Skip to content

Commit cba3638

Browse files
skommalaroberto-sanchez-herreraMahuwa-Barmantelakerachavan
authored
Topic sk bug 35241678 (#183)
Fixed Bug 35241678 - Network validation script flagging load balancer port 443 port to be open to Internet. 1. Tested private load balancer with out cidr 0.0.0.0/0 2. Tested public load balancer. --------- Co-authored-by: Roberto Sanchez <[email protected]> Co-authored-by: Mahuwa Barman <[email protected]> Co-authored-by: telake <[email protected]> Co-authored-by: Rajesh Chavan <[email protected]> Co-authored-by: abhijit-paranjpe <[email protected]>
1 parent 67441ca commit cba3638

File tree

6 files changed

+24
-13
lines changed

6 files changed

+24
-13
lines changed

terraform/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ module "network-validation" {
2121
existing_lb_nsg_id = var.add_existing_nsg && var.add_load_balancer ? var.existing_lb_nsg_id : ""
2222
existing_mount_target_nsg_id = var.add_existing_nsg && var.add_fss ? var.existing_mount_target_nsg_id : ""
2323
existing_bastion_nsg_id = var.add_existing_nsg && var.is_bastion_instance_required ? var.existing_bastion_nsg_id : ""
24+
lb_source_cidr = var.add_load_balancer ? (var.is_lb_private ? "" : "0.0.0.0/0") : ""
2425
}
2526

2627
module "system-tags" {

terraform/modules/network-validator/locals.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ locals {
77
validation_script_bastion_ip_param = var.bastion_ip != "" ? format("--bastionip %s", var.bastion_ip) : ""
88
validation_script_lb_subnet_1_param = var.lb_subnet_1_id != "" ? format("--lbsubnet1 %s", var.lb_subnet_1_id) : ""
99
validation_script_lb_subnet_2_param = var.lb_subnet_2_id != "" ? format("--lbsubnet2 %s", var.lb_subnet_2_id) : ""
10+
validation_script_lb_source_cidr_param = var.lb_source_cidr != "" ? format("--lbsourcecidr %s", var.lb_source_cidr) : ""
1011
validation_script_wls_lb_port = var.wls_ms_extern_port != "" ? format("--externalport %s", var.wls_ms_extern_port) : ""
1112
validation_script_mount_target_subnet_param = var.mount_target_subnet_id != "" ? format("--fsssubnet %s", var.mount_target_subnet_id) : ""
1213
validation_script_atp_db_id_param = var.atp_db_id != "" ? format("--atpdbid %s", var.atp_db_id) : ""

terraform/modules/network-validator/scripts/network_validation.sh

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ LB_NSG_OCID=""
3737
FSS_NSG_OCID=""
3838
LPG_OCID=""
3939
ALL_IPS="0.0.0.0/0"
40+
LB_SOURCE_CIDR=""
4041
NETWORK_VALIDATION_MSG="Fix the network validation script errors and re-run the script in the cloud shell"
4142

