Merge "Remove some firewall rules"
This commit is contained in:
Zuul
Gerrit Code Review
commit
9be020c63e
@ -78,16 +78,6 @@ itemNotFound (404)
|
|||||||
::
|
::
|
||||||
|
|
||||||
{
|
{
|
||||||
"firewallrules": [
|
|
||||||
{
|
|
||||||
"href": "http://10.10.10.2:6385/v1/firewallrules/",
|
|
||||||
"rel": "self"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"href": "http://10.10.10.2:6385/firewallrules/",
|
|
||||||
"rel": "bookmark"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"addresses": [
|
"addresses": [
|
||||||
{
|
{
|
||||||
"href": "http://10.10.10.2:6385/v1/addresses/",
|
"href": "http://10.10.10.2:6385/v1/addresses/",
|
||||||
@ -10751,87 +10741,3 @@ itemNotFound (404)
|
|||||||
}
|
}
|
||||||
|
|
||||||
This operation does not accept a request body.
|
This operation does not accept a request body.
|
||||||
|
|
||||||
----------------------
|
|
||||||
Custom Firewall Rules
|
|
||||||
----------------------
|
|
||||||
|
|
||||||
These APIs allow for the installation of custom firewall rules.
|
|
||||||
|
|
||||||
*******************************
|
|
||||||
Install custom firewall rules
|
|
||||||
*******************************
|
|
||||||
|
|
||||||
.. rest_method:: POST /v1/firewallrules
|
|
||||||
|
|
||||||
Accepts a file containing the custom OAM firewall rules compatible with
|
|
||||||
the Linux Netfilter framework.
|
|
||||||
|
|
||||||
**Normal response codes**
|
|
||||||
|
|
||||||
200
|
|
||||||
|
|
||||||
**Error response codes**
|
|
||||||
|
|
||||||
computeFault (400, 500, ...), serviceUnavailable (503), badRequest (400),
|
|
||||||
unauthorized (401), forbidden (403), badMethod (405), overLimit (413),
|
|
||||||
badMediaType (415)
|
|
||||||
|
|
||||||
**Request parameters**
|
|
||||||
|
|
||||||
.. csv-table::
|
|
||||||
:header: "Parameter", "Style", "Type", "Description"
|
|
||||||
:widths: 20, 20, 20, 60
|
|
||||||
|
|
||||||
"Content-Type multipart/form-data", "plain", "xsd:string", "The content of a file. e.g. if using curl, this would be specified as: curl -F name=@full_path_of_filename"
|
|
||||||
|
|
||||||
*****************************
|
|
||||||
Shows custom firewall rules
|
|
||||||
*****************************
|
|
||||||
|
|
||||||
.. rest_method:: GET /v1/firewallrules
|
|
||||||
|
|
||||||
**Normal response codes**
|
|
||||||
|
|
||||||
200
|
|
||||||
|
|
||||||
**Error response codes**
|
|
||||||
|
|
||||||
computeFault (400, 500, ...), serviceUnavailable (503), badRequest (400),
|
|
||||||
unauthorized (401), forbidden (403), badMethod (405), overLimit (413),
|
|
||||||
itemNotFound (404)
|
|
||||||
|
|
||||||
**Response parameters**
|
|
||||||
|
|
||||||
.. csv-table::
|
|
||||||
:header: "Parameter", "Style", "Type", "Description"
|
|
||||||
:widths: 20, 20, 20, 60
|
|
||||||
|
|
||||||
"firewall_sig (Optional)", "plain", "xsd:string", "The signature of the custom firewall rules."
|
|
||||||
"uuid (Optional)", "plain", "csapi:UUID", "The universally unique identifier for this object."
|
|
||||||
"links (Optional)", "plain", "xsd:list", "For convenience, resources contain links to themselves. This allows a client to easily obtain rather than construct resource URIs. The following types of link relations are associated with resources: a self link containing a versioned link to the resource, and a bookmark link containing a permanent link to a resource that is appropriate for long term storage."
|
|
||||||
"created_at (Optional)", "plain", "xsd:dateTime", "The time when the object was created."
|
|
||||||
"updated_at (Optional)", "plain", "xsd:dateTime", "The time when the object was last updated."
|
|
||||||
|
|
||||||
::
|
|
||||||
|
|
||||||
{
|
|
||||||
"firewallrules": [
|
|
||||||
{
|
|
||||||
"firewall_sig": "ab9695c4ef143d72317a860c6db7f699",
|
|
||||||
"uuid": "bc276605-7ae2-476a-a8c0-01f097f5177e",
|
|
||||||
"updated_at": "2018-03-02T15:59:14.114812+00:00"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
This operation does not accept a request body.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -376,13 +376,6 @@ def restore_configuration(archive, staging_dir):
|
|||||||
# Restore certificate files
|
# Restore certificate files
|
||||||
restore_etc_ssl_dir(archive)
|
restore_etc_ssl_dir(archive)
|
||||||
|
|
||||||
# Restore firewall rules file if it is in the archive
|
|
||||||
if file_exists_in_archive(archive, 'config/iptables.rules'):
|
|
||||||
restore_config_file(
|
|
||||||
archive, constants.CONFIG_WORKDIR, 'iptables.rules')
|
|
||||||
restore_etc_file(archive, tsconfig.PLATFORM_CONF_PATH,
|
|
||||||
'platform/iptables.rules')
|
|
||||||
|
|
||||||
|
|
||||||
def filter_pxelinux(archive):
|
def filter_pxelinux(archive):
|
||||||
for tarinfo in archive:
|
for tarinfo in archive:
|
||||||
|
|||||||
@ -34,7 +34,6 @@ from tsconfig.tsconfig import SW_VERSION
|
|||||||
from tsconfig.tsconfig import PLATFORM_PATH
|
from tsconfig.tsconfig import PLATFORM_PATH
|
||||||
from tsconfig.tsconfig import KEYRING_PATH
|
from tsconfig.tsconfig import KEYRING_PATH
|
||||||
from tsconfig.tsconfig import PLATFORM_CONF_FILE
|
from tsconfig.tsconfig import PLATFORM_CONF_FILE
|
||||||
from tsconfig.tsconfig import PLATFORM_CONF_PATH
|
|
||||||
from tsconfig.tsconfig import CGCS_PATH
|
from tsconfig.tsconfig import CGCS_PATH
|
||||||
from tsconfig.tsconfig import CONFIG_PATH
|
from tsconfig.tsconfig import CONFIG_PATH
|
||||||
from tsconfig.tsconfig import CONTROLLER_UPGRADE_FLAG
|
from tsconfig.tsconfig import CONTROLLER_UPGRADE_FLAG
|
||||||
@ -1119,14 +1118,6 @@ def extract_data_from_archive(archive, staging_dir, from_release, to_release):
|
|||||||
backup_restore.restore_etc_ssl_dir(archive,
|
backup_restore.restore_etc_ssl_dir(archive,
|
||||||
configpath=tmp_config_path)
|
configpath=tmp_config_path)
|
||||||
|
|
||||||
# Restore firewall rules file if it is in the archive
|
|
||||||
if backup_restore.file_exists_in_archive(
|
|
||||||
archive, 'config/iptables.rules'):
|
|
||||||
extract_relative_file(archive, 'config/iptables.rules',
|
|
||||||
tmp_config_path)
|
|
||||||
extract_relative_file(archive, 'etc/platform/iptables.rules',
|
|
||||||
PLATFORM_CONF_PATH)
|
|
||||||
|
|
||||||
# Extract etc files
|
# Extract etc files
|
||||||
archive.extract('etc/hostname', '/')
|
archive.extract('etc/hostname', '/')
|
||||||
archive.extract('etc/hosts', '/')
|
archive.extract('etc/hosts', '/')
|
||||||
|
|||||||
@ -314,15 +314,6 @@ start()
|
|||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [ -e $CONFIG_DIR/iptables.rules ]
|
|
||||||
then
|
|
||||||
cp $CONFIG_DIR/iptables.rules /etc/platform/iptables.rules
|
|
||||||
if [ $? -ne 0 ]
|
|
||||||
then
|
|
||||||
fatal_error "Unable to copy $CONFIG_DIR/iptables.rules"
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Copy over external_ceph config files
|
# Copy over external_ceph config files
|
||||||
if [ -e $CONFIG_DIR/ceph-config ]
|
if [ -e $CONFIG_DIR/ceph-config ]
|
||||||
then
|
then
|
||||||
|
|||||||
@ -88,15 +88,6 @@ class openstack::barbican::service
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
class openstack::barbican::firewall
|
|
||||||
inherits ::openstack::barbican::params {
|
|
||||||
|
|
||||||
platform::firewall::rule { 'barbican-api':
|
|
||||||
service_name => 'barbican-api',
|
|
||||||
ports => $api_port,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
class openstack::barbican::haproxy
|
class openstack::barbican::haproxy
|
||||||
inherits ::openstack::barbican::params {
|
inherits ::openstack::barbican::params {
|
||||||
|
|
||||||
@ -137,7 +128,6 @@ class openstack::barbican::api
|
|||||||
|
|
||||||
if $service_enabled {
|
if $service_enabled {
|
||||||
include ::openstack::barbican::service
|
include ::openstack::barbican::service
|
||||||
include ::openstack::barbican::firewall
|
|
||||||
include ::openstack::barbican::haproxy
|
include ::openstack::barbican::haproxy
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@ -174,32 +174,9 @@ class openstack::horizon
|
|||||||
user => 'root',
|
user => 'root',
|
||||||
}
|
}
|
||||||
|
|
||||||
include ::openstack::horizon::firewall
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
class openstack::horizon::firewall
|
|
||||||
inherits ::openstack::horizon::params {
|
|
||||||
|
|
||||||
# horizon is run behind a proxy server, therefore
|
|
||||||
# set the dashboard access based on the configuration
|
|
||||||
# of HTTPS for external protocols. The horizon
|
|
||||||
# server runs on port 8080 behind the proxy server.
|
|
||||||
if $enable_https {
|
|
||||||
$firewall_port = $https_port
|
|
||||||
} else {
|
|
||||||
$firewall_port = $http_port
|
|
||||||
}
|
|
||||||
|
|
||||||
platform::firewall::rule { 'dashboard':
|
|
||||||
host => 'ALL',
|
|
||||||
service_name => 'horizon',
|
|
||||||
ports => $firewall_port,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
class openstack::horizon::reload {
|
class openstack::horizon::reload {
|
||||||
|
|
||||||
# Remove all active Horizon user sessions
|
# Remove all active Horizon user sessions
|
||||||
|
|||||||
@ -133,19 +133,6 @@ class openstack::keystone (
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
class openstack::keystone::firewall
|
|
||||||
inherits ::openstack::keystone::params {
|
|
||||||
|
|
||||||
if !$::platform::params::region_config {
|
|
||||||
platform::firewall::rule { 'keystone-api':
|
|
||||||
service_name => 'keystone',
|
|
||||||
ports => $api_port,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
class openstack::keystone::haproxy
|
class openstack::keystone::haproxy
|
||||||
inherits ::openstack::keystone::params {
|
inherits ::openstack::keystone::params {
|
||||||
|
|
||||||
@ -202,7 +189,6 @@ class openstack::keystone::api
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
include ::openstack::keystone::firewall
|
|
||||||
include ::openstack::keystone::haproxy
|
include ::openstack::keystone::haproxy
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -387,19 +387,6 @@ class platform::ceph::osds(
|
|||||||
create_resources('platform_ceph_journal', $journal_config)
|
create_resources('platform_ceph_journal', $journal_config)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
class platform::ceph::firewall
|
|
||||||
inherits ::platform::ceph::params {
|
|
||||||
|
|
||||||
if $service_enabled {
|
|
||||||
platform::firewall::rule { 'ceph-radosgw':
|
|
||||||
service_name => 'ceph-radosgw',
|
|
||||||
ports => $rgw_port,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
class platform::ceph::haproxy
|
class platform::ceph::haproxy
|
||||||
inherits ::platform::ceph::params {
|
inherits ::platform::ceph::params {
|
||||||
|
|
||||||
@ -457,7 +444,6 @@ class platform::ceph::rgw
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
include ::platform::ceph::firewall
|
|
||||||
include ::platform::ceph::haproxy
|
include ::platform::ceph::haproxy
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -34,18 +34,6 @@ class platform::dcmanager
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
class platform::dcmanager::firewall
|
|
||||||
inherits ::platform::dcmanager::params {
|
|
||||||
if $::platform::params::distributed_cloud_role =='systemcontroller' {
|
|
||||||
platform::firewall::rule { 'dcmanager-api':
|
|
||||||
service_name => 'dcmanager',
|
|
||||||
ports => $api_port,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
class platform::dcmanager::haproxy
|
class platform::dcmanager::haproxy
|
||||||
inherits ::platform::dcmanager::params {
|
inherits ::platform::dcmanager::params {
|
||||||
if $::platform::params::distributed_cloud_role =='systemcontroller' {
|
if $::platform::params::distributed_cloud_role =='systemcontroller' {
|
||||||
@ -76,7 +64,6 @@ class platform::dcmanager::api
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
include ::platform::dcmanager::firewall
|
|
||||||
include ::platform::dcmanager::haproxy
|
include ::platform::dcmanager::haproxy
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@ -51,10 +51,6 @@ class platform::dcorch::firewall
|
|||||||
service_name => 'dcorch',
|
service_name => 'dcorch',
|
||||||
ports => $api_port,
|
ports => $api_port,
|
||||||
}
|
}
|
||||||
platform::firewall::rule { 'dcorch-sysinv-api-proxy':
|
|
||||||
service_name => 'dcorch-sysinv-api-proxy',
|
|
||||||
ports => $sysinv_api_proxy_port,
|
|
||||||
}
|
|
||||||
platform::firewall::rule { 'dcorch-nova-api-proxy':
|
platform::firewall::rule { 'dcorch-nova-api-proxy':
|
||||||
service_name => 'dcorch-nova-api-proxy',
|
service_name => 'dcorch-nova-api-proxy',
|
||||||
ports => $nova_api_proxy_port,
|
ports => $nova_api_proxy_port,
|
||||||
@ -67,14 +63,6 @@ class platform::dcorch::firewall
|
|||||||
service_name => 'dcorch-cinder-api-proxy',
|
service_name => 'dcorch-cinder-api-proxy',
|
||||||
ports => $cinder_api_proxy_port,
|
ports => $cinder_api_proxy_port,
|
||||||
}
|
}
|
||||||
platform::firewall::rule { 'dcorch-patch-api-proxy':
|
|
||||||
service_name => 'dcorch-patch-api-proxy',
|
|
||||||
ports => $patch_api_proxy_port,
|
|
||||||
}
|
|
||||||
platform::firewall::rule { 'dcorch-identity-api-proxy':
|
|
||||||
service_name => 'dcorch-identity-api-proxy',
|
|
||||||
ports => $identity_api_proxy_port,
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -76,275 +76,6 @@ define platform::firewall::rule (
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
define platform::firewall::common (
|
|
||||||
$version,
|
|
||||||
$interface,
|
|
||||||
) {
|
|
||||||
|
|
||||||
$provider = $version ? {'ipv4' => 'iptables', 'ipv6' => 'ip6tables'}
|
|
||||||
|
|
||||||
firewall { "000 platform accept non-oam ${version}":
|
|
||||||
proto => 'all',
|
|
||||||
iniface => "! ${$interface}",
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "001 platform accept related ${version}":
|
|
||||||
proto => 'all',
|
|
||||||
state => ['RELATED', 'ESTABLISHED'],
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
# explicitly drop some types of traffic without logging
|
|
||||||
firewall { "800 platform drop tcf-agent udp ${version}":
|
|
||||||
proto => 'udp',
|
|
||||||
dport => 1534,
|
|
||||||
action => 'drop',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "800 platform drop tcf-agent tcp ${version}":
|
|
||||||
proto => 'tcp',
|
|
||||||
dport => 1534,
|
|
||||||
action => 'drop',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "800 platform drop all avahi-daemon ${version}":
|
|
||||||
proto => 'udp',
|
|
||||||
dport => 5353,
|
|
||||||
action => 'drop',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "999 platform log dropped ${version}":
|
|
||||||
proto => 'all',
|
|
||||||
limit => '2/min',
|
|
||||||
jump => 'LOG',
|
|
||||||
log_prefix => "${provider}-in-dropped: ",
|
|
||||||
log_level => 4,
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "000 platform forward non-oam ${version}":
|
|
||||||
chain => 'FORWARD',
|
|
||||||
proto => 'all',
|
|
||||||
iniface => "! ${interface}",
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "001 platform forward related ${version}":
|
|
||||||
chain => 'FORWARD',
|
|
||||||
proto => 'all',
|
|
||||||
state => ['RELATED', 'ESTABLISHED'],
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "999 platform log dropped ${version} forwarded":
