[libvirt] [PATCH] use -w flag if supported by iptables

[Daniel P. Berrange]

On Thu, Oct 31, 2013 at 04:36:24PM -0500, Serge Hallyn wrote:
> This will properly lock libvirt's usage of iptables with
> others (like ufw).
> 
> (See https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1245322)
> 
> Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
> ---
>  src/util/viriptables.c | 30 ++++++++++++++++++++++++++----
>  1 file changed, 26 insertions(+), 4 deletions(-)
> 
> diff --git a/src/util/viriptables.c b/src/util/viriptables.c
> index 16f571e..30d59b6 100644
> --- a/src/util/viriptables.c
> +++ b/src/util/viriptables.c
> @@ -50,19 +50,25 @@
>  #include "virstring.h"
>  #include "virutil.h"
>  
> +bool iptables_supports_xlock = false;
> +
>  #if HAVE_FIREWALLD
>  static char *firewall_cmd_path = NULL;
> +#endif
>  
>  static int
>  virIpTablesOnceInit(void)
>  {
> +    virCommandPtr cmd;
> +    int status;
> +
> +#if HAVE_FIREWALLD
>      firewall_cmd_path = virFindFileInPath("firewall-cmd");
>      if (!firewall_cmd_path) {
>          VIR_INFO("firewall-cmd not found on system. "
>                   "firewalld support disabled for iptables.");
>      } else {
> -        virCommandPtr cmd = virCommandNew(firewall_cmd_path);
> -        int status;
> +        virCommandNew(firewall_cmd_path);
>  
>          virCommandAddArgList(cmd, "--state", NULL);
>          if (virCommandRun(cmd, &status) < 0 || status != 0) {
> @@ -74,13 +80,26 @@ virIpTablesOnceInit(void)
>          }
>          virCommandFree(cmd);
>      }
> +
> +    if (firewall_cmd_path)
> +        return 0;
> +
> +#endif
> +
> +    cmd = virCommandNew(IPTABLES_PATH);
> +    virCommandAddArgList(cmd, "-w", "-L", "-n", NULL);

What version of iptables actually has this '-w' flag ? The ubuntu bug
points to an upstream patch, which does locking unconditionally, no
mention of any '-w' flag.

Looking on a per-rule basis is pretty lame locking, since changes
to iptables are often comprised of many rule changes :-(

> +    if (virCommandRun(cmd, &status) < 0 || status != 0) {
> +        VIR_INFO("xtables locking not supported by your iptables");
> +    } else {
> +        VIR_INFO("using xtables locking for iptables");
> +        iptables_supports_xlock = true;
> +    }
> +    virCommandFree(cmd);
>      return 0;
>  }
>  
>  VIR_ONCE_GLOBAL_INIT(virIpTables)
>  
> -#endif
> -

The call to virIptablesInitialize is protected by
#if HAVE_FIREWALLD too, so this code will not run
on older distros.

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|