Examples with PermissionDeniedException com.cloud.exception.PermissionDeniedException used on opensource projects

Example 66 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class ResourceManagerImpl method discoverCluster.

@DB
@Override
public List<? extends Cluster> discoverCluster(final AddClusterCmd cmd) throws IllegalArgumentException, DiscoveryException, ResourceInUseException {
    final long dcId = cmd.getZoneId();
    final long podId = cmd.getPodId();
    final String clusterName = cmd.getClusterName();
    String url = cmd.getUrl();
    final String username = cmd.getUsername();
    final String password = cmd.getPassword();
    if (url != null) {
        url = URLDecoder.decode(url);
    }
    URI uri = null;
    // Check if the zone exists in the system
    final DataCenterVO zone = _dcDao.findById(dcId);
    if (zone == null) {
        final InvalidParameterValueException ex = new InvalidParameterValueException("Can't find zone by the id specified");
        ex.addProxyObject(String.valueOf(dcId), "dcId");
        throw ex;
    }
    final Account account = CallContext.current().getCallingAccount();
    if (Grouping.AllocationState.Disabled == zone.getAllocationState() && !_accountMgr.isRootAdmin(account.getId())) {
        final PermissionDeniedException ex = new PermissionDeniedException("Cannot perform this operation, Zone with specified id is currently disabled");
        ex.addProxyObject(zone.getUuid(), "dcId");
        throw ex;
    }
    final HostPodVO pod = _podDao.findById(podId);
    if (pod == null) {
        throw new InvalidParameterValueException("Can't find pod with specified podId " + podId);
    }
    // Check if the pod exists in the system
    if (_podDao.findById(podId) == null) {
        throw new InvalidParameterValueException("Can't find pod by id " + podId);
    }
    // check if pod belongs to the zone
    if (!Long.valueOf(pod.getDataCenterId()).equals(dcId)) {
        final InvalidParameterValueException ex = new InvalidParameterValueException("Pod with specified id doesn't belong to the zone " + dcId);
        ex.addProxyObject(pod.getUuid(), "podId");
        ex.addProxyObject(zone.getUuid(), "dcId");
        throw ex;
    }
    // Verify cluster information and create a new cluster if needed
    if (clusterName == null || clusterName.isEmpty()) {
        throw new InvalidParameterValueException("Please specify cluster name");
    }
    if (cmd.getHypervisor() == null || cmd.getHypervisor().isEmpty()) {
        throw new InvalidParameterValueException("Please specify a hypervisor");
    }
    final Hypervisor.HypervisorType hypervisorType = Hypervisor.HypervisorType.getType(cmd.getHypervisor());
    if (hypervisorType == null) {
        s_logger.error("Unable to resolve " + cmd.getHypervisor() + " to a valid supported hypervisor type");
        throw new InvalidParameterValueException("Unable to resolve " + cmd.getHypervisor() + " to a supported ");
    }
    if (zone.isSecurityGroupEnabled() && zone.getNetworkType().equals(NetworkType.Advanced)) {
        if (hypervisorType != HypervisorType.KVM && hypervisorType != HypervisorType.XenServer && hypervisorType != HypervisorType.LXC && hypervisorType != HypervisorType.Simulator) {
            throw new InvalidParameterValueException("Don't support hypervisor type " + hypervisorType + " in advanced security enabled zone");
        }
    }
    Cluster.ClusterType clusterType = null;
    if (cmd.getClusterType() != null && !cmd.getClusterType().isEmpty()) {
        clusterType = Cluster.ClusterType.valueOf(cmd.getClusterType());
    }
    if (clusterType == null) {
        clusterType = Cluster.ClusterType.CloudManaged;
    }
    Grouping.AllocationState allocationState = null;
    if (cmd.getAllocationState() != null && !cmd.getAllocationState().isEmpty()) {
        try {
            allocationState = Grouping.AllocationState.valueOf(cmd.getAllocationState());
        } catch (final IllegalArgumentException ex) {
            throw new InvalidParameterValueException("Unable to resolve Allocation State '" + cmd.getAllocationState() + "' to a supported state");
        }
    }
    if (allocationState == null) {
        allocationState = Grouping.AllocationState.Enabled;
    }
    final Discoverer discoverer = getMatchingDiscover(hypervisorType);
    if (discoverer == null) {
        throw new InvalidParameterValueException("Could not find corresponding resource manager for " + cmd.getHypervisor());
    }
    if (hypervisorType == HypervisorType.VMware) {
        final Map<String, String> allParams = cmd.getFullUrlParams();
        discoverer.putParam(allParams);
    }
    final List<ClusterVO> result = new ArrayList<ClusterVO>();
    ClusterVO cluster = new ClusterVO(dcId, podId, clusterName);
    cluster.setHypervisorType(hypervisorType.toString());
    cluster.setClusterType(clusterType);
    cluster.setAllocationState(allocationState);
    try {
        cluster = _clusterDao.persist(cluster);
    } catch (final Exception e) {
        // no longer tolerate exception during the cluster creation phase
        final CloudRuntimeException ex = new CloudRuntimeException("Unable to create cluster " + clusterName + " in pod and data center with specified ids", e);
        // Get the pod VO object's table name.
