[libvirt] libvirt current git & F18
by Gene Czarcinski
Anyone know of problems with the libvirt based on today's git and Fedora
18. Trying to rebuild some rpms which build fine on Fedora 17 fail on
Fedora 18. It appears that it may be related to xen-devel.
Gene
12 years
[libvirt] [PATCHv3 0/3] IPv6 enhancements; put dnsmasq parameters in conf-file
by Gene Czarcinski
Rebased 3 December 2012
These three patch files are packaged together because they serially
depend on each other. This version includes updates to add the ipv6='yes'
for enabling the guest-to-guest communications.
The DHCPv6 support checks dnsmasq's version and requires a minimum of 2.64.
Also, using dnsmasq for providing the RA service is checked against the
dnsmasq version and is currently 2.64. There are separate checks for DHCPv6
and Router Advertising support by dnsmasq.
As with IPv4, IPv6 DHCP is only one subnetwork on an interface. Additionally,
if other IPv6 addresses are defined, a warning message is issued since
the Router Advertisement service will support only state-full (DHCP) or
state-less (SLAAC) addressing on a network interface (not both). Thus, the
additional subnetworks will need to be manually configured to properly function.
If dnsmasq provides the RA service, it also points to itself as a RDNSS
(Recursive DNS Server) as part of the information is supplies.
If IPv6 DHCP is not being run, then SLAAC addressing is supported for
any IPv6 addresses specified.
Gene Czarcinski (3):
v2.0: allow guest to guest IPv6 without gateway definition
v8.2 add support for DHCPv6
v7.9: put dnsmasq parameters into conf-file
docs/formatnetwork.html.in | 136 ++++-
docs/schemas/network.rng | 22 +-
src/conf/network_conf.c | 108 ++--
src/conf/network_conf.h | 5 +
src/network/bridge_driver.c | 594 ++++++++++++++-------
src/network/bridge_driver.h | 7 +-
src/util/dnsmasq.c | 9 +-
tests/networkxml2argvdata/dhcp6-nat-network.argv | 14 +
tests/networkxml2argvdata/dhcp6-nat-network.xml | 24 +
tests/networkxml2argvdata/dhcp6-network.argv | 14 +
tests/networkxml2argvdata/dhcp6-network.xml | 14 +
.../dhcp6host-routed-network.argv | 12 +
.../dhcp6host-routed-network.xml | 19 +
tests/networkxml2argvdata/isolated-network.argv | 25 +-
.../networkxml2argvdata/nat-network-dns-hosts.argv | 14 +-
.../nat-network-dns-srv-record-minimal.argv | 34 +-
.../nat-network-dns-srv-record.argv | 24 +-
.../nat-network-dns-txt-record.argv | 22 +-
tests/networkxml2argvdata/nat-network.argv | 22 +-
tests/networkxml2argvdata/netboot-network.argv | 28 +-
.../networkxml2argvdata/netboot-proxy-network.argv | 26 +-
tests/networkxml2argvdata/routed-network.argv | 11 +-
tests/networkxml2argvtest.c | 47 +-
23 files changed, 876 insertions(+), 355 deletions(-)
create mode 100644 tests/networkxml2argvdata/dhcp6-nat-network.argv
create mode 100644 tests/networkxml2argvdata/dhcp6-nat-network.xml
create mode 100644 tests/networkxml2argvdata/dhcp6-network.argv
create mode 100644 tests/networkxml2argvdata/dhcp6-network.xml
create mode 100644 tests/networkxml2argvdata/dhcp6host-routed-network.argv
create mode 100644 tests/networkxml2argvdata/dhcp6host-routed-network.xml
--
1.7.11.7
12 years
[libvirt] [PATCH] dnsmasq: Fix parsing of the version number
by Michal Privoznik
If the debugging is enabled, the virCommand subsystem catches debug
messages in the command output as well. In that case, we can't assume
the string corresponding to command's stdout will start with specific
prefix. But the prefix can be moved deeper in the string. This bug
shows itself when parsing dnsmasq output:
2012-12-06 11:18:11.445+0000: 18491: error :
dnsmasqCapsSetFromBuffer:664 : internal error cannot parse
/usr/sbin/dnsmasq version number in '2012-12-06 11:11:02.232+0000:
18492: debug : virFileClose:72 : Closed fd 22'
We can clearly see that the output of dnsmasq --version
doesn't start with expected "Dnsmasq version " string but a libvirt
debug output.
