// IngressRules returns the port ranges opened for the whole environment.
// Must only be used if the environment was setup with the
// FwGlobal firewall mode.
2931
func (c *rackspaceFirewaller) IngressRules(ctx context.ProviderCallContext) ([]network.IngressRule, error) {
	return nil, errors.NotSupportedf("Ports")
}
865500
func (lxd *lxdInstance) IngressRules(ctx context.ProviderCallContext, machineId string) ([]network.IngressRule, error) {
	return nil, fmt.Errorf("not implemented")
}
1140970
func Convert_v1beta1_IngressRuleValue_To_networking_IngressRuleValue(in *v1beta1.IngressRuleValue, out *networking.IngressRuleValue, s conversion.Scope) error {
	return autoConvert_v1beta1_IngressRuleValue_To_networking_IngressRuleValue(in, out, s)
}
1171072
func (o *Enterprise) IngressQOSPolicies(info *bambou.FetchingInfo) (IngressQOSPoliciesList, *bambou.Error) {

	var list IngressQOSPoliciesList
	err := bambou.CurrentSession().FetchChildren(o, IngressQOSPolicyIdentity, &list, info)
	return list, err
}
38987
func (c *rackspaceFirewaller) CloseInstancePorts(ctx context.ProviderCallContext, inst instances.Instance, machineId string, rules []network.IngressRule) error {
	return c.changeIngressRules(ctx, inst, false, rules)
}
173313
func (c *clientWrapper) GetIngresses() []*extensionsv1beta1.Ingress {
	var result []*extensionsv1beta1.Ingress
	for ns, factory := range c.factories {
		ings, err := factory.Extensions().V1beta1().Ingresses().Lister().List(c.ingressLabelSelector)
		if err != nil {
			log.Errorf("Failed to list ingresses in namespace %s: %s", ns, err)
		}
		result = append(result, ings...)
	}
	return result
}
637769
func (inst *azureInstance) OpenPorts(ctx context.ProviderCallContext, machineId string, rules []jujunetwork.IngressRule) error {
	nsgClient := network.SecurityGroupsClient{inst.env.network}
	securityRuleClient := network.SecurityRulesClient{inst.env.network}
	primaryNetworkAddress, err := inst.primaryNetworkAddress()
	if err != nil {
		return errors.Trace(err)
	}

	securityGroupName := internalSecurityGroupName
	sdkCtx := stdcontext.Background()
	nsg, err := nsgClient.Get(sdkCtx, inst.env.resourceGroup, securityGroupName, "")
	if err != nil {
		return errorutils.HandleCredentialError(errors.Annotate(err, "querying network security group"), ctx)
	}

	var securityRules []network.SecurityRule
	if nsg.SecurityRules != nil {
		securityRules = *nsg.SecurityRules
	} else {
		nsg.SecurityRules = &securityRules
	}

	// Create rules one at a time; this is necessary to avoid trampling
	// on changes made by the provisioner. We still record rules in the
	// NSG in memory, so we can easily tell which priorities are available.
	vmName := resourceName(names.NewMachineTag(machineId))
	prefix := instanceNetworkSecurityRulePrefix(instance.Id(vmName))

	singleSourceIngressRules := explodeIngressRules(rules)
	for _, rule := range singleSourceIngressRules {
		ruleName := securityRuleName(prefix, rule)

		// Check if the rule already exists; OpenPorts must be idempotent.
		var found bool
		for _, rule := range securityRules {
			if to.String(rule.Name) == ruleName {
				found = true
				break
			}
		}
		if found {
			logger.Debugf("security rule %q already exists", ruleName)
			continue
		}
		logger.Debugf("creating security rule %q", ruleName)

		priority, err := nextSecurityRulePriority(nsg, securityRuleInternalMax+1, securityRuleMax)
		if err != nil {
			return errors.Annotatef(err, "getting security rule priority for %q", rule)
		}

		var protocol network.SecurityRuleProtocol
		switch rule.Protocol {
		case "tcp":
			protocol = network.SecurityRuleProtocolTCP
		case "udp":
			protocol = network.SecurityRuleProtocolUDP
		default:
			return errors.Errorf("invalid protocol %q", rule.Protocol)
		}

		var portRange string
		if rule.FromPort != rule.ToPort {
			portRange = fmt.Sprintf("%d-%d", rule.FromPort, rule.ToPort)
		} else {
			portRange = fmt.Sprint(rule.FromPort)
		}

