private Boolean isSecondSliceSharingController(String thisSlice, String hostname, int port) {
Collection<String> sliceList;
try {
sliceList = listSlices();
} catch (PermissionDeniedException e1) {
return false;
}
for (String otherSlice : sliceList) {
if (otherSlice.equals(thisSlice)) {
// This is actually the same slice, ignore
continue;
}
try {
if (FVConfig.getSliceHost(otherSlice).equalsIgnoreCase(hostname)) {
if (FVConfig.getSlicePort(otherSlice) == port) {
return true;
}
}
} catch (ConfigError e) {
// Guess it wasn't a match. just ignore
}
}
return false;
}
public void init() {
FVLog.log(LogLevel.DEBUG, this, "initializing new FVSlicer");
// snag controller info from config
try {
hostname = FVConfig.getSliceHost(sliceName);
port = FVConfig.getSlicePort(sliceName);
lldpOptIn = FVConfig.getLLDPSpam(sliceName);
SliceImpl.addListener(sliceName, this);
} catch (ConfigError e) {
FVLog.log(
LogLevel.CRIT, this, "ignoring slice ", sliceName, " malformed slice definition: ", e);
this.tearDown();
return;
}
this.updatePortList();
this.reconnect();
this.keepAlive = new OFKeepAlive(this, this, loop);
this.keepAlive.scheduleNextCheck();
fvClassifier.loadLimit(sliceName);
fvClassifier.loadRateLimit(sliceName);
try {
this.fmlimit = SliceImpl.getProxy().getMaxFlowMods(sliceName);
} catch (ConfigError e) {
FVLog.log(LogLevel.WARN, this, "Global slice flow mod limit unreadable; disabling.");
this.fmlimit = -1;
}
}
@Override
public String dumpConfig() throws PermissionDeniedException, FileNotFoundException {
String user = APIUserCred.getUserName();
if (!FVConfig.isSupervisor(user))
throw new PermissionDeniedException(
"User " + user + " cannot dump the configuration to file ");
return FVConfig.getConfig();
}
protected Collection<FlowEntry> getFlowEntries() throws ConfigError {
String sliceName = APIUserCred.getUserName();
FVLog.log(LogLevel.DEBUG, null, "API listFlowSpace() by: " + sliceName);
FlowMap flowMap;
synchronized (FVConfig.class) {
if (FVConfig.isSupervisor(sliceName)) flowMap = FVConfig.getFlowSpaceFlowMap();
else flowMap = FlowSpaceUtil.getSliceFlowSpace(sliceName);
return flowMap.getRules();
}
}
@Override
public Map<String, String> getSliceInfo(String sliceName)
throws PermissionDeniedException, SliceNotFound {
/*
* relaxed security -- anyone can read slice info for now String user =
* APIUserCred.getUserName(); if (!FVConfig.isSupervisor(user) &&
* !APIAuth.transitivelyCreated(user, sliceName)) throw new
* PermissionDeniedException(
* "not superuser or transitive slice creator");
*/
if (!(doesSliceExist(sliceName))) {
throw new SliceNotFound("Slice does not exist: " + sliceName);
}
HashMap<String, String> map = new HashMap<String, String>();
synchronized (FVConfig.class) {
try {
map.put("contact_email", FVConfig.getSliceEmail(sliceName));
map.put("controller_hostname", FVConfig.getSliceHost(sliceName));
map.put("controller_port", String.valueOf(FVConfig.getSlicePort(sliceName)));
map.put("creator", FVConfig.getSliceCreator(sliceName));
map.put("drop_policy", FVConfig.getSlicePolicy(sliceName));
} catch (ConfigError e) {
FVLog.log(LogLevel.CRIT, null, "malformed slice: " + e);
e.printStackTrace();
}
}
long dpid;
int connection = 1;
// TODO: come back an architect this so we can walk the list of slicers,
// not the list of classifiers, and then slicers
for (Iterator<FVEventHandler> it = FlowVisor.getInstance().getHandlersCopy().iterator();
it.hasNext(); ) {
FVEventHandler eventHandler = it.next();
if (eventHandler instanceof FVClassifier) {
FVClassifier classifier = (FVClassifier) eventHandler;
if (!classifier.isIdentified()) // only print switches have have
// been identified
