "AF_INET6", "inet6", 10), "rule['family'] doesn't have a valid value. This should have already been rejected by the schema validation."
+        if rule['family'] in ("AF_INET", "inet", 2):
+            ru['family'] = AF_INET
+        elif rule['family'] in ("AF_INET6", "inet6", 10):
+            ru['family'] = AF_INET6
+
+    return ru
+
+def parse_rules(rules, implicit_defaults=True):
+    return [parse_rule(rule, implicit_defaults) for rule in rules]
 
 def rule_matches(r1, r2, fields=('priority', 'iif', 'oif', 'dst', 'metric', 'protocol'), indent=None):
     return _matches(r1, r2, fields, indent)
@@ -133,64 +274,36 @@ class Tables(collections.abc.Mapping):
     def __len__(self):
         return len(self.tables)
 
-    def add(self, route):
-        dst = ip_network(route['to'])
-        rt = {
-            'type': route.get('type', 'unicast'),
-            'dst': dst.with_prefixlen,
-        }
-
-        for key, lookup in RT_LOOKUPS_DICT.items():
-            try:
-                rt[key] = route.get(key, RT_LOOKUPS_DEFAULTS[key])
-                rt[key] = lookup.lookup_id(rt[key])
-            except KeyError as err:
-                # mapping not available - catch exception and skip it
-                logger.warning('ignoring unknown %s "%s"', key, rt[key],
-                               extra={'iface': rt['dst'], 'netns': self.netns})
-                rt[key] = RT_LOOKUPS_DEFAULTS[key]
-
-        if type(rt['type']) == str:
-            rt['type'] = rt_type[rt['type']]
-
-        if 'dev' in route:
-            rt['oif'] = route['dev']
-
-        if 'via' in route:
-            via = ip_address(route['via'])
-
-            if via.version == dst.version:
-                rt['gateway'] = str(via)
-            else:
-                if via.version == 4:
-                    rt['via'] = {
-                        'family': int(AF_INET),
-                        'addr': str(via),
-                    }
-                else:
-                    rt['via'] = {
-                        'family': int(AF_INET6),
-                        'addr': str(via),
-                    }
-
-        if 'src' in route:
-            rt['prefsrc'] = route['src']
+    def parse_ignores(self, ignores):
+        parsed = []
+        for ignore in ignores:
+            ignore = parse_route(ignore, False)
+
+            for attr in ['dev', 'oif', 'iif']:
+                if attr in ignore and type(ignore[attr]) == str:
+                    idx = next(
+                        iter(self.netns.ipr.link_lookup(ifname=ignore[attr])), None)
+                    if idx is None:
+                        logger.debug("{} '{}' is unknown, skipping ignore".format(attr, ignore[attr]))
+                        continue
+                    else:
+                        ignore[attr] = idx
+            parsed.append(ignore)
 
-        if 'preference' in route:
-            rt['priority'] = route['preference']
-        elif isinstance(dst, IPv6Network):
-            rt['priority'] = 1024
-        else:
-            rt['priority'] = 0
+        return parsed
 
-        if 'vrrp' in route:
-            rt['_vrrp'] = route['vrrp']
+    def add(self, route):
+        # convert config dict into IFLA keys and values
+        rt = parse_route(route)
 
+        # track route in the corresponding table
         if not rt['table'] in self.tables:
             self.tables[rt['table']] = []
         self.tables[rt['table']].append(rt)
 
     def show_routes(self, ignores):
+        ignores = self.parse_ignores(ignores)
+
         routes = []
         for route in self.netns.ipr.get_routes(family=AF_INET) + self.netns.ipr.get_routes(family=AF_INET6):
             # skip routes from local table
@@ -208,7 +321,7 @@ class Tables(collections.abc.Mapping):
                 continue
 
             if route['dst_len'] > 0:
-                dst = ip_network(
+                dst = ip_interface(
                     '{}/{}'.format(route.get_attr('RTA_DST'), route['dst_len'])).with_prefixlen
             elif route['family'] == AF_INET:
                 dst = ip_network('0.0.0.0/0').with_prefixlen
@@ -322,6 +435,8 @@ class Tables(collections.abc.Mapping):
         return routes
 
