[libvirt] [PATCH] use -w flag if supported by iptables

[Serge Hallyn]

Quoting Serge Hallyn (serge.hallyn at ubuntu.com):
> Quoting Laine Stump (laine at laine.org):
> > This needs to be "cmd = virCommandNew(.....);"


>From 1a43e48dfdc83fbde17d40351465af9031883595 Mon Sep 17 00:00:00 2001
From: Serge Hallyn <serge.hallyn at ubuntu.com>
Date: Thu, 31 Oct 2013 15:22:16 -0500
Subject: [PATCH 1/1] use -w flag if supported by iptables (v3)

Ask iptables to wait rather than fail if it is in use by another
caller (like ufw).

(See https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1245322)

Changelog:
   v2: take virIpTablesInitialize() out of HAVE_FIREWALLD ifdef.
   v3: make sure to set cmd to the result of virComandNew()

Signed-off-by: Serge Hallyn <serge.hallyn at ubuntu.com>
---
 src/util/viriptables.c | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/src/util/viriptables.c b/src/util/viriptables.c
index 16f571e..a1711bb 100644
--- a/src/util/viriptables.c
+++ b/src/util/viriptables.c
@@ -50,19 +50,25 @@
 #include "virstring.h"
 #include "virutil.h"
 
+bool iptables_supports_xlock = false;
+
 #if HAVE_FIREWALLD
 static char *firewall_cmd_path = NULL;
+#endif
 
 static int
 virIpTablesOnceInit(void)
 {
+    virCommandPtr cmd;
+    int status;
+
+#if HAVE_FIREWALLD
     firewall_cmd_path = virFindFileInPath("firewall-cmd");
     if (!firewall_cmd_path) {
         VIR_INFO("firewall-cmd not found on system. "
                  "firewalld support disabled for iptables.");
     } else {
-        virCommandPtr cmd = virCommandNew(firewall_cmd_path);
-        int status;
+        cmd = virCommandNew(firewall_cmd_path);
 
         virCommandAddArgList(cmd, "--state", NULL);
         if (virCommandRun(cmd, &status) < 0 || status != 0) {
@@ -74,13 +80,26 @@ virIpTablesOnceInit(void)
         }
         virCommandFree(cmd);
     }
+
+    if (firewall_cmd_path)
+        return 0;
+
+#endif
+
+    cmd = virCommandNew(IPTABLES_PATH);
+    virCommandAddArgList(cmd, "-w", "-L", "-n", NULL);
+    if (virCommandRun(cmd, &status) < 0 || status != 0) {
+        VIR_INFO("xtables locking not supported by your iptables");
+    } else {
+        VIR_INFO("using xtables locking for iptables");
+        iptables_supports_xlock = true;
+    }
+    virCommandFree(cmd);
     return 0;
 }
 
 VIR_ONCE_GLOBAL_INIT(virIpTables)
 
-#endif
-
 #define VIR_FROM_THIS VIR_FROM_NONE
 
 enum {
@@ -92,8 +111,8 @@ static virCommandPtr
 iptablesCommandNew(const char *table, const char *chain, int family, int action)
 {
     virCommandPtr cmd = NULL;
-#if HAVE_FIREWALLD
     virIpTablesInitialize();
+#if HAVE_FIREWALLD
     if (firewall_cmd_path) {
         cmd = virCommandNew(firewall_cmd_path);
         virCommandAddArgList(cmd, "--direct", "--passthrough",
@@ -104,6 +123,9 @@ iptablesCommandNew(const char *table, const char *chain, int family, int action)
     if (cmd == NULL) {
         cmd = virCommandNew((family == AF_INET6)
                         ? IP6TABLES_PATH : IPTABLES_PATH);
+
+        if (iptables_supports_xlock)
+            virCommandAddArgList(cmd, "-w", NULL);
     }
 
     virCommandAddArgList(cmd, "--table", table,
-- 
1.8.3.2