continue;
dpid = classifier.getDPID();
FVSlicer fvSlicer = classifier.getSlicerByName(sliceName);
if (fvSlicer != null) {
map.put(
"connection_" + connection++,
FlowSpaceUtil.dpidToString(dpid) + "-->" + fvSlicer.getConnectionName());
}
}
}
return map;
}
/**
* Change the password for this slice
*
* <p>A slice is allowed to change its own password and the password of any slice that it has
* (transitively) created
*
* @param sliceName
* @param newPasswd
*/
@Override
public Boolean changePasswd(String sliceName, String newPasswd) throws PermissionDeniedException {
String changerSlice = APIUserCred.getUserName();
if (!APIAuth.transitivelyCreated(changerSlice, sliceName)
&& !FVConfig.isSupervisor(changerSlice))
throw new PermissionDeniedException(
"Slice " + changerSlice + " does not have perms to change the passwd of " + sliceName);
String salt = APIAuth.getSalt();
String crypt = APIAuth.makeCrypt(salt, newPasswd);
sliceName = FVConfig.sanitize(sliceName);
// set passwd is synchronized
FVConfig.setPasswd(sliceName, salt, crypt);
FlowVisor.getInstance().checkPointConfig();
return true;
}
@Override
public boolean setMaximumFlowMods(String sliceName, String dpid, String maxFlowMods)
throws PermissionDeniedException {
String user = APIUserCred.getUserName();
if (!APIAuth.transitivelyCreated(user, sliceName) && !FVConfig.isSupervisor(user))
throw new PermissionDeniedException(
"User " + user + " does not have perms to set the flow mod limit for slice " + sliceName);
Long dp = FlowSpaceUtil.parseDPID(dpid);
int limit = Integer.parseInt(maxFlowMods);
FVLog.log(
LogLevel.DEBUG,
null,
"Setting flowmod limit for slice "
+ sliceName
+ " for dpid "
+ dpid
+ " to "
+ maxFlowMods);
try {
if (dp == FlowEntry.ALL_DPIDS) SliceImpl.getProxy().setMaxFlowMods(sliceName, limit);
else SwitchImpl.getProxy().setMaxFlowMods(sliceName, dp, limit);
} catch (ConfigError e) {
return false;
}
return true;
}
@Override
public Boolean changeSlice(String sliceName, String key, String value)
throws MalformedURLException, InvalidSliceName, PermissionDeniedException, InvalidUserInfoKey,
DuplicateControllerException {
String changerSlice = APIUserCred.getUserName();
if (!APIAuth.transitivelyCreated(changerSlice, sliceName)
&& !FVConfig.isSupervisor(changerSlice))
throw new PermissionDeniedException(
"Slice " + changerSlice + " does not have perms to change the passwd of " + sliceName);
/**
* this is the list of things a user is allowed to change about themselves. Critically, it
* should not include "creator" string as this would allow security issues.
*/
try {
if (key.equals("contact_email")) FVConfig.setSliceContactEmail(sliceName, value);
else if (key.equals("controller_hostname")) {
// make sure there isn't already a slice with this hostname and port
// that this slice uses
if (isSecondSliceSharingController(sliceName, value, FVConfig.getSlicePort(sliceName))) {
throw new DuplicateControllerException(
value, FVConfig.getSlicePort(sliceName), sliceName, "changed");
}
FVConfig.setSliceHost(sliceName, value);
} else if (key.equals("controller_port")) {
// Make sure that there isn't already a slice on this port that uses
// the same hostname that this slice uses
if (isSecondSliceSharingController(
sliceName, FVConfig.getSliceHost(sliceName), Integer.parseInt(value))) {
throw new DuplicateControllerException(
FVConfig.getSliceHost(sliceName), Integer.parseInt(value), sliceName, "changed");
}
FVConfig.setSlicePort(sliceName, Integer.valueOf(value));
} else if (key.equals("drop_policy")) {
// Set the drop policy when the controller is done,
// either to an exact match of the packet in or to the
// flow entry.
