wido commented on a change in pull request #2505: CLOUDSTACK-10333: Secure Live
VM Migration for KVM
URL: https://github.com/apache/cloudstack/pull/2505#discussion_r176992891
##########
File path: debian/cloudstack-agent.postinst
##########
@@ -50,6 +50,13 @@ case "$1" in
mkdir /etc/libvirt/hooks
fi
cp -a /usr/share/cloudstack-agent/lib/libvirtqemuhook
/etc/libvirt/hooks/qemu
+
+ # Enable TLS enabled VM migration for libvirtd
+ if ! iptables-save | grep -- "-A INPUT -p tcp -m tcp --dport 16514 -j
ACCEPT" > /dev/null; then
+ iptables -t filter -A INPUT -p tcp -m tcp --dport 16514 -j ACCEPT
+ iptables-save > /etc/iptables/rules.v4
+ fi
+
Review comment:
If users are using firewalld or ufw on their CentOS/Ubuntu system this may
break things. And like I said, /etc/iptables does not exist on Ubuntu systems
by default, you need the iptables-persistent package for that.
I wouldn't touch the firewall in a postinst of a package. The package should
not touch parts of the system it's not configuring.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
