- 21 12月, 2012 3 次提交
-
-
由 Daniel P. Berrange 提交于
-
由 Daniel P. Berrange 提交于
-
由 Daniel P. Berrange 提交于
-
- 21 9月, 2012 1 次提交
-
-
由 Eric Blake 提交于
https://www.gnu.org/licenses/gpl-howto.html recommends that the 'If not, see <url>.' phrase be a separate sentence. * tests/securityselinuxhelper.c: Remove doubled line. * tests/securityselinuxtest.c: Likewise. * globally: s/; If/. If/
-
- 23 8月, 2012 1 次提交
-
-
由 Laine Stump 提交于
Several VIR_DEBUG()'s were changed to VIR_WARN() while I was testing the firewalld support patch, and I neglected to change them back before I pushed. In the meantime I've decided that it would be useful to have them be VIR_INFO(), just so there will be logged evidence of which method is being used (firewall-cmd vs. (eb|ip)tables) without needing to crank logging to 11. (at most this adds 2 lines to libvirtd's logs per libvirtd start).
-
- 22 8月, 2012 1 次提交
-
-
由 Thomas Woerner 提交于
* configure.ac, spec file: firewalld defaults to enabled if dbus is available, otherwise is disabled. If --with_firewalld is explicitly requested and dbus is not available, configure will fail. * bridge_driver: add dbus filters to get the FirewallD1.Reloaded signal and DBus.NameOwnerChanged on org.fedoraproject.FirewallD1. When these are encountered, reload all the iptables reuls of all libvirt's virtual networks (similar to what happens when libvirtd is restarted). * iptables, ebtables: use firewall-cmd's direct passthrough interface when available, otherwise use iptables and ebtables commands. This decision is made once the first time libvirt calls iptables/ebtables, and that decision is maintained for the life of libvirtd. * Note that the nwfilter part of this patch was separated out into another patch by Stefan in V2, so that needs to be revised and re-reviewed as well. ================ All the configure.ac and specfile changes are unchanged from Thomas' V3. V3 re-ran "firewall-cmd --state" every time a new rule was added, which was extremely inefficient. V4 uses VIR_ONCE_GLOBAL_INIT to set up a one-time initialization function. The VIR_ONCE_GLOBAL_INIT(x) macro references a static function called vir(Ip|Eb)OnceInit(), which will then be called the first time that the static function vir(Ip|Eb)TablesInitialize() is called (that function is defined for you by the macro). This is thread-safe, so there is no chance of any race. IMPORTANT NOTE: I've left the VIR_DEBUG messages in these two init functions (one for iptables, on for ebtables) as VIR_WARN so that I don't have to turn on all the other debug message just to see these. Even if this patch doesn't need any other modification, those messages need to be changed to VIR_DEBUG before pushing. This one-time initialization works well. However, I've encountered problems with testing: 1) Whenever I have enabled the firewalld service, *all* attempts to call firewall-cmd from within libvirtd end with firewall-cmd hanging internally somewhere. This is *not* the case if firewall-cmd returns non-0 in response to "firewall-cmd --state" (i.e. *that* command runs and returns to libvirt successfully.) 2) If I start libvirtd while firewalld is stopped, then start firewalld later, this triggers libvirtd to reload its iptables rules, however it also spits out a *ton* of complaints about deletion failing (I suppose because firewalld has nuked all of libvirt's rules). I guess we need to suppress those messages (which is a more annoying problem to fix than you might think, but that's another story). 3) I noticed a few times during this long line of errors that firewalld made a complaint about "Resource Temporarily unavailable. Having libvirtd access iptables commands directly at the same time as firewalld is doing so is apparently problematic. 4) In general, I'm concerned about the "set it once and never change it" method - if firewalld is disabled at libvirtd startup, causing libvirtd to always use iptables/ebtables directly, this won't cause *terrible* problems, but if libvirtd decides to use firewall-cmd and firewalld is later disabled, libvirtd will not be able to recover.
