Distribution EOLE

# -------------------------------------------------------------------------- #

# Copyright 2002-2024, OpenNebula Project, OpenNebula Systems                #

#                                                                            #

# Licensed under the Apache License, Version 2.0 (the "License"); you may    #

# not use this file except in compliance with the License. You may obtain    #

# a copy of the License at                                                   #

#                                                                            #

# http://www.apache.org/licenses/LICENSE-2.0                                 #

#                                                                            #

# Unless required by applicable law or agreed to in writing, software        #

# distributed under the License is distributed on an "AS IS" BASIS,          #

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.   #

# See the License for the specific language governing permissions and        #

# limitations under the License.                                             #

#--------------------------------------------------------------------------- #

require 'vnmmad'

class OpenvSwitchVLAN < VNMMAD::VNMDriver

    DRIVER       = 'ovswitch'

    XPATH_FILTER = "TEMPLATE/NIC[VN_MAD='ovswitch']"

    SUPPORTED_UPDATE = [

        :vlan_id,

        :mtu,

        :vlan_tagged_id,

        :cvlans,

        :qinq_type,

        :inbound_avg_bw,

        :inbound_peak_bw,

        :inbound_peak_kb,

        :outbound_avg_bw,

        :outbound_peak_bw,

        :outbound_peak_kb,

        :outer_vlan_id,

        :phydev

    ]

    def initialize(vm, xpath_filter = nil, deploy_id = nil)

        @locking = false

        xpath_filter ||= XPATH_FILTER

        super(vm, xpath_filter, deploy_id)

    end

    def activate

        lock

        @bridges = list_bridges

        process do |nic|

            @nic = nic

            # Get the name of the link vlan device.

            gen_vlan_dev_name

            # Create the bridge.

            create_bridge

            # Check that no other vlans are connected to this bridge

            validate_vlan_id if @nic[:conf][:validate_vlan_id]

            if @nic[:vlan_dev]

                unless @bridges[@nic[:bridge]].include? @nic[:vlan_dev]

                    create_vlan_dev

                    add_bridge_port(@nic[:vlan_dev], nil)

                end

            elsif !@nic[:phydev].to_s.empty?

                add_bridge_port(@nic[:phydev], nil)

            end

            add_bridge_port(nic[:target], dpdk_vm(@nic[:target])) if dpdk?

            if @nic[:tap].nil?

                # In net/pre action, we just need to ensure the bridge is

                # created so the libvirt/QEMU can add VM interfaces into that.

                # Any other driver actions are done in net/post action.

                next if VNMMAD.pre_action?

                STDERR.puts "No tap device found for nic #{@nic[:nic_id]}"

                unlock

                exit 1

            end

            if !@nic[:mtu].nil?

                cmd = "#{command(:ovs_vsctl)} set int #{@nic[:tap]} "\

                      "mtu_request=#{@nic[:mtu]}"

                run cmd

            end

            # Apply VLAN

            if !@nic[:vlan_id].nil?

                if !@nic[:cvlans].nil?

                    tag_qinq

                else

                    tag_vlan

                    tag_trunk_vlans

                end

            end

            # Delete any existing flows on port

            del_flow "in_port=#{port}"

            # We are using the flow table hierarchy to create a set of rules

            # which must be satisfied. The packet flows through the tables,

            # from to another. Any rule can stop the flow and drop the packet,

            # but if the lucky packet reaches the end, it's accepted.

            #

            # If the OpenNebula virtual network has any IP/MAC-spoofing filter

            # enabled, the additional table rules are generated. Otherwise,

            # the tables are left empty and only pass the packet to another

            # table, or finally accepts the packet.

            #

            #   +---------+          +------------+          +-----------+

            #   | Table 0 | resubmit |  Table 10  | resubmit |  Table 20 |

            #   |  Main   |--------->| MAC-spoof. |--------->| IP-spoof. |--> NORMAL

            #   |         |          |   rules    |          |   rules   |

            #   +---------+          +------------+          +-----------+

            #        |                    |                       |

            #        +-> DROP             +-> DROP                +-> DROP

            #

            # Tables are defined by following base rules:

            # in_port=<PORT>,table=0,priority=100,actions=note:VV.VV.VV.VV.NN.NN,resubmit(,10)

            # in_port=<PORT>,table=10,priority=100,actions=resubmit(,20)

            # in_port=<PORT>,table=20,priority=100,actions=NORMAL

            add_flow("table=0,in_port=#{port}", "note:#{port_note},resubmit(,10)", 100)

            add_flow("table=10,in_port=#{port}", 'resubmit(,20)', 100)

            add_flow("table=20,in_port=#{port}", 'normal', 100)

