Examples with IpAddress com.cloud.network.IpAddress used on opensource projects

Example 21 with IpAddress

use of com.cloud.network.IpAddress in project cloudstack by apache.

the class RulesManagerImpl method buildStaticNatRule.

@Override
public StaticNatRule buildStaticNatRule(FirewallRule rule, boolean forRevoke) {
    IpAddress ip = _ipAddressDao.findById(rule.getSourceIpAddressId());
    FirewallRuleVO ruleVO = _firewallDao.findById(rule.getId());
    if (ip == null || !ip.isOneToOneNat() || ip.getAssociatedWithVmId() == null) {
        InvalidParameterValueException ex = new InvalidParameterValueException("Source ip address of the specified firewall rule id is not static nat enabled");
        ex.addProxyObject(ruleVO.getUuid(), "ruleId");
        throw ex;
    }
    String dstIp = ip.getVmIp();
    if (dstIp == null) {
        InvalidParameterValueException ex = new InvalidParameterValueException("VM ip address of the specified public ip is not set ");
        ex.addProxyObject(ruleVO.getUuid(), "ruleId");
        throw ex;
    }
    return new StaticNatRuleImpl(ruleVO, dstIp);
}

Example 22 with IpAddress

use of com.cloud.network.IpAddress in project cloudstack by apache.

the class RulesManagerImpl method listAssociatedRulesForGuestNic.

@Override
public List<FirewallRuleVO> listAssociatedRulesForGuestNic(Nic nic) {
    s_logger.debug("Checking if PF/StaticNat/LoadBalancer rules are configured for nic " + nic.getId());
    List<FirewallRuleVO> result = new ArrayList<FirewallRuleVO>();
    // add PF rules
    result.addAll(_portForwardingDao.listByNetworkAndDestIpAddr(nic.getIPv4Address(), nic.getNetworkId()));
    if (result.size() > 0) {
        s_logger.debug("Found " + result.size() + " portforwarding rule configured for the nic in the network " + nic.getNetworkId());
    }
    // add static NAT rules
    List<FirewallRuleVO> staticNatRules = _firewallDao.listStaticNatByVmId(nic.getInstanceId());
    for (FirewallRuleVO rule : staticNatRules) {
        if (rule.getNetworkId() == nic.getNetworkId()) {
            result.add(rule);
            s_logger.debug("Found rule " + rule.getId() + " " + rule.getPurpose() + " configured");
        }
    }
    List<? extends IpAddress> staticNatIps = _ipAddressDao.listStaticNatPublicIps(nic.getNetworkId());
    for (IpAddress ip : staticNatIps) {
        if (ip.getVmIp() != null && ip.getVmIp().equals(nic.getIPv4Address())) {
            VMInstanceVO vm = _vmInstanceDao.findById(nic.getInstanceId());
            // generate a static Nat rule on the fly because staticNATrule does not persist into db anymore
            // FIX ME
            FirewallRuleVO staticNatRule = new FirewallRuleVO(null, ip.getId(), 0, 65535, NetUtils.ALL_PROTO.toString(), nic.getNetworkId(), vm.getAccountId(), vm.getDomainId(), Purpose.StaticNat, null, null, null, null, null);
            result.add(staticNatRule);
            s_logger.debug("Found rule " + staticNatRule.getId() + " " + staticNatRule.getPurpose() + " configured");
        }
    }
    // add LB rules
    List<LoadBalancerVMMapVO> lbMapList = _loadBalancerVMMapDao.listByInstanceId(nic.getInstanceId());
    for (LoadBalancerVMMapVO lb : lbMapList) {
        FirewallRuleVO lbRule = _firewallDao.findById(lb.getLoadBalancerId());
        if (lbRule.getNetworkId() == nic.getNetworkId()) {
            result.add(lbRule);
            s_logger.debug("Found rule " + lbRule.getId() + " " + lbRule.getPurpose() + " configured");
        }
    }
    return result;
}

Example 23 with IpAddress

use of com.cloud.network.IpAddress in project cloudstack by apache.

the class RulesManagerImpl method enableStaticNat.

private boolean enableStaticNat(long ipId, long vmId, long networkId, boolean isSystemVm, String vmGuestIp) throws NetworkRuleConflictException, ResourceUnavailableException {
    CallContext ctx = CallContext.current();
    Account caller = ctx.getCallingAccount();
    CallContext.current().setEventDetails("Ip Id: " + ipId);
    // Verify input parameters
    IPAddressVO ipAddress = _ipAddressDao.findById(ipId);
    if (ipAddress == null) {
        throw new InvalidParameterValueException("Unable to find ip address by id " + ipId);
    }
    // Verify input parameters
    boolean performedIpAssoc = false;
    boolean isOneToOneNat = ipAddress.isOneToOneNat();
    Long associatedWithVmId = ipAddress.getAssociatedWithVmId();
    Nic guestNic;
    NicSecondaryIpVO nicSecIp = null;
    String dstIp = null;
    try {
        Network network = _networkModel.getNetwork(networkId);
        if (network == null) {
            throw new InvalidParameterValueException("Unable to find network by id");
        }
        // Check that vm has a nic in the network
        guestNic = _networkModel.getNicInNetwork(vmId, networkId);
        if (guestNic == null) {
            throw new InvalidParameterValueException("Vm doesn't belong to the network with specified id");
        }
        dstIp = guestNic.getIPv4Address();
        if (!_networkModel.areServicesSupportedInNetwork(network.getId(), Service.StaticNat)) {
            throw new InvalidParameterValueException("Unable to create static nat rule; StaticNat service is not " + "supported in network with specified id");
        }
        if (!isSystemVm) {
            UserVmVO vm = _vmDao.findById(vmId);
            if (vm == null) {
                throw new InvalidParameterValueException("Can't enable static nat for the address id=" + ipId + ", invalid virtual machine id specified (" + vmId + ").");
            }
            //associate ip address to network (if needed)
            if (ipAddress.getAssociatedWithNetworkId() == null) {
                boolean assignToVpcNtwk = network.getVpcId() != null && ipAddress.getVpcId() != null && ipAddress.getVpcId().longValue() == network.getVpcId();
                if (assignToVpcNtwk) {
                    _networkModel.checkIpForService(ipAddress, Service.StaticNat, networkId);
                    s_logger.debug("The ip is not associated with the VPC network id=" + networkId + ", so assigning");
                    try {
                        ipAddress = _ipAddrMgr.associateIPToGuestNetwork(ipId, networkId, false);
                    } catch (Exception ex) {
                        s_logger.warn("Failed to associate ip id=" + ipId + " to VPC network id=" + networkId + " as " + "a part of enable static nat");
                        return false;
                    }
                } else if (ipAddress.isPortable()) {
                    s_logger.info("Portable IP " + ipAddress.getUuid() + " is not associated with the network yet " + " so associate IP with the network " + networkId);
                    try {
                        // check if StaticNat service is enabled in the network
                        _networkModel.checkIpForService(ipAddress, Service.StaticNat, networkId);
                        // associate portable IP to vpc, if network is part of VPC
                        if (network.getVpcId() != null) {
                            _vpcSvc.associateIPToVpc(ipId, network.getVpcId());
                        }
                        // associate portable IP with guest network
                        ipAddress = _ipAddrMgr.associatePortableIPToGuestNetwork(ipId, networkId, false);
                    } catch (Exception e) {
                        s_logger.warn("Failed to associate portable id=" + ipId + " to network id=" + networkId + " as " + "a part of enable static nat");
                        return false;
                    }
                }
            } else if (ipAddress.getAssociatedWithNetworkId() != networkId) {
                if (ipAddress.isPortable()) {
                    // check if destination network has StaticNat service enabled
                    _networkModel.checkIpForService(ipAddress, Service.StaticNat, networkId);
                    // check if portable IP can be transferred across the networks
                    if (_ipAddrMgr.isPortableIpTransferableFromNetwork(ipId, ipAddress.getAssociatedWithNetworkId())) {
                        try {
                            // transfer the portable IP and refresh IP details
                            _ipAddrMgr.transferPortableIP(ipId, ipAddress.getAssociatedWithNetworkId(), networkId);
                            ipAddress = _ipAddressDao.findById(ipId);
                        } catch (Exception e) {
                            s_logger.warn("Failed to associate portable id=" + ipId + " to network id=" + networkId + " as " + "a part of enable static nat");
                            return false;
                        }
                    } else {
                        throw new InvalidParameterValueException("Portable IP: " + ipId + " has associated services " + "in network " + ipAddress.getAssociatedWithNetworkId() + " so can not be transferred to " + " network " + networkId);
                    }
                } else {
                    throw new InvalidParameterValueException("Invalid network Id=" + networkId + ". IP is associated with" + " a different network than passed network id");
                }
            } else {
                _networkModel.checkIpForService(ipAddress, Service.StaticNat, null);
            }
            if (ipAddress.getAssociatedWithNetworkId() == null) {
                throw new InvalidParameterValueException("Ip address " + ipAddress + " is not assigned to the network " + network);
            }
            // Check permissions
            if (ipAddress.getSystem()) {
                // when system is enabling static NAT on system IP's (for EIP) ignore VM state
                checkIpAndUserVm(ipAddress, vm, caller, true);
            } else {
                checkIpAndUserVm(ipAddress, vm, caller, false);
            }
            //dstIp = guestNic.getIp4Address();
            if (vmGuestIp != null) {
                if (!dstIp.equals(vmGuestIp)) {
                    //check whether the secondary ip set to the vm or not
                    boolean secondaryIpSet = _networkMgr.isSecondaryIpSetForNic(guestNic.getId());
                    if (!secondaryIpSet) {
                        throw new InvalidParameterValueException("VM ip " + vmGuestIp + " address not belongs to the vm");
                    }
                    //check the ip belongs to the vm or not
                    nicSecIp = _nicSecondaryDao.findByIp4AddressAndNicId(vmGuestIp, guestNic.getId());
                    if (nicSecIp == null) {
                        throw new InvalidParameterValueException("VM ip " + vmGuestIp + " address not belongs to the vm");
                    }
                    dstIp = nicSecIp.getIp4Address();
                // Set public ip column with the vm ip
                }
            }
            // Verify ip address parameter
            // checking vm id is not sufficient, check for the vm ip
            isIpReadyForStaticNat(vmId, ipAddress, dstIp, caller, ctx.getCallingUserId());
        }
        ipAddress.setOneToOneNat(true);
        ipAddress.setAssociatedWithVmId(vmId);
        ipAddress.setVmIp(dstIp);
        if (_ipAddressDao.update(ipAddress.getId(), ipAddress)) {
            // enable static nat on the backend
            s_logger.trace("Enabling static nat for ip address " + ipAddress + " and vm id=" + vmId + " on the backend");
            if (applyStaticNatForIp(ipId, false, caller, false)) {
                // ignor unassignIPFromVpcNetwork in finally block
                performedIpAssoc = false;
                return true;
            } else {
                s_logger.warn("Failed to enable static nat rule for ip address " + ipId + " on the backend");
                ipAddress.setOneToOneNat(isOneToOneNat);
                ipAddress.setAssociatedWithVmId(associatedWithVmId);
                ipAddress.setVmIp(null);
                _ipAddressDao.update(ipAddress.getId(), ipAddress);
            }
        } else {
            s_logger.warn("Failed to update ip address " + ipAddress + " in the DB as a part of enableStaticNat");
        }
    } finally {
        if (performedIpAssoc) {
            //if the rule is the last one for the ip address assigned to VPC, unassign it from the network
            IpAddress ip = _ipAddressDao.findById(ipAddress.getId());
            _vpcMgr.unassignIPFromVpcNetwork(ip.getId(), networkId);
        }
    }
    return false;
}

