External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-09-19 14:10:58 +00:00
Code Issues Packages Projects Releases Wiki Activity
4381b83d99
libvirt/po/POTFILES
Laine Stump b89c4991da network: add an nftables backend for network driver's firewall construction 
Support using nftables to setup the firewall for each virtual network,
rather than iptables. The initial implementation of the nftables
backend creates (almost) exactly the same ruleset as the iptables
backend, determined by running the following commands on a host that
has an active virtual network:

  iptables-save >iptables.txt
  iptables-restore-translate -f iptables.txt

(and the similar ip6tables-save/ip6tables-restore-translate for an
IPv6 network). Correctness of the new backend was checked by comparing
the output of:

  nft list ruleset

when the backend is set to iptables and when it is set to nftables.

This page was used as a guide:

  https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables

The only differences between the rules created by the nftables backed
vs. the iptables backend (aside from a few inconsequential changes in
display order of some chains/options) are:

1) When we add nftables rules, rather than adding them in the
system-created "filter" and "nat" tables, we add them in a private
table (ie only we should be using it) created by us called "libvirt"
(the system-created "filter" and "nat" tables can't be used because
adding any rules to those tables directly with nft will cause failure
of any legacy application attempting to use iptables when it tries to
list the iptables rules (e.g. "iptables -S").

(NB: in nftables only a single table is required for both nat and
filter rules - the chains for each are differentiated by specifying
different "hook" locations for the toplevel chain of each)

2) Since the rules that were added to allow tftp/dns/dhcp traffic from
the guests to the host are unnecessary in the context of nftables,
those rules aren't added.

(Longer explanation: In the case of iptables, all rules were in a
single table, and it was always assumed that there would be some
"catch-all" REJECT rule added by "someone else" in the case that a
packet didn't match any specific rules, so libvirt added these
specific rules to ensure that, no matter what other rules were added
by any other subsystem, the guests would still have functional
tftp/dns/dhcp. For nftables though, the rules added by each subsystem
are in a separate table, and in order for traffic to be accepted, it
must be accepted by *all* tables, so just adding the specific rules to
libvirt's table doesn't help anything (as the default for the libvirt
table is ACCEPT anyway) and it just isn't practical/possible for
libvirt to find *all* other tables and add rules in all of them to
make sure the traffic is accepted. libvirt does this for firewalld (it
creates a "libvirt" zone that allows tftp/dns/dhcp, and adds all
virtual network bridges to that zone), however, so in that case no
extra work is required of the sysadmin.)

3) nftables doesn't support the "checksum mangle" rule (or any
equivalent functionality) that we have historically added to our
iptables rules, so the nftables rules we add have nothing related to
checksum mangling.

(NB: The result of (3) is that if you a) have a very old guest (RHEL5
era or earlier) and b) that guest is using a virtio-net network
device, and c) the virtio-net device is using vhost packet processing
(the default) then DHCP on the guest will fail. You can work around
this by adding <driver name='qemu'/> to the <interface> XML for the
guest).

There are certainly much better nftables rulesets that could be used
instead of those implemented here, and everything is in place to make
future changes to the rules that are used simple and free of surprises
(e.g. the rules that are added have coresponding "removal" commands
added to the network status so that we will always remove exactly the
rules that were previously added rather than trying to remove the
rules that "the current build of libvirt would have added" (which will
be incorrect the first time we run a libvirt with a newly modified
ruleset). For this initial implementation though, I wanted the
nftables rules to be as identical to the iptables rules as possible,
just to make it easier to verify that everything is working.

The backend can be manually chosen using the firewall_backend setting
in /etc/libvirt/network.conf. libvirtd/virtnetworkd will read this
setting when it starts; if there is no explicit setting, it will check
for availability of FIREWALL_BACKEND_DEFAULT_1 and then
FIREWALL_BACKEND_DEFAULT_2 (which are set at build time in
meson_options.txt or by adding -Dfirewall_backend_default_n=blah to
the meson commandline), and use the first backend that is available
(ie, that has the necessary programs installed). The standard
meson_options.txt is set to check for nftables first, and then
iptables.

Although it should be very safe to change the default backend from
iptables to nftables, that change is left for a later patch, to show
how the change in default can be undone if someone really needs to do
that.

