This Page

Psst... hey. You're reading the latest content, but it might be out of sync with code. You can read Nova 2011.1 docs or all OpenStack docs too.

The nova.network.linux_net Module

Implements vlans, bridges, and iptables rules using linux utilities.

class nova.network.linux_net.IptablesManager(execute=None)

Bases: object

Wrapper for iptables

See IptablesTable for some usage docs

A number of chains are set up to begin with.

First, nova-filter-top. It’s added at the top of FORWARD and OUTPUT. Its name is not wrapped, so it’s shared between the various nova workers. It’s intended for rules that need to live at the top of the FORWARD and OUTPUT chains. It’s in both the ipv4 and ipv6 set of tables.

For ipv4 and ipv6, the builtin INPUT, OUTPUT, and FORWARD filter chains are wrapped, meaning that the “real” INPUT chain has a rule that jumps to the wrapped INPUT chain, etc. Additionally, there’s a wrapped chain named “local” which is jumped to from nova-filter-top.

For ipv4, the builtin PREROUTING, OUTPUT, and POSTROUTING nat chains are wrapped in the same was as the builtin filter chains. Additionally, there’s a snat chain that is applied after the POSTROUTING chain.

apply(*args, **kwargs)

Apply the current in-memory set of iptables rules

This will blow away any rules left over from previous runs of the same component of Nova, and replace them with our current set of rules. This happens atomically, thanks to iptables-restore.

class nova.network.linux_net.IptablesRule(chain, rule, wrap=True, top=False)

Bases: object

An iptables rule

You shouldn’t need to use this class directly, it’s only used by IptablesManager

class nova.network.linux_net.IptablesTable

Bases: object

An iptables table

add_chain(name, wrap=True)

Adds a named chain to the table

The chain name is wrapped to be unique for the component creating it, so different components of Nova can safely create identically named chains without interfering with one another.

At the moment, its wrapped name is <binary name>-<chain name>, so if nova-compute creates a chain named “OUTPUT”, it’ll actually end up named “nova-compute-OUTPUT”.

add_rule(chain, rule, wrap=True, top=False)

Add a rule to the table

This is just like what you’d feed to iptables, just without the “-A <chain name>” bit at the start.

However, if you need to jump to one of your wrapped chains, prepend its name with a ‘$’ which will ensure the wrapping is applied correctly.

remove_chain(name, wrap=True)

Remove named chain

This removal “cascades”. All rule in the chain are removed, as are all rules in other chains that jump to it.

If the chain is not found, this is merely logged.

remove_rule(chain, rule, wrap=True, top=False)

Remove a rule from a chain

Note: The rule must be exactly identical to the one that was added. You cannot switch arguments around like you can with the iptables CLI tool.

nova.network.linux_net.bind_floating_ip(floating_ip, check_exit_code=True)

Bind ip to public interface

nova.network.linux_net.ensure_bridge(*args, **kwargs)

Create a bridge unless it already exists.

Parameters:
  • interface – the interface to create the bridge on.
  • net_attrs – dictionary with attributes used to create the bridge.

If net_attrs is set, it will add the net_attrs[‘gateway’] to the bridge using net_attrs[‘broadcast’] and net_attrs[‘cidr’]. It will also add the ip_v6 address specified in net_attrs[‘cidr_v6’] if use_ipv6 is set.

The code will attempt to move any ips that already exist on the interface onto the bridge and reset the default gateway if necessary.

nova.network.linux_net.ensure_floating_forward(floating_ip, fixed_ip)

Ensure floating ip forwarding rule

nova.network.linux_net.ensure_metadata_ip()

Sets up local metadata ip

nova.network.linux_net.ensure_vlan(vlan_num)

Create a vlan unless it already exists

nova.network.linux_net.ensure_vlan_bridge(vlan_num, bridge, net_attrs=None)

Create a vlan and bridge unless they already exist

nova.network.linux_net.ensure_vlan_forward(public_ip, port, private_ip)

Sets up forwarding rules for vlan

nova.network.linux_net.floating_forward_rules(floating_ip, fixed_ip)
nova.network.linux_net.get_dhcp_hosts(context, network_id)

Get a string containing a network’s hosts config in dhcp-host format

nova.network.linux_net.get_dhcp_leases(context, network_id)

Return a network’s hosts config in dnsmasq leasefile format

nova.network.linux_net.init_host()

Basic networking setup goes here

nova.network.linux_net.metadata_forward()

Create forwarding rule for metadata

nova.network.linux_net.remove_floating_forward(floating_ip, fixed_ip)

Remove forwarding for floating ip

nova.network.linux_net.unbind_floating_ip(floating_ip)

Unbind a public ip from public interface

nova.network.linux_net.update_dhcp(*args, **kwargs)

(Re)starts a dnsmasq server for a given network

if a dnsmasq instance is already running then send a HUP signal causing it to reload, otherwise spawn a new instance

nova.network.linux_net.update_ra(*args, **kwargs)