373 lines
14 KiB
Python
373 lines
14 KiB
Python
# Copyright 2017 FUJITSU LIMITED
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
#
|
|
|
|
from osc_lib.cli import format_columns
|
|
from osc_lib.command import command
|
|
from osc_lib import exceptions
|
|
from osc_lib import utils
|
|
from oslo_log import log as logging
|
|
|
|
from neutronclient._i18n import _
|
|
from neutronclient.common import utils as nc_utils
|
|
from neutronclient.osc import utils as osc_utils
|
|
from neutronclient.osc.v2.vpnaas import utils as vpn_utils
|
|
|
|
|
|
LOG = logging.getLogger(__name__)
|
|
|
|
|
|
_formatters = {
|
|
'peer_cidrs': format_columns.ListColumn
|
|
}
|
|
|
|
|
|
_attr_map = (
|
|
('id', 'ID', osc_utils.LIST_BOTH),
|
|
('name', 'Name', osc_utils.LIST_BOTH),
|
|
('peer_address', 'Peer Address', osc_utils.LIST_BOTH),
|
|
('auth_mode', 'Authentication Algorithm', osc_utils.LIST_BOTH),
|
|
('status', 'Status', osc_utils.LIST_BOTH),
|
|
('tenant_id', 'Project', osc_utils.LIST_LONG_ONLY),
|
|
('peer_cidrs', 'Peer CIDRs', osc_utils.LIST_LONG_ONLY),
|
|
('vpnservice_id', 'VPN Service', osc_utils.LIST_LONG_ONLY),
|
|
('ipsecpolicy_id', 'IPSec Policy', osc_utils.LIST_LONG_ONLY),
|
|
('ikepolicy_id', 'IKE Policy', osc_utils.LIST_LONG_ONLY),
|
|
('mtu', 'MTU', osc_utils.LIST_LONG_ONLY),
|
|
('initiator', 'Initiator', osc_utils.LIST_LONG_ONLY),
|
|
('admin_state_up', 'State', osc_utils.LIST_LONG_ONLY),
|
|
('description', 'Description', osc_utils.LIST_LONG_ONLY),
|
|
('psk', 'Pre-shared Key', osc_utils.LIST_LONG_ONLY),
|
|
('route_mode', 'Route Mode', osc_utils.LIST_LONG_ONLY),
|
|
('local_id', 'Local ID', osc_utils.LIST_LONG_ONLY),
|
|
('peer_id', 'Peer ID', osc_utils.LIST_LONG_ONLY),
|
|
('local_ep_group_id', 'Local Endpoint Group ID', osc_utils.LIST_LONG_ONLY),
|
|
('peer_ep_group_id', 'Peer Endpoint Group ID', osc_utils.LIST_LONG_ONLY),
|
|
)
|
|
|
|
|
|
def _convert_to_lowercase(string):
|
|
return string.lower()
|
|
|
|
|
|
def _get_common_parser(parser, is_create=True):
|
|
parser.add_argument(
|
|
'--description',
|
|
metavar='<description>',
|
|
help=_('Description for the connection'))
|
|
parser.add_argument(
|
|
'--dpd',
|
|
metavar="action=ACTION,interval=INTERVAL,timeout=TIMEOUT",
|
|
type=nc_utils.str2dict_type(
|
|
optional_keys=['action', 'interval', 'timeout']),
|
|
help=vpn_utils.dpd_help("IPsec connection"))
|
|
parser.add_argument(
|
|
'--mtu',
|
|
help=_('MTU size for the connection'))
|
|
parser.add_argument(
|
|
'--initiator',
|
|
choices=['bi-directional', 'response-only'],
|
|
type=_convert_to_lowercase,
|
|
help=_('Initiator state'))
|
|
peer_group = parser.add_mutually_exclusive_group()
|
|
peer_group.add_argument(
|
|
'--peer-cidr',
|
|
dest='peer_cidrs',
|
|
help=_('Remote subnet(s) in CIDR format. '
|
|
'Cannot be specified when using endpoint groups. Only '
|
|
'applicable, if subnet provided for VPN service.')
