Ejemplo n.º 1
0
  private Boolean isSecondSliceSharingController(String thisSlice, String hostname, int port) {
    Collection<String> sliceList;
    try {
      sliceList = listSlices();
    } catch (PermissionDeniedException e1) {
      return false;
    }
    for (String otherSlice : sliceList) {
      if (otherSlice.equals(thisSlice)) {
        // This is actually the same slice, ignore
        continue;
      }
      try {
        if (FVConfig.getSliceHost(otherSlice).equalsIgnoreCase(hostname)) {
          if (FVConfig.getSlicePort(otherSlice) == port) {
            return true;
          }
        }
      } catch (ConfigError e) {
        // Guess it wasn't a match. just ignore
      }
    }

    return false;
  }
Ejemplo n.º 2
0
  public void init() {
    FVLog.log(LogLevel.DEBUG, this, "initializing new FVSlicer");

    // snag controller info from config
    try {
      hostname = FVConfig.getSliceHost(sliceName);
      port = FVConfig.getSlicePort(sliceName);
      lldpOptIn = FVConfig.getLLDPSpam(sliceName);
      SliceImpl.addListener(sliceName, this);
    } catch (ConfigError e) {
      FVLog.log(
          LogLevel.CRIT, this, "ignoring slice ", sliceName, " malformed slice definition: ", e);
      this.tearDown();
      return;
    }
    this.updatePortList();
    this.reconnect();
    this.keepAlive = new OFKeepAlive(this, this, loop);
    this.keepAlive.scheduleNextCheck();
    fvClassifier.loadLimit(sliceName);
    fvClassifier.loadRateLimit(sliceName);
    try {
      this.fmlimit = SliceImpl.getProxy().getMaxFlowMods(sliceName);
    } catch (ConfigError e) {
      FVLog.log(LogLevel.WARN, this, "Global slice flow mod limit unreadable; disabling.");
      this.fmlimit = -1;
    }
  }
Ejemplo n.º 3
0
 @Override
 public String dumpConfig() throws PermissionDeniedException, FileNotFoundException {
   String user = APIUserCred.getUserName();
   if (!FVConfig.isSupervisor(user))
     throw new PermissionDeniedException(
         "User " + user + " cannot dump the configuration to file ");
   return FVConfig.getConfig();
 }
Ejemplo n.º 4
0
 protected Collection<FlowEntry> getFlowEntries() throws ConfigError {
   String sliceName = APIUserCred.getUserName();
   FVLog.log(LogLevel.DEBUG, null, "API listFlowSpace() by: " + sliceName);
   FlowMap flowMap;
   synchronized (FVConfig.class) {
     if (FVConfig.isSupervisor(sliceName)) flowMap = FVConfig.getFlowSpaceFlowMap();
     else flowMap = FlowSpaceUtil.getSliceFlowSpace(sliceName);
     return flowMap.getRules();
   }
 }
Ejemplo n.º 5
0
  @Override
  public Map<String, String> getSliceInfo(String sliceName)
      throws PermissionDeniedException, SliceNotFound {

    /*
     * relaxed security -- anyone can read slice info for now String user =
     * APIUserCred.getUserName(); if (!FVConfig.isSupervisor(user) &&
     * !APIAuth.transitivelyCreated(user, sliceName)) throw new
     * PermissionDeniedException(
     * "not superuser or transitive slice creator");
     */
    if (!(doesSliceExist(sliceName))) {
      throw new SliceNotFound("Slice does not exist: " + sliceName);
    }

    HashMap<String, String> map = new HashMap<String, String>();

    synchronized (FVConfig.class) {
      try {
        map.put("contact_email", FVConfig.getSliceEmail(sliceName));
        map.put("controller_hostname", FVConfig.getSliceHost(sliceName));
        map.put("controller_port", String.valueOf(FVConfig.getSlicePort(sliceName)));
        map.put("creator", FVConfig.getSliceCreator(sliceName));
        map.put("drop_policy", FVConfig.getSlicePolicy(sliceName));
      } catch (ConfigError e) {
        FVLog.log(LogLevel.CRIT, null, "malformed slice: " + e);
        e.printStackTrace();
      }
    }
    long dpid;
    int connection = 1;

