SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewall-util: introduce context structure

Browse Source 
for planned nft backend we have three choices:

- open/close a new nfnetlink socket for every operation
- keep a nfnetlink socket open internally
- expose a opaque fw_ctx and stash all internal data here.

Originally I opted for the 2nd option, but during review it was
suggested to avoid static storage duration because of perceived
problems with threaded applications.

This adds fw_ctx and new/free functions, then converts the existing api
and nspawn and networkd to use it.
This commit is contained in:
Florian Westphal
2020-12-16 00:35:56 +01:00
parent f51343d0af
commit 761cf19d7b
11 changed files with 122 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nspawn/nspawn.c
+24 -10
View File
@@ -2474,14 +2474,19 @@ static int setup_kmsg(int kmsg_socket) {
return 0;
}
struct ExposeArgs {
union in_addr_union address;
struct FirewallContext *fw_ctx;
};
static int on_address_change(sd_netlink *rtnl, sd_netlink_message *m, void *userdata) {
union in_addr_union *exposed = userdata;
struct ExposeArgs *args = userdata;
assert(rtnl);
assert(m);
assert(exposed);
assert(args);
expose_port_execute(rtnl, arg_expose_ports, exposed);
expose_port_execute(rtnl, &args->fw_ctx, arg_expose_ports, &args->address);
return 0;
}
@@ -4466,7 +4471,7 @@ static int run_container(
bool secondary,
FDSet *fds,
char veth_name[IFNAMSIZ], bool *veth_created,
union in_addr_union *exposed,
struct ExposeArgs *expose_args,
int *master, pid_t *pid, int *ret) {
static const struct sigaction sa = {
@@ -4895,11 +4900,11 @@ static int run_container(
(void) sd_event_add_signal(event, NULL, SIGCHLD, on_sigchld, PID_TO_PTR(*pid));
if (arg_expose_ports) {
r = expose_port_watch_rtnl(event, rtnl_socket_pair[0], on_address_change, exposed, &rtnl);
r = expose_port_watch_rtnl(event, rtnl_socket_pair[0], on_address_change, expose_args, &rtnl);
if (r < 0)
return r;
(void) expose_port_execute(rtnl, arg_expose_ports, exposed);
(void) expose_port_execute(rtnl, &expose_args->fw_ctx, arg_expose_ports, &expose_args->address);
}
rtnl_socket_pair[0] = safe_close(rtnl_socket_pair[0]);
@@ -5026,7 +5031,7 @@ static int run_container(
return 0; /* finito */
}
expose_port_flush(arg_expose_ports, exposed);
expose_port_flush(&expose_args->fw_ctx, arg_expose_ports, &expose_args->address);
(void) remove_veth_links(veth_name, arg_network_veth_extra);
*veth_created = false;
@@ -5155,12 +5160,13 @@ static int run(int argc, char *argv[]) {
_cleanup_fdset_free_ FDSet *fds = NULL;
int r, n_fd_passed, ret = EXIT_SUCCESS;
char veth_name[IFNAMSIZ] = "";
union in_addr_union exposed = {};
struct ExposeArgs expose_args = {};
_cleanup_(release_lock_file) LockFile tree_global_lock = LOCK_FILE_INIT, tree_local_lock = LOCK_FILE_INIT;
char tmprootdir[] = "/tmp/nspawn-root-XXXXXX";
_cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
_cleanup_(decrypted_image_unrefp) DecryptedImage *decrypted_image = NULL;
_cleanup_(dissected_image_unrefp) DissectedImage *dissected_image = NULL;
_cleanup_(fw_ctx_freep) FirewallContext *fw_ctx = NULL;
pid_t pid = 0;
log_parse_environment();
@@ -5517,12 +5523,20 @@ static int run(int argc, char *argv[]) {
goto finish;
}
if (arg_expose_ports) {
r = fw_ctx_new(&fw_ctx);
if (r < 0) {
log_error_errno(r, "Cannot expose configured ports, firewall initialization failed: %m");
goto finish;
}
expose_args.fw_ctx = fw_ctx;
}
for (;;) {
r = run_container(dissected_image,
secondary,
fds,
veth_name, &veth_created,
&exposed, &master,
&expose_args, &master,
&pid, &ret);
if (r <= 0)
break;
@@ -5572,7 +5586,7 @@ finish:
(void) rm_rf(p, REMOVE_ROOT);
}
expose_port_flush(arg_expose_ports, &exposed);
expose_port_flush(&fw_ctx, arg_expose_ports, &expose_args.address);
if (veth_created)
(void) remove_veth_links(veth_name, arg_network_veth_extra);