CLOUDSTACK-8688 - default policies for INPUT and FORWARD should be se… #765

wilderrodrigues · 2015-08-31T12:12:35Z

…t to DROP instead of ACCEPT

In order to be able to access the routers via the link local interface, we have to add a rules with NEW and ESTABLISHED state

Tests:

Deployed 2 zones, basic and advanced, using KVM as hypervisor
On the basic zone, created 1 security group, added ingress rules to open port 22 and deployed 1 VM
- SSH into the router and checked that the INPUT/FORWARD policies were set to DROP
- SSH to the VM

On the advanced zone, created 1 single VPC (with 2 tiers, 2 puc IPs, 2 VMs and 1 ACL), 1 redundant VPC ((with 2 tiers, 2 puc IPs, 2 VMs and 1 ACL)), 1 isolated network (with 1 VM and 1 pub IP), 1 redundant network (with 1 VM and 1 pub IP)

SSH into all routers to check that the INPUT/FORWARD policies were set to DROP
SSH into all VMs to test the communication

sbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.26
The authenticity of host '192.168.23.26 (192.168.23.26)' can't be established.
RSA key fingerprint is cb:42:81:d0:05:97:f4:be:9e:3b:dd:3f:c6:d2:48:e7.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.23.26' (RSA) to the list of known hosts.
root@192.168.23.26's password: 
# ls /
bin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var
# exit
Connection to 192.168.23.26 closed.

sbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.22.63
The authenticity of host '192.168.22.63 (192.168.22.63)' can't be established.
RSA key fingerprint is a2:20:d6:e2:fb:c5:89:94:57:f5:89:b1:a1:6d:63:99.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.22.63' (RSA) to the list of known hosts.
root@192.168.22.63's password: 
# ls /
bin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var
# exit
Connection to 192.168.22.63 closed.

sbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.27 
The authenticity of host '192.168.23.27 (192.168.23.27)' can't be established.
RSA key fingerprint is 20:f1:6d:9b:74:c5:7b:53:10:5c:a0:0c:bc:9f:2a:29.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.23.27' (RSA) to the list of known hosts.
root@192.168.23.27's password: 
# ls /
bin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var
# exitConnection to 192.168.23.27 closed.

sbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.28
The authenticity of host '192.168.23.28 (192.168.23.28)' can't be established.
RSA key fingerprint is f7:ae:49:46:ba:02:c1:25:5a:50:87:0e:6f:a4:43:a3.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.23.28' (RSA) to the list of known hosts.
root@192.168.23.28's password: 
# ls /
bin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var
# exitConnection to 192.168.23.28 closed.

sbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.29
The authenticity of host '192.168.23.29 (192.168.23.29)' can't be established.
RSA key fingerprint is 09:0c:f2:41:a3:74:3d:ee:04:2b:78:ff:a9:91:0d:79.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.23.29' (RSA) to the list of known hosts.
root@192.168.23.29's password: 
# ls /
bin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var
# exit
Connection to 192.168.23.29 closed.

sbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.30
The authenticity of host '192.168.23.30 (192.168.23.30)' can't be established.
RSA key fingerprint is 2c:a6:10:f5:6d:4b:d1:70:e2:47:07:19:0b:86:c1:b0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.23.30' (RSA) to the list of known hosts.
root@192.168.23.30's password: 
# ls /
bin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var
# exitConnection to 192.168.23.30 closed.

sbpltk1zffh04:asf_cloudstack wrodrigues$ ssh root@192.168.23.32
The authenticity of host '192.168.23.32 (192.168.23.32)' can't be established.
RSA key fingerprint is 6b:85:1e:c7:2e:aa:01:a2:d4:19:e3:ec:a7:69:a1:71.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.23.32' (RSA) to the list of known hosts.
root@192.168.23.32's password: 
# ls /
bin         boot        dev         etc         home        lib         lib64       linuxrc     lost+found  media       mnt         opt         proc        root        run         sbin        sys         tmp         usr         var
# exitConnection to 192.168.23.32 closed.
sbpltk1zffh04:asf_cloudstack wrodrigues$

I'm now running some automated tests, will post the results here once they are complete.

@remibergsma @DaanHoogland @bhaisaab @miguelaferreira @wido @karuturi , could you guys please have a look?

