[PATCH] nwfilter: Remove 'qemu-announce-self' example
by Peter Krempa
From: Peter Krempa <pkrempa(a)redhat.com>
The example allows packets sent by qemu after migration with broken
protocol ID. The proper self announce is handled via
'qemu-announce-self-rarp'.
The qemu bug was addressed by f8778a7785d530515b0db39 (released as
v0.13.0). As we no longer support such old qemus, and allowing broken
packets makes no sense remove the filter, and adjust the existing ones
to refer to the proper name.
Closes: https://gitlab.com/libvirt/libvirt/-/issues/792
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
docs/firewall.rst | 1 -
docs/formatnwfilter.rst | 2 +-
src/nwfilter/xml/clean-traffic-gateway.xml | 2 +-
src/nwfilter/xml/clean-traffic.xml | 2 +-
src/nwfilter/xml/meson.build | 1 -
src/nwfilter/xml/qemu-announce-self-rarp.xml | 2 ++
src/nwfilter/xml/qemu-announce-self.xml | 13 -------------
7 files changed, 5 insertions(+), 18 deletions(-)
delete mode 100644 src/nwfilter/xml/qemu-announce-self.xml
diff --git a/docs/firewall.rst b/docs/firewall.rst
index 26474d3317..81114d2c95 100644
--- a/docs/firewall.rst
+++ b/docs/firewall.rst
@@ -285,7 +285,6 @@ useful rules:
fb57c546-76dc-a372-513f-e8179011b48a no-mac-spoofing
dba10ea7-446d-76de-346f-335bd99c1d05 no-other-l2-traffic
f5c78134-9da4-0c60-a9f0-fb37bc21ac1f no-other-rarp-traffic
- 7637e405-4ccf-42ac-5b41-14f8d03d8cf3 qemu-announce-self
9aed52e7-f0f3-343e-fe5c-7dcb27b594e5 qemu-announce-self-rarp
Most of these are just building blocks. The interesting one here is
diff --git a/docs/formatnwfilter.rst b/docs/formatnwfilter.rst
index 13e9a791af..e50497aaf8 100644
--- a/docs/formatnwfilter.rst
+++ b/docs/formatnwfilter.rst
@@ -438,7 +438,7 @@ several other filters.
<filterref filter='allow-incoming-ipv4'/>
<filterref filter='no-arp-spoofing'/>
<filterref filter='no-other-l2-traffic'/>
- <filterref filter='qemu-announce-self'/>
+ <filterref filter='qemu-announce-self-rarp'/>
</filter>
To reference another filter, the XML node ``filterref`` needs to be provided
diff --git a/src/nwfilter/xml/clean-traffic-gateway.xml b/src/nwfilter/xml/clean-traffic-gateway.xml
index b8c204041a..1768a67697 100644
--- a/src/nwfilter/xml/clean-traffic-gateway.xml
+++ b/src/nwfilter/xml/clean-traffic-gateway.xml
@@ -30,5 +30,5 @@
<filterref filter='no-other-l2-traffic'/>
<!-- allow qemu to send a self-announce upon migration end -->
- <filterref filter='qemu-announce-self'/>
+ <filterref filter='qemu-announce-self-rarp'/>
</filter>
diff --git a/src/nwfilter/xml/clean-traffic.xml b/src/nwfilter/xml/clean-traffic.xml
index b8cde9c560..b0530da70a 100644
--- a/src/nwfilter/xml/clean-traffic.xml
+++ b/src/nwfilter/xml/clean-traffic.xml
@@ -25,6 +25,6 @@
<filterref filter='no-other-l2-traffic'/>
<!-- allow qemu to send a self-announce upon migration end -->
- <filterref filter='qemu-announce-self'/>
+ <filterref filter='qemu-announce-self-rarp'/>
</filter>
diff --git a/src/nwfilter/xml/meson.build b/src/nwfilter/xml/meson.build
index 0d96c54ebe..de3f205a7c 100644
--- a/src/nwfilter/xml/meson.build
+++ b/src/nwfilter/xml/meson.build
@@ -22,7 +22,6 @@ nwfilter_xml_files = [
'no-other-l2-traffic.xml',
'no-other-rarp-traffic.xml',
'qemu-announce-self-rarp.xml',
- 'qemu-announce-self.xml',
]
install_data(nwfilter_xml_files, install_dir: sysconfdir / 'libvirt' / 'nwfilter')
diff --git a/src/nwfilter/xml/qemu-announce-self-rarp.xml b/src/nwfilter/xml/qemu-announce-self-rarp.xml
index b7a848ad0f..db7b650320 100644
--- a/src/nwfilter/xml/qemu-announce-self-rarp.xml
+++ b/src/nwfilter/xml/qemu-announce-self-rarp.xml
@@ -11,4 +11,6 @@
arpsrcmacaddr='$MAC' arpdstmacaddr='$MAC'
arpsrcipaddr='0.0.0.0' arpdstipaddr='0.0.0.0'/>
</rule>
+
+ <filterref filter='no-other-rarp-traffic'/>
</filter>
diff --git a/src/nwfilter/xml/qemu-announce-self.xml b/src/nwfilter/xml/qemu-announce-self.xml
deleted file mode 100644
index 352db500de..0000000000
--- a/src/nwfilter/xml/qemu-announce-self.xml
