Compare commits
161 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 10e74b75cb | |||
| 67283bdf89 | |||
| e092293a63 | |||
| 41a6b3c03f | |||
| 31256f3d0d | |||
| abac39a1b8 | |||
| 39e9be886f | |||
| 3db4281bc0 | |||
| 249ba7e495 | |||
| 33a8555d08 | |||
| dfb6f9eee6 | |||
| f5c4597c0a | |||
| 766bb232e8 | |||
| 266d5e2fcb | |||
| c6cfdf3963 | |||
| e3da3b01fc | |||
| b340367499 | |||
| ca7cc971b8 | |||
| 774125b7ed | |||
| afd39d2091 | |||
| cc16b7cd3a | |||
| be942ea860 | |||
| 938b89f090 | |||
| f7283923a3 | |||
| 1ad100593a | |||
| 21608be3b1 | |||
| 6347aef63f | |||
| 1c5d25ffeb | |||
| 8386ba3e9d | |||
| 03d3983515 | |||
| 1b0f3aaf64 | |||
| 647354eaf9 | |||
| 1392d7120d | |||
| f80d27e126 | |||
| 63cd2ced20 | |||
| cad1b6966f | |||
| a27f478451 | |||
| b94faf01a5 | |||
| 60a70c925a | |||
| e184d967ac | |||
| 985ee7390d | |||
| 156ce5b5c7 | |||
| 77b02695ab | |||
| 50057212b3 | |||
| c61c2c83ef | |||
| e3e721c529 | |||
| 7bf08eb7cb | |||
| 0862e2b778 | |||
| 9ae002fc72 | |||
| 7749fc4a26 | |||
| 5b0f05f970 | |||
| 36079ddefa | |||
| 9abc69f078 | |||
| f4d251ad6e | |||
| b0d2e09842 | |||
| b0dd011728 | |||
| 2513c9ff81 | |||
| 9ef5501a94 | |||
| 659f2f0b36 | |||
| f3cac3532b | |||
| 6eb56c2e71 | |||
| 93a549eb1a | |||
| f2a998ce76 | |||
| 8556d44e84 | |||
| f8539fae13 | |||
| 80a3188a20 | |||
| 56d89b1d61 | |||
| 2a7828bae8 | |||
| c879325741 | |||
| edf6aa6cd7 | |||
| 163b87484b | |||
| 5828ec5da6 | |||
| adaeee1c2c | |||
| 200f2942a9 | |||
| cbf07f0551 | |||
| eb9ceebe38 | |||
| 507eb37491 | |||
| 3e211fa0f6 | |||
| d4bb64489a | |||
| 6d908194bf | |||
| 2333a80c1a | |||
| f4fd6d7df6 | |||
| c1a3411c3b | |||
| 619904f37a | |||
| 044c5b0665 | |||
| 50aba9b5a0 | |||
| c98b586e70 | |||
| 987430ba8b | |||
| 58043b20fb | |||
| f1888958a6 | |||
| 6c3d79e65d | |||
| dc9be9b9a7 | |||
| 5e0d67787a | |||
| 662f0e2ba4 | |||
| 66060fa395 | |||
| 83def04a25 | |||
| 535bbcdd91 | |||
| 417e4c9cf7 | |||
| 24d349fa37 | |||
| 9f3b22fec4 | |||
| 7285a57f5c | |||
| 9944fa190c | |||
| 1a44dca7d4 | |||
| 0c2262d602 | |||
| da598118cf | |||
| da34e517db | |||
| 7b17ccd035 | |||
| 908a2f2a46 | |||
| acf19787de | |||
| c269619b9a | |||
| 3f6336f446 | |||
| a552a10ec8 | |||
| bfb8157052 | |||
| edb5200d83 | |||
| fe3f90dedd | |||
| 437df85540 | |||
| 2d6cbe6672 | |||
| 97a323d7c2 | |||
| cb839d3dfc | |||
| dc6b512f3c | |||
| ac122f4525 | |||
| 7744acbb6b | |||
| 3807f07c15 | |||
| e484fdc92b | |||
| 6752fe8c9e | |||
| 15f52369ae | |||
| 65a0e26138 | |||
| 497e096592 | |||
| 03a98aaf59 | |||
| 5845f1efec | |||
| a8d01eb9d7 | |||
| 6d76ba5956 | |||
| a11202d9e2 | |||
| bbfa59c8da | |||
| b97ad8956c | |||
| f9639a0012 | |||
| c71e60c76c | |||
| 9764121247 | |||
| a18ed3c492 | |||
| 9e2eeb32e3 | |||
| 8bf91f5d22 | |||
| 91d8eff569 | |||
| a761ea338f | |||
| 7eef88add4 | |||
| 0c88a64234 | |||
| c2f3be1f4d | |||
| 18b1c9d77e | |||
| 4528832026 | |||
| 037cd36ba2 | |||
| b94fb6a393 | |||
| b0c05ac2ae | |||
| 15c305caf3 | |||
| bc1b3e59a7 | |||
| 3c4492c415 | |||
| fecc0295a2 | |||
| 325dc837c6 | |||
| 5a45cb7f0d | |||
| 21269530e8 | |||
| fc18e983e7 | |||
| 4a7cc743a9 | |||
| 4398397311 |
@@ -0,0 +1,41 @@
|
|||||||
|
From 845210011a9ffd9d17e30c51cbc81ba67c5d3166 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Michal Privoznik <mprivozn@redhat.com>
|
||||||
|
Date: Tue, 20 Jan 2026 10:08:29 +0100
|
||||||
|
Subject: [PATCH] esx: Allow connecting to IPv6 server
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
When connecting to a VMWare server, the hostname from URI is
|
||||||
|
resolved using esxUtil_ResolveHostname() which in turn calls
|
||||||
|
getaddrinfo(). But in the hints argument, we restrict the return
|
||||||
|
address to be IPv4 (AF_INET) which obviously fails if the address
|
||||||
|
to resolve is an IPv6 address. Set the hint to AF_UNSPEC which
|
||||||
|
allows both IPv4 and IPv6. While at it, also allow IPv4 addresses
|
||||||
|
mapped in IPv6 by setting AI_V4MAPPED flag.
|
||||||
|
|
||||||
|
Resolves: https://issues.redhat.com/browse/RHEL-138300
|
||||||
|
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
||||||
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||||
|
---
|
||||||
|
src/esx/esx_util.c | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/esx/esx_util.c b/src/esx/esx_util.c
|
||||||
|
index 88b3dc893f..a6275babd5 100644
|
||||||
|
--- a/src/esx/esx_util.c
|
||||||
|
+++ b/src/esx/esx_util.c
|
||||||
|
@@ -275,8 +275,8 @@ esxUtil_ResolveHostname(const char *hostname, char **ipAddress)
|
||||||
|
int errcode;
|
||||||
|
g_autofree char *address = NULL;
|
||||||
|
|
||||||
|
- hints.ai_flags = AI_ADDRCONFIG;
|
||||||
|
- hints.ai_family = AF_INET;
|
||||||
|
+ hints.ai_flags = AI_ADDRCONFIG | AI_V4MAPPED;
|
||||||
|
+ hints.ai_family = AF_UNSPEC;
|
||||||
|
hints.ai_socktype = SOCK_STREAM;
|
||||||
|
hints.ai_protocol = 0;
|
||||||
|
|
||||||
|
--
|
||||||
|
2.52.0
|
||||||
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
From: Michal Privoznik <mprivozn@redhat.com>
|
|
||||||
Date: Mon, 9 Mar 2020 16:40:57 +0100
|
|
||||||
Subject: [PATCH] virDomainDiskTranslateSourcePool: Check for disk type
|
|
||||||
correctly
|
|
||||||
|
|
||||||
When rewriting the virDomainDiskTranslateSourcePool() function in
|
|
||||||
v6.1.0-rc1~184 a typo was introduced. Previously, we allowed
|
|
||||||
startup policy only for those volumes which translated to
|
|
||||||
VIR_STORAGE_TYPE_FILE. But starting with the referenced commit,
|
|
||||||
the value we checked for was changed to VIR_STORAGE_VOL_FILE
|
|
||||||
which comes from a different enum and has a different value too.
|
|
||||||
This is wrong, because virStorageSourceGetActualType() returns a
|
|
||||||
value from the original enum.
|
|
||||||
|
|
||||||
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1811728
|
|
||||||
|
|
||||||
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
|
||||||
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
|
|
||||||
(cherry picked from commit 3918dbd84e4951b43f93fbf50ef52be00274850c)
|
|
||||||
---
|
|
||||||
src/conf/domain_conf.c | 2 +-
|
|
||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
|
|
||||||
index 17867eeece..fd2e8f4eb5 100644
|
|
||||||
--- a/src/conf/domain_conf.c
|
|
||||||
+++ b/src/conf/domain_conf.c
|
|
||||||
@@ -31746,7 +31746,7 @@ virDomainDiskTranslateSourcePool(virDomainDiskDefPtr def)
|
|
||||||
}
|
|
||||||
|
|
||||||
if (def->startupPolicy != 0 &&
|
|
||||||
- virStorageSourceGetActualType(def->src) != VIR_STORAGE_VOL_FILE) {
|
|
||||||
+ virStorageSourceGetActualType(def->src) != VIR_STORAGE_TYPE_FILE) {
|
|
||||||
virReportError(VIR_ERR_XML_ERROR, "%s",
|
|
||||||
_("'startupPolicy' is only valid for "
|
|
||||||
"'file' type volume"));
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
From: Laine Stump <laine@redhat.com>
|
|
||||||
Date: Thu, 7 May 2020 22:32:59 -0400
|
|
||||||
Subject: [PATCH] network: make it safe to call networkSetupPrivateChains()
|
|
||||||
multiple times
|
|
||||||
MIME-Version: 1.0
|
|
||||||
Content-Type: text/plain; charset=UTF-8
|
|
||||||
Content-Transfer-Encoding: 8bit
|
|
||||||
|
|
||||||
networkSetupPrivateChains() is currently called only once per run of
|
|
||||||
libvirtd, so it can assume that errInitV4 and errInitV6 are empty/null
|
|
||||||
when it is called. In preparation for potentially calling this
|
|
||||||
function multiple times during one run, this patch moves the reset of
|
|
||||||
errInitV[46] to the top of the function, to assure no memory is
|
|
||||||
leaked.
|
|
||||||
|
|
||||||
Signed-off-by: Laine Stump <laine@redhat.com>
|
|
||||||
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
||||||
(cherry picked from commit de110f110fb917a31b9f33ad8e4b3c1d3284766a)
|
|
||||||
---
|
|
||||||
src/network/bridge_driver_linux.c | 8 ++++----
|
|
||||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c
|
|
||||||
index 7bbde5c6a9..80bd2409e1 100644
|
|
||||||
--- a/src/network/bridge_driver_linux.c
|
|
||||||
+++ b/src/network/bridge_driver_linux.c
|
|
||||||
@@ -48,6 +48,10 @@ static void networkSetupPrivateChains(void)
|
|
||||||
VIR_DEBUG("Setting up global firewall chains");
|
|
||||||
|
|
||||||
createdChains = false;
|
|
||||||
+ virFreeError(errInitV4);
|
|
||||||
+ errInitV4 = NULL;
|
|
||||||
+ virFreeError(errInitV6);
|
|
||||||
+ errInitV6 = NULL;
|
|
||||||
|
|
||||||
rc = iptablesSetupPrivateChains(VIR_FIREWALL_LAYER_IPV4);
|
|
||||||
if (rc < 0) {
|
|
||||||
@@ -56,8 +60,6 @@ static void networkSetupPrivateChains(void)
|
|
||||||
errInitV4 = virSaveLastError();
|
|
||||||
virResetLastError();
|
|
||||||
} else {
|
|
||||||
- virFreeError(errInitV4);
|
|
||||||
- errInitV4 = NULL;
|
|
||||||
if (rc) {
|
|
||||||
VIR_DEBUG("Created global IPv4 chains");
|
|
||||||
createdChains = true;
|
|
||||||
@@ -73,8 +75,6 @@ static void networkSetupPrivateChains(void)
|
|
||||||
errInitV6 = virSaveLastError();
|
|
||||||
virResetLastError();
|
|
||||||
} else {
|
|
||||||
- virFreeError(errInitV6);
|
|
||||||
- errInitV6 = NULL;
|
|
||||||
if (rc) {
|
|
||||||
VIR_DEBUG("Created global IPv6 chains");
|
|
||||||
createdChains = true;
|
|
||||||
@@ -1,265 +0,0 @@
|
|||||||
From: Laine Stump <laine@redhat.com>
|
|
||||||
Date: Thu, 7 May 2020 21:54:39 -0400
|
|
||||||
Subject: [PATCH] network: force re-creation of iptables private chains on
|
|
||||||
firewalld restart
|
|
||||||
MIME-Version: 1.0
|
|
||||||
Content-Type: text/plain; charset=UTF-8
|
|
||||||
Content-Transfer-Encoding: 8bit
|
|
||||||
|
|
||||||
When firewalld is stopped, it removes *all* iptables rules and chains,
|
|
||||||
including those added by libvirt. Since restarting firewalld means
|
|
||||||
stopping and then starting it, any time it is restarted, libvirt needs
|
|
||||||
to recreate all the private iptables chains it uses, along with all
|
|
||||||
the rules it adds.
|
|
||||||
|
|
||||||
We already have code in place to call networkReloadFirewallRules() any
|
|
||||||
time we're notified of a firewalld start, and
|
|
||||||
networkReloadFirewallRules() will call
|
|
||||||
networkPreReloadFirewallRules(), which calls
|
|
||||||
networkSetupPrivateChains(); unfortunately that last call is called
|
|
||||||
using virOnce(), meaning that it will only be called the first time
|
|
||||||
through networkPreReloadFirewallRules() after libvirtd starts - so of
|
|
||||||
course when firewalld is later restarted, the call to
|
|
||||||
networkSetupPrivateChains() is skipped.
|
|
||||||
|
|
||||||
The neat and tidy way to fix this would be if there was a standard way
|
|
||||||
to reset a pthread_once_t object so that the next time virOnce was
|
|
||||||
called, it would think the function hadn't been called, and call it
|
|
||||||
again. Unfortunately, there isn't any official way of doing that (we
|
|
||||||
*could* just fill it with 0 and hope for the best, but that doesn't
|
|
||||||
seem very safe.
|
|
||||||
|
|
||||||
So instead, this patch just adds a static variable called
|
|
||||||
chainInitDone, which is set to true after networkSetupPrivateChains()
|
|
||||||
is called for the first time, and then during calls to
|
|
||||||
networkPreReloadFirewallRules(), if chainInitDone is set, we call
|
|
||||||
networkSetupPrivateChains() directly instead of via virOnce().
|
|
||||||
|
|
||||||
It may seem unsafe to directly call a function that is meant to be
|
|
||||||
called only once, but I think in this case we're safe - there's
|
|
||||||
nothing in the function that is inherently "once only" - it doesn't
|
|
||||||
initialize anything that can't safely be re-initialized (as long as
|
|
||||||
two threads don't try to do it at the same time), and it only happens
|
|
||||||
when responding to a dbus message that firewalld has been started (and
|
|
||||||
I don't think it's possible for us to be processing two of those at
|
|
||||||
once), and even then only if the initial call to the function has
|
|
||||||
already been completed (so we're safe if we receive a firewalld
|
|
||||||
restart call at a time when we haven't yet called it, or even if
|
|
||||||
another thread is already in the process of executing it. The only
|
|
||||||
problematic bit I can think of is if another thread is in the process
|
|
||||||
of adding an iptable rule at the time we're executing this function,
|
|
||||||
but 1) none of those threads will be trying to add chains, and 2) if
|
|
||||||
there was a concurrency problem with other threads adding iptables
|
|
||||||
rules while firewalld was being restarted, it would still be a problem
|
|
||||||
even without this change.
|
|
||||||
|
|
||||||
This is yet another patch that fixes an occurrence of this error:
|
|
||||||
|
|
||||||
COMMAND_FAILED: '/usr/sbin/iptables -w10 -w --table filter --insert LIBVIRT_INP --in-interface virbr0 --protocol tcp --destination-port 67 --jump ACCEPT' failed: iptables: No chain/target/match by that name.
|
|
||||||
|
|
||||||
In particular, this resolves: https://bugzilla.redhat.com/1813830
|
|
||||||
|
|
||||||
Signed-off-by: Laine Stump <laine@redhat.com>
|
|
||||||
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
||||||
(cherry picked from commit f5418b427e7d2f26803880309478de9103680826)
|
|
||||||
---
|
|
||||||
src/network/bridge_driver.c | 16 ++++---
|
|
||||||
src/network/bridge_driver_linux.c | 69 ++++++++++++++++++----------
|
|
||||||
src/network/bridge_driver_nop.c | 3 +-
|
|
||||||
src/network/bridge_driver_platform.h | 2 +-
|
|
||||||
4 files changed, 58 insertions(+), 32 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
|
|
||||||
index 369e80a889..aaf14defe4 100644
|
|
||||||
--- a/src/network/bridge_driver.c
|
|
||||||
+++ b/src/network/bridge_driver.c
|
|
||||||
@@ -273,7 +273,9 @@ static int
|
|
||||||
networkShutdownNetworkExternal(virNetworkObjPtr obj);
|
|
||||||
|
|
||||||
static void
|
|
||||||
-networkReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup);
|
|
||||||
+networkReloadFirewallRules(virNetworkDriverStatePtr driver,
|
|
||||||
+ bool startup,
|
|
||||||
+ bool force);
|
|
||||||
|
|
||||||
static void
|
|
||||||
networkRefreshDaemons(virNetworkDriverStatePtr driver);
|
|
||||||
@@ -689,7 +691,7 @@ firewalld_dbus_filter_bridge(DBusConnection *connection G_GNUC_UNUSED,
|
|
||||||
|
|
||||||
if (reload) {
|
|
||||||
VIR_DEBUG("Reload in bridge_driver because of firewalld.");
|
|
||||||
- networkReloadFirewallRules(driver, false);
|
|
||||||
+ networkReloadFirewallRules(driver, false, true);
|
|
||||||
}
|
|
||||||
|
|
||||||
return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
|
|
||||||
@@ -798,7 +800,7 @@ networkStateInitialize(bool privileged,
|
|
||||||
virNetworkObjListPrune(network_driver->networks,
|
|
||||||
VIR_CONNECT_LIST_NETWORKS_INACTIVE |
|
|
||||||
VIR_CONNECT_LIST_NETWORKS_TRANSIENT);
|
|
||||||
- networkReloadFirewallRules(network_driver, true);
|
|
||||||
+ networkReloadFirewallRules(network_driver, true, false);
|
|
||||||
networkRefreshDaemons(network_driver);
|
|
||||||
|
|
||||||
if (virDriverShouldAutostart(network_driver->stateDir, &autostart) < 0)
|
|
||||||
@@ -868,7 +870,7 @@ networkStateReload(void)
|
|
||||||
network_driver->networkConfigDir,
|
|
||||||
network_driver->networkAutostartDir,
|
|
||||||
network_driver->xmlopt);
|
|
||||||
- networkReloadFirewallRules(network_driver, false);
|
|
||||||
+ networkReloadFirewallRules(network_driver, false, false);
|
|
||||||
networkRefreshDaemons(network_driver);
|
|
||||||
virNetworkObjListForEach(network_driver->networks,
|
|
||||||
networkAutostartConfig,
|
|
||||||
@@ -2236,14 +2238,16 @@ networkReloadFirewallRulesHelper(virNetworkObjPtr obj,
|
|
||||||
|
|
||||||
|
|
||||||
static void
|
|
||||||
-networkReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup)
|
|
||||||
+networkReloadFirewallRules(virNetworkDriverStatePtr driver,
|
|
||||||
+ bool startup,
|
|
||||||
+ bool force)
|
|
||||||
{
|
|
||||||
VIR_INFO("Reloading iptables rules");
|
|
||||||
/* Ideally we'd not even register the driver when unprivilegd
|
|
||||||
* but until we untangle the virt driver that's not viable */
|
|
||||||
if (!driver->privileged)
|
|
||||||
return;
|
|
||||||
- networkPreReloadFirewallRules(driver, startup);
|
|
||||||
+ networkPreReloadFirewallRules(driver, startup, force);
|
|
||||||
virNetworkObjListForEach(driver->networks,
|
|
||||||
networkReloadFirewallRulesHelper,
|
|
||||||
NULL);
|
|
||||||
diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c
|
|
||||||
index 80bd2409e1..b0bd207250 100644
|
|
||||||
--- a/src/network/bridge_driver_linux.c
|
|
||||||
+++ b/src/network/bridge_driver_linux.c
|
|
||||||
@@ -36,11 +36,14 @@ VIR_LOG_INIT("network.bridge_driver_linux");
|
|
||||||
#define PROC_NET_ROUTE "/proc/net/route"
|
|
||||||
|
|
||||||
static virOnceControl createdOnce;
|
|
||||||
-static bool createdChains;
|
|
||||||
+static bool chainInitDone; /* true iff networkSetupPrivateChains was ever called */
|
|
||||||
+static bool createdChains; /* true iff networkSetupPrivateChains created chains during most recent call */
|
|
||||||
static virErrorPtr errInitV4;
|
|
||||||
static virErrorPtr errInitV6;
|
|
||||||
|
|
||||||
-/* Only call via virOnce */
|
|
||||||
+/* Usually only called via virOnce, but can also be called directly in
|
|
||||||
+ * response to firewalld reload (if chainInitDone == true)
|
|
||||||
+ */
|
|
||||||
static void networkSetupPrivateChains(void)
|
|
||||||
{
|
|
||||||
int rc;
|
|
||||||
@@ -82,6 +85,8 @@ static void networkSetupPrivateChains(void)
|
|
||||||
VIR_DEBUG("Global IPv6 chains already exist");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+ chainInitDone = true;
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
@@ -111,7 +116,10 @@ networkHasRunningNetworks(virNetworkDriverStatePtr driver)
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
-void networkPreReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup)
|
|
||||||
+void
|
|
||||||
+networkPreReloadFirewallRules(virNetworkDriverStatePtr driver,
|
|
||||||
+ bool startup,
|
|
||||||
+ bool force)
|
|
||||||
{
|
|
||||||
/*
|
|
||||||
* If there are any running networks, we need to
|
|
||||||
@@ -130,29 +138,42 @@ void networkPreReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup
|
|
||||||
* of starting the network though as that makes them
|
|
||||||
* more likely to be seen by a human
|
|
||||||
*/
|
|
||||||
- if (!networkHasRunningNetworks(driver)) {
|
|
||||||
- VIR_DEBUG("Delayed global rule setup as no networks are running");
|
|
||||||
- return;
|
|
||||||
- }
|
|
||||||
+ if (chainInitDone && force) {
|
|
||||||
+ /* The Private chains have already been initialized once
|
|
||||||
+ * during this run of libvirtd, so 1) we can't do it again via
|
|
||||||
+ * virOnce(), and 2) we need to re-add the private chains even
|
|
||||||
+ * if there are currently no running networks, because the
|
|
||||||
+ * next time a network is started, libvirt will expect that
|
|
||||||
+ * the chains have already been added. So we call directly
|
|
||||||
+ * instead of via virOnce().
|
|
||||||
+ */
|
|
||||||
+ networkSetupPrivateChains();
|
|
||||||
|
|
||||||
- ignore_value(virOnce(&createdOnce, networkSetupPrivateChains));
|
|
||||||
+ } else {
|
|
||||||
+ if (!networkHasRunningNetworks(driver)) {
|
|
||||||
+ VIR_DEBUG("Delayed global rule setup as no networks are running");
|
|
||||||
+ return;
|
|
||||||
+ }
|
|
||||||
|
|
||||||
- /*
|
|
||||||
- * If this is initial startup, and we just created the
|
|
||||||
- * top level private chains we either
|
|
||||||
- *
|
|
||||||
- * - upgraded from old libvirt
|
|
||||||
- * - freshly booted from clean state
|
|
||||||
- *
|
|
||||||
- * In the first case we must delete the old rules from
|
|
||||||
- * the built-in chains, instead of our new private chains.
|
|
||||||
- * In the second case it doesn't matter, since no existing
|
|
||||||
- * rules will be present. Thus we can safely just tell it
|
|
||||||
- * to always delete from the builin chain
|
|
||||||
- */
|
|
||||||
- if (startup && createdChains) {
|
|
||||||
- VIR_DEBUG("Requesting cleanup of legacy firewall rules");
|
|
||||||
- iptablesSetDeletePrivate(false);
|
|
||||||
+ ignore_value(virOnce(&createdOnce, networkSetupPrivateChains));
|
|
||||||
+
|
|
||||||
+ /*
|
|
||||||
+ * If this is initial startup, and we just created the
|
|
||||||
+ * top level private chains we either
|
|
||||||
+ *
|
|
||||||
+ * - upgraded from old libvirt
|
|
||||||
+ * - freshly booted from clean state
|
|
||||||
+ *
|
|
||||||
+ * In the first case we must delete the old rules from
|
|
||||||
+ * the built-in chains, instead of our new private chains.
|
|
||||||
+ * In the second case it doesn't matter, since no existing
|
|
||||||
+ * rules will be present. Thus we can safely just tell it
|
|
||||||
+ * to always delete from the builin chain
|
|
||||||
+ */
|
|
||||||
+ if (startup && createdChains) {
|
|
||||||
+ VIR_DEBUG("Requesting cleanup of legacy firewall rules");
|
|
||||||
+ iptablesSetDeletePrivate(false);
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --git a/src/network/bridge_driver_nop.c b/src/network/bridge_driver_nop.c
|
|
||||||
index 08d737511f..db89c10023 100644
|
|
||||||
--- a/src/network/bridge_driver_nop.c
|
|
||||||
+++ b/src/network/bridge_driver_nop.c
|
|
||||||
@@ -20,7 +20,8 @@
|
|
||||||
#include <config.h>
|
|
||||||
|
|
||||||
void networkPreReloadFirewallRules(virNetworkDriverStatePtr driver G_GNUC_UNUSED,
|
|
||||||
- bool startup G_GNUC_UNUSED)
|
|
||||||
+ bool startup G_GNUC_UNUSED,
|
|
||||||
+ bool force G_GNUC_UNUSED)
|
|
||||||
{
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --git a/src/network/bridge_driver_platform.h b/src/network/bridge_driver_platform.h
|
|
||||||
index 169417a6c0..48ab52c160 100644
|
|
||||||
--- a/src/network/bridge_driver_platform.h
|
|
||||||
+++ b/src/network/bridge_driver_platform.h
|
|
||||||
@@ -62,7 +62,7 @@ struct _virNetworkDriverState {
|
|
||||||
typedef struct _virNetworkDriverState virNetworkDriverState;
|
|
||||||
typedef virNetworkDriverState *virNetworkDriverStatePtr;
|
|
||||||
|
|
||||||
-void networkPreReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup);
|
|
||||||
+void networkPreReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup, bool force);
|
|
||||||
void networkPostReloadFirewallRules(bool startup);
|
|
||||||
|
|
||||||
int networkCheckRouteCollision(virNetworkDefPtr def);
|
|
||||||
@@ -1,100 +0,0 @@
|
|||||||
From: Laine Stump <laine@redhat.com>
|
|
||||||
Date: Fri, 1 May 2020 00:05:50 -0400
|
|
||||||
Subject: [PATCH] systemd: start libvirtd after firewalld/iptables services
|
|
||||||
|
|
||||||
When a system has enabled the iptables/ip6tables services rather than
|
|
||||||
firewalld, there is no explicit ordering of the start of those
|
|
||||||
services vs. libvirtd. This creates a problem when libvirtd.service is
|
|
||||||
started before ip[6]tables, as the latter, when it finally is started,
|
|
||||||
will remove all of the iptables rules that had previously been added
|
|
||||||
by libvirt, including the custom chains where libvirt's rules are
|
|
||||||
kept. This results in an error message similar to the following when a
|
|
||||||
user subsequently tries to start a new libvirt network:
|
|
||||||
|
|
||||||
"Error while activating network: Call to virNetworkCreate failed:
|
|
||||||
internal error: Failed to apply firewall rules
|
|
||||||
/usr/sbin/ip6tables -w --table filter --insert LIBVIRT_FWO \
|
|
||||||
--in-interface virbr2 --jump REJECT:
|
|
||||||
ip6tables: No chain/target/match by that name."
|
|
||||||
|
|
||||||
(Prior to logging this error, it also would have caused failure to
|
|
||||||
forward (or block) traffic in some cases, e.g. for guests on a NATed
|
|
||||||
network, since libvirt's rules to forward/block had all been deleted
|
|
||||||
and libvirt didn't know about it, so it couldn't fix the problem)
|
|
||||||
|
|
||||||
When this happens, the problem can be remedied by simply restarting
|
|
||||||
libvirtd.service (which has the side-effect of reloading all
|
|
||||||
libvirt-generated firewall rules)
|
|
||||||
|
|
||||||
Instead, we can just explicitly stating in the libvirtd.service file
|
|
||||||
that libvirtd.service should start after ip6tables.service and
|
|
||||||
ip6tables.service, eliminating the race condition that leads to the
|
|
||||||
error.
|
|
||||||
|
|
||||||
There is also nothing (that I can see) in the systemd .service files
|
|
||||||
to guarantee that firewalld.service will be started (if enabled) prior
|
|
||||||
to libvirtd.service. The same error scenario given above would occur
|
|
||||||
if libvirtd.service started before firewalld.service. Even before
|
|
||||||
that, though libvirtd would have detected that firewalld.service was
|
|
||||||
disabled, and then turn off all firewalld support. So, for example,
|
|
||||||
firewalld's libvirt zone wouldn't be used, and most likely traffic
|
|
||||||
from guests would therefore be blocked (all with no external
|
|
||||||
indication of the source of the problem other than a debug-level log
|
|
||||||
when libvirtd was started saying that firewalld wasn't in use); also
|
|
||||||
libvirtd wouldn't notice when firewalld reloaded its rules (which also
|
|
||||||
simultaneously deletes all of libvirt's rules).
|
|
||||||
|
|
||||||
I'm not aware of any reports that have been traced back to
|
|
||||||
libvirtd.service starting before firewalld.service, but have seen that
|
|
||||||
error reported multiple times, and also don't see an existing
|
|
||||||
dependency that would guarantee firewalld.service starts before
|
|
||||||
libvirtd.service, so it's possible it's been happening and we just
|
|
||||||
haven't gotten to the bottom of it.
|
|
||||||
|
|
||||||
This patch adds an After= line to the libvirtd.service file for each
|
|
||||||
of iptables.service, ip6tables.service, and firewalld.servicee, which
|
|
||||||
should guarantee that libvirtd.service isn't started until systemd has
|
|
||||||
started whichever of the others is enabled.
|
|
||||||
|
|
||||||
This race was diagnosed, and patch proposed, by Jason Montleon in
|
|
||||||
https://bugzilla.redhat.com/1723698 . At the time (April 2019) danpb
|
|
||||||
agreed with him that this change to libvirtd.service was a reasonable
|
|
||||||
thing to do, but I guess everyone thought someone else was going to
|
|
||||||
post a patch, so in the end nobody did.
