def _add_firewall_rule(self, context, fwp_tenant_id, **fwr): """ :param obj: :param context: :param kwargs: dictionary, firewall rule firewall_rule: {'source_ip_address': u'192.176.10.0/24',... } :return: """ LOG.debug("# _add_firewall_rule() called") namespace = fortinet_db.Fortinet_ML2_Namespace.query_one( context, tenant_id=fwp_tenant_id) vdom = getattr(namespace, 'vdom', None) if not vdom or not fwr: return None inf_int, inf_ext = utils.get_vlink_intf( self, context, vdom=namespace.vdom) srcaddr = self._add_fwr_ip_address( context, vdom, place='source_ip_address', **fwr) dstaddr = self._add_fwr_ip_address( context, vdom, place='destination_ip_address', **fwr) service = self._add_fwr_service(context, vdom, **fwr) action = self._get_fwr_action(**fwr) profiles = self._get_fwp_profiles(action) match_vip = 'enable' name = fwr.get('name', '') # add a basic firewall rule('accept': incoming, 'deny': bidirectional) fortinet_fwp = utils.add_fwpolicy_to_head(self, context, vdom=vdom, srcaddr=srcaddr['name'], srcintf='any', dstaddr=dstaddr['name'], dstintf='any', service=service['name'], match_vip=match_vip, action=action, comments=name, **profiles) utils.add_record(self, context, fortinet_db.Fortinet_FW_Rule_Association, fwr_id=fwr['id'], fortinet_pid=fortinet_fwp.id, type=constants.TYPE_INT) if action in ['accept']: # if allow, for the outgoing traffic it need to enable nat fortinet_fwp = utils.add_fwpolicy_to_head(self, context, vdom=vdom, srcaddr=srcaddr['name'], srcintf='any', dstaddr=dstaddr['name'], dstintf=inf_int, nat='enable', service=service['name'], action=action, comments=name, **profiles) utils.add_record(self, context, fortinet_db.Fortinet_FW_Rule_Association, fwr_id=fwr['id'], fortinet_pid=fortinet_fwp.id, type=constants.TYPE_EXT)
def _allocate_floatingip(self, context, obj): """ 1. mapping floatingip to the one of a pair of internal ips based on the vip function. 2. add another ip of the ip pair to the secondaryip list of the external interface. obj example: { 'floating_network_id': u'1c1dbecc-9dac-4311-a346-f147a04c8dc8', 'router_id': None, 'fixed_ip_address': None, 'floating_ip_address': u'10.160.37.113', 'tenant_id': u'3998b33381fb48f694369689065a3760', 'status': 'DOWN', 'port_id': None, 'id': '5ec1b08b-77c1-4e39-80ac-224ee937ee9f' } The floatingip is a instance of neutron.db.l3_db.FloatingIP, example: { tenant_id=u'3998b33381fb48f694369689065a3760', id=u'25e1588a-5ec5-4fbc-bdef-eff8713da8f8', floating_ip_address=u'10.160.37.111', floating_network_id=u'1c1dbecc-9dac-4311-a346-f147a04c8dc8', floating_port_id=u'4b4120d4-77f9-4f82-b823-05876929a1c4', fixed_port_id=None, fixed_ip_address=None, router_id=None, last_known_router_id=None, status=u'DOWN' } """ with context.session.begin(subtransactions=True): try: db_namespace = utils.add_vdom(self, context, tenant_id=obj['tenant_id']) db_fip = utils.add_record( self, context, fortinet_db.Fortinet_FloatingIP_Allocation, vdom=db_namespace.vdom, floating_ip_address=obj['floating_ip_address'], vip_name=obj['floating_ip_address']) mappedip = utils.get_ipaddr(db_fip.ip_subnet, 0) utils.add_vip(self, context, vdom=const.EXT_VDOM, name=db_fip.vip_name, extip=db_fip.floating_ip_address, extintf='any', mappedip=mappedip) int_intf, ext_intf = utils.get_vlink_intf( self, context, vdom=db_namespace.vdom) utils.add_fwpolicy(self, context, vdom=const.EXT_VDOM, dstintf=ext_intf, dstaddr=db_fip.vip_name, nat='enable') utils.add_routerstatic(self, context, vdom=const.EXT_VDOM, dst="%s 255.255.255.255" % mappedip, device=ext_intf, gateway=const.DEF_GW) utils.add_fwippool(self, context, name=db_fip.floating_ip_address, vdom=const.EXT_VDOM, startip=db_fip.floating_ip_address) utils.add_fwaddress(self, context, name=mappedip, vdom=const.EXT_VDOM, subnet="%s 255.255.255.255" % mappedip) db_fwpolicy = utils.add_fwpolicy( self, context, vdom=const.EXT_VDOM, srcintf=ext_intf, srcaddr=mappedip, dstintf=self._fortigate['ext_interface'], poolname=db_fip.floating_ip_address) utils.head_firewall_policy(self, context, vdom=const.EXT_VDOM, id=db_fwpolicy.edit_id) utils.add_fwippool(self, context, name=mappedip, vdom=db_namespace.vdom, startip=mappedip) except Exception as e: with excutils.save_and_reraise_exception(): utils._rollback_on_err(self, context, e) utils.update_status(self, context, t_consts.TaskStatus.COMPLETED)
def _allocate_floatingip(self, context, obj): """ 1. mapping floatingip to the one of a pair of internal ips based on the vip function. 2. add another ip of the ip pair to the secondaryip list of the external interface. obj example: { 'floating_network_id': u'1c1dbecc-9dac-4311-a346-f147a04c8dc8', 'router_id': None, 'fixed_ip_address': None, 'floating_ip_address': u'10.160.37.113', 'tenant_id': u'3998b33381fb48f694369689065a3760', 'status': 'DOWN', 'port_id': None, 'id': '5ec1b08b-77c1-4e39-80ac-224ee937ee9f' } The floatingip is a instance of neutron.db.l3_db.FloatingIP, example: { tenant_id=u'3998b33381fb48f694369689065a3760', id=u'25e1588a-5ec5-4fbc-bdef-eff8713da8f8', floating_ip_address=u'10.160.37.111', floating_network_id=u'1c1dbecc-9dac-4311-a346-f147a04c8dc8', floating_port_id=u'4b4120d4-77f9-4f82-b823-05876929a1c4', fixed_port_id=None, fixed_ip_address=None, router_id=None, last_known_router_id=None, status=u'DOWN' } """ with context.session.begin(subtransactions=True): try: db_namespace = utils.add_vdom(self, context, tenant_id=obj['tenant_id']) db_fip = utils.add_record(self, context, fortinet_db.Fortinet_FloatingIP_Allocation, vdom=db_namespace.vdom, floating_ip_address=obj['floating_ip_address'], vip_name=obj['floating_ip_address']) mappedip = utils.get_ipaddr(db_fip.ip_subnet, 0) utils.add_vip(self, context, vdom=const.EXT_VDOM, name=db_fip.vip_name, extip=db_fip.floating_ip_address, extintf='any', mappedip=mappedip) int_intf, ext_intf = utils.get_vlink_intf(self, context, vdom=db_namespace.vdom) utils.add_fwpolicy(self, context, vdom=const.EXT_VDOM, dstintf=ext_intf, dstaddr=db_fip.vip_name, nat='enable') utils.add_routerstatic(self, context, vdom=const.EXT_VDOM, dst="%s 255.255.255.255" % mappedip, device=ext_intf, gateway=const.DEF_GW) utils.add_fwippool(self, context, name=db_fip.floating_ip_address, vdom=const.EXT_VDOM, startip=db_fip.floating_ip_address) utils.add_fwaddress(self, context, name=mappedip, vdom=const.EXT_VDOM, subnet="%s 255.255.255.255" % mappedip) db_fwpolicy = utils.add_fwpolicy(self, context, vdom=const.EXT_VDOM, srcintf=ext_intf, srcaddr=mappedip, dstintf=self._fortigate['ext_interface'], poolname=db_fip.floating_ip_address) utils.head_firewall_policy(self, context, vdom=const.EXT_VDOM, id=db_fwpolicy.edit_id) utils.add_fwippool(self, context, name=mappedip, vdom=db_namespace.vdom, startip=mappedip) except Exception as e: with excutils.save_and_reraise_exception(): utils._rollback_on_err(self, context, e) utils.update_status(self, context, t_consts.TaskStatus.COMPLETED)