Do not forget to replace the systemvm.iso in your hypervisor. Do the following for KVM:

Copy this:
- ./client/target/cloud-client-ui-4.6.0-SNAPSHOT/WEB-INF/classes/vms/systemvm.iso
To:
- /usr/share/cloudstack-common/vms/systemvm.iso

Cheers,
Wilder

…t to DROP instead of ACCEPT - In order to be able to access the routers via the link local interface, we have to add a rules with NEW and ESTABLISHED state

wilderrodrigues · 2015-08-31T12:14:03Z

Some screenshots:

VMs:

Infra:

Routers:

asfbot · 2015-08-31T12:14:07Z

cloudstack-pull-rats #454 SUCCESS
This pull request looks good

wilderrodrigues · 2015-08-31T12:54:31Z

VM Life Cycle tests (Advanced Zone)

[root@cs1 integration]# nosetests --with-marvin --marvin-config=/data/shared/marvin/mct-zone2-kvm2-ISOLATED.cfg -s -a tags=advanced,required_hardware=false smoke/test_vm_life_cycle.py 

==== Marvin Init Started ====

=== Marvin Parse Config Successful ===

=== Marvin Setting TestData Successful===

==== Log Folder Path: /tmp//MarvinLogs//Aug_31_2015_12_14_38_JN3PBD. All logs will be available here ====

=== Marvin Init Logging Successful===

==== Marvin Init Successful ====
=== TestName: test_advZoneVirtualRouter | Status : SUCCESS ===

=== TestName: test_deploy_vm | Status : SUCCESS ===

=== TestName: test_deploy_vm_multiple | Status : SUCCESS ===

=== TestName: test_01_stop_vm | Status : SUCCESS ===

=== TestName: test_02_start_vm | Status : SUCCESS ===

=== TestName: test_03_reboot_vm | Status : SUCCESS ===

=== TestName: test_06_destroy_vm | Status : SUCCESS ===

=== TestName: test_07_restore_vm | Status : SUCCESS ===

=== TestName: test_09_expunge_vm | Status : SUCCESS ===

===final results are now copied to: /tmp//MarvinLogs/test_vm_life_cycle_L0WK32===
[root@cs1 integration]#

VM Life Cycle tests (Basic Zone)

[root@cs1 integration]# nosetests --with-marvin --marvin-config=/data/shared/marvin/mct-zone1-kvm1-basic.cfg -s -a tags=basic,required_hardware=false smoke/test_vm_life_cycle.py 

==== Marvin Init Started ====

=== Marvin Parse Config Successful ===

=== Marvin Setting TestData Successful===

==== Log Folder Path: /tmp//MarvinLogs//Aug_31_2015_12_41_40_5VQUD2. All logs will be available here ====

=== Marvin Init Logging Successful===

==== Marvin Init Successful ====
=== TestName: test_deploy_vm | Status : SUCCESS ===

=== TestName: test_deploy_vm_multiple | Status : SUCCESS ===

=== TestName: test_01_stop_vm | Status : SUCCESS ===

=== TestName: test_02_start_vm | Status : SUCCESS ===

=== TestName: test_03_reboot_vm | Status : SUCCESS ===

=== TestName: test_06_destroy_vm | Status : SUCCESS ===

=== TestName: test_07_restore_vm | Status : SUCCESS ===

=== TestName: test_09_expunge_vm | Status : SUCCESS ===

===final results are now copied to: /tmp//MarvinLogs/test_vm_life_cycle_8F4UL3===
[root@cs1 integration]#

asfbot · 2015-08-31T13:23:35Z

cloudstack-pull-analysis #387 SUCCESS
This pull request looks good

wilderrodrigues · 2015-09-01T06:42:46Z

@karuturi @bhaisaab @DaanHoogland @koushik-das

Anyone with some time to have a look at this PR?

Thanks in advance.

Cheers,
Wilder

miguelaferreira · 2015-09-01T07:54:44Z

@wilderrodrigues I'm now testing your PR, but I have a question: how is SSHing into the VMs testing the default policy is set to DROP?

wilderrodrigues · 2015-09-01T07:59:48Z

SSH doesn't test it... I just did to make sure all works as before.

To check the policies to iptables -L --verbose (you will see DROP for INPUT and FORWARD chains on all routers)

You can also try connecting to a port that doesn't have a PF setup.

miguelaferreira · 2015-09-01T08:00:48Z

ok, that's what I thought.

miguelaferreira · 2015-09-01T08:05:05Z

@wilderrodrigues wouldn't it be better to have a Marvin test that checks the policy?
Now that I think of it, also a Python unit-test?

DaanHoogland · 2015-09-01T08:33:51Z

systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py

@@ -414,7 +426,7 @@ def fw_router(self):
        self.fw.append(['', '', '-A NETWORK_STATS -i eth2 -o eth0'])
        self.fw.append(['', '', '-A NETWORK_STATS -o eth2 ! -i eth0 -p tcp'])
        self.fw.append(['', '', '-A NETWORK_STATS -i eth2 ! -o eth0 -p tcp'])
-
+        


trailing white space?

3 days of work to find the cause of the bugs and the thing goes with trailing spaces... crap.

Will remove it once I add a marvin test.

@wilderrodrigues Seems like you hadn't removed the trailing white spaces. Maybe a good time to remove them when PRing CLOUDSTACK-8878 or CLOUDSTACK-8795? :)

DaanHoogland · 2015-09-01T08:35:13Z

changes look reasonable. have not tested, so I am going to trust @wilderrodrigues on this but @miguelaferreira his point on an automation sounds very promising to me.

wilderrodrigues · 2015-09-01T10:19:42Z

Hi @miguelaferreira

Okay for the Marvin test, but then it will make the thing wait for another day, at least. Which is fine, but I hope people LGTM it afterwards. I'm worried about the lack of reviews/tests by reviewers on PRs.

Concerning the unit test, I won't add it because I want to refactor the code as a project and have it done in a way that we can add tests and refactor, as it was done with other components. I know it could be done in a way where I could refactor just 1 method, add a tests and push it. However, I do not want to mix styles in the Python code.

By styles I mean: the way it was developed and the way I would have developed it. So, mixing styles by refactoring 1 method to add 1 test will not really improve it. Once we release 4.6, and if that okay with the team, I, we, will work on the python refactor.

Cheers,
Wilder

miguelaferreira · 2015-09-01T10:28:46Z

@wilderrodrigues ok for the python unit tests, but I would really like a marvin test, or al least some way to automate setting up the environment you described. I'm trying to test this, and clicking around in the UI is just too inefficient.

wilderrodrigues · 2015-09-02T06:37:07Z

I will push a test today to cover the iptables default policies.

Do you need help finding the options on the UI whilst the test gets cooked?

Cheers,
Wilder

karuturi · 2015-09-02T07:37:23Z

tested this on Xen 6.5 advanced zone with isolated and VPC. verified that the default policies are set to drop.

I am not sure if its related to this. But, I found the below issue
in case of vm launched in vpc, outgoing public traffic worked (I was able to ping google.com)
But, in case of default isolated network(DefaultIsolatedNetworkOfferingWithSourceNatService) vm, outgoing public traffic was blocked even after adding egress rule.
It only worked after running the following on isolated VR

iptables -I FW_OUTBOUND -j FIREWALL_EGRESS_RULES

wilderrodrigues · 2015-09-02T11:37:01Z

Thanks for testing it, @karuturi, much appreciated!

I'm writing marvin tests for this PR and the other issue (CLOUDSTACK-8759). Once done, I will have a look at the problem you reported.

In order to keep things separate and move quicker with the PRs, could you please a separate issue with the details above?

Thanks in advance.

Cheers,
Wilder

karuturi · 2015-09-02T12:02:58Z

Ok. Here is the new issue https://issues.apache.org/jira/browse/CLOUDSTACK-8795

👍 for this PR

wilderrodrigues · 2015-09-03T08:38:03Z

Thanks for the LGTM and for the new issue, @karuturi. :)

I will push the test today and merge the PR after @miguelaferreira tests it.

Cheers,
Wilder

asfbot · 2015-09-04T07:37:07Z

cloudstack-pull-rats #489 SUCCESS
This pull request looks good

asfbot · 2015-09-04T08:41:44Z

cloudstack-pull-analysis #422 SUCCESS
This pull request looks good

asfbot · 2015-09-04T09:31:15Z

cloudstack-pull-rats #491 SUCCESS
This pull request looks good

asfbot · 2015-09-04T11:42:55Z

cloudstack-pull-analysis #424 FAILURE
Looks like there's a problem with this pull request

asfbot · 2015-09-04T12:42:58Z

cloudstack-pull-rats #494 SUCCESS
This pull request looks good

asfbot · 2015-09-04T12:45:49Z

cloudstack-pull-rats #495 SUCCESS
This pull request looks good

asfbot · 2015-09-04T12:56:51Z

cloudstack-pull-analysis #427 FAILURE
Looks like there's a problem with this pull request

asfbot · 2015-09-04T13:04:02Z

cloudstack-pull-rats #496 SUCCESS
This pull request looks good

asfbot · 2015-09-04T13:07:35Z

cloudstack-pull-rats #497 SUCCESS
This pull request looks good

asfbot · 2015-09-04T13:09:42Z

cloudstack-pull-rats #498 SUCCESS
This pull request looks good

asfbot · 2015-09-04T13:12:45Z

cloudstack-pull-rats #499 SUCCESS
This pull request looks good

asfbot · 2015-09-04T14:34:17Z

cloudstack-pull-analysis #434 UNSTABLE
Looks like there's a problem with this pull request

asfbot · 2015-09-04T14:44:34Z

cloudstack-pull-analysis #435 SUCCESS
This pull request looks good

asfbot · 2015-09-04T15:06:00Z

cloudstack-pull-analysis #437 UNSTABLE
Looks like there's a problem with this pull request

asfbot · 2015-09-04T15:12:33Z

cloudstack-pull-analysis #438 UNSTABLE
Looks like there's a problem with this pull request

asfbot · 2015-09-05T06:59:32Z

cloudstack-pull-rats #508 SUCCESS
This pull request looks good

asfbot · 2015-09-05T08:12:39Z

cloudstack-pull-analysis #441 SUCCESS
This pull request looks good

karuturi · 2015-09-07T08:45:11Z

@miguelaferreira @wilderrodrigues waiting for the PR merge :)

miguelaferreira · 2015-09-07T09:32:44Z

@karuturi Wilder will add marvin test for this PR, I will run that and post the results

asfbot · 2015-09-07T10:26:12Z

cloudstack-pull-rats #525 SUCCESS
This pull request looks good

asfbot · 2015-09-07T11:34:54Z

cloudstack-pull-analysis #459 UNSTABLE
Looks like there's a problem with this pull request

asfbot · 2015-09-07T12:31:09Z

cloudstack-pull-rats #528 SUCCESS
This pull request looks good

asfbot · 2015-09-07T13:42:24Z

cloudstack-pull-analysis #462 SUCCESS
This pull request looks good

asfbot · 2015-09-07T14:10:35Z

cloudstack-pull-rats #533 SUCCESS
This pull request looks good

asfbot · 2015-09-07T14:28:24Z

cloudstack-pull-rats #534 SUCCESS
This pull request looks good

asfbot · 2015-09-07T14:43:49Z

cloudstack-pull-rats #535 SUCCESS
This pull request looks good

asfbot · 2015-09-07T14:59:27Z

cloudstack-pull-rats #536 SUCCESS
This pull request looks good

…lied - Changing refactored the utils.get_process_status() function - Adding 2 tests: test_01_single_VPC_iptables_policies and test_02_routervm_iptables_policies

wilderrodrigues · 2015-09-07T15:10:06Z

@miguelaferreira @remibergsma @karuturi @DaanHoogland

The test is done!

Results:

Test iptables default INPUT/FORWARD policy on RouterVM ... === TestName: test_02_routervm_iptables_policies | Status : SUCCESS ===
ok
Test iptables default INPUT/FORWARD policies on VPC router ... === TestName: test_01_single_VPC_iptables_policies | Status : SUCCESS ===
ok

Ran 2 tests in 663.540s

OK
/tmp//MarvinLogs/test_routers_iptables_default_policy_RC3AMZ/results.txt (END)

The tests were done only for single VPC and Isolated Network because the python code executed is also used by Redundant VPC and Shared Network. We can come back to this test later and add more cases, I already added some service for the above mentioned networks in the test.

You can run this test by doing so:

nosetests --with-marvin --marvin-config=/data/shared/marvin/mct-zone2-kvm2-ISOLATED.cfg -s -a tags=advanced,required_hardware=true component/test_routers_iptables_default_policy.py

Make sure you do the following before running the test agains a KVM hypervisor:

Copy the systemvm.iso:
- cloudstack/client/target/cloud-client-ui-4.6.0-SNAPSHOT/WEB-INF/classes/vms/systemvm.iso
To:
- /usr/share/cloudstack-common/vms/systemvm.iso

Cheers,
Wilder

asfbot · 2015-09-07T15:21:44Z

cloudstack-pull-analysis #467 SUCCESS
This pull request looks good

asfbot · 2015-09-07T15:21:49Z

cloudstack-pull-analysis #468 ABORTED

asfbot · 2015-09-07T15:26:28Z

cloudstack-pull-rats #538 SUCCESS
This pull request looks good

asfbot · 2015-09-07T15:34:01Z

cloudstack-pull-analysis #469 ABORTED

asfbot · 2015-09-07T15:34:05Z

cloudstack-pull-analysis #470 FAILURE
Looks like there's a problem with this pull request

asfbot · 2015-09-07T16:24:37Z

cloudstack-pull-analysis #472 UNSTABLE
Looks like there's a problem with this pull request

wilderrodrigues · 2015-09-08T11:16:42Z

@wido @borisroman @bhaisaab

Could one of you have a look at this PR, please? :)

Cheers,
Wilder

rohityadavcloud · 2015-09-08T11:25:15Z

LGTM

CLOUDSTACK-8688 - default policies for INPUT and FORWARD should be set to DROP instead of ACCEPT - In order to be able to access the routers via the link local interface, we have to add a rules with NEW and ESTABLISHED state * pr/765: CLOUDSTACK-8688 - Adding Marvin tests in order to cover the fixes applied CLOUDSTACK-8688 - default policies for INPUT and FORWARD should be set to DROP instead of ACCEPT Signed-off-by: wilderrodrigues <wrodrigues@schubergphilis.com>

wilderrodrigues · 2015-09-08T11:47:04Z

Thanks, @bhaisaab !

Reverter MR 295 Closes apache#765 See merge request scclouds/scclouds!333

CLOUDSTACK-8688 - default policies for INPUT and FORWARD should be se…

f5e5f4d

…t to DROP instead of ACCEPT - In order to be able to access the routers via the link local interface, we have to add a rules with NEW and ESTABLISHED state

DaanHoogland reviewed Sep 1, 2015
View reviewed changes

CLOUDSTACK-8688 - Adding Marvin tests in order to cover the fixes app…

1742b10

…lied - Changing refactored the utils.get_process_status() function - Adding 2 tests: test_01_single_VPC_iptables_policies and test_02_routervm_iptables_policies

asfgit merged commit 1742b10 into apache:master Sep 8, 2015

JoaoJandre pushed a commit to scclouds/cloudstack that referenced this pull request Nov 24, 2022

Merge branch 'revert-2d04307b' into '4.16.0.0-scclouds'

4ea238e

Reverter MR 295 Closes apache#765 See merge request scclouds/scclouds!333

CLOUDSTACK-8688 - default policies for INPUT and FORWARD should be se… #765

CLOUDSTACK-8688 - default policies for INPUT and FORWARD should be se… #765

Conversation

wilderrodrigues commented Aug 31, 2015

wilderrodrigues commented Aug 31, 2015

asfbot commented Aug 31, 2015

wilderrodrigues commented Aug 31, 2015

asfbot commented Aug 31, 2015

wilderrodrigues commented Sep 1, 2015

miguelaferreira commented Sep 1, 2015

wilderrodrigues commented Sep 1, 2015

miguelaferreira commented Sep 1, 2015

miguelaferreira commented Sep 1, 2015

DaanHoogland Sep 1, 2015

Choose a reason for hiding this comment

wilderrodrigues Sep 1, 2015

Choose a reason for hiding this comment

borisroman Sep 17, 2015

Choose a reason for hiding this comment

DaanHoogland commented Sep 1, 2015

wilderrodrigues commented Sep 1, 2015

miguelaferreira commented Sep 1, 2015

wilderrodrigues commented Sep 2, 2015

karuturi commented Sep 2, 2015

wilderrodrigues commented Sep 2, 2015

karuturi commented Sep 2, 2015

wilderrodrigues commented Sep 3, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 4, 2015

asfbot commented Sep 5, 2015

asfbot commented Sep 5, 2015

karuturi commented Sep 7, 2015

miguelaferreira commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

wilderrodrigues commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

asfbot commented Sep 7, 2015

wilderrodrigues commented Sep 8, 2015

rohityadavcloud commented Sep 8, 2015

wilderrodrigues commented Sep 8, 2015