Merge branch 'release/2.5.0' of ssh://git.yunion.io/~qiujian/onecloud into hotfix/qj-fix-aliyun-network-fail-to-delete

pkg/compute/models/zones.go

@@ -17,6 +17,7 @@ import (
 )
 
 const (
+	ZONE_INIT    = "init"
 	ZONE_ENABLE  = "enable"
 	ZONE_DISABLE = "disable"
 	ZONE_SOLDOUT = "soldout"
@@ -469,7 +470,7 @@ func (manager *SZoneManager) InitializeData() error {
 				return nil
 			})
 		}
-		if z.Status == "init" {
+		if z.Status == ZONE_INIT || z.Status == ZONE_DISABLE {
 			manager.TableSpec().Update(&z, func() error {
 				z.Status = ZONE_ENABLE
 				return nil

pkg/util/aws/utils.go

@@ -5,6 +5,7 @@ import (
 	"net"
 	"reflect"
 	"regexp"
+	"sort"
 	"strings"
 
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -157,6 +158,34 @@ func IntVal(s *int64) int64 {
 	return 0
 }
 
+// SecurityRuleSet to  allow list
+// 将安全组规则全部转换为等价的allow规则
+func SecurityRuleSetToAllowSet(srs secrules.SecurityRuleSet) secrules.SecurityRuleSet {
+	inRuleSet := secrules.SecurityRuleSet{}
+	outRuleSet := secrules.SecurityRuleSet{}
+
+	for _, rule := range srs {
+		if rule.Direction == secrules.SecurityRuleIngress {
+			inRuleSet = append(inRuleSet, rule)
+		}
+
+		if rule.Direction == secrules.SecurityRuleEgress {
+			outRuleSet = append(outRuleSet, rule)
+		}
+	}
+
+	sort.Sort(inRuleSet)
+	sort.Sort(outRuleSet)
+
+	inRuleSet = inRuleSet.AllowList()
+	outRuleSet = outRuleSet.AllowList()
+
+	ret := secrules.SecurityRuleSet{}
+	ret = append(ret, inRuleSet...)
+	ret = append(ret, outRuleSet...)
+	return ret
+}
+
 func isAwsPermissionAllPorts(p ec2.IpPermission) bool {
 	if p.FromPort == nil || p.ToPort == nil {
 		return false

pkg/util/aws/vpc.go

@@ -146,6 +146,7 @@ func (self *SRegion) SyncSecurityGroup(secgroupId string, vpcId string, name str
 		secgroupId = fmt.Sprintf("%s-%s", vpcId, secgroupId)
 	}
 
+	rules = SecurityRuleSetToAllowSet(rules)
 	if secgroup, err := self.getSecurityGroupById(vpcId, secgroupId); err != nil {
 		if len(desc) == 0 {
 			desc = fmt.Sprintf("security group %s for vpc %s", name, vpcId)