Examples with RemoteAccessVpnVO com.cloud.network.dao.RemoteAccessVpnVO used on opensource projects

Example 6 with RemoteAccessVpnVO

use of com.cloud.network.dao.RemoteAccessVpnVO in project cloudstack by apache.

the class RemoteAccessVpnManagerImpl method createRemoteAccessVpn.

@Override
@DB
public RemoteAccessVpn createRemoteAccessVpn(final long publicIpId, String ipRange, boolean openFirewall, final Boolean forDisplay) throws NetworkRuleConflictException {
    CallContext ctx = CallContext.current();
    final Account caller = ctx.getCallingAccount();
    Long networkId = null;
    // make sure ip address exists
    final PublicIpAddress ipAddr = _networkMgr.getPublicIpAddress(publicIpId);
    if (ipAddr == null) {
        throw new InvalidParameterValueException("Unable to create remote access vpn, invalid public IP address id" + publicIpId);
    }
    _accountMgr.checkAccess(caller, null, true, ipAddr);
    if (!ipAddr.readyToUse()) {
        throw new InvalidParameterValueException("The Ip address is not ready to be used yet: " + ipAddr.getAddress());
    }
    IPAddressVO ipAddress = _ipAddressDao.findById(publicIpId);
    networkId = ipAddress.getAssociatedWithNetworkId();
    if (networkId != null) {
        _networkMgr.checkIpForService(ipAddress, Service.Vpn, null);
    }
    final Long vpcId = ipAddress.getVpcId();
    /* IP Address used for VPC must be the source NAT IP of whole VPC */
    if (vpcId != null && ipAddress.isSourceNat()) {
        assert networkId == null;
        // No firewall setting for VPC, it would be open internally
        openFirewall = false;
    }
    final boolean openFirewallFinal = openFirewall;
    if (networkId == null && vpcId == null) {
        throw new InvalidParameterValueException("Unable to create remote access vpn for the ipAddress: " + ipAddr.getAddress().addr() + " as ip is not associated with any network or VPC");
    }
    RemoteAccessVpnVO vpnVO = _remoteAccessVpnDao.findByPublicIpAddress(publicIpId);
    if (vpnVO != null) {
        //if vpn is in Added state, return it to the api
        if (vpnVO.getState() == RemoteAccessVpn.State.Added) {
            return vpnVO;
        }
        throw new InvalidParameterValueException("A Remote Access VPN already exists for this public Ip address");
    }
    if (ipRange == null) {
        ipRange = RemoteAccessVpnClientIpRange.valueIn(ipAddr.getAccountId());
    }
    final String[] range = ipRange.split("-");
    if (range.length != 2) {
        throw new InvalidParameterValueException("Invalid ip range");
    }
    if (!NetUtils.isValidIp(range[0]) || !NetUtils.isValidIp(range[1])) {
        throw new InvalidParameterValueException("Invalid ip in range specification " + ipRange);
    }
    if (!NetUtils.validIpRange(range[0], range[1])) {
        throw new InvalidParameterValueException("Invalid ip range " + ipRange);
    }
    Pair<String, Integer> cidr = null;
    // TODO: assumes one virtual network / domr per account per zone
    if (networkId != null) {
        vpnVO = _remoteAccessVpnDao.findByAccountAndNetwork(ipAddr.getAccountId(), networkId);
        if (vpnVO != null) {
            //if vpn is in Added state, return it to the api
            if (vpnVO.getState() == RemoteAccessVpn.State.Added) {
                return vpnVO;
            }
            throw new InvalidParameterValueException("A Remote Access VPN already exists for this account");
        }
        //Verify that vpn service is enabled for the network
        Network network = _networkMgr.getNetwork(networkId);
        if (!_networkMgr.areServicesSupportedInNetwork(network.getId(), Service.Vpn)) {
            throw new InvalidParameterValueException("Vpn service is not supported in network id=" + ipAddr.getAssociatedWithNetworkId());
        }
        cidr = NetUtils.getCidr(network.getCidr());
    } else {
        // Don't need to check VPC because there is only one IP(source NAT IP) available for VPN
        Vpc vpc = _vpcDao.findById(vpcId);
        cidr = NetUtils.getCidr(vpc.getCidr());
    }
    // FIXME: This check won't work for the case where the guest ip range
    // changes depending on the vlan allocated.
    String[] guestIpRange = NetUtils.getIpRangeFromCidr(cidr.first(), cidr.second());
    if (NetUtils.ipRangesOverlap(range[0], range[1], guestIpRange[0], guestIpRange[1])) {
        throw new InvalidParameterValueException("Invalid ip range: " + ipRange + " overlaps with guest ip range " + guestIpRange[0] + "-" + guestIpRange[1]);
    }
    // TODO: check sufficient range
    // TODO: check overlap with private and public ip ranges in datacenter
    long startIp = NetUtils.ip2Long(range[0]);
    final String newIpRange = NetUtils.long2Ip(++startIp) + "-" + range[1];
    final String sharedSecret = PasswordGenerator.generatePresharedKey(_pskLength);
    return Transaction.execute(new TransactionCallbackWithException<RemoteAccessVpn, NetworkRuleConflictException>() {

        @Override
        public RemoteAccessVpn doInTransaction(TransactionStatus status) throws NetworkRuleConflictException {
            if (vpcId == null) {
                _rulesMgr.reservePorts(ipAddr, NetUtils.UDP_PROTO, Purpose.Vpn, openFirewallFinal, caller, NetUtils.VPN_PORT, NetUtils.VPN_L2TP_PORT, NetUtils.VPN_NATT_PORT);
            }
            RemoteAccessVpnVO vpnVO = new RemoteAccessVpnVO(ipAddr.getAccountId(), ipAddr.getDomainId(), ipAddr.getAssociatedWithNetworkId(), publicIpId, vpcId, range[0], newIpRange, sharedSecret);
            if (forDisplay != null) {
                vpnVO.setDisplay(forDisplay);
            }
            return _remoteAccessVpnDao.persist(vpnVO);
        }
    });
}

Example 7 with RemoteAccessVpnVO

use of com.cloud.network.dao.RemoteAccessVpnVO in project cloudstack by apache.

the class RemoteAccessVpnManagerImpl method applyVpnUsers.

@DB
@Override
public boolean applyVpnUsers(long vpnOwnerId, String userName) throws ResourceUnavailableException {
    Account caller = CallContext.current().getCallingAccount();
    Account owner = _accountDao.findById(vpnOwnerId);
    _accountMgr.checkAccess(caller, null, true, owner);
    s_logger.debug("Applying vpn users for " + owner);
    List<RemoteAccessVpnVO> vpns = _remoteAccessVpnDao.findByAccount(vpnOwnerId);
    RemoteAccessVpnVO vpnTemp = null;
    List<VpnUserVO> users = _vpnUsersDao.listByAccount(vpnOwnerId);
    //If user is in Active state, we still have to resend them therefore their status has to be Add
    for (VpnUserVO user : users) {
        if (user.getState() == State.Active) {
            user.setState(State.Add);
            _vpnUsersDao.update(user.getId(), user);
        }
    }
    boolean success = true;
    Boolean[] finals = new Boolean[users.size()];
    for (RemoteAccessVPNServiceProvider element : _vpnServiceProviders) {
        s_logger.debug("Applying vpn access to " + element.getName());
        for (RemoteAccessVpnVO vpn : vpns) {
            try {
                String[] results = element.applyVpnUsers(vpn, users);
                if (results != null) {
                    int indexUser = -1;
                    for (int i = 0; i < results.length; i++) {
                        indexUser++;
                        if (indexUser == users.size()) {
                            // results on multiple VPC routers are combined in commit 13eb789, reset user index if one VR is done.
                            indexUser = 0;
                        }
                        s_logger.debug("VPN User " + users.get(indexUser) + (results[i] == null ? " is set on " : (" couldn't be set due to " + results[i]) + " on ") + vpn.getUuid());
                        if (results[i] == null) {
                            if (finals[indexUser] == null) {
                                finals[indexUser] = true;
                            }
                        } else {
                            finals[indexUser] = false;
                            success = false;
                            vpnTemp = vpn;
                        }
                    }
                }
            } catch (Exception e) {
                s_logger.warn("Unable to apply vpn users ", e);
                success = false;
                vpnTemp = vpn;
                for (int i = 0; i < finals.length; i++) {
                    finals[i] = false;
                }
            }
        }
    }
    for (int i = 0; i < finals.length; i++) {
        final VpnUserVO user = users.get(i);
        if (finals[i]) {
            if (user.getState() == State.Add) {
                user.setState(State.Active);
                _vpnUsersDao.update(user.getId(), user);
            } else if (user.getState() == State.Revoke) {
                _vpnUsersDao.remove(user.getId());
            }
        } else {
            if (user.getState() == State.Add && (user.getUsername()).equals(userName)) {
                Transaction.execute(new TransactionCallbackNoReturn() {

