CLOUDSTACK-8650: Fix securitygroups ingress FW for protocol any and 0.0.0.0/0
Change way 0.0.0.0/0 + all is handles, as per feedback in Slack channel Signed-off-by: wilderrodrigues <[email protected]> Project: http://git-wip-us.apache.org/repos/asf/cloudstack/repo Commit: http://git-wip-us.apache.org/repos/asf/cloudstack/commit/4705d75d Tree: http://git-wip-us.apache.org/repos/asf/cloudstack/tree/4705d75d Diff: http://git-wip-us.apache.org/repos/asf/cloudstack/diff/4705d75d Branch: refs/heads/reporter Commit: 4705d75d4a7fd58def45ec3e70ed5118e0334cf7 Parents: 2e79c62 Author: Frank Louwers <[email protected]> Authored: Fri Jul 17 15:33:07 2015 +0200 Committer: wilderrodrigues <[email protected]> Committed: Thu Jul 23 08:36:05 2015 +0200 ---------------------------------------------------------------------- scripts/vm/network/security_group.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cloudstack/blob/4705d75d/scripts/vm/network/security_group.py ---------------------------------------------------------------------- diff --git a/scripts/vm/network/security_group.py b/scripts/vm/network/security_group.py index 7279518..c4a6753 100755 --- a/scripts/vm/network/security_group.py +++ b/scripts/vm/network/security_group.py @@ -860,8 +860,10 @@ def add_network_rules(vm_name, vm_id, vm_ip, signature, seqno, vmMac, rules, vif for ip in ips: execute("iptables -I " + vmchain + " -p icmp --icmp-type " + range + " " + direction + " " + ip + " -j "+ action) - if allow_any and protocol != 'all': - if protocol != 'icmp': + if allow_any + if protocol == 'all': + execute("iptables -I " + vmchain + " -m state --state NEW " + direction + " 0.0.0.0/0 -j "+action) + elif protocol != 'icmp': execute("iptables -I " + vmchain + " -p " + protocol + " -m " + protocol + " --dport " + range + " -m state --state NEW -j "+ action) else: range = start + "/" + end
