-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(ns-ha): handle wg interfaces, ipsec interfaces, routes
- Loading branch information
1 parent
358c9b6
commit 6f4505a
Showing
8 changed files
with
251 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| #!/bin/sh | ||
|
|
||
| . /lib/functions/keepalived/hotplug.sh | ||
|
|
||
| set_service_name network_files | ||
|
|
||
| if [ "$ACTION" == "NOTIFY_MASTER" ]; then | ||
| if [ "$(/usr/libexec/rpcd/ns.ha call status | jq .role)" == "backup" ]; then | ||
| /usr/sbin/ns-ha-enable | ||
| fi | ||
| elif [ "$ACTION" == "NOTIFY_SYNC" ]; then | ||
| home=$(get_rsync_user_home) | ||
| rsync -avr $home/etc/ha/ /etc/ha/ | ||
| /usr/sbin/ns-ha-import | ||
| elif [ "$ACTION" == "NOTIFY_BACKUP" ]; then | ||
| /usr/sbin/ns-ha-disable | ||
| fi | ||
|
|
||
| keepalived_hotplug |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| #!/usr/bin/python3 | ||
|
|
||
| # | ||
| # Copyright (C) 2025 Nethesis S.r.l. | ||
| # SPDX-License-Identifier: GPL-2.0-only | ||
| # | ||
|
|
||
| import os | ||
| import json | ||
| import subprocess | ||
| from euci import EUci | ||
|
|
||
| out_dir = "/etc/ha" | ||
|
|
||
| def disable_interfaces(file): | ||
| u = EUci() | ||
| with open(os.path.join(out_dir, file), 'r') as f: | ||
| interfaces = json.load(f) | ||
| for interface in interfaces.keys(): | ||
| u.set('network', interface, 'disabled', '1') | ||
| u.commit('network') | ||
|
|
||
| def disable_routes(): | ||
| u = EUci() | ||
| with open(os.path.join(out_dir, 'routes'), 'r') as f: | ||
| routes = json.load(f) | ||
| for route in routes.keys(): | ||
| u.set('network', route, 'disabled', '1') | ||
| u.commit('network') | ||
|
|
||
| if __name__ == "__main__": | ||
| disable_interfaces('wg_interfaces') | ||
| disable_interfaces('ipsec_interfaces') | ||
| disable_routes() | ||
| subprocess.run(["/sbin/reload_config"], capture_output=True) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| #!/usr/bin/python3 | ||
|
|
||
| # | ||
| # Copyright (C) 2025 Nethesis S.r.l. | ||
| # SPDX-License-Identifier: GPL-2.0-only | ||
| # | ||
|
|
||
| import os | ||
| import json | ||
| import subprocess | ||
| from euci import EUci | ||
|
|
||
| out_dir = "/etc/ha" | ||
|
|
||
| def enable_interfaces(file): | ||
| u = EUci() | ||
| with open(os.path.join(out_dir, file), 'r') as f: | ||
| interfaces = json.load(f) | ||
| for interface, options in interfaces.items(): | ||
| if options.get('disabled', '0') == '0': | ||
| u.set('network', interface, 'disabled', '0') | ||
| u.commit('network') | ||
|
|
||
| def enable_routes(): | ||
| u = EUci() | ||
| with open(os.path.join(out_dir, 'routes'), 'r') as f: | ||
| routes = json.load(f) | ||
| for route, options in routes.items(): | ||
| if options.get('disabled', '0') == '0': | ||
| u.set('network', route, 'disabled', '0') | ||
| u.commit('network') | ||
|
|
||
| if __name__ == "__main__": | ||
| enable_interfaces('wg_interfaces') | ||
| enable_interfaces('ipsec_interfaces') | ||
| enable_routes() | ||
| subprocess.run(["/sbin/reload_config"], capture_output=True) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| #!/usr/bin/python3 | ||
|
|
||
| # | ||
| # Copyright (C) 2025 Nethesis S.r.l. | ||
| # SPDX-License-Identifier: GPL-2.0-only | ||
| # | ||
|
|
||
| # Export the folloing network configuration to /etc/ha: | ||
| # - routes | ||
| # - ipsec interfaces | ||
| # - wireguard interfaces | ||
| # - wireguard peers | ||
| # This configuration will be imported as disabled on the backup node | ||
|
|
||
| import os | ||
| import json | ||
