Automated cherry pick of #354: feat: add guest nic dedicated secgroup support

.gitignore

@@ -1 +1,2 @@
 _output/
+.idea

pkg/agent/server/service.go

@@ -24,6 +24,7 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/appctx"
 	"yunion.io/x/pkg/errors"
+	"yunion.io/x/pkg/util/signalutils"
 
 	"yunion.io/x/sdnagent/pkg/agent/utils"
 )
@@ -62,6 +63,8 @@ func StartService() {
 	} else if err = hc.Auth(ctx); err != nil {
 		log.Errorln(errors.Wrap(err, "keystone auth"))
 	}
+	signalutils.SetDumpStackSignal()
+	signalutils.StartTrap()
 
 	{
 		f, err := lockPidFile(hc.SdnPidFile)

pkg/agent/utils/flowsource.go

@@ -669,7 +669,9 @@ func (g *Guest) FlowsMapForNic(nic *GuestNIC) ([]*ovs.Flow, error) {
 		)
 	}
 	if !g.HostConfig.DisableSecurityGroup {
-		flows = append(flows, g.SecurityRules.Flows(g, nic, m)...)
+		secRules := g.GetNicSecurityRules(nic)
+
+		flows = append(flows, secRules.Flows(g, nic, m)...)
 	}
 	return flows, nil
 }

pkg/agent/utils/guest.go

@@ -33,9 +33,10 @@ import (
 )
 
 type guestDesc struct {
-	NICs               []*GuestNIC `json:"nics"`
-	SecurityRules      string      `json:"security_rules"`
-	AdminSecurityRules string      `json:"admin_security_rules"`
+	NICs               []*GuestNIC          `json:"nics"`
+	SecurityRules      string               `json:"security_rules"`
+	AdminSecurityRules string               `json:"admin_security_rules"`
+	NicSecgroups       []*GuestNICSecgroups `json:"nic_secgroups"`
 	Name               string
 
 	IsMaster       bool   `json:"is_master"`
@@ -57,6 +58,12 @@ func newGuestDesc() *guestDesc {
 	return desc
 }
 
+type GuestNICSecgroups struct {
+	SecurityRules string `json:"security_rules"`
+	Mac           string `json:"mac"`
+	Index         int    `json:"index"`
+}
+
 type GuestNIC struct {
 	Bridge     string
 	Bw         int
@@ -87,6 +94,8 @@ type GuestNIC struct {
 	CtZoneIdSet bool   `json:"-"`
 	PortNo      int    `json:"-"`
 
+	SecurityRules *SecurityRules `json:"-"`
+
 	NetworkAddresses []GuestNICNetworkAddress `json:"networkaddresses"`
 
 	PortMappings computeapi.GuestPortMappings `json:"port_mappings"`
@@ -267,8 +276,26 @@ func (g *Guest) LoadDesc() error {
 	g.NICs = desc.NICs
 
 	g.VpcNICs = nil
+
+	{
+		rstr := desc.AdminSecurityRules + "; " + desc.SecurityRules
+		rs, err := NewSecurityRules(rstr)
+		if err != nil {
+			return err
+		}
+		g.SecurityRules = rs
+	}
+
 	for i := len(g.NICs) - 1; i >= 0; i-- {
 		nic := g.NICs[i]
+		if rstr, ok := g.nicHasDedicatedSecgroups(nic.MAC, desc.NicSecgroups); ok {
+			rs, err := NewSecurityRules(rstr)
+			if err != nil {
+				return errors.Wrapf(err, "nic %s NewSecurityRules %s failed", nic.MAC, rstr)
+			}
+			nic.SecurityRules = rs
+		}
+
 		if nic.Vpc.Provider != "" {
 			g.VpcNICs = append(g.VpcNICs, nic)
 			g.NICs = append(g.NICs[:i], g.NICs[i+1:]...)
@@ -286,16 +313,23 @@ func (g *Guest) LoadDesc() error {
 	if !g.srcMacCheck && g.srcIpCheck {
 		g.srcIpCheck = false
 	}
+	return nil
+}
 
-	{
-		rstr := desc.AdminSecurityRules + "; " + desc.SecurityRules
-		rs, err := NewSecurityRules(rstr)
-		if err != nil {
-			return err
+func (g *Guest) nicHasDedicatedSecgroups(mac string, guestNicSecgroups []*GuestNICSecgroups) (string, bool) {
+	for i := range guestNicSecgroups {
+		if guestNicSecgroups[i].Mac == mac {
+			return guestNicSecgroups[i].SecurityRules, true
 		}
-		g.SecurityRules = rs
 	}
-	return nil
+	return "", false
+}
+
+func (g *Guest) GetNicSecurityRules(nic *GuestNIC) *SecurityRules {
+	if nic.SecurityRules != nil {
+		return nic.SecurityRules
+	}
+	return g.SecurityRules
 }
 
 func (g *Guest) NeedsSync() bool {