neutron/plugins/ml2/extensions/port_security.py

   1 # Copyright 2015 Intel Corporation.
   2 # All Rights Reserved.
   3 #
   4 #    Licensed under the Apache License, Version 2.0 (the "License"); you may
   5 #    not use this file except in compliance with the License. You may obtain
   6 #    a copy of the License at
   7 #
   8 #         http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 #    Unless required by applicable law or agreed to in writing, software
  11 #    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  12 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  13 #    License for the specific language governing permissions and limitations
  14 #    under the License.
  15
  16 from neutron._i18n import _LI
  17 from neutron.api.v2 import attributes as attrs
  18 from neutron.common import utils
  19 from neutron.db import common_db_mixin
  20 from neutron.db import portsecurity_db_common as ps_db_common
  21 from neutron.extensions import portsecurity as psec
  22 from neutron.plugins.ml2 import driver_api as api
  23 from oslo_log import log as logging
  24
  25 LOG = logging.getLogger(__name__)
  26
  27
  28 class PortSecurityExtensionDriver(api.ExtensionDriver,
  29                                   ps_db_common.PortSecurityDbCommon,
  30                                   common_db_mixin.CommonDbMixin):
  31     _supported_extension_alias = 'port-security'
  32
  33     def initialize(self):
  34         LOG.info(_LI("PortSecurityExtensionDriver initialization complete"))
  35
  36     @property
  37     def extension_alias(self):
  38         return self._supported_extension_alias
  39
  40     def process_create_network(self, context, data, result):
  41         # Create the network extension attributes.
  42         if psec.PORTSECURITY not in data:
  43             data[psec.PORTSECURITY] = (psec.EXTENDED_ATTRIBUTES_2_0['networks']
  44                                        [psec.PORTSECURITY]['default'])
  45         self._process_network_port_security_create(context, data, result)
  46
  47     def process_update_network(self, context, data, result):
  48         # Update the network extension attributes.
  49         if psec.PORTSECURITY in data:
  50             self._process_network_port_security_update(context, data, result)
  51
  52     def process_create_port(self, context, data, result):
  53         # Create the port extension attributes.
  54         data[psec.PORTSECURITY] = self._determine_port_security(context, data)
  55         self._process_port_port_security_create(context, data, result)
  56
  57     def process_update_port(self, context, data, result):
  58         if psec.PORTSECURITY in data:
  59             self._process_port_port_security_update(
  60                 context, data, result)
  61
  62     def extend_network_dict(self, session, db_data, result):
  63         self._extend_port_security_dict(result, db_data)
  64
  65     def extend_port_dict(self, session, db_data, result):
  66         self._extend_port_security_dict(result, db_data)
  67
  68     def _extend_port_security_dict(self, response_data, db_data):
  69         if db_data.get('port_security') is None:
  70             response_data[psec.PORTSECURITY] = (
  71                 psec.EXTENDED_ATTRIBUTES_2_0['networks']
  72                 [psec.PORTSECURITY]['default'])
  73         else:
  74             response_data[psec.PORTSECURITY] = (
  75                                 db_data['port_security'][psec.PORTSECURITY])
  76
  77     def _determine_port_security(self, context, port):
  78         """Returns a boolean (port_security_enabled).
  79
  80         Port_security is the value associated with the port if one is present
  81         otherwise the value associated with the network is returned.
  82         """
  83         # we don't apply security groups for dhcp, router
  84         if port.get('device_owner') and utils.is_port_trusted(port):
  85             return False
  86
  87         if attrs.is_attr_set(port.get(psec.PORTSECURITY)):
  88             port_security_enabled = port[psec.PORTSECURITY]
  89         else:
  90             port_security_enabled = self._get_network_security_binding(
  91                 context, port['network_id'])
  92
  93         return port_security_enabled