Revision:

Revisions

# Date Author Comment
c05f2608 03/05/2014 06:14 pm Dimitris Aragiorgis

Refactor ifup-extra script

1) Look for all kind of tags (interface specific or not):
some-prefix:1:mail
some-prefix:snf-nic-12345:mail
some-prefix:8252fabd-1021-411c-b8f7-ed79ed509bb8:mail
some-prefix:mail

2) some-prefix must be other than synnefo:network:...
fd80d055 03/05/2014 06:14 pm Dimitris Aragiorgis

Do not add ebtables rule for dhcp response

nfdhpcd opens a socket and binds it with tap interface. So dhcp
response will NOT go though the bridge and ebtables rule is
not needed.

Signed-off-by: Dimitris Aragiorgis <>
e5171922 03/05/2014 06:14 pm Dimitris Aragiorgis

Fix typo in ebtables

If interface has an IP we used to add a rule that does not allow
packets coming from TAP to have a different IP. There was a typo
in if statement and the rule did never apply.

Still, we do NOT want this rule so we fix typo and comment the...
184370fd 03/05/2014 06:14 pm Dimitris Aragiorgis

Create ebtables chains with RETURN policy

This fixes inter-node private networks in case of multicast packets.
Multicast packets are forwarded to all interfaces bridged
on the bridge. Lets assume the following:

prv0 bridge with tap0, tap1, and eth1.
From tap0 comes a multicast packet....
66c58448 03/05/2014 06:14 pm Dimitris Aragiorgis

Support execution of extra script

In case of kvm-ifup, if an extra script (/etc/ganeti/ifup-extra)
exists, execute it before exiting.

An dummy example script is given, that parses instance's tags,
and searches for synnefo:network:<ident>:mail.

Signed-off-by: Dimitris Aragiorgis <>
c780a7c5 03/05/2014 06:14 pm Dimitris Aragiorgis

Add sample rules in ifup-extra

Here we allows outgoing traffic with destination port 25.

Please note that every rule that is added when the corresponding
tag is found it should always be removed at the beginning of the
script. With other words you should remove stale entries before...
a57b3c64 03/05/2014 06:14 pm Dimitris Aragiorgis

Fix ebtables

1) Add ebtables in INPUT/OUTPUT chains too
This is needed because multicast packets
(e.g. with dst address 01:00:83:xx:xx:xx) do NOT go through forward chain

2) In case of nfdhpcd allow DHCP replies only with src address the
MAC address of incoming device (e.g. prv0)...
2cf27346 03/05/2014 06:14 pm Dimitris Aragiorgis

Setup ebtables only for mac filtered setups

We used to drop DHCP requests for all bridged setups in case of
nfdhcpd. This requires ebtables setup for private vlans as well.

Dropping DHCP requests in case of nfdhcpd is not really needed
because they are dropped in user space...
b0b92ac3 03/05/2014 03:06 pm Dimitris Aragiorgis

Add docs

Signed-off-by: Dimitris Aragiorgis <>
93476f13 03/05/2014 02:30 pm Dimitris Aragiorgis

Log table's uplink only if exists

Signed-off-by: Dimitris Aragiorgis <>
5ec7b145 03/05/2014 02:30 pm Dimitris Aragiorgis

Minor fix related to logging in dnshook

Signed-off-by: Dimitris Aragiorgis <>
c6fad0f3 03/05/2014 02:30 pm Dimitris Aragiorgis

Add kvm-ifdown-custom script

This should do any cleanup needed related to the interface
that is going down.

Signed-off-by: Dimitris Aragiorgis <>
263fe009 03/05/2014 02:30 pm Dimitris Aragiorgis

Move things inside get_info()

  • Set GANETI_INSTANCE_NAME
  • Set TABLE, INDEV

Signed-off-by: Dimitris Aragiorgis <>
30db6769 03/05/2014 02:30 pm Dimitris Aragiorgis

Fix ebtables in vif-custom

..and remove any unused rules (comments) related to ebtables

Signed-off-by: Dimitris Aragiorgis <>
46a998a6 03/05/2014 02:30 pm Dimitris Aragiorgis

Rename kvm-vif-bridge to kvm-ifup-custom

Package will create a symlink until this gets renamed in
upstream Ganeti as well.

Signed-off-by: Dimitris Aragiorgis <>
5b3472ad 03/05/2014 02:30 pm Dimitris Aragiorgis

Introduce get_info helper method

It gets the exported environment and calculates all needed vars for
a specific interface. Use this function early in scripts and as
soon as you extract each interface info in hooks.

Signed-off-by: Dimitris Aragiorgis <>
fe6454e7 03/05/2014 02:30 pm Dimitris Aragiorgis

Make get_info caclulate ebtables chain names

Signed-off-by: Dimitris Aragiorgis <>
e2c822b5 03/05/2014 02:30 pm Dimitris Aragiorgis

Minor changes related to logging

Signed-off-by: Dimitris Aragiorgis <>
90f2e36b 03/05/2014 02:30 pm Dimitris Aragiorgis

Some minor fixes..

- Use NETWORK_SUBNET6 since this is exported by Ganeti and not
just SUBNET6
- All logging in helper function
- Do not send GARP or delete neighbor proxy if desired vars are not
set

Signed-off-by: Dimitris Aragiorgis <>
43589485 03/05/2014 02:30 pm Dimitris Aragiorgis

Use arpsend instead of arping

arpsend comes along with ndsend with vzctl package.
We send only one packet in order not to delay ifup script.

Signed-off-by: Dimitris Aragiorgis <>
aeaafeb9 03/05/2014 02:30 pm Dimitris Aragiorgis

Small changes in if* scripts

  • Factor out GARP and neighbor proxy action from setup_routed*
  • Invoke send_garp in kvm-ifup
  • Invoke delete_neighbor_proxy in snf-network-hook

Signed-off-by: Dimitris Aragiorgis <>
859d4ba0 03/05/2014 02:30 pm Dimitris Aragiorgis

Use env var for logging script

Signed-off-by: Dimitris Aragiorgis <>
e8ff8060 03/05/2014 02:30 pm Dimitris Aragiorgis

Rename dnshook and fix-net

..to snf-network-dnshook and snf-network-hook correspondingly.

Signed-off-by: Dimitris Aragiorgis <>
14697fe6 03/05/2014 02:30 pm Dimitris Aragiorgis

Factor out common funtions from dnshook

Signed-off-by: Dimitris Aragiorgis <>
0e4e6bea 03/05/2014 02:30 pm Dimitris Aragiorgis

hooks-log -> snf-network-log

Signed-off-by: Dimitris Aragiorgis <>

« Previous 1 2 3 4 ... 10 Next » (26-50/249) | Per page: 25, 50, 100

Also available in: Atom