Skip to content

Commit c671e07

Browse files
shwstpprshwstppr
committed
server: update network offering for specified domain(s) & zone(s)
Added checkAccess while creating network from offering. Response fixes for networkoffering APIs. Signed-off-by: Abhishek Kumar <abhishek.kumar@shapeblue.com>
1 parent eaa7592 commit c671e07

11 files changed

Lines changed: 212 additions & 71 deletions

File tree

‎api/src/main/java/com/cloud/user/AccountService.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
import com.cloud.domain.Domain;
3030
import com.cloud.exception.PermissionDeniedException;
3131
import com.cloud.offering.DiskOffering;
32+
import com.cloud.offering.NetworkOffering;
3233
import com.cloud.offering.ServiceOffering;
3334

3435
public interface AccountService {
@@ -101,6 +102,8 @@ UserAccount createUserAccount(String userName, String password, String firstName
101102

102103
void checkAccess(Account account, DiskOffering dof, DataCenter zone) throws PermissionDeniedException;
103104

105+
void checkAccess(Account account, NetworkOffering nof, DataCenter zone) throws PermissionDeniedException;
106+
104107
void checkAccess(User user, ControlledEntity entity);
105108

106109
void checkAccess(Account account, AccessType accessType, boolean sameOwner, String apiName, ControlledEntity... entities) throws PermissionDeniedException;

‎api/src/main/java/org/apache/cloudstack/acl/SecurityChecker.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import com.cloud.domain.Domain;
2121
import com.cloud.exception.PermissionDeniedException;
2222
import com.cloud.offering.DiskOffering;
23+
import com.cloud.offering.NetworkOffering;
2324
import com.cloud.offering.ServiceOffering;
2425
import com.cloud.user.Account;
2526
import com.cloud.user.User;
@@ -139,4 +140,6 @@ boolean checkAccess(Account caller, AccessType accessType, String action, Contro
139140
boolean checkAccess(Account account, ServiceOffering so, DataCenter zone) throws PermissionDeniedException;
140141

141142
boolean checkAccess(Account account, DiskOffering dof, DataCenter zone) throws PermissionDeniedException;
143+
144+
boolean checkAccess(Account account, NetworkOffering nof, DataCenter zone) throws PermissionDeniedException;
142145
}

‎engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,7 @@
171171
import com.cloud.offerings.dao.NetworkOfferingDetailsDao;
172172
import com.cloud.offerings.dao.NetworkOfferingServiceMapDao;
173173
import com.cloud.user.Account;
174+
import com.cloud.user.AccountManager;
174175
import com.cloud.user.ResourceLimitService;
175176
import com.cloud.user.User;
176177
import com.cloud.user.dao.AccountDao;
@@ -286,6 +287,8 @@ public class NetworkOrchestrator extends ManagerBase implements NetworkOrchestra
286287
RemoteAccessVpnDao _remoteAccessVpnDao;
287288
@Inject
288289
VpcVirtualNetworkApplianceService _routerService;
290+
@Inject
291+
AccountManager accountManager;
289292

290293
List<NetworkGuru> networkGurus;
291294

@@ -2162,6 +2165,8 @@ public Network createGuestNetwork(final long networkOfferingId, final String nam
21622165
final Boolean isDisplayNetworkEnabled, final String isolatedPvlan, String externalId) throws ConcurrentOperationException, InsufficientCapacityException, ResourceAllocationException {
21632166

21642167
final NetworkOfferingVO ntwkOff = _networkOfferingDao.findById(networkOfferingId);
2168+
final DataCenterVO zone = _dcDao.findById(zoneId);
2169+
accountManager.checkAccess(owner, ntwkOff, zone);
21652170
// this method supports only guest network creation
21662171
if (ntwkOff.getTrafficType() != TrafficType.Guest) {
21672172
s_logger.warn("Only guest networks can be created using this method");
@@ -2196,7 +2201,6 @@ public Network createGuestNetwork(final long networkOfferingId, final String nam
21962201
ipv6 = true;
21972202
}
21982203
// Validate zone
2199-
final DataCenterVO zone = _dcDao.findById(zoneId);
22002204
if (zone.getNetworkType() == NetworkType.Basic) {
22012205
// In Basic zone the network should have aclType=Domain, domainId=1, subdomainAccess=true
22022206
if (aclType == null || aclType != ACLType.Domain) {

‎engine/schema/src/main/java/com/cloud/offerings/NetworkOfferingDetailsVO.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,11 @@ public class NetworkOfferingDetailsVO implements ResourceDetail {
5454
public NetworkOfferingDetailsVO() {
5555
}
5656

57-
public NetworkOfferingDetailsVO(long resourceId, Detail detailName, String value) {
57+
public NetworkOfferingDetailsVO(long resourceId, Detail detailName, String value, boolean display) {
5858
this.resourceId = resourceId;
5959
this.name = detailName;
6060
this.value = value;
61-
this.display = false;
61+
this.display = display;
6262
}
6363

6464
@Override

‎engine/schema/src/main/java/com/cloud/offerings/dao/NetworkOfferingDaoImpl.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
import javax.inject.Inject;
2424
import javax.persistence.EntityExistsException;
2525

26-
import com.cloud.offerings.NetworkOfferingServiceMapVO;
2726
import org.apache.commons.collections.CollectionUtils;
2827
import org.springframework.stereotype.Component;
2928

@@ -33,6 +32,7 @@
3332
import com.cloud.offering.NetworkOffering.Availability;
3433
import com.cloud.offering.NetworkOffering.Detail;
3534
import com.cloud.offerings.NetworkOfferingDetailsVO;
35+
import com.cloud.offerings.NetworkOfferingServiceMapVO;
3636
import com.cloud.offerings.NetworkOfferingVO;
3737
import com.cloud.utils.db.DB;
3838
import com.cloud.utils.db.Filter;
@@ -187,7 +187,7 @@ public NetworkOfferingVO persist(NetworkOfferingVO off, Map<Detail, String> deta
187187
//2) persist the details
188188
if (details != null && !details.isEmpty()) {
189189
for (NetworkOffering.Detail detail : details.keySet()) {
190-
_detailsDao.persist(new NetworkOfferingDetailsVO(off.getId(), detail, details.get(detail)));
190+
_detailsDao.persist(new NetworkOfferingDetailsVO(off.getId(), detail, details.get(detail), true));
191191
}
192192
}
193193

‎engine/schema/src/main/java/com/cloud/offerings/dao/NetworkOfferingDetailsDaoImpl.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,19 +43,22 @@ public NetworkOfferingDetailsDaoImpl() {
4343
DetailSearch.and("resourceId", DetailSearch.entity().getResourceId(), SearchCriteria.Op.EQ);
4444
DetailSearch.and("name", DetailSearch.entity().getName(), SearchCriteria.Op.EQ);
4545
DetailSearch.and("value", DetailSearch.entity().getValue(), SearchCriteria.Op.EQ);
46+
DetailSearch.and("display", DetailSearch.entity().isDisplay(), SearchCriteria.Op.EQ);
4647
DetailSearch.done();
4748

4849
ValueSearch = createSearchBuilder(String.class);
4950
ValueSearch.select(null, Func.DISTINCT, ValueSearch.entity().getValue());
5051
ValueSearch.and("resourceId", ValueSearch.entity().getResourceId(), SearchCriteria.Op.EQ);
5152
ValueSearch.and("name", ValueSearch.entity().getName(), Op.EQ);
53+
ValueSearch.and("display", ValueSearch.entity().isDisplay(), SearchCriteria.Op.EQ);
5254
ValueSearch.done();
5355
}
5456

5557
@Override
5658
public Map<NetworkOffering.Detail, String> getNtwkOffDetails(long offeringId) {
5759
SearchCriteria<NetworkOfferingDetailsVO> sc = DetailSearch.create();
5860
sc.setParameters("resourceId", offeringId);
61+
sc.setParameters("display", true);
5962

6063
List<NetworkOfferingDetailsVO> results = search(sc, null);
6164
Map<NetworkOffering.Detail, String> details = new HashMap<NetworkOffering.Detail, String>(results.size());
@@ -81,7 +84,7 @@ public String getDetail(long offeringId, Detail detailName) {
8184

8285
@Override
8386
public void addDetail(long resourceId, String key, String value, boolean display) {
84-
persist(new NetworkOfferingDetailsVO(resourceId, Detail.valueOf(key), value));
87+
persist(new NetworkOfferingDetailsVO(resourceId, Detail.valueOf(key), value, display));
8588
}
8689

8790
@Override

‎server/src/main/java/com/cloud/acl/DomainChecker.java‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,9 @@
3535
import com.cloud.network.Network;
3636
import com.cloud.network.NetworkModel;
3737
import com.cloud.offering.DiskOffering;
38+
import com.cloud.offering.NetworkOffering;
3839
import com.cloud.offering.ServiceOffering;
40+
import com.cloud.offerings.dao.NetworkOfferingDetailsDao;
3941
import com.cloud.projects.ProjectManager;
4042
import com.cloud.projects.dao.ProjectAccountDao;
4143
import com.cloud.service.dao.ServiceOfferingDetailsDao;
@@ -71,6 +73,8 @@ public class DomainChecker extends AdapterBase implements SecurityChecker {
7173
DiskOfferingDetailsDao diskOfferingDetailsDao;
7274
@Inject
7375
ServiceOfferingDetailsDao serviceOfferingDetailsDao;
76+
@Inject
77+
NetworkOfferingDetailsDao networkserviceOfferingDetailsDao;
7478

7579
protected DomainChecker() {
7680
super();
@@ -249,6 +253,44 @@ else if (_accountService.isNormalUser(account.getId())
249253
return isAccess;
250254
}
251255

256+
@Override
257+
public boolean checkAccess(Account account, NetworkOffering nof, DataCenter zone) throws PermissionDeniedException {
258+
boolean isAccess = false;
259+
// Check fo domains
260+
if (account == null || nof == null) {
261+
isAccess = true;
262+
} else {
263+
//admin has all permissions
264+
if (_accountService.isRootAdmin(account.getId())) {
265+
isAccess = true;
266+
}
267+
//if account is normal user or domain admin
268+
//check if account's domain is a child of offering's domain (Note: This is made consistent with the list command for disk offering)
269+
else if (_accountService.isNormalUser(account.getId())
270+
|| account.getType() == Account.ACCOUNT_TYPE_RESOURCE_DOMAIN_ADMIN
271+
|| _accountService.isDomainAdmin(account.getId())
272+
|| account.getType() == Account.ACCOUNT_TYPE_PROJECT) {
273+
final List<Long> doDomainIds = networkserviceOfferingDetailsDao.findDomainIds(nof.getId());
274+
if (doDomainIds.isEmpty()) {
275+
isAccess = true;
276+
} else {
277+
for (Long domainId : doDomainIds) {
278+
if (_domainDao.isChildDomain(domainId, account.getDomainId())) {
279+
isAccess = true;
280+
break;
281+
}
282+
}
283+
}
284+
}
285+
}
286+
// Check for zones
287+
if (isAccess && nof != null && zone != null) {
288+
final List<Long> doZoneIds = networkserviceOfferingDetailsDao.findZoneIds(nof.getId());
289+
isAccess = doZoneIds.isEmpty() || doZoneIds.contains(zone.getId());
290+
}
291+
return isAccess;
292+
}
293+
252294
@Override
253295
public boolean checkAccess(Account account, DataCenter zone) throws PermissionDeniedException {
254296
if (account == null || zone.getDomainId() == null) {//public zone

‎server/src/main/java/com/cloud/api/ApiResponseHelper.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,7 @@
175175
import com.cloud.api.query.vo.HostJoinVO;
176176
import com.cloud.api.query.vo.ImageStoreJoinVO;
177177
import com.cloud.api.query.vo.InstanceGroupJoinVO;
178+
import com.cloud.api.query.vo.NetworkOfferingJoinVO;
178179
import com.cloud.api.query.vo.ProjectAccountJoinVO;
179180
import com.cloud.api.query.vo.ProjectInvitationJoinVO;
180181
import com.cloud.api.query.vo.ProjectJoinVO;
@@ -1913,6 +1914,9 @@ public SecurityGroupResponse createSecurityGroupResponseFromSecurityGroupRule(Li
19131914

19141915
@Override
19151916
public NetworkOfferingResponse createNetworkOfferingResponse(NetworkOffering offering) {
1917+
if (!(offering instanceof NetworkOfferingJoinVO)) {
1918+
offering = ApiDBUtils.newNetworkOfferingView(offering);
1919+
}
19161920
NetworkOfferingResponse response = ApiDBUtils.newNetworkOfferingResponse(offering);
19171921
response.setNetworkRate(ApiDBUtils.getNetworkRate(offering.getId()));
19181922
Long so = null;

0 commit comments

Comments
 (0)