-
- 23 7月, 2012 1 次提交
-
-
由 Osier Yang 提交于
Per the FSF address could be changed from time to time, and GNU recommends the following now: (http://www.gnu.org/licenses/gpl-howto.html) You should have received a copy of the GNU General Public License along with Foobar. If not, see <http://www.gnu.org/licenses/>. This patch removes the explicit FSF address, and uses above instead (of course, with inserting 'Lesser' before 'General'). Except a bunch of files for security driver, all others are changed automatically, the copyright for securify files are not complete, that's why to do it manually: src/security/security_selinux.h src/security/security_driver.h src/security/security_selinux.c src/security/security_apparmor.h src/security/security_apparmor.c src/security/security_driver.c
-
- 18 7月, 2012 1 次提交
-
-
由 Daniel P. Berrange 提交于
This removes nearly all the per-file error reporting macros from the code in src/util/. A few custom macros remain for the case, where the file needs to report errors with a variety of different codes or parameters Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
-
- 04 12月, 2011 1 次提交
-
-
由 Eric Blake 提交于
https://bugzilla.redhat.com/show_bug.cgi?id=648855 mentioned a misuse of 'an' where 'a' is proper; that has since been fixed, but a search found other problems (some were a spelling error for 'and', while most were fixed by 'a'). * daemon/stream.c: Fix grammar. * src/conf/domain_conf.c: Likewise. * src/conf/domain_event.c: Likewise. * src/esx/esx_driver.c: Likewise. * src/esx/esx_vi.c: Likewise. * src/rpc/virnetclient.c: Likewise. * src/rpc/virnetserverprogram.c: Likewise. * src/storage/storage_backend_fs.c: Likewise. * src/util/conf.c: Likewise. * src/util/dnsmasq.c: Likewise. * src/util/iptables.c: Likewise. * src/xen/xen_hypervisor.c: Likewise. * src/xen/xend_internal.c: Likewise. * src/xen/xs_internal.c: Likewise. * tools/virsh.c: Likewise.
-
- 10 11月, 2011 1 次提交
-
-
由 Daniel P. Berrange 提交于
The socket address APIs in src/util/network.h either take the form virSocketAddrXXX, virSocketXXX or virSocketXXXAddr. Sanitize this so everything is virSocketAddrXXXX, and ensure that the virSocketAddr parameter is always the first one. * src/util/network.c, src/util/network.h: Santize socket address API naming * src/conf/domain_conf.c, src/conf/network_conf.c, src/conf/nwfilter_conf.c, src/network/bridge_driver.c, src/nwfilter/nwfilter_ebiptables_driver.c, src/nwfilter/nwfilter_learnipaddr.c, src/qemu/qemu_command.c, src/rpc/virnetsocket.c, src/util/dnsmasq.c, src/util/iptables.c, src/util/virnetdev.c, src/vbox/vbox_tmpl.c: Update for API renaming
-
- 17 4月, 2011 1 次提交
-
-
由 Matthias Bolte 提交于
And from all related macros and functions.
-
- 06 1月, 2011 1 次提交
-
-
由 Laine Stump 提交于
Although the upper-layer code protected against it, it was possible to call iptablesForwardMasquerade() with an IPv6 address and have it attempt to add a rule to the MASQUERADE chain of ip6tables (which doesn't exist). This patch changes that function to check the protocol of the given address, generate an error log if it's not IPv4 (AF_INET), and finally hardcodes all the family parameters sent down to lower-level functions.
-
- 01 1月, 2011 1 次提交
-
-
由 Laine Stump 提交于
The original version of these functions would modify the address sent in, meaning that the caller would usually need to copy the address first. This change makes the original a const, and puts the resulting masked address into a new arg (which could point to the same virSocketAddr as the original, if the caller really wants to modify it). This also makes the API consistent with virSocketAddrBroadcast[ByPrefix].
-
- 24 12月, 2010 2 次提交
-
-
由 Laine Stump 提交于
All of the iptables functions eventually call down to a single bottom-level function, and fortunately, ip6tables syntax (for all the args that we use) is identical to iptables format (except the addresses), so all we need to do is: 1) Get an address family down to the lowest level function in each case, either implied through an address, or explicitly when no address is in the parameter list, and 2) At the lowest level, just decide whether to call "iptables" or "ip6tables" based on the family. The location of the ip6tables binary is determined at build time by autoconf. If a particular target system happens to not have ip6tables installed, any attempts to run it will generate an error, but that won't happen unless someone tries to define an IPv6 address for a network. This is identical behavior to IPv4 addresses and iptables.
-
由 Laine Stump 提交于
IPv6 will use prefix exclusively, and IPv4 will also optionally be able to use it, and the iptables functions really need a prefix anyway, so use the new virNetworkDefPrefix() function to send prefixes into iptables functions instead of netmasks. Also, in a couple places where a netmask is actually needed, use the new private API function for it rather than getting it directly. This will allow for cases where no netmask or prefix is specified (it returns the default for the current class of network.)
-
- 03 12月, 2010 1 次提交
-
-
由 Daniel P. Berrange 提交于
This proof of concept shows how two existing uses of virExec and virRun can be ported to the new virCommand APIs, and how much simpler the code becomes
-
- 02 11月, 2010 1 次提交
-
-
由 Jiri Denemark 提交于
They only popped up during --disable-nls build. Without this configure option, gcc wasn't able to detect them.
