Fix private gateway acl on static routes by vishesh92 · Pull Request #10262 · apache/cloudstack

vishesh92 · 2025-01-24T07:50:12Z

Description

This PR fixes #9837

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

vishesh92 · 2025-01-24T07:50:29Z

@blueorangutan package

codecov · 2025-01-24T07:58:12Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 15.15%. Comparing base (90c960e) to head (77fb01c).
Report is 13 commits behind head on 4.19.

Additional details and impacted files

@@             Coverage Diff              @@
##               4.19   #10262      +/-   ##
============================================
- Coverage     15.16%   15.15%   -0.01%     
- Complexity    11314    11318       +4     
============================================
  Files          5409     5409              
  Lines        474473   474663     +190     
  Branches      57876    57903      +27     
============================================
+ Hits          71947    71952       +5     
- Misses       394482   394666     +184     
- Partials       8044     8045       +1

Flag	Coverage Δ
uitests	`4.29% <ø> (ø)`
unittests	`15.88% <ø> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

weizhouapache · 2025-01-24T08:15:40Z

@blueorangutan package

vishesh92 · 2025-01-24T09:29:25Z

@blueorangutan test

weizhouapache · 2025-01-24T10:19:26Z

iptables rules for ingress look good

-A FORWARD -d 10.200.0.0/24 -o eth2 -j ACL_INBOUND_eth2
-A FORWARD -d xx.xx.80.0/24 -o eth2 -j ACL_INBOUND_eth2
-A FORWARD -d xx.xx.81.0/24 -o eth2 -j ACL_INBOUND_eth2

however, the rules for egress seem wrong

-A PREROUTING -s 10.200.0.0/24 ! -d 10.200.0.1/32 -i eth2 -m state --state NEW -j ACL_OUTBOUND_eth2
-A PREROUTING -s 10.200.0.0/24 ! -d xx.xx.80.0/24 -i eth2 -m state --state NEW -j ACL_OUTBOUND_eth2
-A PREROUTING -s 10.200.0.0/24 ! -d xx.xx.81.0/24 -i eth2 -m state --state NEW -j ACL_OUTBOUND_eth2

I think it should be like

-A PREROUTING -s 10.200.0.0/24 ! -d 10.200.0.4/32 -i eth2 -m state --state NEW -j ACL_OUTBOUND_eth2
-A PREROUTING -s xx.xx.80.0/24 ! -d 10.200.0.4/32 -i eth2 -m state --state NEW -j ACL_OUTBOUND_eth2
-A PREROUTING -s xx.xx.81.0/24 ! -d 10.200.0.4/32 -i eth2 -m state --state NEW -j ACL_OUTBOUND_eth2

note:
in my testing, private gatway ip is 10.200.0.4, gateway is 10.200.0.1

systemvm/debian/opt/cloud/bin/cs/CsAddress.py

vishesh92 · 2025-01-27T05:53:50Z

@blueorangutan package

weizhouapache · 2025-01-30T16:23:35Z

@vishesh92
I added a commit to #10268
8d3468e

similar change might be needed

weizhouapache · 2025-02-06T09:26:33Z

@blueorangutan package

weizhouapache · 2025-02-06T10:33:19Z

@blueorangutan package

weizhouapache · 2025-02-06T13:03:25Z

@blueorangutan test

blueorangutan · 2025-02-08T05:18:09Z

[SF] Trillian test result (tid-12347)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 53108 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10262-t12347-kvm-ol8.zip
Smoke tests completed. 131 look OK, 2 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_01_secure_vm_migration	`Error`	326.77	test_vm_life_cycle.py
test_02_unsecure_vm_migration	`Error`	3739.89	test_vm_life_cycle.py
test_03_secured_to_nonsecured_vm_migration	`Error`	395.59	test_vm_life_cycle.py
test_04_nonsecured_to_secured_vm_migration	`Error`	350.28	test_vm_life_cycle.py
test_04_deploy_vnf_appliance	`Error`	143.70	test_vnf_templates.py
test_04_deploy_vnf_appliance	`Error`	143.70	test_vnf_templates.py
test_05_delete_vnf_template	`Error`	1.12	test_vnf_templates.py
ContextSuite context=TestVnfTemplates>:teardown	`Error`	2.28	test_vnf_templates.py

DaanHoogland · 2025-02-09T08:37:23Z

@blueorangutan package

blueorangutan · 2025-02-09T08:38:03Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-02-09T09:43:12Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 12392

DaanHoogland · 2025-02-09T09:45:55Z

@blueorangutan test

blueorangutan · 2025-02-09T09:48:05Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-02-09T23:33:30Z

[SF] Trillian test result (tid-12361)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 46829 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10262-t12361-kvm-ol8.zip
Smoke tests completed. 132 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_04_nonsecured_to_secured_vm_migration	`Error`	393.61	test_vm_life_cycle.py

DaanHoogland

tested this in a lab env with two VPCs
10.10.0.0/16 and 10.11.0.0/16
private gateways 10.200.20.1 and 10.200.20.2 connected (as each others gateway and tested several acl lists configurations to block/allow tcp/icmp.