        ex.addProxyObject(pod.getUuid(), "podId");
        ex.addProxyObject(zone.getUuid(), "dcId");
        throw ex;
    }
    result.add(cluster);
    if (clusterType == Cluster.ClusterType.CloudManaged) {
        final Map<String, String> details = new HashMap<String, String>();
        // should do this nicer perhaps ?
        if (hypervisorType == HypervisorType.Ovm3) {
            final Map<String, String> allParams = cmd.getFullUrlParams();
            details.put("ovm3vip", allParams.get("ovm3vip"));
            details.put("ovm3pool", allParams.get("ovm3pool"));
            details.put("ovm3cluster", allParams.get("ovm3cluster"));
        }
        details.put("cpuOvercommitRatio", CapacityManager.CpuOverprovisioningFactor.value().toString());
        details.put("memoryOvercommitRatio", CapacityManager.MemOverprovisioningFactor.value().toString());
        _clusterDetailsDao.persist(cluster.getId(), details);
        return result;
    }
    // save cluster details for later cluster/host cross-checking
    final Map<String, String> details = new HashMap<String, String>();
    details.put("url", url);
    details.put("username", username);
    details.put("password", password);
    details.put("cpuOvercommitRatio", CapacityManager.CpuOverprovisioningFactor.value().toString());
    details.put("memoryOvercommitRatio", CapacityManager.MemOverprovisioningFactor.value().toString());
    _clusterDetailsDao.persist(cluster.getId(), details);
    boolean success = false;
    try {
        try {
            uri = new URI(UriUtils.encodeURIComponent(url));
            if (uri.getScheme() == null) {
                throw new InvalidParameterValueException("uri.scheme is null " + url + ", add http:// as a prefix");
            } else if (uri.getScheme().equalsIgnoreCase("http")) {
                if (uri.getHost() == null || uri.getHost().equalsIgnoreCase("") || uri.getPath() == null || uri.getPath().equalsIgnoreCase("")) {
                    throw new InvalidParameterValueException("Your host and/or path is wrong.  Make sure it's of the format http://hostname/path");
                }
            }
        } catch (final URISyntaxException e) {
            throw new InvalidParameterValueException(url + " is not a valid uri");
        }
        final List<HostVO> hosts = new ArrayList<HostVO>();
        Map<? extends ServerResource, Map<String, String>> resources = null;
        resources = discoverer.find(dcId, podId, cluster.getId(), uri, username, password, null);
        if (resources != null) {
            for (final Map.Entry<? extends ServerResource, Map<String, String>> entry : resources.entrySet()) {
                final ServerResource resource = entry.getKey();
                final HostVO host = (HostVO) createHostAndAgent(resource, entry.getValue(), true, null, false);
                if (host != null) {
                    hosts.add(host);
                }
                discoverer.postDiscovery(hosts, _nodeId);
            }
            s_logger.info("External cluster has been successfully discovered by " + discoverer.getName());
            success = true;
            return result;
        }
        s_logger.warn("Unable to find the server resources at " + url);
        throw new DiscoveryException("Unable to add the external cluster");
    } finally {
        if (!success) {
            _clusterDetailsDao.deleteDetails(cluster.getId());
            _clusterDao.remove(cluster.getId());
        }
    }
}

Example 67 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class ApiServer method handleRequest.

