[ovs-dev] [PATCH v6 1/2 ovn] External IP based NAT: Add Columns and CLI

svc.mail.git svc.mail.git at nutanix.com
Tue Sep 8 19:59:05 UTC 2020


Hi Numan,

Thanks a lot for review and applying the patch.
Sure, just sent out the patch for 'NEWS '.

Regards,
Ankur
________________________________
From: Numan Siddique <numans at ovn.org>
Sent: Tuesday, September 8, 2020 2:14 AM
To: svc.mail.git <svc.mail.git at nutanix.com>
Cc: ovs-dev <ovs-dev at openvswitch.org>
Subject: Re: [ovs-dev] [PATCH v6 1/2 ovn] External IP based NAT: Add Columns and CLI



On Tue, Sep 8, 2020 at 2:28 AM Ankur Sharma <svc.mail.git at nutanix.com<mailto:svc.mail.git at nutanix.com>> wrote:
From: Ankur Sharma <ankur.sharma at nutanix.com<mailto:ankur.sharma at nutanix.com>>

This patch adds following columns to NAT table.

a. allowed_ext_ips:
   Represents Address Set of External IPs for which
   a NAT rule is applicable.

b. exempted_ext_ips:
   Represents Address Set of External IPs for which
   a NAT rule is NOT applicable.

Additionally, patch adds nbctl cli to set these column values.
ovn-nbctl [--is-exempted] lr-nat-update-ext-ip

Signed-off-by: Ankur Sharma <ankur.sharma at nutanix.com<mailto:ankur.sharma at nutanix.com>>

Thanks Ankur. I applied this patch series to master.

I think this requires updating the 'NEWS' file. Can you submit a follow up patch to
add a news entry for it  ?

Thanks
Numan

---
 ovn-nb.ovsschema      |  14 +++++-
 ovn-nb.xml            |  48 +++++++++++++++++++++
 tests/ovn-nbctl.at [ovn-nbctl.at]<https://urldefense.proofpoint.com/v2/url?u=http-3A__ovn-2Dnbctl.at&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=gdsHrMKI-VOHoN1ziUyqlIGzgVzIjMMz-NHIsocZYPE&m=AUKavBNgnyuDqvht4dTSZuoePdT9-Y2OWzMMp41y240&s=p0Yau1R1btoDKp2awlCojfGLz4Neksr1O9axNPjao4Q&e=>    |  44 ++++++++++++++++++-
 utilities/ovn-nbctl.c | 116 +++++++++++++++++++++++++++++++++++++++++++++++++-
 4 files changed, 218 insertions(+), 4 deletions(-)

diff --git a/ovn-nb.ovsschema b/ovn-nb.ovsschema
index 0c939b7..62abf15 100644
--- a/ovn-nb.ovsschema
+++ b/ovn-nb.ovsschema
@@ -1,7 +1,7 @@
 {
     "name": "OVN_Northbound",
-    "version": "5.25.0",
-    "cksum": "1354137211 26116",
+    "version": "5.26.0",
+    "cksum": "1072595492 26575",
     "tables": {
         "NB_Global": {
             "columns": {
@@ -403,6 +403,16 @@
                                                              "snat",
                                                              "dnat_and_snat"
                                                                ]]}}},
+                "allowed_ext_ips": {"type": {
+                    "key": {"type": "uuid", "refTable": "Address_Set",
+                            "refType": "strong"},
+                    "min": 0,
+                    "max": 1}},
+                "exempted_ext_ips": {"type": {
+                    "key": {"type": "uuid", "refTable": "Address_Set",
+                            "refType": "strong"},
+                    "min": 0,
+                    "max": 1}},
                 "options": {"type": {"key": "string", "value": "string",
                                      "min": 0, "max": "unlimited"}},
                 "external_ids": {
diff --git a/ovn-nb.xml b/ovn-nb.xml
index 1f2dbb9..09beae9 100644
--- a/ovn-nb.xml
+++ b/ovn-nb.xml
@@ -2716,6 +2716,54 @@
       </p>
     </column>

