iptablesContext holds only 4 pairs of iptables (table, chain) and there's no need to pass it around. This is a first step towards separating bridge_driver.c in platform-specific parts. --- src/libvirt_private.syms | 2 - src/network/bridge_driver.c | 253 +++++++++++++++++-------------------------- src/util/viriptables.c | 257 +++++++++++--------------------------------- src/util/viriptables.h | 65 ++++------- 4 files changed, 183 insertions(+), 394 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 795e011..062c7fb 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1417,8 +1417,6 @@ iptablesAddForwardRejectOut; iptablesAddOutputFixUdpChecksum; iptablesAddTcpInput; iptablesAddUdpInput; -iptablesContextFree; -iptablesContextNew; iptablesRemoveForwardAllowCross; iptablesRemoveForwardAllowIn; iptablesRemoveForwardAllowOut; diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 2cf49bb..062ec85 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -75,7 +75,6 @@ struct network_driver { virNetworkObjList networks; - iptablesContext *iptables; char *networkConfigDir; char *networkAutostartDir; char *stateDir; @@ -106,8 +105,7 @@ static int networkShutdownNetwork(struct network_driver *driver, static int networkStartNetworkVirtual(struct network_driver *driver, virNetworkObjPtr network); -static int networkShutdownNetworkVirtual(struct network_driver *driver, - virNetworkObjPtr network); +static int networkShutdownNetworkVirtual(virNetworkObjPtr network); static int networkStartNetworkExternal(struct network_driver *driver, virNetworkObjPtr network); @@ -420,10 +418,6 @@ networkStateInitialize(bool privileged, } } - if (!(driverState->iptables = iptablesContextNew())) { - goto out_of_memory; - } - /* if this fails now, it will be retried later with dnsmasqCapsRefresh() */ driverState->dnsmasqCaps = dnsmasqCapsNewFromBinary(DNSMASQ); @@ -531,9 +525,6 @@ networkStateCleanup(void) { VIR_FREE(driverState->dnsmasqStateDir); VIR_FREE(driverState->radvdStateDir); - if (driverState->iptables) - iptablesContextFree(driverState->iptables); - virObjectUnref(driverState->dnsmasqCaps); networkDriverUnlock(driverState); @@ -1544,8 +1535,7 @@ networkRefreshDaemons(struct network_driver *driver) } static int -networkAddMasqueradingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkAddMasqueradingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); @@ -1559,8 +1549,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } /* allow forwarding packets from the bridge interface */ - if (iptablesAddForwardAllowOut(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1573,8 +1562,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, /* allow forwarding packets to the bridge interface if they are * part of an existing connection */ - if (iptablesAddForwardAllowRelatedIn(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowRelatedIn(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1608,8 +1596,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, */ /* First the generic masquerade rule for other protocols */ - if (iptablesAddForwardMasquerade(driver->iptables, - &ipdef->address, + if (iptablesAddForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, @@ -1626,8 +1613,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } /* UDP with a source port restriction */ - if (iptablesAddForwardMasquerade(driver->iptables, - &ipdef->address, + if (iptablesAddForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, @@ -1644,8 +1630,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } /* TCP with a source port restriction */ - if (iptablesAddForwardMasquerade(driver->iptables, - &ipdef->address, + if (iptablesAddForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, @@ -1664,30 +1649,26 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, return 0; masqerr5: - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, "udp"); masqerr4: - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, NULL); masqerr3: - iptablesRemoveForwardAllowRelatedIn(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowRelatedIn(&ipdef->address, prefix, network->def->bridge, forwardIf); masqerr2: - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1696,43 +1677,37 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } static void -networkRemoveMasqueradingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkRemoveMasqueradingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); const char *forwardIf = virNetworkDefForwardIf(network->def, 0); if (prefix >= 0) { - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, "tcp"); - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, "udp"); - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, NULL); - iptablesRemoveForwardAllowRelatedIn(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowRelatedIn(&ipdef->address, prefix, network->def->bridge, forwardIf); - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1740,8 +1715,7 @@ networkRemoveMasqueradingIptablesRules(struct network_driver *driver, } static int -networkAddRoutingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkAddRoutingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); @@ -1755,8 +1729,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver, } /* allow routing packets from the bridge interface */ - if (iptablesAddForwardAllowOut(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1767,8 +1740,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver, } /* allow routing packets to the bridge interface */ - if (iptablesAddForwardAllowIn(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowIn(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1781,8 +1753,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver, return 0; routeerr2: - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1791,22 +1762,19 @@ routeerr1: } static void -networkRemoveRoutingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkRemoveRoutingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); const char *forwardIf = virNetworkDefForwardIf(network->def, 0); if (prefix >= 0) { - iptablesRemoveForwardAllowIn(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowIn(&ipdef->address, prefix, network->def->bridge, forwardIf); - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1819,8 +1787,7 @@ networkRemoveRoutingIptablesRules(struct network_driver *driver, * If any IPv6 addresses are defined, then add the rules for regular operation. */ static int -networkAddGeneralIp6tablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkAddGeneralIp6tablesRules(virNetworkObjPtr network) { if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && @@ -1830,16 +1797,14 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, /* Catch all rules to block forwarding to/from bridges */ - if (iptablesAddForwardRejectOut(driver->iptables, AF_INET6, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectOut(AF_INET6, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to block outbound traffic from '%s'"), network->def->bridge); goto err1; } - if (iptablesAddForwardRejectIn(driver->iptables, AF_INET6, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectIn(AF_INET6, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to block inbound traffic to '%s'"), network->def->bridge); @@ -1847,8 +1812,7 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, } /* Allow traffic between guests on the same bridge */ - if (iptablesAddForwardAllowCross(driver->iptables, AF_INET6, - network->def->bridge) < 0) { + if (iptablesAddForwardAllowCross(AF_INET6, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow cross bridge traffic on '%s'"), network->def->bridge); @@ -1860,24 +1824,21 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, return 0; /* allow DNS over IPv6 */ - if (iptablesAddTcpInput(driver->iptables, AF_INET6, - network->def->bridge, 53) < 0) { + if (iptablesAddTcpInput(AF_INET6, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow DNS requests from '%s'"), network->def->bridge); goto err4; } - if (iptablesAddUdpInput(driver->iptables, AF_INET6, - network->def->bridge, 53) < 0) { + if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow DNS requests from '%s'"), network->def->bridge); goto err5; } - if (iptablesAddUdpInput(driver->iptables, AF_INET6, - network->def->bridge, 547) < 0) { + if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 547) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow DHCP6 requests from '%s'"), network->def->bridge); @@ -1888,44 +1849,42 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, /* unwind in reverse order from the point of failure */ err6: - iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53); err5: - iptablesRemoveTcpInput(driver->iptables, AF_INET6, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53); err4: - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge); err3: - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge); err2: - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge); err1: return -1; } static void -networkRemoveGeneralIp6tablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkRemoveGeneralIp6tablesRules(virNetworkObjPtr network) { if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && !network->def->ipv6nogw) { return; } if (virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) { - iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 547); - iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 