restrict network creation in transit domain

plugin/driver/driver.go

@@ -137,6 +137,11 @@ func (driver *driver) createNetwork(w http.ResponseWriter, r *http.Request) {
 	}
 	DomainCreate(domainid.(string))
 
+	if CheckExternalConnectivity(domainid.(string)) {
+		errorResponse(w, fmt.Sprintf("Non-external network cannot be created in transit domain."))
+		return
+	}
+
 	gatewayip := create.IPv4Data[0].Gateway.IP.String()
 	neName := create.Options[netlabel.GenericData].(map[string]interface{})["bridge"]
 

plugin/driver/pg_helper.go

@@ -428,7 +428,7 @@ func CheckNeExists(ne_name, domain string) bool {
 
 	url := "/0/connectivity/domain/" + domain + "/ne?configonly=true"
 
-	body, _ := RestCall("GET", url+"?configonly=true", nil)
+	body, _ := RestCall("GET", url, nil)
 	var domain_data map[string]interface{}
 	err := json.Unmarshal([]byte(body), &domain_data)
 	if err != nil {
@@ -443,3 +443,23 @@ func CheckNeExists(ne_name, domain string) bool {
 
 	return false
 }
+
+func CheckExternalConnectivity(domain string) bool {
+
+	url := "/0/connectivity/domain_prop/" + domain + "/ne?configonly=true"
+
+	body, _ := RestCall("GET", url, nil)
+	var domain_data map[string]interface{}
+	err := json.Unmarshal([]byte(body), &domain_data)
+	if err != nil {
+		panic(err)
+	}
+
+	for key, _ := range domain_data {
+		if key == "external_connectivity_enable" {
+			return true
+		}
+	}
+
+	return false
+}

plugin/driver/utils.go

@@ -25,7 +25,6 @@ import (
 )
 
 // Response Functions
-
 func notFound(w http.ResponseWriter, r *http.Request) {
 	Log.Warningf("[plugin] Not found: %+v", r)
 	http.NotFound(w, r)
@@ -54,7 +53,6 @@ func emptyResponse(w http.ResponseWriter) {
 }
 
 // Helper Functions
-
 func vethPair(suffix string) *netlink.Veth {
 	return &netlink.Veth{
 		LinkAttrs: netlink.LinkAttrs{Name: "tap" + suffix},