                    @Override
                    public void doInTransactionWithoutResult(TransactionStatus status) {
                        _vpnUsersDao.remove(user.getId());
                        UsageEventUtils.publishUsageEvent(EventTypes.EVENT_VPN_USER_REMOVE, user.getAccountId(), 0, user.getId(), user.getUsername(), user.getClass().getName(), user.getUuid());
                    }
                });
            }
            s_logger.warn("Failed to apply vpn for user " + user.getUsername() + ", accountId=" + user.getAccountId());
        }
    }
    if (!success) {
        throw new ResourceUnavailableException("Failed add vpn user due to Resource unavailable ", RemoteAccessVPNServiceProvider.class, vpnTemp.getId());
    }
    return success;
}

Example 8 with RemoteAccessVpnVO

use of com.cloud.network.dao.RemoteAccessVpnVO in project cloudstack by apache.

the class RemoteAccessVpnManagerImpl method searchForRemoteAccessVpns.

@Override
public Pair<List<? extends RemoteAccessVpn>, Integer> searchForRemoteAccessVpns(ListRemoteAccessVpnsCmd cmd) {
    // do some parameter validation
    Account caller = CallContext.current().getCallingAccount();
    Long ipAddressId = cmd.getPublicIpId();
    List<Long> permittedAccounts = new ArrayList<Long>();
    Long vpnId = cmd.getId();
    Long networkId = cmd.getNetworkId();
    if (ipAddressId != null) {
        PublicIpAddress publicIp = _networkMgr.getPublicIpAddress(ipAddressId);
        if (publicIp == null) {
            throw new InvalidParameterValueException("Unable to list remote access vpns, IP address " + ipAddressId + " not found.");
        } else {
            Long ipAddrAcctId = publicIp.getAccountId();
            if (ipAddrAcctId == null) {
                throw new InvalidParameterValueException("Unable to list remote access vpns, IP address " + ipAddressId + " is not associated with an account.");
            }
        }
        _accountMgr.checkAccess(caller, null, true, publicIp);
    }
    Ternary<Long, Boolean, ListProjectResourcesCriteria> domainIdRecursiveListProject = new Ternary<Long, Boolean, ListProjectResourcesCriteria>(cmd.getDomainId(), cmd.isRecursive(), null);
    _accountMgr.buildACLSearchParameters(caller, null, cmd.getAccountName(), cmd.getProjectId(), permittedAccounts, domainIdRecursiveListProject, cmd.listAll(), false);
    Long domainId = domainIdRecursiveListProject.first();
    Boolean isRecursive = domainIdRecursiveListProject.second();
    ListProjectResourcesCriteria listProjectResourcesCriteria = domainIdRecursiveListProject.third();
    Filter filter = new Filter(RemoteAccessVpnVO.class, "serverAddressId", false, cmd.getStartIndex(), cmd.getPageSizeVal());
    SearchBuilder<RemoteAccessVpnVO> sb = _remoteAccessVpnDao.createSearchBuilder();
    _accountMgr.buildACLSearchBuilder(sb, domainId, isRecursive, permittedAccounts, listProjectResourcesCriteria);
    sb.and("serverAddressId", sb.entity().getServerAddressId(), Op.EQ);
    sb.and("id", sb.entity().getId(), Op.EQ);
    sb.and("networkId", sb.entity().getNetworkId(), Op.EQ);
    sb.and("state", sb.entity().getState(), Op.EQ);
    sb.and("display", sb.entity().isDisplay(), Op.EQ);
    SearchCriteria<RemoteAccessVpnVO> sc = sb.create();
    _accountMgr.buildACLSearchCriteria(sc, domainId, isRecursive, permittedAccounts, listProjectResourcesCriteria);
    sc.setParameters("state", RemoteAccessVpn.State.Running);
    if (ipAddressId != null) {
        sc.setParameters("serverAddressId", ipAddressId);
    }
    if (vpnId != null) {
        sc.setParameters("id", vpnId);
    }
    if (networkId != null) {
        sc.setParameters("networkId", networkId);
    }
    Pair<List<RemoteAccessVpnVO>, Integer> result = _remoteAccessVpnDao.searchAndCount(sc, filter);
    return new Pair<List<? extends RemoteAccessVpn>, Integer>(result.first(), result.second());
}

Example 9 with RemoteAccessVpnVO

use of com.cloud.network.dao.RemoteAccessVpnVO in project cloudstack by apache.

the class AccountManagerImpl method cleanupAccount.

protected boolean cleanupAccount(AccountVO account, long callerUserId, Account caller) {
    long accountId = account.getId();
    boolean accountCleanupNeeded = false;
    try {
        // cleanup the users from the account
        List<UserVO> users = _userDao.listByAccount(accountId);
        for (UserVO user : users) {
            if (!_userDao.remove(user.getId())) {
                s_logger.error("Unable to delete user: " + user + " as a part of account " + account + " cleanup");
                accountCleanupNeeded = true;
            }
        }
        // delete global load balancer rules for the account.
        List<org.apache.cloudstack.region.gslb.GlobalLoadBalancerRuleVO> gslbRules = _gslbRuleDao.listByAccount(accountId);
        if (gslbRules != null && !gslbRules.isEmpty()) {
            _gslbService.revokeAllGslbRulesForAccount(caller, accountId);
        }
        // delete the account from project accounts
        _projectAccountDao.removeAccountFromProjects(accountId);
        if (account.getType() != Account.ACCOUNT_TYPE_PROJECT) {
            // delete the account from group
            _messageBus.publish(_name, MESSAGE_REMOVE_ACCOUNT_EVENT, PublishScope.LOCAL, accountId);
        }
        // delete all vm groups belonging to accont
        List<InstanceGroupVO> groups = _vmGroupDao.listByAccountId(accountId);
        for (InstanceGroupVO group : groups) {
            if (!_vmMgr.deleteVmGroup(group.getId())) {
                s_logger.error("Unable to delete group: " + group.getId());
                accountCleanupNeeded = true;
            }
        }
        // Delete the snapshots dir for the account. Have to do this before destroying the VMs.
        boolean success = _snapMgr.deleteSnapshotDirsForAccount(accountId);
        if (success) {
            s_logger.debug("Successfully deleted snapshots directories for all volumes under account " + accountId + " across all zones");
        }
        // clean up templates
        List<VMTemplateVO> userTemplates = _templateDao.listByAccountId(accountId);
        boolean allTemplatesDeleted = true;
        for (VMTemplateVO template : userTemplates) {
            if (template.getRemoved() == null) {
                try {
                    allTemplatesDeleted = _tmpltMgr.delete(callerUserId, template.getId(), null);
                } catch (Exception e) {
                    s_logger.warn("Failed to delete template while removing account: " + template.getName() + " due to: ", e);
                    allTemplatesDeleted = false;
                }
            }
        }
        if (!allTemplatesDeleted) {
            s_logger.warn("Failed to delete templates while removing account id=" + accountId);
            accountCleanupNeeded = true;
        }
        // Destroy VM Snapshots
        List<VMSnapshotVO> vmSnapshots = _vmSnapshotDao.listByAccountId(Long.valueOf(accountId));
        for (VMSnapshot vmSnapshot : vmSnapshots) {
            try {
                _vmSnapshotMgr.deleteVMSnapshot(vmSnapshot.getId());
            } catch (Exception e) {
                s_logger.debug("Failed to cleanup vm snapshot " + vmSnapshot.getId() + " due to " + e.toString());
            }
        }
        // Destroy the account's VMs
        List<UserVmVO> vms = _userVmDao.listByAccountId(accountId);
        if (s_logger.isDebugEnabled()) {
            s_logger.debug("Expunging # of vms (accountId=" + accountId + "): " + vms.size());
        }
        for (UserVmVO vm : vms) {
            if (vm.getState() != VirtualMachine.State.Destroyed && vm.getState() != VirtualMachine.State.Expunging) {
                try {
                    _vmMgr.destroyVm(vm.getId(), false);
                } catch (Exception e) {
                    e.printStackTrace();
                    s_logger.warn("Failed destroying instance " + vm.getUuid() + " as part of account deletion.");
                }
            }
            // should pass in order to perform further cleanup
            if (!_vmMgr.expunge(vm, callerUserId, caller)) {
                s_logger.error("Unable to expunge vm: " + vm.getId());
                accountCleanupNeeded = true;
            }
        }
        // Mark the account's volumes as destroyed
        List<VolumeVO> volumes = _volumeDao.findDetachedByAccount(accountId);
        for (VolumeVO volume : volumes) {
            if (!volume.getState().equals(Volume.State.Destroy)) {
                try {
                    volumeService.deleteVolume(volume.getId(), caller);
                } catch (Exception ex) {
                    s_logger.warn("Failed to cleanup volumes as a part of account id=" + accountId + " cleanup due to Exception: ", ex);
                    accountCleanupNeeded = true;
                }
            }
        }
        // delete remote access vpns and associated users
        List<RemoteAccessVpnVO> remoteAccessVpns = _remoteAccessVpnDao.findByAccount(accountId);
        List<VpnUserVO> vpnUsers = _vpnUser.listByAccount(accountId);
        for (VpnUserVO vpnUser : vpnUsers) {
            _remoteAccessVpnMgr.removeVpnUser(accountId, vpnUser.getUsername(), caller);
        }
        try {
            for (RemoteAccessVpnVO vpn : remoteAccessVpns) {
                _remoteAccessVpnMgr.destroyRemoteAccessVpnForIp(vpn.getServerAddressId(), caller, false);
            }
        } catch (ResourceUnavailableException ex) {
            s_logger.warn("Failed to cleanup remote access vpn resources as a part of account id=" + accountId + " cleanup due to Exception: ", ex);
            accountCleanupNeeded = true;
        }
        // Cleanup security groups
        int numRemoved = _securityGroupDao.removeByAccountId(accountId);
        s_logger.info("deleteAccount: Deleted " + numRemoved + " network groups for account " + accountId);
        // Cleanup affinity groups
        int numAGRemoved = _affinityGroupDao.removeByAccountId(accountId);
        s_logger.info("deleteAccount: Deleted " + numAGRemoved + " affinity groups for account " + accountId);
        // Delete all the networks
        boolean networksDeleted = true;
        s_logger.debug("Deleting networks for account " + account.getId());
        List<NetworkVO> networks = _networkDao.listByOwner(accountId);
        if (networks != null) {
            for (NetworkVO network : networks) {
                ReservationContext context = new ReservationContextImpl(null, null, getActiveUser(callerUserId), caller);
                if (!_networkMgr.destroyNetwork(network.getId(), context, false)) {
                    s_logger.warn("Unable to destroy network " + network + " as a part of account id=" + accountId + " cleanup.");
                    accountCleanupNeeded = true;
                    networksDeleted = false;
                } else {
                    s_logger.debug("Network " + network.getId() + " successfully deleted as a part of account id=" + accountId + " cleanup.");
                }
            }
        }
        // Delete all VPCs
        boolean vpcsDeleted = true;
        s_logger.debug("Deleting vpcs for account " + account.getId());
        List<? extends Vpc> vpcs = _vpcMgr.getVpcsForAccount(account.getId());
        for (Vpc vpc : vpcs) {
            if (!_vpcMgr.destroyVpc(vpc, caller, callerUserId)) {
                s_logger.warn("Unable to destroy VPC " + vpc + " as a part of account id=" + accountId + " cleanup.");
                accountCleanupNeeded = true;
                vpcsDeleted = false;
            } else {
                s_logger.debug("VPC " + vpc.getId() + " successfully deleted as a part of account id=" + accountId + " cleanup.");
            }
        }
        if (networksDeleted && vpcsDeleted) {
            // release ip addresses belonging to the account
            List<? extends IpAddress> ipsToRelease = _ipAddressDao.listByAccount(accountId);
            for (IpAddress ip : ipsToRelease) {
                s_logger.debug("Releasing ip " + ip + " as a part of account id=" + accountId + " cleanup");
                if (!_ipAddrMgr.disassociatePublicIpAddress(ip.getId(), callerUserId, caller)) {
                    s_logger.warn("Failed to release ip address " + ip + " as a part of account id=" + accountId + " clenaup");
