Java IPAddressVO.getAllocatedToAccountId方法代码示例

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@DB
@Override
public IPAddressVO markIpAsUnavailable(final long addrId) {
    final IPAddressVO ip = _ipAddressDao.findById(addrId);

    if (ip.getAllocatedToAccountId() == null && ip.getAllocatedTime() == null) {
        s_logger.trace("Ip address id=" + addrId + " is already released");
        return ip;
    }

    if (ip.getState() != State.Releasing) {
        return Transaction.execute(new TransactionCallback<IPAddressVO>() {
            @Override
            public IPAddressVO doInTransaction(final TransactionStatus status) {
                if (updateIpResourceCount(ip)) {
                    _resourceLimitMgr.decrementResourceCount(_ipAddressDao.findById(addrId).getAllocatedToAccountId(), ResourceType.public_ip);
                }

                return _ipAddressDao.markAsUnavailable(addrId);
            }
        });
    }

    return ip;
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@Override
@ActionEvent(eventType = EventTypes.EVENT_NET_IP_UPDATE, eventDescription = "updating public ip address", async = true)
public IpAddress updateIP(final Long id, final String customId, final Boolean displayIp) {
    final Account caller = CallContext.current().getCallingAccount();
    final IPAddressVO ipVO = _ipAddressDao.findById(id);
    if (ipVO == null) {
        throw new InvalidParameterValueException("Unable to find ip address by id");
    }

    // verify permissions
    if (ipVO.getAllocatedToAccountId() != null) {
        _accountMgr.checkAccess(caller, null, true, ipVO);
    } else if (caller.getType() != Account.ACCOUNT_TYPE_ADMIN) {
        throw new PermissionDeniedException("Only Root admin can update non-allocated ip addresses");
    }

    if (customId != null) {
        ipVO.setUuid(customId);
    }

    if (displayIp != null) {
        ipVO.setDisplay(displayIp);
    }

    _ipAddressDao.update(id, ipVO);
    return _ipAddressDao.findById(id);
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@Override
public boolean applyStaticNatsForNetwork(final long networkId, final boolean continueOnError, final Account caller) {
    final List<IPAddressVO> ips = _ipAddressDao.listStaticNatPublicIps(networkId);
    if (ips.isEmpty()) {
        s_logger.debug("There are no static nat to apply for network id=" + networkId);
        return true;
    }

    if (caller != null) {
        _accountMgr.checkAccess(caller, null, true, ips.toArray(new IPAddressVO[ips.size()]));
    }

    final List<StaticNat> staticNats = new ArrayList<>();
    for (final IPAddressVO ip : ips) {
        // Get nic IP4 address
        //String dstIp = _networkModel.getIpInNetwork(ip.getAssociatedWithVmId(), networkId);
        final StaticNatImpl staticNat = new StaticNatImpl(ip.getAllocatedToAccountId(), ip.getAllocatedInDomainId(), networkId, ip.getId(), ip.getVmIp(), false);
        staticNats.add(staticNat);
    }

    try {
        if (!_ipAddrMgr.applyStaticNats(staticNats, continueOnError, false)) {
            return false;
        }
    } catch (final ResourceUnavailableException ex) {
        s_logger.warn("Failed to create static nat for network due to ", ex);
        return false;
    }

    return true;
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@DB
@Override
public IPAddressVO markIpAsUnavailable(final long addrId) {
    final IPAddressVO ip = _ipAddressDao.findById(addrId);

    if (ip.getAllocatedToAccountId() == null && ip.getAllocatedTime() == null) {
        s_logger.trace("Ip address id=" + addrId + " is already released");
        return ip;
    }

    if (ip.getState() != State.Releasing) {
        return Transaction.execute(new TransactionCallback<IPAddressVO>() {
            @Override
            public IPAddressVO doInTransaction(TransactionStatus status) {
                if (updateIpResourceCount(ip)) {
                    _resourceLimitMgr.decrementResourceCount(_ipAddressDao.findById(addrId).getAllocatedToAccountId(), ResourceType.public_ip);
                }

                // Save usage event
                if (ip.getAllocatedToAccountId() != null && ip.getAllocatedToAccountId() != Account.ACCOUNT_ID_SYSTEM) {
                    VlanVO vlan = _vlanDao.findById(ip.getVlanId());

