Examples with IPAddressVO com.cloud.network.dao.IPAddressVO used on opensource projects

Example 46 with IPAddressVO

use of com.cloud.network.dao.IPAddressVO in project cloudstack by apache.

the class ConsoleProxyManagerImpl method finalizeStart.

@Override
public boolean finalizeStart(VirtualMachineProfile profile, long hostId, Commands cmds, ReservationContext context) {
    CheckSshAnswer answer = (CheckSshAnswer) cmds.getAnswer("checkSsh");
    if (answer == null || !answer.getResult()) {
        if (answer != null) {
            s_logger.warn("Unable to ssh to the VM: " + answer.getDetails());
        } else {
            s_logger.warn("Unable to ssh to the VM: null answer");
        }
        return false;
    }
    try {
        //get system ip and create static nat rule for the vm in case of basic networking with EIP/ELB
        _rulesMgr.getSystemIpAndEnableStaticNatForVm(profile.getVirtualMachine(), false);
        IPAddressVO ipaddr = _ipAddressDao.findByAssociatedVmId(profile.getVirtualMachine().getId());
        if (ipaddr != null && ipaddr.getSystem()) {
            ConsoleProxyVO consoleVm = _consoleProxyDao.findById(profile.getId());
            // override CPVM guest IP with EIP, so that console url's will be prepared with EIP
            consoleVm.setPublicIpAddress(ipaddr.getAddress().addr());
            _consoleProxyDao.update(consoleVm.getId(), consoleVm);
        }
    } catch (Exception ex) {
        s_logger.warn("Failed to get system ip and enable static nat for the vm " + profile.getVirtualMachine() + " due to exception ", ex);
        return false;
    }
    return true;
}

Example 47 with IPAddressVO

use of com.cloud.network.dao.IPAddressVO in project cloudstack by apache.

the class RulesManagerImpl method createStaticNatRule.

@Override
@DB
@ActionEvent(eventType = EventTypes.EVENT_NET_RULE_ADD, eventDescription = "creating static nat rule", create = true)
public StaticNatRule createStaticNatRule(final StaticNatRule rule, final boolean openFirewall) throws NetworkRuleConflictException {
    final Account caller = CallContext.current().getCallingAccount();
    final Long ipAddrId = rule.getSourceIpAddressId();
    IPAddressVO ipAddress = _ipAddressDao.findById(ipAddrId);
    // Validate ip address
    if (ipAddress == null) {
        throw new InvalidParameterValueException("Unable to create static nat rule; ip id=" + ipAddrId + " doesn't exist in the system");
    } else if (ipAddress.isSourceNat() || !ipAddress.isOneToOneNat() || ipAddress.getAssociatedWithVmId() == null) {
        throw new NetworkRuleConflictException("Can't do static nat on ip address: " + ipAddress.getAddress());
    }
    _firewallMgr.validateFirewallRule(caller, ipAddress, rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), Purpose.StaticNat, FirewallRuleType.User, null, rule.getTrafficType());
    final Long networkId = ipAddress.getAssociatedWithNetworkId();
    final Long accountId = ipAddress.getAllocatedToAccountId();
    final Long domainId = ipAddress.getAllocatedInDomainId();
    _networkModel.checkIpForService(ipAddress, Service.StaticNat, null);
    Network network = _networkModel.getNetwork(networkId);
    NetworkOffering off = _entityMgr.findById(NetworkOffering.class, network.getNetworkOfferingId());
    if (off.getElasticIp()) {
        throw new InvalidParameterValueException("Can't create ip forwarding rules for the network where elasticIP service is enabled");
    }
    //String dstIp = _networkModel.getIpInNetwork(ipAddress.getAssociatedWithVmId(), networkId);
    final String dstIp = ipAddress.getVmIp();
    return Transaction.execute(new TransactionCallbackWithException<StaticNatRule, NetworkRuleConflictException>() {

