[NEW PATCH] BZ#736114 bootstrap: override iptables if requested (via gerrit-bot)

Dan Kenigsberg danken at redhat.com
Sun Sep 18 11:58:43 UTC 2011


New patch submitted by Dan Kenigsberg (danken at redhat.com)

You can review this change at: http://gerrit.usersys.redhat.com/945

commit 3a991d4bdb5b800927799804b8d1417428fde5fa
Author: Dan Kenigsberg <danken at redhat.com>
Date:   Sun Sep 18 14:47:37 2011 +0300

    BZ#736114 bootstrap: override iptables if requested
    
    Change-Id: I6a2e7d0512a2c9fc691135bf42b03fdcb3ee088a

diff --git a/vds_bootstrap/vds_bootstrap.py b/vds_bootstrap/vds_bootstrap.py
index 3ae7991..e04b3fd 100755
--- a/vds_bootstrap/vds_bootstrap.py
+++ b/vds_bootstrap/vds_bootstrap.py
@@ -140,6 +140,35 @@ except OSError:
     pass
 sys.path.append(VDSM_DIR)
 
+__DEFAULT_IPTABLES__ = """
+# oVirt automatically generated firewall configuration
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -p icmp -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+# vdsm
+-A INPUT -p tcp --dport 54321 -j ACCEPT
+# libvirt tls
+-A INPUT -p tcp --dport 16514 -j ACCEPT
+# libvirt-cim
+-A INPUT -p tcp --dport 5989 -j ACCEPT
+# SSH
+-A INPUT -p tcp --dport 22 -j ACCEPT
+# guest consoles
+-A INPUT -p tcp -m multiport --dports 5634:6166 -j ACCEPT
+# migration
+-A INPUT -p tcp -m multiport --dports 49152:49216 -j ACCEPT
+# snmp
+-A INPUT -p udp --dport 161 -j ACCEPT
+#
+-A INPUT -j REJECT --reject-with icmp-host-prohibited
+-A FORWARD -m physdev ! --physdev-is-bridged -j REJECT --reject-with icmp-host-prohibited
+COMMIT
+"""
+
 class Deploy:
     """
         This class holds the relevant functionality for vdsm deployment on RHEL.
@@ -692,6 +721,19 @@ gpgcheck=0
         self._xmlOutput('SetSSHAccess', self.status, None, None, self.message)
         return self.rc
 
+    def overrideFirewall(self):
+        self.message = 'overriden firewall successfully'
+        self.rc = True
+        self.st = 'OK'
+        f = file('/etc/sysconfig/iptables', 'w')
+        try:
+            f.write(__DEFAULT_IPTABLES__)
+        finally:
+            f.close()
+
+        self._xmlOutput('Firewall', self.st, None, None, self.message)
+        return self.rc
+
     def setSystemTime(self, systime):
         """
             Set host system time
@@ -760,7 +802,8 @@ gpgcheck=0
         self._xmlOutput('Encryption setup', 'OK', None, None, "Ended successfully")
 # End of deploy class.
 
-def VdsValidation(iurl, subject, random_num, rev_num, orgName, systime, usevdcrepo):
+def VdsValidation(iurl, subject, random_num, rev_num, orgName, systime,
+        usevdcrepo, overrideFirewall):
     """ --- Check VDS Compatibility.
     """
     logging.debug("Entered VdsValidation(subject = '%s', random_num = '%s', rev_num = '%s')"%(subject, random_num, rev_num))
@@ -807,6 +850,11 @@ def VdsValidation(iurl, subject, random_num, rev_num, orgName, systime, usevdcre
         logging.error('setSSHAccess test failed')
         return False
 
+    if overrideFirewall:
+        if not oDeploy.overrideFirewall():
+            logging.error('Failed to set default firewall')
+            return False
+
     if systime:
         if not oDeploy.setSystemTime(systime):
             logging.error('setSystemTime failed')
@@ -823,14 +871,16 @@ def VdsValidation(iurl, subject, random_num, rev_num, orgName, systime, usevdcre
 def main():
     """
         Usage: vds_compat.py [-r rev_num] [-O organizationName] [-t systemTime]
-            [-n netconsole_host:port] [-u (seProductRepo) true|false ] <url> <subject> <random_num>
+            [-n netconsole_host:port] [-u (seProductRepo) true|false ]
+            [-f (firewall) ] <url> <subject> <random_num>
     """
     try:
         rev_num = None
         orgName = 'Red Hat Inc.'
         systime = None
         usevdcrepo = False
-        opts, args = getopt.getopt(sys.argv[1:], "r:O:t:n:u:")
+        overrideFirewall = False
+        opts, args = getopt.getopt(sys.argv[1:], "r:O:t:n:u:f")
         for o,v in opts:
             if o == "-r":
                 rev_num = v
@@ -843,6 +893,10 @@ def main():
                 pass
             if o == "-u":
                 usevdcrepo = (v.upper() == 'TRUE')
+            elif o == '-f':
+                overrideFirewall = True
+                NEEDED_SERVICES.append('iptables')
+
         url = args[0]
         subject = args[1]
         random_num = args[2]
@@ -856,7 +910,7 @@ def main():
     logging.debug('**** Start VDS Validation ****')
     try:
         ret = VdsValidation(url, subject, random_num, rev_num,
-                            orgName, systime, usevdcrepo)
+                            orgName, systime, usevdcrepo, overrideFirewall)
     except:
         logging.error(traceback.format_exc())
         logging.error(main.__doc__)




More information about the vdsm-patches mailing list