Skip to content

Routed VR: accept VRRP and conntrackd sync on redundant routers #14446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hulucc wants to merge 1 commit into
base: 4.20
Choose a base branch
from
+45 −1
Open

Routed VR: accept VRRP and conntrackd sync on redundant routers #14446

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions systemvm/debian/opt/cloud/bin/cs/CsAddress.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -660,6 +660,12 @@ def fw_router_routing(self):
'rule': "iifname %s ct state related,established counter accept" % self.dev})
self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
'rule': "iifname %s udp dport 67 counter accept" % self.dev})
# VRRP (keepalived) and conntrackd sync between redundant routers; the iptables
# path allows these via "-A INPUT -d 224.0.0.18/32" and "-d 225.0.0.50/32".
self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
'rule': "iifname %s ip daddr 224.0.0.18 counter accept" % self.dev})
self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
'rule': "iifname %s ip daddr 225.0.0.50 counter accept" % self.dev})
self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
'rule': "iifname %s ip saddr %s tcp dport 53 counter accept" % (self.dev, guestNetworkCidr)})
self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
Expand Down Expand Up @@ -687,6 +693,12 @@ def fw_vpcrouter_routing(self):
'rule': "iifname %s ct state related,established counter accept" % self.dev})
self.nft_ipv4_acl.append({'type': "", 'chain': 'INPUT',
'rule': "iifname %s udp dport 67 counter accept" % self.dev})
# VRRP (keepalived) and conntrackd sync between redundant routers; the iptables
# path allows these via "-A INPUT -d 224.0.0.18/32" and "-d 225.0.0.50/32".
self.nft_ipv4_acl.append({'type': "", 'chain': 'INPUT',
'rule': "iifname %s ip daddr 224.0.0.18 counter accept" % self.dev})
self.nft_ipv4_acl.append({'type': "", 'chain': 'INPUT',
'rule': "iifname %s ip daddr 225.0.0.50 counter accept" % self.dev})
self.nft_ipv4_acl.append({'type': "", 'chain': 'INPUT',
'rule': "iifname %s ip saddr %s tcp dport 53 counter accept" % (self.dev, guestNetworkCidr)})
self.nft_ipv4_acl.append({'type': "", 'chain': 'INPUT',
Expand Down
34 changes: 33 additions & 1 deletion systemvm/test/TestCsAddress.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@
# under the License.

import unittest
from cs.CsAddress import CsAddress
import mock
from cs.CsAddress import CsAddress, CsIP
import merge


Expand All @@ -39,5 +40,36 @@ def test_get_guest_netmask(self):
self.assertTrue(self.csaddress.get_guest_netmask() == "255.255.255.0")


class TestCsIPRouted(unittest.TestCase):

def routed_guest_ip(self, dev, is_vpc):
config = mock.MagicMock()
config.is_vpc.return_value = is_vpc
config.is_routed.return_value = True
config.get_nft_ipv4_fw.return_value = []
config.get_nft_ipv4_acl.return_value = []
with mock.patch.object(CsIP, 'list'):
ip = CsIP(dev, config)
ip.setAddress({"nw_type": "guest", "network": "10.1.1.0/24"})
return ip

def input_rules(self, rules):
return [rule['rule'] for rule in rules if rule['chain'] == 'INPUT']

def test_fw_router_routing_accepts_vrrp_and_conntrackd(self):
ip = self.routed_guest_ip("eth0", False)
ip.fw_router_routing()
rules = self.input_rules(ip.nft_ipv4_fw)
self.assertIn("iifname eth0 ip daddr 224.0.0.18 counter accept", rules)
self.assertIn("iifname eth0 ip daddr 225.0.0.50 counter accept", rules)

def test_fw_vpcrouter_routing_accepts_vrrp_and_conntrackd(self):
ip = self.routed_guest_ip("eth2", True)
ip.fw_vpcrouter_routing()
rules = self.input_rules(ip.nft_ipv4_acl)
self.assertIn("iifname eth2 ip daddr 224.0.0.18 counter accept", rules)
self.assertIn("iifname eth2 ip daddr 225.0.0.50 counter accept", rules)


if __name__ == '__main__':
unittest.main()
Loading