This patch adds API that will allow to use streams to connect to TCP sockets from the point of view of the host. This API is intended to allow remote display (SPICE/VNC) sessions to managed hosts that prefer not to expose the ports to outer networks and without the need to configure TCP tunneling through ssh or firewalls. The API takes the remote hostname and port as arguments and is configurable using flags. The user may specify to use IPv4 or IPv6 using them. --- include/libvirt/libvirt.h.in | 11 ++++++++ src/driver.h | 8 ++++++ src/libvirt.c | 67 ++++++++++++++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 1 + src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 9 +++++- src/remote_protocol-structs | 6 ++++ src/rpc/gendispatch.pl | 1 + 8 files changed, 103 insertions(+), 1 deletion(-) diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index a19f37a..db53de1 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -3730,6 +3730,17 @@ int virConnectIsEncrypted(virConnectPtr conn); int virConnectIsSecure(virConnectPtr conn); int virConnectIsAlive(virConnectPtr conn); +typedef enum { + VIR_NODE_TUNNEL_TCP_IPV4 = (1 << 0), /* use the IPv4 protocol */ + VIR_NODE_TUNNEL_TCP_IPV6 = (1 << 1), /* use the IPv6 protocol */ +} virNodeTunnelTCPFlags; + +int virNodeTunnelTCP(virConnectPtr conn, + virStreamPtr stream, + const char *address, + const char *service, + unsigned int flags); + /* * CPU specification API */ diff --git a/src/driver.h b/src/driver.h index 64d652f..7c3c5b2 100644 --- a/src/driver.h +++ b/src/driver.h @@ -915,6 +915,13 @@ typedef int unsigned long long minimum, unsigned int flags); +typedef int + (*virDrvNodeTunnelTCP)(virConnectPtr conn, + virStreamPtr stream, + const char *address, + const char *service, + unsigned int flags); + /** * _virDriver: * @@ -1107,6 +1114,7 @@ struct _virDriver { virDrvNodeGetCPUMap nodeGetCPUMap; virDrvDomainFSTrim domainFSTrim; virDrvDomainSendProcessSignal domainSendProcessSignal; + virDrvNodeTunnelTCP nodeTunnelTCP; }; typedef int diff --git a/src/libvirt.c b/src/libvirt.c index 4b7baab..c11f020 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -20363,3 +20363,70 @@ error: virDispatchError(dom->conn); return -1; } + +/** + * virNodeTunnelTCP: + * @conn: pointer to the connection object + * @stream: pointer to a stream object + * @address: pointer to a string containing address to connect to + * @service: pointer to a string containing port number or service name + * @flags: bitwise-OR of virNodeTunnelTCPFlags + * + * Creates a TCP connection to the desired host and port and connects + * the virStream to the connection + * + * If @address is NULL the connection is attempted to the "localhost" + * address. + * + * @service may contain a numeric port ID or a service name as in + * /etc/services. + * + * Restrictions: + * This functionality may be disabled in the hypervisor driver. + * Only connections to the host itself may be allowed. + * This functionality may be disabled for readonly connections. + * + * @flags may contain VIR_NODE_TUNNEL_TCP_IPV4 or VIR_NODE_TUNNEL_TCP_IPV6 + * to denote the desired protocol. If none or both of those are specified + * the selected protocol depends on resolution of the host address. + * + * Returns 0 if the connection succeeds; -1 on failure. + */ +int +virNodeTunnelTCP(virConnectPtr conn, + virStreamPtr stream, + const char *address, + const char *service, + unsigned int flags) +{ + int ret = -1; + VIR_DEBUG("conn=%p stream=%p address=(%p)'%s' service=(%p)'%s' flags=%x", + conn, stream, address, NULLSTR(address), + service, NULLSTR(service), flags); + + virCheckNonNullArgGoto(stream, error); + virCheckNonNullArgGoto(service, error); + + virResetLastError(); + + if (!VIR_IS_CONNECT(conn)) { + virLibConnError(VIR_ERR_INVALID_CONN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + if (conn->driver->nodeTunnelTCP) { + ret = conn->driver->nodeTunnelTCP(conn, stream, address, + service, flags); + if (ret < 0) + goto error; + + return ret; + } + + virLibConnError(VIR_ERR_NO_SUPPORT, __FUNCTION__); + +error: + virDispatchError(conn); + return ret; +} diff --git a/src/libvirt_public.syms b/src/libvirt_public.syms index e3d63d3..c8a7f1c 100644 --- a/src/libvirt_public.syms +++ b/src/libvirt_public.syms @@ -578,6 +578,7 @@ LIBVIRT_1.0.1 { global: virDomainFSTrim; virDomainSendProcessSignal; + virNodeTunnelTCP; } LIBVIRT_1.0.0; # .... define new API here using predicted next version number .... diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 5cc7e32..ef96f51 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -6153,6 +6153,7 @@ static virDriver remote_driver = { .nodeGetMemoryParameters = remoteNodeGetMemoryParameters, /* 0.10.2 */ .nodeGetCPUMap = remoteNodeGetCPUMap, /* 1.0.0 */ .domainFSTrim = remoteDomainFSTrim, /* 1.0.1 */ + .nodeTunnelTCP = remoteNodeTunnelTCP, /* 1.0.1 */ }; static virNetworkDriver network_driver = { diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index bdad9f0..0a64d56 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -2696,6 +2696,12 @@ struct remote_domain_fstrim_args { unsigned int flags; }; +struct remote_node_tunnel_tcp_args { + remote_string address; + remote_nonnull_string service; + unsigned int flags; +}; + /*----- Protocol. -----*/ /* Define the program number, protocol version and procedure numbers here. */ @@ -3042,7 +3048,8 @@ enum remote_procedure { REMOTE_PROC_DOMAIN_EVENT_PMSUSPEND_DISK = 292, /* autogen autogen */ REMOTE_PROC_NODE_GET_CPU_MAP = 293, /* skipgen skipgen */ REMOTE_PROC_DOMAIN_FSTRIM = 294, /* autogen autogen */ - REMOTE_PROC_DOMAIN_SEND_PROCESS_SIGNAL = 295 /* autogen autogen */ + REMOTE_PROC_DOMAIN_SEND_PROCESS_SIGNAL = 295, /* autogen autogen */ + REMOTE_PROC_NODE_TUNNEL_TCP = 296 /* autogen autogen | readstream@1 */ /* * Notice how the entries are grouped in sets of 10 ? diff --git a/src/remote_protocol-structs b/src/remote_protocol-structs index e7d05b8..5e04bd3 100644 --- a/src/remote_protocol-structs +++ b/src/remote_protocol-structs @@ -2151,6 +2151,11 @@ struct remote_domain_fstrim_args { uint64_t minimum; u_int flags; }; +struct remote_node_tunnel_tcp_args { + remote_string address; + remote_nonnull_string service; + u_int flags; +}; enum remote_procedure { REMOTE_PROC_OPEN = 1, REMOTE_PROC_CLOSE = 2, @@ -2447,4 +2452,5 @@ enum remote_procedure { REMOTE_PROC_NODE_GET_CPU_MAP = 293, REMOTE_PROC_DOMAIN_FSTRIM = 294, REMOTE_PROC_DOMAIN_SEND_PROCESS_SIGNAL = 295, + REMOTE_PROC_NODE_TUNNEL_TCP = 296, }; diff --git a/src/rpc/gendispatch.pl b/src/rpc/gendispatch.pl index 899f4bc..902acd8 100755 --- a/src/rpc/gendispatch.pl +++ b/src/rpc/gendispatch.pl @@ -45,6 +45,7 @@ sub fixup_name { $name =~ s/Nmi$/NMI/; $name =~ s/Pm/PM/; $name =~ s/Fstrim$/FSTrim/; + $name =~ s/Tcp$/TCP/; return $name; } -- 1.8.0

On 06.12.2012 19:36, Peter Krempa wrote: I believe this wants to be s/errno/err/.

