server: Fix displaying public IP address of shared networks (#4675)

Public IP addresses dedicated to one domain should not be accessed
by other domains. Also, root admin should be able to display all
public ip addresses in system.

Currently following issues exist

1. Public IP address assigned to one domain can be accessed by
other sibling domains

If use.system.public.ip is false then child domains should not
see public ip of ROOT domain

Before fix
```
(test1) mgt01 > list publicipaddresses listall=true fordisplay=true allocatedonly=false forvirtualnetwork=true filter=ipaddress,
{
  "count": 59,
  "publicipaddress": [
```

After fix

```
(test) mgt01 > list publicipaddresses listall=true fordisplay=true allocatedonly=false forvirtualnetwork=true filter=ipaddress,
{
  "count": 10,
```

.travis.yml

@@ -164,6 +164,7 @@ env:
 
     - TESTS="component/test_project_usage
              component/test_protocol_number_security_group
+             component/test_public_ip
              component/test_resource_limits"
 
     - TESTS="component/test_regions_accounts

engine/components-api/src/main/java/com/cloud/network/IpAddressManager.java

@@ -208,5 +208,22 @@ public interface IpAddressManager {
     void releasePodIp(Long id) throws CloudRuntimeException;
 
     boolean isUsageHidden(IPAddressVO address);
+
+    List<IPAddressVO> listAvailablePublicIps(final long dcId,
+                                             final Long podId,
+                                             final List<Long> vlanDbIds,
+                                             final Account owner,
+                                             final VlanType vlanUse,
+                                             final Long guestNetworkId,
+                                             final boolean sourceNat,
+                                             final boolean assign,
+                                             final boolean allocate,
+                                             final String requestedIp,
+                                             final boolean isSystem,
+                                             final Long vpcId,
+                                             final Boolean displayIp,
+                                             final boolean forSystemVms,
+                                             final boolean lockOneRow)
+            throws InsufficientAddressCapacityException;
 }
 

server/src/main/java/com/cloud/api/ApiDBUtils.java

@@ -27,6 +27,8 @@ import java.util.Set;
 import javax.annotation.PostConstruct;
 import javax.inject.Inject;
 
+import com.cloud.vm.NicVO;
+import com.cloud.vm.dao.NicDao;
 import org.apache.cloudstack.acl.Role;
 import org.apache.cloudstack.acl.RoleService;
 import org.apache.cloudstack.affinity.AffinityGroup;
@@ -458,6 +460,7 @@ public class ApiDBUtils {
     static BackupDao s_backupDao;
     static BackupScheduleDao s_backupScheduleDao;
     static BackupOfferingDao s_backupOfferingDao;
+    static NicDao s_nicDao;
 
     @Inject
     private ManagementServer ms;
@@ -702,6 +705,8 @@ public class ApiDBUtils {
     private BackupOfferingDao backupOfferingDao;
     @Inject
     private BackupScheduleDao backupScheduleDao;
+    @Inject
+    private NicDao nicDao;
 
     @PostConstruct
     void init() {
@@ -811,6 +816,7 @@ public class ApiDBUtils {
         s_hostDetailsDao = hostDetailsDao;
         s_clusterDetailsDao = clusterDetailsDao;
         s_vmSnapshotDao = vmSnapshotDao;
+        s_nicDao = nicDao;
         s_nicSecondaryIpDao = nicSecondaryIpDao;
         s_vpcProvSvc = vpcProvSvc;
         s_affinityGroupDao = affinityGroupDao;
@@ -2079,4 +2085,12 @@ public class ApiDBUtils {
     public static BackupOfferingResponse newBackupOfferingResponse(BackupOffering policy) {
         return s_backupOfferingDao.newBackupOfferingResponse(policy);
     }
+
+    public static NicVO findByIp4AddressAndNetworkId(String ip4Address, long networkId) {
+        return s_nicDao.findByIp4AddressAndNetworkId(ip4Address, networkId);
+    }
+
+    public static NicSecondaryIpVO findSecondaryIpByIp4AddressAndNetworkId(String ip4Address, long networkId) {
+        return s_nicSecondaryIpDao.findByIp4AddressAndNetworkId(ip4Address, networkId);
+    }
 }

server/src/main/java/com/cloud/api/ApiResponseHelper.java

@@ -920,6 +920,9 @@ public class ApiResponseHelper implements ResponseGenerator {
             }
         }
 
+        // show vm info for shared networks
+        showVmInfoForSharedNetworks(forVirtualNetworks, ipAddr, ipResponse);
+
         // show this info to full view only
         if (view == ResponseView.Full) {
             VlanVO vl = ApiDBUtils.findVlanById(ipAddr.getVlanId());
@@ -954,6 +957,42 @@ public class ApiResponseHelper implements ResponseGenerator {
         return ipResponse;
     }
 
+    private void showVmInfoForSharedNetworks(boolean forVirtualNetworks, IpAddress ipAddr, IPAddressResponse ipResponse) {
+        if (!forVirtualNetworks) {
+            NicVO nic = ApiDBUtils.findByIp4AddressAndNetworkId(ipAddr.getAddress().toString(), ipAddr.getNetworkId());
+
+            if (nic == null) {  // find in nic_secondary_ips, user vm only
+                NicSecondaryIpVO secondaryIp =
+                        ApiDBUtils.findSecondaryIpByIp4AddressAndNetworkId(ipAddr.getAddress().toString(), ipAddr.getNetworkId());
+                if (secondaryIp != null) {
+                    UserVm vm = ApiDBUtils.findUserVmById(secondaryIp.getVmId());
+                    if (vm != null) {
+                        ipResponse.setVirtualMachineId(vm.getUuid());
+                        ipResponse.setVirtualMachineName(vm.getHostName());
+                        if (vm.getDisplayName() != null) {
+                            ipResponse.setVirtualMachineDisplayName(vm.getDisplayName());
+                        } else {
+                            ipResponse.setVirtualMachineDisplayName(vm.getHostName());
+                        }
+                    }
+                }
+            } else if (nic.getVmType() == VirtualMachine.Type.User) {
+                UserVm vm = ApiDBUtils.findUserVmById(nic.getInstanceId());
+                if (vm != null) {
+                    ipResponse.setVirtualMachineId(vm.getUuid());
+                    ipResponse.setVirtualMachineName(vm.getHostName());
+                    if (vm.getDisplayName() != null) {
+                        ipResponse.setVirtualMachineDisplayName(vm.getDisplayName());
+                    } else {
+                        ipResponse.setVirtualMachineDisplayName(vm.getHostName());
+                    }
+                }
+            } else if (nic.getVmType() == VirtualMachine.Type.DomainRouter) {
+                ipResponse.setIsSystem(true);
+            }
+        }
+    }
+
     @Override
     public LoadBalancerResponse createLoadBalancerResponse(LoadBalancer loadBalancer) {
         LoadBalancerResponse lbResponse = new LoadBalancerResponse();

server/src/main/java/com/cloud/network/IpAddressManagerImpl.java

@@ -322,31 +322,30 @@ public class IpAddressManagerImpl extends ManagerBase implements IpAddressManage
                 }
             }
 
-            for (final IPAddressVO possibleAddr : addressVOS) {
+            for (IPAddressVO possibleAddr : addressVOS) {
                 if (possibleAddr.getState() != State.Free) {
                     continue;
                 }
-                final IPAddressVO addressVO = possibleAddr;
+                possibleAddr.setSourceNat(sourceNat);
-                addressVO.setSourceNat(sourceNat);
+                possibleAddr.setAllocatedTime(new Date());
-                addressVO.setAllocatedTime(new Date());
+                possibleAddr.setAllocatedInDomainId(owner.getDomainId());
-                addressVO.setAllocatedInDomainId(owner.getDomainId());
+                possibleAddr.setAllocatedToAccountId(owner.getId());
-                addressVO.setAllocatedToAccountId(owner.getId());
+                possibleAddr.setSystem(isSystem);
-                addressVO.setSystem(isSystem);
 
                 if (displayIp != null) {
-                    addressVO.setDisplay(displayIp);
+                    possibleAddr.setDisplay(displayIp);
                 }
 
                 if (vlanUse != VlanType.DirectAttached) {
-                    addressVO.setAssociatedWithNetworkId(guestNetworkId);
+                    possibleAddr.setAssociatedWithNetworkId(guestNetworkId);
-                    addressVO.setVpcId(vpcId);
+                    possibleAddr.setVpcId(vpcId);
                 }
                 if (_ipAddressDao.lockRow(possibleAddr.getId(), true) != null) {
-                    final IPAddressVO userIp = _ipAddressDao.findById(addressVO.getId());
+                    final IPAddressVO userIp = _ipAddressDao.findById(possibleAddr.getId());
                     if (userIp.getState() == State.Free) {
-                        addressVO.setState(State.Allocating);
+                        possibleAddr.setState(State.Allocating);
-                        if (_ipAddressDao.update(addressVO.getId(), addressVO)) {
+                        if (_ipAddressDao.update(possibleAddr.getId(), possibleAddr)) {
-                            finalAddress = addressVO;
+                            finalAddress = possibleAddr;
                             break;
                         }
                     }
@@ -783,9 +782,22 @@ public class IpAddressManagerImpl extends ManagerBase implements IpAddressManage
     public PublicIp fetchNewPublicIp(final long dcId, final Long podId, final List<Long> vlanDbIds, final Account owner, final VlanType vlanUse, final Long guestNetworkId,
             final boolean sourceNat, final boolean assign, final boolean allocate, final String requestedIp, final boolean isSystem, final Long vpcId, final Boolean displayIp, final boolean forSystemVms)
                     throws InsufficientAddressCapacityException {
-        IPAddressVO addr = Transaction.execute(new TransactionCallbackWithException<IPAddressVO, InsufficientAddressCapacityException>() {
+        List<IPAddressVO> addrs = listAvailablePublicIps(dcId, podId, vlanDbIds, owner, vlanUse, guestNetworkId, sourceNat, assign, allocate, requestedIp, isSystem, vpcId, displayIp, forSystemVms, true);
+        IPAddressVO addr = addrs.get(0);
+        if (vlanUse == VlanType.VirtualNetwork) {
+            _firewallMgr.addSystemFirewallRules(addr, owner);
+        }
+
+        return PublicIp.createFromAddrAndVlan(addr, _vlanDao.findById(addr.getVlanId()));
+    }
+
+    @Override
+    public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podId, final List<Long> vlanDbIds, final Account owner, final VlanType vlanUse, final Long guestNetworkId,
+                                                    final boolean sourceNat, final boolean assign, final boolean allocate, final String requestedIp, final boolean isSystem,
+                                                    final Long vpcId, final Boolean displayIp, final boolean forSystemVms, final boolean lockOneRow) throws InsufficientAddressCapacityException {
+        return Transaction.execute(new TransactionCallbackWithException<List<IPAddressVO>, InsufficientAddressCapacityException>() {
             @Override
-            public IPAddressVO doInTransaction(TransactionStatus status) throws InsufficientAddressCapacityException {
+            public List<IPAddressVO> doInTransaction(TransactionStatus status) throws InsufficientAddressCapacityException {
                 StringBuilder errorMessage = new StringBuilder("Unable to get ip address in ");
                 boolean fetchFromDedicatedRange = false;
                 List<Long> dedicatedVlanDbIds = new ArrayList<Long>();
@@ -823,23 +835,26 @@ public class IpAddressManagerImpl extends ManagerBase implements IpAddressManage
                     if (vlanDbIds == null || vlanDbIds.contains(nonDedicatedVlan.getId()))
                         nonDedicatedVlanDbIds.add(nonDedicatedVlan.getId());
                 }
-                if (dedicatedVlanDbIds != null && !dedicatedVlanDbIds.isEmpty()) {
+
-                    fetchFromDedicatedRange = true;
+                if (vlanUse == VlanType.VirtualNetwork) {
-                    sc.setParameters("vlanId", dedicatedVlanDbIds.toArray());
+                    if (dedicatedVlanDbIds != null && !dedicatedVlanDbIds.isEmpty()) {
-                    errorMessage.append(", vlanId id=" + Arrays.toString(dedicatedVlanDbIds.toArray()));
+                        fetchFromDedicatedRange = true;
-                } else if (nonDedicatedVlanDbIds != null && !nonDedicatedVlanDbIds.isEmpty()) {
+                        sc.setParameters("vlanId", dedicatedVlanDbIds.toArray());
-                    sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
+                        errorMessage.append(", vlanId id=" + Arrays.toString(dedicatedVlanDbIds.toArray()));
-                    errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
+                    } else if (nonDedicatedVlanDbIds != null && !nonDedicatedVlanDbIds.isEmpty()) {
-                } else {
+                        sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
-                    if (podId != null) {
+                        errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
-                        InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
+                    } else {
-                        ex.addProxyObject(ApiDBUtils.findPodById(podId).getUuid());
+                        if (podId != null) {
+                            InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
+                            ex.addProxyObject(ApiDBUtils.findPodById(podId).getUuid());
+                            throw ex;
+                        }
+                        s_logger.warn(errorMessage.toString());
+                        InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", DataCenter.class, dcId);
+                        ex.addProxyObject(ApiDBUtils.findZoneById(dcId).getUuid());
                         throw ex;
                     }
-                    s_logger.warn(errorMessage.toString());
-                    InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", DataCenter.class, dcId);
-                    ex.addProxyObject(ApiDBUtils.findZoneById(dcId).getUuid());
-                    throw ex;
                 }
 
                 sc.setParameters("dc", dcId);
@@ -864,21 +879,31 @@ public class IpAddressManagerImpl extends ManagerBase implements IpAddressManage
 
                 filter.addOrderBy(IPAddressVO.class,"vlanId", true);
 
-                List<IPAddressVO> addrs = _ipAddressDao.search(sc, filter, false);
+                List<IPAddressVO> addrs;
+
+                if (lockOneRow) {
+                    addrs = _ipAddressDao.lockRows(sc, filter, true);
+                } else {
+                    addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
+                }
 
                 // If all the dedicated IPs of the owner are in use fetch an IP from the system pool
-                if (addrs.size() == 0 && fetchFromDedicatedRange) {
+                if ((!lockOneRow || (lockOneRow && addrs.size() == 0)) && fetchFromDedicatedRange && vlanUse == VlanType.VirtualNetwork) {
                     // Verify if account is allowed to acquire IPs from the system
                     boolean useSystemIps = UseSystemPublicIps.valueIn(owner.getId());
                     if (useSystemIps && nonDedicatedVlanDbIds != null && !nonDedicatedVlanDbIds.isEmpty()) {
                         fetchFromDedicatedRange = false;
                         sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
                         errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
-                        addrs = _ipAddressDao.search(sc, filter, false);
+                        if (lockOneRow) {
+                            addrs = _ipAddressDao.lockRows(sc, filter, true);
+                        } else {
+                            addrs.addAll(_ipAddressDao.search(sc, null));
+                        }
                     }
                 }
 
-                if (addrs.size() == 0) {
+                if (lockOneRow && addrs.size() == 0) {
                     if (podId != null) {
                         InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
                         // for now, we hardcode the table names, but we should ideally do a lookup for the tablename from the VO object.
@@ -891,23 +916,16 @@ public class IpAddressManagerImpl extends ManagerBase implements IpAddressManage
                     throw ex;
                 }
 
