Use source IP from same subnet for snat

[ravening]

This PR...

Description

Fixes #5365

When snat is configured on a vm in a subnet then the source
ip should be taken from the same subnet rather than from
random other subnet.

Output before the fix and steps to reproduce are mentioned in the issue

Output after the fix

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       all  --  10.10.10.0/24        10.10.10.154         to:10.10.10.254
SNAT       all  --  10.10.10.154         0.0.0.0/0            to:10.135.122.131
SNAT       all  --  0.0.0.0/0            0.0.0.0/0            to:10.135.122.128
SNAT       all  --  0.0.0.0/0            0.0.0.0/0            to:10.135.122.131

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

How Has This Been Tested?

[weizhouapache]

code lgtm

[GabrielBrascher]

Code LGTM

[davidjumani]

CLGTM

[weizhouapache]

@blueorangutan package

[blueorangutan]

@weizhouapache a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress.

[blueorangutan]

Packaging result: ✔️ el7 ✔️ el8 ✔️ debian. SL-JID 1073

[weizhouapache]

@blueorangutan test

[blueorangutan]

@weizhouapache a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

[yadvr]

@blueorangutan test

[blueorangutan]

@rhtyd a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

[blueorangutan]

Trillian test result (tid-1877)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 50762 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5376-t1877-kvm-centos7.zip
Smoke tests completed. 87 look OK, 4 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File
test_deploy_vm_start_failure	Error	61.52	test_deploy_vm.py
test_deploy_vm_volume_creation_failure	Error	67.78	test_deploy_vm.py
test_vm_ha	Error	59.32	test_vm_ha.py
test_vm_sync	Error	127.81	test_vm_sync.py
test_hostha_enable_ha_when_host_in_maintenance	Error	303.66	test_hostha_kvm.py

[nvazquez]

@blueorangutan test

[blueorangutan]

@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests

[yadvr]

@ravening @weizhouapache can you check/test the same fix for isolated networks too?

[blueorangutan]

Trillian test result (tid-1916)
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 37354 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr5376-t1916-kvm-centos7.zip
Smoke tests completed. 87 look OK, 0 have errors
Only failed tests results shown below:

Test	Result	Time (s)	Test File

[weizhouapache]

@ravening @weizhouapache can you check/test the same fix for isolated networks too?

@rhtyd
isolated networks do not have this issue, as there is only 1 guest nic in VR.

I have confirmed this PR does not cause issue in isolated networks. (the iptables rules are same, see below).

1. prior to this pr

root@r-128-VM:~# iptables-save |grep to-source
-A POSTROUTING -s 10.1.2.0/24 -d 10.1.2.234/32 -o eth0 -j SNAT --to-source 10.1.2.1
-A POSTROUTING -s 10.1.2.234/32 -o eth2 -j SNAT --to-source 10.0.55.141
-A POSTROUTING -o eth2 -j SNAT --to-source 10.0.55.156

2. with this pr

root@r-193-VM:~# iptables-save |grep to-source
-A POSTROUTING -s 10.1.2.0/24 -d 10.1.2.234/32 -o eth0 -j SNAT --to-source 10.1.2.1
-A POSTROUTING -s 10.1.2.234/32 -o eth2 -j SNAT --to-source 10.0.55.141
-A POSTROUTING -o eth2 -j SNAT --to-source 10.0.55.156