+    <column name="allowed_ext_ips">
+      It represents Address Set of external ips that NAT rule is applicable to.
+      For SNAT type NAT rules, this refers to destination addresses.
+      For DNAT type NAT rules, this refers to source addresses.
+
+      <p>
+        This configuration overrides the default NAT behavior of applying a
+        rule solely based on internal IP. Without this configuration, NAT
+        happens without considering the external IP (i.e dest/source for
+        snat/dnat type rule). With this configuration NAT rule is applied
+        ONLY if external ip is in the input Address Set.
+      </p>
+    </column>
+
+    <column name="exempted_ext_ips">
+      It represents Address Set of external ips that NAT rule is NOT
+      applicable to.
+      For SNAT type NAT rules, this refers to destination addresses.
+      For DNAT type NAT rules, this refers to source addresses.
+
+      <p>
+        This configuration overrides the default NAT behavior of applying a
+        rule solely based on internal IP. Without this configuration, NAT
+        happens without considering the external IP (i.e dest/source for
+        snat/dnat type rule). With this configuration NAT rule is NOT applied
+        if external ip is in the input Address Set.
+      </p>
+
+      <p>
+        If there are NAT rules in a logical router with overlapping IP prefixes
+        (including /32), then usage of <var>exempted_ext_ips</var> should be
+        avoided in following scenario.
+        a. SNAT rule (let us say RULE1) with logical_ip PREFIX/MASK
+           (let us say 50.0.0.0/24 [50.0.0.0]<https://urldefense.proofpoint.com/v2/url?u=http-3A__50.0.0.0_24&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=gdsHrMKI-VOHoN1ziUyqlIGzgVzIjMMz-NHIsocZYPE&m=AUKavBNgnyuDqvht4dTSZuoePdT9-Y2OWzMMp41y240&s=HDCrn4-SWOjXCPZZ54VFIWSUKynvrOgd58infOUbgvE&e=>).
+        b. SNAT rule (let us say RULE2) with logical_ip PREFIX/MASK+1
+           (let us say 50.0.0.0/25 [50.0.0.0]<https://urldefense.proofpoint.com/v2/url?u=http-3A__50.0.0.0_25&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=gdsHrMKI-VOHoN1ziUyqlIGzgVzIjMMz-NHIsocZYPE&m=AUKavBNgnyuDqvht4dTSZuoePdT9-Y2OWzMMp41y240&s=XDaAEm2kKMy1SGppvP4qjF8u0tSorw_YCfg1UkBDBFU&e=>).
+        c. Now, if exempted_ext_ips is associated with RULE2, then a logical
+           ip which matches both 50.0.0.0/24 [50.0.0.0]<https://urldefense.proofpoint.com/v2/url?u=http-3A__50.0.0.0_24&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=gdsHrMKI-VOHoN1ziUyqlIGzgVzIjMMz-NHIsocZYPE&m=AUKavBNgnyuDqvht4dTSZuoePdT9-Y2OWzMMp41y240&s=HDCrn4-SWOjXCPZZ54VFIWSUKynvrOgd58infOUbgvE&e=> and 50.0.0.0/25 [50.0.0.0]<https://urldefense.proofpoint.com/v2/url?u=http-3A__50.0.0.0_25&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=gdsHrMKI-VOHoN1ziUyqlIGzgVzIjMMz-NHIsocZYPE&m=AUKavBNgnyuDqvht4dTSZuoePdT9-Y2OWzMMp41y240&s=XDaAEm2kKMy1SGppvP4qjF8u0tSorw_YCfg1UkBDBFU&e=> may get the RULE2
+           applied to it instead of RULE1.
+      </p>
+
+      <p>
+        <var>allowed_ext_ips</var> and <var>exempted_ext_ips</var> are mutually
+        exclusive to each other. If both Address Sets are set for a rule,
+        then the NAT rule is not considered.
+      </p>
+    </column>
+
     <column name="options" key="stateless">
       Indicates if a dnat_and_snat rule should lead to connection
       tracking state or not.
