← Back to branch summary

~ubuntu-branches/ubuntu/saucy/nova/saucy-proposed

« back to all changes in this revision

Viewing changes to nova/virt/firewall.py

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2012-05-24 13:12:53 UTC
  • mfrom: (1.1.55)
  • Revision ID: package-import@ubuntu.com-20120524131253-ommql08fg1en06ut
Tags: 2012.2~f1-0ubuntu1
https://launchpad.net/bugs/907197
* New upstream release.
* Prepare for quantal:
  - Dropped debian/patches/upstream/0006-Use-project_id-in-ec2.cloud._format_image.patch
  - Dropped debian/patches/upstream/0005-Populate-image-properties-with-project_id-again.patch
  - Dropped debian/patches/upstream/0004-Fixed-bug-962840-added-a-test-case.patch
  - Dropped debian/patches/upstream/0003-Allow-unprivileged-RADOS-users-to-access-rbd-volumes.patch
  - Dropped debian/patches/upstream/0002-Stop-libvirt-test-from-deleting-instances-dir.patch
  - Dropped debian/patches/upstream/0001-fix-bug-where-nova-ignores-glance-host-in-imageref.patch 
  - Dropped debian/patches/0001-fix-useexisting-deprecation-warnings.patch
* debian/control: Add python-keystone as a dependency. (LP: #907197)
* debian/patches/kombu_tests_timeout.patch: Refreshed.
* debian/nova.conf, debian/nova-common.postinst: Convert to new ini
  file configuration
* debian/patches/nova-manage_flagfile_location.patch: Refreshed

Show diffs side-by-side

added added

removed removed

Lines of Context:
nova/virt/firewall.py
127
127
            self.remove_filters_for_instance(instance)
128
128
            self.iptables.apply()
129
129
        else:
130
 
            LOG.info(_('Attempted to unfilter instance %s which is not '
131
 
                     'filtered'), instance['id'])
 
130
            LOG.info(_('Attempted to unfilter instance which is not '
 
131
                     'filtered'), instance=instance)
132
132
 
133
133
    def prepare_instance_filter(self, instance, network_info):
134
134
        self.instances[instance['id']] = instance
135
135
        self.network_infos[instance['id']] = network_info
136
136
        self.add_filters_for_instance(instance)
137
 
        LOG.debug(_('Filters added to instance %s'), instance['uuid'])
 
137
        LOG.debug(_('Filters added to instance'), instance=instance)
138
138
        self.refresh_provider_fw_rules()
139
 
        LOG.debug(_('Provider Firewall Rules refreshed'))
 
139
        LOG.debug(_('Provider Firewall Rules refreshed'), instance=instance)
140
140
        self.iptables.apply()
141
141
 
142
142
    def _create_filter(self, ips, chain_name):
209
209
        dhcp_servers = [info['dhcp_server'] for (_n, info) in network_info]
210
210
 
211
211
        for dhcp_server in dhcp_servers:
212
 
            ipv4_rules.append('-s %s -p udp --sport 67 --dport 68 '
213
 
                              '-j ACCEPT' % (dhcp_server,))
 
212
            if dhcp_server:
 
213
                ipv4_rules.append('-s %s -p udp --sport 67 --dport 68 '
 
214
                                  '-j ACCEPT' % (dhcp_server,))
214
215
 
215
216
    def _do_project_network_rules(self, ipv4_rules, ipv6_rules, network_info):
216
217
        cidrs = [network['cidr'] for (network, _i) in network_info]
288
289
                                                          security_group['id'])
289
290
 
290
291
            for rule in rules:
291
 
                LOG.debug(_('Adding security group rule: %r'), rule)
 
292
                LOG.debug(_('Adding security group rule: %r'), rule,
 
293
                          instance=instance)
292
294
 
293
295
                if not rule.cidr:
294
296
                    version = 4
313
315
                elif protocol == 'icmp':
314
316
                    args += self._build_icmp_rule(rule, version)
315
317
                if rule.cidr:
316
 
                    LOG.info('Using cidr %r', rule.cidr)
 
318
                    LOG.debug('Using cidr %r', rule.cidr, instance=instance)
317
319
                    args += ['-s', rule.cidr]
318
320
                    fw_rules += [' '.join(args)]
319
321
                else:
326
328
                        import nova.network
327
329
                        nw_api = nova.network.API()
328
330
                        for instance in rule['grantee_group']['instances']:
329
 
                            LOG.info('instance: %r', instance)
330
331
                            nw_info = nw_api.get_instance_nw_info(ctxt,
331
332
                                                                  instance)
332
333
 
334
335
                                for ip in nw_info.fixed_ips()
335
336
                                    if ip['version'] == version]
336
337
 
337
 
                            LOG.info('ips: %r', ips)
 
338
                            LOG.debug('ips: %r', ips, instance=instance)
338
339
                            for ip in ips:
339
340
                                subrule = args + ['-s %s' % ip]
340
341
                                fw_rules += [' '.join(subrule)]
341
342
 
342
 
                LOG.info('Using fw_rules: %r', fw_rules)
 
343
                LOG.debug('Using fw_rules: %r', fw_rules, instance=instance)
 
344
 
343
345
        ipv4_rules += ['-j $sg-fallback']
344
346
        ipv6_rules += ['-j $sg-fallback']
345
347