4243
debug=false
@@ -240,6 +241,9 @@ function check_tcp_port_open_in_seclist_or_nsg() {
240241
else
241242
source_in_cidr_range=1
242243
fi
244+
elif [[ $source = "" ]]
245+
then
246+
source_in_cidr_range=0
243247
else
244248
source_in_cidr_range=$(in_cidr_range $ingress_source $source ; echo $?)
245249
fi
@@ -519,9 +523,10 @@ This script is used to validate existing subnets, and optionally network securit
519523
-g, --lpg OCID of the Local Peering Gateway (LPG) in the DB VCN
520524
-b, --bastionsubnet Bastion Subnet OCID
521525
-i, --bastionip Bastion Host IP. Provide this if using existing bastion
526+
-j, --lbsourcecidr Load Balance Source CIDR
522527
-u, --lbsubnet1 Load Balancer Subnet 1 OCID
523528
-v, --lbsubnet2 Load Balancer Subnet 2 OCID which is required only for AD subnet
524-
-l, --externalport WebLogic Managed Server External Port
529+
-l, --externalport WebLogic Managed Server External Port
525530
-f, --fsssubnet File Storage Service (FSS) Mount Target Subnet OCID
526531
-a, --adminsrvnsg OCID of the Network Security Group (NSG) for the administration server (Required if using NSGs instead of security lists)
527532
-m, --managedsrvnsg OCID of the Network Security Group (NSG) for the managed servers (Required if using NSGs instead of security lists)
@@ -587,6 +592,7 @@ while [[ $1 = -?* ]]; do
587592
-g|--lpg) shift; LPG_OCID=${1} ;;
588593
-b|--bastionsubnet) shift; BASTION_SUBNET_OCID=${1} ;;
589594
-i|--bastionip) shift; BASTION_HOST_IP=${1} ;;
595+
-j|--lbsourcecidr) shift; LB_SOURCE_CIDR=${1} ;;
590596
-u|--lbsubnet1) shift; LB_SUBNET_1_OCID=${1} ;;
591597
-v|--lbsubnet2) shift; LB_SUBNET_2_OCID=${1} ;;
592598
-l|--externalport) shift; WLS_LB_PORT=${1} ;;
@@ -963,20 +969,18 @@ if [[ -n ${LB_SUBNET_1_OCID} ]]
963969
then
964970
if [[ -z ${LB_NSG_OCID} ]]
965971
then
966-
res=$(validate_subnet_port_access "${LB_SUBNET_1_OCID}" ${LB_PORT} "${ALL_IPS}")
972+
res=$(validate_subnet_port_access "${LB_SUBNET_1_OCID}" ${LB_PORT} "${LB_SOURCE_CIDR}")
967973
if [[ $res -ne 0 ]]
968974
then
969-
echo "ERROR: Port [$LB_PORT] is not open for 0.0.0.0/0 in LB Subnet CIDR [${LB_SUBNET_1_OCID}]. ${NETWORK_VALIDATION_MSG}"
970-
validation_return_code=2
975+
echo "WARNING : Port [$LB_PORT] is not open for ${LB_SOURCE_CIDR} in LB Subnet CIDR [${LB_SUBNET_1_OCID}]. ${NETWORK_VALIDATION_MSG}"
971976
fi
972977
else
973978
if [[ -n ${ADMIN_SRV_NSG_OCID} && -n ${MANAGED_SRV_NSG_OCID} ]]
974979
then
975-
res=$(check_tcp_port_open_in_seclist_or_nsg $LB_NSG_OCID "${LB_PORT}" "$ALL_IPS" "nsg")
980+
res=$(check_tcp_port_open_in_seclist_or_nsg $LB_NSG_OCID "${LB_PORT}" "${LB_SOURCE_CIDR}" "nsg")
976981
if [[ $res -ne 0 ]]
977982
then
978-
echo "ERROR: Port [$LB_PORT] is not open for 0.0.0.0/0 in Load Balancer Server NSG [${LB_NSG_OCID}]. ${NETWORK_VALIDATION_MSG}"
979-
validation_return_code=2
983+
echo "WARNING : Port [$LB_PORT] is not open for ${LB_SOURCE_CIDR} in Load Balancer Server NSG [${LB_NSG_OCID}]. ${NETWORK_VALIDATION_MSG}"
980984
fi
981985
fi
982986
fi
@@ -1014,19 +1018,19 @@ if [[ -n ${LB_SUBNET_2_OCID} ]]
10141018
then
10151019
if [[ -z ${LB_NSG_OCID} ]]
10161020
then
1017-
res=$(validate_subnet_port_access "${LB_SUBNET_2_OCID}" ${LB_PORT} "${ALL_IPS}")
1021+
res=$(validate_subnet_port_access "${LB_SUBNET_2_OCID}" ${LB_PORT} "${LB_SOURCE_CIDR}")
10181022
if [[ $res -ne 0 ]]
10191023
then
1020-
echo "ERROR: Port [$LB_PORT] is not open for 0.0.0.0/0 in LB Subnet CIDR [${LB_SUBNET_2_OCID}]. ${NETWORK_VALIDATION_MSG}"
1024+
echo "ERROR: Port [$LB_PORT] is not open for ${LB_SOURCE_CIDR} in LB Subnet CIDR [${LB_SUBNET_2_OCID}]. ${NETWORK_VALIDATION_MSG}"
10211025
validation_return_code=2
10221026
fi
10231027
else
10241028
if [[ -n ${ADMIN_SRV_NSG_OCID} && -n ${MANAGED_SRV_NSG_OCID} ]]
10251029
then
1026-
res=$(check_tcp_port_open_in_seclist_or_nsg $LB_NSG_OCID "${LB_PORT}" "$ALL_IPS" "nsg")
1030+
res=$(check_tcp_port_open_in_seclist_or_nsg $LB_NSG_OCID "${LB_PORT}" "${LB_SOURCE_CIDR}" "nsg")
10271031
if [[ $res -ne 0 ]]
10281032
then
1029-
echo "ERROR: Port [$LB_PORT] is not open for 0.0.0.0/0 in Load Balancer Server NSG [${LB_NSG_OCID}]. ${NETWORK_VALIDATION_MSG}"
1033+
echo "ERROR: Port [$LB_PORT] is not open for ${LB_SOURCE_CIDR} in Load Balancer Server NSG [${LB_NSG_OCID}]. ${NETWORK_VALIDATION_MSG}"
10301034
validation_return_code=2
10311035
fi
10321036
fi

terraform/modules/network-validator/validator.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
resource "null_resource" "validate_network" {
55
provisioner "local-exec" {
6-
command = "chmod +x ./scripts/network_validation.sh && ./scripts/network_validation.sh ${local.validation_script_wls_subnet_param} ${local.validation_script_bastion_subnet_param} ${local.validation_script_bastion_ip_param} ${local.validation_script_lb_subnet_1_param} ${local.validation_script_lb_subnet_2_param} ${local.validation_script_wls_lb_port} ${local.validation_script_mount_target_subnet_param} ${local.validation_script_atp_db_id_param} ${local.validation_script_oci_db_dbsystem_id_param} ${local.validation_script_oci_db_port_param} ${local.validation_script_http_port_param} ${local.validation_script_https_port_param} ${local.validation_script_existing_admin_server_nsg_id_param} ${local.validation_script_existing_managed_server_nsg_id_param} ${local.validation_script_existing_lb_nsg_id_param} ${local.validation_script_existing_mount_target_nsg_id_param} ${local.validation_script_existing_bastion_nsg_id_param}"
6+
command = "chmod +x ./scripts/network_validation.sh && ./scripts/network_validation.sh ${local.validation_script_wls_subnet_param} ${local.validation_script_bastion_subnet_param} ${local.validation_script_bastion_ip_param} ${local.validation_script_lb_subnet_1_param} ${local.validation_script_lb_subnet_2_param} ${local.validation_script_wls_lb_port} ${local.validation_script_lb_source_cidr_param} ${local.validation_script_mount_target_subnet_param} ${local.validation_script_atp_db_id_param} ${local.validation_script_oci_db_dbsystem_id_param} ${local.validation_script_oci_db_port_param} ${local.validation_script_http_port_param} ${local.validation_script_https_port_param} ${local.validation_script_existing_admin_server_nsg_id_param} ${local.validation_script_existing_managed_server_nsg_id_param} ${local.validation_script_existing_lb_nsg_id_param} ${local.validation_script_existing_mount_target_nsg_id_param} ${local.validation_script_existing_bastion_nsg_id_param}"
77
interpreter = ["/bin/bash", "-c"]
88
working_dir = path.module
99
}

terraform/modules/network-validator/variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,8 @@ variable "existing_bastion_nsg_id" {
8585
type = string
8686
description = "The OCID of the pre-created NSG that should be attached to the bastion instance"
8787
}
88+
89+
variable "lb_source_cidr" {
90+
type = string
91+
description = "Set to empty value if loadbalancer is set to private"
92+
}

terraform/schema_14110.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -713,7 +713,7 @@ variables:
713713
default: false
714714
required: true
715715
title: "Skip Network Validation"
716-
description: "Skip running network validation script for existing subnets. Existing Virtual Cloud Network can be validated using the network validation script. See <a target=\"_blank\" href=\https://docs.oracle.com/pls/topic/lookup?ctx=en/cloud/paas/weblogic-cloud/user&id=oci_network_validate\>Validate Existing Network Setup</a>"
716+
description: "Skip running network validation script for existing subnets. Existing Virtual Cloud Network can be validated using the network validation script. See <a target=\"_blank\" href=\"https://docs.oracle.com/pls/topic/lookup?ctx=en/cloud/paas/weblogic-cloud/user&id=oci_network_validate\">Validate Existing Network Setup</a>"
717717
visible:
718718
and:
719719
- not:

0 commit comments

Comments
 (0)