@Override
@SuppressWarnings("rawtypes")
public String handleRequest(final Map params, final String responseType, final StringBuilder auditTrailSb) throws ServerApiException {
    checkCharacterInkParams(params);
    String response = null;
    String[] command = null;
    try {
        command = (String[]) params.get("command");
        if (command == null) {
            s_logger.error("invalid request, no command sent");
            if (s_logger.isTraceEnabled()) {
                s_logger.trace("dumping request parameters");
                for (final Object key : params.keySet()) {
                    final String keyStr = (String) key;
                    final String[] value = (String[]) params.get(key);
                    s_logger.trace("   key: " + keyStr + ", value: " + ((value == null) ? "'null'" : value[0]));
                }
            }
            throw new ServerApiException(ApiErrorCode.UNSUPPORTED_ACTION_ERROR, "Invalid request, no command sent");
        } else {
            // Don't allow Login/Logout APIs to go past this point
            if (authManager.getAPIAuthenticator(command[0]) != null) {
                return null;
            }
            final Map<String, String> paramMap = new HashMap<String, String>();
            final Set keys = params.keySet();
            final Iterator keysIter = keys.iterator();
            while (keysIter.hasNext()) {
                final String key = (String) keysIter.next();
                if ("command".equalsIgnoreCase(key)) {
                    continue;
                }
                final String[] value = (String[]) params.get(key);
                paramMap.put(key, value[0]);
            }
            Class<?> cmdClass = getCmdClass(command[0]);
            if (cmdClass != null) {
                APICommand annotation = cmdClass.getAnnotation(APICommand.class);
                if (annotation == null) {
                    s_logger.error("No APICommand annotation found for class " + cmdClass.getCanonicalName());
                    throw new CloudRuntimeException("No APICommand annotation found for class " + cmdClass.getCanonicalName());
                }
                BaseCmd cmdObj = (BaseCmd) cmdClass.newInstance();
                cmdObj = ComponentContext.inject(cmdObj);
                cmdObj.configure();
                cmdObj.setFullUrlParams(paramMap);
                cmdObj.setResponseType(responseType);
                cmdObj.setHttpMethod(paramMap.get(ApiConstants.HTTPMETHOD).toString());
                // This is where the command is either serialized, or directly dispatched
                StringBuilder log = new StringBuilder();
                response = queueCommand(cmdObj, paramMap, log);
                buildAuditTrail(auditTrailSb, command[0], log.toString());
            } else {
                final String errorString = "Unknown API command: " + command[0];
                s_logger.warn(errorString);
                auditTrailSb.append(" " + errorString);
                throw new ServerApiException(ApiErrorCode.UNSUPPORTED_ACTION_ERROR, errorString);
            }
        }
    } catch (final InvalidParameterValueException ex) {
        s_logger.info(ex.getMessage());
        throw new ServerApiException(ApiErrorCode.PARAM_ERROR, ex.getMessage(), ex);
    } catch (final IllegalArgumentException ex) {
        s_logger.info(ex.getMessage());
        throw new ServerApiException(ApiErrorCode.PARAM_ERROR, ex.getMessage(), ex);
    } catch (final PermissionDeniedException ex) {
        final ArrayList<ExceptionProxyObject> idList = ex.getIdProxyList();
        if (idList != null) {
            final StringBuffer buf = new StringBuffer();
            for (final ExceptionProxyObject obj : idList) {
                buf.append(obj.getDescription());
                buf.append(":");
                buf.append(obj.getUuid());
                buf.append(" ");
            }
            s_logger.info("PermissionDenied: " + ex.getMessage() + " on objs: [" + buf.toString() + "]");
        } else {
            s_logger.info("PermissionDenied: " + ex.getMessage());
        }
        throw new ServerApiException(ApiErrorCode.ACCOUNT_ERROR, ex.getMessage(), ex);
    } catch (final AccountLimitException ex) {
        s_logger.info(ex.getMessage());
        throw new ServerApiException(ApiErrorCode.ACCOUNT_RESOURCE_LIMIT_ERROR, ex.getMessage(), ex);
    } catch (final InsufficientCapacityException ex) {
        s_logger.info(ex.getMessage());
        String errorMsg = ex.getMessage();
        if (!accountMgr.isRootAdmin(CallContext.current().getCallingAccount().getId())) {
            // hide internal details to non-admin user for security reason
            errorMsg = BaseCmd.USER_ERROR_MESSAGE;
        }
        throw new ServerApiException(ApiErrorCode.INSUFFICIENT_CAPACITY_ERROR, errorMsg, ex);
    } catch (final ResourceAllocationException ex) {
        s_logger.info(ex.getMessage());
        throw new ServerApiException(ApiErrorCode.RESOURCE_ALLOCATION_ERROR, ex.getMessage(), ex);
    } catch (final ResourceUnavailableException ex) {
        s_logger.info(ex.getMessage());
        String errorMsg = ex.getMessage();
        if (!accountMgr.isRootAdmin(CallContext.current().getCallingAccount().getId())) {
            // hide internal details to non-admin user for security reason
            errorMsg = BaseCmd.USER_ERROR_MESSAGE;
        }
        throw new ServerApiException(ApiErrorCode.RESOURCE_UNAVAILABLE_ERROR, errorMsg, ex);
    } catch (final ServerApiException ex) {
        s_logger.info(ex.getDescription());
        throw ex;
    } catch (final Exception ex) {
        s_logger.error("unhandled exception executing api command: " + ((command == null) ? "null" : command), ex);
        String errorMsg = ex.getMessage();
        if (!accountMgr.isRootAdmin(CallContext.current().getCallingAccount().getId())) {
            // hide internal details to non-admin user for security reason
            errorMsg = BaseCmd.USER_ERROR_MESSAGE;
        }
        throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, errorMsg, ex);
    }
    return response;
}

Example 68 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class TemplateAdapterBase method prepare.