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Tested-by: Daniel P. Berrangé <berrange@redhat.com>
2024-05-22 23:20:07 -04:00

396 lines
9.9 KiB
Plaintext
Raw Blame History

src/access/viraccessapicheck.c
src/access/viraccessapichecklxc.c
src/access/viraccessapicheckqemu.c
src/admin/admin_client.h
src/admin/admin_server_dispatch_stubs.h
src/remote/remote_client_bodies.h
src/remote/remote_daemon_dispatch_stubs.h
src/access/viraccessdriverpolkit.c
src/access/viraccessmanager.c
src/admin/admin_server.c
src/admin/admin_server_dispatch.c
src/admin/libvirt-admin.c
src/bhyve/bhyve_capabilities.c
src/bhyve/bhyve_command.c
src/bhyve/bhyve_domain.c
src/bhyve/bhyve_driver.c
src/bhyve/bhyve_firmware.c
src/bhyve/bhyve_monitor.c
src/bhyve/bhyve_parse_command.c
src/bhyve/bhyve_process.c
src/ch/ch_conf.c
src/ch/ch_domain.c
src/ch/ch_driver.c
src/ch/ch_interface.c
src/ch/ch_monitor.c
src/ch/ch_process.c
src/conf/backup_conf.c
src/conf/capabilities.c
src/conf/checkpoint_conf.c
src/conf/cpu_conf.c
src/conf/device_conf.c
src/conf/domain_addr.c
src/conf/domain_capabilities.c
src/conf/domain_conf.c
src/conf/domain_event.c
src/conf/domain_postparse.c
src/conf/domain_validate.c
src/conf/interface_conf.c
src/conf/netdev_bandwidth_conf.c
src/conf/netdev_vlan_conf.c
src/conf/netdev_vport_profile_conf.c
src/conf/network_conf.c
src/conf/networkcommon_conf.c
src/conf/node_device_conf.c
src/conf/node_device_util.c
src/conf/numa_conf.c
src/conf/nwfilter_conf.c
src/conf/nwfilter_params.c
src/conf/object_event.c
src/conf/secret_conf.c
src/conf/snapshot_conf.c
src/conf/storage_adapter_conf.c
src/conf/storage_conf.c
src/conf/storage_encryption_conf.c
src/conf/storage_source_conf.c
src/conf/virchrdev.c
src/conf/virdomainjob.c
src/conf/virdomainmomentobjlist.c
src/conf/virdomainobjlist.c
src/conf/virnetworkobj.c
src/conf/virnetworkportdef.c
src/conf/virnodedeviceobj.c
src/conf/virnwfilterbindingdef.c
src/conf/virnwfilterbindingobj.c
src/conf/virnwfilterbindingobjlist.c
src/conf/virnwfilterobj.c
src/conf/virsavecookie.c
src/conf/virsecretobj.c
src/conf/virstorageobj.c
src/cpu/cpu.c
src/cpu/cpu_arm.c
src/cpu/cpu_map.c
src/cpu/cpu_ppc64.c
src/cpu/cpu_riscv64.c
src/cpu/cpu_s390.c
src/cpu/cpu_x86.c
src/datatypes.c
src/driver.c
src/esx/esx_driver.c
src/esx/esx_network_driver.c
src/esx/esx_storage_backend_iscsi.c
src/esx/esx_storage_backend_vmfs.c
src/esx/esx_storage_driver.c
src/esx/esx_stream.c
src/esx/esx_util.c
src/esx/esx_util.h
src/esx/esx_vi.c
src/esx/esx_vi_methods.c
src/esx/esx_vi_types.c
src/hyperv/hyperv_driver.c
src/hyperv/hyperv_network_driver.c
src/hyperv/hyperv_util.c
src/hyperv/hyperv_wmi.c
src/hypervisor/domain_cgroup.c
src/hypervisor/domain_driver.c
src/hypervisor/domain_interface.c
src/hypervisor/virhostdev.c
src/interface/interface_backend_netcf.c
src/interface/interface_backend_udev.c
src/internal.h
src/libvirt-domain-checkpoint.c
src/libvirt-domain-snapshot.c
src/libvirt-domain.c
src/libvirt-host.c
src/libvirt-lxc.c
src/libvirt-network.c
src/libvirt-nodedev.c
src/libvirt-nwfilter.c
src/libvirt-qemu.c
src/libvirt-secret.c
src/libvirt-storage.c
src/libvirt-stream.c
src/libvirt.c
src/libxl/libxl_capabilities.c
src/libxl/libxl_conf.c
src/libxl/libxl_domain.c
src/libxl/libxl_driver.c
src/libxl/libxl_migration.c
src/libxl/xen_common.c
src/libxl/xen_xl.c
src/libxl/xen_xm.c
src/locking/lock_daemon.c
src/locking/lock_daemon_dispatch.c
src/locking/lock_driver_lockd.c
src/locking/lock_driver_sanlock.c
src/locking/lock_manager.c
src/locking/sanlock_helper.c
src/logging/log_cleaner.c
src/logging/log_daemon.c
src/logging/log_daemon_dispatch.c
src/logging/log_handler.c
src/logging/log_manager.c
src/lxc/lxc_cgroup.c
src/lxc/lxc_conf.c
src/lxc/lxc_container.c
src/lxc/lxc_controller.c
src/lxc/lxc_domain.c
src/lxc/lxc_driver.c
src/lxc/lxc_fuse.c
src/lxc/lxc_hostdev.c
src/lxc/lxc_native.c
src/lxc/lxc_process.c
src/network/bridge_driver.c
src/network/bridge_driver_conf.c
src/network/bridge_driver_linux.c
src/network/leaseshelper.c
src/network/network_iptables.c
src/network/network_nftables.c
src/node_device/node_device_driver.c
src/node_device/node_device_udev.c
src/nwfilter/nwfilter_dhcpsnoop.c
src/nwfilter/nwfilter_driver.c
src/nwfilter/nwfilter_ebiptables_driver.c
src/nwfilter/nwfilter_gentech_driver.c
src/nwfilter/nwfilter_learnipaddr.c
src/openvz/openvz_conf.c
src/openvz/openvz_driver.c
src/openvz/openvz_util.c
src/qemu/qemu_agent.c
src/qemu/qemu_alias.c
src/qemu/qemu_backup.c
src/qemu/qemu_block.c
src/qemu/qemu_blockjob.c
src/qemu/qemu_capabilities.c
src/qemu/qemu_cgroup.c
src/qemu/qemu_checkpoint.c
src/qemu/qemu_command.c
src/qemu/qemu_conf.c
src/qemu/qemu_dbus.c
src/qemu/qemu_domain.c
src/qemu/qemu_domain_address.c
src/qemu/qemu_domainjob.c
src/qemu/qemu_driver.c
src/qemu/qemu_extdevice.c
src/qemu/qemu_fd.c
src/qemu/qemu_firmware.c
src/qemu/qemu_hostdev.c
src/qemu/qemu_hotplug.c
src/qemu/qemu_interface.c
src/qemu/qemu_interop_config.c
src/qemu/qemu_logcontext.c
src/qemu/qemu_migration.c
src/qemu/qemu_migration_cookie.c
src/qemu/qemu_migration_params.c
src/qemu/qemu_monitor.c
src/qemu/qemu_monitor_json.c
src/qemu/qemu_monitor_text.c
src/qemu/qemu_namespace.c
src/qemu/qemu_nbdkit.c
src/qemu/qemu_passt.c
src/qemu/qemu_process.c
src/qemu/qemu_qapi.c
src/qemu/qemu_saveimage.c
src/qemu/qemu_slirp.c
src/qemu/qemu_snapshot.c
src/qemu/qemu_tpm.c
src/qemu/qemu_validate.c
src/qemu/qemu_vhost_user.c
src/qemu/qemu_vhost_user_gpu.c
src/qemu/qemu_virtiofs.c
src/remote/remote_daemon.c
src/remote/remote_daemon_config.c
src/remote/remote_daemon_dispatch.c
src/remote/remote_daemon_stream.c
src/remote/remote_driver.c
src/remote/remote_sockets.c
src/remote/remote_ssh_helper.c
src/rpc/virkeepalive.c
src/rpc/virnetclient.c
src/rpc/virnetclientprogram.c
src/rpc/virnetclientstream.c
src/rpc/virnetdaemon.c
src/rpc/virnetlibsshsession.c
src/rpc/virnetmessage.c
src/rpc/virnetsaslcontext.c
src/rpc/virnetserver.c
src/rpc/virnetserverclient.c
src/rpc/virnetserverprogram.c
src/rpc/virnetserverservice.c
src/rpc/virnetsocket.c
src/rpc/virnetsshsession.c
src/rpc/virnettlscontext.c
src/secret/secret_driver.c
src/security/security_apparmor.c
src/security/security_dac.c
src/security/security_driver.c
src/security/security_manager.c
src/security/security_selinux.c
src/security/security_util.c
src/security/virt-aa-helper.c
src/storage/parthelper.c
src/storage/storage_backend.c
src/storage/storage_backend_disk.c
src/storage/storage_backend_fs.c
src/storage/storage_backend_gluster.c
src/storage/storage_backend_iscsi.c
src/storage/storage_backend_iscsi_direct.c
src/storage/storage_backend_logical.c
src/storage/storage_backend_mpath.c
src/storage/storage_backend_rbd.c
src/storage/storage_backend_scsi.c
src/storage/storage_backend_vstorage.c
src/storage/storage_backend_zfs.c
src/storage/storage_driver.c
src/storage/storage_util.c
src/storage_file/storage_file_backend.c
src/storage_file/storage_file_backend_fs.c
src/storage_file/storage_file_backend_gluster.c
src/storage_file/storage_file_probe.c
src/storage_file/storage_source.c
src/storage_file/storage_source_backingstore.c
src/test/test_driver.c
src/util/iohelper.c
src/util/viracpi.c
src/util/viralloc.c
src/util/virarptable.c
src/util/viraudit.c
src/util/virauth.c
src/util/virauthconfig.c
src/util/virbitmap.c
src/util/vircgroup.c
src/util/virccw.c
src/util/vircgroupbackend.c
src/util/vircgroupbackend.h
src/util/vircgroupv1.c
src/util/vircgroupv2.c
src/util/vircgroupv2devices.c
src/util/vircommand.c
src/util/virconf.c
src/util/vircrypto.c
src/util/virdaemon.c
src/util/virdevmapper.c
src/util/virdnsmasq.c
src/util/virerror.c
src/util/virerror.h
src/util/virevent.c
src/util/vireventthread.c
src/util/virfcp.c
src/util/virfdstream.c
src/util/virfile.c
src/util/virfilecache.c
src/util/virfirewall.c
src/util/virfirewalld.c
src/util/virfirmware.c
src/util/virgdbus.c
src/util/virhash.c
src/util/virhook.c
src/util/virhostcpu.c
src/util/virhostmem.c
src/util/virhostuptime.c
src/util/viridentity.c
src/util/virinitctl.c
src/util/viriscsi.c
src/util/virjson.c
src/util/virlease.c
src/util/virlockspace.c
src/util/virlog.c
src/util/virmacmap.c
src/util/virmdev.c
src/util/virmodule.c
src/util/virnetdev.c
src/util/virnetdevbandwidth.c
src/util/virnetdevbridge.c
src/util/virnetdevip.c
src/util/virnetdevmacvlan.c
src/util/virnetdevmidonet.c
src/util/virnetdevopenvswitch.c
src/util/virnetdevtap.c
src/util/virnetdevveth.c
src/util/virnetdevvportprofile.c
src/util/virnetlink.c
src/util/virnodesuspend.c
src/util/virnuma.c
src/util/virnvme.c
src/util/virobject.c
src/util/virpci.c
src/util/virperf.c
src/util/virpidfile.c
src/util/virpolkit.c
src/util/virportallocator.c
src/util/virprocess.c
src/util/virqemu.c
src/util/virrandom.c
src/util/virresctrl.c
src/util/virrotatingfile.c
src/util/virscsi.c
src/util/virscsihost.c
src/util/virscsivhost.c
src/util/virsecret.c
src/util/virsocketaddr.c
src/util/virstoragefile.c
src/util/virstring.c
src/util/virsysinfo.c
src/util/virsystemd.c
src/util/virthreadjob.c
src/util/virthreadpool.c
src/util/virtime.c
src/util/virtpm.c
src/util/virtypedparam-public.c
src/util/virtypedparam.c
src/util/viruri.c
src/util/virusb.c
src/util/virutil.c
src/util/virvhba.c
src/util/virvsock.c
src/util/virxml.c
src/vbox/vbox_XPCOMCGlue.c
src/vbox/vbox_common.c
src/vbox/vbox_driver.c
src/vbox/vbox_network.c
src/vbox/vbox_snapshot_conf.c
src/vbox/vbox_storage.c
src/vbox/vbox_tmpl.c
src/vmware/vmware_conf.c
src/vmware/vmware_driver.c
src/vmx/vmx.c
src/vz/vz_driver.c
src/vz/vz_sdk.c
src/vz/vz_utils.c
src/vz/vz_utils.h
tests/virpolkittest.c
tools/libvirt-guests.sh.in
tools/ssh-proxy/ssh-proxy.c
tools/virsh-backup.c
tools/virsh-checkpoint.c
tools/virsh-completer-host.c
tools/virsh-console.c
tools/virsh-domain-event.c
tools/virsh-domain-monitor.c
tools/virsh-domain.c
tools/virsh-edit.c
tools/virsh-host.c
tools/virsh-interface.c
tools/virsh-network.c
tools/virsh-nodedev.c
tools/virsh-nwfilter.c
tools/virsh-pool.c
tools/virsh-secret.c
tools/virsh-snapshot.c
tools/virsh-util.c
tools/virsh-volume.c
tools/virsh.c
tools/virsh.h
tools/virt-admin.c
tools/virt-host-validate-bhyve.c
tools/virt-host-validate-ch.c
tools/virt-host-validate-common.c
tools/virt-host-validate-lxc.c
tools/virt-host-validate-qemu.c
tools/virt-host-validate.c
tools/virt-login-shell-helper.c
tools/virt-pki-query-dn.c
tools/vsh-table.c
tools/vsh.c
tools/vsh.h
Reference in New Issue View Git Blame Copy Permalink