Skip to content

Commit 5b4759b

Browse files
ruansteveruansteve
committed
port bug 9978 from 2.3.0 to master
1 parent 2da5118 commit 5b4759b

10 files changed

Lines changed: 263 additions & 0 deletions

File tree

‎conf/globalConfig/vyos.xml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<globalConfig xmlns="http://zstack.org/schema/zstack">
3+
<config>
4+
<category>vyos</category>
5+
<name>private.l3.firewall.default.action</name>
6+
<description>default action for private l3 network</description>
7+
<type>java.lang.String</type>
8+
<defaultValue>reject</defaultValue>
9+
</config>
10+
</globalConfig>

‎conf/springConfigXml/vyos.xml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
<list>
1818
<value>org.zstack.network.service.virtualrouter.lifecycle.VirtualRouterAssembleDecoratorFlow</value>
1919
<value>org.zstack.network.service.virtualrouter.vyos.VyosConnectFlow</value>
20+
<value>org.zstack.network.service.virtualrouter.vyos.VyosChangePrivateL3FirewallDefaultActionFlow</value>
2021
<value>org.zstack.network.service.virtualrouter.vip.VirtualRouterCreateVipForPublicIpFlow</value>
2122
<value>org.zstack.network.service.virtualrouter.dns.VirtualRouterSyncDnsOnStartFlow</value>
2223
<value>org.zstack.network.service.virtualrouter.dhcp.VirtualRouterSyncDHCPOnStartFlow</value>
@@ -33,6 +34,7 @@
3334
<list>
3435
<value>org.zstack.network.service.virtualrouter.lifecycle.VirtualRouterAssembleDecoratorFlow</value>
3536
<value>org.zstack.network.service.virtualrouter.vyos.VyosConnectFlow</value>
37+
<value>org.zstack.network.service.virtualrouter.vyos.VyosChangePrivateL3FirewallDefaultActionFlow</value>
3638
<value>org.zstack.network.service.virtualrouter.dns.VirtualRouterSyncDnsOnStartFlow</value>
3739
<value>org.zstack.network.service.virtualrouter.dhcp.VirtualRouterSyncDHCPOnStartFlow</value>
3840
<value>org.zstack.network.service.virtualrouter.nat.VirtualRouterSyncSNATOnStartFlow</value>
@@ -47,6 +49,7 @@
4749
<list>
4850
<value>org.zstack.network.service.virtualrouter.lifecycle.VirtualRouterAssembleDecoratorFlow</value>
4951
<value>org.zstack.network.service.virtualrouter.vyos.VyosConnectFlow</value>
52+
<value>org.zstack.network.service.virtualrouter.vyos.VyosChangePrivateL3FirewallDefaultActionFlow</value>
5053
<value>org.zstack.network.service.virtualrouter.dns.VirtualRouterSyncDnsOnStartFlow</value>
5154
<value>org.zstack.network.service.virtualrouter.dhcp.VirtualRouterSyncDHCPOnStartFlow</value>
5255
<value>org.zstack.network.service.virtualrouter.nat.VirtualRouterSyncSNATOnStartFlow</value>
@@ -72,6 +75,7 @@
7275
<list>
7376
<value>org.zstack.network.service.virtualrouter.vyos.VyosDeployAgentFlow</value>
7477
<value>org.zstack.network.service.virtualrouter.vyos.VyosConnectFlow</value>
78+
<value>org.zstack.network.service.virtualrouter.vyos.VyosChangePrivateL3FirewallDefaultActionFlow</value>
7579
<value>org.zstack.network.service.virtualrouter.dns.VirtualRouterSyncDnsOnStartFlow</value>
7680
<value>org.zstack.network.service.virtualrouter.dhcp.VirtualRouterSyncDHCPOnStartFlow</value>
7781
<value>org.zstack.network.service.virtualrouter.nat.VirtualRouterSyncSNATOnStartFlow</value>
@@ -159,4 +163,11 @@
159163
<zstack:extension interface="org.zstack.network.service.vip.VipFactory" />
160164
</zstack:plugin>
161165
</bean>
166+
167+
<bean id="VyosChangePrivateL3FirewallDefaultActionExtensionPoint" class="org.zstack.network.service.virtualrouter.vyos.VyosChangePrivateL3FirewallDefaultActionExtensionPoint">
168+
<zstack:plugin>
169+
<zstack:extension interface="org.zstack.header.network.service.VirtualRouterAfterAttachNicExtensionPoint" />
170+
</zstack:plugin>
171+
</bean>
172+
162173
</beans>