+++ /dev/null
@@ -1,13 +0,0 @@
-<filter name='qemu-announce-self' chain='root'>
- <!-- as of 4/26/2010 qemu sends out a bogus packet with
- wrong rarp protocol ID -->
- <!-- accept what is being sent now -->
- <rule action='accept' direction='out'>
- <mac protocolid='0x835'/>
- </rule>
-
- <!-- accept if it was changed to rarp -->
- <filterref filter='qemu-announce-self-rarp'/>
- <filterref filter='no-other-rarp-traffic'/>
-
-</filter>
--
2.49.0
1 month, 1 week
[libvirt PATCH] qemu: prefer memfd if we have to format system memory
by Ján Tomko
From: Ján Tomko <jtomko(a)redhat.com>
For any vhost-user device to work, the memory needs to be marked as
shared.
What we recommend to users (e.g. in the virtiofs quide [0]) is:
<memoryBacking>
<source type='memfd'/>
<access mode='shared'/>
</memoryBacking>
Technically, only the access mode is needed:
<memoryBacking>
<access mode='shared'/>
</memoryBacking>
But this results in libvirt assuming the file backend.
Switch this case to use memfd which should offer better performance,
and less disk usage, at the cost of eating unswappable RAM.
[0] https://libvirt.org/kbase/virtiofs.html
Signed-off-by: Ján Tomko <jtomko(a)redhat.com>
---
src/qemu/qemu_command.c | 9 +++++++--
tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args | 2 +-
.../net-vhostuser-multiq.x86_64-latest.args | 2 +-
.../net-vhostuser-passt.x86_64-latest.args | 2 +-
tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args | 2 +-
.../schema-reorder-domain-subelements.x86_64-latest.args | 2 +-
.../qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args | 2 +-
7 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 7658cc4d39..ca9d4d6609 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -3417,8 +3417,13 @@ qemuBuildMemoryBackendProps(virJSONValue **backendProps,
if (!priv->memPrealloc)
prealloc = true;
- } else if (!nvdimmPath &&
- def->mem.source == VIR_DOMAIN_MEMORY_SOURCE_MEMFD) {
+ } else if ((!nvdimmPath &&
+ def->mem.source == VIR_DOMAIN_MEMORY_SOURCE_MEMFD) ||
+ (systemMemory &&
+ memAccess &&
+ !useHugepage &&
+ def->mem.source == VIR_DOMAIN_MEMORY_SOURCE_NONE &&
+ virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_MEMORY_MEMFD))) {
backendType = "memory-backend-memfd";
if (useHugepage &&
diff --git a/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args b/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args
index 93d2ef0d98..04732df68a 100644
--- a/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args
+++ b/tests/qemuxmlconfdata/disk-vhostvdpa.x86_64-latest.args
@@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
-accel tcg \
-cpu qemu64 \
-m size=219136k \
--object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \
+-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \
-overcommit mem-lock=off \
-smp 1,sockets=1,cores=1,threads=1 \
-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
diff --git a/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args b/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args
index 4ea3d4eebd..ac5c8b7652 100644
--- a/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args
+++ b/tests/qemuxmlconfdata/net-vhostuser-multiq.x86_64-latest.args
@@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
-accel tcg \
-cpu qemu64 \
-m size=219136k \
--object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \
+-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \
-overcommit mem-lock=off \
-smp 1,sockets=1,cores=1,threads=1 \
-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
diff --git a/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args b/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args
index afbbe188cf..ee395deffe 100644
--- a/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args
+++ b/tests/qemuxmlconfdata/net-vhostuser-passt.x86_64-latest.args
@@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
-accel tcg \
-cpu qemu64 \
-m size=219136k \
--object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \
+-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \
-overcommit mem-lock=off \
-smp 1,sockets=1,cores=1,threads=1 \
-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
diff --git a/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args b/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args
index f5925c77fe..74454d3d24 100644
--- a/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args
+++ b/tests/qemuxmlconfdata/net-vhostuser.x86_64-latest.args
@@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
-accel tcg \
-cpu qemu64 \
-m size=219136k \
--object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \
+-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \
-overcommit mem-lock=off \
-smp 1,sockets=1,cores=1,threads=1 \
-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
diff --git a/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args b/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args
index 76df9c30b0..5fb594df87 100644
--- a/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args
+++ b/tests/qemuxmlconfdata/schema-reorder-domain-subelements.x86_64-latest.args
@@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-passtvhostuu/.config \
-accel kvm \
-cpu qemu64 \
-m size=16777216k \
--object '{"qom-type":"memory-backend-file","id":"pc.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-passtvhostuu/pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":17179869184}' \
+-object '{"qom-type":"memory-backend-memfd","id":"pc.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":17179869184}' \
-overcommit mem-lock=off \
-smp 16,sockets=16,cores=1,threads=1 \
-uuid d79698e0-46b2-4459-87ee-7c762990dd6e \
diff --git a/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args b/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args
index 72ca38c305..eed9af8bb1 100644
--- a/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args
+++ b/tests/qemuxmlconfdata/vhost-user-fs-ccw.s390x-latest.args
@@ -14,7 +14,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
-accel tcg \
-cpu qemu \
-m size=219136k \
--object '{"qom-type":"memory-backend-file","id":"s390.ram","mem-path":"/var/lib/libvirt/qemu/ram/-1-QEMUGuest1/s390.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \
+-object '{"qom-type":"memory-backend-memfd","id":"s390.ram","share":true,"x-use-canonical-path-for-ramblock-id":false,"size":224395264}' \
-overcommit mem-lock=off \
-smp 1,sockets=1,cores=1,threads=1 \
-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
--
2.50.0
1 month, 1 week
[PATCH 0/3] qemu: Improve handling of architecture-specific defaults (SCSI)
by Andrea Bolognani
I was working on this last year, then sort of lost track. Jim's
recent patch[1] caused me to remember about this work and look into
picking it up again.
This is only half of the original series, which itself was reduced in
scope compared to the first revision. I'll try to get around to
everything, but addressing one area at the time is most likely to
succeed.
Of course this will no longer apply cleanly once Jim's patch has been
pushed. The conflict will be trivial to solve though.
Changes from [v2]:
* several patches have been pushed;
* address review comments.
Changes from [v1]:
* several patches have been pushed;
* of the remaining changes, only the ones related to SCSI and USB
controllers have been retained. I still intend to pursue the
rest, but those two are where the real nasty stuff happens, so
I'm focusing on them only for now;
* improve the handling of USB controllers on s390x;
* make all the code dealing with the legacy USB controller obsolete
and get rid of it;
* use out arguments to return models, making the new helpers fall
in line with the usual libvirt API conventions.
[1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/B4...
[v2] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/FZ...
[v1] https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/G5...