        @Override
        public StaticNatRule doInTransaction(TransactionStatus status) throws NetworkRuleConflictException {
            FirewallRuleVO newRule = new FirewallRuleVO(rule.getXid(), rule.getSourceIpAddressId(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol().toLowerCase(), networkId, accountId, domainId, rule.getPurpose(), null, null, null, null, null);
            newRule = _firewallDao.persist(newRule);
            // create firewallRule for 0.0.0.0/0 cidr
            if (openFirewall) {
                _firewallMgr.createRuleForAllCidrs(ipAddrId, caller, rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), null, null, newRule.getId(), networkId);
            }
            try {
                _firewallMgr.detectRulesConflict(newRule);
                if (!_firewallDao.setStateToAdd(newRule)) {
                    throw new CloudRuntimeException("Unable to update the state to add for " + newRule);
                }
                CallContext.current().setEventDetails("Rule Id: " + newRule.getId());
                UsageEventUtils.publishUsageEvent(EventTypes.EVENT_NET_RULE_ADD, newRule.getAccountId(), 0, newRule.getId(), null, FirewallRule.class.getName(), newRule.getUuid());
                StaticNatRule staticNatRule = new StaticNatRuleImpl(newRule, dstIp);
                return staticNatRule;
            } catch (Exception e) {
                if (newRule != null) {
                    // no need to apply the rule as it wasn't programmed on the backend yet
                    _firewallMgr.revokeRelatedFirewallRule(newRule.getId(), false);
                    _firewallMgr.removeRule(newRule);
                }
                if (e instanceof NetworkRuleConflictException) {
                    throw (NetworkRuleConflictException) e;
                }
                throw new CloudRuntimeException("Unable to add static nat rule for the ip id=" + newRule.getSourceIpAddressId(), e);
            }
        }
    });
}

Example 48 with IPAddressVO

use of com.cloud.network.dao.IPAddressVO in project cloudstack by apache.

the class RulesManagerImpl method isIpReadyForStaticNat.

protected void isIpReadyForStaticNat(long vmId, IPAddressVO ipAddress, String vmIp, Account caller, long callerUserId) throws NetworkRuleConflictException, ResourceUnavailableException {
    if (ipAddress.isSourceNat()) {
        throw new InvalidParameterValueException("Can't enable static, ip address " + ipAddress + " is a sourceNat ip address");
    }
    if (!ipAddress.isOneToOneNat()) {
        // Dont allow to enable static nat if PF/LB rules exist for the IP
        List<FirewallRuleVO> portForwardingRules = _firewallDao.listByIpAndPurposeAndNotRevoked(ipAddress.getId(), Purpose.PortForwarding);
        if (portForwardingRules != null && !portForwardingRules.isEmpty()) {
            throw new NetworkRuleConflictException("Failed to enable static nat for the ip address " + ipAddress + " as it already has PortForwarding rules assigned");
        }
        List<FirewallRuleVO> loadBalancingRules = _firewallDao.listByIpAndPurposeAndNotRevoked(ipAddress.getId(), Purpose.LoadBalancing);
        if (loadBalancingRules != null && !loadBalancingRules.isEmpty()) {
            throw new NetworkRuleConflictException("Failed to enable static nat for the ip address " + ipAddress + " as it already has LoadBalancing rules assigned");
        }
    } else if (ipAddress.getAssociatedWithVmId() != null && ipAddress.getAssociatedWithVmId().longValue() != vmId) {
        throw new NetworkRuleConflictException("Failed to enable static for the ip address " + ipAddress + " and vm id=" + vmId + " as it's already assigned to antoher vm");
    }
    //check wether the vm ip is alreday associated with any public ip address
    IPAddressVO oldIP = _ipAddressDao.findByAssociatedVmIdAndVmIp(vmId, vmIp);
    if (oldIP != null) {
        // If elasticIP functionality is supported in the network, we always have to disable static nat on the old
        // ip in order to re-enable it on the new one
        Long networkId = oldIP.getAssociatedWithNetworkId();
        VMInstanceVO vm = _vmInstanceDao.findById(vmId);
        boolean reassignStaticNat = false;
        if (networkId != null) {
            Network guestNetwork = _networkModel.getNetwork(networkId);
            NetworkOffering offering = _entityMgr.findById(NetworkOffering.class, guestNetwork.getNetworkOfferingId());
            if (offering.getElasticIp()) {
                reassignStaticNat = true;
            }
        }
        // If there is public ip address already associated with the vm, throw an exception
        if (!reassignStaticNat) {
            throw new InvalidParameterValueException("Failed to enable static nat on the  ip " + ipAddress.getAddress() + " with Id " + ipAddress.getUuid() + " as the vm " + vm.getInstanceName() + " with Id " + vm.getUuid() + " is already associated with another public ip " + oldIP.getAddress() + " with id " + oldIP.getUuid());
        }
        // unassign old static nat rule
        s_logger.debug("Disassociating static nat for ip " + oldIP);
        if (!disableStaticNat(oldIP.getId(), caller, callerUserId, true)) {
            throw new CloudRuntimeException("Failed to disable old static nat rule for vm " + vm.getInstanceName() + " with id " + vm.getUuid() + "  and public ip " + oldIP);
        }
    }
}

