[PATCH V1 2/6] Introduce an internal priority for chains

[Stefan Berger <stefanb@xxxxxxxxxxxxxxxxxx>]

For better handling of the sorting of chains introduce an internally used
priority. Use a lookup table to store the priorities. For now their actual
values do not matter just that the values cause the chains to be properly
sorted through changes in the following patches.

---
 src/conf/nwfilter_conf.c                  |   19 +++++++++++++++++++
 src/conf/nwfilter_conf.h                  |    3 +++
 src/nwfilter/nwfilter_ebiptables_driver.c |    4 ++++
 src/nwfilter/nwfilter_ebiptables_driver.h |    1 +
 4 files changed, 27 insertions(+)

Index: libvirt-acl/src/conf/nwfilter_conf.h
===================================================================
--- libvirt-acl.orig/src/conf/nwfilter_conf.h
+++ libvirt-acl/src/conf/nwfilter_conf.h
@@ -355,6 +355,7 @@ enum virNWFilterEbtablesTableType {
 };
 
 
+# define MIN_RULE_PRIORITY  0
 # define MAX_RULE_PRIORITY  1000
 
 enum virNWFilterRuleFlags {
@@ -434,6 +435,7 @@ enum virNWFilterChainSuffixType {
     VIR_NWFILTER_CHAINSUFFIX_LAST,
 };
 
+typedef int32_t virNWFilterChainPriority;
 
 typedef struct _virNWFilterDef virNWFilterDef;
 typedef virNWFilterDef *virNWFilterDefPtr;
@@ -443,6 +445,7 @@ struct _virNWFilterDef {
     unsigned char uuid[VIR_UUID_BUFLEN];
 
     int chainsuffix; /*enum virNWFilterChainSuffixType */
+    virNWFilterChainPriority chainPriority;
 
     int nentries;
     virNWFilterEntryPtr *filterEntries;
Index: libvirt-acl/src/conf/nwfilter_conf.c
===================================================================
--- libvirt-acl.orig/src/conf/nwfilter_conf.c
+++ libvirt-acl/src/conf/nwfilter_conf.c
@@ -120,6 +120,20 @@ struct int_map {
 #define INTMAP_ENTRY(ATT, VAL) { .attr = ATT, .val = VAL }
 #define INTMAP_ENTRY_LAST      { .val = NULL }
 
+#define NWFILTER_ROOT_FILTER_PRI   0
+#define NWFILTER_IPV4_FILTER_PRI 200
+#define NWFILTER_IPV6_FILTER_PRI 400
+#define NWFILTER_ARP_FILTER_PRI  600
+#define NWFILTER_RARP_FILTER_PRI 800
+
+static const struct int_map chain_priorities[] = {
+    INTMAP_ENTRY(NWFILTER_ROOT_FILTER_PRI, "root"),
+    INTMAP_ENTRY(NWFILTER_IPV4_FILTER_PRI, "ipv4"),
+    INTMAP_ENTRY(NWFILTER_IPV6_FILTER_PRI, "ipv6"),
+    INTMAP_ENTRY(NWFILTER_ARP_FILTER_PRI , "arp" ),
+    INTMAP_ENTRY(NWFILTER_RARP_FILTER_PRI, "rarp"),
+    INTMAP_ENTRY_LAST,
+};
 
 /*
  * only one filter update allowed
@@ -2026,6 +2040,11 @@ virNWFilterDefParseXML(xmlXPathContextPt
                                    _("unknown chain suffix '%s'"), chain);
             goto cleanup;
         }
+        /* assign an implicit priority -- support XML attribute later */
+        if (intMapGetByString(chain_priorities, chain, 0,
+                              &ret->chainPriority) == false) {
+            ret->chainPriority = (MAX_RULE_PRIORITY + MIN_RULE_PRIORITY) / 2;
+        }
     }
 
     uuid = virXPathString("string(./uuid)", ctxt);
Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h
===================================================================
--- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.h
+++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h
@@ -36,6 +36,7 @@ typedef ebiptablesRuleInst *ebiptablesRu
 struct _ebiptablesRuleInst {
     char *commandTemplate;
     enum virNWFilterChainSuffixType neededProtocolChain;
+    virNWFilterChainPriority chainPriority;
     char chainprefix;    /* I for incoming, O for outgoing */
     unsigned int priority;
     enum RuleType ruleType;
Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c
===================================================================
--- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c
+++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -327,6 +327,7 @@ static int
 ebiptablesAddRuleInst(virNWFilterRuleInstPtr res,
                       char *commandTemplate,
                       enum virNWFilterChainSuffixType neededChain,
+                      virNWFilterChainPriority chainPriority,
                       char chainprefix,
                       unsigned int priority,
                       enum RuleType ruleType)
@@ -340,6 +341,7 @@ ebiptablesAddRuleInst(virNWFilterRuleIns
 
     inst->commandTemplate = commandTemplate;
     inst->neededProtocolChain = neededChain;
+    inst->chainPriority = chainPriority;
     inst->chainprefix = chainprefix;
     inst->priority = priority;
     inst->ruleType = ruleType;
@@ -1588,6 +1590,7 @@ _iptablesCreateRuleInstance(int directio
     return ebiptablesAddRuleInst(res,
                                  virBufferContentAndReset(final),
                                  nwfilter->chainsuffix,
+                                 nwfilter->chainPriority,
                                  '\0',
                                  rule->priority,
                                  (isIPv6) ? RT_IP6TABLES : RT_IPTABLES);
@@ -2337,6 +2340,7 @@ ebtablesCreateRuleInstance(char chainPre
     return ebiptablesAddRuleInst(res,
                                  virBufferContentAndReset(&buf),
                                  nwfilter->chainsuffix,
+                                 nwfilter->chainPriority,
                                  chainPrefix,
                                  rule->priority,
                                  RT_EBTABLES);

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list