Initial implementation of security group for kubevirt tenant network
Change-Id: If49d03021408a134be01267cc4eee9e0091e3c3d
diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/codec/KubevirtPortCodec.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/codec/KubevirtPortCodec.java
index dbbf9c8..a388227 100644
--- a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/codec/KubevirtPortCodec.java
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/codec/KubevirtPortCodec.java
@@ -16,6 +16,7 @@
package org.onosproject.kubevirtnetworking.codec;
import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.ArrayNode;
import com.fasterxml.jackson.databind.node.ObjectNode;
import org.onlab.packet.IpAddress;
import org.onlab.packet.MacAddress;
@@ -40,6 +41,7 @@
private static final String IP_ADDRESS = "ipAddress";
private static final String DEVICE_ID = "deviceId";
private static final String PORT_NUMBER = "portNumber";
+ private static final String SECURITY_GROUPS = "securityGroups";
private static final String MISSING_MESSAGE = " is required in KubevirtPort";
@@ -63,6 +65,14 @@
result.put(PORT_NUMBER, port.portNumber().toString());
}
+ if (port.securityGroups() != null) {
+ ArrayNode sgIds = context.mapper().createArrayNode();
+ for (String sgId : port.securityGroups()) {
+ sgIds.add(sgId);
+ }
+ result.set(SECURITY_GROUPS, sgIds);
+ }
+
return result;
}
diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/DistributedKubevirtPortStore.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/DistributedKubevirtPortStore.java
index 5104bc8..15461df 100644
--- a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/DistributedKubevirtPortStore.java
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/DistributedKubevirtPortStore.java
@@ -25,6 +25,7 @@
import org.onosproject.kubevirtnetworking.api.KubevirtPortEvent;
import org.onosproject.kubevirtnetworking.api.KubevirtPortStore;
import org.onosproject.kubevirtnetworking.api.KubevirtPortStoreDelegate;
+import org.onosproject.net.DeviceId;
import org.onosproject.store.AbstractStore;
import org.onosproject.store.serializers.KryoNamespaces;
import org.onosproject.store.service.ConsistentMap;
@@ -41,6 +42,7 @@
import org.slf4j.Logger;
import java.util.Collection;
+import java.util.Objects;
import java.util.Set;
import java.util.concurrent.ExecutorService;
@@ -48,7 +50,10 @@
import static java.util.concurrent.Executors.newSingleThreadExecutor;
import static org.onlab.util.Tools.groupedThreads;
import static org.onosproject.kubevirtnetworking.api.KubevirtPortEvent.Type.KUBEVIRT_PORT_CREATED;
+import static org.onosproject.kubevirtnetworking.api.KubevirtPortEvent.Type.KUBEVIRT_PORT_DEVICE_ADDED;
import static org.onosproject.kubevirtnetworking.api.KubevirtPortEvent.Type.KUBEVIRT_PORT_REMOVED;
+import static org.onosproject.kubevirtnetworking.api.KubevirtPortEvent.Type.KUBEVIRT_PORT_SECURITY_GROUP_ADDED;
+import static org.onosproject.kubevirtnetworking.api.KubevirtPortEvent.Type.KUBEVIRT_PORT_SECURITY_GROUP_REMOVED;
import static org.onosproject.kubevirtnetworking.api.KubevirtPortEvent.Type.KUBEVIRT_PORT_UPDATED;
import static org.slf4j.LoggerFactory.getLogger;
@@ -166,6 +171,8 @@
eventExecutor.execute(() ->
notifyDelegate(new KubevirtPortEvent(
KUBEVIRT_PORT_UPDATED, event.newValue().value())));
+ processSecurityGroupEvent(event.oldValue().value(), event.newValue().value());
+ processDeviceEvent(event.oldValue().value(), event.newValue().value());
break;
case REMOVE:
log.debug("Kubevirt port removed");
@@ -182,5 +189,36 @@
break;
}
}
+
+ private void processSecurityGroupEvent(KubevirtPort oldPort, KubevirtPort newPort) {
+ Set<String> oldSecurityGroups = oldPort.securityGroups() == null ?
+ ImmutableSet.of() : oldPort.securityGroups();
+ Set<String> newSecurityGroups = newPort.securityGroups() == null ?
+ ImmutableSet.of() : newPort.securityGroups();
+
+ oldSecurityGroups.stream()
+ .filter(sgId -> !Objects.requireNonNull(
+ newPort.securityGroups()).contains(sgId))
+ .forEach(sgId -> notifyDelegate(new KubevirtPortEvent(
+ KUBEVIRT_PORT_SECURITY_GROUP_REMOVED, newPort, sgId
+ )));
+
+ newSecurityGroups.stream()
+ .filter(sgId -> !oldPort.securityGroups().contains(sgId))
+ .forEach(sgId -> notifyDelegate(new KubevirtPortEvent(
+ KUBEVIRT_PORT_SECURITY_GROUP_ADDED, newPort, sgId
+ )));
+ }
+
+ private void processDeviceEvent(KubevirtPort oldPort, KubevirtPort newPort) {
+ DeviceId oldDeviceId = oldPort.deviceId();
+ DeviceId newDeviceId = newPort.deviceId();
+
+ if (oldDeviceId == null && newDeviceId != null) {
+ notifyDelegate(new KubevirtPortEvent(
+ KUBEVIRT_PORT_DEVICE_ADDED, newPort, newDeviceId
+ ));
+ }
+ }
}
}
diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtFloatingIpHandler.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtFloatingIpHandler.java
index f1a5fe0..b77fb04 100644
--- a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtFloatingIpHandler.java
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtFloatingIpHandler.java
@@ -37,8 +37,6 @@
import org.onosproject.kubevirtnetworking.api.KubevirtRouterService;
import org.onosproject.kubevirtnetworking.util.RulePopulatorUtil;
import org.onosproject.kubevirtnode.api.KubevirtNode;
-import org.onosproject.kubevirtnode.api.KubevirtNodeEvent;
-import org.onosproject.kubevirtnode.api.KubevirtNodeListener;
import org.onosproject.kubevirtnode.api.KubevirtNodeService;
import org.onosproject.net.Device;
import org.onosproject.net.PortNumber;
@@ -130,16 +128,12 @@
private final InternalRouterEventListener kubevirtRouterListener =
new InternalRouterEventListener();
- private final InternalNodeEventListener kubevirtNodeListener =
- new InternalNodeEventListener();
-
@Activate
protected void activate() {
appId = coreService.registerApplication(KUBEVIRT_NETWORKING_APP_ID);
localNodeId = clusterService.getLocalNode().id();
leadershipService.runForLeadership(appId.name());
kubevirtRouterService.addListener(kubevirtRouterListener);
- kubevirtNodeService.addListener(kubevirtNodeListener);
log.info("Started");
}
@@ -148,7 +142,6 @@
protected void deactivate() {
leadershipService.withdraw(appId.name());
kubevirtRouterService.removeListener(kubevirtRouterListener);
- kubevirtNodeService.removeListener(kubevirtNodeListener);
eventExecutor.shutdown();
@@ -162,8 +155,6 @@
KubevirtPort kubevirtPort = getKubevirtPort(floatingIp);
if (kubevirtPort == null) {
- log.warn("Failed to install floating Ip rules for floating ip {} " +
- "because there's no kubevirt port associated to it", floatingIp.floatingIp());
return;
}
@@ -386,6 +377,14 @@
eventExecutor.execute(() -> processRouterGatewayNodeChanged(event.subject(),
event.gateway()));
break;
+ case KUBEVIRT_GATEWAY_NODE_ATTACHED:
+ eventExecutor.execute(() -> processGatewayNodeAttachment(event.subject(),
+ event.gateway()));
+ break;
+ case KUBEVIRT_GATEWAY_NODE_DETACHED:
+ eventExecutor.execute(() -> processGatewayNodeDetachment(event.subject(),
+ event.gateway()));
+ break;
default:
//do nothing
break;
@@ -415,6 +414,28 @@
});
}
+ private void processGatewayNodeAttachment(KubevirtRouter router, String gatewayName) {
+ kubevirtRouterService.floatingIps().forEach(fip -> {
+ if (fip.routerName().equals(router.name())) {
+ KubevirtNode gw = kubevirtNodeService.node(gatewayName);
+ if (gw != null) {
+ setFloatingIpRulesForFip(router, fip, gw, true);
+ }
+ }
+ });
+ }
+
+ private void processGatewayNodeDetachment(KubevirtRouter router, String gatewayName) {
+ kubevirtRouterService.floatingIps().forEach(fip -> {
+ if (fip.routerName().equals(router.name())) {
+ KubevirtNode gw = kubevirtNodeService.node(gatewayName);
+ if (gw != null) {
+ setFloatingIpRulesForFip(router, fip, gw, false);
+ }
+ }
+ });
+ }
+
private void processFloatingIpAssociation(KubevirtRouter router, KubevirtFloatingIp floatingIp) {
if (!isRelevantHelper() || router.electedGateway() == null) {
return;
@@ -443,45 +464,4 @@
setFloatingIpRulesForFip(router, floatingIp, electedGw, false);
}
}
-
- private class InternalNodeEventListener implements KubevirtNodeListener {
-
- private boolean isRelevantHelper() {
- return Objects.equals(localNodeId, leadershipService.getLeader(appId.name()));
- }
-
- @Override
- public void event(KubevirtNodeEvent event) {
- switch (event.type()) {
- case KUBEVIRT_NODE_COMPLETE:
- eventExecutor.execute(() -> processNodeCompletion(event.subject()));
- break;
- case KUBEVIRT_NODE_REMOVED:
- case KUBEVIRT_NODE_INCOMPLETE:
- default:
- break;
- }
- }
-
- private void processNodeCompletion(KubevirtNode node) {
- if (!isRelevantHelper() || !node.type().equals(KubevirtNode.Type.GATEWAY)) {
- return;
- }
-
- kubevirtRouterService.floatingIps().forEach(fip -> {
- KubevirtRouter router = kubevirtRouterService.router(fip.routerName());
-
- if (router != null && router.electedGateway() != null) {
- KubevirtNode electedGw = kubevirtNodeService.node(router.electedGateway());
- if (electedGw == null) {
- return;
- }
-
- if (electedGw.hostname().equals(node.hostname())) {
- setFloatingIpRulesForFip(router, fip, electedGw, true);
- }
- }
- });
- }
- }
}
diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtNetworkHandler.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtNetworkHandler.java
index 603a293..f3edd55 100644
--- a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtNetworkHandler.java
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtNetworkHandler.java
@@ -88,12 +88,17 @@
import static org.onosproject.kubevirtnetworking.api.Constants.FORWARDING_TABLE;
import static org.onosproject.kubevirtnetworking.api.Constants.KUBEVIRT_NETWORKING_APP_ID;
import static org.onosproject.kubevirtnetworking.api.Constants.PRE_FLAT_TABLE;
+import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_ARP_DEFAULT_RULE;
import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_ARP_GATEWAY_RULE;
import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_DHCP_RULE;
import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_FORWARDING_RULE;
import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_ICMP_RULE;
import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_INTERNAL_ROUTING_RULE;
+import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_IP_EGRESS_RULE;
+import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_IP_INGRESS_RULE;
import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_TUNNEL_RULE;
+import static org.onosproject.kubevirtnetworking.api.Constants.TENANT_ACL_EGRESS_TABLE;
+import static org.onosproject.kubevirtnetworking.api.Constants.TENANT_ACL_INGRESS_TABLE;
import static org.onosproject.kubevirtnetworking.api.Constants.TENANT_ARP_TABLE;
import static org.onosproject.kubevirtnetworking.api.Constants.TENANT_DHCP_TABLE;
import static org.onosproject.kubevirtnetworking.api.Constants.TENANT_FORWARDING_TABLE;
@@ -219,9 +224,9 @@
private void createBridge(KubevirtNode node, KubevirtNetwork network) {
- Device tunBridge = deviceService.getDevice(network.tenantDeviceId(node.hostname()));
- if (tunBridge != null) {
- log.warn("The tunnel bridge {} already exists at node {}",
+ Device tenantBridge = deviceService.getDevice(network.tenantDeviceId(node.hostname()));
+ if (tenantBridge != null) {
+ log.warn("The tenant bridge {} already exists at node {}",
network.tenantBridgeName(), node.hostname());
setDefaultRulesForTenantNetwork(node, network);
return;
@@ -321,7 +326,8 @@
ifaceConfig.removePatchMode(tunToIntIntf);
}
- private void setArpRulesForTenantNetwork(KubevirtNode node, KubevirtNetwork network) {
+ private void setGatewayArpRulesForTenantNetwork(KubevirtNode node,
+ KubevirtNetwork network) {
KubevirtRouter router = getRouterForKubevirtNetwork(kubevirtRouterService, network);
if (router == null) {
@@ -333,11 +339,12 @@
return;
}
- setGatewayArpRuleForTenantInternalNetwork(router, network, TENANT_ARP_TABLE, electedGw.intgBridge(),
- network.tenantDeviceId(node.hostname()), true);
+ setGatewayArpRuleForTenantInternalNetwork(router, network, TENANT_ARP_TABLE,
+ electedGw.intgBridge(), network.tenantDeviceId(node.hostname()), true);
}
- private void setIcmpRulesForTenantNetwork(KubevirtNode node, KubevirtNetwork network) {
+ private void setGatewayIcmpRulesForTenantNetwork(KubevirtNode node,
+ KubevirtNetwork network) {
KubevirtRouter router = getRouterForKubevirtNetwork(kubevirtRouterService, network);
if (router == null) {
return;
@@ -348,11 +355,12 @@
return;
}
- setGatewayIcmpRuleForTenantInternalNetwork(router, network, TENANT_ICMP_TABLE, electedGw.intgBridge(),
- network.tenantDeviceId(node.hostname()), true);
+ setGatewayIcmpRuleForTenantInternalNetwork(router, network, TENANT_ICMP_TABLE,
+ electedGw.intgBridge(), network.tenantDeviceId(node.hostname()), true);
}
- private void setDefaultGatewayRuleToWorkerNodeWhenNodeCreated(KubevirtNode node, KubevirtNetwork network) {
+ private void setGatewayRuleToWorkerNodeWhenNodeCreated(KubevirtNode node,
+ KubevirtNetwork network) {
KubevirtRouter router = getRouterForKubevirtNetwork(kubevirtRouterService, network);
if (router == null) {
return;
@@ -363,10 +371,12 @@
return;
}
- setDefaultGatewayRuleToWorkerNodeTunBridge(router, network, electedGw.intgBridge(), node, true);
+ setDefaultGatewayRuleToWorkerNodeTunBridge(router, network,
+ electedGw.intgBridge(), node, true);
}
- private void setDefaultRulesForTenantNetwork(KubevirtNode node, KubevirtNetwork network) {
+ private void setDefaultRulesForTenantNetwork(KubevirtNode node,
+ KubevirtNetwork network) {
DeviceId deviceId = network.tenantDeviceId(node.hostname());
while (!deviceService.isAvailable(deviceId)) {
@@ -384,9 +394,14 @@
flowService.connectTables(deviceId, TENANT_ARP_TABLE, TENANT_ICMP_TABLE);
flowService.connectTables(deviceId, TENANT_ICMP_TABLE, TENANT_FORWARDING_TABLE);
+ setArpRuleForTenantNetwork(deviceId, true);
setDhcpRuleForTenantNetwork(deviceId, true);
setForwardingRule(deviceId, true);
+ // security group related rules
+ setTenantIngressTransitionRule(network, network.tenantDeviceId(node.hostname()), true);
+ setEgressTransitionRule(network.tenantDeviceId(node.hostname()), true);
+
log.info("Install default flow rules for tenant bridge {}", network.tenantBridgeName());
}
@@ -436,13 +451,14 @@
case VXLAN:
case GRE:
case GENEVE:
- setDefaultEgressRuleToGatewayNode(router, network, electedGateway.intgBridge(), install);
+ setDefaultEgressRuleToGatewayNode(router, network,
+ electedGateway.intgBridge(), install);
kubevirtNodeService.completeNodes(WORKER).forEach(node -> {
- setGatewayArpRuleForTenantInternalNetwork(router, network, TENANT_ARP_TABLE,
- electedGateway.intgBridge(),
+ setGatewayArpRuleForTenantInternalNetwork(router, network,
+ TENANT_ARP_TABLE, electedGateway.intgBridge(),
network.tenantDeviceId(node.hostname()), install);
- setGatewayIcmpRuleForTenantInternalNetwork(router, network, TENANT_ICMP_TABLE,
- electedGateway.intgBridge(),
+ setGatewayIcmpRuleForTenantInternalNetwork(router, network,
+ TENANT_ICMP_TABLE, electedGateway.intgBridge(),
network.tenantDeviceId(node.hostname()), install);
setDefaultGatewayRuleToWorkerNodeTunBridge(router, network,
electedGateway.intgBridge(), node, install);
@@ -451,11 +467,12 @@
break;
case FLAT:
case VLAN:
- setGatewayArpRuleForProviderInternalNetwork(router, network, PRE_FLAT_TABLE,
- electedGateway.intgBridge(), install);
- setGatewayIcmpRuleForProviderInternalNetwork(router, network, PRE_FLAT_TABLE,
- electedGateway.intgBridge(), install);
- setGatewayProviderInterNetworkRoutingWithinSameRouter(network, router, electedGateway, install);
+ setGatewayArpRuleForProviderInternalNetwork(router, network,
+ PRE_FLAT_TABLE, electedGateway.intgBridge(), install);
+ setGatewayIcmpRuleForProviderInternalNetwork(router, network,
+ PRE_FLAT_TABLE, electedGateway.intgBridge(), install);
+ setGatewayProviderInterNetworkRoutingWithinSameRouter(network,
+ router, electedGateway, install);
break;
default:
// do nothing
@@ -519,6 +536,42 @@
install);
}
+ private void setTenantIngressTransitionRule(KubevirtNetwork network,
+ DeviceId deviceId, boolean install) {
+ TrafficSelector.Builder sBuilder = DefaultTrafficSelector.builder();
+ sBuilder.matchEthType(EthType.EtherType.IPV4.ethType().toShort())
+ .matchInPort(network.tenantToTunnelPort(deviceId));
+
+ TrafficTreatment.Builder tBuilder = DefaultTrafficTreatment.builder();
+ tBuilder.transition(TENANT_ACL_INGRESS_TABLE);
+
+ flowService.setRule(appId,
+ deviceId,
+ sBuilder.build(),
+ tBuilder.build(),
+ PRIORITY_IP_INGRESS_RULE,
+ TENANT_ICMP_TABLE,
+ install
+ );
+ }
+
+ private void setEgressTransitionRule(DeviceId deviceId, boolean install) {
+ TrafficSelector.Builder sBuilder = DefaultTrafficSelector.builder();
+ sBuilder.matchEthType(EthType.EtherType.IPV4.ethType().toShort());
+
+ TrafficTreatment.Builder tBuilder = DefaultTrafficTreatment.builder();
+ tBuilder.transition(TENANT_ACL_EGRESS_TABLE);
+
+ flowService.setRule(appId,
+ deviceId,
+ sBuilder.build(),
+ tBuilder.build(),
+ PRIORITY_IP_EGRESS_RULE,
+ TENANT_ICMP_TABLE,
+ install
+ );
+ }
+
private void setDefaultEgressRuleToGatewayNode(KubevirtRouter router,
KubevirtNetwork network,
DeviceId gwDeviceId,
@@ -610,6 +663,25 @@
install);
}
+ private void setArpRuleForTenantNetwork(DeviceId tenantDeviceId,
+ boolean install) {
+ TrafficSelector.Builder sBuilder = DefaultTrafficSelector.builder()
+ .matchEthType(EthType.EtherType.ARP.ethType().toShort());
+
+ TrafficTreatment.Builder tBuilder = DefaultTrafficTreatment.builder()
+ .transition(TENANT_FORWARDING_TABLE);
+
+ flowService.setRule(
+ appId,
+ tenantDeviceId,
+ sBuilder.build(),
+ tBuilder.build(),
+ PRIORITY_ARP_DEFAULT_RULE,
+ TENANT_ARP_TABLE,
+ install
+ );
+ }
+
private void setGatewayArpRuleForTenantInternalNetwork(KubevirtRouter router,
KubevirtNetwork network,
int tableNum,
@@ -1000,7 +1072,8 @@
});
}
- private void removeDetachedInternalNetworkRules(KubevirtNetwork removedNetwork, KubevirtRouter router,
+ private void removeDetachedInternalNetworkRules(KubevirtNetwork removedNetwork,
+ KubevirtRouter router,
KubevirtNode electedGw) {
router.internal().stream().filter(networkId -> kubevirtNetworkService.network(networkId) != null)
.forEach(networkId -> {
@@ -1213,9 +1286,9 @@
createBridge(node, network);
createPatchTenantInterface(node, network);
setDefaultRulesForTenantNetwork(node, network);
- setArpRulesForTenantNetwork(node, network);
- setIcmpRulesForTenantNetwork(node, network);
- setDefaultGatewayRuleToWorkerNodeWhenNodeCreated(node, network);
+ setGatewayArpRulesForTenantNetwork(node, network);
+ setGatewayIcmpRulesForTenantNetwork(node, network);
+ setGatewayRuleToWorkerNodeWhenNodeCreated(node, network);
break;
case FLAT:
reserveVrouterIp(network);
@@ -1322,7 +1395,8 @@
|| kubevirtNetworkService.network(srcNetwork) == null) {
return;
}
- setGatewayInterNetworkRoutingFromNetworkToPort(router, kubevirtNetworkService.network(srcNetwork),
+ setGatewayInterNetworkRoutingFromNetworkToPort(router,
+ kubevirtNetworkService.network(srcNetwork),
kubevirtPort, gwNode, true);
});
}
@@ -1347,7 +1421,8 @@
|| kubevirtNetworkService.network(srcNetwork) == null) {
return;
}
- setGatewayInterNetworkRoutingFromNetworkToPort(router, kubevirtNetworkService.network(srcNetwork),
+ setGatewayInterNetworkRoutingFromNetworkToPort(router,
+ kubevirtNetworkService.network(srcNetwork),
kubevirtPort, gwNode, true);
});
}
@@ -1372,7 +1447,8 @@
|| kubevirtNetworkService.network(srcNetwork) == null) {
return;
}
- setGatewayInterNetworkRoutingFromNetworkToPort(router, kubevirtNetworkService.network(srcNetwork),
+ setGatewayInterNetworkRoutingFromNetworkToPort(router,
+ kubevirtNetworkService.network(srcNetwork),
kubevirtPort, gwNode, false);
});
}
diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtNetworkManager.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtNetworkManager.java
index 7b40b01..74d317d 100644
--- a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtNetworkManager.java
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtNetworkManager.java
@@ -46,6 +46,9 @@
import static com.google.common.base.Preconditions.checkArgument;
import static com.google.common.base.Preconditions.checkNotNull;
import static org.onosproject.kubevirtnetworking.api.Constants.KUBEVIRT_NETWORKING_APP_ID;
+import static org.onosproject.kubevirtnetworking.api.KubevirtNetwork.Type.GENEVE;
+import static org.onosproject.kubevirtnetworking.api.KubevirtNetwork.Type.GRE;
+import static org.onosproject.kubevirtnetworking.api.KubevirtNetwork.Type.VXLAN;
import static org.slf4j.LoggerFactory.getLogger;
/**
@@ -216,6 +219,15 @@
.filter(n -> n.type() == type).collect(Collectors.toSet()));
}
+ @Override
+ public Set<KubevirtNetwork> tenantNetworks() {
+ return ImmutableSet.copyOf(networkStore.networks().stream()
+ .filter(n -> n.type() == VXLAN ||
+ n.type() == GRE ||
+ n.type() == GENEVE)
+ .collect(Collectors.toSet()));
+ }
+
private class InternalNetworkStorageDelegate implements KubevirtNetworkStoreDelegate {
@Override
diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtRoutingSnatHandler.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtRoutingSnatHandler.java
index a2667f9..9acf35e 100644
--- a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtRoutingSnatHandler.java
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtRoutingSnatHandler.java
@@ -42,8 +42,6 @@
import org.onosproject.kubevirtnetworking.api.KubevirtRouterService;
import org.onosproject.kubevirtnetworking.util.RulePopulatorUtil;
import org.onosproject.kubevirtnode.api.KubevirtNode;
-import org.onosproject.kubevirtnode.api.KubevirtNodeEvent;
-import org.onosproject.kubevirtnode.api.KubevirtNodeListener;
import org.onosproject.kubevirtnode.api.KubevirtNodeService;
import org.onosproject.net.Device;
import org.onosproject.net.PortNumber;
@@ -148,9 +146,6 @@
private final InternalRouterEventListener kubevirtRouterlistener =
new InternalRouterEventListener();
- private final InternalNodeEventListener kubevirtNodeListener =
- new InternalNodeEventListener();
-
private ApplicationId appId;
private NodeId localNodeId;
@@ -162,7 +157,6 @@
kubevirtPortService.addListener(kubevirtPortListener);
kubevirtRouterService.addListener(kubevirtRouterlistener);
- kubevirtNodeService.addListener(kubevirtNodeListener);
log.info("Started");
}
@@ -170,7 +164,6 @@
@Deactivate
protected void deactivate() {
leadershipService.withdraw(appId.name());
- kubevirtNodeService.removeListener(kubevirtNodeListener);
kubevirtPortService.removeListener(kubevirtPortListener);
kubevirtRouterService.removeListener(kubevirtRouterlistener);
@@ -818,12 +811,4 @@
}
}
}
-
- private class InternalNodeEventListener implements KubevirtNodeListener {
-
- @Override
- public void event(KubevirtNodeEvent event) {
-
- }
- }
}
diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtSecurityGroupHandler.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtSecurityGroupHandler.java
new file mode 100644
index 0000000..77b60d9
--- /dev/null
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtSecurityGroupHandler.java
@@ -0,0 +1,1072 @@
+/*
+ * Copyright 2020-present Open Networking Foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.onosproject.kubevirtnetworking.impl;
+
+import com.google.common.collect.Sets;
+import org.onlab.packet.Ethernet;
+import org.onlab.packet.IPv4;
+import org.onlab.packet.Ip4Address;
+import org.onlab.packet.Ip4Prefix;
+import org.onlab.packet.IpPrefix;
+import org.onlab.packet.TpPort;
+import org.onlab.packet.VlanId;
+import org.onlab.util.Tools;
+import org.onosproject.cfg.ComponentConfigService;
+import org.onosproject.cfg.ConfigProperty;
+import org.onosproject.cluster.ClusterService;
+import org.onosproject.cluster.LeadershipService;
+import org.onosproject.cluster.NodeId;
+import org.onosproject.core.ApplicationId;
+import org.onosproject.core.CoreService;
+import org.onosproject.kubevirtnetworking.api.KubevirtFlowRuleService;
+import org.onosproject.kubevirtnetworking.api.KubevirtNetwork;
+import org.onosproject.kubevirtnetworking.api.KubevirtNetwork.Type;
+import org.onosproject.kubevirtnetworking.api.KubevirtNetworkEvent;
+import org.onosproject.kubevirtnetworking.api.KubevirtNetworkListener;
+import org.onosproject.kubevirtnetworking.api.KubevirtNetworkService;
+import org.onosproject.kubevirtnetworking.api.KubevirtPort;
+import org.onosproject.kubevirtnetworking.api.KubevirtPortEvent;
+import org.onosproject.kubevirtnetworking.api.KubevirtPortListener;
+import org.onosproject.kubevirtnetworking.api.KubevirtPortService;
+import org.onosproject.kubevirtnetworking.api.KubevirtSecurityGroup;
+import org.onosproject.kubevirtnetworking.api.KubevirtSecurityGroupEvent;
+import org.onosproject.kubevirtnetworking.api.KubevirtSecurityGroupListener;
+import org.onosproject.kubevirtnetworking.api.KubevirtSecurityGroupRule;
+import org.onosproject.kubevirtnetworking.api.KubevirtSecurityGroupService;
+import org.onosproject.kubevirtnetworking.util.RulePopulatorUtil;
+import org.onosproject.kubevirtnode.api.KubevirtNode;
+import org.onosproject.kubevirtnode.api.KubevirtNodeEvent;
+import org.onosproject.kubevirtnode.api.KubevirtNodeListener;
+import org.onosproject.kubevirtnode.api.KubevirtNodeService;
+import org.onosproject.mastership.MastershipService;
+import org.onosproject.net.DeviceId;
+import org.onosproject.net.device.DeviceService;
+import org.onosproject.net.driver.DriverService;
+import org.onosproject.net.flow.DefaultTrafficSelector;
+import org.onosproject.net.flow.DefaultTrafficTreatment;
+import org.onosproject.net.flow.TrafficSelector;
+import org.onosproject.net.flow.TrafficTreatment;
+import org.onosproject.net.flow.criteria.ExtensionSelector;
+import org.onosproject.net.flow.instructions.ExtensionTreatment;
+import org.onosproject.store.service.StorageService;
+import org.osgi.service.component.ComponentContext;
+import org.osgi.service.component.annotations.Activate;
+import org.osgi.service.component.annotations.Component;
+import org.osgi.service.component.annotations.Deactivate;
+import org.osgi.service.component.annotations.Modified;
+import org.osgi.service.component.annotations.Reference;
+import org.osgi.service.component.annotations.ReferenceCardinality;
+import org.slf4j.Logger;
+
+import java.util.Dictionary;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.concurrent.ExecutorService;
+import java.util.stream.Collectors;
+
+import static java.lang.Thread.sleep;
+import static java.util.concurrent.Executors.newSingleThreadExecutor;
+import static org.onlab.util.Tools.groupedThreads;
+import static org.onosproject.kubevirtnetworking.api.Constants.ERROR_TABLE;
+import static org.onosproject.kubevirtnetworking.api.Constants.KUBEVIRT_NETWORKING_APP_ID;
+import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_ACL_INGRESS_RULE;
+import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_ACL_RULE;
+import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_CT_DROP_RULE;
+import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_CT_HOOK_RULE;
+import static org.onosproject.kubevirtnetworking.api.Constants.PRIORITY_CT_RULE;
+import static org.onosproject.kubevirtnetworking.api.Constants.TENANT_ACL_CT_TABLE;
+import static org.onosproject.kubevirtnetworking.api.Constants.TENANT_ACL_EGRESS_TABLE;
+import static org.onosproject.kubevirtnetworking.api.Constants.TENANT_ACL_INGRESS_TABLE;
+import static org.onosproject.kubevirtnetworking.api.Constants.TENANT_ACL_RECIRC_TABLE;
+import static org.onosproject.kubevirtnetworking.api.Constants.TENANT_FORWARDING_TABLE;
+import static org.onosproject.kubevirtnetworking.api.KubevirtNetwork.Type.GENEVE;
+import static org.onosproject.kubevirtnetworking.api.KubevirtNetwork.Type.GRE;
+import static org.onosproject.kubevirtnetworking.api.KubevirtNetwork.Type.VLAN;
+import static org.onosproject.kubevirtnetworking.api.KubevirtNetwork.Type.VXLAN;
+import static org.onosproject.kubevirtnetworking.impl.OsgiPropertyConstants.USE_SECURITY_GROUP;
+import static org.onosproject.kubevirtnetworking.impl.OsgiPropertyConstants.USE_SECURITY_GROUP_DEFAULT;
+import static org.onosproject.kubevirtnetworking.util.KubevirtNetworkingUtil.getPropertyValueAsBoolean;
+import static org.onosproject.kubevirtnetworking.util.RulePopulatorUtil.buildPortRangeMatches;
+import static org.onosproject.kubevirtnetworking.util.RulePopulatorUtil.computeCtMaskFlag;
+import static org.onosproject.kubevirtnetworking.util.RulePopulatorUtil.computeCtStateFlag;
+import static org.onosproject.kubevirtnetworking.util.RulePopulatorUtil.niciraConnTrackTreatmentBuilder;
+import static org.onosproject.kubevirtnode.api.KubevirtNode.Type.WORKER;
+import static org.slf4j.LoggerFactory.getLogger;
+
+/**
+ * Populates flow rules to handle EdgeStack SecurityGroups.
+ */
+@Component(
+ immediate = true,
+ property = {
+ USE_SECURITY_GROUP + ":Boolean=" + USE_SECURITY_GROUP_DEFAULT
+ }
+)
+public class KubevirtSecurityGroupHandler {
+
+ private final Logger log = getLogger(getClass());
+
+ private static final int VM_IP_PREFIX = 32;
+
+ private static final String STR_NULL = "null";
+ private static final String PROTO_ICMP = "ICMP";
+ private static final String PROTO_ICMP_NUM = "1";
+ private static final String PROTO_TCP = "TCP";
+ private static final String PROTO_TCP_NUM = "6";
+ private static final String PROTO_UDP = "UDP";
+ private static final String PROTO_UDP_NUM = "17";
+ private static final String PROTO_SCTP = "SCTP";
+ private static final String PROTO_SCTP_NUM = "132";
+ private static final byte PROTOCOL_SCTP = (byte) 0x84;
+ private static final String PROTO_ANY = "ANY";
+ private static final String PROTO_ANY_NUM = "0";
+ private static final String ETHTYPE_IPV4 = "IPV4";
+ private static final String EGRESS = "EGRESS";
+ private static final String INGRESS = "INGRESS";
+ private static final IpPrefix IP_PREFIX_ANY = Ip4Prefix.valueOf("0.0.0.0/0");
+
+ private static final int ICMP_CODE_MIN = 0;
+ private static final int ICMP_CODE_MAX = 255;
+ private static final int ICMP_TYPE_MIN = 0;
+ private static final int ICMP_TYPE_MAX = 255;
+
+ private static final int CT_COMMIT = 0;
+ private static final int CT_NO_COMMIT = 1;
+ private static final short CT_NO_RECIRC = -1;
+
+ private static final int ACTION_NONE = 0;
+ private static final int ACTION_DROP = -1;
+
+ private static final long SLEEP_MS = 5000;
+
+ /** Apply EdgeStack security group rule for VM traffic. */
+ private boolean useSecurityGroup = USE_SECURITY_GROUP_DEFAULT;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected CoreService coreService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected MastershipService mastershipService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected DriverService driverService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected DeviceService deviceService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected LeadershipService leadershipService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected ClusterService clusterService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected StorageService storageService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected ComponentConfigService configService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected KubevirtNodeService nodeService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected KubevirtNetworkService networkService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected KubevirtPortService portService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected KubevirtFlowRuleService flowRuleService;
+
+ @Reference(cardinality = ReferenceCardinality.MANDATORY)
+ protected KubevirtSecurityGroupService securityGroupService;
+
+ private final KubevirtPortListener portListener =
+ new InternalKubevirtPortListener();
+ private final KubevirtSecurityGroupListener securityGroupListener =
+ new InternalSecurityGroupListener();
+ private final KubevirtNodeListener nodeListener =
+ new InternalNodeListener();
+ private final KubevirtNetworkListener networkListener =
+ new InternalNetworkListener();
+
+ private final ExecutorService eventExecutor = newSingleThreadExecutor(
+ groupedThreads(this.getClass().getSimpleName(), "event-handler"));
+
+ private ApplicationId appId;
+ private NodeId localNodeId;
+
+ @Activate
+ protected void activate() {
+ appId = coreService.registerApplication(KUBEVIRT_NETWORKING_APP_ID);
+ localNodeId = clusterService.getLocalNode().id();
+ securityGroupService.addListener(securityGroupListener);
+ portService.addListener(portListener);
+ networkService.addListener(networkListener);
+ configService.registerProperties(getClass());
+ nodeService.addListener(nodeListener);
+
+ log.info("Started");
+ }
+
+ @Deactivate
+ protected void deactivate() {
+ securityGroupService.removeListener(securityGroupListener);
+ portService.removeListener(portListener);
+ configService.unregisterProperties(getClass(), false);
+ nodeService.removeListener(nodeListener);
+ networkService.removeListener(networkListener);
+ eventExecutor.shutdown();
+
+ log.info("Stopped");
+ }
+
+ @Modified
+ protected void modified(ComponentContext context) {
+ Dictionary<?, ?> properties = context.getProperties();
+ Boolean flag;
+
+ flag = Tools.isPropertyEnabled(properties, USE_SECURITY_GROUP);
+ if (flag == null) {
+ log.info("useSecurityGroup is not configured, " +
+ "using current value of {}", useSecurityGroup);
+ } else {
+ useSecurityGroup = flag;
+ log.info("Configured. useSecurityGroup is {}",
+ useSecurityGroup ? "enabled" : "disabled");
+ }
+
+ securityGroupService.setSecurityGroupEnabled(useSecurityGroup);
+ resetSecurityGroupRules();
+ }
+
+ private boolean getUseSecurityGroupFlag() {
+ Set<ConfigProperty> properties =
+ configService.getProperties(getClass().getName());
+ return getPropertyValueAsBoolean(properties, USE_SECURITY_GROUP);
+ }
+
+ private void initializeConnTrackTable(DeviceId deviceId, boolean install) {
+
+ // table={ACL_INGRESS_TABLE(44)},ip,ct_state=-trk, actions=ct(table:{ACL_CT_TABLE(45)})
+ long ctState = computeCtStateFlag(false, false, false);
+ long ctMask = computeCtMaskFlag(true, false, false);
+ setConnTrackRule(deviceId, ctState, ctMask, CT_NO_COMMIT, (short) TENANT_ACL_CT_TABLE,
+ ACTION_NONE, PRIORITY_CT_HOOK_RULE, install);
+
+ //table={ACL_CT_TABLE(45)},ip,nw_dst=10.10.0.2,ct_state=+trk+est,action=goto_table:{NORMAL_TABLE(80)}
+ ctState = computeCtStateFlag(true, false, true);
+ ctMask = computeCtMaskFlag(true, false, true);
+ setConnTrackRule(deviceId, ctState, ctMask, CT_NO_COMMIT, CT_NO_RECIRC,
+ TENANT_FORWARDING_TABLE, PRIORITY_CT_RULE, install);
+
+ //table={ACL_CT_TABLE(45)},ip,nw_dst=10.10.0.2,ct_state=+trk+new,action=drop
+ ctState = computeCtStateFlag(true, true, false);
+ ctMask = computeCtMaskFlag(true, true, false);
+ setConnTrackRule(deviceId, ctState, ctMask, CT_NO_COMMIT, CT_NO_RECIRC,
+ ACTION_DROP, PRIORITY_CT_DROP_RULE, install);
+ }
+
+ private void initializeAclTable(DeviceId deviceId, boolean install) {
+
+ ExtensionTreatment ctTreatment =
+ niciraConnTrackTreatmentBuilder(driverService, deviceId)
+ .commit(true)
+ .build();
+
+ TrafficSelector.Builder sBuilder = DefaultTrafficSelector.builder();
+ sBuilder.matchEthType(Ethernet.TYPE_IPV4);
+
+ TrafficTreatment.Builder tBuilder = DefaultTrafficTreatment.builder();
+ tBuilder.extension(ctTreatment, deviceId)
+ .transition(TENANT_FORWARDING_TABLE);
+
+ flowRuleService.setRule(appId,
+ deviceId,
+ sBuilder.build(),
+ tBuilder.build(),
+ PRIORITY_ACL_INGRESS_RULE,
+ TENANT_ACL_RECIRC_TABLE,
+ install);
+ }
+
+ private void initializeEgressTable(DeviceId deviceId, boolean install) {
+ if (install) {
+ flowRuleService.setUpTableMissEntry(deviceId, TENANT_ACL_EGRESS_TABLE);
+ } else {
+ flowRuleService.connectTables(deviceId, TENANT_ACL_EGRESS_TABLE, TENANT_FORWARDING_TABLE);
+ }
+ }
+
+ private void initializeIngressTable(DeviceId deviceId, boolean install) {
+ if (install) {
+ flowRuleService.setUpTableMissEntry(deviceId, TENANT_ACL_INGRESS_TABLE);
+ } else {
+ flowRuleService.connectTables(deviceId, TENANT_ACL_INGRESS_TABLE, TENANT_FORWARDING_TABLE);
+ }
+ }
+
+ private void updateSecurityGroupRule(KubevirtPort port,
+ KubevirtSecurityGroupRule sgRule, boolean install) {
+
+ if (port == null || sgRule == null) {
+ return;
+ }
+
+ if (sgRule.remoteGroupId() != null && !sgRule.remoteGroupId().isEmpty()) {
+ getRemotePorts(port, sgRule.remoteGroupId())
+ .forEach(rPort -> {
+ populateSecurityGroupRule(sgRule, port,
+ rPort.ipAddress().toIpPrefix(), install);
+ populateSecurityGroupRule(sgRule, rPort,
+ port.ipAddress().toIpPrefix(), install);
+
+ KubevirtSecurityGroupRule rSgRule = sgRule.updateDirection(
+ sgRule.direction().equalsIgnoreCase(EGRESS) ? INGRESS : EGRESS);
+ populateSecurityGroupRule(rSgRule, port,
+ rPort.ipAddress().toIpPrefix(), install);
+ populateSecurityGroupRule(rSgRule, rPort,
+ port.ipAddress().toIpPrefix(), install);
+ });
+ } else {
+ populateSecurityGroupRule(sgRule, port,
+ sgRule.remoteIpPrefix() == null ? IP_PREFIX_ANY :
+ sgRule.remoteIpPrefix(), install);
+ }
+ }
+
+ private boolean checkProtocol(String protocol) {
+ if (protocol == null) {
+ log.debug("No protocol was specified, use default IP(v4/v6) protocol.");
+ return true;
+ } else {
+ String protocolUpper = protocol.toUpperCase();
+ if (protocolUpper.equals(PROTO_TCP) ||
+ protocolUpper.equals(PROTO_UDP) ||
+ protocolUpper.equals(PROTO_ICMP) ||
+ protocolUpper.equals(PROTO_SCTP) ||
+ protocolUpper.equals(PROTO_ANY) ||
+ protocol.equals(PROTO_TCP_NUM) ||
+ protocol.equals(PROTO_UDP_NUM) ||
+ protocol.equals(PROTO_ICMP_NUM) ||
+ protocol.equals(PROTO_SCTP_NUM) ||
+ protocol.equals(PROTO_ANY_NUM)) {
+ return true;
+ } else {
+ log.error("Unsupported protocol {}, we only support " +
+ "TCP/UDP/ICMP/SCTP protocols.", protocol);
+ return false;
+ }
+ }
+ }
+
+ private void populateSecurityGroupRule(KubevirtSecurityGroupRule sgRule,
+ KubevirtPort port,
+ IpPrefix remoteIp,
+ boolean install) {
+ if (!checkProtocol(sgRule.protocol())) {
+ return;
+ }
+
+ DeviceId deviceId = port.isTenant() ? port.tenantDeviceId() : port.deviceId();
+
+ Set<TrafficSelector> selectors = buildSelectors(sgRule,
+ Ip4Address.valueOf(port.ipAddress().toInetAddress()),
+ remoteIp, port.networkId());
+ if (selectors == null || selectors.isEmpty()) {
+ return;
+ }
+
+ // if the device is not available we do not perform any action
+ if (deviceId == null || !deviceService.isAvailable(deviceId)) {
+ return;
+ }
+
+ // XXX All egress traffic needs to go through connection tracking module,
+ // which might hurt its performance.
+ ExtensionTreatment ctTreatment =
+ niciraConnTrackTreatmentBuilder(driverService, deviceId)
+ .commit(true)
+ .build();
+
+ TrafficTreatment.Builder tBuilder = DefaultTrafficTreatment.builder();
+
+ int aclTable;
+ if (sgRule.direction().equalsIgnoreCase(EGRESS)) {
+ aclTable = TENANT_ACL_EGRESS_TABLE;
+ tBuilder.transition(TENANT_ACL_RECIRC_TABLE);
+ } else {
+ aclTable = TENANT_ACL_INGRESS_TABLE;
+ tBuilder.extension(ctTreatment, deviceId)
+ .transition(TENANT_FORWARDING_TABLE);
+ }
+
+ int finalAclTable = aclTable;
+ selectors.forEach(selector -> {
+ flowRuleService.setRule(appId,
+ deviceId,
+ selector, tBuilder.build(),
+ PRIORITY_ACL_RULE,
+ finalAclTable,
+ install);
+ });
+ }
+
+ /**
+ * Sets connection tracking rule using OVS extension commands.
+ * It is not so graceful, but I don't want to make it more general because
+ * it is going to be used only here.
+ * The following is the usage of the function.
+ *
+ * @param deviceId Device ID
+ * @param ctState ctState: please use RulePopulatorUtil.computeCtStateFlag()
+ * to build the value
+ * @param ctMask crMask: please use RulePopulatorUtil.computeCtMaskFlag()
+ * to build the value
+ * @param commit CT_COMMIT for commit action, CT_NO_COMMIT otherwise
+ * @param recircTable table number for recirculation after CT actions.
+ * CT_NO_RECIRC with no recirculation
+ * @param action Additional actions. ACTION_DROP, ACTION_NONE,
+ * GOTO_XXX_TABLE are supported.
+ * @param priority priority value for the rule
+ * @param install true for insertion, false for removal
+ */
+ private void setConnTrackRule(DeviceId deviceId, long ctState, long ctMask,
+ int commit, short recircTable,
+ int action, int priority, boolean install) {
+
+ ExtensionSelector esCtSate = RulePopulatorUtil
+ .buildCtExtensionSelector(driverService, deviceId, ctState, ctMask);
+ TrafficSelector selector = DefaultTrafficSelector.builder()
+ .extension(esCtSate, deviceId)
+ .matchEthType(Ethernet.TYPE_IPV4)
+ .build();
+
+ TrafficTreatment.Builder tb = DefaultTrafficTreatment.builder();
+
+ if (commit == CT_COMMIT || recircTable > 0) {
+ RulePopulatorUtil.NiciraConnTrackTreatmentBuilder natTreatmentBuilder =
+ niciraConnTrackTreatmentBuilder(driverService, deviceId);
+ natTreatmentBuilder.natAction(false);
+ natTreatmentBuilder.commit(commit == CT_COMMIT);
+ if (recircTable > 0) {
+ natTreatmentBuilder.table(recircTable);
+ }
+ tb.extension(natTreatmentBuilder.build(), deviceId);
+ } else if (action == ACTION_DROP) {
+ tb.drop();
+ }
+
+ if (action != ACTION_NONE && action != ACTION_DROP) {
+ tb.transition(action);
+ }
+
+ int tableType = ERROR_TABLE;
+ if (priority == PRIORITY_CT_RULE || priority == PRIORITY_CT_DROP_RULE) {
+ tableType = TENANT_ACL_CT_TABLE;
+ } else if (priority == PRIORITY_CT_HOOK_RULE) {
+ tableType = TENANT_ACL_INGRESS_TABLE;
+ } else {
+ log.error("Cannot an appropriate table for the conn track rule.");
+ }
+
+ flowRuleService.setRule(
+ appId,
+ deviceId,
+ selector,
+ tb.build(),
+ priority,
+ tableType,
+ install);
+ }
+
+ /**
+ * Returns a set of host IP addresses engaged with supplied security group ID.
+ * It only searches a VM in the same tenant boundary.
+ *
+ * @param srcPort edgestack port
+ * @param sgId security group id
+ * @return set of ip addresses
+ */
+ private Set<KubevirtPort> getRemotePorts(KubevirtPort srcPort, String sgId) {
+ return portService.ports().stream()
+ .filter(port -> !port.macAddress().equals(srcPort.macAddress()))
+ .filter(port -> port.securityGroups().contains(sgId))
+ .filter(port -> port.ipAddress() != null)
+ .collect(Collectors.toSet());
+ }
+
+ private Set<TrafficSelector> buildSelectors(KubevirtSecurityGroupRule sgRule,
+ Ip4Address vmIp,
+ IpPrefix remoteIp,
+ String netId) {
+ if (remoteIp != null && remoteIp.equals(IpPrefix.valueOf(vmIp, VM_IP_PREFIX))) {
+ // do nothing if the remote IP is my IP
+ return null;
+ }
+
+ Set<TrafficSelector> selectorSet = Sets.newHashSet();
+
+ if (sgRule.portRangeMax() != null && sgRule.portRangeMin() != null &&
+ sgRule.portRangeMin() < sgRule.portRangeMax()) {
+ Map<TpPort, TpPort> portRangeMatchMap =
+ buildPortRangeMatches(sgRule.portRangeMin(),
+ sgRule.portRangeMax());
+ portRangeMatchMap.forEach((key, value) -> {
+
+ TrafficSelector.Builder sBuilder = DefaultTrafficSelector.builder();
+ buildMatches(sBuilder, sgRule, vmIp, remoteIp, netId);
+
+ if (sgRule.protocol().equalsIgnoreCase(PROTO_TCP) ||
+ sgRule.protocol().equals(PROTO_TCP_NUM)) {
+ if (sgRule.direction().equalsIgnoreCase(EGRESS)) {
+ if (value.toInt() == TpPort.MAX_PORT) {
+ sBuilder.matchTcpSrc(key);
+ } else {
+ sBuilder.matchTcpSrcMasked(key, value);
+ }
+ } else {
+ if (value.toInt() == TpPort.MAX_PORT) {
+ sBuilder.matchTcpDst(key);
+ } else {
+ sBuilder.matchTcpDstMasked(key, value);
+ }
+ }
+ } else if (sgRule.protocol().equalsIgnoreCase(PROTO_UDP) ||
+ sgRule.protocol().equals(PROTO_UDP_NUM)) {
+ if (sgRule.direction().equalsIgnoreCase(EGRESS)) {
+ if (value.toInt() == TpPort.MAX_PORT) {
+ sBuilder.matchUdpSrc(key);
+ } else {
+ sBuilder.matchUdpSrcMasked(key, value);
+ }
+ } else {
+ if (value.toInt() == TpPort.MAX_PORT) {
+ sBuilder.matchUdpDst(key);
+ } else {
+ sBuilder.matchUdpDstMasked(key, value);
+ }
+ }
+ } else if (sgRule.protocol().equalsIgnoreCase(PROTO_SCTP) ||
+ sgRule.protocol().equals(PROTO_SCTP_NUM)) {
+ if (sgRule.direction().equalsIgnoreCase(EGRESS)) {
+ if (value.toInt() == TpPort.MAX_PORT) {
+ sBuilder.matchSctpSrc(key);
+ } else {
+ sBuilder.matchSctpSrcMasked(key, value);
+ }
+ } else {
+ if (value.toInt() == TpPort.MAX_PORT) {
+ sBuilder.matchSctpDst(key);
+ } else {
+ sBuilder.matchSctpDstMasked(key, value);
+ }
+ }
+ }
+
+ selectorSet.add(sBuilder.build());
+ });
+ } else {
+
+ TrafficSelector.Builder sBuilder = DefaultTrafficSelector.builder();
+ buildMatches(sBuilder, sgRule, vmIp, remoteIp, netId);
+
+ selectorSet.add(sBuilder.build());
+ }
+
+ return selectorSet;
+ }
+
+ private void buildMatches(TrafficSelector.Builder sBuilder,
+ KubevirtSecurityGroupRule sgRule, Ip4Address vmIp,
+ IpPrefix remoteIp, String netId) {
+ buildTunnelId(sBuilder, netId);
+ buildMatchEthType(sBuilder, sgRule.etherType());
+ buildMatchDirection(sBuilder, sgRule.direction(), vmIp);
+ buildMatchProto(sBuilder, sgRule.protocol());
+ buildMatchPort(sBuilder, sgRule.protocol(), sgRule.direction(),
+ sgRule.portRangeMin() == null ? 0 : sgRule.portRangeMin(),
+ sgRule.portRangeMax() == null ? 0 : sgRule.portRangeMax());
+ buildMatchIcmp(sBuilder, sgRule.protocol(),
+ sgRule.portRangeMin(), sgRule.portRangeMax());
+ buildMatchRemoteIp(sBuilder, remoteIp, sgRule.direction());
+ }
+
+ private void buildTunnelId(TrafficSelector.Builder sBuilder, String netId) {
+ KubevirtNetwork network = networkService.network(netId);
+
+ if (network == null) {
+ log.warn("Network {} not found!", netId);
+ return;
+ }
+
+ String segId = network.segmentId();
+ Type netType = network.type();
+
+ if (netType == VLAN) {
+ sBuilder.matchVlanId(VlanId.vlanId(segId));
+ } else if (netType == VXLAN || netType == GRE || netType == GENEVE) {
+ // sBuilder.matchTunnelId(Long.parseLong(segId));
+ log.trace("{} typed match rules are installed for security group", netType);
+ } else {
+ log.debug("Cannot tag the VID as it is unsupported vnet type {}", netType);
+ }
+
+
+ }
+
+ private void buildMatchDirection(TrafficSelector.Builder sBuilder,
+ String direction,
+ Ip4Address vmIp) {
+ if (direction.equalsIgnoreCase(EGRESS)) {
+ sBuilder.matchIPSrc(IpPrefix.valueOf(vmIp, VM_IP_PREFIX));
+ } else {
+ sBuilder.matchIPDst(IpPrefix.valueOf(vmIp, VM_IP_PREFIX));
+ }
+ }
+
+ private void buildMatchEthType(TrafficSelector.Builder sBuilder, String etherType) {
+ // Either IpSrc or IpDst (or both) is set by default, and we need to set EthType as IPv4.
