8:29 a.m.
The qemu_bridge_filter.c file had some helpers for calling
the ebtablesXXX functions todo bridge filtering. The only
thing these helpers did was to overwrite the original error
message from the ebtables code. For added fun, the callers
of these helpers overwrote the errors yet again. For even
more fun, one of the helpers called another helper and
overwrite its errors too.
Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com>
---
src/Makefile.am | 4 +-
src/qemu/qemu_bridge_filter.c | 104 ------------------------------------------
src/qemu/qemu_bridge_filter.h | 37 ---------------
src/qemu/qemu_command.c | 11 ++---
src/qemu/qemu_conf.c | 1 -
src/qemu/qemu_driver.c | 7 +--
src/qemu/qemu_hotplug.c | 11 ++---
src/qemu/qemu_process.c | 10 ++--
8 files changed, 12 insertions(+), 173 deletions(-)
delete mode 100644 src/qemu/qemu_bridge_filter.c
delete mode 100644 src/qemu/qemu_bridge_filter.h
diff --git a/src/Makefile.am b/src/Makefile.am
index 25d0370..1708eb7 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -687,9 +687,7 @@ QEMU_DRIVER_SOURCES = \
qemu/qemu_monitor_text.h \
qemu/qemu_monitor_json.c \
qemu/qemu_monitor_json.h \
- qemu/qemu_driver.c qemu/qemu_driver.h \
- qemu/qemu_bridge_filter.c \
- qemu/qemu_bridge_filter.h
+ qemu/qemu_driver.c qemu/qemu_driver.h
XENAPI_DRIVER_SOURCES = \
xenapi/xenapi_driver.c xenapi/xenapi_driver.h \
diff --git a/src/qemu/qemu_bridge_filter.c b/src/qemu/qemu_bridge_filter.c
deleted file mode 100644
index 49954c6..0000000
--- a/src/qemu/qemu_bridge_filter.c
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright (C) 2007-2009, 2013 Red Hat, Inc.
- * Copyright (C) 2009 IBM Corp.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library. If not, see
- * <http://www.gnu.org/licenses/>;.
- *
- * Authors:
- * Gerhard Stenzel <gerhard.stenzel(a)de.ibm.com>
- */
-
-#include <config.h>
-
-#include "virebtables.h"
-#include "qemu_conf.h"
-#include "qemu_driver.h"
-#include "virerror.h"
-#include "virlog.h"
-
-#include "qemu_bridge_filter.h"
-
-#define VIR_FROM_THIS VIR_FROM_QEMU
-
-int
-networkAddEbtablesRules(virQEMUDriverPtr driver) {
- int err;
-
- /* Set forward policy to DROP */
- if ((err = ebtablesAddForwardPolicyReject(driver->ebtables))) {
- virReportSystemError(err,
- _("failed to add ebtables rule to set default policy to drop on
'%s'"),
- __FILE__);
- return err;
- }
-
- return 0;
-}
-
-
-int
-networkDisableAllFrames(virQEMUDriverPtr driver) {
- int err;
-
- /* add default rules */
- if ((err = networkAddEbtablesRules(driver))) {
- virReportSystemError(err,
- _("cannot filter mac addresses on bridge
'%s'"),
- __FILE__);
- return err;
- }
- return 0;
-}
-
-int
-networkAllowMacOnPort(virQEMUDriverPtr driver,
- const char * ifname,
- const virMacAddr *mac)
-{
- int err;
-
- /* allow this combination of macaddr and ifname */
- ebtablesContext * ebtablescontext = driver->ebtables;
- if ((err = ebtablesAddForwardAllowIn(ebtablescontext,
- ifname,
- mac))) {
- virReportSystemError(err,
- _("failed to add ebtables rule to allow routing to
'%s'"),
- ifname);
- }
-
- return 0;
-}
-
-
-int
-networkDisallowMacOnPort(virQEMUDriverPtr driver,
- const char * ifname,
- const virMacAddr *mac)
-{
- int err;
-
- /* disallow this combination of macaddr and ifname */
- ebtablesContext * ebtablescontext = driver->ebtables;
- if ((err = ebtablesRemoveForwardAllowIn(ebtablescontext,
- ifname,
- mac))) {
- virReportSystemError(err,
- _("failed to add ebtables rule to allow routing to
'%s'"),
- ifname);
- }
-
- return 0;
-}
diff --git a/src/qemu/qemu_bridge_filter.h b/src/qemu/qemu_bridge_filter.h
deleted file mode 100644
index bacced8..0000000
--- a/src/qemu/qemu_bridge_filter.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (C) 2007-2009, 2013 Red Hat, Inc.
- * Copyright (C) 2009 IBM Corp.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library. If not, see
- * <http://www.gnu.org/licenses/>;.
