External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-22 19:32:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix formatting of network address in iptables helpers

Browse Source 
The network address was being set to 192.168.122.0 instead
of 192.168.122.0/24. Fix this by removing the unneccessary
'network' field from virNetworkDef and just pass the
network address and netmask into the iptables APIs directly.

* src/conf/network_conf.h, src/conf/network_conf.c: Remove
  the 'network' field from virNEtworkDef.
* src/network/bridge_driver.c: Update for iptables API changes
* src/util/iptables.c, src/util/iptables.h: Require the
  network address + netmask pair to be passed in
This commit is contained in:
Daniel P. Berrange 2010-10-25 15:10:33 +01:00
parent 1a29a14a2f
commit eff1735e42
5 changed files with 142 additions and 98 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/conf/network_conf.c
View File

@ -438,10 +438,6 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt)
goto error; goto error;
} }
def->network = def->ipAddress;
def->network.data.inet4.sin_addr.s_addr &=
def->netmask.data.inet4.sin_addr.s_addr;
if ((ip = virXPathNode("./ip[1]", ctxt)) && if ((ip = virXPathNode("./ip[1]", ctxt)) &&
virNetworkIPParseXML(def, ip) < 0) virNetworkIPParseXML(def, ip) < 0)
goto error; goto error;

1
src/conf/network_conf.h
View File

@ -72,7 +72,6 @@ struct _virNetworkDef {
virSocketAddr ipAddress; /* Bridge IP address */ virSocketAddr ipAddress; /* Bridge IP address */
virSocketAddr netmask; virSocketAddr netmask;
virSocketAddr network;
unsigned int nranges; /* Zero or more dhcp ranges */ unsigned int nranges; /* Zero or more dhcp ranges */
virNetworkDHCPRangeDefPtr ranges; virNetworkDHCPRangeDefPtr ranges;

62
src/network/bridge_driver.c
View File

@ -671,7 +671,8 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
int err; int err;
/* allow forwarding packets from the bridge interface */ /* allow forwarding packets from the bridge interface */
if ((err = iptablesAddForwardAllowOut(driver->iptables, if ((err = iptablesAddForwardAllowOut(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->bridge, network->def->bridge,
network->def->forwardDev))) { network->def->forwardDev))) {
virReportSystemError(err, virReportSystemError(err,
@ -682,9 +683,10 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
/* allow forwarding packets to the bridge interface if they are part of an existing connection */ /* allow forwarding packets to the bridge interface if they are part of an existing connection */
if ((err = iptablesAddForwardAllowRelatedIn(driver->iptables, if ((err = iptablesAddForwardAllowRelatedIn(driver->iptables,
&network->def->network, &network->def->ipAddress,
network->def->bridge, &network->def->netmask,
network->def->forwardDev))) { network->def->bridge,
network->def->forwardDev))) {
virReportSystemError(err, virReportSystemError(err,
_("failed to add iptables rule to allow forwarding to '%s'"), _("failed to add iptables rule to allow forwarding to '%s'"),
network->def->bridge); network->def->bridge);
@ -716,7 +718,8 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
/* First the generic masquerade rule for other protocols */ /* First the generic masquerade rule for other protocols */
if ((err = iptablesAddForwardMasquerade(driver->iptables, if ((err = iptablesAddForwardMasquerade(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->forwardDev, network->def->forwardDev,
NULL))) { NULL))) {
virReportSystemError(err, virReportSystemError(err,
@ -727,7 +730,8 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
/* UDP with a source port restriction */ /* UDP with a source port restriction */
if ((err = iptablesAddForwardMasquerade(driver->iptables, if ((err = iptablesAddForwardMasquerade(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->forwardDev, network->def->forwardDev,
"udp"))) { "udp"))) {
virReportSystemError(err, virReportSystemError(err,
@ -738,7 +742,8 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
/* TCP with a source port restriction */ /* TCP with a source port restriction */
if ((err = iptablesAddForwardMasquerade(driver->iptables, if ((err = iptablesAddForwardMasquerade(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->forwardDev, network->def->forwardDev,
"tcp"))) { "tcp"))) {
virReportSystemError(err, virReportSystemError(err,
@ -751,22 +756,26 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
masqerr5: masqerr5:
iptablesRemoveForwardMasquerade(driver->iptables, iptablesRemoveForwardMasquerade(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->forwardDev, network->def->forwardDev,
"udp"); "udp");
masqerr4: masqerr4:
iptablesRemoveForwardMasquerade(driver->iptables, iptablesRemoveForwardMasquerade(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->forwardDev, network->def->forwardDev,
NULL); NULL);
masqerr3: masqerr3:
iptablesRemoveForwardAllowRelatedIn(driver->iptables, iptablesRemoveForwardAllowRelatedIn(driver->iptables,
&network->def->network, &network->def->ipAddress,
network->def->bridge, &network->def->netmask,
network->def->forwardDev); network->def->bridge,
network->def->forwardDev);
masqerr2: masqerr2:
iptablesRemoveForwardAllowOut(driver->iptables, iptablesRemoveForwardAllowOut(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->bridge, network->def->bridge,
network->def->forwardDev); network->def->forwardDev);
masqerr1: masqerr1:
@ -779,7 +788,8 @@ networkAddRoutingIptablesRules(struct network_driver *driver,
int err; int err;
/* allow routing packets from the bridge interface */ /* allow routing packets from the bridge interface */
if ((err = iptablesAddForwardAllowOut(driver->iptables, if ((err = iptablesAddForwardAllowOut(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->bridge, network->def->bridge,
network->def->forwardDev))) { network->def->forwardDev))) {
virReportSystemError(err, virReportSystemError(err,
@ -790,7 +800,8 @@ networkAddRoutingIptablesRules(struct network_driver *driver,
/* allow routing packets to the bridge interface */ /* allow routing packets to the bridge interface */
if ((err = iptablesAddForwardAllowIn(driver->iptables, if ((err = iptablesAddForwardAllowIn(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->bridge, network->def->bridge,
network->def->forwardDev))) { network->def->forwardDev))) {
virReportSystemError(err, virReportSystemError(err,
@ -804,7 +815,8 @@ networkAddRoutingIptablesRules(struct network_driver *driver,
routeerr2: routeerr2:
iptablesRemoveForwardAllowOut(driver->iptables, iptablesRemoveForwardAllowOut(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->bridge, network->def->bridge,
network->def->forwardDev); network->def->forwardDev);
routeerr1: routeerr1:
@ -943,29 +955,35 @@ networkRemoveIptablesRules(struct network_driver *driver,
if (network->def->forwardType != VIR_NETWORK_FORWARD_NONE) { if (network->def->forwardType != VIR_NETWORK_FORWARD_NONE) {
if (network->def->forwardType == VIR_NETWORK_FORWARD_NAT) { if (network->def->forwardType == VIR_NETWORK_FORWARD_NAT) {
iptablesRemoveForwardMasquerade(driver->iptables, iptablesRemoveForwardMasquerade(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->forwardDev, network->def->forwardDev,
"tcp"); "tcp");
iptablesRemoveForwardMasquerade(driver->iptables, iptablesRemoveForwardMasquerade(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->forwardDev, network->def->forwardDev,
"udp"); "udp");
iptablesRemoveForwardMasquerade(driver->iptables, iptablesRemoveForwardMasquerade(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->forwardDev, network->def->forwardDev,
NULL); NULL);
iptablesRemoveForwardAllowRelatedIn(driver->iptables, iptablesRemoveForwardAllowRelatedIn(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->bridge, network->def->bridge,
network->def->forwardDev); network->def->forwardDev);
} else if (network->def->forwardType == VIR_NETWORK_FORWARD_ROUTE) } else if (network->def->forwardType == VIR_NETWORK_FORWARD_ROUTE)
iptablesRemoveForwardAllowIn(driver->iptables, iptablesRemoveForwardAllowIn(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->bridge, network->def->bridge,
network->def->forwardDev); network->def->forwardDev);
iptablesRemoveForwardAllowOut(driver->iptables, iptablesRemoveForwardAllowOut(driver->iptables,
&network->def->network, &network->def->ipAddress,
&network->def->netmask,
network->def->bridge, network->def->bridge,
network->def->forwardDev); network->def->forwardDev);
} }

149
src/util/iptables.c
View File

@ -44,8 +44,9 @@
#include "virterror_internal.h" #include "virterror_internal.h"
#include "logging.h" #include "logging.h"
#define VIR_FROM_THIS VIR_FROM_NONE
#define iptablesError(code, ...) \ #define iptablesError(code, ...) \
virReportErrorHelper(NULL, VIR_FROM_NONE, code, __FILE__, \ virReportErrorHelper(NULL, VIR_FROM_THIS, code, __FILE__, \
__FUNCTION__, __LINE__, __VA_ARGS__) __FUNCTION__, __LINE__, __VA_ARGS__)
enum { enum {
@ -323,26 +324,55 @@ iptablesRemoveUdpInput(iptablesContext *ctx,
} }
static char *iptablesFormatNetwork(virSocketAddr *netaddr,
virSocketAddr *netmask)
{
virSocketAddr network;
int prefix;
char *netstr;
char *ret;
if (!VIR_SOCKET_IS_FAMILY(netaddr, AF_INET) ||
!VIR_SOCKET_IS_FAMILY(netmask, AF_INET)) {
iptablesError(VIR_ERR_CONFIG_UNSUPPORTED,
_("Only IPv4 addresses can be used with iptables"));
return NULL;
}
network = *netaddr;
network.data.inet4.sin_addr.s_addr &=
netmask->data.inet4.sin_addr.s_addr;
prefix = virSocketGetNumNetmaskBits(netmask);
netstr = virSocketFormatAddr(&network);
if (!netstr)
return NULL;
if (virAsprintf(&ret, "%s/%d", netstr, prefix) < 0)
virReportOOMError();
VIR_FREE(netstr);
return ret;
}
/* Allow all traffic coming from the bridge, with a valid network address /* Allow all traffic coming from the bridge, with a valid network address
* to proceed to WAN * to proceed to WAN
*/ */
static int static int
iptablesForwardAllowOut(iptablesContext *ctx, iptablesForwardAllowOut(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
const char *iface, virSocketAddr *netmask,
const char *physdev, const char *iface,
int action) const char *physdev,
int action)
{ {
int ret; int ret;
char *networkstr; char *networkstr;
if (!VIR_SOCKET_IS_FAMILY(network, AF_INET)) { if (!(networkstr = iptablesFormatNetwork(netaddr, netmask)))
iptablesError(VIR_ERR_CONFIG_UNSUPPORTED,
_("Only IPv4 addresses can be used with iptables"));
return -1;
}
if (!(networkstr = virSocketFormatAddr(network)))
return -1; return -1;
if (physdev && physdev[0]) { if (physdev && physdev[0]) {
@ -380,11 +410,12 @@ iptablesForwardAllowOut(iptablesContext *ctx,
*/ */
int int
iptablesAddForwardAllowOut(iptablesContext *ctx, iptablesAddForwardAllowOut(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
const char *iface, virSocketAddr *netmask,
const char *physdev) const char *iface,
const char *physdev)
{ {
return iptablesForwardAllowOut(ctx, network, iface, physdev, ADD); return iptablesForwardAllowOut(ctx, netaddr, netmask, iface, physdev, ADD);
} }
/** /**
@ -402,11 +433,12 @@ iptablesAddForwardAllowOut(iptablesContext *ctx,
*/ */
int int
iptablesRemoveForwardAllowOut(iptablesContext *ctx, iptablesRemoveForwardAllowOut(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
const char *iface, virSocketAddr *netmask,
const char *physdev) const char *iface,
const char *physdev)
{ {
return iptablesForwardAllowOut(ctx, network, iface, physdev, REMOVE); return iptablesForwardAllowOut(ctx, netaddr, netmask, iface, physdev, REMOVE);
} }
@ -415,21 +447,16 @@ iptablesRemoveForwardAllowOut(iptablesContext *ctx,
*/ */
static int static int
iptablesForwardAllowRelatedIn(iptablesContext *ctx, iptablesForwardAllowRelatedIn(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
const char *iface, virSocketAddr *netmask,
const char *physdev, const char *iface,
int action) const char *physdev,
int action)
{ {
int ret; int ret;
char *networkstr; char *networkstr;
if (!VIR_SOCKET_IS_FAMILY(network, AF_INET)) { if (!(networkstr = iptablesFormatNetwork(netaddr, netmask)))
iptablesError(VIR_ERR_CONFIG_UNSUPPORTED,
_("Only IPv4 addresses can be used with iptables"));
return -1;
}
if (!(networkstr = virSocketFormatAddr(network)))
return -1; return -1;
if (physdev && physdev[0]) { if (physdev && physdev[0]) {
@ -471,11 +498,12 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx,
*/ */
int int
iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, iptablesAddForwardAllowRelatedIn(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
const char *iface, virSocketAddr *netmask,
const char *physdev) const char *iface,
const char *physdev)
{ {
return iptablesForwardAllowRelatedIn(ctx, network, iface, physdev, ADD); return iptablesForwardAllowRelatedIn(ctx, netaddr, netmask, iface, physdev, ADD);
} }
/** /**
@ -493,18 +521,20 @@ iptablesAddForwardAllowRelatedIn(iptablesContext *ctx,
*/ */
int int
iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx, iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
const char *iface, virSocketAddr *netmask,
const char *physdev) const char *iface,
const char *physdev)
{ {
return iptablesForwardAllowRelatedIn(ctx, network, iface, physdev, REMOVE); return iptablesForwardAllowRelatedIn(ctx, netaddr, netmask, iface, physdev, REMOVE);
} }
/* Allow all traffic destined to the bridge, with a valid network address /* Allow all traffic destined to the bridge, with a valid network address
*/ */
static int static int
iptablesForwardAllowIn(iptablesContext *ctx, iptablesForwardAllowIn(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *iface, const char *iface,
const char *physdev, const char *physdev,
int action) int action)
@ -512,13 +542,7 @@ iptablesForwardAllowIn(iptablesContext *ctx,
int ret; int ret;
char *networkstr; char *networkstr;
if (!VIR_SOCKET_IS_FAMILY(network, AF_INET)) { if (!(networkstr = iptablesFormatNetwork(netaddr, netmask)))
iptablesError(VIR_ERR_CONFIG_UNSUPPORTED,
_("Only IPv4 addresses can be used with iptables"));
return -1;
}
if (!(networkstr = virSocketFormatAddr(network)))
return -1; return -1;
if (physdev && physdev[0]) { if (physdev && physdev[0]) {
@ -556,11 +580,12 @@ iptablesForwardAllowIn(iptablesContext *ctx,
*/ */
int int
iptablesAddForwardAllowIn(iptablesContext *ctx, iptablesAddForwardAllowIn(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *iface, const char *iface,
const char *physdev) const char *physdev)
{ {
return iptablesForwardAllowIn(ctx, network, iface, physdev, ADD); return iptablesForwardAllowIn(ctx, netaddr, netmask, iface, physdev, ADD);
} }
/** /**
@ -578,11 +603,12 @@ iptablesAddForwardAllowIn(iptablesContext *ctx,
*/ */
int int
iptablesRemoveForwardAllowIn(iptablesContext *ctx, iptablesRemoveForwardAllowIn(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *iface, const char *iface,
const char *physdev) const char *physdev)
{ {
return iptablesForwardAllowIn(ctx, network, iface, physdev, REMOVE); return iptablesForwardAllowIn(ctx, netaddr, netmask, iface, physdev, REMOVE);
} }
@ -744,7 +770,8 @@ iptablesRemoveForwardRejectIn(iptablesContext *ctx,
*/ */
static int static int
iptablesForwardMasquerade(iptablesContext *ctx, iptablesForwardMasquerade(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *physdev, const char *physdev,
const char *protocol, const char *protocol,
int action) int action)
@ -752,13 +779,7 @@ iptablesForwardMasquerade(iptablesContext *ctx,
int ret; int ret;
char *networkstr; char *networkstr;
if (!VIR_SOCKET_IS_FAMILY(network, AF_INET)) { if (!(networkstr = iptablesFormatNetwork(netaddr, netmask)))
iptablesError(VIR_ERR_CONFIG_UNSUPPORTED,
_("Only IPv4 addresses can be used with iptables"));
return -1;
}
if (!(networkstr = virSocketFormatAddr(network)))
return -1; return -1;
if (protocol && protocol[0]) { if (protocol && protocol[0]) {
@ -819,11 +840,12 @@ iptablesForwardMasquerade(iptablesContext *ctx,
*/ */
int int
iptablesAddForwardMasquerade(iptablesContext *ctx, iptablesAddForwardMasquerade(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *physdev, const char *physdev,
const char *protocol) const char *protocol)
{ {
return iptablesForwardMasquerade(ctx, network, physdev, protocol, ADD); return iptablesForwardMasquerade(ctx, netaddr, netmask, physdev, protocol, ADD);
} }
/** /**
@ -841,11 +863,12 @@ iptablesAddForwardMasquerade(iptablesContext *ctx,
*/ */
int int
iptablesRemoveForwardMasquerade(iptablesContext *ctx, iptablesRemoveForwardMasquerade(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *physdev, const char *physdev,
const char *protocol) const char *protocol)
{ {
return iptablesForwardMasquerade(ctx, network, physdev, protocol, REMOVE); return iptablesForwardMasquerade(ctx, netaddr, netmask, physdev, protocol, REMOVE);
} }

