cloudstack/scripts/vm/hypervisor/xenserver/xcposs/vmops

#!/usr/bin/python
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
# 
#   http://www.apache.org/licenses/LICENSE-2.0
# 
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

# Version @VERSION@
#
# A plugin for executing script needed by vmops cloud 

import os, sys, time
import XenAPIPlugin
sys.path.extend(["/usr/lib/xcp/sm/", "/usr/local/sbin/", "/sbin/"])
import base64
import hostvmstats
import socket
import stat
import tempfile
import util
import subprocess
import zlib
from util import CommandException

def echo(fn):
    def wrapped(*v, **k):
        name = fn.__name__
        util.SMlog("#### VMOPS enter  %s ####" % name )
        res = fn(*v, **k)
        util.SMlog("#### VMOPS exit  %s ####" % name )
        return res
    return wrapped

@echo
def setup_iscsi(session, args):
   uuid=args['uuid']
   try:
       cmd = ["b", "/opt/cloud/bin/setup_iscsi.sh", uuid]
       txt = util.pread2(cmd)
   except:
       txt = ''
   return '> DONE <'
 
@echo
def preparemigration(session, args):
    uuid = args['uuid']
    try:
        cmd = ["/opt/cloud/bin/make_migratable.sh", uuid]
        util.pread2(cmd)
        txt = 'success'
    except:
        util.SMlog("Catch prepare migration exception" )
        txt = ''

    return txt

@echo
def setIptables(session, args):
    try:
        '''cmd = ["/bin/bash", "/opt/cloud/bin/setupxenserver.sh"]
        txt = util.pread2(cmd)'''
        txt = 'success'
    except:
        util.SMlog("  setIptables execution failed "  )
        txt = '' 

    return txt
 
@echo
def pingdomr(session, args):
    host = args['host']
    port = args['port']
    socket.setdefaulttimeout(3)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        s.connect((host,int(port)))
        txt = 'success'
    except:
        txt = ''
    
    s.close()

    return txt

@echo
def kill_copy_process(session, args):
    namelabel = args['namelabel']
    try:
        cmd = ["bash", "/opt/cloud/bin/kill_copy_process.sh", namelabel]
        txt = util.pread2(cmd)
    except:
        txt = 'false'
    return txt

@echo
def pingxenserver(session, args):
    txt = 'success'
    return txt

@echo
def ipassoc(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/ipassoc.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
        txt = 'success'
    except:
        util.SMlog("  ip associate failed "  )
        txt = '' 

    return txt

def pingtest(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/pingtest.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
        txt = 'success'
    except:
        util.SMlog("  pingtest failed "  )
        txt = ''

    return txt

@echo
def savePassword(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/save_password_to_domr.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
        txt = 'success'
    except:
        util.SMlog("  save password to domr failed "  )
        txt = '' 

    return txt

@echo
def saveDhcpEntry(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/dhcp_entry.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
        txt = 'success'
    except:
        util.SMlog(" save dhcp entry failed "  )
        txt = '' 

    return txt
    
@echo
def lt2p_vpn(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/l2tp_vpn.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
        txt = 'success'
    except:
        util.SMlog("l2tp vpn failed "  )
        txt = '' 

    return txt    

@echo
def setLinkLocalIP(session, args):
    brName = args['brName']
    try:
        cmd = ["ip", "route", "del", "169.254.0.0/16"]
        txt = util.pread2(cmd)
    except:
        txt = '' 
    try:
        cmd = ["ifconfig", brName, "169.254.0.1", "netmask", "255.255.0.0"]
        txt = util.pread2(cmd)
    except:

        try:
            cmd = ["brctl", "addbr", brName]
            txt = util.pread2(cmd)
        except:
            pass
 
        try:
            cmd = ["ifconfig", brName, "169.254.0.1", "netmask", "255.255.0.0"]
            txt = util.pread2(cmd)
        except:
            pass
    try:
        cmd = ["ip", "route", "add", "169.254.0.0/16", "dev", brName, "src", "169.254.0.1"]
        txt = util.pread2(cmd)
    except:
        txt = '' 
    txt = 'success'
    return txt
    
@echo
def setFirewallRule(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/call_firewall.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
        txt = 'success'
    except:
        util.SMlog(" set firewall rule failed "  )
        txt = '' 

    return txt

@echo
def setLoadBalancerRule(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/call_loadbalancer.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
        txt = 'success'
    except:
        util.SMlog(" set loadbalancer rule failed "  )
        txt = '' 

    return txt
    
@echo
def createFile(session, args):
    file_path = args['filepath']
    file_contents = args['filecontents']

    try:
        f = open(file_path, "w")
        f.write(file_contents)
        f.close()
        txt = 'success'
    except:
        util.SMlog(" failed to create HA proxy cfg file ")
        txt = ''

    return txt

@echo
def deleteFile(session, args):
    file_path = args["filepath"]

    try:
        if os.path.isfile(file_path):
            os.remove(file_path)
        txt = 'success'
    except:
        util.SMlog(" failed to remove HA proxy cfg file ")
        txt = ''

    return txt


@echo
def networkUsage(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/networkUsage.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
    except:
        util.SMlog("  network usage error "  )
        txt = '' 

    return txt
    
def get_private_nic(session, args):
    vms = session.xenapi.VM.get_all()
    host_uuid = args.get('host_uuid')
    host = session.xenapi.host.get_by_uuid(host_uuid)
    piflist = session.xenapi.host.get_PIFs(host)
    mgmtnic = 'eth0'
    for pif in piflist:
        pifrec = session.xenapi.PIF.get_record(pif)
        network = pifrec.get('network')
        nwrec = session.xenapi.network.get_record(network)
        if nwrec.get('name_label') == 'cloud-guest':
            return pifrec.get('device')
        if pifrec.get('management'):
            mgmtnic = pifrec.get('device')
    
    return mgmtnic

def chain_name(vm_name):
    if vm_name.startswith('i-') or vm_name.startswith('r-'):
        if vm_name.endswith('untagged'):
            return '-'.join(vm_name.split('-')[:-1])
    return vm_name

def chain_name_def(vm_name):
    if vm_name.startswith('i-'):
        if vm_name.endswith('untagged'):
            return '-'.join(vm_name.split('-')[:-2]) + "-def"
        return '-'.join(vm_name.split('-')[:-1]) + "-def"
    return vm_name
  
def egress_chain_name(vm_name):
    return chain_name(vm_name) + "-eg"
      
@echo
def can_bridge_firewall(session, args):
    try:
        util.pread2(['ebtables', '-V'])
        util.pread2(['ipset', '-V'])
    except:
        return 'false'

    host_uuid = args.get('host_uuid')
    try:
        util.pread2(['iptables', '-N', 'BRIDGE-FIREWALL'])
        util.pread2(['iptables', '-I', 'BRIDGE-FIREWALL', '-m', 'state', '--state', 'RELATED,ESTABLISHED', '-j', 'ACCEPT'])
        util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged',  '-p', 'udp', '--dport', '67', '--sport', '68',  '-j', 'ACCEPT'])
        util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged',  '-p', 'udp', '--dport', '68', '--sport', '67',  '-j', 'ACCEPT'])
        util.pread2(['iptables', '-D', 'FORWARD',  '-j', 'RH-Firewall-1-INPUT'])
    except:
        util.SMlog('Chain BRIDGE-FIREWALL already exists')
    privnic = get_private_nic(session, args)
    result = 'true'
    try:
        util.pread2(['/bin/bash', '-c', 'iptables -n -L FORWARD | grep BRIDGE-FIREWALL'])
    except:
        try:
            util.pread2(['iptables', '-I', 'FORWARD', '-m', 'physdev', '--physdev-is-bridged', '-j', 'BRIDGE-FIREWALL'])
            util.pread2(['iptables', '-A', 'FORWARD', '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', privnic, '-j', 'ACCEPT'])
            util.pread2(['iptables', '-A', 'FORWARD', '-j', 'DROP'])
        except:
            return 'false'
    default_ebtables_rules()
    allow_egress_traffic(session)
    if not os.path.exists('/var/run/cloud'):
        os.makedirs('/var/run/cloud')
    if not os.path.exists('/var/cache/cloud'):
        os.makedirs('/var/cache/cloud')
    #get_ipset_keyword()
 
    cleanup_rules_for_dead_vms(session)
    cleanup_rules(session, args)
    
    return result

@echo
def default_ebtables_rules():
    try:
        util.pread2(['ebtables', '-N',  'DEFAULT_EBTABLES'])
        util.pread2(['ebtables', '-A', 'FORWARD', '-j'  'DEFAULT_EBTABLES'])
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES', '-p', 'IPv4', '--ip-dst', '255.255.255.255', '--ip-proto', 'udp', '--ip-dport', '67', '-j', 'ACCEPT'])
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES', '-p', 'ARP', '--arp-op', 'Request', '-j', 'ACCEPT'])
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES', '-p', 'ARP', '--arp-op', 'Reply', '-j', 'ACCEPT'])
        # deny mac broadcast and multicast
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES', '-p', 'IPv4', '-d', 'Broadcast', '-j', 'DROP']) 
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES', '-p', 'IPv4', '-d', 'Multicast', '-j', 'DROP']) 
        # deny ip broadcast and multicast
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES', '-p', 'IPv4', '--ip-dst', '255.255.255.255', '-j', 'DROP'])
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES', '-p', 'IPv4', '--ip-dst', '224.0.0.0/4', '-j', 'DROP'])
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES', '-p', 'IPv4', '-j', 'RETURN'])
        # deny ipv6
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES', '-p', 'IPv6', '-j', 'DROP'])
        # deny vlan
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES', '-p', '802_1Q', '-j', 'DROP'])
        # deny all others (e.g., 802.1d, CDP)
        util.pread2(['ebtables', '-A', 'DEFAULT_EBTABLES',  '-j', 'DROP'])
    except:
        util.SMlog('Chain DEFAULT_EBTABLES already exists')


@echo
def allow_egress_traffic(session):
    devs = []
    for pif in session.xenapi.PIF.get_all():
        pif_rec = session.xenapi.PIF.get_record(pif)
        vlan = pif_rec.get('VLAN')
        dev = pif_rec.get('device')
        if vlan == '-1':
            devs.append(dev)
        else:
            devs.append(dev + "." + vlan)
    for d in devs:
        try:
            util.pread2(['/bin/bash', '-c', "iptables -n -L FORWARD | grep '%s '" % d])
        except:
            try:
                util.pread2(['iptables', '-I', 'FORWARD', '2', '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', d, '-j', 'ACCEPT'])
            except:
                util.SMlog("Failed to add FORWARD rule through to %s" % d)
                return 'false'
    return 'true'


def ipset(ipsetname, proto, start, end, ips):
    try:
        util.pread2(['ipset', '-N', ipsetname, 'iptreemap'])
    except:
        util.SMlog("ipset chain already exists" + ipsetname)

    result = True
    ipsettmp = ''.join(''.join(ipsetname.split('-')).split('_')) + str(int(time.time()) % 1000)

    try: 
        util.pread2(['ipset', '-N', ipsettmp, 'iptreemap']) 
    except:
        util.SMlog("Failed to create temp ipset, reusing old name= " + ipsettmp)
        try: 
            util.pread2(['ipset', '-F', ipsettmp]) 
        except:
            util.SMlog("Failed to clear old temp ipset name=" + ipsettmp)
            return False
        
    try: 
        for ip in ips:
            try:
                util.pread2(['ipset', '-A', ipsettmp, ip])
            except CommandException, cex:
                if cex.reason.rfind('already in set') == -1:
                   raise
    except:
        util.SMlog("Failed to program ipset " + ipsetname)
        util.pread2(['ipset', '-F', ipsettmp]) 
        util.pread2(['ipset', '-X', ipsettmp]) 
        return False

    try: 
        util.pread2(['ipset', '-W', ipsettmp, ipsetname]) 
    except:
        util.SMlog("Failed to swap ipset " + ipsetname)
        result = False

    try: 
        util.pread2(['ipset', '-F', ipsettmp]) 
        util.pread2(['ipset', '-X', ipsettmp]) 
    except:
        # if the temporary name clashes next time we'll just reuse it
        util.SMlog("Failed to delete temp ipset " + ipsettmp)

    return result

@echo 
def destroy_network_rules_for_vm(session, args):
    vm_name = args.pop('vmName')
    vmchain = chain_name(vm_name)
    vmchain_egress = egress_chain_name(vm_name)
    vmchain_default = chain_name_def(vm_name)
    
    delete_rules_for_vm_in_bridge_firewall_chain(vm_name)
    if vm_name.startswith('i-') or vm_name.startswith('r-') or vm_name.startswith('l-'):
        try:
            util.pread2(['iptables', '-F', vmchain_default])
            util.pread2(['iptables', '-X', vmchain_default])
        except:
            util.SMlog("Ignoring failure to delete  chain " + vmchain_default)
    
    destroy_ebtables_rules(vmchain)
    
    try:
        util.pread2(['iptables', '-F', vmchain])
        util.pread2(['iptables', '-X', vmchain])
    except:
        util.SMlog("Ignoring failure to delete ingress chain " + vmchain)
        
   
    try:
        util.pread2(['iptables', '-F', vmchain_egress])
        util.pread2(['iptables', '-X', vmchain_egress])
    except:
        util.SMlog("Ignoring failure to delete egress chain " + vmchain_egress)
    
    remove_rule_log_for_vm(vm_name)
    
    if 1 in [ vm_name.startswith(c) for c in ['r-', 's-', 'v-', 'l-'] ]:
        return 'true'
    
    try:
        setscmd = "ipset --save | grep " +  vmchain + " | grep '^-N' | awk '{print $2}'"
        setsforvm = util.pread2(['/bin/bash', '-c', setscmd]).split('\n')
        for set in setsforvm:
            if set != '':
                util.pread2(['ipset', '-F', set])       
                util.pread2(['ipset', '-X', set])       
    except:
        util.SMlog("Failed to destroy ipsets for %" % vm_name)
    
    
    return 'true'

@echo
def destroy_ebtables_rules(vm_chain):
    
    delcmd = "ebtables-save | grep " +  vm_chain + " | sed 's/-A/-D/'"
    delcmds = util.pread2(['/bin/bash', '-c', delcmd]).split('\n')
    delcmds.pop()
    for cmd in delcmds:
        try:
            dc = cmd.split(' ')
            dc.insert(0, 'ebtables')
            util.pread2(dc)
        except:
            util.SMlog("Ignoring failure to delete ebtables rules for vm " + vm_chain)
    try:
        util.pread2(['ebtables', '-F', vm_chain])
        util.pread2(['ebtables', '-X', vm_chain])
    except:
            util.SMlog("Ignoring failure to delete ebtables chain for vm " + vm_chain)   

@echo
def destroy_arptables_rules(vm_chain):
    delcmd = "arptables -vL FORWARD | grep " + vm_chain + " | sed 's/-i any//' | sed 's/-o any//' | awk '{print $1,$2,$3,$4}' "
    delcmds = util.pread2(['/bin/bash', '-c', delcmd]).split('\n')
    delcmds.pop()
    for cmd in delcmds:
        try:
            dc = cmd.split(' ')
            dc.insert(0, 'arptables')
            dc.insert(1, '-D')
            dc.insert(2, 'FORWARD')
            util.pread2(dc)
        except:
            util.SMlog("Ignoring failure to delete arptables rules for vm " + vm_chain)
    
    try:
        util.pread2(['arptables', '-F', vm_chain])
        util.pread2(['arptables', '-X', vm_chain])
    except:
        util.SMlog("Ignoring failure to delete arptables chain for vm " + vm_chain) 
              
@echo
def default_ebtables_antispoof_rules(vm_chain, vifs, vm_ip, vm_mac):
    if vm_mac == 'ff:ff:ff:ff:ff:ff':
        util.SMlog("Ignoring since mac address is not valid")
        return 'true'
    
    try:
        util.pread2(['ebtables', '-N', vm_chain])
    except:
        try:
            util.pread2(['ebtables', '-F', vm_chain])
        except:
            util.SMlog("Failed to create ebtables antispoof chain, skipping")
            return 'true'

    # note all rules for packets into the bridge (-i) precede all output rules (-o)
    # always start after the first rule in the FORWARD chain that jumps to DEFAULT_EBTABLES chain
    try:
        for vif in vifs:
            util.pread2(['ebtables', '-I', 'FORWARD', '2', '-i',  vif,  '-j', vm_chain])
            util.pread2(['ebtables', '-A', 'FORWARD', '-o',  vif, '-j', vm_chain])
    except:
        util.SMlog("Failed to program default ebtables FORWARD rules for %s" % vm_chain)
        return 'false'

    try:
        for vif in vifs:
            # only allow source mac that belongs to the vm
	    util.pread2(['ebtables', '-A', vm_chain, '-i', vif, '-s', '!', vm_mac,  '-j', 'DROP'])
            # do not allow fake dhcp responses
            util.pread2(['ebtables', '-A', vm_chain, '-i', vif, '-p', 'IPv4', '--ip-proto', 'udp', '--ip-dport', '68', '-j', 'DROP'])
            # do not allow snooping of dhcp requests
            util.pread2(['ebtables', '-A', vm_chain, '-o', vif, '-p', 'IPv4', '--ip-proto', 'udp', '--ip-dport', '67', '-j', 'DROP'])
    except:
        util.SMlog("Failed to program default ebtables antispoof rules for %s" % vm_chain)
        return 'false'

    return 'true'

@echo
def default_arp_antispoof(vm_chain, vifs, vm_ip, vm_mac):
    if vm_mac == 'ff:ff:ff:ff:ff:ff':
        util.SMlog("Ignoring since mac address is not valid")
        return 'true'

    try:
        util.pread2(['arptables',  '-N', vm_chain])
    except:
        try:
            util.pread2(['arptables', '-F', vm_chain])
        except:
            util.SMlog("Failed to create arptables rule, skipping")
            return 'true'

    # note all rules for packets into the bridge (-i) precede all output rules (-o)
    try:
        for vif in vifs:
           util.pread2(['arptables',  '-I', 'FORWARD', '-i',  vif, '-j', vm_chain])
           util.pread2(['arptables',  '-A', 'FORWARD', '-o',  vif, '-j', vm_chain])
    except:
        util.SMlog("Failed to program default arptables rules in FORWARD chain vm=" + vm_chain)
        return 'false'
    
    try:
        for vif in vifs:
            #accept arp replies into the bridge as long as the source mac and ips match the vm
            util.pread2(['arptables',  '-A', vm_chain, '-i', vif, '--opcode', 'Reply', '--source-mac',  vm_mac, '--source-ip',  vm_ip, '-j', 'ACCEPT'])
            #accept any arp requests from this vm. In the future this can be restricted to deny attacks on hosts
            #also important to restrict source ip and src mac in these requests as they can be used to update arp tables on destination
            util.pread2(['arptables',  '-A', vm_chain, '-i', vif, '--opcode', 'Request',  '--source-mac',  vm_mac, '--source-ip',  vm_ip, '-j', 'RETURN'])
            #accept any arp requests to this vm as long as the request is for this vm's ip
            util.pread2(['arptables',  '-A', vm_chain, '-o', vif, '--opcode', 'Request', '--destination-ip', vm_ip, '-j', 'ACCEPT'])   
            #accept any arp replies to this vm as long as the mac and ip matches
            util.pread2(['arptables',  '-A', vm_chain, '-o', vif, '--opcode', 'Reply', '--destination-mac', vm_mac, '--destination-ip', vm_ip, '-j', 'ACCEPT'])   
        util.pread2(['arptables',  '-A', vm_chain,  '-j', 'DROP'])

    except:
        util.SMlog("Failed to program default arptables  rules")
        return 'false'

    return 'true'

@echo
def default_network_rules_systemvm(session, args):
    vm_name = args.pop('vmName')
    try:
        vm = session.xenapi.VM.get_by_name_label(vm_name)
        if len(vm) != 1:
             return 'false'
        vm_rec = session.xenapi.VM.get_record(vm[0])
        vm_vifs = vm_rec.get('VIFs')
        vifnums = [session.xenapi.VIF.get_record(vif).get('device') for vif in vm_vifs]
        domid = vm_rec.get('domid')
    except:
        util.SMlog("### Failed to get domid or vif list for vm  ##" + vm_name)
        return 'false'
    
    if domid == '-1':
        util.SMlog("### Failed to get domid for vm (-1):  " + vm_name)
        return 'false'

    vifs = ["vif" + domid + "." + v for v in vifnums]
    #vm_name =  '-'.join(vm_name.split('-')[:-1])
    vmchain = chain_name(vm_name)
   
 
    delete_rules_for_vm_in_bridge_firewall_chain(vm_name)
  
    try:
        util.pread2(['iptables', '-N', vmchain])
    except:
        util.pread2(['iptables', '-F', vmchain])
    
    allow_egress_traffic(session)
  
    for vif in vifs:
        try:
            util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', vif, '-j', vmchain])
            util.pread2(['iptables', '-I', 'BRIDGE-FIREWALL', '4', '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', vif, '-j', vmchain])
            util.pread2(['iptables', '-I', vmchain, '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', vif, '-j', 'RETURN'])
        except:
            util.SMlog("Failed to program default rules")
            return 'false'
	
	
    util.pread2(['iptables', '-A', vmchain, '-j', 'ACCEPT'])
    
    if write_rule_log_for_vm(vm_name, '-1', '_ignore_', domid, '_initial_', '-1') == False:
        util.SMlog("Failed to log default network rules for systemvm, ignoring")
    return 'true'


@echo
def default_network_rules(session, args):
    vm_name = args.pop('vmName')
    vm_ip = args.pop('vmIP')
    vm_id = args.pop('vmID')
    vm_mac = args.pop('vmMAC')
    
    try:
        vm = session.xenapi.VM.get_by_name_label(vm_name)
        if len(vm) != 1:
             util.SMlog("### Failed to get record for vm  " + vm_name)
             return 'false'
        vm_rec = session.xenapi.VM.get_record(vm[0])
        domid = vm_rec.get('domid')
    except:
        util.SMlog("### Failed to get domid for vm " + vm_name)
        return 'false'
    if domid == '-1':     
        util.SMlog("### Failed to get domid for vm (-1):  " + vm_name)
        return 'false'
    
    vif = "vif" + domid + ".0"
    tap = "tap" + domid + ".0"
    vifs = [vif]
    try:
        util.pread2(['ifconfig', tap])
        vifs.append(tap)
    except:
        pass

    delete_rules_for_vm_in_bridge_firewall_chain(vm_name)

     
    vmchain =  chain_name(vm_name)
    vmchain_egress =  egress_chain_name(vm_name)
    vmchain_default = chain_name_def(vm_name)
    
    destroy_ebtables_rules(vmchain)
    

    try:
        util.pread2(['iptables', '-N', vmchain])
    except:
        util.pread2(['iptables', '-F', vmchain])
    
    try:
        util.pread2(['iptables', '-N', vmchain_egress])
    except:
        util.pread2(['iptables', '-F', vmchain_egress])
        
    try:
        util.pread2(['iptables', '-N', vmchain_default])
    except:
        util.pread2(['iptables', '-F', vmchain_default])        

    try:
        for v in vifs:
            util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', v, '-j', vmchain_default])
            util.pread2(['iptables', '-I', 'BRIDGE-FIREWALL', '2', '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', v, '-j', vmchain_default])
        util.pread2(['iptables', '-A', vmchain_default, '-m', 'state', '--state', 'RELATED,ESTABLISHED', '-j', 'ACCEPT'])
        #allow dhcp
        for v in vifs:
            util.pread2(['iptables', '-A', vmchain_default, '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', v, '-p', 'udp', '--dport', '67', '--sport', '68',  '-j', 'ACCEPT'])
            util.pread2(['iptables', '-A', vmchain_default, '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', v, '-p', 'udp', '--dport', '68', '--sport', '67',  '-j', 'ACCEPT'])

        #don't let vm spoof its ip address
        for v in vifs:
            util.pread2(['iptables', '-A', vmchain_default, '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', v, '--source', vm_ip,'-p', 'udp', '--dport', '53', '-j', 'RETURN'])
            util.pread2(['iptables', '-A', vmchain_default, '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', v, '--source', '!', vm_ip, '-j', 'DROP'])
            util.pread2(['iptables', '-A', vmchain_default, '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', v, '--destination', '!', vm_ip, '-j', 'DROP'])
            util.pread2(['iptables', '-A', vmchain_default, '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', v, '--source', vm_ip, '-j', vmchain_egress])
        
        for v in vifs:
            util.pread2(['iptables', '-A', vmchain_default, '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', v,  '-j', vmchain])
    except:
        util.SMlog("Failed to program default rules for vm " + vm_name)
        return 'false'
    
    default_arp_antispoof(vmchain, vifs, vm_ip, vm_mac)
    default_ebtables_antispoof_rules(vmchain, vifs, vm_ip, vm_mac)
    
    if write_rule_log_for_vm(vm_name, vm_id, vm_ip, domid, '_initial_', '-1', vm_mac) == False:
        util.SMlog("Failed to log default network rules, ignoring")
        
    util.SMlog("Programmed default rules for vm " + vm_name)
    return 'true'

@echo
def check_domid_changed(session, vmName):
    curr_domid = '-1'
    try:
        vm = session.xenapi.VM.get_by_name_label(vmName)
        if len(vm) != 1:
             util.SMlog("### Could not get record for vm ## " + vmName)
        else:
            vm_rec = session.xenapi.VM.get_record(vm[0])
            curr_domid = vm_rec.get('domid')
    except:
        util.SMlog("### Failed to get domid for vm  ## " + vmName)
        
    
    logfilename = "/var/run/cloud/" + vmName +".log"
    if not os.path.exists(logfilename):
        return ['-1', curr_domid]
    
    lines = (line.rstrip() for line in open(logfilename))
    
    [_vmName,_vmID,_vmIP,old_domid,_signature,_seqno, _vmMac] = ['_', '-1', '_', '-1', '_', '-1', 'ff:ff:ff:ff:ff:ff']
    for line in lines:
        try:
            [_vmName,_vmID,_vmIP,old_domid,_signature,_seqno,_vmMac] = line.split(',')
        except ValueError,v:
            [_vmName,_vmID,_vmIP,old_domid,_signature,_seqno] = line.split(',')
        break
    
    return [curr_domid, old_domid]

@echo
def delete_rules_for_vm_in_bridge_firewall_chain(vmName):
    vm_name = vmName
    vmchain = chain_name_def(vm_name)
    
    delcmd = "iptables-save | grep '\-A BRIDGE-FIREWALL' | grep " +  vmchain + " | sed 's/-A/-D/'"
    delcmds = util.pread2(['/bin/bash', '-c', delcmd]).split('\n')
    delcmds.pop()
    for cmd in delcmds:
        try:
            dc = cmd.split(' ')
            dc.insert(0, 'iptables')
            dc.pop()
            util.pread2(filter(None, dc))
        except:
              util.SMlog("Ignoring failure to delete rules for vm " + vmName)

  
@echo
def network_rules_for_rebooted_vm(session, vmName):
    vm_name = vmName
    [curr_domid, old_domid] = check_domid_changed(session, vm_name)
    
    if curr_domid == old_domid:
        return True
    
    if old_domid == '-1':
        return True
    
    if curr_domid == '-1':
        return True
    
    util.SMlog("Found a rebooted VM -- reprogramming rules for  " + vm_name)
    
    delete_rules_for_vm_in_bridge_firewall_chain(vm_name)
    if 1 in [ vm_name.startswith(c) for c in ['r-', 's-', 'v-', 'l-'] ]:
        default_network_rules_systemvm(session, {"vmName":vm_name})
        return True
    
    vif = "vif" + curr_domid + ".0"
    tap = "tap" + curr_domid + ".0"
    vifs = [vif]
    try:
        util.pread2(['ifconfig', tap])
        vifs.append(tap)
    except:
        pass
    vmchain = chain_name(vm_name)
    vmchain_default = chain_name_def(vm_name)

    for v in vifs:
        util.pread2(['iptables', '-A', 'BRIDGE-FIREWALL', '-m', 'physdev', '--physdev-is-bridged', '--physdev-out', v, '-j', vmchain_default])
        util.pread2(['iptables', '-I', 'BRIDGE-FIREWALL', '2', '-m', 'physdev', '--physdev-is-bridged', '--physdev-in', v, '-j', vmchain_default])

    #change antispoof rule in vmchain
    try:
        delcmd = "iptables-save | grep '\-A " +  vmchain_default + "' | grep  physdev-in | sed 's/-A/-D/'"
        delcmd2 = "iptables-save | grep '\-A " +  vmchain_default + "' | grep  physdev-out | sed 's/-A/-D/'"
        inscmd = "iptables-save | grep '\-A " +  vmchain_default + "' | grep  physdev-in | grep vif | sed -r 's/vif[0-9]+.0/" + vif + "/' "
        inscmd2 = "iptables-save| grep '\-A " +  vmchain_default + "' | grep  physdev-in | grep tap | sed -r 's/tap[0-9]+.0/" + tap + "/' "
        inscmd3 = "iptables-save | grep '\-A " +  vmchain_default + "' | grep  physdev-out | grep vif | sed -r 's/vif[0-9]+.0/" + vif + "/' "
        inscmd4 = "iptables-save| grep '\-A " +  vmchain_default + "' | grep  physdev-out | grep tap | sed -r 's/tap[0-9]+.0/" + tap + "/' "
        
        ipts = []
        for cmd in [delcmd, delcmd2, inscmd, inscmd2, inscmd3, inscmd4]:
            cmds = util.pread2(['/bin/bash', '-c', cmd]).split('\n')
            cmds.pop()
            for c in cmds:
                    ipt = c.split(' ')
                    ipt.insert(0, 'iptables')
                    ipt.pop()
                    ipts.append(ipt)
        
        for ipt in ipts:
            try:
                util.pread2(filter(None,ipt))
            except:
                util.SMlog("Failed to rewrite antispoofing rules for vm " + vm_name)
        
        util.pread2(['/bin/bash', '-c', 'iptables -D ' + vmchain_default + " -j " + vmchain])
        util.pread2(['/bin/bash', '-c', 'iptables -A ' + vmchain_default + " -j " + vmchain])
    except:
        util.SMlog("No rules found for vm " + vm_name)

    destroy_ebtables_rules(vmchain)
    destroy_arptables_rules(vmchain)
    [vm_ip, vm_mac] = get_vm_mac_ip_from_log(vmchain)
    default_arp_antispoof(vmchain, vifs, vm_ip, vm_mac)
    default_ebtables_antispoof_rules(vmchain, vifs, vm_ip, vm_mac)
    rewrite_rule_log_for_vm(vm_name, curr_domid)
    return True

def rewrite_rule_log_for_vm(vm_name, new_domid):
    logfilename = "/var/run/cloud/" + vm_name +".log"
    if not os.path.exists(logfilename):
        return 
    lines = (line.rstrip() for line in open(logfilename))
    
    [_vmName,_vmID,_vmIP,_domID,_signature,_seqno,_vmMac] = ['_', '-1', '_', '-1', '_', '-1','ff:ff:ff:ff:ff:ff']
    for line in lines:
        try:
            [_vmName,_vmID,_vmIP,_domID,_signature,_seqno,_vmMac] = line.split(',')
            break
        except ValueError,v:
            [_vmName,_vmID,_vmIP,_domID,_signature,_seqno] = line.split(',')
    
    write_rule_log_for_vm(_vmName, _vmID, _vmIP, new_domid, _signature, '-1', _vmMac)

def get_rule_log_for_vm(session, vmName):
    vm_name = vmName;
    logfilename = "/var/run/cloud/" + vm_name +".log"
    if not os.path.exists(logfilename):
        return ''
    
    lines = (line.rstrip() for line in open(logfilename))
    
    [_vmName,_vmID,_vmIP,_domID,_signature,_seqno,_vmMac] = ['_', '-1', '_', '-1', '_', '-1', 'ff:ff:ff:ff:ff:ff']
    for line in lines:
        try:
            [_vmName,_vmID,_vmIP,_domID,_signature,_seqno,_vmMac] = line.split(',')
            break
        except ValueError,v:
            [_vmName,_vmID,_vmIP,_domID,_signature,_seqno] = line.split(',')
    
    return ','.join([_vmName, _vmID, _vmIP, _domID, _signature, _seqno])

@echo
def get_vm_mac_ip_from_log(vm_name):
    [_vmName,_vmID,_vmIP,_domID,_signature,_seqno,_vmMac] = ['_', '-1', '0.0.0.0', '-1', '_', '-1','ff:ff:ff:ff:ff:ff']
    logfilename = "/var/run/cloud/" + vm_name +".log"
    if not os.path.exists(logfilename):
        return ['_', '_']
    
    lines = (line.rstrip() for line in open(logfilename))
    for line in lines:
        try:
            [_vmName,_vmID,_vmIP,_domID,_signature,_seqno,_vmMac] = line.split(',')
            break
        except ValueError,v:
            [_vmName,_vmID,_vmIP,_domID,_signature,_seqno] = line.split(',')
    
    return [ _vmIP, _vmMac]

