Add support for Qemu to have firewall rules applied and removed on VM startup and shutdown respectively. This patch also provides support for the updating of a filter that causes all VMs that reference the filter to have their ebtables/iptables rules updated. Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxx>
--- src/qemu/qemu_conf.c | 29 +++++++++++++++++++++++++++++ src/qemu/qemu_driver.c | 27 +++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) Index: libvirt-acl/src/qemu/qemu_conf.c =================================================================== --- libvirt-acl.orig/src/qemu/qemu_conf.c +++ libvirt-acl/src/qemu/qemu_conf.c @@ -54,6 +54,7 @@ #include "network.h" #include "macvtap.h" #include "cpu/cpu.h" +#include "nwfilter/nwfilter_gentech_driver.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -1468,6 +1469,17 @@ qemudPhysIfaceConnect(virConnectPtr conn net->ifname); } } + + if (rc >= 0) { + if ((net->filter) && (net->ifname)) { + err = virNWFilterInstantiateFilter(conn, net); + if (err) { + close(rc); + rc = -1; + delMacvtap(net->ifname); + } + } + } #else (void)conn; (void)net; @@ -1590,6 +1602,16 @@ qemudNetworkIfaceConnect(virConnectPtr c } } + if (tapfd >= 0) { + if ((net->filter) && (net->ifname)) { + err = virNWFilterInstantiateFilter(conn, net); + if (err) { + close(tapfd); + tapfd = -1; + } + } + } + cleanup: VIR_FREE(brname); @@ -3271,6 +3293,7 @@ int qemudBuildCommandLine(virConnectPtr char domid[50]; char *cpu; char *smp; + int last_good_net = -1; uname_normalize(&ut); @@ -3906,6 +3929,7 @@ int qemudBuildCommandLine(virConnectPtr goto error; ADD_ARG(host); } + last_good_net = i; } } @@ -4366,6 +4390,11 @@ int qemudBuildCommandLine(virConnectPtr VIR_FREE((qenv)[i]); VIR_FREE(qenv); } + for (i = 0; i <= last_good_net; i++) { + virDomainNetDefPtr net = def->nets[i]; + if ((net->filter) && (net->ifname)) + virNWFilterTeardownFilter(net); + } return -1; #undef ADD_ARG Index: libvirt-acl/src/qemu/qemu_driver.c =================================================================== --- libvirt-acl.orig/src/qemu/qemu_driver.c +++ libvirt-acl/src/qemu/qemu_driver.c @@ -83,6 +83,7 @@ #include "xml.h" #include "cpu/cpu.h" #include "macvtap.h" +#include "nwfilter/nwfilter_gentech_driver.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -3029,6 +3030,13 @@ static void qemudShutdownVMDaemon(struct * reporting so we don't squash a legit error. */ orig_err = virSaveLastError(); + def = vm->def; + for (i = 0 ; i < def->nnets ; i++) { + virDomainNetDefPtr net = def->nets[i]; + if ((net->filter) && (net->ifname)) + virNWFilterTeardownFilter(net); + } + if (driver->macFilter) { def = vm->def; for (i = 0 ; i < def->nnets ; i++) { @@ -7028,6 +7036,9 @@ qemudDomainDetachNetDevice(struct qemud_ } } + if ((detach->ifname) && (detach->filter)) + virNWFilterTeardownFilter(detach); + if (vm->def->nnets > 1) { memmove(vm->def->nets + i, vm->def->nets + i + 1, @@ -9608,8 +9619,24 @@ static virStateDriver qemuStateDriver = .active = qemudActive, }; +static int +qemudVMFilterRebuild(virConnectPtr conn, + virHashIterator iter, void *data) +{ + (void)conn; + virHashForEach(qemu_driver->domains.objs, iter, data); + return 0; +} + + +static virNWFilterCallbackDriver qemuCallbackDriver = { + .name = "QEMU", + .vmFilterRebuild = qemudVMFilterRebuild, +}; + int qemuRegister(void) { virRegisterDriver(&qemuDriver); virRegisterStateDriver(&qemuStateDriver); + virNWFilterRegisterCallbackDriver(&qemuCallbackDriver); return 0; }
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list