mirror of https://github.com/apache/cloudstack.git
Summary: partical check-in for L4-L7 network services in the shared
network in the advanced zone Summary: change 'shared network' in advanced zone with L4-L7 services to go through network implement phase. Add ACL checks to associate IP to shared network in the advanced zone Bug ID:CLOUDSTACK-312 enable L4-L7 network services in the shared network in the advanced zone Conflicts: server/src/com/cloud/network/NetworkManagerImpl.java
This commit is contained in:
Murali Reddy
Murali Reddy
parent
28bbf6c527
commit
0de5a145e4
|
|
@ -16,45 +16,11 @@
|
|||
// under the License.
|
||||
package com.cloud.network;
|
||||
|
||||
import java.net.URI;
|
||||
import java.security.InvalidParameterException;
|
||||
import java.sql.PreparedStatement;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.Collection;
|
||||
import java.util.Comparator;
|
||||
import java.util.Date;
|
||||
import java.util.HashMap;
|
||||
import java.util.HashSet;
|
||||
import java.util.Iterator;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Random;
|
||||
import java.util.Set;
|
||||
import java.util.TreeSet;
|
||||
import java.util.concurrent.Executors;
|
||||
import java.util.concurrent.ScheduledExecutorService;
|
||||
import java.util.concurrent.TimeUnit;
|
||||
|
||||
import javax.ejb.Local;
|
||||
import javax.naming.ConfigurationException;
|
||||
|
||||
import org.apache.log4j.Logger;
|
||||
|
||||
import com.cloud.acl.ControlledEntity.ACLType;
|
||||
import com.cloud.acl.SecurityChecker.AccessType;
|
||||
import com.cloud.agent.AgentManager;
|
||||
import com.cloud.agent.Listener;
|
||||
import com.cloud.agent.api.AgentControlAnswer;
|
||||
import com.cloud.agent.api.AgentControlCommand;
|
||||
import com.cloud.agent.api.Answer;
|
||||
import com.cloud.agent.api.CheckNetworkAnswer;
|
||||
import com.cloud.agent.api.CheckNetworkCommand;
|
||||
import com.cloud.agent.api.Command;
|
||||
import com.cloud.agent.api.StartupCommand;
|
||||
import com.cloud.agent.api.StartupRoutingCommand;
|
||||
import com.cloud.agent.api.*;
|
||||
import com.cloud.agent.api.to.NicTO;
|
||||
import com.cloud.alert.AlertManager;
|
||||
import com.cloud.api.commands.CreateNetworkCmd;
|
||||
|
|
@ -65,15 +31,9 @@ import com.cloud.configuration.Config;
|
|||
import com.cloud.configuration.ConfigurationManager;
|
||||
import com.cloud.configuration.Resource.ResourceType;
|
||||
import com.cloud.configuration.dao.ConfigurationDao;
|
||||
import com.cloud.dc.AccountVlanMapVO;
|
||||
import com.cloud.dc.DataCenter;
|
||||
import com.cloud.dc.*;
|
||||
import com.cloud.dc.DataCenter.NetworkType;
|
||||
import com.cloud.dc.DataCenterVO;
|
||||
import com.cloud.dc.Pod;
|
||||
import com.cloud.dc.PodVlanMapVO;
|
||||
import com.cloud.dc.Vlan;
|
||||
import com.cloud.dc.Vlan.VlanType;
|
||||
import com.cloud.dc.VlanVO;
|
||||
import com.cloud.dc.dao.AccountVlanMapDao;
|
||||
import com.cloud.dc.dao.DataCenterDao;
|
||||
import com.cloud.dc.dao.PodVlanMapDao;
|
||||
|
|
@ -89,17 +49,7 @@ import com.cloud.event.EventTypes;
|
|||
import com.cloud.event.UsageEventVO;
|
||||
import com.cloud.event.dao.EventDao;
|
||||
import com.cloud.event.dao.UsageEventDao;
|
||||
import com.cloud.exception.AccountLimitException;
|
||||
import com.cloud.exception.ConcurrentOperationException;
|
||||
import com.cloud.exception.ConnectionException;
