From 8278d88f76ee129af75cd585b916bd6719e34e4c Mon Sep 17 00:00:00 2001 From: Jayapal Date: Wed, 3 Dec 2014 16:49:24 +0530 Subject: [PATCH] CLOUDSTACK-8030: Updated router to come up egress default ALLOW On default iptables rules are updated to add ACCEPT egress traffic. If the network egress default policy is false, CS remove ACCEPT and adds the DROP rule which is egress default rule when there are no other egress rules. If the CS network egress default policy is true, CS won't configure any default rule for egress because router already came up to accept egress traffic. If there are already egress rules for network then the egress rules get applied on VR. For isolated network with out firewall service, VR default allows egress traffic (guestnetwork --> public network) --- .../orchestration/NetworkOrchestrator.java | 30 ++++++++++--------- .../resource/CitrixResourceBase.java | 1 + .../network/element/VirtualRouterElement.java | 5 ++-- .../VirtualNetworkApplianceManagerImpl.java | 5 +++- .../config/etc/iptables/iptables-router | 3 ++ .../config/opt/cloud/bin/firewall_egress.sh | 8 ++--- 6 files changed, 31 insertions(+), 21 deletions(-) diff --git a/engine/orchestration/src/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java b/engine/orchestration/src/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java index 17a2a9b7269..b28a26b846b 100755 --- a/engine/orchestration/src/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java +++ b/engine/orchestration/src/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java @@ -1147,6 +1147,22 @@ public class NetworkOrchestrator extends ManagerBase implements NetworkOrchestra // This method re-programs the rules/ips for existing network protected boolean reprogramNetworkRules(long networkId, Account caller, Network network) throws ResourceUnavailableException { boolean success = true; + + //Apply egress rules first to effect the egress policy early on the guest traffic + List firewallEgressRulesToApply = _firewallDao.listByNetworkPurposeTrafficType(networkId, Purpose.Firewall, FirewallRule.TrafficType.Egress); + NetworkOfferingVO offering = _networkOfferingDao.findById(network.getNetworkOfferingId()); + DataCenter zone = _dcDao.findById(network.getDataCenterId()); + if (_networkModel.areServicesSupportedInNetwork(network.getId(), Service.Firewall) && _networkModel.areServicesSupportedInNetwork(network.getId(), Service.Firewall) + && (network.getGuestType() == Network.GuestType.Isolated || (network.getGuestType() == Network.GuestType.Shared && zone.getNetworkType() == NetworkType.Advanced))) { + // add default egress rule to accept the traffic + _firewallMgr.applyDefaultEgressFirewallRule(network.getId(), offering.getEgressDefaultPolicy(), true); + } + if (!_firewallMgr.applyFirewallRules(firewallEgressRulesToApply, false, caller)) { + s_logger.warn("Failed to reapply firewall Egress rule(s) as a part of network id=" + networkId + " restart"); + success = false; + } + + // associate all ip addresses if (!_ipAddrMgr.applyIpAssociations(network, false)) { s_logger.warn("Failed to apply ip addresses as a part of network id" + networkId + " restart"); @@ -1166,20 +1182,6 @@ public class NetworkOrchestrator extends ManagerBase implements NetworkOrchestra success = false; } - List firewallEgressRulesToApply = _firewallDao.listByNetworkPurposeTrafficType(networkId, Purpose.Firewall, FirewallRule.TrafficType.Egress); - NetworkOfferingVO offering = _networkOfferingDao.findById(network.getNetworkOfferingId()); - //there are no egress rules then apply the default egress rule - DataCenter zone = _dcDao.findById(network.getDataCenterId()); - if (_networkModel.areServicesSupportedInNetwork(network.getId(), Service.Firewall) && _networkModel.areServicesSupportedInNetwork(network.getId(), Service.Firewall) - && (network.getGuestType() == Network.GuestType.Isolated || (network.getGuestType() == Network.GuestType.Shared && zone.getNetworkType() == NetworkType.Advanced))) { - // add default egress rule to accept the traffic - _firewallMgr.applyDefaultEgressFirewallRule(network.getId(), offering.getEgressDefaultPolicy(), true); - } - if (!_firewallMgr.applyFirewallRules(firewallEgressRulesToApply, false, caller)) { - s_logger.warn("Failed to reapply firewall Egress rule(s) as a part of network id=" + networkId + " restart"); - success = false; - } - // apply port forwarding rules if (!_rulesMgr.applyPortForwardingRulesForNetwork(networkId, false, caller)) { s_logger.warn("Failed to reapply port forwarding rule(s) as a part of network id=" + networkId + " restart"); diff --git a/plugins/hypervisors/xenserver/src/com/cloud/hypervisor/xenserver/resource/CitrixResourceBase.java b/plugins/hypervisors/xenserver/src/com/cloud/hypervisor/xenserver/resource/CitrixResourceBase.java index 9b282d8b33b..a090b1106ac 100644 --- a/plugins/hypervisors/xenserver/src/com/cloud/hypervisor/xenserver/resource/CitrixResourceBase.java +++ b/plugins/hypervisors/xenserver/src/com/cloud/hypervisor/xenserver/resource/CitrixResourceBase.java @@ -573,6 +573,7 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe public ExecutionResult createFileInVR(String routerIp, String path, String filename, String content) { Connection conn = getConnection(); String rc = callHostPlugin(conn, "vmops", "createFileInDomr", "domrip", routerIp, "filepath", path + filename, "filecontents", content); + s_logger.debug ("VR Config file " + filename + " got created in VR with ip " + routerIp + " with content \n" + content); // Fail case would be start with "fail#" return new ExecutionResult(rc.startsWith("succ#"), rc.substring(5)); } diff --git a/server/src/com/cloud/network/element/VirtualRouterElement.java b/server/src/com/cloud/network/element/VirtualRouterElement.java index dc6ffc8b223..ae4c933922b 100755 --- a/server/src/com/cloud/network/element/VirtualRouterElement.java +++ b/server/src/com/cloud/network/element/VirtualRouterElement.java @@ -251,9 +251,10 @@ NetworkMigrationResponder, AggregatedCommandExecutor { } if (rules != null && rules.size() == 1) { - // for VR no need to add default egress rule to DENY traffic + // for VR no need to add default egress rule to ALLOW traffic + //The default allow rule is added from the router defalut iptables rules iptables-router if (rules.get(0).getTrafficType() == FirewallRule.TrafficType.Egress && rules.get(0).getType() == FirewallRule.FirewallRuleType.System && - !_networkMdl.getNetworkEgressDefaultPolicy(config.getId())) + _networkMdl.getNetworkEgressDefaultPolicy(config.getId())) return true; } diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java index fb39c0a2998..6c5ff9c8815 100755 --- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java +++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java @@ -2789,7 +2789,7 @@ VirtualMachineGuru, Listener, Configurable, StateListener sourceCidr = new ArrayList(); @@ -2799,6 +2799,9 @@ VirtualMachineGuru, Listener, Configurable, StateListener