def creation_validation(vca_client, **kwargs):
"""
validate firewall rules for node
"""
getaway = get_gateway(
vca_client, _get_gateway_name(ctx.node.properties)
)
if not getaway.is_fw_enabled():
raise cfy_exc.NonRecoverableError(
"Gateway firewall is disabled. Please, enable firewall.")
rules = get_mandatory(ctx.node.properties, 'rules')
for rule in rules:
description = rule.get("description")
if description and not isinstance(description, basestring):
raise cfy_exc.NonRecoverableError(
"Parameter 'description' must be string.")
source = rule.get("source")
if source:
if not isinstance(source, basestring):
raise cfy_exc.NonRecoverableError(
"Parameter 'source' must be valid IP address string.")
if not _is_literal_ip(source):
check_ip(source)
utils.check_port(rule.get('source_port'))
destination = rule.get('destination')
if destination:
if not isinstance(destination, basestring):
raise cfy_exc.NonRecoverableError(
"Parameter 'destination' must be valid IP address string.")
if not _is_literal_ip(destination):
check_ip(destination)
utils.check_port(rule.get('destination_port'))
utils.check_protocol(rule.get('protocol'))
action = get_mandatory(rule, "action")
if (not isinstance(action, basestring)
or action.lower() not in ACTIONS):
raise cfy_exc.NonRecoverableError(
"Action must be on of{0}.".format(ACTIONS))
log = rule.get('log_traffic')
if log and not isinstance(log, bool):
raise cfy_exc.NonRecoverableError(
"Parameter 'log_traffic' must be boolean.")
def creation_validation(vca_client, **kwargs):
"""
validate firewall rules for node
"""
getaway = get_gateway(vca_client, _get_gateway_name(ctx.node.properties))
if not getaway.is_fw_enabled():
raise cfy_exc.NonRecoverableError(
"Gateway firewall is disabled. Please, enable firewall.")
rules = get_mandatory(ctx.node.properties, 'rules')
for rule in rules:
description = rule.get("description")
if description and not isinstance(description, basestring):
raise cfy_exc.NonRecoverableError(
"Parameter 'description' must be string.")
source = rule.get("source")
if source:
if not isinstance(source, basestring):
raise cfy_exc.NonRecoverableError(
"Parameter 'source' must be valid IP address string.")
if not _is_literal_ip(source):
check_ip(source)
utils.check_port(rule.get('source_port'))
destination = rule.get('destination')
if destination:
if not isinstance(destination, basestring):
raise cfy_exc.NonRecoverableError(
"Parameter 'destination' must be valid IP address string.")
if not _is_literal_ip(destination):
check_ip(destination)
utils.check_port(rule.get('destination_port'))
utils.check_protocol(rule.get('protocol'))
action = get_mandatory(rule, "action")
if (not isinstance(action, basestring)
or action.lower() not in ACTIONS):
raise cfy_exc.NonRecoverableError(
"Action must be on of{0}.".format(ACTIONS))
log = rule.get('log_traffic')
if log and not isinstance(log, bool):
raise cfy_exc.NonRecoverableError(
"Parameter 'log_traffic' must be boolean.")
def test_check_port(self):
"""
check port
"""
# port int
utils.check_port(10)
# port int to big
with self.assertRaises(cfy_exc.NonRecoverableError):
utils.check_port(utils.MAX_PORT_NUMBER + 1)
# port any
utils.check_port('any')
# port not any and not int
with self.assertRaises(cfy_exc.NonRecoverableError):
utils.check_port('some')
