snaps/openstack/create_security_group.py

   1 # Copyright (c) 2017 Cable Television Laboratories, Inc. ("CableLabs")
   2 #                    and others.  All rights reserved.
   3 #
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at:
   7 #
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15 import logging
  16
  17 import enum
  18 from neutronclient.common.exceptions import NotFound, Conflict
  19
  20 from snaps.config.security_group import (
  21     SecurityGroupConfig, SecurityGroupRuleConfig)
  22 from snaps.openstack.openstack_creator import OpenStackNetworkObject
  23 from snaps.openstack.utils import keystone_utils
  24 from snaps.openstack.utils import neutron_utils
  25
  26 __author__ = 'spisarski'
  27
  28 logger = logging.getLogger('OpenStackSecurityGroup')
  29
  30
  31 class OpenStackSecurityGroup(OpenStackNetworkObject):
  32     """
  33     Class responsible for managing a Security Group in OpenStack
  34     """
  35
  36     def __init__(self, os_creds, sec_grp_settings):
  37         """
  38         Constructor - all parameters are required
  39         :param os_creds: The credentials to connect with OpenStack
  40         :param sec_grp_settings: The settings used to create a security group
  41         """
  42         super(self.__class__, self).__init__(os_creds)
  43
  44         self.sec_grp_settings = sec_grp_settings
  45
  46         # Attributes instantiated on create()
  47         self.__security_group = None
  48
  49         # dict where the rule settings object is the key
  50         self.__rules = dict()
  51
  52     def initialize(self):
  53         """
  54         Loads existing security group.
  55         :return: the security group domain object
  56         """
  57         super(self.__class__, self).initialize()
  58
  59         keystone = keystone_utils.keystone_client(self._os_creds)
  60         self.__security_group = neutron_utils.get_security_group(
  61             self._neutron, keystone, sec_grp_settings=self.sec_grp_settings,
  62             project_name=self._os_creds.project_name)
  63         if self.__security_group:
  64             # Populate rules
  65             existing_rules = neutron_utils.get_rules_by_security_group(
  66                 self._neutron, self.__security_group)
  67
  68             for existing_rule in existing_rules:
  69                 # For Custom Rules
  70                 rule_setting = self.__get_setting_from_rule(existing_rule)
  71                 self.__rules[rule_setting] = existing_rule
  72
  73             self.__security_group = neutron_utils.get_security_group_by_id(
  74                 self._neutron, self.__security_group.id)
  75
  76         return self.__security_group
  77
  78     def create(self):
  79         """
  80         Responsible for creating the security group.
  81         :return: the security group domain object
  82         """
  83         self.initialize()
  84
  85         if not self.__security_group:
  86             logger.info(
  87                 'Creating security group %s...' % self.sec_grp_settings.name)
  88
  89             keystone = keystone_utils.keystone_client(self._os_creds)
  90             self.__security_group = neutron_utils.create_security_group(
  91                 self._neutron, keystone, self.sec_grp_settings)
  92
  93             # Get the rules added for free
  94             auto_rules = neutron_utils.get_rules_by_security_group(
  95                 self._neutron, self.__security_group)
  96
  97             ctr = 0
  98             for auto_rule in auto_rules:
  99                 auto_rule_setting = self.__generate_rule_setting(auto_rule)
 100                 self.__rules[auto_rule_setting] = auto_rule
 101                 ctr += 1
 102
 103             # Create the custom rules
 104             for sec_grp_rule_setting in self.sec_grp_settings.rule_settings:
 105                 try:
 106                     custom_rule = neutron_utils.create_security_group_rule(
 107                         self._neutron, keystone, sec_grp_rule_setting,
 108                         self._os_creds.project_name)
 109                     self.__rules[sec_grp_rule_setting] = custom_rule
 110                 except Conflict as e:
 111                     logger.warn('Unable to create rule due to conflict - %s',
 112                                 e)
 113
 114             # Refresh security group object to reflect the new rules added
 115             self.__security_group = neutron_utils.get_security_group_by_id(
 116                 self._neutron, self.__security_group.id)
 117
 118         return self.__security_group
 119
 120     def __generate_rule_setting(self, rule):
 121         """
 122         Creates a SecurityGroupRuleConfig object for a given rule
 123         :param rule: the rule from which to create the
 124                     SecurityGroupRuleConfig object
 125         :return: the newly instantiated SecurityGroupRuleConfig object
 126         """
 127         sec_grp = neutron_utils.get_security_group_by_id(
 128             self._neutron, rule.security_group_id)
 129
 130         setting = SecurityGroupRuleConfig(
 131             description=rule.description,
 132             direction=rule.direction,
 133             ethertype=rule.ethertype,
 134             port_range_min=rule.port_range_min,
 135             port_range_max=rule.port_range_max,
 136             protocol=rule.protocol,
 137             remote_group_id=rule.remote_group_id,
 138             remote_ip_prefix=rule.remote_ip_prefix,
 139             sec_grp_name=sec_grp.name)
 140         return setting
 141
 142     def clean(self):
 143         """
