util: move and rename virFirewallBackendSynchronize()

This function doesn't have anything to do with manipulating
virFirewall objects, but rather should be called in response to dbus
events about the firewalld service. Move this function into
virfirewalld.c, and rename it to virFirewallDSynchronize().

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>

diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 4cfa4ab4dc909aef9fbfb6b35fd7730cac3ac4b3..ae2390132957c85c2454746f5b906151420cecd7 100644 (file)
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -2308,7 +2308,6 @@ virFileCacheSetPriv;
 # util/virfirewall.h
 virFirewallAddRuleFull;
 virFirewallApply;
-virFirewallBackendSynchronize;
 virFirewallFree;
 virFirewallNew;
 virFirewallRemoveRule;
@@ -2329,6 +2328,7 @@ virFirewallDGetVersion;
 virFirewallDGetZones;
 virFirewallDInterfaceSetZone;
 virFirewallDIsRegistered;
+virFirewallDSynchronize;
 virFirewallDZoneExists;
 
 

diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c
index 2fc9f9472920a36b68b7d3a5b5c6ee7757488b40..f3172e5c96b35aed63cd78ff4cedd76895103c01 100644 (file)
--- a/src/util/virfirewall.c
+++ b/src/util/virfirewall.c
@@ -611,49 +611,6 @@ virFirewallApplyRuleFirewallD(virFirewallRule *rule,
 }
 
 
-void
-virFirewallBackendSynchronize(void)
-{
-    const char *arg = "-V";
-    g_autofree char *output = NULL;
-    int firewallDRegistered = virFirewallDIsRegistered();
-
-    /*
-     * virFirewallBackendSynchronize() should be called after
-     * receiving an ownership-change event or reload event for
-     * firewalld from dbus, prior to performing any operations on the
-     * default table "filter".
-     *
-     * Our iptables filter rules are added to (private chains within)
-     * the default table named "filter", which is flushed by firewalld
-     * any time it is restarted or reloads its rules. libvirt watches
-     * for notifications that firewalld has been restarted / its rules
-     * reloaded, and then reloads the libvirt rules. But it's possible
-     * for libvirt to be notified that firewalld has restarted prior
-     * to firewalld completing initialization, and when that race
-     * happens, firewalld can potentially flush out rules that libvirt
-     * has just added!
-     *
-     * To prevent this, we send a simple command ("iptables -V") via
-     * firewalld's passthrough iptables API, and wait until it's
-     * finished before sending our own directly-executed iptables
-     * commands. This assures that firewalld has fully initialized and
-     * caught up with its internal queue of iptables commands, and
-     * won't stomp all over the new rules we subsequently add.
-     *
-     */
-
-    VIR_DEBUG("Firewalld is registered ? %d", firewallDRegistered);
-
-    if (firewallDRegistered < 0)
-        return; /* firewalld (or dbus?) not functional, don't sync */
-
-    ignore_value(virFirewallDApplyRule(VIR_FIREWALL_LAYER_IPV4,
-                                       (char **)&arg, 1, true, &output));
-    VIR_DEBUG("Result of 'iptables -V' via firewalld: %s", NULLSTR(output));
-}
-
-
 static int
 virFirewallApplyRule(virFirewall *firewall,
                      virFirewallRule *rule,

diff --git a/src/util/virfirewall.h b/src/util/virfirewall.h
index 169d99fe2b8dcc7a6cb9049eee2da71549957079..7448825dbc6965de30c0790ffcd789f202e34f45 100644 (file)
--- a/src/util/virfirewall.h
+++ b/src/util/virfirewall.h
@@ -109,6 +109,4 @@ void virFirewallStartRollback(virFirewall *firewall,
 
 int virFirewallApply(virFirewall *firewall);
 
-void virFirewallBackendSynchronize(void);
-
 G_DEFINE_AUTOPTR_CLEANUP_FUNC(virFirewall, virFirewallFree);

diff --git a/src/util/virfirewalld.c b/src/util/virfirewalld.c
index 3178bf4b3db509d4fd5b0667d7b29a746a07eaee..4795bf79251eef313ea86f155eadbc6b5ffc0369 100644 (file)
--- a/src/util/virfirewalld.c
+++ b/src/util/virfirewalld.c
@@ -368,3 +368,46 @@ virFirewallDInterfaceSetZone(const char *iface,
                              "changeZoneOfInterface",
                              message);
 }
+
+
+void
+virFirewallDSynchronize(void)
+{
+    const char *arg = "-V";
+    g_autofree char *output = NULL;
+    int firewallDRegistered = virFirewallDIsRegistered();
+
+    /*
+     * virFirewallDSynchronize() should be called after receiving an
+     * ownership-change event or reload event for firewalld from dbus,
+     * prior to performing any operations on the default table
+     * "filter".
+     *
+     * Our iptables filter rules are added to (private chains within)
+     * the default table named "filter", which is flushed by firewalld
+     * any time it is restarted or reloads its rules. libvirt watches
+     * for notifications that firewalld has been restarted / its rules
+     * reloaded, and then reloads the libvirt rules. But it's possible
+     * for libvirt to be notified that firewalld has restarted prior
+     * to firewalld completing initialization, and when that race
+     * happens, firewalld can potentially flush out rules that libvirt
+     * has just added!
+     *
+     * To prevent this, we send a simple command ("iptables -V") via
+     * firewalld's passthrough iptables API, and wait until it's
+     * finished before sending our own directly-executed iptables
+     * commands. This assures that firewalld has fully initialized and
+     * caught up with its internal queue of iptables commands, and
+     * won't stomp all over the new rules we subsequently add.
+     *
+     */
+
+    VIR_DEBUG("Firewalld is registered ? %d", firewallDRegistered);
+
+    if (firewallDRegistered < 0)
+        return; /* firewalld (or dbus?) not functional, don't sync */
+
+    ignore_value(virFirewallDApplyRule(VIR_FIREWALL_LAYER_IPV4,
+                                       (char **)&arg, 1, true, &output));
+    VIR_DEBUG("Result of 'iptables -V' via firewalld: %s", NULLSTR(output));
+}

diff --git a/src/util/virfirewalld.h b/src/util/virfirewalld.h
index d2db3b6f47bbc79400c164a5630f00fa6f878b0c..c396802a2f56abc29595dbe73483530013f49ad5 100644 (file)
--- a/src/util/virfirewalld.h
+++ b/src/util/virfirewalld.h
@@ -41,3 +41,5 @@ int virFirewallDApplyRule(virFirewallLayer layer,
 
 int virFirewallDInterfaceSetZone(const char *iface,
                                  const char *zone);
+
+void virFirewallDSynchronize(void);

diff --git a/src/util/viriptables.c b/src/util/viriptables.c
index 34ce9cd0182af2916424e17f9b0e20130b4797df..7db09a0d802e7088fe0196d7f6e6a01e97d19d26 100644 (file)
--- a/src/util/viriptables.c
+++ b/src/util/viriptables.c
@@ -28,6 +28,7 @@
 
 #include "internal.h"
 #include "viriptables.h"
+#include "virfirewalld.h"
 #include "vircommand.h"
 #include "viralloc.h"
 #include "virerror.h"
@@ -143,7 +144,7 @@ iptablesSetupPrivateChains(virFirewallLayer layer)
      * initialization, otherwise it might delete our rules soon after
      * we add them!
      */
-    virFirewallBackendSynchronize();
+    virFirewallDSynchronize();
 
     virFirewallStartTransaction(fw, 0);