You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@cloudstack.apache.org by "Jayapal Reddy (JIRA)" <ji...@apache.org> on 2013/09/06 12:10:52 UTC
[jira] [Commented] (CLOUDSTACK-4613) security group rules issue in
host
[ https://issues.apache.org/jira/browse/CLOUDSTACK-4613?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13760103#comment-13760103 ]
Jayapal Reddy commented on CLOUDSTACK-4613:
-------------------------------------------
1. Running iptables command which took from iptables-save failed, 'Bad argument `!--set' space issue after !
[19231] 2013-09-06 02:38:24.546698 ['/bin/bash', '-c', "iptables-save | grep '\\-A i-2-91-def' | grep physdev-in | grep vif | sed -r 's/vif[0-9]+.0/vif21.0/' | sed 's/-A/-I/'"]
[19231] 2013-09-06 02:38:24.565476 SUCCESS
[19231] 2013-09-06 02:38:24.565656 ['/bin/bash', '-c', "iptables-save| grep '\\-A i-2-91-def' | grep physdev-in | grep tap | sed -r 's/tap[0-9]+.0/tap21.0/' | sed 's/-A/-I/'"]
[19231] 2013-09-06 02:38:24.584220 SUCCESS
[19231] 2013-09-06 02:38:24.584356 ['/bin/bash', '-c', "iptables-save | grep '\\-A i-2-91-def' | grep physdev-out | grep vif | sed -r 's/vif[0-9]+.0/vif21.0/' | sed 's/-A/-I/'"]
[19231] 2013-09-06 02:38:24.603046 SUCCESS
[19231] 2013-09-06 02:38:24.603206 ['/bin/bash', '-c', "iptables-save| grep '\\-A i-2-91-def' | grep physdev-out | grep tap | sed -r 's/tap[0-9]+.0/tap21.0/' | sed 's/-A/-I/'"]
[19231] 2013-09-06 02:38:24.621915 SUCCESS
[19231] 2013-09-06 02:38:24.622100 ['iptables', '-D', 'i-2-91-def', '-p', 'udp', '-m', 'physdev', '--physdev-in', 'vif18.0', '--physdev-is-bridged', '-m', 'set', '--set', 'i-2-91-VM', 'src', '-m', 'udp', '--dport', '53', '-j', 'RETURN']
[19231] 2013-09-06 02:38:24.634604 SUCCESS
[19231] 2013-09-06 02:38:24.634749 ['iptables', '-D', 'i-2-91-def', '-m', 'physdev', '--physdev-in', 'vif18.0', '--physdev-is-bridged', '-m', 'set', '!--set', 'i-2-91-VM', 'src', '-j', 'DROP']
[19231] 2013-09-06 02:38:24.645608 FAILED: (rc 2) stdout: 'Bad argument `!--set'
', stderr: 'Try `iptables -h' or 'iptables --help' for more information.
2. The order of anti spoofing rules order is incorrect after the vm reboot
After reboot:
Chain i-2-45-def (2 references)
pkts bytes target prot opt in out source destination
994 381K i-2-45-VM all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vif6.0 --physdev-is-bridged
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out vif6.0 --physdev-is-bridged !set i-2-45-VM dst
0 0 i-2-45-VM-eg all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vif6.0 --physdev-is-bridged set i-2-45-VM src
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vif6.0 --physdev-is-bridged !set i-2-45-VM src
0 0 RETURN udp -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vif6.0 --physdev-is-bridged set i-2-45-VM src udp dpt:53
> security group rules issue in host
> ----------------------------------
>
> Key: CLOUDSTACK-4613
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-4613
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the default.)
> Components: Network Controller
> Affects Versions: 4.1.0
> Reporter: Jayapal Reddy
> Assignee: Jayapal Reddy
> Fix For: 4.2.1
>
>
> Observed the following security group iptables rules issues
> 1. iptables anti spoofing DROP rules add failed on VM reboot.
> inscmd = "iptables-save | grep '\-A " + vmchain_default + "' | grep physdev-in | grep vif | sed -r 's/vif[0-9]+.0/" + vif + "/' | sed 's/-A/-I/'"
> Here the rules in inscmd are with out space for !--set, this causes rule execute failed.
> 2. The order of iptables rules are incorrect on VM reboot.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira