SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewall-util: drop FirewallContext

Browse Source 
After iptables support is dropped, FirewallContext is a trivial
wrapper of sd_netlink. Let's drop it and directly use sd_netlink.
This commit is contained in:
Yu Watanabe
2025-09-19 15:33:17 +09:00
parent 9b75c41cb3
commit 7184f8366f
21 changed files with 189 additions and 396 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nspawn/nspawn-expose-ports.c
+26 -20
View File
@@ -76,12 +76,13 @@ void expose_port_free_all(ExposePort *p) {
LIST_CLEAR(ports, p, free);
}
int expose_port_flush(FirewallContext **fw_ctx, ExposePort* l, int af, union in_addr_union *exposed) {
int expose_port_flush(sd_netlink *nfnl, ExposePort* l, int af, union in_addr_union *exposed) {
int r;
assert(IN_SET(af, AF_INET, AF_INET6));
assert(exposed);
if (!l)
if (!nfnl || !l)
return 0;
if (!in_addr_is_set(af, exposed))
@@ -90,14 +91,15 @@ int expose_port_flush(FirewallContext **fw_ctx, ExposePort* l, int af, union in_
log_debug("Lost IP address.");
LIST_FOREACH(ports, p, l) {
r = fw_add_local_dnat(fw_ctx,
false,
af,
p->protocol,
p->host_port,
exposed,
p->container_port,
NULL);
r = fw_nftables_add_local_dnat(
nfnl,
/* add = */ false,
af,
p->protocol,
p->host_port,
exposed,
p->container_port,
/* previous_remote = */ NULL);
if (r < 0)
log_warning_errno(r, "Failed to modify %s firewall: %m", af_to_name(af));
}
@@ -106,12 +108,15 @@ int expose_port_flush(FirewallContext **fw_ctx, ExposePort* l, int af, union in_
return 0;
}
int expose_port_execute(sd_netlink *rtnl, FirewallContext **fw_ctx, ExposePort *l, int af, union in_addr_union *exposed) {
int expose_port_execute(sd_netlink *rtnl, sd_netlink *nfnl, ExposePort *l, int af, union in_addr_union *exposed) {
_cleanup_free_ struct local_address *addresses = NULL;
union in_addr_union new_exposed;
bool add;
int r;
assert(rtnl);
assert(nfnl);
assert(IN_SET(af, AF_INET, AF_INET6));
assert(exposed);
/* Invoked each time an address is added or removed inside the
@@ -129,7 +134,7 @@ int expose_port_execute(sd_netlink *rtnl, FirewallContext **fw_ctx, ExposePort *
addresses[0].scope < RT_SCOPE_LINK;
if (!add)
return expose_port_flush(fw_ctx, l, af, exposed);
return expose_port_flush(nfnl, l, af, exposed);
new_exposed = addresses[0].address;
if (in_addr_equal(af, exposed, &new_exposed))
@@ -138,14 +143,15 @@ int expose_port_execute(sd_netlink *rtnl, FirewallContext **fw_ctx, ExposePort *
log_debug("New container IP is %s.", IN_ADDR_TO_STRING(af, &new_exposed));
LIST_FOREACH(ports, p, l) {
r = fw_add_local_dnat(fw_ctx,
true,
af,
p->protocol,
p->host_port,
&new_exposed,
p->container_port,
in_addr_is_set(af, exposed) ? exposed : NULL);
r = fw_nftables_add_local_dnat(
nfnl,
/* add = */ true,
af,
p->protocol,
p->host_port,
&new_exposed,
p->container_port,
in_addr_is_set(af, exposed) ? exposed : NULL);
if (r < 0)
log_warning_errno(r, "Failed to modify %s firewall: %m", af_to_name(af));
}
src/nspawn/nspawn-expose-ports.h
+2 -3
View File
@@ -1,7 +1,6 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#pragma once
#include "firewall-util.h"
#include "forward.h"
#include "list.h"
@@ -18,5 +17,5 @@ int expose_port_parse(ExposePort **l, const char *s);
int expose_port_watch_rtnl(sd_event *event, int recv_fd, sd_netlink_message_handler_t handler, void *userdata, sd_netlink **ret);
int expose_port_send_rtnl(int send_fd);
int expose_port_execute(sd_netlink *rtnl, FirewallContext **fw_ctx, ExposePort *l, int af, union in_addr_union *exposed);
