Add VLAN and Port allowlist

Adds support for a VLAN and port allowlist for high security
environments to be able to restrict Ironic activities only to ports
which are attached to nodes (or any other restriction desired and
configured).

Co-authored-by: John Garbutt <John.Garbutt@gresearch.co.uk>
Co-authored-by: Andrew Ellard <andrew.ellard@gresearch.co.uk>
Co-authored-by: Doug Szumski <doug@stackhpc.com>
Change-Id: Ic0ef1d3f917f3b1e666e5f1b87ae13457663330c

Author: 4 people

doc/source/configuration.rst

@@ -16,6 +16,8 @@ Switch configuration format::
     password = <credential password>
     key_file = <ssh key file>
     secret = <enable secret>
+    ngs_allowed_vlans = <comma-separated list of allowed vlans for switch>
+    ngs_allowed_ports = <comma-separated list of allowed ports for switch>
 
     # If set ngs_port_default_vlan to default_vlan, switch's
     # interface will restore the default_vlan.
@@ -24,6 +26,10 @@ Switch configuration format::
 The ``device_type`` entry is mandatory.  Most other configuration entries
 are optional, see below.
 
+The two new optional configuration parameters ``ngs_allowed_vlans`` and
+``ngs_allowed_ports`` have been introduced to manage allowed VLANs and ports
+on switches. If not set, all ports or VLANS are allowed.
+
 .. note::
 
     Switch will be selected by local_link_connection/switch_info

networking_generic_switch/devices/__init__.py

@@ -54,6 +54,10 @@
     {'name': 'ngs_fake_sleep_min_s'},
     {'name': 'ngs_fake_sleep_max_s'},
     {'name': 'ngs_fake_failure_prob'},
+    # Allow list for VLANs and ports for this switch
+    # default open, but setting empty string blocks all ports
+    {'name': 'ngs_allowed_vlans'},
+    {'name': 'ngs_allowed_ports'},
 ]
 
 
@@ -179,6 +183,37 @@ def _batch_requests(self):
         return strutils.bool_from_string(
             self.ngs_config['ngs_batch_requests'])
 
+    def _get_allowed_vlans(self):
+        allowed_vlans = self.ngs_config.get('ngs_allowed_vlans')
+        if allowed_vlans is None:
+            return None
+        return allowed_vlans.split(',')
+
+    def _get_allowed_ports(self):
+        allowed_ports = self.ngs_config.get('ngs_allowed_ports')
+        if allowed_ports is None:
+            return None
+        return allowed_ports.split(',')
+
+    def is_allowed(self, port_id, segmentation_id):
+        is_port_id_allowed = True
+        allowed_ports = self._get_allowed_ports()
+        if allowed_ports is not None:
+            is_port_id_allowed = port_id in allowed_ports
+            LOG.debug("Port %(port_id) allowed: %(is_port_id_allowed",
+                      {"port_id": port_id,
+                       "is_port_id_allowed": is_port_id_allowed})
+
+        is_vlan_allowed = True
+        allowed_vlans = self._get_allowed_vlans()
+        if allowed_vlans is not None:
+            is_vlan_allowed = str(segmentation_id) in allowed_vlans
+            LOG.debug("VLAN %(vlan) allowed: %(is_allowed",
+                      {"vlan": segmentation_id,
+                       "is_allowed": is_vlan_allowed})
+
+        return is_port_id_allowed and is_vlan_allowed
+
     @abc.abstractmethod
     def add_network(self, segmentation_id, network_id):
         pass

networking_generic_switch/generic_switch_mech.py

@@ -477,9 +477,47 @@ def bind_port(self, context):
             if not self._is_link_valid(port, network):
                 return
 
-            segments = context.segments_to_bind
+            is_802_3ad = self._is_802_3ad(port)
+            for link in local_link_information:
+                port_id = link.get('port_id')
+                switch_info = link.get('switch_info')
+                switch_id = link.get('switch_id')
+                switch = device_utils.get_switch_device(
+                    self.switches, switch_info=switch_info,
+                    ngs_mac_address=switch_id)
+
+                segments = context.segments_to_bind
+                # If segmentation ID is None, set vlan 1
+                segmentation_id = segments[0].get('segmentation_id') or 1
+
+                # Fail if port or vlan not in allow list
+                if not switch.is_allowed(port_id, segmentation_id):
+                    LOG.warn("Skipped binding port %(port_id)s, "
+                             "port %(port)s in segment "
+                             "%(segment_id)s on device %(device)s, as either "
+                             "the port or vlan is not on the allow list",
+                             {'port_id': port['id'], 'port': port_id,
+                              'device': switch_info,
+                              'segment_id': segmentation_id})
+                    return
+
+                LOG.debug("Putting port %(port_id)s on %(switch_info)s "
+                          "to vlan: %(segmentation_id)s",
+                          {'port_id': port_id, 'switch_info': switch_info,
+                           'segmentation_id': segmentation_id})
+                # Move port to network
+                if is_802_3ad and hasattr(switch, 'plug_bond_to_network'):
+                    switch.plug_bond_to_network(port_id, segmentation_id)
+                else:
+                    switch.plug_port_to_network(port_id, segmentation_id)
+                LOG.info("Successfully bound port %(port_id)s in segment "
+                         "%(segment_id)s on device %(device)s",
+                         {'port_id': port['id'], 'device': switch_info,
+                          'segment_id': segmentation_id})
+
             context.set_binding(segments[0][api.ID],
                                 portbindings.VIF_TYPE_OTHER, {})
+
             provisioning_blocks.add_provisioning_component(
                 context._plugin_context, port['id'], resources.PORT,
                 GENERIC_SWITCH_ENTITY)

networking_generic_switch/tests/unit/test_devices.py

@@ -118,7 +118,9 @@ def test_driver_ngs_config(self):
                       "ngs_physical_networks": "physnet1,physnet2",
                       "ngs_port_default_vlan": "20",
                       "ngs_disable_inactive_ports": "true",
-                      "ngs_network_name_format": "net-{network_id}"}
+                      "ngs_network_name_format": "net-{network_id}",
+                      "ngs_allowed_vlans": "123,124",
+                      "ngs_allowed_ports": "Ethernet1/1,Ethernet1/2"}
         device = devices.device_manager(device_cfg)
         self.assertIsInstance(device, devices.GenericSwitchDevice)
         self.assertNotIn('ngs_mac_address', device.config)
@@ -127,6 +129,8 @@ def test_driver_ngs_config(self):
         self.assertNotIn('ngs_trunk_ports', device.config)
         self.assertNotIn('ngs_physical_networks', device.config)
         self.assertNotIn('ngs_port_default_vlan', device.config)
+        self.assertNotIn('ngs_allowed_vlans', device.config)
+        self.assertNotIn('ngs_allowed_ports', device.config)
         self.assertEqual('aa:bb:cc:dd:ee:ff',
                          device.ngs_config['ngs_mac_address'])
         self.assertEqual('120', device.ngs_config['ngs_ssh_connect_timeout'])
@@ -139,6 +143,49 @@ def test_driver_ngs_config(self):
                          device.ngs_config['ngs_disable_inactive_ports'])
         self.assertEqual('net-{network_id}',
                          device.ngs_config['ngs_network_name_format'])
+        self.assertEqual("123,124",
+                         device.ngs_config['ngs_allowed_vlans'])
+        self.assertEqual(["123", "124"],
+                         device._get_allowed_vlans())
+        self.assertEqual("Ethernet1/1,Ethernet1/2",
+                         device.ngs_config['ngs_allowed_ports'])
+        self.assertEqual(["Ethernet1/1", "Ethernet1/2"],
+                         device._get_allowed_ports())
+
+    def test_driver_ngs_is_allowed(self):
+        device_cfg = {"device_type": 'netmiko_ovs_linux',
+                      "ngs_allowed_vlans": "123,124",
+                      "ngs_allowed_ports": "Ethernet1/1,Ethernet1/2"}
+        device = devices.device_manager(device_cfg)
+
+        # test all allowed
+        self.assertTrue(device.is_allowed("Ethernet1/1", 123))
+        self.assertTrue(device.is_allowed("Ethernet1/2", 124))
+        # fail on vlan
+        self.assertFalse(device.is_allowed("Ethernet1/2", 125))
+        # fail on port
+        self.assertFalse(device.is_allowed("Ethernet1/3", 124))
+        # fail on both
+        self.assertFalse(device.is_allowed("Ethernet2/2", 1))
+
+    def test_driver_ngs_is_allowed_fails_on_empty_ports(self):
+        device_cfg = {"device_type": 'netmiko_ovs_linux',
+                      "ngs_allowed_vlans": "123",
+                      "ngs_allowed_ports": ""}
+        device = devices.device_manager(device_cfg)
+        self.assertFalse(device.is_allowed("Ethernet1/1", 123))
+
+    def test_driver_ngs_is_allowed_fails_on_empty_vlans(self):
+        device_cfg = {"device_type": 'netmiko_ovs_linux',
+                      "ngs_allowed_vlans": "",
+                      "ngs_allowed_ports": "Ethernet1/1"}
+        device = devices.device_manager(device_cfg)
+        self.assertFalse(device.is_allowed("Ethernet1/1", 123))
+
+    def test_driver_ngs_is_allowed_default(self):
+        device_cfg = {"device_type": 'netmiko_ovs_linux'}
+        device = devices.device_manager(device_cfg)
+        self.assertTrue(device.is_allowed("Ethernet1/1", 123))
 
     def test_driver_ngs_config_defaults(self):
         device_cfg = {"device_type": 'netmiko_ovs_linux'}
@@ -153,6 +200,8 @@ def test_driver_ngs_config_defaults(self):
         self.assertFalse(device.ngs_config['ngs_disable_inactive_ports'])
         self.assertEqual('{network_id}',
                          device.ngs_config['ngs_network_name_format'])
+        self.assertNotIn('ngs_allowed_vlans', device.ngs_config)
+        self.assertNotIn('ngs_allowed_ports', device.ngs_config)
 
     def test__get_trunk_ports(self):
         device_cfg = {"ngs_trunk_ports": 'port1, Po 1/30,port42'}