[PATCH] nwfilter: extend nmwfilter reload support

[Stefan Berger <stefanb@xxxxxxxxxxxxxxxxxx>]

In this patch I am extending the nwfilter module's reload support to 
stop all ongoing threads (for learning IP addresses of interfaces) and 
rebuild the filtering rules of all interfaces of all VMs when libvirt is 
started. I could not test SIGHUP on my system since I currently get a 
fault there in the daemon's call to pthread_join().

About the patch: The nwfilter functions require a virConnectPtr. 
Therefore I am opening a connection in qemudStartup, which later on 
needs to be closed outside where the driver lock is held since otherwise 
it ends up in a deadlock due to virConnectClose() trying to lock the 
driver as well.

Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxx>

---
 src/nwfilter/nwfilter_driver.c |    3 +++
 src/qemu/qemu_driver.c         |   32 ++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

Index: libvirt-acl/src/nwfilter/nwfilter_driver.c
===================================================================
--- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c
+++ libvirt-acl/src/nwfilter/nwfilter_driver.c
@@ -147,6 +147,9 @@ nwfilterDriverReload(void) {
         return -1;
     }

+    /* shut down all threads -- qemud for example will restart them */
+    virNWFilterLearnShutdown();
+
     nwfilterDriverLock(driverState);
     virNWFilterPoolLoadAllConfigs(NULL,
&driverState->pools,
Index: libvirt-acl/src/qemu/qemu_driver.c
===================================================================
--- libvirt-acl.orig/src/qemu/qemu_driver.c
+++ libvirt-acl/src/qemu/qemu_driver.c
@@ -170,6 +170,9 @@ static int qemuDetectVcpuPIDs(struct qem
 static int qemuUpdateActivePciHostdevs(struct qemud_driver *driver,
                                        virDomainDefPtr def);

+static int qemudVMFiltersInstantiate(virConnectPtr conn,
+                                     virDomainDefPtr def);
+
 static struct qemud_driver *qemu_driver = NULL;


@@ -1423,6 +1426,10 @@ error:
     return ret;
 }

+struct virReconnectDomainData {
+    virConnectPtr conn;
+    struct qemud_driver *driver;
+};
 /*
  * Open an existing VM's monitor, re-detect VCPU threads
  * and re-reserve the security labels in use
@@ -1431,9 +1438,11 @@ static void
 qemuReconnectDomain(void *payload, const char *name ATTRIBUTE_UNUSED, 
void *opaque)
 {
     virDomainObjPtr obj = payload;
-    struct qemud_driver *driver = opaque;
+    struct virReconnectDomainData *data = opaque;
+    struct qemud_driver *driver = data->driver;
     qemuDomainObjPrivatePtr priv;
     unsigned long long qemuCmdFlags;
+    virConnectPtr conn = data->conn;

     virDomainObjLock(obj);

@@ -1467,6 +1476,9 @@ qemuReconnectDomain(void *payload, const
                                                            obj) < 0)
         goto error;

+    if (qemudVMFiltersInstantiate(conn, obj->def))
+        goto error;
+
     if (obj->def->id >= driver->nextvmid)
         driver->nextvmid = obj->def->id + 1;

@@ -1491,9 +1503,10 @@ error:
  * about.
  */
 static void
-qemuReconnectDomains(struct qemud_driver *driver)
+qemuReconnectDomains(virConnectPtr conn, struct qemud_driver *driver)
 {
-    virHashForEach(driver->domains.objs, qemuReconnectDomain, driver);
+    struct virReconnectDomainData data = {conn, driver};
+    virHashForEach(driver->domains.objs, qemuReconnectDomain, &data);
 }


@@ -1691,6 +1704,7 @@ qemudStartup(int privileged) {
     char *base = NULL;
     char driverConf[PATH_MAX];
     int rc;
+    virConnectPtr conn = NULL;

     if (VIR_ALLOC(qemu_driver) < 0)
         return -1;
@@ -1912,7 +1926,11 @@ qemudStartup(int privileged) {
                                 1, NULL, NULL) < 0)
         goto error;

-    qemuReconnectDomains(qemu_driver);
+    conn = virConnectOpen(qemu_driver->privileged ?
+                          "qemu:///system" :
+                          "qemu:///session");
+
+    qemuReconnectDomains(conn, qemu_driver);

     /* Then inactive persistent configs */
     if (virDomainLoadAllConfigs(qemu_driver->caps,
@@ -1930,6 +1948,8 @@ qemudStartup(int privileged) {

     qemudAutostartConfigs(qemu_driver);

+    if (conn)
+        virConnectClose(conn);

     return 0;

@@ -1938,6 +1958,8 @@ out_of_memory:
 error:
     if (qemu_driver)
         qemuDriverUnlock(qemu_driver);
+    if (conn)
+        virConnectClose(conn);
     VIR_FREE(base);
     qemudShutdown();
     return -1;
@@ -12724,6 +12746,28 @@ qemudVMFilterRebuild(virConnectPtr conn
     return 0;
 }

+static int
+qemudVMFiltersInstantiate(virConnectPtr conn,
+                          virDomainDefPtr def)
+{
+    int err = 0;
+    int i;
+
+    if (!conn)
+        return 1;
+
+    for (i = 0 ; i < def->nnets ; i++) {
+        virDomainNetDefPtr net = def->nets[i];
+        if ((net->filter) && (net->ifname)) {
+           if (virDomainConfNWFilterInstantiate(conn, net)) {
+                err = 1;
+                break;
+            }
+        }
+    }
+
+    return err;
+}

 static virNWFilterCallbackDriver qemuCallbackDriver = {
     .name = "QEMU",

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list