                    accountCleanupNeeded = true;
                }
            }
        }
        // Delete Site 2 Site VPN customer gateway
        s_logger.debug("Deleting site-to-site VPN customer gateways for account " + accountId);
        if (!_vpnMgr.deleteCustomerGatewayByAccount(accountId)) {
            s_logger.warn("Fail to delete site-to-site VPN customer gateways for account " + accountId);
        }
        // Delete autoscale resources if any
        try {
            _autoscaleMgr.cleanUpAutoScaleResources(accountId);
        } catch (CloudRuntimeException ex) {
            s_logger.warn("Failed to cleanup AutoScale resources as a part of account id=" + accountId + " cleanup due to exception:", ex);
            accountCleanupNeeded = true;
        }
        // up successfully
        if (networksDeleted) {
            if (!_configMgr.releaseAccountSpecificVirtualRanges(accountId)) {
                accountCleanupNeeded = true;
            } else {
                s_logger.debug("Account specific Virtual IP ranges " + " are successfully released as a part of account id=" + accountId + " cleanup.");
            }
        }
        // release account specific guest vlans
        List<AccountGuestVlanMapVO> maps = _accountGuestVlanMapDao.listAccountGuestVlanMapsByAccount(accountId);
        for (AccountGuestVlanMapVO map : maps) {
            _dataCenterVnetDao.releaseDedicatedGuestVlans(map.getId());
        }
        int vlansReleased = _accountGuestVlanMapDao.removeByAccountId(accountId);
        s_logger.info("deleteAccount: Released " + vlansReleased + " dedicated guest vlan ranges from account " + accountId);
        // release account specific acquired portable IP's. Since all the portable IP's must have been already
        // disassociated with VPC/guest network (due to deletion), so just mark portable IP as free.
        List<? extends IpAddress> ipsToRelease = _ipAddressDao.listByAccount(accountId);
        for (IpAddress ip : ipsToRelease) {
            if (ip.isPortable()) {
                s_logger.debug("Releasing portable ip " + ip + " as a part of account id=" + accountId + " cleanup");
                _ipAddrMgr.releasePortableIpAddress(ip.getId());
            }
        }
        // release dedication if any
        List<DedicatedResourceVO> dedicatedResources = _dedicatedDao.listByAccountId(accountId);
        if (dedicatedResources != null && !dedicatedResources.isEmpty()) {
            s_logger.debug("Releasing dedicated resources for account " + accountId);
            for (DedicatedResourceVO dr : dedicatedResources) {
                if (!_dedicatedDao.remove(dr.getId())) {
                    s_logger.warn("Fail to release dedicated resources for account " + accountId);
                }
            }
        }
        // Updating and deleting the resourceLimit and resourceCount should be the last step in cleanupAccount
        // process.
        // Update resource count for this account and for parent domains.
        List<ResourceCountVO> resourceCounts = _resourceCountDao.listByOwnerId(accountId, ResourceOwnerType.Account);
        for (ResourceCountVO resourceCount : resourceCounts) {
            _resourceLimitMgr.decrementResourceCount(accountId, resourceCount.getType(), resourceCount.getCount());
        }
        // Delete resource count and resource limits entries set for this account (if there are any).
        _resourceCountDao.removeEntriesByOwner(accountId, ResourceOwnerType.Account);
        _resourceLimitDao.removeEntriesByOwner(accountId, ResourceOwnerType.Account);
        return true;
    } catch (Exception ex) {
        s_logger.warn("Failed to cleanup account " + account + " due to ", ex);
        accountCleanupNeeded = true;
        return true;
    } finally {
        s_logger.info("Cleanup for account " + account.getId() + (accountCleanupNeeded ? " is needed." : " is not needed."));
        if (accountCleanupNeeded) {
            _accountDao.markForCleanup(accountId);
        } else {
            account.setNeedsCleanup(false);
            _accountDao.update(accountId, account);
        }
    }
}