|
||||
import com.cloud.exception.InsufficientAddressCapacityException;
|
||||
import com.cloud.exception.InsufficientCapacityException;
|
||||
import com.cloud.exception.InsufficientVirtualNetworkCapcityException;
|
||||
import com.cloud.exception.InvalidParameterValueException;
|
||||
import com.cloud.exception.PermissionDeniedException;
|
||||
import com.cloud.exception.ResourceAllocationException;
|
||||
import com.cloud.exception.ResourceUnavailableException;
|
||||
import com.cloud.exception.UnsupportedServiceException;
|
||||
import com.cloud.exception.*;
|
||||
import com.cloud.host.Host;
|
||||
import com.cloud.host.HostVO;
|
||||
import com.cloud.host.Status;
|
||||
|
|
@ -117,47 +67,15 @@ import com.cloud.network.Networks.TrafficType;
|
|||
import com.cloud.network.PhysicalNetwork.BroadcastDomainRange;
|
||||
import com.cloud.network.VirtualRouterProvider.VirtualRouterProviderType;
|
||||
import com.cloud.network.addr.PublicIp;
|
||||
import com.cloud.network.dao.FirewallRulesDao;
|
||||
import com.cloud.network.dao.IPAddressDao;
|
||||
import com.cloud.network.dao.LoadBalancerDao;
|
||||
import com.cloud.network.dao.NetworkDao;
|
||||
import com.cloud.network.dao.NetworkDomainDao;
|
||||
import com.cloud.network.dao.NetworkServiceMapDao;
|
||||
import com.cloud.network.dao.PhysicalNetworkDao;
|
||||
import com.cloud.network.dao.PhysicalNetworkServiceProviderDao;
|
||||
import com.cloud.network.dao.PhysicalNetworkServiceProviderVO;
|
||||
import com.cloud.network.dao.PhysicalNetworkTrafficTypeDao;
|
||||
import com.cloud.network.dao.PhysicalNetworkTrafficTypeVO;
|
||||
import com.cloud.network.element.ConnectivityProvider;
|
||||
import com.cloud.network.element.DhcpServiceProvider;
|
||||
import com.cloud.network.element.FirewallServiceProvider;
|
||||
import com.cloud.network.element.SourceNatServiceProvider;
|
||||
import com.cloud.network.element.IpDeployer;
|
||||
import com.cloud.network.element.LoadBalancingServiceProvider;
|
||||
import com.cloud.network.element.NetworkACLServiceProvider;
|
||||
import com.cloud.network.element.NetworkElement;
|
||||
import com.cloud.network.element.PortForwardingServiceProvider;
|
||||
import com.cloud.network.element.RemoteAccessVPNServiceProvider;
|
||||
import com.cloud.network.element.Site2SiteVpnServiceProvider;
|
||||
import com.cloud.network.element.StaticNatServiceProvider;
|
||||
import com.cloud.network.element.UserDataServiceProvider;
|
||||
import com.cloud.network.element.VirtualRouterElement;
|
||||
import com.cloud.network.element.VpcVirtualRouterElement;
|
||||
import com.cloud.network.dao.*;
|
||||
import com.cloud.network.element.*;
|
||||
import com.cloud.network.guru.NetworkGuru;
|
||||
import com.cloud.network.lb.LoadBalancingRule;
|
||||
import com.cloud.network.lb.LoadBalancingRule.LbDestination;
|
||||
import com.cloud.network.lb.LoadBalancingRule.LbStickinessPolicy;
|
||||
import com.cloud.network.lb.LoadBalancingRulesManager;
|
||||
import com.cloud.network.rules.FirewallManager;
|
||||
import com.cloud.network.rules.FirewallRule;
|
||||
import com.cloud.network.rules.*;
|
||||
import com.cloud.network.rules.FirewallRule.Purpose;
|
||||
import com.cloud.network.rules.FirewallRuleVO;
|
||||
import com.cloud.network.rules.PortForwardingRule;
|
||||
import com.cloud.network.rules.PortForwardingRuleVO;
|
||||
import com.cloud.network.rules.RulesManager;
|
||||
import com.cloud.network.rules.StaticNat;
|
||||
import com.cloud.network.rules.StaticNatRule;
|
||||
import com.cloud.network.rules.StaticNatRuleImpl;
|
||||
import com.cloud.network.rules.dao.PortForwardingRulesDao;
|
||||
import com.cloud.network.vpc.NetworkACLManager;
|
||||
import com.cloud.network.vpc.PrivateIpVO;
|
||||
|
|
@ -176,16 +94,9 @@ import com.cloud.projects.ProjectManager;
|
|||
import com.cloud.server.ResourceTag.TaggedResourceType;
|
||||
import com.cloud.tags.ResourceTagVO;
|
||||
import com.cloud.tags.dao.ResourceTagDao;
|
||||
import com.cloud.user.Account;
|
||||
import com.cloud.user.AccountManager;
|
||||
import com.cloud.user.AccountVO;
|
||||
import com.cloud.user.DomainManager;
|
||||
import com.cloud.user.ResourceLimitService;
|
||||
import com.cloud.user.User;
|
||||
import com.cloud.user.UserContext;
|
||||
import com.cloud.user.*;
|
||||
import com.cloud.user.dao.AccountDao;
|
||||
import com.cloud.user.dao.UserStatisticsDao;
|
||||
import com.cloud.uservm.UserVm;
|
||||
import com.cloud.utils.AnnotationHelper;
|
||||
import com.cloud.utils.NumbersUtil;
|
||||
import com.cloud.utils.Pair;
|
||||
|
|
@ -193,35 +104,32 @@ import com.cloud.utils.component.Adapters;
|
|||
import com.cloud.utils.component.Inject;
|
||||
import com.cloud.utils.component.Manager;
|
||||
import com.cloud.utils.concurrency.NamedThreadFactory;
|
||||
import com.cloud.utils.db.DB;
|
||||
import com.cloud.utils.db.Filter;
|
||||
import com.cloud.utils.db.JoinBuilder;
|
||||
import com.cloud.utils.db.*;
|
||||
import com.cloud.utils.db.JoinBuilder.JoinType;
|
||||
import com.cloud.utils.db.SearchBuilder;
|
||||
import com.cloud.utils.db.SearchCriteria;
|
||||
import com.cloud.utils.db.SearchCriteria.Op;
|
||||
import com.cloud.utils.db.Transaction;
|
||||
import com.cloud.utils.exception.CloudRuntimeException;
|
||||
import com.cloud.utils.net.Ip;
|
||||
import com.cloud.utils.net.NetUtils;
|
||||
import com.cloud.vm.Nic;
|
||||
import com.cloud.vm.Nic.ReservationStrategy;
|
||||
import com.cloud.vm.NicProfile;
|
||||
import com.cloud.vm.NicVO;
|
||||
import com.cloud.vm.ReservationContext;
|
||||
import com.cloud.vm.ReservationContextImpl;
|
||||
import com.cloud.vm.SecondaryStorageVmVO;
|
||||
import com.cloud.vm.UserVmVO;
|
||||
import com.cloud.vm.VMInstanceVO;
|
||||
import com.cloud.vm.VirtualMachine;
|
||||
import com.cloud.vm.*;
|
||||
import com.cloud.vm.VirtualMachine.Type;
|
||||
import com.cloud.vm.VirtualMachineProfile;
|
||||
import com.cloud.vm.VirtualMachineProfileImpl;
|
||||
import com.cloud.vm.dao.DomainRouterDao;
|
||||
import com.cloud.vm.dao.NicDao;
|
||||
import com.cloud.vm.dao.UserVmDao;
|
||||
import com.cloud.vm.dao.VMInstanceDao;
|
||||
import edu.emory.mathcs.backport.java.util.Collections;
|
||||
import org.apache.log4j.Logger;
|
||||
|
||||
import javax.ejb.Local;
|
||||
import javax.naming.ConfigurationException;
|
||||
import java.net.URI;
|
||||
import java.security.InvalidParameterException;
|
||||
import java.sql.PreparedStatement;
|
||||
import java.sql.ResultSet;
|
||||
import java.sql.SQLException;
|
||||
import java.util.*;
|
||||
import java.util.concurrent.Executors;
|
||||
import java.util.concurrent.ScheduledExecutorService;
|
||||
import java.util.concurrent.TimeUnit;
|
||||
|
||||
/**
|
||||
* NetworkManagerImpl implements NetworkManager.