---
src/util/dnsmasq.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/util/dnsmasq.c b/src/util/dnsmasq.c
index 4f210d2..de0293a 100644
--- a/src/util/dnsmasq.c
+++ b/src/util/dnsmasq.c
@@ -641,9 +641,9 @@ dnsmasqCapsSetFromBuffer(dnsmasqCapsPtr caps, const char *buf)
caps->noRefresh = true;
- p = STRSKIP(buf, DNSMASQ_VERSION_STR);
- if (!p)
+ if (!(p = strstr(buf, DNSMASQ_VERSION_STR)))
goto fail;
+ p += sizeof(DNSMASQ_VERSION_STR) - 1;
virSkipSpaces(&p);
if (virParseVersionString(p, &caps->version, true) < 0)
goto fail;
--
1.7.8.6
12 years
[libvirt] [PATCH 1/1] add vnc unix sockets to apparmor policy
by Serge Hallyn
When using vnc gaphics over a unix socket, virt-aa-helper needs to provide
access for the qemu domain to access the sockfile.
Signed-off-by: Serge Hallyn <serge.hallyn(a)ubuntu.com>
---
src/security/virt-aa-helper.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index e480b30..c6b9903 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1003,6 +1003,13 @@ get_files(vahControl * ctl)
if (vah_add_file(&buf, ctl->def->os.loader, "r") != 0)
goto clean;
+ for (i = 0; i < ctl->def->ngraphics; i++) {
+ if (ctl->def->graphics[i]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
+ ctl->def->graphics[i]->data.vnc.socket &&
+ vah_add_file(&buf, ctl->def->graphics[i]->data.vnc.socket, "rw"))
+ goto clean;
+ }
+
if (ctl->def->ngraphics == 1 &&
ctl->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL)
if (vah_add_file(&buf, ctl->def->graphics[0]->data.sdl.xauth,
--
1.7.10.4
12 years
[libvirt] add security hook for permitting hugetlbfs access (v2)
by Serge Hallyn
When a qemu domain is backed by huge pages, apparmor needs to grant the domain
rw access to files under the hugetlbfs mount point. Add a hook, called in
qemu_process.c, which ends up adding the read-write access through
virt-aa-helper. Qemu will be creating a randomly named file under the
mountpoint and unlinking it as soon as it has mmap()d it, therefore we
cannot predict the full pathname, but for the same reason it is generally
safe to provide access to $path/**.
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/646468
Changelog: (v2) use virBuffer in place of snprintf.
Index: libvirt/src/qemu/qemu_process.c
===================================================================
--- libvirt.orig/src/qemu/qemu_process.c 2012-12-06 11:50:48.354763986 -0600
+++ libvirt/src/qemu/qemu_process.c 2012-12-06 11:57:58.234773649 -0600
@@ -3475,6 +3475,15 @@
}
virDomainAuditSecurityLabel(vm, true);
+ if (driver->hugepage_path && vm->def->mem.hugepage_backed) {
+ if (virSecurityManagerSetHugepages(driver->securityManager,
+ vm->def, driver->hugepage_path) < 0) {
+ virReportError(VIR_ERR_INTERNAL_ERROR,
+ "%s", _("Unable to set huge path in security driver"));
+ goto cleanup;
+ }
+ }
+
/* Ensure no historical cgroup for this VM is lying around bogus
* settings */
VIR_DEBUG("Ensuring no historical cgroup is lying around");
Index: libvirt/src/security/security_apparmor.c
===================================================================
--- libvirt.orig/src/security/security_apparmor.c 2012-12-06 11:50:48.354763986 -0600
+++ libvirt/src/security/security_apparmor.c 2012-12-06 11:58:23.286774213 -0600
@@ -840,6 +840,31 @@
}
static int
+ApparmorSetHugepages(virSecurityManagerPtr mgr,
+ virDomainDefPtr def,
+ const char *path)
+{
+ const virSecurityLabelDefPtr secdef =
+ virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME);
+ int ret = -1;
+ virBuffer buf = VIR_BUFFER_INITIALIZER;
+ char *newpath;
+
+ if (!secdef)
+ return -1;
+
+ if (secdef->imagelabel == NULL)
+ return 0;
+
+ virBufferAsprintf(&buf, "%s/**", path);
+ newpath = virBufferCurrentContent(&buf);
+ if (newpath)
+ ret = reload_profile(mgr, def, newpath, true);
+ virBufferFreeAndReset(&buf);
+ return ret;
+}
+
+static int
AppArmorSetFDLabel(virSecurityManagerPtr mgr,
virDomainDefPtr def,
int fd)
@@ -908,4 +933,6 @@
.domainSetSecurityImageFDLabel = AppArmorSetFDLabel,
.domainSetSecurityTapFDLabel = AppArmorSetFDLabel,
+
+ .domainSetSecurityHugepages = ApparmorSetHugepages,
};
Index: libvirt/src/security/security_manager.c
