diff options
| author | Soren Hansen <soren@linux2go.dk> | 2011-09-02 13:44:10 +0200 |
|---|---|---|
| committer | Soren Hansen <soren@linux2go.dk> | 2011-09-02 13:44:10 +0200 |
| commit | 8a5611f9b2fa632ccfcd04523ee42f69b223ea6e (patch) | |
| tree | 255a889061c94a8ca8007d2ae390d542927ed1a0 | |
| parent | d80dc5bbbd1781bd33d9f69b608014e9cc2e41a3 (diff) | |
Fix protocol-less security groups.
| -rw-r--r-- | nova/tests/test_libvirt.py | 11 | ||||
| -rw-r--r-- | nova/virt/libvirt/firewall.py | 4 |
2 files changed, 14 insertions, 1 deletions
diff --git a/nova/tests/test_libvirt.py b/nova/tests/test_libvirt.py index 8c6775b29..f0aa2a918 100644 --- a/nova/tests/test_libvirt.py +++ b/nova/tests/test_libvirt.py @@ -1033,6 +1033,13 @@ class IptablesFirewallTestCase(test.TestCase): 'to_port': 81, 'group_id': src_secgroup['id']}) + db.security_group_rule_create(admin_ctxt, + {'parent_group_id': secgroup['id'], + 'group_id': src_secgroup['id']}) + + db.instance_add_security_group(admin_ctxt, instance_ref['id'], + secgroup['id']) + db.instance_add_security_group(admin_ctxt, instance_ref['id'], secgroup['id']) db.instance_add_security_group(admin_ctxt, src_instance_ref['id'], @@ -1106,6 +1113,10 @@ class IptablesFirewallTestCase(test.TestCase): self.assertTrue(len(filter(regex.match, self.out_rules)) > 0, "TCP port 80/81 acceptance rule wasn't added") + regex = re.compile('-A .* -j ACCEPT -s %s' % (src_ip,)) + self.assertTrue(len(filter(regex.match, self.out_rules)) > 0, + "TCP port 80/81 acceptance rule wasn't added") + regex = re.compile('-A .* -j ACCEPT -p tcp ' '-m multiport --dports 80:81 -s 192.168.10.0/24') self.assertTrue(len(filter(regex.match, self.out_rules)) > 0, diff --git a/nova/virt/libvirt/firewall.py b/nova/virt/libvirt/firewall.py index c2f4f91e8..dfa1deba7 100644 --- a/nova/virt/libvirt/firewall.py +++ b/nova/virt/libvirt/firewall.py @@ -663,7 +663,9 @@ class IptablesFirewallDriver(FirewallDriver): if version == 6 and rule.protocol == 'icmp': protocol = 'icmpv6' - args = ['-j ACCEPT', '-p', protocol] + args = ['-j ACCEPT'] + if protocol: + args += ['-p', protocol] if protocol in ['udp', 'tcp']: if rule.from_port == rule.to_port: |