libvirt/po/POTFILES

401 lines
10 KiB
Plaintext
Raw Normal View History

src/access/viraccessapicheck.c
src/access/viraccessapichecklxc.c
src/access/viraccessapicheckqemu.c
src/admin/admin_client.h
src/admin/admin_server_dispatch_stubs.h
src/remote/remote_client_bodies.h
src/remote/remote_daemon_dispatch_stubs.h
src/access/viraccessdriverpolkit.c
src/access/viraccessmanager.c
src/admin/admin_server.c
src/admin/admin_server_dispatch.c
src/admin/libvirt-admin.c
src/bhyve/bhyve_capabilities.c
src/bhyve/bhyve_command.c
src/bhyve/bhyve_domain.c
src/bhyve/bhyve_driver.c
src/bhyve/bhyve_firmware.c
src/bhyve/bhyve_monitor.c
src/bhyve/bhyve_parse_command.c
src/bhyve/bhyve_process.c
src/ch/ch_conf.c
src/ch/ch_domain.c
src/ch/ch_driver.c
src/ch/ch_interface.c
src/ch/ch_monitor.c
src/ch/ch_process.c
src/conf/backup_conf.c
src/conf/capabilities.c
src/conf/checkpoint_conf.c
src/conf/cpu_conf.c
src/conf/device_conf.c
src/conf/domain_addr.c
src/conf/domain_capabilities.c
src/conf/domain_conf.c
src/conf/domain_event.c
src/conf/domain_postparse.c
src/conf/domain_validate.c
src/conf/interface_conf.c
src/conf/netdev_bandwidth_conf.c
src/conf/netdev_vlan_conf.c
src/conf/netdev_vport_profile_conf.c
src/conf/network_conf.c
src/conf/networkcommon_conf.c
src/conf/node_device_conf.c
src/conf/node_device_util.c
src/conf/numa_conf.c
src/conf/nwfilter_conf.c
src/conf/nwfilter_params.c
src/conf/object_event.c
src/conf/secret_conf.c
src/conf/snapshot_conf.c
src/conf/storage_adapter_conf.c
src/conf/storage_conf.c
src/conf/storage_encryption_conf.c
src/conf/storage_source_conf.c
src/conf/virchrdev.c
src/conf/virdomainjob.c
src/conf/virdomainmomentobjlist.c
src/conf/virdomainobjlist.c
src/conf/virnetworkobj.c
src/conf/virnetworkportdef.c
src/conf/virnodedeviceobj.c
src/conf/virnwfilterbindingdef.c
src/conf/virnwfilterbindingobj.c
src/conf/virnwfilterbindingobjlist.c
src/conf/virnwfilterobj.c
src/conf/virsavecookie.c
src/conf/virsecretobj.c
src/conf/virstorageobj.c
src/cpu/cpu.c
src/cpu/cpu_arm.c
src/cpu/cpu_map.c
src/cpu/cpu_ppc64.c
src/cpu/cpu_riscv64.c
src/cpu/cpu_s390.c
src/cpu/cpu_x86.c
src/datatypes.c
src/driver.c
src/esx/esx_driver.c
src/esx/esx_network_driver.c
src/esx/esx_storage_backend_iscsi.c
src/esx/esx_storage_backend_vmfs.c
src/esx/esx_storage_driver.c
src/esx/esx_stream.c
src/esx/esx_util.c
src/esx/esx_util.h
src/esx/esx_vi.c
src/esx/esx_vi_methods.c
src/esx/esx_vi_types.c
src/hyperv/hyperv_driver.c
src/hyperv/hyperv_network_driver.c
src/hyperv/hyperv_util.c
src/hyperv/hyperv_wmi.c
src/hypervisor/domain_cgroup.c
src/hypervisor/domain_driver.c
src/hypervisor/domain_interface.c
src/hypervisor/virhostdev.c
src/interface/interface_backend_netcf.c
src/interface/interface_backend_udev.c
src/internal.h
src/libvirt-domain-checkpoint.c
src/libvirt-domain-snapshot.c
src/libvirt-domain.c
src/libvirt-host.c
src/libvirt-lxc.c
src/libvirt-network.c
src/libvirt-nodedev.c
src/libvirt-nwfilter.c
src/libvirt-qemu.c
src/libvirt-secret.c
src/libvirt-storage.c
src/libvirt-stream.c
src/libvirt.c
src/libxl/libxl_capabilities.c
src/libxl/libxl_conf.c
src/libxl/libxl_domain.c
src/libxl/libxl_driver.c
src/libxl/libxl_migration.c
src/libxl/xen_common.c
src/libxl/xen_xl.c
src/libxl/xen_xm.c
src/locking/lock_daemon.c
src/locking/lock_daemon_dispatch.c
src/locking/lock_driver_lockd.c
src/locking/lock_driver_sanlock.c
src/locking/lock_manager.c
src/locking/sanlock_helper.c
src/logging/log_cleaner.c
src/logging/log_daemon.c
src/logging/log_daemon_dispatch.c
src/logging/log_handler.c
src/logging/log_manager.c
src/lxc/lxc_cgroup.c
src/lxc/lxc_conf.c
src/lxc/lxc_container.c
src/lxc/lxc_controller.c
src/lxc/lxc_domain.c
src/lxc/lxc_driver.c
src/lxc/lxc_fuse.c
