Re: [ovs-dev] [PATCH ovn v2 3/3] rbac: Only allow relevant chassis to update BFD.

2024-02-02 Thread Ales Musil
On Tue, Jan 30, 2024 at 10:08 PM Mark Michelson  wrote:

> This adds a new "chassis_name" column to the BFD table. ovn-northd sets
> this to the logical port's chassis name when creating the BFD record.
> RBAC has been updated so that chassis may only update their own records.
>
> Signed-off-by: Mark Michelson 
> ---
> v1 -> v2:
> * Rebased on current main
> ---
>  northd/northd.c | 9 -
>  northd/ovn-northd.c | 2 +-
>  ovn-sb.ovsschema| 7 ---
>  ovn-sb.xml  | 4 
>  4 files changed, 17 insertions(+), 5 deletions(-)
>
> diff --git a/northd/northd.c b/northd/northd.c
> index 2a2fab231..51622c302 100644
> --- a/northd/northd.c
> +++ b/northd/northd.c
> @@ -10912,6 +10912,7 @@ build_bfd_table(struct ovsdb_idl_txn *ovnsb_txn,
>  nbrec_bfd_set_status(nb_bt, "admin_down");
>  }
>
> +struct ovn_port *op = ovn_port_find(lr_ports,
> nb_bt->logical_port);
>  bfd_e = bfd_port_lookup(_only, nb_bt->logical_port,
> nb_bt->dst_ip);
>  if (!bfd_e) {
>  int udp_src = bfd_get_unused_port(bfd_src_ports);
> @@ -10925,6 +10926,9 @@ build_bfd_table(struct ovsdb_idl_txn *ovnsb_txn,
>  sbrec_bfd_set_disc(sb_bt, 1 + random_uint32());
>  sbrec_bfd_set_src_port(sb_bt, udp_src);
>  sbrec_bfd_set_status(sb_bt, nb_bt->status);
> +if (op && op->sb && op->sb->chassis) {
> +sbrec_bfd_set_chassis_name(sb_bt, op->sb->chassis->name);
> +}
>
>  int min_tx = nb_bt->n_min_tx ? nb_bt->min_tx[0] :
> BFD_DEF_MINTX;
>  sbrec_bfd_set_min_tx(sb_bt, min_tx);
> @@ -10943,6 +10947,10 @@ build_bfd_table(struct ovsdb_idl_txn *ovnsb_txn,
>  }
>  }
>  build_bfd_update_sb_conf(nb_bt, bfd_e->sb_bt);
> +if (op && op->sb && op->sb->chassis &&
> +strcmp(op->sb->chassis->name, sb_bt->chassis_name)) {
> +sbrec_bfd_set_chassis_name(sb_bt, op->sb->chassis->name);
> +}
>
>  hmap_remove(_only, _e->hmap_node);
>  bfd_e->ref = false;
> @@ -10951,7 +10959,6 @@ build_bfd_table(struct ovsdb_idl_txn *ovnsb_txn,
>  hmap_insert(bfd_connections, _e->hmap_node, hash);
>  }
>
> -struct ovn_port *op = ovn_port_find(lr_ports,
> nb_bt->logical_port);
>  if (op) {
>  op->has_bfd = true;
>  }
> diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
> index 90a6d62b1..fdd5939e5 100644
> --- a/northd/ovn-northd.c
> +++ b/northd/ovn-northd.c
> @@ -122,7 +122,7 @@ static const char *rbac_igmp_group_auth[] =
>  static const char *rbac_igmp_group_update[] =
>  {"address", "chassis", "datapath", "ports"};
>  static const char *rbac_bfd_auth[] =
> -{""};
> +{"chassis_name"};
>  static const char *rbac_bfd_update[] =
>  {"status"};
>
> diff --git a/ovn-sb.ovsschema b/ovn-sb.ovsschema
> index b42f18b04..84ae09515 100644
> --- a/ovn-sb.ovsschema
> +++ b/ovn-sb.ovsschema
> @@ -1,7 +1,7 @@
>  {
>  "name": "OVN_Southbound",
> -"version": "20.32.0",
> -"cksum": "1262133774 31276",
> +"version": "20.33.0",
> +"cksum": "4076371179 31328",
>  "tables": {
>  "SB_Global": {
>  "columns": {
> @@ -578,7 +578,8 @@
>   "min": 0, "max": "unlimited"}},
>  "options": {
>  "type": {"key": "string", "value": "string",
> - "min": 0, "max": "unlimited"}}},
> + "min": 0, "max": "unlimited"}},
> +"chassis_name": {"type": "string"}},
>  "indexes": [["logical_port", "dst_ip", "src_port", "disc"]],
>  "isRoot": true},
>  "FDB": {
> diff --git a/ovn-sb.xml b/ovn-sb.xml
> index 2de7228e7..1b18a27a0 100644
> --- a/ovn-sb.xml
> +++ b/ovn-sb.xml
> @@ -4989,6 +4989,10 @@ tcp.flags = RST;
>  receiving system in Asynchronous mode.
>
>
> +  
> +The name of the chassis where the logical port is bound.
> +  
> +
>
>  Reserved for future use.
>
> --
> 2.43.0
>
> ___
> dev mailing list
> d...@openvswitch.org
> https://mail.openvswitch.org/mailman/listinfo/ovs-dev
>
>
Looks good to me, thanks.