            # MAC-spoofing

            mac_spoofing if nic[:filter_mac_spoofing] =~ /yes/i

            # IP-spoofing

            ip_spoofing if nic[:filter_ip_spoofing] =~ /yes/i

        end

        # MAC-spoofing & IP-spoofing for NIC ALIAS

        process_alias do |nalias|

            nparent = @vm.parent(nalias)

            next unless nparent

            nalias[:port] = nparent[:port]

            @nic = nalias

            mac_spoofing if nalias[:filter_mac_spoofing] =~ /yes/i

            ip_spoofing if nalias[:filter_ip_spoofing] =~ /yes/i

        end

        unlock

        0

    end

    def deactivate

        # NIC_ALIAS are  not processed, skip

        return 0 if @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']

        lock

        @bridges = list_bridges

        attach_nic_id = @vm['TEMPLATE/NIC[ATTACH="YES"]/NIC_ID']

        process do |nic|

            if attach_nic_id && attach_nic_id != nic[:nic_id]

                next

            end

            @nic = nic

            # Remove flows

            del_flows

            # delete port from bridge if exists. Some virtualization

            # technologies might clean the port itselves.

            del_bridge_port(@nic[:target])

            next if @nic[:phydev].nil?

            next if @bridges[@nic[:bridge]].nil?

            # Get the name of the vlan device.

            gen_vlan_dev_name

            # Return if the bridge doesn't exist because it was already deleted

            # (handles last vm with multiple nics on the same vlan)

            next unless @bridges.include?(@nic[:bridge])

            # Return if we want to keep the empty bridge

            next if @nic[:conf][:keep_empty_bridge]

            # Return if the vlan device is not the only left device in the bridge.

            next if @bridges[@nic[:bridge]].length > 1 ||

                (@nic[:vlan_dev] && !@bridges[@nic[:bridge]].include?(@nic[:vlan_dev]))

            if @nic[:vlan_dev]

                delete_vlan_dev

                @bridges[@nic[:bridge]].delete(@nic[:vlan_dev])

            end

            delete_bridge

        end

        unlock

        0

    end

    def update(vnet_id)

        lock

        begin

            changes = @vm.changes.select {|k, _| SUPPORTED_UPDATE.include?(k) }

            return 0 if changes.empty?

            process do |nic|

                next unless Integer(nic[:network_id]) == vnet_id

                @nic = nic

                # Get the name of the link vlan device.

                gen_vlan_dev_name

                if changes[:vlan_id] && !@nic[:vlan_id].nil? && !@nic[:vlan_id].empty?

                    tag_vlan

                end

                if changes[:mtu]

                    cmd = "#{command(:ovs_vsctl)} set int #{@nic[:tap]} "\

                          "mtu_request=#{@nic[:mtu]}"

                    run cmd

                end

                if changes[:vlan_tagged_id]

                    tag_trunk_vlans

                end

                if !changes[:cvlans].nil? || !changes[:qinq_type].nil?

                    tag_qinq

                end

                qos = changes.each do |c, _|

                    break true if c.to_s.match?(/inbound/) || c.match?(/outbound/)

                end

                if qos

                    if @vm.deploy_id

                        deploy_id = @vm.deploy_id

                    else

                        deploy_id = @vm['DEPLOY_ID']

                    end

                    @nic.set_qos(deploy_id)

                end

                @bridges = list_bridges

                phydev   = @nic[:vlan_dev] || @nic[:phydev]

                next if @bridges[@nic[:bridge]].include? phydev

                if (!changes[:outer_vlan_id].nil? || !changes[:phydev].nil?) &&

                      !@nic[:vlan_dev].nil?

