October 2010 - Devel - libvirt List Archives

[libvirt] [PATCH v2 0/5] nwfilter: Support comment attribute in filter rule descriptions
by Stefan Berger 07 Oct '10

07 Oct '10

V2: - work on the iptables instantiation patch (2/5) - work on the parser patch (1/5) - small changes to the test cases (5/5) The following patch series adds support for a comment node to the XML attributes of all protocols. If possible, as for example in case of iptables, the comments are instantiated (iptables ... -m comment --comment ...). The patches do the following: - extend the parser and XML generator to parse and create XML with the comment attribute - instantiate the comment in case of ip(6)tables - extend the nwfilter.rng schema with the comment attribute - add the information to the web docs - add a test case for the XML parser/generator to be run during 'make check' Regards, Stefan

4 21

[libvirt] [TCK][PATCH] nwfilter: implement support for --force flag
by Stefan Berger 07 Oct '10

07 Oct '10

Implement support for the --force command line option to delete existing VMs and nwfilters starting with 'tck'. Fix how the --no-attach flag is handled. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> diff --git a/scripts/nwfilter/nwfilter2vmtest.sh b/scripts/nwfilter/nwfilter2vmtest.sh index b527ee8..496c220 100644 --- a/scripts/nwfilter/nwfilter2vmtest.sh +++ b/scripts/nwfilter/nwfilter2vmtest.sh @@ -23,6 +23,7 @@ FLAG_ATTACH="$((1<<1))" FLAG_VERBOSE="$((1<<2))" FLAG_LIBVIRT_TEST="$((1<<3))" FLAG_TAP_TEST="$((1<<4))" +FLAG_FORCE_CLEAN="$((1<<5))" failctr=0 passctr=0 @@ -47,6 +48,8 @@ Options: --verbose : Verbose output --libvirt-test : Use the libvirt test output format --tap-test : TAP format output + --force : Allow the automatic cleaning of VMs and nwfilters + previously created by the TCK test suite This test will create two virtual machines. The one virtual machine will use a filter called '${TESTFILTERNAME}', and reference the filter @@ -498,11 +501,12 @@ function main() { while [ $# -ne 0 ]; do case "$1" in --help|-h|-\?) usage ${prgname}; exit 0;; - --noattach) ((flags ^= FLAG_ATTACH ));; + --noattach) ((flags &= ~FLAG_ATTACH ));; --wait) ((flags |= FLAG_WAIT ));; --verbose) ((flags |= FLAG_VERBOSE ));; --libvirt-test) ((flags |= FLAG_LIBVIRT_TEST ));; --tap-test) ((flags |= FLAG_TAP_TEST ));; + --force) ((flags |= FLAG_FORCE_CLEAN ));; *) usage ${prgname}; exit 1;; esac shift 1 @@ -523,12 +527,14 @@ function main() { exit 0 fi - for name in `virsh nwfilter-list | awk '{print $2}'` + for name in `virsh list | awk '{print $2}'` do case ${name} in tck*) - if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then - res=$(virsh nwfilter-undefine ${name} 2>&1) + if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" -o \ + $((flags & FLAG_FORCE_CLEAN)) -ne 0 ]; then + res=$(virsh destroy ${name} 2>&1) + res=$(virsh undefine ${name} 2>&1) if [ $? -ne 0 ]; then echo "Bail out! Could not undefine nwfiler ${name}: ${res}" exit 0 @@ -544,8 +550,9 @@ function main() { do case ${name} in tck*) - if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then - res=$(virsh undefine ${name} 2>&1) + if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" -o \ + $((flags & FLAG_FORCE_CLEAN)) -ne 0 ]; then + res=$(virsh nwfilter-undefine ${name} 2>&1) if [ $? -ne 0 ]; then echo "Bail out! Could not undefine domain ${name}: ${res}" exit 1

2 2

[libvirt] Using -netdev with qemu/kvm rather than old style
by Pete Ashdown 07 Oct '10

07 Oct '10

I have 0.8.3 installed and my net devices are still being defined via -net rather than -netdev. I have found that using the latter allows my ethernet to properly offload and gives a 35% performance gain. Looking through the libvirt code I find in qemu_conf.c: /* Possible combinations * * 1. Old way: -net nic,model=e1000,vlan=1 -net tap,vlan=1 * 2. Semi-new: -device e1000,vlan=1 -net tap,vlan=1 * 3. Best way: -netdev type=tap,id=netdev1 -device e1000,id=netdev1 * * NB, no support for -netdev without use of -device */ How do I convince virsh/libvirt to use #3, the "Best way"?

2 1

[libvirt] [PATCH] [DOCS] nwfilter: Add 2nd example to the html docs
by Stefan Berger 07 Oct '10

07 Oct '10

This patch adds another example to the nwfilter html page and provides 2 solutions for how to write a filter meeting the given requirements using newly added features. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/formatnwfilter.html.in | 180 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 179 insertions(+), 1 deletion(-) Index: libvirt-acl/docs/formatnwfilter.html.in =================================================================== --- libvirt-acl.orig/docs/formatnwfilter.html.in +++ libvirt-acl/docs/formatnwfilter.html.in @@ -1468,7 +1468,8 @@ <li>prevents a VM's interface from MAC, IP and ARP spoofing</li> <li>opens only TCP ports 22 and 80 of a VM's interface</li> <li>allows the VM to send ping traffic from an interface - but no let the VM be pinged on the interface</li> + but not let the VM be pinged on the interface</li> + <li>allows the VM to do DNS lookups (UDP towards port 53)</li> </ul> <p> The requirement to prevent spoofing is fulfilled by the existing @@ -1510,6 +1511,11 @@ <icmp/> </rule> +  + <rule action='accept' direction='out'> + <udp dstportstart='53'/> + </rule> +  <rule action='drop' direction='inout'> <all/> @@ -1556,6 +1562,178 @@ </rule> </pre> + <h3><a name="nwfwriteexample2nd">Second example custom filter</a></h3> + <p> + In this example we now want to build a similar filter as in the + example above, but extend the list of requirements with an + ftp server located inside the VM. Further, we will be using features + that have been added in <span class="since">version 0.8.5</span>. + The requirements for this filter shall be: + </p> + <ul> + <li>prevents a VM's interface from MAC, IP and ARP spoofing</li> + <li>opens only TCP ports 22 and 80 of a VM's interface</li> + <li>allows the VM to send ping traffic from an interface + but not let the VM be pinged on the interface</li> + <li>allows the VM to do DNS lookups (UDP towards port 53)</li> + <li>enable an ftp server (in active mode) to be run inside the VM + </ul> + <p> + The additional requirement of allowing an ftp server to be run inside + the VM maps into the requirement of allowing port 21 to be reachable + for ftp control traffic as well as enabling the VM to establish an + outgoing tcp connection originating from the VM's TCP port 20 back to + the ftp client (ftp active mode). There are several ways of how this + filter can be written and we present 2 solutions. + <br><br> + The 1st solution makes use of the <code>state</code> attribute of + the TCP protocol that gives us a hook into the connection tracking + framework of the Linux host. For the VM-initiated ftp data connection + (ftp active mode) we use the <code>RELATED</code> state that allows + us to detect that the VM-initated ftp data connection is a consequence of + ( or 'has a relationship with' ) an existing ftp control connection, + thus we want to allow it to let packets + pass the firewall. The <code>RELATED</code> state, however, is only + valid for the very first packet of the outgoing TCP connection for the + ftp data path. Afterwards, the state to compare against is + <code>ESTABLISHED</code>, which then applies equally + to the incoming and outgoing direction. All this is related to the ftp + data traffic origination from TCP port 20 of the VM. This then leads to + the following solution + <span class="since">(since 0.8.5 (Qemu, KVM, UML))</span>: + </p> +<pre> +<filter name='test-eth0'> +  + <filterref filter='clean-traffic'/> + +  + <rule action='accept' direction='in'> + <tcp dstportstart='21'/> + </rule> + +  + <rule action='accept' direction='out'> + <tcp srcportstart='20' state='RELATED,ESTABLISHED'/> + </rule> + +  + <rule action='accept' direction='in'> + <tcp dstportstart='20' state='ESTABLISHED'/> + </rule> + +  + <rule action='accept' direction='in'> + <tcp dstportstart='22'/> + </rule> + + <rule action='accept' direction='in'> + <tcp dstportstart='80'/> + </rule> + +  + <rule action='accept' direction='out'> + <icmp/> + </rule> + +  + <rule action='accept' direction='out'> + <udp dstportstart='53'/> + </rule> + +  + <rule action='drop' direction='inout'> + <all/> + </rule> + +</filter> +</pre> + <p> + Before trying out a filter using the <code>RELATED</code> state, + you have to make sure that the approriate connection tracking module + has been loaded into the host's kernel. Depending on the version of the + kernel, you must run either one of the following two commands before + the ftp connection with the VM is established. + </p> +<pre> + modprobe nf_conntrack_ftp # where available or + + modprobe ip_conntrack_ftp # if above is not available +</pre> + <p> + If other protocols than ftp are to be used in conjunction with the + <code>RELATED</code> state, their corresponding module must be loaded. + Modules exist at least for the protocols ftp, tftp, irc, sip, + sctp, and amanda. + </p> + <p> + The 2nd solution makes uses the state flags of connections more + than the previous solution did. + In this solution we take advantage of the fact that the + <code>NEW</code> state of a connection is valid when the very + first packet of a traffic flow is seen. Subsequently, if the very first + packet of a flow is accepted, the flow becomes a connection and enters + the <code>ESTABLISHED</code> state. This allows us to write a general + rule for allowing packets of <code>ESTABLISHED</code> connections to + reach the VM or be sent by the VM. + We write specific rules for the very first packets identified by the + <code>NEW</code> state and for which ports they are acceptable. All + packets for ports that are not explicitly accepted will be dropped and + therefore the connection will not go into the <code>ESTABLISHED</code> + state and any subsequent packets be dropped. + </p> + +<pre> +<filter name='test-eth0'> +  + <filterref filter='clean-traffic'/> + +  + <rule action='accept' direction='in'> + <all state='ESTABLISHED'/> + </rule> + +  + <rule action='accept' direction='out'> + <all state='ESTABLISHED,RELATED'/> + </rule> + +  + <rule action='accept' direction='in'> + <tcp dstportstart='21' dstportend='22' state='NEW'/> + </rule> + + <rule action='accept' direction='in'> + <tcp dstportstart='80' state='NEW'/> + </rule> + +  + <rule action='accept' direction='out'> + <icmp state='NEW'/> + </rule> + +  + <rule action='accept' direction='out'> + <udp dstportstart='53' state='NEW'/> + </rule> + +  + <rule action='drop' direction='inout'> + <all/> + </rule> + +</filter> + +</pre> <h2><a name="nwflimits">Limitations</a></h2> <p>

