- 19 11月, 2011 12 次提交
-
-
由 Stefan Berger 提交于
This patch extends the NWFilter driver for Linux (ebiptables) to create rules for each member of a previously introduced list. If for example an attribute value (internally) looks like this: IP = [10.0.0.1, 10.0.0.2, 10.0.0.3] then 3 rules will be generated for a rule accessing the variable 'IP', one for each member of the list. The effect of this is that this now allows for filtering for multiple values in one field. This can then be used to support for filtering/allowing of multiple IP addresses per interface. An iterator is introduced that extracts each member of a list and puts it into a hash table which then is passed to the function creating a rule. For the above example the iterator would cause 3 loops. Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
-
由 Stefan Berger 提交于
NWFilters can be provided name-value pairs using the following XML notation: <filterref filter='xyz'> <parameter name='PORT' value='80'/> <parameter name='VAL' value='abc'/> </filterref> The internal representation currently is so that a name is stored as a string and the value as well. This patch now addresses the value part of it and introduces a data structure for storing a value either as a simple value or as an array for later support of lists. This patch adjusts all code that was handling the values in hash tables and makes it use the new data type. Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
-
由 Stefan Berger 提交于
The previous patch extends the priority of filtering rules into negative numbers. We now use this possibility to interleave the jumping into chains with filtering rules to for example create the 'root' table of an interface with the following sequence of rules: Bridge chain: libvirt-I-vnet0, entries: 6, policy: ACCEPT -p IPv4 -j I-vnet0-ipv4 -p ARP -j I-vnet0-arp -p ARP -j ACCEPT -p 0x8035 -j I-vnet0-rarp -p 0x835 -j ACCEPT -j DROP The '-p ARP -j ACCEPT' rule now appears between the jumps. Since the 'arp' chain has been assigned priority -700 and the 'rarp' chain -600, the above ordering can now be achieved with the following rule: <rule action='accept' direction='out' priority='-650'> <mac protocolid='arp'/> </rule> This patch now sorts the commands generating the above shown jumps into chains and interleaves their execution with those for generating rules. Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
-
由 Stefan Berger 提交于
So far rules' priorities have only been valid in the range [0,1000]. Now I am extending their priority into the range [-1000, 1000] for subsequently being able to sort rules and the access of (jumps into) chains following priorities. Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
-
由 Stefan Berger 提交于
Use the name of the chain rather than its type index (enum). This pushes the later enablement of chains with user-given names into the XML parser. For now we still only allow those names that are well known ('root', 'arp', 'rarp', 'ipv4' and 'ipv6'). Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
-
由 Stefan Berger 提交于
Use scripts for the renaming and cleaning up of chains. This allows us to get rid of some of the code that is only capable of renaming and removing chains whose names are hardcoded. A shell function 'collect_chains' is introduced that is given the name of an ebtables chain and then recursively determines the names of all chains that are accessed from this chain and its sub-chains using 'jumps'. The resulting list of chain names is then used to delete all the found chains by first flushing and then deleting them. The same function is also used for renaming temporary filters to their final names. I tested this with the bash and dash as script interpreters. Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
-
由 Stefan Berger 提交于
Use the previously introduced chain priorities to sort the chains for access from an interface's 'root' table and have them created in the proper order. This gets rid of a lot of code that was previously creating the chains in a more hardcoded way. To determine what protocol a filter is used for evaluation do prefix- matching, i.e., the filter 'arp' is used to filter for the 'arp' protocol, 'ipv4' for the 'ipv4' protocol and 'arp-xyz' will also be used to filter for the 'arp' protocol following the prefix 'arp' in its name. Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
-
由 Stefan Berger 提交于
For better handling of the sorting of chains introduce an internally used priority. Use a lookup table to store the priorities. For now their actual values do not matter just that the values cause the chains to be properly sorted through changes in the following patches. However, the values are chosen as negative so that once they are sorted along with filtering rules (whose priority may only be positive for now) they will always be instantiated before them (lower values cause instantiation before higher values). This is done to maintain backwards compatibility. Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
