[libvirt] [PATCH] Add V6LOCAL parameter to nwfilter rules.
Currently, adding any sort of IPv6 nwfilter rules is rather difficult. There are no
standard rules,
and you end up doing a lot of things by hand. This patch makes the $V6LOCAL variable
available within
rules. This is the generated from the interface's mac address using the modified
EUI-64 format, which
matches what the guest should be using.
This is part of what information is needed to correctly filter guest IPv6 traffic. Since
this changes
with the MAC address, it is significantly easier if libvirt populates it (rather then
requring the
user to enter it)
---
docs/formatnwfilter.html.in | 9 ++++++---
src/conf/nwfilter_params.h | 1 +
src/nwfilter/nwfilter_gentech_driver.c | 23 +++++++++++++++++++++++
3 files changed, 30 insertions(+), 3 deletions(-)
mode change 100644 => 100755 src/nwfilter/nwfilter_gentech_driver.c
diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in
index 45b97f7..aa1ff9f 100644
--- a/docs/formatnwfilter.html.in
+++ b/docs/formatnwfilter.html.in
@@ -239,9 +239,9 @@
<h3><a name="nwfconceptsvars">Usage of variables in
filters</a></h3>
<p>
- Two variables names have so far been reserved for usage by the
- network traffic filtering subsystem: <code>MAC</code> and
- <code>IP</code>.
+ Three variables names have so far been reserved for usage by the
+ network traffic filtering subsystem: <code>MAC</code>,
+ <code>IP</code>, and <code>V6LOCAL</code>
<br/><br/>
<code>MAC</code> is the MAC address of the
network interface. A filtering rule that references this variable
@@ -251,6 +251,9 @@
parameter similar to the IP parameter above, it is discouraged
since libvirt knows what MAC address an interface will be using.
<br/><br/>
+ <code>V6LOCAL</code> is the computed IPv6 link-local address.
+ This is based on the MAC variable
+ <br/><br/>
The parameter <code>IP</code> represents the IP address
that the operating system inside the virtual machine is expected
to use on the given interface. The <code>IP</code> parameter
diff --git a/src/conf/nwfilter_params.h b/src/conf/nwfilter_params.h
index 5e9777b..f61250f 100644
--- a/src/conf/nwfilter_params.h
+++ b/src/conf/nwfilter_params.h
@@ -98,6 +98,7 @@ bool virNWFilterHashTableEqual(virNWFilterHashTablePtr a,
# define NWFILTER_VARNAME_IP "IP"
# define NWFILTER_VARNAME_MAC "MAC"
+# define NWFILTER_VARNAME_V6LOCAL "V6LOCAL"
# define NWFILTER_VARNAME_CTRL_IP_LEARNING "CTRL_IP_LEARNING"
# define NWFILTER_VARNAME_DHCPSERVER "DHCPSERVER"
diff --git a/src/nwfilter/nwfilter_gentech_driver.c
b/src/nwfilter/nwfilter_gentech_driver.c
old mode 100644
new mode 100755
index 1ce5e70..a86dae8
--- a/src/nwfilter/nwfilter_gentech_driver.c
+++ b/src/nwfilter/nwfilter_gentech_driver.c
@@ -45,6 +45,7 @@ VIR_LOG_INIT("nwfilter.nwfilter_gentech_driver");
#define NWFILTER_STD_VAR_MAC NWFILTER_VARNAME_MAC
#define NWFILTER_STD_VAR_IP NWFILTER_VARNAME_IP
+#define NWFILTER_STD_VAR_V6LOCAL NWFILTER_VARNAME_V6LOCAL
#define NWFILTER_DFLT_LEARN "any"
@@ -163,6 +164,28 @@ virNWFilterVarHashmapAddStdValues(virNWFilterHashTablePtr table,
"%s", _("Could not add variable 'MAC'
to hashmap"));
return -1;
}
+
+ virMacAddr parsedMac;
+ if (virMacAddrParse(macaddr, &parsedMac) == 0)
+ {
+ parsedMac.addr[0] ^= 2;
+
+ char euiMacAddr[26];
+ snprintf(euiMacAddr, sizeof(euiMacAddr),
"fe80::%x%x:%xff:fe%x:%x%x", parsedMac.addr[0], parsedMac.addr[1],
parsedMac.addr[2],
+ parsedMac.addr[3], parsedMac.addr[4], parsedMac.addr[5]);
+
+ val = virNWFilterVarValueCreateSimpleCopyValue(euiMacAddr);
+ if (!val)
+ return -1;
+
+ if (virHashAddEntry(table->hashTable,
+ NWFILTER_STD_VAR_V6LOCAL,
+ val) < 0) {
+ virReportError(VIR_ERR_INTERNAL_ERROR,
+ "%s", _("Could not add variable
'V6LOCAL' to hashmap"));
+ return -1;
+ }
+ }
}
if (ipaddr) {
--
1.7.1