Ruipeng Zhang ppoffice

People

`:bowtie:`	😄 `:smile:`	😆 `:laughing:`
😊 `:blush:`	😃 `:smiley:`	☺️ `:relaxed:`
😏 `:smirk:`	😍 `:heart_eyes:`	😘 `:kissing_heart:`
😚 `:kissing_closed_eyes:`	😳 `:flushed:`	😌 `:relieved:`
😆 `:satisfied:`	😁 `:grin:`	😉 `:wink:`
😜 `:stuck_out_tongue_winking_eye:`	😝 `:stuck_out_tongue_closed_eyes:`	😀 `:grinning:`
😗 `:kissing:`	😙 `:kissing_smiling_eyes:`	😛 `:stuck_out_tongue:`

How to setup your own CA with OpenSSL

For educational reasons I've decided to create my own CA. Here is what I learned.

First things first

Lets get some context first.

Howto disable OpenStack firewalls

tested on kilo, juno and liberty. This breaks creating instances in horizon - on liberty anyway, maybe older too.

People usually want to do this because the anti-spoofing rules are dropping packets transmitted by Nova instances that do not have the source MAC or IP address that was allocated to the instance. Note: allowed-addresses-pairs or port-security extension can fix that. Also there is a performance drop using the hybrid plugging strategy (veth+linuxbridge+iptables).

But Nova needs a security groups API or it will refuse to start instances. It needs to be configured to use its own or Neutron's. Here we configure it to use the Nova security groups API, but disable nova-compute (and the Neutron L2 agent - just to be sure) from applying any iptables rules.

	# coding=utf-8
	"""
	LICENSE http://www.apache.org/licenses/LICENSE-2.0
	"""
	import datetime
	import sys
	import time
	import threading
	import traceback
	import SocketServer

	// src: https://cb.qq.com/bank/js/pinyin.js?v=1.0.3
	;
	(function(global) {
	var dict_combo = {
	"yā,ā": "吖",
	"ā,ē": "阿",
	"hē,a,kē": "呵",
	"shà,á": "嗄",
	"ā,á,ǎ,à,a": "啊",
	"ā,yān": "腌",

	// List of language tags according to RFC 5646.
	// See <http://tools.ietf.org/html/rfc5646> for info on how to parse
	// these language tags. Some duplicates have been removed.
	var RFC5646_LANGUAGE_TAGS = {
	'af': 'Afrikaans',
	'af-ZA': 'Afrikaans (South Africa)',
	'ar': 'Arabic',
	'ar-AE': 'Arabic (U.A.E.)',
	'ar-BH': 'Arabic (Bahrain)',
	'ar-DZ': 'Arabic (Algeria)',


	root@mininet-vm:/home/mininet/mininet/examples# more vxlan.py
	#!/usr/bin/python

	"""
	This example shows how to create an empty Mininet object
	(without a topology object) and add nodes to it manually.
	"""

	from mininet.net import Mininet

Ruipeng Zhang ppoffice

How to setup your own CA with OpenSSL

First things first

Howto disable OpenStack firewalls

On each controller and compute node, change:

Libraries

	from scapy.all import *

	answer = sr1(IP(dst="8.8.8.8")/UDP(dport=53)/DNS(rd=1,qd=DNSQR(qname="www.thepacketgeek.com")),verbose=0)
	print answer[DNS].summary()

	qemu-img convert -O vdi gnome.qcow2 gnome.vdi


	#if its a raw image then:
	VBoxManage convertdd opnstk.raw VBox.vdi --format VDI