"Daniel P. Berrange" <berrange@redhat.com> wrote on 03/25/2010 07:09:24 AM:


>
> Please respond to "Daniel P. Berrange"
>
> On Tue, Mar 23, 2010 at 10:54:16AM -0400, stefanb@us.ibm.com wrote:
> > Add support for Qemu to have firewall rules applied and removed on VM
> > startup and shutdown respectively. This  patch also provides support for
> > the updating of a filter that causes all VMs that reference the filter
> > to have their ebtables/iptables rules updated.
> >
> > Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
> >
> > ---
> >  src/qemu/qemu_conf.c   |   29 +++++++++++++++++++++++++++++
> >  src/qemu/qemu_driver.c |   27 +++++++++++++++++++++++++++
> >  2 files changed, 56 insertions(+)
> >
> > Index: libvirt-acl/src/qemu/qemu_driver.c
> > ===================================================================
> > --- libvirt-acl.orig/src/qemu/qemu_driver.c
> > +++ libvirt-acl/src/qemu/qemu_driver.c
> > @@ -83,6 +83,7 @@
> >  #include "xml.h"
> >  #include "cpu/cpu.h"
> >  #include "macvtap.h"
> > +#include "nwfilter/nwfilter_gentech_driver.h"
> >  
> >  
> >  #define VIR_FROM_THIS VIR_FROM_QEMU
> > @@ -3041,6 +3042,13 @@ static void qemudShutdownVMDaemon(struct
> >       * reporting so we don't squash a legit error. */
> >      orig_err = virSaveLastError();
> >  
> > +    def = vm->def;
> > +    for (i = 0 ; i < def->nnets ; i++) {
> > +        virDomainNetDefPtr net = def->nets[i];
> > +        if ((net->filter) && (net->ifname))
> > +            virNWFilterTeardownFilter(net);
> > +    }
> > +
>
> I think we might also need to run this in qemudStartuVMDaemon() in
> the 'cleanup' path taken when virExecDaemonize fails.

Fixed. This and the above now calls a function qemuTearVMNWFilters() which in turn calls qemuTearNWFilter();

>
> >      if (driver->macFilter) {
> >          def = vm->def;
> >          for (i = 0 ; i < def->nnets ; i++) {
> > @@ -7052,6 +7060,9 @@ qemudDomainDetachNetDevice(struct qemud_
> >          }
> >      }
> >  
> > +    if ((detach->ifname) && (detach->filter))
> > +        virNWFilterTeardownFilter(detach);
> > +
> >      if (vm->def->nnets > 1) {
> >          memmove(vm->def->nets + i,
> >                  vm->def->nets + i + 1,
>
> Also might need this in the cleanup path for qemudDomainAttachNetDevice
> when it fails to hotplug

Fixed. This and the above now calls qemuTearNWFilter().

Due to these and other changes I would like to post a 'v4' patch series with an additional patch installing a couple of example filters.

Thanks and regards,
   Stefan

>
> Regards,
> Daniel
> --
> |: Red Hat, Engineering, London    -o-   http://people.redhat.com/berrange/:|
> |: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org:|
> |: http://autobuild.org        -o-         http://search.cpan.org/~danberr/:|
> |: GnuPG: 7D3B9505  -o-   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|