summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorMohsin Kazmi <sykazmi@cisco.com>2018-04-17 19:35:42 +0200
committerNeale Ranns <nranns@cisco.com>2018-07-19 07:51:39 +0000
commitd61105656b61012c39e7b9f96c12b65ef5ad3b05 (patch)
tree4087f0357b0e96fba924c88c860260ad8125e4cf /src
parent692250bedfc047ec9f88e7308daf456ed5f4a2a7 (diff)
gbp: Add support for ACL
Change-Id: I7513c41307e62068ab5d9739cac393675c6066f8 Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com> (cherry picked from commit 22b3b846822df2701bb6cb508fa4e023526e5717)
Diffstat (limited to 'src')
-rw-r--r--src/plugins/gbp/gbp.h10
-rw-r--r--src/plugins/gbp/gbp_api.c23
-rw-r--r--src/plugins/gbp/gbp_contract.c65
-rw-r--r--src/plugins/gbp/gbp_contract.h23
-rw-r--r--src/plugins/gbp/gbp_policy.c59
-rw-r--r--src/plugins/gbp/gbp_policy_dpo.c56
6 files changed, 178 insertions, 58 deletions
diff --git a/src/plugins/gbp/gbp.h b/src/plugins/gbp/gbp.h
index 8672fd3b092..06612cd948f 100644
--- a/src/plugins/gbp/gbp.h
+++ b/src/plugins/gbp/gbp.h
@@ -31,6 +31,8 @@
#ifndef __GBP_H__
#define __GBP_H__
+#include <plugins/acl/exports.h>
+
#include <plugins/gbp/gbp_types.h>
#include <plugins/gbp/gbp_endpoint.h>
#include <plugins/gbp/gbp_endpoint_group.h>
@@ -38,6 +40,14 @@
#include <plugins/gbp/gbp_subnet.h>
#include <plugins/gbp/gbp_recirc.h>
+typedef struct
+{
+ u32 gbp_acl_user_id;
+ acl_plugin_methods_t acl_plugin;
+} gbp_main_t;
+
+extern gbp_main_t gbp_main;
+
#endif
/*
diff --git a/src/plugins/gbp/gbp_api.c b/src/plugins/gbp/gbp_api.c
index 88b2cd1cea9..1f24eedc3d0 100644
--- a/src/plugins/gbp/gbp_api.c
+++ b/src/plugins/gbp/gbp_api.c
@@ -46,7 +46,7 @@
/* Get the API version number */
#define vl_api_version(n,v) static u32 api_version=(v);
-#include <acl/acl_all_api_h.h>
+#include <gbp/gbp_all_api_h.h>
#undef vl_api_version
#include <vlibapi/api_helper_macros.h>
@@ -63,17 +63,11 @@
_(GBP_CONTRACT_ADD_DEL, gbp_contract_add_del) \
_(GBP_CONTRACT_DUMP, gbp_contract_dump)
-/**
- * L2 Emulation Main
- */
-typedef struct gbp_main_t_
-{
- u16 msg_id_base;
-} gbp_main_t;
+gbp_main_t gbp_main;
-static gbp_main_t gbp_main;
+static u16 msg_id_base;
-#define GBP_MSG_BASE gbp_main.msg_id_base
+#define GBP_MSG_BASE msg_id_base
static void
vl_api_gbp_endpoint_add_del_t_handler (vl_api_gbp_endpoint_add_del_t * mp)
@@ -418,7 +412,7 @@ gbp_contract_send_details (gbp_contract_t * gbpc, void *args)
mp->contract.src_epg = ntohl (gbpc->gc_key.gck_src);
mp->contract.dst_epg = ntohl (gbpc->gc_key.gck_dst);
- mp->contract.acl_index = ntohl (gbpc->gc_acl_index);
+ mp->contract.acl_index = ntohl (gbpc->gc_value.gc_acl_index);
vl_api_send_msg (ctx->reg, (u8 *) mp);
@@ -484,10 +478,11 @@ gbp_init (vlib_main_t * vm)
gbp_main_t *gbpm = &gbp_main;
u8 *name = format (0, "gbp_%08x%c", api_version, 0);
- /* Ask for a correctly-sized block of API message decode slots */
- gbpm->msg_id_base = vl_msg_api_get_msg_ids ((char *) name,
- VL_MSG_FIRST_AVAILABLE);
+ gbpm->gbp_acl_user_id = ~0;
+ /* Ask for a correctly-sized block of API message decode slots */
+ msg_id_base = vl_msg_api_get_msg_ids ((char *) name,
+ VL_MSG_FIRST_AVAILABLE);
gbp_api_hookup (vm);
/* Add our API messages to the global name_crc hash table */
diff --git a/src/plugins/gbp/gbp_contract.c b/src/plugins/gbp/gbp_contract.c
index 71d8bcf4671..a536f89e5fe 100644
--- a/src/plugins/gbp/gbp_contract.c
+++ b/src/plugins/gbp/gbp_contract.c
@@ -25,22 +25,64 @@ gbp_contract_db_t gbp_contract_db;
void
gbp_contract_update (epg_id_t src_epg, epg_id_t dst_epg, u32 acl_index)
{
+ gbp_main_t *gm = &gbp_main;
+ u32 *acl_vec = 0;
+ gbp_contract_value_t value = {
+ .gc_lc_index = ~0,
+ .gc_acl_index = ~0,
+ };
+ uword *p;
+
gbp_contract_key_t key = {
