Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

M #-: Add IP Spoofing support for NIC_ALIAS #4764

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion src/vmm_mad/exec/one_vmm_exec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -970,7 +970,7 @@ def attach_nic(id, drv_message)
]
}
]
elsif nic_alias && external
elsif nic_alias
steps = [
# Execute pre-attach networking setup
{
Expand Down Expand Up @@ -1072,6 +1072,15 @@ def detach_nic(id, drv_message)
:action => :clean
}
]
elsif nic_alias
steps = [
# Execute post-boot networking setup
{
:driver => :vnm,
:action => :post,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not clean action?

Copy link
Contributor Author

@rdiaz-on rdiaz-on Jun 12, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean action deletes the whole iptables chain included the rules for the parent NIC

:parameters => [:deploy_id]
}
]
else
steps = []
end
Expand Down
16 changes: 16 additions & 0 deletions src/vnm_mad/remotes/lib/security_groups_iptables.rb
Original file line number Diff line number Diff line change
Expand Up @@ -334,6 +334,14 @@ def self.vars(vm, nic, sg_id = nil)
vars[:set_sg_out] = "#{vars[:chain]}-#{sg_id}-o"
end

vars[:nic_aliases] = []

unless nic[:alias_ids].nil?
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

prefer if !nic[:alias_ids].nil? for single statements

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will change it

nic[:alias_ids].split(',').each do |id|
vars[:nic_aliases] << vm.nic_alias(id)
end
end

vars
end

Expand Down Expand Up @@ -426,6 +434,10 @@ def self.nic_pre(vm, nic)

[:ip, :vrouter_ip].each do |key|
ipv4s << nic[key] if !nic[key].nil? && !nic[key].empty?
vars[:nic_aliases].each do |nic_alias|
ipv4s << nic_alias[key] \
if !nic_alias[key].nil? && !nic_alias[key].empty?
end
end

if !ipv4s.empty?
Expand Down Expand Up @@ -453,6 +465,10 @@ def self.nic_pre(vm, nic)

[:ip6, :ip6_global, :ip6_link, :ip6_ula].each do |key|
ipv6s << nic[key] if !nic[key].nil? && !nic[key].empty?
vars[:nic_aliases].each do |nic_alias|
ipv6s << nic_alias[key] \
if !nic_alias[key].nil? && !nic_alias[key].empty?
end
end

if !ipv6s.empty?
Expand Down
16 changes: 16 additions & 0 deletions src/vnm_mad/remotes/lib/sg_driver.rb
Original file line number Diff line number Diff line change
Expand Up @@ -79,10 +79,18 @@ def activate(do_all=false)
SGIPTables.global_bootstrap

attach_nic_id = @vm['TEMPLATE/NIC[ATTACH="YES"]/NIC_ID'] if !do_all
attach_nic_alias_id = nil
if !do_all
attach_nic_alias_id = @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']
attach_nic_alias_parent_id =
@vm["TEMPLATE/NIC_ALIAS[NIC_ID=#{attach_nic_alias_id}]/PARENT_ID"]
end

# Process the rules
process do |nic|
next if attach_nic_id && attach_nic_id != nic[:nic_id]
next if attach_nic_alias_id && \
attach_nic_alias_parent_id != nic[:nic_id]

if nic[:security_groups].nil?
nic[:security_groups] = "0"
Expand Down Expand Up @@ -123,9 +131,17 @@ def deactivate(do_all=false)

begin
attach_nic_id = @vm['TEMPLATE/NIC[ATTACH="YES"]/NIC_ID'] if !do_all
attach_nic_alias_id = nil
if !do_all
attach_nic_alias_id = @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']
attach_nic_alias_parent_id =
@vm["TEMPLATE/NIC_ALIAS[NIC_ID=#{attach_nic_alias_id}]/PARENT_ID"]
end

@vm.nics.each do |nic|
next if attach_nic_id && attach_nic_id != nic[:nic_id]
next if attach_nic_alias_id && \
attach_nic_alias_parent_id != nic[:nic_id]

SGIPTables.nic_deactivate(@vm, nic)
end
Expand Down
54 changes: 38 additions & 16 deletions src/vnm_mad/remotes/lib/vm.rb
Original file line number Diff line number Diff line change
Expand Up @@ -38,22 +38,10 @@ def initialize(vm_root, xpath_filter, deploy_id)

@deploy_id = nil if deploy_id == '-'

nics = VNMNetwork::Nics.new(hypervisor)

@vm_root.elements.each(xpath_filter) do |nic_element|
nic = nics.new_nic

nic_build_hash(nic_element, nic)

if !VNMMAD.pre_action?
nic.get_info(self)
nic.get_tap(self)
end

nics << nic
end

@nics = nics
@nics = nics_build(xpath_filter)
@nic_aliases = []
@nic_aliases = nics_build('TEMPLATE/NIC_ALIAS') \
if !xpath_filter.nil? && xpath_filter.include?('TEMPLATE/NIC')
end

# Iterator on each NIC of the VM
Expand All @@ -65,6 +53,19 @@ def each_nic(block)
end
end

# Get NIC_ALIAS by NIC_ID
# @param element [String] the NIC_ID
# @return [Hash] the NIC_ALIAS
def nic_alias(id)
if @nic_aliases
Copy link
Member

@rsmontero rsmontero Jun 1, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

better use exit condition.

return nil if @nic_aliases.nil?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I will change it

@nic_aliases.each do |the_nic|
return the_nic if the_nic[:nic_id] == id
end
end

nil
end

# Access an XML Element of the VM
# @param element [String] element name
# @return [String] value of the element or nil if not found
Expand Down Expand Up @@ -121,6 +122,27 @@ def nic_build_hash(nic_element, nic)
end
end

# Method to build the list of NIC/NIC_ALIAS
# @param xpath_filter [String] XML NIC/NIC_ALIAS document
def nics_build(xpath_filter)
nics = VNMNetwork::Nics.new(hypervisor)

@vm_root.elements.each(xpath_filter) do |nic_element|
nic = nics.new_nic

nic_build_hash(nic_element, nic)

if !VNMMAD.pre_action?
nic.get_info(self)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do these functions work/make sense for NIC_ALIAS? (when calling it as nics_build('TEMPLATE/NIC_ALIAS')

nic.get_tap(self)
end

nics << nic
end

nics
end

end

end
Expand Down