snaps/openstack/create_security_group.py

   1 # Copyright (c) 2017 Cable Television Laboratories, Inc. ("CableLabs")
   2 #                    and others.  All rights reserved.
   3 #
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at:
   7 #
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15 import logging
  16
  17 import enum
  18 from neutronclient.common.exceptions import NotFound, Conflict
  19
  20 from snaps.config.security_group import (
  21     SecurityGroupConfig, SecurityGroupRuleConfig)
  22 from snaps.openstack.openstack_creator import OpenStackNetworkObject
  23 from snaps.openstack.utils import neutron_utils
  24
  25 __author__ = 'spisarski'
  26
  27 logger = logging.getLogger('OpenStackSecurityGroup')
  28
  29
  30 class OpenStackSecurityGroup(OpenStackNetworkObject):
  31     """
  32     Class responsible for managing a Security Group in OpenStack
  33     """
  34
  35     def __init__(self, os_creds, sec_grp_settings):
  36         """
  37         Constructor - all parameters are required
  38         :param os_creds: The credentials to connect with OpenStack
  39         :param sec_grp_settings: The settings used to create a security group
  40         """
  41         super(self.__class__, self).__init__(os_creds)
  42
  43         self.sec_grp_settings = sec_grp_settings
  44
  45         # Attributes instantiated on create()
  46         self.__security_group = None
  47
  48         # dict where the rule settings object is the key
  49         self.__rules = dict()
  50
  51     def initialize(self):
  52         """
  53         Loads existing security group.
  54         :return: the security group domain object
  55         """
  56         super(self.__class__, self).initialize()
  57
  58         self.__security_group = neutron_utils.get_security_group(
  59             self._neutron, self._keystone,
  60             sec_grp_settings=self.sec_grp_settings,
  61             project_name=self._os_creds.project_name)
  62         if self.__security_group:
  63             # Populate rules
  64             existing_rules = neutron_utils.get_rules_by_security_group(
  65                 self._neutron, self.__security_group)
  66
  67             for existing_rule in existing_rules:
  68                 # For Custom Rules
  69                 rule_setting = self.__get_setting_from_rule(existing_rule)
  70                 self.__rules[rule_setting] = existing_rule
  71
  72             self.__security_group = neutron_utils.get_security_group_by_id(
  73                 self._neutron, self.__security_group.id)
  74
  75         return self.__security_group
  76
  77     def create(self):
  78         """
  79         Responsible for creating the security group.
  80         :return: the security group domain object
  81         """
  82         self.initialize()
  83
  84         if not self.__security_group:
  85             logger.info(
  86                 'Creating security group %s...' % self.sec_grp_settings.name)
  87
  88             self.__security_group = neutron_utils.create_security_group(
  89                 self._neutron, self._keystone, self.sec_grp_settings)
  90
  91             # Get the rules added for free
  92             auto_rules = neutron_utils.get_rules_by_security_group(
  93                 self._neutron, self.__security_group)
  94
  95             ctr = 0
  96             for auto_rule in auto_rules:
  97                 auto_rule_setting = self.__generate_rule_setting(auto_rule)
  98                 self.__rules[auto_rule_setting] = auto_rule
  99                 ctr += 1
 100
 101             # Create the custom rules
 102             for sec_grp_rule_setting in self.sec_grp_settings.rule_settings:
 103                 try:
 104                     custom_rule = neutron_utils.create_security_group_rule(
 105                         self._neutron, self._keystone, sec_grp_rule_setting,
 106                         self._os_creds.project_name)
 107                     self.__rules[sec_grp_rule_setting] = custom_rule
 108                 except Conflict as e:
 109                     logger.warn('Unable to create rule due to conflict - %s',
 110                                 e)
 111
 112             # Refresh security group object to reflect the new rules added
 113             self.__security_group = neutron_utils.get_security_group_by_id(
 114                 self._neutron, self.__security_group.id)
 115
 116         return self.__security_group
 117
 118     def __generate_rule_setting(self, rule):
 119         """
 120         Creates a SecurityGroupRuleConfig object for a given rule
 121         :param rule: the rule from which to create the
 122                     SecurityGroupRuleConfig object
 123         :return: the newly instantiated SecurityGroupRuleConfig object
 124         """
 125         sec_grp = neutron_utils.get_security_group_by_id(
 126             self._neutron, rule.security_group_id)
 127
 128         setting = SecurityGroupRuleConfig(
 129             description=rule.description,
 130             direction=rule.direction,
 131             ethertype=rule.ethertype,
 132             port_range_min=rule.port_range_min,
 133             port_range_max=rule.port_range_max,
 134             protocol=rule.protocol,
 135             remote_group_id=rule.remote_group_id,
 136             remote_ip_prefix=rule.remote_ip_prefix,
 137             sec_grp_name=sec_grp.name)
 138         return setting
 139
 140     def clean(self):
 141         """
