mirror of
https://github.com/apache/cloudstack.git
synced 2025-10-26 08:42:29 +01:00
89 lines
3.8 KiB
Java
89 lines
3.8 KiB
Java
// Licensed to the Apache Software Foundation (ASF) under one
|
|
// or more contributor license agreements. See the NOTICE file
|
|
// distributed with this work for additional information
|
|
// regarding copyright ownership. The ASF licenses this file
|
|
// to you under the Apache License, Version 2.0 (the
|
|
// "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
package com.cloud.network.rules;
|
|
|
|
import java.util.List;
|
|
|
|
import com.cloud.exception.NetworkRuleConflictException;
|
|
import com.cloud.exception.ResourceUnavailableException;
|
|
import com.cloud.network.IPAddressVO;
|
|
import com.cloud.network.firewall.FirewallService;
|
|
import com.cloud.network.rules.FirewallRule.FirewallRuleType;
|
|
import com.cloud.network.rules.FirewallRule.Purpose;
|
|
import com.cloud.user.Account;
|
|
|
|
public interface FirewallManager extends FirewallService {
|
|
/**
|
|
* detectRulesConflict finds conflicts in networking rules. It checks for
|
|
* conflicts between the following types of netowrking rules;
|
|
* 1. one to one nat ip forwarding
|
|
* 2. port forwarding
|
|
* 3. load balancing
|
|
*
|
|
* and conflicts are detected between those two rules. In this case, it
|
|
* is possible for both rules to be rolled back when, technically, we should
|
|
* and the user can simply re-add one of the rules themselves.
|
|
*
|
|
* @param newRule
|
|
* the new rule created.
|
|
* @throws NetworkRuleConflictException
|
|
*/
|
|
void detectRulesConflict(FirewallRule newRule) throws NetworkRuleConflictException;
|
|
|
|
void validateFirewallRule(Account caller, IPAddressVO ipAddress, Integer portStart, Integer portEnd, String proto,
|
|
Purpose purpose, FirewallRuleType type, Long networkid, FirewallRule.TrafficType trafficType);
|
|
|
|
boolean applyRules(List<? extends FirewallRule> rules, boolean continueOnError, boolean updateRulesInDB) throws ResourceUnavailableException;
|
|
|
|
boolean applyFirewallRules(List<FirewallRuleVO> rules, boolean continueOnError, Account caller);
|
|
|
|
public void revokeRule(FirewallRuleVO rule, Account caller, long userId, boolean needUsageEvent);
|
|
|
|
boolean revokeFirewallRulesForIp(long ipId, long userId, Account caller) throws ResourceUnavailableException;
|
|
|
|
/**
|
|
* Revokes a firewall rule
|
|
*
|
|
* @param ruleId
|
|
* the id of the rule to revoke.
|
|
* @param caller
|
|
* TODO
|
|
* @param userId
|
|
* TODO
|
|
* @return
|
|
*/
|
|
boolean revokeFirewallRule(long ruleId, boolean apply, Account caller, long userId);
|
|
|
|
FirewallRule createFirewallRule(Long ipAddrId, Account caller, String xId, Integer portStart, Integer portEnd, String protocol, List<String> sourceCidrList, Integer icmpCode, Integer icmpType, Long relatedRuleId,
|
|
FirewallRule.FirewallRuleType type, Long networkId, FirewallRule.TrafficType traffictype)
|
|
throws NetworkRuleConflictException;
|
|
|
|
FirewallRule createRuleForAllCidrs(long ipAddrId, Account caller, Integer startPort, Integer endPort, String protocol, Integer icmpCode, Integer icmpType, Long relatedRuleId, long networkId) throws NetworkRuleConflictException;
|
|
|
|
boolean revokeAllFirewallRulesForNetwork(long networkId, long userId, Account caller) throws ResourceUnavailableException;
|
|
|
|
boolean revokeFirewallRulesForVm(long vmId);
|
|
|
|
boolean addSystemFirewallRules(IPAddressVO ip, Account acct);
|
|
|
|
/**
|
|
* @param rule
|
|
*/
|
|
void removeRule(FirewallRule rule);
|
|
|
|
}
|