     def apply(self, ignores, do_apply, by_vrrp, vrrp_type, vrrp_name, vrrp_state):
+        ignores = self.parse_ignores(ignores)
+
         for table, croutes in self.tables.items():
             log_str = RTLookups.tables.lookup_str(table)
             if self.netns.netns != None:
@@ -413,53 +528,10 @@ class Rules():
         self.rules = []
 
     def add(self, rule):
-        ru = {
-            'table': RTLookups.tables.lookup_id(rule.get('table', 254)),
-            'protocol': RTLookups.protos.lookup_id(rule.get('proto', 0)),
-            'tos': rule.get('tos', 0),
-        }
-
-        if 'action' in rule and type(rule['action']) == str:
-            ru['action'] = {
-                "to_tbl": "FR_ACT_TO_TBL",
-                "unicast": "FR_ACT_UNICAST",
-                "blackhole": "FR_ACT_BLACKHOLE",
-                "unreachable": "FR_ACT_UNREACHABLE",
-                "prohibit": "FR_ACT_PROHIBIT",
-                "nat": "FR_ACT_NAT",
-            }.get(rule['action'], rule['action'])
-        else:
-            ru['action'] = rule.get('action'.lower(), "FR_ACT_TO_TBL")
-
-        if 'fwmark' in rule:
-            ru['fwmark'] = rule['fwmark']
-
-        if 'ipproto' in rule:
-            if type(rule['ipproto']) == str:
-                ru['ip_proto'] = socket.getprotobyname(rule['ipproto'])
-            else:
-                ru['ip_proto'] = rule['ipproto']
-
-        if 'to' in rule:
-            ru['dst'] = str(ip_network(rule['to']).network_address)
-            ru['dst_len'] = ip_network(rule['to']).prefixlen
-
-        if 'from' in rule:
-            ru['src'] = str(ip_network(rule['from']).network_address)
-            ru['src_len'] = ip_network(rule['from']).prefixlen
-
-        if 'iif' in rule:
-            ru['iifname'] = rule['iif']
-
-        if 'oif' in rule:
-            ru['oifname'] = rule['oif']
-
-        if 'priority' in rule:
-            ru['priority'] = rule['priority']
-
-        if 'vrrp' in rule:
-            ru['_vrrp'] = rule['vrrp']
+        # convert config dict into IFLA keys and values
+        ru = parse_rule(rule)
 
+        # track rule
         self.rules.append(ru)
 
     def kernel_rules(self):
@@ -474,13 +546,18 @@ class Rules():
                 'tos': rule['tos'],
             }
 
-            if rule['dst_len'] > 0:
-                ru['dst'] = rule.get_attr('FRA_DST')
-                ru['dst_len'] = rule['dst_len']
+            # add source and destination ip spaces even if they are not given by pyroute2
+            # as the user might specify something like "from: ::/0" explicitly which would not
+            # be present on a krule (because default values are ommited by pyroute2) and therefore
+            # would not match, even though it is the same rule
+            # if the user doesn't specify 'from' or 'to', these fields are just ignored because
+            # rule_matches is instructed to only check fields that are present on the config rule,
+            # meaning that these just get ignored
+            ru['dst'] = rule.get_attr('FRA_DST', default=("::" if rule['family'] == AF_INET6 else "0.0.0.0"))
+            ru['dst_len'] = rule['dst_len']
 
-            if rule['src_len'] > 0:
-                ru['src'] = rule.get_attr('FRA_SRC')
-                ru['src_len'] = rule['src_len']
+            ru['src'] = rule.get_attr('FRA_SRC', default=("::" if rule['family'] == AF_INET6 else "0.0.0.0"))
+            ru['src_len'] = rule['src_len']
 
             for field in ['iifname', 'oifname', 'fwmark', 'ip_proto']:
                 value = rule.get_attr('FRA_{}'.format(field.upper()))
@@ -491,14 +568,13 @@ class Rules():
         return rules
 
     def show_rules(self, ignores):
+        ignores = parse_rules(ignores, implicit_defaults=False)
+
         rules = []
         for rule in self.kernel_rules():
             # skip ignored routes
             ignore = False
             for irule in ignores:
-                if 'proto' in irule:
-                    irule['protocol'] = irule['proto']
-                    del irule['proto']
                 if rule_matches(rule, irule, irule.keys()):
                     ignore = True
                     break
@@ -522,7 +598,7 @@ class Rules():
                 del rule['protocol']
 
