Skip to content

Commit 72d0546

Browse files
vishesh92vishesh92
authored
Shared Network Firewall (Security groups) in Advanced zone without security groups (#9415)
1 parent 6a559f4 commit 72d0546

26 files changed

Lines changed: 402 additions & 99 deletions

File tree

‎api/src/main/java/com/cloud/network/NetworkModel.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -356,4 +356,8 @@ List<String[]> generateVmData(String userData, String userDataDetails, String se
356356

357357
void verifyIp6DnsPair(final String ip6Dns1, final String ip6Dns2);
358358

359+
boolean isSecurityGroupSupportedForZone(Long zoneId);
360+
361+
boolean checkSecurityGroupSupportForNetwork(DataCenter zone, List<Long> networkIds,
362+
List<Long> securityGroupsIds);
359363
}

‎api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddIpToVmNicCmd.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ public long getNicId() {
7979
private boolean isZoneSGEnabled() {
8080
Network ntwk = _entityMgr.findById(Network.class, getNetworkId());
8181
DataCenter dc = _entityMgr.findById(DataCenter.class, ntwk.getDataCenterId());
82-
return dc.isSecurityGroupEnabled();
82+
return dc.isSecurityGroupEnabled() || _ntwkModel.isSecurityGroupSupportedForZone(dc.getId());
8383
}
8484

8585
@Override

‎api/src/main/java/org/apache/cloudstack/api/command/user/vm/RemoveIpFromVmNicCmd.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ public NetworkType getNetworkType() {
127127
private boolean isZoneSGEnabled() {
128128
Network ntwk = _entityMgr.findById(Network.class, getNetworkId());
129129
DataCenter dc = _entityMgr.findById(DataCenter.class, ntwk.getDataCenterId());
130-
return dc.isSecurityGroupEnabled();
130+
return dc.isSecurityGroupEnabled() || _ntwkModel.isSecurityGroupSupportedForZone(dc.getId());
131131
}
132132

133133
@Override

‎api/src/main/java/org/apache/cloudstack/api/response/ZoneResponse.java‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -312,10 +312,6 @@ public String getNetworkType() {
312312
return networkType;
313313
}
314314

315-
public boolean isSecurityGroupsEnabled() {
316-
return securityGroupsEnabled;
317-
}
318-
319315
public String getAllocationState() {
320316
return allocationState;
321317
}
@@ -332,10 +328,6 @@ public List<CapacityResponse> getCapacities() {
332328
return capacities;
333329
}
334330

335-
public boolean isLocalStorageEnabled() {
336-
return localStorageEnabled;
337-
}
338-
339331
public Set<ResourceTagResponse> getTags() {
340332
return tags;
341333
}
@@ -344,6 +336,14 @@ public Map<String, String> getResourceDetails() {
344336
return resourceDetails;
345337
}
346338

339+
public boolean isSecurityGroupsEnabled() {
340+
return securityGroupsEnabled;
341+
}
342+
343+
public boolean isLocalStorageEnabled() {
344+
return localStorageEnabled;
345+
}
346+
347347
public Boolean getAllowUserSpecifyVRMtu() {
348348
return allowUserSpecifyVRMtu;
349349
}
@@ -356,6 +356,10 @@ public Integer getRouterPublicInterfaceMaxMtu() {
356356
return routerPublicInterfaceMaxMtu;
357357
}
358358

359+
public boolean isNsxEnabled() {
360+
return nsxEnabled;
361+
}
362+
359363
@Override
360364
public void setResourceIconResponse(ResourceIconResponse resourceIconResponse) {
361365
this.resourceIconResponse = resourceIconResponse;

‎plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/discoverer/XcpServerDiscoverer.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -346,7 +346,7 @@ protected boolean poolHasHotFix(Connection conn, String hostIp, String hotFixUui
346346
}
347347

348348
DataCenterVO zone = _dcDao.findById(dcId);
349-
boolean securityGroupEnabled = zone.isSecurityGroupEnabled();
349+
boolean securityGroupEnabled = zone.isSecurityGroupEnabled() || _networkMgr.isSecurityGroupSupportedForZone(zone.getId());
350350
params.put("securitygroupenabled", Boolean.toString(securityGroupEnabled));
351351

352352
params.put("router.aggregation.command.each.timeout", _configDao.getValue(Config.RouterAggregationCommandEachTimeout.toString()));
@@ -695,7 +695,7 @@ protected HashMap<String, Object> buildConfigParams(HostVO host) {
695695
HashMap<String, Object> params = super.buildConfigParams(host);
696696
DataCenterVO zone = _dcDao.findById(host.getDataCenterId());
697697
if (zone != null) {
698-
boolean securityGroupEnabled = zone.isSecurityGroupEnabled();
698+
boolean securityGroupEnabled = zone.isSecurityGroupEnabled() || _networkMgr.isSecurityGroupSupportedForZone(zone.getId());
699699
params.put("securitygroupenabled", Boolean.toString(securityGroupEnabled));
700700
}
701701
return params;

‎plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterResourceModifierActionWorker.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -401,7 +401,7 @@ protected UserVm createKubernetesNode(String joinIp) throws ManagementServerExce
401401
if (StringUtils.isNotBlank(kubernetesCluster.getKeyPair())) {
402402
keypairs.add(kubernetesCluster.getKeyPair());
403403
}
404-
if (zone.isSecurityGroupEnabled()) {
404+
if (kubernetesCluster.getSecurityGroupId() != null && networkModel.checkSecurityGroupSupportForNetwork(zone, networkIds, List.of(kubernetesCluster.getSecurityGroupId()))) {
405405
List<Long> securityGroupIds = new ArrayList<>();
406406
securityGroupIds.add(kubernetesCluster.getSecurityGroupId());
407407
nodeVm = userVmService.createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, clusterTemplate, networkIds, securityGroupIds, owner,

‎plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterStartWorker.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,9 @@ private UserVm createKubernetesControlNode(final Network network, String serverI
215215
if (StringUtils.isNotBlank(kubernetesCluster.getKeyPair())) {
216216
keypairs.add(kubernetesCluster.getKeyPair());
217217
}
218-
if (zone.isSecurityGroupEnabled()) {
218+
if (kubernetesCluster.getSecurityGroupId() != null &&
219+
networkModel.checkSecurityGroupSupportForNetwork(zone, networkIds,
220+
List.of(kubernetesCluster.getSecurityGroupId()))) {
219221
List<Long> securityGroupIds = new ArrayList<>();
220222
securityGroupIds.add(kubernetesCluster.getSecurityGroupId());
221223
controlVm = userVmService.createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, clusterTemplate, networkIds, securityGroupIds, owner,
@@ -289,7 +291,8 @@ private UserVm createKubernetesAdditionalControlNode(final String joinIp, final
289291
if (StringUtils.isNotBlank(kubernetesCluster.getKeyPair())) {
290292
keypairs.add(kubernetesCluster.getKeyPair());
291293
}
292-
if (zone.isSecurityGroupEnabled()) {
294+
if (kubernetesCluster.getSecurityGroupId() != null &&
295+
networkModel.checkSecurityGroupSupportForNetwork(zone, networkIds, List.of(kubernetesCluster.getSecurityGroupId()))) {
293296
List<Long> securityGroupIds = new ArrayList<>();
294297
securityGroupIds.add(kubernetesCluster.getSecurityGroupId());
295298
additionalControlVm = userVmService.createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, clusterTemplate, networkIds, securityGroupIds, owner,

‎server/src/main/java/com/cloud/network/NetworkModelImpl.java‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,8 @@
145145
import com.cloud.vm.dao.NicSecondaryIpDao;
146146
import com.cloud.vm.dao.VMInstanceDao;
147147

