@ -13,9 +13,9 @@
# License for the specific language governing permissions and limitations
# under the License.
import collections
import contextlib
import collections
import mock
from oslo_config import cfg
import oslo_messaging
@ -34,6 +34,7 @@ from neutron.db import securitygroups_rpc_base as sg_db_rpc
from neutron . extensions import allowedaddresspairs as addr_pair
from neutron . extensions import securitygroup as ext_sg
from neutron import manager
from neutron . plugins . openvswitch . agent import ovs_neutron_agent
from neutron . tests import base
from neutron . tests . unit . extensions import test_securitygroup as test_sg
@ -1107,6 +1108,7 @@ class BaseSecurityGroupAgentRpcTestCase(base.BaseTestCase):
self . firewall . defer_apply . side_effect = firewall_object . defer_apply
self . agent . firewall = self . firewall
self . fake_device = { ' device ' : ' fake_device ' ,
' network_id ' : ' fake_net ' ,
' security_groups ' : [ ' fake_sgid1 ' , ' fake_sgid2 ' ] ,
' security_group_source_groups ' : [ ' fake_sgid2 ' ] ,
' security_group_rules ' : [ { ' security_group_id ' :
@ -1667,6 +1669,42 @@ IPTABLES_ARG['ip1'] = IPS.values()[0]
IPTABLES_ARG [ ' ip2 ' ] = IPS . values ( ) [ 1 ]
IPTABLES_ARG [ ' chains ' ] = CHAINS_NAT
IPTABLES_RAW_DEFAULT = """ # Generated by iptables_manager
* raw
: % ( bn ) s - OUTPUT - [ 0 : 0 ]
: % ( bn ) s - PREROUTING - [ 0 : 0 ]
[ 0 : 0 ] - A PREROUTING - j % ( bn ) s - PREROUTING
[ 0 : 0 ] - A OUTPUT - j % ( bn ) s - OUTPUT
COMMIT
# Completed by iptables_manager
""" % IPTABLES_ARG
IPTABLES_RAW_DEVICE_1 = """ # Generated by iptables_manager
* raw
: % ( bn ) s - OUTPUT - [ 0 : 0 ]
: % ( bn ) s - PREROUTING - [ 0 : 0 ]
[ 0 : 0 ] - A PREROUTING - j % ( bn ) s - PREROUTING
[ 0 : 0 ] - A OUTPUT - j % ( bn ) s - OUTPUT
[ 0 : 0 ] - A % ( bn ) s - PREROUTING - m physdev - - physdev - in qvbtap_port1 - j CT - - zone 1
[ 0 : 0 ] - A % ( bn ) s - PREROUTING - m physdev - - physdev - in tap_port1 - j CT - - zone 1
COMMIT
# Completed by iptables_manager
""" % IPTABLES_ARG
IPTABLES_RAW_DEVICE_2 = """ # Generated by iptables_manager
* raw
: % ( bn ) s - OUTPUT - [ 0 : 0 ]
: % ( bn ) s - PREROUTING - [ 0 : 0 ]
[ 0 : 0 ] - A PREROUTING - j % ( bn ) s - PREROUTING
[ 0 : 0 ] - A OUTPUT - j % ( bn ) s - OUTPUT
[ 0 : 0 ] - A % ( bn ) s - PREROUTING - m physdev - - physdev - in qvbtap_port1 - j CT - - zone 1
[ 0 : 0 ] - A % ( bn ) s - PREROUTING - m physdev - - physdev - in tap_port1 - j CT - - zone 1
[ 0 : 0 ] - A % ( bn ) s - PREROUTING - m physdev - - physdev - in qvbtap_port2 - j CT - - zone 1
[ 0 : 0 ] - A % ( bn ) s - PREROUTING - m physdev - - physdev - in tap_port2 - j CT - - zone 1
COMMIT
# Completed by iptables_manager
""" % IPTABLES_ARG
IPTABLES_NAT = """ # Generated by iptables_manager
* nat
: neutron - postrouting - bottom - [ 0 : 0 ]
@ -2469,9 +2507,7 @@ class TestSecurityGroupAgentWithIptables(base.BaseTestCase):
cfg . CONF . set_override ( ' comment_iptables_rules ' , False , group = ' AGENT ' )
self . rpc = mock . Mock ( )
self . agent = sg_rpc . SecurityGroupAgentRpc (
context = None , plugin_rpc = self . rpc ,
defer_refresh_firewall = defer_refresh_firewall )
self . _init_agent ( defer_refresh_firewall )
if test_rpc_v1_1 :
self . rpc . security_group_info_for_devices . side_effect = (
@ -2542,8 +2578,14 @@ class TestSecurityGroupAgentWithIptables(base.BaseTestCase):
' 12:34:56:78:9a:bd ' ,
rule5 ) }
def _init_agent ( self , defer_refresh_firewall ) :
self . agent = sg_rpc . SecurityGroupAgentRpc (
context = None , plugin_rpc = self . rpc ,
defer_refresh_firewall = defer_refresh_firewall )
def _device ( self , device , ip , mac_address , rule ) :
return { ' device ' : device ,
' network_id ' : ' fakenet ' ,
' fixed_ips ' : [ ip ] ,
' mac_address ' : mac_address ,
' security_groups ' : [ ' security_group1 ' ] ,
@ -2588,14 +2630,14 @@ class TestSecurityGroupAgentWithIptables(base.BaseTestCase):
self . assertThat ( kwargs [ ' process_input ' ] ,
matchers . MatchesRegex ( expected_regex ) )
def _replay_iptables ( self , v4_filter , v6_filter ) :
def _replay_iptables ( self , v4_filter , v6_filter , raw ) :
self . _register_mock_call (
[ ' iptables-save ' , ' -c ' ] ,
run_as_root = True ,
return_value = ' ' )
self . _register_mock_call (
[ ' iptables-restore ' , ' -c ' ] ,
process_input = self . _regex ( IPTABLES_RAW + IPTABLES_NAT +
process_input = self . _regex ( raw + IPTABLES_NAT +
IPTABLES_MANGLE + v4_filter ) ,
run_as_root = True ,
return_value = ' ' )
@ -2605,14 +2647,16 @@ class TestSecurityGroupAgentWithIptables(base.BaseTestCase):
return_value = ' ' )
self . _register_mock_call (
[ ' ip6tables-restore ' , ' -c ' ] ,
process_input = self . _regex ( v6_filter ) ,
process_input = self . _regex ( raw + v6_filter ) ,
run_as_root = True ,
return_value = ' ' )
def test_prepare_remove_port ( self ) :
self . rpc . security_group_rules_for_devices . return_value = self . devices1
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY )
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' ] )
self . agent . remove_devices_filter ( [ ' tap_port1 ' ] )
@ -2621,12 +2665,18 @@ class TestSecurityGroupAgentWithIptables(base.BaseTestCase):
def test_security_group_member_updated ( self ) :
self . rpc . security_group_rules_for_devices . return_value = self . devices1
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPTABLES_FILTER_1_2 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPTABLES_FILTER_2 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPTABLES_FILTER_2_2 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY )
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_1_2 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_2_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' ] )
self . rpc . security_group_rules_for_devices . return_value = self . devices2
@ -2641,8 +2691,10 @@ class TestSecurityGroupAgentWithIptables(base.BaseTestCase):
def test_security_group_rule_updated ( self ) :
self . rpc . security_group_rules_for_devices . return_value = self . devices2
self . _replay_iptables ( IPTABLES_FILTER_2 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPTABLES_FILTER_2_3 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPTABLES_FILTER_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_2_3 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' , ' tap_port3 ' ] )
self . rpc . security_group_rules_for_devices . return_value = self . devices3
@ -2713,8 +2765,10 @@ class TestSecurityGroupAgentEnhancedRpcWithIptables(
def test_prepare_remove_port ( self ) :
self . sg_info . return_value = self . devices_info1
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY )
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' ] )
self . agent . remove_devices_filter ( [ ' tap_port1 ' ] )
@ -2723,12 +2777,18 @@ class TestSecurityGroupAgentEnhancedRpcWithIptables(
def test_security_group_member_updated ( self ) :
self . sg_info . return_value = self . devices_info1
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPTABLES_FILTER_1_2 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPTABLES_FILTER_2 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPTABLES_FILTER_2_2 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY )
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_1_2 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_2_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' ] )
self . sg_info . return_value = self . devices_info2
@ -2743,8 +2803,10 @@ class TestSecurityGroupAgentEnhancedRpcWithIptables(
def test_security_group_rule_updated ( self ) :
self . sg_info . return_value = self . devices_info2
self . _replay_iptables ( IPTABLES_FILTER_2 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPTABLES_FILTER_2_3 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPTABLES_FILTER_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_2_3 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' , ' tap_port3 ' ] )
self . sg_info . return_value = self . devices_info3
@ -2765,8 +2827,10 @@ class TestSecurityGroupAgentEnhancedIpsetWithIptables(
def test_prepare_remove_port ( self ) :
self . sg_info . return_value = self . devices_info1
self . _replay_iptables ( IPSET_FILTER_1 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY )
self . _replay_iptables ( IPSET_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' ] )
self . agent . remove_devices_filter ( [ ' tap_port1 ' ] )
@ -2775,12 +2839,18 @@ class TestSecurityGroupAgentEnhancedIpsetWithIptables(
def test_security_group_member_updated ( self ) :
self . sg_info . return_value = self . devices_info1
self . _replay_iptables ( IPSET_FILTER_1 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPSET_FILTER_1 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPSET_FILTER_2 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPSET_FILTER_2 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPSET_FILTER_1 , IPTABLES_FILTER_V6_1 )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY )
self . _replay_iptables ( IPSET_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPSET_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPSET_FILTER_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPSET_FILTER_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPSET_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' ] )
self . sg_info . return_value = self . devices_info2
@ -2795,8 +2865,10 @@ class TestSecurityGroupAgentEnhancedIpsetWithIptables(
def test_security_group_rule_updated ( self ) :
self . sg_info . return_value = self . devices_info2
self . _replay_iptables ( IPSET_FILTER_2 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPSET_FILTER_2_3 , IPTABLES_FILTER_V6_2 )
self . _replay_iptables ( IPSET_FILTER_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . _replay_iptables ( IPSET_FILTER_2_3 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' , ' tap_port3 ' ] )
self . sg_info . return_value = self . devices_info3
@ -2858,11 +2930,77 @@ class TestSecurityGroupAgentWithOVSIptables(
FIREWALL_DRIVER = FIREWALL_HYBRID_DRIVER
def setUp ( self , defer_refresh_firewall = False , test_rpc_v1_1 = True ) :
super ( TestSecurityGroupAgentWithOVSIptables , self ) . setUp (
defer_refresh_firewall ,
test_rpc_v1_1 )
def _init_agent ( self , defer_refresh_firewall ) :
fake_map = ovs_neutron_agent . LocalVLANMapping ( 1 , ' network_type ' ,
' physical_network ' , 1 )
local_vlan_map = { ' fakenet ' : fake_map }
self . agent = sg_rpc . SecurityGroupAgentRpc (
context = None , plugin_rpc = self . rpc ,
local_vlan_map = local_vlan_map ,
defer_refresh_firewall = defer_refresh_firewall )
def test_prepare_remove_port ( self ) :
self . rpc . security_group_rules_for_devices . return_value = self . devices1
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEVICE_1 )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' ] )
self . agent . remove_devices_filter ( [ ' tap_port1 ' ] )
self . _verify_mock_calls ( )
def test_security_group_member_updated ( self ) :
self . rpc . security_group_rules_for_devices . return_value = self . devices1
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEVICE_1 )
self . _replay_iptables ( IPTABLES_FILTER_1_2 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEVICE_1 )
self . _replay_iptables ( IPTABLES_FILTER_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEVICE_2 )
self . _replay_iptables ( IPTABLES_FILTER_2_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEVICE_2 )
self . _replay_iptables ( IPTABLES_FILTER_1 , IPTABLES_FILTER_V6_1 ,
IPTABLES_RAW_DEVICE_1 )
self . _replay_iptables ( IPTABLES_FILTER_EMPTY , IPTABLES_FILTER_V6_EMPTY ,
IPTABLES_RAW_DEFAULT )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' ] )
self . rpc . security_group_rules_for_devices . return_value = self . devices2
self . agent . security_groups_member_updated ( [ ' security_group1 ' ] )
self . agent . prepare_devices_filter ( [ ' tap_port2 ' ] )
self . rpc . security_group_rules_for_devices . return_value = self . devices1
self . agent . security_groups_member_updated ( [ ' security_group1 ' ] )
self . agent . remove_devices_filter ( [ ' tap_port2 ' ] )
self . agent . remove_devices_filter ( [ ' tap_port1 ' ] )
self . _verify_mock_calls ( )
def test_security_group_rule_updated ( self ) :
self . rpc . security_group_rules_for_devices . return_value = self . devices2
self . _replay_iptables ( IPTABLES_FILTER_2 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEVICE_2 )
self . _replay_iptables ( IPTABLES_FILTER_2_3 , IPTABLES_FILTER_V6_2 ,
IPTABLES_RAW_DEVICE_2 )
self . agent . prepare_devices_filter ( [ ' tap_port1 ' , ' tap_port3 ' ] )
self . rpc . security_group_rules_for_devices . return_value = self . devices3
self . agent . security_groups_rule_updated ( [ ' security_group1 ' ] )
self . _verify_mock_calls ( )
def _regex ( self , value ) :
#Note(nati): tap is prefixed on the device
# in the OVSHybridIptablesFirewallDriver
value = value . replace ( ' tap_port ' , ' taptap_port ' )
value = value . replace ( ' qvbtaptap_port ' , ' qvbtap_port ' )
value = value . replace ( ' o_port ' , ' otap_port ' )
value = value . replace ( ' i_port ' , ' itap_port ' )
value = value . replace ( ' s_port ' , ' stap_port ' )