FVConfig.setSliceDropPolicy(sliceName, value);
} else
throw new InvalidUserInfoKey(
"invalid key: "
+ key
+ "-- only contact_email, drop_policy and "
+ "controller_{hostname,port} can be changed");
FlowVisor.getInstance().checkPointConfig();
} catch (ConfigError e) {
// this should probably never happen b/c of above checks
throw new InvalidUserInfoKey(e.toString());
}
return true;
}
/*
* @return true if slice exists, otherwise false
* @param sliceName name of slice to check for existance
*/
public static boolean doesSliceExist(String sliceName) {
List<String> slices = new ArrayList<String>();
try {
slices = FVConfig.getAllSlices();
} catch (ConfigError e) {
e.printStackTrace();
}
return slices.contains(sliceName);
}
public static void main(String args[]) throws FileNotFoundException, ConfigError {
if (args.length < 3) {
System.err.println("Usage: <config.xml> <dpid> <ofmatch>");
System.exit(1);
}
FVConfig.readFromFile(args[0]);
long dpid = FlowSpaceUtil.parseDPID(args[1]);
FVMatch packet = new FVMatch();
packet.fromString(args[2]);
System.err.println(
"Looking up packet '" + packet + "' on dpid=" + FlowSpaceUtil.dpidToString(dpid));
List<FlowEntry> entries = FVConfig.getFlowSpaceFlowMap().matches(dpid, packet);
System.err.println("Matches found: " + entries.size());
if (entries.size() > 1) System.err.println("WARN: only sending to the first match");
for (FlowEntry flowEntry : entries) {
System.out.println(flowEntry);
}
}
@Override
public Boolean setFlowTracking(String flowtracking) throws PermissionDeniedException {
String user = APIUserCred.getUserName();
if (!FVConfig.isSupervisor(user))
throw new PermissionDeniedException(
"User " + user + " does not have perms to enable or disable flow tracking");
boolean track = Boolean.parseBoolean(flowtracking);
FVLog.log(
LogLevel.DEBUG, null, "Setting flow tracking to " + (track ? "enabled." : "disabled."));
FlowvisorImpl.getProxy().settrack_flows(track);
return true;
}
public Integer getCurrentFlowMods(String sliceName, String dpid)
throws PermissionDeniedException, SliceNotFound, DPIDNotFound {
String user = APIUserCred.getUserName();
if (!APIAuth.transitivelyCreated(user, sliceName) && !FVConfig.isSupervisor(user))
throw new PermissionDeniedException(
"User "
+ user
+ " does not have perms to get the current flow mod value for slice "
+ sliceName);
Long dp = FlowSpaceUtil.parseDPID(dpid);
if (dp == FlowEntry.ALL_DPIDS) return getSliceLimits().getSliceFMLimit(sliceName);
else return lookupClassifier(dp).getCurrentFlowModCounter(sliceName);
}
@Override
public Boolean setFloodPerm(String floodPerm) throws PermissionDeniedException {
String user = APIUserCred.getUserName();
if (!FVConfig.isSupervisor(user))
throw new PermissionDeniedException(
"User "
+ user
+ " does not have perms to change the default flood perms to "
+ floodPerm);
FVLog.log(LogLevel.DEBUG, null, "Setting default flood perm to " + floodPerm);
FlowvisorImpl.getProxy().setFloodPerm(floodPerm);
return true;
}
@Override
public Boolean getFlowTracking() throws PermissionDeniedException {
String user = APIUserCred.getUserName();
if (!FVConfig.isSupervisor(user))
throw new PermissionDeniedException(
"User " + user + " does not have perms to obtain flow tracking status");
FVLog.log(LogLevel.DEBUG, null, "Getting flow tracking status");
try {
return FlowvisorImpl.getProxy().gettrack_flows();
} catch (ConfigError e) {
FVLog.log(LogLevel.ALERT, null, "Unable to get flow tracking status ", e.getMessage());
}
return null;
}
@Override
public Integer getMaximumFlowMods(String sliceName, String dpid)
throws PermissionDeniedException {
String user = APIUserCred.getUserName();
if (!APIAuth.transitivelyCreated(user, sliceName) && !FVConfig.isSupervisor(user))
throw new PermissionDeniedException(
"User " + user + " does not have perms to get the flow mod limit for slice " + sliceName);
Long dp = FlowSpaceUtil.parseDPID(dpid);
try {
if (dp == FlowEntry.ALL_DPIDS) return SliceImpl.getProxy().getMaxFlowMods(sliceName);