Example 24 with IpAddress

use of com.cloud.network.IpAddress in project cloudstack by apache.

the class RulesManagerImpl method getSystemIpAndEnableStaticNatForVm.

@Override
public void getSystemIpAndEnableStaticNatForVm(VirtualMachine vm, boolean getNewIp) throws InsufficientAddressCapacityException {
    boolean success = true;
    // enable static nat if eIp capability is supported
    List<? extends Nic> nics = _nicDao.listByVmId(vm.getId());
    for (Nic nic : nics) {
        Network guestNetwork = _networkModel.getNetwork(nic.getNetworkId());
        NetworkOffering offering = _entityMgr.findById(NetworkOffering.class, guestNetwork.getNetworkOfferingId());
        if (offering.getElasticIp()) {
            boolean isSystemVM = (vm.getType() == Type.ConsoleProxy || vm.getType() == Type.SecondaryStorageVm);
            // for user VM's associate public IP only if offering is marked to associate a public IP by default on start of VM
            if (!isSystemVM && !offering.getAssociatePublicIP()) {
                continue;
            }
            // check if there is already static nat enabled
            if (_ipAddressDao.findByAssociatedVmId(vm.getId()) != null && !getNewIp) {
                s_logger.debug("Vm " + vm + " already has ip associated with it in guest network " + guestNetwork);
                continue;
            }
            s_logger.debug("Allocating system ip and enabling static nat for it for the vm " + vm + " in guest network " + guestNetwork);
            IpAddress ip = _ipAddrMgr.assignSystemIp(guestNetwork.getId(), _accountMgr.getAccount(vm.getAccountId()), false, true);
            if (ip == null) {
                throw new CloudRuntimeException("Failed to allocate system ip for vm " + vm + " in guest network " + guestNetwork);
            }
            s_logger.debug("Allocated system ip " + ip + ", now enabling static nat on it for vm " + vm);
            try {
                success = enableStaticNat(ip.getId(), vm.getId(), guestNetwork.getId(), isSystemVM, null);
            } catch (NetworkRuleConflictException ex) {
                s_logger.warn("Failed to enable static nat as a part of enabling elasticIp and staticNat for vm " + vm + " in guest network " + guestNetwork + " due to exception ", ex);
                success = false;
            } catch (ResourceUnavailableException ex) {
                s_logger.warn("Failed to enable static nat as a part of enabling elasticIp and staticNat for vm " + vm + " in guest network " + guestNetwork + " due to exception ", ex);
                success = false;
            }
            if (!success) {
                s_logger.warn("Failed to enable static nat on system ip " + ip + " for the vm " + vm + ", releasing the ip...");
                _ipAddrMgr.handleSystemIpRelease(ip);
                throw new CloudRuntimeException("Failed to enable static nat on system ip for the vm " + vm);
            } else {
                s_logger.warn("Succesfully enabled static nat on system ip " + ip + " for the vm " + vm);
            }
        }
    }
}

