GabrielBrascher opened a new pull request #3197: Fix XenServer Security Groups 'vmops' script URL: https://github.com/apache/cloudstack/pull/3197 Fixing issue: #3192 Security Group rules not applied at all for XenServer 6.5 / Advanced Zone https://github.com/apache/cloudstack/issues/3192 - Fix `tokens = line.split(':')` to `tokens = line.split(';')` - Fix expected tokens size from 5 to 4 ``` if len(tokens) != 5: continue ``` - Add logs - remove unused vmops script. The XCP patch points to the vmops script on the parent folder [1]. Thus, all XenServer versions are considering the vmops script located at [2]. [1] https://github.com/apache/cloudstack/blob/master/scripts/vm/hypervisor/xenserver/xcposs/patch#L30 [2] https://github.com/apache/cloudstack/blob/master/scripts/vm/hypervisor/xenserver/vmops ## Description <!--- Describe your changes in detail --> <!-- For new features, provide link to FS, dev ML discussion etc. --> <!-- In case of bug fix, the expected and actual behaviours, steps to reproduce. --> <!-- When "Fixes: #<id>" is specified, the issue/PR will automatically be closed when this PR gets merged --> <!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" --> <!-- Fixes: # --> ## Types of changes <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] New feature (non-breaking change which adds functionality) - [x] Bug fix (non-breaking change which fixes an issue) - [ ] Enhancement (improves an existing feature and functionality) - [ ] Cleanup (Code refactoring and cleanup, that may add test cases) ## Screenshots (if appropriate): ## How Has This Been Tested? <!-- Please describe in detail how you tested your changes. --> <!-- Include details of your testing environment, and the tests you ran to --> <!-- see how your change affects other areas of the code, etc. --> - SSH fail as expected - Add Ingress and Egress rules with start port=22, end port=22, and cidr=0.0.0.0/0 - SSH succeeds as expected **iptables -L** ``` Chain i-2-125-VM (1 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ctstate NEW DROP all -- anywhere anywhere Chain i-2-125-VM-def (2 references) target prot opt source destination RETURN udp -- anywhere anywhere PHYSDEV match --physdev-in vif22.0 --physdev-is-bridged match-set i-2-125-VM src udp dpt:domain DROP all -- anywhere anywhere PHYSDEV match --physdev-in vif22.0 --physdev-is-bridged ! match-set i-2-125-VM src DROP all -- anywhere anywhere PHYSDEV match --physdev-out vif22.0 --physdev-is-bridged ! match-set i-2-125-VM dst i-2-125-VM-eg all -- anywhere anywhere PHYSDEV match --physdev-in vif22.0 --physdev-is-bridged match-set i-2-125-VM src i-2-125-VM all -- anywhere anywhere PHYSDEV match --physdev-out vif22.0 --physdev-is-bridged Chain i-2-125-VM-eg (1 references) target prot opt source destination RETURN tcp -- anywhere anywhere tcp dpt:ssh ctstate NEW DROP all -- anywhere anywhere ``` **cloud.log output** ``` DEBUG [root] Network rules compressed in base64 [eJzztCpJLrA2MgIhAz0w1DfQ8XONCFFwxS0FAG5GDOs=]. INFO [root] Network rules to be processed [I:tcp;22;22;0.0.0.0/0,NEXT E:tcp;22;22;0.0.0.0/0,NEXT ]. INFO [root] Programming network rules for vm i-2-125-VM seqno=37 numrules=3 signature=5173d229b469dcfb63575ae93fde95ec guestIp=192.168.100.152, update iptables, reason=seqno_change_or_sig_change DEBUG [root] Processing rule [I:tcp;22;22;0.0.0.0/0,NEXT]. DEBUG [root] Tokens ['I:tcp', '22', '22', '0.0.0.0/0,NEXT']. INFO [root] Ipset chaing [i-2-125-VM], VM [i-2-125-VM], Action [ACCEPT], Direction [src], egress rules [0] DEBUG [root] port range [22:22] DEBUG [root] ['iptables', '-I', 'i-2-125-VM', '-p', 'tcp', '-m', 'tcp', '--dport', '22:22', '-m', 'state', '--state', 'NEW', '-j', 'ACCEPT'] DEBUG [root] Processing rule [E:tcp;22;22;0.0.0.0/0,NEXT]. DEBUG [root] Tokens ['E:tcp', '22', '22', '0.0.0.0/0,NEXT']. INFO [root] Ipset chaing [i-2-125-VM-e], VM chain [i-2-125-VM-eg], VM name [i-2-125-VM], Action [RETURN], Direction [dst], egress rules [1] DEBUG [root] port range [22:22] DEBUG [root] ['iptables', '-I', 'i-2-125-VM-eg', '-p', 'tcp', '-m', 'tcp', '--dport', '22:22', '-m', 'state', '--state', 'NEW', '-j', 'RETURN'] DEBUG [root] Processing rule []. DEBUG [root] Tokens ['']. WARNING [root] Network rule tokens size [1] is different from the expected size [4], ignoring rule [''] DEBUG [root] Executing command: [['iptables', '-I', 'i-2-125-VM', '-p', 'tcp', '-m', 'tcp', '--dport', '22:22', '-m', 'state', '--state', 'NEW', '-j', 'ACCEPT']]. DEBUG [root] Executing command: [['iptables', '-I', 'i-2-125-VM-eg', '-p', 'tcp', '-m', 'tcp', '--dport', '22:22', '-m', 'state', '--state', 'NEW', '-j', 'RETURN']]. DEBUG [root] Writing log to /var/run/cloud/i-2-125-VM.log ``` <!-- Please read the [CONTRIBUTING](https://github.com/apache/cloudstack/blob/master/CONTRIBUTING.md) document -->
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
