From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <pve-devel-bounces@lists.proxmox.com> Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 767EB1FF16B for <inbox@lore.proxmox.com>; Thu, 6 Mar 2025 12:43:57 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 78191411A; Thu, 6 Mar 2025 12:43:44 +0100 (CET) To: pve-devel@lists.proxmox.com Date: Thu, 6 Mar 2025 12:08:29 +0100 In-Reply-To: <20250306110831.6426-1-lou.lecrivain@orange.fr> References: <20250306110831.6426-1-lou.lecrivain@orange.fr> X-Mailman-Approved-At: Thu, 06 Mar 2025 12:43:42 +0100 MIME-Version: 1.0 Message-ID: <mailman.833.1741261422.293.pve-devel@lists.proxmox.com> List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com> List-Post: <mailto:pve-devel@lists.proxmox.com> From: "lou.lecrivain--- via pve-devel" <pve-devel@lists.proxmox.com> Precedence: list Cc: lou.lecrivain@orange.fr, jonatan.crystall@gwdg.de X-Mailman-Version: 2.1.29 X-BeenThere: pve-devel@lists.proxmox.com List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=subscribe> List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe> List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/> Reply-To: Proxmox VE development discussion <pve-devel@lists.proxmox.com> List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help> Subject: [pve-devel] [PATCH pve-network v3 1/3] ipam: nautobot: base plugin Content-Type: multipart/mixed; boundary="===============7222298681966977506==" Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" <pve-devel-bounces@lists.proxmox.com> --===============7222298681966977506== Content-Type: message/rfc822 Content-Disposition: inline Return-Path: <lou.lecrivain@orange.fr> X-Original-To: pve-devel@lists.proxmox.com Delivered-To: pve-devel@lists.proxmox.com Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id BD06DD3F99 for <pve-devel@lists.proxmox.com>; Thu, 6 Mar 2025 12:09:08 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 9EF3F3555 for <pve-devel@lists.proxmox.com>; Thu, 6 Mar 2025 12:09:08 +0100 (CET) Received: from smtp.smtpout.orange.fr (smtp-80.smtpout.orange.fr [80.12.242.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for <pve-devel@lists.proxmox.com>; Thu, 6 Mar 2025 12:09:07 +0100 (CET) Received: from localhost ([176.139.8.107]) by smtp.orange.fr with ESMTPA id q961tnBYNrpMNq964tufml; Thu, 06 Mar 2025 12:09:01 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.fr; s=t20230301; t=1741259341; bh=OO9mC07UvuPJTrMk+s1FC1/3L3k2x2KlLrEe3+lW2XA=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=sGX6AWNFV7eoHBVYZAkP4yVWSkmwfxD5YqdHj8LbFoXFIHPG1H2Ty07t+kNjADO0e 3BrHEzFvchFACH39wNln/bRagrQvzWTXWDs70V1M+BU8XT07hK52tCMnvX2mYfzRRP /cGFm9alUiJ1vwwKU5N+wRV7adoXaHitRjAdopgXd1agbuw21b9g0viuVNqN0GeVF+ N8D09hlYNmA8asa9WbUOIFz0hWjW2KHqm1M5ABVWSzunI8VulibzDwC4MkFSDjernO FQOi0O/L1Kg3FVQb5Bwvptbak8WZ78uYDBOJce6q2PcCNL8bjY6AVc2QfRvfQ0GBDh etKqQtTCQsK2A== X-ME-Helo: localhost X-ME-Auth: bG91LmxlY3JpdmFpbkBvcmFuZ2UuZnI= X-ME-Date: Thu, 06 Mar 2025 12:09:01 +0100 X-ME-IP: 176.139.8.107 From: lou.lecrivain@orange.fr To: pve-devel@lists.proxmox.com Cc: h.duerr@proxmox.com, jonatan.crystall@gwdg.de, Lou Lecrivain <lou.lecrivain@wdz.de> Subject: [PATCH pve-network v3 1/3] ipam: nautobot: base plugin Date: Thu, 6 Mar 2025 12:08:29 +0100 Message-Id: <20250306110831.6426-2-lou.lecrivain@orange.fr> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250306110831.6426-1-lou.lecrivain@orange.fr> References: <20250306110831.6426-1-lou.lecrivain@orange.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -1.000 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider KAM_MAILER 2 Automated Mailer Tag Left in Email RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust RCVD_IN_MSPIKE_H3 0.001 Good reputation (+3) RCVD_IN_MSPIKE_WL 0.001 Mailspike good senders SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record X-Mailman-Approved-At: Thu, 06 Mar 2025 12:43:42 +0100 From: Lou Lecrivain <lou.lecrivain@wdz.de> This is the initial Nautobot plugin, based on the Netbox plugin implementation. Signed-off-by: lou lecrivain <lou.lecrivain@wdz.de> --- src/PVE/API2/Network/SDN/Ipams.pm | 1 + src/PVE/Network/SDN/Ipams.pm | 3 + src/PVE/Network/SDN/Ipams/Makefile | 2 +- src/PVE/Network/SDN/Ipams/NautobotPlugin.pm | 413 ++++++++++++++++++++ 4 files changed, 418 insertions(+), 1 deletion(-) create mode 100644 src/PVE/Network/SDN/Ipams/NautobotPlugin.pm diff --git a/src/PVE/API2/Network/SDN/Ipams.pm b/src/PVE/API2/Network/SDN/Ipams.pm index 27ead02..8074512 100644 --- a/src/PVE/API2/Network/SDN/Ipams.pm +++ b/src/PVE/API2/Network/SDN/Ipams.pm @@ -12,6 +12,7 @@ use PVE::Network::SDN::Ipams::Plugin; use PVE::Network::SDN::Ipams::PVEPlugin; use PVE::Network::SDN::Ipams::PhpIpamPlugin; use PVE::Network::SDN::Ipams::NetboxPlugin; +use PVE::Network::SDN::Ipams::NautobotPlugin; use PVE::Network::SDN::Dhcp; use PVE::Network::SDN::Vnets; use PVE::Network::SDN::Zones; diff --git a/src/PVE/Network/SDN/Ipams.pm b/src/PVE/Network/SDN/Ipams.pm index c689b8f..2ecb75e 100644 --- a/src/PVE/Network/SDN/Ipams.pm +++ b/src/PVE/Network/SDN/Ipams.pm @@ -12,11 +12,14 @@ use PVE::Network; use PVE::Network::SDN::Ipams::PVEPlugin; use PVE::Network::SDN::Ipams::NetboxPlugin; +use PVE::Network::SDN::Ipams::NautobotPlugin; use PVE::Network::SDN::Ipams::PhpIpamPlugin; use PVE::Network::SDN::Ipams::Plugin; + PVE::Network::SDN::Ipams::PVEPlugin->register(); PVE::Network::SDN::Ipams::NetboxPlugin->register(); +PVE::Network::SDN::Ipams::NautobotPlugin->register(); PVE::Network::SDN::Ipams::PhpIpamPlugin->register(); PVE::Network::SDN::Ipams::Plugin->init(); diff --git a/src/PVE/Network/SDN/Ipams/Makefile b/src/PVE/Network/SDN/Ipams/Makefile index 4e7d65f..75e5b9a 100644 --- a/src/PVE/Network/SDN/Ipams/Makefile +++ b/src/PVE/Network/SDN/Ipams/Makefile @@ -1,4 +1,4 @@ -SOURCES=Plugin.pm PhpIpamPlugin.pm NetboxPlugin.pm PVEPlugin.pm +SOURCES=Plugin.pm PhpIpamPlugin.pm NetboxPlugin.pm PVEPlugin.pm NautobotPlugin.pm PERL5DIR=${DESTDIR}/usr/share/perl5 diff --git a/src/PVE/Network/SDN/Ipams/NautobotPlugin.pm b/src/PVE/Network/SDN/Ipams/NautobotPlugin.pm new file mode 100644 index 0000000..58f7c68 --- /dev/null +++ b/src/PVE/Network/SDN/Ipams/NautobotPlugin.pm @@ -0,0 +1,413 @@ +package PVE::Network::SDN::Ipams::NautobotPlugin; + +use strict; +use warnings; +use PVE::INotify; +use PVE::Cluster; +use PVE::Tools; +use NetAddr::IP; + +use base('PVE::Network::SDN::Ipams::Plugin'); + +sub type { + return 'nautobot'; +} + +sub properties { + return { + namespace => { + type => 'string', + }, + }; +} + +sub options { + return { + url => { optional => 0 }, + token => { optional => 0 }, + namespace => { optional => 0 }, + }; +} + +sub default_ip_status { + return 'Active'; +} + +sub default_headers { + my ($plugin_config) = @_; + my $token = $plugin_config->{token}; + + return [ + 'Content-Type' => "application/json", 'Authorization' => "token $token", + 'Accept' => "application/json" + ]; +} + +# implem + +sub add_subnet { + my ($class, $plugin_config, undef, $subnet, $noerr) = @_; + + my $cidr = $subnet->{cidr}; + my $gateway = $subnet->{gateway}; + my $url = $plugin_config->{url}; + my $namespace = $plugin_config->{namespace}; + my $headers = default_headers($plugin_config); + + my $internalid = get_prefix_id($url, $cidr, $headers, $noerr); + + #create subnet + if (!$internalid) { + my $params = { + prefix => $cidr, namespace => $namespace, + status => default_ip_status() + }; + + eval { + my $result = PVE::Network::SDN::api_request( + "POST", "$url/ipam/prefixes/", $headers, $params); + }; + if ($@) { + die "error adding subnet to ipam: $@" if !$noerr; + } + } +} + +sub del_subnet { + my ($class, $plugin_config, $subnetid, $subnet, $noerr) = @_; + + my $cidr = $subnet->{cidr}; + my $url = $plugin_config->{url}; + my $headers = default_headers($plugin_config); + + my $internalid = get_prefix_id($url, $cidr, $headers, $noerr); + return if !$internalid; + + # TODO check that prefix is empty before deletion + return; + + eval { + PVE::Network::SDN::api_request( + "DELETE", "$url/ipam/prefixes/$internalid/", $headers); + }; + if ($@) { + die "error deleting subnet in Nautobot: $@" if !$noerr; + } +} + +sub add_ip { + my ($class, $plugin_config, undef, $subnet, $ip, $hostname, $mac, undef, + $is_gateway, $noerr) = @_; + + my $mask = $subnet->{mask}; + my $url = $plugin_config->{url}; + my $namespace = $plugin_config->{namespace}; + my $headers = default_headers($plugin_config); + + my $description = undef; + if ($is_gateway) { + $description = 'gateway' + } elsif ($mac) { + $description = "mac:$mac"; + } + + my $params = { + address => "$ip/$mask", type => "dhcp", dns_name => $hostname, + description => $description, namespace => $namespace, + status => default_ip_status()}; + + eval { + PVE::Network::SDN::api_request( + "POST", "$url/ipam/ip-addresses/", $headers, $params); + }; + + if ($@) { + if($is_gateway) { + die "error adding subnet ip to ipam: ip $ip already exists: $@" + if !$noerr && !is_ip_gateway($url, $ip, $headers, $noerr); + } else { + die "error adding subnet ip to ipam: ip $ip already exists: $@" + if !$noerr; + } + } +} + +sub add_next_freeip { + my ($class, $plugin_config, undef, $subnet, $hostname, $mac, undef, + $noerr) = @_; + + my $cidr = $subnet->{cidr}; + + my $url = $plugin_config->{url}; + my $namespace = $plugin_config->{namespace}; + my $headers = default_headers($plugin_config); + + my $internalid = get_prefix_id($url, $cidr, $headers, $noerr); + die "cannot find prefix $cidr in Nautobot" if !$internalid; + + my $description = undef; + $description = "mac:$mac" if $mac; + + my $params = { + type => "dhcp", dns_name => $hostname, description => $description, + namespace => $namespace, status => default_ip_status() + }; + + my $ip = eval { + my $result = PVE::Network::SDN::api_request( + "POST", + "$url/ipam/prefixes/$internalid/available-ips/", + $headers, + $params); + my ($host_ip, undef) = split(/\//, $result->{address}); + return $host_ip; + }; + + if ($@) { + die "can't find free ip in subnet $cidr: $@" if !