3 3

[libvirt] [patch 0/5] nwfilter: add a 'state' attribute to protocols
by Stefan Berger 07 Oct '10

07 Oct '10

The following patch series introduces an attribute 'state' for iptables- supported protocols. This gives the user more control over the 'state match' of the underlying ip(6)tables implementation and allows to create filtering rules that are more efficient to evaluate. TCK test cases will be posted later. Each rule containing a state attribute with either one of the values NEW, ESTABLISHED, RELATED, INVALID or NONE, gets one iptables rule created for the direction of the rule. The keyword 'NONE' does the same, but doesn't generate a rule with the 'state match'. If no state attribute is used, a symmetric rule in the incoming and outgoing direction is generated (as was done previously). The patches do the following: - extend the parser and XML generator to parse and create XML with the state attribute - instantiate the state in case of ip(6)tables - extend the nwfilter.rng schema with the state attribute's possible values - add information about the new state attribute to the web docs - add a test case for the XML parser/generator to be run during 'make check' I valgrind'ed this patch and it looks all memory is freed appropriately. Regards, Stefan

4 16

[libvirt] [PATCH] document authentication with PolicyKit-1
by Gerd v. Egidy 07 Oct '10

07 Oct '10

Hi, I just encountered the same problem with the newer PolicyKit as discussed e.g. in this thread: http://lists.fedoraproject.org/pipermail/virt/2010-June/002081.html I solved it and thought updating the documentation for PolicyKit 1 would be nice. Patch attached. Kind regards, Gerd -- Address (better: trap) for people I really don't want to get mail from: jonas(a)cactusamerica.com