+ sBuilder.matchEthType(Ethernet.TYPE_IPV4);
+ if (etherType != null && !Objects.equals(etherType, STR_NULL) &&
+ !etherType.equalsIgnoreCase(ETHTYPE_IPV4)) {
+ log.debug("EthType {} is not supported yet in Security Group", etherType);
+ }
+ }
+
+ private void buildMatchRemoteIp(TrafficSelector.Builder sBuilder,
+ IpPrefix remoteIpPrefix, String direction) {
+ if (remoteIpPrefix != null &&
+ !remoteIpPrefix.getIp4Prefix().equals(IP_PREFIX_ANY)) {
+ if (direction.equalsIgnoreCase(EGRESS)) {
+ sBuilder.matchIPDst(remoteIpPrefix);
+ } else {
+ sBuilder.matchIPSrc(remoteIpPrefix);
+ }
+ }
+ }
+
+ private void buildMatchProto(TrafficSelector.Builder sBuilder, String protocol) {
+ if (protocol != null) {
+ switch (protocol.toUpperCase()) {
+ case PROTO_ICMP:
+ case PROTO_ICMP_NUM:
+ sBuilder.matchIPProtocol(IPv4.PROTOCOL_ICMP);
+ break;
+ case PROTO_TCP:
+ case PROTO_TCP_NUM:
+ sBuilder.matchIPProtocol(IPv4.PROTOCOL_TCP);
+ break;
+ case PROTO_UDP:
+ case PROTO_UDP_NUM:
+ sBuilder.matchIPProtocol(IPv4.PROTOCOL_UDP);
+ break;
+ case PROTO_SCTP:
+ case PROTO_SCTP_NUM:
+ sBuilder.matchIPProtocol(PROTOCOL_SCTP);
+ break;
+ default:
+ break;
+ }
+ }
+ }
+
+ private void buildMatchPort(TrafficSelector.Builder sBuilder,
+ String protocol, String direction,
+ int portMin, int portMax) {
+ if (portMax > 0 && portMin == portMax) {
+ if (protocol.equalsIgnoreCase(PROTO_TCP) ||
+ protocol.equals(PROTO_TCP_NUM)) {
+ if (direction.equalsIgnoreCase(EGRESS)) {
+ sBuilder.matchTcpSrc(TpPort.tpPort(portMax));
+ } else {
+ sBuilder.matchTcpDst(TpPort.tpPort(portMax));
+ }
+ } else if (protocol.equalsIgnoreCase(PROTO_UDP) ||
+ protocol.equals(PROTO_UDP_NUM)) {
+ if (direction.equalsIgnoreCase(EGRESS)) {
+ sBuilder.matchUdpSrc(TpPort.tpPort(portMax));
+ } else {
+ sBuilder.matchUdpDst(TpPort.tpPort(portMax));
+ }
+ } else if (protocol.equalsIgnoreCase(PROTO_SCTP) ||
+ protocol.equals(PROTO_SCTP_NUM)) {
+ if (direction.equalsIgnoreCase(EGRESS)) {
+ sBuilder.matchSctpSrc(TpPort.tpPort(portMax));
+ } else {
+ sBuilder.matchSctpDst(TpPort.tpPort(portMax));
+ }
+ }
+ }
+ }
+
+ private void buildMatchIcmp(TrafficSelector.Builder sBuilder,
+ String protocol, Integer icmpCode, Integer icmpType) {
+ if (protocol != null) {
+ if (protocol.equalsIgnoreCase(PROTO_ICMP) ||
+ protocol.equals(PROTO_ICMP_NUM)) {
+ if (icmpCode != null && icmpCode >= ICMP_CODE_MIN &&
+ icmpCode <= ICMP_CODE_MAX) {
+ sBuilder.matchIcmpCode(icmpCode.byteValue());
+ }
+ if (icmpType != null && icmpType >= ICMP_TYPE_MIN &&
+ icmpType <= ICMP_TYPE_MAX) {
+ sBuilder.matchIcmpType(icmpType.byteValue());
+ }
+ }
+ }
+ }
+
+ private void resetSecurityGroupRules() {
+
+ if (getUseSecurityGroupFlag()) {
+ nodeService.completeNodes(WORKER).forEach(node -> {
+ initializeEgressTable(node.intgBridge(), true);
+ initializeConnTrackTable(node.intgBridge(), true);
+ initializeAclTable(node.intgBridge(), true);
+ initializeIngressTable(node.intgBridge(), true);
+
+ for (KubevirtNetwork network : networkService.tenantNetworks()) {
+ initializeEgressTable(network.tenantDeviceId(node.hostname()), true);
+ initializeIngressTable(network.tenantDeviceId(node.hostname()), true);
+ initializeConnTrackTable(network.tenantDeviceId(node.hostname()), true);
+ initializeAclTable(network.tenantDeviceId(node.hostname()), true);
+ }
+ });
+
+ securityGroupService.securityGroups().forEach(securityGroup ->
+ securityGroup.rules().forEach(this::securityGroupRuleAdded));
+ } else {
+ nodeService.completeNodes(WORKER).forEach(node -> {
+ initializeEgressTable(node.intgBridge(), false);
+ initializeConnTrackTable(node.intgBridge(), false);
+ initializeAclTable(node.intgBridge(), false);
+ initializeIngressTable(node.intgBridge(), false);
+
+ for (KubevirtNetwork network : networkService.tenantNetworks()) {
+ initializeEgressTable(network.tenantDeviceId(node.hostname()), false);
+ initializeIngressTable(network.tenantDeviceId(node.hostname()), false);
+ initializeConnTrackTable(network.tenantDeviceId(node.hostname()), false);
+ initializeAclTable(network.tenantDeviceId(node.hostname()), false);
+ }
+ });
+
+ securityGroupService.securityGroups().forEach(securityGroup ->
+ securityGroup.rules().forEach(this::securityGroupRuleRemoved));
+ }
+
+ log.info("Reset security group info " +
+ (getUseSecurityGroupFlag() ? "with" : "without") + " Security Group");
+ }
+
+ private void securityGroupRuleAdded(KubevirtSecurityGroupRule sgRule) {
+ portService.ports().stream()
+ .filter(port -> port.securityGroups().contains(sgRule.securityGroupId()))
+ .forEach(port -> {
+ updateSecurityGroupRule(port, sgRule, true);
+ log.info("Applied security group rule {} to port {}",
+ sgRule.id(), port.macAddress());
+ });
+ }
+
+ private void securityGroupRuleRemoved(KubevirtSecurityGroupRule sgRule) {
+ portService.ports().stream()
+ .filter(port -> port.securityGroups().contains(sgRule.securityGroupId()))
+ .forEach(port -> {
+ updateSecurityGroupRule(port, sgRule, false);
+ log.info("Removed security group rule {} from port {}",
+ sgRule.id(), port.macAddress());
+ });
+ }
+
+ private class InternalKubevirtPortListener implements KubevirtPortListener {
+
+ @Override
+ public boolean isRelevant(KubevirtPortEvent event) {
+ return getUseSecurityGroupFlag();
+ }
+
+ private boolean isRelevantHelper(KubevirtPortEvent event) {
+ DeviceId deviceId = event.subject().deviceId();
+
+ if (deviceId == null) {
+ return false;
+ }
+
+ return mastershipService.isLocalMaster(deviceId);
+ }
+
+ @Override
+ public void event(KubevirtPortEvent event) {
+ log.debug("security group event received {}", event);
+
+ switch (event.type()) {
+ case KUBEVIRT_PORT_SECURITY_GROUP_ADDED:
+ eventExecutor.execute(() -> processPortSgAdd(event));
+ break;
+ case KUBEVIRT_PORT_SECURITY_GROUP_REMOVED:
+ eventExecutor.execute(() -> processPortSgRemove(event));
+ break;
+ case KUBEVIRT_PORT_REMOVED:
+ eventExecutor.execute(() -> processPortRemove(event));
+ break;
+ case KUBEVIRT_PORT_DEVICE_ADDED:
+ eventExecutor.execute(() -> processPortDeviceAdded(event));
+ break;
+ default:
+ // do nothing for the other events
+ break;
+ }
+ }
+
+ private void processPortSgAdd(KubevirtPortEvent event) {
+ if (!isRelevantHelper(event)) {
+ return;
+ }
+
+ if (event.securityGroupId() == null ||
+ securityGroupService.securityGroup(event.securityGroupId()) == null) {
+ return;
+ }
+
+ KubevirtPort port = event.subject();
+ KubevirtSecurityGroup sg = securityGroupService.securityGroup(event.securityGroupId());
+
+ sg.rules().forEach(sgRule -> {
+ updateSecurityGroupRule(port, sgRule, true);
+ });
+ log.info("Added security group {} to port {}",
+ event.securityGroupId(), event.subject().macAddress());
+ }
+
+ private void processPortSgRemove(KubevirtPortEvent event) {
+ if (!isRelevantHelper(event)) {
+ return;
+ }
+
+ if (event.securityGroupId() == null ||
+ securityGroupService.securityGroup(event.securityGroupId()) == null) {
+ return;
+ }
+
+ KubevirtPort port = event.subject();
+ KubevirtSecurityGroup sg = securityGroupService.securityGroup(event.securityGroupId());
+
+ sg.rules().forEach(sgRule -> {
+ updateSecurityGroupRule(port, sgRule, false);
+ });
+ log.info("Removed security group {} from port {}",
+ event.securityGroupId(), event.subject().macAddress());
+ }
+
+ private void processPortRemove(KubevirtPortEvent event) {
+ if (!isRelevantHelper(event)) {
+ return;
+ }
+
+ KubevirtPort port = event.subject();
+ for (String sgStr : port.securityGroups()) {
+ KubevirtSecurityGroup sg = securityGroupService.securityGroup(sgStr);
+ sg.rules().forEach(sgRule -> {
+ updateSecurityGroupRule(port, sgRule, false);
+ });
+ log.info("Removed security group {} from port {}",
+ sgStr, event.subject().macAddress());
+ }
+ }
+
+ private void processPortDeviceAdded(KubevirtPortEvent event) {
+ if (!isRelevantHelper(event)) {
+ return;
