api: Add framework for extra spec validation

Add the validation framework necessary to verify extra specs along with
the definitions for every extra spec we currently recognize in-tree.
None of this is currently used since we don't have the API microversions
wired up, but that will come in a future patch.

Note that we must add the H238 hacking check to the ignore list here,
since this includes our first use of Python 3-type classes without the
explicit 'object' subclass. This can be removed when that check is
removed from hacking.

Part of blueprint flavor-extra-spec-validators

Change-Id: Ib64a1348cce1dca995746214616c4f33d9d664bd
Signed-off-by: Stephen Finucane <sfinucan@redhat.com>

nova/api/validation/extra_specs/validators.py

@@ -0,0 +1,79 @@
+# Copyright 2020 Red Hat, Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+"""Validators for all extra specs known by nova."""
+
+import re
+import typing as ty
+
+from oslo_log import log as logging
+from stevedore import extension
+
+from nova.api.validation.extra_specs import base
+from nova import exception
+
+LOG = logging.getLogger(__name__)
+
+VALIDATORS: ty.Dict[str, base.ExtraSpecValidator] = {}
+
+
+def validate(name: str, value: str, mode: str):
+    """Validate a given extra spec.
+
+    :param name: Extra spec name.
+    :param value: Extra spec value.
+    :param mode: Validation mode; one of: strict, permissive, disabled
+    :raises: exception.ValidationError if validation fails.
+    """
+    if mode == 'disabled':
+        return
+
+    # attempt a basic lookup for extra specs without embedded parameters
+    if name in VALIDATORS:
+        VALIDATORS[name].validate(name, value)
+        return
+
+    # if that failed, fallback to a linear search through the registry
+    for validator in VALIDATORS.values():
+        if re.fullmatch(validator.name_regex, name):
+            validator.validate(name, value)
+            return
+
+    if mode == 'permissive':  # unregistered extra spec, ignore
+        return
+
+    raise exception.ValidationError(
+        f"Validation failed; extra spec '{name}' does not appear to be a "
+        f"valid extra spec."
+    )
+
+
+def load_validators():
+    global VALIDATORS
+
+    def _report_load_failure(mgr, ep, err):
+        LOG.warning(u'Failed to load %s: %s', ep.module_name, err)
+
+    mgr = extension.ExtensionManager(
+        'nova.api.extra_spec_validators',
+        on_load_failure_callback=_report_load_failure,
+        invoke_on_load=False,
+    )
+    for ext in mgr:
+        # TODO(stephenfin): Make 'register' return a dict rather than a list?
+        for validator in ext.plugin.register():
+            VALIDATORS[validator.name] = validator
+
+
+load_validators()