- 08 4月, 2011 1 次提交
-
-
由 Stefan Berger 提交于
This patch adds support for the evaluation of TCP flags in nwfilters. It adds documentation to the web page and extends the tests as well. Also, the nwfilter schema is extended. The following are some example for rules using the tcp flags: <rule action='accept' direction='in'> <tcp state='NONE' flags='SYN/ALL' dsptportstart='80'/> </rule> <rule action='drop' direction='in'> <tcp state='NONE' flags='SYN/ALL'/> </rule>
-
- 05 4月, 2011 1 次提交
-
-
由 Matthias Bolte 提交于
Make virFileBuildPath operate on the heap instead of the stack. It allocates a buffer instead of expecting a preexisting buffer.
-
- 21 2月, 2011 1 次提交
-
-
由 Eric Blake 提交于
Two-argument free functions are uncommon; match the style elsewhere by caching the callback at creation. * src/util/hash.h (virHashCreate, virHashFree): Move deallocator argument to creation. * cfg.mk (useless_free_options): Add virHashFree. * src/util/hash.c (_virHashTable): Track deallocator. (virHashCreate, virHashFree): Update to new signature. * src/conf/domain_conf.c (virDomainObjListDeinit) (virDomainObjListInit, virDomainDiskDefForeachPath) (virDomainSnapshotObjListDeinit, virDomainSnapshotObjListInit): Update callers. * src/conf/nwfilter_params.c (virNWFilterHashTableFree) (virNWFilterHashTableCreate): Likewise. * src/conf/nwfilter_conf.c (virNWFilterTriggerVMFilterRebuild): Likewise. * src/cpu/cpu_generic.c (genericHashFeatures, genericBaseline): Likewise. * src/xen/xm_internal.c (xenXMOpen, xenXMClose): Likewise. * src/nwfilter/nwfilter_learnipaddr.c (virNWFilterLearnInit) (virNWFilterLearnShutdown): Likewise. * src/qemu/qemu_command.c (qemuDomainPCIAddressSetCreate) (qemuDomainPCIAddressSetFree): Likewise. * src/qemu/qemu_process.c (qemuProcessWaitForMonitor): Likewise.
-
- 19 2月, 2011 1 次提交
-
-
由 Stefan Berger 提交于
This patch adds the possibility to not just drop packets, but to also have them rejected where iptables at least sends an ICMP msg back to the originator. On ebtables this again maps into dropping packets since rejecting is not supported. I am adding 'since 0.8.9' to the docs assuming this will be the next version of libvirt.
-
- 18 2月, 2011 1 次提交
-
-
由 Christophe Fergeau 提交于
Now that the virHash handling functions call virReportOOMError by themselves when needed, users of the virHash API no longer need to do it by themselves. Since users of the virHash API were not consistently calling virReportOOMError after memory failures from the virHash code, this has the added benefit of making OOM reporting from this code more consistent and reliable.
-
- 29 1月, 2011 1 次提交
-
-
由 Matthias Bolte 提交于
Pure cosmetic change.
-
- 19 1月, 2011 2 次提交
-
-
由 Matthias Bolte 提交于
VIR_ERR_INVALID_* is meant for invalid pointers only.
-
由 Matthias Bolte 提交于
The public object is called NWFilter but the corresponding private object is called NWFilterPool. I don't see compelling reasons for this Pool suffix. One might argue that an NWFilter is a "pool" of rules, etc. Remove the Pool suffix from NWFilterPool. No functional change included.
-
- 22 10月, 2010 1 次提交
-
-
由 Daniel P. Berrange 提交于
The nwIPAddress was simply a wrapper about virSocketAddr. Just use the latter directly, removing all the extra field de-references from code & helper APIs for parsing/formatting. Also remove all the redundant casts from strong types to void * and then immediately back to strong types. * src/conf/nwfilter_conf.h: Remove nwIPAddress * src/conf/nwfilter_conf.c, src/nwfilter/nwfilter_ebiptables_driver.c: Update to use virSocketAddr and remove void * casts.
