2005-11-02 12:50:21 +00:00
|
|
|
dnl Process this file with autoconf to produce a configure script.
|
2007-09-18 23:46:18 +00:00
|
|
|
|
2015-01-08 14:36:54 +00:00
|
|
|
dnl Copyright (C) 2005-2015 Red Hat, Inc.
|
2013-05-14 23:42:12 +00:00
|
|
|
dnl
|
|
|
|
|
dnl This library is free software; you can redistribute it and/or
|
|
|
|
|
dnl modify it under the terms of the GNU Lesser General Public
|
|
|
|
|
dnl License as published by the Free Software Foundation; either
|
|
|
|
|
dnl version 2.1 of the License, or (at your option) any later version.
|
|
|
|
|
dnl
|
|
|
|
|
dnl This library is distributed in the hope that it will be useful,
|
|
|
|
|
dnl but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
|
dnl Lesser General Public License for more details.
|
|
|
|
|
dnl
|
|
|
|
|
dnl You should have received a copy of the GNU Lesser General Public
|
|
|
|
|
dnl License along with this library. If not, see
|
|
|
|
|
dnl <http://www.gnu.org/licenses/>.
|
2011-07-28 18:56:24 +00:00
|
|
|
|
2008-05-22 15:34:02 +00:00
|
|
|
AC_CONFIG_AUX_DIR([build-aux])
|
2010-02-17 13:45:10 +00:00
|
|
|
AC_CONFIG_MACRO_DIR([m4])
|
2019-04-03 00:21:28 +00:00
|
|
|
dnl Make automake keep quiet about wildcards & other GNUmake-isms
|
2019-04-03 00:01:30 +00:00
|
|
|
AM_INIT_AUTOMAKE([
|
2019-04-03 00:29:03 +00:00
|
|
|
foreign
|
2019-04-03 00:01:30 +00:00
|
|
|
-Wno-portability
|
|
|
|
|
tar-pax
|
|
|
|
|
no-dist-gzip
|
|
|
|
|
dist-xz
|
|
|
|
|
subdir-objects
|
|
|
|
|
])
|
2015-06-02 15:17:43 +00:00
|
|
|
dnl older automake's default of ARFLAGS=cru is noisy on newer binutils;
|
|
|
|
|
dnl we don't really need the 'u' even in older toolchains. Then there is
|
|
|
|
|
dnl older libtool, which spelled it AR_FLAGS
|
|
|
|
|
m4_divert_text([DEFAULTS], [: "${ARFLAGS=cr} ${AR_FLAGS=cr}"])
|
2009-07-08 09:51:59 +00:00
|
|
|
|
2013-09-04 16:26:30 +00:00
|
|
|
# Default to using the silent-rules feature when possible. Formatting
|
|
|
|
|
# chosen to bypass 'grep' checks that cause older automake to warn.
|
|
|
|
|
# Users (include rpm) can still change the default at configure time.
|
|
|
|
|
m4_ifndef([AM_SILENT_RULES],
|
|
|
|
|
[m4_define([AM_SILENT_RULES],[])])AM_SILENT_RULES([yes])
|
2009-07-08 09:51:59 +00:00
|
|
|
|
2005-11-02 12:50:21 +00:00
|
|
|
AC_CANONICAL_HOST
|
|
|
|
|
|
2007-11-29 17:41:57 +00:00
|
|
|
dnl Checks for C compiler.
|
2005-11-02 13:19:10 +00:00
|
|
|
AC_PROG_CC
|
|
|
|
|
AC_PROG_INSTALL
|
|
|
|
|
AC_PROG_CPP
|
2007-09-20 18:40:36 +00:00
|
|
|
|
2020-01-17 11:26:26 +00:00
|
|
|
dnl get 64-int interfaces on 32-bit platforms
|
2020-07-24 12:02:39 +00:00
|
|
|
CFLAGS="$CFLAGS -D_FILE_OFFSET_BITS=64"
|
2020-01-17 11:26:26 +00:00
|
|
|
|
2007-11-29 17:41:57 +00:00
|
|
|
dnl Support building Win32 DLLs (must appear *before* AM_PROG_LIBTOOL)
|
|
|
|
|
AC_LIBTOOL_WIN32_DLL
|
|
|
|
|
|
2013-04-02 15:52:31 +00:00
|
|
|
m4_ifndef([LT_INIT], [
|
|
|
|
|
AM_PROG_LIBTOOL
|
|
|
|
|
], [
|
|
|
|
|
LT_INIT([shared disable-static])
|
|
|
|
|
])
|
2007-03-15 17:24:56 +00:00
|
|
|
AM_PROG_CC_C_O
|
2010-04-27 07:43:55 +00:00
|
|
|
AM_PROG_LD
|
2007-03-15 17:24:56 +00:00
|
|
|
|
2013-09-17 16:25:42 +00:00
|
|
|
dnl Make some notes about which OS we're compiling for, as the lxc and qemu
|
|
|
|
|
dnl drivers require linux headers, and storage_mpath, dtrace, and nwfilter
|
|
|
|
|
dnl are also linux specific. The "network" and storage_fs drivers are known
|
2019-04-02 09:04:46 +00:00
|
|
|
dnl to not work on macOS presently, so we also make a note if compiling
|
2013-09-17 16:25:42 +00:00
|
|
|
dnl for that
|
|
|
|
|
|
2020-01-14 18:34:26 +00:00
|
|
|
with_linux=no with_macos=no with_freebsd=no with_win=no
|
2013-09-17 16:25:42 +00:00
|
|
|
case $host in
|
|
|
|
|
*-*-linux*) with_linux=yes ;;
|
2019-04-02 09:04:46 +00:00
|
|
|
*-*-darwin*) with_macos=yes ;;
|
2013-09-17 16:25:42 +00:00
|
|
|
*-*-freebsd*) with_freebsd=yes ;;
|
2014-04-28 12:30:36 +00:00
|
|
|
*-*-mingw* | *-*-msvc* ) with_win=yes ;;
|
2013-09-17 16:25:42 +00:00
|
|
|
esac
|
|
|
|
|
|
|
|
|
|
if test $with_linux = no; then
|
|
|
|
|
if test "x$with_lxc" != xyes
|
|
|
|
|
then
|
|
|
|
|
with_lxc=no
|
|
|
|
|
fi
|
|
|
|
|
with_dtrace=no
|
2017-03-05 14:17:22 +00:00
|
|
|
with_storage_scsi=no
|
2013-09-17 16:25:42 +00:00
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
AM_CONDITIONAL([WITH_LINUX], [test "$with_linux" = "yes"])
|
|
|
|
|
AM_CONDITIONAL([WITH_FREEBSD], [test "$with_freebsd" = "yes"])
|
2019-08-21 16:13:19 +00:00
|
|
|
AM_CONDITIONAL([WITH_MACOS], [test "$with_macos" = "yes"])
|
2013-09-17 16:25:42 +00:00
|
|
|
|
2014-04-28 12:30:36 +00:00
|
|
|
if test "$with_win" = "yes" ; then
|
2020-01-14 17:38:59 +00:00
|
|
|
# We don't support the daemon yet
|
2014-04-28 12:30:36 +00:00
|
|
|
with_libvirtd=no
|
|
|
|
|
fi
|
|
|
|
|
|
2013-09-27 23:09:20 +00:00
|
|
|
# The daemon requires remote support. Likewise, if we are not using
|
|
|
|
|
# RPC, we don't need several libraries.
|
|
|
|
|
if test "$with_remote" = "no" ; then
|
|
|
|
|
with_libvirtd=no
|
|
|
|
|
with_ssh2=no
|
|
|
|
|
with_sasl=no
|
2016-11-09 14:28:35 +00:00
|
|
|
with_libssh=no
|
2013-09-27 23:09:20 +00:00
|
|
|
fi
|
|
|
|
|
# Stateful drivers are useful only when building the daemon.
|
2013-09-17 16:25:42 +00:00
|
|
|
if test "$with_libvirtd" = "no" ; then
|
|
|
|
|
with_qemu=no
|
2013-09-27 23:09:20 +00:00
|
|
|
with_lxc=no
|
|
|
|
|
with_libxl=no
|
|
|
|
|
with_vbox=no
|
2013-09-17 16:25:42 +00:00
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
# Check for compiler and library settings.
|
|
|
|
|
|
configure: selectively install a firewalld 'libvirt' zone
In the past (when both libvirt and firewalld used iptables), if either
libvirt's rules *OR* firewalld's rules accepted a packet, it would
be accepted. This was because libvirt and firewalld rules were
processed during the same kernel hook, and a single ACCEPT result
would terminate the rule traversal and cause the packet to be
accepted.
But now firewalld can use nftables for its backend, while libvirt's
firewall rules are still using iptables; iptables rules are still
processed, but at a different time during packet processing
(i.e. during a different hook) than the firewalld nftables rules. The
result is that a packet must be accepted by *BOTH* the libvirt
iptables rules *AND* the firewalld nftable rules in order to be
accepted.
This causes pain because
1) libvirt always adds rules to permit DNS and DHCP (and sometimes
TFTP) from guests to the host network's bridge interface. But
libvirt's bridges are in firewalld's "default" zone (which is usually
the zone called "public"). The public zone allows ssh, but doesn't
allow DNS, DHCP, or TFTP. So even though libvirt's rules allow the
DHCP and DNS traffic, the firewalld rules (now processed during a
different hook) dont, thus guests connected to libvirt's bridges can't
acquire an IP address from DHCP, nor can they make DNS queries to the
DNS server libvirt has setup on the host. (This could be solved by
modifying the default firewalld zone to allow DNS and DHCP, but that
would open *all* interfaces in the default zone to those services,
which is most likely not what the host's admin wants.)
2) Even though libvirt adds iptables rules to allow forwarded traffic
to pass the iptables hook, firewalld's higher level "rich rules" don't
yet have the ability to configure the acceptance of forwarded traffic
(traffic that is going somewhere beyond the host), so any traffic that
needs to be forwarded from guests to the network beyond the host is
rejected during the nftables hook by the default zone's "default
reject" policy (which rejects all traffic in the zone not specifically
allowed by the rules in the zone, whether that traffic is destined to
be forwarded or locally received by the host).
libvirt can't send "direct" nftables rules (firewalld only supports
direct/passthrough rules for iptables), so we can't solve this problem
by just sending explicit nftables rules instead of explicit iptables
rules (which, if it could be done, would place libvirt's rules in the
same hook as firewalld's native rules, and thus eliminate the need for
packets to be accepted by both libvirt's and firewalld's own rules).
However, we can take advantage of a quirk in firewalld zones that have
a default policy of "accept" (meaning any packet that doesn't match a
specific rule in the zone will be *accepted*) - this default accept will
also accept forwarded traffic (not just traffic destined for the host).
Of course we don't want to modify firewalld's default zone in that
way, because that would affect the filtering of traffic coming into
the host from other interfaces using that zone. Instead, we will
create a new zone called "libvirt". The libvirt zone will have a
default policy of accept so that forwarded traffic can pass and list
specific services that will be allowed into the host from guests (DNS,
DHCP, SSH, and TFTP).
But the same default accept policy that fixes forwarded traffic also
causes *all* traffic from guest to host to be accepted. To close this
new hole, the libvirt zone can take advantage of a new feature in
firewalld (currently slated for firewalld-0.7.0) - priorities for rich
rules - to add a low priority rule that rejects all local traffic (but
leaves alone all forwarded traffic).
So, our new zone will start with a list of services that are allowed
(dhcp, dns, tftp, and ssh to start, but configurable via any firewalld
management application, or direct editing of the zone file in
/etc/firewalld/zones/libvirt.xml), followed by a low priority
<reject/> rule (to reject all other traffic from guest to host), and
finally with a default policy of accept (to allow forwarded traffic).
This patch only creates the zonefile for the new zone, and implements
a configure.ac option to selectively enable/disable installation of
the new zone. A separate patch contains the necessary code to actually
place bridge interfaces in the libvirt zone.
Why do we need a configure option to disable installation of the new
libvirt zone? It uses a new firewalld attribute that sets the priority
of a rich rule; this feature first appears in firewalld-0.7.0 (unless
it has been backported to am earlier firewalld by a downstream
maintainer). If the file were installed on a system with firewalld
that didn't support rule priorities, firewalld would log an error
every time it restarted, causing confusion and lots of extra bug
reports.
So we add two new configure.ac switches to avoid polluting the system
logs with this error on systems that don't support rule priorities -
"--with-firewalld-zone" and "--without-firewalld-zone". A package
builder can use these to include/exclude the libvirt zone file in the
installation. If firewalld is enabled (--with-firewalld), the default
is --with-firewalld-zone, but it can be disabled during configure
(using --without-firewalld-zone). Targets that are using a firewalld
version too old to support the rule priority setting in the libvirt
zone file can simply add --without-firewalld-zone to their configure
commandline.
These switches only affect whether or not the libvirt zone file is
*installed* in /usr/lib/firewalld/zones, but have no effect on whether
or not libvirt looks for a zone called libvirt and tries to use it.
NB: firewalld zones can only be added to the permanent config of
firewalld, and won't be loaded/enabled until firewalld is restarted,
so at package install/upgrade time we have to restart firewalld. For
rpm-based distros, this is done in the libvirt.spec file by calling
the %firewalld_restart rpm macro, which is a part of the
firewalld-filesystem package. (For distros that don't use rpm
packages, the command "firewalld-cmd --reload" will have the same
effect).
Signed-off-by: Laine Stump <laine@laine.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-01-26 04:52:37 +00:00
|
|
|
LIBVIRT_ARG_FIREWALLD_ZONE
|
2016-12-12 17:11:51 +00:00
|
|
|
LIBVIRT_ARG_FUSE
|
|
|
|
|
LIBVIRT_ARG_GLUSTER
|
|
|
|
|
LIBVIRT_ARG_HAL
|
2018-07-31 08:44:20 +00:00
|
|
|
LIBVIRT_ARG_LIBISCSI
|
2016-12-15 13:56:29 +00:00
|
|
|
LIBVIRT_ARG_LIBPCAP
|
2016-12-12 17:11:51 +00:00
|
|
|
LIBVIRT_ARG_LIBSSH
|
2016-12-15 13:56:29 +00:00
|
|
|
LIBVIRT_ARG_LIBXML
|
|
|
|
|
LIBVIRT_ARG_MACVTAP
|
2016-12-12 17:11:51 +00:00
|
|
|
LIBVIRT_ARG_NETCF
|
2018-04-03 15:39:17 +00:00
|
|
|
LIBVIRT_ARG_NLS
|
2016-12-12 17:11:51 +00:00
|
|
|
LIBVIRT_ARG_NSS
|
|
|
|
|
LIBVIRT_ARG_NUMACTL
|
|
|
|
|
LIBVIRT_ARG_OPENWSMAN
|
|
|
|
|
LIBVIRT_ARG_PCIACCESS
|
2016-12-15 13:56:29 +00:00
|
|
|
LIBVIRT_ARG_PM_UTILS
|
|
|
|
|
LIBVIRT_ARG_POLKIT
|
2016-12-12 17:11:51 +00:00
|
|
|
LIBVIRT_ARG_SANLOCK
|
|
|
|
|
LIBVIRT_ARG_SASL
|
|
|
|
|
LIBVIRT_ARG_SELINUX
|
|
|
|
|
LIBVIRT_ARG_SSH2
|
|
|
|
|
LIBVIRT_ARG_UDEV
|
2016-12-15 13:56:29 +00:00
|
|
|
LIBVIRT_ARG_VIRTUALPORT
|
2016-12-12 17:11:51 +00:00
|
|
|
LIBVIRT_ARG_WIRESHARK
|
|
|
|
|
LIBVIRT_ARG_YAJL
|
|
|
|
|
|
configure: selectively install a firewalld 'libvirt' zone
In the past (when both libvirt and firewalld used iptables), if either
libvirt's rules *OR* firewalld's rules accepted a packet, it would
be accepted. This was because libvirt and firewalld rules were
processed during the same kernel hook, and a single ACCEPT result
would terminate the rule traversal and cause the packet to be
accepted.
But now firewalld can use nftables for its backend, while libvirt's
firewall rules are still using iptables; iptables rules are still
processed, but at a different time during packet processing
(i.e. during a different hook) than the firewalld nftables rules. The
result is that a packet must be accepted by *BOTH* the libvirt
iptables rules *AND* the firewalld nftable rules in order to be
accepted.
This causes pain because
1) libvirt always adds rules to permit DNS and DHCP (and sometimes
TFTP) from guests to the host network's bridge interface. But
libvirt's bridges are in firewalld's "default" zone (which is usually
the zone called "public"). The public zone allows ssh, but doesn't
allow DNS, DHCP, or TFTP. So even though libvirt's rules allow the
DHCP and DNS traffic, the firewalld rules (now processed during a
different hook) dont, thus guests connected to libvirt's bridges can't
acquire an IP address from DHCP, nor can they make DNS queries to the
DNS server libvirt has setup on the host. (This could be solved by
modifying the default firewalld zone to allow DNS and DHCP, but that
would open *all* interfaces in the default zone to those services,
which is most likely not what the host's admin wants.)
2) Even though libvirt adds iptables rules to allow forwarded traffic
to pass the iptables hook, firewalld's higher level "rich rules" don't
yet have the ability to configure the acceptance of forwarded traffic
(traffic that is going somewhere beyond the host), so any traffic that
needs to be forwarded from guests to the network beyond the host is
rejected during the nftables hook by the default zone's "default
reject" policy (which rejects all traffic in the zone not specifically
allowed by the rules in the zone, whether that traffic is destined to
be forwarded or locally received by the host).
libvirt can't send "direct" nftables rules (firewalld only supports
direct/passthrough rules for iptables), so we can't solve this problem
by just sending explicit nftables rules instead of explicit iptables
rules (which, if it could be done, would place libvirt's rules in the
same hook as firewalld's native rules, and thus eliminate the need for
packets to be accepted by both libvirt's and firewalld's own rules).
However, we can take advantage of a quirk in firewalld zones that have
a default policy of "accept" (meaning any packet that doesn't match a
specific rule in the zone will be *accepted*) - this default accept will
also accept forwarded traffic (not just traffic destined for the host).
Of course we don't want to modify firewalld's default zone in that
way, because that would affect the filtering of traffic coming into
the host from other interfaces using that zone. Instead, we will
create a new zone called "libvirt". The libvirt zone will have a
default policy of accept so that forwarded traffic can pass and list
specific services that will be allowed into the host from guests (DNS,
DHCP, SSH, and TFTP).
But the same default accept policy that fixes forwarded traffic also
causes *all* traffic from guest to host to be accepted. To close this
new hole, the libvirt zone can take advantage of a new feature in
firewalld (currently slated for firewalld-0.7.0) - priorities for rich
rules - to add a low priority rule that rejects all local traffic (but
leaves alone all forwarded traffic).
So, our new zone will start with a list of services that are allowed
(dhcp, dns, tftp, and ssh to start, but configurable via any firewalld
management application, or direct editing of the zone file in
/etc/firewalld/zones/libvirt.xml), followed by a low priority
<reject/> rule (to reject all other traffic from guest to host), and
finally with a default policy of accept (to allow forwarded traffic).
This patch only creates the zonefile for the new zone, and implements
a configure.ac option to selectively enable/disable installation of
the new zone. A separate patch contains the necessary code to actually
place bridge interfaces in the libvirt zone.
Why do we need a configure option to disable installation of the new
libvirt zone? It uses a new firewalld attribute that sets the priority
of a rich rule; this feature first appears in firewalld-0.7.0 (unless
it has been backported to am earlier firewalld by a downstream
maintainer). If the file were installed on a system with firewalld
that didn't support rule priorities, firewalld would log an error
every time it restarted, causing confusion and lots of extra bug
reports.
So we add two new configure.ac switches to avoid polluting the system
logs with this error on systems that don't support rule priorities -
"--with-firewalld-zone" and "--without-firewalld-zone". A package
builder can use these to include/exclude the libvirt zone file in the
installation. If firewalld is enabled (--with-firewalld), the default
is --with-firewalld-zone, but it can be disabled during configure
(using --without-firewalld-zone). Targets that are using a firewalld
version too old to support the rule priority setting in the libvirt
zone file can simply add --without-firewalld-zone to their configure
commandline.
These switches only affect whether or not the libvirt zone file is
*installed* in /usr/lib/firewalld/zones, but have no effect on whether
or not libvirt looks for a zone called libvirt and tries to use it.
NB: firewalld zones can only be added to the permanent config of
firewalld, and won't be loaded/enabled until firewalld is restarted,
so at package install/upgrade time we have to restart firewalld. For
rpm-based distros, this is done in the libvirt.spec file by calling
the %firewalld_restart rpm macro, which is a part of the
firewalld-filesystem package. (For distros that don't use rpm
packages, the command "firewalld-cmd --reload" will have the same
effect).
Signed-off-by: Laine Stump <laine@laine.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-01-26 04:52:37 +00:00
|
|
|
LIBVIRT_CHECK_FIREWALLD_ZONE
|
2013-01-08 21:06:57 +00:00
|
|
|
LIBVIRT_CHECK_FUSE
|
2019-07-30 09:13:36 +00:00
|
|
|
LIBVIRT_CHECK_GLIB
|
2013-11-19 23:26:05 +00:00
|
|
|
LIBVIRT_CHECK_GLUSTER
|
2016-11-10 13:33:41 +00:00
|
|
|
LIBVIRT_CHECK_GNUTLS
|
2012-09-20 14:39:12 +00:00
|
|
|
LIBVIRT_CHECK_HAL
|
2018-07-31 08:44:20 +00:00
|
|
|
LIBVIRT_CHECK_LIBISCSI
|
2016-12-15 13:56:29 +00:00
|
|
|
LIBVIRT_CHECK_LIBNL
|
|
|
|
|
LIBVIRT_CHECK_LIBPARTED
|
|
|
|
|
LIBVIRT_CHECK_LIBPCAP
|
2016-11-09 14:28:35 +00:00
|
|
|
LIBVIRT_CHECK_LIBSSH
|
2016-12-15 13:56:29 +00:00
|
|
|
LIBVIRT_CHECK_LIBXML
|
|
|
|
|
LIBVIRT_CHECK_MACVTAP
|
2012-09-20 14:14:52 +00:00
|
|
|
LIBVIRT_CHECK_NETCF
|
2018-04-03 15:39:17 +00:00
|
|
|
LIBVIRT_CHECK_NLS
|
2012-09-20 12:47:23 +00:00
|
|
|
LIBVIRT_CHECK_NUMACTL
|
2016-12-06 15:00:41 +00:00
|
|
|
LIBVIRT_CHECK_NWFILTER
|
2013-01-08 22:08:53 +00:00
|
|
|
LIBVIRT_CHECK_OPENWSMAN
|
2012-09-20 14:34:13 +00:00
|
|
|
LIBVIRT_CHECK_PCIACCESS
|
2016-12-15 13:56:29 +00:00
|
|
|
LIBVIRT_CHECK_PM_UTILS
|
|
|
|
|
LIBVIRT_CHECK_POLKIT
|
|
|
|
|
LIBVIRT_CHECK_PTHREAD
|
2012-09-20 12:04:57 +00:00
|
|
|
LIBVIRT_CHECK_SANLOCK
|
2012-09-20 12:06:12 +00:00
|
|
|
LIBVIRT_CHECK_SASL
|
2012-09-20 12:21:48 +00:00
|
|
|
LIBVIRT_CHECK_SELINUX
|
2013-01-08 21:47:55 +00:00
|
|
|
LIBVIRT_CHECK_SSH2
|
2012-09-20 14:34:13 +00:00
|
|
|
LIBVIRT_CHECK_UDEV
|
2016-12-15 13:56:29 +00:00
|
|
|
LIBVIRT_CHECK_VIRTUALPORT
|
2015-03-16 11:52:13 +00:00
|
|
|
LIBVIRT_CHECK_WIRESHARK
|
2016-12-15 13:56:29 +00:00
|
|
|
LIBVIRT_CHECK_XDR
|
2012-09-20 12:03:27 +00:00
|
|
|
LIBVIRT_CHECK_YAJL
|
|
|
|
|
|
2017-05-18 09:55:12 +00:00
|
|
|
|
2008-09-05 12:03:45 +00:00
|
|
|
AC_CHECK_LIB([intl],[gettext],[])
|
2020-01-07 16:19:52 +00:00
|
|
|
AC_CHECK_LIB([util],[openpty],[])
|
2008-09-05 12:03:45 +00:00
|
|
|
|
2016-12-13 12:47:07 +00:00
|
|
|
|
2016-12-14 14:28:55 +00:00
|
|
|
dnl
|
|
|
|
|
dnl Virtualization drivers check
|
|
|
|
|
dnl
|
|
|
|
|
|
2016-12-08 09:35:30 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_QEMU
|
2016-11-29 07:50:58 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_OPENVZ
|
2016-11-29 07:54:02 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_VMWARE
|
2016-12-12 15:18:02 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_LIBXL
|
2016-12-12 17:19:21 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_VBOX
|
2016-12-08 09:36:55 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_LXC
|
2016-12-14 14:28:55 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_VZ
|
|
|
|
|
LIBVIRT_DRIVER_ARG_BHYVE
|
2016-12-01 09:40:31 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_ESX
|
2016-12-01 09:43:13 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_HYPERV
|
2016-12-01 09:23:41 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_TEST
|
2016-12-01 09:27:19 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_REMOTE
|
2016-12-01 11:01:33 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_LIBVIRTD
|
2016-12-14 14:28:55 +00:00
|
|
|
LIBVIRT_DRIVER_ARG_NETWORK
|
|
|
|
|
LIBVIRT_DRIVER_ARG_INTERFACE
|
|
|
|
|
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_QEMU
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_OPENVZ
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_VMWARE
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_LIBXL
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_VBOX
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_LXC
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_VZ
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_BHYVE
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_ESX
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_HYPERV
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_TEST
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_REMOTE
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_LIBVIRTD
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_NETWORK
|
|
|
|
|
LIBVIRT_DRIVER_CHECK_INTERFACE
|
|
|
|
|
|
2016-11-14 14:25:41 +00:00
|
|
|
|
2005-12-02 12:11:06 +00:00
|
|
|
dnl
|
2010-09-09 15:06:00 +00:00
|
|
|
dnl in case someone want to build static binaries
|
|
|
|
|
dnl STATIC_BINARIES="-static"
|
2005-12-02 12:11:06 +00:00
|
|
|
dnl
|
2010-09-09 15:06:00 +00:00
|
|
|
STATIC_BINARIES=
|
2008-05-22 15:34:02 +00:00
|
|
|
AC_SUBST([STATIC_BINARIES])
|
2005-12-02 12:11:06 +00:00
|
|
|
|
2016-12-15 14:04:23 +00:00
|
|
|
dnl
|
|
|
|
|
dnl Miscellaneous checks
|
|
|
|
|
dnl
|
2007-02-16 18:30:55 +00:00
|
|
|
|
2016-12-15 14:04:23 +00:00
|
|
|
LIBVIRT_ARG_DTRACE
|
|
|
|
|
LIBVIRT_ARG_NUMAD
|
2016-12-12 17:11:51 +00:00
|
|
|
LIBVIRT_ARG_INIT_SCRIPT
|
2016-12-15 14:04:23 +00:00
|
|
|
LIBVIRT_ARG_CHRDEV_LOCK_FILES
|
|
|
|
|
LIBVIRT_ARG_LOADER_NVRAM
|
|
|
|
|
LIBVIRT_ARG_LOGIN_SHELL
|
|
|
|
|
LIBVIRT_ARG_HOST_VALIDATE
|
|
|
|
|
LIBVIRT_ARG_TLS_PRIORITY
|
2016-11-29 07:33:19 +00:00
|
|
|
LIBVIRT_ARG_SYSCTL_CONFIG
|
2016-12-15 14:04:23 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
LIBVIRT_CHECK_DTRACE
|
|
|
|
|
LIBVIRT_CHECK_NUMAD
|
|
|
|
|
LIBVIRT_CHECK_INIT_SCRIPT
|
|
|
|
|
LIBVIRT_CHECK_CHRDEV_LOCK_FILES
|
|
|
|
|
LIBVIRT_CHECK_LOADER_NVRAM
|
|
|
|
|
LIBVIRT_CHECK_LOGIN_SHELL
|
|
