Examples with NetworkRuleConflictException com.cloud.exception.NetworkRuleConflictException used on opensource projects

Example 71 with NetworkRuleConflictException

use of com.cloud.exception.NetworkRuleConflictException in project cosmic by MissionCriticalCloud.

the class CreateIpForwardingRuleCmd method create.

@Override
public void create() {
    // cidr list parameter is deprecated
    if (cidrlist != null) {
        throw new InvalidParameterValueException("Parameter cidrList is deprecated; if you need to open firewall rule for the specific CIDR, please refer to createFirewallRule command");
    }
    try {
        final StaticNatRule rule = _rulesService.createStaticNatRule(this, getOpenFirewall());
        setEntityId(rule.getId());
        setEntityUuid(rule.getUuid());
    } catch (final NetworkRuleConflictException e) {
        s_logger.info("Unable to create static NAT rule due to ", e);
        throw new ServerApiException(ApiErrorCode.NETWORK_RULE_CONFLICT_ERROR, e.getMessage());
    }
}

Example 72 with NetworkRuleConflictException

use of com.cloud.exception.NetworkRuleConflictException in project cloudstack by apache.

the class LoadBalanceRuleHandler method handleCreateLoadBalancerRuleWithLock.

private LoadBalancer handleCreateLoadBalancerRuleWithLock(final CreateLoadBalancerRuleCmd lb, final Account account, final long networkId) throws InsufficientAddressCapacityException, NetworkRuleConflictException {
    Long ipId = null;
    boolean newIp = false;
    List<LoadBalancerVO> existingLbs = findExistingLoadBalancers(lb.getName(), lb.getSourceIpAddressId(), lb.getAccountId(), lb.getDomainId(), lb.getSourcePortStart());
    if (existingLbs == null) {
        existingLbs = findExistingLoadBalancers(lb.getName(), lb.getSourceIpAddressId(), lb.getAccountId(), lb.getDomainId(), null);
        if (existingLbs == null) {
            if (lb.getSourceIpAddressId() != null) {
                throwExceptionIfSuppliedlLbNameIsNotAssociatedWithIpAddress(lb);
            } else {
                s_logger.debug("Could not find any existing frontend ips for this account for this LB rule, acquiring a new frontent IP for ELB");
                final PublicIp ip = allocDirectIp(account, networkId);
                ipId = ip.getId();
                newIp = true;
            }
        } else {
            ipId = existingLbs.get(0).getSourceIpAddressId();
            s_logger.debug("ELB: Found existing frontend ip for this account for this LB rule " + ipId);
        }
    } else {
        s_logger.warn("ELB: Found existing load balancers matching requested new LB");
        throw new NetworkRuleConflictException("ELB: Found existing load balancers matching requested new LB");
    }
    final IPAddressVO ipAddr = _ipAddressDao.findById(ipId);
    LoadBalancer result = null;
    try {
        lb.setSourceIpAddressId(ipId);
        result = _lbMgr.createPublicLoadBalancer(lb.getXid(), lb.getName(), lb.getDescription(), lb.getSourcePortStart(), lb.getDefaultPortStart(), ipId.longValue(), lb.getProtocol(), lb.getAlgorithm(), false, CallContext.current(), lb.getLbProtocol(), true);
    } catch (final NetworkRuleConflictException e) {
        s_logger.warn("Failed to create LB rule, not continuing with ELB deployment");
        if (newIp) {
            releaseIp(ipId, CallContext.current().getCallingUserId(), account);
        }
        throw e;
    }
    DomainRouterVO elbVm = null;
    if (existingLbs == null) {
        elbVm = findElbVmWithCapacity(ipAddr);
        if (elbVm == null) {
            elbVm = deployLoadBalancerVM(networkId, ipAddr);
            if (elbVm == null) {
                final Network network = _networkModel.getNetwork(networkId);
                s_logger.warn("Failed to deploy a new ELB vm for ip " + ipAddr + " in network " + network + "lb name=" + lb.getName());
                if (newIp) {
                    releaseIp(ipId, CallContext.current().getCallingUserId(), account);
                }
            }
        }
    } else {
        final ElasticLbVmMapVO elbVmMap = _elbVmMapDao.findOneByIp(ipId);
        if (elbVmMap != null) {
            elbVm = _routerDao.findById(elbVmMap.getElbVmId());
        }
    }
    if (elbVm == null) {
        s_logger.warn("No ELB VM can be found or deployed");
        s_logger.warn("Deleting LB since we failed to deploy ELB VM");
        _lbDao.remove(result.getId());
        return null;
    }
    final ElasticLbVmMapVO mapping = new ElasticLbVmMapVO(ipId, elbVm.getId(), result.getId());
    _elbVmMapDao.persist(mapping);
    return result;
}

Example 73 with NetworkRuleConflictException

use of com.cloud.exception.NetworkRuleConflictException in project cloudstack by apache.

the class VpcManagerImpl method createStaticRoute.

