[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

[libvirt] [PATCH 07/28] Rename ebtables.{c, h} to virebtables.{c, h}



From: "Daniel P. Berrange" <berrange redhat com>

---
 src/Makefile.am               |   2 +-
 src/qemu/qemu_bridge_filter.c |   2 +-
 src/qemu/qemu_conf.h          |   2 +-
 src/util/ebtables.c           | 486 ------------------------------------------
 src/util/ebtables.h           |  67 ------
 src/util/virebtables.c        | 486 ++++++++++++++++++++++++++++++++++++++++++
 src/util/virebtables.h        |  67 ++++++
 7 files changed, 556 insertions(+), 556 deletions(-)
 delete mode 100644 src/util/ebtables.c
 delete mode 100644 src/util/ebtables.h
 create mode 100644 src/util/virebtables.c
 create mode 100644 src/util/virebtables.h

diff --git a/src/Makefile.am b/src/Makefile.am
index ce16e87..daefa95 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -57,7 +57,6 @@ UTIL_SOURCES =							\
 		util/event_poll.c util/event_poll.h		\
 		util/hooks.c util/hooks.h			\
 		util/iptables.c util/iptables.h			\
-		util/ebtables.c util/ebtables.h			\
 		util/json.c util/json.h				\
 		util/logging.c util/logging.h			\
 		util/memory.c util/memory.h			\
@@ -83,6 +82,7 @@ UTIL_SOURCES =							\
 		util/vircommand.c util/vircommand.h		\
 		util/virconf.c util/virconf.h			\
 		util/virdnsmasq.c util/virdnsmasq.h             \
+		util/virebtables.c util/virebtables.h		\
 		util/virfile.c util/virfile.h			\
 		util/virnodesuspend.c util/virnodesuspend.h	\
 		util/virobject.c util/virobject.h		\
diff --git a/src/qemu/qemu_bridge_filter.c b/src/qemu/qemu_bridge_filter.c
index a34a92e..a6d0d4f 100644
--- a/src/qemu/qemu_bridge_filter.c
+++ b/src/qemu/qemu_bridge_filter.c
@@ -22,7 +22,7 @@
 
 #include <config.h>
 
-#include "ebtables.h"
+#include "virebtables.h"
 #include "qemu_conf.h"
 #include "qemu_driver.h"
 #include "util.h"
diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h
index eafaf9f..5499203 100644
--- a/src/qemu/qemu_conf.h
+++ b/src/qemu/qemu_conf.h
@@ -26,7 +26,7 @@
 
 # include <config.h>
 
-# include "ebtables.h"
+# include "virebtables.h"
 # include "internal.h"
 # include "capabilities.h"
 # include "network_conf.h"
diff --git a/src/util/ebtables.c b/src/util/ebtables.c
deleted file mode 100644
index 4b427ee..0000000
--- a/src/util/ebtables.c
+++ /dev/null
@@ -1,486 +0,0 @@
-/*
- * Copyright (C) 2007-2012 Red Hat, Inc.
- * Copyright (C) 2009 IBM Corp.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library.  If not, see
- * <http://www.gnu.org/licenses/>.
- *
- * based on iptables.c
- * Authors:
- *     Gerhard Stenzel <gerhard stenzel de ibm com>
- */
-
-#include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <errno.h>
-#include <limits.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/wait.h>
-
-#ifdef HAVE_PATHS_H
-# include <paths.h>
-#endif
-
-#include "internal.h"
-#include "ebtables.h"
-#include "vircommand.h"
-#include "memory.h"
-#include "virterror_internal.h"
-#include "logging.h"
-#include "threads.h"
-
-#if HAVE_FIREWALLD
-static char *firewall_cmd_path = NULL;
-
-static int
-virEbTablesOnceInit(void)
-{
-    firewall_cmd_path = virFindFileInPath("firewall-cmd");
-    if (!firewall_cmd_path) {
-        VIR_INFO("firewall-cmd not found on system. "
-                 "firewalld support disabled for ebtables.");
-    } else {
-        virCommandPtr cmd = virCommandNew(firewall_cmd_path);
-        int status;
-
-        virCommandAddArgList(cmd, "--state", NULL);
-        if (virCommandRun(cmd, &status) < 0 || status != 0) {
-            VIR_INFO("firewall-cmd found but disabled for ebtables");
-            VIR_FREE(firewall_cmd_path);
-            firewall_cmd_path = NULL;
-        } else {
-            VIR_INFO("using firewalld for ebtables commands");
-        }
-        virCommandFree(cmd);
-    }
-    return 0;
-}
-
-VIR_ONCE_GLOBAL_INIT(virEbTables)
-
-#endif
-
-struct _ebtablesContext
-{
-    ebtRules *input_filter;
-    ebtRules *forward_filter;
-    ebtRules *nat_postrouting;
-};
-
-enum {
-    ADD = 0,
-    REMOVE,
-    CREATE,
-    POLICY,
-    INSERT
-};
-
-static void
-ebtRuleFree(ebtRule *rule)
-{
-    VIR_FREE(rule->rule);
-
-    if (rule->argv) {
-        int i = 0;
-        while (rule->argv[i])
-            VIR_FREE(rule->argv[i++]);
-        VIR_FREE(rule->argv);
-    }
-}
-
-static int
-ebtRulesAppend(ebtRules *rules,
-               char *rule,
-               const char **argv,
-               int command_idx)
-{
-    if (VIR_REALLOC_N(rules->rules, rules->nrules+1) < 0) {
-        int i = 0;
-        while (argv[i])
-            VIR_FREE(argv[i++]);
-        VIR_FREE(argv);
-        return ENOMEM;
-    }
-
-    rules->rules[rules->nrules].rule        = rule;
-    rules->rules[rules->nrules].argv        = argv;
-    rules->rules[rules->nrules].command_idx = command_idx;
-
-    rules->nrules++;
-
-    return 0;
-}
-
-static int
-ebtRulesRemove(ebtRules *rules,
-               char *rule)
-{
-    int i;
-
-    for (i = 0; i < rules->nrules; i++)
-        if (STREQ(rules->rules[i].rule, rule))
-            break;
-
-    if (i >= rules->nrules)
-        return EINVAL;
-
-    ebtRuleFree(&rules->rules[i]);
-
-    memmove(&rules->rules[i],
-            &rules->rules[i+1],
-            (rules->nrules - i - 1) * sizeof(ebtRule));
-
-    rules->nrules--;
-
-    return 0;
-}
-
-static void
-ebtRulesFree(ebtRules *rules)
-{
-    int i;
-
-    VIR_FREE(rules->table);
-    VIR_FREE(rules->chain);
-
-    if (rules->rules) {
-        for (i = 0; i < rules->nrules; i++)
-            ebtRuleFree(&rules->rules[i]);
-
-        VIR_FREE(rules->rules);
-
-        rules->nrules = 0;
-    }
-
-    VIR_FREE(rules);
-}
-
-static ebtRules *
-ebtRulesNew(const char *table,
-            const char *chain)
-{
-    ebtRules *rules;
-
-    if (VIR_ALLOC(rules) < 0)
-        return NULL;
-
-    if (!(rules->table = strdup(table)))
-        goto error;
-
-    if (!(rules->chain = strdup(chain)))
-        goto error;
-
-    rules->rules = NULL;
-    rules->nrules = 0;
-
-    return rules;
-
- error:
-    ebtRulesFree(rules);
-    return NULL;
-}
-
-static int ATTRIBUTE_SENTINEL
-ebtablesAddRemoveRule(ebtRules *rules, int action, const char *arg, ...)
-{
-    va_list args;
-    int retval = ENOMEM;
-    const char **argv;
-    char *rule = NULL;
-    const char *s;
-    int n, command_idx;
-
-    n = 1 + /* /sbin/ebtables  */
-        2 + /*   --table foo   */
-        2 + /*   --insert bar  */
-        1;  /*   arg           */
-
-#if HAVE_FIREWALLD
-    virEbTablesInitialize();
-    if (firewall_cmd_path)
-        n += 3; /* --direct --passthrough eb */
-#endif
-
-    va_start(args, arg);
-    while (va_arg(args, const char *))
-        n++;
-
-    va_end(args);
-
-    if (VIR_ALLOC_N(argv, n + 1) < 0)
-        goto error;
-
-    n = 0;
-
-#if HAVE_FIREWALLD
-    if (firewall_cmd_path) {
-        if (!(argv[n++] = strdup(firewall_cmd_path)))
-            goto error;
-        if (!(argv[n++] = strdup("--direct")))
-            goto error;
-        if (!(argv[n++] = strdup("--passthrough")))
-            goto error;
-        if (!(argv[n++] = strdup("eb")))
-            goto error;
-    } else
-#endif
-    if (!(argv[n++] = strdup(EBTABLES_PATH)))
-        goto error;
-
-    command_idx = n;
-
-    if (action == ADD || action == REMOVE) {
-        if (!(argv[n++] = strdup("--insert")))
-            goto error;
-
-        if (!(argv[n++] = strdup(rules->chain)))
-            goto error;
-    }
-
-    if (!(argv[n++] = strdup(arg)))
-        goto error;
-
-    va_start(args, arg);
-
-    while ((s = va_arg(args, const char *))) {
-        if (!(argv[n++] = strdup(s))) {
-            va_end(args);
-            goto error;
-        }
-    }
-
-    va_end(args);
-
-    if (!(rule = virArgvToString(&argv[command_idx])))
-        goto error;
-
-    if (action == REMOVE) {
-        VIR_FREE(argv[command_idx]);
-        if (!(argv[command_idx] = strdup("--delete")))
-            goto error;
-    }
-
-    if (virRun(argv, NULL) < 0) {
-        retval = errno;
-        goto error;
-    }
-
-    if (action == ADD || action == CREATE || action == POLICY ||
-        action == INSERT) {
-        retval = ebtRulesAppend(rules, rule, argv, command_idx);
-        rule = NULL;
-        argv = NULL;
-    } else {
-        retval = ebtRulesRemove(rules, rule);
-    }
-
- error:
-    VIR_FREE(rule);
-
-    if (argv) {
-        n = 0;
-        while (argv[n])
-            VIR_FREE(argv[n++]);
-        VIR_FREE(argv);
-    }
-
-    return retval;
-}
-
-
-/**
- * ebtablesContextNew:
- *
- * Create a new ebtable context
- *
- * Returns a pointer to the new structure or NULL in case of error
- */
-ebtablesContext *
-ebtablesContextNew(const char *driver)
-{
-    bool success = false;
-    ebtablesContext *ctx = NULL;
-    char *input_chain = NULL;
-    char *forward_chain = NULL;
-    char *nat_chain = NULL;
-
-    if (VIR_ALLOC(ctx) < 0)
-        return NULL;
-
-    if (virAsprintf(&input_chain, "libvirt_%s_INPUT", driver) < 0 ||
-        virAsprintf(&forward_chain, "libvirt_%s_FORWARD", driver) < 0 ||
-        virAsprintf(&nat_chain, "libvirt_%s_POSTROUTING", driver) < 0) {
-        goto cleanup;
-    }
-
-    if (!(ctx->input_filter = ebtRulesNew("filter", input_chain)))
-        goto cleanup;
-
-    if (!(ctx->forward_filter = ebtRulesNew("filter", forward_chain)))
-        goto cleanup;
-
-    if (!(ctx->nat_postrouting = ebtRulesNew("nat", nat_chain)))
-        goto cleanup;
-
-    success = true;
-
-cleanup:
-    VIR_FREE(input_chain);
-    VIR_FREE(forward_chain);
-    VIR_FREE(nat_chain);
-
-    if (!success) {
-        ebtablesContextFree(ctx);
-        ctx = NULL;
-    }
-
-    return ctx;
-}
-
-/**
- * ebtablesContextFree:
- * @ctx: pointer to the EB table context
- *
- * Free the resources associated with an EB table context
- */
-void
-ebtablesContextFree(ebtablesContext *ctx)
-{
-    if (!ctx)
-        return;
-    if (ctx->input_filter)
-        ebtRulesFree(ctx->input_filter);
-    if (ctx->forward_filter)
-        ebtRulesFree(ctx->forward_filter);
-    if (ctx->nat_postrouting)
-        ebtRulesFree(ctx->nat_postrouting);
-    VIR_FREE(ctx);
-}
-
-int
-ebtablesAddForwardPolicyReject(ebtablesContext *ctx)
-{
-    return ebtablesForwardPolicyReject(ctx, ADD);
-}
-
-
-int
-ebtablesRemoveForwardPolicyReject(ebtablesContext *ctx)
-{
-    return ebtablesForwardPolicyReject(ctx, REMOVE);
-}
-
-int
-ebtablesForwardPolicyReject(ebtablesContext *ctx,
-                            int action)
-{
-    /* create it, if it does not exist */
-    if (action == ADD) {
-        ebtablesAddRemoveRule(ctx->forward_filter,
-                              CREATE,
-                              "--new-chain", ctx->forward_filter->chain, NULL,
-                              NULL);
-        ebtablesAddRemoveRule(ctx->forward_filter,
-                              INSERT,
-                              "--insert", "FORWARD", "--jump",
-                              ctx->forward_filter->chain, NULL);
-    }
-
-    return ebtablesAddRemoveRule(ctx->forward_filter,
-                                 POLICY,
-                                 "-P", ctx->forward_filter->chain, "DROP",
-                                 NULL);
-}
-
-/*
- * Allow all traffic destined to the bridge, with a valid network address
- */
-static int
-ebtablesForwardAllowIn(ebtablesContext *ctx,
-                       const char *iface,
-                       const char *macaddr,
-                       int action)
-{
-    return ebtablesAddRemoveRule(ctx->forward_filter,
-                                     action,
-                                     "--in-interface", iface,
-                                     "--source", macaddr,
-                                     "--jump", "ACCEPT",
-                                     NULL);
-}
-
-/**
- * ebtablesAddForwardAllowIn:
- * @ctx: pointer to the EB table context
- * @iface: the output interface name
- * @physdev: the physical input device or NULL
- *
- * Add rules to the EB table context to allow the traffic on
- * @physdev device to be forwarded to interface @iface. This allows
- * the inbound traffic on a bridge.
- *
- * Returns 0 in case of success or an error code otherwise
- */
-int
-ebtablesAddForwardAllowIn(ebtablesContext *ctx,
-                          const char *iface,
-                          const virMacAddrPtr mac)
-{
-    char *macaddr;
-
-    if (virAsprintf(&macaddr,
-                    "%02x:%02x:%02x:%02x:%02x:%02x",
-                    mac->addr[0], mac->addr[1],
-                    mac->addr[2], mac->addr[3],
-                    mac->addr[4], mac->addr[5]) < 0) {
-        return -1;
-    }
-    return ebtablesForwardAllowIn(ctx, iface, macaddr, ADD);
-}
-
-/**
- * ebtablesRemoveForwardAllowIn:
- * @ctx: pointer to the EB table context
- * @iface: the output interface name
- * @physdev: the physical input device or NULL
- *
- * Remove rules from the EB table context hence forbidding the traffic
- * on the @physdev device to be forwarded to interface @iface. This
- * stops the inbound traffic on a bridge.
- *
- * Returns 0 in case of success or an error code otherwise
- */
-int
-ebtablesRemoveForwardAllowIn(ebtablesContext *ctx,
-                             const char *iface,
-                             const virMacAddrPtr mac)
-{
-    char *macaddr;
-
-    if (virAsprintf(&macaddr,
-                    "%02x:%02x:%02x:%02x:%02x:%02x",
-                    mac->addr[0], mac->addr[1],
-                    mac->addr[2], mac->addr[3],
-                    mac->addr[4], mac->addr[5]) < 0) {
-       return -1;
-    }
-    return ebtablesForwardAllowIn(ctx, iface, macaddr, REMOVE);
-}
diff --git a/src/util/ebtables.h b/src/util/ebtables.h
deleted file mode 100644
index 49dc8a0..0000000
--- a/src/util/ebtables.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) 2009 IBM Corp.
- * Copyright (C) 2007, 2008 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library.  If not, see
- * <http://www.gnu.org/licenses/>.
- *
- * based on iptables.h
- * Authors:
- *     Gerhard Stenzel <gerhard stenzel de ibm com>
- */
-
-#ifndef __QEMUD_EBTABLES_H__
-# define __QEMUD_EBTABLES_H__
-
-# include "virmacaddr.h"
-
-typedef struct
-{
-    char  *rule;
-    const char **argv;
-    int    command_idx;
-} ebtRule;
-
-typedef struct
-{
-    char  *table;
-    char  *chain;
-
-    int      nrules;
-    ebtRule *rules;
-
-} ebtRules;
-
-typedef struct _ebtablesContext ebtablesContext;
-
-ebtablesContext *ebtablesContextNew              (const char *driver);
-void             ebtablesContextFree             (ebtablesContext *ctx);
-
-void             ebtablesSaveRules               (ebtablesContext *ctx);
-
-int              ebtablesAddForwardAllowIn       (ebtablesContext *ctx,
-                                                  const char *iface,
-                                                  const virMacAddrPtr mac);
-int              ebtablesRemoveForwardAllowIn    (ebtablesContext *ctx,
-                                                  const char *iface,
-                                                  const virMacAddrPtr mac);
-
-int              ebtablesAddForwardPolicyReject(ebtablesContext *ctx);
-
-int              ebtablesRemoveForwardPolicyReject(ebtablesContext *ctx);
-
-int              ebtablesForwardPolicyReject(ebtablesContext *ctx,
-                                                  int action);
-
-#endif /* __QEMUD_ebtabLES_H__ */
diff --git a/src/util/virebtables.c b/src/util/virebtables.c
new file mode 100644
index 0000000..8474b2a
--- /dev/null
+++ b/src/util/virebtables.c
@@ -0,0 +1,486 @@
+/*
+ * Copyright (C) 2007-2012 Red Hat, Inc.
+ * Copyright (C) 2009 IBM Corp.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * based on iptables.c
+ * Authors:
+ *     Gerhard Stenzel <gerhard stenzel de ibm com>
+ */
+
+#include <config.h>
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <string.h>
+#include <errno.h>
+#include <limits.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+#ifdef HAVE_PATHS_H
+# include <paths.h>
+#endif
+
+#include "internal.h"
+#include "virebtables.h"
+#include "vircommand.h"
+#include "memory.h"
+#include "virterror_internal.h"
+#include "logging.h"
+#include "threads.h"
+
+#if HAVE_FIREWALLD
+static char *firewall_cmd_path = NULL;
+
+static int
+virEbTablesOnceInit(void)
+{
+    firewall_cmd_path = virFindFileInPath("firewall-cmd");
+    if (!firewall_cmd_path) {
+        VIR_INFO("firewall-cmd not found on system. "
+                 "firewalld support disabled for ebtables.");
+    } else {
+        virCommandPtr cmd = virCommandNew(firewall_cmd_path);
+        int status;
+
+        virCommandAddArgList(cmd, "--state", NULL);
+        if (virCommandRun(cmd, &status) < 0 || status != 0) {
+            VIR_INFO("firewall-cmd found but disabled for ebtables");
+            VIR_FREE(firewall_cmd_path);
+            firewall_cmd_path = NULL;
+        } else {
+            VIR_INFO("using firewalld for ebtables commands");
+        }
+        virCommandFree(cmd);
+    }
+    return 0;
+}
+
+VIR_ONCE_GLOBAL_INIT(virEbTables)
+
+#endif
+
+struct _ebtablesContext
+{
+    ebtRules *input_filter;
+    ebtRules *forward_filter;
+    ebtRules *nat_postrouting;
+};
+
+enum {
+    ADD = 0,
+    REMOVE,
+    CREATE,
+    POLICY,
+    INSERT
+};
+
+static void
+ebtRuleFree(ebtRule *rule)
+{
+    VIR_FREE(rule->rule);
+
+    if (rule->argv) {
+        int i = 0;
+        while (rule->argv[i])
+            VIR_FREE(rule->argv[i++]);
+        VIR_FREE(rule->argv);
+    }
+}
+
+static int
+ebtRulesAppend(ebtRules *rules,
+               char *rule,
+               const char **argv,
+               int command_idx)
+{
+    if (VIR_REALLOC_N(rules->rules, rules->nrules+1) < 0) {
+        int i = 0;
+        while (argv[i])
+            VIR_FREE(argv[i++]);
+        VIR_FREE(argv);
+        return ENOMEM;
+    }
+
+    rules->rules[rules->nrules].rule        = rule;
+    rules->rules[rules->nrules].argv        = argv;
+    rules->rules[rules->nrules].command_idx = command_idx;
+
+    rules->nrules++;
+
+    return 0;
+}
+
+static int
+ebtRulesRemove(ebtRules *rules,
+               char *rule)
+{
+    int i;
+
+    for (i = 0; i < rules->nrules; i++)
+        if (STREQ(rules->rules[i].rule, rule))
+            break;
+
+    if (i >= rules->nrules)
+        return EINVAL;
+
+    ebtRuleFree(&rules->rules[i]);
+
+    memmove(&rules->rules[i],
+            &rules->rules[i+1],
+            (rules->nrules - i - 1) * sizeof(ebtRule));
+
+    rules->nrules--;
+
+    return 0;
+}
+
+static void
+ebtRulesFree(ebtRules *rules)
+{
+    int i;
+
+    VIR_FREE(rules->table);
+    VIR_FREE(rules->chain);
+
+    if (rules->rules) {
+        for (i = 0; i < rules->nrules; i++)
+            ebtRuleFree(&rules->rules[i]);
+
+        VIR_FREE(rules->rules);
+
+        rules->nrules = 0;
+    }
+
+    VIR_FREE(rules);
+}
+
+static ebtRules *
+ebtRulesNew(const char *table,
+            const char *chain)
+{
+    ebtRules *rules;
+
+    if (VIR_ALLOC(rules) < 0)
+        return NULL;
+
+    if (!(rules->table = strdup(table)))
+        goto error;
+
+    if (!(rules->chain = strdup(chain)))
+        goto error;
+
+    rules->rules = NULL;
+    rules->nrules = 0;
+
+    return rules;
+
+ error:
+    ebtRulesFree(rules);
+    return NULL;
+}
+
+static int ATTRIBUTE_SENTINEL
+ebtablesAddRemoveRule(ebtRules *rules, int action, const char *arg, ...)
+{
+    va_list args;
+    int retval = ENOMEM;
+    const char **argv;
+    char *rule = NULL;
+    const char *s;
+    int n, command_idx;
+
+    n = 1 + /* /sbin/ebtables  */
+        2 + /*   --table foo   */
+        2 + /*   --insert bar  */
+        1;  /*   arg           */
+
+#if HAVE_FIREWALLD
+    virEbTablesInitialize();
+    if (firewall_cmd_path)
+        n += 3; /* --direct --passthrough eb */
+#endif
+
+    va_start(args, arg);
+    while (va_arg(args, const char *))
+        n++;
+
+    va_end(args);
+
+    if (VIR_ALLOC_N(argv, n + 1) < 0)
+        goto error;
+
+    n = 0;
+
+#if HAVE_FIREWALLD
+    if (firewall_cmd_path) {
+        if (!(argv[n++] = strdup(firewall_cmd_path)))
+            goto error;
+        if (!(argv[n++] = strdup("--direct")))
+            goto error;
+        if (!(argv[n++] = strdup("--passthrough")))
+            goto error;
+        if (!(argv[n++] = strdup("eb")))
+            goto error;
+    } else
+#endif
+    if (!(argv[n++] = strdup(EBTABLES_PATH)))
+        goto error;
+
+    command_idx = n;
+
+    if (action == ADD || action == REMOVE) {
+        if (!(argv[n++] = strdup("--insert")))
+            goto error;
+
+        if (!(argv[n++] = strdup(rules->chain)))
+            goto error;
+    }
+
+    if (!(argv[n++] = strdup(arg)))
+        goto error;
+
+    va_start(args, arg);
+
+    while ((s = va_arg(args, const char *))) {
+        if (!(argv[n++] = strdup(s))) {
+            va_end(args);
+            goto error;
+        }
+    }
+
+    va_end(args);
+
+    if (!(rule = virArgvToString(&argv[command_idx])))
+        goto error;
+
+    if (action == REMOVE) {
+        VIR_FREE(argv[command_idx]);
+        if (!(argv[command_idx] = strdup("--delete")))
+            goto error;
+    }
+
+    if (virRun(argv, NULL) < 0) {
+        retval = errno;
+        goto error;
+    }
+
+    if (action == ADD || action == CREATE || action == POLICY ||
+        action == INSERT) {
+        retval = ebtRulesAppend(rules, rule, argv, command_idx);
+        rule = NULL;
+        argv = NULL;
+    } else {
+        retval = ebtRulesRemove(rules, rule);
+    }
+
+ error:
+    VIR_FREE(rule);
