Skip to content

Commit 8a87eaa

Browse files
nvazquezPearl1594
nvazquez
and
Pearl1594
authored
[NSX] Add ACL types support (#8224)
* NSX: Create segment group on segment creation * Add unit tests * Remove group for segment before removing segment * Create Distributed Firewall rules * Remove distributed firewall policy on segment deletion * Fix policy rule ID and add more unit tests * Fix DROP action rules and transform tests * Add new ACL rules * Fixes * associate security policies with groups and not to DFW and add deletion of rules * Fix name convention --------- Co-authored-by: Pearl Dsilva <pearl1594@gmail.com>
1 parent 0535210 commit 8a87eaa

File tree

12 files changed

+647
-26
lines changed

12 files changed

+647
-26
lines changed

‎engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1735,8 +1735,7 @@ protected boolean reprogramNetworkRules(final long networkId, final Account call
17351735
}
17361736

17371737
//apply network ACLs
1738-
// TODO: remove check for NSX
1739-
if (!offering.isForNsx() && !_networkACLMgr.applyACLToNetwork(networkId)) {
1738+
if (!_networkACLMgr.applyACLToNetwork(networkId)) {
17401739
s_logger.warn("Failed to reapply network ACLs as a part of of network id=" + networkId + " restart");
17411740
success = false;
17421741
}

‎plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/agent/api/CreateNsxDistributedFirewallRulesCommand.java‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package org.apache.cloudstack.agent.api;
18+
19+
import org.apache.cloudstack.resource.NsxNetworkRule;
20+
21+
import java.util.List;
22+
23+
public class CreateNsxDistributedFirewallRulesCommand extends NsxCommand {
24+
25+
private Long vpcId;
26+
private long networkId;
27+
private List<NsxNetworkRule> rules;
28+
29+
public CreateNsxDistributedFirewallRulesCommand(long domainId, long accountId, long zoneId,
30+
Long vpcId, long networkId,
31+
List<NsxNetworkRule> rules) {
32+
super(domainId, accountId, zoneId);
33+
this.vpcId = vpcId;
34+
this.networkId = networkId;
35+
this.rules = rules;
36+
}
37+
38+
public Long getVpcId() {
39+
return vpcId;
40+
}
41+
42+
public long getNetworkId() {
43+
return networkId;
44+
}
45+
46+
public List<NsxNetworkRule> getRules() {
47+
return rules;
48+
}
49+
}

‎plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/agent/api/DeletedNsxDistributedFirewallRulesCommand.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
2+
// Licensed to the Apache Software Foundation (ASF) under one
3+
// or more contributor license agreements. See the NOTICE file
4+
// distributed with this work for additional information
5+
// regarding copyright ownership. The ASF licenses this file
6+
// to you under the Apache License, Version 2.0 (the
7+
// "License"); you may not use this file except in compliance
8+
// with the License. You may obtain a copy of the License at
9+
//
10+
// http://www.apache.org/licenses/LICENSE-2.0
11+
//
12+
// Unless required by applicable law or agreed to in writing,
13+
// software distributed under the License is distributed on an
14+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
// KIND, either express or implied. See the License for the
16+
// specific language governing permissions and limitations
17+
// under the License.
18+
package org.apache.cloudstack.agent.api;
19+
20+
import org.apache.cloudstack.resource.NsxNetworkRule;
21+
22+
import java.util.List;
23+
24+
public class DeletedNsxDistributedFirewallRulesCommand extends CreateNsxDistributedFirewallRulesCommand {
25+
public DeletedNsxDistributedFirewallRulesCommand(long domainId, long accountId, long zoneId, Long vpcId, long networkId, List<NsxNetworkRule> rules) {
26+
super(domainId, accountId, zoneId, vpcId, networkId, rules);
27+
}
28+
}

‎plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/resource/NsxNetworkRule.java‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,16 @@
1616
// under the License.
1717
package org.apache.cloudstack.resource;
1818

19+
import com.cloud.network.Network;
20+
1921
import java.util.List;
2022

2123
public class NsxNetworkRule {
24+
25+
public enum NsxRuleAction {
26+
ALLOW, DROP
27+
}
28+
2229
private long domainId;
2330
private long accountId;
2431
private long zoneId;
@@ -34,6 +41,36 @@ public class NsxNetworkRule {
3441
private String protocol;
3542
private String algorithm;
3643
private List<NsxLoadBalancerMember> memberList;
44+
private NsxRuleAction aclAction;
45+
private List<String> cidrList;
46+
private String trafficType;
47+
private Integer icmpCode;
48+
private Integer icmpType;
49+
private Network.Service service;
50+
51+
public Integer getIcmpCode() {
52+
return icmpCode;
53+
}
54+
55+
public void setIcmpCode(Integer icmpCode) {
56+
this.icmpCode = icmpCode;
57+
}
58+
59+
public Integer getIcmpType() {
60+
return icmpType;
61+
}
62+
63+
public void setIcmpType(Integer icmpType) {
64+
this.icmpType = icmpType;
65+
}
66+
67+
public Network.Service getService() {
68+
return service;
69+
}
70+
71+
public void setService(Network.Service service) {
72+
this.service = service;
73+
}
3774

