mirror of https://github.com/apache/cloudstack.git
462 lines
21 KiB
Java
462 lines
21 KiB
Java
/**
|
|
* Copyright (C) 2011 Cloud.com, Inc. All rights reserved.
|
|
*/
|
|
|
|
package com.cloud.network;
|
|
|
|
import java.net.URI;
|
|
import java.util.ArrayList;
|
|
import java.util.HashMap;
|
|
import java.util.List;
|
|
import java.util.Map;
|
|
|
|
import javax.ejb.Local;
|
|
import javax.naming.ConfigurationException;
|
|
|
|
import org.apache.log4j.Logger;
|
|
|
|
import com.cloud.agent.api.Answer;
|
|
import com.cloud.agent.api.routing.IpAssocCommand;
|
|
import com.cloud.agent.api.routing.NetworkElementCommand;
|
|
import com.cloud.agent.api.routing.SetPortForwardingRulesCommand;
|
|
import com.cloud.agent.api.routing.SetStaticNatRulesCommand;
|
|
import com.cloud.agent.api.to.IpAddressTO;
|
|
import com.cloud.agent.api.to.PortForwardingRuleTO;
|
|
import com.cloud.agent.api.to.StaticNatRuleTO;
|
|
import com.cloud.api.commands.AddExternalFirewallCmd;
|
|
import com.cloud.api.commands.DeleteExternalFirewallCmd;
|
|
import com.cloud.api.commands.ListExternalFirewallsCmd;
|
|
import com.cloud.configuration.ConfigurationManager;
|
|
import com.cloud.dc.DataCenter;
|
|
import com.cloud.dc.DataCenterVO;
|
|
import com.cloud.dc.Vlan;
|
|
import com.cloud.dc.VlanVO;
|
|
import com.cloud.dc.DataCenter.NetworkType;
|
|
import com.cloud.dc.dao.DataCenterDao;
|
|
import com.cloud.dc.dao.VlanDao;
|
|
import com.cloud.exception.AgentUnavailableException;
|
|
import com.cloud.exception.InvalidParameterValueException;
|
|
import com.cloud.exception.ResourceUnavailableException;
|
|
import com.cloud.host.DetailVO;
|
|
import com.cloud.host.Host;
|
|
import com.cloud.host.HostVO;
|
|
import com.cloud.network.Networks.TrafficType;
|
|
import com.cloud.network.dao.FirewallRulesDao;
|
|
import com.cloud.network.dao.InlineLoadBalancerNicMapDao;
|
|
import com.cloud.network.resource.JuniperSrxResource;
|
|
import com.cloud.network.rules.FirewallRule;
|
|
import com.cloud.network.rules.FirewallRule.Purpose;
|
|
import com.cloud.network.rules.FirewallRuleVO;
|
|
import com.cloud.network.rules.PortForwardingRule;
|
|
import com.cloud.network.rules.StaticNatRule;
|
|
import com.cloud.network.rules.StaticNatRuleImpl;
|
|
import com.cloud.offering.NetworkOffering;
|
|
import com.cloud.server.api.response.ExternalFirewallResponse;
|
|
import com.cloud.user.Account;
|
|
import com.cloud.user.AccountManager;
|
|
import com.cloud.user.User;
|
|
import com.cloud.user.UserContext;
|
|
import com.cloud.user.dao.AccountDao;
|
|
import com.cloud.user.dao.UserStatisticsDao;
|
|
import com.cloud.utils.component.Inject;
|
|
import com.cloud.utils.exception.CloudRuntimeException;
|
|
import com.cloud.utils.net.NetUtils;
|
|
import com.cloud.utils.net.UrlUtil;
|
|
import com.cloud.vm.Nic.ReservationStrategy;
|
|
import com.cloud.vm.Nic.State;
|
|
import com.cloud.vm.NicVO;
|
|
import com.cloud.vm.dao.NicDao;
|
|
|
|
@Local(value = { ExternalFirewallManager.class })
|
|
public class JuniperSrxManagerImpl extends ExternalNetworkManagerImpl implements ExternalFirewallManager {
|
|
|
|
@Inject
|
|
NetworkManager _networkMgr;
|
|
@Inject
|
|
NicDao _nicDao;
|
|
@Inject
|
|
AccountDao _accountDao;
|
|
@Inject
|
|
DataCenterDao _dcDao;
|
|
@Inject
|
|
FirewallRulesDao _firewallRulesDao;
|
|
@Inject
|
|
UserStatisticsDao _userStatsDao;
|
|
@Inject
|
|
VlanDao _vlanDao;
|
|
@Inject
|
|
ConfigurationManager _configMgr;
|
|
@Inject
|
|
AccountManager _accountMgr;
|
|
|
|
private static final org.apache.log4j.Logger s_logger = Logger.getLogger(JuniperSrxManagerImpl.class);
|
|
|
|
@Override
|
|
public Host addExternalFirewall(AddExternalFirewallCmd cmd) {
|
|
long zoneId = cmd.getZoneId();
|
|
|
|
DataCenterVO zone = _dcDao.findById(zoneId);
|
|
String zoneName;
|
|
if (zone == null) {
|
|
throw new InvalidParameterValueException("Could not find zone with ID: " + zoneId);
|
|
} else {
|
|
zoneName = zone.getName();
|
|
}
|
|
|
|
List<HostVO> externalFirewallsInZone = _hostDao.listByTypeDataCenter(Host.Type.ExternalFirewall, zoneId);
|
|
if (externalFirewallsInZone.size() != 0) {
|
|
throw new InvalidParameterValueException("Already added an external firewall in zone: " + zoneName);
|
|
}
|
|
|
|
URI uri;
|
|
try {
|
|
uri = new URI(cmd.getUrl());
|
|
} catch (Exception e) {
|
|
s_logger.debug(e);
|
|
throw new InvalidParameterValueException(e.getMessage());
|
|
}
|
|
|
|
String ipAddress = uri.getHost();
|
|
String username = cmd.getUsername();
|
|
String password = cmd.getPassword();
|
|
Map<String, String> params = new HashMap<String, String>();
|
|
UrlUtil.parseQueryParameters(uri.getQuery(), true, params);
|
|
String publicInterface = params.get("publicinterface");
|
|
String usageInterface = params.get("usageinterface");
|
|
String privateInterface = params.get("privateinterface");
|
|
String publicZone = params.get("publiczone");
|
|
String privateZone = params.get("privatezone");
|
|
String numRetries = params.get("numretries");
|
|
String timeout = params.get("timeout");
|
|
|
|
if (publicInterface == null) {
|
|
throw new InvalidParameterValueException("Please specify a public interface.");
|
|
}
|
|
|
|
if (usageInterface != null) {
|
|
if (!usageInterface.contains(".")) {
|
|
usageInterface += ".0";
|
|
}
|
|
}
|
|
|
|
if (privateInterface != null) {
|
|
if (privateInterface.contains(".")) {
|
|
throw new InvalidParameterValueException("The private interface name must not have a unit identifier.");
|
|
}
|
|
} else {
|
|
throw new InvalidParameterValueException("Please specify a private interface.");
|
|
}
|
|
|
|
if (publicZone == null) {
|
|
publicZone = "untrust";
|
|
}
|
|
|
|
if (privateZone == null) {
|
|
privateZone = "trust";
|
|
}
|
|
|
|
if (numRetries == null) {
|
|
numRetries = "1";
|
|
}
|
|
|
|
if (timeout == null) {
|
|
timeout = "300";
|
|
}
|
|
|
|
JuniperSrxResource resource = new JuniperSrxResource();
|
|
String guid = getExternalNetworkResourceGuid(zoneId, ExternalNetworkResourceName.JuniperSrx, ipAddress);
|
|
|
|
Map hostDetails = new HashMap<String, String>();
|
|
hostDetails.put("zoneId", String.valueOf(zoneId));
|
|
hostDetails.put("ip", ipAddress);
|
|
hostDetails.put("username", username);
|
|
hostDetails.put("password", password);
|
|
hostDetails.put("publicInterface", publicInterface);
|
|
hostDetails.put("privateInterface", privateInterface);
|
|
hostDetails.put("publicZone", publicZone);
|
|
hostDetails.put("privateZone", privateZone);
|
|
hostDetails.put("numRetries", numRetries);
|
|
hostDetails.put("timeout", timeout);
|
|
hostDetails.put("guid", guid);
|
|
hostDetails.put("name", guid);
|
|
|
|
if (usageInterface != null) {
|
|
hostDetails.put("usageInterface", usageInterface);
|
|
}
|
|
|
|
try {
|
|
resource.configure(guid, hostDetails);
|
|
} catch (ConfigurationException e) {
|
|
throw new CloudRuntimeException(e.getMessage());
|
|
}
|
|
|
|
Host externalFirewall = _agentMgr.addHost(zoneId, resource, Host.Type.ExternalFirewall, hostDetails);
|
|
if (externalFirewall != null) {
|
|
zone.setFirewallProvider(Network.Provider.JuniperSRX.getName());
|
|
zone.setUserDataProvider(Network.Provider.DhcpServer.getName());
|
|
zone.setVpnProvider(null);
|
|
|
|
if (zone.getGatewayProvider() == null || !zone.getGatewayProvider().equals(Network.Provider.ExternalGateWay)) {
|
|
zone.setGatewayProvider(Network.Provider.JuniperSRX.getName());
|
|
}
|
|
|
|
if (zone.getDnsProvider() == null || !zone.getDnsProvider().equals(Network.Provider.ExternalDhcpServer)) {
|
|
zone.setDnsProvider(Network.Provider.DhcpServer.getName());
|
|
}
|
|
|
|
if (zone.getDhcpProvider() == null || !zone.getDhcpProvider().equals(Network.Provider.ExternalDhcpServer)) {
|
|
zone.setDhcpProvider(Network.Provider.DhcpServer.getName());
|
|
}
|
|
|
|
if (zone.getLoadBalancerProvider() == null || !zone.getLoadBalancerProvider().equals(Network.Provider.F5BigIp.getName())) {
|
|
zone.setLoadBalancerProvider(Network.Provider.None.getName());
|
|
}
|
|
|
|
_dcDao.update(zone.getId(), zone);
|
|
return externalFirewall;
|
|
} else {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
@Override
|
|
public boolean deleteExternalFirewall(DeleteExternalFirewallCmd cmd) {
|
|
long hostId = cmd.getId();
|
|
User caller = _accountMgr.getActiveUser(UserContext.current().getCallerUserId());
|
|
HostVO externalFirewall = _hostDao.findById(hostId);
|
|
if (externalFirewall == null) {
|
|
throw new InvalidParameterValueException("Could not find an external firewall with ID: " + hostId);
|
|
}
|
|
|
|
try {
|
|
if (_agentMgr.maintain(hostId) && _agentMgr.deleteHost(hostId, false, false, caller)) {
|
|
DataCenterVO zone = _dcDao.findById(externalFirewall.getDataCenterId());
|
|
zone.setFirewallProvider(Network.Provider.VirtualRouter.getName());
|
|
zone.setUserDataProvider(Network.Provider.VirtualRouter.getName());
|
|
zone.setVpnProvider(Network.Provider.VirtualRouter.getName());
|
|
|
|
if (zone.getGatewayProvider() != null && !zone.getGatewayProvider().equals(Network.Provider.ExternalGateWay)) {
|
|
zone.setGatewayProvider(Network.Provider.VirtualRouter.getName());
|
|
}
|
|
|
|
if (zone.getDnsProvider() != null && !zone.getDnsProvider().equals(Network.Provider.ExternalDhcpServer)) {
|
|
zone.setDnsProvider(Network.Provider.VirtualRouter.getName());
|
|
}
|
|
|
|
if (zone.getDhcpProvider() != null && !zone.getDhcpProvider().equals(Network.Provider.ExternalDhcpServer)) {
|
|
zone.setDhcpProvider(Network.Provider.VirtualRouter.getName());
|
|
}
|
|
|
|
if (zone.getLoadBalancerProvider() != null && zone.getLoadBalancerProvider().equals(Network.Provider.None)) {
|
|
if (zone.getNetworkType().equals(NetworkType.Advanced)) {
|
|
zone.setLoadBalancerProvider(Network.Provider.VirtualRouter.getName());
|
|
} else if (zone.getNetworkType().equals(NetworkType.Basic)) {
|
|
zone.setLoadBalancerProvider(null);
|
|
}
|
|
}
|
|
|
|
return _dcDao.update(zone.getId(), zone);
|
|
} else {
|
|
return false;
|
|
}
|
|
} catch (AgentUnavailableException e) {
|
|
s_logger.debug(e);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
@Override
|
|
public List<HostVO> listExternalFirewalls(ListExternalFirewallsCmd cmd) {
|
|
long zoneId = cmd.getZoneId();
|
|
return _hostDao.listByTypeDataCenter(Host.Type.ExternalFirewall, zoneId);
|
|
}
|
|
|
|
@Override
|
|
public ExternalFirewallResponse getApiResponse(Host externalFirewall) {
|
|
Map<String, String> fwDetails = _detailsDao.findDetails(externalFirewall.getId());
|
|
ExternalFirewallResponse response = new ExternalFirewallResponse();
|
|
response.setId(externalFirewall.getId());
|
|
response.setIpAddress(externalFirewall.getPrivateIpAddress());
|
|
response.setUsername(fwDetails.get("username"));
|
|
response.setPublicInterface(fwDetails.get("publicInterface"));
|
|
response.setUsageInterface(fwDetails.get("usageInterface"));
|
|
response.setPrivateInterface(fwDetails.get("privateInterface"));
|
|
response.setPublicZone(fwDetails.get("publicZone"));
|
|
response.setPrivateZone(fwDetails.get("privateZone"));
|
|
response.setNumRetries(fwDetails.get("numRetries"));
|
|
response.setTimeout(fwDetails.get("timeout"));
|
|
return response;
|
|
}
|
|
|
|
@Override
|
|
public boolean manageGuestNetwork(boolean add, Network network, NetworkOffering offering) throws ResourceUnavailableException {
|
|
if (network.getTrafficType() != TrafficType.Guest) {
|
|
s_logger.trace("JuniperSrxManager can only add/remove guest networks.");
|
|
return false;
|
|
}
|
|
|
|
// Find the external firewall in this zone
|
|
long zoneId = network.getDataCenterId();
|
|
DataCenterVO zone = _dcDao.findById(zoneId);
|
|
HostVO externalFirewall = getExternalNetworkAppliance(zoneId, Host.Type.ExternalFirewall);
|
|
|
|
if (externalFirewall == null) {
|
|
return false;
|
|
}
|
|
|
|
Account account = _accountDao.findByIdIncludingRemoved(network.getAccountId());
|
|
boolean sharedSourceNat = offering.isSharedSourceNatService();
|
|
IPAddressVO sourceNatIp = null;
|
|
if (!sharedSourceNat) {
|
|
// Get the source NAT IP address for this network
|
|
List<IPAddressVO> sourceNatIps = _networkMgr.listPublicIpAddressesInVirtualNetwork(network.getAccountId(), zoneId, true, null);
|
|
|
|
if (sourceNatIps.size() != 1) {
|
|
String errorMsg = "JuniperSrxManager was unable to find the source NAT IP address for account " + account.getAccountName();
|
|
s_logger.error(errorMsg);
|
|
return true;
|
|
} else {
|
|
sourceNatIp = sourceNatIps.get(0);
|
|
}
|
|
}
|
|
|
|
// Send a command to the external firewall to implement or shutdown the guest network
|
|
long guestVlanTag = Long.parseLong(network.getBroadcastUri().getHost());
|
|
String guestVlanGateway = network.getGateway();
|
|
String guestVlanCidr = network.getCidr();
|
|
String sourceNatIpAddress = sourceNatIp.getAddress().addr();
|
|
|
|
VlanVO publicVlan = _vlanDao.findById(sourceNatIp.getVlanId());
|
|
String publicVlanTag = publicVlan.getVlanTag();
|
|
|
|
// Get network rate
|
|
Integer networkRate = _networkMgr.getNetworkRate(network.getId(), null);
|
|
|
|
IpAddressTO ip = new IpAddressTO(account.getId(), sourceNatIpAddress, add, false, !sharedSourceNat, publicVlanTag, null, null, null, null, networkRate, sourceNatIp.isOneToOneNat());
