-
Notifications
You must be signed in to change notification settings - Fork 372
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add a binary file for setting up firewall rules on the VM #2147
Conversation
return command | ||
|
||
@staticmethod | ||
def get_iptables_accept_command(wait, command, destination, owner_uid): |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These 2 commands are all we need to setup the rules on system reboot so just created a new Util just for them
Codecov Report
@@ Coverage Diff @@
## develop #2147 +/- ##
===========================================
+ Coverage 70.64% 70.71% +0.06%
===========================================
Files 95 95
Lines 12939 12965 +26
Branches 1842 1844 +2
===========================================
+ Hits 9141 9168 +27
Misses 3390 3390
+ Partials 408 407 -1
Continue to review full report at Codecov.
|
This service would run before the network would be setup, so we need to maintain state of the previous Wireserver IP | ||
to ensure we cover all attack vectors to the Wire IP. | ||
""" | ||
_setup_firewall_rules() |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The idea is to create a new service file which would call this binary to setup the network rules on startup. Adding another parameter to our /sbin/waagent
binary was being a bit painful because that way we would've needed to separate out all dependencies on the VM (like file access, network access, etc) because we plan to run this service way high up in the boot order where these bare minimum dependencies would not be available.
Setting up the new service would come in subsequent PRs
Description
This is the 1st PR for the change to add firewall rules to the VM on system reboot (since iptables are not persisted on reboots).
This PR deals with -
Issue #
PR information
Quality of Code and Contribution Guidelines