Change in vdsm[master]: hook: noipspoof: consume libvirt's clean-traffic filter
danken at redhat.com
danken at redhat.com
Mon Jun 23 21:50:06 UTC 2014
Dan Kenigsberg has uploaded a new change for review.
Change subject: hook: noipspoof: consume libvirt's clean-traffic filter
......................................................................
hook: noipspoof: consume libvirt's clean-traffic filter
This hook converts all vnic filters of a VM to the clean-traffic filter.
The list of valid IP addresses is specified as a VM-wide custom
property.
A VM-wide custom property has been chosen since Engine does not allow
setting per-VM vnic properties (but rather only vnic-type ones).
Change-Id: Id99d9211576235be0374bde5aea5ecf7a146b979
Signed-off-by: Dan Kenigsberg <danken at redhat.com>
---
M configure.ac
A debian/vdsm-hook-noipspoof.docs
A debian/vdsm-hook-noipspoof.install
M vdsm.spec.in
M vdsm_hooks/Makefile.am
A vdsm_hooks/noipspoof/Makefile.am
A vdsm_hooks/noipspoof/noipspoof.py
7 files changed, 138 insertions(+), 0 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/93/29093/1
diff --git a/configure.ac b/configure.ac
index 885572e..752beb9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -296,6 +296,7 @@
vdsm_hooks/macbind/Makefile
vdsm_hooks/macspoof/Makefile
vdsm_hooks/nestedvt/Makefile
+ vdsm_hooks/noipspoof/Makefile
vdsm_hooks/numa/Makefile
vdsm_hooks/openstacknet/Makefile
vdsm_hooks/pincpu/Makefile
diff --git a/debian/vdsm-hook-noipspoof.docs b/debian/vdsm-hook-noipspoof.docs
new file mode 100644
index 0000000..5ecd9c6
--- /dev/null
+++ b/debian/vdsm-hook-noipspoof.docs
@@ -0,0 +1 @@
+COPYING
diff --git a/debian/vdsm-hook-noipspoof.install b/debian/vdsm-hook-noipspoof.install
new file mode 100644
index 0000000..c72c262
--- /dev/null
+++ b/debian/vdsm-hook-noipspoof.install
@@ -0,0 +1,2 @@
+usr/libexec/vdsm/hooks/before_device_create/50_noipspoof
+usr/libexec/vdsm/hooks/before_nic_hotplug/50_noipspoof
diff --git a/vdsm.spec.in b/vdsm.spec.in
index 949611f..11e4947 100644
--- a/vdsm.spec.in
+++ b/vdsm.spec.in
@@ -411,6 +411,14 @@
either on all the of the VM's interfaces or on
specific vnics.
+%package hook-noipspoof
+Summary: Enables strict anti-spoofing filtering
+BuildArch: noarch
+
+%description hook-noipspoof
+VDSM hooks which allow to enable strict anti-spoofing filtering
+on all the of the VM's interfaces.
+
%package hook-extnet
Summary: Force a vNIC to connect to a specific libvirt network
BuildArch: noarch
@@ -1309,6 +1317,11 @@
%{_libexecdir}/%{vdsm_name}/hooks/before_device_create/50_macspoof
%{_libexecdir}/%{vdsm_name}/hooks/before_nic_hotplug/50_macspoof
+%files hook-noipspoof
+%defattr(-, root, root, -)
+%{_libexecdir}/%{vdsm_name}/hooks/before_device_create/50_noipspoof
+%{_libexecdir}/%{vdsm_name}/hooks/before_nic_hotplug/50_noipspoof
+
%files hook-extnet
%defattr(-, root, root, -)
%{_libexecdir}/%{vdsm_name}/hooks/before_device_create/50_extnet
diff --git a/vdsm_hooks/Makefile.am b/vdsm_hooks/Makefile.am
index 5e4d731..70239d5 100644
--- a/vdsm_hooks/Makefile.am
+++ b/vdsm_hooks/Makefile.am
@@ -37,6 +37,7 @@
macbind \
macspoof \
nestedvt \
+ noipspoof \
numa \
pincpu \
promisc \
diff --git a/vdsm_hooks/noipspoof/Makefile.am b/vdsm_hooks/noipspoof/Makefile.am
new file mode 100644
index 0000000..0ec5e89
--- /dev/null
+++ b/vdsm_hooks/noipspoof/Makefile.am
@@ -0,0 +1,36 @@
+#
+# Copyright 2014 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+#