src/lxc/lxc_hostdev.c
src/lxc/lxc_native.c
src/lxc/lxc_process.c
src/network/bridge_driver.c
src/network/bridge_driver_conf.c
src/network/bridge_driver_linux.c
network: introduce a "none" firewall backend type There are two scenarios identified after the recent firewall backend selection was introduced, which result in libvirtd failing to startup due to an inability to find either iptables/nftables - On Linux if running unprivileged with $PATH lacking the dir containing iptables/nftables - On non-Linux where iptables/nftables never existed In the former case, it is preferrable to restore the behaviour whereby the driver starts successfully. Users will get an error reported when attempting to start any virtual network, due to the lack of permissions needed to create bridge devices. This makes the missing firewall backend irrelevant. In the latter case, the network driver calls the 'nop' platform implementation which does not attempt to implement any firewall logic, just allowing the network to start without firewall rules. To solve this are number of changes are required * Introduce VIR_FIREWALL_BACKEND_NONE, which does nothing except report a fatal error from virFirewallApply(). This code path is unreachable, since we'll never create a virFirewall object with with VIR_FIREWALL_BACKEND_NONE, so the error reporting is just a sanity check. * Ignore the compile time backend defaults and assume use of the 'none' backend if running unprivileged. This fixes the first regression, avoiding the failure to start libvirtd on Linux in unprivileged context, instead allowing use of the driver and expecting a permission denied when creating a bridge. * Reject the use of compile time backend defaults no non-Linux and hardcode the 'none' backend. The non-Linux platforms have no firewall implementation at all currently, so there's no reason to permit the use of 'firewall_backend_priority' meson option. This fixes the second regression, avoiding the failure to start libvirtd on non-Linux hosts due to non-existant Linux binaries. * Change the Linux platform backend to raise an error if the firewall backend is 'none'. Again this code path is unreachable by default since we'll fail to create the bridge before getting here, but if someone modified network.conf to request the 'none' backend, this will stop further progress. * Change the nop platform backend to raise an error if the firewall backend is 'iptables' or 'nftables'. Again this code path is unreachable, since we should already have failed to find the iptables/nftables binaries on non-Linux hosts, so this is just a sanity check. * 'none' is not permited as a value in 'firewall_backend_priority' meson option, since it is conceptually meaningless to ask for that on Linux. NB, 'firewall_backend_priority' allows repeated options temporarily, which we don't want. Meson intends to turn this into a hard error DEPRECATION: Duplicated values in array option is deprecated. This will become a hard error in the future. and we can live with the reduced error checking until that happens. Reviewed-by: Andrea Bolognani <abologna@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2024-06-13 17:16:48 +00:00
src/network/bridge_driver_nop.c
src/network/leaseshelper.c
src/network/network_iptables.c