    // TODO: come back an architect this so we can walk the list of slicers,
    // not the list of classifiers, and then slicers
    for (Iterator<FVEventHandler> it = FlowVisor.getInstance().getHandlersCopy().iterator();
        it.hasNext(); ) {
      FVEventHandler eventHandler = it.next();
      if (eventHandler instanceof FVClassifier) {
        FVClassifier classifier = (FVClassifier) eventHandler;
        if (!classifier.isIdentified()) // only print switches have have
          // been identified
          continue;
        dpid = classifier.getDPID();
        FVSlicer fvSlicer = classifier.getSlicerByName(sliceName);
        if (fvSlicer != null) {
          map.put(
              "connection_" + connection++,
              FlowSpaceUtil.dpidToString(dpid) + "-->" + fvSlicer.getConnectionName());
        }
      }
    }

    return map;
  }
Ejemplo n.º 6
0
 /**
  * Change the password for this slice
  *
  * <p>A slice is allowed to change its own password and the password of any slice that it has
  * (transitively) created
  *
  * @param sliceName
  * @param newPasswd
  */
 @Override
 public Boolean changePasswd(String sliceName, String newPasswd) throws PermissionDeniedException {
   String changerSlice = APIUserCred.getUserName();
   if (!APIAuth.transitivelyCreated(changerSlice, sliceName)
       && !FVConfig.isSupervisor(changerSlice))
     throw new PermissionDeniedException(
         "Slice " + changerSlice + " does not have perms to change the passwd of " + sliceName);
   String salt = APIAuth.getSalt();
   String crypt = APIAuth.makeCrypt(salt, newPasswd);
   sliceName = FVConfig.sanitize(sliceName);
   // set passwd is synchronized
   FVConfig.setPasswd(sliceName, salt, crypt);
   FlowVisor.getInstance().checkPointConfig();
   return true;
 }
Ejemplo n.º 7
0
 @Override
 public boolean setMaximumFlowMods(String sliceName, String dpid, String maxFlowMods)
     throws PermissionDeniedException {
   String user = APIUserCred.getUserName();
   if (!APIAuth.transitivelyCreated(user, sliceName) && !FVConfig.isSupervisor(user))
     throw new PermissionDeniedException(
         "User " + user + " does not have perms to set the flow mod limit for slice " + sliceName);
   Long dp = FlowSpaceUtil.parseDPID(dpid);
   int limit = Integer.parseInt(maxFlowMods);
   FVLog.log(
       LogLevel.DEBUG,
       null,
       "Setting flowmod limit for slice "
           + sliceName
           + " for dpid "
           + dpid
           + " to "
           + maxFlowMods);
   try {
     if (dp == FlowEntry.ALL_DPIDS) SliceImpl.getProxy().setMaxFlowMods(sliceName, limit);
     else SwitchImpl.getProxy().setMaxFlowMods(sliceName, dp, limit);
   } catch (ConfigError e) {
     return false;
   }
   return true;
 }
Ejemplo n.º 8
0
  @Override
  public Boolean changeSlice(String sliceName, String key, String value)
      throws MalformedURLException, InvalidSliceName, PermissionDeniedException, InvalidUserInfoKey,
          DuplicateControllerException {
    String changerSlice = APIUserCred.getUserName();
    if (!APIAuth.transitivelyCreated(changerSlice, sliceName)
        && !FVConfig.isSupervisor(changerSlice))
      throw new PermissionDeniedException(
          "Slice " + changerSlice + " does not have perms to change the passwd of " + sliceName);
    /**
     * this is the list of things a user is allowed to change about themselves. Critically, it
     * should not include "creator" string as this would allow security issues.
     */
    try {
      if (key.equals("contact_email")) FVConfig.setSliceContactEmail(sliceName, value);
      else if (key.equals("controller_hostname")) {
        // make sure there isn't already a slice with this hostname and port
        // that this slice uses
        if (isSecondSliceSharingController(sliceName, value, FVConfig.getSlicePort(sliceName))) {
          throw new DuplicateControllerException(
              value, FVConfig.getSlicePort(sliceName), sliceName, "changed");
        }
        FVConfig.setSliceHost(sliceName, value);
      } else if (key.equals("controller_port")) {
        // Make sure that there isn't already a slice on this port that uses
        // the same hostname that this slice uses
        if (isSecondSliceSharingController(
            sliceName, FVConfig.getSliceHost(sliceName), Integer.parseInt(value))) {
          throw new DuplicateControllerException(
              FVConfig.getSliceHost(sliceName), Integer.parseInt(value), sliceName, "changed");
        }

        FVConfig.setSlicePort(sliceName, Integer.valueOf(value));
      } else if (key.equals("drop_policy")) {
        // Set the drop policy when the controller is done,
        // either to an exact match of the packet in or to the
        // flow entry.
        FVConfig.setSliceDropPolicy(sliceName, value);
      } else
        throw new InvalidUserInfoKey(
            "invalid key: "
                + key
                + "-- only contact_email, drop_policy and "
                + "controller_{hostname,port} can be changed");
      FlowVisor.getInstance().checkPointConfig();
    } catch (ConfigError e) {
      // this should probably never happen b/c of above checks
      throw new InvalidUserInfoKey(e.toString());
    }

    return true;
  }
Ejemplo n.º 9
0
 /*
  * @return true if slice exists, otherwise false
  * @param sliceName name of slice to check for existance
  */
 public static boolean doesSliceExist(String sliceName) {
   List<String> slices = new ArrayList<String>();
   try {
     slices = FVConfig.getAllSlices();
   } catch (ConfigError e) {
     e.printStackTrace();
   }
   return slices.contains(sliceName);
 }
Ejemplo n.º 10
0
  public static void main(String args[]) throws FileNotFoundException, ConfigError {
    if (args.length < 3) {
      System.err.println("Usage: <config.xml> <dpid> <ofmatch>");
      System.exit(1);
    }

    FVConfig.readFromFile(args[0]);
    long dpid = FlowSpaceUtil.parseDPID(args[1]);
    FVMatch packet = new FVMatch();
    packet.fromString(args[2]);

    System.err.println(
        "Looking up packet '" + packet + "' on dpid=" + FlowSpaceUtil.dpidToString(dpid));
    List<FlowEntry> entries = FVConfig.getFlowSpaceFlowMap().matches(dpid, packet);

    System.err.println("Matches found: " + entries.size());
    if (entries.size() > 1) System.err.println("WARN: only sending to the first match");
    for (FlowEntry flowEntry : entries) {
      System.out.println(flowEntry);
    }
  }
Ejemplo n.º 11
0
 @Override
 public Boolean setFlowTracking(String flowtracking) throws PermissionDeniedException {
   String user = APIUserCred.getUserName();
   if (!FVConfig.isSupervisor(user))
     throw new PermissionDeniedException(
         "User " + user + " does not have perms to enable or disable flow tracking");
   boolean track = Boolean.parseBoolean(flowtracking);
   FVLog.log(
       LogLevel.DEBUG, null, "Setting flow tracking to " + (track ? "enabled." : "disabled."));
   FlowvisorImpl.getProxy().settrack_flows(track);
   return true;
 }
Ejemplo n.º 12
0
 public Integer getCurrentFlowMods(String sliceName, String dpid)
     throws PermissionDeniedException, SliceNotFound, DPIDNotFound {
   String user = APIUserCred.getUserName();
   if (!APIAuth.transitivelyCreated(user, sliceName) && !FVConfig.isSupervisor(user))
     throw new PermissionDeniedException(
         "User "
             + user
             + " does not have perms to get the current flow mod value for slice "
             + sliceName);
   Long dp = FlowSpaceUtil.parseDPID(dpid);
   if (dp == FlowEntry.ALL_DPIDS) return getSliceLimits().getSliceFMLimit(sliceName);
   else return lookupClassifier(dp).getCurrentFlowModCounter(sliceName);
 }
Ejemplo n.º 13
0
  @Override
  public Boolean setFloodPerm(String floodPerm) throws PermissionDeniedException {
    String user = APIUserCred.getUserName();
    if (!FVConfig.isSupervisor(user))
      throw new PermissionDeniedException(
          "User "
              + user
              + " does not have perms to change the default flood perms to "
              + floodPerm);
    FVLog.log(LogLevel.DEBUG, null, "Setting default flood perm to " + floodPerm);

