From a20d05aca6a41e864781e846ed3ab4fcc808b01b Mon Sep 17 00:00:00 2001 From: Rohit Yadav Date: Thu, 19 Apr 2018 01:18:39 +0530 Subject: [PATCH] router: Fix routing tables for public IP NAT based access This fixes routing table rule setup regression to correctly router marked packets based on interface related ip route tables. This thereby fixes the access of VMs in the same VPC using NAT/SNAT public IPs. Signed-off-by: Rohit Yadav --- systemvm/debian/opt/cloud/bin/configure.py | 4 ++-- systemvm/debian/opt/cloud/bin/cs/CsAddress.py | 12 +++++++++--- systemvm/debian/opt/cloud/bin/cs/CsRoute.py | 7 +++++-- 3 files changed, 16 insertions(+), 7 deletions(-) diff --git a/systemvm/debian/opt/cloud/bin/configure.py b/systemvm/debian/opt/cloud/bin/configure.py index a3b7674926c4..55da0f9a3848 100755 --- a/systemvm/debian/opt/cloud/bin/configure.py +++ b/systemvm/debian/opt/cloud/bin/configure.py @@ -926,8 +926,8 @@ def processStaticNatRule(self, rule): "-I PREROUTING -s %s/32 -m state --state NEW -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff" % rule["internal_ip"]]) self.fw.append(["mangle", "", - "-I PREROUTING -s %s/32 -m state --state NEW -j MARK --set-xmark 0x%s/0xffffffff" % - (rule["internal_ip"], device[len("eth"):])]) + "-I PREROUTING -s %s/32 -m state --state NEW -j MARK --set-xmark %s/0xffffffff" % + (rule["internal_ip"], hex(int(device[len("eth"):])))]) self.fw.append(["nat", "front", "-A PREROUTING -d %s/32 -j DNAT --to-destination %s" % (rule["public_ip"], rule["internal_ip"])]) self.fw.append(["nat", "front", diff --git a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py index dbafa1df5552..8df51622633e 100755 --- a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py +++ b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py @@ -297,9 +297,7 @@ def post_configure(self, address): interfaces = [CsInterface(address, self.config)] CsHelper.reconfigure_interfaces(self.cl, interfaces) - if not self.config.is_vpc() and (self.get_type() in ['public']): - self.set_mark() - if self.config.is_vpc() and (self.get_type() in ['public']): + if self.get_type() in ['public']: self.set_mark() if 'gateway' in self.address: @@ -363,6 +361,7 @@ def setup_router_control(self): def fw_router(self): if self.config.is_vpc(): return + self.fw.append(["mangle", "front", "-A PREROUTING " + "-m state --state RELATED,ESTABLISHED " + "-j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff"]) @@ -534,6 +533,13 @@ def post_config_change(self, method): if self.config.is_vpc(): if self.get_type() in ["public"] and "gateway" in self.address and self.address["gateway"] != "None": route.add_route(self.dev, self.address["gateway"]) + for inf, addresses in self.config.address().dbag.iteritems(): + if not inf.startswith("eth"): + continue + for address in addresses: + if "nw_type" in address and address["nw_type"] == "guest": + route.add_network_route(self.dev, str(address["network"])) + route.add_network_route(self.dev, str(self.address["network"])) CsHelper.execute("sudo ip route flush cache") diff --git a/systemvm/debian/opt/cloud/bin/cs/CsRoute.py b/systemvm/debian/opt/cloud/bin/cs/CsRoute.py index 02cc88117d86..74544d988335 100755 --- a/systemvm/debian/opt/cloud/bin/cs/CsRoute.py +++ b/systemvm/debian/opt/cloud/bin/cs/CsRoute.py @@ -62,13 +62,16 @@ def add_network_route(self, dev, address): table = self.get_tablename(dev) logging.info("Adding route: dev " + dev + " table: " + table + " network: " + address + " if not present") - cmd = "dev %s table %s throw %s proto static" % (dev, table, address) + cmd = "throw %s table %s proto static" % (address, table) self.set_route(cmd) def set_route(self, cmd, method="add"): """ Add a route if it is not already defined """ found = False - for i in CsHelper.execute("ip route show " + cmd): + search = cmd + if "throw" in search: + search = "type " + search + for i in CsHelper.execute("ip route show " + search): found = True if not found and method == "add": logging.info("Add " + cmd)