shaba/one
1
0
Fork 0
mirror of https://github.com/OpenNebula/one.git synced 2025-04-01 06:50:25 +03:00
Code Releases Wiki Activity

B #6310: Don't deactivate NICs on NIC_ALIAS detach

Browse Source 
When a NIC_ALIAS is detached the deactivate block is executed
incorrectly for some drivers. This can render in an unusable network for
the VM.

This commits includes also some linting
This commit is contained in:
Ruben S. Montero 2023-09-08 12:59:09 +02:00
parent 6de9e4e8bb
commit a9275666ba
No known key found for this signature in database
GPG Key ID: A0CEA6FA880A1D87
5 changed files with 49 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/vnm_mad/remotes/ebtables/Ebtables.rb
View File

@ -16,9 +16,10 @@
require 'vnmmad'
# Class to implement VLANs using ebtables
class EbtablesVLAN < VNMMAD::NoVLANDriver
DRIVER = "ebtables"
DRIVER = 'ebtables'
XPATH_FILTER = "TEMPLATE/NIC[VN_MAD='ebtables']"
def initialize(vm, xpath_filter = nil, deploy_id = nil)
@ -67,6 +68,9 @@ class EbtablesVLAN < VNMMAD::NoVLANDriver
end
def deactivate
# NIC_ALIAS are not processed, skip
return 0 if @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']
lock
attach_nic_id = @vm['TEMPLATE/NIC[ATTACH="YES"]/NIC_ID']
@ -79,11 +83,11 @@ class EbtablesVLAN < VNMMAD::NoVLANDriver
mac = nic[:mac]
# remove 0-padding
mac = mac.split(":").collect{|e| e.hex.to_s(16)}.join(":")
mac = mac.split(':').collect {|e| e.hex.to_s(16) }.join(':')
tap = ""
tap = ''
rules.each do |rule|
if m = rule.match(/#{mac} -i (\w+)/)
if (m = rule.match(/#{mac} -i (\w+)/))
tap = m[1]
break
end
@ -113,4 +117,5 @@ class EbtablesVLAN < VNMMAD::NoVLANDriver
def remove_rule(rule)
OpenNebula.exec_and_log("#{command(:ebtables)} -D FORWARD #{rule}")
end
end

6
src/vnm_mad/remotes/lib/no_vlan.rb
View File

@ -30,7 +30,6 @@ module VNMMAD
super(vm, xpath_filter, deploy_id)
end
# Activate the driver and creates bridges and tags devices as needed.
def activate
lock
@ -60,6 +59,9 @@ module VNMMAD
# Deactivate the driver and delete bridges and tags devices as needed.
def deactivate
# NIC_ALIAS are not processed, skip
return 0 if @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']
lock
@bridges = list_bridges
@ -132,8 +134,6 @@ module VNMMAD
return 0
end
rescue StandardException => e
raise e
ensure
unlock
end