.gck_src = src_epg,
.gck_dst = dst_epg,
};
- hash_set (gbp_contract_db.gc_hash, key.as_u64, acl_index);
+ if (~0 == gm->gbp_acl_user_id)
+ {
+ acl_plugin_exports_init (&gm->acl_plugin);
+ gm->gbp_acl_user_id =
+ gm->acl_plugin.register_user_module ("GBP ACL", "src-epg", "dst-epg");
+ }
+
+ p = hash_get (gbp_contract_db.gc_hash, key.as_u64);
+ if (p != NULL)
+ {
+ value.as_u64 = p[0];
+ }
+ else
+ {
+ value.gc_lc_index =
+ gm->acl_plugin.get_lookup_context_index (gm->gbp_acl_user_id, src_epg,
+ dst_epg);
+ value.gc_acl_index = acl_index;
+ hash_set (gbp_contract_db.gc_hash, key.as_u64, value.as_u64);
+ }
+
+ if (value.gc_lc_index == ~0)
+ return;
+ vec_add1 (acl_vec, acl_index);
+ gm->acl_plugin.set_acl_vec_for_context (value.gc_lc_index, acl_vec);
+ vec_free (acl_vec);
}
void
gbp_contract_delete (epg_id_t src_epg, epg_id_t dst_epg)
{
+ gbp_main_t *gm = &gbp_main;
+ uword *p;
+ gbp_contract_value_t value;
gbp_contract_key_t key = {
.gck_src = src_epg,
.gck_dst = dst_epg,
};
+ p = hash_get (gbp_contract_db.gc_hash, key.as_u64);
+ if (p != NULL)
+ {
+ value.as_u64 = p[0];
+ gm->acl_plugin.put_lookup_context_index (value.gc_lc_index);
+ }
hash_unset (gbp_contract_db.gc_hash, key.as_u64);
}
@@ -48,14 +90,14 @@ void
gbp_contract_walk (gbp_contract_cb_t cb, void *ctx)
{
gbp_contract_key_t key;
- u32 acl_index;
+ gbp_contract_value_t value;
/* *INDENT-OFF* */
- hash_foreach(key.as_u64, acl_index, gbp_contract_db.gc_hash,
+ hash_foreach(key.as_u64, value.as_u64, gbp_contract_db.gc_hash,
({
gbp_contract_t gbpc = {
.gc_key = key,
- .gc_acl_index = acl_index,
+ .gc_value = value,
};
if (!cb(&gbpc, ctx))
@@ -112,11 +154,14 @@ gbp_contract_cli (vlib_main_t * vm,
* @cliexstart{set gbp contract [del] src-epg <ID> dst-epg <ID> acl-index <ACL>}
* @cliexend
?*/
+/* *INDENT-OFF* */
VLIB_CLI_COMMAND (gbp_contract_cli_node, static) =
{
-.path = "gbp contract",.short_help =
- "gbp contract [del] src-epg <ID> dst-epg <ID> acl-index <ACL>",.function
- = gbp_contract_cli,};
+ .path = "gbp contract",
+ .short_help =
+ "gbp contract [del] src-epg <ID> dst-epg <ID> acl-index <ACL>",
+ .function = gbp_contract_cli,
+};
/* *INDENT-ON* */
static clib_error_t *
@@ -124,15 +169,15 @@ gbp_contract_show (vlib_main_t * vm,
unformat_input_t * input, vlib_cli_command_t * cmd)
{
gbp_contract_key_t key;
- epg_id_t epg_id;
+ gbp_contract_value_t value;
vlib_cli_output (vm, "Contracts:");
/* *INDENT-OFF* */
- hash_foreach (key.as_u64, epg_id, gbp_contract_db.gc_hash,
+ hash_foreach (key.as_u64, value.as_u64, gbp_contract_db.gc_hash,
{
vlib_cli_output (vm, " {%d,%d} -> %d", key.gck_src,
- key.gck_dst, epg_id);
+ key.gck_dst, value.gc_acl_index);
});
/* *INDENT-ON* */
diff --git a/src/plugins/gbp/gbp_contract.h b/src/plugins/gbp/gbp_contract.h
index 1964098adc3..75f2edca116 100644
--- a/src/plugins/gbp/gbp_contract.h
+++ b/src/plugins/gbp/gbp_contract.h
@@ -38,6 +38,25 @@ typedef struct gbp_contract_key_t_
} gbp_contract_key_t;
/**
+ * The value for an Contract
+ */
+typedef struct gbp_contract_value_t_
+{
+ union
+ {
+ struct
+ {
+ /**
+ * lookup context and acl index
+ */
+ u32 gc_lc_index;
+ u32 gc_acl_index;
+ };
+ u64 as_u64;
+ };
+} gbp_contract_value_t;
+
+/**
* A Group Based Policy Contract.
* Determines the ACL that applies to traffic pass between two endpoint groups
*/
@@ -51,7 +70,7 @@ typedef struct gbp_contract_t_
/**
* The ACL to apply for packets from the source to the destination EPG
*/
- u32 gc_acl_index;;
+ gbp_contract_value_t gc_value;
} gbp_contract_t;
/**
@@ -78,7 +97,7 @@ extern void gbp_contract_walk (gbp_contract_cb_t bgpe, void *ctx);
*/
extern gbp_contract_db_t gbp_contract_db;
-always_inline u32
+always_inline u64
gbp_acl_lookup (gbp_contract_key_t * key)
