Add support for Qemu to have firewall rules applied and removed on VM
startup and shutdown respectively. This patch also provides support for
the updating of a filter that causes all VMs that reference the filter
to have their ebtables/iptables rules updated.
Signed-off-by: Stefan Berger <[email protected]>
---
src/qemu/qemu_conf.c | 37 +++++++++++++++++++++++++++++++++++++
src/qemu/qemu_conf.h | 2 ++
src/qemu/qemu_driver.c | 29 +++++++++++++++++++++++++++++
3 files changed, 68 insertions(+)
Index: libvirt-acl/src/qemu/qemu_conf.c
===================================================================
--- libvirt-acl.orig/src/qemu/qemu_conf.c
+++ libvirt-acl/src/qemu/qemu_conf.c
@@ -54,6 +54,7 @@
#include "network.h"
#include "macvtap.h"
#include "cpu/cpu.h"
+#include "nwfilter/nwfilter_gentech_driver.h"
#define VIR_FROM_THIS VIR_FROM_QEMU
@@ -346,6 +347,14 @@ int qemudLoadDriverConfig(struct qemud_d
}
}
+ p = virConfGetValue (conf, "nwFilter");
+ CHECK_TYPE ("nwFilter", VIR_CONF_LONG);
+ if (p && p->l) {
+ driver->nwFilter = p->l;
+ }
+ // FIXME: Remove this
+ driver->nwFilter = 1;
+
p = virConfGetValue (conf, "relaxed_acs_check");
CHECK_TYPE ("relaxed_acs_check", VIR_CONF_LONG);
if (p) driver->relaxedACS = p->l;
@@ -1468,6 +1477,17 @@ qemudPhysIfaceConnect(virConnectPtr conn
net->ifname);
}
}
+
+ if (rc >= 0 && driver->nwFilter) {
+ if ((net->filter) && (net->ifname)) {
+ err = virNWFilterInstantiateFilter(conn, net);
+ if (err) {
+ close(rc);
+ rc = -1;
+ delMacvtap(net->ifname);
+ }
+ }
+ }
#else
(void)conn;
(void)net;
@@ -1590,6 +1610,16 @@ qemudNetworkIfaceConnect(virConnectPtr c
}
}
+ if (tapfd >= 0 && driver->nwFilter) {
+ if ((net->filter) && (net->ifname)) {
+ err = virNWFilterInstantiateFilter(conn, net);
+ if (err) {
+ close(tapfd);
+ tapfd = -1;
+ }
+ }
+ }
+
cleanup:
VIR_FREE(brname);
@@ -3268,6 +3298,7 @@ int qemudBuildCommandLine(virConnectPtr
char domid[50];
char *cpu;
char *smp;
+ int last_good_net = -1;
uname_normalize(&ut);
@@ -3903,6 +3934,7 @@ int qemudBuildCommandLine(virConnectPtr
goto error;
ADD_ARG(host);
}
+ last_good_net = i;
}
}
@@ -4363,6 +4395,11 @@ int qemudBuildCommandLine(virConnectPtr
VIR_FREE((qenv)[i]);
VIR_FREE(qenv);
}
+ for (i = 0; i <= last_good_net; i++) {
+ virDomainNetDefPtr net = def->nets[i];
+ if ((net->filter) && (net->ifname))
+ virNWFilterTeardownFilter(net);
+ }
return -1;
#undef ADD_ARG
Index: libvirt-acl/src/qemu/qemu_conf.h
===================================================================
--- libvirt-acl.orig/src/qemu/qemu_conf.h
+++ libvirt-acl/src/qemu/qemu_conf.h
@@ -128,6 +128,8 @@ struct qemud_driver {
unsigned int macFilter : 1;
ebtablesContext *ebtables;
+ unsigned int nwFilter : 1;
+
unsigned int relaxedACS : 1;
virCapsPtr caps;
Index: libvirt-acl/src/qemu/qemu_driver.c
===================================================================
--- libvirt-acl.orig/src/qemu/qemu_driver.c
+++ libvirt-acl/src/qemu/qemu_driver.c
@@ -83,6 +83,7 @@
#include "xml.h"
#include "cpu/cpu.h"
#include "macvtap.h"
+#include "nwfilter/nwfilter_gentech_driver.h"
#define VIR_FROM_THIS VIR_FROM_QEMU
@@ -2994,6 +2995,15 @@ static void qemudShutdownVMDaemon(struct
* reporting so we don't squash a legit error. */
orig_err = virSaveLastError();
+ if (driver->nwFilter) {
+ def = vm->def;
+ for (i = 0 ; i < def->nnets ; i++) {
+ virDomainNetDefPtr net = def->nets[i];
+ if ((net->filter) && (net->ifname))
+ virNWFilterTeardownFilter(net);
+ }
+ }
+
if (driver->macFilter) {
def = vm->def;
for (i = 0 ; i < def->nnets ; i++) {
@@ -6979,6 +6989,9 @@ qemudDomainDetachNetDevice(struct qemud_
}
}
+ if ((driver->nwFilter) && (detach->ifname) && (detach->filter))
+ virNWFilterTeardownFilter(detach);
+
if (vm->def->nnets > 1) {
memmove(vm->def->nets + i,
vm->def->nets + i + 1,
@@ -9571,8 +9584,24 @@ static virStateDriver qemuStateDriver =
.active = qemudActive,
};
+static int
+qemudVMFilterRebuild(virConnectPtr conn,
+ virHashIterator iter, void *data)
+{
+ (void)conn;
+ virHashForEach(qemu_driver->domains.objs, iter, data);
+ return 0;
+}
+
+
+static virNWFilterCallbackDriver qemuCallbackDriver = {
+ .name = "QEMU",
+ .vmFilterRebuild = qemudVMFilterRebuild,
+};
+
int qemuRegister(void) {
virRegisterDriver(&qemuDriver);
virRegisterStateDriver(&qemuStateDriver);
+ virNWFilterRegisterCallbackDriver(&qemuCallbackDriver);
return 0;
}
--
libvir-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/libvir-list
