Fix OpenVMM forwarded SSH ingress rule

Restore the forwarded SSH filter rule so DNAT traffic to the guest is accepted from any non-OpenVMM bridge ingress interface. The cleanup refactor accidentally tied the SSH path to the default route interface, which breaks baremetal hosts where the incoming management path is not that interface.

Keep cleanup precise by continuing to track the exact inserted rule, and update the OpenVMM node selftest to reject the default-interface-constrained rule shape.

Author: vyadavmsft

lisa/sut_orchestrator/openvmm/node.py

@@ -1209,16 +1209,15 @@ def _wait_for_guest_ssh_from_host(
         log: Logger,
         timeout: int = OPENVMM_CONNECTION_TIMEOUT,
     ) -> None:
-        command = (
-            "for i in $(seq 1 "
-            f"{timeout}); do "
+        probe_command = (
+            "while true; do "
             "timeout 1 bash -c "
             f"{shlex.quote(f'</dev/tcp/{guest_address}/{guest_port}')} "
             ">/dev/null 2>&1 && exit 0; "
             "sleep 1; "
-            "done; "
-            "exit 1"
+            "done"
         )
+        command = f"timeout {timeout} bash -c " f"{shlex.quote(probe_command)}"
         result = self.host_node.execute(
             command,
             shell=True,
@@ -1703,8 +1702,8 @@ def _enable_ssh_forwarding(
                 ),
                 (
                     "",
-                    "FORWARD -i "
-                    f"{shlex.quote(forwarding_interface)} -o "
+                    "FORWARD ! -i "
+                    f"{shlex.quote(host_interface)} -o "
                     f"{shlex.quote(host_interface)} "
                     f"-p tcp -d {guest_address} --dport {guest_port} -j ACCEPT",
                 ),

lisa/tools/cargo.py

@@ -11,8 +11,6 @@
 from lisa.tools.curl import Curl
 from lisa.tools.echo import Echo
 from lisa.tools.gcc import Gcc
-from lisa.tools.ln import Ln
-from lisa.tools.rm import Rm
 from lisa.util import LisaException, UnsupportedDistroException
 from lisa.util.process import ExecutableResult
 
@@ -98,20 +96,6 @@ def _install(self) -> bool:
                 expected_exit_code=0,
                 expected_exit_code_failure_message="curl fetch failed",
             )
-
-            ln = self.node.tools[Ln]
-            ln.create_link(
-                is_symbolic=True,
-                target=cargo_bin,
-                link="/usr/local/bin/cargo",
-                force=True,
-            )
-            ln.create_link(
-                is_symbolic=True,
-                target=rustup_bin,
-                link="/usr/local/bin/rustup",
-                force=True,
-            )
         else:
             raise UnsupportedDistroException(node_os)
 
@@ -126,15 +110,6 @@ def _install(self) -> bool:
         self._command = cargo_bin
         self._exists = None
         is_installed = self._check_exists()
-
-        self.node.tools[Rm].remove_file(
-            "/usr/local/bin/cargo",
-            sudo=True,
-        )
-        self.node.tools[Rm].remove_file(
-            "/usr/local/bin/rustup",
-            sudo=True,
-        )
         return is_installed
 
     def wrap_with_rustup_lock(self, command: str) -> str:

selftests/test_openvmm_node.py

@@ -342,7 +342,7 @@ def _execute(command: str, *args: Any, **kwargs: Any) -> Any:
         )
         self.assertTrue(
             any(
-                f"iptables -C FORWARD -i eth0 -o {bridge_name} "
+                f"iptables -C FORWARD ! -i {bridge_name} -o {bridge_name} "
                 f"-p tcp -d {guest_address} --dport 22 -j ACCEPT" in command
                 for command in commands
             )
@@ -368,7 +368,7 @@ def _execute(command: str, *args: Any, **kwargs: Any) -> Any:
         )
         self.assertTrue(
             any(
-                f"iptables -I FORWARD -i eth0 -o {bridge_name} "
+                f"iptables -I FORWARD ! -i {bridge_name} -o {bridge_name} "
                 f"-p tcp -d {guest_address} --dport 22 -j ACCEPT" in command
                 for command in commands
             )
@@ -394,7 +394,7 @@ def _execute(command: str, *args: Any, **kwargs: Any) -> Any:
         )
         self.assertTrue(
             any(
-                f"iptables -D FORWARD -i eth0 -o {bridge_name} "
+                f"iptables -D FORWARD ! -i {bridge_name} -o {bridge_name} "
                 f"-p tcp -d {guest_address} --dport 22 -j ACCEPT" in command
                 for command in commands
             )
@@ -405,6 +405,12 @@ def _execute(command: str, *args: Any, **kwargs: Any) -> Any:
                 for command in commands
             )
         )
+        self.assertFalse(
+            any(
+                f"FORWARD -i eth0 -o {bridge_name} -p tcp -d {guest_address}" in command
+                for command in commands
+            )
+        )
 
     def test_configure_connection_uses_host_proxy_mode(self) -> None:
         host_connection = schema.ConnectionInfo(