CLOUDSTACK-2319: fix "unable to add egress rules" in SecurityGroup

Signed-off-by: Chip Childers <chip.childers@gmail.com>

api/src/com/cloud/network/security/SecurityGroupRules.java

@@ -31,6 +31,8 @@ public interface SecurityGroupRules extends InternalIdentity {
 
     Long getRuleId();
 
+    String getRuleUuid();
+
     int getStartPort();
 
     int getEndPort();

core/src/com/cloud/network/security/SecurityGroupRulesVO.java

@@ -54,6 +54,9 @@ public class SecurityGroupRulesVO implements SecurityGroupRules {
     @Column(name = "id", table = "security_group_rule", insertable = false, updatable = false)
     private Long ruleId;
 
+    @Column(name = "uuid", table = "security_group_rule", insertable = false, updatable = false)
+    private String ruleUuid;
+
     @Column(name = "start_port", table = "security_group_rule", insertable = false, updatable = false)
     private int startPort;
 
@@ -75,7 +78,11 @@ public class SecurityGroupRulesVO implements SecurityGroupRules {
     public SecurityGroupRulesVO() {
     }
 
-    public SecurityGroupRulesVO(long id, String name, String description, Long domainId, Long accountId, Long ruleId, int startPort, int endPort, String protocol, Long allowedNetworkId,
+    public SecurityGroupRulesVO(long id) {
+        this.id = id;
+    }
+
+    public SecurityGroupRulesVO(long id, String name, String description, Long domainId, Long accountId, Long ruleId, String ruleUuid, int startPort, int endPort, String protocol, Long allowedNetworkId,
             String allowedSourceIpCidr) {
         this.id = id;
         this.name = name;
@@ -83,6 +90,7 @@ public class SecurityGroupRulesVO implements SecurityGroupRules {
         this.domainId = domainId;
         this.accountId = accountId;
         this.ruleId = ruleId;
+        this.ruleUuid = ruleUuid;
         this.startPort = startPort;
         this.endPort = endPort;
         this.protocol = protocol;
@@ -120,6 +128,11 @@ public class SecurityGroupRulesVO implements SecurityGroupRules {
         return ruleId;
     }
 
+    @Override
+    public String getRuleUuid() {
+        return ruleUuid;
+    }
+
     @Override
     public int getStartPort() {
         return startPort;

server/src/com/cloud/network/security/dao/SecurityGroupRulesDaoImpl.java

@@ -84,4 +84,13 @@ public class SecurityGroupRulesDaoImpl extends GenericDaoBase<SecurityGroupRules
         sc.setParameters("groupId", groupId);
         return listBy(sc, searchFilter);
     }
+
+    @Override
+    public SecurityGroupRulesVO findByUuidIncludingRemoved(final String uuid) {
+        SearchCriteria<SecurityGroupRulesVO> sc = createSearchCriteria();
+        sc.addAnd("ruleUuid", SearchCriteria.Op.EQ, uuid);
+        SecurityGroupRulesVO rule = findOneIncludingRemovedBy(sc);
+        SecurityGroupRulesVO newRule = new SecurityGroupRulesVO(rule.getRuleId());
+        return newRule;
+    }
 }

ui/scripts/network.js

@@ -3981,13 +3981,12 @@
                         account: args.context.securityGroups[0].account
                       };
 
-                      // TCP / ICMP
                       if (args.data.icmptype && args.data.icmpcode) { // ICMP
                         $.extend(data, {
                           icmptype: args.data.icmptype,
                           icmpcode: args.data.icmpcode
                         });
-                      } else { // TCP
+                      } else { // TCP/UDP
                         $.extend(data, {
                           startport: args.data.startport,
                           endport: args.data.endport
@@ -4081,15 +4080,10 @@
               
               egressRules: {
                 title: 'label.egress.rule',
-                custom: function(args) {
+                custom: cloudStack.uiCustom.securityRules({
-                  var context = args.context;
-
-                  return $('<div>').multiEdit({
-                    context: context,
                   noSelect: true,
                   noHeaderActionsColumn: true,
                   fields: {
-                      'cidrlist': { edit: true, label: 'label.cidr' },
                     'protocol': {
                       label: 'label.protocol',
                       select: function(args) {
@@ -4106,11 +4100,13 @@
                           var $otherFields = $inputs.filter(function() {
                             var name = $(this).attr('rel');
 
-                              return name != 'cidrlist' &&
+                            return name != 'icmptype' &&
-                                name != 'icmptype' &&
                               name != 'icmpcode' &&
                               name != 'protocol' &&
-                                name != 'add-rule';
+                              name != 'add-rule' &&
+                              name != 'cidr' &&
+                              name != 'accountname' &&
+                              name != 'securitygroup';
                           });
 
