You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by sw...@apache.org on 2016/06/28 15:28:35 UTC
[01/15] git commit: updated refs/heads/master to e4ba640
Repository: cloudstack
Updated Branches:
refs/heads/master f7f23ec72 -> e4ba640a2
VR CsAddress fixes:
* cleanup imports,
* fix to_str(),
* improve & fix service post_config logic
* don't arpPing when there's no gateway
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/d14a4843
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/d14a4843
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/d14a4843
Branch: refs/heads/master
Commit: d14a4843749c20a01994eca0cf587fa3f9d67855
Parents: 6055ed6
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Fri May 13 17:28:39 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:09 2016 +0200
----------------------------------------------------------------------
.../debian/config/opt/cloud/bin/cs/CsAddress.py | 35 +++++++++++---------
1 file changed, 19 insertions(+), 16 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/d14a4843/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py
index e4c5d1f..efcb94f 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py
@@ -15,15 +15,13 @@
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
-from CsDatabag import CsDataBag, CsCmdLine
-from CsApp import CsApache, CsDnsmasq, CsPasswdSvc
-import CsHelper
import logging
from netaddr import IPAddress, IPNetwork
-import CsHelper
-
import subprocess
import time
+import CsHelper
+from CsDatabag import CsDataBag
+from CsApp import CsApache, CsDnsmasq, CsPasswdSvc
from CsRoute import CsRoute
from CsRule import CsRule
@@ -198,7 +196,7 @@ class CsInterface:
return self.get_attr("add")
def to_str(self):
- pprint(self.address)
+ return self.address
class CsDevice:
@@ -293,9 +291,10 @@ class CsIP:
interfaces = [CsInterface(address, self.config)]
CsHelper.reconfigure_interfaces(self.cl, interfaces)
-
self.set_mark()
- self.arpPing()
+
+ if 'gateway' in self.address:
+ self.arpPing()
CsRpsrfs(self.dev).enable()
self.post_config_change("add")
@@ -514,16 +513,19 @@ class CsIP:
self.fw_vpcrouter()
# On deletion nw_type will no longer be known
- if self.get_type() in ["guest"] and self.config.is_vpc():
+ if self.get_type() in ('guest'):
+ if self.config.is_vpc() or self.config.is_router():
+ CsDevice(self.dev, self.config).configure_rp()
+ logging.error(
+ "Not able to setup source-nat for a regular router yet")
- CsDevice(self.dev, self.config).configure_rp()
+ if self.config.has_dns() or self.config.is_dhcp():
+ dns = CsDnsmasq(self)
+ dns.add_firewall_rules()
- logging.error(
- "Not able to setup source-nat for a regular router yet")
- dns = CsDnsmasq(self)
- dns.add_firewall_rules()
- app = CsApache(self)
- app.setup()
+ if self.config.has_metadata():
+ app = CsApache(self)
+ app.setup()
cmdline = self.config.cmdline()
# If redundant then this is dealt with by the master backup functions
@@ -685,3 +687,4 @@ class CsRpsrfs:
if count < 2:
logging.debug("Single CPU machine")
return count
+
[04/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
VR merge.py ipalias fix & dhcpconfig stub notification
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/ed820beb
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/ed820beb
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/ed820beb
Branch: refs/heads/master
Commit: ed820bebe57eb6315f162562503856a7141c6193
Parents: 971c8a7
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Fri May 13 17:16:46 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:09 2016 +0200
----------------------------------------------------------------------
.../debian/config/opt/cloud/bin/merge.py | 31 ++++++++++++++++++++
1 file changed, 31 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/ed820beb/systemvm/patches/debian/config/opt/cloud/bin/merge.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/merge.py b/systemvm/patches/debian/config/opt/cloud/bin/merge.py
index aa67682..4087094 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/merge.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/merge.py
@@ -129,6 +129,13 @@ class updateDataBag:
dbag = self.process_vpnusers(self.db.getDataBag())
elif self.qFile.type == 'staticroutes':
dbag = self.process_staticroutes(self.db.getDataBag())
+ elif self.qFile.type == 'ipaliases':
+ self.db.setKey('ips')
+ self.db.load()
+ dbag = self.process_ipaliases(self.db.getDataBag())
+ elif self.qFile.type == 'dhcpconfig':
+ logging.error("I don't think I need %s anymore", self.qFile.type)
+ return
else:
logging.error("Error I do not know what to do with file of type %s", self.qFile.type)
return
@@ -231,6 +238,30 @@ class updateDataBag:
cs_vmdata.merge(dbag, self.qFile.data)
return dbag
+ def process_ipaliases(self, dbag):
+ nic_dev = None
+ # Should be a way to deal with this better
+ for intf, data in dbag.items():
+ if intf == 'id':
+ continue
+ elif any([net['nw_type'] == 'guest' for net in data]):
+ nic_dev = intf
+ break
+
+ assert nic_dev is not None, 'Unable to determine Guest interface'
+
+ nic_dev_id = nic_dev[3:]
+
+ for alias in self.qFile.data['aliases']:
+ ip = {
+ 'add': not alias['revoke'],
+ 'nw_type': 'guest',
+ 'public_ip': alias['ip_address'],
+ 'netmask': alias['netmask'],
+ 'nic_dev_id': nic_dev_id
+ }
+ dbag = cs_ip.merge(dbag, ip)
+ return dbag
class QueueFile:
[02/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
VR CsConfig: Add is_router(), is_dns(), has_dns(), has_metadata(), use_extdns(), fix get_dns() with use_extdns()
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/748bf435
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/748bf435
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/748bf435
Branch: refs/heads/master
Commit: 748bf4353052c1a1d30e043253298694cd58526e
Parents: 8753790
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Fri May 13 17:23:04 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:09 2016 +0200
----------------------------------------------------------------------
.../debian/config/opt/cloud/bin/cs/CsConfig.py | 32 +++++++++++++-------
1 file changed, 21 insertions(+), 11 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/748bf435/systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py
index a35a545..f3de977 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py
@@ -58,25 +58,35 @@ class CsConfig(object):
return self.__LOG_LEVEL
def is_vpc(self):
- return self.cl.get_type() == "vpcrouter"
+ return self.cl.get_type() == 'vpcrouter'
def is_router(self):
- return self.cl.get_type() == "router"
+ return self.cl.get_type() == 'router'
+
+ def is_dhcp(self):
+ return self.cl.get_type() == 'dhcpsrvr'
+
+ def has_dns(self):
+ return not self.use_extdns()
+
+ def has_metadata(self):
+ return any((self.is_vpc(), self.is_router(), self.is_dhcp()))
def get_domain(self):
return self.cl.get_domain()
+ def use_extdns(self):
+ return self.cmdline().idata().get('useextdns', 'false') == 'true'
+
def get_dns(self):
+ conf = self.cmdline().idata()
dns = []
- if not self.cl.get_use_ext_dns():
- if not self.is_vpc() and self.cl.is_redundant():
- dns.append(self.cl.get_guest_gw())
- else:
- dns.append(self.address().get_guest_ip())
- names = ["dns1", "dns2"]
- for name in names:
- if name in self.cmdline().idata():
- dns.append(self.cmdline().idata()[name])
+ if not self.use_extdns():
+ dns.append(self.address().get_guest_ip())
+
+ for name in ('dns1', 'dns2'):
+ if name in conf:
+ dns.append(conf[name])
return dns
def get_format(self):
[12/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
SysVM cloud-early-config: Intermediate fix for SecStore & CORS
* Take setup from vhost.template rather than default(-ssl)
* should move into Python CS code as well
* Move CORS setup to separate conf
* Modify vhost template to Optionally include the cors file
* Add NameVirtualHost to vhost template for feature parity with ports.conf
* Take setup from vhost.template rather than default(-ssl)
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/72e83085
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/72e83085
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/72e83085
Branch: refs/heads/master
Commit: 72e83085e1e041b9272baa18a6b212d61fbbde01
Parents: f49a4d9
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Mon May 30 18:25:42 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:10 2016 +0200
----------------------------------------------------------------------
.../debian/config/etc/apache2/vhost.template | 4 +++
.../debian/config/etc/init.d/cloud-early-config | 38 +++++++++-----------
2 files changed, 20 insertions(+), 22 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/72e83085/systemvm/patches/debian/config/etc/apache2/vhost.template
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/apache2/vhost.template b/systemvm/patches/debian/config/etc/apache2/vhost.template
index dd9c58a..24d8d60 100644
--- a/systemvm/patches/debian/config/etc/apache2/vhost.template
+++ b/systemvm/patches/debian/config/etc/apache2/vhost.template
@@ -83,6 +83,9 @@
Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>
+ # Include CORS configuration if set
+ IncludeOptional /etc/apache2/cors.conf
+
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
@@ -225,6 +228,7 @@
# README.Debian.gz
Listen 10.1.1.1:80
+NameVirtualHost 10.1.1.1:80
<IfModule mod_ssl.c>
# If you add NameVirtualHost *:443 here, you will also have to change
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/72e83085/systemvm/patches/debian/config/etc/init.d/cloud-early-config
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/init.d/cloud-early-config b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
index baec1d8..8ced0f9 100755
--- a/systemvm/patches/debian/config/etc/init.d/cloud-early-config
+++ b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
@@ -1212,33 +1212,27 @@ setup_secstorage() {
fi
setup_apache2 $ETH2_IP
+ # Deprecated, should move to Cs Python all of it
+ sed -e "s/<VirtualHost .*:80>/<VirtualHost $ETH2_IP:80>/" \
+ -e "s/<VirtualHost .*:443>/<VirtualHost $ETH2_IP:443>/" \
+ -e "s/Listen .*:80/Listen $ETH2_IP:80/g" \
+ -e "s/Listen .*:443/Listen $ETH2_IP:443/g" \