-                assert(addrs.size() == 1) : "Return size is incorrect: " + addrs.size();
+                if (lockOneRow) {
-                IPAddressVO finalAddr = null;
+                    assert (addrs.size() == 1) : "Return size is incorrect: " + addrs.size();
-                if (assign) {
-                    finalAddr = assignAndAllocateIpAddressEntry(owner, vlanUse, guestNetworkId, sourceNat, allocate,
-                            isSystem,vpcId, displayIp, fetchFromDedicatedRange, addrs);
-                } else {
-                    finalAddr = addrs.get(0);
                 }
-                return finalAddr;
+                if (assign) {
+                    assignAndAllocateIpAddressEntry(owner, vlanUse, guestNetworkId, sourceNat, allocate,
+                            isSystem,vpcId, displayIp, fetchFromDedicatedRange, addrs);
+                }
+                return addrs;
             }
         });
-
-        if (vlanUse == VlanType.VirtualNetwork) {
-            _firewallMgr.addSystemFirewallRules(addr, owner);
-        }
-
-        return PublicIp.createFromAddrAndVlan(addr, _vlanDao.findById(addr.getVlanId()));
     }
 
     @DB

server/src/main/java/com/cloud/server/ManagementServerImpl.java

@@ -610,6 +610,7 @@ import com.cloud.event.EventTypes;
 import com.cloud.event.EventVO;
 import com.cloud.event.dao.EventDao;
 import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientAddressCapacityException;
 import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.exception.ManagementServerException;
 import com.cloud.exception.OperationTimedoutException;
@@ -634,12 +635,20 @@ import com.cloud.hypervisor.dao.HypervisorCapabilitiesDao;
 import com.cloud.hypervisor.kvm.dpdk.DpdkHelper;
 import com.cloud.info.ConsoleProxyInfo;
 import com.cloud.network.IpAddress;
+import com.cloud.network.IpAddressManager;
+import com.cloud.network.Network;
+import com.cloud.network.NetworkModel;
 import com.cloud.network.dao.IPAddressDao;
 import com.cloud.network.dao.IPAddressVO;
 import com.cloud.network.dao.LoadBalancerDao;
 import com.cloud.network.dao.LoadBalancerVO;
+import com.cloud.network.dao.NetworkAccountDao;
+import com.cloud.network.dao.NetworkAccountVO;
+import com.cloud.network.dao.NetworkDomainDao;
+import com.cloud.network.dao.NetworkDomainVO;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.vpc.dao.VpcDao;
 import com.cloud.org.Cluster;
 import com.cloud.org.Grouping.AllocationState;
 import com.cloud.projects.Project;
@@ -854,6 +863,16 @@ public class ManagementServerImpl extends ManagerBase implements ManagementServe
     private VolumeDataStoreDao _volumeStoreDao;
     @Inject
     private TemplateDataStoreDao _vmTemplateStoreDao;
+    @Inject
+    private IpAddressManager _ipAddressMgr;
+    @Inject
+    private NetworkAccountDao _networkAccountDao;
+    @Inject
+    private NetworkDomainDao _networkDomainDao;
+    @Inject
+    private NetworkModel _networkMgr;
+    @Inject
+    private VpcDao _vpcDao;
 
     private LockMasterListener _lockMasterListener;
     private final ScheduledExecutorService _eventExecutor = Executors.newScheduledThreadPool(1, new NamedThreadFactory("EventChecker"));
@@ -2004,29 +2023,90 @@ public class ManagementServerImpl extends ManagerBase implements ManagementServe
 
     @Override
     public Pair<List<? extends IpAddress>, Integer> searchForIPAddresses(final ListPublicIpAddressesCmd cmd) {
-        final Object keyword = cmd.getKeyword();
-        final Long physicalNetworkId = cmd.getPhysicalNetworkId();
         final Long associatedNetworkId = cmd.getAssociatedNetworkId();
-        final Long sourceNetworkId = cmd.getNetworkId();
         final Long zone = cmd.getZoneId();
-        final String address = cmd.getIpAddress();
         final Long vlan = cmd.getVlanId();
         final Boolean forVirtualNetwork = cmd.isForVirtualNetwork();
-        final Boolean forLoadBalancing = cmd.isForLoadBalancing();
         final Long ipId = cmd.getId();
-        final Boolean sourceNat = cmd.isSourceNat();
+        final Long networkId = cmd.getNetworkId();
-        final Boolean staticNat = cmd.isStaticNat();
         final Long vpcId = cmd.getVpcId();
-        final Boolean forDisplay = cmd.getDisplay();
-        final Map<String, String> tags = cmd.getTags();
 
         final String state = cmd.getState();
         Boolean isAllocated = cmd.isAllocatedOnly();
         if (isAllocated == null) {
-            isAllocated = Boolean.TRUE;
+            if (state != null && state.equalsIgnoreCase(IpAddress.State.Free.name())) {
-
-            if (state != null) {
                 isAllocated = Boolean.FALSE;
+            } else {
+                isAllocated = Boolean.TRUE; // default
+            }
+        } else {
+            if (state != null && state.equalsIgnoreCase(IpAddress.State.Free.name())) {
+                if (isAllocated) {
+                    throw new InvalidParameterValueException("Conflict: allocatedonly is true but state is Free");
+                }
+            } else if (state != null && state.equalsIgnoreCase(IpAddress.State.Allocated.name())) {
+                isAllocated = Boolean.TRUE;
+            }
+        }
+
+        VlanType vlanType = null;
+        if (forVirtualNetwork != null) {
+            vlanType = forVirtualNetwork ? VlanType.VirtualNetwork : VlanType.DirectAttached;
+        } else {
+            vlanType = VlanType.VirtualNetwork;
+        }
+
+        final Account caller = getCaller();
+        List<IPAddressVO> addrs = new ArrayList<>();
+
+        if (vlanType == VlanType.DirectAttached && networkId == null && ipId == null) { // only root admin can list public ips in all shared networks
+            if (caller.getType() != Account.ACCOUNT_TYPE_ADMIN) {
+                isAllocated = true;
+            }
+        } else if (vlanType == VlanType.DirectAttached) {
+            // list public ip address on shared network
+            // access control. admin: all Ips, domain admin/user: all Ips in shared network in the domain/sub-domain/user
+            NetworkVO network = null;
+            if (networkId == null) {
+                IPAddressVO ip = _publicIpAddressDao.findById(ipId);
+                if (ip == null) {
+                    throw new InvalidParameterValueException("Please specify a valid ipaddress id");
+                }
+                network = _networkDao.findById(ip.getSourceNetworkId());
+            } else {
+                network = _networkDao.findById(networkId);
+            }
+            if (network == null || network.getGuestType() != Network.GuestType.Shared) {
+                throw new InvalidParameterValueException("Please specify a valid network id");
+            }
+            if (network.getAclType() == ControlledEntity.ACLType.Account) {
+                NetworkAccountVO networkMap = _networkAccountDao.getAccountNetworkMapByNetworkId(network.getId());
+                if (networkMap == null) {
+                    return new Pair<>(addrs, 0);
+                }
+                _accountMgr.checkAccess(caller, null, false, _accountDao.findById(networkMap.getAccountId()));
+            } else { // Domain level
+                NetworkDomainVO networkMap = _networkDomainDao.getDomainNetworkMapByNetworkId(network.getId());
+                if (networkMap == null) {
+                    return new Pair<>(addrs, 0);
+                }
+                if (caller.getType() == Account.ACCOUNT_TYPE_NORMAL || caller.getType() == Account.ACCOUNT_TYPE_PROJECT) {
+                    if (_networkMgr.isNetworkAvailableInDomain(network.getId(), caller.getDomainId())) {
+                        isAllocated = Boolean.TRUE;
+                    } else {
+                        return new Pair<>(addrs, 0);
+                    }
+                } else if (caller.getType() == Account.ACCOUNT_TYPE_DOMAIN_ADMIN || caller.getType() == Account.ACCOUNT_TYPE_RESOURCE_DOMAIN_ADMIN) {
+                    if (caller.getDomainId() == networkMap.getDomainId() || _domainDao.isChildDomain(caller.getDomainId(), networkMap.getDomainId())) {
+                        s_logger.debug("Caller " + caller.getUuid() + " has permission to access the network : " + network.getUuid());
+                    } else {
+                        if (_networkMgr.isNetworkAvailableInDomain(network.getId(), caller.getDomainId())) {
+                            isAllocated = Boolean.TRUE;
+                        } else {
+                            return new Pair<>(addrs, 0);
+                        }
+                    }
+                }
             }
         }
 
@@ -2034,12 +2114,10 @@ public class ManagementServerImpl extends ManagerBase implements ManagementServe
         final SearchBuilder<IPAddressVO> sb = _publicIpAddressDao.createSearchBuilder();
         Long domainId = null;
         Boolean isRecursive = null;
-        final List<Long> permittedAccounts = new ArrayList<Long>();
+        final List<Long> permittedAccounts = new ArrayList<>();
         ListProjectResourcesCriteria listProjectResourcesCriteria = null;
-        if (isAllocated) {
+        if (isAllocated || (vlanType == VlanType.VirtualNetwork && (caller.getType() != Account.ACCOUNT_TYPE_ADMIN || cmd.getDomainId() != null))) {
-            final Account caller = getCaller();
+            final Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject = new Ternary<>(cmd.getDomainId(), cmd.isRecursive(),
-
-            final Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject = new Ternary<Long, Boolean, ListProjectResourcesCriteria>(cmd.getDomainId(), cmd.isRecursive(),
                     null);
             _accountMgr.buildACLSearchParameters(caller, cmd.getId(), cmd.getAccountName(), cmd.getProjectId(), permittedAccounts, domainIdRecursiveListProject, cmd.listAll(), false);
             domainId = domainIdRecursiveListProject.first();
@@ -2048,12 +2126,93 @@ public class ManagementServerImpl extends ManagerBase implements ManagementServe
             _accountMgr.buildACLSearchBuilder(sb, domainId, isRecursive, permittedAccounts, listProjectResourcesCriteria);
         }
 
+        buildParameters(sb, cmd);
+
+        SearchCriteria<IPAddressVO> sc = sb.create();
+        setParameters(sc, cmd, vlanType);
+
+        if (isAllocated || (vlanType == VlanType.VirtualNetwork && (caller.getType() != Account.ACCOUNT_TYPE_ADMIN || cmd.getDomainId() != null))) {
+            _accountMgr.buildACLSearchCriteria(sc, domainId, isRecursive, permittedAccounts, listProjectResourcesCriteria);
+        }
+
+        if (associatedNetworkId != null) {
+            _accountMgr.checkAccess(caller, null, false, _networkDao.findById(associatedNetworkId));
+            sc.setParameters("associatedNetworkIdEq", associatedNetworkId);
+        }
+        if (vpcId != null) {
+            _accountMgr.checkAccess(caller, null, false, _vpcDao.findById(vpcId));
+            sc.setParameters("vpcId", vpcId);
+        }
+
+        addrs = _publicIpAddressDao.search(sc, searchFilter); // Allocated
+
+        // Free IP addresses in system IP ranges
+        List<Long> freeAddrIds = new ArrayList<>();
+        if (!(isAllocated || vlanType == VlanType.DirectAttached)) {
+            Long zoneId = zone;
+            Account owner = _accountMgr.finalizeOwner(CallContext.current().getCallingAccount(), cmd.getAccountName(), cmd.getDomainId(), cmd.getProjectId());
+            if (associatedNetworkId != null) {
+                NetworkVO guestNetwork = _networkDao.findById(associatedNetworkId);
+                if (zoneId == null) {
+                    zoneId = guestNetwork.getDataCenterId();
+                } else if (zoneId != guestNetwork.getDataCenterId()) {
+                    InvalidParameterValueException ex = new InvalidParameterValueException("Please specify a valid associated network id in the specified zone.");
+                    throw ex;
+                }
+                owner = _accountDao.findById(guestNetwork.getAccountId());
+            }
+            List<DataCenterVO> dcList = new ArrayList<>();
+            if (zoneId == null){
+                dcList = ApiDBUtils.listZones();
+            } else {
+                dcList.add(ApiDBUtils.findZoneById(zoneId));
+            }
+            List<Long> vlanDbIds = null;
+            if (vlan != null) {
+                vlanDbIds = new ArrayList<>();
+                vlanDbIds.add(vlan);
+            }
+            List<IPAddressVO> freeAddrs = new ArrayList<>();
+            for (DataCenterVO dc : dcList) {
+                long dcId = dc.getId();
+                try {
+                    freeAddrs.addAll(_ipAddressMgr.listAvailablePublicIps(dcId, null, vlanDbIds, owner, VlanType.VirtualNetwork, associatedNetworkId,
+                            false, false, false, null, false, cmd.getVpcId(), cmd.isDisplay(), false, false)); // Free
+                } catch (InsufficientAddressCapacityException e) {
+                    s_logger.warn("no free address is found in zone " + dcId);
+                }
+            }
+            for (IPAddressVO addr: freeAddrs) {
+                freeAddrIds.add(addr.getId());
+            }
+        }
+        if (freeAddrIds.size() > 0) {
+            final SearchBuilder<IPAddressVO> sb2 = _publicIpAddressDao.createSearchBuilder();
+            buildParameters(sb2, cmd);
+            sb2.and("ids", sb2.entity().getId(), SearchCriteria.Op.IN);
+
+            SearchCriteria<IPAddressVO> sc2 = sb2.create();
+            setParameters(sc2, cmd, vlanType);
+            sc2.setParameters("ids", freeAddrIds.toArray());
+            addrs.addAll(_publicIpAddressDao.search(sc2, searchFilter)); // Allocated + Free
+        }
+
+        return new Pair<>(addrs, addrs.size());
+    }
+
+    private void buildParameters(final SearchBuilder<IPAddressVO> sb, final ListPublicIpAddressesCmd cmd) {
+        final Object keyword = cmd.getKeyword();
+        final String address = cmd.getIpAddress();
+        final Boolean forLoadBalancing = cmd.isForLoadBalancing();
+        Boolean isAllocated = cmd.isAllocatedOnly();
+        final Map<String, String> tags = cmd.getTags();
+
         sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.EQ);
         sb.and("address", sb.entity().getAddress(), SearchCriteria.Op.EQ);
         sb.and("vlanDbId", sb.entity().getVlanId(), SearchCriteria.Op.EQ);
         sb.and("id", sb.entity().getId(), SearchCriteria.Op.EQ);
         sb.and("physicalNetworkId", sb.entity().getPhysicalNetworkId(), SearchCriteria.Op.EQ);
-        sb.and("associatedNetworkId", sb.entity().getAssociatedWithNetworkId(), SearchCriteria.Op.EQ);
+        sb.and("associatedNetworkIdEq", sb.entity().getAssociatedWithNetworkId(), SearchCriteria.Op.EQ);
         sb.and("sourceNetworkId", sb.entity().getSourceNetworkId(), SearchCriteria.Op.EQ);
         sb.and("isSourceNat", sb.entity().isSourceNat(), SearchCriteria.Op.EQ);
         sb.and("isStaticNat", sb.entity().isOneToOneNat(), SearchCriteria.Op.EQ);
@@ -2089,21 +2248,24 @@ public class ManagementServerImpl extends ManagerBase implements ManagementServe
         vlanSearch.and("removed", vlanSearch.entity().getRemoved(), SearchCriteria.Op.NULL);
         sb.join("vlanSearch", vlanSearch, sb.entity().getVlanId(), vlanSearch.entity().getId(), JoinBuilder.JoinType.INNER);
 
-        if (isAllocated != null && isAllocated == true) {
+        if (isAllocated != null && isAllocated) {
             sb.and("allocated", sb.entity().getAllocatedTime(), SearchCriteria.Op.NNULL);
         }
+    }
 
-        VlanType vlanType = null;
+    private void setParameters(SearchCriteria<IPAddressVO> sc, final ListPublicIpAddressesCmd cmd, VlanType vlanType) {
-        if (forVirtualNetwork != null) {
+        final Object keyword = cmd.getKeyword();
-            vlanType = forVirtualNetwork ? VlanType.VirtualNetwork : VlanType.DirectAttached;
+        final Long physicalNetworkId = cmd.getPhysicalNetworkId();
-        } else {
+        final Long sourceNetworkId = cmd.getNetworkId();
-            vlanType = VlanType.VirtualNetwork;
+        final Long zone = cmd.getZoneId();
-        }
+        final String address = cmd.getIpAddress();
-
+        final Long vlan = cmd.getVlanId();
-        final SearchCriteria<IPAddressVO> sc = sb.create();
+        final Long ipId = cmd.getId();
-        if (isAllocated) {
+        final Boolean sourceNat = cmd.isSourceNat();
-            _accountMgr.buildACLSearchCriteria(sc, domainId, isRecursive, permittedAccounts, listProjectResourcesCriteria);
+        final Boolean staticNat = cmd.isStaticNat();
-        }
+        final Boolean forDisplay = cmd.getDisplay();
+        final String state = cmd.getState();
+        final Map<String, String> tags = cmd.getTags();
 
         sc.setJoinParameters("vlanSearch", "vlanType", vlanType);
 
@@ -2121,10 +2283,6 @@ public class ManagementServerImpl extends ManagerBase implements ManagementServe
             sc.setParameters("dataCenterId", zone);
         }
 
-        if (vpcId != null) {
-            sc.setParameters("vpcId", vpcId);
-        }
-
         if (ipId != null) {
             sc.setParameters("id", ipId);
         }
@@ -2153,10 +2311,6 @@ public class ManagementServerImpl extends ManagerBase implements ManagementServe
             sc.setParameters("physicalNetworkId", physicalNetworkId);
         }
 
-        if (associatedNetworkId != null) {
-            sc.setParameters("associatedNetworkId", associatedNetworkId);
-        }
-
         if (sourceNetworkId != null) {
             sc.setParameters("sourceNetworkId", sourceNetworkId);
         }
@@ -2170,8 +2324,6 @@ public class ManagementServerImpl extends ManagerBase implements ManagementServe
         }
 
         sc.setParameters( "forsystemvms", false);
-        final Pair<List<IPAddressVO>, Integer> result = _publicIpAddressDao.searchAndCount(sc, searchFilter);
-        return new Pair<List<? extends IpAddress>, Integer>(result.first(), result.second());
     }
 
     @Override

test/integration/component/test_public_ip.py

@@ -0,0 +1,870 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+""" Tests for acquiring/listing public ip address
+"""
+from nose.plugins.attrib import attr
+from marvin.cloudstackTestCase import cloudstackTestCase
+from marvin.lib.utils import cleanup_resources
+from marvin.lib.base import (Account,
+                             Configurations,
+                             Domain,
+                             PublicIpRange,
+                             PublicIPAddress,
+                             Network,
+                             NetworkOffering,
+                             ServiceOffering,
+                             VPC,
+                             VpcOffering,
+                             Zone)
+from marvin.lib.common import (get_zone,
+                               get_domain,
+                               get_template,
+                               get_free_vlan
+                              )
+import logging
+import random
+
+class TestPublicIp(cloudstackTestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.testClient = super(TestPublicIp, cls).getClsTestClient()
+        cls.apiclient = cls.testClient.getApiClient()
+        cls.services = cls.testClient.getParsedTestDataConfig()
+
+        # Get Zone, Domain and templates
+        cls.zone = get_zone(cls.apiclient, cls.testClient.getZoneForTests())
+        cls.services['mode'] = cls.zone.networktype
+        cls.logger = logging.getLogger("TestPublicIp")
+        cls.domain = get_domain(cls.apiclient)
+        cls.services["virtual_machine"]["zoneid"] = cls.zone.id
+
+        cls.template = get_template(
+            cls.apiclient,
+            cls.zone.id,
+            cls.services["ostype"]
+        )
+
+        cls.use_system_ips_config_name = "use.system.public.ips"
+        cls.use_system_ips_config = Configurations.list(
+            cls.apiclient,
+            name=cls.use_system_ips_config_name
+        )
+        cls.use_system_ips_config_value = cls.use_system_ips_config[0].value
+        Configurations.update(
+            cls.apiclient,
+            name=cls.use_system_ips_config_name,
+            value="false"
+        )
+
+        cls._cleanup = []
+        cls.unsupportedHypervisor = False
+        cls.hypervisor = cls.testClient.getHypervisorInfo()
+        if cls.hypervisor.lower() in ['lxc']:
+            cls.unsupportedHypervisor = True
+            return
+
+        # Create new domain1
+        cls.domain1 = Domain.create(
+            cls.apiclient,
+            services=cls.services["acl"]["domain1"],
+            parentdomainid=cls.domain.id)
+
+        # Create account1
+        cls.account1 = Account.create(
+            cls.apiclient,
+            cls.services["account"],
+            # cls.services["acl"]["accountD1"],
+            admin=True,
+            domainid=cls.domain1.id
+        )
+
+        # Create new sub-domain
+        cls.sub_domain = Domain.create(
+            cls.apiclient,
+            services=cls.services["acl"]["domain11"],
+            parentdomainid=cls.domain1.id)
+
+        # Create account for sub-domain
+        cls.sub_account = Account.create(
+            cls.apiclient,
+            cls.services["acl"]["accountD11"],
+            domainid=cls.sub_domain.id
+        )
+
+        # Create new domain2
+        cls.domain2 = Domain.create(
+            cls.apiclient,
+            services=cls.services["acl"]["domain2"],
+            parentdomainid=cls.domain.id)
+
+        # Create account2
+        cls.account2 = Account.create(
+            cls.apiclient,
+            cls.services["acl"]["accountD2"],
+            domainid=cls.domain2.id
+        )
+
+        cls.services["publiciprange"]["zoneid"] = cls.zone.id
+        cls.services["publiciprange"]["forvirtualnetwork"] = "true"
+
+        # Create public ip range 1
+        cls.services["publiciprange"]["vlan"] = get_free_vlan(
+            cls.apiclient,
+            cls.zone.id)[1]
+        random_subnet_number = random.randrange(10,20)
+        cls.services["publiciprange"]["gateway"] = "10.100." + \
+                                                   str(random_subnet_number) + ".254"
+        cls.services["publiciprange"]["startip"] = "10.100." + \
+                                                   str(random_subnet_number) + ".1"
+        cls.services["publiciprange"]["endip"] = "10.100." + \
+                                                 str(random_subnet_number) + ".10"
+        cls.services["publiciprange"]["netmask"] = "255.255.255.0"
+        cls.public_ip_range1 = PublicIpRange.create(
+            cls.apiclient,
+            cls.services["publiciprange"],
+            account=cls.account1.name,
+            domainid=cls.account1.domainid
+        )
+
+        # dedicate ip range to sub domain
+        cls.services["publiciprange"]["vlan"] = get_free_vlan(
+            cls.apiclient,
+            cls.zone.id)[1]
+        random_subnet_number = random.randrange(10,20)
+        cls.services["publiciprange"]["gateway"] = "10.110." + \
+                                                    str(random_subnet_number) + ".254"
+        cls.services["publiciprange"]["startip"] = "10.110." + \
+                                                    str(random_subnet_number) + ".1"
+        cls.services["publiciprange"]["endip"] = "10.110." + \
+                                                  str(random_subnet_number) + ".10"
+        cls.services["publiciprange"]["netmask"] = "255.255.255.0"
+        cls.public_ip_range2 = PublicIpRange.create(
+            cls.apiclient,
+            cls.services["publiciprange"],
+            account=cls.sub_account.name,
+            domainid=cls.sub_account.domainid
+        )
+
+        # dedicate ip range to second domain
+        cls.services["publiciprange"]["vlan"] = get_free_vlan(
+            cls.apiclient,
+            cls.zone.id)[1]
+        random_subnet_number = random.randrange(10,20)
+        cls.services["publiciprange"]["gateway"] = "10.120." + \
+                                                   str(random_subnet_number) + ".254"
+        cls.services["publiciprange"]["startip"] = "10.120." + \
+                                                   str(random_subnet_number) + ".1"
+        cls.services["publiciprange"]["endip"] = "10.120." + \
+                                                 str(random_subnet_number) + ".10"
+        cls.services["publiciprange"]["netmask"] = "255.255.255.0"
+        cls.public_ip_range3 = PublicIpRange.create(
+            cls.apiclient,
+            cls.services["publiciprange"],
+            account=cls.account2.name,
+            domainid=cls.account2.domainid
+        )
+
+        # create vpc offering and VPC
+        cls.vpc_off = VpcOffering.create(
+            cls.apiclient,
+            cls.services["vpc_offering"]
+        )
+        cls.vpc_off.update(cls.apiclient, state='Enabled')
+
+        # create network offering
+        cls.isolated_network_offering = NetworkOffering.create(
+            cls.apiclient,
+            cls.services["isolated_network_offering"],
+            conservemode=False
+        )
+
+        NetworkOffering.update(
+            cls.isolated_network_offering,
+            cls.apiclient,
+            id=cls.isolated_network_offering.id,
+            state="enabled"
+        )
+
+        physical_network, shared_vlan = get_free_vlan(
+            cls.apiclient, cls.zone.id)
+        if shared_vlan is None:
+            cls.fail("Failed to get free vlan id for shared network")
+
+        cls.services["shared_network_offering"]["specifyVlan"] = "True"
+        cls.services["shared_network_offering"]["specifyIpRanges"] = "True"
+
+        cls.shared_network_offering = NetworkOffering.create(
+            cls.apiclient,
+            cls.services["shared_network_offering"],
+            conservemode=False
+        )
+
+        NetworkOffering.update(
+            cls.shared_network_offering,
+            cls.apiclient,
+            id=cls.shared_network_offering.id,
+            state="enabled"
+        )
+
+        # create network using the shared network offering created
+        cls.services["shared_network"]["acltype"] = "Domain"
+        cls.services["shared_network"][
+            "networkofferingid"] = cls.shared_network_offering.id
+        cls.services["shared_network"][
+            "physicalnetworkid"] = physical_network.id
+        cls.services["shared_network"]["vlan"] = shared_vlan
+        shared_network_subnet_number = random.randrange(1, 254)
+
+        cls.services["shared_network"]["netmask"] = "255.255.255.0"
+        cls.services["shared_network"]["gateway"] = "172.16." + \
+                                                     str(shared_network_subnet_number) + ".254"
+        cls.services["shared_network"]["startip"] = "172.16." + \
+                                                     str(shared_network_subnet_number) + ".1"
+        cls.services["shared_network"]["endip"] = "172.16." + \
+                                                   str(shared_network_subnet_number) + ".10"
+
+        cls.guest_network = Network.create(
+            cls.apiclient,
+            cls.services["shared_network"],
+            networkofferingid=cls.shared_network_offering.id,
+            zoneid=cls.zone.id
+        )
+
+        cls._cleanup.append(cls.guest_network)
+        cls._cleanup.append(cls.shared_network_offering)
+        cls._cleanup.append(cls.account1)
+        cls._cleanup.append(cls.account2)
+        cls._cleanup.append(cls.sub_account)
+        cls._cleanup.append(cls.sub_domain)
+        cls._cleanup.append(cls.domain1)
+        cls._cleanup.append(cls.domain2)
+        cls._cleanup.append(cls.public_ip_range1)
+        cls._cleanup.append(cls.public_ip_range2)
+        cls._cleanup.append(cls.public_ip_range3)
+
+    @classmethod
+    def tearDownClass(cls):
+        try:
+            cls.apiclient = super(
+                TestPublicIp,
+                cls).getClsTestClient().getApiClient()
+
+            Configurations.update(
+                cls.apiclient,
+                name=cls.use_system_ips_config_name,
+                value=cls.use_system_ips_config_value
+            )
+            # Cleanup resources used
+            cleanup_resources(cls.apiclient, cls._cleanup)
+
+        except Exception as e:
+            raise Exception("Warning: Exception during cleanup : %s" % e)
+
+        return
+
+    def setUp(self):
+        self.apiclient = self.testClient.getApiClient()
+        self.cleanup = []
+        return
+
+    def tearDown(self):
+        try:
+            # Clean up, terminate the resources created
+            cleanup_resources(self.apiclient, self.cleanup)
+        except Exception as e:
+            raise Exception("Warning: Exception during cleanup : %s" % e)
+        return
+
+    @attr(tags=["advanced", "basic", "sg"], required_hardware="false")
+    def test_01_list_publicip_root_domain(self):
+        """
+        ROOT domain should be able to list public IP address of all
+        sub domains
+
+        Step 1: List all public ip address
+        Step 2: Ensure that the count is greater than or equal to 30
+        Step 3: Display only allocated ip address
+        Step 4: Ensure that the count is greater than or equal to 0
+        Step 5: Display ip address from shared networks
+        Step 6: Ensure that the count is greater than or equal to 30
+        :return:
+        """
+        # Step 1
+        ipAddresses = PublicIPAddress.list(
+            self.apiclient,
+            allocatedonly=False,
+            isrecursive=True,
+            listall=True,
+            forvirtualnetwork=True)
+
+        # Step 2
+        self.assertGreaterEqual(
+            len(ipAddresses),
+            30,
+            "Unable to display all public ip for ROOT domain"
+        )
+
+        # Step 4
+        ipAddresses = PublicIPAddress.list(
+            self.apiclient,
+            allocatedonly=True,
+            isrecursive=True,
+            listall=True,
+            forvirtualnetwork=True)
+
+        self.assertGreaterEqual(
+            len(ipAddresses),
+            0,
+            "Unable to display all public ip for ROOT domain"
+        )
+
+        # Step 5
+        ipAddresses = PublicIPAddress.list(
+            self.apiclient,
+            allocatedonly=False,
+            isrecursive=True,
+            listall=True,
+            forvirtualnetwork=False)
+
+        # Step 6
+        self.assertGreaterEqual(
+            len(ipAddresses),
+            10,
+            "Unable to display all public ip for ROOT domain"
+        )
+
+    @attr(tags=["advanced", "basic", "sg"], required_hardware="false")
+    def test_02_list_publicip_domain_admin(self):
+        """
+        A domain admin should be able to list public IP address of
+        his/her domain and all sub domains
+
+        Step 1: Create an isolated network in the user domain and sub domain
+        Step 2: Associate IP in the range, dedicated to domain1
+        Step 3: Display all public ip address in domain1
+        Step 4: Ensure that the count is greater than or equal to 10
+        Step 5: Display only the allocated Ip address in domain1
+        Step 6: Ensure that the count is 1
+        Step 7: Try to display public ip address from shared networks
+        Step 8: It should not return any result
+        Step 9: Try to display ip address of domain1 from domain2
+        Step 10: Ensure that it doesnt not return any result
+        :return:
+        """
+        # Step 1. Create isolated network
+        self.isolated_network1 = Network.create(
+            self.apiclient,
+            self.services["isolated_network"],
+            accountid=self.account1.name,
+            domainid=self.account1.domainid,
+            networkofferingid=self.isolated_network_offering.id,
+            zoneid=self.zone.id
+        )
+
+        # Step 2. Associate IP in range dedicated to domain1
+        ip_address_1 = self.get_free_ipaddress(self.public_ip_range1.vlan.id)
+        ipaddress = PublicIPAddress.create(
+            self.apiclient,
+            zoneid=self.zone.id,
+            networkid=self.isolated_network1.id,
+            ipaddress=ip_address_1
+        )
+        self.assertIsNotNone(
+            ipaddress,
+            "Failed to Associate IP Address"
+        )
+
+        # Step 3: Display all public ip address in domain1
+        user = self.account1.user[0]
+        user_api_client = self.testClient.getUserApiClient(user.username, self.domain1.name)
+
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=False,
+            isrecursive=True,
+            listall=True,
+            forvirtualnetwork=True)
+
+        # Step 4: Ensure that the count is equal to 10
+        self.assertEqual(
+            len(ipAddresses),
+            10,
+            "Failed to display all public ip address is domain %s" % self.domain1.name
+        )
+
+        # Display public ip address using network id
+        ipAddresses = PublicIPAddress.list(
+            self.apiclient,
+            associatednetworkid=self.isolated_network1.id,
+            account=self.account1.name,
+            domainid=self.account1.domainid,
+            allocatedonly=False,
+            listall=True,
+            forvirtualnetwork=True)
+
+        # Step 4: Ensure that the count is greater than or equal to 10
+        self.assertEqual(
+            len(ipAddresses),
+            10,
+            "Failed to display all public ip address using network id"
+        )
+
+        # Step 5: Display all allocated public ip address in domain1
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=True,
+            isrecursive=True,
+            listall=True,
+            forvirtualnetwork=True)
+
+        # Step 6: Ensure that the count is greater than or equal to 1
+        self.assertEqual(
+            len(ipAddresses),
+            1,
+            "Allocated IP address is greater than 1"
+        )
+
+        # Step 7: Display public ip address from shared networks
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=True,
+            isrecursive=True,
+            listall=True,
+            forvirtualnetwork=False)
+
+        # Step 8: Ensure that the result is empty
+        self.assertIsNone(
+            ipAddresses,
+            "Users should not display ip from shared networks"
+        )
+
+        try:
+            # Step 9
+            user = self.account2.user[0]
+            user_api_client = self.testClient.getUserApiClient(user.username, self.domain2.name)
+
+            ipAddresses = PublicIPAddress.list(
+                user_api_client,
+                allocatedonly=False,
+                listall=True,
+                associatednetworkid=self.isolated_network1.id,
+                forvirtualnetwork=True)
+
+            # Step 10
+            self.fail("Domain should not access public ip of sibling domain")
+        except Exception as e:
+            self.info("Got exception as expected since domain2 cant access network of domain1")
+
+    @attr(tags=["advanced", "basic", "sg"], required_hardware="false")
+    def test_03_list_publicip_user_domain(self):
+        """
+        A regular user should be able to display public ip address
+        only in his domain
+
+        Step 1: Create an isolated network in the user domain
+        Step 2: Display all public ip address in that domain
+        Step 3: Ensure that the count is 10
+        Step 4: Associate IP in the range, dedicated to domain2
+        Step 5: Display only the allocated Ip address in domain2
+        Step 6: Ensure that the count is 1
+        Step 7: Try to display public ip address from shared networks
+        Step 8: It should not return any result
+        Step 9: Try to display allocated public ip address of child domain using networkid
+        Step 10: It should display all allocated ip address from child domain
+        Step 11: Try to display all public ip address from child domain
+        Step 12: It should display all public ip of child domain
+        Step 13: Try to display ip of domain2 from a different domain
+        Step 14: Ensure that we get exception when trying to do so
+        :return:
+        """
+        user = self.sub_account.user[0]
+        sub_user_api_client = self.testClient.getUserApiClient(user.username, self.sub_domain.name)
+
+        # Step 1: create network in child domain
+        self.isolated_network2 = Network.create(
+            self.apiclient,
+            self.services["isolated_network"],
+            accountid=self.sub_account.name,
+            domainid=self.sub_account.domainid,
+            networkofferingid=self.isolated_network_offering.id,
+            zoneid=self.zone.id
+        )
+
+        # Step 2: Display all public ip address in sub domain
+        ipAddresses = PublicIPAddress.list(
+            sub_user_api_client,
+            allocatedonly=False,
+            listall=True,
+            forvirtualnetwork=True)
+
+        # Step 3: Ensure that sub domain can list only the ip address in his domain
+        self.assertEqual(
+            len(ipAddresses),
+            10,
+            "Allocated IP address is greater than 1"
+        )
+
+        # Step 4: Associate IP in range dedicated to sub domain
+        ip_address_1 = self.get_free_ipaddress(self.public_ip_range2.vlan.id)
+        ipaddress = PublicIPAddress.create(
+            sub_user_api_client,
+            zoneid=self.zone.id,
+            networkid=self.isolated_network2.id,
+            ipaddress=ip_address_1
+        )
+
+        # Step 5: Display all allocated ip address in sub domain
+        ipAddresses = PublicIPAddress.list(
+            sub_user_api_client,
+            allocatedonly=True,
+            listall=True,
+            forvirtualnetwork=True)
+
+        # Step 6: Ensure that the count is 1
+        self.assertEqual(
+            len(ipAddresses),
+            1,
+            "Allocated IP address is greater than 1"
+        )
+
+        # Step 7: Display ip address from shared networks
+        ipAddresses = PublicIPAddress.list(
+            sub_user_api_client,
+            allocatedonly=True,
+            listall=True,
+            forvirtualnetwork=False)
+
+        # Step 8: It should not return any result
+        self.assertIsNone(
+            ipAddresses,
+            "Users should not display ip from shared networks"
+        )
+
+        user = self.account1.user[0]
+        user_api_client = self.testClient.getUserApiClient(user.username, self.domain1.name)
+
+        # Step 9: display ip of child domain using network id
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=True,
+            listall=True,
+            isrecursive=True,
+            associatednetworkid=self.isolated_network2.id,
+            forvirtualnetwork=True)
+
+        # Step 10: Ensure that the count is 1 as only 1 ip is acquired in test 3
+        self.assertEqual(
+            len(ipAddresses),
+            1,
+            "Unable to display IP address of child domain using network id"
+        )
+
+        # Step 11: display ip of child domain using network id
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=False,
+            listall=True,
+            isrecursive=True,
+            associatednetworkid=self.isolated_network2.id,
+            forvirtualnetwork=True)
+
+        # Step 12: Ensure that the count is 1 as only 1 ip is acquired in test 3
+        self.assertEqual(
+            len(ipAddresses),
+            10,
