March 2007 - Devel - libvirt List Archives

[Libvir] QEMU networking XML docs summary
by Daniel P. Berrange 21 Mar '07

21 Mar '07

What follows is a summary of the ways in which you can setup QEMU networking 1. Userspace SLIRP stack Provides a virtual LAN with NAT to the outside world. The virtual network has DHCP & DNS services and will give the guest VM addresses starting from 10.0.2.15. The default router will be 10.0.2.2 and the DNS server will be 10.0.2.3. This networking is the only option for unprivileged users who need their VMS to have outgoing access. Example configs are: <interface type='user'/> <interface type='user'> <mac address="11:22:33:44:55:66:/> </interface> 2. Virtual network Provides a virtual network using a bridge device in the host. Depending on the virtual network configuration, the network may be totally isolated, NAT'ing to aan explicit network device, or NAT'ing to the default route. DHCP and DNS are provided on the virtual network in all cases and the IP range can be determined by examining the virtual network config with 'virsh net-dumpxml <network name>'. There is one virtual network called 'default' setup out of the box which does NAT'ing to the default route and has an IP range of 192.168.22.0/255.255.255.0. Each guest will have an associated tun device created with a name of vnetN, which can also be overriden with the <target> element. Example configs are <interface type='network'> <source network='default'/> </interface> <interface type='network'> <source network='default'/> <target dev='vnet7'/> <mac address="11:22:33:44:55:66:/> </interface> 3. Bridge to to LAN Provides a bridge from the VM directly onto the LAN. This assumes there is a bridge device on the host which has one or more of the hosts physical NICs enslaved. The guest VM will have an associated tun device created with a name of vnetN, which can also be overriden with the <target> element. The tun device will be enslaved to the bridge. The IP range / network configuration is whatever is used on the LAN. This provides the guest VM full incoming & outgoing net access just like a physical machine. Examples include <interface type='bridge'> <source dev='br0'/> </interface> <interface type='bridge'> <source dev='br0'/> <target dev='vnet7'/> <mac address="11:22:33:44:55:66:/> </interface> 4. Generic connection to LAN Provides a means for the administrator to execute an arbitrary script to connect the guest's network to the LAN. The guest will have a tun device created with a name of vnetN, which can also be overriden with the <target> element. After creating the tun device a shell script will be run which is expected to do whatever host network integration is required. By default this script is called /etc/qemu-ifup but can be overriden. <interface type='ethernet'/> <interface type='ethernet'> <target dev='vnet7'/> <script path='/etc/qemu-ifup-mynet'/> </interface> 5. Multicast tunnel A multicast group is setup to represent a virtual network. Any VMs whose network devices are in the same multicast group can talk to each other even across hosts. This mode is also available to unprivileged users. There is no default DNS or DHCP support and no outgoing network access. To provide outgoing network access, one of the VMs should have a 2nd NIC which is connected to one of the first 4 network types and do the appropriate routing. The multicast protocol is compatible with that used by user mode linux guests too. The source address used must be from the multicast address block <interface type='mcast'> <source address='230.0.0.1' port='5558'/> </interface> 6. TCP tunnel A TCP client/server architecture provides a virtual network. One VM provides the server end of the netowrk, all other VMS are configured as clients. All network traffic is routed between the VMs via the server. This mode is also available to unprivileged users. There is no default DNS or DHCP support and no outgoing network access. To provide outgoing network access, one of the VMs should have a 2nd NIC which is connected to one of the first 4 network types and do the appropriate routing. Example server config <interface type='server'> <source address='192.168.0.1' port='5558'/> </interface> Example client config <interface type='client'> <source address='192.168.0.1' port='5558'/> </interface> NB, options 2 -> 4 are also supported by Xen VMs, so it is possible to use these configs to have networking with both Xen & QEMU/KVMs connected to each other. Regards, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

2 2

[Libvir] Persistence / re-instate of iptables rules
by Daniel P. Berrange 21 Mar '07

21 Mar '07

With the virtual networking capability we have to add various rules to the iptables chains to ensure that outgoing connections are forwarded + NATed to the physical LAN. Now if the user does 'service iptables restart' these rules are lost until you restart the VM. This obviously sucks. We've been exploring the possibility of adapting the Fedora / RHEL iptables scripts to allow user-defined chains which are automatically restored from a 'safe' config file during a restart. This is not present in FC6 / RHEL5 or even F6 yet, nor does it help non-Fedora userrs. We already have ability to add / remove rules from iptables, so I was wondering how hard it would be to list existing rules. From whence we can look at existing rules to see if our virtual network forwarding/NAT rules were missing. The idea being that a simple 'killall -SIGHUP libvirt_qemud' could trigger libvirt to check & re-add the iptables rules if missing. Regards, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

2 1

Re: [Libvir] [patch 4/5] iptables: maintain rules in memory even when not writing to disk
by Daniel Veillard 21 Mar '07

21 Mar '07

On Wed, Mar 21, 2007 at 12:48:01PM +0000, Mark McLoughlin wrote: > Re-factor things a little for the next patch so that we maintain > the rules in memory even when we're not going to write them to > disk. [...] > if (!(r = (char **)realloc(rules->rules, sizeof(char *) * (rules->nrules+1)))) > return ENOMEM; Seems the rules tab is zeroed, but when you extend it you don't zeroe the new part of the array, but it may not give problem in practice (or a very hard one to track down ;-) Daniel -- Red Hat Virtualization group http://redhat.com/virtualization/ Daniel Veillard | virtualization library http://libvirt.org/ veillard(a)redhat.com | libxml GNOME XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/

2 1

Re: [Libvir] [patch 2/5] iptables: use calloc() instead of malloc()/memset()
by Daniel Veillard 21 Mar '07

21 Mar '07

On Wed, Mar 21, 2007 at 12:47:59PM +0000, Mark McLoughlin wrote: > Replace a few instances of malloc() followed by memset(0) with > calloc() Humpf, that's just the opposite of the other parts of libvirt I wrote. Could you justify ? It's hard to catch it's a calloc or a malloc call, and hence notice if it was initialized or not. The extra memset line makes it clear, plus it will allow me more easilly to plug in libxml2 memory wrapper. I doubt the patch is related to other parts needed for the restart code it's just coding policy and IMHO different from teh rest of libvirt. Daniel -- Red Hat Virtualization group http://redhat.com/virtualization/ Daniel Veillard | virtualization library http://libvirt.org/ veillard(a)redhat.com | libxml GNOME XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/

2 1

[Libvir] [patch 5/5] iptables: reload rules on SIGHUP
by Mark McLoughlin 21 Mar '07

