Dogface2k commented on code in PR #13766:
URL: https://github.com/apache/cloudstack/pull/13766#discussion_r4531524015
##########
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/service/NsxServiceImpl.java:
##########
@@ -196,6 +298,192 @@ public boolean deleteFirewallRules(Network network,
List<NsxNetworkRule> netRule
return result.getResult();
}
+ @Override
+ public NsxVpnGatewayResult createVpnGateway(Vpc vpc, String
localEndpointIp) {
+ return createVpnGateway(vpc, localEndpointIp, false);
+ }
+
+ @Override
+ public NsxVpnGatewayResult createVpnGateway(Vpc vpc, String
localEndpointIp, boolean reconcileExistingService) {
+ CreateNsxVpnGatewayCommand createNsxVpnGatewayCommand = new
CreateNsxVpnGatewayCommand(vpc.getDomainId(),
+ vpc.getAccountId(), vpc.getZoneId(), vpc.getId(),
vpc.getName(), localEndpointIp,
+ reconcileExistingService);
+ NsxAnswer result =
nsxControllerUtils.sendNsxCommandForResult(createNsxVpnGatewayCommand,
vpc.getZoneId());
+ return new NsxVpnGatewayResult(result.getResult(),
result.isEndpointMayBeInUse());
+ }
+
+ public boolean deleteVpnGateway(Vpc vpc) {
+ DeleteNsxVpnGatewayCommand deleteNsxVpnGatewayCommand = new
DeleteNsxVpnGatewayCommand(vpc.getDomainId(),
+ vpc.getAccountId(), vpc.getZoneId(), vpc.getId(),
vpc.getName());
+ NsxAnswer result =
nsxControllerUtils.sendNsxCommand(deleteNsxVpnGatewayCommand, vpc.getZoneId());
+ return result.getResult();
+ }
+
+ public boolean createVpnConnection(Vpc vpc, long connectionId, String
peerAddress, String psk,
+ String ikePolicy, String espPolicy,
Long ikeLifetime, Long espLifetime,
+ boolean dpdEnabled, String ikeVersion,
boolean passive, List<String> peerCidrs,
+ String vtiLocalIp, String vtiPeerIp,
int vtiPrefixLength, String localEndpointIp) {
+ CreateNsxVpnConnectionCommand createNsxVpnConnectionCommand = new
CreateNsxVpnConnectionCommand(vpc.getDomainId(),
+ vpc.getAccountId(), vpc.getZoneId(), vpc.getId(),
vpc.getName(), connectionId, peerAddress, psk,
+ ikePolicy, espPolicy, ikeLifetime, espLifetime, dpdEnabled,
ikeVersion, passive, peerCidrs,
+ vtiLocalIp, vtiPeerIp, vtiPrefixLength, vpc.getCidr(),
localEndpointIp);
+ NsxAnswer result =
nsxControllerUtils.sendNsxCommand(createNsxVpnConnectionCommand,
vpc.getZoneId());
+ return result.getResult();
+ }
+
+ public boolean deleteVpnConnection(Vpc vpc, long connectionId) {
+ DeleteNsxVpnConnectionCommand deleteNsxVpnConnectionCommand = new
DeleteNsxVpnConnectionCommand(vpc.getDomainId(),
+ vpc.getAccountId(), vpc.getZoneId(), vpc.getId(),
vpc.getName(), connectionId);
+ NsxAnswer result =
nsxControllerUtils.sendNsxCommand(deleteNsxVpnConnectionCommand,
vpc.getZoneId());
+ return result.getResult();
+ }
+
+ public boolean updateVpnConnectionState(Vpc vpc, long connectionId,
boolean enabled) {
+ UpdateNsxVpnConnectionStateCommand command = new
UpdateNsxVpnConnectionStateCommand(vpc.getDomainId(),
+ vpc.getAccountId(), vpc.getZoneId(), vpc.getId(),
vpc.getName(), connectionId, enabled);
+ NsxAnswer result = nsxControllerUtils.sendNsxCommand(command,
vpc.getZoneId());
+ return result.getResult();
+ }
+
+ public String getVpnConnectionStatus(Vpc vpc, long connectionId) {
+ GetNsxVpnSessionStatusCommand getNsxVpnSessionStatusCommand = new
GetNsxVpnSessionStatusCommand(vpc.getDomainId(),
+ vpc.getAccountId(), vpc.getZoneId(), vpc.getId(),
vpc.getName(), connectionId);
+ NsxAnswer result =
nsxControllerUtils.sendNsxCommand(getNsxVpnSessionStatusCommand,
vpc.getZoneId());
+ return result.getDetails();
+ }
+
+ /**
+ * The global lock makes the scan a cluster-wide singleton. The connection
row lock in
+ * transitionVpnConnectionState separately protects each state transition
from a concurrent
+ * user operation that starts, stops, resets, or deletes the connection.
+ */
+ protected class VpnStatusPollTask extends ManagedContextRunnable {
+ @Override
+ protected void runInContext() {
+ GlobalLock scanLock =
GlobalLock.getInternLock(VPN_STATUS_POLL_LOCK_NAME);
+ try {
+ if (scanLock.lock(VPN_STATUS_POLL_LOCK_TIMEOUT)) {
+ try {
+ pollVpnConnectionStatuses();
+ } finally {
+ scanLock.unlock();
+ }
+ }
+ } catch (Exception e) {
+ logger.warn("Failed to poll the status of the NSX Site-to-Site
VPN connections: {}", e.getMessage(), e);
+ } finally {
+ scanLock.releaseRef();
+ }
+ }
+ }
+
+ private void pollVpnConnectionStatuses() {
+ Set<Long> polledConnectionIds = new HashSet<>();
+ List<Site2SiteVpnConnectionVO> connections =
site2SiteVpnConnectionDao.listByStates(
+ VPN_POLLED_STATES.toArray(new
Site2SiteVpnConnection.State[0]));
+ for (Site2SiteVpnConnectionVO connection : connections) {
+ Site2SiteVpnGatewayVO vpnGateway =
site2SiteVpnGatewayDao.findById(connection.getVpnGatewayId());
+ if (vpnGateway == null) {
+ continue;
+ }
+ VpcVO vpc = vpcDao.findById(vpnGateway.getVpcId());
+ if (vpc == null || !isVpnProvidedByNsx(vpc, vpnGateway)) {
+ continue;
+ }
+ polledConnectionIds.add(connection.getId());
+ pollVpnConnectionStatus(connection, vpc);
+ }
+ // Drop the failure counters of connections that were deleted or left
the polled states.
+ vpnStatusPollFailures.keySet().retainAll(polledConnectionIds);
+ }
+
+ private boolean isVpnProvidedByNsx(Vpc vpc, Site2SiteVpnGatewayVO
vpnGateway) {
+ return vpc != null
+ && userIpAddressDetailsDao != null
+ && vpnGateway != null
+ && userIpAddressDetailsDao.findDetail(vpnGateway.getAddrId(),
NsxElement.NSX_VPN_GATEWAY_IP_DETAIL) != null;
Review Comment:
Keeping the NSX IP-marker key as one definition within the NSX package; both
consumers use that definition. A separate holder is optional and does not
change correctness here. The new gateway-provider key is a different,
provider-neutral detail: it is defined on Site2SiteVpnServiceProvider because
both the server and NSX plugin use it. This distinction was independently
checked against the final tree.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