		// rule has a single source CIDR
		from := rule.SourceCIDRs[0]
		securityRule := network.SecurityRule{
			SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
				Description:              to.StringPtr(rule.String()),
				Protocol:                 protocol,
				SourcePortRange:          to.StringPtr("*"),
				DestinationPortRange:     to.StringPtr(portRange),
				SourceAddressPrefix:      to.StringPtr(from),
				DestinationAddressPrefix: to.StringPtr(primaryNetworkAddress.Value),
				Access:                   network.SecurityRuleAccessAllow,
				Priority:                 to.Int32Ptr(priority),
				Direction:                network.SecurityRuleDirectionInbound,
			},
		}
		_, err = securityRuleClient.CreateOrUpdate(
			sdkCtx,
			inst.env.resourceGroup, securityGroupName, ruleName, securityRule,
		)
		if err != nil {
			return errorutils.HandleCredentialError(errors.Annotatef(err, "creating security rule for %q", ruleName), ctx)
		}
		securityRules = append(securityRules, securityRule)
	}
	return nil
}
1354527
func (c *legacyNovaFirewaller) IngressRules(ctx context.ProviderCallContext) ([]network.IngressRule, error) {
	return c.ingressRules(ctx, c.ingressRulesInGroup)
}
1136287
func (f Firewall) getDefaultIngressRules(apiPort int) []network.IngressRule {
	return []network.IngressRule{
		{
			PortRange: corenetwork.PortRange{
				FromPort: 22,
				ToPort:   22,
				Protocol: "tcp",
			},
			SourceCIDRs: []string{
				"0.0.0.0/0",
			},
		},
		{
			PortRange: corenetwork.PortRange{
				FromPort: 3389,
				ToPort:   3389,
				Protocol: "tcp",
			},
			SourceCIDRs: []string{
				"0.0.0.0/0",
			},
		},
		{
			PortRange: corenetwork.PortRange{
				FromPort: apiPort,
				ToPort:   apiPort,
				Protocol: "tcp",
			},
			SourceCIDRs: []string{
				"0.0.0.0/0",
			},
		},
		{
			PortRange: corenetwork.PortRange{
				FromPort: controller.DefaultStatePort,
				ToPort:   controller.DefaultStatePort,
				Protocol: "tcp",
			},
			SourceCIDRs: []string{
				"0.0.0.0/0",
			},
		},
	}
}
1048893
func (inst *environInstance) OpenPorts(ctx context.ProviderCallContext, machineID string, rules []network.IngressRule) error {
	return inst.changeIngressRules(ctx, true, rules)
}
627193
func (inst *environInstance) ClosePorts(ctx context.ProviderCallContext, machineID string, rules []network.IngressRule) error {
	return inst.changeIngressRules(ctx, false, rules)
}
7039
func (f Firewall) IngressRules(ctx context.ProviderCallContext) ([]network.IngressRule, error) {
	return f.GlobalIngressRules(ctx)
}
713314
func (c *neutronFirewaller) OpenPorts(ctx context.ProviderCallContext, rules []network.IngressRule) error {
	err := c.openPorts(ctx, c.openPortsInGroup, rules)
	if err != nil {
		common.HandleCredentialError(IsAuthorisationFailure, err, ctx)
		return errors.Trace(err)
	}
	return nil
}
1332373
func (v *version) Ingresses() IngressInformer {
	return &ingressInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
}
323976
func (f Firewall) GlobalIngressRules(ctx context.ProviderCallContext) ([]network.IngressRule, error) {
	seclist := f.globalGroupName()
	return f.getIngressRules(ctx, f.client.ComposeName(seclist))
}
57722
func (mi *maas2Instance) OpenPorts(ctx context.ProviderCallContext, machineId string, rules []network.IngressRule) error {
	logger.Debugf("unimplemented OpenPorts() called")
	return nil
}
437382
func (inst *environInstance) IngressRules(ctx context.ProviderCallContext, machineID string) ([]network.IngressRule, error) {
	_, client, err := inst.getInstanceConfigurator(ctx)
	if err != nil {
		return nil, errors.Trace(err)
	}
	return client.FindIngressRules()
}