iptables has a system-wide lock on the xtables. Strangely though, in
the case of two concurrent invocations, the default is for the
instance not grabbing the lock to exit out rather than waiting for it.
This means that when starting a large number of guests in parallel,
many will fail out with messages like this:
2017-05-10 11:45:40 UTC libxl: error: libxl_exec.c:118: libxl_report_child_exitstatus: /etc/xen/scripts/vif-bridge remove [18767] exited with error status 4
2017-05-10 11:50:52 UTC libxl: error: libxl_exec.c:118: libxl_report_child_exitstatus: /etc/xen/scripts/vif-bridge offline [1554] exited with error status 4
In order to instruct iptables to wait for the lock, you have to
specify '-w'. Unfortunately, not all versions of iptables have the
'-w' option, so on first invocation check to see if it accepts the -w
command.
Reported-by: Antony Saba <awsaba@gmail.com>
Signed-off-by: George Dunlap <george.dunlap@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
Release-acked-by: Julien Grall <julien.grall@arm.com>
As recommended in http://www.gnu.org/licenses/gpl-howto.en.html.
This is the result of:
$ git grep -El Mass\|Temple\|Franklin | xargs ./fsf.pl
Where fsf.pl is:
#!/usr/bin/perl -w -pi.bak -0777
my $repl = 'If not, see <http://www.gnu.org/licenses/>.';
my $br = qr/(?:\s*\n\s*(?:[\*\#]|\/\/|\.\\" )?\s*|\s+)/;
my $inwt = qr/[Ii]f${br}not,${br}write${br}(?:to${br})?the${br}Free${br}Software${br}Foundation,(?:${br}Inc\.,)?/;
my $mass = qr/675${br}Mass${br}Ave,?${br}Cambridge,?${br}MA${br}02139,?${br}USA,?\.?/;
my $franklin = qr/51${br}Franklin${br}St(?:reet)?(?:,${br}| - )Fifth${br}Floor,?${br}Boston,?${br}MA,?${br}02110-1301,?${br}USA,?\.?/;
my $temple = qr/59${br}Temple${br}Place(?:,${br}| - )Suite${br}330,?${br}Boston,?${br}MA,?${br}021110?-1307,?${br}USA,?\.?/;
s|$inwt$br$mass|$repl|m;
s|$inwt$br$franklin|$repl|m;
s|$inwt$br$temple|$repl|m;
The only remaining mentions of these addresses are in COPYING files which I
haven't touched.
Some of the changed files are imports from elsewhere, however
filtering them out is tricky, I think it is tolerable to have these
files be modified here and then perhaps reverted on the next sync,
since it's only 1-2 lines and obvious what is going on.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
The TAP interfaces need the same iptables rules as the VIF, without it,
traffic will not be forwarded to/from them is the default FORWARD policy
is DROP/REJECT
Signed-off-by: Sylvain Munaut <s.munaut@whatever-company.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
This is from an old Debian bug at
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=437127
I'm slightly inferring what the configuration which trigger this issue is, the
bug report says:
This code however fails if no slash is present in the address, which is the
case in my configuration:
$ ip addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:16:17:90:b4:35 brd ff:ff:ff:ff:ff:ff
inet 88.198.12.XXX peer 88.198.12.XXX/32 brd 88.255.255.255 scope global eth0
I hope either Marc or Stefan can correct me if I have surmised wrongly what
this configuration represents.
This function is used in the vif-route configuration.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Campbell <ian.campbell@citrix.com>
This is based on a patch from Hans van Kranenburg in
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658305. Quoting that bug
report:
When configurating a duplicate custom vifname for interfaces in the Xen
dom0 that are added to a bridge (which is obviously a configuration error),
the hotplug scripts fail silently to rename the new vifX.0 to
the custom vifname, if it's already existing.
The result of this, is that the domU will start normally, but no network
traffic between domU and the dom0 bridge is possible, because the vifX.0
never gets added to the bridge.
Worse... when doing xm shutdown on the newly created domU, while
investigating the issue, the interface of another running domU gets shut
down, and remains hanging around in a DOWN state, because it cannot be
removed (the other unrelated domU is still running, but succesfully made
unavailable on the network!).
