womax/nova
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Move setting of device trust to privsep."

Browse Source
This commit is contained in:
Zuul
2019-08-21 17:31:59 +00:00
committed by Gerrit Code Review
parent 9950b6b415 d45be94fdf
commit 6ddfad5935
3 changed files with 38 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nova/network/linux_net.py
+5 -11
View File
@@ -1603,12 +1603,9 @@ class LinuxOVSInterfaceDriver(LinuxNetInterfaceDriver):
if not gateway:
# If we weren't instructed to act as a gateway then add the
# appropriate flows to block all non-dhcp traffic.
_execute('ovs-ofctl',
'add-flow', bridge, 'priority=1,actions=drop',
run_as_root=True)
_execute('ovs-ofctl', 'add-flow', bridge,
'udp,tp_dst=67,dl_dst=%s,priority=2,actions=normal' %
mac_address, run_as_root=True)
nova.privsep.linux_net.ovs_drop_nondhcp(
bridge, mac_address)
# .. and make sure iptbles won't forward it as well.
iptables_manager.ipv4['filter'].add_rule('FORWARD',
'--in-interface %s -j %s' % (bridge,
@@ -1653,8 +1650,5 @@ def set_vf_trusted(pci_addr, trusted):
pf_ifname = pci_utils.get_ifname_by_pci_address(pci_addr,
pf_interface=True)
vf_num = pci_utils.get_vf_num_by_pci_address(pci_addr)
utils.execute('ip', 'link', 'set', pf_ifname,
'vf', vf_num,
'trust', bool(trusted) and 'on' or 'off',
run_as_root=True,
check_exit_code=[0, 2, 254])
nova.privsep.linux_net.set_device_trust(
pf_ifname, vf_num, trusted)
nova/privsep/linux_net.py
+21
View File
@@ -88,6 +88,18 @@ def _set_device_enabled_inner(dev):
check_exit_code=[0, 2, 254])
@nova.privsep.sys_admin_pctxt.entrypoint
def set_device_trust(dev, vf_num, trusted):
_set_device_trust_inner(dev, vf_num, trusted)
def _set_device_trust_inner(dev, vf_num, trusted):
processutils.execute('ip', 'link', 'set', dev,
'vf', vf_num,
'trust', bool(trusted) and 'on' or 'off',
check_exit_code=[0, 2, 254])
@nova.privsep.sys_admin_pctxt.entrypoint
def set_device_disabled(dev):
processutils.execute('ip', 'link', 'set', dev, 'down')
@@ -363,6 +375,15 @@ def ovs_plug(timeout, bridge, dev, mac_address):
'external-ids:attached-mac=%s' % mac_address)
@nova.privsep.sys_admin_pctxt.entrypoint
def ovs_drop_nondhcp(bridge, mac_address):
processutils.execute(
'ovs-ofctl', 'add-flow', bridge, 'priority=1,actions=drop')
processutils.execute(
'ovs-ofctl', 'add-flow', bridge,
'udp,tp_dst=67,dl_dst=%s,priority=2,actions=normal' % mac_address)
@nova.privsep.sys_admin_pctxt.entrypoint
def ovs_unplug(timeout, bridge, dev):
processutils.execute('ovs-vsctl', '--timeout=%s' % timeout,
nova/tests/unit/network/test_linux_net.py
+12 -6
View File
@@ -1401,22 +1401,28 @@ class LinuxNetworkTestCase(test.NoDBTestCase):
@mock.patch('nova.pci.utils.get_vf_num_by_pci_address')
@mock.patch('nova.pci.utils.get_ifname_by_pci_address')
@mock.patch('nova.utils.execute')
def test_set_vf_trusted_on(self, mexecute, mget_ifname, mget_vfnum):
@mock.patch('nova.privsep.linux_net.set_device_trust',
side_effect=nova.privsep.linux_net._set_device_trust_inner)
@mock.patch('oslo_concurrency.processutils.execute')
def test_set_vf_trusted_on(self, mexecute, mtrust, mget_ifname,
mget_vfnum):
mget_ifname.return_value = 'eth0'
mget_vfnum.return_value = 2
linux_net.set_vf_trusted('PCI_ADDR', True)
mexecute.assert_called_once_with(
'ip', 'link', 'set', 'eth0', 'vf', 2, 'trust', 'on',
check_exit_code=[0, 2, 254], run_as_root=True)
check_exit_code=[0, 2, 254])
@mock.patch('nova.pci.utils.get_vf_num_by_pci_address')
@mock.patch('nova.pci.utils.get_ifname_by_pci_address')
@mock.patch('nova.utils.execute')
def test_set_vf_trusted_off(self, mexecute, mget_ifname, mget_vfnum):
@mock.patch('nova.privsep.linux_net.set_device_trust',
side_effect=nova.privsep.linux_net._set_device_trust_inner)
@mock.patch('oslo_concurrency.processutils.execute')
def test_set_vf_trusted_off(self, mexecute, mtrust, mget_ifname,
mget_vfnum):
mget_ifname.return_value = 'eth0'
mget_vfnum.return_value = 2
linux_net.set_vf_trusted('PCI_ADDR', False)
mexecute.assert_called_once_with(
'ip', 'link', 'set', 'eth0', 'vf', 2, 'trust', 'off',
check_exit_code=[0, 2, 254], run_as_root=True)
check_exit_code=[0, 2, 254])