4 4

[libvirt] bug: network lock-out
by Zdenek Styblik 07 Oct '10

07 Oct '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I'm sorry to report this, but network should start or stop regardless iptables status. virsh # net-start default error: Failed to start network default error: internal error '/usr/sbin/iptables --table filter --delete INPUT - --in-interface virbr0 --protocol udp --destination-port 69 --jump ACCEPT' exited with non-zero status 1 and signal 0: iptables: Bad rule (does a matching rule exist in that chain?). Ok, so I'm going to create this rule to make you happy. virsh # net-start default error: Failed to start network default error: internal error '/usr/sbin/iptables --table mangle --delete POSTROUTING --out-interface virbr0 --protocol udp --destination-port 68 - --jump CHECKSUM --checksum-fill' exited with non-zero status 2 and signal 0: iptables v1.4.7: unknown option `--checksum-fill' Try `iptables -h' or 'iptables --help' for more information. And Oops, because I don't have CHECKSUM support. And to note, it's not even in kernel. Rely on such features is unfriendly and bellow belt :) Once again, I'm locked by hard-coded features :( That's why I "fight" against these. btw it's strange to me that libvirt is deleting rules that shouldn't be present since I want to start network, not to stop it. Let's dump all nwfilters and hope for miracle...and nothing. Same errors, although nwfilter rules are gone. What the ...? :| libvirt-0.8.4 Regards, Zdenek - -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkyrezwACgkQ8MreUbSH7ikbpQCdEDtbwG+PV6u0yvUZYzXlQas9 ohEAoIyy/HPZwtWlaOAgtx6jnOEFashR =u7st -----END PGP SIGNATURE-----

3 8

[libvirt] libvirt and nested pagind
by Eduardo 07 Oct '10

07 Oct '10

Good afternoon! Searching on the web, I joint some codes and produced those patches. Now I have a server running perfectly with the following scenario: AMD Phenom 8400 x3; Slackware64 13.1 on a slim and custom 2.6.35.2 Linux; qemu-kvm 0.12.5; libvirt 0.8.4. Patch of libvirt 0.8.3: diff -Naur ../libvirt-0.8.3//docs/schemas/domain.rng ./docs/schemas/domain.rng --- ../libvirt-0.8.3//docs/schemas/domain.rng 2010-07-29 06:48:30.000000000 -0300 +++ ./docs/schemas/domain.rng 2010-09-01 16:51:57.710851479 -0300 @@ -1595,6 +1595,11 @@ <empty/> </element> </optional> + <optional> + <element name="nesting"> + <empty/> + </element> + </optional> </interleave> </element> </optional> diff -Naur ../libvirt-0.8.3//src/conf/domain_conf.c ./src/conf/domain_conf.c --- ../libvirt-0.8.3//src/conf/domain_conf.c 2010-08-02 16:16:42.000000000 -0300 +++ ./src/conf/domain_conf.c 2010-09-01 16:51:57.710851479 -0300 @@ -75,7 +75,8 @@ VIR_ENUM_IMPL(virDomainFeature, VIR_DOMAIN_FEATURE_LAST, "acpi", "apic", - "pae") + "pae", + "nesting") VIR_ENUM_IMPL(virDomainLifecycle, VIR_DOMAIN_LIFECYCLE_LAST, "destroy", diff -Naur ../libvirt-0.8.3//src/conf/domain_conf.h ./src/conf/domain_conf.h --- ../libvirt-0.8.3//src/conf/domain_conf.h 2010-07-29 06:48:30.000000000 -0300 +++ ./src/conf/domain_conf.h 2010-09-01 16:51:57.710851479 -0300 @@ -649,6 +649,7 @@ VIR_DOMAIN_FEATURE_ACPI, VIR_DOMAIN_FEATURE_APIC, VIR_DOMAIN_FEATURE_PAE, + VIR_DOMAIN_FEATURE_NESTING, VIR_DOMAIN_FEATURE_LAST }; diff -Naur ../libvirt-0.8.3//src/qemu/qemu_conf.c ./src/qemu/qemu_conf.c --- ../libvirt-0.8.3//src/qemu/qemu_conf.c 2010-08-04 09:21:27.000000000 -0300 +++ ./src/qemu/qemu_conf.c 2010-09-01 16:57:47.485469640 -0300 @@ -1190,6 +1190,8 @@ flags |= QEMUD_CMD_FLAG_MEM_PATH; if (strstr(help, "-chardev")) flags |= QEMUD_CMD_FLAG_CHARDEV; + if (strstr(help, "-enable-nesting")) + flags |= QEMUD_CMD_FLAG_NESTING; if (strstr(help, "-balloon")) flags |= QEMUD_CMD_FLAG_BALLOON; if (strstr(help, "-device")) @@ -3907,6 +3909,9 @@ goto error; } } + if ((qemuCmdFlags & QEMUD_CMD_FLAG_NESTING) && + (def->features & (1 << VIR_DOMAIN_FEATURE_NESTING))) + ADD_ARG_LIT("-enable-nesting"); /* * NB, -nographic *MUST* come before any serial, or monitor @@ -6265,6 +6270,8 @@ fullscreen = 1; } else if (STREQ(arg, "-localtime")) { def->clock.offset = VIR_DOMAIN_CLOCK_OFFSET_LOCALTIME; + } else if (STREQ(arg, "-enable-nesting")) { + def->features |= (1 << VIR_DOMAIN_FEATURE_NESTING); } else if (STREQ(arg, "-kernel")) { WANT_VALUE(); if (!(def->os.kernel = strdup(val))) diff -Naur ../libvirt-0.8.3//src/qemu/qemu_conf.h ./src/qemu/qemu_conf.h --- ../libvirt-0.8.3//src/qemu/qemu_conf.h 2010-07-28 11:18:15.000000000 -0300 +++ ./src/qemu/qemu_conf.h 2010-09-01 16:58:29.900876561 -0300 @@ -92,6 +92,7 @@ QEMUD_CMD_FLAG_PCI_CONFIGFD = (1LL << 36), /* pci-assign.configfd */ QEMUD_CMD_FLAG_NODEFCONFIG = (1LL << 37), /* -nodefconfig */ QEMUD_CMD_FLAG_BOOT_MENU = (1LL << 38), /* -boot menu=on support */ + QEMUD_CMD_FLAG_NESTING = (1LL << 39), /* Is