Convert the nwfilter ebiptablesTearNewRules method to use the
virFirewall object APIs instead of creating shell scripts
using virBuffer APIs. This provides a performance improvement
through allowing direct use of firewalld dbus APIs and will
facilitate automated testing.
---
src/nwfilter/nwfilter_ebiptables_driver.c | 88 ++++++++++++++++++++++---------
tests/nwfilterebiptablestest.c | 65 +++++++++++++++++++++++
2 files changed, 128 insertions(+), 25 deletions(-)
diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c
index 7740960..4093bd9 100644
--- a/src/nwfilter/nwfilter_ebiptables_driver.c
+++ b/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -707,6 +707,18 @@ iptablesRemoveTmpRootChain(virBufferPtr buf,
static void
+iptablesRemoveTmpRootChainFW(virFirewallPtr fw,
+ virFirewallLayer layer,
+ char prefix,
+ bool incoming,
+ const char *ifname)
+{
+ _iptablesRemoveRootChainFW(fw, layer, prefix,
+ incoming, ifname, 1);
+}
+
+
+static void
iptablesRemoveTmpRootChains(virBufferPtr buf,
const char *ifname)
{
@@ -717,6 +729,17 @@ iptablesRemoveTmpRootChains(virBufferPtr buf,
static void
+iptablesRemoveTmpRootChainsFW(virFirewallPtr fw,
+ virFirewallLayer layer,
+ const char *ifname)
+{
+ iptablesRemoveTmpRootChainFW(fw, layer, 'F', false, ifname);
+ iptablesRemoveTmpRootChainFW(fw, layer, 'F', true, ifname);
+ iptablesRemoveTmpRootChainFW(fw, layer, 'H', true, ifname);
+}
+
+
+static void
iptablesRemoveRootChainsFW(virFirewallPtr fw,
virFirewallLayer layer,
const char *ifname)
@@ -914,6 +937,18 @@ iptablesUnlinkTmpRootChain(virBufferPtr buf,
static void
+iptablesUnlinkTmpRootChainFW(virFirewallPtr fw,
+ virFirewallLayer layer,
+ const char *basechain,
+ char prefix,
+ bool incoming, const char *ifname)
+{
+ _iptablesUnlinkRootChainFW(fw, layer,
+ basechain, prefix, incoming, ifname, 1);
+}
+
+
+static void
iptablesUnlinkRootChainsFW(virFirewallPtr fw,
virFirewallLayer layer,
const char *ifname)
@@ -935,6 +970,17 @@ iptablesUnlinkTmpRootChains(virBufferPtr buf,
static void
+iptablesUnlinkTmpRootChainsFW(virFirewallPtr fw,
+ virFirewallLayer layer,
+ const char *ifname)
+{
+ iptablesUnlinkTmpRootChainFW(fw, layer, VIRT_OUT_CHAIN, 'F', false, ifname);
+ iptablesUnlinkTmpRootChainFW(fw, layer, VIRT_IN_CHAIN, 'F', true, ifname);
+ iptablesUnlinkTmpRootChainFW(fw, layer, HOST_IN_CHAIN, 'H', true, ifname);
+}
+
+
+static void
iptablesRenameTmpRootChainFW(virFirewallPtr fw,
virFirewallLayer layer,
char prefix,
@@ -4236,36 +4282,28 @@ ebiptablesApplyNewRules(const char *ifname,
static int
ebiptablesTearNewRules(const char *ifname)
{
- virBuffer buf = VIR_BUFFER_INITIALIZER;
-
- if (iptables_cmd_path) {
- NWFILTER_SET_IPTABLES_SHELLVAR(&buf);
-
- iptablesUnlinkTmpRootChains(&buf, ifname);
- iptablesRemoveTmpRootChains(&buf, ifname);
- }
-
- if (ip6tables_cmd_path) {
- NWFILTER_SET_IP6TABLES_SHELLVAR(&buf);
+ virFirewallPtr fw = virFirewallNew();
+ int ret = -1;
- iptablesUnlinkTmpRootChains(&buf, ifname);
- iptablesRemoveTmpRootChains(&buf, ifname);
- }
+ virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
- if (ebtables_cmd_path) {
- NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+ iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
+ iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
- ebtablesUnlinkTmpRootChain(&buf, true, ifname);
- ebtablesUnlinkTmpRootChain(&buf, false, ifname);
+ iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV6, ifname);
+ iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV6, ifname);
- ebtablesRemoveTmpSubChains(&buf, ifname);
- ebtablesRemoveTmpRootChain(&buf, true, ifname);
- ebtablesRemoveTmpRootChain(&buf, false, ifname);
- }
-
- ebiptablesExecCLI(&buf, true, NULL);
+ ebtablesUnlinkTmpRootChainFW(fw, true, ifname);
+ ebtablesUnlinkTmpRootChainFW(fw, false, ifname);
+ ebtablesRemoveTmpSubChainsFW(fw, ifname);
+ ebtablesRemoveTmpRootChainFW(fw, true, ifname);
+ ebtablesRemoveTmpRootChainFW(fw, false, ifname);
- return 0;
+ virMutexLock(&execCLIMutex);
+ ret = virFirewallApply(fw);
+ virMutexUnlock(&execCLIMutex);
+ virFirewallFree(fw);
+ return ret;
}
diff --git a/tests/nwfilterebiptablestest.c b/tests/nwfilterebiptablestest.c
index 11b7fb5..d728e4c 100644
--- a/tests/nwfilterebiptablestest.c
+++ b/tests/nwfilterebiptablestest.c
@@ -211,6 +211,66 @@ testNWFilterEBIPTablesRemoveBasicRules(const void *opaque ATTRIBUTE_UNUSED)
static int
+testNWFilterEBIPTablesTearNewRules(const void *opaque ATTRIBUTE_UNUSED)
+{
+ virBuffer buf = VIR_BUFFER_INITIALIZER;
+ const char *expected =
+ "/usr/sbin/iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
+ "/usr/sbin/iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
+ "/usr/sbin/iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
+ "/usr/sbin/iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
+ "/usr/sbin/iptables -F FP-vnet0\n"
+ "/usr/sbin/iptables -X FP-vnet0\n"
+ "/usr/sbin/iptables -F FJ-vnet0\n"
+ "/usr/sbin/iptables -X FJ-vnet0\n"
+ "/usr/sbin/iptables -F HJ-vnet0\n"
+ "/usr/sbin/iptables -X HJ-vnet0\n"
+ "/usr/sbin/ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
+ "/usr/sbin/ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
+ "/usr/sbin/ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
+ "/usr/sbin/ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
+ "/usr/sbin/ip6tables -F FP-vnet0\n"
+ "/usr/sbin/ip6tables -X FP-vnet0\n"
+ "/usr/sbin/ip6tables -F FJ-vnet0\n"
+ "/usr/sbin/ip6tables -X FJ-vnet0\n"
+ "/usr/sbin/ip6tables -F HJ-vnet0\n"
+ "/usr/sbin/ip6tables -X HJ-vnet0\n"
+ "/usr/sbin/ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
+ "/usr/sbin/ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
+ "/usr/sbin/ebtables -t nat -L libvirt-J-vnet0\n"
+ "/usr/sbin/ebtables -t nat -L libvirt-P-vnet0\n"
+ "/usr/sbin/ebtables -t nat -F libvirt-J-vnet0\n"
+ "/usr/sbin/ebtables -t nat -X libvirt-J-vnet0\n"
+ "/usr/sbin/ebtables -t nat -F libvirt-P-vnet0\n"
+ "/usr/sbin/ebtables -t nat -X libvirt-P-vnet0\n";
+
+ const char *actual = NULL;
+ int ret = -1;
+
+ virCommandSetDryRun(&buf, NULL, NULL);
+
+ if (ebiptables_driver.tearNewRules("vnet0") < 0)
+ goto cleanup;
+
+ if (virBufferError(&buf))
+ goto cleanup;
+
+ actual = virBufferCurrentContent(&buf);
+
+ if (STRNEQ_NULLABLE(actual, expected)) {
+ virtTestDifference(stderr, actual, expected);
+ goto cleanup;
+ }
+
+ ret = 0;
+ cleanup:
+ virCommandSetDryRun(NULL, NULL, NULL);
+ virBufferFreeAndReset(&buf);
+ return ret;
+}
+
+
+static int
mymain(void)
{
int ret = 0;
@@ -235,6 +295,11 @@ mymain(void)
NULL) < 0)
ret = -1;
+ if (virtTestRun("ebiptablesTearNewRules",
+ testNWFilterEBIPTablesTearNewRules,
+ NULL) < 0)
+ ret = -1;
+
cleanup:
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
}
--
1.9.0
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list