Skip to content

Commit 6a7ae63

Browse files
author
Jayapal
committed
CLOUDSTACK-1578 Egress default policy configurable using network offering in xenserver with VR as firewall provider
1 parent 4f45673 commit 6a7ae63

21 files changed

Lines changed: 173 additions & 42 deletions

File tree

‎api/src/com/cloud/offering/NetworkOffering.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,5 +127,6 @@ public enum Detail {
127127
boolean getInternalLb();
128128

129129
boolean getPublicLb();
130+
boolean getEgressDefaultPolicy();
130131

131132
}

‎api/src/org/apache/cloudstack/api/ApiConstants.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ public class ApiConstants {
121121
public static final String IS_PORTABLE = "isportable";
122122
public static final String IS_PUBLIC = "ispublic";
123123
public static final String IS_PERSISTENT = "ispersistent";
124+
public static final String EGRESS_DEFAULT_POLICY = "egressdefaultpolicy";
124125
public static final String IS_READY = "isready";
125126
public static final String IS_RECURSIVE = "isrecursive";
126127
public static final String ISO_FILTER = "isofilter";

‎api/src/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,9 @@ public class CreateNetworkOfferingCmd extends BaseCmd {
9999
" Supported keys are internallbprovider/publiclbprovider with service provider as a value")
100100
protected Map details;
101101

102+
@Parameter(name=ApiConstants.EGRESS_DEFAULT_POLICY, type=CommandType.BOOLEAN, description="true if default guest network egress policy is allow; false if default egress policy is deny")
103+
private Boolean egressDefaultPolicy;
104+
102105
/////////////////////////////////////////////////////
103106
/////////////////// Accessors ///////////////////////
104107
/////////////////////////////////////////////////////
@@ -162,6 +165,13 @@ public Boolean getIsPersistent() {
162165
return isPersistent == null ? false : isPersistent;
163166
}
164167

168+
public Boolean getEgressDefaultPolicy() {
169+
if (egressDefaultPolicy == null) {
170+
return true;
171+
}
172+
return egressDefaultPolicy;
173+
}
174+
165175
public Map<String, List<String>> getServiceProviders() {
166176
Map<String, List<String>> serviceProviderMap = null;
167177
if (serviceProviderList != null && !serviceProviderList.isEmpty()) {

‎api/src/org/apache/cloudstack/api/response/NetworkOfferingResponse.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,9 @@ public class NetworkOfferingResponse extends BaseResponse {
8888
@SerializedName(ApiConstants.DETAILS) @Param(description="additional key/value details tied with network offering", since="4.2.0")
8989
private Map details;
9090

91+
@SerializedName(ApiConstants.EGRESS_DEFAULT_POLICY) @Param(description="true if network offering supports persistent networks, false otherwise")
92+
private Boolean egressDefaultPolicy;
93+
9194

9295
public void setId(String id) {
9396
this.id = id;
@@ -166,4 +169,8 @@ public void setDetails(Map details) {
166169
this.details = details;
167170
}
168171

172+
public void setEgressDefaultPolicy(Boolean egressDefaultPolicy) {
173+
this.egressDefaultPolicy = egressDefaultPolicy;
174+
}
175+
169176
}

‎core/src/com/cloud/agent/api/routing/NetworkElementCommand.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ public abstract class NetworkElementCommand extends Command {
3333
public static final String ZONE_NETWORK_TYPE = "zone.network.type";
3434
public static final String GUEST_BRIDGE = "guest.bridge";
3535
public static final String VPC_PRIVATE_GATEWAY = "vpc.gateway.private";
36+
public static final String FIREWALL_EGRESS_DEFAULT = "firewall.egress.default";
3637

3738

3839
protected NetworkElementCommand() {

‎engine/schema/src/com/cloud/network/rules/FirewallRuleVO.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,13 @@ public FirewallRuleVO(String xId, Long ipAddressId, Integer portStart, Integer p
223223
}
224224

