• Leigh Stoller's avatar
    Server side of firewall support for XEN containers. · 2faea2f3
    Leigh Stoller authored
    This differs from the current firewall support, which assumes a single
    firewall for an entire experiment, hosted on a dedicated physical
    node. At some point, it would be better to host the dedicated firewall
    inside a XEN container, but that is a project for another day (year).
    
    Instead, I added two sets of firewall rules to the default_firewall_rules
    table, one for dom0 and another for domU. These follow the current
    style setup of open,basic,closed, while elabinelab is ignored since it
    does not make sense for this yet.
    
    These two rules sets are independent, the dom0 rules can be applied to
    the physical host, and domU rules can be applied to specific
    containers.
    
    My goal is that all shared nodes will get the dom0 closed rules (ssh
    from local boss only) to avoid the ssh attacks that all of the racks
    are seeing.
    
    DomU rules can be applied on a per-container (node) basis. As
    mentioned above this is quite different, and needed minor additions to
    the virt_nodes table to allow it.
    2faea2f3
database-fill.sql 110 KB