cloudstack-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From GitBox <...@apache.org>
Subject [GitHub] rhtyd commented on a change in pull request #2505: CLOUDSTACK-10333: Secure Live VM Migration for KVM
Date Mon, 26 Mar 2018 06:56:11 GMT
rhtyd commented on a change in pull request #2505: CLOUDSTACK-10333: Secure Live VM Migration
for KVM
URL: https://github.com/apache/cloudstack/pull/2505#discussion_r176993902
 
 

 ##########
 File path: debian/cloudstack-agent.postinst
 ##########
 @@ -50,6 +50,13 @@ case "$1" in
             mkdir /etc/libvirt/hooks
         fi
         cp -a /usr/share/cloudstack-agent/lib/libvirtqemuhook /etc/libvirt/hooks/qemu
+
+        # Enable TLS enabled VM migration for libvirtd
+        if ! iptables-save | grep -- "-A INPUT -p tcp -m tcp --dport 16514 -j ACCEPT" >
/dev/null; then
+            iptables -t filter -A INPUT -p tcp -m tcp --dport 16514 -j ACCEPT
+            iptables-save > /etc/iptables/rules.v4
+        fi
+
 
 Review comment:
   Alright @wido, perhaps we can remove this for Ubuntu (debian pkg). On both CentOS 6 and
7, iptables service is indeed available that is used to save existing rules, firewalld is
not used here. It is likely that things may break for el6/7 users. I'm okay to document the
change in release notes docs as well. Let's ask others for their thoughts - @DaanHoogland
@rafaelweingartner @resmo @ustcweizhou @nvazquez @mlsorensen ?

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services

Mime
View raw message