Change in vdsm[master]: hook: noipspoof: consume libvirt's clean-traffic filter

danken at redhat.com danken at redhat.com
Mon Jun 23 21:50:06 UTC 2014


Dan Kenigsberg has uploaded a new change for review.

Change subject: hook: noipspoof: consume libvirt's clean-traffic filter
......................................................................

hook: noipspoof: consume libvirt's clean-traffic filter

This hook converts all vnic filters of a VM to the clean-traffic filter.
The list of valid IP addresses is specified as a VM-wide custom
property.

A VM-wide custom property has been chosen since Engine does not allow
setting per-VM vnic properties (but rather only vnic-type ones).

Change-Id: Id99d9211576235be0374bde5aea5ecf7a146b979
Signed-off-by: Dan Kenigsberg <danken at redhat.com>
---
M configure.ac
A debian/vdsm-hook-noipspoof.docs
A debian/vdsm-hook-noipspoof.install
M vdsm.spec.in
M vdsm_hooks/Makefile.am
A vdsm_hooks/noipspoof/Makefile.am
A vdsm_hooks/noipspoof/noipspoof.py
7 files changed, 138 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/93/29093/1

diff --git a/configure.ac b/configure.ac
index 885572e..752beb9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -296,6 +296,7 @@
 	vdsm_hooks/macbind/Makefile
 	vdsm_hooks/macspoof/Makefile
 	vdsm_hooks/nestedvt/Makefile
+	vdsm_hooks/noipspoof/Makefile
 	vdsm_hooks/numa/Makefile
 	vdsm_hooks/openstacknet/Makefile
 	vdsm_hooks/pincpu/Makefile
diff --git a/debian/vdsm-hook-noipspoof.docs b/debian/vdsm-hook-noipspoof.docs
new file mode 100644
index 0000000..5ecd9c6
--- /dev/null
+++ b/debian/vdsm-hook-noipspoof.docs
@@ -0,0 +1 @@
+COPYING
diff --git a/debian/vdsm-hook-noipspoof.install b/debian/vdsm-hook-noipspoof.install
new file mode 100644
index 0000000..c72c262
--- /dev/null
+++ b/debian/vdsm-hook-noipspoof.install
@@ -0,0 +1,2 @@
+usr/libexec/vdsm/hooks/before_device_create/50_noipspoof
+usr/libexec/vdsm/hooks/before_nic_hotplug/50_noipspoof
diff --git a/vdsm.spec.in b/vdsm.spec.in
index 949611f..11e4947 100644
--- a/vdsm.spec.in
+++ b/vdsm.spec.in
@@ -411,6 +411,14 @@
 either on all the of the VM's interfaces or on
 specific vnics.
 
+%package hook-noipspoof
+Summary:        Enables strict anti-spoofing filtering
+BuildArch:      noarch
+
+%description hook-noipspoof
+VDSM hooks which allow to enable strict anti-spoofing filtering
+on all the of the VM's interfaces.
+
 %package hook-extnet
 Summary:        Force a vNIC to connect to a specific libvirt network
 BuildArch:      noarch
@@ -1309,6 +1317,11 @@
 %{_libexecdir}/%{vdsm_name}/hooks/before_device_create/50_macspoof
 %{_libexecdir}/%{vdsm_name}/hooks/before_nic_hotplug/50_macspoof
 
