Skip to content

Commit 77dca4c

Browse files
vishesh92dhslove
vishesh92
authored and
dhslove
committed
Shared Network Firewall (Security groups) in Advanced zone without security groups (apache#9415)
1 parent ef3200d commit 77dca4c

26 files changed

Lines changed: 402 additions & 99 deletions

File tree

‎api/src/main/java/com/cloud/network/NetworkModel.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -360,4 +360,8 @@ List<String[]> generateVmData(String userData, String userDataDetails, String se
360360

361361
void verifyIp6DnsPair(final String ip6Dns1, final String ip6Dns2);
362362

363+
boolean isSecurityGroupSupportedForZone(Long zoneId);
364+
365+
boolean checkSecurityGroupSupportForNetwork(DataCenter zone, List<Long> networkIds,
366+
List<Long> securityGroupsIds);
363367
}

‎api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddIpToVmNicCmd.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ public long getNicId() {
7979
private boolean isZoneSGEnabled() {
8080
Network ntwk = _entityMgr.findById(Network.class, getNetworkId());
8181
DataCenter dc = _entityMgr.findById(DataCenter.class, ntwk.getDataCenterId());
82-
return dc.isSecurityGroupEnabled();
82+
return dc.isSecurityGroupEnabled() || _ntwkModel.isSecurityGroupSupportedForZone(dc.getId());
8383
}
8484

8585
@Override

‎api/src/main/java/org/apache/cloudstack/api/command/user/vm/RemoveIpFromVmNicCmd.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ public NetworkType getNetworkType() {
127127
private boolean isZoneSGEnabled() {
128128
Network ntwk = _entityMgr.findById(Network.class, getNetworkId());
129129
DataCenter dc = _entityMgr.findById(DataCenter.class, ntwk.getDataCenterId());
130-
return dc.isSecurityGroupEnabled();
130+
return dc.isSecurityGroupEnabled() || _ntwkModel.isSecurityGroupSupportedForZone(dc.getId());
131131
}
132132

133133
@Override

‎api/src/main/java/org/apache/cloudstack/api/response/ZoneResponse.java‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -312,10 +312,6 @@ public String getNetworkType() {
312312
return networkType;
313313
}
314314

315-
public boolean isSecurityGroupsEnabled() {
316-
return securityGroupsEnabled;
317-
}
318-
319315
public String getAllocationState() {
320316
return allocationState;
321317
}
@@ -332,10 +328,6 @@ public List<CapacityResponse> getCapacities() {
332328
return capacities;
333329
}
334330

335-
public boolean isLocalStorageEnabled() {
336-
return localStorageEnabled;
337-
}
338-
339331
public Set<ResourceTagResponse> getTags() {
340332
return tags;
341333
}
@@ -344,6 +336,14 @@ public Map<String, String> getResourceDetails() {
344336
return resourceDetails;
345337
}
346338

339+
public boolean isSecurityGroupsEnabled() {
340+
return securityGroupsEnabled;
341+
}
342+
343+
public boolean isLocalStorageEnabled() {
344+
return localStorageEnabled;
345+
}
346+
347347
public Boolean getAllowUserSpecifyVRMtu() {
348348
return allowUserSpecifyVRMtu;
349349
}
@@ -356,6 +356,10 @@ public Integer getRouterPublicInterfaceMaxMtu() {
356356
return routerPublicInterfaceMaxMtu;
357357
}
358358

359+
public boolean isNsxEnabled() {
360+
return nsxEnabled;
361+
}
362+
359363
@Override
360364
public void setResourceIconResponse(ResourceIconResponse resourceIconResponse) {
361365
this.resourceIconResponse = resourceIconResponse;

‎plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/discoverer/XcpServerDiscoverer.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -346,7 +346,7 @@ protected boolean poolHasHotFix(Connection conn, String hostIp, String hotFixUui
346346
}
347347

