"Daniel P. Berrange" <berrange@xxxxxxxxxx> wrote on 03/25/2010 07:09:24 AM:
>
> Please respond to "Daniel P. Berrange"
>
> On Tue, Mar 23, 2010 at 10:54:16AM -0400, stefanb@xxxxxxxxxx wrote:
> > Add support for Qemu to have firewall rules applied and removed on VM
> > startup and shutdown respectively. This patch also provides support for
> > the updating of a filter that causes all VMs that reference the filter
> > to have their ebtables/iptables rules updated.
> >
> > Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxx>
> >
> > ---
> > src/qemu/qemu_conf.c | 29 +++++++++++++++++++++++++++++
> > src/qemu/qemu_driver.c | 27 +++++++++++++++++++++++++++
> > 2 files changed, 56 insertions(+)
> >
> > Index: libvirt-acl/src/qemu/qemu_driver.c
> > ===================================================================
> > --- libvirt-acl.orig/src/qemu/qemu_driver.c
> > +++ libvirt-acl/src/qemu/qemu_driver.c
> > @@ -83,6 +83,7 @@
> > #include "xml.h"
> > #include "cpu/cpu.h"
> > #include "macvtap.h"
> > +#include "nwfilter/nwfilter_gentech_driver.h"
> >
> >
> > #define VIR_FROM_THIS VIR_FROM_QEMU
> > @@ -3041,6 +3042,13 @@ static void qemudShutdownVMDaemon(struct
> > * reporting so we don't squash a legit error. */
> > orig_err = virSaveLastError();
> >
> > + def = vm->def;
> > + for (i = 0 ; i < def->nnets ; i++) {
> > + virDomainNetDefPtr net = def->nets[i];
> > + if ((net->filter) && (net->ifname))
> > + virNWFilterTeardownFilter(net);
> > + }
> > +
>
> I think we might also need to run this in qemudStartuVMDaemon() in
> the 'cleanup' path taken when virExecDaemonize fails.
Fixed. This and the above now calls a function qemuTearVMNWFilters() which in turn calls qemuTearNWFilter();
>
> > if (driver->macFilter) {
> > def = vm->def;
> > for (i = 0 ; i < def->nnets ; i++) {
> > @@ -7052,6 +7060,9 @@ qemudDomainDetachNetDevice(struct qemud_
> > }
> > }
> >
> > + if ((detach->ifname) && (detach->filter))
> > + virNWFilterTeardownFilter(detach);
> > +
> > if (vm->def->nnets > 1) {
> > memmove(vm->def->nets + i,
> > vm->def->nets + i + 1,
>
> Also might need this in the cleanup path for qemudDomainAttachNetDevice
> when it fails to hotplug
Fixed. This and the above now calls qemuTearNWFilter().
Due to these and other changes I would like to post a 'v4' patch series with an additional patch installing a couple of example filters.
Thanks and regards,
Stefan
>
> Regards,
> Daniel
> --
> |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/:|
> |: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org:|
> |: http://autobuild.org -o- http://search.cpan.org/~danberr/:|
> |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list