551130e9f4
When add allowed-address-pair 0.0.0.0/0 to one port, it will
unexpectedly open all others' protocol under same security
group. IPv6 has the same problem.
The root cause is the openflow rules calculation of the
security group, it will unexpectedly allow all IP(4&6)
traffic to get through.
For openvswitch openflow firewall, this patch adds a source
mac address match for the allowed-address-pair which has
prefix lenght 0, that means all ethernet packets from this
mac will be accepted. It exactly will meet the request of
accepting any IP address from the configured VM.
Test result shows that the remote security group and
allowed address pair works:
1. Port has 0.0.0.0/0 allowed-address-pair clould send any
IP (src) packet out.
2. Port has x.x.x.x/y allowed-address-pair could be accepted
for those VMs under same security group.
3. Ports under same network can reach each other (remote
security group).
4. Protocol port number could be accessed only when there
has related rule.
Closes-bug: #1867119
Change-Id: I2e3aa7c400d7bb17cc117b65faaa160b41013dde
(cherry picked from commit 00298fe6e8)
189 lines
7.6 KiB
Python
189 lines
7.6 KiB
Python
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
import copy
|
|
|
|
import netaddr
|
|
|
|
from neutron.agent.linux import utils as linux_utils
|
|
from oslo_concurrency import lockutils
|
|
|
|
IPSET_ADD_BULK_THRESHOLD = 5
|
|
NET_PREFIX = 'N'
|
|
SWAP_SUFFIX = '-n'
|
|
IPSET_NAME_MAX_LENGTH = 31 - len(SWAP_SUFFIX)
|
|
|
|
|
|
class IpsetManager(object):
|
|
"""Smart wrapper for ipset.
|
|
|
|
Keeps track of ip addresses per set, using bulk
|
|
or single ip add/remove for smaller changes.
|
|
"""
|
|
|
|
def __init__(self, execute=None, namespace=None):
|
|
self.execute = execute or linux_utils.execute
|
|
self.namespace = namespace
|
|
self.ipset_sets = {}
|
|
|
|
def _sanitize_addresses(self, addresses):
|
|
"""This method converts any address to ipset format.
|
|
|
|
If an address has a mask of /0 we need to cover to it to a mask of
|
|
/1 as ipset does not support /0 length addresses. Instead we use two
|
|
/1's to represent the /0.
|
|
"""
|
|
sanitized_addresses = []
|
|
for ip, _mac in addresses:
|
|
ip = netaddr.IPNetwork(ip)
|
|
if ip.prefixlen == 0:
|
|
if ip.version == 4:
|
|
sanitized_addresses.append('0.0.0.0/1')
|
|
sanitized_addresses.append('128.0.0.0/1')
|
|
elif ip.version == 6:
|
|
sanitized_addresses.append('::/1')
|
|
sanitized_addresses.append('8000::/1')
|
|
else:
|
|
sanitized_addresses.append(str(ip))
|
|
return sanitized_addresses
|
|
|
|
@staticmethod
|
|
def get_name(id, ethertype):
|
|
"""Returns the given ipset name for an id+ethertype pair.
|
|
This reference can be used from iptables.
|
|
"""
|
|
name = NET_PREFIX + ethertype + id
|
|
return name[:IPSET_NAME_MAX_LENGTH]
|
|
|
|
def set_name_exists(self, set_name):
|
|
"""Returns true if the set name is known to the manager."""
|
|
return set_name in self.ipset_sets
|
|
|
|
def set_members(self, id, ethertype, member_ips):
|
|
"""Create or update a specific set by name and ethertype.
|
|
It will make sure that a set is created, updated to
|
|
add / remove new members, or swapped atomically if
|
|
that's faster, and return added / removed members.
|
|
"""
|
|
member_ips = self._sanitize_addresses(member_ips)
|
|
set_name = self.get_name(id, ethertype)
|
|
add_ips = self._get_new_set_ips(set_name, member_ips)
|
|
del_ips = self._get_deleted_set_ips(set_name, member_ips)
|
|
if add_ips or del_ips or not self.set_name_exists(set_name):
|
|
self.set_members_mutate(set_name, ethertype, member_ips)
|
|
return add_ips, del_ips
|
|
|
|
def set_members_mutate(self, set_name, ethertype, member_ips):
|
|
with lockutils.lock('neutron-ipset-%s' % self.namespace,
|
|
external=True):
|
|
if not self.set_name_exists(set_name):
|
|
# The initial creation is handled with create/refresh to
|
|
# avoid any downtime for existing sets (i.e. avoiding
|
|
# a flush/restore), as the restore operation of ipset is
|
|
# additive to the existing set.
|
|
self._create_set(set_name, ethertype)
|
|
self._refresh_set(set_name, member_ips, ethertype)
|
|
# TODO(majopela,shihanzhang,haleyb): Optimize this by
|
|
# gathering the system ipsets at start. So we can determine
|
|
# if a normal restore is enough for initial creation.
|
|
# That should speed up agent boot up time.
|
|
else:
|
|
add_ips = self._get_new_set_ips(set_name, member_ips)
|
|
del_ips = self._get_deleted_set_ips(set_name, member_ips)
|
|
if (len(add_ips) + len(del_ips) < IPSET_ADD_BULK_THRESHOLD):
|
|
self._add_members_to_set(set_name, add_ips)
|
|
self._del_members_from_set(set_name, del_ips)
|
|
else:
|
|
self._refresh_set(set_name, member_ips, ethertype)
|
|
|
|
def destroy(self, id, ethertype, forced=False):
|
|
with lockutils.lock('neutron-ipset-%s' % self.namespace,
|
|
external=True):
|
|
set_name = self.get_name(id, ethertype)
|
|
self._destroy(set_name, forced)
|
|
|
|
def _add_member_to_set(self, set_name, member_ip):
|
|
cmd = ['ipset', 'add', '-exist', set_name, member_ip]
|
|
self._apply(cmd)
|
|
self.ipset_sets[set_name].append(member_ip)
|
|
|
|
def _refresh_set(self, set_name, member_ips, ethertype):
|
|
new_set_name = set_name + SWAP_SUFFIX
|
|
set_type = self._get_ipset_set_type(ethertype)
|
|
process_input = ["create %s hash:net family %s" % (new_set_name,
|
|
set_type)]
|
|
for ip in member_ips:
|
|
process_input.append("add %s %s" % (new_set_name, ip))
|
|
|
|
self._restore_sets(process_input)
|
|
self._swap_sets(new_set_name, set_name)
|
|
self._destroy(new_set_name, True)
|
|
self.ipset_sets[set_name] = copy.copy(member_ips)
|
|
|
|
def _del_member_from_set(self, set_name, member_ip):
|
|
cmd = ['ipset', 'del', set_name, member_ip]
|
|
self._apply(cmd, fail_on_errors=False)
|
|
self.ipset_sets[set_name].remove(member_ip)
|
|
|
|
def _create_set(self, set_name, ethertype):
|
|
cmd = ['ipset', 'create', '-exist', set_name, 'hash:net', 'family',
|
|
self._get_ipset_set_type(ethertype)]
|
|
self._apply(cmd)
|
|
self.ipset_sets[set_name] = []
|
|
|
|
def _apply(self, cmd, input=None, fail_on_errors=True):
|
|
input = '\n'.join(input) if input else None
|
|
cmd_ns = []
|
|
if self.namespace:
|
|
cmd_ns.extend(['ip', 'netns', 'exec', self.namespace])
|
|
cmd_ns.extend(cmd)
|
|
self.execute(cmd_ns, run_as_root=True, process_input=input,
|
|
check_exit_code=fail_on_errors)
|
|
|
|
def _get_new_set_ips(self, set_name, expected_ips):
|
|
new_member_ips = (set(expected_ips) -
|
|
set(self.ipset_sets.get(set_name, [])))
|
|
return list(new_member_ips)
|
|
|
|
def _get_deleted_set_ips(self, set_name, expected_ips):
|
|
deleted_member_ips = (set(self.ipset_sets.get(set_name, [])) -
|
|
set(expected_ips))
|
|
return list(deleted_member_ips)
|
|
|
|
def _add_members_to_set(self, set_name, add_ips):
|
|
for ip in add_ips:
|
|
if ip not in self.ipset_sets[set_name]:
|
|
self._add_member_to_set(set_name, ip)
|
|
|
|
def _del_members_from_set(self, set_name, del_ips):
|
|
for ip in del_ips:
|
|
if ip in self.ipset_sets[set_name]:
|
|
self._del_member_from_set(set_name, ip)
|
|
|
|
def _get_ipset_set_type(self, ethertype):
|
|
return 'inet6' if ethertype == 'IPv6' else 'inet'
|
|
|
|
def _restore_sets(self, process_input):
|
|
cmd = ['ipset', 'restore', '-exist']
|
|
self._apply(cmd, process_input)
|
|
|
|
def _swap_sets(self, src_set, dest_set):
|
|
cmd = ['ipset', 'swap', src_set, dest_set]
|
|
self._apply(cmd)
|
|
|
|
def _destroy(self, set_name, forced=False):
|
|
if set_name in self.ipset_sets or forced:
|
|
cmd = ['ipset', 'destroy', set_name]
|
|
self._apply(cmd, fail_on_errors=False)
|
|
self.ipset_sets.pop(set_name, None)
|