+ -e "s/NameVirtualHost .*:80/NameVirtualHost $ETH2_IP:80/g" /etc/apache2/vhost.template > /etc/apache2/sites-enabled/vhost-${ETH2_IP}.conf
+
log_it "setting up apache2 for post upload of volume/template"
a2enmod proxy
a2enmod proxy_http
a2enmod headers
- SSL_FILE="/etc/apache2/sites-available/default-ssl"
- PATTERN="RewriteRule ^\/upload\/(.*)"
- CORS_PATTERN="Header set Access-Control-Allow-Origin"
- if [ -f $SSL_FILE ]; then
- if grep -q "$PATTERN" $SSL_FILE ; then
- log_it "rewrite rules already exist in file $SSL_FILE"
- else
- log_it "adding rewrite rules to file: $SSL_FILE"
- sed -i -e "s/<\/VirtualHost>/RewriteEngine On \n&/" $SSL_FILE
- sed -i -e "s/<\/VirtualHost>/RewriteCond %{HTTPS} =on \n&/" $SSL_FILE
- sed -i -e "s/<\/VirtualHost>/RewriteCond %{REQUEST_METHOD} =POST \n&/" $SSL_FILE
- sed -i -e "s/<\/VirtualHost>/RewriteRule ^\/upload\/(.*) http:\/\/127.0.0.1:8210\/upload?uuid=\$1 [P,L] \n&/" $SSL_FILE
- fi
- if grep -q "$CORS_PATTERN" $SSL_FILE ; then
- log_it "cors rules already exist in file $SSL_FILE"
- else
- log_it "adding cors rules to file: $SSL_FILE"
- sed -i -e "s/<\/VirtualHost>/Header always set Access-Control-Allow-Origin \"*\" \n&/" $SSL_FILE
- sed -i -e "s/<\/VirtualHost>/Header always set Access-Control-Allow-Methods \"POST, OPTIONS\" \n&/" $SSL_FILE
- sed -i -e "s/<\/VirtualHost>/Header always set Access-Control-Allow-Headers \"x-requested-with, Content-Type, origin, authorization, accept, client-security-token, x-signature, x-metadata, x-expires\" \n&/" $SSL_FILE
- fi
- fi
+ cat >/etc/apache2/cors.conf <<CORS
+RewriteEngine On
+RewriteCond %{HTTPS} =on
+RewriteCond %{REQUEST_METHOD} =POST
+RewriteRule ^/upload/(.*) http://127.0.0.1:8210/upload?uuid=\$1 [P,L]
+Header always set Access-Control-Allow-Origin "*"
+Header always set Access-Control-Allow-Methods "POST, OPTIONS"
+Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token, x-signature, x-metadata, x-expires"
+CORS
service apache2 restart
[06/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
VR CsApp: Expose config to classes, move vhost confs to proper location, allow for multiple IP's per intf, sanitize servername, don't open port 53 if no DNS is foreseen
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/6055ed6e
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/6055ed6e
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/6055ed6e
Branch: refs/heads/master
Commit: 6055ed6ed67fc43b3fe27a6971020336dcc4ff9d
Parents: 748bf43
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Fri May 13 17:25:06 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:09 2016 +0200
----------------------------------------------------------------------
.../debian/config/opt/cloud/bin/cs/CsApp.py | 31 ++++++++++++--------
1 file changed, 18 insertions(+), 13 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/6055ed6e/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
index a0b4c6e..003af48 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
@@ -28,35 +28,37 @@ class CsApp:
self.ip = ip.get_ip_address()
self.type = ip.get_type()
self.fw = ip.fw
+ self.config = ip.config
class CsApache(CsApp):
""" Set up Apache """
def remove(self):
- file = "/etc/apache2/conf.d/vhost%s.conf" % self.dev
+ file = "/etc/apache2/sites-enabled/vhost-%s.conf" % self.dev
if os.path.isfile(file):
os.remove(file)
CsHelper.service("apache2", "restart")
def setup(self):
CsHelper.copy_if_needed("/etc/apache2/vhostexample.conf",
- "/etc/apache2/conf.d/vhost%s.conf" % self.dev)
+ "/etc/apache2/sites-enabled/vhost-%s.conf" % self.ip)
- file = CsFile("/etc/apache2/conf.d/vhost%s.conf" % (self.dev))
+ file = CsFile("/etc/apache2/sites-enabled/vhost-%s.conf" % (self.ip))
file.search("<VirtualHost.*:80>", "\t<VirtualHost %s:80>" % (self.ip))
file.search("<VirtualHost.*:80>", "\t<VirtualHost %s:80>" % (self.ip))
file.search("<VirtualHost.*:443>", "\t<VirtualHost %s:443>" % (self.ip))
file.search("Listen .*:80", "Listen %s:80" % (self.ip))
file.search("Listen .*:443", "Listen %s:443" % (self.ip))
- file.search("ServerName.*", "\tServerName vhost%s.cloudinternal.com" % (self.dev))
+ file.search("ServerName.*", "\tServerName %s.%s" % (self.config.cl.get_type(), self.config.get_domain()))
if file.is_changed():
file.commit()
CsHelper.service("apache2", "restart")
- self.fw.append(["", "front",
- "-A INPUT -i %s -d %s/32 -p tcp -m tcp -m state --state NEW --dport 80 -j ACCEPT" % (self.dev, self.ip)
- ])
+ self.fw.append([
+ "", "front",
+ "-A INPUT -i %s -d %s/32 -p tcp -m tcp -m state --state NEW --dport 80 -j ACCEPT" % (self.dev, self.ip)
+ ])
class CsPasswdSvc():
@@ -94,10 +96,13 @@ class CsDnsmasq(CsApp):
"-A INPUT -i %s -p udp -m udp --dport 67 -j ACCEPT" % self.dev
])
- self.fw.append(["", "front",
- "-A INPUT -i %s -d %s/32 -p udp -m udp --dport 53 -j ACCEPT" % (self.dev, self.ip)
- ])
+ if self.config.has_dns():
+ self.fw.append([
+ "", "front",
+ "-A INPUT -i %s -d %s/32 -p udp -m udp --dport 53 -j ACCEPT" % (self.dev, self.ip)
+ ])
- self.fw.append(["", "front",
- "-A INPUT -i %s -d %s/32 -p tcp -m tcp --dport 53 -j ACCEPT" % (self.dev, self.ip)
- ])
+ self.fw.append([
+ "", "front",
+ "-A INPUT -i %s -d %s/32 -p tcp -m tcp --dport 53 -j ACCEPT" % (self.dev, self.ip)
+ ])
[13/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
VR: consistent SSL setup, vhost is not an example, but a template
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/e32cd130
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/e32cd130
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/e32cd130
Branch: refs/heads/master
Commit: e32cd1303abd07531d89551719f62306dfcef823
Parents: f379df4
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Wed May 18 16:38:39 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:10 2016 +0200
----------------------------------------------------------------------
LICENSE | 2 +-
pom.xml | 2 +-
.../debian/config/etc/apache2/vhost.template | 241 +++++++++++++++++++
.../debian/config/etc/apache2/vhostexample.conf | 239 ------------------
.../debian/config/opt/cloud/bin/cs/CsApp.py | 8 +-
tools/whisker/LICENSE | 2 +-
tools/whisker/descriptor-for-packaging.xml | 2 +-
tools/whisker/descriptor.xml | 2 +-
8 files changed, 252 insertions(+), 246 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/e32cd130/LICENSE
----------------------------------------------------------------------
diff --git a/LICENSE b/LICENSE
index 9d53cbc..6c2462d 100644
--- a/LICENSE
+++ b/LICENSE
@@ -224,7 +224,7 @@ Within the patches/systemvm/debian/config/etc/apache2 directory
ports.conf
sites-available/default
sites-available/default-ssl
- vhostexample.conf
+ vhost.template
Within the patches/systemvm/debian/config/etc/ssh/ directory
licensed under the BSD (2-clause) http://www.opensource.org/licenses/BSD-2-Clause (as follows)
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/e32cd130/pom.xml
----------------------------------------------------------------------
diff --git a/pom.xml b/pom.xml
index 5ecce93..b244f17 100644
--- a/pom.xml
+++ b/pom.xml
@@ -895,7 +895,7 @@
<exclude>systemvm/patches/debian/config/etc/apache2/ports.conf</exclude>
<exclude>systemvm/patches/debian/config/etc/apache2/sites-available/default</exclude>
<exclude>systemvm/patches/debian/config/etc/apache2/sites-available/default-ssl</exclude>
- <exclude>systemvm/patches/debian/config/etc/apache2/vhostexample.conf</exclude>
+ <exclude>systemvm/patches/debian/config/etc/apache2/vhost.template</exclude>
<exclude>systemvm/patches/debian/config/etc/dnsmasq.conf.tmpl</exclude>
<exclude>systemvm/patches/debian/config/etc/vpcdnsmasq.conf</exclude>
<exclude>systemvm/patches/debian/config/etc/ssh/sshd_config</exclude>
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/e32cd130/systemvm/patches/debian/config/etc/apache2/vhost.template
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/apache2/vhost.template b/systemvm/patches/debian/config/etc/apache2/vhost.template
new file mode 100644
index 0000000..dd9c58a
--- /dev/null
+++ b/systemvm/patches/debian/config/etc/apache2/vhost.template
@@ -0,0 +1,241 @@
+<VirtualHost 10.1.1.1:80>
+ ServerAdmin webmaster@localhost
+
+ DocumentRoot /var/www/html
+ ServerName cloudinternal.com
+ <Directory />
+ Options FollowSymLinks
+ AllowOverride None
+ </Directory>
+ <Directory /var/www/html>
+ Options Indexes FollowSymLinks MultiViews
+ AllowOverride All
+ Order allow,deny
+ allow from all
+ </Directory>
+
+ ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
+ <Directory "/usr/lib/cgi-bin">
+ AllowOverride None
+ Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
+ Order allow,deny
+ Allow from all
+ </Directory>
+
+ ErrorLog ${APACHE_LOG_DIR}/error.log
+
+ # Possible values include: debug, info, notice, warn, error, crit,
+ # alert, emerg.
+ LogLevel warn
+
+ CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+ Alias /doc/ "/usr/share/doc/"
+ <Directory "/usr/share/doc/">
+ Options Indexes MultiViews FollowSymLinks
+ AllowOverride None
+ Order deny,allow
+ Deny from all
+ Allow from 127.0.0.0/255.0.0.0 ::1/128
+ </Directory>
+
+</VirtualHost>
+
+<IfModule mod_ssl.c>
+<VirtualHost 10.1.1.1:443>
+ ServerAdmin webmaster@localhost
+
+ DocumentRoot /var/www/html
+ ServerName cloudinternal.com
+ <Directory />
+ Options FollowSymLinks
+ AllowOverride None
+ </Directory>
+ <Directory /var/www/html>
+ Options Indexes FollowSymLinks MultiViews
+ AllowOverride all
+ Order allow,deny
+ allow from all
+ </Directory>
+
+ ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
+ <Directory "/usr/lib/cgi-bin">
+ AllowOverride None
+ Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
+ Order allow,deny
+ Allow from all
+ </Directory>
+
+ ErrorLog ${APACHE_LOG_DIR}/error.log
+
+ # Possible values include: debug, info, notice, warn, error, crit,
+ # alert, emerg.
+ LogLevel warn
+
+ CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
+
+ Alias /doc/ "/usr/share/doc/"
+ <Directory "/usr/share/doc/">
+ Options Indexes MultiViews FollowSymLinks
+ AllowOverride None
+ Order deny,allow
+ Deny from all
+ Allow from 127.0.0.0/255.0.0.0 ::1/128
+ </Directory>
+
+ # SSL Engine Switch:
+ # Enable/Disable SSL for this virtual host.
+ SSLEngine on
+ SSLProtocol all -SSLv2 -SSLv3
+ SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+ SSLHonorCipherOrder on
+
+ # A self-signed (snakeoil) certificate can be created by installing
+ # the ssl-cert package. See
+ # /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
+ # If both key and certificate are stored in the same file, only the
+ # SSLCertificateFile directive is needed.
+ SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
+ SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
+
+ # Server Certificate Chain:
+ # Point SSLCertificateChainFile at a file containing the
+ # concatenation of PEM encoded CA certificates which form the
+ # certificate chain for the server certificate. Alternatively
+ # the referenced file can be the same as SSLCertificateFile
+ # when the CA certificates are directly appended to the server
+ # certificate for convinience.
+ #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
+
+ # Certificate Authority (CA):
+ # Set the CA certificate verification path where to find CA
+ # certificates for client authentication or alternatively one
+ # huge file containing all of them (file must be PEM encoded)
+ # Note: Inside SSLCACertificatePath you need hash symlinks
+ # to point to the certificate files. Use the provided
+ # Makefile to update the hash symlinks after changes.
+ #SSLCACertificatePath /etc/ssl/certs/
+ #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
+
+ # Certificate Revocation Lists (CRL):
+ # Set the CA revocation path where to find CA CRLs for client
+ # authentication or alternatively one huge file containing all
+ # of them (file must be PEM encoded)
+ # Note: Inside SSLCARevocationPath you need hash symlinks
+ # to point to the certificate files. Use the provided
+ # Makefile to update the hash symlinks after changes.
+ #SSLCARevocationPath /etc/apache2/ssl.crl/
+ #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
+
+ # Client Authentication (Type):
+ # Client certificate verification type and depth. Types are
+ # none, optional, require and optional_no_ca. Depth is a
+ # number which specifies how deeply to verify the certificate
+ # issuer chain before deciding the certificate is not valid.
+ #SSLVerifyClient require
+ #SSLVerifyDepth 10
+
+ # Access Control:
+ # With SSLRequire you can do per-directory access control based
+ # on arbitrary complex boolean expressions containing server
+ # variable checks and other lookup directives. The syntax is a
+ # mixture between C and Perl. See the mod_ssl documentation
+ # for more details.
+ #<Location />
+ #SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
+ # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+ # and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
+ # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
+ # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
+ # or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
+ #</Location>
+
+ # SSL Engine Options:
+ # Set various options for the SSL engine.
+ # o FakeBasicAuth:
+ # Translate the client X.509 into a Basic Authorisation. This means that
+ # the standard Auth/DBMAuth methods can be used for access control. The
+ # user name is the `one line' version of the client's X.509 certificate.
+ # Note that no password is obtained from the user. Every entry in the user
+ # file needs this password: `xxj31ZMTZzkVA'.
+ # o ExportCertData:
+ # This exports two additional environment variables: SSL_CLIENT_CERT and
+ # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+ # server (always existing) and the client (only existing when client
+ # authentication is used). This can be used to import the certificates
+ # into CGI scripts.
+ # o StdEnvVars:
+ # This exports the standard SSL/TLS related `SSL_*' environment variables.
+ # Per default this exportation is switched off for performance reasons,
+ # because the extraction step is an expensive operation and is usually
+ # useless for serving static content. So one usually enables the
+ # exportation for CGI and SSI requests only.
+ # o StrictRequire:
+ # This denies access when "SSLRequireSSL" or "SSLRequire" applied even
+ # under a "Satisfy any" situation, i.e. when it applies access is denied
+ # and no other module can change it.
+ # o OptRenegotiate:
+ # This enables optimized SSL connection renegotiation handling when SSL
+ # directives are used in per-directory context.
+ #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
+ <FilesMatch "\.(cgi|shtml|phtml|php)$">
+ SSLOptions +StdEnvVars
+ </FilesMatch>
+ <Directory /usr/lib/cgi-bin>
+ SSLOptions +StdEnvVars
+ </Directory>
+
+ # SSL Protocol Adjustments:
+ # The safe and default but still SSL/TLS standard compliant shutdown
+ # approach is that mod_ssl sends the close notify alert but doesn't wait for
+ # the close notify alert from client. When you need a different shutdown
+ # approach you can use one of the following variables:
+ # o ssl-unclean-shutdown:
+ # This forces an unclean shutdown when the connection is closed, i.e. no
+ # SSL close notify alert is send or allowed to received. This violates
+ # the SSL/TLS standard but is needed for some brain-dead browsers. Use
+ # this when you receive I/O errors because of the standard approach where
+ # mod_ssl sends the close notify alert.
+ # o ssl-accurate-shutdown:
+ # This forces an accurate shutdown when the connection is closed, i.e. a
+ # SSL close notify alert is send and mod_ssl waits for the close notify
+ # alert of the client. This is 100% SSL/TLS standard compliant, but in
+ # practice often causes hanging connections with brain-dead browsers. Use
+ # this only for browsers where you know that their SSL implementation
+ # works correctly.
+ # Notice: Most problems of broken clients are also related to the HTTP
+ # keep-alive facility, so you usually additionally want to disable
+ # keep-alive for those clients, too. Use variable "nokeepalive" for this.
+ # Similarly, one has to force some clients to use HTTP/1.0 to workaround
+ # their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+ # "force-response-1.0" for this.
+ BrowserMatch "MSIE [2-6]" \
+ nokeepalive ssl-unclean-shutdown \
+ downgrade-1.0 force-response-1.0
+ # MSIE 7 and newer should be able to use keepalive
+ BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
+
+</VirtualHost>
+</IfModule>
+# If you just change the port or add more ports here, you will likely also
+# have to change the VirtualHost statement in
+# /etc/apache2/sites-enabled/000-default
+# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
+# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
+# README.Debian.gz
+
+Listen 10.1.1.1:80
+
+<IfModule mod_ssl.c>
+ # If you add NameVirtualHost *:443 here, you will also have to change
+ # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
+ # to <VirtualHost *:443>
+ # Server Name Indication for SSL named virtual hosts is currently not
+ # supported by MSIE on Windows XP.
+ Listen 10.1.1.1:443
+</IfModule>
+
+<IfModule mod_gnutls.c>
+ Listen 10.1.1.1:443
+</IfModule>
+
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/e32cd130/systemvm/patches/debian/config/etc/apache2/vhostexample.conf
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/apache2/vhostexample.conf b/systemvm/patches/debian/config/etc/apache2/vhostexample.conf
deleted file mode 100644
index 70cb7dc..0000000
--- a/systemvm/patches/debian/config/etc/apache2/vhostexample.conf
+++ /dev/null
@@ -1,239 +0,0 @@
-<VirtualHost 10.1.1.1:80>
- ServerAdmin webmaster@localhost
-
- DocumentRoot /var/www/html
- ServerName cloudinternal.com
- <Directory />
- Options FollowSymLinks
- AllowOverride None
- </Directory>
- <Directory /var/www/html>
- Options Indexes FollowSymLinks MultiViews
- AllowOverride All
- Order allow,deny
- allow from all
- </Directory>
-
- ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
- <Directory "/usr/lib/cgi-bin">
- AllowOverride None
- Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
- Order allow,deny
- Allow from all
- </Directory>
-
- ErrorLog ${APACHE_LOG_DIR}/error.log
-
- # Possible values include: debug, info, notice, warn, error, crit,
- # alert, emerg.
- LogLevel warn
-
- CustomLog ${APACHE_LOG_DIR}/access.log combined
-
- Alias /doc/ "/usr/share/doc/"
- <Directory "/usr/share/doc/">
- Options Indexes MultiViews FollowSymLinks
- AllowOverride None
- Order deny,allow
- Deny from all
- Allow from 127.0.0.0/255.0.0.0 ::1/128
- </Directory>
-
-</VirtualHost>
-
-<IfModule mod_ssl.c>
-<VirtualHost 10.1.1.1:443>
- ServerAdmin webmaster@localhost
-
- DocumentRoot /var/www/html
- ServerName cloudinternal.com
- <Directory />
- Options FollowSymLinks
- AllowOverride None
- </Directory>
- <Directory /var/www/html>
- Options Indexes FollowSymLinks MultiViews
- AllowOverride all
- Order allow,deny
- allow from all
- </Directory>
-
- ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
- <Directory "/usr/lib/cgi-bin">
- AllowOverride None
- Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
- Order allow,deny
- Allow from all
- </Directory>
-
- ErrorLog ${APACHE_LOG_DIR}/error.log
-
- # Possible values include: debug, info, notice, warn, error, crit,
- # alert, emerg.
- LogLevel warn
-
- CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
-
- Alias /doc/ "/usr/share/doc/"
- <Directory "/usr/share/doc/">
- Options Indexes MultiViews FollowSymLinks
- AllowOverride None
- Order deny,allow
- Deny from all
- Allow from 127.0.0.0/255.0.0.0 ::1/128
- </Directory>
-
- # SSL Engine Switch:
- # Enable/Disable SSL for this virtual host.
- SSLEngine on
- SSLProtocol all -SSLv2 -SSLv3
-
- # A self-signed (snakeoil) certificate can be created by installing
- # the ssl-cert package. See
- # /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
- # If both key and certificate are stored in the same file, only the
- # SSLCertificateFile directive is needed.
- SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
- SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
-
- # Server Certificate Chain:
- # Point SSLCertificateChainFile at a file containing the
- # concatenation of PEM encoded CA certificates which form the
- # certificate chain for the server certificate. Alternatively
- # the referenced file can be the same as SSLCertificateFile
- # when the CA certificates are directly appended to the server
- # certificate for convinience.
- #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
-
- # Certificate Authority (CA):
- # Set the CA certificate verification path where to find CA
- # certificates for client authentication or alternatively one
- # huge file containing all of them (file must be PEM encoded)
- # Note: Inside SSLCACertificatePath you need hash symlinks
- # to point to the certificate files. Use the provided
- # Makefile to update the hash symlinks after changes.
- #SSLCACertificatePath /etc/ssl/certs/
- #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
-
- # Certificate Revocation Lists (CRL):
- # Set the CA revocation path where to find CA CRLs for client
- # authentication or alternatively one huge file containing all
- # of them (file must be PEM encoded)
- # Note: Inside SSLCARevocationPath you need hash symlinks
- # to point to the certificate files. Use the provided
- # Makefile to update the hash symlinks after changes.
- #SSLCARevocationPath /etc/apache2/ssl.crl/
- #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
-
- # Client Authentication (Type):
- # Client certificate verification type and depth. Types are
- # none, optional, require and optional_no_ca. Depth is a
- # number which specifies how deeply to verify the certificate
- # issuer chain before deciding the certificate is not valid.
- #SSLVerifyClient require
- #SSLVerifyDepth 10
-
- # Access Control:
- # With SSLRequire you can do per-directory access control based
- # on arbitrary complex boolean expressions containing server
- # variable checks and other lookup directives. The syntax is a
- # mixture between C and Perl. See the mod_ssl documentation
- # for more details.
- #<Location />
- #SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
- # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
- # and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
- # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
- # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
- # or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
- #</Location>
-
- # SSL Engine Options:
- # Set various options for the SSL engine.
- # o FakeBasicAuth:
- # Translate the client X.509 into a Basic Authorisation. This means that
- # the standard Auth/DBMAuth methods can be used for access control. The
- # user name is the `one line' version of the client's X.509 certificate.
- # Note that no password is obtained from the user. Every entry in the user
- # file needs this password: `xxj31ZMTZzkVA'.
- # o ExportCertData:
- # This exports two additional environment variables: SSL_CLIENT_CERT and
- # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
- # server (always existing) and the client (only existing when client
- # authentication is used). This can be used to import the certificates
- # into CGI scripts.
- # o StdEnvVars:
- # This exports the standard SSL/TLS related `SSL_*' environment variables.
- # Per default this exportation is switched off for performance reasons,
- # because the extraction step is an expensive operation and is usually
- # useless for serving static content. So one usually enables the
- # exportation for CGI and SSI requests only.
- # o StrictRequire:
- # This denies access when "SSLRequireSSL" or "SSLRequire" applied even
- # under a "Satisfy any" situation, i.e. when it applies access is denied
- # and no other module can change it.
- # o OptRenegotiate:
- # This enables optimized SSL connection renegotiation handling when SSL
- # directives are used in per-directory context.
- #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
- <FilesMatch "\.(cgi|shtml|phtml|php)$">
- SSLOptions +StdEnvVars
- </FilesMatch>
- <Directory /usr/lib/cgi-bin>
- SSLOptions +StdEnvVars
- </Directory>
-
- # SSL Protocol Adjustments:
- # The safe and default but still SSL/TLS standard compliant shutdown
- # approach is that mod_ssl sends the close notify alert but doesn't wait for
- # the close notify alert from client. When you need a different shutdown
- # approach you can use one of the following variables:
- # o ssl-unclean-shutdown:
- # This forces an unclean shutdown when the connection is closed, i.e. no
- # SSL close notify alert is send or allowed to received. This violates
- # the SSL/TLS standard but is needed for some brain-dead browsers. Use
- # this when you receive I/O errors because of the standard approach where
- # mod_ssl sends the close notify alert.
- # o ssl-accurate-shutdown:
- # This forces an accurate shutdown when the connection is closed, i.e. a
- # SSL close notify alert is send and mod_ssl waits for the close notify
- # alert of the client. This is 100% SSL/TLS standard compliant, but in
- # practice often causes hanging connections with brain-dead browsers. Use
- # this only for browsers where you know that their SSL implementation
- # works correctly.
- # Notice: Most problems of broken clients are also related to the HTTP
- # keep-alive facility, so you usually additionally want to disable
- # keep-alive for those clients, too. Use variable "nokeepalive" for this.
- # Similarly, one has to force some clients to use HTTP/1.0 to workaround
- # their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
- # "force-response-1.0" for this.
- BrowserMatch "MSIE [2-6]" \
- nokeepalive ssl-unclean-shutdown \
- downgrade-1.0 force-response-1.0
- # MSIE 7 and newer should be able to use keepalive
- BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
-
-</VirtualHost>
-</IfModule>
-# If you just change the port or add more ports here, you will likely also
-# have to change the VirtualHost statement in
-# /etc/apache2/sites-enabled/000-default
-# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
-# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
-# README.Debian.gz
-
-Listen 10.1.1.1:80
-
-<IfModule mod_ssl.c>
- # If you add NameVirtualHost *:443 here, you will also have to change
- # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
- # to <VirtualHost *:443>
- # Server Name Indication for SSL named virtual hosts is currently not
- # supported by MSIE on Windows XP.
- Listen 10.1.1.1:443
-</IfModule>
-
-<IfModule mod_gnutls.c>
- Listen 10.1.1.1:443
-</IfModule>
-
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/e32cd130/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
index 003af48..496a0e7 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
@@ -41,12 +41,11 @@ class CsApache(CsApp):
CsHelper.service("apache2", "restart")
def setup(self):
- CsHelper.copy_if_needed("/etc/apache2/vhostexample.conf",
+ CsHelper.copy_if_needed("/etc/apache2/vhost.template",
"/etc/apache2/sites-enabled/vhost-%s.conf" % self.ip)
file = CsFile("/etc/apache2/sites-enabled/vhost-%s.conf" % (self.ip))
file.search("<VirtualHost.*:80>", "\t<VirtualHost %s:80>" % (self.ip))
- file.search("<VirtualHost.*:80>", "\t<VirtualHost %s:80>" % (self.ip))
file.search("<VirtualHost.*:443>", "\t<VirtualHost %s:443>" % (self.ip))
file.search("Listen .*:80", "Listen %s:80" % (self.ip))
file.search("Listen .*:443", "Listen %s:443" % (self.ip))
@@ -60,6 +59,11 @@ class CsApache(CsApp):
"-A INPUT -i %s -d %s/32 -p tcp -m tcp -m state --state NEW --dport 80 -j ACCEPT" % (self.dev, self.ip)
])
+ self.fw.append([
+ "", "front",
+ "-A INPUT -i %s -d %s/32 -p tcp -m tcp -m state --state NEW --dport 443 -j ACCEPT" % (self.dev, self.ip)
+ ])
+
class CsPasswdSvc():
"""
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/e32cd130/tools/whisker/LICENSE
----------------------------------------------------------------------
diff --git a/tools/whisker/LICENSE b/tools/whisker/LICENSE
index da8aaed..6bc400e 100644
--- a/tools/whisker/LICENSE
+++ b/tools/whisker/LICENSE
@@ -2774,7 +2774,7 @@ Within the patches/systemvm/debian/config/etc/apache2 directory
ports.conf
sites-available/default
sites-available/default-ssl
- vhostexample.conf
+ vhost.template
Within the patches/systemvm/debian/config/etc/ssh/ directory
licensed under the BSD (2-clause) http://www.opensource.org/licenses/BSD-2-Clause (as follows)
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/e32cd130/tools/whisker/descriptor-for-packaging.xml
----------------------------------------------------------------------
diff --git a/tools/whisker/descriptor-for-packaging.xml b/tools/whisker/descriptor-for-packaging.xml
index 01e6026..e76e5e2 100644
--- a/tools/whisker/descriptor-for-packaging.xml
+++ b/tools/whisker/descriptor-for-packaging.xml
@@ -2460,7 +2460,7 @@ Copyright (c) 2012 The Apache Software Foundation
<by-organisation id='apache.org.2'>
<resource name='httpd.conf' />
<resource name='ports.conf' />
- <resource name='vhostexample.conf' />
+ <resource name='vhost.template' />
<resource name='sites-available/default' />
<resource name='sites-available/default-ssl' />
</by-organisation>
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/e32cd130/tools/whisker/descriptor.xml
----------------------------------------------------------------------
diff --git a/tools/whisker/descriptor.xml b/tools/whisker/descriptor.xml
index da38b18..6996efe 100644
--- a/tools/whisker/descriptor.xml
+++ b/tools/whisker/descriptor.xml
@@ -2444,7 +2444,7 @@ Copyright (c) 2012 The Apache Software Foundation
<by-organisation id='apache.org.2'>
<resource name='httpd.conf' />
<resource name='ports.conf' />
- <resource name='vhostexample.conf' />
+ <resource name='vhost.template' />
<resource name='sites-available/default' />
<resource name='sites-available/default-ssl' />
</by-organisation>
[03/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
VR CsGuestNetwork obey useextdns
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/2790d7a6
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/2790d7a6
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/2790d7a6
Branch: refs/heads/master
Commit: 2790d7a69b5cb66b6bbc8cd68b712d020a07f063
Parents: ed820be
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Fri May 13 17:18:01 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:09 2016 +0200
----------------------------------------------------------------------
.../config/opt/cloud/bin/cs/CsGuestNetwork.py | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/2790d7a6/systemvm/patches/debian/config/opt/cloud/bin/cs/CsGuestNetwork.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsGuestNetwork.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsGuestNetwork.py
index e1afb92..d23a870 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsGuestNetwork.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsGuestNetwork.py
@@ -38,13 +38,15 @@ class CsGuestNetwork:
def get_dns(self):
if not self.guest:
return self.config.get_dns()
- # Can a router provide dhcp but not dns?
