Change in vdsm[master]: macspoof hooks: new hook script to enable macspoof filtering...
gvallare at redhat.com
gvallare at redhat.com
Mon Aug 5 16:02:04 UTC 2013
Giuseppe Vallarelli has uploaded a new change for review.
Change subject: macspoof hooks: new hook script to enable macspoof filtering per vnic.
......................................................................
macspoof hooks: new hook script to enable macspoof filtering per vnic.
Puropose of this patch is to add a new hook script which is
almost equal to the existing one except that is applied on
a per vnic basis. This hook script uses a different custom
property macspoofperdevice to avoid conflicts with the macspoof
one which operates for all VM's interfaces.
Change-Id: Ifb3e7bec7ce400dddc6f4e649b7d21dfe5010631
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=908704
Signed-off-by: Giuseppe Vallarelli <gvallare at redhat.com>
---
M vdsm.spec.in
M vdsm_hooks/macspoof/Makefile.am
M vdsm_hooks/macspoof/README
A vdsm_hooks/macspoof/before_device_create.py
4 files changed, 96 insertions(+), 7 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/78/17678/1
diff --git a/vdsm.spec.in b/vdsm.spec.in
index 87bc231..1153452 100644
--- a/vdsm.spec.in
+++ b/vdsm.spec.in
@@ -362,7 +362,9 @@
BuildArch: noarch
%description hook-macspoof
-VDSM hook that disables mac spoof filtering on all the of the VM's interfaces.
+VDSM hooks which allow to disable mac spoof filtering
+either on all the of the VM's interfaces or on
+specific vnics.
%package hook-fileinject
Summary: Allow uploading file to VMs disk
@@ -1132,6 +1134,7 @@
%files hook-macspoof
%defattr(-, root, root, -)
%{_libexecdir}/%{vdsm_name}/hooks/before_vm_start/50_macspoof
+%{_libexecdir}/%{vdsm_name}/hooks/before_device_create/50_macspoof
%files hook-nestedvt
%defattr(-, root, root, -)
diff --git a/vdsm_hooks/macspoof/Makefile.am b/vdsm_hooks/macspoof/Makefile.am
index 68c70f9..e288d92 100644
--- a/vdsm_hooks/macspoof/Makefile.am
+++ b/vdsm_hooks/macspoof/Makefile.am
@@ -19,13 +19,18 @@
#
EXTRA_DIST = \
- before_vm_start.py
+ before_vm_start.py \
+ before_device_create.py
install-data-local:
$(MKDIR_P) $(DESTDIR)$(vdsmhooksdir)/before_vm_start
$(INSTALL_SCRIPT) $(srcdir)/before_vm_start.py \
$(DESTDIR)$(vdsmhooksdir)/before_vm_start/50_macspoof
+ $(MKDIR_P) $(DESTDIR)$(vdsmhooksdir)/before_device_create
+ $(INSTALL_SCRIPT) $(srcdir)/before_device_create.py \
+ $(DESTDIR)$(vdsmhooksdir)/before_device_create/50_macspoof
uninstall-local:
$(RM) $(DESTDIR)$(vdsmhooksdir)/before_vm_start/50_macspoof
+ $(RM) $(DESTDIR)$(vdsmhooksdir)/before_device_create/50_macspoof
diff --git a/vdsm_hooks/macspoof/README b/vdsm_hooks/macspoof/README
index c7d14f6..5051685 100644
--- a/vdsm_hooks/macspoof/README
+++ b/vdsm_hooks/macspoof/README
@@ -1,16 +1,31 @@
macspoof vdsm hook
=================================
-This hook goes through all of the VM's interfaces and removes
-MAC and ARP spoofing filtering.
+These hooks allow to remove MAC and ARP spoofing filtering
+from all of the VM's interfaces or for a specific vnic.
Installation:
-* Use the engine-config to append the appropriate custom property as such:
+* Use the engine-config to append the appropriate custom properties
+ as such:
+
+Custom property which removes MAC and ARP spoofing filtering
+for all interfaces in a VM:
+
sudo engine-config -s UserDefinedVMProperties=
'previousProperties;macspoof=^(true|false)$' --cver=3.2
-* Verify that the macspoof custom property was properly added:
+Custom property which removes MAC and ARP spoofing filtering
+for a specific vnic in a VM:
+
+ sudo engine-config -s UserDefinedVMProperties=
+ 'previousProperties;macspoofperdevice=^(true|false)$' --cver=3.2
+
+* Verify that the macspoof custom propertes were properly added:
sudo engine-config -g UserDefinedVMProperties
Usage:
In the VM configuration window, open the custom properites tab
-and add macspoof=true
+and add macspoof=true for applying filtering to all VM's interfaces.
+
+In the vnic profiles configuration window, open the custom properties
+tab and add macspoof=true for applying filtering to the specific
+interface.
diff --git a/vdsm_hooks/macspoof/before_device_create.py b/vdsm_hooks/macspoof/before_device_create.py
new file mode 100755
index 0000000..9c7c9e2
--- /dev/null
+++ b/vdsm_hooks/macspoof/before_device_create.py
@@ -0,0 +1,66 @@
+#!/usr/bin/python
+
+import os
+import hooking
+
+
+def removeMacSpoofingFilter(interface):
+ for filterElement in interface.getElementsByTagName('filterref'):
+ if isMacSpoofingFilter(filterElement):
+ removeFilter(interface, filterElement)
+
+
+def isMacSpoofingFilter(filterElement):
+ """
+ Accept a filter DOM element
+ and checks if it's a mac spoofing filter
+ """
+ filterValue = filterElement.getAttribute('filter')
+ return filterValue == 'vdsm-no-mac-spoofing'
+
+
+def removeFilter(interface, filterElement):
+ """
+ Accept an interface DOM element
+ and a filter DOM element and remove the filter from the DOM.
+ """
+ interface.removeChild(filterElement)
+
+
+def main():
+
+ if hooking.tobool(os.environ.get('macspoofperdevice')):
+ domxml = hooking.read_domxml()
+
+ for interface in domxml.getElementsByTagName('interface'):
+ removeMacSpoofingFilter(interface)
+
+ hooking.write_domxml(domxml)
+
+
+def test():
+ import xml.dom
+
+ interface = xml.dom.minidom.parseString("""
+ <interface type="bridge">
+ <address bus="0x00" domain="0x0000" function="0x0" slot="0x03"\
+ type="pci"/>
+ <mac address="00:1a:4a:16:01:b0"/>
+ <model type="virtio"/>
+ <source bridge="ovirtmgmt"/>
+ <filterref filter="vdsm-no-mac-spoofing"/>
+ <link state="up"/>
+ <boot order="1"/>
+ </interface>
+ """).getElementsByTagName('interface')[0]
+
+ print "Interface before removing filter: %s" % \
+ interface.toxml(encoding='UTF-8')
+
+ removeMacSpoofingFilter(interface)
+ print "Interface after removing filter: %s" % \
+ interface.toxml(encoding='UTF-8')
+
+
+if __name__ == '__main__':
+ main()
--
To view, visit http://gerrit.ovirt.org/17678
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ifb3e7bec7ce400dddc6f4e649b7d21dfe5010631
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Giuseppe Vallarelli <gvallare at redhat.com>
More information about the vdsm-patches
mailing list