Skip to content

Commit ccec919

Browse files
author
Alena Prokharchyk
committed
VPC: implemented delete and list Network ACL(s)
1 parent 374a600 commit ccec919

10 files changed

Lines changed: 314 additions & 22 deletions

File tree

‎api/src/com/cloud/api/commands/CreateNetworkACLCmd.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
@Implementation(description = "Creates a ACL rule the given network (the network has to belong to VPC)",
3232
responseObject = NetworkACLResponse.class)
3333
public class CreateNetworkACLCmd extends BaseAsyncCreateCmd implements NetworkACL {
34-
public static final Logger s_logger = Logger.getLogger(CreateFirewallRuleCmd.class.getName());
34+
public static final Logger s_logger = Logger.getLogger(CreateNetworkACLCmd.class.getName());
3535

3636
private static final String s_name = "createnetworkaclresponse";
3737

‎api/src/com/cloud/api/commands/DeleteNetworkACLCmd.java‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
// Copyright 2012 Citrix Systems, Inc. Licensed under the
2+
// Apache License, Version 2.0 (the "License"); you may not use this
3+
// file except in compliance with the License. Citrix Systems, Inc.
4+
// reserves all rights not expressly granted by the License.
5+
// You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
6+
// Unless required by applicable law or agreed to in writing, software
7+
// distributed under the License is distributed on an "AS IS" BASIS,
8+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9+
// See the License for the specific language governing permissions and
10+
// limitations under the License.
11+
//
12+
// Automatically generated by addcopyright.py at 04/03/2012
13+
package com.cloud.api.commands;
14+
15+
/**
16+
* @author Alena Prokharchyk
17+
*/
18+
import org.apache.log4j.Logger;
19+
20+
import com.cloud.api.ApiConstants;
21+
import com.cloud.api.BaseAsyncCmd;
22+
import com.cloud.api.BaseCmd;
23+
import com.cloud.api.IdentityMapper;
24+
import com.cloud.api.Implementation;
25+
import com.cloud.api.Parameter;
26+
import com.cloud.api.ServerApiException;
27+
import com.cloud.api.response.SuccessResponse;
28+
import com.cloud.async.AsyncJob;
29+
import com.cloud.event.EventTypes;
30+
import com.cloud.exception.InvalidParameterValueException;
31+
import com.cloud.exception.ResourceUnavailableException;
32+
import com.cloud.network.rules.NetworkACL;
33+
import com.cloud.user.UserContext;
34+
35+
@Implementation(description="Deletes a Network ACL", responseObject=SuccessResponse.class)
36+
public class DeleteNetworkACLCmd extends BaseAsyncCmd {
37+
public static final Logger s_logger = Logger.getLogger(DeleteNetworkACLCmd.class.getName());
38+
private static final String s_name = "deletenetworkaclresponse";
39+
40+
/////////////////////////////////////////////////////
41+
//////////////// API parameters /////////////////////
42+
/////////////////////////////////////////////////////
43+
44+
@IdentityMapper(entityTableName="firewall_rules")
45+
@Parameter(name=ApiConstants.ID, type=CommandType.LONG, required=true, description="the ID of the network ACL")
46+
private Long id;
47+
48+
// unexposed parameter needed for events logging
49+
@IdentityMapper(entityTableName="account")
50+
@Parameter(name=ApiConstants.ACCOUNT_ID, type=CommandType.LONG, expose=false)
51+
private Long ownerId;
52+
/////////////////////////////////////////////////////
53+
/////////////////// Accessors ///////////////////////
54+
/////////////////////////////////////////////////////
55+
56+
public Long getId() {
57+
return id;
58+
}
59+
60+
/////////////////////////////////////////////////////
61+
/////////////// API Implementation///////////////////
62+
/////////////////////////////////////////////////////
63+
@Override
64+
public String getCommandName() {
65+
return s_name;
66+
}
67+
68+
@Override
69+
public String getEventType() {
70+
return EventTypes.EVENT_FIREWALL_CLOSE;
71+
}
72+
73+
@Override
74+
public String getEventDescription() {
75+
return ("Deleting Network ACL id=" + id);
76+
}
77+
78+
@Override
79+
public long getEntityOwnerId() {
80+
if (ownerId == null) {
81+
NetworkACL rule = _networkACLService.getNetworkACL(id);
82+
if (rule == null) {
83+
throw new InvalidParameterValueException("Unable to find network ACL by id=" + id);
84+
} else {
85+
ownerId = rule.getAccountId();
86+
}
87+
}
88+
return ownerId;
89+
}
90+
91+
@Override
92+
public void execute() throws ResourceUnavailableException {
93+
UserContext.current().setEventDetails("Network ACL Id: " + id);
94+
boolean result = _networkACLService.revokeNetworkACL(id, true);
95+
96+
if (result) {
97+
SuccessResponse response = new SuccessResponse(getCommandName());
98+
this.setResponseObject(response);
99+
} else {
100+
throw new ServerApiException(BaseCmd.INTERNAL_ERROR, "Failed to delete network ACL");
101+
}
102+
}
103+
104+
105+
@Override
106+
public String getSyncObjType() {
107+
return BaseAsyncCmd.networkSyncObject;
108+
}
109+
110+
@Override
111+
public Long getSyncObjId() {
112+
return _firewallService.getFirewallRule(id).getNetworkId();
113+
}
114+
115+
@Override
116+
public AsyncJob.Type getInstanceType() {
117+
return AsyncJob.Type.FirewallRule;
118+
}
119+
}
120+

