[libvirt] [PATCH v2] Add support for network filter code in LXC driver

[Stefan Berger]

On 06/14/2011 10:46 AM, Daniel P. Berrange wrote:
> The LXC driver networking uses veth device pairs. These can
> be easily hooked into the network filtering code.
>
> * src/lxc/lxc_driver.c: Add calls to setup/teardown nwfilter
>
> New in v2:
>
>   - Add missing hooks for automatic rebuild of filters for
>     online guests
>
> ---
>   src/lxc/lxc_driver.c |   40 ++++++++++++++++++++++++++++++++++++++--
>   1 files changed, 38 insertions(+), 2 deletions(-)
>
> diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
> index 9ef75f5..e8ad3f0 100644
> --- a/src/lxc/lxc_driver.c
> +++ b/src/lxc/lxc_driver.c
> @@ -52,7 +52,7 @@
>   #include "hooks.h"
>   #include "files.h"
>   #include "fdstream.h"
> -
> +#include "domain_nwfilter.h"
>
>   #define VIR_FROM_THIS VIR_FROM_LXC
>
> @@ -1027,6 +1027,8 @@ static void lxcVmCleanup(lxc_driver_t *driver,
>           vethDelete(vm->def->nets[i]->ifname);
>       }
>
> +    virDomainConfVMNWFilterTeardown(vm);
> +
>       if (driver->cgroup&&
>           virCgroupForDomain(driver->cgroup, vm->def->name,&cgroup, 0) == 0) {
>           virCgroupRemove(cgroup);
> @@ -1146,6 +1148,10 @@ static int lxcSetupInterfaces(virConnectPtr conn,
>
>           if (vethInterfaceUpOrDown(parentVeth, 1)<  0)
>               goto error_exit;
> +
> +        if (def->nets[i]->filter&&
> +            virDomainConfNWFilterInstantiate(conn, def->nets[i])<  0)
> +            goto error_exit;
>       }
>
>       rc = 0;
> @@ -1642,8 +1648,10 @@ cleanup:
>               vethDelete(veths[i]);
>           VIR_FREE(veths[i]);
>       }
> -    if (rc != 0)
> +    if (rc != 0) {
>           VIR_FORCE_CLOSE(priv->monitor);
> +        virDomainConfVMNWFilterTeardown(vm);
> +    }
>       VIR_FORCE_CLOSE(parentTty);
>       VIR_FORCE_CLOSE(handshakefds[0]);
>       VIR_FORCE_CLOSE(handshakefds[1]);
> @@ -2842,6 +2850,33 @@ cleanup:
>       return ret;
>   }
>
> +static int
> +lxcVMFilterRebuild(virConnectPtr conn ATTRIBUTE_UNUSED,
> +                   virHashIterator iter, void *data)
> +{
> +    virHashForEach(lxc_driver->domains.objs, iter, data);
> +
> +    return 0;
> +}
> +
> +static void
> +lxcVMDriverLock(void)
> +{
> +    lxcDriverLock(lxc_driver);
> +}
> +
> +static void
> +lxcVMDriverUnlock(void)
> +{
> +    lxcDriverUnlock(lxc_driver);
> +}
> +
> +static virNWFilterCallbackDriver lxcCallbackDriver = {
> +    .name = "LXC",
> +    .vmFilterRebuild = lxcVMFilterRebuild,
> +    .vmDriverLock = lxcVMDriverLock,
> +    .vmDriverUnlock = lxcVMDriverUnlock,
> +};
>
>   /* Function Tables */
>   static virDriver lxcDriver = {
> @@ -2911,5 +2946,6 @@ int lxcRegister(void)
>   {
>       virRegisterDriver(&lxcDriver);
>       virRegisterStateDriver(&lxcStateDriver);
> +    virNWFilterRegisterCallbackDriver(&lxcCallbackDriver);
>       return 0;
>   }
ACK.

Looks good. Unfortunately I cannot test it since I don't have LXC on any 
of my machines...

    Stefan