Add support for so-far missing protocols for iptables filtering

This patch adds filtering support for the so-far missing protocols 'ah',
'esp' and 'udplite'.

diff --git a/src/conf/nwfilter_conf.c b/src/conf/nwfilter_conf.c
index 668918d6cdc5278d4d2f83c46b99f45514eefd26..9c9dde3d7f916748831b1d140f378398cf506bb1 100644 (file)
--- a/src/conf/nwfilter_conf.c
+++ b/src/conf/nwfilter_conf.c
@@ -83,6 +83,9 @@ VIR_ENUM_IMPL(virNWFilterRuleProtocol, VIR_NWFILTER_RULE_PROTOCOL_LAST,
               "icmp",
               "igmp",
               "udp",
+              "udplite",
+              "esp",
+              "ah",
               "sctp",
               "all");
 
@@ -584,6 +587,17 @@ static const struct int_map ipProtoMap[] = {
     } , {
         .attr = IPPROTO_UDP,
         .val  = "udp",
+#ifdef IPPROTO_UDPLITE
+    } , {
+        .attr = IPPROTO_UDPLITE,
+        .val  = "udplite",
+#endif
+    } , {
+        .attr = IPPROTO_ESP,
+        .val  = "esp",
+    } , {
+        .attr = IPPROTO_AH,
+        .val  = "ah",
     } , {
         .attr = IPPROTO_ICMP,
         .val  = "icmp",
@@ -948,6 +962,26 @@ static const virXMLAttr2Struct udpAttributes[] = {
     }
 };
 
+static const virXMLAttr2Struct udpliteAttributes[] = {
+    COMMON_IP_PROPS(udpliteHdrFilter),
+    {
+        .name = NULL,
+    }
+};
+
+static const virXMLAttr2Struct espAttributes[] = {
+    COMMON_IP_PROPS(espHdrFilter),
+    {
+        .name = NULL,
+    }
+};
+
+static const virXMLAttr2Struct ahAttributes[] = {
+    COMMON_IP_PROPS(ahHdrFilter),
+    {
+        .name = NULL,
+    }
+};
 
 static const virXMLAttr2Struct sctpAttributes[] = {
     COMMON_IP_PROPS(sctpHdrFilter),
@@ -1025,6 +1059,18 @@ static const virAttributes virAttr[] = {
         .id = "udp",
         .att = udpAttributes,
         .prtclType = VIR_NWFILTER_RULE_PROTOCOL_UDP,
+    }, {
+        .id = "udplite",
+        .att = udpliteAttributes,
+        .prtclType = VIR_NWFILTER_RULE_PROTOCOL_UDPLITE,
+    }, {
+        .id = "esp",
+        .att = espAttributes,
+        .prtclType = VIR_NWFILTER_RULE_PROTOCOL_ESP,
+    }, {
+        .id = "ah",
+        .att = ahAttributes,
+        .prtclType = VIR_NWFILTER_RULE_PROTOCOL_AH,
     }, {
         .id = "sctp",
         .att = sctpAttributes,
@@ -1494,6 +1540,39 @@ virNWFilterRuleDefFixup(virNWFilterRuleDefPtr rule)
                       rule->p.udpHdrFilter.portData.dataSrcPortStart);
     break;
 
