Previous topic

The nova.virt.libvirt.connection Module

Next topic

The nova.virt.libvirt.imagecache Module

This Page

Psst... hey. You're reading the latest content, but it might be out of sync with code. You can read Nova 2011.2 docs or all OpenStack docs too.

The nova.virt.libvirt.firewall Module

class IptablesFirewallDriver(execute=None, **kwargs)

Bases: nova.virt.firewall.IptablesFirewallDriver

apply_instance_filter(instance, network_info)

No-op. Everything is done in prepare_instance_filter

instance_filter_exists(instance, network_info)

Check nova-instance-instance-xxx exists

setup_basic_filtering(instance, network_info)

Set up provider rules and basic NWFilter.

unfilter_instance(instance, network_info)
class NWFilterFirewall(get_connection, **kwargs)

Bases: nova.virt.firewall.FirewallDriver

This class implements a network filtering mechanism by using libvirt’s nwfilter. all instances get a filter (“nova-base”) applied. This filter provides some basic security such as protection against MAC spoofing, IP spoofing, and ARP spoofing.

apply_instance_filter(instance, network_info)

No-op. Everything is done in prepare_instance_filter

instance_filter_exists(instance, network_info)

Check nova-instance-instance-xxx exists

static nova_dhcp_filter()

The standard allow-dhcp-server filter is an <ip> one, so it uses ebtables to allow traffic through. Without a corresponding rule in iptables, it’ll get blocked anyway.

setup_basic_filtering(instance, network_info)

Set up basic filtering (MAC, IP, and ARP spoofing protection)

unfilter_instance(instance, network_info)

Clear out the nwfilter rules.