Ejemplo n.º 1
0
    def _update_subnets_and_dnat_firewall_on_routers(self, context,
                                                     target_router_id,
                                                     router_ids,
                                                     allow_external=True):
        fake_fw_rules = []
        for router_id in router_ids:
            router_qry = context.session.query(l3_db.Router)
            router = router_qry.filter_by(id=router_id).one()
            subnet_cidrs = self.plugin._find_router_subnets_cidrs(
                context, router['id'])
            routes = self.plugin._get_extra_routes_by_router_id(
                context, router['id'])
            subnet_cidrs.extend([route['destination'] for route in routes])
            if subnet_cidrs:
                # Fake fw rule to open subnets firewall flows and static routes
                # relative flows
                fake_subnet_fw_rule = {
                    'action': 'allow',
                    'enabled': True,
                    'source_ip_address': subnet_cidrs,
                    'destination_ip_address': subnet_cidrs}
                fake_fw_rules.append(fake_subnet_fw_rule)
            _, dnat_rules = self.plugin._get_nat_rules(context, router)
            dnat_cidrs = [rule['dst'] for rule in dnat_rules]
            if dnat_cidrs:
                # Fake fw rule to open dnat firewall flows
                fake_dnat_fw_rule = {
                    'action': 'allow',
                    'enabled': True,
                    'destination_ip_address': dnat_cidrs}
                fake_fw_rules.append(fake_dnat_fw_rule)
            nosnat_fw_rules = self.plugin._get_nosnat_subnets_fw_rules(
                context, router)
            fake_fw_rules.extend(nosnat_fw_rules)

        # If metadata service is enabled, block access to inter-edge network
        if self.plugin.metadata_proxy_handler:
            fake_fw_rules += (
                nsx_v_md_proxy.get_router_fw_rules())

        # TODO(berlin): Add fw rules if fw service is supported
        fake_fw = {'firewall_rule_list': fake_fw_rules}
        edge_utils.update_firewall(self.nsx_v, context, target_router_id,
                                   fake_fw, allow_external=allow_external)
Ejemplo n.º 2
0
    def _get_proxy_edge(self, rtr_ip):

        # If DB Entry already defined by another Neutron instance, retrieve
        # its IP address and exit
        try:
            nsxv_db.create_nsxv_internal_edge(
                self.context.session,
                rtr_ip,
                vcns_const.InternalEdgePurposes.INTER_EDGE_PURPOSE,
                None)
        except db_exc.DBDuplicateEntry:
            edge_ip = None
            ctr = 0
            while edge_ip is None and ctr < EDGE_WAIT_INTERVAL:
                rtr_list = nsxv_db.get_nsxv_internal_edge(
                    self.context.session, rtr_ip)
                if rtr_list:
                    rtr_id = rtr_list[0]['router_id']
                    if rtr_id:
                        edge_ip = self._get_edge_internal_ip(rtr_id)
                        if edge_ip:
                            return edge_ip

                self.context.session.expire_all()
                ctr += EDGE_CHECK_INTERVAL
                time.sleep(EDGE_CHECK_INTERVAL)

            error = _('Metadata proxy creation on other neutron instance '
                      'timed out')
            raise nsxv_exc.NsxPluginException(err_msg=error)

        rtr_id = None
        try:
            router_data = {
                'router': {
                    'name': 'metadata_proxy_router',
                    'admin_state_up': True,
                    'router_type': 'exclusive',
                    'tenant_id': None}}

            rtr = self.nsxv_plugin.create_router(
                self.context,
                router_data,
                allow_metadata=False)

            rtr_id = rtr['id']
            binding = nsxv_db.get_nsxv_router_binding(
                self.context.session,
                rtr_id)

            self.nsxv_plugin.nsx_v.update_interface(
                rtr['id'],
                binding['edge_id'],
                vcns_const.EXTERNAL_VNIC_INDEX,
                cfg.CONF.nsxv.mgt_net_moid,
                address=rtr_ip,
                netmask=cfg.CONF.nsxv.mgt_net_proxy_netmask,
                secondary=[])

            port_data = {
                'port': {
                    'network_id': self.internal_net,
                    'name': None,
                    'admin_state_up': True,
                    'device_id': rtr_id,
                    'device_owner': constants.DEVICE_OWNER_ROUTER_INTF,
                    'fixed_ips': attr.ATTR_NOT_SPECIFIED,
                    'mac_address': attr.ATTR_NOT_SPECIFIED,
                    'port_security_enabled': False,
                    'tenant_id': None}}

            port = self.nsxv_plugin.create_port(self.context, port_data)

            address_groups = self._get_address_groups(
                self.context, self.internal_net, rtr_id, is_proxy=True)

            edge_ip = port['fixed_ips'][0]['ip_address']
            edge_utils.update_internal_interface(
                self.nsxv_plugin.nsx_v, self.context, rtr_id,
                self.internal_net, address_groups)