|
|
|
LIBVIRT_CHECK_HOST_VALIDATE
|
|
|
|
|
LIBVIRT_CHECK_TLS_PRIORITY
|
2016-11-29 07:33:19 +00:00
|
|
|
LIBVIRT_CHECK_SYSCTL_CONFIG
|
2016-12-25 12:42:42 +00:00
|
|
|
LIBVIRT_CHECK_NSS
|
2012-04-04 10:16:34 +00:00
|
|
|
|
2010-03-25 17:46:12 +00:00
|
|
|
|
2009-09-10 13:21:10 +00:00
|
|
|
dnl Need to test if pkg-config exists
|
|
|
|
|
PKG_PROG_PKG_CONFIG
|
|
|
|
|
|
2009-05-25 11:56:00 +00:00
|
|
|
|
2016-12-12 17:20:45 +00:00
|
|
|
dnl Security driver checks
|
|
|
|
|
LIBVIRT_SECDRIVER_ARG_SELINUX
|
2016-12-01 11:08:20 +00:00
|
|
|
LIBVIRT_SECDRIVER_ARG_APPARMOR
|
2009-10-08 14:34:22 +00:00
|
|
|
|
2016-12-01 11:08:20 +00:00
|
|
|
LIBVIRT_SECDRIVER_CHECK_SELINUX
|
|
|
|
|
LIBVIRT_SECDRIVER_CHECK_APPARMOR
|
2009-10-08 14:34:22 +00:00
|
|
|
|
2009-09-14 12:31:23 +00:00
|
|
|
|
2016-12-22 11:49:51 +00:00
|
|
|
LIBVIRT_ARG_WITH_FEATURE([SECRETS], [local secrets management driver], [yes])
|
2011-05-24 11:21:51 +00:00
|
|
|
|
2009-09-14 12:31:23 +00:00
|
|
|
if test "$with_libvirtd" = "no"; then
|
|
|
|
|
with_secrets=no
|
|
|
|
|
fi
|
|
|
|
|
if test "$with_secrets" = "yes" ; then
|
|
|
|
|
AC_DEFINE_UNQUOTED([WITH_SECRETS], 1, [whether local secrets management driver is available])
|
|
|
|
|
fi
|
|
|
|
|
AM_CONDITIONAL([WITH_SECRETS], [test "$with_secrets" = "yes"])
|
|
|
|
|
|
|
|
|
|
|
2016-12-13 09:36:14 +00:00
|
|
|
dnl
|
|
|
|
|
dnl Storage driver checks
|
|
|
|
|
dnl
|
|
|
|
|
|
2016-12-07 07:46:51 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_DIR
|
2016-12-07 09:16:19 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_FS
|
2016-12-07 09:22:05 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_LVM
|
2016-12-07 12:12:31 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_ISCSI
|
2018-07-31 08:44:21 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_ISCSI_DIRECT
|
2016-12-07 12:13:00 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_SCSI
|
2016-12-12 17:21:11 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_MPATH
|
2016-12-12 17:21:51 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_DISK
|
2016-12-07 14:44:08 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_RBD
|
2016-12-07 14:48:37 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_SHEEPDOG
|
2016-12-07 14:52:39 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_GLUSTER
|
2016-12-07 14:59:19 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_ZFS
|
2017-01-17 14:10:55 +00:00
|
|
|
LIBVIRT_STORAGE_ARG_VSTORAGE
|
2008-02-20 15:42:30 +00:00
|
|
|
|
2008-09-05 12:03:45 +00:00
|
|
|
if test "$with_libvirtd" = "no"; then
|
|
|
|
|
with_storage_dir=no
|
|
|
|
|
with_storage_fs=no
|
|
|
|
|
with_storage_lvm=no
|
|
|
|
|
with_storage_iscsi=no
|
2018-07-31 08:44:21 +00:00
|
|
|
with_storage_iscsi_direct=no
|
2009-04-01 16:03:22 +00:00
|
|
|
with_storage_scsi=no
|
2009-09-08 13:47:45 +00:00
|
|
|
with_storage_mpath=no
|
2008-09-05 12:03:45 +00:00
|
|
|
with_storage_disk=no
|
2012-05-14 09:06:42 +00:00
|
|
|
with_storage_rbd=no
|
2012-07-18 19:06:58 +00:00
|
|
|
with_storage_sheepdog=no
|
2013-11-19 23:26:05 +00:00
|
|
|
with_storage_gluster=no
|
2014-07-21 14:38:42 +00:00
|
|
|
with_storage_zfs=no
|
2017-01-17 14:10:55 +00:00
|
|
|
with_storage_vstorage=no
|
2008-09-05 12:03:45 +00:00
|
|
|
fi
|
2016-12-07 07:46:51 +00:00
|
|
|
|
2019-04-02 09:04:46 +00:00
|
|
|
dnl storage-fs does not work on macOS
|
2010-10-05 01:31:05 +00:00
|
|
|
|
2019-04-02 09:04:46 +00:00
|
|
|
if test "$with_macos" = "yes"; then
|
2010-10-05 01:31:05 +00:00
|
|
|
with_storage_fs=no
|
|
|
|
|
fi
|
2008-09-05 12:03:45 +00:00
|
|
|
|
2016-12-13 09:36:14 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_DIR
|
2016-12-07 09:16:19 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_FS
|
2016-12-07 09:22:05 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_LVM
|
2016-12-07 12:12:31 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_ISCSI
|
2018-07-31 08:44:21 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_ISCSI_DIRECT
|
2016-12-07 12:13:00 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_SCSI
|
2016-12-12 17:21:11 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_MPATH
|
2016-12-13 09:36:14 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_DISK
|
2016-12-07 14:44:08 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_RBD
|
2016-12-07 14:48:37 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_SHEEPDOG
|
2016-12-07 14:52:39 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_GLUSTER
|
2016-12-07 14:59:19 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_ZFS
|
2017-01-17 14:10:55 +00:00
|
|
|
LIBVIRT_STORAGE_CHECK_VSTORAGE
|
2008-02-20 15:45:33 +00:00
|
|
|
|
2012-06-05 16:28:52 +00:00
|
|
|
with_storage=no
|
2018-07-31 08:44:21 +00:00
|
|
|
for backend in dir fs lvm iscsi iscsi_direct scsi mpath rbd disk; do
|
2012-06-05 16:28:52 +00:00
|
|
|
if eval test \$with_storage_$backend = yes; then
|
|
|
|
|
with_storage=yes
|
|
|
|
|
break
|
|
|
|
|
fi
|
|
|
|
|
done
|
|
|
|
|
if test $with_storage = yes; then
|
|
|
|
|
AC_DEFINE([WITH_STORAGE], [1],
|
|
|
|
|
[Define to 1 if at least one storage backend is in use])
|
|
|
|
|
fi
|
|
|
|
|
AM_CONDITIONAL([WITH_STORAGE], [test "$with_storage" = "yes"])
|
|
|
|
|
|
2019-09-05 15:45:27 +00:00
|
|
|
dnl Python3 < 3.7 treats the C locale as 7-bit only.
