#NEWLINE# def security_group_to_nwfilter_xml( self , security_group_id ) : #NEWLINE# #INDENT# security_group = db . security_group_get ( context . get_admin_context ( ) , security_group_id ) #NEWLINE# rule_xml = '' #NEWLINE# v6protocol = { #NEWLINE# #INDENT# 'tcp' : 'tcp-ipv6' , #NEWLINE# 'udp' : 'udp-ipv6' , #NEWLINE# 'icmp' : 'icmpv6' , #NEWLINE# #UNINDENT# } #NEWLINE# for rule in security_group . rules : #NEWLINE# #INDENT# rule_xml += "<rule action='accept' direction='in' priority='300'>" #NEWLINE# if rule . cidr : #NEWLINE# #INDENT# version = netutils . get_ip_version ( rule . cidr ) #NEWLINE# if ( FLAGS . use_ipv6 and ( version == 6 ) ) : #NEWLINE# #INDENT# ( net , prefixlen ) = netutils . get_net_and_prefixlen ( rule . cidr ) #NEWLINE# rule_xml += ( "<%s srcipaddr='%s' srcipmask='%s' " % ( v6protocol [ rule . protocol ] , net , prefixlen ) ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# ( net , mask ) = netutils . get_net_and_mask ( rule . cidr ) #NEWLINE# rule_xml += ( "<%s srcipaddr='%s' srcipmask='%s' " % ( self . protocol , net , mask ) ) #NEWLINE# #UNINDENT# if ( rule . protocol in [ 'tcp' , 'udp' ] ) : #NEWLINE# #INDENT# rule_xml += ( "dstportstart='%s' dstportend='%s' " % ( rule . from_port , rule . to_port ) ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( rule . protocol == 'icmp' ) : #NEWLINE# #INDENT# LOG . info ( 'rule.protocol: %r, rule.from_port: %r, rule.to_port: %r' , rule . protocol , rule . from_port , rule . to_port ) #NEWLINE# if ( rule . from_port != ( - 1 ) ) : #NEWLINE# #INDENT# rule_xml += ( "type='%s' " % rule . from_port ) #NEWLINE# #UNINDENT# if ( rule . to_port != ( - 1 ) ) : #NEWLINE# #INDENT# rule_xml += ( "code='%s' " % rule . to_port ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# rule_xml += '/>\n' #NEWLINE# #UNINDENT# rule_xml += '</rule>\n' #NEWLINE# #UNINDENT# xml = ( "<filter name='nova-secgroup-%s' " % security_group_id ) #NEWLINE# if FLAGS . use_ipv6 : #NEWLINE# #INDENT# xml += ( "chain='root'>%s</filter>" % rule_xml ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# xml += ( "chain='ipv4'>%s</filter>" % rule_xml ) #NEWLINE# #UNINDENT# return xml