linux-system-roles / network

An ansible role to configure networking
https://linux-system-roles.github.io/network/
BSD 3-Clause "New" or "Revised" License
237 stars 106 forks source link

Add support for scope and src route options #683

Open jjbc opened 8 months ago

jjbc commented 8 months ago

Could it be possible to add support for scope and src parameters in the route definitions?

An example of route with these parameters in a .nmconnection file:

route3_options=scope=253,src=192.168.12.154,table=200

An implementation approach could be:

In the network_connections.py, add the two new parameters to the NM.IPRoute creation:

      for r in ip["route"]:
          new_route = NM.IPRoute.new(
              r["family"], r["network"], r["prefix"], r["gateway"], r["metric"]
          )
          if r["type"]:
              NM.IPRoute.set_attribute(
                  new_route, "type", Util.GLib().Variant("s", r["type"])
              )
          if r["scope"]:
              NM.IPRoute.set_attribute(
                  new_route, "scope", Util.GLib().Variant.new_byte(r["scope"])
              )
          if r["src"]:
              NM.IPRoute.set_attribute(
                  new_route, "src", Util.GLib().Variant.new_string(r["src"])
              )
          if r["table"]:
              NM.IPRoute.set_attribute(
                  new_route, "table", Util.GLib().Variant.new_uint32(r["table"])
              )

In the argument_validator.py, validate these options inside ArgValidatorIPRoute class:

               ArgValidatorIP(
                    "src", family=family, default_value=None, plain_address=False
                ),
                ArgValidatorNum("scope", default_value=None, val_min=0, val_max=255),
liangwen12year commented 8 months ago

Ok, scope and src are also not supported in network_state, can you provide the user story for it (explain the reason why you want to have this feature)? Also, patches are welcomed though for supporting it.

jjbc commented 7 months ago

Hi, all our servers are configured with two different interfaces, for management and service. By default, we send all the traffic through our service interface. To prevent receiving incoming traffic through our management interface and answering through the service interface, we are configuring routing tables with advanced routing.

We define a routing table for our management interface, which sends back all the management incoming traffic through the management gateway. In this same table, we need to define a link route for the communication with the hosts in the same management VLAN, for which we need to use the scope link route parameter, along with the source IP.

# ip route show table 100
default via 172.23.219.10 dev ens224 proto static metric 101
172.23.219.0/24 dev ens224 proto static scope link src 172.23.219.154 metric 101

Our NM cfg file looks like this:

route10=0.0.0.0/0,172.23.219.10
route10_options=table=100
route11=172.23.219.0/24
route11_options=scope=253,src=172.23.219.154,table=100
routing-rule1=priority 100 from 172.23.219.154/24 table 100

Since we are working behind a corporate proxy with very limited access to internet, we are having many issues when trying to configure an environment where to develop and test a patch. If you think this modification to the role is reasonable, but we have to create the pull request, we could push to deliver it.

liangwen12year commented 7 months ago

Thanks for the clarification, this is a valid and reasonable request for the feature. We can prioritize supporting this feature with medium priority, if you think that you need this feature very soon, patches are welcomed, or do not hesitate to let us know about it, then we can prioritize supporting it sooner.

liangwen12year commented 7 months ago

@jjbc , if you have a plan to work on the feature support, please assign the issue to yourself.

liangwen12year commented 2 months ago

@jjbc , FYI, the route src is already supported in network role, you can configure the route src with network_connections variable.