Skip to content

SSVM: 'allow from' private IP in other SSVMs if the public IP is in allowed internal sites cidrs #7288

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DaanHoogland merged 2 commits into from
Jul 20, 2023
Merged

SSVM: 'allow from' private IP in other SSVMs if the public IP is in allowed internal sites cidrs #7288

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ef94c1c
SSVM: 'allow from' private IP of other SSVMs if the IP is in allowed …
weizhouapache Feb 24, 2023
a0e2d00
Update systemvm/agent/scripts/ipfirewall.sh
weizhouapache May 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions core/src/main/java/com/cloud/storage/template/TemplateConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,12 +27,10 @@ public final class TemplateConstants {

public static final String DEFAULT_SYSTEM_VM_TEMPLATE_PATH = "template/tmpl/1/";

public static final String DEFAULT_SYSTEM_VM_TMPLT_NAME = "routing";

public static final int DEFAULT_TMPLT_COPY_PORT = 80;
public static final String DEFAULT_TMPLT_COPY_INTF = "eth2";
public static final String TMPLT_COPY_INTF_PRIVATE = "eth1";

public static final String DEFAULT_SSL_CERT_DOMAIN = "realhostip.com";
public static final String DEFAULT_HTTP_AUTH_USER = "cloud";

}
36 changes: 29 additions & 7 deletions ...ler/src/main/java/org/apache/cloudstack/secondarystorage/SecondaryStorageManagerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -363,13 +363,7 @@ public boolean generateVMSetupCommand(Long ssAHostId) {

SecStorageVMSetupCommand setupCmd = new SecStorageVMSetupCommand();
if (_allowedInternalSites != null) {
List<String> allowedCidrs = new ArrayList<>();
String[] cidrs = _allowedInternalSites.split(",");
for (String cidr : cidrs) {
if (NetUtils.isValidIp4Cidr(cidr) || NetUtils.isValidIp4(cidr) || !cidr.startsWith("0.0.0.0")) {
allowedCidrs.add(cidr);
}
}
List<String> allowedCidrs = getAllowedInternalSiteCidrs();
setupCmd.setAllowedInternalSites(allowedCidrs.toArray(new String[allowedCidrs.size()]));
}
String copyPasswd = _configDao.getValue("secstorage.copy.password");
Expand All @@ -390,6 +384,20 @@ public boolean generateVMSetupCommand(Long ssAHostId) {
}
}

private List<String> getAllowedInternalSiteCidrs() {
List<String> allowedCidrs = new ArrayList<>();
if (_allowedInternalSites == null) {
return allowedCidrs;
}
String[] cidrs = _allowedInternalSites.split(",");
for (String cidr : cidrs) {
if (NetUtils.isValidIp4Cidr(cidr) || NetUtils.isValidIp4(cidr) || !cidr.startsWith("0.0.0.0")) {
allowedCidrs.add(cidr);
}
}
return allowedCidrs;
}

@Override
public Pair<HostVO, SecondaryStorageVmVO> assignSecStorageVm(long zoneId, Command cmd) {
return null;
Expand All @@ -414,6 +422,9 @@ public boolean generateFirewallConfiguration(Long ssAHostId) {
SecStorageFirewallCfgCommand thiscpc = new SecStorageFirewallCfgCommand(true);
thiscpc.addPortConfig(thisSecStorageVm.getPublicIpAddress(), copyPort, true, TemplateConstants.DEFAULT_TMPLT_COPY_INTF);

List<String> allowedCidrs = getAllowedInternalSiteCidrs();
addPortConfigForPrivateIpToCommand(thiscpc, allowedCidrs, thisSecStorageVm.getPrivateIpAddress(), thisSecStorageVm.getPublicIpAddress(), copyPort);

QueryBuilder<HostVO> sc = QueryBuilder.create(HostVO.class);
sc.and(sc.entity().getType(), Op.EQ, Host.Type.SecondaryStorageVM);
sc.and(sc.entity().getStatus(), Op.IN, Status.Up, Status.Connecting);
Expand Down Expand Up @@ -443,6 +454,7 @@ public boolean generateFirewallConfiguration(Long ssAHostId) {
continue;
}
allSSVMIpList.addPortConfig(ssvm.getPublicIpAddress(), copyPort, true, TemplateConstants.DEFAULT_TMPLT_COPY_INTF);
addPortConfigForPrivateIpToCommand(allSSVMIpList, allowedCidrs, ssvm.getPrivateIpAddress(), ssvm.getPublicIpAddress(), copyPort);
}

hostName = thisSecStorageVm.getHostName();
Expand All @@ -463,6 +475,16 @@ public boolean generateFirewallConfiguration(Long ssAHostId) {

}

private void addPortConfigForPrivateIpToCommand(SecStorageFirewallCfgCommand command, List<String> allowedCidrs,
String privateIpAddress, String publicIpAddress, String copyPort) {
for (String allowCidr : allowedCidrs) {
if (NetUtils.isIpWithInCidrRange(publicIpAddress, allowCidr)) {
command.addPortConfig(privateIpAddress, copyPort, true, TemplateConstants.TMPLT_COPY_INTF_PRIVATE);
break;
}
}
}

protected boolean isSecondaryStorageVmRequired(long dcId) {
DataCenterVO dc = _dcDao.findById(dcId);
_dcDao.loadDetails(dc);
Expand Down
2 changes: 1 addition & 1 deletion systemvm/agent/scripts/ipfirewall.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ config_htaccess() {
}

ips(){
echo "allow from $1" >> $HTACCESS
grep -e "^allow from $1$" $HTACCESS || echo "allow from $1" >> $HTACCESS
result=$?
return $result
}
Expand Down