Skip to content

Commit a4a059c

Browse files
JayapalUradiSheng Yang
JayapalUradi
authored and
Sheng Yang
committed
CLOUDSTACK-779 Egress firewall rules support for Juniper SRX
1 parent ee0a91d commit a4a059c

7 files changed

Lines changed: 328 additions & 80 deletions

File tree

‎api/src/com/cloud/agent/api/to/FirewallRuleTO.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323

2424
import com.cloud.network.rules.FirewallRule;
2525
import com.cloud.network.rules.FirewallRule.State;
26+
import com.cloud.network.rules.FirewallRule.TrafficType;
2627
import com.cloud.utils.net.NetUtils;
2728

2829
/**
@@ -109,6 +110,11 @@ public FirewallRuleTO(FirewallRule rule, String srcVlanTag, String srcIp, Firewa
109110
this(rule.getId(),srcVlanTag, srcIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(), revokeState, alreadyAdded, purpose,rule.getSourceCidrList(),rule.getIcmpType(),rule.getIcmpCode());
110111
}
111112

113+
public FirewallRuleTO(FirewallRule rule, String guestVlanTag, FirewallRule.TrafficType trafficType) {
114+
this(rule.getId(), guestVlanTag, null, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose(), rule.getSourceCidrList(), rule.getIcmpType(), rule.getIcmpCode());
115+
this.trafficType = trafficType;
116+
}
117+
112118
public FirewallRule.TrafficType getTrafficType(){
113119
return trafficType;
114120
}

‎plugins/network-elements/juniper-srx/src/com/cloud/network/element/JuniperSRXExternalFirewallElement.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -274,7 +274,7 @@ private static Map<Service, Map<Capability, String>> setCapabilities() {
274274
firewallCapabilities.put(Capability.SupportedProtocols, "tcp,udp,icmp");
275275
firewallCapabilities.put(Capability.MultipleIps, "true");
276276
firewallCapabilities.put(Capability.TrafficStatistics, "per public ip");
277-
firewallCapabilities.put(Capability.SupportedTrafficDirection, "ingress");
277+
firewallCapabilities.put(Capability.SupportedTrafficDirection, "ingress, egress");
278278
capabilities.put(Service.Firewall, firewallCapabilities);
279279

280280
// Disabling VPN for Juniper in Acton as it 1) Was never tested 2) probably just doesn't work

‎plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java‎

Lines changed: 248 additions & 74 deletions
Large diffs are not rendered by default.

‎scripts/network/juniper/application-add.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ under the License.
2323
<application>
2424
<name>%name%</name>
2525
<protocol>%protocol%</protocol>
26-
<destination-port>%dest-port%</destination-port>
26+
%dest-port-icmp%
2727
</application>
2828
</applications>
2929
</configuration>

‎scripts/network/juniper/security-policy-add.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ under the License.
2727
<policy>
2828
<name>%policy-name%</name>
2929
<match>
30-
<source-address>%src-address%</source-address>
31-
<destination-address>%dest-address%</destination-address>
30+
%src-address%
31+
%dst-address%
3232
%applications%
3333
</match>
3434
<then>

‎server/src/com/cloud/network/ExternalFirewallDeviceManagerImpl.java‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
12
// Licensed to the Apache Software Foundation (ASF) under one
23
// or more contributor license agreements. See the NOTICE file
34
// distributed with this work for additional information
@@ -541,8 +542,15 @@ public boolean applyFirewallRules(Network network, List<? extends FirewallRule>
541542
if (rule.getSourceCidrList() == null && (rule.getPurpose() == Purpose.Firewall || rule.getPurpose() == Purpose.NetworkACL)) {
542543
_fwRulesDao.loadSourceCidrs((FirewallRuleVO)rule);
543544
}
544-
IpAddress sourceIp = _networkModel.getIp(rule.getSourceIpAddressId());
545-
FirewallRuleTO ruleTO = new FirewallRuleTO(rule, null, sourceIp.getAddress().addr());
545+
FirewallRuleTO ruleTO;
546+
if (rule.getPurpose() == Purpose.Firewall && rule.getTrafficType() == FirewallRule.TrafficType.Egress) {
547+
String guestVlanTag = network.getBroadcastUri().getHost();
548+
String guestCidr = network.getCidr();
549+
ruleTO = new FirewallRuleTO(rule, guestVlanTag, rule.getTrafficType());
550+
} else {
551+
IpAddress sourceIp = _networkModel.getIp(rule.getSourceIpAddressId());
552+
ruleTO = new FirewallRuleTO(rule, null, sourceIp.getAddress().addr());
553+
}
546554
rulesTO.add(ruleTO);
547555
}
548556

