On Tue, Mar 23, 2010 at 10:54:16AM -0400, stefanb@xxxxxxxxxx wrote:
> Add support for Qemu to have firewall rules applied and removed on VM
> startup and shutdown respectively. This patch also provides support for
> the updating of a filter that causes all VMs that reference the filter
> to have their ebtables/iptables rules updated.
>
> Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxx>
>
> ---
> src/qemu/qemu_conf.c | 29 +++++++++++++++++++++++++++++
> src/qemu/qemu_driver.c | 27 +++++++++++++++++++++++++++
> 2 files changed, 56 insertions(+)
>
> Index: libvirt-acl/src/qemu/qemu_driver.c
> ===================================================================
> --- libvirt-acl.orig/src/qemu/qemu_driver.c
> +++ libvirt-acl/src/qemu/qemu_driver.c
> @@ -83,6 +83,7 @@
> #include "xml.h"
> #include "cpu/cpu.h"
> #include "macvtap.h"
> +#include "nwfilter/nwfilter_gentech_driver.h"
>
>
> #define VIR_FROM_THIS VIR_FROM_QEMU
> @@ -3041,6 +3042,13 @@ static void qemudShutdownVMDaemon(struct
> * reporting so we don't squash a legit error. */
> orig_err = virSaveLastError();
>
> + def = vm->def;
> + for (i = 0 ; i < def->nnets ; i++) {
> + virDomainNetDefPtr net = def->nets[i];
> + if ((net->filter) && (net->ifname))
> + virNWFilterTeardownFilter(net);
> + }
> +
I think we might also need to run this in qemudStartuVMDaemon() in
the 'cleanup' path taken when virExecDaemonize fails.
> if (driver->macFilter) {
> def = vm->def;
> for (i = 0 ; i < def->nnets ; i++) {
> @@ -7052,6 +7060,9 @@ qemudDomainDetachNetDevice(struct qemud_
> }
> }
>
> + if ((detach->ifname) && (detach->filter))
> + virNWFilterTeardownFilter(detach);
> +
> if (vm->def->nnets > 1) {
> memmove(vm->def->nets + i,
> vm->def->nets + i + 1,
Also might need this in the cleanup path for qemudDomainAttachNetDevice
when it fails to hotplug
Regards,
Daniel
--
|: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :|
|: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list