From 44ef7ec0590116e8478125dc564f202baaf3f517 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Mon, 30 Jan 2023 13:06:38 +0100
Subject: [PATCH 1/5] server: fix cannot get systemvm ips in dedicated ranges
 (Issue 6698)

---
 .../java/com/cloud/api/ApiResponseHelper.java |   2 +-
 .../ConfigurationManagerImpl.java             |   1 -
 .../cloud/network/IpAddressManagerImpl.java   | 114 +++++++++---------
 ui/public/locales/en.json                     |   1 +
 .../views/infra/network/IpRangesTabPublic.vue |   6 +-
 5 files changed, 65 insertions(+), 59 deletions(-)

diff --git a/server/src/main/java/com/cloud/api/ApiResponseHelper.java b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
index 437ff05d28d0..6c9229bc6ec2 100644
--- a/server/src/main/java/com/cloud/api/ApiResponseHelper.java
+++ b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
@@ -855,7 +855,7 @@ public VlanIpRangeResponse createVlanIpRangeResponse(Class<? extends VlanIpRange
                     Long networkId = vlan.getNetworkId();
                     if (networkId != null) {
                         Network network = _ntwkModel.getNetwork(networkId);
-                        if (network != null) {
+                        if (network != null && TrafficType.Guest.equals(network.getTrafficType())) {
                             Long accountId = network.getAccountId();
                             populateAccount(vlanResponse, accountId);
                             populateDomain(vlanResponse, ApiDBUtils.findAccountById(accountId).getDomainId());
diff --git a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
index 5e684a07ad6d..aab19f5b4e5e 100644
--- a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
@@ -7164,7 +7164,6 @@ public Account getVlanAccount(final long vlanId) {
     @Override
     public Domain getVlanDomain(long vlanId) {
         Vlan vlan = _vlanDao.findById(vlanId);
-        Long domainId = null;
 
         // if vlan is Virtual Domain specific, get vlan information from the
         // accountVlanMap; otherwise get account information
diff --git a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
index f6df85f23085..287244ebe5c4 100644
--- a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
@@ -492,9 +492,8 @@ public boolean configure(String name, Map<String, Object> params) {
         AssignIpAddressSearch.and("dc", AssignIpAddressSearch.entity().getDataCenterId(), Op.EQ);
         AssignIpAddressSearch.and("allocated", AssignIpAddressSearch.entity().getAllocatedTime(), Op.NULL);
         AssignIpAddressSearch.and("vlanId", AssignIpAddressSearch.entity().getVlanId(), Op.IN);
-        if (SystemVmPublicIpReservationModeStrictness.value()) {
-            AssignIpAddressSearch.and("forSystemVms", AssignIpAddressSearch.entity().isForSystemVms(), Op.EQ);
-        }
+        AssignIpAddressSearch.and("forSystemVms", AssignIpAddressSearch.entity().isForSystemVms(), Op.EQ);
+
         SearchBuilder<VlanVO> vlanSearch = _vlanDao.createSearchBuilder();
         vlanSearch.and("type", vlanSearch.entity().getVlanType(), Op.EQ);
         vlanSearch.and("networkId", vlanSearch.entity().getNetworkId(), Op.EQ);
@@ -840,49 +839,6 @@ public List<IPAddressVO> doInTransaction(TransactionStatus status) throws Insuff
                     errorMessage.append(" zone id=" + dcId);
                 }
 
-                // If owner has dedicated Public IP ranges, fetch IP from the dedicated range
-                // Otherwise fetch IP from the system pool
-                Network network = _networksDao.findById(guestNetworkId);
-                //Checking if network is null in the case of system VM's. At the time of allocation of IP address to systemVm, no network is present.
-                if(network == null || !(network.getGuestType() == GuestType.Shared && zone.getNetworkType() == NetworkType.Advanced)) {
-                    List<AccountVlanMapVO> maps = _accountVlanMapDao.listAccountVlanMapsByAccount(owner.getId());
-                    for (AccountVlanMapVO map : maps) {
-                        if (vlanDbIds == null || vlanDbIds.contains(map.getVlanDbId()))
-                            dedicatedVlanDbIds.add(map.getVlanDbId());
-                    }
-                }
-                List<DomainVlanMapVO> domainMaps = _domainVlanMapDao.listDomainVlanMapsByDomain(owner.getDomainId());
-                for (DomainVlanMapVO map : domainMaps) {
-                    if (vlanDbIds == null || vlanDbIds.contains(map.getVlanDbId()))
-                        dedicatedVlanDbIds.add(map.getVlanDbId());
-                }
-                List<VlanVO> nonDedicatedVlans = _vlanDao.listZoneWideNonDedicatedVlans(dcId);
-                for (VlanVO nonDedicatedVlan : nonDedicatedVlans) {
-                    if (vlanDbIds == null || vlanDbIds.contains(nonDedicatedVlan.getId()))
-                        nonDedicatedVlanDbIds.add(nonDedicatedVlan.getId());
-                }
-
-                if (vlanUse == VlanType.VirtualNetwork) {
-                    if (!dedicatedVlanDbIds.isEmpty()) {
-                        fetchFromDedicatedRange = true;
-                        sc.setParameters("vlanId", dedicatedVlanDbIds.toArray());
-                        errorMessage.append(", vlanId id=" + Arrays.toString(dedicatedVlanDbIds.toArray()));
-                    } else if (!nonDedicatedVlanDbIds.isEmpty()) {
-                        sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
-                        errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
-                    } else {
-                        if (podId != null) {
-                            InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
-                            ex.addProxyObject(ApiDBUtils.findPodById(podId).getUuid());
-                            throw ex;
-                        }
-                        s_logger.warn(errorMessage.toString());
-                        InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", DataCenter.class, dcId);
-                        ex.addProxyObject(ApiDBUtils.findZoneById(dcId).getUuid());
-                        throw ex;
-                    }
-                }
-
                 sc.setParameters("dc", dcId);
 
