module NSXDriver::NSXRule::NSXTRule
Class Logical Switch
Public Instance Methods
nsxt_rule_spec(rule, vm_data, nic_data)
click to toggle source
# File lib/nsxt_rule.rb, line 23 def nsxt_rule_spec(rule, vm_data, nic_data) # default spec # Allow any-any to any port applied on the # virtual machine logical port rule_name = "#{rule[:id]}-#{rule[:name]}-#{vm_data[:id]}" rule_name << "-#{vm_data[:deploy_id]}-#{nic_data[:id]}" rule_spec = { :display_name => rule_name, :destinations_excluded => false, :sources => [], :destinations => [], :services => [], :applied_tos => [ { :target_id => nic_data[:lp].id, :target_display_name => nic_data[:name], :target_type => nic_data[:lp].type, :is_valid => true } ], :ip_protocol => 'IPV4_IPV6', :logged => false, :action => 'ALLOW', :sources_excluded => false, :disabled => false, :direction => rule[:direction] } rule_protocol_template = { 'TCP' => [ { :service => { :l4_protocol => 'TCP', :source_ports => [], :destination_ports => [], :resource_type => 'L4PortSetNSService' } } ], 'UDP' => [ { :service => { :l4_protocol => 'UDP', :source_ports => [], :destination_ports => [], :resource_type => 'L4PortSetNSService' } } ], 'ICMP' => [ { :service => { :protocol => 'ICMPv4', :resource_type => 'ICMPTypeNSService' } } ], 'ICMPv6' => [ { :service => { :protocol => 'ICMPv6', :resource_type => 'ICMPTypeNSService' } } ], 'IPSEC' => [ { :service => { :l4_protocol => 'UDP', :source_ports => [], :destination_ports => [], :resource_type => 'L4PortSetNSService' } }, { :service => { :protocol_number => 50, :resource_type => 'IPProtocolNSService' } }, { :service => { :protocol_number => 51, :resource_type => 'IPProtocolNSService' } } ] } # Modify default rule spec based on rule_data extracted # from vm template ###### SOURCES / DESTINATIONS: Any | IP Address | Vnet ##### src_or_dst = [] # Target network: Vnet if !rule[:network_id].empty? src_or_dst << { :target_id => rule[:network_nsxid], :target_display_name => rule[:network_name], :target_type => 'LogicalSwitch', :is_valid => true } # Target network: Manual network (IP Address) elsif !rule[:subnets].empty? rule[:subnets].each do |subnet| src_or_dst << { :target_id => subnet, :target_display_name => subnet, :target_type => 'IPAddress', :is_valid => true } end end # (OpenNebula) INBOUND => Destination (NSX) # (OpenNebula) OUTBOUND => Source (NSX) unless src_or_dst.empty? rule_spec[:sources] = src_or_dst \ if rule[:direction] == 'IN' rule_spec[:destinations] = src_or_dst \ if rule[:direction] == 'OUT' end ##### SERVICES ##### services = [] service = rule_protocol_template[rule[:protocol]] case rule[:protocol] when 'TCP' service[0][:service][:source_ports] = rule[:ports] \ if rule[:direction] == 'IN' service[0][:service][:destination_ports] = rule[:ports] \ if rule[:direction] == 'OUT' when 'UDP' service[0][:service][:source_ports] = rule[:ports] \ if rule[:direction] == 'IN' service[0][:service][:destination_ports] = rule[:ports] \ if rule[:direction] == 'OUT' # when 'ICMP' # when 'ICMPv6' when 'IPSEC' ipsec_ports = NSXConstants::NSX_RULE_IPSEC_PORTS service[0][:service][:source_ports] = ipsec_ports \ if rule[:direction] == 'IN' service[0][:service][:destination_ports] = ipsec_ports \ if rule[:direction] == 'OUT' end if rule[:protocol] != 'ALL' && !service.empty? service.each do |s| services << s end rule_spec[:services] = services end rule_spec end