From 9e9ae52dbfad61aa0c15b3724a7ea6bec644e64f Mon Sep 17 00:00:00 2001 From: Naredula Janardhana Reddy Date: Tue, 9 Aug 2011 00:08:07 +0530 Subject: [PATCH 1/3] Revert "bug 10561: Allowing ICMP traffic through static NAT" This reverts commit 5e74e24bb359456967866cb2c6cc0f6f73570f97. --- .../systemvm/debian/config/root/firewall.sh | 14 +----- .../cloud/network/rules/RulesManagerImpl.java | 44 +------------------ 2 files changed, 3 insertions(+), 55 deletions(-) diff --git a/patches/systemvm/debian/config/root/firewall.sh b/patches/systemvm/debian/config/root/firewall.sh index 201aa45ac74..84cbab75d5f 100755 --- a/patches/systemvm/debian/config/root/firewall.sh +++ b/patches/systemvm/debian/config/root/firewall.sh @@ -126,22 +126,12 @@ one_to_one_fw_entry() { # shortcircuit the process if error and it is an append operation # continue if it is delete - if [ $proto == "icmp" ] - then - (sudo iptables -t nat $op PREROUTING -i $dev -d $publicIp --proto $proto \ - -j DNAT \ - --to-destination $instIp &>> $OUTFILE || [ "$op" == "-D" ]) && - (sudo iptables $op FORWARD -i $dev -o eth0 -d $instIp --proto $proto \ - -m state \ - --state NEW -j ACCEPT &>> $OUTFILE ) - else - (sudo iptables -t nat $op PREROUTING -i $dev -d $publicIp --proto $proto \ + (sudo iptables -t nat $op PREROUTING -i $dev -d $publicIp --proto $proto \ --destination-port $portRange -j DNAT \ --to-destination $instIp &>> $OUTFILE || [ "$op" == "-D" ]) && - (sudo iptables $op FORWARD -i $dev -o eth0 -d $instIp --proto $proto \ + (sudo iptables $op FORWARD -i $dev -o eth0 -d $instIp --proto $proto \ --destination-port $portRange -m state \ --state NEW -j ACCEPT &>> $OUTFILE ) - fi result=$? logger -t cloud "$(basename $0): done firewall entry public ip=$publicIp op=$op result=$result" diff --git a/server/src/com/cloud/network/rules/RulesManagerImpl.java b/server/src/com/cloud/network/rules/RulesManagerImpl.java index 698894298fa..b7fed50a783 100755 --- a/server/src/com/cloud/network/rules/RulesManagerImpl.java +++ b/server/src/com/cloud/network/rules/RulesManagerImpl.java @@ -424,28 +424,8 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager { ipAddress.setOneToOneNat(true); ipAddress.setAssociatedWithVmId(vmId); - if ( _ipAddressDao.update(ipAddress.getId(), ipAddress)) - { - List staticNatRules = new ArrayList(); - - FirewallRuleVO ruleVO = new FirewallRuleVO(null, ipAddress.getId(), 0, 0, "icmp", - networkId,vm.getAccountId(), vm.getDomainId(), Purpose.StaticNat); + return _ipAddressDao.update(ipAddress.getId(), ipAddress); - staticNatRules.add(new StaticNatRuleImpl(ruleVO, guestNic.getIp4Address())); - - try { - if (!applyRules(staticNatRules, true)) { - return false; - } - - } catch (ResourceUnavailableException ex) { - s_logger.warn("Failed to apply icmp firewall rules due to ", ex); - return false; - } - return true; - - } - return false; } @DB @@ -1121,29 +1101,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager { s_logger.warn("Unable to revoke all static nat rules for ip " + ipAddress); success = false; } - if (success) - { - long vmId = ipAddress.getAssociatedWithVmId(); - Nic guestNic = _networkMgr.getNicInNetwork(vmId, ipAddress.getAssociatedWithNetworkId()); - if (guestNic == null) { - throw new InvalidParameterValueException("Vm doesn't belong to the network " + ipAddress.getAssociatedWithNetworkId()); - } - List staticNatRules = new ArrayList(); - FirewallRuleVO ruleVO = new FirewallRuleVO(null, ipAddress.getId(), 0, 0, "icmp", - ipAddress.getAssociatedWithNetworkId(),ipAddress.getAccountId(), ipAddress.getDomainId(), Purpose.StaticNat); - ruleVO.setState(State.Revoke); - staticNatRules.add(new StaticNatRuleImpl(ruleVO, guestNic.getIp4Address())); - - try { - if (!applyRules(staticNatRules, true)) { - return false; - } - } catch (ResourceUnavailableException ex) { - s_logger.warn("Failed to apply icmp firewall rules due to ", ex); - return false; - } - } if (success) { ipAddress.setOneToOneNat(false); ipAddress.setAssociatedWithVmId(null); From 84fe6c3863af8284a032764a965f9f9844d48e02 Mon Sep 17 00:00:00 2001 From: Sheng Yang Date: Mon, 8 Aug 2011 13:35:17 -0700 Subject: [PATCH 2/3] bug 11003: Fix HAproxy with new template New debian package didn't create directory /var/lib/haproxy, which result in haproxy fail to work. status 11003: resolved fixed --- patches/systemvm/debian/config/etc/init.d/cloud-early-config | 3 +++ 1 file changed, 3 insertions(+) diff --git a/patches/systemvm/debian/config/etc/init.d/cloud-early-config b/patches/systemvm/debian/config/etc/init.d/cloud-early-config index 015976a381a..96743bdcf34 100755 --- a/patches/systemvm/debian/config/etc/init.d/cloud-early-config +++ b/patches/systemvm/debian/config/etc/init.d/cloud-early-config @@ -12,6 +12,9 @@ PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin" +# Fix haproxy directory issue +mkdir -p /var/lib/haproxy + [ -x /sbin/ifup ] || exit 0 . /lib/lsb/init-functions From 19189f1d0f5fc753439afe4c1ef6f62d6a9104ad Mon Sep 17 00:00:00 2001 From: anthony Date: Mon, 8 Aug 2011 15:24:49 -0700 Subject: [PATCH 3/3] For some NFS Servers, mount option tcp is required --- .../vm/hypervisor/xenserver/copy_vhd_from_secondarystorage.sh | 2 +- .../vm/hypervisor/xenserver/copy_vhd_to_secondarystorage.sh | 2 +- .../xenserver/create_privatetemplate_from_snapshot.sh | 4 ++-- scripts/vm/hypervisor/xenserver/upgrade_snapshot.sh | 4 ++-- scripts/vm/hypervisor/xenserver/vmopsSnapshot | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/scripts/vm/hypervisor/xenserver/copy_vhd_from_secondarystorage.sh b/scripts/vm/hypervisor/xenserver/copy_vhd_from_secondarystorage.sh index d7b9d0bb24d..b38ac13b93d 100755 --- a/scripts/vm/hypervisor/xenserver/copy_vhd_from_secondarystorage.sh +++ b/scripts/vm/hypervisor/xenserver/copy_vhd_from_secondarystorage.sh @@ -48,7 +48,7 @@ if [ $? -ne 0 ]; then exit 0 fi -mount $mountpoint $localmp -r +mount -o tcp,ro $mountpoint $localmp if [ $? -ne 0 ]; then echo "6#can't mount $mountpoint to $localmp" exit 0 diff --git a/scripts/vm/hypervisor/xenserver/copy_vhd_to_secondarystorage.sh b/scripts/vm/hypervisor/xenserver/copy_vhd_to_secondarystorage.sh index 8ef26471510..53f7f77db08 100755 --- a/scripts/vm/hypervisor/xenserver/copy_vhd_to_secondarystorage.sh +++ b/scripts/vm/hypervisor/xenserver/copy_vhd_to_secondarystorage.sh @@ -56,7 +56,7 @@ if [ $? -ne 0 ]; then exit 0 fi -mount $mountpoint $localmp +mount -o tcp $mountpoint $localmp if [ $? -ne 0 ]; then echo "6#can't mount $mountpoint to $localmp" exit 0 diff --git a/scripts/vm/hypervisor/xenserver/create_privatetemplate_from_snapshot.sh b/scripts/vm/hypervisor/xenserver/create_privatetemplate_from_snapshot.sh index 1b55501e7f4..a23111df12f 100755 --- a/scripts/vm/hypervisor/xenserver/create_privatetemplate_from_snapshot.sh +++ b/scripts/vm/hypervisor/xenserver/create_privatetemplate_from_snapshot.sh @@ -47,7 +47,7 @@ if [ $? -ne 0 ]; then exit 0 fi -mount $snapshoturl $snapshotdir +mount -o tcp $snapshoturl $snapshotdir if [ $? -ne 0 ]; then rmdir $snapshotdir echo "5#can not mount $snapshoturl to $snapshotdir" @@ -63,7 +63,7 @@ if [ $? -ne 0 ]; then exit 0 fi -mount $templateurl $templatedir +mount -o tcp $templateurl $templatedir if [ $? -ne 0 ]; then rmdir $templatedir templatedir="" diff --git a/scripts/vm/hypervisor/xenserver/upgrade_snapshot.sh b/scripts/vm/hypervisor/xenserver/upgrade_snapshot.sh index 0da5debb77e..e8d891fb0d6 100755 --- a/scripts/vm/hypervisor/xenserver/upgrade_snapshot.sh +++ b/scripts/vm/hypervisor/xenserver/upgrade_snapshot.sh @@ -46,7 +46,7 @@ if [ $? -ne 0 ]; then exit 0 fi -mount $snapshoturl $snapshotdir +mount -o tcp $snapshoturl $snapshotdir if [ $? -ne 0 ]; then rmdir $snapshotdir echo "5#can not mount $snapshoturl to $snapshotdir" @@ -62,7 +62,7 @@ if [ $? -ne 0 ]; then exit 0 fi -mount $templateurl $templatedir +mount -o tcp $templateurl $templatedir if [ $? -ne 0 ]; then rmdir $templatedir templatedir="" diff --git a/scripts/vm/hypervisor/xenserver/vmopsSnapshot b/scripts/vm/hypervisor/xenserver/vmopsSnapshot index 21c263e87dd..5641ad12874 100755 --- a/scripts/vm/hypervisor/xenserver/vmopsSnapshot +++ b/scripts/vm/hypervisor/xenserver/vmopsSnapshot @@ -286,7 +286,7 @@ def mount(remoteDir, localDir): makedirs(localDir) try: - cmd = ['mount', remoteDir, localDir] + cmd = ['mount', '-o', 'tcp', remoteDir, localDir] txt = util.pread2(cmd) except: txt = ''