#!/usr/bin/python # Version @VERSION@ # # A plugin for executing script needed by vmops cloud import os, sys, time import XenAPIPlugin sys.path.extend(["/opt/xensource/sm/", "/usr/local/sbin/", "/sbin/"]) import base64 import hostvmstats import socket import stat import tempfile import util def echo(fn): def wrapped(*v, **k): name = fn.__name__ util.SMlog("#### VMOPS enter %s ####" % name ) res = fn(*v, **k) util.SMlog("#### VMOPS exit %s ####" % name ) return res return wrapped @echo def gethostvmstats(session, args): collect_host_stats = args['collectHostStats'] consolidation_function = args['consolidationFunction'] interval = args['interval'] start_time = args['startTime'] result = hostvmstats.get_stats(session, collect_host_stats, consolidation_function, interval, start_time) return result @echo def setup_iscsi(session, args): uuid=args['uuid'] try: cmd = ["bash", "/opt/xensource/bin/setup_iscsi.sh", uuid] txt = util.pread2(cmd) except: txt = '' return txt @echo def getvncport(session, args): domid = args['domID'] hvm = args['hvm'] if hvm == 'true': path1 = "/local/domain/" + domid + "/qemu-pid" path2 = "/local/domain/" + domid + "/console/vnc-port" else: path1 = "/local/domain/" + domid + "/serial/0/vncterm-pid" path2 = "/local/domain/" + domid + "/serial/0/vnc-port" try: cmd = ["xenstore-read", path1] pid = util.pread2(cmd) pid = pid.strip() cmd = ["ps", pid] util.pread2(cmd) cmd = ["xenstore-read", path2] vncport = util.pread2(cmd) vncport = vncport.strip() return vncport except: return '' @echo def getgateway(session, args): mgmt_ip = args['mgmtIP'] try: cmd = ["bash", "/opt/xensource/bin/network_info.sh", "-g", mgmt_ip] txt = util.pread2(cmd) except: txt = '' return txt @echo def preparemigration(session, args): uuid = args['uuid'] try: cmd = ["/opt/xensource/bin/make_migratable.sh", uuid] util.pread2(cmd) txt = 'success' except: util.SMlog("Catch prepare migration exception" ) txt = '' return txt @echo def setIptables(session, args): try: cmd = ["/bin/bash", "/opt/xensource/bin/setupxenserver.sh"] txt = util.pread2(cmd) txt = 'success' except: util.SMlog(" setIptables execution failed " ) txt = '' return txt @echo def pingdomr(session, args): host = args['host'] port = args['port'] socket.setdefaulttimeout(3) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: s.connect((host,int(port))) txt = 'success' except: txt = '' s.close() return txt @echo def pingxenserver(session, args): txt = 'success' return txt @echo def ipassoc(session, args): sargs = args['args'] cmd = sargs.split(' ') cmd.insert(0, "/opt/xensource/bin/ipassoc.sh") cmd.insert(0, "/bin/bash") try: txt = util.pread2(cmd) txt = 'success' except: util.SMlog(" ip associate failed " ) txt = '' return txt @echo def vm_data(session, args): router_ip = args.pop('routerIP') vm_ip = args.pop('vmIP') util.SMlog(" adding vmdata for VM with IP: " + vm_ip + " to router with IP: " + router_ip) for pair in args: pairList = pair.split(',') vmDataFolder = pairList[0] vmDataFile = pairList[1] vmDataValue = args[pair] cmd = ["/bin/bash", "/opt/xensource/bin/vm_data.sh", "-r", router_ip, "-v", vm_ip, "-F", vmDataFolder, "-f", vmDataFile] fd = None tmp_path = None if (vmDataValue != "none"): try: fd,tmp_path = tempfile.mkstemp() tmpfile = open(tmp_path, 'w') if (vmDataFolder == "userdata"): vmDataValue = base64.urlsafe_b64decode(vmDataValue) tmpfile.write(vmDataValue) tmpfile.close() cmd.append("-d") cmd.append(tmp_path) except: util.SMlog(" vmdata failed to write tempfile " ) os.close(fd) os.remove(tmp_path) return '' try: txt = util.pread2(cmd) txt = 'success' except: util.SMlog(" vmdata failed with folder: " + vmDataFolder + " and file: " + vmDataFile) txt = '' if (fd != None): os.close(fd) os.remove(tmp_path) return txt def pingtest(session, args): sargs = args['args'] cmd = sargs.split(' ') cmd.insert(0, "/opt/xensource/bin/pingtest.sh") cmd.insert(0, "/bin/bash") try: txt = util.pread2(cmd) txt = 'success' except: util.SMlog(" pingtest failed " ) txt = '' return txt @echo def savePassword(session, args): sargs = args['args'] cmd = sargs.split(' ') cmd.insert(0, "/opt/xensource/bin/save_password_to_domr.sh") cmd.insert(0, "/bin/bash") try: txt = util.pread2(cmd) txt = 'success' except: util.SMlog(" save password to domr failed " ) txt = '' return txt @echo def saveDhcpEntry(session, args): sargs = args['args'] cmd = sargs.split(' ') cmd.insert(0, "/opt/xensource/bin/dhcp_entry.sh") cmd.insert(0, "/bin/bash") try: txt = util.pread2(cmd) txt = 'success' except: util.SMlog(" save dhcp entry failed " ) txt = '' return txt @echo def lt2p_vpn(session, args): sargs = args['args'] cmd = sargs.split(' ') cmd.insert(0, "/opt/xensource/bin/l2tp_vpn.sh") cmd.insert(0, "/bin/bash") try: txt = util.pread2(cmd) txt = 'success' except: util.SMlog("l2tp vpn failed " ) txt = '' return txt @echo def setLinkLocalIP(session, args): brName = args['brName'] try: cmd = ["ip", "route", "del", "169.254.0.0/16"] txt = util.pread2(cmd) except: txt = '' try: cmd = ["ifconfig", brName, "169.254.0.1", "netmask", "255.255.0.0"] txt = util.pread2(cmd) except: txt = '' try: cmd = ["ip", "route", "add", "169.254.0.0/16", "dev", brName, "src", "169.254.0.1"] txt = util.pread2(cmd) except: txt = '' txt = 'success' return txt @echo def setFirewallRule(session, args): sargs = args['args'] cmd = sargs.split(' ') cmd.insert(0, "/opt/xensource/bin/call_firewall.sh") cmd.insert(0, "/bin/bash") try: txt = util.pread2(cmd) txt = 'success' except: util.SMlog(" set firewall rule failed " ) txt = '' return txt @echo def setLoadBalancerRule(session, args): sargs = args['args'] cmd = sargs.split(' ') cmd.insert(0, "/opt/xensource/bin/call_loadbalancer.sh") cmd.insert(0, "/bin/bash") try: txt = util.pread2(cmd) txt = 'success' except: util.SMlog(" set loadbalancer rule failed " ) txt = '' return txt @echo def createFile(session, args): file_path = args['filepath'] file_contents = args['filecontents'] try: f = open(file_path, "w") f.write(file_contents) f.close() txt = 'success' except: util.SMlog(" failed to create HA proxy cfg file ") txt = '' return txt @echo def deleteFile(session, args): file_path = args["filepath"] try: if os.path.isfile(file_path): os.remove(file_path) txt = 'success' except: util.SMlog(" failed to remove HA proxy cfg file ") txt = '' return txt @echo def networkUsage(session, args): sargs = args['args'] cmd = sargs.split(' ') cmd.insert(0, "/opt/xensource/bin/networkUsage.sh") cmd.insert(0, "/bin/bash") try: txt = util.pread2(cmd) except: util.SMlog(" network usage error " ) txt = '' return txt def get_private_nic(session, args): vms = session.xenapi.VM.get_all() host_uuid = args.get('host_uuid') host = session.xenapi.host.get_by_uuid(host_uuid) piflist = session.xenapi.host.get_PIFs(host) mgmtnic = 'eth0' for pif in piflist: pifrec = session.xenapi.PIF.get_record(pif) network = pifrec.get('network') nwrec = session.xenapi.network.get_record(network) if nwrec.get('name_label') == 'cloud-guest': return pifrec.get('device') if pifrec.get('management'): mgmtnic = pifrec.get('device') return mgmtnic def chain_name(vm_name): if vm_name.startswith('i-') or vm_name.startswith('r-'): if vm_name.endswith('untagged'): return '-'.join(vm_name.split('-')[:-1]) return '-'.join(vm_name.split('-')) return vm_name def chain_name_def(vm_name): if vm_name.startswith('i-') or vm_name.startswith('r-'): if vm_name.endswith('untagged'): return '-'.join(vm_name.split('-')[:-2]) + "-def" return '-'.join(vm_name.split('-')[:-1]) + "-def" return vm_name @echo def can_bridge_firewall(session, args): host_uuid = args.get('host_uuid') try: util.pread2(['iptables', '-N', 'BRIDGE-FIREWALL']) util.pread2(['iptables', '-I', 'BRIDGE-FIREWALL', '-m', 'state', '--state', 'RELATED,ESTABLISHED', '-j', 'ACCEPT']) util.pread2(['iptables', '-D', 'FORWARD', '-j', 'RH-Firewall-1-INPUT']) except: util.SMlog('Chain BRIDGE-FIREWALL already exists') privnic = get_private_nic(session, args) result = 'true' try: util.pread2(['/bin/bash', '-c', 'iptables -n -L FORWARD | grep BRIDGE-FIREWALL']) except: try: util.pread2(['iptables', '-I', 'FORWARD', '-m', 'physdev', '--physdev-is-bridged', '-j', 'BRIDGE-FIREWALL']) util.pread2(['iptables', '-A', 'FORWARD', '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', privnic, '-j', 'ACCEPT']) util.pread2(['iptables', '-A', 'FORWARD', '-j', 'DROP']) except: result = 'false' if not os.path.exists('/var/run/cloud'): os.makedirs('/var/run/cloud') cleanup_rules_for_dead_vms(session) cleanup_rules(session, args) return result def ipset(ipsetname, proto, start, end, ips): try: util.pread2(['ipset', '-N', ipsetname, 'iptreemap']) except: util.SMlog("ipset chain already exists" + ipsetname) result = True ipsettmp = ''.join(''.join(ipsetname.split('-')).split('_')) + str(int(time.time()) % 1000) try: util.pread2(['ipset', '-N', ipsettmp, 'iptreemap']) for ip in ips: try: util.pread2(['ipset', '-A', ipsettmp, ip]) except CommandException, cex: if cex.reason.rfind('already in set') == -1: raise util.pread2(['ipset', '-W', ipsettmp, ipsetname]) util.pread2(['ipset', '-X', ipsettmp]) except: util.SMlog("Failed to program ipset " + ipsetname) result = False return result @echo def destroy_network_rules_for_vm(session, args): vm_name = args.pop('vmName') vmchain = chain_name(vm_name) vmchain_default = chain_name_def(vm_name) delete_rules_for_vm_in_bridge_firewall_chain(vm_name) if vm_name.startswith('i-') or vm_name.startswith('r-'): try: util.pread2(['iptables', '-F', vmchain_default]) util.pread2(['iptables', '-X', vmchain_default]) except: util.SMlog("Ignoring failure to delete chain " + vmchain_default) destroy_ebtables_rules(vmchain) try: util.pread2(['iptables', '-F', vmchain]) util.pread2(['iptables', '-X', vmchain]) except: util.SMlog("Ignoring failure to delete chain " + vmchain) remove_rule_log_for_vm(vm_name) if 1 in [ vm_name.startswith(c) for c in ['r-', 's-', 'v-'] ]: return 'true' try: setscmd = "ipset --save | grep " + vmchain + " | grep '^-N' | awk '{print $2}'" setsforvm = util.pread2(['/bin/bash', '-c', setscmd]).split('\n') for set in setsforvm: if set != '': util.pread2(['ipset', '-F', set]) util.pread2(['ipset', '-X', set]) except: util.SMlog("Failed to destroy ipsets for %" % vm_name) return 'true' @echo def destroy_ebtables_rules(vm_chain): delcmd = "ebtables-save | grep ROUTING | grep " + vm_chain + " | sed 's/-A/-D/'" delcmds = util.pread2(['/bin/bash', '-c', delcmd]).split('\n') delcmds.pop() for cmd in delcmds: try: dc = cmd.split(' ') dc.insert(0, 'ebtables') dc.insert(1, '-t') dc.insert(2, 'nat') util.pread2(dc) except: util.SMlog("Ignoring failure to delete ebtables rules for vm " + vm_chain) chains = [vm_chain+"-in", vm_chain+"-out"] for chain in chains: try: util.pread2(['ebtables', '-t', 'nat', '-F', chain]) util.pread2(['ebtables', '-t', 'nat', '-X', chain]) except: util.SMlog("Ignoring failure to delete ebtables chain for vm " + vm_chain) @echo def default_ebtables_rules(vm_chain, vif, vm_ip, vm_mac): vmchain_in = vm_chain + "-in" vmchain_out = vm_chain + "-out" for chain in [vmchain_in, vmchain_out]: try: util.pread2(['ebtables', '-t', 'nat', '-N', chain]) except: try: util.pread2(['ebtables', '-t', 'nat', '-F', chain]) except: util.SMlog("Failed to create ebtables nat rule, skipping") return 'true' try: # -s ! 52:54:0:56:44:32 -j DROP util.pread2(['ebtables', '-t', 'nat', '-A', 'PREROUTING', '-i', vif, '-j', vmchain_in]) util.pread2(['ebtables', '-t', 'nat', '-A', 'POSTROUTING', '-o', vif, '-j', vmchain_out]) except: util.SMlog("Failed to program default rules") return 'false' try: util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_in, '-i', vif, '-s', '!', vm_mac, '-j', 'DROP']) util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_in, '-p', 'ARP', '-s', '!', vm_mac, '-j', 'DROP']) util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_in, '-p', 'ARP', '--arp-mac-src', '!', vm_mac, '-j', 'DROP']) util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_in, '-p', 'ARP', '--arp-ip-src', '!', vm_ip, '-j', 'DROP']) util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_in, '-p', 'ARP', '--arp-op', 'Request', '-j', 'ACCEPT']) util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_in, '-p', 'ARP', '--arp-op', 'Reply', '-j', 'ACCEPT']) util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_in, '-p', 'ARP', '-j', 'DROP']) except: util.SMlog("Failed to program default ebtables IN rules") return 'false' try: util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_out, '-p', 'ARP', '--arp-op', 'Reply', '--arp-mac-dst', '!', vm_mac, '-j', 'DROP']) util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_out, '-p', 'ARP', '--arp-ip-dst', '!', vm_ip, '-j', 'DROP']) util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_out, '-p', 'ARP', '--arp-op', 'Request', '-j', 'ACCEPT']) util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_out, '-p', 'ARP', '--arp-op', 'Reply', '-j', 'ACCEPT']) util.pread2(['ebtables', '-t', 'nat', '-A', vmchain_out, '-p', 'ARP', '-j', 'DROP']) except: util.SMlog("Failed to program default ebtables OUT rules") return 'false' return 'true' @echo def default_network_rules_systemvm(session, args): vm_name = args.pop('vmName') try: vm = session.xenapi.VM.get_by_name_label(vm_name) if len(vm) != 1: return 'false' vm_rec = session.xenapi.VM.get_record(vm[0]) vm_vifs = vm_rec.get('VIFs') vifnums = [session.xenapi.VIF.get_record(vif).get('device') for vif in vm_vifs] domid = vm_rec.get('domid') except: util.SMlog("### Failed to get domid or vif list for vm ##" + vm_name) return 'false' if domid == '-1': util.SMlog("### Failed to get domid for vm (-1): " + vm_name) return 'false' vifs = ["vif" + domid + "." + v for v in vifnums] #vm_name = '-'.join(vm_name.split('-')[:-1]) vmchain = chain_name(vm_name) delete_rules_for_vm_in_bridge_firewall_chain(vm_name) try: util.pread2(['iptables', '-N', vmchain]) except: util.pread2(['iptables', '-F', vmchain]) for vif in vifs: try: util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', vif, '-j', vmchain]) util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', vif, '-j', vmchain]) except: util.SMlog("Failed to program default rules") return 'false' util.pread2(['iptables', '-A', vmchain, '-j', 'ACCEPT']) if write_rule_log_for_vm(vm_name, '-1', '_ignore_', domid, '_initial_', '-1') == False: util.SMlog("Failed to log default network rules for systemvm, ignoring") return 'true' @echo def default_network_rules(session, args): vm_name = args.pop('vmName') vm_ip = args.pop('vmIP') vm_id = args.pop('vmID') vm_mac = args.pop('vmMAC') try: vm = session.xenapi.VM.get_by_name_label(vm_name) if len(vm) != 1: util.SMlog("### Failed to get record for vm " + vm_name) return 'false' vm_rec = session.xenapi.VM.get_record(vm[0]) domid = vm_rec.get('domid') except: util.SMlog("### Failed to get domid for vm " + vm_name) return 'false' if domid == '-1': util.SMlog("### Failed to get domid for vm (-1): " + vm_name) return 'false' vif = "vif" + domid + ".0" tap = "tap" + domid + ".0" vifs = [vif] try: util.pread2(['ifconfig', tap]) vifs.append(tap) except: pass delete_rules_for_vm_in_bridge_firewall_chain(vm_name) vmchain = chain_name(vm_name) vmchain_default = chain_name_def(vm_name) destroy_ebtables_rules(vmchain) try: util.pread2(['iptables', '-N', vmchain]) except: util.pread2(['iptables', '-F', vmchain]) try: util.pread2(['iptables', '-N', vmchain_default]) except: util.pread2(['iptables', '-F', vmchain_default]) try: for v in vifs: util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', v, '-j', vmchain_default]) util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', v, '-j', vmchain_default]) util.pread2(['iptables', '-A', vmchain_default, '-m', 'state', '--state', 'RELATED,ESTABLISHED', '-j', 'ACCEPT']) #allow dhcp for v in vifs: util.pread2(['iptables', '-A', vmchain_default, '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', v, '-p', 'udp', '--dport', '67', '--sport', '68', '-j', 'ACCEPT']) util.pread2(['iptables', '-A', vmchain_default, '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', v, '-p', 'udp', '--dport', '68', '--sport', '67', '-j', 'ACCEPT']) #don't let vm spoof its ip address for v in vifs: util.pread2(['iptables', '-A', vmchain_default, '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', v, '--source', vm_ip, '-j', 'RETURN']) util.pread2(['iptables', '-A', vmchain_default, '-j', vmchain]) except: util.SMlog("Failed to program default rules for vm " + vm_name) return 'false' for v in vifs: default_ebtables_rules(vmchain, v, vm_ip, vm_mac) if write_rule_log_for_vm(vm_name, vm_id, vm_ip, domid, '_initial_', '-1') == False: util.SMlog("Failed to log default network rules, ignoring") util.SMlog("Programmed default rules for vm " + vm_name) return 'true' def check_domid_changed(session, vmName): curr_domid = '-1' try: vm = session.xenapi.VM.get_by_name_label(vmName) if len(vm) != 1: util.SMlog("### Could not get record for vm ## " + vmName) else: vm_rec = session.xenapi.VM.get_record(vm[0]) curr_domid = vm_rec.get('domid') except: util.SMlog("### Failed to get domid for vm ## " + vmName) logfilename = "/var/run/cloud/" + vmName +".log" if not os.path.exists(logfilename): return ['-1', curr_domid] lines = (line.rstrip() for line in open(logfilename)) [_vmName,_vmID,_vmIP,old_domid,_signature,_seqno] = ['_', '-1', '_', '-1', '_', '-1'] for line in lines: [_vmName,_vmID,_vmIP,old_domid,_signature,_seqno] = line.split(',') break return [curr_domid, old_domid] def delete_rules_for_vm_in_bridge_firewall_chain(vmName): vm_name = vmName vmchain = chain_name_def(vm_name) delcmd = "iptables -S BRIDGE-FIREWALL | grep " + vmchain + " | sed 's/-A/-D/'" delcmds = util.pread2(['/bin/bash', '-c', delcmd]).split('\n') delcmds.pop() for cmd in delcmds: try: dc = cmd.split(' ') dc.insert(0, 'iptables') dc.pop() util.pread2(dc) except: util.SMlog("Ignoring failure to delete rules for vm " + vmName) def network_rules_for_rebooted_vm(session, vmName): vm_name = vmName [curr_domid, old_domid] = check_domid_changed(session, vm_name) if curr_domid == old_domid: return True if old_domid == '-1': return True if curr_domid == '-1': return True util.SMlog("Found a rebooted VM -- reprogramming rules for " + vm_name) delete_rules_for_vm_in_bridge_firewall_chain(vm_name) if 1 in [ vm_name.startswith(c) for c in ['r-', 's-', 'v-'] ]: default_network_rules_systemvm(session, {"vmName":vm_name}) return True vif = "vif" + curr_domid + ".0" tap = "tap" + curr_domid + ".0" vifs = [vif] try: util.pread2(['ifconfig', tap]) vifs.append(tap) except: pass vmchain = chain_name(vm_name) vmchain_default = chain_name_def(vm_name) for v in vifs: util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', v, '-j', vmchain_default]) util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', v, '-j', vmchain_default]) #change antispoof rule in vmchain try: delcmd = "iptables -S " + vmchain_default + " | grep physdev-in | sed 's/-A/-D/'" inscmd = "iptables -S " + vmchain_default + " | grep physdev-in | grep vif | sed -r 's/vif[0-9]+.0/" + vif + "/' | sed 's/-A/-I/'" inscmd2 = "iptables -S " + vmchain_default + " | grep physdev-in | grep tap | sed -r 's/tap[0-9]+.0/" + tap + "/' | sed 's/-A/-I/'" ipts = [] for cmd in [delcmd, inscmd, inscmd2]: cmds = util.pread2(['/bin/bash', '-c', cmd]).split('\n') cmds.pop() for c in cmds: ipt = c.split(' ') ipt.insert(0, 'iptables') ipt.pop() ipts.append(ipt) for ipt in ipts: try: util.pread2(ipt) except: util.SMlog("Failed to rewrite antispoofing rules for vm " + vm_name) except: util.SMlog("No rules found for vm " + vm_name) rewrite_rule_log_for_vm(vm_name, curr_domid) return True def rewrite_rule_log_for_vm(vm_name, new_domid): logfilename = "/var/run/cloud/" + vm_name +".log" if not os.path.exists(logfilename): return lines = (line.rstrip() for line in open(logfilename)) [_vmName,_vmID,_vmIP,_domID,_signature,_seqno] = ['_', '-1', '_', '-1', '_', '-1'] for line in lines: [_vmName,_vmID,_vmIP,_domID,_signature,_seqno] = line.split(',') break write_rule_log_for_vm(_vmName, _vmID, '0.0.0.0', new_domid, _signature, '-1') def get_rule_log_for_vm(session, vmName): vm_name = vmName; logfilename = "/var/run/cloud/" + vm_name +".log" if not os.path.exists(logfilename): return '' lines = (line.rstrip() for line in open(logfilename)) [_vmName,_vmID,_vmIP,_domID,_signature,_seqno] = ['_', '-1', '_', '-1', '_', '-1'] for line in lines: [_vmName,_vmID,_vmIP,_domID,_signature,_seqno] = line.split(',') break return ','.join([_vmName, _vmID, _vmIP, _domID, _signature, _seqno]) @echo def get_rule_logs_for_vms(session, args): host_uuid = args.pop('host_uuid') try: thishost = session.xenapi.host.get_by_uuid(host_uuid) hostrec = session.xenapi.host.get_record(thishost) vms = hostrec.get('resident_VMs') except: util.SMlog("Failed to get host from uuid " + host_uuid) return ' ' result = [] try: for name in [session.xenapi.VM.get_name_label(x) for x in vms]: if 1 not in [ name.startswith(c) for c in ['r-', 's-', 'v-', 'i-'] ]: continue network_rules_for_rebooted_vm(session, name) if name.startswith('i-'): log = get_rule_log_for_vm(session, name) result.append(log) except: util.SMlog("Failed to get rule logs, better luck next time!") return ";".join(result) @echo def cleanup_rules_for_dead_vms(session): try: vms = session.xenapi.VM.get_all() cleaned = 0 for vm_name in [session.xenapi.VM.get_name_label(x) for x in vms]: if 1 in [ vm_name.startswith(c) for c in ['r-', 'i-', 's-', 'v-'] ]: vm = session.xenapi.VM.get_by_name_label(vm_name) if len(vm) != 1: continue vm_rec = session.xenapi.VM.get_record(vm[0]) state = vm_rec.get('power_state') if state != 'Running' and state != 'Paused': util.SMlog("vm " + vm_name + " is not running, cleaning up") destroy_network_rules_for_vm(session, {'vmName':vm_name}) cleaned = cleaned+1 util.SMlog("Cleaned up rules for " + str(cleaned) + " vms") except: util.SMlog("Failed to cleanup rules for dead vms!") @echo def cleanup_rules(session, args): instance = args.get('instance') if not instance: instance = 'VM' try: chainscmd = "iptables-save | grep '^:' | awk '{print $1}' | cut -d':' -f2 | sed 's/-def/-%s/'|sort|uniq" % instance chains = util.pread2(['/bin/bash', '-c', chainscmd]).split('\n') cleaned = 0 cleanup = [] for chain in chains: if 1 in [ chain.startswith(c) for c in ['r-', 'i-', 's-', 'v-'] ]: vm = session.xenapi.VM.get_by_name_label(vm_name) if len(vm) != 1: util.SMlog("chain " + chain + " does not correspond to a vm, cleaning up") cleanup.append(vm_name) continue vm_rec = session.xenapi.VM.get_record(vm[0]) state = vm_rec.get('power_state') if state != 'Running' and state != 'Paused': util.SMlog("vm " + vm_name + " is not running, cleaning up") cleanup.append(vm_name) for vm_name in cleanup: destroy_network_rules_for_vm(session, {'vmName':vm_name}) util.SMlog("Cleaned up rules for " + str(len(cleanup)) + " chains") return str(len(cleanup)) except: util.SMlog("Failed to cleanup rules !") return '-1'; @echo def check_rule_log_for_vm(vmName, vmID, vmIP, domID, signature, seqno): vm_name = vmName; logfilename = "/var/run/cloud/" + vm_name +".log" if not os.path.exists(logfilename): return [True, True, True, True, True, True] lines = (line.rstrip() for line in open(logfilename)) [_vmName,_vmID,_vmIP,_domID,_signature,_seqno] = ['_', '-1', '_', '-1', '_', '-1'] try: for line in lines: [_vmName,_vmID,_vmIP,_domID,_signature,_seqno] = line.split(',') break except: util.SMlog("Failed to parse log file for vm " + vm_name) remove_rule_log_for_vm(vm_name) return False return [(vm_name != _vmName), \ (vmID != _vmID), \ (vmIP != _vmIP), \ (domID != _domID), \ (signature != _signature), \ (seqno != _seqno)] @echo def write_rule_log_for_vm(vmName, vmID, vmIP, domID, signature, seqno): vm_name = vmName logfilename = "/var/run/cloud/" + vm_name +".log" util.SMlog("Writing log to " + logfilename) logf = open(logfilename, 'w') output = ','.join([vmName, vmID, vmIP, domID, signature, seqno]) result = True try: logf.write(output) logf.write('\n') except: util.SMlog("Failed to write to rule log file " + logfilename) result = False logf.close() return result @echo def remove_rule_log_for_vm(vmName): vm_name = vmName logfilename = "/var/run/cloud/" + vm_name +".log" result = True try: os.remove(logfilename) except: util.SMlog("Failed to delete rule log file " + logfilename) result = False return result @echo def network_rules(session, args): try: vm_name = args.get('vmName') vm_ip = args.get('vmIP') vm_id = args.get('vmID') signature = args.pop('signature') seqno = args.pop('seqno') try: vm = session.xenapi.VM.get_by_name_label(vm_name) if len(vm) != 1: util.SMlog("### Could not get record for vm ## " + vm_name) return 'false' vm_rec = session.xenapi.VM.get_record(vm[0]) domid = vm_rec.get('domid') except: util.SMlog("### Failed to get