Google
Edit File: network_manager.py
# Copyright 2022 Red Hat, Inc. # # Author: Lubomir Rintel <lkundrak@v3.sk> # Fixes and suggestions contributed by James Falcon, Neal Gompa, # Zbigniew Jędrzejewski-Szmek and Emanuele Giuseppe Esposito. # # This file is part of cloud-init. See LICENSE file for license information. import configparser import io import itertools import logging import os import uuid from typing import List, Optional from cloudinit import subp, util from cloudinit.net import ( is_ipv6_address, is_ipv6_network, renderer, subnet_is_ipv6, ) from cloudinit.net.network_state import NetworkState from cloudinit.net.sysconfig import available_nm_ifcfg_rh NM_RUN_DIR = "/etc/NetworkManager" NM_LIB_DIR = "/usr/lib/NetworkManager" IFCFG_CFG_FILE = "/etc/sysconfig/network-scripts" NM_IPV6_ADDR_GEN_CONF = """# This is generated by cloud-init. Do not edit. # [.config] enable=nm-version-min:1.40 [connection.30-cloud-init-ip6-addr-gen-mode] # Select EUI64 to be used if the profile does not specify it. ipv6.addr-gen-mode=0 """ LOG = logging.getLogger(__name__) class NMConnection: """Represents a NetworkManager connection profile.""" def __init__(self, con_id): """ Initializes the connection with some very basic properties, notably the UUID so that the connection can be referred to. """ # Chosen by fair dice roll CI_NM_UUID = uuid.UUID("a3924cb8-09e0-43e9-890b-77972a800108") self.config = configparser.ConfigParser() # Identity option name mapping, to achieve case sensitivity self.config.optionxform = str self.config["connection"] = { "id": f"cloud-init {con_id}", "uuid": str(uuid.uuid5(CI_NM_UUID, con_id)), "autoconnect-priority": "120", } # This is not actually used anywhere, but may be useful in future self.config["user"] = { "org.freedesktop.NetworkManager.origin": "cloud-init" } def _set_default(self, section, option, value): """ Sets a property unless it's already set, ensuring the section exists. """ if not self.config.has_section(section): self.config[section] = {} if not self.config.has_option(section, option): self.config[section][option] = value def _config_option_is_set(self, section, option): """ Checks if a config option is set. Returns True if it is, else returns False. """ return self.config.has_section(section) and self.config.has_option( section, option ) def _get_config_option(self, section, option): """ Returns the value of a config option if its set, else returns None. """ if self._config_option_is_set(section, option): return self.config[section][option] else: return None def _change_set_config_option(self, section, option, value): """ Overrides the value of a config option if its already set. Else, if the config option is not set, it does nothing. """ if self._config_option_is_set(section, option): self.config[section][option] = value def _set_mayfail_true_if_both_false_dhcp(self): """ If for both ipv4 and ipv6, 'may-fail' is set to be False, set it to True for both of them. """ for family in ["ipv4", "ipv6"]: if self._get_config_option(family, "may-fail") != "false": # if either ipv4 or ipv6 sections are not set/configured, # or if both are configured but for either ipv4 or ipv6, # 'may-fail' is not 'false', do not do anything. return if self._get_config_option(family, "method") not in [ "dhcp", "auto", ]: # if both v4 and v6 are not dhcp, do not do anything. return # If we landed here, it means both ipv4 and ipv6 are configured # with dhcp/auto and both have 'may-fail' set to 'false'. So set # both to 'true'. for family in ["ipv4", "ipv6"]: self._change_set_config_option(family, "may-fail", "true") def _set_ip_method(self, family, subnet_type): """ Ensures there's appropriate [ipv4]/[ipv6] for given family appropriate for given configuration type """ method_map = { "static": "manual", "static6": "manual", "dhcp6": "auto", "ipv6_slaac": "auto", "ipv6_dhcpv6-stateless": "auto", "ipv6_dhcpv6-stateful": "dhcp", "dhcp4": "auto", "dhcp": "auto", } # Ensure