def setRpFilterIfNeeded(netIfaceName, hostname, loose_mode):
"""
Set rp_filter to loose or strict mode if there's no session using the
netIfaceName device and it's not the device used by the OS to reach the
'hostname'.
loose mode is needed to allow multiple iSCSI connections in a multiple NIC
per subnet configuration. strict mode is needed to avoid the security
breach where an untrusted VM can DoS the host by sending it packets with
spoofed random sources.
Arguments:
netIfaceName: the device used by the iSCSI session
target: iSCSI target object cointaining the portal hostname
loose_mode: boolean
"""
if netIfaceName is None:
log.debug("iface.net_ifacename not provided, skipping rp filter setup")
return
sessions = _sessionsUsingNetiface(netIfaceName)
if not any(sessions) and netIfaceName != getRouteDeviceTo(hostname):
if loose_mode:
log.info("Setting loose mode rp_filter for device %r." %
netIfaceName)
supervdsm.getProxy().set_rp_filter_loose(netIfaceName)
else:
log.info("Setting strict mode rp_filter for device %r." %
netIfaceName)
supervdsm.getProxy().set_rp_filter_strict(netIfaceName)
def test_routes_device_to(self, ip_addr, ip_netmask, nic0):
addr_in_net = ipaddress.ip_address(ip_addr) + 1
ip_version = addr_in_net.version
Interface.from_existing_dev_name(nic0).add_ip(ip_addr,
ip_netmask,
family=ip_version)
assert routes.getRouteDeviceTo(str(addr_in_net)) == nic0
def test_routes_device_to(self, ip_addr, ip_netmask, nic0):
addr_in_net = ipaddress.ip_address(ip_addr) + 1
ip_version = addr_in_net.version
ipwrapper.addrAdd(nic0, ip_addr, ip_netmask, family=ip_version)
try:
ipwrapper.linkSet(nic0, ['up'])
assert routes.getRouteDeviceTo(str(addr_in_net)) == nic0
finally:
ipwrapper.addrFlush(nic0, ip_version)
def testGetRouteDeviceTo(self):
with dummyIf(1) as nics:
nic, = nics
addrAdd(nic, IP_ADDRESS, IP_CIDR)
try:
linkSet(nic, ['up'])
self.assertEqual(getRouteDeviceTo(IP_ADDRESS_IN_NETWORK), nic)
finally:
addrFlush(nic)
sysctl.disable_ipv6(nic, False)
addrAdd(nic, IPv6_ADDRESS, IPv6_CIDR, family=6)
try:
linkSet(nic, ['up'])
self.assertEqual(getRouteDeviceTo(IPv6_ADDRESS_IN_NETWORK),
nic)
finally:
addrFlush(nic)