When starting the new domU again, the interface of the other domU will
be added to the bridge again, and while looking at the output of brctl
show, tcpdump and ping, which make no sense, because everything will
seem to be right, nagios will notify you of another host being down. :|
Note that libxl doesn't actually check the hotplug status yet, this changes
with Rogers hotplug script changes. xend correctly picks the failure up.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Campbell <ian.campbell@citrix.com>
This prevents the udev scripts from operating on other tap devices (e.g.
openvpn etc)
Correct the documentation for the "vifname" option which suggested it applied
to HVM tap devices only, which is not the case.
Reported by Michael Young.
Also fix the use of vifname with emulated devices. This is slightly complex.
The current hotplug scripts rely on being able to parse the "tapX.Y" (now
"vifX.Y-emu") name in order to locate the xenstore backend dir relating to the
corresponding vif. This is because we cannot inject our own environment vars
into the tap hotplug events. However this means that if the tap is initially
named with a user specified name (which will not match the expected scheme) we
fail to do anything useful with the device. So now we create the initial tap
device with the standard "vifX.Y-emu" name and the hotplug script will handle
the rename to the desired name. This is also how PV vif devices work -- they
are always created by netback with the name vifX.Y and renamed in the script.
Lastly also move libxl__device_* to a better place in the header, otherwise the
comment about evgen stuff isn't next to the associated functions (noticed jsut
because I was going to add nic_devname near to the setdefault functions)
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
In vif-common.sh, set the shell variable "dev" to the new interface
name when interfaces are renamed, and consistently use this variable
in all the vif scripts.
This fixes hotplug of renamed interfaces.
From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
From: Patrick Scharrenberg <pittipatti@web.de>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Signed-off-by: Patrick Scharrenberg <pittipatti@web.de>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Checking for RELATED,ESTABLISHED traffic being sent to a domU requires
connection tracking, which adds unexpected (to most users) load to
dom0. Heavily loaded systems can fill the conntrack tables.
So avoid this, be more liberal in what we accept, and leave it to domU
to police its own input.
Signed-off-by: Keir Fraser <keir@xen.org>
With newer (pvops) kernels logs get flooded with this iptables
warning: physdev match: using --physdev-out in the OUTPUT, FORWARD and
POSTROUTING chains for non-bridged traffic is not supported anymore
Using the --physdev-is-bridged option prevents this.
See also: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=571634#10
Signed-off-by: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
From: Anthony PERARD <anthony.perard@citrix.com>
This patch adds a second argument to vif-bridge script. It can be "vif"
or "tap". "vif" give the default behavior and "tap" just add the
interface to the found bridge when the action is "add".
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
---
tools/hotplug/Linux/vif-bridge | 20 ++++++---
tools/hotplug/Linux/vif-common.sh | 70 ++++++++++++++++++++++++---------
tools/hotplug/Linux/xen-backend.rules | 5 +-
tools/libxl/libxl.c | 6 +-
4 files changed, 70 insertions(+), 31 deletions(-)
In changset 19540 a bug was introduced in the fib_iptable function in
vif-common.sh that incorrectly checks the exit status of iptables --
it always believes iptables has failed even when it hasn't.
The attached patch fixes that. It's also bug 1490.
Signed-off-by: John Haxby <john.haxby@oracle.com>
iptables cannot correctly handle situations when more than one command
is trying to set netfilter rules. In such situations, iptables may fail
with EAGAIN, which results in iptables: Unknown error
18446744073709551615.
Such situation can easily happen when multiple network devices are
configured for a domain as vif hotplug scripts are called in parallel
for all of the network devices.
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
This patch makes two small changes to dom0 iptables rules that permit
(and revoke) domU network access.
First:
Currently, a rule intended to allow domU network access is appended to
the end of the FORWARD chain, where it can be preempted by other =20
rules. This patch causes the rule to be inserted at the top, where
it's more likely to have the intended effect.
Second:
In some cases (e.g. Fedora 9's default iptables configuration), the
first rule alone is insufficient to permit two-way packet flow. This
patch adds a second rule to the FORWARD chain that permits replies to
domU network requests to reach the domU vif.
Signed-off-by: Chris Bookholt <hap10@tycho.ncsc.mil>
George Dunlap
Ian Campbell
Olaf Hering
Sylvain Munaut
Ian Campbell
Ian Jackson
Keir Fraser
Sander Eikelenboom
Anthony Perard
Keir Fraser