-
- 26 10月, 2010 1 次提交
-
-
由 Daniel P. Berrange 提交于
The network address was being set to 192.168.122.0 instead of 192.168.122.0/24. Fix this by removing the unneccessary 'network' field from virNetworkDef and just pass the network address and netmask into the iptables APIs directly. * src/conf/network_conf.h, src/conf/network_conf.c: Remove the 'network' field from virNEtworkDef. * src/network/bridge_driver.c: Update for iptables API changes * src/util/iptables.c, src/util/iptables.h: Require the network address + netmask pair to be passed in
-
- 22 10月, 2010 1 次提交
-
-
由 Daniel P. Berrange 提交于
Instead of storing the IP address string in virNetwork related structs, store the parsed virSocketAddr. This will make it easier to add IPv6 support in the future, by letting driver code directly check what address family is present * src/conf/network_conf.c, src/conf/network_conf.h, src/network/bridge_driver.c: Convert to use virSocketAddr in virNetwork, instead of char *. * src/util/bridge.c, src/util/bridge.h, src/util/dnsmasq.c, src/util/dnsmasq.h, src/util/iptables.c, src/util/iptables.h: Convert to take a virSocketAddr instead of char * for any IP address parameters * src/util/network.h: Add macros to determine if an address is set, and what address family is set.
-
- 02 8月, 2010 1 次提交
-
-
由 Laine Stump 提交于
This patch attempts to take advantage of a newly added netfilter module to correct for a problem with some guest DHCP client implementations when used in conjunction with a DHCP server run on the host systems with packet checksum offloading enabled. The problem is that, when the guest uses a RAW socket to read the DHCP response packets, the checksum hasn't yet been fixed by the IP stack, so it is incorrect. The fix implemented here is to add a rule to the POSTROUTING chain of the mangle table in iptables that fixes up the checksum for packets on the virtual network's bridge that are destined for the bootpc port (ie "dhcpc", ie port 68) port on the guest. Only very new versions of iptables will have this support (it will be in the next upstream release), so a failure to add this rule only results in a warning message. The iptables patch is here: http://patchwork.ozlabs.org/patch/58525/ A corresponding kernel module patch is also required (the backend of the iptables patch) and that will be in the next release of the kernel.
-
- 19 7月, 2010 1 次提交
-
-
由 Daniel P. Berrange 提交于
IPtables will seek to preserve the source port unchanged when doing masquerading, if possible. NFS has a pseudo-security option where it checks for the source port <= 1023 before allowing a mount request. If an admin has used this to make the host OS trusted for mounts, the default iptables behaviour will potentially allow NAT'd guests access too. This needs to be stopped. With this change, the iptables -t nat -L -n -v rules for the default network will be Chain POSTROUTING (policy ACCEPT 95 packets, 9163 bytes) pkts bytes target prot opt in out source destination 14 840 MASQUERADE tcp -- * * 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 75 5752 MASQUERADE udp -- * * 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 0 0 MASQUERADE all -- * * 192.168.122.0/24 !192.168.122.0/24 * src/network/bridge_driver.c: Add masquerade rules for TCP and UDP protocols * src/util/iptables.c, src/util/iptables.c: Add source port mappings for TCP & UDP protocols when masquerading.
-
- 19 5月, 2010 1 次提交
-
-
由 Jim Meyering 提交于
* src/util/ebtables.c (ebtablesAddRemoveRule): Don't skip va_end(args) on an error path. * src/util/iptables.c (iptablesAddRemoveRule): Identical change.
-
- 07 5月, 2010 1 次提交
-
-
由 Eric Blake 提交于
* configure.ac: Drop sys/wait.h check. * src/libvirt.c (includes): Use header unconditionally. * src/remote/remote_driver.c (includes): Likewise. * src/storage/storage_backend.c (includes): Likewise. * src/util/ebtables.c (includes): Likewise. * src/util/hooks.c (includes): Likewise. * src/util/iptables.c (includes): Likewise. * src/util/util.c (includes): Likewise.
-
- 10 3月, 2010 1 次提交
-
-
由 Eric Blake 提交于
* global: patch created by running: for f in $(git ls-files '*.[ch]') ; do cppi $f > $f.t && mv $f.t $f done
-
- 09 2月, 2010 1 次提交
-
-
由 Matthias Bolte 提交于
It was used for error reporting only.
