M #-: Add IP Spoofing support for NIC_ALIAS #4764
Conversation
Add IP addresses of a NIC_ALIAS to the corresponding ipset if the parent NIC belongs to the "Bridged & Security Groups" network mode (fw) when a VM is instantiated or a NIC_ALIAS attached. Signed-off-by: Ricardo Diaz <rdiaz@opennebula.io>
| # Execute post-boot networking setup | ||
| { | ||
| :driver => :vnm, | ||
| :action => :post, |
There was a problem hiding this comment.
Clean action deletes the whole iptables chain included the rules for the parent NIC
| nic_build_hash(nic_element, nic) | ||
|
|
||
| if !VNMMAD.pre_action? | ||
| nic.get_info(self) |
There was a problem hiding this comment.
Do these functions work/make sense for NIC_ALIAS? (when calling it as nics_build('TEMPLATE/NIC_ALIAS')
| # @param element [String] the NIC_ID | ||
| # @return [Hash] the NIC_ALIAS | ||
| def nic_alias(id) | ||
| if @nic_aliases |
There was a problem hiding this comment.
better use exit condition.
return nil if @nic_aliases.nil?
| @@ -334,6 +334,14 @@ def self.vars(vm, nic, sg_id = nil) | |||
| vars[:set_sg_out] = "#{vars[:chain]}-#{sg_id}-o" | |||
| end | |||
|
|
|||
| vars[:nic_aliases] = [] | |||
|
|
|||
| unless nic[:alias_ids].nil? | |||
There was a problem hiding this comment.
prefer if !nic[:alias_ids].nil? for single statements
|
Hello. Such behaviour and delaying PRs with years is highly discouraging to do project contributions. Regards, |
|
Thanks @atodorov-storpool for this an other contributions to the project. As you see this PR is still in review and will include reference to the affected bugs. As per the implementation this is indeed inspired by your PR, but re-written to improve its design and better fit in the driver. Also note that design decisions evolve with the code and need to consider its relation with other new components. Finally, we need to prioritize our available development resources, that unfortunately force us to delay some contributions. Please note that these decisions are not easy for us, and by not means imply that we underestimate your contributions. Thanks again for your valuable contributions and hope you'll keep making them in the future. |
|
What is the status of this? It would be nice to have this included in opennebula... |
|
I have tested that this commit applies fine onto 5.12.0.3 and fixes the issue by adding/removing alias ips to the ipset. |
rsmontero
force-pushed
the
master
branch
2 times, most recently
from
bdce88d to
14635f2
Compare
rsmontero
force-pushed
the
master
branch
2 times, most recently
from
339f9c9 to
1cf07c3
Compare
Add IP addresses of a NIC_ALIAS to the corresponding ipset if the parent
NIC belongs to the "Bridged & Security Groups" network mode (fw) when a
VM is instantiated or a NIC_ALIAS attached.
Signed-off-by: Ricardo Diaz rdiaz@opennebula.io