opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-01 15:07:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

更新参数名称

Browse Source
This commit is contained in:
屈轩
2019-03-25 17:53:04 +08:00
parent c288c21ae2
commit 845c159cac
4 changed files with 104 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/climc/shell/secgroups.go
+24 -3
View File
@@ -12,7 +12,7 @@ import (
func init() {
type SecGroupsListOptions struct {
UnionSecgroup string `help:"Secgroup ID or Name, filter secgroups which rules equals with this secgroup"`
Equals string `help:"Secgroup ID or Name, filter secgroups whose rules equals the specified one"`
options.BaseListOptions
}
@@ -26,8 +26,8 @@ func init() {
}
}
if len(args.UnionSecgroup) > 0 {
params.Add(jsonutils.NewString(args.UnionSecgroup), "union_secgroup")
if len(args.Equals) > 0 {
params.Add(jsonutils.NewString(args.Equals), "equals")
}
result, err := modules.SecGroups.List(s, params)
if err != nil {
@@ -61,6 +61,27 @@ func init() {
})
type SecGroupsUnionOptions struct {
ID string `help:"ID or Name of security group destination"`
SECGROUPS []string `help:"source IDs or Names of secgroup"`
}
R(&SecGroupsUnionOptions{}, "secgroup-union", "Union secgroups to one secgroup", func(s *mcclient.ClientSession, args *SecGroupsUnionOptions) error {
params := jsonutils.NewDict()
secgroups := jsonutils.NewArray()
for i := 0; i < len(args.SECGROUPS); i++ {
secgroups.Add(jsonutils.NewString(args.SECGROUPS[i]))
}
params.Add(secgroups, "secgroups")
secgroup, err := modules.SecGroups.PerformAction(s, args.ID, "union", params)
if err != nil {
return err
}
printObject(secgroup)
return nil
})
type SecGroupsDetailOptions struct {
ID string `help:"ID or Name of security group"`
}
pkg/compute/models/secgroups.go
+12 -16
View File
@@ -51,23 +51,23 @@ type SSecurityGroup struct {
}
func (manager *SSecurityGroupManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
unionSecgroup, _ := query.GetString("union_secgroup")
if len(unionSecgroup) > 0 {
_secgroup, err := manager.FetchByIdOrName(userCred, unionSecgroup)
equalSecgroup, _ := query.GetString("equals")
if len(equalSecgroup) > 0 {
_secgroup, err := manager.FetchByIdOrName(userCred, equalSecgroup)
if err != nil {
return nil, err
return nil, httperrors.NewInputParameterError("Failed fetching secgroup %s", equalSecgroup)
}
secgroup := _secgroup.(*SSecurityGroup)
secgroup.SetModelManager(manager)
sq := manager.Query().NotEquals("id", secgroup.Id)
secgroups := []SSecurityGroup{}
err = db.FetchModelObjects(manager, sq, &secgroups)
if err != nil {
return nil, err
}
srs := secgroup.getSecurityGroupRuleSet()
secgroupIds := []string{}
for i := 0; i < len(secgroups); i++ {
if equal := secgroup.isEqual(ctx, userCred, &secgroups[i]); equal {
if srs.IsEqual(secgroups[i].getSecurityGroupRuleSet()) {
secgroupIds = append(secgroupIds, secgroups[i].Id)
}
}
@@ -297,6 +297,7 @@ func (self *SSecurityGroup) PerformUnion(ctx context.Context, userCred mcclient.
if len(secgroupIds) == 0 {
return nil, httperrors.NewMissingParameterError("secgroups")
}
srs := self.getSecurityGroupRuleSet()
secgroups := []*SSecurityGroup{}
for _, secgroupId := range secgroupIds {
_secgroup, err := SecurityGroupManager.FetchByIdOrName(userCred, secgroupId)
@@ -305,7 +306,8 @@ func (self *SSecurityGroup) PerformUnion(ctx context.Context, userCred mcclient.
}
secgroup := _secgroup.(*SSecurityGroup)
secgroup.SetModelManager(SecurityGroupManager)
if equal := self.isEqual(ctx, userCred, secgroup); !equal {
_srs := secgroup.getSecurityGroupRuleSet()
if !srs.IsEqual(_srs) {
return nil, httperrors.NewUnsupportOperationError("secgroup %s rules not equals %s rules", secgroup.Name, self.Name)
}
secgroups = append(secgroups, secgroup)
@@ -320,25 +322,19 @@ func (self *SSecurityGroup) PerformUnion(ctx context.Context, userCred mcclient.