‎server/src/com/cloud/upgrade/dao/Upgrade410to420.java‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ public void performDataMigration(Connection conn) {
6565
updateSystemVmTemplates(conn);
6666
updateCluster_details(conn);
6767
updatePrimaryStore(conn);
68+
addEgressFwRulesForSRXGuestNw(conn);
6869
}
6970

7071
private void updateSystemVmTemplates(Connection conn) {
@@ -305,4 +306,63 @@ private void updateRemoteAccessVpn(Connection conn) {
305306
}
306307
}
307308
}
309+
private void addEgressFwRulesForSRXGuestNw(Connection conn) {
310+
PreparedStatement pstmt = null;
311+
ResultSet rs = null;
312+
ResultSet rsId = null;
313+
ResultSet rsNw = null;
314+
try {
315+
pstmt = conn.prepareStatement("select network_id FROM `cloud`.`ntwk_service_map` where service='Firewall' and provider='JuniperSRX' ");
316+
rs = pstmt.executeQuery();
317+
while (rs.next()) {
318+
long netId = rs.getLong(1);
319+
//checking for Isolated OR Virtual
320+
pstmt = conn.prepareStatement("select account_id, domain_id FROM `cloud`.`networks` where (guest_type='Isolated' OR guest_type='Virtual') and traffic_type='Guest' and vpc_id is NULL and (state='implemented' OR state='Shutdown') and id=? ");
321+
pstmt.setLong(1, netId);
322+
s_logger.debug("Getting account_id, domain_id from networks table: " + pstmt);
323+
rsNw = pstmt.executeQuery();
324+
325+
if(rsNw.next()) {
326+
long accountId = rsNw.getLong(1);
327+
long domainId = rsNw.getLong(2);
328+
329+
//Add new rule for the existing networks
330+
s_logger.debug("Adding default egress firewall rule for network " + netId);
331+
pstmt = conn.prepareStatement("INSERT INTO firewall_rules (uuid, state, protocol, purpose, account_id, domain_id, network_id, xid, created, traffic_type) VALUES (?, 'Active', 'all', 'Firewall', ?, ?, ?, ?, now(), 'Egress')");
332+
pstmt.setString(1, UUID.randomUUID().toString());
333+
pstmt.setLong(2, accountId);
334+
pstmt.setLong(3, domainId);
335+
pstmt.setLong(4, netId);
336+
pstmt.setString(5, UUID.randomUUID().toString());
337+
s_logger.debug("Inserting default egress firewall rule " + pstmt);
338+
pstmt.executeUpdate();
339+
340+
pstmt = conn.prepareStatement("select id from firewall_rules where protocol='all' and network_id=?");
341+
pstmt.setLong(1, netId);
342+
rsId = pstmt.executeQuery();
343+
344+
long firewallRuleId;
345+
if(rsId.next()) {
346+
firewallRuleId = rsId.getLong(1);
347+
pstmt = conn.prepareStatement("insert into firewall_rules_cidrs (firewall_rule_id,source_cidr) values (?, '0.0.0.0/0')");
348+
pstmt.setLong(1, firewallRuleId);
349+
s_logger.debug("Inserting rule for cidr 0.0.0.0/0 for the new Firewall rule id=" + firewallRuleId + " with statement " + pstmt);
350+
pstmt.executeUpdate();
351+
}
352+
}
353+
}
354+
} catch (SQLException e) {
355+
throw new CloudRuntimeException("Unable to set egress firewall rules ", e);
356+
} finally {
357+
try {
358+
if (rs != null) {
359+
rs.close();
360+
}
361+
if (pstmt != null) {
362+
pstmt.close();
363+
}
364+
} catch (SQLException e) {
365+
}
366+
}
367+
}
308368
}

0 commit comments

Comments
 (0)