                 // for direct network take ip addresses only from the vlans belonging to the network
@@ -895,6 +851,8 @@ public List<IPAddressVO> doInTransaction(TransactionStatus status) throws Insuff
                     errorMessage.append(", requested gateway=" + requestedGateway);
                 }
                 sc.setJoinParameters("vlan", "type", vlanUse);
+
+                Network network = _networksDao.findById(guestNetworkId);
                 String routerIpAddress = null;
                 if (network != null) {
                     NetworkDetailVO routerIpDetail = _networkDetailsDao.findDetail(network.getId(), ApiConstants.ROUTER_IP);
@@ -909,18 +867,66 @@ public List<IPAddressVO> doInTransaction(TransactionStatus status) throws Insuff
 
                 boolean ascOrder = ! forSystemVms;
                 Filter filter = new Filter(IPAddressVO.class, "forSystemVms", ascOrder, 0l, 1l);
-                if (SystemVmPublicIpReservationModeStrictness.value()) {
-                    sc.setParameters("forSystemVms", forSystemVms);
-                }
 
                 filter.addOrderBy(IPAddressVO.class,"vlanId", true);
 
-                List<IPAddressVO> addrs;
+                List<IPAddressVO> addrs = new ArrayList<>();
 
-                if (lockOneRow) {
-                    addrs = _ipAddressDao.lockRows(sc, filter, true);
-                } else {
-                    addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
+                if (forSystemVms) {
+                    // Get Public IPs for system vms in dedicated ranges
+                    sc.setParameters("forSystemVms", true);
+                    if (lockOneRow) {
+                        addrs = _ipAddressDao.lockRows(sc, filter, true);
+                    } else {
+                        addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
+                    }
+                }
+                if (vlanUse == VlanType.VirtualNetwork && (!lockOneRow || (lockOneRow && addrs.size() == 0)) &&
+                        !(forSystemVms && SystemVmPublicIpReservationModeStrictness.value())) {
+                    sc.setParameters("forSystemVms", false);
+                    // If owner has dedicated Public IP ranges, fetch IP from the dedicated range
+                    // Otherwise fetch IP from the system pool
+                    // Checking if network is null in the case of system VM's. At the time of allocation of IP address to systemVm, no network is present.
+                    if (network == null || !(network.getGuestType() == GuestType.Shared && zone.getNetworkType() == NetworkType.Advanced)) {
+                        List<AccountVlanMapVO> maps = _accountVlanMapDao.listAccountVlanMapsByAccount(owner.getId());
+                        for (AccountVlanMapVO map : maps) {
+                            if (vlanDbIds == null || vlanDbIds.contains(map.getVlanDbId()))
+                                dedicatedVlanDbIds.add(map.getVlanDbId());
+                        }
+                    }
+                    List<DomainVlanMapVO> domainMaps = _domainVlanMapDao.listDomainVlanMapsByDomain(owner.getDomainId());
+                    for (DomainVlanMapVO map : domainMaps) {
+                        if (vlanDbIds == null || vlanDbIds.contains(map.getVlanDbId()))
+                            dedicatedVlanDbIds.add(map.getVlanDbId());
+                    }
+                    List<VlanVO> nonDedicatedVlans = _vlanDao.listZoneWideNonDedicatedVlans(dcId);
+                    for (VlanVO nonDedicatedVlan : nonDedicatedVlans) {
+                        if (vlanDbIds == null || vlanDbIds.contains(nonDedicatedVlan.getId()))
+                            nonDedicatedVlanDbIds.add(nonDedicatedVlan.getId());
+                    }
+                    if (!dedicatedVlanDbIds.isEmpty()) {
+                        fetchFromDedicatedRange = true;
+                        sc.setParameters("vlanId", dedicatedVlanDbIds.toArray());
+                        errorMessage.append(", vlanId id=" + Arrays.toString(dedicatedVlanDbIds.toArray()));
+                    } else if (!nonDedicatedVlanDbIds.isEmpty()) {
+                        sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
+                        errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
+                    } else {
+                        if (podId != null) {
+                            InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
+                            ex.addProxyObject(ApiDBUtils.findPodById(podId).getUuid());
+                            throw ex;
+                        }
+                        s_logger.warn(errorMessage.toString());
+                        InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", DataCenter.class, dcId);
+                        ex.addProxyObject(ApiDBUtils.findZoneById(dcId).getUuid());
+                        throw ex;
+                    }
+                    if (lockOneRow) {
+                        addrs = _ipAddressDao.lockRows(sc, filter, true);
+                    } else {
+                        addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
+                    }
                 }
 
