[libvirt] [PATCH 19/26] Convert nwfilter ebiptablesTearNewRules to virFirewall

Convert the nwfilter ebiptablesTearNewRules method to use the virFirewall object APIs instead of creating shell scripts using virBuffer APIs. This provides a performance improvement through allowing direct use of firewalld dbus APIs and will facilitate automated testing. --- src/nwfilter/nwfilter_ebiptables_driver.c | 88 ++++++++++++++++++++++--------- tests/nwfilterebiptablestest.c | 65 +++++++++++++++++++++++ 2 files changed, 128 insertions(+), 25 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 7740960..4093bd9 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -707,6 +707,18 @@ iptablesRemoveTmpRootChain(virBufferPtr buf, static void +iptablesRemoveTmpRootChainFW(virFirewallPtr fw, + virFirewallLayer layer, + char prefix, + bool incoming, + const char *ifname) +{ + _iptablesRemoveRootChainFW(fw, layer, prefix, + incoming, ifname, 1); +} + + +static void iptablesRemoveTmpRootChains(virBufferPtr buf, const char *ifname) { @@ -717,6 +729,17 @@ iptablesRemoveTmpRootChains(virBufferPtr buf, static void +iptablesRemoveTmpRootChainsFW(virFirewallPtr fw, + virFirewallLayer layer, + const char *ifname) +{ + iptablesRemoveTmpRootChainFW(fw, layer, 'F', false, ifname); + iptablesRemoveTmpRootChainFW(fw, layer, 'F', true, ifname); + iptablesRemoveTmpRootChainFW(fw, layer, 'H', true, ifname); +} + + +static void iptablesRemoveRootChainsFW(virFirewallPtr fw, virFirewallLayer layer, const char *ifname) @@ -914,6 +937,18 @@ iptablesUnlinkTmpRootChain(virBufferPtr buf, static void +iptablesUnlinkTmpRootChainFW(virFirewallPtr fw, + virFirewallLayer layer, + const char *basechain, + char prefix, + bool incoming, const char *ifname) +{ + _iptablesUnlinkRootChainFW(fw, layer, + basechain, prefix, incoming, ifname, 1); +} + + +static void iptablesUnlinkRootChainsFW(virFirewallPtr fw, virFirewallLayer layer, const char *ifname) @@ -935,6 +970,17 @@ iptablesUnlinkTmpRootChains(virBufferPtr buf, static void +iptablesUnlinkTmpRootChainsFW(virFirewallPtr fw, + virFirewallLayer layer, + const char *ifname) +{ + iptablesUnlinkTmpRootChainFW(fw, layer, VIRT_OUT_CHAIN, 'F', false, ifname); + iptablesUnlinkTmpRootChainFW(fw, layer, VIRT_IN_CHAIN, 'F', true, ifname); + iptablesUnlinkTmpRootChainFW(fw, layer, HOST_IN_CHAIN, 'H', true, ifname); +} + + +static void iptablesRenameTmpRootChainFW(virFirewallPtr fw, virFirewallLayer layer, char prefix, @@ -4236,36 +4282,28 @@ ebiptablesApplyNewRules(const char *ifname, static int ebiptablesTearNewRules(const char *ifname) { - virBuffer buf = VIR_BUFFER_INITIALIZER; - - if (iptables_cmd_path) { - NWFILTER_SET_IPTABLES_SHELLVAR(&buf); - - iptablesUnlinkTmpRootChains(&buf, ifname); - iptablesRemoveTmpRootChains(&buf, ifname); - } - - if (ip6tables_cmd_path) { - NWFILTER_SET_IP6TABLES_SHELLVAR(&buf); + virFirewallPtr fw = virFirewallNew(); + int ret = -1; - iptablesUnlinkTmpRootChains(&buf, ifname); - iptablesRemoveTmpRootChains(&buf, ifname); - } + virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); - if (ebtables_cmd_path) { - NWFILTER_SET_EBTABLES_SHELLVAR(&buf); + iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); + iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); - ebtablesUnlinkTmpRootChain(&buf, true, ifname); - ebtablesUnlinkTmpRootChain(&buf, false, ifname); + iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV6, ifname); + iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV6, ifname); - ebtablesRemoveTmpSubChains(&buf, ifname); - ebtablesRemoveTmpRootChain(&buf, true, ifname); - ebtablesRemoveTmpRootChain(&buf, false, ifname); - } - - ebiptablesExecCLI(&buf, true, NULL); + ebtablesUnlinkTmpRootChainFW(fw, true, ifname); + ebtablesUnlinkTmpRootChainFW(fw, false, ifname); + ebtablesRemoveTmpSubChainsFW(fw, ifname); + ebtablesRemoveTmpRootChainFW(fw, true, ifname); + ebtablesRemoveTmpRootChainFW(fw, false, ifname); - return 0; + virMutexLock(&execCLIMutex); + ret = virFirewallApply(fw); + virMutexUnlock(&execCLIMutex); + virFirewallFree(fw); + return ret; } diff --git a/tests/nwfilterebiptablestest.c b/tests/nwfilterebiptablestest.c index 11b7fb5..d728e4c 100644 --- a/tests/nwfilterebiptablestest.c +++ b/tests/nwfilterebiptablestest.c @@ -211,6 +211,66 @@ testNWFilterEBIPTablesRemoveBasicRules(const void *opaque ATTRIBUTE_UNUSED) static int +testNWFilterEBIPTablesTearNewRules(const void *opaque ATTRIBUTE_UNUSED) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + const char *expected = + "/usr/sbin/iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" + "/usr/sbin/iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" + "/usr/sbin/iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" + "/usr/sbin/iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" + "/usr/sbin/iptables -F FP-vnet0\n" + "/usr/sbin/iptables -X FP-vnet0\n" + "/usr/sbin/iptables -F FJ-vnet0\n" + "/usr/sbin/iptables -X FJ-vnet0\n" + "/usr/sbin/iptables -F HJ-vnet0\n" + "/usr/sbin/iptables -X HJ-vnet0\n" + "/usr/sbin/ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" + "/usr/sbin/ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" + "/usr/sbin/ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" + "/usr/sbin/ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" + "/usr/sbin/ip6tables -F FP-vnet0\n" + "/usr/sbin/ip6tables -X FP-vnet0\n" + "/usr/sbin/ip6tables -F FJ-vnet0\n" + "/usr/sbin/ip6tables -X FJ-vnet0\n" + "/usr/sbin/ip6tables -F HJ-vnet0\n" + "/usr/sbin/ip6tables -X HJ-vnet0\n" + "/usr/sbin/ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" + "/usr/sbin/ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" + "/usr/sbin/ebtables -t nat -L libvirt-J-vnet0\n" + "/usr/sbin/ebtables -t nat -L libvirt-P-vnet0\n" + "/usr/sbin/ebtables -t nat -F libvirt-J-vnet0\n" + "/usr/sbin/ebtables -t nat -X libvirt-J-vnet0\n" + "/usr/sbin/ebtables -t nat -F libvirt-P-vnet0\n" + "/usr/sbin/ebtables -t nat -X libvirt-P-vnet0\n"; + + const char *actual = NULL; + int ret = -1; + + virCommandSetDryRun(&buf, NULL, NULL); + + if (ebiptables_driver.tearNewRules("vnet0") < 0) + goto cleanup; + + if (virBufferError(&buf)) + goto cleanup; + + actual = virBufferCurrentContent(&buf); + + if (STRNEQ_NULLABLE(actual, expected)) { + virtTestDifference(stderr, actual, expected); + goto cleanup; + } + + ret = 0; + cleanup: + virCommandSetDryRun(NULL, NULL, NULL); + virBufferFreeAndReset(&buf); + return ret; +} + + +static int mymain(void) { int ret = 0; @@ -235,6 +295,11 @@ mymain(void) NULL) < 0) ret = -1; + if (virtTestRun("ebiptablesTearNewRules", + testNWFilterEBIPTablesTearNewRules, + NULL) < 0) + ret = -1; + cleanup: return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; } -- 1.9.0