(vm_name, vm_id, vm_ips, vm_ip6, vm_mac, vif, brname)
| 1489 | return verify_expected_rules_in_order(expected_rules, rules) |
| 1490 | |
| 1491 | def verify_ebtables_rules_for_vm(vm_name, vm_id, vm_ips, vm_ip6, vm_mac, vif, brname): |
| 1492 | vmchain_in = vm_name + "-in" |
| 1493 | vmchain_out = vm_name + "-out" |
| 1494 | vmchain_in_ips = vm_name + "-in-ips" |
| 1495 | vmchain_out_ips = vm_name + "-out-ips" |
| 1496 | vmchain_in_src = vm_name + "-in-src" |
| 1497 | vmchain_out_dst = vm_name + "-out-dst" |
| 1498 | |
| 1499 | new_mac = trim_mac_address(vm_mac) |
| 1500 | |
| 1501 | # PREROUTING/POSTROUTING |
| 1502 | expected_rules = [] |
| 1503 | expected_rules.append("-A PREROUTING -i %s -j %s" % (vif, vmchain_in)) |
| 1504 | expected_rules.append("-A POSTROUTING -o %s -j %s" % (vif, vmchain_out)) |
| 1505 | rules = execute("ebtables-save |grep -E \"PREROUTING|POSTROUTING\" | grep %s" % vm_name).split('\n') |
| 1506 | if not verify_expected_rules_exist(expected_rules, rules): |
| 1507 | return False |
| 1508 | |
| 1509 | rules = execute("ebtables-save | grep %s" % vm_name).split('\n') |
| 1510 | |
| 1511 | # vmchain_in |
| 1512 | expected_rules = [] |
| 1513 | expected_rules.append("-A %s -j %s" % (vmchain_in, vmchain_in_src)) |
| 1514 | expected_rules.append("-A %s -p ARP -j %s" % (vmchain_in, vmchain_in_ips)) |
| 1515 | expected_rules.append("-A %s -p ARP --arp-op Request -j ACCEPT" % (vmchain_in)) |
| 1516 | expected_rules.append("-A %s -p ARP --arp-op Reply -j ACCEPT" % (vmchain_in)) |
| 1517 | expected_rules.append("-A %s -p ARP -j DROP" % (vmchain_in)) |
| 1518 | if not verify_expected_rules_in_order(expected_rules, rules): |
| 1519 | return False |
| 1520 | |
| 1521 | # vmchain_in_src |
| 1522 | expected_rules = [] |
| 1523 | expected_rules.append("-A %s -s %s -j RETURN" % (vmchain_in_src, new_mac)) |
| 1524 | expected_rules.append("-A %s -j DROP" % (vmchain_in_src)) |
| 1525 | if not verify_expected_rules_in_order(expected_rules, rules): |
| 1526 | return False |
| 1527 | |
| 1528 | # vmchain_in_ips |
| 1529 | expected_rules = [] |
| 1530 | for vm_ip in vm_ips: |
| 1531 | expected_rules.append("-A %s -p ARP -s %s --arp-ip-src %s --arp-mac-src %s -j RETURN" % (vmchain_in_ips, new_mac, vm_ip, new_mac)) |
| 1532 | expected_rules.append("-A %s -j DROP" % (vmchain_in_ips)) |
| 1533 | if not verify_expected_rules_in_order(expected_rules, rules): |
| 1534 | return False |
| 1535 | |
| 1536 | # vmchain_out |
| 1537 | expected_rules = [] |
| 1538 | expected_rules.append("-A %s -p ARP --arp-op Reply -j %s" % (vmchain_out, vmchain_out_dst)) |
| 1539 | expected_rules.append("-A %s -p ARP -j %s" % (vmchain_out, vmchain_out_ips)) |
| 1540 | expected_rules.append("-A %s -p ARP --arp-op Request -j ACCEPT" % (vmchain_out)) |
| 1541 | expected_rules.append("-A %s -p ARP --arp-op Reply -j ACCEPT" % (vmchain_out)) |
| 1542 | expected_rules.append("-A %s -p ARP -j DROP" % (vmchain_out)) |
| 1543 | if not verify_expected_rules_in_order(expected_rules, rules): |
| 1544 | return False |
| 1545 | |
| 1546 | # vmchain_out_dst |
| 1547 | expected_rules = [] |
| 1548 | expected_rules.append("-A %s -p ARP --arp-op Reply --arp-mac-dst %s -j RETURN" % (vmchain_out_dst, new_mac)) |
no test coverage detected