{
uword *p;
diff --git a/src/plugins/gbp/gbp_policy.c b/src/plugins/gbp/gbp_policy.c
index 8f3fc76a019..38254644631 100644
--- a/src/plugins/gbp/gbp_policy.c
+++ b/src/plugins/gbp/gbp_policy.c
@@ -68,6 +68,7 @@ static uword
gbp_policy (vlib_main_t * vm,
vlib_node_runtime_t * node, vlib_frame_t * frame)
{
+ gbp_main_t *gm = &gbp_main;
gbp_policy_main_t *gpm = &gbp_policy_main;
u32 n_left_from, *from, *to_next;
u32 next_index;
@@ -86,9 +87,11 @@ gbp_policy (vlib_main_t * vm,
{
gbp_policy_next_t next0;
gbp_contract_key_t key0;
+ gbp_contract_value_t value0 = {
+ .as_u64 = ~0,
+ };
u32 bi0, sw_if_index0;
vlib_buffer_t *b0;
- u32 acl_index0;
next0 = GBP_POLICY_NEXT_DENY;
bi0 = from[0];
@@ -106,7 +109,6 @@ gbp_policy (vlib_main_t * vm,
sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_TX];
key0.gck_dst = gbp_port_to_epg (sw_if_index0);
key0.gck_src = vnet_buffer2 (b0)->gbp.src_epg;
- acl_index0 = ~0;
if (~0 != key0.gck_src)
{
@@ -120,20 +122,48 @@ gbp_policy (vlib_main_t * vm,
}
else
{
- acl_index0 = gbp_acl_lookup (&key0);
+ value0.as_u64 = gbp_acl_lookup (&key0);
- if (~0 != acl_index0)
+ if (~0 != value0.gc_lc_index)
{
+ fa_5tuple_opaque_t pkt_5tuple0;
+ u8 action0 = 0;
+ u32 acl_pos_p0, acl_match_p0;
+ u32 rule_match_p0, trace_bitmap0;
+ u8 *h0, l2_len0;
+ u16 ether_type0;
+ u8 is_ip60 = 0;
+
+ l2_len0 = vnet_buffer (b0)->l2.l2_len;
+ h0 = vlib_buffer_get_current (b0);
+
+ ether_type0 =
+ clib_net_to_host_u16 (*(u16 *) (h0 + l2_len0 - 2));
+
+ is_ip60 = (ether_type0 == ETHERNET_TYPE_IP6) ? 1 : 0;
/*
- * TODO tests against the ACL
- */
- /*
- * ACL tables are not available outside of ACL plugin
- * until then bypass the ACL to next node
+ * tests against the ACL
*/
- next0 =
- vnet_l2_feature_next (b0, gpm->l2_output_feat_next,
- L2OUTPUT_FEAT_GBP_POLICY);
+ acl_plugin_fill_5tuple_inline (gm->
+ acl_plugin.p_acl_main,
+ value0.gc_lc_index, b0,
+ is_ip60,
+ /* is_input */ 0,
+ /* is_l2_path */ 1,
+ &pkt_5tuple0);
+ acl_plugin_match_5tuple_inline (gm->
+ acl_plugin.p_acl_main,
+ value0.gc_lc_index,
+ &pkt_5tuple0, is_ip60,
+ &action0, &acl_pos_p0,
+ &acl_match_p0,
+ &rule_match_p0,
+ &trace_bitmap0);
+
+ if (action0 > 0)
+ next0 =
+ vnet_l2_feature_next (b0, gpm->l2_output_feat_next,
+ L2OUTPUT_FEAT_GBP_POLICY);
}
}
}
@@ -153,7 +183,7 @@ gbp_policy (vlib_main_t * vm,
vlib_add_trace (vm, node, b0, sizeof (*t));
t->src_epg = key0.gck_src;
t->dst_epg = key0.gck_dst;
- t->acl_index = acl_index0;
+ t->acl_index = value0.gc_acl_index;
}
/* verify speculative enqueue, maybe switch current next frame */
@@ -209,6 +239,7 @@ static clib_error_t *
gbp_policy_init (vlib_main_t * vm)
{
gbp_policy_main_t *gpm = &gbp_policy_main;
+ clib_error_t *error = 0;
/* Initialize the feature next-node indexes */
feat_bitmap_init_next_nodes (vm,
@@ -217,7 +248,7 @@ gbp_policy_init (vlib_main_t * vm)
l2output_get_feat_names (),
gpm->l2_output_feat_next);
- return 0;
+ return error;
}
VLIB_INIT_FUNCTION (gbp_policy_init);
diff --git a/src/plugins/gbp/gbp_policy_dpo.c b/src/plugins/gbp/gbp_policy_dpo.c
index 0f62fb3445d..e2af1e6daab 100644
--- a/src/plugins/gbp/gbp_policy_dpo.c
+++ b/src/plugins/gbp/gbp_policy_dpo.c
@@ -13,15 +13,15 @@
* limitations under the License.
*/
-#include <plugins/gbp/gbp.h>
-#include <plugins/gbp/gbp_policy_dpo.h>
-#include <plugins/gbp/gbp_recirc.h>
-
#include <vnet/dpo/dvr_dpo.h>
#include <vnet/fib/ip4_fib.h>
#include <vnet/fib/ip6_fib.h>
#include <vnet/dpo/load_balance.h>
+#include <plugins/gbp/gbp.h>
+#include <plugins/gbp/gbp_policy_dpo.h>
+#include <plugins/gbp/gbp_recirc.h>
+
/**
* DPO pool
*/
@@ -206,8 +206,9 @@ typedef enum
always_inline uword
gbp_policy_dpo_inline (vlib_main_t * vm,
