You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by ja...@apache.org on 2013/06/24 11:22:16 UTC
[2/6] git commit: updated refs/heads/master-6-17-stable to 4f75062
CLOUDSTACK-1578 Egress default policy configurable using network offering in xenserver with VR as firewall provider
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/32b43d2b
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/32b43d2b
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/32b43d2b
Branch: refs/heads/master-6-17-stable
Commit: 32b43d2b174496a5a0ae21024062247f6166374c
Parents: f00ebad
Author: Jayapal <ja...@apache.org>
Authored: Mon Jun 24 14:24:49 2013 +0530
Committer: Jayapal <ja...@apache.org>
Committed: Mon Jun 24 14:30:22 2013 +0530
----------------------------------------------------------------------
api/src/com/cloud/offering/NetworkOffering.java | 1 +
.../org/apache/cloudstack/api/ApiConstants.java | 1 +
.../admin/network/CreateNetworkOfferingCmd.java | 10 ++++++
.../api/response/NetworkOfferingResponse.java | 7 ++++
.../api/routing/NetworkElementCommand.java | 1 +
.../com/cloud/network/rules/FirewallRuleVO.java | 7 ++++
.../com/cloud/offerings/NetworkOfferingVO.java | 10 +++++-
.../debian/config/root/firewallRule_egress.sh | 26 +++++++++++---
.../xen/resource/CitrixResourceBase.java | 8 +++++
server/src/com/cloud/api/ApiResponseHelper.java | 1 +
.../configuration/ConfigurationManager.java | 2 +-
.../configuration/ConfigurationManagerImpl.java | 12 +++++--
.../com/cloud/network/NetworkManagerImpl.java | 37 +++++++++++++-------
.../network/firewall/FirewallManagerImpl.java | 31 ++++++++++++++++
.../VirtualNetworkApplianceManagerImpl.java | 32 ++++++++++++-----
.../cloud/network/rules/FirewallManager.java | 1 +
.../cloud/server/ConfigurationServerImpl.java | 2 +-
.../cloud/network/MockFirewallManagerImpl.java | 5 +++
.../cloud/vpc/MockConfigurationManagerImpl.java | 2 +-
.../CreateNetworkOfferingTest.java | 20 +++++------
setup/db/db/schema-410to420.sql | 1 +
21 files changed, 175 insertions(+), 42 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/api/src/com/cloud/offering/NetworkOffering.java
----------------------------------------------------------------------
diff --git a/api/src/com/cloud/offering/NetworkOffering.java b/api/src/com/cloud/offering/NetworkOffering.java
index 5f522eb..43312db 100644
--- a/api/src/com/cloud/offering/NetworkOffering.java
+++ b/api/src/com/cloud/offering/NetworkOffering.java
@@ -127,5 +127,6 @@ public interface NetworkOffering extends InfrastructureEntity, InternalIdentity,
boolean getInternalLb();
boolean getPublicLb();
+ boolean getEgressDefaultPolicy();
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/api/src/org/apache/cloudstack/api/ApiConstants.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/ApiConstants.java b/api/src/org/apache/cloudstack/api/ApiConstants.java
index b43f06c..c4dba5d 100755
--- a/api/src/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/org/apache/cloudstack/api/ApiConstants.java
@@ -117,6 +117,7 @@ public class ApiConstants {
public static final String IS_PORTABLE = "isportable";
public static final String IS_PUBLIC = "ispublic";
public static final String IS_PERSISTENT = "ispersistent";
+ public static final String EGRESS_DEFAULT_POLICY = "egressdefaultpolicy";
public static final String IS_READY = "isready";
public static final String IS_RECURSIVE = "isrecursive";
public static final String ISO_FILTER = "isofilter";
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/api/src/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java b/api/src/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java
index febb0c3..94e263c 100644
--- a/api/src/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java
+++ b/api/src/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java
@@ -99,6 +99,9 @@ public class CreateNetworkOfferingCmd extends BaseCmd {
" Supported keys are internallbprovider/publiclbprovider with service provider as a value")
protected Map details;
+ @Parameter(name=ApiConstants.EGRESS_DEFAULT_POLICY, type=CommandType.BOOLEAN, description="true if default guest network egress policy is allow; false if default egress policy is deny")
+ private Boolean egressDefaultPolicy;
+
/////////////////////////////////////////////////////
/////////////////// Accessors ///////////////////////
/////////////////////////////////////////////////////
@@ -162,6 +165,13 @@ public class CreateNetworkOfferingCmd extends BaseCmd {
return isPersistent == null ? false : isPersistent;
}
+ public Boolean getEgressDefaultPolicy() {
+ if (egressDefaultPolicy == null) {
+ return true;
+ }
+ return egressDefaultPolicy;
+ }
+
public Map<String, List<String>> getServiceProviders() {
Map<String, List<String>> serviceProviderMap = null;
if (serviceProviderList != null && !serviceProviderList.isEmpty()) {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/api/src/org/apache/cloudstack/api/response/NetworkOfferingResponse.java
----------------------------------------------------------------------
diff --git a/api/src/org/apache/cloudstack/api/response/NetworkOfferingResponse.java b/api/src/org/apache/cloudstack/api/response/NetworkOfferingResponse.java
index 7a7e371..6b35d7b 100644
--- a/api/src/org/apache/cloudstack/api/response/NetworkOfferingResponse.java
+++ b/api/src/org/apache/cloudstack/api/response/NetworkOfferingResponse.java
@@ -88,6 +88,9 @@ public class NetworkOfferingResponse extends BaseResponse {
@SerializedName(ApiConstants.DETAILS) @Param(description="additional key/value details tied with network offering", since="4.2.0")
private Map details;
+ @SerializedName(ApiConstants.EGRESS_DEFAULT_POLICY) @Param(description="true if network offering supports persistent networks, false otherwise")
+ private Boolean egressDefaultPolicy;
+
public void setId(String id) {
this.id = id;
@@ -166,4 +169,8 @@ public class NetworkOfferingResponse extends BaseResponse {
this.details = details;
}
+ public void setEgressDefaultPolicy(Boolean egressDefaultPolicy) {
+ this.egressDefaultPolicy = egressDefaultPolicy;
+ }
+
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/core/src/com/cloud/agent/api/routing/NetworkElementCommand.java
----------------------------------------------------------------------
diff --git a/core/src/com/cloud/agent/api/routing/NetworkElementCommand.java b/core/src/com/cloud/agent/api/routing/NetworkElementCommand.java
index ddb7ac8..843d213 100644
--- a/core/src/com/cloud/agent/api/routing/NetworkElementCommand.java
+++ b/core/src/com/cloud/agent/api/routing/NetworkElementCommand.java
@@ -33,6 +33,7 @@ public abstract class NetworkElementCommand extends Command {
public static final String ZONE_NETWORK_TYPE = "zone.network.type";
public static final String GUEST_BRIDGE = "guest.bridge";
public static final String VPC_PRIVATE_GATEWAY = "vpc.gateway.private";
+ public static final String FIREWALL_EGRESS_DEFAULT = "firewall.egress.default";
protected NetworkElementCommand() {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/engine/schema/src/com/cloud/network/rules/FirewallRuleVO.java
----------------------------------------------------------------------
diff --git a/engine/schema/src/com/cloud/network/rules/FirewallRuleVO.java b/engine/schema/src/com/cloud/network/rules/FirewallRuleVO.java
index 9f73029..a51c364 100644
--- a/engine/schema/src/com/cloud/network/rules/FirewallRuleVO.java
+++ b/engine/schema/src/com/cloud/network/rules/FirewallRuleVO.java
@@ -223,6 +223,13 @@ public class FirewallRuleVO implements FirewallRule {
}
+ public FirewallRuleVO(String xId, Long ipAddressId, Integer portStart, Integer portEnd, String protocol,
+ long networkId, long accountId, long domainId, Purpose purpose, List<String> sourceCidrs, Integer icmpCode,
+ Integer icmpType, Long related, TrafficType trafficType, FirewallRuleType type) {
+ this(xId, ipAddressId, portStart, portEnd, protocol, networkId, accountId, domainId, purpose, sourceCidrs, icmpCode, icmpType, related, trafficType);
+ this.type = type;
+ }
+
public FirewallRuleVO(String xId, long ipAddressId, int port, String protocol, long networkId, long accountId,
long domainId, Purpose purpose, List<String> sourceCidrs, Integer icmpCode, Integer icmpType, Long related) {
this(xId, ipAddressId, port, port, protocol, networkId, accountId, domainId, purpose, sourceCidrs, icmpCode, icmpType, related, null);
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/engine/schema/src/com/cloud/offerings/NetworkOfferingVO.java
----------------------------------------------------------------------
diff --git a/engine/schema/src/com/cloud/offerings/NetworkOfferingVO.java b/engine/schema/src/com/cloud/offerings/NetworkOfferingVO.java
index fae315b..6317f72 100755
--- a/engine/schema/src/com/cloud/offerings/NetworkOfferingVO.java
+++ b/engine/schema/src/com/cloud/offerings/NetworkOfferingVO.java
@@ -130,6 +130,9 @@ public class NetworkOfferingVO implements NetworkOffering {
@Column(name = "is_persistent")
boolean isPersistent;
+ @Column(name = "egress_default_policy")
+ boolean egressdefaultpolicy;
+
@Override
public String getDisplayText() {
return displayText;
@@ -275,6 +278,10 @@ public class NetworkOfferingVO implements NetworkOffering {
this.redundantRouter = redundantRouter;
}
+ public boolean getEgressDefaultPolicy() {
+ return egressdefaultpolicy;
+ }
+
public NetworkOfferingVO(String name, String displayText, TrafficType trafficType, boolean systemOnly, boolean specifyVlan, Integer rateMbps, Integer multicastRateMbps, boolean isDefault,
Availability availability, String tags, Network.GuestType guestType, boolean conserveMode, boolean specifyIpRanges, boolean isPersistent, boolean internalLb, boolean publicLb) {
this.name = name;
@@ -306,7 +313,7 @@ public class NetworkOfferingVO implements NetworkOffering {
public NetworkOfferingVO(String name, String displayText, TrafficType trafficType, boolean systemOnly, boolean specifyVlan, Integer rateMbps, Integer multicastRateMbps, boolean isDefault,
Availability availability, String tags, Network.GuestType guestType, boolean conserveMode, boolean dedicatedLb, boolean sharedSourceNat, boolean redundantRouter, boolean elasticIp, boolean elasticLb,
- boolean specifyIpRanges, boolean inline, boolean isPersistent, boolean associatePublicIP, boolean publicLb, boolean internalLb) {
+ boolean specifyIpRanges, boolean inline, boolean isPersistent, boolean associatePublicIP, boolean publicLb, boolean internalLb, boolean egressdefaultpolicy) {
this(name, displayText, trafficType, systemOnly, specifyVlan, rateMbps, multicastRateMbps, isDefault, availability, tags, guestType, conserveMode, specifyIpRanges, isPersistent, internalLb, publicLb);
this.dedicatedLB = dedicatedLb;
this.sharedSourceNat = sharedSourceNat;
@@ -315,6 +322,7 @@ public class NetworkOfferingVO implements NetworkOffering {
this.elasticLb = elasticLb;
this.inline = inline;
this.eipAssociatePublicIp = associatePublicIP;
+ this.egressdefaultpolicy = egressdefaultpolicy;
}
public NetworkOfferingVO() {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/patches/systemvm/debian/config/root/firewallRule_egress.sh
----------------------------------------------------------------------
diff --git a/patches/systemvm/debian/config/root/firewallRule_egress.sh b/patches/systemvm/debian/config/root/firewallRule_egress.sh
index 0da7718..b1e7a40 100755
--- a/patches/systemvm/debian/config/root/firewallRule_egress.sh
+++ b/patches/systemvm/debian/config/root/firewallRule_egress.sh
@@ -82,15 +82,14 @@ fw_entry_for_egress() {
[ "$eport" == "-1" ] && typecode="$sport"
[ "$sport" == "-1" ] && typecode="any"
sudo iptables -A FW_EGRESS_RULES -p $prot -s $lcidr --icmp-type $typecode \
- -j ACCEPT
+ -j $target
result=$?