|
|
|
|
|
dnl We must force env vars so it treats it as UTF-8
|
|
|
|
|
dnl regardless of the user's locale.
|
|
|
|
|
RUNUTF8="LC_ALL= LANG=C LC_CTYPE=en_US.UTF-8"
|
|
|
|
|
AC_SUBST(RUNUTF8)
|
|
|
|
|
|
|
|
|
|
|
2020-01-14 18:34:26 +00:00
|
|
|
dnl MinGW checks
|
2016-12-15 10:48:38 +00:00
|
|
|
LIBVIRT_WIN_CHECK_COMMON
|
2016-12-06 12:55:50 +00:00
|
|
|
LIBVIRT_WIN_CHECK_MINGW
|
2016-12-06 12:56:38 +00:00
|
|
|
LIBVIRT_WIN_CHECK_SYMBOLS
|
2016-12-06 12:57:12 +00:00
|
|
|
LIBVIRT_WIN_CHECK_WINDRES
|
2016-12-15 10:48:38 +00:00
|
|
|
|
|
|
|
|
|
2016-11-14 14:34:04 +00:00
|
|
|
dnl Driver-Modules library support
|
|
|
|
|
LIBVIRT_CHECK_DRIVER_MODULES
|
2008-11-21 12:16:08 +00:00
|
|
|
|
|
|
|
|
|
2008-02-28 17:07:37 +00:00
|
|
|
# Set LV_LIBTOOL_OBJDIR to "." or $lt_cv_objdir, depending on whether
|
|
|
|
|
# we're building shared libraries. This is the name of the directory
|
|
|
|
|
# in which .o files will be created.
|
|
|
|
|
test "$enable_shared" = no && lt_cv_objdir=.
|
|
|
|
|
LV_LIBTOOL_OBJDIR=${lt_cv_objdir-.}
|
2008-05-22 15:34:02 +00:00
|
|
|
AC_SUBST([LV_LIBTOOL_OBJDIR])
|
2008-02-28 17:07:37 +00:00
|
|
|
|
2008-11-21 12:27:11 +00:00
|
|
|
|
|
|
|
|
with_nodedev=no;
|
2010-03-24 21:31:31 +00:00
|
|
|
if test "$with_hal" = "yes" || test "$with_udev" = "yes";
|
2008-11-21 12:27:11 +00:00
|
|
|
then
|
|
|
|
|
with_nodedev=yes
|
|
|
|
|
AC_DEFINE_UNQUOTED([WITH_NODE_DEVICES], 1, [with node device driver])
|
|
|
|
|
fi
|
|
|
|
|
AM_CONDITIONAL([WITH_NODE_DEVICES], [test "$with_nodedev" = "yes"])
|
|
|
|
|
|
2013-07-17 18:02:17 +00:00
|
|
|
|
2014-04-21 10:59:58 +00:00
|
|
|
# Check for BSD kvm (kernel memory interface)
|
|
|
|
|
if test $with_freebsd = yes; then
|
|
|
|
|
AC_CHECK_LIB([kvm], [kvm_getprocs], [],
|
|
|
|
|
[AC_MSG_ERROR([BSD kernel memory interface library is required to build on FreeBSD])]
|
|
|
|
|
)
|
|
|
|
|
fi
|
|
|
|
|
|
2019-10-02 16:04:31 +00:00
|
|
|
GNUmakefile=GNUmakefile
|
|
|
|
|
m4_if(m4_version_compare([2.61a.100],
|
|
|
|
|
m4_defn([m4_PACKAGE_VERSION])), [1], [],
|
|
|
|
|
[AC_CONFIG_LINKS([$GNUmakefile:$GNUmakefile], [],
|
|
|
|
|
[GNUmakefile=$GNUmakefile])])
|
|
|
|
|
|
2012-09-14 09:08:54 +00:00
|
|
|
AC_CONFIG_FILES([run],
|
|
|
|
|
[chmod +x,-w run])
|
2013-07-31 20:52:16 +00:00
|
|
|
AC_CONFIG_FILES([\
|
2020-06-17 22:53:35 +00:00
|
|
|
Makefile src/Makefile docs/Makefile \
|
2017-04-21 14:05:19 +00:00
|
|
|
.color_coded \
|
2017-04-21 14:47:02 +00:00
|
|
|
.ycm_extra_conf.py \
|
2014-06-20 16:47:15 +00:00
|
|
|
libvirt.pc \
|
|
|
|
|
libvirt-qemu.pc \
|
|
|
|
|
libvirt-lxc.pc \
|
2015-04-15 14:16:24 +00:00
|
|
|
libvirt-admin.pc \
|
2014-06-20 16:48:12 +00:00
|
|
|
src/libvirt.pc \
|
|
|
|
|
src/libvirt-qemu.pc \
|
|
|
|
|
src/libvirt-lxc.pc \
|
2014-06-20 16:47:15 +00:00
|
|
|
libvirt.spec mingw-libvirt.spec \
|
2018-04-03 15:39:17 +00:00
|
|
|
po/Makefile \
|
2016-01-09 23:03:56 +00:00
|
|
|
examples/Makefile \
|
2013-07-31 20:52:16 +00:00
|
|
|
tests/Makefile \
|
2016-01-10 20:35:36 +00:00
|
|
|
tools/Makefile])
|
2013-07-31 20:52:16 +00:00
|
|
|
AC_OUTPUT
|
2007-09-18 23:36:30 +00:00
|
|
|
|
|
|
|
|
AC_MSG_NOTICE([])
|
|
|
|
|
AC_MSG_NOTICE([Configuration summary])
|
|
|
|
|
AC_MSG_NOTICE([=====================])
|
|
|
|
|
AC_MSG_NOTICE([])
|
|
|
|
|
AC_MSG_NOTICE([Drivers])
|
|
|
|
|
AC_MSG_NOTICE([])
|
2016-12-08 09:35:30 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_QEMU
|
2016-11-29 07:50:58 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_OPENVZ
|
2016-11-29 07:54:02 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_VMWARE
|
2016-12-12 17:19:21 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_VBOX
|
2016-12-12 15:18:02 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_LIBXL
|
2016-12-08 09:36:55 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_LXC
|
2016-12-01 09:40:31 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_ESX
|
2016-12-01 09:43:13 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_HYPERV
|
2015-07-10 14:32:00 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_VZ
|
2014-02-18 10:08:10 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_BHYVE
|
2016-12-01 09:23:41 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_TEST
|
2016-12-01 09:27:19 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_REMOTE
|
2016-12-01 11:02:30 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_NETWORK
|
2016-12-01 11:01:33 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_LIBVIRTD
|
2016-12-01 14:50:59 +00:00
|
|
|
LIBVIRT_DRIVER_RESULT_INTERFACE
|
2007-09-18 23:36:30 +00:00
|
|
|
AC_MSG_NOTICE([])
|
2008-02-20 15:42:30 +00:00
|
|
|
AC_MSG_NOTICE([Storage Drivers])
|
|
|
|
|
AC_MSG_NOTICE([])
|
2016-12-07 07:46:51 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_DIR
|
2016-12-07 09:16:19 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_FS
|
2016-12-07 09:22:05 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_LVM
|
2016-12-07 12:12:31 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_ISCSI
|
2018-07-31 08:44:21 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_ISCSI_DIRECT
|
2016-12-07 12:13:00 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_SCSI
|
2016-12-12 17:21:11 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_MPATH
|
2016-12-12 17:21:51 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_DISK
|
2016-12-07 14:44:08 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_RBD
|
2016-12-07 14:48:37 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_SHEEPDOG
|
2016-12-07 14:52:39 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_GLUSTER
|
2016-12-07 14:59:19 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_ZFS
|
2017-01-17 14:10:55 +00:00
|
|
|
LIBVIRT_STORAGE_RESULT_VSTORAGE
|
2008-02-20 15:42:30 +00:00
|
|
|
AC_MSG_NOTICE([])
|
2009-03-03 10:06:49 +00:00
|
|
|
AC_MSG_NOTICE([Security Drivers])
|
|
|
|
|
AC_MSG_NOTICE([])
|
2016-12-12 17:20:45 +00:00
|
|
|
LIBVIRT_SECDRIVER_RESULT_SELINUX
|
2016-12-01 11:08:20 +00:00
|
|
|
LIBVIRT_SECDRIVER_RESULT_APPARMOR
|
2009-03-03 10:06:49 +00:00
|
|
|
AC_MSG_NOTICE([])
|
2008-11-21 12:16:08 +00:00
|
|
|
AC_MSG_NOTICE([Driver Loadable Modules])
|
|
|
|
|
AC_MSG_NOTICE([])
|
2016-11-14 14:34:04 +00:00
|
|
|
LIBVIRT_RESULT_DRIVER_MODULES
|
2009-08-05 08:43:37 +00:00
|
|
|
AC_MSG_NOTICE([])
|
|
|
|
|
AC_MSG_NOTICE([Libraries])
|
|
|
|
|
AC_MSG_NOTICE([])
|
configure: selectively install a firewalld 'libvirt' zone
In the past (when both libvirt and firewalld used iptables), if either
libvirt's rules *OR* firewalld's rules accepted a packet, it would
be accepted. This was because libvirt and firewalld rules were
processed during the same kernel hook, and a single ACCEPT result
would terminate the rule traversal and cause the packet to be
accepted.
But now firewalld can use nftables for its backend, while libvirt's
firewall rules are still using iptables; iptables rules are still
processed, but at a different time during packet processing
(i.e. during a different hook) than the firewalld nftables rules. The
result is that a packet must be accepted by *BOTH* the libvirt
iptables rules *AND* the firewalld nftable rules in order to be
accepted.
This causes pain because
1) libvirt always adds rules to permit DNS and DHCP (and sometimes
TFTP) from guests to the host network's bridge interface. But
libvirt's bridges are in firewalld's "default" zone (which is usually
the zone called "public"). The public zone allows ssh, but doesn't
allow DNS, DHCP, or TFTP. So even though libvirt's rules allow the
DHCP and DNS traffic, the firewalld rules (now processed during a
different hook) dont, thus guests connected to libvirt's bridges can't
acquire an IP address from DHCP, nor can they make DNS queries to the
DNS server libvirt has setup on the host. (This could be solved by
modifying the default firewalld zone to allow DNS and DHCP, but that
would open *all* interfaces in the default zone to those services,
which is most likely not what the host's admin wants.)
2) Even though libvirt adds iptables rules to allow forwarded traffic
to pass the iptables hook, firewalld's higher level "rich rules" don't
yet have the ability to configure the acceptance of forwarded traffic
(traffic that is going somewhere beyond the host), so any traffic that
needs to be forwarded from guests to the network beyond the host is
rejected during the nftables hook by the default zone's "default
reject" policy (which rejects all traffic in the zone not specifically
allowed by the rules in the zone, whether that traffic is destined to
be forwarded or locally received by the host).
libvirt can't send "direct" nftables rules (firewalld only supports
direct/passthrough rules for iptables), so we can't solve this problem
by just sending explicit nftables rules instead of explicit iptables
rules (which, if it could be done, would place libvirt's rules in the
same hook as firewalld's native rules, and thus eliminate the need for
packets to be accepted by both libvirt's and firewalld's own rules).
However, we can take advantage of a quirk in firewalld zones that have
a default policy of "accept" (meaning any packet that doesn't match a
specific rule in the zone will be *accepted*) - this default accept will
also accept forwarded traffic (not just traffic destined for the host).
Of course we don't want to modify firewalld's default zone in that
way, because that would affect the filtering of traffic coming into
the host from other interfaces using that zone. Instead, we will
create a new zone called "libvirt". The libvirt zone will have a
default policy of accept so that forwarded traffic can pass and list
specific services that will be allowed into the host from guests (DNS,
DHCP, SSH, and TFTP).
But the same default accept policy that fixes forwarded traffic also
causes *all* traffic from guest to host to be accepted. To close this
new hole, the libvirt zone can take advantage of a new feature in
firewalld (currently slated for firewalld-0.7.0) - priorities for rich
rules - to add a low priority rule that rejects all local traffic (but
leaves alone all forwarded traffic).
So, our new zone will start with a list of services that are allowed
(dhcp, dns, tftp, and ssh to start, but configurable via any firewalld
management application, or direct editing of the zone file in
/etc/firewalld/zones/libvirt.xml), followed by a low priority
<reject/> rule (to reject all other traffic from guest to host), and
finally with a default policy of accept (to allow forwarded traffic).
This patch only creates the zonefile for the new zone, and implements
a configure.ac option to selectively enable/disable installation of
the new zone. A separate patch contains the necessary code to actually
place bridge interfaces in the libvirt zone.
Why do we need a configure option to disable installation of the new
libvirt zone? It uses a new firewalld attribute that sets the priority
of a rich rule; this feature first appears in firewalld-0.7.0 (unless
it has been backported to am earlier firewalld by a downstream
maintainer). If the file were installed on a system with firewalld
that didn't support rule priorities, firewalld would log an error
every time it restarted, causing confusion and lots of extra bug
reports.
