Examples with NetworkRuleConflictException com.cloud.legacymodel.exceptions.NetworkRuleConflictException used on opensource projects

Example 26 with NetworkRuleConflictException

use of com.cloud.legacymodel.exceptions.NetworkRuleConflictException in project cosmic by MissionCriticalCloud.

the class FirewallManagerImpl method detectRulesConflict.

@Override
public void detectRulesConflict(final FirewallRule newRule) throws NetworkRuleConflictException {
    final List<FirewallRuleVO> rules;
    if (newRule.getSourceIpAddressId() != null) {
        rules = _firewallDao.listByIpAndPurposeAndNotRevoked(newRule.getSourceIpAddressId(), null);
        assert (rules.size() >= 1) : "For network rules, we now always first persist the rule and then check for " + "network conflicts so we should at least have one rule at this point.";
    } else {
        // fetches only firewall egress rules.
        rules = _firewallDao.listByNetworkPurposeTrafficTypeAndNotRevoked(newRule.getNetworkId(), Purpose.Firewall, newRule.getTrafficType());
        assert (rules.size() >= 1);
    }
    for (final FirewallRuleVO rule : rules) {
        if (rule.getId() == newRule.getId()) {
            // Skips my own rule.
            continue;
        }
        final boolean oneOfRulesIsFirewall = ((rule.getPurpose() == Purpose.Firewall || newRule.getPurpose() == Purpose.Firewall) && ((newRule.getPurpose() != rule.getPurpose()) || (!newRule.getProtocol().equalsIgnoreCase(rule.getProtocol()))));
        // if both rules are firewall and their cidrs are different, we can skip port ranges verification
        final boolean bothRulesFirewall = (rule.getPurpose() == newRule.getPurpose() && rule.getPurpose() == Purpose.Firewall);
        boolean duplicatedCidrs = false;
        if (bothRulesFirewall) {
            // Verify that the rules have different cidrs
            _firewallDao.loadSourceCidrs(rule);
            _firewallDao.loadSourceCidrs((FirewallRuleVO) newRule);
            final List<String> ruleCidrList = rule.getSourceCidrList();
            final List<String> newRuleCidrList = newRule.getSourceCidrList();
            if (ruleCidrList == null || newRuleCidrList == null) {
                continue;
            }
            final Collection<String> similar = new HashSet<>(ruleCidrList);
            similar.retainAll(newRuleCidrList);
            if (similar.size() > 0) {
                duplicatedCidrs = true;
            }
        }
        if (!oneOfRulesIsFirewall) {
            if (rule.getPurpose() == Purpose.StaticNat && newRule.getPurpose() != Purpose.StaticNat) {
                throw new NetworkRuleConflictException("There is 1 to 1 Nat rule specified for the ip address id=" + newRule.getSourceIpAddressId());
            } else if (rule.getPurpose() != Purpose.StaticNat && newRule.getPurpose() == Purpose.StaticNat) {
                throw new NetworkRuleConflictException("There is already firewall rule specified for the ip address id=" + newRule.getSourceIpAddressId());
            }
        }
        if (rule.getNetworkId() != newRule.getNetworkId() && rule.getState() != State.Revoke) {
            throw new NetworkRuleConflictException("New rule is for a different network than what's specified in rule " + rule.getXid());
        }
        if (newRule.getProtocol().equalsIgnoreCase(NetUtils.ICMP_PROTO) && newRule.getProtocol().equalsIgnoreCase(rule.getProtocol())) {
            if (newRule.getIcmpCode().longValue() == rule.getIcmpCode().longValue() && newRule.getIcmpType().longValue() == rule.getIcmpType().longValue() && newRule.getProtocol().equalsIgnoreCase(rule.getProtocol()) && duplicatedCidrs) {
                throw new InvalidParameterValueException("New rule conflicts with existing rule id=" + rule.getId());
            }
        }
        final boolean notNullPorts = (newRule.getSourcePortStart() != null && newRule.getSourcePortEnd() != null && rule.getSourcePortStart() != null && rule.getSourcePortEnd() != null);
        final boolean nullPorts = (newRule.getSourcePortStart() == null && newRule.getSourcePortEnd() == null && rule.getSourcePortStart() == null && rule.getSourcePortEnd() == null);
        if (nullPorts && duplicatedCidrs && (rule.getProtocol().equalsIgnoreCase(newRule.getProtocol())) && !newRule.getProtocol().equalsIgnoreCase(NetUtils.ICMP_PROTO)) {
            throw new NetworkRuleConflictException("There is already a firewall rule specified with protocol = " + newRule.getProtocol() + " and no ports");
        }
        if (!notNullPorts) {
            continue;
        } else if (!oneOfRulesIsFirewall && !(bothRulesFirewall && !duplicatedCidrs) && ((rule.getSourcePortStart().intValue() <= newRule.getSourcePortStart().intValue() && rule.getSourcePortEnd().intValue() >= newRule.getSourcePortStart().intValue()) || (rule.getSourcePortStart().intValue() <= newRule.getSourcePortEnd().intValue() && rule.getSourcePortEnd().intValue() >= newRule.getSourcePortEnd().intValue()) || (newRule.getSourcePortStart().intValue() <= rule.getSourcePortStart().intValue() && newRule.getSourcePortEnd().intValue() >= rule.getSourcePortStart().intValue()) || (newRule.getSourcePortStart().intValue() <= rule.getSourcePortEnd().intValue() && newRule.getSourcePortEnd().intValue() >= rule.getSourcePortEnd().intValue()))) {
            // we allow port forwarding rules with the same parameters but different protocols
            final boolean allowPf = (rule.getPurpose() == Purpose.PortForwarding && newRule.getPurpose() == Purpose.PortForwarding && !newRule.getProtocol().equalsIgnoreCase(rule.getProtocol())) || (rule.getPurpose() == Purpose.Vpn && newRule.getPurpose() == Purpose.PortForwarding && !newRule.getProtocol().equalsIgnoreCase(rule.getProtocol()));
            final boolean allowStaticNat = (rule.getPurpose() == Purpose.StaticNat && newRule.getPurpose() == Purpose.StaticNat && !newRule.getProtocol().equalsIgnoreCase(rule.getProtocol()));
            final boolean allowVpnPf = (rule.getPurpose() == Purpose.PortForwarding && newRule.getPurpose() == Purpose.Vpn && !newRule.getProtocol().equalsIgnoreCase(rule.getProtocol()));
            final boolean allowVpnLb = (rule.getPurpose() == Purpose.LoadBalancing && newRule.getPurpose() == Purpose.Vpn && !newRule.getProtocol().equalsIgnoreCase(rule.getProtocol()));
            if (!(allowPf || allowStaticNat || oneOfRulesIsFirewall || allowVpnPf || allowVpnLb)) {
                throw new NetworkRuleConflictException("The range specified, " + newRule.getSourcePortStart() + "-" + newRule.getSourcePortEnd() + ", conflicts with rule " + rule.getId() + " which has " + rule.getSourcePortStart() + "-" + rule.getSourcePortEnd());
            }
        }
    }
    if (s_logger.isDebugEnabled()) {
        s_logger.debug("No network rule conflicts detected for " + newRule + " against " + (rules.size() - 1) + " existing rules");
    }
}