elif [ "$prot" == "all" ]
then
- sudo iptables -A FW_EGRESS_RULES -p $prot -s $lcidr -j ACCEPT
+ sudo iptables -A FW_EGRESS_RULES -p $prot -s $lcidr -j $target
result=$?
else
- sudo iptables -A FW_EGRESS_RULES -p $prot -s $lcidr \
- $DPORT -j ACCEPT
+ sudo iptables -A FW_EGRESS_RULES -p $prot -s $lcidr $DPORT -j $target
result=$?
fi
@@ -109,14 +108,18 @@ rules=""
rules_list=""
ip=""
dev=""
+pflag=0
shift
shift
-while getopts 'a:' OPTION
+while getopts 'a:P:' OPTION
do
case $OPTION in
a) aflag=1
rules="$OPTARG"
;;
+ P) pflag=1
+ pvalue="$OPTARG"
+ ;;
?) usage
unlock_exit 2 $lock $locked
;;
@@ -142,6 +145,13 @@ fi
success=0
+if [ "$pvalue" == "0" -o "$pvalue" == "2" ]
+ then
+ target="ACCEPT"
+ else
+ target="DROP"
+ fi
+
fw_egress_chain
for r in $rules_list
do
@@ -162,6 +172,12 @@ then
fw_egress_backup_restore
else
logger -t cloud "deleting backup for guest network"
+ if [ "$pvalue" == "1" -o "$pvalue" == "2" ]
+ then
+ #Adding default policy rule
+ sudo iptables -A FW_EGRESS_RULES -j ACCEPT
+ fi
+
fi
fw_egress_remove_backup
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/plugins/hypervisors/xen/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
----------------------------------------------------------------------
diff --git a/plugins/hypervisors/xen/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java b/plugins/hypervisors/xen/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
index 5e8283a..bb267fb 100644
--- a/plugins/hypervisors/xen/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
+++ b/plugins/hypervisors/xen/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
@@ -7920,6 +7920,7 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe
String callResult;
Connection conn = getConnection();
String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
+ String egressDefault = cmd.getAccessDetail(NetworkElementCommand.FIREWALL_EGRESS_DEFAULT);
FirewallRuleTO[] allrules = cmd.getRules();
FirewallRule.TrafficType trafficType = allrules[0].getTrafficType();
if (routerIp == null) {
@@ -7931,6 +7932,13 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe
args += routerIp + " -F";
if (trafficType == FirewallRule.TrafficType.Egress){
args+= " -E";
+ if (egressDefault.equals("true")) {
+ args+= " -P 1";
+ } else if (egressDefault.equals("System")) {
+ args+= " -P 2";
+ } else {
+ args+= " -P 0";
+ }
}
StringBuilder sb = new StringBuilder();
String[] fwRules = rules[0];
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/src/com/cloud/api/ApiResponseHelper.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/api/ApiResponseHelper.java b/server/src/com/cloud/api/ApiResponseHelper.java
index c0034ab..14254ac 100755
--- a/server/src/com/cloud/api/ApiResponseHelper.java
+++ b/server/src/com/cloud/api/ApiResponseHelper.java
@@ -2049,6 +2049,7 @@ public class ApiResponseHelper implements ResponseGenerator {
response.setAvailability(offering.getAvailability().toString());
response.setIsPersistent(offering.getIsPersistent());
response.setNetworkRate(ApiDBUtils.getNetworkRate(offering.getId()));
+ response.setEgressDefaultPolicy(offering.getEgressDefaultPolicy());
Long so = null;
if (offering.getServiceOfferingId() != null) {
so = offering.getServiceOfferingId();
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/src/com/cloud/configuration/ConfigurationManager.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/configuration/ConfigurationManager.java b/server/src/com/cloud/configuration/ConfigurationManager.java
index 8db037b..3f0bdbe 100755
--- a/server/src/com/cloud/configuration/ConfigurationManager.java
+++ b/server/src/com/cloud/configuration/ConfigurationManager.java
@@ -205,7 +205,7 @@ public interface ConfigurationManager extends ConfigurationService, Manager {
NetworkOfferingVO createNetworkOffering(String name, String displayText, TrafficType trafficType, String tags, boolean specifyVlan, Availability availability, Integer networkRate, Map<Service, Set<Provider>> serviceProviderMap,
boolean isDefault, Network.GuestType type, boolean systemOnly, Long serviceOfferingId, boolean conserveMode, Map<Service, Map<Capability, String>> serviceCapabilityMap,
- boolean specifyIpRanges, boolean isPersistent, Map<NetworkOffering.Detail,String> details);
+ boolean specifyIpRanges, boolean isPersistent, Map<NetworkOffering.Detail,String> details, boolean egressDefaultPolicy);
Vlan createVlanAndPublicIpRange(long zoneId, long networkId, long physicalNetworkId, boolean forVirtualNetwork, Long podId, String startIP, String endIP, String vlanGateway, String vlanNetmask, String vlanId, Account vlanOwner, String startIPv6, String endIPv6, String vlanIp6Gateway, String vlanIp6Cidr) throws InsufficientCapacityException, ConcurrentOperationException, InvalidParameterValueException;
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/src/com/cloud/configuration/ConfigurationManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/configuration/ConfigurationManagerImpl.java b/server/src/com/cloud/configuration/ConfigurationManagerImpl.java
index 97f0d33..60e23e5 100755
--- a/server/src/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/com/cloud/configuration/ConfigurationManagerImpl.java
@@ -3590,6 +3590,7 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
boolean specifyIpRanges = cmd.getSpecifyIpRanges();
boolean isPersistent = cmd.getIsPersistent();
Map<String, String> detailsStr = cmd.getDetails();
+ Boolean egressDefaultPolicy = cmd.getEgressDefaultPolicy();
