aboutsummaryrefslogtreecommitdiffstats
path: root/ice_validator/tests/test_neutron_port_addresses.py
blob: 0cd6b3bd560bb0445af9769eec1a69c83d0704e1 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
# -*- coding: utf8 -*-
# ============LICENSE_START====================================================
# org.onap.vvp/validation-scripts
# ===================================================================
# Copyright © 2017 AT&T Intellectual Property. All rights reserved.
# ===================================================================
#
# Unless otherwise specified, all software contained herein is licensed
# under the Apache License, Version 2.0 (the "License");
# you may not use this software except in compliance with the License.
# You may obtain a copy of the License at
#
#             http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
#
#
# Unless otherwise specified, all documentation contained herein is licensed
# under the Creative Commons License, Attribution 4.0 Intl. (the "License");
# you may not use this documentation except in compliance with the License.
# You may obtain a copy of the License at
#
#             https://creativecommons.org/licenses/by/4.0/
#
# Unless required by applicable law or agreed to in writing, documentation
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# ============LICENSE_END============================================
#
# ECOMP is a trademark and service mark of AT&T Intellectual Property.
#

"""
OS::Neutron::Port connecting to external network
must have at most one ip_address and at most one v6_ip_address.
"""

import collections
import os.path

import pytest

from .structures import Heat
from .helpers import validates

VERSION = "1.1.0"


def is_v6_ip(ip_address):
    if ip_address.find("v6") != -1:
        return True
    return False


def get_neutron_ports(heat):
    """Return dict of resource_id: resource, whose type is
    OS::Neutron::Port.
    """
    return {
        rid: resource
        for rid, resource in heat.resources.items()
        if heat.nested_get(resource, "type") == "OS::Neutron::Port"
    }


def get_port_addresses(filepath):
    """Return dict:
    key is field name, value is dict:
        key is parameter name, value is dict:
            key is filepath, value is set of rid
    """
    port_addresses = collections.defaultdict(
        lambda: collections.defaultdict(lambda: collections.defaultdict(set))
    )
    heat = Heat(filepath=filepath)
    basename = os.path.basename(filepath)
    for rid, port in get_neutron_ports(heat).items():
        allowed_address_pairs = heat.nested_get(
            port, "properties", "allowed_address_pairs"
        )
        if not isinstance(allowed_address_pairs, list):
            continue
        field = "ip_address"
        for aa_pair in allowed_address_pairs:
            param = heat.nested_get(aa_pair, field, "get_param")
            if param is None:
                continue
            port_addresses[field][param][basename].add(rid)
    return port_addresses


def nested_update(out_dict, in_dict):
    """Recursively update out_dict from in_dict.
    """
    for key, value in in_dict.items():
        if key not in out_dict:
            out_dict[key] = value
        elif isinstance(value, dict) and isinstance(out_dict[key], dict):
            out_dict[key] = nested_update(out_dict[key], value)
        elif isinstance(value, set) and isinstance(out_dict[key], set):
            out_dict[key].update(value)
        else:
            out_dict[key] = value
    return out_dict


def run_test(heat_template, validate):
    """call validate with allowed_address_pairs
    """
    heat = Heat(filepath=heat_template)
    if not heat.resources:
        pytest.skip("No resources found")

    neutron_ports = get_neutron_ports(heat)
    if not neutron_ports:
        pytest.skip("No OS::Neutron::Port resources found")

    bad = {}
    for rid, resource in neutron_ports.items():
        if rid.startswith("int_"):
            continue
        allowed_address_pairs = heat.nested_get(
            resource, "properties", "allowed_address_pairs"
        )
        if allowed_address_pairs is None:
            continue
        if not isinstance(allowed_address_pairs, list):
            bad[rid] = "properties.allowed_address_pairs must be a list."
            continue
        error = validate(heat, allowed_address_pairs)
        if error:
            bad[rid] = error
            break
    if bad:
        # raise RuntimeError(
        raise AssertionError(
            "Bad OS::Neutron::Port: %s"
            % (", ".join("%s: %s" % (rid, error) for rid, error in bad.items()))
        )


def validate_field(heat, allowed_address_pairs, field, v6=False):
    """ensure at most one `field` is found in `allowed_address_pairs'
    validate allowed_addrfess_pairs as well.
    Returns error message string or None.
    """
    error = None
    ports = set()
    port_type = "ipv6" if v6 else "ipv4"
    for allowed_address_pair in allowed_address_pairs:
        if not isinstance(allowed_address_pair, dict):
            error = 'allowed_address_pair "%s" is not a dict' % (allowed_address_pair)
            break
        if field in allowed_address_pair:
            param = heat.nested_get(allowed_address_pair, field, "get_param")
            if param is None:
                error = 'allowed_address_pair %s requires "get_param"' % field
                break
            else:
                # if v6 and testing v6, or inverse
                if v6 == is_v6_ip(param):
                    ports.add(param)
    if error is None and len(ports) > 1:
        error = 'More than one %s "%s" found in allowed_address_pairs: %s' % (
            port_type,
            field,
            list(ports),
        )
    return error


def validate_external_ipaddress(heat, allowed_address_pairs):
    """ensure allowed_address_pairs has at most one ip_address
    Returns error message string or None.
    """
    return validate_field(heat, allowed_address_pairs, "ip_address")


def validate_external_ipaddress_v6(heat, allowed_address_pairs):
    """ensure allowed_address_pairs has at most one v6_ip_address
    Returns error message string or None.
    """
    return validate_field(heat, allowed_address_pairs, "ip_address", v6=True)


# pylint: disable=invalid-name


@validates("R-91810")
def test_neutron_port_external_ipaddress(heat_template):
    """
    If a VNF requires ECOMP to assign a Virtual IP (VIP) Address to
    ports connected an external network, the port
    **MUST NOT** have more than one IPv4 VIP address.
    """
    run_test(heat_template, validate_external_ipaddress)


@validates("R-41956")
def test_neutron_port_external_ipaddress_v6(heat_template):
    """
    If a VNF requires ECOMP to assign a Virtual IP (VIP) Address to
    ports connected an external network, the port
    **MUST NOT** have more than one IPv6 VIP address.
    """
    run_test(heat_template, validate_external_ipaddress_v6)


@validates("R-10754")
def test_neutron_port_floating(yaml_files):
    """
    If a VNF has two or more ports that
    attach to an external network that require a Virtual IP Address (VIP),
    and the VNF requires ECOMP automation to assign the IP address,
    all the Virtual Machines using the VIP address **MUST**
    be instantiated in the same Base Module Heat Orchestration Template
    or in the same Incremental Module Heat Orchestration Template.
    """
    fields = {}
    for filepath in yaml_files:
        fields = nested_update(fields, get_port_addresses(filepath))
    bad = []
    for field, params in fields.items():
        for param, files in params.items():
            if len(files) > 1:
                bad.append(
                    '"%s" "%s" in multiple templates: %s'
                    % (
                        field,
                        param,
                        ", ".join("%s: %s" % (k, list(v)) for k, v in files.items()),
                    )
                )
    assert not bad, "; ".join(bad)