24
src/util/iptables.h
View File

@ -44,29 +44,35 @@ int iptablesRemoveUdpInput (iptablesContext *ctx,
int port); int port);
int iptablesAddForwardAllowOut (iptablesContext *ctx, int iptablesAddForwardAllowOut (iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *iface, const char *iface,
const char *physdev); const char *physdev);
int iptablesRemoveForwardAllowOut (iptablesContext *ctx, int iptablesRemoveForwardAllowOut (iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *iface, const char *iface,
const char *physdev); const char *physdev);
int iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, int iptablesAddForwardAllowRelatedIn(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *iface, const char *iface,
const char *physdev); const char *physdev);
int iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx, int iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *iface, const char *iface,
const char *physdev); const char *physdev);
int iptablesAddForwardAllowIn (iptablesContext *ctx, int iptablesAddForwardAllowIn (iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *iface, const char *iface,
const char *physdev); const char *physdev);
int iptablesRemoveForwardAllowIn (iptablesContext *ctx, int iptablesRemoveForwardAllowIn (iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *iface, const char *iface,
const char *physdev); const char *physdev);
@ -86,11 +92,13 @@ int iptablesRemoveForwardRejectIn (iptablesContext *ctx,
const char *iface); const char *iface);
int iptablesAddForwardMasquerade (iptablesContext *ctx, int iptablesAddForwardMasquerade (iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *physdev, const char *physdev,
const char *protocol); const char *protocol);
int iptablesRemoveForwardMasquerade (iptablesContext *ctx, int iptablesRemoveForwardMasquerade (iptablesContext *ctx,
virSocketAddr *network, virSocketAddr *netaddr,
virSocketAddr *netmask,
const char *physdev, const char *physdev,
const char *protocol); const char *protocol);
int iptablesAddOutputFixUdpChecksum (iptablesContext *ctx, int iptablesAddOutputFixUdpChecksum (iptablesContext *ctx,