Skip to content

Commit 7efdaa6

Browse files
rafaelweingartnerrafaelweingartner
authored
[CLOUDSTACK-10314] Add Text-Field to each ACL Rule (#2475)
* [CLOUDSTACK-10314] Add Text-Field to each ACL Rule It is interesting to have a text field (e.g. CHAR-256) added to each ACL rule, which allows to enter a "reason" for each FW Rule created. This is valuable for customer documentation, as well as best practice for an evidence towards auditing the system * Formatting to make check style happy and code clean ups
1 parent 82bcc74 commit 7efdaa6

34 files changed

Lines changed: 1484 additions & 584 deletions

File tree

‎api/src/main/java/com/cloud/network/vpc/NetworkACLItem.java‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424

2525
public interface NetworkACLItem extends InternalIdentity, Identity, Displayable {
2626

27+
@Override
2728
String getUuid();
2829

2930
Action getAction();
@@ -51,7 +52,7 @@ enum Action {
5152
Integer getSourcePortStart();
5253

5354
/**
54-
* @return last port of the source prot range. If this is null, that means only one port is mapped.
55+
* @return last port of the source port range. If this is null, that means only one port is mapped.
5556
*/
5657
Integer getSourcePortEnd();
5758

@@ -70,12 +71,10 @@ enum Action {
7071

7172
List<String> getSourceCidrList();
7273

73-
/**
74-
* @return
75-
*/
7674
TrafficType getTrafficType();
7775

7876
@Override
7977
boolean isDisplay();
8078

79+
String getReason();
8180
}

‎api/src/main/java/com/cloud/network/vpc/NetworkACLService.java‎

Lines changed: 2 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -21,113 +21,69 @@
2121
import org.apache.cloudstack.api.command.user.network.CreateNetworkACLCmd;
2222
import org.apache.cloudstack.api.command.user.network.ListNetworkACLListsCmd;
2323
import org.apache.cloudstack.api.command.user.network.ListNetworkACLsCmd;
24+
import org.apache.cloudstack.api.command.user.network.UpdateNetworkACLItemCmd;
2425

2526
import com.cloud.exception.ResourceUnavailableException;
2627
import com.cloud.utils.Pair;
2728

2829
public interface NetworkACLService {
2930
/**
3031
* Creates Network ACL for the specified VPC
31-
* @param name
32-
* @param description
33-
* @param vpcId
34-
* @param forDisplay TODO
35-
* @return
3632
*/
3733
NetworkACL createNetworkACL(String name, String description, long vpcId, Boolean forDisplay);
3834

3935
/**
4036
* Get Network ACL with specified Id
41-
* @param id
42-
* @return
4337
*/
4438
NetworkACL getNetworkACL(long id);
4539

4640
/**
4741
* List NetworkACLs by Id/Name/Network or Vpc it belongs to
48-
* @param cmd
49-
* @return
5042
*/
5143
Pair<List<? extends NetworkACL>, Integer> listNetworkACLs(ListNetworkACLListsCmd cmd);
5244

5345
/**
5446
* Delete specified network ACL. Deletion fails if the list is not empty
55-
* @param id
56-
* @return
5747
*/
5848
boolean deleteNetworkACL(long id);
5949

6050
/**
6151
* Associates ACL with specified Network
62-
* @param aclId
63-
* @param networkId
64-
* @return
65-
* @throws ResourceUnavailableException
6652
*/
6753
boolean replaceNetworkACL(long aclId, long networkId) throws ResourceUnavailableException;
6854

6955
/**
7056
* Applied ACL to associated networks
71-
* @param aclId
72-
* @return
73-
* @throws ResourceUnavailableException
7457
*/
7558
boolean applyNetworkACL(long aclId) throws ResourceUnavailableException;
7659

7760
/**
7861
* Creates a Network ACL Item within an ACL and applies the ACL to associated networks
79-
* @param createNetworkACLCmd
80-
* @return
8162
*/
8263
NetworkACLItem createNetworkACLItem(CreateNetworkACLCmd aclItemCmd);
8364

8465
/**
8566
* Return ACL item with specified Id
86-
* @param ruleId
87-
* @return
8867
*/
8968
NetworkACLItem getNetworkACLItem(long ruleId);
9069

9170
/**
9271
* Lists Network ACL Items by Id, Network, ACLId, Traffic Type, protocol
93-
* @param listNetworkACLsCmd
94-
* @return
9572
*/
9673
Pair<List<? extends NetworkACLItem>, Integer> listNetworkACLItems(ListNetworkACLsCmd cmd);
9774

9875
/**
9976
* Revoke ACL Item with specified Id
100-
* @param ruleId
101-
* @return
10277
*/
10378
boolean revokeNetworkACLItem(long ruleId);
10479

