etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

NSX: Add appropriate error message when icmp type is set to -1 for NSX (#8504) 

* NSX: Add appropriate error message when icmp type is set to -1 for NSX

* address comments

* update text
This commit is contained in:
Pearl Dsilva 2024-01-18 11:45:58 -05:00 committed by GitHub
parent a4f63053b6
commit 3027501d4b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 24 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java
View File

@ -21,10 +21,14 @@ import java.util.Collections;
import java.util.Comparator;
import java.util.List;
import java.util.Map;
import java.util.Objects;
import javax.inject.Inject;
import com.cloud.dc.DataCenter;
import com.cloud.exception.PermissionDeniedException;
import com.cloud.network.dao.NsxProviderDao;
import com.cloud.network.element.NsxProviderVO;
import org.apache.cloudstack.api.ApiErrorCode;
import org.apache.cloudstack.api.ServerApiException;
import org.apache.cloudstack.api.command.user.network.CreateNetworkACLCmd;
@ -99,6 +103,8 @@ public class NetworkACLServiceImpl extends ManagerBase implements NetworkACLServ
private VpcDao _vpcDao;
@Inject
private VpcService _vpcSvc;
@Inject
private NsxProviderDao nsxProviderDao;
private String supportedProtocolsForAclRules = "tcp,udp,icmp,all";
@ -338,6 +344,7 @@ public class NetworkACLServiceImpl extends ManagerBase implements NetworkACLServ
if (isGlobalAcl(acl.getVpcId()) && !Account.Type.ADMIN.equals(caller.getType())) {
throw new PermissionDeniedException("Only Root Admins can create rules for a global ACL.");
}
validateNsxConstraints(acl.getVpcId(), icmpType);
validateAclRuleNumber(createNetworkACLCmd, acl);
NetworkACLItem.Action ruleAction = validateAndCreateNetworkAclRuleAction(action);
@ -428,6 +435,20 @@ public class NetworkACLServiceImpl extends ManagerBase implements NetworkACLServ
}
}
private void validateNsxConstraints(Long vpcId, Integer icpmType) {
VpcVO vpc = _vpcDao.findById(vpcId);
final DataCenter dc = _entityMgr.findById(DataCenter.class, vpc.getZoneId());
final NsxProviderVO nsxProvider = nsxProviderDao.findByZoneId(dc.getId());
if (Objects.isNull(nsxProvider)) {
return;
}
if (icpmType == -1) {
String errorMsg = "Passing -1 for ICMP type is not supported for NSX enabled zones";
s_logger.error(errorMsg);
throw new InvalidParameterValueException(errorMsg);
}
}
/**
* This methods will simply return the ACL rule list ID if it has been provided by the parameter 'createNetworkACLCmd'.
* If no ACL rule List ID has been provided the method behave as follows:
@ -817,7 +838,7 @@ public class NetworkACLServiceImpl extends ManagerBase implements NetworkACLServ
NetworkACL acl = _networkAclMgr.getNetworkACL(networkACLItemVo.getAclId());
validateNetworkAcl(acl);
validateNsxConstraints(acl.getVpcId(), networkACLItemVo.getIcmpType());
Account account = CallContext.current().getCallingAccount();
validateGlobalAclPermissionAndAclAssociatedToVpc(acl, account, "Only Root Admins can update global ACLs.");

4
ui/public/locales/en.json
View File

@ -15,8 +15,8 @@
"error.release.dedicate.zone": "Failed to release dedicated zone.",
"error.unable.to.proceed": "Unable to proceed. Please contact your administrator.",
"firewall.close": "Firewall",
"icmp.code.desc": "Please specify -1 if you want to allow all ICMP codes.",
"icmp.type.desc": "Please specify -1 if you want to allow all ICMP types.",
"icmp.code.desc": "Please specify -1 if you want to allow all ICMP codes (except NSX zones).",
"icmp.type.desc": "Please specify -1 if you want to allow all ICMP types (except NSX zones).",
"inline": "Inline",
"label.about": "About",
"label.about.app": "About CloudStack",