mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-27 19:11:16 +00:00
Convert nwfilter ebiptablesTearNewRules to virFirewall
Convert the nwfilter ebiptablesTearNewRules method to use the virFirewall object APIs instead of creating shell scripts using virBuffer APIs. This provides a performance improvement through allowing direct use of firewalld dbus APIs and will facilitate automated testing. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
parent
d7b83ab7c3
commit
138ef25e99
@ -722,6 +722,18 @@ iptablesRemoveTmpRootChain(virBufferPtr buf,
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static void
|
||||||
|
iptablesRemoveTmpRootChainFW(virFirewallPtr fw,
|
||||||
|
virFirewallLayer layer,
|
||||||
|
char prefix,
|
||||||
|
bool incoming,
|
||||||
|
const char *ifname)
|
||||||
|
{
|
||||||
|
_iptablesRemoveRootChainFW(fw, layer, prefix,
|
||||||
|
incoming, ifname, 1);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
static void
|
static void
|
||||||
iptablesRemoveTmpRootChains(virBufferPtr buf,
|
iptablesRemoveTmpRootChains(virBufferPtr buf,
|
||||||
const char *ifname)
|
const char *ifname)
|
||||||
@ -732,6 +744,17 @@ iptablesRemoveTmpRootChains(virBufferPtr buf,
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static void
|
||||||
|
iptablesRemoveTmpRootChainsFW(virFirewallPtr fw,
|
||||||
|
virFirewallLayer layer,
|
||||||
|
const char *ifname)
|
||||||
|
{
|
||||||
|
iptablesRemoveTmpRootChainFW(fw, layer, 'F', false, ifname);
|
||||||
|
iptablesRemoveTmpRootChainFW(fw, layer, 'F', true, ifname);
|
||||||
|
iptablesRemoveTmpRootChainFW(fw, layer, 'H', true, ifname);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
static void
|
static void
|
||||||
iptablesRemoveRootChainsFW(virFirewallPtr fw,
|
iptablesRemoveRootChainsFW(virFirewallPtr fw,
|
||||||
virFirewallLayer layer,
|
virFirewallLayer layer,
|
||||||
@ -933,6 +956,18 @@ iptablesUnlinkTmpRootChain(virBufferPtr buf,
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static void
|
||||||
|
iptablesUnlinkTmpRootChainFW(virFirewallPtr fw,
|
||||||
|
virFirewallLayer layer,
|
||||||
|
const char *basechain,
|
||||||
|
char prefix,
|
||||||
|
bool incoming, const char *ifname)
|
||||||
|
{
|
||||||
|
_iptablesUnlinkRootChainFW(fw, layer,
|
||||||
|
basechain, prefix, incoming, ifname, 1);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
static void
|
static void
|
||||||
iptablesUnlinkRootChainsFW(virFirewallPtr fw,
|
iptablesUnlinkRootChainsFW(virFirewallPtr fw,
|
||||||
virFirewallLayer layer,
|
virFirewallLayer layer,
|
||||||
@ -954,6 +989,17 @@ iptablesUnlinkTmpRootChains(virBufferPtr buf,
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static void
|
||||||
|
iptablesUnlinkTmpRootChainsFW(virFirewallPtr fw,
|
||||||
|
virFirewallLayer layer,
|
||||||
|
const char *ifname)
|
||||||
|
{
|
||||||
|
iptablesUnlinkTmpRootChainFW(fw, layer, VIRT_OUT_CHAIN, 'F', false, ifname);
|
||||||
|
iptablesUnlinkTmpRootChainFW(fw, layer, VIRT_IN_CHAIN, 'F', true, ifname);
|
||||||
|
iptablesUnlinkTmpRootChainFW(fw, layer, HOST_IN_CHAIN, 'H', true, ifname);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
static void
|
static void
|
||||||
iptablesRenameTmpRootChainFW(virFirewallPtr fw,
|
iptablesRenameTmpRootChainFW(virFirewallPtr fw,
|
||||||
virFirewallLayer layer,
|
virFirewallLayer layer,
|
||||||
@ -4251,36 +4297,28 @@ ebiptablesApplyNewRules(const char *ifname,
|
|||||||
static int
|
static int
|
||||||
ebiptablesTearNewRules(const char *ifname)
|
ebiptablesTearNewRules(const char *ifname)
|
||||||
{
|
{
|
||||||
virBuffer buf = VIR_BUFFER_INITIALIZER;
|
virFirewallPtr fw = virFirewallNew();
|
||||||
|
int ret = -1;
|
||||||
|
|
||||||
if (iptables_cmd_path) {
|
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
|
||||||
NWFILTER_SET_IPTABLES_SHELLVAR(&buf);
|
|
||||||
|
|
||||||
iptablesUnlinkTmpRootChains(&buf, ifname);
|
iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
|
||||||
iptablesRemoveTmpRootChains(&buf, ifname);
|
iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
|
||||||
}
|
|
||||||
|
|
||||||
if (ip6tables_cmd_path) {
|
iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV6, ifname);
|
||||||
NWFILTER_SET_IP6TABLES_SHELLVAR(&buf);
|
iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV6, ifname);
|
||||||
|
|
||||||
iptablesUnlinkTmpRootChains(&buf, ifname);
|
ebtablesUnlinkTmpRootChainFW(fw, true, ifname);
|
||||||
iptablesRemoveTmpRootChains(&buf, ifname);
|
ebtablesUnlinkTmpRootChainFW(fw, false, ifname);
|
||||||
}
|
ebtablesRemoveTmpSubChainsFW(fw, ifname);
|
||||||
|
ebtablesRemoveTmpRootChainFW(fw, true, ifname);
|
||||||
|
ebtablesRemoveTmpRootChainFW(fw, false, ifname);
|
||||||
|
|
||||||
if (ebtables_cmd_path) {
|
virMutexLock(&execCLIMutex);
|
||||||
NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
|
ret = virFirewallApply(fw);
|
||||||
|
virMutexUnlock(&execCLIMutex);
|
||||||
ebtablesUnlinkTmpRootChain(&buf, true, ifname);
|
virFirewallFree(fw);
|
||||||
ebtablesUnlinkTmpRootChain(&buf, false, ifname);
|
return ret;
|
||||||
|
|
||||||
ebtablesRemoveTmpSubChains(&buf, ifname);
|
|
||||||
ebtablesRemoveTmpRootChain(&buf, true, ifname);
|
|
||||||
ebtablesRemoveTmpRootChain(&buf, false, ifname);
|
|
||||||
}
|
|
||||||
|
|
||||||
ebiptablesExecCLI(&buf, true, NULL);
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -216,6 +216,67 @@ testNWFilterEBIPTablesRemoveBasicRules(const void *opaque ATTRIBUTE_UNUSED)
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static int
|
||||||
|
testNWFilterEBIPTablesTearNewRules(const void *opaque ATTRIBUTE_UNUSED)
|
||||||
|
{
|
||||||
|
virBuffer buf = VIR_BUFFER_INITIALIZER;
|
||||||
|
const char *expected =
|
||||||
|
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
|
||||||
|
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
|
||||||
|
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
|
||||||
|
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
|
||||||
|
"iptables -F FP-vnet0\n"
|
||||||
|
"iptables -X FP-vnet0\n"
|
||||||
|
"iptables -F FJ-vnet0\n"
|
||||||
|
"iptables -X FJ-vnet0\n"
|
||||||
|
"iptables -F HJ-vnet0\n"
|
||||||
|
"iptables -X HJ-vnet0\n"
|
||||||
|
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
|
||||||
|
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
|
||||||
|
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
|
||||||
|
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
|
||||||
|
"ip6tables -F FP-vnet0\n"
|
||||||
|
"ip6tables -X FP-vnet0\n"
|
||||||
|
"ip6tables -F FJ-vnet0\n"
|
||||||
|
"ip6tables -X FJ-vnet0\n"
|
||||||
|
"ip6tables -F HJ-vnet0\n"
|
||||||
|
"ip6tables -X HJ-vnet0\n"
|
||||||
|
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
|
||||||
|
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
|
||||||
|
"ebtables -t nat -L libvirt-J-vnet0\n"
|
||||||
|
"ebtables -t nat -L libvirt-P-vnet0\n"
|
||||||
|
"ebtables -t nat -F libvirt-J-vnet0\n"
|
||||||
|
"ebtables -t nat -X libvirt-J-vnet0\n"
|
||||||
|
"ebtables -t nat -F libvirt-P-vnet0\n"
|
||||||
|
"ebtables -t nat -X libvirt-P-vnet0\n";
|
||||||
|
char *actual = NULL;
|
||||||
|
int ret = -1;
|
||||||
|
|
||||||
|
virCommandSetDryRun(&buf, NULL, NULL);
|
||||||
|
|
||||||
|
if (ebiptables_driver.tearNewRules("vnet0") < 0)
|
||||||
|
goto cleanup;
|
||||||
|
|
||||||
|
if (virBufferError(&buf))
|
||||||
|
goto cleanup;
|
||||||
|
|
||||||
|
actual = virBufferContentAndReset(&buf);
|
||||||
|
virtTestClearCommandPath(actual);
|
||||||
|
|
||||||
|
if (STRNEQ_NULLABLE(actual, expected)) {
|
||||||
|
virtTestDifference(stderr, actual, expected);
|
||||||
|
goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = 0;
|
||||||
|
cleanup:
|
||||||
|
virCommandSetDryRun(NULL, NULL, NULL);
|
||||||
|
virBufferFreeAndReset(&buf);
|
||||||
|
VIR_FREE(actual);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
static int
|
static int
|
||||||
mymain(void)
|
mymain(void)
|
||||||
{
|
{
|
||||||
@ -241,6 +302,11 @@ mymain(void)
|
|||||||
NULL) < 0)
|
NULL) < 0)
|
||||||
ret = -1;
|
ret = -1;
|
||||||
|
|
||||||
|
if (virtTestRun("ebiptablesTearNewRules",
|
||||||
|
testNWFilterEBIPTablesTearNewRules,
|
||||||
|
NULL) < 0)
|
||||||
|
ret = -1;
|
||||||
|
|
||||||
cleanup:
|
cleanup:
|
||||||
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
|
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user