int expose_port_flush(FirewallContext **fw_ctx, ExposePort* l, int af, union in_addr_union *exposed);
int expose_port_execute(sd_netlink *rtnl, sd_netlink *nfnl, ExposePort *l, int af, union in_addr_union *exposed);
int expose_port_flush(sd_netlink *nfnl, ExposePort* l, int af, union in_addr_union *exposed);
src/nspawn/nspawn.c
+14 -13
View File
@@ -71,6 +71,7 @@
#include "mount-util.h"
#include "mountpoint-util.h"
#include "namespace-util.h"
#include "netlink-internal.h"
#include "notify-recv.h"
#include "nspawn-bind-user.h"
#include "nspawn-cgroup.h"
@@ -2539,7 +2540,7 @@ static int setup_kmsg(int fd_inner_socket) {
struct ExposeArgs {
union in_addr_union address4;
union in_addr_union address6;
struct FirewallContext *fw_ctx;
sd_netlink *nfnl;
};
static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
@@ -2548,8 +2549,8 @@ static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *user
assert(rtnl);
assert(m);
(void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET, &args->address4);
(void) expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, AF_INET6, &args->address6);
(void) expose_port_execute(rtnl, args->nfnl, arg_expose_ports, AF_INET, &args->address4);
(void) expose_port_execute(rtnl, args->nfnl, arg_expose_ports, AF_INET6, &args->address6);
return 0;
}
@@ -5607,8 +5608,8 @@ static int run_container(
if (r < 0)
return r;
(void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
(void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
(void) expose_port_execute(rtnl, expose_args->nfnl, arg_expose_ports, AF_INET, &expose_args->address4);
(void) expose_port_execute(rtnl, expose_args->nfnl, arg_expose_ports, AF_INET6, &expose_args->address6);
}
_cleanup_(osc_context_closep) sd_id128_t osc_context_id = SD_ID128_NULL;
@@ -5730,8 +5731,8 @@ static int run_container(
return 0; /* finito */
}
expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET, &expose_args->address4);
expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, AF_INET6, &expose_args->address6);
expose_port_flush(expose_args->nfnl, arg_expose_ports, AF_INET, &expose_args->address4);
expose_port_flush(expose_args->nfnl, arg_expose_ports, AF_INET6, &expose_args->address6);
(void) remove_veth_links(veth_name, arg_network_veth_extra);
*veth_created = false;
@@ -5900,7 +5901,7 @@ static int run(int argc, char *argv[]) {
_cleanup_(rmdir_and_freep) char *rootdir = NULL;
_cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
_cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
_cleanup_(fw_ctx_freep) FirewallContext *fw_ctx = NULL;
_cleanup_(sd_netlink_unrefp) sd_netlink *nfnl = NULL;
_cleanup_(pidref_done) PidRef pid = PIDREF_NULL;
log_setup();
@@ -6385,12 +6386,12 @@ static int run(int argc, char *argv[]) {
}
if (arg_expose_ports) {
r = fw_ctx_new(&fw_ctx);
r = sd_nfnl_socket_open(&nfnl);
if (r < 0) {
log_error_errno(r, "Cannot expose configured ports, firewall initialization failed: %m");
log_error_errno(r, "Cannot expose configured ports, failed to initialize nftables: %m");
goto finish;
}
expose_args.fw_ctx = fw_ctx;
expose_args.nfnl = nfnl;
}
for (;;) {
@@ -6454,8 +6455,8 @@ finish:
cleanup_propagation_and_export_directories();
expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET, &expose_args.address4);
expose_port_flush(&fw_ctx, arg_expose_ports, AF_INET6, &expose_args.address6);
expose_port_flush(nfnl, arg_expose_ports, AF_INET, &expose_args.address4);
expose_port_flush(nfnl, arg_expose_ports, AF_INET6, &expose_args.address6);
if (arg_userns_mode != USER_NAMESPACE_MANAGED) {
if (veth_created)