Example 49 with IPAddressVO

use of com.cloud.network.dao.IPAddressVO in project cloudstack by apache.

the class RulesManagerImpl method enableStaticNat.

private boolean enableStaticNat(long ipId, long vmId, long networkId, boolean isSystemVm, String vmGuestIp) throws NetworkRuleConflictException, ResourceUnavailableException {
    CallContext ctx = CallContext.current();
    Account caller = ctx.getCallingAccount();
    CallContext.current().setEventDetails("Ip Id: " + ipId);
    // Verify input parameters
    IPAddressVO ipAddress = _ipAddressDao.findById(ipId);
    if (ipAddress == null) {
        throw new InvalidParameterValueException("Unable to find ip address by id " + ipId);
    }
    // Verify input parameters
    boolean performedIpAssoc = false;
    boolean isOneToOneNat = ipAddress.isOneToOneNat();
    Long associatedWithVmId = ipAddress.getAssociatedWithVmId();
    Nic guestNic;
    NicSecondaryIpVO nicSecIp = null;
    String dstIp = null;
    try {
        Network network = _networkModel.getNetwork(networkId);
        if (network == null) {
            throw new InvalidParameterValueException("Unable to find network by id");
        }
        // Check that vm has a nic in the network
        guestNic = _networkModel.getNicInNetwork(vmId, networkId);
        if (guestNic == null) {
            throw new InvalidParameterValueException("Vm doesn't belong to the network with specified id");
        }
        dstIp = guestNic.getIPv4Address();
        if (!_networkModel.areServicesSupportedInNetwork(network.getId(), Service.StaticNat)) {
            throw new InvalidParameterValueException("Unable to create static nat rule; StaticNat service is not " + "supported in network with specified id");
        }
        if (!isSystemVm) {
            UserVmVO vm = _vmDao.findById(vmId);
            if (vm == null) {
                throw new InvalidParameterValueException("Can't enable static nat for the address id=" + ipId + ", invalid virtual machine id specified (" + vmId + ").");
            }
            //associate ip address to network (if needed)
            if (ipAddress.getAssociatedWithNetworkId() == null) {
                boolean assignToVpcNtwk = network.getVpcId() != null && ipAddress.getVpcId() != null && ipAddress.getVpcId().longValue() == network.getVpcId();
                if (assignToVpcNtwk) {
                    _networkModel.checkIpForService(ipAddress, Service.StaticNat, networkId);
                    s_logger.debug("The ip is not associated with the VPC network id=" + networkId + ", so assigning");
                    try {
                        ipAddress = _ipAddrMgr.associateIPToGuestNetwork(ipId, networkId, false);
                    } catch (Exception ex) {
                        s_logger.warn("Failed to associate ip id=" + ipId + " to VPC network id=" + networkId + " as " + "a part of enable static nat");
                        return false;
                    }
                } else if (ipAddress.isPortable()) {
                    s_logger.info("Portable IP " + ipAddress.getUuid() + " is not associated with the network yet " + " so associate IP with the network " + networkId);
                    try {
                        // check if StaticNat service is enabled in the network
                        _networkModel.checkIpForService(ipAddress, Service.StaticNat, networkId);
                        // associate portable IP to vpc, if network is part of VPC
                        if (network.getVpcId() != null) {
                            _vpcSvc.associateIPToVpc(ipId, network.getVpcId());
                        }
                        // associate portable IP with guest network
                        ipAddress = _ipAddrMgr.associatePortableIPToGuestNetwork(ipId, networkId, false);
                    } catch (Exception e) {
                        s_logger.warn("Failed to associate portable id=" + ipId + " to network id=" + networkId + " as " + "a part of enable static nat");
                        return false;
                    }
                }
            } else if (ipAddress.getAssociatedWithNetworkId() != networkId) {
                if (ipAddress.isPortable()) {
                    // check if destination network has StaticNat service enabled
                    _networkModel.checkIpForService(ipAddress, Service.StaticNat, networkId);
                    // check if portable IP can be transferred across the networks
                    if (_ipAddrMgr.isPortableIpTransferableFromNetwork(ipId, ipAddress.getAssociatedWithNetworkId())) {