Acked-by: Ales Musil 

-- 

Ales Musil

Senior Software Engineer - OVN Core

Red Hat EMEA 

amu...@redhat.com

___
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev


[ovs-dev] [PATCH ovn v2 3/3] rbac: Only allow relevant chassis to update BFD.

2024-01-30 Thread Mark Michelson
This adds a new "chassis_name" column to the BFD table. ovn-northd sets
this to the logical port's chassis name when creating the BFD record.
RBAC has been updated so that chassis may only update their own records.

Signed-off-by: Mark Michelson 
---
v1 -> v2:
* Rebased on current main
---
 northd/northd.c | 9 -
 northd/ovn-northd.c | 2 +-
 ovn-sb.ovsschema| 7 ---
 ovn-sb.xml  | 4 
 4 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/northd/northd.c b/northd/northd.c
index 2a2fab231..51622c302 100644
--- a/northd/northd.c
+++ b/northd/northd.c
@@ -10912,6 +10912,7 @@ build_bfd_table(struct ovsdb_idl_txn *ovnsb_txn,
 nbrec_bfd_set_status(nb_bt, "admin_down");
 }
 
+struct ovn_port *op = ovn_port_find(lr_ports, nb_bt->logical_port);
 bfd_e = bfd_port_lookup(_only, nb_bt->logical_port, nb_bt->dst_ip);
 if (!bfd_e) {
 int udp_src = bfd_get_unused_port(bfd_src_ports);
@@ -10925,6 +10926,9 @@ build_bfd_table(struct ovsdb_idl_txn *ovnsb_txn,
 sbrec_bfd_set_disc(sb_bt, 1 + random_uint32());
 sbrec_bfd_set_src_port(sb_bt, udp_src);
 sbrec_bfd_set_status(sb_bt, nb_bt->status);
+if (op && op->sb && op->sb->chassis) {
+sbrec_bfd_set_chassis_name(sb_bt, op->sb->chassis->name);
+}
 
 int min_tx = nb_bt->n_min_tx ? nb_bt->min_tx[0] : BFD_DEF_MINTX;
 sbrec_bfd_set_min_tx(sb_bt, min_tx);
@@ -10943,6 +10947,10 @@ build_bfd_table(struct ovsdb_idl_txn *ovnsb_txn,
 }
 }
 build_bfd_update_sb_conf(nb_bt, bfd_e->sb_bt);
+if (op && op->sb && op->sb->chassis &&
+strcmp(op->sb->chassis->name, sb_bt->chassis_name)) {
+sbrec_bfd_set_chassis_name(sb_bt, op->sb->chassis->name);
+}
 
 hmap_remove(_only, _e->hmap_node);
 bfd_e->ref = false;
@@ -10951,7 +10959,6 @@ build_bfd_table(struct ovsdb_idl_txn *ovnsb_txn,
 hmap_insert(bfd_connections, _e->hmap_node, hash);
 }
 
-struct ovn_port *op = ovn_port_find(lr_ports, nb_bt->logical_port);
 if (op) {
 op->has_bfd = true;
 }
diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
index 90a6d62b1..fdd5939e5 100644
--- a/northd/ovn-northd.c
+++ b/northd/ovn-northd.c
@@ -122,7 +122,7 @@ static const char *rbac_igmp_group_auth[] =
 static const char *rbac_igmp_group_update[] =
 {"address", "chassis", "datapath", "ports"};
 static const char *rbac_bfd_auth[] =
-{""};
+{"chassis_name"};
 static const char *rbac_bfd_update[] =
 {"status"};
 
diff --git a/ovn-sb.ovsschema b/ovn-sb.ovsschema
index b42f18b04..84ae09515 100644
--- a/ovn-sb.ovsschema
+++ b/ovn-sb.ovsschema
@@ -1,7 +1,7 @@
 {
 "name": "OVN_Southbound",
-"version": "20.32.0",
-"cksum": "1262133774 31276",
+"version": "20.33.0",
+"cksum": "4076371179 31328",
 "tables": {
 "SB_Global": {
 "columns": {
@@ -578,7 +578,8 @@
  "min": 0, "max": "unlimited"}},
 "options": {
 "type": {"key": "string", "value": "string",
- "min": 0, "max": "unlimited"}}},
+ "min": 0, "max": "unlimited"}},
+"chassis_name": {"type": "string"}},
 "indexes": [["logical_port", "dst_ip", "src_port", "disc"]],
 "isRoot": true},
 "FDB": {
diff --git a/ovn-sb.xml b/ovn-sb.xml
index 2de7228e7..1b18a27a0 100644
--- a/ovn-sb.xml
+++ b/ovn-sb.xml
@@ -4989,6 +4989,10 @@ tcp.flags = RST;
 receiving system in Asynchronous mode.
   
 
+  
+The name of the chassis where the logical port is bound.
+  
+
   
 Reserved for future use.
   
-- 
2.43.0

___
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev