Kilo的代码中对Fwaas做了优化，可以将规则应用到单个路由上
但是juno里面还是应用到租户的所有路由上的，因此对juno的代码做了修改
1. 介绍
在FWaaS中，一个租户可以创建多个防火墙,而每一个防火墙和多个Policies关联，每个Policies由多个Rules按序组成。不能直接应用一个rule，它必须先加入到一个policy中，因为它需要先审计。如下图：
审计的功能目前是这样的：新建一个策略的时候默认审计是False，在新加或者修改一个规则时这个值都是False，需要手动去确认后设置为True
代码里暂时没有看到用这个字段作功能上的判断，fwaas的规则是写在qr-这个port上的
2. 创建一个防火墙
juno中创建墙是不指定路由id的，因为会应用到所有的路由上。kilo中优化了这里，让用户在创建防火墙的时候给定路由的id列表，如果不给定，默认是所有路由
文件路径：neutron\services\firewall\fwaas_plugin.py
line:230
方法：create_firewall
这个plugin是在配置文件中指定的setup.cfg中 [neutron.service_plugins] section下面
def create_firewall(self, context, firewall):
LOG.debug("create_firewall() called")
tenant_id = self._get_tenant_id_for_create(context,
firewall['firewall']) fw_new_rtrs = self._get_routers_for_create_firewall( #【1】获取用户参数中的router_ids,如果没有给定返回所有的路由ids。同时会校验给定的路由是否已经被使用
tenant_id, context, firewall) if not fw_new_rtrs: #当前租户没有创建路由
# no messaging to agent needed, and fw needs to go
# to INACTIVE(no associated rtrs) state.
status = const.INACTIVE
fw = super(FirewallPlugin, self).create_firewall(
context, firewall, status)
fw['router_ids'] = []
return fw
else:
fw = super(FirewallPlugin, self).create_firewall(
context, firewall) #【2】调用db中的create_firewall方法，创建防火墙数据库记录以及防火墙和路由的绑定记录
fw['router_ids'] = fw_new_rtrs fw_with_rules = (
self._make_firewall_dict_with_rules(context, fw['id'])) #【3】根据policy_id获取数据库对象，获取到策略中的防火墙规则列表 fw_with_rtrs = {'fw_id': fw['id'],
'router_ids': fw_new_rtrs}
self.set_routers_for_firewall(context, fw_with_rtrs) #【4】创建防火墙和路由的绑定记录
fw_with_rules['add-router-ids'] = fw_new_rtrs #【5】表示是添加的路由 和修改或者删除路由方法对应
fw_with_rules['del-router-ids'] = [] self.agent_rpc.create_firewall(context, fw_with_rules) #通知防火墙agent去创建防火墙 return fw
【1】获取路由id列表
def _get_routers_for_create_firewall(self, tenant_id, context, firewall):
# pop router_id as this goes in the router association db
# and not firewall db
router_ids = firewall['firewall'].pop('router_ids', None)
if router_ids == attr.ATTR_NOT_SPECIFIED: #object() 即用户没有给定路由id列表
# old semantics router-ids keyword not specified pick up
# all routers on tenant.
l3_plugin = manager.NeutronManager.get_service_plugins().get(
const.L3_ROUTER_NAT)
ctx = neutron_context.get_admin_context()
routers = l3_plugin.get_routers(ctx) #获取租户所有路由列表
router_ids = [
router['id']
for router in routers
if router['tenant_id'] == tenant_id]
# validation can still fail this if there is another fw
# which is associated with one of these routers.
self.validate_firewall_routers_not_in_use(context, router_ids) #验证路由是否被占用
return router_ids
else:
if not router_ids:
# This indicates that user specifies no routers.
return []
else:
# some router(s) provided.
self.validate_firewall_routers_not_in_use(context, router_ids) #验证路由是否被占用
return router_ids
【2】db中的create_firewall方法
def create_firewall(self, context, firewall, status=None):
LOG.debug("create_firewall() called")
fw = firewall['firewall']
tenant_id = self._get_tenant_id_for_create(context, fw)