3875
public long getDomainId() {
3976
return domainId;
@@ -155,6 +192,30 @@ public void setMemberList(List<NsxLoadBalancerMember> memberList) {
155192
this.memberList = memberList;
156193
}
157194

195+
public NsxRuleAction getAclAction() {
196+
return aclAction;
197+
}
198+
199+
public void setAclAction(NsxRuleAction aclAction) {
200+
this.aclAction = aclAction;
201+
}
202+
203+
public List<String> getCidrList() {
204+
return cidrList;
205+
}
206+
207+
public void setCidrList(List<String> cidrList) {
208+
this.cidrList = cidrList;
209+
}
210+
211+
public String getTrafficType() {
212+
return trafficType;
213+
}
214+
215+
public void setTrafficType(String trafficType) {
216+
this.trafficType = trafficType;
217+
}
218+
158219
public static final class Builder {
159220
private long domainId;
160221
private long accountId;
@@ -172,6 +233,12 @@ public static final class Builder {
172233
private String protocol;
173234
private String algorithm;
174235
private List<NsxLoadBalancerMember> memberList;
236+
private NsxRuleAction aclAction;
237+
private List<String> cidrList;
238+
private String trafficType;
239+
private Integer icmpType;
240+
private Integer icmpCode;
241+
private Network.Service service;
175242

176243
public Builder() {
177244
}
@@ -252,6 +319,36 @@ public Builder setMemberList(List<NsxLoadBalancerMember> memberList) {
252319
return this;
253320
}
254321

322+
public Builder setAclAction(NsxRuleAction aclAction) {
323+
this.aclAction = aclAction;
324+
return this;
325+
}
326+
327+
public Builder setCidrList(List<String> cidrList) {
328+
this.cidrList = cidrList;
329+
return this;
330+
}
331+
332+
public Builder setTrafficType(String trafficType) {
333+
this.trafficType = trafficType;
334+
return this;
335+
}
336+
337+
public Builder setIcmpType(Integer icmpType) {
338+
this.icmpType = icmpType;
339+
return this;
340+
}
341+
342+
public Builder setIcmpCode(Integer icmpCode) {
343+
this.icmpCode = icmpCode;
344+
return this;
345+
}
346+
347+
public Builder setService(Network.Service service) {
348+
this.service = service;
349+
return this;
350+
}
351+
255352
public NsxNetworkRule build() {
256353
NsxNetworkRule rule = new NsxNetworkRule();
257354
rule.setDomainId(this.domainId);
@@ -269,6 +366,12 @@ public NsxNetworkRule build() {
269366
rule.setRuleId(this.ruleId);
270367
rule.setAlgorithm(this.algorithm);
271368
rule.setMemberList(this.memberList);
369+
rule.setAclAction(this.aclAction);
370+
rule.setCidrList(this.cidrList);
371+
rule.setTrafficType(this.trafficType);
372+
rule.setIcmpType(this.icmpType);
373+
rule.setIcmpCode(this.icmpCode);
374+
rule.setService(this.service);
272375
return rule;
273376
}
274377
}

‎plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/resource/NsxResource.java‎

