(vm_name, vm_id, vm_ip, vm_ip6, signature, seqno, vmMac, rules, vif, brname, sec_ips)
| 1096 | |
| 1097 | |
| 1098 | def add_network_rules(vm_name, vm_id, vm_ip, vm_ip6, signature, seqno, vmMac, rules, vif, brname, sec_ips): |
| 1099 | try: |
| 1100 | vmName = vm_name |
| 1101 | domId = get_vm_id(vmName) |
| 1102 | |
| 1103 | changes = check_rule_log_for_vm(vmName, vm_id, vm_ip, domId, signature, seqno) |
| 1104 | |
| 1105 | if 1 not in changes: |
| 1106 | logging.debug("Rules already programmed for vm " + vm_name) |
| 1107 | return True |
| 1108 | |
| 1109 | if rules == "" or rules == None: |
| 1110 | lines = [] |
| 1111 | else: |
| 1112 | lines = rules.split(';')[:-1] |
| 1113 | |
| 1114 | logging.debug("programming network rules for IP: " + vm_ip + " vmname=%s", vm_name) |
| 1115 | |
| 1116 | egress_chain_name(vm_name) |
| 1117 | vmchain = iptables_chain_name(vm_name) |
| 1118 | egress_vmchain = egress_chain_name(vm_name) |
| 1119 | |
| 1120 | try: |
| 1121 | for chain in [vmchain, egress_vmchain]: |
| 1122 | execute('iptables -F ' + chain) |
| 1123 | execute('ip6tables -F ' + chain) |
| 1124 | except: |
| 1125 | logging.debug("Error flushing iptables rules for " + vm_name + ". Presuming firewall rules deleted, re-initializing." ) |
| 1126 | default_network_rules(vm_name, vm_id, vm_ip, vm_ip6, vmMac, vif, brname, sec_ips, True) |
| 1127 | |
| 1128 | egressrule_v4 = 0 |
| 1129 | egressrule_v6 = 0 |
| 1130 | |
| 1131 | for rule in parse_network_rules(rules): |
| 1132 | start = rule['start'] |
| 1133 | end = rule['end'] |
| 1134 | protocol = rule['protocol'] |
| 1135 | |
| 1136 | if rule['ruletype'] == 'E': |
| 1137 | vmchain = egress_vmchain |
| 1138 | direction = "-d" |
| 1139 | action = "RETURN" |
| 1140 | if rule['ipv4']: |
| 1141 | egressrule_v4 =+ 1 |
| 1142 | |
| 1143 | if rule['ipv6']: |
| 1144 | egressrule_v6 +=1 |
| 1145 | |
| 1146 | else: |
| 1147 | vmchain = vm_name |
| 1148 | action = "ACCEPT" |
| 1149 | direction = "-s" |
| 1150 | |
| 1151 | if start == 0 and end == 0: |
| 1152 | dport = "" |
| 1153 | else: |
| 1154 | dport = " --dport " + str(start) + ":" + str(end) |
| 1155 |
no test coverage detected