// Verify traffic type
for (TrafficType tType : TrafficType.values()) {
@@ -3757,6 +3758,9 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
Set<Provider> firewallProviderSet = new HashSet<Provider>();
firewallProviderSet.add(firewallProvider);
serviceProviderMap.put(Service.Firewall, firewallProviderSet);
+ if (!(firewallProvider.getName().equals(Provider.JuniperSRX.getName()) || firewallProvider.getName().equals(Provider.VirtualRouter.getName())) && egressDefaultPolicy == false) {
+ throw new InvalidParameterValueException("Firewall egress with default policy " + egressDefaultPolicy + "is not supported by the provider "+ firewallProvider.getName());
+ }
}
Map<NetworkOffering.Detail, String> details = new HashMap<NetworkOffering.Detail, String>();
@@ -3777,7 +3781,7 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
}
return createNetworkOffering(name, displayText, trafficType, tags, specifyVlan, availability, networkRate, serviceProviderMap, false, guestType, false,
- serviceOfferingId, conserveMode, serviceCapabilityMap, specifyIpRanges, isPersistent, details);
+ serviceOfferingId, conserveMode, serviceCapabilityMap, specifyIpRanges, isPersistent, details, egressDefaultPolicy);
}
void validateLoadBalancerServiceCapabilities(Map<Capability, String> lbServiceCapabilityMap) {
@@ -3885,9 +3889,11 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
@Override
@DB
+
public NetworkOfferingVO createNetworkOffering(String name, String displayText, TrafficType trafficType, String tags, boolean specifyVlan, Availability availability, Integer networkRate,
Map<Service, Set<Provider>> serviceProviderMap, boolean isDefault, Network.GuestType type, boolean systemOnly, Long serviceOfferingId,
- boolean conserveMode, Map<Service, Map<Capability, String>> serviceCapabilityMap, boolean specifyIpRanges, boolean isPersistent, Map<NetworkOffering.Detail,String> details) {
+ boolean conserveMode, Map<Service, Map<Capability, String>> serviceCapabilityMap, boolean specifyIpRanges, boolean isPersistent, Map<NetworkOffering.Detail,String> details,
+ boolean egressDefaultPolicy) {
String multicastRateStr = _configDao.getValue("multicast.throttling.rate");
int multicastRate = ((multicastRateStr == null) ? 10 : Integer.parseInt(multicastRateStr));
@@ -4020,7 +4026,7 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
NetworkOfferingVO offering = new NetworkOfferingVO(name, displayText, trafficType, systemOnly, specifyVlan,
networkRate, multicastRate, isDefault, availability, tags, type, conserveMode, dedicatedLb,
- sharedSourceNat, redundantRouter, elasticIp, elasticLb, specifyIpRanges, inline, isPersistent, associatePublicIp, publicLb, internalLb);
+ sharedSourceNat, redundantRouter, elasticIp, elasticLb, specifyIpRanges, inline, isPersistent, associatePublicIp, publicLb, internalLb, egressDefaultPolicy);
if (serviceOfferingId != null) {
offering.setServiceOfferingId(serviceOfferingId);
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/src/com/cloud/network/NetworkManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/network/NetworkManagerImpl.java b/server/src/com/cloud/network/NetworkManagerImpl.java
index 8c2806a..67f08ee 100755
--- a/server/src/com/cloud/network/NetworkManagerImpl.java
+++ b/server/src/com/cloud/network/NetworkManagerImpl.java
@@ -1308,7 +1308,7 @@ public class NetworkManagerImpl extends ManagerBase implements NetworkManager, L
_configMgr.createNetworkOffering(NetworkOffering.QuickCloudNoServices,
"Offering for QuickCloud with no services", TrafficType.Guest, null, true,
Availability.Optional, null, new HashMap<Network.Service, Set<Network.Provider>>(), true,
- Network.GuestType.Shared, false, null, true, null, true, false, null);
+ Network.GuestType.Shared, false, null, true, null, true, false, null, false);
offering.setState(NetworkOffering.State.Enabled);
_networkOfferingDao.update(offering.getId(), offering);
}
@@ -1319,7 +1319,7 @@ public class NetworkManagerImpl extends ManagerBase implements NetworkManager, L
_configMgr.createNetworkOffering(NetworkOffering.DefaultSharedNetworkOfferingWithSGService,
"Offering for Shared Security group enabled networks", TrafficType.Guest, null, true,
Availability.Optional, null, defaultSharedNetworkOfferingProviders, true,
- Network.GuestType.Shared, false, null, true, null, true, false, null);
+ Network.GuestType.Shared, false, null, true, null, true, false, null, false);
offering.setState(NetworkOffering.State.Enabled);
_networkOfferingDao.update(offering.getId(), offering);
}
@@ -1327,7 +1327,7 @@ public class NetworkManagerImpl extends ManagerBase implements NetworkManager, L
//#3 - shared network offering with no SG service
if (_networkOfferingDao.findByUniqueName(NetworkOffering.DefaultSharedNetworkOffering) == null) {
offering = _configMgr.createNetworkOffering(NetworkOffering.DefaultSharedNetworkOffering, "Offering for Shared networks", TrafficType.Guest, null, true, Availability.Optional, null,
- defaultSharedNetworkOfferingProviders, true, Network.GuestType.Shared, false, null, true, null, true, false, null);
+ defaultSharedNetworkOfferingProviders, true, Network.GuestType.Shared, false, null, true, null, true, false, null, false);
offering.setState(NetworkOffering.State.Enabled);
_networkOfferingDao.update(offering.getId(), offering);
}
@@ -1338,7 +1338,8 @@ public class NetworkManagerImpl extends ManagerBase implements NetworkManager, L
offering = _configMgr.createNetworkOffering(NetworkOffering.DefaultIsolatedNetworkOfferingWithSourceNatService,