So we add two new configure.ac switches to avoid polluting the system
logs with this error on systems that don't support rule priorities -
"--with-firewalld-zone" and "--without-firewalld-zone". A package
builder can use these to include/exclude the libvirt zone file in the
installation. If firewalld is enabled (--with-firewalld), the default
is --with-firewalld-zone, but it can be disabled during configure
(using --without-firewalld-zone). Targets that are using a firewalld
version too old to support the rule priority setting in the libvirt
zone file can simply add --without-firewalld-zone to their configure
commandline.
These switches only affect whether or not the libvirt zone file is
*installed* in /usr/lib/firewalld/zones, but have no effect on whether
or not libvirt looks for a zone called libvirt and tries to use it.
NB: firewalld zones can only be added to the permanent config of
firewalld, and won't be loaded/enabled until firewalld is restarted,
so at package install/upgrade time we have to restart firewalld. For
rpm-based distros, this is done in the libvirt.spec file by calling
the %firewalld_restart rpm macro, which is a part of the
firewalld-filesystem package. (For distros that don't use rpm
packages, the command "firewalld-cmd --reload" will have the same
effect).
Signed-off-by: Laine Stump <laine@laine.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-01-26 04:52:37 +00:00
|
|
|
LIBVIRT_RESULT_FIREWALLD_ZONE
|
2013-01-08 21:06:57 +00:00
|
|
|
LIBVIRT_RESULT_FUSE
|
2019-07-30 09:13:36 +00:00
|
|
|
LIBVIRT_RESULT_GLIB
|
2013-11-19 23:26:05 +00:00
|
|
|
LIBVIRT_RESULT_GLUSTER
|
2016-11-10 13:33:41 +00:00
|
|
|
LIBVIRT_RESULT_GNUTLS
|
2012-09-20 14:39:12 +00:00
|
|
|
LIBVIRT_RESULT_HAL
|
2018-07-31 08:44:20 +00:00
|
|
|
LIBVIRT_RESULT_LIBISCSI
|
2016-12-12 09:07:24 +00:00
|
|
|
LIBVIRT_RESULT_LIBNL
|
2016-12-09 10:01:47 +00:00
|
|
|
LIBVIRT_RESULT_LIBPCAP
|
2016-11-09 14:28:35 +00:00
|
|
|
LIBVIRT_RESULT_LIBSSH
|
2016-12-12 15:18:02 +00:00
|
|
|
LIBVIRT_RESULT_LIBXL
|
2016-12-19 14:11:06 +00:00
|
|
|
LIBVIRT_RESULT_LIBXML
|
2016-12-12 08:59:15 +00:00
|
|
|
LIBVIRT_RESULT_MACVTAP
|
2012-09-20 14:14:52 +00:00
|
|
|
LIBVIRT_RESULT_NETCF
|
2018-04-03 15:39:17 +00:00
|
|
|
LIBVIRT_RESULT_NLS
|
2016-11-10 13:33:41 +00:00
|
|
|
LIBVIRT_RESULT_NSS
|
2012-09-20 12:47:23 +00:00
|
|
|
LIBVIRT_RESULT_NUMACTL
|
2013-01-08 22:08:53 +00:00
|
|
|
LIBVIRT_RESULT_OPENWSMAN
|
2012-09-20 14:34:13 +00:00
|
|
|
LIBVIRT_RESULT_PCIACCESS
|
2016-12-12 09:12:13 +00:00
|
|
|
LIBVIRT_RESULT_PM_UTILS
|
2016-12-12 07:05:18 +00:00
|
|
|
LIBVIRT_RESULT_POLKIT
|
2016-12-07 14:44:08 +00:00
|
|
|
LIBVIRT_RESULT_RBD
|
2012-09-20 12:04:57 +00:00
|
|
|
LIBVIRT_RESULT_SANLOCK
|
2012-09-20 12:06:12 +00:00
|
|
|
LIBVIRT_RESULT_SASL
|
2012-09-20 12:21:48 +00:00
|
|
|
LIBVIRT_RESULT_SELINUX
|
2013-01-08 21:47:55 +00:00
|
|
|
LIBVIRT_RESULT_SSH2
|
2012-09-20 14:34:13 +00:00
|
|
|
LIBVIRT_RESULT_UDEV
|
2016-12-13 11:40:48 +00:00
|
|
|
LIBVIRT_RESULT_VIRTUALPORT
|
2016-12-13 11:40:30 +00:00
|
|
|
LIBVIRT_RESULT_XDR
|
2012-09-20 12:03:27 +00:00
|
|
|
LIBVIRT_RESULT_YAJL
|
2016-12-15 10:48:38 +00:00
|
|
|
AC_MSG_NOTICE([])
|
|
|
|
|
AC_MSG_NOTICE([Windows])
|
|
|
|
|
AC_MSG_NOTICE([])
|
|
|
|
|
LIBVIRT_WIN_RESULT_COMMON
|
2016-12-06 12:57:12 +00:00
|
|
|
LIBVIRT_WIN_RESULT_WINDRES
|
2007-09-18 23:36:30 +00:00
|
|
|
AC_MSG_NOTICE([])
|
|
|
|
|
AC_MSG_NOTICE([Miscellaneous])
|
|
|
|
|
AC_MSG_NOTICE([])
|
2016-11-30 13:34:57 +00:00
|
|
|
LIBVIRT_RESULT_DTRACE
|
2016-12-12 12:54:35 +00:00
|
|
|
LIBVIRT_RESULT_NUMAD
|
2016-05-02 11:27:47 +00:00
|
|
|
LIBVIRT_RESULT_INIT_SCRIPT
|
2016-12-13 12:45:25 +00:00
|
|
|
LIBVIRT_RESULT_CHRDEV_LOCK_FILES
|
2016-12-15 12:39:21 +00:00
|
|
|
LIBVIRT_RESULT_LOADER_NVRAM
|
2016-12-14 15:51:30 +00:00
|
|
|
LIBVIRT_RESULT_LOGIN_SHELL
|
|
|
|
|
LIBVIRT_RESULT_HOST_VALIDATE
|
2016-12-14 15:33:57 +00:00
|
|
|
LIBVIRT_RESULT_TLS_PRIORITY
|
2007-09-18 23:36:30 +00:00
|
|
|
AC_MSG_NOTICE([])
|
2014-01-15 17:06:58 +00:00
|
|
|
AC_MSG_NOTICE([Developer Tools])
|
|
|
|
|
AC_MSG_NOTICE([])
|
2016-12-13 11:40:05 +00:00
|
|
|
LIBVIRT_RESULT_WIRESHARK
|
2014-01-15 17:06:58 +00:00
|
|
|
AC_MSG_NOTICE([])
|
2009-07-15 21:25:01 +00:00
|
|
|
AC_MSG_NOTICE([Privileges])
|
|
|
|
|
AC_MSG_NOTICE([])
|
2016-12-12 14:35:07 +00:00
|
|
|
LIBVIRT_RESULT_QEMU_PRIVILEGES
|
2009-07-24 14:17:06 +00:00
|
|
|
AC_MSG_NOTICE([])
|