- *
- * Authors:
- * Gerhard Stenzel <gerhard.stenzel(a)de.ibm.com>
- */
-
-#ifndef __QEMUD_BRIDGE_FILTER_H__
-# define __QEMUD_BRIDGE_FILTER_H__
-
-
-int networkAllowMacOnPort(virQEMUDriverPtr driver,
- const char *ifname,
- const virMacAddr *mac);
-int networkDisallowMacOnPort(virQEMUDriverPtr driver,
- const char *ifname,
- const virMacAddr *mac);
-int networkDisableAllFrames(virQEMUDriverPtr driver);
-int networkAddEbtablesRules(virQEMUDriverPtr driver);
-
-
-#endif /* __QEMUD_BRIDGE_FILTER_H__ */
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 775e139..dbb8499 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -26,7 +26,6 @@
#include "qemu_command.h"
#include "qemu_hostdev.h"
#include "qemu_capabilities.h"
-#include "qemu_bridge_filter.h"
#include "cpu/cpu.h"
#include "dirname.h"
#include "passfd.h"
@@ -380,12 +379,10 @@ qemuNetworkIfaceConnect(virDomainDefPtr def,
virDomainAuditNetDevice(def, net, "/dev/net/tun", true);
if (cfg->macFilter &&
- (ret = networkAllowMacOnPort(driver, net->ifname, &net->mac)) < 0)
{
- virReportSystemError(ret,
- _("failed to add ebtables rule "
- "to allow MAC address on '%s'"),
- net->ifname);
- }
+ ebtablesAddForwardAllowIn(driver->ebtables,
+ net->ifname,
+ &net->mac) < 0)
+ goto cleanup;
if (virNetDevBandwidthSet(net->ifname,
virDomainNetGetActualBandwidth(net),
diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
index 20fd62d..bdba7d4 100644
--- a/src/qemu/qemu_conf.c
+++ b/src/qemu/qemu_conf.c
@@ -38,7 +38,6 @@
#include "qemu_conf.h"
#include "qemu_command.h"
#include "qemu_capabilities.h"
-#include "qemu_bridge_filter.h"
#include "viruuid.h"
#include "virbuffer.h"
#include "virconf.h"
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 8a54b8a..2a1adec 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -53,7 +53,6 @@
#include "qemu_hostdev.h"
#include "qemu_hotplug.h"
#include "qemu_monitor.h"
-#include "qemu_bridge_filter.h"
#include "qemu_process.h"
#include "qemu_migration.h"
@@ -663,12 +662,8 @@ qemuStateInitialize(bool privileged,
goto error;
}
- if ((errno = networkDisableAllFrames(qemu_driver))) {
- virReportSystemError(errno,
- _("failed to add rule to drop all frames in
'%s'"),
- __FILE__);
+ if (ebtablesAddForwardPolicyReject(qemu_driver->ebtables) < 0)
goto error;
- }
}
/* Allocate bitmap for remote display port reservations. We cannot
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 6703c92..47996da 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -29,7 +29,6 @@
#include "qemu_capabilities.h"
#include "qemu_domain.h"
#include "qemu_command.h"
-#include "qemu_bridge_filter.h"
#include "qemu_hostdev.h"
#include "domain_audit.h"
#include "domain_nwfilter.h"
@@ -2702,13 +2701,9 @@ qemuDomainRemoveNetDevice(virQEMUDriverPtr driver,
}
if (cfg->macFilter && (net->ifname != NULL)) {
- if ((errno = networkDisallowMacOnPort(driver,
- net->ifname,
- &net->mac))) {
- virReportSystemError(errno,
- _("failed to remove ebtables rule on '%s'"),
- net->ifname);
- }
+ ignore_value(ebtablesRemoveForwardAllowIn(driver->ebtables,
+ net->ifname,
+ &net->mac));
}
vport = virDomainNetGetActualVirtPortProfile(net);
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index ffa939a..1f00840 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -41,7 +41,6 @@
#include "qemu_command.h"
#include "qemu_hostdev.h"
#include "qemu_hotplug.h"
-#include "qemu_bridge_filter.h"
#include "qemu_migration.h"
#include "cpu/cpu.h"
@@ -4280,12 +4279,9 @@ void qemuProcessStop(virQEMUDriverPtr driver,
virDomainNetDefPtr net = def->nets[i];
if (net->ifname == NULL)
continue;
- if ((errno = networkDisallowMacOnPort(driver, net->ifname,
- &net->mac))) {
- virReportSystemError(errno,
- _("failed to remove ebtables rule to allow MAC address on
'%s'"),
- net->ifname);
- }
+ ignore_value(ebtablesRemoveForwardAllowIn(driver->ebtables,
+ net->ifname,
+ &net->mac));
}
}
--
1.8.5.3