- if 'dns' in self.data and 'router_guest_gateway' in self.data:
- return [self.data['router_guest_gateway']] + self.data['dns'].split(',')
- elif "router_guest_gateway" in self.data:
- return [self.data['router_guest_gateway']]
- else:
- return [""]
+
+ dns = []
+ if not self.config.use_extdns() and 'router_guest_gateway' in self.data:
+ dns.append(self.data['router_guest_gateway'])
+
+ if 'dns' in self.data:
+ dns.extend(self.data['dns'].split(','))
+
+ return dns or ['']
def set_dns(self, val):
self.data['dns'] = val
[11/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
SysVM various fixes to previous refactorings
* make CORS include a regular glob-matched one
* fix NameVirtualHost in CsApp.py as well
* even moar cleanups
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/91a8faac
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/91a8faac
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/91a8faac
Branch: refs/heads/master
Commit: 91a8faac316b93d165f3f316d4293ff454da1b67
Parents: 58bdb44
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Tue May 31 09:07:37 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:10 2016 +0200
----------------------------------------------------------------------
systemvm/patches/debian/config/etc/apache2/vhost.template | 4 ++--
systemvm/patches/debian/config/etc/init.d/cloud-early-config | 3 +++
systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py | 1 +
3 files changed, 6 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/91a8faac/systemvm/patches/debian/config/etc/apache2/vhost.template
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/apache2/vhost.template b/systemvm/patches/debian/config/etc/apache2/vhost.template
index 24d8d60..043a286 100644
--- a/systemvm/patches/debian/config/etc/apache2/vhost.template
+++ b/systemvm/patches/debian/config/etc/apache2/vhost.template
@@ -83,8 +83,8 @@
Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>
- # Include CORS configuration if set
- IncludeOptional /etc/apache2/cors.conf
+ # Include CORS configuration **IF SET**
+ Include /etc/apache2/[cC][oO][rR][sS].conf
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/91a8faac/systemvm/patches/debian/config/etc/init.d/cloud-early-config
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/init.d/cloud-early-config b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
index 2103065..bc26766 100755
--- a/systemvm/patches/debian/config/etc/init.d/cloud-early-config
+++ b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
@@ -814,8 +814,11 @@ clean_ipalias_config() {
rm -f /etc/apache2/sites-enabled/ipAlias*
rm -f /etc/apache2/conf.d/vhost*.conf
rm -f /etc/apache2/ports.conf
+ rm -f /etc/apache2/vhostexample.conf
rm -f /etc/apache2/sites-available/default
rm -f /etc/apache2/sites-available/default-ssl
+ rm -f /etc/apache2/sites-enabled/default
+ rm -f /etc/apache2/sites-enabled/default-ssl
# New
rm -f /etc/apache2/sites-enabled/vhost-*.conf
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/91a8faac/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
index 496a0e7..9762e04 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsApp.py
@@ -49,6 +49,7 @@ class CsApache(CsApp):
file.search("<VirtualHost.*:443>", "\t<VirtualHost %s:443>" % (self.ip))
file.search("Listen .*:80", "Listen %s:80" % (self.ip))
file.search("Listen .*:443", "Listen %s:443" % (self.ip))
+ file.search("NameVirtualHost .*:80", "NameVirtualHost %s:80" % (self.ip))
file.search("ServerName.*", "\tServerName %s.%s" % (self.config.cl.get_type(), self.config.get_domain()))
if file.is_changed():
file.commit()
[10/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
VR CsConfig: reintroduce old get_dns() behaviour for redundant non-VPC's
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/f379df4b
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/f379df4b
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/f379df4b
Branch: refs/heads/master
Commit: f379df4bc27eda991079f3e462bfd27a11bfea12
Parents: d14a484
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Wed May 18 14:09:39 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:10 2016 +0200
----------------------------------------------------------------------
systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/f379df4b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py
index f3de977..e3b9009 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsConfig.py
@@ -82,7 +82,10 @@ class CsConfig(object):
conf = self.cmdline().idata()
dns = []
if not self.use_extdns():
- dns.append(self.address().get_guest_ip())
+ if not self.is_vpc() and self.cl.is_redundant() and self.cl.get_guest_gw():
+ dns.append(self.cl.get_guest_gw())
+ else:
+ dns.append(self.address().get_guest_ip())
for name in ('dns1', 'dns2'):
if name in conf:
[05/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
VR CsDhcp: allow multiple ranges & finite lease time (fixes CLOUDSTACK-8303)
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/87537904
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/87537904
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/87537904
Branch: refs/heads/master
Commit: 875379042eeae60635b326114a3a3d34ac529cd1
Parents: 2790d7a
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Fri May 13 17:21:18 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:09 2016 +0200
----------------------------------------------------------------------
.../debian/config/opt/cloud/bin/cs/CsDhcp.py | 39 ++++++++++++--------
1 file changed, 24 insertions(+), 15 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/87537904/systemvm/patches/debian/config/opt/cloud/bin/cs/CsDhcp.py
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsDhcp.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsDhcp.py
index 3f102e6..d97c04b 100755
--- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsDhcp.py
+++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsDhcp.py
@@ -17,6 +17,7 @@
import CsHelper
import logging
from netaddr import *
+from random import randint
from CsGuestNetwork import CsGuestNetwork
from cs.CsDatabag import CsDataBag
from cs.CsFile import CsFile
@@ -44,7 +45,7 @@ class CsDhcp(CsDataBag):
continue
self.add(self.dbag[item])
self.write_hosts()
-
+
if self.cloud.is_changed():
self.delete_leases()
@@ -59,23 +60,24 @@ class CsDhcp(CsDataBag):
def configure_server(self):
# self.conf.addeq("dhcp-hostsfile=%s" % DHCP_HOSTS)
+ idx = 0
for i in self.devinfo:
if not i['dnsmasq']:
continue
device = i['dev']
ip = i['ip'].split('/')[0]
- sline = "dhcp-range=interface:%s,set:interface" % (device)
- line = "dhcp-range=interface:%s,set:interface-%s,%s,static" % (device, device, ip)
+ sline = "dhcp-range=interface:%s,set:interface-%s-%s" % (device, device, idx)
+ line = "dhcp-range=interface:%s,set:interface-%s-%s,%s,static" % (device, device, idx, ip)
self.conf.search(sline, line)
gn = CsGuestNetwork(device, self.config)
- sline = "dhcp-option=tag:interface-%s,15" % device
- line = "dhcp-option=tag:interface-%s,15,%s" % (device, gn.get_domain())
+ sline = "dhcp-option=tag:interface-%s-%s,15" % (device, idx)
+ line = "dhcp-option=tag:interface-%s-%s,15,%s" % (device, idx, gn.get_domain())
self.conf.search(sline, line)
# DNS search order
if gn.get_dns() and device:
- sline = "dhcp-option=tag:interface-%s,6" % device
+ sline = "dhcp-option=tag:interface-%s-%s,6" % (device, idx)
dns_list = [x for x in gn.get_dns() if x is not None]
- line = "dhcp-option=tag:interface-%s,6,%s" % (device, ','.join(dns_list))
+ line = "dhcp-option=tag:interface-%s-%s,6,%s" % (device, idx, ','.join(dns_list))
self.conf.search(sline, line)
# Gateway
gateway = ''
@@ -83,8 +85,8 @@ class CsDhcp(CsDataBag):
gateway = gn.get_gateway()
else:
gateway = i['gateway']
- sline = "dhcp-option=tag:interface-%s,3," % device
- line = "dhcp-option=tag:interface-%s,3,%s" % (device, gateway)
+ sline = "dhcp-option=tag:interface-%s-%s,3," % (device, idx)
+ line = "dhcp-option=tag:interface-%s-%s,3,%s" % (device, idx, gateway)
self.conf.search(sline, line)
# Netmask
netmask = ''
@@ -92,9 +94,10 @@ class CsDhcp(CsDataBag):
netmask = gn.get_netmask()
else:
netmask = self.config.address().get_guest_netmask()
- sline = "dhcp-option=tag:interface-%s,1," % device
- line = "dhcp-option=tag:interface-%s,1,%s" % (device, netmask)
+ sline = "dhcp-option=tag:interface-%s-%s,1," % (device, idx)
+ line = "dhcp-option=tag:interface-%s-%s,1,%s" % (device, idx, netmask)
self.conf.search(sline, line)
+ idx += 1
def delete_leases(self):
try:
@@ -104,7 +107,7 @@ class CsDhcp(CsDataBag):
def preseed(self):
self.add_host("127.0.0.1", "localhost")
- self.add_host("::1", "localhost ip6-localhost ip6-loopback")
+ self.add_host("::1", "localhost ip6-localhost ip6-loopback")
self.add_host("ff02::1", "ip6-allnodes")
self.add_host("ff02::2", "ip6-allrouters")
if self.config.is_vpc():
@@ -125,9 +128,15 @@ class CsDhcp(CsDataBag):
def add(self, entry):
self.add_host(entry['ipv4_adress'], entry['host_name'])
- self.cloud.add("%s,%s,%s,infinite" % (entry['mac_address'],
- entry['ipv4_adress'],
- entry['host_name']))
+
+ # lease time boils down to once a month
+ # with a splay of 60 hours to prevent storms
+ lease = randint(700, 760)
+ self.cloud.add("%s,%s,%s,%sh" % (entry['mac_address'],
+ entry['ipv4_adress'],
+ entry['host_name'],
+ lease
+ ))
i = IPAddress(entry['ipv4_adress'])
# Calculate the device
for v in self.devinfo:
[15/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
Merge pull request #1547 from PCextreme/vrouter-fixes
Fixes for VirtualRouters in Basic Networking, especially with mutliple ranges in VLANsDuring the last few modifications on the SystemVM scripts, it turns out quite a lot of stuff broke in our setups.