348348
DataCenterVO zone = _dcDao.findById(dcId);
349-
boolean securityGroupEnabled = zone.isSecurityGroupEnabled();
349+
boolean securityGroupEnabled = zone.isSecurityGroupEnabled() || _networkMgr.isSecurityGroupSupportedForZone(zone.getId());
350350
params.put("securitygroupenabled", Boolean.toString(securityGroupEnabled));
351351

352352
params.put("router.aggregation.command.each.timeout", _configDao.getValue(Config.RouterAggregationCommandEachTimeout.toString()));
@@ -695,7 +695,7 @@ protected HashMap<String, Object> buildConfigParams(HostVO host) {
695695
HashMap<String, Object> params = super.buildConfigParams(host);
696696
DataCenterVO zone = _dcDao.findById(host.getDataCenterId());
697697
if (zone != null) {
698-
boolean securityGroupEnabled = zone.isSecurityGroupEnabled();
698+
boolean securityGroupEnabled = zone.isSecurityGroupEnabled() || _networkMgr.isSecurityGroupSupportedForZone(zone.getId());
699699
params.put("securitygroupenabled", Boolean.toString(securityGroupEnabled));
700700
}
701701
return params;

‎plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterResourceModifierActionWorker.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -401,7 +401,7 @@ protected UserVm createKubernetesNode(String joinIp) throws ManagementServerExce
401401
if (StringUtils.isNotBlank(kubernetesCluster.getKeyPair())) {
402402
keypairs.add(kubernetesCluster.getKeyPair());
403403
}
404-
if (zone.isSecurityGroupEnabled()) {
404+
if (kubernetesCluster.getSecurityGroupId() != null && networkModel.checkSecurityGroupSupportForNetwork(zone, networkIds, List.of(kubernetesCluster.getSecurityGroupId()))) {
405405
List<Long> securityGroupIds = new ArrayList<>();
406406
securityGroupIds.add(kubernetesCluster.getSecurityGroupId());
407407
nodeVm = userVmService.createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, clusterTemplate, networkIds, securityGroupIds, owner,

‎plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterStartWorker.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,9 @@ private UserVm createKubernetesControlNode(final Network network, String serverI
215215
if (StringUtils.isNotBlank(kubernetesCluster.getKeyPair())) {
216216
keypairs.add(kubernetesCluster.getKeyPair());
217217
}
218-
if (zone.isSecurityGroupEnabled()) {
218+
if (kubernetesCluster.getSecurityGroupId() != null &&
219+
networkModel.checkSecurityGroupSupportForNetwork(zone, networkIds,
220+
List.of(kubernetesCluster.getSecurityGroupId()))) {
219221
List<Long> securityGroupIds = new ArrayList<>();
220222
securityGroupIds.add(kubernetesCluster.getSecurityGroupId());
221223
controlVm = userVmService.createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, clusterTemplate, networkIds, securityGroupIds, owner,
@@ -289,7 +291,8 @@ private UserVm createKubernetesAdditionalControlNode(final String joinIp, final
289291
if (StringUtils.isNotBlank(kubernetesCluster.getKeyPair())) {
290292
keypairs.add(kubernetesCluster.getKeyPair());
291293
}
292-
if (zone.isSecurityGroupEnabled()) {
294+
if (kubernetesCluster.getSecurityGroupId() != null &&
295+
networkModel.checkSecurityGroupSupportForNetwork(zone, networkIds, List.of(kubernetesCluster.getSecurityGroupId()))) {
293296
List<Long> securityGroupIds = new ArrayList<>();
294297
securityGroupIds.add(kubernetesCluster.getSecurityGroupId());
295298
additionalControlVm = userVmService.createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, clusterTemplate, networkIds, securityGroupIds, owner,

‎server/src/main/java/com/cloud/network/NetworkModelImpl.java‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,8 @@
146146
import com.cloud.vm.dao.NicSecondaryIpDao;
147147
import com.cloud.vm.dao.VMInstanceDao;
148148

149+
import static com.cloud.network.Network.Service.SecurityGroup;
150+
149151
public class NetworkModelImpl extends ManagerBase implements NetworkModel, Configurable {
150152
public static final String UNABLE_TO_USE_NETWORK = "Unable to use network with id= %s, permission denied";
151153
@Inject
@@ -1272,7 +1274,7 @@ public boolean isSecurityGroupSupportedInNetwork(Network network) {
12721274
physicalNetworkId = findPhysicalNetworkId(network.getDataCenterId(), null, null);
12731275
}
12741276

1275-
return isServiceEnabledInNetwork(physicalNetworkId, network.getId(), Service.SecurityGroup);
1277+
return isServiceEnabledInNetwork(physicalNetworkId, network.getId(), SecurityGroup);
12761278
}
12771279

12781280
@Override
@@ -2765,4 +2767,38 @@ public void verifyIp6DnsPair(String ip6Dns1, String ip6Dns2) {
27652767
throw new InvalidParameterValueException("Invalid IPv6 for IPv6 DNS2");
27662768
}
27672769
}
2770+
2771+
@Override
2772+
public boolean isSecurityGroupSupportedForZone(Long zoneId) {
2773+
List<? extends PhysicalNetwork> networks = getPhysicalNtwksSupportingTrafficType(zoneId, TrafficType.Guest);
2774+
for (PhysicalNetwork network : networks ) {
2775+
if (_pNSPDao.isServiceProviderEnabled(network.getId(), Provider.SecurityGroupProvider.getName(), Service.SecurityGroup.getName())) {
2776+
return true;
2777+
}
2778+
}
2779+
return false;
2780+
}
2781+
2782+
@Override
2783+
public boolean checkSecurityGroupSupportForNetwork(DataCenter zone, List<Long> networkIds,
2784+
List<Long> securityGroupsIds) {
2785+
if (zone.isSecurityGroupEnabled()) {
2786+
return true;
2787+
}
2788+
if (CollectionUtils.isNotEmpty(networkIds)) {
2789+
for (Long networkId : networkIds) {
2790+
Network network = _networksDao.findById(networkId);
2791+
if (network == null) {
2792+
throw new InvalidParameterValueException("Unable to find network by id " + networkId);
2793+
}
2794+
if (network.getGuestType() == Network.GuestType.Shared && isSecurityGroupSupportedInNetwork(network)) {
2795+
return true;
2796+
}
2797+
}
2798+
} else if (CollectionUtils.isNotEmpty(securityGroupsIds)) {
2799+
Network networkWithSecurityGroup = getNetworkWithSGWithFreeIPs(zone.getId());
2800+
return networkWithSecurityGroup != null;
2801+
}
2802+
return false;
2803+
}
27682804
}

‎server/src/main/java/com/cloud/network/as/AutoScaleManagerImpl.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import java.security.SecureRandom;
2020
import java.util.ArrayList;
2121
import java.util.Arrays;
22+
import java.util.Collections;
2223
import java.util.Date;
2324
import java.util.HashMap;
2425
import java.util.List;
@@ -37,6 +38,7 @@
3738

3839
import javax.inject.Inject;
3940

41+
import com.cloud.network.NetworkModel;
4042
import org.apache.cloudstack.acl.ControlledEntity;
4143
import org.apache.cloudstack.affinity.AffinityGroupVO;
4244
import org.apache.cloudstack.affinity.dao.AffinityGroupDao;
@@ -251,6 +253,8 @@ public class AutoScaleManagerImpl extends ManagerBase implements AutoScaleManage
251253
@Inject
252254
NetworkOrchestrationService networkMgr;
253255
@Inject
256+
NetworkModel networkModel;
257+
@Inject
254258
private UserVmManager userVmMgr;
255259
@Inject
256260
private UserDataManager userDataMgr;
@@ -1808,7 +1812,8 @@ protected long createNewVM(AutoScaleVmGroupVO asGroup) {
18081812
null, null, true, null, affinityGroupIdList, customParameters, null, null, null,
18091813
null, true, overrideDiskOfferingId);
18101814
} else {
1811-
if (zone.isSecurityGroupEnabled()) {
1815+
if (networkModel.checkSecurityGroupSupportForNetwork(zone, networkIds,
1816+
Collections.emptyList())) {
18121817
vm = userVmService.createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, template, networkIds, null,
18131818
owner, vmHostName,vmHostName, diskOfferingId, dataDiskSize, null,
18141819
hypervisorType, HTTPMethod.GET, userData, userDataId, userDataDetails, sshKeyPairs,

