diff --git a/networkdriver.py b/networkdriver.py index 2398478..a281d5f 100755 --- a/networkdriver.py +++ b/networkdriver.py @@ -5,111 +5,112 @@ import logging import re -class NWDriver: - - def __init__(self): - pass - - def ovs_command_execute(self, command): - '''Execute OpenVSwitch commands - command - List of strings - ''' - command = ['sudo', 'ovs-vsctl'] + command - return_val = subprocess.call(command) - logging.info('OVS command: %s executed.', command) - return return_val - - def ofctl_command_execute(self, command): - '''Execute OpenVSwitch flow commands - command - List of strings - ''' - command = ['sudo', 'ovs-ofctl'] + command - return_val = subprocess.call(command) - logging.info('OVS flow command: %s executed.', command) - return return_val - - def nw_create(self, vm): - for network in vm.network_list: - self.port_create(network) - - def nw_delete(self, vm): - for network in vm.network_list: - self.port_delete(network) - - def port_create(self, network): - ''' - add-port BRIDGE PORT - set Port vnet18 tag=9 - add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,udp,tp_dst=68,priority=43000,actions=drop". - add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,ip,nw_src=10.9.1.138,priority=42000,actions=normal". - add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,ipv6,ipv6_src=2001:738:2001:4031:9:1:138:0/112,priority=42000,actions=normal". - add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,arp,nw_src=10.9.1.138,priority=41000,actions=normal". - add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,udp,tp_dst=67,priority=40000,actions=normal". - add-flow cloud in_port=245,priority=39000,actions=drop". - ''' - # Create the port for virtual network - cmd_list = ['add-port', network.bridge, network.name] - self.ovs_command_execute(cmd_list) - - # Set VLAN parameter for tap interface - cmd_list = ['set', 'Port', network.name, 'tag='+str(network.vlan)] - self.ovs_command_execute(cmd_list) - - # Getting network FlowPortNumber - port_number = self.get_port_number(network) - - # Set Flow rules to avoid mac or IP spoofing - # Set flow rule 1 (dhcp server ban) - cmd_list = ['add-flow', network.bridge, - 'in_port=%(port_number)s,dl_src=%(mac)s,udp,tp_dst=68,\ - priority=43000,actions=drop' % { - 'port_number': port_number, 'mac': network.mac}] - self.ofctl_command_execute(cmd_list) - - # Set flow rules 2 (ipv4 filter) - cmd_list = ['add-flow', network.bridge, - 'in_port=%(port_number)s,dl_src=%(mac)s,ip,\ - nw_src=%(ipv4)s,priority=42000,actions=normal' % { - 'port_number': port_number, - 'mac': network.mac, 'ipv4': network.ipv4}] - self.ofctl_command_execute(cmd_list) - - # Set flow rules 3 (ipv6 filter) - cmd_list = ['add-flow', network.bridge, - 'in_port=%(port_number)s,dl_src=%(mac)s,ipv6,\ - nw_src=%(ipv6)s,priority=42000,actions=normal' % { - 'port_number': port_number, - 'mac': network.mac, 'ipv6': network.ipv6}] - self.ofctl_command_execute(cmd_list) - - # Set flow rules 4 (enabling arp) - cmd_list = ['add-flow', network.bridge, - 'in_port=%(port_number)s,dl_src=%(mac)s,arp,\ - nw_src=%(ipv4)s,priority=41000,actions=normal' % { - 'port_number': port_number, - 'mac': network.mac, 'ipv4': network.ipv4}] - self.ofctl_command_execute(cmd_list) - - # Set flow rules 5 (enabling arp) - cmd_list = ['add-flow', network.bridge, - 'in_port=%(port_number)s,dl_src=%(mac)s,udp,tp_dst=67,\ - priority=40000,actions=normal' % { - 'port_number': port_number, 'mac': network.mac}] - self.ofctl_command_execute(cmd_list) - - # Set flow rule 6 (disable other protocols) - cmd_list = ['add-flow', network.bridge, - 'in_port=%(port_number)s,priority=39000,actions=drop' % { - 'port_number': port_number}] - self.ofctl_command_execute(cmd_list) - - def port_delete(self, network): - cmd_list = ['del-port', network.name] - self.ovs_command_execute(cmd_list) - - def get_port_number(self, network): - '''Returns the OpenFlow port number for a given network - ''' - output = subprocess.check_output( - ['sudo', 'ovs-ofctl', 'dump-ports', network.bridge, network.name]) - return re.search('port *([0-9]+)', output).group(1) +def ovs_command_execute(command): + '''Execute OpenVSwitch commands + command - List of strings + ''' + command = ['sudo', 'ovs-vsctl'] + command + return_val = subprocess.call(command) + logging.info('OVS command: %s executed.', command) + return return_val + + +def ofctl_command_execute(command): + '''Execute OpenVSwitch