{"action":"created","comment":{"url":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/comments/37977351","id":37977351,"diff_hunk":"@@ -418,3 +424,36 @@ def set_boot_kernel_and_trigger_reboot(flavor=\"default\")\n execute \"trigger-nova-own-az-config\" do\n   command \"true\"\n end\n+\n+# Set iptables rules for blocking VNC Access for all but the nova-controller node.\n+bash \"nova_compute_vncblock_reject_all\" do\n+  code <<-EOH\n+    iptables -N VNCBLOCK\n+    iptables -I INPUT -j VNCBLOCK -p tcp --match multiport --dports 5900:15900\n+    iptables -F VNCBLOCK\n+    iptables -I VNCBLOCK -p tcp \\\n+        -m connbytes --connbytes 0:1024 \\\n+        --connbytes-dir both --connbytes-mode bytes \\\n+        -m state --state ESTABLISHED \\\n+        -m u32 --u32 \"0>>22&0x3C@ 12>>26&0x3C@ 0=0x52464220\" \\","path":"chef/cookbooks/nova/recipes/compute.rb","position":40,"original_position":40,"commit_id":"f503874b80f2a1c1db7749b0f863e2edbfa3be9b","original_commit_id":"f503874b80f2a1c1db7749b0f863e2edbfa3be9b","user":{"login":"aspiers","id":100738,"avatar_url":"https://avatars.githubusercontent.com/u/100738?v=3","gravatar_id":"","url":"https://api.github.com/users/aspiers","html_url":"https://github.com/aspiers","followers_url":"https://api.github.com/users/aspiers/followers","following_url":"https://api.github.com/users/aspiers/following{/other_user}","gists_url":"https://api.github.com/users/aspiers/gists{/gist_id}","starred_url":"https://api.github.com/users/aspiers/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aspiers/subscriptions","organizations_url":"https://api.github.com/users/aspiers/orgs","repos_url":"https://api.github.com/users/aspiers/repos","events_url":"https://api.github.com/users/aspiers/events{/privacy}","received_events_url":"https://api.github.com/users/aspiers/received_events","type":"User","site_admin":false},"body":"As noted by another reviewer, please can you add comments explaining this!  It's totally cryptic and unreadable.","created_at":"2015-08-26T12:55:03Z","updated_at":"2015-08-26T12:55:03Z","html_url":"https://github.com/crowbar/crowbar-openstack/pull/16#discussion_r37977351","pull_request_url":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/16","_links":{"self":{"href":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/comments/37977351"},"html":{"href":"https://github.com/crowbar/crowbar-openstack/pull/16#discussion_r37977351"},"pull_request":{"href":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/16"}}},"pull_request":{"url":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/16","id":43397877,"html_url":"https://github.com/crowbar/crowbar-openstack/pull/16","diff_url":"https://github.com/crowbar/crowbar-openstack/pull/16.diff","patch_url":"https://github.com/crowbar/crowbar-openstack/pull/16.patch","issue_url":"https://api.github.com/repos/crowbar/crowbar-openstack/issues/16","number":16,"state":"open","locked":false,"title":"Add iptables rules to deny unwanted VNC access (bsc#938200)","user":{"login":"dguitarbite","id":2204767,"avatar_url":"https://avatars.githubusercontent.com/u/2204767?v=3","gravatar_id":"","url":"https://api.github.com/users/dguitarbite","html_url":"https://github.com/dguitarbite","followers_url":"https://api.github.com/users/dguitarbite/followers","following_url":"https://api.github.com/users/dguitarbite/following{/other_user}","gists_url":"https://api.github.com/users/dguitarbite/gists{/gist_id}","starred_url":"https://api.github.com/users/dguitarbite/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dguitarbite/subscriptions","organizations_url":"https://api.github.com/users/dguitarbite/orgs","repos_url":"https://api.github.com/users/dguitarbite/repos","events_url":"https://api.github.com/users/dguitarbite/events{/privacy}","received_events_url":"https://api.github.com/users/dguitarbite/received_events","type":"User","site_admin":false},"body":"VNC ports are accessible from the management network. This patch will\r\nallow us to restrict the VNC console from unwanted access to VNC\r\nconsole. Using iptables u32 and string module to filter out VNC packets.\r\n\r\nForwardport from https://github.com/crowbar/barclamp-nova/pull/483\r\n\r\nSigned-off-by: Pranav Salunke <dguitarbite@gmail.com>","created_at":"2015-08-26T12:52:15Z","updated_at":"2015-08-26T12:55:03Z","closed_at":null,"merged_at":null,"merge_commit_sha":"cf9815c70872213ec1628860e4035924aa4f4a8d","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/16/commits","review_comments_url":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/16/comments","review_comment_url":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/comments{/number}","comments_url":"https://api.github.com/repos/crowbar/crowbar-openstack/issues/16/comments","statuses_url":"https://api.github.com/repos/crowbar/crowbar-openstack/statuses/f503874b80f2a1c1db7749b0f863e2edbfa3be9b","head":{"label":"dguitarbite:master","ref":"master","sha":"f503874b80f2a1c1db7749b0f863e2edbfa3be9b","user":{"login":"dguitarbite","id":2204767,"avatar_url":"https://avatars.githubusercontent.com/u/2204767?v=3","gravatar_id":"","url":"https://api.github.com/users/dguitarbite","html_url":"https://github.com/dguitarbite","followers_url":"https://api.github.com/users/dguitarbite/followers","following_url":"https://api.github.com/users/dguitarbite/following{/other_user}","gists_url":"https://api.github.com/users/dguitarbite/gists{/gist_id}","starred_url":"https://api.github.com/users/dguitarbite/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dguitarbite/subscriptions","organizations_url":"https://api.github.com/users/dguitarbite/orgs","repos_url":"https://api.github.com/users/dguitarbite/repos","events_url":"https://api.github.com/users/dguitarbite/events{/privacy}","received_events_url":"https://api.github.com/users/dguitarbite/received_events","type":"User","site_admin":false},"repo":{"id":40978717,"name":"crowbar-openstack","full_name":"dguitarbite/crowbar-openstack","owner":{"login":"dguitarbite","id":2204767,"avatar_url":"https://avatars.githubusercontent.com/u/2204767?v=3","gravatar_id":"","url":"https://api.github.com/users/dguitarbite","html_url":"https://github.com/dguitarbite","followers_url":"https://api.github.com/users/dguitarbite/followers","following_url":"https://api.github.com/users/dguitarbite/following{/other_user}","gists_url":"https://api.github.com/users/dguitarbite/gists{/gist_id}","starred_url":"https://api.github.com/users/dguitarbite/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dguitarbite/subscriptions","organizations_url":"https://api.github.com/users/dguitarbite/orgs","repos_url":"https://api.github.com/users/dguitarbite/repos","events_url":"https://api.github.com/users/dguitarbite/events{/privacy}","received_events_url":"https://api.github.com/users/dguitarbite/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/dguitarbite/crowbar-openstack","description":"Openstack deployment for Crowbar","fork":true,"url":"https://api.github.com/repos/dguitarbite/crowbar-openstack","forks_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/forks","keys_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/teams","hooks_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/hooks","issue_events_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/issues/events{/number}","events_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/events","assignees_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/assignees{/user}","branches_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/branches{/branch}","tags_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/tags","blobs_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/git/refs{/sha}","trees_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/statuses/{sha}","languages_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/languages","stargazers_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/stargazers","contributors_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/contributors","subscribers_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/subscribers","subscription_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/subscription","commits_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/commits{/sha}","git_commits_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/git/commits{/sha}","comments_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/comments{/number}","issue_comment_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/issues/comments{/number}","contents_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/contents/{+path}","compare_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/merges","archive_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/downloads","issues_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/issues{/number}","pulls_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/pulls{/number}","milestones_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/milestones{/number}","notifications_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/labels{/name}","releases_url":"https://api.github.com/repos/dguitarbite/crowbar-openstack/releases{/id}","created_at":"2015-08-18T15:04:05Z","updated_at":"2015-08-18T15:04:07Z","pushed_at":"2015-08-26T12:51:50Z","git_url":"git://github.com/dguitarbite/crowbar-openstack.git","ssh_url":"git@github.com:dguitarbite/crowbar-openstack.git","clone_url":"https://github.com/dguitarbite/crowbar-openstack.git","svn_url":"https://github.com/dguitarbite/crowbar-openstack","homepage":null,"size":15082,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"crowbar:master","ref":"master","sha":"ea789deb5225efd2ea4347e1857b35cba25f1942","user":{"login":"crowbar","id":2910205,"avatar_url":"https://avatars.githubusercontent.com/u/2910205?v=3","gravatar_id":"","url":"https://api.github.com/users/crowbar","html_url":"https://github.com/crowbar","followers_url":"https://api.github.com/users/crowbar/followers","following_url":"https://api.github.com/users/crowbar/following{/other_user}","gists_url":"https://api.github.com/users/crowbar/gists{/gist_id}","starred_url":"https://api.github.com/users/crowbar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crowbar/subscriptions","organizations_url":"https://api.github.com/users/crowbar/orgs","repos_url":"https://api.github.com/users/crowbar/repos","events_url":"https://api.github.com/users/crowbar/events{/privacy}","received_events_url":"https://api.github.com/users/crowbar/received_events","type":"Organization","site_admin":false},"repo":{"id":39006903,"name":"crowbar-openstack","full_name":"crowbar/crowbar-openstack","owner":{"login":"crowbar","id":2910205,"avatar_url":"https://avatars.githubusercontent.com/u/2910205?v=3","gravatar_id":"","url":"https://api.github.com/users/crowbar","html_url":"https://github.com/crowbar","followers_url":"https://api.github.com/users/crowbar/followers","following_url":"https://api.github.com/users/crowbar/following{/other_user}","gists_url":"https://api.github.com/users/crowbar/gists{/gist_id}","starred_url":"https://api.github.com/users/crowbar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/crowbar/subscriptions","organizations_url":"https://api.github.com/users/crowbar/orgs","repos_url":"https://api.github.com/users/crowbar/repos","events_url":"https://api.github.com/users/crowbar/events{/privacy}","received_events_url":"https://api.github.com/users/crowbar/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/crowbar/crowbar-openstack","description":"Openstack deployment for Crowbar","fork":false,"url":"https://api.github.com/repos/crowbar/crowbar-openstack","forks_url":"https://api.github.com/repos/crowbar/crowbar-openstack/forks","keys_url":"https://api.github.com/repos/crowbar/crowbar-openstack/keys{/key_id}","collaborators_url":"https://api.github.com/repos/crowbar/crowbar-openstack/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/crowbar/crowbar-openstack/teams","hooks_url":"https://api.github.com/repos/crowbar/crowbar-openstack/hooks","issue_events_url":"https://api.github.com/repos/crowbar/crowbar-openstack/issues/events{/number}","events_url":"https://api.github.com/repos/crowbar/crowbar-openstack/events","assignees_url":"https://api.github.com/repos/crowbar/crowbar-openstack/assignees{/user}","branches_url":"https://api.github.com/repos/crowbar/crowbar-openstack/branches{/branch}","tags_url":"https://api.github.com/repos/crowbar/crowbar-openstack/tags","blobs_url":"https://api.github.com/repos/crowbar/crowbar-openstack/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/crowbar/crowbar-openstack/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/crowbar/crowbar-openstack/git/refs{/sha}","trees_url":"https://api.github.com/repos/crowbar/crowbar-openstack/git/trees{/sha}","statuses_url":"https://api.github.com/repos/crowbar/crowbar-openstack/statuses/{sha}","languages_url":"https://api.github.com/repos/crowbar/crowbar-openstack/languages","stargazers_url":"https://api.github.com/repos/crowbar/crowbar-openstack/stargazers","contributors_url":"https://api.github.com/repos/crowbar/crowbar-openstack/contributors","subscribers_url":"https://api.github.com/repos/crowbar/crowbar-openstack/subscribers","subscription_url":"https://api.github.com/repos/crowbar/crowbar-openstack/subscription","commits_url":"https://api.github.com/repos/crowbar/crowbar-openstack/commits{/sha}","git_commits_url":"https://api.github.com/repos/crowbar/crowbar-openstack/git/commits{/sha}","comments_url":"https://api.github.com/repos/crowbar/crowbar-openstack/comments{/number}","issue_comment_url":"https://api.github.com/repos/crowbar/crowbar-openstack/issues/comments{/number}","contents_url":"https://api.github.com/repos/crowbar/crowbar-openstack/contents/{+path}","compare_url":"https://api.github.com/repos/crowbar/crowbar-openstack/compare/{base}...{head}","merges_url":"https://api.github.com/repos/crowbar/crowbar-openstack/merges","archive_url":"https://api.github.com/repos/crowbar/crowbar-openstack/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/crowbar/crowbar-openstack/downloads","issues_url":"https://api.github.com/repos/crowbar/crowbar-openstack/issues{/number}","pulls_url":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls{/number}","milestones_url":"https://api.github.com/repos/crowbar/crowbar-openstack/milestones{/number}","notifications_url":"https://api.github.com/repos/crowbar/crowbar-openstack/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/crowbar/crowbar-openstack/labels{/name}","releases_url":"https://api.github.com/repos/crowbar/crowbar-openstack/releases{/id}","created_at":"2015-07-13T10:55:33Z","updated_at":"2015-08-20T13:43:51Z","pushed_at":"2015-08-26T12:52:15Z","git_url":"git://github.com/crowbar/crowbar-openstack.git","ssh_url":"git@github.com:crowbar/crowbar-openstack.git","clone_url":"https://github.com/crowbar/crowbar-openstack.git","svn_url":"https://github.com/crowbar/crowbar-openstack","homepage":null,"size":240085,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":11,"mirror_url":null,"open_issues_count":9,"forks":11,"open_issues":9,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/16"},"html":{"href":"https://github.com/crowbar/crowbar-openstack/pull/16"},"issue":{"href":"https://api.github.com/repos/crowbar/crowbar-openstack/issues/16"},"comments":{"href":"https://api.github.com/repos/crowbar/crowbar-openstack/issues/16/comments"},"review_comments":{"href":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/16/comments"},"review_comment":{"href":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/crowbar/crowbar-openstack/pulls/16/commits"},"statuses":{"href":"https://api.github.com/repos/crowbar/crowbar-openstack/statuses/f503874b80f2a1c1db7749b0f863e2edbfa3be9b"}}}}