-
- 10 12月, 2009 2 次提交
-
-
由 Mark McLoughlin 提交于
We don't use this method of reloading rules anymore, so we can just kill the code. This simplifies things a lot because we no longer need to keep a table of the rules we've added. * src/util/iptables.c: kill iptablesReloadRules()
-
由 Mark McLoughlin 提交于
Long ago we tried to use Fedora's lokkit utility in order to register our iptables rules so that 'service iptables restart' would automatically load our rules. There was one fatal flaw - if the user had configured iptables without lokkit, then we would clobber that configuration by running lokkit. We quickly disabled lokkit support, but never removed it. Let's do that now. The 'my virtual network stops working when I restart iptables' still remains. For all the background on this saga, see: https://bugzilla.redhat.com/227011 * src/util/iptables.c: remove lokkit support * configure.in: remove --enable-lokkit * libvirt.spec.in: remove the dirs used only for saving rules for lokkit * src/Makefile.am: ditto * src/libvirt_private.syms, src/network/bridge_driver.c, src/util/iptables.h: remove references to iptablesSaveRules
-
- 20 11月, 2009 1 次提交
-
-
由 Steve Yarmie 提交于
* src/util/iptables.c: `--option ! this` is deprecated in favor of `! --option this` syntax, change the output command accordingly
-
- 06 11月, 2009 1 次提交
-
-
由 Paolo Bonzini 提交于
* src/internal.h (ATTRIBUTE_SENTINEL): New, it's a ggc feature and protected as such * src/util/buf.c (virBufferStrcat): Use it. * src/util/ebtables.c (ebtablesAddRemoveRule): Use it. * src/util/iptables.c (iptableAddRemoveRule: Use it. * src/util/qparams.h (new_qparam_set, append_qparams): Use it. * docs/apibuild.py: avoid breaking the API generator with that new internal keyword macro
-
- 21 9月, 2009 1 次提交
-
-
由 Daniel P. Berrange 提交于
* src/bridge.c, src/bridge.h, src/buf.c, src/buf.h, src/cgroup.c, src/cgroup.h, src/conf.c, src/conf.h, src/event.c, src/event.h, src/hash.c, src/hash.h, src/hostusb.c, src/hostusb.h, src/iptables.c, src/iptables.h, src/logging.c, src/logging.h, src/memory.c, src/memory.h, src/pci.c, src/pci.h, src/qparams.c, src/qparams.h, src/stats_linux.c, src/stats_linux.h, src/threads-pthread.c, src/threads-pthread.h, src/threads-win32.c, src/threads-win32.h, src/threads.c, src/threads.h, src/util.c, src/util.h, src/uuid.c, src/uuid.h, src/virterror.c, src/virterror_internal.h, src/xml.c, src/xml.h: Move all files into src/util/ * daemon/Makefile.am: Add -Isrc/util/ to build flags * src/Makefile.am: Add -Isrc/util/ to build flags and update for moved files * src/libvirt_private.syms: Export cgroup APIs since they're now in util rather than linking directly to drivers * src/xen/xs_internal.c: Disable bogus virEventRemoveHandle call when built under PROXY * proxy/Makefile.am: Update for changed file locations. Remove bogus build of event.c * tools/Makefile.am, tests/Makefile.am: Add -Isrc/util/ to build flags
-
- 08 9月, 2009 1 次提交
-
-
由 Jim Meyering 提交于
* src/iptables.c (iptablesAddRemoveRule): Remove dead store.
-
- 03 3月, 2009 1 次提交
-
-
由 Daniel P. Berrange 提交于
-
- 06 2月, 2009 1 次提交
-
-
由 Jim Meyering 提交于
* src/iptables.c: Include "virterror_internal.h". Use virStrerror, not strerror. * src/iptables.c (notifyRulesUpdated): Use %s rather than string-concatenation that made sc_unmarked_diagnostics report a false-positive.
-
- 03 2月, 2009 1 次提交
-
-
由 Jim Meyering 提交于
* Makefile.cfg (useless_free_options): Also check for VIR_FREE. * src/iptables.c (iptRulesFree): Remove useless if-before-VIR_FREE. * src/remote_internal.c (remoteAuthSASL): Likewise. * src/test.c (testOpenFromFile): Likewise.
-
- 08 11月, 2008 1 次提交
-
-
由 Jim Meyering 提交于
Avoid a build error when configuring --without-xen --without-qemu. * src/iptables.c [WITH_QEMU]: Don't #ifdef-out. * src/iptables.h [WITH_QEMU]: Don't #ifdef-out. * src/util.c (virRun) [__MINGW32__]: Define a stub that always fails.
-
- 06 11月, 2008 1 次提交
-
-
由 Cole Robinson 提交于
-
- 08 8月, 2008 1 次提交
-
-
由 Daniel P. Berrange 提交于
-
- 19 7月, 2008 1 次提交
-
-
由 Jim Meyering 提交于
* src/domain_conf.c (virDomainChrDefParseXML) (virDomainNetDefParseXML): Likewise. * src/iptables.c (iptRuleFree): Likewise. * src/storage_backend.c (virStorageBackendRunProgRegex): Likewise. * src/test.c (testOpenFromFile): Likewise. * src/xmlrpc.c (xmlRpcCallRaw): Likewise.
-
- 06 6月, 2008 1 次提交
-
-
由 Daniel P. Berrange 提交于
-
- 15 5月, 2008 1 次提交
-
-
由 Daniel P. Berrange 提交于
-