@echo
def get_rule_logs_for_vms(session, args):
    host_uuid = args.pop('host_uuid')
    try:
        thishost = session.xenapi.host.get_by_uuid(host_uuid)
        hostrec = session.xenapi.host.get_record(thishost)
        vms = hostrec.get('resident_VMs')
    except:
        util.SMlog("Failed to get host from uuid " + host_uuid)
        return ' '
    
    result = []
    try:
        for name in [session.xenapi.VM.get_name_label(x) for x in vms]:
            if 1 not in [ name.startswith(c) for c in ['r-', 's-', 'v-', 'i-', 'l-'] ]:
                continue
            network_rules_for_rebooted_vm(session, name)
            if name.startswith('i-'):
                log = get_rule_log_for_vm(session, name)
                result.append(log)
    except:
        util.SMlog("Failed to get rule logs, better luck next time!")
        
    return ";".join(result)

@echo
def cleanup_rules_for_dead_vms(session):
  try:
    vms = session.xenapi.VM.get_all()
    cleaned = 0
    for vm_name in [session.xenapi.VM.get_name_label(x) for x in vms]:
        if 1 in [ vm_name.startswith(c) for c in ['r-', 'i-', 's-', 'v-', 'l-'] ]:
            vm = session.xenapi.VM.get_by_name_label(vm_name)
            if len(vm) != 1:
                continue
            vm_rec = session.xenapi.VM.get_record(vm[0])
            state = vm_rec.get('power_state')
            if state != 'Running' and state != 'Paused':
                util.SMlog("vm " + vm_name + " is not running, cleaning up")
                destroy_network_rules_for_vm(session, {'vmName':vm_name})
                cleaned = cleaned+1
                
    util.SMlog("Cleaned up rules for " + str(cleaned) + " vms")
  except:
    util.SMlog("Failed to cleanup rules for dead vms!")
        

@echo
def cleanup_rules(session, args):
  instance = args.get('instance')
  if not instance:
    instance = 'VM'
  resident_vms = []
  try:
    hostname = util.pread2(['/bin/bash', '-c', 'hostname']).split('\n')
    if len(hostname) < 1:
       raise Exception('Could not find hostname of this host')
    thishost = session.xenapi.host.get_by_name_label(hostname[0])
    if len(thishost) < 1:
       raise Exception("Could not find host record from hostname %s of this host"%hostname[0])
    hostrec = session.xenapi.host.get_record(thishost[0])
    vms = hostrec.get('resident_VMs')
    resident_vms = [session.xenapi.VM.get_name_label(x) for x in vms]
    util.SMlog('cleanup_rules: found %s resident vms on this host %s' % (len(resident_vms)-1, hostname[0]))
 
    chainscmd = "iptables-save | grep '^:' | awk '{print $1}' | cut -d':' -f2 | sed 's/-def/-%s/'| sed 's/-eg//' | sort|uniq" % instance
    chains = util.pread2(['/bin/bash', '-c', chainscmd]).split('\n')
    vmchains = [ch  for ch in chains if 1 in [ ch.startswith(c) for c in ['r-', 'i-', 's-', 'v-', 'l-']]]
    util.SMlog('cleanup_rules: found %s iptables chains for vms on this host %s' % (len(vmchains), hostname[0]))
    cleaned = 0
    cleanup = []
    for chain in vmchains:
        vm = session.xenapi.VM.get_by_name_label(chain)
        if len(vm) != 1:
            vm = session.xenapi.VM.get_by_name_label(chain + "-untagged")
            if len(vm) != 1:
                util.SMlog("chain " + chain + " does not correspond to a vm, cleaning up")
                cleanup.append(chain)
                continue
        if chain not in resident_vms:
            util.SMlog("vm " + chain + " is not running, cleaning up")
            cleanup.append(chain)
                
    for vm_name in cleanup:
        destroy_network_rules_for_vm(session, {'vmName':vm_name})
                    
    util.SMlog("Cleaned up rules for " + str(len(cleanup)) + " chains")
    return str(len(cleanup))                
  except Exception, ex:
    util.SMlog("Failed to cleanup rules, reason= " + str(ex))
    return '-1';

@echo
def check_rule_log_for_vm(vmName, vmID, vmIP, domID, signature, seqno):
    vm_name = vmName;
    logfilename = "/var/run/cloud/" + vm_name +".log"
    if not os.path.exists(logfilename):
        util.SMlog("Failed to find logfile %s" %logfilename)
        return [True, True, True]
        
    lines = (line.rstrip() for line in open(logfilename))
    
    [_vmName,_vmID,_vmIP,_domID,_signature,_seqno,_vmMac] = ['_', '-1', '_', '-1', '_', '-1', 'ff:ff:ff:ff:ff:ff']
    try:
        for line in lines:
            try:
                [_vmName,_vmID,_vmIP,_domID,_signature,_seqno, _vmMac] = line.split(',')
            except ValueError,v:
                [_vmName,_vmID,_vmIP,_domID,_signature,_seqno] = line.split(',')
            break
    except:
        util.SMlog("Failed to parse log file for vm " + vmName)
        remove_rule_log_for_vm(vmName)
        return [True, True, True]
    
    reprogramDefault = False
    if (domID != _domID) or (vmID != _vmID) or (vmIP != _vmIP):
        util.SMlog("Change in default info set of vm %s" % vmName)
        return [True, True, True]
    else:
        util.SMlog("No change in default info set of vm %s" % vmName)
    
    reprogramChain = False
    rewriteLog = True
    if (int(seqno) > int(_seqno)):
        if (_signature != signature):
            reprogramChain = True
            util.SMlog("Seqno increased from %s to %s: reprogamming "\
                        "ingress rules for vm %s" % (_seqno, seqno, vmName))
        else:
            util.SMlog("Seqno increased from %s to %s: but no change "\
                        "in signature for vm: skip programming ingress "\
                        "rules %s" % (_seqno, seqno, vmName))
    elif (int(seqno) < int(_seqno)):
        util.SMlog("Seqno decreased from %s to %s: ignoring these "\
                        "ingress rules for vm %s" % (_seqno, seqno, vmName))
        rewriteLog = False
    elif (signature != _signature):
        util.SMlog("Seqno %s stayed the same but signature changed from "\
                    "%s to %s for vm %s" % (seqno, _signature, signature, vmName))
        rewriteLog = True
        reprogramChain = True
    else:
        util.SMlog("Seqno and signature stayed the same: %s : ignoring these "\
                        "ingress rules for vm %s" % (seqno, vmName))
        rewriteLog = False
        
    return [reprogramDefault, reprogramChain, rewriteLog]
    

@echo
def write_rule_log_for_vm(vmName, vmID, vmIP, domID, signature, seqno, vmMac='ff:ff:ff:ff:ff:ff'):
    vm_name = vmName
    logfilename = "/var/run/cloud/" + vm_name +".log"
    util.SMlog("Writing log to " + logfilename)
    logf = open(logfilename, 'w')
    output = ','.join([vmName, vmID, vmIP, domID, signature, seqno, vmMac])
    result = True
    try:
        logf.write(output)
        logf.write('\n')
    except:
        util.SMlog("Failed to write to rule log file " + logfilename)
        result = False
        
    logf.close()
    
    return result

@echo
def remove_rule_log_for_vm(vmName):
    vm_name = vmName
    logfilename = "/var/run/cloud/" + vm_name +".log"

    result = True
    try:
        os.remove(logfilename)
    except:
        util.SMlog("Failed to delete rule log file " + logfilename)
        result = False
    
    return result

@echo
def inflate_rules (zipped):
   return zlib.decompress(base64.b64decode(zipped))

@echo
def cache_ipset_keyword():
    tmpname = 'ipsetqzvxtmp'
    try:
        util.pread2(['/bin/bash', '-c', 'ipset -N ' + tmpname + ' iptreemap'])
    except:
        util.pread2(['/bin/bash', '-c', 'ipset -F ' + tmpname])

    try:
        util.pread2(['/bin/bash', '-c', 'iptables -A INPUT -m set --set ' + tmpname + ' src' + ' -j ACCEPT'])
        util.pread2(['/bin/bash', '-c', 'iptables -D INPUT -m set --set ' + tmpname + ' src' + ' -j ACCEPT'])
        keyword = 'set'
    except:
        keyword = 'match-set'
    
    try:
       util.pread2(['/bin/bash', '-c', 'ipset -X ' + tmpname])
    except:
       pass
       
    cachefile = "/var/cache/cloud/ipset.keyword"
    util.SMlog("Writing ipset keyword to " + cachefile)
    cachef = open(cachefile, 'w')
    try:
        cachef.write(keyword)
        cachef.write('\n')
    except:
        util.SMlog("Failed to write to cache file " + cachef)
        
    cachef.close()
    return keyword
    
@echo
def get_ipset_keyword():
    cachefile = "/var/cache/cloud/ipset.keyword"
    keyword = 'match-set'
    
    if not os.path.exists(cachefile):
        util.SMlog("Failed to find ipset keyword cachefile %s" %cachefile)
        keyword = cache_ipset_keyword()
    else:
        lines = (line.rstrip() for line in open(cachefile))
        for line in lines:
            keyword = line
            break

    return keyword

@echo
def network_rules(session, args):
  try:
    vm_name = args.get('vmName')
    vm_ip = args.get('vmIP')
    vm_id = args.get('vmID')
    vm_mac = args.get('vmMAC')
    signature = args.pop('signature')
    seqno = args.pop('seqno')
    deflated = 'false'
    if 'deflated' in args:
        deflated = args.pop('deflated')
    
    try:
        vm = session.xenapi.VM.get_by_name_label(vm_name)
        if len(vm) != 1:
             util.SMlog("### Could not get record for vm ## " + vm_name)
             return 'false'
        vm_rec = session.xenapi.VM.get_record(vm[0])
        domid = vm_rec.get('domid')
    except:
        util.SMlog("### Failed to get domid for vm  ## " + vm_name)
        return 'false'
    if domid == '-1':
        util.SMlog("### Failed to get domid for vm (-1):  " + vm_name)
        return 'false'
   
    vif = "vif" + domid + ".0"
    tap = "tap" + domid + ".0"
    vifs = [vif]
    try:
        util.pread2(['ifconfig', tap])
        vifs.append(tap)
    except:
        pass
   

    reason = 'seqno_change_or_sig_change'
    [reprogramDefault, reprogramChain, rewriteLog] = \
             check_rule_log_for_vm (vm_name, vm_id, vm_ip, domid, signature, seqno)
    
    if not reprogramDefault and not reprogramChain:
        util.SMlog("No changes detected between current state and received state")
        reason = 'seqno_same_sig_same'
        if rewriteLog:
            reason = 'seqno_increased_sig_same'
            write_rule_log_for_vm(vm_name, vm_id, vm_ip, domid, signature, seqno, vm_mac)
        util.SMlog("Programming network rules for vm  %s seqno=%s signature=%s guestIp=%s,"\
               " do nothing, reason=%s" % (vm_name, seqno, signature, vm_ip, reason))
        return 'true'
           
    if not reprogramChain:
        util.SMlog("###Not programming any ingress rules since no changes detected?")
        return 'true'

    if reprogramDefault:
        util.SMlog("Change detected in vmId or vmIp or domId, resetting default rules")
        default_network_rules(session, args)
        reason = 'domid_change'
    
    rules = args.pop('rules')
    if deflated.lower() == 'true':
       rules = inflate_rules (rules)
    keyword = '--' + get_ipset_keyword() 
    lines = rules.split(' ')

    util.SMlog("Programming network rules for vm  %s seqno=%s numrules=%s signature=%s guestIp=%s,"\
              " update iptables, reason=%s" % (vm_name, seqno, len(lines), signature, vm_ip, reason))
    
    cmds = []
    egressrules = 0
    for line in lines:
        tokens = line.split(':')
        if len(tokens) != 5:
          continue
        type = tokens[0]
        protocol = tokens[1]
        start = tokens[2]
        end = tokens[3]
        cidrs = tokens.pop();
        ips = cidrs.split(",")
        ips.pop()
        allow_any = False

        if type == 'E':
            vmchain = egress_chain_name(vm_name)
            action = "RETURN"
            direction = "dst"
            egressrules = egressrules + 1
        else:
            vmchain = chain_name(vm_name)
            action = "ACCEPT"
            direction = "src"
        if  '0.0.0.0/0' in ips:
            i = ips.index('0.0.0.0/0')
            del ips[i]
            allow_any = True
        range = start + ":" + end
        if ips:    
            ipsetname = vmchain + "_" + protocol + "_" + start + "_" + end
            if start == "-1":
                ipsetname = vmchain + "_" + protocol + "_any"

            if ipset(ipsetname, protocol, start, end, ips) == False:
                util.SMlog(" failed to create ipset for rule " + str(tokens))