21 Mar '07

As suggested by danpb, make libvirt_qemud handle SIGHUP by re-loading the iptables rules. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/qemud/iptables.c =================================================================== --- libvirt.orig/qemud/iptables.c +++ libvirt/qemud/iptables.c @@ -36,6 +36,8 @@ #include <sys/stat.h> #include <sys/wait.h> +#include "internal.h" + enum { ADD = 0, REMOVE @@ -48,11 +50,18 @@ enum { typedef struct { + char *rule; + char **argv; + int flipflop; +} iptRule; + +typedef struct +{ char *table; char *chain; - int nrules; - char **rules; + int nrules; + iptRule *rules; #ifdef IPTABLES_DIR @@ -73,7 +82,7 @@ struct _iptablesContext #ifdef IPTABLES_DIR static int writeRules(const char *path, - char * const *rules, + const iptRules *rules, int nrules) { char tmp[PATH_MAX]; @@ -96,7 +105,7 @@ writeRules(const char *path, } for (i = 0; i < nrules; i++) { - if (fputs(rules[i], f) == EOF || + if (fputs(rules[i].rule, f) == EOF || fputc('\n', f) == EOF) { fclose(f); if (istmp) @@ -173,19 +182,43 @@ buildPath(const char *table, } #endif /* IPTABLES_DIR */ -static int -iptRulesAppend(iptRules *rules, - const char *rule) +static void +iptRuleFree(iptRule *rule) { - char **r; + if (rule->rule) + free(rule->rule); + rule->rule = NULL; + + if (rule->argv) { + int i = 0; + while (rule->argv[i]) + free(rule->argv[i++]); + free(rule->argv); + rule->argv = NULL; + } +} - if (!(r = (char **)realloc(rules->rules, sizeof(char *) * (rules->nrules+1)))) +static int +iptRulesAppend(iptRules *rules, + char *rule, + char **argv, + int flipflop) +{ + iptRule *r; + + if (!(r = (iptRule *)realloc(rules->rules, sizeof(iptRule) * (rules->nrules+1)))) { + int i = 0; + while (argv[i]) + free(argv[i++]); + free(argv); return ENOMEM; + } rules->rules = r; - if (!(rules->rules[rules->nrules] = strdup(rule))) - return ENOMEM; + rules->rules[rules->nrules].rule = rule; + rules->rules[rules->nrules].argv = argv; + rules->rules[rules->nrules].flipflop = flipflop; rules->nrules++; @@ -211,17 +244,17 @@ iptRulesRemove(iptRules *rules, int i; for (i = 0; i < rules->nrules; i++) - if (!strcmp(rules->rules[i], strdup(rule))) + if (!strcmp(rules->rules[i].rule, strdup(rule))) break; if (i >= rules->nrules) return EINVAL; - free(rules->rules[i]); + iptRuleFree(&rules->rules[i]); memmove(&rules->rules[i], &rules->rules[i+1], - (rules->nrules - i - 1) * sizeof (char *)); + (rules->nrules - i - 1) * sizeof (iptRule)); rules->nrules--; @@ -253,16 +286,14 @@ iptRulesFree(iptRules *rules) } - for (i = 0; i < rules->nrules; i++) { - free(rules->rules[i]); - rules->rules[i] = NULL; - } - - rules->nrules = 0; - if (rules->rules) { + for (i = 0; i < rules->nrules; i++) + iptRuleFree(&rules->rules[i]); + free(rules->rules); rules->rules = NULL; + + rules->nrules = 0; } #ifdef IPTABLES_DIR @@ -480,10 +511,13 @@ iptablesAddRemoveRule(iptRules *rules, i (retval = iptablesAddRemoveChain(rules, action))) goto error; - if (action == ADD) - retval = iptRulesAppend(rules, rule); - else + if (action == ADD) { + retval = iptRulesAppend(rules, rule, argv, flipflop); + rule = NULL; + argv = NULL; + } else { retval = iptRulesRemove(rules, rule); + } error: if (rule) @@ -535,6 +569,45 @@ iptablesContextFree(iptablesContext *ctx free(ctx); } +static void +iptRulesReload(iptRules *rules) +{ + int i; + int retval; + + for (i = 0; i < rules->nrules; i++) { + iptRule *rule = &rules->rules[i]; + char *orig; + + orig = rule->argv[rule->flipflop]; + rule->argv[rule->flipflop] = (char *) "--delete"; + + if ((retval = iptablesSpawn(WITH_ERRORS, rule->argv))) + qemudLog(QEMUD_WARN, "Failed to remove iptables rule '%s' from chain '%s' in table '%s': %s", + rule->rule, rules->chain, rules->table, strerror(errno)); + + rule->argv[rule->flipflop] = orig; + } + + if ((retval = iptablesAddRemoveChain(rules, REMOVE)) || + (retval = iptablesAddRemoveChain(rules, ADD))) + qemudLog(QEMUD_WARN, "Failed to re-create chain '%s' in table '%s': %s", + rules->chain, rules->table, strerror(retval)); + + for (i = 0; i < rules->nrules; i++) + if ((retval = iptablesSpawn(WITH_ERRORS, rules->rules[i].argv))) + qemudLog(QEMUD_WARN, "Failed to add iptables rule '%s' to chain '%s' in table '%s': %s", + rules->rules[i].rule, rules->chain, rules->table, strerror(retval)); +} + +void +iptablesReloadRules(iptablesContext *ctx) +{ + iptRulesReload(ctx->input_filter); + iptRulesReload(ctx->forward_filter); + iptRulesReload(ctx->nat_postrouting); +} + static int iptablesInput(iptablesContext *ctx, const char *iface, Index: libvirt/qemud/iptables.h =================================================================== --- libvirt.orig/qemud/iptables.h +++ libvirt/qemud/iptables.h @@ -27,6 +27,8 @@ typedef struct _iptablesContext iptables iptablesContext *iptablesContextNew (void); void iptablesContextFree (iptablesContext *ctx); +void iptablesReloadRules (iptablesContext *ctx); + int iptablesAddTcpInput (iptablesContext *ctx, const char *iface, int port); Index: libvirt/qemud/qemud.c =================================================================== --- libvirt.orig/qemud/qemud.c +++ libvirt/qemud/qemud.c @@ -88,6 +88,11 @@ static int qemudDispatchSignal(struct qe case SIGHUP: qemudLog(QEMUD_INFO, "Reloading configuration on SIGHUP"); ret = qemudScanConfigs(server); + + if (server->iptables) { + qemudLog(QEMUD_INFO, "Reloading iptables rules"); + iptablesReloadRules(server->iptables); + } break; case SIGINT: --

1 0

[Libvir] [patch 4/5] iptables: maintain rules in memory even when not writing to disk
by Mark McLoughlin 21 Mar '07

21 Mar '07

Re-factor things a little for the next patch so that we maintain the rules in memory even when we're not going to write them to disk. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/qemud/iptables.c =================================================================== --- libvirt.orig/qemud/iptables.c +++ libvirt/qemud/iptables.c @@ -51,14 +51,14 @@ typedef struct char *table; char *chain; + int nrules; + char **rules; + #ifdef IPTABLES_DIR char dir[PATH_MAX]; char path[PATH_MAX]; - int nrules; - char **rules; - #endif /* IPTABLES_DIR */ } iptRules; @@ -171,13 +171,13 @@ buildPath(const char *table, else return 0; } +#endif /* IPTABLES_DIR */ static int iptRulesAppend(iptRules *rules, const char *rule) { char **r; - int err; if (!(r = (char **)realloc(rules->rules, sizeof(char *) * (rules->nrules+1)))) return ENOMEM; @@ -189,24 +189,29 @@ iptRulesAppend(iptRules *rules, rules->nrules++; - if ((err = ensureDir(rules->dir))) - return err; +#ifdef IPTABLES_DIR + { + int err; - if ((err = writeRules(rules->path, rules->rules, rules->nrules))) - return err; + if ((err = ensureDir(rules->dir))) + return err; + + if ((err = writeRules(rules->path, rules->rules, rules->nrules))) + return err; + } +#endif /* IPTABLES_DIR */ return 0; } static int iptRulesRemove(iptRules *rules, - const char *rule) + char *rule) { int i; - int err; for (i = 0; i < rules->nrules; i++) - if (!strcmp(rules->rules[i], rule)) + if (!strcmp(rules->rules[i], strdup(rule))) break; if (i >= rules->nrules) @@ -220,16 +225,23 @@ iptRulesRemove(iptRules *rules, rules->nrules--; - if ((err = writeRules(rules->path, rules->rules, rules->nrules))) - return err; +#ifdef IPTABLES_DIR + { + int err; + + if ((err = writeRules(rules->path, rules->rules, rules->nrules))) + return err; + } +#endif /* IPTABLES_DIR */ return 0; } -#endif /* IPTABLES_DIR */ static void iptRulesFree(iptRules *rules) { + int i; + if (rules->table) { free(rules->table); rules->table = NULL; @@ -240,25 +252,22 @@ iptRulesFree(iptRules *rules) rules->chain = NULL; } -#ifdef IPTABLES_DIR - { - int i; - rules->dir[0] = '\0'; - rules->path[0] = '\0'; - - for (i = 0; i < rules->nrules; i++) { - free(rules->rules[i]); - rules->rules[i] = NULL; - } + for (i = 0; i < rules->nrules; i++) { + free(rules->rules[i]); + rules->rules[i] = NULL; + } - rules->nrules = 0; + rules->nrules = 0; - if (rules->rules) { - free(rules->rules); - rules->rules = NULL; - } + if (rules->rules) { + free(rules->rules); + rules->rules = NULL; } + +#ifdef IPTABLES_DIR + rules->dir[0] = '\0'; + rules->path[0] = '\0'; #endif /* IPTABLES_DIR */ free(rules); @@ -279,15 +288,15 @@ iptRulesNew(const char *table, if (!(rules->chain = strdup(chain))) goto error; + rules->rules = NULL; + rules->nrules = 0; + #ifdef IPTABLES_DIR if (buildDir(table, rules->dir, sizeof(rules->dir))) goto error; if (buildPath(table, chain, rules->path, sizeof(rules->path))) goto error; - - rules->rules = NULL; - rules->nrules = 0; #endif /* IPTABLES_DIR */ return rules; @@ -464,12 +473,10 @@ iptablesAddRemoveRule(iptRules *rules, i (retval = iptablesAddRemoveChain(rules, action))) goto error; -#ifdef IPTABLES_DIR if (action == ADD) retval = iptRulesAppend(rules, rule); else retval = iptRulesRemove(rules, rule); -#endif /* IPTABLES_DIR */ error: if (rule) --

1 0

[Libvir] [patch 3/5] iptables: fix iptablesPhysdevForward()
by Mark McLoughlin 21 Mar '07

21 Mar '07

Remove the target interface parameter from iptablesPhysdevForward(). This rule is intended to allow frames to be forwarded across the bridge from the supplied bridge port. In this context, the --out parameter would match the outgoing bridge port, which will never be network->def->forwardDev. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/qemud/iptables.c =================================================================== --- libvirt.orig/qemud/iptables.c +++ libvirt/qemud/iptables.c @@ -577,41 +577,28 @@ iptablesRemoveUdpInput(iptablesContext * static int iptablesPhysdevForward(iptablesContext *ctx, const char *iface, - const char *target, int action) { - if (target && target[0]) { - return iptablesAddRemoveRule(ctx->forward_filter, - action, - "--match", "physdev", - "--physdev-in", iface, - "--out", target, - "--jump", "ACCEPT", - NULL); - } else { - return iptablesAddRemoveRule(ctx->forward_filter, - action, - "--match", "physdev", - "--physdev-in", iface, - "--jump", "ACCEPT", - NULL); - } + return iptablesAddRemoveRule(ctx->forward_filter, + action, + "--match", "physdev", + "--physdev-in", iface, + "--jump", "ACCEPT", + NULL); } int iptablesAddPhysdevForward(iptablesContext *ctx, - const char *iface, - const char *target) + const char *iface) { - return iptablesPhysdevForward(ctx, iface, target, ADD); + return iptablesPhysdevForward(ctx, iface, ADD); } int iptablesRemovePhysdevForward(iptablesContext *ctx, - const char *iface, - const char *target) + const char *iface) { - return iptablesPhysdevForward(ctx, iface, target, REMOVE); + return iptablesPhysdevForward(ctx, iface, REMOVE); } static int Index: libvirt/qemud/iptables.h =================================================================== --- libvirt.orig/qemud/iptables.h +++ libvirt/qemud/iptables.h @@ -42,11 +42,9 @@ int iptablesRemoveUdpInput int port); int iptablesAddPhysdevForward (iptablesContext *ctx, - const char *iface, - const char *target); + const char *iface); int iptablesRemovePhysdevForward (iptablesContext *ctx, - const char *iface, - const char *target); + const char *iface); int iptablesAddInterfaceForward (iptablesContext *ctx, const char *iface, Index: libvirt/qemud/conf.c =================================================================== --- libvirt.orig/qemud/conf.c +++ libvirt/qemud/conf.c @@ -1128,7 +1128,7 @@ qemudNetworkIfaceConnect(struct qemud_se } if (net->type == QEMUD_NET_NETWORK && network->def->forward) { - if ((err = iptablesAddPhysdevForward(server->iptables, ifname, network->def->forwardDev))) { + if ((err = iptablesAddPhysdevForward(server->iptables, ifname))) { qemudReportError(server, VIR_ERR_INTERNAL_ERROR, "Failed to add iptables rule to allow bridging from '%s' :%s", ifname, strerror(err)); @@ -1152,7 +1152,7 @@ qemudNetworkIfaceConnect(struct qemud_se no_memory: if (net->type == QEMUD_NET_NETWORK && network->def->forward) - iptablesRemovePhysdevForward(server->iptables, ifname, network->def->forwardDev); + iptablesRemovePhysdevForward(server->iptables, ifname); qemudReportError(server, VIR_ERR_NO_MEMORY, "tapfds"); error: if (retval) Index: libvirt/qemud/qemud.c =================================================================== --- libvirt.orig/qemud/qemud.c +++ libvirt/qemud/qemud.c @@ -1042,8 +1042,7 @@ qemudNetworkIfaceDisconnect(struct qemud return; } - if (network->def->forward) - iptablesRemovePhysdevForward(server->iptables, net->dst.network.ifname, network->def->forwardDev); + iptablesRemovePhysdevForward(server->iptables, net->dst.network.ifname); } int qemudShutdownVMDaemon(struct qemud_server *server, struct qemud_vm *vm) { @@ -1242,83 +1241,87 @@ qemudAddIptablesRules(struct qemud_serve } /* allow bridging from the bridge interface itself */ - if ((err = iptablesAddPhysdevForward(server->iptables, network->bridge, network->def->forwardDev))) { + if ((err = iptablesAddPhysdevForward(server->iptables, network->bridge))) { qemudReportError(server, VIR_ERR_INTERNAL_ERROR, "failed to add iptables rule to allow bridging from '%s' : %s\n", network->bridge, strerror(err)); goto err1; } - /* allow forwarding packets from the bridge interface */ - if ((err = iptablesAddInterfaceForward(server->iptables, network->bridge, network->def->forwardDev))) { + /* allow DHCP requests through to dnsmasq */ + if ((err = iptablesAddTcpInput(server->iptables, network->bridge, 67))) { qemudReportError(server, VIR_ERR_INTERNAL_ERROR, - "failed to add iptables rule to allow forwarding from '%s' : %s\n", + "failed to add iptables rule to allow DHCP requests from '%s' : %s\n", network->bridge, strerror(err)); goto err2; } - /* allow forwarding packets to the bridge interface if they are part of an existing connection */ - if ((err = iptablesAddStateForward(server->iptables, network->bridge, network->def->forwardDev))) { + if ((err = iptablesAddUdpInput(server->iptables, network->bridge, 67))) { qemudReportError(server, VIR_ERR_INTERNAL_ERROR, - "failed to add iptables rule to allow forwarding to '%s' : %s\n", + "failed to add iptables rule to allow DHCP requests from '%s' : %s\n", network->bridge, strerror(err)); goto err3; } - /* enable masquerading */ - if ((err = iptablesAddNonBridgedMasq(server->iptables, network->def->forwardDev))) { + /* allow DNS requests through to dnsmasq */ + if ((err = iptablesAddTcpInput(server->iptables, network->bridge, 53))) { qemudReportError(server, VIR_ERR_INTERNAL_ERROR, - "failed to add iptables rule to enable masquerading : %s\n", - strerror(err)); + "failed to add iptables rule to allow DNS requests from '%s' : %s\n", + network->bridge, strerror(err)); goto err4; } - /* allow DHCP requests through to dnsmasq */ - if ((err = iptablesAddTcpInput(server->iptables, network->bridge, 67))) { + if ((err = iptablesAddUdpInput(server->iptables, network->bridge, 53))) { qemudReportError(server, VIR_ERR_INTERNAL_ERROR, - "failed to add iptables rule to allow DHCP requests from '%s' : %s\n", + "failed to add iptables rule to allow DNS requests from '%s' : %s\n", network->bridge, strerror(err)); goto err5; } - if ((err = iptablesAddUdpInput(server->iptables, network->bridge, 67))) { + /* The remaining rules are only needed for IP forwarding */ + if (!network->def->forward) + return 1; + + /* allow forwarding packets from the bridge interface */ + if ((err = iptablesAddInterfaceForward(server->iptables, network->bridge, network->def->forwardDev))) { qemudReportError(server, VIR_ERR_INTERNAL_ERROR, - "failed to add iptables rule to allow DHCP requests from '%s' : %s\n", + "failed to add iptables rule to allow forwarding from '%s' : %s\n", network->bridge, strerror(err)); goto err6; } - /* allow DNS requests through to dnsmasq */ - if ((err = iptablesAddTcpInput(server->iptables, network->bridge, 53))) { + /* allow forwarding packets to the bridge interface if they are part of an existing connection */ + if ((err = iptablesAddStateForward(server->iptables, network->bridge, network->def->forwardDev))) { qemudReportError(server, VIR_ERR_INTERNAL_ERROR, - "failed to add iptables rule to allow DNS requests from '%s' : %s\n", + "failed to add iptables rule to allow forwarding to '%s' : %s\n", network->bridge, strerror(err)); goto err7; } - if ((err = iptablesAddUdpInput(server->iptables, network->bridge, 53))) { + /* enable masquerading */ + if ((err = iptablesAddNonBridgedMasq(server->iptables, network->def->forwardDev))) { qemudReportError(server, VIR_ERR_INTERNAL_ERROR, - "failed to add iptables rule to allow DNS requests from '%s' : %s\n", - network->bridge, strerror(err)); + "failed to add iptables rule to enable masquerading : %s\n", + strerror(err)); goto err8; } return 1; err8: - iptablesRemoveTcpInput(server->iptables, network->bridge, 53); + iptablesRemoveStateForward(server->iptables, network->bridge, network->def->forwardDev); err7: - iptablesRemoveUdpInput(server->iptables, network->bridge, 67); + iptablesRemoveInterfaceForward(server->iptables, network->bridge, network->def->forwardDev); err6: - iptablesRemoveTcpInput(server->iptables, network->bridge, 67); + iptablesRemoveUdpInput(server->iptables, network->bridge, 53); err5: - iptablesRemoveNonBridgedMasq(server->iptables, network->def->forwardDev); + iptablesRemoveTcpInput(server->iptables, network->bridge, 53); err4: - iptablesRemoveStateForward(server->iptables, network->bridge, network->def->forwardDev); + iptablesRemoveUdpInput(server->iptables, network->bridge, 67); err3: - iptablesRemoveInterfaceForward(server->iptables, network->bridge, network->def->forwardDev); + iptablesRemoveTcpInput(server->iptables, network->bridge, 67); err2: - iptablesRemovePhysdevForward(server->iptables, network->bridge, network->def->forwardDev); + iptablesRemovePhysdevForward(server->iptables, network->bridge); err1: return 0; } @@ -1327,15 +1330,15 @@ static void qemudRemoveIptablesRules(struct qemud_server *server, struct qemud_network *network) { if (network->def->forward) { - iptablesRemoveUdpInput(server->iptables, network->bridge, 53); - iptablesRemoveTcpInput(server->iptables, network->bridge, 53); - iptablesRemoveUdpInput(server->iptables, network->bridge, 67); - iptablesRemoveTcpInput(server->iptables, network->bridge, 67); iptablesRemoveNonBridgedMasq(server->iptables, network->def->forwardDev); iptablesRemoveStateForward(server->iptables, network->bridge, network->def->forwardDev); iptablesRemoveInterfaceForward(server->iptables, network->bridge, network->def->forwardDev); - iptablesRemovePhysdevForward(server->iptables, network->bridge, network->def->forwardDev); } + iptablesRemoveUdpInput(server->iptables, network->bridge, 53); + iptablesRemoveTcpInput(server->iptables, network->bridge, 53); + iptablesRemoveUdpInput(server->iptables, network->bridge, 67); + iptablesRemoveTcpInput(server->iptables, network->bridge, 67); + iptablesRemovePhysdevForward(server->iptables, network->bridge); } static int @@ -1412,8 +1415,7 @@ int qemudStartNetworkDaemon(struct qemud goto err_delbr; } - if (network->def->forward && - !qemudAddIptablesRules(server, network)) + if (!qemudAddIptablesRules(server, network)) goto err_delbr1; if (network->def->forward && --

1 0

[Libvir] [patch 2/5] iptables: use calloc() instead of malloc()/memset()
by Mark McLoughlin 21 Mar '07

21 Mar '07

Replace a few instances of malloc() followed by memset(0) with calloc() Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/qemud/iptables.c =================================================================== --- libvirt.orig/qemud/iptables.c +++ libvirt/qemud/iptables.c @@ -270,11 +270,9 @@ iptRulesNew(const char *table, { iptRules *rules; - if (!(rules = (iptRules *)malloc(sizeof (iptRules)))) + if (!(rules = (iptRules *)calloc(1, sizeof (iptRules)))) return NULL; - memset (rules, 0, sizeof (iptRules)); - if (!(rules->table = strdup(table))) goto error; @@ -353,11 +351,9 @@ iptablesAddRemoveChain(iptRules *rules, 2 + /* --table foo */ 2; /* --new-chain bar */ - if (!(argv = (char **)malloc(sizeof(char *) * (n+1)))) + if (!(argv = (char **)calloc(n + 1, sizeof(char *)))) goto error; - memset(argv, 0, sizeof(char *) * (n + 1)); - n = 0; if (!(argv[n++] = strdup(IPTABLES_PATH))) @@ -413,14 +409,12 @@ iptablesAddRemoveRule(iptRules *rules, i va_end(args); - if (!(argv = (char **)malloc(sizeof(char *) * (n + 1)))) + if (!(argv = (char **)calloc(n + 1, sizeof(char *)))) goto error; if (!(rule = (char *)malloc(rulelen))) goto error; - memset(argv, 0, sizeof(char *) * (n + 1)); - n = 0; if (!(argv[n++] = strdup(IPTABLES_PATH))) --

1 0

[Libvir] [patch 1/5] iptables: fix invalid free
by Mark McLoughlin 21 Mar '07

21 Mar '07

In iptablesContextNew(), make sure we don't try and free an invalid pointer if one of the iptRulesNew() fails. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/qemud/iptables.c =================================================================== --- libvirt.orig/qemud/iptables.c +++ libvirt/qemud/iptables.c @@ -496,7 +496,7 @@ iptablesContextNew(void) { iptablesContext *ctx; - if (!(ctx = (iptablesContext *) malloc(sizeof (iptablesContext)))) + if (!(ctx = (iptablesContext *) calloc(1, sizeof (iptablesContext)))) return NULL; if (!(ctx->input_filter = iptRulesNew("filter", IPTABLES_PREFIX "INPUT"))) @@ -518,9 +518,12 @@ iptablesContextNew(void) void iptablesContextFree(iptablesContext *ctx) { - iptRulesFree(ctx->input_filter); - iptRulesFree(ctx->forward_filter); - iptRulesFree(ctx->nat_postrouting); + if (ctx->input_filter) + iptRulesFree(ctx->input_filter); + if (ctx->forward_filter) + iptRulesFree(ctx->forward_filter); + if (ctx->nat_postrouting) + iptRulesFree(ctx->nat_postrouting); free(ctx); } --

1 0

[Libvir] [patch 0/5] Misc. fixes to iptables support
by Mark McLoughlin 21 Mar '07

21 Mar '07

Hey, What follows is a few misc patches for qemud's iptables support. The main point is to add reload-on-HUP as suggested by danpb. Comments welcome .. Cheers, Mark. --

1 0

[Libvir] A whole tonne of networking fixes / enhancements
by Daniel P. Berrange 21 Mar '07

21 Mar '07

I've been testing the networking support and found various bugs / missing features that I thought we really need to have in the release - some of them impact the XML so we have to get this right now. - Build up in memory linked-list of network devices & disk devices in same order as they are listed in XML. Currently they are built up in reversed order, which makes the XML not be idempotent, and also means that if you have multiple NICs, what you think is eth0 ends up being eth4 and what you think is eth4 is eth0. This patch fixes the ordering to match XML. - Set the 'vlan' attribute in command line args to QEMU. This ensures that separate network devices are in fact separated. Previously if you had multiple NICs, QEMU connected them all to the same VLAN so any traffic on one NIC got sent to all NICs. Most definitely not what you want in any usual scenario, and created a traffic storm from the resultant network loops ! - Added support for networking of type='bridge'. This gives parity with equivalent Xen networking, eg <interface type='bridge'> <source dev='xenbr0'/> <target dev='vnet3'/> </interface> Will create a tap device called vnet3 and bridge it into xenbr0 - Added support for networking of type='ethernet'. This give parity with equivlent Xen networking, eg <interface type='ethernet'> <script path='/etc/qemu-ifup'/> <target dev='vnet5'/> </interface> Will create a tap device called vnet5 and run 'qemu-ifup' to setup its configuration. Think the various non-bridge Xen networking configs. - Added support for 'client', 'server', 'mcast' networking types. These are QEMU specific types, allowing unprivileged (or privileged) users to create virtual networks without TAP devices. eg two machines, one with <interface type='server'> <source address="127.0.0.1" port="5555"/> </interface> And the other with <interface type='client'> <source address="127.0.0.1" port="5555"/> </interface> Or both using multicast: <interface type='mcast'> <source address="230.0.0.1" port="5558"/> </interface> Both these options allow QEMU instancs on different physical machines to talk to each other. The multicast protocol is also compatible with the UserModeLinux multicast protocol. - Fix the 'type=network' config use the <target dev='vnet3'> element instead of a custom tapifname=vnet3 attribute - this gives consistent way to name tap devices that - most importantly - matches the Xen XML format for specifying vifname, eg <interface type='network'> <source network='default'/> <target dev='vnet2'/> </interface> Will create a tapdevice called vnet2 and connect it to the bridge device associated with the network 'default'. - Removed references to 'vde' - we're not using this explicitly - at some time in the future, we'll perhaps use VDE for doing virtual networking for unprivileged users where bridge devices are not available - Removed references to 'tap' network type - this is basically handled by the 'ethernet' network type to give XML compatability with the same functionality in the Xen backend. - The virtual network configuration currently always adds whole bunch of IPTables rules to the FORWARD/POSTROUTING chain which allow traffic from the virtual network to be masqueraded out through any active physical interface. This may be correct thing todo for the default network, but we also need the ability to create totally isolated networks (no forwarding at all), or directed networks (eg forwarding to an explicit physical device). To deal with this scenario I introduce a new element in the network XML called '<forward>'. If this is not present, then no forwarding rules are added at all. If it is present, but with no attributes then a generic rule allowing forwarding to any interface is added. If it is present and the 'dev' attribute is specific then forwarding is only allowed to that named interface. The default network XML thus now includes <forward/> So that by default we have a virtual network connected to all physical devices. - MAC addreses were not be autogenerated inside libvirt_qemud. If you don't provide a MAC address, QEMU (insanely) uses a hardcoded default. So all NICs end up with an identical MAC. We now always autogenerate a MAC address if not explicitly listed in XML. One final thing to be aware of - the Fedora Core 6 Xen kernel currently has totally fubar TCP checksum offland. So if you try to bridge a Xen guest into the libvirt virtual networking, it'll fail to get a DHCP address from dnsmasq. Even if you fix that by turning off TX checksums in Dom0, you'll get checksum failures for the actual TCP data transmission too. The only solution is to either upgrade the Dom0 kernel to a RHEL-5 vintage, or to also turn off checksumming in the guest. A new FC6 xen kernel is in the works which should hopefully fix this for real. With fixed kernel, I can easily setup virtual networks connecting both Xen PV, Xen FV and QEMU instances together. Anyway, the upshot of all this, is that we can now trivially create really complicated & fun networking layouts across QEMU & Xen, using a mixture of bridging, NAT, isolated LANs, and tunnelled VLANS :-) We really ought to document it a little though Since Mark is off on vacation for a while, I'd appreciate people taking a close look at this / actually giving it a try if you can. It is possible to create a totally isolated network using <network> <name>private</name> <uuid>d237ce44-8efa-452c-b8e6-1ae9cf53aeb1</uuid> <bridge name="virbr0" /> <ip address="192.168.122.1" netmask="255.255.255.0"> <dhcp> <range start="192.168.122.2" end="192.168.122.254" /> </dhcp> </ip> </network> And a QEMU guest with 5 (yes, 5) network cards <domain type='qemu'> <name>QEMUFirewall</name> <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> <memory>219200</memory> <currentMemory>219200</currentMemory> <vcpu>1</vcpu> <os> <type arch='i686' machine='pc'>hvm</type> <boot dev='hd'/> </os> <devices> <emulator>/usr/bin/qemu</emulator> <disk type='block' device='disk'> <source dev='/dev/HostVG/QEMUGuest1'/> <target dev='hda'/> </disk> <interface type='network'> <source network='private'/> <target dev='vnet1'/> </interface> <interface type='bridge'> <source dev='xenbr0'/> <target dev='vnet2'/> </interface> <interface type='ethernet'> <script path='/etc/dan-test-ifup'/> <target dev='vnet3'/> </interface> <interface type='server'> <source address="127.0.0.1" port="5555"/> </interface> <interface type='mcast'> <source address="230.0.0.1" port="5558"/> </interface> <graphics type='vnc' port='-1'/> </devices> </domain> In this XML, only eth1 is connected to the hosts public facing network. The other NICs are all on various private networks. So this QEMU guest is in essence a router/firewall box. eg, you could connected various other guests to the 'private' virtual network, and the only way they could reach the outside world is via this QEMU instance doing routing. Regards, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

3 2

[Libvir] Turn on compiler buffer checks
by Daniel P. Berrange 21 Mar '07

21 Mar '07

Since testing the latest Fedora RPMs I've hit a number of buffer overflow issues which were caught by the extra compiler checks Fedora turns on. It would be much better if we caught these before release, so the attached patch modifies the configure script so that the following options are always turned on if the compiler supports them: -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -fasynchronous-unwind-tables Since all our production builds use these flags & the patch only enables them if the compiler has support I don't see any issue with having them turned on by default. In addition I altered the existing configure compiler flag checks so that every compiler flag we turned on is explicitly checked to see if supported by the current compiler rather than doing a crude $CC=gcc heuristic which doesn't take account of differing gcc version numbers. If we wanted super-extra paranoia we could also turn on -fstack-protector-all possibly only with --enable-compiler-warnings=maximum since it adds more non-trivial performance overhead Regards, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

2 1

[Libvir] Fix for buffer overflow in network setup
by Daniel P. Berrange 20 Mar '07

