shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 17:34:18 +03:00
Code Releases Activity
b89c4991da
libvirt/meson_options.txt
Laine Stump b89c4991da network: add an nftables backend for network driver's firewall construction 
Support using nftables to setup the firewall for each virtual network,
rather than iptables. The initial implementation of the nftables
backend creates (almost) exactly the same ruleset as the iptables
backend, determined by running the following commands on a host that
has an active virtual network:

  iptables-save >iptables.txt
  iptables-restore-translate -f iptables.txt

(and the similar ip6tables-save/ip6tables-restore-translate for an
IPv6 network). Correctness of the new backend was checked by comparing
the output of:

  nft list ruleset

when the backend is set to iptables and when it is set to nftables.

This page was used as a guide:

  https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables

The only differences between the rules created by the nftables backed
vs. the iptables backend (aside from a few inconsequential changes in
display order of some chains/options) are:

1) When we add nftables rules, rather than adding them in the
system-created "filter" and "nat" tables, we add them in a private
table (ie only we should be using it) created by us called "libvirt"
(the system-created "filter" and "nat" tables can't be used because
adding any rules to those tables directly with nft will cause failure
of any legacy application attempting to use iptables when it tries to
list the iptables rules (e.g. "iptables -S").

(NB: in nftables only a single table is required for both nat and
filter rules - the chains for each are differentiated by specifying
different "hook" locations for the toplevel chain of each)

2) Since the rules that were added to allow tftp/dns/dhcp traffic from
the guests to the host are unnecessary in the context of nftables,
those rules aren't added.

(Longer explanation: In the case of iptables, all rules were in a
single table, and it was always assumed that there would be some
"catch-all" REJECT rule added by "someone else" in the case that a
packet didn't match any specific rules, so libvirt added these
specific rules to ensure that, no matter what other rules were added
by any other subsystem, the guests would still have functional
tftp/dns/dhcp. For nftables though, the rules added by each subsystem
are in a separate table, and in order for traffic to be accepted, it
must be accepted by *all* tables, so just adding the specific rules to
libvirt's table doesn't help anything (as the default for the libvirt
table is ACCEPT anyway) and it just isn't practical/possible for
libvirt to find *all* other tables and add rules in all of them to
make sure the traffic is accepted. libvirt does this for firewalld (it
creates a "libvirt" zone that allows tftp/dns/dhcp, and adds all
virtual network bridges to that zone), however, so in that case no
extra work is required of the sysadmin.)

3) nftables doesn't support the "checksum mangle" rule (or any
equivalent functionality) that we have historically added to our
iptables rules, so the nftables rules we add have nothing related to
checksum mangling.

(NB: The result of (3) is that if you a) have a very old guest (RHEL5
era or earlier) and b) that guest is using a virtio-net network
device, and c) the virtio-net device is using vhost packet processing
(the default) then DHCP on the guest will fail. You can work around
this by adding <driver name='qemu'/> to the <interface> XML for the
guest).

There are certainly much better nftables rulesets that could be used
instead of those implemented here, and everything is in place to make
future changes to the rules that are used simple and free of surprises
(e.g. the rules that are added have coresponding "removal" commands
added to the network status so that we will always remove exactly the
rules that were previously added rather than trying to remove the
rules that "the current build of libvirt would have added" (which will
be incorrect the first time we run a libvirt with a newly modified
ruleset). For this initial implementation though, I wanted the
nftables rules to be as identical to the iptables rules as possible,
just to make it easier to verify that everything is working.

The backend can be manually chosen using the firewall_backend setting
in /etc/libvirt/network.conf. libvirtd/virtnetworkd will read this
setting when it starts; if there is no explicit setting, it will check
for availability of FIREWALL_BACKEND_DEFAULT_1 and then
FIREWALL_BACKEND_DEFAULT_2 (which are set at build time in
meson_options.txt or by adding -Dfirewall_backend_default_n=blah to
the meson commandline), and use the first backend that is available
(ie, that has the necessary programs installed). The standard
meson_options.txt is set to check for nftables first, and then
iptables.

Although it should be very safe to change the default backend from
iptables to nftables, that change is left for a later patch, to show
how the change in default can be undone if someone really needs to do
that.

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Tested-by: Daniel P. Berrangé <berrange@redhat.com>
2024-05-22 23:20:07 -04:00

