Page MenuHomePhabricator

Homer CI: verify Junos syntax
Open, LowPublic

Description

I came across junoser which is a Ruby tool to verify Juniper configuration (in various formats), as well as translate them to set commands.

It would be useful to be able to use it in CI to catch errors before having to get a diff directly from a device (slower and requires router access).

An example run:

$ homer -c config.yaml 'msw1-codfw*' generate
$ sed -e "s/replace: //g" -i output/msw1-codfw.mgmt.codfw.wmnet.out
$ junoser -c output/msw1-codfw.mgmt.codfw.wmnet.out
$ echo $?
0

Running it on more complex devices:

$ junoser -c output/cr3-ulsfo.wikimedia.org.out
Invalid syntax:  set forwarding-options rpf-loose-mode-discard family inet6
Invalid syntax:  set protocols bgp group Netflow local-as 65004 no-prepend-global-as
Invalid syntax:  set policy-options prefix-list bgp-sessions apply-path "protocols bgp group <*> neighbor <*>"
Invalid syntax:  set policy-options prefix-list system-ntp apply-path "system ntp server <*>"
Invalid syntax:  set policy-options prefix-list system-nameservers apply-path "system name-server <*>"
Invalid syntax:  set policy-options prefix-list loopback4 apply-path "interfaces lo0 unit 0 family inet address <*/32>"
Invalid syntax:  set policy-options prefix-list loopback6 apply-path "interfaces lo0 unit 0 family inet6 address <*/128>"
Invalid syntax:  set policy-options policy-statement BGP_Customer_out term aggregates6 from protocol ospf3
Invalid syntax:  set policy-options policy-statement BGP_aggregate_contributors term internal_only from protocol ospf3

The apply-path error has been reported in https://github.com/codeout/junoser/issues/22
The other ones would need some more investigation.

Event Timeline

ayounsi created this task.

@ayounsi nice! The only problem that I see is the connection to Netbox. As Netbox is currently "private" it would not be possible to add a token (even RO) to our public CI to be able to connect to it to generate the configuration.

Opened an upstream task with some questions: https://github.com/codeout/junoser/issues/24

Indeed, not having CI able to pull data from Netbox is going to be an issue down the road. Current workaround is to maybe use netbox-next and have sanitized data there.

I had another look as upstream fixed the issues reported.

I opened a follow up issue for a couple more invalid error messages: https://github.com/codeout/junoser/issues/31

But it already helped by finding typos in our config: https://gerrit.wikimedia.org/r/c/operations/homer/public/+/806857

I'm still wondering how best to integrate it to our workflows though.

Change 811706 had a related patch set uploaded (by Ayounsi; author: Ayounsi):

[operations/homer/public@master] cr: policy-options add missing return

https://gerrit.wikimedia.org/r/811706

Change 811706 merged by jenkins-bot:

[operations/homer/public@master] cr: policy-options add missing return

https://gerrit.wikimedia.org/r/811706