domid for vm ## " + vm_name) return 'false' if domid == '-1': util.SMlog("### Failed to get domid for vm (-1): " + vm_name) return 'false' vif = "vif" + domid + ".0" tap = "tap" + domid + ".0" vifs = [vif] try: util.pread2(['ifconfig', tap]) vifs.append(tap) except: pass vmchain = chain_name(vm_name) changes = check_rule_log_for_vm (vm_name, vm_id, vm_ip, domid, signature, seqno) if not 1 in changes: util.SMlog("Rules already programmed for vm " + vm_name) return 'true' if changes[1] or changes[2] or changes[3]: util.SMlog("Change detected in vmId or vmIp or domId, resetting default rules") default_network_rules(session, args) rules = args.pop('rules') lines = rules.split(' ') util.SMlog(" programming network rules for IP: " + vm_ip + " vmname=" + vm_name) util.pread2(['iptables', '-F', vmchain]) for line in lines: tokens = line.split(':') if len(tokens) != 4: continue protocol = tokens[0] start = tokens[1] end = tokens[2] cidrs = tokens.pop(); ips = cidrs.split(",") ips.pop() allow_any = False if '0.0.0.0/0' in ips: i = ips.index('0.0.0.0/0') del ips[i] allow_any = True range = start + ":" + end if ips: ipsetname = vmchain + "_" + protocol + "_" + start + "_" + end if start == "-1": ipsetname = vmchain + "_" + protocol + "_any" if ipset(ipsetname, protocol, start, end, ips) == False: util.SMlog(" failed to create ipset for rule " + str(tokens)) if protocol == 'all': iptables = ['iptables', '-I', vmchain, '-m', 'state', '--state', 'NEW', '-m', 'set', '--match-set', ipsetname, 'src', '-j', 'ACCEPT'] elif protocol != 'icmp': iptables = ['iptables', '-I', vmchain, '-p', protocol, '-m', protocol, '--dport', range, '-m', 'state', '--state', 'NEW', '-m', 'set', '--match-set', ipsetname, 'src', '-j', 'ACCEPT'] else: range = start + "/" + end if start == "-1": range = "any" iptables = ['iptables', '-I', vmchain, '-p', 'icmp', '--icmp-type', range, '-m', 'set', '--match-set', ipsetname, 'src', '-j', 'ACCEPT'] util.pread2(iptables) util.SMlog(iptables) if allow_any and protocol != 'all': if protocol != 'icmp': iptables = ['iptables', '-I', vmchain, '-p', protocol, '-m', protocol, '--dport', range, '-m', 'state', '--state', 'NEW', '-j', 'ACCEPT'] else: range = start + "/" + end if start == "-1": range = "any" iptables = ['iptables', '-I', vmchain, '-p', 'icmp', '--icmp-type', range, '-j', 'ACCEPT'] util.pread2(iptables) util.SMlog(iptables) util.pread2(['iptables', '-A', vmchain, '-j', 'DROP']) if write_rule_log_for_vm(vm_name, vm_id, vm_ip, domid, signature, seqno) == False: return 'false' return 'true' except: util.SMlog("Failed to network rule !") if __name__ == "__main__": XenAPIPlugin.dispatch({"pingtest": pingtest, "setup_iscsi":setup_iscsi, "gethostvmstats": gethostvmstats, "getvncport": getvncport, "getgateway": getgateway, "preparemigration": preparemigration, "setIptables": setIptables, "pingdomr": pingdomr, "pingxenserver": pingxenserver, "ipassoc": ipassoc, "vm_data": vm_data, "savePassword": savePassword, "saveDhcpEntry": saveDhcpEntry, "setFirewallRule": setFirewallRule, "setLoadBalancerRule": setLoadBalancerRule, "createFile": createFile, "deleteFile": deleteFile, "networkUsage": networkUsage, "network_rules":network_rules, "can_bridge_firewall":can_bridge_firewall, "default_network_rules":default_network_rules, "destroy_network_rules_for_vm":destroy_network_rules_for_vm, "default_network_rules_systemvm":default_network_rules_systemvm, "get_rule_logs_for_vms":get_rule_logs_for_vms, "setLinkLocalIP":setLinkLocalIP, "lt2p_vpn":lt2p_vpn, "cleanup_rules":cleanup_rules})