20 Mar '07

There was a buffer overflow in teh code to deal with building command line arguments which was only exposed when the Fedora RPM builds uses the stack protector args to GCC. The attached patch increases the buffer size and uses snprintf() instead of sprintf(). BTW, if anyone is looking for a patch to write - removing all other calls to sprintf() would be a worthy task :-) Regards, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

2 1

[Libvir] [PATCH] Add error message to virsh setmem/setmaxmem
by Masayuki Sunou 20 Mar '07

20 Mar '07

Hi Virsh setmem/setmaxmem doesn't output an error message when an invalid value is set to "bytes". This patch outputs an error message, when an invalid value is set as "bytes" of virsh setmem/setmaxmem. Signed-off-by: Masayuki Sunou <fj1826dm(a)aa.jp.fujitsu.com> Thanks, Masayuki Sunou. Index: src/virsh.c =================================================================== RCS file: /data/cvs/libvirt/src/virsh.c,v retrieving revision 1.66 diff -u -p -r1.66 virsh.c --- src/virsh.c 19 Mar 2007 14:20:30 -0000 1.66 +++ src/virsh.c 19 Mar 2007 23:29:14 -0000 @@ -1461,6 +1461,7 @@ cmdSetmem(vshControl * ctl, vshCmd * cmd bytes = vshCommandOptInt(cmd, "bytes", &bytes); if (bytes <= 0) { virDomainFree(dom); + vshError(ctl, FALSE, _("Invalid value of \"bytes\"")); return FALSE; } @@ -1504,6 +1505,7 @@ cmdSetmaxmem(vshControl * ctl, vshCmd * bytes = vshCommandOptInt(cmd, "bytes", &bytes); if (bytes <= 0) { virDomainFree(dom); + vshError(ctl, FALSE, _("Invalid value of \"bytes\"")); return FALSE; }

2 1

[Libvir] RPM upgrades interaction with default networking
by Daniel P. Berrange 20 Mar '07

20 Mar '07

I've been thinking about the tricky issue of RPM upgrades and how they interact with the new networking stuff and don't think we've currently got quite the optimal setup. The current approach is that 'make install' puts a default.xml file into /etc/libvirt/qemu/networks and also symlinks that file into the autostart directory. So if someone builds from tar.gz and does make install they'll get a default network config installed & turned on out of the box. This is fine for tar.gz scenario. When we build an RPM we also include the default.xml file in the /etc/libvirt/qemu/networks directory, as well as the autostart symlink. So anyone installing the libvirt RPM gets the default network, whether they're doing an upgrade or fresh install. This is reasonable for the new install, or the first time you upgrade to a new neworking-enabled libvirt. If you subsequently delete the default network, or turn off autostarting, then along comes the next libvirt RPM update and autostart gets turned back on, and/or the default network recreated. This will be considered to be rather unpleasant by many people because no matter what they do, they will always be given a virbr0, a dnsmasq process and a bunch of extra iptables rules whether they want them or not. So I think we need to figure out a way to deploy a default network out of the box, but at the same time ensure that if the turn it off / delete it, upgrades won't re-introduce it. Ideally if someone upgrades from FC6 -> FC7 they will also get the default network created (once only). One way we can address this is to put the default.xml into the docs directory /usr/share/doc/libvirt-X.Y.Z (or perhaps stuff is into a dir like /usr/share/libvirt instead) and then have a RPM %post script which copies it into /etc/libvirt/qemu/networks. If we make the %post script conditional on '$1 == 1' then it will only be run for completely new libvirt installs. This doesn't address the upgrade question though - so someone updating from FC6 -> FC7 won't get the default network. Perhaps we shouldn't worry about them ? Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

4 5

[Libvir] [PATCH] Check calls to printf-like functions (and some fixes)
by Richard W.M. Jones 20 Mar '07

20 Mar '07

* Check calls to printf-like functions (and some fixes) * Fix qemudDebug when debug not enabled * Fix TODO so it doesn't supply a semi-colon (and all calls to this macro) * Add vim/emacs local variables in several places AFAICS this doesn't break the Python API build script, which was the objection to Jim Meyerling's previous patch to do much the same (http://www.redhat.com/archives/libvir-list/2006-March/msg00065.html) Rich.

3 6

[Libvir] more printf-style function checking
by Jim Meyering 19 Mar '07

19 Mar '07

I had the first hunk of the following patch laying around, but when I updated/compiled today, it triggered a warning: virsh.c:3162: warning: format '%d' expects type 'int', but argument 6 has type 's ize_t' I've fixed it by using %lu, which is more likely to be the same width as size_t that %d, and by casting strlen's return val to the new, expected type. 2007-03-19 Jim Meyering <jim(a)meyering.net> Avoid printf-style format mismatch. * src/virsh.c (vshError): Use ATTRIBUTE_FORMAT. (_vshStrdup): Use %lu (not %d) for strlen, and cast the strlen return value to "unsigned long" to match the format. Index: src/virsh.c =================================================================== RCS file: /data/cvs/libvirt/src/virsh.c,v retrieving revision 1.65 diff -u -p -r1.65 virsh.c --- src/virsh.c 19 Mar 2007 09:46:13 -0000 1.65 +++ src/virsh.c 19 Mar 2007 14:03:10 -0000 @@ -179,8 +179,8 @@ typedef struct __vshControl { static vshCmdDef commands[]; -static void vshError(vshControl * ctl, int doexit, const char *format, - ...); +static void vshError(vshControl * ctl, int doexit, const char *format, ...) + ATTRIBUTE_FORMAT(printf, 3, 4); static int vshInit(vshControl * ctl); static int vshDeinit(vshControl * ctl); static void vshUsage(vshControl * ctl, const char *cmdname); @@ -3158,8 +3158,8 @@ _vshStrdup(vshControl * ctl, const char if ((x = strdup(s))) return x; - vshError(ctl, TRUE, _("%s: %d: failed to allocate %d bytes"), - filename, line, strlen(s)); + vshError(ctl, TRUE, _("%s: %d: failed to allocate %lu bytes"), + filename, line, (unsigned long)strlen(s)); return NULL; }

2 1

[Libvir] remove global variables from header files
by Jim Meyering 19 Mar '07

19 Mar '07

Hello, I compiled the latest-from-cvs libvirt and was surprised to see link failures. It was because I used -fno-common: .libs/libvirt_la-hash.o:(.bss+0x0): multiple definition of `virDomainFlags' .libs/libvirt_la-libvirt.o:(.bss+0x0): first defined here libvirt_qemud-buf.o:(.bss+0x0): multiple definition of `qemud_packet_type' libvirt_qemud-qemud.o:(.bss+0x0): first defined here libvirt_qemud-buf.o:(.bss+0x4): multiple definition of `qemud_domain_runstate' libvirt_qemud-qemud.o:(.bss+0x4): first defined here Those happen when more than one compilation unit contains a non-extern declaration of the same global variable. In each of the three cases, the name in question appears only at the point of declaration, so one could conceivably simply remove the name, leaving the anonymous "enum". But then there would be no way to declare a variable to be of that type, so I chose to reuse the name, making it the name of the enum. If name space pollution is an issue, and applications that use those headers won't need those types, then it'd be better to remove the names altogether. Here's a patch: 2007-03-19 Jim Meyering <jim(a)meyering.net> Remove global variables from header files. * qemud/protocol.h (qemud_domain_runstate): Declare a named enum and no variable, rather than a global variable of type "anonymous enum". (qemud_packet_type): Likewise. * src/internal.h (virDomainFlags): Likewise. Index: qemud/protocol.h =================================================================== RCS file: /data/cvs/libvirt/qemud/protocol.h,v retrieving revision 1.5 diff -u -p -r1.5 protocol.h --- qemud/protocol.h 15 Mar 2007 17:24:57 -0000 1.5 +++ qemud/protocol.h 19 Mar 2007 13:36:55 -0000 @@ -29,7 +29,7 @@ #include <net/if.h> /* for IF_NAMESIZE */ /* List of different packet types which can be sent */ -enum { +enum qemud_packet_type { QEMUD_PKT_FAILURE = 0, QEMUD_PKT_GET_VERSION, QEMUD_PKT_GET_NODEINFO, @@ -71,7 +71,7 @@ enum { QEMUD_PKT_GET_CAPABILITIES, QEMUD_PKT_MAX, -} qemud_packet_type; +}; #define QEMUD_PROTOCOL_VERSION_MAJOR 1 @@ -86,11 +86,11 @@ enum { #define QEMUD_MAX_ERROR_LEN 1024 /* Possible guest VM states */ -enum { +enum qemud_domain_runstate { QEMUD_STATE_RUNNING = 1, QEMUD_STATE_PAUSED, QEMUD_STATE_STOPPED, -} qemud_domain_runstate; +}; /* Each packets has at least a fixed size header. * Index: src/internal.h =================================================================== RCS file: /data/cvs/libvirt/src/internal.h,v retrieving revision 1.35 diff -u -p -r1.35 internal.h --- src/internal.h 16 Mar 2007 15:03:21 -0000 1.35 +++ src/internal.h 19 Mar 2007 13:36:55 -0000 @@ -155,10 +155,10 @@ struct _virConnect { * a set of special flag values associated to the domain */ -enum { +enum virDomainFlags { DOMAIN_IS_SHUTDOWN = (1 << 0), /* the domain is being shutdown */ DOMAIN_IS_DEFINED = (1 << 1) /* the domain is defined not running */ -} virDomainFlags; +}; /** * _virDomain:

2 1

[Libvir] [PATCH] Fix driver counting in virConnectOpen
by Atsushi SAKAI 19 Mar '07

19 Mar '07

Hi, I think virConnectOpen driver counting check is wrong. If we does not run libvirt_qemud, virsh does not run on root privilege. This restriction forces Xen user to run verbose libvirt_qemud. Signed-off-by: Atsushi SAKAI <sakaia(a)jp.fujitsu.com> Thanks Atsushi SAKAI diff -urpN libvirt-0.2.1/src/libvirt.c libvirt-0.2.1.check/src/libvirt.c --- libvirt-0.2.1/src/libvirt.c 2007-03-16 01:45:36.000000000 +0900 +++ libvirt-0.2.1.check/src/libvirt.c 2007-03-19 18:37:22.000000000 +0900 @@ -322,7 +322,7 @@ virConnectOpen(const char *name) } } - if (ret->nb_drivers == 0 || ret->nb_network_drivers == 0) { + if (ret->nb_drivers == 0 && ret->nb_network_drivers == 0) { /* we failed to find an adequate driver */ virLibConnError(NULL, VIR_ERR_NO_SUPPORT, name); goto failed; @@ -389,7 +389,7 @@ virConnectOpenReadOnly(const char *name) ret->networkDrivers[ret->nb_network_drivers++] = virNetworkDriverTab[i]; } } - if (ret->nb_drivers == 0) { + if (ret->nb_drivers == 0 && ret->nb_network_drivers == 0) { if (name == NULL) virLibConnError(NULL, VIR_ERR_NO_CONNECT, _("Xen Daemon or Xen Store"));

2 1

[Libvir] [PATCH] Guard a negative value of "virsh setmem" and "virsh setmexmem"
by Masayuki Sunou 19 Mar '07

19 Mar '07

Hi "virsh setmem" and "virsh setmexmem" have the problem of setting a very big value in the domain when -1 is set in the domain. As a result, I detected the problem of doing abnormal operation of Xen in 64bit machine. (virsh setmem) Therefore, I contribute the patch that corrects the argument of the function to guard a negative value. This treatment is based on setMemoryTarget(a)XendDomainInfo.py. Signed-off-by: Masayuki Sunou <fj1826dm(a)aa.jp.fujitsu.com> Thanks, Masayuki Sunou. ------------------------------------------------------------------------------- Index: include/libvirt/libvirt.h =================================================================== RCS file: /data/cvs/libvirt/include/libvirt/libvirt.h,v retrieving revision 1.41 diff -u -p -r1.41 libvirt.h --- include/libvirt/libvirt.h 15 Mar 2007 17:24:57 -0000 1.41 +++ include/libvirt/libvirt.h 16 Mar 2007 01:37:25 -0000 @@ -314,9 +314,9 @@ int virDomainGetUUIDString (virDomainP char * virDomainGetOSType (virDomainPtr domain); unsigned long virDomainGetMaxMemory (virDomainPtr domain); int virDomainSetMaxMemory (virDomainPtr domain, - unsigned long memory); + int memory); int virDomainSetMemory (virDomainPtr domain, - unsigned long memory); + int memory); int virDomainGetMaxVcpus (virDomainPtr domain); /* Index: include/libvirt/libvirt.h.in =================================================================== RCS file: /data/cvs/libvirt/include/libvirt/libvirt.h.in,v retrieving revision 1.26 diff -u -p -r1.26 libvirt.h.in --- include/libvirt/libvirt.h.in 15 Mar 2007 17:24:57 -0000 1.26 +++ include/libvirt/libvirt.h.in 16 Mar 2007 01:37:26 -0000 @@ -314,9 +314,9 @@ int virDomainGetUUIDString (virDomainP char * virDomainGetOSType (virDomainPtr domain); unsigned long virDomainGetMaxMemory (virDomainPtr domain); int virDomainSetMaxMemory (virDomainPtr domain, - unsigned long memory); + int memory); int virDomainSetMemory (virDomainPtr domain, - unsigned long memory); + int memory); int virDomainGetMaxVcpus (virDomainPtr domain); /* Index: src/libvirt.c =================================================================== RCS file: /data/cvs/libvirt/src/libvirt.c,v retrieving revision 1.63 diff -u -p -r1.63 libvirt.c --- src/libvirt.c 15 Mar 2007 17:24:57 -0000 1.63 +++ src/libvirt.c 16 Mar 2007 01:37:31 -0000 @@ -1499,7 +1499,7 @@ virDomainGetMaxMemory(virDomainPtr domai * Returns 0 in case of success and -1 in case of failure. */ int -virDomainSetMaxMemory(virDomainPtr domain, unsigned long memory) +virDomainSetMaxMemory(virDomainPtr domain, int memory) { int ret = -1 , i; virConnectPtr conn; @@ -1553,7 +1553,7 @@ virDomainSetMaxMemory(virDomainPtr domai * Returns 0 in case of success and -1 in case of failure. */ int -virDomainSetMemory(virDomainPtr domain, unsigned long memory) +virDomainSetMemory(virDomainPtr domain, int memory) { int ret = -1 , i; virConnectPtr conn; -------------------------------------------------------------------------------

