455 lines
20 KiB
Python
455 lines
20 KiB
Python
# Derived from nova/virt/libvirt/vif.py
|
|
#
|
|
# Copyright (C) 2011 Midokura KK
|
|
# Copyright (C) 2011 Nicira, Inc
|
|
# Copyright 2011 OpenStack Foundation
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
import sys
|
|
|
|
from oslo_config import cfg
|
|
from oslo_log import log as logging
|
|
|
|
from os_vif import exception as osv_exception
|
|
from os_vif.internal.ip.api import ip as ip_lib
|
|
from os_vif import objects
|
|
from os_vif import plugin
|
|
|
|
|
|
from vif_plug_ovs import constants
|
|
from vif_plug_ovs import exception
|
|
from vif_plug_ovs import linux_net
|
|
from vif_plug_ovs.ovsdb import api as ovsdb_api
|
|
from vif_plug_ovs.ovsdb import ovsdb_lib
|
|
|
|
LOG = logging.getLogger(__name__)
|
|
|
|
|
|
class OvsPlugin(plugin.PluginBase):
|
|
"""An OVS plugin that can setup VIFs in many ways
|
|
|
|
The OVS plugin supports several different VIF types, VIFBridge
|
|
and VIFOpenVSwitch, and will choose the appropriate plugging
|
|
action depending on the type of VIF config it receives.
|
|
|
|
If given a VIFBridge, then it will create connect the VM via
|
|
a regular Linux bridge device to allow security group rules to
|
|
be applied to VM traffic.
|
|
"""
|
|
|
|
NIC_NAME_LEN = 14
|
|
|
|
CONFIG_OPTS = (
|
|
cfg.IntOpt('network_device_mtu',
|
|
default=1500,
|
|
help='MTU setting for network interface.',
|
|
deprecated_group="DEFAULT"),
|
|
cfg.IntOpt('ovs_vsctl_timeout',
|
|
default=120,
|
|
help='Amount of time, in seconds, that ovs_vsctl should '
|
|
'wait for a response from the database. 0 is to wait '
|
|
'forever.',
|
|
deprecated_group="DEFAULT"),
|
|
cfg.StrOpt('ovsdb_connection',
|
|
default='tcp:127.0.0.1:6640',
|
|
help='The connection string for the OVSDB backend. '
|
|
'When executing commands using the native or vsctl '
|
|
'ovsdb interface drivers this config option defines '
|
|
'the ovsdb endpoint used.'),
|
|
cfg.StrOpt('ovsdb_interface',
|
|
choices=list(ovsdb_api.interface_map),
|
|
default='native',
|
|
deprecated_for_removal=True,
|
|
deprecated_since='2.2.0',
|
|
deprecated_reason="""
|
|
os-vif has supported ovsdb access via python bindings
|
|
since Stein (1.15.0), starting in Victoria (2.2.0) the
|
|
ovs-vsctl driver is now deprecated for removal and
|
|
in future releases it will be be removed.
|
|
""",
|
|
help='The interface for interacting with the OVSDB'),
|
|
# NOTE(sean-k-mooney): This value is a bool for two reasons.
|
|
# First I want to allow this config option to be reusable with
|
|
# non ml2/ovs deployment in the future if required, as such I do not
|
|
# want to encode how the isolation is done in the config option.
|
|
# Second in the case of ml2/ovs the isolation is based on VLAN tags.
|
|
# The 802.1Q IEEE spec that defines the VLAN format reserved two VLAN
|
|
# id values, VLAN ID 0 means the packet is a member of no VLAN
|
|
# and VLAN ID 4095 is reserved for implementation defined use.
|
|
# Using VLAN ID 0 would not provide isolation and all other VLAN IDs
|
|
# except VLAN ID 4095 are valid for the ml2/ovs agent to use for a
|
|
# tenant network's local VLAN ID. As such only VLAN ID 4095 is valid
|
|
# to use for vif isolation which is defined in Neutron as the
|
|
# dead VLAN, a VLAN on which all traffic will be dropped.
|
|
cfg.BoolOpt('isolate_vif', default=False,
|
|
help='Controls if VIF should be isolated when plugged '
|
|
'to the ovs bridge. This should only be set to True '
|
|
'when using the neutron ovs ml2 agent.'),
|
|
cfg.BoolOpt('per_port_bridge', default=False,
|
|
help='Controls if VIF should be plugged into a per-port '
|
|
'bridge. This is experimental and controls the plugging '
|
|
'behavior when not using hybrid-plug.'
|
|
'This is only used on linux and should be set to false '
|
|
'in all other cases such as ironic smartnic ports.')