                    String guestType = vlan.getVlanType().toString();
                    if (!isIpDedicated(ip)) {
                        String eventType = ip.isPortable() ? EventTypes.EVENT_PORTABLE_IP_RELEASE : EventTypes.EVENT_NET_IP_RELEASE;
                        UsageEventUtils.publishUsageEvent(eventType, ip.getAllocatedToAccountId(), ip.getDataCenterId(), addrId, ip.getAddress().addr(), ip.isSourceNat(),
                                guestType, ip.getSystem(), ip.getClass().getName(), ip.getUuid());
                    }
                }

                return _ipAddressDao.markAsUnavailable(addrId);
            }
        });
    }

    return ip;
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@Override
@ActionEvent(eventType = EventTypes.EVENT_NET_IP_UPDATE, eventDescription = "updating public ip address", async = true)
public IpAddress updateIP(Long id, String customId, Boolean displayIp) {
    Account caller = CallContext.current().getCallingAccount();
    IPAddressVO ipVO = _ipAddressDao.findById(id);
    if (ipVO == null) {
        throw new InvalidParameterValueException("Unable to find ip address by id");
    }

    // verify permissions
    if (ipVO.getAllocatedToAccountId() != null) {
        _accountMgr.checkAccess(caller, null, true, ipVO);
    } else if (caller.getType() != Account.ACCOUNT_TYPE_ADMIN) {
        throw new PermissionDeniedException("Only Root admin can update non-allocated ip addresses");
    }

    if (customId != null) {
        ipVO.setUuid(customId);
    }

    if (displayIp != null) {
        ipVO.setDisplay(displayIp);
    }

    _ipAddressDao.update(id, ipVO);
    return _ipAddressDao.findById(id);
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
private void applyStaticNatRuleForInlineLBRule(DataCenterVO zone, Network network, boolean revoked, String publicIp, String privateIp)
    throws ResourceUnavailableException {
    List<StaticNat> staticNats = new ArrayList<StaticNat>();
    IPAddressVO ipVO = _ipAddressDao.listByDcIdIpAddress(zone.getId(), publicIp).get(0);
    StaticNatImpl staticNat = new StaticNatImpl(ipVO.getAllocatedToAccountId(), ipVO.getAllocatedInDomainId(), network.getId(), ipVO.getId(), privateIp, revoked);
    staticNats.add(staticNat);
    StaticNatServiceProvider element = _networkMgr.getStaticNatProviderForNetwork(network);
    element.applyStaticNats(network, staticNats);
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@Override
public boolean applyStaticNatsForNetwork(long networkId, boolean continueOnError, Account caller) {
    List<IPAddressVO> ips = _ipAddressDao.listStaticNatPublicIps(networkId);
    if (ips.isEmpty()) {
        s_logger.debug("There are no static nat to apply for network id=" + networkId);
        return true;
    }

    if (caller != null) {
        _accountMgr.checkAccess(caller, null, true, ips.toArray(new IPAddressVO[ips.size()]));
    }

    List<StaticNat> staticNats = new ArrayList<StaticNat>();
    for (IPAddressVO ip : ips) {
        // Get nic IP4 address
        //String dstIp = _networkModel.getIpInNetwork(ip.getAssociatedWithVmId(), networkId);
        StaticNatImpl staticNat = new StaticNatImpl(ip.getAllocatedToAccountId(), ip.getAllocatedInDomainId(), networkId, ip.getId(), ip.getVmIp(), false);
        staticNats.add(staticNat);
    }

    try {
        if (!_ipAddrMgr.applyStaticNats(staticNats, continueOnError, false)) {
            return false;
        }
    } catch (ResourceUnavailableException ex) {
        s_logger.warn("Failed to create static nat for network due to ", ex);
        return false;
    }

    return true;
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@DB
private boolean releaseIpAddressInternal(final long ipAddressId) throws InsufficientAddressCapacityException {
    final Long userId = CallContext.current().getCallingUserId();
    final Account caller = CallContext.current().getCallingAccount();

    // Verify input parameters
    final IPAddressVO ipVO = _ipAddressDao.findById(ipAddressId);
    if (ipVO == null) {
        throw new InvalidParameterValueException("Unable to find ip address by id");
    }

    if (ipVO.getAllocatedTime() == null) {
        s_logger.debug("Ip Address id= " + ipAddressId + " is not allocated, so do nothing.");
        return true;
    }