|
|
||||||
chain => 'FORWARD',
|
|
||||||
proto => 'all',
|
|
||||||
limit => '2/min',
|
|
||||||
jump => 'LOG',
|
|
||||||
log_prefix => "${provider}-fwd-dropped: ",
|
|
||||||
log_level => 4,
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
# Declare OAM service rules
|
|
||||||
define platform::firewall::services (
|
|
||||||
$version,
|
|
||||||
) {
|
|
||||||
# platform rules to be applied before custom rules
|
|
||||||
Firewall {
|
|
||||||
require => undef,
|
|
||||||
}
|
|
||||||
|
|
||||||
$provider = $version ? {'ipv4' => 'iptables', 'ipv6' => 'ip6tables'}
|
|
||||||
|
|
||||||
$proto_icmp = $version ? {'ipv4' => 'icmp', 'ipv6' => 'ipv6-icmp'}
|
|
||||||
|
|
||||||
# Provider specific service rules
|
|
||||||
firewall { "010 platform accept sm ${version}":
|
|
||||||
proto => 'udp',
|
|
||||||
dport => [2222, 2223],
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "011 platform accept ssh ${version}":
|
|
||||||
proto => 'tcp',
|
|
||||||
dport => 22,
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "200 platform accept icmp ${version}":
|
|
||||||
proto => $proto_icmp,
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "201 platform accept ntp ${version}":
|
|
||||||
proto => 'udp',
|
|
||||||
dport => 123,
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "202 platform accept snmp ${version}":
|
|
||||||
proto => 'udp',
|
|
||||||
dport => 161,
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "202 platform accept snmp trap ${version}":
|
|
||||||
proto => 'udp',
|
|
||||||
dport => 162,
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
firewall { "203 platform accept ptp ${version}":
|
|
||||||
proto => 'udp',
|
|
||||||
dport => [319, 320],
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
|
|
||||||
# allow IGMP Query traffic if IGMP Snooping is
|
|
||||||
# enabled on the TOR switch
|
|
||||||
firewall { "204 platform accept igmp ${version}":
|
|
||||||
proto => 'igmp',
|
|
||||||
action => 'accept',
|
|
||||||
provider => $provider,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
define platform::firewall::hooks (
|
|
||||||
$version = undef,
|
|
||||||
) {
|
|
||||||
$protocol = $version ? {'ipv4' => 'IPv4', 'ipv6' => 'IPv6'}
|
|
||||||
|
|
||||||
$input_pre_chain = 'INPUT-custom-pre'
|
|
||||||
$input_post_chain = 'INPUT-custom-post'
|
|
||||||
|
|
||||||
firewallchain { "${input_pre_chain}:filter:${protocol}":
|
|
||||||
ensure => present,
|
|
||||||
}
|
|
||||||
-> firewallchain { "${input_post_chain}:filter:${protocol}":
|
|
||||||
ensure => present,
|
|
||||||
}
|
|
||||||
-> firewall { "100 ${input_pre_chain} ${version}":
|
|
||||||
proto => 'all',
|
|
||||||
chain => 'INPUT',
|
|
||||||
jump => $input_pre_chain
|
|
||||||
}
|
|
||||||
-> firewall { "900 ${input_post_chain} ${version}":
|
|
||||||
proto => 'all',
|
|
||||||
chain => 'INPUT',
|
|
||||||
jump => $input_post_chain
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
class platform::firewall::custom (
|
|
||||||
$version = undef,
|
|
||||||
$rules_file = undef,
|
|
||||||
) {
|
|
||||||
|
|
||||||
$restore = $version ? {
|
|
||||||
'ipv4' => 'iptables-restore',
|
|
||||||
'ipv6' => 'ip6tables-restore'}
|
|
||||||
|
|
||||||
platform::firewall::hooks { '::platform:firewall:hooks':
|
|
||||||
version => $version,
|
|
||||||
}
|
|
||||||
|
|
||||||
-> exec { 'Flush firewall custom pre rules':
|
|
||||||
command => 'iptables --flush INPUT-custom-pre',
|
|
||||||
}
|
|
||||||
-> exec { 'Flush firewall custom post rules':
|
|
||||||
command => 'iptables --flush INPUT-custom-post',
|
|
||||||
}
|
|
||||||
-> exec { 'Apply firewall custom rules':
|
|
||||||
command => "${restore} --noflush ${rules_file}",
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
class platform::firewall::oam (
|
|
||||||
$rules_file = undef,
|
|
||||||
) {
|
|
||||||
|
|
||||||
include ::platform::network::oam::params
|
|
||||||
$interface_name = $::platform::network::oam::params::interface_name
|
|
||||||
$subnet_version = $::platform::network::oam::params::subnet_version
|
|
||||||
|
|
||||||
$version = $subnet_version ? {
|
|
||||||
4 => 'ipv4',
|
|
||||||
6 => 'ipv6',
|
|
||||||
}
|
|
||||||
|
|
||||||
platform::firewall::common { 'platform:firewall:ipv4':
|
|
||||||
interface => $interface_name,
|
|
||||||
version => 'ipv4',
|
|
||||||
}
|
|
||||||
|
|
||||||
-> platform::firewall::common { 'platform:firewall:ipv6':
|
|
||||||
interface => $interface_name,
|
|
||||||
version => 'ipv6',
|
|
||||||
}
|
|
||||||
|
|
||||||
-> platform::firewall::services { 'platform:firewall:services':
|
|
||||||
version => $version,
|
|
||||||
}
|
|
||||||
|
|
||||||
# Set default table policies
|
|
||||||
-> firewallchain { 'INPUT:filter:IPv4':
|
|
||||||
ensure => present,
|
|
||||||
policy => drop,
|
|
||||||
before => undef,
|
|
||||||
purge => false,
|
|
||||||
}
|
|
||||||
|
|
||||||
-> firewallchain { 'INPUT:filter:IPv6':
|
|
||||||
ensure => present,
|
|
||||||
policy => drop,
|
|
||||||
before => undef,
|
|
||||||
purge => false,
|
|
||||||
}
|
|
||||||
|
|
||||||
-> firewallchain { 'FORWARD:filter:IPv4':
|
|
||||||
ensure => present,
|
|
||||||
policy => drop,
|
|
||||||
before => undef,
|
|
||||||
purge => false,
|
|
||||||
}
|
|
||||||
|
|
||||||
-> firewallchain { 'FORWARD:filter:IPv6':
|
|
||||||
ensure => present,
|
|
||||||
policy => drop,
|
|
||||||
before => undef,
|
|
||||||
purge => false,
|
|
||||||
}
|
|
||||||
|
|
||||||
if $rules_file {
|
|
||||||
|
|
||||||
class { '::platform::firewall::custom':
|
|
||||||
version => $version,
|
|
||||||
rules_file => $rules_file,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
class platform::firewall::calico::oam::services {
|
class platform::firewall::calico::oam::services {
|
||||||
include ::platform::params
|
include ::platform::params
|
||||||
include ::platform::network::oam::params
|
include ::platform::network::oam::params
|
||||||
|
|||||||
@ -35,15 +35,6 @@ class platform::fm
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
class platform::fm::firewall
|
|
||||||
inherits ::platform::fm::params {
|
|
||||||
|
|
||||||
platform::firewall::rule { 'fm-api':
|
|
||||||
service_name => 'fm',
|
|
||||||
ports => $api_port,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
class platform::fm::haproxy
|
class platform::fm::haproxy
|
||||||
inherits ::platform::fm::params {
|
inherits ::platform::fm::params {
|
||||||
|
|
||||||
@ -84,7 +75,6 @@ class platform::fm::api
|
|||||||
sync_db => $::platform::params::init_database,
|
sync_db => $::platform::params::init_database,
|
||||||
}
|
}
|
||||||
|
|
||||||
include ::platform::fm::firewall
|
|
||||||
include ::platform::fm::haproxy
|
include ::platform::fm::haproxy
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@ -52,16 +52,6 @@ class platform::nfv::runtime {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
class platform::nfv::firewall
|
|
||||||
inherits ::platform::nfv::params {
|
|
||||||
|
|
||||||
platform::firewall::rule { 'nfv-vim-api':
|
|
||||||
service_name => 'nfv-vim',
|
|
||||||
ports => $api_port,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
class platform::nfv::haproxy
|
class platform::nfv::haproxy
|
||||||
