[NEW PATCH] BZ#736114 bootstrap: override iptables if requested (via gerrit-bot)
Dan Kenigsberg
danken at redhat.com
Sun Sep 18 11:58:43 UTC 2011
New patch submitted by Dan Kenigsberg (danken at redhat.com)
You can review this change at: http://gerrit.usersys.redhat.com/945
commit 3a991d4bdb5b800927799804b8d1417428fde5fa
Author: Dan Kenigsberg <danken at redhat.com>
Date: Sun Sep 18 14:47:37 2011 +0300
BZ#736114 bootstrap: override iptables if requested
Change-Id: I6a2e7d0512a2c9fc691135bf42b03fdcb3ee088a
diff --git a/vds_bootstrap/vds_bootstrap.py b/vds_bootstrap/vds_bootstrap.py
index 3ae7991..e04b3fd 100755
--- a/vds_bootstrap/vds_bootstrap.py
+++ b/vds_bootstrap/vds_bootstrap.py
@@ -140,6 +140,35 @@ except OSError:
pass
sys.path.append(VDSM_DIR)
+__DEFAULT_IPTABLES__ = """
+# oVirt automatically generated firewall configuration
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -p icmp -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+# vdsm
+-A INPUT -p tcp --dport 54321 -j ACCEPT
+# libvirt tls
+-A INPUT -p tcp --dport 16514 -j ACCEPT
+# libvirt-cim
+-A INPUT -p tcp --dport 5989 -j ACCEPT
+# SSH
+-A INPUT -p tcp --dport 22 -j ACCEPT
+# guest consoles
+-A INPUT -p tcp -m multiport --dports 5634:6166 -j ACCEPT
+# migration
+-A INPUT -p tcp -m multiport --dports 49152:49216 -j ACCEPT
+# snmp
+-A INPUT -p udp --dport 161 -j ACCEPT
+#
+-A INPUT -j REJECT --reject-with icmp-host-prohibited
+-A FORWARD -m physdev ! --physdev-is-bridged -j REJECT --reject-with icmp-host-prohibited
+COMMIT
+"""
+
class Deploy:
"""
This class holds the relevant functionality for vdsm deployment on RHEL.
@@ -692,6 +721,19 @@ gpgcheck=0
self._xmlOutput('SetSSHAccess', self.status, None, None, self.message)
return self.rc
+ def overrideFirewall(self):
+ self.message = 'overriden firewall successfully'
+ self.rc = True
+ self.st = 'OK'
+ f = file('/etc/sysconfig/iptables', 'w')
+ try:
+ f.write(__DEFAULT_IPTABLES__)
+ finally:
+ f.close()
+
+ self._xmlOutput('Firewall', self.st, None, None, self.message)
+ return self.rc
+
def setSystemTime(self, systime):
"""
Set host system time
@@ -760,7 +802,8 @@ gpgcheck=0
self._xmlOutput('Encryption setup', 'OK', None, None, "Ended successfully")
# End of deploy class.
-def VdsValidation(iurl, subject, random_num, rev_num, orgName, systime, usevdcrepo):
+def VdsValidation(iurl, subject, random_num, rev_num, orgName, systime,
+ usevdcrepo, overrideFirewall):
""" --- Check VDS Compatibility.
"""
logging.debug("Entered VdsValidation(subject = '%s', random_num = '%s', rev_num = '%s')"%(subject, random_num, rev_num))
@@ -807,6 +850,11 @@ def VdsValidation(iurl, subject, random_num, rev_num, orgName, systime, usevdcre
logging.error('setSSHAccess test failed')
return False
+ if overrideFirewall:
+ if not oDeploy.overrideFirewall():
+ logging.error('Failed to set default firewall')
+ return False
+
if systime:
if not oDeploy.setSystemTime(systime):
logging.error('setSystemTime failed')
@@ -823,14 +871,16 @@ def VdsValidation(iurl, subject, random_num, rev_num, orgName, systime, usevdcre
def main():
"""
Usage: vds_compat.py [-r rev_num] [-O organizationName] [-t systemTime]
- [-n netconsole_host:port] [-u (seProductRepo) true|false ] <url> <subject> <random_num>
+ [-n netconsole_host:port] [-u (seProductRepo) true|false ]
+ [-f (firewall) ] <url> <subject> <random_num>
"""
try:
rev_num = None
orgName = 'Red Hat Inc.'
systime = None
usevdcrepo = False
- opts, args = getopt.getopt(sys.argv[1:], "r:O:t:n:u:")
+ overrideFirewall = False
+ opts, args = getopt.getopt(sys.argv[1:], "r:O:t:n:u:f")
for o,v in opts:
if o == "-r":
rev_num = v
@@ -843,6 +893,10 @@ def main():
pass
if o == "-u":
usevdcrepo = (v.upper() == 'TRUE')
+ elif o == '-f':
+ overrideFirewall = True
+ NEEDED_SERVICES.append('iptables')
+
url = args[0]
subject = args[1]
random_num = args[2]
@@ -856,7 +910,7 @@ def main():
logging.debug('**** Start VDS Validation ****')
try:
ret = VdsValidation(url, subject, random_num, rev_num,
- orgName, systime, usevdcrepo)
+ orgName, systime, usevdcrepo, overrideFirewall)
except:
logging.error(traceback.format_exc())
logging.error(main.__doc__)
More information about the vdsm-patches
mailing list