Change in vdsm[master]: New hook that disables mac spoof filtering
amuller at redhat.com
amuller at redhat.com
Thu Mar 7 13:16:05 UTC 2013
Assaf Muller has uploaded a new change for review.
Change subject: New hook that disables mac spoof filtering
......................................................................
New hook that disables mac spoof filtering
'macspoof' is a new hook that disables mac spoof filtering on a
VM basis.
Change-Id: I437d114dbd596e5f7e1a302a8f95c2ecdc4b4347
Signed-off-by: Assaf Muller <amuller at redhat.com>
---
M configure.ac
M vdsm.spec.in
M vdsm_hooks/Makefile.am
A vdsm_hooks/macspoof/Makefile.am
A vdsm_hooks/macspoof/README
A vdsm_hooks/macspoof/before_vm_start.py
6 files changed, 124 insertions(+), 0 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/33/12833/1
diff --git a/configure.ac b/configure.ac
index 434d209..a86e0b9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -200,6 +200,7 @@
vdsm_hooks/hostusb/Makefile
vdsm_hooks/hugepages/Makefile
vdsm_hooks/isolatedprivatevlan/Makefile
+ vdsm_hooks/macspoof/Makefile
vdsm_hooks/Makefile
vdsm_hooks/nestedvt/Makefile
vdsm_hooks/numa/Makefile
diff --git a/vdsm.spec.in b/vdsm.spec.in
index 38838ea..99944c9 100644
--- a/vdsm.spec.in
+++ b/vdsm.spec.in
@@ -284,6 +284,13 @@
VDSM hook enable user to add storage LUN for VDSM
without the sharing and storage handling of VDSM.
+%package hook-macspoof
+Summary: Disables MAC spoofing filtering
+BuildArch: noarch
+
+%description hook-macspoof
+VDSM hook that disables mac spoof filtering on all the of the VM's interfaces.
+
%package hook-fileinject
Summary: Allow uploading file to VMs disk
BuildArch: noarch
@@ -866,6 +873,10 @@
%{_libexecdir}/%{vdsm_name}/hooks/before_vm_dehibernate/50_vhostmd
%{_libexecdir}/%{vdsm_name}/hooks/after_vm_destroy/50_vhostmd
+%files hook-macspoof
+%defattr(-, root, root, -)
+%{_libexecdir}/%{vdsm_name}/hooks/before_vm_start/50_macspoof
+
%files hook-qemucmdline
%defattr(-, root, root, -)
%doc COPYING
diff --git a/vdsm_hooks/Makefile.am b/vdsm_hooks/Makefile.am
index 0e27a98..b417271 100644
--- a/vdsm_hooks/Makefile.am
+++ b/vdsm_hooks/Makefile.am
@@ -31,6 +31,7 @@
hostusb \
hugepages \
isolatedprivatevlan \
+ macspoof \
nestedvt \
numa \
pincpu \
diff --git a/vdsm_hooks/macspoof/Makefile.am b/vdsm_hooks/macspoof/Makefile.am
new file mode 100644
index 0000000..68c70f9
--- /dev/null
+++ b/vdsm_hooks/macspoof/Makefile.am
@@ -0,0 +1,31 @@
+#
+# Copyright 2013 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+#
+# Refer to the README and COPYING files for full details of the license
+#
+
+EXTRA_DIST = \
+ before_vm_start.py
+
+install-data-local:
+ $(MKDIR_P) $(DESTDIR)$(vdsmhooksdir)/before_vm_start
+ $(INSTALL_SCRIPT) $(srcdir)/before_vm_start.py \
+ $(DESTDIR)$(vdsmhooksdir)/before_vm_start/50_macspoof
+
+uninstall-local:
+ $(RM) $(DESTDIR)$(vdsmhooksdir)/before_vm_start/50_macspoof
+
diff --git a/vdsm_hooks/macspoof/README b/vdsm_hooks/macspoof/README
new file mode 100644
index 0000000..e82b2f0
--- /dev/null
+++ b/vdsm_hooks/macspoof/README
@@ -0,0 +1,13 @@
+macspoof vdsm hook
+=================================
+This hook goes through all of the VM's interfaces and removes MAC and ARP spoofing filtering.
+
+Installation:
+* Use the engine-config to append the appropriate custom property as such:
+ sudo engine-config -s UserDefinedVMProperties='previousProperties;macspoof=^(true|false)$' --cver=3.2
+
+* Verify that the macspoof custom property was properly added:
+ sudo engine-config -g UserDefinedVMProperties
+
+Usage:
+In the VM configuration window, open the custom properites tab and add macspoof=true
diff --git a/vdsm_hooks/macspoof/before_vm_start.py b/vdsm_hooks/macspoof/before_vm_start.py
new file mode 100755
index 0000000..fde594e
--- /dev/null
+++ b/vdsm_hooks/macspoof/before_vm_start.py
@@ -0,0 +1,67 @@
+#!/usr/bin/python
+
+import os
+import hooking
+
+
+def removeMacSpoofingFilter(interface):
+ for filterElement in interface.getElementsByTagName('filterref'):
+ if isMacSpoofingFilter(filterElement):
+ removeFilter(interface, filterElement)
+
+
+def isMacSpoofingFilter(filterElement):
+ """
+ Accept a filter DOM element
+ and checks if it's a mac spoofing/ARP spoofing filter
+ """
+ filterValue = filterElement.getAttribute('filter')
+ return filterValue == 'vdsm-no-mac-spoofing' or \
+ filterValue == 'vdsm-no-arp-mac-spoofing'
+
+
+def removeFilter(interface, filterElement):
+ """
+ Accept an interface DOM element
+ and a filter DOM element and remove the filter from the DOM.
+ """
+ interface.removeChild(filterElement)
+
+
+def main():
+
+ if 'macspoof' in os.environ and os.environ.get('macspoof') == 'true':
+ domxml = hooking.read_domxml()
+
+ for interface in domxml.getElementsByTagName('interface'):
+ removeMacSpoofingFilter(interface)
+
+ hooking.write_domxml(domxml)
+
+
+def test():
+ import xml.dom
+
+ interface = xml.dom.minidom.parseString("""
+ <interface type="bridge">
+ <address bus="0x00" domain="0x0000" function="0x0" slot="0x03"\
+ type="pci"/>
+ <mac address="00:1a:4a:16:01:b0"/>
+ <model type="virtio"/>
+ <source bridge="ovirtmgmt"/>
+ <filterref filter="vdsm-no-mac-spoofing"/>
+ <link state="up"/>
+ <boot order="1"/>
+ </interface>
+ """).getElementsByTagName('interface')[0]
+
+ print "Interface before removing filter: %s" % \
+ interface.toxml(encoding='UTF-8')
+
+ removeMacSpoofingFilter(interface)
+ print "Interface after removing filter: %s" % \
+ interface.toxml(encoding='UTF-8')
+
+
+if __name__ == '__main__':
+ main()
--
To view, visit http://gerrit.ovirt.org/12833
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I437d114dbd596e5f7e1a302a8f95c2ecdc4b4347
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Assaf Muller <amuller at redhat.com>
More information about the vdsm-patches
mailing list