    // verify permissions
    if (ipVO.getAllocatedToAccountId() != null) {
        _accountMgr.checkAccess(caller, null, true, ipVO);
    }

    if (ipVO.isSourceNat()) {
        throw new IllegalArgumentException("ip address is used for source nat purposes and can not be disassociated.");
    }

    final VlanVO vlan = _vlanDao.findById(ipVO.getVlanId());
    if (!vlan.getVlanType().equals(VlanType.VirtualNetwork)) {
        throw new IllegalArgumentException("only ip addresses that belong to a virtual network may be disassociated.");
    }

    // don't allow releasing system ip address
    if (ipVO.getSystem()) {
        final InvalidParameterValueException ex = new InvalidParameterValueException("Can't release system IP address with specified id");
        ex.addProxyObject(ipVO.getUuid(), "systemIpAddrId");
        throw ex;
    }

    final boolean success = _ipAddrMgr.disassociatePublicIpAddress(ipAddressId, userId, caller);

    if (success) {
        final Long networkId = ipVO.getAssociatedWithNetworkId();
        if (networkId != null) {
            final Network guestNetwork = getNetwork(networkId);
            final NetworkOffering offering = _entityMgr.findById(NetworkOffering.class, guestNetwork.getNetworkOfferingId());
            final Long vmId = ipVO.getAssociatedWithVmId();
            if (offering.getElasticIp() && vmId != null) {
                _rulesMgr.getSystemIpAndEnableStaticNatForVm(_userVmDao.findById(vmId), true);
                return true;
            }
        }
    } else {
        s_logger.warn("Failed to release public ip address id=" + ipAddressId);
    }
    return success;
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@Override
@DB
@ActionEvent(eventType = EventTypes.EVENT_NET_RULE_ADD, eventDescription = "creating static nat rule", create = true)
public StaticNatRule createStaticNatRule(final StaticNatRule rule, final boolean openFirewall) throws NetworkRuleConflictException {
    final Account caller = CallContext.current().getCallingAccount();

    final Long ipAddrId = rule.getSourceIpAddressId();

    final IPAddressVO ipAddress = _ipAddressDao.findById(ipAddrId);

    // Validate ip address
    if (ipAddress == null) {
        throw new InvalidParameterValueException("Unable to create static nat rule; ip id=" + ipAddrId + " doesn't exist in the system");
    } else if (ipAddress.isSourceNat() || !ipAddress.isOneToOneNat() || ipAddress.getAssociatedWithVmId() == null) {
        throw new NetworkRuleConflictException("Can't do static nat on ip address: " + ipAddress.getAddress());
    }

    _firewallMgr.validateFirewallRule(caller, ipAddress, rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), Purpose.StaticNat,
            FirewallRuleType.User, null, rule.getTrafficType());

    final Long networkId = ipAddress.getAssociatedWithNetworkId();
    final Long accountId = ipAddress.getAllocatedToAccountId();
    final Long domainId = ipAddress.getAllocatedInDomainId();

    _networkModel.checkIpForService(ipAddress, Service.StaticNat, null);

    final Network network = _networkModel.getNetwork(networkId);
    final NetworkOffering off = _entityMgr.findById(NetworkOffering.class, network.getNetworkOfferingId());
    if (off.getElasticIp()) {
        throw new InvalidParameterValueException("Can't create ip forwarding rules for the network where elasticIP service is enabled");
    }

    //String dstIp = _networkModel.getIpInNetwork(ipAddress.getAssociatedWithVmId(), networkId);
    final String dstIp = ipAddress.getVmIp();
    return Transaction.execute(new TransactionCallbackWithException<StaticNatRule, NetworkRuleConflictException>() {
        @Override
        public StaticNatRule doInTransaction(final TransactionStatus status) throws NetworkRuleConflictException {

            FirewallRuleVO newRule =
                    new FirewallRuleVO(rule.getXid(), rule.getSourceIpAddressId(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol().toLowerCase(),
                            networkId, accountId, domainId, rule.getPurpose(), null, null, null, null, null);

            newRule = _firewallDao.persist(newRule);