                           if ($(this).val() == 'icmp') {
@@ -4135,6 +4131,13 @@
                     'endport': { edit: true, label: 'label.end.port' },
                     'icmptype': { edit: true, label: 'ICMP.type', isHidden: true },
                     'icmpcode': { edit: true, label: 'ICMP.code', isHidden: true },
+                    'cidr': { edit: true, label: 'label.cidr', isHidden: true },
+                    'accountname': {
+                      edit: true,
+                      label: 'label.account.and.security.group',
+                      isHidden: true,
+                      range: ['accountname', 'securitygroup']
+                    },
                     'add-rule': {
                       label: 'label.add',
                       addButton: true
@@ -4144,9 +4147,10 @@
                     label: 'label.add',
                     action: function(args) {
                       var data = {
+                        securitygroupid: args.context.securityGroups[0].id,
                         protocol: args.data.protocol,
-                          cidrlist: args.data.cidrlist,
+                        domainid: args.context.securityGroups[0].domainid,
-                          trafficType: 'Egress'
+                        account: args.context.securityGroups[0].account
                       };
 
                       if (args.data.icmptype && args.data.icmpcode) { // ICMP
@@ -4161,34 +4165,21 @@
                         });
                       }
 
-                        // Get Source NAT IP
+                      // CIDR / account
-                        var sourceNATIP;
+                      if (args.data.cidr) {
-
+                        data.cidrlist = args.data.cidr;
-                        $.ajax({
+                      } else {
-                          url: createURL('listPublicIpAddresses'),
+                        data['usersecuritygrouplist[0].account'] = args.data.accountname;
-                          data: {
+                        data['usersecuritygrouplist[0].group'] = args.data.securitygroup;
-                            listAll: true,
-                            associatednetworkid: args.context.networks[0].id
-                          },
-                          async: false,
-                          success: function(json) {
-                            var ipAddresses = json.listpublicipaddressesresponse.publicipaddress;
-                            
-                            sourceNATIP = $.grep(ipAddresses, function(ipAddress) {
-                              return ipAddress.issourcenat;
-                            })[0];
                       }
-                        });
-
-                        data.ipaddressid = sourceNATIP.id;
 
                       $.ajax({
-                          url: createURL('createFirewallRule'),
+                        url: createURL('authorizeSecurityGroupEgress'),
                         data: data,
                         dataType: 'json',
                         async: true,
-                          success: function(json) {
+                        success: function(data) {
-                            var jobId = json.createfirewallruleresponse.jobid;
+                          var jobId = data.authorizesecuritygroupegressresponse.jobid;
 
                           args.response.success({
                             _custom: {
@@ -4199,9 +4190,6 @@
                               poll: pollAsyncJobResult
                             }
                           });
-                          },
-                          error: function(json) {
-                            args.response.error(parseXMLHttpResponse(json));
                         }
                       });
                     }
@@ -4211,14 +4199,16 @@
                       label: 'label.remove.rule',
                       action: function(args) {
                         $.ajax({
-                            url: createURL('deleteFirewallRule'),
+                          url: createURL('revokeSecurityGroupEgress'),
                           data: {
+                            domainid: args.context.securityGroups[0].domainid,
+                            account: args.context.securityGroups[0].account,
                             id: args.context.multiRule[0].id
                           },
                           dataType: 'json',
                           async: true,
                           success: function(data) {
-                              var jobID = data.deletefirewallruleresponse.jobid;
+                            var jobID = data.revokesecuritygroupegress.jobid;
 
                             args.response.success({
                               _custom: {
@@ -4240,25 +4230,24 @@
                   ignoreEmptyFields: true,
                   dataProvider: function(args) {
                     $.ajax({
-                        url: createURL('listFirewallRules'),
+                      url: createURL('listSecurityGroups'),
                       data: {
-                          listAll: true,
+                        id: args.context.securityGroups[0].id
-                          networkid: args.context.networks[0].id,
-                          trafficType: 'Egress'
                       },
                       dataType: 'json',
                       async: true,
-                        success: function(json) {
+                      success: function(data) {
-                          var response = json.listfirewallrulesresponse.firewallrule;
-                          
                         args.response.success({
-                            data: response
+                          data: $.map(
-                          });
+                            data.listsecuritygroupsresponse.securitygroup[0].egressrule ?
-                        }
+                              data.listsecuritygroupsresponse.securitygroup[0].egressrule : [],
+                            ingressEgressDataMap
+                          )
                         });
                       }
                     });
                   }
+                })
               }
             },