External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-04-26 07:04:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

nwfilter: Tear down temp. filters when tearing all filters

Browse Source 
Refactor the ebiptablesTearNewRules function so that the teardown of temporary
filters can also be called by the ebiptablesAllTeardown function.

This fixes a problem that leaves temporary filters behind when a VM shuts down
while its filters are modified.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>

v1->v2:
  - test cases adjusted to expect more commands
This commit is contained in:
Stefan Berger 2014-04-30 12:51:38 -04:00 committed by Stefan Berger
parent 7a6ae35dbe
commit cdebc2f74c
2 changed files with 52 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/nwfilter/nwfilter_ebiptables_driver.c
View File

@ -3536,14 +3536,9 @@ ebiptablesApplyNewRules(const char *ifname,
} }
static int static void
ebiptablesTearNewRules(const char *ifname) ebiptablesTearNewRulesFW(virFirewallPtr fw, const char *ifname)
{ {
virFirewallPtr fw = virFirewallNew();
int ret = -1;
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
@ -3555,13 +3550,24 @@ ebiptablesTearNewRules(const char *ifname)
ebtablesRemoveTmpSubChainsFW(fw, ifname); ebtablesRemoveTmpSubChainsFW(fw, ifname);
ebtablesRemoveTmpRootChainFW(fw, true, ifname); ebtablesRemoveTmpRootChainFW(fw, true, ifname);
ebtablesRemoveTmpRootChainFW(fw, false, ifname); ebtablesRemoveTmpRootChainFW(fw, false, ifname);
}
static int
ebiptablesTearNewRules(const char *ifname)
{
virFirewallPtr fw = virFirewallNew();
int ret = -1;
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
ebiptablesTearNewRulesFW(fw, ifname);
ret = virFirewallApply(fw); ret = virFirewallApply(fw);
virFirewallFree(fw); virFirewallFree(fw);
return ret; return ret;
} }
static int static int
ebiptablesTearOldRules(const char *ifname) ebiptablesTearOldRules(const char *ifname)
{ {
@ -3608,6 +3614,8 @@ ebiptablesAllTeardown(const char *ifname)
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
ebiptablesTearNewRulesFW(fw, ifname);
iptablesUnlinkRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesUnlinkRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
iptablesClearVirtInPostFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesClearVirtInPostFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
iptablesRemoveRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesRemoveRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);

64
tests/nwfilterebiptablestest.c
View File

@ -33,11 +33,43 @@
#define VIR_FROM_THIS VIR_FROM_NONE #define VIR_FROM_THIS VIR_FROM_NONE
#define VIR_NWFILTER_NEW_RULES_TEARDOWN \
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \
"iptables -F FP-vnet0\n" \
"iptables -X FP-vnet0\n" \
"iptables -F FJ-vnet0\n" \
"iptables -X FJ-vnet0\n" \
"iptables -F HJ-vnet0\n" \
"iptables -X HJ-vnet0\n" \
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \
"ip6tables -F FP-vnet0\n" \
"ip6tables -X FP-vnet0\n" \
"ip6tables -F FJ-vnet0\n" \
"ip6tables -X FJ-vnet0\n" \
"ip6tables -F HJ-vnet0\n" \
"ip6tables -X HJ-vnet0\n" \
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" \
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" \
"ebtables -t nat -L libvirt-J-vnet0\n" \
"ebtables -t nat -L libvirt-P-vnet0\n" \
"ebtables -t nat -F libvirt-J-vnet0\n" \
"ebtables -t nat -X libvirt-J-vnet0\n" \
"ebtables -t nat -F libvirt-P-vnet0\n" \
"ebtables -t nat -X libvirt-P-vnet0\n"
static int static int
testNWFilterEBIPTablesAllTeardown(const void *opaque ATTRIBUTE_UNUSED) testNWFilterEBIPTablesAllTeardown(const void *opaque ATTRIBUTE_UNUSED)
{ {
virBuffer buf = VIR_BUFFER_INITIALIZER; virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
@ -221,34 +253,7 @@ testNWFilterEBIPTablesTearNewRules(const void *opaque ATTRIBUTE_UNUSED)
{ {
virBuffer buf = VIR_BUFFER_INITIALIZER; virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" VIR_NWFILTER_NEW_RULES_TEARDOWN;
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
"iptables -F FP-vnet0\n"
"iptables -X FP-vnet0\n"
"iptables -F FJ-vnet0\n"
"iptables -X FJ-vnet0\n"
"iptables -F HJ-vnet0\n"
"iptables -X HJ-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
"ip6tables -F FP-vnet0\n"
"ip6tables -X FP-vnet0\n"
"ip6tables -F FJ-vnet0\n"
"ip6tables -X FJ-vnet0\n"
"ip6tables -F HJ-vnet0\n"
"ip6tables -X HJ-vnet0\n"
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
"ebtables -t nat -L libvirt-J-vnet0\n"
"ebtables -t nat -L libvirt-P-vnet0\n"
"ebtables -t nat -F libvirt-J-vnet0\n"
"ebtables -t nat -X libvirt-J-vnet0\n"
"ebtables -t nat -F libvirt-P-vnet0\n"
"ebtables -t nat -X libvirt-P-vnet0\n";
char *actual = NULL; char *actual = NULL;
int ret = -1; int ret = -1;
@ -282,6 +287,7 @@ testNWFilterEBIPTablesApplyBasicRules(const void *opaque ATTRIBUTE_UNUSED)
{ {
virBuffer buf = VIR_BUFFER_INITIALIZER; virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
@ -353,6 +359,7 @@ testNWFilterEBIPTablesApplyDHCPOnlyRules(const void *opaque ATTRIBUTE_UNUSED)
{ {
virBuffer buf = VIR_BUFFER_INITIALIZER; virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
@ -443,6 +450,7 @@ testNWFilterEBIPTablesApplyDropAllRules(const void *opaque ATTRIBUTE_UNUSED)
{ {
virBuffer buf = VIR_BUFFER_INITIALIZER; virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"