‎api/src/com/cloud/api/commands/ListFirewallRulesCmd.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222
import org.apache.log4j.Logger;
2323

2424
import com.cloud.api.ApiConstants;
25-
import com.cloud.api.BaseCmd.CommandType;
2625
import com.cloud.api.BaseListProjectAndAccountResourcesCmd;
2726
import com.cloud.api.IdentityMapper;
2827
import com.cloud.api.Implementation;

‎api/src/com/cloud/api/commands/ListNetworkACLsCmd.java‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
// Copyright 2012 Citrix Systems, Inc. Licensed under the
2+
// Apache License, Version 2.0 (the "License"); you may not use this
3+
// file except in compliance with the License. Citrix Systems, Inc.
4+
// reserves all rights not expressly granted by the License.
5+
// You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
6+
// Unless required by applicable law or agreed to in writing, software
7+
// distributed under the License is distributed on an "AS IS" BASIS,
8+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
9+
// See the License for the specific language governing permissions and
10+
// limitations under the License.
11+
//
12+
// Automatically generated by addcopyright.py at 04/03/2012
13+
package com.cloud.api.commands;
14+
15+
/**
16+
* @author Alena Prokharchyk
17+
*/
18+
19+
import java.util.ArrayList;
20+
import java.util.List;
21+
22+
import org.apache.log4j.Logger;
23+
24+
import com.cloud.api.ApiConstants;
25+
import com.cloud.api.BaseListProjectAndAccountResourcesCmd;
26+
import com.cloud.api.IdentityMapper;
27+
import com.cloud.api.Implementation;
28+
import com.cloud.api.Parameter;
29+
import com.cloud.api.response.FirewallResponse;
30+
import com.cloud.api.response.ListResponse;
31+
import com.cloud.api.response.NetworkACLResponse;
32+
import com.cloud.network.rules.NetworkACL;
33+
34+
@Implementation(description="Lists all network ACLs", responseObject=NetworkACLResponse.class)
35+
public class ListNetworkACLsCmd extends BaseListProjectAndAccountResourcesCmd {
36+
public static final Logger s_logger = Logger.getLogger(ListNetworkACLsCmd.class.getName());
37+
38+
private static final String s_name = "listnetworkaclsresponse";
39+
40+
/////////////////////////////////////////////////////
41+
//////////////// API parameters /////////////////////
42+
/////////////////////////////////////////////////////
43+
@IdentityMapper(entityTableName="firewall_rules")
44+
@Parameter(name=ApiConstants.ID, type=CommandType.LONG, description="Lists network ACL with the specified ID.")
45+
private Long id;
46+
47+
@IdentityMapper(entityTableName="networks")
48+
@Parameter(name=ApiConstants.NETWORK, type=CommandType.LONG, description="list network ACLs by network Id")
49+
private Long networkId;
50+
51+
@Parameter(name=ApiConstants.TRAFFIC_TYPE, type=CommandType.STRING, description="list network ACLs by traffic type - Ingress or Egress")
52+
private String trafficType;
53+
54+
/////////////////////////////////////////////////////
55+
/////////////////// Accessors ///////////////////////
56+
/////////////////////////////////////////////////////
57+
58+
public Long getNetworkId() {
59+
return networkId;
60+
}
61+
62+
public Long getId() {
63+
return id;
64+
}
65+
66+
public String getTrafficType() {
67+
return trafficType;
68+
}
69+
70+
/////////////////////////////////////////////////////
71+
/////////////// API Implementation///////////////////
72+
/////////////////////////////////////////////////////
73+
74+
@Override
75+
public String getCommandName() {
76+
return s_name;
77+
}
78+
79+
@Override
80+
public void execute(){
81+
List<? extends NetworkACL> result = _networkACLService.listNetworkACLs(this);
82+
ListResponse<NetworkACLResponse> response = new ListResponse<NetworkACLResponse>();
83+
List<NetworkACLResponse> aclResponses = new ArrayList<NetworkACLResponse>();
84+
85+
for (NetworkACL acl : result) {
86+
NetworkACLResponse ruleData = _responseGenerator.createNetworkACLResponse(acl);
87+
aclResponses.add(ruleData);
88+
}
89+
response.setResponses(aclResponses);
90+
response.setResponseName(getCommandName());
91+
this.setResponseObject(response);
92+
}
93+
}

‎api/src/com/cloud/network/firewall/NetworkACLService.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@
1212
// Automatically generated by addcopyright.py at 04/03/2012
1313
package com.cloud.network.firewall;
1414