                 // If all the dedicated IPs of the owner are in use fetch an IP from the system pool
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index a4d0d0b6197c..6883ae9789c5 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -1739,6 +1739,7 @@
 "label.suspend.project": "Suspend project",
 "label.switch.type": "Switch type",
 "label.sync.storage": "Sync storage pool",
+"label.system.ip.pool": "System Pool",
 "label.system.offering": "System offering",
 "label.system.offerings": "System offerings",
 "label.system.service.offering": "System service offering",
diff --git a/ui/src/views/infra/network/IpRangesTabPublic.vue b/ui/src/views/infra/network/IpRangesTabPublic.vue
index 247a8faf0d41..d7f743fda138 100644
--- a/ui/src/views/infra/network/IpRangesTabPublic.vue
+++ b/ui/src/views/infra/network/IpRangesTabPublic.vue
@@ -47,21 +47,21 @@
         {{ record.endip || record.endipv6 }}
       </template>
       <template #account="{record}" v-if="!basicGuestNetwork">
-        <a-button @click="() => handleOpenAccountModal(record)">{{ `[${record.domain}] ${record.account === undefined ? '' : record.account}` }}</a-button>
+        <a-button @click="() => handleOpenAccountModal(record)">{{ record.domain === undefined ? `${$t('label.system.ip.pool')}` : `[ ${record.domain}] ${record.account === undefined ? '' : record.account}` }}</a-button>
       </template>
       <template #actions="{record}">
         <div
           class="actions"
           style="text-align: right" >
           <tooltip-button
-            v-if="record.account === 'system' && !basicGuestNetwork && record.gateway && !record.ip6gateway"
+            v-if="!record.domain && !basicGuestNetwork && record.gateway && !record.ip6gateway"
             tooltipPlacement="bottom"
             :tooltip="$t('label.add.account')"
             icon="user-add-outlined"
             @onClick="() => handleOpenAddAccountModal(record)"
             :disabled="!('dedicatePublicIpRange' in $store.getters.apis)" />
           <tooltip-button
-            v-if="record.account !== 'system' && !basicGuestNetwork"
+            v-if="record.domain && !basicGuestNetwork"
             tooltipPlacement="bottom"
             :tooltip="$t('label.release.account')"
             icon="user-delete-outlined"

From 37d28d491b07464b9a0776a1e91307697eb403d4 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Mon, 30 Jan 2023 13:07:05 +0100
Subject: [PATCH 2/5] server: refactoring fetchNewPublicIp and
 listAvailablePublicIps (issue 6698)

---
 .../cloud/network/IpAddressManagerImpl.java   | 284 +++++++++---------
 1 file changed, 141 insertions(+), 143 deletions(-)

diff --git a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
index 287244ebe5c4..d7758ef1771d 100644
--- a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
@@ -330,19 +330,10 @@ private List<Long> getIpv6SupportingVlanRangeIds(long dcId) throws InsufficientA
     @DB
     private IPAddressVO assignAndAllocateIpAddressEntry(final Account owner, final VlanType vlanUse, final Long guestNetworkId,
                                                         final boolean sourceNat, final boolean allocate, final boolean isSystem,
-                                                        final Long vpcId, final Boolean displayIp, final boolean fetchFromDedicatedRange,
+                                                        final Long vpcId, final Boolean displayIp,
                                                         final List<IPAddressVO> addressVOS) throws CloudRuntimeException {
         return Transaction.execute((TransactionCallbackWithException<IPAddressVO, CloudRuntimeException>) status -> {
             IPAddressVO finalAddress = null;
-            if (!fetchFromDedicatedRange && VlanType.VirtualNetwork.equals(vlanUse)) {
-                // Check that the maximum number of public IPs for the given accountId will not be exceeded
-                try {
-                    _resourceLimitMgr.checkResourceLimit(owner, ResourceType.public_ip);
-                } catch (ResourceAllocationException ex) {
-                    s_logger.warn("Failed to allocate resource of type " + ex.getResourceType() + " for account " + owner);
-                    throw new AccountLimitException("Maximum number of public IP addresses for account: " + owner.getAccountName() + " has been exceeded.");
-                }
-            }
 
             for (IPAddressVO possibleAddr : addressVOS) {
                 if (possibleAddr.getState() != State.Free) {
@@ -809,6 +800,10 @@ public PublicIp fetchNewPublicIp(final long dcId, final Long podId, final List<L
                     throws InsufficientAddressCapacityException {
         List<IPAddressVO> addrs = listAvailablePublicIps(dcId, podId, vlanDbIds, owner, vlanUse, guestNetworkId, sourceNat, assign, allocate, requestedIp, requestedGateway, isSystem, vpcId, displayIp, forSystemVms, true);
         IPAddressVO addr = addrs.get(0);
+        if (assign) {
+            addr = assignAndAllocateIpAddressEntry(owner, vlanUse, guestNetworkId, sourceNat, allocate,
+                    isSystem,vpcId, displayIp, addrs);
+        }
         if (vlanUse == VlanType.VirtualNetwork) {
             _firewallMgr.addSystemFirewallRules(addr, owner);
         }
@@ -820,154 +815,157 @@ public PublicIp fetchNewPublicIp(final long dcId, final Long podId, final List<L
     public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podId, final List<Long> vlanDbIds, final Account owner, final VlanType vlanUse, final Long guestNetworkId,
                                                     final boolean sourceNat, final boolean assign, final boolean allocate, final String requestedIp, final String requestedGateway, final boolean isSystem,
                                                     final Long vpcId, final Boolean displayIp, final boolean forSystemVms, final boolean lockOneRow) throws InsufficientAddressCapacityException {
-        return Transaction.execute(new TransactionCallbackWithException<List<IPAddressVO>, InsufficientAddressCapacityException>() {
-            @Override
-            public List<IPAddressVO> doInTransaction(TransactionStatus status) throws InsufficientAddressCapacityException {
-                StringBuilder errorMessage = new StringBuilder("Unable to get ip address in ");
-                boolean fetchFromDedicatedRange = false;
-                List<Long> dedicatedVlanDbIds = new ArrayList<Long>();
-                List<Long> nonDedicatedVlanDbIds = new ArrayList<Long>();
-                DataCenter zone = _entityMgr.findById(DataCenter.class, dcId);
-
-                SearchCriteria<IPAddressVO> sc = null;
-                if (podId != null) {
-                    sc = AssignIpAddressFromPodVlanSearch.create();
-                    sc.setJoinParameters("podVlanMapSB", "podId", podId);
-                    errorMessage.append(" pod id=" + podId);
-                } else {
-                    sc = AssignIpAddressSearch.create();
-                    errorMessage.append(" zone id=" + dcId);
-                }
 
-                sc.setParameters("dc", dcId);
+        StringBuilder errorMessage = new StringBuilder("Unable to get ip address in ");
+        boolean fetchFromDedicatedRange = false;
+        List<Long> dedicatedVlanDbIds = new ArrayList<Long>();
+        List<Long> nonDedicatedVlanDbIds = new ArrayList<Long>();
+        DataCenter zone = _entityMgr.findById(DataCenter.class, dcId);
+
+        SearchCriteria<IPAddressVO> sc = null;
+        if (podId != null) {
+            sc = AssignIpAddressFromPodVlanSearch.create();
+            sc.setJoinParameters("podVlanMapSB", "podId", podId);
+            errorMessage.append(" pod id=" + podId);
+        } else {
+            sc = AssignIpAddressSearch.create();
+            errorMessage.append(" zone id=" + dcId);
+        }
 
-                // for direct network take ip addresses only from the vlans belonging to the network
-                if (vlanUse == VlanType.DirectAttached) {
-                    sc.setJoinParameters("vlan", "networkId", guestNetworkId);
-                    errorMessage.append(", network id=" + guestNetworkId);
-                }
-                if (requestedGateway != null) {
-                    sc.setJoinParameters("vlan", "vlanGateway", requestedGateway);
-                    errorMessage.append(", requested gateway=" + requestedGateway);
-                }
-                sc.setJoinParameters("vlan", "type", vlanUse);
+        sc.setParameters("dc", dcId);
 
-                Network network = _networksDao.findById(guestNetworkId);
-                String routerIpAddress = null;
-                if (network != null) {
-                    NetworkDetailVO routerIpDetail = _networkDetailsDao.findDetail(network.getId(), ApiConstants.ROUTER_IP);
-                    routerIpAddress = routerIpDetail != null ? routerIpDetail.getValue() : null;
-                }
-                if (requestedIp != null) {
-                    sc.addAnd("address", SearchCriteria.Op.EQ, requestedIp);
-                    errorMessage.append(": requested ip " + requestedIp + " is not available");
-                } else if (routerIpAddress != null) {
-                    sc.addAnd("address", Op.NEQ, routerIpAddress);
-                }
+        // for direct network take ip addresses only from the vlans belonging to the network
+        if (vlanUse == VlanType.DirectAttached) {
+            sc.setJoinParameters("vlan", "networkId", guestNetworkId);
+            errorMessage.append(", network id=" + guestNetworkId);
+        }
+        if (requestedGateway != null) {
+            sc.setJoinParameters("vlan", "vlanGateway", requestedGateway);
+            errorMessage.append(", requested gateway=" + requestedGateway);
+        }
+        sc.setJoinParameters("vlan", "type", vlanUse);
 
