Examples with FirewallRuleTO com.cloud.agent.api.to.FirewallRuleTO used on opensource projects

Example 11 with FirewallRuleTO

use of com.cloud.agent.api.to.FirewallRuleTO in project cloudstack by apache.

the class CiscoVnmcResourceTest method testFirewall.

@Test
public void testFirewall() throws ConfigurationException, Exception {
    long vlanId = 123;
    List<FirewallRuleTO> rules = new ArrayList<FirewallRuleTO>();
    List<String> cidrList = new ArrayList<String>();
    cidrList.add("2.3.2.3/32");
    FirewallRuleTO active = new FirewallRuleTO(1, null, "1.2.3.4", "tcp", 22, 22, false, false, FirewallRule.Purpose.Firewall, cidrList, null, null);
    rules.add(active);
    FirewallRuleTO revoked = new FirewallRuleTO(1, null, "1.2.3.4", "tcp", 22, 22, true, false, FirewallRule.Purpose.Firewall, null, null, null);
    rules.add(revoked);
    SetFirewallRulesCommand cmd = new SetFirewallRulesCommand(rules);
    cmd.setContextParam(NetworkElementCommand.GUEST_VLAN_TAG, Long.toString(vlanId));
    cmd.setContextParam(NetworkElementCommand.GUEST_NETWORK_CIDR, "1.2.3.4/32");
    _resource.setConnection(_connection);
    when(_connection.createTenantVDCAclPolicySet(anyString(), anyBoolean())).thenReturn(true);
    when(_connection.createTenantVDCAclPolicy(anyString(), anyString())).thenReturn(true);
    when(_connection.createTenantVDCAclPolicyRef(anyString(), anyString(), anyBoolean())).thenReturn(true);
    when(_connection.deleteTenantVDCAclRule(anyString(), anyLong(), anyString())).thenReturn(true);
    when(_connection.createTenantVDCIngressAclRule(anyString(), anyLong(), anyString(), anyString(), anyString(), anyString(), anyString(), anyString())).thenReturn(true);
    when(_connection.createTenantVDCEgressAclRule(anyString(), anyLong(), anyString(), anyString(), anyString(), anyString(), anyString(), anyString())).thenReturn(true);
    when(_connection.associateAclPolicySet(anyString())).thenReturn(true);
    Answer answer = _resource.executeRequest(cmd);
    System.out.println(answer.getDetails());
    assertTrue(answer.getResult());
}

Example 12 with FirewallRuleTO

use of com.cloud.agent.api.to.FirewallRuleTO in project cloudstack by apache.

the class PaloAltoResource method execute.

private Answer execute(SetFirewallRulesCommand cmd, int numRetries) {
    FirewallRuleTO[] rules = cmd.getRules();
    try {
        ArrayList<IPaloAltoCommand> commandList = new ArrayList<IPaloAltoCommand>();
        for (FirewallRuleTO rule : rules) {
            if (!rule.revoked()) {
                manageFirewallRule(commandList, PaloAltoPrimative.ADD, rule);
            } else {
                manageFirewallRule(commandList, PaloAltoPrimative.DELETE, rule);
            }
        }
        boolean status = requestWithCommit(commandList);
        return new Answer(cmd);
    } catch (ExecutionException e) {
        s_logger.error(e);
        if (numRetries > 0 && refreshPaloAltoConnection()) {
            int numRetriesRemaining = numRetries - 1;
            s_logger.debug("Retrying SetFirewallRulesCommand. Number of retries remaining: " + numRetriesRemaining);
            return execute(cmd, numRetriesRemaining);
        } else {
            return new Answer(cmd, e);
        }
    }
}

Example 13 with FirewallRuleTO

use of com.cloud.agent.api.to.FirewallRuleTO in project cloudstack by apache.

the class PaloAltoResourceTest method removeEgressFirewallRule.

@Test
public void removeEgressFirewallRule() throws ConfigurationException, Exception {
    if (_context.containsKey("enable_console_output") && _context.get("enable_console_output").equals("true")) {
        System.out.println("\nTEST: removeEgressFirewallRule");
        System.out.println("---------------------------------------------------");
    }
    _context.put("has_public_interface", "true");
    _context.put("has_private_interface", "true");
    _context.put("has_src_nat_rule", "true");
    _context.put("has_isolation_fw_rule", "true");
    _context.put("has_service_tcp_80", "true");
    _context.put("has_egress_fw_rule", "true");
    _resource.setMockContext(_context);
    _resource.configure("PaloAltoResource", _resourceParams);
    long vlanId = 3954;
    List<FirewallRuleTO> rules = new ArrayList<FirewallRuleTO>();
    FirewallRuleVO revokedVO = new FirewallRuleVO(null, null, 80, 80, "tcp", 1, 1, 1, Purpose.Firewall, null, null, null, null, FirewallRule.TrafficType.Egress);
    revokedVO.setState(State.Revoke);
    FirewallRuleTO revoked = new FirewallRuleTO(revokedVO, Long.toString(vlanId), null, Purpose.Firewall, FirewallRule.TrafficType.Egress);
    rules.add(revoked);
    SetFirewallRulesCommand cmd = new SetFirewallRulesCommand(rules);
    cmd.setContextParam(NetworkElementCommand.GUEST_VLAN_TAG, Long.toString(vlanId));
    cmd.setContextParam(NetworkElementCommand.GUEST_NETWORK_CIDR, "10.3.96.1/20");
    Answer answer = _resource.executeRequest(cmd);
    assertTrue(answer.getResult());
}