15+
import java.util.List;
16+
17+
import com.cloud.api.commands.ListNetworkACLsCmd;
1518
import com.cloud.exception.NetworkRuleConflictException;
1619
import com.cloud.exception.ResourceUnavailableException;
1720
import com.cloud.network.rules.NetworkACL;
@@ -35,4 +38,9 @@ public interface NetworkACLService {
3538
* @return
3639
*/
3740
boolean revokeNetworkACL(long ruleId, boolean apply);
41+
/**
42+
* @param listNetworkACLsCmd
43+
* @return
44+
*/
45+
List<? extends NetworkACL> listNetworkACLs(ListNetworkACLsCmd cmd);
3846
}

‎client/tomcatconf/commands.properties.in‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -361,5 +361,5 @@ createPrivateNetwork=com.cloud.api.commands.CreatePrivateNetworkCmd;1
361361

362362
####
363363
createNetworkACL=com.cloud.api.commands.CreateNetworkACLCmd;15
364-
#deleteNetworkACL=com.cloud.api.commands.DeleteNetworkACLCmd;15
365-
#listNetworkACLs=com.cloud.api.commands.ListNetworkACLsCmd;15
364+
deleteNetworkACL=com.cloud.api.commands.DeleteNetworkACLCmd;15
365+
listNetworkACLs=com.cloud.api.commands.ListNetworkACLsCmd;15

‎server/src/com/cloud/network/element/VpcVirtualRouterElement.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ private static Map<Service, Map<Capability, String>> setCapabilities() {
281281
capabilities.put(Service.Vpn, vpnCapabilities);
282282

283283
Map<Capability, String> firewallCapabilities = capabilities.get(Service.Firewall);
284-
firewallCapabilities.put(Capability.FirewallType, "percidr");
284+
firewallCapabilities.put(Capability.FirewallType, "networkacl");
285285
capabilities.put(Service.Firewall, firewallCapabilities);
286286

287287
return capabilities;

‎server/src/com/cloud/network/firewall/FirewallManagerImpl.java‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -348,7 +348,7 @@ public void validateFirewallRule(Account caller, IPAddressVO ipAddress, Integer
348348
Long networkId = null;
349349

350350
if (ipAddress.getAssociatedWithNetworkId() == null) {
351-
throw new InvalidParameterValueException("Unable to create port forwarding rule ; ip id=" +
351+
throw new InvalidParameterValueException("Unable to create firewall rule ; ip id=" +
352352
ipAddress.getId() + " is not associated with any network");
353353
} else {
354354
networkId = ipAddress.getAssociatedWithNetworkId();
@@ -358,20 +358,27 @@ public void validateFirewallRule(Account caller, IPAddressVO ipAddress, Integer
358358
assert network != null : "Can't create port forwarding rule as network associated with public ip address is null?";
359359

360360
// Verify that the network guru supports the protocol specified
361-
Map<Network.Capability, String> protocolCapabilities = null;
361+
Map<Network.Capability, String> caps = null;
362362

363363
if (purpose == Purpose.LoadBalancing) {
364364
if (!_elbEnabled) {
365-
protocolCapabilities = _networkMgr.getNetworkServiceCapabilities(network.getId(), Service.Lb);
365+
caps = _networkMgr.getNetworkServiceCapabilities(network.getId(), Service.Lb);
366366
}
367367
} else if (purpose == Purpose.Firewall) {
368-
protocolCapabilities = _networkMgr.getNetworkServiceCapabilities(network.getId(), Service.Firewall);
368+
caps = _networkMgr.getNetworkServiceCapabilities(network.getId(), Service.Firewall);
369+
if (caps != null) {
370+
String firewallType = caps.get(Capability.FirewallType);
371+
//regular firewall rules are not supported in networks supporting network ACLs
372+
if (firewallType.equalsIgnoreCase("networkacl")) {
373+
throw new UnsupportedOperationException("Firewall rules are not supported in network " + network);
374+
}
375+
}
369376
} else if (purpose == Purpose.PortForwarding) {
370-
protocolCapabilities = _networkMgr.getNetworkServiceCapabilities(network.getId(), Service.PortForwarding);
377+
caps = _networkMgr.getNetworkServiceCapabilities(network.getId(), Service.PortForwarding);
371378
}
372379

373-
if (protocolCapabilities != null) {
374-
String supportedProtocols = protocolCapabilities.get(Capability.SupportedProtocols).toLowerCase();
380+
if (caps != null) {
381+
String supportedProtocols = caps.get(Capability.SupportedProtocols).toLowerCase();
375382
if (!supportedProtocols.contains(proto.toLowerCase())) {
376383
throw new InvalidParameterValueException("Protocol " + proto + " is not supported in zone " + network.getDataCenterId());
377384
} else if (proto.equalsIgnoreCase(NetUtils.ICMP_PROTO) && purpose != Purpose.Firewall) {

0 commit comments

Comments
 (0)