+            "Unable to display IP address of child domain using network id"
+        )
+
+        try:
+            # Step 13
+            user = self.account2.user[0]
+            user_api_client = self.testClient.getUserApiClient(user.username, self.domain2.name)
+
+            PublicIPAddress.list(
+                user_api_client,
+                allocatedonly=False,
+                listall=True,
+                associatednetworkid=self.isolated_network2.id,
+                forvirtualnetwork=True)
+
+            # Step 14
+            self.fail("Domain should not access public ip of sibling domain")
+        except Exception as e:
+            self.info("Got exception as expected since domain2 cant access network of domain1")
+
+    @attr(tags=["advanced", "basic", "sg"], required_hardware="false")
+    def test_04_list_publicip_all_subdomains(self):
+        """
+        A domain admin should be able to display public ip address
+        in his domain and also all child domains
+
+        Step 1: Display all public ip address in that domain and sub domain
+        Step 2: Ensure that the count is 11 (all ip from parent domain and allocated from sub domain)
+        Step 3: Display only the allocated Ip address
+        Step 4: Ensure that the count is 2
+        Step 5: Display public ip of child domain using domain/account
+        Step 6: Ensure that the count is 10
+        Step 7: Display public ip of child domain using network id
+        Step 8: Ensure that the count is 1 as only one IP is allocated
+        :return:
+        """
+        user = self.account1.user[0]
+        user_api_client = self.testClient.getUserApiClient(user.username, self.domain1.name)
+
+        # Step 1: Display all public ip
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=False,
+            listall=True,
+            isrecursive=True,
+            forvirtualnetwork=True)
+
+        # Step 2: Ensure that it can display all ip from current domain and
+        # only allocated ip from child domains
+        self.assertEqual(
+            len(ipAddresses),
+            11,
+            "Unable to display all IP address is domain %s" % self.domain1.name
+        )
+
+        # Step 3: display only allocated ip for parent and sub domain
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=True,
+            listall=True,
+            isrecursive=True,
+            forvirtualnetwork=True)
+
+        # Step 4: Ensure that the count is 2
+        self.assertEqual(
+            len(ipAddresses),
+            2,
+            "Unable to display all allocated IP address is domain %s" % self.domain1.name
+        )
+
+        # Step 5: display ip of child domain using domainid/account
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=False,
+            listall=True,
+            isrecursive=True,
+            domainid=self.sub_domain.id,
+            account=self.sub_account.name,
+            forvirtualnetwork=True)
+
+        # Step 6: Ensure that the count is 10
+        self.assertEqual(
+            len(ipAddresses),
+            10,
+            "Unable to display IP address of child domain"
+        )
+
+    @attr(tags=["advanced", "basic", "sg"], required_hardware="false")
+    def test_05_list_publicip_user_domain(self):
+        """
+        A domain admin should be able to display public ip address
+        in his domain and also all child domains
+
+        Step 1: Display all public ip address in that domain and sub domain
+        Step 2: Ensure that the count is 20
+        Step 3: Display only the allocated Ip address
+        Step 4: Ensure that the count is 2
+        Step 5: Try to display public ip of vpc from different domain
+        Step 6: Ensure that we get exception when trying to do so
+        :return:
+        """
+        user = self.account2.user[0]
+        user_api_client = self.testClient.getUserApiClient(user.username, self.domain2.name)
+
+        self.services["vpc"]["cidr"] = "10.1.1.1/16"
+        vpc_1 = VPC.create(
+            user_api_client,
+            self.services["vpc"],
+            vpcofferingid=self.vpc_off.id,
+            zoneid=self.zone.id,
+            account=self.account2.name,
+            domainid=self.account2.domainid
+        )
+        self.validate_vpc_network(vpc_1)
+
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=False,
+            listall=True,
+            forvirtualnetwork=True)
+
+        self.assertGreaterEqual(
+            len(ipAddresses),
+            10,
+            "Unable to display all public ip in VPC"
+        )
+
+        # List ip address using vpcid
+        ipAddresses = PublicIPAddress.list(
+            self.apiclient,
+            vpcid=vpc_1.id,
+            allocatedonly=False,
+            account=self.account2.name,
+            domainid=self.domain2.id,
+            forvirtualnetwork=True)
+
+        self.assertGreaterEqual(
+            len(ipAddresses),
+            10,
+            "Unable to display all public ip in VPC"
+        )
+
+        # Acquire public ip address from VPC
+        ip_address_1 = self.get_free_ipaddress(self.public_ip_range3.vlan.id)
+        PublicIPAddress.create(
+            user_api_client,
+            zoneid=self.zone.id,
+            vpcid=vpc_1.id,
+            ipaddress=ip_address_1
+        )
+
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=True,
+            listall=True,
+            forvirtualnetwork=True)
+
+        self.assertGreaterEqual(
+            len(ipAddresses),
+            2,
+            "Unable to display allocated public ip in VPC"
+        )
+
+        try:
+            # Step 5
+            user = self.account1.user[0]
+            user_api_client = self.testClient.getUserApiClient(user.username, self.domain1.name)
+
+            PublicIPAddress.list(
+                user_api_client,
+                allocatedonly=False,
+                listall=True,
+                vpcid=vpc_1.id,
+                forvirtualnetwork=True)
+
+            # Step 6
+            self.fail("Domain should not access public ip of sibling domain")
+        except Exception as e:
+            self.info("Got exception as expected since domain2 cant access network of domain1")
+
+        self.vpc_off.update(self.apiclient, state='Disabled')
+        self.cleanup.append(vpc_1)
+        self.cleanup.append(self.vpc_off)
+
+    @attr(tags=["advanced", "basic", "sg"], required_hardware="false")
+    def test_06_list_publicip_user_domain(self):
+        """
+        Display public ip address from shared networks
+        1. List public ip address of shared network as root admin
+        2. Ensure that it can display all public ip address
+        3. List public ip address of shared networks as domain admin
+        4. It should not return any result
+        5. Try to display public ip by passing network id
+        6. Ensure that we get exception when trying to do so
+        :return:
+        """
+        # Step 1
+        ipAddresses = PublicIPAddress.list(
+            self.apiclient,
+            allocatedonly=False,
+            listall=True,
+            networkid=self.guest_network.id,
+            forvirtualnetwork=False)
+
+        # Step 2
+        self.assertGreaterEqual(
+            len(ipAddresses),
+            10,
+            "Unable to display allocated public ip in VPC"
+        )
+
+        user = self.account1.user[0]
+        user_api_client = self.testClient.getUserApiClient(user.username, self.domain1.name)
+
+        # Step 3
+        ipAddresses = PublicIPAddress.list(
+            user_api_client,
+            allocatedonly=False,
+            listall=True,
+            networkid=self.guest_network.id,
+            forvirtualnetwork=False)
+
+        # Step 4
+        self.assertIsNone(
+            ipAddresses,
+            "Unable to display allocated public ip in VPC"
+        )
+
+        try:
+            # Step 5
+            PublicIPAddress.list(
+                user_api_client,
+                allocatedonly=False,
+                listall=True,
+                associatednetworkid=self.guest_network.id,
+                forvirtualnetwork=True)
+
+            # Step 6
+            self.fail("Domain should not access public ip of sibling domain")
+        except Exception as e:
+            self.info("Got exception as expected since domain2 cant access network of domain1")
+
+    def get_free_ipaddress(self, vlanId):
+        ipaddresses = PublicIPAddress.list(
+            self.apiclient,
+            vlanid=vlanId,
+            state='Free'
+        )
+        self.assertEqual(
+            isinstance(ipaddresses, list),
+            True,
+            "List ipaddresses should return a valid response for Free ipaddresses"
+        )
+        random.shuffle(ipaddresses)
+        return ipaddresses[0].ipaddress
+
+    def validate_vpc_network(self, network, state=None):
+        """Validates the VPC network"""
+
+        self.debug("Check if the VPC network is created successfully?")
+        vpc_networks = VPC.list(
+            self.apiclient,
+            id=network.id
+        )
+        self.assertEqual(
+            isinstance(vpc_networks, list),
+            True,
+            "List VPC network should return a valid list"
+        )
+        self.assertEqual(
+            network.name,
+            vpc_networks[0].name,
+            "Name of the VPC network should match with listVPC data"
+        )
+        if state:
+            self.assertEqual(
+                vpc_networks[0].state,
+                state,
+                "VPC state should be '%s'" % state
+            )
+        self.debug("VPC network validated - %s" % network.name)
+        return

test/integration/smoke/test_network.py

@@ -224,7 +224,8 @@ class TestPublicIP(cloudstackTestCase):
         # 1.listPublicIpAddresses should no more return the released address
         list_pub_ip_addr_resp = list_publicIP(
             self.apiclient,
-            id=ip_address.ipaddress.id
+            id=ip_address.ipaddress.id,
+            allocatedonly=True
         )
         if list_pub_ip_addr_resp is None:
             return
@@ -276,7 +277,8 @@ class TestPublicIP(cloudstackTestCase):
 
         list_pub_ip_addr_resp = list_publicIP(
             self.apiclient,
-            id=ip_address.ipaddress.id
+            id=ip_address.ipaddress.id,
+            allocatedonly=True
         )
 
         self.assertEqual(
@@ -880,7 +882,8 @@ class TestReleaseIP(cloudstackTestCase):
         while retriesCount > 0:
             listResponse = list_publicIP(
                 self.apiclient,
-                id=self.ip_addr.id
+                id=self.ip_addr.id,
+                state="Allocated"
             )
             if listResponse is None:
                 isIpAddressDisassociated = True