-
由 Daniel P. Berrange 提交于
Move the ifaceMacvtapLinkDump and ifaceGetNthParent functions into virnetdevvportprofile.c since they are specific to that code. This avoids polluting the headers with the Linux specific netlink data types * src/util/interface.c, src/util/interface.h: Move ifaceMacvtapLinkDump and ifaceGetNthParent functions and delete remaining file * src/util/virnetdevvportprofile.c: Add ifaceMacvtapLinkDump and ifaceGetNthParent functions * src/network/bridge_driver.c, src/nwfilter/nwfilter_gentech_driver.c, src/nwfilter/nwfilter_learnipaddr.c, src/util/virnetdevmacvlan.c: Remove include of interface.h
-
由 Daniel P. Berrange 提交于
Rename the ifaceCheck method to virNetDevValidateConfig and change so that it always raises an error and returns -1 on error. * src/util/interface.c, src/util/interface.h: Rename ifaceCheck to virNetDevValidateConfig * src/nwfilter/nwfilter_gentech_driver.c, src/nwfilter/nwfilter_learnipaddr.c: Update for API rename
-
由 Daniel P. Berrange 提交于
Move virNetDevGetIndex & virNetDevGetVLanID to virnetdev.c to suit their functional purpose * util/interface.c, util/interface.h: Remove virNetDevGetIndex & virNetDevGetVLanID * util/virnetdev.c, util/virnetdev.h: Add virNetDevGetIndex & virNetDevGetVLanID
-
由 Daniel P. Berrange 提交于
Rename the ifaceGetIndex method to virNetDevGetIndex and ifaceGetVlanID to virNetDevGetVLanID. Also change the error reporting behaviour to always raise errors and return -1 on failure * util/interface.c, util/interface.h: Rename ifaceGetIndex and ifaceGetVLAN * nwfilter/nwfilter_gentech_driver.c, nwfilter/nwfilter_learnipaddr.c, nwfilter/nwfilter_learnipaddr.c, util/virnetdevvportprofile.c: Update for API renames and error handling changes
-
- 15 11月, 2011 1 次提交
-
-
由 Daniel P. Berrange 提交于
The ifaceUp, ifaceDown, ifaceCtrl & ifaceIsUp APIs can be replaced with calls to virNetDevSetOnline and virNetDevIsOnline * src/util/interface.c, src/util/interface.h: Delete ifaceUp, ifaceDown, ifaceCtrl & ifaceIsUp * src/nwfilter/nwfilter_gentech_driver.c, src/util/macvtap.c: Update to use virNetDevSetOnline and virNetDevIsOnline
-
- 10 11月, 2011 3 次提交
-
-
由 Eric Blake 提交于
It's not worth even worrying about a temporary file, unless we ever expect the script to exceed maximum command-line argument length limits. * src/nwfilter/nwfilter_ebiptables_driver.c (ebiptablesExecCLI): Run the commands as an argument to /bin/sh, rather than worrying about a temporary file. (ebiptablesWriteToTempFile): Delete unused function.
-
由 Eric Blake 提交于
If /tmp is mounted with the noexec flag (common on security-conscious systems), then nwfilter will fail to initialize, because we cannot run any temporary script via virRun("/tmp/script"); but we _can_ use "/bin/sh /tmp/script". For that matter, using /tmp risks collisions with other unrelated programs; we already have /var/run/libvirt as a dedicated temporary directory for use by libvirt. * src/nwfilter/nwfilter_ebiptables_driver.c (ebiptablesWriteToTempFile): Use internal directory, not /tmp; drop attempts to make script executable; and detect close error. (ebiptablesExecCLI): Switch to virCommand, and invoke the shell to read the script, rather than requiring an executable script.
-
由 Daniel P. Berrange 提交于
The socket address APIs in src/util/network.h either take the form virSocketAddrXXX, virSocketXXX or virSocketXXXAddr. Sanitize this so everything is virSocketAddrXXXX, and ensure that the virSocketAddr parameter is always the first one. * src/util/network.c, src/util/network.h: Santize socket address API naming * src/conf/domain_conf.c, src/conf/network_conf.c, src/conf/nwfilter_conf.c, src/network/bridge_driver.c, src/nwfilter/nwfilter_ebiptables_driver.c, src/nwfilter/nwfilter_learnipaddr.c, src/qemu/qemu_command.c, src/rpc/virnetsocket.c, src/util/dnsmasq.c, src/util/iptables.c, src/util/virnetdev.c, src/vbox/vbox_tmpl.c: Update for API renaming
-
- 11 8月, 2011 1 次提交
-
-
由 Stefan Berger 提交于
When instantiating a filter, a VM may disappear and remove its tap interfaces. Tolerate this case and don't report an error.
-
- 22 7月, 2011 2 次提交
-
-
由 Laine Stump 提交于
All of the functions in util/interface.c were returning 0 on success, but some returned -1 on error, and some returned a positive value (usually the value of errno, but sometimes just 1). Libvirt's standard is to return < 0 on error (in the case of functions that need to return errno, -errno is returned. This patch modifies all functions in interface.c to consistently return < 0 on error, and makes changes to callers of those functions where necessary.
-
由 Eric Blake 提交于
In preparation for a future patch adding new virFile APIs. * src/util/files.h, src/util/files.c: Move... * src/util/virfile.h, src/util/virfile.c: ...here, and rename functions to virFile prefix. Macro names are intentionally left alone. * *.c: All '#include "files.h"' uses changed. * src/Makefile.am (UTIL_SOURCES): Reflect rename. * cfg.mk (exclude_file_name_regexp--sc_prohibit_close): Likewise. * src/libvirt_private.syms: Likewise. * docs/hacking.html.in: Likewise. * HACKING: Regenerate.
-
- 13 7月, 2011 1 次提交
-
-
由 Eric Blake 提交于
Silently ignored flags get in the way of new features that use those flags. Also, an upcoming syntax check will favor unsigned flags. * src/nodeinfo.h (nodeGetCPUStats, nodeGetMemoryStats): Drop unused attribute. * src/interface/netcf_driver.c (interfaceOpenInterface) (interfaceDefineXML, interfaceCreate, interfaceDestroy): Reject unknown flags. * src/network/bridge_driver.c (networkOpenNetwork) (networkGetXMLDesc): Likewise. * src/nwfilter/nwfilter_driver.c (nwfilterOpen): Likewise. * src/secret/secret_driver.c (secretOpen, secretDefineXML) (secretGetXMLDesc, secretSetValue): Likewise. * src/util/logging.c (virLogDefineFilter, virLogDefineOutput) (virLogMessage): Likewise; also use unsigned flags. * src/util/logging.h (virLogDefineFilter, virLogDefineOutput) (virLogMessage): Change signature. * src/util/command.c (virExecWithHook): Likewise.
-
- 08 7月, 2011 1 次提交
-
-
由 Eric Blake 提交于
Now that the public APIs always use unsigned flags, the internal driver callbacks might as well do likewise. * src/driver.h (vrDrvOpen, virDrvDomainCoreDump) (virDrvDomainGetXMLDesc, virDrvNetworkGetXMLDesc) (virDrvNWFilterGetXMLDesc): Update type. * src/remote/remote_protocol.x (remote_open_args) (remote_domain_core_dump_args, remote_domain_get_xml_desc_args) (remote_network_get_xml_desc_args) (remote_nwfilter_get_xml_desc_args): Likewise. * src/test/test_driver.c: Update clients. * src/remote/remote_driver.c: Likewise. * src/xen/xen_hypervisor.c: Likewise. * src/xen/xen_hypervisor.h: Likewise. * src/xen/xen_driver.c: Likewise. * src/xen/xend_internal.c: Likewise. * src/xen/xend_internal.h: Likewise. * src/xen/xm_internal.c: Likewise. * src/xen/xm_internal.h: Likewise. * src/xen/xs_internal.c: Likewise. * src/xen/xs_internal.h: Likewise. * src/xen/xen_inotify.c: Likewise. * src/xen/xen_inotify.h: Likewise. * src/phyp/phyp_driver.c: Likewise. * src/openvz/openvz_driver.c: Likewise. * src/vmware/vmware_driver.c: Likewise. * src/vbox/vbox_driver.c: Likewise. * src/vbox/vbox_tmpl.c: Likewise. * src/xenapi/xenapi_driver.c: Likewise. * src/esx/esx_driver.c: Likewise. * src/esx/esx_interface_driver.c: Likewise. * src/esx/esx_network_driver.c: Likewise. * src/esx/esx_storage_driver.c: Likewise. * src/esx/esx_device_monitor.c: Likewise. * src/esx/esx_secret_driver.c: Likewise. * src/esx/esx_nwfilter_driver.c: Likewise. * src/interface/netcf_driver.c: Likewise. * src/nwfilter/nwfilter_driver.c: Likewise. * src/libxl/libxl_driver.c: Likewise. * src/qemu/qemu_driver.c: Likewise. * src/lxc/lxc_driver.c: Likewise. * src/uml/uml_driver.c: Likewise. * src/network/bridge_driver.c: Likewise. * src/secret/secret_driver.c: Likewise. * src/storage/storage_driver.c: Likewise. * src/node_device/node_device_hal.c: Likewise. * src/node_device/node_device_udev.c: Likewise. * src/remote_protocol-structs: Likewise.
-
- 28 6月, 2011 1 次提交
-
-
由 Stefan Berger 提交于
This is in response to bugzilla 664629 https://bugzilla.redhat.com/show_bug.cgi?id=664629 The patch below returns an appropriate error message if the chain of nwfilters is found to contain unresolvable variables and therefore cannot be instantiated. Example: The following XMl added to a domain: <interface type='bridge'> <mac address='52:54:00:9f:80:45'/> <source bridge='virbr0'/> <model type='virtio'/> <filterref filter='test'/> </interface> that references the following filter <filter name='test' chain='root'> <filterref filter='clean-traffic'/> <filterref filter='allow-dhcp-server'/> </filter> now displays upon 'virsh start mydomain' error: Failed to start domain mydomain error: internal error Cannot instantiate filter due to unresolvable variable: DHCPSERVER 'DHPCSERVER' is contained in allow-dhcp-server.
-
- 25 6月, 2011 1 次提交
-
-
由 Eric Blake 提交于
Done as a separate commit to make backporting the next patch easier. We are already using "intprops.h", but this makes it explicit. * .gnulib: Update, for syntax-check fix. * bootstrap.conf (gnulib_modules): Make intprops use explicit. * src/locking/domain_lock.c (includes): Drop unused header. * src/nwfilter/nwfilter_learnipaddr.c (includes): Use "", not <>, for gnulib.
-
- 08 6月, 2011 1 次提交
-
-
由 Cole Robinson 提交于
Seems reasonable to have all command wrappers in the same place v2: Dont move SetInherit v3: Comment spelling fix Adjust WARN0 comment Remove spurious #include movement Don't include sys/types.h Combine virExec enums Signed-off-by: NCole Robinson <crobinso@redhat.com>
-
- 28 5月, 2011 1 次提交
-
-
由 Stefan Berger 提交于
This patch reorders the locks for the nwfilter updates and the access the nwfilter objects. In the case that the IP address learning thread was instantiating filters while an update happened, the previous order lead to a deadlock.
-
- 26 5月, 2011 1 次提交
-
-
由 Matthias Bolte 提交于
In most cases this affects flags parameters that are unsigned in the public and driver API but signed in the XDR protocol. Switch the XDR protocol to unsigned for those. A counterexample is virNWFilterGetXMLDesc. Its flags parameter is signed in the public API and XDR protocol, but unsigned in the driver API.
-
- 24 5月, 2011 1 次提交
-
-
由 Stefan Berger 提交于
This patch enables filtering of gratuitous ARP packets using the following XML: <rule action='accept' direction='in' priority='425'> <arp gratuitous='true'/> </rule>
-
- 16 5月, 2011 1 次提交
-
-
由 Daniel P. Berrange 提交于
Add many version number annotations to the internal driver tables, to allow hvsupport.html to display more accurate information
-
- 12 5月, 2011 2 次提交
-
-
由 Eric Blake 提交于
The public API and RPC over-the-wire format have no flags argument, so neither should the internal callback API. This simplifies the RPC generator. * src/driver.h (virDrvNWFilterDefineXML): Drop argument that does not match public API. * src/nwfilter/nwfilter_driver.c (nwfilterDefine): Likewise. * src/libvirt.c (virNWFilterDefineXML): Likewise. * daemon/remote_generator.pl: Drop special case.
-
由 Lai Jiangshan 提交于
These VIR_XXXX0 APIs make us confused, use the non-0-suffix APIs instead. How do these coversions works? The magic is using the gcc extension of ##. When __VA_ARGS__ is empty, "##" will swallow the "," in "fmt," to avoid compile error. example: origin after CPP high_level_api("%d", a_int) low_level_api("%d", a_int) high_level_api("a string") low_level_api("a string") About 400 conversions. 8 special conversions: VIR_XXXX0("") -> VIR_XXXX("msg") (avoid empty format) 2 conversions VIR_XXXX0(string_literal_with_%) -> VIR_XXXX(%->%%) 0 conversions VIR_XXXX0(non_string_literal) -> VIR_XXXX("%s", non_string_literal) (for security) 6 conversions Signed-off-by: NLai Jiangshan <laijs@cn.fujitsu.com>
-
- 11 5月, 2011 1 次提交
-
-
由 Matthias Bolte 提交于
This matches the public API and helps to get rid of some special case code in the remote generator. Rename driver API functions and XDR protocol structs. No functional change included outside of the remote generator.
-
- 07 5月, 2011 1 次提交
-
-
由 Eric Blake 提交于
HACKING already mentions that comparisons against literal 'true' are unsafe; for consistency, also shorten comparisons against 'false'. * src/conf/domain_conf.c (virDomainNetDefParseXML): Simplify. * src/nwfilter/nwfilter_gentech_driver.c (virNWFilterDomainFWUpdateCB): Likewise. * tools/virsh.c (cmdVolDownload, vshCommandRun, vshPrintExtra): Likewise.
-
- 06 5月, 2011 1 次提交
-
-
由 Eric Blake 提交于
We already have virAsprintf, so picking a similar name helps for seeing a similar purpose. Furthermore, the prefix V before printf generally implies 'va_list', even though this variant was '...', and the old name got in the way of adding a new va_list version. global rename performed with: $ git grep -l virBufferVSprintf \ | xargs -L1 sed -i 's/virBufferVSprintf/virBufferAsprintf/g' then revert the changes in ChangeLog-old.
-
- 30 4月, 2011 1 次提交
-
-
由 Matthias Bolte 提交于
Call shutdown functions for all subcomponents in nwfilterDriverShutdown. Make sure that this shutdown functions can safely be called multiple times and independent from the actual subcomponents state.
-
- 20 4月, 2011 1 次提交
-
-
由 Stefan Berger 提交于
Ebtables filtering doesn't work on macvtap device. Remove support for direct type of interface.
-
- 15 4月, 2011 1 次提交
-
-
由 Christophe Fergeau 提交于
gcc 4.6 warns when a variable is initialized but isn't used afterwards: vmware/vmware_driver.c:449:18: warning: variable 'vmxPath' set but not used [-Wunused-but-set-variable] This patch fixes these warnings. There are still 2 offending files: - vbox_tmpl.c: the variable is used inside an #ifdef and is assigned several times outside of #ifdef. Fixing the warning would have required wrapping all the assignment inside #ifdef which hurts readability. vbox/vbox_tmpl.c: In function 'vboxAttachDrives': vbox/vbox_tmpl.c:3918:22: warning: variable 'accessMode' set but not used [-Wunused-but-set-variable] - esx_vi_types.generated.c: the name implies it's generated code and I didn't want to dive into the code generator esx/esx_vi_types.generated.c: In function 'esxVI_FileQueryFlags_Free': esx/esx_vi_types.generated.c:1203:3: warning: variable 'item' set but not used [-Wunused-but-set-variable]
-
- 08 4月, 2011 1 次提交
-
-
由 Stefan Berger 提交于
This patch adds support for the evaluation of TCP flags in nwfilters. It adds documentation to the web page and extends the tests as well. Also, the nwfilter schema is extended. The following are some example for rules using the tcp flags: <rule action='accept' direction='in'> <tcp state='NONE' flags='SYN/ALL' dsptportstart='80'/> </rule> <rule action='drop' direction='in'> <tcp state='NONE' flags='SYN/ALL'/> </rule>
-
- 25 3月, 2011 1 次提交
-
-
由 Eric Blake 提交于
Child processes don't always reach _exit(); if they die from a signal, then any messages should still be accurate. Most users either expect a 0 status (thankfully, if status==0, then WIFEXITED(status) is true and WEXITSTATUS(status)==0 for all known platforms) or were filtering on WIFEXITED before printing a status, but a few were missing this check. Additionally, nwfilter_ebiptables_driver was making an assumption that works on Linux (where WEXITSTATUS shifts and WTERMSIG just masks) but fails on other platforms (where WEXITSTATUS just masks and WTERMSIG shifts). * src/util/command.h (virCommandTranslateStatus): New helper. * src/libvirt_private.syms (command.h): Export it. * src/util/command.c (virCommandTranslateStatus): New function. (virCommandWait): Use it to also diagnose status from signals. * src/security/security_apparmor.c (load_profile): Likewise. * src/storage/storage_backend.c (virStorageBackendQEMUImgBackingFormat): Likewise. * src/util/util.c (virExecDaemonize, virRunWithHook) (virFileOperation, virDirCreate): Likewise. * daemon/remote.c (remoteDispatchAuthPolkit): Likewise. * src/nwfilter/nwfilter_ebiptables_driver.c (ebiptablesExecCLI): Likewise.
-
- 05 3月, 2011 1 次提交
-
-
由 Phil Petty 提交于
Signed-off-by: NEric Blake <eblake@redhat.com>
-
- 25 2月, 2011 1 次提交
-
-
由 Daniel P. Berrange 提交于
Relax the restriction that the hash table key must be a string by allowing an arbitrary hash code generator + comparison func to be provided * util/hash.c, util/hash.h: Allow any pointer as a key * internal.h: Include stdbool.h as standard. * conf/domain_conf.c, conf/domain_conf.c, conf/nwfilter_params.c, nwfilter/nwfilter_gentech_driver.c, nwfilter/nwfilter_gentech_driver.h, nwfilter/nwfilter_learnipaddr.c, qemu/qemu_command.c, qemu/qemu_driver.c, qemu/qemu_process.c, uml/uml_driver.c, xen/xm_internal.c: s/char */void */ in hash callbacks
-