                    ####################################################

                    # Remove old VXLAN device

                    ####################################################

                    @nic = nic.merge(changes)

                    gen_vlan_dev_name

                    if @bridges[@nic[:bridge]].include? @nic[:vlan_dev]

                        del_bridge_port(@nic[:vlan_dev])

                        delete_vlan_dev

                    end

                    ####################################################

                    # Add new link to the BRIDGE

                    ####################################################

                    @nic = nic

                    gen_vlan_dev_name

                    create_vlan_dev

                    add_bridge_port(@nic[:vlan_dev], nil)

                elsif !changes[:phydev].nil?

                    if !@bridges[@nic[:bridge]].include?(@nic[:phydev])

                        del_bridge_port(changes[:phydev])

                        add_bridge_port(@nic[:phydev])

                    end

                end

            end

        rescue StandardError => e

            raise e

        ensure

            unlock

        end

        0

    end

    def tag_vlan

        cmd =  "#{command(:ovs_vsctl)} set Port #{@nic[:tap]} "

        cmd << "tag=#{@nic[:vlan_id]}"

        run cmd

    end

    def tag_trunk_vlans

        range = @nic[:vlan_tagged_id]

        return unless range?(range)

        ovs_vsctl_cmd = "#{command(:ovs_vsctl)} set Port #{@nic[:tap]}"

        # Open vSwitch 2.7.0+ allows range intervals (x-y), but

        # we need to support even older versions. We expand the

        # intervals into the list of values [x,x+1,...,y-1,y],

        # which should work for all.

        cmd = "#{ovs_vsctl_cmd} trunks='#{expand_range(range)}'"

        run cmd

        cmd = "#{ovs_vsctl_cmd} vlan_mode=native-untagged"

        run cmd

    end

    def tag_qinq

        range = @nic[:cvlans]

        set_vlan_limit(2)

        cmd =  "#{command(:ovs_vsctl)} set Port #{@nic[:tap]} "

        cmd << "vlan_mode=dot1q-tunnel tag=#{@nic[:vlan_id]} "

        cmd << "cvlans=#{expand_range(range)}"

        run cmd

        qinq_type = @nic[:qinq_type]

        qinq_type ||= '802.1q'

        cmd =  "#{command(:ovs_vsctl)} set Port #{@nic[:tap]} "

        cmd << "other_config:qinq-ethtype=#{qinq_type}"

        run cmd

    end

    # Following IP-spoofing rules may be created:

    # (if ARP Cache Poisoning) in_port=<PORT>,table=20,arp,arp_spa=<IP>,priority=50000,actions=NORMAL

    # (if ARP Cache Poisoning) in_port=<PORT>,table=20,arp,priority=49000,actions=drop

    # in_port=<PORT>,table=20,ip,nw_src=<IP>,priority=45000,actions=NORMAL

    # in_port=<PORT>,table=20,ipv6,ipv6_src=<IP6>,priority=45000,actions=NORMAL

    # in_port=<PORT>,table=20,udp,nw_src=0.0.0.0,nw_dst=255.255.255.255,tp_src=68,tp_dst=67,priority=44000,actions=NORMAL

    # in_port=<PORT>,table=20,icmp6,ipv6_src=::,icmp_type=133,priority=44000,actions=NORMAL

    # in_port=<PORT>,table=20,icmp6,ipv6_src=::,icmp_type=135,priority=44000,actions=NORMAL

    # in_port=<PORT>,table=20,ip,priority=40000,actions=drop

    # in_port=<PORT>,table=20,ipv6,priority=40000,actions=drop

    #

    # The particular table also contains the base rule created before:

    # in_port=<PORT>,table=20,priority=100,actions=NORMAL

    def ip_spoofing

        base = "table=20,in_port=#{port}"

        pass = 'normal'

        ipv4s = []

        [:ip, :vrouter_ip].each do |key|

            ipv4s << @nic[key] if !@nic[key].nil? && !@nic[key].empty?

        end

        if !ipv4s.empty?

            ipv4s.each do |ip|

                if @nic[:conf][:arp_cache_poisoning]

                    add_flow("#{base},arp,nw_src=#{ip}", pass, 50000)

                end

                add_flow("#{base},ip,nw_src=#{ip}", pass, 45000)

            end

        end

        if @nic[:conf][:arp_cache_poisoning]

            add_flow("#{base},arp", :drop, 49000)

        end

        # BOOTP

        add_flow("#{base},udp,nw_src=0.0.0.0/32,tp_src=68,nw_dst=255.255.255.255/32,tp_dst=67",

                 pass, 44000)

        ipv6s = []

        [:ip6, :ip6_global, :ip6_link, :ip6_ula].each do |key|

            ipv6s << @nic[key] if !@nic[key].nil? && !@nic[key].empty?

