Commit Graph

91 Commits

Author SHA1 Message Date
Marcus Sorensen 7dbea68b87 Summary: Wait for VPC router nics to hotplug before assigning IPs
Detail: CLOUDSTACK-1452, CLOUDSTACK-1523 - When rebooting VPC routers, ip addr
assignment was inconsistent, sometimes the assignment would be attempted while
router was still setting up nic device. This adds a watch for the nic to show
up before attempting to add an ip to a nic.

Signed-off-by: Marcus Sorensen <marcus@betterservers.com> 1362521453 -0700
2013-03-05 15:10:53 -07:00
Jayapal b6727e5646 CLOUDSTACK-299: Egress firewall rules feature for guest network on VR 2013-01-31 11:20:47 +05:30
Sheng Yang a5ac88db88 CLOUDSTACK-938: Add missing checkbatchs2svpn.sh 2013-01-18 11:01:00 -08:00
Marcus Sorensen e37a82375c Summary: Fix rp_filter for VPC router
Detail: VPC router was being treated like normal VR, which was an issue because
normally the VR has an eth0,1,2 which are isolated, linklocal, and public
networks respectively. rp_filter is turned on for eth0,1 and off for 2
(hardcoded). VPC however comes up with eth0,1 as public, linklocal, and no other
interfaces until new isolated networks are added, so the process doesn't work.
This change turns on rp_filter as new isolated networks are added to the VR.

BUG-ID: CLOUDSTACK-938
Bugfix-for: 4.0.2
Signed-off-by: Marcus Sorensen <marcus@betterservers.com> 1358451991 -0700
2013-01-17 12:51:38 -07:00
Sheng Yang 911f8c33c5 Fix broadcast address is 0.0.0.0 on additional public vlan issue 2012-12-21 15:22:15 -08:00
Sheng Yang 7926e66afa Redundant router: Fix wrong log attend to keepalived.log
If something got wrong with passwd_server_ip script, it would output to
keepalived.log, thus cause other scripts malfunctional.

Also make savepassword.sh using the same lock as serve_password.sh.
2012-12-21 15:21:49 -08:00
Marcus Sorensen 82a7e49fad Summary: Add TCP to DNS firewall settings for virtual routers
Detail: TCP is occasionally used for certain DNS query types

BUG-ID: CLOUDSTACK-535
Bugfix-for: 4.0.1
Reported-by: Tamas Monos
Signed-off-by: Marcus Sorensen <marcus@betterservers.com> 1353946670 -0700
2012-11-26 09:21:32 -07:00
Rohit Yadav ac1920ee9d CLOUDSTACK-500: Fix race condition between password server and iptables-persistent
Fixes order of service startup. Fixes file redirectors.

Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
2012-11-23 15:43:11 +05:30
Alex Huang 25e8deb679 Applied review #7342 2012-10-01 17:34:56 -07:00
Anthony Xu 12d12ac54c CS-16409 : dhcp request doesn't have target ip, remove ip in the iptable rule 2012-10-01 10:27:42 -07:00
Anthony Xu 87e6278725 CS-16049 : VPC, VR provides metadata and user data through port 80, this port should be only open for targeting to this VR ip 2012-10-01 10:27:42 -07:00
Anthony Xu a892f08280 fix licnese header for vpc_passwd_server 2012-09-28 10:18:01 -07:00
Anthony Xu e44d306dd9 VPC : password reset fix 2012-09-26 17:42:42 -07:00
Anthony Xu 1946a9a583 VPC : password reset,
add console redirect
2012-09-26 17:42:42 -07:00
Anthony Xu ddffdc9db7 CS-16393
one typo fix
    make passwd service exitable
2012-09-26 17:42:42 -07:00
Anthony Xu b59c3c8885 VPC : password server, start password server when guest network is created 2012-09-26 17:42:42 -07:00
Sheng Yang 435e4f6868 CS-16400: Fix LB service using port 8080
Also added license header for passwd_server_ip

Ported from:

commit 1072ec7ae3
Author: Sheng Yang <sheng.yang@citrix.com>
Date:   Wed Sep 12 11:15:33 2012 -0700

    CS-16318: Update the fix with some tweak

    1. The old fix run cloud-passwd-srvr twice because cloud-passwd-srvr is
still in the list of enabled_svcs

    2. The lock should be applied on serve_password.sh, which controlled the
accessing to the password. Applied on the MASTER/BACKUP switch is useless, two
instance of serve_password.sh would still able to access the password file at
the same time.

    3. Password service is a part of redundant router state transition process
now, so if the service failed to start, then the transition failed.

    4. Restart password service should be put before restart dnsmasq, which
would sent out DHCP offer to the user vms. If user VMs got the DHCP offer first
but failed to get password, there would be an issue.

    Reviewed-by: Anthony Xu

commit fa94da1140
Author: Jayapal Reddy <jayapalreddy.uradi@citrix.com>
Date:   Wed Sep 12 17:57:03 2012 +0530

    Bug:CS-16318 Starting password server on the both IPs in RRVM
    Reviewed-by: Abhi

Conflicts:

	patches/systemvm/debian/config/opt/cloud/bin/passwd_server
2012-09-26 16:28:33 -07:00
Anthony Xu 44e8938120 CLOUDSTACK-106: this issue seems be coverred by other issue somehow, when other issue is fixed, this issue shows up 2012-09-21 10:24:58 -07:00
Marcus Sorensen bf30dbc241 VPC - enable passwd server service
There is currently no vpcrouter type defined in patchsystemvm.sh, which
controls our init scripts in the system vms. This patch allows the
services that would normally start on a router to start also on the VPC
router, in particular the password server was missing.