we have an [ipvX] section, default to disabled method = "disabled" self._set_default(family, "method", method) try: if subnet_type: method = method_map[subnet_type] except KeyError: # What else can we do method = "auto" self.config[family]["may-fail"] = "true" # Make sure we don't "downgrade" the method in case # we got conflicting subnets (e.g. static along with dhcp) if self.config[family]["method"] == "dhcp": return if self.config[family]["method"] == "auto" and method == "manual": return if subnet_type in [ "ipv6_dhcpv6-stateful", "ipv6_dhcpv6-stateless", "ipv6_slaac", ]: # set ipv4 method to 'disabled' to align with sysconfig renderer. self._set_default("ipv4", "method", "disabled") self.config[family]["method"] = method # Network Manager sets the value of `may-fail` to `True` by default. # Please see https://www.networkmanager.dev/docs/api/1.32.10/settings-ipv6.html. # Therefore, when no configuration for ipv4 or ipv6 is specified, # `may-fail = True` applies. When the user explicitly configures ipv4 # or ipv6, `may-fail` is set to `False`. This is so because it is # assumed that a network failure with the user provided configuration # is unexpected. In other words, we think that the user knows what # works in their target environment and what does not and they have # correctly configured cloud-init network configuration such that # it works in that environment. When no such configuration is # specified, we do not know what would work and what would not in # user's environment. Therefore, we are more conservative in assuming # that failure with ipv4 or ipv6 can be expected or tolerated. self._set_default(family, "may-fail", "false") def _get_next_numbered_section(self, section, key_prefix) -> str: if not self.config.has_section(section): self.config[section] = {} for index in itertools.count(1): key = f"{key_prefix}{index}" if not self.config.has_option(section, key): return key return "not_possible" # for typing def _add_numbered(self, section, key_prefix, value): """ Adds a numbered property, such as address<n> or route<n>, ensuring the appropriate value gets used for <n>. """ key = self._get_next_numbered_section(section, key_prefix) self.config[section][key] = value def _add_route_options(self, section, route, key, value): """Add route options to a given route Example: Given: section: ipv4 route: route0 key: mtu value: 500 Create line under [ipv4] section: route0_options=mtu=500 If the line already exists, then append the new key/value pair """ numbered_key = f"{route}_options" route_options = self.config[section].get(numbered_key) self.config[section][numbered_key] = ( f"{route_options},{key}={value}" if route_options else f"{key}={value}" ) def _add_address(self, family, subnet): """ Adds an ipv[46]address<n> property. """ value = subnet["address"] + "/" + str(subnet["prefix"]) self._add_numbered(family, "address", value) def _is_default_route(self, route): default_nets = ("::", "0.0.0.0") return route["prefix"] == 0 and route["network"] in default_nets def _add_route(self, route): """Adds a ipv[46].route<n> property.""" # Because network v2 route definitions can have mixed v4 and v6 # routes, determine the family per route based on the network family = "ipv6" if is_ipv6_network(route["network"]) else "ipv4" value = f'{route["network"]}/{route["prefix"]}' if "gateway" in route: value += f',{route["gateway"]}' if "metric" in route: if self._is_default_route(route): self.config[family]["route-metric"] = f'{route["metric"]}' else: value += f',{route["metric"]}' route_key = self._get_next_numbered_section(family, "route") self.config[family][route_key] = value if "mtu" in route: self._add_route_options(family, route_key, "mtu", route["mtu"]) def _add_nameserver(self, dns: str) -> None: """ Extends the ipv[46].dns property with a name server. """ family = "ipv6" if is_ipv6_address(dns) else "ipv4" if ( self.config.has_section(family) and