@Override
public TemplateProfile prepare(boolean isIso, long userId, String name, String displayText, Integer bits, Boolean passwordEnabled, Boolean requiresHVM, String url, Boolean isPublic, Boolean featured, Boolean isExtractable, String format, Long guestOSId, Long zoneId, HypervisorType hypervisorType, String chksum, Boolean bootable, String templateTag, Account templateOwner, Map details, Boolean sshkeyEnabled, String imageStoreUuid, Boolean isDynamicallyScalable, TemplateType templateType) throws ResourceAllocationException {
    if (isPublic == null) {
        isPublic = Boolean.FALSE;
    }
    if (zoneId.longValue() == -1) {
        zoneId = null;
    }
    if (isIso) {
        if (bootable == null) {
            bootable = Boolean.TRUE;
        }
        GuestOS noneGuestOs = ApiDBUtils.findGuestOSByDisplayName(ApiConstants.ISO_GUEST_OS_NONE);
        if ((guestOSId == null || guestOSId == noneGuestOs.getId()) && bootable == true) {
            throw new InvalidParameterValueException("Please pass a valid GuestOS Id");
        }
        if (bootable == false) {
            //Guest os id of None.
            guestOSId = noneGuestOs.getId();
        }
    } else {
        if (bits == null) {
            bits = Integer.valueOf(64);
        }
        if (passwordEnabled == null) {
            passwordEnabled = false;
        }
        if (requiresHVM == null) {
            requiresHVM = true;
        }
    }
    if (isExtractable == null) {
        isExtractable = Boolean.FALSE;
    }
    if (sshkeyEnabled == null) {
        sshkeyEnabled = Boolean.FALSE;
    }
    boolean isAdmin = _accountMgr.isRootAdmin(templateOwner.getId());
    boolean isRegionStore = false;
    List<ImageStoreVO> stores = _imgStoreDao.findRegionImageStores();
    if (stores != null && stores.size() > 0) {
        isRegionStore = true;
    }
    if (!isAdmin && zoneId == null && !isRegionStore) {
        // domain admin and user should also be able to register template on a region store
        throw new InvalidParameterValueException("Please specify a valid zone Id. Only admins can create templates in all zones.");
    }
    // check for the url format only when url is not null. url can be null incase of form based upload
    if (url != null && url.toLowerCase().contains("file://")) {
        throw new InvalidParameterValueException("File:// type urls are currently unsupported");
    }
    // check whether owner can create public templates
    boolean allowPublicUserTemplates = TemplateManager.AllowPublicUserTemplates.valueIn(templateOwner.getId());
    if (!isAdmin && !allowPublicUserTemplates && isPublic) {
        throw new InvalidParameterValueException("Only private templates/ISO can be created.");
    }
    if (!isAdmin || featured == null) {
        featured = Boolean.FALSE;
    }
    ImageFormat imgfmt;
    try {
        imgfmt = ImageFormat.valueOf(format.toUpperCase());
    } catch (IllegalArgumentException e) {
        s_logger.debug("ImageFormat IllegalArgumentException: " + e.getMessage());
        throw new IllegalArgumentException("Image format: " + format + " is incorrect. Supported formats are " + EnumUtils.listValues(ImageFormat.values()));
    }
    // Check that the resource limit for templates/ISOs won't be exceeded
    UserVO user = _userDao.findById(userId);
    if (user == null) {
        throw new IllegalArgumentException("Unable to find user with id " + userId);
    }
    _resourceLimitMgr.checkResourceLimit(templateOwner, ResourceType.template);
    // If a zoneId is specified, make sure it is valid
    if (zoneId != null) {
        DataCenterVO zone = _dcDao.findById(zoneId);
        if (zone == null) {
            throw new IllegalArgumentException("Please specify a valid zone.");
        }
        Account caller = CallContext.current().getCallingAccount();
        if (Grouping.AllocationState.Disabled == zone.getAllocationState() && !_accountMgr.isRootAdmin(caller.getId())) {
            throw new PermissionDeniedException("Cannot perform this operation, Zone is currently disabled: " + zoneId);
        }
    }
    List<VMTemplateVO> systemvmTmplts = _tmpltDao.listAllSystemVMTemplates();
    for (VMTemplateVO template : systemvmTmplts) {
        if (template.getName().equalsIgnoreCase(name) || template.getDisplayText().equalsIgnoreCase(displayText)) {
