1b28ea1ebb
network: fix dhcp/password/metadata issues on shared networks with multiple subnets ( #5013 )
...
* #4943 : apply iptables for password and metadata
* #4943 : fix wrong ip alias
* #4943 : revert previous change and add ip_aliases
Co-authored-by: Wei Zhou <weizhouapache@gmail.com>
2021-05-13 14:31:47 +05:30
bc80815cf5
server: Adding VPN options for IKE version and IKE split connections ( #4953 )
...
IKE version allows selecting ike (autoselect), ikev1, or ikev2.
Split connections gives an option of separating the first right subnet from the rest, and kicking out individual statements for each right subnet for better cross-compatibility.
Backported from PR: #4137
update per PR suggestion
Fixes #3138
Co-authored-by: Greg Goodrich <ggoodrich@ippathways.com>
Co-authored-by: Daan Hoogland <dahn@onecht.net>
Co-authored-by: Pearl Dsilva <pearl.dsilva@shapeblue.com>
2021-05-05 12:54:23 +05:30
e824fdba20
Merge remote-tracking branch 'origin/4.14' into 4.15
...
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Conflicts:
server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
2021-04-10 13:41:50 +05:30
4bab06a74b
systemvm: Restricting http access on VR to internal network ( #4847 )
...
There is a potential security issue with having http access to the VR from anywhere.
This PR restricts http access to the VR to the internal network only.
2021-04-10 13:19:31 +05:30
43257f8300
Merge remote-tracking branch 'origin/4.14' into 4.15
2021-04-05 12:59:37 +05:30
ca4669c4d4
systemvm: Add localized "data-server" records in /etc/hosts for VPC routers ( #4873 )
2021-04-05 12:34:10 +05:30
d4ba00434c
VR: fix rsyslog compresses log files but not release disk space in VR ( #4869 )
...
We had critical issue with VR recently. The VRs of shared network or vpc stops working after some days.
After investigation, I found that the disk space is full
```
root@r-10-VM:~# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/vda5 2086316 2069932 0 100% /
```
logrotate/ryslog has compresses the log files, but space is not released. see `lsof |grep deleted`
```
root@r-10-VM:~# lsof |grep deleted
rsyslogd 960 root 12w REG 254,5 493060096 137 /var/log/daemon.log.1 (deleted)
rsyslogd 960 root 13w REG 254,5 17715200 110 /var/log/messages.1 (deleted)
rsyslogd 960 root 16w REG 254,5 545968128 342 /var/log/auth.log.1 (deleted)
rsyslogd 960 root 18w REG 254,5 38313984 341 /var/log/cron.log.1 (deleted)
rsyslogd 960 962 in:imuxso root 12w REG 254,5 493060096 137 /var/log/daemon.log.1 (deleted)
rsyslogd 960 962 in:imuxso root 13w REG 254,5 17715200 110 /var/log/messages.1 (deleted)
rsyslogd 960 962 in:imuxso root 16w REG 254,5 545968128 342 /var/log/auth.log.1 (deleted)
rsyslogd 960 962 in:imuxso root 18w REG 254,5 38313984 341 /var/log/cron.log.1 (deleted)
rsyslogd 960 963 in:imklog root 12w REG 254,5 493060096 137 /var/log/daemon.log.1 (deleted)
rsyslogd 960 963 in:imklog root 13w REG 254,5 17715200 110 /var/log/messages.1 (deleted)
rsyslogd 960 963 in:imklog root 16w REG 254,5 545968128 342 /var/log/auth.log.1 (deleted)
rsyslogd 960 963 in:imklog root 18w REG 254,5 38313984 341 /var/log/cron.log.1 (deleted)
rsyslogd 960 964 in:imfile root 12w REG 254,5 493060096 137 /var/log/daemon.log.1 (deleted)
rsyslogd 960 964 in:imfile root 13w REG 254,5 17715200 110 /var/log/messages.1 (deleted)
rsyslogd 960 964 in:imfile root 16w REG 254,5 545968128 342 /var/log/auth.log.1 (deleted)
rsyslogd 960 964 in:imfile root 18w REG 254,5 38313984 341 /var/log/cron.log.1 (deleted)
rsyslogd 960 965 in:imudp root 12w REG 254,5 493060096 137 /var/log/daemon.log.1 (deleted)
rsyslogd 960 965 in:imudp root 13w REG 254,5 17715200 110 /var/log/messages.1 (deleted)
rsyslogd 960 965 in:imudp root 16w REG 254,5 545968128 342 /var/log/auth.log.1 (deleted)
rsyslogd 960 965 in:imudp root 18w REG 254,5 38313984 341 /var/log/cron.log.1 (deleted)
rsyslogd 960 966 rs:main root 12w REG 254,5 493060096 137 /var/log/daemon.log.1 (deleted)
rsyslogd 960 966 rs:main root 13w REG 254,5 17715200 110 /var/log/messages.1 (deleted)
rsyslogd 960 966 rs:main root 16w REG 254,5 545968128 342 /var/log/auth.log.1 (deleted)
rsyslogd 960 966 rs:main root 18w REG 254,5 38313984 341 /var/log/cron.log.1 (deleted)
```
workaround: restarting rsyslog to release the space.
