Damans227 commented on code in PR #13200:
URL: https://github.com/apache/cloudstack/pull/13200#discussion_r4194459494
##########
server/src/main/java/com/cloud/network/router/CommandSetupHelper.java:
##########
@@ -463,6 +464,25 @@ public void createApplyStaticNatRulesCommands(final List<?
extends StaticNatRule
cmds.addCommand(cmd);
}
+ /**
+ * This method determines whether to use network-wide SNAT or NIC aware
SNAT
+ * @param networkId
+ * @param destinationIp
+ * @return
+ */
+ private boolean requiresReturnPathSnat(final long networkId, final String
destinationIp) {
+ if (!VirtualNetworkApplianceManager.NicSnatEnabled.value()) {
+ return false;
+ }
+
+ final NicVO destinationNic =
_nicDao.findByIp4AddressAndNetworkId(destinationIp, networkId);
+ if (destinationNic == null) {
+ logger.debug("Unable to find destination NIC for ip [{}] in
network [{}], assuming default NIC.", destinationIp, networkId);
+ return false;
+ }
+ return !destinationNic.isDefaultNic();
Review Comment:
what happens if the user changes the default nic of the vm later? the static
nat rules arent sent again, so the router keeps the old setup and replies go
out the wrong way again
##########
systemvm/debian/opt/cloud/bin/configure.py:
##########
@@ -1688,11 +1688,20 @@ def processStaticNatRule(self, rule):
self.fw.append(["filter", "",
"-A FORWARD -i %s -o eth0 -d %s -m state --state
NEW -j ACCEPT " % (device, rule["internal_ip"])])
- # Configure the hairpin snat
- self.fw.append(["nat", "front", "-A POSTROUTING -s %s -d %s -j SNAT -o
%s --to-source %s" %
+ # Configure the hairpin snat for default nic or nic-aware snat for
non-default
+ apply_cross_network_snat = rule.get("should_apply_cross_network_snat",
False)
+ if apply_cross_network_snat:
+ internal_device = self.getDeviceByIp(rule["internal_ip"])
+ internal_vr_ip = self.getGuestIpByIp(rule["internal_ip"])
+ if internal_device and internal_vr_ip and internal_device !=
device:
+ self.fw.append(["nat", "front",
+ "-A POSTROUTING -o %s -d %s/32 -j SNAT
--to-source %s" % (internal_device, rule["internal_ip"], internal_vr_ip)])
Review Comment:
with this the vm sees every connection as coming from the router instead of
the real client. should the setting description say that, since it breaks
client ip logging and ip based rules inside the vm?
##########
server/src/main/java/com/cloud/network/router/CommandSetupHelper.java:
##########
@@ -463,6 +464,25 @@ public void createApplyStaticNatRulesCommands(final List<?
extends StaticNatRule
cmds.addCommand(cmd);
}
+ /**
+ * This method determines whether to use network-wide SNAT or NIC aware
SNAT
+ * @param networkId
+ * @param destinationIp
+ * @return
+ */
+ private boolean requiresReturnPathSnat(final long networkId, final String
destinationIp) {
+ if (!VirtualNetworkApplianceManager.NicSnatEnabled.value()) {
+ return false;
+ }
+
+ final NicVO destinationNic =
_nicDao.findByIp4AddressAndNetworkId(destinationIp, networkId);
+ if (destinationNic == null) {
+ logger.debug("Unable to find destination NIC for ip [{}] in
network [{}], assuming default NIC.", destinationIp, networkId);
+ return false;
+ }
+ return !destinationNic.isDefaultNic();
Review Comment:
what happens if the user changes the default network card of the vm later?
the static nat rules arent sent again, so the router keeps the old setup and
replies go out the wrong way again
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