Andrea Bolognani (3):
qemu: Improve qemuDomainDefaultSCSIControllerModel()
qemu: Clean up qemuDomainDefaultSCSIControllerModel()
qemu: Use virtio-scsi by default on RISC-V
src/qemu/qemu_domain.c | 48 +++++++++++++------
src/qemu/qemu_domain.h | 5 +-
src/qemu/qemu_hotplug.c | 16 ++++---
src/qemu/qemu_postparse.c | 11 +++--
...ault-models.riscv64-latest.abi-update.args | 5 +-
...fault-models.riscv64-latest.abi-update.xml | 11 +++--
...64-virt-default-models.riscv64-latest.args | 5 +-
...v64-virt-default-models.riscv64-latest.xml | 11 +++--
8 files changed, 73 insertions(+), 39 deletions(-)
--
2.50.0
1 month, 2 weeks
[PATCH v1] aspeed: Deprecate the ast2700a0-evb machine
by Jamin Lin
The ast2700a0-evb machine represents the first revision of the AST2700 and
serves as the initial engineering sample rather than a production version.
A newer revision, A1, is now supported, and the ast2700a1-evb should replace
the older A0 version.
Signed-off-by: Jamin Lin <jamin_lin(a)aspeedtech.com>
---
docs/about/deprecated.rst | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 42037131de..5a3ed71a64 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -315,6 +315,14 @@ deprecated; use the new name ``dtb-randomness`` instead. The new name
better reflects the way this property affects all random data within
the device tree blob, not just the ``kaslr-seed`` node.
+Arm ``ast2700a0-evb`` machine (since 10.1)
+''''''''''''''''''''''''''''''''''''''''''
+
+The ``ast2700a0-evb`` machine represents the first revision of the AST2700
+and serves as the initial engineering sample rather than a production version.
+A newer revision, A1, is now supported, and the ``ast2700a1-evb`` should
+replace the older A0 version.
+
Mips ``mipssim`` machine (since 10.0)
'''''''''''''''''''''''''''''''''''''
--
2.43.0
1 month, 2 weeks
[PATCH] virdevmapper: Always use device name for finding targets
by bhavin192＠purelymail.com
From: Bhavin Gandhi <bhavin192(a)geeksocket.in>
DM_TABLE_DEPS expects a device name in dm_ioctl.name. In one of the
cases, full path of the device was getting returned causing the ioctl
call to fail with `ENXIO (No such device or address)`.
Also rename the function and variable names to better reflect that we
are dealing with DM device names and not paths.
This got introduced in 22494556542c676d1b9e7f1c1f2ea13ac17e1e3e
Resolves: https://gitlab.com/libvirt/libvirt/-/issues/790
Signed-off-by: Bhavin Gandhi <bhavin192(a)geeksocket.in>
---
src/util/virdevmapper.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/src/util/virdevmapper.c b/src/util/virdevmapper.c
index d0eae671ab..42c86d89cf 100644
--- a/src/util/virdevmapper.c
+++ b/src/util/virdevmapper.c
@@ -164,7 +164,7 @@ virDMOpen(void)
static char *
-virDMSanitizepath(const char *path)
+virDMGetDeviceName(const char *path)
{
g_autofree char *dmDirPath = NULL;
struct dirent *ent = NULL;
@@ -205,7 +205,7 @@ virDMSanitizepath(const char *path)
if (stat(tmp, &sb[1]) == 0 &&
sb[0].st_rdev == sb[1].st_rdev) {
- return g_steal_pointer(&tmp);
+ return g_strdup(ent->d_name);
}
}
@@ -219,7 +219,7 @@ virDevMapperGetTargetsImpl(int controlFD,
GSList **devPaths,
unsigned int ttl)
{
- g_autofree char *sanitizedPath = NULL;
+ g_autofree char *deviceName = NULL;
g_autofree char *buf = NULL;
struct dm_ioctl dm = { 0 };
struct dm_target_deps *deps = NULL;
@@ -233,10 +233,10 @@ virDevMapperGetTargetsImpl(int controlFD,
if (!virIsDevMapperDevice(path))
return 0;
- if (!(sanitizedPath = virDMSanitizepath(path)))
+ if (!(deviceName = virDMGetDeviceName(path)))
return 0;
- if (virStrcpy(dm.name, sanitizedPath, DM_NAME_LEN) < 0) {
+ if (virStrcpy(dm.name, deviceName, DM_NAME_LEN) < 0) {
virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s",
_("Resolved device mapper name too long"));
return -1;
--
2.49.0
1 month, 2 weeks
[PATCH 0/2] network: support NAT networking for FreeBSD/pf
by Roman Bogorodskiy
This series implements NAT networks support for FreeBSD using the Packet
Filter (pf) firewall.