|
|
)
|
|
peer_group.add_argument(
|
|
'--local-endpoint-group',
|
|
help=_('Local endpoint group (name or ID) with subnet(s) '
|
|
'for IPsec connection')
|
|
)
|
|
parser.add_argument(
|
|
'--peer-endpoint-group',
|
|
help=_('Peer endpoint group (name or ID) with CIDR(s) for '
|
|
'IPSec connection'))
|
|
admin_group = parser.add_mutually_exclusive_group()
|
|
admin_group.add_argument(
|
|
'--enable',
|
|
action='store_true',
|
|
help=_("Enable IPSec site connection")
|
|
)
|
|
admin_group.add_argument(
|
|
'--disable',
|
|
action='store_true',
|
|
help=_("Disable IPSec site connection")
|
|
)
|
|
parser.add_argument(
|
|
'--local-id',
|
|
help=_('An ID to be used instead of the external IP '
|
|
'address for a virtual router'))
|
|
return parser
|
|
|
|
|
|
def _get_common_attrs(client_manager, parsed_args, is_create=True):
|
|
attrs = {}
|
|
if is_create:
|
|
if 'project' in parsed_args and parsed_args.project is not None:
|
|
attrs['tenant_id'] = osc_utils.find_project(
|
|
client_manager.identity,
|
|
parsed_args.project,
|
|
parsed_args.project_domain,
|
|
).id
|
|
if parsed_args.description:
|
|
attrs['description'] = str(parsed_args.description)
|
|
if parsed_args.mtu:
|
|
attrs['mtu'] = parsed_args.mtu
|
|
if parsed_args.enable:
|
|
attrs['admin_state_up'] = True
|
|
if parsed_args.disable:
|
|
attrs['admin_state_up'] = False
|
|
if parsed_args.initiator:
|
|
attrs['initiator'] = parsed_args.initiator
|
|
if parsed_args.dpd:
|
|
vpn_utils.validate_dpd_dict(parsed_args.dpd)
|
|
attrs['dpd'] = parsed_args.dpd
|
|
if parsed_args.local_endpoint_group:
|
|
_local_epg = client_manager.neutronclient.find_resource(
|
|
'endpoint_group',
|
|
parsed_args.local_endpoint_group,
|
|
cmd_resource='endpoint_group')['id']
|
|
attrs['local_ep_group_id'] = _local_epg
|
|
if parsed_args.peer_endpoint_group:
|
|
_peer_epg = client_manager.neutronclient.find_resource(
|
|
'endpoint_group',
|
|
parsed_args.peer_endpoint_group,
|
|
cmd_resource='endpoint_group')['id']
|
|
attrs['peer_ep_group_id'] = _peer_epg
|
|
if parsed_args.peer_cidrs:
|
|
attrs['peer_cidrs'] = parsed_args.peer_cidrs
|
|
if parsed_args.local_id:
|
|
attrs['local_id'] = parsed_args.local_id
|
|
return attrs
|
|
|
|
|
|
class CreateIPsecSiteConnection(command.ShowOne):
|
|
_description = _("Create an IPsec site connection")
|
|
|
|
def get_parser(self, prog_name):
|
|
parser = super(CreateIPsecSiteConnection, self).get_parser(prog_name)
|
|
_get_common_parser(parser)
|
|
parser.add_argument(
|
|
'--peer-id',
|
|
required=True,
|
|
help=_('Peer router identity for authentication. Can be '
|
|
'IPv4/IPv6 address, e-mail address, key id, or FQDN'))
|
|
parser.add_argument(
|
|
'--peer-address',
|
|
required=True,
|
|
help=_('Peer gateway public IPv4/IPv6 address or FQDN'))
|
|
parser.add_argument(
|
|
'--psk',
|
|
required=True,
|
|
help=_('Pre-shared key string.'))
