Skip to content

Commit 12dc264

Browse files
yzguyyzguy
committed
T7432: RPKI VRF Support
1 parent c8e468d commit 12dc264

File tree

9 files changed

+225
-109
lines changed

9 files changed

+225
-109
lines changed

‎data/templates/frr/rpki.frr.j2

+18-9
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
!
1+
{% macro rpki_config(rpki) %}
22
{# as FRR does not support deleting the entire rpki section we leave it in place even when it's empty #}
33
rpki
4-
{% if cache is vyos_defined %}
5-
{% for peer, peer_config in cache.items() %}
4+
{% if rpki.cache is vyos_defined %}
5+
{% for peer, peer_config in rpki.cache.items() %}
66
{# port is mandatory and preference uses a default value #}
77
{% if peer_config.ssh.username is vyos_defined %}
88
rpki cache ssh {{ peer | replace('_', '-') }} {{ peer_config.port }} {{ peer_config.ssh.username }} {{ peer_config.ssh.private_key_file }} {{ peer_config.ssh.public_key_file }}{{ ' source ' ~ peer_config.source_address if peer_config.source_address is vyos_defined }} preference {{ peer_config.preference }}
@@ -11,14 +11,23 @@ rpki
1111
{% endif %}
1212
{% endfor %}
1313
{% endif %}
14-
{% if expire_interval is vyos_defined %}
15-
rpki expire_interval {{ expire_interval }}
14+
{% if rpki.expire_interval is vyos_defined %}
15+
rpki expire_interval {{ rpki.expire_interval }}
1616
{% endif %}
17-
{% if polling_period is vyos_defined %}
18-
rpki polling_period {{ polling_period }}
17+
{% if rpki.polling_period is vyos_defined %}
18+
rpki polling_period {{ rpki.polling_period }}
1919
{% endif %}
20-
{% if retry_interval is vyos_defined %}
21-
rpki retry_interval {{ retry_interval }}
20+
{% if rpki.retry_interval is vyos_defined %}
21+
rpki retry_interval {{ rpki.retry_interval }}
2222
{% endif %}
2323
exit
24+
{%- endmacro -%}
25+
!
26+
{% if rpki.vrf is vyos_defined %}
27+
vrf {{ rpki.vrf }}
28+
{{ rpki_config(rpki) | indent(width=1) }}
29+
exit-vrf
30+
{% else %}
31+
{{ rpki_config(rpki) }}
32+
{% endif %}
2433
!

‎data/templates/frr/zebra.vrf.route-map.frr.j2

+22
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,28 @@ vrf {{ vrf }}
2121
ipv6 protocol {{ protocol_name }} route-map {{ protocol_config.route_map }}
2222
{% endfor %}
2323
{% endif %}
24+
{# as FRR does not support deleting the entire rpki section we leave it in place even when it's empty #}
25+
rpki
26+
{% if vrf_config.protocols.rpki is vyos_defined %}
27+
{% for peer, peer_config in vrf_config.protocols.rpki.cache.items() %}
28+
{# port is mandatory and preference uses a default value #}
29+
{% if peer_config.ssh.username is vyos_defined %}
30+
rpki cache ssh {{ peer | replace('_', '-') }} {{ peer_config.port }} {{ peer_config.ssh.username }} {{ peer_config.ssh.private_key_file }} {{ peer_config.ssh.public_key_file }}{{ ' source ' ~ peer_config.source_address if peer_config.source_address is vyos_defined }} preference {{ peer_config.preference }}
31+
{% else %}
32+
rpki cache tcp {{ peer | replace('_', '-') }} {{ peer_config.port }}{{ ' source ' ~ peer_config.source_address if peer_config.source_address is vyos_defined }} preference {{ peer_config.preference }}
33+
{% endif %}
34+
{% endfor %}
35+
{% endif %}
36+
{% if vrf_config.protocols.rpki.expire_interval is vyos_defined %}
37+
rpki expire_interval {{ vrf_config.protocols.rpki.expire_interval }}
38+
{% endif %}
39+
{% if vrf_config.protocols.rpki.polling_period is vyos_defined %}
40+
rpki polling_period {{ vrf_config.protocols.rpki.polling_period }}
41+
{% endif %}
42+
{% if vrf_config.protocols.rpki.retry_interval is vyos_defined %}
43+
rpki retry_interval {{ vrf_config.protocols.rpki.retry_interval }}
44+
{% endif %}
45+
exit
2446
{% if vrf_config.vni is vyos_defined %}
2547
vni {{ vrf_config.vni }}
2648
{% endif %}

