Support ACL deny rules

Bug Reference: CLOUDSTACK-763

ACL Deny Rules

Currently only ACL allow rules are supported as part of Network ACLs. Default is to block all incoming and all outgoing traffic between tiers and between tiers and various gateways (including Public).  ACL deny rules will be supported through this feature. New fields "number"  and "action"will be added to rules to resolve conflicting rules.

NetworkACLContainer will be introduced to manage NetworkACLs.

NetworkACLContainer

NetworkACLContainer is a numbered list of  NetworkACLs that are evaluated in order, starting with the lowest numbered rule, to determine whether traffic is allowed in or out of any tier associated with the network ACL container.

Instead of adding NetworkACLs directly to the tier, NetworkACLs will be added to the NetworkACLContainer. Tier will be associated with a NetworkACLContainer at all times (default NetworkACLContainer will be used when no ACL container is associated).

NetworkACLContainer can be assigned to multiple vpc tiers. Each tier can be associated with only one NetworkACLContainer. 

Add/Remove networkACL to container

NetworkACLs can be added or removed from the container using APIs createNetworkACL and removeNetworkACL APIs.

Sample workflow

Creating Tier with default acl container and assigning a custom acl container later

1. Create VPC
2. Create Tier A - tier is associated with default network ACL container
3. Create custom network ACL Container
4. Add ACLs to the container
5. Assign ACL container created in step # 3 to tier A using replaceNetworkACLContainer API

Create Tier with custom acl container in 1 step

1. Create VPC
2. Create custom network ACL Container
3. Add ACLs to the container
4. Create Tier A with ACL container created in step # 2

API changes

Existing API

createNetworkAcl

Adds a networkACL to the specified container.

New parameters

• action (required) - allow/deny
• number (required) - rule number. ACL rules are ordered by this number
• container_id (optional) - id of the network ACL container

container_id is required while creating network ACLs. network_id parameter is not required when container_id is specified.

createNetwork

In VPC case, createNetwork is used to create a tier within VPC. Tier can be associated with a container during creation. If container_id is not specified default container will be used.

New parameters

• container_id (optional) - id of the network ACL container. Default NetworkACLContainer will be used when not specified. 

new API

updateNetworkACL

Updates an existing NetworkACL

Parameters:

• id (required) - Id of the network ACL
• trafficType (optional) - can be ingress/egress (defaulted to ingress if not specified)
• cidrlist (optional) - List of the coma separated CIDRs for the rule. If not specified, defaulted to 0.0.0.0/0
• startPort (optional)
• endPort (optional)
• protocol (optional). TCP/UDP/ICMP protocol types are supported
• icmpType (optional) - type of the icmp message being sent
• icmpCode (optional) - error code for this icmp message
• action (optional) - allow/deny
• number (optional) - rule number

createNetworkAclContainer

Created network ACL container

Parameters:

• name - Name of the Network Acl Container (required)
• description - Description of the Network ACL Container (required)

Response:

• name - Name of the Network Acl Container
• id - uuid of the Network Acl Container
• description - Description of the Network ACL Container

deleteNetworkAclContainer

Deletes network ACL conatiner

Parameters:

• id - uuid of the Network Acl Container (required)

Response:

• success - True if Network ACL container is successfully removed, false otherwise

listNetworkAclContainers

Containers can be listed by id or tier

Parameters:

• id - uuid of the Network Acl Container (optional)
• network_id - list by network_id (Tier) (optional)

Response:

• List of network ACL containers

replaceNetworkACLContainer

Assigns specified container to a tier (network)

Parameters:

• network_id - Id of the network (Tier) (required)
• container_id: Id of the network ACL container to be associated with the network (required)

Response:

• success -  True when container is successfully assigned to network, false otherwise

DB

New Tables

1. network_acl_container

• New Columns
  • id (long): auto-generated id
  • uuid (string): auto-generated uuid
  • name: name of the network acl container
  • description: network acl container description

Changes to existing tables

1. firewall_rules

• New Columns
  • action (String) - Action allow/deny
  • number (long) - Rule priority
  • container_id (long) - Id of the container, this ACL is part of

action, number, container_id are mandatory for rule with purpose NetworkACL.

2. networks

• New Columns
  • container_id (long) - network acl container associated with this Tier

Scripts

vpc_acl.sh will be modified to support ACL deny rules. iptables rules will ACCEPT or DROP based on the ACL action. iptables rules will added in the order of the number starting from the lowest.

UI

UI changes are required to:

• Support ACL action and number
• Create Network ACL Container
• Add/Remove ACLs to Network ACL Container
• Assign Network ACL Container to a Tier

Upgrade

For each tier, a new network acl container is created during the upgrade, All ACLs that were assigned to this tier, will be part of the newly created network acl container. If there are no ACLs for any tier, it'll be associated with the default container.

All existing rules in firewall_rules table of type NetworkACL will have action "allow". Rule number will be sequentially assigned for all rules in each tier.