|
|
IpAddressTO[] ips = new IpAddressTO[1];
|
|
ips[0] = ip;
|
|
IpAssocCommand cmd = new IpAssocCommand(ips);
|
|
cmd.setAccessDetail(NetworkElementCommand.GUEST_NETWORK_GATEWAY, guestVlanGateway);
|
|
cmd.setAccessDetail(NetworkElementCommand.GUEST_NETWORK_CIDR, guestVlanCidr);
|
|
cmd.setAccessDetail(NetworkElementCommand.GUEST_VLAN_TAG, String.valueOf(guestVlanTag));
|
|
Answer answer = _agentMgr.easySend(externalFirewall.getId(), cmd);
|
|
|
|
if (answer == null || !answer.getResult()) {
|
|
String action = add ? "implement" : "shutdown";
|
|
String answerDetails = (answer != null) ? answer.getDetails() : "answer was null";
|
|
String msg = "JuniperSrxManager was unable to " + action + " the guest network on the external firewall in zone " + zone.getName() + " due to " + answerDetails;
|
|
s_logger.error(msg);
|
|
throw new ResourceUnavailableException(msg, DataCenter.class, zoneId);
|
|
}
|
|
|
|
List<String> reservedIpAddressesForGuestNetwork = _nicDao.listIpAddressInNetwork(network.getId());
|
|
if (add && (!reservedIpAddressesForGuestNetwork.contains(network.getGateway()))) {
|
|
// Insert a new NIC for this guest network to reserve the gateway address
|
|
savePlaceholderNic(network, network.getGateway());
|
|
}
|
|
|
|
// Delete any mappings used for inline external load balancers in this network
|
|
List<NicVO> nicsInNetwork = _nicDao.listByNetworkId(network.getId());
|
|
for (NicVO nic : nicsInNetwork) {
|
|
InlineLoadBalancerNicMapVO mapping = _inlineLoadBalancerNicMapDao.findByNicId(nic.getId());
|
|
if (mapping != null) {
|
|
_nicDao.expunge(mapping.getNicId());
|
|
_inlineLoadBalancerNicMapDao.expunge(mapping.getId());
|
|
}
|
|
}
|
|
|
|
String action = add ? "implemented" : "shut down";
|
|
s_logger.debug("JuniperSrxManager has " + action + " the guest network for account " + account.getAccountName() + "(id = " + account.getAccountId() + ") with VLAN tag " + guestVlanTag);
|
|
|
|
return true;
|
|
}
|
|
|
|
public void applyStaticNatRuleForInlineLBRule(DataCenterVO zone, Network network, HostVO externalFirewall, boolean revoked, String publicIp, String privateIp) throws ResourceUnavailableException {
|
|
List<StaticNatRuleTO> staticNatRules = new ArrayList<StaticNatRuleTO>();
|
|
IPAddressVO ipVO = _ipAddressDao.listByDcIdIpAddress(zone.getId(), publicIp).get(0);
|
|
VlanVO vlan = _vlanDao.findById(ipVO.getVlanId());
|
|
FirewallRuleVO fwRule = new FirewallRuleVO(null, ipVO.getId(), -1, -1, "any", network.getId(), network.getAccountId(), network.getDomainId(), Purpose.StaticNat, null, null, null, null);
|
|
FirewallRule.State state = !revoked ? FirewallRule.State.Add : FirewallRule.State.Revoke;
|
|
fwRule.setState(state);
|
|
StaticNatRule rule = new StaticNatRuleImpl(fwRule, privateIp);
|
|
StaticNatRuleTO ruleTO = new StaticNatRuleTO(rule, vlan.getVlanTag(), publicIp, privateIp);
|
|
staticNatRules.add(ruleTO);
|
|
|
|
applyStaticNatRules(staticNatRules, zone, externalFirewall.getId());
|
|
}
|
|
|
|
@Override
|
|
public boolean applyFirewallRules(Network network, List<? extends FirewallRule> rules) throws ResourceUnavailableException {
|
|
// Find the external firewall in this zone
|
|
long zoneId = network.getDataCenterId();
|
|
DataCenterVO zone = _dcDao.findById(zoneId);
|