+
+    if (argv) {
+        n = 0;
+        while (argv[n])
+            VIR_FREE(argv[n++]);
+        VIR_FREE(argv);
+    }
+
+    return retval;
+}
+
+
+/**
+ * ebtablesContextNew:
+ *
+ * Create a new ebtable context
+ *
+ * Returns a pointer to the new structure or NULL in case of error
+ */
+ebtablesContext *
+ebtablesContextNew(const char *driver)
+{
+    bool success = false;
+    ebtablesContext *ctx = NULL;
+    char *input_chain = NULL;
+    char *forward_chain = NULL;
+    char *nat_chain = NULL;
+
+    if (VIR_ALLOC(ctx) < 0)
+        return NULL;
+
+    if (virAsprintf(&input_chain, "libvirt_%s_INPUT", driver) < 0 ||
+        virAsprintf(&forward_chain, "libvirt_%s_FORWARD", driver) < 0 ||
+        virAsprintf(&nat_chain, "libvirt_%s_POSTROUTING", driver) < 0) {
+        goto cleanup;
+    }
+
+    if (!(ctx->input_filter = ebtRulesNew("filter", input_chain)))
+        goto cleanup;
+
+    if (!(ctx->forward_filter = ebtRulesNew("filter", forward_chain)))
+        goto cleanup;
+
+    if (!(ctx->nat_postrouting = ebtRulesNew("nat", nat_chain)))
+        goto cleanup;
+
+    success = true;
+
+cleanup:
+    VIR_FREE(input_chain);
+    VIR_FREE(forward_chain);
+    VIR_FREE(nat_chain);
+
+    if (!success) {
+        ebtablesContextFree(ctx);
+        ctx = NULL;
+    }
+
+    return ctx;
+}
+
+/**
+ * ebtablesContextFree:
+ * @ctx: pointer to the EB table context
+ *
+ * Free the resources associated with an EB table context
+ */
+void
+ebtablesContextFree(ebtablesContext *ctx)
+{
+    if (!ctx)
+        return;
+    if (ctx->input_filter)
+        ebtRulesFree(ctx->input_filter);
+    if (ctx->forward_filter)
+        ebtRulesFree(ctx->forward_filter);
+    if (ctx->nat_postrouting)
+        ebtRulesFree(ctx->nat_postrouting);
+    VIR_FREE(ctx);
+}
+
+int
+ebtablesAddForwardPolicyReject(ebtablesContext *ctx)
+{
+    return ebtablesForwardPolicyReject(ctx, ADD);
+}
+
+
+int
+ebtablesRemoveForwardPolicyReject(ebtablesContext *ctx)
+{
+    return ebtablesForwardPolicyReject(ctx, REMOVE);
+}
+
+int
+ebtablesForwardPolicyReject(ebtablesContext *ctx,
+                            int action)
+{
+    /* create it, if it does not exist */
+    if (action == ADD) {
+        ebtablesAddRemoveRule(ctx->forward_filter,
+                              CREATE,
+                              "--new-chain", ctx->forward_filter->chain, NULL,
+                              NULL);
+        ebtablesAddRemoveRule(ctx->forward_filter,
+                              INSERT,
+                              "--insert", "FORWARD", "--jump",
+                              ctx->forward_filter->chain, NULL);
+    }
+
+    return ebtablesAddRemoveRule(ctx->forward_filter,
+                                 POLICY,
+                                 "-P", ctx->forward_filter->chain, "DROP",
+                                 NULL);
+}
+
+/*
+ * Allow all traffic destined to the bridge, with a valid network address
+ */
+static int
+ebtablesForwardAllowIn(ebtablesContext *ctx,
+                       const char *iface,
+                       const char *macaddr,
+                       int action)
+{
+    return ebtablesAddRemoveRule(ctx->forward_filter,
+                                     action,
+                                     "--in-interface", iface,
+                                     "--source", macaddr,
+                                     "--jump", "ACCEPT",
+                                     NULL);
+}
+
+/**
+ * ebtablesAddForwardAllowIn:
+ * @ctx: pointer to the EB table context
+ * @iface: the output interface name
+ * @physdev: the physical input device or NULL
+ *
+ * Add rules to the EB table context to allow the traffic on
+ * @physdev device to be forwarded to interface @iface. This allows
+ * the inbound traffic on a bridge.
+ *
+ * Returns 0 in case of success or an error code otherwise
+ */
+int
+ebtablesAddForwardAllowIn(ebtablesContext *ctx,
+                          const char *iface,
+                          const virMacAddrPtr mac)
+{
+    char *macaddr;
+
+    if (virAsprintf(&macaddr,
+                    "%02x:%02x:%02x:%02x:%02x:%02x",
+                    mac->addr[0], mac->addr[1],
+                    mac->addr[2], mac->addr[3],
+                    mac->addr[4], mac->addr[5]) < 0) {
+        return -1;
+    }
+    return ebtablesForwardAllowIn(ctx, iface, macaddr, ADD);
+}
+
+/**
+ * ebtablesRemoveForwardAllowIn:
+ * @ctx: pointer to the EB table context
+ * @iface: the output interface name
+ * @physdev: the physical input device or NULL
+ *
+ * Remove rules from the EB table context hence forbidding the traffic
+ * on the @physdev device to be forwarded to interface @iface. This
+ * stops the inbound traffic on a bridge.
+ *
+ * Returns 0 in case of success or an error code otherwise
+ */
+int
+ebtablesRemoveForwardAllowIn(ebtablesContext *ctx,
+                             const char *iface,
+                             const virMacAddrPtr mac)
+{
+    char *macaddr;
+
+    if (virAsprintf(&macaddr,
+                    "%02x:%02x:%02x:%02x:%02x:%02x",
+                    mac->addr[0], mac->addr[1],
+                    mac->addr[2], mac->addr[3],
+                    mac->addr[4], mac->addr[5]) < 0) {
+       return -1;
+    }
+    return ebtablesForwardAllowIn(ctx, iface, macaddr, REMOVE);
+}
diff --git a/src/util/virebtables.h b/src/util/virebtables.h
new file mode 100644
index 0000000..49dc8a0
--- /dev/null
+++ b/src/util/virebtables.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 IBM Corp.
+ * Copyright (C) 2007, 2008 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * based on iptables.h
+ * Authors:
+ *     Gerhard Stenzel <gerhard stenzel de ibm com>
+ */
+
+#ifndef __QEMUD_EBTABLES_H__
+# define __QEMUD_EBTABLES_H__
+
+# include "virmacaddr.h"
+
+typedef struct
+{
+    char  *rule;
+    const char **argv;
+    int    command_idx;
+} ebtRule;
+
+typedef struct
+{
+    char  *table;
+    char  *chain;
+
+    int      nrules;
+    ebtRule *rules;
+
+} ebtRules;
+
+typedef struct _ebtablesContext ebtablesContext;
+
+ebtablesContext *ebtablesContextNew              (const char *driver);
+void             ebtablesContextFree             (ebtablesContext *ctx);
+
+void             ebtablesSaveRules               (ebtablesContext *ctx);
+
+int              ebtablesAddForwardAllowIn       (ebtablesContext *ctx,
+                                                  const char *iface,
+                                                  const virMacAddrPtr mac);
+int              ebtablesRemoveForwardAllowIn    (ebtablesContext *ctx,
+                                                  const char *iface,
+                                                  const virMacAddrPtr mac);
+
+int              ebtablesAddForwardPolicyReject(ebtablesContext *ctx);
+
+int              ebtablesRemoveForwardPolicyReject(ebtablesContext *ctx);
+
+int              ebtablesForwardPolicyReject(ebtablesContext *ctx,
+                                                  int action);
+
+#endif /* __QEMUD_ebtabLES_H__ */
-- 
1.7.11.7


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]