            throw new IllegalArgumentException("Cannot use reserved names for templates");
        }
    }
    if (hypervisorType.equals(Hypervisor.HypervisorType.XenServer)) {
        if (details == null || !details.containsKey("hypervisortoolsversion") || details.get("hypervisortoolsversion") == null || ((String) details.get("hypervisortoolsversion")).equalsIgnoreCase("none")) {
            String hpvs = _configDao.getValue(Config.XenServerPVdriverVersion.key());
            if (hpvs != null) {
                if (details == null) {
                    details = new HashMap<String, String>();
                }
                details.put("hypervisortoolsversion", hpvs);
            }
        }
    }
    Long id = _tmpltDao.getNextInSequence(Long.class, "id");
    CallContext.current().setEventDetails("Id: " + id + " name: " + name);
    return new TemplateProfile(id, userId, name, displayText, bits, passwordEnabled, requiresHVM, url, isPublic, featured, isExtractable, imgfmt, guestOSId, zoneId, hypervisorType, templateOwner.getAccountName(), templateOwner.getDomainId(), templateOwner.getAccountId(), chksum, bootable, templateTag, details, sshkeyEnabled, null, isDynamicallyScalable, templateType);
}

Example 69 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class NetworkServiceImpl method createGuestNetwork.

@Override
@DB
@ActionEvent(eventType = EventTypes.EVENT_NETWORK_CREATE, eventDescription = "creating network")
public Network createGuestNetwork(CreateNetworkCmd cmd) throws InsufficientCapacityException, ConcurrentOperationException, ResourceAllocationException {
    Long networkOfferingId = cmd.getNetworkOfferingId();
    String gateway = cmd.getGateway();
    String startIP = cmd.getStartIp();
    String endIP = cmd.getEndIp();
    String netmask = cmd.getNetmask();
    String networkDomain = cmd.getNetworkDomain();
    String vlanId = null;
    if (cmd instanceof CreateNetworkCmdByAdmin) {
        vlanId = ((CreateNetworkCmdByAdmin) cmd).getVlan();
    }
    String name = cmd.getNetworkName();
    String displayText = cmd.getDisplayText();
    Account caller = CallContext.current().getCallingAccount();
    Long physicalNetworkId = cmd.getPhysicalNetworkId();
    Long zoneId = cmd.getZoneId();
    String aclTypeStr = cmd.getAclType();
    Long domainId = cmd.getDomainId();
    boolean isDomainSpecific = false;
    Boolean subdomainAccess = cmd.getSubdomainAccess();
    Long vpcId = cmd.getVpcId();
    String startIPv6 = cmd.getStartIpv6();
    String endIPv6 = cmd.getEndIpv6();
    String ip6Gateway = cmd.getIp6Gateway();
    String ip6Cidr = cmd.getIp6Cidr();
    Boolean displayNetwork = cmd.getDisplayNetwork();
    Long aclId = cmd.getAclId();
    String isolatedPvlan = cmd.getIsolatedPvlan();
    // Validate network offering
    NetworkOfferingVO ntwkOff = _networkOfferingDao.findById(networkOfferingId);
    if (ntwkOff == null || ntwkOff.isSystemOnly()) {
        InvalidParameterValueException ex = new InvalidParameterValueException("Unable to find network offering by specified id");
        if (ntwkOff != null) {
            ex.addProxyObject(ntwkOff.getUuid(), "networkOfferingId");
        }
        throw ex;
    }
    // validate physical network and zone
    // Check if physical network exists
    PhysicalNetwork pNtwk = null;
    if (physicalNetworkId != null) {
        pNtwk = _physicalNetworkDao.findById(physicalNetworkId);
        if (pNtwk == null) {
            throw new InvalidParameterValueException("Unable to find a physical network having the specified physical network id");
        }
    }
    if (zoneId == null) {
        zoneId = pNtwk.getDataCenterId();
    }
    if (displayNetwork == null) {
        displayNetwork = true;
    }
    DataCenter zone = _dcDao.findById(zoneId);
    if (zone == null) {
        throw new InvalidParameterValueException("Specified zone id was not found");
    }
    if (Grouping.AllocationState.Disabled == zone.getAllocationState() && !_accountMgr.isRootAdmin(caller.getId())) {
        // See DataCenterVO.java
        PermissionDeniedException ex = new PermissionDeniedException("Cannot perform this operation since specified Zone is currently disabled");
        ex.addProxyObject(zone.getUuid(), "zoneId");
        throw ex;
    }
    // Only domain and account ACL types are supported in Acton.