The driver function implemented by this patch checks the configuration if the connection is allowed and opens the connection to the socked using the fdstream handler. --- src/qemu/qemu_driver.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index e099c5c..57145e7 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -14868,6 +14868,50 @@ endjob: cleanup: if (vm) virDomainObjUnlock(vm); + + return ret; +} + +static int +nodeTunnelTCP(virConnectPtr conn, + virStreamPtr stream, + const char *address, + const char *service, + unsigned int flags) +{ + virQEMUDriverPtr driver = conn->privateData; + int config = driver->tunnelTcpRw; + int ret = -1; + + virCheckFlags(VIR_NODE_TUNNEL_TCP_IPV4 | + VIR_NODE_TUNNEL_TCP_IPV6, -1); + + if (conn->flags & VIR_CONNECT_RO) + config = driver->tunnelTcpRo; + + switch (config) { + case QEMU_TCP_TUNNEL_DISABLE: + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("Can't open TCP tunnel: disabled in configuration")); + goto cleanup; + break; + case QEMU_TCP_TUNNEL_LOCAL: + if (address && STRNEQ(address, "localhost")) { + virReportError(VIR_ERR_INVALID_ARG, + _("Tunneling to host '%s' forbidden. " + "Only local connections are allowed"), + address); + goto cleanup; + } + break; + default: + /* ok - can be only reached if enabled */ + break; + } + + ret = virFDStreamConnectTCP(stream, address, service, flags); + +cleanup: return ret; } @@ -15045,6 +15089,7 @@ static virDriver qemuDriver = { .nodeSetMemoryParameters = nodeSetMemoryParameters, /* 0.10.2 */ .nodeGetCPUMap = nodeGetCPUMap, /* 1.0.0 */ .domainFSTrim = qemuDomainFSTrim, /* 1.0.1 */ + .nodeTunnelTCP = nodeTunnelTCP, /* 1.0.1 */ }; -- 1.8.0

This patch adds a "remote netcat" functionality using for example: virsh tcp-console --host localhost --port 1234 --ipv4 --- tools/console.c | 66 ++++++++++++++++++++++++++++------------------------ tools/console.h | 11 ++++----- tools/virsh-domain.c | 18 ++++++++++---- tools/virsh-host.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 114 insertions(+), 41 deletions(-) diff --git a/tools/console.c b/tools/console.c index 40de8eb..e4e4fd7 100644 --- a/tools/console.c +++ b/tools/console.c @@ -325,38 +325,46 @@ vshMakeStdinRaw(struct termios *ttyattr, bool report_errors) return 0; } -int vshRunConsole(virDomainPtr dom, - const char *dev_name, - const char *escape_seq, - unsigned int flags) +int +vshRunConsole(virStreamPtr st, + const char *escape_seq, + bool raw) { int ret = -1; struct termios ttyattr; - void (*old_sigquit)(int); - void (*old_sigterm)(int); - void (*old_sigint)(int); - void (*old_sighup)(int); - void (*old_sigpipe)(int); + void (*old_sigquit)(int) = NULL; + void (*old_sigterm)(int) = NULL; + void (*old_sigint)(int) = NULL; + void (*old_sighup)(int) = NULL; + void (*old_sigpipe)(int) = NULL; virConsolePtr con = NULL; + if (!st) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Invalid stream")); + return -1; + } + /* Put STDIN into raw mode so that stuff typed does not echo to the screen (the TTY reads will result in it being echoed back already), and also ensure Ctrl-C, etc is blocked, and misc other bits */ - if (vshMakeStdinRaw(&ttyattr, true) < 0) + if (raw && vshMakeStdinRaw(&ttyattr, true) < 0) goto resettty; /* Trap all common signals so that we can safely restore the original terminal settings on STDIN before the process exits - people don't like being left with a messed up terminal ! */ - old_sigquit = signal(SIGQUIT, do_signal); - old_sigterm = signal(SIGTERM, do_signal); - old_sigint = signal(SIGINT, do_signal); - old_sighup = signal(SIGHUP, do_signal); - old_sigpipe = signal(SIGPIPE, do_signal); - got_signal = 0; + if (raw) { + old_sigquit = signal(SIGQUIT, do_signal); + old_sigterm = signal(SIGTERM, do_signal); + old_sigint = signal(SIGINT, do_signal); + old_sighup = signal(SIGHUP, do_signal); + old_sigpipe = signal(SIGPIPE, do_signal); + got_signal = 0; + } if (VIR_ALLOC(con) < 0) { virReportOOMError(); @@ -364,13 +372,8 @@ int vshRunConsole(virDomainPtr dom, } con->escapeChar = vshGetEscapeChar(escape_seq); - con->st = virStreamNew(virDomainGetConnect(dom), - VIR_STREAM_NONBLOCK); - if (!con->st) - goto cleanup; - - if (virDomainOpenConsole(dom, dev_name, con->st, flags) < 0) - goto cleanup; + virStreamRef(st); + con->st = st; if (virCondInit(&con->cond) < 0 || virMutexInit(&con->lock) < 0) goto cleanup; @@ -411,17 +414,20 @@ int vshRunConsole(virDomainPtr dom, VIR_FREE(con); } - /* Restore original signal handlers */ - signal(SIGPIPE, old_sigpipe); - signal(SIGHUP, old_sighup); - signal(SIGINT, old_sigint); - signal(SIGTERM, old_sigterm); - signal(SIGQUIT, old_sigquit); + if (raw) { + /* Restore original signal handlers */ + signal(SIGPIPE, old_sigpipe); + signal(SIGHUP, old_sighup); + signal(SIGINT, old_sigint); + signal(SIGTERM, old_sigterm); + signal(SIGQUIT, old_sigquit); + } resettty: /* Put STDIN back into the (sane?) state we found it in before starting */ - tcsetattr(STDIN_FILENO, TCSAFLUSH, &ttyattr); + if (raw) + tcsetattr(STDIN_FILENO, TCSAFLUSH, &ttyattr); return ret; } diff --git a/tools/console.h b/tools/console.h index 962594c..c23acda 100644 --- a/tools/console.h +++ b/tools/console.h @@ -1,9 +1,9 @@ /* * console.c: A dumb serial console client * - * Copyright (C) 2007, 2010 Red Hat, Inc. + * Copyright (C) 2007, 2010, 2012 Red Hat, Inc. * - * This library is free software; you can redistribute it and/or + * This library is free software you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. @@ -24,11 +24,8 @@ # define __VIR_CONSOLE_H__ # ifndef WIN32 - -int vshRunConsole(virDomainPtr dom, - const char *dev_name, - const char *escape_seq, - unsigned int flags); +# include <termios.h> +int vshRunConsole(virStreamPtr st, const char *escape_seq, bool raw); int vshMakeStdinRaw(struct termios *ttyattr, bool report_errors); diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c index 1f7aff7..4a500e6 100644 --- a/tools/virsh-domain.c +++ b/tools/virsh-domain.c @@ -30,7 +30,6 @@ #include <poll.h> #include <signal.h> #include <sys/time.h> -#include <termios.h> #include <libxml/parser.h> #include <libxml/tree.h> @@ -1888,10 +1887,12 @@ static const vshCmdOptDef opts_console[] = { }; static bool -cmdRunConsole(vshControl *ctl, virDomainPtr dom, +cmdRunConsole(vshControl *ctl, + virDomainPtr dom, const char *name, unsigned int flags) { + virStreamPtr st = NULL; bool ret = false; int state; @@ -1906,17 +1907,26 @@ cmdRunConsole(vshControl *ctl, virDomainPtr dom, } if (!isatty(STDIN_FILENO)) { - vshError(ctl, "%s", _("Cannot run interactive console without a controlling TTY")); + vshError(ctl, "%s", _("Cannot run interactive console " + "without a controlling TTY")); goto cleanup; } + if (!