ó
±EYc@s
dd
lm
Z
ddlmZ
ddlmZ
ddlZ	ddl	m
Z

ddlmZ
ddl
mZ
ddl	mZ
ddl	mZ
dd	lmZ
ejeƒ
Ze	jjZd
„Zdef
d„ƒYZd
ef
d„ƒYZdef
d„ƒYZdS(iÿÿÿÿ(
tlog(
timportutils(
tutilsN(
tcontext(
t_LI(
t	linux_net(
tobjects(
tnetutilsc
Os%tj
tjp|ƒ
}||
|ŽS(
N(R
timport_classtCONFtfirewall_driver(tdefaulttargstkwargstfw_class((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pytload_driver#s

tFirewallDriverc
Bs_eZ
dZd
„Zd„Zd„Zd„Zd„Zd„Zd„Z	d„Z
d	„ZRS(
srFirewall Driver base class.

    Defines methods that any driver providing security groups should implement.

    c
Cs
tƒ‚
d
S(sbPrepare filters for the instance.

        At this point, the instance isn't running yet.
        N(
tNotImplementedError(tselftinstancetnetwork_info((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pytprepare_instance_filter.sc


Csd
S(s$Defer application of IPTables rules.N((
R((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pytfilter_defer_apply_on5sc


Csd
S(s<Turn off deferral of IPTables rules and apply the rules now.N((
R((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pytfilter_defer_apply_off9sc
Cs
tƒ‚
d
S(sStop filtering instance.N(
R(RRR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pytunfilter_instance=sc
Cs
tƒ‚
d
S(s
Apply instance filter.

        Once this method returns, the instance should be firewalled
        appropriately. This method should as far as possible be a
        no-op. It's vastly preferred to get everything set up in
        prepare_instance_filter.
        N(
R(RRR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pytapply_instance_filterAsc
Cs
tƒ‚
d
S(s”Refresh security group rules from data store

        Gets called when a rule has been added to or removed from
        the security group.
        N(
R(Rtsecurity_group_id((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pytrefresh_security_group_rulesKsc
Cs
tƒ‚
d
S(sßRefresh security group rules from data store

        Gets called when an instance gets added to or removed from
        the security group the instance is a member of or if the
        group gains or loses a rule.
        N(
R(RR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pytrefresh_instance_security_rulesSsc
Cs
tƒ‚
d
S(s Create rules to block spoofing and allow dhcp.

        This gets called when spawning an instance, before
        :py:meth:`prepare_instance_filter`.

        N(
R(RRR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pytsetup_basic_filtering\sc
Cs
tƒ‚
d
S(s(Check nova-instance-instance-xxx exists.N(
R(RRR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pytinstance_filter_existses(t__name__t
__module__t__doc__RRRRRRRRR(((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR(s
					
					tIptablesFirewallDrivercBs
eZ
dZd
„Zd„Zd„Zd„Zd„Zd„Zd„Z	d„Z
d	„Zd
„Zd„Z
d„Zd
„Zd„Zd„Zd„Zd„Zd„Zd„Zd„Zd„Zd„Zd„Zd„Zejddeƒ

d„ƒ
Zd„Zd„Z RS(s=Driver which enforces security groups through iptables rules.c
Kstj
|_i|_t|_t|_|jjd
jdƒ

|jjd
j	ddƒ
|jj
d
jdƒ

|jj
d
j	ddƒ
dS(Ntfilterssg-fallbacks-j DROP(Rtiptables_managertiptablest
instance_infotFalsetdhcp_createtdhcp_createdtipv4t	add_chaintadd_ruletipv6(RR
((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt__init__ms

		
	


c
CsdS(
N((RRR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyRzs
c
Csd
S(s5No-op. Everything is done in prepare_instance_filter.N((RRR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR}sc


Cs|jj
ƒ
dS(
N(R%tdefer_apply_on(
R((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyRs
c


Cs|jj
ƒ
dS(
N(R%tdefer_apply_off(
R((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR„s
cCsR|jj
|
jdƒr5|j|
ƒ

|jjƒ
ntjt	d
ƒ
d|
ƒ


dS(Ns4Attempted to unfilter instance which is not filteredR(
R&tpoptidtNonetremove_filters_for_instanceR%tapplytLOGtinfoR(RRR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR‡s





cCsÁ|
|f|j|
j
<|j|
|ƒ\}}|j|
|||ƒ
tjd
|
j
d|
ƒ

|jr°|jr°|jj	dj
ddƒ
|jj	dj
ddƒ
t|_n|jjƒ
dS(NsFilters added to instance: %sRR#tINPUTsQ-s 0.0.0.0/32 -d 255.255.255.255/32 -p udp -m udp --sport 68 --dport 67 -j ACCEPTtFORWARD(
R&R2tinstance_rulestadd_filters_for_instanceR6tdebugR(R)R%R*R,tTrueR5(RRRt
ipv4_rulest
ipv6_rules((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyRs











cCs!g|
D]}d
||f^qS(Ns-d %s -j $%s((Rtipst
chain_nametip((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_create_filter£s
cCssg}xf|
D]^}d
|kr
d|d
kr
x9|d
dD]&}|d|kr>|j|ƒ

q>q>Wq
q
W|S(Ntnetworktsubnetstversion(
tappend(RRRFREtviftsubnet((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_get_subnets¦s







cCsÍ|j|d
ƒ}|j|dƒ}g|D]!}|dD]}|d^q9q+}|j
||
ƒ}g}	}
tjrÃ|r®g|D]!}|dD]}|d^q’q„}
n|j
|
|
ƒ}	n||	fS(s©Creates a rule corresponding to each ip that defines a
           jump to the corresponding instance - chain for all the traffic
           destined to that ip.
        iiR@taddress(RJRCR	tuse_ipv6(RRARt
v4_subnetst
v6_subnetsRIRBtips_v4R>R?tips_v6((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_filters_for_instance¯s



!


	



$
cCsfx(|D] }|jj
d
j|
|ƒ
qWtjrbx+|D] }|jjd
j|
|ƒ
q;WndS(NR#(R%R*R,R	RLR-(RRAR>R?trule((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_add_filtersÃs



	


cCs‹|j|
ƒ
}t
jr2|jjd
j|ƒ

n|jjd
j|ƒ

|j||ƒ\}}|jd||ƒ
|j|||ƒ
dS(NR#tlocal(	t_instance_chain_nameR	RLR%R-R+R*RQRS(RRRtinst_ipv4_rulestinst_ipv6_rulesRAR>R?((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR;Ës
	


	


cCsM|j|
ƒ
}|j
jd
j|ƒ

tjrI|j
jd
j|ƒ

ndS(NR#(RUR%R*tremove_chainR	RLR-(RRRA((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR4Ös

	
cCsd
|
jf
S(Nsinst-%s(
R2(RR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyRUÝs
cCs8|
d
g
7}
|d
g
7}|
dg
7}
|dg
7}dS(Ns -m state --state INVALID -j DROPs.-m state --state ESTABLISHED,RELATED -j ACCEPT((RR>R?R((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_do_basic_rulesàs




cCs~|j|d
ƒ}g|D]$}|j
dƒ
r|j
dƒ
^q}x4|D],}|rJ|
jd|f
ƒ

t|_qJqJWdS(Nitdhcp_servers,-s %s -p udp --sport 67 --dport 68 -j ACCEPT(RJtget_metaRGR=R((RR>RRMRItdhcp_serversRZ((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_do_dhcp_rulesés


.


	

cCs¸|j|d
ƒ}|j|dƒ}g|D]}|d^q+}x"|D]}|
j
d|f
ƒ

qHWtjr´g|D]}|d^qv}	x%|	D]}
|j
d|
f
ƒ

q“WndS(Niitcidrs-s %s -j ACCEPT(RJRGR	RL(RR>R?RRMRNRItcidrsR^tcidrv6stcidrv6((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_do_project_network_rulesôs






	



cCs\|j|d
ƒ}g|D]}|dd^q}x"|D]}|
j
d|f
ƒ

q:WdS(NitgatewayRKs-s %s/128 -p icmpv6 -j ACCEPT(RJRG(RR?RRNRItgateways_v6t
gateway_v6((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_do_ra_rulesÿs


!


cCs“|
j}|
j
}|d
kr'd}n'd|}|d
ksN|d|7}n|r|dkrpddd|gS|dkrdd	d
|gSngS(Niÿÿÿÿs%ss/%sis-mticmps--icmp-typeiticmp6s
--icmpv6-type(t	from_porttto_portR3(RRRRFt	icmp_typet	icmp_codet
icmp_type_arg((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_build_icmp_rule
s
	