10580
/**
10681
* Updates existing aclItem applies to associated networks
107-
* @param id
108-
* @param protocol
109-
* @param sourceCidrList
110-
* @param trafficType
111-
* @param action
112-
* @param number
113-
* @param sourcePortStart
114-
* @param sourcePortEnd
115-
* @param icmpCode
116-
* @param icmpType
117-
* @param newUUID TODO
118-
* @param forDisplay TODO
119-
* @return
120-
* @throws ResourceUnavailableException
12182
*/
122-
NetworkACLItem updateNetworkACLItem(Long id, String protocol, List<String> sourceCidrList, NetworkACLItem.TrafficType trafficType, String action, Integer number,
123-
Integer sourcePortStart, Integer sourcePortEnd, Integer icmpCode, Integer icmpType, String newUUID, Boolean forDisplay) throws ResourceUnavailableException;
83+
NetworkACLItem updateNetworkACLItem(UpdateNetworkACLItemCmd updateNetworkACLItemCmd) throws ResourceUnavailableException;
12484

12585
/**
12686
* Associates ACL with specified Network
127-
* @param aclId
128-
* @param privateGatewayId
129-
* @return
130-
* @throws ResourceUnavailableException
13187
*/
13288
boolean replaceNetworkACLonPrivateGw(long aclId, long privateGatewayId) throws ResourceUnavailableException;
13389

‎api/src/main/java/org/apache/cloudstack/api/ApiConstants.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -452,6 +452,7 @@ public class ApiConstants {
452452
public static final String SUPPORTED_SERVICES = "supportedservices";
453453
public static final String NSP_ID = "nspid";
454454
public static final String ACL_TYPE = "acltype";
455+
public static final String ACL_REASON = "reason";
455456
public static final String SUBDOMAIN_ACCESS = "subdomainaccess";
456457
public static final String LOAD_BALANCER_DEVICE_ID = "lbdeviceid";
457458
public static final String LOAD_BALANCER_DEVICE_NAME = "lbdevicename";

‎api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkACLCmd.java‎

Lines changed: 15 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,7 @@
4040
import com.cloud.user.Account;
4141
import com.cloud.utils.net.NetUtils;
4242

43-
@APICommand(name = "createNetworkACL",
44-
description = "Creates a ACL rule in the given network (the network has to belong to VPC)",
45-
responseObject = NetworkACLItemResponse.class,
46-
requestHasSensitiveInfo = false,
47-
responseHasSensitiveInfo = false)
43+
@APICommand(name = "createNetworkACL", description = "Creates a ACL rule in the given network (the network has to belong to VPC)", responseObject = NetworkACLItemResponse.class, requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
4844
public class CreateNetworkACLCmd extends BaseAsyncCreateCmd {
4945
public static final Logger s_logger = Logger.getLogger(CreateNetworkACLCmd.class.getName());
5046

@@ -54,10 +50,7 @@ public class CreateNetworkACLCmd extends BaseAsyncCreateCmd {
5450
// ////////////// API parameters /////////////////////
5551
// ///////////////////////////////////////////////////
5652

57-
@Parameter(name = ApiConstants.PROTOCOL,
58-
type = CommandType.STRING,
59-
required = true,
60-
description = "the protocol for the ACL rule. Valid values are TCP/UDP/ICMP/ALL or valid protocol number")
53+
@Parameter(name = ApiConstants.PROTOCOL, type = CommandType.STRING, required = true, description = "the protocol for the ACL rule. Valid values are TCP/UDP/ICMP/ALL or valid protocol number")
6154
private String protocol;
6255

6356
@Parameter(name = ApiConstants.START_PORT, type = CommandType.INTEGER, description = "the starting port of ACL")
@@ -75,20 +68,13 @@ public class CreateNetworkACLCmd extends BaseAsyncCreateCmd {
7568
@Parameter(name = ApiConstants.ICMP_CODE, type = CommandType.INTEGER, description = "error code for this ICMP message")
7669
private Integer icmpCode;
7770

78-
@Parameter(name = ApiConstants.NETWORK_ID,
79-
type = CommandType.UUID,
80-
entityType = NetworkResponse.class,
81-
description = "The network of the VM the ACL will be created for")
71+
@Parameter(name = ApiConstants.NETWORK_ID, type = CommandType.UUID, entityType = NetworkResponse.class, description = "The network of the VM the ACL will be created for")
8272
private Long networkId;
8373

84-
@Parameter(name = ApiConstants.ACL_ID,
85-
type = CommandType.UUID,
86-
entityType = NetworkACLResponse.class,
87-
description = "The network of the VM the ACL will be created for")
74+
@Parameter(name = ApiConstants.ACL_ID, type = CommandType.UUID, entityType = NetworkACLResponse.class, description = "The network of the VM the ACL will be created for")
8875
private Long aclId;
8976