    ACLType aclType = null;
    if (aclTypeStr != null) {
        if (aclTypeStr.equalsIgnoreCase(ACLType.Account.toString())) {
            aclType = ACLType.Account;
        } else if (aclTypeStr.equalsIgnoreCase(ACLType.Domain.toString())) {
            aclType = ACLType.Domain;
        } else {
            throw new InvalidParameterValueException("Incorrect aclType specified. Check the API documentation for supported types");
        }
        // In 3.0 all Shared networks should have aclType == Domain, all Isolated networks aclType==Account
        if (ntwkOff.getGuestType() == GuestType.Isolated) {
            if (aclType != ACLType.Account) {
                throw new InvalidParameterValueException("AclType should be " + ACLType.Account + " for network of type " + Network.GuestType.Isolated);
            }
        } else if (ntwkOff.getGuestType() == GuestType.Shared) {
            if (!(aclType == ACLType.Domain || aclType == ACLType.Account)) {
                throw new InvalidParameterValueException("AclType should be " + ACLType.Domain + " or " + ACLType.Account + " for network of type " + Network.GuestType.Shared);
            }
        }
    } else {
        if (ntwkOff.getGuestType() == GuestType.Isolated) {
            aclType = ACLType.Account;
        } else if (ntwkOff.getGuestType() == GuestType.Shared) {
            aclType = ACLType.Domain;
        }
    }
    // Only Admin can create Shared networks
    if (ntwkOff.getGuestType() == GuestType.Shared && !_accountMgr.isAdmin(caller.getId())) {
        throw new InvalidParameterValueException("Only Admins can create network with guest type " + GuestType.Shared);
    }
    // Check if the network is domain specific
    if (aclType == ACLType.Domain) {
        // only Admin can create domain with aclType=Domain
        if (!_accountMgr.isAdmin(caller.getId())) {
            throw new PermissionDeniedException("Only admin can create networks with aclType=Domain");
        }
        // only shared networks can be Domain specific
        if (ntwkOff.getGuestType() != GuestType.Shared) {
            throw new InvalidParameterValueException("Only " + GuestType.Shared + " networks can have aclType=" + ACLType.Domain);
        }
        if (domainId != null) {
            if (ntwkOff.getTrafficType() != TrafficType.Guest || ntwkOff.getGuestType() != Network.GuestType.Shared) {
                throw new InvalidParameterValueException("Domain level networks are supported just for traffic type " + TrafficType.Guest + " and guest type " + Network.GuestType.Shared);
            }
            DomainVO domain = _domainDao.findById(domainId);
            if (domain == null) {
                throw new InvalidParameterValueException("Unable to find domain by specified id");
            }
            _accountMgr.checkAccess(caller, domain);
        }
        isDomainSpecific = true;
    } else if (subdomainAccess != null) {
        throw new InvalidParameterValueException("Parameter subDomainAccess can be specified only with aclType=Domain");
    }
    Account owner = null;
    if ((cmd.getAccountName() != null && domainId != null) || cmd.getProjectId() != null) {
        owner = _accountMgr.finalizeOwner(caller, cmd.getAccountName(), domainId, cmd.getProjectId());
    } else {
        owner = caller;
    }
    boolean ipv4 = true, ipv6 = false;
    if (startIP != null) {
        ipv4 = true;
    }
    if (startIPv6 != null) {
        ipv6 = true;
    }
    if (gateway != null) {
        try {
            // getByName on a literal representation will only check validity of the address
            // http://docs.oracle.com/javase/6/docs/api/java/net/InetAddress.html#getByName(java.lang.String)
            InetAddress gatewayAddress = InetAddress.getByName(gateway);
            if (gatewayAddress instanceof Inet6Address) {
                ipv6 = true;
            } else {
                ipv4 = true;
            }
        } catch (UnknownHostException e) {
            s_logger.error("Unable to convert gateway IP to a InetAddress", e);
            throw new InvalidParameterValueException("Gateway parameter is invalid");
        }
    }
    String cidr = null;
    if (ipv4) {
        // if end ip is not specified, default it to startIp
        if (startIP != null) {
            if (!NetUtils.isValidIp(startIP)) {
                throw new InvalidParameterValueException("Invalid format for the startIp parameter");
