← Back to branch summary

~ubuntu-branches/ubuntu/raring/nova/raring-proposed

« back to all changes in this revision

Viewing changes to nova/virt/libvirt/firewall.py

  • Committer: Package Import Robot
  • Author(s): Chuck Short, Adam Gandelman, Chuck Short
  • Date: 2012-11-23 09:04:58 UTC
  • mfrom: (1.1.66)
  • Revision ID: package-import@ubuntu.com-20121123090458-91565o7aev1i1h71
Tags: 2013.1~g1-0ubuntu1
https://launchpad.net/bugs/1073289
https://launchpad.net/bugs/1076442
[ Adam Gandelman ]
* debian/control: Ensure novaclient is upgraded with nova,
  require python-keystoneclient >= 1:2.9.0. (LP: #1073289)
* debian/patches/{ubuntu/*, rbd-security.patch}: Dropped, applied
  upstream.
* debian/control: Add python-testtools to Build-Depends.

[ Chuck Short ]
* New upstream version.
* Refreshed debian/patches/avoid_setuptools_git_dependency.patch.
* debian/rules: FTBFS if missing binaries.
* debian/nova-scheudler.install: Add missing rabbit-queues and
  nova-rpc-zmq-receiver.
* Remove nova-volume since it doesnt exist anymore, transition to cinder-*.
* debian/rules: install apport hook in the right place.
* debian/patches/ubuntu-show-tests.patch: Display test failures.
* debian/control: Add depends on genisoimage
* debian/control: Suggest guestmount.
* debian/control: Suggest websockify. (LP: #1076442)
* debian/nova.conf: Disable nova-volume service.
* debian/control: Depend on xen-system-* rather than the hypervisor.
* debian/control, debian/mans/nova-conductor.8, debian/nova-conductor.init,
  debian/nova-conductor.install, debian/nova-conductor.logrotate
  debian/nova-conductor.manpages, debian/nova-conductor.postrm
  debian/nova-conductor.upstart.in: Add nova-conductor service.
* debian/control: Add python-fixtures as a build deps.

Show diffs side-by-side

added added

removed removed

Lines of Context:
nova/virt/libvirt/firewall.py
20
20
 
21
21
from eventlet import tpool
22
22
 
23
 
from nova import flags
 
23
from nova.openstack.common import cfg
24
24
from nova.openstack.common import log as logging
25
25
import nova.virt.firewall as base_firewall
26
26
 
27
 
 
28
27
LOG = logging.getLogger(__name__)
29
 
FLAGS = flags.FLAGS
 
28
CONF = cfg.CONF
 
29
CONF.import_opt('use_ipv6', 'nova.config')
 
30
CONF.import_opt('vpn_image_id', 'nova.config')
30
31
 
31
32
try:
32
33
    import libvirt
44
45
    spoofing, IP spoofing, and ARP spoofing.
45
46
    """
46
47
 
47
 
    def __init__(self, get_connection, **kwargs):
 
48
    def __init__(self, virtapi, get_connection, **kwargs):
 
49
        super(NWFilterFirewall, self).__init__(virtapi)
48
50
        self._libvirt_get_connection = get_connection
49
51
        self.static_filters_configured = False
50
52
        self.handle_security_groups = False
58
60
    _conn = property(_get_connection)
59
61
 
60
62
    @staticmethod
 
63
    def nova_no_nd_reflection_filter():
 
64
        """
 
65
        This filter protects false positives on IPv6 Duplicate Address
 
66
        Detection(DAD).
 
67
        """
 
68
        return '''<filter name='nova-no-nd-reflection' chain='ipv6'>
 
69
                  <!-- no nd reflection -->
 
70
                  <!-- drop if destination mac is v6 mcast mac addr and
 
71
                       we sent it. -->
 
72
 
 
73
                  <rule action='drop' direction='in'>
 
74
                      <mac dstmacaddr='33:33:00:00:00:00'
 
75
                           dstmacmask='ff:ff:00:00:00:00' srcmacaddr='$MAC'/>
 
76
                  </rule>
 
77
                  </filter>'''
 
78
 
 
79
    @staticmethod
61
80
    def nova_dhcp_filter():
62
81
        """The standard allow-dhcp-server filter is an <ip> one, so it uses
63
82
           ebtables to allow traffic through. Without a corresponding rule in
98
117
            if mapping['dhcp_server']:
99
118
                allow_dhcp = True
100
119
                break
101
 
        if instance['image_ref'] == str(FLAGS.vpn_image_id):
 
120
        if instance['image_ref'] == str(CONF.vpn_image_id):
102
121
            base_filter = 'nova-vpn'
103
122
        elif allow_dhcp:
104
123
            base_filter = 'nova-base'
122
141
        if self.static_filters_configured:
123
142
            return
124
143
 
125
 
        self._define_filter(self._filter_container('nova-base',
126
 
                                                   ['no-mac-spoofing',
127
 
                                                    'no-ip-spoofing',
128
 
                                                    'no-arp-spoofing',
129
 
                                                    'allow-dhcp-server']))
130
 
        self._define_filter(self._filter_container('nova-nodhcp',
131
 
                                                   ['no-mac-spoofing',
132
 
                                                    'no-ip-spoofing',
133
 
                                                    'no-arp-spoofing']))
 
144
        filter_set = ['no-mac-spoofing',
 
145
                      'no-ip-spoofing',
 
146
                      'no-arp-spoofing']
 
147
        if CONF.use_ipv6:
 
148
            self._define_filter(self.nova_no_nd_reflection_filter)
 
149
            filter_set.append('nova-no-nd-reflection')
 
150
        self._define_filter(self._filter_container('nova-nodhcp', filter_set))
 
151
        filter_set.append('allow-dhcp-server')
 
152
        self._define_filter(self._filter_container('nova-base', filter_set))
134
153
        self._define_filter(self._filter_container('nova-vpn',
135
154
                                                   ['allow-dhcp-server']))
136
155
        self._define_filter(self.nova_dhcp_filter)
147
166
        if callable(xml):
148
167
            xml = xml()
149
168
        # execute in a native thread and block current greenthread until done
150
 
        if not FLAGS.libvirt_nonblocking:
 
169
        if not CONF.libvirt_nonblocking:
151
170
            # NOTE(maoy): the original implementation is to have the API called
152
171
            # in the thread pool no matter what.
153
172
            tpool.execute(self._conn.nwfilterDefineXML, xml)
202
221
 
203
222
 
204
223
class IptablesFirewallDriver(base_firewall.IptablesFirewallDriver):
205
 
    def __init__(self, execute=None, **kwargs):
206
 
        super(IptablesFirewallDriver, self).__init__(**kwargs)
207
 
        self.nwfilter = NWFilterFirewall(kwargs['get_connection'])
 
224
    def __init__(self, virtapi, execute=None, **kwargs):
 
225
        super(IptablesFirewallDriver, self).__init__(virtapi, **kwargs)
 
226
        self.nwfilter = NWFilterFirewall(virtapi, kwargs['get_connection'])
208
227
 
209
228
    def setup_basic_filtering(self, instance, network_info):
210
229
        """Set up provider rules and basic NWFilter."""