‎plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterCommands.java‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ public static class NicInfo {
6363
private String physicalInterface;
6464
private String l2type;
6565
private Integer vni;
66+
private String firewallDefaultAction;
6667

6768
public String getIp() {
6869
return ip;
@@ -126,6 +127,14 @@ public String getPhysicalInterface() {
126127
public void setPhysicalInterface(String physicalInterface) {
127128
this.physicalInterface = physicalInterface;
128129
}
130+
131+
public String getFirewallDefaultAction() {
132+
return firewallDefaultAction;
133+
}
134+
135+
public void setFirewallDefaultAction(String firewallDefaultAction) {
136+
this.firewallDefaultAction = firewallDefaultAction;
137+
}
129138
}
130139

131140
public static class ConfigureNicCmd extends AgentCommand {
@@ -143,6 +152,21 @@ public void setNics(List<NicInfo> nics) {
143152
public static class ConfigureNicRsp extends AgentResponse {
144153
}
145154

155+
public static class ConfigureNicFirewallDefaultActionCmd extends AgentCommand {
156+
private List<NicInfo> nics;
157+
158+
public List<NicInfo> getNics() {
159+
return nics;
160+
}
161+
162+
public void setNics(List<NicInfo> nics) {
163+
this.nics = nics;
164+
}
165+
}
166+
167+
public static class ConfigureNicFirewallDefaultActionRsp extends AgentResponse {
168+
}
169+
146170
public static class RemoveNicCmd extends AgentCommand {
147171
private List<NicInfo> nics;
148172

‎plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterConstant.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ public interface VirtualRouterConstant {
2424
public static final String VR_ECHO_PATH = "/echo";
2525
public static final String VR_CONFIGURE_NIC_PATH = "/configurenic";
2626
public static final String VR_REMOVE_NIC_PATH = "/removenic";
27+
public static final String VR_CONFIGURE_NIC_FIREWALL_DEFAULT_ACTION_PATH = "/configurenicdefaultaction";
2728
public static final String VR_ADD_DHCP_PATH = "/adddhcp";
2829
public static final String VR_REMOVE_DHCP_PATH = "/removedhcp";
2930
public static final String VR_SET_SNAT_PATH = "/setsnat";

‎plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosChangePrivateL3FirewallDefaultActionExtensionPoint.java‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
package org.zstack.network.service.virtualrouter.vyos;
2+
3+
import org.springframework.beans.factory.annotation.Autowired;
4+
import org.zstack.core.cloudbus.CloudBus;
5+
import org.zstack.core.cloudbus.CloudBusCallBack;
6+
import org.zstack.core.timeout.ApiTimeoutManager;
7+
import org.zstack.header.core.Completion;
8+
import org.zstack.header.core.NoErrorCompletion;
9+
import org.zstack.header.errorcode.ErrorCode;
10+
import org.zstack.header.message.MessageReply;
11+
import org.zstack.header.network.service.VirtualRouterAfterAttachNicExtensionPoint;
12+
import org.zstack.header.vm.VmInstanceConstant;
13+
import org.zstack.header.vm.VmNicInventory;
14+
import org.zstack.network.service.virtualrouter.*;
15+
import org.zstack.utils.Utils;
16+
import org.zstack.utils.logging.CLogger;
17+
18+
import java.util.Collections;
19+
import static org.zstack.core.Platform.operr;
20+
21+
public class VyosChangePrivateL3FirewallDefaultActionExtensionPoint implements VirtualRouterAfterAttachNicExtensionPoint {
22+
@Autowired
23+
protected CloudBus bus;
24+
@Autowired
25+
protected ApiTimeoutManager apiTimeoutManager;
26+
private final static CLogger logger = Utils.getLogger(VyosChangePrivateL3FirewallDefaultActionExtensionPoint.class);
27+
28+
@Override
29+
public void afterAttachNic(VmNicInventory nic, Completion completion) {
30+
if (!VirtualRouterNicMetaData.GUEST_NIC_MASK_STRING_LIST.contains(nic.getMetaData())) {
31+
completion.success();
32+
return;
33+
}
34+
35+
String action = VyosGlobalConfig.PRIVATE_L3_FIREWALL_DEFAULT_ACTION.value(String.class);
36+
VirtualRouterCommands.NicInfo info = new VirtualRouterCommands.NicInfo();
37+
info.setIp(nic.getIp());
38+
info.setDefaultRoute(false);
39+
info.setGateway(nic.getGateway());
40+
info.setMac(nic.getMac());
41+
info.setNetmask(nic.getNetmask());
42+
info.setFirewallDefaultAction(action);
43+
44+
VirtualRouterCommands.ConfigureNicFirewallDefaultActionCmd cmd = new VirtualRouterCommands.ConfigureNicFirewallDefaultActionCmd();
45+
cmd.setNics(Collections.singletonList(info));
46+
47+
VirtualRouterAsyncHttpCallMsg cmsg = new VirtualRouterAsyncHttpCallMsg();
48+
cmsg.setCommand(cmd);
49+
cmsg.setCommandTimeout(apiTimeoutManager.getTimeout(cmd.getClass(), "30m"));
50+
cmsg.setPath(VirtualRouterConstant.VR_CONFIGURE_NIC_FIREWALL_DEFAULT_ACTION_PATH);
51+
cmsg.setVmInstanceUuid(nic.getVmInstanceUuid());
52+
bus.makeTargetServiceIdByResourceUuid(cmsg, VmInstanceConstant.SERVICE_ID, nic.getVmInstanceUuid());
53+
bus.send(cmsg, new CloudBusCallBack(completion) {
54+
@Override
55+
public void run(MessageReply reply) {
56+
if (!reply.isSuccess()) {
57+
completion.fail(reply.getError());
58+
return;
59+
}
60+
61+
VirtualRouterAsyncHttpCallReply re = reply.castReply();
62+
VirtualRouterCommands.ConfigureNicFirewallDefaultActionRsp rsp = re.toResponse(VirtualRouterCommands.ConfigureNicFirewallDefaultActionRsp.class);
63+
if (rsp.isSuccess()) {
64+
logger.debug(String.format("successfully change nic[ip:%s, mac:%s] firewall default action of virtual router vm[uuid:%s]",
65+
nic.getIp(), nic.getMac(), nic.getVmInstanceUuid()));
66+
completion.success();
67+
} else {
68+
ErrorCode err = operr("failed to change nic[ip:%s, mac:%s] firewall default action of virtual router vm[uuid:%s], because %s",
69+
nic.getIp(), nic.getMac(), nic.getVmInstanceUuid(), rsp.getError());
70+
completion.fail(err);
71+
}
72+
}
73+
});
74+
}
75+
76+
@Override
77+
public void afterAttachNicRollback(VmNicInventory nic, NoErrorCompletion completion) {
78+
/* rollback nic will delete all nic configure */
79+
completion.done();
80+
}
81+
}

