Skip to content

Commit bc8698d

Browse files
abdosiabdosi
authored
Merge pull request #21 from abdosi/feature
What I did: Fixes: sonic-net#12179 Why I did: Fix the issue where if dest port is not specified in ACL rule than for multi-asic where we create NAT rule to forward traffic from Namespace to host fail with exception. How I verify:- Added UT for the scenario.
2 parents 6e45acc + 557a110 commit bc8698d

File tree

3 files changed

+64
-21
lines changed

3 files changed

+64
-21
lines changed

‎scripts/caclmgrd‎

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -314,27 +314,28 @@ class ControlPlaneAclManager(daemon_base.DaemonBase):
314314
nat_source_ipv6_set = acl_source_ip_map[acl_service]["ipv6"] if acl_source_ip_map and acl_source_ip_map[acl_service]["ipv6"] else { "::/0" }
315315

316316
for ip_protocol in self.ACL_SERVICES[acl_service]["ip_protocols"]:
317-
for dst_port in self.ACL_SERVICES[acl_service]["dst_ports"]:
318-
for ipv4_src_ip in nat_source_ipv4_set:
319-
# IPv4 rules
320-
fwd_traffic_from_namespace_to_host_cmds.append(self.iptables_cmd_ns_prefix[namespace] +
321-
"iptables -t nat -A PREROUTING -p {} -s {} --dport {} -j DNAT --to-destination {}".format
322-
(ip_protocol, ipv4_src_ip, dst_port,
323-
self.namespace_mgmt_ip))
324-
fwd_traffic_from_namespace_to_host_cmds.append(self.iptables_cmd_ns_prefix[namespace] +
325-
"iptables -t nat -A POSTROUTING -p {} -s {} --dport {} -j SNAT --to-source {}".format
326-
(ip_protocol, ipv4_src_ip, dst_port,
327-
self.namespace_docker_mgmt_ip[namespace]))
328-
for ipv6_src_ip in nat_source_ipv6_set:
329-
# IPv6 rules
330-
fwd_traffic_from_namespace_to_host_cmds.append(self.iptables_cmd_ns_prefix[namespace] +
331-
"ip6tables -t nat -A PREROUTING -p {} -s {} --dport {} -j DNAT --to-destination {}".format
332-
(ip_protocol, ipv6_src_ip, dst_port,
333-
self.namespace_mgmt_ipv6))
334-
fwd_traffic_from_namespace_to_host_cmds.append(self.iptables_cmd_ns_prefix[namespace] +
335-
"ip6tables -t nat -A POSTROUTING -p {} -s {} --dport {} -j SNAT --to-source {}".format
336-
(ip_protocol,ipv6_src_ip, dst_port,
337-
self.namespace_docker_mgmt_ipv6[namespace]))
317+
if "dst_ports" in self.ACL_SERVICES[acl_service]:
318+
for dst_port in self.ACL_SERVICES[acl_service]["dst_ports"]:
319+
for ipv4_src_ip in nat_source_ipv4_set:
320+
# IPv4 rules
321+
fwd_traffic_from_namespace_to_host_cmds.append(self.iptables_cmd_ns_prefix[namespace] +
322+
"iptables -t nat -A PREROUTING -p {} -s {} --dport {} -j DNAT --to-destination {}".format
323+
(ip_protocol, ipv4_src_ip, dst_port,
324+
self.namespace_mgmt_ip))
325+
fwd_traffic_from_namespace_to_host_cmds.append(self.iptables_cmd_ns_prefix[namespace] +
326+
"iptables -t nat -A POSTROUTING -p {} -s {} --dport {} -j SNAT --to-source {}".format
327+
(ip_protocol, ipv4_src_ip, dst_port,
328+
self.namespace_docker_mgmt_ip[namespace]))
329+
for ipv6_src_ip in nat_source_ipv6_set:
330+
# IPv6 rules
331+
fwd_traffic_from_namespace_to_host_cmds.append(self.iptables_cmd_ns_prefix[namespace] +
332+
"ip6tables -t nat -A PREROUTING -p {} -s {} --dport {} -j DNAT --to-destination {}".format
333+
(ip_protocol, ipv6_src_ip, dst_port,
334+
self.namespace_mgmt_ipv6))
335+
fwd_traffic_from_namespace_to_host_cmds.append(self.iptables_cmd_ns_prefix[namespace] +
336+
"ip6tables -t nat -A POSTROUTING -p {} -s {} --dport {} -j SNAT --to-source {}".format
337+
(ip_protocol,ipv6_src_ip, dst_port,
338+
self.namespace_docker_mgmt_ipv6[namespace]))
338339

339340
return fwd_traffic_from_namespace_to_host_cmds
340341

‎tests/caclmgrd/caclmgrd_external_client_acl_test.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,10 @@ def test_caclmgrd_external_client_acl(self, test_name, test_data, fs):
4242

4343
iptables_rules_ret, _ = caclmgrd_daemon.get_acl_rules_and_translate_to_iptables_commands('')
4444
self.assertEqual(set(test_data["return"]).issubset(set(iptables_rules_ret)), True)
45+
caclmgrd_daemon.iptables_cmd_ns_prefix['asic0'] = 'ip netns exec asic0'
46+
caclmgrd_daemon.namespace_docker_mgmt_ip['asic0'] = '1.1.1.1'
47+
caclmgrd_daemon.namespace_mgmt_ip = '2.2.2.2'
48+
caclmgrd_daemon.namespace_docker_mgmt_ipv6['asic0'] = 'fd::01'
49+
caclmgrd_daemon.namespace_mgmt_ipv6 = 'fd::02'
50+
51+
_ = caclmgrd_daemon.generate_fwd_traffic_from_namespace_to_host_commands('asic0', None)

‎tests/caclmgrd/test_external_client_acl_vectors.py‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,41 @@
44
caclmgrd test external_client_acl vector
55
"""
66
EXTERNAL_CLIENT_ACL_TEST_VECTOR = [
7+
[
8+
"Test for EXTERNAL_CLIENT_ACL with no dest port configured.",
9+
{
10+
"config_db": {
11+
"ACL_TABLE": {
12+
"EXTERNAL_CLIENT_ACL": {
13+
"stage": "INGRESS",
14+
"type": "CTRLPLANE",
15+
"services": [
16+
"EXTERNAL_CLIENT"
17+
]
18+
}
19+
},
20+
"ACL_RULE": {
21+
"EXTERNAL_CLIENT_ACL|DEFAULT_RULE": {
22+
"ETHER_TYPE": "2048",
23+
"PACKET_ACTION": "DROP",
24+
"PRIORITY": "1"
25+
},
26+
"EXTERNAL_CLIENT_ACL|RULE_1": {
27+
"PACKET_ACTION": "ACCEPT",
28+
"PRIORITY": "9998",
29+
"SRC_IP": "20.0.0.55/32"
30+
},
31+
},
32+
"DEVICE_METADATA": {
33+
"localhost": {
34+
}
35+
},
36+
"FEATURE": {},
37+
},
38+
"return": [
39+
],
40+
}
41+
],
742
[
843
"Test single IPv4 dst port + src ip for EXTERNAL_CLIENT_ACL",
944
{

0 commit comments

Comments
 (0)