else return SwitchImpl.getProxy().getMaxFlowMods(sliceName, dp);
} catch (ConfigError e) {
FVLog.log(LogLevel.DEBUG, null, "Unable to get flow mod limit; " + e.getMessage());
return null;
}
}
@Override
public String getFloodPerm(String dpidStr) throws PermissionDeniedException {
String user = APIUserCred.getUserName();
if (!FVConfig.isSupervisor(user))
throw new PermissionDeniedException(
"User " + user + " does not have perms to obtain the flood perms of " + dpidStr);
FVLog.log(LogLevel.DEBUG, null, "Setting flood perm for : ", dpidStr);
long dpid = FlowSpaceUtil.parseDPID(dpidStr);
try {
return SwitchImpl.getProxy().getFloodPerm(dpid);
} catch (ConfigError e) {
FVLog.log(LogLevel.ALERT, null, "Unable to set floodperm", e.getMessage());
}
return null;
}
/**
* Tell the classifier to drop packets that look like this
*
* @param fvClassifier
* @param flowEntry
* @param hardTimeout
* @param idleTimeout
*/
private void sendDropRule(
FVClassifier fvClassifier,
FlowEntry flowEntry,
String sliceName,
short hardTimeout,
short idleTimeout) {
FVFlowMod flowMod =
(FVFlowMod) FlowVisor.getInstance().getFactory().getMessage(OFType.FLOW_MOD);
// block this exact flow
OFMatch match = new OFMatch();
match.loadFromPacket(this.packetData, this.inPort);
// different from previous policty of block by rule
// flowMod.setMatch(flowEntry.getRuleMatch());
String drop_policy = null;
try {
drop_policy = FVConfig.getDropPolicy(sliceName);
} catch (ConfigError e) {
FVLog.log(
LogLevel.ALERT,
fvClassifier,
"Failed to retrieve drop policy from config." + "\nDefauting to exact drop_policy");
drop_policy = "exact";
}
if (drop_policy.equals("exact")) flowMod.setMatch(match);
else if (drop_policy.equals("rule")) flowMod.setMatch(flowEntry.getRuleMatch());
else
// Should never happen
FVLog.log(LogLevel.CRIT, fvClassifier, "Error in configuration!");
flowMod.setCommand(FVFlowMod.OFPFC_ADD);
flowMod.setActions(new LinkedList<OFAction>()); // send to zero-length
// list, i.e., DROP
flowMod.setLengthU(OFFlowMod.MINIMUM_LENGTH);
flowMod.setHardTimeout(hardTimeout);
flowMod.setIdleTimeout(idleTimeout);
flowMod.setPriority((short) 0); // set to lowest priority
flowMod.setFlags((short) 1);
// send removed msg (1), not the check overlap (2), or
// emergency flow cache (4)
FVLog.log(
LogLevel.WARN,
fvClassifier,
"inserting drop (hard=" + hardTimeout + ",idle=" + idleTimeout + ") rule for " + flowEntry);
fvClassifier.sendMsg(flowMod, fvClassifier);
}
@Override
public Collection<String> listSlices() throws PermissionDeniedException {
/*
* relaxed security; anyone can get a list of slices if
* (!FVConfig.isSupervisor(APIUserCred.getUserName())) throw new
* PermissionDeniedException( "listSlices only available to root");
*/
List<String> slices = null;
synchronized (FVConfig.class) {
try {
// this is synchronized
List<String> entries = FVConfig.getAllSlices();
slices = new LinkedList<String>(entries);
} catch (ConfigError e) {
e.printStackTrace();
throw new RuntimeException("wtf!?: no SLICES subdir found in config");
}
}
return slices;
}
@Override
public Boolean deleteSlice(String sliceName)
throws SliceNotFound, PermissionDeniedException, ConfigError {
String changerSlice = APIUserCred.getUserName();
if (!APIAuth.transitivelyCreated(changerSlice, sliceName)) {
FVLog.log(
LogLevel.WARN,
null,
"API deletSlice(" + sliceName + ") failed by: " + APIUserCred.getUserName());
throw new PermissionDeniedException(
"Slice " + changerSlice + " does not have perms to change the passwd of " + sliceName);
}
synchronized (FVConfig.class) {
FVLog.log(
LogLevel.DEBUG,
null,
"API removeSlice(" + sliceName + ") by: " + APIUserCred.getUserName());
FlowMap flowSpace = FlowSpaceUtil.deleteFlowSpaceBySlice(sliceName);
try {
// this is also synchronized against FVConfig.class
FVConfig.deleteSlice(sliceName);
} catch (Exception e) {
throw new SliceNotFound("slice does not exist: " + sliceName);
}
/*
* We need to do this because of the linear flowmap, because
* it wants the slicers and classifiers to update their
* view of the flowspace.
* Once linearflowmap is dropped, this should be dropped as
* well.
*
* FIXME
*/
FlowSpaceImpl.getProxy().notifyChange(flowSpace);
// FVConfig.sendUpdates(FVConfig.FLOWSPACE);
// signal that FS has changed
FlowVisor.getInstance().checkPointConfig();
}
return true;
}
/**
* Create a new slice (without flowspace)
*
* <p>Slices that contain the field separator are rewritten with underscores
*
* @param sliceName Cannot contain FVConfig.FS == '!'
* @param passwd Cleartext! FIXME
* @param controller_url Reference controller pseudo-url, e.g., tcp:hostname[:port]
* @param slice_email As a contract for the slice
* @return success
* @throws InvalidSliceName
* @throws PermissionDeniedException
* @throws DuplicateControllerException
*/
@Override
public Boolean createSlice(
String sliceName,
String passwd,
String controller_url,
String drop_policy,
String slice_email)
throws MalformedControllerURL, InvalidSliceName, InvalidDropPolicy, PermissionDeniedException,
DuplicateControllerException {
// FIXME: make sure this user has perms to do this OP
// for now, all slices can create other slices
// FIXME: for now, only handle tcp, not ssl controller url
String[] list = controller_url.split(":");
if (!FVConfig.isSupervisor(APIUserCred.getUserName()))
throw new PermissionDeniedException("only superusers can create new slices");
if (list.length < 2)
throw new MalformedControllerURL(
"controller url needs to be of the form "
+ "proto:hostname[:port], e.g., tcp:yourhost.foo.com:6633, not: "
+ controller_url);
if (!list[0].equals("tcp"))
throw new MalformedControllerURL(
"Flowvisor currently only supports 'tcp' proto, not: " + list[0]);
int controller_port;
if (list.length >= 3) controller_port = Integer.valueOf(list[2]);
else controller_port = FVConfig.OFP_TCP_PORT;
// createSlice is synchronized()
if (drop_policy.equals("")) drop_policy = "exact";
else if (!drop_policy.equals("exact") && !drop_policy.equals("rule"))
throw new InvalidDropPolicy(
"Flowvisor currently supports an 'exact'" + " or a 'rule' based drop policy");
// We need to make sure this slice doesn't already exist
List<String> slices = null;
synchronized (FVConfig.class) {
try {
slices = FVConfig.getAllSlices();
} catch (ConfigError e) {
e.printStackTrace();
throw new RuntimeException("no SLICES subdir found in config");
}
for (Iterator<String> sliceIter = slices.iterator(); sliceIter.hasNext(); ) {
String existingSlice = sliceIter.next();
if (sliceName.equals(existingSlice)) {
throw new PermissionDeniedException("Cannot create slice with existing name.");
}
}
}
FVConfig.createSlice(
sliceName,
list[1],
controller_port,
drop_policy,
passwd,
slice_email,
APIUserCred.getUserName());
FlowVisor.getInstance().checkPointConfig();
return true;
}