+    case VIR_NWFILTER_RULE_PROTOCOL_UDPLITE:
+        COPY_NEG_SIGN(rule->p.udpliteHdrFilter.ipHdr.dataSrcIPMask,
+                      rule->p.udpliteHdrFilter.ipHdr.dataSrcIPAddr);
+        COPY_NEG_SIGN(rule->p.udpliteHdrFilter.ipHdr.dataDstIPMask,
+                      rule->p.udpliteHdrFilter.ipHdr.dataDstIPAddr);
+        COPY_NEG_SIGN(rule->p.udpliteHdrFilter.ipHdr.dataSrcIPTo,
+                      rule->p.udpliteHdrFilter.ipHdr.dataSrcIPFrom);
+        COPY_NEG_SIGN(rule->p.udpliteHdrFilter.ipHdr.dataDstIPTo,
+                      rule->p.udpliteHdrFilter.ipHdr.dataDstIPFrom);
+    break;
+
+    case VIR_NWFILTER_RULE_PROTOCOL_ESP:
+        COPY_NEG_SIGN(rule->p.espHdrFilter.ipHdr.dataSrcIPMask,
+                      rule->p.espHdrFilter.ipHdr.dataSrcIPAddr);
+        COPY_NEG_SIGN(rule->p.espHdrFilter.ipHdr.dataDstIPMask,
+                      rule->p.espHdrFilter.ipHdr.dataDstIPAddr);
+        COPY_NEG_SIGN(rule->p.espHdrFilter.ipHdr.dataSrcIPTo,
+                      rule->p.espHdrFilter.ipHdr.dataSrcIPFrom);
+        COPY_NEG_SIGN(rule->p.espHdrFilter.ipHdr.dataDstIPTo,
+                      rule->p.espHdrFilter.ipHdr.dataDstIPFrom);
+    break;
+
+    case VIR_NWFILTER_RULE_PROTOCOL_AH:
+        COPY_NEG_SIGN(rule->p.ahHdrFilter.ipHdr.dataSrcIPMask,
+                      rule->p.ahHdrFilter.ipHdr.dataSrcIPAddr);
+        COPY_NEG_SIGN(rule->p.ahHdrFilter.ipHdr.dataDstIPMask,
+                      rule->p.ahHdrFilter.ipHdr.dataDstIPAddr);
+        COPY_NEG_SIGN(rule->p.ahHdrFilter.ipHdr.dataSrcIPTo,
+                      rule->p.ahHdrFilter.ipHdr.dataSrcIPFrom);
+        COPY_NEG_SIGN(rule->p.ahHdrFilter.ipHdr.dataDstIPTo,
+                      rule->p.ahHdrFilter.ipHdr.dataDstIPFrom);
+    break;
+
     case VIR_NWFILTER_RULE_PROTOCOL_SCTP:
         COPY_NEG_SIGN(rule->p.sctpHdrFilter.ipHdr.dataSrcIPMask,
                       rule->p.sctpHdrFilter.ipHdr.dataSrcIPAddr);

diff --git a/src/conf/nwfilter_conf.h b/src/conf/nwfilter_conf.h
index 8fafc336943e7af1e29cc447cb442becb0af4737..582df11143c98f49a519a0d0c428bec488532310 100644 (file)
--- a/src/conf/nwfilter_conf.h
+++ b/src/conf/nwfilter_conf.h
@@ -241,6 +241,30 @@ struct _sctpHdrFilterDef {
 };
 
 
+typedef struct _espHdrFilterDef  espHdrFilterDef;
+typedef espHdrFilterDef *espHdrFilterDefPtr;
+struct _espHdrFilterDef {
+    nwItemDesc   dataSrcMACAddr;
+    ipHdrDataDef ipHdr;
+};
+
+
+typedef struct _ahHdrFilterDef  ahHdrFilterDef;
+typedef ahHdrFilterDef *ahHdrFilterDefPtr;
+struct _ahHdrFilterDef {
+    nwItemDesc   dataSrcMACAddr;
+    ipHdrDataDef ipHdr;
+};
+
+
+typedef struct _udpliteHdrFilterDef  udpliteHdrFilterDef;
+typedef udpliteHdrFilterDef *udpliteHdrFilterDefPtr;
+struct _udpliteHdrFilterDef {
+    nwItemDesc   dataSrcMACAddr;
+    ipHdrDataDef ipHdr;
+};
+
+
 enum virNWFilterRuleActionType {
     VIR_NWFILTER_RULE_ACTION_DROP = 0,
     VIR_NWFILTER_RULE_ACTION_ACCEPT,
@@ -273,6 +297,9 @@ enum virNWFilterRuleProtocolType {
     VIR_NWFILTER_RULE_PROTOCOL_ICMP,
     VIR_NWFILTER_RULE_PROTOCOL_IGMP,
     VIR_NWFILTER_RULE_PROTOCOL_UDP,
+    VIR_NWFILTER_RULE_PROTOCOL_UDPLITE,
+    VIR_NWFILTER_RULE_PROTOCOL_ESP,
+    VIR_NWFILTER_RULE_PROTOCOL_AH,
     VIR_NWFILTER_RULE_PROTOCOL_SCTP,
     VIR_NWFILTER_RULE_PROTOCOL_ALL,
 
@@ -306,6 +333,9 @@ struct _virNWFilterRuleDef {
         tcpHdrFilterDef  tcpHdrFilter;
         icmpHdrFilterDef icmpHdrFilter;
         udpHdrFilterDef  udpHdrFilter;
+        udpliteHdrFilterDef  udpliteHdrFilter;
+        espHdrFilterDef  espHdrFilter;
+        ahHdrFilterDef  ahHdrFilter;
         allHdrFilterDef  allHdrFilter;
         igmpHdrFilterDef igmpHdrFilter;
         sctpHdrFilterDef sctpHdrFilter;

diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c
index 78719262e8148cd17b9cae08f1cb7b7dddac9b7c..e59a80af5a9ab90361fbeb5adf57d7a6b573355d 100644 (file)
--- a/src/nwfilter/nwfilter_ebiptables_driver.c
+++ b/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -1089,6 +1089,75 @@ _iptablesCreateRuleInstance(virConnectPtr conn,
             goto err_exit;
     break;
 
+    case VIR_NWFILTER_RULE_PROTOCOL_UDPLITE:
+        virBufferVSprintf(&buf,
+                          CMD_DEF_PRE IPTABLES_CMD " -%%c %s %%s",
+                          chain);
+
+        virBufferAddLit(&buf, " -p udplite");
+
+        if (iptablesHandleSrcMacAddr(conn,
+                                     &buf,
+                                     vars,
+                                     &rule->p.udpliteHdrFilter.dataSrcMACAddr,
+                                     directionIn))
+            goto err_exit;
+
+        if (iptablesHandleIpHdr(conn,
+                                &buf,
+                                vars,
+                                &rule->p.udpliteHdrFilter.ipHdr,
+                                directionIn))
+            goto err_exit;
+
+    break;
+
+    case VIR_NWFILTER_RULE_PROTOCOL_ESP:
+        virBufferVSprintf(&buf,
+                          CMD_DEF_PRE IPTABLES_CMD " -%%c %s %%s",
+                          chain);
+
+        virBufferAddLit(&buf, " -p esp");
+
+        if (iptablesHandleSrcMacAddr(conn,
+                                     &buf,
+                                     vars,
+                                     &rule->p.espHdrFilter.dataSrcMACAddr,
+                                     directionIn))
+            goto err_exit;
+
+        if (iptablesHandleIpHdr(conn,
+                                &buf,
+                                vars,
+                                &rule->p.espHdrFilter.ipHdr,
+                                directionIn))
+            goto err_exit;
+
+    break;
+
+    case VIR_NWFILTER_RULE_PROTOCOL_AH:
+        virBufferVSprintf(&buf,
+                          CMD_DEF_PRE IPTABLES_CMD " -%%c %s %%s",
+                          chain);
+
+        virBufferAddLit(&buf, " -p ah");
+
+        if (iptablesHandleSrcMacAddr(conn,
+                                     &buf,
+                                     vars,
+                                     &rule->p.ahHdrFilter.dataSrcMACAddr,
+                                     directionIn))
+            goto err_exit;
+
+        if (iptablesHandleIpHdr(conn,
+                                &buf,
+                                vars,
+                                &rule->p.ahHdrFilter.ipHdr,
+                                directionIn))
+            goto err_exit;
+
+    break;
+
     case VIR_NWFILTER_RULE_PROTOCOL_SCTP:
         virBufferVSprintf(&buf,
                           CMD_DEF_PRE IPTABLES_CMD " -%%c %s %%s",
@@ -1836,6 +1905,9 @@ ebiptablesCreateRuleInstance(virConnectPtr conn,
 
     case VIR_NWFILTER_RULE_PROTOCOL_TCP:
     case VIR_NWFILTER_RULE_PROTOCOL_UDP:
+    case VIR_NWFILTER_RULE_PROTOCOL_UDPLITE:
+    case VIR_NWFILTER_RULE_PROTOCOL_ESP:
+    case VIR_NWFILTER_RULE_PROTOCOL_AH:
     case VIR_NWFILTER_RULE_PROTOCOL_SCTP:
     case VIR_NWFILTER_RULE_PROTOCOL_ICMP:
     case VIR_NWFILTER_RULE_PROTOCOL_IGMP: