mirror of
https://github.com/apache/cloudstack
synced 2026-08-06 18:51:34 +00:00
83f705ddc5
* Fix static routes to be added to PBR tables in VPC routers Static routes were only being added to the main routing table, but policy-based routing (PBR) is active on VPC routers. This caused traffic coming in from specific interfaces to not find the static routes, as they use interface-specific routing tables (Table_ethX). This fix: - Adds a helper method to find which interface a gateway belongs to by matching the gateway IP against configured interface subnets - Modifies route add/delete operations to update both the main table and the appropriate interface-specific PBR table - Uses existing CsAddress databag metadata to avoid OS queries - Handles both add and revoke operations for proper cleanup - Adds comprehensive logging for troubleshooting Fixes #12857 * Add iptables FORWARD rules for nexthop-based static routes When static routes use nexthop (gateway) instead of referencing a private gateway's public IP, the iptables FORWARD rules were not being generated. This caused traffic to be dropped by ACLs. This fix: - Adds a shared helper CsHelper.find_device_for_gateway() to determine which interface a gateway belongs to by checking subnet membership - Updates CsStaticRoutes to use the shared helper instead of duplicating the device-finding logic - Modifies CsAddress firewall rule generation to handle both old-style (ip_address-based) and new-style (nexthop-based) static routes - Generates the required FORWARD and PREROUTING rules for nexthop routes: * -A PREROUTING -s <network> ! -d <interface_ip>/32 -i <dev> -j ACL_OUTBOUND_<dev> * -A FORWARD -d <network> -o <dev> -j ACL_INBOUND_<dev> * -A FORWARD -d <network> -o <dev> -m state --state RELATED,ESTABLISHED -j ACCEPT Fixes the second part of #12857 * network matching grep fix, don't let 1.2.3.4/32 match 11.2.3.4/32
78 lines
3.3 KiB
Python
Executable File
78 lines
3.3 KiB
Python
Executable File
#!/usr/bin/python
|
|
# -- coding: utf-8 --
|
|
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
import logging
|
|
from . import CsHelper
|
|
from .CsDatabag import CsDataBag
|
|
from .CsRoute import CsRoute
|
|
|
|
|
|
class CsStaticRoutes(CsDataBag):
|
|
|
|
def process(self):
|
|
logging.debug("Processing CsStaticRoutes file ==> %s" % self.dbag)
|
|
for item in self.dbag:
|
|
if item == "id":
|
|
continue
|
|
self.__update(self.dbag[item])
|
|
|
|
|
|
|
|
def __update(self, route):
|
|
network = route['network']
|
|
gateway = route['gateway']
|
|
|
|
if route['revoke']:
|
|
# Delete from main table
|
|
command = "ip route del %s via %s" % (network, gateway)
|
|
CsHelper.execute(command)
|
|
|
|
# Delete from PBR table if applicable
|
|
device = CsHelper.find_device_for_gateway(self.config, gateway)
|
|
if device:
|
|
cs_route = CsRoute()
|
|
table_name = cs_route.get_tablename(device)
|
|
command = "ip route del %s via %s table %s" % (network, gateway, table_name)
|
|
CsHelper.execute(command)
|
|
logging.info("Deleted static route %s via %s from PBR table %s" % (network, gateway, table_name))
|
|
else:
|
|
# Add to main table (existing logic)
|
|
command = "ip route show | grep '^%s' | awk '{print $1, $3}'" % network
|
|
result = CsHelper.execute(command)
|
|
if not result:
|
|
route_command = "ip route add %s via %s" % (network, gateway)
|
|
CsHelper.execute(route_command)
|
|
logging.info("Added static route %s via %s to main table" % (network, gateway))
|
|
|
|
# Add to PBR table if applicable
|
|
device = CsHelper.find_device_for_gateway(self.config, gateway)
|
|
if device:
|
|
cs_route = CsRoute()
|
|
table_name = cs_route.get_tablename(device)
|
|
# Check if route already exists in the PBR table
|
|
check_command = "ip route show table %s | grep '^%s' | awk '{print $1, $3}'" % (table_name, network)
|
|
result = CsHelper.execute(check_command)
|
|
if not result:
|
|
# Add route to the interface-specific table
|
|
route_command = "ip route add %s via %s dev %s table %s" % (network, gateway, device, table_name)
|
|
CsHelper.execute(route_command)
|
|
logging.info("Added static route %s via %s to PBR table %s" % (network, gateway, table_name))
|
|
else:
|
|
logging.info("Static route %s via %s added to main table only (no matching interface found for PBR table)" % (network, gateway))
|
