opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-21 14:19:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

add secrule parse

Browse Source
This commit is contained in:
TangBin
2018-10-19 11:47:42 +08:00
parent fc94fdad01
commit ba5710cf70
2 changed files with 134 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/util/aws/securitygroup.go
+30 -48
View File
@@ -7,35 +7,6 @@ import (
"yunion.io/x/log"
)
type SecurityGroupPermissionNicType string
const (
IntranetNicType SecurityGroupPermissionNicType = "intranet"
InternetNicType SecurityGroupPermissionNicType = "internet"
)
type SPermission struct {
Description string
DestCidrIp string
DestGroupId string
DestGroupName string
DestGroupOwnerAccount string
Direction string
IpProtocol string
NicType SecurityGroupPermissionNicType
Policy string
PortRange string
Priority int
SourceCidrIp string
SourceGroupId string
SourceGroupName string
SourceGroupOwnerAccount string
}
type SPermissions struct {
Permission []SPermission
}
type Tags struct {
Tag []Tag
}
@@ -53,7 +24,7 @@ type SSecurityGroup struct {
SecurityGroupId string
Description string
SecurityGroupName string
Permissions SPermissions
Permissions []secrules.SecurityRule
Tags Tags
// CreationTime time.Time
@@ -107,25 +78,13 @@ func (self *SSecurityGroup) GetDescription() string {
}
func (self *SSecurityGroup) GetRules() ([]secrules.SecurityRule, error) {
// todo: implement me
rules := make([]secrules.SecurityRule, 0)
if secgrp, err := self.vpc.region.GetSecurityGroupDetails(self.SecurityGroupId); err != nil {
return rules, err
} else {
for _, permission := range secgrp.Permissions.Permission {
if rule, err := secrules.ParseSecurityRule(""); err != nil {
return rules, err
} else {
priority := permission.Priority
if priority > 100 {
priority = 100
}
rule.Priority = 101 - priority
rule.Description = permission.Description
rules = append(rules, *rule)
}
}
rules = secgrp.Permissions
}
return rules, nil
}
@@ -182,8 +141,31 @@ func (self *SRegion) syncSecgroupRules(secgroupId string, rules []secrules.Secur
return nil
}
func (self *SRegion) getSecurityGroupsPermissions(ingress []*ec2.IpPermission, egress []*ec2.IpPermission) SPermissions {
return SPermissions{}
func (self *SRegion) getSecRules(ingress []*ec2.IpPermission, egress []*ec2.IpPermission) ([]secrules.SecurityRule) {
rules := []secrules.SecurityRule{}
for _, p := range ingress {
ret, err := AwsIpPermissionToYunion(secrules.SecurityRuleIngress, p)
if err != nil {
log.Debugf(err.Error())
}
for _, rule := range ret {
rules = append(rules, rule)
}
}
for _, p := range egress {
ret, err := AwsIpPermissionToYunion(secrules.SecurityRuleEgress, p)
if err != nil {
log.Debugf(err.Error())
}
for _, rule := range ret {
rules = append(rules, rule)
}
}
return rules
}
func (self *SRegion) GetSecurityGroups(vpcId string, offset int, limit int) ([]SSecurityGroup, int, error) {
@@ -207,10 +189,10 @@ func (self *SRegion) GetSecurityGroups(vpcId string, offset int, limit int) ([]S
vpc, err := self.getVpc(*item.VpcId)
if err != nil {
log.Errorf("vpc %s not found", *item.VpcId)
continue
}
permissions := self.getSecurityGroupsPermissions(item.IpPermissions, item.IpPermissionsEgress)
permissions := self.getSecRules(item.IpPermissions, item.IpPermissionsEgress)
group := SSecurityGroup{
vpc: vpc,
pkg/util/aws/utils.go
+104 -8
View File
@@ -9,6 +9,11 @@ import (
"strings"
)
type portRange struct {
Start int64
End int64
}
func AppendFilter(filters []*ec2.Filter, name string, values []string) ([]*ec2.Filter) {
f := &ec2.Filter{}
v := make([]*string, len(values))
@@ -48,6 +53,14 @@ func ConvertedPointList(list []*string) ([]string) {
return result
}
func StrVal(s *string) string {
if s != nil {
return *s
}
return ""
}
