OpenStack-Neutron-Fwaas-代码【一】

Kilo的代码中对Fwaas做了优化，可以将规则应用到单个路由上

但是juno里面还是应用到租户的所有路由上的，因此对juno的代码做了修改

1. 介绍

在FWaaS中，一个租户可以创建多个防火墙,而每一个防火墙和多个Policies关联，每个Policies由多个Rules按序组成。不能直接应用一个rule，它必须先加入到一个policy中，因为它需要先审计。如下图：

审计的功能目前是这样的：新建一个策略的时候默认审计是False，在新加或者修改一个规则时这个值都是False，需要手动去确认后设置为True

代码里暂时没有看到用这个字段作功能上的判断，fwaas的规则是写在qr-这个port上的

2. 创建一个防火墙

juno中创建墙是不指定路由id的，因为会应用到所有的路由上。kilo中优化了这里，让用户在创建防火墙的时候给定路由的id列表，如果不给定，默认是所有路由

文件路径：neutron\services\firewall\fwaas_plugin.py

line:230

方法：create_firewall

这个plugin是在配置文件中指定的setup.cfg中 [neutron.service_plugins] section下面

def create_firewall(self, context, firewall):
        LOG.debug("create_firewall() called")
        tenant_id = self._get_tenant_id_for_create(context,
            firewall['firewall'])

        fw_new_rtrs = self._get_routers_for_create_firewall( #【1】获取用户参数中的router_ids,如果没有给定返回所有的路由ids。同时会校验给定的路由是否已经被使用
            tenant_id, context, firewall)

        if not fw_new_rtrs: #当前租户没有创建路由
            # no messaging to agent needed, and fw needs to go
            # to INACTIVE(no associated rtrs) state.
            status = const.INACTIVE
            fw = super(FirewallPlugin, self).create_firewall(
                context, firewall, status)
            fw['router_ids'] = []
            return fw
        else:
            fw = super(FirewallPlugin, self).create_firewall(
                context, firewall)  #【2】调用db中的create_firewall方法，创建防火墙数据库记录以及防火墙和路由的绑定记录
            fw['router_ids'] = fw_new_rtrs

        fw_with_rules = (
            self._make_firewall_dict_with_rules(context, fw['id'])) #【3】根据policy_id获取数据库对象，获取到策略中的防火墙规则列表

        fw_with_rtrs = {'fw_id': fw['id'],
                        'router_ids': fw_new_rtrs}
        self.set_routers_for_firewall(context, fw_with_rtrs) #【4】创建防火墙和路由的绑定记录
        fw_with_rules['add-router-ids'] = fw_new_rtrs #【5】表示是添加的路由 和修改或者删除路由方法对应
        fw_with_rules['del-router-ids'] = []

        self.agent_rpc.create_firewall(context, fw_with_rules) #通知防火墙agent去创建防火墙

        return fw

【1】获取路由id列表

def _get_routers_for_create_firewall(self, tenant_id, context, firewall):
        # pop router_id as this goes in the router association db
        # and not firewall db
        router_ids = firewall['firewall'].pop('router_ids', None)
        if router_ids == attr.ATTR_NOT_SPECIFIED: #object() 即用户没有给定路由id列表
            # old semantics router-ids keyword not specified pick up
            # all routers on tenant.
            l3_plugin = manager.NeutronManager.get_service_plugins().get(
                const.L3_ROUTER_NAT)
            ctx = neutron_context.get_admin_context()
            routers = l3_plugin.get_routers(ctx) #获取租户所有路由列表
            router_ids = [
                router['id']
                for router in routers
                if router['tenant_id'] == tenant_id]
            # validation can still fail this if there is another fw
            # which is associated with one of these routers.
            self.validate_firewall_routers_not_in_use(context, router_ids) #验证路由是否被占用
            return router_ids
        else:
            if not router_ids:
                # This indicates that user specifies no routers.
                return []
            else:
                # some router(s) provided.
                self.validate_firewall_routers_not_in_use(context, router_ids) #验证路由是否被占用