$noerr; + } + return $ip; +} + +sub add_range_next_freeip { + my ($class, $plugin_config, $subnet, $range, $data, $noerr) = @_; + + my $url = $plugin_config->{url}; + my $namespace = $plugin_config->{namespace}; + my $headers = default_headers($plugin_config); + my $cidr = $subnet->{cidr}; + + # ranges are not supported natively in nautobot, hence why we have + # to get a little hacky. + my $minimal_size = NetAddr::IP->new($range->{'start-address'}) + - NetAddr::IP->new($cidr); + my $internalid = get_prefix_id($url, $cidr, $headers, $noerr); + + my $ip = eval { + my $result = PVE::Network::SDN::api_request( + "GET", + "$url/ipam/prefixes/$internalid/available-ips/?limit=$minimal_size", + $headers); + # v important for NetAddr::IP comparison! + my @ips = map((split(/\//,$_->{address}))[0], @{$result}); + # get 1st result + my $found_ip = (get_ips_within_range( + $range->{'start-address'}, + $range->{'end-address'}, + @ips))[0]; + + die "prefix out of space in range" if !$noerr && !$found_ip; + + $class->add_ip( + $plugin_config, undef, $subnet, $found_ip, $data->{hostname}, + $data->{mac}, undef, 0, 0); + return $found_ip; + }; + + if ($@) { + die "can't find free ip in range" + ." $range->{'start-address'}-$range->{'end-address'}: $@" + if !$noerr; + } + return $ip; +} + + +sub update_ip { + my ($class, $plugin_config, $subnetid, $subnet, $ip, $hostname, $mac, + undef, $is_gateway, $noerr) = @_; + + my $mask = $subnet->{mask}; + my $url = $plugin_config->{url}; + my $namespace = $plugin_config->{namespace}; + my $headers = default_headers($plugin_config); + + my $description = undef; + if ($is_gateway) { + $description = 'gateway' + } elsif ($mac) { + $description = "mac:$mac"; + } + + my $params = { + address => "$ip/$mask", type => "dhcp", dns_name => $hostname, + description => $description, namespace => $namespace, + status => default_ip_status() + }; + + my $ip_id = get_ip_id($url, $ip, $headers, $noerr); + die "can't find ip $ip in ipam" if !$noerr && !$ip_id; + + eval { + PVE::Network::SDN::api_request( + "PATCH", "$url/ipam/ip-addresses/$ip_id/", $headers, $params); + }; + if ($@) { + die "error updating ip $ip: $@" if !$noerr; + } +} + + +sub del_ip { + my ($class, $plugin_config, undef, undef, $ip, $noerr) = @_; + + return if !$ip; + + my $url = $plugin_config->{url}; + my $headers = default_headers($plugin_config); + + my $ip_id = get_ip_id($url, $ip, $headers, $noerr); + die "can't find ip $ip in ipam" if !$ip_id && !$noerr; + + eval { + PVE::Network::SDN::api_request( + "DELETE", "$url/ipam/ip-addresses/$ip_id/", $headers); + }; + if ($@) { + die "error deleting ip $ip : $@" if !