137 lines
11 KiB
Meson
Raw Blame History

option('no_git', type: 'boolean', value: false, description: 'Disable git submodule update')
option('packager', type: 'string', value: '', description: 'Extra packager name')
option('packager_version', type: 'string', value: '', description: 'Extra packager version')
option('system', type: 'boolean', value: false, description: 'Set install paths to system ones')
option('runstatedir', type: 'string', value: '', description: 'State directory for temporary sockets, pid files, etc')
option('initconfdir', type: 'string', value: '', description: 'directory for init script configuration files')
# dep:tests
option('expensive_tests', type: 'feature', value: 'auto', description: 'set the default for enabling expensive tests (long timeouts)')
option('test_coverage', type: 'boolean', value: false, description: 'turn on code coverage instrumentation')
option('git_werror', type: 'feature', value: 'auto', description: 'use -Werror if building from GIT')
option('rpath', type: 'feature', value: 'auto', description: 'whether to include rpath information in installed binaries and libraries')
option('docdir', type: 'string', value: '', description: 'documentation installation directory')
option('docs', type: 'feature', value: 'auto', description: 'whether to generate documentation')
option('tests', type: 'feature', value: 'auto', description: 'whether to build and run tests')
# build dependencies options
option('apparmor', type: 'feature', value: 'auto', description: 'apparmor support')
option('attr', type: 'feature', value: 'auto', description: 'attr support')
option('audit', type: 'feature', value: 'auto', description: 'audit support')
# dep:readline
option('bash_completion', type: 'feature', value: 'auto', description: 'bash-completion support')
option('bash_completion_dir', type: 'string', value: '', description: 'directory containing bash completion scripts')
option('blkid', type: 'feature', value: 'auto', description: 'blkid support')
option('capng', type: 'feature', value: 'auto', description: 'cap-ng support')
option('curl', type: 'feature', value: 'auto', description: 'curl support')
option('fuse', type: 'feature', value: 'auto', description: 'fuse support')
option('glusterfs', type: 'feature', value: 'auto', description: 'glusterfs support')
option('libiscsi', type: 'feature', value: 'auto', description: 'libiscsi support')
option('libnl', type: 'feature', value: 'auto', description: 'libnl support')
option('libpcap', type: 'feature', value: 'auto', description: 'libpcap support')
option('libssh', type: 'feature', value: 'auto', description: 'libssh support')
option('libssh2', type: 'feature', value: 'auto', description: 'libssh2 support')
option('netcf', type: 'feature', value: 'auto', description: 'netcf support')
option('nls', type: 'feature', value: 'auto', description: 'nls support')
option('numactl', type: 'feature', value: 'auto', description: 'numactl support')
option('openwsman', type: 'feature', value: 'auto', description: 'openwsman support')
option('pciaccess', type: 'feature', value: 'auto', description: 'pciaccess support')
option('polkit', type: 'feature', value: 'auto', description: 'use PolicyKit for UNIX socket access checks')
option('readline', type: 'feature', value: 'auto', description: 'readline support')
option('sanlock', type: 'feature', value: 'auto', description: 'sanlock support')
option('sasl', type: 'feature', value: 'auto', description: 'sasl support')
option('selinux', type: 'feature', value: 'auto', description: 'selinux support')
option('selinux_mount', type: 'string', value: '', description: 'set SELinux mount point')
option('sshconfdir', type: 'string', value: '', description: 'directory for SSH client configuration')
# dep:pciaccess
option('udev', type: 'feature', value: 'auto', description: 'udev support')
# dep:driver_remote
option('wireshark_dissector', type: 'feature', value: 'auto', description: 'wireshark support')
option('wireshark_plugindir', type: 'string', value: '', description: 'wireshark plugins directory for use when installing wireshark plugin')
option('yajl', type: 'feature', value: 'auto', description: 'yajl support')
# build driver options
option('driver_bhyve', type: 'feature', value: 'auto', description: 'bhyve driver')
# dep:curl
option('driver_esx', type: 'feature', value: 'auto', description: 'esx driver')
# dep:openwsman
option('driver_hyperv', type: 'feature', value: 'auto', description: 'Hyper-V driver')
# dep:pciaccess dep:udev dep:driver_remote dep:driver_libvirtd
option('driver_interface', type: 'feature', value: 'auto', description: 'host interface driver')
# dep:driver_remote
option('driver_libvirtd', type: 'feature', value: 'auto', description: 'libvirtd driver')
# dep:driver_remote dep:driver_libvirtd
option('driver_libxl', type: 'feature', value: 'auto', description: 'libxenlight driver')
# dep:driver_remote dep:driver_libvirtd
option('driver_lxc', type: 'feature', value: 'auto', description: 'Linux Container driver')
# dep:curl dep:yajl dep:driver_remote dep:driver_libvirtd
option('driver_ch', type: 'feature', value: 'auto', description: 'Cloud-Hypervisor driver')
option('ch_user', type: 'string', value: '', description: 'username to run Cloud-Hypervisor system instance as')
option('ch_group', type: 'string', value: '', description: 'groupname to run Cloud-Hypervisor system instance as')
# dep:driver_remote dep:driver_libvirtd
option('driver_network', type: 'feature', value: 'auto', description: 'virtual network driver')
option('driver_openvz', type: 'feature', value: 'auto', description: 'OpenVZ driver')