Example 14 with FirewallRuleTO

use of com.cloud.agent.api.to.FirewallRuleTO in project cloudstack by apache.

the class PaloAltoResourceTest method addIngressFirewallRule.

@Test
public void addIngressFirewallRule() throws ConfigurationException, Exception {
    if (_context.containsKey("enable_console_output") && _context.get("enable_console_output").equals("true")) {
        System.out.println("\nTEST: addIngressFirewallRule");
        System.out.println("---------------------------------------------------");
    }
    _context.put("has_public_interface", "true");
    _context.put("has_private_interface", "true");
    _context.put("has_src_nat_rule", "true");
    _context.put("has_isolation_fw_rule", "true");
    _context.put("has_service_tcp_80", "true");
    _resource.setMockContext(_context);
    _resource.configure("PaloAltoResource", _resourceParams);
    long vlanId = 3954;
    List<FirewallRuleTO> rules = new ArrayList<FirewallRuleTO>();
    List<String> cidrList = new ArrayList<String>();
    cidrList.add("0.0.0.0/0");
    FirewallRuleTO active = new FirewallRuleTO(8, null, "192.168.80.103", "tcp", 80, 80, false, false, FirewallRule.Purpose.Firewall, cidrList, null, null);
    rules.add(active);
    SetFirewallRulesCommand cmd = new SetFirewallRulesCommand(rules);
    cmd.setContextParam(NetworkElementCommand.GUEST_VLAN_TAG, Long.toString(vlanId));
    cmd.setContextParam(NetworkElementCommand.GUEST_NETWORK_CIDR, "10.3.96.1/20");
    Answer answer = _resource.executeRequest(cmd);
    assertTrue(answer.getResult());
}

Example 15 with FirewallRuleTO

use of com.cloud.agent.api.to.FirewallRuleTO in project CloudStack-archive by CloudStack-extras.

the class SetFirewallRulesCommand method generateFwRules.

public String[][] generateFwRules() {
    String[][] result = new String[2][];
    Set<String> toAdd = new HashSet<String>();
    for (FirewallRuleTO fwTO : rules) {
        /* example  :  172.16.92.44:tcp:80:80:0.0.0.0/0:,200.16.92.44:tcp:220:220:0.0.0.0/0:, 
		 *  each entry format      <ip>:protocol:srcport:destport:scidr:
		 *  reverted entry format  <ip>:reverted:0:0:0:
		 */
        if (fwTO.revoked() == true) {
            StringBuilder sb = new StringBuilder();
            /* This entry is added just to make sure atleast there will one entry in the list to get the ipaddress */
            sb.append(fwTO.getSrcIp()).append(":reverted:0:0:0:");
            String fwRuleEntry = sb.toString();
            toAdd.add(fwRuleEntry);
            continue;
        }
        List<String> cidr;
        StringBuilder sb = new StringBuilder();
        sb.append(fwTO.getSrcIp()).append(":").append(fwTO.getProtocol()).append(":");
        if ("icmp".compareTo(fwTO.getProtocol()) == 0) {
            sb.append(fwTO.getIcmpType()).append(":").append(fwTO.getIcmpCode()).append(":");
        } else if (fwTO.getStringSrcPortRange() == null)
            sb.append("0:0").append(":");
        else
            sb.append(fwTO.getStringSrcPortRange()).append(":");
        cidr = fwTO.getSourceCidrList();
        if (cidr == null || cidr.isEmpty()) {
            sb.append("0.0.0.0/0");
        } else {
            Boolean firstEntry = true;
            for (String tag : cidr) {
                if (!firstEntry)
                    sb.append("-");
                sb.append(tag);
                firstEntry = false;
            }
        }
        sb.append(":");
        String fwRuleEntry = sb.toString();
        toAdd.add(fwRuleEntry);
    }
    result[0] = toAdd.toArray(new String[toAdd.size()]);
    return result;
}