 144         Removes and deletes the rules then the security group.
 145         """
 146         for setting, rule in self.__rules.items():
 147             try:
 148                 neutron_utils.delete_security_group_rule(self._neutron, rule)
 149             except NotFound as e:
 150                 logger.warning('Rule not found, cannot delete - ' + str(e))
 151                 pass
 152         self.__rules = dict()
 153
 154         if self.__security_group:
 155             try:
 156                 neutron_utils.delete_security_group(self._neutron,
 157                                                     self.__security_group)
 158             except NotFound as e:
 159                 logger.warning(
 160                     'Security Group not found, cannot delete - ' + str(e))
 161
 162             self.__security_group = None
 163
 164     def get_security_group(self):
 165         """
 166         Returns the OpenStack security group object
 167         :return:
 168         """
 169         return self.__security_group
 170
 171     def get_rules(self):
 172         """
 173         Returns the associated rules
 174         :return:
 175         """
 176         return self.__rules
 177
 178     def add_rule(self, rule_setting):
 179         """
 180         Adds a rule to this security group
 181         :param rule_setting: the rule configuration
 182         """
 183         rule_setting.sec_grp_name = self.sec_grp_settings.name
 184         keystone = keystone_utils.keystone_client(self._os_creds)
 185         new_rule = neutron_utils.create_security_group_rule(
 186             self._neutron, keystone, rule_setting, self._os_creds.project_name)
 187         self.__rules[rule_setting] = new_rule
 188         self.sec_grp_settings.rule_settings.append(rule_setting)
 189
 190     def remove_rule(self, rule_id=None, rule_setting=None):
 191         """
 192         Removes a rule to this security group by id, name, or rule_setting
 193         object
 194         :param rule_id: the rule's id
 195         :param rule_setting: the rule's setting object
 196         """
 197         rule_to_remove = None
 198         if rule_id or rule_setting:
 199             if rule_id:
 200                 rule_to_remove = neutron_utils.get_rule_by_id(
 201                     self._neutron, self.__security_group, rule_id)
 202             elif rule_setting:
 203                 rule_to_remove = self.__rules.get(rule_setting)
 204
 205         if rule_to_remove:
 206             neutron_utils.delete_security_group_rule(self._neutron,
 207                                                      rule_to_remove)
 208             rule_setting = self.__get_setting_from_rule(rule_to_remove)
 209             if rule_setting:
 210                 self.__rules.pop(rule_setting)
 211             else:
 212                 logger.warning('Rule setting is None, cannot remove rule')
 213
 214     def __get_setting_from_rule(self, rule):
 215         """
 216         Returns the associated RuleSetting object for a given rule
 217         :param rule: the Rule object
 218         :return: the associated RuleSetting object or None
 219         """
 220         for rule_setting in self.sec_grp_settings.rule_settings:
 221             if rule_setting.rule_eq(rule):
 222                 return rule_setting
 223         return None
 224
 225
 226 class SecurityGroupSettings(SecurityGroupConfig):
 227     """
 228     Class to hold the configuration settings required for creating OpenStack
 229     SecurityGroup objects
 230     deprecated - use snaps.config.security_group.SecurityGroupConfig instead
 231     """
 232
 233     def __init__(self, **kwargs):
 234         from warnings import warn
 235         warn('Use snaps.config.security_group.SecurityGroupConfig instead',
 236              DeprecationWarning)
 237         super(self.__class__, self).__init__(**kwargs)
 238
 239
 240 class Direction(enum.Enum):
 241     """
 242     A rule's direction
 243     deprecated - use snaps.config.security_group.Direction
 244     """
 245     ingress = 'ingress'
 246     egress = 'egress'
 247
 248
 249 class Protocol(enum.Enum):
 250     """
 251     A rule's protocol
 252     deprecated - use snaps.config.security_group.Protocol
 253     """
 254     ah = 51
 255     dccp = 33
 256     egp = 8
 257     esp = 50
 258     gre = 47
 259     icmp = 1
 260     icmpv6 = 58
 261     igmp = 2
 262     ipv6_encap = 41
 263     ipv6_frag = 44
 264     ipv6_icmp = 58
 265     ipv6_nonxt = 59
 266     ipv6_opts = 60
 267     ipv6_route = 43
 268     ospf = 89
 269     pgm = 113
 270     rsvp = 46
 271     sctp = 132
 272     tcp = 6
 273     udp = 17
 274     udplite = 136
 275     vrrp = 112
 276     any = 'any'
 277     null = 'null'
 278
 279
 280 class Ethertype(enum.Enum):
 281     """
 282     A rule's ethertype
 283     deprecated - use snaps.config.security_group.Ethertype
 284     """
 285     IPv4 = 4
 286     IPv6 = 6
 287
 288
 289 class SecurityGroupRuleSettings(SecurityGroupRuleConfig):
 290     """
 291     Class to hold the configuration settings required for creating OpenStack
 292     SecurityGroupRule objects
 293     deprecated - use snaps.config.security_group.SecurityGroupRuleConfig
 294     instead
 295     """
 296
 297     def __init__(self, **kwargs):
 298         from warnings import warn
 299         warn('Use snaps.config.security_group.SecurityGroupRuleConfig instead',
 300              DeprecationWarning)
 301         super(self.__class__, self).__init__(**kwargs)