‎server/src/main/java/com/cloud/vm/UserVmManagerImpl.java‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import java.net.URLDecoder;
2828
import java.util.ArrayList;
2929
import java.util.Arrays;
30+
import java.util.Collections;
3031
import java.util.Date;
3132
import java.util.HashMap;
3233
import java.util.HashSet;
@@ -3184,7 +3185,7 @@ public UserVm updateVirtualMachine(long id, String displayName, String group, Bo
31843185
if (zone.getNetworkType() == NetworkType.Basic) {
31853186
// Get default guest network in Basic zone
31863187
defaultNetwork = _networkModel.getExclusiveGuestNetwork(zone.getId());
3187-
} else if (zone.isSecurityGroupEnabled()) {
3188+
} else if (_networkModel.checkSecurityGroupSupportForNetwork(zone, Collections.emptyList(), securityGroupIdList)) {
31883189
NicVO defaultNic = _nicDao.findDefaultNicForVM(vm.getId());
31893190
if (defaultNic != null) {
31903191
defaultNetwork = _networkDao.findById(defaultNic.getNetworkId());
@@ -6262,7 +6263,8 @@ public UserVm createVirtualMachine(DeployVMCmd cmd) throws InsufficientCapacityE
62626263
dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, overrideDiskOfferingId);
62636264
}
62646265
} else {
6265-
if (zone.isSecurityGroupEnabled()) {
6266+
if (_networkModel.checkSecurityGroupSupportForNetwork(zone, networkIds,
6267+
cmd.getSecurityGroupIdList())) {
62666268
vm = createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, template, networkIds, getSecurityGroupIdList(cmd, zone, template, owner), owner, name,
62676269
displayName, diskOfferingId, size, group, cmd.getHypervisor(), cmd.getHttpMethod(), userData, userDataId, userDataDetails, sshKeyPairNames, cmd.getIpToNetworkMap(), addrs, displayVm, keyboard,
62686270
cmd.getAffinityGroupIdList(), cmd.getDetails(), cmd.getCustomId(), cmd.getDhcpOptionsMap(),
@@ -7682,7 +7684,7 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
76827684
Set<NetworkVO> applicableNetworks = new LinkedHashSet<>();
76837685
Map<Long, String> requestedIPv4ForNics = new HashMap<>();
76847686
Map<Long, String> requestedIPv6ForNics = new HashMap<>();
7685-
if (zone.isSecurityGroupEnabled()) { // advanced zone with security groups
7687+
if (_networkModel.checkSecurityGroupSupportForNetwork(zone, networkIdList, securityGroupIdList)) { // advanced zone with security groups
76867688
// cleanup the old security groups
76877689
_securityGroupMgr.removeInstanceFromGroups(cmd.getVmId());
76887690
// if networkIdList is null and the first network of vm is shared network, then keep it if possible
@@ -8912,7 +8914,7 @@ private LinkedHashMap<Integer, Long> getVmOvfNetworkMapping(DataCenter zone, Acc
89128914

89138915
private Network getNetworkForOvfNetworkMapping(DataCenter zone, Account owner) throws InsufficientCapacityException, ResourceAllocationException {
89148916
Network network = null;
8915-
if (zone.isSecurityGroupEnabled()) {
8917+
if (zone.isSecurityGroupEnabled() || _networkModel.isSecurityGroupSupportedForZone(zone.getId())) {
89168918
network = _networkModel.getNetworkWithSGWithFreeIPs(zone.getId());
89178919
if (network == null) {
89188920
throw new InvalidParameterValueException("No network with security enabled is found in zone ID: " + zone.getUuid());

0 commit comments

Comments
 (0)