[
https://issues.apache.org/jira/browse/CLOUDSTACK-9339?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15696434#comment-15696434
]
ASF GitHub Bot commented on CLOUDSTACK-9339:
--------------------------------------------
Github user blueorangutan commented on the issue:
https://github.com/apache/cloudstack/pull/1659
<b>Trillian test result (tid-440)</b>
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 33701 seconds
Marvin logs:
https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr1659-t440-kvm-centos7.zip
Test completed. 35 look ok, 13 have error(s)
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_02_VPC_default_routes | `Failure` | 812.61 | test_vpc_router_nics.py
test_01_VPC_nics_after_destroy | `Failure` | 802.74 |
test_vpc_router_nics.py
test_05_rvpc_multi_tiers | `Failure` | 344.39 | test_vpc_redundant.py
test_04_rvpc_network_garbage_collector_nics | `Failure` | 292.52 |
test_vpc_redundant.py
test_03_create_redundant_VPC_1tier_2VMs_2IPs_2PF_ACL_reboot_routers |
`Failure` | 308.11 | test_vpc_redundant.py
test_02_redundant_VPC_default_routes | `Failure` | 850.49 |
test_vpc_redundant.py
test_01_create_redundant_VPC_2tiers_4VMs_4IPs_4PF_ACL | `Failure` | 369.71
| test_vpc_redundant.py
test_02_attach_volume | `Failure` | 668.65 | test_volumes.py
test_01_create_volume | `Failure` | 683.96 | test_volumes.py
test_10_attachAndDetach_iso | `Failure` | 684.02 | test_vm_life_cycle.py
test_04_change_offering_small | `Failure` | 794.64 |
test_service_offerings.py
test_router_dns_guestipquery | `Failure` | 277.48 | test_router_dns.py
test_router_dhcphosts | `Failure` | 188.70 | test_router_dhcphosts.py
test_router_dhcp_opts | `Failure` | 21.10 | test_router_dhcphosts.py
test_04_rvpc_privategw_static_routes | `Failure` | 994.91 |
test_privategw_acl.py
test_03_vpc_privategw_restart_vpc_cleanup | `Failure` | 934.94 |
test_privategw_acl.py
test_02_vpc_privategw_static_routes | `Failure` | 914.87 |
test_privategw_acl.py
test_isolate_network_password_server | `Failure` | 188.81 |
test_password_server.py
test_reboot_router | `Failure` | 442.02 | test_network.py
test_network_rules_acquired_public_ip_3_Load_Balancer_Rule | `Failure` |
831.79 | test_network.py
test_network_rules_acquired_public_ip_2_nat_rule | `Failure` | 679.53 |
test_network.py
test_network_rules_acquired_public_ip_1_static_nat_rule | `Failure` |
675.65 | test_network.py
test_02_port_fwd_on_non_src_nat | `Failure` | 678.93 | test_network.py
test_01_port_fwd_on_src_nat | `Failure` | 673.81 | test_network.py
test_assign_and_removal_lb | `Failure` | 110.44 | test_loadbalance.py
test_02_create_lb_rule_non_nat | `Failure` | 110.40 | test_loadbalance.py
test_01_create_lb_rule_src_nat | `Failure` | 110.55 | test_loadbalance.py
test_02_internallb_roundrobin_1RVPC_3VM_HTTP_port80 | `Failure` | 275.29 |
test_internal_lb.py
test_01_internallb_roundrobin_1VPC_3VM_HTTP_port80 | `Failure` | 209.92 |
test_internal_lb.py
test_01_vpc_site2site_vpn | `Error` | 295.74 | test_vpc_vpn.py
test_01_redundant_vpc_site2site_vpn | `Error` | 376.30 | test_vpc_vpn.py
test_05_rvpc_multi_tiers | `Error` | 405.30 | test_vpc_redundant.py
ContextSuite context=TestRouterDHCPHosts>:teardown | `Error` | 234.13 |
test_router_dhcphosts.py
test_04_rvpc_internallb_haproxy_stats_on_all_interfaces | `Error` | 230.33
| test_internal_lb.py
test_03_vpc_internallb_haproxy_stats_on_all_interfaces | `Error` | 215.26 |
test_internal_lb.py
test_01_vpc_remote_access_vpn | Success | 61.08 | test_vpc_vpn.py
test_09_delete_detached_volume | Success | 15.48 | test_volumes.py
test_08_resize_volume | Success | 15.38 | test_volumes.py
test_07_resize_fail | Success | 20.50 | test_volumes.py
test_06_download_detached_volume | Success | 15.29 | test_volumes.py
test_05_detach_volume | Success | 100.28 | test_volumes.py
test_04_delete_attached_volume | Success | 10.23 | test_volumes.py
test_03_download_attached_volume | Success | 15.28 | test_volumes.py
test_deploy_vm_multiple | Success | 289.44 | test_vm_life_cycle.py
test_deploy_vm | Success | 0.03 | test_vm_life_cycle.py
test_advZoneVirtualRouter | Success | 0.02 | test_vm_life_cycle.py
test_09_expunge_vm | Success | 125.20 | test_vm_life_cycle.py
test_08_migrate_vm | Success | 30.93 | test_vm_life_cycle.py
test_07_restore_vm | Success | 0.13 | test_vm_life_cycle.py
test_06_destroy_vm | Success | 125.84 | test_vm_life_cycle.py
test_03_reboot_vm | Success | 125.81 | test_vm_life_cycle.py
test_02_start_vm | Success | 5.14 | test_vm_life_cycle.py
test_01_stop_vm | Success | 125.89 | test_vm_life_cycle.py
test_CreateTemplateWithDuplicateName | Success | 171.46 | test_templates.py
test_08_list_system_templates | Success | 0.03 | test_templates.py
test_07_list_public_templates | Success | 0.04 | test_templates.py
test_05_template_permissions | Success | 0.07 | test_templates.py
test_04_extract_template | Success | 5.22 | test_templates.py
test_03_delete_template | Success | 5.11 | test_templates.py
test_02_edit_template | Success | 90.15 | test_templates.py
test_01_create_template | Success | 65.55 | test_templates.py
test_10_destroy_cpvm | Success | 166.42 | test_ssvm.py
test_09_destroy_ssvm | Success | 163.29 | test_ssvm.py
test_08_reboot_cpvm | Success | 131.57 | test_ssvm.py
test_07_reboot_ssvm | Success | 133.51 | test_ssvm.py
test_06_stop_cpvm | Success | 131.72 | test_ssvm.py
test_05_stop_ssvm | Success | 133.83 | test_ssvm.py
test_04_cpvm_internals | Success | 1.17 | test_ssvm.py
test_03_ssvm_internals | Success | 3.29 | test_ssvm.py
test_02_list_cpvm_vm | Success | 0.12 | test_ssvm.py
test_01_list_sec_storage_vm | Success | 0.13 | test_ssvm.py
test_01_snapshot_root_disk | Success | 11.32 | test_snapshots.py
test_03_delete_service_offering | Success | 0.04 | test_service_offerings.py
test_02_edit_service_offering | Success | 0.09 | test_service_offerings.py
test_01_create_service_offering | Success | 0.11 | test_service_offerings.py
test_02_sys_template_ready | Success | 0.12 | test_secondary_storage.py
test_01_sys_vm_start | Success | 0.18 | test_secondary_storage.py
test_09_reboot_router | Success | 30.26 | test_routers.py
test_08_start_router | Success | 20.23 | test_routers.py
test_07_stop_router | Success | 10.16 | test_routers.py
test_06_router_advanced | Success | 0.06 | test_routers.py
test_05_router_basic | Success | 0.04 | test_routers.py
test_04_restart_network_wo_cleanup | Success | 5.57 | test_routers.py
test_03_restart_network_cleanup | Success | 60.52 | test_routers.py
test_02_router_internal_adv | Success | 0.84 | test_routers.py
test_01_router_internal_basic | Success | 0.46 | test_routers.py
test_router_dns_externalipquery | Success | 0.08 | test_router_dns.py
test_01_updatevolumedetail | Success | 5.12 | test_resource_detail.py
test_01_reset_vm_on_reboot | Success | 130.89 | test_reset_vm_on_reboot.py
test_createRegion | Success | 0.04 | test_regions.py
test_create_pvlan_network | Success | 5.22 | test_pvlan.py
test_dedicatePublicIpRange | Success | 0.42 | test_public_ip_range.py
test_01_vpc_privategw_acl | Success | 93.16 | test_privategw_acl.py
test_01_primary_storage_nfs | Success | 35.76 | test_primary_storage.py
test_createPortablePublicIPRange | Success | 15.19 |
test_portable_publicip.py
test_createPortablePublicIPAcquire | Success | 15.44 |
test_portable_publicip.py
test_UpdateStorageOverProvisioningFactor | Success | 0.14 |
test_over_provisioning.py
test_oobm_zchange_password | Success | 20.52 | test_outofbandmanagement.py
test_oobm_multiple_mgmt_server_ownership | Success | 16.52 |
test_outofbandmanagement.py
test_oobm_issue_power_status | Success | 5.50 | test_outofbandmanagement.py
test_oobm_issue_power_soft | Success | 15.52 | test_outofbandmanagement.py
test_oobm_issue_power_reset | Success | 15.52 | test_outofbandmanagement.py
test_oobm_issue_power_on | Success | 15.52 | test_outofbandmanagement.py
test_oobm_issue_power_off | Success | 15.52 | test_outofbandmanagement.py
test_oobm_issue_power_cycle | Success | 16.02 | test_outofbandmanagement.py
test_oobm_enabledisable_across_clusterzones | Success | 57.25 |
test_outofbandmanagement.py
test_oobm_enable_feature_valid | Success | 5.17 |
test_outofbandmanagement.py
test_oobm_enable_feature_invalid | Success | 0.11 |
test_outofbandmanagement.py
test_oobm_disable_feature_valid | Success | 5.21 |
test_outofbandmanagement.py
test_oobm_disable_feature_invalid | Success | 0.12 |
test_outofbandmanagement.py
test_oobm_configure_invalid_driver | Success | 0.09 |
test_outofbandmanagement.py
test_oobm_configure_default_driver | Success | 0.09 |
test_outofbandmanagement.py
test_oobm_background_powerstate_sync | Success | 29.52 |
test_outofbandmanagement.py
test_extendPhysicalNetworkVlan | Success | 15.31 |
test_non_contigiousvlan.py
test_01_nic | Success | 500.69 | test_nic.py
test_releaseIP | Success | 243.69 | test_network.py
test_public_ip_user_account | Success | 10.27 | test_network.py
test_public_ip_admin_account | Success | 40.27 | test_network.py
test_delete_account | Success | 334.44 | test_network.py
test_nic_secondaryip_add_remove | Success | 198.79 |
test_multipleips_per_nic.py
login_test_saml_user | Success | 24.60 | test_login.py
test_03_list_snapshots | Success | 0.08 | test_list_ids_parameter.py
test_02_list_templates | Success | 0.04 | test_list_ids_parameter.py
test_01_list_volumes | Success | 0.03 | test_list_ids_parameter.py
test_07_list_default_iso | Success | 0.06 | test_iso.py
test_05_iso_permissions | Success | 0.14 | test_iso.py
test_04_extract_Iso | Success | 5.16 | test_iso.py
test_03_delete_iso | Success | 95.13 | test_iso.py
test_02_edit_iso | Success | 0.06 | test_iso.py
test_01_create_iso | Success | 21.88 | test_iso.py
test_dedicateGuestVlanRange | Success | 10.28 | test_guest_vlan_range.py
test_UpdateConfigParamWithScope | Success | 0.16 | test_global_settings.py
test_rolepermission_lifecycle_update | Success | 7.15 | test_dynamicroles.py
test_rolepermission_lifecycle_list | Success | 6.87 | test_dynamicroles.py
test_rolepermission_lifecycle_delete | Success | 6.74 | test_dynamicroles.py
test_rolepermission_lifecycle_create | Success | 6.84 | test_dynamicroles.py
test_rolepermission_lifecycle_concurrent_updates | Success | 6.90 |
test_dynamicroles.py
test_role_lifecycle_update_role_inuse | Success | 6.83 |
test_dynamicroles.py
test_role_lifecycle_update | Success | 11.93 | test_dynamicroles.py
test_role_lifecycle_list | Success | 6.98 | test_dynamicroles.py
test_role_lifecycle_delete | Success | 11.87 | test_dynamicroles.py
test_role_lifecycle_create | Success | 6.78 | test_dynamicroles.py
test_role_inuse_deletion | Success | 6.78 | test_dynamicroles.py
test_role_account_acls_multiple_mgmt_servers | Success | 9.06 |
test_dynamicroles.py
test_role_account_acls | Success | 9.43 | test_dynamicroles.py
test_default_role_deletion | Success | 7.04 | test_dynamicroles.py
test_04_create_fat_type_disk_offering | Success | 0.06 |
test_disk_offerings.py
test_03_delete_disk_offering | Success | 0.04 | test_disk_offerings.py
test_02_edit_disk_offering | Success | 0.05 | test_disk_offerings.py
test_02_create_sparse_type_disk_offering | Success | 0.07 |
test_disk_offerings.py
test_01_create_disk_offering | Success | 0.11 | test_disk_offerings.py
test_deployvm_userdispersing | Success | 20.61 |
test_deploy_vms_with_varied_deploymentplanners.py
test_deployvm_userconcentrated | Success | 10.56 |
test_deploy_vms_with_varied_deploymentplanners.py
test_deployvm_firstfit | Success | 126.22 |
test_deploy_vms_with_varied_deploymentplanners.py
test_deployvm_userdata_post | Success | 50.80 |
test_deploy_vm_with_userdata.py
test_deployvm_userdata | Success | 55.91 | test_deploy_vm_with_userdata.py
test_02_deploy_vm_root_resize | Success | 7.06 |
test_deploy_vm_root_resize.py
test_01_deploy_vm_root_resize | Success | 6.89 |
test_deploy_vm_root_resize.py
test_00_deploy_vm_root_resize | Success | 258.72 |
test_deploy_vm_root_resize.py
test_deploy_vm_from_iso | Success | 203.35 | test_deploy_vm_iso.py
test_DeployVmAntiAffinityGroup | Success | 126.56 | test_affinity_groups.py
test_03_delete_vm_snapshots | Skipped | 0.00 | test_vm_snapshots.py
test_02_revert_vm_snapshots | Skipped | 0.00 | test_vm_snapshots.py
test_01_test_vm_volume_snapshot | Skipped | 0.00 | test_vm_snapshots.py
test_01_create_vm_snapshots | Skipped | 0.00 | test_vm_snapshots.py
test_06_copy_template | Skipped | 0.00 | test_templates.py
test_static_role_account_acls | Skipped | 0.02 | test_staticroles.py
test_01_scale_vm | Skipped | 0.00 | test_scale_vm.py