# distributed routers may required a more complex state machine;
# the introduction of a new 'CREATED' state allows this, whilst
# keeping a backward compatible behavior of the logical resource.
if not status:
status = (p_const.CREATED if cfg.CONF.router_distributed
else p_const.PENDING_CREATE)
with context.session.begin(subtransactions=True):
if not fw.get('tenant_id'):
fw['tenant_id'] = self._get_tenant_id_for_create(context, fw) #_validata_fw_parameters方法会校验fw对象中的tenant_id
self._validate_fw_parameters(context, fw) #验证firewall对象的tenent_id和policy中的tenant_id是否一致，验证policy的shared字段是否为True
firewall_db = Firewall(
id=uuidutils.generate_uuid(),
tenant_id=tenant_id,
name=fw['name'],
description=fw['description'],
firewall_policy_id=fw['firewall_policy_id'],
admin_state_up=fw['admin_state_up'],
status=status)
context.session.add(firewall_db) #添加数据库记录
return self._make_firewall_dict(firewall_db)
【3】获取防火墙规则
def _make_firewall_dict_with_rules(self, context, firewall_id):
firewall = self.get_firewall(context, firewall_id)
fw_policy_id = firewall['firewall_policy_id']
if fw_policy_id:
fw_policy = self.get_firewall_policy(context, fw_policy_id) #根据策略id获取数据库对象
fw_rules_list = [self.get_firewall_rule(
context, rule_id) for rule_id in fw_policy['firewall_rules']] #遍历出规则列表
firewall['firewall_rule_list'] = fw_rules_list
else:
firewall['firewall_rule_list'] = []
# FIXME(Sumit): If the size of the firewall object we are creating
# here exceeds the largest message size supported by rabbit/qpid
# then we will have a problem.
return firewall
【4】防火墙和路由绑定
def set_routers_for_firewall(self, context, fw):
"""Sets the routers associated with the fw."""
with context.session.begin(subtransactions=True):
for r_id in fw['router_ids']:
fw_rtr_db = FirewallRouterAssociation(fw_id=fw['fw_id'],
router_id=r_id)
context.session.add(fw_rtr_db)
neutron\services\firewall\agents\l3reference\firewall_l3_agent.py
【5】agent中创建防火墙
def create_firewall(self, context, firewall, host):
"""Handle Rpc from plugin to create a firewall.""" router_ids = self._get_router_ids_for_fw(context, firewall) #获取防火墙对象中的add-router-ids属性值
if not router_ids:
return
router_info_list = self._get_router_info_list_for_tenant(
router_ids,
firewall['tenant_id']) #根据路由id获取数据库对象列表
LOG.debug("Create: Add firewall on Router List: '%s'",
[ri.router['id'] for ri in router_info_list])
# call into the driver
try:
self.fwaas_driver.create_firewall( #【5.1】这里默认使用iptables driver
self.conf.agent_mode,
router_info_list,
firewall)
if firewall['admin_state_up']:
status = constants.ACTIVE
else:
status = constants.DOWN
except fw_ext.FirewallInternalDriverError:
LOG.error(_LE("Firewall Driver Error for create_firewall "
"for firewall: %(fwid)s"),
{'fwid': firewall['id']})
status = constants.ERROR try:
# send status back to plugin
self.fwplugin_rpc.set_firewall_status(
context,
firewall['id'],
status) #【5.2】rpc调用plugin中的更新防火墙状态的方法
except Exception:
LOG.error(
_LE("FWaaS RPC failure in create_firewall "
"for firewall: %(fwid)s"),
{'fwid': firewall['id']})
self.services_sync = True
neutron\services\firewall\drivers\linux\iptables_fwaas.py
【5.1】创建防火墙
def create_firewall(self, agent_mode, apply_list, firewall):
LOG.debug('Creating firewall %(fw_id)s for tenant %(tid)s)',
{'fw_id': firewall['id'], 'tid': firewall['tenant_id']})
try:
if firewall['admin_state_up']:
self._setup_firewall(agent_mode, apply_list, firewall) #【5.1.1】设置防火墙规则
else:
self.apply_default_policy(agent_mode, apply_list, firewall) #这个方法自行查看，就是初始化了基本的规则
except (LookupError, RuntimeError):
# catch known library exceptions and raise Fwaas generic exception
LOG.error(_LE("Failed to create firewall: %s"), firewall['id'])
raise fw_ext.FirewallInternalDriverError(driver=FWAAS_DRIVER_NAME)
【5.1.1】设置防火墙规则
这里我们重点看规则的添加顺序，规则的拼凑其实很简单
def _setup_firewall(self, agent_mode, apply_list, firewall):
fwid = firewall['id']
for router_info in apply_list: #apply_list就是路由对象列表
ipt_if_prefix_list = self._get_ipt_mgrs_with_if_prefix(
agent_mode, router_info) #获取iptables_manager和网卡前缀列表
for ipt_if_prefix in ipt_if_prefix_list:
ipt_mgr = ipt_if_prefix['ipt']
# the following only updates local memory; no hole in FW
self._remove_chains(fwid, ipt_mgr) #删除v4 v6 上行和下行方向的链
self._remove_default_chains(ipt_mgr) #删除default链，default只有一条drop规则 # create default 'DROP ALL' policy chain
self._add_default_policy_chain_v4v6(ipt_mgr) #重新添加default链
#create chain based on configured policy
self._setup_chains(firewall, ipt_if_prefix) #重点，请看下面方法中的解释 # apply the changes immediately (no defer in firewall path)
ipt_mgr.defer_apply_off() #将规则应用到iptables中 def _get_chain_name(self, fwid, ver, direction):
return '%s%s%s' % (CHAIN_NAME_PREFIX[direction],
IP_VER_TAG[ver],
fwid) #命令规则 i/0+v4/v6+防火墙uuid，这里字符串的长度已经超过设置了，后面在iptables_mangager中会过滤 def _setup_chains(self, firewall, ipt_if_prefix):
"""Create Fwaas chain using the rules in the policy
"""
fw_rules_list = firewall['firewall_rule_list']
fwid = firewall['id']
ipt_mgr = ipt_if_prefix['ipt'] #default rules for invalid packets and established sessions
invalid_rule = self._drop_invalid_packets_rule() #drop invalid包
est_rule = self._allow_established_rule() #允许established包，这些都是默认规则，在初始化链规则的时候使用 for ver in [IPV4, IPV6]:
if ver == IPV4:
table = ipt_mgr.ipv4['filter']
else:
table = ipt_mgr.ipv6['filter']
ichain_name = self._get_chain_name(fwid, ver, INGRESS_DIRECTION)
ochain_name = self._get_chain_name(fwid, ver, EGRESS_DIRECTION)
for name in [ichain_name, ochain_name]:
table.add_chain(name) #add_chain方法会将链的长度裁剪，长度小于16
table.add_rule(name, invalid_rule) #添加默认规则
table.add_rule(name, est_rule) #添加默认规则 for rule in fw_rules_list:
if not rule['enabled']: #如果值为False，跳过
continue
iptbl_rule = self._convert_fwaas_to_iptables_rule(rule) #将界面给定的规则转换成iptables规则，就是拼凑
if rule['ip_version'] == 4:
ver = IPV4
table = ipt_mgr.ipv4['filter']
else:
ver = IPV6
table = ipt_mgr.ipv6['filter']
ichain_name = self._get_chain_name(fwid, ver, INGRESS_DIRECTION)
ochain_name = self._get_chain_name(fwid, ver, EGRESS_DIRECTION)
table.add_rule(ichain_name, iptbl_rule) #将界面规则添加到上行和下行链中，这里可以看到是同时添加到两个链中
table.add_rule(ochain_name, iptbl_rule)
self._enable_policy_chain(fwid, ipt_if_prefix) #【5.1.1.1】重点，看下面的解释 def _remove_default_chains(self, nsid):
"""Remove fwaas default policy chain."""
