1. 12 2月, 2019 3 次提交
  2. 08 2月, 2019 1 次提交
  3. 07 2月, 2019 3 次提交
  4. 04 2月, 2019 4 次提交
  5. 03 2月, 2019 1 次提交
    • L
      util: remove test code accidentally committed to virFirewallDZoneExists · 7c9dcfed
      Laine Stump 提交于
      Just before pushing the series containing commit 3bba4825 I had added
      a "return true" to the top of virFirewallDZoneExists() to measure the
      impact of calling that function once per network during startup. I
      found that the effect was minimal, but forgot to remove the "return
      true" before pushing. This unfortunately causes a failure to start
      networks on systems that have a firewalld version that doesn't support
      our libvirt zone file (i.e. pretty much everyone).
      
      This patch removes the unintended line.
      Signed-off-by: NLaine Stump <laine@laine.org>
      7c9dcfed
  6. 02 2月, 2019 3 次提交
  7. 01 2月, 2019 4 次提交
    • J
      util: Introduce virStorageFileGetNPIVKey · 5f9e211c
      John Ferlan 提交于
      The vHBA/NPIV LUNs created via the udev processing of the
      VPORT_CREATE command end up using the same serial value
      as seen/generated by the /lib/udev/scsi_id as returned
      during virStorageFileGetSCSIKey. Therefore, in order to
      generate a unique enough key to be used when adding the
      LUN as a volume during virStoragePoolObjAddVol a more
      unique key needs to be generated for an NPIV volume.
      
      The problem is illustrated by the following example, where
      scsi_host5 is a vHBA used with the following LUNs:
      
      $ lsscsi -tg
      ...
      [5:0:4:0]    disk    fc:0x5006016844602198,0x101f00  /dev/sdh   /dev/sg23
      [5:0:5:0]    disk    fc:0x5006016044602198,0x102000  /dev/sdi   /dev/sg24
      ...
      
      Calling virStorageFileGetSCSIKey would return:
      
      /lib/udev/scsi_id --device /dev/sdh --whitelisted --replace-whitespace /dev/sdh
      350060160c460219850060160c4602198
      /lib/udev/scsi_id --device /dev/sdh --whitelisted --replace-whitespace /dev/sdi
      350060160c460219850060160c4602198
      
      Note that althrough /dev/sdh and /dev/sdi are separate LUNs, they
      end up with the same serial number used for the vol->key value.
      When virStoragePoolFCRefreshThread calls virStoragePoolObjAddVol
      the second LUN fails to be added with the following message
      getting logged:
      
          virHashAddOrUpdateEntry:341 : internal error: Duplicate key
      
      To resolve this, virStorageFileGetNPIVKey will use a similar call
      sequence as virStorageFileGetSCSIKey, except that it will add the
      "--export" option to the call. This results in more detailed output
      which needs to be parsed in order to formulate a unique enough key
      to be used. In order to be unique enough, the returned value will
      concatenate the target port as returned in the "ID_TARGET_PORT"
      field from the command to the "ID_SERIAL" value.
      Signed-off-by: NJohn Ferlan <jferlan@redhat.com>
      ACKed-by: NMichal Privoznik <mprivozn@redhat.com>
      Reviewed-by: NJán Tomko <jtomko@redhat.com>
      5f9e211c
    • J
      storage: Rework virStorageBackendSCSISerial · 8bf89dc8
      John Ferlan 提交于
      Alter the code to use the virStorageFileGetSCSIKey helper
      to fetch the unique key for the SCSI disk. Alter the logic
      to follow the former code which would return a duplicate
      of @dev when either the virCommandRun succeeded, but returned
      an empty string or when WITH_UDEV was not true.
      Signed-off-by: NJohn Ferlan <jferlan@redhat.com>
      ACKed-by: NMichal Privoznik <mprivozn@redhat.com>
      Reviewed-by: NJán Tomko <jtomko@redhat.com>
      8bf89dc8
    • J
      util: Modify virStorageFileGetSCSIKey return · 9b86bbcc
      John Ferlan 提交于
      Alter the "real" code to return -2 on virCommandRun failure.
      Alter the comments and function header to describe the function
      and its returns.
      Signed-off-by: NJohn Ferlan <jferlan@redhat.com>
      ACKed-by: NMichal Privoznik <mprivozn@redhat.com>
      Reviewed-by: NJán Tomko <jtomko@redhat.com>
      9b86bbcc
    • E
      qemu: caps: Use CAP_DAC_OVERRIDE for probing to avoid permission issues · a2d3dea9
      Erik Skultety 提交于
      This is mainly about /dev/sev and its default permissions 0600. Of
      course, rule of 'tinfoil' would be that we can't trust anything, but the
      probing code in QEMU is considered safe from security's perspective + we
      can't create an udev rule for this at the moment, because ioctls and
      file system permissions aren't cross-checked in kernel and therefore a
      user with read permissions could issue a 'privileged' operation on SEV
      which is currently only limited to root.
      
      https://bugzilla.redhat.com/show_bug.cgi?id=1665400Signed-off-by: NErik Skultety <eskultet@redhat.com>
      Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com>
      a2d3dea9
  8. 29 1月, 2019 3 次提交
    • D
      util: move virtual network firwall rules into private chains · 7431b3eb
      Daniel P. Berrangé 提交于
      The previous commit created new chains to hold the firewall rules. This
      commit changes the code that creates rules to place them in the new
      private chains instead of the builtin top level chains.
      
      With two networks running, the rules in the filter table now look like
      
        -N LIBVIRT_FWI
        -N LIBVIRT_FWO
        -N LIBVIRT_FWX
        -N LIBVIRT_INP
        -N LIBVIRT_OUT
        -A INPUT -j LIBVIRT_INP
        -A FORWARD -j LIBVIRT_FWX
        -A FORWARD -j LIBVIRT_FWI
        -A FORWARD -j LIBVIRT_FWO
        -A OUTPUT -j LIBVIRT_OUT
        -A LIBVIRT_FWI -d 192.168.0.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        -A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with icmp-port-unreachable
        -A LIBVIRT_FWI -d 192.168.1.0/24 -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        -A LIBVIRT_FWI -o virbr1 -j REJECT --reject-with icmp-port-unreachable
        -A LIBVIRT_FWO -s 192.168.0.0/24 -i virbr0 -j ACCEPT
        -A LIBVIRT_FWO -i virbr0 -j REJECT --reject-with icmp-port-unreachable
        -A LIBVIRT_FWO -s 192.168.1.0/24 -i virbr1 -j ACCEPT
        -A LIBVIRT_FWO -i virbr1 -j REJECT --reject-with icmp-port-unreachable
        -A LIBVIRT_FWX -i virbr0 -o virbr0 -j ACCEPT
        -A LIBVIRT_FWX -i virbr1 -o virbr1 -j ACCEPT
        -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
        -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
        -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
        -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
        -A LIBVIRT_INP -i virbr1 -p udp -m udp --dport 53 -j ACCEPT
        -A LIBVIRT_INP -i virbr1 -p tcp -m tcp --dport 53 -j ACCEPT
        -A LIBVIRT_INP -i virbr1 -p udp -m udp --dport 67 -j ACCEPT
        -A LIBVIRT_INP -i virbr1 -p tcp -m tcp --dport 67 -j ACCEPT
        -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
        -A LIBVIRT_OUT -o virbr1 -p udp -m udp --dport 68 -j ACCEPT
      
      While in the nat table:
      
        -N LIBVIRT_PRT
        -A POSTROUTING -j LIBVIRT_PRT
        -A LIBVIRT_PRT -s 192.168.0.0/24 -d 224.0.0.0/24 -j RETURN
        -A LIBVIRT_PRT -s 192.168.0.0/24 -d 255.255.255.255/32 -j RETURN
        -A LIBVIRT_PRT -s 192.168.0.0/24 ! -d 192.168.0.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
        -A LIBVIRT_PRT -s 192.168.0.0/24 ! -d 192.168.0.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
        -A LIBVIRT_PRT -s 192.168.0.0/24 ! -d 192.168.0.0/24 -j MASQUERADE
        -A LIBVIRT_PRT -s 192.168.1.0/24 -d 224.0.0.0/24 -j RETURN
        -A LIBVIRT_PRT -s 192.168.1.0/24 -d 255.255.255.255/32 -j RETURN
        -A LIBVIRT_PRT -s 192.168.1.0/24 ! -d 192.168.1.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
        -A LIBVIRT_PRT -s 192.168.1.0/24 ! -d 192.168.1.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
        -A LIBVIRT_PRT -s 192.168.1.0/24 ! -d 192.168.1.0/24 -j MASQUERADE
      
      And finally the mangle table:
      
        -N LIBVIRT_PRT
        -A POSTROUTING -j LIBVIRT_PRT
        -A LIBVIRT_PRT -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
        -A LIBVIRT_PRT -o virbr1 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
      Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>
      7431b3eb
    • D
      util: create private chains for virtual network firewall rules · 5f1e6a7d
      Daniel P. Berrangé 提交于
      Historically firewall rules for virtual networks were added straight
      into the base chains. This works but has a number of bugs and design
      limitations:
      
        - It is inflexible for admins wanting to add extra rules ahead
          of libvirt's rules, via hook scripts.
      
        - It is not clear to the admin that the rules were created by
          libvirt
      
        - Each rule must be deleted by libvirt individually since they
          are all directly in the builtin chains
      
        - The ordering of rules in the forward chain is incorrect
          when multiple networks are created, allowing traffic to
          mistakenly flow between networks in one direction.
      
      To address all of these problems, libvirt needs to move to creating
      rules in its own private chains. In the top level builtin chains,
      libvirt will add links to its own private top level chains.
      
      Addressing the traffic ordering bug requires some extra steps. With
      everything going into the FORWARD chain there was interleaving of rules
      for outbound traffic and inbound traffic for each network:
      
        -A FORWARD -d 192.168.3.0/24 -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        -A FORWARD -s 192.168.3.0/24 -i virbr1 -j ACCEPT
        -A FORWARD -i virbr1 -o virbr1 -j ACCEPT
        -A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable
        -A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable
        -A FORWARD -d 192.168.2.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        -A FORWARD -s 192.168.2.0/24 -i virbr0 -j ACCEPT
        -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
        -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
        -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
      
      The rule allowing outbound traffic from virbr1 would mistakenly
      allow packets from virbr1 to virbr0, before the rule denying input
      to virbr0 gets a chance to run.
      
      What we really need todo is group the forwarding rules into three
      distinct sets:
      
       * Cross rules - LIBVIRT_FWX
      
        -A FORWARD -i virbr1 -o virbr1 -j ACCEPT
        -A FORWARD -i virbr0 -o virbr0 -j ACCEPT
      
       * Incoming rules - LIBVIRT_FWI
      
        -A FORWARD -d 192.168.3.0/24 -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        -A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable
        -A FORWARD -d 192.168.2.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
      
       * Outgoing rules - LIBVIRT_FWO
      
        -A FORWARD -s 192.168.3.0/24 -i virbr1 -j ACCEPT
        -A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable
        -A FORWARD -s 192.168.2.0/24 -i virbr0 -j ACCEPT
        -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
      
      There is thus no risk of outgoing rules for one network mistakenly
      allowing incoming traffic for another network, as all incoming rules
      are evalated first.
      
      With this in mind, we'll thus need three distinct chains linked from
      the FORWARD chain, so we end up with:
      
              INPUT --> LIBVIRT_INP   (filter)
      
             OUTPUT --> LIBVIRT_OUT   (filter)
      
            FORWARD +-> LIBVIRT_FWX   (filter)
                    +-> LIBVIRT_FWO
                    \-> LIBVIRT_FWI
      
        POSTROUTING --> LIBVIRT_PRT   (nat & mangle)
      Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>
      5f1e6a7d
    • D
      util: pass layer into firewall query callback · b092a435
      Daniel P. Berrangé 提交于
      Some of the query callbacks want to know the firewall layer that was
      being used for triggering the query to avoid duplicating that data.
      Reviewed-by: NLaine Stump <laine@laine.org>
      Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>
      b092a435
  9. 28 1月, 2019 2 次提交
  10. 25 1月, 2019 3 次提交
  11. 24 1月, 2019 2 次提交
  12. 23 1月, 2019 3 次提交
  13. 15 1月, 2019 1 次提交
  14. 14 1月, 2019 1 次提交
  15. 12 1月, 2019 1 次提交
  16. 11 1月, 2019 3 次提交
  17. 08 1月, 2019 1 次提交
  18. 03 1月, 2019 1 次提交