self._get_config_option(family, "method") != "disabled" ): self._set_default(family, "dns", "") self.config[family]["dns"] = self.config[family]["dns"] + dns + ";" def _add_dns_search(self, dns_search: List[str]) -> None: """ Extends the ipv[46].dns-search property with a name server. """ for family in ["ipv4", "ipv6"]: if ( self.config.has_section(family) and self._get_config_option(family, "method") != "disabled" ): self._set_default(family, "dns-search", "") self.config[family]["dns-search"] = ( self.config[family]["dns-search"] + ";".join(dns_search) + ";" ) def con_uuid(self): """ Returns the connection UUID """ return self.config["connection"]["uuid"] def valid(self): """ Can this be serialized into a meaningful connection profile? """ return self.config.has_option("connection", "type") @staticmethod def mac_addr(addr): """ Sanitize a MAC address. """ return addr.replace("-", ":").upper() def render_interface(self, iface, network_state, renderer): """ Integrate information from network state interface information into the connection. Most of the work is done here. """ # Initialize type & connectivity _type_map = { "physical": "ethernet", "vlan": "vlan", "bond": "bond", "bridge": "bridge", "infiniband": "infiniband", "loopback": None, } if_type = _type_map[iface["type"]] if if_type is None: return if "bond-master" in iface: slave_type = "bond" else: slave_type = None self.config["connection"]["type"] = if_type if slave_type is not None: self.config["connection"]["slave-type"] = slave_type self.config["connection"]["master"] = renderer.con_ref( iface[slave_type + "-master"] ) # Add type specific-section self.config[if_type] = {} # These are the interface properties that map nicely # to NetworkManager properties # NOTE: Please ensure these items are formatted so as # to match the schema in schema-network-config-v1.json # # Supported parameters # https://networkmanager.dev/docs/libnm/latest/NMSettingBond.html#NMSettingBond.other # https://www.kernel.org/doc/Documentation/networking/bonding.txt _prop_map = { "bond": { "mode": "bond-mode", "miimon": "bond-miimon", # only in balance-xor(2), 802.3ad(4), balance-tlb(5) "xmit_hash_policy": "bond-xmit_hash_policy", # only in active-backup(1) "num_grat_arp": "bond-num_grat_arp", "downdelay": "bond-downdelay", "updelay": "bond-updelay", "fail_over_mac": "bond-fail_over_mac", # only in active-backup(1), balance-tlb(5), balance-alb(6) "primary_reselect": "bond-primary_reselect", # only in active-backup(1), balance-tlb(5), balance-alb(6) "primary": "bond-primary", # only in active-backup(1), balance-tlb(5), balance-alb(6) "active_slave": "bond-active_slave", # only in 802.3ad(4) "ad_actor_sys_prio": "bond-ad_actor_sys_prio", # only in 802.3ad(4) "ad_actor_system": "bond-ad_actor_system", # only in 802.3ad(4) "ad_select": "bond-ad_select", # only in 802.3ad(4) "ad_user_port_key": "bond-ad_user_port_key", "all_slaves_active": "bond-all_slaves_active", "arp_all_targets": "bond-arp_all_targets", "arp_interval": "bond-arp_interval", "arp_ip_target": "bond-arp_ip_target", "arp_validate": "bond-arp_validate", # only in 802.3ad(4) "lacp_rate": "bond-lacp_rate", # only in balance-tlb(5), balance-alb(6) "lp_interval": "bond-lp_interval", # only in 802.3ad(4) "min_links": "bond-min_links", # only in active-backup(1) "num_unsol_na": "bond-num_unsol_na", # only in balance-rr(0) "packets_per_slave": "bond-packets_per_slave", # only in active-backup(1) "peer_notif_delay": "bond-peer_notif_delay", # only in active-backup(1), balance rr(0), tlb(5), alb(6) "resend_igmp": "bond-resend_igmp", # only in balance-tlb(5) "tlb_dynamic_lb": "bond-tlb_dynamic_lb", "use_carrier": "bond-use_carrier", }, "bridge": { "stp": "bridge_stp", "priority": "bridge_bridgeprio", }, "vlan": { "id": "vlan_id", }, "ethernet": {}, "infiniband": {}, } device_mtu = iface["mtu"] ipv4_mtu = None found_nameservers = [] found_dns_search = [] # Deal with Layer 3 configuration if if_type == "bond" and not iface["subnets"]: # If there is no L3 subnet config for a given connection, # ensure it is disabled. Without this, the interface # defaults to 'auto' which implies DHCP. This is problematic # for certain configurations such as bonds where the root # device itself may not have a subnet config and should be # disabled while a separate VLAN interface on the bond holds # the subnet information. for family in ["ipv4", "ipv6"]: self._set_ip_method(family, None) for subnet in iface["subnets"]: family = "ipv6" if subnet_is_ipv6(subnet) else "ipv4" self._set_ip_method(family, subnet["type"]) if "address" in subnet: self._add_address(family, subnet) if "gateway" in subnet: self.config[family]["gateway"] = subnet["gateway"] for route in subnet["routes"]: self._add_route(route) # Add subnet-level DNS if "dns_nameservers" in subnet: found_nameservers.extend(subnet["dns_nameservers"]) if "dns_search" in subnet: found_dns_search.extend(subnet["dns_search"]) if family == "ipv4" and "mtu" in subnet: ipv4_mtu = subnet["mtu"] # Add interface-level DNS if "dns" in iface: found_nameservers += [ dns for dns in iface["dns"]["nameservers"] if dns not in found_nameservers ] found_dns_search += [ search for search in iface["dns"]["search"] if search not in found_dns_search ] # We prefer any interface-specific DNS entries, but if we do not # have any, add the global DNS to the connection if not found_nameservers and network_state.dns_nameservers: found_nameservers = network_state.dns_nameservers if not found_dns_search and network_state.dns_searchdomains: found_dns_search = network_state.dns_searchdomains # Write out all DNS entries to the connection for nameserver in found_nameservers: self._add_nameserver(nameserver) if found_dns_search: self._add_dns_search(found_dns_search) # we do not want to set may-fail to false for both ipv4 and ipv6 dhcp # at the at the same time. This will make the network configuration # work only when both ipv4 and ipv6 dhcp succeeds. This may not be # what we want. If we have configured both ipv4 and ipv6 dhcp, any one # succeeding should be enough. Therefore, if "may-fail" is set to # False for both ipv4 and ipv6 dhcp, set them both to True. self._set_mayfail_true_if_both_false_dhcp() if ipv4_mtu is None: ipv4_mtu = device_mtu if not ipv4_mtu == device_mtu: LOG.warning( "Network config: ignoring %s device-level mtu:%s" " because ipv4 subnet-level mtu:%s provided.", iface["name"], device_mtu, ipv4_mtu, ) # Parse type-specific properties for nm_prop, key in _prop_map[if_type].items(): if key not in iface: continue if iface[key] is None: continue if isinstance(iface[key], bool): self.config[if_type][nm_prop] = ( "true" if iface[key] else "false" ) else: self.config[if_type][nm_prop] = str(iface[key]) # These ones need special treatment if if_type == "ethernet": if iface["wakeonlan"] is True: # NM_SETTING_WIRED_WAKE_ON_LAN_MAGIC self.config["ethernet"]["wake-on-lan"] = str(0x40) if ipv4_mtu is not None: self.config["ethernet"]["mtu"] = str(ipv4_mtu) if iface["mac_address"] is not None: self.config["ethernet"]["mac-address"] = self.mac_addr( iface["mac_address"] ) if if_type == "vlan" and "vlan-raw-device" in iface: self.config["vlan"]["parent"] = renderer.con_ref( iface["vlan-raw-device"] ) if if_type == "bond" and ipv4_mtu is not None: if "ethernet" not in self.config: self.config["ethernet"] = {} self.config["ethernet"]["mtu"] = str(ipv4_mtu) if if_type == "bridge": # Bridge is ass-backwards compared to bond for port in iface["bridge_ports"]: port = renderer.get_conn(port) port._set_default("connection", "slave-type", "bridge") port._set_default("connection", "master", self.con_uuid()) if iface["mac_address"] is not None: self.config["bridge"]["mac-address"] = self.mac_addr( iface["mac_address"] ) if if_type == "infiniband" and ipv4_mtu is not None: self.config["infiniband"]["transport-mode"] = "datagram" self.config["infiniband"]["mtu"] = str(ipv4_mtu) if iface["mac_address"] is not None: self.config["infiniband"]["mac-address"] = self.mac_addr( iface["mac_address"] ) # Finish up if if_type == "bridge" or not self.config.has_option( if_type, "mac-address" ): self.config["connection"]["interface-name"] = iface["name"] def dump(self): """ Stringify. """ buf = io.StringIO() self.config.write(buf, space_around_delimiters=False) header = "# Generated by cloud-init. Changes will be lost.\n\n" return header + buf.getvalue() class Renderer(renderer.Renderer): """Renders network information in a NetworkManager keyfile format. See https://networkmanager.dev/docs/api/latest/nm-settings-keyfile.html """ def __init__(self, config=None): self.connections = {} self.config = config def get_conn(self, con_id): return self.connections[con_id] def con_ref(self, con_id): if con_id in self.connections: return self.connections[con_id].con_uuid() else: # Well, what can we do... return con_id def render_network_state( self, network_state: NetworkState, templates: Optional[dict] = None, target=None, ) -> None: # First pass makes sure there's NMConnections for all known # interfaces that have UUIDs that can be linked to from related # interfaces for iface in network_state.iter_interfaces(): conn_key = iface.get("config_id") or iface["name"] self.connections[conn_key] = NMConnection(iface["name"]) # Now render the actual interface configuration for iface in network_state.iter_interfaces(): conn_key = iface.get("config_id") or iface["name"] conn = self.connections[conn_key] conn.render_interface(iface, network_state, self) # And finally write the files for con_id, conn in self.connections.items(): if not conn.valid(): continue name = nm_conn_filename(con_id, target) util.write_file(name, conn.dump(), 0o600) # Select EUI64 to be used by default by NM for creating the address # for use with RFC4862 IPv6 Stateless Address Autoconfiguration. util.write_file( cloud_init_nm_conf_filename(target), NM_IPV6_ADDR_GEN_CONF, 0o600 ) def nm_conn_filename(con_id, target=None): target_con_dir = subp.target_path(target, NM_RUN_DIR) con_file = f"cloud-init-{con_id}.nmconnection" return f"{target_con_dir}/system-connections/{con_file}" def sysconfig_conn_filename(devname, target=None): target_con_dir = subp.target_path(target, IFCFG_CFG_FILE) con_file = f"ifcfg-{devname}" return f"{target_con_dir}/{con_file}" def conn_filename(devname): """ This function returns the name of the interface config file. It first checks for presence of network manager connection file. If absent and ifcfg-rh plugin for network manager is available, it returns the name of the ifcfg file if it is present. If the plugin is not present or the plugin is present but ifcfg file is not, it returns None. This function is called from NetworkManagerActivator class in activators.py. """ conn_file = nm_conn_filename(devname) # If the network manager connection file is absent, also check for # presence of ifcfg files for the same interface (if nm-ifcfg-rh plugin is # present, network manager can handle ifcfg files). If both network manager # connection file and ifcfg files are absent, return None. if not os.path.isfile(conn_file) and available_nm_ifcfg_rh(): conn_file = sysconfig_conn_filename(devname) return conn_file if os.path.isfile(conn_file) else None def cloud_init_nm_conf_filename(target=None): target_con_dir = subp.target_path(target, NM_RUN_DIR) conf_file = "30-cloud-init-ip6-addr-gen-mode.conf" return f"{target_con_dir}/conf.d/{conf_file}" def available(target=None): # TODO: Move `uses_systemd` to a more appropriate location # It is imported here to avoid circular import from cloudinit.distros import uses_systemd nmcli_present = subp.which("nmcli", target=target) service_active = True if uses_systemd(): try: subp.subp(["systemctl", "is-enabled", "NetworkManager.service"]) except subp.ProcessExecutionError: service_active = False return bool(nmcli_present) and service_active