$noerr; + } +} + + +sub verify_api { + my ($class, $plugin_config) = @_; + + my $url = $plugin_config->{url}; + my $namespace = $plugin_config->{namespace}; + my $headers = default_headers($plugin_config); + + # check that the namespace exists AND that default IP active status + # exists AND that we have indeed API access + eval { + get_namespace_id($url, $namespace, $headers, 0) + // die "namespace $namespace does not exist"; + get_status_id($url, default_ip_status(), $headers, 0) + // die "default IP status ". default_ip_status() . " not found"; + }; + if ($@) { + die "Can't use nautobot api: $@"; + } +} + +sub get_ips_from_mac { + my ($class, $plugin_config, $mac) = @_; + + my $url = $plugin_config->{url}; + my $namespace = $plugin_config->{namespace}; + my $headers = default_headers($plugin_config); + + my $ip4 = undef; + my $ip6 = undef; + + my $data = PVE::Network::SDN::api_request( + "GET", "$url/ipam/ip-addresses/?q=$mac", $headers); + for my $ip (@{$data->{results}}) { + if ($ip->{ip_version} == 4 && !$ip4) { + ($ip4, undef) = split(/\//, $ip->{address}); + } + + if ($ip->{ip_version} == 6 && !$ip6) { + ($ip6, undef) = split(/\//, $ip->{address}); + } + } + + return ($ip4, $ip6); +} + +sub on_update_hook { + my ($class, $plugin_config) = @_; + + PVE::Network::SDN::Ipams::NautobotPlugin::verify_api( + $class, $plugin_config); +} + +# helpers +sub get_ips_within_range { + my ($start_address, $end_address, @list) = @_; + $start_address = NetAddr::IP->new($start_address); + $end_address = NetAddr::IP->new($end_address); + return grep($start_address <= NetAddr::IP->new($_) <= $end_address, @list); +} + +sub get_ip_id { + my ($url, $ip, $headers, $noerr) = @_; + + my $result = eval { + return PVE::Network::SDN::api_request( + "GET", "$url/ipam/ip-addresses/?q=$ip", $headers); + }; + if ($@) { + die "error while querying for ip $ip id: $@" if !$noerr; + } + + my $data = @{$result->{results}}[0]; + my $ip_id = $data->{id}; + return $ip_id; +} + +sub get_prefix_id { + my ($url, $cidr, $headers, $noerr) = @_; + + my $result = eval { + return PVE::Network::SDN::api_request( + "GET", "$url/ipam/prefixes/?q=$cidr", $headers); + }; + if ($@) { + die "error while querying for cidr $cidr prefix id: $@" if !$noerr; + } + + my $data = @{$result->{results}}[0]; + my $internalid = $data->{id}; + return $internalid; +} + +sub get_namespace_id { + my ($url, $namespace, $headers, $noerr) = @_; + + my $result = eval { + return PVE::Network::SDN::api_request( + "GET", "$url/ipam/namespaces/?q=$namespace", $headers); + }; + if ($@) { + die "error while querying for namespace $namespace id: $@" if !$noerr; + } + + my $data = @{$result->{results}}[0]; + my $internalid = $data->{id}; + return $internalid; +} + +sub get_status_id { + my ($url, $status, $headers, $noerr) = @_; + + my $result = eval { + return PVE::Network::SDN::api_request( + "GET", "$url/extras/statuses/?q=$status", $headers); + }; + if ($@) { + die "error while querying for status $status id: $@" if !$noerr; + } + + my $data = @{$result->{results}}[0]; + my $internalid = $data->{id}; + return $internalid; +} + +sub is_ip_gateway { + my ($url, $ip, $headers, $noerr) = @_; + + my $result = eval { + return PVE::Network::SDN::api_request( + "GET", "$url/ipam/ip-addresses/?q=$ip", $headers); + }; + if ($@) { + die "error while checking if $ip is a gateway" if !$noerr; + } + + my $data = @{$result->{results}}[0]; + my $description = $data->{description}; + my $is_gateway = 0; $is_gateway = 1 if $description eq 'gateway'; + return $is_gateway; +} + +1; -- 2.39.5 --===============7222298681966977506== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel --===============7222298681966977506==--