[GitHub] [cloudstack] DennisKonrad opened a new pull request #3316: [WIP DO NOT MERGE] Fix private gateway ACLs

[GitBox <gi...@apache.org>]

DennisKonrad opened a new pull request #3316: [WIP DO NOT MERGE] Fix private gateway ACLs
URL: https://github.com/apache/cloudstack/pull/3316
 
 
   ## Description
   **Problem**
   At the moment ACLs attached to a private gateway are not working. The rules are created on the virtual router but multiple small errors prevent their evaluation.
   
   **Fix # 1**
   This commit changes the ordering of rules in the FORWARD table so the custom chains created are evaluated.
   
   **Fix # 2**
   Also ACLs on private gateways should not only be valid for the VPC CIDR but also for networks that are reached via static routes. This is achieved by considering all traffic that goes through the relevant network interface.
   
   **Fix # 3**
   This commit sets the right interface for the ACL_INBOUND_ethX chains. Before the interface was set on "out" even though the rules states it's inbound. **TODO push commit**
   ( self.fw.append(["filter", "", "-A FORWARD -i %s -j ACL_INBOUND_%s" % (self.dev, self.dev)]) )
   -> CsAddress.py:444
   
   **Fix # 4**
   ACL_OUTBOUND rules should also be filtered -> Move them to filter
   
   **Fix # 5**
   To allow for correct private gateway ACL evaluation the argument already generated by the java code needed to be evaluated.
   
   ## Types of changes
   <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
   - [ ] Breaking change (fix or feature that would cause existing functionality to change)
   - [ ] New feature (non-breaking change which adds functionality)
   - [X] Bug fix (non-breaking change which fixes an issue)
   - [ ] Enhancement (improves an existing feature and functionality)
   - [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
   
   ## How Has This Been Tested?
   We tested this by manually applying the changes to the .py files. Also one has to move or delete the .pyc files to experience the changes.

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services