[PATCH 19/26] Convert nwfilter ebiptablesTearNewRules to virFirewall

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Convert the nwfilter ebiptablesTearNewRules method to use the
virFirewall object APIs instead of creating shell scripts
using virBuffer APIs. This provides a performance improvement
through allowing direct use of firewalld dbus APIs and will
facilitate automated testing.
---
 src/nwfilter/nwfilter_ebiptables_driver.c | 88 ++++++++++++++++++++++---------
 tests/nwfilterebiptablestest.c            | 65 +++++++++++++++++++++++
 2 files changed, 128 insertions(+), 25 deletions(-)

diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c
index 7740960..4093bd9 100644
--- a/src/nwfilter/nwfilter_ebiptables_driver.c
+++ b/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -707,6 +707,18 @@ iptablesRemoveTmpRootChain(virBufferPtr buf,
 
 
 static void
+iptablesRemoveTmpRootChainFW(virFirewallPtr fw,
+                             virFirewallLayer layer,
+                             char prefix,
+                             bool incoming,
+                             const char *ifname)
+{
+    _iptablesRemoveRootChainFW(fw, layer, prefix,
+                               incoming, ifname, 1);
+}
+
+
+static void
 iptablesRemoveTmpRootChains(virBufferPtr buf,
                             const char *ifname)
 {
@@ -717,6 +729,17 @@ iptablesRemoveTmpRootChains(virBufferPtr buf,
 
 
 static void
+iptablesRemoveTmpRootChainsFW(virFirewallPtr fw,
+                              virFirewallLayer layer,
+                              const char *ifname)
+{
+    iptablesRemoveTmpRootChainFW(fw, layer, 'F', false, ifname);
+    iptablesRemoveTmpRootChainFW(fw, layer, 'F', true, ifname);
+    iptablesRemoveTmpRootChainFW(fw, layer, 'H', true, ifname);
+}
+
+
+static void
 iptablesRemoveRootChainsFW(virFirewallPtr fw,
                            virFirewallLayer layer,
                            const char *ifname)
@@ -914,6 +937,18 @@ iptablesUnlinkTmpRootChain(virBufferPtr buf,
 
 
 static void
+iptablesUnlinkTmpRootChainFW(virFirewallPtr fw,
+                             virFirewallLayer layer,
+                             const char *basechain,
+                             char prefix,
+                             bool incoming, const char *ifname)
+{
+    _iptablesUnlinkRootChainFW(fw, layer,
+                               basechain, prefix, incoming, ifname, 1);
+}
+
+
+static void
 iptablesUnlinkRootChainsFW(virFirewallPtr fw,
                            virFirewallLayer layer,
                            const char *ifname)
@@ -935,6 +970,17 @@ iptablesUnlinkTmpRootChains(virBufferPtr buf,
 
 
 static void
+iptablesUnlinkTmpRootChainsFW(virFirewallPtr fw,
+                              virFirewallLayer layer,
+                              const char *ifname)
+{
+    iptablesUnlinkTmpRootChainFW(fw, layer, VIRT_OUT_CHAIN, 'F', false, ifname);
+    iptablesUnlinkTmpRootChainFW(fw, layer, VIRT_IN_CHAIN,  'F', true, ifname);
+    iptablesUnlinkTmpRootChainFW(fw, layer, HOST_IN_CHAIN,  'H', true, ifname);
+}
+
+
+static void
 iptablesRenameTmpRootChainFW(virFirewallPtr fw,
                              virFirewallLayer layer,
                              char prefix,
@@ -4236,36 +4282,28 @@ ebiptablesApplyNewRules(const char *ifname,
 static int
 ebiptablesTearNewRules(const char *ifname)
 {
-    virBuffer buf = VIR_BUFFER_INITIALIZER;
-
-    if (iptables_cmd_path) {
-        NWFILTER_SET_IPTABLES_SHELLVAR(&buf);
-
-        iptablesUnlinkTmpRootChains(&buf, ifname);
-        iptablesRemoveTmpRootChains(&buf, ifname);
-    }
-
-    if (ip6tables_cmd_path) {
-        NWFILTER_SET_IP6TABLES_SHELLVAR(&buf);
+    virFirewallPtr fw = virFirewallNew();
+    int ret = -1;
 
-        iptablesUnlinkTmpRootChains(&buf, ifname);
-        iptablesRemoveTmpRootChains(&buf, ifname);
-    }
+    virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
 
-    if (ebtables_cmd_path) {
-        NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+    iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
+    iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
 