225225

226+
public FirewallRuleVO(String xId, Long ipAddressId, Integer portStart, Integer portEnd, String protocol,
227+
long networkId, long accountId, long domainId, Purpose purpose, List<String> sourceCidrs, Integer icmpCode,
228+
Integer icmpType, Long related, TrafficType trafficType, FirewallRuleType type) {
229+
this(xId, ipAddressId, portStart, portEnd, protocol, networkId, accountId, domainId, purpose, sourceCidrs, icmpCode, icmpType, related, trafficType);
230+
this.type = type;
231+
}
232+
226233
public FirewallRuleVO(String xId, long ipAddressId, int port, String protocol, long networkId, long accountId,
227234
long domainId, Purpose purpose, List<String> sourceCidrs, Integer icmpCode, Integer icmpType, Long related) {
228235
this(xId, ipAddressId, port, port, protocol, networkId, accountId, domainId, purpose, sourceCidrs, icmpCode, icmpType, related, null);

‎engine/schema/src/com/cloud/offerings/NetworkOfferingVO.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,9 @@ public class NetworkOfferingVO implements NetworkOffering {
130130
@Column(name = "is_persistent")
131131
boolean isPersistent;
132132

133+
@Column(name = "egress_default_policy")
134+
boolean egressdefaultpolicy;
135+
133136
@Override
134137
public String getDisplayText() {
135138
return displayText;
@@ -275,6 +278,10 @@ public void setRedundantRouter(boolean redundantRouter) {
275278
this.redundantRouter = redundantRouter;
276279
}
277280

281+
public boolean getEgressDefaultPolicy() {
282+
return egressdefaultpolicy;
283+
}
284+
278285
public NetworkOfferingVO(String name, String displayText, TrafficType trafficType, boolean systemOnly, boolean specifyVlan, Integer rateMbps, Integer multicastRateMbps, boolean isDefault,
279286
Availability availability, String tags, Network.GuestType guestType, boolean conserveMode, boolean specifyIpRanges, boolean isPersistent, boolean internalLb, boolean publicLb) {
280287
this.name = name;
@@ -306,7 +313,7 @@ public NetworkOfferingVO(String name, String displayText, TrafficType trafficTyp
306313

307314
public NetworkOfferingVO(String name, String displayText, TrafficType trafficType, boolean systemOnly, boolean specifyVlan, Integer rateMbps, Integer multicastRateMbps, boolean isDefault,
308315
Availability availability, String tags, Network.GuestType guestType, boolean conserveMode, boolean dedicatedLb, boolean sharedSourceNat, boolean redundantRouter, boolean elasticIp, boolean elasticLb,
309-
boolean specifyIpRanges, boolean inline, boolean isPersistent, boolean associatePublicIP, boolean publicLb, boolean internalLb) {
316+
boolean specifyIpRanges, boolean inline, boolean isPersistent, boolean associatePublicIP, boolean publicLb, boolean internalLb, boolean egressdefaultpolicy) {
310317
this(name, displayText, trafficType, systemOnly, specifyVlan, rateMbps, multicastRateMbps, isDefault, availability, tags, guestType, conserveMode, specifyIpRanges, isPersistent, internalLb, publicLb);
311318
this.dedicatedLB = dedicatedLb;
312319
this.sharedSourceNat = sharedSourceNat;
@@ -315,6 +322,7 @@ public NetworkOfferingVO(String name, String displayText, TrafficType trafficTyp
315322
this.elasticLb = elasticLb;
316323
this.inline = inline;
317324
this.eipAssociatePublicIp = associatePublicIP;
325+
this.egressdefaultpolicy = egressdefaultpolicy;
318326
}
319327

