kvm/security_group: Make Security Group Python 3 compatible (#3589)

* kvm/security_group: Make Security Group Python 3 compatible

This script only runs on the KVM Hypervisors and these all support
Python 3.

As Python 2 is deprecated at the end of 2019 we need to fix these
scripts to work under Python 3.

CentOS 7, 8 and Ubuntu 16.04 and 18.04 all have Python 3 installed
by default.

Ubuntu 20.04 will no longer have Python 2 installed and therefor
this script needs to be modified to work with Python 3.

Signed-off-by: Wido den Hollander <wido@widodh.nl>

* Add dependency of python3 in packaging/centos7/cloud.spec

debian/control

@@ -3,13 +3,13 @@ Section: libs
 Priority: extra
 Maintainer: Wido den Hollander <wido@widodh.nl>
 Build-Depends: debhelper (>= 9), openjdk-8-jdk | java8-sdk | java8-jdk | openjdk-9-jdk, genisoimage,
- python-mysql.connector, maven (>= 3) | maven3, python (>= 2.7), lsb-release, dh-systemd, python-setuptools
+ python-mysql.connector, maven (>= 3) | maven3, python (>= 2.7), python3 (>= 3), lsb-release, dh-systemd, python-setuptools
 Standards-Version: 3.8.1
 Homepage: http://www.cloudstack.org/
 
 Package: cloudstack-common
 Architecture: all
-Depends: ${misc:Depends}, ${python:Depends}, genisoimage, nfs-common, python-netaddr
+Depends: ${misc:Depends}, ${python:Depends}, genisoimage, nfs-common
 Conflicts: cloud-scripts, cloud-utils, cloud-system-iso, cloud-console-proxy, cloud-daemonize, cloud-deps, cloud-python, cloud-setup
 Description: A common package which contains files which are shared by several CloudStack packages
 
@@ -22,7 +22,7 @@ Description: CloudStack server library
 
 Package: cloudstack-agent
 Architecture: all
-Depends: ${python:Depends}, openjdk-8-jre-headless | java8-runtime-headless | java8-runtime | openjdk-9-jre-headless, cloudstack-common (= ${source:Version}), lsb-base (>= 9), openssh-client, qemu-kvm (>= 2.5), libvirt-bin (>= 1.3) | libvirt-daemon-system (>= 3.0), uuid-runtime, iproute2, ebtables, vlan, ipset, python-libvirt, ethtool, iptables, lsb-release, aria2
+Depends: ${python:Depends}, openjdk-8-jre-headless | java8-runtime-headless | java8-runtime | openjdk-9-jre-headless, cloudstack-common (= ${source:Version}), lsb-base (>= 9), openssh-client, qemu-kvm (>= 2.5), libvirt-bin (>= 1.3) | libvirt-daemon-system (>= 3.0), uuid-runtime, iproute2, ebtables, vlan, ipset, python3-libvirt, ethtool, iptables, lsb-release, aria2
 Recommends: init-system-helpers
 Conflicts: cloud-agent, cloud-agent-libs, cloud-agent-deps, cloud-agent-scripts
 Description: CloudStack agent

packaging/centos7/cloud.spec

@@ -55,6 +55,7 @@ intelligent IaaS cloud implementation.
 Summary:   CloudStack management server UI
 Requires: java-1.8.0-openjdk
 Requires: python
+Requires: python3
 Requires: bash
 Requires: bzip2
 Requires: gzip
@@ -82,6 +83,7 @@ management, and intelligence in CloudStack.
 %package common
 Summary: Apache CloudStack common files and scripts
 Requires: python
+Requires: python3
 Requires: python-argparse
 Requires: python-netaddr
 Group:   System Environment/Libraries

scripts/vm/network/security_group.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/python3
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
@@ -26,9 +26,7 @@ import re
 import libvirt
 import fcntl
 import time
-from netaddr import IPAddress, IPNetwork
-from netaddr.core import AddrFormatError
-
+import ipaddress
 
 logpath = "/var/run/cloud/"        # FIXME: Logs should reside in /var/log/cloud
 lock_file = "/var/lock/cloudstack_security_group.lock"
@@ -52,7 +50,7 @@ def obtain_file_lock(path):
 def execute(cmd):
     logging.debug(cmd)
     try:
-        return check_output(cmd, shell=True)
+        return check_output(cmd, shell=True).decode()
     except CalledProcessError as e:
         logging.exception('Command exited non-zero: %s', cmd)
         raise
@@ -103,8 +101,8 @@ def virshlist(states):
 
     conn = get_libvirt_connection()
 
-    alldomains = map(conn.lookupByID, conn.listDomainsID())
-    alldomains += map(conn.lookupByName, conn.listDefinedDomains())
+    alldomains = [d for domain in map(conn.lookupByID, conn.listDomainsID())]
+    alldomains += [d for domain in map(conn.lookupByName, conn.listDefinedDomains())]
 
     domains = []
     for domain in alldomains:
@@ -130,7 +128,7 @@ def ipv6_link_local_addr(mac=None):
     eui64 = re.sub(r'[.:-]', '', mac).lower()
     eui64 = eui64[0:6] + 'fffe' + eui64[6:]
     eui64 = hex(int(eui64[0:2], 16) ^ 2)[2:].zfill(2) + eui64[2:]
-    return IPAddress('fe80::' + ':'.join(re.findall(r'.{4}', eui64)))
+    return ipaddress.ip_address('fe80::' + ':'.join(re.findall(r'.{4}', eui64)))
 
 
 def split_ips_by_family(ips):
@@ -140,10 +138,10 @@ def split_ips_by_family(ips):
     ip4s = []
     ip6s = []
     for ip in ips:
-        version = IPNetwork(ip).version
-        if version == 4:
+        network = ipaddress.ip_network(ip)
+        if network.version == 4:
             ip4s.append(ip)
-        elif version == 6:
+        elif network.version == 6:
             ip6s.append(ip)
     return ip4s, ip6s
 
@@ -516,10 +514,10 @@ def default_network_rules(vm_name, vm_id, vm_ip, vm_ip6, vm_mac, vif, brname, se
 
     vm_ip6_addr = [ipv6_link_local]
     try:
-        ip6 = IPAddress(vm_ip6)
+        ip6 = ipaddress.ip_address(vm_ip6)
         if ip6.version == 6:
             vm_ip6_addr.append(ip6)
-    except AddrFormatError:
+    except (ipaddress.AddressValueError, ValueError):
         pass
 
     add_to_ipset(vmipsetName6, vm_ip6_addr, action)
@@ -969,7 +967,7 @@ def parse_network_rules(rules):
         ipv6 = []
         for ip in cidrs.split(","):
             try:
-                network = IPNetwork(ip)
+                network = ipaddress.ip_network(ip)
                 if network.version == 4:
                     ipv4.append(ip)
                 else: