Ejemplo n.º 1
0
 def test_remove_ip_block(self):
     """Remove ip blocks."""
     result = self.api.block_external_addresses(self.context, '1.1.1.3/32')
     self.assertEqual('OK', result['status'])
     num0 = len(db.provider_fw_rule_get_all(self.context))
     result = self.api.remove_external_address_block(self.context,
                                                     '1.1.1.3/32')
     self.assertEqual('OK', result['status'])
     self.assertEqual('Deleted 3 rules', result['message'])
     num1 = len(db.provider_fw_rule_get_all(self.context))
     self.assert_(num1 < num0)
Ejemplo n.º 2
0
 def describe_external_address_blocks(self, context):
     blocks = db.provider_fw_rule_get_all(context)
     # NOTE(todd): use a set since we have icmp/udp/tcp rules with same cidr
     blocks = set([b.cidr for b in blocks])
     blocks = [{'cidr': b} for b in blocks]
     return {'externalIpBlockInfo':
             list(sorted(blocks, key=lambda k: k['cidr']))}
Ejemplo n.º 3
0
 def _provider_fw_rule_exists(self, context, rule):
     # TODO(todd): we call this repeatedly, can we filter by protocol?
     for old_rule in db.provider_fw_rule_get_all(context):
         if all([rule[k] == old_rule[k] for k in ('cidr', 'from_port',
                                                  'to_port', 'protocol')]):
             return True
     return False
Ejemplo n.º 4
0
 def test_list_blocked_ips(self):
     """Make sure we can see the external blocks that exist."""
     self.api.block_external_addresses(self.context, '1.1.1.2/32')
     result = self.api.describe_external_address_blocks(self.context)
     num = len(db.provider_fw_rule_get_all(self.context))
     self.api.remove_external_address_block(self.context, '1.1.1.2/32')
     # we only list IP, not tcp/udp/icmp rules
     self.assertEqual(num / 3, len(result['externalIpBlockInfo']))
Ejemplo n.º 5
0
 def describe_external_address_blocks(self, context):
     blocks = db.provider_fw_rule_get_all(context)
     # NOTE(todd): use a set since we have icmp/udp/tcp rules with same cidr
     blocks = set([b.cidr for b in blocks])
     blocks = [{'cidr': b} for b in blocks]
     return {
         'externalIpBlockInfo': list(sorted(blocks,
                                            key=lambda k: k['cidr']))
     }
Ejemplo n.º 6
0
 def _provider_fw_rule_exists(self, context, rule):
     # TODO(todd): we call this repeatedly, can we filter by protocol?
     for old_rule in db.provider_fw_rule_get_all(context):
         if all([
                 rule[k] == old_rule[k]
                 for k in ('cidr', 'from_port', 'to_port', 'protocol')
         ]):
             return True
     return False
Ejemplo n.º 7
0
    def _provider_rules():
        """Generate a list of rules from provider for IP4 & IP6."""
        ctxt = context.get_admin_context()
        ipv4_rules = []
        ipv6_rules = []
        rules = db.provider_fw_rule_get_all(ctxt)
        for rule in rules:
            LOG.debug(_('Adding provider rule: %s'), rule['cidr'])
            version = netutils.get_ip_version(rule['cidr'])
            if version == 4:
                fw_rules = ipv4_rules
            else:
                fw_rules = ipv6_rules

            protocol = rule['protocol']
            if version == 6 and protocol == 'icmp':
                protocol = 'icmpv6'

            args = ['-p', protocol, '-s', rule['cidr']]

            if protocol in ['udp', 'tcp']:
                if rule['from_port'] == rule['to_port']:
                    args += ['--dport', '%s' % (rule['from_port'],)]
                else:
                    args += ['-m', 'multiport',
                             '--dports', '%s:%s' % (rule['from_port'],
                                                    rule['to_port'])]
            elif protocol == 'icmp':
                icmp_type = rule['from_port']
                icmp_code = rule['to_port']

                if icmp_type == -1:
                    icmp_type_arg = None
                else:
                    icmp_type_arg = '%s' % icmp_type
                    if not icmp_code == -1:
                        icmp_type_arg += '/%s' % icmp_code

                if icmp_type_arg:
                    if version == 4:
                        args += ['-m', 'icmp', '--icmp-type',
                                 icmp_type_arg]
                    elif version == 6:
                        args += ['-m', 'icmp6', '--icmpv6-type',
                                 icmp_type_arg]
            args += ['-j DROP']
            fw_rules += [' '.join(args)]
        return ipv4_rules, ipv6_rules
Ejemplo n.º 8
0
    def _provider_rules():
        """Generate a list of rules from provider for IP4 & IP6."""
        ctxt = context.get_admin_context()
        ipv4_rules = []
        ipv6_rules = []
        rules = db.provider_fw_rule_get_all(ctxt)
        for rule in rules:
            LOG.debug(_('Adding provider rule: %s'), rule['cidr'])
            version = netutils.get_ip_version(rule['cidr'])
            if version == 4:
                fw_rules = ipv4_rules
            else:
                fw_rules = ipv6_rules

            protocol = rule['protocol']
            if version == 6 and protocol == 'icmp':
                protocol = 'icmpv6'

            args = ['-p', protocol, '-s', rule['cidr']]

            if protocol in ['udp', 'tcp']:
                if rule['from_port'] == rule['to_port']:
                    args += ['--dport', '%s' % (rule['from_port'], )]
                else:
                    args += [
                        '-m', 'multiport', '--dports',
                        '%s:%s' % (rule['from_port'], rule['to_port'])
                    ]
            elif protocol == 'icmp':
                icmp_type = rule['from_port']
                icmp_code = rule['to_port']

                if icmp_type == -1:
                    icmp_type_arg = None
                else:
                    icmp_type_arg = '%s' % icmp_type
                    if not icmp_code == -1:
                        icmp_type_arg += '/%s' % icmp_code

                if icmp_type_arg:
                    if version == 4:
                        args += ['-m', 'icmp', '--icmp-type', icmp_type_arg]
                    elif version == 6:
                        args += ['-m', 'icmp6', '--icmpv6-type', icmp_type_arg]
            args += ['-j DROP']
            fw_rules += [' '.join(args)]
        return ipv4_rules, ipv6_rules
Ejemplo n.º 9
0
    def provider_fw_to_nwfilter_xml():
        """Compose a filter of drop rules from specified cidrs."""
        rule_xml = ""
        v6protocol = {'tcp': 'tcp-ipv6', 'udp': 'udp-ipv6', 'icmp': 'icmpv6'}
        rules = db.provider_fw_rule_get_all(context.get_admin_context())
        for rule in rules:
            rule_xml += "<rule action='block' direction='in' priority='150'>"
            version = netutils.get_ip_version(rule.cidr)
            if (FLAGS.use_ipv6 and version == 6):
                net, prefixlen = netutils.get_net_and_prefixlen(rule.cidr)
                rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
                            (v6protocol[rule.protocol], net, prefixlen)
            else:
                net, mask = netutils.get_net_and_mask(rule.cidr)
                rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
                            (rule.protocol, net, mask)
            if rule.protocol in ['tcp', 'udp']:
                rule_xml += "dstportstart='%s' dstportend='%s' " % \
                            (rule.from_port, rule.to_port)
            elif rule.protocol == 'icmp':
                LOG.info(
                    'rule.protocol: %r, rule.from_port: %r, '
                    'rule.to_port: %r', rule.protocol, rule.from_port,
                    rule.to_port)
                if rule.from_port != -1:
                    rule_xml += "type='%s' " % rule.from_port
                if rule.to_port != -1:
                    rule_xml += "code='%s' " % rule.to_port

                rule_xml += '/>\n'
            rule_xml += "</rule>\n"
        xml = "<filter name='engine-provider-rules' "
        if (FLAGS.use_ipv6):
            xml += "chain='root'>%s</filter>" % rule_xml
        else:
            xml += "chain='ipv4'>%s</filter>" % rule_xml
        return xml
Ejemplo n.º 10
0
    def provider_fw_to_nwfilter_xml():
        """Compose a filter of drop rules from specified cidrs."""
        rule_xml = ""
        v6protocol = {'tcp': 'tcp-ipv6', 'udp': 'udp-ipv6', 'icmp': 'icmpv6'}
        rules = db.provider_fw_rule_get_all(context.get_admin_context())
        for rule in rules:
            rule_xml += "<rule action='block' direction='in' priority='150'>"
            version = netutils.get_ip_version(rule.cidr)
            if(FLAGS.use_ipv6 and version == 6):
                net, prefixlen = netutils.get_net_and_prefixlen(rule.cidr)
                rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
                            (v6protocol[rule.protocol], net, prefixlen)
            else:
                net, mask = netutils.get_net_and_mask(rule.cidr)
                rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
                            (rule.protocol, net, mask)
            if rule.protocol in ['tcp', 'udp']:
                rule_xml += "dstportstart='%s' dstportend='%s' " % \
                            (rule.from_port, rule.to_port)
            elif rule.protocol == 'icmp':
                LOG.info('rule.protocol: %r, rule.from_port: %r, '
                         'rule.to_port: %r', rule.protocol,
                         rule.from_port, rule.to_port)
                if rule.from_port != -1:
                    rule_xml += "type='%s' " % rule.from_port
                if rule.to_port != -1:
                    rule_xml += "code='%s' " % rule.to_port

                rule_xml += '/>\n'
            rule_xml += "</rule>\n"
        xml = "<filter name='engine-provider-rules' "
        if(FLAGS.use_ipv6):
            xml += "chain='root'>%s</filter>" % rule_xml
        else:
            xml += "chain='ipv4'>%s</filter>" % rule_xml
        return xml