Change in vdsm[master]: macspoof hooks: new hook script to enable macspoof filtering...

gvallare at redhat.com gvallare at redhat.com
Mon Aug 5 16:02:04 UTC 2013


Giuseppe Vallarelli has uploaded a new change for review.

Change subject: macspoof hooks: new hook script to enable macspoof filtering per vnic.
......................................................................

macspoof hooks: new hook script to enable macspoof filtering per vnic.

Puropose of this patch is to add a new hook script which is
almost equal to the existing one except that is applied on
a per vnic basis. This hook script uses a different custom
property macspoofperdevice to avoid conflicts with the macspoof
one which operates for all VM's interfaces.

Change-Id: Ifb3e7bec7ce400dddc6f4e649b7d21dfe5010631
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=908704
Signed-off-by: Giuseppe Vallarelli <gvallare at redhat.com>
---
M vdsm.spec.in
M vdsm_hooks/macspoof/Makefile.am
M vdsm_hooks/macspoof/README
A vdsm_hooks/macspoof/before_device_create.py
4 files changed, 96 insertions(+), 7 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/78/17678/1

diff --git a/vdsm.spec.in b/vdsm.spec.in
index 87bc231..1153452 100644
--- a/vdsm.spec.in
+++ b/vdsm.spec.in
@@ -362,7 +362,9 @@
 BuildArch:      noarch
 
 %description hook-macspoof
-VDSM hook that disables mac spoof filtering on all the of the VM's interfaces.
+VDSM hooks which allow to disable mac spoof filtering
+either on all the of the VM's interfaces or on
+specific vnics.
 
 %package hook-fileinject
 Summary:        Allow uploading file to VMs disk
@@ -1132,6 +1134,7 @@
 %files hook-macspoof
 %defattr(-, root, root, -)
 %{_libexecdir}/%{vdsm_name}/hooks/before_vm_start/50_macspoof
+%{_libexecdir}/%{vdsm_name}/hooks/before_device_create/50_macspoof
 
 %files hook-nestedvt
 %defattr(-, root, root, -)
diff --git a/vdsm_hooks/macspoof/Makefile.am b/vdsm_hooks/macspoof/Makefile.am
index 68c70f9..e288d92 100644
--- a/vdsm_hooks/macspoof/Makefile.am
+++ b/vdsm_hooks/macspoof/Makefile.am
@@ -19,13 +19,18 @@
 #
 
 EXTRA_DIST = \
-	before_vm_start.py
+	before_vm_start.py \
+	before_device_create.py
 
 install-data-local:
 	$(MKDIR_P) $(DESTDIR)$(vdsmhooksdir)/before_vm_start
 	$(INSTALL_SCRIPT) $(srcdir)/before_vm_start.py \
 		$(DESTDIR)$(vdsmhooksdir)/before_vm_start/50_macspoof
+	$(MKDIR_P) $(DESTDIR)$(vdsmhooksdir)/before_device_create
+	$(INSTALL_SCRIPT) $(srcdir)/before_device_create.py \
+		$(DESTDIR)$(vdsmhooksdir)/before_device_create/50_macspoof
 
 uninstall-local:
 	$(RM) $(DESTDIR)$(vdsmhooksdir)/before_vm_start/50_macspoof
+	$(RM) $(DESTDIR)$(vdsmhooksdir)/before_device_create/50_macspoof
 
diff --git a/vdsm_hooks/macspoof/README b/vdsm_hooks/macspoof/README
index c7d14f6..5051685 100644
--- a/vdsm_hooks/macspoof/README
+++ b/vdsm_hooks/macspoof/README
@@ -1,16 +1,31 @@
 macspoof vdsm hook
 =================================
-This hook goes through all of the VM's interfaces and removes
-MAC and ARP spoofing filtering.
+These hooks allow to remove MAC and ARP spoofing filtering
+from all of the VM's interfaces or for a specific vnic.
 
 Installation:
-* Use the engine-config to append the appropriate custom property as such:
+* Use the engine-config to append the appropriate custom properties
+  as such:
+
+Custom property which removes MAC and ARP spoofing filtering
+for all interfaces in a VM:
+
 	sudo engine-config -s UserDefinedVMProperties=
 	'previousProperties;macspoof=^(true|false)$' --cver=3.2
 
-* Verify that the macspoof custom property was properly added:
+Custom property which removes MAC and ARP spoofing filtering
+for a specific vnic in a VM:
+
+  sudo engine-config -s UserDefinedVMProperties=
+	'previousProperties;macspoofperdevice=^(true|false)$' --cver=3.2
+
+* Verify that the macspoof custom propertes were properly added:
 	sudo engine-config -g UserDefinedVMProperties
 
 Usage:
 In the VM configuration window, open the custom properites tab
-and add macspoof=true
+and add macspoof=true for applying filtering to all VM's interfaces.
+
+In the vnic profiles configuration window, open the custom properties
+tab and add macspoof=true for applying filtering to the specific
+interface.
diff --git a/vdsm_hooks/macspoof/before_device_create.py b/vdsm_hooks/macspoof/before_device_create.py
new file mode 100755
index 0000000..9c7c9e2
--- /dev/null
+++ b/vdsm_hooks/macspoof/before_device_create.py
@@ -0,0 +1,66 @@
+#!/usr/bin/python
+
+import os
+import hooking
+
+
+def removeMacSpoofingFilter(interface):
+    for filterElement in interface.getElementsByTagName('filterref'):
+        if isMacSpoofingFilter(filterElement):
+            removeFilter(interface, filterElement)
+
+
+def isMacSpoofingFilter(filterElement):
+    """
+    Accept a filter DOM element
+    and checks if it's a mac spoofing filter
+    """
+    filterValue = filterElement.getAttribute('filter')
+    return filterValue == 'vdsm-no-mac-spoofing'
+
+
+def removeFilter(interface, filterElement):
+    """
+    Accept an interface DOM element
+    and a filter DOM element and remove the filter from the DOM.
+    """
+    interface.removeChild(filterElement)
+
+
+def main():
+
+    if hooking.tobool(os.environ.get('macspoofperdevice')):
+        domxml = hooking.read_domxml()
+
+        for interface in domxml.getElementsByTagName('interface'):
+            removeMacSpoofingFilter(interface)
+
+        hooking.write_domxml(domxml)
+
+
+def test():
+    import xml.dom
+
+    interface = xml.dom.minidom.parseString("""
+    <interface type="bridge">
+        <address bus="0x00" domain="0x0000" function="0x0" slot="0x03"\
+                                            type="pci"/>
+        <mac address="00:1a:4a:16:01:b0"/>
+        <model type="virtio"/>
+        <source bridge="ovirtmgmt"/>
+        <filterref filter="vdsm-no-mac-spoofing"/>
+        <link state="up"/>
+        <boot order="1"/>
+    </interface>
+    """).getElementsByTagName('interface')[0]
+
+    print "Interface before removing filter: %s" % \
+        interface.toxml(encoding='UTF-8')
+
+    removeMacSpoofingFilter(interface)
+    print "Interface after removing filter: %s" % \
+        interface.toxml(encoding='UTF-8')
+
+
+if __name__ == '__main__':
+    main()


-- 
To view, visit http://gerrit.ovirt.org/17678
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Ifb3e7bec7ce400dddc6f4e649b7d21dfe5010631
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Giuseppe Vallarelli <gvallare at redhat.com>


More information about the vdsm-patches mailing list