53); - iptablesRemoveTcpInput(driver->iptables, AF_INET6, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 547); + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53); } /* the following rules are there if no IPv6 address has been defined * but network->def->ipv6nogw == true */ - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET6, network->def->bridge); - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET6, network->def->bridge); - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge); } static int -networkAddGeneralIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkAddGeneralIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipv4def; @@ -1941,16 +1900,14 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* allow DHCP requests through to dnsmasq */ - if (iptablesAddTcpInput(driver->iptables, AF_INET, - network->def->bridge, 67) < 0) { + if (iptablesAddTcpInput(AF_INET, network->def->bridge, 67) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DHCP requests from '%s'"), network->def->bridge); goto err1; } - if (iptablesAddUdpInput(driver->iptables, AF_INET, - network->def->bridge, 67) < 0) { + if (iptablesAddUdpInput(AF_INET, network->def->bridge, 67) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DHCP requests from '%s'"), network->def->bridge); @@ -1964,24 +1921,21 @@ networkAddGeneralIptablesRules(struct network_driver *driver, */ if (ipv4def && (ipv4def->nranges || ipv4def->nhosts) && - (iptablesAddOutputFixUdpChecksum(driver->iptables, - network->def->bridge, 68) < 0)) { + (iptablesAddOutputFixUdpChecksum(network->def->bridge, 68) < 0)) { VIR_WARN("Could not add rule to fixup DHCP response checksums " "on network '%s'.", network->def->name); VIR_WARN("May need to update iptables package & kernel to support CHECKSUM rule."); } /* allow DNS requests through to dnsmasq */ - if (iptablesAddTcpInput(driver->iptables, AF_INET, - network->def->bridge, 53) < 0) { + if (iptablesAddTcpInput(AF_INET, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DNS requests from '%s'"), network->def->bridge); goto err3; } - if (iptablesAddUdpInput(driver->iptables, AF_INET, - network->def->bridge, 53) < 0) { + if (iptablesAddUdpInput(AF_INET, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DNS requests from '%s'"), network->def->bridge); @@ -1990,8 +1944,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* allow TFTP requests through to dnsmasq if necessary */ if (ipv4def && ipv4def->tftproot && - iptablesAddUdpInput(driver->iptables, AF_INET, - network->def->bridge, 69) < 0) { + iptablesAddUdpInput(AF_INET, network->def->bridge, 69) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow TFTP requests from '%s'"), network->def->bridge); @@ -2000,16 +1953,14 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* Catch all rules to block forwarding to/from bridges */ - if (iptablesAddForwardRejectOut(driver->iptables, AF_INET, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectOut(AF_INET, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to block outbound traffic from '%s'"), network->def->bridge); goto err6; } - if (iptablesAddForwardRejectIn(driver->iptables, AF_INET, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectIn(AF_INET, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to block inbound traffic to '%s'"), network->def->bridge); @@ -2017,8 +1968,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver, } /* Allow traffic between guests on the same bridge */ - if (iptablesAddForwardAllowCross(driver->iptables, AF_INET, - network->def->bridge) < 0) { + if (iptablesAddForwardAllowCross(AF_INET, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow cross bridge traffic on '%s'"), network->def->bridge); @@ -2026,7 +1976,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver, } /* add IPv6 general rules, if needed */ - if (networkAddGeneralIp6tablesRules(driver, network) < 0) { + if (networkAddGeneralIp6tablesRules(network) < 0) { goto err9; } @@ -2034,35 +1984,34 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* unwind in reverse order from the point of failure */ err9: - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); err8: - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); err7: - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); err6: if (ipv4def && ipv4def->tftproot) { - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 69); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); } err5: - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); err4: - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); err3: - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 67); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); err2: - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 67); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67); err1: return -1; } static void -networkRemoveGeneralIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkRemoveGeneralIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipv4def; - networkRemoveGeneralIp6tablesRules(driver, network); + networkRemoveGeneralIp6tablesRules(network); for (ii = 0; (ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, ii)); @@ -2071,25 +2020,23 @@ networkRemoveGeneralIptablesRules(struct network_driver *driver, break; } - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET, network->def->bridge); - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET, network->def->bridge); - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); if (ipv4def && ipv4def->tftproot) { - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 69); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); } - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 53); - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); if (ipv4def && (ipv4def->nranges || ipv4def->nhosts)) { - iptablesRemoveOutputFixUdpChecksum(driver->iptables, - network->def->bridge, 68); + iptablesRemoveOutputFixUdpChecksum(network->def->bridge, 68); } - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 67); - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 67); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67); } static int -networkAddIpSpecificIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkAddIpSpecificIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { /* NB: in the case of IPv6, routing rules are added when the @@ -2098,48 +2045,46 @@ networkAddIpSpecificIptablesRules(struct network_driver *driver, if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) - return networkAddMasqueradingIptablesRules(driver, network, ipdef); + return networkAddMasqueradingIptablesRules(network, ipdef); else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) - return networkAddRoutingIptablesRules(driver, network, ipdef); + return networkAddRoutingIptablesRules(network, ipdef); } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { - return networkAddRoutingIptablesRules(driver, network, ipdef); + return networkAddRoutingIptablesRules(network, ipdef); } return 0; } static void -networkRemoveIpSpecificIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkRemoveIpSpecificIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) - networkRemoveMasqueradingIptablesRules(driver, network, ipdef); + networkRemoveMasqueradingIptablesRules(network, ipdef); else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) - networkRemoveRoutingIptablesRules(driver, network, ipdef); + networkRemoveRoutingIptablesRules(network, ipdef); } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { - networkRemoveRoutingIptablesRules(driver, network, ipdef); + networkRemoveRoutingIptablesRules(network, ipdef); } } /* Add all rules for all ip addresses (and general rules) on a network */ static int -networkAddIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkAddIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipdef; virErrorPtr orig_error; /* Add "once per network" rules */ - if (networkAddGeneralIptablesRules(driver, network) < 0) + if (networkAddGeneralIptablesRules(network) < 0) return -1; for (ii = 0; (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii)); ii++) { /* Add address-specific iptables rules */ - if (networkAddIpSpecificIptablesRules(driver, network, ipdef) < 0) { + if (networkAddIpSpecificIptablesRules(network, ipdef) < 0) { goto err; } } @@ -2155,9 +2100,9 @@ err: */ while ((--ii >= 0) && (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii))) { - networkRemoveIpSpecificIptablesRules(driver, network, ipdef); + networkRemoveIpSpecificIptablesRules(network, ipdef); } - networkRemoveGeneralIptablesRules(driver, network); + networkRemoveGeneralIptablesRules(network); /* return the original error */ virSetError(orig_error); @@ -2167,8 +2112,7 @@ err: /* Remove all rules for all ip addresses (and general rules) on a network */ static void -networkRemoveIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkRemoveIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipdef; @@ -2176,9 +2120,9 @@ networkRemoveIptablesRules(struct network_driver *driver, for (ii = 0; (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii)); ii++) { - networkRemoveIpSpecificIptablesRules(driver, network, ipdef); + networkRemoveIpSpecificIptablesRules(network, ipdef); } - networkRemoveGeneralIptablesRules(driver, network); + networkRemoveGeneralIptablesRules(network); } static void @@ -2199,8 +2143,8 @@ networkReloadIptablesRules(struct network_driver *driver) /* Only the three L3 network types that are configured by libvirt * need to have iptables rules reloaded. */ - networkRemoveIptablesRules(driver, network); - if (networkAddIptablesRules(driver, network) < 0) { + networkRemoveIptablesRules(network); + if (networkAddIptablesRules(network) < 0) { /* failed to add but already logged */ } } @@ -2526,7 +2470,7 @@ networkStartNetworkVirtual(struct network_driver *driver, goto err1; /* Add "once per network" rules */ - if (networkAddIptablesRules(driver, network) < 0) + if (networkAddIptablesRules(network) < 0) goto err1; for (ii = 0; @@ -2619,7 +2563,7 @@ networkStartNetworkVirtual(struct network_driver *driver, err2: if (!save_err) save_err = virSaveLastError(); - networkRemoveIptablesRules(driver, network); + networkRemoveIptablesRules(network); err1: if (!save_err) @@ -2644,8 +2588,7 @@ networkStartNetworkVirtual(struct network_driver *driver, return -1; } -static int networkShutdownNetworkVirtual(struct network_driver *driver, - virNetworkObjPtr network) +static int networkShutdownNetworkVirtual(virNetworkObjPtr network) { virNetDevBandwidthClear(network->def->bridge); @@ -2677,7 +2620,7 @@ static int networkShutdownNetworkVirtual(struct network_driver *driver, ignore_value(virNetDevSetOnline(network->def->bridge, 0)); - networkRemoveIptablesRules(driver, network); + networkRemoveIptablesRules(network); ignore_value(virNetDevBridgeDelete(network->def->bridge)); @@ -2802,7 +2745,7 @@ static int networkShutdownNetwork(struct network_driver *driver, case VIR_NETWORK_FORWARD_NONE: case VIR_NETWORK_FORWARD_NAT: case VIR_NETWORK_FORWARD_ROUTE: - ret = networkShutdownNetworkVirtual(driver, network); + ret = networkShutdownNetworkVirtual(network); break; case VIR_NETWORK_FORWARD_BRIDGE: @@ -3490,8 +3433,8 @@ networkUpdate(virNetworkPtr net, network->def->forward.type == VIR_NETWORK_FORWARD_NAT || network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE)) { /* these could affect the iptables rules */ - networkRemoveIptablesRules(driver, network); - if (networkAddIptablesRules(driver, network) < 0) + networkRemoveIptablesRules(network); + if (networkAddIptablesRules(network) < 0) goto cleanup; } diff --git a/src/util/viriptables.c b/src/util/viriptables.c index 16fbe9c..63a8031 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -88,52 +88,8 @@ enum { REMOVE }; -typedef struct -{ - char *table; - char *chain; -} iptRules; - -struct _iptablesContext -{ - iptRules *input_filter; - iptRules *forward_filter; - iptRules *nat_postrouting; - iptRules *mangle_postrouting; -}; - -static void -iptRulesFree(iptRules *rules) -{ - VIR_FREE(rules->table); - VIR_FREE(rules->chain); - VIR_FREE(rules); -} - -static iptRules * -iptRulesNew(const char *table, - const char *chain) -{ - iptRules *rules; - - if (VIR_ALLOC(rules) < 0) - return NULL; - - if (VIR_STRDUP(rules->table, table) < 0) - goto error; - - if (VIR_STRDUP(rules->chain, chain) < 0) - goto error; - - return rules; - - error: - iptRulesFree(rules); - return NULL; -} - static virCommandPtr -iptablesCommandNew(iptRules *rules, int family, int action) +iptablesCommandNew(const char *table, const char *chain, int family, int action) { virCommandPtr cmd = NULL; #if HAVE_FIREWALLD @@ -150,9 +106,9 @@ iptablesCommandNew(iptRules *rules, int family, int action) ? IP6TABLES_PATH : IPTABLES_PATH); } - virCommandAddArgList(cmd, "--table", rules->table, + virCommandAddArgList(cmd, "--table", table, action == ADD ? "--insert" : "--delete", - rules->chain, NULL); + chain, NULL); return cmd; } @@ -166,14 +122,14 @@ iptablesCommandRunAndFree(virCommandPtr cmd) } static int ATTRIBUTE_SENTINEL -iptablesAddRemoveRule(iptRules *rules, int family, int action, +iptablesAddRemoveRule(const char *table, const char *chain, int family, int action, const char *arg, ...) { va_list args; virCommandPtr cmd = NULL; const char *s; - cmd = iptablesCommandNew(rules, family, action); + cmd = iptablesCommandNew(table, chain, family, action); virCommandAddArg(cmd, arg); va_start(args, arg); @@ -184,63 +140,8 @@ iptablesAddRemoveRule(iptRules *rules, int family, int action, return iptablesCommandRunAndFree(cmd); } -/** - * iptablesContextNew: - * - * Create a new IPtable context - * - * Returns a pointer to the new structure or NULL in case of error - */ -iptablesContext * -iptablesContextNew(void) -{ - iptablesContext *ctx; - - if (VIR_ALLOC(ctx) < 0) - return NULL; - - if (!(ctx->input_filter = iptRulesNew("filter", "INPUT"))) - goto error; - - if (!(ctx->forward_filter = iptRulesNew("filter", "FORWARD"))) - goto error; - - if (!(ctx->nat_postrouting = iptRulesNew("nat", "POSTROUTING"))) - goto error; - - if (!(ctx->mangle_postrouting = iptRulesNew("mangle", "POSTROUTING"))) - goto error; - - return ctx; - - error: - iptablesContextFree(ctx); - return NULL; -} - -/** - * iptablesContextFree: - * @ctx: pointer to the IP table context - * - * Free the resources associated with an IP table context - */ -void -iptablesContextFree(iptablesContext *ctx) -{ - if (ctx->input_filter) - iptRulesFree(ctx->input_filter); - if (ctx->forward_filter) - iptRulesFree(ctx->forward_filter); - if (ctx->nat_postrouting) - iptRulesFree(ctx->nat_postrouting); - if (ctx->mangle_postrouting) - iptRulesFree(ctx->mangle_postrouting); - VIR_FREE(ctx); -} - static int -iptablesInput(iptablesContext *ctx, - int family, +iptablesInput(int family, const char *iface, int port, int action, @@ -251,7 +152,7 @@ iptablesInput(iptablesContext *ctx, snprintf(portstr, sizeof(portstr), "%d", port); portstr[sizeof(portstr) - 1] = '\0'; - return iptablesAddRemoveRule(ctx->input_filter, + return iptablesAddRemoveRule("filter", "INPUT", family, action, "--in-interface", iface, @@ -274,12 +175,11 @@ iptablesInput(iptablesContext *ctx, */ int -iptablesAddTcpInput(iptablesContext *ctx, - int family, +iptablesAddTcpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, ADD, 1); + return iptablesInput(family, iface, port, ADD, 1); } /** @@ -294,12 +194,11 @@ iptablesAddTcpInput(iptablesContext *ctx, * Returns 0 in case of success or an error code in case of error */ int -iptablesRemoveTcpInput(iptablesContext *ctx, - int family, +iptablesRemoveTcpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, REMOVE, 1); + return iptablesInput(family, iface, port, REMOVE, 1); } /** @@ -315,12 +214,11 @@ iptablesRemoveTcpInput(iptablesContext *ctx, */ int -iptablesAddUdpInput(iptablesContext *ctx, - int family, +iptablesAddUdpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, ADD, 0); + return iptablesInput(family, iface, port, ADD, 0); } /** @@ -335,12 +233,11 @@ iptablesAddUdpInput(iptablesContext *ctx, * Returns 0 in case of success or an error code in case of error */ int -iptablesRemoveUdpInput(iptablesContext *ctx, - int family, +iptablesRemoveUdpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, REMOVE, 0); + return iptablesInput(family, iface, port, REMOVE, 0); } @@ -381,8 +278,7 @@ static char *iptablesFormatNetwork(virSocketAddr *netaddr, * to proceed to WAN */ static int -iptablesForwardAllowOut(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardAllowOut(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev, @@ -395,7 +291,7 @@ iptablesForwardAllowOut(iptablesContext *ctx, if (!(networkstr = iptablesFormatNetwork(netaddr, prefix))) return -1; - cmd = iptablesCommandNew(ctx->forward_filter, + cmd = iptablesCommandNew("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action); virCommandAddArgList(cmd, @@ -426,13 +322,12 @@ iptablesForwardAllowOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowOut(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardAllowOut(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowOut(ctx, netaddr, prefix, iface, physdev, ADD); + return iptablesForwardAllowOut(netaddr, prefix, iface, physdev, ADD); } /** @@ -449,13 +344,12 @@ iptablesAddForwardAllowOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowOut(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardAllowOut(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowOut(ctx, netaddr, prefix, iface, physdev, REMOVE); + return iptablesForwardAllowOut(netaddr, prefix, iface, physdev, REMOVE); } @@ -463,8 +357,7 @@ iptablesRemoveForwardAllowOut(iptablesContext *ctx, * and associated with an existing connection */ static int -iptablesForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev, @@ -477,7 +370,7 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx, return -1; if (physdev && physdev[0]) { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -488,7 +381,7 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx, "--jump", "ACCEPT", NULL); } else { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -516,13 +409,12 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowRelatedIn(ctx, netaddr, prefix, iface, physdev, ADD); + return iptablesForwardAllowRelatedIn(netaddr, prefix, iface, physdev, ADD); } /** @@ -539,20 +431,18 @@ iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowRelatedIn(ctx, netaddr, prefix, iface, physdev, REMOVE); + return iptablesForwardAllowRelatedIn(netaddr, prefix, iface, physdev, REMOVE); } /* Allow all traffic destined to the bridge, with a valid network address */ static int -iptablesForwardAllowIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardAllowIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev, @@ -565,7 +455,7 @@ iptablesForwardAllowIn(iptablesContext *ctx, return -1; if (physdev && physdev[0]) { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -574,7 +464,7 @@ iptablesForwardAllowIn(iptablesContext *ctx, "--jump", "ACCEPT", NULL); } else { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -600,13 +490,12 @@ iptablesForwardAllowIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardAllowIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowIn(ctx, netaddr, prefix, iface, physdev, ADD); + return iptablesForwardAllowIn(netaddr, prefix, iface, physdev, ADD); } /** @@ -623,13 +512,12 @@ iptablesAddForwardAllowIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardAllowIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowIn(ctx, netaddr, prefix, iface, physdev, REMOVE); + return iptablesForwardAllowIn(netaddr, prefix, iface, physdev, REMOVE); } @@ -637,12 +525,11 @@ iptablesRemoveForwardAllowIn(iptablesContext *ctx, * with a valid network address */ static int -iptablesForwardAllowCross(iptablesContext *ctx, - int family, +iptablesForwardAllowCross(int family, const char *iface, int action) { - return iptablesAddRemoveRule(ctx->forward_filter, + return iptablesAddRemoveRule("filter", "FORWARD", family, action, "--in-interface", iface, @@ -663,11 +550,10 @@ iptablesForwardAllowCross(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowCross(iptablesContext *ctx, - int family, +iptablesAddForwardAllowCross(int family, const char *iface) { - return iptablesForwardAllowCross(ctx, family, iface, ADD); + return iptablesForwardAllowCross(family, iface, ADD); } /** @@ -682,11 +568,10 @@ iptablesAddForwardAllowCross(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowCross(iptablesContext *ctx, - int family, +iptablesRemoveForwardAllowCross(int family, const char *iface) { - return iptablesForwardAllowCross(ctx, family, iface, REMOVE); + return iptablesForwardAllowCross(family, iface, REMOVE); } @@ -694,12 +579,11 @@ iptablesRemoveForwardAllowCross(iptablesContext *ctx, * ie the bridge is the in interface */ static int -iptablesForwardRejectOut(iptablesContext *ctx, - int family, +iptablesForwardRejectOut(int family, const char *iface, int action) { - return iptablesAddRemoveRule(ctx->forward_filter, + return iptablesAddRemoveRule("filter", "FORWARD", family, action, "--in-interface", iface, @@ -718,11 +602,10 @@ iptablesForwardRejectOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardRejectOut(iptablesContext *ctx, - int family, +iptablesAddForwardRejectOut(int family, const char *iface) { - return iptablesForwardRejectOut(ctx, family, iface, ADD); + return iptablesForwardRejectOut(family, iface, ADD); } /** @@ -736,11 +619,10 @@ iptablesAddForwardRejectOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardRejectOut(iptablesContext *ctx, - int family, +iptablesRemoveForwardRejectOut(int family, const char *iface) { - return iptablesForwardRejectOut(ctx, family, iface, REMOVE); + return iptablesForwardRejectOut(family, iface, REMOVE); } @@ -750,12 +632,11 @@ iptablesRemoveForwardRejectOut(iptablesContext *ctx, * ie the bridge is the out interface */ static int -iptablesForwardRejectIn(iptablesContext *ctx, - int family, +iptablesForwardRejectIn(int family, const char *iface, int action) { - return iptablesAddRemoveRule(ctx->forward_filter, + return iptablesAddRemoveRule("filter", "FORWARD", family, action, "--out-interface", iface, @@ -774,11 +655,10 @@ iptablesForwardRejectIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardRejectIn(iptablesContext *ctx, - int family, +iptablesAddForwardRejectIn(int family, const char *iface) { - return iptablesForwardRejectIn(ctx, family, iface, ADD); + return iptablesForwardRejectIn(family, iface, ADD); } /** @@ -792,11 +672,10 @@ iptablesAddForwardRejectIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardRejectIn(iptablesContext *ctx, - int family, +iptablesRemoveForwardRejectIn(int family, const char *iface) { - return iptablesForwardRejectIn(ctx, family, iface, REMOVE); + return iptablesForwardRejectIn(family, iface, REMOVE); } @@ -804,8 +683,7 @@ iptablesRemoveForwardRejectIn(iptablesContext *ctx, * with the bridge */ static int -iptablesForwardMasquerade(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardMasquerade(virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, @@ -841,7 +719,7 @@ iptablesForwardMasquerade(iptablesContext *ctx, } } - cmd = iptablesCommandNew(ctx->nat_postrouting, AF_INET, action); + cmd = iptablesCommandNew("nat", "POSTROUTING", AF_INET, action); virCommandAddArgList(cmd, "--source", networkstr, NULL); if (protocol && protocol[0]) @@ -922,15 +800,14 @@ cleanup: * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardMasquerade(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardMasquerade(virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol) { - return iptablesForwardMasquerade(ctx, netaddr, prefix, physdev, addr, port, + return iptablesForwardMasquerade(netaddr, prefix, physdev, addr, port, protocol, ADD); } @@ -948,22 +825,20 @@ iptablesAddForwardMasquerade(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardMasquerade(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardMasquerade(virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol) { - return iptablesForwardMasquerade(ctx, netaddr, prefix, physdev, addr, port, + return iptablesForwardMasquerade(netaddr, prefix, physdev, addr, port, protocol, REMOVE); } static int -iptablesOutputFixUdpChecksum(iptablesContext *ctx, - const char *iface, +iptablesOutputFixUdpChecksum(const char *iface, int port, int action) { @@ -972,7 +847,7 @@ iptablesOutputFixUdpChecksum(iptablesContext *ctx, snprintf(portstr, sizeof(portstr), "%d", port); portstr[sizeof(portstr) - 1] = '\0'; - return iptablesAddRemoveRule(ctx->mangle_postrouting, + return iptablesAddRemoveRule("mangle", "POSTROUTING", AF_INET, action, "--out-interface", iface, @@ -998,11 +873,10 @@ iptablesOutputFixUdpChecksum(iptablesContext *ctx, */ int -iptablesAddOutputFixUdpChecksum(iptablesContext *ctx, - const char *iface, +iptablesAddOutputFixUdpChecksum(const char *iface, int port) { - return iptablesOutputFixUdpChecksum(ctx, iface, port, ADD); + return iptablesOutputFixUdpChecksum(iface, port, ADD); } /** @@ -1019,9 +893,8 @@ iptablesAddOutputFixUdpChecksum(iptablesContext *ctx, * return an error, which should be ignored) */ int -iptablesRemoveOutputFixUdpChecksum(iptablesContext *ctx, - const char *iface, +iptablesRemoveOutputFixUdpChecksum(const char *iface, int port) { - return iptablesOutputFixUdpChecksum(ctx, iface, port, REMOVE); + return iptablesOutputFixUdpChecksum(iface, port, REMOVE); } diff --git a/src/util/viriptables.h b/src/util/viriptables.h index b7ce59b..447f4a8 100644 --- a/src/util/viriptables.h +++ b/src/util/viriptables.h @@ -26,102 +26,77 @@ # include "virsocketaddr.h" -typedef struct _iptablesContext iptablesContext; - -iptablesContext *iptablesContextNew (void); -void iptablesContextFree (iptablesContext *ctx); - -int iptablesAddTcpInput (iptablesContext *ctx, - int family, +int iptablesAddTcpInput (int family, const char *iface, int port); -int iptablesRemoveTcpInput (iptablesContext *ctx, - int family, +int iptablesRemoveTcpInput (int family, const char *iface, int port); -int iptablesAddUdpInput (iptablesContext *ctx, - int family, +int iptablesAddUdpInput (int family, const char *iface, int port); -int iptablesRemoveUdpInput (iptablesContext *ctx, - int family, +int iptablesRemoveUdpInput (int family, const char *iface, int port); -int iptablesAddForwardAllowOut (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardAllowOut (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesRemoveForwardAllowOut (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardAllowOut (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesAddForwardAllowIn (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardAllowIn (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesRemoveForwardAllowIn (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardAllowIn (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesAddForwardAllowCross (iptablesContext *ctx, - int family, +int iptablesAddForwardAllowCross (int family, const char *iface); -int iptablesRemoveForwardAllowCross (iptablesContext *ctx, - int family, +int iptablesRemoveForwardAllowCross (int family, const char *iface); -int iptablesAddForwardRejectOut (iptablesContext *ctx, - int family, +int iptablesAddForwardRejectOut (int family, const char *iface); -int iptablesRemoveForwardRejectOut (iptablesContext *ctx, - int family, +int iptablesRemoveForwardRejectOut (int family, const char *iface); -int iptablesAddForwardRejectIn (iptablesContext *ctx, - int family, +int iptablesAddForwardRejectIn (int family, const char *iface); -int iptablesRemoveForwardRejectIn (iptablesContext *ctx, - int family, +int iptablesRemoveForwardRejectIn (int family, const char *iface); -int iptablesAddForwardMasquerade (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardMasquerade (virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol); -int iptablesRemoveForwardMasquerade (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardMasquerade (virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol); -int iptablesAddOutputFixUdpChecksum (iptablesContext *ctx, - const char *iface, +int iptablesAddOutputFixUdpChecksum (const char *iface, int port); -int iptablesRemoveOutputFixUdpChecksum (iptablesContext *ctx, - const char *iface, +int iptablesRemoveOutputFixUdpChecksum (const char *iface, int port); #endif /* __QEMUD_IPTABLES_H__ */ -- 1.8.1.4