===================================================================
--- libvirt.orig/src/security/security_manager.c 2012-12-06 11:50:48.354763986 -0600
+++ libvirt/src/security/security_manager.c 2012-12-06 11:57:58.238773649 -0600
@@ -511,3 +511,13 @@
list[1] = NULL;
return list;
}
+
+int virSecurityManagerSetHugepages(virSecurityManagerPtr mgr,
+ virDomainDefPtr vm,
+ const char *path)
+{
+ if (mgr->drv->domainSetSecurityHugepages)
+ return mgr->drv->domainSetSecurityHugepages(mgr, vm, path);
+
+ return 0;
+}
Index: libvirt/src/security/security_manager.h
===================================================================
--- libvirt.orig/src/security/security_manager.h 2012-12-06 11:50:48.354763986 -0600
+++ libvirt/src/security/security_manager.h 2012-12-06 11:57:58.238773649 -0600
@@ -112,5 +112,8 @@
virDomainDefPtr vm);
virSecurityManagerPtr*
virSecurityManagerGetNested(virSecurityManagerPtr mgr);
+int virSecurityManagerSetHugepages(virSecurityManagerPtr mgr,
+ virDomainDefPtr sec,
+ const char *hugepages_path);
#endif /* VIR_SECURITY_MANAGER_H__ */
Index: libvirt/src/security/security_driver.h
===================================================================
--- libvirt.orig/src/security/security_driver.h 2012-12-06 11:50:48.354763986 -0600
+++ libvirt/src/security/security_driver.h 2012-12-06 11:57:58.238773649 -0600
@@ -100,6 +100,9 @@
int fd);
typedef char *(*virSecurityDomainGetMountOptions) (virSecurityManagerPtr mgr,
virDomainDefPtr def);
+typedef int (*virSecurityDomainSetHugepages) (virSecurityManagerPtr mgr,
+ virDomainDefPtr def,
+ const char *path);
struct _virSecurityDriver {
size_t privateDataLen;
@@ -140,6 +143,7 @@
virSecurityDomainSetTapFDLabel domainSetSecurityTapFDLabel;
virSecurityDomainGetMountOptions domainGetSecurityMountOptions;
+ virSecurityDomainSetHugepages domainSetSecurityHugepages;
};
virSecurityDriverPtr virSecurityDriverLookup(const char *name,
Index: libvirt/src/libvirt_private.syms
===================================================================
--- libvirt.orig/src/libvirt_private.syms 2012-12-06 11:50:48.354763986 -0600
+++ libvirt/src/libvirt_private.syms 2012-12-06 11:57:58.238773649 -0600
@@ -1052,6 +1052,7 @@
virSecurityManagerStackAddNested;
virSecurityManagerVerify;
virSecurityManagerGetMountOptions;
+virSecurityManagerSetHugepages;
# sexpr.h
sexpr_append;
Index: libvirt/src/security/security_stack.c
===================================================================
--- libvirt.orig/src/security/security_stack.c 2012-12-06 11:50:48.354763986 -0600
+++ libvirt/src/security/security_stack.c 2012-12-06 11:57:58.238773649 -0600
@@ -462,6 +462,23 @@
return rc;
}
+static int
+virSecurityStackSetHugepages(virSecurityManagerPtr mgr,
+ virDomainDefPtr vm,
+ const char *path)
+{
+ virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr);
+ virSecurityStackItemPtr item = priv->itemsHead;
+ int rc = 0;
+
+ for (; item; item = item->next) {
+ if (virSecurityManagerSetHugepages(item->securityManager, vm, path) < 0)
+ rc = -1;
+ }
+
+ return rc;
+}
+
static char *virSecurityStackGetMountOptions(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED,
virDomainDefPtr vm ATTRIBUTE_UNUSED) {
return NULL;
@@ -529,4 +546,6 @@
.domainSetSecurityTapFDLabel = virSecurityStackSetTapFDLabel,
.domainGetSecurityMountOptions = virSecurityStackGetMountOptions,
+
+ .domainSetSecurityHugepages = virSecurityStackSetHugepages,
};
12 years
[libvirt] [PATCH] network: prevent a few invalid configuration combinations
by Laine Stump
This resolves: https://bugzilla.redhat.com/show_bug.cgi?id=767057
It was possible to define a network with <forward mode='bridge'> that
had both a bridge device and a forward device defined. These two are
mutually exclusive by definition (if you are using a bridge device,
then this is a host bridge, and if you have a forward dev defined,
this is using macvtap). It was also possible to put <ip>, <dns>, and
<domain> elements in this definition, although those aren't supported
by the current driver (although it's conceivable that some other
driver might support that).