2 3

[Libvir] [PATCH]Reprt error for a existing file
by Kazuki Mizushima 19 Mar '07

19 Mar '07

Hi, I make a patch which reports error for a existing file to prevent overwriting before the file. # ./virsh dump 1 a.dump error: file a.dump exists already # echo $? 1 # ./virsh save 1 a.save error: file a.save exists already # echo $? 1 As you know, we need to add this message item to libvirt/po. Signed-off-by: Kazuki Mizushima <mizushima.kazuk(a)jp.fujitsu.com> Thanks, Kazuki Mizushima Index: src/virsh.c =================================================================== RCS file: /data/cvs/libvirt/src/virsh.c,v retrieving revision 1.58 diff -u -p -r1.58 virsh.c --- src/virsh.c 2 Mar 2007 14:22:33 -0000 1.58 +++ src/virsh.c 5 Mar 2007 06:49:28 -0000 @@ -25,6 +25,7 @@ #include <getopt.h> #include <sys/types.h> #include <sys/time.h> +#include <sys/stat.h> #include <ctype.h> #include <fcntl.h> #include <locale.h> @@ -860,6 +861,7 @@ cmdSave(vshControl * ctl, vshCmd * cmd) virDomainPtr dom; char *name; char *to; + struct stat st; int ret = TRUE; if (!vshConnectionUsability(ctl, ctl->conn, TRUE)) @@ -871,6 +873,11 @@ cmdSave(vshControl * ctl, vshCmd * cmd) if (!(dom = vshCommandOptDomain(ctl, cmd, "domain", &name))) return FALSE; + if (stat(to, &st) == 0){ + vshError(ctl, FALSE, _("file %s exists already"), to); + return FALSE; + } + if (virDomainSave(dom, to) == 0) { vshPrint(ctl, _("Domain %s saved to %s\n"), name, to); } else { @@ -942,6 +949,7 @@ cmdDump(vshControl * ctl, vshCmd * cmd) virDomainPtr dom; char *name; char *to; + struct stat st; int ret = TRUE; if (!vshConnectionUsability(ctl, ctl->conn, TRUE)) @@ -953,6 +961,11 @@ cmdDump(vshControl * ctl, vshCmd * cmd) if (!(dom = vshCommandOptDomain(ctl, cmd, "domain", &name))) return FALSE; + if (stat(to, &st) == 0){ + vshError(ctl, FALSE, _("file %s exists already"), to); + return FALSE; + } + if (virDomainCoreDump(dom, to, 0) == 0) { vshPrint(ctl, _("Domain %s dumpd to %s\n"), name, to); } else {

3 8

[Libvir] Release of libvirt-0.2.1
by Daniel Veillard 16 Mar '07

16 Mar '07

A lot of work had accumulated in CVS, and it was really time for a new release, it's available from: ftp://libvirt.org/libvirt * Various internal cleanups (Richard Jones,Daniel Berrange,Mark McLoughlin) * Bug fixes: - libvirt_qemud daemon path (Daniel Berrange) - libvirt config directory (Daniel Berrange and Mark McLoughlin) - memory leak in qemud (Mark) - various fixes on network support (Mark) - avoid Xen domain zombies on device hotplug errors (Daniel Berrange) - various fixes on qemud (Mark) - argsparsing (Richard Jones) - virsh -t argument (Saori Fukuta) - avoid virsh crash on TAB key (Daniel Berrange) - detect xend operation failures (Kazuki Mizushima) - don't listen on null socket (Rich Jones) - read-only socket cleanup (Rich Jones) - use of vnc port 5900 (Nobuhiro Itou) - assorted networking fixes (Daniel Berrange) - shutoff and shutdown mismatches (Kazuki Mizushima) - unlimited memory handling (Atsushi SAKAI) - python binding fixes (Tatsuro Enokura) * Build and portability fixes: - IA64 fixes (Atsushi SAKAI) - dependancies and build (Daniel Berrange) - fix xend port detection (Daniel Berrange) - icompile time warnings (Mark) - avoid const related compiler warnings (Daniel Berrange) - automated builds (Daniel Berrange) - pointer/int mismatch (Richard Jones) - configure time selection of drivers - libvirt spec hacking (Daniel Berrange) * Add support for network autostart and init scripts (Mark McLoughlin) * New API virConnectGetCapabilities() to detect the virtualization capabilities of a host (Richard Jones) * Minor improvements: - qemud signal handling (Mark) - don't shutdown or reboot domain0 (Kazuki Mizushima) - QEmu version autodetection (Daniel Berrange) - network UUIDs (Mark) - speed up UUID domain lookups (Tatsuro Enokura and Daniel Berrange) - support for paused QEmu CPU (Daniel Berrange) - keymap VNC attribute support (Takahashi Tomohiro and Daniel Berrange) - maximum number of virtual CPU (Masayuki Sunou) - virtsh --readonly option (Rich Jones) - python bindings for new functions (Daniel Berrange) * Documentation updates especially on the XML formats Thanks to everybody who contributed to this release ! Daniel -- Red Hat Virtualization group http://redhat.com/virtualization/ Daniel Veillard | virtualization library http://libvirt.org/ veillard(a)redhat.com | libxml GNOME XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/

1 0

[Libvir] [PATCH] Check calls to printf-like functions (and some fixes) (second version)
by Richard W.M. Jones 16 Mar '07

16 Mar '07

-- Emerging Technologies, Red Hat http://et.redhat.com/~rjones/ 64 Baker Street, London, W1U 7DF Mobile: +44 7866 314 421 "[Negative numbers] darken the very whole doctrines of the equations and make dark of the things which are in their nature excessively obvious and simple" (Francis Maseres FRS, mathematician, 1759)

3 4

[Libvir] [PATCH] TODO macro shouldn't contain a semicolon
by Richard W.M. Jones 16 Mar '07

16 Mar '07

I don't think it's a good idea for macros which look like statements to behave differently from actual statements. This patch fixes the TODO macro in this way. Rich. -- Emerging Technologies, Red Hat http://et.redhat.com/~rjones/ 64 Baker Street, London, W1U 7DF Mobile: +44 7866 314 421 "[Negative numbers] darken the very whole doctrines of the equations and make dark of the things which are in their nature excessively obvious and simple" (Francis Maseres FRS, mathematician, 1759)

1 0

[Libvir] libvirt.py has the two functions that names are the same.
by Tatsuro Enokura 16 Mar '07

16 Mar '07

Hi, When I used the lookupByName() function of libvirt.py, it failed with the following error messages. ------ Traceback (most recent call last): File "./virt-install.mod", line 569, in <module> main() File "./virt-install.mod", line 499, in main guest, hvm, conn) File "./virt-install.mod", line 187, in get_disks disk, size) File "./virt-install.mod", line 186, in <lambda> map(lambda d, s: get_disk(d, s, sparse, guest, hvm, conn), File "./virt-install.mod", line 131, in get_disk vm = conn.lookupByName(name) File "/usr/lib/python2.5/site-packages/libvirt.py", line 483, in lookupByName if ret is None:raise libvirtError('virNetworkLookupByName() failed', conn=self) libvirt.libvirtError: virNetworkLookupByName() failed ------ The lookupByName() function is the same name for domain and for network in libvirt.py. The lookupByUUIDstring() function is similar. I think that generator of libvirt.py's function is incorrect. Thanks, Tatsuro Enokura --- cat /usr/lib/python2.5/site-packages/libvirt.py .. snip .. def lookupByName(self, name): """Try to lookup a domain on the given hypervisor based on its name. """ ret = libvirtmod.virDomainLookupByName(self._o, name) if ret is None:raise libvirtError('virDomainLookupByName() failed', conn=self) __tmp = virDomain(_obj=ret) __tmp.ref = self return __tmp def lookupByName(self, name): """Try to lookup a network on the given hypervisor based on its name. """ ret = libvirtmod.virNetworkLookupByName(self._o, name) if ret is None:raise libvirtError('virNetworkLookupByName() failed', conn=self) __tmp = virNetwork(_obj=ret) __tmp.ref = self return __tmp def lookupByUUIDString(self, uuidstr): """Try to lookup a network on the given hypervisor based on its UUID. """ ret = libvirtmod.virNetworkLookupByUUIDString(self._o, uuidstr) if ret is None:raise libvirtError('virNetworkLookupByUUIDString() failed', conn=self) __tmp = virNetwork(_obj=ret) __tmp.ref = self return __tmp def lookupByUUIDString(self, uuidstr): """Try to lookup a domain on the given hypervisor based on its UUID. """ ret = libvirtmod.virDomainLookupByUUIDString(self._o, uuidstr) if ret is None:raise libvirtError('virDomainLookupByUUIDString() failed', conn=self) __tmp = virDomain(_obj=ret) __tmp.ref = self return __tmp .. snip .. --

2 3