                        try {
                            // transfer the portable IP and refresh IP details
                            _ipAddrMgr.transferPortableIP(ipId, ipAddress.getAssociatedWithNetworkId(), networkId);
                            ipAddress = _ipAddressDao.findById(ipId);
                        } catch (Exception e) {
                            s_logger.warn("Failed to associate portable id=" + ipId + " to network id=" + networkId + " as " + "a part of enable static nat");
                            return false;
                        }
                    } else {
                        throw new InvalidParameterValueException("Portable IP: " + ipId + " has associated services " + "in network " + ipAddress.getAssociatedWithNetworkId() + " so can not be transferred to " + " network " + networkId);
                    }
                } else {
                    throw new InvalidParameterValueException("Invalid network Id=" + networkId + ". IP is associated with" + " a different network than passed network id");
                }
            } else {
                _networkModel.checkIpForService(ipAddress, Service.StaticNat, null);
            }
            if (ipAddress.getAssociatedWithNetworkId() == null) {
                throw new InvalidParameterValueException("Ip address " + ipAddress + " is not assigned to the network " + network);
            }
            // Check permissions
            if (ipAddress.getSystem()) {
                // when system is enabling static NAT on system IP's (for EIP) ignore VM state
                checkIpAndUserVm(ipAddress, vm, caller, true);
            } else {
                checkIpAndUserVm(ipAddress, vm, caller, false);
            }
            //dstIp = guestNic.getIp4Address();
            if (vmGuestIp != null) {
                if (!dstIp.equals(vmGuestIp)) {
                    //check whether the secondary ip set to the vm or not
                    boolean secondaryIpSet = _networkMgr.isSecondaryIpSetForNic(guestNic.getId());
                    if (!secondaryIpSet) {
                        throw new InvalidParameterValueException("VM ip " + vmGuestIp + " address not belongs to the vm");
                    }
                    //check the ip belongs to the vm or not
                    nicSecIp = _nicSecondaryDao.findByIp4AddressAndNicId(vmGuestIp, guestNic.getId());
                    if (nicSecIp == null) {
                        throw new InvalidParameterValueException("VM ip " + vmGuestIp + " address not belongs to the vm");
                    }
                    dstIp = nicSecIp.getIp4Address();
                // Set public ip column with the vm ip
                }
            }
            // Verify ip address parameter
            // checking vm id is not sufficient, check for the vm ip
            isIpReadyForStaticNat(vmId, ipAddress, dstIp, caller, ctx.getCallingUserId());
        }
        ipAddress.setOneToOneNat(true);
        ipAddress.setAssociatedWithVmId(vmId);
        ipAddress.setVmIp(dstIp);
        if (_ipAddressDao.update(ipAddress.getId(), ipAddress)) {
            // enable static nat on the backend
            s_logger.trace("Enabling static nat for ip address " + ipAddress + " and vm id=" + vmId + " on the backend");
            if (applyStaticNatForIp(ipId, false, caller, false)) {
                // ignor unassignIPFromVpcNetwork in finally block
                performedIpAssoc = false;
                return true;
            } else {
                s_logger.warn("Failed to enable static nat rule for ip address " + ipId + " on the backend");
                ipAddress.setOneToOneNat(isOneToOneNat);
                ipAddress.setAssociatedWithVmId(associatedWithVmId);
                ipAddress.setVmIp(null);
                _ipAddressDao.update(ipAddress.getId(), ipAddress);
            }
        } else {
            s_logger.warn("Failed to update ip address " + ipAddress + " in the DB as a part of enableStaticNat");
        }
    } finally {
        if (performedIpAssoc) {
            //if the rule is the last one for the ip address assigned to VPC, unassign it from the network
            IpAddress ip = _ipAddressDao.findById(ipAddress.getId());
            _vpcMgr.unassignIPFromVpcNetwork(ip.getId(), networkId);
        }
    }
    return false;
}

Example 50 with IPAddressVO

use of com.cloud.network.dao.IPAddressVO in project cloudstack by apache.

the class CiscoVnmcElement method implement.

@Override
public boolean implement(final Network network, final NetworkOffering offering, final DeployDestination dest, final ReservationContext context) throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException {
    final DataCenter zone = _entityMgr.findById(DataCenter.class, network.getDataCenterId());
    if (zone.getNetworkType() == NetworkType.Basic) {
        s_logger.debug("Not handling network implement in zone of type " + NetworkType.Basic);
        return false;
    }
    if (!canHandle(network)) {
        return false;
    }
    final List<CiscoVnmcControllerVO> devices = _ciscoVnmcDao.listByPhysicalNetwork(network.getPhysicalNetworkId());
    if (devices.isEmpty()) {
        s_logger.error("No Cisco Vnmc device on network " + network.getName());
        return false;
    }
    List<CiscoAsa1000vDeviceVO> asaList = _ciscoAsa1000vDao.listByPhysicalNetwork(network.getPhysicalNetworkId());
    if (asaList.isEmpty()) {
        s_logger.debug("No Cisco ASA 1000v device on network " + network.getName());
        return false;
    }
    NetworkAsa1000vMapVO asaForNetwork = _networkAsa1000vMapDao.findByNetworkId(network.getId());
    if (asaForNetwork != null) {
        s_logger.debug("Cisco ASA 1000v device already associated with network " + network.getName());
        return true;
    }
    if (!_networkModel.isProviderSupportServiceInNetwork(network.getId(), Service.SourceNat, Provider.CiscoVnmc)) {
        s_logger.error("SourceNat service is not provided by Cisco Vnmc device on network " + network.getName());
        return false;
    }
    try {
        // ensure that there is an ASA 1000v assigned to this network
        CiscoAsa1000vDevice assignedAsa = assignAsa1000vToNetwork(network);
        if (assignedAsa == null) {
            s_logger.error("Unable to assign ASA 1000v device to network " + network.getName());
            throw new CloudRuntimeException("Unable to assign ASA 1000v device to network " + network.getName());
        }
        ClusterVO asaCluster = _clusterDao.findById(assignedAsa.getClusterId());
        ClusterVSMMapVO clusterVsmMap = _clusterVsmMapDao.findByClusterId(assignedAsa.getClusterId());
        if (clusterVsmMap == null) {
            s_logger.error("Vmware cluster " + asaCluster.getName() + " has no Cisco Nexus VSM device associated with it");
            throw new CloudRuntimeException("Vmware cluster " + asaCluster.getName() + " has no Cisco Nexus VSM device associated with it");
        }
        CiscoNexusVSMDeviceVO vsmDevice = _vsmDeviceDao.findById(clusterVsmMap.getVsmId());
        if (vsmDevice == null) {
            s_logger.error("Unable to load details of Cisco Nexus VSM device associated with cluster " + asaCluster.getName());
            throw new CloudRuntimeException("Unable to load details of Cisco Nexus VSM device associated with cluster " + asaCluster.getName());
        }
        CiscoVnmcControllerVO ciscoVnmcDevice = devices.get(0);
        HostVO ciscoVnmcHost = _hostDao.findById(ciscoVnmcDevice.getHostId());
        _hostDao.loadDetails(ciscoVnmcHost);
        Account owner = context.getAccount();
        PublicIp sourceNatIp = _ipAddrMgr.assignSourceNatIpAddressToGuestNetwork(owner, network);
        long vlanId = Long.parseLong(BroadcastDomainType.getValue(network.getBroadcastUri()));
        List<VlanVO> vlanVOList = _vlanDao.listVlansByPhysicalNetworkId(network.getPhysicalNetworkId());
        List<String> publicGateways = new ArrayList<String>();
        for (VlanVO vlanVO : vlanVOList) {
            publicGateways.add(vlanVO.getVlanGateway());
        }
        // due to VNMC limitation of not allowing source NAT ip as the outside ip of firewall,
        // an additional public ip needs to acquired for assigning as firewall outside ip.
        // In case there are already additional ip addresses available (network restart) use one
        // of them such that it is not the source NAT ip
        IpAddress outsideIp = null;
        List<IPAddressVO> publicIps = _ipAddressDao.listByAssociatedNetwork(network.getId(), null);
