Merge lp:~markmc/nova/metadata-accept-rule into lp:~hudson-openstack/nova/trunk

[Mark McLoughlin]

Add INPUT chain rule for EC2 metadata requests (lp:856385)

On Fedora, the default policy for the INPUT chain in the filter table
is DROP. This means that EC2 metadata requests from guests get dropped.

We have nova-api add this rule to let it through:

$> sudo iptables -t filter -A nova-api-INPUT \
                 -s 0.0.0.0/0 -d $ec2_dmz_host \
                 -m tcp -p tcp --dport $ec2_port -j ACCEPT

[Vish Ishaya (vishvananda)]

again, reasonable. Perhaps one bug for all of these.

review: Approve

[Vish Ishaya (vishvananda)]

actually, I'm not so sure about this. This rule really needs to go into nova-api to be useful.

review: Abstain

[lp:~markmc/nova/metadata-accept-rule]

1528. By Mark McLoughlin on 2011-09-08

Have nova-api add the INPUT rule for EC2 metadata

It makes no sense to have nova-network add an iptables rule for the EC2
metadata service, since they may not actually be on the same host.

Instead, nova-api should add it directly. In order to do that, we add a
manager class for API services and allow the EC2 manager use the network
driver to add the rule.

[Mark McLoughlin (markmc)]

> actually, I'm not so sure about this. This rule really needs to go into nova-
> api to be useful.

Okay, I've attempted to have nova-api add it

[Vish Ishaya (vishvananda)]

I'm a little worried about adding it in to diablo, so we might just have to mention in the release notes that the rule will have to be added manually for fedora.

Also, the construction of the manager class isn't quite right. Host is supposed to be FLAGS.host not the ip string for listen.

review: Needs Fixing

[lp:~markmc/nova/metadata-accept-rule]

1529. By Mark McLoughlin on 2011-09-17

Allow EC2 manager host param be set to default FLAGS.host

1530. By Mark McLoughlin on 2011-09-17

Fix pep8 issue

[Mark McLoughlin (markmc)]

> I'm a little worried about adding it in to diablo, so we might just have to
> mention in the release notes that the rule will have to be added manually for
> fedora.

Okay. I've included the original hacky patch in the Fedora Diablo packages.

> Also, the construction of the manager class isn't quite right. Host is
> supposed to be FLAGS.host not the ip string for listen.

Good catch, fixed now.

[Thierry Carrez (ttx)]

Could you split it in a separate bug ? The other part of this bug is now fixed

[Mark McLoughlin (markmc)]

> Could you split it in a separate bug ? The other part of this bug is now fixed

Done, sorry for the delay

[Mark McLoughlin (markmc)]

Moved to gerrit:

https://review.openstack.org/#q,status:open+project:openstack/nova+branch:master+topic:metadata-accept-rule,n,z

Unmerged revisions

1530. By Mark McLoughlin on 2011-09-17

Fix pep8 issue

1529. By Mark McLoughlin on 2011-09-17

Allow EC2 manager host param be set to default FLAGS.host

1528. By Mark McLoughlin on 2011-09-08

Have nova-api add the INPUT rule for EC2 metadata

It makes no sense to have nova-network add an iptables rule for the EC2
metadata service, since they may not actually be on the same host.

Instead, nova-api should add it directly. In order to do that, we add a
manager class for API services and allow the EC2 manager use the network
driver to add the rule.

1527. By Mark McLoughlin on 2011-09-05

Add INPUT chain rule for EC2 metadata requests

On Fedora, the default policy for the INPUT chain in the filter table
is DROP. This means that EC2 metadata requests from guests get dropped.

Add this rule to let it through:

$> sudo iptables -t filter -A nova-network-INPUT \
                 -s 0.0.0.0/0 -d $ec2_dmz_host \
                 -m tcp -p tcp --dport $ec2_port -j ACCEPT

However, this only works if nova-network and nova-api are on the same
host.