 142         Removes and deletes the rules then the security group.
 143         """
 144         for setting, rule in self.__rules.items():
 145             try:
 146                 neutron_utils.delete_security_group_rule(self._neutron, rule)
 147             except NotFound as e:
 148                 logger.warning('Rule not found, cannot delete - ' + str(e))
 149                 pass
 150         self.__rules = dict()
 151
 152         if self.__security_group:
 153             try:
 154                 neutron_utils.delete_security_group(self._neutron,
 155                                                     self.__security_group)
 156             except NotFound as e:
 157                 logger.warning(
 158                     'Security Group not found, cannot delete - ' + str(e))
 159
 160             self.__security_group = None
 161
 162         super(self.__class__, self).clean()
 163
 164     def get_security_group(self):
 165         """
 166         Returns the OpenStack security group object
 167         :return:
 168         """
 169         return self.__security_group
 170
 171     def get_rules(self):
 172         """
 173         Returns the associated rules
 174         :return:
 175         """
 176         return self.__rules
 177
 178     def add_rule(self, rule_setting):
 179         """
 180         Adds a rule to this security group
 181         :param rule_setting: the rule configuration
 182         """
 183         rule_setting.sec_grp_name = self.sec_grp_settings.name
 184         new_rule = neutron_utils.create_security_group_rule(
 185             self._neutron, self._keystone, rule_setting,
 186             self._os_creds.project_name)
 187         self.__rules[rule_setting] = new_rule
 188         self.sec_grp_settings.rule_settings.append(rule_setting)
 189
 190     def remove_rule(self, rule_id=None, rule_setting=None):
 191         """
 192         Removes a rule to this security group by id, name, or rule_setting
 193         object
 194         :param rule_id: the rule's id
 195         :param rule_setting: the rule's setting object
 196         """
 197         rule_to_remove = None
 198         if rule_id or rule_setting:
 199             if rule_id:
 200                 rule_to_remove = neutron_utils.get_rule_by_id(
 201                     self._neutron, self.__security_group, rule_id)
 202             elif rule_setting:
 203                 rule_to_remove = self.__rules.get(rule_setting)
 204
 205         if rule_to_remove:
 206             neutron_utils.delete_security_group_rule(self._neutron,
 207                                                      rule_to_remove)
 208             rule_setting = self.__get_setting_from_rule(rule_to_remove)
 209             if rule_setting:
 210                 self.__rules.pop(rule_setting)
 211             else:
 212                 logger.warning('Rule setting is None, cannot remove rule')
 213
 214     def __get_setting_from_rule(self, rule):
 215         """
 216         Returns the associated RuleSetting object for a given rule
 217         :param rule: the Rule object
 218         :return: the associated RuleSetting object or None
 219         """
 220         for rule_setting in self.sec_grp_settings.rule_settings:
 221             if rule_setting.rule_eq(rule):
 222                 return rule_setting
 223         return None
 224
 225
 226 class SecurityGroupSettings(SecurityGroupConfig):
 227     """
 228     Class to hold the configuration settings required for creating OpenStack
 229     SecurityGroup objects
 230     deprecated - use snaps.config.security_group.SecurityGroupConfig instead
 231     """
 232
 233     def __init__(self, **kwargs):
 234         from warnings import warn
 235         warn('Use snaps.config.security_group.SecurityGroupConfig instead',
 236              DeprecationWarning)
 237         super(self.__class__, self).__init__(**kwargs)
 238
 239
 240 class Direction(enum.Enum):
 241     """
 242     A rule's direction
 243     deprecated - use snaps.config.security_group.Direction
 244     """
 245     ingress = 'ingress'
 246     egress = 'egress'
 247
 248
 249 class Protocol(enum.Enum):
 250     """
 251     A rule's protocol
 252     deprecated - use snaps.config.security_group.Protocol
 253     """
 254     ah = 51
 255     dccp = 33
 256     egp = 8
 257     esp = 50
 258     gre = 47
 259     icmp = 1
 260     icmpv6 = 58
 261     igmp = 2
 262     ipv6_encap = 41
 263     ipv6_frag = 44
 264     ipv6_icmp = 58
 265     ipv6_nonxt = 59
 266     ipv6_opts = 60
 267     ipv6_route = 43
 268     ospf = 89
 269     pgm = 113
 270     rsvp = 46
 271     sctp = 132
 272     tcp = 6
 273     udp = 17
 274     udplite = 136
 275     vrrp = 112
 276     any = 'any'
 277     null = 'null'
 278
 279
 280 class Ethertype(enum.Enum):
 281     """
 282     A rule's ethertype
 283     deprecated - use snaps.config.security_group.Ethertype
 284     """
 285     IPv4 = 4
 286     IPv6 = 6
 287
 288
 289 class SecurityGroupRuleSettings(SecurityGroupRuleConfig):
 290     """
 291     Class to hold the configuration settings required for creating OpenStack
 292     SecurityGroupRule objects
 293     deprecated - use snaps.config.security_group.SecurityGroupRuleConfig
 294     instead
 295     """
 296
 297     def __init__(self, **kwargs):
 298         from warnings import warn
 299         warn('Use snaps.config.security_group.SecurityGroupRuleConfig instead',
 300              DeprecationWarning)
 301         super(self.__class__, self).__init__(**kwargs)