[PATCH] Add support for network filter code in LXC driver

["Daniel P. Berrange" <berrange@xxxxxxxxxx>]

The LXC driver networking uses veth device pairs. These can
be easily hooked into the network filtering code.

* src/lxc/lxc_driver.c: Add calls to setup/teardown nwfilter
---
 src/lxc/lxc_driver.c |   12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
index 8eb87a2..4d14466 100644
--- a/src/lxc/lxc_driver.c
+++ b/src/lxc/lxc_driver.c
@@ -52,7 +52,7 @@
 #include "hooks.h"
 #include "files.h"
 #include "fdstream.h"
-
+#include "domain_nwfilter.h"
 
 #define VIR_FROM_THIS VIR_FROM_LXC
 
@@ -1027,6 +1027,8 @@ static void lxcVmCleanup(lxc_driver_t *driver,
         vethDelete(vm->def->nets[i]->ifname);
     }
 
+    virDomainConfVMNWFilterTeardown(vm);
+
     if (driver->cgroup &&
         virCgroupForDomain(driver->cgroup, vm->def->name, &cgroup, 0) == 0) {
         virCgroupRemove(cgroup);
@@ -1146,6 +1148,10 @@ static int lxcSetupInterfaces(virConnectPtr conn,
 
         if (vethInterfaceUpOrDown(parentVeth, 1) < 0)
             goto error_exit;
+
+        if (def->nets[i]->filter &&
+            virDomainConfNWFilterInstantiate(conn, def->nets[i]) < 0)
+            goto error_exit;
     }
 
     rc = 0;
@@ -1538,8 +1544,10 @@ cleanup:
             vethDelete(veths[i]);
         VIR_FREE(veths[i]);
     }
-    if (rc != 0)
+    if (rc != 0) {
         VIR_FORCE_CLOSE(priv->monitor);
+        virDomainConfVMNWFilterTeardown(vm);
+    }
     VIR_FORCE_CLOSE(parentTty);
     VIR_FREE(logfile);
     return rc;
-- 
1.7.4.4

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list