    FlowvisorImpl.getProxy().setFloodPerm(floodPerm);
    return true;
  }
Ejemplo n.º 14
0
 @Override
 public Boolean getFlowTracking() throws PermissionDeniedException {
   String user = APIUserCred.getUserName();
   if (!FVConfig.isSupervisor(user))
     throw new PermissionDeniedException(
         "User " + user + " does not have perms to obtain flow tracking status");
   FVLog.log(LogLevel.DEBUG, null, "Getting flow tracking status");
   try {
     return FlowvisorImpl.getProxy().gettrack_flows();
   } catch (ConfigError e) {
     FVLog.log(LogLevel.ALERT, null, "Unable to get flow tracking status ", e.getMessage());
   }
   return null;
 }
Ejemplo n.º 15
0
 @Override
 public Integer getMaximumFlowMods(String sliceName, String dpid)
     throws PermissionDeniedException {
   String user = APIUserCred.getUserName();
   if (!APIAuth.transitivelyCreated(user, sliceName) && !FVConfig.isSupervisor(user))
     throw new PermissionDeniedException(
         "User " + user + " does not have perms to get the flow mod limit for slice " + sliceName);
   Long dp = FlowSpaceUtil.parseDPID(dpid);
   try {
     if (dp == FlowEntry.ALL_DPIDS) return SliceImpl.getProxy().getMaxFlowMods(sliceName);
     else return SwitchImpl.getProxy().getMaxFlowMods(sliceName, dp);
   } catch (ConfigError e) {
     FVLog.log(LogLevel.DEBUG, null, "Unable to get flow mod limit; " + e.getMessage());
     return null;
   }
 }
Ejemplo n.º 16
0
  @Override
  public String getFloodPerm(String dpidStr) throws PermissionDeniedException {
    String user = APIUserCred.getUserName();
    if (!FVConfig.isSupervisor(user))
      throw new PermissionDeniedException(
          "User " + user + " does not have perms to obtain the flood perms of " + dpidStr);
    FVLog.log(LogLevel.DEBUG, null, "Setting flood perm for : ", dpidStr);
    long dpid = FlowSpaceUtil.parseDPID(dpidStr);
    try {
      return SwitchImpl.getProxy().getFloodPerm(dpid);

    } catch (ConfigError e) {
      FVLog.log(LogLevel.ALERT, null, "Unable to set floodperm", e.getMessage());
    }
    return null;
  }
Ejemplo n.º 17
0
  /**
   * Tell the classifier to drop packets that look like this
   *
   * @param fvClassifier
   * @param flowEntry
   * @param hardTimeout
   * @param idleTimeout
   */
  private void sendDropRule(
      FVClassifier fvClassifier,
      FlowEntry flowEntry,
      String sliceName,
      short hardTimeout,
      short idleTimeout) {
    FVFlowMod flowMod =
        (FVFlowMod) FlowVisor.getInstance().getFactory().getMessage(OFType.FLOW_MOD);
    // block this exact flow
    OFMatch match = new OFMatch();
    match.loadFromPacket(this.packetData, this.inPort);
    // different from previous policty of block by rule
    // flowMod.setMatch(flowEntry.getRuleMatch());

    String drop_policy = null;
    try {
      drop_policy = FVConfig.getDropPolicy(sliceName);
    } catch (ConfigError e) {
      FVLog.log(
          LogLevel.ALERT,
          fvClassifier,
          "Failed to retrieve drop policy from config." + "\nDefauting to exact drop_policy");
      drop_policy = "exact";
    }
    if (drop_policy.equals("exact")) flowMod.setMatch(match);
    else if (drop_policy.equals("rule")) flowMod.setMatch(flowEntry.getRuleMatch());
    else
      // Should never happen
      FVLog.log(LogLevel.CRIT, fvClassifier, "Error in configuration!");
    flowMod.setCommand(FVFlowMod.OFPFC_ADD);
    flowMod.setActions(new LinkedList<OFAction>()); // send to zero-length
    // list, i.e., DROP
    flowMod.setLengthU(OFFlowMod.MINIMUM_LENGTH);
    flowMod.setHardTimeout(hardTimeout);
    flowMod.setIdleTimeout(idleTimeout);
    flowMod.setPriority((short) 0); // set to lowest priority
    flowMod.setFlags((short) 1);
    // send removed msg (1), not the check overlap (2), or
    // emergency flow cache (4)