"Offering for Isolated networks with Source Nat service enabled", TrafficType.Guest,
null, false, Availability.Required, null, defaultIsolatedSourceNatEnabledNetworkOfferingProviders,
- true, Network.GuestType.Isolated, false, null, true, null, false, false, null);
+ true, Network.GuestType.Isolated, false, null, true, null, false, false, null, false);
+
offering.setState(NetworkOffering.State.Enabled);
_networkOfferingDao.update(offering.getId(), offering);
}
@@ -1348,7 +1349,7 @@ public class NetworkManagerImpl extends ManagerBase implements NetworkManager, L
offering = _configMgr.createNetworkOffering(NetworkOffering.DefaultIsolatedNetworkOfferingForVpcNetworks,
"Offering for Isolated VPC networks with Source Nat service enabled", TrafficType.Guest,
null, false, Availability.Optional, null, defaultVPCOffProviders,
- true, Network.GuestType.Isolated, false, null, false, null, false, false, null);
+ true, Network.GuestType.Isolated, false, null, false, null, false, false, null,false);
offering.setState(NetworkOffering.State.Enabled);
_networkOfferingDao.update(offering.getId(), offering);
}
@@ -1360,7 +1361,7 @@ public class NetworkManagerImpl extends ManagerBase implements NetworkManager, L
offering = _configMgr.createNetworkOffering(NetworkOffering.DefaultIsolatedNetworkOfferingForVpcNetworksNoLB,
"Offering for Isolated VPC networks with Source Nat service enabled and LB service disabled", TrafficType.Guest,
null, false, Availability.Optional, null, defaultVPCOffProviders,
- true, Network.GuestType.Isolated, false, null, false, null, false, false, null);
+ true, Network.GuestType.Isolated, false, null, false, null, false, false, null, false);
offering.setState(NetworkOffering.State.Enabled);
_networkOfferingDao.update(offering.getId(), offering);
}
@@ -1370,7 +1371,7 @@ public class NetworkManagerImpl extends ManagerBase implements NetworkManager, L
offering = _configMgr.createNetworkOffering(NetworkOffering.DefaultIsolatedNetworkOffering,
"Offering for Isolated networks with no Source Nat service", TrafficType.Guest, null, true,
Availability.Optional, null, defaultIsolatedNetworkOfferingProviders, true, Network.GuestType.Isolated,
- false, null, true, null, true, false, null);
+ false, null, true, null, true, false, null, false);
offering.setState(NetworkOffering.State.Enabled);
_networkOfferingDao.update(offering.getId(), offering);
}
@@ -1396,7 +1397,7 @@ public class NetworkManagerImpl extends ManagerBase implements NetworkManager, L
offering = _configMgr.createNetworkOffering(NetworkOffering.DefaultIsolatedNetworkOfferingForVpcNetworksWithInternalLB,
"Offering for Isolated VPC networks with Internal Lb support", TrafficType.Guest,
null, false, Availability.Optional, null, internalLbOffProviders,
- true, Network.GuestType.Isolated, false, null, false, null, false, false, null);
+ true, Network.GuestType.Isolated, false, null, false, null, false, false, null, false);
offering.setState(NetworkOffering.State.Enabled);
offering.setInternalLb(true);
_networkOfferingDao.update(offering.getId(), offering);
@@ -1426,7 +1427,7 @@ public class NetworkManagerImpl extends ManagerBase implements NetworkManager, L
if (_networkOfferingDao.findByUniqueName(NetworkOffering.DefaultSharedEIPandELBNetworkOffering) == null) {
offering = _configMgr.createNetworkOffering(NetworkOffering.DefaultSharedEIPandELBNetworkOffering, "Offering for Shared networks with Elastic IP and Elastic LB capabilities", TrafficType.Guest, null, true,
- Availability.Optional, null, netscalerServiceProviders, true, Network.GuestType.Shared, false, null, true, serviceCapabilityMap, true, false, null);
+ Availability.Optional, null, netscalerServiceProviders, true, Network.GuestType.Shared, false, null, true, serviceCapabilityMap, true, false, null, false);
offering.setState(NetworkOffering.State.Enabled);
offering.setDedicatedLB(false);
_networkOfferingDao.update(offering.getId(), offering);
@@ -3090,9 +3091,21 @@ public class NetworkManagerImpl extends ManagerBase implements NetworkManager, L
}
List<FirewallRuleVO> firewallEgressRulesToApply = _firewallDao.listByNetworkPurposeTrafficType(networkId, Purpose.Firewall, FirewallRule.TrafficType.Egress);
- if (!_firewallMgr.applyFirewallRules(firewallEgressRulesToApply, false, caller)) {
- s_logger.warn("Failed to reapply firewall Egress rule(s) as a part of network id=" + networkId + " restart");
- success = false;
+ if (firewallEgressRulesToApply.size() == 0) {
+ NetworkOfferingVO offering = _networkOfferingDao.findById(network.getNetworkOfferingId());
+ //there are no egress rules then apply the default egress rule
+ DataCenter zone = _dcDao.findById(network.getDataCenterId());
+ if (offering.getEgressDefaultPolicy() && _networkModel.areServicesSupportedInNetwork(network.getId(), Service.Firewall)
+ && (network.getGuestType() == Network.GuestType.Isolated ||
+ (network.getGuestType() == Network.GuestType.Shared && zone.getNetworkType() == NetworkType.Advanced))) {
+ // add default egress rule to accept the traffic
+ _firewallMgr.applyDefaultEgressFirewallRule(network.getId(), true);
+ }
+ } else {
+ if (!_firewallMgr.applyFirewallRules(firewallEgressRulesToApply, false, caller)) {
+ s_logger.warn("Failed to reapply firewall Egress rule(s) as a part of network id=" + networkId + " restart");
+ success = false;
+ }
}
// apply port forwarding rules
