External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-10-30 01:43:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Convert nwfilter ebtablesRemoveBasicRules to virFirewall

Browse Source 
Convert the nwfilter ebtablesRemoveBasicRules method to use the
virFirewall object APIs instead of creating shell scripts
using virBuffer APIs. This provides a performance improvement
through allowing direct use of firewalld dbus APIs and will
facilitate automated testing.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2014-03-14 12:14:13 +00:00
parent 3010fae592
commit d7b83ab7c3
2 changed files with 104 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

99
src/nwfilter/nwfilter_ebiptables_driver.c
View File

@ -206,7 +206,7 @@ static const char *m_physdev_out_old_str = "-m physdev --physdev-out";
static int ebtablesRemoveBasicRules(const char *ifname); static int ebtablesRemoveBasicRules(const char *ifname);
static int ebiptablesDriverInit(bool privileged); static int ebiptablesDriverInit(bool privileged);
static void ebiptablesDriverShutdown(void); static void ebiptablesDriverShutdown(void);
static void ebtablesCleanAll(const char *ifname); static int ebtablesCleanAll(const char *ifname);
static int ebiptablesAllTeardown(const char *ifname); static int ebiptablesAllTeardown(const char *ifname);
static virMutex execCLIMutex = VIR_MUTEX_INITIALIZER; static virMutex execCLIMutex = VIR_MUTEX_INITIALIZER;
@ -253,6 +253,12 @@ static char chainprefixes_host[3] = {
0 0
}; };
static char chainprefixes_host_temp[3] = {
CHAINPREFIX_HOST_IN_TEMP,
CHAINPREFIX_HOST_OUT_TEMP,
0
};
static int static int
printVar(virNWFilterVarCombIterPtr vars, printVar(virNWFilterVarCombIterPtr vars,
char *buf, int bufsize, char *buf, int bufsize,
@ -2916,14 +2922,6 @@ _ebtablesRemoveRootChainFW(virFirewallPtr fw,
} }
static void
ebtablesRemoveRootChain(virBufferPtr buf,
bool incoming, const char *ifname)
{
_ebtablesRemoveRootChain(buf, incoming, ifname, false);
}
static void static void
ebtablesRemoveRootChainFW(virFirewallPtr fw, ebtablesRemoveRootChainFW(virFirewallPtr fw,
bool incoming, const char *ifname) bool incoming, const char *ifname)
@ -2940,6 +2938,14 @@ ebtablesRemoveTmpRootChain(virBufferPtr buf,
} }
static void
ebtablesRemoveTmpRootChainFW(virFirewallPtr fw,
bool incoming, const char *ifname)
{
_ebtablesRemoveRootChainFW(fw, incoming, ifname, 1);
}
static void static void
_ebtablesUnlinkRootChain(virBufferPtr buf, _ebtablesUnlinkRootChain(virBufferPtr buf,
bool incoming, const char *ifname, bool incoming, const char *ifname,
@ -2994,14 +3000,6 @@ _ebtablesUnlinkRootChainFW(virFirewallPtr fw,
} }
static void
ebtablesUnlinkRootChain(virBufferPtr buf,
bool incoming, const char *ifname)
{
_ebtablesUnlinkRootChain(buf, incoming, ifname, false);
}
static void static void
ebtablesUnlinkRootChainFW(virFirewallPtr fw, ebtablesUnlinkRootChainFW(virFirewallPtr fw,
bool incoming, const char *ifname) bool incoming, const char *ifname)
@ -3018,6 +3016,14 @@ ebtablesUnlinkTmpRootChain(virBufferPtr buf,
} }
static void
ebtablesUnlinkTmpRootChainFW(virFirewallPtr fw,
int incoming, const char *ifname)
{
_ebtablesUnlinkRootChainFW(fw, incoming, ifname, 1);
}
static int static int
ebtablesCreateTmpSubChain(ebiptablesRuleInstPtr *inst, ebtablesCreateTmpSubChain(ebiptablesRuleInstPtr *inst,
int *nRuleInstances, int *nRuleInstances,
@ -3184,19 +3190,6 @@ _ebtablesRemoveSubChainsFW(virFirewallPtr fw,
} }
} }
static void
ebtablesRemoveSubChains(virBufferPtr buf,
const char *ifname)
{
char chains[3] = {
CHAINPREFIX_HOST_IN,
CHAINPREFIX_HOST_OUT,
0
};
_ebtablesRemoveSubChains(buf, ifname, chains);
}
static void static void
ebtablesRemoveSubChainsFW(virFirewallPtr fw, ebtablesRemoveSubChainsFW(virFirewallPtr fw,
const char *ifname) const char *ifname)
@ -3217,6 +3210,13 @@ ebtablesRemoveTmpSubChains(virBufferPtr buf,
_ebtablesRemoveSubChains(buf, ifname, chains); _ebtablesRemoveSubChains(buf, ifname, chains);
} }
static void
ebtablesRemoveTmpSubChainsFW(virFirewallPtr fw,
const char *ifname)
{
_ebtablesRemoveSubChainsFW(fw, ifname, chainprefixes_host_temp);
}
static void static void
ebtablesRenameTmpSubChain(virBufferPtr buf, ebtablesRenameTmpSubChain(virBufferPtr buf,
bool incoming, bool incoming,
@ -3683,34 +3683,35 @@ ebtablesApplyDropAllRules(const char *ifname)
static int static int
ebtablesRemoveBasicRules(const char *ifname) ebtablesRemoveBasicRules(const char *ifname)
{ {
ebtablesCleanAll(ifname); return ebtablesCleanAll(ifname);
return 0;
} }
static void static int
ebtablesCleanAll(const char *ifname) ebtablesCleanAll(const char *ifname)
{ {
virBuffer buf = VIR_BUFFER_INITIALIZER; virFirewallPtr fw = virFirewallNew();
int ret = -1;
if (!ebtables_cmd_path) virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
return;
NWFILTER_SET_EBTABLES_SHELLVAR(&buf); ebtablesUnlinkRootChainFW(fw, true, ifname);
ebtablesUnlinkRootChainFW(fw, false, ifname);
ebtablesRemoveSubChainsFW(fw, ifname);
ebtablesRemoveRootChainFW(fw, true, ifname);
ebtablesRemoveRootChainFW(fw, false, ifname);
ebtablesUnlinkRootChain(&buf, true, ifname); ebtablesUnlinkTmpRootChainFW(fw, true, ifname);
ebtablesUnlinkRootChain(&buf, false, ifname); ebtablesUnlinkTmpRootChainFW(fw, false, ifname);
ebtablesRemoveSubChains(&buf, ifname); ebtablesRemoveTmpSubChainsFW(fw, ifname);
ebtablesRemoveRootChain(&buf, true, ifname); ebtablesRemoveTmpRootChainFW(fw, true, ifname);
ebtablesRemoveRootChain(&buf, false, ifname); ebtablesRemoveTmpRootChainFW(fw, false, ifname);
ebtablesUnlinkTmpRootChain(&buf, true, ifname); virMutexLock(&execCLIMutex);
ebtablesUnlinkTmpRootChain(&buf, false, ifname); ret = virFirewallApply(fw);
ebtablesRemoveTmpSubChains(&buf, ifname); virMutexUnlock(&execCLIMutex);
ebtablesRemoveTmpRootChain(&buf, true, ifname); virFirewallFree(fw);
ebtablesRemoveTmpRootChain(&buf, false, ifname); return ret;
ebiptablesExecCLI(&buf, true, NULL);
} }

54
tests/nwfilterebiptablestest.c
View File

@ -167,6 +167,55 @@ testNWFilterEBIPTablesTearOldRules(const void *opaque ATTRIBUTE_UNUSED)
} }
static int
testNWFilterEBIPTablesRemoveBasicRules(const void *opaque ATTRIBUTE_UNUSED)
{
virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected =
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n"
"ebtables -t nat -L libvirt-I-vnet0\n"
"ebtables -t nat -L libvirt-O-vnet0\n"
"ebtables -t nat -F libvirt-I-vnet0\n"
"ebtables -t nat -X libvirt-I-vnet0\n"
"ebtables -t nat -F libvirt-O-vnet0\n"
"ebtables -t nat -X libvirt-O-vnet0\n"
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
"ebtables -t nat -L libvirt-J-vnet0\n"
"ebtables -t nat -L libvirt-P-vnet0\n"
"ebtables -t nat -F libvirt-J-vnet0\n"
"ebtables -t nat -X libvirt-J-vnet0\n"
"ebtables -t nat -F libvirt-P-vnet0\n"
"ebtables -t nat -X libvirt-P-vnet0\n";
char *actual = NULL;
int ret = -1;
virCommandSetDryRun(&buf, NULL, NULL);
if (ebiptables_driver.removeBasicRules("vnet0") < 0)
goto cleanup;
if (virBufferError(&buf))
goto cleanup;
actual = virBufferContentAndReset(&buf);
virtTestClearCommandPath(actual);
if (STRNEQ_NULLABLE(actual, expected)) {
virtTestDifference(stderr, actual, expected);
goto cleanup;
}
ret = 0;
cleanup:
virCommandSetDryRun(NULL, NULL, NULL);
virBufferFreeAndReset(&buf);
VIR_FREE(actual);
return ret;
}
static int static int
mymain(void) mymain(void)
{ {
@ -187,6 +236,11 @@ mymain(void)
NULL) < 0) NULL) < 0)
ret = -1; ret = -1;
if (virtTestRun("ebiptablesRemoveBasicRules",
testNWFilterEBIPTablesRemoveBasicRules,
NULL) < 0)
ret = -1;
cleanup: cleanup:
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
} }