=== added file 'nova/api/manager.py'
--- nova/api/manager.py	1970-01-01 00:00:00 +0000
+++ nova/api/manager.py	2011-09-17 07:06:27 +0000
@@ -0,0 +1,42 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from nova import flags
+from nova import manager
+from nova import utils
+
+FLAGS = flags.FLAGS
+
+
+class EC2Manager(manager.Manager):
+    """EC2 API manager.
+
+    This class manages the EC2 API service initialization. Currently, it
+    just adds an iptables filter rule for the metadata service.
+    """
+    def __init__(self, *args, **kwargs):
+        super(EC2Manager, self).__init__(*args, **kwargs)
+        self.network_driver = utils.import_object(FLAGS.network_driver)
+
+    def init_host(self):
+        """Perform any initialization.
+
+        Currently, we only add an iptables filter rule for the metadta
+        service.
+        """
+        self.network_driver.metadata_accept()

=== modified file 'nova/flags.py'
--- nova/flags.py	2011-09-06 11:31:39 +0000
+++ nova/flags.py	2011-09-17 07:06:27 +0000
@@ -419,6 +419,9 @@
 DEFINE_string('root_helper', 'sudo',
               'Command prefix to use for running commands as root')
 
+DEFINE_string('network_driver', 'nova.network.linux_net',
+              'Driver to use for network creation')
+
 DEFINE_bool('use_ipv6', False, 'use ipv6')
 
 DEFINE_integer('password_length', 12,

=== modified file 'nova/network/linux_net.py'
--- nova/network/linux_net.py	2011-09-16 14:40:37 +0000
+++ nova/network/linux_net.py	2011-09-17 07:06:27 +0000
@@ -384,6 +384,17 @@
     iptables_manager.apply()
 
 
+def metadata_accept():
+    """Create the filter accept rule for metadata."""
+    iptables_manager.ipv4['filter'].add_rule('INPUT',
+                                             '-s 0.0.0.0/0 -d %s '
+                                             '-p tcp -m tcp --dport %s '
+                                             '-j ACCEPT' % \
+                                             (FLAGS.ec2_dmz_host,
+                                              FLAGS.ec2_port))
+    iptables_manager.apply()
+
+
 def init_host():
     """Basic networking setup goes here."""
     # NOTE(devcamcar): Cloud public SNAT entries and the default

=== modified file 'nova/network/manager.py'
--- nova/network/manager.py	2011-09-14 20:57:15 +0000
+++ nova/network/manager.py	2011-09-17 07:06:27 +0000
@@ -96,8 +96,6 @@
 flags.DEFINE_string('gateway_v6', None, 'Default IPv6 gateway')
 flags.DEFINE_integer('cnt_vpn_clients', 0,
                      'Number of addresses reserved for vpn clients')
-flags.DEFINE_string('network_driver', 'nova.network.linux_net',
-                    'Driver to use for network creation')
 flags.DEFINE_bool('update_dhcp_on_disassociate', False,
                   'Whether to update dhcp when fixed_ip is disassociated')
 flags.DEFINE_integer('fixed_ip_disassociate_timeout', 600,

=== modified file 'nova/service.py'
--- nova/service.py	2011-08-29 21:36:12 +0000
+++ nova/service.py	2011-09-17 07:06:27 +0000
@@ -45,9 +45,13 @@
 flags.DEFINE_integer('periodic_interval', 60,
                      'seconds between running periodic tasks',
                      lower_bound=1)
+flags.DEFINE_string('ec2_manager', 'nova.api.manager.EC2Manager',
+                    'EC2 API service manager')
 flags.DEFINE_string('ec2_listen', "0.0.0.0",
                     'IP address for EC2 API to listen')
 flags.DEFINE_integer('ec2_listen_port', 8773, 'port for ec2 api to listen')
+flags.DEFINE_string('osapi_manager', None,
+                    'OpenStack API service manager')
 flags.DEFINE_string('osapi_listen', "0.0.0.0",
                     'IP address for OpenStack API to listen')
 flags.DEFINE_integer('osapi_listen_port', 8774, 'port for os api to listen')
@@ -290,6 +294,7 @@
 
         """
         self.name = name
+        self.manager = self._get_manager()
         self.loader = loader or wsgi.Loader()
         self.app = self.loader.load_app(name)
         self.host = getattr(FLAGS, '%s_listen' % name, "0.0.0.0")
@@ -299,6 +304,27 @@
                                   host=self.host,
                                   port=self.port)
 
+    def _get_manager(self):
+        """Initialize a Manager object appropriate for this service.
+
+        Use the service name to look up a Manager subclass from the
+        configuration and initialize an instance. If no class name
+        is configured, just return None.
+
+        :returns: a Manager instance, or None.
+
+        """
+        fl = '%s_manager' % self.name
+        if not fl in FLAGS:
+            return None
+
+        manager_class_name = FLAGS.get(fl, None)
+        if not manager_class_name:
+            return None
+
+        manager_class = utils.import_class(manager_class_name)
+        return manager_class()
+
     def start(self):
         """Start serving this service using loaded configuration.
 
@@ -308,6 +334,8 @@
         :returns: None
 
         """
+        if self.manager:
+            self.manager.init_host()
         self.server.start()
         self.port = self.server.port