[
https://issues.apache.org/jira/browse/CLOUDSTACK-10003?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16293642#comment-16293642
]
ASF GitHub Bot commented on CLOUDSTACK-10003:
---------------------------------------------
rhtyd closed pull request #2184: CLOUDSTACK-10003 automatic configure juniper
srx/vsrx nat loopback,
URL: https://github.com/apache/cloudstack/pull/2184
This is a PR merged from a forked repository.
As GitHub hides the original diff on merge, it is displayed below for
the sake of provenance:
As this is a foreign pull request (from a fork), the diff is supplied
below (as it won't show otherwise due to GitHub magic):
diff --git
a/plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java
b/plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java
index d60ccb67240..64d13485abb 100644
---
a/plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java
+++
b/plugins/network-elements/juniper-srx/src/com/cloud/network/resource/JuniperSrxResource.java
@@ -303,7 +303,7 @@ public String getCountName() {
}
private enum SrxCommand {
- LOGIN, OPEN_CONFIGURATION, CLOSE_CONFIGURATION, COMMIT, ROLLBACK,
CHECK_IF_EXISTS, CHECK_IF_IN_USE, ADD, DELETE, GET_ALL;
+ LOGIN, OPEN_CONFIGURATION, CLOSE_CONFIGURATION, COMMIT, ROLLBACK,
CHECK_IF_EXISTS, CHECK_IF_IN_USE, ADD, DELETE, GET_ALL, CHECK_PRIVATE_IF_EXISTS;
}
private enum Protocol {
@@ -2011,6 +2011,7 @@ private String genStaticNatRuleName(String publicIp,
String privateIp) {
private boolean manageStaticNatRule(SrxCommand command, String publicIp,
String privateIp) throws ExecutionException {
String ruleName = genStaticNatRuleName(publicIp, privateIp);
+ String ruleName_private = genStaticNatRuleName(privateIp, publicIp);
String xml;
switch (command) {
@@ -2022,7 +2023,13 @@ private boolean manageStaticNatRule(SrxCommand command,
String publicIp, String
xml = replaceXmlValue(xml, "from-zone", _publicZone);
xml = replaceXmlValue(xml, "rule-name", ruleName);
return sendRequestAndCheckResponse(command, xml, "name",
ruleName);
-
+ case CHECK_PRIVATE_IF_EXISTS:
+ xml = SrxXml.STATIC_NAT_RULE_GETONE.getXml();
+ xml = setDelete(xml, false);
+ xml = replaceXmlValue(xml, "rule-set", _privateZone);
+ xml = replaceXmlValue(xml, "from-zone", _privateZone);
+ xml = replaceXmlValue(xml, "rule-name", ruleName_private);
+ return sendRequestAndCheckResponse(command, xml, "name",
ruleName_private);
case ADD:
if (manageStaticNatRule(SrxCommand.CHECK_IF_EXISTS, publicIp,
privateIp)) {
return true;
@@ -2038,6 +2045,16 @@ private boolean manageStaticNatRule(SrxCommand command,
String publicIp, String
if (!sendRequestAndCheckResponse(command, xml)) {
throw new ExecutionException("Failed to add static NAT
rule from public IP " + publicIp + " to private IP " + privateIp);
} else {
+ xml = SrxXml.STATIC_NAT_RULE_ADD.getXml();
+ xml = replaceXmlValue(xml, "rule-set", _privateZone);
+ xml = replaceXmlValue(xml, "from-zone", _privateZone);
+ xml = replaceXmlValue(xml, "rule-name", ruleName_private);
+ xml = replaceXmlValue(xml, "original-ip", publicIp);
+ xml = replaceXmlValue(xml, "translated-ip", privateIp);
+ if (!sendRequestAndCheckResponse(command, xml))
+ {
+ throw new ExecutionException("Failed to add trust
static NAT rule from public IP " + publicIp + " to private IP " + privateIp);
+ }
return true;
}
@@ -2055,6 +2072,18 @@ private boolean manageStaticNatRule(SrxCommand command,
String publicIp, String
if (!sendRequestAndCheckResponse(command, xml, "name",
ruleName)) {
throw new ExecutionException("Failed to delete static NAT
rule from public IP " + publicIp + " to private IP " + privateIp);
} else {
+ if
(manageStaticNatRule(SrxCommand.CHECK_PRIVATE_IF_EXISTS, publicIp, privateIp)){
+ xml = SrxXml.STATIC_NAT_RULE_GETONE.getXml();
+ xml = setDelete(xml, true);
+ xml = replaceXmlValue(xml, "rule-set", _privateZone);
+ xml = replaceXmlValue(xml, "from-zone", _privateZone);
+ xml = replaceXmlValue(xml, "rule-name",
ruleName_private);
+ }
+
+ if (!sendRequestAndCheckResponse(command, xml, "name",
ruleName_private))
+ {
+ throw new ExecutionException("Failed to delete trust
static NAT rule from public IP " + publicIp + " to private IP " + privateIp);
+ }
return true;
}
@@ -2184,6 +2213,7 @@ private String genDestinationNatRuleName(String publicIp,
String privateIp, long
private boolean manageDestinationNatRule(SrxCommand command, String
publicIp, String privateIp, long srcPort, long destPort) throws
ExecutionException {
String ruleName = genDestinationNatRuleName(publicIp, privateIp,
srcPort, destPort);
+ String ruleName_private = ruleName + "p";
String poolName = genDestinationNatPoolName(privateIp, destPort);
String xml;
@@ -2196,7 +2226,13 @@ private boolean manageDestinationNatRule(SrxCommand
command, String publicIp, St
xml = replaceXmlValue(xml, "from-zone", _publicZone);
xml = replaceXmlValue(xml, "rule-name", ruleName);
return sendRequestAndCheckResponse(command, xml, "name",
ruleName);
-
+ case CHECK_PRIVATE_IF_EXISTS:
+ xml = SrxXml.DEST_NAT_RULE_GETONE.getXml();
+ xml = setDelete(xml, false);
+ xml = replaceXmlValue(xml, "rule-set", _privateZone);
+ xml = replaceXmlValue(xml, "from-zone", _privateZone);
+ xml = replaceXmlValue(xml, "rule-name", ruleName_private);
+ return sendRequestAndCheckResponse(command, xml, "name",
ruleName_private);
case ADD:
if (manageDestinationNatRule(SrxCommand.CHECK_IF_EXISTS,
publicIp, privateIp, srcPort, destPort)) {
return true;
@@ -2219,6 +2255,20 @@ private boolean manageDestinationNatRule(SrxCommand
command, String publicIp, St
throw new ExecutionException("Failed to add destination
NAT rule from public IP " + publicIp + ", public port " + srcPort + ", private
IP " +
privateIp + ", and private port " + destPort);
} else {
+
+ xml = SrxXml.DEST_NAT_RULE_ADD.getXml();
+ xml = replaceXmlValue(xml, "rule-set", _privateZone);
+ xml = replaceXmlValue(xml, "from-zone", _privateZone);
+ xml = replaceXmlValue(xml, "rule-name", ruleName_private);
+ xml = replaceXmlValue(xml, "public-address", publicIp);
+ xml = replaceXmlValue(xml, "src-port",
String.valueOf(srcPort));
+ xml = replaceXmlValue(xml, "pool-name", poolName);
+
+ if (!sendRequestAndCheckResponse(command, xml))
+ {
+ s_logger.debug("Purple: loopback Failed to add " +
_privateZone + " destination NAT rule from public IP " + publicIp + ", public
port " + srcPort + ", private IP " +
+ privateIp + ", and private port " + destPort);
+ }
return true;
}
@@ -2237,6 +2287,21 @@ private boolean manageDestinationNatRule(SrxCommand
command, String publicIp, St
throw new ExecutionException("Failed to delete destination
NAT rule from public IP " + publicIp + ", public port " + srcPort + ", private
IP " +
privateIp + ", and private port " + destPort);
} else {
+ if
(manageDestinationNatRule(SrxCommand.CHECK_PRIVATE_IF_EXISTS, publicIp,
privateIp, srcPort, destPort))
+ {
+ xml = SrxXml.DEST_NAT_RULE_GETONE.getXml();
+ xml = setDelete(xml, true);
+ xml = replaceXmlValue(xml, "rule-set", _privateZone);
+ xml = replaceXmlValue(xml, "from-zone", _privateZone);
+ xml = replaceXmlValue(xml, "rule-name",
ruleName_private);
+
+ if (!sendRequestAndCheckResponse(command, xml))
+ {
+ s_logger.debug("Purple: Failed to delete " +
_privateZone + " destination NAT rule from public IP " + publicIp + ", public
port " + srcPort + ", private IP " +
+ privateIp + ", and private port " +
destPort);
+ }
+ }
+
return true;
}
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
> automatic configure juniper srx/vsrx nat loopback
> -------------------------------------------------
>
> Key: CLOUDSTACK-10003
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-10003
> Project: CloudStack
> Issue Type: Improvement
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Components: Automation
> Affects Versions: 4.8.0, 4.9.0, 4.10.0.0, 4.8.1.1, 4.9.0.1
> Environment: network-pluge juniper srx
> Reporter: ming
> Fix For: 4.8.0, 4.9.0, 4.10.0.0, 4.8.1.1, 4.9.0.1
>
>
> automatic configure juniper srx/vsrx nat loopback,
> constraint condition that manual configure source nat in juniper srx，allowed
> vm vist public network :
> zone : trust to {trust,untrust}
> rule : source address {0.0.0.0/0},destination address{0.0.0.0/0} ,do source
> nat with pool {public network getway ip}.
> code change for trust to trust destination or static nat:
> add srxCommand :CHECK_PRIVATE_IF_EXISTS. for add/delete rule to detect
> whether exist or not contain DestinationNatRule or StaticNatRule
> (ruleName_private) in trust zone .
> add DestinationNatRule (ruleName_private) to trust zone when ADD
> DestinationNatRule to untrust .
> delete DestinationNatRule (ruleName_private) from trust zone when DELETE
> DestinationNatRule from untrust.
> add StaticNatRule (ruleName_private) to trust zone when ADD StaticNatRule to
> untrust .
> delete StaticNatRule (ruleName_private) from trust zone when DELETE
> StaticNatRule from untrust.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