-        ebtablesUnlinkTmpRootChain(&buf, true, ifname);
-        ebtablesUnlinkTmpRootChain(&buf, false, ifname);
+    iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV6, ifname);
+    iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV6, ifname);
 
-        ebtablesRemoveTmpSubChains(&buf, ifname);
-        ebtablesRemoveTmpRootChain(&buf, true, ifname);
-        ebtablesRemoveTmpRootChain(&buf, false, ifname);
-    }
-
-    ebiptablesExecCLI(&buf, true, NULL);
+    ebtablesUnlinkTmpRootChainFW(fw, true, ifname);
+    ebtablesUnlinkTmpRootChainFW(fw, false, ifname);
+    ebtablesRemoveTmpSubChainsFW(fw, ifname);
+    ebtablesRemoveTmpRootChainFW(fw, true, ifname);
+    ebtablesRemoveTmpRootChainFW(fw, false, ifname);
 
-    return 0;
+    virMutexLock(&execCLIMutex);
+    ret = virFirewallApply(fw);
+    virMutexUnlock(&execCLIMutex);
+    virFirewallFree(fw);
+    return ret;
 }
 
 
diff --git a/tests/nwfilterebiptablestest.c b/tests/nwfilterebiptablestest.c
index 11b7fb5..d728e4c 100644
--- a/tests/nwfilterebiptablestest.c
+++ b/tests/nwfilterebiptablestest.c
@@ -211,6 +211,66 @@ testNWFilterEBIPTablesRemoveBasicRules(const void *opaque ATTRIBUTE_UNUSED)
 
 
 static int
+testNWFilterEBIPTablesTearNewRules(const void *opaque ATTRIBUTE_UNUSED)
+{
+    virBuffer buf = VIR_BUFFER_INITIALIZER;
+    const char *expected =
+        "/usr/sbin/iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
+        "/usr/sbin/iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
+        "/usr/sbin/iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
+        "/usr/sbin/iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
+        "/usr/sbin/iptables -F FP-vnet0\n"
+        "/usr/sbin/iptables -X FP-vnet0\n"
+        "/usr/sbin/iptables -F FJ-vnet0\n"
+        "/usr/sbin/iptables -X FJ-vnet0\n"
+        "/usr/sbin/iptables -F HJ-vnet0\n"
+        "/usr/sbin/iptables -X HJ-vnet0\n"
+        "/usr/sbin/ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
+        "/usr/sbin/ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
+        "/usr/sbin/ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
+        "/usr/sbin/ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
+        "/usr/sbin/ip6tables -F FP-vnet0\n"
+        "/usr/sbin/ip6tables -X FP-vnet0\n"
+        "/usr/sbin/ip6tables -F FJ-vnet0\n"
+        "/usr/sbin/ip6tables -X FJ-vnet0\n"
+        "/usr/sbin/ip6tables -F HJ-vnet0\n"
+        "/usr/sbin/ip6tables -X HJ-vnet0\n"
+        "/usr/sbin/ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
+        "/usr/sbin/ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
+        "/usr/sbin/ebtables -t nat -L libvirt-J-vnet0\n"
+        "/usr/sbin/ebtables -t nat -L libvirt-P-vnet0\n"
+        "/usr/sbin/ebtables -t nat -F libvirt-J-vnet0\n"
+        "/usr/sbin/ebtables -t nat -X libvirt-J-vnet0\n"
+        "/usr/sbin/ebtables -t nat -F libvirt-P-vnet0\n"
+        "/usr/sbin/ebtables -t nat -X libvirt-P-vnet0\n";
+
+    const char *actual = NULL;
+    int ret = -1;
+
+    virCommandSetDryRun(&buf, NULL, NULL);
+
+    if (ebiptables_driver.tearNewRules("vnet0") < 0)
+        goto cleanup;
+
+    if (virBufferError(&buf))
+        goto cleanup;
+
+    actual = virBufferCurrentContent(&buf);
+
+    if (STRNEQ_NULLABLE(actual, expected)) {
+        virtTestDifference(stderr, actual, expected);
+        goto cleanup;
+    }
+
+    ret = 0;
+ cleanup:
+    virCommandSetDryRun(NULL, NULL, NULL);
+    virBufferFreeAndReset(&buf);
+    return ret;
+}
+
+
+static int
 mymain(void)
 {
     int ret = 0;
@@ -235,6 +295,11 @@ mymain(void)
                     NULL) < 0)
         ret = -1;
 
+    if (virtTestRun("ebiptablesTearNewRules",
+                    testNWFilterEBIPTablesTearNewRules,
+                    NULL) < 0)
+        ret = -1;
+
  cleanup:
     return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
 }
-- 
1.9.0

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]