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index f7275b0..d250a08 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -616,6 +616,7 @@ public class FirewallManagerImpl extends ManagerBase implements FirewallService,
@Override
public boolean applyEgressFirewallRules (FirewallRule rule, Account caller) throws ResourceUnavailableException {
List<FirewallRuleVO> rules = _firewallDao.listByNetworkPurposeTrafficType(rule.getNetworkId(), Purpose.Firewall, FirewallRule.TrafficType.Egress);
+ applyDefaultEgressFirewallRule(rule.getNetworkId(), true);
return applyFirewallRules(rules, false, caller);
}
@@ -649,6 +650,36 @@ public class FirewallManagerImpl extends ManagerBase implements FirewallService,
}
@Override
+ public boolean applyDefaultEgressFirewallRule(Long networkId, boolean defaultPolicy) throws ResourceUnavailableException {
+
+ if (defaultPolicy == false) {
+ //If default policy is false no need apply rules on backend because firewall provider blocks by default
+ return true;
+ }
+ s_logger.debug("applying default firewall egress rules ");
+
+ NetworkVO network = _networkDao.findById(networkId);
+ List<String> sourceCidr = new ArrayList<String>();
+
+ sourceCidr.add(NetUtils.ALL_CIDRS);
+ FirewallRuleVO ruleVO = new FirewallRuleVO(null, null, null, null, "all", networkId, network.getAccountId(), network.getDomainId(), Purpose.Firewall, sourceCidr,
+ null, null, null, FirewallRule.TrafficType.Egress, FirewallRuleType.System);
+ List<FirewallRuleVO> rules = new ArrayList<FirewallRuleVO>();
+ rules.add(ruleVO);
+
+ try {
+ //this is not required to store in db because we don't to add this rule along with the normal rules
+ if (!applyRules(rules, false, false)) {
+ return false;
+ }
+ } catch (ResourceUnavailableException ex) {
+ s_logger.warn("Failed to apply default egress rules for guest network due to ", ex);
+ return false;
+ }
+ return true;
+ }
+
+ @Override
@ActionEvent(eventType = EventTypes.EVENT_FIREWALL_CLOSE, eventDescription = "revoking firewall rule", async = true)
public boolean revokeFirewallRule(long ruleId, boolean apply, Account caller, long userId) {
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 7f3a88e..7e12ce9 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -163,6 +163,7 @@ import com.cloud.network.rules.dao.PortForwardingRulesDao;
import com.cloud.network.vpn.Site2SiteVpnManager;
import com.cloud.offering.NetworkOffering;
import com.cloud.offering.ServiceOffering;
+import com.cloud.offerings.NetworkOfferingVO;
import com.cloud.offerings.dao.NetworkOfferingDao;
import com.cloud.resource.ResourceManager;
import com.cloud.server.ConfigurationServer;
@@ -3679,29 +3680,44 @@ public class VirtualNetworkApplianceManagerImpl extends ManagerBase implements V
private void createFirewallRulesCommands(List<? extends FirewallRule> rules, VirtualRouter router, Commands cmds, long guestNetworkId) {
List<FirewallRuleTO> rulesTO = null;
+ String systemRule = null;
if (rules != null) {
+ if (rules.size() > 0) {
+ if (rules.get(0).getTrafficType() == FirewallRule.TrafficType.Egress && rules.get(0).getType() == FirewallRule.FirewallRuleType.System) {
+ systemRule = String.valueOf(FirewallRule.FirewallRuleType.System);
+ }
+ }
rulesTO = new ArrayList<FirewallRuleTO>();
for (FirewallRule rule : rules) {
FirewallRule.TrafficType traffictype = rule.getTrafficType();
if(traffictype == FirewallRule.TrafficType.Ingress){
- IpAddress sourceIp = _networkModel.getIp(rule.getSourceIpAddressId());
- FirewallRuleTO ruleTO = new FirewallRuleTO(rule, null, sourceIp.getAddress().addr(),Purpose.Firewall,traffictype);
- rulesTO.add(ruleTO);
- }
- else if (rule.getTrafficType() == FirewallRule.TrafficType.Egress){
- assert (rule.getSourceIpAddressId()==null) : "ipAddressId should be null for egress firewall rule. ";
- FirewallRuleTO ruleTO = new FirewallRuleTO(rule, null,"",Purpose.Firewall,traffictype);
- rulesTO.add(ruleTO);
+ IpAddress sourceIp = _networkModel.getIp(rule.getSourceIpAddressId());
+ FirewallRuleTO ruleTO = new FirewallRuleTO(rule, null, sourceIp.getAddress().addr(),Purpose.Firewall,traffictype);
+ rulesTO.add(ruleTO);
+ } else if (rule.getTrafficType() == FirewallRule.TrafficType.Egress){
+ assert (rule.getSourceIpAddressId()==null) : "ipAddressId should be null for egress firewall rule. ";
+ FirewallRuleTO ruleTO = new FirewallRuleTO(rule, null,"",Purpose.Firewall, traffictype);
+ rulesTO.add(ruleTO);
}
}
}
+
+ NetworkVO network = _networkDao.findById(guestNetworkId);
+ NetworkOfferingVO offering = _networkOfferingDao.findById(network.getNetworkOfferingId());
+ Boolean defaultEgressPolicy = offering.getEgressDefaultPolicy();
SetFirewallRulesCommand cmd = new SetFirewallRulesCommand(rulesTO);
cmd.setAccessDetail(NetworkElementCommand.ROUTER_IP, getRouterControlIp(router.getId()));
cmd.setAccessDetail(NetworkElementCommand.ROUTER_GUEST_IP, getRouterIpInNetwork(guestNetworkId, router.getId()));
cmd.setAccessDetail(NetworkElementCommand.ROUTER_NAME, router.getInstanceName());
DataCenterVO dcVo = _dcDao.findById(router.getDataCenterId());
cmd.setAccessDetail(NetworkElementCommand.ZONE_NETWORK_TYPE, dcVo.getNetworkType().toString());
+ if (systemRule != null) {
+ cmd.setAccessDetail(NetworkElementCommand.FIREWALL_EGRESS_DEFAULT, systemRule);
+ } else {
+ cmd.setAccessDetail(NetworkElementCommand.FIREWALL_EGRESS_DEFAULT, String.valueOf(defaultEgressPolicy));
+ }
+
cmds.addCommand(cmd);
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/src/com/cloud/network/rules/FirewallManager.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/network/rules/FirewallManager.java b/server/src/com/cloud/network/rules/FirewallManager.java