-                boolean ascOrder = ! forSystemVms;
-                Filter filter = new Filter(IPAddressVO.class, "forSystemVms", ascOrder, 0l, 1l);
+        Network network = _networksDao.findById(guestNetworkId);
+        String routerIpAddress = null;
+        if (network != null) {
+            NetworkDetailVO routerIpDetail = _networkDetailsDao.findDetail(network.getId(), ApiConstants.ROUTER_IP);
+            routerIpAddress = routerIpDetail != null ? routerIpDetail.getValue() : null;
+        }
+        if (requestedIp != null) {
+            sc.addAnd("address", SearchCriteria.Op.EQ, requestedIp);
+            errorMessage.append(": requested ip " + requestedIp + " is not available");
+        } else if (routerIpAddress != null) {
+            sc.addAnd("address", Op.NEQ, routerIpAddress);
+        }
 
-                filter.addOrderBy(IPAddressVO.class,"vlanId", true);
+        boolean ascOrder = ! forSystemVms;
+        Filter filter = new Filter(IPAddressVO.class, "forSystemVms", ascOrder, 0l, 1l);
 
-                List<IPAddressVO> addrs = new ArrayList<>();
+        filter.addOrderBy(IPAddressVO.class,"vlanId", true);
 
-                if (forSystemVms) {
-                    // Get Public IPs for system vms in dedicated ranges
-                    sc.setParameters("forSystemVms", true);
-                    if (lockOneRow) {
-                        addrs = _ipAddressDao.lockRows(sc, filter, true);
-                    } else {
-                        addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
-                    }
-                }
-                if (vlanUse == VlanType.VirtualNetwork && (!lockOneRow || (lockOneRow && addrs.size() == 0)) &&
-                        !(forSystemVms && SystemVmPublicIpReservationModeStrictness.value())) {
-                    sc.setParameters("forSystemVms", false);
-                    // If owner has dedicated Public IP ranges, fetch IP from the dedicated range
-                    // Otherwise fetch IP from the system pool
-                    // Checking if network is null in the case of system VM's. At the time of allocation of IP address to systemVm, no network is present.
-                    if (network == null || !(network.getGuestType() == GuestType.Shared && zone.getNetworkType() == NetworkType.Advanced)) {
-                        List<AccountVlanMapVO> maps = _accountVlanMapDao.listAccountVlanMapsByAccount(owner.getId());
-                        for (AccountVlanMapVO map : maps) {
-                            if (vlanDbIds == null || vlanDbIds.contains(map.getVlanDbId()))
-                                dedicatedVlanDbIds.add(map.getVlanDbId());
-                        }
-                    }
-                    List<DomainVlanMapVO> domainMaps = _domainVlanMapDao.listDomainVlanMapsByDomain(owner.getDomainId());
-                    for (DomainVlanMapVO map : domainMaps) {
-                        if (vlanDbIds == null || vlanDbIds.contains(map.getVlanDbId()))
-                            dedicatedVlanDbIds.add(map.getVlanDbId());
-                    }
-                    List<VlanVO> nonDedicatedVlans = _vlanDao.listZoneWideNonDedicatedVlans(dcId);
-                    for (VlanVO nonDedicatedVlan : nonDedicatedVlans) {
-                        if (vlanDbIds == null || vlanDbIds.contains(nonDedicatedVlan.getId()))
-                            nonDedicatedVlanDbIds.add(nonDedicatedVlan.getId());
-                    }
-                    if (!dedicatedVlanDbIds.isEmpty()) {
-                        fetchFromDedicatedRange = true;
-                        sc.setParameters("vlanId", dedicatedVlanDbIds.toArray());
-                        errorMessage.append(", vlanId id=" + Arrays.toString(dedicatedVlanDbIds.toArray()));
-                    } else if (!nonDedicatedVlanDbIds.isEmpty()) {
-                        sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
-                        errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
-                    } else {
-                        if (podId != null) {
-                            InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
-                            ex.addProxyObject(ApiDBUtils.findPodById(podId).getUuid());
-                            throw ex;
-                        }
-                        s_logger.warn(errorMessage.toString());
-                        InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", DataCenter.class, dcId);
-                        ex.addProxyObject(ApiDBUtils.findZoneById(dcId).getUuid());
-                        throw ex;
-                    }
-                    if (lockOneRow) {
-                        addrs = _ipAddressDao.lockRows(sc, filter, true);
-                    } else {
-                        addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
-                    }
-                }
+        List<IPAddressVO> addrs = new ArrayList<>();
 