if err := self.migrateGuestSecurityGroup(secgroup); err != nil {
return nil, err
}
secgroup.RealDelete(ctx, userCred)
}
self.DoSync(ctx, userCred)
return nil, nil
}
func (self *SSecurityGroup) isEqual(ctx context.Context, userCred mcclient.TokenCredential, secgroup *SSecurityGroup) bool {
func (self *SSecurityGroup) getSecurityGroupRuleSet() secrules.SecurityGroupRuleSet {
rules := self.GetSecRules("")
srs := secrules.SecurityGroupRuleSet{}
for i := 0; i < len(rules); i++ {
srs.AddRule(rules[i])
}
_rules := secgroup.GetSecRules("")
_srs := secrules.SecurityGroupRuleSet{}
for i := 0; i < len(_rules); i++ {
_srs.AddRule(_rules[i])
}
return srs.IsEqual(_srs)
return srs
}
func (self *SSecurityGroup) migrateSecurityGroupCache(secgroup *SSecurityGroup) error {
vendor/yunion.io/x/pkg/util/secrules/secrules.go
Generated Vendored
+1 -1
View File
@@ -181,7 +181,7 @@ func (rule *SecurityRule) IsWildMatch() bool {
func (rule SecurityRule) protoRelation(r SecurityRule) TSecurityRuleRelation {
if rule.Direction != r.Direction {
return RELATION_IDENTICAL
return RELATION_INDEPENDENT
}
if rule.Protocol == r.Protocol {
if utils.IsInStringArray(rule.Protocol, []string{PROTO_ANY, PROTO_ICMP}) {
vendor/yunion.io/x/pkg/util/secrules/securityruleset.go
Generated Vendored
+67 -62
View File
@@ -2,6 +2,7 @@ package secrules
import (
"bytes"
"fmt"
"sort"
"yunion.io/x/log"
@@ -12,14 +13,14 @@ type SecurityGroupSubSubRuleSet struct {
rules []SecurityRule
}
func (sssrs *SecurityGroupSubSubRuleSet) AddRule(rule SecurityRule) {
func (sssrs *SecurityGroupSubSubRuleSet) addRule(rule SecurityRule) {
if sssrs.rules == nil {
sssrs.ipKey = rule.getIPKey()
sssrs.rules = []SecurityRule{rule}
return
}
if sssrs.ipKey != rule.getIPKey() {
panic("rule ip key not equal")
panic(fmt.Sprintf("rule ip key %s not equal %s", sssrs.ipKey, rule.getIPKey()))
}
idx := 0
for idx < len(sssrs.rules) {
@@ -30,15 +31,19 @@ func (sssrs *SecurityGroupSubSubRuleSet) AddRule(rule SecurityRule) {
case RELATION_IDENTICAL, RELATION_SUPERSET:
return
case RELATION_SUBSET:
sssrs.rules = append(sssrs.rules[:idx], sssrs.rules[idx+1:]...)
if idx+1 < len(sssrs.rules) {
sssrs.rules = append(sssrs.rules[:idx], sssrs.rules[idx+1:]...)
} else {
sssrs.rules = sssrs.rules[:idx]
}
case RELATION_NEXT_AHEAD, RELATION_NEXT_AFTER, RELATION_OVERLAP:
r, err := rule.merge(sssrs.rules[idx])
if err != nil {
log.Errorf("Merge failed?? %v", err)
continue
panic(err.Error())
}
idx = 0
sssrs.rules[idx] = r
idx = 0
}
}
sssrs.rules = append(sssrs.rules, rule)
@@ -49,74 +54,72 @@ type SecurityGroupSubRuleSet struct {
denyRules *SecurityGroupSubSubRuleSet
}
func (ssrs *SecurityGroupSubRuleSet) AddRule(rule SecurityRule) {
func (ssrs *SecurityGroupSubRuleSet) addRule(rule SecurityRule) {
if rule.Action == SecurityRuleAllow {
if ssrs.allowRules == nil {
ssrs.allowRules = &SecurityGroupSubSubRuleSet{}
}
ssrs.allowRules.AddRule(rule)
ssrs.allowRules.addRule(rule)
} else {
if ssrs.denyRules == nil {
ssrs.denyRules = &SecurityGroupSubSubRuleSet{}
}
ssrs.denyRules.AddRule(rule)
ssrs.denyRules.addRule(rule)
}
}
func (ssrs *SecurityGroupSubRuleSet) isEqual(_ssrs *SecurityGroupSubRuleSet) bool {
allowRules := ssrs.GetAllowRules()
_allowRules := _ssrs.GetAllowRules()
if len(allowRules.rules) != len(_allowRules.rules) {
func (ssrs *SecurityGroupSubRuleSet) isRulesEqual(rules *SecurityGroupSubSubRuleSet, _rules *SecurityGroupSubSubRuleSet) bool {
if rules == _rules { //都是nil
return true
}
if rules == nil || _rules == nil { //其中一个是nil
return false
}
if len(rules.rules) != len(_rules.rules) {
return false
}
sort.Slice(allowRules.rules, func(i, j int) bool {
return allowRules.rules[i].Priority < allowRules.rules[j].Priority
sort.Slice(rules.rules, func(i, j int) bool {
return rules.rules[i].Priority < rules.rules[j].Priority
})
sort.Slice(_rules.rules, func(i, j int) bool {
return _rules.rules[i].Priority < _rules.rules[j].Priority
})
sort.Slice(_allowRules.rules, func(i, j int) bool {