90-
@Parameter(name = ApiConstants.TRAFFIC_TYPE, type = CommandType.STRING, description = "the traffic type for the ACL,"
91-
+ "can be ingress or egress, defaulted to ingress if not specified")
77+
@Parameter(name = ApiConstants.TRAFFIC_TYPE, type = CommandType.STRING, description = "the traffic type for the ACL," + "can be ingress or egress, defaulted to ingress if not specified")
9278
private String trafficType;
9379

9480
@Parameter(name = ApiConstants.NUMBER, type = CommandType.INTEGER, description = "The network of the VM the ACL will be created for")
@@ -97,16 +83,16 @@ public class CreateNetworkACLCmd extends BaseAsyncCreateCmd {
9783
@Parameter(name = ApiConstants.ACTION, type = CommandType.STRING, description = "scl entry action, allow or deny")
9884
private String action;
9985

100-
@Parameter(name = ApiConstants.FOR_DISPLAY, type = CommandType.BOOLEAN, description = "an optional field, whether to the display the rule to the end user or not", since = "4.4", authorized = {RoleType.Admin})
86+
@Parameter(name = ApiConstants.FOR_DISPLAY, type = CommandType.BOOLEAN, description = "an optional field, whether to the display the rule to the end user or not", since = "4.4", authorized = {
87+
RoleType.Admin})
10188
private Boolean display;
10289

90+
@Parameter(name = ApiConstants.ACL_REASON, type = CommandType.STRING, description = "A description indicating why the ACL rule is required.")
91+
private String reason;
92+
10393
// ///////////////////////////////////////////////////
10494
// ///////////////// Accessors ///////////////////////
10595
// ///////////////////////////////////////////////////
106-
@Deprecated
107-
public Boolean getDisplay() {
108-
return display;
109-
}
11096

11197
@Override
11298
public boolean isDisplay() {
@@ -227,6 +213,10 @@ public Long getACLId() {
227213
return aclId;
228214
}
229215

216+
public String getReason() {
217+
return reason;
218+
}
219+
230220
@Override
231221
public void create() {
232222
NetworkACLItem result = _networkACLService.createNetworkACLItem(this);
@@ -257,5 +247,4 @@ public void execute() throws ResourceUnavailableException {
257247
}
258248
}
259249
}
260-
261-
}
250+
}

‎api/src/main/java/org/apache/cloudstack/api/command/user/network/UpdateNetworkACLItemCmd.java‎

Lines changed: 16 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,8 @@
2121
import org.apache.cloudstack.acl.RoleType;
2222
import org.apache.cloudstack.api.APICommand;
2323
import org.apache.cloudstack.api.ApiConstants;
24-
import org.apache.cloudstack.api.ApiErrorCode;
2524
import org.apache.cloudstack.api.BaseAsyncCustomIdCmd;
2625
import org.apache.cloudstack.api.Parameter;
27-
import org.apache.cloudstack.api.ServerApiException;
2826
import org.apache.cloudstack.api.response.NetworkACLItemResponse;
2927
import org.apache.cloudstack.context.CallContext;
3028
import org.apache.log4j.Logger;
@@ -34,8 +32,7 @@
3432
import com.cloud.network.vpc.NetworkACLItem;
3533
import com.cloud.user.Account;
3634

37-
@APICommand(name = "updateNetworkACLItem", description = "Updates ACL item with specified ID", responseObject = NetworkACLItemResponse.class,
38-
requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
35+
@APICommand(name = "updateNetworkACLItem", description = "Updates ACL item with specified ID", responseObject = NetworkACLItemResponse.class, requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
3936
public class UpdateNetworkACLItemCmd extends BaseAsyncCustomIdCmd {
4037
public static final Logger s_logger = Logger.getLogger(UpdateNetworkACLItemCmd.class.getName());
4138

@@ -45,16 +42,10 @@ public class UpdateNetworkACLItemCmd extends BaseAsyncCustomIdCmd {
4542
// ////////////// API parameters /////////////////////
4643
// ///////////////////////////////////////////////////
4744

48-
@Parameter(name = ApiConstants.ID,
49-
type = CommandType.UUID,
50-
entityType = NetworkACLItemResponse.class,
51-
required = true,
52-
description = "the ID of the network ACL item")
45+
@Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = NetworkACLItemResponse.class, required = true, description = "the ID of the network ACL item")
5346
private Long id;
5447

