shaba/one
1
0
Fork 0
mirror of https://github.com/OpenNebula/one.git synced 2025-03-22 18:50:08 +03:00
Code Releases Wiki Activity

F #5027: Update security group driver to work with the IP6 static AR

Browse Source
This commit is contained in:
Ruben S. Montero 2017-02-21 17:24:05 +01:00
parent 27956d9891
commit faf2c6f3b8
2 changed files with 34 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/vnm_mad/remotes/lib/security_groups.rb
View File

@ -70,6 +70,7 @@ module VNMNetwork
@range = @rule[:range]
@ip = @rule[:ip]
@ip6 = @rule[:ip6]
@ip6_global = @rule[:ip6_global]
@ip6_ula = @rule[:ip6_ula]
@size = @rule[:size]
@ -124,6 +125,10 @@ module VNMNetwork
nets += VNMNetwork::to_nets(@ip6_ula, @size.to_i)
end
if @ip6 && @size
nets += VNMNetwork::to_nets(@ip6, @size.to_i)
end
return nets
end

51
src/vnm_mad/remotes/lib/security_groups_iptables.rb
View File

@ -84,7 +84,7 @@ module SGIPTables
sets = []
the_nets.each do |n|
if IPAddr.new(the_nets[0]).ipv6?
if IPAddr.new(the_nets[n]).ipv6?
command = :ip6tables
family = "inet6"
else
@ -124,32 +124,39 @@ module SGIPTables
return if the_nets.empty?
if IPAddr.new(the_nets[0]).ipv6?
command = :ip6tables
family = "inet6"
else
command = :iptables
family = "inet"
end
if @rule_type == :inbound
chain = vars[:chain_in]
set = "#{vars[:set_sg_in]}-nr-#{family}"
dir = "src,dst"
else
chain = vars[:chain_out]
set = "#{vars[:set_sg_out]}-nr-#{family}"
dir = "dst,dst"
end
cmds.add :ipset, "create #{set} hash:net,port family #{family}"
cmds.add command, "-A #{chain} -m set --match-set" \
" #{set} #{dir} -j RETURN"
sets = []
the_nets.each do |n|
if IPAddr.new(the_nets[n]).ipv6?
command = :ip6tables
family = "inet6"
else
command = :iptables
family = "inet"
end
if @rule_type == :inbound
chain = vars[:chain_in]
set = "#{vars[:set_sg_in]}-nr-#{family}"
dir = "src,dst"
else
chain = vars[:chain_out]
set = "#{vars[:set_sg_out]}-nr-#{family}"
dir = "dst,dst"
end
if !sets.include?(set)
cmds.add :ipset, "create #{set} hash:net,port family #{family}"
cmds.add command, "-A #{chain} -m set --match-set" \
" #{set} #{dir} -j RETURN"
sets << set
end
@range.split(",").each do |r|
r.gsub!(":","-")
net_range = "#{n},#{@protocol}:#{r}"
cmds.add :ipset, "add -exist #{set} #{net_range}"
end
end