bridge: vlan-aware: add new boolean policy "vlan_aware_bridge_address_support"

closes #58

In linux its possible to assign a vlan-aware bridge an ip address
For some use cases is it useful to restrict users from configuring
ips on bridges VA. This patch will let admins and distributions
decide if it is necessary to warn the user in such case.

The patch introduces a new 'address' policy:

 vlan_aware_bridge_address_support: yes|no|on|off|0|1 (default to yes)

[16:46:09] root:~ # cat /var/lib/ifupdown2/policy.d/address.json
{
    "address": {
	"module_globals": {
	    "enable_l3_iface_forwarding_checks": "yes"
	},
	"defaults": {
	    "mtu": "1500",
	    "ip-forward": "on",
	    "ip6-forward": "on"
	}
    }
}
[16:46:16] root:~ # ifquery -a
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

auto bridge
iface bridge
	bridge-ports swp1
	bridge-vlan-aware yes
	address 10.10.10.10/32

[16:46:20] root:~ # ifup -a --syntax-check
[16:46:22] root:~ # echo $?
0
[16:46:33] root:~ # nano /var/lib/ifupdown2/policy.d/address.json
[16:46:47] root:~ # cat /var/lib/ifupdown2/policy.d/address.json
{
    "address": {
	"module_globals": {
	    "enable_l3_iface_forwarding_checks": "yes",
	    "vlan_aware_bridge_address_support": "no"
	},
	"defaults": {
	    "mtu": "1500",
	    "ip-forward": "on",
	    "ip6-forward": "on"
	}
    }
}
[16:46:48] root:~ # ifup -a --syntax-check
warning: bridge: ignoring ip address. Assigning an IP address is not allowed on bridge vlan aware interfaces
[16:46:51] root:~ # echo $?
1
[16:46:52] root:~ #

Reviewed-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: Julien Fortin <julien@cumulusnetworks.com>

diff --git a/debian/changelog b/debian/changelog
index df093f12a5007c906d22f00c122fea72aeac97f6..60d633c6d36322f44dde1691f7d674c3735234e9 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -5,7 +5,7 @@ ifupdown2 (1.2.0) UNRELEASED; urgency=medium
   * VRF slaves: add support for link-down yes
   * addressvirtual: macvlan: add default metric to ip4 and ip6
   * Closes #48: Run up/down on "manual" interfaces, but ignore any errors.
-  * Closes #58: ifupdown2.conf: vlan_aware_bridge_address_support on/off
+  * Closes #58: address addon "vlan_aware_bridge_address_support" policy
   * Traditional bridge support for mstpctl attr: (portautoedge, portrestrrole)
   * Configuration for IPv6 link-local auto-generate mode, new attributes:
         ipv6-addrgen (address addon)

diff --git a/ifupdown2/ifupdown/utils.py b/ifupdown2/ifupdown/utils.py
index f7a89a768460206ff7ef5003556ad31712a46b6c..9c259ceb2c0821bc2b0daffb73153664a01e754e 100644 (file)
--- a/ifupdown2/ifupdown/utils.py
+++ b/ifupdown2/ifupdown/utils.py
@@ -21,10 +21,12 @@ from ipaddr import IPNetwork, IPAddress
 try:
     from ifupdown2.ifupdown.iface import *
 
+    import ifupdown2.ifupdown.policymanager as policymanager
     import ifupdown2.ifupdown.ifupdownflags as ifupdownflags
 except ImportError:
     from ifupdown.iface import *
 
+    import ifupdown.policymanager as policymanager
     import ifupdown.ifupdownflags as ifupdownflags
 
 
@@ -37,6 +39,7 @@ def signal_handler_f(ps, sig, frame):
 class utils():
     logger = logging.getLogger('ifupdown')
     DEVNULL = open(os.devnull, 'w')
+    vlan_aware_bridge_address_support = None
 
     _string_values = {
         "on": True,
@@ -146,8 +149,8 @@ class utils():
         return value
 
     @staticmethod
-    def get_boolean_from_string(value):
-        return utils._string_values.get(value, False)
+    def get_boolean_from_string(value, default=False):
+        return utils._string_values.get(value, default)
 
     @staticmethod
     def get_yesno_boolean(bool):
@@ -331,6 +334,14 @@ class utils():
 
     @classmethod
     def is_addr_ip_allowed_on(cls, ifaceobj, syntax_check=False):
+        if cls.vlan_aware_bridge_address_support is None:
+            cls.vlan_aware_bridge_address_support = utils.get_boolean_from_string(
+                policymanager.policymanager_api.get_module_globals(
+                    module_name='address',
+                    attr='vlan_aware_bridge_address_support'
+                ),
+                True
+            )
         msg = ('%s: ignoring ip address. Assigning an IP '
                'address is not allowed on' % ifaceobj.name)
         if (ifaceobj.role & ifaceRole.SLAVE
@@ -347,8 +358,10 @@ class utils():
                 cls.logger.info(msg)
             return False
         elif (ifaceobj.link_kind & ifaceLinkKind.BRIDGE
-                and ifaceobj.link_privflags & ifaceLinkPrivFlags.BRIDGE_VLAN_AWARE):
-            msg = '%s bridge vlan aware interfaces'
+              and ifaceobj.link_privflags & ifaceLinkPrivFlags.BRIDGE_VLAN_AWARE
+              and not cls.vlan_aware_bridge_address_support
+        ):
+            msg = '%s bridge vlan aware interfaces' % msg
             if syntax_check:
                 cls.logger.warning(msg)
             else: