apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

bug 6971: Dont confuse PF rules added for VPN to be LB rules

Browse Source
This commit is contained in:
Chiradeep Vittal 2010-11-18 13:57:22 -08:00
parent ea0680ef9c
commit a7547846bf
4 changed files with 49 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
core/src/com/cloud/network/dao/FirewallRulesDao.java
View File

@ -53,4 +53,5 @@ public interface FirewallRulesDao extends GenericDao<FirewallRuleVO, Long> {
public List<FirewallRuleVO> listByPrivateIp(String privateIp);
public boolean isPublicIpOneToOneNATted(String publicIp);
void deleteIPForwardingByPublicIpAndPort(String ipAddress, String port);
public List<FirewallRuleVO> listIPForwardingForLB(long userId, long dcId);
}

33
core/src/com/cloud/network/dao/FirewallRulesDaoImpl.java
View File

@ -44,6 +44,8 @@ public class FirewallRulesDaoImpl extends GenericDaoBase<FirewallRuleVO, Long> i
public static String SELECT_IP_FORWARDINGS_BY_USERID_SQL = null;
public static String SELECT_IP_FORWARDINGS_BY_USERID_AND_DCID_SQL = null;
public static String SELECT_LB_FORWARDINGS_BY_USERID_AND_DCID_SQL = null;
public static final String DELETE_IP_FORWARDING_BY_IPADDRESS_SQL = "DELETE FROM ip_forwarding WHERE public_ip_address = ?";
public static final String DELETE_IP_FORWARDING_BY_IP_PORT_SQL = "DELETE FROM ip_forwarding WHERE public_ip_address = ? and public_port = ?";
@ -60,6 +62,7 @@ public class FirewallRulesDaoImpl extends GenericDaoBase<FirewallRuleVO, Long> i
protected SearchBuilder<FirewallRuleVO> RulesExcludingPubIpPort;
protected SearchBuilder<FirewallRuleVO> FWByGroupId;
protected SearchBuilder<FirewallRuleVO> FWByIpForLB;
protected SearchBuilder<FirewallRuleVO> FWByGroupAndPrivateIp;
protected SearchBuilder<FirewallRuleVO> FWByPrivateIpPrivatePortPublicIpPublicPortSearch;
protected SearchBuilder<FirewallRuleVO> OneToOneNATSearch;
@ -84,6 +87,12 @@ public class FirewallRulesDaoImpl extends GenericDaoBase<FirewallRuleVO, Long> i
s_logger.debug(SELECT_IP_FORWARDINGS_BY_USERID_AND_DCID_SQL);
}
SELECT_LB_FORWARDINGS_BY_USERID_AND_DCID_SQL = buildSelectByUserIdAndDatacenterIdForLBSql();
if (s_logger.isDebugEnabled()) {
s_logger.debug(SELECT_LB_FORWARDINGS_BY_USERID_AND_DCID_SQL);
}
FWByIPSearch = createSearchBuilder();
FWByIPSearch.and("publicIpAddress", FWByIPSearch.entity().getPublicIpAddress(), SearchCriteria.Op.EQ);
FWByIPSearch.done();
@ -149,6 +158,7 @@ public class FirewallRulesDaoImpl extends GenericDaoBase<FirewallRuleVO, Long> i
FWByIpForLB.and("groupId", FWByIpForLB.entity().getGroupId(), SearchCriteria.Op.NNULL);
FWByIpForLB.and("forwarding", FWByIpForLB.entity().isForwarding(), SearchCriteria.Op.EQ);
FWByIpForLB.done();
return true;
}
@ -164,6 +174,10 @@ public class FirewallRulesDaoImpl extends GenericDaoBase<FirewallRuleVO, Long> i
return "SELECT i.id, i.group_id, i.public_ip_address, i.public_port, i.private_ip_address, i.private_port, i.enabled, i.protocol, i.forwarding, i.algorithm FROM ip_forwarding i, user_ip_address u WHERE i.public_ip_address=u.public_ip_address AND u.account_id=? AND u.data_center_id=?";
}
protected String buildSelectByUserIdAndDatacenterIdForLBSql() {
return "SELECT i.id, i.group_id, i.public_ip_address, i.public_port, i.private_ip_address, i.private_port, i.enabled, i.protocol, i.forwarding, i.algorithm FROM ip_forwarding i, user_ip_address u WHERE i.public_ip_address=u.public_ip_address AND u.account_id=? AND u.data_center_id=? AND i.group_id is not NULL";
}
public List<FirewallRuleVO> listIPForwarding(String publicIPAddress, boolean forwarding) {
SearchCriteria<FirewallRuleVO> sc = FWByIPAndForwardingSearch.create();
sc.setParameters("publicIpAddress", publicIPAddress);
@ -392,4 +406,23 @@ public class FirewallRulesDaoImpl extends GenericDaoBase<FirewallRuleVO, Long> i
sc.setParameters("forwarding", false);
return search(sc, null);
}
@Override
public List<FirewallRuleVO> listIPForwardingForLB(long userId, long dcId) {
Transaction txn = Transaction.currentTxn();
List<FirewallRuleVO> forwardings = new ArrayList<FirewallRuleVO>();
PreparedStatement pstmt = null;
try {
pstmt = txn.prepareAutoCloseStatement(SELECT_LB_FORWARDINGS_BY_USERID_AND_DCID_SQL);
pstmt.setLong(1, userId);
pstmt.setLong(2, dcId);
ResultSet rs = pstmt.executeQuery();
while (rs.next()) {
forwardings.add(toEntityBean(rs, false));
}
} catch (Exception e) {
s_logger.warn(e);
}
return forwardings;
}
}

