[Compass-ci] Re: [PATCH compass-ci 1/4] sparrow: start the firewall in adapting openeuler

-systemctl status firewalld | grep -q "running" && { +systemctl start firewalld

•    DOCKER0_IFACE=docker0
  

•    DOCKER0_SUBNET=172.17.0.0/16
  

+[ "$(systemctl is-active firewalld)" == "active" ] || {

• echo "firewalld start failed"
• exit 0

+}

That adds dependency on firewalld.

The code should work equally well whether it is installed/active or not. Since we won't be able to control the exact deploy environment.

Thanks, Fengguang

•    iptables -t nat -A POSTROUTING -o $PUB_IFACE -s $DOCKER0_SUBNET -j MASQUERADE
  

•    iptables -t nat -A POSTROUTING -o $DOCKER0_IFACE -d $DOCKER0_SUBNET -j MASQUERADE
  

+DOCKER0_IFACE=docker0 +DOCKER0_SUBNET=172.17.0.0/16

•    firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 source address=$DOCKER0_SUBNET accept"
  

•    firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 source address=$BR0_SUBNET accept"
  

•    firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 source address=0.0.0.0/32 accept"
  

-} +iptables -t nat -A POSTROUTING -o $PUB_IFACE -s $DOCKER0_SUBNET -j MASQUERADE +iptables -t nat -A POSTROUTING -o $DOCKER0_IFACE -d $DOCKER0_SUBNET -j MASQUERADE

+firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 source address=$DOCKER0_SUBNET accept" +firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 source address=$BR0_SUBNET accept"

+firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 source address=0.0.0.0/32 accept"

2.23.0