[pve-devel] [PATCH 3/3] pve-bridge-fw script and pass fwenable to tap_plug
Alexandre Derumier
aderumier at odiso.com
Tue May 6 12:46:36 CEST 2014
-we now use a new pve-bridge-fw script if firewall is enable.
-we also need to pass fwenable value to tap_plug.
(If user change online the vlan, bridge or firewall for the interface)
-we also need to pass vmfw_conf to device hotplug
Signed-off-by: Alexandre Derumier <aderumier at odiso.com>
---
Makefile | 1 +
PVE/API2/Qemu.pm | 13 +++++++++----
PVE/QemuServer.pm | 30 ++++++++++++++++++++----------
pve-bridge | 2 +-
pve-bridge-fw | 35 +++++++++++++++++++++++++++++++++++
5 files changed, 66 insertions(+), 15 deletions(-)
create mode 100755 pve-bridge-fw
diff --git a/Makefile b/Makefile
index 99dc897..535ad92 100644
--- a/Makefile
+++ b/Makefile
@@ -81,6 +81,7 @@ install: ${PKGSOURCES}
install -D -m 0755 qmupdate ${DESTDIR}${VARLIBDIR}/qmupdate
install -D -m 0755 qemu.init.d ${DESTDIR}/etc/init.d/${PACKAGE}
install -m 0755 pve-bridge ${DESTDIR}${VARLIBDIR}/pve-bridge
+ install -m 0755 pve-bridge-fw ${DESTDIR}${VARLIBDIR}/pve-bridge-fw
install -m 0755 pve-bridgedown ${DESTDIR}${VARLIBDIR}/pve-bridgedown
install -s -m 0755 vmtar ${DESTDIR}${LIBDIR}
install -s -m 0755 sparsecp ${DESTDIR}${LIBDIR}
diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index e7d49d9..460931c 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -820,7 +820,7 @@ my $vmconfig_update_disk = sub {
};
my $vmconfig_update_net = sub {
- my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value) = @_;
+ my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value, $vmfw_conf) = @_;
if ($conf->{$opt} && PVE::QemuServer::check_running($vmid)) {
my $oldnet = PVE::QemuServer::parse_net($conf->{$opt});
@@ -840,7 +840,11 @@ my $vmconfig_update_net = sub {
if(($newnet->{bridge} ne $oldnet->{bridge}) || ($newnet->{tag} ne $oldnet->{tag}) || ($newnet->{firewall} ne $oldnet->{firewall})){
eval{PVE::Network::tap_unplug($iface, $oldnet->{bridge}, $oldnet->{tag}, $oldnet->{firewall});};
- PVE::Network::tap_plug($iface, $newnet->{bridge}, $newnet->{tag}, $newnet->{firewall});
+
+ my $fwenable = $vmfw_conf->{options}->{enable};
+ $fwenable = $newnet->{firewall} if $fwenable;
+
+ PVE::Network::tap_plug($iface, $newnet->{bridge}, $newnet->{tag}, $fwenable);
}
}else{
@@ -856,7 +860,7 @@ my $vmconfig_update_net = sub {
my $net = PVE::QemuServer::parse_net($conf->{$opt});
- die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $net);
+ die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $net, $vmfw_conf);
};
# POST/PUT {vmid}/config implementation
@@ -945,6 +949,7 @@ my $update_vm_api = sub {
my $updatefn = sub {
my $conf = PVE::QemuServer::load_config($vmid);
+ my $vmfw_conf = PVE::Firewall::load_vmfw_conf($vmid);
die "checksum missmatch (file change by other user?)\n"
if $digest && $digest ne $conf->{digest};
@@ -986,7 +991,7 @@ my $update_vm_api = sub {
} elsif ($opt =~ m/^net(\d+)$/) { #nics
&$vmconfig_update_net($rpcenv, $authuser, $conf, $storecfg, $vmid,
- $opt, $param->{$opt});
+ $opt, $param->{$opt}, $vmfw_conf);
} else {
diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index 4f93f34..765c8be 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -30,6 +30,7 @@ use PVE::ProcFSTools;
use PVE::QMPClient;
use PVE::RPCEnvironment;
use Time::HiRes qw(gettimeofday);
+use PVE::Firewall;
my $cpuinfo = PVE::ProcFSTools::read_cpuinfo();
@@ -1181,7 +1182,7 @@ sub print_netdevice_full {
}
sub print_netdev_full {
- my ($vmid, $conf, $net, $netid) = @_;
+ my ($vmid, $conf, $net, $netid, $vmfw_conf) = @_;
my $i = '';
if ($netid =~ m/^net(\d+)$/) {
@@ -1202,7 +1203,14 @@ sub print_netdev_full {
my $vmname = $conf->{name} || "vm$vmid";
if ($net->{bridge}) {
- return "type=tap,id=$netid,ifname=${ifname},script=/var/lib/qemu-server/pve-bridge,downscript=/var/lib/qemu-server/pve-bridgedown$vhostparam";
+
+ my $fwenable = $vmfw_conf->{options}->{enable};
+ $fwenable = $net->{firewall} if $fwenable;
+
+ my $bridgescript = "pve-bridge";
+ $bridgescript .= "-fw" if $fwenable;
+
+ return "type=tap,id=$netid,ifname=${ifname},script=/var/lib/qemu-server/$bridgescript,downscript=/var/lib/qemu-server/pve-bridgedown$vhostparam";
} else {
return "type=user,id=$netid,hostname=$vmname";
}
@@ -2282,7 +2290,7 @@ sub vga_conf_has_spice {
}
sub config_to_command {
- my ($storecfg, $vmid, $conf, $defaults, $forcemachine) = @_;
+ my ($storecfg, $vmid, $conf, $defaults, $forcemachine, $vmfw_conf) = @_;
my $cmd = [];
my $globalFlags = [];
@@ -2631,7 +2639,7 @@ sub config_to_command {
$bootindex_hash->{n} += 1;
}
- my $netdevfull = print_netdev_full($vmid,$conf,$d,"net$i");
+ my $netdevfull = print_netdev_full($vmid,$conf,$d,"net$i", $vmfw_conf);
push @$devices, '-netdev', $netdevfull;
my $netdevicefull = print_netdevice_full($vmid,$conf,$d,"net$i",$bridges);
@@ -2720,7 +2728,7 @@ sub vm_devices_list {
}
sub vm_deviceplug {
- my ($storecfg, $conf, $vmid, $deviceid, $device) = @_;
+ my ($storecfg, $conf, $vmid, $deviceid, $device, $vmfw_conf) = @_;
return 1 if !check_running($vmid);
@@ -2767,7 +2775,7 @@ sub vm_deviceplug {
}
if ($deviceid =~ m/^(net)(\d+)$/) {
- return undef if !qemu_netdevadd($vmid, $conf, $device, $deviceid);
+ return undef if !qemu_netdevadd($vmid, $conf, $device, $deviceid, $vmfw_conf);
my $netdevicefull = print_netdevice_full($vmid, $conf, $device, $deviceid);
qemu_deviceadd($vmid, $netdevicefull);
if(!qemu_deviceaddverify($vmid, $deviceid)) {
@@ -2933,9 +2941,9 @@ sub qemu_bridgeadd {
}
sub qemu_netdevadd {
- my ($vmid, $conf, $device, $deviceid) = @_;
+ my ($vmid, $conf, $device, $deviceid, $vmfw_conf) = @_;
- my $netdev = print_netdev_full($vmid, $conf, $device, $deviceid);
+ my $netdev = print_netdev_full($vmid, $conf, $device, $deviceid, $vmfw_conf);
my %options = split(/[=,]/, $netdev);
vm_mon_cmd($vmid, "netdev_add", %options);
@@ -3168,6 +3176,7 @@ sub vm_start {
lock_config($vmid, sub {
my $conf = load_config($vmid, $migratedfrom);
+ my $vmfw_conf = PVE::Firewall::load_vmfw_conf($vmid);
die "you can't start a vm if it's a template\n" if is_template($conf);
@@ -3180,7 +3189,7 @@ sub vm_start {
# set environment variable useful inside network script
$ENV{PVE_MIGRATED_FROM} = $migratedfrom if $migratedfrom;
- my ($cmd, $vollist, $spice_port) = config_to_command($storecfg, $vmid, $conf, $defaults, $forcemachine);
+ my ($cmd, $vollist, $spice_port) = config_to_command($storecfg, $vmid, $conf, $defaults, $forcemachine, $vmfw_conf);
my $migrate_port = 0;
my $migrate_uri;
@@ -3322,10 +3331,11 @@ sub vm_commandline {
my ($storecfg, $vmid) = @_;
my $conf = load_config($vmid);
+ my $vmfw_conf = PVE::Firewall::load_vmfw_conf($vmid);
my $defaults = load_defaults();
- my $cmd = config_to_command($storecfg, $vmid, $conf, $defaults);
+ my $cmd = config_to_command($storecfg, $vmid, $conf, $defaults, $vmfw_conf);
return join(' ', @$cmd);
}
diff --git a/pve-bridge b/pve-bridge
index d6c5eb8..81ad5f4 100755
--- a/pve-bridge
+++ b/pve-bridge
@@ -30,6 +30,6 @@ PVE::Network::tap_create($iface, $net->{bridge});
PVE::Network::tap_rate_limit($iface, $net->{rate}) if $net->{rate};
-PVE::Network::tap_plug($iface, $net->{bridge}, $net->{tag}, $net->{firewall});
+PVE::Network::tap_plug($iface, $net->{bridge}, $net->{tag});
exit 0;
diff --git a/pve-bridge-fw b/pve-bridge-fw
new file mode 100755
index 0000000..f5a6228
--- /dev/null
+++ b/pve-bridge-fw
@@ -0,0 +1,35 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+use PVE::QemuServer;
+use PVE::Tools qw(run_command);
+use PVE::Network;
+
+my $iface = shift;
+
+die "no interface specified\n" if !$iface;
+
+die "got strange interface name '$iface'\n"
+ if $iface !~ m/^tap(\d+)i(\d+)$/;
+
+my $vmid = $1;
+my $netid = "net$2";
+
+my $migratedfrom = $ENV{PVE_MIGRATED_FROM};
+
+my $conf = PVE::QemuServer::load_config($vmid, $migratedfrom);
+
+die "unable to get network config '$netid'\n"
+ if !$conf->{$netid};
+
+my $net = PVE::QemuServer::parse_net($conf->{$netid});
+die "unable to parse network config '$netid'\n" if !$net;
+
+PVE::Network::tap_create($iface, $net->{bridge});
+
+PVE::Network::tap_rate_limit($iface, $net->{rate}) if $net->{rate};
+
+PVE::Network::tap_plug($iface, $net->{bridge}, $net->{tag}, 1);
+
+exit 0;
--
1.7.10.4
More information about the pve-devel
mailing list