Allow allowed_hosts to not have ipv6 interfaces

This puts a conditional around the AAAA lookup so we can add hosts in
clouds that don't provide an IPv6 address.

Change-Id: I97e82a41fdbe31e7bce6f05b8e6aa39834c42548
This commit is contained in:
Ian Wienand 2018-02-21 12:10:23 +11:00
parent 8f2af6849c
commit ac4f7e77e3
1 changed files with 3 additions and 0 deletions

View File

@ -25,10 +25,13 @@
<% @rules6.each do |rule| -%>
-A openstack-INPUT <%= rule %>
<% end -%>
<% begin -%>
<% @allowed_hosts.each do |host| -%>
<% scope.call_function('dns_aaaa', [host['hostname']]).each do |addr| -%>
-A openstack-INPUT <% if host['protocol'] == 'tcp' %>-m state --state NEW <% end -%>-m <%= host['protocol'] %> -p <%= host['protocol'] %> -s <%= addr %> --dport <%= host['port'] %> -j ACCEPT
<% end -%>
<% end -%>
<% rescue Resolv::ResolvError -%>
<% end -%>
-A openstack-INPUT -j REJECT --reject-with icmp6-adm-prohibited
COMMIT