148+
import static com.cloud.network.Network.Service.SecurityGroup;
149+
148150
public class NetworkModelImpl extends ManagerBase implements NetworkModel, Configurable {
149151
public static final String UNABLE_TO_USE_NETWORK = "Unable to use network with id= %s, permission denied";
150152
@Inject
@@ -1262,7 +1264,7 @@ public boolean isSecurityGroupSupportedInNetwork(Network network) {
12621264
physicalNetworkId = findPhysicalNetworkId(network.getDataCenterId(), null, null);
12631265
}
12641266

1265-
return isServiceEnabledInNetwork(physicalNetworkId, network.getId(), Service.SecurityGroup);
1267+
return isServiceEnabledInNetwork(physicalNetworkId, network.getId(), SecurityGroup);
12661268
}
12671269

12681270
@Override
@@ -2755,4 +2757,38 @@ public void verifyIp6DnsPair(String ip6Dns1, String ip6Dns2) {
27552757
throw new InvalidParameterValueException("Invalid IPv6 for IPv6 DNS2");
27562758
}
27572759
}
2760+
2761+
@Override
2762+
public boolean isSecurityGroupSupportedForZone(Long zoneId) {
2763+
List<? extends PhysicalNetwork> networks = getPhysicalNtwksSupportingTrafficType(zoneId, TrafficType.Guest);
2764+
for (PhysicalNetwork network : networks ) {
2765+
if (_pNSPDao.isServiceProviderEnabled(network.getId(), Provider.SecurityGroupProvider.getName(), Service.SecurityGroup.getName())) {
2766+
return true;
2767+
}
2768+
}
2769+
return false;
2770+
}
2771+
2772+
@Override
2773+
public boolean checkSecurityGroupSupportForNetwork(DataCenter zone, List<Long> networkIds,
2774+
List<Long> securityGroupsIds) {
2775+
if (zone.isSecurityGroupEnabled()) {
2776+
return true;
2777+
}
2778+
if (CollectionUtils.isNotEmpty(networkIds)) {
2779+
for (Long networkId : networkIds) {
2780+
Network network = _networksDao.findById(networkId);
2781+
if (network == null) {
2782+
throw new InvalidParameterValueException("Unable to find network by id " + networkId);
2783+
}
2784+
if (network.getGuestType() == Network.GuestType.Shared && isSecurityGroupSupportedInNetwork(network)) {
2785+
return true;
2786+
}
2787+
}
2788+
} else if (CollectionUtils.isNotEmpty(securityGroupsIds)) {
2789+
Network networkWithSecurityGroup = getNetworkWithSGWithFreeIPs(zone.getId());
2790+
return networkWithSecurityGroup != null;
2791+
}
2792+
return false;
2793+
}
27582794
}

‎server/src/main/java/com/cloud/network/as/AutoScaleManagerImpl.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import java.security.SecureRandom;
2020
import java.util.ArrayList;
2121
import java.util.Arrays;
22+
import java.util.Collections;
2223
import java.util.Date;
2324
import java.util.HashMap;
2425
import java.util.List;
@@ -37,6 +38,7 @@
3738

3839
import javax.inject.Inject;
3940

41+
import com.cloud.network.NetworkModel;
4042
import org.apache.cloudstack.acl.ControlledEntity;
4143
import org.apache.cloudstack.affinity.AffinityGroupVO;
4244
import org.apache.cloudstack.affinity.dao.AffinityGroupDao;
@@ -251,6 +253,8 @@ public class AutoScaleManagerImpl extends ManagerBase implements AutoScaleManage
251253
@Inject
252254
NetworkOrchestrationService networkMgr;
253255
@Inject
256+
NetworkModel networkModel;
257+
@Inject
254258
private UserVmManager userVmMgr;
255259
@Inject
256260
private UserDataManager userDataMgr;
@@ -1808,7 +1812,8 @@ protected long createNewVM(AutoScaleVmGroupVO asGroup) {
18081812
null, null, true, null, affinityGroupIdList, customParameters, null, null, null,
18091813
null, true, overrideDiskOfferingId);
18101814
} else {
1811-
if (zone.isSecurityGroupEnabled()) {
1815+
if (networkModel.checkSecurityGroupSupportForNetwork(zone, networkIds,
1816+
Collections.emptyList())) {
18121817
vm = userVmService.createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, template, networkIds, null,
18131818
owner, vmHostName,vmHostName, diskOfferingId, dataDiskSize, null,
18141819
hypervisorType, HTTPMethod.GET, userData, userDataId, userDataDetails, sshKeyPairs,

‎server/src/main/java/com/cloud/vm/UserVmManagerImpl.java‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
import java.net.URLDecoder;
2828
import java.util.ArrayList;
2929
import java.util.Arrays;
30+
import java.util.Collections;
3031
import java.util.Date;
3132
import java.util.HashMap;
3233
import java.util.HashSet;
@@ -3094,7 +3095,7 @@ public UserVm updateVirtualMachine(long id, String displayName, String group, Bo
30943095
if (zone.getNetworkType() == NetworkType.Basic) {
30953096
// Get default guest network in Basic zone
30963097
defaultNetwork = _networkModel.getExclusiveGuestNetwork(zone.getId());
3097-
} else if (zone.isSecurityGroupEnabled()) {
3098+
} else if (_networkModel.checkSecurityGroupSupportForNetwork(zone, Collections.emptyList(), securityGroupIdList)) {
30983099
NicVO defaultNic = _nicDao.findDefaultNicForVM(vm.getId());
30993100
if (defaultNic != null) {
31003101
defaultNetwork = _networkDao.findById(defaultNic.getNetworkId());
@@ -6153,7 +6154,8 @@ public UserVm createVirtualMachine(DeployVMCmd cmd) throws InsufficientCapacityE
61536154
dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, overrideDiskOfferingId);
61546155
}
61556156
} else {
6156-
if (zone.isSecurityGroupEnabled()) {
6157+
if (_networkModel.checkSecurityGroupSupportForNetwork(zone, networkIds,
6158+
cmd.getSecurityGroupIdList())) {
61576159
vm = createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, template, networkIds, getSecurityGroupIdList(cmd, zone, template, owner), owner, name,
61586160
displayName, diskOfferingId, size, group, cmd.getHypervisor(), cmd.getHttpMethod(), userData, userDataId, userDataDetails, sshKeyPairNames, cmd.getIpToNetworkMap(), addrs, displayVm, keyboard,
61596161
cmd.getAffinityGroupIdList(), cmd.getDetails(), cmd.getCustomId(), cmd.getDhcpOptionsMap(),
@@ -7573,7 +7575,7 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
75737575
Set<NetworkVO> applicableNetworks = new LinkedHashSet<>();
75747576
Map<Long, String> requestedIPv4ForNics = new HashMap<>();
75757577
Map<Long, String> requestedIPv6ForNics = new HashMap<>();
7576-
if (zone.isSecurityGroupEnabled()) { // advanced zone with security groups
7578+
if (_networkModel.checkSecurityGroupSupportForNetwork(zone, networkIdList, securityGroupIdList)) { // advanced zone with security groups
75777579
// cleanup the old security groups
75787580
_securityGroupMgr.removeInstanceFromGroups(cmd.getVmId());
75797581
// if networkIdList is null and the first network of vm is shared network, then keep it if possible
@@ -8794,7 +8796,7 @@ private LinkedHashMap<Integer, Long> getVmOvfNetworkMapping(DataCenter zone, Acc
87948796

87958797
private Network getNetworkForOvfNetworkMapping(DataCenter zone, Account owner) throws InsufficientCapacityException, ResourceAllocationException {
87968798
Network network = null;
8797-
if (zone.isSecurityGroupEnabled()) {
8799+
if (zone.isSecurityGroupEnabled() || _networkModel.isSecurityGroupSupportedForZone(zone.getId())) {
87988800
network = _networkModel.getNetworkWithSGWithFreeIPs(zone.getId());
87998801
if (network == null) {
88008802
throw new InvalidParameterValueException("No network with security enabled is found in zone ID: " + zone.getUuid());

0 commit comments

Comments
 (0)