|
|
parser.add_argument(
|
|
'--vpnservice',
|
|
metavar='VPNSERVICE',
|
|
required=True,
|
|
help=_('VPN service instance associated with this '
|
|
'connection (name or ID)'))
|
|
parser.add_argument(
|
|
'--ikepolicy',
|
|
metavar='IKEPOLICY',
|
|
required=True,
|
|
help=_('IKE policy associated with this connection (name or ID)'))
|
|
parser.add_argument(
|
|
'--ipsecpolicy',
|
|
metavar='IPSECPOLICY',
|
|
required=True,
|
|
help=_('IPsec policy associated with this connection '
|
|
'(name or ID)'))
|
|
parser.add_argument(
|
|
'name',
|
|
metavar='<name>',
|
|
help=_('Set friendly name for the connection'))
|
|
osc_utils.add_project_owner_option_to_parser(parser)
|
|
return parser
|
|
|
|
def take_action(self, parsed_args):
|
|
client = self.app.client_manager.neutronclient
|
|
attrs = _get_common_attrs(self.app.client_manager, parsed_args)
|
|
if parsed_args.vpnservice:
|
|
_vpnservice_id = client.find_resource(
|
|
'vpnservice',
|
|
parsed_args.vpnservice,
|
|
cmd_resource='vpnservice')['id']
|
|
attrs['vpnservice_id'] = _vpnservice_id
|
|
if parsed_args.ikepolicy:
|
|
_ikepolicy_id = client.find_resource(
|
|
'ikepolicy',
|
|
parsed_args.ikepolicy,
|
|
cmd_resource='ikepolicy')['id']
|
|
attrs['ikepolicy_id'] = _ikepolicy_id
|
|
if parsed_args.ipsecpolicy:
|
|
_ipsecpolicy_id = client.find_resource(
|
|
'ipsecpolicy',
|
|
parsed_args.ipsecpolicy,
|
|
cmd_resource='ipsecpolicy')['id']
|
|
attrs['ipsecpolicy_id'] = _ipsecpolicy_id
|
|
if parsed_args.peer_id:
|
|
attrs['peer_id'] = parsed_args.peer_id
|
|
if parsed_args.peer_address:
|
|
attrs['peer_address'] = parsed_args.peer_address
|
|
if parsed_args.psk:
|
|
attrs['psk'] = parsed_args.psk
|
|
if parsed_args.name:
|
|
attrs['name'] = parsed_args.name
|
|
if (bool(parsed_args.local_endpoint_group) !=
|
|
bool(parsed_args.peer_endpoint_group)):
|
|
message = _("You must specify both local and peer endpoint "
|
|
"groups")
|
|
raise exceptions.CommandError(message)
|
|
if not parsed_args.peer_cidrs and not parsed_args.local_endpoint_group:
|
|
message = _("You must specify endpoint groups or peer CIDR(s)")
|
|
raise exceptions.CommandError(message)
|
|
obj = client.create_ipsec_site_connection(
|
|
{'ipsec_site_connection': attrs})['ipsec_site_connection']
|
|
columns, display_columns = osc_utils.get_columns(obj, _attr_map)
|
|
data = utils.get_dict_properties(obj, columns, formatters=_formatters)
|
|
return display_columns, data
|
|
|
|
|
|
class DeleteIPsecSiteConnection(command.Command):
|
|
_description = _("Delete IPsec site connection(s)")
|
|
|
|
def get_parser(self, prog_name):
|
|
parser = super(DeleteIPsecSiteConnection, self).get_parser(prog_name)
|
|
parser.add_argument(
|
|
'ipsec_site_connection',
|
|
metavar='<ipsec-site-connection>',
|
|
nargs='+',
|
|
help=_('IPsec site connection to delete (name or ID)'))
|
|
return parser
|
|
|
|
def take_action(self, parsed_args):
|
|
client = self.app.client_manager.neutronclient
|
|
result = 0
|
|
for ipsec_conn in parsed_args.ipsec_site_connection:
|
|
try:
|
|
ipsec_con_id = client.find_resource(
|
|
'ipsec_site_connection',
|
|
ipsec_conn,
|
|
cmd_resource='ipsec_site_connection')['id']
|
|
client.delete_ipsec_site_connection(ipsec_con_id)
|
|
except Exception as e:
|
|
result += 1
|
|
LOG.error(_("Failed to delete IPsec site connection with "
|
|
"name or ID '%(ipsec_site_conn)s': %(e)s"),
|
|
{'ipsec_site_conn': ipsec_conn, 'e': e})
|
|
|
|
if result > 0:
|
|
total = len(parsed_args.ipsec_site_connection)
|
|
msg = (_("%(result)s of %(total)s IPsec site connection failed "