    FVLog.log(
        LogLevel.WARN,
        fvClassifier,
        "inserting drop (hard=" + hardTimeout + ",idle=" + idleTimeout + ") rule for " + flowEntry);
    fvClassifier.sendMsg(flowMod, fvClassifier);
  }
Ejemplo n.º 18
0
 @Override
 public Collection<String> listSlices() throws PermissionDeniedException {
   /*
    * relaxed security; anyone can get a list of slices if
    * (!FVConfig.isSupervisor(APIUserCred.getUserName())) throw new
    * PermissionDeniedException( "listSlices only available to root");
    */
   List<String> slices = null;
   synchronized (FVConfig.class) {
     try {
       // this is synchronized
       List<String> entries = FVConfig.getAllSlices();
       slices = new LinkedList<String>(entries);
     } catch (ConfigError e) {
       e.printStackTrace();
       throw new RuntimeException("wtf!?: no SLICES subdir found in config");
     }
   }
   return slices;
 }
Ejemplo n.º 19
0
  @Override
  public Boolean deleteSlice(String sliceName)
      throws SliceNotFound, PermissionDeniedException, ConfigError {
    String changerSlice = APIUserCred.getUserName();
    if (!APIAuth.transitivelyCreated(changerSlice, sliceName)) {
      FVLog.log(
          LogLevel.WARN,
          null,
          "API deletSlice(" + sliceName + ") failed by: " + APIUserCred.getUserName());
      throw new PermissionDeniedException(
          "Slice " + changerSlice + " does not have perms to change the passwd of " + sliceName);
    }
    synchronized (FVConfig.class) {
      FVLog.log(
          LogLevel.DEBUG,
          null,
          "API removeSlice(" + sliceName + ") by: " + APIUserCred.getUserName());
      FlowMap flowSpace = FlowSpaceUtil.deleteFlowSpaceBySlice(sliceName);
      try {
        // this is also synchronized against FVConfig.class
        FVConfig.deleteSlice(sliceName);
      } catch (Exception e) {
        throw new SliceNotFound("slice does not exist: " + sliceName);
      }

      /*
       * We need to do this because of the linear flowmap, because
       * it wants the slicers and classifiers to update their
       * view of the flowspace.
       * Once linearflowmap is dropped, this should be dropped as
       * well.
       *
       * FIXME
       */
      FlowSpaceImpl.getProxy().notifyChange(flowSpace);
      // FVConfig.sendUpdates(FVConfig.FLOWSPACE);
      // signal that FS has changed
      FlowVisor.getInstance().checkPointConfig();
    }
    return true;
  }
Ejemplo n.º 20
0
  /**
   * Create a new slice (without flowspace)
   *
   * <p>Slices that contain the field separator are rewritten with underscores
   *
   * @param sliceName Cannot contain FVConfig.FS == '!'
   * @param passwd Cleartext! FIXME
   * @param controller_url Reference controller pseudo-url, e.g., tcp:hostname[:port]
   * @param slice_email As a contract for the slice
   * @return success
   * @throws InvalidSliceName
   * @throws PermissionDeniedException
   * @throws DuplicateControllerException
   */
  @Override
  public Boolean createSlice(
      String sliceName,
      String passwd,
      String controller_url,
      String drop_policy,
      String slice_email)
      throws MalformedControllerURL, InvalidSliceName, InvalidDropPolicy, PermissionDeniedException,
          DuplicateControllerException {
    // FIXME: make sure this user has perms to do this OP
    // for now, all slices can create other slices
    // FIXME: for now, only handle tcp, not ssl controller url
    String[] list = controller_url.split(":");
    if (!FVConfig.isSupervisor(APIUserCred.getUserName()))
      throw new PermissionDeniedException("only superusers can create new slices");
    if (list.length < 2)
      throw new MalformedControllerURL(
          "controller url needs to be of the form "
              + "proto:hostname[:port], e.g., tcp:yourhost.foo.com:6633, not: "
              + controller_url);
    if (!list[0].equals("tcp"))
      throw new MalformedControllerURL(
          "Flowvisor currently only supports 'tcp' proto, not: " + list[0]);
    int controller_port;
    if (list.length >= 3) controller_port = Integer.valueOf(list[2]);
    else controller_port = FVConfig.OFP_TCP_PORT;
    // createSlice is synchronized()

    if (drop_policy.equals("")) drop_policy = "exact";
    else if (!drop_policy.equals("exact") && !drop_policy.equals("rule"))
      throw new InvalidDropPolicy(
          "Flowvisor currently supports an 'exact'" + " or a 'rule' based drop policy");

    // We need to make sure this slice doesn't already exist
    List<String> slices = null;
    synchronized (FVConfig.class) {
      try {
        slices = FVConfig.getAllSlices();
      } catch (ConfigError e) {
        e.printStackTrace();
        throw new RuntimeException("no SLICES subdir found in config");
      }
      for (Iterator<String> sliceIter = slices.iterator(); sliceIter.hasNext(); ) {
        String existingSlice = sliceIter.next();
        if (sliceName.equals(existingSlice)) {
          throw new PermissionDeniedException("Cannot create slice with existing name.");
        }
      }
    }

    FVConfig.createSlice(
        sliceName,
        list[1],
        controller_port,
        drop_policy,
        passwd,
        slice_email,
        APIUserCred.getUserName());
    FlowVisor.getInstance().checkPointConfig();
    return true;
  }