openkylin
/
libvirt
mirror of https://gitee.com/openkylin/libvirt.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Convert nwfilter ebiptablesTearNewRules to virFirewall 

Convert the nwfilter ebiptablesTearNewRules method to use the
virFirewall object APIs instead of creating shell scripts
using virBuffer APIs. This provides a performance improvement
through allowing direct use of firewalld dbus APIs and will
facilitate automated testing.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2014-03-14 12:48:33 +00:00
parent d7b83ab7c3
commit 138ef25e99
2 changed files with 129 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
src/nwfilter/nwfilter_ebiptables_driver.c
View File

@ -722,6 +722,18 @@ iptablesRemoveTmpRootChain(virBufferPtr buf,
}
static void
iptablesRemoveTmpRootChainFW(virFirewallPtr fw,
virFirewallLayer layer,
char prefix,
bool incoming,
const char *ifname)
{
_iptablesRemoveRootChainFW(fw, layer, prefix,
incoming, ifname, 1);
}
static void
iptablesRemoveTmpRootChains(virBufferPtr buf,
const char *ifname)
@ -732,6 +744,17 @@ iptablesRemoveTmpRootChains(virBufferPtr buf,
}
static void
iptablesRemoveTmpRootChainsFW(virFirewallPtr fw,
virFirewallLayer layer,
const char *ifname)
{
iptablesRemoveTmpRootChainFW(fw, layer, 'F', false, ifname);
iptablesRemoveTmpRootChainFW(fw, layer, 'F', true, ifname);
iptablesRemoveTmpRootChainFW(fw, layer, 'H', true, ifname);
}
static void
iptablesRemoveRootChainsFW(virFirewallPtr fw,
virFirewallLayer layer,
@ -933,6 +956,18 @@ iptablesUnlinkTmpRootChain(virBufferPtr buf,
}
static void
iptablesUnlinkTmpRootChainFW(virFirewallPtr fw,
virFirewallLayer layer,
const char *basechain,
char prefix,
bool incoming, const char *ifname)
{
_iptablesUnlinkRootChainFW(fw, layer,
basechain, prefix, incoming, ifname, 1);
}
static void
iptablesUnlinkRootChainsFW(virFirewallPtr fw,
virFirewallLayer layer,
@ -954,6 +989,17 @@ iptablesUnlinkTmpRootChains(virBufferPtr buf,
}
static void
iptablesUnlinkTmpRootChainsFW(virFirewallPtr fw,
virFirewallLayer layer,
const char *ifname)
{
iptablesUnlinkTmpRootChainFW(fw, layer, VIRT_OUT_CHAIN, 'F', false, ifname);
iptablesUnlinkTmpRootChainFW(fw, layer, VIRT_IN_CHAIN, 'F', true, ifname);
iptablesUnlinkTmpRootChainFW(fw, layer, HOST_IN_CHAIN, 'H', true, ifname);
}
static void
iptablesRenameTmpRootChainFW(virFirewallPtr fw,
virFirewallLayer layer,
@ -4251,36 +4297,28 @@ ebiptablesApplyNewRules(const char *ifname,
static int
ebiptablesTearNewRules(const char *ifname)
{
virBuffer buf = VIR_BUFFER_INITIALIZER;
virFirewallPtr fw = virFirewallNew();
int ret = -1;
if (iptables_cmd_path) {
NWFILTER_SET_IPTABLES_SHELLVAR(&buf);
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
iptablesUnlinkTmpRootChains(&buf, ifname);
iptablesRemoveTmpRootChains(&buf, ifname);
}
iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
if (ip6tables_cmd_path) {
NWFILTER_SET_IP6TABLES_SHELLVAR(&buf);
iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV6, ifname);
iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV6, ifname);
iptablesUnlinkTmpRootChains(&buf, ifname);
iptablesRemoveTmpRootChains(&buf, ifname);
}
ebtablesUnlinkTmpRootChainFW(fw, true, ifname);
ebtablesUnlinkTmpRootChainFW(fw, false, ifname);
ebtablesRemoveTmpSubChainsFW(fw, ifname);
ebtablesRemoveTmpRootChainFW(fw, true, ifname);
ebtablesRemoveTmpRootChainFW(fw, false, ifname);
if (ebtables_cmd_path) {
NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
ebtablesUnlinkTmpRootChain(&buf, true, ifname);
ebtablesUnlinkTmpRootChain(&buf, false, ifname);
ebtablesRemoveTmpSubChains(&buf, ifname);
ebtablesRemoveTmpRootChain(&buf, true, ifname);
ebtablesRemoveTmpRootChain(&buf, false, ifname);
}
ebiptablesExecCLI(&buf, true, NULL);
return 0;
virMutexLock(&execCLIMutex);
ret = virFirewallApply(fw);
virMutexUnlock(&execCLIMutex);
virFirewallFree(fw);
return ret;
}

66
tests/nwfilterebiptablestest.c
View File

@ -216,6 +216,67 @@ testNWFilterEBIPTablesRemoveBasicRules(const void *opaque ATTRIBUTE_UNUSED)
}
static int
testNWFilterEBIPTablesTearNewRules(const void *opaque ATTRIBUTE_UNUSED)
{
virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected =
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
"iptables -F FP-vnet0\n"
"iptables -X FP-vnet0\n"
"iptables -F FJ-vnet0\n"
"iptables -X FJ-vnet0\n"
"iptables -F HJ-vnet0\n"
"iptables -X HJ-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
"ip6tables -F FP-vnet0\n"
"ip6tables -X FP-vnet0\n"
"ip6tables -F FJ-vnet0\n"
"ip6tables -X FJ-vnet0\n"
"ip6tables -F HJ-vnet0\n"
"ip6tables -X HJ-vnet0\n"
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
"ebtables -t nat -L libvirt-J-vnet0\n"
"ebtables -t nat -L libvirt-P-vnet0\n"
"ebtables -t nat -F libvirt-J-vnet0\n"
"ebtables -t nat -X libvirt-J-vnet0\n"
"ebtables -t nat -F libvirt-P-vnet0\n"
"ebtables -t nat -X libvirt-P-vnet0\n";
char *actual = NULL;
int ret = -1;
virCommandSetDryRun(&buf, NULL, NULL);
if (ebiptables_driver.tearNewRules("vnet0") < 0)
goto cleanup;
if (virBufferError(&buf))
goto cleanup;
actual = virBufferContentAndReset(&buf);
virtTestClearCommandPath(actual);
if (STRNEQ_NULLABLE(actual, expected)) {
virtTestDifference(stderr, actual, expected);
goto cleanup;
}
ret = 0;
cleanup:
virCommandSetDryRun(NULL, NULL, NULL);
virBufferFreeAndReset(&buf);
VIR_FREE(actual);
return ret;
}
static int
mymain(void)
{
@ -241,6 +302,11 @@ mymain(void)
NULL) < 0)
ret = -1;
if (virtTestRun("ebiptablesTearNewRules",
testNWFilterEBIPTablesTearNewRules,
NULL) < 0)
ret = -1;
cleanup:
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
}