Merge ~fnordahl/ubuntu/+source/ovn:bug/1914988-hirsute into ~ubuntu-server-dev/ubuntu/+source/ovn:ubuntu/hirsute

[Frode Nordahl]

[Frode Nordahl (fnordahl)]

Built package available in https://launchpad.net/~fnordahl/+archive/ubuntu/hirsute-rbac-fixes

diff --git a/debian/changelog b/debian/changelog
index 3b332a3..e9b9bbf 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+ovn (20.12.0-0ubuntu3) hirsute; urgency=medium
+
+  * Cherry-pick fixes from upstream branch-20.12
+    - d/p/lp-1913024-northd-Add-Chassis_Private-external_ids-column-to-RB.patch
+      Update RBAC rules for Chassis_Private table (LP: #1913024).
+    - d/p/lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch
+      Add RBAC rules for IGMP_Group table (LP: #1914988).
+    - d/p/lp-1917475-northd-Amend-RBAC-rules-for-Port_Binding-table.patch
+      Update RBAC rules for Port_Binding table (LP: #1917475).
+
+ -- Frode Nordahl <[e-mail]>  Thu, 23 Sep 2021 10:59:00 +0200
+
 ovn (20.12.0-0ubuntu2) hirsute; urgency=medium
 
   * d/rules: Disable test 168 on arm architectures.
diff --git a/debian/patches/lp-1913024-northd-Add-Chassis_Private-external_ids-column-to-RB.patch b/debian/patches/lp-1913024-northd-Add-Chassis_Private-external_ids-column-to-RB.patch
new file mode 100644
index 0000000..a2533f8
--- /dev/null
+++ b/debian/patches/lp-1913024-northd-Add-Chassis_Private-external_ids-column-to-RB.patch
@@ -0,0 +1,42 @@
+Origin: upstream, https://github.com/ovn-org/ovn/commit/f653d627100c91fb169009de44add746beb23769
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1913024
+Last-Update: 2021-09-23
+
+From f653d627100c91fb169009de44add746beb23769 Mon Sep 17 00:00:00 2001
+From: Frode Nordahl <[e-mail]>
+Date: Mon, 25 Jan 2021 21:34:04 +0100
+Subject: [PATCH] northd: Add Chassis_Private "external_ids" column to RBAC
+
+After introduction of the Chassis_Private table in OVN 20.09, CMS'es do
+expect data plane components that may be subject to the
+`ovn-controller` RBAC role to be able to write to the external_ids
+column. An example being the OpenStack metadata agent [0].
+
+[0]: https://github.com/openstack/neutron/blob/master/neutron/agent/ovn/metadata/agent.py#L175-L191
+Reported-at: https://bugs.launchpad.net/bugs/1913024
+Fixes: 4adc10f58127 ("Avoid nb_cfg update notification flooding")
+Signed-off-by: Frode Nordahl <[e-mail]>
+Acked-by: Dumitru Ceara <[e-mail]>
+Signed-off-by: Numan Siddique <[e-mail]>
+
+(cherry-picked from master commit a798e2cfb6dd97c1603b7b758464afb8b897c9ed)
+---
+ northd/ovn-northd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
+index 7ead3f6b8..89f7dc362 100644
+--- a/northd/ovn-northd.c
++++ b/northd/ovn-northd.c
+@@ -12729,7 +12729,7 @@ static const char *rbac_chassis_update[] =
+ static const char *rbac_chassis_private_auth[] =
+     {"name"};
+ static const char *rbac_chassis_private_update[] =
+-    {"nb_cfg", "nb_cfg_timestamp", "chassis"};
++    {"nb_cfg", "nb_cfg_timestamp", "chassis", "external_ids"};
+ 
+ static const char *rbac_encap_auth[] =
+     {"chassis_name"};
+-- 
+2.32.0
+
diff --git a/debian/patches/lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch b/debian/patches/lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch
new file mode 100644
index 0000000..52365a4
--- /dev/null
+++ b/debian/patches/lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch
@@ -0,0 +1,100 @@
+Origin: upstream, https://github.com/ovn-org/ovn/commit/6aab727db39dcdcfd859aa617e0d9f1ab0bcac98
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1914988
+Last-Update: 2021-09-23
+
+From 6aab727db39dcdcfd859aa617e0d9f1ab0bcac98 Mon Sep 17 00:00:00 2001
+From: Pedro Guimaraes <[e-mail]>
+Date: Sun, 7 Feb 2021 16:07:08 +0100
+Subject: [PATCH] Add IGMP_Group to ovn-controller RBAC
+
+If RBAC and IGMP snooping are enabled, ovn-controllers need to
+be able to register new entries to table IGMP_Group as requests
+are detected.
+
+For that, ovn-controllers need to have read/write access to
+IGMP_Group table.
+
+Signed-off-by: Pedro Guimaraes <[e-mail]>
+Reported-at: https://github.com/ovn-org/ovn/issues/77
+Acked-by: Frode Nordahl <[e-mail]>
+Signed-off-by: Numan Siddique <[e-mail]>
+
+(cherry-picked from master commit e92d8cb838d407aac7d44c9d27f862df42fbb8d2)
+---
+ AUTHORS.rst            |  1 +
+ northd/ovn-northd.c    | 12 ++++++++++++
+ ovn-architecture.7.xml | 16 ++++++++++++++++
+ 3 files changed, 29 insertions(+)
+
+diff --git a/AUTHORS.rst b/AUTHORS.rst
+index 5d926c11f..ba0a4eb1e 100644
+--- a/AUTHORS.rst
++++ b/AUTHORS.rst
+@@ -290,6 +290,7 @@ Paul Fazzone                       [e-mail]
+ Paul Ingram
+ Paul-Emmanuel Raoul                [e-mail]
+ Pavithra Ramesh                    [e-mail]
++Pedro Guimaraes                    [e-mail]
+ Peter Downs                        [e-mail]
+ Philippe Jung                      [e-mail]
+ Pim van den Berg                   [e-mail]
+diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
+index 89f7dc362..cb6bbb74d 100644
+--- a/northd/ovn-northd.c
++++ b/northd/ovn-northd.c
+@@ -12750,6 +12750,10 @@ static const char *rbac_svc_monitor_auth[] =
+     {""};
+ static const char *rbac_svc_monitor_auth_update[] =
+     {"status"};
++static const char *rbac_igmp_group_auth[] =
++    {""};
++static const char *rbac_igmp_group_update[] =
++    {"address", "chassis", "datapath", "ports"};
+ 
+ static struct rbac_perm_cfg {
+     const char *table;
+@@ -12808,6 +12812,14 @@ static struct rbac_perm_cfg {
+         .update = rbac_svc_monitor_auth_update,
+         .n_update = ARRAY_SIZE(rbac_svc_monitor_auth_update),
+         .row = NULL
++    },{
++        .table = "IGMP_Group",
++        .auth = rbac_igmp_group_auth,
++        .n_auth = ARRAY_SIZE(rbac_igmp_group_auth),
++        .insdel = true,
++        .update = rbac_igmp_group_update,
++        .n_update = ARRAY_SIZE(rbac_igmp_group_update),
++        .row = NULL
+     },{
+         .table = NULL,
+         .auth = NULL,
+diff --git a/ovn-architecture.7.xml b/ovn-architecture.7.xml
+index d00af36b4..e5b70ca20 100644
+--- a/ovn-architecture.7.xml
++++ b/ovn-architecture.7.xml
+@@ -2597,6 +2597,22 @@
+         modified by ovn-controller.
+       </p>
+     </dd>
++
++    <dt><code>IGMP_Group</code></dt>
++    <dd>
++      <p>
++        <code>Authorization</code>: disabled (all clients are considered
++        to be authorized).
++      </p>
++      <p>
++        <code>Insert/Delete</code>: row insertion/deletion are permitted.
++      </p>
++      <p>
++        <code>Update</code>: The columns <code>address</code>,
++        <code>chassis</code>, <code>datapath</code>, and
++        <code>ports</code> may be modified by ovn-controller.
++      </p>
++    </dd>
+   </dl>
+ 
+   <p>
+-- 
+2.32.0
+
diff --git a/debian/patches/lp-1917475-northd-Amend-RBAC-rules-for-Port_Binding-table.patch b/debian/patches/lp-1917475-northd-Amend-RBAC-rules-for-Port_Binding-table.patch
new file mode 100644
index 0000000..1968bc4
--- /dev/null
+++ b/debian/patches/lp-1917475-northd-Amend-RBAC-rules-for-Port_Binding-table.patch
@@ -0,0 +1,48 @@
+Origin: upstream, https://github.com/ovn-org/ovn/commit/291d88b787a66741810950a5b1b74f82e53ec9a4
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1917475
+Last-Update: 2021-09-23
+
+From 291d88b787a66741810950a5b1b74f82e53ec9a4 Mon Sep 17 00:00:00 2001
+From: Frode Nordahl <[e-mail]>
+Date: Fri, 5 Mar 2021 13:16:23 +0100
+Subject: [PATCH] northd: Amend RBAC rules for Port_Binding table
+
+When `ovn-controller` claims a virtual lport it will update the
+Port_Binding table with which chassis currently has claimed the
+port as well as recording information about the virtual parent
+lport [0].
+
+When `ovn-controller` claims a lport it will also update the
+encap field of the Port_Binding table if set and an update is
+needed.
+
+The current RBAC rules does not allow for these updates.
+
+0: https://github.com/ovn-org/ovn/blob/b7b0fbdab03ce8b39d5bdc114876e6b0d0683892/controller/pinctrl.c#L6150
+Fixes: 054f4c85c ("Add a new logical switch port type - 'virtual'")
+Fixes: 6c8b9a132 (" ovn-controller: Store the local port bindings in the runtime data I-P state")
+Reported-At: https://bugs.launchpad.net/ubuntu/+source/ovn/+bug/1917475
+Signed-off-by: Frode Nordahl <[e-mail]>
+Signed-off-by: Numan Siddique <[e-mail]>
+
+(cherry-picked from master commit 525d78946e6db29430fc2f946b9348eda6356fc6)
+---
+ northd/ovn-northd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/northd/ovn-northd.c b/northd/ovn-northd.c
+index 13288a31c..893b55bed 100644
+--- a/northd/ovn-northd.c
++++ b/northd/ovn-northd.c
+@@ -12745,7 +12745,7 @@ static const char *rbac_encap_update[] =
+ static const char *rbac_port_binding_auth[] =
+     {""};
+ static const char *rbac_port_binding_update[] =
+-    {"chassis"};
++    {"chassis", "encap", "virtual_parent"};
+ 
+ static const char *rbac_mac_binding_auth[] =
+     {""};
+-- 
+2.32.0
+
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..c004be5
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1,3 @@
+lp-1913024-northd-Add-Chassis_Private-external_ids-column-to-RB.patch
+lp-1914988-Add-IGMP_Group-to-ovn-controller-RBAC.patch
+lp-1917475-northd-Amend-RBAC-rules-for-Port_Binding-table.patch