From 20e717e4bfd972abb8cabc7a1888129ec3926dac Mon Sep 17 00:00:00 2001 From: pavel Date: Mon, 26 Jan 2026 19:19:01 +0200 Subject: [PATCH] 1918 --- .../ptsd_reacquire_attempt.yml | 105 +++++++++--------- 1 file changed, 50 insertions(+), 55 deletions(-) diff --git a/files/ansible-playbooks/ptsd_reacquire_attempt.yml b/files/ansible-playbooks/ptsd_reacquire_attempt.yml index 93ffe2f..98f9fc2 100644 --- a/files/ansible-playbooks/ptsd_reacquire_attempt.yml +++ b/files/ansible-playbooks/ptsd_reacquire_attempt.yml @@ -76,6 +76,7 @@ # sleep 10 # ignore_errors: true + - name: Discover DEV2 candidate IPv4 via LLDP on DEV1 (best-effort) ansible.builtin.raw: > {{ pathprefix }} @@ -312,19 +313,12 @@ changed_when: false ignore_errors: true - - name: Record IPv4 tunnel probe status - when: dev2_conn_method == "tunnel" - delegate_to: localhost - ansible.builtin.set_fact: - tunnel_v4_ok: "{{ (nc_probe.rc | default(1)) == 0 }}" - changed_when: false - - - name: Stop if tunnel TCP probe failed and no IPv6 candidate exists - when: dev2_conn_method == "tunnel" and not (tunnel_v4_ok | bool) and (lldp_dev2_ip6 | default('') | trim | length) == 0 + - name: Stop if tunnel TCP probe failed + when: dev2_conn_method == "tunnel" and nc_probe.rc != 0 ansible.builtin.meta: end_host - name: Pick DEV2 password for root (tunnel) try basicpass - when: dev2_conn_method == "tunnel" and (tunnel_v4_ok | bool) + when: dev2_conn_method == "tunnel" delegate_to: localhost ansible.builtin.shell: | set -e @@ -338,14 +332,14 @@ ignore_errors: true - name: Select basicpass if tunnel login succeeded - when: dev2_conn_method == "tunnel" and (tunnel_v4_ok | bool) and dev2_try_basicpass.rc == 0 + when: dev2_conn_method == "tunnel" and dev2_try_basicpass.rc == 0 delegate_to: localhost ansible.builtin.set_fact: dev2_passfile_used_tunnel: "basicpass" changed_when: false - name: Try DEV2 login through tunnel with basicpass2 (only if first failed) - when: dev2_conn_method == "tunnel" and (tunnel_v4_ok | bool) and (dev2_passfile_used_tunnel == "NONE") + when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel == "NONE") delegate_to: localhost ansible.builtin.shell: | set -e @@ -359,30 +353,37 @@ ignore_errors: true - name: Select basicpass2 if tunnel login succeeded - when: dev2_conn_method == "tunnel" and (tunnel_v4_ok | bool) and dev2_passfile_used_tunnel == "NONE" and dev2_try_basicpass2.rc == 0 + when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and dev2_try_basicpass2.rc == 0 delegate_to: localhost ansible.builtin.set_fact: dev2_passfile_used_tunnel: "basicpass2" changed_when: false - - name: Record need for IPv6 tunnel attempt - when: dev2_conn_method == "tunnel" + - name: Decide if IPv6 tunnel fallback should be attempted delegate_to: localhost ansible.builtin.set_fact: - need_tunnel6: >- + try_ipv6_tunnel: >- {{ - ( - (not (tunnel_v4_ok | default(false) | bool)) - or - ((dev2_passfile_used_tunnel | default('NONE')) == 'NONE') - ) + (lldp_dev2_ip6 | default('') | trim | length > 0) and - ((lldp_dev2_ip6 | default('') | trim | length) > 0) + ( + ( + (lldp_ip_class | trim) == '10' + and + (dev2_passfile_used_direct | default('NONE')) == 'NONE' + ) + or + ( + (lldp_ip_class | trim) == '192_168' + and + (dev2_passfile_used_tunnel | default('NONE')) == 'NONE' + ) + ) }} changed_when: false - name: Pick a free local TCP port for the IPv6 tunnel (controller side) - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) + when: try_ipv6_tunnel | bool delegate_to: localhost ansible.builtin.shell: | set -e @@ -407,19 +408,19 @@ changed_when: false - name: Stop if no free local port was found for IPv6 tunnel - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) and (pick_port6.stdout | trim | length) == 0 + when: try_ipv6_tunnel | bool and (pick_port6.stdout | trim | length) == 0 ansible.builtin.meta: end_host - - name: Create control dir for SSH ControlMaster (IPv6 tunnel) - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) + - name: Create control dir for IPv6 tunnel SSH ControlMaster + when: try_ipv6_tunnel | bool delegate_to: localhost ansible.builtin.shell: "mktemp -d" args: { executable: /bin/bash } register: mktemp_dir6 changed_when: false - - name: Record chosen local port and build ControlMaster socket path (IPv6 tunnel) - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) + - name: Record chosen local port and build IPv6 tunnel ControlMaster socket path + when: try_ipv6_tunnel | bool delegate_to: localhost ansible.builtin.set_fact: _local_port6: "{{ pick_port6.stdout | trim }}" @@ -427,25 +428,23 @@ _ctrl_sock6: "{{ (mktemp_dir6.stdout | trim) }}/ssh_tunnel_ctl6" changed_when: false - - name: Start SSH ControlMaster and forward 127.0.0.1:local_port6 to DEV2 22 via DEV1 (IPv6) - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) + - name: Start SSH ControlMaster and forward 127.0.0.1:local_port to DEV2 IPv6 22 via DEV1 + when: try_ipv6_tunnel | bool delegate_to: localhost ansible.builtin.shell: | set -e USER="{{ dev1_user }}" HOST="{{ ansible_host | default(inventory_hostname) }}" - IP6="{{ lldp_dev2_ip6 | trim }}" sshpass -p '{{ dev1_pass }}' ssh -f -N {{ ssh_opts_common }} \ -M -S "{{ _ctrl_sock6 }}" \ - -L "127.0.0.1:{{ _local_port6 }}:[${IP6}%{{ dev1_iface }}]:{{ dev2_port }}" \ + -L "127.0.0.1:{{ _local_port6 }}:[{{ lldp_dev2_ip6 }}%{{ dev1_iface }}]:{{ dev2_port }}" \ "${USER}@${HOST}" args: { executable: /bin/bash } register: start_tunnel6 changed_when: true - ignore_errors: true - name: Probe TCP reachability to DEV2 through the IPv6 tunnel (nc) - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) + when: try_ipv6_tunnel | bool delegate_to: localhost ansible.builtin.shell: | set -e @@ -455,12 +454,8 @@ changed_when: false ignore_errors: true - - name: Stop if IPv6 tunnel TCP probe failed - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) and (nc_probe6.rc | default(1)) != 0 - ansible.builtin.meta: end_host - - name: Pick DEV2 password for root (IPv6 tunnel) try basicpass - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) + when: try_ipv6_tunnel | bool and (nc_probe6.rc | default(1)) == 0 delegate_to: localhost ansible.builtin.shell: | set -e @@ -474,14 +469,14 @@ ignore_errors: true - name: Select basicpass if IPv6 tunnel login succeeded - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) and dev2_try_basicpass6.rc == 0 + when: try_ipv6_tunnel | bool and (dev2_try_basicpass6.rc | default(1)) == 0 delegate_to: localhost ansible.builtin.set_fact: dev2_passfile_used_tunnel6: "basicpass" changed_when: false - name: Try DEV2 login through IPv6 tunnel with basicpass2 (only if first failed) - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) and (dev2_passfile_used_tunnel6 == "NONE") + when: try_ipv6_tunnel | bool and (dev2_passfile_used_tunnel6 == "NONE") and (nc_probe6.rc | default(1)) == 0 delegate_to: localhost ansible.builtin.shell: | set -e @@ -495,7 +490,7 @@ ignore_errors: true - name: Select basicpass2 if IPv6 tunnel login succeeded - when: dev2_conn_method == "tunnel" and (need_tunnel6 | bool) and dev2_passfile_used_tunnel6 == "NONE" and dev2_try_basicpass26.rc == 0 + when: try_ipv6_tunnel | bool and dev2_passfile_used_tunnel6 == "NONE" and (dev2_try_basicpass26.rc | default(1)) == 0 delegate_to: localhost ansible.builtin.set_fact: dev2_passfile_used_tunnel6: "basicpass2" @@ -509,7 +504,7 @@ direct_lldp {%- elif dev2_conn_method == 'tunnel' and (dev2_passfile_used_tunnel | default('NONE')) != 'NONE' -%} tunnel - {%- elif dev2_conn_method == 'tunnel' and (dev2_passfile_used_tunnel6 | default('NONE')) != 'NONE' -%} + {%- elif (dev2_passfile_used_tunnel6 | default('NONE')) != 'NONE' -%} tunnel6 {%- else -%} none @@ -535,7 +530,7 @@ - "tunnel6 passfile={{ dev2_passfile_used_tunnel6 | default('n/a') }}" - "direct passfile={{ dev2_passfile_used_direct | default('n/a') }}" - "tunnel target={{ dev2_host }}:{{ dev2_port }} forwarded 127.0.0.1:{{ _local_port | default('na') }}" - - "tunnel6 target={{ lldp_dev2_ip6 | default('') }}%{{ dev1_iface }}:{{ dev2_port }} forwarded 127.0.0.1:{{ _local_port6 | default('na') }}" + - "tunnel6 target=[{{ lldp_dev2_ip6 | default('') }}%{{ dev1_iface }}]:{{ dev2_port }} forwarded 127.0.0.1:{{ _local_port6 | default('na') }}" - "lldp ipv4={{ lldp_dev2_ip | default('') }}" - "lldp ipv6={{ lldp_dev2_ip6 | default('') }}" @@ -886,15 +881,6 @@ changed_when: false ignore_errors: true - - name: Close SSH ControlMaster (IPv6 tunnel best-effort) - when: dev2_conn_method | default('') == "tunnel" - delegate_to: localhost - ansible.builtin.shell: | - ssh -S "{{ _ctrl_sock6 | default('/dev/null') }}" -O exit 2>/dev/null || true - args: { executable: /bin/bash } - changed_when: false - ignore_errors: true - - name: Remove tunnel control dir (best-effort) when: dev2_conn_method | default('') == "tunnel" delegate_to: localhost @@ -903,8 +889,17 @@ state: absent ignore_errors: true - - name: Remove tunnel control dir (IPv6 tunnel best-effort) - when: dev2_conn_method | default('') == "tunnel" + - name: Close SSH ControlMaster for IPv6 tunnel (best-effort) + when: _ctrl_sock6 is defined + delegate_to: localhost + ansible.builtin.shell: | + ssh -S "{{ _ctrl_sock6 | default('/dev/null') }}" -O exit 2>/dev/null || true + args: { executable: /bin/bash } + changed_when: false + ignore_errors: true + + - name: Remove IPv6 tunnel control dir (best-effort) + when: _ctrl_dir6 is defined delegate_to: localhost ansible.builtin.file: path: "{{ _ctrl_dir6 | default('/tmp/none') }}"