flow commands + command - List of strings + ''' + command = ['sudo', 'ovs-ofctl'] + command + return_val = subprocess.call(command) + logging.info('OVS flow command: %s executed.', command) + return return_val + + +def nw_create(vm): + for network in vm.network_list: + port_create(network) + + +def nw_delete(vm): + for network in vm.network_list: + port_delete(network) + + +def port_create(network): + ''' + add-port BRIDGE PORT + set Port vnet18 tag=9 + add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,udp,tp_dst=68,priority=43000,actions=drop". + add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,ip,nw_src=10.9.1.138,priority=42000,actions=normal". + add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,ipv6,ipv6_src=2001:738:2001:4031:9:1:138:0/112,priority=42000,actions=normal". + add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,arp,nw_src=10.9.1.138,priority=41000,actions=normal". + add-flow cloud in_port=245,dl_src=02:00:0a:09:01:8a,udp,tp_dst=67,priority=40000,actions=normal". + add-flow cloud in_port=245,priority=39000,actions=drop". + ''' + # Create the port for virtual network + cmd_list = ['add-port', network.bridge, network.name] + ovs_command_execute(cmd_list) + + # Set VLAN parameter for tap interface + cmd_list = ['set', 'Port', network.name, 'tag='+str(network.vlan)] + ovs_command_execute(cmd_list) + + # Getting network FlowPortNumber + port_number = get_port_number(network) + + # Set Flow rules to avoid mac or IP spoofing + # Set flow rule 1 (dhcp server ban) + cmd_list = ['add-flow', network.bridge, + 'in_port=%(port_number)s,dl_src=%(mac)s,udp,tp_dst=68,\ + priority=43000,actions=drop' % { + 'port_number': port_number, 'mac': network.mac}] + ofctl_command_execute(cmd_list) + + # Set flow rules 2 (ipv4 filter) + cmd_list = ['add-flow', network.bridge, + 'in_port=%(port_number)s,dl_src=%(mac)s,ip,\ + nw_src=%(ipv4)s,priority=42000,actions=normal' % { + 'port_number': port_number, + 'mac': network.mac, 'ipv4': network.ipv4}] + ofctl_command_execute(cmd_list) + + # Set flow rules 3 (ipv6 filter) + cmd_list = ['add-flow', network.bridge, + 'in_port=%(port_number)s,dl_src=%(mac)s,ipv6,\ + nw_src=%(ipv6)s,priority=42000,actions=normal' % { + 'port_number': port_number, + 'mac': network.mac, 'ipv6': network.ipv6}] + ofctl_command_execute(cmd_list) + + # Set flow rules 4 (enabling arp) + cmd_list = ['add-flow', network.bridge, + 'in_port=%(port_number)s,dl_src=%(mac)s,arp,\ + nw_src=%(ipv4)s,priority=41000,actions=normal' % { + 'port_number': port_number, + 'mac': network.mac, 'ipv4': network.ipv4}] + ofctl_command_execute(cmd_list) + + # Set flow rules 5 (enabling arp) + cmd_list = ['add-flow', network.bridge, + 'in_port=%(port_number)s,dl_src=%(mac)s,udp,tp_dst=67,\ + priority=40000,actions=normal' % { + 'port_number': port_number, 'mac': network.mac}] + ofctl_command_execute(cmd_list) + + # Set flow rule 6 (disable other protocols) + cmd_list = ['add-flow', network.bridge, + 'in_port=%(port_number)s,priority=39000,actions=drop' % { + 'port_number': port_number}] + ofctl_command_execute(cmd_list) + + +def port_delete(network): + cmd_list = ['del-port', network.name] + ovs_command_execute(cmd_list) + + +def get_port_number(network): + '''Returns the OpenFlow port number for a given network + ''' + output = subprocess.check_output( + ['sudo', 'ovs-ofctl', 'dump-ports', network.bridge, network.name]) + return re.search('port *([0-9]+)', output).group(1) diff --git a/test_nw.py b/test_nw.py deleted file mode 100755 index fd24d0b..0000000 --- a/test_nw.py +++ /dev/null @@ -1,33 +0,0 @@ -#!/usr/bin/env python -import networkdriver -import vm -import logging -import vmdriver - -logging.basicConfig(filename='example.log', level=logging.DEBUG) - -graphics = {'type': 'vnc', 'listen': - '0.0.0.0', 'port': '6300', 'passwd': 'asd'} -a = vm.VMDisk(name="ubuntu", source='/home/tarokkk/ubuntu.qcow') -b = vm.VMNetwork(name="vm-88", bridge='cloud', - mac="02:00:0a:09:01:8a", ipv4='10.9.1.138', - ipv6='2001:738:2001:4031:9:1:138:0/112') -testvm = vm.VMInstance(name="ubuntu", vcpu="1", - memory_max="131072", - disk_list=[a], - network_list=[b], - graphics=graphics) - -#Creating vm -vm_driver = vmdriver.VMDriver() -vm_driver.connect() -#vm_driver.vm_create(testvm) - -#Enabling network -network = networkdriver.NWDriver() -#network.nw_create(testvm) - -network.nw_delete(testvm) -vm_driver.vm_delete(testvm) - -vm_driver.disconnect()