Skip to content

Commit 62eb540

Browse files
miguelaferreiramiguelaferreira
committed
Merge pull request #146 from schubergphilis/tech/trust_nw_as_string
Allow trusted_networks as both string or array
2 parents 64eff9e + 59bcd85 commit 62eb540

File tree

5 files changed

+100
-61
lines changed

5 files changed

+100
-61
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ to update UUIDs in your Vagrantfile. If both are specified, the id parameter tak
144144
* `pf_public_port_randomrange` - If public port is omited, a port from this range wll be used (default `{:start=>49152, :end=>65535}`)
145145
* `pf_private_port` - Private port for port forwarding rule (defaults to respective Communicator protocol)
146146
* `pf_open_firewall` - Flag to enable/disable automatic open firewall rule (by CloudStack)
147-
* `pf_trusted_networks` - Array to network(s) to
147+
* `pf_trusted_networks` - Array of CIDRs or (array of) comma-separated string of CIDRs to network(s) to
148148
- automatically (by plugin) generate firewall rules for, ignored if `pf_open_firewall` set `true`
149149
- use as default for firewall rules where source CIDR is missing
150150
* `port_forwarding_rules` - Port forwarding rules for the virtual machine
@@ -338,7 +338,7 @@ Vagrant.configure("2") do |config|
338338

339339
config.vm.provider :cloudstack do |cloudstack|
340340

341-
cloudstack.pf_trusted_networks = [ "1.2.3.4/24" , "11.22.33.44/32" ]
341+
cloudstack.pf_trusted_networks = "1.2.3.4/24,11.22.33.44/32"
342342
cloudstack.port_forwarding_rules = [
343343
{ :privateport => 22, :generate_firewall => true },
344344
{ :privateport => 80, :generate_firewall => true }

‎Rakefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ task :default => "spec"
2929
namespace :functional_tests do
3030

3131
# Name must match folder beneath functional-tests/
32-
functional_test_names = %w(vmlifecycle rsync networking)
32+
functional_test_names = %w(vmlifecycle networking rsync)
3333
separate_test_names = %w(basic)
3434

3535
desc "Check for required enviroment variables for functional testing"

‎functional-tests/networking/Vagrantfile.advanced_networking‎

Lines changed: 86 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -5,69 +5,98 @@
55
VAGRANTFILE_API_VERSION = '2'
66

77
Vagrant.require_version '>= 1.5.0'
8+
cloudstack_pf_ip_address = ENV['PUBLIC_SOURCE_NAT_IP']
9+
machines = {
10+
box1: {
11+
# Test fixed public port
12+
pf_public_port: ENV['PUBLIC_SSH_PORT'],
13+
# Test fixed private port
14+
pf_private_port: ENV['PRIVATE_SSH_PORT'],
15+
firewall_rules: [
16+
# Full Firewall rule
17+
{:ipaddress => cloudstack_pf_ip_address, :protocol => 'tcp', :startport => 1111, :endport => 1111},
18+
# Firewall rule without ':ipaddress' which defaults to 'cloudstack_pf_ip_address'
19+
{:protocol => 'tcp', :startport => 1122, :endport => 1122},
20+
# Firewall rule without ':protocol', which defaults to 'tcp'
21+
{:startport => 1133, :endport => 1133},
22+
# Firewall rule without ':endport', which defaults to ':startport' if present
23+
{:startport => 1144},
24+
# Firewall rule without ':start', which defaults to ':endport' if present
25+
{:endport => 22}
26+
],
27+
port_forwarding_rules: [
28+
# Full portforwarding rule
29+
{:ipaddress => cloudstack_pf_ip_address, :protocol => "tcp", :publicport => 1111, :privateport => 22, :openfirewall => false},
30+
# Portforwarding rule without ':ipaddress' which defaults to 'cloudstack_pf_ip_address'
31+
{:protocol => "tcp", :publicport => 1122, :privateport => 22, :openfirewall => false},
32+
# Portforwarding rule without ':protocol', which defaults to 'tcp'
33+
{:publicport => 1133, :privateport => 22, :openfirewall => false},
34+
# Portforwarding rule without ':openfirewall', which defaults to 'cloudstack.pf_open_firewall'
35+
{:publicport => 1144, :privateport => 22},
36+
# Portforwarding rule without ':publicport', which defaults to ':privateport'
37+
{:privateport => 22},
38+
# Portforwarding rule with ':generate_firewall', which generates an apropriate
39+
# Firewall rule based ':publicport' => ':startport', and other defaults
40+
{:publicport => 1155, :privateport => 22, :generate_firewall => true},
41+
# Portforwarding rule which instructs CloudStack to create a Firewall rule
42+
{:publicport => 1166, :privateport => 22, :openfirewall => true},
43+
],
44+
# Trusted network as array, instead of string. Add some networks to make sure it's an (multi element) Array
45+
pf_trusted_networks: [ENV['SOURCE_CIDR'], ',172.31.1.172/32', '172.31.1.173/32'],
46+
# Ignore security groups
47+
security_groups: [{
48+
:name => "Awesome_security_group",
49+
:description => "Created from the Vagrantfile",
50+
:rules => [{:type => "ingress", :protocol => "TCP", :startport => 22, :endport => 22, :cidrlist => "0.0.0.0/0"}]
51+
}],
52+
# Ignore security groups
53+
security_group_names: ['default', 'Awesome_security_group'],
54+
},
55+
box2: {
56+
# NO pf_public_port; test auto generated public port
57+
# NO pf_private_port; test detection of Communicator port (SSH/Winrm)
58+
# NO firewall rules for Communicator (SSH/WinRM), test auto generation
59+
# Trusted networks as string instead of array. Add some networks to make sure it supports multiple network-string
60+
pf_trusted_networks: ENV['SOURCE_CIDR'] + ',172.31.1.172/32,172.31.1.173/32'
61+
}
62+
}
863

9-
Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
10-
config.vm.box = ENV['LINUX_TEMPLATE_NAME']
64+
Vagrant.configure(VAGRANTFILE_API_VERSION) do |global_config|
65+
machines.each_pair do |name, options|
66+
global_config.vm.define name do |config|
67+
config.vm.box = ENV['LINUX_TEMPLATE_NAME']
1168

12-
config.vm.synced_folder ".", "/vagrant", type: "rsync",
13-
rsync__exclude: [".git/", "vendor"], disabled: true
69+
config.vm.synced_folder ".", "/vagrant", type: "rsync",
70+
rsync__exclude: [".git/", "vendor"], disabled: true
1471

15-
config.vm.provider :cloudstack do |cloudstack, override|
16-
cloudstack.display_name = ENV['TEST_NAME']
72+
config.vm.provider :cloudstack do |cloudstack, override|
73+
cloudstack.display_name = "#{name}-#{ENV['TEST_NAME']}"
1774

18-
cloudstack.host = ENV['CLOUDSTACK_HOST']
19-
# Use default path, port and scheme
20-
cloudstack.api_key = ENV['CLOUDSTACK_API_KEY']
21-
cloudstack.secret_key = ENV['CLOUDSTACK_SECRET_KEY']
22-
cloudstack.zone_name = ENV['ZONE_NAME']
23-
cloudstack.network_name = ENV['NETWORK_NAME']
24-
cloudstack.service_offering_name = ENV['SERVICE_OFFERING_NAME']
25-
cloudstack.ssh_key = ENV['SSH_KEY'] unless ENV['SSH_KEY'].nil?
26-
cloudstack.ssh_user = ENV['SSH_USER'] unless ENV['SSH_USER'].nil?
75+
cloudstack.host = ENV['CLOUDSTACK_HOST']
76+
# Use default path, port and scheme
77+
cloudstack.api_key = ENV['CLOUDSTACK_API_KEY']
78+
cloudstack.secret_key = ENV['CLOUDSTACK_SECRET_KEY']
79+
cloudstack.zone_name = ENV['ZONE_NAME']
80+
cloudstack.network_name = ENV['NETWORK_NAME']
81+
cloudstack.service_offering_name = ENV['SERVICE_OFFERING_NAME']
82+
cloudstack.ssh_key = ENV['SSH_KEY'] unless ENV['SSH_KEY'].nil?
83+
cloudstack.ssh_user = ENV['SSH_USER'] unless ENV['SSH_USER'].nil?
84+
cloudstack.expunge_on_destroy == true
2785

28-
cloudstack.pf_ip_address = ENV['PUBLIC_SOURCE_NAT_IP']
29-
cloudstack.pf_public_port = ENV['PUBLIC_SSH_PORT']
30-
cloudstack.pf_private_port = ENV['PRIVATE_SSH_PORT']
31-
cloudstack.pf_open_firewall = false
86+
cloudstack.pf_ip_address = cloudstack_pf_ip_address
87+
cloudstack.pf_public_port = options[:pf_public_port] unless options[:pf_public_port].nil?
88+
cloudstack.pf_private_port = options[:pf_private_port] unless options[:pf_private_port].nil?
89+
cloudstack.pf_open_firewall = false
3290

33-
# With Advanced networking, following Basic networking features should be ignored
34-
cloudstack.security_groups = [{
35-
:name => "Awesome_security_group",
36-
:description => "Created from the Vagrantfile",
37-
:rules => [{:type => "ingress", :protocol => "TCP", :startport => 22, :endport => 22, :cidrlist => "0.0.0.0/0"}]
38-
}]
39-
cloudstack.security_group_names = ['default', 'Awesome_security_group']
40-
# With Advanced networking, following Basic networking features should be ignored
91+
# With Advanced networking, following Basic networking features should be ignored
92+
cloudstack.security_groups = options[:security_groups] unless options[:security_groups].nil?
93+
cloudstack.security_group_names = options[:security_group_names] unless options[:security_group_names].nil?
94+
# With Advanced networking, following Basic networking features should be ignored
4195

42-
cloudstack.pf_trusted_networks = [ ENV['SOURCE_CIDR'] ]
43-
cloudstack.firewall_rules = [
44-
# Full Firewall rule
45-
{ :ipaddress => cloudstack.pf_ip_address, :protocol => 'tcp', :startport => 1111, :endport => 1111 },
46-
# Firewall rule without ':ipaddress' which defaults to 'cloudstack.pf_ip_address'
47-
{ :protocol => 'tcp', :startport => 1122, :endport => 1122 },
48-
# Firewall rule without ':protocol', which defaults to 'tcp'
49-
{ :startport => 1133, :endport => 1133 },
50-
# Firewall rule without ':endport', which defaults to ':startport' if present
51-
{ :startport => 1144 },
52-
# Firewall rule without ':start', which defaults to ':endport' if present
53-
{ :endport => 22 }
54-
]
55-
cloudstack.port_forwarding_rules = [
56-
# Full portforwarding rule
57-
{ :ipaddress => cloudstack.pf_ip_address, :protocol => "tcp", :publicport => 1111, :privateport => 22, :openfirewall => false },
58-
# Portforwarding rule without ':ipaddress' which defaults to 'cloudstack.pf_ip_address'
59-
{ :protocol => "tcp", :publicport => 1122, :privateport => 22, :openfirewall => false },
60-
# Portforwarding rule without ':protocol', which defaults to 'tcp'
61-
{ :publicport => 1133, :privateport => 22, :openfirewall => false },
62-
# Portforwarding rule without ':openfirewall', which defaults to 'cloudstack.pf_open_firewall'
63-
{ :publicport => 1144, :privateport => 22 },
64-
# Portforwarding rule without ':publicport', which defaults to ':privateport'
65-
{ :privateport => 22 },
66-
# Portforwarding rule with ':generate_firewall', which generates an apropriate
67-
# Firewall rule based ':publicport' => ':startport', and other defaults
68-
{ :publicport => 1155, :privateport => 22, :generate_firewall => true },
69-
# Portforwarding rule which instructs CloudStack to create a Firewall rule
70-
{ :publicport => 1166, :privateport => 22, :openfirewall => true },
71-
]
96+
cloudstack.pf_trusted_networks = options[:pf_trusted_networks] unless options[:pf_trusted_networks].nil?
97+
cloudstack.firewall_rules = options[:firewall_rules] unless options[:firewall_rules].nil?
98+
cloudstack.port_forwarding_rules = options[:port_forwarding_rules] unless options[:port_forwarding_rules].nil?
99+
end
100+
end
72101
end
73102
end

‎functional-tests/networking/rsync_spec.rb‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
describe 'Networking features' do
22
it 'creates firewall and portwarding rules' do
3-
expect(`vagrant up`).to include('Machine is booted and ready for use!')
3+
expect(`vagrant up`).to include(
4+
'box1: Machine is booted and ready for use!',
5+
'box2: Machine is booted and ready for use!'
6+
)
47
expect($?.exitstatus).to eq(0)
58

69
expect(`vagrant destroy --force`).to include('Terminating the instance...')

‎lib/vagrant-cloudstack/action/run_instance.rb‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ def call(env)
3232
# Get the configs
3333
@domain_config = @env[:machine].provider_config.get_domain_config(@domain)
3434

35+
sanitize_domain_config
36+
3537
@zone = CloudstackResource.new(@domain_config.zone_id, @domain_config.zone_name, 'zone')
3638
@network = CloudstackResource.new(@domain_config.network_id, @domain_config.network_name, 'network')
3739
@service_offering = CloudstackResource.new(@domain_config.service_offering_id, @domain_config.service_offering_name, 'service_offering')
@@ -116,6 +118,11 @@ def call(env)
116118
@app.call(@env)
117119
end
118120

121+
def sanitize_domain_config
122+
# Accept a single entry as input, convert it to array
123+
@domain_config.pf_trusted_networks = [@domain_config.pf_trusted_networks] if @domain_config.pf_trusted_networks
124+
end
125+
119126
def configure_networking
120127
enable_static_nat_rules
121128

0 commit comments

Comments
 (0)