etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

NSX: Fix Routed mode - add checks for ports added for FW rules

This commit is contained in:
Pearl Dsilva 2024-01-22 10:07:32 -05:00
parent 10401563c7
commit 906fce5f5f
2 changed files with 37 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
server/src/main/java/com/cloud/network/firewall/FirewallManagerImpl.java
View File

@ -22,12 +22,18 @@ import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Locale;
import java.util.Map;
import java.util.Objects;
import java.util.Set;
import javax.inject.Inject;
import javax.naming.ConfigurationException;
import com.cloud.dc.DataCenter;
import com.cloud.network.dao.NsxProviderDao;
import com.cloud.network.element.NsxProviderVO;
import com.cloud.utils.db.EntityManager;
import org.apache.cloudstack.api.command.user.firewall.IListFirewallRulesCmd;
import org.apache.cloudstack.api.command.user.ipv6.ListIpv6FirewallRulesCmd;
import org.apache.cloudstack.context.CallContext;
@ -146,6 +152,10 @@ public class FirewallManagerImpl extends ManagerBase implements FirewallService,
List<NetworkACLServiceProvider> _networkAclElements;
@Inject
IpAddressManager _ipAddrMgr;
@Inject
EntityManager entityManager;
@Inject
NsxProviderDao nsxProviderDao;
private boolean _elbEnabled = false;
static Boolean rulesContinueOnErrFlag = true;
@ -690,6 +700,8 @@ public class FirewallManagerImpl extends ManagerBase implements FirewallService,
for (FirewallRuleVO rule : rules) {
// load cidrs if any
long networkId = rule.getNetworkId();
validateNsxConstraints(networkId, rule.getProtocol(), rule);
rule.setSourceCidrList(_firewallCidrsDao.getSourceCidrs(rule.getId()));
rule.setDestinationCidrsList(_firewallDcidrsDao.getDestCidrs(rule.getId()));
}
@ -710,6 +722,28 @@ public class FirewallManagerImpl extends ManagerBase implements FirewallService,
return true;
}
private void validateNsxConstraints(long networkId, String protocol, FirewallRuleVO rule) {
final Network network = entityManager.findById(Network.class, networkId);
final DataCenter dc = entityManager.findById(DataCenter.class, network.getDataCenterId());
final NsxProviderVO nsxProvider = nsxProviderDao.findByZoneId(dc.getId());
if (Objects.isNull(nsxProvider)) {
return;
}
if (NetUtils.ICMP_PROTO.equals(protocol.toLowerCase(Locale.ROOT)) && (rule.getIcmpType() == -1 || rule.getIcmpCode() == -1)) {
String errorMsg = "Passing -1 for ICMP type is not supported for NSX enabled zones";
s_logger.error(errorMsg);
throw new InvalidParameterValueException(errorMsg);
}
if (List.of(NetUtils.TCP_PROTO, NetUtils.UDP_PROTO).contains(protocol.toLowerCase(Locale.ROOT)) &&
(Objects.isNull(rule.getSourcePortStart()) || Objects.isNull(rule.getSourcePortEnd())) &&
State.Add.equals(rule.getState())) {
String errorMsg = "Source start and end ports are required to be passed";
s_logger.error(errorMsg);
throw new InvalidParameterValueException(errorMsg);
}
}
@Override
public boolean applyDefaultEgressFirewallRule(Long networkId, boolean defaultPolicy, boolean add) throws ResourceUnavailableException {

9
server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
View File

@ -1246,19 +1246,16 @@ public class ConfigurationServerImpl extends ManagerBase implements Configuratio
serviceProviderMap.put(Service.Dhcp, routerProvider);
serviceProviderMap.put(Service.Dns, routerProvider);
serviceProviderMap.put(Service.UserData, routerProvider);
if (nsxMode == NetworkOffering.NsxMode.ROUTED && forVpc) {
if (forVpc) {
serviceProviderMap.put(Service.NetworkACL, Provider.Nsx);
} else {
serviceProviderMap.put(Service.Firewall, Provider.Nsx);
}
if (nsxMode == NetworkOffering.NsxMode.NATTED) {
serviceProviderMap.put(Service.SourceNat, Provider.Nsx);
serviceProviderMap.put(Service.StaticNat, Provider.Nsx);
serviceProviderMap.put(Service.PortForwarding, Provider.Nsx);
serviceProviderMap.put(Service.Lb, Provider.Nsx);
if (forVpc) {
serviceProviderMap.put(Service.NetworkACL, Provider.Nsx);
} else {
serviceProviderMap.put(Service.Firewall, Provider.Nsx);
}
}
return serviceProviderMap;
}