Example 25 with IpAddress

use of com.cloud.network.IpAddress in project cloudstack by apache.

the class CiscoVnmcElement method implement.

@Override
public boolean implement(final Network network, final NetworkOffering offering, final DeployDestination dest, final ReservationContext context) throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException {
    final DataCenter zone = _entityMgr.findById(DataCenter.class, network.getDataCenterId());
    if (zone.getNetworkType() == NetworkType.Basic) {
        s_logger.debug("Not handling network implement in zone of type " + NetworkType.Basic);
        return false;
    }
    if (!canHandle(network)) {
        return false;
    }
    final List<CiscoVnmcControllerVO> devices = _ciscoVnmcDao.listByPhysicalNetwork(network.getPhysicalNetworkId());
    if (devices.isEmpty()) {
        s_logger.error("No Cisco Vnmc device on network " + network.getName());
        return false;
    }
    List<CiscoAsa1000vDeviceVO> asaList = _ciscoAsa1000vDao.listByPhysicalNetwork(network.getPhysicalNetworkId());
    if (asaList.isEmpty()) {
        s_logger.debug("No Cisco ASA 1000v device on network " + network.getName());
        return false;
    }
    NetworkAsa1000vMapVO asaForNetwork = _networkAsa1000vMapDao.findByNetworkId(network.getId());
    if (asaForNetwork != null) {
        s_logger.debug("Cisco ASA 1000v device already associated with network " + network.getName());
        return true;
    }
    if (!_networkModel.isProviderSupportServiceInNetwork(network.getId(), Service.SourceNat, Provider.CiscoVnmc)) {
        s_logger.error("SourceNat service is not provided by Cisco Vnmc device on network " + network.getName());
        return false;
    }
    try {
        // ensure that there is an ASA 1000v assigned to this network
        CiscoAsa1000vDevice assignedAsa = assignAsa1000vToNetwork(network);
        if (assignedAsa == null) {
            s_logger.error("Unable to assign ASA 1000v device to network " + network.getName());
            throw new CloudRuntimeException("Unable to assign ASA 1000v device to network " + network.getName());
        }
        ClusterVO asaCluster = _clusterDao.findById(assignedAsa.getClusterId());
        ClusterVSMMapVO clusterVsmMap = _clusterVsmMapDao.findByClusterId(assignedAsa.getClusterId());
        if (clusterVsmMap == null) {
            s_logger.error("Vmware cluster " + asaCluster.getName() + " has no Cisco Nexus VSM device associated with it");
            throw new CloudRuntimeException("Vmware cluster " + asaCluster.getName() + " has no Cisco Nexus VSM device associated with it");
        }
        CiscoNexusVSMDeviceVO vsmDevice = _vsmDeviceDao.findById(clusterVsmMap.getVsmId());
        if (vsmDevice == null) {
            s_logger.error("Unable to load details of Cisco Nexus VSM device associated with cluster " + asaCluster.getName());
            throw new CloudRuntimeException("Unable to load details of Cisco Nexus VSM device associated with cluster " + asaCluster.getName());
        }
        CiscoVnmcControllerVO ciscoVnmcDevice = devices.get(0);
        HostVO ciscoVnmcHost = _hostDao.findById(ciscoVnmcDevice.getHostId());
        _hostDao.loadDetails(ciscoVnmcHost);
        Account owner = context.getAccount();
        PublicIp sourceNatIp = _ipAddrMgr.assignSourceNatIpAddressToGuestNetwork(owner, network);
        long vlanId = Long.parseLong(BroadcastDomainType.getValue(network.getBroadcastUri()));
        List<VlanVO> vlanVOList = _vlanDao.listVlansByPhysicalNetworkId(network.getPhysicalNetworkId());
        List<String> publicGateways = new ArrayList<String>();
        for (VlanVO vlanVO : vlanVOList) {
            publicGateways.add(vlanVO.getVlanGateway());
        }
        // due to VNMC limitation of not allowing source NAT ip as the outside ip of firewall,
        // an additional public ip needs to acquired for assigning as firewall outside ip.
        // In case there are already additional ip addresses available (network restart) use one
        // of them such that it is not the source NAT ip
        IpAddress outsideIp = null;