            self._setup_metadata_lb(rtr_id,
                                    port['fixed_ips'][0]['ip_address'],
                                    cfg.CONF.nsxv.nova_metadata_port,
                                    cfg.CONF.nsxv.nova_metadata_port,
                                    cfg.CONF.nsxv.nova_metadata_ips,
                                    proxy_lb=True)

            firewall_rule = {
                'action': 'allow',
                'enabled': True,
                'source_ip_address': [INTERNAL_SUBNET]}

            edge_utils.update_firewall(
                self.nsxv_plugin.nsx_v,
                self.context,
                rtr_id,
                {'firewall_rule_list': [firewall_rule]},
                allow_external=False)

            if cfg.CONF.nsxv.mgt_net_default_gateway:
                self.nsxv_plugin._update_routes(
                    self.context, rtr_id,
                    cfg.CONF.nsxv.mgt_net_default_gateway)

            nsxv_db.update_nsxv_internal_edge(
                self.context.session,
                rtr_ip,
                rtr_id)

            return edge_ip

        except Exception as e:
            with excutils.save_and_reraise_exception():
                nsxv_db.delete_nsxv_internal_edge(
                    self.context.session,
                    rtr_ip)

                if rtr_id:
                    self.nsxv_plugin.delete_router(self.context, rtr_id)
                LOG.exception(_LE("Exception %s while creating internal edge "
                                  "for metadata service"), e)
Ejemplo n.º 3
0
    def _setup_new_proxy_edge(self, rtr_ext_ip):
        rtr_id = None
        try:
            router_data = {
                'router': {
                    'name': 'metadata_proxy_router',
                    'admin_state_up': True,
                    'router_type': 'exclusive',
                    'tenant_id': None}}

            rtr = self.nsxv_plugin.create_router(
                self.context,
                router_data,
                allow_metadata=False)

            rtr_id = rtr['id']
            edge_id = self._get_edge_id_by_rtr_id(rtr_id)

            self.nsxv_plugin.nsx_v.update_interface(
                rtr['id'],
                edge_id,
                vcns_const.EXTERNAL_VNIC_INDEX,
                cfg.CONF.nsxv.mgt_net_moid,
                address=rtr_ext_ip,
                netmask=cfg.CONF.nsxv.mgt_net_proxy_netmask,
                secondary=[])

            port_data = {
                'port': {
                    'network_id': self.internal_net,
                    'name': None,
                    'admin_state_up': True,
                    'device_id': rtr_id,
                    'device_owner': constants.DEVICE_OWNER_ROUTER_INTF,
                    'fixed_ips': attr.ATTR_NOT_SPECIFIED,
                    'mac_address': attr.ATTR_NOT_SPECIFIED,
                    'port_security_enabled': False,
                    'tenant_id': None}}

            port = self.nsxv_plugin.create_port(self.context, port_data)

            address_groups = self._get_address_groups(
                self.context, self.internal_net, rtr_id, is_proxy=True)

            edge_ip = port['fixed_ips'][0]['ip_address']
            edge_utils.update_internal_interface(
                self.nsxv_plugin.nsx_v, self.context, rtr_id,
                self.internal_net, address_groups)

            self._setup_metadata_lb(rtr_id,
                                    port['fixed_ips'][0]['ip_address'],
                                    cfg.CONF.nsxv.nova_metadata_port,
                                    cfg.CONF.nsxv.nova_metadata_port,
                                    cfg.CONF.nsxv.nova_metadata_ips,
                                    proxy_lb=True)

            firewall_rules = [
                DEFAULT_EDGE_FIREWALL_RULE,
                {
                    'action': 'allow',
                    'enabled': True,
                    'source_ip_address': [INTERNAL_SUBNET]}]

            edge_utils.update_firewall(
                self.nsxv_plugin.nsx_v,
                self.context,
                rtr_id,
                {'firewall_rule_list': firewall_rules},
                allow_external=False)

            if cfg.CONF.nsxv.mgt_net_default_gateway:
                self.nsxv_plugin._update_routes(
                    self.context, rtr_id,
                    cfg.CONF.nsxv.mgt_net_default_gateway)

            nsxv_db.create_nsxv_internal_edge(
                self.context.session, rtr_ext_ip,
                vcns_const.InternalEdgePurposes.INTER_EDGE_PURPOSE, rtr_id)

            return edge_ip

        except Exception as e:
            LOG.exception(_LE("Exception %s while creating internal edge "
                              "for metadata service"), e)

            ports = self.nsxv_plugin.get_ports(
                self.context, filters={'device_id': [rtr_id]})

            for port in ports:
                self.nsxv_plugin.delete_port(self.context, port['id'],
                                             l3_port_check=True,
                                             nw_gw_port_check=True)

            nsxv_db.delete_nsxv_internal_edge(
                self.context.session,
                rtr_ext_ip)

            if rtr_id:
                self.nsxv_plugin.delete_router(self.context, rtr_id)