60
src/vnm_mad/remotes/lib/sg_driver.rb
View File

@ -20,21 +20,27 @@ module VNMMAD
# OpenNebula Firewall with Security Groups Based on IPTables (KVM)
############################################################################
class SGDriver < VNMDriver
DRIVER = "sg"
DRIVER = 'sg'
XPATH_FILTER = "TEMPLATE/NIC[VN_MAD='fw']"
# Rules that simulate an empty list of Security Groups (allow everything)
EMPTY_RULES = {"0"=> [
{:protocol => "ALL",
:rule_type => "OUTBOUND",
:security_group_id => "0",
:security_group_name => "default"},
{:protocol => "ALL",
:rule_type => "INBOUND",
:security_group_id => "0",
:security_group_name => "default"}
]}
EMPTY_RULES = {
'0'=> [
{
:protocol => 'ALL',
:rule_type => 'OUTBOUND',
:security_group_id => '0',
:security_group_name => 'default'
},
{
:protocol => 'ALL',
:rule_type => 'INBOUND',
:security_group_id => '0',
:security_group_name => 'default'
}
]
}
# Attributes that can be updated on update_nic action
SUPPORTED_UPDATE = [
@ -51,12 +57,12 @@ module VNMMAD
# @param [String] hypervisor ID for the VM
# @param [String] hypervisor (e.g. 'kvm' ...)
# @param [String] Xpath for the NICs using the SG driver
def initialize(vm_64, xpath_filter = nil, deploy_id = nil, bridged=true)
def initialize(vm_64, xpath_filter = nil, deploy_id = nil, bridged = true)
@locking = true
@bridged = bridged
vm = Base64::decode64(vm_64)
vm = Base64.decode64(vm_64)
xpath_filter ||= XPATH_FILTER
super(vm, xpath_filter, deploy_id)
@ -83,7 +89,7 @@ module VNMMAD
# Activate the rules, bootstrap iptables chains and set filter rules for
# each VM NIC
def activate(do_all=false)
def activate(do_all = false)
deactivate(do_all)
lock
@ -91,8 +97,8 @@ module VNMMAD
SGIPTables.global_bootstrap(@bridged)
unless do_all
attach_nic_id = @vm['TEMPLATE/NIC[ATTACH="YES"]/NIC_ID']
attach_nic_id ||= @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']
attach_nic_id = @vm['TEMPLATE/NIC[ATTACH="YES"]/NIC_ID']
attach_nic_id ||= @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']
end
# Process the rules for each NIC
@ -101,24 +107,23 @@ module VNMMAD
# SG not supported for NIC_ALIAS
if nic[:security_groups].nil?
nic[:security_groups] = "0"
nic[:security_groups] = '0'
@security_group_rules = EMPTY_RULES
end
SGIPTables.nic_pre(@bridged, @vm, nic)
sg_ids = nic[:security_groups].split(",")
sg_ids = nic[:security_groups].split(',')
sg_ids.each do |sg_id|
rules = @security_group_rules[sg_id]
sg = SGIPTables::SecurityGroupIPTables.new(@vm, nic, sg_id,
rules)
sg = SGIPTables::SecurityGroupIPTables.new(@vm, nic, sg_id, rules)
begin
sg.process_rules
sg.run!
rescue Exception => e
rescue StandardError => e
unlock
deactivate(do_all)
raise e
@ -141,13 +146,13 @@ module VNMMAD
end
# Clean iptables rules and chains
def deactivate(do_all=false)
def deactivate(do_all = false)
lock
begin
unless do_all
attach_nic_id = @vm['TEMPLATE/NIC[ATTACH="YES"]/NIC_ID']
attach_nic_id ||= @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']
attach_nic_id = @vm['TEMPLATE/NIC[ATTACH="YES"]/NIC_ID']
attach_nic_id ||= @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']
end
process_alias do |nic|
@ -161,9 +166,6 @@ module VNMMAD
SGIPTables.nic_deactivate(@vm, nic)
end
rescue Exception => e
raise e
ensure
unlock
end
@ -190,8 +192,6 @@ module VNMMAD
nic.set_qos(deploy_id)
end
rescue StandardError => e
raise e
ensure
unlock
end

3
src/vnm_mad/remotes/lib/vlan.rb
View File

@ -92,6 +92,9 @@ module VNMMAD
# Deactivate the driver and delete bridges and tags devices as needed.
def deactivate
# NIC_ALIAS are not processed, skip
return 0 if @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']
lock
@bridges = list_bridges

6
src/vnm_mad/remotes/ovswitch/OpenvSwitch.rb
View File

@ -142,6 +142,9 @@ class OpenvSwitchVLAN < VNMMAD::VNMDriver
end
def deactivate
# NIC_ALIAS are not processed, skip
return 0 if @vm['TEMPLATE/NIC_ALIAS[ATTACH="YES"]/NIC_ID']
lock
@bridges = list_bridges
@ -445,8 +448,7 @@ class OpenvSwitchVLAN < VNMMAD::VNMDriver
def del_flow(filter)
filter.gsub!(/priority=(\d+)/, '')
run "#{command(:ovs_ofctl)} del-flows " <<
"#{@nic[:bridge]} #{filter}"
run "#{command(:ovs_ofctl)} del-flows #{@nic[:bridge]} #{filter}"
end
def run(cmd)