|
|
"to delete.") % {'result': result, 'total': total})
|
|
raise exceptions.CommandError(msg)
|
|
|
|
|
|
class ListIPsecSiteConnection(command.Lister):
|
|
_description = _("List IPsec site connections "
|
|
"that belong to a given project")
|
|
|
|
def get_parser(self, prog_name):
|
|
parser = super(ListIPsecSiteConnection, self).get_parser(prog_name)
|
|
parser.add_argument(
|
|
'--long',
|
|
action='store_true',
|
|
default=False,
|
|
help=_("List additional fields in output")
|
|
)
|
|
return parser
|
|
|
|
def take_action(self, parsed_args):
|
|
client = self.app.client_manager.neutronclient
|
|
obj = client.list_ipsec_site_connections()['ipsec_site_connections']
|
|
headers, columns = osc_utils.get_column_definitions(
|
|
_attr_map, long_listing=parsed_args.long)
|
|
return (headers, (utils.get_dict_properties(
|
|
s, columns, formatters=_formatters) for s in obj))
|
|
|
|
|
|
class SetIPsecSiteConnection(command.Command):
|
|
_description = _("Set IPsec site connection properties")
|
|
|
|
def get_parser(self, prog_name):
|
|
parser = super(SetIPsecSiteConnection, self).get_parser(prog_name)
|
|
_get_common_parser(parser)
|
|
parser.add_argument(
|
|
'--peer-id',
|
|
help=_('Peer router identity for authentication. Can be '
|
|
'IPv4/IPv6 address, e-mail address, key id, or FQDN'))
|
|
parser.add_argument(
|
|
'--peer-address',
|
|
help=_('Peer gateway public IPv4/IPv6 address or FQDN'))
|
|
parser.add_argument(
|
|
'--name',
|
|
metavar='<name>',
|
|
help=_('Set friendly name for the connection'))
|
|
parser.add_argument(
|
|
'ipsec_site_connection',
|
|
metavar='<ipsec-site-connection>',
|
|
help=_('IPsec site connection to set (name or ID)'))
|
|
return parser
|
|
|
|
def take_action(self, parsed_args):
|
|
client = self.app.client_manager.neutronclient
|
|
attrs = _get_common_attrs(self.app.client_manager,
|
|
parsed_args, is_create=False)
|
|
if parsed_args.peer_id:
|
|
attrs['peer_id'] = parsed_args.peer_id
|
|
if parsed_args.peer_address:
|
|
attrs['peer_address'] = parsed_args.peer_address
|
|
if parsed_args.name:
|
|
attrs['name'] = parsed_args.name
|
|
ipsec_conn_id = client.find_resource(
|
|
'ipsec_site_connection', parsed_args.ipsec_site_connection,
|
|
cmd_resource='ipsec_site_connection')['id']
|
|
try:
|
|
client.update_ipsec_site_connection(
|
|
ipsec_conn_id,
|
|
{'ipsec_site_connection': attrs})
|
|
except Exception as e:
|
|
msg = (_("Failed to set IPsec site "
|
|
"connection '%(ipsec_conn)s': %(e)s")
|
|
% {'ipsec_conn': parsed_args.ipsec_site_connection, 'e': e})
|
|
raise exceptions.CommandError(msg)
|
|
|
|
|
|
class ShowIPsecSiteConnection(command.ShowOne):
|
|
_description = _("Show information of a given IPsec site connection")
|
|
|
|
def get_parser(self, prog_name):
|
|
parser = super(ShowIPsecSiteConnection, self).get_parser(prog_name)
|
|
parser.add_argument(
|
|
'ipsec_site_connection',
|
|
metavar='<ipsec-site-connection>',
|
|
help=_('IPsec site connection to display (name or ID)'))
|
|
return parser
|
|
|
|
def take_action(self, parsed_args):
|
|
client = self.app.client_manager.neutronclient
|
|
ipsec_site_id = client.find_resource(
|
|
'ipsec_site_connection', parsed_args.ipsec_site_connection,
|
|
cmd_resource='ipsec_site_connection')['id']
|
|
obj = client.show_ipsec_site_connection(
|
|
ipsec_site_id)['ipsec_site_connection']
|
|
columns, display_columns = osc_utils.get_columns(obj, _attr_map)
|
|
data = utils.get_dict_properties(obj, columns, formatters=_formatters)
|
|
return (display_columns, data)
|