Change in vdsm[master]: New hook that disables mac spoof filtering

amuller at redhat.com amuller at redhat.com
Thu Mar 7 13:16:05 UTC 2013


Assaf Muller has uploaded a new change for review.

Change subject: New hook that disables mac spoof filtering
......................................................................

New hook that disables mac spoof filtering

'macspoof' is a new hook that disables mac spoof filtering on a
VM basis.

Change-Id: I437d114dbd596e5f7e1a302a8f95c2ecdc4b4347
Signed-off-by: Assaf Muller <amuller at redhat.com>
---
M configure.ac
M vdsm.spec.in
M vdsm_hooks/Makefile.am
A vdsm_hooks/macspoof/Makefile.am
A vdsm_hooks/macspoof/README
A vdsm_hooks/macspoof/before_vm_start.py
6 files changed, 124 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/33/12833/1

diff --git a/configure.ac b/configure.ac
index 434d209..a86e0b9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -200,6 +200,7 @@
 	vdsm_hooks/hostusb/Makefile
 	vdsm_hooks/hugepages/Makefile
 	vdsm_hooks/isolatedprivatevlan/Makefile
+	vdsm_hooks/macspoof/Makefile
 	vdsm_hooks/Makefile
 	vdsm_hooks/nestedvt/Makefile
 	vdsm_hooks/numa/Makefile
diff --git a/vdsm.spec.in b/vdsm.spec.in
index 38838ea..99944c9 100644
--- a/vdsm.spec.in
+++ b/vdsm.spec.in
@@ -284,6 +284,13 @@
 VDSM hook enable user to add storage LUN for VDSM
 without the sharing and storage handling of VDSM.
 
+%package hook-macspoof
+Summary:        Disables MAC spoofing filtering
+BuildArch:      noarch
+
+%description hook-macspoof
+VDSM hook that disables mac spoof filtering on all the of the VM's interfaces.
+
 %package hook-fileinject
 Summary:        Allow uploading file to VMs disk
 BuildArch:      noarch
@@ -866,6 +873,10 @@
 %{_libexecdir}/%{vdsm_name}/hooks/before_vm_dehibernate/50_vhostmd
 %{_libexecdir}/%{vdsm_name}/hooks/after_vm_destroy/50_vhostmd
 
+%files hook-macspoof
+%defattr(-, root, root, -)
+%{_libexecdir}/%{vdsm_name}/hooks/before_vm_start/50_macspoof
+
 %files hook-qemucmdline
 %defattr(-, root, root, -)
 %doc COPYING
diff --git a/vdsm_hooks/Makefile.am b/vdsm_hooks/Makefile.am
index 0e27a98..b417271 100644
--- a/vdsm_hooks/Makefile.am
+++ b/vdsm_hooks/Makefile.am
@@ -31,6 +31,7 @@
 	hostusb \
 	hugepages \
 	isolatedprivatevlan \
+	macspoof \
 	nestedvt \
 	numa \
 	pincpu \
diff --git a/vdsm_hooks/macspoof/Makefile.am b/vdsm_hooks/macspoof/Makefile.am
new file mode 100644
index 0000000..68c70f9
--- /dev/null
+++ b/vdsm_hooks/macspoof/Makefile.am
@@ -0,0 +1,31 @@
+#
+# Copyright 2013 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+#
+# Refer to the README and COPYING files for full details of the license
+#
+
+EXTRA_DIST = \
+	before_vm_start.py
+
+install-data-local:
+	$(MKDIR_P) $(DESTDIR)$(vdsmhooksdir)/before_vm_start
+	$(INSTALL_SCRIPT) $(srcdir)/before_vm_start.py \
+		$(DESTDIR)$(vdsmhooksdir)/before_vm_start/50_macspoof
+
+uninstall-local:
+	$(RM) $(DESTDIR)$(vdsmhooksdir)/before_vm_start/50_macspoof
+
diff --git a/vdsm_hooks/macspoof/README b/vdsm_hooks/macspoof/README
new file mode 100644
index 0000000..e82b2f0
--- /dev/null
+++ b/vdsm_hooks/macspoof/README
@@ -0,0 +1,13 @@
+macspoof vdsm hook
+=================================
+This hook goes through all of the VM's interfaces and removes MAC and ARP spoofing filtering.
+
+Installation:
+* Use the engine-config to append the appropriate custom property as such:
+	sudo engine-config -s UserDefinedVMProperties='previousProperties;macspoof=^(true|false)$' --cver=3.2
+
+* Verify that the macspoof custom property was properly added:
+	sudo engine-config -g UserDefinedVMProperties
+
+Usage:
+In the VM configuration window, open the custom properites tab and add macspoof=true
diff --git a/vdsm_hooks/macspoof/before_vm_start.py b/vdsm_hooks/macspoof/before_vm_start.py
new file mode 100755
index 0000000..fde594e
--- /dev/null
+++ b/vdsm_hooks/macspoof/before_vm_start.py
@@ -0,0 +1,67 @@
+#!/usr/bin/python
+
+import os
+import hooking
+
+
+def removeMacSpoofingFilter(interface):
+    for filterElement in interface.getElementsByTagName('filterref'):
+        if isMacSpoofingFilter(filterElement):
+            removeFilter(interface, filterElement)
+
+
+def isMacSpoofingFilter(filterElement):
+    """
+    Accept a filter DOM element
+    and checks if it's a mac spoofing/ARP spoofing filter
+    """
+    filterValue = filterElement.getAttribute('filter')
+    return filterValue == 'vdsm-no-mac-spoofing' or \
+        filterValue == 'vdsm-no-arp-mac-spoofing'
+
+
+def removeFilter(interface, filterElement):
+    """
+    Accept an interface DOM element
+    and a filter DOM element and remove the filter from the DOM.
+    """
+    interface.removeChild(filterElement)
+
+
+def main():
+
+    if 'macspoof' in os.environ and os.environ.get('macspoof') == 'true':
+        domxml = hooking.read_domxml()
+
+        for interface in domxml.getElementsByTagName('interface'):
+            removeMacSpoofingFilter(interface)
+
+        hooking.write_domxml(domxml)
+
+
+def test():
+    import xml.dom
+
+    interface = xml.dom.minidom.parseString("""
+    <interface type="bridge">
+        <address bus="0x00" domain="0x0000" function="0x0" slot="0x03"\
+                                            type="pci"/>
+        <mac address="00:1a:4a:16:01:b0"/>
+        <model type="virtio"/>
+        <source bridge="ovirtmgmt"/>
+        <filterref filter="vdsm-no-mac-spoofing"/>
+        <link state="up"/>
+        <boot order="1"/>
+    </interface>
+    """).getElementsByTagName('interface')[0]
+
+    print "Interface before removing filter: %s" % \
+        interface.toxml(encoding='UTF-8')
+
+    removeMacSpoofingFilter(interface)
+    print "Interface after removing filter: %s" % \
+        interface.toxml(encoding='UTF-8')
+
+
+if __name__ == '__main__':
+    main()


--
To view, visit http://gerrit.ovirt.org/12833
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I437d114dbd596e5f7e1a302a8f95c2ecdc4b4347
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Assaf Muller <amuller at redhat.com>


More information about the vdsm-patches mailing list