-                // If all the dedicated IPs of the owner are in use fetch an IP from the system pool
-                if ((!lockOneRow || (lockOneRow && addrs.size() == 0)) && fetchFromDedicatedRange && vlanUse == VlanType.VirtualNetwork) {
-                    // Verify if account is allowed to acquire IPs from the system
-                    boolean useSystemIps = UseSystemPublicIps.valueIn(owner.getId());
-                    if (useSystemIps && !nonDedicatedVlanDbIds.isEmpty()) {
-                        fetchFromDedicatedRange = false;
-                        sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
-                        errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
-                        if (lockOneRow) {
-                            addrs = _ipAddressDao.lockRows(sc, filter, true);
-                        } else {
-                            addrs.addAll(_ipAddressDao.search(sc, null));
-                        }
-                    }
+        if (forSystemVms) {
+            // Get Public IPs for system vms in dedicated ranges
+            sc.setParameters("forSystemVms", true);
+            if (lockOneRow) {
+                addrs = _ipAddressDao.lockRows(sc, filter, true);
+            } else {
+                addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
+            }
+        }
+        if (vlanUse == VlanType.VirtualNetwork && (!lockOneRow || (lockOneRow && addrs.size() == 0)) &&
+                !(forSystemVms && SystemVmPublicIpReservationModeStrictness.value())) {
+            sc.setParameters("forSystemVms", false);
+            // If owner has dedicated Public IP ranges, fetch IP from the dedicated range
+            // Otherwise fetch IP from the system pool
+            // Checking if network is null in the case of system VM's. At the time of allocation of IP address to systemVm, no network is present.
+            if (network == null || !(network.getGuestType() == GuestType.Shared && zone.getNetworkType() == NetworkType.Advanced)) {
+                List<AccountVlanMapVO> maps = _accountVlanMapDao.listAccountVlanMapsByAccount(owner.getId());
+                for (AccountVlanMapVO map : maps) {
+                    if (vlanDbIds == null || vlanDbIds.contains(map.getVlanDbId()))
+                        dedicatedVlanDbIds.add(map.getVlanDbId());
                 }
-
-                if (lockOneRow && addrs.size() == 0) {
-                    if (podId != null) {
-                        InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
-                        // for now, we hardcode the table names, but we should ideally do a lookup for the tablename from the VO object.
-                        ex.addProxyObject(ApiDBUtils.findPodById(podId).getUuid());
-                        throw ex;
-                    }
-                    s_logger.warn(errorMessage.toString());
-                    InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", DataCenter.class, dcId);
-                    ex.addProxyObject(ApiDBUtils.findZoneById(dcId).getUuid());
+            }
+            List<DomainVlanMapVO> domainMaps = _domainVlanMapDao.listDomainVlanMapsByDomain(owner.getDomainId());
+            for (DomainVlanMapVO map : domainMaps) {
+                if (vlanDbIds == null || vlanDbIds.contains(map.getVlanDbId()))
+                    dedicatedVlanDbIds.add(map.getVlanDbId());
+            }
+            List<VlanVO> nonDedicatedVlans = _vlanDao.listZoneWideNonDedicatedVlans(dcId);
+            for (VlanVO nonDedicatedVlan : nonDedicatedVlans) {
+                if (vlanDbIds == null || vlanDbIds.contains(nonDedicatedVlan.getId()))
+                    nonDedicatedVlanDbIds.add(nonDedicatedVlan.getId());
+            }
+            if (!dedicatedVlanDbIds.isEmpty()) {
+                fetchFromDedicatedRange = true;
+                sc.setParameters("vlanId", dedicatedVlanDbIds.toArray());
+                errorMessage.append(", vlanId id=" + Arrays.toString(dedicatedVlanDbIds.toArray()));
+            } else if (!nonDedicatedVlanDbIds.isEmpty()) {
+                sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
+                errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
+            } else {
+                if (podId != null) {
+                    InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
+                    ex.addProxyObject(ApiDBUtils.findPodById(podId).getUuid());
                     throw ex;
                 }
+                s_logger.warn(errorMessage.toString());
+                InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", DataCenter.class, dcId);
+                ex.addProxyObject(ApiDBUtils.findZoneById(dcId).getUuid());
+                throw ex;
+            }
+            if (lockOneRow) {
+                addrs = _ipAddressDao.lockRows(sc, filter, true);
+            } else {
+                addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
+            }
+        }
 