index 2bce8fe..6d36ed3 100644
--- a/server/src/com/cloud/network/rules/FirewallManager.java
+++ b/server/src/com/cloud/network/rules/FirewallManager.java
@@ -85,4 +85,5 @@ public interface FirewallManager extends FirewallService {
*/
void removeRule(FirewallRule rule);
+ boolean applyDefaultEgressFirewallRule(Long networkId, boolean defaultPolicy) throws ResourceUnavailableException;
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/src/com/cloud/server/ConfigurationServerImpl.java
----------------------------------------------------------------------
diff --git a/server/src/com/cloud/server/ConfigurationServerImpl.java b/server/src/com/cloud/server/ConfigurationServerImpl.java
index 510455b..ad4c346 100755
--- a/server/src/com/cloud/server/ConfigurationServerImpl.java
+++ b/server/src/com/cloud/server/ConfigurationServerImpl.java
@@ -1082,7 +1082,7 @@ public class ConfigurationServerImpl extends ManagerBase implements Configuratio
"Offering for Shared networks with Elastic IP and Elastic LB capabilities",
TrafficType.Guest,
false, true, null, null, true, Availability.Optional,
- null, Network.GuestType.Shared, true, false, false, false, true, true, true, false, false, true, true, false);
+ null, Network.GuestType.Shared, true, false, false, false, true, true, true, false, false, true, true, false, false);
defaultNetscalerNetworkOffering.setState(NetworkOffering.State.Enabled);
defaultNetscalerNetworkOffering = _networkOfferingDao.persistDefaultNetworkOffering(defaultNetscalerNetworkOffering);
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/test/com/cloud/network/MockFirewallManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/test/com/cloud/network/MockFirewallManagerImpl.java b/server/test/com/cloud/network/MockFirewallManagerImpl.java
index 95bb1d1..c50459e 100644
--- a/server/test/com/cloud/network/MockFirewallManagerImpl.java
+++ b/server/test/com/cloud/network/MockFirewallManagerImpl.java
@@ -169,6 +169,11 @@ public class MockFirewallManagerImpl extends ManagerBase implements FirewallMana
}
@Override
+ public boolean applyDefaultEgressFirewallRule(Long networkId, boolean defaultPolicy) throws ResourceUnavailableException {
+ return false; //To change body of implemented methods use File | Settings | File Templates.
+ }
+
+ @Override
public FirewallRule createFirewallRule(Long ipAddrId, Account caller,
String xId, Integer portStart, Integer portEnd, String protocol,
List<String> sourceCidrList, Integer icmpCode, Integer icmpType,
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/test/com/cloud/vpc/MockConfigurationManagerImpl.java
----------------------------------------------------------------------
diff --git a/server/test/com/cloud/vpc/MockConfigurationManagerImpl.java b/server/test/com/cloud/vpc/MockConfigurationManagerImpl.java
index 21b3590..76a8e84 100755
--- a/server/test/com/cloud/vpc/MockConfigurationManagerImpl.java
+++ b/server/test/com/cloud/vpc/MockConfigurationManagerImpl.java
@@ -554,7 +554,7 @@ public class MockConfigurationManagerImpl extends ManagerBase implements Configu
@Override
public NetworkOfferingVO createNetworkOffering(String name, String displayText, TrafficType trafficType, String tags, boolean specifyVlan, Availability availability, Integer networkRate,
Map<Service, Set<Provider>> serviceProviderMap, boolean isDefault, GuestType type, boolean systemOnly, Long serviceOfferingId, boolean conserveMode,
- Map<Service, Map<Capability, String>> serviceCapabilityMap, boolean specifyIpRanges, boolean isPersistent, Map<NetworkOffering.Detail,String> details) {
+ Map<Service, Map<Capability, String>> serviceCapabilityMap, boolean specifyIpRanges, boolean isPersistent, Map<NetworkOffering.Detail,String> details, boolean egressDefaultPolicy) {
// TODO Auto-generated method stub
return null;
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/server/test/org/apache/cloudstack/networkoffering/CreateNetworkOfferingTest.java
----------------------------------------------------------------------
diff --git a/server/test/org/apache/cloudstack/networkoffering/CreateNetworkOfferingTest.java b/server/test/org/apache/cloudstack/networkoffering/CreateNetworkOfferingTest.java
index 4a2c867..36564d9 100644
--- a/server/test/org/apache/cloudstack/networkoffering/CreateNetworkOfferingTest.java
+++ b/server/test/org/apache/cloudstack/networkoffering/CreateNetworkOfferingTest.java
@@ -94,7 +94,7 @@ public class CreateNetworkOfferingTest extends TestCase{
public void createSharedNtwkOffWithVlan() {
NetworkOfferingVO off = configMgr.createNetworkOffering("shared", "shared", TrafficType.Guest, null, true,
Availability.Optional, 200, null, false, Network.GuestType.Shared, false,
- null, false, null, true, false, null);
+ null, false, null, true, false, null, false);
assertNotNull("Shared network offering with specifyVlan=true failed to create ", off);
}
@@ -103,7 +103,7 @@ public class CreateNetworkOfferingTest extends TestCase{
try {
NetworkOfferingVO off = configMgr.createNetworkOffering("shared", "shared", TrafficType.Guest, null, false,
Availability.Optional, 200, null, false, Network.GuestType.Shared, false,
- null, false, null, true, false, null);
+ null, false, null, true, false, null, false);
assertNull("Shared network offering with specifyVlan=false was created", off);
} catch (InvalidParameterValueException ex) {
}
@@ -113,7 +113,7 @@ public class CreateNetworkOfferingTest extends TestCase{
public void createSharedNtwkOffWithSpecifyIpRanges() {
NetworkOfferingVO off = configMgr.createNetworkOffering("shared", "shared", TrafficType.Guest, null, true,
Availability.Optional, 200, null, false, Network.GuestType.Shared, false,
- null, false, null, true, false, null);
+ null, false, null, true, false, null, false);
assertNotNull("Shared network offering with specifyIpRanges=true failed to create ", off);
}
@@ -123,7 +123,7 @@ public class CreateNetworkOfferingTest extends TestCase{
try {
NetworkOfferingVO off = configMgr.createNetworkOffering("shared", "shared", TrafficType.Guest, null, true,
Availability.Optional, 200, null, false, Network.GuestType.Shared, false,
- null, false, null, false, false, null);
+ null, false, null, false, false, null, false);
assertNull("Shared network offering with specifyIpRanges=false was created", off);
} catch (InvalidParameterValueException ex) {
}
@@ -138,7 +138,7 @@ public class CreateNetworkOfferingTest extends TestCase{
serviceProviderMap.put(Network.Service.SourceNat, vrProvider);
NetworkOfferingVO off = configMgr.createNetworkOffering("isolated", "isolated", TrafficType.Guest, null, false,
Availability.Optional, 200, serviceProviderMap, false, Network.GuestType.Isolated, false,
- null, false, null, false, false, null);
+ null, false, null, false, false, null, false);
assertNotNull("Isolated network offering with specifyIpRanges=false failed to create ", off);
}
@@ -151,7 +151,7 @@ public class CreateNetworkOfferingTest extends TestCase{
serviceProviderMap.put(Network.Service.SourceNat, vrProvider);
NetworkOfferingVO off = configMgr.createNetworkOffering("isolated", "isolated", TrafficType.Guest, null, true,
Availability.Optional, 200, serviceProviderMap, false, Network.GuestType.Isolated, false,
- null, false, null, false, false, null);
+ null, false, null, false, false, null, false);
assertNotNull("Isolated network offering with specifyVlan=true wasn't created", off);
}
@@ -165,7 +165,7 @@ public class CreateNetworkOfferingTest extends TestCase{
serviceProviderMap.put(Network.Service.SourceNat, vrProvider);
NetworkOfferingVO off = configMgr.createNetworkOffering("isolated", "isolated", TrafficType.Guest, null, false,
Availability.Optional, 200, serviceProviderMap, false, Network.GuestType.Isolated, false,
- null, false, null, true, false, null);
+ null, false, null, true, false, null, false);
assertNull("Isolated network offering with specifyIpRanges=true and source nat service enabled, was created", off);
} catch (InvalidParameterValueException ex) {
}
@@ -178,7 +178,7 @@ public class CreateNetworkOfferingTest extends TestCase{
Set<Network.Provider> vrProvider = new HashSet<Network.Provider>();
NetworkOfferingVO off = configMgr.createNetworkOffering("isolated", "isolated", TrafficType.Guest, null, false,
Availability.Optional, 200, serviceProviderMap, false, Network.GuestType.Isolated, false,
- null, false, null, true, false, null);
+ null, false, null, true, false, null, false);
assertNotNull("Isolated network offering with specifyIpRanges=true and with no sourceNatService, failed to create", off);
}
@@ -196,7 +196,7 @@ public class CreateNetworkOfferingTest extends TestCase{
serviceProviderMap.put(Network.Service.Lb , vrProvider);
NetworkOfferingVO off = configMgr.createNetworkOffering("isolated", "isolated", TrafficType.Guest, null, true,
Availability.Optional, 200, serviceProviderMap, false, Network.GuestType.Isolated, false,
- null, false, null, false, false, null);
+ null, false, null, false, false, null, false);
// System.out.println("Creating Vpc Network Offering");
assertNotNull("Vpc Isolated network offering with Vpc provider ", off);
}
@@ -216,7 +216,7 @@ public class CreateNetworkOfferingTest extends TestCase{
serviceProviderMap.put(Network.Service.Lb, lbProvider);
NetworkOfferingVO off = configMgr.createNetworkOffering("isolated", "isolated", TrafficType.Guest, null, true,
Availability.Optional, 200, serviceProviderMap, false, Network.GuestType.Isolated, false, null, false,
- null, false, false, null);
+ null, false, false, null, false);
// System.out.println("Creating Vpc Network Offering");
assertNotNull("Vpc Isolated network offering with Vpc and Netscaler provider ", off);
}
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/32b43d2b/setup/db/db/schema-410to420.sql
----------------------------------------------------------------------
diff --git a/setup/db/db/schema-410to420.sql b/setup/db/db/schema-410to420.sql
index 181f1cb..9d80b3b 100644
--- a/setup/db/db/schema-410to420.sql
+++ b/setup/db/db/schema-410to420.sql
@@ -1857,3 +1857,4 @@ INSERT IGNORE INTO `cloud`.`configuration` VALUES ('Advanced', 'DEFAULT', 'manag
INSERT IGNORE INTO `cloud`.`configuration` VALUES ('Advanced', 'DEFAULT', 'management-server', 'execute.in.sequence.hypervisor.commands', 'false', 'If set to true, StartCommand, StopCommand, CopyVolumeCommand, CreateCommand will be synchronized on the agent side. If set to false, these commands become asynchronous. Default value is false.');
INSERT IGNORE INTO `cloud`.`configuration` VALUES ('Advanced', 'DEFAULT', 'management-server', 'execute.in.sequence.network.element.commands', 'false', 'If set to true, DhcpEntryCommand, SavePasswordCommand, UserDataCommand, VmDataCommand will be synchronized on the agent side. If set to false, these commands become asynchronous. Default value is false.');
+alter table `cloud`.`network_offerings` add column egress_default_policy boolean default false;