10
server/src/com/cloud/network/NetworkManagerImpl.java
View File

@ -825,11 +825,12 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
if (rule.isForwarding()) {
return updatePortForwardingRule(rule, router, hostId, oldPrivateIP, oldPrivatePort);
} else {
final List<FirewallRuleVO> fwRules = _rulesDao.listIPForwarding(ipVO.getAccountId(), ipVO.getDataCenterId());
} else if (rule.getGroupId() != null) {
final List<FirewallRuleVO> fwRules = _rulesDao.listIPForwardingForLB(ipVO.getAccountId(), ipVO.getDataCenterId());
return updateLoadBalancerRules(fwRules, router, hostId);
}
return true;
}
@Override
@ -870,7 +871,7 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
fwdRules.add(rule);
final SetFirewallRuleCommand cmd = new SetFirewallRuleCommand(routerName, routerIp, false, rule, false);
cmds.addCommand(cmd);
} else {
} else if (rule.getGroupId() != null){
lbRules.add(rule);
}
@ -882,6 +883,9 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
final LoadBalancerCfgCommand cmd = new LoadBalancerCfgCommand(cfg, addRemoveRules, routerName, routerIp);
cmds.addCommand(cmd);
}
if (cmds.size() == 0) {
return result;
}
Answer [] answers = null;
try {
answers = _agentMgr.send(host.getId(), cmds);

4
server/src/com/cloud/network/router/DomainRouterManagerImpl.java
View File

@ -1140,7 +1140,9 @@ public class DomainRouterManagerImpl implements DomainRouterManager, DomainRoute
}
final List<FirewallRuleVO> fwRules = new ArrayList<FirewallRuleVO>();
for (final IPAddressVO ipVO : ipAddrs) {
fwRules.addAll(_rulesDao.listIPForwarding(ipVO.getAddress()));
//We need only firewall rules that are either forwarding or for load balancers
fwRules.addAll(_rulesDao.listIPForwarding(ipVO.getAddress(), true));
fwRules.addAll(_rulesDao.listIpForwardingRulesForLoadBalancers(ipVO.getAddress()));
}
final List<FirewallRuleVO> result = _networkMgr.updateFirewallRules(router
.getPublicIpAddress(), fwRules, router);