- Devel - libvirt List Archives

[Libvir] [patch 6/9] Move iptablesSpawn()
by Mark McLoughlin 04 Jan '08

04 Jan '08

The next patch requires iptablesSpawn() higher up in the file. This patch just moves the code around; there is no functional change. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 11:55:21.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 11:55:21.000000000 +0000 @@ -89,6 +89,49 @@ struct _iptablesContext iptRules *nat_postrouting; }; +static int +iptablesSpawn(int errors, char * const *argv) +{ + pid_t pid, ret; + int status; + int null = -1; + + if (errors == NO_ERRORS && (null = open(_PATH_DEVNULL, O_RDONLY)) < 0) + return errno; + + pid = fork(); + if (pid == -1) { + if (errors == NO_ERRORS) + close(null); + return errno; + } + + if (pid == 0) { /* child */ + if (errors == NO_ERRORS) { + dup2(null, STDIN_FILENO); + dup2(null, STDOUT_FILENO); + dup2(null, STDERR_FILENO); + close(null); + } + + execvp(argv[0], argv); + + _exit (1); + } + + if (errors == NO_ERRORS) + close(null); + + while ((ret = waitpid(pid, &status, 0) == -1) && errno == EINTR); + if (ret == -1) + return errno; + + if (errors == NO_ERRORS) + return 0; + else + return (WIFEXITED(status) && WEXITSTATUS(status) == 0) ? 0 : EINVAL; +} + #ifdef IPTABLES_DIR static int writeRules(const char *path, @@ -294,49 +337,6 @@ iptRulesNew(const char *table, } static int -iptablesSpawn(int errors, char * const *argv) -{ - pid_t pid, ret; - int status; - int null = -1; - - if (errors == NO_ERRORS && (null = open(_PATH_DEVNULL, O_RDONLY)) < 0) - return errno; - - pid = fork(); - if (pid == -1) { - if (errors == NO_ERRORS) - close(null); - return errno; - } - - if (pid == 0) { /* child */ - if (errors == NO_ERRORS) { - dup2(null, STDIN_FILENO); - dup2(null, STDOUT_FILENO); - dup2(null, STDERR_FILENO); - close(null); - } - - execvp(argv[0], argv); - - _exit (1); - } - - if (errors == NO_ERRORS) - close(null); - - while ((ret = waitpid(pid, &status, 0) == -1) && errno == EINTR); - if (ret == -1) - return errno; - - if (errors == NO_ERRORS) - return 0; - else - return (WIFEXITED(status) && WEXITSTATUS(status) == 0) ? 0 : EINVAL; -} - -static int iptablesAddRemoveChain(iptRules *rules, int action) { char **argv; --

1 0

[Libvir] [patch 5/9] Include the iptables command and chain name in the saved rules file
by Mark McLoughlin 04 Jan '08

04 Jan '08

lokkit --custom-rules expects the passed file to include the iptables command and chain name (e.g. "--inset INPUT") rather than just the rest of the arguments. Add both of those to what will be saved to the rules file and simplify the resulting code by splitting out a argvToString() helper function. The one complication is that when we're removing a rule we need to make sure we don't search for it using "--delete" rather than "--insert". For that reason, only change the argument to "--delete" once we've constructed the string we use to search through the existing rules. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 12:09:05.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 12:09:05.000000000 +0000 @@ -380,37 +380,55 @@ iptablesAddRemoveChain(iptRules *rules, return retval; } +static char * +argvToString(char **argv) +{ + int len, i; + char *ret, *p; + + for (len = 1, i = 0; argv[i]; i++) + len += strlen(argv[i]) + 1; + + if (!(p = ret = (char *)malloc(len))) + return NULL; + + for (i = 0; argv[i]; i++) { + if (i != 0) + *(p++) = ' '; + + strcpy(p, argv[i]); + p += strlen(argv[i]); + } + + *p = '\0'; + + return ret; +} + static int iptablesAddRemoveRule(iptRules *rules, int action, const char *arg, ...) { va_list args; int retval = ENOMEM; char **argv; - char *rule = NULL, *p; + char *rule = NULL; const char *s; - int n, rulelen, command_idx; + int n, command_idx; n = 1 + /* /sbin/iptables */ 2 + /* --table foo */ 2 + /* --insert bar */ 1; /* arg */ - rulelen = strlen(arg) + 1; - va_start(args, arg); - while ((s = va_arg(args, const char *))) { + while ((s = va_arg(args, const char *))) n++; - rulelen += strlen(s) + 1; - } va_end(args); if (!(argv = calloc(n + 1, sizeof(*argv)))) goto error; - if (!(rule = (char *)malloc(rulelen))) - goto error; - n = 0; if (!(argv[n++] = strdup(IPTABLES_PATH))) @@ -424,7 +442,7 @@ iptablesAddRemoveRule(iptRules *rules, i command_idx = n; - if (!(argv[n++] = strdup(action == ADD ? "--insert" : "--delete"))) + if (!(argv[n++] = strdup("--insert"))) goto error; if (!(argv[n++] = strdup(rules->chain))) @@ -433,23 +451,22 @@ iptablesAddRemoveRule(iptRules *rules, i if (!(argv[n++] = strdup(arg))) goto error; - p = strcpy(rule, arg); - p += strlen(arg); - va_start(args, arg); - while ((s = va_arg(args, const char *))) { + while ((s = va_arg(args, const char *))) if (!(argv[n++] = strdup(s))) goto error; - *(p++) = ' '; - strcpy(p, s); - p += strlen(s); - } - va_end(args); - *p = '\0'; + if (!(rule = argvToString(&argv[command_idx]))) + goto error; + + if (action == REMOVE) { + free(argv[command_idx]); + if (!(argv[command_idx] = strdup("--delete"))) + goto error; + } if (action == ADD && (retval = iptablesAddRemoveChain(rules, action))) --

1 0

[Libvir] [patch 4/9] Re-name the "flipflop" variable to "command_idx"
by Mark McLoughlin 04 Jan '08

04 Jan '08

The "flipflop" variable marks the index into argv where the "--insert" is at, so that when we're reloading the rules we can easily change it to "--delete" and back again. It's a rather silly name, and the next patch is going to make more use out of it, so let's use the more sane "command_idx" name. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 10:00:03.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 10:00:03.000000000 +0000 @@ -62,7 +62,7 @@ typedef struct { char *rule; char **argv; - int flipflop; + int command_idx; } iptRule; typedef struct @@ -158,7 +158,7 @@ static int iptRulesAppend(iptRules *rules, char *rule, char **argv, - int flipflop) + int command_idx) { iptRule *r; @@ -172,9 +172,9 @@ iptRulesAppend(iptRules *rules, rules->rules = r; - rules->rules[rules->nrules].rule = rule; - rules->rules[rules->nrules].argv = argv; - rules->rules[rules->nrules].flipflop = flipflop; + rules->rules[rules->nrules].rule = rule; + rules->rules[rules->nrules].argv = argv; + rules->rules[rules->nrules].command_idx = command_idx; rules->nrules++; @@ -388,7 +388,7 @@ iptablesAddRemoveRule(iptRules *rules, i char **argv; char *rule = NULL, *p; const char *s; - int n, rulelen, flipflop; + int n, rulelen, command_idx; n = 1 + /* /sbin/iptables */ 2 + /* --table foo */ @@ -422,7 +422,7 @@ iptablesAddRemoveRule(iptRules *rules, i if (!(argv[n++] = strdup(rules->table))) goto error; - flipflop = n; + command_idx = n; if (!(argv[n++] = strdup(action == ADD ? "--insert" : "--delete"))) goto error; @@ -463,7 +463,7 @@ iptablesAddRemoveRule(iptRules *rules, i goto error; if (action == ADD) { - retval = iptRulesAppend(rules, rule, argv, flipflop); + retval = iptRulesAppend(rules, rule, argv, command_idx); rule = NULL; argv = NULL; } else { @@ -543,14 +543,14 @@ iptRulesReload(iptRules *rules) iptRule *rule = &rules->rules[i]; char *orig; - orig = rule->argv[rule->flipflop]; - rule->argv[rule->flipflop] = (char *) "--delete"; + orig = rule->argv[rule->command_idx]; + rule->argv[rule->command_idx] = (char *) "--delete"; if ((retval = iptablesSpawn(WITH_ERRORS, rule->argv))) qemudLog(QEMUD_WARN, "Failed to remove iptables rule '%s' from chain '%s' in table '%s': %s", rule->rule, rules->chain, rules->table, strerror(retval)); - rule->argv[rule->flipflop] = orig; + rule->argv[rule->command_idx] = orig; } if ((retval = iptablesAddRemoveChain(rules, REMOVE)) || --

1 0

[Libvir] [patch 3/9] Make iptables code use common utils
by Mark McLoughlin 04 Jan '08

04 Jan '08

utils.c has grown some functions since the iptables code was written - make use of virFileMakePath() and virFileBuildPath(). Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 09:46:19.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 09:46:19.000000000 +0000 @@ -44,6 +44,7 @@ #include "internal.h" #include "iptables.h" +#include "util.h" #define qemudLog(level, msg...) fprintf(stderr, msg) @@ -135,60 +136,6 @@ writeRules(const char *path, return 0; } - -static int -ensureDir(const char *path) -{ - struct stat st; - char parent[PATH_MAX]; - char *p; - int err; - - if (stat(path, &st) >= 0) - return 0; - - strncpy(parent, path, PATH_MAX); - parent[PATH_MAX - 1] = '\0'; - - if (!(p = strrchr(parent, '/'))) - return EINVAL; - - if (p == parent) - return EPERM; - - *p = '\0'; - - if ((err = ensureDir(parent))) - return err; - - if (mkdir(path, 0700) < 0 && errno != EEXIST) - return errno; - - return 0; -} - -static int -buildDir(const char *table, - char *path, - int maxlen) -{ - if (snprintf(path, maxlen, IPTABLES_DIR "/%s", table) >= maxlen) - return EINVAL; - else - return 0; -} - -static int -buildPath(const char *table, - const char *chain, - char *path, - int maxlen) -{ - if (snprintf(path, maxlen, IPTABLES_DIR "/%s/%s.chain", table, chain) >= maxlen) - return EINVAL; - else - return 0; -} #endif /* IPTABLES_DIR */ static void @@ -235,7 +182,7 @@ iptRulesAppend(iptRules *rules, { int err; - if ((err = ensureDir(rules->dir))) + if ((err = virFileMakePath(rules->dir))) return err; if ((err = writeRules(rules->path, rules->rules, rules->nrules))) @@ -332,10 +279,10 @@ iptRulesNew(const char *table, rules->nrules = 0; #ifdef IPTABLES_DIR - if (buildDir(table, rules->dir, sizeof(rules->dir))) + if (virFileBuildPath(IPTABLES_DIR, table, NULL, rules->dir, sizeof(rules->dir)) < 0) goto error; - if (buildPath(table, chain, rules->path, sizeof(rules->path))) + if (virFileBuildPath(rules->dir, chain, ".chain", rules->path, sizeof(rules->path)) < 0) goto error; #endif /* IPTABLES_DIR */ --

1 0

[Libvir] [patch 2/9] Fix minor iptables error logging issue
by Mark McLoughlin 04 Jan '08

04 Jan '08

Fix a minor issue with some error reporting in the iptables code - namely that we use errno after it may have been set to something other than the error reported. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 11:46:38.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 11:46:38.000000000 +0000 @@ -601,7 +601,7 @@ iptRulesReload(iptRules *rules) if ((retval = iptablesSpawn(WITH_ERRORS, rule->argv))) qemudLog(QEMUD_WARN, "Failed to remove iptables rule '%s' from chain '%s' in table '%s': %s", - rule->rule, rules->chain, rules->table, strerror(errno)); + rule->rule, rules->chain, rules->table, strerror(retval)); rule->argv[rule->flipflop] = orig; } --

1 0

[Libvir] [patch 1/9] Fix compile error in --with-iptables-dir code
by Mark McLoughlin 04 Jan '08

04 Jan '08

It seems no-one ever used --with-iptables-dir, since it doesn't compile :-) Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2007-12-13 09:05:31.000000000 +0000 +++ libvirt.orig/src/iptables.c 2007-12-13 09:05:31.000000000 +0000 @@ -91,7 +91,7 @@ struct _iptablesContext #ifdef IPTABLES_DIR static int writeRules(const char *path, - const iptRules *rules, + const iptRule *rules, int nrules) { char tmp[PATH_MAX]; --

1 0

[Libvir] [patch 0/9] Add support for Fedora lokkit's --custom-rules option
by Mark McLoughlin 04 Jan '08

04 Jan '08

Hey, When the iptables support was first added to libvirtd, we proposed a change to iptables to allow us to register our rules so that the rules would be automatically reloaded e.g. "service iptables restart" was run or if the user modified their firewall configuration with system-config-firewall. See: https://bugzilla.redhat.com/227011 That proposal wasn't accepted and so users must currently force libvirt to reload its iptables configuration using SIGHUP in those circumstances. However, since Fedora 8, lokkit has grown a --custom-rules option which we can use to achieve the same effect. The following series of patches does just that. Most of the patches are pretty trivial; the only really significant one is 7/9. (Oh, 7/9 requires Dan's virFileReadAll() patch) Thanks, Mark. --

1 0

[Libvir] [PATCH] #include "config.h" needed
by Richard W.M. Jones 04 Jan '08

04 Jan '08

There is one file missing: #include "config.h" which ought to be included at the beginning of every C file. If missing, it causes problems on Windows -- in particular the C99 keyword 'restrict' won't be recognised and that causes compile errors all over the place. I've also changed a few <config.h> --> "config.h", which I think is more correct because config.h is a local file and should never come from the system include files (CC'd to Jim Meyering -- is this right in your opinion?) Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

3 4

Re: [Libvir] java-libvirt on cvs:libvirt.org
by Richard W.M. Jones 02 Jan '08

02 Jan '08

[Sorry, accidentally deleted the attached message while combing through the awesome amount of spam that this list receives ...] -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

1 0

[Libvir] Re: Documentation on the xml format
by Daniel Schwager 29 Dec '07

29 Dec '07

Hi Rich, >Unfortunately this level of detail is only in the source, and usually >depends on the backend (Xen/QEMU/whatever). > >If you'd like to help document these sorts of issues, then we'd welcome >patches. The source for this page is in libvirt CVS doc/ directory. > >http://libvirt.org/format.html I want extend the java-libvirt implementation based on the code of István Tóth. Therefore, I created a XSD file (XML description file). This could be a base for the XML-documentation. Should I post it ? One more question: Is there a changelist for the libvirt API between 0.3.2 and 0.4 ? The code based on 0.3.2 ... regards Danny ------------------------------------------------------------------- DT Netsolution GmbH - Taläckerstr. 30 - D-70437 Stuttgart Geschäftsführer: Daniel Schwager, Stefan Hörz - HRB Stuttgart 19870 Tel: +49-711-849910-32, Fax: -932 - Mailto:daniel.schwager@dtnet.de

3 4