        return router_ids

【2】db中的create_firewall方法

def create_firewall(self, context, firewall, status=None):
        LOG.debug("create_firewall() called")
        fw = firewall['firewall']
        tenant_id = self._get_tenant_id_for_create(context, fw)
        # distributed routers may required a more complex state machine;
        # the introduction of a new 'CREATED' state allows this, whilst
        # keeping a backward compatible behavior of the logical resource.
        if not status:
            status = (p_const.CREATED if cfg.CONF.router_distributed
                      else p_const.PENDING_CREATE)
        with context.session.begin(subtransactions=True):
            if not fw.get('tenant_id'):
                fw['tenant_id'] = self._get_tenant_id_for_create(context, fw) #_validata_fw_parameters方法会校验fw对象中的tenant_id
            self._validate_fw_parameters(context, fw) #验证firewall对象的tenent_id和policy中的tenant_id是否一致，验证policy的shared字段是否为True
            firewall_db = Firewall(
                id=uuidutils.generate_uuid(),
                tenant_id=tenant_id,
                name=fw['name'],
                description=fw['description'],
                firewall_policy_id=fw['firewall_policy_id'],
                admin_state_up=fw['admin_state_up'],
                status=status)
            context.session.add(firewall_db) #添加数据库记录
        return self._make_firewall_dict(firewall_db)

【3】获取防火墙规则

def _make_firewall_dict_with_rules(self, context, firewall_id):
        firewall = self.get_firewall(context, firewall_id)
        fw_policy_id = firewall['firewall_policy_id']
        if fw_policy_id:
            fw_policy = self.get_firewall_policy(context, fw_policy_id) #根据策略id获取数据库对象
            fw_rules_list = [self.get_firewall_rule(
                context, rule_id) for rule_id in fw_policy['firewall_rules']] #遍历出规则列表
            firewall['firewall_rule_list'] = fw_rules_list
        else:
            firewall['firewall_rule_list'] = []
        # FIXME(Sumit): If the size of the firewall object we are creating
        # here exceeds the largest message size supported by rabbit/qpid
        # then we will have a problem.
        return firewall

【4】防火墙和路由绑定

def set_routers_for_firewall(self, context, fw):
        """Sets the routers associated with the fw."""
        with context.session.begin(subtransactions=True):
            for r_id in fw['router_ids']:
                fw_rtr_db = FirewallRouterAssociation(fw_id=fw['fw_id'],
                                   router_id=r_id)
                context.session.add(fw_rtr_db)

neutron\services\firewall\agents\l3reference\firewall_l3_agent.py

【5】agent中创建防火墙

def create_firewall(self, context, firewall, host):
        """Handle Rpc from plugin to create a firewall."""

        router_ids = self._get_router_ids_for_fw(context, firewall) #获取防火墙对象中的add-router-ids属性值
        if not router_ids:
            return
        router_info_list = self._get_router_info_list_for_tenant(
            router_ids,
            firewall['tenant_id']) #根据路由id获取数据库对象列表
        LOG.debug("Create: Add firewall on Router List: '%s'",
            [ri.router['id'] for ri in router_info_list])
        # call into the driver
        try:
            self.fwaas_driver.create_firewall( #【5.1】这里默认使用iptables driver
                self.conf.agent_mode,
                router_info_list,
                firewall)
            if firewall['admin_state_up']:
                status = constants.ACTIVE
            else:
                status = constants.DOWN
        except fw_ext.FirewallInternalDriverError:
            LOG.error(_LE("Firewall Driver Error for create_firewall "
                          "for firewall: %(fwid)s"),
                {'fwid': firewall['id']})
            status = constants.ERROR

        try:
            # send status back to plugin
            self.fwplugin_rpc.set_firewall_status(
                context,
                firewall['id'],
                status)  #【5.2】rpc调用plugin中的更新防火墙状态的方法
        except Exception:
            LOG.error(
                _LE("FWaaS RPC failure in create_firewall "
                    "for firewall: %(fwid)s"),
                {'fwid': firewall['id']})
            self.services_sync = True