inherits ::platform::nfv::params {
|
inherits ::platform::nfv::params {
|
||||||
|
|
||||||
@ -81,6 +71,5 @@ class platform::nfv::api
|
|||||||
include ::nfv::keystone::auth
|
include ::nfv::keystone::auth
|
||||||
}
|
}
|
||||||
|
|
||||||
include ::platform::nfv::firewall
|
|
||||||
include ::platform::nfv::haproxy
|
include ::platform::nfv::haproxy
|
||||||
}
|
}
|
||||||
|
|||||||
@ -35,16 +35,6 @@ class platform::patching
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
class platform::patching::firewall
|
|
||||||
inherits ::platform::patching::params {
|
|
||||||
|
|
||||||
platform::firewall::rule { 'patching-api':
|
|
||||||
service_name => 'patching',
|
|
||||||
ports => $public_port,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
class platform::patching::haproxy
|
class platform::patching::haproxy
|
||||||
inherits ::platform::patching::params {
|
inherits ::platform::patching::params {
|
||||||
|
|
||||||
@ -67,7 +57,6 @@ class platform::patching::api (
|
|||||||
include ::patching::keystone::auth
|
include ::patching::keystone::auth
|
||||||
}
|
}
|
||||||
|
|
||||||
include ::platform::patching::firewall
|
|
||||||
include ::platform::patching::haproxy
|
include ::platform::patching::haproxy
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -10,15 +10,6 @@ class platform::smapi::params (
|
|||||||
$region = undef,
|
$region = undef,
|
||||||
) {}
|
) {}
|
||||||
|
|
||||||
class platform::smap::firewall
|
|
||||||
inherits ::platform::smapi::params {
|
|
||||||
|
|
||||||
platform::firewall::rule { 'sm-api':
|
|
||||||
service_name => 'sm-api',
|
|
||||||
ports => $port,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
class platform::smapi::haproxy
|
class platform::smapi::haproxy
|
||||||
inherits ::platform::smapi::params {
|
inherits ::platform::smapi::params {
|
||||||
|
|
||||||
@ -47,7 +38,6 @@ class platform::smapi
|
|||||||
}
|
}
|
||||||
|
|
||||||
include ::platform::params
|
include ::platform::params
|
||||||
include ::platform::smap::firewall
|
|
||||||
include ::platform::smapi::haproxy
|
include ::platform::smapi::haproxy
|
||||||
$bind_host_name = $::platform::params::hostname
|
$bind_host_name = $::platform::params::hostname
|
||||||
file { '/etc/sm-api/sm-api.conf':
|
file { '/etc/sm-api/sm-api.conf':
|
||||||
|
|||||||
@ -120,16 +120,6 @@ class platform::sysinv::conductor {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
class platform::sysinv::firewall
|
|
||||||
inherits ::platform::sysinv::params {
|
|
||||||
|
|
||||||
platform::firewall::rule { 'sysinv-api':
|
|
||||||
service_name => 'sysinv',
|
|
||||||
ports => $api_port,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
class platform::sysinv::haproxy
|
class platform::sysinv::haproxy
|
||||||
inherits ::platform::sysinv::params {
|
inherits ::platform::sysinv::params {
|
||||||
|
|
||||||
@ -173,7 +163,6 @@ class platform::sysinv::api
|
|||||||
'DEFAULT/sysinv_api_workers': value => $::platform::params::eng_workers_by_5;
|
'DEFAULT/sysinv_api_workers': value => $::platform::params::eng_workers_by_5;
|
||||||
}
|
}
|
||||||
|
|
||||||
include ::platform::sysinv::firewall
|
|
||||||
include ::platform::sysinv::haproxy
|
include ::platform::sysinv::haproxy
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -29,7 +29,6 @@ from cgtsclient.v1 import datanetwork
|
|||||||
from cgtsclient.v1 import drbdconfig
|
from cgtsclient.v1 import drbdconfig
|
||||||
from cgtsclient.v1 import ethernetport
|
from cgtsclient.v1 import ethernetport
|
||||||
from cgtsclient.v1 import fernet
|
from cgtsclient.v1 import fernet
|
||||||
from cgtsclient.v1 import firewallrules
|
|
||||||
from cgtsclient.v1 import health
|
from cgtsclient.v1 import health
|
||||||
from cgtsclient.v1 import helm
|
from cgtsclient.v1 import helm
|
||||||
from cgtsclient.v1 import icommunity
|
from cgtsclient.v1 import icommunity
|
||||||
@ -148,7 +147,6 @@ class Client(http.HTTPClient):
|
|||||||
self.health = health.HealthManager(self)
|
self.health = health.HealthManager(self)
|
||||||
self.remotelogging = remotelogging.RemoteLoggingManager(self)
|
self.remotelogging = remotelogging.RemoteLoggingManager(self)
|
||||||
self.sdn_controller = sdn_controller.SDNControllerManager(self)
|
self.sdn_controller = sdn_controller.SDNControllerManager(self)
|
||||||
self.firewallrules = firewallrules.FirewallRulesManager(self)
|
|
||||||
self.partition = partition.partitionManager(self)
|
self.partition = partition.partitionManager(self)
|
||||||
self.license = license.LicenseManager(self)
|
self.license = license.LicenseManager(self)
|
||||||
self.certificate = certificate.CertificateManager(self)
|
self.certificate = certificate.CertificateManager(self)
|
||||||
|
|||||||
@ -1,38 +0,0 @@
|
|||||||
#
|
|
||||||
# Copyright (c) 2017 Wind River Systems, Inc.
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
#
|
|
||||||
|
|
||||||
# -*- encoding: utf-8 -*-
|
|
||||||
#
|
|
||||||
|
|
||||||
from cgtsclient.common import base
|
|
||||||
|
|
||||||
CREATION_ATTRIBUTES = ['firewall_path']
|
|
||||||
|
|
||||||
|
|
||||||
class FirewallRules(base.Resource):
|
|
||||||
def __repr__(self):
|
|
||||||
return "<firewallrules %s>" % self._info
|
|
||||||
|
|
||||||
|
|
||||||
class FirewallRulesManager(base.Manager):
|
|
||||||
resource_class = FirewallRules
|
|
||||||
|
|
||||||
@staticmethod
|
|
||||||
def _path(id=None):
|
|
||||||
return '/v1/firewallrules/%s' % id if id else '/v1/firewallrules'
|
|
||||||
|
|
||||||
def list(self):
|
|
||||||
return self._list(self._path(), "firewallrules")
|
|
||||||
|
|
||||||
def get(self, firewallrules_id):
|
|
||||||
try:
|
|
||||||
return self._list(self._path(firewallrules_id))[0]
|
|
||||||
except IndexError:
|
|
||||||
return None
|
|
||||||
|
|
||||||
def import_firewall_rules(self, file):
|
|
||||||
path = self._path("import_firewall_rules")
|
|
||||||
return self._upload(path, file)
|
|
||||||
@ -1,54 +0,0 @@
|
|||||||
#!/usr/bin/env python
|
|
||||||
#
|
|
||||||
# Copyright (c) 2017 Wind River Systems, Inc.
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
#
|
|
||||||
|
|
||||||
# vim: tabstop=4 shiftwidth=4 softtabstop=4
|
|
||||||
# All Rights Reserved.
|
|
||||||
#
|
|
||||||
|
|
||||||
from cgtsclient.common import utils
|
|
||||||
from cgtsclient import exc
|
|
||||||
|
|
||||||
|
|
||||||
def _print_firewallrules_show(firewallrules):
|
|
||||||
fields = ['uuid', 'firewall_sig', 'updated_at']
|
|
||||||
if type(firewallrules) is dict:
|
|
||||||
data = [(f, firewallrules.get(f, '')) for f in fields]
|
|
||||||
else:
|
|
||||||
data = [(f, getattr(firewallrules, f, '')) for f in fields]
|
|
||||||
utils.print_tuple_list(data)
|
|
||||||
|
|
||||||
|
|
||||||
def do_firewall_rules_show(cc, args):
|
|
||||||
"""Show Firewall Rules attributes."""
|
|
||||||
|
|
||||||
firewallrules = cc.firewallrules.list()
|
|
||||||
|
|
||||||
_print_firewallrules_show(firewallrules[0])
|
|
||||||
|
|
||||||
|
|
||||||
@utils.arg('firewall_rules_path',
|
|
||||||
metavar='<firewall rules path>',
|
|
||||||
default=None,
|
|
||||||
help="Path to custom firewall rule file to install.")
|
|
||||||
def do_firewall_rules_install(cc, args):
|
|
||||||
"""Install firewall rules."""