the -enable-nesting flag available */ }; /* Main driver state */ Patch of libvirt 0.8.4: diff -Naur libvirt-0.8.4/docs/schemas/domain.rng libvirt-0.8.4.edu/docs/schemas/domain.rng --- libvirt-0.8.4/docs/schemas/domain.rng 2010-08-31 10:44:13.000000000 -0300 +++ libvirt-0.8.4.edu/docs/schemas/domain.rng 2010-09-28 14:34:40.626234752 -0300 @@ -1619,6 +1619,11 @@ <empty/> </element> </optional> + <optional> + <element name="nesting"> + <empty/> + </element> + </optional> </interleave> </element> </optional> diff -Naur libvirt-0.8.4/src/conf/domain_conf.c libvirt-0.8.4.edu/src/conf/domain_conf.c --- libvirt-0.8.4/src/conf/domain_conf.c 2010-08-31 10:44:13.000000000 -0300 +++ libvirt-0.8.4.edu/src/conf/domain_conf.c 2010-09-28 14:35:36.069149447 -0300 @@ -75,7 +75,8 @@ VIR_ENUM_IMPL(virDomainFeature, VIR_DOMAIN_FEATURE_LAST, "acpi", "apic", - "pae") + "pae", + "nesting") VIR_ENUM_IMPL(virDomainLifecycle, VIR_DOMAIN_LIFECYCLE_LAST, "destroy", diff -Naur libvirt-0.8.4/src/conf/domain_conf.h libvirt-0.8.4.edu/src/conf/domain_conf.h --- libvirt-0.8.4/src/conf/domain_conf.h 2010-08-31 10:44:13.000000000 -0300 +++ libvirt-0.8.4.edu/src/conf/domain_conf.h 2010-09-28 14:36:11.931054102 -0300 @@ -650,6 +650,7 @@ VIR_DOMAIN_FEATURE_ACPI, VIR_DOMAIN_FEATURE_APIC, VIR_DOMAIN_FEATURE_PAE, + VIR_DOMAIN_FEATURE_NESTING, VIR_DOMAIN_FEATURE_LAST }; diff -Naur libvirt-0.8.4/src/qemu/qemu_conf.c libvirt-0.8.4.edu/src/qemu/qemu_conf.c --- libvirt-0.8.4/src/qemu/qemu_conf.c 2010-09-10 09:38:13.000000000 -0300 +++ libvirt-0.8.4.edu/src/qemu/qemu_conf.c 2010-09-28 14:38:36.218612249 -0300 @@ -1192,6 +1192,8 @@ flags |= QEMUD_CMD_FLAG_MEM_PATH; if (strstr(help, "-chardev")) flags |= QEMUD_CMD_FLAG_CHARDEV; + if (strstr(help, "-enable-nesting")) + flags |= QEMUD_CMD_FLAG_NESTING; if (strstr(help, "-balloon")) flags |= QEMUD_CMD_FLAG_BALLOON; if (strstr(help, "-device")) @@ -3944,6 +3946,9 @@ goto error; } } + if ((qemuCmdFlags & QEMUD_CMD_FLAG_NESTING) && + (def->features & (1 << VIR_DOMAIN_FEATURE_NESTING))) + ADD_ARG_LIT("-enable-nesting"); /* * NB, -nographic *MUST* come before any serial, or monitor @@ -6303,6 +6308,8 @@ fullscreen = 1; } else if (STREQ(arg, "-localtime")) { def->clock.offset = VIR_DOMAIN_CLOCK_OFFSET_LOCALTIME; + } else if (STREQ(arg, "-enable-nesting")) { + def->features |= (1 << VIR_DOMAIN_FEATURE_NESTING); } else if (STREQ(arg, "-kernel")) { WANT_VALUE(); if (!(def->os.kernel = strdup(val))) diff -Naur libvirt-0.8.4/src/qemu/qemu_conf.h libvirt-0.8.4.edu/src/qemu/qemu_conf.h --- libvirt-0.8.4/src/qemu/qemu_conf.h 2010-08-31 10:44:13.000000000 -0300 +++ libvirt-0.8.4.edu/src/qemu/qemu_conf.h 2010-09-28 14:38:58.739788135 -0300 @@ -93,6 +93,8 @@ QEMUD_CMD_FLAG_NODEFCONFIG = (1LL << 37), /* -nodefconfig */ QEMUD_CMD_FLAG_BOOT_MENU = (1LL << 38), /* -boot menu=on support */ QEMUD_CMD_FLAG_ENABLE_KQEMU = (1LL << 39), /* -enable-kqemu flag */ + QEMUD_CMD_FLAG_NESTING = (1LL << 39), /* Is the -enable-nesting flag available */ + }; /* Main driver state */ -- *Eduardo Ramos* www.freedominterface.org +55 12 91051687 exten=>eduardo,1,hangup()