The commit messages provide high-level details and limitations of the
current implementation, and I'll use this cover letter to provide some
more technical details and describe testing I have performed for this
change.
Libvirt FreeBSD/pf NAT testing
For two networks:
virsh # net-dumpxml default
<network>
<name>default</name>
<uuid>68cd5419-9fda-4cf0-9ac6-2eb9c1ba41ed</uuid>
<forward mode='nat'>
<nat>
<port start='1024' end='65535'/>
</nat>
</forward>
<bridge name='virbr0' stp='on' delay='0'/>
<mac address='52:54:00:db:0e:e5'/>
<ip address='192.168.122.1' netmask='255.255.255.0'>
<dhcp>
<range start='192.168.122.2' end='192.168.122.254'/>
</dhcp>
</ip>
</network>
virsh # net-dumpxml natnet
<network>
<name>natnet</name>
<uuid>d3c59659-3ceb-4482-a625-1f839a54429c</uuid>
<forward mode='nat'>
<nat>
<port start='1024' end='65535'/>
</nat>
</forward>
<bridge name='virbr1' stp='on' delay='0'/>
<mac address='52:54:00:0a:fc:1d'/>
<ip address='10.0.100.1' netmask='255.255.255.0'>
<dhcp>
<range start='10.0.100.2' end='10.0.100.254'/>
</dhcp>
</ip>
</network>
virsh #
The following rules are generated:
$ sudo pfctl -a '*' -sn
nat-anchor "libvirt/*" all {
nat-anchor "default" all {
nat pass on re0 inet from 192.168.122.0/24 to <natdst> -> (re0) port
1024:65535 round-robin
}
nat-anchor "natnet" all {
nat pass on re0 inet from 10.0.100.0/24 to <natdst> -> (re0) port
1024:65535 round-robin
}
}
$
$ sudo pfctl -a 'libvirt/default' -t natdst -T show
0.0.0.0/0
!192.168.122.0/24
!224.0.0.0/24
!255.255.255.255
$ sudo pfctl -a 'libvirt/natnet' -t natdst -T show
0.0.0.0/0
!10.0.100.0/24
!224.0.0.0/24
!255.255.255.255
$
$ sudo pfctl -a '*' -sr
scrub all fragment reassemble
anchor "libvirt/*" all {
anchor "default" all {
pass quick on virbr0 inet from 192.168.122.0/24 to 192.168.122.0/24
flags S/SA keep state
pass quick on virbr0 inet from 192.168.122.0/24 to 224.0.0.0/24
flags S/SA keep state
pass quick on virbr0 inet from 192.168.122.0/24 to 255.255.255.255
flags S/SA keep state
block drop on virbr0 all
}
anchor "natnet" all {
pass quick on virbr1 inet from 10.0.100.0/24 to 10.0.100.0/24 flags
S/SA keep state
pass quick on virbr1 inet from 10.0.100.0/24 to 224.0.0.0/24 flags
S/SA keep state
pass quick on virbr1 inet from 10.0.100.0/24 to 255.255.255.255
flags S/SA keep state
block drop on virbr1 all
}
}
pass all flags S/SA keep state
$
Create two guests attached to the "default" network, vmA and vmB.
