On 10/31/2013 11:36 PM, Serge Hallyn wrote: > This will properly lock libvirt's usage of iptables with > others (like ufw). > > (See https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1245322) > > Signed-off-by: Serge Hallyn <serge.hallyn@xxxxxxxxxx> > --- > src/util/viriptables.c | 30 ++++++++++++++++++++++++++---- > 1 file changed, 26 insertions(+), 4 deletions(-) > > diff --git a/src/util/viriptables.c b/src/util/viriptables.c > index 16f571e..30d59b6 100644 > --- a/src/util/viriptables.c > +++ b/src/util/viriptables.c > @@ -50,19 +50,25 @@ > #include "virstring.h" > #include "virutil.h" > > +bool iptables_supports_xlock = false; > + > #if HAVE_FIREWALLD > static char *firewall_cmd_path = NULL; > +#endif > > static int > virIpTablesOnceInit(void) > { > + virCommandPtr cmd; > + int status; > + > +#if HAVE_FIREWALLD > firewall_cmd_path = virFindFileInPath("firewall-cmd"); > if (!firewall_cmd_path) { > VIR_INFO("firewall-cmd not found on system. " > "firewalld support disabled for iptables."); > } else { > - virCommandPtr cmd = virCommandNew(firewall_cmd_path); > - int status; > + virCommandNew(firewall_cmd_path); This needs to be "cmd = virCommandNew(.....);" > > virCommandAddArgList(cmd, "--state", NULL); > if (virCommandRun(cmd, &status) < 0 || status != 0) { > @@ -74,13 +80,26 @@ virIpTablesOnceInit(void) > } > virCommandFree(cmd); > } > + > + if (firewall_cmd_path) > + return 0; > + > +#endif > + > + cmd = virCommandNew(IPTABLES_PATH); > + virCommandAddArgList(cmd, "-w", "-L", "-n", NULL); > + if (virCommandRun(cmd, &status) < 0 || status != 0) { > + VIR_INFO("xtables locking not supported by your iptables"); > + } else { > + VIR_INFO("using xtables locking for iptables"); > + iptables_supports_xlock = true; > + } > + virCommandFree(cmd); > return 0; > } > > VIR_ONCE_GLOBAL_INIT(virIpTables) > > -#endif > - > #define VIR_FROM_THIS VIR_FROM_NONE > > enum { > @@ -104,6 +123,9 @@ iptablesCommandNew(const char *table, const char *chain, int family, int action) > if (cmd == NULL) { > cmd = virCommandNew((family == AF_INET6) > ? IP6TABLES_PATH : IPTABLES_PATH); > + > + if (iptables_supports_xlock) > + virCommandAddArgList(cmd, "-w", NULL); > } > > virCommandAddArgList(cmd, "--table", table, -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list