+%files hook-noipspoof
+%defattr(-, root, root, -)
+%{_libexecdir}/%{vdsm_name}/hooks/before_device_create/50_noipspoof
+%{_libexecdir}/%{vdsm_name}/hooks/before_nic_hotplug/50_noipspoof
+
 %files hook-extnet
 %defattr(-, root, root, -)
 %{_libexecdir}/%{vdsm_name}/hooks/before_device_create/50_extnet
diff --git a/vdsm_hooks/Makefile.am b/vdsm_hooks/Makefile.am
index 5e4d731..70239d5 100644
--- a/vdsm_hooks/Makefile.am
+++ b/vdsm_hooks/Makefile.am
@@ -37,6 +37,7 @@
 	macbind \
 	macspoof \
 	nestedvt \
+	noipspoof \
 	numa \
 	pincpu \
 	promisc \
diff --git a/vdsm_hooks/noipspoof/Makefile.am b/vdsm_hooks/noipspoof/Makefile.am
new file mode 100644
index 0000000..0ec5e89
--- /dev/null
+++ b/vdsm_hooks/noipspoof/Makefile.am
@@ -0,0 +1,36 @@
+#
+# Copyright 2014 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+#
+# Refer to the README and COPYING files for full details of the license
+#
+
+EXTRA_DIST = \
+	noipspoof.py \
+	$(NULL)
+
+install-data-local:
+	$(MKDIR_P) $(DESTDIR)$(vdsmhooksdir)/before_device_create
+	$(INSTALL_SCRIPT) $(srcdir)/noipspoof.py \
+		$(DESTDIR)$(vdsmhooksdir)/before_device_create/50_noipspoof
+	$(MKDIR_P) $(DESTDIR)$(vdsmhooksdir)/before_nic_hotplug
+	$(INSTALL_SCRIPT) $(srcdir)/noipspoof.py \
+		$(DESTDIR)$(vdsmhooksdir)/before_nic_hotplug/50_noipspoof
+
+uninstall-local:
+	$(RM) $(DESTDIR)$(vdsmhooksdir)/before_device_create/50_noipspoof
+	$(RM) $(DESTDIR)$(vdsmhooksdir)/before_nic_hotplug/50_noipspoof
+
diff --git a/vdsm_hooks/noipspoof/noipspoof.py b/vdsm_hooks/noipspoof/noipspoof.py
new file mode 100755
index 0000000..2f1f612
--- /dev/null
+++ b/vdsm_hooks/noipspoof/noipspoof.py
@@ -0,0 +1,84 @@
+#!/usr/bin/python
+"""
+This hook allows to replace the default no-mac-spoof filter with a the stricter
+clean-traffic. To activate this hook
+- install this file as a before_vm_start hook
+- define the noipspoof custom property
+sudo engine-config -s "UserDefinedVMProperties=noipspoof=^[0-9.]*$"
+- enabled per a specfic VM by setting its noipspoof to a comman-separated list
+  of valid IP addresses for it.
+"""
+
+import os
+import sys
+
+import hooking
+
+
+def replaceMacSpoofingFilter(interface, IPs):
+    for filterElement in interface.getElementsByTagName('filterref'):
+        if isMacSpoofingFilter(filterElement):
+            replaceFilter(interface, filterElement, IPs)
+
+
+def isMacSpoofingFilter(filterElement):
+    """
+    Accept a filter DOM element
+    and checks if it's a mac spoofing filter
+    """
+    filterValue = filterElement.getAttribute('filter')
+    return filterValue == 'vdsm-no-mac-spoofing'
+
+
+def replaceFilter(interface, filterElement, IPs):
+    """
+    Accept an interface DOM element
+    and a filter DOM element and remove the filter from the DOM.
+    """
+    filterElement.attributes['filter'] = 'clean-traffic'
+    for ip in IPs:
+        param = filterElement.ownerDocument.createElement('parameter')
+        param.attributes['name'] = 'IP'
+        param.attributes['value'] = ip
+        filterElement.appendChild(param)
+
+
+def main():
+
+    IPs = os.environ.get('noipspoof', '').split(',')
+    if IPs:
+        domxml = hooking.read_domxml()
+        interface, = domxml.getElementsByTagName('interface')
+        replaceMacSpoofingFilter(interface, IPs)
+        hooking.write_domxml(domxml)
+
+
+def test():
+    import xml.dom
+
+    interface = xml.dom.minidom.parseString("""
+    <interface type="bridge">
+        <address bus="0x00" domain="0x0000" function="0x0" slot="0x03"\
+                                            type="pci"/>
+        <mac address="00:1a:4a:16:01:b0"/>
+        <model type="virtio"/>
+        <source bridge="ovirtmgmt"/>
+        <filterref filter="vdsm-no-mac-spoofing"/>
+        <link state="up"/>
+        <boot order="1"/>
+    </interface>
+    """).getElementsByTagName('interface')[0]
+
+    print "Interface before removing filter: %s\n" % \
+        interface.toxml(encoding='UTF-8')
+
+    replaceMacSpoofingFilter(interface, ['192.168.1.1', 'nonsense'])
+    print "Interface after removing filter: %s\n" % \
+        interface.toxml(encoding='UTF-8')
+
+
+if __name__ == '__main__':
+    if '--test' in sys.argv:
+        test()
+    else:
+        main()


-- 
To view, visit http://gerrit.ovirt.org/29093
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Id99d9211576235be0374bde5aea5ecf7a146b979
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Dan Kenigsberg <danken at redhat.com>


More information about the vdsm-patches mailing list