vmA $ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: enp0s4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 52:54:00:67:eb:de brd ff:ff:ff:ff:ff:ff
inet 192.168.122.92/24 brd 192.168.122.255 scope global dynamic noprefixroute enp0s4
valid_lft 1082sec preferred_lft 1082sec
inet6 fe80::5054:ff:fe67:ebde/64 scope link noprefixroute
valid_lft forever preferred_lft forever
vmA $
vmB $ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: enp0s4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 52:54:00:d2:8b:41 brd ff:ff:ff:ff:ff:ff
inet 192.168.122.154/24 metric 100 brd 192.168.122.255 scope global dynamic enp0s4
valid_lft 1040sec preferred_lft 1040sec
inet6 fe80::5054:ff:fed2:8b41/64 scope link
valid_lft forever preferred_lft forever
vmB $
Test NAT rules:
vmA $ ping -c 3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=14.7 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=57 time=10.7 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=57 time=10.1 ms
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2006ms
rtt min/avg/max/mdev = 10.099/11.835/14.710/2.047 ms
vmA $
vmB $ ping -c 3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=15.1 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=57 time=11.0 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=57 time=10.4 ms
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2006ms
rtt min/avg/max/mdev = 10.434/12.198/15.113/2.075 ms
vmB $
vmA $ curl wttr.in/?0Q
Fog
_ - _ - _ - +4(1) °C
_ - _ - _ ↙ 11 km/h
_ - _ - _ - 0 km
0.0 mm
vmA $
vmB $ curl wttr.in/?0Q
Fog
_ - _ - _ - +4(1) °C
_ - _ - _ ↙ 11 km/h
_ - _ - _ - 0 km
0.0 mm
vmB $
Inter-VM connectivity:
vmA $ ping -c 3 192.168.122.154
PING 192.168.122.154 (192.168.122.154) 56(84) bytes of data.
64 bytes from 192.168.122.154: icmp_seq=1 ttl=64 time=0.253 ms
64 bytes from 192.168.122.154: icmp_seq=2 ttl=64 time=0.226 ms
64 bytes from 192.168.122.154: icmp_seq=3 ttl=64 time=0.269 ms
--- 192.168.122.154 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2042ms
rtt min/avg/max/mdev = 0.226/0.249/0.269/0.017 ms
vmA $
vmA $ ssh 192.168.122.154 uname
novel(a)192.168.122.154's password:
Linux
vmA $
Multicast test:
vmA $ iperf -s -u -B 224.0.0.1 -i 1
------------------------------------------------------------
Server listening on UDP port 5001
Joining multicast group 224.0.0.1
Server set to single client traffic mode (per multicast receive)
UDP buffer size: 208 KByte (default)
------------------------------------------------------------
[ 1] local 224.0.0.1 port 5001 connected with 192.168.122.154 port
36963
[ ID] Interval Transfer Bandwidth Jitter Lost/Total
Datagrams
[ 1] 0.00-1.00 sec 131 KBytes 1.07 Mbits/sec 0.030 ms 0/91 (0%)
[ 1] 1.00-2.00 sec 128 KBytes 1.05 Mbits/sec 0.022 ms 0/89 (0%)
[ 1] 2.00-3.00 sec 128 KBytes 1.05 Mbits/sec 0.021 ms 0/89 (0%)
[ 1] 0.00-3.02 sec 389 KBytes 1.06 Mbits/sec 0.026 ms 0/271 (0%)
vmB $ iperf -c 224.0.0.1 -u -T 32 -t 3 -i 1
------------------------------------------------------------
Client connecting to 224.0.0.1, UDP port 5001
Sending 1470 byte datagrams, IPG target: 11215.21 us (kalman adjust)
UDP buffer size: 208 KByte (default)
------------------------------------------------------------
[ 1] local 192.168.122.154 port 36963 connected with 224.0.0.1 port
5001
[ ID] Interval Transfer Bandwidth
[ 1] 0.0000-1.0000 sec 131 KBytes 1.07 Mbits/sec
[ 1] 1.0000-2.0000 sec 128 KBytes 1.05 Mbits/sec
[ 1] 2.0000-3.0000 sec 128 KBytes 1.05 Mbits/sec
[ 1] 0.0000-3.0173 sec 389 KBytes 1.06 Mbits/sec
[ 1] Sent 272 datagrams
vmB $
Broadcast test:
vmA $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=0
net.ipv4.icmp_echo_ignore_broadcasts = 0
vmA $
vmB $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=0
net.ipv4.icmp_echo_ignore_broadcasts = 0
vmB $
host $ ping 192.168.122.255
PING 192.168.122.255 (192.168.122.255): 56 data bytes
64 bytes from 192.168.122.154: icmp_seq=0 ttl=64 time=0.199 ms
64 bytes from 192.168.122.92: icmp_seq=0 ttl=64 time=0.227 ms (DUP!)
