x/vmware-nsx
Code Issues Proposed changes

NSX|V: no spoofguard policy for portgroup provider network

Browse Source 
The patch ensures that we do not create a spoofguard policy
for provider network port groups. This makes sure that the network
continues to behave as it did prior to attaching it to
OpenStack

Change-Id: I2466f3e3168afe68724d65f8a6463a0453bdf8db
This commit is contained in:
Gary Kotton 2017-11-29 23:40:43 -08:00
parent 78aae2093d
commit 51756e568a
2 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
vmware_nsx/plugins/nsx_v/plugin.py
View File

@ -1030,6 +1030,9 @@ class NsxVPluginV2(addr_pair_db.AllowedAddressPairsMixin,
for ep in policy['enforcementPoints']: for ep in policy['enforcementPoints']:
if ep['id'] == net_morefs[0]: if ep['id'] == net_morefs[0]:
return policy['policyId'], True return policy['policyId'], True
LOG.warning("No spoofguard policy will be created for %s",
net_data['id'])
return None, False
# Always use enabled spoofguard policy. ports with disabled port # Always use enabled spoofguard policy. ports with disabled port
# security will be added to the exclude list # security will be added to the exclude list
sg_policy_id = self.nsx_v.vcns.create_spoofguard_policy( sg_policy_id = self.nsx_v.vcns.create_spoofguard_policy(
@ -1284,7 +1287,8 @@ class NsxVPluginV2(addr_pair_db.AllowedAddressPairsMixin,
nsx_db.add_neutron_nsx_network_mapping( nsx_db.add_neutron_nsx_network_mapping(
context.session, new_net['id'], context.session, new_net['id'],
net_moref) net_moref)
if cfg.CONF.nsxv.spoofguard_enabled and backend_network: if (cfg.CONF.nsxv.spoofguard_enabled and
backend_network and sg_policy_id):
nsxv_db.map_spoofguard_policy_for_network( nsxv_db.map_spoofguard_policy_for_network(
context.session, new_net['id'], sg_policy_id) context.session, new_net['id'], sg_policy_id)
@ -4356,6 +4360,10 @@ class NsxVPluginV2(addr_pair_db.AllowedAddressPairsMixin,
def _update_vnic_assigned_addresses(self, session, port, vnic_id): def _update_vnic_assigned_addresses(self, session, port, vnic_id):
sg_policy_id = nsxv_db.get_spoofguard_policy_id( sg_policy_id = nsxv_db.get_spoofguard_policy_id(
session, port['network_id']) session, port['network_id'])
if not sg_policy_id:
LOG.warning("Spoofguard not defined for network %s",
port['network_id'])
return
mac_addr = port['mac_address'] mac_addr = port['mac_address']
approved_addrs = [addr['ip_address'] for addr in port['fixed_ips']] approved_addrs = [addr['ip_address'] for addr in port['fixed_ips']]
# add in the address pair # add in the address pair

11
vmware_nsx/tests/unit/nsx_v/vshield/fake_vcns.py
View File

@ -1113,22 +1113,25 @@ class FakeVcns(object):
'operationMode': 'MANUAL' if enable else 'DISABLE'} 'operationMode': 'MANUAL' if enable else 'DISABLE'}
policy_id = len(self._spoofguard_policies) policy_id = len(self._spoofguard_policies)
self._spoofguard_policies.append(policy) self._spoofguard_policies.append(policy)
return None, policy_id return None, 'spoofguardpolicy-%s' % policy_id
def _get_index(self, policy_id):
return int(policy_id.split('-')[-1])
def update_spoofguard_policy(self, policy_id, def update_spoofguard_policy(self, policy_id,
enforcement_points, name, enable): enforcement_points, name, enable):
policy = {'name': name, policy = {'name': name,
'enforcementPoints': [{'id': enforcement_points[0]}], 'enforcementPoints': [{'id': enforcement_points[0]}],
'operationMode': 'MANUAL' if enable else 'DISABLE'} 'operationMode': 'MANUAL' if enable else 'DISABLE'}
self._spoofguard_policies[int(policy_id)] = policy self._spoofguard_policies[self._get_index(policy_id)] = policy
return None, '' return None, ''
def delete_spoofguard_policy(self, policy_id): def delete_spoofguard_policy(self, policy_id):
self._spoofguard_policies[int(policy_id)] = {} self._spoofguard_policies[self._get_index(policy_id)] = {}
def get_spoofguard_policy(self, policy_id): def get_spoofguard_policy(self, policy_id):
try: try:
return None, self._spoofguard_policies[int(policy_id)] return None, self._spoofguard_policies[self._get_index(policy_id)]
except IndexError: except IndexError:
raise exceptions.VcnsGeneralException( raise exceptions.VcnsGeneralException(
_("Spoofguard policy not found")) _("Spoofguard policy not found"))