@Override
@DB
@ActionEvent(eventType = EventTypes.EVENT_STATIC_ROUTE_CREATE, eventDescription = "creating static route", create = true)
public StaticRoute createStaticRoute(final long gatewayId, final String cidr) throws NetworkRuleConflictException {
    final Account caller = CallContext.current().getCallingAccount();
    // parameters validation
    final VpcGateway gateway = _vpcGatewayDao.findById(gatewayId);
    if (gateway == null) {
        throw new InvalidParameterValueException("Invalid gateway id is given");
    }
    if (gateway.getState() != VpcGateway.State.Ready) {
        throw new InvalidParameterValueException("Gateway is not in the " + VpcGateway.State.Ready + " state: " + gateway.getState());
    }
    final Vpc vpc = getActiveVpc(gateway.getVpcId());
    if (vpc == null) {
        throw new InvalidParameterValueException("Can't add static route to VPC that is being deleted");
    }
    _accountMgr.checkAccess(caller, null, false, vpc);
    if (!NetUtils.isValidIp4Cidr(cidr)) {
        throw new InvalidParameterValueException("Invalid format for cidr " + cidr);
    }
    // 1) CIDR should be outside of VPC cidr for guest networks
    if (NetUtils.isNetworksOverlap(vpc.getCidr(), cidr)) {
        throw new InvalidParameterValueException("CIDR should be outside of VPC cidr " + vpc.getCidr());
    }
    // 2) CIDR should be outside of link-local cidr
    if (NetUtils.isNetworksOverlap(vpc.getCidr(), NetUtils.getLinkLocalCIDR())) {
        throw new InvalidParameterValueException("CIDR should be outside of link local cidr " + NetUtils.getLinkLocalCIDR());
    }
    // 3) Verify against denied routes
    if (isCidrDenylisted(cidr, vpc.getZoneId())) {
        throw new InvalidParameterValueException("The static gateway cidr overlaps with one of the denied routes of the zone the VPC belongs to");
    }
    return Transaction.execute(new TransactionCallbackWithException<StaticRouteVO, NetworkRuleConflictException>() {

        @Override
        public StaticRouteVO doInTransaction(final TransactionStatus status) throws NetworkRuleConflictException {
            StaticRouteVO newRoute = new StaticRouteVO(gateway.getId(), cidr, vpc.getId(), vpc.getAccountId(), vpc.getDomainId());
            s_logger.debug("Adding static route " + newRoute);
            newRoute = _staticRouteDao.persist(newRoute);
            detectRoutesConflict(newRoute);
            if (!_staticRouteDao.setStateToAdd(newRoute)) {
                throw new CloudRuntimeException("Unable to update the state to add for " + newRoute);
            }
            CallContext.current().setEventDetails("Static route Id: " + newRoute.getId());
            return newRoute;
        }
    });
}

Example 74 with NetworkRuleConflictException

use of com.cloud.exception.NetworkRuleConflictException in project cloudstack by apache.

the class RemoteAccessVpnManagerImpl method createRemoteAccessVpn.

