Skip to content

Commit b9183c0

Browse files
author
Naredula Janardhana Reddy
committed
bug 10561: merging code from 2.2.10 to master
1 parent 085bd36 commit b9183c0

8 files changed

Lines changed: 345 additions & 34 deletions

File tree

‎api/src/com/cloud/agent/api/routing/SetFirewallRulesAnswer.java‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,8 @@ public class SetFirewallRulesAnswer extends Answer {
2525
protected SetFirewallRulesAnswer() {
2626
}
2727

28-
public SetFirewallRulesAnswer(SetFirewallRulesCommand cmd, String[] results) {
29-
super(cmd, true, null);
30-
28+
public SetFirewallRulesAnswer(SetFirewallRulesCommand cmd, boolean success, String[] results) {
29+
super(cmd, success, null);
3130
assert (cmd.getRules().length == results.length) : "rules and their results should be the same length don't you think?";
3231
this.results = results;
3332
}

‎api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,13 @@
1717
*/
1818
package com.cloud.agent.api.routing;
1919

20+
import java.util.HashSet;
2021
import java.util.List;
22+
import java.util.Set;
2123

2224
import com.cloud.agent.api.to.FirewallRuleTO;
25+
import com.cloud.agent.api.to.LoadBalancerTO;
26+
import com.cloud.utils.StringUtils;
2327

2428
/**
2529
* SetFirewallRulesCommand is the transport for firewall rules.
@@ -40,4 +44,59 @@ public SetFirewallRulesCommand(List<FirewallRuleTO> rules) {
4044
public FirewallRuleTO[] getRules() {
4145
return rules;
4246
}
47+
48+
public String[][] generateFwRules() {
49+
String [][] result = new String [2][];
50+
Set<String> toAdd = new HashSet<String>();
51+
52+
53+
for (FirewallRuleTO fwTO: rules) {
54+
/* example : 172.16.92.44:tcp:80:80:0.0.0.0/0:,200.16.92.44:tcp:220:220:0.0.0.0/0:,
55+
* each entry format <ip>:protocol:srcport:destport:scidr:
56+
* reverted entry format <ip>:reverted:0:0:0:
57+
*/
58+
if (fwTO.revoked() == true)
59+
{
60+
StringBuilder sb = new StringBuilder();
61+
/* This entry is added just to make sure atleast there will one entry in the list to get the ipaddress */
62+
sb.append(fwTO.getSrcIp()).append(":reverted:0:0:0:");
63+
String fwRuleEntry = sb.toString();
64+
toAdd.add(fwRuleEntry);
65+
continue;
66+
}
67+
68+
List<String> cidr;
69+
StringBuilder sb = new StringBuilder();
70+
sb.append(fwTO.getSrcIp()).append(":").append(fwTO.getProtocol()).append(":");
71+
if ("icmp".compareTo(fwTO.getProtocol()) == 0)
72+
{
73+
sb.append(fwTO.getIcmpType()).append(":").append(fwTO.getIcmpCode()).append(":");
74+
75+
}else if (fwTO.getStringSrcPortRange() == null)
76+
sb.append("0:0").append(":");
77+
else
78+
sb.append(fwTO.getStringSrcPortRange()).append(":");
79+
80+
cidr = fwTO.getSourceCidrList();
81+
if (cidr == null || cidr.isEmpty())
82+
{
83+
sb.append("0.0.0.0/0");
84+
}else{
85+
Boolean firstEntry = true;
86+
for (String tag : cidr) {
87+
if (!firstEntry) sb.append("-");
88+
sb.append(tag);
89+
firstEntry = false;
90+
}
91+
}
92+
sb.append(":");
93+
String fwRuleEntry = sb.toString();
94+
95+
toAdd.add(fwRuleEntry);
96+
97+
}
98+
result[0] = toAdd.toArray(new String[toAdd.size()]);
99+
100+
return result;
101+
}
43102
}

‎api/src/com/cloud/agent/api/to/FirewallRuleTO.java‎

Lines changed: 34 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -52,14 +52,21 @@ public class FirewallRuleTO {
5252
int[] srcPortRange;
5353
boolean revoked;
5454
boolean alreadyAdded;
55+
private List<String> sourceCidrList;
5556
FirewallRule.Purpose purpose;
57+
private Integer icmpType;
58+
private Integer icmpCode;
59+
5660