```
systemctl restart rsyslog
```
The root cause is, the following command does not work in 4.15 template
```
root@r-10-VM:~# invoke-rc.d rsyslog rotate
[FAIL] Closing open files: rsyslogd failed!
```
Fix: use `/usr/lib/rsyslog/rsyslog-rotate` instead
```
root@r-10-VM:~# /usr/lib/rsyslog/rsyslog-rotate
root@r-10-VM:~# cat /usr/lib/rsyslog/rsyslog-rotate
if [ -d /run/systemd/system ]; then
systemctl kill -s HUP rsyslog.service
else
invoke-rc.d rsyslog rotate > /dev/null
fi
```
2021-04-01 14:30:58 +05:30
dc5b9ec7c8
systemvm: remove logrotate config for wtmp and btmp ( #4872 )
...
logrotate in systemvms run every day. it exits with failure.
```
root@r-100-VM:~# systemctl status logrotate
● logrotate.service - Rotate log files
Loaded: loaded (/lib/systemd/system/logrotate.service; static; vendor preset: enabled)
Active: failed (Result: exit-code) since Thu 2021-03-23 00:00:01 UTC; 2 days ago
Docs: man:logrotate(8)
man:logrotate.conf(5)
Process: 25001 ExecStart=/usr/sbin/logrotate /etc/logrotate.conf (code=exited, status=1/FAILURE)
Main PID: 25001 (code=exited, status=1/FAILURE)
Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
```
it is because the logrotate for wtmp and btmp already exist in 4.15 systemvm template.
```
root@r-100-VM:~# cat /etc/logrotate.d/wtmp
/var/log/wtmp {
missingok
monthly
create 0664 root utmp
minsize 1M
rotate 1
}
root@r-100-VM:~# cat /etc/logrotate.d/btmp
/var/log/btmp {
missingok
monthly
create 0660 root utmp
rotate 1
}
```
remove them from /etc/logrotate.conf fixes the issue.
```
root@r-100-VM:~# systemctl status logrotate
● logrotate.service - Rotate log files
Loaded: loaded (/lib/systemd/system/logrotate.service; static; vendor preset: enabled)
Active: inactive (dead) since Thu 2021-03-25 00:00:01 UTC; 9h ago
Docs: man:logrotate(8)
man:logrotate.conf(5)
Process: 28211 ExecStart=/usr/sbin/logrotate /etc/logrotate.conf (code=exited, status=0/SUCCESS)
Main PID: 28211 (code=exited, status=0/SUCCESS)
Mar 25 00:00:01 r-100-VM systemd[1]: Starting Rotate log files...
Mar 25 00:00:01 r-100-VM systemd[1]: logrotate.service: Succeeded.
Mar 25 00:00:01 r-100-VM systemd[1]: Started Rotate log files.
```
2021-04-01 12:51:17 +05:30
63c91c1458
server: Fix network statistics for vpc ( #3944 )
...
This contains 3 main changes
(1) add NETWORK_STATS_ethX for all nics with public ips in VPC VRs (current: NETWORK_STATS_eth1)
(2) DO NOT create records in user_statistics for each VPC tier (only one record per public nic per VPC VR)
(3) send NetworkUsageCommand before unplugging a NIC with public IPs from VPC VR
2021-04-01 12:43:06 +05:30
dab7d29bb2
systemvm: Load modules to support NAT traversal in VR ( #4777 )
...
