MitchDrage opened a new pull request, #14620:
URL: https://github.com/apache/cloudstack/pull/14620
### Description
This PR counts IPv6 traffic in network usage on virtual routers for isolated
and VPC networks. Until now only IPv4 was counted on these networks.
IPv6 traffic on shared networks has successfully been counted due to the
usage counters measure raw interface traffic which can account for IPv4 and
IPv6.
This builds on #14583, which adds `network.usage.exempt.cidrs`, so this
branch includes that commit until #14583 merges.
Related: #14607 applies the `network.usage.exempt.cidrs` exemptions to VMs
on KVM shared networks, for both IPv4 and IPv6. This PR doesn't depend on it.
- A new `ip6 cloudstack_usage` nftables table copies each IPv4
`NETWORK_STATS` rule, so both families count the same traffic. VPC routers
match on the tiers' IPv6 prefixes.
- The counts are named nftables counters. `configure.py` rebuilds the rules
on every run, and named counters keep their counts through that.
- `netusage.sh` and `vpc_netusage.sh` append the IPv6 counts to the IPv4
ones. Every hypervisor adds up that output in sent/received pairs, so no Java
changes are needed. Resetting usage resets both families.
- IPv6 addresses in `network.usage.exempt.cidrs` (from #14583) are left out
of the IPv6 counts on forwarded traffic, the same way #14583 does it for IPv4.
- `postinit.sh` resets the IPv6 counts after restoring the saved ruleset at
boot, so they start from zero like the iptables ones.
- Routed-mode and shared-network routers aren't changed.
Release note, to be added to `PendingReleaseNotes` once a target release is
assigned:
```
* Virtual routers on isolated and VPC networks now count IPv6 traffic in
network usage, using the same rules as IPv4. Dual-stack networks will
report higher usage once their routers run the new system VM template.
Operators who already bill IPv6 traffic from an external source should
stop doing so for these networks, or that traffic will be billed twice.
```
Fixes: #14591
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Feature/Enhancement Scale
- [ ] Major
- [x] Minor
### Screenshots (if appropriate):
### How Has This Been Tested?
- Unit tests: `TestCsIpv6Usage` (the generated rules for isolated and VPC
routers, exempt addresses, removed tiers, and routers that are left alone) and
`TestCsConfig`.
- A lab running this branch's router scripts, with an isolated router and a
VPC router:
- IPv6 pings to a normal address showed up in `netusage.sh` /
`vpc_netusage.sh` output, to the byte. Pings to an exempt address added nothing.
- IPv4 counts were unchanged.
- TCP to the router itself was counted, and so was traffic from outside to
the VPC router's tier address.
- Not tested on a production router, as none with IPv6 was available.
#### How did you try to break this feature and the system with this change?
- Restored a saved ruleset holding non-zero IPv6 counts, as a boot would.
The reset line in `postinit.sh` brought them back to zero.
- Read usage on a router where the IPv6 table doesn't exist. The scripts
printed the IPv4 counts only and didn't error.
- Rebuilt the rules after counting traffic. The counts stayed the same.
- Reset the global counters with `-r` while per-interface counters held
traffic. Only the global ones went to zero.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