| from euci import EUci | ||
| from nethsec import utils | ||
|
|
||
| out_dir = "/etc/ha" | ||
|
|
||
| def export_routes(): | ||
| routes = {} | ||
| u = EUci() | ||
| for route in utils.get_all_by_type(u, 'network', 'route'): | ||
| routes[route] = u.get_all('network', route) | ||
|
|
||
| with open(os.path.join(out_dir, 'routes'), 'w') as f: | ||
| json.dump(routes, f) | ||
|
|
||
| def export_ipsec_interfaces(): | ||
| ipsec_interfaces = {} | ||
| u = EUci() | ||
| for interface in utils.get_all_by_type(u, 'network', 'interface'): | ||
| if interface.startswith('ipsec'): | ||
| ipsec_interfaces[interface] = u.get_all('network', interface) | ||
|
|
||
| with open(os.path.join(out_dir, 'ipsec_interfaces'), 'w') as f: | ||
| json.dump(ipsec_interfaces, f) | ||
|
|
||
| def export_wireguard_interfaces(): | ||
| wireguard_interfaces = {} | ||
| u = EUci() | ||
| for interface in utils.get_all_by_type(u, 'network', 'interface'): | ||
| if interface.startswith('wg'): | ||
| wireguard_interfaces[interface] = u.get_all('network', interface) | ||
|
|
||
| with open(os.path.join(out_dir, 'wg_interfaces'), 'w') as f: | ||
| json.dump(wireguard_interfaces, f) | ||
|
|
||
| def export_wireguard_peers(): | ||
| wireguard_peers = {} | ||
| u = EUci() | ||
| for section in u.get_all('network'): | ||
| if u.get('network', section).startswith('wireguard_'): | ||
| wireguard_peers[section] = u.get_all('network', section) | ||
|
|
||
| with open(os.path.join(out_dir, 'wg_peers'), 'w') as f: | ||
| json.dump(wireguard_peers, f) | ||
|
|
||
|
|
||
| if __name__ == '__main__': | ||
| os.makedirs(out_dir, exist_ok=True) | ||
| export_routes() | ||
| export_ipsec_interfaces() | ||
| export_wireguard_interfaces() | ||
| export_wireguard_peers() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| #!/usr/bin/python3 | ||
|
|
||
| # | ||
| # Copyright (C) 2025 Nethesis S.r.l. | ||
| # SPDX-License-Identifier: GPL-2.0-only | ||
| # | ||
|
|
||
| # Import the network configuration exported by the master node but in a disabled state | ||
|
|
||
| import os | ||
| import json | ||
| from euci import EUci | ||
|
|
||
| out_dir = "/etc/ha" | ||
|
|
||
| def import_interfaces(file): | ||
| u = EUci() | ||
| with open(os.path.join(out_dir, file), 'r') as f: | ||
| interfaces = json.load(f) | ||
| for interface, options in interfaces.items(): | ||
| u.set('network', interface, 'interface') | ||
| for opt in options: | ||
| u.set('network', interface, opt, options[opt]) | ||
| u.set('network', interface, 'disabled', '1') | ||
| u.commit('network') | ||
|
|
||
| def import_wireguard_peers(): | ||
| u = EUci() | ||
| with open(os.path.join(out_dir, 'wg_peers'), 'r') as f: | ||
| peers = json.load(f) | ||
| for section, options in peers.items(): | ||
| stype = "wireguard_"+section.split("_")[0] | ||
| u.set('network', section, stype) | ||
| for opt in options: | ||
| u.set('network', section, opt, options[opt]) | ||
| u.commit('network') | ||
|
|
||
| def import_routes(): | ||
| u = EUci() | ||
| with open(os.path.join(out_dir, 'routes'), 'r') as f: | ||
| routes = json.load(f) | ||
| for section, options in routes.items(): | ||
| u.set('network', section, 'route') | ||
| for opt in options: | ||
| u.set('network', section, opt, options[opt]) | ||
| u.set('network', section, 'disabled', '1') | ||
| u.commit('network') | ||
|
|
||
| if __name__ == "__main__": | ||
| import_interfaces('wg_interfaces') | ||
| import_wireguard_peers() | ||
| import_interfaces('ipsec_interfaces') | ||
| import_routes() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters