# Licensed to the Apache Software Foundation (ASF) under one # or more contributor license agreements. See the NOTICE file # distributed with this work for additional information # regarding copyright ownership. The ASF licenses this file # to you under the Apache License, Version 2.0 (the # "License"); you may not use this file except in compliance # with the License. You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, # software distributed under the License is distributed on an # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. # cloudstack_pluginlib for openvswitch on KVM hypervisor import ConfigParser import logging import os import subprocess from time import localtime, asctime DEFAULT_LOG_FORMAT = "%(asctime)s %(levelname)8s [%(name)s] %(message)s" DEFAULT_LOG_DATE_FORMAT = "%Y-%m-%d %H:%M:%S" DEFAULT_LOG_FILE = "/var/log/cloudstack_plugins.log" PLUGIN_CONFIG_PATH = "/usr/share/cloudstack-common/scripts/vm/hypervisor/xenserver/cloudstack_plugins.conf" OVSDB_PID_PATH = "/var/run/openvswitch/ovsdb-server.pid" OVSDB_DAEMON_PATH = "ovsdb-server" OVS_PID_PATH = "/var/run/openvswitch/ovs-vswitchd.pid" OVS_DAEMON_PATH = "ovs-vswitchd" VSCTL_PATH = "/usr/bin/ovs-vsctl" OFCTL_PATH = "/usr/bin/ovs-ofctl" class PluginError(Exception): """Base Exception class for all plugin errors.""" def __init__(self, *args): Exception.__init__(self, *args) def setup_logging(log_file=None): debug = False verbose = False log_format = DEFAULT_LOG_FORMAT log_date_format = DEFAULT_LOG_DATE_FORMAT # try to read plugin configuration file if os.path.exists(PLUGIN_CONFIG_PATH): config = ConfigParser.ConfigParser() config.read(PLUGIN_CONFIG_PATH) try: options = config.options('LOGGING') if 'debug' in options: debug = config.getboolean('LOGGING', 'debug') if 'verbose' in options: verbose = config.getboolean('LOGGING', 'verbose') if 'format' in options: log_format = config.get('LOGGING', 'format') if 'date_format' in options: log_date_format = config.get('LOGGING', 'date_format') if 'file' in options: log_file_2 = config.get('LOGGING', 'file') except ValueError: # configuration file contained invalid attributes # ignore them pass except ConfigParser.NoSectionError: # Missing 'Logging' section in configuration file pass root_logger = logging.root if debug: root_logger.setLevel(logging.DEBUG) elif verbose: root_logger.setLevel(logging.INFO) else: root_logger.setLevel(logging.WARNING) formatter = logging.Formatter(log_format, log_date_format) log_filename = log_file or log_file_2 or DEFAULT_LOG_FILE logfile_handler = logging.FileHandler(log_filename) logfile_handler.setFormatter(formatter) root_logger.addHandler(logfile_handler) def do_cmd(cmd): """Abstracts out the basics of issuing system commands. If the command returns anything in stderr, a PluginError is raised with that information. Otherwise, the output from stdout is returned. """ pipe = subprocess.PIPE logging.debug("Executing:%s", cmd) proc = subprocess.Popen(cmd, shell=False, stdin=pipe, stdout=pipe, stderr=pipe, close_fds=True) ret_code = proc.wait() err = proc.stderr.read() if ret_code: logging.debug("The command exited with the error code: " + "%s (stderr output:%s)" % (ret_code, err)) raise PluginError(err) output = proc.stdout.read() if output.endswith('\n'): output = output[:-1] return output def _is_process_run(pidFile, name): try: fpid = open(pidFile, "r") pid = fpid.readline() fpid.close() except IOError, e: return -1 pid = pid[:-1] ps = os.popen("ps -ae") for l in ps: if pid in l and name in l: ps.close() return 0 ps.close() return -2 def _is_tool_exist(name): if os.path.exists(name): return 0 return -1 def check_switch(): global result ret = _is_process_run(OVSDB_PID_PATH, OVSDB_DAEMON_PATH) if ret < 0: if ret == -1: return "NO_DB_PID_FILE" if ret == -2: return "DB_NOT_RUN" ret = _is_process_run(OVS_PID_PATH, OVS_DAEMON_PATH) if ret < 0: if ret == -1: return "NO_SWITCH_PID_FILE" if ret == -2: return "SWITCH_NOT_RUN" if _is_tool_exist(VSCTL_PATH) < 0: return "NO_VSCTL" if _is_tool_exist(OFCTL_PATH) < 0: return "NO_OFCTL" return "SUCCESS" def _build_flow_expr(**kwargs): is_delete_expr = kwargs.get('delete', False) flow = "" if not is_delete_expr: flow = "hard_timeout=%s,idle_timeout=%s,priority=%s"\ % (kwargs.get('hard_timeout', '0'), kwargs.get('idle_timeout', '0'), kwargs.get('priority', '1')) in_port = 'in_port' in kwargs and ",in_port=%s" % kwargs['in_port'] or '' dl_type = 'dl_type' in kwargs and ",dl_type=%s" % kwargs['dl_type'] or '' dl_src = 'dl_src' in kwargs and ",dl_src=%s" % kwargs['dl_src'] or '' dl_dst = 'dl_dst' in kwargs and ",dl_dst=%s" % kwargs['dl_dst'] or '' nw_src = 'nw_src' in kwargs and ",nw_src=%s" % kwargs['nw_src'] or '' nw_dst = 'nw_dst' in kwargs and ",nw_dst=%s" % kwargs['nw_dst'] or '' table = 'table' in kwargs and ",table=%s" % kwargs['table'] or '' proto = 'proto' in kwargs and ",%s" % kwargs['proto'] or '' ip = ('nw_src' in kwargs or 'nw_dst' in kwargs) and ',ip' or '' flow = (flow + in_port + dl_type + dl_src + dl_dst + (ip or proto) + nw_src + nw_dst) return flow def add_flow(bridge, **kwargs): """ Builds a flow expression for **kwargs and adds the flow entry to an Open vSwitch instance """ flow = _build_flow_expr(**kwargs) actions = 'actions' in kwargs and ",actions=%s" % kwargs['actions'] or '' flow = flow + actions addflow = [OFCTL_PATH, "add-flow", bridge, flow] do_cmd(addflow) def del_flows(bridge, **kwargs): """ Removes flows according to criteria passed as keyword. """ flow = _build_flow_expr(delete=True, **kwargs) # out_port condition does not exist for all flow commands out_port = ("out_port" in kwargs and ",out_port=%s" % kwargs['out_port'] or '') flow = flow + out_port delFlow = [OFCTL_PATH, 'del-flows', bridge, flow] do_cmd(delFlow) def del_all_flows(bridge): delFlow = [OFCTL_PATH, "del-flows", bridge] do_cmd(delFlow) normalFlow = "priority=0 idle_timeout=0 hard_timeout=0 actions=normal" add_flow(bridge, normalFlow) def del_port(bridge, port): delPort = [VSCTL_PATH, "del-port", bridge, port] do_cmd(delPort) def get_network_id_for_vif(vif_name): domain_id, device_id = vif_name[3:len(vif_name)].split(".") dom_uuid = do_cmd([XE_PATH, "vm-list", "dom-id=%s" % domain_id, "--minimal"]) vif_uuid = do_cmd([XE_PATH, "vif-list", "vm-uuid=%s" % dom_uuid, "device=%s" % device_id, "--minimal"]) vnet = do_cmd([XE_PATH, "vif-param-get", "uuid=%s" % vif_uuid, "param-name=other-config", "param-key=cloudstack-network-id"]) return vnet def get_network_id_for_tunnel_port(tunnelif_name): vnet = do_cmd([VSCTL_PATH, "get", "interface", tunnelif_name, "options:cloudstack-network-id"]) return vnet def clear_flooding_rules_for_port(bridge, ofport): del_flows(bridge, in_port=ofport, table=2) def add_flooding_rules_for_port(bridge, in_ofport, out_ofports): action = "".join("output:%s," %ofport for ofport in out_ofports)[:-1] add_flow(bridge, priority=1100, in_port=in_ofport, table=1, actions=action) def get_ofport_for_vif(vif_name): return do_cmd([VSCTL_PATH, "get", "interface", vif_name, "ofport"]) def get_macaddress_of_vif(vif_name): domain_id, device_id = vif_name[3:len(vif_name)].split(".") dom_uuid = do_cmd([XE_PATH, "vm-list", "dom-id=%s" % domain_id, "--minimal"]) vif_uuid = do_cmd([XE_PATH, "vif-list", "vm-uuid=%s" % dom_uuid, "device=%s" % device_id, "--minimal"]) mac = do_cmd([XE_PATH, "vif-param-get", "uuid=%s" % vif_uuid, "param-name=MAC"]) return mac def get_vif_name_from_macaddress(macaddress): vif_uuid = do_cmd([XE_PATH, "vif-list", "MAC=%s" % macaddress, "--minimal"]) vif_device_id = do_cmd([XE_PATH, "vif-param-get", "uuid=%s" % vif_uuid, "param-name=device"]) vm_uuid = do_cmd([XE_PATH, "vif-param-get", "uuid=%s" % vif_uuid, "param-name=vm-uuid"]) vm_domain_id = do_cmd([XE_PATH, "vm-param-get", "uuid=%s" % vm_uuid, "param-name=dom-id"]) return "vif"+vm_domain_id+"."+vif_device_id def add_mac_lookup_table_entry(bridge, mac_address, out_of_port): add_flow(bridge, priority=1100, dl_dst=mac_address, table=1, actions="output:%s" % out_of_port) def delete_mac_lookup_table_entry(bridge, mac_address): del_flows(bridge, dl_dst=mac_address, table=1) def add_ip_lookup_table_entry(bridge, ip, dst_tier_gateway_mac, dst_vm_mac): action_str = "mod_dl_sr:%s" % dst_tier_gateway_mac + ",mod_dl_dst:%s" % dst_vm_mac +",resubmit(,5)" addflow = [OFCTL_PATH, "add-flow", bridge, "table=4", "nw_dst=%s" % ip, "actions=%s" %action_str] do_cmd(addflow) def get_vms_on_host(vpc, host_id): all_vms = vpc.vms vms_on_host = [] for vm in all_vms: if vm.hostid == host_id: vms_on_host.append(vm) return vms_on_host def get_network_details(vpc, network_uuid): tiers = vpc.tiers for tier in tiers: if tier.networkuuid == network_uuid: return tier return None class jsonLoader(object): def __init__(self, obj): for k in obj: v = obj[k] if isinstance(v, dict): setattr(self, k, jsonLoader(v)) elif isinstance(v, (list, tuple)): if len(v) > 0 and isinstance(v[0], dict): setattr(self, k, [jsonLoader(elem) for elem in v]) else: setattr(self, k, v) else: setattr(self, k, v) def __getattr__(self, val): if val in self.__dict__: return self.__dict__[val] else: return None def __repr__(self): return '{%s}' % str(', '.join('%s : %s' % (k, repr(v)) for (k, v) in self.__dict__.iteritems())) def __str__(self): return '{%s}' % str(', '.join('%s : %s' % (k, repr(v)) for (k, v) in self.__dict__.iteritems())) def configure_bridge_for_network_topology(bridge, this_host_id, json_config): vpconfig = jsonLoader(json.loads(json_config)).vpc if vpconfig is None: logging.debug("WARNING:Can't find VPC info in json config file") return "FAILURE:IMPROPER_JSON_CONFG_FILE" # get the list of Vm's in the VPC from the JSON config this_host_vms = get_vms_on_host(vpconfig, this_host_id) for vm in this_host_vms: for nic in vm.nics: mac_addr = nic.macaddress ip = nic.ipaddress vif_name = get_vif_name_from_macaddress(mac_addr) of_port = get_ofport_for_vif(vif_name) network = get_network_details(vpconfig, nic.networkuuid) # Add flow rule in L2 look up table, if the destination mac = MAC of the nic send packet on the found OFPORT add_mac_lookup_table_entry(bridge, mac_addr, of_port) # Add flow rule in L3 look up table: if the destination IP = VM's IP then modify the packet # to set DST MAC = VM's MAC, SRC MAC=tier gateway MAC and send to egress table add_ip_lookup_table_entry(bridge, ip, network.gatewaymac, mac_addr) # Add flow entry to send with intra tier traffic from the NIC to L2 lookup path) addflow = [OFCTL_PATH, "add-flow", bridge, "table=0", "in_port=%s" % of_port, "nw_dst=%s" %network.cidr, "actions=resubmit(,1)"] do_cmd(addflow) #add flow entry to send inter-tier traffic from the NIC to egress ACL table(to L3 lookup path) addflow = [OFCTL_PATH, "add-flow", bridge, "table=0", "in_port=%s" % of_port, "dl_dst=%s" %network.gatewaymac, "nw_dst=%s" %vpconfig.cidr, "actions=resubmit(,3)"] do_cmd(addflow) # get the list of hosts on which VPC spans from the JSON config vpc_spanning_hosts = vpconfig.hosts for host in vpc_spanning_hosts: if this_host_id == host.hostid: continue other_host_vms = get_vms_on_host(vpconfig, host.hostid) for vm in other_host_vms: for nic in vm.nics: mac_addr = nic.macaddress ip = nic.ipaddress network = get_network_details(vpconfig, nic.networkuuid) gre_key = network.grekey # generate tunnel name from tunnel naming convention tunnel_name = "t%s-%s-%s" % (gre_key, this_host_id, host.hostid) of_port = get_ofport_for_vif(tunnel_name) # Add flow rule in L2 look up table, if the destination mac = MAC of the nic send packet tunnel port add_mac_lookup_table_entry(bridge, mac_addr, of_port) # Add flow tule in L3 look up table: if the destination IP = VM's IP then modify the packet # set DST MAC = VM's MAC, SRC MAC=tier gateway MAC and send to egress table add_ip_lookup_table_entry(bridge, ip, network.gatewaymac, mac_addr) return "SUCCESS: successfully configured bridge as per the VPC topology" def get_acl(vpcconfig, required_acl_id): acls = vpcconfig.acls for acl in acls: if acl.id == required_acl_id: return acl return None def configure_ovs_bridge_for_routing_policies(bridge, json_config): vpconfig = jsonLoader(json.loads(json_config)).vpc if vpconfig is None: logging.debug("WARNING:Can't find VPC info in json config file") return "FAILURE:IMPROPER_JSON_CONFG_FILE" # First flush current egress ACL's before re-applying the ACL's del_flows(bridge, table=3) egress_rules_added = False ingress_rules_added = False tiers = vpconfig.tiers for tier in tiers: tier_cidr = tier.cidr acl = get_acl(vpconfig, tier.aclid) acl_items = acl.aclitems for acl_item in acl_items: number = acl_item.number action = acl_item.action direction = acl_item.direction source_port_start = acl_item.sourceportstart source_port_end = acl_item.sourceportend protocol = acl_item.protocol source_cidrs = acl_item.sourcecidrs acl_priority = 1000 + number for source_cidr in source_cidrs: if direction is "ingress": ingress_rules_added = True # add flow rule to do action (allow/deny) for flows where source IP of the packet is in # source_cidr and destination ip is in tier_cidr port = source_port_start while (port < source_port_end): if action is "deny": add_flow(bridge, priority= acl_priority, table=5, nw_src=source_cidr, nw_dst=tier_cidr, tp_dst=port, nw_proto=protocol, actions='drop') if action is "allow": add_flow(bridge, priority= acl_priority,table=5, nw_src=source_cidr, nw_dst=tier_cidr, tp_dst=port, nw_proto=protocol, actions='resubmit(,1)') port = port + 1 elif direction in "egress": egress_rules_added = True # add flow rule to do action (allow/deny) for flows where destination IP of the packet is in # source_cidr and source ip is in tier_cidr port = source_port_start while (port < source_port_end): if action is "deny": add_flow(bridge, priority= acl_priority, table=5, nw_src=tier_cidr, nw_dst=source_cidr, tp_dst=port, nw_proto=protocol, actions='drop') if action is "allow": add_flow(bridge, priority= acl_priority, table=5, nw_src=tier_cidr, nw_dst=source_cidr, tp_dst=port, nw_proto=protocol, actions='resubmit(,1)') port = port + 1 if egress_rules_added is False: # add a default rule in egress table to forward packet to L3 lookup table add_flow(bridge, priority=0, table=3, actions='resubmit(,4)') if ingress_rules_added is False: # add a default rule in egress table drop packets add_flow(bridge, priority=0, table=5, actions='drop')