neutron\services\firewall\drivers\linux\iptables_fwaas.py

【5.1】创建防火墙

def create_firewall(self, agent_mode, apply_list, firewall):
        LOG.debug('Creating firewall %(fw_id)s for tenant %(tid)s)',
                  {'fw_id': firewall['id'], 'tid': firewall['tenant_id']})
        try:
            if firewall['admin_state_up']:
                self._setup_firewall(agent_mode, apply_list, firewall) #【5.1.1】设置防火墙规则
            else:
                self.apply_default_policy(agent_mode, apply_list, firewall) #这个方法自行查看，就是初始化了基本的规则
        except (LookupError, RuntimeError):
            # catch known library exceptions and raise Fwaas generic exception
            LOG.error(_LE("Failed to create firewall: %s"), firewall['id'])
            raise fw_ext.FirewallInternalDriverError(driver=FWAAS_DRIVER_NAME)

【5.1.1】设置防火墙规则

这里我们重点看规则的添加顺序，规则的拼凑其实很简单

def _setup_firewall(self, agent_mode, apply_list, firewall):
        fwid = firewall['id']
        for router_info in apply_list: #apply_list就是路由对象列表
            ipt_if_prefix_list = self._get_ipt_mgrs_with_if_prefix(
                agent_mode, router_info)  #获取iptables_manager和网卡前缀列表
            for ipt_if_prefix in ipt_if_prefix_list:
                ipt_mgr = ipt_if_prefix['ipt']
                # the following only updates local memory; no hole in FW
                self._remove_chains(fwid, ipt_mgr) #删除v4 v6 上行和下行方向的链
                self._remove_default_chains(ipt_mgr) #删除default链，default只有一条drop规则

                # create default 'DROP ALL' policy chain
                self._add_default_policy_chain_v4v6(ipt_mgr) #重新添加default链
                #create chain based on configured policy
                self._setup_chains(firewall, ipt_if_prefix) #重点，请看下面方法中的解释

                # apply the changes immediately (no defer in firewall path)
                ipt_mgr.defer_apply_off() #将规则应用到iptables中

    def _get_chain_name(self, fwid, ver, direction):
        return '%s%s%s' % (CHAIN_NAME_PREFIX[direction],
                           IP_VER_TAG[ver],
                           fwid) #命令规则  i/0+v4/v6+防火墙uuid，这里字符串的长度已经超过设置了，后面在iptables_mangager中会过滤

    def _setup_chains(self, firewall, ipt_if_prefix):
        """Create Fwaas chain using the rules in the policy
        """
        fw_rules_list = firewall['firewall_rule_list']
        fwid = firewall['id']
        ipt_mgr = ipt_if_prefix['ipt']

        #default rules for invalid packets and established sessions
        invalid_rule = self._drop_invalid_packets_rule() #drop invalid包
        est_rule = self._allow_established_rule() #允许established包，这些都是默认规则，在初始化链规则的时候使用

        for ver in [IPV4, IPV6]:
            if ver == IPV4:
                table = ipt_mgr.ipv4['filter']
            else:
                table = ipt_mgr.ipv6['filter']
            ichain_name = self._get_chain_name(fwid, ver, INGRESS_DIRECTION)
            ochain_name = self._get_chain_name(fwid, ver, EGRESS_DIRECTION)
            for name in [ichain_name, ochain_name]:
                table.add_chain(name)  #add_chain方法会将链的长度裁剪，长度小于16
                table.add_rule(name, invalid_rule) #添加默认规则
                table.add_rule(name, est_rule) #添加默认规则

        for rule in fw_rules_list:
            if not rule['enabled']: #如果值为False，跳过
                continue
            iptbl_rule = self._convert_fwaas_to_iptables_rule(rule) #将界面给定的规则转换成iptables规则，就是拼凑
            if rule['ip_version'] == 4:
                ver = IPV4
                table = ipt_mgr.ipv4['filter']
            else:
                ver = IPV6
                table = ipt_mgr.ipv6['filter']
            ichain_name = self._get_chain_name(fwid, ver, INGRESS_DIRECTION)
            ochain_name = self._get_chain_name(fwid, ver, EGRESS_DIRECTION)
            table.add_rule(ichain_name, iptbl_rule)  #将界面规则添加到上行和下行链中，这里可以看到是同时添加到两个链中
            table.add_rule(ochain_name, iptbl_rule)
        self._enable_policy_chain(fwid, ipt_if_prefix)  #【5.1.1.1】重点，看下面的解释

