On Thu, Mar 25, 2010 at 10:02:38AM -0400, Stefan Berger wrote:
"Daniel P. Berrange" <berrange@redhat.com> wrote on 03/25/2010 07:09:24 AM:
Please respond to "Daniel P. Berrange"
On Tue, Mar 23, 2010 at 10:54:16AM -0400, stefanb@us.ibm.com wrote:
Add support for Qemu to have firewall rules applied and removed on VM startup and shutdown respectively. This patch also provides support
for
the updating of a filter that causes all VMs that reference the filter to have their ebtables/iptables rules updated.
Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
--- src/qemu/qemu_conf.c | 29 +++++++++++++++++++++++++++++ src/qemu/qemu_driver.c | 27 +++++++++++++++++++++++++++ 2 files changed, 56 insertions(+)
Index: libvirt-acl/src/qemu/qemu_driver.c =================================================================== --- libvirt-acl.orig/src/qemu/qemu_driver.c +++ libvirt-acl/src/qemu/qemu_driver.c @@ -83,6 +83,7 @@ #include "xml.h" #include "cpu/cpu.h" #include "macvtap.h" +#include "nwfilter/nwfilter_gentech_driver.h"
#define VIR_FROM_THIS VIR_FROM_QEMU @@ -3041,6 +3042,13 @@ static void qemudShutdownVMDaemon(struct * reporting so we don't squash a legit error. */ orig_err = virSaveLastError();
+ def = vm->def; + for (i = 0 ; i < def->nnets ; i++) { + virDomainNetDefPtr net = def->nets[i]; + if ((net->filter) && (net->ifname)) + virNWFilterTeardownFilter(net); + } +
I think we might also need to run this in qemudStartuVMDaemon() in the 'cleanup' path taken when virExecDaemonize fails.
Fixed. This and the above now calls a function qemuTearVMNWFilters() which in turn calls qemuTearNWFilter();
if (driver->macFilter) { def = vm->def; for (i = 0 ; i < def->nnets ; i++) { @@ -7052,6 +7060,9 @@ qemudDomainDetachNetDevice(struct qemud_ } }
+ if ((detach->ifname) && (detach->filter)) + virNWFilterTeardownFilter(detach); + if (vm->def->nnets > 1) { memmove(vm->def->nets + i, vm->def->nets + i + 1,
Also might need this in the cleanup path for qemudDomainAttachNetDevice when it fails to hotplug
Fixed. This and the above now calls qemuTearNWFilter().
Due to these and other changes I would like to post a 'v4' patch series with an additional patch installing a couple of example filters.
That's fine with me - BTW, i notice in the nwfilter_conf.c some of the objects are called 'FilterPool' instead of just 'Filter' - is that delibrate, or a cut +paste mistake from copying existing storage_conf.c code. Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|