ifup-extra

#!/bin/bash
#
# Copyright 2011-2013 GRNET S.A. All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
#   1. Redistributions of source code must retain the above
#      copyright notice, this list of conditions and the following
#      disclaimer.
#
#   2. Redistributions in binary form must reproduce the above
#      copyright notice, this list of conditions and the following
#      disclaimer in the documentation and/or other materials
#      provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY GRNET S.A. ``AS IS'' AND ANY EXPRESS
# OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GRNET S.A OR
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
# USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#
# The views and conclusions contained in the software and
# documentation are those of the authors and should not be
# interpreted as representing official policies, either expressed
# or implied, of GRNET S.A.


###############################################################################
# IMPORTANT: Your custom script must configure the network interface FULLY,
# regardless of whether your custom tag, e.g., some-prefix:allow_this, is set.
#
# This is necessary to ensure the interface is in a consistent state when
# local-prefix:allow_this is not defined. Thus you should undo the changes
# which a previous invocation of this script may have done.
#
# In the future, if Ganeti acquires the ability to run ifdown scripts,
# this functionality will be moved there, greatly simplifying the ifup scripts
#
# some-prefix must NOT be synnefo:network: since this is already used by
# synnefo for setting up firewalls, etc.

source /etc/default/snf-network
source /usr/lib/snf-network/common.sh

# Useful environment vars
# INTERFACE, INSTANCE, IP, NETWORK_TAGS, MODE, TABLE

# This cleans up the rules that might have been applied by a previous ifup-extra
function clean_extra (){

  iptables -D FORWARD -i $INTERFACE -p tcp --dport 25 -j ACCEPT
  iptables -D FORWARD -i $INTERFACE -p tcp --dport 25 -j ACCEPT -m comment --comment "snf-network_extra"
  ip6tables -D FORWARD -i $INTERFACE -p tcp --dport 25 -j ACCEPT
  ip6tables -D FORWARD -i $INTERFACE -p tcp --dport 25 -j ACCEPT -m comment --comment "snf-network_extra"

}

# This looks for the following tag examples:
#  some-prefix:1:mail
#  some-prefix:snf-nic-12345:mail
#  some-prefix:8252fabd-1021-411c-b8f7-ed79ed509bb8:mail
#  some-prefix:mail
# and issues some iptables rules
function setup_extra () {

  ifprefixindex="some-prefix:$INTERFACE_INDEX:"
  ifprefixname="some-prefix:$INTERFACE_NAME:"
  ifprefixuuid="some-prefix:$INTERFACE_UUID:"
  ifprefix="some-prefix:"

  for tag in $TAGS; do
    tag=${tag#$ifprefixindex}
    tag=${tag#$ifprefixname}
    tag=${tag#$ifprefixuuid}
    tag=${tag#$ifprefix}
    case $tag in
      mail)
      # Here add iptalbes rule..
      log "Tag $tag found: Applying rule for $INTERFACE..."
      iptables  -I FORWARD -i $INTERFACE -p tcp --dport 25 -j ACCEPT -m comment --comment "snf-network_extra"
      ip6tables -I FORWARD -i $INTERFACE -p tcp --dport 25 -j ACCEPT -m comment --comment "snf-network_extra"
    ;;
    esac
  done

}

function save_all_tables () {

  date > $STATE_DIR/date
  iptables-save > $STATE_DIR/snf-network.v4
  ip6tables-save > $STATE_DIR/snf-network.v6
  arptables-save > $STATE_DIR/snf-network.arp

}

# This is an example file. Actually it does nothing.
# Please see the instructions above before adding any logic here.

exit 0