The only noteworthy limitation is that running processes won't get blocked. I do not consider that part of this PR/issue and am not sure if that needs solving, as restart with cleanup would take care of that.

weizhouapache

code lgtm

boring-cyborg bot added component:networking component:virtual-router Python Warning... Python code Ahead! labels Jan 24, 2025

vishesh92 linked an issue Jan 24, 2025 that may be closed by this pull request

private gateway ACLs are not applied correctly #9838

Closed

vishesh92 requested a review from weizhouapache January 24, 2025 07:52

vishesh92 removed a link to an issue Jan 24, 2025

private gateway ACLs are not applied correctly #9838

Closed

vishesh92 linked an issue Jan 24, 2025 that may be closed by this pull request

private gateway ACL does not apply on the static routes #9837

Closed

DaanHoogland added this to the 4.19.2 milestone Jan 24, 2025

weizhouapache reviewed Jan 24, 2025

View reviewed changes

systemvm/debian/opt/cloud/bin/cs/CsAddress.py Outdated Show resolved Hide resolved

vishesh92 commented Jan 24, 2025

View reviewed changes

systemvm/debian/opt/cloud/bin/cs/CsAddress.py Outdated Show resolved Hide resolved

weizhouapache reviewed Jan 24, 2025

View reviewed changes

systemvm/debian/opt/cloud/bin/cs/CsAddress.py Show resolved Hide resolved

systemvm/debian/opt/cloud/bin/cs/CsAddress.py Outdated Show resolved Hide resolved

DaanHoogland added the status:needs-testing label Jan 27, 2025

vishesh92 added 3 commits February 6, 2025 14:29

Fix private gateway acl on static routes

bffcb48

Fixup

45ede9d

Update systemvm/debian/opt/cloud/bin/cs/CsAddress.py

2fa9d88

vishesh92 force-pushed the fixup-private-gw-acl branch from 22462bd to 2fa9d88 Compare February 6, 2025 09:00

Address commments

77fb01c

DaanHoogland assigned Pearl1594 Feb 7, 2025

apache deleted a comment from blueorangutan Feb 9, 2025

DaanHoogland approved these changes Feb 10, 2025

View reviewed changes

weizhouapache approved these changes Feb 10, 2025

View reviewed changes

DaanHoogland merged commit ae1d7cc into apache:4.19 Feb 10, 2025

DaanHoogland mentioned this pull request Feb 10, 2025

private gateway ACL does not apply on the static routes #9837

Closed

DaanHoogland deleted the fixup-private-gw-acl branch February 10, 2025 17:51

yadvr removed the status:needs-testing label Feb 11, 2025

dhslove pushed a commit to ablecloud-team/ablestack-cloud that referenced this pull request Jun 19, 2025

Fix private gateway acl on static routes (apache#10262)

b9b7266

bradh352 mentioned this pull request Nov 3, 2025

Private Gateway prevents VPC from starting (4.21.0) #11965

Closed

Conversation

vishesh92 commented Jan 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

vishesh92 commented Jan 24, 2025

Uh oh!

codecov bot commented Jan 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

weizhouapache commented Jan 24, 2025

Uh oh!

vishesh92 commented Jan 24, 2025

Uh oh!

weizhouapache commented Jan 24, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vishesh92 commented Jan 27, 2025

Uh oh!

weizhouapache commented Jan 30, 2025

Uh oh!

weizhouapache commented Feb 6, 2025

Uh oh!

weizhouapache commented Feb 6, 2025

Uh oh!

weizhouapache commented Feb 6, 2025

Uh oh!

blueorangutan commented Feb 8, 2025

Uh oh!

DaanHoogland commented Feb 9, 2025

Uh oh!

blueorangutan commented Feb 9, 2025

Uh oh!

blueorangutan commented Feb 9, 2025

Uh oh!

DaanHoogland commented Feb 9, 2025

Uh oh!

blueorangutan commented Feb 9, 2025

Uh oh!

blueorangutan commented Feb 9, 2025

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

weizhouapache left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

vishesh92 commented Jan 24, 2025 •

edited

Loading

codecov bot commented Jan 24, 2025 •

edited

Loading