2 1

[libvirt] [PATCH] Added new attribute exportfs_type to filesystem element
by Harsh Prateek Bora 07 Oct '10

07 Oct '10

This patch introduces a new attribute export_fs to the filesystem element which specifies the type of export. Currently only 'local' type of exported filesystem is supported. More types like NFS, clusterFS, etc. can be added later as required. Note: This patch is based on the following two patches: 1) Daniel's patch to support 9pfs: https://www.redhat.com/archives/libvir-list/2010-September/msg00358.html 2) Another related patch to support 'security_model' attribute: https://www.redhat.com/archives/libvir-list/2010-September/msg00435.html Signed-off-by: Harsh Prateek Bora <harsh(a)linux.vnet.ibm.com> --- docs/schemas/domain.rng | 5 +++++ src/conf/domain_conf.c | 24 ++++++++++++++++++++++-- src/conf/domain_conf.h | 9 +++++++++ src/qemu/qemu_conf.c | 3 ++- 4 files changed, 38 insertions(+), 3 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index 43a292d..5b7563a 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -768,6 +768,11 @@ <value>none</value> </choice> </attribute> + <attribute name="exportfs_type"> + <choice> + <value>local</value> + </choice> + </attribute> </optional> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index a9881d1..6d728a7 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -166,6 +166,8 @@ VIR_ENUM_IMPL(virDomainFSSecurityModel, VIR_DOMAIN_FS_SECURITY_LAST, "mapped", "none") +VIR_ENUM_IMPL(virDomainFSExportType, VIR_DOMAIN_FS_EXPORT_TYPE_LAST, + "local") VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", @@ -1851,6 +1853,7 @@ virDomainFSDefParseXML(xmlNodePtr node, virDomainFSDefPtr def; xmlNodePtr cur; char *type = NULL; + char *exportfs_type = NULL; char *source = NULL; char *target = NULL; char *security_model; @@ -1871,6 +1874,17 @@ virDomainFSDefParseXML(xmlNodePtr node, def->type = VIR_DOMAIN_FS_TYPE_MOUNT; } + exportfs_type = virXMLPropString(node, "exportfs_type"); + if (exportfs_type) { + if ((def->exportfs_type = virDomainFSExportTypeTypeFromString(exportfs_type)) < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unknown exportfs type '%s'"), exportfs_type); + goto error; + } + } else { + def->exportfs_type = VIR_DOMAIN_FS_EXPORT_TYPE_LOCAL; + } + security_model = virXMLPropString(node, "security_model"); if (security_model) { if ((def->security_model = virDomainFSSecurityModelTypeFromString(security_model)) < 0) { @@ -5621,6 +5635,7 @@ virDomainFSDefFormat(virBufferPtr buf, { const char *type = virDomainFSTypeToString(def->type); const char *sec_model = virDomainFSSecurityModelTypeToString(def->security_model); + const char *expfs_type = virDomainFSExportTypeTypeToString(def->exportfs_type); if (!type) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, @@ -5628,6 +5643,11 @@ virDomainFSDefFormat(virBufferPtr buf, return -1; } + if (!expfs_type) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unexpected exportfs type %d"), def->type); + } + if (!sec_model) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, _("unexpected security model %d"), def->security_model); @@ -5636,8 +5656,8 @@ virDomainFSDefFormat(virBufferPtr buf, virBufferVSprintf(buf, - " <filesystem type='%s' security_model='%s'>\n", - type, sec_model); + " <filesystem type='%s' exportfs_type='%s' security_model='%s'>\n", + type, expfs_type, sec_model); if (def->src) { switch (def->type) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 6adf027..956cac0 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -245,10 +245,18 @@ enum virDomainFSSecurityModel { VIR_DOMAIN_FS_SECURITY_LAST }; +/* Export Filesystem Type */ +enum virDomainFSExportType { + VIR_DOMAIN_FS_EXPORT_TYPE_LOCAL, + + VIR_DOMAIN_FS_EXPORT_TYPE_LAST +}; + typedef struct _virDomainFSDef virDomainFSDef; typedef virDomainFSDef *virDomainFSDefPtr; struct _virDomainFSDef { int type; + int exportfs_type; int security_model; char *src; char *dst; @@ -1177,6 +1185,7 @@ VIR_ENUM_DECL(virDomainDiskErrorPolicy) VIR_ENUM_DECL(virDomainController) VIR_ENUM_DECL(virDomainControllerModel) VIR_ENUM_DECL(virDomainFS) +VIR_ENUM_DECL(virDomainFSExportType) VIR_ENUM_DECL(virDomainNet) VIR_ENUM_DECL(virDomainChrDevice) VIR_ENUM_DECL(virDomainChrChannelTarget) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 6b96d2f..458beab 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -2788,7 +2788,8 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, goto error; } - virBufferAddLit(&opt, "local"); + if (fs->exportfs_type == VIR_DOMAIN_FS_EXPORT_TYPE_LOCAL) + virBufferAddLit(&opt, "local"); if (fs->security_model == VIR_DOMAIN_FS_SECURITY_PASSTHROUGH) virBufferAddLit(&opt, ",security_model=passthrough"); else if (fs->security_model == VIR_DOMAIN_FS_SECURITY_MAPPED) -- 1.7.1.1

4 3

[libvirt] nwfilter: test code to provoke deadlock
by Stefan Berger 06 Oct '10

06 Oct '10

Attached are the bash scripts and xml files for provoking the deadlock. With the new patch applied the deadlock does not occur anymore. Regards, Stefan

1 0