        end

        if !ipv6s.empty?

            ipv6s.each do |ip|

                add_flow("#{base},ipv6,ipv6_src=#{ip}", pass, 45000)

            end

        end

        # ICMPv6 Neighbor Discovery Protocol (ARP replacement for IPv6)

        add_flow("#{base},icmp6,icmp_type=133,ipv6_src=::", pass, 44000)

        add_flow("#{base},icmp6,icmp_type=135,ipv6_src=::", pass, 44000)

        add_flow("#{base},ip", :drop, 40000)

        add_flow("#{base},ipv6", :drop, 40000)

    end

    # Following MAC-spoofing rules may be created:

    # (if ARP Cache Poisoning) in_port=<PORT>,table=10,arp,dl_src=<MAC>,priority=50000,actions=resubmit(,20)

    # in_port=<PORT>,table=10,dl_src=<MAC>,priority=45000,actions=resubmit(,20)

    # in_port=<PORT>,table=10,priority=40000,actions=drop

    #

    # The particular table also contains the base rule created before:

    # in_port=<PORT>,table=10,priority=100,actions=resubmit(,20)

    def mac_spoofing

        base = "table=10,in_port=#{port}"

        pass = 'resubmit(,20)'

        if @nic[:conf][:arp_cache_poisoning]

            add_flow("#{base},arp,dl_src=#{@nic[:mac]}", pass, 50000)

        end

        add_flow("#{base},dl_src=#{@nic[:mac]}", pass, 45000)

        add_flow(base, :drop, 40000)

    end

    def del_flows

        the_ports = ports

        in_port   = ''

        cmd_flows = "#{command(:ovs_ofctl)} dump-flows #{@nic[:bridge]}"

        out_flows = `#{cmd_flows}`

        # searching for flow just by MAC address is legacy,

        # we preferably look for a flow port with our note

        ["note:#{port_note}", @nic[:mac]].each do |flow_matching|

            out_flows.lines do |flow|

                next unless flow.match(flow_matching)

                if (port_match = flow.match(/in_port=(\d+)/))

                    in_port_tmp = port_match[1]

                    if !the_ports.include?(in_port_tmp)

                        in_port = in_port_tmp

                        break

                    end

                end

            end

            break unless in_port.empty?

        end

        del_flow "in_port=#{in_port}" unless in_port.empty?

    end

    def add_flow(filter, action, priority = nil)

        priority = (priority.to_s.empty? ? '' : "priority=#{priority},")

        run "#{command(:ovs_ofctl)} add-flow " <<

            "#{@nic[:bridge]} '#{filter},#{priority}actions=#{action}'"

    end

    def del_flow(filter)

        filter.gsub!(/priority=(\d+)/, '')

        run "#{command(:ovs_ofctl)} del-flows #{@nic[:bridge]} #{filter}"

    end

    def run(cmd)

        OpenNebula.exec_and_log(cmd)

    end

    def ports

        dump_ports = `#{command(:ovs_ofctl)} \

                      dump-ports #{@nic[:bridge]} #{@nic[:tap]}`

        dump_ports.scan(/^\s*port\s*(\d+):/).flatten

    end

    def port

        if @nic[:port]

            @nic[:port]

        else

            @nic[:port] = ports.first

        end

    end

    def port_note

        # dot separated hexadecimal VM_ID, NIC_ID twins,

        # e.g. for VM_ID=1, NIC_ID=1: "00.00.00.01.00.01"

        ("%08x%04x" % [@vm['ID'], @nic[:nic_id]]).gsub(/(..)(?=.)/, '\1.')

    end

    def range?(range)

        !range.to_s.match(/^\d+([,-]\d+)*$/).nil?

    end

    def expand_range(range)

        items = []

        range.split(',').each do |i|

            l, r = i.split('-')

            l = l.to_i

            r = r.to_i unless r.nil?

            if r.nil?

                items << l

            elsif r >= l

                items.concat((l..r).to_a)

            else

                items.concat((r..l).to_a)

            end

        end

        items.uniq.join(',')

    end

    private

    # Generate the name of the vlan device which will be added to the bridge.

    def gen_vlan_dev_name

        nil

    end

    # Create a VLAN device.

    # NEEDS to be implemented by the subclass.

    def create_vlan_dev

        nil

    end

    # Delete a VLAN device

    # NEEDS to be implemented by the subclass.

    def delete_vlan_dev

        nil

    end

    # Return true when usgin dpdk

    def dpdk?

