我对 Ruby 了解不多,我需要了解这个脚本的作用。我知道它调用 ebtables 来添加为虚拟机配置网络的规则。但我不确定如何?
这是代码:
#!/usr/bin/env ruby
require 'pp'
require 'rexml/document'
VM_NAME=ARGV[0]
# Uncomment to act only on the listed bridges.
#FILTERED_BRIDGES = ['beth0']
def activate(rule)
system "sudo ebtables -A #{rule}"
end
def get_bridges
bridges = Hash.new
brctl_exit=`brctl show`
cur_bridge = ""
brctl_exit.split("\n")[1..-1].each do |l|
l = l.split
if l.length > 1
cur_bridge = l[0]
bridges[cur_bridge] = Array.new
bridges[cur_bridge] << l[3]
else
bridges[cur_bridge] << l[0]
end
end
bridges
end
def get_interfaces
bridges = get_bridges
if defined? FILTERED_BRIDGES
FILTERED_BRIDGES.collect {|k,v| bridges[k]}.flatten
else
bridges.values.flatten
end
end
nets=`virsh -c qemu:///system dumpxml #{VM_NAME}`
doc=REXML::Document.new(nets).root
interfaces = get_interfaces()
doc.elements.each('/domain/devices/interface') {|net|
tap=net.elements['target'].attributes['dev']
if interfaces.include? tap
iface_mac=net.elements['mac'].attributes['address']
mac=iface_mac.split(':')
mac[-1]='00'
net_mac=mac.join(':')
in_rule="FORWARD -s ! #{net_mac}/ff:ff:ff:ff:ff:00 -o #{tap} -j DROP"
out_rule="FORWARD -s ! #{iface_mac} -i #{tap} -j DROP"
activate(in_rule)
activate(out_rule)
end
}
所以显然它会提取mac地址(不确定哪些)并丢弃数据包/或将它们转发到某处?
非常感谢你的帮助!