On Thu, Oct 31, 2013 at 04:36:24PM -0500, Serge Hallyn wrote:
This will properly lock libvirt's usage of iptables with others (like ufw).
(See https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1245322)
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com> --- src/util/viriptables.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-)
diff --git a/src/util/viriptables.c b/src/util/viriptables.c index 16f571e..30d59b6 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -50,19 +50,25 @@ #include "virstring.h" #include "virutil.h"
+bool iptables_supports_xlock = false; + #if HAVE_FIREWALLD static char *firewall_cmd_path = NULL; +#endif
static int virIpTablesOnceInit(void) { + virCommandPtr cmd; + int status; + +#if HAVE_FIREWALLD firewall_cmd_path = virFindFileInPath("firewall-cmd"); if (!firewall_cmd_path) { VIR_INFO("firewall-cmd not found on system. " "firewalld support disabled for iptables."); } else { - virCommandPtr cmd = virCommandNew(firewall_cmd_path); - int status; + virCommandNew(firewall_cmd_path);
virCommandAddArgList(cmd, "--state", NULL); if (virCommandRun(cmd, &status) < 0 || status != 0) { @@ -74,13 +80,26 @@ virIpTablesOnceInit(void) } virCommandFree(cmd); } + + if (firewall_cmd_path) + return 0; + +#endif + + cmd = virCommandNew(IPTABLES_PATH); + virCommandAddArgList(cmd, "-w", "-L", "-n", NULL);
What version of iptables actually has this '-w' flag ? The ubuntu bug points to an upstream patch, which does locking unconditionally, no mention of any '-w' flag. Looking on a per-rule basis is pretty lame locking, since changes to iptables are often comprised of many rule changes :-(
+ if (virCommandRun(cmd, &status) < 0 || status != 0) { + VIR_INFO("xtables locking not supported by your iptables"); + } else { + VIR_INFO("using xtables locking for iptables"); + iptables_supports_xlock = true; + } + virCommandFree(cmd); return 0; }
VIR_ONCE_GLOBAL_INIT(virIpTables)
-#endif -
The call to virIptablesInitialize is protected by #if HAVE_FIREWALLD too, so this code will not run on older distros. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|