GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Network: default egress policy Allow for Isolated networks on fresh i… · NetApp/cloudstack@e0f3006

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • api/src/test/java/org/apache/cloudstack/api/command/admin/network
    • CreateNetworkOfferingCmdTest.java
  • engine/schema/src/main/java/com/cloud/offerings
    • NetworkOfferingVO.java
  • server/src
    • main/java/com/cloud/server
      • ConfigurationServerImpl.java
    • test/java/com/cloud/server
      • ConfigurationServerImplTest.java
  • ui/src/views/offering
    • AddNetworkOffering.vue
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎api/src/test/java/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmdTest.java‎

Copy file name to clipboard
+50Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
18+
package org.apache.cloudstack.api.command.admin.network;
19+
20+
import org.junit.Test;
21+
import org.junit.runner.RunWith;
22+
import org.mockito.junit.MockitoJUnitRunner;
23+
import org.springframework.test.util.ReflectionTestUtils;
24+
25+
import static org.junit.Assert.assertEquals;
26+
27+
@RunWith(MockitoJUnitRunner.class)
28+
public class CreateNetworkOfferingCmdTest {
29+
30+
@Test
31+
public void testEgressDefaultPolicyIsAllowWhenParameterOmitted() {
32+
CreateNetworkOfferingCmd cmd = new CreateNetworkOfferingCmd();
33+
assertEquals("createNetworkOffering must default to egress Allow when egressdefaultpolicy is not specified",
34+
Boolean.TRUE, cmd.getEgressDefaultPolicy());
35+
}
36+
37+
@Test
38+
public void testEgressDefaultPolicyExplicitDenyIsHonored() {
39+
CreateNetworkOfferingCmd cmd = new CreateNetworkOfferingCmd();
40+
ReflectionTestUtils.setField(cmd, "egressDefaultPolicy", Boolean.FALSE);
41+
assertEquals(Boolean.FALSE, cmd.getEgressDefaultPolicy());
42+
}
43+
44+
@Test
45+
public void testEgressDefaultPolicyExplicitAllowIsHonored() {
46+
CreateNetworkOfferingCmd cmd = new CreateNetworkOfferingCmd();
47+
ReflectionTestUtils.setField(cmd, "egressDefaultPolicy", Boolean.TRUE);
48+
assertEquals(Boolean.TRUE, cmd.getEgressDefaultPolicy());
49+
}
50+
}
Collapse file

‎engine/schema/src/main/java/com/cloud/offerings/NetworkOfferingVO.java‎

Copy file name to clipboardExpand all lines: engine/schema/src/main/java/com/cloud/offerings/NetworkOfferingVO.java
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -346,6 +346,10 @@ public boolean isEgressDefaultPolicy() {
346346
return egressdefaultpolicy;
347347
}
348348

349+
public void setEgressDefaultPolicy(boolean egressDefaultPolicy) {
350+
this.egressdefaultpolicy = egressDefaultPolicy;
351+
}
352+
349353
public NetworkOfferingVO(String name, String displayText, TrafficType trafficType, boolean systemOnly, boolean specifyVlan, Integer rateMbps,
350354
Integer multicastRateMbps, boolean isDefault, Availability availability, String tags, Network.GuestType guestType, boolean conserveMode,
351355
boolean specifyIpRanges, boolean isPersistent, boolean internalLb, boolean publicLb, boolean isForVpc) {
Collapse file

‎server/src/main/java/com/cloud/server/ConfigurationServerImpl.java‎

Copy file name to clipboardExpand all lines: server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
+9Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1067,6 +1067,12 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
10671067
Network.GuestType.Isolated, true, false, false, false, true, false);
10681068

10691069
defaultIsolatedSourceNatEnabledNetworkOffering.setState(NetworkOffering.State.Enabled);
1070+
// Default egress policy is Allow on fresh installations, consistent with the
1071+
// createNetworkOffering API default (egressdefaultpolicy=true when not specified).
1072+
// Existing installations are not affected: this method only runs on first boot
1073+
// (guarded by the "init" configuration flag) and persistDefaultNetworkOffering()
1074+
// never updates an already existing offering.
1075+
defaultIsolatedSourceNatEnabledNetworkOffering.setEgressDefaultPolicy(true);
10701076
defaultIsolatedSourceNatEnabledNetworkOffering.setSupportsVmAutoScaling(true);
10711077
defaultIsolatedSourceNatEnabledNetworkOffering = _networkOfferingDao.persistDefaultNetworkOffering(defaultIsolatedSourceNatEnabledNetworkOffering);
10721078

@@ -1084,6 +1090,9 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
10841090
false, true, null, null, true, Availability.Optional, null, Network.GuestType.Isolated, true, true, false, false, false, false);
10851091