             if 'src_len' in rule and rule['src_len'] > 0:
-                rule['from'] = ip_network(
+                rule['from'] = ip_interface(
                     '{}/{}'.format(rule['src'], rule['src_len'])).with_prefixlen
 
             for key in ['src', 'src_len', 'tos', 'protocol']:
@@ -534,33 +610,55 @@ class Rules():
         return rules
 
     def apply(self, ignores, do_apply, by_vrrp, vrrp_type, vrrp_name, vrrp_state):
+        ignores = parse_rules(ignores, implicit_defaults=False)
+
+        # get rules that are currently in the kernels list
         krules = self.kernel_rules()
+
+        # loop over all rules that are wanted by the config
         for rule in self.rules:
             log_str = '#{}'.format(rule['priority'])
+
+            if rule.get('family', None) == AF_INET6:
+                log_str += " (inet6)"
+            elif rule.get('family', None) == AF_INET:
+                log_str += " (inet)"
+
             if self.netns.netns != None:
                 log_str += "[netns={}]".format(self.netns.netns)
 
+            vrrp_matched = vrrp_match(rule, by_vrrp, vrrp_type, vrrp_name, vrrp_state)
+            # 'found' indicates whether the rule wanted by the config was found
+            # in the kernels rules. if not, it is going to be added below
             found = False
-            matched = vrrp_match(rule, by_vrrp, vrrp_type, vrrp_name, vrrp_state)
             for i, krule in enumerate(krules):
                 if rule_matches(
                     rule,
                     krule,
                     # skip helper attrs like _vrrp
+                    # note that rule_matches it told to only check fields that are
+                    # present on the config rule, so additional ones from the krule
+                    # just get ignored
                     [key for key in rule.keys() if key[0] != '_']
                 ):
                     found = True
 
-                    # remove kernel routes due to vrrp_match
-                    if matched != VRRP_MATCH_DISABLE:
+                    # we've just confirmed that this krule matches a rule
+                    # that is wanted by the config so we delete it from the
+                    # krules because any that remain in krule are unwanted
+                    # and get deleted below
+                    # EXCEPT if vrrp tells us to leave it be
+                    if vrrp_matched != VRRP_MATCH_DISABLE:
                         del krules[i]
 
                     break
 
-            if matched not in [VRRP_MATCH_IGNORE, VRRP_MATCH_DISABLE]:
+            if vrrp_matched not in [VRRP_MATCH_IGNORE, VRRP_MATCH_DISABLE]:
                 if found:
+                    # rule already exists
                     logger.log_ok(log_str)
                 else:
+                    # rule doesn't exist, add it
                     logger.log_add(log_str)
 
                     logger.debug("ip rule add: {}".format(
@@ -573,7 +671,12 @@ class Rules():
                             raise
                         logger.warning('rule setup failed: {}'.format(err.args[1]))
 
+        # at this point all wanted rules have been deleted from the krules list,
+        # leaving the rest to be deleted here (see 'del krules[i]' above)
         for rule in krules:
+
+            # if this rule falls into the ignored ones (like the ones set by the kernel itself by default)
+            # we will ignore it and continue
             ignore = False
             for irule in ignores:
                 if 'proto' in irule:
@@ -585,9 +688,26 @@ class Rules():
             if ignore:
                 continue
 
-            logger.log_del('#{}'.format(rule['priority']))
+            log_str = '#{}'.format(rule['priority'])
+
+            if rule.get('family', None) == AF_INET6:
+                log_str += " (inet6)"
+            elif rule.get('family', None) == AF_INET:
+                log_str += " (inet)"
+
+            logger.log_del(log_str)
+
             try:
                 if do_apply:
+                    # for some reason pyroute2 raises an exception when
+                    # we pass an address like "0.0.0.0" or "::" with an
+                    # 'src_len' or 'dst_len' of 0.
+                    # using this as a workaround:
+                    if rule['src_len'] == 0:
+                        del rule['src']
+                    if rule['dst_len'] == 0:
+                        del rule['dst']
+
                     self.netns.ipr.rule('del', **rule)
             except Exception as err:
                 if not isinstance(err, netlinkerror_classes):