Libvirt provides a portable, long term stable C API for managing the virtualization technologies provided by many operating systems. It includes support for QEMU, KVM, Xen, LXC, bhyve, Virtuozzo, VMware vCenter and ESX, VMware Desktop, Hyper-V, VirtualBox and the POWER Hypervisor.
Go to file
Laine Stump f5418b427e network: force re-creation of iptables private chains on firewalld restart
When firewalld is stopped, it removes *all* iptables rules and chains,
including those added by libvirt. Since restarting firewalld means
stopping and then starting it, any time it is restarted, libvirt needs
to recreate all the private iptables chains it uses, along with all
the rules it adds.

We already have code in place to call networkReloadFirewallRules() any
time we're notified of a firewalld start, and
networkReloadFirewallRules() will call
networkPreReloadFirewallRules(), which calls
networkSetupPrivateChains(); unfortunately that last call is called
using virOnce(), meaning that it will only be called the first time
through networkPreReloadFirewallRules() after libvirtd starts - so of
course when firewalld is later restarted, the call to
networkSetupPrivateChains() is skipped.

The neat and tidy way to fix this would be if there was a standard way
to reset a pthread_once_t object so that the next time virOnce was
called, it would think the function hadn't been called, and call it
again. Unfortunately, there isn't any official way of doing that (we
*could* just fill it with 0 and hope for the best, but that doesn't
seem very safe.

So instead, this patch just adds a static variable called
chainInitDone, which is set to true after networkSetupPrivateChains()
is called for the first time, and then during calls to
networkPreReloadFirewallRules(), if chainInitDone is set, we call
networkSetupPrivateChains() directly instead of via virOnce().

It may seem unsafe to directly call a function that is meant to be
called only once, but I think in this case we're safe - there's
nothing in the function that is inherently "once only" - it doesn't
initialize anything that can't safely be re-initialized (as long as
two threads don't try to do it at the same time), and it only happens
when responding to a dbus message that firewalld has been started (and
I don't think it's possible for us to be processing two of those at
once), and even then only if the initial call to the function has
already been completed (so we're safe if we receive a firewalld
restart call at a time when we haven't yet called it, or even if
another thread is already in the process of executing it. The only
problematic bit I can think of is if another thread is in the process
of adding an iptable rule at the time we're executing this function,
but 1) none of those threads will be trying to add chains, and 2) if
there was a concurrency problem with other threads adding iptables
rules while firewalld was being restarted, it would still be a problem
even without this change.

This is yet another patch that fixes an occurrence of this error:

COMMAND_FAILED: '/usr/sbin/iptables -w10 -w --table filter --insert LIBVIRT_INP --in-interface virbr0 --protocol tcp --destination-port 67 --jump ACCEPT' failed: iptables: No chain/target/match by that name.