+ }
+
+ for (String sgId : event.subject().securityGroups()) {
+ KubevirtSecurityGroup sg = securityGroupService.securityGroup(sgId);
+
+ sg.rules().forEach(sgRule -> {
+ updateSecurityGroupRule(event.subject(), sgRule, true);
+ });
+ log.info("Added security group {} to port {}",
+ event.securityGroupId(), event.subject().macAddress());
+ }
+ }
+ }
+
+ private class InternalNetworkListener implements KubevirtNetworkListener {
+
+ private boolean isRelevantHelper() {
+ return Objects.equals(localNodeId, leadershipService.getLeader(appId.name()));
+ }
+
+ @Override
+ public void event(KubevirtNetworkEvent event) {
+ switch (event.type()) {
+ case KUBEVIRT_NETWORK_CREATED:
+ eventExecutor.execute(() -> processNetworkCreation(event.subject()));
+ break;
+ case KUBEVIRT_NETWORK_REMOVED:
+ case KUBEVIRT_NETWORK_UPDATED:
+ default:
+ // do thing
+ break;
+ }
+ }
+
+ private void processNetworkCreation(KubevirtNetwork network) {
+ if (!isRelevantHelper()) {
+ return;
+ }
+
+ Set<KubevirtNode> nodes = nodeService.completeNodes(WORKER);
+
+ if (nodes.size() > 0) {
+ // now we wait 5s for all tenant bridges are created,
+ // FIXME: we need to fina a better way to wait all tenant bridges
+ // are created before installing default security group rules
+ try {
+ sleep(SLEEP_MS);
+ } catch (InterruptedException e) {
+ log.error("Failed to install security group default rules.");
+ }
+
+ for (KubevirtNode node : nodes) {
+ initializeEgressTable(network.tenantDeviceId(node.hostname()), true);
+ initializeIngressTable(network.tenantDeviceId(node.hostname()), true);
+ initializeConnTrackTable(network.tenantDeviceId(node.hostname()), true);
+ initializeAclTable(network.tenantDeviceId(node.hostname()), true);
+ }
+ }
+ }
+ }
+
+ private class InternalSecurityGroupListener implements KubevirtSecurityGroupListener {
+
+ @Override
+ public boolean isRelevant(KubevirtSecurityGroupEvent event) {
+ return getUseSecurityGroupFlag();
+ }
+
+ private boolean isRelevantHelper() {
+ return Objects.equals(localNodeId, leadershipService.getLeader(appId.name()));
+ }
+
+ @Override
+ public void event(KubevirtSecurityGroupEvent event) {
+ switch (event.type()) {
+ case KUBEVIRT_SECURITY_GROUP_RULE_CREATED:
+ eventExecutor.execute(() -> processSgRuleCreate(event));
+ break;
+ case KUBEVIRT_SECURITY_GROUP_RULE_REMOVED:
+ eventExecutor.execute(() -> processSgRuleRemove(event));
+ break;
+ default:
+ // do nothing
+ break;
+ }
+ }
+
+ private void processSgRuleCreate(KubevirtSecurityGroupEvent event) {
+ if (!isRelevantHelper()) {
+ return;
+ }
+
+ KubevirtSecurityGroupRule sgRuleToAdd = event.rule();
+ securityGroupRuleAdded(sgRuleToAdd);
+ log.info("Applied new security group rule {} to ports", sgRuleToAdd.id());
+ }
+
+ private void processSgRuleRemove(KubevirtSecurityGroupEvent event) {
+ if (!isRelevantHelper()) {
+ return;
+ }
+
+ KubevirtSecurityGroupRule sgRuleToRemove = event.rule();
+ securityGroupRuleRemoved(sgRuleToRemove);
+ log.info("Removed security group rule {} from ports", sgRuleToRemove.id());
+ }
+ }
+
+ private class InternalNodeListener implements KubevirtNodeListener {
+
+ @Override
+ public boolean isRelevant(KubevirtNodeEvent event) {
+ return event.subject().type() == WORKER;
+ }
+
+ private boolean isRelevantHelper() {
+ return Objects.equals(localNodeId, leadershipService.getLeader(appId.name()));
+ }
+
+ @Override
+ public void event(KubevirtNodeEvent event) {
+ switch (event.type()) {
+ case KUBEVIRT_NODE_COMPLETE:
+ eventExecutor.execute(() -> processNodeComplete(event.subject()));
+ break;
+ default:
+ break;
+ }
+ }
+
+ private void processNodeComplete(KubevirtNode node) {
+ if (!isRelevantHelper()) {
+ return;
+ }
+
+ resetSecurityGroupRulesByNode(node);
+ }
+
+ private void resetSecurityGroupRulesByNode(KubevirtNode node) {
+ if (getUseSecurityGroupFlag()) {
+ initializeEgressTable(node.intgBridge(), true);
+ initializeConnTrackTable(node.intgBridge(), true);
+ initializeAclTable(node.intgBridge(), true);
+ initializeIngressTable(node.intgBridge(), true);
+
+ for (KubevirtNetwork network : networkService.tenantNetworks()) {
+ initializeEgressTable(network.tenantDeviceId(node.hostname()), true);
+ initializeIngressTable(network.tenantDeviceId(node.hostname()), true);
+ initializeConnTrackTable(network.tenantDeviceId(node.hostname()), true);
+ initializeAclTable(network.tenantDeviceId(node.hostname()), true);
+ }
+
+ securityGroupService.securityGroups().forEach(securityGroup ->
+ securityGroup.rules().forEach(
+ KubevirtSecurityGroupHandler.this::securityGroupRuleAdded));
+ } else {
+ initializeEgressTable(node.intgBridge(), false);
+ initializeConnTrackTable(node.intgBridge(), false);
+ initializeAclTable(node.intgBridge(), false);
+ initializeIngressTable(node.intgBridge(), false);
+
+ for (KubevirtNetwork network : networkService.tenantNetworks()) {
+ initializeEgressTable(network.tenantDeviceId(node.hostname()), false);
+ initializeIngressTable(network.tenantDeviceId(node.hostname()), false);
+ initializeConnTrackTable(network.tenantDeviceId(node.hostname()), false);
+ initializeAclTable(network.tenantDeviceId(node.hostname()), false);
+ }
+
+ securityGroupService.securityGroups().forEach(securityGroup ->
+ securityGroup.rules().forEach(
+ KubevirtSecurityGroupHandler.this::securityGroupRuleRemoved));
+ }
+
+ log.info("Reset security group info " +
+ (getUseSecurityGroupFlag() ? "with" : "without") + " Security Group");
+ }
+ }
+}
\ No newline at end of file
diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtVmWatcher.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtVmWatcher.java
index 61b9be0..308707e 100644
--- a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtVmWatcher.java
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/KubevirtVmWatcher.java
@@ -87,6 +87,8 @@
private static final String DOMAIN = "domain";
private static final String DEVICES = "devices";
private static final String INTERFACES = "interfaces";
+ private static final String NETWORK_POLICIES = "networkPolicies";
+ private static final String SECURITY_GROUPS = "securityGroups";
private static final String NAME = "name";
private static final String NETWORK = "network";
private static final String MAC = "macAddress";
@@ -211,6 +213,9 @@
case DELETED:
eventExecutor.execute(() -> processDeletion(resource));
break;
+ case MODIFIED:
+ eventExecutor.execute(() -> processModification(resource));
+ break;
case ERROR:
log.warn("Failures processing VM manipulation.");
break;
@@ -238,6 +243,9 @@
String name = parseResourceName(resource);
+ Set<String> sgs = parseSecurityGroups(resource);
+ port = port.updateSecurityGroups(sgs);
+
Map<String, IpAddress> ips = parseIpAddresses(resource);
IpAddress ip;
IpAddress existingIp = ips.get(port.networkId());
@@ -303,6 +311,28 @@
});
}
+ private void processModification(String resource) {
+ if (!isMaster()) {
+ return;
+ }
+
+ parseMacAddresses(resource).forEach((mac, net) -> {
+ KubevirtPort port = DefaultKubevirtPort.builder()
+ .macAddress(mac)
+ .networkId(net)
+ .build();
+
+ KubevirtPort existing = portAdminService.port(port.macAddress());
+
+ if (existing == null) {
+ return;
+ }
+
+ Set<String> sgs = parseSecurityGroups(resource);
+ portAdminService.updatePort(existing.updateSecurityGroups(sgs));
+ });
+ }
+
private void processDeletion(String resource) {
if (!isMaster()) {
return;
@@ -410,6 +440,37 @@
return null;
}
+ private Set<String> parseSecurityGroups(String resource) {
+ try {
+ ObjectMapper mapper = new ObjectMapper();
+ JsonNode json = mapper.readTree(resource);
+ JsonNode metadata = json.get(SPEC).get(TEMPLATE).get(METADATA);
+
+ JsonNode annots = metadata.get(ANNOTATIONS);
+ if (annots == null) {
+ return new HashSet<>();
+ }
+
+ JsonNode sgsJson = annots.get(SECURITY_GROUPS);
+ if (sgsJson == null) {
+ return new HashSet<>();