self._remove_chain_by_name(IPV4, FWAAS_DEFAULT_CHAIN, nsid)
self._remove_chain_by_name(IPV6, FWAAS_DEFAULT_CHAIN, nsid) def _remove_chains(self, fwid, ipt_mgr):
"""Remove fwaas policy chain."""
for ver in [IPV4, IPV6]:
for direction in [INGRESS_DIRECTION, EGRESS_DIRECTION]:
chain_name = self._get_chain_name(fwid, ver, direction)
self._remove_chain_by_name(ver, chain_name, ipt_mgr) def _add_default_policy_chain_v4v6(self, ipt_mgr):
ipt_mgr.ipv4['filter'].add_chain(FWAAS_DEFAULT_CHAIN)
ipt_mgr.ipv4['filter'].add_rule(FWAAS_DEFAULT_CHAIN, '-j DROP')
ipt_mgr.ipv6['filter'].add_chain(FWAAS_DEFAULT_CHAIN)
ipt_mgr.ipv6['filter'].add_rule(FWAAS_DEFAULT_CHAIN, '-j DROP')
【5.1.1.1】将规则添加到链中
def _enable_policy_chain(self, fwid, ipt_if_prefix):
bname = iptables_manager.binary_name #获取前缀字符串，这里获取到的是neutron-l3-agent
ipt_mgr = ipt_if_prefix['ipt']
if_prefix = ipt_if_prefix['if_prefix'] for (ver, tbl) in [(IPV4, ipt_mgr.ipv4['filter']),
(IPV6, ipt_mgr.ipv6['filter'])]:
for direction in [INGRESS_DIRECTION, EGRESS_DIRECTION]:
chain_name = self._get_chain_name(fwid, ver, direction)
chain_name = iptables_manager.get_chain_name(chain_name) #这里的chain_name已经是一个长度小于16的字符串了
if chain_name in tbl.chains:
jump_rule = ['%s %s+ -j %s-%s' % (IPTABLES_DIR[direction],
if_prefix, bname, chain_name)]
self._add_rules_to_chain(ipt_mgr, #在neutron-l3-agent-FORWARD链中添加跳跃规则，跳到neutron-l3-agent-iv4xxx链或者neutron-l3-agent-ov4xxx链
ver, 'FORWARD', jump_rule) #jump to DROP_ALL policy
chain_name = iptables_manager.get_chain_name(FWAAS_DEFAULT_CHAIN)
jump_rule = ['-o %s+ -j %s-%s' % (if_prefix, bname, chain_name)]
self._add_rules_to_chain(ipt_mgr, IPV4, 'FORWARD', jump_rule)
self._add_rules_to_chain(ipt_mgr, IPV6, 'FORWARD', jump_rule) #在neutron-l3-agent-FORWARD链中添加跳跃规则，跳到neutron-l3-agent-fwaas-defau链
#jump to DROP_ALL policy
chain_name = iptables_manager.get_chain_name(FWAAS_DEFAULT_CHAIN)
jump_rule = ['-i %s+ -j %s-%s' % (if_prefix, bname, chain_name)]
self._add_rules_to_chain(ipt_mgr, IPV4, 'FORWARD', jump_rule)
self._add_rules_to_chain(ipt_mgr, IPV6, 'FORWARD', jump_rule)#在neutron-l3-agent-FORWARD链中添加跳跃规则，跳到neutron-l3-agent-fwaas-defau链
总结一下链添加规则的流程
1. 初始化链（增加内置链的包装链，并将包装链作为规则添加到内置链中），这一步是在iptables_manager.py中初始化的
2. 创建并初始化iv4xxx/ov4xxx链
3. 将界面的规则添加到链中（同时添加到出和入链中）
4. 将iv4xxx/ov4xxx链放到neutron-l3-agent-FORWARD链中
5. 更新iptables规则
下一节通过查看iptables的具体规则来说明fwaas的流程