ipv6: set default_egress_policy for ingress rules - #6364
Conversation
The issue is found in the smoke test `test/integration/smoke/test_network_ipv6.py`.
sometimes the test failed with error below
```
FAIL: Test to verify IPv6 network
----------------------------------------------------------------------
Traceback (most recent call last):
File "/usr/local/lib/python3.6/site-packages/marvin/lib/decoratorGenerators.py", line 30, in test_wrapper
return test(self, *args, **kwargs)
File "/marvin/test_network_ipv6.py", line 1215, in test_01_verify_ipv6_network
self.checkNetworkRouting()
File "/marvin/test_network_ipv6.py", line 1060, in checkNetworkRouting
"Ping from VM %s of network %s to VM %s of network %s is unsuccessful" % (self.routing_test_vm.id, self.routing_test_network.id, self.virtual_machine.id, self.network.id))
AssertionError: False is not true : Ping from VM 0aa36a76-09c6-476f-97c5-b9cea27a5b7c of network 27a2b244-e319-46c5-a779-d6ae73eb9ac2 to VM ae13ea17-1f35-4ca7-83c1-e13126f8df79 of network 1f38a686-69f3-41ed-a75e-cd3f822497d8 is unsuccessful
```
After investigation, we found the egress traffic is dropped by `nft`.
a correct nft chain looks like
```
root@r-282-VM:~# nft list chain ip6 ip6_firewall fw_chain_egress
table ip6 ip6_firewall {
chain fw_chain_egress {
counter packets 0 bytes 0 accept
}
}
```
However, some VRs has the following nft chain
```
root@r-280-VM:~# nft list chain ip6 ip6_firewall fw_chain_egress
table ip6 ip6_firewall {
chain fw_chain_egress {
counter packets 0 bytes 0 drop
}
}
```
It is because the ingress rule does not have correct `default_egress_policy`
```
root@r-280-VM:~# cat /etc/cloudstack/ipv6firewallrules.json
{
"0": {
"already_added": false,
"default_egress_policy": true,
"dest_cidr_list": [],
"guest_ip6_cidr": "fd17:ac56:1234:1a96::/64",
"id": 0,
"protocol": "all",
"purpose": "Ipv6Firewall",
"revoked": false,
"source_cidr_list": [],
"src_ip": "",
"traffic_type": "Egress"
},
"1263": {
"already_added": false,
"default_egress_policy": false,
"dest_cidr_list": [
"::/0"
],
"guest_ip6_cidr": "fd17:ac56:1234:1a96::/64",
"icmp_code": -1,
"icmp_type": -1,
"id": 1263,
"protocol": "icmp",
"purpose": "Ipv6Firewall",
"revoked": false,
"source_cidr_list": [
"::/0"
],
"traffic_type": "Ingress"
},
"id": "ipv6firewallrules"
}
```
in mose time, the Egress rule is processed before Ingress rule.
But when the Ingress rule is processed at first, the nft chain will be wrong.
|
@blueorangutan package |
|
@weizhouapache a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 3362 |
|
Kudos, SonarCloud Quality Gate passed! |
|
@blueorangutan package |
|
@weizhouapache a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
|
Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 3363 |
|
@blueorangutan test |
|
@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests |
|
Trillian Build Failed (tid-4130) |
|
@blueorangutan test matrix |
|
@weizhouapache a Trillian-Jenkins matrix job (centos7 mgmt + xs71, centos7 mgmt + vmware65, centos7 mgmt + kvmcentos7) has been kicked to run smoke tests |
|
@blueorangutan test centos7 vmware-70u3 |
|
@weizhouapache a Trillian-Jenkins test job (centos7 mgmt + vmware-70u3) has been kicked to run smoke tests |
|
@blueorangutan test ubuntu20 kvm-ubuntu20 |
|
@weizhouapache a Trillian-Jenkins test job (ubuntu20 mgmt + kvm-ubuntu20) has been kicked to run smoke tests |
|
Trillian Build Failed (tid-4141) |
|
Trillian Build Failed (tid-4143) |
shwstppr
left a comment
shwstppr
left a comment
There was a problem hiding this comment.
LGTM
Ran smoke test from #6338 to test different scenarios in addition to manually testing IPv6 Firewall rules
Test to verify IPv6 network ... === TestName: test_01_verify_ipv6_network | Status : SUCCESS ===
ok
Test to verify redundant IPv6 network ... === TestName: test_02_verify_ipv6_network_redundant | Status : SUCCESS ===
ok
Test to verify IPv4 network upgraded to IPv6 network ... === TestName: test_03_verify_upgraded_ipv6_network | Status : SUCCESS ===
ok
Test to verify redundant IPv4 network upgraded to redundant IPv6 network ... === TestName: test_04_verify_upgraded_ipv6_network_redundant | Status : SUCCESS ===
ok
----------------------------------------------------------------------
Ran 4 tests in 1694.090s
OK
|
Trillian Build Failed (tid-4146) |
|
Trillian test result (tid-4144)
|
|
Trillian test result (tid-4145)
|
|
Trillian test result (tid-4142)
|
|
Trillian test result (tid-4148)
|
|
Trillian test result (tid-4147)
|
4 participants
Description
This PR fixes an issue we found in the smoke test
test/integration/smoke/test_network_ipv6.py.sometimes the test failed with error below
After investigation, we found the egress traffic is dropped by
nft.a correct nft chain looks like
However, some VRs have the following nft chain
It is because the ingress rule does not have correct
default_egress_policyin mose time, the Egress rule is processed before Ingress rule.
But when the Ingress rule is processed at first, the nft chain will be wrong.
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?