External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-03 11:35:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

qemu: fail on attempts to use <filterref> for non-tap network connections

Browse Source 
nwfilter uses iptables and ebtables, which only work properly on
tap-based network connections (*not* on macvtap, for example), but we
just ignore any <filterref> elements for other types of networks,
potentially giving users a false sense of security.

This patch checks the network type and fails/logs an error if any
domain <interface> has a <filterref> when the connection isn't using a
tap device.

This resolves:

  https://bugzilla.redhat.com/show_bug.cgi?id=1180011
This commit is contained in:
Laine Stump 2015-08-10 02:05:29 -04:00
parent a6f9af8292
commit f4f1d18dc4
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/qemu/qemu_command.c
View File

@ -8588,6 +8588,17 @@ qemuBuildInterfaceCommandLine(virCommandPtr cmd,
return -1; return -1;
} }
/* and only TAP devices support nwfilter rules */
if (net->filter &&
!(actualType == VIR_DOMAIN_NET_TYPE_NETWORK ||
actualType == VIR_DOMAIN_NET_TYPE_BRIDGE)) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
_("filterref is not supported for "
"network interfaces of type %s"),
virDomainNetTypeToString(actualType));
return -1;
}
if (net->backend.tap && if (net->backend.tap &&
!(actualType == VIR_DOMAIN_NET_TYPE_NETWORK || !(actualType == VIR_DOMAIN_NET_TYPE_NETWORK ||
actualType == VIR_DOMAIN_NET_TYPE_BRIDGE)) { actualType == VIR_DOMAIN_NET_TYPE_BRIDGE)) {

11
src/qemu/qemu_hotplug.c
View File

@ -910,6 +910,17 @@ int qemuDomainAttachNetDevice(virConnectPtr conn,
return -1; return -1;
} }
/* and only TAP devices support nwfilter rules */
if (net->filter &&
!(actualType == VIR_DOMAIN_NET_TYPE_NETWORK ||
actualType == VIR_DOMAIN_NET_TYPE_BRIDGE)) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
_("filterref is not supported for "
"network interfaces of type %s"),
virDomainNetTypeToString(actualType));
return -1;
}
if (actualType == VIR_DOMAIN_NET_TYPE_BRIDGE || if (actualType == VIR_DOMAIN_NET_TYPE_BRIDGE ||
actualType == VIR_DOMAIN_NET_TYPE_NETWORK) { actualType == VIR_DOMAIN_NET_TYPE_NETWORK) {
tapfdSize = vhostfdSize = net->driver.virtio.queues; tapfdSize = vhostfdSize = net->driver.virtio.queues;