diff --git a/tests/ovn-nbctl.at [ovn-nbctl.at]<https://urldefense.proofpoint.com/v2/url?u=http-3A__ovn-2Dnbctl.at&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=gdsHrMKI-VOHoN1ziUyqlIGzgVzIjMMz-NHIsocZYPE&m=AUKavBNgnyuDqvht4dTSZuoePdT9-Y2OWzMMp41y240&s=p0Yau1R1btoDKp2awlCojfGLz4Neksr1O9axNPjao4Q&e=> b/tests/ovn-nbctl.at [ovn-nbctl.at]<https://urldefense.proofpoint.com/v2/url?u=http-3A__ovn-2Dnbctl.at&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=gdsHrMKI-VOHoN1ziUyqlIGzgVzIjMMz-NHIsocZYPE&m=AUKavBNgnyuDqvht4dTSZuoePdT9-Y2OWzMMp41y240&s=p0Yau1R1btoDKp2awlCojfGLz4Neksr1O9axNPjao4Q&e=>
index 619051d..baf7a87 100644
--- a/tests/ovn-nbctl.at [ovn-nbctl.at]<https://urldefense.proofpoint.com/v2/url?u=http-3A__ovn-2Dnbctl.at&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=gdsHrMKI-VOHoN1ziUyqlIGzgVzIjMMz-NHIsocZYPE&m=AUKavBNgnyuDqvht4dTSZuoePdT9-Y2OWzMMp41y240&s=p0Yau1R1btoDKp2awlCojfGLz4Neksr1O9axNPjao4Q&e=>
+++ b/tests/ovn-nbctl.at [ovn-nbctl.at]<https://urldefense.proofpoint.com/v2/url?u=http-3A__ovn-2Dnbctl.at&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=gdsHrMKI-VOHoN1ziUyqlIGzgVzIjMMz-NHIsocZYPE&m=AUKavBNgnyuDqvht4dTSZuoePdT9-Y2OWzMMp41y240&s=p0Yau1R1btoDKp2awlCojfGLz4Neksr1O9axNPjao4Q&e=>
@@ -685,7 +685,49 @@ snat             40.0.0.3           21-65535         192.168.1.6
 AT_CHECK([ovn-nbctl lr-nat-del lr0])
 AT_CHECK([ovn-nbctl lr-nat-list lr0], [0], [])
 AT_CHECK([ovn-nbctl lr-nat-del lr0])
-AT_CHECK([ovn-nbctl lr-nat-del lr0 dnat])])
+AT_CHECK([ovn-nbctl lr-nat-del lr0 dnat])
+
+AT_CHECK([ovn-nbctl lr-nat-del lr0])
+
+ovn-nbctl create Address_Set name=allowed_range addresses=\"1.1.1.1\"
+ovn-nbctl create Address_Set name=disallowed_range addresses=\"2.2.2.2\"
+AT_CHECK([ovn-nbctl lr-nat-add lr0 snat 40.0.0.3 192.168.1.6])
+AT_CHECK([ovn-nbctl lr-nat-update-ext-ip lr0 snat 192.168.1.6 allowed_range])
+AT_CHECK([ovn-nbctl --is-exempted lr-nat-update-ext-ip lr0 snat 192.168.1.6 disallowed_range])
+AT_CHECK([ovn-nbctl lr-nat-update-ext-ip lr0 snat 192.168.1.6 allowed_range_tmp], [1], [],
+[ovn-nbctl: allowed_range_tmp: Address Set name not found
+])
+AT_CHECK([ovn-nbctl --is-exempted lr-nat-update-ext-ip lr0 snat 192.168.1.6 disallowed_range_tmp], [1], [],
+[ovn-nbctl: disallowed_range_tmp: Address Set name not found
+])
+
+AT_CHECK([ovn-nbctl lr-nat-add lr0 dnat 40.0.0.4 192.168.1.7])
+AT_CHECK([ovn-nbctl lr-nat-update-ext-ip lr0 dnat 40.0.0.4 allowed_range])
+AT_CHECK([ovn-nbctl --is-exempted lr-nat-update-ext-ip lr0 dnat 40.0.0.4 disallowed_range])
+AT_CHECK([ovn-nbctl lr-nat-update-ext-ip lr0 dnat 40.0.0.4 allowed_range_tmp], [1], [],
+[ovn-nbctl: allowed_range_tmp: Address Set name not found
+])
+AT_CHECK([ovn-nbctl --is-exempted lr-nat-update-ext-ip lr0 dnat 40.0.0.4 disallowed_range_tmp], [1], [],
+[ovn-nbctl: disallowed_range_tmp: Address Set name not found
+])
+
+AT_CHECK([ovn-nbctl lr-nat-add lr0 dnat_and_snat 40.0.0.5 192.168.1.8])
+AT_CHECK([ovn-nbctl lr-nat-update-ext-ip lr0 dnat_and_snat 40.0.0.5 allowed_range])
+AT_CHECK([ovn-nbctl --is-exempted lr-nat-update-ext-ip lr0 dnat 40.0.0.4 disallowed_range])
+AT_CHECK([ovn-nbctl lr-nat-update-ext-ip lr0 dnat 40.0.0.4 allowed_range_tmp], [1], [],
+[ovn-nbctl: allowed_range_tmp: Address Set name not found
+])
+AT_CHECK([ovn-nbctl --is-exempted lr-nat-update-ext-ip lr0 dnat 40.0.0.4 disallowed_range_tmp], [1], [],
+[ovn-nbctl: disallowed_range_tmp: Address Set name not found
+])
+AT_CHECK([ovn-nbctl lr-nat-update-ext-ip lr0 snat 192.168.1.6], [1], [],
+[ovn-nbctl: 'lr-nat-update-ext-ip' command requires at least 4 arguments
+])
+AT_CHECK([ovn-nbctl lr-nat-update-ext-ip lr0 snat 192.168.16 allowed_range], [1], [],
+[ovn-nbctl: 192.168.16: Invalid IP address or CIDR
+])
+
+AT_CHECK([ovn-nbctl lr-nat-del lr0])])

