VPC VR: fix empty iptables if there is no vpc tier

[weizhouapache]

Description

This PR fixes #8729

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• build/CI

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

[weizhouapache]

@blueorangutan package

[blueorangutan]

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 13.16%. Comparing base (f8fd22c) to head (3dbdeb0).
Report is 1 commits behind head on 4.18.

Additional details and impacted files

@@             Coverage Diff              @@
##               4.18    #8787      +/-   ##
============================================
- Coverage     13.16%   13.16%   -0.01%     
+ Complexity     9205     9203       -2     
============================================
  Files          2724     2724              
  Lines        258149   258149              
  Branches      40235    40235              
============================================
- Hits          33987    33982       -5     
- Misses       219856   219862       +6     
+ Partials       4306     4305       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[blueorangutan]

Packaging result [SF]: ✔️ el7 ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 8933

[weizhouapache]

@blueorangutan test matrix

[blueorangutan]

@weizhouapache a [SL] Trillian-Jenkins matrix job (centos7 mgmt + xenserver71, rocky8 mgmt + vmware67u3, centos7 mgmt + kvmcentos7) has been kicked to run smoke tests

[vishesh92]

code lgtm

[blueorangutan]

[SF] Trillian test result (tid-9471)
Environment: xenserver-71 (x2), Advanced Networking with Mgmt server 7
Total time taken: 41029 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8787-t9471-xenserver-71.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

[blueorangutan]

[SF] Trillian test result (tid-9472)
Environment: vmware-67u3 (x2), Advanced Networking with Mgmt server r8
Total time taken: 42659 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8787-t9472-vmware-67u3.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

[blueorangutan]

[SF] Trillian test result (tid-9473)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 46293 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr8787-t9473-kvm-centos7.zip
Smoke tests completed. 110 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

[DaanHoogland]

clgtm

[DaanHoogland]

@JoaoJandre , please merge at your will

[JoaoJandre]

@weizhouapache does this still need work? Also, could you share your test results?

[weizhouapache]

@weizhouapache does this still need work? Also, could you share your test results?

here is the iptables rules of a VPC VR without any tier in my testing

root@r-1277-VM:~# iptables-save
# Generated by iptables-save v1.8.9 (nf_tables) on Fri Mar 15 19:30:53 2024
*mangle
:PREROUTING ACCEPT [474:70400]
:INPUT ACCEPT [473:70360]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [458:70506]
:POSTROUTING ACCEPT [458:70506]
-A OUTPUT -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Fri Mar 15 19:30:53 2024
# Generated by iptables-save v1.8.9 (nf_tables) on Fri Mar 15 19:30:53 2024
*filter
:INPUT DROP [7:1099]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [458:70506]
:FW_EGRESS_RULES - [0:0]
-A INPUT -d 224.0.0.18/32 -j ACCEPT
-A INPUT -d 225.0.0.50/32 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 3922 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Fri Mar 15 19:30:53 2024
# Generated by iptables-save v1.8.9 (nf_tables) on Fri Mar 15 19:30:53 2024
*nat
:PREROUTING ACCEPT [30:2675]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [51:4079]
:POSTROUTING ACCEPT [51:4079]
COMMIT
# Completed on Fri Mar 15 19:30:53 2024

which is same as

cloudstack/systemvm/debian/etc/iptables/iptables-vpcrouter

Lines 18 to 42 in 7b02c4c

	*nat
	:PREROUTING ACCEPT [0:0]
	:POSTROUTING ACCEPT [0:0]
	:OUTPUT ACCEPT [0:0]
	COMMIT
	*filter
	:INPUT DROP [0:0]
	:FORWARD DROP [0:0]
	:OUTPUT ACCEPT [0:0]
	-A INPUT -d 224.0.0.18/32 -j ACCEPT
	-A INPUT -d 225.0.0.50/32 -j ACCEPT
	-A INPUT -p icmp -j ACCEPT
	-A INPUT -i lo -j ACCEPT
	-A INPUT -i eth0 -p tcp -m tcp -m state --state NEW,ESTABLISHED --dport 3922 -j ACCEPT
	-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
	-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
	COMMIT
	*mangle
	:PREROUTING ACCEPT [0:0]
	:INPUT ACCEPT [0:0]
	:FORWARD ACCEPT [0:0]
	:OUTPUT ACCEPT [0:0]
	:POSTROUTING ACCEPT [0:0]
	-A OUTPUT -p udp -m udp --dport bootpc -j CHECKSUM --checksum-fill
	COMMIT

[weizhouapache]

@JoaoJandre
please test it by yourself or ask someone else to test it.
It is required to test it manually (except the author)

[JoaoJandre]

@KlausDornsbach could you test this and share your test steps/results?

[KlausDornsbach]

Tested and clgtm @JoaoJandre

[KlausDornsbach]

Tested as described on #8729 without and with the changes in this PR:
Running the version without changes, I sent packets to the public IP address at port 35999 of the a newly created VPC VR and the HA Proxy logs got flooded, with the changes I did the same process and the VR did not accept the packets, logs were not being flooded anymore.