mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2025-03-07 17:28:15 +00:00
util: use -w flag when calling iptables
When supported, ask iptables to wait rather than fail if it is in use by another caller (like ufw). (See https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1245322) Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
This commit is contained in:
parent
d94b781771
commit
ba95426d6f
@ -50,19 +50,25 @@
|
|||||||
#include "virstring.h"
|
#include "virstring.h"
|
||||||
#include "virutil.h"
|
#include "virutil.h"
|
||||||
|
|
||||||
|
bool iptables_supports_xlock = false;
|
||||||
|
|
||||||
#if HAVE_FIREWALLD
|
#if HAVE_FIREWALLD
|
||||||
static char *firewall_cmd_path = NULL;
|
static char *firewall_cmd_path = NULL;
|
||||||
|
#endif
|
||||||
|
|
||||||
static int
|
static int
|
||||||
virIpTablesOnceInit(void)
|
virIpTablesOnceInit(void)
|
||||||
{
|
{
|
||||||
|
virCommandPtr cmd;
|
||||||
|
int status;
|
||||||
|
|
||||||
|
#if HAVE_FIREWALLD
|
||||||
firewall_cmd_path = virFindFileInPath("firewall-cmd");
|
firewall_cmd_path = virFindFileInPath("firewall-cmd");
|
||||||
if (!firewall_cmd_path) {
|
if (!firewall_cmd_path) {
|
||||||
VIR_INFO("firewall-cmd not found on system. "
|
VIR_INFO("firewall-cmd not found on system. "
|
||||||
"firewalld support disabled for iptables.");
|
"firewalld support disabled for iptables.");
|
||||||
} else {
|
} else {
|
||||||
virCommandPtr cmd = virCommandNew(firewall_cmd_path);
|
cmd = virCommandNew(firewall_cmd_path);
|
||||||
int status;
|
|
||||||
|
|
||||||
virCommandAddArgList(cmd, "--state", NULL);
|
virCommandAddArgList(cmd, "--state", NULL);
|
||||||
if (virCommandRun(cmd, &status) < 0 || status != 0) {
|
if (virCommandRun(cmd, &status) < 0 || status != 0) {
|
||||||
@ -74,13 +80,26 @@ virIpTablesOnceInit(void)
|
|||||||
}
|
}
|
||||||
virCommandFree(cmd);
|
virCommandFree(cmd);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (firewall_cmd_path)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
#endif
|
||||||
|
|
||||||
|
cmd = virCommandNew(IPTABLES_PATH);
|
||||||
|
virCommandAddArgList(cmd, "-w", "-L", "-n", NULL);
|
||||||
|
if (virCommandRun(cmd, &status) < 0 || status != 0) {
|
||||||
|
VIR_INFO("xtables locking not supported by your iptables");
|
||||||
|
} else {
|
||||||
|
VIR_INFO("using xtables locking for iptables");
|
||||||
|
iptables_supports_xlock = true;
|
||||||
|
}
|
||||||
|
virCommandFree(cmd);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
VIR_ONCE_GLOBAL_INIT(virIpTables)
|
VIR_ONCE_GLOBAL_INIT(virIpTables)
|
||||||
|
|
||||||
#endif
|
|
||||||
|
|
||||||
#define VIR_FROM_THIS VIR_FROM_NONE
|
#define VIR_FROM_THIS VIR_FROM_NONE
|
||||||
|
|
||||||
enum {
|
enum {
|
||||||
@ -92,8 +111,8 @@ static virCommandPtr
|
|||||||
iptablesCommandNew(const char *table, const char *chain, int family, int action)
|
iptablesCommandNew(const char *table, const char *chain, int family, int action)
|
||||||
{
|
{
|
||||||
virCommandPtr cmd = NULL;
|
virCommandPtr cmd = NULL;
|
||||||
#if HAVE_FIREWALLD
|
|
||||||
virIpTablesInitialize();
|
virIpTablesInitialize();
|
||||||
|
#if HAVE_FIREWALLD
|
||||||
if (firewall_cmd_path) {
|
if (firewall_cmd_path) {
|
||||||
cmd = virCommandNew(firewall_cmd_path);
|
cmd = virCommandNew(firewall_cmd_path);
|
||||||
virCommandAddArgList(cmd, "--direct", "--passthrough",
|
virCommandAddArgList(cmd, "--direct", "--passthrough",
|
||||||
@ -104,6 +123,9 @@ iptablesCommandNew(const char *table, const char *chain, int family, int action)
|
|||||||
if (cmd == NULL) {
|
if (cmd == NULL) {
|
||||||
cmd = virCommandNew((family == AF_INET6)
|
cmd = virCommandNew((family == AF_INET6)
|
||||||
? IP6TABLES_PATH : IPTABLES_PATH);
|
? IP6TABLES_PATH : IPTABLES_PATH);
|
||||||
|
|
||||||
|
if (iptables_supports_xlock)
|
||||||
|
virCommandAddArgList(cmd, "-w", NULL);
|
||||||
}
|
}
|
||||||
|
|
||||||
virCommandAddArgList(cmd, "--table", table,
|
virCommandAddArgList(cmd, "--table", table,
|
||||||
|
Loading…
x
Reference in New Issue
Block a user