 dnl ---------------------------------------------------------------------

diff --git a/utilities/ovn-nbctl.c b/utilities/ovn-nbctl.c
index 542cbf7..42dcad7 100644
--- a/utilities/ovn-nbctl.c
+++ b/utilities/ovn-nbctl.c
@@ -839,6 +839,46 @@ lr_by_name_or_uuid(struct ctl_context *ctx, const char *id,
     return NULL;
 }

+/* Find an Address Set given its id. */
+static char * OVS_WARN_UNUSED_RESULT
+address_set_by_name_or_uuid(struct ctl_context *ctx,
+                            const char *id, bool must_exist,
+                            const struct nbrec_address_set **addr_set_p)
+{
+    const struct nbrec_address_set *addr_set = NULL;
+    bool is_uuid = false;
+    struct uuid addr_set_uuid;
+
+    *addr_set_p = NULL;
+    if (uuid_from_string(&addr_set_uuid, id)) {
+        is_uuid = true;
+        addr_set = nbrec_address_set_get_for_uuid(ctx->idl, &addr_set_uuid);
+    }
+
+    if (!addr_set) {
+        const struct nbrec_address_set *iter;
+
+        NBREC_ADDRESS_SET_FOR_EACH(iter, ctx->idl) {
+            if (strcmp(iter->name, id)) {
+                continue;
+            }
+            if (addr_set) {
+                return xasprintf("Multiple Address Sets named '%s'.  "
+                                 "Use a UUID.", id);
+            }
+            addr_set = iter;
+        }
+    }
+
+    if (!addr_set && must_exist) {
+        return xasprintf("%s: Address Set %s not found",
+                         id, is_uuid ? "UUID" : "name");
+    }
+
+    *addr_set_p = addr_set;
+    return NULL;
+}
+
 static char * OVS_WARN_UNUSED_RESULT
 ls_by_name_or_uuid(struct ctl_context *ctx, const char *id, bool must_exist,
                    const struct nbrec_logical_switch **ls_p)
@@ -4486,6 +4526,79 @@ nbctl_lr_nat_list(struct ctl_context *ctx)
     smap_destroy(&lr_nats);
 }