func isAwsPermissionAllPorts(p ec2.IpPermission) bool {
// 全部端口范围： TCP/UDP （0，65535） 其他：（-1，-1）
if (*p.IpProtocol == "tcp" || *p.IpProtocol == "udp") && *p.FromPort == 0 && *p.ToPort == 65535 {
@@ -59,6 +72,66 @@ func isAwsPermissionAllPorts(p ec2.IpPermission) bool {
}
}
func awsProtocolToYunion(p ec2.IpPermission) string {
if *p.IpProtocol == "-1" {
return secrules.PROTO_ANY
} else {
return *p.IpProtocol
}
}
func isYunionRuleAllPorts(r secrules.SecurityRule) bool {
// 全部端口范围： TCP/UDP （0，65535） 其他：（-1，-1）
if (r.Protocol == "tcp" || r.Protocol == "udp") && r.PortStart == 0 && r.PortEnd == 65535 {
return true
} else if r.PortStart == -1 && r.PortEnd == -1 {
return true
} else {
return false
}
}
func yunionPortRangeToAws(r secrules.SecurityRule) ([]portRange) {
// port 0 / -1 都代表所有端口
portranges := []portRange{}
if len(r.Ports) == 0 {
var start, end = 0, 0
if r.PortStart <= 0 {
if r.Protocol == "tcp" || r.Protocol == "udp" {
start = 0
} else {
start = -1
}
} else {
start = r.PortStart
}
if r.PortEnd <= 0 {
if r.Protocol == "tcp" || r.Protocol == "udp" {
end = 65535
} else {
end = -1
}
} else {
end = r.PortEnd
}
portranges = append(portranges, portRange{int64(start), int64(end)})
}
for _, port := range r.Ports {
if port <= 0 && ( r.Protocol == "tcp" || r.Protocol == "udp" ) {
portranges = append(portranges, portRange{0, 65535})
} else if port <= 0 {
portranges = append(portranges, portRange{-1, -1})
} else {
portranges = append(portranges, portRange{int64(port), int64(port)})
}
}
return portranges
}
// Security Rule Transform
func AwsIpPermissionToYunion(direction secrules.TSecurityRuleDirection,p ec2.IpPermission) ([]secrules.SecurityRule, error) {
@@ -76,6 +149,7 @@ func AwsIpPermissionToYunion(direction secrules.TSecurityRuleDirection,p ec2.IpP
rules := []secrules.SecurityRule{}
isAllPorts := isAwsPermissionAllPorts(p)
protocol := awsProtocolToYunion(p)
for _, ip := range p.IpRanges {
ipNet := strings.Split(*ip.CidrIp, "/")
if len(ipNet) != 2 {
@@ -88,19 +162,21 @@ func AwsIpPermissionToYunion(direction secrules.TSecurityRuleDirection,p ec2.IpP
rule = secrules.SecurityRule{
Action: secrules.SecurityRuleAllow,
IPNet: &net.IPNet{net.IP(ipNet[0]), net.IPMask(ipNet[1])},
Protocol: *p.IpProtocol,
Protocol: protocol,
Direction: direction,
Description: "",
Priority: 1,
Description: StrVal(ip.Description),
}
} else {
rule = secrules.SecurityRule{
Action: secrules.SecurityRuleAllow,
IPNet: &net.IPNet{net.IP(ipNet[0]), net.IPMask(ipNet[1])},
Protocol: *p.IpProtocol,
Protocol: protocol,
Direction: direction,
PortStart: int(*p.FromPort),
PortEnd: int(*p.ToPort),
Description: "",
Priority: 1,
Description: StrVal(ip.Description),
}
}
@@ -111,10 +187,30 @@ func AwsIpPermissionToYunion(direction secrules.TSecurityRuleDirection,p ec2.IpP
return rules, nil
}
func YunionSecRuleToAws(rule secrules.SecurityRule) ec2.IpPermission {
return ec2.IpPermission{}
}
func YunionSecRuleToAws(rule secrules.SecurityRule) ([]ec2.IpPermission, error) {
if rule.Action == secrules.SecurityRuleDeny {
return nil, fmt.Errorf("YunionSecRuleToAws ignored aws not supported deny rule")
}
func DiffIpPermission(permission ec2.IpPermission, rule secrules.SecurityRule) {
iprange := rule.IPNet.String()
if iprange == "<nil>" {
return nil, fmt.Errorf("YunionSecRuleToAws ignored ipnet should not be empty")
}
ipranges := []*ec2.IpRange{}
ipranges = append(ipranges, &ec2.IpRange{CidrIp: &iprange, Description: &rule.Description})
portranges := yunionPortRangeToAws(rule)
permissions := []ec2.IpPermission{}
for _, port := range portranges {
permission := ec2.IpPermission{
FromPort: &port.Start,
IpProtocol: &rule.Protocol,
IpRanges: ipranges,
ToPort: &port.End,
}
permissions = append(permissions, permission)
}
return permissions, nil
}