wlb: T4470: Migrate WAN Load Balancer to XML/Python

data/op-mode-standardized.json

@@ -13,6 +13,7 @@
 "evpn.py",
 "interfaces.py",
 "ipsec.py",
+"load-balancing_wan.py",
 "lldp.py",
 "log.py",
 "memory.py",

data/templates/load-balancing/nftables-wlb.j2

@@ -0,0 +1,64 @@
+#!/usr/sbin/nft -f
+
+{% if first_install is not vyos_defined %}
+delete table ip vyos_wanloadbalance
+{% endif %}
+table ip vyos_wanloadbalance {
+    chain wlb_nat_postrouting {
+        type nat hook postrouting priority srcnat - 1; policy accept;
+{% for ifname, health_conf in interface_health.items() if health_state[ifname].if_addr %}
+{%     if disable_source_nat is not vyos_defined %}
+{%         set state = health_state[ifname] %}
+        ct mark {{ state.mark }} counter snat to {{ state.if_addr }}
+{%     endif %}
+{% endfor %}
+    }
+
+    chain wlb_mangle_prerouting {
+        type filter hook prerouting priority mangle; policy accept;
+{% for ifname, health_conf in interface_health.items() %}
+{%     set state = health_state[ifname] %}
+{%     if sticky_connections is vyos_defined %}
+        iifname "{{ ifname }}" ct state new ct mark set {{ state.mark }}
+{%     endif %}
+{% endfor %}
+{% if rule is vyos_defined %}
+{%     for rule_id, rule_conf in rule.items() %}
+{%         if rule_conf.exclude is vyos_defined %}
+        {{ rule_conf | wlb_nft_rule(rule_id, exclude=True, action='accept') }}
+{%         else %}
+{%             set limit = rule_conf.limit is vyos_defined %}
+        {{ rule_conf | wlb_nft_rule(rule_id, limit=limit, weight=True, health_state=health_state) }}
+        {{ rule_conf | wlb_nft_rule(rule_id, restore_mark=True) }}
+{%         endif %}
+{%     endfor %}
+{% endif %}
+    }
+
+    chain wlb_mangle_output {
+        type filter hook output priority -150; policy accept;
+{% if enable_local_traffic is vyos_defined %}
+        meta mark != 0x0 counter accept
+        meta l4proto icmp counter accept
+        ip saddr 127.0.0.0/8 ip daddr 127.0.0.0/8 counter accept
+{%     if rule is vyos_defined %}
+{%         for rule_id, rule_conf in rule.items() %}
+{%             if rule_conf.exclude is vyos_defined  %}
+        {{ rule_conf | wlb_nft_rule(rule_id, local=True, exclude=True, action='accept') }}
+{%             else %}
+{%                 set limit = rule_conf.limit is vyos_defined %}
+        {{ rule_conf | wlb_nft_rule(rule_id, local=True, limit=limit, weight=True, health_state=health_state) }}
+        {{ rule_conf | wlb_nft_rule(rule_id, local=True, restore_mark=True) }}
+{%             endif %}
+{%         endfor %}
+{%     endif %}
+{% endif %}
+    }
+
+{% for ifname, health_conf in interface_health.items() %}
+{%     set state = health_state[ifname] %}
+    chain wlb_mangle_isp_{{ ifname }} {
+        meta mark set {{ state.mark }} ct mark set {{ state.mark }} counter accept
+    }
+{% endfor %}
+}

debian/control

@@ -205,9 +205,6 @@ Depends:
 # For "load-balancing haproxy"
   haproxy,
 # End "load-balancing haproxy"
-# For "load-balancing wan"
-  vyatta-wanloadbalance,
-# End "load-balancing wan"
 # For "service dhcp-relay"
   isc-dhcp-relay,
 # For "service dhcp-server"

op-mode-definitions/load-balancing_wan.xml.in

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interfaceDefinition>
+  <node name="restart">
+    <children>
+      <node name="wan-load-balance">
+        <properties>
+          <help>Restart Wide Area Network (WAN) load-balancing daemon</help>
+        </properties>
+        <command>sudo ${vyos_op_scripts_dir}/restart.py restart_service --name load-balancing_wan</command>
+      </node>
+    </children>
+  </node>
+  <node name="show">
+    <children>
+      <node name="wan-load-balance">
+        <properties>
+          <help>Show Wide Area Network (WAN) load-balancing information</help>
+        </properties>
+        <command>${vyos_op_scripts_dir}/load-balancing_wan.py show_summary</command>
+        <children>
+          <node name="connection">
+            <properties>
+              <help>Show Wide Area Network (WAN) load-balancing flow</help>
+            </properties>
+            <command>${vyos_op_scripts_dir}/load-balancing_wan.py show_connection</command>
+          </node>
+          <node name="status">
+            <properties>
+              <help>Show WAN load-balancing statistics</help>
+            </properties>
+            <command>${vyos_op_scripts_dir}/load-balancing_wan.py show_status</command>
+          </node>
+        </children>
+      </node>
+    </children>
+  </node>
+</interfaceDefinition>

python/vyos/defaults.py

@@ -36,7 +36,8 @@
   'isc_dhclient_dir' : '/run/dhclient',
   'dhcp6_client_dir' : '/run/dhcp6c',
   'vyos_configdir' : '/opt/vyatta/config',
-  'completion_dir' : f'{base_dir}/completion'
+  'completion_dir' : f'{base_dir}/completion',
+  'ppp_nexthop_dir' : '/run/ppp_nexthop'
 }
 
 config_status = '/tmp/vyos-config-status'

python/vyos/template.py

@@ -779,6 +779,11 @@ def conntrack_ct_policy(protocol_conf):
 
     return ", ".join(output)
 
+@register_filter('wlb_nft_rule')
+def wlb_nft_rule(rule_conf, rule_id, local=False, exclude=False, limit=False, weight=None, health_state=None, action=None, restore_mark=False):
+    from vyos.wanloadbalance import nft_rule as wlb_nft_rule
+    return wlb_nft_rule(rule_conf, rule_id, local, exclude, limit, weight, health_state, action, restore_mark)
+
 @register_filter('range_to_regex')
 def range_to_regex(num_range):
     """Convert range of numbers or list of ranges