[libvirt] [PATCH V11 0/7] Add DHCP snooping support to nwfilter
This series of patches adds DHCP snooping support to libvirt's nwfilter subsystem. DHCP snooping detects DHCP leases obtained by a VM and automatically adjusts the network traffic filters to reflect the IP addresses with which a VM may send its traffic, thus for example preventing IP address spoofing. Once leases on IP addresses expire or if a VM gives up on a lease on an IP address, the filters are also adjusted. All leases are persisted and automatically applied upon a VM's restart. Leases are associated with the tuple of VM-UUID and interface MAC address. The following interface XML activates and uses the DHCP snooping: <interface type='bridge'> <source bridge='virbr0'/> <filterref filter='clean-traffic'> <parameter name='ip_learning' value='dhcp'/> </filterref> </interface> Once an IP address has been detected on an interface, 'virsh dumpxml <vm>' would show the IP address lease in the format <IP address>,<lease timeout in seconds>: <interface type='bridge'> <source bridge='virbr0'/> <filterref filter='clean-traffic'> <parameter name='ip_learning' value='dhcp'/> <parameter name='IP_LEASE' value='192.168.122.210,180'/> </filterref> </interface> Regards, David and Stefan
Implement function to remove all entries of a hash table. --- src/libvirt_private.syms | 1 + src/util/virhash.c | 25 +++++++++++++++++++++++++ src/util/virhash.h | 5 +++++ 3 files changed, 31 insertions(+) Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -578,6 +578,7 @@ virHashForEach; virHashFree; virHashGetItems; virHashLookup; +virHashRemoveAll; virHashRemoveEntry; virHashRemoveSet; virHashSearch; Index: libvirt-acl/src/util/virhash.c =================================================================== --- libvirt-acl.orig/src/util/virhash.c +++ libvirt-acl/src/util/virhash.c @@ -575,6 +575,31 @@ virHashRemoveSet(virHashTablePtr table, return count; } +static int +_virHashRemoveAllIter(const void *payload ATTRIBUTE_UNUSED, + const void *name ATTRIBUTE_UNUSED, + const void *data ATTRIBUTE_UNUSED) +{ + return 1; +} + +/** + * virHashRemoveAll + * @table: the hash table to clear + * + * Free the hash @table's contents. The userdata is + * deallocated with the function provided at creation time. + * + * Returns the number of items removed on success, -1 on failure + */ +ssize_t +virHashRemoveAll(virHashTablePtr table) +{ + return virHashRemoveSet(table, + _virHashRemoveAllIter, + NULL); +} + /** * virHashSearch: * @table: the hash table to search Index: libvirt-acl/src/util/virhash.h =================================================================== --- libvirt-acl.orig/src/util/virhash.h +++ libvirt-acl/src/util/virhash.h @@ -127,6 +127,11 @@ int virHashRemoveEntry(virHashTablePtr t const void *name); /* + * Remove all entries from the hash table. + */ +ssize_t virHashRemoveAll(virHashTablePtr table); + +/* * Retrieve the userdata. */ void *virHashLookup(virHashTablePtr table, const void *name);
On Tue, Apr 17, 2012 at 10:44:02AM -0400, Stefan Berger wrote:
Implement function to remove all entries of a hash table.
--- src/libvirt_private.syms | 1 + src/util/virhash.c | 25 +++++++++++++++++++++++++ src/util/virhash.h | 5 +++++ 3 files changed, 31 insertions(+)
Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -578,6 +578,7 @@ virHashForEach; virHashFree; virHashGetItems; virHashLookup; +virHashRemoveAll; virHashRemoveEntry; virHashRemoveSet; virHashSearch; Index: libvirt-acl/src/util/virhash.c =================================================================== --- libvirt-acl.orig/src/util/virhash.c +++ libvirt-acl/src/util/virhash.c @@ -575,6 +575,31 @@ virHashRemoveSet(virHashTablePtr table, return count; }
+static int +_virHashRemoveAllIter(const void *payload ATTRIBUTE_UNUSED, + const void *name ATTRIBUTE_UNUSED, + const void *data ATTRIBUTE_UNUSED) +{ + return 1; +} + +/** + * virHashRemoveAll + * @table: the hash table to clear + * + * Free the hash @table's contents. The userdata is + * deallocated with the function provided at creation time. + * + * Returns the number of items removed on success, -1 on failure + */ +ssize_t +virHashRemoveAll(virHashTablePtr table) +{ + return virHashRemoveSet(table, + _virHashRemoveAllIter, + NULL); +} + /** * virHashSearch: * @table: the hash table to search Index: libvirt-acl/src/util/virhash.h =================================================================== --- libvirt-acl.orig/src/util/virhash.h +++ libvirt-acl/src/util/virhash.h @@ -127,6 +127,11 @@ int virHashRemoveEntry(virHashTablePtr t const void *name);
/* + * Remove all entries from the hash table. + */ +ssize_t virHashRemoveAll(virHashTablePtr table); + +/* * Retrieve the userdata. */ void *virHashLookup(virHashTablePtr table, const void *name);
There is certainly a way to implement this in a more efficient fashion but that's fine :-) ACK, Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel@veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/
For threading support, add atomic add and sub operations working on integers. Base this on locking support provided by virMutex. --- src/util/viratomic.h | 91 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 91 insertions(+) Index: libvirt-acl/src/util/viratomic.h =================================================================== --- /dev/null +++ libvirt-acl/src/util/viratomic.h @@ -0,0 +1,91 @@ +/* + * viratomic.h: atomic integer operations + * + * Copyright (C) 2012 IBM Corporation + * + * Authors: + * Stefan Berger <stefanb@linux.vnet.ibm.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + */ + +#ifndef __VIR_ATOMIC_H__ +# define __VIR_ATOMIC_H__ + +# include "threads.h" + +typedef struct _virAtomicInt virAtomicInt; +typedef virAtomicInt *virAtomicIntPtr; + +struct _virAtomicInt { + virMutex lock; + int value; +}; + +static inline int +virAtomicIntInit(virAtomicIntPtr vaip) +{ + vaip->value = 0; + return virMutexInit(&vaip->lock); +} + +static inline void +virAtomicIntSet(virAtomicIntPtr vaip, int value) +{ + virMutexLock(&vaip->lock); + + vaip->value = value; + + virMutexUnlock(&vaip->lock); +} + +static inline int +virAtomicIntRead(virAtomicIntPtr vaip) +{ + return vaip->value; +} + +static inline int +virAtomicIntAdd(virAtomicIntPtr vaip, int add) +{ + int ret; + + virMutexLock(&vaip->lock); + + vaip->value += add; + ret = vaip->value; + + virMutexUnlock(&vaip->lock); + + return ret; +} + +static inline int +virAtomicIntSub(virAtomicIntPtr vaip, int sub) +{ + int ret; + + virMutexLock(&vaip->lock); + + vaip->value -= sub; + ret = vaip->value; + + virMutexUnlock(&vaip->lock); + + return ret; +} + +#endif /* __VIR_ATOMIC_H */
On Tue, Apr 17, 2012 at 10:44:03AM -0400, Stefan Berger wrote:
For threading support, add atomic add and sub operations working on integers. Base this on locking support provided by virMutex.
--- src/util/viratomic.h | 91 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 91 insertions(+)
Index: libvirt-acl/src/util/viratomic.h =================================================================== --- /dev/null +++ libvirt-acl/src/util/viratomic.h @@ -0,0 +1,91 @@ +/* + * viratomic.h: atomic integer operations + * + * Copyright (C) 2012 IBM Corporation + * + * Authors: + * Stefan Berger <stefanb@linux.vnet.ibm.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + */ + +#ifndef __VIR_ATOMIC_H__ +# define __VIR_ATOMIC_H__ + +# include "threads.h" + +typedef struct _virAtomicInt virAtomicInt; +typedef virAtomicInt *virAtomicIntPtr; + +struct _virAtomicInt { + virMutex lock; + int value; +}; + +static inline int +virAtomicIntInit(virAtomicIntPtr vaip) +{ + vaip->value = 0; + return virMutexInit(&vaip->lock); +} + +static inline void +virAtomicIntSet(virAtomicIntPtr vaip, int value) +{ + virMutexLock(&vaip->lock); + + vaip->value = value; + + virMutexUnlock(&vaip->lock); +} + +static inline int +virAtomicIntRead(virAtomicIntPtr vaip) +{ + return vaip->value; +} + +static inline int +virAtomicIntAdd(virAtomicIntPtr vaip, int add) +{ + int ret; + + virMutexLock(&vaip->lock); + + vaip->value += add; + ret = vaip->value; + + virMutexUnlock(&vaip->lock); + + return ret; +} + +static inline int +virAtomicIntSub(virAtomicIntPtr vaip, int sub) +{ + int ret; + + virMutexLock(&vaip->lock); + + vaip->value -= sub; + ret = vaip->value; + + virMutexUnlock(&vaip->lock); + + return ret; +} + +#endif /* __VIR_ATOMIC_H */
To be honnest, I'm not too fond of inline functions, but we already rely on them (though for accessors mostly). In that case it's reasonnable to use them, ACK, but it itches me a bit Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel@veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/
On 04/17/2012 08:44 AM, Stefan Berger wrote:
For threading support, add atomic add and sub operations working on integers. Base this on locking support provided by virMutex.
--- src/util/viratomic.h | 91 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 91 insertions(+)
Index: libvirt-acl/src/util/viratomic.h
+typedef struct _virAtomicInt virAtomicInt; +typedef virAtomicInt *virAtomicIntPtr; + +struct _virAtomicInt { + virMutex lock; + int value; +};
virMutex is very heavyweight. I'd love it if we could use gcc primitives and/or MSVC libc primitives (where they are known to be available), for a lighter-weight implementation on platforms that support it. See this patch proposal (now a year old!) for some ideas that we should fold in before 0.9.12: https://www.redhat.com/archives/libvir-list/2011-April/msg00368.html -- Eric Blake eblake@redhat.com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
On 04/19/2012 02:08 PM, Eric Blake wrote:
On 04/17/2012 08:44 AM, Stefan Berger wrote:
For threading support, add atomic add and sub operations working on integers. Base this on locking support provided by virMutex.
virMutex is very heavyweight. I'd love it if we could use gcc primitives and/or MSVC libc primitives (where they are known to be available), for a lighter-weight implementation on platforms that support it. See this patch proposal (now a year old!) for some ideas that we should fold in before 0.9.12:
https://www.redhat.com/archives/libvir-list/2011-April/msg00368.html
Well, I wasn't aware of this previous proposal and had actually looked in pthread for some form of atomic support. I already pushed this patch now. We can add some compiler- and architecture-specific #ifdef's around the few existing functions. So the existing implementation probably has a place but can be improved upon. Stefan
On 04/19/2012 12:19 PM, Stefan Berger wrote:
On 04/19/2012 02:08 PM, Eric Blake wrote:
On 04/17/2012 08:44 AM, Stefan Berger wrote:
For threading support, add atomic add and sub operations working on integers. Base this on locking support provided by virMutex.
virMutex is very heavyweight. I'd love it if we could use gcc primitives and/or MSVC libc primitives (where they are known to be available), for a lighter-weight implementation on platforms that support it. See this patch proposal (now a year old!) for some ideas that we should fold in before 0.9.12:
https://www.redhat.com/archives/libvir-list/2011-April/msg00368.html
Well, I wasn't aware of this previous proposal and had actually looked in pthread for some form of atomic support. I already pushed this patch now. We can add some compiler- and architecture-specific #ifdef's around the few existing functions. So the existing implementation probably has a place but can be improved upon.
No problem with the current implementation (don't go reverting anything just because I came late to the review party!); I'm okay with future patches for the improvements, especially since they will merely be optimizations. But I'm hoping we can get those optimizations in the tree before 0.9.12, rather than later, now that it is fresh on our minds. -- Eric Blake eblake@redhat.com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
Fix the support for trusted DHCP server in the ebtables code's hard-coded function applying DHCP only filtering rules: Rather than using a char * use the more flexible virNWFilterVarValuePtr that contains the trusted DHCP server(s) IP address. Process all entries. Since all callers so far provided NULL as parameter, no changes are necessary in any other code. --- src/conf/nwfilter_conf.h | 2 src/nwfilter/nwfilter_ebiptables_driver.c | 72 +++++++++++++++++------------- 2 files changed, 44 insertions(+), 30 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -625,7 +625,7 @@ typedef int (*virNWFilterApplyBasicRules typedef int (*virNWFilterApplyDHCPOnlyRules)(const char *ifname, const unsigned char *macaddr, - const char *dhcpserver, + virNWFilterVarValuePtr dhcpsrvs, bool leaveTemporary); typedef int (*virNWFilterRemoveBasicRules)(const char *ifname); Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3195,7 +3195,7 @@ tear_down_tmpebchains: * @ifname: name of the backend-interface to which to apply the rules * @macaddr: MAC address the VM is using in packets sent through the * interface - * @dhcpserver: The DHCP server from which the VM may receive traffic + * @dhcpsrvrs: The DHCP server(s) from which the VM may receive traffic * from; may be NULL * @leaveTemporary: Whether to leave the table names with their temporary * names (true) or also perform the renaming to their final names as @@ -3209,14 +3209,15 @@ tear_down_tmpebchains: static int ebtablesApplyDHCPOnlyRules(const char *ifname, const unsigned char *macaddr, - const char *dhcpserver, + virNWFilterVarValuePtr dhcpsrvrs, bool leaveTemporary) { virBuffer buf = VIR_BUFFER_INITIALIZER; char chain_in [MAX_CHAINNAME_LENGTH], chain_out[MAX_CHAINNAME_LENGTH]; char macaddr_str[VIR_MAC_STRING_BUFLEN]; - char *srcIPParam = NULL; + unsigned int idx = 0; + unsigned int num_dhcpsrvrs; if (!ebtables_cmd_path) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -3225,15 +3226,6 @@ ebtablesApplyDHCPOnlyRules(const char *i return -1; } - if (dhcpserver) { - virBufferAsprintf(&buf, " --ip-src %s", dhcpserver); - if (virBufferError(&buf)) { - virBufferFreeAndReset(&buf); - return -1; - } - srcIPParam = virBufferContentAndReset(&buf); - } - virMacAddrFormat(macaddr, macaddr_str); ebiptablesAllTeardown(ifname); @@ -3267,20 +3259,46 @@ ebtablesApplyDHCPOnlyRules(const char *i chain_in, CMD_STOPONERR(1)); - virBufferAsprintf(&buf, - CMD_DEF("$EBT -t nat -A %s" - " -d %s" - " -p ipv4 --ip-protocol udp" - " %s" - " --ip-sport 67 --ip-dport 68" - " -j ACCEPT") CMD_SEPARATOR - CMD_EXEC - "%s", + num_dhcpsrvrs = (dhcpsrvrs != NULL) + ? virNWFilterVarValueGetCardinality(dhcpsrvrs) + : 0; - chain_out, - macaddr_str, - srcIPParam != NULL ? srcIPParam : "", - CMD_STOPONERR(1)); + while (true) { + char *srcIPParam = NULL; + + if (idx < num_dhcpsrvrs) { + const char *dhcpserver; + + dhcpserver = virNWFilterVarValueGetNthValue(dhcpsrvrs, idx); + + if (virAsprintf(&srcIPParam, "--ip-src %s", dhcpserver) < 0) { + virReportOOMError(); + goto tear_down_tmpebchains; + } + } + + virBufferAsprintf(&buf, + CMD_DEF("$EBT -t nat -A %s" + " -d %s" + " -p ipv4 --ip-protocol udp" + " %s" + " --ip-sport 67 --ip-dport 68" + " -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + chain_out, + macaddr_str, + srcIPParam != NULL ? srcIPParam : "", + CMD_STOPONERR(1)); + + VIR_FREE(srcIPParam); + + if (idx == num_dhcpsrvrs) + break; + + idx++; + } virBufferAsprintf(&buf, CMD_DEF("$EBT -t nat -A %s -j DROP") CMD_SEPARATOR @@ -3301,8 +3319,6 @@ ebtablesApplyDHCPOnlyRules(const char *i if (ebiptablesExecCLI(&buf, NULL, NULL) < 0) goto tear_down_tmpebchains; - VIR_FREE(srcIPParam); - return 0; tear_down_tmpebchains: @@ -3312,8 +3328,6 @@ tear_down_tmpebchains: "%s", _("Some rules could not be created.")); - VIR_FREE(srcIPParam); - return -1; }
On Tue, Apr 17, 2012 at 10:44:04AM -0400, Stefan Berger wrote:
Fix the support for trusted DHCP server in the ebtables code's hard-coded function applying DHCP only filtering rules: Rather than using a char * use the more flexible virNWFilterVarValuePtr that contains the trusted DHCP server(s) IP address. Process all entries.
Since all callers so far provided NULL as parameter, no changes are necessary in any other code.
--- src/conf/nwfilter_conf.h | 2 src/nwfilter/nwfilter_ebiptables_driver.c | 72 +++++++++++++++++------------- 2 files changed, 44 insertions(+), 30 deletions(-)
Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -625,7 +625,7 @@ typedef int (*virNWFilterApplyBasicRules
typedef int (*virNWFilterApplyDHCPOnlyRules)(const char *ifname, const unsigned char *macaddr, - const char *dhcpserver, + virNWFilterVarValuePtr dhcpsrvs, bool leaveTemporary);
typedef int (*virNWFilterRemoveBasicRules)(const char *ifname); Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3195,7 +3195,7 @@ tear_down_tmpebchains: * @ifname: name of the backend-interface to which to apply the rules * @macaddr: MAC address the VM is using in packets sent through the * interface - * @dhcpserver: The DHCP server from which the VM may receive traffic + * @dhcpsrvrs: The DHCP server(s) from which the VM may receive traffic * from; may be NULL * @leaveTemporary: Whether to leave the table names with their temporary * names (true) or also perform the renaming to their final names as @@ -3209,14 +3209,15 @@ tear_down_tmpebchains: static int ebtablesApplyDHCPOnlyRules(const char *ifname, const unsigned char *macaddr, - const char *dhcpserver, + virNWFilterVarValuePtr dhcpsrvrs, bool leaveTemporary) { virBuffer buf = VIR_BUFFER_INITIALIZER; char chain_in [MAX_CHAINNAME_LENGTH], chain_out[MAX_CHAINNAME_LENGTH]; char macaddr_str[VIR_MAC_STRING_BUFLEN]; - char *srcIPParam = NULL; + unsigned int idx = 0; + unsigned int num_dhcpsrvrs;
if (!ebtables_cmd_path) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -3225,15 +3226,6 @@ ebtablesApplyDHCPOnlyRules(const char *i return -1; }
- if (dhcpserver) { - virBufferAsprintf(&buf, " --ip-src %s", dhcpserver); - if (virBufferError(&buf)) { - virBufferFreeAndReset(&buf); - return -1; - } - srcIPParam = virBufferContentAndReset(&buf); - } - virMacAddrFormat(macaddr, macaddr_str);
ebiptablesAllTeardown(ifname); @@ -3267,20 +3259,46 @@ ebtablesApplyDHCPOnlyRules(const char *i chain_in, CMD_STOPONERR(1));
- virBufferAsprintf(&buf, - CMD_DEF("$EBT -t nat -A %s" - " -d %s" - " -p ipv4 --ip-protocol udp" - " %s" - " --ip-sport 67 --ip-dport 68" - " -j ACCEPT") CMD_SEPARATOR - CMD_EXEC - "%s", + num_dhcpsrvrs = (dhcpsrvrs != NULL) + ? virNWFilterVarValueGetCardinality(dhcpsrvrs) + : 0;
- chain_out, - macaddr_str, - srcIPParam != NULL ? srcIPParam : "", - CMD_STOPONERR(1)); + while (true) { + char *srcIPParam = NULL; + + if (idx < num_dhcpsrvrs) { + const char *dhcpserver; + + dhcpserver = virNWFilterVarValueGetNthValue(dhcpsrvrs, idx); + + if (virAsprintf(&srcIPParam, "--ip-src %s", dhcpserver) < 0) { + virReportOOMError(); + goto tear_down_tmpebchains; + } + } + + virBufferAsprintf(&buf, + CMD_DEF("$EBT -t nat -A %s" + " -d %s" + " -p ipv4 --ip-protocol udp" + " %s" + " --ip-sport 67 --ip-dport 68" + " -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + chain_out, + macaddr_str, + srcIPParam != NULL ? srcIPParam : "", + CMD_STOPONERR(1)); + + VIR_FREE(srcIPParam); + + if (idx == num_dhcpsrvrs) + break; + + idx++; + }
There is something I don't understand in that loop, you repetedly write to buf, but you don't seems to use buf in the loop. This looks fishy to me, or are you using side effect execution in the Asprintf argument evaluation. Too cryptic to my taste, I'm lost !
virBufferAsprintf(&buf, CMD_DEF("$EBT -t nat -A %s -j DROP") CMD_SEPARATOR @@ -3301,8 +3319,6 @@ ebtablesApplyDHCPOnlyRules(const char *i if (ebiptablesExecCLI(&buf, NULL, NULL) < 0) goto tear_down_tmpebchains;
- VIR_FREE(srcIPParam); - return 0;
tear_down_tmpebchains: @@ -3312,8 +3328,6 @@ tear_down_tmpebchains: "%s", _("Some rules could not be created."));
- VIR_FREE(srcIPParam); - return -1; }
If you can explain the rationale for that buf use in the loop, ACK Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel@veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/
On 04/19/2012 05:27 AM, Daniel Veillard wrote:
On Tue, Apr 17, 2012 at 10:44:04AM -0400, Stefan Berger wrote:
Fix the support for trusted DHCP server in the ebtables code's hard-coded function applying DHCP only filtering rules: Rather than using a char * use the more flexible virNWFilterVarValuePtr that contains the trusted DHCP server(s) IP address. Process all entries.
Since all callers so far provided NULL as parameter, no changes are necessary in any other code.
[...]
+ while (true) { + char *srcIPParam = NULL; + + if (idx< num_dhcpsrvrs) { + const char *dhcpserver; + + dhcpserver = virNWFilterVarValueGetNthValue(dhcpsrvrs, idx); + + if (virAsprintf(&srcIPParam, "--ip-src %s", dhcpserver)< 0) { + virReportOOMError(); + goto tear_down_tmpebchains; + } + } + + virBufferAsprintf(&buf, + CMD_DEF("$EBT -t nat -A %s" + " -d %s" + " -p ipv4 --ip-protocol udp" + " %s" + " --ip-sport 67 --ip-dport 68" + " -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + chain_out, + macaddr_str, + srcIPParam != NULL ? srcIPParam : "", + CMD_STOPONERR(1)); + + VIR_FREE(srcIPParam); + + if (idx == num_dhcpsrvrs) + break; + + idx++; + } There is something I don't understand in that loop, you repetedly write to buf, but you don't seems to use buf in the loop. This looks fishy to me, or are you using side effect execution in the Asprintf argument evaluation. Too cryptic to my taste, I'm lost !
I am accumulating (shell) commands in the buffer and then test the buffer for error before finally executing the commands. Stefan
On Thu, Apr 19, 2012 at 06:30:59AM -0400, Stefan Berger wrote:
On 04/19/2012 05:27 AM, Daniel Veillard wrote:
On Tue, Apr 17, 2012 at 10:44:04AM -0400, Stefan Berger wrote:
Fix the support for trusted DHCP server in the ebtables code's hard-coded function applying DHCP only filtering rules: Rather than using a char * use the more flexible virNWFilterVarValuePtr that contains the trusted DHCP server(s) IP address. Process all entries.
Since all callers so far provided NULL as parameter, no changes are necessary in any other code.
[...]
+ while (true) { + char *srcIPParam = NULL; + + if (idx< num_dhcpsrvrs) { + const char *dhcpserver; + + dhcpserver = virNWFilterVarValueGetNthValue(dhcpsrvrs, idx); + + if (virAsprintf(&srcIPParam, "--ip-src %s", dhcpserver)< 0) { + virReportOOMError(); + goto tear_down_tmpebchains; + } + } + + virBufferAsprintf(&buf, + CMD_DEF("$EBT -t nat -A %s" + " -d %s" + " -p ipv4 --ip-protocol udp" + " %s" + " --ip-sport 67 --ip-dport 68" + " -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + chain_out, + macaddr_str, + srcIPParam != NULL ? srcIPParam : "", + CMD_STOPONERR(1)); + + VIR_FREE(srcIPParam); + + if (idx == num_dhcpsrvrs) + break; + + idx++; + } There is something I don't understand in that loop, you repetedly write to buf, but you don't seems to use buf in the loop. This looks fishy to me, or are you using side effect execution in the Asprintf argument evaluation. Too cryptic to my taste, I'm lost !
I am accumulating (shell) commands in the buffer and then test the buffer for error before finally executing the commands.
Okay, virBufferAsprintf contrary to virAsprintf accumulates the writes, makes sense now ... Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel@veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/
This patch adds DHCP snooping support to libvirt. The learning method for IP addresses is specified by setting the "ip_learning" variable to one of "any" [default] (existing IP learning code), "none" (static only addresses) or "dhcp" (DHCP snooping). Active leases are saved in a lease file and reloaded on restart or HUP. The following interface XML activates and uses the DHCP snooping: <interface type='bridge'> <source bridge='virbr0'/> <filterref filter='clean-traffic'> <parameter name='ip_learning' value='dhcp'/> </filterref> </interface> All filters containig the variable 'IP' are automatically adjusted when the VM receives an IP address via DHCP. However, multiple IP addresses per interface are silently ignored in this patch, thus only supporting one IP address per interface. Multiple IP address support is added in a later patch in this series. Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> --- Changes since v10: - using 2 pcap captures now, one for incoming and one for outgoing traffic to prevent libvirt from picking up spoofed DHCP packets and adding bogus leases - more cleanups on variable names Changes since v9: - introduced usage of thread pool for having a worker that evaluates the received DHCP packets and have it instantiate the new filters; it does more time consuming work while the 'normal' thread tries to maximies its time in libpcap packet capture function - added rate limitation for evaluation of DCHP packets to prevent flooding the worker thread - thread startup synchronization to avoid missing packets on a PXE-booting VM that may send DHCP packets early - more work on documentation - introducing #defines for reserved variable names Changes since v8: - naming consistency - memory leaks - if-before-free not being necessary - separate shutdown function (for avoiding a valgrind reporting memory leak) - a compilation error ("%d", strlen()) - pass NULL for a pointer rather than 0 - use common exits where possible - make 'make syntax-check' pass - due to a locking bug resulting in a deadlock reworked the locking and introduced a reference counter for the SnoopReq that must be held while the 'req' variable is accessed; it resulred in finer grained locking with the virNWFilterSnoopLock() - improved on the documentation Changes since v7: - renamed functions as suggested - collected local state into "virNWFilterSnoopState" struct - cleaned up include file list - misc code cleanups per review comments --- docs/formatnwfilter.html.in | 143 +- src/Makefile.am | 2 src/conf/nwfilter_params.h | 5 src/nwfilter/nwfilter_dhcpsnoop.c | 2025 +++++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_dhcpsnoop.h | 39 src/nwfilter/nwfilter_driver.c | 6 src/nwfilter/nwfilter_gentech_driver.c | 63 - 7 files changed, 2238 insertions(+), 45 deletions(-) create mode 100644 src/nwfilter/nwfilter_dhcpsnoop.c create mode 100644 src/nwfilter/nwfilter_dhcpsnoop.h Index: libvirt-acl/docs/formatnwfilter.html.in =================================================================== --- libvirt-acl.orig/docs/formatnwfilter.html.in +++ libvirt-acl/docs/formatnwfilter.html.in @@ -371,6 +371,118 @@ Further, the notation of $VARIABLE is short-hand for $VARIABLE[@0]. The former notation always assumes the iterator with Id '0'. <p> + + <h3><a name="nwfelemsRulesAdvIPAddrDetection">Automatic IP address detection</a></h3> + <p> + The detection of IP addresses used on a virtual machine's interface + is automatically activated if the variable <code>IP</code> is referenced + but not value has been assign to it. + <span class="since">Since 0.9.12</span> + the variable <code>ip_learning</code> can be used to specify + the IP address learning method to use. Valid values are <code>any</code>, + <code>dhcp</code>, or <code>none</code>. + <br/><br/> + The value <code>any</code> means that libvirt may use any packet to + determine the address in use by a virtual machine, which is the default + behavior if the variable <code>ip_learning</code> is not set. This method + will only detect a single IP address on an interface. + Once a VM's IP address has been detected, its IP network traffic + will be locked to that address, if for example IP address spoofing + is prevented by one of its filters. In that case the user of the VM + will not be able to change the IP address on the interface inside + the VM, which would be considered IP address spoofing. + When a VM is migrated to another host or resumed after a suspend operation, + the first packet sent by the VM will again determine the IP address it can + use on a particular interface. + <br/><br> + A value of <code>dhcp</code> specifies that libvirt should only honor DHCP + server-assigned addresses with valid leases. This method supports the detection + and usage of multiple IP address per interface. + When a VM is resumed after a suspend operation, still valid IP address leases + are applied to its filters. Otherwise the VM is expected to again use DHCP to obtain new + IP addresses. The migration of a VM to another physical host requires that + the VM again runs the DHCP protocol. + <br/><br/> + Use of <code>ip_learning=dhcp</code> (DHCP snooping) provides additional + anti-spoofing security, especially when combined with a filter allowing + only trusted DHCP servers to assign addresses. To enable this, set the + variable <code>DHCPSERVER</code> to the IP address of a valid DHCP server + and provide filters that use this variable to filter incoming DHCP responses. + <br/><br/> + When DHCP snooping is enable and the DHCP lease expires, + the VM will no longer be able to use the IP address until it acquires a + new, valid lease from a DHCP server. If the VM is migrated, it must get + a new valid DHCP lease to use an IP address (e.g., by + bringing the VM interface down and up again). + <br/><br/> + Note that automatic DHCP detection listens to the DHCP traffic + the VM exchanges with the DHCP server of the infrastructure. To avoid + denial-of-service attacks on libvirt, the evaluation of those packets + is rate-limited, meaning that a VM sending an excessive number of DHCP + packets per seconds on an interface will not have all of those packets + evaluated and thus filters may not get adapted. Normal DHCP client + behavior is assumed to send a low number of DHCP packets per second. + Further, it is important to setup approriate filters on all VMs in + the infrastructure to avoid them being able to send DHCP + packets. Therefore VMs must either be prevented from sending UDP and TCP + traffic from port 67 to port 68 or the <code>DHCPSERVER</code> + variable should be used on all VMs to restrict DHCP server messages to + only be allowed to originate from trusted DHCP servers. At the same + time anti-spoofing prevention must be enabled on all VMs in the subnet. + <br/><br/> + If <code>ip_learning</code> is set to <code>none</code>, libvirt does not do + IP address learning and referencing <code>IP</code> without assigning it an + explicit value is an error. + <br/><br/> + The following XML provides an example for the activation of IP address learning + using the DHCP snooping method: + </p> +<pre> + <interface type='bridge'> + <source bridge='virbr0'/> + <filterref filter='clean-traffic'> + <parameter name='ip_learning' value='dhcp'/> + </filterref> + </interface> +</pre> + + <h3><a name="nwfelemsReservedVars">Reserved Variables</a></h3> + <p> + The following table lists reserved variables in use by libvirt. + </p> + <table class="top_table"> + <tr> + <th> Variable Name </th> + <th> Semantics </th> + </tr> + <tr> + <td> MAC </td> + <td> The MAC address of the interface </td> + </tr> + <tr> + <td> IP </td> + <td> The list of IP addresses in use by an interface </td> + </tr> + <tr> + <td> IPV6 </td> + <td> Not currently implemented: + the list of IPV6 addresses in use by an interface </td> + </tr> + <tr> + <td> DHCPSERVER </td> + <td> The list of IP addresses of trusted DHCP servers</td> + </tr> + <tr> + <td> DHCPSERVERV6 </td> + <td> Not currently implemented: + The list of IPv6 addresses of trusted DHCP servers</td> + </tr> + <tr> + <td> ip_learning </td> + <td> The choice of the IP address detection mode </td> + </tr> + </table> + <h2><a name="nwfelems">Element and attribute overview</a></h2> <p> @@ -1629,6 +1741,7 @@ The following sections discuss advanced filter configuration topics. </p> + <h4><a name="nwfelemsRulesAdvTracking">Connection tracking</a></h4> <p> The network filtering subsystem (on Linux) makes use of the connection @@ -2161,36 +2274,6 @@ filtering subsystem. </p> - <h3><a name="nwflimitsIP">IP Address Detection</a></h3> - <p> - In case a network filter references the variable - <i>IP</i> and no variable was defined in any higher layer - references to the filter, IP address detection will automatically - be started when the filter is to be instantiated (VM start, interface - hotplug event). Only IPv4 - addresses can be detected and only a single IP address - legitimately in use by a VM on a single interface will be detected. - In case a VM was to use multiple IP address on a single interface - (IP aliasing), - the IP addresses would have to be provided explicitly either - in the network filter itself or as variables used in attributes' - values. These - variables must then be defined in a higher level reference to the filter - and each assigned the value of the IP address that the VM is expected - to be using. - Different IP addresses in use by multiple interfaces of a VM - (one IP address each) will be independently detected. - <br/><br/> - Once a VM's IP address has been detected, its IP network traffic - may be locked to that address, if for example IP address spoofing - is prevented by one of its filters. In that case the user of the VM - will not be able to change the IP address on the interface inside - the VM, which would be considered IP address spoofing. - <br/><br/> - In case a VM is resumed after suspension or migrated, IP address - detection will be restarted. - </p> - <h3><a name="nwflimitsmigr">VM Migration</a></h3> <p> VM migration is only supported if the whole filter tree Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -509,6 +509,8 @@ NWFILTER_DRIVER_SOURCES = \ nwfilter/nwfilter_driver.h nwfilter/nwfilter_driver.c \ nwfilter/nwfilter_gentech_driver.c \ nwfilter/nwfilter_gentech_driver.h \ + nwfilter/nwfilter_dhcpsnoop.c \ + nwfilter/nwfilter_dhcpsnoop.h \ nwfilter/nwfilter_ebiptables_driver.c \ nwfilter/nwfilter_ebiptables_driver.h \ nwfilter/nwfilter_learnipaddr.c \ Index: libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.c =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.c @@ -0,0 +1,2025 @@ +/* + * nwfilter_dhcpsnoop.c: support for DHCP snooping used by a VM + * on an interface + * + * Copyright (C) 2011,2012 IBM Corp. + * + * Authors: + * David L Stevens <dlstevens@us.ibm.com> + * Stefan Berger <stefanb@linux.vnet.ibm.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Based in part on work by Stefan Berger <stefanb@us.ibm.com> + */ + +/* + * Note about testing: + * On the host run in a shell: + * while :; do kill -SIGHUP `pidof libvirtd` ; echo "HUP $RANDOM"; sleep 20; done + * + * Inside a couple of VMs that for example use the 'clean-traffic' filter: + * while :; do kill -SIGTERM `pidof dhclient`; dhclient eth0 ; ifconfig eth0; done + * + * On the host check the lease file and that it's periodically shortened: + * cat /var/run/libvirt/network/nwfilter.leases ; date +%s + * + * On the host also check that the ebtables rules 'look' ok: + * ebtables -t nat -L + */ +#include <config.h> + +#ifdef HAVE_LIBPCAP +#include <pcap.h> +#endif + +#include <fcntl.h> + +#include <arpa/inet.h> +#include <netinet/ip.h> +#include <netinet/udp.h> +#include <net/if.h> + +#include "memory.h" +#include "logging.h" +#include "datatypes.h" +#include "virterror_internal.h" +#include "conf/domain_conf.h" +#include "nwfilter_gentech_driver.h" +#include "nwfilter_dhcpsnoop.h" +#include "virnetdev.h" +#include "virfile.h" +#include "viratomic.h" +#include "threadpool.h" +#include "configmake.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + +#ifdef HAVE_LIBPCAP + +#define LEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.leases" +#define TMPLEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.ltmp" + +struct virNWFilterSnoopState { + /* lease file */ + int leaseFD; + virAtomicInt nLeases; /* number of active leases */ + virAtomicInt wLeases; /* number of written leases */ + virAtomicInt nThreads; /* number of running threads */ + /* thread management */ + virHashTablePtr snoopReqs; + virHashTablePtr ifnameToKey; + virMutex snoopLock; /* protects SnoopReqs and IfNameToKey */ + virHashTablePtr active; + virMutex activeLock; /* protects Active */ +}; + +#define virNWFilterSnoopLock() \ + { virMutexLock(&virNWFilterSnoopState.snoopLock); } +#define virNWFilterSnoopUnlock() \ + { virMutexUnlock(&virNWFilterSnoopState.snoopLock); } +#define virNWFilterSnoopActiveLock() \ + { virMutexLock(&virNWFilterSnoopState.activeLock); } +#define virNWFilterSnoopActiveUnlock() \ + { virMutexUnlock(&virNWFilterSnoopState.activeLock); } + +#define VIR_IFKEY_LEN ((VIR_UUID_STRING_BUFLEN) + (VIR_MAC_STRING_BUFLEN)) + +typedef struct _virNWFilterSnoopReq virNWFilterSnoopReq; +typedef virNWFilterSnoopReq *virNWFilterSnoopReqPtr; + +typedef struct _virNWFilterSnoopIPLease virNWFilterSnoopIPLease; +typedef virNWFilterSnoopIPLease *virNWFilterSnoopIPLeasePtr; + +typedef enum { + THREAD_STATUS_NONE, + THREAD_STATUS_OK, + THREAD_STATUS_FAIL, +} virNWFilterSnoopThreadStatus; + +struct _virNWFilterSnoopReq { + /* + * reference counter: while the req is on the + * publicSnoopReqs hash, the refctr may only + * be modified with the SnoopLock held + */ + unsigned int refctr; + + virNWFilterTechDriverPtr techdriver; + const char *ifname; + int ifindex; + const char *linkdev; + enum virDomainNetType nettype; + char ifkey[VIR_IFKEY_LEN]; + unsigned char macaddr[VIR_MAC_BUFLEN]; + const char *filtername; + virNWFilterHashTablePtr vars; + virNWFilterDriverStatePtr driver; + /* start and end of lease list, ordered by lease time */ + virNWFilterSnoopIPLeasePtr start; + virNWFilterSnoopIPLeasePtr end; + char *threadkey; + + virNWFilterSnoopThreadStatus threadStatus; + virCond threadStatusCond; + + int jobCompletionStatus; + /* the number of submitted jobs in the worker's queue */ + virAtomicInt queueSize; + /* + * protect those members that can change while the + * req is on the public SnoopReq hash and + * at least one reference is held: + * - ifname + * - threadkey + * - start + * - end + * - a lease while it is on the list + * - threadStatus + * (for refctr, see above) + */ + virMutex lock; +}; + +/* + * Note about lock-order: + * 1st: virNWFilterSnoopLock() + * 2nd: virNWFilterSnoopReqLock(req) + * + * Rationale: Former protects the SnoopReqs hash, latter its contents + */ + +struct _virNWFilterSnoopIPLease { + uint32_t ipAddress; + uint32_t ipServer; + virNWFilterSnoopReqPtr snoopReq; + unsigned int timeout; + /* timer list */ + virNWFilterSnoopIPLeasePtr prev; + virNWFilterSnoopIPLeasePtr next; +}; + + +typedef unsigned char Eaddr[6]; + +typedef struct _virNWFilterSnoopEthHdr virNWFilterSnoopEthHdr; +typedef virNWFilterSnoopEthHdr *virNWFilterSnoopEthHdrPtr; + +struct _virNWFilterSnoopEthHdr { + Eaddr eh_dst; + Eaddr eh_src; + unsigned short eh_type; + union { + unsigned char eu_data[0]; + struct vlan_hdr { + unsigned short ev_flags; + unsigned short ev_type; + unsigned char ev_data[0]; + } eu_vlh; + } eth_un; +} ATTRIBUTE_PACKED; + +#define eh_data eth_un.eu_data +#define ehv_data eth_un.eu_vlh.ev_data +#define ehv_type eth_un.eu_vlh.ev_type + + +typedef struct _virNWFilterSnoopDHCPHdr virNWFilterSnoopDHCPHdr; +typedef virNWFilterSnoopDHCPHdr *virNWFilterSnoopDHCPHdrPtr; + +struct _virNWFilterSnoopDHCPHdr { + unsigned char d_op; + unsigned char d_htype; + unsigned char d_hlen; + unsigned char d_hops; + unsigned int d_xid; + unsigned short d_secs; + unsigned short d_flags; + unsigned int d_ciaddr; + unsigned int d_yiaddr; + unsigned int d_siaddr; + unsigned int d_giaddr; + unsigned char d_chaddr[16]; + char d_sname[64]; + char d_file[128]; + unsigned char d_opts[0]; +}; + +/* DHCP options */ + +#define DHCPO_PAD 0 +#define DHCPO_LEASE 51 /* lease time in secs */ +#define DHCPO_MTYPE 53 /* message type */ +#define DHCPO_END 255 /* end of options */ + +/* DHCP message types */ +#define DHCPDECLINE 4 +#define DHCPACK 5 +#define DHCPRELEASE 7 + +#define PCAP_PBUFSIZE 576 /* >= IP/TCP/DHCP headers */ +#define PCAP_POLL_INTERVAL_MS 10*1000 /* 10 secs */ +#define PCAP_READ_MAXERRS 25 /* retries on failing device */ + +typedef struct _virNWFilterDHCPDecodeJob virNWFilterDHCPDecodeJob; +typedef virNWFilterDHCPDecodeJob *virNWFilterDHCPDecodeJobPtr; + +struct _virNWFilterDHCPDecodeJob { + unsigned char packet[PCAP_PBUFSIZE]; + int caplen; + bool fromVM; +}; + +#define DHCP_PKT_RATE 10 /* pkts/sec */ +#define DHCP_PKT_BURST 50 /* pkts/sec */ +#define DHCP_BURST_INTERVAL_S 10 /* sec */ + +#define MAX_QUEUED_JOBS (DHCP_PKT_BURST + 2 * DHCP_PKT_RATE) + +typedef struct _virNWFilterSnoopRateLimitConf virNWFilterSnoopRateLimitConf; +typedef virNWFilterSnoopRateLimitConf *virNWFilterSnoopRateLimitConfPtr; + +struct _virNWFilterSnoopRateLimitConf { + time_t prev; + unsigned int pkt_ctr; + time_t burst; + const unsigned int rate; + const unsigned int burst_rate; + const unsigned int burst_interval; +}; + +/* local function prototypes */ +static int virNWFilterSnoopReqLeaseDel(virNWFilterSnoopReqPtr req, + uint32_t ipaddr, bool update_leasefile); + +static void virNWFilterSnoopReqLock(virNWFilterSnoopReqPtr req); +static void virNWFilterSnoopReqUnlock(virNWFilterSnoopReqPtr req); + +static void virNWFilterSnoopLeaseFileLoad(void); +static void virNWFilterSnoopLeaseFileSave(virNWFilterSnoopIPLeasePtr ipl); + +/* local variables */ +static struct virNWFilterSnoopState virNWFilterSnoopState = { + .leaseFD = -1, +}; + +static const unsigned char dhcp_magic[4] = { 99, 130, 83, 99 }; + + +static char * +virNWFilterSnoopActivate(virThreadPtr thread) +{ + char *key; + unsigned long threadID = (unsigned long int)thread->thread; + + if (virAsprintf(&key, "0x%0*lX", (int)sizeof(threadID)*2, threadID) < 0) { + virReportOOMError(); + return NULL; + } + + virNWFilterSnoopActiveLock(); + + if (virHashAddEntry(virNWFilterSnoopState.active, key, (void *)0x1) < 0) { + VIR_FREE(key); + } + + virNWFilterSnoopActiveUnlock(); + + return key; +} + +static void +virNWFilterSnoopCancel(char **threadKey) +{ + if (*threadKey == NULL) + return; + + virNWFilterSnoopActiveLock(); + + (void) virHashRemoveEntry(virNWFilterSnoopState.active, *threadKey); + VIR_FREE(*threadKey); + + virNWFilterSnoopActiveUnlock(); +} + +static bool +virNWFilterSnoopIsActive(char *threadKey) +{ + void *entry; + + if (threadKey == NULL) + return 0; + + virNWFilterSnoopActiveLock(); + + entry = virHashLookup(virNWFilterSnoopState.active, threadKey); + + virNWFilterSnoopActiveUnlock(); + + return entry != NULL; +} + +/* + * virNWFilterSnoopListAdd - add an IP lease to a list + */ +static void +virNWFilterSnoopListAdd(virNWFilterSnoopIPLeasePtr plnew, + virNWFilterSnoopIPLeasePtr *start, + virNWFilterSnoopIPLeasePtr *end) +{ + virNWFilterSnoopIPLeasePtr pl; + + plnew->next = plnew->prev = 0; + + if (!*start) { + *start = *end = plnew; + return; + } + + for (pl = *end; pl && plnew->timeout < pl->timeout; + pl = pl->prev) + /* empty */ ; + + if (!pl) { + plnew->next = *start; + *start = plnew; + } else { + plnew->next = pl->next; + pl->next = plnew; + } + + plnew->prev = pl; + + if (plnew->next) + plnew->next->prev = plnew; + else + *end = plnew; +} + +/* + * virNWFilterSnoopListDel - remove an IP lease from a list + */ +static void +virNWFilterSnoopListDel(virNWFilterSnoopIPLeasePtr ipl, + virNWFilterSnoopIPLeasePtr *start, + virNWFilterSnoopIPLeasePtr *end) +{ + if (ipl->prev) + ipl->prev->next = ipl->next; + else + *start = ipl->next; + + if (ipl->next) + ipl->next->prev = ipl->prev; + else + *end = ipl->prev; + + ipl->next = ipl->prev = 0; +} + +/* + * virNWFilterSnoopLeaseTimerAdd - add an IP lease to the timer list + */ +static void +virNWFilterSnoopIPLeaseTimerAdd(virNWFilterSnoopIPLeasePtr plnew) +{ + virNWFilterSnoopReqPtr req = plnew->snoopReq; + + /* protect req->start / req->end */ + virNWFilterSnoopReqLock(req); + + virNWFilterSnoopListAdd(plnew, &req->start, &req->end); + + virNWFilterSnoopReqUnlock(req); +} + +/* + * virNWFilterSnoopLeaseTimerDel - remove an IP lease from the timer list + */ +static void +virNWFilterSnoopIPLeaseTimerDel(virNWFilterSnoopIPLeasePtr ipl) +{ + virNWFilterSnoopReqPtr req = ipl->snoopReq; + + /* protect req->start / req->end */ + virNWFilterSnoopReqLock(req); + + virNWFilterSnoopListDel(ipl, &req->start, &req->end); + + virNWFilterSnoopReqUnlock(req); + + ipl->timeout = 0; +} + +/* + * virNWFilterSnoopInstallRule - install rule for a lease + * + * @instantiate: when calling this function in a loop, indicate + * the last call with 'true' here so that the + * rules all get instantiated + * Always calling this with 'true' is fine, but less + * efficient. + */ +static int +virNWFilterSnoopIPLeaseInstallRule(virNWFilterSnoopIPLeasePtr ipl, + bool instantiate) +{ + char ipbuf[INET_ADDRSTRLEN]; + int rc = -1; + virNWFilterVarValuePtr ipVar; + virNWFilterSnoopReqPtr req; + + if (!inet_ntop(AF_INET, &ipl->ipAddress, ipbuf, sizeof(ipbuf))) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("%s: inet_ntop failed " + " (0x%08X)"), + __func__, ipl->ipAddress); + return -1; + } + ipVar = virNWFilterVarValueCreateSimpleCopyValue(ipbuf); + if (!ipVar) { + virReportOOMError(); + return -1; + } + if (virNWFilterHashTablePut(ipl->snoopReq->vars, NWFILTER_VARNAME_IP, + ipVar, 1) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not add variable \"" + NWFILTER_VARNAME_IP "\" to hashmap")); + virNWFilterVarValueFree(ipVar); + return -1; + } + + if (!instantiate) + return 0; + + /* instantiate the filters */ + req = ipl->snoopReq; + + /* protect req->ifname */ + virNWFilterSnoopReqLock(req); + + if (req->ifname) + rc = virNWFilterInstantiateFilterLate(NULL, + req->ifname, + req->ifindex, + req->linkdev, + req->nettype, + req->macaddr, + req->filtername, + req->vars, + req->driver); + + virNWFilterSnoopReqUnlock(req); + + return rc; +} + +/* + * virNWFilterSnoopIPLeaseUpdate - update the timeout on an IP lease + */ +static void +virNWFilterSnoopIPLeaseUpdate(virNWFilterSnoopIPLeasePtr ipl, time_t timeout) +{ + if (timeout < ipl->timeout) + return; /* no take-backs */ + + virNWFilterSnoopIPLeaseTimerDel(ipl); + ipl->timeout = timeout; + virNWFilterSnoopIPLeaseTimerAdd(ipl); +} + +/* + * virNWFilterSnoopGetByIP - lookup IP lease by IP address + */ +static virNWFilterSnoopIPLeasePtr +virNWFilterSnoopIPLeaseGetByIP(virNWFilterSnoopIPLeasePtr start, + uint32_t ipaddr) +{ + virNWFilterSnoopIPLeasePtr pl; + + for (pl = start; pl && pl->ipAddress != ipaddr; pl = pl->next) + /* empty */ ; + return pl; +} + +/* + * virNWFilterSnoopReqLeaseTimerRun - run the IP lease timeout list + */ +static unsigned int +virNWFilterSnoopReqLeaseTimerRun(virNWFilterSnoopReqPtr req) +{ + time_t now = time(0); + + /* protect req->start */ + virNWFilterSnoopReqLock(req); + + while (req->start && req->start->timeout <= now) + virNWFilterSnoopReqLeaseDel(req, req->start->ipAddress, true); + + virNWFilterSnoopReqUnlock(req); + + return 0; +} + +/* + * Get a reference to the given Snoop request + */ +static void +virNWFilterSnoopReqGet(virNWFilterSnoopReqPtr req) +{ + req->refctr++; +} + +/* + * Create a new Snoop request. Initialize it with the given + * interface key. The caller must release the request with a call + * to virNWFilerSnoopReqPut(req). + */ +static virNWFilterSnoopReqPtr +virNWFilterSnoopReqNew(const char *ifkey) +{ + virNWFilterSnoopReqPtr req; + + if (ifkey == NULL || strlen(ifkey) != VIR_IFKEY_LEN - 1) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterSnoopReqNew called with invalid " + "key \"%s\" (%u)"), + ifkey ? ifkey : "", + (unsigned int)strlen(ifkey)); + return NULL; + } + + if (VIR_ALLOC(req) < 0) { + virReportOOMError(); + return NULL; + } + + virNWFilterSnoopReqGet(req); + + req->threadStatus = THREAD_STATUS_NONE; + + if (virMutexInitRecursive(&req->lock) < 0 || + virStrcpyStatic(req->ifkey, ifkey) == NULL || + virCondInit(&req->threadStatusCond) < 0 || + virAtomicIntInit(&req->queueSize) < 0) + VIR_FREE(req); + + return req; +} + +/* + * Free a snoop request unless it is still referenced. + * All its associated leases are also freed. + * The lease file is NOT rewritten. + */ +static void +virNWFilterSnoopReqFree(virNWFilterSnoopReqPtr req) +{ + virNWFilterSnoopIPLeasePtr ipl; + + if (!req) + return; + + if (req->refctr != 0) + return; + + /* free all leases */ + for (ipl = req->start; ipl; ipl = req->start) + virNWFilterSnoopReqLeaseDel(req, ipl->ipAddress, false); + + /* free all req data */ + VIR_FREE(req->ifname); + VIR_FREE(req->linkdev); + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->vars); + + VIR_FREE(req); +} + +/* + * Lock a Snoop request 'req' + */ +static void +virNWFilterSnoopReqLock(virNWFilterSnoopReqPtr req) +{ + virMutexLock(&req->lock); +} + +/* + * Unlock a Snoop request 'req' + */ +static void +virNWFilterSnoopReqUnlock(virNWFilterSnoopReqPtr req) +{ + virMutexUnlock(&req->lock); +} + +/* + * virNWFilterSnoopReqRelease - hash table free function to kill a request + */ +static void +virNWFilterSnoopReqRelease(void *req0, const void *name ATTRIBUTE_UNUSED) +{ + virNWFilterSnoopReqPtr req = (virNWFilterSnoopReqPtr) req0; + + if (!req) + return; + + /* protect req->threadkey */ + virNWFilterSnoopReqLock(req); + + if (req->threadkey) + virNWFilterSnoopCancel(&req->threadkey); + + virNWFilterSnoopReqUnlock(req); + + virNWFilterSnoopReqFree(req); +} + +/* + * virNWFilterSnoopReqGetByIFKey + * + * Get a Snoop request given an interface key; caller must release + * the Snoop request with a call to virNWFilterSnoopReqPut() + */ +static virNWFilterSnoopReqPtr +virNWFilterSnoopReqGetByIFKey(const char *ifkey) +{ + virNWFilterSnoopReqPtr req; + + virNWFilterSnoopLock(); + + req = virHashLookup(virNWFilterSnoopState.snoopReqs, ifkey); + if (req) + virNWFilterSnoopReqGet(req); + + virNWFilterSnoopUnlock(); + + return req; +} + +/* + * Drop the reference to the Snoop request. Don't use the req + * after this call. + */ +static void +virNWFilterSnoopReqPut(virNWFilterSnoopReqPtr req) +{ + if (!req) + return; + + virNWFilterSnoopLock() + + req->refctr--; + + if (req->refctr == 0) { + /* + * delete the request: + * - if we don't find req on the global list anymore + * (this happens during SIGHUP) + * we would keep the request: + * - if we still have a valid lease, keep the req for restarts + */ + if (virHashLookup(virNWFilterSnoopState.snoopReqs, req->ifkey) != req) { + virNWFilterSnoopReqRelease(req, NULL); + } else if (!req->start || req->start->timeout < time(0)) { + (void) virHashRemoveEntry(virNWFilterSnoopState.snoopReqs, + req->ifkey); + } + } + + virNWFilterSnoopUnlock(); +} + +/* + * virNWFilterSnoopReqLeaseAdd - create or update an IP lease + */ +static int +virNWFilterSnoopReqLeaseAdd(virNWFilterSnoopReqPtr req, + virNWFilterSnoopIPLeasePtr plnew, + bool update_leasefile) +{ + virNWFilterSnoopIPLeasePtr pl; + + plnew->snoopReq = req; + + /* protect req->start and the lease */ + virNWFilterSnoopReqLock(req); + + pl = virNWFilterSnoopIPLeaseGetByIP(req->start, plnew->ipAddress); + + if (pl) { + virNWFilterSnoopIPLeaseUpdate(pl, plnew->timeout); + + virNWFilterSnoopReqUnlock(req); + + goto exit; + } + + virNWFilterSnoopReqUnlock(req); + + /* support for multiple addresses requires the ability to add filters + * to existing chains, or to instantiate address lists via + * virNWFilterInstantiateFilterLate(). Until one of those capabilities + * is added, don't allow a new address when one is already assigned to + * this interface. + */ + if (req->start) + return 0; /* silently ignore multiple addresses */ + + if (VIR_ALLOC(pl) < 0) { + virReportOOMError(); + return -1; + } + *pl = *plnew; + + /* protect req->threadkey */ + virNWFilterSnoopReqLock(req); + + if (req->threadkey && virNWFilterSnoopIPLeaseInstallRule(pl, true) < 0) { + virNWFilterSnoopReqUnlock(req); + VIR_FREE(pl); + return -1; + } + + virNWFilterSnoopReqUnlock(req); + + /* put the lease on the req's list */ + virNWFilterSnoopIPLeaseTimerAdd(pl); + + virAtomicIntAdd(&virNWFilterSnoopState.nLeases, 1); + +exit: + if (update_leasefile) + virNWFilterSnoopLeaseFileSave(pl); + + return 0; +} + +/* + * Restore a Snoop request -- walk its list of leases + * and re-build the filtering rules with them + */ +static int +virNWFilterSnoopReqRestore(virNWFilterSnoopReqPtr req) +{ + int ret = 0; + virNWFilterSnoopIPLeasePtr ipl; + + /* protect req->start */ + virNWFilterSnoopReqLock(req); + + for (ipl = req->start; ipl; ipl = ipl->next) { + /* instantiate the rules at the last lease */ + bool is_last = (ipl->next == NULL); + if (virNWFilterSnoopIPLeaseInstallRule(ipl, is_last) < 0) { + ret = -1; + break; + } + } + + virNWFilterSnoopReqUnlock(req); + + return ret; +} + +/* + * virNWFilterSnoopReqLeaseDel - delete an IP lease + * + * @update_leasefile: set to 'true' if the lease expired or the lease + * was returned to the DHCP server and therefore + * this has to be noted in the lease file. + * set to 'false' for any other reason such as for + * example when calling only to free the lease's + * memory or when calling this function while reading + * leases from the file. + * + * Returns 0 on success, -1 if the instantiation of the rules failed + */ +static int +virNWFilterSnoopReqLeaseDel(virNWFilterSnoopReqPtr req, + uint32_t ipaddr, bool update_leasefile) +{ + int ret = 0; + virNWFilterSnoopIPLeasePtr ipl; + + /* protect req->start & req->ifname */ + virNWFilterSnoopReqLock(req); + + ipl = virNWFilterSnoopIPLeaseGetByIP(req->start, ipaddr); + if (ipl == NULL) + goto lease_not_found; + + virNWFilterSnoopIPLeaseTimerDel(ipl); + + if (update_leasefile) { + const virNWFilterVarValuePtr dhcpsrvrs = + virHashLookup(req->vars->hashTable, NWFILTER_VARNAME_DHCPSERVER); + + virNWFilterSnoopLeaseFileSave(ipl); + + /* + * for multiple address support, this needs to remove those rules + * referencing "IP" with ipl's ip value. + */ + if (req->techdriver && + req->techdriver->applyDHCPOnlyRules(req->ifname, req->macaddr, + dhcpsrvrs, false) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterSnoopListDel failed")); + ret = -1; + } + + } + VIR_FREE(ipl); + + virAtomicIntSub(&virNWFilterSnoopState.nLeases, 1); + +lease_not_found: + virNWFilterSnoopReqUnlock(req); + + return ret; +} + +static int +virNWFilterSnoopDHCPGetOpt(virNWFilterSnoopDHCPHdrPtr pd, int len, + int *pmtype, int *pleasetime) +{ + int oind, olen; + int oend; + + olen = len - sizeof(*pd); + oind = 0; + + if (olen < 4) /* bad magic */ + return -1; + + if (memcmp(dhcp_magic, pd->d_opts, sizeof(dhcp_magic)) != 0) + return -1; /* bad magic */ + + oind += sizeof(dhcp_magic); + + oend = 0; + + *pmtype = *pleasetime = 0; + + while (oind < olen) { + switch (pd->d_opts[oind]) { + case DHCPO_LEASE: + if (olen - oind < 6) + goto malformed; + if (*pleasetime) + return -1; /* duplicate lease time */ + *pleasetime = + ntohl(*(unsigned int *) (pd->d_opts + oind + 2)); + break; + case DHCPO_MTYPE: + if (olen - oind < 3) + goto malformed; + if (*pmtype) + return -1; /* duplicate message type */ + *pmtype = pd->d_opts[oind + 2]; + break; + case DHCPO_PAD: + oind++; + continue; + + case DHCPO_END: + oend = 1; + break; + default: + if (olen - oind < 2) + goto malformed; + } + if (oend) + break; + oind += pd->d_opts[oind + 1] + 2; + } + return 0; +malformed: + VIR_WARN("got lost in the options!"); + return -1; +} + +/* + * Decode the DHCP options + * + * Returns 0 in case of full success. + * Returns -2 in case of some error with the packet. + * Returns -1 in case of error with the installation of rules + */ +static int +virNWFilterSnoopDHCPDecode(virNWFilterSnoopReqPtr req, + virNWFilterSnoopEthHdrPtr pep, + int len, bool fromVM) +{ + struct iphdr *pip; + struct udphdr *pup; + virNWFilterSnoopDHCPHdrPtr pd; + virNWFilterSnoopIPLease ipl; + int mtype, leasetime; + + /* go through the protocol headers */ + switch (ntohs(pep->eh_type)) { + case ETHERTYPE_IP: + pip = (struct iphdr *) pep->eh_data; + len -= offsetof(virNWFilterSnoopEthHdr, eh_data); + break; + case ETHERTYPE_VLAN: + if (ntohs(pep->ehv_type) != ETHERTYPE_IP) + return -2; + pip = (struct iphdr *) pep->ehv_data; + len -= offsetof(virNWFilterSnoopEthHdr, ehv_data); + break; + default: + return -2; + } + + if (len < 0) + return -2; + + pip = (struct iphdr *) pep->eh_data; + len -= sizeof(*pep); + if (len < 0) + return -2; + + /* check for spoofed or packets not destined for this VM */ + if (fromVM) { + if (memcmp(req->macaddr, pep->eh_src, 6) != 0) + return -2; + } else { + /* + * packets not destined for us can occurr while the bridge is + * learning the MAC addresses on ports + */ + if (memcmp(req->macaddr, pep->eh_dst, 6) != 0) + return -2; + } + + pup = (struct udphdr *) ((char *) pip + (pip->ihl << 2)); + len -= pip->ihl << 2; + if (len < 0) + return -2; + + pd = (virNWFilterSnoopDHCPHdrPtr) ((char *) pup + sizeof(*pup)); + len -= sizeof(*pup); + if (len < 0) + return -2; /* invalid packet length */ + + if (virNWFilterSnoopDHCPGetOpt(pd, len, &mtype, &leasetime) < 0) + return -2; + + memset(&ipl, 0, sizeof(ipl)); + ipl.ipAddress = pd->d_yiaddr; + ipl.ipServer = pd->d_siaddr; + + if (leasetime == ~0) + ipl.timeout = ~0; + else + ipl.timeout = time(0) + leasetime; + + ipl.snoopReq = req; + + /* check that the type of message comes from the right direction */ + switch (mtype) { + case DHCPACK: + case DHCPDECLINE: + if (fromVM) + return -2; + break; + case DHCPRELEASE: + if (!fromVM) + return -2; + break; + default: + break; + } + + switch (mtype) { + case DHCPACK: + if (virNWFilterSnoopReqLeaseAdd(req, &ipl, true) < 0) + return -1; + break; + case DHCPDECLINE: + case DHCPRELEASE: + if (virNWFilterSnoopReqLeaseDel(req, ipl.ipAddress, true) < 0) + return -1; + break; + default: + return -2; + break; + } + return 0; +} + +static pcap_t * +virNWFilterSnoopDHCPOpen(const char *ifname, const char *filter, + pcap_direction_t dir) +{ + pcap_t *handle = NULL; + struct bpf_program fp; + char pcap_errbuf[PCAP_ERRBUF_SIZE]; + + handle = pcap_open_live(ifname, PCAP_PBUFSIZE, 0, PCAP_POLL_INTERVAL_MS, + pcap_errbuf); + + if (handle == NULL) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_open_live: %s"), pcap_errbuf); + goto cleanup; + } + + if (pcap_compile(handle, &fp, filter, 1, PCAP_NETMASK_UNKNOWN) != 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_compile: %s"), pcap_geterr(handle)); + goto cleanup; + } + + if (pcap_setfilter(handle, &fp) != 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_setfilter: %s"), pcap_geterr(handle)); + goto cleanup_freecode; + } + + if (pcap_setdirection(handle, dir) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_setdirection: %s"), + pcap_geterr(handle)); + goto cleanup_freecode; + } + + pcap_freecode(&fp); + + return handle; + +cleanup_freecode: + pcap_freecode(&fp); +cleanup: + pcap_close(handle); + + return NULL; +} + +/* + * Worker function to decode the DHCP message and with that + * also do the time-consuming work of instantiating the filters + */ +static void virNWFilterDHCPDecodeWorker(void *jobdata, void *opaque) +{ + virNWFilterSnoopReqPtr req = opaque; + virNWFilterDHCPDecodeJobPtr job = jobdata; + virNWFilterSnoopEthHdrPtr packet = (virNWFilterSnoopEthHdrPtr)job->packet; + + if (virNWFilterSnoopDHCPDecode(req, packet, + job->caplen, job->fromVM) == -1) { + req->jobCompletionStatus = -1; + + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Instantiation of rules failed on " + "interface '%s'"), req->ifname); + } + VIR_FREE(job); + virAtomicIntSub(&req->queueSize, 1); +} + +/* + * Submit a job to the worker thread doing the time-consuming work... + */ +static int +virNWFilterSnoopDHCPDecodeJobSubmit(virThreadPoolPtr pool, + virNWFilterSnoopReqPtr req, + virNWFilterSnoopEthHdrPtr pep, + int len, pcap_direction_t dir) +{ + virNWFilterDHCPDecodeJobPtr job; + int ret; + + if (len <= 0 || len > sizeof(job->packet)) + return 0; + + if (VIR_ALLOC(job) < 0) { + virReportOOMError(); + return -1; + } + + memcpy(job->packet, pep, len); + job->caplen = len; + job->fromVM = (dir == PCAP_D_IN); + + ret = virThreadPoolSendJob(pool, 0, job); + + if (ret == 0) + virAtomicIntAdd(&req->queueSize, 1); + + return ret; +} + +/* + * virNWFilterSnoopRateLimit -- limit the rate of jobs submitted to the + * worker thread + * + * Help defend the worker thread from being flooded with likely bogus packets + * sent by the VM. + * + * rl: The state of the rate limiter + * + * Returns the delta of packets compared to the rate, i.e. if the rate + * is 4 (pkts/s) and we now have received 5 within a second, it would + * return 1. If the number of packets is below the rate, it returns 0. + */ +static int +virNWFilterSnoopRateLimit(virNWFilterSnoopRateLimitConfPtr rl) +{ + time_t now = time(0); + int diff; +#define IN_BURST(n,b) ((n)-(b) <= 1) /* bursts span 2 discreet seconds */ + + if (rl->prev != now && !IN_BURST(now, rl->burst)) { + rl->prev = now; + rl->pkt_ctr = 1; + } else { + rl->pkt_ctr++; + if (rl->pkt_ctr >= rl->rate) { + if (IN_BURST(now, rl->burst)) { + /* in a burst */ + diff = rl->pkt_ctr - rl->burst_rate; + if (diff > 0) + return diff; + return 0; + } + if (rl->prev - rl->burst > rl->burst_interval) { + /* this second will start a new burst */ + rl->burst = rl->prev; + return 0; + } + /* previous burst is too close */ + return rl->pkt_ctr - rl->rate; + } + } + + return 0; +} + +/* + * The DHCP snooping thread. It spends most of its time in the pcap + * library and if it gets suitable packets, it submits them to the worker + * thread for processing. + */ +static void +virNWFilterDHCPSnoopThread(void *req0) +{ + virNWFilterSnoopReqPtr req = req0; + struct pcap_pkthdr *hdr; + virNWFilterSnoopEthHdrPtr packet; + int ifindex = 0; + int errcount = 0; + int tmp = -1, i, rv, n; + char *threadkey = NULL; + virThreadPoolPtr worker = NULL; + time_t last_displayed = 0, last_displayed_queue = 0; + struct { + pcap_t *handle; + pcap_direction_t dir; + const char *filter; + } pcapConf[] = { + { + .dir = PCAP_D_IN, /* from VM */ + .filter = "dst port 67 and src port 68", + }, { + .dir = PCAP_D_OUT, /* to VM */ + .filter = "src port 67 and dst port 68", + }, + }; + struct pollfd fds[] = { + { + /* get a POLLERR if interface goes down or disappears */ + .events = POLLIN | POLLERR, + }, { + .events = POLLIN | POLLERR, + }, + }; + virNWFilterSnoopRateLimitConf rateLimit = { + .prev = time(0), + .pkt_ctr = 0, + .burst = 0, + .rate = DHCP_PKT_RATE, + .burst_rate = DHCP_PKT_BURST, + .burst_interval = DHCP_BURST_INTERVAL_S, + }; + bool error = false; + + /* whoever started us increased the reference counter for the req for us */ + + /* protect req->ifname & req->threadkey */ + virNWFilterSnoopReqLock(req); + + if (req->ifname && req->threadkey) { + for (i = 0; i < ARRAY_CARDINALITY(pcapConf); i++) { + pcapConf[i].handle = + virNWFilterSnoopDHCPOpen(req->ifname, pcapConf[i].filter, + pcapConf[i].dir); + if (!pcapConf[i].handle) { + error = true; + break; + } + fds[i].fd = pcap_fileno(pcapConf[i].handle); + } + tmp = virNetDevGetIndex(req->ifname, &ifindex); + threadkey = strdup(req->threadkey); + worker = virThreadPoolNew(1, 1, 0, + virNWFilterDHCPDecodeWorker, + req); + } + + /* let creator know how well we initialized */ + if (error == true || !threadkey || tmp < 0 || !worker || + ifindex != req->ifindex) + req->threadStatus = THREAD_STATUS_FAIL; + else + req->threadStatus = THREAD_STATUS_OK; + + virCondSignal(&req->threadStatusCond); + + virNWFilterSnoopReqUnlock(req); + + if (req->threadStatus != THREAD_STATUS_OK) + goto exit; + + while (!error) { + n = poll(fds, ARRAY_CARDINALITY(fds), 1000 * 10); + + if (n < 0) + error = true; + + virNWFilterSnoopReqLeaseTimerRun(req); + + /* + * Check whether we were cancelled or whether + * a previously submitted job failed. + */ + if (!virNWFilterSnoopIsActive(threadkey) || + req->jobCompletionStatus != 0) + goto exit; + + for (i = 0; n > 0 && i < ARRAY_CARDINALITY(fds); i++) { + if (!fds[i].revents) + continue; + + fds[i].revents = 0; + n--; + + rv = pcap_next_ex(pcapConf[i].handle, &hdr, + (const u_char **)&packet); + + if (rv < 0) { + /* error reading from socket */ + tmp = -1; + + /* protect req->ifname */ + virNWFilterSnoopReqLock(req); + + if (req->ifname) + tmp = virNetDevValidateConfig(req->ifname, NULL, ifindex); + + virNWFilterSnoopReqUnlock(req); + + if (tmp <= 0) { + error = true; + break; + } + + if (++errcount > PCAP_READ_MAXERRS) { + pcap_close(pcapConf[i].handle); + pcapConf[i].handle = NULL; + + /* protect req->ifname */ + virNWFilterSnoopReqLock(req); + + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("interface '%s' failing; " + "reopening"), + req->ifname); + if (req->ifname) + pcapConf[i].handle = + virNWFilterSnoopDHCPOpen(req->ifname, + pcapConf[i].filter, + pcapConf[i].dir); + + virNWFilterSnoopReqUnlock(req); + + if (!pcapConf[i].handle) { + error = true; + break; + } + } + continue; + } + + errcount = 0; + + if (rv) { + int diff; + + /* submit packet to worker thread */ + if (virAtomicIntRead(&req->queueSize) > MAX_QUEUED_JOBS) { + if (last_displayed_queue - time(0) > 10) { + last_displayed_queue = time(0); + VIR_WARN("Worker thread for interface '%s' has a " + "job queue that is too long\n", + req->ifname); + } + continue; + } + + diff = virNWFilterSnoopRateLimit(&rateLimit); + if (diff > 0) { + if (diff > DHCP_PKT_RATE) { + /* twice the allowed rate -- serious flooding */ + usleep(1 * 1000); /* 1 ms */ + } + /* rate-limited warnings */ + if (time(0) - last_displayed > 10) { + last_displayed = time(0); + VIR_WARN("Too many DHCP packets on interface '%s'", + req->ifname); + } + continue; + } + + if (virNWFilterSnoopDHCPDecodeJobSubmit(worker, req, packet, + hdr->caplen, + pcapConf[i].dir) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Job submission failed on " + "interface '%s'"), req->ifname); + error = true; + break; + } + } + } /* for all fds */ + } /* while (!error) */ + + /* protect IfNameToKey */ + virNWFilterSnoopLock(); + + /* protect req->ifname & req->threadkey */ + virNWFilterSnoopReqLock(req); + + virNWFilterSnoopCancel(&req->threadkey); + + (void) virHashRemoveEntry(virNWFilterSnoopState.ifnameToKey, req->ifname); + + VIR_FREE(req->ifname); + + virNWFilterSnoopReqUnlock(req); + virNWFilterSnoopUnlock(); + +exit: + virThreadPoolFree(worker); + + virNWFilterSnoopReqPut(req); + + VIR_FREE(threadkey); + + for (i = 0; i < ARRAY_CARDINALITY(pcapConf); i++) { + if (pcapConf[i].handle) + pcap_close(pcapConf[i].handle); + } + + virAtomicIntSub(&virNWFilterSnoopState.nThreads, 1); + + return; +} + +static void +virNWFilterSnoopIFKeyFMT(char *ifkey, const unsigned char *vmuuid, + unsigned const char *macaddr) +{ + virUUIDFormat(vmuuid, ifkey); + ifkey[VIR_UUID_STRING_BUFLEN - 1] = '-'; + virMacAddrFormat(macaddr, ifkey + VIR_UUID_STRING_BUFLEN); +} + +int +virNWFilterDHCPSnoopReq(virNWFilterTechDriverPtr techdriver, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *vmuuid, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) +{ + virNWFilterSnoopReqPtr req; + bool isnewreq; + char ifkey[VIR_IFKEY_LEN]; + int tmp; + virThread thread; + virNWFilterVarValuePtr dhcpsrvrs; + + virNWFilterSnoopIFKeyFMT(ifkey, vmuuid, macaddr); + + req = virNWFilterSnoopReqGetByIFKey(ifkey); + isnewreq = (req == NULL); + if (!isnewreq) { + if (req->threadkey) { + virNWFilterSnoopReqPut(req); + return 0; + } + /* a recycled req may still have filtername and vars */ + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->vars); + } else { + req = virNWFilterSnoopReqNew(ifkey); + if (!req) + return -1; + } + + req->driver = driver; + req->techdriver = techdriver; + tmp = virNetDevGetIndex(ifname, &req->ifindex); + req->linkdev = linkdev ? strdup(linkdev) : NULL; + req->nettype = nettype; + req->ifname = strdup(ifname); + memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); + req->filtername = strdup(filtername); + req->vars = virNWFilterHashTableCreate(0); + + if (!req->ifname || !req->filtername || !req->vars || tmp < 0) { + virReportOOMError(); + goto exit_snoopreqput; + } + + dhcpsrvrs = virHashLookup(filterparams->hashTable, + NWFILTER_VARNAME_DHCPSERVER); + + if (techdriver->applyDHCPOnlyRules(req->ifname, req->macaddr, + dhcpsrvrs, false) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("applyDHCPOnlyRules " + "failed - spoofing not protected!")); + goto exit_snoopreqput; + } + + if (virNWFilterHashTablePutAll(filterparams, req->vars) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq: can't copy variables" + " on if %s"), ifkey); + goto exit_snoopreqput; + } + + virNWFilterSnoopLock(); + + if (virHashAddEntry(virNWFilterSnoopState.ifnameToKey, ifname, + req->ifkey) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq ifname map failed" + " on interface \"%s\" key \"%s\""), ifname, + ifkey); + goto exit_snoopunlock; + } + + if (isnewreq && + virHashAddEntry(virNWFilterSnoopState.snoopReqs, ifkey, req) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq req add failed on" + " interface \"%s\" ifkey \"%s\""), ifname, + ifkey); + goto exit_rem_ifnametokey; + } + + /* prevent thread from holding req */ + virNWFilterSnoopReqLock(req); + + if (virThreadCreate(&thread, false, virNWFilterDHCPSnoopThread, + req) != 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq virThreadCreate " + "failed on interface '%s'"), ifname); + goto exit_snoopreq_unlock; + } + + virAtomicIntAdd(&virNWFilterSnoopState.nThreads, 1); + + req->threadkey = virNWFilterSnoopActivate(&thread); + if (!req->threadkey) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Actication of snoop request failed on " + "interface '%s'"), req->ifname); + goto exit_snoopreq_unlock; + } + + if (virNWFilterSnoopReqRestore(req) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Restoring of leases failed on " + "interface '%s'"), req->ifname); + goto exit_snoop_cancel; + } + + /* sync with thread */ + if (virCondWait(&req->threadStatusCond, &req->lock) < 0 || + req->threadStatus != THREAD_STATUS_OK) + goto exit_snoop_cancel; + + virNWFilterSnoopReqUnlock(req); + + virNWFilterSnoopUnlock(); + + /* do not 'put' the req -- the thread will do this */ + + return 0; + +exit_snoop_cancel: + virNWFilterSnoopCancel(&req->threadkey); +exit_snoopreq_unlock: + virNWFilterSnoopReqUnlock(req); +exit_rem_ifnametokey: + virHashRemoveEntry(virNWFilterSnoopState.ifnameToKey, ifname); +exit_snoopunlock: + virNWFilterSnoopUnlock(); +exit_snoopreqput: + virNWFilterSnoopReqPut(req); + + return -1; +} + +static void +virNWFilterSnoopLeaseFileClose(void) +{ + VIR_FORCE_CLOSE(virNWFilterSnoopState.leaseFD); +} + +static void +virNWFilterSnoopLeaseFileOpen(void) +{ + virNWFilterSnoopLeaseFileClose(); + + virNWFilterSnoopState.leaseFD = open(LEASEFILE, O_CREAT|O_RDWR|O_APPEND, + 0644); +} + +/* + * Write a single lease to the given file. + * + */ +static int +virNWFilterSnoopLeaseFileWrite(int lfd, const char *ifkey, + virNWFilterSnoopIPLeasePtr ipl) +{ + char lbuf[256], ipstr[INET_ADDRSTRLEN], dhcpstr[INET_ADDRSTRLEN]; + size_t len; + + if (inet_ntop(AF_INET, &ipl->ipAddress, ipstr, sizeof(ipstr)) == 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("inet_ntop(0x%08X) failed"), ipl->ipAddress); + return -1; + } + if (inet_ntop(AF_INET, &ipl->ipServer, dhcpstr, sizeof(dhcpstr)) == 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("inet_ntop(0x%08X) failed"), ipl->ipServer); + return -1; + } + /* time intf ip dhcpserver */ + snprintf(lbuf, sizeof(lbuf), "%u %s %s %s\n", ipl->timeout, + ifkey, ipstr, dhcpstr); + + len = strlen(lbuf); + + if (safewrite(lfd, lbuf, len) != len) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("lease file write failed: %s"), + strerror(errno)); + return -1; + } + + (void) fsync(lfd); + + return 0; +} + +/* + * Append a single lease to the end of the lease file. + * To keep a limited number of dead leases, re-read the lease + * file if the threshold of active leases versus written ones + * exceeds a threshold. + */ +static void +virNWFilterSnoopLeaseFileSave(virNWFilterSnoopIPLeasePtr ipl) +{ + virNWFilterSnoopReqPtr req = ipl->snoopReq; + + virNWFilterSnoopLock(); + + if (virNWFilterSnoopState.leaseFD < 0) + virNWFilterSnoopLeaseFileOpen(); + if (virNWFilterSnoopLeaseFileWrite(virNWFilterSnoopState.leaseFD, + req->ifkey, ipl) < 0) + goto err_exit; + + /* keep dead leases at < ~95% of file size */ + if (virAtomicIntAdd(&virNWFilterSnoopState.wLeases, 1) >= + virAtomicIntRead(&virNWFilterSnoopState.nLeases) * 20) + virNWFilterSnoopLeaseFileLoad(); /* load & refresh lease file */ + +err_exit: + virNWFilterSnoopUnlock(); +} + +/* + * Have requests removed that have no leases. + * Remove all expired leases. + * Call this function with the SnoopLock held. + */ +static int +virNWFilterSnoopPruneIter(const void *payload, + const void *name ATTRIBUTE_UNUSED, + const void *data ATTRIBUTE_UNUSED) +{ + const virNWFilterSnoopReqPtr req = (virNWFilterSnoopReqPtr)payload; + bool del_req; + + /* clean up orphaned, expired leases */ + + /* protect req->threadkey */ + virNWFilterSnoopReqLock(req); + + if (!req->threadkey) + virNWFilterSnoopReqLeaseTimerRun(req); + + /* + * have the entry removed if it has no leases and no one holds a ref + */ + del_req = ((req->start == NULL) && (req->refctr == 0)); + + virNWFilterSnoopReqUnlock(req); + + return del_req; +} + +/* + * Iterator to write all leases of a single request to a file. + * Call this function with the SnoopLock held. + */ +static void +virNWFilterSnoopSaveIter(void *payload, + const void *name ATTRIBUTE_UNUSED, + void *data) +{ + virNWFilterSnoopReqPtr req = payload; + int tfd = *(int *)data; + virNWFilterSnoopIPLeasePtr ipl; + + /* protect req->start */ + virNWFilterSnoopReqLock(req); + + for (ipl = req->start; ipl; ipl = ipl->next) + (void) virNWFilterSnoopLeaseFileWrite(tfd, req->ifkey, ipl); + + virNWFilterSnoopReqUnlock(req); +} + +/* + * Write all valid leases into a temporary file and then + * rename the file to the final file. + * Call this function with the SnoopLock held. + */ +static void +virNWFilterSnoopLeaseFileRefresh(void) +{ + int tfd; + + (void) unlink(TMPLEASEFILE); + /* lease file loaded, delete old one */ + tfd = open(TMPLEASEFILE, O_CREAT|O_RDWR|O_TRUNC|O_EXCL, 0644); + if (tfd < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("open(\"%s\"): %s"), + TMPLEASEFILE, strerror(errno)); + return; + } + + if (virNWFilterSnoopState.snoopReqs) { + /* clean up the requests */ + virHashRemoveSet(virNWFilterSnoopState.snoopReqs, + virNWFilterSnoopPruneIter, NULL); + /* now save them */ + virHashForEach(virNWFilterSnoopState.snoopReqs, + virNWFilterSnoopSaveIter, (void *)&tfd); + } + + VIR_FORCE_CLOSE(tfd); + + if (rename(TMPLEASEFILE, LEASEFILE) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("rename(\"%s\", \"%s\"): %s"), + TMPLEASEFILE, LEASEFILE, strerror(errno)); + (void) unlink(TMPLEASEFILE); + } + virAtomicIntSet(&virNWFilterSnoopState.wLeases, 0); + virNWFilterSnoopLeaseFileOpen(); +} + + +static void +virNWFilterSnoopLeaseFileLoad(void) +{ + char line[256], ifkey[VIR_IFKEY_LEN]; + char ipstr[INET_ADDRSTRLEN], srvstr[INET_ADDRSTRLEN]; + virNWFilterSnoopIPLease ipl; + virNWFilterSnoopReqPtr req; + time_t now; + FILE *fp; + int ln = 0, tmp; + + /* protect the lease file */ + virNWFilterSnoopLock(); + + fp = fopen(LEASEFILE, "r"); + time(&now); + while (fp && fgets(line, sizeof(line), fp)) { + if (line[strlen(line)-1] != '\n') { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterSnoopLeaseFileLoad lease file " + "line %d corrupt"), ln); + break; + } + ln++; + /* key len 55 = "VMUUID"+'-'+"MAC" */ + if (sscanf(line, "%u %55s %16s %16s", &ipl.timeout, + ifkey, ipstr, srvstr) < 4) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterSnoopLeaseFileLoad lease file " + "line %d corrupt"), ln); + break; + } + if (ipl.timeout && ipl.timeout < now) + continue; + req = virNWFilterSnoopReqGetByIFKey(ifkey); + if (!req) { + req = virNWFilterSnoopReqNew(ifkey); + if (!req) + break; + + tmp = virHashAddEntry(virNWFilterSnoopState.snoopReqs, ifkey, req); + + if (tmp < 0) { + virNWFilterSnoopReqPut(req); + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterSnoopLeaseFileLoad req add" + " failed on interface \"%s\""), ifkey); + continue; + } + } + + if (inet_pton(AF_INET, ipstr, &ipl.ipAddress) <= 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("line %d corrupt ipaddr \"%s\""), + ln, ipstr); + virNWFilterSnoopReqPut(req); + continue; + } + (void) inet_pton(AF_INET, srvstr, &ipl.ipServer); + ipl.snoopReq = req; + + if (ipl.timeout) + virNWFilterSnoopReqLeaseAdd(req, &ipl, false); + else + virNWFilterSnoopReqLeaseDel(req, ipl.ipAddress, false); + + virNWFilterSnoopReqPut(req); + } + + VIR_FORCE_FCLOSE(fp); + + virNWFilterSnoopLeaseFileRefresh(); + + virNWFilterSnoopUnlock(); +} + +/* + * Wait until all threads have ended. + */ +static void +virNWFilterSnoopJoinThreads(void) +{ + while (virAtomicIntRead(&virNWFilterSnoopState.nThreads) != 0) { + VIR_WARN("Waiting for snooping threads to terminate: %u\n", + virAtomicIntRead(&virNWFilterSnoopState.nThreads)); + usleep(1000 * 1000); + } +} + +/* + * Iterator to remove a requests, repeatedly called on one + * request after another. + * The requests' ifname is freed allowing for an association + * of the Snoop request's leases with the same VM under a + * different interface name at a later time. + */ +static int +virNWFilterSnoopRemAllReqIter(const void *payload, + const void *name ATTRIBUTE_UNUSED, + const void *data ATTRIBUTE_UNUSED) +{ + const virNWFilterSnoopReqPtr req = (virNWFilterSnoopReqPtr)payload; + + /* protect req->ifname */ + virNWFilterSnoopReqLock(req); + + if (req->ifname) { + (void) virHashRemoveEntry(virNWFilterSnoopState.ifnameToKey, + req->ifname); + + VIR_FREE(req->ifname); + } + + virNWFilterSnoopReqUnlock(req); + + /* removal will call virNWFilterSnoopCancel() */ + return 1; +} + + +/* + * Terminate all threads; keep the SnoopReqs hash allocated + */ +static void +virNWFilterSnoopEndThreads(void) +{ + virNWFilterSnoopLock(); + virHashRemoveSet(virNWFilterSnoopState.snoopReqs, + virNWFilterSnoopRemAllReqIter, + NULL); + virNWFilterSnoopUnlock(); +} + +int +virNWFilterDHCPSnoopInit(void) +{ + if (virNWFilterSnoopState.snoopReqs) + return 0; + + if (virMutexInitRecursive(&virNWFilterSnoopState.snoopLock) < 0 || + virMutexInit(&virNWFilterSnoopState.activeLock) < 0 || + virAtomicIntInit(&virNWFilterSnoopState.nLeases) < 0 || + virAtomicIntInit(&virNWFilterSnoopState.wLeases) < 0 || + virAtomicIntInit(&virNWFilterSnoopState.nThreads) < 0) + return -1; + + virNWFilterSnoopState.ifnameToKey = virHashCreate(0, NULL); + virNWFilterSnoopState.active = virHashCreate(0, NULL); + virNWFilterSnoopState.snoopReqs = + virHashCreate(0, virNWFilterSnoopReqRelease); + + if (!virNWFilterSnoopState.ifnameToKey || + !virNWFilterSnoopState.snoopReqs || + !virNWFilterSnoopState.active) { + virReportOOMError(); + goto err_exit; + } + + virNWFilterSnoopLeaseFileLoad(); + virNWFilterSnoopLeaseFileOpen(); + + return 0; + +err_exit: + virHashFree(virNWFilterSnoopState.ifnameToKey); + virNWFilterSnoopState.ifnameToKey = NULL; + + virHashFree(virNWFilterSnoopState.snoopReqs); + virNWFilterSnoopState.snoopReqs = NULL; + + virHashFree(virNWFilterSnoopState.active); + virNWFilterSnoopState.active = NULL; + + return -1; +} + +void +virNWFilterDHCPSnoopEnd(const char *ifname) +{ + char *ifkey = NULL; + + virNWFilterSnoopLock(); + + if (!virNWFilterSnoopState.snoopReqs) + goto cleanup; + + if (ifname) { + ifkey = (char *)virHashLookup(virNWFilterSnoopState.ifnameToKey, + ifname); + if (!ifkey) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("ifname \"%s\" not in key map"), ifname); + goto cleanup; + } + + (void) virHashRemoveEntry(virNWFilterSnoopState.ifnameToKey, ifname); + } + + if (ifkey) { + virNWFilterSnoopReqPtr req; + + req = virNWFilterSnoopReqGetByIFKey(ifkey); + if (!req) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("ifkey \"%s\" has no req"), ifkey); + goto cleanup; + } + + /* protect req->ifname & req->threadkey */ + virNWFilterSnoopReqLock(req); + + /* keep valid lease req; drop interface association */ + virNWFilterSnoopCancel(&req->threadkey); + + VIR_FREE(req->ifname); + + virNWFilterSnoopReqUnlock(req); + + virNWFilterSnoopReqPut(req); + } else { /* free all of them */ + virNWFilterSnoopLeaseFileClose(); + + virHashRemoveAll(virNWFilterSnoopState.ifnameToKey); + + /* tell the threads to terminate */ + virNWFilterSnoopEndThreads(); + + virNWFilterSnoopLeaseFileLoad(); + } + +cleanup: + virNWFilterSnoopUnlock(); +} + +void +virNWFilterDHCPSnoopShutdown(void) +{ + virNWFilterSnoopEndThreads(); + virNWFilterSnoopJoinThreads(); + + virNWFilterSnoopLock(); + + virNWFilterSnoopLeaseFileClose(); + virHashFree(virNWFilterSnoopState.ifnameToKey); + virHashFree(virNWFilterSnoopState.snoopReqs); + + virNWFilterSnoopUnlock(); + + virNWFilterSnoopActiveLock(); + virHashFree(virNWFilterSnoopState.active); + virNWFilterSnoopActiveUnlock(); +} + +#else /* HAVE_LIBPCAP */ + +int +virNWFilterDHCPSnoopInit(void) +{ + return -1; +} + +void +virNWFilterDHCPSnoopEnd(const char *ifname ATTRIBUTE_UNUSED) +{ + return; +} + +void +virNWFilterDHCPSnoopShutdown(void) +{ + return; +} + +int +virNWFilterDHCPSnoopReq(virNWFilterTechDriverPtr techdriver ATTRIBUTE_UNUSED, + const char *ifname ATTRIBUTE_UNUSED, + const char *linkdev ATTRIBUTE_UNUSED, + enum virDomainNetType nettype ATTRIBUTE_UNUSED, + const unsigned char *vmuuid ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED, + const char *filtername ATTRIBUTE_UNUSED, + virNWFilterHashTablePtr filterparams ATTRIBUTE_UNUSED, + virNWFilterDriverStatePtr driver ATTRIBUTE_UNUSED) +{ + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("libvirt was not compiled " + "with libpcap and \"ip_learning='dhcp'\" requires" + " it.")); + return -1; +} +#endif /* HAVE_LIBPCAP */ Index: libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.h =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.h @@ -0,0 +1,39 @@ +/* + * nwfilter_dhcpsnoop.h: support DHCP snooping for a VM on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 David L Stevens + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: David L Stevens <dlstevens@us.ibm.com> + */ + +#ifndef __NWFILTER_DHCPSNOOP_H +#define __NWFILTER_DHCPSNOOP_H + +int virNWFilterDHCPSnoopInit(void); +void virNWFilterDHCPSnoopShutdown(void); +int virNWFilterDHCPSnoopReq(virNWFilterTechDriverPtr techdriver, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *vmuuid, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); +void virNWFilterDHCPSnoopEnd(const char *ifname); +#endif /* __NWFILTER_DHCPSNOOP_H */ Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -39,6 +39,7 @@ #include "nwfilter_gentech_driver.h" #include "configmake.h" +#include "nwfilter_dhcpsnoop.h" #include "nwfilter_learnipaddr.