        List<IPAddressVO> publicIps = _ipAddressDao.listByAssociatedNetwork(network.getId(), null);
        for (IPAddressVO ip : publicIps) {
            if (!ip.isSourceNat()) {
                outsideIp = ip;
                break;
            }
        }
        if (outsideIp == null) {
            // none available, acquire one
            try {
                Account caller = CallContext.current().getCallingAccount();
                long callerUserId = CallContext.current().getCallingUserId();
                outsideIp = _ipAddrMgr.allocateIp(owner, false, caller, callerUserId, zone, true);
            } catch (ResourceAllocationException e) {
                s_logger.error("Unable to allocate additional public Ip address. Exception details " + e);
                throw new CloudRuntimeException("Unable to allocate additional public Ip address. Exception details " + e);
            }
            try {
                outsideIp = _ipAddrMgr.associateIPToGuestNetwork(outsideIp.getId(), network.getId(), true);
            } catch (ResourceAllocationException e) {
                s_logger.error("Unable to assign allocated additional public Ip " + outsideIp.getAddress().addr() + " to network with vlan " + vlanId + ". Exception details " + e);
                throw new CloudRuntimeException("Unable to assign allocated additional public Ip " + outsideIp.getAddress().addr() + " to network with vlan " + vlanId + ". Exception details " + e);
            }
        }
        // create logical edge firewall in VNMC
        String gatewayNetmask = NetUtils.getCidrNetmask(network.getCidr());
        // all public ip addresses must be from same subnet, this essentially means single public subnet in zone
        if (!createLogicalEdgeFirewall(vlanId, network.getGateway(), gatewayNetmask, outsideIp.getAddress().addr(), sourceNatIp.getNetmask(), publicGateways, ciscoVnmcHost.getId())) {
            s_logger.error("Failed to create logical edge firewall in Cisco VNMC device for network " + network.getName());
            throw new CloudRuntimeException("Failed to create logical edge firewall in Cisco VNMC device for network " + network.getName());
        }
        // create stuff in VSM for ASA device
        if (!configureNexusVsmForAsa(vlanId, network.getGateway(), vsmDevice.getUserName(), vsmDevice.getPassword(), vsmDevice.getipaddr(), assignedAsa.getInPortProfile(), ciscoVnmcHost.getId())) {
            s_logger.error("Failed to configure Cisco Nexus VSM " + vsmDevice.getipaddr() + " for ASA device for network " + network.getName());
            throw new CloudRuntimeException("Failed to configure Cisco Nexus VSM " + vsmDevice.getipaddr() + " for ASA device for network " + network.getName());
        }
        // configure source NAT
        if (!configureSourceNat(vlanId, network.getCidr(), sourceNatIp, ciscoVnmcHost.getId())) {
            s_logger.error("Failed to configure source NAT in Cisco VNMC device for network " + network.getName());
            throw new CloudRuntimeException("Failed to configure source NAT in Cisco VNMC device for network " + network.getName());
        }
        // associate Asa 1000v instance with logical edge firewall
        if (!associateAsaWithLogicalEdgeFirewall(vlanId, assignedAsa.getManagementIp(), ciscoVnmcHost.getId())) {
            s_logger.error("Failed to associate Cisco ASA 1000v (" + assignedAsa.getManagementIp() + ") with logical edge firewall in VNMC for network " + network.getName());
            throw new CloudRuntimeException("Failed to associate Cisco ASA 1000v (" + assignedAsa.getManagementIp() + ") with logical edge firewall in VNMC for network " + network.getName());
        }
    } catch (CloudRuntimeException e) {
        unassignAsa1000vFromNetwork(network);
        s_logger.error("CiscoVnmcElement failed", e);
        return false;
    } catch (Exception e) {
        unassignAsa1000vFromNetwork(network);
        ExceptionUtil.rethrowRuntime(e);
        ExceptionUtil.rethrow(e, InsufficientAddressCapacityException.class);
        ExceptionUtil.rethrow(e, ResourceUnavailableException.class);
        throw new IllegalStateException(e);
    }
    return true;
}