|
|
||||||
|
|
||||||
Signed-off-by: Laine Stump <laine@redhat.com>
|
|
||||||
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
|
||||||
(cherry picked from commit 0756415f147dda15a417bd79eef9a62027d176e6)
|
|
||||||
---
|
|
||||||
src/network/virtnetworkd.service.in | 3 +++
|
|
||||||
src/remote/libvirtd.service.in | 3 +++
|
|
||||||
2 files changed, 6 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/src/network/virtnetworkd.service.in b/src/network/virtnetworkd.service.in
|
|
||||||
index 656e8b4f84..56182e1693 100644
|
|
||||||
--- a/src/network/virtnetworkd.service.in
|
|
||||||
+++ b/src/network/virtnetworkd.service.in
|
|
||||||
@@ -5,6 +5,9 @@ Requires=virtnetworkd.socket
|
|
||||||
Requires=virtnetworkd-ro.socket
|
|
||||||
Requires=virtnetworkd-admin.socket
|
|
||||||
After=network.target
|
|
||||||
+After=firewalld.service
|
|
||||||
+After=iptables.service
|
|
||||||
+After=ip6tables.service
|
|
||||||
After=dbus.service
|
|
||||||
After=apparmor.service
|
|
||||||
After=local-fs.target
|
|
||||||
diff --git a/src/remote/libvirtd.service.in b/src/remote/libvirtd.service.in
|
|
||||||
index 90b2cad5b0..cc0d4e3693 100644
|
|
||||||
--- a/src/remote/libvirtd.service.in
|
|
||||||
+++ b/src/remote/libvirtd.service.in
|
|
||||||
@@ -11,6 +11,9 @@ Wants=libvirtd-admin.socket
|
|
||||||
Wants=systemd-machined.service
|
|
||||||
Before=libvirt-guests.service
|
|
||||||
After=network.target
|
|
||||||
+After=firewalld.service
|
|
||||||
+After=iptables.service
|
|
||||||
+After=ip6tables.service
|
|
||||||
After=dbus.service
|
|
||||||
After=iscsid.service
|
|
||||||
After=apparmor.service
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
From: Jim Fehlig <jfehlig@suse.com>
|
|
||||||
Date: Fri, 3 Apr 2020 15:51:48 -0600
|
|
||||||
Subject: [PATCH] libxl: fix crash when initializing driver
|
|
||||||
MIME-Version: 1.0
|
|
||||||
Content-Type: text/plain; charset=UTF-8
|
|
||||||
Content-Transfer-Encoding: 8bit
|
|
||||||
|
|
||||||
Commit 54a401af478 split out DriverConfigInit from DriverConfigNew, but
|
|
||||||
then called it a bit late from libxlStateInitialize. The cfg is used in
|
|
||||||
libxlDriverConfigLoadFile and when uninitialized results in a crash.
|
|
||||||
Calling DriverConfigInit immediately after DriverConfigNew fixes the
|
|
||||||
crash.
|
|
||||||
|
|
||||||
Signed-off-by: Jim Fehlig <jfehlig@suse.com>
|
|
||||||
Reviewed-by: Erik Skultety <eskultet@redhat.com>
|
|
||||||
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
||||||
(cherry picked from commit 88011ed280c4f946a7b8e7ffcea2335eb075de60)
|
|
||||||
---
|
|
||||||
src/libxl/libxl_driver.c | 6 +++---
|
|
||||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c
|
|
||||||
index f2387e2a20..c4fb791fa0 100644
|
|
||||||
--- a/src/libxl/libxl_driver.c
|
|
||||||
+++ b/src/libxl/libxl_driver.c
|
|
||||||
@@ -703,14 +703,14 @@ libxlStateInitialize(bool privileged,
|
|
||||||
if (!(cfg = libxlDriverConfigNew()))
|
|
||||||
goto error;
|
|
||||||
|
|
||||||
+ if (libxlDriverConfigInit(cfg) < 0)
|
|
||||||
+ goto error;
|
|
||||||
+
|
|
||||||
driverConf = g_strdup_printf("%s/libxl.conf", cfg->configBaseDir);
|
|
||||||
|
|
||||||
if (libxlDriverConfigLoadFile(cfg, driverConf) < 0)
|
|
||||||
goto error;
|
|
||||||
|
|
||||||
- if (libxlDriverConfigInit(cfg) < 0)
|
|
||||||
- goto error;
|
|
||||||
-
|
|
||||||
/* Register the callbacks providing access to libvirt's event loop */
|
|
||||||
libxl_osevent_register_hooks(cfg->ctx, &libxl_osevent_callbacks, cfg->ctx);
|
|
||||||
|
|
||||||
+1920
-978
File diff suppressed because it is too large
Load Diff
@@ -1 +1 @@
|
|||||||
SHA512 (libvirt-6.1.0.tar.xz) = 17a2641f300a4a05149261bae74ac856e9a2511a259146595d2e2412c4a0601d88369b0544ba86edc80e433a47cf828317d8de38c6ec86a1b3efaca75294a606
|
SHA512 (libvirt-12.0.0.tar.xz) = 5613e4e59865f688fe4cca2734c6de1cf68d0540c6e3013c9c21e583accd4f4fc21ec98e9c794036c5d6d0c8dd05ad1d22dab61f8c7d2934c8cb507b5bee76ad
|
||||||
|
|||||||
Reference in New Issue
Block a user