return _allowRules.rules[i].Priority < _allowRules.rules[j].Priority
})
for i := 0; i < len(allowRules.rules); i++ {
if allowRules.rules[i].String() != _allowRules.rules[i].String() {
rulePriority, initPriority := 0, 0
_rulePriority, _initPriority := 0, 0
for i := 0; i < len(rules.rules); i++ {
if rulePriority != rules.rules[i].Priority {
rulePriority = rules.rules[i].Priority
initPriority++
}
find, ruleStr := false, rules.rules[i].String()
for j := 0; j < len(_rules.rules); j++ {
if _rulePriority != _rules.rules[j].Priority {
_rulePriority = _rules.rules[j].Priority
_initPriority++
}
//仅在每个优先级阶梯下进行对比
if initPriority != _initPriority {
continue
}
if _rules.rules[j].String() == ruleStr {
find = true
}
}
if !find {
return false
}
}
denyRules := ssrs.GetDenyRules()
_denyRuels := _ssrs.GetDenyRules()
if len(denyRules.rules) != len(_denyRuels.rules) {
return false
}
sort.Slice(denyRules.rules, func(i, j int) bool {
return denyRules.rules[i].Priority < denyRules.rules[j].Priority
})
sort.Slice(_denyRuels.rules, func(i, j int) bool {
return _denyRuels.rules[i].Priority < _denyRuels.rules[j].Priority
})
for i := 0; i < len(denyRules.rules); i++ {
if denyRules.rules[i].String() != _denyRuels.rules[i].String() {
return false
}
}
return true
}
func (ssrs *SecurityGroupSubRuleSet) GetAllowRules() SecurityGroupSubSubRuleSet {
if ssrs.allowRules == nil {
return SecurityGroupSubSubRuleSet{}
func (ssrs *SecurityGroupSubRuleSet) isEqual(_ssrs *SecurityGroupSubRuleSet) bool {
if _ssrs == nil {
return false
}
return *ssrs.allowRules
}
func (ssrs *SecurityGroupSubRuleSet) GetDenyRules() SecurityGroupSubSubRuleSet {
if ssrs.denyRules == nil {
return SecurityGroupSubSubRuleSet{}
}
return *ssrs.denyRules
return ssrs.isRulesEqual(ssrs.allowRules, _ssrs.allowRules) && ssrs.isRulesEqual(ssrs.denyRules, _ssrs.denyRules)
}
type SecurityGroupRuleSet struct {
@@ -134,18 +137,19 @@ func (srs *SecurityGroupRuleSet) AddRule(rule SecurityRule) {
ssrs := srs.rules[key]
if len(rule.Ports) > 0 {
ports := rule.Ports
//规则合并时，是依据PortStart和PortEnd,因此将多个不连续的端口拆分为单个端口连续的规则进行合并
rule.Ports = []int{}
for i := 0; i < len(ports); i++ {
rule.PortStart = ports[i]
rule.PortEnd = ports[i]
ssrs.AddRule(rule)
ssrs.addRule(rule)
}
return
}
ssrs.AddRule(rule)
ssrs.addRule(rule)
}
func (srs *SecurityGroupRuleSet) GetSubRuleSet(key string) *SecurityGroupSubRuleSet {
func (srs *SecurityGroupRuleSet) getSubRuleSet(key string) *SecurityGroupSubRuleSet {
if srs.rules == nil {
return nil
}
@@ -156,18 +160,22 @@ func (srs *SecurityGroupRuleSet) GetSubRuleSet(key string) *SecurityGroupSubRule
return s
}
func (srs *SecurityGroupRuleSet) GetAllowRules() []SecurityRule {
func (srs *SecurityGroupRuleSet) getAllowRules() []SecurityRule {
rules := []SecurityRule{}
for _, v := range srs.rules {
rules = append(rules, v.GetAllowRules().rules...)
if v.allowRules != nil {
rules = append(rules, v.allowRules.rules...)
}
}
return rules
}
func (srs *SecurityGroupRuleSet) GetDenyRules() []SecurityRule {
func (srs *SecurityGroupRuleSet) getDenyRules() []SecurityRule {
rules := []SecurityRule{}
for _, v := range srs.rules {
rules = append(rules, v.GetDenyRules().rules...)
if v.denyRules != nil {
rules = append(rules, v.denyRules.rules...)
}
}
return rules
}
@@ -177,10 +185,7 @@ func (srs *SecurityGroupRuleSet) IsEqual(src SecurityGroupRuleSet) bool {
return false
}
for k, v := range srs.rules {
_v := src.GetSubRuleSet(k)
if _v == nil {
return false
}
_v := src.getSubRuleSet(k)
if !v.isEqual(_v) {
return false
}
@@ -190,11 +195,11 @@ func (srs *SecurityGroupRuleSet) IsEqual(src SecurityGroupRuleSet) bool {
func (srs *SecurityGroupRuleSet) String() string {
buf := bytes.Buffer{}
for _, r := range srs.GetAllowRules() {
for _, r := range srs.getAllowRules() {
buf.WriteString(r.String())
buf.WriteString(";")
}
for _, r := range srs.GetDenyRules() {
for _, r := range srs.getDenyRules() {
buf.WriteString(r.String())
buf.WriteString(";")
}