|
HostVO externalFirewall = getExternalNetworkAppliance(zoneId, Host.Type.ExternalFirewall);
|
|
|
|
if (externalFirewall == null) {
|
|
return false;
|
|
}
|
|
|
|
if (network.getState() == Network.State.Allocated) {
|
|
s_logger.debug("JuniperSrxManager was asked to apply firewall rules for network with ID " + network.getId() + "; this network is not implemented. Skipping backend commands.");
|
|
return true;
|
|
}
|
|
|
|
List<StaticNatRuleTO> staticNatRules = new ArrayList<StaticNatRuleTO>();
|
|
List<PortForwardingRuleTO> portForwardingRules = new ArrayList<PortForwardingRuleTO>();
|
|
|
|
for (FirewallRule rule : rules) {
|
|
IpAddress sourceIp = _networkMgr.getIp(rule.getSourceIpAddressId());
|
|
Vlan vlan = _vlanDao.findById(sourceIp.getVlanId());
|
|
|
|
if (rule.getPurpose() == Purpose.StaticNat) {
|
|
StaticNatRule staticNatRule = (StaticNatRule) rule;
|
|
StaticNatRuleTO ruleTO = new StaticNatRuleTO(staticNatRule, vlan.getVlanTag(), sourceIp.getAddress().addr(), staticNatRule.getDestIpAddress());
|
|
staticNatRules.add(ruleTO);
|
|
} else if (rule.getPurpose() == Purpose.PortForwarding) {
|
|
PortForwardingRuleTO ruleTO = new PortForwardingRuleTO((PortForwardingRule) rule, vlan.getVlanTag(), sourceIp.getAddress().addr());
|
|
portForwardingRules.add(ruleTO);
|
|
}
|
|
}
|
|
|
|
// Apply static nat rules
|
|
applyStaticNatRules(staticNatRules, zone, externalFirewall.getId());
|
|
|
|
// apply port forwarding rules
|
|
applyPortForwardingRules(portForwardingRules, zone, externalFirewall.getId());
|
|
|
|
return true;
|
|
}
|
|
|
|
protected void applyStaticNatRules(List<StaticNatRuleTO> staticNatRules, DataCenter zone, long externalFirewallId) throws ResourceUnavailableException {
|
|
if (!staticNatRules.isEmpty()) {
|
|
SetStaticNatRulesCommand cmd = new SetStaticNatRulesCommand(staticNatRules);
|
|
Answer answer = _agentMgr.easySend(externalFirewallId, cmd);
|
|
if (answer == null || !answer.getResult()) {
|
|
String details = (answer != null) ? answer.getDetails() : "details unavailable";
|
|
String msg = "JuniperSrxManager was unable to apply static nat rules to the SRX appliance in zone " + zone.getName() + " due to: " + details + ".";
|
|
s_logger.error(msg);
|
|
throw new ResourceUnavailableException(msg, DataCenter.class, zone.getId());
|
|
}
|
|
}
|
|
}
|
|
|
|
protected void applyPortForwardingRules(List<PortForwardingRuleTO> portForwardingRules, DataCenter zone, long externalFirewallId) throws ResourceUnavailableException {
|
|
if (!portForwardingRules.isEmpty()) {
|
|
SetPortForwardingRulesCommand cmd = new SetPortForwardingRulesCommand(portForwardingRules);
|
|
Answer answer = _agentMgr.easySend(externalFirewallId, cmd);
|
|
if (answer == null || !answer.getResult()) {
|
|
String details = (answer != null) ? answer.getDetails() : "details unavailable";
|
|
String msg = "JuniperSrxManager was unable to apply port forwarding rules to the SRX appliance in zone " + zone.getName() + " due to: " + details + ".";
|
|
s_logger.error(msg);
|
|
throw new ResourceUnavailableException(msg, DataCenter.class, zone.getId());
|
|
}
|
|
}
|
|
}
|
|
|
|
@Override
|
|
public boolean applyIps(Network network, List<? extends PublicIpAddress> ipAddresses) throws ResourceUnavailableException {
|
|
return true;
|
|
}
|
|
|
|
}
|