            }
            if (endIP == null) {
                endIP = startIP;
            } else if (!NetUtils.isValidIp(endIP)) {
                throw new InvalidParameterValueException("Invalid format for the endIp parameter");
            }
        }
        if (startIP != null && endIP != null) {
            if (!(gateway != null && netmask != null)) {
                throw new InvalidParameterValueException("gateway and netmask should be defined when startIP/endIP are passed in");
            }
        }
        if (gateway != null && netmask != null) {
            if (NetUtils.isNetworkorBroadcastIP(gateway, netmask)) {
                if (s_logger.isDebugEnabled()) {
                    s_logger.debug("The gateway IP provided is " + gateway + " and netmask is " + netmask + ". The IP is either broadcast or network IP.");
                }
                throw new InvalidParameterValueException("Invalid gateway IP provided. Either the IP is broadcast or network IP.");
            }
            if (!NetUtils.isValidIp(gateway)) {
                throw new InvalidParameterValueException("Invalid gateway");
            }
            if (!NetUtils.isValidNetmask(netmask)) {
                throw new InvalidParameterValueException("Invalid netmask");
            }
            cidr = NetUtils.ipAndNetMaskToCidr(gateway, netmask);
        }
    }
    if (ipv6) {
        if (endIPv6 == null) {
            endIPv6 = startIPv6;
        }
        _networkModel.checkIp6Parameters(startIPv6, endIPv6, ip6Gateway, ip6Cidr);
        if (zone.getNetworkType() != NetworkType.Advanced || ntwkOff.getGuestType() != Network.GuestType.Shared) {
            throw new InvalidParameterValueException("Can only support create IPv6 network with advance shared network!");
        }
    }
    if (isolatedPvlan != null && (zone.getNetworkType() != NetworkType.Advanced || ntwkOff.getGuestType() != Network.GuestType.Shared)) {
        throw new InvalidParameterValueException("Can only support create Private VLAN network with advance shared network!");
    }
    if (isolatedPvlan != null && ipv6) {
        throw new InvalidParameterValueException("Can only support create Private VLAN network with IPv4!");
    }
    // Regular user can create Guest Isolated Source Nat enabled network only
    if (_accountMgr.isNormalUser(caller.getId()) && (ntwkOff.getTrafficType() != TrafficType.Guest || ntwkOff.getGuestType() != Network.GuestType.Isolated && areServicesSupportedByNetworkOffering(ntwkOff.getId(), Service.SourceNat))) {
        throw new InvalidParameterValueException("Regular user can create a network only from the network" + " offering having traffic type " + TrafficType.Guest + " and network type " + Network.GuestType.Isolated + " with a service " + Service.SourceNat.getName() + " enabled");
    }
    // Don't allow to specify vlan if the caller is not ROOT admin
    if (!_accountMgr.isRootAdmin(caller.getId()) && (ntwkOff.getSpecifyVlan() || vlanId != null)) {
        throw new InvalidParameterValueException("Only ROOT admin is allowed to specify vlanId");
    }
    if (ipv4) {
        // For non-root admins check cidr limit - if it's allowed by global config value
        if (!_accountMgr.isRootAdmin(caller.getId()) && cidr != null) {
            String[] cidrPair = cidr.split("\\/");
            int cidrSize = Integer.parseInt(cidrPair[1]);
            if (cidrSize < _cidrLimit) {
                throw new InvalidParameterValueException("Cidr size can't be less than " + _cidrLimit);
            }
        }
    }
    Collection<String> ntwkProviders = _networkMgr.finalizeServicesAndProvidersForNetwork(ntwkOff, physicalNetworkId).values();
    if (ipv6 && providersConfiguredForExternalNetworking(ntwkProviders)) {
        throw new InvalidParameterValueException("Cannot support IPv6 on network offering with external devices!");
    }
    if (isolatedPvlan != null && providersConfiguredForExternalNetworking(ntwkProviders)) {
        throw new InvalidParameterValueException("Cannot support private vlan on network offering with external devices!");
    }
    if (cidr != null && providersConfiguredForExternalNetworking(ntwkProviders)) {
        if (ntwkOff.getGuestType() == GuestType.Shared && (zone.getNetworkType() == NetworkType.Advanced) && isSharedNetworkOfferingWithServices(networkOfferingId)) {
            // validate if CIDR specified overlaps with any of the CIDR's allocated for isolated networks and shared networks in the zone