|
|
||||||
filename = args.firewall_rules_path
|
|
||||||
try:
|
|
||||||
fw_file = open(filename, 'rb')
|
|
||||||
except Exception:
|
|
||||||
raise exc.CommandError("Error: Could not open file %s for read." %
|
|
||||||
filename)
|
|
||||||
try:
|
|
||||||
response = cc.firewallrules.import_firewall_rules(fw_file)
|
|
||||||
error = response.get('error')
|
|
||||||
if error:
|
|
||||||
raise exc.CommandError("%s" % error)
|
|
||||||
else:
|
|
||||||
_print_firewallrules_show(response.get('firewallrules'))
|
|
||||||
except exc.HTTPNotFound:
|
|
||||||
raise exc.CommandError('firewallrules not installed %s' %
|
|
||||||
filename)
|
|
||||||
@ -16,7 +16,6 @@ from cgtsclient.v1 import controller_fs_shell
|
|||||||
from cgtsclient.v1 import datanetwork_shell
|
from cgtsclient.v1 import datanetwork_shell
|
||||||
from cgtsclient.v1 import drbdconfig_shell
|
from cgtsclient.v1 import drbdconfig_shell
|
||||||
from cgtsclient.v1 import ethernetport_shell
|
from cgtsclient.v1 import ethernetport_shell
|
||||||
from cgtsclient.v1 import firewallrules_shell
|
|
||||||
from cgtsclient.v1 import health_shell
|
from cgtsclient.v1 import health_shell
|
||||||
from cgtsclient.v1 import helm_shell
|
from cgtsclient.v1 import helm_shell
|
||||||
|
|
||||||
@ -111,7 +110,6 @@ COMMAND_MODULES = [
|
|||||||
health_shell,
|
health_shell,
|
||||||
remotelogging_shell,
|
remotelogging_shell,
|
||||||
sdn_controller_shell,
|
sdn_controller_shell,
|
||||||
firewallrules_shell,
|
|
||||||
partition_shell,
|
partition_shell,
|
||||||
license_shell,
|
license_shell,
|
||||||
certificate_shell,
|
certificate_shell,
|
||||||
|
|||||||
@ -35,7 +35,6 @@ from sysinv.api.controllers.v1 import dns
|
|||||||
from sysinv.api.controllers.v1 import drbdconfig
|
from sysinv.api.controllers.v1 import drbdconfig
|
||||||
from sysinv.api.controllers.v1 import ethernet_port
|
from sysinv.api.controllers.v1 import ethernet_port
|
||||||
from sysinv.api.controllers.v1 import fernet_repo
|
from sysinv.api.controllers.v1 import fernet_repo
|
||||||
from sysinv.api.controllers.v1 import firewallrules
|
|
||||||
from sysinv.api.controllers.v1 import health
|
from sysinv.api.controllers.v1 import health
|
||||||
from sysinv.api.controllers.v1 import helm_charts
|
from sysinv.api.controllers.v1 import helm_charts
|
||||||
from sysinv.api.controllers.v1 import host
|
from sysinv.api.controllers.v1 import host
|
||||||
@ -234,9 +233,6 @@ class V1(base.APIBase):
|
|||||||
sdn_controller = [link.Link]
|
sdn_controller = [link.Link]
|
||||||
"Links to the SDN controller resource"
|
"Links to the SDN controller resource"
|
||||||
|
|
||||||
firewallrules = [link.Link]
|
|
||||||
"Links to customer firewall rules"
|
|
||||||
|
|
||||||
license = [link.Link]
|
license = [link.Link]
|
||||||
"Links to the license resource "
|
"Links to the license resource "
|
||||||
|
|
||||||
@ -719,14 +715,6 @@ class V1(base.APIBase):
|
|||||||
bookmark=True)
|
bookmark=True)
|
||||||
]
|
]
|
||||||
|
|
||||||
v1.firewallrules = [link.Link.make_link('self',
|
|
||||||
pecan.request.host_url,
|
|
||||||
'firewallrules', ''),
|
|
||||||
link.Link.make_link('bookmark',
|
|
||||||
pecan.request.host_url,
|
|
||||||
'firewallrules', '',
|
|
||||||
bookmark=True)]
|
|
||||||
|
|
||||||
v1.license = [link.Link.make_link('self',
|
v1.license = [link.Link.make_link('self',
|
||||||
pecan.request.host_url,
|
pecan.request.host_url,
|
||||||
'license', ''),
|
'license', ''),
|
||||||
@ -835,7 +823,6 @@ class Controller(rest.RestController):
|
|||||||
health = health.HealthController()
|
health = health.HealthController()
|
||||||
remotelogging = remotelogging.RemoteLoggingController()
|
remotelogging = remotelogging.RemoteLoggingController()
|
||||||
sdn_controller = sdn_controller.SDNControllerController()
|
sdn_controller = sdn_controller.SDNControllerController()
|
||||||
firewallrules = firewallrules.FirewallRulesController()
|
|
||||||
license = license.LicenseController()
|
license = license.LicenseController()
|
||||||
labels = label.LabelController()
|
labels = label.LabelController()
|
||||||
fernet_repo = fernet_repo.FernetKeyController()
|
fernet_repo = fernet_repo.FernetKeyController()
|
||||||
|
|||||||
@ -1,221 +0,0 @@
|
|||||||
# Copyright (c) 2017 Wind River Systems, Inc.
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
#
|
|
||||||
|
|
||||||
import os
|
|
||||||
import pecan
|
|
||||||
from pecan import expose
|
|
||||||
from pecan import rest
|
|
||||||
import wsme
|
|
||||||
import wsmeext.pecan as wsme_pecan
|
|
||||||
from wsme import types as wtypes
|
|
||||||
from sysinv import objects
|
|
||||||
|
|
||||||
from sysinv.api.controllers.v1 import utils
|
|
||||||
from sysinv.api.controllers.v1 import base
|
|
||||||
from sysinv.api.controllers.v1 import collection
|
|
||||||
from sysinv.api.controllers.v1 import link
|
|
||||||
from sysinv.api.controllers.v1 import types
|
|
||||||
|
|
||||||
from sysinv.common import constants
|
|
||||||
from sysinv.common import exception
|
|
||||||
from sysinv.common import utils as cutils
|
|
||||||
from sysinv.openstack.common import log
|
|
||||||
from sysinv.openstack.common.gettextutils import _
|
|
||||||
|
|
||||||
|
|
||||||
LOG = log.getLogger(__name__)
|
|
||||||
|
|
||||||
|
|
||||||
LOCK_NAME = 'FirewallRulesController'
|
|
||||||
|
|
||||||
|
|
||||||
class FirewallRules(base.APIBase):
|
|
||||||
"""API representation of oam custom firewall rules.
|
|
||||||
|
|
||||||
This class enforces type checking and value constraints, and converts
|
|
||||||
between the internal object model and the API representation of
|
|
||||||
oam custom firewall rules.
|
|
||||||
"""
|
|
||||||
|
|
||||||
uuid = types.uuid
|
|
||||||
"Unique UUID for the firewall rules"
|
|
||||||
|
|
||||||
firewall_sig = wtypes.text
|
|
||||||
"Represents the signature of the custom firewall rules"
|
|
||||||
|
|
||||||
created_at = wtypes.datetime.datetime
|
|
||||||
updated_at = wtypes.datetime.datetime
|
|
||||||
|
|
||||||
def __init__(self, **kwargs):
|
|
||||||
self.fields = list(objects.firewallrules.fields.keys())
|
|
||||||
for k in self.fields:
|
|
||||||
if not hasattr(self, k):
|
|
||||||
continue
|
|
||||||
setattr(self, k, kwargs.get(k, wtypes.Unset))
|
|
||||||
|
|
||||||
self.fields.append('firewall_sig')
|
|
||||||
setattr(self, 'firewall_sig', kwargs.get('value', None))
|
|
||||||
|
|
||||||
@classmethod
|
|
||||||
def convert_with_links(cls, rpc_firewallrules, expand=True):
|
|
||||||
parm = FirewallRules(**rpc_firewallrules.as_dict())
|
|
||||||
if not expand:
|
|
||||||
parm.unset_fields_except(['uuid', 'firewall_sig', 'updated_at'])
|
|
||||||
|
|
||||||
parm.links = [link.Link.make_link('self', pecan.request.host_url,
|
|
||||||
'parameters', parm.uuid),
|
|
||||||
link.Link.make_link('bookmark',
|
|
||||||
pecan.request.host_url,
|
|
||||||
'parameters', parm.uuid,
|
|
||||||
bookmark=True)
|
|
||||||
]
|
|
||||||
return parm
|
|
||||||
|
|
||||||
|
|
||||||
def firewallrules_as_dict(sp_firewallrules):
|
|
||||||
sp_firewallrules_dict = sp_firewallrules.as_dict()
|
|
||||||
keys = objects.firewallrules.fields.keys()
|
|
||||||
for k, v in sp_firewallrules.as_dict().items():
|
|
||||||
if k == 'value':
|
|
||||||
sp_firewallrules_dict['firewall_sig'] = \
|
|
||||||
sp_firewallrules_dict.pop('value')
|
|
||||||
elif k not in keys:
|
|
||||||
sp_firewallrules_dict.pop(k)
|
|
||||||
return sp_firewallrules_dict
|
|
||||||
|
|
||||||
|
|
||||||
class FirewallRulesCollection(collection.Collection):
|
|
||||||
"""API representation of a collection of firewall rules."""