network: add an nftables backend for network driver's firewall construction Support using nftables to setup the firewall for each virtual network, rather than iptables. The initial implementation of the nftables backend creates (almost) exactly the same ruleset as the iptables backend, determined by running the following commands on a host that has an active virtual network: iptables-save >iptables.txt iptables-restore-translate -f iptables.txt (and the similar ip6tables-save/ip6tables-restore-translate for an IPv6 network). Correctness of the new backend was checked by comparing the output of: nft list ruleset when the backend is set to iptables and when it is set to nftables. This page was used as a guide: https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables The only differences between the rules created by the nftables backed vs. the iptables backend (aside from a few inconsequential changes in display order of some chains/options) are: 1) When we add nftables rules, rather than adding them in the system-created "filter" and "nat" tables, we add them in a private table (ie only we should be using it) created by us called "libvirt" (the system-created "filter" and "nat" tables can't be used because adding any rules to those tables directly with nft will cause failure of any legacy application attempting to use iptables when it tries to list the iptables rules (e.g. "iptables -S"). (NB: in nftables only a single table is required for both nat and filter rules - the chains for each are differentiated by specifying different "hook" locations for the toplevel chain of each) 2) Since the rules that were added to allow tftp/dns/dhcp traffic from the guests to the host are unnecessary in the context of nftables, those rules aren't added. (Longer explanation: In the case of iptables, all rules were in a single table, and it was always assumed that there would be some "catch-all" REJECT rule added by "someone else" in the case that a packet didn't match any specific rules, so libvirt added these specific rules to ensure that, no matter what other rules were added by any other subsystem, the guests would still have functional tftp/dns/dhcp. For nftables though, the rules added by each subsystem are in a separate table, and in order for traffic to be accepted, it must be accepted by *all* tables, so just adding the specific rules to libvirt's table doesn't help anything (as the default for the libvirt table is ACCEPT anyway) and it just isn't practical/possible for libvirt to find *all* other tables and add rules in all of them to make sure the traffic is accepted. libvirt does this for firewalld (it creates a "libvirt" zone that allows tftp/dns/dhcp, and adds all virtual network bridges to that zone), however, so in that case no extra work is required of the sysadmin.) 3) nftables doesn't support the "checksum mangle" rule (or any equivalent functionality) that we have historically added to our iptables rules, so the nftables rules we add have nothing related to checksum mangling. (NB: The result of (3) is that if you a) have a very old guest (RHEL5 era or earlier) and b) that guest is using a virtio-net network device, and c) the virtio-net device is using vhost packet processing (the default) then DHCP on the guest will fail. You can work around this by adding <driver name='qemu'/> to the <interface> XML for the guest). There are certainly much better nftables rulesets that could be used instead of those implemented here, and everything is in place to make future changes to the rules that are used simple and free of surprises (e.g. the rules that are added have coresponding "removal" commands added to the network status so that we will always remove exactly the rules that were previously added rather than trying to remove the rules that "the current build of libvirt would have added" (which will be incorrect the first time we run a libvirt with a newly modified ruleset). For this initial implementation though, I wanted the nftables rules to be as identical to the iptables rules as possible, just to make it easier to verify that everything is working. The backend can be manually chosen using the firewall_backend setting in /etc/libvirt/network.conf. libvirtd/virtnetworkd will read this setting when it starts; if there is no explicit setting, it will check for availability of FIREWALL_BACKEND_DEFAULT_1 and then FIREWALL_BACKEND_DEFAULT_2 (which are set at build time in meson_options.txt or by adding -Dfirewall_backend_default_n=blah to the meson commandline), and use the first backend that is available (ie, that has the necessary programs installed). The standard meson_options.txt is set to check for nftables first, and then iptables. Although it should be very safe to change the default backend from iptables to nftables, that change is left for a later patch, to show how the change in default can be undone if someone really needs to do that. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Tested-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
src/network/network_nftables.c
src/node_device/node_device_driver.c
src/node_device/node_device_udev.c
src/nwfilter/nwfilter_dhcpsnoop.c
src/nwfilter/nwfilter_driver.c
src/nwfilter/nwfilter_ebiptables_driver.c
src/nwfilter/nwfilter_gentech_driver.c
src/nwfilter/nwfilter_learnipaddr.c
src/openvz/openvz_conf.c
src/openvz/openvz_driver.c
src/openvz/openvz_util.c
src/qemu/qemu_agent.c
src/qemu/qemu_alias.c
src/qemu/qemu_backup.c
src/qemu/qemu_block.c
src/qemu/qemu_blockjob.c
src/qemu/qemu_capabilities.c
src/qemu/qemu_cgroup.c
src/qemu/qemu_checkpoint.c
src/qemu/qemu_command.c
src/qemu/qemu_conf.c
src/qemu/qemu_dbus.c
src/qemu/qemu_domain.c
src/qemu/qemu_domain_address.c
src/qemu/qemu_domainjob.c
src/qemu/qemu_driver.c
src/qemu/qemu_extdevice.c
src/qemu/qemu_fd.c
src/qemu/qemu_firmware.c
src/qemu/qemu_hostdev.c
src/qemu/qemu_hotplug.c
src/qemu/qemu_interface.c
src/qemu/qemu_interop_config.c
src/qemu/qemu_logcontext.c
src/qemu/qemu_migration.c
src/qemu/qemu_migration_cookie.c
src/qemu/qemu_migration_params.c
src/qemu/qemu_monitor.c
src/qemu/qemu_monitor_json.c
src/qemu/qemu_monitor_text.c
src/qemu/qemu_namespace.c
src/qemu/qemu_nbdkit.c
src/qemu/qemu_passt.c
src/qemu/qemu_postparse.c
src/qemu/qemu_process.c
src/qemu/qemu_qapi.c
src/qemu/qemu_saveimage.c
src/qemu/qemu_slirp.c
src/qemu/qemu_snapshot.c
src/qemu/qemu_tpm.c
src/qemu/qemu_validate.c
src/qemu/qemu_vhost_user.c
src/qemu/qemu_vhost_user_gpu.c
src/qemu/qemu_virtiofs.c
src/remote/remote_daemon.c
src/remote/remote_daemon_config.c
src/remote/remote_daemon_dispatch.c
src/remote/remote_daemon_stream.c
src/remote/remote_driver.c
src/remote/remote_sockets.c
src/remote/remote_ssh_helper.c
src/rpc/virkeepalive.c
src/rpc/virnetclient.c
src/rpc/virnetclientprogram.c
src/rpc/virnetclientstream.c
src/rpc/virnetdaemon.c
src/rpc/virnetlibsshsession.c
src/rpc/virnetmessage.c
src/rpc/virnetsaslcontext.c
src/rpc/virnetserver.c
src/rpc/virnetserverclient.c
src/rpc/virnetserverprogram.c
src/rpc/virnetserverservice.c
src/rpc/virnetsocket.c
src/rpc/virnetsshsession.c
src/rpc/virnettlscert.c
src/rpc/virnettlscontext.c
src/secret/secret_driver.c
src/security/security_apparmor.c
src/security/security_dac.c
src/security/security_driver.c
src/security/security_manager.c
src/security/security_selinux.c
src/security/security_util.c
src/security/virt-aa-helper.c
src/storage/parthelper.c
src/storage/storage_backend.c
src/storage/storage_backend_disk.c
src/storage/storage_backend_fs.c
src/storage/storage_backend_gluster.c
src/storage/storage_backend_iscsi.c
src/storage/storage_backend_iscsi_direct.c
src/storage/storage_backend_logical.c
src/storage/storage_backend_mpath.c
src/storage/storage_backend_rbd.c
src/storage/storage_backend_scsi.c
