Skip to content

NSX: Fix Routed Mode for Isolated and VPC networks #8534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pearl1594 merged 5 commits into from
Jan 23, 2024
Merged

NSX: Fix Routed Mode for Isolated and VPC networks #8534

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1040156
NSX: Fix Routed Mode for Isolated and VPC networks
Pearl1594 Jan 19, 2024
906fce5
NSX: Fix Routed mode - add checks for ports added for FW rules
Pearl1594 Jan 22, 2024
b0b4175
Merge branch 'nsx-integration' of https://github.com/apache/cloudstac…
Pearl1594 Jan 22, 2024
f537283
clean up code
Pearl1594 Jan 22, 2024
0455f63
fix build failure
Pearl1594 Jan 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion ...network-elements/nsx/src/main/java/org/apache/cloudstack/service/NsxGuestNetworkGuru.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@
import com.cloud.network.guru.GuestNetworkGuru;
import com.cloud.network.vpc.VpcVO;
import com.cloud.offering.NetworkOffering;
import com.cloud.offerings.NetworkOfferingVO;
import com.cloud.offerings.dao.NetworkOfferingServiceMapDao;
import com.cloud.user.Account;
import com.cloud.user.dao.AccountDao;
Expand Down Expand Up @@ -227,7 +228,9 @@ public NicProfile allocate(Network network, NicProfile nic, VirtualMachineProfil
throw new CloudRuntimeException(msg);
}

if (isNull(network.getVpcId())) {
NetworkOfferingVO networkOfferingVO = networkOfferingDao.findById(network.getNetworkOfferingId());

if (isNull(network.getVpcId()) && networkOfferingVO.getNsxMode().equals(NetworkOffering.NsxMode.NATTED.name())) {
long domainId = domain.getId();
long accountId = account.getId();
long dataCenterId = zone.getId();
Expand Down
16 changes: 13 additions & 3 deletions server/src/main/java/com/cloud/network/firewall/FirewallManagerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -701,7 +701,7 @@ public boolean applyFirewallRules(List<FirewallRuleVO> rules, boolean continueOn
for (FirewallRuleVO rule : rules) {
// validate rule - for NSX
long networkId = rule.getNetworkId();
validateNsxConstraints(networkId, rule.getProtocol(), rule.getIcmpType(), rule.getIcmpCode());
validateNsxConstraints(networkId, rule);
// load cidrs if any
rule.setSourceCidrList(_firewallCidrsDao.getSourceCidrs(rule.getId()));
rule.setDestinationCidrsList(_firewallDcidrsDao.getDestCidrs(rule.getId()));
Expand All @@ -723,18 +723,28 @@ public boolean applyFirewallRules(List<FirewallRuleVO> rules, boolean continueOn
return true;
}

private void validateNsxConstraints(long networkId, String protocol, Integer icpmType, Integer icmpCode) {
private void validateNsxConstraints(long networkId, FirewallRuleVO rule) {
String protocol = rule.getProtocol();
final Network network = entityManager.findById(Network.class, networkId);
final DataCenter dc = entityManager.findById(DataCenter.class, network.getDataCenterId());
final NsxProviderVO nsxProvider = nsxProviderDao.findByZoneId(dc.getId());
if (Objects.isNull(nsxProvider)) {
return;
}
if (NetUtils.ICMP_PROTO.equals(protocol.toLowerCase(Locale.ROOT)) && (icpmType == -1 || icmpCode == -1)) {

if (NetUtils.ICMP_PROTO.equals(protocol.toLowerCase(Locale.ROOT)) && (rule.getIcmpType() == -1 || rule.getIcmpCode() == -1)) {
String errorMsg = "Passing -1 for ICMP type is not supported for NSX enabled zones";
s_logger.error(errorMsg);
throw new InvalidParameterValueException(errorMsg);
}

if (List.of(NetUtils.TCP_PROTO, NetUtils.UDP_PROTO).contains(protocol.toLowerCase(Locale.ROOT)) &&
(Objects.isNull(rule.getSourcePortStart()) || Objects.isNull(rule.getSourcePortEnd())) &&
State.Add.equals(rule.getState())) {
String errorMsg = "Source start and end ports are required to be passed";
s_logger.error(errorMsg);
throw new InvalidParameterValueException(errorMsg);
}
}

@Override
Expand Down
10 changes: 5 additions & 5 deletions server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1246,16 +1246,16 @@ private Map<Service, Provider> getServicesAndProvidersForNSXNetwork(NetworkOffer
serviceProviderMap.put(Service.Dhcp, routerProvider);
serviceProviderMap.put(Service.Dns, routerProvider);
serviceProviderMap.put(Service.UserData, routerProvider);
if (forVpc) {
serviceProviderMap.put(Service.NetworkACL, Provider.Nsx);
} else {
serviceProviderMap.put(Service.Firewall, Provider.Nsx);
}
if (nsxMode == NetworkOffering.NsxMode.NATTED) {
serviceProviderMap.put(Service.SourceNat, Provider.Nsx);
serviceProviderMap.put(Service.StaticNat, Provider.Nsx);
serviceProviderMap.put(Service.PortForwarding, Provider.Nsx);
serviceProviderMap.put(Service.Lb, Provider.Nsx);
if (forVpc) {
serviceProviderMap.put(Service.NetworkACL, Provider.Nsx);
} else {
serviceProviderMap.put(Service.Firewall, Provider.Nsx);
}
}
return serviceProviderMap;
}
Expand Down