            // create firewallRule for 0.0.0.0/0 cidr
            if (openFirewall) {
                _firewallMgr.createRuleForAllCidrs(ipAddrId, caller, rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), null, null,
                        newRule.getId(), networkId);
            }

            try {
                _firewallMgr.detectRulesConflict(newRule);
                if (!_firewallDao.setStateToAdd(newRule)) {
                    throw new CloudRuntimeException("Unable to update the state to add for " + newRule);
                }
                CallContext.current().setEventDetails("Rule Id: " + newRule.getId());

                final StaticNatRule staticNatRule = new StaticNatRuleImpl(newRule, dstIp);

                return staticNatRule;
            } catch (final Exception e) {
                if (newRule != null) {
                    // no need to apply the rule as it wasn't programmed on the backend yet
                    _firewallMgr.revokeRelatedFirewallRule(newRule.getId(), false);
                    _firewallMgr.removeRule(newRule);
                }

                if (e instanceof NetworkRuleConflictException) {
                    throw (NetworkRuleConflictException) e;
                }
                throw new CloudRuntimeException("Unable to add static nat rule for the ip id=" + newRule.getSourceIpAddressId(), e);
            }
        }
    });
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@DB
protected FirewallRule createFirewallRule(final Long ipAddrId, final Account caller, final String xId, final Integer portStart, final Integer portEnd,
                                          final String protocol, final List<String> sourceCidrList, final Integer icmpCode, final Integer icmpType, final Long relatedRuleId,
                                          final FirewallRule.FirewallRuleType type,
                                          final Long networkId, final FirewallRule.TrafficType trafficType, final Boolean forDisplay) throws NetworkRuleConflictException {

    IPAddressVO ipAddress = null;
    if (ipAddrId != null) {
        // this for ingress firewall rule, for egress id is null
        ipAddress = _ipAddressDao.findById(ipAddrId);
        // Validate ip address
        if (ipAddress == null && type == FirewallRule.FirewallRuleType.User) {
            throw new InvalidParameterValueException("Unable to create firewall rule; " + "couldn't locate IP address by id in the system");
        }
        _networkModel.checkIpForService(ipAddress, Service.Firewall, null);
    }

    validateFirewallRule(caller, ipAddress, portStart, portEnd, protocol, Purpose.Firewall, type, networkId, trafficType);

    // icmp code and icmp type can't be passed in for any other protocol rather than icmp
    if (!protocol.equalsIgnoreCase(NetUtils.ICMP_PROTO) && (icmpCode != null || icmpType != null)) {
        throw new InvalidParameterValueException("Can specify icmpCode and icmpType for ICMP protocol only");
    }

    if (protocol.equalsIgnoreCase(NetUtils.ICMP_PROTO) && (portStart != null || portEnd != null)) {
        throw new InvalidParameterValueException("Can't specify start/end port when protocol is ICMP");
    }

    Long accountId = null;
    Long domainId = null;

    if (ipAddress != null) {
        //Ingress firewall rule
        accountId = ipAddress.getAllocatedToAccountId();
        domainId = ipAddress.getAllocatedInDomainId();
    } else if (networkId != null) {
        //egress firewall rule
        final Network network = _networkModel.getNetwork(networkId);
        accountId = network.getAccountId();
        domainId = network.getDomainId();
    }

    final Long accountIdFinal = accountId;
    final Long domainIdFinal = domainId;
    return Transaction.execute(new TransactionCallbackWithException<FirewallRuleVO, NetworkRuleConflictException>() {
        @Override
        public FirewallRuleVO doInTransaction(final TransactionStatus status) throws NetworkRuleConflictException {
            FirewallRuleVO newRule =
                    new FirewallRuleVO(xId, ipAddrId, portStart, portEnd, protocol.toLowerCase(), networkId, accountIdFinal, domainIdFinal, Purpose.Firewall,
                            sourceCidrList, icmpCode, icmpType, relatedRuleId, trafficType);
            newRule.setType(type);
            if (forDisplay != null) {
                newRule.setDisplay(forDisplay);
            }
            newRule = _firewallDao.persist(newRule);

            if (type == FirewallRuleType.User) {
                detectRulesConflict(newRule);
            }

            if (!_firewallDao.setStateToAdd(newRule)) {
                throw new CloudRuntimeException("Unable to update the state to add for " + newRule);
            }
            CallContext.current().setEventDetails("Rule Id: " + newRule.getId());

            return newRule;
        }
    });
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@DB
private boolean releaseIpAddressInternal(long ipAddressId) throws InsufficientAddressCapacityException {
    Long userId = CallContext.current().getCallingUserId();
    Account caller = CallContext.current().getCallingAccount();

    // Verify input parameters
    IPAddressVO ipVO = _ipAddressDao.findById(ipAddressId);
    if (ipVO == null) {
        throw new InvalidParameterValueException("Unable to find ip address by id");
    }

    if (ipVO.getAllocatedTime() == null) {
        s_logger.debug("Ip Address id= " + ipAddressId + " is not allocated, so do nothing.");
        return true;
    }

    // verify permissions
    if (ipVO.getAllocatedToAccountId() != null) {
        _accountMgr.checkAccess(caller, null, true, ipVO);
    }

    if (ipVO.isSourceNat()) {
        throw new IllegalArgumentException("ip address is used for source nat purposes and can not be disassociated.");
    }

    VlanVO vlan = _vlanDao.findById(ipVO.getVlanId());
    if (!vlan.getVlanType().equals(VlanType.VirtualNetwork)) {
        throw new IllegalArgumentException("only ip addresses that belong to a virtual network may be disassociated.");
    }

    // don't allow releasing system ip address
    if (ipVO.getSystem()) {
        throwInvalidIdException("Can't release system IP address with specified id", ipVO.getUuid(), "systemIpAddrId");
    }

    boolean success = _ipAddrMgr.disassociatePublicIpAddress(ipAddressId, userId, caller);

    if (success) {
        Long networkId = ipVO.getAssociatedWithNetworkId();
        if (networkId != null) {
            Network guestNetwork = getNetwork(networkId);
            NetworkOffering offering = _entityMgr.findById(NetworkOffering.class, guestNetwork.getNetworkOfferingId());
            Long vmId = ipVO.getAssociatedWithVmId();
            if (offering.getElasticIp() && vmId != null) {
                _rulesMgr.getSystemIpAndEnableStaticNatForVm(_userVmDao.findById(vmId), true);
                return true;
            }
        }
    } else {
        s_logger.warn("Failed to release public ip address id=" + ipAddressId);
    }
    return success;
}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@Override
@DB
@ActionEvent(eventType = EventTypes.EVENT_NET_RULE_ADD, eventDescription = "creating static nat rule", create = true)
public StaticNatRule createStaticNatRule(final StaticNatRule rule, final boolean openFirewall) throws NetworkRuleConflictException {
    final Account caller = CallContext.current().getCallingAccount();

    final Long ipAddrId = rule.getSourceIpAddressId();

    IPAddressVO ipAddress = _ipAddressDao.findById(ipAddrId);

    // Validate ip address
    if (ipAddress == null) {
        throw new InvalidParameterValueException("Unable to create static nat rule; ip id=" + ipAddrId + " doesn't exist in the system");
    } else if (ipAddress.isSourceNat() || !ipAddress.isOneToOneNat() || ipAddress.getAssociatedWithVmId() == null) {
        throw new NetworkRuleConflictException("Can't do static nat on ip address: " + ipAddress.getAddress());
    }

    _firewallMgr.validateFirewallRule(caller, ipAddress, rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), Purpose.StaticNat,
        FirewallRuleType.User, null, rule.getTrafficType());

    final Long networkId = ipAddress.getAssociatedWithNetworkId();
    final Long accountId = ipAddress.getAllocatedToAccountId();
    final Long domainId = ipAddress.getAllocatedInDomainId();

    _networkModel.checkIpForService(ipAddress, Service.StaticNat, null);

    Network network = _networkModel.getNetwork(networkId);
    NetworkOffering off = _entityMgr.findById(NetworkOffering.class, network.getNetworkOfferingId());
    if (off.getElasticIp()) {
        throw new InvalidParameterValueException("Can't create ip forwarding rules for the network where elasticIP service is enabled");
    }

    //String dstIp = _networkModel.getIpInNetwork(ipAddress.getAssociatedWithVmId(), networkId);
    final String dstIp = ipAddress.getVmIp();
    return Transaction.execute(new TransactionCallbackWithException<StaticNatRule, NetworkRuleConflictException>() {
        @Override
        public StaticNatRule doInTransaction(TransactionStatus status) throws NetworkRuleConflictException {

            FirewallRuleVO newRule =
                new FirewallRuleVO(rule.getXid(), rule.getSourceIpAddressId(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol().toLowerCase(),
                    networkId, accountId, domainId, rule.getPurpose(), null, null, null, null, null);

            newRule = _firewallDao.persist(newRule);