vlib_node_runtime_t * node,
- vlib_frame_t * from_frame, fib_protocol_t fproto)
+ vlib_frame_t * from_frame, u8 is_ip6)
{
+ gbp_main_t *gm = &gbp_main;
u32 n_left_from, next_index, *from, *to_next;
from = vlib_frame_vector_args (from_frame);
@@ -224,8 +225,11 @@ gbp_policy_dpo_inline (vlib_main_t * vm,
while (n_left_from > 0 && n_left_to_next > 0)
{
const gbp_policy_dpo_t *gpd0;
- u32 bi0, next0, acl_index0;
+ u32 bi0, next0;
gbp_contract_key_t key0;
+ gbp_contract_value_t value0 = {
+ .as_u64 = ~0,
+ };
vlib_buffer_t *b0;
bi0 = from[0];
@@ -235,7 +239,6 @@ gbp_policy_dpo_inline (vlib_main_t * vm,
n_left_from -= 1;
n_left_to_next -= 1;
next0 = GBP_POLICY_DROP;
- acl_index0 = ~0;
b0 = vlib_get_buffer (vm, bi0);
gpd0 =
@@ -256,18 +259,35 @@ gbp_policy_dpo_inline (vlib_main_t * vm,
}
else
{
- acl_index0 = gbp_acl_lookup (&key0);
+ value0.as_u64 = gbp_acl_lookup (&key0);
- if (~0 != acl_index0)
+ if (~0 != value0.gc_lc_index)
{
+ fa_5tuple_opaque_t pkt_5tuple0;
+ u8 action0 = 0;
+ u32 acl_pos_p0, acl_match_p0;
+ u32 rule_match_p0, trace_bitmap0;
/*
- * TODO tests against the ACL
- */
- /*
- * ACL tables are not available outside of ACL plugin
- * until then bypass the ACL to next node
+ * tests against the ACL
*/
- next0 = gpd0->gpd_dpo.dpoi_next_node;
+ acl_plugin_fill_5tuple_inline (gm->
+ acl_plugin.p_acl_main,
+ value0.gc_lc_index, b0,
+ is_ip6,
+ /* is_input */ 1,
+ /* is_l2_path */ 0,
+ &pkt_5tuple0);
+ acl_plugin_match_5tuple_inline (gm->
+ acl_plugin.p_acl_main,
+ value0.gc_lc_index,
+ &pkt_5tuple0, is_ip6,
+ &action0, &acl_pos_p0,
+ &acl_match_p0,
+ &rule_match_p0,
+ &trace_bitmap0);
+
+ if (action0 > 0)
+ next0 = gpd0->gpd_dpo.dpoi_next_node;
}
}
}
@@ -287,7 +307,7 @@ gbp_policy_dpo_inline (vlib_main_t * vm,
tr = vlib_add_trace (vm, node, b0, sizeof (*tr));
tr->src_epg = key0.gck_src;
tr->dst_epg = key0.gck_dst;
- tr->acl_index = acl_index0;
+ tr->acl_index = value0.gc_acl_index;
}
vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
@@ -315,14 +335,14 @@ static uword
ip4_gbp_policy_dpo (vlib_main_t * vm,
vlib_node_runtime_t * node, vlib_frame_t * from_frame)
{
- return (gbp_policy_dpo_inline (vm, node, from_frame, FIB_PROTOCOL_IP4));
+ return (gbp_policy_dpo_inline (vm, node, from_frame, 0));
}
static uword
ip6_gbp_policy_dpo (vlib_main_t * vm,
vlib_node_runtime_t * node, vlib_frame_t * from_frame)
{
- return (gbp_policy_dpo_inline (vm, node, from_frame, FIB_PROTOCOL_IP6));
+ return (gbp_policy_dpo_inline (vm, node, from_frame, 1));
}
/* *INDENT-OFF* */
lor: #fff0f0 } /* Literal.String.Escape */ .highlight .sh { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Heredoc */ .highlight .si { color: #3333bb; background-color: #fff0f0 } /* Literal.String.Interpol */ .highlight .sx { color: #22bb22; background-color: #f0fff0 } /* Literal.String.Other */ .highlight .sr { color: #008800; background-color: #fff0ff } /* Literal.String.Regex */ .highlight .s1 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Single */ .highlight .ss { color: #aa6600; background-color: #fff0f0 } /* Literal.String.Symbol */ .highlight .bp { color: #003388 } /* Name.Builtin.Pseudo */ .highlight .fm { color: #0066bb; font-weight: bold } /* Name.Function.Magic */ .highlight .vc { color: #336699 } /* Name.Variable.Class */ .highlight .vg { color: #dd7700 } /* Name.Variable.Global */ .highlight .vi { color: #3333bb } /* Name.Variable.Instance */ .highlight .vm { color: #336699 } /* Name.Variable.Magic */ .highlight .il { color: #0000DD; font-weight: bold } /* Literal.Number.Integer.Long */ } 
# Copyright (c) 2022 Cisco and/or its affiliates.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at:
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

"""Library for SSH connection management."""


import socket

from io import StringIO
from time import monotonic, sleep

from paramiko import RSAKey, SSHClient, AutoAddPolicy
from paramiko.ssh_exception import SSHException, NoValidConnectionsError
from robot.api import logger
from scp import SCPClient, SCPException

from resources.libraries.python.OptionString import OptionString

__all__ = [
    u"exec_cmd", u"exec_cmd_no_error", u"SSH", u"SSHTimeout", u"scp_node"
]

# TODO: load priv key


class SSHTimeout(Exception):
    """This exception is raised when a timeout occurs."""


class SSH:
    """Contains methods for managing and using SSH connections."""

    __MAX_RECV_BUF = 10 * 1024 * 1024
    __existing_connections = dict()

    def __init__(self):
        self._ssh = None
        self._node = None

    @staticmethod
    def _node_hash(node):
        """Get IP address and port hash from node dictionary.

        :param node: Node in topology.
        :type node: dict
        :returns: IP address and port for the specified node.
        :rtype: int
        """
        return hash(frozenset([node[u"host"], node[u"port"]]))

    def connect(self, node, attempts=5):
        """Connect to node prior to running exec_command or scp.

        If there already is a connection to the node, this method reuses it.

        :param node: Node in topology.
        :param attempts: Number of reconnect attempts.
        :type node: dict
        :type attempts: int
        :raises IOError: If cannot connect to host.
        """
        self._node = node
        node_hash = self._node_hash(node)
        if node_hash in SSH.__existing_connections:
            self._ssh = SSH.__existing_connections[node_hash]
            if self._ssh.get_transport().is_active():
                logger.debug(f"Reusing SSH: {self._ssh}")
            else:
                if attempts > 0:
                    self._reconnect(attempts-1)
                else:
                    raise IOError(f"Cannot connect to {node['host']}")
        else:
            try:
                start = monotonic()
                pkey = None
                if u"priv_key" in node:
                    pkey = RSAKey.from_private_key(StringIO(node[u"priv_key"]))

                self._ssh = SSHClient()
                self._ssh.set_missing_host_key_policy(AutoAddPolicy())

                self._ssh.connect(
                    node[u"host"], username=node[u"username"],
                    password=node.get(u"password"), pkey=pkey,
                    port=node[u"port"]
                )

                self._ssh.get_transport().set_keepalive(10)

                SSH.__existing_connections[node_hash] = self._ssh
                logger.debug(
                    f"New SSH to {self._ssh.get_transport().getpeername()} "
                    f"took {monotonic() - start} seconds: {self._ssh}"
                )
            except SSHException as exc:
                raise IOError(f"Cannot connect to {node[u'host']}") from exc
            except NoValidConnectionsError as err:
                raise IOError(
                    f"Unable to connect to port {node[u'port']} on "
                    f"{node[u'host']}"
                ) from err

    def disconnect(self, node=None):
        """Close SSH connection to the node.

        :param node: The node to disconnect from. None means last connected.
        :type node: dict or None
        """
        if node is None:
            node = self._node
        if node is None:
            return
        node_hash = self._node_hash(node)
        if node_hash in SSH.__existing_connections:
            logger.debug(
                f"Disconnecting peer: {node[u'host']}, {node[u'port']}"
            )
            ssh = SSH.__existing_connections.pop(node_hash)
            ssh.close()

    def _reconnect(self, attempts=0):
        """Close the SSH connection and open it again.

