Skip to content

L
libvirt

openeuler / libvirt

通知 3
Star 0
Fork 0
L
libvirt

体验新版 GitCode，发现更多精彩内容 >>

切换分支/标签
  1. 03 8月, 2017 2 次提交
  3. 09 3月, 2017 1 次提交
  5. 14 11月, 2016 1 次提交
  7. 23 4月, 2016 1 次提交
  9. 22 4月, 2016 1 次提交
  11. 08 1月, 2015 1 次提交
    • S
      nwfilter: Add support for icmpv6 filtering · 3a3b3691
      由 Stefan Berger 提交于 
      Make use of the ebtables functionality to be able to filter certain
parameters of icmpv6 packets. Extend the XML parser for icmpv6 types,
type ranges, codes, and code ranges. Extend the nwfilter documentation,
schema, and test cases.

Being able to filter icmpv6 types and codes helps extending the DHCP
snooper for IPv6 and filtering at least some parameters of IPv6's NDP
(Neighbor Discovery Protocol) packets. However, the filtering will not
be as good as the filtering of ARP packets since we cannot
check on IP addresses in the payload of the NDP packets.
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      3a3b3691
  13. 19 8月, 2014 1 次提交
    • J
      docs: nwfilter: add missing dscp attribute · 08567572
      由 Jianwei Hu 提交于 
      Added attribute dscp to below supported protocols table in nwfilter docs.
IPV4 (ip)
TCP/UDP/SCTP (tcp/udp/sctp)
ICMP (icmp)
IGMP,ESP,AH,UDPLITE,'ALL' (igmp,esp,ah,udplite,all)
TCP/UDP/SCTP over IPV6 (tcp-ipv6,udp-ipv6,sctp-ipv6)
ICMPV6 (icmpv6)
IGMP,ESP,AH,UDPLITE,'ALL' over IPv6 (igmp-ipv6,esp-ipv6,ah-ipv6,udplite-ipv6,all-ipv6)

Here is a simple example:
[root@localhost ~]# virsh nwfilter-dumpxml myself
<filter name='myself' chain='root'>
  <uuid>7192ef51-cd50-4f14-ad7b-fa5c69ea19e3</uuid>
  <rule action='accept' direction='in' priority='500'>
    <ip dscp='1'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <tcp dscp='1'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <tcp-ipv6 dscp='2'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <icmp dscp='55'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <icmpv6 dscp='55'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <udp dscp='3'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <udp-ipv6 dscp='4'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <udplite dscp='5'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <udplite-ipv6 dscp='6'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <esp dscp='7'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <esp-ipv6 dscp='8'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <ah dscp='9'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <ah-ipv6 dscp='10'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <sctp dscp='11'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <sctp-ipv6 dscp='55'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <igmp dscp='55'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <all-ipv6 dscp='55'/>
  </rule>
  <rule action='accept' direction='in' priority='500'>
    <all dscp='55'/>
  </rule>
</filter>
Signed-off-by: NJán Tomko <jtomko@redhat.com>
      08567572
  15. 05 8月, 2014 1 次提交
  17. 14 3月, 2014 1 次提交
  19. 15 11月, 2013 1 次提交
  21. 06 11月, 2013 1 次提交
  23. 30 10月, 2013 1 次提交
  25. 03 5月, 2013 1 次提交
    • D
      Fix multiple formatting problems in HTML docs · f2f9742d
      由 Daniel P. Berrange 提交于 
      The rule generating the HTML docs passing the --html flag
to xsltproc. This makes it use the legacy HTML parser, which
either ignores or tries to fix all sorts of broken XML tags.
There's no reason why we should be writing broken XML in
the first place, so removing --html and adding the XHTML
doctype to all files forces us to create good XML.

This adds the XHTML doc type and fixes many, many XML tag
problems it exposes.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
      f2f9742d
  27. 23 8月, 2012 1 次提交
  29. 02 6月, 2012 1 次提交
    • S
      nwfilter: add DHCP snooping · cec281fc
      由 Stefan Berger 提交于 
      This patch adds DHCP snooping support to libvirt. The learning method for
IP addresses is specified by setting the "CTRL_IP_LEARNING" variable to one of
"any" [default] (existing IP learning code), "none" (static only addresses)
or "dhcp" (DHCP snooping).

Active leases are saved in a lease file and reloaded on restart or HUP.

The following interface XML activates and uses the DHCP snooping:

    <interface type='bridge'>
      <source bridge='virbr0'/>
      <filterref filter='clean-traffic'>
        <parameter name='CTRL_IP_LEARNING' value='dhcp'/>
      </filterref>
    </interface>

All filters containing the variable 'IP' are automatically adjusted when
the VM receives an IP address via DHCP. However, multiple IP addresses per
interface are silently ignored in this patch, thus only supporting one IP
address per interface. Multiple IP address support is added in a later
patch in this series.
Signed-off-by: NDavid L Stevens <dlstevens@us.ibm.com>
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      cec281fc
  31. 21 5月, 2012 1 次提交
    • S
      nwfilter: Add support for ipset · a3f3ab4c
      由 Stefan Berger 提交于 
      This patch adds support for the recent ipset iptables extension
to libvirt's nwfilter subsystem. Ipset allows to maintain 'sets'
of IP addresses, ports and other packet parameters and allows for
faster lookup (in the order of O(1) vs. O(n)) and rule evaluation
to achieve higher throughput than what can be achieved with
individual iptables rules.

On the command line iptables supports ipset using

iptables ... -m set --match-set <ipset name> <flags> -j ...

where 'ipset name' is the name of a previously created ipset and
flags is a comma-separated list of up to 6 flags. Flags use 'src' and 'dst'
for selecting IP addresses, ports etc. from the source or
destination part of a packet. So a concrete example may look like this:

iptables -A INPUT -m set --match-set test src,src -j ACCEPT

Since ipset management is quite complex, the idea was to leave ipset 
management outside of libvirt but still allow users to reference an ipset.
The user would have to make sure the ipset is available once the VM is
started so that the iptables rule(s) referencing the ipset can be created.

Using XML to describe an ipset in an nwfilter rule would then look as
follows:

  <rule action='accept' direction='in'>
    <all ipset='test' ipsetflags='src,src'/>
  </rule>

The two parameters on the command line are also the two distinct XML attributes
'ipset' and 'ipsetflags'.

FYI: Here is the man page for ipset:

https://ipset.netfilter.org/ipset.man.html

Regards,
    Stefan
      a3f3ab4c
  33. 11 1月, 2012 1 次提交
  35. 23 11月, 2011 1 次提交
  37. 19 11月, 2011 2 次提交
  39. 21 10月, 2011 1 次提交
  41. 24 5月, 2011 1 次提交
  43. 20 4月, 2011 1 次提交
  45. 08 4月, 2011 1 次提交
    • S
      nwfilters: support for TCP flags evaluation · 6ab24feb
      由 Stefan Berger 提交于 
      This patch adds support for the evaluation of TCP flags in nwfilters.

It adds documentation to the web page and extends the tests as well.
Also, the nwfilter schema is extended.

The following are some example for rules using the tcp flags:

<rule action='accept' direction='in'>
    <tcp state='NONE' flags='SYN/ALL' dsptportstart='80'/>
</rule>
<rule action='drop' direction='in'>
    <tcp state='NONE' flags='SYN/ALL'/>
</rule>
      6ab24feb
  47. 02 4月, 2011 1 次提交
    • E
      docs: correct invalid xml · b5ec89d9
      由 Eric Blake 提交于 
      * docs/internals.html.in: Fix xml errors.
* docs/formatstorageencryption.html.in: Likewise.
* docs/drvesx.html.in: Likewise.
* docs/archnetwork.html.in: Likewise.
* docs/logging.html.in: Likewise.
* docs/drvvmware.html.in: Likewise.
* docs/api.html.in: Likewise.
* docs/formatnwfilter.html.in: Likewise.
* docs/formatdomain.html.in: Likewise.
* docs/windows.html.in: Likewise.
      b5ec89d9
  49. 30 3月, 2011 1 次提交
  51. 19 2月, 2011 1 次提交
    • S
      nwfilter: enable rejection of packets · 912d170f
      由 Stefan Berger 提交于 
      This patch adds the possibility to not just drop packets, but to also have them rejected where iptables at least sends an ICMP msg back to the originator. On ebtables this again maps into dropping packets since rejecting is not supported.

I am adding 'since 0.8.9' to the docs assuming this will be the next version of libvirt.
      912d170f
  53. 07 10月, 2010 2 次提交
  55. 01 10月, 2010 1 次提交
  57. 19 6月, 2010 1 次提交
    • S
      nwfilter: extensions of docs with · 7057f39c
      由 Stefan Berger 提交于 
      As requested, here a couple of paragraphs about the recently added statematch attribute and some advanced (and tricky) traffic filtering topics.
      7057f39c
  59. 26 5月, 2010 1 次提交
    • E
      build: fix HTML errors in nwfilter docs · 6e6acb77
      由 Eric Blake 提交于 
      A build on Ubuntu reported:

|| Generating formatnwfilter.html.tmp
/dados/develop/libvirt/docs/formatnwfilter.html.in|390| HTML parser error : Unexpected end tag : p
||     </p>
||         ^
/dados/develop/libvirt/docs/formatnwfilter.html.in|705| HTML parser error : Unexpected end tag : code
||          <td>End of range of valid source ports</code></td>
||                                                       ^
/dados/develop/libvirt/docs/formatnwfilter.html.in|710| HTML parser error : Unexpected end tag : code
||          <td>Start of range of valid destination ports</code></td>
||                                                              ^

* docs/formatnwfilter.html.in: Fix invalid HTML constructs.
Reported by Eduardo Otubo.
      6e6acb77
  61. 25 5月, 2010 1 次提交
    • S
      nwfilter: documentation · f36eb693
      由 Stefan Berger 提交于 
      This patch adds documentation of the nwfilter subsystem of libvirt to
the existing (web) docs.
      f36eb693