Skip to content

Terminate ddos mitigation

A termination workflow for DDoS Single Upstream Setup Mitigation subscriptions.

input_form_generator(subscription_id)

Gather input from the operator.

Source code in gso/workflows/ddos_mitigation/terminate_ddos_mitigation.py 
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
def input_form_generator(subscription_id: UUIDstr) -> FormGenerator:
    """Gather input from the operator."""
    subscription = DDoSMitigation.from_subscription(subscription_id)

    class DDoSMitigationTerminationForm(FormPage):
        model_config = ConfigDict(title="Terminate DDoS Single Upstream Setup Mitigation")

        tt_number: TTNumber

    user_input = yield DDoSMitigationTerminationForm
    user_input_dict = user_input.model_dump()
    yield from create_summary_form(user_input_dict, subscription.product.name, ["tt_number"])

    return user_input_dict | {
        "subscription": subscription,
        "partner": subscription.customer_id,
        "partner_id": subscription.customer_id,
        "partner_name": get_partner_by_id(subscription.customer_id).name,
    }

restore_exit_export_policy_real(subscription, process_id, partner_name, tt_number)

Restores the original export policy on the DDoS exit port.

Source code in gso/workflows/ddos_mitigation/terminate_ddos_mitigation.py 
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
@step("[FOR REAL] Restore Exit Port export policy")
def restore_exit_export_policy_real(
    subscription: dict[str, Any],
    process_id: UUIDstr,
    partner_name: str,
    tt_number: str,
) -> LSOState:
    """Restores the original export policy on the DDoS exit port."""
    params = load_oss_params()
    exit_port_fqdn = params.GENERAL.exit_port_fqdn

    extra_vars = {
        "dry_run": False,
        "subscription": subscription,
        "partner_name": partner_name,
        "commit_comment": (
            f"GSO_PROCESS_ID: {process_id} - TT_NUMBER: {tt_number} - Terminate DDoS Single Upstream Setup Mitigation"
        ),
        "verb": "delete",
    }

    return {
        "playbook_name": "gap_ansible/playbooks/ddos_mitigation.yaml",
        "inventory": {"all": {"hosts": {exit_port_fqdn: None}}},
        "extra_vars": extra_vars,
    }

update_exit_export_policy_dry(subscription, process_id, partner_name, tt_number)

Perform a dry run of updating the export policy on a DDoS Single Upstream Setup Mitigation exit port.

Source code in gso/workflows/ddos_mitigation/terminate_ddos_mitigation.py 
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
@step("[DRY RUN] Update Exit Port export policy")
def update_exit_export_policy_dry(
    subscription: dict[str, Any],
    process_id: UUIDstr,
    partner_name: str,
    tt_number: str,
) -> LSOState:
    """Perform a dry run of updating the export policy on a DDoS Single Upstream Setup Mitigation exit port."""
    params = load_oss_params()
    exit_port_fqdn = params.GENERAL.exit_port_fqdn

    extra_vars = {
        "dry_run": True,
        "subscription": subscription,
        "partner_name": partner_name,
        "commit_comment": (
            f"GSO_PROCESS_ID: {process_id} - TT_NUMBER: {tt_number} - "
            f"Create DDoS Single Upstream Setup Mitigation for {partner_name}"
        ),
        "verb": "delete",
    }

    return {
        "playbook_name": "gap_ansible/playbooks/ddos_upstream_setup.yaml",
        "inventory": {"all": {"hosts": {exit_port_fqdn: None}}},
        "extra_vars": extra_vars,
    }

update_exit_export_policy_real(subscription, process_id, partner_name, tt_number)

Updates the export policy on a DDoS Single Upstream Setup Mitigation exit port.

Source code in gso/workflows/ddos_mitigation/terminate_ddos_mitigation.py 
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
@step("[FOR REAL] Update Exit Port export policy")
def update_exit_export_policy_real(
    subscription: dict[str, Any],
    process_id: UUIDstr,
    partner_name: str,
    tt_number: str,
) -> LSOState:
    """Updates the export policy on a DDoS Single Upstream Setup Mitigation exit port."""
    params = load_oss_params()
    exit_port_fqdn = params.GENERAL.exit_port_fqdn

    extra_vars = {
        "dry_run": False,
        "subscription": subscription,
        "partner_name": partner_name,
        "commit_comment": (
            f"GSO_PROCESS_ID: {process_id} - TT_NUMBER: {tt_number} - "
            f"Create DDoS Single Upstream Setup Mitigation for {partner_name}"
        ),
        "verb": "delete",
    }

    return {
        "playbook_name": "gap_ansible/playbooks/ddos_upstream_setup.yaml",
        "inventory": {"all": {"hosts": {exit_port_fqdn: None}}},
        "extra_vars": extra_vars,
    }

mark_ias_import_policy_dry(subscription, process_id, tt_number, partner_name, ias_subscription_endpoints, peer_map)

Perform a dry run of adding the DDoS victim policy to all IAS subscriptions of the partner.

Source code in gso/workflows/ddos_mitigation/terminate_ddos_mitigation.py 
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
@step("[DRY RUN] Add Prefix List on all partner IAS subscriptions")
def mark_ias_import_policy_dry(
    subscription: dict[str, Any],
    process_id: UUIDstr,
    tt_number: TTNumber,
    partner_name: str,
    ias_subscription_endpoints: list[str],
    peer_map: dict[str, dict[str, str | None]],
) -> LSOState:
    """Perform a dry run of adding the DDoS victim policy to all IAS subscriptions of the partner."""
    extra_vars = {
        "dry_run": True,
        "subscription": subscription,
        "partner_name": partner_name,
        "peer_map": peer_map,
        "commit_comment": (
            f"GSO_PROCESS_ID: {process_id} - TT_NUMBER: {tt_number} - Create DDoS Single Upstream Setup Mitigation"
        ),
        "verb": "delete",
    }

    return {
        "playbook_name": "gap_ansible/playbooks/ddos_nren_setup.yaml",
        "inventory": {"all": {"hosts": dict.fromkeys(ias_subscription_endpoints)}},
        "extra_vars": extra_vars,
    }

mark_ias_import_policy_real(subscription, process_id, tt_number, partner_name, ias_subscription_endpoints, peer_map)

Adds the DDoS victim policy to all IAS subscriptions of the partner.

Source code in gso/workflows/ddos_mitigation/terminate_ddos_mitigation.py 
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
@step("[FOR REAL] Add Prefix List on all partner IAS subscriptions")
def mark_ias_import_policy_real(
    subscription: dict[str, Any],
    process_id: UUIDstr,
    tt_number: str,
    partner_name: str,
    ias_subscription_endpoints: list[str],
    peer_map: dict[str, dict[str, str | None]],
) -> LSOState:
    """Adds the DDoS victim policy to all IAS subscriptions of the partner."""
    extra_vars = {
        "dry_run": False,
        "subscription": subscription,
        "partner_name": partner_name,
        "peer_map": peer_map,
        "commit_comment": (
            f"GSO_PROCESS_ID: {process_id} - TT_NUMBER: {tt_number} - Delete DDoS Single Upstream Setup Mitigation"
        ),
        "verb": "delete",
    }

    return {
        "playbook_name": "gap_ansible/playbooks/ddos_nren_setup.yaml",
        "inventory": {"all": {"hosts": dict.fromkeys(ias_subscription_endpoints)}},
        "extra_vars": extra_vars,
    }

terminate_ddos_mitigation()

A Termination workflow for a DDoS Single Upstream Setup Mitigation.

This workflow: 1. Removes mitigation prefixes from NREN IAS Access Ports 2. Conditionally restores the exit upstream port export policy (only if no other active mitigations are using the same exit port)

Source code in gso/workflows/ddos_mitigation/terminate_ddos_mitigation.py 
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
@terminate_workflow("Terminate DDoS Single Upstream Setup Mitigation", input_form_generator)
def terminate_ddos_mitigation() -> StepList:
    """A Termination workflow for a DDoS Single Upstream Setup Mitigation.

    This workflow:
    1. Removes mitigation prefixes from NREN IAS Access Ports
    2. Conditionally restores the exit upstream port export policy
       (only if no other active mitigations are using the same exit port)
    """
    should_restore = conditional(lambda state: has_no_other_active_mitigations(state["subscription_id"]))

    return (
        begin
        >> build_ias_peer_map
        >> lso_interaction(mark_ias_import_policy_dry)
        >> lso_interaction(mark_ias_import_policy_real)
        >> should_restore(lso_interaction(update_exit_export_policy_dry))
        >> should_restore(lso_interaction(update_exit_export_policy_real))
    )