|
|
)
|
|
|
|
def __init__(self, config):
|
|
super(OvsPlugin, self).__init__(config)
|
|
self.ovsdb = ovsdb_lib.BaseOVS(self.config)
|
|
|
|
@staticmethod
|
|
def gen_port_name(prefix, vif_id, max_length=NIC_NAME_LEN):
|
|
return ("%s%s" % (prefix, vif_id))[:max_length]
|
|
|
|
@staticmethod
|
|
def get_veth_pair_names(vif):
|
|
return (OvsPlugin.gen_port_name("qvb", vif.id),
|
|
OvsPlugin.gen_port_name("qvo", vif.id))
|
|
|
|
def describe(self):
|
|
pp_ovs = objects.host_info.HostPortProfileInfo(
|
|
profile_object_name=objects.vif.VIFPortProfileOpenVSwitch.__name__, # noqa
|
|
min_version="1.0",
|
|
max_version="1.0",
|
|
)
|
|
pp_ovs_representor = objects.host_info.HostPortProfileInfo(
|
|
profile_object_name=objects.vif.VIFPortProfileOVSRepresentor.__name__, # noqa
|
|
min_version="1.0",
|
|
max_version="1.0",
|
|
)
|
|
return objects.host_info.HostPluginInfo(
|
|
plugin_name=constants.PLUGIN_NAME,
|
|
vif_info=[
|
|
objects.host_info.HostVIFInfo(
|
|
vif_object_name=objects.vif.VIFBridge.__name__,
|
|
min_version="1.0",
|
|
max_version="1.0",
|
|
supported_port_profiles=[pp_ovs]),
|
|
objects.host_info.HostVIFInfo(
|
|
vif_object_name=objects.vif.VIFOpenVSwitch.__name__,
|
|
min_version="1.0",
|
|
max_version="1.0",
|
|
supported_port_profiles=[pp_ovs]),
|
|
objects.host_info.HostVIFInfo(
|
|
vif_object_name=objects.vif.VIFVHostUser.__name__,
|
|
min_version="1.0",
|
|
max_version="1.0",
|
|
supported_port_profiles=[pp_ovs, pp_ovs_representor]),
|
|
objects.host_info.HostVIFInfo(
|
|
vif_object_name=objects.vif.VIFHostDevice.__name__,
|
|
min_version="1.0",
|
|
max_version="1.0",
|
|
supported_port_profiles=[pp_ovs, pp_ovs_representor]),
|
|
])
|
|
|
|
def _get_mtu(self, vif):
|
|
if vif.network and vif.network.mtu:
|
|
return vif.network.mtu
|
|
return self.config.network_device_mtu
|
|
|
|
def _create_vif_port(self, vif, vif_name, instance_info, **kwargs):
|
|
mtu = self._get_mtu(vif)
|
|
# NOTE(sean-k-mooney): As part of a partial fix to bug #1734320
|
|
# we introduced the isolate_vif config option to enable isolation
|
|
# of the vif prior to neutron wiring up the interface. To do
|
|
# this we take advantage of the fact the ml2/ovs uses the
|
|
# implementation defined VLAN 4095 as a dead VLAN to indicate
|
|
# that all packets should be dropped. We only enable this
|
|
# behaviour conditionally as it is not portable to SDN based
|
|
# deployment such as ODL or OVN as such operator must opt-in
|
|
# to this behaviour by setting the isolate_vif config option.
|
|
# TODO(sean-k-mooney): Extend neutron to record what ml2 driver
|
|
# bound the interface in the vif binding details so isolation
|
|
# can be enabled automatically in the future.
|
|
if self.config.isolate_vif:
|
|
kwargs['tag'] = constants.DEAD_VLAN
|
|
bridge = kwargs.pop('bridge', vif.network.bridge)
|
|
self.ovsdb.create_ovs_vif_port(
|
|
bridge,
|
|
vif_name,
|
|
vif.port_profile.interface_id,
|
|
vif.address, instance_info.uuid,
|
|
mtu=mtu,
|
|
**kwargs)
|
|
|
|
def _update_vif_port(self, vif, vif_name):
|
|
mtu = self._get_mtu(vif)
|
|
self.ovsdb.update_ovs_vif_port(vif_name, mtu)
|
|
|
|
@staticmethod
|
|
def _get_vif_datapath_type(vif, datapath=constants.OVS_DATAPATH_SYSTEM):
|
|
profile = vif.port_profile
|
|
if 'datapath_type' not in profile or not profile.datapath_type:
|
|
return datapath
|
|
return profile.datapath_type
|
|
|
|
def _plug_vhostuser(self, vif, instance_info):
|
|
self.ovsdb.ensure_ovs_bridge(
|
|
vif.network.bridge, self._get_vif_datapath_type(
|
|
vif, datapath=constants.OVS_DATAPATH_NETDEV))
|
|
vif_name = OvsPlugin.gen_port_name(
|
|
constants.OVS_VHOSTUSER_PREFIX, vif.id)
|
|
args = {}
|
|
if vif.mode == "client":
|
|
args['interface_type'] = \
|
|
constants.OVS_VHOSTUSER_INTERFACE_TYPE
|
|
else:
|
|
args['interface_type'] = \
|
|
constants.OVS_VHOSTUSER_CLIENT_INTERFACE_TYPE
|
|
args['vhost_server_path'] = vif.path
|
|
|
|
self._create_vif_port(
|
|
vif, vif_name, instance_info, **args)
|
|
|
|
def _plug_bridge(self, vif, instance_info):
|
|
"""Plug using hybrid strategy
|
|
|
|
Create a per-VIF linux bridge, then link that bridge to the OVS
|
|
integration bridge via a veth device, setting up the other end
|
|
of the veth device just like a normal OVS port. Then boot the
|
|
VIF on the linux bridge using standard libvirt mechanisms.
|
|
"""
|
|
|
|
v1_name, v2_name = self.get_veth_pair_names(vif)
|
|
|
|
linux_net.ensure_bridge(vif.bridge_name)
|
|
|
|
mtu = self._get_mtu(vif)
|
|
if not ip_lib.exists(v2_name):
|
|
linux_net.create_veth_pair(v1_name, v2_name, mtu)
|
|
linux_net.add_bridge_port(vif.bridge_name, v1_name)
|
|
self.ovsdb.ensure_ovs_bridge(vif.network.bridge,
|
|
self._get_vif_datapath_type(vif))
|
|
self._create_vif_port(vif, v2_name, instance_info)
|
|
else:
|
|
linux_net.update_veth_pair(v1_name, v2_name, mtu)
|
|
self._update_vif_port(vif, v2_name)
|
|
|
|
def _plug_vif_windows(self, vif, instance_info):
|
|
"""Create a per-VIF OVS port."""
|
|
|
|
if not ip_lib.exists(vif.id):
|
|
self.ovsdb.ensure_ovs_bridge(vif.network.bridge,
|
|
self._get_vif_datapath_type(vif))
|
|
self._create_vif_port(vif, vif.id, instance_info)
|
|
|
|
def _plug_port_bridge(self, vif, instance_info):
|
|
"""Create a per-VIF OVS bridge and patch pair."""
|
|
|
|
# NOTE(sean-k-mooney): the port name prefix should not be
|
|
# changed to avoid losing ports on upgrade.
|
|
port_bridge_name = self.gen_port_name('pb', vif.id)
|
|
port_bridge_patch = self.gen_port_name('pbp', vif.id, max_length=64)
|
|
int_bridge_name = vif.network.bridge
|
|
int_bridge_patch = self.gen_port_name('ibp', vif.id, max_length=64)
|
|
|
|
self.ovsdb.ensure_ovs_bridge(
|
|
int_bridge_name, self._get_vif_datapath_type(vif))
|
|
self.ovsdb.ensure_ovs_bridge(
|
|
port_bridge_name, self._get_vif_datapath_type(vif))
|
|
self._create_vif_port(
|
|
vif, vif.vif_name, instance_info, bridge=port_bridge_name,
|
|
set_ids=False
|
|
)
|
|
tag = constants.DEAD_VLAN if self.config.isolate_vif else None
|
|
iface_id = vif.id
|
|
mac = vif.address
|
|
instance_id = instance_info.uuid
|
|
LOG.debug(
|
|
'creating patch port pair \n'
|
|
f'{port_bridge_name}:({port_bridge_patch}) -> '
|
|
f'{int_bridge_name}:({int_bridge_patch})'
|
|
)
|
|
self.ovsdb.create_patch_port_pair(
|
|
port_bridge_name, port_bridge_patch, int_bridge_name,
|
|
int_bridge_patch, iface_id, mac, instance_id, tag=tag)
|
|
|
|
def _plug_vif_generic(self, vif, instance_info):
|
|
"""Create a per-VIF OVS port."""
|
|
self.ovsdb.ensure_ovs_bridge(vif.network.bridge,
|
|
self._get_vif_datapath_type(vif))
|
|
# NOTE(sean-k-mooney): as part of a partial revert of
|
|
# change Iaf15fa7a678ec2624f7c12f634269c465fbad930
|
|
# (always create ovs port during plug), we stopped calling
|
|
# self._create_vif_port(vif, vif.vif_name, instance_info).
|
|
# Calling _create_vif_port here was intended to ensure
|
|
# that the vif was wired up by neutron before the vm was
|
|
# spawned on boot or live migration to partially resolve
|
|
# #1734320. When the "always create ovs port during plug" change
|
|
# was written it was understood by me that libvirt would not
|
|
# modify ovs if the port exists but in fact it deletes and
|
|
# recreates the port. This both undoes the effort to resolve
|
|
# bug #1734320 and introduces other issues for neutron.
|
|
# this comment will be removed when we actually fix #1734320 in
|
|
# all cases.
|
|
|
|
# NOTE(hamdyk): As a WA to the above note, one can use
|
|
# VIFPortProfileOpenVSwitch.create_port flag to explicitly
|
|
# plug the port to the switch.
|
|
if ("create_port" in vif.port_profile and
|
|
vif.port_profile.create_port):
|
|
self._create_vif_port(vif, vif.vif_name, instance_info)
|
|
|
|
def _plug_vf(self, vif, instance_info):
|
|
datapath = self._get_vif_datapath_type(vif)
|
|
self.ovsdb.ensure_ovs_bridge(vif.network.bridge, datapath)
|
|
pci_slot = vif.dev_address
|
|
vf_num = linux_net.get_vf_num_by_pci_address(pci_slot)
|
|
args = []
|
|
kwargs = {}
|
|
if datapath == constants.OVS_DATAPATH_SYSTEM:
|
|
pf_ifname = linux_net.get_ifname_by_pci_address(
|
|
pci_slot, pf_interface=True, switchdev=True)
|
|
representor = linux_net.get_representor_port(pf_ifname, vf_num)
|
|
linux_net.set_interface_state(representor, 'up')
|
|
args = [vif, representor, instance_info]
|
|
else:
|
|
representor = linux_net.get_dpdk_representor_port_name(
|
|
vif.id)
|
|
pf_pci = linux_net.get_pf_pci_from_vf(pci_slot)
|
|
args = [vif, representor, instance_info]
|
|
kwargs = {'interface_type': constants.OVS_DPDK_INTERFACE_TYPE,
|
|
'pf_pci': pf_pci,
|
|
'vf_num': vf_num}
|
|
self._create_vif_port(*args, **kwargs)
|
|
|
|
def plug(self, vif, instance_info):
|
|
if not hasattr(vif, "port_profile"):
|
|
raise exception.MissingPortProfile()
|
|
if not isinstance(vif.port_profile,
|
|
objects.vif.VIFPortProfileOpenVSwitch):
|
|
raise exception.WrongPortProfile(
|
|
profile=vif.port_profile.__class__.__name__)
|
|
|
|
if sys.platform == constants.PLATFORM_WIN32:
|
|
if type(vif) not in (
|
|
objects.vif.VIFOpenVSwitch, objects.vif.VIFBridge
|
|
):
|
|
raise osv_exception.PlugException(
|
|
vif=vif, err="This vif type is not supported on Windows")
|
|
|
|
self._plug_vif_windows(vif, instance_info)
|
|
elif isinstance(vif, objects.vif.VIFOpenVSwitch):
|
|
if self.config.per_port_bridge:
|
|
self._plug_port_bridge(vif, instance_info)
|
|
else:
|
|
self._plug_vif_generic(vif, instance_info)
|
|
elif isinstance(vif, objects.vif.VIFBridge):
|
|
self._plug_bridge(vif, instance_info)
|
|
elif isinstance(vif, objects.vif.VIFVHostUser):
|
|
self._plug_vhostuser(vif, instance_info)
|
|
elif isinstance(vif, objects.vif.VIFHostDevice):
|
|
self._plug_vf(vif, instance_info)
|
|
else:
|
|
# This should never be raised.
|
|
raise osv_exception.PlugException(
|
|
vif=vif,
|
|
err="This vif type is not supported by this plugin")
|
|
|
|
def _unplug_vhostuser(self, vif, instance_info):
|
|
self.ovsdb.delete_ovs_vif_port(vif.network.bridge,
|
|
OvsPlugin.gen_port_name(
|
|
constants.OVS_VHOSTUSER_PREFIX,
|
|
vif.id))
|
|
|
|
def _unplug_bridge(self, vif, instance_info):
|
|
"""UnPlug using hybrid strategy
|
|
|
|
Unhook port from OVS, unhook port from bridge, delete
|
|
bridge, and delete both veth devices.
|
|
"""
|
|
|
|
v1_name, v2_name = self.get_veth_pair_names(vif)
|
|
|
|
linux_net.delete_bridge(vif.bridge_name, v1_name)
|
|
|
|
self.ovsdb.delete_ovs_vif_port(vif.network.bridge, v2_name)
|
|
|
|
def _unplug_vif_windows(self, vif, instance_info):
|
|
"""Remove port from OVS."""
|
|
self.ovsdb.delete_ovs_vif_port(vif.network.bridge, vif.id,
|
|
delete_netdev=False)
|
|
|
|
def _unplug_port_bridge(self, vif, instance_info):
|
|
"""Create a per-VIF OVS bridge and patch pair."""
|
|
# NOTE(sean-k-mooney): the port name prefix should not be
|
|
# changed to avoid loosing ports on upgrade.
|
|
port_bridge_name = self.gen_port_name('pb', vif.id)
|
|
port_bridge_patch = self.gen_port_name('pbp', vif.id, max_length=64)
|
|
int_bridge_patch = self.gen_port_name('ibp', vif.id, max_length=64)
|
|
self.ovsdb.delete_ovs_vif_port(vif.network.bridge, int_bridge_patch)
|
|
self.ovsdb.delete_ovs_vif_port(port_bridge_name, port_bridge_patch)
|
|
self.ovsdb.delete_ovs_vif_port(port_bridge_name, vif.vif_name)
|
|
self.ovsdb.delete_ovs_bridge(port_bridge_name)
|
|
|
|
def _unplug_vif_generic(self, vif, instance_info):
|
|
"""Remove port from OVS."""
|
|
# NOTE(sean-k-mooney): even with the partial revert of change
|
|
# Iaf15fa7a678ec2624f7c12f634269c465fbad930 this should be correct
|
|
# so this is not removed.
|
|
self.ovsdb.delete_ovs_vif_port(vif.network.bridge, vif.vif_name)
|
|
|
|
def _unplug_vf(self, vif):
|
|
"""Remove port from OVS."""
|
|
datapath = self._get_vif_datapath_type(vif)
|
|
if datapath == constants.OVS_DATAPATH_SYSTEM:
|
|
pci_slot = vif.dev_address
|
|
pf_ifname = linux_net.get_ifname_by_pci_address(
|
|
pci_slot, pf_interface=True, switchdev=True)
|
|
vf_num = linux_net.get_vf_num_by_pci_address(pci_slot)
|
|
representor = linux_net.get_representor_port(pf_ifname, vf_num)
|
|
else:
|
|
representor = linux_net.get_dpdk_representor_port_name(
|
|
vif.id)
|
|
|
|
# The representor interface can't be deleted because it bind the
|
|
# SR-IOV VF, therefore we just need to remove it from the ovs bridge
|
|
# and set the status to down
|
|
self.ovsdb.delete_ovs_vif_port(
|
|
vif.network.bridge, representor, delete_netdev=False)
|
|
if datapath == constants.OVS_DATAPATH_SYSTEM:
|
|
linux_net.set_interface_state(representor, 'down')
|
|
|
|
def unplug(self, vif, instance_info):
|
|
if not hasattr(vif, "port_profile"):
|
|
raise exception.MissingPortProfile()
|
|
if not isinstance(vif.port_profile,
|
|
objects.vif.VIFPortProfileOpenVSwitch):
|
|
raise exception.WrongPortProfile(
|
|
profile=vif.port_profile.__class__.__name__)
|
|
if sys.platform == constants.PLATFORM_WIN32:
|
|
if type(vif) not in (
|
|
objects.vif.VIFOpenVSwitch, objects.vif.VIFBridge
|
|
):
|
|
raise osv_exception.UnplugException(
|
|
vif=vif, err="This vif type is not supported on windows.")
|
|
self._unplug_vif_windows(vif, instance_info)
|
|
elif isinstance(vif, objects.vif.VIFOpenVSwitch):
|
|
if self.config.per_port_bridge:
|
|
self._unplug_port_bridge(vif, instance_info)
|
|
else:
|
|
self._unplug_vif_generic(vif, instance_info)
|
|
elif isinstance(vif, objects.vif.VIFBridge):
|
|
self._unplug_bridge(vif, instance_info)
|
|
elif isinstance(vif, objects.vif.VIFVHostUser):
|
|
self._unplug_vhostuser(vif, instance_info)
|
|
elif isinstance(vif, objects.vif.VIFHostDevice):
|
|
self._unplug_vf(vif)
|
|
else:
|
|
# this should never be raised.
|
|
raise osv_exception.UnplugException(
|
|
vif=vif,
|
|
err="This vif type is not supported by this plugin")
|