        for (IPAddressVO ip : publicIps) {
            if (!ip.isSourceNat()) {
                outsideIp = ip;
                break;
            }
        }
        if (outsideIp == null) {
            // none available, acquire one
            try {
                Account caller = CallContext.current().getCallingAccount();
                long callerUserId = CallContext.current().getCallingUserId();
                outsideIp = _ipAddrMgr.allocateIp(owner, false, caller, callerUserId, zone, true);
            } catch (ResourceAllocationException e) {
                s_logger.error("Unable to allocate additional public Ip address. Exception details " + e);
                throw new CloudRuntimeException("Unable to allocate additional public Ip address. Exception details " + e);
            }
            try {
                outsideIp = _ipAddrMgr.associateIPToGuestNetwork(outsideIp.getId(), network.getId(), true);
            } catch (ResourceAllocationException e) {
                s_logger.error("Unable to assign allocated additional public Ip " + outsideIp.getAddress().addr() + " to network with vlan " + vlanId + ". Exception details " + e);
                throw new CloudRuntimeException("Unable to assign allocated additional public Ip " + outsideIp.getAddress().addr() + " to network with vlan " + vlanId + ". Exception details " + e);
            }
        }
        // create logical edge firewall in VNMC
        String gatewayNetmask = NetUtils.getCidrNetmask(network.getCidr());
        // all public ip addresses must be from same subnet, this essentially means single public subnet in zone
        if (!createLogicalEdgeFirewall(vlanId, network.getGateway(), gatewayNetmask, outsideIp.getAddress().addr(), sourceNatIp.getNetmask(), publicGateways, ciscoVnmcHost.getId())) {
            s_logger.error("Failed to create logical edge firewall in Cisco VNMC device for network " + network.getName());
            throw new CloudRuntimeException("Failed to create logical edge firewall in Cisco VNMC device for network " + network.getName());
        }
        // create stuff in VSM for ASA device
        if (!configureNexusVsmForAsa(vlanId, network.getGateway(), vsmDevice.getUserName(), vsmDevice.getPassword(), vsmDevice.getipaddr(), assignedAsa.getInPortProfile(), ciscoVnmcHost.getId())) {
            s_logger.error("Failed to configure Cisco Nexus VSM " + vsmDevice.getipaddr() + " for ASA device for network " + network.getName());
            throw new CloudRuntimeException("Failed to configure Cisco Nexus VSM " + vsmDevice.getipaddr() + " for ASA device for network " + network.getName());
        }
        // configure source NAT
        if (!configureSourceNat(vlanId, network.getCidr(), sourceNatIp, ciscoVnmcHost.getId())) {
            s_logger.error("Failed to configure source NAT in Cisco VNMC device for network " + network.getName());
            throw new CloudRuntimeException("Failed to configure source NAT in Cisco VNMC device for network " + network.getName());
        }
        // associate Asa 1000v instance with logical edge firewall
        if (!associateAsaWithLogicalEdgeFirewall(vlanId, assignedAsa.getManagementIp(), ciscoVnmcHost.getId())) {
            s_logger.error("Failed to associate Cisco ASA 1000v (" + assignedAsa.getManagementIp() + ") with logical edge firewall in VNMC for network " + network.getName());
            throw new CloudRuntimeException("Failed to associate Cisco ASA 1000v (" + assignedAsa.getManagementIp() + ") with logical edge firewall in VNMC for network " + network.getName());
        }
    } catch (CloudRuntimeException e) {
        unassignAsa1000vFromNetwork(network);
        s_logger.error("CiscoVnmcElement failed", e);
        return false;
    } catch (Exception e) {
        unassignAsa1000vFromNetwork(network);
        ExceptionUtil.rethrowRuntime(e);
        ExceptionUtil.rethrow(e, InsufficientAddressCapacityException.class);
        ExceptionUtil.rethrow(e, ResourceUnavailableException.class);
        throw new IllegalStateException(e);
    }
    return true;
}