original_docstring: Add or replace a VPP ACL.
  
          Arguments:
          secgroup - OpenStack SecurityGroup ID
          data - SecurityGroup data from etcd
          
docstring: Add or replace a VPP ACL.
  Arguments:
  secgroup - OpenStack SecurityGroup ID
  data - SecurityGroup data from etcd
docstring_tokens: Add or replace a VPP ACL . Arguments : secgroup - OpenStack SecurityGroup ID data - SecurityGroup data from etcd
code: def acl_add_replace(self, secgroup, data):
          """Add or replace a VPP ACL.
  
          Arguments:
          secgroup - OpenStack SecurityGroup ID
          data - SecurityGroup data from etcd
          """
  
          def _secgroup_rule(r):
              # Create a rule for the remote_ip_prefix (CIDR) value
              if r['remote_ip_addr']:
                  remote_ip_prefixes = [(r['remote_ip_addr'],
                                         r['ip_prefix_len'])]
              # Create a rule for each ip address in the remote_group
              else:
                  remote_group = r['remote_group_id']
                  prefix_length = 128 if r['is_ipv6'] else 32
                  ip_version = 6 if r['is_ipv6'] else 4
                  # Add the referencing secgroup ID to the remote-group lookup
                  # data set. This enables the RemoteGroupWatcher thread to
                  # lookup the secgroups that need to be updated for a
                  # remote-group etcd watch event
                  self.vppf.remote_group_secgroups[remote_group].add(secgroup)
                  remote_ip_prefixes = [
                      (ip, prefix_length) for port in
                      self.vppf.remote_group_ports[remote_group]
                      for ip in self.vppf.port_ips[port]
                      if ip_network(ip).version == ip_version]
                  LOG.debug("remote_group: vppf.remote_group_ports:%s",
                            self.vppf.remote_group_ports
                            )
                  LOG.debug("remote_group: vppf.port_ips:%s",
                            self.vppf.port_ips)
                  LOG.debug("remote_group_ip_prefixes:%s for group %s",
                            remote_ip_prefixes, remote_group)
                  LOG.debug("remote_group_secgroups: %s",
                            self.vppf.remote_group_secgroups)
              # VPP API requires the IP addresses to be represented in binary
              # At this point:
              # 1. we convert to the form VPP likes - a packed address
              # 2. we fix up the rule.  At this point it's what Neutron gave us
              # and Neutron doesn't strictly check that the rule is a network
              # address compatible with the mask, but VPP cares.  Our assumption
              # is that only bits significant relative to the mask are intended
              # to matter, though that's ill-defined in the Neutron API.
  
              rules = []
              for ip_addr, ip_prefix_len in remote_ip_prefixes:
                  # OpenStack should provide a network address here, but
                  # doesn't correctly validate input.
                  net = ip_interface((ip_addr, int(ip_prefix_len),)).network
                  packed_addr = net.network_address.packed
                  rules.append(SecurityGroupRule(r['is_ipv6'],
                                                 packed_addr,
                                                 ip_prefix_len,
                                                 r.get('remote_group_id', None),
                                                 r['protocol'],
                                                 r['port_min'],
                                                 r['port_max']))
              return rules
  
          ingress_rules, egress_rules = (
              [_secgroup_rule(r) for r in data['ingress_rules']],
              [_secgroup_rule(r) for r in data['egress_rules']]
              )
          # Flatten ingress and egress rules
          ingress_rules, egress_rules = (
              [rule for rule_list in ingress_rules for rule in rule_list],
              [rule for rule_list in egress_rules for rule in rule_list]
              )
          LOG.debug("remote_group: sec_group: %s, ingress rules: %s "
                    "egress_rules: %s", secgroup, ingress_rules, egress_rules)
          self.vppf.acl_add_replace_on_host(SecurityGroup(secgroup,
                                                          ingress_rules,
                                                          egress_rules))
code_tokens: def acl_add_replace ( self , secgroup , data ) : def _secgroup_rule ( r ) : if r [ 'remote_ip_addr' ] : remote_ip_prefixes = [ ( r [ 'remote_ip_addr' ] , r [ 'ip_prefix_len' ] ) ] else : remote_group = r [ 'remote_group_id' ] prefix_length = 128 if r [ 'is_ipv6' ] else 32 ip_version = 6 if r [ 'is_ipv6' ] else 4 self . vppf . remote_group_secgroups [ remote_group ] . add ( secgroup ) remote_ip_prefixes = [ ( ip , prefix_length ) for port in self . vppf . remote_group_ports [ remote_group ] for ip in self . vppf . port_ips [ port ] if ip_network ( ip ) . version == ip_version ] LOG . debug ( "remote_group: vppf.remote_group_ports:%s" , self . vppf . remote_group_ports ) LOG . debug ( "remote_group: vppf.port_ips:%s" , self . vppf . port_ips ) LOG . debug ( "remote_group_ip_prefixes:%s for group %s" , remote_ip_prefixes , remote_group ) LOG . debug ( "remote_group_secgroups: %s" , self . vppf . remote_group_secgroups ) rules = [ ] for ip_addr , ip_prefix_len in remote_ip_prefixes : net = ip_interface ( ( ip_addr , int ( ip_prefix_len ) , ) ) . network packed_addr = net . network_address . packed rules . append ( SecurityGroupRule ( r [ 'is_ipv6' ] , packed_addr , ip_prefix_len , r . get ( 'remote_group_id' , None ) , r [ 'protocol' ] , r [ 'port_min' ] , r [ 'port_max' ] ) ) return rules ingress_rules , egress_rules = ( [ _secgroup_rule ( r ) for r in data [ 'ingress_rules' ] ] , [ _secgroup_rule ( r ) for r in data [ 'egress_rules' ] ] ) ingress_rules , egress_rules = ( [ rule for rule_list in ingress_rules for rule in rule_list ] , [ rule for rule_list in egress_rules for rule in rule_list ] ) LOG . debug ( "remote_group: sec_group: %s, ingress rules: %s " "egress_rules: %s" , secgroup , ingress_rules , egress_rules ) self . vppf . acl_add_replace_on_host ( SecurityGroup ( secgroup , ingress_rules , egress_rules ) )
short_docstring: Add or replace a VPP ACL.
short_docstring_tokens: Add or replace a VPP ACL .
comment: """Add or replace a VPP ACL.
  
          Arguments:
          secgroup - OpenStack SecurityGroup ID
          data - SecurityGroup data from etcd
          """$SEP$# Create a rule for the remote_ip_prefix (CIDR) value$SEP$# Create a rule for each ip address in the remote_group$SEP$# Add the referencing secgroup ID to the remote-group lookup$SEP$# data set. This enables the RemoteGroupWatcher thread to$SEP$# lookup the secgroups that need to be updated for a$SEP$# remote-group etcd watch event$SEP$# VPP API requires the IP addresses to be represented in binary$SEP$# At this point:$SEP$# 1. we convert to the form VPP likes - a packed address$SEP$# 2. we fix up the rule.  At this point it's what Neutron gave us$SEP$# and Neutron doesn't strictly check that the rule is a network$SEP$# address compatible with the mask, but VPP cares.  Our assumption$SEP$# is that only bits significant relative to the mask are intended$SEP$# to matter, though that's ill-defined in the Neutron API.$SEP$# OpenStack should provide a network address here, but$SEP$# doesn't correctly validate input.$SEP$# Flatten ingress and egress rules