64 bytes from 192.168.122.154: icmp_seq=1 ttl=64 time=0.209 ms
64 bytes from 192.168.122.92: icmp_seq=1 ttl=64 time=0.235 ms (DUP!)
^C
--- 192.168.122.255 ping statistics ---
2 packets transmitted, 2 packets received, +2 duplicates, 0.0% packet
loss
round-trip min/avg/max/stddev = 0.199/0.218/0.235/0.014 ms
This testing does not cover any negative scenarios which are probably
not that important at this point.
Roman Bogorodskiy (2):
network: bridge_driver: add BSD implementation
network: introduce Packet Filter firewall backend
meson.build | 2 +
po/POTFILES | 2 +
src/network/bridge_driver_bsd.c | 107 +++++++++
src/network/bridge_driver_conf.c | 8 +
src/network/bridge_driver_linux.c | 2 +
src/network/bridge_driver_platform.c | 2 +
src/network/meson.build | 1 +
src/network/network_pf.c | 327 +++++++++++++++++++++++++++
src/network/network_pf.h | 26 +++
src/util/virfirewall.c | 4 +-
src/util/virfirewall.h | 2 +
11 files changed, 482 insertions(+), 1 deletion(-)
create mode 100644 src/network/bridge_driver_bsd.c
create mode 100644 src/network/network_pf.c
create mode 100644 src/network/network_pf.h
--
2.49.0
1 month, 2 weeks
[libvirt PATCH] docs: clarify how to build without -Werror
by Ján Tomko
From: Ján Tomko <jtomko(a)redhat.com>
--werror does not accept any arguments for me and setting
git_werror was also needed to disable it with git.
Signed-off-by: Ján Tomko <jtomko(a)redhat.com>
---
docs/compiling.rst | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/docs/compiling.rst b/docs/compiling.rst
index 0a47a50569..06a2d53c3a 100644
--- a/docs/compiling.rst
+++ b/docs/compiling.rst
@@ -105,8 +105,8 @@ Notes:
~~~~~~
By default when the ``meson`` is run from within a GIT checkout, it will turn
-on -Werror for builds. This can be disabled with --werror=false, but this is
-not recommended.
+on -Werror for builds. This can be disabled with
+`-Dwerror=false -Dgit_werror=false`, but this is not recommended.
Please ensure that you have the appropriate minimal ``meson`` version installed
in your build environment. The minimal version for a specific package can be
--
2.49.0
1 month, 2 weeks
[PATCH 00/15] virt-aa-helper: Misc improvements
by Michal Privoznik
Inspired by a patchset against virt-aa-helper that I reviewed recently:
https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/QQ...
Green pipeline:
https://gitlab.com/MichalPrivoznik/libvirt/-/pipelines/1866451277
Michal Prívozník (15):
log_cleaner: Use virFileCanonicalizePath()
virt-aa-helper: Use virFileCanonicalizePath()
virpcimock: Automatically invent fakerootdir, if not provided
virpcimock: Strip fakerootdir prefix in virFileCanonicalizePath()
tests: Fix mocking of open()
virt-aa-helper-test: Print errors to stderr
virt-aa-helper-test: Silence ls
virt-aa-helper-test: Test hostdevs unconditionally
virt-aa-helper: Rework USB hostdev handling
virt-aa-helper: Simplify paths collection
virt-aa-helper: Decrease scope of @mem_path in get_files()
virt-aa-helper: Use automatic memory freeing
virt-aa-helper: Check retval of vah_add_file()
virt-aa-helper: Drop cleanup label from get_files()
virt-aa-helper-test: Switch to getopts
src/logging/log_cleaner.c | 2 +-
src/security/virt-aa-helper.c | 474 +++++++++++++++++-----------------
tests/nssmock.c | 4 +
tests/qemusecuritymock.c | 4 +
tests/vircgroupmock.c | 4 +
tests/virfilewrapper.c | 4 +
tests/virpcimock.c | 41 ++-
tests/virt-aa-helper-test | 77 +++---
tests/virtestmock.c | 4 +
tests/virusbmock.c | 4 +
10 files changed, 353 insertions(+), 265 deletions(-)
--
2.49.0
1 month, 2 weeks