@Override
@DB
public RemoteAccessVpn createRemoteAccessVpn(final long publicIpId, String ipRange, boolean openFirewall, final Boolean forDisplay) throws NetworkRuleConflictException {
    CallContext ctx = CallContext.current();
    final Account caller = ctx.getCallingAccount();
    final PublicIpAddress ipAddr = _networkMgr.getPublicIpAddress(publicIpId);
    if (ipAddr == null) {
        throw new InvalidParameterValueException(String.format("Unable to create remote access VPN, invalid public IP address {\"id\": %s}.", publicIpId));
    }
    _accountMgr.checkAccess(caller, null, true, ipAddr);
    if (!ipAddr.readyToUse()) {
        throw new InvalidParameterValueException("The Ip address is not ready to be used yet: " + ipAddr.getAddress());
    }
    IPAddressVO ipAddress = _ipAddressDao.findById(publicIpId);
    Long networkId = ipAddress.getAssociatedWithNetworkId();
    if (networkId != null) {
        _networkMgr.checkIpForService(ipAddress, Service.Vpn, null);
    }
    final Long vpcId = ipAddress.getVpcId();
    if (vpcId != null && ipAddress.isSourceNat()) {
        assert networkId == null;
        openFirewall = false;
    }
    final boolean openFirewallFinal = openFirewall;
    if (networkId == null && vpcId == null) {
        throw new InvalidParameterValueException("Unable to create remote access vpn for the ipAddress: " + ipAddr.getAddress().addr() + " as ip is not associated with any network or VPC");
    }
    RemoteAccessVpnVO vpnVO = _remoteAccessVpnDao.findByPublicIpAddress(publicIpId);
    if (vpnVO != null) {
        if (vpnVO.getState() == RemoteAccessVpn.State.Added) {
            return vpnVO;
        }
        throw new InvalidParameterValueException(String.format("A remote Access VPN already exists for the public IP address [%s].", ipAddr.getAddress().toString()));
    }
    if (ipRange == null) {
        ipRange = RemoteAccessVpnClientIpRange.valueIn(ipAddr.getAccountId());
    }
    validateIpRange(ipRange, InvalidParameterValueException.class);
    String[] range = ipRange.split("-");
    Pair<String, Integer> cidr = null;
    if (networkId != null) {
        long ipAddressOwner = ipAddr.getAccountId();
        vpnVO = _remoteAccessVpnDao.findByAccountAndNetwork(ipAddressOwner, networkId);
        if (vpnVO != null) {
            if (vpnVO.getState() == RemoteAccessVpn.State.Added) {
                return vpnVO;
            }
            throw new InvalidParameterValueException(String.format("A remote access VPN already exists for the account [%s].", ipAddressOwner));
        }
        Network network = _networkMgr.getNetwork(networkId);
        if (!_networkMgr.areServicesSupportedInNetwork(network.getId(), Service.Vpn)) {
            throw new InvalidParameterValueException("Vpn service is not supported in network id=" + ipAddr.getAssociatedWithNetworkId());
        }
        cidr = NetUtils.getCidr(network.getCidr());
    } else {
        Vpc vpc = _vpcDao.findById(vpcId);
        cidr = NetUtils.getCidr(vpc.getCidr());
    }
    String[] guestIpRange = NetUtils.getIpRangeFromCidr(cidr.first(), cidr.second());
    if (NetUtils.ipRangesOverlap(range[0], range[1], guestIpRange[0], guestIpRange[1])) {
        throw new InvalidParameterValueException("Invalid ip range: " + ipRange + " overlaps with guest ip range " + guestIpRange[0] + "-" + guestIpRange[1]);
    }
    long startIp = NetUtils.ip2Long(range[0]);
    final String newIpRange = NetUtils.long2Ip(++startIp) + "-" + range[1];
    final String sharedSecret = PasswordGenerator.generatePresharedKey(_pskLength);
    return Transaction.execute(new TransactionCallbackWithException<RemoteAccessVpn, NetworkRuleConflictException>() {

        @Override
        public RemoteAccessVpn doInTransaction(TransactionStatus status) throws NetworkRuleConflictException {
            if (vpcId == null) {
                _rulesMgr.reservePorts(ipAddr, NetUtils.UDP_PROTO, Purpose.Vpn, openFirewallFinal, caller, NetUtils.VPN_PORT, NetUtils.VPN_L2TP_PORT, NetUtils.VPN_NATT_PORT);
            }
            RemoteAccessVpnVO vpnVO = new RemoteAccessVpnVO(ipAddr.getAccountId(), ipAddr.getDomainId(), ipAddr.getAssociatedWithNetworkId(), publicIpId, vpcId, range[0], newIpRange, sharedSecret);
            if (forDisplay != null) {
                vpnVO.setDisplay(forDisplay);
            }
            return _remoteAccessVpnDao.persist(vpnVO);
        }
    });
}

Example 75 with NetworkRuleConflictException

use of com.cloud.exception.NetworkRuleConflictException in project cloudstack by apache.

the class KubernetesClusterStartWorker method createFirewallRules.

private void createFirewallRules(IpAddress publicIp, List<Long> clusterVMIds) throws ManagementServerException {
    // Firewall rule fo API access for control node VMs
    try {
        provisionFirewallRules(publicIp, owner, CLUSTER_API_PORT, CLUSTER_API_PORT);
        if (LOGGER.isInfoEnabled()) {
            LOGGER.info(String.format("Provisioned firewall rule to open up port %d on %s for Kubernetes cluster %s", CLUSTER_API_PORT, publicIp.getAddress().addr(), kubernetesCluster.getName()));
        }
    } catch (NoSuchFieldException | IllegalAccessException | ResourceUnavailableException | NetworkRuleConflictException e) {
        throw new ManagementServerException(String.format("Failed to provision firewall rules for API access for the Kubernetes cluster : %s", kubernetesCluster.getName()), e);
    }
    // Firewall rule fo SSH access on each node VM
    try {
        int endPort = CLUSTER_NODES_DEFAULT_START_SSH_PORT + clusterVMIds.size() - 1;
        provisionFirewallRules(publicIp, owner, CLUSTER_NODES_DEFAULT_START_SSH_PORT, endPort);
        if (LOGGER.isInfoEnabled()) {
            LOGGER.info(String.format("Provisioned firewall rule to open up port %d to %d on %s for Kubernetes cluster : %s", CLUSTER_NODES_DEFAULT_START_SSH_PORT, endPort, publicIp.getAddress().addr(), kubernetesCluster.getName()));
        }
    } catch (NoSuchFieldException | IllegalAccessException | ResourceUnavailableException | NetworkRuleConflictException e) {
        throw new ManagementServerException(String.format("Failed to provision firewall rules for SSH access for the Kubernetes cluster : %s", kubernetesCluster.getName()), e);
    }
}