+ }
+
+ Set<String> result = new HashSet<>();
+ ArrayNode sgs = (ArrayNode) mapper.readTree(sgsJson.asText());
+ for (JsonNode sg : sgs) {
+ result.add(sg.asText());
+ }
+
+ return result;
+
+ } catch (IOException e) {
+ log.error("Failed to parse kubevirt security group IDs.");
+ }
+
+ return new HashSet<>();
+ }
+
private Map<MacAddress, String> parseMacAddresses(String resource) {
try {
ObjectMapper mapper = new ObjectMapper();
diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/OsgiPropertyConstants.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/OsgiPropertyConstants.java
index 68b15ea..5d5742b 100644
--- a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/OsgiPropertyConstants.java
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/impl/OsgiPropertyConstants.java
@@ -28,4 +28,7 @@
static final String DHCP_SERVER_MAC = "dhcpServerMac";
static final String DHCP_SERVER_MAC_DEFAULT = "fe:00:00:00:00:02";
+
+ static final String USE_SECURITY_GROUP = "useSecurityGroup";
+ static final boolean USE_SECURITY_GROUP_DEFAULT = true;
}
diff --git a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/util/RulePopulatorUtil.java b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/util/RulePopulatorUtil.java
index 610066f..304e9b6 100644
--- a/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/util/RulePopulatorUtil.java
+++ b/apps/kubevirt-networking/app/src/main/java/org/onosproject/kubevirtnetworking/util/RulePopulatorUtil.java
@@ -15,15 +15,19 @@
*/
package org.onosproject.kubevirtnetworking.util;
+import com.google.common.collect.Maps;
import org.onlab.packet.Ip4Address;
import org.onlab.packet.IpAddress;
import org.onlab.packet.TpPort;
import org.onosproject.net.Device;
import org.onosproject.net.DeviceId;
+import org.onosproject.net.behaviour.ExtensionSelectorResolver;
import org.onosproject.net.behaviour.ExtensionTreatmentResolver;
import org.onosproject.net.device.DeviceService;
import org.onosproject.net.driver.DriverHandler;
import org.onosproject.net.driver.DriverService;
+import org.onosproject.net.flow.criteria.ExtensionSelector;
+import org.onosproject.net.flow.criteria.ExtensionSelectorType;
import org.onosproject.net.flow.instructions.ExtensionPropertyException;
import org.onosproject.net.flow.instructions.ExtensionTreatment;
import org.onosproject.net.flow.instructions.ExtensionTreatmentType;
@@ -31,6 +35,8 @@
import java.util.ArrayList;
import java.util.List;
+import java.util.Map;
+import java.util.Objects;
import static org.onosproject.net.flow.instructions.ExtensionTreatmentType.ExtensionTreatmentTypes.NICIRA_LOAD;
import static org.onosproject.net.flow.instructions.ExtensionTreatmentType.ExtensionTreatmentTypes.NICIRA_MOV_ARP_SHA_TO_THA;
@@ -257,6 +263,185 @@
}
}
+
+ /**
+ * Builds OVS ConnTrack matches.
+ *
+ * @param driverService driver service
+ * @param deviceId device ID
+ * @param ctState connection tracking sate masking value
+ * @param ctSateMask connection tracking sate masking value
+ * @return OVS ConnTrack extension match
+ */
+ public static ExtensionSelector buildCtExtensionSelector(DriverService driverService,
+ DeviceId deviceId,
+ long ctState,
+ long ctSateMask) {
+ DriverHandler handler = driverService.createHandler(deviceId);
+ ExtensionSelectorResolver esr = handler.behaviour(ExtensionSelectorResolver.class);
+
+ ExtensionSelector extensionSelector = esr.getExtensionSelector(
+ ExtensionSelectorType.ExtensionSelectorTypes.NICIRA_MATCH_CONNTRACK_STATE.type());
+ try {
+ extensionSelector.setPropertyValue(CT_STATE, ctState);
+ extensionSelector.setPropertyValue(CT_STATE_MASK, ctSateMask);
+ } catch (Exception e) {
+ log.error("Failed to set nicira match CT state because of {}", e);
+ return null;
+ }
+
+ return extensionSelector;
+ }
+
+ /**
+ * Computes ConnTack State flag values.
+ *
+ * @param isTracking true for +trk, false for -trk
+ * @param isNew true for +new, false for nothing
+ * @param isEstablished true for +est, false for nothing
+ * @return ConnTrack State flags
+ */
+ public static long computeCtStateFlag(boolean isTracking,
+ boolean isNew,
+ boolean isEstablished) {
+ long ctMaskFlag = 0x00;
+
+ if (isTracking) {
+ ctMaskFlag = ctMaskFlag | CT_STATE_TRK;
+ }
+
+ if (isNew) {
+ ctMaskFlag = ctMaskFlag | CT_STATE_TRK;
+ ctMaskFlag = ctMaskFlag | CT_STATE_NEW;
+ }
+
+ if (isEstablished) {
+ ctMaskFlag = ctMaskFlag | CT_STATE_TRK;
+ ctMaskFlag = ctMaskFlag | CT_STATE_EST;
+ }
+
+ return ctMaskFlag;
+ }
+
+ /**
+ * Computes ConnTrack State mask values.
+ *
+ * @param isTracking true for setting +trk/-trk value, false for otherwise
+ * @param isNew true for setting +new value, false for otherwise
+ * @param isEstablished true for setting +est value, false for otherwise
+ * @return ConnTrack State Mask value
+ */
+ public static long computeCtMaskFlag(boolean isTracking,
+ boolean isNew,
+ boolean isEstablished) {
+ long ctMaskFlag = 0x00;
+
+ if (isTracking) {
+ ctMaskFlag = ctMaskFlag | CT_STATE_TRK;
+ }
+
+ if (isNew) {
+ ctMaskFlag = ctMaskFlag | CT_STATE_TRK;
+ ctMaskFlag = ctMaskFlag | CT_STATE_NEW;
+ }
+
+ if (isEstablished) {
+ ctMaskFlag = ctMaskFlag | CT_STATE_TRK;
+ ctMaskFlag = ctMaskFlag | CT_STATE_EST;
+ }
+
+ return ctMaskFlag;
+ }
+
+ /**
+ * Computes port and port mask value from port min/max values.
+ *
+ * @param portMin port min value
+ * @param portMax port max value
+ * @return Port Mask value
+ */
+ public static Map<TpPort, TpPort> buildPortRangeMatches(int portMin, int portMax) {
+
+ boolean processing = true;
+ int start = portMin;
+ Map<TpPort, TpPort> portMaskMap = Maps.newHashMap();
+ while (processing) {
+ String minStr = Integer.toBinaryString(start);
+ String binStrMinPadded = STR_PADDING.substring(minStr.length()) + minStr;
+
+ int mask = testMasks(binStrMinPadded, start, portMax);
+ int maskStart = binLower(binStrMinPadded, mask);
+ int maskEnd = binHigher(binStrMinPadded, mask);
+
+ log.debug("start : {} port/mask = {} / {} ", start, getMask(mask), maskStart);
+ portMaskMap.put(TpPort.tpPort(maskStart), TpPort.tpPort(
+ Integer.parseInt(Objects.requireNonNull(getMask(mask)), PORT_RADIX)));
+
+ start = maskEnd + 1;
+ if (start > portMax) {
+ processing = false;
+ }
+ }
+
+ return portMaskMap;
+ }
+
+ private static int binLower(String binStr, int bits) {
+ StringBuilder outBin = new StringBuilder(
+ binStr.substring(MASK_BEGIN_IDX, MASK_MAX_IDX - bits));
+ for (int i = 0; i < bits; i++) {
+ outBin.append(STR_ZERO);
+ }
+
+ return Integer.parseInt(outBin.toString(), MASK_RADIX);
+ }
+
+ private static int binHigher(String binStr, int bits) {
+ StringBuilder outBin = new StringBuilder(
+ binStr.substring(MASK_BEGIN_IDX, MASK_MAX_IDX - bits));
+ for (int i = 0; i < bits; i++) {
+ outBin.append(STR_ONE);
+ }
+
+ return Integer.parseInt(outBin.toString(), MASK_RADIX);
+ }
+
+ private static int testMasks(String binStr, int start, int end) {
+ int mask = MASK_BEGIN_IDX;
+ for (; mask <= MASK_MAX_IDX; mask++) {
+ int maskStart = binLower(binStr, mask);
+ int maskEnd = binHigher(binStr, mask);
+ if (maskStart < start || maskEnd > end) {
+ return mask - 1;
+ }
+ }
+
+ return mask;
+ }
+
+ private static String getMask(int bits) {
+ switch (bits) {
+ case 0: return "ffff";
+ case 1: return "fffe";
+ case 2: return "fffc";
+ case 3: return "fff8";
+ case 4: return "fff0";
+ case 5: return "ffe0";
+ case 6: return "ffc0";
+ case 7: return "ff80";
+ case 8: return "ff00";
+ case 9: return "fe00";
+ case 10: return "fc00";
+ case 11: return "f800";
+ case 12: return "f000";
+ case 13: return "e000";
+ case 14: return "c000";
+ case 15: return "8000";
+ case 16: return "0000";
+ default: return null;
+ }
+ }
+
public static NiciraConnTrackTreatmentBuilder niciraConnTrackTreatmentBuilder(DriverService ds, DeviceId id) {
return new NiciraConnTrackTreatmentBuilder(ds, id);
}