‎plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosChangePrivateL3FirewallDefaultActionFlow.java‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
package org.zstack.network.service.virtualrouter.vyos;
2+
3+
import org.springframework.beans.factory.annotation.Autowire;
4+
import org.springframework.beans.factory.annotation.Autowired;
5+
import org.springframework.beans.factory.annotation.Configurable;
6+
import org.zstack.core.cloudbus.CloudBus;
7+
import org.zstack.core.cloudbus.CloudBusCallBack;
8+
import org.zstack.core.timeout.ApiTimeoutManager;
9+
import org.zstack.header.core.workflow.FlowTrigger;
10+
import org.zstack.header.core.workflow.NoRollbackFlow;
11+
import org.zstack.header.errorcode.ErrorCode;
12+
import org.zstack.header.message.MessageReply;
13+
import org.zstack.header.vm.VmInstanceConstant;
14+
import org.zstack.header.vm.VmNicInventory;
15+
import org.zstack.network.service.virtualrouter.*;
16+
import org.zstack.utils.CollectionUtils;
17+
import org.zstack.utils.Utils;
18+
import org.zstack.utils.function.Function;
19+
import org.zstack.utils.logging.CLogger;
20+
21+
import java.util.*;
22+
23+
import static org.zstack.core.Platform.operr;
24+
25+
/**
26+
* Created by shixin.ruan on 18-03-10.
27+
*/
28+
@Configurable(preConstruction = true, autowire = Autowire.BY_TYPE)
29+
public class VyosChangePrivateL3FirewallDefaultActionFlow extends NoRollbackFlow {
30+
@Autowired
31+
protected CloudBus bus;
32+
@Autowired
33+
protected ApiTimeoutManager apiTimeoutManager;
34+
35+
private final static CLogger logger = Utils.getLogger(VyosChangePrivateL3FirewallDefaultActionFlow.class);
36+
37+
@Override
38+
public void run(FlowTrigger trigger, Map data) {
39+
String action = VyosGlobalConfig.PRIVATE_L3_FIREWALL_DEFAULT_ACTION.value(String.class);
40+
41+
final VirtualRouterVmInventory servedVm = (VirtualRouterVmInventory) data.get(VirtualRouterConstant.Param.VR.toString());
42+
List<VirtualRouterCommands.NicInfo> infos = CollectionUtils.transformToList(servedVm.getGuestNics(), new Function<VirtualRouterCommands.NicInfo, VmNicInventory>() {
43+
@Override
44+
public VirtualRouterCommands.NicInfo call(VmNicInventory arg) {
45+
VirtualRouterCommands.NicInfo info = new VirtualRouterCommands.NicInfo();
46+
info.setIp(arg.getIp());
47+
info.setDefaultRoute(false);
48+
info.setGateway(arg.getGateway());
49+
info.setMac(arg.getMac());
50+
info.setNetmask(arg.getNetmask());
51+
info.setFirewallDefaultAction(action);
52+
53+
return info;
54+
}
55+
});
56+
57+
if (infos == null || infos.isEmpty()) {
58+
trigger.next();
59+
return;
60+
}
61+
62+
VirtualRouterCommands.ConfigureNicFirewallDefaultActionCmd cmd = new VirtualRouterCommands.ConfigureNicFirewallDefaultActionCmd();
63+
cmd.setNics(infos);
64+
65+
VirtualRouterAsyncHttpCallMsg cmsg = new VirtualRouterAsyncHttpCallMsg();
66+
cmsg.setCommand(cmd);
67+
cmsg.setCommandTimeout(apiTimeoutManager.getTimeout(cmd.getClass(), "30m"));
68+
cmsg.setPath(VirtualRouterConstant.VR_CONFIGURE_NIC_FIREWALL_DEFAULT_ACTION_PATH);
69+
cmsg.setVmInstanceUuid(servedVm.getUuid());
70+
bus.makeTargetServiceIdByResourceUuid(cmsg, VmInstanceConstant.SERVICE_ID, servedVm.getUuid());
71+
bus.send(cmsg, new CloudBusCallBack(trigger) {
72+
/* failure in this flow will not block normal process */
73+
@Override
74+
public void run(MessageReply reply) {
75+
if (!reply.isSuccess()) {
76+
logger.debug(String.format("failed to change nic firewall default action of virtual router vm[uuid:%s ip:%s], because %s",
77+
servedVm.getUuid(), servedVm.getManagementNic().getIp(), reply.getError()));
78+
trigger.next();
79+
return;
80+
}
81+
82+
VirtualRouterAsyncHttpCallReply re = reply.castReply();
83+
VirtualRouterCommands.ConfigureNicFirewallDefaultActionRsp rsp = re.toResponse(VirtualRouterCommands.ConfigureNicFirewallDefaultActionRsp.class);
84+
if (rsp.isSuccess()) {
85+
logger.debug(String.format("successfully change nic firewall default action of virtual router vm[uuid:%s, ip:%s]",
86+
servedVm.getUuid(), servedVm.getManagementNic().getIp()));
87+
trigger.next();
88+
} else {
89+
logger.debug(String.format("failed to change nic firewall default action of virtual router vm[uuid:%s ip:%s], because %s",
90+
servedVm.getUuid(), servedVm.getManagementNic().getIp(), rsp.getError()));
91+
trigger.next();
92+
}
93+
}
94+
});
95+
}
96+
}

