[libvirt] [PATCH] use -w flag if supported by iptables
Serge Hallyn
serge.hallyn at ubuntu.com
Thu Nov 7 16:44:10 UTC 2013
Quoting Serge Hallyn (serge.hallyn at ubuntu.com):
> Quoting Serge Hallyn (serge.hallyn at ubuntu.com):
> > Quoting Laine Stump (laine at laine.org):
> > > This needs to be "cmd = virCommandNew(.....);"
>
>
> >From 1a43e48dfdc83fbde17d40351465af9031883595 Mon Sep 17 00:00:00 2001
> From: Serge Hallyn <serge.hallyn at ubuntu.com>
> Date: Thu, 31 Oct 2013 15:22:16 -0500
> Subject: [PATCH 1/1] use -w flag if supported by iptables (v3)
>
> Ask iptables to wait rather than fail if it is in use by another
> caller (like ufw).
>
> (See https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1245322)
>
> Changelog:
> v2: take virIpTablesInitialize() out of HAVE_FIREWALLD ifdef.
> v3: make sure to set cmd to the result of virComandNew()
Hi - are there any other objections to this patch?
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> ---
> src/util/viriptables.c | 32 +++++++++++++++++++++++++++-----
> 1 file changed, 27 insertions(+), 5 deletions(-)
>
> diff --git a/src/util/viriptables.c b/src/util/viriptables.c
> index 16f571e..a1711bb 100644
> --- a/src/util/viriptables.c
> +++ b/src/util/viriptables.c
> @@ -50,19 +50,25 @@
> #include "virstring.h"
> #include "virutil.h"
>
> +bool iptables_supports_xlock = false;
> +
> #if HAVE_FIREWALLD
> static char *firewall_cmd_path = NULL;
> +#endif
>
> static int
> virIpTablesOnceInit(void)
> {
> + virCommandPtr cmd;
> + int status;
> +
> +#if HAVE_FIREWALLD
> firewall_cmd_path = virFindFileInPath("firewall-cmd");
> if (!firewall_cmd_path) {
> VIR_INFO("firewall-cmd not found on system. "
> "firewalld support disabled for iptables.");
> } else {
> - virCommandPtr cmd = virCommandNew(firewall_cmd_path);
> - int status;
> + cmd = virCommandNew(firewall_cmd_path);
>
> virCommandAddArgList(cmd, "--state", NULL);
> if (virCommandRun(cmd, &status) < 0 || status != 0) {
> @@ -74,13 +80,26 @@ virIpTablesOnceInit(void)
> }
> virCommandFree(cmd);
> }
> +
> + if (firewall_cmd_path)
> + return 0;
> +
> +#endif
> +
> + cmd = virCommandNew(IPTABLES_PATH);
> + virCommandAddArgList(cmd, "-w", "-L", "-n", NULL);
> + if (virCommandRun(cmd, &status) < 0 || status != 0) {
> + VIR_INFO("xtables locking not supported by your iptables");
> + } else {
> + VIR_INFO("using xtables locking for iptables");
> + iptables_supports_xlock = true;
> + }
> + virCommandFree(cmd);
> return 0;
> }
>
> VIR_ONCE_GLOBAL_INIT(virIpTables)
>
> -#endif
> -
> #define VIR_FROM_THIS VIR_FROM_NONE
>
> enum {
> @@ -92,8 +111,8 @@ static virCommandPtr
> iptablesCommandNew(const char *table, const char *chain, int family, int action)
> {
> virCommandPtr cmd = NULL;
> -#if HAVE_FIREWALLD
> virIpTablesInitialize();
> +#if HAVE_FIREWALLD
> if (firewall_cmd_path) {
> cmd = virCommandNew(firewall_cmd_path);
> virCommandAddArgList(cmd, "--direct", "--passthrough",
> @@ -104,6 +123,9 @@ iptablesCommandNew(const char *table, const char *chain, int family, int action)
> if (cmd == NULL) {
> cmd = virCommandNew((family == AF_INET6)
> ? IP6TABLES_PATH : IPTABLES_PATH);
> +
> + if (iptables_supports_xlock)
> + virCommandAddArgList(cmd, "-w", NULL);
> }
>
> virCommandAddArgList(cmd, "--table", table,
> --
> 1.8.3.2
>
> --
> libvir-list mailing list
> libvir-list at redhat.com
> https://www.redhat.com/mailman/listinfo/libvir-list
More information about the libvir-list
mailing list