In particular, this resolves: https://bugzilla.redhat.com/1813830

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2020-05-11 22:54:52 -04:00
.ctags.d maint: Add support for .ctags.d 2019-05-31 17:54:28 +02:00
.github github: skip lockdown of old issues/prs 2020-04-07 17:50:54 +01:00
build-aux qemumonitortestutils: Make test monitor failures more prominent 2020-04-27 08:13:48 +02:00
ci ci: Drop handling of $PKG_CONFIG_LIBDIR 2020-03-04 11:24:10 +01:00
docs docs: Document list-tables as recommended 2020-05-11 13:55:27 +02:00
examples qemu: support Panic Crashloaded event handling 2020-02-07 14:05:25 +00:00
include/libvirt API: Add VIR_DOMAIN_JOB_ERRMSG domain job statistics field 2020-04-24 08:56:57 +02:00
m4 qemu-conf: add configurable dbus-daemon location 2020-03-24 15:57:33 +01:00
po vbox: remove unused support for Windows MSCOM 2020-04-20 11:34:59 +01:00
scripts gitlab: convert to shared container for DCO check 2020-05-04 15:43:55 +01:00
src network: force re-creation of iptables private chains on firewalld restart 2020-05-11 22:54:52 -04:00
tests tests: Fix the libxl xml2domconfig test 2020-05-07 17:38:41 -06:00
tools virt-host-validate-bhyve.c: Reintroduce @ret to virHostValidateBhyve() 2020-05-05 14:45:58 +02:00
.color_coded.in gnulib: delete all gnulib integration 2020-02-07 15:03:54 +00:00
.ctags ctags: Generate tags for headers, i.e. function prototypes 2018-09-18 14:21:33 +02:00
.dir-locals.el build: avoid tabs that failed syntax-check 2012-09-06 09:43:46 -06:00
.editorconfig Add .editorconfig 2019-09-06 12:47:46 +02:00
.gitignore gnulib: delete all gnulib integration 2020-02-07 15:03:54 +00:00
.gitlab-ci.yml gitlab: move some jobs onto CentOS 8 2020-05-06 13:16:58 +01:00
.gitmodules gnulib: delete all gnulib integration 2020-02-07 15:03:54 +00:00
.gitpublish gitpublish: add a subject prefix 2020-01-16 13:04:11 +00:00
.mailmap mailmap: Remove some duplicates 2019-06-07 13:18:08 +02:00
.travis.yml travis: explicitly include gnutls to ensure it is updated 2020-04-24 15:00:58 +01:00
.ycm_extra_conf.py.in gnulib: delete all gnulib integration 2020-02-07 15:03:54 +00:00
ABOUT-NLS Convert all remaining Markdown files to reStructuredText 2020-04-14 16:29:04 +02:00
AUTHORS.in AUTHORS: Add Fabiano Fidêncio 2019-12-19 16:42:06 +01:00
autogen.sh build: stop running aclocal manually 2020-02-25 09:22:56 +00:00
ChangeLog maint: Stop generating ChangeLog from git 2019-04-03 09:45:25 +02:00
config-post.h gnulib: delete all gnulib integration 2020-02-07 15:03:54 +00:00
configure.ac maint: Post-release version bump to 6.4.0 2020-05-05 10:52:22 +02:00
CONTRIBUTING.rst CONTRIBUTING: Include note about build system tools 2020-05-04 19:03:51 +02:00
COPYING maint: follow recommended practice for using LGPL 2013-05-20 14:15:21 -06:00
COPYING.LESSER maint: Remove control characters from LGPL license file 2015-09-25 09:16:24 +02:00
gitdm.config gitdm: add 'ibm' file 2019-10-18 17:32:52 +02:00
GNUmakefile build: merge all syntax-check logic into one file 2019-10-09 13:36:54 +01:00
libvirt-admin.pc.in Add libvirt-admin library 2015-06-16 13:46:20 +02:00
libvirt-lxc.pc.in Add pkg-config files for libvirt-qemu & libvirt-lxc 2014-06-23 16:17:27 +01:00
libvirt-qemu.pc.in Add pkg-config files for libvirt-qemu & libvirt-lxc 2014-06-23 16:17:27 +01:00
libvirt.pc.in Add pkg-config files for libvirt-qemu & libvirt-lxc 2014-06-23 16:17:27 +01:00
libvirt.spec.in Convert all remaining Markdown files to reStructuredText 2020-04-14 16:29:04 +02:00
Makefile.am CONTRIBUTING: Include in release archives 2020-04-20 18:01:55 +02:00
Makefile.nonreentrant Remove backslash alignment attempts 2017-11-03 13:24:12 +01:00
mingw-libvirt.spec.in Remove phyp driver 2019-12-20 12:25:42 -05:00
README Convert all remaining Markdown files to reStructuredText 2020-04-14 16:29:04 +02:00
README.rst README: Add GitLab CI badge 2020-04-20 18:02:07 +02:00
run.in run.in: Include tools directory on $PATH. 2020-01-21 13:04:57 +01:00

.. image:: https://gitlab.com/libvirt/libvirt/badges/master/pipeline.svg
     :target: https://gitlab.com/libvirt/libvirt/pipelines
     :alt: GitLab CI Build Status
.. image:: https://travis-ci.org/libvirt/libvirt.svg
     :target: https://travis-ci.org/libvirt/libvirt
     :alt: Travis CI Build Status
.. image:: https://bestpractices.coreinfrastructure.org/projects/355/badge
     :target: https://bestpractices.coreinfrastructure.org/projects/355
     :alt: CII Best Practices

==============================
Libvirt API for virtualization
==============================

Libvirt provides a portable, long term stable C API for managing the
virtualization technologies provided by many operating systems. It
includes support for QEMU, KVM, Xen, LXC, bhyve, Virtuozzo, VMware
vCenter and ESX, VMware Desktop, Hyper-V, VirtualBox and the POWER
Hypervisor.

For some of these hypervisors, it provides a stateful management
daemon which runs on the virtualization host allowing access to the
API both by non-privileged local users and remote users.

Layered packages provide bindings of the libvirt C API into other
languages including Python, Perl, PHP, Go, Java, OCaml, as well as
mappings into object systems such as GObject, CIM and SNMP.

Further information about the libvirt project can be found on the
website:

https://libvirt.org


License
=======

The libvirt C API is distributed under the terms of GNU Lesser General
Public License, version 2.1 (or later). Some parts of the code that are
not part of the C library may have the more restrictive GNU General
Public License, version 2.0 (or later). See the files ``COPYING.LESSER``
and ``COPYING`` for full license terms & conditions.


Installation
============

Libvirt uses the GNU Autotools build system, so in general can be built
and installed with the usual commands, however, we mandate to have the
build directory different than the source directory. For example, to build
in a manner that is suitable for installing as root, use:

::

  $ mkdir build && cd build
  $ ../configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
  $ make
  $ sudo make install

While to build & install as an unprivileged user

::

  $ mkdir build && cd build
  $ ../configure --prefix=$HOME/usr
  $ make
  $ make install

The libvirt code relies on a large number of 3rd party libraries. These will
be detected during execution of the ``configure`` script and a summary printed
which lists any missing (optional) dependencies.


Contributing
============

The libvirt project welcomes contributions in many ways. For most components
the best way to contribute is to send patches to the primary development
mailing list. Further guidance on this can be found on the website:

https://libvirt.org/contribute.html


Contact
=======

The libvirt project has two primary mailing lists:

* libvirt-users@redhat.com (**for user discussions**)
* libvir-list@redhat.com (**for development only**)

Further details on contacting the project are available on the website:

https://libvirt.org/contact.html