            // create firewallRule for 0.0.0.0/0 cidr
            if (openFirewall) {
                _firewallMgr.createRuleForAllCidrs(ipAddrId, caller, rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), null, null,
                    newRule.getId(), networkId);
            }

            try {
                _firewallMgr.detectRulesConflict(newRule);
                if (!_firewallDao.setStateToAdd(newRule)) {
                    throw new CloudRuntimeException("Unable to update the state to add for " + newRule);
                }
                CallContext.current().setEventDetails("Rule Id: " + newRule.getId());
                UsageEventUtils.publishUsageEvent(EventTypes.EVENT_NET_RULE_ADD, newRule.getAccountId(), 0, newRule.getId(), null, FirewallRule.class.getName(),
                    newRule.getUuid());

                StaticNatRule staticNatRule = new StaticNatRuleImpl(newRule, dstIp);

                return staticNatRule;
            } catch (Exception e) {
                if (newRule != null) {
                    // no need to apply the rule as it wasn't programmed on the backend yet
                    _firewallMgr.revokeRelatedFirewallRule(newRule.getId(), false);
                    _firewallMgr.removeRule(newRule);
                }

                if (e instanceof NetworkRuleConflictException) {
                    throw (NetworkRuleConflictException)e;
                }
                throw new CloudRuntimeException("Unable to add static nat rule for the ip id=" + newRule.getSourceIpAddressId(), e);
            }
        }
    });

}
 

import com.cloud.network.dao.IPAddressVO; //导入方法依赖的package包/类
@DB
   protected FirewallRule createFirewallRule(final Long ipAddrId, Account caller, final String xId, final Integer portStart, final Integer portEnd,
       final String protocol, final List<String> sourceCidrList, final List<String> destCidrList, final Integer icmpCode, final Integer icmpType, final Long relatedRuleId,
final FirewallRule.FirewallRuleType type,
           final Long networkId, final FirewallRule.TrafficType trafficType, final Boolean forDisplay) throws NetworkRuleConflictException {

       IPAddressVO ipAddress = null;
       if (ipAddrId != null) {
           // this for ingress firewall rule, for egress id is null
            ipAddress = _ipAddressDao.findById(ipAddrId);
       // Validate ip address
       if (ipAddress == null && type == FirewallRule.FirewallRuleType.User) {
               throw new InvalidParameterValueException("Unable to create firewall rule; " + "couldn't locate IP address by id in the system");
       }
       _networkModel.checkIpForService(ipAddress, Service.Firewall, null);
       }

       validateFirewallRule(caller, ipAddress, portStart, portEnd, protocol, Purpose.Firewall, type, networkId, trafficType);

       // icmp code and icmp type can't be passed in for any other protocol rather than icmp
       if (!protocol.equalsIgnoreCase(NetUtils.ICMP_PROTO) && (icmpCode != null || icmpType != null)) {
           throw new InvalidParameterValueException("Can specify icmpCode and icmpType for ICMP protocol only");
       }

       if (protocol.equalsIgnoreCase(NetUtils.ICMP_PROTO) && (portStart != null || portEnd != null)) {
           throw new InvalidParameterValueException("Can't specify start/end port when protocol is ICMP");
       }

       Long accountId = null;
       Long domainId = null;

       if (ipAddress != null) {
           //Ingress firewall rule
           accountId = ipAddress.getAllocatedToAccountId();
           domainId = ipAddress.getAllocatedInDomainId();
       } else if (networkId != null) {
           //egress firewall rule
               Network network = _networkModel.getNetwork(networkId);
               accountId = network.getAccountId();
               domainId = network.getDomainId();
       }

       final Long accountIdFinal = accountId;
       final Long domainIdFinal = domainId;
       return Transaction.execute(new TransactionCallbackWithException<FirewallRuleVO, NetworkRuleConflictException>() {
           @Override
           public FirewallRuleVO doInTransaction(TransactionStatus status) throws NetworkRuleConflictException {
               FirewallRuleVO newRule =
                       new FirewallRuleVO(xId, ipAddrId, portStart, portEnd, protocol.toLowerCase(), networkId, accountIdFinal, domainIdFinal, Purpose.Firewall,
                               sourceCidrList, destCidrList, icmpCode, icmpType, relatedRuleId, trafficType);
               newRule.setType(type);
               if (forDisplay != null) {
                   newRule.setDisplay(forDisplay);
               }
               newRule = _firewallDao.persist(newRule);

               if (type == FirewallRuleType.User)
                   detectRulesConflict(newRule);

               if (!_firewallDao.setStateToAdd(newRule)) {
                   throw new CloudRuntimeException("Unable to update the state to add for " + newRule);
               }
               CallContext.current().setEventDetails("Rule Id: " + newRule.getId());

               return newRule;
           }
       });
   }