(vm_name, vm_ip, vm_mac, vif, is_first_nic=False)
| 278 | |
| 279 | |
| 280 | def default_ebtables_rules(vm_name, vm_ip, vm_mac, vif, is_first_nic=False): |
| 281 | eb_vm_chain=ebtables_chain_name(vm_name) |
| 282 | vmchain_in = eb_vm_chain + "-in" |
| 283 | vmchain_out = eb_vm_chain + "-out" |
| 284 | vmchain_in_ips = eb_vm_chain + "-in-ips" |
| 285 | vmchain_out_ips = eb_vm_chain + "-out-ips" |
| 286 | vmchain_in_src = eb_vm_chain + "-in-src" |
| 287 | vmchain_out_dst = eb_vm_chain + "-out-dst" |
| 288 | |
| 289 | if not is_first_nic: |
| 290 | try: |
| 291 | execute("ebtables -t nat -A PREROUTING -i " + vif + " -j " + vmchain_in) |
| 292 | execute("ebtables -t nat -A POSTROUTING -o " + vif + " -j " + vmchain_out) |
| 293 | execute("ebtables -t nat -I " + vmchain_in_src + " -s " + vm_mac + " -j RETURN") |
| 294 | if vm_ip: |
| 295 | execute("ebtables -t nat -I " + vmchain_in_ips + " -p ARP -s " + vm_mac + " --arp-mac-src " + vm_mac + " --arp-ip-src " + vm_ip + " -j RETURN") |
| 296 | execute("ebtables -t nat -I " + vmchain_out_dst + " -p ARP --arp-op Reply --arp-mac-dst " + vm_mac + " -j RETURN") |
| 297 | if vm_ip: |
| 298 | execute("ebtables -t nat -I " + vmchain_out_ips + " -p ARP --arp-ip-dst " + vm_ip + " -j RETURN") |
| 299 | except: |
| 300 | logging.debug("Failed to program rules for additional nic " + vif) |
| 301 | return False |
| 302 | return |
| 303 | |
| 304 | destroy_ebtables_rules(vm_name, vif) |
| 305 | |
| 306 | for chain in [vmchain_in, vmchain_out, vmchain_in_ips, vmchain_out_ips, vmchain_in_src, vmchain_out_dst]: |
| 307 | try: |
| 308 | execute("ebtables -t nat -N " + chain) |
| 309 | except: |
| 310 | execute("ebtables -t nat -F " + chain) |
| 311 | |
| 312 | try: |
| 313 | # -s ! 52:54:0:56:44:32 -j DROP |
| 314 | execute("ebtables -t nat -A PREROUTING -i " + vif + " -j " + vmchain_in) |
| 315 | execute("ebtables -t nat -A POSTROUTING -o " + vif + " -j " + vmchain_out) |
| 316 | execute("ebtables -t nat -A " + vmchain_in_ips + " -j DROP") |
| 317 | execute("ebtables -t nat -A " + vmchain_out_ips + " -j DROP") |
| 318 | execute("ebtables -t nat -A " + vmchain_in_src + " -j DROP") |
| 319 | execute("ebtables -t nat -A " + vmchain_out_dst + " -p ARP --arp-op Reply -j DROP") |
| 320 | |
| 321 | except: |
| 322 | logging.debug("Failed to program default rules") |
| 323 | return False |
| 324 | |
| 325 | try: |
| 326 | execute("ebtables -t nat -A " + vmchain_in + " -j " + vmchain_in_src) |
| 327 | execute("ebtables -t nat -I " + vmchain_in_src + " -s " + vm_mac + " -j RETURN") |
| 328 | execute("ebtables -t nat -A " + vmchain_in + " -p ARP -j " + vmchain_in_ips) |
| 329 | if vm_ip: |
| 330 | execute("ebtables -t nat -I " + vmchain_in_ips + " -p ARP -s " + vm_mac + " --arp-mac-src " + vm_mac + " --arp-ip-src " + vm_ip + " -j RETURN") |
| 331 | execute("ebtables -t nat -A " + vmchain_in + " -p ARP --arp-op Request -j ACCEPT") |
| 332 | execute("ebtables -t nat -A " + vmchain_in + " -p ARP --arp-op Reply -j ACCEPT") |
| 333 | execute("ebtables -t nat -A " + vmchain_in + " -p ARP -j DROP") |
| 334 | except: |
| 335 | logging.exception("Failed to program default ebtables IN rules") |
| 336 | return False |
| 337 |
no test coverage detected