Re: [libvirt] [PATCH] use -w flag if supported by iptables

Quoting Daniel P. Berrange (berrange(a)redhat.com): > On Thu, Oct 31, 2013 at 04:36:24PM -0500, Serge Hallyn wrote: > > This will properly lock libvirt's usage of iptables with > > others (like ufw). > > > > (See https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1245322) > > > > Signed-off-by: Serge Hallyn <serge.hallyn(a)ubuntu.com&gt; > > --- > > src/util/viriptables.c | 30 ++++++++++++++++++++++++++---- > > 1 file changed, 26 insertions(+), 4 deletions(-) > > > > diff --git a/src/util/viriptables.c b/src/util/viriptables.c > > index 16f571e..30d59b6 100644 > > --- a/src/util/viriptables.c > > +++ b/src/util/viriptables.c > > @@ -50,19 +50,25 @@ > > #include "virstring.h" > > #include "virutil.h" > > > > +bool iptables_supports_xlock = false; > > + > > #if HAVE_FIREWALLD > > static char *firewall_cmd_path = NULL; > > +#endif > > > > static int > > virIpTablesOnceInit(void) > > { > > + virCommandPtr cmd; > > + int status; > > + > > +#if HAVE_FIREWALLD > > firewall_cmd_path = virFindFileInPath("firewall-cmd"); > > if (!firewall_cmd_path) { > > VIR_INFO("firewall-cmd not found on system. " > > "firewalld support disabled for iptables."); > > } else { > > - virCommandPtr cmd = virCommandNew(firewall_cmd_path); > > - int status; > > + virCommandNew(firewall_cmd_path); > > > > virCommandAddArgList(cmd, "--state", NULL); > > if (virCommandRun(cmd, &status) < 0 || status != 0) { > > @@ -74,13 +80,26 @@ virIpTablesOnceInit(void) > > } > > virCommandFree(cmd); > > } > > + > > + if (firewall_cmd_path) > > + return 0; > > + > > +#endif > > + > > + cmd = virCommandNew(IPTABLES_PATH); > > + virCommandAddArgList(cmd, "-w", "-L", "-n", NULL); > > What version of iptables actually has this '-w' flag ? The ubuntu bug It was introduced in 1.4.20, specifically with commit 93587a04d0f2511e108bbc4d87a8b9d28a5c5dd8 Author: Phil Oester <kernel(a)linuxace.com&gt; Date: Fri May 31 09:07:04 2013 -0400 ip[6]tables: Add locking to prevent concurrent instances > points to an upstream patch, which does locking unconditionally, no > mention of any '-w' flag. Well yes it locks unconditionally, but without -w it won't wait. So if there is another app using iptables at the time, then the call fails and libvirt fails to create the interface. > Looking on a per-rule basis is pretty lame locking, since changes > to iptables are often comprised of many rule changes :-( > > > + if (virCommandRun(cmd, &status) < 0 || status != 0) { > > + VIR_INFO("xtables locking not supported by your iptables"); > > + } else { > > + VIR_INFO("using xtables locking for iptables"); > > + iptables_supports_xlock = true; > > + } > > + virCommandFree(cmd); > > return 0; > > } > > > > VIR_ONCE_GLOBAL_INIT(virIpTables) > > > > -#endif > > - > > The call to virIptablesInitialize is protected by > #if HAVE_FIREWALLD too, so this code will not run > on older distros. I thought I changed that, but I may not properly understand the libvirt init code. I moved the VIR_ONCE_GLOBAL_INIT(virIptTables) out from under that ifdef.