On 2013年03月18日 14:54, hongming wrote: Can you shorten the patch subject? And add the sentences in the commit log instead?

> --- > cases/nwfilter.conf | 59 +++++++++++++++++ > repos/nwfilter/nwfilter_check.py | 120 > +++++++++++++++++++++++++++++++++++ > repos/nwfilter/nwfilter_define.py | 54 ++++++++++++++++ > repos/nwfilter/nwfilter_list.py | 76 ++++++++++++++++++++++ > repos/nwfilter/nwfilter_undefine.py | 43 +++++++++++++ > repos/nwfilter/xmls/nwfilter.xml | 3 + > 6 files changed, 355 insertions(+), 0 deletions(-) > create mode 100644 cases/nwfilter.conf > create mode 100644 repos/nwfilter/__init__.py > create mode 100644 repos/nwfilter/nwfilter_check.py > create mode 100644 repos/nwfilter/nwfilter_define.py > create mode 100644 repos/nwfilter/nwfilter_list.py > create mode 100644 repos/nwfilter/nwfilter_undefine.py > create mode 100644 repos/nwfilter/xmls/nwfilter.xml > > diff --git a/cases/nwfilter.conf b/cases/nwfilter.conf > new file mode 100644 > index 0000000..b394ee5 > --- /dev/null > +++ b/cases/nwfilter.conf > @@ -0,0 +1,59 @@ > +domain:install_linux_cdrom > + guestname > + $defaultname > + guestos > + $defaultos > + guestarch > + $defaultarch > + vcpu > + $defaultvcpu > + memory > + $defaultmem > + hddriver > + $defaulthd > + nicdriver > + $defaultnic > + imageformat > + qcow2 > + macaddr > + 54:52:00:4a:16:30 > + > +nwfilter:nwfilter_list > + > +# chain -- ipv4, ipv6, arp .etc > +# action -- mandatory; drop, accept, return > +# direction -- mandatory; must either be in, out or inout > +nwfilter:nwfilter_define > + nwfiltername > + disallow-arp > + chain > + arp > + action > + drop > + direction > + inout > + > +nwfilter:nwfilter_list > + > +nwfilter:nwfilter_check > + nwfiltername > + disallow-arp > + guestname > + $defaultname > + > +nwfilter:nwfilter_define > + nwfiltername > + disallow-ipv6 > + chain > + ipv6 > + action > + drop > + direction > + in > + > +nwfilter:nwfilter_undefine > + nwfiltername > + disallow-ipv6 > + > +nwfilter:nwfilter_list > + > diff --git a/repos/nwfilter/__init__.py b/repos/nwfilter/__init__.py > new file mode 100644 > index 0000000..e69de29 > diff --git a/repos/nwfilter/nwfilter_check.py > b/repos/nwfilter/nwfilter_check.py > new file mode 100644 > index 0000000..b2c7ece > --- /dev/null > +++ b/repos/nwfilter/nwfilter_check.py > @@ -0,0 +1,120 @@ > +#!/usr/bin/env python > +import time > +import xml.dom.minidom > + > +from libvirt import libvirtError > +from utils import utils > +from xml.dom import minidom > + > +from src import sharedmod > + > +required_params = ('nwfiltername','guestname',) > +optional_params = {} > + > +EBTABLES = "ebtables -t nat -L" > + > +def get_ebtables(): > + """ Get the output of ebtables """ > + (status, output) = utils.exec_cmd(EBTABLES,shell=True) > + logger.info("Execute command:" + EBTABLES) > + ebtables_list = [] > + > + if status: > + logger.error("Executing " + EBTABLES + " failed") > + logger.error(output) > + return False > + else: > + for i in range(len(output)): > + ebtables_list.append(output[i]) > + logger.info("Get the output of ebtables list: %s" \ > + % ebtables_list) > + > + return ebtables_list > + > +def check_ebtables(*args): > + """ Check the ebtables """ > + (nwfiltername,conn)= args > + ebtables_list = get_ebtables() > + > + #Get the filter' attribute value > + nwfilter_xml = conn.nwfilterLookupByName(nwfiltername).XMLDesc(0) > + nwfilter_parsedxml = minidom.parseString(nwfilter_xml) > + chain = nwfilter_parsedxml.getElementsByTagName("filter")[0].\ > + getAttribute("chain") > + rule = nwfilter_parsedxml.getElementsByTagName("rule")[0] > + action = rule.getAttribute("action").upper() > + direction = rule.getAttribute("direction") > + logger.info("The nwfilter chain:%s ,action:%s ,direction:%s " %\ > + (chain,action,direction) ) > + in_vnet_chain = "I-vnet0-" + chain > + out_vnet_chain = "O-vnet0-" + chain > + > + if cmp(direction,"inout") == 0 : > + if len(ebtables_list) == 21 and in_vnet_chain in > ebtables_list[-5]\ > + and out_vnet_chain in ebtables_list[-2] \ > + and action in ebtables_list[-1] \ > + and action in ebtables_list[-4]: > + return True > + else: > + return False > + elif cmp(direction,"in") == 0: > + if len(ebtables_list) == 14 and out_vnet_chain in > ebtables_list[-2]\ > + and action in ebtables_list[-1]: > + return True > + else: > + return False > + > + elif cmp(direction,"out") == 0: > + if len(ebtables_list) == 14 and in_vnet_chain in > ebtables_list[-2] \ > + and action in ebtables_list[-1]: > + return True > + else: > + return False > + > +def nwfilter_check(params): > + """Check the nwfilter via checking ebtales""" > + global logger > + logger = params['logger'] > + nwfiltername = params['nwfiltername'] > + guestname = params['guestname'] > + domain_nwfilter_xml = "" > + > + conn = sharedmod.libvirtobj['conn'] > + domobj = conn.lookupByName(guestname) > + > + try: > + > + #Create the nwfilter's element and append it to domain xml > + domxml = domobj.XMLDesc(0) > + domain_parsedxml = minidom.parseString(domxml) > + domain_ifxml = > domain_parsedxml.getElementsByTagName("interface") > + filterxml = domain_parsedxml.createElement("filterref") > + filterxml.setAttribute("filter", nwfiltername) > + domain_ifxml[0].appendChild(filterxml) > + > + #Destroy the domain and redefine it with nwfilter > + domobj.destroy() > + time.sleep(5) > + domobj.undefine() > + > + #Define the new domain with the nwfilter > + dom_nwfilter = conn.defineXML(domain_parsedxml.toxml()) > + logger.debug("The xml of new defined domain with nwfilter > %s" % \ > + dom_nwfilter.XMLDesc(0)) > + > + #Start the new defined domain > + dom_nwfilter.create() > + time.sleep(5) > + > + if check_ebtables(nwfiltername,conn): > + logger.info("Successfully create nwfilter") > + return 0 > + else: > + logger.error("Failed to create nwfilter") > + return 1 > + > + except libvirtError, e: > + logger.error("API error message: %s" % e.message) > + return 1 > + > + return 0 > \ No newline at end of file > diff --git a/repos/nwfilter/nwfilter_define.py > b/repos/nwfilter/nwfilter_define.py > new file mode 100644 > index 0000000..e20fd2d > --- /dev/null > +++ b/repos/nwfilter/nwfilter_define.py > @@ -0,0 +1,54 @@ > +#! /usr/bin/env python > + > + > + > +from libvirt import libvirtError > +from src import sharedmod > + > + > +required_params = ('nwfiltername','chain','action','direction') > +optional_params = {'xml' : 'xmls/nwfilter.xml',} > + > +def nwfilter_define(params): > + """ Define network filters.""" > + logger = params['logger'] > + conn = sharedmod.libvirtobj['conn'] > + xmlstr = params['xml'] > + nwfiltername = params['nwfiltername'] > + chain = params['chain'] > + action = params['action'] > + direction = params['direction'] > + > + > + xmlstr = xmlstr.replace('NWFILTERNAME', nwfiltername) > + xmlstr = xmlstr.replace('CHAIN', chain) > + xmlstr = xmlstr.replace('ACTION', action) > + xmlstr = xmlstr.replace('DIRECTION', direction) > + try: > + logger.info("nwfiltername:%s chain:%s action:%s > direction:%s" % \ > + (nwfiltername,chain,action,direction)) > + logger.info("The nwfilter's xml is %s" % xmlstr) > + > + #Define the nwfilter with given attribute value from > nwfilter.conf""" > + conn.nwfilterDefineXML(xmlstr) > + nwfilterxml = > conn.nwfilterLookupByName(nwfiltername).XMLDesc(0) > + > + if nwfiltername in conn.listNWFilters(): > + logger.info("The nwfilter list includes the defined > nwfilter") > + if cmp(xmlstr,nwfilterxml): > + logger.info("Successfully define the nwfilter %s" % \ > + nwfiltername) > + return 0 > + else: > + logger.error("Fail to define the nwfilter %s" % > nwfiltername) > + return 1 > + else: > + logger.error("Failed,nwfilter list doesn't include the > defined \ > + nwfilter") > + return 1 > + > + except libvirtError, e: > + logger.error("API error message: %s" % e.message) > + return 1 > + > + return 0 > \ No newline at end of file > diff --git a/repos/nwfilter/nwfilter_list.py > b/repos/nwfilter/nwfilter_list.py > new file mode 100644 > index 0000000..056ee1f > --- /dev/null > +++ b/repos/nwfilter/nwfilter_list.py > @@ -0,0 +1,76 @@ > +#!/usr/bin/env python > + > +from libvirt import libvirtError > +from utils import utils > + > +from src import sharedmod > + > +required_params = () > +optional_params = {} > + > +NWFILTER_LIST_API_DIR = "ls /etc/libvirt/nwfilter" > + > +def get_nwfilterlist_dir(): > + """ Get the nwfilter list from dir """ > + > + (status, output) = utils.exec_cmd(NWFILTER_LIST_API_DIR,shell=True) > + logger.info("Execute command:" + NWFILTER_LIST_API_DIR) > + nwfilter_list_api_dir = [] > + if status: > + logger.error("Executing " + NWFILTER_LIST_API_DIR + " failed") > + logger.error(output) > + return False > + else: > + for i in range(len(output)): > + nwfilter_list_api_dir.append(output[i][:-4]) > + logger.info("Get nwfilters name list under dir: %s" \ > + % nwfilter_list_api_dir) > + return nwfilter_list_api_dir > + > +def nwfilter_list(params): > + """ List all of the available network filters.""" > + global logger > + logger = params['logger'] > + conn = sharedmod.libvirtobj['conn'] > + > + try: > + #Get the nwfilter name list from API """ > + nwfilter_namelist_api = conn.listNWFilters() > + > + #Get the nwfilter object list > + nwfilter_list_api = conn.listAllNWFilters(0) > + logger.info("The connection URI %s" % \ > + nwfilter_list_api[0].connect().getURI()) > + > + #Get the number of nwfilters from API > + nwfilter_num = conn.numOfNWFilters() > + > + nwfilter_list_dir = get_nwfilterlist_dir() > + if nwfilter_num == len(nwfilter_list_api) and \ > + len(nwfilter_list_api) == len(nwfilter_list_dir) and \ > + cmp(nwfilter_namelist_api,nwfilter_list_dir): > + logger.info("The number of available network filters is > %s" % \ > + nwfilter_num) > + else: > + logger.error("Failed to get the nwfilters list") > + return 1 > + > + for nwfilter_item in nwfilter_list_api: > + if nwfilter_item.name()in nwfilter_list_dir and \ > + nwfilter_item.name()in nwfilter_namelist_api: > + logger.info("The name is %s" % nwfilter_item.name()) > + else: > + logger.error("Failed to get nwfilter's name.") > + return 1 > + if > cmp(str(nwfilter_item.UUID()),nwfilter_item.UUIDString()): > + logger.info("The UUID is %s" % > nwfilter_item.UUIDString()) > + else: > + logger.error("Failed to get nwfilter's uuid.") > + return 1 > + > + > + except libvirtError, e: > + logger.error("API error message: %s" % e.message) > + return 1 > + > + return 0 > \ No newline at end of file > diff --git a/repos/nwfilter/nwfilter_undefine.py > b/repos/nwfilter/nwfilter_undefine.py > new file mode 100644 > index 0000000..b9ea332 > --- /dev/null > +++ b/repos/nwfilter/nwfilter_undefine.py > @@ -0,0 +1,43 @@ > +#!/usr/bin/env python > + > +from libvirt import libvirtError > + > +from src import sharedmod > + > +required_params = ('nwfiltername',) > +optional_params = {} > + > +def nwfilter_undefine(params): > + """Undefine the specified nwfilter""" > + logger = params['logger'] > + nwfiltername = params['nwfiltername'] > + conn = sharedmod.libvirtobj['conn'] > + > + try: > + nwfilter = conn.nwfilterLookupByName(nwfiltername) > + uuidstr = nwfilter.UUIDString() > + uuid = nwfilter.UUID() > + # Lookup by nwfilter's uuid string > + nwfilter_uuidstr = conn.nwfilterLookupByUUIDString(uuidstr) > + # Lookup by nwfilter's uuid > + nwfilter_uuid = conn.nwfilterLookupByUUID(uuid) > + > + # Check if the nwfilter lookup by name/uuid/uuidstr is the > same one > + if cmp(nwfilter,nwfilter_uuidstr) and cmp(nwfilter_uuidstr,\ > + nwfilter_uuid): > + # Undefine the nwfilter > + nwfilter.undefine() > + # Check if the nwfiler list includes the undefined > nwfilter > + if nwfiltername not in conn.listNWFilters(): > + logger.info("Successfully undefine the nwfilter %s" > % \ > + nwfiltername) > + return 0 > + else: > + logger.error("Failed to undefine the nwfilter %s" % > nwfiltername) > + return 1 > + > + except libvirtError, e: > + logger.error("API error message: %s" % e.message) > + return 1 > + > + return 0 > diff --git a/repos/nwfilter/xmls/nwfilter.xml > b/repos/nwfilter/xmls/nwfilter.xml > new file mode 100644 > index 0000000..6d52d5d > --- /dev/null > +++ b/repos/nwfilter/xmls/nwfilter.xml > @@ -0,0 +1,3 @@ > +<filter name='NWFILTERNAME' chain='CHAIN'> > +<rule action='ACTION' direction='DIRECTION' priority='500'/> > +</filter>