8060b526e1
Some commands are having different results when used in another language environment. For example ifconfig output parsing fails in my language. Also unittest using cat failed, as it didnt expect czech language in the error message. This small patch makes it work. Also adding myself to 'Authors' file.
188 lines
6.6 KiB
Bash
Executable File
188 lines
6.6 KiB
Bash
Executable File
#! /bin/sh
|
|
|
|
# vim: tabstop=4 shiftwidth=4 softtabstop=4
|
|
|
|
# Copyright 2010 United States Government as represented by the
|
|
# Administrator of the National Aeronautics and Space Administration.
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
# NOTE(vish): This script sets up some reasonable defaults for iptables and
|
|
# creates nova-specific chains. If you use this script you should
|
|
# run nova-network and nova-compute with --use_nova_chains=True
|
|
|
|
|
|
# NOTE(vish): If you run public nova-api on a different port, make sure to
|
|
# change the port here
|
|
|
|
if [ -f /etc/default/nova-iptables ] ; then
|
|
. /etc/default/nova-iptables
|
|
fi
|
|
|
|
export LC_ALL=C
|
|
|
|
API_PORT=${API_PORT:-"8773"}
|
|
|
|
if [ ! -n "$IP" ]; then
|
|
# NOTE(vish): IP address is what address the services ALLOW on.
|
|
# This will just get the first ip in the list, so if you
|
|
# have more than one eth device set up, this will fail, and
|
|
# you should explicitly pass in the ip of the instance
|
|
IP=`ifconfig | grep -m 1 'inet addr:'| cut -d: -f2 | awk '{print $1}'`
|
|
fi
|
|
|
|
if [ ! -n "$PRIVATE_RANGE" ]; then
|
|
#NOTE(vish): PRIVATE_RANGE: range is ALLOW to access DHCP
|
|
PRIVATE_RANGE="192.168.0.0/12"
|
|
fi
|
|
|
|
if [ ! -n "$MGMT_IP" ]; then
|
|
# NOTE(vish): Management IP is the ip over which to allow ssh traffic. It
|
|
# will also allow traffic to nova-api
|
|
MGMT_IP="$IP"
|
|
fi
|
|
|
|
if [ ! -n "$DMZ_IP" ]; then
|
|
# NOTE(vish): DMZ IP is the ip over which to allow api & objectstore access
|
|
DMZ_IP="$IP"
|
|
fi
|
|
|
|
clear_nova_iptables() {
|
|
iptables -P INPUT ACCEPT
|
|
iptables -P FORWARD ACCEPT
|
|
iptables -P OUTPUT ACCEPT
|
|
iptables -F
|
|
iptables -t nat -F
|
|
iptables -F services
|
|
iptables -X services
|
|
# HACK: re-adding fail2ban rules :(
|
|
iptables -N fail2ban-ssh
|
|
iptables -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
|
|
iptables -A fail2ban-ssh -j RETURN
|
|
}
|
|
|
|
load_nova_iptables() {
|
|
|
|
iptables -P INPUT DROP
|
|
iptables -A INPUT -m state --state INVALID -j DROP
|
|
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
# NOTE(ja): allow localhost for everything
|
|
iptables -A INPUT -d 127.0.0.1/32 -j ACCEPT
|
|
# NOTE(ja): 22 only allowed MGMT_IP before, but we widened it to any
|
|
# address, since ssh should be listening only on internal
|
|
# before we re-add this rule we will need to add
|
|
# flexibility for RSYNC between omega/stingray
|
|
iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
|
|
iptables -A INPUT -m udp -p udp --dport 123 -j ACCEPT
|
|
iptables -A INPUT -p icmp -j ACCEPT
|
|
iptables -N services
|
|
iptables -A INPUT -j services
|
|
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
|
|
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
|
|
|
|
iptables -P FORWARD DROP
|
|
iptables -A FORWARD -m state --state INVALID -j DROP
|
|
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
|
|
|
|
# NOTE(vish): DROP on output is too restrictive for now. We need to add
|
|
# in a bunch of more specific output rules to use it.
|
|
# iptables -P OUTPUT DROP
|
|
iptables -A OUTPUT -m state --state INVALID -j DROP
|
|
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
if [ -n "$GANGLIA" ] || [ -n "$ALL" ]; then
|
|
iptables -A services -m tcp -p tcp -d $IP --dport 8649 -j ACCEPT
|
|
iptables -A services -m udp -p udp -d $IP --dport 8649 -j ACCEPT
|
|
fi
|
|
|
|
# if [ -n "$WEB" ] || [ -n "$ALL" ]; then
|
|
# # NOTE(vish): This opens up ports for web access, allowing web-based
|
|
# # dashboards to work.
|
|
# iptables -A services -m tcp -p tcp -d $IP --dport 80 -j ACCEPT
|
|
# iptables -A services -m tcp -p tcp -d $IP --dport 443 -j ACCEPT
|
|
# fi
|
|
|
|
if [ -n "$OBJECTSTORE" ] || [ -n "$ALL" ]; then
|
|
# infrastructure
|
|
iptables -A services -m tcp -p tcp -d $IP --dport 3333 -j ACCEPT
|
|
# clients
|
|
iptables -A services -m tcp -p tcp -d $DMZ_IP --dport 3333 -j ACCEPT
|
|
fi
|
|
|
|
if [ -n "$API" ] || [ -n "$ALL" ]; then
|
|
iptables -A services -m tcp -p tcp -d $IP --dport $API_PORT -j ACCEPT
|
|
if [ "$IP" != "$DMZ_IP" ]; then
|
|
iptables -A services -m tcp -p tcp -d $DMZ_IP --dport $API_PORT -j ACCEPT
|
|
fi
|
|
if [ "$IP" != "$MGMT_IP" ] && [ "$DMZ_IP" != "$MGMT_IP" ]; then
|
|
iptables -A services -m tcp -p tcp -d $MGMT_IP --dport $API_PORT -j ACCEPT
|
|
fi
|
|
fi
|
|
|
|
if [ -n "$REDIS" ] || [ -n "$ALL" ]; then
|
|
iptables -A services -m tcp -p tcp -d $IP --dport 6379 -j ACCEPT
|
|
fi
|
|
|
|
if [ -n "$MYSQL" ] || [ -n "$ALL" ]; then
|
|
iptables -A services -m tcp -p tcp -d $IP --dport 3306 -j ACCEPT
|
|
fi
|
|
|
|
if [ -n "$RABBITMQ" ] || [ -n "$ALL" ]; then
|
|
iptables -A services -m tcp -p tcp -d $IP --dport 4369 -j ACCEPT
|
|
iptables -A services -m tcp -p tcp -d $IP --dport 5672 -j ACCEPT
|
|
iptables -A services -m tcp -p tcp -d $IP --dport 53284 -j ACCEPT
|
|
fi
|
|
|
|
if [ -n "$DNSMASQ" ] || [ -n "$ALL" ]; then
|
|
# NOTE(vish): this could theoretically be setup per network
|
|
# for each host, but it seems like overkill
|
|
iptables -A services -m tcp -p tcp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
|
|
iptables -A services -m udp -p udp -s $PRIVATE_RANGE --dport 53 -j ACCEPT
|
|
iptables -A services -m udp -p udp --dport 67 -j ACCEPT
|
|
fi
|
|
|
|
if [ -n "$LDAP" ] || [ -n "$ALL" ]; then
|
|
iptables -A services -m tcp -p tcp -d $IP --dport 389 -j ACCEPT
|
|
fi
|
|
|
|
if [ -n "$ISCSI" ] || [ -n "$ALL" ]; then
|
|
iptables -A services -m tcp -p tcp -d $IP --dport 3260 -j ACCEPT
|
|
iptables -A services -m tcp -p tcp -d 127.0.0.0/16 --dport 3260 -j ACCEPT
|
|
fi
|
|
}
|
|
|
|
|
|
case "$1" in
|
|
start)
|
|
echo "Starting nova-iptables: "
|
|
load_nova_iptables
|
|
;;
|
|
stop)
|
|
echo "Clearing nova-iptables: "
|
|
clear_nova_iptables
|
|
;;
|
|
restart)
|
|
echo "Restarting nova-iptables: "
|
|
clear_nova_iptables
|
|
load_nova_iptables
|
|
;;
|
|
*)
|
|
echo "Usage: $NAME {start|stop|restart}" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
exit 0
|