5761
protected FirewallRuleTO() {
5862
}
5963

60-
public FirewallRuleTO(long id, String srcVlanTag, String srcIp, String protocol, Integer srcPortStart, Integer srcPortEnd, boolean revoked, boolean alreadyAdded, FirewallRule.Purpose purpose) {
61-
this.srcVlanTag = srcVlanTag;
62-
this.srcIp = srcIp;
64+
public FirewallRuleTO(long id, String srcIp, String protocol, Integer srcPortStart, Integer srcPortEnd, boolean revoked, boolean alreadyAdded, FirewallRule.Purpose purpose, List<String> sourceCidr,Integer icmpType,Integer icmpCode) {
65+
this(id,null,srcIp,protocol,srcPortStart,srcPortEnd,revoked,alreadyAdded,purpose,sourceCidr,icmpType,icmpCode);
66+
}
67+
public FirewallRuleTO(long id,String srcVlanTag, String srcIp, String protocol, Integer srcPortStart, Integer srcPortEnd, boolean revoked, boolean alreadyAdded, FirewallRule.Purpose purpose, List<String> sourceCidr,Integer icmpType,Integer icmpCode) {
68+
this.srcVlanTag = srcVlanTag;
69+
this.srcIp = srcIp;
6370
this.protocol = protocol;
6471

6572
if (srcPortStart != null) {
@@ -80,10 +87,16 @@ public FirewallRuleTO(long id, String srcVlanTag, String srcIp, String protocol,
8087
this.revoked = revoked;
8188
this.alreadyAdded = alreadyAdded;
8289
this.purpose = purpose;
90+
this.sourceCidrList = sourceCidr;
91+
this.icmpType = icmpType;
92+
this.icmpCode = icmpCode;
8393
}
84-
8594
public FirewallRuleTO(FirewallRule rule, String srcVlanTag, String srcIp) {
86-
this(rule.getId(), srcVlanTag, srcIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose());
95+
this(rule.getId(),srcVlanTag, srcIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose(),rule.getSourceCidrList(),rule.getIcmpType(),rule.getIcmpCode());
96+
}
97+
98+
public FirewallRuleTO(FirewallRule rule, String srcIp) {
99+
this(rule.getId(),null, srcIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose(),rule.getSourceCidrList(),rule.getIcmpType(),rule.getIcmpCode());
87100
}
88101

89102
public long getId() {
@@ -106,14 +119,29 @@ public int[] getSrcPortRange() {
106119
return srcPortRange;
107120
}
108121

122+
public Integer getIcmpType(){
123+
return icmpType;
124+
}
125+
126+
public Integer getIcmpCode(){
127+
return icmpCode;
128+
}
129+
109130
public String getStringSrcPortRange() {
110-
return NetUtils.portRangeToString(srcPortRange);
131+
if (srcPortRange == null || srcPortRange.length < 2)
132+
return "0:0";
133+
else
134+
return NetUtils.portRangeToString(srcPortRange);
111135
}
112136

113137
public boolean revoked() {
114138
return revoked;
115139
}
116140

141+
public List<String> getSourceCidrList() {
142+
return sourceCidrList;
143+
}
144+
117145
public boolean isAlreadyAdded() {
118146
return alreadyAdded;
119147
}

‎api/src/com/cloud/agent/api/to/PortForwardingRuleTO.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ public PortForwardingRuleTO(PortForwardingRule rule, String srcVlanTag, String s
4646
this.sourceCidrs = rule.getSourceCidrList();
4747
}
4848

49-
protected PortForwardingRuleTO(long id, String srcVlanTag, String srcIp, int srcPortStart, int srcPortEnd, String dstIp, int dstPortStart, int dstPortEnd, String protocol, boolean revoked, boolean brandNew) {
50-
super(id, srcVlanTag, srcIp, protocol, srcPortStart, srcPortEnd, revoked, brandNew, FirewallRule.Purpose.PortForwarding);
49+
protected PortForwardingRuleTO(long id, String srcIp, int srcPortStart, int srcPortEnd, String dstIp, int dstPortStart, int dstPortEnd, String protocol, boolean revoked, boolean brandNew) {
50+
super(id, srcIp,null, protocol, srcPortStart, srcPortEnd, revoked, brandNew, FirewallRule.Purpose.PortForwarding, null,0,0);
5151
this.dstIp = dstIp;
5252
this.dstPortRange = new int[] { dstPortStart, dstPortEnd };
5353
}

