[libvirt] [PATCH] nwfilter: add support for RAPR protocol

Stefan Berger stefanb at us.ibm.com
Sat Apr 24 03:02:45 UTC 2010


This patch adds support for the RARP protocol. This may be needed due to
qemu sending out a RARP packet (at least that's what it seems to want to
do even though the protocol id is wrong) when migration finishes and
we'd need a rule to let the packets pass. 

Unfortunately my installation of ebtables does not understand -p RARP
and also seems to otherwise depend on strings in /etc/ethertype
translated to protocol identifiers. Therefore I need to pass -p 0x8035
for RARP. To generally get rid of the dependency of that file I switch
all so far supported protocols to use their protocol identifier in the
-p parameter rather than the string.

I am also extending the schema.

Signed-off-by: Stefan Berger <stefanb at us.ibm.com>

---
 docs/schemas/nwfilter.rng                 |    9 ++
 src/conf/nwfilter_conf.c                  |   29 ++-----
 src/conf/nwfilter_conf.h                  |   22 +++++-
 src/nwfilter/nwfilter_ebiptables_driver.c |  109 ++++++++++++++++++------------
 4 files changed, 106 insertions(+), 63 deletions(-)

Index: libvirt-acl/docs/schemas/nwfilter.rng
===================================================================
--- libvirt-acl.orig/docs/schemas/nwfilter.rng
+++ libvirt-acl/docs/schemas/nwfilter.rng
@@ -39,6 +39,15 @@
           </optional>
           <optional>
             <zeroOrMore>
+              <element name="rarp">
+                <ref name="match-attribute"/>
+                <ref name="common-l2-attributes"/>
+                <ref name="arp-attributes"/> <!-- same as arp -->
+              </element>
+            </zeroOrMore>
+          </optional>
+          <optional>
+            <zeroOrMore>
               <element name="ip">
                 <ref name="match-attribute"/>
                 <ref name="common-l2-attributes"/>
Index: libvirt-acl/src/conf/nwfilter_conf.c
===================================================================
--- libvirt-acl.orig/src/conf/nwfilter_conf.c
+++ libvirt-acl/src/conf/nwfilter_conf.c
@@ -46,22 +46,6 @@
 #include "domain_conf.h"
 
 
-/* XXX
- * The config parser/structs should not be using platform specific
- * constants. Win32 lacks these constants, breaking the parser,
- * so temporarily define them until this can be re-written to use
- * locally defined enums for all constants
- */
-#ifndef ETHERTYPE_IP
-# define ETHERTYPE_IP            0x0800
-#endif
-#ifndef ETHERTYPE_ARP
-# define ETHERTYPE_ARP           0x0806
-#endif
-#ifndef ETHERTYPE_IPV6
-# define ETHERTYPE_IPV6          0x86dd
-#endif
-
 #define VIR_FROM_THIS VIR_FROM_NWFILTER
 
 
@@ -90,6 +74,7 @@ VIR_ENUM_IMPL(virNWFilterEbtablesTable, 
 VIR_ENUM_IMPL(virNWFilterChainSuffix, VIR_NWFILTER_CHAINSUFFIX_LAST,
               "root",
               "arp",
+              "rarp",
               "ipv4",
               "ipv6");
 
@@ -97,6 +82,7 @@ VIR_ENUM_IMPL(virNWFilterRuleProtocol, V
               "none",
               "mac",
               "arp",
+              "rarp",
               "ip",
               "ipv6",
               "tcp",
@@ -412,11 +398,10 @@ struct _virXMLAttr2Struct
 
 
 static const struct int_map macProtoMap[] = {
-    INTMAP_ENTRY(ETHERTYPE_ARP , "arp"),
-    INTMAP_ENTRY(ETHERTYPE_IP  , "ipv4"),
-#ifdef ETHERTYPE_IPV6
-    INTMAP_ENTRY(ETHERTYPE_IPV6, "ipv6"),
-#endif
+    INTMAP_ENTRY(ETHERTYPE_ARP   , "arp"),
+    INTMAP_ENTRY(ETHERTYPE_REVARP, "rarp"),
+    INTMAP_ENTRY(ETHERTYPE_IP    , "ipv4"),
+    INTMAP_ENTRY(ETHERTYPE_IPV6  , "ipv6"),
     INTMAP_ENTRY_LAST
 };
 
@@ -1084,6 +1069,7 @@ struct _virAttributes {
 
 static const virAttributes virAttr[] = {
     PROTOCOL_ENTRY("arp"    , arpAttributes    , VIR_NWFILTER_RULE_PROTOCOL_ARP),
+    PROTOCOL_ENTRY("rarp"   , arpAttributes    , VIR_NWFILTER_RULE_PROTOCOL_RARP),
     PROTOCOL_ENTRY("mac"    , macAttributes    , VIR_NWFILTER_RULE_PROTOCOL_MAC),
     PROTOCOL_ENTRY("ip"     , ipAttributes     , VIR_NWFILTER_RULE_PROTOCOL_IP),
     PROTOCOL_ENTRY("ipv6"   , ipv6Attributes   , VIR_NWFILTER_RULE_PROTOCOL_IPV6),
@@ -1434,6 +1420,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD
     break;
 
     case VIR_NWFILTER_RULE_PROTOCOL_ARP:
+    case VIR_NWFILTER_RULE_PROTOCOL_RARP:
     case VIR_NWFILTER_RULE_PROTOCOL_NONE:
     break;
 
Index: libvirt-acl/src/conf/nwfilter_conf.h
===================================================================
--- libvirt-acl.orig/src/conf/nwfilter_conf.h
+++ libvirt-acl/src/conf/nwfilter_conf.h
@@ -35,6 +35,24 @@
 # include "xml.h"
 # include "network.h"
 
+/* XXX
+ * The config parser/structs should not be using platform specific
+ * constants. Win32 lacks these constants, breaking the parser,
+ * so temporarily define them until this can be re-written to use
+ * locally defined enums for all constants
+ */
+# ifndef ETHERTYPE_IP
+#  define ETHERTYPE_IP            0x0800
+# endif
+# ifndef ETHERTYPE_ARP
+#  define ETHERTYPE_ARP           0x0806
+# endif
+# ifndef ETHERTYPE_REVARP
+#  define ETHERTYPE_REVARP        0x8035
+# endif
+# ifndef ETHERTYPE_IPV6
+#  define ETHERTYPE_IPV6          0x86dd
+# endif
 
 /**
  * Chain suffix size is:
@@ -290,6 +308,7 @@ enum virNWFilterRuleProtocolType {
     VIR_NWFILTER_RULE_PROTOCOL_NONE = 0,
     VIR_NWFILTER_RULE_PROTOCOL_MAC,
     VIR_NWFILTER_RULE_PROTOCOL_ARP,
+    VIR_NWFILTER_RULE_PROTOCOL_RARP,
     VIR_NWFILTER_RULE_PROTOCOL_IP,
     VIR_NWFILTER_RULE_PROTOCOL_IPV6,
     VIR_NWFILTER_RULE_PROTOCOL_TCP,
@@ -334,7 +353,7 @@ struct _virNWFilterRuleDef {
     enum virNWFilterRuleProtocolType prtclType;
     union {
         ethHdrFilterDef  ethHdrFilter;
-        arpHdrFilterDef  arpHdrFilter;
+        arpHdrFilterDef  arpHdrFilter; /* also used for rarp */
         ipHdrFilterDef   ipHdrFilter;
         ipv6HdrFilterDef ipv6HdrFilter;
         tcpHdrFilterDef  tcpHdrFilter;
@@ -371,6 +390,7 @@ struct _virNWFilterEntry {
 enum virNWFilterChainSuffixType {
     VIR_NWFILTER_CHAINSUFFIX_ROOT = 0,
     VIR_NWFILTER_CHAINSUFFIX_ARP,
+    VIR_NWFILTER_CHAINSUFFIX_RARP,
     VIR_NWFILTER_CHAINSUFFIX_IPv4,
     VIR_NWFILTER_CHAINSUFFIX_IPv6,
 
Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c
===================================================================
--- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c
+++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -32,6 +32,7 @@
 #include "logging.h"
 #include "virterror_internal.h"
 #include "domain_conf.h"
+#include "nwfilter_conf.h"
 #include "nwfilter_gentech_driver.h"
 #include "nwfilter_ebiptables_driver.h"
 
@@ -103,11 +104,28 @@ static int ebiptablesDriverInit(void);
 static void ebiptablesDriverShutdown(void);
 
 
-static const char *supported_protocols[] = {
-    "ipv4",
-    "ipv6",
-    "arp",
-    NULL,
+struct ushort_map {
+    unsigned short attr;
+    const char *val;
+};
+
+
+enum l3_proto_idx {
+    L3_PROTO_IPV4_IDX = 0,
+    L3_PROTO_IPV6_IDX,
+    L3_PROTO_ARP_IDX,
+    L3_PROTO_RARP_IDX,
+    L3_PROTO_LAST_IDX
+};
+
+#define USHORTMAP_ENTRY_IDX(IDX, ATT, VAL) [IDX] = { .attr = ATT, .val = VAL }
+
+static const struct ushort_map l3_protocols[] = {
+    USHORTMAP_ENTRY_IDX(L3_PROTO_IPV4_IDX, ETHERTYPE_IP    , "ipv4"),
+    USHORTMAP_ENTRY_IDX(L3_PROTO_IPV6_IDX, ETHERTYPE_IPV6  , "ipv6"),
+    USHORTMAP_ENTRY_IDX(L3_PROTO_ARP_IDX , ETHERTYPE_ARP   , "arp"),
+    USHORTMAP_ENTRY_IDX(L3_PROTO_RARP_IDX, ETHERTYPE_REVARP, "rarp"),
+    USHORTMAP_ENTRY_IDX(L3_PROTO_LAST_IDX, 0               , NULL),
 };
 
 
@@ -1609,6 +1627,7 @@ ebtablesCreateRuleInstance(char chainPre
     break;
 
     case VIR_NWFILTER_RULE_PROTOCOL_ARP:
+    case VIR_NWFILTER_RULE_PROTOCOL_RARP:
 
         virBufferVSprintf(&buf,
                           CMD_DEF_PRE "%s -t %s -%%c %s %%s",
@@ -1620,7 +1639,10 @@ ebtablesCreateRuleInstance(char chainPre
                                  reverse))
             goto err_exit;
 
-        virBufferAddLit(&buf, " -p arp");
+        virBufferVSprintf(&buf, " -p 0x%x",
+                          (rule->prtclType == VIR_NWFILTER_RULE_PROTOCOL_ARP)
+                           ? l3_protocols[L3_PROTO_ARP_IDX].attr
+                           : l3_protocols[L3_PROTO_RARP_IDX].attr);
 
         if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataHWType)) {
              if (printDataType(vars,
@@ -2034,6 +2056,7 @@ ebiptablesCreateRuleInstance(virConnectP
     case VIR_NWFILTER_RULE_PROTOCOL_IP:
     case VIR_NWFILTER_RULE_PROTOCOL_MAC:
     case VIR_NWFILTER_RULE_PROTOCOL_ARP:
+    case VIR_NWFILTER_RULE_PROTOCOL_RARP:
     case VIR_NWFILTER_RULE_PROTOCOL_NONE:
     case VIR_NWFILTER_RULE_PROTOCOL_IPV6:
 
@@ -2425,7 +2448,7 @@ static int
 ebtablesCreateTmpSubChain(virBufferPtr buf,
                           int incoming,
                           const char *ifname,
-                          const char *protocol,
+                          enum l3_proto_idx protoidx,
                           int stopOnError)
 {
     char rootchain[MAX_CHAINNAME_LENGTH], chain[MAX_CHAINNAME_LENGTH];
@@ -2433,13 +2456,13 @@ ebtablesCreateTmpSubChain(virBufferPtr b
                                   : CHAINPREFIX_HOST_OUT_TEMP;
 
     PRINT_ROOT_CHAIN(rootchain, chainPrefix, ifname);
-    PRINT_CHAIN(chain, chainPrefix, ifname, protocol);
+    PRINT_CHAIN(chain, chainPrefix, ifname, l3_protocols[protoidx].val);
 
     virBufferVSprintf(buf,
                       CMD_DEF("%s -t %s -N %s") CMD_SEPARATOR
                       CMD_EXEC
                       "%s"
-                      CMD_DEF("%s -t %s -A %s -p %s -j %s") CMD_SEPARATOR
+                      CMD_DEF("%s -t %s -A %s -p 0x%x -j %s") CMD_SEPARATOR
                       CMD_EXEC
                       "%s",
 
@@ -2448,7 +2471,7 @@ ebtablesCreateTmpSubChain(virBufferPtr b
                       CMD_STOPONERR(stopOnError),
 
                       ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
-                      rootchain, protocol, chain,
+                      rootchain, l3_protocols[protoidx].attr, chain,
 
                       CMD_STOPONERR(stopOnError));
 
@@ -2460,11 +2483,12 @@ static int
 _ebtablesRemoveSubChain(virBufferPtr buf,
                         int incoming,
                         const char *ifname,
-                        const char *protocol,
+                        enum l3_proto_idx protoidx,
                         int isTempChain)
 {
     char rootchain[MAX_CHAINNAME_LENGTH], chain[MAX_CHAINNAME_LENGTH];
     char chainPrefix;
+
     if (isTempChain) {
         chainPrefix =(incoming) ? CHAINPREFIX_HOST_IN_TEMP
                                 : CHAINPREFIX_HOST_OUT_TEMP;
@@ -2474,14 +2498,14 @@ _ebtablesRemoveSubChain(virBufferPtr buf
     }
 
     PRINT_ROOT_CHAIN(rootchain, chainPrefix, ifname);
-    PRINT_CHAIN(chain, chainPrefix, ifname, protocol);
+    PRINT_CHAIN(chain, chainPrefix, ifname, l3_protocols[protoidx].val);
 
     virBufferVSprintf(buf,
-                      "%s -t %s -D %s -p %s -j %s" CMD_SEPARATOR
+                      "%s -t %s -D %s -p 0x%x -j %s" CMD_SEPARATOR
                       "%s -t %s -F %s" CMD_SEPARATOR
                       "%s -t %s -X %s" CMD_SEPARATOR,
                       ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
-                      rootchain, protocol, chain,
+                      rootchain, l3_protocols[protoidx].attr, chain,
 
                       ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain,
 
@@ -2495,10 +2519,10 @@ static int
 ebtablesRemoveSubChain(virBufferPtr buf,
                        int incoming,
                        const char *ifname,
-                       const char *protocol)
+                       enum l3_proto_idx protoidx)
 {
     return _ebtablesRemoveSubChain(buf,
-                                   incoming, ifname, protocol, 0);
+                                   incoming, ifname, protoidx, 0);
 }
 
 
@@ -2506,10 +2530,11 @@ static int
 ebtablesRemoveSubChains(virBufferPtr buf,
                         const char *ifname)
 {
-    int i;
-    for (i = 0; supported_protocols[i]; i++) {
-        ebtablesRemoveSubChain(buf, 1, ifname, supported_protocols[i]);
-        ebtablesRemoveSubChain(buf, 0, ifname, supported_protocols[i]);
+    enum l3_proto_idx i;
+
+    for (i = 0; i < L3_PROTO_LAST_IDX; i++) {
+        ebtablesRemoveSubChain(buf, 1, ifname, i);
+        ebtablesRemoveSubChain(buf, 0, ifname, i);
     }
 
     return 0;
@@ -2520,10 +2545,10 @@ static int
 ebtablesRemoveTmpSubChain(virBufferPtr buf,
                           int incoming,
                           const char *ifname,
-                          const char *protocol)
+                          enum l3_proto_idx protoidx)
 {
     return _ebtablesRemoveSubChain(buf,
-                                   incoming, ifname, protocol, 1);
+                                   incoming, ifname, protoidx, 1);
 }
 
 
@@ -2531,12 +2556,11 @@ static int
 ebtablesRemoveTmpSubChains(virBufferPtr buf,
                            const char *ifname)
 {
-    int i;
-    for (i = 0; supported_protocols[i]; i++) {
-        ebtablesRemoveTmpSubChain(buf, 1, ifname,
-                                  supported_protocols[i]);
-        ebtablesRemoveTmpSubChain(buf, 0, ifname,
-                                  supported_protocols[i]);
+    enum l3_proto_idx i;
+
+    for (i = 0; i < L3_PROTO_LAST_IDX; i++) {
+        ebtablesRemoveTmpSubChain(buf, 1, ifname, i);
+        ebtablesRemoveTmpSubChain(buf, 0, ifname, i);
     }
 
     return 0;
@@ -2574,12 +2598,11 @@ static int
 ebtablesRenameTmpSubChains(virBufferPtr buf,
                            const char *ifname)
 {
-    int i;
-    for (i = 0; supported_protocols[i]; i++) {
-        ebtablesRenameTmpSubChain (buf, 1, ifname,
-                                   supported_protocols[i]);
-        ebtablesRenameTmpSubChain (buf, 0, ifname,
-                                   supported_protocols[i]);
+    enum l3_proto_idx i;
+
+    for (i = 0; i < L3_PROTO_LAST_IDX; i++) {
+        ebtablesRenameTmpSubChain (buf, 1, ifname, l3_protocols[i].val);
+        ebtablesRenameTmpSubChain (buf, 0, ifname, l3_protocols[i].val);
     }
 
     return 0;
@@ -2909,20 +2932,24 @@ ebiptablesApplyNewRules(virConnectPtr co
         ebtablesCreateTmpRootChain(&buf, 0, ifname, 1);
 
     if (chains_in  & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4))
-        ebtablesCreateTmpSubChain(&buf, 1, ifname, "ipv4", 1);
+        ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_IPV4_IDX, 1);
     if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4))
-        ebtablesCreateTmpSubChain(&buf, 0, ifname, "ipv4", 1);
+        ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_IPV4_IDX, 1);
 
     if (chains_in  & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv6))
-        ebtablesCreateTmpSubChain(&buf, 1, ifname, "ipv6", 1);
+        ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_IPV6_IDX, 1);
     if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv6))
-        ebtablesCreateTmpSubChain(&buf, 0, ifname, "ipv6", 1);
+        ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_IPV6_IDX, 1);
 
-    // keep arp as last
+    // keep arp,rarp as last
     if (chains_in  & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP))
-        ebtablesCreateTmpSubChain(&buf, 1, ifname, "arp", 1);
+        ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_ARP_IDX, 1);
     if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP))
-        ebtablesCreateTmpSubChain(&buf, 0, ifname, "arp", 1);
+        ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_ARP_IDX, 1);
+    if (chains_in  & (1 << VIR_NWFILTER_CHAINSUFFIX_RARP))
+        ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_RARP_IDX, 1);
+    if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_RARP))
+        ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_RARP_IDX, 1);
 
     if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0)
         goto tear_down_tmpebchains;




More information about the libvir-list mailing list