Merge "Add VLAN and Port allowlist"

Author: Zuul

doc/source/configuration.rst

@@ -16,6 +16,8 @@ Switch configuration format::
     password = <credential password>
     key_file = <ssh key file>
     secret = <enable secret>
+    ngs_allowed_vlans = <comma-separated list of allowed vlans for switch>
+    ngs_allowed_ports = <comma-separated list of allowed ports for switch>
 
     # If set ngs_port_default_vlan to default_vlan, switch's
     # interface will restore the default_vlan.
@@ -24,6 +26,10 @@ Switch configuration format::
 The ``device_type`` entry is mandatory.  Most other configuration entries
 are optional, see below.
 
+The two new optional configuration parameters ``ngs_allowed_vlans`` and
+``ngs_allowed_ports`` have been introduced to manage allowed VLANs and ports
+on switches. If not set, all ports or VLANS are allowed.
+
 .. note::
 
     Switch will be selected by local_link_connection/switch_info

networking_generic_switch/devices/__init__.py

@@ -54,6 +54,10 @@
     {'name': 'ngs_fake_sleep_min_s'},
     {'name': 'ngs_fake_sleep_max_s'},
     {'name': 'ngs_fake_failure_prob'},
+    # Allow list for VLANs and ports for this switch
+    # default open, but setting empty string blocks all ports
+    {'name': 'ngs_allowed_vlans'},
+    {'name': 'ngs_allowed_ports'},
 ]
 
 
@@ -179,6 +183,37 @@ def _batch_requests(self):
         return strutils.bool_from_string(
             self.ngs_config['ngs_batch_requests'])
 
+    def _get_allowed_vlans(self):
+        allowed_vlans = self.ngs_config.get('ngs_allowed_vlans')
+        if allowed_vlans is None:
+            return None
+        return allowed_vlans.split(',')
+
+    def _get_allowed_ports(self):
+        allowed_ports = self.ngs_config.get('ngs_allowed_ports')
+        if allowed_ports is None:
+            return None
+        return allowed_ports.split(',')
+
+    def is_allowed(self, port_id, segmentation_id):
+        is_port_id_allowed = True
+        allowed_ports = self._get_allowed_ports()
+        if allowed_ports is not None:
+            is_port_id_allowed = port_id in allowed_ports
+            LOG.debug("Port %(port_id) allowed: %(is_port_id_allowed",
+                      {"port_id": port_id,
+                       "is_port_id_allowed": is_port_id_allowed})
+
+        is_vlan_allowed = True
+        allowed_vlans = self._get_allowed_vlans()
+        if allowed_vlans is not None:
+            is_vlan_allowed = str(segmentation_id) in allowed_vlans
+            LOG.debug("VLAN %(vlan) allowed: %(is_allowed",
+                      {"vlan": segmentation_id,
+                       "is_allowed": is_vlan_allowed})
+
+        return is_port_id_allowed and is_vlan_allowed
+
     @abc.abstractmethod
     def add_network(self, segmentation_id, network_id):
         pass

networking_generic_switch/generic_switch_mech.py

@@ -477,9 +477,47 @@ def bind_port(self, context):
             if not self._is_link_valid(port, network):
                 return
 
-            segments = context.segments_to_bind
+            is_802_3ad = self._is_802_3ad(port)
+            for link in local_link_information:
+                port_id = link.get('port_id')
+                switch_info = link.get('switch_info')
+                switch_id = link.get('switch_id')
+                switch = device_utils.get_switch_device(
+                    self.switches, switch_info=switch_info,
+                    ngs_mac_address=switch_id)
+
+                segments = context.segments_to_bind
+                # If segmentation ID is None, set vlan 1
+                segmentation_id = segments[0].get('segmentation_id') or 1
+
+                # Fail if port or vlan not in allow list
+                if not switch.is_allowed(port_id, segmentation_id):
+                    LOG.warn("Skipped binding port %(port_id)s, "
+                             "port %(port)s in segment "
+                             "%(segment_id)s on device %(device)s, as either "
+                             "the port or vlan is not on the allow list",
+                             {'port_id': port['id'], 'port': port_id,
+                              'device': switch_info,
+                              'segment_id': segmentation_id})
+                    return
+
+                LOG.debug("Putting port %(port_id)s on %(switch_info)s "
+                          "to vlan: %(segmentation_id)s",
+                          {'port_id': port_id, 'switch_info': switch_info,
+                           'segmentation_id': segmentation_id})
+                # Move port to network
+                if is_802_3ad and hasattr(switch, 'plug_bond_to_network'):
+                    switch.plug_bond_to_network(port_id, segmentation_id)
+                else:
+                    switch.plug_port_to_network(port_id, segmentation_id)
+                LOG.info("Successfully bound port %(port_id)s in segment "
+                         "%(segment_id)s on device %(device)s",
+                         {'port_id': port['id'], 'device': switch_info,
+                          'segment_id': segmentation_id})
+
             context.set_binding(segments[0][api.ID],
                                 portbindings.VIF_TYPE_OTHER, {})
+
             provisioning_blocks.add_provisioning_component(
                 context._plugin_context, port['id'], resources.PORT,
                 GENERIC_SWITCH_ENTITY)

networking_generic_switch/tests/unit/test_devices.py

@@ -118,7 +118,9 @@ def test_driver_ngs_config(self):
                       "ngs_physical_networks": "physnet1,physnet2",
                       "ngs_port_default_vlan": "20",
                       "ngs_disable_inactive_ports": "true",
-                      "ngs_network_name_format": "net-{network_id}"}
+                      "ngs_network_name_format": "net-{network_id}",
+                      "ngs_allowed_vlans": "123,124",
+                      "ngs_allowed_ports": "Ethernet1/1,Ethernet1/2"}
         device = devices.device_manager(device_cfg)
         self.assertIsInstance(device, devices.GenericSwitchDevice)
         self.assertNotIn('ngs_mac_address', device.config)
@@ -127,6 +129,8 @@ def test_driver_ngs_config(self):
         self.assertNotIn('ngs_trunk_ports', device.config)
         self.assertNotIn('ngs_physical_networks', device.config)
         self.assertNotIn('ngs_port_default_vlan', device.config)
+        self.assertNotIn('ngs_allowed_vlans', device.config)
+        self.assertNotIn('ngs_allowed_ports', device.config)
         self.assertEqual('aa:bb:cc:dd:ee:ff',
                          device.ngs_config['ngs_mac_address'])
         self.assertEqual('120', device.ngs_config['ngs_ssh_connect_timeout'])
@@ -139,6 +143,49 @@ def test_driver_ngs_config(self):
                          device.ngs_config['ngs_disable_inactive_ports'])
         self.assertEqual('net-{network_id}',
                          device.ngs_config['ngs_network_name_format'])
+        self.assertEqual("123,124",
+                         device.ngs_config['ngs_allowed_vlans'])
+        self.assertEqual(["123", "124"],
+                         device._get_allowed_vlans())
+        self.assertEqual("Ethernet1/1,Ethernet1/2",
+                         device.ngs_config['ngs_allowed_ports'])
+        self.assertEqual(["Ethernet1/1", "Ethernet1/2"],
+                         device._get_allowed_ports())
+
+    def test_driver_ngs_is_allowed(self):
+        device_cfg = {"device_type": 'netmiko_ovs_linux',
+                      "ngs_allowed_vlans": "123,124",
+                      "ngs_allowed_ports": "Ethernet1/1,Ethernet1/2"}
+        device = devices.device_manager(device_cfg)
+
+        # test all allowed
+        self.assertTrue(device.is_allowed("Ethernet1/1", 123))
+        self.assertTrue(device.is_allowed("Ethernet1/2", 124))
+        # fail on vlan
+        self.assertFalse(device.is_allowed("Ethernet1/2", 125))
+        # fail on port
+        self.assertFalse(device.is_allowed("Ethernet1/3", 124))
+        # fail on both
+        self.assertFalse(device.is_allowed("Ethernet2/2", 1))
+
+    def test_driver_ngs_is_allowed_fails_on_empty_ports(self):
+        device_cfg = {"device_type": 'netmiko_ovs_linux',
+                      "ngs_allowed_vlans": "123",
+                      "ngs_allowed_ports": ""}
+        device = devices.device_manager(device_cfg)
+        self.assertFalse(device.is_allowed("Ethernet1/1", 123))
+
+    def test_driver_ngs_is_allowed_fails_on_empty_vlans(self):
+        device_cfg = {"device_type": 'netmiko_ovs_linux',
+                      "ngs_allowed_vlans": "",
+                      "ngs_allowed_ports": "Ethernet1/1"}
+        device = devices.device_manager(device_cfg)
+        self.assertFalse(device.is_allowed("Ethernet1/1", 123))
+
+    def test_driver_ngs_is_allowed_default(self):
+        device_cfg = {"device_type": 'netmiko_ovs_linux'}
+        device = devices.device_manager(device_cfg)
+        self.assertTrue(device.is_allowed("Ethernet1/1", 123))
 
     def test_driver_ngs_config_defaults(self):
         device_cfg = {"device_type": 'netmiko_ovs_linux'}
@@ -153,6 +200,8 @@ def test_driver_ngs_config_defaults(self):
         self.assertFalse(device.ngs_config['ngs_disable_inactive_ports'])
         self.assertEqual('{network_id}',
                          device.ngs_config['ngs_network_name_format'])
+        self.assertNotIn('ngs_allowed_vlans', device.ngs_config)
+        self.assertNotIn('ngs_allowed_ports', device.ngs_config)
 
     def test__get_trunk_ports(self):
         device_cfg = {"ngs_trunk_ports": 'port1, Po 1/30,port42'}