mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-27 11:01:19 +00:00
Convert nwfilter ebtablesRemoveBasicRules to virFirewall
Convert the nwfilter ebtablesRemoveBasicRules method to use the virFirewall object APIs instead of creating shell scripts using virBuffer APIs. This provides a performance improvement through allowing direct use of firewalld dbus APIs and will facilitate automated testing. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
parent
3010fae592
commit
d7b83ab7c3
@ -206,7 +206,7 @@ static const char *m_physdev_out_old_str = "-m physdev --physdev-out";
|
|||||||
static int ebtablesRemoveBasicRules(const char *ifname);
|
static int ebtablesRemoveBasicRules(const char *ifname);
|
||||||
static int ebiptablesDriverInit(bool privileged);
|
static int ebiptablesDriverInit(bool privileged);
|
||||||
static void ebiptablesDriverShutdown(void);
|
static void ebiptablesDriverShutdown(void);
|
||||||
static void ebtablesCleanAll(const char *ifname);
|
static int ebtablesCleanAll(const char *ifname);
|
||||||
static int ebiptablesAllTeardown(const char *ifname);
|
static int ebiptablesAllTeardown(const char *ifname);
|
||||||
|
|
||||||
static virMutex execCLIMutex = VIR_MUTEX_INITIALIZER;
|
static virMutex execCLIMutex = VIR_MUTEX_INITIALIZER;
|
||||||
@ -253,6 +253,12 @@ static char chainprefixes_host[3] = {
|
|||||||
0
|
0
|
||||||
};
|
};
|
||||||
|
|
||||||
|
static char chainprefixes_host_temp[3] = {
|
||||||
|
CHAINPREFIX_HOST_IN_TEMP,
|
||||||
|
CHAINPREFIX_HOST_OUT_TEMP,
|
||||||
|
0
|
||||||
|
};
|
||||||
|
|
||||||
static int
|
static int
|
||||||
printVar(virNWFilterVarCombIterPtr vars,
|
printVar(virNWFilterVarCombIterPtr vars,
|
||||||
char *buf, int bufsize,
|
char *buf, int bufsize,
|
||||||
@ -2916,14 +2922,6 @@ _ebtablesRemoveRootChainFW(virFirewallPtr fw,
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
static void
|
|
||||||
ebtablesRemoveRootChain(virBufferPtr buf,
|
|
||||||
bool incoming, const char *ifname)
|
|
||||||
{
|
|
||||||
_ebtablesRemoveRootChain(buf, incoming, ifname, false);
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
static void
|
static void
|
||||||
ebtablesRemoveRootChainFW(virFirewallPtr fw,
|
ebtablesRemoveRootChainFW(virFirewallPtr fw,
|
||||||
bool incoming, const char *ifname)
|
bool incoming, const char *ifname)
|
||||||
@ -2940,6 +2938,14 @@ ebtablesRemoveTmpRootChain(virBufferPtr buf,
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static void
|
||||||
|
ebtablesRemoveTmpRootChainFW(virFirewallPtr fw,
|
||||||
|
bool incoming, const char *ifname)
|
||||||
|
{
|
||||||
|
_ebtablesRemoveRootChainFW(fw, incoming, ifname, 1);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
static void
|
static void
|
||||||
_ebtablesUnlinkRootChain(virBufferPtr buf,
|
_ebtablesUnlinkRootChain(virBufferPtr buf,
|
||||||
bool incoming, const char *ifname,
|
bool incoming, const char *ifname,
|
||||||
@ -2994,14 +3000,6 @@ _ebtablesUnlinkRootChainFW(virFirewallPtr fw,
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
static void
|
|
||||||
ebtablesUnlinkRootChain(virBufferPtr buf,
|
|
||||||
bool incoming, const char *ifname)
|
|
||||||
{
|
|
||||||
_ebtablesUnlinkRootChain(buf, incoming, ifname, false);
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
static void
|
static void
|
||||||
ebtablesUnlinkRootChainFW(virFirewallPtr fw,
|
ebtablesUnlinkRootChainFW(virFirewallPtr fw,
|
||||||
bool incoming, const char *ifname)
|
bool incoming, const char *ifname)
|
||||||
@ -3018,6 +3016,14 @@ ebtablesUnlinkTmpRootChain(virBufferPtr buf,
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static void
|
||||||
|
ebtablesUnlinkTmpRootChainFW(virFirewallPtr fw,
|
||||||
|
int incoming, const char *ifname)
|
||||||
|
{
|
||||||
|
_ebtablesUnlinkRootChainFW(fw, incoming, ifname, 1);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
static int
|
static int
|
||||||
ebtablesCreateTmpSubChain(ebiptablesRuleInstPtr *inst,
|
ebtablesCreateTmpSubChain(ebiptablesRuleInstPtr *inst,
|
||||||
int *nRuleInstances,
|
int *nRuleInstances,
|
||||||
@ -3184,19 +3190,6 @@ _ebtablesRemoveSubChainsFW(virFirewallPtr fw,
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static void
|
|
||||||
ebtablesRemoveSubChains(virBufferPtr buf,
|
|
||||||
const char *ifname)
|
|
||||||
{
|
|
||||||
char chains[3] = {
|
|
||||||
CHAINPREFIX_HOST_IN,
|
|
||||||
CHAINPREFIX_HOST_OUT,
|
|
||||||
0
|
|
||||||
};
|
|
||||||
|
|
||||||
_ebtablesRemoveSubChains(buf, ifname, chains);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
static void
|
||||||
ebtablesRemoveSubChainsFW(virFirewallPtr fw,
|
ebtablesRemoveSubChainsFW(virFirewallPtr fw,
|
||||||
const char *ifname)
|
const char *ifname)
|
||||||
@ -3217,6 +3210,13 @@ ebtablesRemoveTmpSubChains(virBufferPtr buf,
|
|||||||
_ebtablesRemoveSubChains(buf, ifname, chains);
|
_ebtablesRemoveSubChains(buf, ifname, chains);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void
|
||||||
|
ebtablesRemoveTmpSubChainsFW(virFirewallPtr fw,
|
||||||
|
const char *ifname)
|
||||||
|
{
|
||||||
|
_ebtablesRemoveSubChainsFW(fw, ifname, chainprefixes_host_temp);
|
||||||
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
ebtablesRenameTmpSubChain(virBufferPtr buf,
|
ebtablesRenameTmpSubChain(virBufferPtr buf,
|
||||||
bool incoming,
|
bool incoming,
|
||||||
@ -3683,34 +3683,35 @@ ebtablesApplyDropAllRules(const char *ifname)
|
|||||||
static int
|
static int
|
||||||
ebtablesRemoveBasicRules(const char *ifname)
|
ebtablesRemoveBasicRules(const char *ifname)
|
||||||
{
|
{
|
||||||
ebtablesCleanAll(ifname);
|
return ebtablesCleanAll(ifname);
|
||||||
return 0;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
static void
|
static int
|
||||||
ebtablesCleanAll(const char *ifname)
|
ebtablesCleanAll(const char *ifname)
|
||||||
{
|
{
|
||||||
virBuffer buf = VIR_BUFFER_INITIALIZER;
|
virFirewallPtr fw = virFirewallNew();
|
||||||
|
int ret = -1;
|
||||||
|
|
||||||
if (!ebtables_cmd_path)
|
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
|
||||||
return;
|
|
||||||
|
|
||||||
NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
|
ebtablesUnlinkRootChainFW(fw, true, ifname);
|
||||||
|
ebtablesUnlinkRootChainFW(fw, false, ifname);
|
||||||
|
ebtablesRemoveSubChainsFW(fw, ifname);
|
||||||
|
ebtablesRemoveRootChainFW(fw, true, ifname);
|
||||||
|
ebtablesRemoveRootChainFW(fw, false, ifname);
|
||||||
|
|
||||||
ebtablesUnlinkRootChain(&buf, true, ifname);
|
ebtablesUnlinkTmpRootChainFW(fw, true, ifname);
|
||||||
ebtablesUnlinkRootChain(&buf, false, ifname);
|
ebtablesUnlinkTmpRootChainFW(fw, false, ifname);
|
||||||
ebtablesRemoveSubChains(&buf, ifname);
|
ebtablesRemoveTmpSubChainsFW(fw, ifname);
|
||||||
ebtablesRemoveRootChain(&buf, true, ifname);
|
ebtablesRemoveTmpRootChainFW(fw, true, ifname);
|
||||||
ebtablesRemoveRootChain(&buf, false, ifname);
|
ebtablesRemoveTmpRootChainFW(fw, false, ifname);
|
||||||
|
|
||||||
ebtablesUnlinkTmpRootChain(&buf, true, ifname);
|
virMutexLock(&execCLIMutex);
|
||||||
ebtablesUnlinkTmpRootChain(&buf, false, ifname);
|
ret = virFirewallApply(fw);
|
||||||
ebtablesRemoveTmpSubChains(&buf, ifname);
|
virMutexUnlock(&execCLIMutex);
|
||||||
ebtablesRemoveTmpRootChain(&buf, true, ifname);
|
virFirewallFree(fw);
|
||||||
ebtablesRemoveTmpRootChain(&buf, false, ifname);
|
return ret;
|
||||||
|
|
||||||
ebiptablesExecCLI(&buf, true, NULL);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -167,6 +167,55 @@ testNWFilterEBIPTablesTearOldRules(const void *opaque ATTRIBUTE_UNUSED)
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static int
|
||||||
|
testNWFilterEBIPTablesRemoveBasicRules(const void *opaque ATTRIBUTE_UNUSED)
|
||||||
|
{
|
||||||
|
virBuffer buf = VIR_BUFFER_INITIALIZER;
|
||||||
|
const char *expected =
|
||||||
|
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n"
|
||||||
|
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n"
|
||||||
|
"ebtables -t nat -L libvirt-I-vnet0\n"
|
||||||
|
"ebtables -t nat -L libvirt-O-vnet0\n"
|
||||||
|
"ebtables -t nat -F libvirt-I-vnet0\n"
|
||||||
|
"ebtables -t nat -X libvirt-I-vnet0\n"
|
||||||
|
"ebtables -t nat -F libvirt-O-vnet0\n"
|
||||||
|
"ebtables -t nat -X libvirt-O-vnet0\n"
|
||||||
|
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
|
||||||
|
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
|
||||||
|
"ebtables -t nat -L libvirt-J-vnet0\n"
|
||||||
|
"ebtables -t nat -L libvirt-P-vnet0\n"
|
||||||
|
"ebtables -t nat -F libvirt-J-vnet0\n"
|
||||||
|
"ebtables -t nat -X libvirt-J-vnet0\n"
|
||||||
|
"ebtables -t nat -F libvirt-P-vnet0\n"
|
||||||
|
"ebtables -t nat -X libvirt-P-vnet0\n";
|
||||||
|
char *actual = NULL;
|
||||||
|
int ret = -1;
|
||||||
|
|
||||||
|
virCommandSetDryRun(&buf, NULL, NULL);
|
||||||
|
|
||||||
|
if (ebiptables_driver.removeBasicRules("vnet0") < 0)
|
||||||
|
goto cleanup;
|
||||||
|
|
||||||
|
if (virBufferError(&buf))
|
||||||
|
goto cleanup;
|
||||||
|
|
||||||
|
actual = virBufferContentAndReset(&buf);
|
||||||
|
virtTestClearCommandPath(actual);
|
||||||
|
|
||||||
|
if (STRNEQ_NULLABLE(actual, expected)) {
|
||||||
|
virtTestDifference(stderr, actual, expected);
|
||||||
|
goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = 0;
|
||||||
|
cleanup:
|
||||||
|
virCommandSetDryRun(NULL, NULL, NULL);
|
||||||
|
virBufferFreeAndReset(&buf);
|
||||||
|
VIR_FREE(actual);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
static int
|
static int
|
||||||
mymain(void)
|
mymain(void)
|
||||||
{
|
{
|
||||||
@ -187,6 +236,11 @@ mymain(void)
|
|||||||
NULL) < 0)
|
NULL) < 0)
|
||||||
ret = -1;
|
ret = -1;
|
||||||
|
|
||||||
|
if (virtTestRun("ebiptablesRemoveBasicRules",
|
||||||
|
testNWFilterEBIPTablesRemoveBasicRules,
|
||||||
|
NULL) < 0)
|
||||||
|
ret = -1;
|
||||||
|
|
||||||
cleanup:
|
cleanup:
|
||||||
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
|
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user