Load necessary modules so that VPN connection works properly
2021-03-24 12:13:31 +05:30
aab2447656
systemvm: loop optimisation in bash ( #4451 )
...
Co-authored-by: Daan Hoogland <dahn@onecht.net>
2021-02-18 18:18:16 +05:30
f5a44b3502
Merge remote-tracking branch 'origin/4.14' into 4.15
2021-02-05 18:28:02 +05:30
d62d5c6cd2
VR: fix expunging vm will remove dhcp entries of another vm in VR ( #4627 )
...
Steps to reproduce the issue
(1) create two vm wei-001 and wei-002, start them
(2) check /etc/cloudstack/dhcpentry.json and /etc/dhcphosts.txt in VR
They have entries for both of wei-001 and wei-002
(3) stop wei-002, and restart VR (or restart network with cleanup).
check /etc/cloudstack/dhcpentry.json and /etc/dhcphosts.txt in VR
They have entries for wei-001 only (as wei-002 is stopped)
(4) expunge wei-002. when it is done,
check /etc/cloudstack/dhcpentry.json and /etc/dhcphosts.txt in VR
They do not have entries for wei-001.
VR health check fails at dhcp_check.py and dns_check.py
2021-02-05 18:10:53 +05:30
58a0a7b1a3
Merge remote-tracking branch 'origin/4.14'
2020-12-14 14:41:06 +05:30
4d33e159f7
vr: Ensuring dnsmasq.leases file is populated ( #4529 )
2020-12-14 09:06:24 +00:00
e9ce381c56
Merge branch '4.14'
2020-11-25 09:04:53 +01:00
8a68617eee
bugfix #9 vpc vr: Add PREROUTING rule for vm with static nat to multiple private gateways
2020-11-25 08:40:16 +01:00
69c0f71cf7
bugfix #8 vpc: add rule for traffic between vm and private gateway
2020-11-25 08:40:16 +01:00
a8c9b4531b
bugfix #7 vpc vr: allow servers in private gateway to reach internet via the VPC VR if it is gateway
2020-11-25 08:40:16 +01:00
8fb2efee1c
bugfix #6 vpc vr: Add iptables rules for ACL of private gateway
2020-11-25 08:40:16 +01:00
7e6f484332
Revert "Fix Policy Based Routing for private gateway static routes ( #3604 )"
...
This reverts commit 82d94a87c5
2020-11-25 08:40:16 +01:00
5cc6fedb1f
Revert "Handle private gateways more reliably"
...
This reverts commit f4f9b3ab4e
2020-11-25 08:40:16 +01:00
8e03374c29
Merge remote-tracking branch 'origin/4.14'
2020-11-23 16:00:41 +05:30
81ac9f90ab
vr: fix python exception when configure VRs ( #4489 )
...
before
```
root@r-27-VM:/var/cache/cloud# /opt/cloud/bin/configure.py monitor_service.json
ERROR:root:Command 'ip link show eth0 | grep 'state DOWN'' returned non-zero exit status 1
```
with this change
```
root@r-27-VM:/var/cache/cloud# /opt/cloud/bin/configure.py monitor_service.json
root@r-27-VM:/var/cache/cloud#
```
2020-11-23 14:09:40 +05:30
d3f18ef71c
Merge remote-tracking branch 'origin/4.14'
2020-11-20 21:12:20 +05:30
75fdb07387
vpc: fix ips on wrong interfaces after rebooting vpc vrs ( #4467 )
...
* vpc: fix ips on wrong interfaces after rebooting vpc vrs
* #4467 : Rename to updateNicWithDeviceId
* CLSTACK-8923 vr: Force a restart of keepalived if conntrackd is not running or configuration has changed
2020-11-20 21:02:53 +05:30
492962238e
Merge branch '4.14'
2020-11-20 11:43:20 +00:00
a368ba9def
VR: fix logging is not working and logs are not appended to /var/log/cloud.log ( #4466 )
2020-11-20 10:40:02 +00:00
88762c101c
Added compress option to dnsmasq log files ( #4439 )
2020-11-06 09:33:52 +00:00
ffc42b9d92
Merge branch '4.14'
2020-11-04 09:33:46 +01:00
34146569d9
FIX issue in VR if remote access vpn is enabled ( #4430 )
...