        :param attempts: Number of reconnect attempts.
        :type attempts: int
        """
        node = self._node
        self.disconnect(node)
        self.connect(node, attempts)
        logger.debug(
            f"Reconnecting peer done: {node[u'host']}, {node[u'port']}"
        )

    def exec_command(self, cmd, timeout=10, log_stdout_err=True):
        """Execute SSH command on a new channel on the connected Node.

        :param cmd: Command to run on the Node.
        :param timeout: Maximal time in seconds to wait until the command is
            done. If set to None then wait forever.
        :param log_stdout_err: If True, stdout and stderr are logged. stdout
            and stderr are logged also if the return code is not zero
            independently of the value of log_stdout_err.
            Needed for calls outside Robot (e.g. from reservation script).
        :type cmd: str or OptionString
        :type timeout: int
        :type log_stdout_err: bool
        :returns: return_code, stdout, stderr
        :rtype: tuple(int, str, str)
        :raises SSHTimeout: If command is not finished in timeout time.
        """
        if isinstance(cmd, (list, tuple)):
            cmd = OptionString(cmd)
        cmd = str(cmd)
        stdout = u""
        stderr = u""
        try:
            chan = self._ssh.get_transport().open_session(timeout=5)
            peer = self._ssh.get_transport().getpeername()
        except (AttributeError, SSHException):
            self._reconnect()
            chan = self._ssh.get_transport().open_session(timeout=5)
            peer = self._ssh.get_transport().getpeername()
        chan.settimeout(timeout)

        logger.trace(f"exec_command on {peer} with timeout {timeout}: {cmd}")

        start = monotonic()
        chan.exec_command(cmd)
        while not chan.exit_status_ready() and timeout is not None:
            if chan.recv_ready():
                s_out = chan.recv(self.__MAX_RECV_BUF)
                stdout += s_out.decode(encoding=u'utf-8', errors=u'ignore') \
                    if isinstance(s_out, bytes) else s_out

            if chan.recv_stderr_ready():
                s_err = chan.recv_stderr(self.__MAX_RECV_BUF)
                stderr += s_err.decode(encoding=u'utf-8', errors=u'ignore') \
                    if isinstance(s_err, bytes) else s_err

            duration = monotonic() - start
            if duration > timeout:
                raise SSHTimeout(
                    f"Timeout exception during execution of command: {cmd}\n"
                    f"Current contents of stdout buffer: "
                    f"{stdout}\n"
                    f"Current contents of stderr buffer: "
                    f"{stderr}\n"
                )

            sleep(0.1)
        return_code = chan.recv_exit_status()

        while chan.recv_ready():
            s_out = chan.recv(self.__MAX_RECV_BUF)
            stdout += s_out.decode(encoding=u'utf-8', errors=u'ignore') \
                if isinstance(s_out, bytes) else s_out

        while chan.recv_stderr_ready():
            s_err = chan.recv_stderr(self.__MAX_RECV_BUF)
            stderr += s_err.decode(encoding=u'utf-8', errors=u'ignore') \
                if isinstance(s_err, bytes) else s_err

        duration = monotonic() - start
        logger.trace(f"exec_command on {peer} took {duration} seconds")

        logger.trace(f"return RC {return_code}")
        if log_stdout_err or int(return_code):
            logger.trace(
                f"return STDOUT {stdout}"
            )
            logger.trace(
                f"return STDERR {stderr}"
            )
        return return_code, stdout, stderr

    def exec_command_sudo(
            self, cmd, cmd_input=None, timeout=30, log_stdout_err=True):
        """Execute SSH command with sudo on a new channel on the connected Node.

        :param cmd: Command to be executed.
        :param cmd_input: Input redirected to the command.
        :param timeout: Timeout.
        :param log_stdout_err: If True, stdout and stderr are logged.
            Needed for calls outside Robot (e.g. from reservation script).
        :type cmd: str
        :type cmd_input: str
        :type timeout: int
        :type log_stdout_err: bool
        :returns: return_code, stdout, stderr
        :rtype: tuple(int, str, str)

        :Example:

        >>> from ssh import SSH
        >>> ssh = SSH()
        >>> ssh.connect(node)
        >>> # Execute command without input (sudo -S cmd)
        >>> ssh.exec_command_sudo(u"ifconfig eth0 down")
        >>> # Execute command with input (sudo -S cmd <<< 'input')
        >>> ssh.exec_command_sudo(u"vpp_api_test", u"dump_interface_table")
        """
        if isinstance(cmd, (list, tuple)):
            cmd = OptionString(cmd)
        if cmd_input is None:
            command = f"sudo -E -S {cmd}"
        else:
            command = f"sudo -E -S {cmd} <<< \"{cmd_input}\""
        return self.exec_command(
            command, timeout, log_stdout_err=log_stdout_err
        )

    def exec_command_lxc(
            self, lxc_cmd, lxc_name, lxc_params=u"", sudo=True, timeout=30):
        """Execute command in LXC on a new SSH channel on the connected Node.

        :param lxc_cmd: Command to be executed.
        :param lxc_name: LXC name.
        :param lxc_params: Additional parameters for LXC attach.
        :param sudo: Run in privileged LXC mode. Default: privileged
        :param timeout: Timeout.
        :type lxc_cmd: str
        :type lxc_name: str
        :type lxc_params: str
        :type sudo: bool
        :type timeout: int
        :returns: return_code, stdout, stderr
        """
        command = f"lxc-attach {lxc_params} --name {lxc_name} -- /bin/sh " \
            f"-c \"{lxc_cmd}\""

        if sudo:
            command = f"sudo -E -S {command}"
        return self.exec_command(command, timeout)

    def interactive_terminal_open(self, time_out=45):
        """Open interactive terminal on a new channel on the connected Node.

        :param time_out: Timeout in seconds.
        :returns: SSH channel with opened terminal.

        .. warning:: Interruptingcow is used here, and it uses
           signal(SIGALRM) to let the operating system interrupt program
           execution. This has the following limitations: Python signal
           handlers only apply to the main thread, so you cannot use this
           from other threads. You must not use this in a program that
           uses SIGALRM itself (this includes certain profilers)
        """
        chan = self._ssh.get_transport().open_session()
        chan.get_pty()
        chan.invoke_shell()
        chan.settimeout(int(time_out))
        chan.set_combine_stderr(True)

        buf = u""
        while not buf.endswith((u":~# ", u":~$ ", u"~]$ ", u"~]# ")):
            try:
                s_out = chan.recv(self.__MAX_RECV_BUF)
                if not s_out:
                    break
                buf += s_out.decode(encoding=u'utf-8', errors=u'ignore') \
                    if isinstance(s_out, bytes) else s_out
                if chan.exit_status_ready():
                    logger.error(u"Channel exit status ready")
                    break
            except socket.timeout as exc:
                raise Exception(f"Socket timeout: {buf}") from exc
        return chan

    def interactive_terminal_exec_command(self, chan, cmd, prompt):
        """Execute command on interactive terminal.

        interactive_terminal_open() method has to be called first!

        :param chan: SSH channel with opened terminal.
        :param cmd: Command to be executed.
        :param prompt: Command prompt, sequence of characters used to
            indicate readiness to accept commands.
        :returns: Command output.

        .. warning:: Interruptingcow is used here, and it uses
           signal(SIGALRM) to let the operating system interrupt program
           execution. This has the following limitations: Python signal
           handlers only apply to the main thread, so you cannot use this
           from other threads. You must not use this in a program that
           uses SIGALRM itself (this includes certain profilers)
        """
        chan.sendall(f"{cmd}\n")
        buf = u""
        while not buf.endswith(prompt):
            try:
                s_out = chan.recv(self.__MAX_RECV_BUF)
                if not s_out:
                    break
                buf += s_out.decode(encoding=u'utf-8', errors=u'ignore') \
                    if isinstance(s_out, bytes) else s_out
                if chan.exit_status_ready():
                    logger.error(u"Channel exit status ready")
                    break
            except socket.timeout as exc:
                raise Exception(
                    f"Socket timeout during execution of command: {cmd}\n"
                    f"Buffer content:\n{buf}"
                ) from exc
        tmp = buf.replace(cmd.replace(u"\n", u""), u"")
        for item in prompt:
            tmp.replace(item, u"")
        return tmp

    @staticmethod
    def interactive_terminal_close(chan):
        """Close interactive terminal SSH channel.

        :param chan: SSH channel to be closed.
        """
        chan.close()

    def scp(
            self, local_path, remote_path, get=False, timeout=30,
            wildcard=False):
        """Copy files from local_path to remote_path or vice versa.

        connect() method has to be called first!

        :param local_path: Path to local file that should be uploaded; or
            path where to save remote file.
        :param remote_path: Remote path where to place uploaded file; or
            path to remote file which should be downloaded.
        :param get: scp operation to perform. Default is put.
        :param timeout: Timeout value in seconds.
        :param wildcard: If path has wildcard characters. Default is false.
        :type local_path: str
        :type remote_path: str
        :type get: bool
        :type timeout: int
        :type wildcard: bool
        """
        if not get:
            logger.trace(
                f"SCP {local_path} to "
                f"{self._ssh.get_transport().getpeername()}:{remote_path}"
            )
        else:
            logger.trace(
                f"SCP {self._ssh.get_transport().getpeername()}:{remote_path} "
                f"to {local_path}"
            )
        # SCPCLient takes a paramiko transport as its only argument
        if not wildcard:
            scp = SCPClient(self._ssh.get_transport(), socket_timeout=timeout)
        else:
            scp = SCPClient(
                self._ssh.get_transport(), sanitize=lambda x: x,
                socket_timeout=timeout
            )
        start = monotonic()
        if not get:
            scp.put(local_path, remote_path)
        else:
            scp.get(remote_path, local_path)
        scp.close()
        duration = monotonic() - start
        logger.trace(f"SCP took {duration} seconds")


def exec_cmd(
        node, cmd, timeout=600, sudo=False, disconnect=False,
        log_stdout_err=True
    ):
    """Convenience function to ssh/exec/return rc, out & err.

