<tt>"Daniel P. Berrange" <berrange@redhat.com> wrote on 03/25/2010 07:09:24 AM: </tt> <tt>> > Please respond to "Daniel P. Berrange"</tt> <tt>> > On Tue, Mar 23, 2010 at 10:54:16AM -0400, stefanb@us.ibm.com wrote: > > Add support for Qemu to have firewall rules applied and removed on VM > > startup and shutdown respectively. This patch also provides support for > > the updating of a filter that causes all VMs that reference the filter > > to have their ebtables/iptables rules updated. > > > > Signed-off-by: Stefan Berger <stefanb@us.ibm.com> > > > > --- > > src/qemu/qemu_conf.c | 29 +++++++++++++++++++++++++++++ > > src/qemu/qemu_driver.c | 27 +++++++++++++++++++++++++++ > > 2 files changed, 56 insertions(+) > > > > Index: libvirt-acl/src/qemu/qemu_driver.c > > =================================================================== > > --- libvirt-acl.orig/src/qemu/qemu_driver.c > > +++ libvirt-acl/src/qemu/qemu_driver.c > > @@ -83,6 +83,7 @@ > > #include "xml.h" > > #include "cpu/cpu.h" > > #include "macvtap.h" > > +#include "nwfilter/nwfilter_gentech_driver.h" > > > > > > #define VIR_FROM_THIS VIR_FROM_QEMU > > @@ -3041,6 +3042,13 @@ static void qemudShutdownVMDaemon(struct > > * reporting so we don't squash a legit error. */ > > orig_err = virSaveLastError(); > > > > + def = vm->def; > > + for (i = 0 ; i < def->nnets ; i++) { > > + virDomainNetDefPtr net = def->nets[i]; > > + if ((net->filter) && (net->ifname)) > > + virNWFilterTeardownFilter(net); > > + } > > + > > I think we might also need to run this in qemudStartuVMDaemon() in > the 'cleanup' path taken when virExecDaemonize fails.</tt> <tt>Fixed. This and the above now calls a function qemuTearVMNWFilters() which in turn calls qemuTearNWFilter();</tt> <tt> > > > if (driver->macFilter) { > > def = vm->def; > > for (i = 0 ; i < def->nnets ; i++) { > > @@ -7052,6 +7060,9 @@ qemudDomainDetachNetDevice(struct qemud_ > > } > > } > > > > + if ((detach->ifname) && (detach->filter)) > > + virNWFilterTeardownFilter(detach); > > + > > if (vm->def->nnets > 1) { > > memmove(vm->def->nets + i, > > vm->def->nets + i + 1, > > Also might need this in the cleanup path for qemudDomainAttachNetDevice > when it fails to hotplug</tt> <tt>Fixed. This and the above now calls qemuTearNWFilter().</tt> <tt>Due to these and other changes I would like to post a 'v4' patch series with an additional patch installing a couple of example filters.</tt> <tt>Thanks and regards,</tt> <tt> Stefan</tt> <tt> > > Regards, > Daniel > -- > |: Red Hat, Engineering, London -o- </tt><a href=http://people.redhat.com/berrange/:|><tt>http://people.redhat.com/berrange/:|</tt></a><tt> > |: </tt><a href=http://libvirt.org/><tt>http://libvirt.org</tt></a><tt> -o- </tt><a href="http://virt-manager.org/"><tt>http://virt-manager.org</tt></a><tt> -o- </tt><a href=http://deltacloud.org:|/><tt>http://deltacloud.org:|</tt></a><tt> > |: </tt><a href=http://autobuild.org/><tt>http://autobuild.org</tt></a><tt> -o- </tt><a href=http://search.cpan.org/~danberr/:|><tt>http://search.cpan.org/~danberr/:|</tt></a><tt> > |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :| </tt>