+# Refer to the README and COPYING files for full details of the license
+#
+
+EXTRA_DIST = \
+ noipspoof.py \
+ $(NULL)
+
+install-data-local:
+ $(MKDIR_P) $(DESTDIR)$(vdsmhooksdir)/before_device_create
+ $(INSTALL_SCRIPT) $(srcdir)/noipspoof.py \
+ $(DESTDIR)$(vdsmhooksdir)/before_device_create/50_noipspoof
+ $(MKDIR_P) $(DESTDIR)$(vdsmhooksdir)/before_nic_hotplug
+ $(INSTALL_SCRIPT) $(srcdir)/noipspoof.py \
+ $(DESTDIR)$(vdsmhooksdir)/before_nic_hotplug/50_noipspoof
+
+uninstall-local:
+ $(RM) $(DESTDIR)$(vdsmhooksdir)/before_device_create/50_noipspoof
+ $(RM) $(DESTDIR)$(vdsmhooksdir)/before_nic_hotplug/50_noipspoof
+
diff --git a/vdsm_hooks/noipspoof/noipspoof.py b/vdsm_hooks/noipspoof/noipspoof.py
new file mode 100755
index 0000000..2f1f612
--- /dev/null
+++ b/vdsm_hooks/noipspoof/noipspoof.py
@@ -0,0 +1,84 @@
+#!/usr/bin/python
+"""
+This hook allows to replace the default no-mac-spoof filter with a the stricter
+clean-traffic. To activate this hook
+- install this file as a before_vm_start hook
+- define the noipspoof custom property
+sudo engine-config -s "UserDefinedVMProperties=noipspoof=^[0-9.]*$"
+- enabled per a specfic VM by setting its noipspoof to a comman-separated list
+ of valid IP addresses for it.
+"""
+
+import os
+import sys
+
+import hooking
+
+
+def replaceMacSpoofingFilter(interface, IPs):
+ for filterElement in interface.getElementsByTagName('filterref'):
+ if isMacSpoofingFilter(filterElement):
+ replaceFilter(interface, filterElement, IPs)
+
+
+def isMacSpoofingFilter(filterElement):
+ """
+ Accept a filter DOM element
+ and checks if it's a mac spoofing filter
+ """
+ filterValue = filterElement.getAttribute('filter')
+ return filterValue == 'vdsm-no-mac-spoofing'
+
+
+def replaceFilter(interface, filterElement, IPs):
+ """
+ Accept an interface DOM element
+ and a filter DOM element and remove the filter from the DOM.
+ """
+ filterElement.attributes['filter'] = 'clean-traffic'
+ for ip in IPs:
+ param = filterElement.ownerDocument.createElement('parameter')
+ param.attributes['name'] = 'IP'
+ param.attributes['value'] = ip
+ filterElement.appendChild(param)
+
+
+def main():
+
+ IPs = os.environ.get('noipspoof', '').split(',')
+ if IPs:
+ domxml = hooking.read_domxml()
+ interface, = domxml.getElementsByTagName('interface')
+ replaceMacSpoofingFilter(interface, IPs)
+ hooking.write_domxml(domxml)
+
+
+def test():
+ import xml.dom
+
+ interface = xml.dom.minidom.parseString("""
+ <interface type="bridge">
+ <address bus="0x00" domain="0x0000" function="0x0" slot="0x03"\
+ type="pci"/>
+ <mac address="00:1a:4a:16:01:b0"/>
+ <model type="virtio"/>
+ <source bridge="ovirtmgmt"/>
+ <filterref filter="vdsm-no-mac-spoofing"/>
+ <link state="up"/>
+ <boot order="1"/>
+ </interface>
+ """).getElementsByTagName('interface')[0]
+
+ print "Interface before removing filter: %s\n" % \
+ interface.toxml(encoding='UTF-8')
+
+ replaceMacSpoofingFilter(interface, ['192.168.1.1', 'nonsense'])
+ print "Interface after removing filter: %s\n" % \
+ interface.toxml(encoding='UTF-8')
+
+
+if __name__ == '__main__':
+ if '--test' in sys.argv:
+ test()
+ else:
+ main()
--
To view, visit http://gerrit.ovirt.org/29093
To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Id99d9211576235be0374bde5aea5ecf7a146b979
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Dan Kenigsberg <danken at redhat.com>
More information about the vdsm-patches
mailing list