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER @@ -66,6 +67,8 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; + if (virNWFilterDHCPSnoopInit() < 0) + return -1; if (virNWFilterLearnInit() < 0) return -1; @@ -127,6 +130,7 @@ alloc_err_exit: conf_init_err: virNWFilterTechDriversShutdown(); + virNWFilterDHCPSnoopShutdown(); virNWFilterLearnShutdown(); return -1; @@ -149,6 +153,7 @@ nwfilterDriverReload(void) { conn = virConnectOpen("qemu:///system"); if (conn) { + virNWFilterDHCPSnoopEnd(NULL); /* shut down all threads -- they will be restarted if necessary */ virNWFilterLearnThreadsTerminate(true); @@ -203,6 +208,7 @@ nwfilterDriverShutdown(void) { virNWFilterConfLayerShutdown(); virNWFilterTechDriversShutdown(); + virNWFilterDHCPSnoopShutdown(); virNWFilterLearnShutdown(); nwfilterDriverLock(driverState); Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -32,6 +32,7 @@ #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_dhcpsnoop.h" #include "nwfilter_learnipaddr.h" #include "virnetdev.h" #include "datatypes.h" @@ -39,8 +40,10 @@ #define VIR_FROM_THIS VIR_FROM_NWFILTER -#define NWFILTER_STD_VAR_MAC "MAC" -#define NWFILTER_STD_VAR_IP "IP" +#define NWFILTER_STD_VAR_MAC NWFILTER_VARNAME_MAC +#define NWFILTER_STD_VAR_IP NWFILTER_VARNAME_IP + +#define NWFILTER_DFLT_LEARN "any" static int _virNWFilterTeardownFilter(const char *ifname); @@ -662,6 +665,9 @@ virNWFilterInstantiate(const unsigned ch void **ptrs = NULL; int instantiate = 1; char *buf; + virNWFilterVarValuePtr lv; + const char *learning; + bool reportIP = false; virNWFilterHashTablePtr missing_vars = virNWFilterHashTableCreate(0); if (!missing_vars) { @@ -678,22 +684,47 @@ virNWFilterInstantiate(const unsigned ch if (rc < 0) goto err_exit; + lv = virHashLookup(vars->hashTable, NWFILTER_VARNAME_IP_LEARNING); + if (lv) + learning = virNWFilterVarValueGetNthValue(lv, 0); + else + learning = NULL; + + if (learning == NULL) + learning = NWFILTER_DFLT_LEARN; + if (virHashSize(missing_vars->hashTable) == 1) { if (virHashLookup(missing_vars->hashTable, NWFILTER_STD_VAR_IP) != NULL) { - if (virNWFilterLookupLearnReq(ifindex) == NULL) { - rc = virNWFilterLearnIPAddress(techdriver, - ifname, - ifindex, - linkdev, - nettype, macaddr, - filter->name, - vars, driver, - DETECT_DHCP|DETECT_STATIC); + if (STRCASEEQ(learning, "none")) { /* no learning */ + reportIP = true; + goto err_unresolvable_vars; } - goto err_exit; - } - goto err_unresolvable_vars; + if (STRCASEEQ(learning, "dhcp")) { + rc = virNWFilterDHCPSnoopReq(techdriver, ifname, linkdev, + nettype, vmuuid, macaddr, + filter->name, vars, driver); + goto err_exit; + } else if (STRCASEEQ(learning, "any")) { + if (virNWFilterLookupLearnReq(ifindex) == NULL) { + rc = virNWFilterLearnIPAddress(techdriver, + ifname, + ifindex, + linkdev, + nettype, macaddr, + filter->name, + vars, driver, + DETECT_DHCP|DETECT_STATIC); + } + goto err_exit; + } else { + rc = -1; + virNWFilterReportError(VIR_ERR_PARSE_FAILED, _("filter '%s' " + "learning value '%s' invalid."), + filter->name, learning); + } + } else + goto err_unresolvable_vars; } else if (virHashSize(missing_vars->hashTable) > 1) { goto err_unresolvable_vars; } else if (!forceWithPendingReq && @@ -761,7 +792,7 @@ err_exit: err_unresolvable_vars: - buf = virNWFilterPrintVars(missing_vars->hashTable, ", ", false, false); + buf = virNWFilterPrintVars(missing_vars->hashTable, ", ", false, reportIP); if (buf) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Cannot instantiate filter due to unresolvable " @@ -1092,6 +1123,8 @@ _virNWFilterTeardownFilter(const char *i return -1; } + virNWFilterDHCPSnoopEnd(ifname); + virNWFilterTerminateLearnReq(ifname); if (virNWFilterLockIface(ifname) < 0) Index: libvirt-acl/src/conf/nwfilter_params.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.h +++ libvirt-acl/src/conf/nwfilter_params.h @@ -91,6 +91,11 @@ int virNWFilterHashTablePutAll(virNWFilt # define VALID_VARVALUE \ "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:" +# define NWFILTER_VARNAME_IP "IP" +# define NWFILTER_VARNAME_MAC "MAC" +# define NWFILTER_VARNAME_IP_LEARNING "ip_learning" +# define NWFILTER_VARNAME_DHCPSERVER "DHCPSERVER" + enum virNWFilterVarAccessType { VIR_NWFILTER_VAR_ACCESS_ELEMENT = 0, VIR_NWFILTER_VAR_ACCESS_ITERATOR = 1,
On Tue, Apr 17, 2012 at 10:44:05AM -0400, Stefan Berger wrote:
This patch adds DHCP snooping support to libvirt. The learning method for IP addresses is specified by setting the "ip_learning" variable to one of "any" [default] (existing IP learning code), "none" (static only addresses) or "dhcp" (DHCP snooping).
Active leases are saved in a lease file and reloaded on restart or HUP.
The following interface XML activates and uses the DHCP snooping:
<interface type='bridge'> <source bridge='virbr0'/> <filterref filter='clean-traffic'> <parameter name='ip_learning' value='dhcp'/> </filterref> </interface>
All filters containig the variable 'IP' are automatically adjusted when the VM receives an IP address via DHCP. However, multiple IP addresses per interface are silently ignored in this patch, thus only supporting one IP address per interface. Multiple IP address support is added in a later patch in this series.
Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
---
Changes since v10: - using 2 pcap captures now, one for incoming and one for outgoing traffic to prevent libvirt from picking up spoofed DHCP packets and adding bogus leases - more cleanups on variable names
Changes since v9: - introduced usage of thread pool for having a worker that evaluates the received DHCP packets and have it instantiate the new filters; it does more time consuming work while the 'normal' thread tries to maximies its time in libpcap packet capture function - added rate limitation for evaluation of DCHP packets to prevent flooding the worker thread - thread startup synchronization to avoid missing packets on a PXE-booting VM that may send DHCP packets early - more work on documentation - introducing #defines for reserved variable names
Changes since v8: - naming consistency - memory leaks - if-before-free not being necessary - separate shutdown function (for avoiding a valgrind reporting memory leak) - a compilation error ("%d", strlen()) - pass NULL for a pointer rather than 0 - use common exits where possible - make 'make syntax-check' pass - due to a locking bug resulting in a deadlock reworked the locking and introduced a reference counter for the SnoopReq that must be held while the 'req' variable is accessed; it resulred in finer grained locking with the virNWFilterSnoopLock() - improved on the documentation
Changes since v7: - renamed functions as suggested - collected local state into "virNWFilterSnoopState" struct - cleaned up include file list - misc code cleanups per review comments
--- docs/formatnwfilter.html.in | 143 +- src/Makefile.am | 2 src/conf/nwfilter_params.h | 5 src/nwfilter/nwfilter_dhcpsnoop.c | 2025 +++++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_dhcpsnoop.h | 39 src/nwfilter/nwfilter_driver.c | 6 src/nwfilter/nwfilter_gentech_driver.c | 63 - 7 files changed, 2238 insertions(+), 45 deletions(-) create mode 100644 src/nwfilter/nwfilter_dhcpsnoop.c create mode 100644 src/nwfilter/nwfilter_dhcpsnoop.h
Index: libvirt-acl/docs/formatnwfilter.html.in =================================================================== --- libvirt-acl.orig/docs/formatnwfilter.html.in +++ libvirt-acl/docs/formatnwfilter.html.in @@ -371,6 +371,118 @@ Further, the notation of $VARIABLE is short-hand for $VARIABLE[@0]. The former notation always assumes the iterator with Id '0'. <p> + + <h3><a name="nwfelemsRulesAdvIPAddrDetection">Automatic IP address detection</a></h3> + <p> + The detection of IP addresses used on a virtual machine's interface + is automatically activated if the variable <code>IP</code> is referenced + but not value has been assign to it. + <span class="since">Since 0.9.12</span> + the variable <code>ip_learning</code> can be used to specify + the IP address learning method to use. Valid values are <code>any</code>, + <code>dhcp</code>, or <code>none</code>. + <br/><br/> + The value <code>any</code> means that libvirt may use any packet to + determine the address in use by a virtual machine, which is the default + behavior if the variable <code>ip_learning</code> is not set. This method + will only detect a single IP address on an interface. + Once a VM's IP address has been detected, its IP network traffic + will be locked to that address, if for example IP address spoofing + is prevented by one of its filters. In that case the user of the VM + will not be able to change the IP address on the interface inside + the VM, which would be considered IP address spoofing. + When a VM is migrated to another host or resumed after a suspend operation, + the first packet sent by the VM will again determine the IP address it can + use on a particular interface. + <br/><br> + A value of <code>dhcp</code> specifies that libvirt should only honor DHCP + server-assigned addresses with valid leases. This method supports the detection + and usage of multiple IP address per interface. + When a VM is resumed after a suspend operation, still valid IP address leases + are applied to its filters. Otherwise the VM is expected to again use DHCP to obtain new + IP addresses. The migration of a VM to another physical host requires that + the VM again runs the DHCP protocol. + <br/><br/> + Use of <code>ip_learning=dhcp</code> (DHCP snooping) provides additional + anti-spoofing security, especially when combined with a filter allowing + only trusted DHCP servers to assign addresses. To enable this, set the + variable <code>DHCPSERVER</code> to the IP address of a valid DHCP server + and provide filters that use this variable to filter incoming DHCP responses. + <br/><br/> + When DHCP snooping is enable and the DHCP lease expires, + the VM will no longer be able to use the IP address until it acquires a + new, valid lease from a DHCP server. If the VM is migrated, it must get + a new valid DHCP lease to use an IP address (e.g., by + bringing the VM interface down and up again). + <br/><br/> + Note that automatic DHCP detection listens to the DHCP traffic + the VM exchanges with the DHCP server of the infrastructure. To avoid + denial-of-service attacks on libvirt, the evaluation of those packets + is rate-limited, meaning that a VM sending an excessive number of DHCP + packets per seconds on an interface will not have all of those packets + evaluated and thus filters may not get adapted. Normal DHCP client + behavior is assumed to send a low number of DHCP packets per second. + Further, it is important to setup approriate filters on all VMs in + the infrastructure to avoid them being able to send DHCP + packets. Therefore VMs must either be prevented from sending UDP and TCP + traffic from port 67 to port 68 or the <code>DHCPSERVER</code> + variable should be used on all VMs to restrict DHCP server messages to + only be allowed to originate from trusted DHCP servers. At the same + time anti-spoofing prevention must be enabled on all VMs in the subnet. + <br/><br/> + If <code>ip_learning</code> is set to <code>none</code>, libvirt does not do + IP address learning and referencing <code>IP</code> without assigning it an + explicit value is an error. + <br/><br/> + The following XML provides an example for the activation of IP address learning + using the DHCP snooping method: + </p> +<pre> + <interface type='bridge'> + <source bridge='virbr0'/> + <filterref filter='clean-traffic'> + <parameter name='ip_learning' value='dhcp'/> + </filterref> + </interface> +</pre> + + <h3><a name="nwfelemsReservedVars">Reserved Variables</a></h3> + <p> + The following table lists reserved variables in use by libvirt. + </p> + <table class="top_table"> + <tr> + <th> Variable Name </th> + <th> Semantics </th> + </tr> + <tr> + <td> MAC </td> + <td> The MAC address of the interface </td> + </tr> + <tr> + <td> IP </td> + <td> The list of IP addresses in use by an interface </td> + </tr> + <tr> + <td> IPV6 </td> + <td> Not currently implemented: + the list of IPV6 addresses in use by an interface </td> + </tr> + <tr> + <td> DHCPSERVER </td> + <td> The list of IP addresses of trusted DHCP servers</td> + </tr> + <tr> + <td> DHCPSERVERV6 </td> + <td> Not currently implemented: + The list of IPv6 addresses of trusted DHCP servers</td> + </tr> + <tr> + <td> ip_learning </td> + <td> The choice of the IP address detection mode </td> + </tr> + </table> + <h2><a name="nwfelems">Element and attribute overview</a></h2>
<p> @@ -1629,6 +1741,7 @@ The following sections discuss advanced filter configuration topics. </p> + <h4><a name="nwfelemsRulesAdvTracking">Connection tracking</a></h4> <p> The network filtering subsystem (on Linux) makes use of the connection @@ -2161,36 +2274,6 @@ filtering subsystem. </p>
- <h3><a name="nwflimitsIP">IP Address Detection</a></h3> - <p> - In case a network filter references the variable - <i>IP</i> and no variable was defined in any higher layer - references to the filter, IP address detection will automatically - be started when the filter is to be instantiated (VM start, interface - hotplug event). Only IPv4 - addresses can be detected and only a single IP address - legitimately in use by a VM on a single interface will be detected. - In case a VM was to use multiple IP address on a single interface - (IP aliasing), - the IP addresses would have to be provided explicitly either - in the network filter itself or as variables used in attributes' - values. These - variables must then be defined in a higher level reference to the filter - and each assigned the value of the IP address that the VM is expected - to be using. - Different IP addresses in use by multiple interfaces of a VM - (one IP address each) will be independently detected. - <br/><br/> - Once a VM's IP address has been detected, its IP network traffic - may be locked to that address, if for example IP address spoofing - is prevented by one of its filters. In that case the user of the VM - will not be able to change the IP address on the interface inside - the VM, which would be considered IP address spoofing. - <br/><br/> - In case a VM is resumed after suspension or migrated, IP address - detection will be restarted. - </p> - <h3><a name="nwflimitsmigr">VM Migration</a></h3> <p> VM migration is only supported if the whole filter tree Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -509,6 +509,8 @@ NWFILTER_DRIVER_SOURCES = \ nwfilter/nwfilter_driver.h nwfilter/nwfilter_driver.c \ nwfilter/nwfilter_gentech_driver.c \ nwfilter/nwfilter_gentech_driver.h \ + nwfilter/nwfilter_dhcpsnoop.c \ + nwfilter/nwfilter_dhcpsnoop.h \ nwfilter/nwfilter_ebiptables_driver.c \ nwfilter/nwfilter_ebiptables_driver.h \ nwfilter/nwfilter_learnipaddr.c \ Index: libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.c =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.c @@ -0,0 +1,2025 @@ +/* + * nwfilter_dhcpsnoop.c: support for DHCP snooping used by a VM + * on an interface + * + * Copyright (C) 2011,2012 IBM Corp. + * + * Authors: + * David L Stevens <dlstevens@us.ibm.com> + * Stefan Berger <stefanb@linux.vnet.ibm.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Based in part on work by Stefan Berger <stefanb@us.ibm.com> + */ + +/* + * Note about testing: + * On the host run in a shell: + * while :; do kill -SIGHUP `pidof libvirtd` ; echo "HUP $RANDOM"; sleep 20; done + * + * Inside a couple of VMs that for example use the 'clean-traffic' filter: + * while :; do kill -SIGTERM `pidof dhclient`; dhclient eth0 ; ifconfig eth0; done + * + * On the host check the lease file and that it's periodically shortened: + * cat /var/run/libvirt/network/nwfilter.leases ; date +%s + * + * On the host also check that the ebtables rules 'look' ok: + * ebtables -t nat -L + */ +#include <config.h> + +#ifdef HAVE_LIBPCAP +#include <pcap.h> +#endif + +#include <fcntl.h> + +#include <arpa/inet.h> +#include <netinet/ip.h> +#include <netinet/udp.h> +#include <net/if.h> + +#include "memory.h" +#include "logging.h" +#include "datatypes.h" +#include "virterror_internal.h" +#include "conf/domain_conf.h" +#include "nwfilter_gentech_driver.h" +#include "nwfilter_dhcpsnoop.h" +#include "virnetdev.h" +#include "virfile.h" +#include "viratomic.h" +#include "threadpool.h" +#include "configmake.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + +#ifdef HAVE_LIBPCAP + +#define LEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.leases" +#define TMPLEASEFILE LOCALSTATEDIR "/run/libvirt/network/nwfilter.ltmp" + +struct virNWFilterSnoopState { + /* lease file */ + int leaseFD; + virAtomicInt nLeases; /* number of active leases */ + virAtomicInt wLeases; /* number of written leases */ + virAtomicInt nThreads; /* number of running threads */ + /* thread management */ + virHashTablePtr snoopReqs; + virHashTablePtr ifnameToKey; + virMutex snoopLock; /* protects SnoopReqs and IfNameToKey */ + virHashTablePtr active; + virMutex activeLock; /* protects Active */ +}; + +#define virNWFilterSnoopLock() \ + { virMutexLock(&virNWFilterSnoopState.snoopLock); } +#define virNWFilterSnoopUnlock() \ + { virMutexUnlock(&virNWFilterSnoopState.snoopLock); } +#define virNWFilterSnoopActiveLock() \ + { virMutexLock(&virNWFilterSnoopState.activeLock); } +#define virNWFilterSnoopActiveUnlock() \ + { virMutexUnlock(&virNWFilterSnoopState.activeLock); } + +#define VIR_IFKEY_LEN ((VIR_UUID_STRING_BUFLEN) + (VIR_MAC_STRING_BUFLEN)) + +typedef struct _virNWFilterSnoopReq virNWFilterSnoopReq; +typedef virNWFilterSnoopReq *virNWFilterSnoopReqPtr; + +typedef struct _virNWFilterSnoopIPLease virNWFilterSnoopIPLease; +typedef virNWFilterSnoopIPLease *virNWFilterSnoopIPLeasePtr; + +typedef enum { + THREAD_STATUS_NONE, + THREAD_STATUS_OK, + THREAD_STATUS_FAIL, +} virNWFilterSnoopThreadStatus; + +struct _virNWFilterSnoopReq { + /* + * reference counter: while the req is on the + * publicSnoopReqs hash, the refctr may only + * be modified with the SnoopLock held + */ + unsigned int refctr; + + virNWFilterTechDriverPtr techdriver; + const char *ifname; + int ifindex; + const char *linkdev; + enum virDomainNetType nettype; + char ifkey[VIR_IFKEY_LEN]; + unsigned char macaddr[VIR_MAC_BUFLEN]; + const char *filtername; + virNWFilterHashTablePtr vars; + virNWFilterDriverStatePtr driver; + /* start and end of lease list, ordered by lease time */ + virNWFilterSnoopIPLeasePtr start; + virNWFilterSnoopIPLeasePtr end; + char *threadkey; + + virNWFilterSnoopThreadStatus threadStatus; + virCond threadStatusCond; + + int jobCompletionStatus; + /* the number of submitted jobs in the worker's queue */ + virAtomicInt queueSize; + /* + * protect those members that can change while the + * req is on the public SnoopReq hash and + * at least one reference is held: + * - ifname + * - threadkey + * - start + * - end + * - a lease while it is on the list + * - threadStatus + * (for refctr, see above) + */ + virMutex lock; +}; + +/* + * Note about lock-order: + * 1st: virNWFilterSnoopLock() + * 2nd: virNWFilterSnoopReqLock(req) + * + * Rationale: Former protects the SnoopReqs hash, latter its contents + */ + +struct _virNWFilterSnoopIPLease { + uint32_t ipAddress; + uint32_t ipServer; + virNWFilterSnoopReqPtr snoopReq; + unsigned int timeout; + /* timer list */ + virNWFilterSnoopIPLeasePtr prev; + virNWFilterSnoopIPLeasePtr next; +}; + + +typedef unsigned char Eaddr[6]; + +typedef struct _virNWFilterSnoopEthHdr virNWFilterSnoopEthHdr; +typedef virNWFilterSnoopEthHdr *virNWFilterSnoopEthHdrPtr; + +struct _virNWFilterSnoopEthHdr { + Eaddr eh_dst; + Eaddr eh_src; + unsigned short eh_type; + union { + unsigned char eu_data[0]; + struct vlan_hdr { + unsigned short ev_flags; + unsigned short ev_type; + unsigned char ev_data[0]; + } eu_vlh; + } eth_un; +} ATTRIBUTE_PACKED; + +#define eh_data eth_un.eu_data +#define ehv_data eth_un.eu_vlh.ev_data +#define ehv_type eth_un.eu_vlh.ev_type + + +typedef struct _virNWFilterSnoopDHCPHdr virNWFilterSnoopDHCPHdr; +typedef virNWFilterSnoopDHCPHdr *virNWFilterSnoopDHCPHdrPtr; + +struct _virNWFilterSnoopDHCPHdr { + unsigned char d_op; + unsigned char d_htype; + unsigned char d_hlen; + unsigned char d_hops; + unsigned int d_xid; + unsigned short d_secs; + unsigned short d_flags; + unsigned int d_ciaddr; + unsigned int d_yiaddr; + unsigned int d_siaddr; + unsigned int d_giaddr; + unsigned char d_chaddr[16]; + char d_sname[64]; + char d_file[128]; + unsigned char d_opts[0]; +}; + +/* DHCP options */ + +#define DHCPO_PAD 0 +#define DHCPO_LEASE 51 /* lease time in secs */ +#define DHCPO_MTYPE 53 /* message type */ +#define DHCPO_END 255 /* end of options */ + +/* DHCP message types */ +#define DHCPDECLINE 4 +#define DHCPACK 5 +#define DHCPRELEASE 7 + +#define PCAP_PBUFSIZE 576 /* >= IP/TCP/DHCP headers */ +#define PCAP_POLL_INTERVAL_MS 10*1000 /* 10 secs */ +#define PCAP_READ_MAXERRS 25 /* retries on failing device */ + +typedef struct _virNWFilterDHCPDecodeJob virNWFilterDHCPDecodeJob; +typedef virNWFilterDHCPDecodeJob *virNWFilterDHCPDecodeJobPtr; + +struct _virNWFilterDHCPDecodeJob { + unsigned char packet[PCAP_PBUFSIZE]; + int caplen; + bool fromVM; +}; + +#define DHCP_PKT_RATE 10 /* pkts/sec */ +#define DHCP_PKT_BURST 50 /* pkts/sec */ +#define DHCP_BURST_INTERVAL_S 10 /* sec */ + +#define MAX_QUEUED_JOBS (DHCP_PKT_BURST + 2 * DHCP_PKT_RATE) + +typedef struct _virNWFilterSnoopRateLimitConf virNWFilterSnoopRateLimitConf; +typedef virNWFilterSnoopRateLimitConf *virNWFilterSnoopRateLimitConfPtr; + +struct _virNWFilterSnoopRateLimitConf { + time_t prev; + unsigned int pkt_ctr; + time_t burst; + const unsigned int rate; + const unsigned int burst_rate; + const unsigned int burst_interval; +}; + +/* local function prototypes */ +static int virNWFilterSnoopReqLeaseDel(virNWFilterSnoopReqPtr req, + uint32_t ipaddr, bool update_leasefile); + +static void virNWFilterSnoopReqLock(virNWFilterSnoopReqPtr req); +static void virNWFilterSnoopReqUnlock(virNWFilterSnoopReqPtr req); + +static void virNWFilterSnoopLeaseFileLoad(void); +static void virNWFilterSnoopLeaseFileSave(virNWFilterSnoopIPLeasePtr ipl); + +/* local variables */ +static struct virNWFilterSnoopState virNWFilterSnoopState = { + .leaseFD = -1, +}; + +static const unsigned char dhcp_magic[4] = { 99, 130, 83, 99 }; + + +static char * +virNWFilterSnoopActivate(virThreadPtr thread) +{ + char *key; + unsigned long threadID = (unsigned long int)thread->thread; + + if (virAsprintf(&key, "0x%0*lX", (int)sizeof(threadID)*2, threadID) < 0) { + virReportOOMError(); + return NULL; + } + + virNWFilterSnoopActiveLock(); + + if (virHashAddEntry(virNWFilterSnoopState.active, key, (void *)0x1) < 0) { + VIR_FREE(key); + } + + virNWFilterSnoopActiveUnlock(); + + return key; +} + +static void +virNWFilterSnoopCancel(char **threadKey) +{ + if (*threadKey == NULL) + return; + + virNWFilterSnoopActiveLock(); + + (void) virHashRemoveEntry(virNWFilterSnoopState.active, *threadKey); + VIR_FREE(*threadKey); + + virNWFilterSnoopActiveUnlock(); +} + +static bool +virNWFilterSnoopIsActive(char *threadKey) +{ + void *entry; + + if (threadKey == NULL) + return 0; + + virNWFilterSnoopActiveLock(); + + entry = virHashLookup(virNWFilterSnoopState.active, threadKey); + + virNWFilterSnoopActiveUnlock(); + + return entry != NULL; +} + +/* + * virNWFilterSnoopListAdd - add an IP lease to a list + */ +static void +virNWFilterSnoopListAdd(virNWFilterSnoopIPLeasePtr plnew, + virNWFilterSnoopIPLeasePtr *start, + virNWFilterSnoopIPLeasePtr *end) +{ + virNWFilterSnoopIPLeasePtr pl; + + plnew->next = plnew->prev = 0; + + if (!*start) { + *start = *end = plnew; + return; + } + + for (pl = *end; pl && plnew->timeout < pl->timeout; + pl = pl->prev) + /* empty */ ; + + if (!pl) { + plnew->next = *start; + *start = plnew; + } else { + plnew->next = pl->next; + pl->next = plnew; + } + + plnew->prev = pl; + + if (plnew->next) + plnew->next->prev = plnew; + else + *end = plnew; +} + +/* + * virNWFilterSnoopListDel - remove an IP lease from a list + */ +static void +virNWFilterSnoopListDel(virNWFilterSnoopIPLeasePtr ipl, + virNWFilterSnoopIPLeasePtr *start, + virNWFilterSnoopIPLeasePtr *end) +{ + if (ipl->prev) + ipl->prev->next = ipl->next; + else + *start = ipl->next; + + if (ipl->next) + ipl->next->prev = ipl->prev; + else + *end = ipl->prev; + + ipl->next = ipl->prev = 0;
Please use NULL to set pointers to zero
+} + +/* + * virNWFilterSnoopLeaseTimerAdd - add an IP lease to the timer list + */ +static void +virNWFilterSnoopIPLeaseTimerAdd(virNWFilterSnoopIPLeasePtr plnew) +{ + virNWFilterSnoopReqPtr req = plnew->snoopReq; + + /* protect req->start / req->end */ + virNWFilterSnoopReqLock(req); + + virNWFilterSnoopListAdd(plnew, &req->start, &req->end); + + virNWFilterSnoopReqUnlock(req); +} + +/* + * virNWFilterSnoopLeaseTimerDel - remove an IP lease from the timer list + */ +static void +virNWFilterSnoopIPLeaseTimerDel(virNWFilterSnoopIPLeasePtr ipl) +{ + virNWFilterSnoopReqPtr req = ipl->snoopReq; + + /* protect req->start / req->end */ + virNWFilterSnoopReqLock(req); + + virNWFilterSnoopListDel(ipl, &req->start, &req->end); + + virNWFilterSnoopReqUnlock(req); + + ipl->timeout = 0; +} + +/* + * virNWFilterSnoopInstallRule - install rule for a lease + * + * @instantiate: when calling this function in a loop, indicate + * the last call with 'true' here so that the + * rules all get instantiated + * Always calling this with 'true' is fine, but less + * efficient. + */ +static int +virNWFilterSnoopIPLeaseInstallRule(virNWFilterSnoopIPLeasePtr ipl, + bool instantiate) +{ + char ipbuf[INET_ADDRSTRLEN]; + int rc = -1; + virNWFilterVarValuePtr ipVar; + virNWFilterSnoopReqPtr req; + + if (!inet_ntop(AF_INET, &ipl->ipAddress, ipbuf, sizeof(ipbuf))) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("%s: inet_ntop failed " + " (0x%08X)"), + __func__, ipl->ipAddress); + return -1; + } + ipVar = virNWFilterVarValueCreateSimpleCopyValue(ipbuf); + if (!ipVar) { + virReportOOMError(); + return -1; + } + if (virNWFilterHashTablePut(ipl->snoopReq->vars, NWFILTER_VARNAME_IP, + ipVar, 1) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not add variable \"" + NWFILTER_VARNAME_IP "\" to hashmap")); + virNWFilterVarValueFree(ipVar); + return -1; + } + + if (!instantiate) + return 0; + + /* instantiate the filters */ + req = ipl->snoopReq; + + /* protect req->ifname */ + virNWFilterSnoopReqLock(req); + + if (req->ifname) + rc = virNWFilterInstantiateFilterLate(NULL, + req->ifname, + req->ifindex, + req->linkdev, + req->nettype, + req->macaddr, + req->filtername, + req->vars, + req->driver); + + virNWFilterSnoopReqUnlock(req); + + return rc; +} + +/* + * virNWFilterSnoopIPLeaseUpdate - update the timeout on an IP lease + */ +static void +virNWFilterSnoopIPLeaseUpdate(virNWFilterSnoopIPLeasePtr ipl, time_t timeout) +{ + if (timeout < ipl->timeout) + return; /* no take-backs */ + + virNWFilterSnoopIPLeaseTimerDel(ipl); + ipl->timeout = timeout; + virNWFilterSnoopIPLeaseTimerAdd(ipl); +} + +/* + * virNWFilterSnoopGetByIP - lookup IP lease by IP address + */ +static virNWFilterSnoopIPLeasePtr +virNWFilterSnoopIPLeaseGetByIP(virNWFilterSnoopIPLeasePtr start, + uint32_t ipaddr) +{ + virNWFilterSnoopIPLeasePtr pl; + + for (pl = start; pl && pl->ipAddress != ipaddr; pl = pl->next) + /* empty */ ; + return pl; +} + +/* + * virNWFilterSnoopReqLeaseTimerRun - run the IP lease timeout list + */ +static unsigned int +virNWFilterSnoopReqLeaseTimerRun(virNWFilterSnoopReqPtr req) +{ + time_t now = time(0); + + /* protect req->start */ + virNWFilterSnoopReqLock(req); + + while (req->start && req->start->timeout <= now) + virNWFilterSnoopReqLeaseDel(req, req->start->ipAddress, true); + + virNWFilterSnoopReqUnlock(req); + + return 0; +} + +/* + * Get a reference to the given Snoop request + */ +static void +virNWFilterSnoopReqGet(virNWFilterSnoopReqPtr req) +{ + req->refctr++;
Sounds racy I would lock here, unless this is expected to be called while already locked (in which case should be documented, but why make a function for it then ?)
+} + +/* + * Create a new Snoop request. Initialize it with the given + * interface key. The caller must release the request with a call + * to virNWFilerSnoopReqPut(req). + */ +static virNWFilterSnoopReqPtr +virNWFilterSnoopReqNew(const char *ifkey) +{ + virNWFilterSnoopReqPtr req; + + if (ifkey == NULL || strlen(ifkey) != VIR_IFKEY_LEN - 1) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterSnoopReqNew called with invalid " + "key \"%s\" (%u)"), + ifkey ? ifkey : "", + (unsigned int)strlen(ifkey)); + return NULL; + } + + if (VIR_ALLOC(req) < 0) { + virReportOOMError(); + return NULL; + } + + virNWFilterSnoopReqGet(req); + + req->threadStatus = THREAD_STATUS_NONE; + + if (virMutexInitRecursive(&req->lock) < 0 || + virStrcpyStatic(req->ifkey, ifkey) == NULL || + virCondInit(&req->threadStatusCond) < 0 || + virAtomicIntInit(&req->queueSize) < 0) + VIR_FREE(req); + + return req; +} + +/* + * Free a snoop request unless it is still referenced. + * All its associated leases are also freed. + * The lease file is NOT rewritten. + */ +static void +virNWFilterSnoopReqFree(virNWFilterSnoopReqPtr req) +{ + virNWFilterSnoopIPLeasePtr ipl; + + if (!req) + return; + + if (req->refctr != 0) + return; + + /* free all leases */ + for (ipl = req->start; ipl; ipl = req->start) + virNWFilterSnoopReqLeaseDel(req, ipl->ipAddress, false); + + /* free all req data */ + VIR_FREE(req->ifname); + VIR_FREE(req->linkdev); + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->vars); + + VIR_FREE(req); +} + +/* + * Lock a Snoop request 'req' + */ +static void +virNWFilterSnoopReqLock(virNWFilterSnoopReqPtr req) +{ + virMutexLock(&req->lock); +} + +/* + * Unlock a Snoop request 'req' + */ +static void +virNWFilterSnoopReqUnlock(virNWFilterSnoopReqPtr req) +{ + virMutexUnlock(&req->lock); +} + +/* + * virNWFilterSnoopReqRelease - hash table free function to kill a request + */ +static void +virNWFilterSnoopReqRelease(void *req0, const void *name ATTRIBUTE_UNUSED) +{ + virNWFilterSnoopReqPtr req = (virNWFilterSnoopReqPtr) req0; + + if (!req) + return; + + /* protect req->threadkey */ + virNWFilterSnoopReqLock(req); + + if (req->threadkey) + virNWFilterSnoopCancel(&req->threadkey); + + virNWFilterSnoopReqUnlock(req); + + virNWFilterSnoopReqFree(req); +} + +/* + * virNWFilterSnoopReqGetByIFKey + * + * Get a Snoop request given an interface key; caller must release + * the Snoop request with a call to virNWFilterSnoopReqPut() + */ +static virNWFilterSnoopReqPtr +virNWFilterSnoopReqGetByIFKey(const char *ifkey) +{ + virNWFilterSnoopReqPtr req; + + virNWFilterSnoopLock(); + + req = virHashLookup(virNWFilterSnoopState.snoopReqs, ifkey); + if (req) + virNWFilterSnoopReqGet(req); + + virNWFilterSnoopUnlock(); + + return req; +} + +/* + * Drop the reference to the Snoop request. Don't use the req + * after this call. + */ +static void +virNWFilterSnoopReqPut(virNWFilterSnoopReqPtr req) +{ + if (!req) + return; + + virNWFilterSnoopLock() + + req->refctr--; + + if (req->refctr == 0) { + /* + * delete the request: + * - if we don't find req on the global list anymore + * (this happens during SIGHUP) + * we would keep the request: + * - if we still have a valid lease, keep the req for restarts + */ + if (virHashLookup(virNWFilterSnoopState.snoopReqs, req->ifkey) != req) { + virNWFilterSnoopReqRelease(req, NULL); + } else if (!req->start || req->start->timeout < time(0)) { + (void) virHashRemoveEntry(virNWFilterSnoopState.snoopReqs, + req->ifkey); + } + } + + virNWFilterSnoopUnlock(); +} + +/* + * virNWFilterSnoopReqLeaseAdd - create or update an IP lease + */ +static int +virNWFilterSnoopReqLeaseAdd(virNWFilterSnoopReqPtr req, + virNWFilterSnoopIPLeasePtr plnew, + bool update_leasefile) +{ + virNWFilterSnoopIPLeasePtr pl; + + plnew->snoopReq = req; + + /* protect req->start and the lease */ + virNWFilterSnoopReqLock(req); + + pl = virNWFilterSnoopIPLeaseGetByIP(req->start, plnew->ipAddress); + + if (pl) { + virNWFilterSnoopIPLeaseUpdate(pl, plnew->timeout); + + virNWFilterSnoopReqUnlock(req); + + goto exit; + } + + virNWFilterSnoopReqUnlock(req); + + /* support for multiple addresses requires the ability to add filters + * to existing chains, or to instantiate address lists via + * virNWFilterInstantiateFilterLate(). Until one of those capabilities + * is added, don't allow a new address when one is already assigned to + * this interface. + */ + if (req->start) + return 0; /* silently ignore multiple addresses */ + + if (VIR_ALLOC(pl) < 0) { + virReportOOMError(); + return -1; + } + *pl = *plnew; + + /* protect req->threadkey */ + virNWFilterSnoopReqLock(req); + + if (req->threadkey && virNWFilterSnoopIPLeaseInstallRule(pl, true) < 0) { + virNWFilterSnoopReqUnlock(req); + VIR_FREE(pl); + return -1; + } + + virNWFilterSnoopReqUnlock(req); + + /* put the lease on the req's list */ + virNWFilterSnoopIPLeaseTimerAdd(pl); + + virAtomicIntAdd(&virNWFilterSnoopState.nLeases, 1); + +exit: + if (update_leasefile) + virNWFilterSnoopLeaseFileSave(pl); + + return 0; +} + +/* + * Restore a Snoop request -- walk its list of leases + * and re-build the filtering rules with them + */ +static int +virNWFilterSnoopReqRestore(virNWFilterSnoopReqPtr req) +{ + int ret = 0; + virNWFilterSnoopIPLeasePtr ipl; + + /* protect req->start */ + virNWFilterSnoopReqLock(req); + + for (ipl = req->start; ipl; ipl = ipl->next) { + /* instantiate the rules at the last lease */ + bool is_last = (ipl->next == NULL); + if (virNWFilterSnoopIPLeaseInstallRule(ipl, is_last) < 0) { + ret = -1; + break; + } + } + + virNWFilterSnoopReqUnlock(req); + + return ret; +} + +/* + * virNWFilterSnoopReqLeaseDel - delete an IP lease + * + * @update_leasefile: set to 'true' if the lease expired or the lease + * was returned to the DHCP server and therefore + * this has to be noted in the lease file. + * set to 'false' for any other reason such as for + * example when calling only to free the lease's + * memory or when calling this function while reading + * leases from the file. + * + * Returns 0 on success, -1 if the instantiation of the rules failed + */ +static int +virNWFilterSnoopReqLeaseDel(virNWFilterSnoopReqPtr req, + uint32_t ipaddr, bool update_leasefile) +{ + int ret = 0; + virNWFilterSnoopIPLeasePtr ipl; + + /* protect req->start & req->ifname */ + virNWFilterSnoopReqLock(req); + + ipl = virNWFilterSnoopIPLeaseGetByIP(req->start, ipaddr); + if (ipl == NULL) + goto lease_not_found; + + virNWFilterSnoopIPLeaseTimerDel(ipl); + + if (update_leasefile) { + const virNWFilterVarValuePtr dhcpsrvrs = + virHashLookup(req->vars->hashTable, NWFILTER_VARNAME_DHCPSERVER); + + virNWFilterSnoopLeaseFileSave(ipl); + + /* + * for multiple address support, this needs to remove those rules + * referencing "IP" with ipl's ip value. + */ + if (req->techdriver && + req->techdriver->applyDHCPOnlyRules(req->ifname, req->macaddr, + dhcpsrvrs, false) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterSnoopListDel failed")); + ret = -1; + } + + } + VIR_FREE(ipl); + + virAtomicIntSub(&virNWFilterSnoopState.nLeases, 1); + +lease_not_found: + virNWFilterSnoopReqUnlock(req); + + return ret; +} + +static int +virNWFilterSnoopDHCPGetOpt(virNWFilterSnoopDHCPHdrPtr pd, int len, + int *pmtype, int *pleasetime) +{ + int oind, olen; + int oend; + + olen = len - sizeof(*pd); + oind = 0; + + if (olen < 4) /* bad magic */ + return -1; + + if (memcmp(dhcp_magic, pd->d_opts, sizeof(dhcp_magic)) != 0) + return -1; /* bad magic */ + + oind += sizeof(dhcp_magic); + + oend = 0; + + *pmtype = *pleasetime = 0; + + while (oind < olen) { + switch (pd->d_opts[oind]) { + case DHCPO_LEASE: + if (olen - oind < 6) + goto malformed; + if (*pleasetime) + return -1; /* duplicate lease time */ + *pleasetime = + ntohl(*(unsigned int *) (pd->d_opts + oind + 2)); + break; + case DHCPO_MTYPE: + if (olen - oind < 3) + goto malformed; + if (*pmtype) + return -1; /* duplicate message type */ + *pmtype = pd->d_opts[oind + 2]; + break; + case DHCPO_PAD: + oind++; + continue; + + case DHCPO_END: + oend = 1; + break; + default: + if (olen - oind < 2) + goto malformed; + } + if (oend) + break; + oind += pd->d_opts[oind + 1] + 2; + } + return 0; +malformed: + VIR_WARN("got lost in the options!"); + return -1; +} + +/* + * Decode the DHCP options + * + * Returns 0 in case of full success. + * Returns -2 in case of some error with the packet. + * Returns -1 in case of error with the installation of rules + */ +static int +virNWFilterSnoopDHCPDecode(virNWFilterSnoopReqPtr req, + virNWFilterSnoopEthHdrPtr pep, + int len, bool fromVM) +{ + struct iphdr *pip; + struct udphdr *pup; + virNWFilterSnoopDHCPHdrPtr pd; + virNWFilterSnoopIPLease ipl; + int mtype, leasetime; + + /* go through the protocol headers */ + switch (ntohs(pep->eh_type)) { + case ETHERTYPE_IP: + pip = (struct iphdr *) pep->eh_data; + len -= offsetof(virNWFilterSnoopEthHdr, eh_data); + break; + case ETHERTYPE_VLAN: + if (ntohs(pep->ehv_type) != ETHERTYPE_IP) + return -2; + pip = (struct iphdr *) pep->ehv_data; + len -= offsetof(virNWFilterSnoopEthHdr, ehv_data); + break; + default: + return -2; + } + + if (len < 0) + return -2; + + pip = (struct iphdr *) pep->eh_data; + len -= sizeof(*pep); + if (len < 0) + return -2; + + /* check for spoofed or packets not destined for this VM */ + if (fromVM) { + if (memcmp(req->macaddr, pep->eh_src, 6) != 0) + return -2; + } else { + /* + * packets not destined for us can occurr while the bridge is + * learning the MAC addresses on ports + */ + if (memcmp(req->macaddr, pep->eh_dst, 6) != 0) + return -2; + } + + pup = (struct udphdr *) ((char *) pip + (pip->ihl << 2)); + len -= pip->ihl << 2; + if (len < 0) + return -2; + + pd = (virNWFilterSnoopDHCPHdrPtr) ((char *) pup + sizeof(*pup)); + len -= sizeof(*pup); + if (len < 0) + return -2; /* invalid packet length */ + + if (virNWFilterSnoopDHCPGetOpt(pd, len, &mtype, &leasetime) < 0) + return -2; + + memset(&ipl, 0, sizeof(ipl)); + ipl.ipAddress = pd->d_yiaddr; + ipl.ipServer = pd->d_siaddr; + + if (leasetime == ~0) + ipl.timeout = ~0; + else + ipl.timeout = time(0) + leasetime; + + ipl.snoopReq = req; + + /* check that the type of message comes from the right direction */ + switch (mtype) { + case DHCPACK: + case DHCPDECLINE: + if (fromVM) + return -2; + break; + case DHCPRELEASE: + if (!fromVM) + return -2; + break; + default: + break; + } + + switch (mtype) { + case DHCPACK: + if (virNWFilterSnoopReqLeaseAdd(req, &ipl, true) < 0) + return -1; + break; + case DHCPDECLINE: + case DHCPRELEASE: + if (virNWFilterSnoopReqLeaseDel(req, ipl.ipAddress, true) < 0) + return -1; + break; + default: + return -2; + break; + } + return 0; +} + +static pcap_t * +virNWFilterSnoopDHCPOpen(const char *ifname, const char *filter, + pcap_direction_t dir) +{ + pcap_t *handle = NULL; + struct bpf_program fp; + char pcap_errbuf[PCAP_ERRBUF_SIZE]; + + handle = pcap_open_live(ifname, PCAP_PBUFSIZE, 0, PCAP_POLL_INTERVAL_MS, + pcap_errbuf); + + if (handle == NULL) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_open_live: %s"), pcap_errbuf); + goto cleanup; + } + + if (pcap_compile(handle, &fp, filter, 1, PCAP_NETMASK_UNKNOWN) != 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_compile: %s"), pcap_geterr(handle)); + goto cleanup; + } + + if (pcap_setfilter(handle, &fp) != 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_setfilter: %s"), pcap_geterr(handle)); + goto cleanup_freecode; + } + + if (pcap_setdirection(handle, dir) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("pcap_setdirection: %s"), + pcap_geterr(handle)); + goto cleanup_freecode; + } + + pcap_freecode(&fp); + + return handle; + +cleanup_freecode: + pcap_freecode(&fp); +cleanup: + pcap_close(handle); + + return NULL; +} + +/* + * Worker function to decode the DHCP message and with that + * also do the time-consuming work of instantiating the filters + */ +static void virNWFilterDHCPDecodeWorker(void *jobdata, void *opaque) +{ + virNWFilterSnoopReqPtr req = opaque; + virNWFilterDHCPDecodeJobPtr job = jobdata; + virNWFilterSnoopEthHdrPtr packet = (virNWFilterSnoopEthHdrPtr)job->packet; + + if (virNWFilterSnoopDHCPDecode(req, packet, + job->caplen, job->fromVM) == -1) { + req->jobCompletionStatus = -1; + + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Instantiation of rules failed on " + "interface '%s'"), req->ifname); + } + VIR_FREE(job); + virAtomicIntSub(&req->queueSize, 1); +} + +/* + * Submit a job to the worker thread doing the time-consuming work... + */ +static int +virNWFilterSnoopDHCPDecodeJobSubmit(virThreadPoolPtr pool, + virNWFilterSnoopReqPtr req, + virNWFilterSnoopEthHdrPtr pep, + int len, pcap_direction_t dir) +{ + virNWFilterDHCPDecodeJobPtr job; + int ret; + + if (len <= 0 || len > sizeof(job->packet)) + return 0; + + if (VIR_ALLOC(job) < 0) { + virReportOOMError(); + return -1; + } + + memcpy(job->packet, pep, len); + job->caplen = len; + job->fromVM = (dir == PCAP_D_IN); + + ret = virThreadPoolSendJob(pool, 0, job); + + if (ret == 0) + virAtomicIntAdd(&req->queueSize, 1); + + return ret; +} + +/* + * virNWFilterSnoopRateLimit -- limit the rate of jobs submitted to the + * worker thread + * + * Help defend the worker thread from being flooded with likely bogus packets + * sent by the VM. + * + * rl: The state of the rate limiter + * + * Returns the delta of packets compared to the rate, i.e. if the rate + * is 4 (pkts/s) and we now have received 5 within a second, it would + * return 1. If the number of packets is below the rate, it returns 0. + */ +static int +virNWFilterSnoopRateLimit(virNWFilterSnoopRateLimitConfPtr rl) +{ + time_t now = time(0); + int diff; +#define IN_BURST(n,b) ((n)-(b) <= 1) /* bursts span 2 discreet seconds */ + + if (rl->prev != now && !IN_BURST(now, rl->burst)) { + rl->prev = now; + rl->pkt_ctr = 1; + } else { + rl->pkt_ctr++; + if (rl->pkt_ctr >= rl->rate) { + if (IN_BURST(now, rl->burst)) { + /* in a burst */ + diff = rl->pkt_ctr - rl->burst_rate; + if (diff > 0) + return diff; + return 0; + } + if (rl->prev - rl->burst > rl->burst_interval) { + /* this second will start a new burst */ + rl->burst = rl->prev; + return 0; + } + /* previous burst is too close */ + return rl->pkt_ctr - rl->rate; + } + } + + return 0; +} + +/* + * The DHCP snooping thread. It spends most of its time in the pcap + * library and if it gets suitable packets, it submits them to the worker + * thread for processing. + */ +static void +virNWFilterDHCPSnoopThread(void *req0) +{ + virNWFilterSnoopReqPtr req = req0; + struct pcap_pkthdr *hdr; + virNWFilterSnoopEthHdrPtr packet; + int ifindex = 0; + int errcount = 0; + int tmp = -1, i, rv, n; + char *threadkey = NULL; + virThreadPoolPtr worker = NULL; + time_t last_displayed = 0, last_displayed_queue = 0; + struct { + pcap_t *handle; + pcap_direction_t dir; + const char *filter; + } pcapConf[] = { + { + .dir = PCAP_D_IN, /* from VM */ + .filter = "dst port 67 and src port 68", + }, { + .dir = PCAP_D_OUT, /* to VM */ + .filter = "src port 67 and dst port 68", + }, + }; + struct pollfd fds[] = { + { + /* get a POLLERR if interface goes down or disappears */ + .events = POLLIN | POLLERR, + }, { + .events = POLLIN | POLLERR, + }, + }; + virNWFilterSnoopRateLimitConf rateLimit = { + .prev = time(0), + .pkt_ctr = 0, + .burst = 0, + .rate = DHCP_PKT_RATE, + .burst_rate = DHCP_PKT_BURST, + .burst_interval = DHCP_BURST_INTERVAL_S, + }; + bool error = false; + + /* whoever started us increased the reference counter for the req for us */ + + /* protect req->ifname & req->threadkey */ + virNWFilterSnoopReqLock(req); + + if (req->ifname && req->threadkey) { + for (i = 0; i < ARRAY_CARDINALITY(pcapConf); i++) { + pcapConf[i].handle = + virNWFilterSnoopDHCPOpen(req->ifname, pcapConf[i].filter, + pcapConf[i].dir); + if (!pcapConf[i].handle) { + error = true; + break; + } + fds[i].fd = pcap_fileno(pcapConf[i].handle); + } + tmp = virNetDevGetIndex(req->ifname, &ifindex); + threadkey = strdup(req->threadkey); + worker = virThreadPoolNew(1, 1, 0, + virNWFilterDHCPDecodeWorker, + req); + } + + /* let creator know how well we initialized */ + if (error == true || !threadkey || tmp < 0 || !worker || + ifindex != req->ifindex) + req->threadStatus = THREAD_STATUS_FAIL; + else + req->threadStatus = THREAD_STATUS_OK; + + virCondSignal(&req->threadStatusCond); + + virNWFilterSnoopReqUnlock(req); + + if (req->threadStatus != THREAD_STATUS_OK) + goto exit; + + while (!error) { + n = poll(fds, ARRAY_CARDINALITY(fds), 1000 * 10); + + if (n < 0) + error = true; + + virNWFilterSnoopReqLeaseTimerRun(req); + + /* + * Check whether we were cancelled or whether + * a previously submitted job failed. + */ + if (!virNWFilterSnoopIsActive(threadkey) || + req->jobCompletionStatus != 0) + goto exit; + + for (i = 0; n > 0 && i < ARRAY_CARDINALITY(fds); i++) { + if (!fds[i].revents) + continue; + + fds[i].revents = 0; + n--; + + rv = pcap_next_ex(pcapConf[i].handle, &hdr, + (const u_char **)&packet); + + if (rv < 0) { + /* error reading from socket */ + tmp = -1; + + /* protect req->ifname */ + virNWFilterSnoopReqLock(req); + + if (req->ifname) + tmp = virNetDevValidateConfig(req->ifname, NULL, ifindex); + + virNWFilterSnoopReqUnlock(req); + + if (tmp <= 0) { + error = true; + break; + } + + if (++errcount > PCAP_READ_MAXERRS) { + pcap_close(pcapConf[i].handle); + pcapConf[i].handle = NULL; + + /* protect req->ifname */ + virNWFilterSnoopReqLock(req); + + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("interface '%s' failing; " + "reopening"), + req->ifname); + if (req->ifname) + pcapConf[i].handle = + virNWFilterSnoopDHCPOpen(req->ifname, + pcapConf[i].filter, + pcapConf[i].dir); + + virNWFilterSnoopReqUnlock(req); + + if (!pcapConf[i].handle) { + error = true; + break; + } + } + continue; + } + + errcount = 0; + + if (rv) { + int diff; + + /* submit packet to worker thread */ + if (virAtomicIntRead(&req->queueSize) > MAX_QUEUED_JOBS) { + if (last_displayed_queue - time(0) > 10) { + last_displayed_queue = time(0); + VIR_WARN("Worker thread for interface '%s' has a " + "job queue that is too long\n", + req->ifname); + } + continue; + } + + diff = virNWFilterSnoopRateLimit(&rateLimit); + if (diff > 0) { + if (diff > DHCP_PKT_RATE) { + /* twice the allowed rate -- serious flooding */ + usleep(1 * 1000); /* 1 ms */ + } + /* rate-limited warnings */ + if (time(0) - last_displayed > 10) { + last_displayed = time(0); + VIR_WARN("Too many DHCP packets on interface '%s'", + req->ifname); + } + continue; + } + + if (virNWFilterSnoopDHCPDecodeJobSubmit(worker, req, packet, + hdr->caplen, + pcapConf[i].dir) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Job submission failed on " + "interface '%s'"), req->ifname); + error = true; + break; + } + } + } /* for all fds */ + } /* while (!error) */ + + /* protect IfNameToKey */ + virNWFilterSnoopLock(); + + /* protect req->ifname & req->threadkey */ + virNWFilterSnoopReqLock(req); + + virNWFilterSnoopCancel(&req->threadkey); + + (void) virHashRemoveEntry(virNWFilterSnoopState.ifnameToKey, req->ifname); + + VIR_FREE(req->ifname); + + virNWFilterSnoopReqUnlock(req); + virNWFilterSnoopUnlock(); + +exit: + virThreadPoolFree(worker); + + virNWFilterSnoopReqPut(req); + + VIR_FREE(threadkey); + + for (i = 0; i < ARRAY_CARDINALITY(pcapConf); i++) { + if (pcapConf[i].handle) + pcap_close(pcapConf[i].handle); + } + + virAtomicIntSub(&virNWFilterSnoopState.nThreads, 1); + + return; +} + +static void +virNWFilterSnoopIFKeyFMT(char *ifkey, const unsigned char *vmuuid, + unsigned const char *macaddr) +{ + virUUIDFormat(vmuuid, ifkey); + ifkey[VIR_UUID_STRING_BUFLEN - 1] = '-'; + virMacAddrFormat(macaddr, ifkey + VIR_UUID_STRING_BUFLEN); +} + +int +virNWFilterDHCPSnoopReq(virNWFilterTechDriverPtr techdriver, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *vmuuid, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) +{ + virNWFilterSnoopReqPtr req; + bool isnewreq; + char ifkey[VIR_IFKEY_LEN]; + int tmp; + virThread thread; + virNWFilterVarValuePtr dhcpsrvrs; + + virNWFilterSnoopIFKeyFMT(ifkey, vmuuid, macaddr); + + req = virNWFilterSnoopReqGetByIFKey(ifkey); + isnewreq = (req == NULL); + if (!isnewreq) { + if (req->threadkey) { + virNWFilterSnoopReqPut(req); + return 0; + } + /* a recycled req may still have filtername and vars */ + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->vars); + } else { + req = virNWFilterSnoopReqNew(ifkey); + if (!req) + return -1; + } + + req->driver = driver; + req->techdriver = techdriver; + tmp = virNetDevGetIndex(ifname, &req->ifindex); + req->linkdev = linkdev ? strdup(linkdev) : NULL; + req->nettype = nettype; + req->ifname = strdup(ifname); + memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); + req->filtername = strdup(filtername); + req->vars = virNWFilterHashTableCreate(0); + + if (!req->ifname || !req->filtername || !req->vars || tmp < 0) { + virReportOOMError(); + goto exit_snoopreqput; + } + + dhcpsrvrs = virHashLookup(filterparams->hashTable, + NWFILTER_VARNAME_DHCPSERVER); + + if (techdriver->applyDHCPOnlyRules(req->ifname, req->macaddr, + dhcpsrvrs, false) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("applyDHCPOnlyRules " + "failed - spoofing not protected!")); + goto exit_snoopreqput; + } + + if (virNWFilterHashTablePutAll(filterparams, req->vars) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq: can't copy variables" + " on if %s"), ifkey); + goto exit_snoopreqput; + } + + virNWFilterSnoopLock(); + + if (virHashAddEntry(virNWFilterSnoopState.ifnameToKey, ifname, + req->ifkey) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq ifname map failed" + " on interface \"%s\" key \"%s\""), ifname, + ifkey); + goto exit_snoopunlock; + } + + if (isnewreq && + virHashAddEntry(virNWFilterSnoopState.snoopReqs, ifkey, req) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq req add failed on" + " interface \"%s\" ifkey \"%s\""), ifname, + ifkey); + goto exit_rem_ifnametokey; + } + + /* prevent thread from holding req */ + virNWFilterSnoopReqLock(req); + + if (virThreadCreate(&thread, false, virNWFilterDHCPSnoopThread, + req) != 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterDHCPSnoopReq virThreadCreate " + "failed on interface '%s'"), ifname); + goto exit_snoopreq_unlock; + } + + virAtomicIntAdd(&virNWFilterSnoopState.nThreads, 1); + + req->threadkey = virNWFilterSnoopActivate(&thread); + if (!req->threadkey) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Actication of snoop request failed on " + "interface '%s'"), req->ifname); + goto exit_snoopreq_unlock; + } + + if (virNWFilterSnoopReqRestore(req) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Restoring of leases failed on " + "interface '%s'"), req->ifname); + goto exit_snoop_cancel; + } + + /* sync with thread */ + if (virCondWait(&req->threadStatusCond, &req->lock) < 0 || + req->threadStatus != THREAD_STATUS_OK) + goto exit_snoop_cancel; + + virNWFilterSnoopReqUnlock(req); + + virNWFilterSnoopUnlock(); + + /* do not 'put' the req -- the thread will do this */ + + return 0; + +exit_snoop_cancel: + virNWFilterSnoopCancel(&req->threadkey); +exit_snoopreq_unlock: + virNWFilterSnoopReqUnlock(req); +exit_rem_ifnametokey: + virHashRemoveEntry(virNWFilterSnoopState.ifnameToKey, ifname); +exit_snoopunlock: + virNWFilterSnoopUnlock(); +exit_snoopreqput: + virNWFilterSnoopReqPut(req); + + return -1; +} + +static void +virNWFilterSnoopLeaseFileClose(void) +{ + VIR_FORCE_CLOSE(virNWFilterSnoopState.leaseFD); +} + +static void +virNWFilterSnoopLeaseFileOpen(void) +{ + virNWFilterSnoopLeaseFileClose(); + + virNWFilterSnoopState.leaseFD = open(LEASEFILE, O_CREAT|O_RDWR|O_APPEND, + 0644); +} + +/* + * Write a single lease to the given file. + * + */ +static int +virNWFilterSnoopLeaseFileWrite(int lfd, const char *ifkey, + virNWFilterSnoopIPLeasePtr ipl) +{ + char lbuf[256], ipstr[INET_ADDRSTRLEN], dhcpstr[INET_ADDRSTRLEN]; + size_t len; + + if (inet_ntop(AF_INET, &ipl->ipAddress, ipstr, sizeof(ipstr)) == 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("inet_ntop(0x%08X) failed"), ipl->ipAddress); + return -1; + } + if (inet_ntop(AF_INET, &ipl->ipServer, dhcpstr, sizeof(dhcpstr)) == 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("inet_ntop(0x%08X) failed"), ipl->ipServer); + return -1; + } + /* time intf ip dhcpserver */ + snprintf(lbuf, sizeof(lbuf), "%u %s %s %s\n", ipl->timeout, + ifkey, ipstr, dhcpstr); + + len = strlen(lbuf); + + if (safewrite(lfd, lbuf, len) != len) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("lease file write failed: %s"), + strerror(errno)); + return -1; + } + + (void) fsync(lfd); + + return 0; +} + +/* + * Append a single lease to the end of the lease file. + * To keep a limited number of dead leases, re-read the lease + * file if the threshold of active leases versus written ones + * exceeds a threshold. + */ +static void +virNWFilterSnoopLeaseFileSave(virNWFilterSnoopIPLeasePtr ipl) +{ + virNWFilterSnoopReqPtr req = ipl->snoopReq; + + virNWFilterSnoopLock(); + + if (virNWFilterSnoopState.leaseFD < 0) + virNWFilterSnoopLeaseFileOpen(); + if (virNWFilterSnoopLeaseFileWrite(virNWFilterSnoopState.leaseFD, + req->ifkey, ipl) < 0) + goto err_exit; + + /* keep dead leases at < ~95% of file size */ + if (virAtomicIntAdd(&virNWFilterSnoopState.wLeases, 1) >= + virAtomicIntRead(&virNWFilterSnoopState.nLeases) * 20) + virNWFilterSnoopLeaseFileLoad(); /* load & refresh lease file */ + +err_exit: + virNWFilterSnoopUnlock(); +} + +/* + * Have requests removed that have no leases. + * Remove all expired leases. + * Call this function with the SnoopLock held. + */ +static int +virNWFilterSnoopPruneIter(const void *payload, + const void *name ATTRIBUTE_UNUSED, + const void *data ATTRIBUTE_UNUSED) +{ + const virNWFilterSnoopReqPtr req = (virNWFilterSnoopReqPtr)payload; + bool del_req; + + /* clean up orphaned, expired leases */ + + /* protect req->threadkey */ + virNWFilterSnoopReqLock(req); + + if (!req->threadkey) + virNWFilterSnoopReqLeaseTimerRun(req); + + /* + * have the entry removed if it has no leases and no one holds a ref + */ + del_req = ((req->start == NULL) && (req->refctr == 0)); + + virNWFilterSnoopReqUnlock(req); + + return del_req; +} + +/* + * Iterator to write all leases of a single request to a file. + * Call this function with the SnoopLock held. + */ +static void +virNWFilterSnoopSaveIter(void *payload, + const void *name ATTRIBUTE_UNUSED, + void *data) +{ + virNWFilterSnoopReqPtr req = payload; + int tfd = *(int *)data; + virNWFilterSnoopIPLeasePtr ipl; + + /* protect req->start */ + virNWFilterSnoopReqLock(req); + + for (ipl = req->start; ipl; ipl = ipl->next) + (void) virNWFilterSnoopLeaseFileWrite(tfd, req->ifkey, ipl); + + virNWFilterSnoopReqUnlock(req); +} + +/* + * Write all valid leases into a temporary file and then + * rename the file to the final file. + * Call this function with the SnoopLock held. + */ +static void +virNWFilterSnoopLeaseFileRefresh(void) +{ + int tfd; + + (void) unlink(TMPLEASEFILE); + /* lease file loaded, delete old one */ + tfd = open(TMPLEASEFILE, O_CREAT|O_RDWR|O_TRUNC|O_EXCL, 0644); + if (tfd < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("open(\"%s\"): %s"), + TMPLEASEFILE, strerror(errno)); + return; + } + + if (virNWFilterSnoopState.snoopReqs) { + /* clean up the requests */ + virHashRemoveSet(virNWFilterSnoopState.snoopReqs, + virNWFilterSnoopPruneIter, NULL); + /* now save them */ + virHashForEach(virNWFilterSnoopState.snoopReqs, + virNWFilterSnoopSaveIter, (void *)&tfd); + } + + VIR_FORCE_CLOSE(tfd); + + if (rename(TMPLEASEFILE, LEASEFILE) < 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("rename(\"%s\", \"%s\"): %s"), + TMPLEASEFILE, LEASEFILE, strerror(errno)); + (void) unlink(TMPLEASEFILE); + } + virAtomicIntSet(&virNWFilterSnoopState.wLeases, 0); + virNWFilterSnoopLeaseFileOpen(); +} + + +static void +virNWFilterSnoopLeaseFileLoad(void) +{ + char line[256], ifkey[VIR_IFKEY_LEN]; + char ipstr[INET_ADDRSTRLEN], srvstr[INET_ADDRSTRLEN]; + virNWFilterSnoopIPLease ipl; + virNWFilterSnoopReqPtr req; + time_t now; + FILE *fp; + int ln = 0, tmp; + + /* protect the lease file */ + virNWFilterSnoopLock(); + + fp = fopen(LEASEFILE, "r"); + time(&now); + while (fp && fgets(line, sizeof(line), fp)) { + if (line[strlen(line)-1] != '\n') { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterSnoopLeaseFileLoad lease file " + "line %d corrupt"), ln); + break; + } + ln++; + /* key len 55 = "VMUUID"+'-'+"MAC" */ + if (sscanf(line, "%u %55s %16s %16s", &ipl.timeout, + ifkey, ipstr, srvstr) < 4) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterSnoopLeaseFileLoad lease file " + "line %d corrupt"), ln); + break; + } + if (ipl.timeout && ipl.timeout < now) + continue; + req = virNWFilterSnoopReqGetByIFKey(ifkey); + if (!req) { + req = virNWFilterSnoopReqNew(ifkey); + if (!req) + break; + + tmp = virHashAddEntry(virNWFilterSnoopState.snoopReqs, ifkey, req); + + if (tmp < 0) { + virNWFilterSnoopReqPut(req); + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("virNWFilterSnoopLeaseFileLoad req add" + " failed on interface \"%s\""), ifkey); + continue; + } + } + + if (inet_pton(AF_INET, ipstr, &ipl.ipAddress) <= 0) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("line %d corrupt ipaddr \"%s\""), + ln, ipstr); + virNWFilterSnoopReqPut(req); + continue; + } + (void) inet_pton(AF_INET, srvstr, &ipl.ipServer); + ipl.snoopReq = req; + + if (ipl.timeout) + virNWFilterSnoopReqLeaseAdd(req, &ipl, false); + else + virNWFilterSnoopReqLeaseDel(req, ipl.ipAddress, false); + + virNWFilterSnoopReqPut(req); + } + + VIR_FORCE_FCLOSE(fp); + + virNWFilterSnoopLeaseFileRefresh(); + + virNWFilterSnoopUnlock(); +} + +/* + * Wait until all threads have ended. + */ +static void +virNWFilterSnoopJoinThreads(void) +{ + while (virAtomicIntRead(&virNWFilterSnoopState.nThreads) != 0) { + VIR_WARN("Waiting for snooping threads to terminate: %u\n", + virAtomicIntRead(&virNWFilterSnoopState.nThreads)); + usleep(1000 * 1000); + } +} + +/* + * Iterator to remove a requests, repeatedly called on one + * request after another. + * The requests' ifname is freed allowing for an association + * of the Snoop request's leases with the same VM under a + * different interface name at a later time. + */ +static int +virNWFilterSnoopRemAllReqIter(const void *payload, + const void *name ATTRIBUTE_UNUSED, + const void *data ATTRIBUTE_UNUSED) +{ + const virNWFilterSnoopReqPtr req = (virNWFilterSnoopReqPtr)payload; + + /* protect req->ifname */ + virNWFilterSnoopReqLock(req); + + if (req->ifname) { + (void) virHashRemoveEntry(virNWFilterSnoopState.ifnameToKey, + req->ifname); + + VIR_FREE(req->ifname); + } + + virNWFilterSnoopReqUnlock(req); + + /* removal will call virNWFilterSnoopCancel() */ + return 1; +} + + +/* + * Terminate all threads; keep the SnoopReqs hash allocated + */ +static void +virNWFilterSnoopEndThreads(void) +{ + virNWFilterSnoopLock(); + virHashRemoveSet(virNWFilterSnoopState.snoopReqs, + virNWFilterSnoopRemAllReqIter, + NULL); + virNWFilterSnoopUnlock(); +} + +int +virNWFilterDHCPSnoopInit(void) +{ + if (virNWFilterSnoopState.snoopReqs) + return 0; + + if (virMutexInitRecursive(&virNWFilterSnoopState.snoopLock) < 0 || + virMutexInit(&virNWFilterSnoopState.activeLock) < 0 || + virAtomicIntInit(&virNWFilterSnoopState.nLeases) < 0 || + virAtomicIntInit(&virNWFilterSnoopState.wLeases) < 0 || + virAtomicIntInit(&virNWFilterSnoopState.nThreads) < 0) + return -1; + + virNWFilterSnoopState.ifnameToKey = virHashCreate(0, NULL); + virNWFilterSnoopState.active = virHashCreate(0, NULL); + virNWFilterSnoopState.snoopReqs = + virHashCreate(0, virNWFilterSnoopReqRelease); + + if (!virNWFilterSnoopState.ifnameToKey || + !virNWFilterSnoopState.snoopReqs || + !virNWFilterSnoopState.active) { + virReportOOMError(); + goto err_exit; + } + + virNWFilterSnoopLeaseFileLoad(); + virNWFilterSnoopLeaseFileOpen(); + + return 0; + +err_exit: + virHashFree(virNWFilterSnoopState.ifnameToKey); + virNWFilterSnoopState.ifnameToKey = NULL; + + virHashFree(virNWFilterSnoopState.snoopReqs); + virNWFilterSnoopState.snoopReqs = NULL; + + virHashFree(virNWFilterSnoopState.active); + virNWFilterSnoopState.active = NULL; + + return -1; +} + +void +virNWFilterDHCPSnoopEnd(const char *ifname) +{ + char *ifkey = NULL; + + virNWFilterSnoopLock(); + + if (!virNWFilterSnoopState.snoopReqs) + goto cleanup; + + if (ifname) { + ifkey = (char *)virHashLookup(virNWFilterSnoopState.ifnameToKey, + ifname); + if (!ifkey) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("ifname \"%s\" not in key map"), ifname); + goto cleanup; + } + + (void) virHashRemoveEntry(virNWFilterSnoopState.ifnameToKey, ifname); + } + + if (ifkey) { + virNWFilterSnoopReqPtr req; + + req = virNWFilterSnoopReqGetByIFKey(ifkey); + if (!req) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("ifkey \"%s\" has no req"), ifkey); + goto cleanup; + } + + /* protect req->ifname & req->threadkey */ + virNWFilterSnoopReqLock(req); + + /* keep valid lease req; drop interface association */ + virNWFilterSnoopCancel(&req->threadkey); + + VIR_FREE(req->ifname); + + virNWFilterSnoopReqUnlock(req); + + virNWFilterSnoopReqPut(req); + } else { /* free all of them */ + virNWFilterSnoopLeaseFileClose(); + + virHashRemoveAll(virNWFilterSnoopState.ifnameToKey); + + /* tell the threads to terminate */ + virNWFilterSnoopEndThreads(); + + virNWFilterSnoopLeaseFileLoad(); + } + +cleanup: + virNWFilterSnoopUnlock(); +} + +void +virNWFilterDHCPSnoopShutdown(void) +{ + virNWFilterSnoopEndThreads(); + virNWFilterSnoopJoinThreads(); + + virNWFilterSnoopLock(); + + virNWFilterSnoopLeaseFileClose(); + virHashFree(virNWFilterSnoopState.ifnameToKey); + virHashFree(virNWFilterSnoopState.snoopReqs); + + virNWFilterSnoopUnlock(); + + virNWFilterSnoopActiveLock(); + virHashFree(virNWFilterSnoopState.active); + virNWFilterSnoopActiveUnlock(); +} + +#else /* HAVE_LIBPCAP */ + +int +virNWFilterDHCPSnoopInit(void) +{ + return -1; +} + +void +virNWFilterDHCPSnoopEnd(const char *ifname ATTRIBUTE_UNUSED) +{ + return; +} + +void +virNWFilterDHCPSnoopShutdown(void) +{ + return; +} + +int +virNWFilterDHCPSnoopReq(virNWFilterTechDriverPtr techdriver ATTRIBUTE_UNUSED, + const char *ifname ATTRIBUTE_UNUSED, + const char *linkdev ATTRIBUTE_UNUSED, + enum virDomainNetType nettype ATTRIBUTE_UNUSED, + const unsigned char *vmuuid ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED, + const char *filtername ATTRIBUTE_UNUSED, + virNWFilterHashTablePtr filterparams ATTRIBUTE_UNUSED, + virNWFilterDriverStatePtr driver ATTRIBUTE_UNUSED) +{ + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("libvirt was not compiled " + "with libpcap and \"ip_learning='dhcp'\" requires" + " it.")); + return -1; +}
if libpcap wasn't detected shouln't all these dummy functions log an error ?
+#endif /* HAVE_LIBPCAP */ Index: libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.h =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.h @@ -0,0 +1,39 @@ +/* + * nwfilter_dhcpsnoop.h: support DHCP snooping for a VM on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 David L Stevens + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: David L Stevens <dlstevens@us.ibm.com> + */ + +#ifndef __NWFILTER_DHCPSNOOP_H +#define __NWFILTER_DHCPSNOOP_H + +int virNWFilterDHCPSnoopInit(void); +void virNWFilterDHCPSnoopShutdown(void); +int virNWFilterDHCPSnoopReq(virNWFilterTechDriverPtr techdriver, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *vmuuid, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); +void virNWFilterDHCPSnoopEnd(const char *ifname); +#endif /* __NWFILTER_DHCPSNOOP_H */ Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -39,6 +39,7 @@ #include "nwfilter_gentech_driver.h" #include "configmake.h"
+#include "nwfilter_dhcpsnoop.h" #include "nwfilter_learnipaddr.h"
#define VIR_FROM_THIS VIR_FROM_NWFILTER @@ -66,6 +67,8 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL;
+ if (virNWFilterDHCPSnoopInit() < 0) + return -1; if (virNWFilterLearnInit() < 0) return -1;
@@ -127,6 +130,7 @@ alloc_err_exit:
conf_init_err: virNWFilterTechDriversShutdown(); + virNWFilterDHCPSnoopShutdown(); virNWFilterLearnShutdown();
return -1; @@ -149,6 +153,7 @@ nwfilterDriverReload(void) { conn = virConnectOpen("qemu:///system");
if (conn) { + virNWFilterDHCPSnoopEnd(NULL); /* shut down all threads -- they will be restarted if necessary */ virNWFilterLearnThreadsTerminate(true);
@@ -203,6 +208,7 @@ nwfilterDriverShutdown(void) {
virNWFilterConfLayerShutdown(); virNWFilterTechDriversShutdown(); + virNWFilterDHCPSnoopShutdown(); virNWFilterLearnShutdown();
nwfilterDriverLock(driverState); Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -32,6 +32,7 @@ #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_dhcpsnoop.h" #include "nwfilter_learnipaddr.h" #include "virnetdev.h" #include "datatypes.h" @@ -39,8 +40,10 @@ #define VIR_FROM_THIS VIR_FROM_NWFILTER
-#define NWFILTER_STD_VAR_MAC "MAC" -#define NWFILTER_STD_VAR_IP "IP" +#define NWFILTER_STD_VAR_MAC NWFILTER_VARNAME_MAC +#define NWFILTER_STD_VAR_IP NWFILTER_VARNAME_IP + +#define NWFILTER_DFLT_LEARN "any"
static int _virNWFilterTeardownFilter(const char *ifname);
@@ -662,6 +665,9 @@ virNWFilterInstantiate(const unsigned ch void **ptrs = NULL; int instantiate = 1; char *buf; + virNWFilterVarValuePtr lv; + const char *learning; + bool reportIP = false;
virNWFilterHashTablePtr missing_vars = virNWFilterHashTableCreate(0); if (!missing_vars) { @@ -678,22 +684,47 @@ virNWFilterInstantiate(const unsigned ch if (rc < 0) goto err_exit;
+ lv = virHashLookup(vars->hashTable, NWFILTER_VARNAME_IP_LEARNING); + if (lv) + learning = virNWFilterVarValueGetNthValue(lv, 0); + else + learning = NULL; + + if (learning == NULL) + learning = NWFILTER_DFLT_LEARN; + if (virHashSize(missing_vars->hashTable) == 1) { if (virHashLookup(missing_vars->hashTable, NWFILTER_STD_VAR_IP) != NULL) { - if (virNWFilterLookupLearnReq(ifindex) == NULL) { - rc = virNWFilterLearnIPAddress(techdriver, - ifname, - ifindex, - linkdev, - nettype, macaddr, - filter->name, - vars, driver, - DETECT_DHCP|DETECT_STATIC); + if (STRCASEEQ(learning, "none")) { /* no learning */ + reportIP = true; + goto err_unresolvable_vars; } - goto err_exit; - } - goto err_unresolvable_vars; + if (STRCASEEQ(learning, "dhcp")) { + rc = virNWFilterDHCPSnoopReq(techdriver, ifname, linkdev, + nettype, vmuuid, macaddr, + filter->name, vars, driver); + goto err_exit; + } else if (STRCASEEQ(learning, "any")) { + if (virNWFilterLookupLearnReq(ifindex) == NULL) { + rc = virNWFilterLearnIPAddress(techdriver, + ifname, + ifindex, + linkdev, + nettype, macaddr, + filter->name, + vars, driver, + DETECT_DHCP|DETECT_STATIC); + } + goto err_exit; + } else { + rc = -1; + virNWFilterReportError(VIR_ERR_PARSE_FAILED, _("filter '%s' " + "learning value '%s' invalid."), + filter->name, learning); + } + } else + goto err_unresolvable_vars; } else if (virHashSize(missing_vars->hashTable) > 1) { goto err_unresolvable_vars; } else if (!forceWithPendingReq && @@ -761,7 +792,7 @@ err_exit:
err_unresolvable_vars:
- buf = virNWFilterPrintVars(missing_vars->hashTable, ", ", false, false); + buf = virNWFilterPrintVars(missing_vars->hashTable, ", ", false, reportIP); if (buf) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Cannot instantiate filter due to unresolvable " @@ -1092,6 +1123,8 @@ _virNWFilterTeardownFilter(const char *i return -1; }
+ virNWFilterDHCPSnoopEnd(ifname); + virNWFilterTerminateLearnReq(ifname);
if (virNWFilterLockIface(ifname) < 0) Index: libvirt-acl/src/conf/nwfilter_params.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.h +++ libvirt-acl/src/conf/nwfilter_params.h @@ -91,6 +91,11 @@ int virNWFilterHashTablePutAll(virNWFilt # define VALID_VARVALUE \ "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:"
+# define NWFILTER_VARNAME_IP "IP" +# define NWFILTER_VARNAME_MAC "MAC" +# define NWFILTER_VARNAME_IP_LEARNING "ip_learning" +# define NWFILTER_VARNAME_DHCPSERVER "DHCPSERVER" + enum virNWFilterVarAccessType { VIR_NWFILTER_VAR_ACCESS_ELEMENT = 0, VIR_NWFILTER_VAR_ACCESS_ITERATOR = 1,
A fairly big patch ! I have tried to really read everything, but finding locking issues, especially when there is multiple layers of locks is nearly impossible by review. I think the best is to get this running and tested as much as possible before the next release, ACK Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel@veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/
On 04/19/2012 05:54 AM, Daniel Veillard wrote:
On Tue, Apr 17, 2012 at 10:44:05AM -0400, Stefan Berger wrote:
Index: libvirt-acl/src/conf/nwfilter_params.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.h +++ libvirt-acl/src/conf/nwfilter_params.h @@ -91,6 +91,11 @@ int virNWFilterHashTablePutAll(virNWFilt # define VALID_VARVALUE \ "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:"
+# define NWFILTER_VARNAME_IP "IP" +# define NWFILTER_VARNAME_MAC "MAC" +# define NWFILTER_VARNAME_IP_LEARNING "ip_learning" +# define NWFILTER_VARNAME_DHCPSERVER "DHCPSERVER" + enum virNWFilterVarAccessType { VIR_NWFILTER_VAR_ACCESS_ELEMENT = 0, VIR_NWFILTER_VAR_ACCESS_ITERATOR = 1, A fairly big patch ! I have tried to really read everything, but finding locking issues, especially when there is multiple layers of locks is nearly impossible by review. I think the best is to get this running and tested as much as possible before the next release,
ACK
Thanks for the ACK. However, there are some things that I would like to adapt before checking in: - rename the 'ip_learning' variable to CTRL_IP_LEARNING to open up a 'namespace' for future extensions providing control to users over the behavior of the algorithm; someone may be interested in having IP addresses detected by the DHCP snooper but have no filters instantiated and for that there could be a variable CTRL_NO_INSTANTIATE (=true) - some small optimization to not have packets submitted to the worker that are shorter than the minimal size a valid DHCP packet must have - forgot about the existence of virSocketAddr and so I needed to replace the usage of uint32_t's with virSocketAddr So I would check in patches 1-3 soon and post the rest of the series again later. Stefan
The goal of this patch is to prepare for support for multiple IP addresses per interface in the DHCP snooping code. Move the code for the IP address map that maps interface names to IP addresses into their own file. Rename the functions on the way but otherwise leave the code as-is. Initialize this new layer separately before dependent layers (iplearning, dhcpsnooping) and shut it down after them. --- src/Makefile.am | 4 src/conf/nwfilter_ipaddrmap.c | 167 +++++++++++++++++++++++++++++++++ src/conf/nwfilter_ipaddrmap.h | 37 +++++++ src/libvirt_private.syms | 8 + src/nwfilter/nwfilter_driver.c | 11 +- src/nwfilter/nwfilter_gentech_driver.c | 5 src/nwfilter/nwfilter_learnipaddr.c | 126 ------------------------ src/nwfilter/nwfilter_learnipaddr.h | 3 8 files changed, 229 insertions(+), 132 deletions(-) Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -159,9 +159,11 @@ NETWORK_CONF_SOURCES = \ # Network filter driver generic impl APIs NWFILTER_PARAM_CONF_SOURCES = \ conf/nwfilter_params.c conf/nwfilter_params.h \ + conf/nwfilter_ipaddrmap.c \ + conf/nwfilter_ipaddrmap.h \ conf/nwfilter_conf.h -NWFILTER_CONF_SOURCES = \ +NWFILTER_CONF_SOURCES = \ $(NWFILTER_PARAM_CONF_SOURCES) \ conf/nwfilter_conf.c conf/nwfilter_conf.h Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -39,6 +39,7 @@ #include "nwfilter_gentech_driver.h" #include "configmake.h" +#include "nwfilter_ipaddrmap.h" #include "nwfilter_dhcpsnoop.h" #include "nwfilter_learnipaddr.h" @@ -67,10 +68,12 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; - if (virNWFilterDHCPSnoopInit() < 0) + if (virNWFilterIPAddrMapInit() < 0) return -1; if (virNWFilterLearnInit() < 0) - return -1; + goto err_exit_ipaddrmapshutdown; + if (virNWFilterDHCPSnoopInit() < 0) + goto err_exit_learnshutdown; virNWFilterTechDriversInit(privileged); @@ -131,7 +134,10 @@ alloc_err_exit: conf_init_err: virNWFilterTechDriversShutdown(); virNWFilterDHCPSnoopShutdown(); +err_exit_learnshutdown: virNWFilterLearnShutdown(); +err_exit_ipaddrmapshutdown: + virNWFilterIPAddrMapShutdown(); return -1; } @@ -210,6 +216,7 @@ nwfilterDriverShutdown(void) { virNWFilterTechDriversShutdown(); virNWFilterDHCPSnoopShutdown(); virNWFilterLearnShutdown(); + virNWFilterIPAddrMapShutdown(); nwfilterDriverLock(driverState); Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -33,6 +33,7 @@ #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" #include "nwfilter_dhcpsnoop.h" +#include "nwfilter_ipaddrmap.h" #include "nwfilter_learnipaddr.h" #include "virnetdev.h" #include "datatypes.h" @@ -870,7 +871,7 @@ __virNWFilterInstantiateFilter(const uns goto err_exit; } - ipaddr = virNWFilterGetIpAddrForIfname(ifname); + ipaddr = virNWFilterIPAddrMapGetIPAddr(ifname); vars1 = virNWFilterCreateVarHashmap(str_macaddr, ipaddr); if (!vars1) { @@ -1132,7 +1133,7 @@ _virNWFilterTeardownFilter(const char *i techdriver->allTeardown(ifname); - virNWFilterDelIpAddrForIfname(ifname, NULL); + virNWFilterIPAddrMapDelIPAddr(ifname, NULL); virNWFilterUnlockIface(ifname); Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -52,6 +52,7 @@ #include "conf/domain_conf.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_ipaddrmap.h" #include "nwfilter_learnipaddr.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER @@ -118,9 +119,6 @@ struct ether_vlan_header static virMutex pendingLearnReqLock; static virHashTablePtr pendingLearnReq; -static virMutex ipAddressMapLock; -static virNWFilterHashTablePtr ipAddressMap; - static virMutex ifaceMapLock; static virHashTablePtr ifaceLockMap; @@ -310,113 +308,8 @@ virNWFilterDeregisterLearnReq(int ifinde return res; } -/* Add an IP address to the list of IP addresses an interface is - * known to use. This function feeds the per-interface cache that - * is used to instantiate filters with variable '$IP'. - * - * @ifname: The name of the (tap) interface - * @addr: An IPv4 address in dotted decimal format that the (tap) - * interface is known to use. - * - * This function returns 0 on success, -1 otherwise - */ -static int -virNWFilterAddIpAddrForIfname(const char *ifname, char *addr) -{ - int ret = -1; - virNWFilterVarValuePtr val; - - virMutexLock(&ipAddressMapLock); - - val = virHashLookup(ipAddressMap->hashTable, ifname); - if (!val) { - val = virNWFilterVarValueCreateSimple(addr); - if (!val) { - virReportOOMError(); - goto cleanup; - } - ret = virNWFilterHashTablePut(ipAddressMap, ifname, val, 1); - goto cleanup; - } else { - if (virNWFilterVarValueAddValue(val, addr) < 0) - goto cleanup; - } - - ret = 0; - -cleanup: - virMutexUnlock(&ipAddressMapLock); - - return ret; -} #endif -/* Delete all or a specific IP address from an interface. After this - * call either all or the given IP address will not be associated - * with the interface anymore. - * - * @ifname: The name of the (tap) interface - * @addr: An IPv4 address in dotted decimal format that the (tap) - * interface is not using anymore; provide NULL to remove all IP - * addresses associated with the given interface - * - * This function returns the number of IP addresses that are still - * known to be associated with this interface, in case of an error - * -1 is returned. Error conditions are: - * - IP addresses is not known to be associated with the interface - */ -int -virNWFilterDelIpAddrForIfname(const char *ifname, const char *ipaddr) -{ - int ret = -1; - virNWFilterVarValuePtr val = NULL; - - virMutexLock(&ipAddressMapLock); - - if (ipaddr != NULL) { - val = virHashLookup(ipAddressMap->hashTable, ifname); - if (val) { - if (virNWFilterVarValueGetCardinality(val) == 1 && - STREQ(ipaddr, - virNWFilterVarValueGetNthValue(val, 0))) - goto remove_entry; - virNWFilterVarValueDelValue(val, ipaddr); - ret = virNWFilterVarValueGetCardinality(val); - } - } else { -remove_entry: - /* remove whole entry */ - val = virNWFilterHashTableRemoveEntry(ipAddressMap, ifname); - virNWFilterVarValueFree(val); - ret = 0; - } - - virMutexUnlock(&ipAddressMapLock); - - return ret; -} - -/* Get the list of IP addresses known to be in use by an interface - * - * This function returns NULL in case no IP address is known to be - * associated with the interface, a virNWFilterVarValuePtr otherwise - * that then can contain one or multiple entries. - */ -virNWFilterVarValuePtr -virNWFilterGetIpAddrForIfname(const char *ifname) -{ - virNWFilterVarValuePtr res; - - virMutexLock(&ipAddressMapLock); - - res = virHashLookup(ipAddressMap->hashTable, ifname); - - virMutexUnlock(&ipAddressMapLock); - - return res; -} - - #ifdef HAVE_LIBPCAP static void @@ -699,7 +592,7 @@ learnIPAddressThread(void *arg) char *inetaddr; if ((inetaddr = virSocketAddrFormat(&sa)) != NULL) { - if (virNWFilterAddIpAddrForIfname(req->ifname, inetaddr) < 0) { + if (virNWFilterIPAddrMapAddIPAddr(req->ifname, inetaddr) < 0) { VIR_ERROR(_("Failed to add IP address %s to IP address " "cache for interface %s"), inetaddr, req->ifname); } @@ -901,18 +794,6 @@ virNWFilterLearnInit(void) { return -1; } - ipAddressMap = virNWFilterHashTableCreate(0); - if (!ipAddressMap) { - virReportOOMError(); - virNWFilterLearnShutdown(); - return -1; - } - - if (virMutexInit(&ipAddressMapLock) < 0) { - virNWFilterLearnShutdown(); - return -1; - } - ifaceLockMap = virHashCreate(0, freeIfaceLock); if (!ifaceLockMap) { virNWFilterLearnShutdown(); @@ -954,9 +835,6 @@ virNWFilterLearnShutdown(void) virHashFree(pendingLearnReq); pendingLearnReq = NULL; - virNWFilterHashTableFree(ipAddressMap); - ipAddressMap = NULL; - virHashFree(ifaceLockMap); ifaceLockMap = NULL; } Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.h +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -65,9 +65,6 @@ int virNWFilterLearnIPAddress(virNWFilte virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(int ifindex); int virNWFilterTerminateLearnReq(const char *ifname); -int virNWFilterDelIpAddrForIfname(const char *ifname, const char *ipaddr); -virNWFilterVarValuePtr virNWFilterGetIpAddrForIfname(const char *ifname); - int virNWFilterLockIface(const char *ifname) ATTRIBUTE_RETURN_CHECK; void virNWFilterUnlockIface(const char *ifname); Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -853,6 +853,14 @@ virNWFilterTestUnassignDef; virNWFilterUnlockFilterUpdates; +# nwfilter_ipaddrmap +virNWFilterIPAddrMapAddIPAddr; +virNWFilterIPAddrMapDelIPAddr; +virNWFilterIPAddrMapGetIPAddr; +virNWFilterIPAddrMapInit; +virNWFilterIPAddrMapShutdown; + + # nwfilter_params.h virNWFilterHashTableCreate; virNWFilterHashTableFree; Index: libvirt-acl/src/conf/nwfilter_ipaddrmap.c =================================================================== --- /dev/null +++ libvirt-acl/src/conf/nwfilter_ipaddrmap.c @@ -0,0 +1,167 @@ +/* + * nwfilter_ipaddrmap.c: IP address map for mapping interfaces to their + * detected/expected IP addresses + * + * Copyright (C) 2010, 2012 IBM Corp. + * + * Author: + * Stefan Berger <stefanb@linux.vnet.ibm.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include <config.h> + +#include "internal.h" + +#include "virterror_internal.h" +#include "datatypes.h" +#include "nwfilter_params.h" +#include "nwfilter_ipaddrmap.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + +static virMutex ipAddressMapLock; +static virNWFilterHashTablePtr ipAddressMap; + + +/* Add an IP address to the list of IP addresses an interface is + * known to use. This function feeds the per-interface cache that + * is used to instantiate filters with variable '$IP'. + * + * @ifname: The name of the (tap) interface + * @addr: An IPv4 address in dotted decimal format that the (tap) + * interface is known to use. + * + * This function returns 0 on success, -1 otherwise + */ +int +virNWFilterIPAddrMapAddIPAddr(const char *ifname, char *addr) +{ + int ret = -1; + virNWFilterVarValuePtr val; + + virMutexLock(&ipAddressMapLock); + + val = virHashLookup(ipAddressMap->hashTable, ifname); + if (!val) { + val = virNWFilterVarValueCreateSimple(addr); + if (!val) { + virReportOOMError(); + goto cleanup; + } + ret = virNWFilterHashTablePut(ipAddressMap, ifname, val, 1); + goto cleanup; + } else { + if (virNWFilterVarValueAddValue(val, addr) < 0) + goto cleanup; + } + + ret = 0; + +cleanup: + virMutexUnlock(&ipAddressMapLock); + + return ret; +} + +/* Delete all or a specific IP address from an interface. After this + * call either all or the given IP address will not be associated + * with the interface anymore. + * + * @ifname: The name of the (tap) interface + * @addr: An IPv4 address in dotted decimal format that the (tap) + * interface is not using anymore; provide NULL to remove all IP + * addresses associated with the given interface + * + * This function returns the number of IP addresses that are still + * known to be associated with this interface, in case of an error + * -1 is returned. Error conditions are: + * - IP addresses is not known to be associated with the interface + */ +int +virNWFilterIPAddrMapDelIPAddr(const char *ifname, const char *ipaddr) +{ + int ret = -1; + virNWFilterVarValuePtr val = NULL; + + virMutexLock(&ipAddressMapLock); + + if (ipaddr != NULL) { + val = virHashLookup(ipAddressMap->hashTable, ifname); + if (val) { + if (virNWFilterVarValueGetCardinality(val) == 1 && + STREQ(ipaddr, + virNWFilterVarValueGetNthValue(val, 0))) + goto remove_entry; + virNWFilterVarValueDelValue(val, ipaddr); + ret = virNWFilterVarValueGetCardinality(val); + } + } else { +remove_entry: + /* remove whole entry */ + val = virNWFilterHashTableRemoveEntry(ipAddressMap, ifname); + virNWFilterVarValueFree(val); + ret = 0; + } + + virMutexUnlock(&ipAddressMapLock); + + return ret; +} + +/* Get the list of IP addresses known to be in use by an interface + * + * This function returns NULL in case no IP address is known to be + * associated with the interface, a virNWFilterVarValuePtr otherwise + * that then can contain one or multiple entries. + */ +virNWFilterVarValuePtr +virNWFilterIPAddrMapGetIPAddr(const char *ifname) +{ + virNWFilterVarValuePtr res; + + virMutexLock(&ipAddressMapLock); + + res = virHashLookup(ipAddressMap->hashTable, ifname); + + virMutexUnlock(&ipAddressMapLock); + + return res; +} + +int +virNWFilterIPAddrMapInit(void) +{ + ipAddressMap = virNWFilterHashTableCreate(0); + if (!ipAddressMap) { + virReportOOMError(); + return -1; + } + + if (virMutexInit(&ipAddressMapLock) < 0) { + virNWFilterIPAddrMapShutdown(); + return -1; + } + + return 0; +} + +void +virNWFilterIPAddrMapShutdown(void) +{ + virNWFilterHashTableFree(ipAddressMap); + ipAddressMap = NULL; +} Index: libvirt-acl/src/conf/nwfilter_ipaddrmap.h =================================================================== --- /dev/null +++ libvirt-acl/src/conf/nwfilter_ipaddrmap.h @@ -0,0 +1,37 @@ +/* + * nwfilter_ipaddrmap.h: IP address map for mapping interfaces to their + * detected/expected IP addresses + * + * Copyright (C) 2010, 2012 IBM Corp. + * + * Author: + * Stefan Berger <stefanb@linux.vnet.ibm.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + */ + +#ifndef __VIR_NWFILTER_IPADDRMAP_H +# define __VIR_NWFILTER_IPADDRMAP_H + +int virNWFilterIPAddrMapInit(void); +void virNWFilterIPAddrMapShutdown(void); + +int virNWFilterIPAddrMapAddIPAddr(const char *ifname, char *addr); +int virNWFilterIPAddrMapDelIPAddr(const char *ifname, + const char *ipaddr); +virNWFilterVarValuePtr virNWFilterIPAddrMapGetIPAddr(const char *ifname); + +#endif /* __VIR_NWFILTER_IPADDRMAP_H */
On Tue, Apr 17, 2012 at 10:44:06AM -0400, Stefan Berger wrote:
The goal of this patch is to prepare for support for multiple IP addresses per interface in the DHCP snooping code.
Move the code for the IP address map that maps interface names to IP addresses into their own file. Rename the functions on the way but otherwise leave the code as-is. Initialize this new layer separately before dependent layers (iplearning, dhcpsnooping) and shut it down after them.
--- src/Makefile.am | 4 src/conf/nwfilter_ipaddrmap.c | 167 +++++++++++++++++++++++++++++++++ src/conf/nwfilter_ipaddrmap.h | 37 +++++++ src/libvirt_private.syms | 8 + src/nwfilter/nwfilter_driver.c | 11 +- src/nwfilter/nwfilter_gentech_driver.c | 5 src/nwfilter/nwfilter_learnipaddr.c | 126 ------------------------ src/nwfilter/nwfilter_learnipaddr.h | 3 8 files changed, 229 insertions(+), 132 deletions(-)
Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -159,9 +159,11 @@ NETWORK_CONF_SOURCES = \ # Network filter driver generic impl APIs NWFILTER_PARAM_CONF_SOURCES = \ conf/nwfilter_params.c conf/nwfilter_params.h \ + conf/nwfilter_ipaddrmap.c \ + conf/nwfilter_ipaddrmap.h \ conf/nwfilter_conf.h
-NWFILTER_CONF_SOURCES = \ +NWFILTER_CONF_SOURCES = \ $(NWFILTER_PARAM_CONF_SOURCES) \ conf/nwfilter_conf.c conf/nwfilter_conf.h
Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -39,6 +39,7 @@ #include "nwfilter_gentech_driver.h" #include "configmake.h"
+#include "nwfilter_ipaddrmap.h" #include "nwfilter_dhcpsnoop.h" #include "nwfilter_learnipaddr.h"
@@ -67,10 +68,12 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL;
- if (virNWFilterDHCPSnoopInit() < 0) + if (virNWFilterIPAddrMapInit() < 0) return -1; if (virNWFilterLearnInit() < 0) - return -1; + goto err_exit_ipaddrmapshutdown; + if (virNWFilterDHCPSnoopInit() < 0) + goto err_exit_learnshutdown;
virNWFilterTechDriversInit(privileged);
@@ -131,7 +134,10 @@ alloc_err_exit: conf_init_err: virNWFilterTechDriversShutdown(); virNWFilterDHCPSnoopShutdown(); +err_exit_learnshutdown: virNWFilterLearnShutdown(); +err_exit_ipaddrmapshutdown: + virNWFilterIPAddrMapShutdown();
return -1; } @@ -210,6 +216,7 @@ nwfilterDriverShutdown(void) { virNWFilterTechDriversShutdown(); virNWFilterDHCPSnoopShutdown(); virNWFilterLearnShutdown(); + virNWFilterIPAddrMapShutdown();
nwfilterDriverLock(driverState);
Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -33,6 +33,7 @@ #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" #include "nwfilter_dhcpsnoop.h" +#include "nwfilter_ipaddrmap.h" #include "nwfilter_learnipaddr.h" #include "virnetdev.h" #include "datatypes.h" @@ -870,7 +871,7 @@ __virNWFilterInstantiateFilter(const uns goto err_exit; }
- ipaddr = virNWFilterGetIpAddrForIfname(ifname); + ipaddr = virNWFilterIPAddrMapGetIPAddr(ifname);
vars1 = virNWFilterCreateVarHashmap(str_macaddr, ipaddr); if (!vars1) { @@ -1132,7 +1133,7 @@ _virNWFilterTeardownFilter(const char *i
techdriver->allTeardown(ifname);
- virNWFilterDelIpAddrForIfname(ifname, NULL); + virNWFilterIPAddrMapDelIPAddr(ifname, NULL);
virNWFilterUnlockIface(ifname);
Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -52,6 +52,7 @@ #include "conf/domain_conf.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_ipaddrmap.h" #include "nwfilter_learnipaddr.h"
#define VIR_FROM_THIS VIR_FROM_NWFILTER @@ -118,9 +119,6 @@ struct ether_vlan_header static virMutex pendingLearnReqLock; static virHashTablePtr pendingLearnReq;
-static virMutex ipAddressMapLock; -static virNWFilterHashTablePtr ipAddressMap; - static virMutex ifaceMapLock; static virHashTablePtr ifaceLockMap;
@@ -310,113 +308,8 @@ virNWFilterDeregisterLearnReq(int ifinde return res; }
-/* Add an IP address to the list of IP addresses an interface is - * known to use. This function feeds the per-interface cache that - * is used to instantiate filters with variable '$IP'. - * - * @ifname: The name of the (tap) interface - * @addr: An IPv4 address in dotted decimal format that the (tap) - * interface is known to use. - * - * This function returns 0 on success, -1 otherwise - */ -static int -virNWFilterAddIpAddrForIfname(const char *ifname, char *addr) -{ - int ret = -1; - virNWFilterVarValuePtr val; - - virMutexLock(&ipAddressMapLock); - - val = virHashLookup(ipAddressMap->hashTable, ifname); - if (!val) { - val = virNWFilterVarValueCreateSimple(addr); - if (!val) { - virReportOOMError(); - goto cleanup; - } - ret = virNWFilterHashTablePut(ipAddressMap, ifname, val, 1); - goto cleanup; - } else { - if (virNWFilterVarValueAddValue(val, addr) < 0) - goto cleanup; - } - - ret = 0; - -cleanup: - virMutexUnlock(&ipAddressMapLock); - - return ret; -} #endif
-/* Delete all or a specific IP address from an interface. After this - * call either all or the given IP address will not be associated - * with the interface anymore. - * - * @ifname: The name of the (tap) interface - * @addr: An IPv4 address in dotted decimal format that the (tap) - * interface is not using anymore; provide NULL to remove all IP - * addresses associated with the given interface - * - * This function returns the number of IP addresses that are still - * known to be associated with this interface, in case of an error - * -1 is returned. Error conditions are: - * - IP addresses is not known to be associated with the interface - */ -int -virNWFilterDelIpAddrForIfname(const char *ifname, const char *ipaddr) -{ - int ret = -1; - virNWFilterVarValuePtr val = NULL; - - virMutexLock(&ipAddressMapLock); - - if (ipaddr != NULL) { - val = virHashLookup(ipAddressMap->hashTable, ifname); - if (val) { - if (virNWFilterVarValueGetCardinality(val) == 1 && - STREQ(ipaddr, - virNWFilterVarValueGetNthValue(val, 0))) - goto remove_entry; - virNWFilterVarValueDelValue(val, ipaddr); - ret = virNWFilterVarValueGetCardinality(val); - } - } else { -remove_entry: - /* remove whole entry */ - val = virNWFilterHashTableRemoveEntry(ipAddressMap, ifname); - virNWFilterVarValueFree(val); - ret = 0; - } - - virMutexUnlock(&ipAddressMapLock); - - return ret; -} - -/* Get the list of IP addresses known to be in use by an interface - * - * This function returns NULL in case no IP address is known to be - * associated with the interface, a virNWFilterVarValuePtr otherwise - * that then can contain one or multiple entries. - */ -virNWFilterVarValuePtr -virNWFilterGetIpAddrForIfname(const char *ifname) -{ - virNWFilterVarValuePtr res; - - virMutexLock(&ipAddressMapLock); - - res = virHashLookup(ipAddressMap->hashTable, ifname); - - virMutexUnlock(&ipAddressMapLock); - - return res; -} - - #ifdef HAVE_LIBPCAP
static void @@ -699,7 +592,7 @@ learnIPAddressThread(void *arg) char *inetaddr;
if ((inetaddr = virSocketAddrFormat(&sa)) != NULL) { - if (virNWFilterAddIpAddrForIfname(req->ifname, inetaddr) < 0) { + if (virNWFilterIPAddrMapAddIPAddr(req->ifname, inetaddr) < 0) { VIR_ERROR(_("Failed to add IP address %s to IP address " "cache for interface %s"), inetaddr, req->ifname); } @@ -901,18 +794,6 @@ virNWFilterLearnInit(void) { return -1; }
- ipAddressMap = virNWFilterHashTableCreate(0); - if (!ipAddressMap) { - virReportOOMError(); - virNWFilterLearnShutdown(); - return -1; - } - - if (virMutexInit(&ipAddressMapLock) < 0) { - virNWFilterLearnShutdown(); - return -1; - } - ifaceLockMap = virHashCreate(0, freeIfaceLock); if (!ifaceLockMap) { virNWFilterLearnShutdown(); @@ -954,9 +835,6 @@ virNWFilterLearnShutdown(void) virHashFree(pendingLearnReq); pendingLearnReq = NULL;
- virNWFilterHashTableFree(ipAddressMap); - ipAddressMap = NULL; - virHashFree(ifaceLockMap); ifaceLockMap = NULL; } Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.h +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -65,9 +65,6 @@ int virNWFilterLearnIPAddress(virNWFilte virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(int ifindex); int virNWFilterTerminateLearnReq(const char *ifname);
-int virNWFilterDelIpAddrForIfname(const char *ifname, const char *ipaddr); -virNWFilterVarValuePtr virNWFilterGetIpAddrForIfname(const char *ifname); - int virNWFilterLockIface(const char *ifname) ATTRIBUTE_RETURN_CHECK; void virNWFilterUnlockIface(const char *ifname);
Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -853,6 +853,14 @@ virNWFilterTestUnassignDef; virNWFilterUnlockFilterUpdates;
+# nwfilter_ipaddrmap +virNWFilterIPAddrMapAddIPAddr; +virNWFilterIPAddrMapDelIPAddr; +virNWFilterIPAddrMapGetIPAddr; +virNWFilterIPAddrMapInit; +virNWFilterIPAddrMapShutdown; + + # nwfilter_params.h virNWFilterHashTableCreate; virNWFilterHashTableFree;
Weird I would have expected some of the renamed/moved functions to be removed from the libvirt_private.syms, I'm surprized to see only additions :)
Index: libvirt-acl/src/conf/nwfilter_ipaddrmap.c =================================================================== --- /dev/null +++ libvirt-acl/src/conf/nwfilter_ipaddrmap.c @@ -0,0 +1,167 @@ +/* + * nwfilter_ipaddrmap.c: IP address map for mapping interfaces to their + * detected/expected IP addresses + * + * Copyright (C) 2010, 2012 IBM Corp. + * + * Author: + * Stefan Berger <stefanb@linux.vnet.ibm.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +#include <config.h> + +#include "internal.h" + +#include "virterror_internal.h" +#include "datatypes.h" +#include "nwfilter_params.h" +#include "nwfilter_ipaddrmap.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + +static virMutex ipAddressMapLock; +static virNWFilterHashTablePtr ipAddressMap; + + +/* Add an IP address to the list of IP addresses an interface is + * known to use. This function feeds the per-interface cache that + * is used to instantiate filters with variable '$IP'. + * + * @ifname: The name of the (tap) interface + * @addr: An IPv4 address in dotted decimal format that the (tap) + * interface is known to use. + * + * This function returns 0 on success, -1 otherwise + */ +int +virNWFilterIPAddrMapAddIPAddr(const char *ifname, char *addr) +{ + int ret = -1; + virNWFilterVarValuePtr val; + + virMutexLock(&ipAddressMapLock); + + val = virHashLookup(ipAddressMap->hashTable, ifname); + if (!val) { + val = virNWFilterVarValueCreateSimple(addr); + if (!val) { + virReportOOMError(); + goto cleanup; + } + ret = virNWFilterHashTablePut(ipAddressMap, ifname, val, 1); + goto cleanup; + } else { + if (virNWFilterVarValueAddValue(val, addr) < 0) + goto cleanup; + } + + ret = 0; + +cleanup: + virMutexUnlock(&ipAddressMapLock); + + return ret; +} + +/* Delete all or a specific IP address from an interface. After this + * call either all or the given IP address will not be associated + * with the interface anymore. + * + * @ifname: The name of the (tap) interface + * @addr: An IPv4 address in dotted decimal format that the (tap) + * interface is not using anymore; provide NULL to remove all IP + * addresses associated with the given interface + * + * This function returns the number of IP addresses that are still + * known to be associated with this interface, in case of an error + * -1 is returned. Error conditions are: + * - IP addresses is not known to be associated with the interface + */ +int +virNWFilterIPAddrMapDelIPAddr(const char *ifname, const char *ipaddr) +{ + int ret = -1; + virNWFilterVarValuePtr val = NULL; + + virMutexLock(&ipAddressMapLock); + + if (ipaddr != NULL) { + val = virHashLookup(ipAddressMap->hashTable, ifname); + if (val) { + if (virNWFilterVarValueGetCardinality(val) == 1 && + STREQ(ipaddr, + virNWFilterVarValueGetNthValue(val, 0))) + goto remove_entry; + virNWFilterVarValueDelValue(val, ipaddr); + ret = virNWFilterVarValueGetCardinality(val); + } + } else { +remove_entry: + /* remove whole entry */ + val = virNWFilterHashTableRemoveEntry(ipAddressMap, ifname); + virNWFilterVarValueFree(val); + ret = 0; + } + + virMutexUnlock(&ipAddressMapLock); + + return ret; +} + +/* Get the list of IP addresses known to be in use by an interface + * + * This function returns NULL in case no IP address is known to be + * associated with the interface, a virNWFilterVarValuePtr otherwise + * that then can contain one or multiple entries. + */ +virNWFilterVarValuePtr +virNWFilterIPAddrMapGetIPAddr(const char *ifname) +{ + virNWFilterVarValuePtr res; + + virMutexLock(&ipAddressMapLock); + + res = virHashLookup(ipAddressMap->hashTable, ifname); + + virMutexUnlock(&ipAddressMapLock); + + return res; +} + +int +virNWFilterIPAddrMapInit(void) +{ + ipAddressMap = virNWFilterHashTableCreate(0); + if (!ipAddressMap) { + virReportOOMError(); + return -1; + } + + if (virMutexInit(&ipAddressMapLock) < 0) { + virNWFilterIPAddrMapShutdown(); + return -1; + } + + return 0; +} + +void +virNWFilterIPAddrMapShutdown(void) +{ + virNWFilterHashTableFree(ipAddressMap); + ipAddressMap = NULL; +} Index: libvirt-acl/src/conf/nwfilter_ipaddrmap.h =================================================================== --- /dev/null +++ libvirt-acl/src/conf/nwfilter_ipaddrmap.h @@ -0,0 +1,37 @@ +/* + * nwfilter_ipaddrmap.h: IP address map for mapping interfaces to their + * detected/expected IP addresses + * + * Copyright (C) 2010, 2012 IBM Corp. + * + * Author: + * Stefan Berger <stefanb@linux.vnet.ibm.com> + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + */ + +#ifndef __VIR_NWFILTER_IPADDRMAP_H +# define __VIR_NWFILTER_IPADDRMAP_H + +int virNWFilterIPAddrMapInit(void); +void virNWFilterIPAddrMapShutdown(void); + +int virNWFilterIPAddrMapAddIPAddr(const char *ifname, char *addr); +int virNWFilterIPAddrMapDelIPAddr(const char *ifname, + const char *ipaddr); +virNWFilterVarValuePtr virNWFilterIPAddrMapGetIPAddr(const char *ifname); + +#endif /* __VIR_NWFILTER_IPADDRMAP_H */
ACK, but double check the syms, thanks, Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel@veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/
On 04/19/2012 05:58 AM, Daniel Veillard wrote:
On Tue, Apr 17, 2012 at 10:44:06AM -0400, Stefan Berger wrote: [...]
Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -853,6 +853,14 @@ virNWFilterTestUnassignDef; virNWFilterUnlockFilterUpdates;
+# nwfilter_ipaddrmap +virNWFilterIPAddrMapAddIPAddr; +virNWFilterIPAddrMapDelIPAddr; +virNWFilterIPAddrMapGetIPAddr; +virNWFilterIPAddrMapInit; +virNWFilterIPAddrMapShutdown; + + # nwfilter_params.h virNWFilterHashTableCreate; virNWFilterHashTableFree; Weird I would have expected some of the renamed/moved functions to be removed from the libvirt_private.syms, I'm surprized to see only additions :)
[...]
ACK, but double check the syms, thanks,
There were none there before. Regards, Stefan
On Thu, Apr 19, 2012 at 06:51:46AM -0400, Stefan Berger wrote:
On 04/19/2012 05:58 AM, Daniel Veillard wrote:
On Tue, Apr 17, 2012 at 10:44:06AM -0400, Stefan Berger wrote: [...]
Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -853,6 +853,14 @@ virNWFilterTestUnassignDef; virNWFilterUnlockFilterUpdates;
+# nwfilter_ipaddrmap +virNWFilterIPAddrMapAddIPAddr; +virNWFilterIPAddrMapDelIPAddr; +virNWFilterIPAddrMapGetIPAddr; +virNWFilterIPAddrMapInit; +virNWFilterIPAddrMapShutdown; + + # nwfilter_params.h virNWFilterHashTableCreate; virNWFilterHashTableFree; Weird I would have expected some of the renamed/moved functions to be removed from the libvirt_private.syms, I'm surprized to see only additions :)
[...]
ACK, but double check the syms, thanks,
There were none there before.
okay the functions were not exported then, thanks ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel@veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/
With support for multiple IP addresses per interface in place, this patch now adds support for multiple IP addresses per interface for the DHCP snooping code. Testing: Since the infrastructure I tested this with does not provide multiple IP addresses per MAC address (anymore), I either had to plug the VM's interface from the virtual bride connected directly to the infrastructure to virbr0 to get a 2nd IP address from dnsmasq (kill and run dhclient inside the VM) or changed the lease file (/var/run/libvirt/network/nwfilter.leases) and restart libvirtd to have a 2nd IP address on an existing interface. Note that dnsmasq can take a lease timeout parameter as part of the --dhcp-range command line parameter, so that timeouts can be tested that way (--dhcp-range 192.168.122.2,192.168.122.254,120). So, terminating and restarting dnsmasq with that parameter is another choice to watch an IP address disappear after 120 seconds. Regards, Stefan --- src/nwfilter/nwfilter_dhcpsnoop.c | 102 +++++++++++++++++++++++++------------- 1 file changed, 69 insertions(+), 33 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_dhcpsnoop.c +++ libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.c @@ -59,6 +59,7 @@ #include "conf/domain_conf.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_dhcpsnoop.h" +#include "nwfilter_ipaddrmap.h" #include "virnetdev.h" #include "virfile.h" #include "viratomic.h" @@ -262,7 +263,8 @@ struct _virNWFilterSnoopRateLimitConf { /* local function prototypes */ static int virNWFilterSnoopReqLeaseDel(virNWFilterSnoopReqPtr req, - uint32_t ipaddr, bool update_leasefile); + uint32_t ipaddr, bool update_leasefile, + bool instantiate); static void virNWFilterSnoopReqLock(virNWFilterSnoopReqPtr req); static void virNWFilterSnoopReqUnlock(virNWFilterSnoopReqPtr req); @@ -438,8 +440,8 @@ virNWFilterSnoopIPLeaseInstallRule(virNW { char ipbuf[INET_ADDRSTRLEN]; int rc = -1; - virNWFilterVarValuePtr ipVar; virNWFilterSnoopReqPtr req; + char *ipaddr; if (!inet_ntop(AF_INET, &ipl->ipAddress, ipbuf, sizeof(ipbuf))) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, @@ -448,17 +450,15 @@ virNWFilterSnoopIPLeaseInstallRule(virNW __func__, ipl->ipAddress); return -1; } - ipVar = virNWFilterVarValueCreateSimpleCopyValue(ipbuf); - if (!ipVar) { + + ipaddr = strdup(ipbuf); + if (ipaddr == NULL) { virReportOOMError(); return -1; } - if (virNWFilterHashTablePut(ipl->snoopReq->vars, NWFILTER_VARNAME_IP, - ipVar, 1) < 0) { - virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, - _("Could not add variable \"" - NWFILTER_VARNAME_IP "\" to hashmap")); - virNWFilterVarValueFree(ipVar); + + if (virNWFilterIPAddrMapAddIPAddr(ipl->snoopReq->ifname, ipaddr) < 0) { + VIR_FREE(ipaddr); return -1; } @@ -522,12 +522,18 @@ static unsigned int virNWFilterSnoopReqLeaseTimerRun(virNWFilterSnoopReqPtr req) { time_t now = time(0); + bool is_last = false; /* protect req->start */ virNWFilterSnoopReqLock(req); - while (req->start && req->start->timeout <= now) - virNWFilterSnoopReqLeaseDel(req, req->start->ipAddress, true); + while (req->start && req->start->timeout <= now) { + if (req->start->next == NULL || + req->start->next->timeout > now) + is_last = true; + virNWFilterSnoopReqLeaseDel(req, req->start->ipAddress, true, + is_last); + } virNWFilterSnoopReqUnlock(req); @@ -598,7 +604,7 @@ virNWFilterSnoopReqFree(virNWFilterSnoop /* free all leases */ for (ipl = req->start; ipl; ipl = req->start) - virNWFilterSnoopReqLeaseDel(req, ipl->ipAddress, false); + virNWFilterSnoopReqLeaseDel(req, ipl->ipAddress, false, false); /* free all req data */ VIR_FREE(req->ifname); @@ -731,15 +737,6 @@ virNWFilterSnoopReqLeaseAdd(virNWFilterS virNWFilterSnoopReqUnlock(req); - /* support for multiple addresses requires the ability to add filters - * to existing chains, or to instantiate address lists via - * virNWFilterInstantiateFilterLate(). Until one of those capabilities - * is added, don't allow a new address when one is already assigned to - * this interface. - */ - if (req->start) - return 0; /* silently ignore multiple addresses */ - if (VIR_ALLOC(pl) < 0) { virReportOOMError(); return -1; @@ -807,34 +804,64 @@ virNWFilterSnoopReqRestore(virNWFilterSn * memory or when calling this function while reading * leases from the file. * + * @instantiate: when calling this function in a loop, indicate + * the last call with 'true' here so that the + * rules all get instantiated + * Always calling this with 'true' is fine, but less + * efficient. + * * Returns 0 on success, -1 if the instantiation of the rules failed */ static int virNWFilterSnoopReqLeaseDel(virNWFilterSnoopReqPtr req, - uint32_t ipaddr, bool update_leasefile) + uint32_t ipaddr, bool update_leasefile, + bool instantiate) { int ret = 0; virNWFilterSnoopIPLeasePtr ipl; + char ipstr[INET_ADDRSTRLEN]; + int ipAddrLeft; - /* protect req->start & req->ifname */ + /* protect req->start, req->ifname and the lease */ virNWFilterSnoopReqLock(req); ipl = virNWFilterSnoopIPLeaseGetByIP(req->start, ipaddr); if (ipl == NULL) goto lease_not_found; + if (!inet_ntop(AF_INET, &ipl->ipAddress, ipstr, sizeof(ipstr))) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("%s: inet_ntop failed (0x%08X)"), + __func__, ipl->ipAddress); + ret = -1; + goto lease_not_found; + } + virNWFilterSnoopIPLeaseTimerDel(ipl); + /* lease is off the list now */ + + if (update_leasefile) + virNWFilterSnoopLeaseFileSave(ipl); - if (update_leasefile) { + ipAddrLeft = virNWFilterIPAddrMapDelIPAddr(req->ifname, ipstr); + + if (!req->threadkey || !instantiate) + goto skip_instantiate; + + if (ipAddrLeft) { + ret = virNWFilterInstantiateFilterLate(NULL, + req->ifname, + req->ifindex, + req->linkdev, + req->nettype, + req->macaddr, + req->filtername, + req->vars, + req->driver); + } else { const virNWFilterVarValuePtr dhcpsrvrs = virHashLookup(req->vars->hashTable, NWFILTER_VARNAME_DHCPSERVER); - virNWFilterSnoopLeaseFileSave(ipl); - - /* - * for multiple address support, this needs to remove those rules - * referencing "IP" with ipl's ip value. - */ if (req->techdriver && req->techdriver->applyDHCPOnlyRules(req->ifname, req->macaddr, dhcpsrvrs, false) < 0) { @@ -844,6 +871,8 @@ virNWFilterSnoopReqLeaseDel(virNWFilterS } } + +skip_instantiate: VIR_FREE(ipl); virAtomicIntSub(&virNWFilterSnoopState.nLeases, 1); @@ -1015,7 +1044,7 @@ virNWFilterSnoopDHCPDecode(virNWFilterSn break; case DHCPDECLINE: case DHCPRELEASE: - if (virNWFilterSnoopReqLeaseDel(req, ipl.ipAddress, true) < 0) + if (virNWFilterSnoopReqLeaseDel(req, ipl.ipAddress, true, true) < 0) return -1; break; default: @@ -1797,7 +1826,7 @@ virNWFilterSnoopLeaseFileLoad(void) if (ipl.timeout) virNWFilterSnoopReqLeaseAdd(req, &ipl, false); else - virNWFilterSnoopReqLeaseDel(req, ipl.ipAddress, false); + virNWFilterSnoopReqLeaseDel(req, ipl.ipAddress, false, false); virNWFilterSnoopReqPut(req); } @@ -1843,6 +1872,13 @@ virNWFilterSnoopRemAllReqIter(const void (void) virHashRemoveEntry(virNWFilterSnoopState.ifnameToKey, req->ifname); + /* + * Remove all IP addresses known to be associated with this + * interface so that a new thread will be started on this + * interface + */ + virNWFilterIPAddrMapDelIPAddr(req->ifname, NULL); + VIR_FREE(req->ifname); }
Display detected IP addresses in the domain XML using the IP_LEASE variable name. This variable name now becomes a reserved variable name that can be read only but not set by the user. The format of the value is: <ip addresss>,<lease timeout in seconds> An example of a displayed XML may then be: <interface type='bridge'> <mac address='52:54:00:68:e3:90'/> <source bridge='virbr0'/> <target dev='vnet1'/> <model type='virtio'/> <filterref filter='clean-traffic'> <parameter name='ip_learning' value='dhcp'/> <parameter name='IP_LEASE' value='192.168.122.210,100'/> </filterref> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </interface> --- docs/formatnwfilter.html.in | 27 +++++++++++++++ src/conf/domain_conf.c | 16 +++++++-- src/conf/domain_nwfilter.c | 11 ++++++ src/conf/domain_nwfilter.h | 12 +++++++ src/conf/nwfilter_conf.c | 3 + src/conf/nwfilter_ipaddrmap.c | 29 +++++++++++++++++ src/conf/nwfilter_ipaddrmap.h | 5 ++ src/conf/nwfilter_params.c | 45 +++++++++++++++++++++++++- src/conf/nwfilter_params.h | 9 ++++- src/libvirt_private.syms | 3 + src/nwfilter/nwfilter_dhcpsnoop.c | 56 +++++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_dhcpsnoop.h | 4 ++ src/nwfilter/nwfilter_driver.c | 10 +++++ src/nwfilter/nwfilter_gentech_driver.c | 24 ++++++++++++++ src/nwfilter/nwfilter_gentech_driver.h | 6 +++ src/nwfilter/nwfilter_learnipaddr.c | 14 ++++++++ src/nwfilter/nwfilter_learnipaddr.h | 2 + 17 files changed, 267 insertions(+), 9 deletions(-) Index: libvirt-acl/src/conf/nwfilter_params.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.h +++ libvirt-acl/src/conf/nwfilter_params.h @@ -72,7 +72,10 @@ struct _virNWFilterHashTable { virNWFilterHashTablePtr virNWFilterParseParamAttributes(xmlNodePtr cur); int virNWFilterFormatParamAttributes(virBufferPtr buf, virNWFilterHashTablePtr table, - const char *filterref); + const char *filterref, + const unsigned char *vmuuid, + const unsigned char *mac, + const char *ifname); virNWFilterHashTablePtr virNWFilterHashTableCreate(int n); void virNWFilterHashTableFree(virNWFilterHashTablePtr table); @@ -89,12 +92,14 @@ int virNWFilterHashTablePutAll(virNWFilt "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_" # define VALID_VARVALUE \ - "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:" + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:," # define NWFILTER_VARNAME_IP "IP" # define NWFILTER_VARNAME_MAC "MAC" # define NWFILTER_VARNAME_IP_LEARNING "ip_learning" # define NWFILTER_VARNAME_DHCPSERVER "DHCPSERVER" +# define NWFILTER_VARNAME_IP_LEASE "IP_LEASE" +# define NWFILTER_VARNAME_IPV6_LEASE "IPV6_LEASE" /* future */ enum virNWFilterVarAccessType { VIR_NWFILTER_VAR_ACCESS_ELEMENT = 0, Index: libvirt-acl/src/conf/domain_conf.c =================================================================== --- libvirt-acl.orig/src/conf/domain_conf.c +++ libvirt-acl/src/conf/domain_conf.c @@ -43,6 +43,7 @@ #include "buf.h" #include "c-ctype.h" #include "logging.h" +#include "nwfilter_params.h" #include "nwfilter_conf.h" #include "ignore-value.h" #include "storage_file.h" @@ -11205,7 +11206,8 @@ error: static int virDomainNetDefFormat(virBufferPtr buf, virDomainNetDefPtr def, - unsigned int flags) + unsigned int flags, + const unsigned char *vmuuid) { const char *type = virDomainNetTypeToString(def->type); @@ -11346,9 +11348,15 @@ virDomainNetDefFormat(virBufferPtr buf, } } if (def->filter) { + const char *ifname = NULL; + + if (!(flags & VIR_DOMAIN_XML_INACTIVE)) + ifname = def->ifname; + virBufferAdjustIndent(buf, 6); if (virNWFilterFormatParamAttributes(buf, def->filterparams, - def->filter) < 0) + def->filter, vmuuid, def->mac, + ifname) < 0) return -1; virBufferAdjustIndent(buf, -6); } @@ -12632,7 +12640,7 @@ virDomainDefFormatInternal(virDomainDefP for (n = 0 ; n < def->nnets ; n++) - if (virDomainNetDefFormat(buf, def->nets[n], flags) < 0) + if (virDomainNetDefFormat(buf, def->nets[n], flags, def->uuid) < 0) goto cleanup; for (n = 0 ; n < def->nsmartcards ; n++) @@ -14885,7 +14893,7 @@ virDomainDeviceDefCopy(virCapsPtr caps, rc = virDomainFSDefFormat(&buf, src->data.fs, flags); break; case VIR_DOMAIN_DEVICE_NET: - rc = virDomainNetDefFormat(&buf, src->data.net, flags); + rc = virDomainNetDefFormat(&buf, src->data.net, flags, def->uuid); break; case VIR_DOMAIN_DEVICE_INPUT: rc = virDomainInputDefFormat(&buf, src->data.input, flags); Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -3272,7 +3272,8 @@ virNWFilterIncludeDefFormat(virNWFilterI virBufferAdjustIndent(&buf, 2); if (virNWFilterFormatParamAttributes(&buf, inc->params, - inc->filterref) < 0) { + inc->filterref, + NULL, NULL, NULL) < 0) { virBufferFreeAndReset(&buf); return NULL; } Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -545,6 +545,7 @@ virDomainLockLeaseDetach; # domain_nwfilter.h +virDomainConfNWFilterFormatLeases; virDomainConfNWFilterInstantiate; virDomainConfNWFilterRegister; virDomainConfNWFilterTeardown; @@ -856,6 +857,7 @@ virNWFilterUnlockFilterUpdates; # nwfilter_ipaddrmap virNWFilterIPAddrMapAddIPAddr; virNWFilterIPAddrMapDelIPAddr; +virNWFilterIPAddrMapFormatIPAddrs; virNWFilterIPAddrMapGetIPAddr; virNWFilterIPAddrMapInit; virNWFilterIPAddrMapShutdown; @@ -883,6 +885,7 @@ virNWFilterVarValueFree; virNWFilterVarValueGetCardinality; virNWFilterVarValueGetNthValue; virNWFilterVarValueGetSimple; +virNWFilterFormatParamAttributes; # pci.h Index: libvirt-acl/src/conf/nwfilter_params.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.c +++ libvirt-acl/src/conf/nwfilter_params.c @@ -30,10 +30,17 @@ #include "datatypes.h" #include "nwfilter_params.h" #include "domain_conf.h" +#include "domain_nwfilter.h" +#include "nwfilter_ipaddrmap.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER +static const char *virNWFilterReservedVarnames[] = { + NWFILTER_VARNAME_IP_LEASE, + NWFILTER_VARNAME_IPV6_LEASE, +}; + static bool isValidVarValue(const char *value); static void virNWFilterVarAccessSetIntIterId(virNWFilterVarAccessPtr, unsigned int); @@ -747,7 +754,6 @@ err_exit: return -1; } - static bool isValidVarName(const char *var) { @@ -767,6 +773,19 @@ virNWFilterParseVarValue(const char *val return virNWFilterVarValueCreateSimpleCopyValue(val); } +static void +virNWFilterDelReservedVarnames(virNWFilterHashTablePtr ht) +{ + unsigned int i; + virNWFilterVarValuePtr val; + + for (i = 0; i < ARRAY_CARDINALITY(virNWFilterReservedVarnames); i++) { + val = virNWFilterHashTableRemoveEntry(ht, + virNWFilterReservedVarnames[i]); + virNWFilterVarValueFree(val); + } +} + virNWFilterHashTablePtr virNWFilterParseParamAttributes(xmlNodePtr cur) { @@ -817,6 +836,15 @@ skip_entry: } cur = cur->next; } + + /* + * read-only variables that may be usable in an incoming + * migration could be wired up here. + */ + + /* remove all reserved varnames from the table */ + virNWFilterDelReservedVarnames(table); + return table; err_exit: @@ -838,7 +866,10 @@ virNWFilterFormatParameterNameSorter(con int virNWFilterFormatParamAttributes(virBufferPtr buf, virNWFilterHashTablePtr table, - const char *filterref) + const char *filterref, + const unsigned char *vmuuid, + const unsigned char *mac, + const char *ifname) { virHashKeyValuePairPtr items; int i, j, card, numKeys; @@ -872,6 +903,16 @@ virNWFilterFormatParamAttributes(virBuff virNWFilterVarValueGetNthValue(value, j)); } + if (ifname) { + virBufferAdjustIndent(buf, 2); + /* also display the IP addresses being used */ + virDomainConfNWFilterFormatLeases(buf, + table, + ifname, + vmuuid, + mac); + virBufferAdjustIndent(buf, -2); + } virBufferAddLit(buf, "</filterref>\n"); } else { virBufferAddLit(buf, "/>\n"); Index: libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_dhcpsnoop.c +++ libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.c @@ -1839,6 +1839,55 @@ virNWFilterSnoopLeaseFileLoad(void) } /* + * Format the detected IP addresses for display in the domain's + * XML inside a <parameter name=... value=.../> XML node. + */ +void +virNWFilterSnoopFormatLeases(virBufferPtr buf, + const unsigned char *vmuuid, + const unsigned char *macaddr) +{ + char ifkey[VIR_IFKEY_LEN]; + virNWFilterSnoopReqPtr req; + virNWFilterSnoopIPLeasePtr ipl; + char ipbuf[INET_ADDRSTRLEN]; + + virNWFilterSnoopIFKeyFMT(ifkey, vmuuid, macaddr); + + req = virNWFilterSnoopReqGetByIFKey(ifkey); + if (req) { + time_t now = time(0); + + /* protect req->start */ + virNWFilterSnoopReqLock(req); + + for (ipl = req->start; ipl; ipl = ipl->next) { + if (ipl->timeout <= now) + continue; + + if (!inet_ntop(AF_INET, &ipl->ipAddress, ipbuf, sizeof(ipbuf))) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("%s: inet_ntop failed " + " (0x%08X)"), + __func__, ipl->ipAddress); + continue; + } + + virBufferAsprintf(buf, + "<parameter name='" + NWFILTER_VARNAME_IP_LEASE + "' value='%s,%u'/>\n", + ipbuf, + (unsigned int)(ipl->timeout - now)); + } + + virNWFilterSnoopReqUnlock(req); + + virNWFilterSnoopReqPut(req); + } +} + +/* * Wait until all threads have ended. */ static void @@ -2024,6 +2073,13 @@ virNWFilterDHCPSnoopShutdown(void) #else /* HAVE_LIBPCAP */ +void +virNWFilterSnoopFormatLeases(virBufferPtr buf ATTRIBUTE_UNUSED, + const unsigned char *vmuuid ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED) +{ +} + int virNWFilterDHCPSnoopInit(void) { Index: libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_dhcpsnoop.h +++ libvirt-acl/src/nwfilter/nwfilter_dhcpsnoop.h @@ -36,4 +36,8 @@ int virNWFilterDHCPSnoopReq(virNWFilterT virNWFilterHashTablePtr filterparams, virNWFilterDriverStatePtr driver); void virNWFilterDHCPSnoopEnd(const char *ifname); +void virNWFilterSnoopFormatLeases(virBufferPtr buf, + const unsigned char *vmuuid, + const unsigned char *macaddr); + #endif /* __NWFILTER_DHCPSNOOP_H */ Index: libvirt-acl/src/conf/domain_nwfilter.c =================================================================== --- libvirt-acl.orig/src/conf/domain_nwfilter.c +++ libvirt-acl/src/conf/domain_nwfilter.c @@ -60,3 +60,14 @@ virDomainConfVMNWFilterTeardown(virDomai virDomainConfNWFilterTeardown(vm->def->nets[i]); } } + +void +virDomainConfNWFilterFormatLeases(virBufferPtr buf, + virNWFilterHashTablePtr table, + const char *ifname, + const unsigned char *vmuuid, + const unsigned char *mac) +{ + if (nwfilterDriver != NULL) + nwfilterDriver->formatLeases(buf, table, ifname, vmuuid, mac); +} Index: libvirt-acl/src/conf/domain_nwfilter.h =================================================================== --- libvirt-acl.orig/src/conf/domain_nwfilter.h +++ libvirt-acl/src/conf/domain_nwfilter.h @@ -28,9 +28,16 @@ typedef int (*virDomainConfInstantiateNW virDomainNetDefPtr net); typedef void (*virDomainConfTeardownNWFilter)(virDomainNetDefPtr net); +typedef void (*virDomainConfFormatLeases)(virBufferPtr buf, + virNWFilterHashTablePtr table, + const char *ifname, + const unsigned char *vmuuid, + const unsigned char *mac); + typedef struct { virDomainConfInstantiateNWFilter instantiateFilter; virDomainConfTeardownNWFilter teardownFilter; + virDomainConfFormatLeases formatLeases; } virDomainConfNWFilterDriver; typedef virDomainConfNWFilterDriver *virDomainConfNWFilterDriverPtr; @@ -41,5 +48,10 @@ int virDomainConfNWFilterInstantiate(vir virDomainNetDefPtr net); void virDomainConfNWFilterTeardown(virDomainNetDefPtr net); void virDomainConfVMNWFilterTeardown(virDomainObjPtr vm); +void virDomainConfNWFilterFormatLeases(virBufferPtr buf, + virNWFilterHashTablePtr table, + const char *ifname, + const unsigned char *vmuuid, + const unsigned char *mac); #endif /* DOMAIN_NWFILTER_H */ Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -1209,3 +1209,27 @@ virNWFilterDomainFWUpdateCB(void *payloa virDomainObjUnlock(obj); } + +void +virNWFilterFormatLeases(virBufferPtr buf, + virNWFilterHashTablePtr vars, + const char *ifname, + const unsigned char *vmuuid, + const unsigned char *mac) +{ + virNWFilterVarValuePtr lv; + const char *learning = NULL; + + if (!vars) + return; + + lv = virHashLookup(vars->hashTable, NWFILTER_VARNAME_IP_LEARNING); + if (lv) + learning = virNWFilterVarValueGetNthValue(lv, 0); + + if (!learning || STRCASEEQ(learning, "any")) { + virNWFilterLearnFormatLeases(buf, ifname); + } else if (STRCASEEQ(learning, "dhcp")) { + virNWFilterSnoopFormatLeases(buf, vmuuid, mac); + } +} Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -64,4 +64,10 @@ void virNWFilterDomainFWUpdateCB(void *p const void *name, void *data); +void virNWFilterFormatLeases(virBufferPtr buf, + virNWFilterHashTablePtr vars, + const char *ifname, + const unsigned char *vmmuid, + const unsigned char *mac); + #endif Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -471,6 +471,15 @@ nwfilterTeardownFilter(virDomainNetDefPt virNWFilterTeardownFilter(net); } +static void +nwfilterFormatLeases(virBufferPtr buf, + virNWFilterHashTablePtr vars, + const char *ifname, + const unsigned char *vmuuid, + const unsigned char *mac) +{ + virNWFilterFormatLeases(buf, vars, ifname, vmuuid, mac); +} static virNWFilterDriver nwfilterDriver = { .name = "nwfilter", @@ -498,6 +507,7 @@ static virStateDriver stateDriver = { static virDomainConfNWFilterDriver domainNWFilterDriver = { .instantiateFilter = nwfilterInstantiateFilter, .teardownFilter = nwfilterTeardownFilter, + .formatLeases = nwfilterFormatLeases, }; Index: libvirt-acl/src/conf/nwfilter_ipaddrmap.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_ipaddrmap.c +++ libvirt-acl/src/conf/nwfilter_ipaddrmap.c @@ -122,6 +122,35 @@ remove_entry: return ret; } +void +virNWFilterIPAddrMapFormatIPAddrs(virBufferPtr buf, + const char *ifname, + const char *pre, const char *post) +{ + virNWFilterVarValuePtr val = NULL; + + virMutexLock(&ipAddressMapLock); + + val = virHashLookup(ipAddressMap->hashTable, ifname); + if (val) { + unsigned int card = virNWFilterVarValueGetCardinality(val); + unsigned int i; + + for (i = 0; i < card; i++) { + const char *ipaddr = virNWFilterVarValueGetNthValue(val, i); + + if (pre) + virBufferAdd(buf, pre, -1); + virBufferAdd(buf, ipaddr, -1); + + if (post) + virBufferAdd(buf, post, -1); + } + } + + virMutexUnlock(&ipAddressMapLock); +} + /* Get the list of IP addresses known to be in use by an interface * * This function returns NULL in case no IP address is known to be Index: libvirt-acl/src/conf/nwfilter_ipaddrmap.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_ipaddrmap.h +++ libvirt-acl/src/conf/nwfilter_ipaddrmap.h @@ -26,6 +26,8 @@ #ifndef __VIR_NWFILTER_IPADDRMAP_H # define __VIR_NWFILTER_IPADDRMAP_H +# include "buf.h" + int virNWFilterIPAddrMapInit(void); void virNWFilterIPAddrMapShutdown(void); @@ -33,5 +35,8 @@ int virNWFilterIPAddrMapAddIPAddr(const int virNWFilterIPAddrMapDelIPAddr(const char *ifname, const char *ipaddr); virNWFilterVarValuePtr virNWFilterIPAddrMapGetIPAddr(const char *ifname); +void virNWFilterIPAddrMapFormatIPAddrs(virBufferPtr buf, + const char *ifname, + const char *pre, const char *post); #endif /* __VIR_NWFILTER_IPADDRMAP_H */ Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -771,6 +771,20 @@ virNWFilterLearnIPAddress(virNWFilterTec } #endif /* HAVE_LIBPCAP */ +/* + * Format the detected IP addresses for display in the domain's + * XML inside a <parameter name=... value=.../> XML node. + */ +void +virNWFilterLearnFormatLeases(virBufferPtr buf, + const char *ifname) +{ + virNWFilterIPAddrMapFormatIPAddrs(buf, ifname, + "<parameter name='" + NWFILTER_VARNAME_IP_LEASE + "' value='", + ",-1'/>\n"); +} /** * virNWFilterLearnInit Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.h +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -71,5 +71,7 @@ void virNWFilterUnlockIface(const char * int virNWFilterLearnInit(void); void virNWFilterLearnShutdown(void); void virNWFilterLearnThreadsTerminate(bool allowNewThreads); +void virNWFilterLearnFormatLeases(virBufferPtr buf, + const char *ifname); #endif /* __NWFILTER_LEARNIPADDR_H */ Index: libvirt-acl/docs/formatnwfilter.html.in =================================================================== --- libvirt-acl.orig/docs/formatnwfilter.html.in +++ libvirt-acl/docs/formatnwfilter.html.in @@ -446,6 +446,22 @@ </interface> </pre> + <p> + Once an IP address has been detected, the domain's interface XML + will display the detected IP address and its lease expiration time + in seconds. Note that the <code>IP_LEASE</code> variable is read-only + and cannot be set by the user. + </p> +<pre> + <interface type='bridge'> + <source bridge='virbr0'/> + <filterref filter='clean-traffic'> + <parameter name='ip_learning' value='dhcp'/> + <parameter name='IP_LEASE' value='192.168.122.100,200'/> + </filterref> + </interface> +</pre> + <h3><a name="nwfelemsReservedVars">Reserved Variables</a></h3> <p> The following table lists reserved variables in use by libvirt. @@ -481,6 +497,17 @@ <td> ip_learning </td> <td> The choice of the IP address detection mode </td> </tr> + <tr> + <td> IP_LEASE </td> + <td> Read-only variable displaying the detected IP lease in the + format IP address,lease expiration time in seconds </td> + </tr> + <tr> + <td> IPV6_LEASE </td> + <td> Not currently implemented: + Read-only variable displaying the detected IPV6 lease in the + format IPV6 address,lease expiration time in seconds </td> + </tr> </table> <h2><a name="nwfelems">Element and attribute overview</a></h2>
participants (3)
-
Daniel Veillard -
Eric Blake -
Stefan Berger