‎plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosConstants.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ public interface VyosConstants {
1212
String ANSIBLE_PLAYBOOK_NAME = "zvr.py";
1313
String ANSIBLE_MODULE_PATH = "ansible/zvr";
1414

15+
String PRIVATE_L3_FIREWALL_DEFAULT_ACTION = "reject";
16+
1517
NetworkServiceProviderType PROVIDER_TYPE = new NetworkServiceProviderType(VyosConstants.VYOS_ROUTER_PROVIDER_TYPE);
1618

1719
enum BootstrapInfoKey {

‎plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosGlobalConfig.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package org.zstack.network.service.virtualrouter.vyos;
2+
3+
import org.zstack.core.config.GlobalConfig;
4+
import org.zstack.core.config.GlobalConfigDefinition;
5+
import org.zstack.core.config.GlobalConfigValidation;
6+
7+
/**
8+
* Created by shixin.ruan on 18/03/09.
9+
*/
10+
@GlobalConfigDefinition
11+
public class VyosGlobalConfig {
12+
public static final String CATEGORY = "vyos";
13+
14+
@GlobalConfigValidation(validValues = {"accept", "reject"})
15+
public static GlobalConfig PRIVATE_L3_FIREWALL_DEFAULT_ACTION = new GlobalConfig(CATEGORY, "private.l3.firewall.default.action");
16+
}

‎simulator/simulatorImpl/src/main/java/org/zstack/simulator/virtualrouter/VirtualRouterSimulator.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -431,6 +431,24 @@ String configureNic(HttpServletRequest req) {
431431
return null;
432432
}
433433

434+
@AsyncThread
435+
private void doConfigureNicFirewallDefaultAction(HttpEntity<String> entity) {
436+
ConfigureNicFirewallDefaultActionCmd cmd = JSONObjectUtil.toObject(entity.getBody(), ConfigureNicFirewallDefaultActionCmd.class);
437+
ConfigureNicFirewallDefaultActionRsp rsp = new ConfigureNicFirewallDefaultActionRsp();
438+
439+
logger.debug(String.format("successfully configured nics: %s firewall default action", JSONObjectUtil.toJsonString(cmd.getNics())));
440+
replyer.reply(entity, rsp);
441+
return;
442+
}
443+
444+
@RequestMapping(value = VirtualRouterConstant.VR_CONFIGURE_NIC_FIREWALL_DEFAULT_ACTION_PATH, method = RequestMethod.POST)
445+
private @ResponseBody
446+
String configureNicFirewallDefaultAction(HttpServletRequest req) {
447+
HttpEntity<String> entity = restf.httpServletRequestToHttpEntity(req);
448+
doConfigureNicFirewallDefaultAction(entity);
449+
return null;
450+
}
451+
434452
@RequestMapping(value = VirtualRouterConstant.VR_REMOVE_DHCP_PATH, method = RequestMethod.POST)
435453
private @ResponseBody
436454
String removeDchpEntry(HttpServletRequest req) {

‎testlib/src/main/java/org/zstack/testlib/VirtualRouterOfferingSpec.groovy‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,10 @@ class VirtualRouterOfferingSpec extends InstanceOfferingSpec {
195195
return new VirtualRouterCommands.ConfigureNicRsp()
196196
}
197197

198+
simulator(VirtualRouterConstant.VR_CONFIGURE_NIC_FIREWALL_DEFAULT_ACTION_PATH) {
199+
return new VirtualRouterCommands.ConfigureNicFirewallDefaultActionRsp()
200+
}
201+
198202
simulator(VirtualRouterConstant.VR_REMOVE_NIC_PATH) {
199203
return new VirtualRouterCommands.RemoveNicRsp()
200204
}

0 commit comments

Comments
 (0)