April 2010 - Devel - libvirt List Archives

[libvirt] [PATCH] Avoid searching for windres when not building for cygwin or mingw.
by Diego Elio Pettenò 08 Apr '10

08 Apr '10

Just checking for a windres tool might hit even on Linux systems when building for Linux (e.g.: when using Gentoo and having built binutils with multitarget support), and will then fail to link properly at the end of the build. Check the host string before deciding whether to look for windres or not. --- configure.ac | 9 +++++++-- 1 files changed, 7 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 29c6396..e6122b9 100644 --- a/configure.ac +++ b/configure.ac @@ -1676,8 +1676,13 @@ AC_SUBST([CYGWIN_EXTRA_PYTHON_LIBADD]) AC_SUBST([MINGW_EXTRA_LDFLAGS]) dnl Look for windres to build a Windows icon resource. -AC_CHECK_TOOL([WINDRES], [windres], [no]) -AM_CONDITIONAL([WITH_WIN_ICON], [test "$WINDRES" != "no"]) +case "$host" in + *cygwin* | *mingw* ) + AC_CHECK_TOOL([WINDRES], [windres], []) + ;; +esac + +AM_CONDITIONAL([WITH_WIN_ICON], [test "$WINDRES" != ""]) -- 1.6.6.1

3 2

[libvirt] [PATCH] nwfilters: Test suite for checking created firewall entries
by Stefan Berger 08 Apr '10

08 Apr '10

This patch adds new test cases to the existing nwfilter test program and adds a test script that must be run while a VM is running. This test script verifies that input network filter XML creates expected user-defined tables and rules on ebtables, iptables & ip6tables layer and verifies their content against expected content. The idea is that these tools always return exactly the same output when displaying the content of a user-defined table so that the diff tool can be used for simple text comparison. All supported protocols have at least one test case. This test program is not run automatically since it requires a running VM. For all tests to pass the previously posted ICMP fix patch must be applied. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfiltervmtest.sh | 186 ++++++++++++++++++ tests/nwfilterxml2fwallout/ah-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/ah-test.fwall | 19 + tests/nwfilterxml2fwallout/all-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/all-test.fwall | 19 + tests/nwfilterxml2fwallout/arp-test.fwall | 9 tests/nwfilterxml2fwallout/esp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/esp-test.fwall | 19 + tests/nwfilterxml2fwallout/icmp-direction-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction2-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction3-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-test.fwall | 16 + tests/nwfilterxml2fwallout/icmpv6-test.fwall | 16 + tests/nwfilterxml2fwallout/igmp-test.fwall | 19 + tests/nwfilterxml2fwallout/ip-test.fwall | 12 + tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 12 + tests/nwfilterxml2fwallout/ipv6-test.fwall | 14 + tests/nwfilterxml2fwallout/mac-test.fwall | 12 + tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/sctp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/sctp-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/udp-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-test.fwall | 19 + tests/nwfilterxml2xmlin/icmp-direction-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 + tests/nwfilterxml2xmlout/icmp-direction-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction2-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction3-test.xml | 9 tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml | 9 tests/nwfilterxml2xmltest.c | 4 37 files changed, 748 insertions(+) Index: libvirt-acl/tests/nwfiltervmtest.sh =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfiltervmtest.sh @@ -0,0 +1,186 @@ +#!/bin/sh + +VIRSH=virsh +ORIG_IFNAME="vnet0" + +function usage() { + local cmd="$0" + echo "Usage: ${cmd} [--help|-h|-?] [--ifname|-i <interfacename>" + cat <<EOF + +Options: + --help,-h,-? : Display this help screen. + --ifname, -i : Name of the backend interface of the VM. Default 'vnet0' + +Run this program while a KVM VM is running (preferably as only VM on the +system) and one of its interfaces uses a filter called 'testcase'. The name +of the interface of the VM is anticipated to be 'vnet0' unless set by the +'--ifname' option. The following interface description fulfills this +requirement: + + <interface type='bridge'> + <source bridge='virbr0'/> + <target dev='vnet0'/> + <filterref filter='testcase'/> + </interface> + +The individual tests are validated using string comparison where the output +of ebtables, iptables and ip6tables is compared against expected output. As +long as the output of those tools is the same, the tests should all pass. +The tests were developed on Fedore Core 12. + +Known problems: None of the running VMs' names may have spaces. +EOF +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local cmd line tmpfile tmpfile2 + local linenums ctr=0 + local regex="s/${ORIG_IFNAME}/${ifname}/g" + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + tmpfile=`mktemp` + tmpfile2=`mktemp` + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + exec 4<&0 + + exec < ${fwallfile} + + read line + while [ ! -z "${line}" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + exec ${cmd} | grep -v "^Bridge" | grep -v "^$" > ${tmpfile} + + rm ${tmpfile2} + touch ${tmpfile2} + + while [ 1 ]; do + read + + line="${REPLY}" + + if [ "${line:0:1}" == "#" -o -z "${line}" ]; then + + diff ${tmpfile} ${tmpfile2} > /dev/null + + if [ $? -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + else + echo "PASS ${xmlfile} : ${cmd}" + fi + + break; + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 0<&4 + exec 4<&- + + rm -rf "${tmpfile}" "${tmpfile2}" +} + + +function runTests() { + local ifname="$1" + local xmldir="$2" + local fwalldir="$3" + local fwallfiles f + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${ifname}" + done +} + + +function checkVM() { + local vmname="$1" + local ifname="$2" + local nwfilter="$3" + local f i c + + c=`virsh dumpxml ${vmname} | grep -c "<interface"` + if [ ${c} -ne 1 ]; then + echo "VM '${vmname}' has multiple interfaces. I cannot tell for sure " + echo "whether this VM has the correct interface name '${ifname}' and " + echo "reference the filter '${nwfilter}'. Cowardly skipping this VM..." + return 1 + fi + + f=`${VIRSH} dumpxml ${vmname} | \ + tr -d "\n" | \ + sed "s/.*filterref filter='$[a-zA-Z0-9_]\+$'.*/\1/"` + i=`${VIRSH} dumpxml ${vmname} | \ + tr -d "\n" | \ + sed "s/.*\<interface.*target dev='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + if [ "${i}" == "${ifname}" -a "${f}" == "${nwfilter}" ]; then + return 0 + fi + + return 1 +} + + +function main() { + local prgname="$0" + local ifname="${ORIG_IFNAME}" + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms + local filtername="testcase" + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --ifname|-i) shift 1; ifname="$1";; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + vms=`${VIRSH} list | grep running | gawk '{print $2}'` + if [ -z ${vms} ]; then + echo "Error: Need a running VM." + exit 1; + fi + + for vm in ${vms}; do + checkVM "${vm}" "${ifname}" "${filtername}" + if [ $? -eq 0 ]; then + found=1; + break; + fi + done + + if [ ${found} -eq 0 ]; then + echo "Error: Suitable VM seems not to be running. Check the help screen"; + echo "to (--help) to read about requirements to the running VM."; + exit 1; + fi + + runTests "${ifname}" "${xmldir}" "${fwalldir}" +} + +main $* + Index: libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,14 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,16 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21 +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21 +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21 +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21 +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -114,6 +114,10 @@ mymain(int argc, char **argv) DO_TEST("ref-test"); DO_TEST("ref-rule-test"); + DO_TEST("ipt-no-macspoof-test"); + DO_TEST("icmp-direction-test"); + DO_TEST("icmp-direction2-test"); + DO_TEST("icmp-direction3-test"); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout' priority='500'> + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + <rule action='drop' direction='in' priority='500'> + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,12 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/Makefile.am =================================================================== --- libvirt-acl.orig/tests/Makefile.am +++ libvirt-acl/tests/Makefile.am @@ -74,7 +74,9 @@ EXTRA_DIST = \ xml2vmxdata \ nwfilterxml2xmlout \ nwfilterxml2xmlin \ + nwfilterxml2fwallout \ nwfilterschematest \ + nwfiltervmtest.sh \ $(patsubst %,qemuhelpdata/%,$(qemuhelpdata)) noinst_PROGRAMS = virshtest conftest \

3 5

[libvirt] [PATCH] nwfilter: fix for directionality of ICMP traffic
by Stefan Berger 08 Apr '10

08 Apr '10

This patch enables the skipping of some of the ICMP traffic rules on the iptables level under certain circumstances so that the following filter properly enables unidirectional pings: <filter name='testcase'> <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>  <rule action='accept' direction='in' priority='500'> <icmp type='0'/> </rule>  <rule action='accept' direction='out' priority='500'> <icmp type='8'/> </rule>  <rule action='drop' direction='inout' priority='600'> <icmp/> </rule> </filter> Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 108 +++++++++++++++++------------- 1 file changed, 64 insertions(+), 44 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1022,6 +1022,12 @@ err_exit: * @ifname : The name of the interface to apply the rule to * @vars : A map containing the variables to resolve * @res : The data structure to store the result(s) into + * @match : optional string for state match + * @accept_target : where to jump to on accepted traffic, i.e., "RETURN" + * "ACCEPT" + * @isIPv6 : Whether this is an IPv6 rule + * @maySkipICMP : whether this rule may under certain circumstances skip + * the ICMP rule from being created * * Convert a single rule into its representation for later instantiation * @@ -1039,7 +1045,8 @@ _iptablesCreateRuleInstance(int directio virNWFilterRuleInstPtr res, const char *match, const char *accept_target, - bool isIPv6) + bool isIPv6, + bool maySkipICMP) { char chain[MAX_CHAINNAME_LENGTH]; char number[20]; @@ -1265,6 +1272,10 @@ _iptablesCreateRuleInstance(int directio if (HAS_ENTRY_ITEM(&rule->p.icmpHdrFilter.dataICMPType)) { const char *parm; + + if (maySkipICMP) + goto exit_no_error; + if (rule->prtclType == VIR_NWFILTER_RULE_PROTOCOL_ICMP) parm = "--icmp-type"; else @@ -1386,6 +1397,10 @@ err_exit: return -1; +exit_no_error: + virBufferFreeAndReset(&buf); + + return 0; } @@ -1401,15 +1416,19 @@ iptablesCreateRuleInstance(virNWFilterDe int directionIn = 0; char chainPrefix[2]; int needState = 1; + bool maySkipICMP, inout = false; if ((rule->tt == VIR_NWFILTER_RULE_DIRECTION_IN) || (rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT)) { directionIn = 1; needState = 0; + inout = (rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT); } chainPrefix[0] = 'F'; + maySkipICMP = !directionIn && !inout; + chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; rc = _iptablesCreateRuleInstance(directionIn, chainPrefix, @@ -1421,10 +1440,14 @@ iptablesCreateRuleInstance(virNWFilterDe needState ? MATCH_STATE_OUT : NULL, "RETURN", - isIPv6); + isIPv6, + maySkipICMP); if (rc) return rc; + + maySkipICMP = directionIn && !inout; + chainPrefix[1] = CHAINPREFIX_HOST_OUT_TEMP; rc = _iptablesCreateRuleInstance(!directionIn, chainPrefix, @@ -1436,10 +1459,13 @@ iptablesCreateRuleInstance(virNWFilterDe needState ? MATCH_STATE_IN : NULL, "ACCEPT", - isIPv6); + isIPv6, + maySkipICMP); if (rc) return rc; + maySkipICMP = !directionIn; + chainPrefix[0] = 'H'; chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; rc = _iptablesCreateRuleInstance(directionIn, @@ -1451,9 +1477,8 @@ iptablesCreateRuleInstance(virNWFilterDe res, NULL, "ACCEPT", - isIPv6); - if (rc) - return rc; + isIPv6, + maySkipICMP); return rc; }

2 1

[libvirt] [PATCH] Avoid a race when restoring a qemu domain.
by Laine Stump 08 Apr '10

08 Apr '10

This patch adds a 1 second sleep after telling qemu to start the restore operation and before telling qemu to start up the CPUs. Without this sleep, my hardware would end up with the CPUs started before the restore was started, leading to random (but never good) behavior. Apparently this is caused by slow hardware, as I haven't heard of anyone else experiencing this problem. A sleep is a very inelegant way to eliminate the problem, but it's apparently the only way currently available to us. Note that sleep durations as low as 250msec were successful in eliminating the bad behavior; I made it 1 sec. just for extra safety. --- src/qemu/qemu_driver.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 60fa95a..1270c84 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5965,6 +5965,13 @@ static int qemudDomainRestore(virConnectPtr conn, /* If it was running before, resume it now. */ if (header.was_running) { qemuDomainObjPrivatePtr priv = vm->privateData; + + /* pause 1 second to allow qemu time to start the restore, + * otherwise it may start the CPUs before the restore, and end + * up in a "nondeterminate" state. + */ + usleep(1000000); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStartCPUs(priv->mon, conn) < 0) { if (virGetLastError() == NULL) -- 1.6.6.1

3 4

[libvirt] [PATCH v2] nwfilter: Support for learning a VM's IP address
by Stefan Berger 08 Apr '10

08 Apr '10

Since v1, I have made the following changes: - remove unneeded include files - created a new ATTRIBUTE_PACKED in internal.h (please check) - added libpcap to rpm spec file (not built via rpm) - added 2 flags for the type of traffic to be used to detect the IP address of a VM: DETECT_DHCP & DETECT_STATIC. Now if DETECT_DHCP is chosen, temporary filtering rules are applied on the VM's interface that allow the VM to only send and receive DHCP traffic (optionally restricted to a certain DHCP server) until the actual rules are then applied. In that case the libpcap uses a filter that restricts packets the thread received to DHCP Response traffic. The function to request the learning of the IP address is currently invoked with both flags set, but either one by itself works. A user should consciously configure the VM that triggers that for example DETECT_DHCP is to be used alone since in that case a statically configured interface in the VM will not be able to communicate at all. Now the following ways for learning the IP address parameter are available: - explicitly provided IP address by user as filter parameter - snooping of DHCP OFFERs from a specific DHCP server - snooping of DHCP OFFERs from any server - snooping of any traffic from the VM indicating its IP address This patch implements support for learning a VM's IP address. It uses the pcap library to listen on the VM's backend network interface (tap) or the physical ethernet device (macvtap) and tries to capture packets with source or destination MAC address of the VM and learn from DHCP Offers, ARP traffic, or first-sent IPv4 packet what the IP address of the VM's interface is. This then allows to instantiate the network traffic filtering rules without the user having to provide the IP parameter somewhere in the filter description or in the interface description as a parameter. This only supports to detect the parameter IP, which is for the assumed single IPv4 address of a VM. There is not support for interfaces that may have multiple IP addresses (IP aliasing) or IPv6 that may then require more than one valid IP address to be detected. A VM can have multiple independent interfaces that each uses a different IP address and in that case it will be attempted to detect each one of the address independently. So, when for example an interface description in the domain XML has looked like this up to now: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'> <parameter name='IP' value='10.2.3.4'/> </filterref> </interface> you may omit the IP parameter: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> Internally I am walking the 'tree' of a VM's referenced network filters and determine with the given variables which variables are missing. Now, the above IP parameter may be missing and this causes a libvirt-internal thread to be started that uses the pcap library's API to listen to the backend interface (in case of macvtap to the physical interface) in an attempt to determine the missing IP parameter. If the backend interface disappears the thread terminates assuming the VM was brought down. In case of a macvtap device a timeout is being used to wait for packets from the given VM (filtering by VM's interface MAC address). If the VM's macvtap device disappeared the thread also terminates. In all other cases it tries to determine the IP address of the VM and will then apply the rules late on the given interface, which would have happened immediately if the IP parameter had been explicitly given. In case an error happens while the firewall rules are applied, the VM's backend interface is 'down'ed preventing it to communicate. Reasons for failure for applying the network firewall rules may that an ebtables/iptables command failes or OOM errors. Essentially the same failure reasons may occur as when the firewall rules are applied immediately on VM start, except that due to the late application of the filtering rules the VM now is already running and cannot be hindered anymore from starting. Bringing down the whole VM would probably be considered too drastic. While a VM's IP address is attempted to be determined only limited updates to network filters are allowed. In particular it is prevented that filters are modified in such a way that they would introduce new variables. A caveat: The algorithm does not know which one is the appropriate IP address of a VM. If the VM spoofs an IP address in its first ARP traffic or IPv4 packets its filtering rules will be instantiated for this IP address, thus 'locking' it to the found IP address. So, it's still 'safer' to explicitly provide the IP address of a VM's interface in the filter description if it is known beforehand. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- configure.ac | 39 + libvirt.spec.in | 9 src/Makefile.am | 14 src/conf/nwfilter_conf.c | 7 src/conf/nwfilter_conf.h | 3 src/internal.h | 8 src/libvirt_private.syms | 12 src/nwfilter/nwfilter_driver.c | 11 src/nwfilter/nwfilter_ebiptables_driver.c | 258 ++++++++++++ src/nwfilter/nwfilter_ebiptables_driver.h | 11 src/nwfilter/nwfilter_gentech_driver.c | 409 ++++++++++++++++++- src/nwfilter/nwfilter_gentech_driver.h | 14 src/nwfilter/nwfilter_learnipaddr.c | 625 ++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_learnipaddr.h | 68 +++ 14 files changed, 1450 insertions(+), 38 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -0,0 +1,68 @@ +/* + * nwfilter_learnipaddr.h: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#ifndef __NWFILTER_LEARNIPADDR_H +# define __NWFILTER_LEARNIPADDR_H + +enum howDetect { + DETECT_DHCP = 1, + DETECT_STATIC = 2, +}; + +typedef struct _virNWFilterIPAddrLearnReq virNWFilterIPAddrLearnReq; +typedef virNWFilterIPAddrLearnReq *virNWFilterIPAddrLearnReqPtr; +struct _virNWFilterIPAddrLearnReq { + char ifname[IF_NAMESIZE]; + char linkdev[IF_NAMESIZE]; + enum virDomainNetType nettype; + unsigned char macaddr[VIR_MAC_BUFLEN]; + char *filtername; + virNWFilterHashTablePtr filterparams; + virNWFilterDriverStatePtr driver; + enum howDetect howDetect; + + int status; + pthread_t thread; +}; + +int virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver, + enum howDetect howDetect); + +virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(const char *ifname); + + +void virNWFilterDelIpAddrForIfname(const char *ifname); +const char *virNWFilterGetIpAddrForIfname(const char *ifname); + +int virNWFilterLearnInit(void); +void virNWFilterLearnShutdown(void); + +#endif /* __NWFILTER_LEARNIPADDR_H */ Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -0,0 +1,625 @@ +/* + * nwfilter_learnipaddr.c: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#include <config.h> + +#ifdef HAVE_LIBPCAP +# include <pcap.h> +#endif + +#include <fcntl.h> +#include <sys/ioctl.h> + +#include <arpa/inet.h> +#include <net/ethernet.h> +#include <netinet/ip.h> +#include <netinet/udp.h> +#include <net/if_arp.h> + +#include "internal.h" + +#include "buf.h" +#include "memory.h" +#include "logging.h" +#include "datatypes.h" +#include "virterror_internal.h" +#include "threads.h" +#include "conf/nwfilter_params.h" +#include "conf/domain_conf.h" +#include "nwfilter_gentech_driver.h" +#include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + + +/* structure of an ARP request/reply message */ +struct f_arphdr { + struct arphdr arphdr; + uint8_t ar_sha[ETH_ALEN]; + uint32_t ar_sip; + uint8_t ar_tha[ETH_ALEN]; + uint32_t ar_tip; +} ATTRIBUTE_PACKED; + + +/* structure representing DHCP message */ +struct dhcp { + uint8_t op; + uint8_t htype; + uint8_t hlen; + uint8_t hops; + uint32_t xid; + uint16_t secs; + uint16_t flags; + uint32_t ciaddr; + uint32_t yiaddr; + uint32_t siaddr; + uint32_t giaddr; + uint8_t chaddr[16]; + /* omitted */ +} ATTRIBUTE_PACKED; + + +struct ether_vlan_header +{ + uint8_t dhost[ETH_ALEN]; + uint8_t shost[ETH_ALEN]; + uint16_t vlan_type; + uint16_t vlan_flags; + uint16_t ether_type; +} ATTRIBUTE_PACKED; + + +static virMutex pendingLearnReqLock; +static virHashTablePtr pendingLearnReq; + +static virMutex ipAddressMapLock; +static virNWFilterHashTablePtr ipAddressMap; + + +static void +virNWFilterIPAddrLearnReqFree(virNWFilterIPAddrLearnReqPtr req) { + if (!req) + return; + + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->filterparams); + + VIR_FREE(req); +} + + +#if HAVE_LIBPCAP + +static int +virNWFilterRegisterLearnReq(virNWFilterIPAddrLearnReqPtr req) { + int res = -1; + virMutexLock(&pendingLearnReqLock); + + if (!virHashLookup(pendingLearnReq, req->ifname)) + res = virHashAddEntry(pendingLearnReq, req->ifname, req); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + +#endif + + +virNWFilterIPAddrLearnReqPtr +virNWFilterLookupLearnReq(const char *ifname) { + void *res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + +static void +freeLearnReqEntry(void *payload, const char *name ATTRIBUTE_UNUSED) { + virNWFilterIPAddrLearnReqFree(payload); +} + + +#ifdef HAVE_LIBPCAP + +static virNWFilterIPAddrLearnReqPtr +virNWFilterDeregisterLearnReq(const char *ifname) { + virNWFilterIPAddrLearnReqPtr res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + if (res) + virHashRemoveEntry(pendingLearnReq, ifname, NULL); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + + +static int +virNWFilterAddIpAddrForIfname(const char *ifname, char *addr) { + int ret; + + virMutexLock(&ipAddressMapLock); + + ret = virNWFilterHashTablePut(ipAddressMap, ifname, addr, 1); + + virMutexUnlock(&ipAddressMapLock); + + return ret; +} +#endif + + +void +virNWFilterDelIpAddrForIfname(const char *ifname) { + + virMutexLock(&ipAddressMapLock); + + if (virHashLookup(ipAddressMap->hashTable, ifname)) + virNWFilterHashTableRemoveEntry(ipAddressMap, ifname); + + virMutexUnlock(&ipAddressMapLock); +} + + +const char * +virNWFilterGetIpAddrForIfname(const char *ifname) { + const char *res; + + virMutexLock(&ipAddressMapLock); + + res = virHashLookup(ipAddressMap->hashTable, ifname); + + virMutexUnlock(&ipAddressMapLock); + + return res; +} + + +#ifdef HAVE_LIBPCAP + +/** + * learnIPAddressThread + * arg: pointer to virNWFilterIPAddrLearnReq structure + * + * Learn the IP address being used on an interface. Use ARP Request and + * Reply messages, DHCP offers and the first IP packet being sent from + * the VM to detect the IP address it is using. Detects only one IP address + * per interface (IP aliasing not supported). The method on how the + * IP address is detected can be chosen through flags. DETECT_DHCP will + * require that the IP address is detected from a DHCP OFFER, DETECT_STATIC + * will require that the IP address was taken from an ARP packet or an IPv4 + * packet. Both flags can be set at the same time. + */ +static void * +learnIPAddressThread(void *arg) +{ + char errbuf[PCAP_ERRBUF_SIZE] = {0}; + pcap_t *handle; + struct bpf_program fp; + struct pcap_pkthdr header; + const u_char *packet; + struct ether_header *ether_hdr; + struct ether_vlan_header *vlan_hdr; + virNWFilterIPAddrLearnReqPtr req = arg; + uint32_t vmaddr = 0; + unsigned int ethHdrSize; + char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev + : req->ifname; + int to_ms = (strlen(req->linkdev) != 0) ? 1000 + : 0; + char macaddr[VIR_MAC_STRING_BUFLEN]; + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *filter= NULL; + uint16_t etherType; + enum howDetect howDetected = 0; + + req->status = 0; + + handle = pcap_open_live(listen_if, BUFSIZ, 0, to_ms, errbuf); + + if (handle == NULL) { + VIR_DEBUG("Couldn't open device %s: %s\n", listen_if, errbuf); + req->status = ENODEV; + goto done; + } + + virFormatMacAddr(req->macaddr, macaddr); + + switch (req->howDetect) { + case DETECT_DHCP: + virBufferVSprintf(&buf, " ether dst %s" + " and src port 67 and dst port 68", + macaddr); + break; + default: + virBufferVSprintf(&buf, "ether host %s", macaddr); + } + + if (virBufferError(&buf)) { + req->status = ENOMEM; + goto done; + } + + filter = virBufferContentAndReset(&buf); + + if (pcap_compile(handle, &fp, filter, 1, 0) != 0 || + pcap_setfilter(handle, &fp) != 0) { + VIR_DEBUG("Couldn't compile or set filter '%s'.\n", filter); + req->status = EINVAL; + goto done; + } + + while (req->status == 0 && vmaddr == 0) { + packet = pcap_next(handle, &header); + + if (!packet) { + if (to_ms == 0) { + /* assuming IF disappeared */ + req->status = ENODEV; + break; + } + /* listening on linkdev, check whether VM's dev is still there */ + if (checkIf(req->ifname, req->macaddr)) { + req->status = ENODEV; + break; + } + continue; + } + + if (header.len >= sizeof(struct ether_header)) { + ether_hdr = (struct ether_header*)packet; + + switch (ntohs(ether_hdr->ether_type)) { + + case ETHERTYPE_IP: + ethHdrSize = sizeof(struct ether_header); + etherType = ntohs(ether_hdr->ether_type); + break; + + case ETHERTYPE_VLAN: + ethHdrSize = sizeof(struct ether_vlan_header); + vlan_hdr = (struct ether_vlan_header *)packet; + if (ntohs(vlan_hdr->ether_type) != ETHERTYPE_IP || + header.len < ethHdrSize) + continue; + etherType = ntohs(vlan_hdr->ether_type); + break; + + default: + continue; + } + + if (memcmp(ether_hdr->ether_shost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets from the VM + + if (etherType == ETHERTYPE_IP && + (header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + vmaddr = iphdr->saddr; + // skip eth. bcast and mcast addresses, + // and zero address in DHCP Requests + if ((ntohl(vmaddr) & 0xc0000000) || vmaddr == 0) { + vmaddr = 0; + continue; + } + + howDetected = DETECT_STATIC; + } else if (etherType == ETHERTYPE_ARP && + (header.len >= ethHdrSize + + sizeof(struct f_arphdr))) { + struct f_arphdr *arphdr = (struct f_arphdr*)(packet + + ethHdrSize); + switch (ntohs(arphdr->arphdr.ar_op)) { + case ARPOP_REPLY: + vmaddr = arphdr->ar_sip; + howDetected = DETECT_STATIC; + break; + case ARPOP_REQUEST: + vmaddr = arphdr->ar_tip; + howDetected = DETECT_STATIC; + break; + } + } + } else if (memcmp(ether_hdr->ether_dhost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets to the VM + if (etherType == ETHERTYPE_IP && + (header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + if ((iphdr->protocol == IPPROTO_UDP) && + (header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr))) { + struct udphdr *udphdr= (struct udphdr *) + ((char *)iphdr + iphdr->ihl * 4); + if (ntohs(udphdr->source) == 67 && + ntohs(udphdr->dest) == 68 && + header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr) + + sizeof(struct dhcp)) { + struct dhcp *dhcp = (struct dhcp *) + ((char *)udphdr + sizeof(udphdr)); + if (dhcp->op == 2 /* DHCP OFFER */ && + !memcmp(&dhcp->chaddr[0], + req->macaddr, + 6)) { + vmaddr = dhcp->yiaddr; + howDetected = DETECT_DHCP; + } + } + } + } + } + } + if (vmaddr && (req->howDetect & howDetected) == 0) { + vmaddr = 0; + howDetected = 0; + } + } /* while */ + + done: + VIR_FREE(filter); + + if (handle) + pcap_close(handle); + + ebtablesRemoveBasicRules(NULL, req->ifname); + + if (req->status == 0) { + int ret; + char inetaddr[INET_ADDRSTRLEN]; + inet_ntop(AF_INET, &vmaddr, inetaddr, sizeof(inetaddr)); + + virNWFilterAddIpAddrForIfname(req->ifname, strdup(inetaddr)); + + ret = virNWFilterInstantiateFilterLate(NULL, + req->ifname, + req->linkdev, + req->nettype, + req->macaddr, + req->filtername, + req->filterparams, + req->driver); + VIR_DEBUG("Result from applying firewall rules on " + "%s with IP addr %s : %d\n", req->ifname, inetaddr, ret); + } + + memset(&req->thread, 0x0, sizeof(req->thread)); + + VIR_DEBUG("pcap thread terminating for interface %s \n",req->ifname); + + virNWFilterDeregisterLearnReq(req->ifname); + + virNWFilterIPAddrLearnReqFree(req); + + return 0; +} + + +/** + * virNWFilterLearnIPAddress + * @conn: pointer to virConnect object + * @ifname: the name of the interface + * @linkdev : the name of the link device; currently only used in case of a + * macvtap device + * @nettype : the type of interface + * @macaddr : the MAC address of the interface + * @filtername : the name of the top-level filter to apply to the interface + * once its IP address has been detected + * @driver : the network filter driver + * @howDetect : the method on how the thread is supposed to detect the + * IP address; must choose any of the available flags + * + * Instruct to learn the IP address being used on a given interface (ifname). + * Unless there already is a thread attempting to learn the IP address + * being used on the interface, a thread is started that will listen on + * the traffic being sent on the interface (or link device) with the + * MAC address that is provided. Will then launch the application of the + * firewall rules on the interface. + */ +int +virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver, + enum howDetect howDetect) { + int rc; + virNWFilterIPAddrLearnReqPtr req = NULL; + virNWFilterHashTablePtr ht = NULL; + + if (howDetect == 0) + return 1; + + if (VIR_ALLOC(req) < 0) { + virReportOOMError(); + goto err_no_req; + } + + ht = virNWFilterHashTableCreate(0); + if (ht == NULL) { + virReportOOMError(); + goto err_no_ht; + } + + if (virNWFilterHashTablePutAll(conn, filterparams, ht)) + goto err_free_ht; + + req->filtername = strdup(filtername); + if (req->filtername == NULL) { + virReportOOMError(); + goto err_free_ht; + } + + if (virStrcpyStatic(req->ifname, ifname) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for ifname ('%s') " + "not large enough"), ifname); + goto err_free_ht; + } + + if (linkdev) { + if (virStrcpyStatic(req->linkdev, linkdev) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for linkdev ('%s') " + "not large enough"), linkdev); + goto err_free_ht; + } + } + req->nettype = nettype; + memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); + req->driver = driver; + req->filterparams = ht; + ht = NULL; + req->howDetect = howDetect; + + rc = virNWFilterRegisterLearnReq(req); + + if (rc) + goto err_free_ht; + + switch (howDetect) { + case DETECT_DHCP: + if (ebtablesApplyDHCPOnlyRules(conn, + ifname, + macaddr, + NULL)) + goto err_free_ht; + break; + default: + if (ebtablesApplyBasicRules(conn, + ifname, + macaddr)) + goto err_free_ht; + } + + + if (pthread_create(&req->thread, + NULL, + learnIPAddressThread, + req) != 0) + goto err_remove_rules; + + return 0; + +err_remove_rules: + ebtablesRemoveBasicRules(conn, ifname); +err_free_ht: + virNWFilterHashTableFree(ht); +err_no_ht: + virNWFilterIPAddrLearnReqFree(req); +err_no_req: + return 1; +} + +#else + +int +virNWFilterLearnIPAddress(virConnectPtr conn ATTRIBUTE_UNUSED, + const char *ifname ATTRIBUTE_UNUSED, + const char *linkdev ATTRIBUTE_UNUSED, + enum virDomainNetType nettype ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED, + const char *filtername ATTRIBUTE_UNUSED, + virNWFilterHashTablePtr filterparams ATTRIBUTE_UNUSED, + virNWFilterDriverStatePtr driver ATTRIBUTE_UNUSED) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + _("IP parameter must be given since libvirt " + "was not compiled with IP address learning " + "support")); + return 1; +} +#endif /* HAVE_LIBPCAP */ + + +/** + * virNWFilterLearnInit + * Initialization of this layer + */ +int +virNWFilterLearnInit(void) { + pendingLearnReq = virHashCreate(0); + if (!pendingLearnReq) { + virReportOOMError(); + return 1; + } + + if (virMutexInit(&pendingLearnReqLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + ipAddressMap = virNWFilterHashTableCreate(0); + if (!ipAddressMap) { + virReportOOMError(); + virNWFilterLearnShutdown(); + return 1; + } + + if (virMutexInit(&ipAddressMapLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + return 0; +} + + +/** + * virNWFilterLearnShutdown + * Shutdown of this layer + */ +void +virNWFilterLearnShutdown(void) { + virHashFree(pendingLearnReq, freeLearnReqEntry); + pendingLearnReq = NULL; + + virNWFilterHashTableFree(ipAddressMap); + ipAddressMap = NULL; +} Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -308,7 +308,9 @@ NWFILTER_DRIVER_SOURCES = \ nwfilter/nwfilter_gentech_driver.c \ nwfilter/nwfilter_gentech_driver.h \ nwfilter/nwfilter_ebiptables_driver.c \ - nwfilter/nwfilter_ebiptables_driver.h + nwfilter/nwfilter_ebiptables_driver.h \ + nwfilter/nwfilter_learnipaddr.c \ + nwfilter/nwfilter_learnipaddr.h # Security framework and drivers for various models @@ -764,10 +766,11 @@ else libvirt_la_LIBADD += libvirt_driver_nwfilter.la noinst_LTLIBRARIES += libvirt_driver_nwfilter.la endif -libvirt_driver_nwfilter_la_CFLAGS = \ +libvirt_driver_nwfilter_la_CFLAGS = $(LIBPCAP_CFLAGS) \ -I@top_srcdir@/src/conf +libvirt_driver_nwfilter_la_LDFLAGS = $(LIBPCAP_LIBS) if WITH_DRIVER_MODULES -libvirt_driver_nwfilter_la_LDFLAGS = -module -avoid-version ../gnulib/lib/libgnu.la +libvirt_driver_nwfilter_la_LDFLAGS += -module -avoid-version ../gnulib/lib/libgnu.la endif libvirt_driver_nwfilter_la_SOURCES = $(NWFILTER_DRIVER_SOURCES) endif @@ -912,6 +915,7 @@ libvirt_la_LDFLAGS = $(VERSION_SCRIPT_FL -version-info $(LIBVIRT_VERSION_INFO) \ $(COVERAGE_CFLAGS:-f%=-Wc,-f%) \ $(LIBXML_LIBS) \ + $(LIBPCAP_LIBS) \ $(DRIVER_MODULE_LIBS) \ $(CYGWIN_EXTRA_LDFLAGS) $(MINGW_EXTRA_LDFLAGS) libvirt_la_CFLAGS = $(COVERAGE_CFLAGS) -DIN_LIBVIRT @@ -960,8 +964,8 @@ libvirt_lxc_SOURCES = \ $(NODE_INFO_SOURCES) \ $(ENCRYPTION_CONF_SOURCES) \ $(DOMAIN_CONF_SOURCES) \ - $(NWFILTER_PARAM_CONF_SOURCES) \ - $(CPU_CONF_SOURCES) + $(CPU_CONF_SOURCES) \ + $(NWFILTER_PARAM_CONF_SOURCES) libvirt_lxc_LDFLAGS = $(WARN_CFLAGS) $(COVERAGE_LDCFLAGS) $(CAPNG_LIBS) $(YAJL_LIBS) libvirt_lxc_LDADD = $(LIBXML_LIBS) $(NUMACTL_LIBS) ../gnulib/lib/libgnu.la libvirt_lxc_CFLAGS = \ Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -24,6 +24,9 @@ #include <config.h> #include <stdint.h> +#include <sys/socket.h> +#include <sys/ioctl.h> +#include <linux/if.h> #include "internal.h" @@ -34,12 +37,16 @@ #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER #define NWFILTER_STD_VAR_MAC "MAC" +#define NWFILTER_STD_VAR_IP "IP" + +static int _virNWFilterTeardownFilter(const char *ifname); static virNWFilterTechDriverPtr filter_tech_drivers[] = { @@ -111,6 +118,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI * @tables: pointer to hash tabel to add values to * @macaddr: The string of the MAC address to add to the hash table, * may be NULL + * @ipaddr: The string of the IP address to add to the hash table; + * may be NULL * * Returns 0 in case of success, 1 in case an error happened with * error having been reported. @@ -120,7 +129,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI static int virNWFilterVarHashmapAddStdValues(virConnectPtr conn, virNWFilterHashTablePtr table, - char *macaddr) + char *macaddr, + char *ipaddr) { if (macaddr) { if (virHashAddEntry(table->hashTable, @@ -132,6 +142,16 @@ virNWFilterVarHashmapAddStdValues(virCon } } + if (ipaddr) { + if (virHashAddEntry(table->hashTable, + NWFILTER_STD_VAR_IP, + ipaddr) < 0) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + "%s", _("Could not add variable 'IP' to hashmap")); + return 1; + } + } + return 0; } @@ -140,23 +160,26 @@ virNWFilterVarHashmapAddStdValues(virCon * virNWFilterCreateVarHashmap: * @conn: pointer to virConnect object * @macaddr: pointer to string containing formatted MAC address of interface + * @ipaddr: pointer to string containing formatted IP address used by + * VM on this interface; may be NULL * * Create a hashmap used for evaluating the firewall rules. Initializes - * it with the standard variable 'MAC'. + * it with the standard variable 'MAC' and 'IP' if provided. * * Returns pointer to hashmap, NULL if an error occcurred and error message * is attached to the virConnect object. */ virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr) { + char *macaddr, + char *ipaddr) { virNWFilterHashTablePtr table = virNWFilterHashTableCreate(0); if (!table) { virReportOOMError(); return NULL; } - if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr)) { + if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr, ipaddr)) { virNWFilterHashTableFree(table); return NULL; } @@ -284,9 +307,9 @@ _virNWFilterInstantiateRec(virConnectPtr virNWFilterHashTablePtr vars, int *nEntries, virNWFilterRuleInstPtr **insts, - enum instCase useNewFilter, int *foundNewFilter) + enum instCase useNewFilter, int *foundNewFilter, + virNWFilterDriverStatePtr driver) { - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterPoolObjPtr obj; int rc = 0; int i; @@ -365,7 +388,96 @@ _virNWFilterInstantiateRec(virConnectPtr tmpvars, nEntries, insts, useNewFilter, - foundNewFilter); + foundNewFilter, + driver); + + virNWFilterHashTableFree(tmpvars); + + virNWFilterPoolObjUnlock(obj); + if (rc) + break; + } else { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("referenced filter '%s' is missing"), + inc->filterref); + rc = 1; + break; + } + } + } + return rc; +} + + +static int +virNWFilterDetermineMissingVarsRec(virConnectPtr conn, + virNWFilterDefPtr filter, + virNWFilterHashTablePtr vars, + virNWFilterHashTablePtr missing_vars, + int useNewFilter, + virNWFilterDriverStatePtr driver) +{ + virNWFilterPoolObjPtr obj; + int rc = 0; + int i, j; + virNWFilterDefPtr next_filter; + + for (i = 0; i < filter->nentries; i++) { + virNWFilterRuleDefPtr rule = filter->filterEntries[i]->rule; + virNWFilterIncludeDefPtr inc = filter->filterEntries[i]->include; + if (rule) { + // check all variables of this rule + for (j = 0; j < rule->nvars; j++) { + if (!virHashLookup(vars->hashTable, rule->vars[j])) { + virNWFilterHashTablePut(missing_vars, rule->vars[j], + strdup("1"), 1); + } + } + } else if (inc) { + VIR_DEBUG("Following filter %s\n", inc->filterref); + obj = virNWFilterPoolObjFindByName(&driver->pools, + inc->filterref); + if (obj) { + + if (obj->wantRemoved) { + virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + _("Filter '%s' is in use."), + inc->filterref); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + // create a temporary hashmap for depth-first tree traversal + virNWFilterHashTablePtr tmpvars = + virNWFilterCreateVarsFrom(conn, + inc->params, + vars); + if (!tmpvars) { + virReportOOMError(); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + next_filter = obj->def; + + switch (useNewFilter) { + case INSTANTIATE_FOLLOW_NEWFILTER: + if (obj->newDef) { + next_filter = obj->newDef; + } + break; + case INSTANTIATE_ALWAYS: + break; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + next_filter, + tmpvars, + missing_vars, + useNewFilter, + driver); virNWFilterHashTableFree(tmpvars); @@ -438,9 +550,12 @@ virNWFilterInstantiate(virConnectPtr con enum virDomainNetType nettype, virNWFilterDefPtr filter, const char *ifname, + const char *linkdev, virNWFilterHashTablePtr vars, enum instCase useNewFilter, int *foundNewFilter, - bool teardownOld) + bool teardownOld, + const unsigned char *macaddr, + virNWFilterDriverStatePtr driver) { int rc; int j, nptrs; @@ -449,6 +564,45 @@ virNWFilterInstantiate(virConnectPtr con void **ptrs = NULL; int instantiate = 1; + virNWFilterLockFilterUpdates(); + + virNWFilterHashTablePtr missing_vars = virNWFilterHashTableCreate(0); + if (!missing_vars) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + filter, + vars, + missing_vars, + useNewFilter, + driver); + if (rc) + goto err_exit; + + if (virHashSize(missing_vars->hashTable) == 1) { + if (virHashLookup(missing_vars->hashTable, + NWFILTER_STD_VAR_IP) != NULL) { + if (virNWFilterLookupLearnReq(ifname) == NULL) { + rc = virNWFilterLearnIPAddress(conn, + ifname, + linkdev, + nettype, macaddr, + filter->name, + vars, driver, + DETECT_DHCP| DETECT_STATIC); + } + goto err_exit; + } + rc = 1; + goto err_exit; + } else if (virHashSize(missing_vars->hashTable) > 1) { + rc = 1; + goto err_exit; + } + rc = _virNWFilterInstantiateRec(conn, techdriver, nettype, @@ -456,7 +610,8 @@ virNWFilterInstantiate(virConnectPtr con ifname, vars, &nEntries, &insts, - useNewFilter, foundNewFilter); + useNewFilter, foundNewFilter, + driver); if (rc) goto err_exit; @@ -487,24 +642,33 @@ virNWFilterInstantiate(virConnectPtr con err_exit: + virNWFilterUnlockFilterUpdates(); + for (j = 0; j < nEntries; j++) virNWFilterRuleInstFree(insts[j]); VIR_FREE(insts); + virNWFilterHashTableFree(missing_vars); + return rc; } static int -_virNWFilterInstantiateFilter(virConnectPtr conn, - const virDomainNetDefPtr net, - bool teardownOld, - enum instCase useNewFilter) +__virNWFilterInstantiateFilter(virConnectPtr conn, + bool teardownOld, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + enum instCase useNewFilter, + virNWFilterDriverStatePtr driver) { int rc; const char *drvname = EBIPTABLES_DRIVER_ID; - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterTechDriverPtr techdriver; virNWFilterPoolObjPtr obj; virNWFilterHashTablePtr vars, vars1; @@ -512,6 +676,8 @@ _virNWFilterInstantiateFilter(virConnect char vmmacaddr[VIR_MAC_STRING_BUFLEN] = {0}; int foundNewFilter = 0; char *str_macaddr = NULL; + const char *ipaddr; + char *str_ipaddr = NULL; techdriver = virNWFilterTechDriverForName(drvname); @@ -523,25 +689,25 @@ _virNWFilterInstantiateFilter(virConnect return 1; } - VIR_DEBUG("filter name: %s\n", net->filter); + VIR_DEBUG("filter name: %s\n", filtername); - obj = virNWFilterPoolObjFindByName(&driver->pools, net->filter); + obj = virNWFilterPoolObjFindByName(&driver->pools, filtername); if (!obj) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Could not find filter '%s'"), - net->filter); + filtername); return 1; } if (obj->wantRemoved) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Filter '%s' is in use."), - net->filter); + filtername); rc = 1; goto err_exit; } - virFormatMacAddr(net->mac, vmmacaddr); + virFormatMacAddr(macaddr, vmmacaddr); str_macaddr = strdup(vmmacaddr); if (!str_macaddr) { virReportOOMError(); @@ -549,18 +715,29 @@ _virNWFilterInstantiateFilter(virConnect goto err_exit; } + ipaddr = virNWFilterGetIpAddrForIfname(ifname); + if (ipaddr) { + str_ipaddr = strdup(ipaddr); + if (!str_ipaddr) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + } + vars1 = virNWFilterCreateVarHashmap(conn, - str_macaddr); + str_macaddr, str_ipaddr); if (!vars1) { rc = 1; goto err_exit; } str_macaddr = NULL; + str_ipaddr = NULL; vars = virNWFilterCreateVarsFrom(conn, vars1, - net->filterparams); + filterparams); if (!vars) { rc = 1; goto err_exit_vars1; @@ -582,12 +759,15 @@ _virNWFilterInstantiateFilter(virConnect rc = virNWFilterInstantiate(conn, techdriver, - net->type, + nettype, filter, - net->ifname, + ifname, + linkdev, vars, useNewFilter, &foundNewFilter, - teardownOld); + teardownOld, + macaddr, + driver); virNWFilterHashTableFree(vars); @@ -595,15 +775,180 @@ err_exit_vars1: virNWFilterHashTableFree(vars1); err_exit: - virNWFilterPoolObjUnlock(obj); + VIR_FREE(str_ipaddr); VIR_FREE(str_macaddr); return rc; } +static int +_virNWFilterInstantiateFilter(virConnectPtr conn, + const virDomainNetDefPtr net, + bool teardownOld, + enum instCase useNewFilter) +{ + const char *linkdev = (net->type == VIR_DOMAIN_NET_TYPE_DIRECT) + ? net->data.direct.linkdev + : NULL; + return __virNWFilterInstantiateFilter(conn, + teardownOld, + net->ifname, + linkdev, + net->type, + net->mac, + net->filter, + net->filterparams, + useNewFilter, + conn->nwfilterPrivateData); +} + + +// FIXME: move chgIfFlags, ifUp, checkIf into common file & share w/ macvtap.c + +/* + * chgIfFlags: Change flags on an interface + * @ifname : name of the interface + * @flagclear : the flags to clear + * @flagset : the flags to set + * + * The new flags of the interface will be calculated as + * flagmask = (~0 ^ flagclear) + * newflags = (curflags & flagmask) | flagset; + * + * Returns 0 on success, errno on failure. + */ +static int chgIfFlags(const char *ifname, short flagclear, short flagset) { + struct ifreq ifr; + int rc = 0; + int flags; + short flagmask = (~0 ^ flagclear); + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + flags = (ifr.ifr_flags & flagmask) | flagset; + + if (ifr.ifr_flags != flags) { + ifr.ifr_flags = flags; + + if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) + rc = errno; + } + +err_exit: + close(fd); + return rc; +} + +/* + * ifUp + * @name: name of the interface + * @up: 1 for up, 0 for down + * + * Function to control if an interface is activated (up, 1) or not (down, 0) + * + * Returns 0 in case of success or an errno code in case of failure. + */ +static int +ifUp(const char *name, int up) +{ + return chgIfFlags(name, + (up) ? 0 : IFF_UP, + (up) ? IFF_UP : 0); +} + + +/** + * checkIf + * + * @ifname: Name of the interface + * @macaddr: expected MAC address of the interface + * + * FIXME: the interface's index is another good parameter to check + * + * Determine whether a given interface is still available. If so, + * it must have the given MAC address. + * + * Returns an error code ENODEV in case the interface does not exist + * anymore or its MAC address is different, 0 otherwise. + */ +int +checkIf(const char *ifname, const unsigned char *macaddr) +{ + struct ifreq ifr; + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + int rc = 0; + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + if (memcmp(&ifr.ifr_hwaddr.sa_data, macaddr, 6) != 0) + rc = ENODEV; + + err_exit: + close(fd); + return rc; +} + + +int +virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) +{ + int rc; + rc = __virNWFilterInstantiateFilter(conn, + 1, + ifname, + linkdev, + nettype, + macaddr, + filtername, + filterparams, + INSTANTIATE_ALWAYS, + driver); + if (rc) { + //something went wrong... 'DOWN' the interface + if (ifUp(ifname ,0)) { + // assuming interface disappeared... + _virNWFilterTeardownFilter(ifname); + } + } + return rc; +} + + int virNWFilterInstantiateFilter(virConnectPtr conn, const virDomainNetDefPtr net) @@ -660,8 +1005,8 @@ virNWFilterTearOldFilter(virConnectPtr c } -int -virNWFilterTeardownFilter(const virDomainNetDefPtr net) +static int +_virNWFilterTeardownFilter(const char *ifname) { const char *drvname = EBIPTABLES_DRIVER_ID; virNWFilterTechDriverPtr techdriver; @@ -676,13 +1021,21 @@ virNWFilterTeardownFilter(const virDomai #endif return 1; } + techdriver->allTeardown(ifname); - techdriver->allTeardown(net->ifname); + virNWFilterDelIpAddrForIfname(ifname); return 0; } +int +virNWFilterTeardownFilter(const virDomainNetDefPtr net) +{ + return _virNWFilterTeardownFilter(net->ifname); +} + + void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -37,6 +37,8 @@ #include "nwfilter_gentech_driver.h" +#include "nwfilter_learnipaddr.h" + #define VIR_FROM_THIS VIR_FROM_NWFILTER #define nwfilterLog(msg...) fprintf(stderr, msg) @@ -65,9 +67,12 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; - if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + if (virNWFilterLearnInit() < 0) return -1; + if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + goto conf_init_err; + if (VIR_ALLOC(driverState) < 0) goto alloc_err_exit; @@ -120,6 +125,9 @@ error: alloc_err_exit: virNWFilterConfLayerShutdown(); +conf_init_err: + virNWFilterLearnShutdown(); + return -1; } @@ -413,5 +421,6 @@ static virStateDriver stateDriver = { int nwfilterRegister(void) { virRegisterNWFilterDriver(&nwfilterDriver); virRegisterStateDriver(&stateDriver); + virNWFilterLearnInit(); return 0; } Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -46,13 +46,25 @@ int virNWFilterRollbackUpdateFilter(virC int virNWFilterTearOldFilter(virConnectPtr conn, const virDomainNetDefPtr net); +int virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); + int virNWFilterTeardownFilter(const virDomainNetDefPtr net); virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr); + char *macaddr, + char *ipaddr); void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, void *data); +int checkIf(const char *ifname, const unsigned char *macaddr); + #endif Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -488,6 +488,8 @@ virNWFilterRegisterCallbackDriver; virNWFilterTestUnassignDef; virNWFilterConfLayerInit; virNWFilterConfLayerShutdown; +virNWFilterLockFilterUpdates; +virNWFilterUnlockFilterUpdates; #nwfilter_params.h @@ -503,6 +505,16 @@ virNWFilterInstantiateFilter; virNWFilterTeardownFilter; +#nwfilter_learnipaddr.h +ipAddressMap; +ipAddressMapLock; +pendingLearnReq; +pendingLearnReqLock; +virNWFilterGetIpAddrForIfname; +virNWFilterDelIpAddrForIfname; +virNWFilterLookupLearnReq; + + # pci.h pciGetDevice; pciFreeDevice; Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -114,17 +114,18 @@ struct int_map { */ static virMutex updateMutex; -static void +void virNWFilterLockFilterUpdates(void) { virMutexLock(&updateMutex); } -static void +void virNWFilterUnlockFilterUpdates(void) { virMutexUnlock(&updateMutex); } + /* * attribute names for the rules XML */ @@ -2631,7 +2632,7 @@ int virNWFilterConfLayerInit(virHashIter { virNWFilterDomainFWUpdateCB = domUpdateCB; - if (virMutexInit(&updateMutex)) + if (virMutexInitRecursive(&updateMutex)) return 1; if (virNWFilterParamConfLayerInit()) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -565,6 +565,9 @@ virNWFilterDefPtr virNWFilterDefParseFil void virNWFilterPoolObjLock(virNWFilterPoolObjPtr obj); void virNWFilterPoolObjUnlock(virNWFilterPoolObjPtr obj); +void virNWFilterLockFilterUpdates(void); +void virNWFilterUnlockFilterUpdates(void); + int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -2594,6 +2594,264 @@ ebiptablesInstCommand(virConnectPtr conn } +/** + * ebtablesApplyBasicRules + * + * @conn: virConnect object + * @ifname: name of the backend-interface to which to apply the rules + * @macaddr: MAC address the VM is using in packets sent through the + * interface + * + * Returns 0 on success, 1 on failure with the rules removed + * + * Apply basic filtering rules on the given interface + * - filtering for MAC address spoofing + * - allowing IPv4 & ARP traffic + */ +int +ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + char chain[MAX_CHAINNAME_LENGTH]; + char chainPrefix = CHAINPREFIX_HOST_IN_TEMP; + char macaddr_str[VIR_MAC_STRING_BUFLEN]; + + virFormatMacAddr(macaddr, macaddr_str); + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebiptablesExecCLI(conn, &buf, &cli_status); + + ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + + PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p IPv4 -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p ARP -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + + if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + goto tear_down_tmpebchains; + + return 0; + +tear_down_tmpebchains: + ebtablesRemoveBasicRules(conn, ifname); + + virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + "%s", + _("Some rules could not be created.")); + + return 1; +} + + +/** + * ebtablesApplyDHCPOnlyRules + * + * @conn: virConnect object + * @ifname: name of the backend-interface to which to apply the rules + * @macaddr: MAC address the VM is using in packets sent through the + * interface + * @dhcpserver: The DHCP server from which the VM may receive traffic + * from; may be NULL + * + * Returns 0 on success, 1 on failure with the rules removed + * + * Apply filtering rules so that the VM can only send and receive + * DHCP traffic and nothing else. + */ +int +ebtablesApplyDHCPOnlyRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr, + const char *dhcpserver) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + char chain_in [MAX_CHAINNAME_LENGTH], + chain_out[MAX_CHAINNAME_LENGTH]; + char macaddr_str[VIR_MAC_STRING_BUFLEN]; + char *srcIPParam = NULL; + + if (dhcpserver) { + virBufferVSprintf(&buf, " --ip-src %s", dhcpserver); + if (virBufferError(&buf)) + return 1; + srcIPParam = virBufferContentAndReset(&buf); + } + + virFormatMacAddr(macaddr, macaddr_str); + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebiptablesExecCLI(conn, &buf, &cli_status); + + ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + ebtablesCreateTmpRootChain(conn, &buf, 0, ifname, 1); + + PRINT_ROOT_CHAIN(chain_in , CHAINPREFIX_HOST_IN_TEMP , ifname); + PRINT_ROOT_CHAIN(chain_out, CHAINPREFIX_HOST_OUT_TEMP, ifname); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_in, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s" + " -p ipv4 --ip-protocol udp" + " --ip-src 0.0.0.0 --ip-dst 255.255.255.255 " + " --ip-sport 68 --ip-dport 67 " + " -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_in, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_in, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -d ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_out, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s" + " -p ipv4 --ip-protocol udp" + " --ip-sport 67 --ip-dport 68" + " %s" + " -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_out, + srcIPParam != NULL ? srcIPParam : "", + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_out, + CMD_STOPONERR(1)); + + ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + ebtablesLinkTmpRootChain(conn, &buf, 0, ifname, 1); + + if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + goto tear_down_tmpebchains; + + VIR_FREE(srcIPParam); + + return 0; + +tear_down_tmpebchains: + ebtablesRemoveBasicRules(conn, ifname); + + virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + "%s", + _("Some rules could not be created.")); + + VIR_FREE(srcIPParam); + + return 1; +} + + +int +ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + + ebiptablesExecCLI(conn, &buf, &cli_status); + return 0; +} + + static int ebiptablesRuleOrderSort(const void *a, const void *b) { Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h @@ -45,4 +45,15 @@ extern virNWFilterTechDriver ebiptables_ # define EBIPTABLES_DRIVER_ID "ebiptables" + +int ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr); +int ebtablesApplyDHCPOnlyRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr, + const char *dhcpServer); +int ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname); + #endif Index: libvirt-acl/configure.ac =================================================================== --- libvirt-acl.orig/configure.ac +++ libvirt-acl/configure.ac @@ -41,6 +41,7 @@ XMLRPC_REQUIRED=1.14.0 HAL_REQUIRED=0.5.0 DEVMAPPER_REQUIRED=1.0.0 LIBCURL_REQUIRED="7.18.0" +LIBPCAP_REQUIRED="1.0.0" dnl Checks for C compiler. AC_PROG_CC @@ -1045,6 +1046,39 @@ AC_SUBST([NUMACTL_CFLAGS]) AC_SUBST([NUMACTL_LIBS]) +dnl pcap lib +LIBPCAP_CONFIG="pcap-config" +LIBPCAP_CFLAGS="" +LIBPCAP_LIBS="" +LIBPCAP_FOUND="no" + +AC_ARG_WITH([libpcap], AC_HELP_STRING([--with-libpcap=@<:@PFX@:>@], [libpcap location])) +if test "$with_qemu" = "yes"; then + if test "x$with_libpcap" != "xno" ; then + if test "x$with_libpcap" != "x" ; then + LIBPCAP_CONFIG=$with_libpcap/bin/$LIBPCAP_CONFIG + fi + AC_MSG_CHECKING(libpcap $LIBPCAP_CONFIG >= $LIBPCAP_REQUIRED ) + if ! $LIBPCAP_CONFIG --libs > /dev/null 2>&1 ; then + AC_MSG_RESULT(no) + else + LIBPCAP_LIBS="`$LIBPCAP_CONFIG --libs`" + LIBPCAP_CFLAGS="`$LIBPCAP_CONFIG --cflags`" + LIBPCAP_FOUND="yes" + AC_MSG_RESULT(yes) + fi + fi +fi + +if test "x$LIBPCAP_FOUND" = "xyes"; then + AC_DEFINE_UNQUOTED([HAVE_LIBPCAP], 1, [whether libpcap can be used]) +fi + +AC_SUBST([LIBPCAP_CFLAGS]) +AC_SUBST([LIBPCAP_LIBS]) + + + dnl dnl Checks for the UML driver dnl @@ -2129,6 +2163,11 @@ AC_MSG_NOTICE([ xmlrpc: $XMLRPC_CFLAGS else AC_MSG_NOTICE([ xmlrpc: no]) fi +if test "$with_qemu" = "yes" ; then +AC_MSG_NOTICE([ pcap: $LIBPCAP_CFLAGS $LIBPCAP_LIBS]) +else +AC_MSG_NOTICE([ pcap: no]) +fi AC_MSG_NOTICE([]) AC_MSG_NOTICE([Test suite]) AC_MSG_NOTICE([]) Index: libvirt-acl/src/internal.h =================================================================== --- libvirt-acl.orig/src/internal.h +++ libvirt-acl/src/internal.h @@ -138,6 +138,14 @@ # endif # endif +# ifndef ATTRIBUTE_PACKED +# if __GNUC_PREREQ (3, 3) +# define ATTRIBUTE_PACKED __attribute__((packed)) +# else +# error "Need an __attribute__((packed)) equivalent" +# endif +# endif + # ifndef ATTRIBUTE_NONNULL # if __GNUC_PREREQ (3, 3) # define ATTRIBUTE_NONNULL(m) __attribute__((__nonnull__(m))) Index: libvirt-acl/libvirt.spec.in =================================================================== --- libvirt-acl.orig/libvirt.spec.in +++ libvirt-acl/libvirt.spec.in @@ -61,6 +61,7 @@ %define with_udev 0%{!?_without_udev:0} %define with_hal 0%{!?_without_hal:0} %define with_yajl 0%{!?_without_yajl:0} +%define with_libpcap 0%{!?_without_libpcap:0} # Non-server/HV driver defaults which are always enabled %define with_python 0%{!?_without_python:1} @@ -147,6 +148,11 @@ %define with_yajl 0%{!?_without_yajl:%{server_drivers}} %endif +# Enable libpcap library +%if %{with_qemu} +%define with_libpcap 0%{!?_without_libpcap:%{server_drivers}} +%endif + # Force QEMU to run as non-root %if 0%{?fedora} >= 12 || 0%{?rhel} >= 6 %define qemu_user qemu @@ -266,6 +272,9 @@ BuildRequires: libpciaccess-devel >= 0.1 %if %{with_yajl} BuildRequires: yajl-devel %endif +%if %{with_libpcap} +BuildRequires: libpcap-devel +%endif %if %{with_avahi} BuildRequires: avahi-devel %endif

2 2

[libvirt] [PATCH v2] nwfilters: Test suite for checking created firewall entries
by Stefan Berger 08 Apr '10

08 Apr '10

Changes from v1 to v2: - followed suggestions from Eric Blake on script improvements This patch adds new test cases to the existing nwfilter test program and adds a test script that must be run while a VM is running. This test script verifies that input network filter XML creates expected user-defined tables and rules on ebtables, iptables & ip6tables layer and verifies their content against expected content. The idea is that these tools always return exactly the same output when displaying the content of a user-defined table so that the diff tool can be used for simple text comparison. All supported protocols have at least one test case. This test program is not run automatically since it requires a running VM. For all tests to pass the previously posted ICMP fix patch must be applied. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfiltervmtest.sh | 186 ++++++++++++++++++ tests/nwfilterxml2fwallout/ah-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/ah-test.fwall | 19 + tests/nwfilterxml2fwallout/all-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/all-test.fwall | 19 + tests/nwfilterxml2fwallout/arp-test.fwall | 9 tests/nwfilterxml2fwallout/esp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/esp-test.fwall | 19 + tests/nwfilterxml2fwallout/icmp-direction-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction2-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction3-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-test.fwall | 16 + tests/nwfilterxml2fwallout/icmpv6-test.fwall | 16 + tests/nwfilterxml2fwallout/igmp-test.fwall | 19 + tests/nwfilterxml2fwallout/ip-test.fwall | 12 + tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 12 + tests/nwfilterxml2fwallout/ipv6-test.fwall | 14 + tests/nwfilterxml2fwallout/mac-test.fwall | 12 + tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/sctp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/sctp-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/udp-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-test.fwall | 19 + tests/nwfilterxml2xmlin/icmp-direction-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 + tests/nwfilterxml2xmlout/icmp-direction-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction2-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction3-test.xml | 9 tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml | 9 tests/nwfilterxml2xmltest.c | 4 37 files changed, 748 insertions(+) Index: libvirt-acl/tests/nwfiltervmtest.sh =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfiltervmtest.sh @@ -0,0 +1,191 @@ +#!/bin/bash + +VIRSH=virsh +ORIG_IFNAME="vnet0" + +TMPFILE1="/tmp/nwfiltervmtest1.txt" +TMPFILE2="/tmp/nwfiltervmtest2.txt" + +function usage() { + local cmd="$0" + echo "Usage: ${cmd} [--help|-h|-?] [--ifname|-i <interfacename>" + cat <<EOF + +Options: + --help,-h,-? : Display this help screen. + --ifname, -i : Name of the backend interface of the VM. Default 'vnet0' + +Run this program while a KVM VM is running (preferably as only VM on the +system) and one of its interfaces uses a filter called 'testcase'. The name +of the interface of the VM is anticipated to be 'vnet0' unless set by the +'--ifname' option. The following interface description fulfills this +requirement: + + <interface type='bridge'> + <source bridge='virbr0'/> + <target dev='vnet0'/> + <filterref filter='testcase'/> + </interface> + +The individual tests are validated using string comparison where the output +of ebtables, iptables and ip6tables is compared against expected output. As +long as the output of those tools is the same, the tests should all pass. +The tests were developed on Fedore Core 12. + +Known problems: None of the running VMs' names may have spaces. +EOF +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local cmd line tmpfile tmpfile2 + local linenums ctr=0 + local regex="s/${ORIG_IFNAME}/${ifname}/g" + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + tmpfile="${TMPFILE1}" + tmpfile2="${TMPFILE2}" + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + exec 4<&0 + + exec < ${fwallfile} + + read line + while [ "x${line}x" != "xx" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + exec ${cmd} | grep -v "^Bridge" | grep -v "^$" > ${tmpfile} + + rm ${tmpfile2} 2>/dev/null + touch ${tmpfile2} + + while [ 1 ]; do + read + + line="${REPLY}" + + if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then + + diff ${tmpfile} ${tmpfile2} >/dev/null + + if [ $? -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + else + echo "PASS ${xmlfile} : ${cmd}" + fi + + break; + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 0<&4 + exec 4<&- + + rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null +} + + +function runTests() { + local ifname="$1" + local xmldir="$2" + local fwalldir="$3" + local fwallfiles f + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${ifname}" + done +} + + +function checkVM() { + local vmname="$1" + local ifname="$2" + local nwfilter="$3" + local f i c + + c=`${VIRSH} dumpxml ${vmname} | grep -c "<interface"` + if [ ${c} -ne 1 ]; then + echo "VM '${vmname}' has multiple interfaces. I cannot tell for sure " + echo "whether this VM has the correct interface name '${ifname}' and " + echo "reference the filter '${nwfilter}'. Cowardly skipping this VM..." + return 1 + fi + + f=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \ + sed "s/.*filterref filter='$[a-zA-Z0-9_]\+$'.*/\1/"` + i=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \ + sed "s/.*\<interface.*target dev='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + if [ "x${i}x" == "x${ifname}x" ] && [ "x${f}x" == "x${nwfilter}x" ]; then + return 0 + fi + + return 1 +} + + +function main() { + local prgname="$0" + local ifname="${ORIG_IFNAME}" + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms + local filtername="testcase" + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --ifname|-i) shift 1; ifname="$1";; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + if [ `uname` != "Linux" ]; then + echo "This script will only run on Linux." + exit 1; + fi + + vms=`${VIRSH} list | grep running | gawk '{print $2}'` + if [ "x${vms}x" == "xx" ]; then + echo "Error: Need a running VM." + exit 1; + fi + + for vm in ${vms}; do + checkVM "${vm}" "${ifname}" "${filtername}" + if [ $? -eq 0 ]; then + found=1; + break; + fi + done + + if [ ${found} -eq 0 ]; then + echo "Error: Suitable VM seems not to be running. Check the help screen"; + echo "to (--help) to read about requirements to the running VM."; + exit 1; + fi + + runTests "${ifname}" "${xmldir}" "${fwalldir}" +} + +main "$@" Index: libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,14 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,16 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21 +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21 +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21 +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21 +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -114,6 +114,10 @@ mymain(int argc, char **argv) DO_TEST("ref-test"); DO_TEST("ref-rule-test"); + DO_TEST("ipt-no-macspoof-test"); + DO_TEST("icmp-direction-test"); + DO_TEST("icmp-direction2-test"); + DO_TEST("icmp-direction3-test"); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout' priority='500'> + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + <rule action='drop' direction='in' priority='500'> + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,12 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/Makefile.am =================================================================== --- libvirt-acl.orig/tests/Makefile.am +++ libvirt-acl/tests/Makefile.am @@ -74,7 +74,9 @@ EXTRA_DIST = \ xml2vmxdata \ nwfilterxml2xmlout \ nwfilterxml2xmlin \ + nwfilterxml2fwallout \ nwfilterschematest \ + nwfiltervmtest.sh \ $(patsubst %,qemuhelpdata/%,$(qemuhelpdata)) noinst_PROGRAMS = virshtest conftest \

1 0

[libvirt] [PATCH] Fix up python bindings for new event callbacks
by Daniel P. Berrange 08 Apr '10

08 Apr '10

The generator was disabled for the new event callbacks, since they need to be hand written. This patch adds the C and python glue to expose the new APIs in the python binding. The python example program is extended to demonstrate of the code * python/libvirt-override.c: Registration and dispatch of events at the C layer * python/libvirt-override-virConnect.py: Python glue for events * examples/domain-events/events-python/event-test.py: Demo use of new event callbacks --- examples/domain-events/events-python/event-test.py | 22 +- python/libvirt-override-virConnect.py | 45 ++ python/libvirt-override.c | 451 ++++++++++++++++++++ 3 files changed, 517 insertions(+), 1 deletions(-) diff --git a/examples/domain-events/events-python/event-test.py b/examples/domain-events/events-python/event-test.py index 181b389..0c6e2f0 100644 --- a/examples/domain-events/events-python/event-test.py +++ b/examples/domain-events/events-python/event-test.py @@ -412,6 +412,21 @@ def myDomainEventCallback1 (conn, dom, event, detail, opaque): def myDomainEventCallback2 (conn, dom, event, detail, opaque): print "myDomainEventCallback2 EVENT: Domain %s(%s) %s %d" % (dom.name(), dom.ID(), eventToString(event), detail) +def myDomainEventRebootCallback(conn, dom, opaque): + print "myDomainEventRebootCallback: Domain %s(%s)" % (dom.name(), dom.ID()) + +def myDomainEventRTCChangeCallback(conn, dom, utcoffset, opaque): + print "myDomainEventRTCChangeCallback: Domain %s(%s) %d" % (dom.name(), dom.ID(), utcoffset) + +def myDomainEventWatchdogCallback(conn, dom, action, opaque): + print "myDomainEventWatchdogCallback: Domain %s(%s) %d" % (dom.name(), dom.ID(), action) + +def myDomainEventIOErrorCallback(conn, dom, srcpath, devalias, action, opaque): + print "myDomainEventIOErrorCallback: Domain %s(%s) %s %s %d" % (dom.name(), dom.ID(), srcpath, devalias, action) + +def myDomainEventGraphicsCallback(conn, dom, phase, localAddr, remoteAddr, authScheme, subject, opaque): + print "myDomainEventGraphicsCallback: Domain %s(%s) %d %s" % (dom.name(), dom.ID(), phase, authScheme) + def usage(): print "usage: "+os.path.basename(sys.argv[0])+" [uri]" print " uri will default to qemu:///system" @@ -451,7 +466,12 @@ def main(): #Add 2 callbacks to prove this works with more than just one vc.domainEventRegister(myDomainEventCallback1,None) - vc.domainEventRegister(myDomainEventCallback2,None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_LIFECYCLE, myDomainEventCallback2, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_REBOOT, myDomainEventRebootCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_RTC_CHANGE, myDomainEventRTCChangeCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_IO_ERROR, myDomainEventIOErrorCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_WATCHDOG, myDomainEventWatchdogCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_GRAPHICS, myDomainEventGraphicsCallback, None) # The rest of your app would go here normally, but for sake # of demo we'll just go to sleep. The other option is to diff --git a/python/libvirt-override-virConnect.py b/python/libvirt-override-virConnect.py index 1fdf548..444a499 100644 --- a/python/libvirt-override-virConnect.py +++ b/python/libvirt-override-virConnect.py @@ -41,3 +41,48 @@ return 0 except AttributeError: pass + + def dispatchDomainEventLifecycleCallback(self, dom, event, detail, cbData): + """Dispatches events to python user domain event callbacks + """ + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), event, detail, opaque) + return 0 + + def dispatchDomainEventGenericCallback(self, dom, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), opaque) + return 0 + except AttributeError: + pass + + def domainEventDeregisterAny(self, callbackID): + """Removes a Domain Event Callback. De-registering for a + domain callback will disable delivery of this event type """ + try: + ret = libvirtmod.virConnectDomainEventDeregisterAny(self._o, callbackID) + if ret == -1: raise libvirtError ('virConnectDomainEventDeregisterAny() failed', conn=self) + del self.domainEventCallbackID[callbackID] + except AttributeError: + pass + + def domainEventRegisterAny(self, dom, eventID, cb, opaque): + """Adds a Domain Event Callback. Registering for a domain + callback will enable delivery of the events """ + if not hasattr(self, 'domainEventCallbackID'): + self.domainEventCallbackID = {} + cbData = { "cb": cb, "conn": self, "opaque": opaque } + if dom is None: + ret = libvirtmod.virConnectDomainEventRegisterAny(self._o, None, eventID, cbData) + else: + ret = libvirtmod.virConnectDomainEventRegisterAny(self._o, dom._o, eventID, cbData) + if ret == -1: + raise libvirtError ('virConnectDomainEventRegisterAny() failed', conn=self) + self.domainEventCallbackID[ret] = opaque diff --git a/python/libvirt-override.c b/python/libvirt-override.c index e27bce6..02bc313 100644 --- a/python/libvirt-override.c +++ b/python/libvirt-override.c @@ -2761,6 +2761,455 @@ libvirt_virEventInvokeTimeoutCallback(PyObject *self ATTRIBUTE_UNUSED, return VIR_PY_INT_SUCCESS; } + +static void +libvirt_virConnectDomainEventFreeFunc(void *opaque) +{ + PyObject *pyobj_conn = (PyObject*)opaque; + LIBVIRT_ENSURE_THREAD_STATE; + Py_DECREF(pyobj_conn); + LIBVIRT_RELEASE_THREAD_STATE; +} + +static int +libvirt_virConnectDomainEventLifecycleCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + int event, + int detail, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventLifecycleCallback", + (char*)"OiiO", + pyobj_dom, + event, detail, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventGenericCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventGenericCallback", + (char*)"OO", + pyobj_dom, pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventRTCChangeCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + long long utcoffset, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventRTCChangeCallback", + (char*)"OLO", + pyobj_dom, + (PY_LONG_LONG)utcoffset, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventWatchdogCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + int action, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventWatchdogCallback", + (char*)"OiO", + pyobj_dom, + action, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventIOErrorCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventIOErrorCallback", + (char*)"OssiO", + pyobj_dom, + srcPath, devAlias, action, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventGraphicsCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + int phase, + virDomainEventGraphicsAddressPtr local, + virDomainEventGraphicsAddressPtr remote, + const char *authScheme, + virDomainEventGraphicsSubjectPtr subject, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + PyObject *pyobj_local; + PyObject *pyobj_remote; + PyObject *pyobj_subject; + int ret = -1; + int i; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + pyobj_local = PyDict_New(); + PyDict_SetItem(pyobj_local, + libvirt_constcharPtrWrap("family"), + libvirt_intWrap(local->family)); + PyDict_SetItem(pyobj_local, + libvirt_constcharPtrWrap("node"), + libvirt_constcharPtrWrap(local->node)); + PyDict_SetItem(pyobj_local, + libvirt_constcharPtrWrap("service"), + libvirt_constcharPtrWrap(local->service)); + + pyobj_remote = PyDict_New(); + PyDict_SetItem(pyobj_remote, + libvirt_constcharPtrWrap("family"), + libvirt_intWrap(remote->family)); + PyDict_SetItem(pyobj_remote, + libvirt_constcharPtrWrap("node"), + libvirt_constcharPtrWrap(remote->node)); + PyDict_SetItem(pyobj_remote, + libvirt_constcharPtrWrap("service"), + libvirt_constcharPtrWrap(remote->service)); + + pyobj_subject = PyList_New(subject->nidentity); + for (i = 0 ; i < subject->nidentity ; i++) { + PyObject *pair = PyTuple_New(2); + PyTuple_SetItem(pair, 0, libvirt_constcharPtrWrap(subject->identities[i].type)); + PyTuple_SetItem(pair, 1, libvirt_constcharPtrWrap(subject->identities[i].name)); + + PyList_SetItem(pyobj_subject, i, pair); + } + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventGraphicsCallback", + (char*)"OiOOsOO", + pyobj_dom, + phase, pyobj_local, pyobj_remote, + authScheme, pyobj_subject, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static PyObject * +libvirt_virConnectDomainEventRegisterAny(ATTRIBUTE_UNUSED PyObject * self, + PyObject * args) +{ + PyObject *py_retval; /* return value */ + PyObject *pyobj_conn; /* virConnectPtr */ + PyObject *pyobj_dom; + PyObject *pyobj_cbData; /* hash of callback data */ + int eventID; + virConnectPtr conn; + int ret = 0; + virConnectDomainEventGenericCallback cb = NULL; + virDomainPtr dom; + + if (!PyArg_ParseTuple + (args, (char *) "OOiO:virConnectDomainEventRegisterAny", + &pyobj_conn, &pyobj_dom, &eventID, &pyobj_cbData)) { +#if DEBUG_ERROR + printf("%s failed parsing tuple\n", __FUNCTION__); +#endif + return VIR_PY_INT_FAIL; + } + +#ifdef DEBUG_ERROR + printf("libvirt_virConnectDomainEventRegister(%p %p %d %p) called\n", + pyobj_conn, pyobj_dom, eventID, pyobj_cbData); +#endif + conn = PyvirConnect_Get(pyobj_conn); + if (pyobj_dom == Py_None) + dom = NULL; + else + dom = PyvirDomain_Get(pyobj_dom); + + switch (eventID) { + case VIR_DOMAIN_EVENT_ID_LIFECYCLE: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventLifecycleCallback); + break; + case VIR_DOMAIN_EVENT_ID_REBOOT: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventGenericCallback); + break; + case VIR_DOMAIN_EVENT_ID_RTC_CHANGE: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventRTCChangeCallback); + break; + case VIR_DOMAIN_EVENT_ID_WATCHDOG: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventWatchdogCallback); + break; + case VIR_DOMAIN_EVENT_ID_IO_ERROR: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventIOErrorCallback); + break; + case VIR_DOMAIN_EVENT_ID_GRAPHICS: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventGraphicsCallback); + break; + } + + if (!cb) { + return VIR_PY_INT_FAIL; + } + + Py_INCREF(pyobj_cbData); + + LIBVIRT_BEGIN_ALLOW_THREADS; + ret = virConnectDomainEventRegisterAny(conn, dom, eventID, + cb, pyobj_cbData, + libvirt_virConnectDomainEventFreeFunc); + LIBVIRT_END_ALLOW_THREADS; + + if (ret < 0) { + Py_DECREF(pyobj_cbData); + } + + py_retval = libvirt_intWrap(ret); + return (py_retval); +} + +static PyObject * +libvirt_virConnectDomainEventDeregisterAny(ATTRIBUTE_UNUSED PyObject * self, + PyObject * args) +{ + PyObject *py_retval; + PyObject *pyobj_conn; + int callbackID; + virConnectPtr conn; + int ret = 0; + + if (!PyArg_ParseTuple + (args, (char *) "Oi:virConnectDomainEventDeregister", + &pyobj_conn, &callbackID)) + return (NULL); + +#ifdef DEBUG_ERROR + printf("libvirt_virConnectDomainEventDeregister(%p) called\n", pyobj_conn); +#endif + + conn = (virConnectPtr) PyvirConnect_Get(pyobj_conn); + + LIBVIRT_BEGIN_ALLOW_THREADS; + + ret = virConnectDomainEventDeregisterAny(conn, callbackID); + + LIBVIRT_END_ALLOW_THREADS; + py_retval = libvirt_intWrap(ret); + return (py_retval); +} + + /************************************************************************ * * * The registration stuff * @@ -2776,6 +3225,8 @@ static PyMethodDef libvirtMethods[] = { {(char *) "virConnectListDefinedDomains", libvirt_virConnectListDefinedDomains, METH_VARARGS, NULL}, {(char *) "virConnectDomainEventRegister", libvirt_virConnectDomainEventRegister, METH_VARARGS, NULL}, {(char *) "virConnectDomainEventDeregister", libvirt_virConnectDomainEventDeregister, METH_VARARGS, NULL}, + {(char *) "virConnectDomainEventRegisterAny", libvirt_virConnectDomainEventRegisterAny, METH_VARARGS, NULL}, + {(char *) "virConnectDomainEventDeregisterAny", libvirt_virConnectDomainEventDeregisterAny, METH_VARARGS, NULL}, {(char *) "virDomainGetInfo", libvirt_virDomainGetInfo, METH_VARARGS, NULL}, {(char *) "virNodeGetInfo", libvirt_virNodeGetInfo, METH_VARARGS, NULL}, {(char *) "virDomainGetUUID", libvirt_virDomainGetUUID, METH_VARARGS, NULL}, -- 1.6.6.1

2 1

[libvirt] [PATCH] Fix CPU comparison for x86 arch
by Jiri Denemark 08 Apr '10

08 Apr '10

When comparing a CPU to host CPU, the result would be VIR_CPU_COMPARE_SUPERSET (or even VIR_CPU_COMPARE_INCOMPATIBLE if strict match was required) even though the two CPUs were identical. --- src/cpu/cpu_x86.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 46a9fbb..205528d 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -963,8 +963,8 @@ x86Compute(virCPUDefPtr host, x86ModelSubtract(diff, cpu_disable); x86ModelSubtract(diff, cpu_force); - for (i = 0; i < host_model->ncpuid; i++) { - if (!x86cpuidMatch(host_model->cpuid + i, &cpuid_zero)) { + for (i = 0; i < diff->ncpuid; i++) { + if (!x86cpuidMatch(diff->cpuid + i, &cpuid_zero)) { ret = VIR_CPU_COMPARE_SUPERSET; break; } -- 1.7.0.4

2 2

[libvirt] [PATCH] Cleanup x86Compute()
by Jiri Denemark 08 Apr '10

08 Apr '10

No change in semantics. --- src/cpu/cpu_x86.c | 46 +++++++++++++++++----------------------------- 1 files changed, 17 insertions(+), 29 deletions(-) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index e49f7c0..46a9fbb 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -901,7 +901,7 @@ x86Compute(virCPUDefPtr host, struct x86_model *guest_model = NULL; virCPUCompareResult ret; enum compare_result result; - int i; + unsigned int i; if (cpu->arch != NULL) { bool found = false; @@ -919,36 +919,15 @@ x86Compute(virCPUDefPtr host, } } - if ((map = x86LoadMap()) == NULL) - goto error; - - if (!(host_model = x86ModelFromCPU(host, map, 0))) - goto error; - - if (!(cpu_force = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORCE))) - goto error; - - if (!(cpu_require = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_REQUIRE))) - goto error; - - if (!(cpu_optional = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_OPTIONAL))) - goto error; - - if (!(cpu_disable = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_DISABLE))) - goto error; - - if (!(cpu_forbid = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORBID))) + if (!(map = x86LoadMap()) || + !(host_model = x86ModelFromCPU(host, map, 0)) || + !(cpu_force = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORCE)) || + !(cpu_require = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_REQUIRE)) || + !(cpu_optional = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_OPTIONAL)) || + !(cpu_disable = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_DISABLE)) || + !(cpu_forbid = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORBID))) goto error; - x86ModelSubtract(cpu_require, cpu_disable); - - if ((diff = x86ModelCopy(host_model)) == NULL) - goto no_memory; - - x86ModelSubtract(diff, cpu_require); - x86ModelSubtract(diff, cpu_optional); - x86ModelSubtract(diff, cpu_force); - for (i = 0; i < cpu_forbid->ncpuid; i++) { const struct cpuX86cpuid *cpuid1; const struct cpuX86cpuid *cpuid2; @@ -966,6 +945,7 @@ x86Compute(virCPUDefPtr host, } } + x86ModelSubtract(cpu_require, cpu_disable); result = x86ModelCompare(host_model, cpu_require); if (result == SUBSET || result == UNRELATED) { VIR_DEBUG0("Host CPU does not provide all required features"); @@ -975,6 +955,14 @@ x86Compute(virCPUDefPtr host, ret = VIR_CPU_COMPARE_IDENTICAL; + if ((diff = x86ModelCopy(host_model)) == NULL) + goto no_memory; + + x86ModelSubtract(diff, cpu_optional); + x86ModelSubtract(diff, cpu_require); + x86ModelSubtract(diff, cpu_disable); + x86ModelSubtract(diff, cpu_force); + for (i = 0; i < host_model->ncpuid; i++) { if (!x86cpuidMatch(host_model->cpuid + i, &cpuid_zero)) { ret = VIR_CPU_COMPARE_SUPERSET; -- 1.7.0.4

2 2

[libvirt] [PATCH] Properly advertise cpuselection guest capability
by Jiri Denemark 08 Apr '10

08 Apr '10

There's no sense in advertising cpuselection capability when host CPU is not properly detected and advertised in host capabilities. --- src/qemu/qemu_conf.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 3fb0074..ff5bd43 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -892,7 +892,8 @@ qemudCapsInitGuest(virCapsPtr caps, guest->arch.defaultInfo.emulator_mtime = binary_mtime; - if (qemudProbeCPUModels(binary, info->arch, &ncpus, NULL) == 0 + if (caps->host.cpu + && qemudProbeCPUModels(binary, info->arch, &ncpus, NULL) == 0 && ncpus > 0 && !virCapabilitiesAddGuestFeature(guest, "cpuselection", 1, 0)) goto error; -- 1.7.0.4

2 4