            if protocol == 'all':
                iptables = ['iptables', '-I', vmchain, '-m', 'state', '--state', 'NEW', '-m', 'set', keyword, ipsetname, direction, '-j', action]
            elif protocol != 'icmp':
                iptables = ['iptables', '-I', vmchain, '-p',  protocol, '-m', protocol, '--dport', range, '-m', 'state', '--state', 'NEW', '-m', 'set', keyword, ipsetname, direction, '-j', action]
            else:
                range = start + "/" + end
                if start == "-1":
                    range = "any"
                iptables = ['iptables', '-I', vmchain, '-p',  'icmp', '--icmp-type',  range,  '-m', 'set', keyword, ipsetname, direction, '-j', action]
                
            cmds.append(iptables)
            util.SMlog(iptables)
        
        if allow_any and protocol != 'all':
            if protocol != 'icmp':
                iptables = ['iptables', '-I', vmchain, '-p',  protocol, '-m', protocol, '--dport', range, '-m', 'state', '--state', 'NEW', '-j', action]
            else:
                range = start + "/" + end
                if start == "-1":
                    range = "any"
                iptables = ['iptables', '-I', vmchain, '-p',  'icmp', '--icmp-type',  range, '-j', action]
            cmds.append(iptables)
            util.SMlog(iptables)
      
    vmchain = chain_name(vm_name)        
    util.pread2(['iptables', '-F', vmchain])
    egress_vmchain = egress_chain_name(vm_name)        
    util.pread2(['iptables', '-F', egress_vmchain])
    
    for cmd in cmds:
        util.pread2(cmd)
        
    if egressrules == 0 :
        util.pread2(['iptables', '-A', egress_vmchain, '-j', 'RETURN'])
    else:
        util.pread2(['iptables', '-A', egress_vmchain, '-j', 'DROP'])
   
    util.pread2(['iptables', '-A', vmchain, '-j', 'DROP'])

    if write_rule_log_for_vm(vm_name, vm_id, vm_ip, domid, signature, seqno, vm_mac) == False:
        return 'false'
    
    return 'true'
  except:
    util.SMlog("Failed to network rule !")

@echo
def checkRouter(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/getRouterStatus.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
    except:
        util.SMlog("  check router status fail! ")
        txt = '' 

    return txt

@echo
def bumpUpPriority(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/bumpUpPriority.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
        txt = 'success'
    except:
        util.SMlog("bump up priority fail! ")
        txt = ''

    return txt
    
@echo
def setDNATRule(session, args):
    add = args["add"]
    if add == "false":
        util.pread2(["iptables", "-t", "nat", "-F"])
    else:
        ip = args["ip"]
        port = args["port"]
        util.pread2(["iptables", "-t", "nat", "-F"])
        util.pread2(["iptables", "-t", "nat", "-A", "PREROUTING", "-i", "xenbr0", "-p", "tcp", "--dport", port, "-m", "state", "--state", "NEW", "-j", "DNAT", "--to-destination", ip +":443"])
    return ""

@echo
def createISOVHD(session, args):
    # Should not create the VDI if the systemvm.iso does not exist
    if not os.path.exists('/usr/share/xcp/packages/iso/systemvm.iso'):
        return "Failed"
    #hack for XCP on ubuntu 12.04, as can't attach iso to a vm
    vdis = session.xenapi.VDI.get_by_name_label("systemvm-vdi");
    util.SMlog(vdis)
    if len(vdis) > 0:
        vdi_record = session.xenapi.VDI.get_record(vdis[0])
        vdi_uuid = vdi_record['uuid']
        return vdi_uuid
    localsrUUid = args['uuid'];
    sr = session.xenapi.SR.get_by_uuid(localsrUUid)
    data = {'name_label': "systemvm-vdi",
            'SR': sr,
            'virtual_size': '50000000',
            'type': 'user',
            'sharable':False,
            'read_only':False,
            'other_config':{},
            }
    vdi = session.xenapi.VDI.create(data);
    vdi_record = session.xenapi.VDI.get_record(vdi)

    vdi_uuid = vdi_record['uuid']

    vms = session.xenapi.VM.get_all()
    ctrldom = None
    for vm in vms:
        dom0 = session.xenapi.VM.get_is_control_domain(vm)
        if dom0 is False:
            continue
        else:
            ctrldom = vm

    if ctrldom is None:
        return "Failed"

    vbds = session.xenapi.VM.get_VBDs(ctrldom)
    if len(vbds) == 0:
        vbd = session.xenapi.VBD.create({"VDI": vdi, "VM": ctrldom, "type":"Disk", "device": "xvda4",  "bootable": False, "mode": "RW", "userdevice": "4", "empty":False,
                              "other_config":{}, "qos_algorithm_type":"", "qos_algorithm_params":{}})
    else:
        vbd = vbds[0]

    vbdr = session.xenapi.VBD.get_record(vbd)
    if session.xenapi.VBD.get_currently_attached(vbd) is False:
        session.xenapi.VBD.plug(vbd)
        vbdr = session.xenapi.VBD.get_record(vbd)
    util.pread2(["dd", "if=/usr/share/xcp/packages/iso/systemvm.iso", "of=" + "/dev/" + vbdr["device"]])
    session.xenapi.VBD.unplug(vbd)
    session.xenapi.VBD.destroy(vbd)
    return vdi_uuid

@echo
def getDomRVersion(session, args):
    sargs = args['args']
    cmd = sargs.split(' ')
    cmd.insert(0, "/opt/cloud/bin/getDomRVersion.sh")
    cmd.insert(0, "/bin/bash")
    try:
        txt = util.pread2(cmd)
    except:
        util.SMlog("  get domR version fail! ")
        txt = '' 

    return txt

if __name__ == "__main__":
     XenAPIPlugin.dispatch({"pingtest": pingtest, "setup_iscsi":setup_iscsi,
                            "preparemigration": preparemigration, 
                            "setIptables": setIptables, "pingdomr": pingdomr, "pingxenserver": pingxenserver,  
                            "ipassoc": ipassoc, "savePassword": savePassword, 
                            "saveDhcpEntry": saveDhcpEntry, "setFirewallRule": setFirewallRule, 
                            "setLoadBalancerRule": setLoadBalancerRule, "createFile": createFile, "deleteFile": deleteFile, 
                            "networkUsage": networkUsage, "network_rules":network_rules, 
                            "can_bridge_firewall":can_bridge_firewall, "default_network_rules":default_network_rules,
                            "destroy_network_rules_for_vm":destroy_network_rules_for_vm, 
                            "default_network_rules_systemvm":default_network_rules_systemvm, 
                            "get_rule_logs_for_vms":get_rule_logs_for_vms, 
                            "setLinkLocalIP":setLinkLocalIP, "lt2p_vpn":lt2p_vpn,
                            "cleanup_rules":cleanup_rules, "checkRouter":checkRouter,
                            "bumpUpPriority":bumpUpPriority, "getDomRVersion":getDomRVersion,
                            "kill_copy_process":kill_copy_process,
                            "createISOVHD":createISOVHD,
                            "setDNATRule":setDNATRule})