‎api/src/com/cloud/agent/api/to/StaticNatRuleTO.java‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,15 +34,20 @@ public class StaticNatRuleTO extends FirewallRuleTO{
3434

3535
protected StaticNatRuleTO() {
3636
}
37-
37+
3838
public StaticNatRuleTO(StaticNatRule rule, String srcVlanTag, String srcIp, String dstIp) {
39-
super(rule.getId(), srcVlanTag, srcIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(),rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose());
39+
super(rule.getId(),srcVlanTag, srcIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(),rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose(), null,0,0);
40+
this.dstIp = dstIp;
41+
}
42+
43+
public StaticNatRuleTO(StaticNatRule rule, String scrIp, String dstIp) {
44+
super(rule.getId(), scrIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(),rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose(), null,0,0);
4045
this.dstIp = dstIp;
4146
}
4247

4348

44-
protected StaticNatRuleTO(long id, String srcVlanTag, String srcIp, int srcPortStart, int srcPortEnd, String dstIp, int dstPortStart, int dstPortEnd, String protocol, boolean revoked, boolean brandNew) {
45-
super(id, srcVlanTag, srcIp, protocol, srcPortStart, srcPortEnd, revoked, brandNew, FirewallRule.Purpose.StaticNat);
49+
public StaticNatRuleTO(long id, String srcIp, Integer srcPortStart, Integer srcPortEnd, String dstIp, Integer dstPortStart, Integer dstPortEnd, String protocol, boolean revoked, boolean alreadyAdded) {
50+
super(id, srcIp, protocol, srcPortStart, srcPortEnd, revoked, alreadyAdded, FirewallRule.Purpose.StaticNat, null,0,0);
4651
this.dstIp = dstIp;
4752
}
4853

‎core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java‎

Lines changed: 32 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,6 @@
156156
import com.cloud.agent.api.storage.DestroyCommand;
157157
import com.cloud.agent.api.storage.PrimaryStorageDownloadAnswer;
158158
import com.cloud.agent.api.storage.PrimaryStorageDownloadCommand;
159-
import com.cloud.agent.api.to.FirewallRuleTO;
160159
import com.cloud.agent.api.to.IpAddressTO;
161160
import com.cloud.agent.api.to.NicTO;
162161
import com.cloud.agent.api.to.PortForwardingRuleTO;
@@ -6508,17 +6507,37 @@ private Answer execute(NetworkRulesSystemVmCommand cmd) {
65086507
return new Answer(cmd, success, "");
65096508
}
65106509

6511-
protected SetFirewallRulesAnswer execute(SetFirewallRulesCommand cmd) {
6512-
Connection conn = getConnection();
6513-
6514-
String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
6515-
String[] results = new String[cmd.getRules().length];
6516-
int i = 0;
6517-
for (FirewallRuleTO rule : cmd.getRules()) {
6518-
//FIXME - Jana, add implementation here
6519-
}
6510+
protected SetFirewallRulesAnswer execute(SetFirewallRulesCommand cmd) {
6511+
String[] results = new String[cmd.getRules().length];
6512+
String callResult;
6513+
Connection conn = getConnection();
6514+
String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
6515+
6516+
if (routerIp == null) {
6517+
return new SetFirewallRulesAnswer(cmd, false, results);
6518+
}
65206519

6521-
return new SetFirewallRulesAnswer(cmd, results);
6522-
}
6523-
6520+
String[][] rules = cmd.generateFwRules();
6521+
String args = "";
6522+
args += routerIp + " -F ";
6523+
StringBuilder sb = new StringBuilder();
6524+
String[] fwRules = rules[0];
6525+
if (fwRules.length > 0) {
6526+
for (int i = 0; i < fwRules.length; i++) {
6527+
sb.append(fwRules[i]).append(',');
6528+
}
6529+
args += " -a " + sb.toString();
6530+
}
6531+
6532+
callResult = callHostPlugin(conn, "vmops", "setFirewallRule", "args", args);
6533+
6534+
if (callResult == null || callResult.isEmpty()) {
6535+
//FIXME - in the future we have to process each rule separately; now we temporarily set every rule to be false if single rule fails
6536+
for (int i=0; i < results.length; i++) {
6537+
results[i] = "Failed";
6538+
}
6539+
return new SetFirewallRulesAnswer(cmd, false, results);
6540+
}
6541+
return new SetFirewallRulesAnswer(cmd, true, results);
6542+
}
65246543
}

0 commit comments

Comments
 (0)