(vm_name, vm_id, vm_ip, vm_ip6, vm_mac, vif, brname, sec_ips, is_first_nic=False)
| 530 | return True |
| 531 | |
| 532 | def default_network_rules(vm_name, vm_id, vm_ip, vm_ip6, vm_mac, vif, brname, sec_ips, is_first_nic=False): |
| 533 | if not add_fw_framework(brname): |
| 534 | return False |
| 535 | |
| 536 | vmName = vm_name |
| 537 | brfw = get_br_fw(brname) |
| 538 | domID = get_vm_id(vm_name) |
| 539 | |
| 540 | vmchain = iptables_chain_name(vm_name) |
| 541 | vmchain_egress = egress_chain_name(vm_name) |
| 542 | vmchain_default = '-'.join(vmchain.split('-')[:-1]) + "-def" |
| 543 | ipv6_link_local = ipv6_link_local_addr(vm_mac) |
| 544 | |
| 545 | action = "-A" |
| 546 | vmipsetName = ipset_chain_name(vm_name) |
| 547 | vmipsetName6 = vmipsetName + '-6' |
| 548 | |
| 549 | if is_first_nic: |
| 550 | delete_rules_for_vm_in_bridge_firewall_chain(vmName) |
| 551 | destroy_ebtables_rules(vmName, vif) |
| 552 | |
| 553 | for chain in [vmchain, vmchain_egress, vmchain_default]: |
| 554 | try: |
| 555 | execute('iptables -N ' + chain) |
| 556 | except: |
| 557 | execute('iptables -F ' + chain) |
| 558 | |
| 559 | try: |
| 560 | execute('ip6tables -N ' + chain) |
| 561 | except: |
| 562 | execute('ip6tables -F ' + chain) |
| 563 | |
| 564 | #create ipset and add vm ips to that ip set |
| 565 | if not create_ipset_forvm(vmipsetName): |
| 566 | logging.debug("failed to create ipset for rule %s", vmipsetName) |
| 567 | return False |
| 568 | |
| 569 | if not create_ipset_forvm(vmipsetName6, family='inet6', type='hash:net'): |
| 570 | logging.debug("failed to create ivp6 ipset for rule %s", vmipsetName6) |
| 571 | return False |
| 572 | |
| 573 | #add primary nic ip to ipset |
| 574 | if not add_to_ipset(vmipsetName, [vm_ip], action ): |
| 575 | logging.debug("failed to add vm " + vm_ip + " ip to set ") |
| 576 | return False |
| 577 | |
| 578 | #add secodnary nic ips to ipset |
| 579 | secIpSet = "1" |
| 580 | ips = sec_ips.split(';') |
| 581 | ips.pop() |
| 582 | |
| 583 | if len(ips) == 0 or ips[0] == "0": |
| 584 | secIpSet = "0" |
| 585 | ip4s = [] |
| 586 | ip6s = [] |
| 587 | |
| 588 | if secIpSet == "1": |
| 589 | logging.debug("Adding IPset for secondary IPv4 addresses") |
no test coverage detected