|
||||
|
|
@ -1163,7 +1071,17 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
|
|||
|
||||
IPAddressVO ipToAssoc = _ipAddressDao.findById(ipId);
|
||||
if (ipToAssoc != null) {
|
||||
_accountMgr.checkAccess(caller, null, true, ipToAssoc);
|
||||
Network network = _networksDao.findById(networkId);
|
||||
if (network == null) {
|
||||
throw new InvalidParameterValueException("Invalid network id is given");
|
||||
}
|
||||
|
||||
DataCenter zone = _configMgr.getZone(network.getDataCenterId());
|
||||
if (network.getGuestType() == Network.GuestType.Shared && zone.getNetworkType() == NetworkType.Advanced && isSharedNetworkOfferingWithServices(network.getNetworkOfferingId())) {
|
||||
_accountMgr.checkAccess(UserContext.current().getCaller(), AccessType.UseNetwork, false, network);
|
||||
} else {
|
||||
_accountMgr.checkAccess(caller, null, true, ipToAssoc);
|
||||
}
|
||||
owner = _accountMgr.getAccount(ipToAssoc.getAllocatedToAccountId());
|
||||
} else {
|
||||
s_logger.debug("Unable to find ip address by id: " + ipId);
|
||||
|
|
@ -1187,21 +1105,24 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
|
|||
|
||||
// allow associating IP addresses to guest network only
|
||||
if (network.getTrafficType() != TrafficType.Guest) {
|
||||
throw new InvalidParameterValueException("Ip address can be associated to the network with trafficType " +
|
||||
TrafficType.Guest);
|
||||
throw new InvalidParameterValueException("Ip address can be associated to the network with trafficType " + TrafficType.Guest);
|
||||
}
|
||||
|
||||
// Check that network belongs to IP owner - skip this check for Basic zone as there is just one guest network,
|
||||
// and it belongs to the system
|
||||
if (zone.getNetworkType() != NetworkType.Basic && network.getAccountId() != owner.getId()) {
|
||||
throw new InvalidParameterValueException("The owner of the network is not the same as owner of the IP");
|
||||
// Check that network belongs to IP owner - skip this check
|
||||
// - if zone is basic zone as there is just one guest network,
|
||||
// - if shared network in Advanced zone
|
||||
// - and it belongs to the system
|
||||
if (network.getAccountId() != owner.getId()) {
|
||||
if (zone.getNetworkType() != NetworkType.Basic && !(zone.getNetworkType() == NetworkType.Advanced && network.getGuestType() == Network.GuestType.Shared)) {
|
||||
throw new InvalidParameterValueException("The owner of the network is not the same as owner of the IP");
|
||||
}
|
||||
}
|
||||
|
||||
// In Advance zone only allow to do IP assoc for Isolated networks with source nat service enabled
|
||||
if (zone.getNetworkType() == NetworkType.Advanced &&
|
||||
!(network.getGuestType() == GuestType.Isolated && areServicesSupportedInNetwork(network.getId(),
|
||||
Service.SourceNat))) {
|
||||
throw new InvalidParameterValueException("In zone of type " + NetworkType.Advanced +
|
||||
|
||||
// In Advance zone only allow to do IP assoc
|
||||
// - for Isolated networks with source nat service enabled
|
||||
// - for shared networks with source nat service enabled
|
||||
if (zone.getNetworkType() == NetworkType.Advanced && (!areServicesSupportedInNetwork(network.getId(), Service.SourceNat))) {
|
||||
throw new InvalidParameterValueException("In zone of type " + NetworkType.Advanced +
|
||||
" ip address can be associated only to the network of guest type " + GuestType.Isolated + " with the "
|
||||
+ Service.SourceNat.getName() + " enabled");
|
||||
}
|
||||
|
|
@ -1971,12 +1892,21 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
|
|||
try {
|
||||
NetworkGuru guru = _networkGurus.get(network.getGuruName());
|
||||
Network.State state = network.getState();
|
||||
if (state == Network.State.Implemented || state == Network.State.Setup || state == Network.State.Implementing) {
|
||||
if (state == Network.State.Implemented || state == Network.State.Implementing) {
|
||||
s_logger.debug("Network id=" + networkId + " is already implemented");
|
||||
implemented.set(guru, network);
|
||||
return implemented;
|
||||
}
|
||||
|
||||
if (state == Network.State.Setup) {
|
||||
DataCenterVO zone = _dcDao.findById(network.getDataCenterId());
|
||||
if (!isSharedNetworkOfferingWithServices(network.getNetworkOfferingId()) || (zone.getNetworkType() == NetworkType.Basic)) {
|
||||
s_logger.debug("Network id=" + networkId + " is already implemented");
|
||||
implemented.set(guru, network);
|
||||
return implemented;
|
||||
}
|
||||
}
|
||||
|
||||
if (s_logger.isDebugEnabled()) {
|
||||
s_logger.debug("Asking " + guru.getName() + " to implement " + network);
|
||||
}
|
||||
|
|
@ -2020,19 +1950,21 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
|
|||
}
|
||||
}
|
||||
|
||||
private void implementNetworkElementsAndResources(DeployDestination dest, ReservationContext context,
|
||||
NetworkVO network, NetworkOfferingVO offering)
|
||||
private void implementNetworkElementsAndResources(DeployDestination dest, ReservationContext context,
|
||||
NetworkVO network, NetworkOfferingVO offering)
|
||||
throws ConcurrentOperationException, InsufficientAddressCapacityException, ResourceUnavailableException, InsufficientCapacityException {
|
||||
// If this is a 1) guest virtual network 2) network has sourceNat service 3) network offering does not support a
|
||||
// Shared source NAT rule,
|
||||
// associate a source NAT IP (if one isn't already associated with the network)
|
||||
|
||||
// Associate a source NAT IP (if one isn't already associated with the network) if this is a
|
||||
// 1) 'Isolated' or 'Shared' guest virtual network in the advance zone
|
||||
// 2) network has sourceNat service
|
||||
// 3) network offering does not support a shared source NAT rule
|
||||
|
||||
boolean sharedSourceNat = offering.getSharedSourceNat();
|
||||
DataCenter zone = _dcDao.findById(network.getDataCenterId());
|
||||
if (!sharedSourceNat && areServicesSupportedInNetwork(network.getId(), Service.SourceNat)
|
||||
&& (network.getGuestType() == Network.GuestType.Isolated ||
|
||||
(network.getGuestType() == Network.GuestType.Shared && zone.getNetworkType() == NetworkType.Advanced))) {
|
||||
|
||||
if (network.getGuestType() == Network.GuestType.Isolated
|
||||
&& areServicesSupportedInNetwork(network.getId(), Service.SourceNat)
|
||||
&& !sharedSourceNat) {
|
||||
|
||||
List<IPAddressVO> ips = null;
|
||||
if (network.getVpcId() != null) {
|
||||
ips = _ipAddressDao.listByAssociatedVpc(network.getVpcId(), true);
|
||||
|
|
@ -2062,9 +1994,11 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
|
|||
throw new CloudRuntimeException("Service provider " + element.getProvider().getName() +
|
||||
" either doesn't exist or is not enabled in physical network id: " + network.getPhysicalNetworkId());
|
||||
}
|
||||
|
||||
if (s_logger.isDebugEnabled()) {
|
||||
s_logger.debug("Asking " + element.getName() + " to implemenet " + network);
|
||||
}
|
||||
|
||||
if (!element.implement(network, offering, dest, context)) {
|
||||
CloudRuntimeException ex = new CloudRuntimeException("Failed to implement provider " + element.getProvider().getName() + " for network with specified id");
|
||||
ex.addProxyObject(network, network.getId(), "networkId");
|
||||
|
|
|
|||
Loading…
Reference in New Issue