This PR fixes a number of things:
* Multiple IP's per VLAN interface are now supported & working again, including DNS, DHCP ranges, password and metadata services
* `useextdns` fixed (I had a small merge conflict with an attempt to fix this at 4.7, but these fixes are more comprehensive)
* CLOUDSTACK-8303
* Apache configs better in line with best-practices and distro-expected locations
* Added a few more helper functions & getters & setters for utility
* some minor cleanup & fixes
* pr/1547:
Remove /etc/apache2/sites-enabled/000-default in cloud-early-config
SysVM various fixes to previous refactorings * make CORS include a regular glob-matched one * fix NameVirtualHost in CsApp.py as well * even moar cleanups
SysVM: Cleanup and removal of old (and dangerous) config files * ports.conf * default & default-ssl sites * SSL config in httpd.conf * deprecated & dead setup_redundant_router in cloud-early-config
SysVM cloud-early-config: Intermediate fix for SecStore & CORS * Take setup from vhost.template rather than default(-ssl) * should move into Python CS code as well * Move CORS setup to separate conf * Modify vhost template to Optionally include the cors file * Add NameVirtualHost to vhost template for feature parity with ports.conf * Take setup from vhost.template rather than default(-ssl)
VR cloud-early-config: Commonize Apache2 common setup
VR cloud-early-config: Fix Apache2 alias cleanup
VR: consistent SSL setup, vhost is not an example, but a template
VR CsConfig: reintroduce old get_dns() behaviour for redundant non-VPC's
VR CsAddress fixes: * cleanup imports, * fix to_str(), * improve & fix service post_config logic * don't arpPing when there's no gateway
VR CsApp: Expose config to classes, move vhost confs to proper location, allow for multiple IP's per intf, sanitize servername, don't open port 53 if no DNS is foreseen
VR CsConfig: Add is_router(), is_dns(), has_dns(), has_metadata(), use_extdns(), fix get_dns() with use_extdns()
VR CsDhcp: allow multiple ranges & finite lease time (fixes CLOUDSTACK-8303)
VR CsGuestNetwork obey useextdns
VR merge.py ipalias fix & dhcpconfig stub notification
Signed-off-by: Will Stevens <wi...@gmail.com>
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/e4ba640a
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/e4ba640a
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/e4ba640a
Branch: refs/heads/master
Commit: e4ba640a2870f0ed7cd092a1760b2d78e63c6258
Parents: f7f23ec 67eb6ca
Author: Will Stevens <wi...@gmail.com>
Authored: Tue Jun 28 11:28:06 2016 -0400
Committer: Will Stevens <wi...@gmail.com>
Committed: Tue Jun 28 11:28:07 2016 -0400
----------------------------------------------------------------------
LICENSE | 5 +-
pom.xml | 5 +-
.../debian/config/etc/apache2/httpd.conf | 4 +-
.../debian/config/etc/apache2/ports.conf | 23 --
.../config/etc/apache2/sites-available/default | 41 ----
.../etc/apache2/sites-available/default-ssl | 175 -------------
.../debian/config/etc/apache2/vhost.template | 245 +++++++++++++++++++
.../debian/config/etc/apache2/vhostexample.conf | 239 ------------------
.../debian/config/etc/init.d/cloud-early-config | 162 ++++--------
.../debian/config/opt/cloud/bin/cs/CsAddress.py | 35 +--
.../debian/config/opt/cloud/bin/cs/CsApp.py | 40 +--
.../debian/config/opt/cloud/bin/cs/CsConfig.py | 29 ++-
.../debian/config/opt/cloud/bin/cs/CsDhcp.py | 39 +--
.../config/opt/cloud/bin/cs/CsGuestNetwork.py | 16 +-
.../debian/config/opt/cloud/bin/merge.py | 31 +++
tools/whisker/LICENSE | 5 +-
tools/whisker/descriptor-for-packaging.xml | 5 +-
tools/whisker/descriptor.xml | 5 +-
18 files changed, 429 insertions(+), 675 deletions(-)
----------------------------------------------------------------------
[07/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
VR cloud-early-config: Fix Apache2 alias cleanup
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/7e290979
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/7e290979
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/7e290979
Branch: refs/heads/master
Commit: 7e290979a9491ae8536740ac317441a2cf38a852
Parents: e32cd13
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Mon May 30 17:18:33 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:10 2016 +0200
----------------------------------------------------------------------
systemvm/patches/debian/config/etc/init.d/cloud-early-config | 8 ++++++++
1 file changed, 8 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/7e290979/systemvm/patches/debian/config/etc/init.d/cloud-early-config
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/init.d/cloud-early-config b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
index 5d45661..eeb5275 100755
--- a/systemvm/patches/debian/config/etc/init.d/cloud-early-config
+++ b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
@@ -818,9 +818,17 @@ setup_vpc_apache2() {
clean_ipalias_config() {
+# Old
rm -f /etc/apache2/conf.d/ports.*.meta-data.conf
rm -f /etc/apache2/sites-available/ipAlias*
rm -f /etc/apache2/sites-enabled/ipAlias*
+
+# New
+rm -f /etc/apache2/sites-enabled/vhost-*.conf
+rm -f /etc/apache2/ports.conf
+rm -f /etc/apache2/sites-available/default
+rm -f /etc/apache2/sites-available/default-ssl
+
rm -rf /etc/failure_config
}
[09/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
SysVM: Cleanup and removal of old (and dangerous) config files
* ports.conf
* default & default-ssl sites
* SSL config in httpd.conf
* deprecated & dead setup_redundant_router in cloud-early-config
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/58bdb441
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/58bdb441
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/58bdb441
Branch: refs/heads/master
Commit: 58bdb44135655de0684631d71702e57ed4c21d85
Parents: 72e8308
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Mon May 30 19:20:09 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:10 2016 +0200
----------------------------------------------------------------------
LICENSE | 3 -
pom.xml | 3 -
.../debian/config/etc/apache2/httpd.conf | 4 +-
.../debian/config/etc/apache2/ports.conf | 23 ---
.../config/etc/apache2/sites-available/default | 41 -----
.../etc/apache2/sites-available/default-ssl | 175 -------------------
.../debian/config/etc/init.d/cloud-early-config | 95 ++--------
tools/whisker/LICENSE | 3 -
tools/whisker/descriptor-for-packaging.xml | 3 -
tools/whisker/descriptor.xml | 3 -
10 files changed, 15 insertions(+), 338 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/58bdb441/LICENSE
----------------------------------------------------------------------
diff --git a/LICENSE b/LICENSE
index 6c2462d..982b158 100644
--- a/LICENSE
+++ b/LICENSE
@@ -221,9 +221,6 @@ Within the patches/systemvm/debian/config/etc/apache2 directory
Copyright (c) 2012 The Apache Software Foundation
from The Apache Software Foundation http://www.apache.org/
httpd.conf
- ports.conf
- sites-available/default
- sites-available/default-ssl
vhost.template
Within the patches/systemvm/debian/config/etc/ssh/ directory
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/58bdb441/pom.xml
----------------------------------------------------------------------
diff --git a/pom.xml b/pom.xml
index b244f17..ecce49b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -892,9 +892,6 @@
<exclude>systemvm/patches/debian/systemvm.vmx</exclude>
<exclude>systemvm/patches/debian/config/root/.ssh/authorized_keys</exclude>
<exclude>systemvm/patches/debian/config/etc/apache2/httpd.conf</exclude>
- <exclude>systemvm/patches/debian/config/etc/apache2/ports.conf</exclude>
- <exclude>systemvm/patches/debian/config/etc/apache2/sites-available/default</exclude>
- <exclude>systemvm/patches/debian/config/etc/apache2/sites-available/default-ssl</exclude>
<exclude>systemvm/patches/debian/config/etc/apache2/vhost.template</exclude>
<exclude>systemvm/patches/debian/config/etc/dnsmasq.conf.tmpl</exclude>
<exclude>systemvm/patches/debian/config/etc/vpcdnsmasq.conf</exclude>
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/58bdb441/systemvm/patches/debian/config/etc/apache2/httpd.conf
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/apache2/httpd.conf b/systemvm/patches/debian/config/etc/apache2/httpd.conf
index 56366f2..b7db254 100644
--- a/systemvm/patches/debian/config/etc/apache2/httpd.conf
+++ b/systemvm/patches/debian/config/etc/apache2/httpd.conf
@@ -1,3 +1 @@
-SSLProtocol all -SSLv2 -SSLv3
-SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
-SSLHonorCipherOrder on
+# Empty
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/58bdb441/systemvm/patches/debian/config/etc/apache2/ports.conf
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/apache2/ports.conf b/systemvm/patches/debian/config/etc/apache2/ports.conf
deleted file mode 100644
index 369cb29..0000000
--- a/systemvm/patches/debian/config/etc/apache2/ports.conf
+++ /dev/null
@@ -1,23 +0,0 @@
-# If you just change the port or add more ports here, you will likely also
-# have to change the VirtualHost statement in
-# /etc/apache2/sites-enabled/000-default
-# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
-# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
-# README.Debian.gz
-
-NameVirtualHost 10.1.1.1:80
-Listen 10.1.1.1:80
-
-<IfModule mod_ssl.c>
- # If you add NameVirtualHost *:443 here, you will also have to change
- # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
- # to <VirtualHost *:443>
- # Server Name Indication for SSL named virtual hosts is currently not
- # supported by MSIE on Windows XP.
- Listen 10.1.1.1:443
-</IfModule>
-
-<IfModule mod_gnutls.c>
- Listen 10.1.1.1:443
-</IfModule>
-
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/58bdb441/systemvm/patches/debian/config/etc/apache2/sites-available/default
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/apache2/sites-available/default b/systemvm/patches/debian/config/etc/apache2/sites-available/default
deleted file mode 100644
index ae009b7..0000000
--- a/systemvm/patches/debian/config/etc/apache2/sites-available/default
+++ /dev/null
@@ -1,41 +0,0 @@
-<VirtualHost 10.1.1.1:80>
- ServerAdmin webmaster@localhost
-
- DocumentRoot /var/www/html
- <Directory />
- Options FollowSymLinks
- AllowOverride None
- </Directory>
- <Directory /var/www/html>
- Options Indexes FollowSymLinks MultiViews
- AllowOverride All
- Order allow,deny
- allow from all
- </Directory>
-
- ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
- <Directory "/usr/lib/cgi-bin">
- AllowOverride None
- Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
- Order allow,deny
- Allow from all
- </Directory>
-
- ErrorLog ${APACHE_LOG_DIR}/error.log
-
- # Possible values include: debug, info, notice, warn, error, crit,
- # alert, emerg.
- LogLevel warn
-
- CustomLog ${APACHE_LOG_DIR}/access.log combined
-
- Alias /doc/ "/usr/share/doc/"
- <Directory "/usr/share/doc/">
- Options Indexes MultiViews FollowSymLinks
- AllowOverride None
- Order deny,allow
- Deny from all
- Allow from 127.0.0.0/255.0.0.0 ::1/128
- </Directory>
-
-</VirtualHost>
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/58bdb441/systemvm/patches/debian/config/etc/apache2/sites-available/default-ssl
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/apache2/sites-available/default-ssl b/systemvm/patches/debian/config/etc/apache2/sites-available/default-ssl
deleted file mode 100644
index a2c21d7..0000000
--- a/systemvm/patches/debian/config/etc/apache2/sites-available/default-ssl
+++ /dev/null
@@ -1,175 +0,0 @@
-<IfModule mod_ssl.c>
-<VirtualHost 10.1.1.1:443>
- ServerAdmin webmaster@localhost
-
- DocumentRoot /var/www/html
- <Directory />
- Options FollowSymLinks
- AllowOverride None
- </Directory>
- <Directory /var/www/html>
- Options Indexes FollowSymLinks MultiViews
- AllowOverride all
- Order allow,deny
- allow from all
- </Directory>
-
- ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
- <Directory "/usr/lib/cgi-bin">
- AllowOverride None
- Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
- Order allow,deny
- Allow from all
- </Directory>
-
- ErrorLog ${APACHE_LOG_DIR}/error.log
-
- # Possible values include: debug, info, notice, warn, error, crit,
- # alert, emerg.
- LogLevel warn
-
- CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
-
- Alias /doc/ "/usr/share/doc/"
- <Directory "/usr/share/doc/">
- Options Indexes MultiViews FollowSymLinks
- AllowOverride None
- Order deny,allow
- Deny from all
- Allow from 127.0.0.0/255.0.0.0 ::1/128
- </Directory>
-
- # SSL Engine Switch:
- # Enable/Disable SSL for this virtual host.
- SSLEngine on
- SSLProtocol all -SSLv2 -SSLv3
- SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
- SSLHonorCipherOrder on
-
- # A self-signed (snakeoil) certificate can be created by installing
- # the ssl-cert package. See
- # /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
- # If both key and certificate are stored in the same file, only the
- # SSLCertificateFile directive is needed.
- SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
- SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
-
- # Server Certificate Chain:
- # Point SSLCertificateChainFile at a file containing the
- # concatenation of PEM encoded CA certificates which form the
- # certificate chain for the server certificate. Alternatively
- # the referenced file can be the same as SSLCertificateFile
- # when the CA certificates are directly appended to the server
- # certificate for convinience.
- #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
-
- # Certificate Authority (CA):
- # Set the CA certificate verification path where to find CA
- # certificates for client authentication or alternatively one
- # huge file containing all of them (file must be PEM encoded)
- # Note: Inside SSLCACertificatePath you need hash symlinks
- # to point to the certificate files. Use the provided
- # Makefile to update the hash symlinks after changes.
- #SSLCACertificatePath /etc/ssl/certs/
- #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
-
- # Certificate Revocation Lists (CRL):
- # Set the CA revocation path where to find CA CRLs for client
- # authentication or alternatively one huge file containing all
- # of them (file must be PEM encoded)
- # Note: Inside SSLCARevocationPath you need hash symlinks
- # to point to the certificate files. Use the provided
- # Makefile to update the hash symlinks after changes.
- #SSLCARevocationPath /etc/apache2/ssl.crl/
- #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
-
- # Client Authentication (Type):
- # Client certificate verification type and depth. Types are
- # none, optional, require and optional_no_ca. Depth is a
- # number which specifies how deeply to verify the certificate
- # issuer chain before deciding the certificate is not valid.
- #SSLVerifyClient require
- #SSLVerifyDepth 10
-
- # Access Control:
- # With SSLRequire you can do per-directory access control based
- # on arbitrary complex boolean expressions containing server
- # variable checks and other lookup directives. The syntax is a
- # mixture between C and Perl. See the mod_ssl documentation
- # for more details.
- #<Location />
- #SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
- # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
- # and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
- # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
- # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
- # or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
- #</Location>
-
- # SSL Engine Options:
- # Set various options for the SSL engine.
- # o FakeBasicAuth:
- # Translate the client X.509 into a Basic Authorisation. This means that
- # the standard Auth/DBMAuth methods can be used for access control. The
- # user name is the `one line' version of the client's X.509 certificate.
- # Note that no password is obtained from the user. Every entry in the user
- # file needs this password: `xxj31ZMTZzkVA'.
- # o ExportCertData:
- # This exports two additional environment variables: SSL_CLIENT_CERT and
- # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
- # server (always existing) and the client (only existing when client
- # authentication is used). This can be used to import the certificates
- # into CGI scripts.
- # o StdEnvVars:
- # This exports the standard SSL/TLS related `SSL_*' environment variables.
- # Per default this exportation is switched off for performance reasons,
- # because the extraction step is an expensive operation and is usually
- # useless for serving static content. So one usually enables the
- # exportation for CGI and SSI requests only.
- # o StrictRequire:
- # This denies access when "SSLRequireSSL" or "SSLRequire" applied even
- # under a "Satisfy any" situation, i.e. when it applies access is denied
- # and no other module can change it.
- # o OptRenegotiate:
- # This enables optimized SSL connection renegotiation handling when SSL
- # directives are used in per-directory context.
- #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
- <FilesMatch "\.(cgi|shtml|phtml|php)$">
- SSLOptions +StdEnvVars
- </FilesMatch>
- <Directory /usr/lib/cgi-bin>
- SSLOptions +StdEnvVars
- </Directory>
-
- # SSL Protocol Adjustments:
- # The safe and default but still SSL/TLS standard compliant shutdown
- # approach is that mod_ssl sends the close notify alert but doesn't wait for
- # the close notify alert from client. When you need a different shutdown
- # approach you can use one of the following variables:
- # o ssl-unclean-shutdown:
- # This forces an unclean shutdown when the connection is closed, i.e. no
- # SSL close notify alert is send or allowed to received. This violates
- # the SSL/TLS standard but is needed for some brain-dead browsers. Use
- # this when you receive I/O errors because of the standard approach where
- # mod_ssl sends the close notify alert.
- # o ssl-accurate-shutdown:
- # This forces an accurate shutdown when the connection is closed, i.e. a
- # SSL close notify alert is send and mod_ssl waits for the close notify
- # alert of the client. This is 100% SSL/TLS standard compliant, but in
- # practice often causes hanging connections with brain-dead browsers. Use
- # this only for browsers where you know that their SSL implementation
- # works correctly.
- # Notice: Most problems of broken clients are also related to the HTTP
- # keep-alive facility, so you usually additionally want to disable
- # keep-alive for those clients, too. Use variable "nokeepalive" for this.
- # Similarly, one has to force some clients to use HTTP/1.0 to workaround
- # their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
- # "force-response-1.0" for this.
- BrowserMatch "MSIE [2-6]" \
- nokeepalive ssl-unclean-shutdown \
- downgrade-1.0 force-response-1.0
- # MSIE 7 and newer should be able to use keepalive
- BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
-
-</VirtualHost>
-</IfModule>
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/58bdb441/systemvm/patches/debian/config/etc/init.d/cloud-early-config
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/init.d/cloud-early-config b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
index 8ced0f9..2103065 100755
--- a/systemvm/patches/debian/config/etc/init.d/cloud-early-config
+++ b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
@@ -808,22 +808,23 @@ setup_vpc_apache2() {
clean_ipalias_config() {
-# Old
-rm -f /etc/apache2/conf.d/ports.*.meta-data.conf
-rm -f /etc/apache2/sites-available/ipAlias*
-rm -f /etc/apache2/sites-enabled/ipAlias*
-rm -f /etc/apache2/conf.d/vhost*.conf
-
-# New
-rm -f /etc/apache2/sites-enabled/vhost-*.conf
-rm -f /etc/apache2/ports.conf
-rm -f /etc/apache2/sites-available/default
-rm -f /etc/apache2/sites-available/default-ssl
-
-rm -rf /etc/failure_config
+ # Old
+ rm -f /etc/apache2/conf.d/ports.*.meta-data.conf
+ rm -f /etc/apache2/sites-available/ipAlias*
+ rm -f /etc/apache2/sites-enabled/ipAlias*
+ rm -f /etc/apache2/conf.d/vhost*.conf
+ rm -f /etc/apache2/ports.conf
+ rm -f /etc/apache2/sites-available/default
+ rm -f /etc/apache2/sites-available/default-ssl
+
+ # New
+ rm -f /etc/apache2/sites-enabled/vhost-*.conf
+
+ rm -rf /etc/failure_config
}
setup_apache2_common() {
+ sed -i 's/^Include ports.conf.*/# CS: Done by Python CsApp config\n#Include ports.conf/g' /etc/apache2/apache2.conf
[ -f /etc/apache2/conf.d/security ] && sed -i -e "s/^ServerTokens .*/ServerTokens Prod/g" /etc/apache2/conf.d/security
[ -f /etc/apache2/conf.d/security ] && sed -i -e "s/^ServerSignature .*/ServerSignature Off/g" /etc/apache2/conf.d/security
@@ -847,74 +848,6 @@ setup_apache2() {
# [ -f /etc/apache2/ports.conf ] && sed -i -e "s/NameVirtualHost .*:80/NameVirtualHost $ip:80/g" /etc/apache2/ports.conf
}
-setup_redundant_router() {
- rrouter_bin_path="/ramdisk/rrouter"
- rrouter_log="/ramdisk/rrouter/keepalived.log"
- rrouter_bin_path_str="\/ramdisk\/rrouter"
- rrouter_log_str="\/ramdisk\/rrouter\/keepalived.log"
- mkdir -p /ramdisk
- mount tmpfs /ramdisk -t tmpfs
- mkdir -p /ramdisk/rrouter
- ip route delete default
- cp /root/redundant_router/keepalived.conf.templ /etc/keepalived/keepalived.conf
- cp /root/redundant_router/conntrackd.conf.templ /etc/conntrackd/conntrackd.conf
- cp /root/redundant_router/enable_pubip.sh.templ $rrouter_bin_path/enable_pubip.sh
- cp /root/redundant_router/master.sh.templ $rrouter_bin_path/master.sh
- cp /root/redundant_router/backup.sh.templ $rrouter_bin_path/backup.sh
- cp /root/redundant_router/fault.sh.templ $rrouter_bin_path/fault.sh
- cp /root/redundant_router/primary-backup.sh.templ $rrouter_bin_path/primary-backup.sh
- cp /root/redundant_router/heartbeat.sh.templ $rrouter_bin_path/heartbeat.sh
- cp /root/redundant_router/check_heartbeat.sh.templ $rrouter_bin_path/check_heartbeat.sh
- cp /root/redundant_router/arping_gateways.sh.templ $rrouter_bin_path/arping_gateways.sh
- cp /root/redundant_router/check_bumpup.sh $rrouter_bin_path/
- cp /root/redundant_router/disable_pubip.sh $rrouter_bin_path/
- cp /root/redundant_router/checkrouter.sh.templ /opt/cloud/bin/checkrouter.sh
- cp /root/redundant_router/services.sh $rrouter_bin_path/
- sed -i "s/\[ROUTER_ID\]/$NAME/g" /etc/keepalived/keepalived.conf
- sed -i "s/\[ROUTER_IP\]/$GUEST_GW\/$GUEST_CIDR_SIZE/g" /etc/keepalived/keepalived.conf
- sed -i "s/\[BOARDCAST\]/$GUEST_BRD/g" /etc/keepalived/keepalived.conf
- sed -i "s/\[PRIORITY\]/$ROUTER_PR/g" /etc/keepalived/keepalived.conf
- sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" /etc/keepalived/keepalived.conf
- sed -i "s/\[DELTA\]/2/g" /etc/keepalived/keepalived.conf
- sed -i "s/\[LINK_IF\]/eth0/g" /etc/conntrackd/conntrackd.conf
- sed -i "s/\[LINK_IP\]/$ETH0_IP/g" /etc/conntrackd/conntrackd.conf
- sed -i "s/\[IGNORE_IP1\]/$GUEST_GW/g" /etc/conntrackd/conntrackd.conf
- sed -i "s/\[IGNORE_IP2\]/$ETH0_IP/g" /etc/conntrackd/conntrackd.conf
- sed -i "s/\[IGNORE_IP3\]/$ETH1_IP/g" /etc/conntrackd/conntrackd.conf
- sed -i "s/\[ETH2IP\]/$ETH2_IP/g" $rrouter_bin_path/enable_pubip.sh
- sed -i "s/\[ETH2MASK\]/$ETH2_MASK/g" $rrouter_bin_path/enable_pubip.sh
- sed -i "s/\[GATEWAY\]/$GW/g" $rrouter_bin_path/enable_pubip.sh
- sed -i "s/\[GATEWAY\]/$GW/g" $rrouter_bin_path/master.sh
-
- sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" $rrouter_bin_path/master.sh
- sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" $rrouter_bin_path/backup.sh
- sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" $rrouter_bin_path/fault.sh
- sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" $rrouter_bin_path/heartbeat.sh
- sed -i "s/\[RROUTER_BIN_PATH\]/$rrouter_bin_path_str/g" $rrouter_bin_path/check_heartbeat.sh
- sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/master.sh
- sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/backup.sh
- sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/fault.sh
- sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/primary-backup.sh
- sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/check_heartbeat.sh
- sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" $rrouter_bin_path/arping_gateways.sh
- sed -i "s/\[RROUTER_LOG\]/$rrouter_log_str/g" /opt/cloud/bin/checkrouter.sh
-
- if [ $ADVERT_INT ]
- then
- sed -i "s/advert_int 1/advert_int $ADVERT_INT/g" /etc/keepalived/keepalived.conf
- fi
-
- chmod a+x $rrouter_bin_path/*.sh
-
- sed -i "s/--exec\ \$DAEMON;/--exec\ \$DAEMON\ --\ --vrrp;/g" /etc/init.d/keepalived
- crontab -l|grep "check_heartbeat.sh"
- if [ $? -ne 0 ]
- then
- (crontab -l; echo -e "SHELL=/bin/bash\nPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n*/1 * * * * $rrouter_bin_path/check_heartbeat.sh 2>&1 > /dev/null") | crontab
- fi
- load_modules
-}
-
setup_aesni() {
if [ `grep aes /proc/cpuinfo | wc -l` -gt 0 ]
then
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/58bdb441/tools/whisker/LICENSE
----------------------------------------------------------------------
diff --git a/tools/whisker/LICENSE b/tools/whisker/LICENSE
index 6bc400e..d14a974 100644
--- a/tools/whisker/LICENSE
+++ b/tools/whisker/LICENSE
@@ -2771,9 +2771,6 @@ Within the patches/systemvm/debian/config/etc/apache2 directory
Copyright (c) 2012 The Apache Software Foundation
from The Apache Software Foundation http://www.apache.org/
httpd.conf
- ports.conf
- sites-available/default
- sites-available/default-ssl
vhost.template
Within the patches/systemvm/debian/config/etc/ssh/ directory
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/58bdb441/tools/whisker/descriptor-for-packaging.xml
----------------------------------------------------------------------
diff --git a/tools/whisker/descriptor-for-packaging.xml b/tools/whisker/descriptor-for-packaging.xml
index e76e5e2..579e9d7 100644
--- a/tools/whisker/descriptor-for-packaging.xml
+++ b/tools/whisker/descriptor-for-packaging.xml
@@ -2459,10 +2459,7 @@ Copyright (c) 2012 The Apache Software Foundation
</copyright-notice>
<by-organisation id='apache.org.2'>
<resource name='httpd.conf' />
- <resource name='ports.conf' />
<resource name='vhost.template' />
- <resource name='sites-available/default' />
- <resource name='sites-available/default-ssl' />
</by-organisation>
</with-license>
</within>
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/58bdb441/tools/whisker/descriptor.xml
----------------------------------------------------------------------
diff --git a/tools/whisker/descriptor.xml b/tools/whisker/descriptor.xml
index 6996efe..0b6ded5 100644
--- a/tools/whisker/descriptor.xml
+++ b/tools/whisker/descriptor.xml
@@ -2443,10 +2443,7 @@ Copyright (c) 2012 The Apache Software Foundation
</copyright-notice>
<by-organisation id='apache.org.2'>
<resource name='httpd.conf' />
- <resource name='ports.conf' />
<resource name='vhost.template' />
- <resource name='sites-available/default' />
- <resource name='sites-available/default-ssl' />
</by-organisation>
</with-license>
</within>
[08/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
VR cloud-early-config: Commonize Apache2 common setup
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/f49a4d94
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/f49a4d94
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/f49a4d94
Branch: refs/heads/master
Commit: f49a4d944a3f6950a60c103f3f840063558464b8
Parents: 7e29097
Author: Ronald van Zantvoort <ro...@pcextreme.nl>
Authored: Mon May 30 17:29:41 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:10 2016 +0200
----------------------------------------------------------------------
.../debian/config/etc/init.d/cloud-early-config | 41 +++++++++-----------
1 file changed, 19 insertions(+), 22 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/f49a4d94/systemvm/patches/debian/config/etc/init.d/cloud-early-config
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/init.d/cloud-early-config b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
index eeb5275..baec1d8 100755
--- a/systemvm/patches/debian/config/etc/init.d/cloud-early-config
+++ b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
@@ -342,6 +342,7 @@ cat << "EOF" > /usr/local/cloud/systemvm/conf/temp.xml
EOF
mv /usr/local/cloud/systemvm/conf/temp.xml /usr/local/cloud/systemvm/conf/log4j-cloud.xml
}
+
setup_interface() {
local intfnum=$1
local ip=$2
@@ -801,19 +802,8 @@ setup_sshd(){
setup_vpc_apache2() {
log_it "Setting up apache web server for VPC"
chkconfig apache2 off
- rm -f /etc/apache2/conf.d/vhost*.conf
- [ -f /etc/apache2/sites-available/default ] && echo "" >/etc/apache2/sites-available/default
- [ -f /etc/apache2/sites-available/default-ssl ] && echo "">/etc/apache2/sites-available/default-ssl
- [ -f /etc/apache2/ports.conf ] && echo "">/etc/apache2/ports.conf
- [ -f /etc/apache2/ports.conf ] && echo "">/etc/apache2/ports.conf
- [ -f /etc/apache2/ports.conf ] && echo "">/etc/apache2/ports.conf
- [ -f /etc/apache2/conf.d/security ] && sed -i -e "s/^ServerTokens .*/ServerTokens Prod/g" /etc/apache2/conf.d/security
- [ -f /etc/apache2/conf.d/security ] && sed -i -e "s/^ServerSignature .*/ServerSignature Off/g" /etc/apache2/conf.d/security
-
- # Disable listing of http://SSVM-IP/icons folder for security issue. see article http://www.i-lateral.com/tutorials/disabling-the-icons-folder-on-an-ubuntu-web-server/
- [ -f /etc/apache2/mods-available/alias.conf ] && sed -i s/"Options Indexes MultiViews"/"Options -Indexes MultiViews"/ /etc/apache2/mods-available/alias.conf
-
- echo "Options -Indexes" > /var/www/html/.htaccess
+ clean_ipalias_config
+ setup_apache2_common
}
@@ -822,6 +812,7 @@ clean_ipalias_config() {
rm -f /etc/apache2/conf.d/ports.*.meta-data.conf
rm -f /etc/apache2/sites-available/ipAlias*
rm -f /etc/apache2/sites-enabled/ipAlias*
+rm -f /etc/apache2/conf.d/vhost*.conf
# New
rm -f /etc/apache2/sites-enabled/vhost-*.conf
@@ -832,15 +823,7 @@ rm -f /etc/apache2/sites-available/default-ssl
rm -rf /etc/failure_config
}
-setup_apache2() {
- clean_ipalias_config
- log_it "Setting up apache web server"
- local ip=$1
- [ -f /etc/apache2/sites-available/default ] && sed -i -e "s/<VirtualHost.*>/<VirtualHost $ip:80>/" /etc/apache2/sites-available/default
- [ -f /etc/apache2/sites-available/default-ssl ] && sed -i -e "s/<VirtualHost.*>/<VirtualHost $ip:443>/" /etc/apache2/sites-available/default-ssl
- [ -f /etc/apache2/ports.conf ] && sed -i -e "s/Listen .*:80/Listen $ip:80/g" /etc/apache2/ports.conf
- [ -f /etc/apache2/ports.conf ] && sed -i -e "s/Listen .*:443/Listen $ip:443/g" /etc/apache2/ports.conf
- [ -f /etc/apache2/ports.conf ] && sed -i -e "s/NameVirtualHost .*:80/NameVirtualHost $ip:80/g" /etc/apache2/ports.conf
+setup_apache2_common() {
[ -f /etc/apache2/conf.d/security ] && sed -i -e "s/^ServerTokens .*/ServerTokens Prod/g" /etc/apache2/conf.d/security
[ -f /etc/apache2/conf.d/security ] && sed -i -e "s/^ServerSignature .*/ServerSignature Off/g" /etc/apache2/conf.d/security
@@ -850,6 +833,20 @@ setup_apache2() {
echo "Options -Indexes" > /var/www/html/.htaccess
}
+setup_apache2() {
+ log_it "Setting up apache web server"
+ clean_ipalias_config
+ setup_apache2_common
+ local ip=$1
+
+ # Deprecated, functionality moved to Cs Python code
+ # [ -f /etc/apache2/sites-available/default ] && sed -i -e "s/<VirtualHost.*>/<VirtualHost $ip:80>/" /etc/apache2/sites-available/default
+ # [ -f /etc/apache2/sites-available/default-ssl ] && sed -i -e "s/<VirtualHost.*>/<VirtualHost $ip:443>/" /etc/apache2/sites-available/default-ssl
+ # [ -f /etc/apache2/ports.conf ] && sed -i -e "s/Listen .*:80/Listen $ip:80/g" /etc/apache2/ports.conf
+ # [ -f /etc/apache2/ports.conf ] && sed -i -e "s/Listen .*:443/Listen $ip:443/g" /etc/apache2/ports.conf
+ # [ -f /etc/apache2/ports.conf ] && sed -i -e "s/NameVirtualHost .*:80/NameVirtualHost $ip:80/g" /etc/apache2/ports.conf
+}
+
setup_redundant_router() {
rrouter_bin_path="/ramdisk/rrouter"
rrouter_log="/ramdisk/rrouter/keepalived.log"
[14/15] git commit: updated refs/heads/master to e4ba640
Posted by sw...@apache.org.
Remove /etc/apache2/sites-enabled/000-default in cloud-early-config
Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo
Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/67eb6caa
Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/67eb6caa
Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/67eb6caa
Branch: refs/heads/master
Commit: 67eb6caa37dd1f6548adf588a842aacb0bbeafb8
Parents: 91a8faa
Author: Wido den Hollander <wi...@widodh.nl>
Authored: Thu Jun 2 16:07:52 2016 +0200
Committer: Wido den Hollander <wi...@widodh.nl>
Committed: Tue Jun 7 13:03:18 2016 +0200
----------------------------------------------------------------------
systemvm/patches/debian/config/etc/init.d/cloud-early-config | 1 +
1 file changed, 1 insertion(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cloudstack/blob/67eb6caa/systemvm/patches/debian/config/etc/init.d/cloud-early-config
----------------------------------------------------------------------
diff --git a/systemvm/patches/debian/config/etc/init.d/cloud-early-config b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
index bc26766..cd42bb0 100755
--- a/systemvm/patches/debian/config/etc/init.d/cloud-early-config
+++ b/systemvm/patches/debian/config/etc/init.d/cloud-early-config
@@ -822,6 +822,7 @@ clean_ipalias_config() {
# New
rm -f /etc/apache2/sites-enabled/vhost-*.conf
+ rm -f /etc/apache2/sites-enabled/000-default
rm -rf /etc/failure_config
}