Signed-off-by: Edison Su <sudison@gmail.com>
2012-09-20 15:44:51 -07:00
Chip Childers 763311c006 License header updates, and modification to root pom for exclusions. 2012-09-13 16:55:48 -04:00
anthony ba0522461d VPC : configure apache2 for each guest network 2012-09-07 18:10:42 -07:00
Anthony Xu 4a0e645e28 CS-16254:
passwd_server listen on every interface, but only guest interface is enabled for that port
2012-09-07 17:10:54 -07:00
Anthony Xu 3cfe01d07c VPC : by default , outgoing traffic is allowed out, once egress rules are added, only traffic specified in those are allowed out, others are blocked 2012-09-07 17:03:12 -07:00
Edison Su ea9121bc8f KVM initial VPC support
Implements
SetupGuestNetworkCommand,SetNetworkACLCommand,SetSourceNatCommand,IpAssocVpcCommand,SetPortForwardingRulesVpcCommand.
Passes basic functionality, though I'm sure there may be some honing to
do.

Also fixes a few minor things found along the way:
 vpc_guestnw.sh wasn't successfully setting up apache due to default
listen IP of 10.1.1.1
 vpc_guestnw.sh was referencing a 'logger_it' function, replaced with
'logger -t cloud'
 system vms were running with OS type "Debian GNU/Linux 5.0(32-bit)",
which was not found in the KVMGuestOsMapper
 the Xen implementation of SetupGuestNetworkCommand had apparently
copied its catch message from UnPlug Nic, fixed string

Send-by: Marcus Sorensen
RB: https://reviews.apache.org/r/6883
2012-09-04 11:45:59 -07:00
Gavin Lee 39a676c496 Correct license header mainly for patches folder
Signed-off-by: Chip Childers <chip.childers@gmail.com>
I've assumed that Gavin's commit is appropriate, based
on an assumption that we will keep these files in the source
tree.  If https://issues.apache.org/jira/browse/LEGAL-146
results in a different opionion from the members, then we
will end up having to do something more drastic anyway.
2012-08-31 10:50:46 -04:00
Rohit Yadav fd4a1a39c1 Bug CS-15970: Fixes Redundant router status when host is XenServer 2012-08-28 12:07:33 +05:30
kishan b42a813ff1 bug CS-16112: During unplug nic iptables rules are cleaned up in both cloud_nic.sh and vpc_netusage.sh. Consolidated this code in cloud_nic.sh
status CS-16112: resolved fixed

Conflicts:
	patches/systemvm/debian/config/opt/cloud/bin/vpc_netusage.sh
2012-08-22 12:00:02 +05:30
Sheng Yang 20ccb6c1cb S2S VPN: CS-16092: Add ESP rule to iptables
Otherwise the other end cannot initiate connection.
2012-08-20 17:28:46 -07:00
kishan 691be5c60e bug CS-15577: Added per gateway network usage for VPC and VPN usage. VPN usage uses 525 mark for outgoing traffic and 524 mark for incoming traffic
status CS-15577: resolved fixed
2012-08-17 17:07:13 +05:30
Sheng Yang e7efd0d95b S2S VPN: Don't consider VPN is down if IPsec SA still existed
Because ISAKMP SA wouldn't be updated after expiration if IPsec SA is still in
affect.
2012-08-10 16:20:52 -07:00
Sheng Yang 435480cb5a S2S VPN: CS-15641: Enable UDP port 4500 for NAT-T 2012-08-06 17:15:38 -07:00
Sheng Yang 4908adb3a1 S2S VPN: CS-15852: Add vpninmask for VPN network usage 2012-08-06 15:32:36 -07:00
Sheng Yang 6e7b4bc07b S2S VPN: CS-15642: Re-initiate the VPN connections after router reboot
Conflicts:

	server/src/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java
2012-08-06 15:32:18 -07:00
Sheng Yang 84a1a311f9 S2S VPN: CS-15511: Add PFS support for VPN connection 2012-08-06 15:27:13 -07:00
Sheng Yang 1b5103c501 S2S VPN: CS-15472: Separate IKE lifetime and ESP lifetime 2012-08-06 15:19:26 -07:00
anthony 9b43753399 VPC : handle Revoke rules for staticroute 2012-08-02 18:59:49 -07:00
anthony 0c9d5f5eb1 VPC : typo 2012-08-02 18:59:48 -07:00
anthony f763f53c2d CS-15680 : set broadcast IP 2012-07-30 13:24:33 -07:00
anthony 3aae979967 CS-15708 : fix network cleanup 2012-07-30 13:24:10 -07:00
Sheng Yang dd50bdf38e CS-15731: Make S2S VPN no-nat rule the top of POSTROUTING 2012-07-27 18:49:25 -07:00
Sheng Yang 8eee8f342e S2S VPN: CS-15650: Add connection status update to s2s vpn 2012-07-27 16:28:06 -07:00
anthony 59937838e5 VPC : create/destroy static nat 2012-07-27 15:04:42 -07:00
anthony ae579c4cdd VPC : create/destroy static route 2012-07-27 15:04:42 -07:00
anthony 0d52ac205b VPC : create/destroy source NAT 2012-07-27 15:04:42 -07:00
anthony 9910176d76 VPC : create/destroy private Gateway 2012-07-27 15:04:41 -07:00
anthony f7da1772b0 VPC : portforwarding script 2012-07-27 15:04:41 -07:00
anthony 952da87e19 VPC : basic network usage per guest network 2012-07-27 15:04:41 -07:00
anthony 744bfdce5f VPC : vpc loadbalancer script 2012-07-27 15:04:41 -07:00
anthony 7dc4231ea6 VPC : vpc ip assocate fix 2012-07-27 15:04:41 -07:00
anthony 165a21c62a VPC : vpc_acl.sh is for VPC access control list 2012-07-27 15:04:40 -07:00