Some changes related to logging

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
GANETI_INSTANCE_NAME -> INSTANCE

GANETI_INSTANCE_NAME is available only in hooks. Library uses
INSTANCE so we should set it as soon as possible.

Hooks are not aware of INTERFACE. Thus get_info() will find
INDEV and ebtables chains only during NIC configuration scripts.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Move reset_dns() in common.sh

Note that currently this is executed only during
OP_INSTANCE_SET_PARAMS.

Before using it we should query_dns().

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Support firewall for bridged setups

Just like routed setups we parse instance's tags and search
for a specific suffix (chain). If found we add an ebtables
rule so that outgoing traffic to tap will go through this
chain.

Note that those chains should be created by admin first.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add snf-network.ferm for firewalls

This ferm defines 3 extra chains in filter table (for both
ipv4 and ipv6): protected, limited, unprotected.

The first drops incoming new connections, allows dns replies and pings.
The seconds allows ssh, and rdp ports.
The third just accepts the packet.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Update docs

- ifup-extra
- firewall
- nfdhcpd

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Change interfaces example file

Use addresses reserved for documentation in interfaces example file.

Mention two setups:

 * routed setup
    - external router
    - nodes without IP inside routed network
    - proxy ARP

 * bridged setup
    - extra common interfaces on all nodes
    - one common bridge on separate interface
    - node with internet access is the gateway and does NAT

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Update docs wrt ip-less-routed setup

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Create examples dir

..and add interfaces, vmrouter ifup and ifdown scripts, and
prv-net-helper.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add separate docs for routed and ebtables setup

Remove further info and implementation details of ip-less-routed
and private-filtered setups from main page. Introduce routed and
ebtables page to include all this info.

Add /etc/network/interfaces examples for ip-less-routed
configuration.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Fix some typos

..and use upper case for all acronyms (NIC, TAP, DNS, SSH, RDP).

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Big refactor

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add comments to iptables

Depending on each rule reason we add a relevant comment prefixed
with "snf-network_".

Currently we have three reasons: firewall, proxy-arp, extra.

Additionally save all rules under /etc/iptables/ at the end of
ifup-extra script. This can be used to restore some rules after
reloading ferm.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Fix typo in clear_bridged_setup_firewall

Use $oldchain instead of $chain.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Run snf-network-dnshook only in primary node

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Use hostname -f to get node FQDN

Ganeti exports node names with their FQDN. Use hostname -f
to compare the exported variables and decide whether to execute
the hook or not.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Try clean anything in ifdown

..and don't count on tags, etc. This should work on a best effort
basis.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Fix snf-network-hook

..to delete neighbor proxy only:

1) in old primary node during instance migrate/failover
2) in primary node during instance shutdown/remove

Please note that this is done also by kvm-ifdown-custom.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Fix typo in delete_neighbor_proxy()

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Several syntax fixes in docs

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>