External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-03-07 17:28:15 +00:00
Code

util: use -w flag when calling iptables

Browse Source 
When supported, ask iptables to wait rather than fail if it is in use
by another caller (like ufw).

(See https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1245322)

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
This commit is contained in:
Serge Hallyn 2013-11-01 12:36:59 -05:00 committed by Laine Stump
parent d94b781771
commit ba95426d6f
1 changed files with 27 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
src/util/viriptables.c
View File

@ -50,19 +50,25 @@
#include "virstring.h" #include "virstring.h"
#include "virutil.h" #include "virutil.h"
bool iptables_supports_xlock = false;
#if HAVE_FIREWALLD #if HAVE_FIREWALLD
static char *firewall_cmd_path = NULL; static char *firewall_cmd_path = NULL;
#endif
static int static int
virIpTablesOnceInit(void) virIpTablesOnceInit(void)
{ {
virCommandPtr cmd;
int status;
#if HAVE_FIREWALLD
firewall_cmd_path = virFindFileInPath("firewall-cmd"); firewall_cmd_path = virFindFileInPath("firewall-cmd");
if (!firewall_cmd_path) { if (!firewall_cmd_path) {
VIR_INFO("firewall-cmd not found on system. " VIR_INFO("firewall-cmd not found on system. "
"firewalld support disabled for iptables."); "firewalld support disabled for iptables.");
} else { } else {
virCommandPtr cmd = virCommandNew(firewall_cmd_path); cmd = virCommandNew(firewall_cmd_path);
int status;
virCommandAddArgList(cmd, "--state", NULL); virCommandAddArgList(cmd, "--state", NULL);
if (virCommandRun(cmd, &status) < 0 || status != 0) { if (virCommandRun(cmd, &status) < 0 || status != 0) {
@ -74,13 +80,26 @@ virIpTablesOnceInit(void)
} }
virCommandFree(cmd); virCommandFree(cmd);
} }
if (firewall_cmd_path)
return 0;
#endif
cmd = virCommandNew(IPTABLES_PATH);
virCommandAddArgList(cmd, "-w", "-L", "-n", NULL);
if (virCommandRun(cmd, &status) < 0 || status != 0) {
VIR_INFO("xtables locking not supported by your iptables");
} else {
VIR_INFO("using xtables locking for iptables");
iptables_supports_xlock = true;
}
virCommandFree(cmd);
return 0; return 0;
} }
VIR_ONCE_GLOBAL_INIT(virIpTables) VIR_ONCE_GLOBAL_INIT(virIpTables)
#endif
#define VIR_FROM_THIS VIR_FROM_NONE #define VIR_FROM_THIS VIR_FROM_NONE
enum { enum {
@ -92,8 +111,8 @@ static virCommandPtr
iptablesCommandNew(const char *table, const char *chain, int family, int action) iptablesCommandNew(const char *table, const char *chain, int family, int action)
{ {
virCommandPtr cmd = NULL; virCommandPtr cmd = NULL;
#if HAVE_FIREWALLD
virIpTablesInitialize(); virIpTablesInitialize();
#if HAVE_FIREWALLD
if (firewall_cmd_path) { if (firewall_cmd_path) {
cmd = virCommandNew(firewall_cmd_path); cmd = virCommandNew(firewall_cmd_path);
virCommandAddArgList(cmd, "--direct", "--passthrough", virCommandAddArgList(cmd, "--direct", "--passthrough",
@ -104,6 +123,9 @@ iptablesCommandNew(const char *table, const char *chain, int family, int action)
if (cmd == NULL) { if (cmd == NULL) {
cmd = virCommandNew((family == AF_INET6) cmd = virCommandNew((family == AF_INET6)
? IP6TABLES_PATH : IPTABLES_PATH); ? IP6TABLES_PATH : IPTABLES_PATH);
if (iptables_supports_xlock)
virCommandAddArgList(cmd, "-w", NULL);
} }
virCommandAddArgList(cmd, "--table", table, virCommandAddArgList(cmd, "--table", table,