test_01_primary_storage_iscsi | Skipped | 0.03 | test_primary_storage.py
test_06_copy_iso | Skipped | 0.00 | test_iso.py
test_deploy_vgpu_enabled_vm | Skipped | 0.00 |
test_deploy_vgpu_enabled_vm.py
> Virtual Routers don't handle Multiple Public Interfaces
> -------------------------------------------------------
>
> Key: CLOUDSTACK-9339
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-9339
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Components: Virtual Router
> Affects Versions: 4.8.0
> Reporter: dsclose
> Assignee: Murali Reddy
> Labels: firewall, nat, router
> Fix For: 4.10.0.0, 4.9.1.0
>
>
> There are a series of issues with the way Virtual Routers manage multiple
> public interfaces. These are more pronounced on redundant virtual router
> setups. I have not attempted to examine these issues in a VPC context.
> Outside of a VPC context, however, the following is expected behaviour:
> * eth0 connects the router to the guest network.
> * In RvR setups, keepalived manages the guests' gateway IP as a virtual IP on
> eth0.
> * eth1 provides a local link to the hypervisor, allowing Cloudstack to issue
> commands to the router.
> * eth2 is the routers public interface. By default, a single public IP will
> be setup on eth2 along with the necessary iptables and ip rules to source-NAT
> guest traffic to that public IP.
> * When a public IP address is assigned to the router that is on a separate
> subnet to the source-NAT IP, a new interface is configured, such as eth3, and
> the IP is assigned to that interface.
> * This can result in eth3, eth4, eth5, etc. being created depending upon how
> many public subnets the router has to work with.
> The above all works. The following, however, is currently not working:
> * Public interfaces should be set to DOWN on backup redundant routers. The
> master.py script is responsible for setting public interfaces to UP during a
> keepalived transition. Currently the check_is_up method of the CsIP class
> brings all interfaces UP on both RvR. A proposed fix for this has been
> discussed on the mailing list. That fix will leave public interfaces DOWN on
> RvR allowing the keepalived transition to control the state of public
> interfaces. Issue #1413 includes a commit that contradicts the proposed fix
> so it is unclear what the current state of the code should be.
> * Newly created interfaces should be set to UP on master redundant routers.
> Assuming public interfaces should be default be DOWN on an RvR we need to
> accommodate the fact that, as interfaces are created, no keepalived
> transition occurs. This means that assigning an IP from a new public subnet
> will have no effect (as the interface will be down) until the network is
> restarted with a "clean up."
> * Public interfaces other than eth2 do not forward traffic. There are two
> iptables rules in the FORWARD chain of the filter table created for eth2 that
> allow forwarding between eth2 and eth0. Equivalent rules are not created for
> other public interfaces so forwarded traffic is dropped.
> * Outbound traffic from guest VMs does not honour static-NAT rules. Instead,
> outbound traffic is source-NAT'd to the networks default source-NAT IP. New
> connections from guests that are destined for public networks are processed
> like so:
> 1. Traffic is matched against the following rule in the mangle table that
> marks the connection with a 0x0:
> *mangle
> -A PREROUTING -i eth0 -m state --state NEW -j CONNMARK --set-xmark
> 0x0/0xffffffff
> 2. There are no "ip rule" statements that match a connection marked 0x0, so
> the kernel routes the connection via the default gateway. That gateway is on
> source-NAT subnet, so the connection is routed out of eth2.
> 3. The following iptables rules are then matched in the filter table:
> *filter
> -A FORWARD -i eth0 -o eth2 -j FW_OUTBOUND
> -A FW_OUTBOUND -j FW_EGRESS_RULES
> -A FW_EGRESS_RULES -j ACCEPT
> 4. Finally, the following rule is matched from the nat table, where the IP
> address is the source-NAT IP:
> *nat
> -A POSTROUTING -o eth2 -j SNAT --to-source 123.4.5.67
>
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