# dep:yajl dep:driver_remote dep:driver_libvirtd
option('driver_qemu', type: 'feature', value: 'auto', description: 'QEMU/KVM driver')
option('qemu_user', type: 'string', value: '', description: 'username to run QEMU system instance as')
option('qemu_group', type: 'string', value: '', description: 'groupname to run QEMU system instance as')
option('qemu_moddir', type: 'string', value: '', description: 'set the directory where QEMU modules are located')
option('qemu_datadir', type: 'string', value: '', description: 'set the directory where QEMU shared data is located')
option('driver_remote', type: 'feature', value: 'auto', description: 'remote driver')
option('remote_default_mode', type: 'combo', choices: ['legacy', 'direct'], value: 'direct', description: 'remote driver default mode')
option('driver_secrets', type: 'feature', value: 'auto', description: 'local secrets management driver')
option('driver_test', type: 'feature', value: 'auto', description: 'test driver')
option('driver_vbox', type: 'feature', value: 'auto', description: 'VirtualBox XPCOMC driver')
option('vbox_xpcomc_dir', type: 'string', value: '', description: 'Location of directory containing VirtualBox XPCOMC library')
option('driver_vmware', type: 'feature', value: 'auto', description: 'VMware driver')
option('driver_vz', type: 'feature', value: 'auto', description: 'Virtuozzo driver')
option('secdriver_apparmor', type: 'feature', value: 'auto', description: 'use AppArmor security driver')
# dep:secdriver_apparmor
option('apparmor_profiles', type: 'feature', value: 'auto', description: 'install apparmor profiles')
# dep:selinux
option('secdriver_selinux', type: 'feature', value: 'auto', description: 'use SELinux security driver')
# storage driver options
option('storage_dir', type: 'feature', value: 'auto', description: 'directory backend for the storage driver')
option('storage_disk', type: 'feature', value: 'auto', description: 'GPartd Disk backend for the storage driver')
option('storage_fs', type: 'feature', value: 'auto', description: 'FileSystem backend for the storage driver')
option('storage_gluster', type: 'feature', value: 'auto', description: 'Gluster backend for the storage driver')
option('storage_iscsi', type: 'feature', value: 'auto', description: 'iscsi backend for the storage driver')
option('storage_iscsi_direct', type: 'feature', value: 'auto', description: 'iscsi-direct backend for the storage driver')
option('storage_lvm', type: 'feature', value: 'auto', description: 'LVM backend for the storage driver')
option('storage_mpath', type: 'feature', value: 'auto', description: 'mpath backend for the storage driver')
option('storage_rbd', type: 'feature', value: 'auto', description: 'RADOS Block Device backend for the storage driver')
option('storage_scsi', type: 'feature', value: 'auto', description: 'SCSI backend for the storage driver')
option('storage_vstorage', type: 'feature', value: 'auto', description: 'Virtuozzo storage backend for the storage driver')
option('storage_zfs', type: 'feature', value: 'auto', description: 'ZFS backend for the storage driver')
# build feature options
option('chrdev_lock_files', type: 'string', value: '', description: 'location for UUCP style lock files for character devices (leave empty for default paths on some platforms)')
option('dtrace', type: 'feature', value: 'auto', description: 'use dtrace for static probing')
option('firewalld', type: 'feature', value: 'auto', description: 'firewalld support')
# dep:firewalld
option('firewalld_zone', type: 'feature', value: 'auto', description: 'whether to install firewalld libvirt zone')
option('firewall_backend_default_1', type: 'string', value: 'iptables', description: 'first firewall backend to try when none is specified')
option('firewall_backend_default_2', type: 'string', value: 'nftables', description: 'second firewall backend to try when none is specified (and first is unavailable)')
option('host_validate', type: 'feature', value: 'auto', description: 'build virt-host-validate')
option('init_script', type: 'combo', choices: ['systemd', 'openrc', 'check', 'none'], value: 'check', description: 'Style of init script to install')
option('loader_nvram', type: 'string', value: '', description: 'Pass list of pairs of <loader>:<nvram> paths. Both pairs and list items are separated by a colon.')
option('login_shell', type: 'feature', value: 'auto', description: 'build virt-login-shell')
# dep:yajl dep:driver_network dep:libvirtd
option('nss', type: 'feature', value: 'auto', description: 'enable Name Service Switch plugin for resolving guest IP addresses')
# dep:numactl
option('numad', type: 'feature', value: 'auto', description: 'use numad to manage CPU placement dynamically')
option('nbdkit', type: 'feature', value: 'auto', description: 'Build nbdkit storage backend')
# dep:nbdkit
option('nbdkit_config_default', type: 'feature', value: 'auto', description: 'Whether to use nbdkit storage backend for network disks by default (configurable)')
option('pm_utils', type: 'feature', value: 'auto', description: 'use pm-utils for power management')
option('ssh_proxy', type: 'feature', value: 'auto', description: 'Build ssh-proxy for ssh over vsock')
option('sysctl_config', type: 'feature', value: 'auto', description: 'Whether to install sysctl configs')
# dep:sysctl_config
option('userfaultfd_sysctl', type: 'feature', value: 'auto', description: 'Whether to install sysctl config for enabling unprivileged userfaultfd')
option('tls_priority', type: 'string', value: 'NORMAL', description: 'set the default TLS session priority string')
View Git Blame Copy Permalink