+static void
+nbctl_lr_nat_set_ext_ips(struct ctl_context *ctx)
+{
+    const struct nbrec_logical_router *lr = NULL;
+    const struct nbrec_address_set *addr_set = NULL;
+    bool is_exempted = shash_find(&ctx->options, "--is-exempted");
+    bool nat_found = false;
+
+    if (ctx->argc < 5) {
+        ctl_error(ctx, "Incomplete input, Required arguments are: "
+                  "ROUTER TYPE IP ADDRESS_SET");
+        return;
+    }
+
+    char *error = lr_by_name_or_uuid(ctx, ctx->argv[1], true, &lr);
+    if (error) {
+        ctx->error = error;
+        return;
+    }
+
+    const char *nat_type = ctx->argv[2];
+    if (strcmp(nat_type, "dnat") && strcmp(nat_type, "snat")
+            && strcmp(nat_type, "dnat_and_snat")) {
+        ctl_error(ctx, "%s: type must be one of \"dnat\", \"snat\" and "
+                  "\"dnat_and_snat\".", nat_type);
+        return;
+    }
+
+    error = address_set_by_name_or_uuid(ctx, ctx->argv[4], true, &addr_set);
+    if (error) {
+        ctx->error = error;
+        return;
+    }
+
+    char *nat_ip = normalize_prefix_str(ctx->argv[3]);
+    if (!nat_ip) {
+        ctl_error(ctx, "%s: Invalid IP address or CIDR", ctx->argv[3]);
+        return;
+    }
+
+    int is_snat = !strcmp("snat", nat_type);
+
+    /* Update the matching NAT. */
+    for (size_t i = 0; i < lr->n_nat; i++) {
+        struct nbrec_nat *nat = lr->nat[i];
+        char *old_ip = normalize_prefix_str(is_snat
+                                            ? nat->logical_ip
+                                            : nat->external_ip);
+
+        if (!old_ip) {
+            continue;
+        }
+
+        if (!strcmp(nat_type, nat->type) && !strcmp(nat_ip, old_ip)) {
+            nat_found = true;
+            nbrec_logical_router_verify_nat(lr);
+            if (is_exempted) {
+                nbrec_nat_set_exempted_ext_ips(nat, addr_set);
+            } else {
+                nbrec_nat_set_allowed_ext_ips(nat, addr_set);
+            }
+            return;
+        }
+    }
+
+    if (!nat_found) {
+        ctl_error(ctx, "%s: Could not locate nat rule for: %s.",
+                  nat_type, nat_ip);
+    }
+
+    free(nat_ip);
+}
+

 static char * OVS_WARN_UNUSED_RESULT
 lrp_by_name_or_uuid(struct ctl_context *ctx, const char *id, bool must_exist,
@@ -6402,7 +6515,8 @@ static const struct ctl_command_syntax nbctl_commands[] = {
     { "lr-nat-del", 1, 3, "ROUTER [TYPE [IP]]", NULL,
         nbctl_lr_nat_del, NULL, "--if-exists", RW },
     { "lr-nat-list", 1, 1, "ROUTER", NULL, nbctl_lr_nat_list, NULL, "", RO },
-
+    { "lr-nat-update-ext-ip", 4, 4, "ROUTER TYPE IP ADDRESS_SET", NULL,
+      nbctl_lr_nat_set_ext_ips, NULL, "--is-exempted", RW},
     /* load balancer commands. */
     { "lb-add", 3, 4, "LB VIP[:PORT] IP[:PORT]... [PROTOCOL]", NULL,
       nbctl_lb_add, NULL, "--may-exist,--add-duplicate", RW },
--
1.8.3.1

_______________________________________________
dev mailing list
dev at openvswitch.org<mailto:dev at openvswitch.org>
https://mail.openvswitch.org/mailman/listinfo/ovs-dev [mail.openvswitch.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__mail.openvswitch.org_mailman_listinfo_ovs-2Ddev&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=gdsHrMKI-VOHoN1ziUyqlIGzgVzIjMMz-NHIsocZYPE&m=AUKavBNgnyuDqvht4dTSZuoePdT9-Y2OWzMMp41y240&s=eyFsmNryZAlgNeiA4d71RnY5CWkAg_SEoRNAAFWqMvc&e=>



More information about the dev mailing list