/var/lib/one/remotes/vnm/ebtables/Ebtables.rb is in opennebula 3.2.1-2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 | # -------------------------------------------------------------------------- #
# Copyright 2002-2012, OpenNebula Project Leads (OpenNebula.org) #
# #
# Licensed under the Apache License, Version 2.0 (the "License"); you may #
# not use this file except in compliance with the License. You may obtain #
# a copy of the License at #
# #
# http://www.apache.org/licenses/LICENSE-2.0 #
# #
# Unless required by applicable law or agreed to in writing, software #
# distributed under the License is distributed on an "AS IS" BASIS, #
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. #
# See the License for the specific language governing permissions and #
# limitations under the License. #
#--------------------------------------------------------------------------- #
require 'OpenNebulaNetwork'
class EbtablesVLAN < OpenNebulaNetwork
XPATH_FILTER = "TEMPLATE/NIC[VLAN='YES']"
def initialize(vm, deploy_id = nil, hypervisor = nil)
super(vm,XPATH_FILTER,deploy_id,hypervisor)
end
def ebtables(rule)
OpenNebula.exec_and_log("#{COMMANDS[:ebtables]} -A #{rule}")
end
# Activates ebtables rules
#
def activate
process do |nic|
tap = nic[:tap]
if tap
iface_mac = nic[:mac]
mac = iface_mac.split(':')
mac[-1] = '00'
net_mac = mac.join(':')
in_rule="FORWARD -s ! #{net_mac}/ff:ff:ff:ff:ff:00 " <<
"-o #{tap} -j DROP"
out_rule="FORWARD -s ! #{iface_mac} -i #{tap} -j DROP"
ebtables(in_rule)
ebtables(out_rule)
end
end
return 0
end
def deactivate
process do |nic|
mac = nic[:mac]
# remove 0-padding
mac = mac.split(":").collect{|e| e.hex.to_s(16)}.join(":")
tap = ""
rules.each do |rule|
if m = rule.match(/#{mac} -i (\w+)/)
tap = m[1]
break
end
end
remove_rules(tap)
end
return 0
end
def rules
`#{COMMANDS[:ebtables]} -L FORWARD`.split("\n")[3..-1]
end
def remove_rules(tap)
rules.each do |rule|
if rule.match(tap)
remove_rule(rule)
end
end
end
def remove_rule(rule)
OpenNebula.exec_and_log("#{COMMANDS[:ebtables]} -D FORWARD #{rule}")
end
end
|