            checkSharedNetworkCidrOverlap(zoneId, pNtwk.getId(), cidr);
        } else {
            // if cidr is not null and network is not part of vpc then throw the exception
            if (vpcId == null)
                throw new InvalidParameterValueException("Cannot specify CIDR when using network offering with external devices!");
        }
    }
    // Vlan is created in 1 cases - works in Advance zone only:
    // 1) GuestType is Shared
    boolean createVlan = (startIP != null && endIP != null && zone.getNetworkType() == NetworkType.Advanced && ((ntwkOff.getGuestType() == Network.GuestType.Shared) || (ntwkOff.getGuestType() == GuestType.Isolated && !areServicesSupportedByNetworkOffering(ntwkOff.getId(), Service.SourceNat))));
    if (!createVlan) {
        // Only support advance shared network in IPv6, which means createVlan is a must
        if (ipv6) {
            createVlan = true;
        }
    }
    // Can add vlan range only to the network which allows it
    if (createVlan && !ntwkOff.getSpecifyIpRanges()) {
        InvalidParameterValueException ex = new InvalidParameterValueException("Network offering with specified id doesn't support adding multiple ip ranges");
        ex.addProxyObject(ntwkOff.getUuid(), "networkOfferingId");
        throw ex;
    }
    Network network = commitNetwork(networkOfferingId, gateway, startIP, endIP, netmask, networkDomain, vlanId, name, displayText, caller, physicalNetworkId, zoneId, domainId, isDomainSpecific, subdomainAccess, vpcId, startIPv6, endIPv6, ip6Gateway, ip6Cidr, displayNetwork, aclId, isolatedPvlan, ntwkOff, pNtwk, aclType, owner, cidr, createVlan);
    // if the network offering has persistent set to true, implement the network
    if (ntwkOff.getIsPersistent()) {
        try {
            if (network.getState() == Network.State.Setup) {
                s_logger.debug("Network id=" + network.getId() + " is already provisioned");
                return network;
            }
            DeployDestination dest = new DeployDestination(zone, null, null, null);
            UserVO callerUser = _userDao.findById(CallContext.current().getCallingUserId());
            Journal journal = new Journal.LogJournal("Implementing " + network, s_logger);
            ReservationContext context = new ReservationContextImpl(UUID.randomUUID().toString(), journal, callerUser, caller);
            s_logger.debug("Implementing network " + network + " as a part of network provision for persistent network");
            Pair<? extends NetworkGuru, ? extends Network> implementedNetwork = _networkMgr.implementNetwork(network.getId(), dest, context);
            if (implementedNetwork == null || implementedNetwork.first() == null) {
                s_logger.warn("Failed to provision the network " + network);
            }
            network = implementedNetwork.second();
        } catch (ResourceUnavailableException ex) {
            s_logger.warn("Failed to implement persistent guest network " + network + "due to ", ex);
            CloudRuntimeException e = new CloudRuntimeException("Failed to implement persistent guest network");
            e.addProxyObject(network.getUuid(), "networkId");
            throw e;
        }
    }
    return network;
}

Example 70 with PermissionDeniedException

use of com.cloud.exception.PermissionDeniedException in project cloudstack by apache.

the class NetworkServiceImpl method updateIP.

@Override
@ActionEvent(eventType = EventTypes.EVENT_NET_IP_UPDATE, eventDescription = "updating public ip address", async = true)
public IpAddress updateIP(Long id, String customId, Boolean displayIp) {
    Account caller = CallContext.current().getCallingAccount();
    IPAddressVO ipVO = _ipAddressDao.findById(id);
    if (ipVO == null) {
        throw new InvalidParameterValueException("Unable to find ip address by id");
    }
    // verify permissions
    if (ipVO.getAllocatedToAccountId() != null) {
        _accountMgr.checkAccess(caller, null, true, ipVO);
    } else if (caller.getType() != Account.ACCOUNT_TYPE_ADMIN) {
        throw new PermissionDeniedException("Only Root admin can update non-allocated ip addresses");
    }
    if (customId != null) {
        ipVO.setUuid(customId);
    }
    if (displayIp != null) {
        ipVO.setDisplay(displayIp);
    }
    _ipAddressDao.update(id, ipVO);
    return _ipAddressDao.findById(id);
}