You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by sw...@apache.org on 2016/07/25 20:45:51 UTC
git commit: updated refs/heads/master to d302269
Repository: cloudstack
Updated Branches:
refs/heads/master 818063c8e -> d302269fe
CLOUDSTACK-9437: Create egress chain on upgrade and cleanup for allow all traffic
- Ensure that FW_EGRESS_RULE chain exists after upgrading the router
- Flush allow all egress rule on 0.0.0.0/0, if such a rule exists in the config
it will be added later (CLOUDSTACK-9437)
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/d302269f
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/d302269f
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/d302269f
Branch: refs/heads/master
Commit: d302269fe53ca0d3ef4c7d4c51b28ce94d8a4847
Parents: 818063c
Author: Will Stevens <wi...@gmail.com>
Authored: Mon Jul 25 16:44:38 2016 -0400
Committer: Will Stevens <wi...@gmail.com>
Committed: Mon Jul 25 16:44:38 2016 -0400
----------------------------------------------------------------------
systemvm/patches/debian/config/opt/cloud/bin/configure.py | 7 +++++++
1 file changed, 7 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/d302269f/systemvm/patches/debian/config/opt/cloud/bin/configure.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/configure.py b/systemvm/patches/debian/config/opt/cloud/bin/configure.py
index 35ac3f2..dd164a2 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/configure.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/configure.py
@@ -263,6 +263,12 @@ class CsAcl(CsDataBag):
rstr = rstr.replace(" ", " ").lstrip()
self.fw.append([self.table, self.count, rstr])
+ def flushAllowAllEgressRules(self):
+ logging.debug("Flush allow 'all' egress firewall rule")
+ # Ensure that FW_EGRESS_RULES chain exists
+ CsHelper.execute("iptables-save | grep '^:FW_EGRESS_RULES' || iptables -t filter -N FW_EGRESS_RULES")
+ CsHelper.execute("iptables-save | grep '^-A FW_EGRESS_RULES -j ACCEPT$' | sed 's/^-A/iptables -t filter -D/g' | bash")
+
def process(self):
for item in self.dbag:
if item == "id":
@@ -978,6 +984,7 @@ def main(argv):
acls.process()
acls = CsAcl('firewallrules', config)
+ acls.flushAllowAllEgressRules()
acls.process()
fwd = CsForwardingRules("forwardingrules", config)