router: don't mark packets permanently on SNAT

This will remove MARK-ing of packets via the mangle table. This also
fixes an unexplained issue of failure of access via public SNAT ips
across VMS of the same VPC.

This also removes MARK usage across VR codebase except for VPN.

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>

Author: yadvr

systemvm/debian/opt/cloud/bin/configure.py

@@ -851,24 +851,15 @@ def forward_vr(self, rule):
                 rule['protocol'],
                 self.portsToString(rule['internal_ports'], ':')
               )
-        fw5 = "-A PREROUTING -d %s/32 -i %s -p %s -m %s --dport %s -j MARK --set-xmark %s/0xffffffff" % \
+        fw5 = "-A PREROUTING -d %s/32 -i %s -p %s -m %s --dport %s -m state --state NEW -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff" % \
               (
                 rule['public_ip'],
                 public_fwinterface,
                 rule['protocol'],
                 rule['protocol'],
                 public_fwports,
-                hex(int(public_fwinterface[3:]))
               )
-        fw6 = "-A PREROUTING -d %s/32 -i %s -p %s -m %s --dport %s -m state --state NEW -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff" % \
-              (
-                rule['public_ip'],
-                public_fwinterface,
-                rule['protocol'],
-                rule['protocol'],
-                public_fwports,
-              )
-        fw7 = "-A FORWARD -i %s -o %s -p %s -m %s --dport %s -m state --state NEW,ESTABLISHED -j ACCEPT" % \
+        fw6 = "-A FORWARD -i %s -o %s -p %s -m %s --dport %s -m state --state NEW,ESTABLISHED -j ACCEPT" % \
               (
                 public_fwinterface,
                 internal_fwinterface,
@@ -881,8 +872,7 @@ def forward_vr(self, rule):
         self.fw.append(["nat", "", fw3])
         self.fw.append(["nat", "", fw4])
         self.fw.append(["nat", "", fw5])
-        self.fw.append(["nat", "", fw6])
-        self.fw.append(["filter", "", fw7])
+        self.fw.append(["filter", "", fw6])
 
     def forward_vpc(self, rule):
         fw_prerout_rule = "-A PREROUTING -d %s/32 " % (rule["public_ip"])
@@ -922,12 +912,6 @@ def processStaticNatRule(self, rule):
         if device is None:
             raise Exception("Ip address %s has no device in the ips databag" % rule["public_ip"])
 
-        self.fw.append(["mangle", "",
-                        "-I PREROUTING -s %s/32 -m state --state NEW -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff" %
-                        rule["internal_ip"]])
-        self.fw.append(["mangle", "",
-                        "-I PREROUTING -s %s/32 -m state --state NEW -j MARK --set-xmark 0x%s/0xffffffff" %
-                        (rule["internal_ip"], device[len("eth"):])])
         self.fw.append(["nat", "front",
                         "-A PREROUTING -d %s/32 -j DNAT --to-destination %s" % (rule["public_ip"], rule["internal_ip"])])
         self.fw.append(["nat", "front",

systemvm/debian/opt/cloud/bin/cs/CsAddress.py

@@ -299,8 +299,6 @@ def post_configure(self, address):
             CsHelper.reconfigure_interfaces(self.cl, interfaces)
             if not self.config.is_vpc() and (self.get_type() in ['public']):
                 self.set_mark()
-            if self.config.is_vpc() and (self.get_type() in ['public']):
-                self.set_mark()
 
             if 'gateway' in self.address:
                 self.arpPing()
@@ -363,6 +361,7 @@ def setup_router_control(self):
     def fw_router(self):
         if self.config.is_vpc():
             return
+
         self.fw.append(["mangle", "front", "-A PREROUTING " +
                         "-m state --state RELATED,ESTABLISHED " +
                         "-j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff"])

systemvm/debian/opt/cloud/bin/cs/CsRoute.py

@@ -62,13 +62,13 @@ def add_network_route(self, dev, address):
         table = self.get_tablename(dev)
         logging.info("Adding route: dev " + dev + " table: " +
                      table + " network: " + address + " if not present")
-        cmd = "dev %s table %s throw %s proto static" % (dev, table, address)
+        cmd = "throw %s table %s proto static" % (address, table)
         self.set_route(cmd)
 
     def set_route(self, cmd, method="add"):
         """ Add a route if it is not already defined """
         found = False
-        for i in CsHelper.execute("ip route show " + cmd):
+        for i in CsHelper.execute("ip route show table " + cmd.split(" table")[1]):
             found = True
         if not found and method == "add":
             logging.info("Add " + cmd)