Enable the user to enforce validity of the gateway IP

Fixes bug 1096532

A new configuration variable is added to enable the user to indicate
if the gateway should be validated on the subnet. For backward
compatibility this is set as False by default.

Change-Id: Ieadd60a945d34703bfee7576aa3b2ff7da3143d4

diff --git a/etc/quantum.conf b/etc/quantum.conf
index a57e5079415f5f5a6cd904978a861906a428bdec..2032341caab9d73ae7a1dbf4b96f08ca2011c587 100644 (file)
--- a/etc/quantum.conf
+++ b/etc/quantum.conf
@@ -70,6 +70,9 @@ api_paste_config = api-paste.ini
 # Attention: the following parameter MUST be set to False if Quantum is
 # being used in conjunction with nova security groups and/or metadata service.
 # allow_overlapping_ips = False
+# Ensure that configured gateway is on subnet
+# force_gateway_on_subnet = False
+
 
 # RPC configuration options. Defined in rpc __init__
 # The messaging module to use, defaults to kombu.

diff --git a/quantum/common/config.py b/quantum/common/config.py
index 25e8e058a3828cf7db553642a8851731ad226244..fb273b465bf5af3a45a376dd50932c23382d1784 100644 (file)
--- a/quantum/common/config.py
+++ b/quantum/common/config.py
@@ -54,7 +54,8 @@ core_opts = [
                default='quantum',
                help='AMQP exchange to connect to if using RabbitMQ or Qpid'),
     cfg.StrOpt('host', default=utils.get_hostname()),
-
+    cfg.BoolOpt('force_gateway_on_subnet', default=False,
+                help=_("Ensure that configured gateway is on subnet")),
 ]
 
 # Register the configuration options

diff --git a/quantum/db/db_base_plugin_v2.py b/quantum/db/db_base_plugin_v2.py
index 66b72e6e5d69f6aab0afe0469f13399934225da2..a332f842f3465f40e75a5a9d0b64bc108b01e03e 100644 (file)
--- a/quantum/db/db_base_plugin_v2.py
+++ b/quantum/db/db_base_plugin_v2.py
@@ -1014,6 +1014,11 @@ class QuantumDbPluginV2(quantum_plugin_base_v2.QuantumPluginBaseV2):
             s['gateway_ip'] and
             s['gateway_ip'] != attributes.ATTR_NOT_SPECIFIED):
             self._validate_ip_version(ip_ver, s['gateway_ip'], 'gateway_ip')
+            if (cfg.CONF.force_gateway_on_subnet and
+                not QuantumDbPluginV2._check_subnet_ip(s['cidr'],
+                                                       s['gateway_ip'])):
+                error_message = _("Gateway is not valid on subnet")
+                raise q_exc.InvalidInput(error_message=error_message)
 
         if ('dns_nameservers' in s and
             s['dns_nameservers'] != attributes.ATTR_NOT_SPECIFIED):

diff --git a/quantum/tests/unit/test_db_plugin.py b/quantum/tests/unit/test_db_plugin.py
index c6ec469471c40329492fef929721fb7a8853fbed..57eca29548bcee6a7a27627e5fbb1aeef6731428 100644 (file)
--- a/quantum/tests/unit/test_db_plugin.py
+++ b/quantum/tests/unit/test_db_plugin.py
@@ -2227,6 +2227,15 @@ class TestSubnetsV2(QuantumDbPluginV2TestCase):
         subnet = self._test_create_subnet(expected=expected,
                                           gateway_ip=gateway)
 
+    def test_create_force_subnet_gw_values(self):
+        cfg.CONF.set_override('force_gateway_on_subnet', True)
+        with self.network() as network:
+            self._create_subnet('json',
+                                network['network']['id'],
+                                '10.0.0.0/24',
+                                400,
+                                gateway_ip='100.0.0.1')
+
     def test_create_subnet_with_allocation_pool(self):
         gateway_ip = '10.0.0.1'
         cidr = '10.0.0.0/24'