Skip to content

Gelencsér Szabolcs / vmdriver

Go to a project
Commit 88688f4b by Guba Sándor
Options

complete refactor of flow rules

parent 78e6644b
Showing with 147 additions and 71 deletions
networkdriver.py
...@@ -24,104 +24,180 @@ def ofctl_command_execute(command): ...@@ -24,104 +24,180 @@ def ofctl_command_execute(command):
return return_val return return_val
def create(vm): def create(network_list):
for network in vm.network_list: for network in network_list:
port_create(network) port_create(network)
def delete(vm): def delete(network_list):
for network in vm.network_list: for network in network_list:
port_delete(network) port_delete(network)
def build_flow_rule(): def build_flow_rule(
in_port=None,
dl_src=None,
protocol=None,
nw_src=None,
ipv6_src=None,
tp_dst=None,
priority=None,
actions=None):
'''
in_port - Interface flow-port number
dl_src - Source mac addsress (virtual interface)
protocol - Protocol for the rule like ip,ipv6,arp,udp,tcp
nw_src - Source network IP(v4)
ipv6_src - Source network IP(v6)
tp_dst - Destination port
priority - Rule priority
actions - Action for the matching rule
'''
flow_rule = ""
if in_port is None:
raise AttributeError("Parameter in_port is mandantory")
parameters = [('in_port=%s', in_port),
('dl_src=%s', dl_src),
('%s', protocol),
('nw_src=%s', nw_src),
('ipv6_src=%s', ipv6_src),
('tp_dst=%s', tp_dst),
('priority=%s', priority),
('actions=%s', actions)]
# Checking for values if not None making up rule list
rule = [p1 % p2 for (p1, p2) in parameters if p2 is not None]
# Generate rule string with comas, except the last item
for i in rule[:-1]:
flow_rule += i + ","
else:
flow_rule += rule[-1]
return flow_rule
def set_port_vlan(network_name, vlan):
''' Setting vlan for interface named net_name
'''
cmd_list = ['set', 'Port', network_name, 'tag=' + str(vlan)]
ovs_command_execute(cmd_list)
def add_port_to_bridge(network_name, bridge):
cmd_list = ['add-port', bridge, network_name]
ovs_command_execute(cmd_list)
def ban_dhcp_server(network, port_number): def del_port_from_bridge(network_name):
cmd_list = ['add-flow', network.bridge, ovs_command_execute(['del-port', network_name])
'in_port=%(port_number)s,dl_src=%(mac)s,udp,tp_dst=68,\
priority=43000,actions=drop' % {
'port_number': port_number, 'mac': network.mac}] def ban_dhcp_server(network, port_number, delete=False):
return cmd_list if not delete:
flow_cmd = build_flow_rule(in_port=port_number, dl_src=network.mac,
protocol="udp", tp_dst="68",
priority="43000", actions="drop")
ofctl_command_execute(["add-flow", network.bridge, flow_cmd])
else:
flow_cmd = build_flow_rule(in_port=port_number, dl_src=network.mac,
protocol="udp", tp_dst="68")
ofctl_command_execute(["del-flows", network.bridge, flow_cmd])
def ipv4_filter(network, port_number, delete=False):
if not delete:
flow_cmd = build_flow_rule(in_port=port_number, dl_src=network.mac,
protocol="ip", nw_src=network.ipv4,
priority=42000, actions="normal")
ofctl_command_execute(["add-flow", network.bridge, flow_cmd])
else:
flow_cmd = build_flow_rule(in_port=port_number, dl_src=network.mac,
protocol="ip", nw_src=network.ipv4)
ofctl_command_execute(["del-flows", network.bridge, flow_cmd])
def ipv6_filter(network, port_number, delete=False):
if not delete:
flow_cmd = build_flow_rule(in_port=port_number, dl_src=network.mac,
protocol="ipv6", ipv6_src=network.ipv6,
priority=42000, actions="normal")
ofctl_command_execute(["add-flow", network.bridge, flow_cmd])
else:
flow_cmd = build_flow_rule(in_port=port_number, dl_src=network.mac,
protocol="ipv6", ipv6_src=network.ipv6)
ofctl_command_execute(["del-flows", network.bridge, flow_cmd])
def arp_filter(network, port_number, delete=False):
if not delete:
flow_cmd = build_flow_rule(in_port=port_number, dl_src=network.mac,
protocol="arp", nw_src=network.ipv4,
priority=41000, actions="normal")
ofctl_command_execute(["add-flow", network.bridge, flow_cmd])
else:
flow_cmd = build_flow_rule(in_port=port_number, dl_src=network.mac,
protocol="arp", nw_src=network.ipv4)
ofctl_command_execute(["del-flows", network.bridge, flow_cmd])
def enable_dhcp_client(network, port_number, delete=False):
if not delete:
flow_cmd = build_flow_rule(in_port=port_number, dl_src=network.mac,
protocol="udp", tp_dst="67",
priority="40000", actions="normal")
ofctl_command_execute(["add-flow", network.bridge, flow_cmd])
else:
flow_cmd = build_flow_rule(in_port=port_number, dl_src=network.mac,
protocol="udp", tp_dst="67")
ofctl_command_execute(["del-flows", network.bridge, flow_cmd])
def disable_all_not_allowed_trafic(network, port_number, delete=False):
if not delete:
flow_cmd = build_flow_rule(in_port=port_number,
priority="39000", actions="drop")
ofctl_command_execute(["add-flow", network.bridge, flow_cmd])
else:
flow_cmd = build_flow_rule(in_port=port_number)
ofctl_command_execute(["del-flows", network.bridge, flow_cmd])
def port_create(network): def port_create(network):
''' '''
add-port BRIDGE PORT
set Port vnet18 tag=9
add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,udp,tp_dst=68,priority=43000,actions=drop".
add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,ip,nw_src=10.9.1.138,priority=42000,actions=normal".
add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,ipv6,ipv6_src=2001:738:2001:4031:9:1:138:0/112,priority=42000,actions=normal".
add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,arp,nw_src=10.9.1.138,priority=41000,actions=normal".
add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,udp,tp_dst=67,priority=40000,actions=normal".
add-flow cloud in_port=245,priority=39000,actions=drop".
''' '''
# Create the port for virtual network # Create the port for virtual network
cmd_list = ['add-port', network.bridge, network.name] add_port_to_bridge(network.name, network.bridge)
ovs_command_execute(cmd_list)
# Set VLAN parameter for tap interface # Set VLAN parameter for tap interface
cmd_list = ['set', 'Port', network.name, 'tag='+str(network.vlan)] set_port_vlan(network.name, network.vlan)
ovs_command_execute(cmd_list)
# Getting network FlowPortNumber # Getting network FlowPortNumber
port_number = get_fport_for_network(network) port_number = get_fport_for_network(network)
# Set Flow rules to avoid mac or IP spoofing # Set Flow rules to avoid mac or IP spoofing
# Set flow rule 1 (dhcp server ban) if network.managed:
ofctl_command_execute(ban_dhcp_server(network, port_number)) ban_dhcp_server(network, port_number)
# Set flow rules 2 (ipv4 filter) ipv4_filter(network, port_number)
cmd_list = ['add-flow', network.bridge, ipv6_filter(network, port_number)
'in_port=%(port_number)s,dl_src=%(mac)s,ip,\ arp_filter(network, port_number)
nw_src=%(ipv4)s,priority=42000,actions=normal' % { enable_dhcp_client(network, port_number)
'port_number': port_number, disable_all_not_allowed_trafic(network, port_number)
'mac': network.mac, 'ipv4': network.ipv4}]
ofctl_command_execute(cmd_list)
# Set flow rules 3 (ipv6 filter)
cmd_list = ['add-flow', network.bridge,
'in_port=%(port_number)s,dl_src=%(mac)s,ipv6,\
ipv6_src=%(ipv6)s,priority=42000,actions=normal' % {
'port_number': port_number,
'mac': network.mac, 'ipv6': network.ipv6}]
ofctl_command_execute(cmd_list)
# Set flow rules 4 (enabling arp)
cmd_list = ['add-flow', network.bridge,
'in_port=%(port_number)s,dl_src=%(mac)s,arp,\
nw_src=%(ipv4)s,priority=41000,actions=normal' % {
'port_number': port_number,
'mac': network.mac, 'ipv4': network.ipv4}]
ofctl_command_execute(cmd_list)
# Set flow rules 5 (enabling arp)
cmd_list = ['add-flow', network.bridge,
'in_port=%(port_number)s,dl_src=%(mac)s,udp,tp_dst=67,\
priority=40000,actions=normal' % {
'port_number': port_number, 'mac': network.mac}]
ofctl_command_execute(cmd_list)
# Set flow rule 6 (disable other protocols)
cmd_list = ['add-flow', network.bridge,
'in_port=%(port_number)s,priority=39000,actions=drop' % {
'port_number': port_number}]
ofctl_command_execute(cmd_list)
def port_delete(network): def port_delete(network):
'''
'''
# Getting network FlowPortNumber # Getting network FlowPortNumber
port_number = get_fport_for_network(network) port_number = get_fport_for_network(network)
# Delete flow # Clear network rules
cmd_list = ['del-flows', network.bridge, if network.managed:
'in_port=%(port_number)s,dl_src=%(mac)s,udp,tp_dst=68' % { ban_dhcp_server(network, port_number, delete=True)
'port_number': port_number, 'mac': network.mac}] ipv4_filter(network, port_number, delete=True)
ofctl_command_execute(cmd_list) ipv6_filter(network, port_number, delete=True)
arp_filter(network, port_number, delete=True)
enable_dhcp_client(network, port_number, delete=True)
disable_all_not_allowed_trafic(network, port_number, delete=True)
# Delete port # Delete port
# cmd_list = ['del-port', network.name] del_port_from_bridge(network.name)
# ovs_command_execute(cmd_list)
def get_fport_for_network(network): def get_fport_for_network(network):
...@@ -130,4 +206,4 @@ def get_fport_for_network(network): ...@@ -130,4 +206,4 @@ def get_fport_for_network(network):
''' '''
output = subprocess.check_output( output = subprocess.check_output(
['sudo', 'ovs-vsctl', 'get', 'Interface', network.name, 'ofport']) ['sudo', 'ovs-vsctl', 'get', 'Interface', network.name, 'ofport'])
return output return output.strip()
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or sign in to comment