cloudstack-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Jayapal Reddy (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (CLOUDSTACK-4613) security group rules issue in host
Date Fri, 06 Sep 2013 10:10:52 GMT

    [ https://issues.apache.org/jira/browse/CLOUDSTACK-4613?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13760103#comment-13760103
] 

Jayapal Reddy commented on CLOUDSTACK-4613:
-------------------------------------------

1. Running iptables command which took from iptables-save failed, 'Bad argument `!--set' 
space issue after !



[19231] 2013-09-06 02:38:24.546698      ['/bin/bash', '-c', "iptables-save | grep '\\-A i-2-91-def'
| grep  physdev-in | grep vif | sed -r 's/vif[0-9]+.0/vif21.0/' | sed 's/-A/-I/'"]
[19231] 2013-09-06 02:38:24.565476      SUCCESS
[19231] 2013-09-06 02:38:24.565656      ['/bin/bash', '-c', "iptables-save| grep '\\-A i-2-91-def'
| grep  physdev-in | grep tap | sed -r 's/tap[0-9]+.0/tap21.0/' | sed 's/-A/-I/'"]
[19231] 2013-09-06 02:38:24.584220      SUCCESS
[19231] 2013-09-06 02:38:24.584356      ['/bin/bash', '-c', "iptables-save | grep '\\-A i-2-91-def'
| grep  physdev-out | grep vif | sed -r 's/vif[0-9]+.0/vif21.0/' | sed 's/-A/-I/'"]
[19231] 2013-09-06 02:38:24.603046      SUCCESS
[19231] 2013-09-06 02:38:24.603206      ['/bin/bash', '-c', "iptables-save| grep '\\-A i-2-91-def'
| grep  physdev-out | grep tap | sed -r 's/tap[0-9]+.0/tap21.0/' | sed 's/-A/-I/'"]
[19231] 2013-09-06 02:38:24.621915      SUCCESS
[19231] 2013-09-06 02:38:24.622100      ['iptables', '-D', 'i-2-91-def', '-p', 'udp', '-m',
'physdev', '--physdev-in', 'vif18.0', '--physdev-is-bridged', '-m', 'set', '--set', 'i-2-91-VM',
'src', '-m', 'udp', '--dport', '53', '-j', 'RETURN']
[19231] 2013-09-06 02:38:24.634604      SUCCESS
[19231] 2013-09-06 02:38:24.634749      ['iptables', '-D', 'i-2-91-def', '-m', 'physdev',
'--physdev-in', 'vif18.0', '--physdev-is-bridged', '-m', 'set', '!--set', 'i-2-91-VM', 'src',
'-j', 'DROP']
[19231] 2013-09-06 02:38:24.645608      FAILED: (rc 2) stdout: 'Bad argument `!--set'
', stderr: 'Try `iptables -h' or 'iptables --help' for more information.

2. The order of anti spoofing rules order is incorrect after the vm reboot

After reboot:
Chain i-2-45-def (2 references)
 pkts bytes target     prot opt in     out     source               destination
  994  381K i-2-45-VM  all  --  *      *       0.0.0.0/0            0.0.0.0/0           PHYSDEV
match --physdev-out vif6.0 --physdev-is-bridged
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           PHYSDEV
match --physdev-out vif6.0 --physdev-is-bridged !set i-2-45-VM dst
    0     0 i-2-45-VM-eg  all  --  *      *       0.0.0.0/0            0.0.0.0/0         
 PHYSDEV match --physdev-in vif6.0 --physdev-is-bridged set i-2-45-VM src
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           PHYSDEV
match --physdev-in vif6.0 --physdev-is-bridged !set i-2-45-VM src
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           PHYSDEV
match --physdev-in vif6.0 --physdev-is-bridged set i-2-45-VM src udp dpt:53




                
> security group rules issue in host
> ----------------------------------
>
>                 Key: CLOUDSTACK-4613
>                 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-4613
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>          Components: Network Controller
>    Affects Versions: 4.1.0
>            Reporter: Jayapal Reddy
>            Assignee: Jayapal Reddy
>             Fix For: 4.2.1
>
>
> Observed the following security group iptables rules issues
> 1. iptables anti spoofing DROP rules add failed on VM reboot.
> inscmd = "iptables-save | grep '\-A " +  vmchain_default + "' | grep  physdev-in | grep
vif | sed -r 's/vif[0-9]+.0/" + vif + "/' | sed 's/-A/-I/'"
> Here the rules in inscmd are with out space for !--set, this causes rule execute failed.
> 2. The order of iptables rules are incorrect on VM reboot.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira

Mime
View raw message