‎interface-definitions/include/rpki/protocol-common-config.xml.i

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
<!-- include start from rpki/protocol-common-config.xml.i -->
2+
<tagNode name="cache">
3+
<properties>
4+
<help>RPKI cache server address</help>
5+
<valueHelp>
6+
<format>ipv4</format>
7+
<description>IP address of RPKI server</description>
8+
</valueHelp>
9+
<valueHelp>
10+
<format>ipv6</format>
11+
<description>IPv6 address of RPKI server</description>
12+
</valueHelp>
13+
<valueHelp>
14+
<format>hostname</format>
15+
<description>Fully qualified domain name of RPKI server</description>
16+
</valueHelp>
17+
<constraint>
18+
<validator name="ip-address"/>
19+
<validator name="fqdn"/>
20+
</constraint>
21+
</properties>
22+
<children>
23+
#include <include/port-number.xml.i>
24+
<leafNode name="preference">
25+
<properties>
26+
<help>Preference of the cache server</help>
27+
<valueHelp>
28+
<format>u32:1-255</format>
29+
<description>Preference of the cache server</description>
30+
</valueHelp>
31+
<constraint>
32+
<validator name="numeric" argument="--range 1-255"/>
33+
</constraint>
34+
</properties>
35+
</leafNode>
36+
#include <include/source-address-ipv4.xml.i>
37+
<node name="ssh">
38+
<properties>
39+
<help>RPKI SSH connection settings</help>
40+
</properties>
41+
<children>
42+
#include <include/pki/openssh-key.xml.i>
43+
#include <include/generic-username.xml.i>
44+
</children>
45+
</node>
46+
</children>
47+
</tagNode>
48+
<leafNode name="expire-interval">
49+
<properties>
50+
<help>Interval to wait before expiring the cache</help>
51+
<valueHelp>
52+
<format>u32:600-172800</format>
53+
<description>Interval in seconds</description>
54+
</valueHelp>
55+
<constraint>
56+
<validator name="numeric" argument="--range 600-172800"/>
57+
</constraint>
58+
</properties>
59+
<defaultValue>7200</defaultValue>
60+
</leafNode>
61+
<leafNode name="polling-period">
62+
<properties>
63+
<help>Cache polling interval</help>
64+
<valueHelp>
65+
<format>u32:1-86400</format>
66+
<description>Interval in seconds</description>
67+
</valueHelp>
68+
<constraint>
69+
<validator name="numeric" argument="--range 1-86400"/>
70+
</constraint>
71+
</properties>
72+
<defaultValue>300</defaultValue>
73+
</leafNode>
74+
<leafNode name="retry-interval">
75+
<properties>
76+
<help>Retry interval to connect to the cache server</help>
77+
<valueHelp>
78+
<format>u32:1-7200</format>
79+
<description>Interval in seconds</description>
80+
</valueHelp>
81+
<constraint>
82+
<validator name="numeric" argument="--range 1-7200"/>
83+
</constraint>
84+
</properties>
85+
<defaultValue>600</defaultValue>
86+
</leafNode>
87+
<!-- include end -->

‎interface-definitions/protocols_rpki.xml.in

+1-85
Original file line numberDiff line numberDiff line change
@@ -8,91 +8,7 @@
88
<priority>819</priority>
99
</properties>
1010
<children>
11-
<tagNode name="cache">
12-
<properties>
13-
<help>RPKI cache server address</help>
14-
<valueHelp>
15-
<format>ipv4</format>
16-
<description>IP address of RPKI server</description>
17-
</valueHelp>
18-
<valueHelp>
19-
<format>ipv6</format>
20-
<description>IPv6 address of RPKI server</description>
21-
</valueHelp>
22-
<valueHelp>
23-
<format>hostname</format>
24-
<description>Fully qualified domain name of RPKI server</description>
25-
</valueHelp>
26-
<constraint>
27-
<validator name="ip-address"/>
28-
<validator name="fqdn"/>
29-
</constraint>
30-
</properties>
31-
<children>
32-
#include <include/port-number.xml.i>
33-
<leafNode name="preference">
34-
<properties>
35-
<help>Preference of the cache server</help>
36-
<valueHelp>
37-
<format>u32:1-255</format>
38-
<description>Preference of the cache server</description>
39-
</valueHelp>
40-
<constraint>
41-
<validator name="numeric" argument="--range 1-255"/>
42-
</constraint>
43-
</properties>
44-
</leafNode>
45-
#include <include/source-address-ipv4.xml.i>
46-
<node name="ssh">
47-
<properties>
48-
<help>RPKI SSH connection settings</help>
49-
</properties>
50-
<children>
51-
#include <include/pki/openssh-key.xml.i>
52-
#include <include/generic-username.xml.i>
53-
</children>
54-
</node>
55-
</children>
56-
</tagNode>
57-
<leafNode name="expire-interval">
58-
<properties>
59-
<help>Interval to wait before expiring the cache</help>
60-
<valueHelp>
61-
<format>u32:600-172800</format>
62-
<description>Interval in seconds</description>
63-
</valueHelp>
64-
<constraint>
65-
<validator name="numeric" argument="--range 600-172800"/>
66-
</constraint>
67-
</properties>
68-
<defaultValue>7200</defaultValue>
69-
</leafNode>
70-
<leafNode name="polling-period">
71-
<properties>
72-
<help>Cache polling interval</help>
73-
<valueHelp>
74-
<format>u32:1-86400</format>
75-
<description>Interval in seconds</description>
76-
</valueHelp>
77-
<constraint>
78-
<validator name="numeric" argument="--range 1-86400"/>
79-
</constraint>
80-
</properties>
81-
<defaultValue>300</defaultValue>
82-
</leafNode>
83-
<leafNode name="retry-interval">
84-
<properties>
85-
<help>Retry interval to connect to the cache server</help>
86-
<valueHelp>
87-
<format>u32:1-7200</format>
88-
<description>Interval in seconds</description>
89-
</valueHelp>
90-
<constraint>
91-
<validator name="numeric" argument="--range 1-7200"/>
92-
</constraint>
93-
</properties>
94-
<defaultValue>600</defaultValue>
95-
</leafNode>
11+
#include <include/rpki/protocol-common-config.xml.i>
9612
</children>
9713
</node>
9814
</children>