|
|
||||||
|
|
||||||
firewallrules = [FirewallRules]
|
|
||||||
"A list containing firewallrules objects"
|
|
||||||
|
|
||||||
def __init__(self, **kwargs):
|
|
||||||
self._type = 'firewallrules'
|
|
||||||
|
|
||||||
@classmethod
|
|
||||||
def convert_with_links(cls, rpc_firewallrules, limit, url=None,
|
|
||||||
expand=False,
|
|
||||||
**kwargs):
|
|
||||||
collection = FirewallRulesCollection()
|
|
||||||
collection.firewallrules = [FirewallRules.convert_with_links(p, expand)
|
|
||||||
for p in rpc_firewallrules]
|
|
||||||
collection.next = collection.get_next(limit, url=url, **kwargs)
|
|
||||||
return collection
|
|
||||||
|
|
||||||
|
|
||||||
class FirewallRulesController(rest.RestController):
|
|
||||||
"""REST controller for Custom Firewall Rules."""
|
|
||||||
|
|
||||||
_custom_actions = {
|
|
||||||
'import_firewall_rules': ['POST'],
|
|
||||||
}
|
|
||||||
|
|
||||||
def __init__(self):
|
|
||||||
self._api_token = None
|
|
||||||
|
|
||||||
@wsme_pecan.wsexpose(FirewallRules, types.uuid)
|
|
||||||
def get_one(self, firewallrules_uuid):
|
|
||||||
"""Retrieve information about the given firewall rules."""
|
|
||||||
|
|
||||||
try:
|
|
||||||
sp_firewallrules = objects.firewallrules.get_by_uuid(
|
|
||||||
pecan.request.context, firewallrules_uuid)
|
|
||||||
except exception.InvalidParameterValue:
|
|
||||||
raise wsme.exc.ClientSideError(
|
|
||||||
_("No firewall rules found for %s" % firewallrules_uuid))
|
|
||||||
|
|
||||||
return FirewallRules.convert_with_links(sp_firewallrules)
|
|
||||||
|
|
||||||
def _get_firewallrules_collection(self, marker, limit,
|
|
||||||
sort_key, sort_dir, expand=False,
|
|
||||||
resource_url=None):
|
|
||||||
|
|
||||||
limit = utils.validate_limit(limit)
|
|
||||||
sort_dir = utils.validate_sort_dir(sort_dir)
|
|
||||||
|
|
||||||
sp_firewallrules = pecan.request.dbapi.service_parameter_get_one(
|
|
||||||
service=constants.SERVICE_TYPE_PLATFORM,
|
|
||||||
section=constants.SERVICE_PARAM_SECTION_PLATFORM_SYSINV,
|
|
||||||
name=constants.SERVICE_PARAM_NAME_SYSINV_FIREWALL_RULES_ID)
|
|
||||||
sp_firewallrules.firewall_sig = sp_firewallrules.value
|
|
||||||
|
|
||||||
sp_firewallrules = [sp_firewallrules]
|
|
||||||
|
|
||||||
rules = FirewallRulesCollection.convert_with_links(
|
|
||||||
sp_firewallrules,
|
|
||||||
limit,
|
|
||||||
url=resource_url,
|
|
||||||
expand=expand,
|
|
||||||
sort_key=sort_key,
|
|
||||||
sort_dir=sort_dir)
|
|
||||||
return rules
|
|
||||||
|
|
||||||
@wsme_pecan.wsexpose(FirewallRulesCollection, types.uuid, types.uuid, int,
|
|
||||||
wtypes.text, wtypes.text)
|
|
||||||
def get_all(self, isystem_uuid=None, marker=None, limit=None,
|
|
||||||
sort_key='id', sort_dir='asc'):
|
|
||||||
"""Retrieve a list of firewallrules. Only one per system"""
|
|
||||||
|
|
||||||
sort_key = ['section', 'name']
|
|
||||||
return self._get_firewallrules_collection(marker, limit,
|
|
||||||
sort_key, sort_dir)
|
|
||||||
|
|
||||||
@expose('json')
|
|
||||||
@cutils.synchronized(LOCK_NAME)
|
|
||||||
def import_firewall_rules(self, file):
|
|
||||||
file = pecan.request.POST['file']
|
|
||||||
if not file.filename:
|
|
||||||
return dict(success="", error="Error: No firewall rules uploaded")
|
|
||||||
|
|
||||||
# Check if the firewallrules_file size is large
|
|
||||||
try:
|
|
||||||
_check_firewall_rules_file_size(file)
|
|
||||||
except Exception as e:
|
|
||||||
LOG.exception(e)
|
|
||||||
return dict(success="", error=e.message)
|
|
||||||
|
|
||||||
file.file.seek(0, os.SEEK_SET)
|
|
||||||
contents = file.file.read()
|
|
||||||
|
|
||||||
# Get OAM network ip version
|
|
||||||
oam_network = pecan.request.dbapi.network_get_by_type(
|
|
||||||
constants.NETWORK_TYPE_OAM)
|
|
||||||
oam_address_pool = pecan.request.dbapi.address_pool_get(
|
|
||||||
oam_network.pool_uuid)
|
|
||||||
|
|
||||||
try:
|
|
||||||
firewall_sig = pecan.request.rpcapi.update_firewall_config(
|
|
||||||
pecan.request.context, oam_address_pool.family, contents)
|
|
||||||
|
|
||||||
# push the updated firewall_sig into db
|
|
||||||
sp_firewallrules = pecan.request.dbapi.service_parameter_get_one(
|
|
||||||
service=constants.SERVICE_TYPE_PLATFORM,
|
|
||||||
section=constants.SERVICE_PARAM_SECTION_PLATFORM_SYSINV,
|
|
||||||
name=constants.SERVICE_PARAM_NAME_SYSINV_FIREWALL_RULES_ID)
|
|
||||||
|
|
||||||
sp_firewallrules = pecan.request.dbapi.service_parameter_update(
|
|
||||||
sp_firewallrules.uuid,
|
|
||||||
{'value': firewall_sig, 'personality': constants.CONTROLLER})
|
|
||||||
|
|
||||||
sp_firewallrules_dict = firewallrules_as_dict(sp_firewallrules)
|
|
||||||
|
|
||||||
LOG.info("import_firewallrules sp_firewallrules={}".format(
|
|
||||||
sp_firewallrules_dict))
|
|
||||||
|
|
||||||
except Exception as e:
|
|
||||||
return dict(success="", error=e.value)
|
|
||||||
|
|
||||||
return dict(success="", error="", body="",
|
|
||||||
firewallrules=sp_firewallrules_dict)
|
|
||||||
|
|
||||||
|
|
||||||
def _check_firewall_rules_file_size(firewallrules_file):
|
|
||||||
firewallrules_file.file.seek(0, os.SEEK_END)
|
|
||||||
size = firewallrules_file.file.tell()
|
|
||||||
if size > constants.FIREWALL_RULES_MAX_FILE_SIZE:
|
|
||||||
raise wsme.exc.ClientSideError(
|
|
||||||
_("Firewall rules file size exceeded maximum supported"
|
|
||||||
" size of %s bytes." % constants.FIREWALL_RULES_MAX_FILE_SIZE))
|
|
||||||
@ -197,12 +197,6 @@ class ServiceParameterController(rest.RestController):
|
|||||||
p.section == constants.SERVICE_PARAM_SECTION_CINDER_DEFAULT and
|
p.section == constants.SERVICE_PARAM_SECTION_CINDER_DEFAULT and
|
||||||
p.name == constants.SERVICE_PARAM_CINDER_DEFAULT_MULTIPATH_STATE)]
|
p.name == constants.SERVICE_PARAM_CINDER_DEFAULT_MULTIPATH_STATE)]
|
||||||
|
|
||||||
# filter out firewall_rules_id
|
|
||||||
parms = [p for p in parms if not (
|
|
||||||
p.service == constants.SERVICE_TYPE_PLATFORM and p.section ==
|
|
||||||
constants.SERVICE_PARAM_SECTION_PLATFORM_SYSINV and p.name ==
|
|
||||||
constants.SERVICE_PARAM_NAME_SYSINV_FIREWALL_RULES_ID)]
|
|
||||||
|
|
||||||
# Before we can return the service parameter collection,
|
# Before we can return the service parameter collection,
|
||||||
# we need to ensure that the list does not contain any
|
# we need to ensure that the list does not contain any
|
||||||
# "protected" service parameters which may need to be
|
# "protected" service parameters which may need to be
|
||||||
|
|||||||
@ -1043,7 +1043,6 @@ SERVICE_PARAM_NAME_DEFAULT_DNS_DOMAIN = 'dns_domain'
|
|||||||
# Platform Service Parameters
|
# Platform Service Parameters
|
||||||
SERVICE_PARAM_SECTION_PLATFORM_MAINTENANCE = 'maintenance'
|
SERVICE_PARAM_SECTION_PLATFORM_MAINTENANCE = 'maintenance'
|
||||||
SERVICE_PARAM_SECTION_PLATFORM_SYSINV = 'sysinv'
|
SERVICE_PARAM_SECTION_PLATFORM_SYSINV = 'sysinv'
|
||||||
SERVICE_PARAM_NAME_SYSINV_FIREWALL_RULES_ID = 'firewall_rules_id'
|
|
||||||
|
|
||||||
SERVICE_PARAM_PLAT_MTCE_WORKER_BOOT_TIMEOUT = 'worker_boot_timeout'
|
SERVICE_PARAM_PLAT_MTCE_WORKER_BOOT_TIMEOUT = 'worker_boot_timeout'
|
||||||
SERVICE_PARAM_PLAT_MTCE_CONTROLLER_BOOT_TIMEOUT = 'controller_boot_timeout'
|
SERVICE_PARAM_PLAT_MTCE_CONTROLLER_BOOT_TIMEOUT = 'controller_boot_timeout'
|
||||||
@ -1389,10 +1388,6 @@ WARNING_ROOT_PV_CINDER_CEPH_MSG = (
|
|||||||
PV_WARNINGS = {WARN_CINDER_ON_ROOT_WITH_LVM: WARNING_ROOT_PV_CINDER_LVM_MSG,
|
PV_WARNINGS = {WARN_CINDER_ON_ROOT_WITH_LVM: WARNING_ROOT_PV_CINDER_LVM_MSG,
|
||||||
WARN_CINDER_ON_ROOT_WITH_CEPH: WARNING_ROOT_PV_CINDER_CEPH_MSG}
|
WARN_CINDER_ON_ROOT_WITH_CEPH: WARNING_ROOT_PV_CINDER_CEPH_MSG}
|
||||||
|
|
||||||
# Custom firewall rule file
|
|
||||||
FIREWALL_RULES_FILE = 'iptables.rules'
|
|
||||||
FIREWALL_RULES_MAX_FILE_SIZE = 102400
|
|
||||||
|
|
||||||
# License file
|
# License file
|
||||||
LICENSE_FILE = ".license"
|
LICENSE_FILE = ".license"
|
||||||
|
|
||||||
|
|||||||
@ -32,7 +32,6 @@ collection of inventory data for each host.
|
|||||||
import errno
|
import errno
|
||||||
import filecmp
|
import filecmp
|
||||||
import glob
|
import glob
|
||||||
import hashlib
|
|
||||||
import math
|
import math
|
||||||
import os
|
import os
|
||||||
import re
|
import re
|
||||||
@ -499,10 +498,6 @@ class ConductorManager(service.PeriodicService):
|
|||||||
'name': constants.SERVICE_PARAM_NAME_AODH_DATABASE_ALARM_HISTORY_TIME_TO_LIVE,
|
'name': constants.SERVICE_PARAM_NAME_AODH_DATABASE_ALARM_HISTORY_TIME_TO_LIVE,
|
||||||
'value': constants.SERVICE_PARAM_AODH_DATABASE_ALARM_HISTORY_TIME_TO_LIVE_DEFAULT,
|
'value': constants.SERVICE_PARAM_AODH_DATABASE_ALARM_HISTORY_TIME_TO_LIVE_DEFAULT,
|
||||||
},
|
},
|
||||||
{'service': constants.SERVICE_TYPE_PLATFORM,
|
|
||||||
'section': constants.SERVICE_PARAM_SECTION_PLATFORM_SYSINV,
|
|
||||||
'name': constants.SERVICE_PARAM_NAME_SYSINV_FIREWALL_RULES_ID,
|
|
||||||
'value': None},
|
|
||||||
{'service': constants.SERVICE_TYPE_SWIFT,
|
{'service': constants.SERVICE_TYPE_SWIFT,
|
||||||
'section': constants.SERVICE_PARAM_SECTION_SWIFT_CONFIG,
|
'section': constants.SERVICE_PARAM_SECTION_SWIFT_CONFIG,
|
||||||
'name': constants.SERVICE_PARAM_NAME_SWIFT_SERVICE_ENABLED,
|
'name': constants.SERVICE_PARAM_NAME_SWIFT_SERVICE_ENABLED,
|
||||||
@ -7224,7 +7219,7 @@ class ConductorManager(service.PeriodicService):
|
|||||||
"personalities": personalities,
|
"personalities": personalities,
|
||||||
"classes": ['openstack::lighttpd::runtime',
|
"classes": ['openstack::lighttpd::runtime',
|
||||||
'platform::helm::runtime',
|
'platform::helm::runtime',
|
||||||
'openstack::horizon::firewall',
|
'platform::firewall::runtime',
|
||||||
'platform::patching::runtime']
|
'platform::patching::runtime']
|
||||||
}
|
}
|
||||||
self._config_apply_runtime_manifest(context, config_uuid,
|
self._config_apply_runtime_manifest(context, config_uuid,
|
||||||
@ -9882,31 +9877,6 @@ class ConductorManager(service.PeriodicService):
|
|||||||
pass
|
pass
|
||||||
return upgrade
|
return upgrade
|
||||||
|
|
||||||
@staticmethod
|
|
||||||
def _validate_firewall_rules(rules_file,
|
|
||||||
ip_version=constants.IPV4_FAMILY):
|
|
||||||
"""
|
|
||||||
Validate the content of the custom firewall rules
|
|
||||||
:param rules_file: file path of the custom firewall rules
|
|
||||||
:param ip_version: IP version
|
|
||||||
:return:
|
|
||||||
"""
|
|
||||||
try:
|
|
||||||
if ip_version == constants.IPV4_FAMILY:
|
|
||||||
cmd = "iptables-restore"
|
|
||||||
else:
|
|
||||||
cmd = "ip6tables-restore"
|
|
||||||
|
|
||||||
with open(os.devnull, "w"):
|
|
||||||
subprocess.check_output(
|
|
||||||
[cmd, "--test", "--noflush", rules_file],
|
|
||||||
stderr=subprocess.STDOUT)
|
|
||||||
return True
|
|
||||||
except subprocess.CalledProcessError as e:
|
|
||||||
LOG.error("iptables-restore failed, output: %s" % e.output)
|
|
||||||
LOG.exception(e)
|
|
||||||
return False
|
|
||||||
|
|
||||||
def distribute_ceph_external_config(self, context, ceph_conf_filename):
|
def distribute_ceph_external_config(self, context, ceph_conf_filename):
|
||||||
"""Notify agent to distribute Ceph configuration file for external
|
"""Notify agent to distribute Ceph configuration file for external
|
||||||
cluster.
|
cluster.
|
||||||
@ -9969,57 +9939,6 @@ class ConductorManager(service.PeriodicService):
|
|||||||
tsc.PLATFORM_CEPH_CONF_PATH)
|
tsc.PLATFORM_CEPH_CONF_PATH)
|
||||||
raise exception.SysinvException(msg)
|
raise exception.SysinvException(msg)
|
||||||
|
|
||||||
def update_firewall_config(self, context, ip_version, contents):
|
|
||||||
"""Notify agent to configure firewall rules with the supplied data.
|
|
||||||
Apply firewall manifest changes.
|
|
||||||
|
|
||||||
:param context: an admin context.
|
|
||||||
:param ip_version: IPV4_VERSION or IPV6_VERSION
|
|
||||||
:param contents: custom firewall rules contents
|
|
||||||
"""
|
|
||||||
firewall_rules_file = os.path.join(tsc.PLATFORM_CONF_PATH,
|
|
||||||
constants.FIREWALL_RULES_FILE)
|
|
||||||
temp_firewall_rules_file = firewall_rules_file + '.temp'
|
|
||||||
firewall_sig = hashlib.md5(contents).hexdigest()
|
|
||||||
LOG.info("update_firewall_config firewall_sig=%s" % firewall_sig)
|
|
||||||
|
|
||||||
with open(temp_firewall_rules_file, 'w') as f:
|
|
||||||
f.write(contents)
|
|
||||||
f.close()
|
|
||||||
|
|
||||||
if not self._validate_firewall_rules(
|
|
||||||
temp_firewall_rules_file, ip_version):
|
|
||||||
os.remove(temp_firewall_rules_file)
|
|
||||||
raise exception.SysinvException(_(
|
|
||||||
"Error in custom firewall rule file"))
|
|
||||||
|
|
||||||
# Copy firewall rules file
|
|
||||||
os.rename(temp_firewall_rules_file, firewall_rules_file)
|
|
||||||
|
|
||||||
# Copy the updated file to shared storage
|
|
||||||
shutil.copy(firewall_rules_file,
|
|
||||||
os.path.join(tsc.CONFIG_PATH,
|
|
||||||
constants.FIREWALL_RULES_FILE))
|
|
||||||
|
|
||||||
personalities = [constants.CONTROLLER]
|
|
||||||
config_uuid = self._config_update_hosts(context, personalities)
|
|
||||||
config_dict = {
|
|
||||||
'personalities': personalities,
|
|
||||||
'file_names': [firewall_rules_file],
|
|
||||||
'file_content': contents,
|
|
||||||
}
|
|
||||||
self._config_update_file(context, config_uuid, config_dict)
|
|
||||||
|
|
||||||
config_uuid = self._config_update_hosts(context, personalities)
|
|
||||||
config_dict = {
|
|
||||||
"personalities": personalities,
|
|
||||||
"classes": ['platform::firewall::runtime']
|
|
||||||
}
|
|
||||||
self._config_apply_runtime_manifest(context,
|
|
||||||
config_uuid,
|
|
||||||
config_dict)
|
|
||||||
return firewall_sig
|
|
||||||
|
|
||||||
def install_license_file(self, context, contents):
|
def install_license_file(self, context, contents):
|
||||||
"""Notify agent to install license file with the supplied data.
|
"""Notify agent to install license file with the supplied data.
|
||||||
|
|
||||||
|
|||||||
@ -1569,20 +1569,6 @@ class ConductorAPI(sysinv.openstack.common.rpc.proxy.RpcProxy):
|
|||||||
return self.call(context,
|
return self.call(context,
|
||||||
self.make_msg('get_software_upgrade_status'))
|
self.make_msg('get_software_upgrade_status'))
|
||||||
|
|
||||||
def update_firewall_config(self, context, ip_version, contents):
|
|
||||||
"""Synchronously, have the conductor update the firewall config
|
|
||||||
and manifest.
|
|
||||||
|
|
||||||
:param context: request context.
|
|
||||||
:param ip_version: IP version.
|
|
||||||
:param contents: file content of custom firewall rules.
|
|
||||||
|
|
||||||
"""
|
|
||||||
return self.call(context,
|
|
||||||
self.make_msg('update_firewall_config',
|
|
||||||
ip_version=ip_version,
|
|
||||||
contents=contents))
|
|
||||||
|
|
||||||
def distribute_ceph_external_config(self, context, ceph_conf_filename):
|
def distribute_ceph_external_config(self, context, ceph_conf_filename):
|
||||||
"""Synchronously, have the conductor update the Ceph configuration
|
"""Synchronously, have the conductor update the Ceph configuration
|
||||||
file for external cluster.
|
file for external cluster.
|
||||||
|
|||||||
@ -29,7 +29,6 @@ from sysinv.objects import controller_fs
|
|||||||
from sysinv.objects import cpu
|
from sysinv.objects import cpu
|
||||||
from sysinv.objects import datanetwork
|
from sysinv.objects import datanetwork
|
||||||
from sysinv.objects import disk
|
from sysinv.objects import disk
|
||||||
from sysinv.objects import firewallrules
|
|
||||||
from sysinv.objects import partition
|
from sysinv.objects import partition
|
||||||
from sysinv.objects import dns
|
from sysinv.objects import dns
|
||||||
from sysinv.objects import drbdconfig
|
from sysinv.objects import drbdconfig
|
||||||
@ -135,7 +134,6 @@ port = port.Port
|
|||||||
ethernet_port = port_ethernet.EthernetPort
|
ethernet_port = port_ethernet.EthernetPort
|
||||||
disk = disk.Disk
|
disk = disk.Disk
|
||||||
partition = partition.Partition
|
partition = partition.Partition
|
||||||
firewallrules = firewallrules.FirewallRules
|
|
||||||
storage = storage.Storage
|
storage = storage.Storage
|
||||||
journal = journal.Journal
|
journal = journal.Journal
|
||||||
lvg = lvg.LVG
|
lvg = lvg.LVG
|
||||||
@ -247,7 +245,6 @@ __all__ = (system,
|
|||||||
tpmconfig,
|
tpmconfig,
|
||||||
tpmdevice,
|
tpmdevice,
|
||||||
certificate,
|
certificate,
|
||||||
firewallrules,
|
|
||||||
objectify,
|
objectify,
|
||||||
storage_file,
|
storage_file,
|
||||||
storage_external,
|
storage_external,
|
||||||
|
|||||||
@ -1,34 +0,0 @@
|
|||||||
# Copyright (c) 2015-2016 Wind River Systems, Inc.
|
|
||||||
#
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
#
|
|
||||||
|
|
||||||
# vim: tabstop=4 shiftwidth=4 softtabstop=4
|
|
||||||
# coding=utf-8
|
|
||||||
#
|
|
||||||
|
|
||||||
from sysinv.db import api as db_api
|
|
||||||
from sysinv.objects import base
|
|
||||||
from sysinv.objects import utils
|
|
||||||
|
|
||||||
|
|
||||||
def _get_firewall_sig(field, db_object):
|
|
||||||
return db_object.value
|
|
||||||
|
|
||||||
|
|
||||||
class FirewallRules(base.SysinvObject):
|
|
||||||
# VERSION 1.0: Initial version
|
|
||||||
VERSION = '1.0'
|
|
||||||
|
|
||||||
dbapi = db_api.get_instance()
|
|
||||||
|
|
||||||
fields = {'uuid': utils.uuid_or_none, # uuid of service_parameter
|
|
||||||
'firewall_sig': _get_firewall_sig
|
|
||||||
}
|
|
||||||
|
|
||||||
@base.remotable_classmethod
|
|
||||||
def get_by_uuid(cls, context, uuid):
|
|
||||||
return cls.dbapi.service_parameter_get(uuid)
|
|
||||||
|
|
||||||
def save_changes(self, context, updates):
|
|
||||||
self.dbapi.service_parameter_update(self.uuid, updates)
|
|
||||||
@ -4,8 +4,6 @@
|
|||||||
# SPDX-License-Identifier: Apache-2.0
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
#
|
#
|
||||||
|
|
||||||
import os
|
|
||||||
|
|
||||||
from sysinv.common import constants
|
from sysinv.common import constants
|
||||||
from sysinv.common import exception
|
from sysinv.common import exception
|
||||||
from sysinv.common import utils
|
from sysinv.common import utils
|
||||||
@ -43,7 +41,6 @@ class PlatformPuppet(base.BasePuppet):
|
|||||||
config.update(self._get_region_config())
|
config.update(self._get_region_config())
|
||||||
config.update(self._get_distributed_cloud_role())
|
config.update(self._get_distributed_cloud_role())
|
||||||
config.update(self._get_sm_config())
|
config.update(self._get_sm_config())
|
||||||
config.update(self._get_firewall_config())
|
|
||||||
config.update(self._get_drbd_sync_config())
|
config.update(self._get_drbd_sync_config())
|
||||||
config.update(self._get_remotelogging_config())
|
config.update(self._get_remotelogging_config())
|
||||||
config.update(self._get_snmp_config())
|
config.update(self._get_snmp_config())
|
||||||
@ -326,16 +323,6 @@ class PlatformPuppet(base.BasePuppet):
|
|||||||
multicast_address.address,
|
multicast_address.address,
|
||||||
}
|
}
|
||||||
|
|
||||||
def _get_firewall_config(self):
|
|
||||||
config = {}
|
|
||||||
rules_filepath = os.path.join(tsconfig.PLATFORM_CONF_PATH,
|
|
||||||
'iptables.rules')
|
|
||||||
if os.path.isfile(rules_filepath):
|
|
||||||
config.update({
|
|
||||||
'platform::firewall::oam::rules_file': rules_filepath
|
|
||||||
})
|
|
||||||
return config
|
|
||||||
|
|
||||||
def _get_host_platform_config(self, host, config_uuid):
|
def _get_host_platform_config(self, host, config_uuid):
|
||||||
if not config_uuid:
|
if not config_uuid:
|
||||||
config_uuid = host.config_target
|
config_uuid = host.config_target
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user