+        // If all the dedicated IPs of the owner are in use fetch an IP from the system pool
+        if ((!lockOneRow || (lockOneRow && addrs.size() == 0)) && fetchFromDedicatedRange && vlanUse == VlanType.VirtualNetwork) {
+            // Verify if account is allowed to acquire IPs from the system
+            boolean useSystemIps = UseSystemPublicIps.valueIn(owner.getId());
+            if (useSystemIps && !nonDedicatedVlanDbIds.isEmpty()) {
+                fetchFromDedicatedRange = false;
+                sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
+                errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
                 if (lockOneRow) {
-                    assert (addrs.size() == 1) : "Return size is incorrect: " + addrs.size();
-                }
-                if (assign) {
-                    assignAndAllocateIpAddressEntry(owner, vlanUse, guestNetworkId, sourceNat, allocate,
-                            isSystem,vpcId, displayIp, fetchFromDedicatedRange, addrs);
+                    addrs = _ipAddressDao.lockRows(sc, filter, true);
+                } else {
+                    addrs.addAll(_ipAddressDao.search(sc, null));
                 }
-                return addrs;
             }
-        });
+        }
+
+        if (lockOneRow && addrs.size() == 0) {
+            if (podId != null) {
+                InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
+                // for now, we hardcode the table names, but we should ideally do a lookup for the tablename from the VO object.
+                ex.addProxyObject(ApiDBUtils.findPodById(podId).getUuid());
+                throw ex;
+            }
+            s_logger.warn(errorMessage.toString());
+            InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", DataCenter.class, dcId);
+            ex.addProxyObject(ApiDBUtils.findZoneById(dcId).getUuid());
+            throw ex;
+        }
+
+        if (lockOneRow) {
+            assert (addrs.size() == 1) : "Return size is incorrect: " + addrs.size();
+        }
+
+        if (assign && !fetchFromDedicatedRange && VlanType.VirtualNetwork.equals(vlanUse)) {
+            // Check that the maximum number of public IPs for the given accountId will not be exceeded
+            try {
+                _resourceLimitMgr.checkResourceLimit(owner, ResourceType.public_ip);
+            } catch (ResourceAllocationException ex) {
+                s_logger.warn("Failed to allocate resource of type " + ex.getResourceType() + " for account " + owner);
+                throw new AccountLimitException("Maximum number of public IP addresses for account: " + owner.getAccountName() + " has been exceeded.");
+            }
+        }
+
+        return addrs;
     }
 
     @DB

From b15b539735a799b2dd95a9b446c66ccd83768ba9 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Mon, 30 Jan 2023 20:30:30 +0100
Subject: [PATCH 3/5] Update 7144: fix test_public_ip_range.py

---
 test/integration/smoke/test_public_ip_range.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/test/integration/smoke/test_public_ip_range.py b/test/integration/smoke/test_public_ip_range.py
index 69baf5f2fc21..19edc4c164f2 100644
--- a/test/integration/smoke/test_public_ip_range.py
+++ b/test/integration/smoke/test_public_ip_range.py
@@ -128,9 +128,8 @@ def test_dedicatePublicIpRange(self):
                                             id=self.public_ip_range.vlan.id
                                         )
         public_ip_response = list_public_ip_range_response[0]
-        self.assertEqual(
+        self.assertIsNone(
                             public_ip_response.account,
-                            "system",
                             "Check account name is system account in listVlanIpRanges"
                         )
         return

From ec58f78b6304c55fc6b8f97ee4719316823cb310 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Tue, 31 Jan 2023 08:20:26 +0100
Subject: [PATCH 4/5] Update 7144: fix ip allocation in shared networks

---
 .../cloud/network/IpAddressManagerImpl.java   | 60 ++++++++++---------
 1 file changed, 31 insertions(+), 29 deletions(-)

diff --git a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
index d7758ef1771d..4b7cabc61e3c 100644
--- a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
@@ -874,7 +874,7 @@ public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podI
                 addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
             }
         }
-        if (vlanUse == VlanType.VirtualNetwork && (!lockOneRow || (lockOneRow && addrs.size() == 0)) &&
+        if ((!lockOneRow || (lockOneRow && CollectionUtils.isEmpty(addrs))) &&
                 !(forSystemVms && SystemVmPublicIpReservationModeStrictness.value())) {
             sc.setParameters("forSystemVms", false);
             // If owner has dedicated Public IP ranges, fetch IP from the dedicated range
@@ -897,43 +897,45 @@ public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podI
                 if (vlanDbIds == null || vlanDbIds.contains(nonDedicatedVlan.getId()))
                     nonDedicatedVlanDbIds.add(nonDedicatedVlan.getId());
             }
-            if (!dedicatedVlanDbIds.isEmpty()) {
-                fetchFromDedicatedRange = true;
-                sc.setParameters("vlanId", dedicatedVlanDbIds.toArray());
-                errorMessage.append(", vlanId id=" + Arrays.toString(dedicatedVlanDbIds.toArray()));
-            } else if (!nonDedicatedVlanDbIds.isEmpty()) {
-                sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
-                errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
-            } else {
-                if (podId != null) {
-                    InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
-                    ex.addProxyObject(ApiDBUtils.findPodById(podId).getUuid());
+            if (vlanUse == VlanType.VirtualNetwork) {
+                if (!dedicatedVlanDbIds.isEmpty()) {
+                    fetchFromDedicatedRange = true;
+                    sc.setParameters("vlanId", dedicatedVlanDbIds.toArray());
+                    errorMessage.append(", vlanId id=" + Arrays.toString(dedicatedVlanDbIds.toArray()));
+                } else if (!nonDedicatedVlanDbIds.isEmpty()) {
+                    sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
+                    errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
+                } else {
+                    if (podId != null) {
+                        InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
+                        ex.addProxyObject(ApiDBUtils.findPodById(podId).getUuid());
+                        throw ex;
+                    }
+                    s_logger.warn(errorMessage.toString());
+                    InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", DataCenter.class, dcId);
+                    ex.addProxyObject(ApiDBUtils.findZoneById(dcId).getUuid());
                     throw ex;
                 }
-                s_logger.warn(errorMessage.toString());
-                InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", DataCenter.class, dcId);
-                ex.addProxyObject(ApiDBUtils.findZoneById(dcId).getUuid());
-                throw ex;
             }
             if (lockOneRow) {
                 addrs = _ipAddressDao.lockRows(sc, filter, true);
             } else {
                 addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
             }
-        }
 