-
- 19 10月, 2010 1 次提交
-
-
由 Stefan Berger 提交于
Since bugs due to double-closed file descriptors are difficult to track down in a multi-threaded system, I am introducing the VIR_CLOSE(fd) macro to help avoid mistakes here. There are lots of places where close() is being used. In this patch I am only cleaning up usage of close() in src/conf where the problems were. I also dare to declare close() as being deprecated in libvirt code base (HACKING).
-
- 14 10月, 2010 1 次提交
-
-
由 Stefan Berger 提交于
Patch to prevent multiple nwfilters with different name but same UUID.
-
- 13 10月, 2010 1 次提交
-
-
由 Stefan Berger 提交于
This is from a bug report and conversation on IRC where Soren reported that while a filter update is occurring on one or more VMs (due to a rule having been edited for example), a deadlock can occur when a VM referencing a filter is started. The problem is caused by the two locking sequences of qemu driver, qemu domain, filter # for the VM start operation filter, qemu_driver, qemu_domain # for the filter update operation that obviously don't lock in the same order. The problem is the 2nd lock sequence. Here the qemu_driver lock is being grabbed in qemu_driver:qemudVMFilterRebuild() The following solution is based on the idea of trying to re-arrange the 2nd sequence of locks as follows: qemu_driver, filter, qemu_driver, qemu_domain and making the qemu driver recursively lockable so that a second lock can occur, this would then lead to the following net-locking sequence qemu_driver, filter, qemu_domain where the 2nd qemu_driver lock has been ( logically ) eliminated. The 2nd part of the idea is that the sequence of locks (filter, qemu_domain) and (qemu_domain, filter) becomes interchangeable if all code paths where filter AND qemu_domain are locked have a preceding qemu_domain lock that basically blocks their concurrent execution So, the following code paths exist towards qemu_driver:qemudVMFilterRebuild where we now want to put a qemu_driver lock in front of the filter lock. -> nwfilterUndefine() [ locks the filter ] -> virNWFilterTestUnassignDef() -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() -> nwfilterDefine() -> virNWFilterPoolAssignDef() [ locks the filter ] -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() -> nwfilterDriverReload() -> virNWFilterPoolLoadAllConfigs() ->virNWFilterPoolObjLoad() -> virNWFilterPoolAssignDef() [ locks the filter ] -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() -> nwfilterDriverStartup() -> virNWFilterPoolLoadAllConfigs() ->virNWFilterPoolObjLoad() -> virNWFilterPoolAssignDef() [ locks the filter ] -> virNWFilterTriggerVMFilterRebuild() -> qemudVMFilterRebuild() Qemu is not the only driver using the nwfilter driver, but also the UML driver calls into it. Therefore qemuVMFilterRebuild() can be exchanged with umlVMFilterRebuild() along with the driver lock of qemu_driver that can now be a uml_driver. Further, since UML and Qemu domains can be running on the same machine, the triggering of a rebuild of the filter can touch both types of drivers and their domains. In the patch below I am now extending each nwfilter callback driver with functions for locking and unlocking the (VM) driver (UML, QEMU) and introduce new functions for locking all registered callback drivers and unlocking them. Then I am distributing the lock-all-cbdrivers/unlock-all-cbdrivers call into the above call paths. The last shown callpath starting with nwfilterDriverStart() is problematic since it is initialize before the Qemu and UML drives are and thus a lock in the path would result in a NULL pointer attempted to be locked -- the call to virNWFilterTriggerVMFilterRebuild() is never called, so we never lock either the qemu_driver or the uml_driver in that path. Therefore, only the first 3 paths now receive calls to lock and unlock all callback drivers. Now that the locks are distributed where it matters I can remove the qemu_driver and uml_driver lock from qemudVMFilterRebuild() and umlVMFilterRebuild() and not requiring the recursive locks. For now I want to put this out as an RFC patch. I have tested it by 'stretching' the critical section after the define/undefine functions each lock the filter so I can (easily) concurrently execute another VM operation (suspend,start). That code is in this patch and if you want you can de-activate it. It seems to work ok and operations are being blocked while the update is being done. I still also want to verify the other assumption above that locking filter and qemu_domain always has a preceding qemu_driver lock.
-
- 07 10月, 2010 1 次提交
-
-
由 Stefan Berger 提交于
The patch below extends the XML parser and generator so that every l3 protocol now can have a state attribute.
-
- 01 10月, 2010 1 次提交
-
-
由 Stefan Berger 提交于
The patch below extends the XML parser and generator so that every protocol now can have a comment node. Comments are limited to 256 characters.
-
- 22 9月, 2010 1 次提交
-
-
由 Stefan Berger 提交于
This patch fixes a bug appearing on big endian machines where the returned XML is not the one that is expected (see test/nwfilterxml2xmltest). The problem is due to for example the casting of pointers to unsigned integers to void * and then back to 16 bit integers.
-
- 13 8月, 2010 1 次提交
-
-
由 Stefan Berger 提交于
This patch fixes a couple of complaints from valgrind when tickling libvirtd with SIGHUP. The first two files contain fixes for memory leaks. The 3rd one initializes an uninitialized variable. The 4th one is another memory leak.
-
- 18 6月, 2010 1 次提交
-
-
由 Stefan Berger 提交于
This patch adds an optional XML attribute to a nwfilter rule to give the user control over whether the rule is supposed to be using the iptables state match or not. A rule may now look like shown in the XML below with the statematch attribute either having value '0' or 'false' (case-insensitive). [...] <rule action='accept' direction='in' statematch='false'> <tcp srcmacaddr='1:2:3:4:5:6' srcipaddr='10.1.2.3' srcipmask='32' dscp='33' srcportstart='20' srcportend='21' dstportstart='100' dstportend='1111'/> </rule> [...] I am also extending the nwfilter schema and add this attribute to a test case.
-
- 19 5月, 2010 1 次提交
-
-
由 Jim Meyering 提交于
* src/conf/nwfilter_conf.c (virNWFilterDefParseXML): Also free "ret" via cleanup.
-
- 04 5月, 2010 1 次提交
-
-
由 Stefan Berger 提交于
When a filter is updated, only those interfaces must have their old rules cleared that either reference the filter directly or indirectly through another filter. Remember between the different steps of the instantiation of the filters which interfaces must be skipped. I am using a hash map to remember the names of the interfaces and store a bogus pointer to ~0 into it that need not be freed.
-
- 27 4月, 2010 2 次提交
-
-
由 Stefan Berger 提交于
This patch adds support for the RARP protocol. This may be needed due to qemu sending out a RARP packet (at least that's what it seems to want to do even though the protocol id is wrong) when migration finishes and we'd need a rule to let the packets pass. Unfortunately my installation of ebtables does not understand -p RARP and also seems to otherwise depend on strings in /etc/ethertype translated to protocol identifiers. Therefore I need to pass -p 0x8035 for RARP. To generally get rid of the dependency of that file I switch all so far supported protocols to use their protocol identifier in the -p parameter rather than the string. I am also extending the schema and added a test case. changes from v1 to v2: - added test case into patch
-
由 Stefan Berger 提交于
With this patch I want to enable hex number inputs in the filter XML. A number that was entered as hex is also printed as hex unless a string representing the meaning can be found. I am also extending the schema and adding a test case. A problem with the DSCP value is fixed on the way as well. Changes from V1 to V2: - using asHex boolean in all printf type of functions to select the output format in hex or decimal format
-
- 21 4月, 2010 1 次提交
-
-
由 Stefan Berger 提交于
This patch adds support for the connlimit match in iptables that is used to limit the number of outgoing directions.
-
- 15 4月, 2010 1 次提交
-
-
由 Matthias Bolte 提交于
Triggered by gnulib when compiling with MinGW.
-
- 09 4月, 2010 1 次提交
-
-
由 Daniel Veillard 提交于
* src/conf/nwfilter_conf.c src/util/hooks.c: added spaces to avoid "make syntax-check" failures
-
- 08 4月, 2010 2 次提交
-
-
由 Daniel P. Berrange 提交于
The network filter / snapshot / hooks code introduced some non-portable pices that broke the win32 build * configure.ac: Check for net/ethernet.h required by nwfile config parsing code * src/conf/nwfilter_conf.c: Define ethernet protocol constants if net/ethernet.h is missing * src/util/hooks.c: Disable hooks build on Win32 since it lacks fork/exec/pipe * src/util/threads-win32.c: Fix unchecked return value * tools/virsh.c: Disable SIGPIPE on Win32 since it doesn't exist. Fix non-portable strftime() formats
-
由 Stefan Berger 提交于
This patch implements support for learning a VM's IP address. It uses the pcap library to listen on the VM's backend network interface (tap) or the physical ethernet device (macvtap) and tries to capture packets with source or destination MAC address of the VM and learn from DHCP Offers, ARP traffic, or first-sent IPv4 packet what the IP address of the VM's interface is. This then allows to instantiate the network traffic filtering rules without the user having to provide the IP parameter somewhere in the filter description or in the interface description as a parameter. This only supports to detect the parameter IP, which is for the assumed single IPv4 address of a VM. There is not support for interfaces that may have multiple IP addresses (IP aliasing) or IPv6 that may then require more than one valid IP address to be detected. A VM can have multiple independent interfaces that each uses a different IP address and in that case it will be attempted to detect each one of the address independently. So, when for example an interface description in the domain XML has looked like this up to now: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'> <parameter name='IP' value='10.2.3.4'/> </filterref> </interface> you may omit the IP parameter: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> Internally I am walking the 'tree' of a VM's referenced network filters and determine with the given variables which variables are missing. Now, the above IP parameter may be missing and this causes a libvirt-internal thread to be started that uses the pcap library's API to listen to the backend interface (in case of macvtap to the physical interface) in an attempt to determine the missing IP parameter. If the backend interface disappears the thread terminates assuming the VM was brought down. In case of a macvtap device a timeout is being used to wait for packets from the given VM (filtering by VM's interface MAC address). If the VM's macvtap device disappeared the thread also terminates. In all other cases it tries to determine the IP address of the VM and will then apply the rules late on the given interface, which would have happened immediately if the IP parameter had been explicitly given. In case an error happens while the firewall rules are applied, the VM's backend interface is 'down'ed preventing it to communicate. Reasons for failure for applying the network firewall rules may that an ebtables/iptables command failes or OOM errors. Essentially the same failure reasons may occur as when the firewall rules are applied immediately on VM start, except that due to the late application of the filtering rules the VM now is already running and cannot be hindered anymore from starting. Bringing down the whole VM would probably be considered too drastic. While a VM's IP address is attempted to be determined only limited updates to network filters are allowed. In particular it is prevented that filters are modified in such a way that they would introduce new variables. A caveat: The algorithm does not know which one is the appropriate IP address of a VM. If the VM spoofs an IP address in its first ARP traffic or IPv4 packets its filtering rules will be instantiated for this IP address, thus 'locking' it to the found IP address. So, it's still 'safer' to explicitly provide the IP address of a VM's interface in the filter description if it is known beforehand. * configure.ac: detect libpcap * libvirt.spec.in: require libpcap[-devel] if qemu is built * src/internal.h: add the new ATTRIBUTE_PACKED define * src/Makefile.am src/libvirt_private.syms: add the new modules and symbols * src/nwfilter/nwfilter_learnipaddr.[ch]: new module being added * src/nwfilter/nwfilter_driver.c src/conf/nwfilter_conf.[ch] src/nwfilter/nwfilter_ebiptables_driver.[ch] src/nwfilter/nwfilter_gentech_driver.[ch]: plu the new functionality in * tests/nwfilterxml2xmltest: extend testing
-
- 06 4月, 2010 2 次提交
-
-
由 Stefan Berger 提交于
This patch fixes some compilation issues for the RHEL5 build. I am also removing the IPV6 constant where it appears in the wrong place.
-
由 Stefan Berger 提交于
This patch removes the virConnectPtr parameter from all functions where it's not necessary starting out with removing it as a parameter to the error reporting function.
-
- 04 4月, 2010 2 次提交
-
-
由 Stefan Berger 提交于
values. Rather use the strspn() function. Along with this cleanup the initialization function for the code that used the regular expression can also be removed.
-
由 Matthias Bolte 提交于
An uninitialized int value was used to index an array. This can result in a segfault in nwfilterxml2xmltest.
-
- 03 4月, 2010 2 次提交
-
-
由 Stefan Berger 提交于
where possible.
-
由 Stefan Berger 提交于
- ebtables requires that some of the command line parameters are passed as hex numbers; so have those attributes call a function that prints 16 and 8 bit integers as hex nunbers. - ip6tables requires '--icmpv6-type' rather than '--icmp-type' - ebtables complains about protocol identifiers lower than 0x600, so already discard anything lower than 0x600 in the parser - make the protocol entry types more readable using a #define for its entries - continue parsing a filtering rule even if a faulty entry is encountered; return an error value at the end and let the caller decide what to do with the rule's object - fix an error message
-
- 01 4月, 2010 2 次提交
-
-
由 Matthias Bolte 提交于
Parsing is stricter now and doesn't accept trailing characters after the actual value anymore.
-
由 Stefan Berger 提交于
found some cases where the output ended up not looking as expected. So the following changes are in the patch below: - if the protocol ID in the MAC header is an integer, just write it into the datastructure without trying to find a corresponding string for it and if none is found failing - when writing the protocol ID as string, simply write it as integer if no corresponding string can be found - same changes for arpOpcode parsing and printing - same changes for protocol ID in an IP packet - DSCP value needs to be written into the data structure - IP protocol version number is redundant at this level, so remove it - parse the protocol ID found inside an IP packet not only as string but also as uint8 - arrange the display of the src and destination masks to be shown after the src and destination ip address respectively in the XML - the existing libvirt IP address parser accepts for example '25' as an IP address. I want this to be parsed as a CIDR type netmask. So try to parse it as an integer first (CIDR netmask) and if that doesn't work as a dotted IP address style netmask. - instantiation of rules with MAC masks didn't work because they weren't printed into a buffer, yet.
-
- 30 3月, 2010 6 次提交
-
-
由 Stefan Berger 提交于
more readable. Add some missing entries: ipv6 and icmpv6.
-
由 Stefan Berger 提交于
This patch changes the network filtering code to use libvirt's existing IPv4 and IPv6 address parsers/printers rather than my self-written ones. I am introducing a new function in network.c that counts the number of bits in a netmask and ensures that the given address is indeed a netmask, return -1 on error or values of 0-32 for IPv4 addresses and 0-128 for IPv6 addresses. I then based the function checking for valid netmask on invoking this function.
-
由 Stefan Berger 提交于
This patch adds IPv6 filtering support for the following protocols: - tcp-ipv6 - udp-ipv6 - udplite-ipv6 - esp-ipv6 - ah-ipv6 - sctp-ipv6 - all-ipv6 - icmpv6 Many of the IPv4 data structure could be re-used for IPv6 support. Since ip6tables also supports pretty much the same command line parameters as iptables does, also much of the code could be re-used and now command lines are invoked with the ip(6)tables tool parameter passed through the functions as a parameter.
-
由 Stefan Berger 提交于
This patch removes the driver dependency from nwfilter_conf.c and moves a callback function calling into the driver into nwfilter_gentech_driver.c and passes a pointer to that callback function upon initialization of nwfilter_conf.c.
-
由 Stefan Berger 提交于
This patch adds filtering support for the so-far missing protocols 'ah', 'esp' and 'udplite'.
-
由 Stefan Berger 提交于
This patch fixes the 'make check' runs for me which, under certain circumstances and login configurations, did invoke popups requesting authentication. I removed the parameter conn from being passed into the error reporting function. * src/conf/nwfilter_conf.h src/conf/nwfilter_conf.c: remove conn from error reporting parameters.
-