        @nic[:bridge_type] == 'openvswitch_dpdk'

    end

    # Path to the vm port socket /var/lib/one/datastores/0/23/one-23-0

    def dpdk_vm(port)

        "#{@vm.system_dir(@nic[:conf][:datastore_location])}/#{port}"

    end

    # Path to  bridge folder for non VM links

    def dpdk_br

        "#{@nic[:conf][:datastore_location]}/ovs-#{@nic[:bridge]}"

    end

    # Creates an OvS bridge if it does not exists, and brings it up.

    # This function IS FINAL, exits if action cannot be completed

    def create_bridge

        return if @bridges.keys.include? @nic[:bridge]

        if @nic[:bridge_type] == 'openvswitch_dpdk'

            @nic[:ovs_bridge_conf] = {} unless @nic[:ovs_bridge_conf]

            @nic[:ovs_bridge_conf]['datapath_type'] = 'netdev'

        end

        OpenNebula.exec_and_log("#{command(:ovs_vsctl)} --may-exist add-br #{@nic[:bridge]}")

        set_bridge_options

        @bridges[@nic[:bridge]] = []

        OpenNebula.exec_and_log("#{command(:ip)} link set #{@nic[:bridge]} up")

    end

    # Delete OvS bridge

    def delete_bridge

        OpenNebula.exec_and_log("#{command(:ovs_vsctl)} del-br #{@nic[:bridge]}")

        @bridges.delete(@nic[:bridge])

    end

    # Add port into OvS bridge

        def add_bridge_port(port, dpdk_path = nil)

        OpenNebula.log_error("DEBUG: Entering add_bridge_port. Bridge: #{@nic[:bridge]}, Port: #{port.inspect}")

        OpenNebula.log_error("DEBUG: Call Stack: #{caller.join("\n")}")

        return if @bridges[@nic[:bridge]].include? port

        ovs_cmd = "#{command(:ovs_vsctl)} add-port #{@nic[:bridge]} #{port}"

        OpenNebula.log_error("DEBUG: Executing OVS command: #{ovs_cmd}")

        if dpdk_path && dpdk?

            ovs_cmd << " -- set Interface #{port} type=dpdkvhostuserclient"\

                         " options:vhost-server-path=#{dpdk_path}"

        end

        OpenNebula.exec_and_log(ovs_cmd)

        @bridges[@nic[:bridge]] << port

    end

    # Delete port from OvS bridge

    def del_bridge_port(port)

        OpenNebula.exec_and_log("#{command(:ovs_vsctl)} --if-exists del-port " \

                                "#{@nic[:bridge]} #{port}")

        @bridges[@nic[:bridge]].delete(port)

    end

    # Calls ovs-vsctl set bridge to set options stored in ovs_bridge_conf

    def set_bridge_options

        @nic[:ovs_bridge_conf].each do |option, value|

            cmd = "#{command(:ovs_vsctl)} set bridge " <<

                    "#{@nic[:bridge]} #{option}=#{value}"

            OpenNebula.exec_and_log(cmd)

        end

    end

    # Get hypervisor bridges

    #   @return [Hash<String>] with the bridge names

    def list_bridges

        bridges = {}

        list_br =`#{command(:ovs_vsctl)} list-br`

        list_br.split.each do |bridge|

            bridge = bridge.strip

            if bridge

                list_ports =`#{command(:ovs_vsctl)} list-ports #{bridge}`

                bridges[bridge] = list_ports.split("\n")

            end

        end

        bridges

    end

    def validate_vlan_id

        OpenNebula.log_error('VLAN ID validation not supported for OpenvSwitch, skipped.')

    end

    def set_vlan_limit(limit)

        vl = `#{command(:ovs_vsctl)} get Open_vSwitch . other_config:vlan-limit`

        vl_limit = 0

        begin

            vl_limit = Integer(vl.tr("\"\n", ''))

        rescue ArgumentError

        end

        return if vl_limit == limit

        cmd = "#{command(:ovs_vsctl)} set Open_vSwitch . "\

            "other_config:vlan-limit=#{limit}"

        run cmd

        cmd = "#{command(:ovs_appctl)} revalidator/purge"

        run cmd

    end

end