-        // If all the dedicated IPs of the owner are in use fetch an IP from the system pool
-        if ((!lockOneRow || (lockOneRow && addrs.size() == 0)) && fetchFromDedicatedRange && vlanUse == VlanType.VirtualNetwork) {
-            // Verify if account is allowed to acquire IPs from the system
-            boolean useSystemIps = UseSystemPublicIps.valueIn(owner.getId());
-            if (useSystemIps && !nonDedicatedVlanDbIds.isEmpty()) {
-                fetchFromDedicatedRange = false;
-                sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
-                errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
-                if (lockOneRow) {
-                    addrs = _ipAddressDao.lockRows(sc, filter, true);
-                } else {
-                    addrs.addAll(_ipAddressDao.search(sc, null));
+            // If all the dedicated IPs of the owner are in use fetch an IP from the system pool
+            if ((!lockOneRow || (lockOneRow && addrs.size() == 0)) && fetchFromDedicatedRange && vlanUse == VlanType.VirtualNetwork) {
+                // Verify if account is allowed to acquire IPs from the system
+                boolean useSystemIps = UseSystemPublicIps.valueIn(owner.getId());
+                if (useSystemIps && !nonDedicatedVlanDbIds.isEmpty()) {
+                    fetchFromDedicatedRange = false;
+                    sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
+                    errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
+                    if (lockOneRow) {
+                        addrs = _ipAddressDao.lockRows(sc, filter, true);
+                    } else {
+                        addrs.addAll(_ipAddressDao.search(sc, null));
+                    }
                 }
             }
         }

From 43cd1c46863db2c472370027cded9759b67a6f34 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Tue, 31 Jan 2023 08:20:42 +0100
Subject: [PATCH 5/5] server: dedicated systemvm ip range to ROOT domain should
 fail

---
 .../com/cloud/configuration/ConfigurationManagerImpl.java  | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
index aab19f5b4e5e..f15d3f318fd7 100644
--- a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
@@ -5318,10 +5318,11 @@ public Vlan dedicatePublicIpRange(final DedicatePublicIpRangeCmd cmd) throws Res
 
         // Check if any of the Public IP addresses is allocated to another
         // account
-        boolean forSystemVms = false;
         final List<IPAddressVO> ips = _publicIpAddressDao.listByVlanId(vlanDbId);
         for (final IPAddressVO ip : ips) {
-            forSystemVms = ip.isForSystemVms();
+            if (ip.isForSystemVms()) {
+                throw new InvalidParameterValueException(ip.getAddress() + " Public IP address in range is dedicated to system vms ");
+            }
             final Long allocatedToAccountId = ip.getAllocatedToAccountId();
             if (allocatedToAccountId != null) {
                 if (vlanOwner != null && allocatedToAccountId != vlanOwner.getId()) {
@@ -5346,7 +5347,7 @@ public Vlan dedicatePublicIpRange(final DedicatePublicIpRangeCmd cmd) throws Res
                 UsageEventUtils.publishUsageEvent(EventTypes.EVENT_NET_IP_ASSIGN, vlanOwner.getId(), ip.getDataCenterId(), ip.getId(), ip.getAddress().toString(), ip.isSourceNat(),
                         vlan.getVlanType().toString(), ip.getSystem(), usageHidden, ip.getClass().getName(), ip.getUuid());
             }
-        } else if (domain != null && !forSystemVms) {
+        } else if (domain != null) {
             // Create an DomainVlanMapVO entry
             DomainVlanMapVO domainVlanMapVO = new DomainVlanMapVO(domain.getId(), vlan.getId());
             _domainVlanMapDao.persist(domainVlanMapVO);