320328
public NetworkOfferingVO() {

‎patches/systemvm/debian/config/root/firewallRule_egress.sh‎

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -82,15 +82,14 @@ fw_entry_for_egress() {
8282
[ "$eport" == "-1" ] && typecode="$sport"
8383
[ "$sport" == "-1" ] && typecode="any"
8484
sudo iptables -A FW_EGRESS_RULES -p $prot -s $lcidr --icmp-type $typecode \
85-
-j ACCEPT
85+
-j $target
8686
result=$?
8787
elif [ "$prot" == "all" ]
8888
then
89-
sudo iptables -A FW_EGRESS_RULES -p $prot -s $lcidr -j ACCEPT
89+
sudo iptables -A FW_EGRESS_RULES -p $prot -s $lcidr -j $target
9090
result=$?
9191
else
92-
sudo iptables -A FW_EGRESS_RULES -p $prot -s $lcidr \
93-
$DPORT -j ACCEPT
92+
sudo iptables -A FW_EGRESS_RULES -p $prot -s $lcidr $DPORT -j $target
9493
result=$?
9594
fi
9695

@@ -109,14 +108,18 @@ rules=""
109108
rules_list=""
110109
ip=""
111110
dev=""
111+
pflag=0
112112
shift
113113
shift
114-
while getopts 'a:' OPTION
114+
while getopts 'a:P:' OPTION
115115
do
116116
case $OPTION in
117117
a) aflag=1
118118
rules="$OPTARG"
119119
;;
120+
P) pflag=1
121+
pvalue="$OPTARG"
122+
;;
120123
?) usage
121124
unlock_exit 2 $lock $locked
122125
;;
@@ -142,6 +145,13 @@ fi
142145

143146
success=0
144147

148+
if [ "$pvalue" == "0" -o "$pvalue" == "2" ]
149+
then
150+
target="ACCEPT"
151+
else
152+
target="DROP"
153+
fi
154+
145155
fw_egress_chain
146156
for r in $rules_list
147157
do
@@ -162,6 +172,12 @@ then
162172
fw_egress_backup_restore
163173
else
164174
logger -t cloud "deleting backup for guest network"
175+
if [ "$pvalue" == "1" -o "$pvalue" == "2" ]
176+
then
177+
#Adding default policy rule
178+
sudo iptables -A FW_EGRESS_RULES -j ACCEPT
179+
fi
180+
165181
fi
166182

167183
fw_egress_remove_backup

‎plugins/hypervisors/xen/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7994,6 +7994,7 @@ protected SetFirewallRulesAnswer execute(SetFirewallRulesCommand cmd) {
79947994
String callResult;
79957995
Connection conn = getConnection();
79967996
String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
7997+
String egressDefault = cmd.getAccessDetail(NetworkElementCommand.FIREWALL_EGRESS_DEFAULT);
79977998
FirewallRuleTO[] allrules = cmd.getRules();
79987999
FirewallRule.TrafficType trafficType = allrules[0].getTrafficType();
79998000
if (routerIp == null) {
@@ -8005,6 +8006,13 @@ protected SetFirewallRulesAnswer execute(SetFirewallRulesCommand cmd) {
80058006
args += routerIp + " -F";
80068007
if (trafficType == FirewallRule.TrafficType.Egress){
80078008
args+= " -E";
8009+
if (egressDefault.equals("true")) {
8010+
args+= " -P 1";
8011+
} else if (egressDefault.equals("System")) {
8012+
args+= " -P 2";
8013+
} else {
8014+
args+= " -P 0";
8015+
}
80088016
}
80098017
StringBuilder sb = new StringBuilder();
80108018
String[] fwRules = rules[0];

‎server/src/com/cloud/api/ApiResponseHelper.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2009,6 +2009,7 @@ public NetworkOfferingResponse createNetworkOfferingResponse(NetworkOffering off
20092009
response.setAvailability(offering.getAvailability().toString());
20102010
response.setIsPersistent(offering.getIsPersistent());
20112011
response.setNetworkRate(ApiDBUtils.getNetworkRate(offering.getId()));
2012+
response.setEgressDefaultPolicy(offering.getEgressDefaultPolicy());
20122013
Long so = null;
20132014
if (offering.getServiceOfferingId() != null) {
20142015
so = offering.getServiceOfferingId();

0 commit comments

Comments
 (0)