	
	






cCsJ|
j|
j
kr&d
d|
jf
gSdddd|
j|
j
fgSdS(Ns--dports%ss-mt	multiports--dportss%s:%s(RiRj(RRRRF((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_build_tcp_udp_rule
s




cCs!tj
ƒ}t|
tƒr?tjj|tjƒ|
gƒ}
ng}g}|j|||ƒ
|j||ƒ
t	j
r|j|||ƒ
nt	jr©|j
||ƒ
ntjj||
ƒ}x|D]}|jsÝd
}ntj|jƒ
}|d
kr
|}	n|}	|j}
|
r+
|jjƒ}
n|dkrL
|
dkrL
d}
ndg
}|
rn
|d|
g7}n|
dkr“
||j||ƒ7}n%|
dkr¸
||j||ƒ7}n|jró
|d	t|jƒ
g7}|	d
j|ƒ
g
7}	qÅ|jrÅtjj||jƒ}xÀ|D]µ}
|
jjr@tjdƒ

qnt j!|
ƒ
}g|j"ƒD] }|d|kr\|d
^q\}tjd|d|
ƒ

x5|D]-}|d|g
}|	d
j|ƒ
g
7}	qŸWqWqÅqÅW|dg
7}|dg
7}tjdt#|ƒ
||d|
ƒ

||fS(NiiRgticmpv6s	-j ACCEPTs-ptudpttcps-st
 signoring deleted cacheRFRKsips: %rRs-s %ss-j $sg-fallbacks8Security Group Rules %s translated to ipv4: %r, ipv6: %r(sudpstcp($Rtget_admin_contextt
isinstancetdictRtInstancet_from_db_objectRYR]R	tallow_same_net_trafficRbRLRftSecurityGroupRuleListtget_by_instanceR^Rtget_ip_versiontprotocoltlowerRpRntstrtjoint
grantee_grouptInstanceListtget_by_security_groupt
info_cachetdeletedR6R<t
compute_utilstget_nw_info_for_instancet	fixed_ipstlist(RRRtctxtR>R?trulesRRRFtfw_rulesR~Rtinststinsttnw_infoRBR@tsubrule((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR:"
sr

	

	


	

	
	
		

		





	

	
	








	
 



%



	


c
CsdS(
N((RRR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyRx
s
cCs|j|
ƒ

|j
jƒ
dS(
N(tdo_refresh_security_group_rulesR%R5(Rtsecurity_group((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR{
s


cCs|j|
ƒ

|j
jƒ
dS(
N(tdo_refresh_instance_rulesR%R5(RR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR
s


R%texternalcCso|j|
ƒ
}|j
jd
j|ƒ
sHtjtdƒ
|d|
ƒ

dS|j|
ƒ

|j|
|||ƒ
dS(NR#s6instance chain %s disappeared during refresh, skippingR(	RUR%R*t	has_chainR6R7RR4R;(RRRR>R?RA((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_inner_do_refresh_rulesƒ
s


	






cCs€|jj
ƒ}xj|D]b}y|j|\}}Wntk
rI


qn
X|j||ƒ\}}|j||||ƒ
qWdS(
N(R&tkeystKeyErrorR:R—(RR“tid_listtinstance_idRRR>R?((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR’‘
s







	


cCsH|j|
j
\}}|j|
|ƒ\}}|j|
|||ƒ
dS(
N(R&R2R:R—(RRt	_instanceRR>R?((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR”Ÿ
s



(!RR R!R.RRRRRRRCRJRQRSR;R4RURYR]RbRfRnRpR:RRRRtsynchronizedR=R—R’R”(((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR"js8
	
																						V				tNoopFirewallDriverc
Bs2eZ
dZd
„Zd„Zd„Zd„ZRS(s2Firewall driver which just provides No-op methods.c

OsdS(
N((RRR
((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR.¨
s
c

OsdS(
N((RRR
((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt_noop«
s
c
Cs|jS(
N(
RŸ(Rtkey((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt__getattr__®
s
c
CstS(
N(
R=(RRR((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyR±
s
(RR R!R.RŸR¡R(((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyRž¦
s


			(toslo_logRtloggingt
oslo_utilsR
tnova.computeRR‡t	nova.conftnovaRt	nova.i18nRtnova.networkRRt	nova.virtRt	getLoggerRR6tconfR	RtobjectRR"Rž(((sG/home/tvault/.virtenv/lib/python2.7/site-packages/nova/virt/firewall.pyt<module>s 







	Bÿ=