Repository navigation
Conversation
boring-cyborg
Bot
added
component:networking
component:virtual-router
Python
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #13200 +/- ##
============================================
- Coverage 19.65% 19.64% -0.01%
+ Complexity 19792 19790 -2
============================================
Files 6368 6368
Lines 575107 575137 +30
Branches 70370 70372 +2
============================================
- Hits 113016 112998 -18
- Misses 449808 449854 +46
- Partials 12283 12285 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
bc506f4 to
4a9d0f4
Compare
|
@blueorangutan package |
|
@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17959 |
|
@blueorangutan package |
|
@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 17986 |
|
@blueorangutan package |
|
@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 17987 |
|
This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch. |
| logger.debug("Unable to find destination NIC for ip [{}] in network [{}], assuming default NIC.", destinationIp, networkId); | ||
| return false; | ||
| } | ||
| return !destinationNic.isDefaultNic(); |
There was a problem hiding this comment.
what happens if the user changes the default network card of the vm later? the static nat rules arent sent again, so the router keeps the old setup and replies go out the wrong way again
There was a problem hiding this comment.
good catch. I will re-apply the static NAT and port forwarding rules after the default NIC is updated
| internal_vr_ip = self.getGuestIpByIp(rule["internal_ip"]) | ||
| if internal_device and internal_vr_ip and internal_device != device: | ||
| self.fw.append(["nat", "front", | ||
| "-A POSTROUTING -o %s -d %s/32 -j SNAT --to-source %s" % (internal_device, rule["internal_ip"], internal_vr_ip)]) |
There was a problem hiding this comment.
with this the vm sees every connection as coming from the router instead of the real client. should the setting description say that, since it breaks client ip logging and ip based rules inside the vm?
There was a problem hiding this comment.
makes sense, will update the description.
|
thanks @Damans227 for your review and good feedback. It seems reasonable to move this pr to draft while I work upon it. |
Description
This PR intends to fix #8366
When CloudStack VR forwards traffic to a VM whose NIC is not the VM's default, the VM may reply via its default NIC (asymmetric routing). To force symmetric routing we SNAT the forwarded packet's source to the VR’s guest IP on the VM subnet so the VM replies on-link back to that VR interface. Also fix the port-forwarding SNAT to pick the correct VR guest IP for the VM's subnet
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?