{"action":"created","comment":{"url":"https://api.github.com/repos/vmware/vic/pulls/comments/105275063","pull_request_review_id":26148184,"id":105275063,"diff_hunk":"@@ -0,0 +1,93 @@\n+// Copyright 2017 VMware, Inc. All Rights Reserved.\n+//\n+// Licensed under the Apache License, Version 2.0 (the \"License\");\n+// you may not use this file except in compliance with the License.\n+// You may obtain a copy of the License at\n+//\n+//    http://www.apache.org/licenses/LICENSE-2.0\n+//\n+// Unless required by applicable law or agreed to in writing, software\n+// distributed under the License is distributed on an \"AS IS\" BASIS,\n+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n+// See the License for the specific language governing permissions and\n+// limitations under the License.\n+\n+package management\n+\n+import (\n+\tlog \"github.com/Sirupsen/logrus\"\n+\n+\t\"github.com/vmware/govmomi/object\"\n+\t\"github.com/vmware/vic/pkg/trace\"\n+)\n+\n+type State int\n+\n+// ruleset ID from /etc/vmware/firewall/service.xml\n+const RulesetID string = \"vSPC\"\n+const (\n+\tenable State = iota\n+\tdisable\n+)\n+\n+func (s State) String() string {\n+\tswitch s {\n+\tcase enable:\n+\t\treturn \"enable\"\n+\tcase disable:\n+\t\treturn \"disable\"\n+\t}\n+\treturn \"\"\n+}\n+\n+// EnableFirewall enables the ruleset on the target, allowing VIC backchannel traffic","path":"lib/install/management/update.go","position":43,"original_position":43,"commit_id":"1354ec81bf9f985c4142bc80ce398e1284d3b9ec","original_commit_id":"1354ec81bf9f985c4142bc80ce398e1284d3b9ec","user":{"login":"emlin","id":1091772,"avatar_url":"https://avatars3.githubusercontent.com/u/1091772?v=3","gravatar_id":"","url":"https://api.github.com/users/emlin","html_url":"https://github.com/emlin","followers_url":"https://api.github.com/users/emlin/followers","following_url":"https://api.github.com/users/emlin/following{/other_user}","gists_url":"https://api.github.com/users/emlin/gists{/gist_id}","starred_url":"https://api.github.com/users/emlin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/emlin/subscriptions","organizations_url":"https://api.github.com/users/emlin/orgs","repos_url":"https://api.github.com/users/emlin/repos","events_url":"https://api.github.com/users/emlin/events{/privacy}","received_events_url":"https://api.github.com/users/emlin/received_events","type":"User","site_admin":false},"body":"EnableFirewall -> EnableFirewallRuleset","created_at":"2017-03-09T21:27:03Z","updated_at":"2017-03-09T21:27:03Z","html_url":"https://github.com/vmware/vic/pull/4165#discussion_r105275063","pull_request_url":"https://api.github.com/repos/vmware/vic/pulls/4165","_links":{"self":{"href":"https://api.github.com/repos/vmware/vic/pulls/comments/105275063"},"html":{"href":"https://github.com/vmware/vic/pull/4165#discussion_r105275063"},"pull_request":{"href":"https://api.github.com/repos/vmware/vic/pulls/4165"}}},"pull_request":{"url":"https://api.github.com/repos/vmware/vic/pulls/4165","id":109540666,"html_url":"https://github.com/vmware/vic/pull/4165","diff_url":"https://github.com/vmware/vic/pull/4165.diff","patch_url":"https://github.com/vmware/vic/pull/4165.patch","issue_url":"https://api.github.com/repos/vmware/vic/issues/4165","number":4165,"state":"open","locked":false,"title":"Add vic-machine firewall configuration command [specific ci=6-14-Update-Firewall]","user":{"login":"andrewtchin","id":1649165,"avatar_url":"https://avatars1.githubusercontent.com/u/1649165?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewtchin","html_url":"https://github.com/andrewtchin","followers_url":"https://api.github.com/users/andrewtchin/followers","following_url":"https://api.github.com/users/andrewtchin/following{/other_user}","gists_url":"https://api.github.com/users/andrewtchin/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewtchin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewtchin/subscriptions","organizations_url":"https://api.github.com/users/andrewtchin/orgs","repos_url":"https://api.github.com/users/andrewtchin/repos","events_url":"https://api.github.com/users/andrewtchin/events{/privacy}","received_events_url":"https://api.github.com/users/andrewtchin/received_events","type":"User","site_admin":false},"body":"Fixes #3979 \r\n\r\nTested on ESX and vCenter, integration test passes locally\r\n\r\nEnabling the rule:\r\n```\r\nbin/vic-machine-linux update firewall --target root:password@10.0.0.3 --allow --thumbprint=C1:7A:E4:A4:22:B8:8A:68:F9:A4:E4:C2:38:91:3B:0D:8E:E0:C8:FB\r\nMar  9 2017 12:07:34.174-08:00 INFO  ### Updating ####\r\nMar  9 2017 12:07:35.989-08:00 INFO  Validating target\r\nMar  9 2017 12:07:36.459-08:00 INFO  Validating compute resource\r\nMar  9 2017 12:07:36.818-08:00 INFO  \r\nMar  9 2017 12:07:36.818-08:00 WARN  ### WARNING ###\r\nMar  9 2017 12:07:36.818-08:00 WARN  \tThis command modifies the host firewall on the target machine or cluster\r\nMar  9 2017 12:07:36.818-08:00 WARN  \tThe ruleset \"vSPC\" will be enabled\r\nMar  9 2017 12:07:36.818-08:00 WARN  \tThis allows all outbound TCP traffic from the target\r\nMar  9 2017 12:07:36.818-08:00 WARN  \tTo undo this modification use --deny\r\nMar  9 2017 12:07:36.818-08:00 INFO  \r\nMar  9 2017 12:07:37.281-08:00 INFO  Ruleset \"vSPC\" enabled on host \"HostSystem:ha-host @ /ha-datacenter/host/ib-aus-office-130.eng.vmware.com/ib-aus-office-130.eng.vmware.com\"\r\nMar  9 2017 12:07:37.281-08:00 INFO  \r\nMar  9 2017 12:07:37.281-08:00 INFO  Firewall changes complete\r\nMar  9 2017 12:07:37.281-08:00 INFO  Command completed successfully\r\n\r\n```\r\n\r\nDisabling the rule:\r\n```\r\nbin/vic-machine-linux update firewall --target root:password@10.0.0.3 --deny --thumbprint=C1:7A:E4:A4:22:B8:8A:68:F9:A4:E4:C2:38:91:3B:0D:8E:E0:C8:FB\r\nMar  9 2017 12:09:49.198-08:00 INFO  ### Updating ####\r\nMar  9 2017 12:09:50.934-08:00 INFO  Validating target\r\nMar  9 2017 12:09:51.383-08:00 INFO  Validating compute resource\r\nMar  9 2017 12:09:51.714-08:00 INFO  \r\nMar  9 2017 12:09:51.714-08:00 WARN  ### WARNING ###\r\nMar  9 2017 12:09:51.714-08:00 WARN  \tThis command modifies the host firewall on the target machine or cluster\r\nMar  9 2017 12:09:51.714-08:00 WARN  \tThe ruleset \"vSPC\" will be disabled\r\nMar  9 2017 12:09:51.714-08:00 WARN  \tThis disables the ruleset that allows all outbound TCP traffic from the target\r\nMar  9 2017 12:09:51.714-08:00 WARN  \tVIC Engine will not function unless 2377/tcp outbound is allowed\r\nMar  9 2017 12:09:51.714-08:00 WARN  \tTo undo this modification use --allow\r\nMar  9 2017 12:09:51.714-08:00 INFO  \r\nMar  9 2017 12:09:52.161-08:00 INFO  Ruleset \"vSPC\" disabled on host \"HostSystem:ha-host @ /ha-datacenter/host/ib-aus-office-130.eng.vmware.com/ib-aus-office-130.eng.vmware.com\"\r\nMar  9 2017 12:09:52.161-08:00 INFO  \r\nMar  9 2017 12:09:52.161-08:00 INFO  Firewall changes complete\r\nMar  9 2017 12:09:52.161-08:00 INFO  Command completed successfully\r\n\r\n```\r\n\r\nCommand help:\r\n```\r\nNAME:\r\n   vic-machine-linux update firewall - Modify host firewall\r\n\r\nUSAGE:\r\n   vic-machine-linux update firewall [command options] [arguments...]\r\n\r\nOPTIONS:\r\n   --target value, -t value            REQUIRED. ESXi or vCenter connection URL, specifying a datacenter if multiple exist e.g. root:password@VC-FQDN/datacenter (default: https://root:password@10.0.0.3)\r\n   --user value, -u value              ESX or vCenter user\r\n   --password value, -p value          ESX or vCenter password (default: <nil>)\r\n   --thumbprint value                  ESX or vCenter host certificate thumbprint\r\n   --compute-resource value, -r value  Compute resource path, e.g. myCluster/Resources/myRP. Default to <default cluster>/Resources\r\n   --timeout value                     Time to wait for update firewall (default: 3m0s)\r\n   --allow                             Enable a firewall rule on target host(s) to allow VIC communication\r\n   --deny                              Disable the firewall rule on target host(s) that allows VIC communication\r\n```","created_at":"2017-03-07T18:23:00Z","updated_at":"2017-03-09T21:27:03Z","closed_at":null,"merged_at":null,"merge_commit_sha":"423e11a755ba6d5e3a0267dd864ffceac4b0bd95","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/vmware/vic/pulls/4165/commits","review_comments_url":"https://api.github.com/repos/vmware/vic/pulls/4165/comments","review_comment_url":"https://api.github.com/repos/vmware/vic/pulls/comments{/number}","comments_url":"https://api.github.com/repos/vmware/vic/issues/4165/comments","statuses_url":"https://api.github.com/repos/vmware/vic/statuses/1354ec81bf9f985c4142bc80ce398e1284d3b9ec","head":{"label":"andrewtchin:3979/vic-machine-firewall-config","ref":"3979/vic-machine-firewall-config","sha":"1354ec81bf9f985c4142bc80ce398e1284d3b9ec","user":{"login":"andrewtchin","id":1649165,"avatar_url":"https://avatars1.githubusercontent.com/u/1649165?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewtchin","html_url":"https://github.com/andrewtchin","followers_url":"https://api.github.com/users/andrewtchin/followers","following_url":"https://api.github.com/users/andrewtchin/following{/other_user}","gists_url":"https://api.github.com/users/andrewtchin/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewtchin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewtchin/subscriptions","organizations_url":"https://api.github.com/users/andrewtchin/orgs","repos_url":"https://api.github.com/users/andrewtchin/repos","events_url":"https://api.github.com/users/andrewtchin/events{/privacy}","received_events_url":"https://api.github.com/users/andrewtchin/received_events","type":"User","site_admin":false},"repo":{"id":55440762,"name":"vic","full_name":"andrewtchin/vic","owner":{"login":"andrewtchin","id":1649165,"avatar_url":"https://avatars1.githubusercontent.com/u/1649165?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewtchin","html_url":"https://github.com/andrewtchin","followers_url":"https://api.github.com/users/andrewtchin/followers","following_url":"https://api.github.com/users/andrewtchin/following{/other_user}","gists_url":"https://api.github.com/users/andrewtchin/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewtchin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewtchin/subscriptions","organizations_url":"https://api.github.com/users/andrewtchin/orgs","repos_url":"https://api.github.com/users/andrewtchin/repos","events_url":"https://api.github.com/users/andrewtchin/events{/privacy}","received_events_url":"https://api.github.com/users/andrewtchin/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/andrewtchin/vic","description":"Integrated containers on vSphere","fork":true,"url":"https://api.github.com/repos/andrewtchin/vic","forks_url":"https://api.github.com/repos/andrewtchin/vic/forks","keys_url":"https://api.github.com/repos/andrewtchin/vic/keys{/key_id}","collaborators_url":"https://api.github.com/repos/andrewtchin/vic/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/andrewtchin/vic/teams","hooks_url":"https://api.github.com/repos/andrewtchin/vic/hooks","issue_events_url":"https://api.github.com/repos/andrewtchin/vic/issues/events{/number}","events_url":"https://api.github.com/repos/andrewtchin/vic/events","assignees_url":"https://api.github.com/repos/andrewtchin/vic/assignees{/user}","branches_url":"https://api.github.com/repos/andrewtchin/vic/branches{/branch}","tags_url":"https://api.github.com/repos/andrewtchin/vic/tags","blobs_url":"https://api.github.com/repos/andrewtchin/vic/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/andrewtchin/vic/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/andrewtchin/vic/git/refs{/sha}","trees_url":"https://api.github.com/repos/andrewtchin/vic/git/trees{/sha}","statuses_url":"https://api.github.com/repos/andrewtchin/vic/statuses/{sha}","languages_url":"https://api.github.com/repos/andrewtchin/vic/languages","stargazers_url":"https://api.github.com/repos/andrewtchin/vic/stargazers","contributors_url":"https://api.github.com/repos/andrewtchin/vic/contributors","subscribers_url":"https://api.github.com/repos/andrewtchin/vic/subscribers","subscription_url":"https://api.github.com/repos/andrewtchin/vic/subscription","commits_url":"https://api.github.com/repos/andrewtchin/vic/commits{/sha}","git_commits_url":"https://api.github.com/repos/andrewtchin/vic/git/commits{/sha}","comments_url":"https://api.github.com/repos/andrewtchin/vic/comments{/number}","issue_comment_url":"https://api.github.com/repos/andrewtchin/vic/issues/comments{/number}","contents_url":"https://api.github.com/repos/andrewtchin/vic/contents/{+path}","compare_url":"https://api.github.com/repos/andrewtchin/vic/compare/{base}...{head}","merges_url":"https://api.github.com/repos/andrewtchin/vic/merges","archive_url":"https://api.github.com/repos/andrewtchin/vic/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/andrewtchin/vic/downloads","issues_url":"https://api.github.com/repos/andrewtchin/vic/issues{/number}","pulls_url":"https://api.github.com/repos/andrewtchin/vic/pulls{/number}","milestones_url":"https://api.github.com/repos/andrewtchin/vic/milestones{/number}","notifications_url":"https://api.github.com/repos/andrewtchin/vic/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/andrewtchin/vic/labels{/name}","releases_url":"https://api.github.com/repos/andrewtchin/vic/releases{/id}","deployments_url":"https://api.github.com/repos/andrewtchin/vic/deployments","created_at":"2016-04-04T20:01:48Z","updated_at":"2016-10-24T15:57:22Z","pushed_at":"2017-03-09T20:36:35Z","git_url":"git://github.com/andrewtchin/vic.git","ssh_url":"git@github.com:andrewtchin/vic.git","clone_url":"https://github.com/andrewtchin/vic.git","svn_url":"https://github.com/andrewtchin/vic","homepage":null,"size":43766,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"vmware:master","ref":"master","sha":"7fb8df2db2161a760da9c4b35cf4a5914d8ef19b","user":{"login":"vmware","id":473334,"avatar_url":"https://avatars3.githubusercontent.com/u/473334?v=3","gravatar_id":"","url":"https://api.github.com/users/vmware","html_url":"https://github.com/vmware","followers_url":"https://api.github.com/users/vmware/followers","following_url":"https://api.github.com/users/vmware/following{/other_user}","gists_url":"https://api.github.com/users/vmware/gists{/gist_id}","starred_url":"https://api.github.com/users/vmware/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vmware/subscriptions","organizations_url":"https://api.github.com/users/vmware/orgs","repos_url":"https://api.github.com/users/vmware/repos","events_url":"https://api.github.com/users/vmware/events{/privacy}","received_events_url":"https://api.github.com/users/vmware/received_events","type":"Organization","site_admin":false},"repo":{"id":49597898,"name":"vic","full_name":"vmware/vic","owner":{"login":"vmware","id":473334,"avatar_url":"https://avatars3.githubusercontent.com/u/473334?v=3","gravatar_id":"","url":"https://api.github.com/users/vmware","html_url":"https://github.com/vmware","followers_url":"https://api.github.com/users/vmware/followers","following_url":"https://api.github.com/users/vmware/following{/other_user}","gists_url":"https://api.github.com/users/vmware/gists{/gist_id}","starred_url":"https://api.github.com/users/vmware/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vmware/subscriptions","organizations_url":"https://api.github.com/users/vmware/orgs","repos_url":"https://api.github.com/users/vmware/repos","events_url":"https://api.github.com/users/vmware/events{/privacy}","received_events_url":"https://api.github.com/users/vmware/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/vmware/vic","description":"Integrated