diff mbox series

[ovs-dev,2/4] rbac: Only allow relevant chassis to update service monitors.

Message ID 20240119213331.454896-2-mmichels@redhat.com
State Superseded
Headers show
Series [ovs-dev,1/4] rbac: MAC_Bindings can only be updated by the inserting chassis. | expand

Checks

Context Check Description
ovsrobot/apply-robot warning apply and check: warning
ovsrobot/github-robot-_Build_and_Test fail github build: failed
ovsrobot/github-robot-_ovn-kubernetes success github build: passed

Commit Message

Mark Michelson Jan. 19, 2024, 9:33 p.m. UTC 
Service monitors already had the restriction that chassis could not
insert or delete records. However, there was nothing restricting chassis
from updating records for service monitors that are relevant to other
chassis.

This change adds a new "chassis_name" column to the Service_Monitor
table. ovn-northd will set this column to the chassis on which the
relevant logical port is bound. This way, only that particular chassis
can update the status of the service monitor.
---
 northd/northd.c     | 19 +++++++++++++++++--
 northd/ovn-northd.c |  2 +-
 ovn-sb.ovsschema    |  5 +++--
 ovn-sb.xml          |  4 ++++
 4 files changed, 25 insertions(+), 5 deletions(-)

Comments

0-day Robot Jan. 19, 2024, 9:44 p.m. UTC | #1 
Bleep bloop.  Greetings Mark Michelson, I am a robot and I have tried out your patch.
Thanks for your contribution.

I encountered some error that I wasn't expecting.  See the details below.


checkpatch:
ERROR: Author Mark Michelson <mmichels@redhat.com> needs to sign off.
Lines checked: 131, Warnings: 0, Errors: 1


Please check this out.  If you feel there has been an error, please email aconole@redhat.com

Thanks,
0-day Robot
diff mbox series

Patch

diff --git a/northd/northd.c b/northd/northd.c
index 952f8200d..9821fcef5 100644
--- a/northd/northd.c
+++ b/northd/northd.c
@@ -3841,13 +3841,19 @@  static struct service_monitor_info *
 create_or_get_service_mon(struct ovsdb_idl_txn *ovnsb_txn,
                           struct hmap *monitor_map,
                           const char *ip, const char *logical_port,
-                          uint16_t service_port, const char *protocol)
+                          uint16_t service_port, const char *protocol,
+                          const char *chassis_name)
 {
     struct service_monitor_info *mon_info =
         get_service_mon(monitor_map, ip, logical_port, service_port,
                         protocol);
 
     if (mon_info) {
+        if (chassis_name && strcmp(mon_info->sbrec_mon->chassis_name,
+                                   chassis_name)) {
+            sbrec_service_monitor_set_chassis_name(mon_info->sbrec_mon,
+                                                   chassis_name);
+        }
         return mon_info;
     }
 
@@ -3862,6 +3868,9 @@  create_or_get_service_mon(struct ovsdb_idl_txn *ovnsb_txn,
     sbrec_service_monitor_set_port(sbrec_mon, service_port);
     sbrec_service_monitor_set_logical_port(sbrec_mon, logical_port);
     sbrec_service_monitor_set_protocol(sbrec_mon, protocol);
+    if (chassis_name) {
+        sbrec_service_monitor_set_chassis_name(sbrec_mon, chassis_name);
+    }
     mon_info = xzalloc(sizeof *mon_info);
     mon_info->sbrec_mon = sbrec_mon;
     hmap_insert(monitor_map, &mon_info->hmap_node, hash);
@@ -3904,12 +3913,18 @@  ovn_lb_svc_create(struct ovsdb_idl_txn *ovnsb_txn,
                 protocol = "tcp";
             }
 
+            const char *chassis_name = NULL;
+            if (op->sb && op->sb->chassis) {
+                chassis_name = op->sb->chassis->name;
+            }
+
             struct service_monitor_info *mon_info =
                 create_or_get_service_mon(ovnsb_txn, monitor_map,
                                           backend->ip_str,
                                           backend_nb->logical_port,
                                           backend->port,
-                                          protocol);
+                                          protocol,
+                                          chassis_name);
             ovs_assert(mon_info);
             sbrec_service_monitor_set_options(
                 mon_info->sbrec_mon, &lb_vip_nb->lb_health_check->options);
diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
index f51dbecb4..ef580b561 100644
--- a/northd/ovn-northd.c
+++ b/northd/ovn-northd.c
@@ -114,7 +114,7 @@  static const char *rbac_mac_binding_update[] =
     {"logical_port", "ip", "mac", "datapath", "timestamp"};
 
 static const char *rbac_svc_monitor_auth[] =
-    {""};
+    {"chassis_name"};
 static const char *rbac_svc_monitor_auth_update[] =
     {"status"};
 static const char *rbac_igmp_group_auth[] =
diff --git a/ovn-sb.ovsschema b/ovn-sb.ovsschema
index 9cf91c8f7..563d1a215 100644
--- a/ovn-sb.ovsschema
+++ b/ovn-sb.ovsschema
@@ -1,7 +1,7 @@ 
 {
     "name": "OVN_Southbound",
-    "version": "20.31.0",
-    "cksum": "3395536250 31224",
+    "version": "20.32.0",
+    "cksum": "482767101 31276",
     "tables": {
         "SB_Global": {
             "columns": {
@@ -510,6 +510,7 @@ 
                 "logical_port": {"type": "string"},
                 "src_mac": {"type": "string"},
                 "src_ip": {"type": "string"},
+                "chassis_name": {"type": "string"},
                 "status": {
                     "type": {"key": {"type": "string",
                              "enum": ["set", ["online", "offline", "error"]]},
diff --git a/ovn-sb.xml b/ovn-sb.xml
index 411074083..046913201 100644
--- a/ovn-sb.xml
+++ b/ovn-sb.xml
@@ -4818,6 +4818,10 @@  tcp.flags = RST;
         Source IPv4 address to use in the service monitor packet.
       </column>
 
+      <column name="chassis_name">
+        The name of the chassis where the logical port is bound.
+      </column>
+
       <column name="options" key="interval" type='{"type": "integer"}'>
         The interval, in seconds, between service monitor checks.
       </column>