1132704 - ship-it access for all masters

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

On fw1.phx1, there's a rule,

security policies from-zone dc to-zone webapp policy-name shipit--http

which lists srv.releng.scl3 as a source range.  We'd like to add to that the ranges

bb.releng.scl3 - 10.26.68.0/24
bb.releng.use1 - 10.26.134.0/24
bb.releng.usw2 - 10.26.132.0/24

Priority: today if possible --

17:28 <@nthomas> relman would like to start 36.0b9, so I think so
17:28 <@nthomas> late in cycle, time of essence, yada yada

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

We'll want to loop back to remove srv.releng.scl3 tomorrow, but that's lower priority and might break stuff, so not today.

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

sorry guys :(

Comment 3

[James Barnell [:jbarnell]]

[e-mail]# show | compare 
[edit security policies from-zone dc to-zone webapp policy shipit--http match]
-      source-address srv.releng.scl3;
+      source-address [ srv.releng.scl3 bb.releng.scl3 bb.releng.use1 bb.releng.usw2 ];
[edit security zones security-zone dc address-book]
       address ldapmaster1.db.scl3 { ... }
+      address bb.releng.scl3 10.26.68.0/24;
+      address bb.releng.use1 10.26.134.0/24;
+      address bb.releng.usw2 10.26.132.0/24;

committing ...

Comment 4

[James Barnell [:jbarnell]]

please test and confirm the "add" functionality is working.  we can discuss the deletes and cleanup tomorrow.

Comment 5

[Nick Thomas [:nthomas] (UTC+12)]

Sorry for the correction, but shouldn't that be:
 bb.releng.use1 - 10.134.68.0/24
 bb.releng.usw2 - 10.132.68.0/24

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

Ugh, if I had a brain I would have written

bb.releng.scl3 - 10.26.68.0/24
bb.releng.use1 - 10.134.68.0/24
bb.releng.usw2 - 10.132.68.0/24

We can clean that up tomorrow when we delete.  The add for bb.releng.scl3 was the critical one, and it's working.

Comment 7

[James Barnell [:jbarnell]]

Changed and committing

[e-mail]# show | compare 
[edit security zones security-zone dc address-book]
       address bb.releng.scl3 { ... }
-      address bb.releng.use1 10.26.134.0/24;
+      address bb.releng.use1 10.134.68.0/24;
-      address bb.releng.usw2 10.26.132.0/24;
+      address bb.releng.usw2 10.132.68.0/24;

Please test and verify in a couple of minutes

Comment 8

[Nick Thomas [:nthomas] (UTC+12)]

Verified on buildbot-master82.bb.releng.scl3.mozilla.com, buildbot-master94.bb.releng.use1.mozilla.com, buildbot-master115.bb.releng.usw2.mozilla.com. Thanks for the quick fix.

Comment 9

[James Barnell [:jbarnell]]

(In reply to Dustin J. Mitchell [:dustin] from comment #1)
> We'll want to loop back to remove srv.releng.scl3 tomorrow, but that's lower
> priority and might break stuff, so not today.

Dustin did you want the above address entry removed from FW1.PHX1?

Comment 10

[Dustin J. Mitchell [:dustin] (he/him)]

Yes, please -- thanks for the poke.

Comment 11

[James Barnell [:jbarnell]]

Config diff 

[e-mail]# show | compare 
[edit security policies from-zone dc to-zone webapp policy aus4-admin-dev--https match]
-      source-address [ winbuild.releng.scl3 build.releng.scl3 mpt-vpn aws-aus4-set srv.releng.scl3 ];
-      destination-address aus4-admin-dev;
-      application https;
+      source-address [ winbuild.releng.scl3 build.releng.scl3 mpt-vpn aws-aus4-set ];
+      destination-address aus4-admin-dev;
+      application https;
[edit security policies from-zone dc to-zone webapp policy shipit--http match]
-      source-address [ bb.releng.scl3 bb.releng.use1 bb.releng.usw2 srv.releng.scl3 ];
-      destination-address ship-it-all;
-      application [ junos-http junos-https ];
+      source-address [ bb.releng.scl3 bb.releng.use1 bb.releng.usw2 ];
+      destination-address ship-it-all;
+      application [ junos-http junos-https ];
[edit security policies from-zone dc to-zone webapp policy aus4-admin--https match]
-      source-address [ winbuild.releng.scl3 build.releng.scl3 build-us-east-1a build-us-east-1b build-us-east-1c build-us-east-1d srv-us-east-1a srv-us-east-1b srv-us-east-1c srv-us-east-1d build-us-west-2a build-us-west-2b build-us-west-2c srv-us-west-2a srv-us-west-2b srv-us-west-2c build-us-east-1 build-us-west-2d srv.releng.scl3 ];
-      destination-address aus4-admin-prod-zlb;
-      application [ https junos-http ];
+      source-address [ winbuild.releng.scl3 build.releng.scl3 build-us-east-1a build-us-east-1b build-us-east-1c build-us-east-1d srv-us-east-1a srv-us-east-1b srv-us-east-1c srv-us-east-1d build-us-west-2a build-us-west-2b build-us-west-2c srv-us-west-2a srv-us-west-2b srv-us-west-2c build-us-east-1 build-us-west-2d ];
+      destination-address aus4-admin-prod-zlb;
+      application [ https junos-http ];
[edit security zones security-zone dc address-book]
-      address srv.releng.scl3 10.26.48.0/22;