containers engine on vSphere","fork":false,"url":"https://api.github.com/repos/vmware/vic","forks_url":"https://api.github.com/repos/vmware/vic/forks","keys_url":"https://api.github.com/repos/vmware/vic/keys{/key_id}","collaborators_url":"https://api.github.com/repos/vmware/vic/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/vmware/vic/teams","hooks_url":"https://api.github.com/repos/vmware/vic/hooks","issue_events_url":"https://api.github.com/repos/vmware/vic/issues/events{/number}","events_url":"https://api.github.com/repos/vmware/vic/events","assignees_url":"https://api.github.com/repos/vmware/vic/assignees{/user}","branches_url":"https://api.github.com/repos/vmware/vic/branches{/branch}","tags_url":"https://api.github.com/repos/vmware/vic/tags","blobs_url":"https://api.github.com/repos/vmware/vic/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/vmware/vic/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/vmware/vic/git/refs{/sha}","trees_url":"https://api.github.com/repos/vmware/vic/git/trees{/sha}","statuses_url":"https://api.github.com/repos/vmware/vic/statuses/{sha}","languages_url":"https://api.github.com/repos/vmware/vic/languages","stargazers_url":"https://api.github.com/repos/vmware/vic/stargazers","contributors_url":"https://api.github.com/repos/vmware/vic/contributors","subscribers_url":"https://api.github.com/repos/vmware/vic/subscribers","subscription_url":"https://api.github.com/repos/vmware/vic/subscription","commits_url":"https://api.github.com/repos/vmware/vic/commits{/sha}","git_commits_url":"https://api.github.com/repos/vmware/vic/git/commits{/sha}","comments_url":"https://api.github.com/repos/vmware/vic/comments{/number}","issue_comment_url":"https://api.github.com/repos/vmware/vic/issues/comments{/number}","contents_url":"https://api.github.com/repos/vmware/vic/contents/{+path}","compare_url":"https://api.github.com/repos/vmware/vic/compare/{base}...{head}","merges_url":"https://api.github.com/repos/vmware/vic/merges","archive_url":"https://api.github.com/repos/vmware/vic/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/vmware/vic/downloads","issues_url":"https://api.github.com/repos/vmware/vic/issues{/number}","pulls_url":"https://api.github.com/repos/vmware/vic/pulls{/number}","milestones_url":"https://api.github.com/repos/vmware/vic/milestones{/number}","notifications_url":"https://api.github.com/repos/vmware/vic/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/vmware/vic/labels{/name}","releases_url":"https://api.github.com/repos/vmware/vic/releases{/id}","deployments_url":"https://api.github.com/repos/vmware/vic/deployments","created_at":"2016-01-13T19:53:57Z","updated_at":"2017-03-08T15:52:27Z","pushed_at":"2017-03-09T21:25:53Z","git_url":"git://github.com/vmware/vic.git","ssh_url":"git@github.com:vmware/vic.git","clone_url":"https://github.com/vmware/vic.git","svn_url":"https://github.com/vmware/vic","homepage":"http://vmware.github.io/vic","size":53121,"stargazers_count":201,"watchers_count":201,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":80,"mirror_url":null,"open_issues_count":660,"forks":80,"open_issues":660,"watchers":201,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/vmware/vic/pulls/4165"},"html":{"href":"https://github.com/vmware/vic/pull/4165"},"issue":{"href":"https://api.github.com/repos/vmware/vic/issues/4165"},"comments":{"href":"https://api.github.com/repos/vmware/vic/issues/4165/comments"},"review_comments":{"href":"https://api.github.com/repos/vmware/vic/pulls/4165/comments"},"review_comment":{"href":"https://api.github.com/repos/vmware/vic/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/vmware/vic/pulls/4165/commits"},"statuses":{"href":"https://api.github.com/repos/vmware/vic/statuses/1354ec81bf9f985c4142bc80ce398e1284d3b9ec"}}}}
{"actor":{"display_login":"emlin"}}