cloudstack-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (CLOUDSTACK-8925) Default allow for Egress rules is not being configured properly in VR iptables rules
Date Tue, 03 Nov 2015 14:48:28 GMT

    [ https://issues.apache.org/jira/browse/CLOUDSTACK-8925?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14987397#comment-14987397
] 

ASF GitHub Bot commented on CLOUDSTACK-8925:
--------------------------------------------

Github user wilderrodrigues commented on the pull request:

    https://github.com/apache/cloudstack/pull/1023#issuecomment-153376651
  
    The last test failed because the connection timed out without printing "Giving up.", as
I expected in the test. You can see the output below:
    
    ```
    {Cmd: wget -t 1 -T 1 www.google.com via Host: 192.168.23.6} {returns: [u'--2015-11-03
14:44:03--  http://www.google.com/', u'Resolving www.google.com... failed: Connection timed
out.', u"wget: unable to resolve host address 'www.google.com'"]}
    {Cmd: wget -t 1 -T 1 www.google.com via Host: 192.168.23.6} {returns: [u'--2015-11-03
14:44:03--  http://www.google.com/', u'Resolving www.google.com... failed: Connection timed
out.', u"wget: unable to resolve host address 'www.google.com'"]}
    {Cmd: wget -t 1 -T 1 www.google.com via Host: 192.168.23.6} {returns: [u'--2015-11-03
14:44:03--  http://www.google.com/', u'Resolving www.google.com... failed: Connection timed
out.', u"wget: unable to resolve host address 'www.google.com'"]}
    {Cmd: wget -t 1 -T 1 www.google.com via Host: 192.168.23.6} {returns: [u'--2015-11-03
14:44:03--  http://www.google.com/', u'Resolving www.google.com... failed: Connection timed
out.', u"wget: unable to resolve host address 'www.google.com'"]}
    ```
    
    I will push another time and will rely on a better test string. But no worries, the fix
is fine!
    
    * Test results:
    
    ```
    Test redundant router internals ... === TestName: test_01_isolate_network_FW_PF_default_routes_egress_true
| Status : SUCCESS ===
    ok
    Test redundant router internals ... === TestName: test_02_isolate_network_FW_PF_default_routes_egress_false
| Status : SUCCESS ===
    ok
    Test redundant router internals ... === TestName: test_01_RVR_Network_FW_PF_SSH_default_routes_egress_true
| Status : SUCCESS ===
    ok
    Test redundant router internals ... === TestName: test_02_RVR_Network_FW_PF_SSH_default_routes_egress_false
| Status : FAILED ===
    FAIL
    
    ======================================================================
    FAIL: Test redundant router internals
    ----------------------------------------------------------------------
    Traceback (most recent call last):
      File "/data/git/cs1/cloudstack/test/integration/component/test_routers_network_ops.py",
line 473, in test_02_RVR_Network_FW_PF_SSH_default_routes_egress_false
        "Attempt to retrieve google.com index page should NOT be successful"
    AssertionError: Attempt to retrieve google.com index page should NOT be successful
    ```


> Default allow for Egress rules is not being configured properly in VR iptables rules
> ------------------------------------------------------------------------------------
>
>                 Key: CLOUDSTACK-8925
>                 URL: https://issues.apache.org/jira/browse/CLOUDSTACK-8925
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>          Components: Virtual Router
>    Affects Versions: 4.6.0
>            Reporter: Pavan Kumar Bandarupally
>            Assignee: Wilder Rodrigues
>            Priority: Blocker
>             Fix For: 4.6.0
>
>
> When we create a network with Egress rules set to default allow, the rules created in
FW_OUTBOUND table should have a reference to FW_EGRESS_RULES chain which has a rule to accept
NEW packets from the guest instances. Without that rule only RELATED , ESTABLISHED rule in
FW_OUTBOUND chain will result in Drop of packets.
> Chain FORWARD (policy DROP 0 packets, 0 bytes)
>  pkts bytes target     prot opt in     out     source               destination
>    44  2832 NETWORK_STATS  all  --  *      *       0.0.0.0/0            0.0.0.0/0
>     0     0 ACCEPT     all  --  eth0   eth1    0.0.0.0/0            0.0.0.0/0       
    state RELATED,ESTABLISHED
>     0     0 ACCEPT     all  --  eth0   eth0    0.0.0.0/0            0.0.0.0/0       
    state NEW
>     4   336 ACCEPT     all  --  eth2   eth0    0.0.0.0/0            0.0.0.0/0       
    state RELATED,ESTABLISHED
>     0     0 ACCEPT     all  --  eth0   eth0    0.0.0.0/0            0.0.0.0/0       
    state RELATED,ESTABLISHED
>    40  2496 FW_OUTBOUND  all  --  eth0   eth2    0.0.0.0/0            0.0.0.0/0
> Chain OUTPUT (policy ACCEPT 20 packets, 1888 bytes)
>  pkts bytes target     prot opt in     out     source               destination
>  2498  369K NETWORK_STATS  all  --  *      *       0.0.0.0/0            0.0.0.0/0
> Chain FIREWALL_EGRESS_RULES (0 references)
>  pkts bytes target     prot opt in     out     source               destination
> Chain FW_OUTBOUND (1 references)
>  pkts bytes target     prot opt in     out     source               destination
>     3   252 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0       
    state RELATED,ESTABLISHED



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message