    Returns (rc, stdout, stderr).

    :param node: The node to execute command on.
    :param cmd: Command to execute.
    :param timeout: Timeout value in seconds. Default: 600.
    :param sudo: Sudo privilege execution flag. Default: False.
    :param disconnect: Close the opened SSH connection if True.
    :param log_stdout_err: If True, stdout and stderr are logged. stdout
        and stderr are logged also if the return code is not zero
        independently of the value of log_stdout_err.
        Needed for calls outside Robot (e.g. from reservation script).
    :type node: dict
    :type cmd: str or OptionString
    :type timeout: int
    :type sudo: bool
    :type disconnect: bool
    :type log_stdout_err: bool
    :returns: RC, Stdout, Stderr.
    :rtype: Tuple[int, str, str]
    """
    if node is None:
        raise TypeError(u"Node parameter is None")
    if cmd is None:
        raise TypeError(u"Command parameter is None")
    if not cmd:
        raise ValueError(u"Empty command parameter")

    ssh = SSH()

    try:
        ssh.connect(node)
    except SSHException as err:
        logger.error(f"Failed to connect to node {node[u'host']}\n{err!r}")
        return None, None, None

    try:
        if not sudo:
            ret_code, stdout, stderr = ssh.exec_command(
                cmd, timeout=timeout, log_stdout_err=log_stdout_err
            )
        else:
            ret_code, stdout, stderr = ssh.exec_command_sudo(
                cmd, timeout=timeout, log_stdout_err=log_stdout_err
            )
    except SSHException as err:
        logger.error(repr(err))
        return None, None, None
    finally:
        if disconnect:
            ssh.disconnect()

    return ret_code, stdout, stderr


def exec_cmd_no_error(
        node, cmd, timeout=600, sudo=False, message=None, disconnect=False,
        retries=0, include_reason=False, log_stdout_err=True
    ):
    """Convenience function to ssh/exec/return out & err.

    Verifies that return code is zero.
    Supports retries, timeout is related to each try separately then. There is
    sleep(1) before each retry.
    Disconnect (if enabled) is applied after each try.

    :param node: DUT node.
    :param cmd: Command to be executed.
    :param timeout: Timeout value in seconds. Default: 600.
    :param sudo: Sudo privilege execution flag. Default: False.
    :param message: Error message in case of failure. Default: None.
    :param disconnect: Close the opened SSH connection if True.
    :param retries: How many times to retry on failure.
    :param include_reason: Whether default info should be appended to message.
    :param log_stdout_err: If True, stdout and stderr are logged. stdout
        and stderr are logged also if the return code is not zero
        independently of the value of log_stdout_err.
        Needed for calls outside Robot thread (e.g. parallel framework setup).
    :type node: dict
    :type cmd: str or OptionString
    :type timeout: int
    :type sudo: bool
    :type message: str
    :type disconnect: bool
    :type retries: int
    :type include_reason: bool
    :type log_stdout_err: bool
    :returns: Stdout, Stderr.
    :rtype: tuple(str, str)
    :raises RuntimeError: If bash return code is not 0.
    """
    for _ in range(retries + 1):
        ret_code, stdout, stderr = exec_cmd(
            node, cmd, timeout=timeout, sudo=sudo, disconnect=disconnect,
            log_stdout_err=log_stdout_err
        )
        if ret_code == 0:
            break
        sleep(1)
    else:
        msg = f"Command execution failed: '{cmd}'\nRC: {ret_code}\n{stderr}"
        logger.info(msg)
        if message:
            msg = f"{message}\n{msg}" if include_reason else message
        raise RuntimeError(msg)

    return stdout, stderr


def scp_node(
        node, local_path, remote_path, get=False, timeout=30, disconnect=False):
    """Copy files from local_path to remote_path or vice versa.

    :param node: SUT node.
    :param local_path: Path to local file that should be uploaded; or
        path where to save remote file.
    :param remote_path: Remote path where to place uploaded file; or
        path to remote file which should be downloaded.
    :param get: scp operation to perform. Default is put.
    :param timeout: Timeout value in seconds.
    :param disconnect: Close the opened SSH connection if True.
    :type node: dict
    :type local_path: str
    :type remote_path: str
    :type get: bool
    :type timeout: int
    :type disconnect: bool
    :raises RuntimeError: If SSH connection failed or SCP transfer failed.
    """
    ssh = SSH()

    try:
        ssh.connect(node)
    except SSHException as exc:
        raise RuntimeError(f"Failed to connect to {node[u'host']}!") from exc
    try:
        ssh.scp(local_path, remote_path, get, timeout)
    except SCPException as exc:
        raise RuntimeError(f"SCP execution failed on {node[u'host']}!") from exc
    finally:
        if disconnect:
            ssh.disconnect()