Previous topic

The nova.virt.fake Module

Next topic

The nova.virt.images Module

This Page

Psst... hey. You're reading the latest content, but it might be out of sync with code. You can read Nova 2011.2 docs or all OpenStack docs too.

The nova.virt.firewall Module

class FirewallDriver

Bases: object

Firewall Driver base class.

Defines methods that any driver providing security groups and provider fireall functionality should implement.

apply_instance_filter(instance, network_info)

Apply instance filter.

Once this method returns, the instance should be firewalled appropriately. This method should as far as possible be a no-op. It’s vastly preferred to get everything set up in prepare_instance_filter.

instance_filter_exists(instance, network_info)

Check nova-instance-instance-xxx exists

prepare_instance_filter(instance, network_info)

Prepare filters for the instance. At this point, the instance isn’t running yet.

refresh_provider_fw_rules()

Refresh common rules for all hosts/instances from data store.

Gets called when a rule has been added to or removed from the list of rules (via admin api).

refresh_security_group_members(security_group_id)

Refresh security group members from data store

Gets called when an instance gets added to or removed from the security group.

refresh_security_group_rules(security_group_id)

Refresh security group rules from data store

Gets called when a rule has been added to or removed from the security group.

setup_basic_filtering(instance, network_info)

Create rules to block spoofing and allow dhcp.

This gets called when spawning an instance, before prepare_instance_filter().

unfilter_instance(instance, network_info)

Stop filtering instance

class IptablesFirewallDriver(**kwargs)

Bases: nova.virt.firewall.FirewallDriver

Driver which enforces security groups through iptables rules.

add_filters_for_instance(instance)
apply_instance_filter(instance, network_info)

No-op. Everything is done in prepare_instance_filter.

do_refresh_security_group_rules(*args, **kwargs)
instance_filter_exists(instance, network_info)
instance_rules(instance, network_info)
prepare_instance_filter(instance, network_info)
refresh_provider_fw_rules()

See FirewallDriver docs.

refresh_security_group_members(security_group)
refresh_security_group_rules(security_group)
remove_filters_for_instance(instance)
setup_basic_filtering(instance, network_info)
unfilter_instance(instance, network_info)
class NoopFirewallDriver(*args, **kwargs)

Bases: object

Firewall driver which just provides No-op methods.

instance_filter_exists(instance, network_info)