NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

Replace virNetworkObjPtr with virNetworkDefPtr in network platform APIs

Browse Source 
The networkCheckRouteCollision, networkAddFirewallRules and
networkRemoveFirewallRules APIs all take a virNetworkObjPtr
instance, but only ever access the 'def' member. It thus
simplifies testing if the APIs are changed to just take a
virNetworkDefPtr instead

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2014-03-19 16:56:35 +00:00
parent a66fc27d89
commit c13a952f69
4 changed files with 128 additions and 128 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/network/bridge_driver.c
View File

@ -1650,8 +1650,8 @@ networkReloadFirewallRules(virNetworkDriverStatePtr driver)
/* Only the three L3 network types that are configured by libvirt /* Only the three L3 network types that are configured by libvirt
* need to have iptables rules reloaded. * need to have iptables rules reloaded.
*/ */
networkRemoveFirewallRules(network); networkRemoveFirewallRules(network->def);
if (networkAddFirewallRules(network) < 0) { if (networkAddFirewallRules(network->def) < 0) {
/* failed to add but already logged */ /* failed to add but already logged */
} }
} }
@ -1833,7 +1833,7 @@ networkStartNetworkVirtual(virNetworkDriverStatePtr driver,
int tapfd = -1; int tapfd = -1;
/* Check to see if any network IP collides with an existing route */ /* Check to see if any network IP collides with an existing route */
if (networkCheckRouteCollision(network) < 0) if (networkCheckRouteCollision(network->def) < 0)
return -1; return -1;
/* Create and configure the bridge device */ /* Create and configure the bridge device */
@ -1882,7 +1882,7 @@ networkStartNetworkVirtual(virNetworkDriverStatePtr driver,
goto err1; goto err1;
/* Add "once per network" rules */ /* Add "once per network" rules */
if (networkAddFirewallRules(network) < 0) if (networkAddFirewallRules(network->def) < 0)
goto err1; goto err1;
for (i = 0; for (i = 0;
@ -1975,7 +1975,7 @@ networkStartNetworkVirtual(virNetworkDriverStatePtr driver,
err2: err2:
if (!save_err) if (!save_err)
save_err = virSaveLastError(); save_err = virSaveLastError();
networkRemoveFirewallRules(network); networkRemoveFirewallRules(network->def);
err1: err1:
if (!save_err) if (!save_err)
@ -2029,7 +2029,7 @@ static int networkShutdownNetworkVirtual(virNetworkDriverStatePtr driver ATTRIBU
ignore_value(virNetDevSetOnline(network->def->bridge, 0)); ignore_value(virNetDevSetOnline(network->def->bridge, 0));
networkRemoveFirewallRules(network); networkRemoveFirewallRules(network->def);
ignore_value(virNetDevBridgeDelete(network->def->bridge)); ignore_value(virNetDevBridgeDelete(network->def->bridge));
@ -2897,7 +2897,7 @@ networkUpdate(virNetworkPtr net,
* old rules (and remember to load new ones after the * old rules (and remember to load new ones after the
* update). * update).
*/ */
networkRemoveFirewallRules(network); networkRemoveFirewallRules(network->def);
needFirewallRefresh = true; needFirewallRefresh = true;
break; break;
default: default:
@ -2909,11 +2909,11 @@ networkUpdate(virNetworkPtr net,
/* update the network config in memory/on disk */ /* update the network config in memory/on disk */
if (virNetworkObjUpdate(network, command, section, parentIndex, xml, flags) < 0) { if (virNetworkObjUpdate(network, command, section, parentIndex, xml, flags) < 0) {
if (needFirewallRefresh) if (needFirewallRefresh)
ignore_value(networkAddFirewallRules(network)); ignore_value(networkAddFirewallRules(network->def));
goto cleanup; goto cleanup;
} }
if (needFirewallRefresh && networkAddFirewallRules(network) < 0) if (needFirewallRefresh && networkAddFirewallRules(network->def) < 0)
goto cleanup; goto cleanup;
if (flags & VIR_NETWORK_UPDATE_AFFECT_CONFIG) { if (flags & VIR_NETWORK_UPDATE_AFFECT_CONFIG) {

226
src/network/bridge_driver_linux.c
View File

@ -40,7 +40,7 @@ VIR_LOG_INIT("network.bridge_driver_linux");
* other scenarios where we can ruin host network connectivity. * other scenarios where we can ruin host network connectivity.
* XXX: Using a proper library is preferred over parsing /proc * XXX: Using a proper library is preferred over parsing /proc
*/ */
int networkCheckRouteCollision(virNetworkObjPtr network) int networkCheckRouteCollision(virNetworkDefPtr def)
{ {
int ret = 0, len; int ret = 0, len;
char *cur, *buf = NULL; char *cur, *buf = NULL;
@ -100,7 +100,7 @@ int networkCheckRouteCollision(virNetworkObjPtr network)
addr_val &= mask_val; addr_val &= mask_val;
for (i = 0; for (i = 0;
(ipdef = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); (ipdef = virNetworkDefGetIpByIndex(def, AF_INET, i));
i++) { i++) {
unsigned int net_dest; unsigned int net_dest;
@ -108,7 +108,7 @@ int networkCheckRouteCollision(virNetworkObjPtr network)
if (virNetworkIpDefNetmask(ipdef, &netmask) < 0) { if (virNetworkIpDefNetmask(ipdef, &netmask) < 0) {
VIR_WARN("Failed to get netmask of '%s'", VIR_WARN("Failed to get netmask of '%s'",
network->def->bridge); def->bridge);
continue; continue;
} }
@ -136,16 +136,16 @@ static const char networkLocalBroadcast[] = "255.255.255.255/32";
static int static int
networkAddMasqueradingFirewallRules(virFirewallPtr fw, networkAddMasqueradingFirewallRules(virFirewallPtr fw,
virNetworkObjPtr network, virNetworkDefPtr def,
virNetworkIpDefPtr ipdef) virNetworkIpDefPtr ipdef)
{ {
int prefix = virNetworkIpDefPrefix(ipdef); int prefix = virNetworkIpDefPrefix(ipdef);
const char *forwardIf = virNetworkDefForwardIf(network->def, 0); const char *forwardIf = virNetworkDefForwardIf(def, 0);
if (prefix < 0) { if (prefix < 0) {
virReportError(VIR_ERR_INTERNAL_ERROR, virReportError(VIR_ERR_INTERNAL_ERROR,
_("Invalid prefix or netmask for '%s'"), _("Invalid prefix or netmask for '%s'"),
network->def->bridge); def->bridge);
return -1; return -1;
} }
@ -153,7 +153,7 @@ networkAddMasqueradingFirewallRules(virFirewallPtr fw,
if (iptablesAddForwardAllowOut(fw, if (iptablesAddForwardAllowOut(fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
network->def->bridge, def->bridge,
forwardIf) < 0) forwardIf) < 0)
return -1; return -1;
@ -163,7 +163,7 @@ networkAddMasqueradingFirewallRules(virFirewallPtr fw,
if (iptablesAddForwardAllowRelatedIn(fw, if (iptablesAddForwardAllowRelatedIn(fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
network->def->bridge, def->bridge,
forwardIf) < 0) forwardIf) < 0)
return -1; return -1;
@ -204,8 +204,8 @@ networkAddMasqueradingFirewallRules(virFirewallPtr fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
forwardIf, forwardIf,
&network->def->forward.addr, &def->forward.addr,
&network->def->forward.port, &def->forward.port,
NULL) < 0) NULL) < 0)
return -1; return -1;
@ -214,8 +214,8 @@ networkAddMasqueradingFirewallRules(virFirewallPtr fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
forwardIf, forwardIf,
&network->def->forward.addr, &def->forward.addr,
&network->def->forward.port, &def->forward.port,
"udp") < 0) "udp") < 0)
return -1; return -1;
@ -224,8 +224,8 @@ networkAddMasqueradingFirewallRules(virFirewallPtr fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
forwardIf, forwardIf,
&network->def->forward.addr, &def->forward.addr,
&network->def->forward.port, &def->forward.port,
"tcp") < 0) "tcp") < 0)
return -1; return -1;
@ -250,11 +250,11 @@ networkAddMasqueradingFirewallRules(virFirewallPtr fw,
static int static int
networkRemoveMasqueradingFirewallRules(virFirewallPtr fw, networkRemoveMasqueradingFirewallRules(virFirewallPtr fw,
virNetworkObjPtr network, virNetworkDefPtr def,
virNetworkIpDefPtr ipdef) virNetworkIpDefPtr ipdef)
{ {
int prefix = virNetworkIpDefPrefix(ipdef); int prefix = virNetworkIpDefPrefix(ipdef);
const char *forwardIf = virNetworkDefForwardIf(network->def, 0); const char *forwardIf = virNetworkDefForwardIf(def, 0);
if (prefix < 0) if (prefix < 0)
return 0; return 0;
@ -277,8 +277,8 @@ networkRemoveMasqueradingFirewallRules(virFirewallPtr fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
forwardIf, forwardIf,
&network->def->forward.addr, &def->forward.addr,
&network->def->forward.port, &def->forward.port,
"tcp") < 0) "tcp") < 0)
return -1; return -1;
@ -286,8 +286,8 @@ networkRemoveMasqueradingFirewallRules(virFirewallPtr fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
forwardIf, forwardIf,
&network->def->forward.addr, &def->forward.addr,
&network->def->forward.port, &def->forward.port,
"udp") < 0) "udp") < 0)
return -1; return -1;
@ -295,22 +295,22 @@ networkRemoveMasqueradingFirewallRules(virFirewallPtr fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
forwardIf, forwardIf,
&network->def->forward.addr, &def->forward.addr,
&network->def->forward.port, &def->forward.port,
NULL) < 0) NULL) < 0)
return -1; return -1;
if (iptablesRemoveForwardAllowRelatedIn(fw, if (iptablesRemoveForwardAllowRelatedIn(fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
network->def->bridge, def->bridge,
forwardIf) < 0) forwardIf) < 0)
return -1; return -1;
if (iptablesRemoveForwardAllowOut(fw, if (iptablesRemoveForwardAllowOut(fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
network->def->bridge, def->bridge,
forwardIf) < 0) forwardIf) < 0)
return -1; return -1;
@ -320,16 +320,16 @@ networkRemoveMasqueradingFirewallRules(virFirewallPtr fw,
static int static int
networkAddRoutingFirewallRules(virFirewallPtr fw, networkAddRoutingFirewallRules(virFirewallPtr fw,
virNetworkObjPtr network, virNetworkDefPtr def,
virNetworkIpDefPtr ipdef) virNetworkIpDefPtr ipdef)
{ {
int prefix = virNetworkIpDefPrefix(ipdef); int prefix = virNetworkIpDefPrefix(ipdef);
const char *forwardIf = virNetworkDefForwardIf(network->def, 0); const char *forwardIf = virNetworkDefForwardIf(def, 0);
if (prefix < 0) { if (prefix < 0) {
virReportError(VIR_ERR_INTERNAL_ERROR, virReportError(VIR_ERR_INTERNAL_ERROR,
_("Invalid prefix or netmask for '%s'"), _("Invalid prefix or netmask for '%s'"),
network->def->bridge); def->bridge);
return -1; return -1;
} }
@ -337,7 +337,7 @@ networkAddRoutingFirewallRules(virFirewallPtr fw,
if (iptablesAddForwardAllowOut(fw, if (iptablesAddForwardAllowOut(fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
network->def->bridge, def->bridge,
forwardIf) < 0) forwardIf) < 0)
return -1; return -1;
@ -345,7 +345,7 @@ networkAddRoutingFirewallRules(virFirewallPtr fw,
if (iptablesAddForwardAllowIn(fw, if (iptablesAddForwardAllowIn(fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
network->def->bridge, def->bridge,
forwardIf) < 0) forwardIf) < 0)
return -1; return -1;
@ -355,11 +355,11 @@ networkAddRoutingFirewallRules(virFirewallPtr fw,
static int static int
networkRemoveRoutingFirewallRules(virFirewallPtr fw, networkRemoveRoutingFirewallRules(virFirewallPtr fw,
virNetworkObjPtr network, virNetworkDefPtr def,
virNetworkIpDefPtr ipdef) virNetworkIpDefPtr ipdef)
{ {
int prefix = virNetworkIpDefPrefix(ipdef); int prefix = virNetworkIpDefPrefix(ipdef);
const char *forwardIf = virNetworkDefForwardIf(network->def, 0); const char *forwardIf = virNetworkDefForwardIf(def, 0);
if (prefix < 0) if (prefix < 0)
return 0; return 0;
@ -367,14 +367,14 @@ networkRemoveRoutingFirewallRules(virFirewallPtr fw,
if (iptablesRemoveForwardAllowIn(fw, if (iptablesRemoveForwardAllowIn(fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
network->def->bridge, def->bridge,
forwardIf) < 0) forwardIf) < 0)
return -1; return -1;
if (iptablesRemoveForwardAllowOut(fw, if (iptablesRemoveForwardAllowOut(fw,
&ipdef->address, &ipdef->address,
prefix, prefix,
network->def->bridge, def->bridge,
forwardIf) < 0) forwardIf) < 0)
return -1; return -1;
@ -384,7 +384,7 @@ networkRemoveRoutingFirewallRules(virFirewallPtr fw,
static void static void
networkAddGeneralIPv4FirewallRules(virFirewallPtr fw, networkAddGeneralIPv4FirewallRules(virFirewallPtr fw,
virNetworkObjPtr network) virNetworkDefPtr def)
{ {
size_t i; size_t i;
virNetworkIpDefPtr ipv4def; virNetworkIpDefPtr ipv4def;
@ -392,60 +392,60 @@ networkAddGeneralIPv4FirewallRules(virFirewallPtr fw,
/* First look for first IPv4 address that has dhcp or tftpboot defined. */ /* First look for first IPv4 address that has dhcp or tftpboot defined. */
/* We support dhcp config on 1 IPv4 interface only. */ /* We support dhcp config on 1 IPv4 interface only. */
for (i = 0; for (i = 0;
(ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); (ipv4def = virNetworkDefGetIpByIndex(def, AF_INET, i));
i++) { i++) {
if (ipv4def->nranges || ipv4def->nhosts || ipv4def->tftproot) if (ipv4def->nranges || ipv4def->nhosts || ipv4def->tftproot)
break; break;
} }
/* allow DHCP requests through to dnsmasq */ /* allow DHCP requests through to dnsmasq */
iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 67); iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67);
iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 67); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67);
iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 68); iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 68);
/* allow DNS requests through to dnsmasq */ /* allow DNS requests through to dnsmasq */
iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 53); iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53);
iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 53); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53);
/* allow TFTP requests through to dnsmasq if necessary */ /* allow TFTP requests through to dnsmasq if necessary */
if (ipv4def && ipv4def->tftproot) if (ipv4def && ipv4def->tftproot)
iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 69); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 69);
/* Catch all rules to block forwarding to/from bridges */ /* Catch all rules to block forwarding to/from bridges */
iptablesAddForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge); iptablesAddForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge);
iptablesAddForwardRejectIn(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge); iptablesAddForwardRejectIn(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge);
/* Allow traffic between guests on the same bridge */ /* Allow traffic between guests on the same bridge */
iptablesAddForwardAllowCross(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge); iptablesAddForwardAllowCross(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge);
} }
static void static void
networkRemoveGeneralIPv4FirewallRules(virFirewallPtr fw, networkRemoveGeneralIPv4FirewallRules(virFirewallPtr fw,
virNetworkObjPtr network) virNetworkDefPtr def)
{ {
size_t i; size_t i;
virNetworkIpDefPtr ipv4def; virNetworkIpDefPtr ipv4def;
for (i = 0; for (i = 0;
(ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); (ipv4def = virNetworkDefGetIpByIndex(def, AF_INET, i));
i++) { i++) {
if (ipv4def->nranges || ipv4def->nhosts || ipv4def->tftproot) if (ipv4def->nranges || ipv4def->nhosts || ipv4def->tftproot)
break; break;
} }
iptablesRemoveForwardAllowCross(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge); iptablesRemoveForwardAllowCross(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge);
iptablesRemoveForwardRejectIn(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge); iptablesRemoveForwardRejectIn(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge);
iptablesRemoveForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge); iptablesRemoveForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge);
if (ipv4def && ipv4def->tftproot) if (ipv4def && ipv4def->tftproot)
iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 69); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 69);
iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 53); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53);
iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 53); iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53);
iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 68); iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 68);
iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 67); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67);
iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, network->def->bridge, 67); iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67);
} }
@ -456,73 +456,73 @@ networkRemoveGeneralIPv4FirewallRules(virFirewallPtr fw,
*/ */
static void static void
networkAddGeneralIPv6FirewallRules(virFirewallPtr fw, networkAddGeneralIPv6FirewallRules(virFirewallPtr fw,
virNetworkObjPtr network) virNetworkDefPtr def)
{ {
if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && if (!virNetworkDefGetIpByIndex(def, AF_INET6, 0) &&
!network->def->ipv6nogw) { !def->ipv6nogw) {
return; return;
} }
/* Catch all rules to block forwarding to/from bridges */ /* Catch all rules to block forwarding to/from bridges */
iptablesAddForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge); iptablesAddForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge);
iptablesAddForwardRejectIn(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge); iptablesAddForwardRejectIn(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge);
/* Allow traffic between guests on the same bridge */ /* Allow traffic between guests on the same bridge */
iptablesAddForwardAllowCross(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge); iptablesAddForwardAllowCross(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge);
if (virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) { if (virNetworkDefGetIpByIndex(def, AF_INET6, 0)) {
/* allow DNS over IPv6 */ /* allow DNS over IPv6 */
iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge, 53); iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53);
iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge, 53); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53);
iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge, 547); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 547);
} }
} }
static void static void
networkRemoveGeneralIPv6FirewallRules(virFirewallPtr fw, networkRemoveGeneralIPv6FirewallRules(virFirewallPtr fw,
virNetworkObjPtr network) virNetworkDefPtr def)
{ {
if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && if (!virNetworkDefGetIpByIndex(def, AF_INET6, 0) &&
!network->def->ipv6nogw) { !def->ipv6nogw) {
return; return;
} }
if (virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) { if (virNetworkDefGetIpByIndex(def, AF_INET6, 0)) {
iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge, 547); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 547);
iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge, 53); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53);
iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge, 53); iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53);
} }
/* the following rules are there if no IPv6 address has been defined /* the following rules are there if no IPv6 address has been defined
* but network->def->ipv6nogw == true * but def->ipv6nogw == true
*/ */
iptablesRemoveForwardAllowCross(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge); iptablesRemoveForwardAllowCross(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge);
iptablesRemoveForwardRejectIn(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge); iptablesRemoveForwardRejectIn(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge);
iptablesRemoveForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV6, network->def->bridge); iptablesRemoveForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge);
} }
static void static void
networkAddGeneralFirewallRules(virFirewallPtr fw, networkAddGeneralFirewallRules(virFirewallPtr fw,
virNetworkObjPtr network) virNetworkDefPtr def)
{ {
networkAddGeneralIPv4FirewallRules(fw, network); networkAddGeneralIPv4FirewallRules(fw, def);
networkAddGeneralIPv6FirewallRules(fw, network); networkAddGeneralIPv6FirewallRules(fw, def);
} }
static void static void
networkRemoveGeneralFirewallRules(virFirewallPtr fw, networkRemoveGeneralFirewallRules(virFirewallPtr fw,
virNetworkObjPtr network) virNetworkDefPtr def)
{ {
networkRemoveGeneralIPv4FirewallRules(fw, network); networkRemoveGeneralIPv4FirewallRules(fw, def);
networkRemoveGeneralIPv6FirewallRules(fw, network); networkRemoveGeneralIPv6FirewallRules(fw, def);
} }
static void static void
networkAddChecksumFirewallRules(virFirewallPtr fw, networkAddChecksumFirewallRules(virFirewallPtr fw,
virNetworkObjPtr network) virNetworkDefPtr def)
{ {
size_t i; size_t i;
virNetworkIpDefPtr ipv4def; virNetworkIpDefPtr ipv4def;
@ -530,7 +530,7 @@ networkAddChecksumFirewallRules(virFirewallPtr fw,
/* First look for first IPv4 address that has dhcp or tftpboot defined. */ /* First look for first IPv4 address that has dhcp or tftpboot defined. */
/* We support dhcp config on 1 IPv4 interface only. */ /* We support dhcp config on 1 IPv4 interface only. */
for (i = 0; for (i = 0;
(ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); (ipv4def = virNetworkDefGetIpByIndex(def, AF_INET, i));
i++) { i++) {
if (ipv4def->nranges || ipv4def->nhosts) if (ipv4def->nranges || ipv4def->nhosts)
break; break;
@ -542,13 +542,13 @@ networkAddChecksumFirewallRules(virFirewallPtr fw,
* aborting, since not all iptables implementations support it). * aborting, since not all iptables implementations support it).
*/ */
if (ipv4def) if (ipv4def)
iptablesAddOutputFixUdpChecksum(fw, network->def->bridge, 68); iptablesAddOutputFixUdpChecksum(fw, def->bridge, 68);
} }
static void static void
networkRemoveChecksumFirewallRules(virFirewallPtr fw, networkRemoveChecksumFirewallRules(virFirewallPtr fw,
virNetworkObjPtr network) virNetworkDefPtr def)
{ {
size_t i; size_t i;
virNetworkIpDefPtr ipv4def; virNetworkIpDefPtr ipv4def;
@ -556,33 +556,33 @@ networkRemoveChecksumFirewallRules(virFirewallPtr fw,
/* First look for first IPv4 address that has dhcp or tftpboot defined. */ /* First look for first IPv4 address that has dhcp or tftpboot defined. */
/* We support dhcp config on 1 IPv4 interface only. */ /* We support dhcp config on 1 IPv4 interface only. */
for (i = 0; for (i = 0;
(ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, i)); (ipv4def = virNetworkDefGetIpByIndex(def, AF_INET, i));
i++) { i++) {
if (ipv4def->nranges || ipv4def->nhosts) if (ipv4def->nranges || ipv4def->nhosts)
break; break;
} }
if (ipv4def) if (ipv4def)
iptablesRemoveOutputFixUdpChecksum(fw, network->def->bridge, 68); iptablesRemoveOutputFixUdpChecksum(fw, def->bridge, 68);
} }
static int static int
networkAddIpSpecificFirewallRules(virFirewallPtr fw, networkAddIpSpecificFirewallRules(virFirewallPtr fw,
virNetworkObjPtr network, virNetworkDefPtr def,
virNetworkIpDefPtr ipdef) virNetworkIpDefPtr ipdef)
{ {
/* NB: in the case of IPv6, routing rules are added when the /* NB: in the case of IPv6, routing rules are added when the
* forward mode is NAT. This is because IPv6 has no NAT. * forward mode is NAT. This is because IPv6 has no NAT.
*/ */
if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { if (def->forward.type == VIR_NETWORK_FORWARD_NAT) {
if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET))
return networkAddMasqueradingFirewallRules(fw, network, ipdef); return networkAddMasqueradingFirewallRules(fw, def, ipdef);
else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6))
return networkAddRoutingFirewallRules(fw, network, ipdef); return networkAddRoutingFirewallRules(fw, def, ipdef);
} else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { } else if (def->forward.type == VIR_NETWORK_FORWARD_ROUTE) {
return networkAddRoutingFirewallRules(fw, network, ipdef); return networkAddRoutingFirewallRules(fw, def, ipdef);
} }
return 0; return 0;
} }
@ -590,23 +590,23 @@ networkAddIpSpecificFirewallRules(virFirewallPtr fw,
static int static int
networkRemoveIpSpecificFirewallRules(virFirewallPtr fw, networkRemoveIpSpecificFirewallRules(virFirewallPtr fw,
virNetworkObjPtr network, virNetworkDefPtr def,
virNetworkIpDefPtr ipdef) virNetworkIpDefPtr ipdef)
{ {
if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { if (def->forward.type == VIR_NETWORK_FORWARD_NAT) {
if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET))
return networkRemoveMasqueradingFirewallRules(fw, network, ipdef); return networkRemoveMasqueradingFirewallRules(fw, def, ipdef);
else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6))
return networkRemoveRoutingFirewallRules(fw, network, ipdef); return networkRemoveRoutingFirewallRules(fw, def, ipdef);
} else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { } else if (def->forward.type == VIR_NETWORK_FORWARD_ROUTE) {
return networkRemoveRoutingFirewallRules(fw, network, ipdef); return networkRemoveRoutingFirewallRules(fw, def, ipdef);
} }
return 0; return 0;
} }
/* Add all rules for all ip addresses (and general rules) on a network */ /* Add all rules for all ip addresses (and general rules) on a network */
int networkAddFirewallRules(virNetworkObjPtr network) int networkAddFirewallRules(virNetworkDefPtr def)
{ {
size_t i; size_t i;
virNetworkIpDefPtr ipdef; virNetworkIpDefPtr ipdef;
@ -617,27 +617,27 @@ int networkAddFirewallRules(virNetworkObjPtr network)
virFirewallStartTransaction(fw, 0); virFirewallStartTransaction(fw, 0);
networkAddGeneralFirewallRules(fw, network); networkAddGeneralFirewallRules(fw, def);
for (i = 0; for (i = 0;
(ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, i)); (ipdef = virNetworkDefGetIpByIndex(def, AF_UNSPEC, i));
i++) { i++) {
if (networkAddIpSpecificFirewallRules(fw, network, ipdef) < 0) if (networkAddIpSpecificFirewallRules(fw, def, ipdef) < 0)
goto cleanup; goto cleanup;
} }
virFirewallStartRollback(fw, 0); virFirewallStartRollback(fw, 0);
for (i = 0; for (i = 0;
(ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, i)); (ipdef = virNetworkDefGetIpByIndex(def, AF_UNSPEC, i));
i++) { i++) {
if (networkRemoveIpSpecificFirewallRules(fw, network, ipdef) < 0) if (networkRemoveIpSpecificFirewallRules(fw, def, ipdef) < 0)
goto cleanup; goto cleanup;
} }
networkRemoveGeneralFirewallRules(fw, network); networkRemoveGeneralFirewallRules(fw, def);
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
networkAddChecksumFirewallRules(fw, network); networkAddChecksumFirewallRules(fw, def);
if (virFirewallApply(fw) < 0) if (virFirewallApply(fw) < 0)
goto cleanup; goto cleanup;
@ -649,7 +649,7 @@ int networkAddFirewallRules(virNetworkObjPtr network)
} }
/* Remove all rules for all ip addresses (and general rules) on a network */ /* Remove all rules for all ip addresses (and general rules) on a network */
void networkRemoveFirewallRules(virNetworkObjPtr network) void networkRemoveFirewallRules(virNetworkDefPtr def)
{ {
size_t i; size_t i;
virNetworkIpDefPtr ipdef; virNetworkIpDefPtr ipdef;
@ -658,17 +658,17 @@ void networkRemoveFirewallRules(virNetworkObjPtr network)
fw = virFirewallNew(); fw = virFirewallNew();
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
networkRemoveChecksumFirewallRules(fw, network); networkRemoveChecksumFirewallRules(fw, def);
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
for (i = 0; for (i = 0;
(ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, i)); (ipdef = virNetworkDefGetIpByIndex(def, AF_UNSPEC, i));
i++) { i++) {
if (networkRemoveIpSpecificFirewallRules(fw, network, ipdef) < 0) if (networkRemoveIpSpecificFirewallRules(fw, def, ipdef) < 0)
goto cleanup; goto cleanup;
} }
networkRemoveGeneralFirewallRules(fw, network); networkRemoveGeneralFirewallRules(fw, def);
virFirewallApply(fw); virFirewallApply(fw);

6
src/network/bridge_driver_nop.c
View File

@ -21,16 +21,16 @@
#include <config.h> #include <config.h>
int networkCheckRouteCollision(virNetworkObjPtr network ATTRIBUTE_UNUSED) int networkCheckRouteCollision(virNetworkDefPtr def ATTRIBUTE_UNUSED)
{ {
return 0; return 0;
} }
int networkAddFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED) int networkAddFirewallRules(virNetworkDefPtr def ATTRIBUTE_UNUSED)
{ {
return 0; return 0;
} }
void networkRemoveFirewallRules(virNetworkObjPtr network ATTRIBUTE_UNUSED) void networkRemoveFirewallRules(virNetworkDefPtr def ATTRIBUTE_UNUSED)
{ {
} }

6
src/network/bridge_driver_platform.h
View File

@ -50,10 +50,10 @@ struct _virNetworkDriverState {
typedef struct _virNetworkDriverState virNetworkDriverState; typedef struct _virNetworkDriverState virNetworkDriverState;
typedef virNetworkDriverState *virNetworkDriverStatePtr; typedef virNetworkDriverState *virNetworkDriverStatePtr;
int networkCheckRouteCollision(virNetworkObjPtr network); int networkCheckRouteCollision(virNetworkDefPtr def);
int networkAddFirewallRules(virNetworkObjPtr network); int networkAddFirewallRules(virNetworkDefPtr def);
void networkRemoveFirewallRules(virNetworkObjPtr network); void networkRemoveFirewallRules(virNetworkDefPtr def);
#endif /* __VIR_BRIDGE_DRIVER_PLATFORM_H__ */ #endif /* __VIR_BRIDGE_DRIVER_PLATFORM_H__ */