55-
@Parameter(name = ApiConstants.PROTOCOL,
56-
type = CommandType.STRING,
57-
description = "the protocol for the ACL rule. Valid values are TCP/UDP/ICMP/ALL or valid protocol number")
48+
@Parameter(name = ApiConstants.PROTOCOL, type = CommandType.STRING, description = "the protocol for the ACL rule. Valid values are TCP/UDP/ICMP/ALL or valid protocol number")
5849
private String protocol;
5950

6051
@Parameter(name = ApiConstants.START_PORT, type = CommandType.INTEGER, description = "the starting port of ACL")
@@ -72,8 +63,7 @@ public class UpdateNetworkACLItemCmd extends BaseAsyncCustomIdCmd {
7263
@Parameter(name = ApiConstants.ICMP_CODE, type = CommandType.INTEGER, description = "error code for this ICMP message")
7364
private Integer icmpCode;
7465

75-
@Parameter(name = ApiConstants.TRAFFIC_TYPE, type = CommandType.STRING, description = "the traffic type for the ACL,"
76-
+ "can be Ingress or Egress, defaulted to Ingress if not specified")
66+
@Parameter(name = ApiConstants.TRAFFIC_TYPE, type = CommandType.STRING, description = "the traffic type for the ACL, can be Ingress or Egress, defaulted to Ingress if not specified")
7767
private String trafficType;
7868

7969
@Parameter(name = ApiConstants.NUMBER, type = CommandType.INTEGER, description = "The network of the vm the ACL will be created for")
@@ -82,9 +72,13 @@ public class UpdateNetworkACLItemCmd extends BaseAsyncCustomIdCmd {
8272
@Parameter(name = ApiConstants.ACTION, type = CommandType.STRING, description = "scl entry action, allow or deny")
8373
private String action;
8474

85-
@Parameter(name = ApiConstants.FOR_DISPLAY, type = CommandType.BOOLEAN, description = "an optional field, whether to the display the rule to the end user or not", since = "4.4", authorized = {RoleType.Admin})
75+
@Parameter(name = ApiConstants.FOR_DISPLAY, type = CommandType.BOOLEAN, description = "an optional field, whether to the display the rule to the end user or not", since = "4.4", authorized = {
76+
RoleType.Admin})
8677
private Boolean display;
8778

79+
@Parameter(name = ApiConstants.ACL_REASON, type = CommandType.STRING, description = "A description indicating why the ACL rule is required.")
80+
private String reason;
81+
8882
// ///////////////////////////////////////////////////
8983
// ///////////////// Accessors ///////////////////////
9084
// ///////////////////////////////////////////////////
@@ -105,8 +99,9 @@ public Long getId() {
10599
public String getProtocol() {
106100
if (protocol != null) {
107101
return protocol.trim();
108-
} else
102+
} else {
109103
return null;
104+
}
110105
}
111106

112107
public List<String> getSourceCidrList() {
@@ -173,15 +168,14 @@ public Integer getIcmpType() {
173168
return icmpType;
174169
}
175170

171+
public String getReason() {
172+
return reason;
173+
}
174+
176175
@Override
177176
public void execute() throws ResourceUnavailableException {
178177
CallContext.current().setEventDetails("Rule Id: " + getId());
179-
NetworkACLItem aclItem =
180-
_networkACLService.updateNetworkACLItem(getId(), getProtocol(), getSourceCidrList(), getTrafficType(), getAction(), getNumber(), getSourcePortStart(),
181-
getSourcePortEnd(), getIcmpCode(), getIcmpType(), this.getCustomId(), this.isDisplay());
182-
if (aclItem == null) {
183-
throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to update network ACL item");
184-
}
178+
NetworkACLItem aclItem = _networkACLService.updateNetworkACLItem(this);
185179
NetworkACLItemResponse aclResponse = _responseGenerator.createNetworkACLItemResponse(aclItem);
186180
setResponseObject(aclResponse);
187181
aclResponse.setResponseName(getCommandName());

‎api/src/main/java/org/apache/cloudstack/api/response/NetworkACLItemResponse.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,10 @@ public class NetworkACLItemResponse extends BaseResponse {
8585
@Param(description = "is rule for display to the regular user", since = "4.4", authorized = {RoleType.Admin})
8686
private Boolean forDisplay;
8787

88+
@SerializedName(ApiConstants.ACL_REASON)
89+
@Param(description = "an explanation on why this ACL rule is being applied", since = "4.12")
90+
private String reason;
91+
8892
public void setId(String id) {
8993
this.id = id;
9094
}
@@ -140,4 +144,12 @@ public void setAction(String action) {
140144
public void setForDisplay(Boolean forDisplay) {
141145
this.forDisplay = forDisplay;
142146
}
147+
148+
public void setReason(String reason) {
149+
this.reason = reason;
150+
}
151+
152+
public String getReason() {
153+
return reason;
154+
}
143155
}

0 commit comments

Comments
 (0)