[libvirt] [PATCH] use -w flag if supported by iptables
This will properly lock libvirt's usage of iptables with
others (like ufw).
(See https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1245322)
Signed-off-by: Serge Hallyn <serge.hallyn(a)ubuntu.com>
---
src/util/viriptables.c | 30 ++++++++++++++++++++++++++----
1 file changed, 26 insertions(+), 4 deletions(-)
diff --git a/src/util/viriptables.c b/src/util/viriptables.c
index 16f571e..30d59b6 100644
--- a/src/util/viriptables.c
+++ b/src/util/viriptables.c
@@ -50,19 +50,25 @@
#include "virstring.h"
#include "virutil.h"
+bool iptables_supports_xlock = false;
+
#if HAVE_FIREWALLD
static char *firewall_cmd_path = NULL;
+#endif
static int
virIpTablesOnceInit(void)
{
+ virCommandPtr cmd;
+ int status;
+
+#if HAVE_FIREWALLD
firewall_cmd_path = virFindFileInPath("firewall-cmd");
if (!firewall_cmd_path) {
VIR_INFO("firewall-cmd not found on system. "
"firewalld support disabled for iptables.");
} else {
- virCommandPtr cmd = virCommandNew(firewall_cmd_path);
- int status;
+ virCommandNew(firewall_cmd_path);
virCommandAddArgList(cmd, "--state", NULL);
if (virCommandRun(cmd, &status) < 0 || status != 0) {
@@ -74,13 +80,26 @@ virIpTablesOnceInit(void)
}
virCommandFree(cmd);
}
+
+ if (firewall_cmd_path)
+ return 0;
+
+#endif
+
+ cmd = virCommandNew(IPTABLES_PATH);
+ virCommandAddArgList(cmd, "-w", "-L", "-n", NULL);
+ if (virCommandRun(cmd, &status) < 0 || status != 0) {
+ VIR_INFO("xtables locking not supported by your iptables");
+ } else {
+ VIR_INFO("using xtables locking for iptables");
+ iptables_supports_xlock = true;
+ }
+ virCommandFree(cmd);
return 0;
}
VIR_ONCE_GLOBAL_INIT(virIpTables)
-#endif
-
#define VIR_FROM_THIS VIR_FROM_NONE
enum {
@@ -104,6 +123,9 @@ iptablesCommandNew(const char *table, const char *chain, int family,
int action)
if (cmd == NULL) {
cmd = virCommandNew((family == AF_INET6)
? IP6TABLES_PATH : IPTABLES_PATH);
+
+ if (iptables_supports_xlock)
+ virCommandAddArgList(cmd, "-w", NULL);
}
virCommandAddArgList(cmd, "--table", table,
--
1.8.3.2