src/storage/storage_backend_vstorage.c
src/storage/storage_backend_zfs.c
src/storage/storage_driver.c
src/storage/storage_util.c
src/storage_file/storage_file_backend.c
src/storage_file/storage_file_backend_fs.c
src/storage_file/storage_file_backend_gluster.c
src/storage_file/storage_file_probe.c
src/storage_file/storage_source.c
src/storage_file/storage_source_backingstore.c
src/test/test_driver.c
src/util/iohelper.c
src/util/viracpi.c
src/util/viralloc.c
src/util/virarptable.c
src/util/viraudit.c
src/util/virauth.c
src/util/virauthconfig.c
src/util/virbitmap.c
src/util/vircgroup.c
src/util/virccw.c
src/util/vircgroupbackend.c
src/util/vircgroupbackend.h
src/util/vircgroupv1.c
src/util/vircgroupv2.c
src/util/vircgroupv2devices.c
src/util/vircommand.c
src/util/virconf.c
src/util/vircrypto.c
src/util/virdaemon.c
src/util/virdevmapper.c
src/util/virdnsmasq.c
src/util/virerror.c
src/util/virerror.h
src/util/virevent.c
src/util/vireventthread.c
src/util/virfcp.c
src/util/virfdstream.c
src/util/virfile.c
src/util/virfilecache.c
src/util/virfirewall.c
src/util/virfirewalld.c
src/util/virfirmware.c
src/util/virgdbus.c
src/util/virhash.c
src/util/virhook.c
src/util/virhostcpu.c
src/util/virhostmem.c
src/util/virhostuptime.c
src/util/viridentity.c
src/util/virinitctl.c
src/util/viriscsi.c
src/util/virjson.c
src/util/virlease.c
src/util/virlockspace.c
src/util/virlog.c
src/util/virmacmap.c
src/util/virmdev.c
src/util/virmodule.c
src/util/virnetdev.c
src/util/virnetdevbandwidth.c
src/util/virnetdevbridge.c
src/util/virnetdevip.c
src/util/virnetdevmacvlan.c
src/util/virnetdevmidonet.c
src/util/virnetdevopenvswitch.c
src/util/virnetdevtap.c
src/util/virnetdevveth.c
src/util/virnetdevvportprofile.c
src/util/virnetlink.c
src/util/virnodesuspend.c
src/util/virnuma.c
src/util/virnvme.c
src/util/virobject.c
src/util/virpci.c
src/util/virperf.c
src/util/virpidfile.c
src/util/virpolkit.c
src/util/virportallocator.c
src/util/virprocess.c
src/util/virqemu.c
src/util/virrandom.c
src/util/virresctrl.c
src/util/virrotatingfile.c
src/util/virscsi.c
src/util/virscsihost.c
src/util/virscsivhost.c
src/util/virsecret.c
src/util/virsocketaddr.c
src/util/virstoragefile.c
src/util/virstring.c
src/util/virsysinfo.c
src/util/virsystemd.c
src/util/virthreadjob.c
src/util/virthreadpool.c
src/util/virtime.c
src/util/virtpm.c
src/util/virtypedparam-public.c
src/util/virtypedparam.c
src/util/viruri.c
src/util/virusb.c
src/util/virutil.c
src/util/virvhba.c
src/util/virvsock.c
src/util/virxml.c
src/vbox/vbox_XPCOMCGlue.c
src/vbox/vbox_common.c
src/vbox/vbox_driver.c
src/vbox/vbox_network.c
src/vbox/vbox_snapshot_conf.c
src/vbox/vbox_storage.c
src/vbox/vbox_tmpl.c
src/vmware/vmware_conf.c
src/vmware/vmware_driver.c
src/vmx/vmx.c
src/vz/vz_driver.c
src/vz/vz_sdk.c
src/vz/vz_utils.c
src/vz/vz_utils.h
tests/virpolkittest.c
tools/libvirt-guests.sh.in
tools/ssh-proxy/ssh-proxy.c
tools/virsh-backup.c
tools/virsh-checkpoint.c
tools/virsh-completer-host.c
tools/virsh-console.c
tools/virsh-domain-event.c
tools/virsh-domain-monitor.c
tools/virsh-domain.c
tools/virsh-edit.c
tools/virsh-host.c
tools/virsh-interface.c
tools/virsh-network.c
tools/virsh-nodedev.c
tools/virsh-nwfilter.c
tools/virsh-pool.c
tools/virsh-secret.c
tools/virsh-snapshot.c
tools/virsh-util.c
tools/virsh-volume.c
tools/virsh.c
tools/virsh.h
tools/virt-admin.c
tools/virt-host-validate-bhyve.c
tools/virt-host-validate-ch.c
tools/virt-host-validate-common.c
tools/virt-host-validate-lxc.c
tools/virt-host-validate-qemu.c
tools/virt-host-validate.c
tools/virt-login-shell-helper.c
tools/virt-pki-query-dn.c
tools/virt-pki-validate.c
tools/virt-validate-common.c
tools/vsh-table.c
tools/vsh.c
tools/vsh.h