‎interface-definitions/vrf.xml.in

+9
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,15 @@
9595
#include <include/ospfv3/protocol-common-config.xml.i>
9696
</children>
9797
</node>
98+
<node name="rpki" owner="${vyos_conf_scripts_dir}/protocols_rpki.py $VAR(../../@)">
99+
<properties>
100+
<help>Resource Public Key Infrastructure (RPKI)</help>
101+
<priority>820</priority>
102+
</properties>
103+
<children>
104+
#include <include/rpki/protocol-common-config.xml.i>
105+
</children>
106+
</node>
98107
<node name="static" owner="${vyos_conf_scripts_dir}/protocols_static.py $VAR(../../@)">
99108
<properties>
100109
<help>Static Routing</help>

‎op-mode-definitions/include/rpki/vrf.xml.i

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<!-- include start from rpki/vrf.xml.i -->
2+
<tagNode name="vrf">
3+
<properties>
4+
<help>Virtual Routing and Forwarding (VRF)</help>
5+
<completionHelp>
6+
<path>vrf name</path>
7+
</completionHelp>
8+
</properties>
9+
<command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command>
10+
</tagNode>
11+
<!-- include end -->

‎op-mode-definitions/rpki.xml.in

+46-11
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,28 @@
1515
</completionHelp>
1616
</properties>
1717
<command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command>
18+
<children>
19+
#include <include/rpki/vrf.xml.i>
20+
</children>
1821
</tagNode>
19-
<leafNode name="cache-connection">
22+
<node name="cache-connection">
2023
<properties>
2124
<help>Show RPKI cache connections</help>
2225
</properties>
23-
<command>vtysh -c "show rpki cache-connection"</command>
24-
</leafNode>
25-
<leafNode name="cache-server">
26+
<command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command>
27+
<children>
28+
#include <include/rpki/vrf.xml.i>
29+
</children>
30+
</node>
31+
<node name="cache-server">
2632
<properties>
2733
<help>Show RPKI cache servers information</help>
2834
</properties>
29-
<command>vtysh -c "show rpki cache-server"</command>
30-
</leafNode>
35+
<command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command>
36+
<children>
37+
#include <include/rpki/vrf.xml.i>
38+
</children>
39+
</node>
3140
<tagNode name="prefix">
3241
<properties>
3342
<help>Lookup IP prefix and optionally ASN in prefix table</help>
@@ -45,27 +54,53 @@
4554
</completionHelp>
4655
</properties>
4756
<command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $(echo $@ | sed -e "s/as-number //g")</command>
57+
<children>
58+
<tagNode name="vrf">
59+
<properties>
60+
<help>Virtual Routing and Forwarding (VRF)</help>
61+
<completionHelp>
62+
<path>vrf name</path>
63+
</completionHelp>
64+
</properties>
65+
<command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $(echo $@ | sed -e "s/as-number //g")</command>
66+
</tagNode>
67+
</children>
4868
</tagNode>
69+
#include <include/rpki/vrf.xml.i>
4970
</children>
5071
</tagNode>
51-
<leafNode name="prefix-table">
72+
<node name="prefix-table">
5273
<properties>
5374
<help>Show RPKI-validated prefixes</help>
5475
</properties>
55-
<command>vtysh -c "show rpki prefix-table"</command>
56-
</leafNode>
76+
<command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command>
77+
<children>
78+
#include <include/rpki/vrf.xml.i>
79+
</children>
80+
</node>
5781
</children>
5882
</node>
5983
</children>
6084
</node>
6185
<node name="reset">
6286
<children>
63-
<leafNode name="rpki">
87+
<node name="rpki">
6488
<properties>
6589
<help>Reset RPKI</help>
6690
</properties>
6791
<command>vtysh -c "rpki reset"</command>
68-
</leafNode>
92+
<children>
93+
<tagNode name="vrf">
94+
<properties>
95+
<help>Reset RPKI in VRF</help>
96+
<completionHelp>
97+
<path>vrf name</path>
98+
</completionHelp>
99+
</properties>
100+
<command>vtysh -c "rpki reset vrf $4"</command>
101+
</tagNode>
102+
</children>
103+
</node>
69104
</children>
70105
</node>
71106
</interfaceDefinition>

0 commit comments

Comments
 (0)