(st = virStreamNew(virDomainGetConnect(dom), VIR_STREAM_NONBLOCK))) + goto cleanup; + + if (virDomainOpenConsole(dom, name, st, flags) < 0) + goto cleanup; + vshPrintExtra(ctl, _("Connected to domain %s\n"), virDomainGetName(dom)); vshPrintExtra(ctl, _("Escape character is %s\n"), ctl->escapeChar); fflush(stdout); - if (vshRunConsole(dom, name, ctl->escapeChar, flags) == 0) + if (vshRunConsole(st, ctl->escapeChar, true) == 0) ret = true; cleanup: + if (st) + virStreamFree(st); return ret; } diff --git a/tools/virsh-host.c b/tools/virsh-host.c index 3d13e01..bf2a48f 100644 --- a/tools/virsh-host.c +++ b/tools/virsh-host.c @@ -31,6 +31,7 @@ #include <libxml/xpath.h> #include <libxml/xmlsave.h> +#include "console.h" #include "internal.h" #include "buf.h" #include "memory.h" @@ -1073,6 +1074,64 @@ error: goto cleanup; } +static const vshCmdInfo info_node_tcp_console[] = { + {"help", N_("Connect to a TCP port on the host using a console")}, + {"desc", N_("Connect to a TCP port on the host using a console")}, + {NULL, NULL} +}; + +static const vshCmdOptDef opts_node_tcp_console[] = { + {"port", VSH_OT_DATA, VSH_OFLAG_REQ, N_("port to connect to")}, + {"host", VSH_OT_STRING, VSH_OFLAG_NONE, N_("hostname to connect to")}, + {"ipv4", VSH_OT_BOOL, VSH_OFLAG_NONE, N_("use IPv4")}, + {"ipv6", VSH_OT_BOOL, VSH_OFLAG_NONE, N_("use IPv6")}, + {NULL, 0, 0, NULL} +}; + +static bool +cmdNodeTCPConsole(vshControl *ctl, const vshCmd *cmd) +{ + bool ret = false; + const char *host; + const char *port; + unsigned int flags = 0; + virStreamPtr st = NULL; + + if (vshCommandOptString(cmd, "host", &host) < 0) { + vshError(ctl, "%s", _("Invalid hostname")); + goto cleanup; + } + + if (vshCommandOptString(cmd, "port", &port) < 0) { + vshError(ctl, "%s", _("Invalid port")); + goto cleanup; + } + + if (vshCommandOptBool(cmd, "ipv4")) + flags |= VIR_NODE_TUNNEL_TCP_IPV4; + + if (vshCommandOptBool(cmd, "ipv6")) + flags |= VIR_NODE_TUNNEL_TCP_IPV6; + + if (!(st = virStreamNew(ctl->conn, VIR_STREAM_NONBLOCK))) + goto cleanup; + + if (virNodeTunnelTCP(ctl->conn, st, host, port, flags) < 0) + goto cleanup; + + vshPrintExtra(ctl, _("Connected to host '%s' port '%s'\n"), host, port); + vshPrintExtra(ctl, _("Escape character is %s\n"), ctl->escapeChar); + fflush(stdout); + if (vshRunConsole(st, ctl->escapeChar, false) == 0) + ret = true; + +cleanup: + if (st) + virStreamFree(st); + + return ret; +} + const vshCmdDef hostAndHypervisorCmds[] = { {"capabilities", cmdCapabilities, NULL, info_capabilities, 0}, {"connect", cmdConnect, opts_connect, info_connect, @@ -1094,5 +1153,6 @@ const vshCmdDef hostAndHypervisorCmds[] = { {"sysinfo", cmdSysinfo, NULL, info_sysinfo, 0}, {"uri", cmdURI, NULL, info_uri, 0}, {"version", cmdVersion, opts_version, info_version, 0}, + {"node-tcp-console", cmdNodeTCPConsole, opts_node_tcp_console, info_node_tcp_console, 0}, {NULL, NULL, NULL, NULL, 0} }; -- 1.8.0