    def _remove_default_chains(self, nsid):
        """Remove fwaas default policy chain."""
        self._remove_chain_by_name(IPV4, FWAAS_DEFAULT_CHAIN, nsid)
        self._remove_chain_by_name(IPV6, FWAAS_DEFAULT_CHAIN, nsid)

    def _remove_chains(self, fwid, ipt_mgr):
        """Remove fwaas policy chain."""
        for ver in [IPV4, IPV6]:
            for direction in [INGRESS_DIRECTION, EGRESS_DIRECTION]:
                chain_name = self._get_chain_name(fwid, ver, direction)
                self._remove_chain_by_name(ver, chain_name, ipt_mgr) 

    def _add_default_policy_chain_v4v6(self, ipt_mgr):
        ipt_mgr.ipv4['filter'].add_chain(FWAAS_DEFAULT_CHAIN)
        ipt_mgr.ipv4['filter'].add_rule(FWAAS_DEFAULT_CHAIN, '-j DROP')
        ipt_mgr.ipv6['filter'].add_chain(FWAAS_DEFAULT_CHAIN)
        ipt_mgr.ipv6['filter'].add_rule(FWAAS_DEFAULT_CHAIN, '-j DROP')

【5.1.1.1】将规则添加到链中

def _enable_policy_chain(self, fwid, ipt_if_prefix):
      bname = iptables_manager.binary_name #获取前缀字符串，这里获取到的是neutron-l3-agent
      ipt_mgr = ipt_if_prefix['ipt']
      if_prefix = ipt_if_prefix['if_prefix']

      for (ver, tbl) in [(IPV4, ipt_mgr.ipv4['filter']),
                         (IPV6, ipt_mgr.ipv6['filter'])]:
          for direction in [INGRESS_DIRECTION, EGRESS_DIRECTION]:
              chain_name = self._get_chain_name(fwid, ver, direction)
              chain_name = iptables_manager.get_chain_name(chain_name) #这里的chain_name已经是一个长度小于16的字符串了
              if chain_name in tbl.chains:
                  jump_rule = ['%s %s+ -j %s-%s' % (IPTABLES_DIR[direction],
                      if_prefix, bname, chain_name)]
                  self._add_rules_to_chain(ipt_mgr,  #在neutron-l3-agent-FORWARD链中添加跳跃规则，跳到neutron-l3-agent-iv4xxx链或者neutron-l3-agent-ov4xxx链
                      ver, 'FORWARD', jump_rule)

      #jump to DROP_ALL policy
      chain_name = iptables_manager.get_chain_name(FWAAS_DEFAULT_CHAIN)
      jump_rule = ['-o %s+ -j %s-%s' % (if_prefix, bname, chain_name)]
      self._add_rules_to_chain(ipt_mgr, IPV4, 'FORWARD', jump_rule)
      self._add_rules_to_chain(ipt_mgr, IPV6, 'FORWARD', jump_rule) #在neutron-l3-agent-FORWARD链中添加跳跃规则，跳到neutron-l3-agent-fwaas-defau链
　　　 #jump to DROP_ALL policy
      chain_name = iptables_manager.get_chain_name(FWAAS_DEFAULT_CHAIN)
      jump_rule = ['-i %s+ -j %s-%s' % (if_prefix, bname, chain_name)]
      self._add_rules_to_chain(ipt_mgr, IPV4, 'FORWARD', jump_rule)
      self._add_rules_to_chain(ipt_mgr, IPV6, 'FORWARD', jump_rule)#在neutron-l3-agent-FORWARD链中添加跳跃规则，跳到neutron-l3-agent-fwaas-defau链

总结一下链添加规则的流程

1. 初始化链（增加内置链的包装链，并将包装链作为规则添加到内置链中），这一步是在iptables_manager.py中初始化的

2. 创建并初始化iv4xxx/ov4xxx链

3. 将界面的规则添加到链中（同时添加到出和入链中）

4. 将iv4xxx/ov4xxx链放到neutron-l3-agent-FORWARD链中

5. 更新iptables规则

下一节通过查看iptables的具体规则来说明fwaas的流程