10861092
defaultIsolatedEnabledNetworkOffering.setState(NetworkOffering.State.Enabled);
1093+
// This offering carries no Firewall service, so the flag is not enforced anywhere;
1094+
// it is set for consistency so API responses do not advertise a misleading Deny policy.
1095+
defaultIsolatedEnabledNetworkOffering.setEgressDefaultPolicy(true);
10871096
defaultIsolatedEnabledNetworkOffering = _networkOfferingDao.persistDefaultNetworkOffering(defaultIsolatedEnabledNetworkOffering);
10881097

10891098
for (Service service : defaultIsolatedNetworkOfferingProviders.keySet()) {
Collapse file

‎server/src/test/java/com/cloud/server/ConfigurationServerImplTest.java‎

Copy file name to clipboardExpand all lines: server/src/test/java/com/cloud/server/ConfigurationServerImplTest.java
+39Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
import com.cloud.dc.dao.VlanDao;
2424
import com.cloud.domain.dao.DomainDao;
2525
import com.cloud.network.dao.NetworkDao;
26+
import com.cloud.offering.NetworkOffering;
27+
import com.cloud.offerings.NetworkOfferingVO;
2628
import com.cloud.offerings.dao.NetworkOfferingDao;
2729
import com.cloud.offerings.dao.NetworkOfferingServiceMapDao;
2830
import com.cloud.service.dao.ServiceOfferingDao;
@@ -35,12 +37,16 @@
3537
import org.junit.Assert;
3638
import org.junit.Test;
3739
import org.junit.runner.RunWith;
40+
import org.mockito.ArgumentCaptor;
3841
import org.mockito.InjectMocks;
3942
import org.mockito.Mock;
4043
import org.mockito.Mockito;
4144
import org.mockito.Spy;
4245
import org.mockito.junit.MockitoJUnitRunner;
4346

47+
import java.util.HashMap;
48+
import java.util.Map;
49+
4450
@RunWith(MockitoJUnitRunner.class)
4551
public class ConfigurationServerImplTest {
4652

@@ -122,4 +128,37 @@ public void testUpdateSystemvmPassword() {
122128
//teardown
123129
System.setProperty("user.name", realusername);
124130
}
131+
132+
@Test
133+
public void testCreateDefaultNetworkOfferingsSeedsIsolatedOfferingsWithEgressAllow() {
134+
Mockito.when(_networkOfferingDao.persistDefaultNetworkOffering(Mockito.any(NetworkOfferingVO.class)))
135+
.thenAnswer(invocation -> invocation.getArgument(0));
136+
137+
try (TransactionLegacy txn = TransactionLegacy.open("testCreateDefaultNetworkOfferings")) {
138+
configurationServer.createDefaultNetworkOfferings();
139+
}
140+
141+
ArgumentCaptor<NetworkOfferingVO> captor = ArgumentCaptor.forClass(NetworkOfferingVO.class);
142+
Mockito.verify(_networkOfferingDao, Mockito.atLeastOnce()).persistDefaultNetworkOffering(captor.capture());
143+
144+
Map<String, NetworkOfferingVO> offeringsByName = new HashMap<>();
145+
for (NetworkOfferingVO offering : captor.getAllValues()) {
146+
offeringsByName.putIfAbsent(offering.getUniqueName(), offering);
147+
}
148+
149+
NetworkOfferingVO isolatedSourceNatOffering = offeringsByName.get(NetworkOffering.DefaultIsolatedNetworkOfferingWithSourceNatService);
150+
Assert.assertNotNull(isolatedSourceNatOffering);
151+
Assert.assertTrue("Built-in Isolated source-NAT offering must be seeded with egress default policy Allow on fresh installations",
152+
isolatedSourceNatOffering.isEgressDefaultPolicy());
153+
154+
NetworkOfferingVO isolatedOffering = offeringsByName.get(NetworkOffering.DefaultIsolatedNetworkOffering);
155+
Assert.assertNotNull(isolatedOffering);
156+
Assert.assertTrue("Built-in Isolated (no source-NAT) offering must be seeded with egress default policy Allow on fresh installations",
157+
isolatedOffering.isEgressDefaultPolicy());
158+
159+
NetworkOfferingVO sharedOffering = offeringsByName.get(NetworkOffering.DefaultSharedNetworkOffering);
160+
Assert.assertNotNull(sharedOffering);
161+
Assert.assertFalse("Built-in Shared offering seeding must remain unchanged",
162+
sharedOffering.isEgressDefaultPolicy());
163+
}
125164
}
Collapse file

‎ui/src/views/offering/AddNetworkOffering.vue‎

Copy file name to clipboardExpand all lines: ui/src/views/offering/AddNetworkOffering.vue
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -704,7 +704,7 @@ export default {
704704
isolation: 'dedicated',
705705
conservemode: true,
706706
availability: 'optional',
707-
egressdefaultpolicy: 'deny',
707+
egressdefaultpolicy: 'allow',
708708
ispublic: this.isPublic,
709709
nsxsupportlb: true,
710710
routingmode: 'static'

0 commit comments

Comments
0 (0)
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.