Co-authored-by: Rakesh Venkatesh <r.venkatesh@global.leaseweb.com>
2020-11-04 09:27:48 +01:00
ee5094b77f
Merge branch '4.14'
2020-10-24 12:55:25 +02:00
ff8a84ee77
systemvm: fix proc.find in CsProcess.py ( #4413 )
...
Co-authored-by: Wei Zhou <w.zhou@global.leaseweb.com>
2020-10-21 19:21:54 +02:00
766eab8cab
Merge remote-tracking branch 'origin/4.13' into 4.14
2020-09-23 10:49:19 +05:30
ab02cf7078
router: adding "data-server" dns entry in /etc/hosts ( #4319 )
...
The DNS entry "data-server" was not added in /etc/hosts.
Since the VR is now considered as a "dhcpsrvr" (?), we need to apply this commit to add this DNS entry.
/etc/hosts is fully rewritten by this script.
Fixes : #4308
(cherry picked from commit dc65f31f9f
2020-09-23 10:48:44 +05:30
dc65f31f9f
router: adding "data-server" dns entry in /etc/hosts ( #4319 )
...
The DNS entry "data-server" was not added in /etc/hosts.
Since the VR is now considered as a "dhcpsrvr" (?), we need to apply this commit to add this DNS entry.
/etc/hosts is fully rewritten by this script.
Fixes : #4308
2020-09-22 13:07:56 +05:30
9ae1170b29
Merge remote-tracking branch 'origin/4.14'
2020-08-04 11:28:43 +05:30
407e34d4e7
vrouter: remove a POSTROUTING rule for port forwarding in VPC router ( #3952 )
...
As discussed in #3937 (comment)
a rule for port forwarding in VPC router might not be needed.
This fixes the failed result of health check for network VRs.
2020-08-04 11:25:28 +05:30
3de5ca9871
Merge remote-tracking branch 'origin/4.13' into 4.14
...
Fixes forward-merge lint issue
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
2020-06-15 08:59:08 +05:30
1e19ea5bdd
systemvmtemplate: move to using Debian10 ( #4104 )
...
This upgrades the systemvmtemplate base to Debian 10 with openjdk-11 and a newer strongswan package.
Fixes #3654
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
2020-06-09 08:20:51 +05:30
1756b0f64a
noVNC console integration ( #3967 )
...
* Adding noVNC repo
* Adding support for noVNC
* Adding Ctl+Esc
* Removing device name from novnc header
2020-05-19 14:14:04 +02:00
8f3ad0fd8d
python format ( #4087 )
2020-05-18 15:15:01 +00:00
60d7215a06
fix dhcp lease entry wrong hostname ( #4064 )
...
When Guest VM add secondary nic, will get wrong hostname "infiniteh" from dhcp server
infiniteh -->infinite
cat /etc/dhcphosts.txt
02:00:0b:ef:00:04,set:192_168_4_18,192.168.4.18,gumd-tes3,infiniteh
2020-05-11 10:56:14 +02:00
8e4be6dc60
Merge branch '4.13'
2020-04-16 15:27:52 +02:00
22e0fc8752
mac-check
2020-04-16 15:10:50 +02:00
6a72e6e9f8
do not put in default accept rules for DNS and BOOTPS
2020-04-16 15:09:51 +02:00
32b509a83e
Handle port forward rule check for vpc and non vpc Isolated net… ( #3963 )
...
Co-authored-by: Pearl Dsilva <pearl.dsilva@shapeblue.com>
2020-03-13 09:20:42 +01:00
6f9890694d
Merge release branch 4.13 to master
...
* 4.13:
vr: fix password server run with empty gateway in isolated netw… (#3943 )
Fix simulator docker db deploy issue (apache#3397) (#3651 )
2020-03-09 11:26:21 +01:00
7d0fd9fa3f
vr: fix password server run with empty gateway in isolated netw… ( #3943 )
2020-03-09 10:35:56 +01:00
06a8ff04b1
Merge release branch 4.13 to master
...
* 4.13:
VR: Fix Redundant VRouter guest network on wrong interface (#3847 )
2020-02-29 19:56:07 +01:00
Wei Zhou
Pearl Dsilva
Rohit Yadav
Spaceman1984
aleskxyz
Wei Zhou
Rakesh
dahn
davidjumani
Daan Hoogland
Lucas Granet
havengit
dahn