Lines changed: 35 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
import org.apache.cloudstack.NsxAnswer;
3737
import org.apache.cloudstack.StartupNsxCommand;
3838
import org.apache.cloudstack.agent.api.CreateNsxDhcpRelayConfigCommand;
39+
import org.apache.cloudstack.agent.api.CreateNsxDistributedFirewallRulesCommand;
3940
import org.apache.cloudstack.agent.api.CreateNsxLoadBalancerRuleCommand;
4041
import org.apache.cloudstack.agent.api.CreateNsxPortForwardRuleCommand;
4142
import org.apache.cloudstack.agent.api.CreateNsxSegmentCommand;
@@ -46,6 +47,7 @@
4647
import org.apache.cloudstack.agent.api.DeleteNsxSegmentCommand;
4748
import org.apache.cloudstack.agent.api.DeleteNsxNatRuleCommand;
4849
import org.apache.cloudstack.agent.api.DeleteNsxTier1GatewayCommand;
50+
import org.apache.cloudstack.agent.api.DeletedNsxDistributedFirewallRulesCommand;
4951
import org.apache.cloudstack.service.NsxApiClient;
5052
import org.apache.cloudstack.utils.NsxControllerUtils;
5153
import org.apache.commons.collections.CollectionUtils;
@@ -123,6 +125,10 @@ public Answer executeRequest(Command cmd) {
123125
return executeRequest((CreateNsxLoadBalancerRuleCommand) cmd);
124126
} else if (cmd instanceof DeleteNsxLoadBalancerRuleCommand) {
125127
return executeRequest((DeleteNsxLoadBalancerRuleCommand) cmd);
128+
} else if (cmd instanceof DeletedNsxDistributedFirewallRulesCommand) {
129+
return executeRequest((DeletedNsxDistributedFirewallRulesCommand) cmd);
130+
} else if (cmd instanceof CreateNsxDistributedFirewallRulesCommand) {
131+
return executeRequest((CreateNsxDistributedFirewallRulesCommand) cmd);
126132
} else {
127133
return Answer.createUnsupportedCommandAnswer(cmd);
128134
}
@@ -353,6 +359,7 @@ private Answer executeRequest(CreateNsxSegmentCommand cmd) {
353359
String tier1GatewayName = NsxControllerUtils.getTier1GatewayName(cmd.getDomainId(), cmd.getAccountId(),
354360
cmd.getZoneId(), networkResourceId, isResourceVpc);
355361
nsxApiClient.createSegment(segmentName, tier1GatewayName, gatewayAddress, enforcementPointPath, transportZones);
362+
nsxApiClient.createGroupForSegment(segmentName);
356363
} catch (Exception e) {
357364
LOGGER.error(String.format("Failed to create network: %s", cmd.getNetworkName()));
358365
return new NsxAnswer(cmd, new CloudRuntimeException(e.getMessage()));
@@ -394,8 +401,8 @@ private NsxAnswer executeRequest(CreateNsxPortForwardRuleCommand cmd) {
394401
cmd.getNetworkResourceId(), cmd.isResourceVpc());
395402
try {
396403
String privatePort = cmd.getPrivatePort();
397-
String service = privatePort.contains("-") ? nsxApiClient.createNsxInfraService(ruleName, privatePort, cmd.getProtocol()) :
398-
nsxApiClient.getNsxInfraServices(ruleName, privatePort, cmd.getProtocol());
404+
String service = privatePort.contains("-") ? nsxApiClient.getServicePath(ruleName, privatePort, cmd.getProtocol(), null, null) :
405+
nsxApiClient.getNsxInfraServices(ruleName, privatePort, cmd.getProtocol(), null, null);
399406

400407
nsxApiClient.createPortForwardingRule(ruleName, tier1GatewayName, cmd.getNetworkResourceName(), cmd.getPublicIp(),
401408
cmd.getVmIp(), cmd.getPublicPort(), service);
@@ -454,6 +461,32 @@ private NsxAnswer executeRequest(DeleteNsxLoadBalancerRuleCommand cmd) {
454461
return new NsxAnswer(cmd, true, null);
455462
}
456463

464+
private NsxAnswer executeRequest(CreateNsxDistributedFirewallRulesCommand cmd) {
465+
String segmentName = NsxControllerUtils.getNsxSegmentId(cmd.getDomainId(), cmd.getAccountId(),
466+
cmd.getZoneId(), cmd.getVpcId(), cmd.getNetworkId());
467+
List<NsxNetworkRule> rules = cmd.getRules();
468+
try {
469+
nsxApiClient.createSegmentDistributedFirewall(segmentName, rules);
470+
} catch (Exception e) {
471+
LOGGER.error(String.format("Failed to create NSX distributed firewall %s: %s", segmentName, e.getMessage()), e);
472+
return new NsxAnswer(cmd, new CloudRuntimeException(e.getMessage()));
473+
}
474+
return new NsxAnswer(cmd, true, null);
475+
}
476+
477+
private NsxAnswer executeRequest(DeletedNsxDistributedFirewallRulesCommand cmd) {
478+
String segmentName = NsxControllerUtils.getNsxSegmentId(cmd.getDomainId(), cmd.getAccountId(),
479+
cmd.getZoneId(), cmd.getVpcId(), cmd.getNetworkId());
480+
List<NsxNetworkRule> rules = cmd.getRules();
481+
try {
482+
nsxApiClient.deleteDistributedFirewallRules(segmentName, rules);
483+
} catch (Exception e) {
484+
LOGGER.error(String.format("Failed to create NSX distributed firewall %s: %s", segmentName, e.getMessage()), e);
485+
return new NsxAnswer(cmd, new CloudRuntimeException(e.getMessage()));
486+
}
487+
return new NsxAnswer(cmd, true, null);
488+
}
489+
457490
@Override
458491
public boolean start() {
459492
return true;

0 commit comments

Comments
 (0)