The items that are invalid by definition, are now checked in the XML
parser (since they will definitely *always* be wrong), and the others
are checked in networkValidate() in the network driver (since, as
mentioned, it's possible that some other network driver, or even this
one, could some day support setting those).
---
src/conf/network_conf.c | 9 +++++++++
src/libvirt_private.syms | 1 +
src/network/bridge_driver.c | 29 +++++++++++++++++++++++++++++
3 files changed, 39 insertions(+)
diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index 6ce2e63..06932d8 100644
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -1577,6 +1577,15 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt)
def->name);
goto error;
}
+ if (def->bridge && (def->nForwardIfs || nForwardPfs)) {
+ virReportError(VIR_ERR_XML_ERROR,
+ _("A network with forward mode='%s' can specify "
+ "a bridge name or a forward dev, but not "
+ "both (network '%s')"),
+ virNetworkForwardTypeToString(def->forwardType),
+ def->name);
+ goto error;
+ }
break;
}
}
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 946bb20..bc01fe5 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -857,6 +857,7 @@ virNetworkDefParseString;
virNetworkDeleteConfig;
virNetworkFindByName;
virNetworkFindByUUID;
+virNetworkForwardTypeToString;
virNetworkIpDefNetmask;
virNetworkIpDefPrefix;
virNetworkList;
diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index e8be00a..0893e9b 100644
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -2733,6 +2733,35 @@ networkValidate(struct network_driver *driver,
return -1;
virNetworkSetBridgeMacAddr(def);
+ } else {
+ /* They are also the only types that currently support setting
+ * an IP address for the host-side device (bridge)
+ */
+ if (virNetworkDefGetIpByIndex(def, AF_UNSPEC, 0)) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Unsupported <ip> element in network %s "
+ "with forward mode='%s'"),
+ def->name,
+ virNetworkForwardTypeToString(def->forwardType));
+ return -1;
+ }
+ if (def->dns &&
+ (def->dns->ntxtrecords || def->dns->nhosts || def->dns->nsrvrecords)) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Unsupported <dns> element in network %s "
+ "with forward mode='%s'"),
+ def->name,
+ virNetworkForwardTypeToString(def->forwardType));
+ return -1;
+ }
+ if (def->domain) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("Unsupported <domain> element in network %s "
+ "with forward mode='%s'"),
+ def->name,
+ virNetworkForwardTypeToString(def->forwardType));
+ return -1;
+ }
}
/* We only support dhcp on one IPv4 address per defined network */
--
1.7.11.7
12 years
[libvirt] [PATCH] maint: Sort util source file definitions in makefile
by Peter Krempa
---
src/Makefile.am | 32 ++++++++++++++++----------------
1 file changed, 16 insertions(+), 16 deletions(-)
diff --git a/src/Makefile.am b/src/Makefile.am
index 1a2f94f..9aff77a 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -54,44 +54,37 @@ augeastest_DATA =
UTIL_SOURCES = \
util/bitmap.c util/bitmap.h \
util/buf.c util/buf.h \
+ util/cgroup.c util/cgroup.h \
util/command.c util/command.h \
util/conf.c util/conf.h \
- util/cgroup.c util/cgroup.h \
+ util/dnsmasq.c util/dnsmasq.h \
+ util/ebtables.c util/ebtables.h \
util/event.c util/event.h \
util/event_poll.c util/event_poll.h \
util/hooks.c util/hooks.h \
+ util/hostusb.c util/hostusb.h \
util/iptables.c util/iptables.h \
- util/ebtables.c util/ebtables.h \
- util/dnsmasq.c util/dnsmasq.h \
util/json.c util/json.h \
util/logging.c util/logging.h \
util/memory.c util/memory.h \
util/pci.c util/pci.h \
util/processinfo.c util/processinfo.h \
- util/hostusb.c util/hostusb.h \
util/sexpr.c util/sexpr.h \
util/stats_linux.c util/stats_linux.h \
util/storage_file.c util/storage_file.h \
util/sysinfo.c util/sysinfo.h \
- util/threads.c util/threads.h \
+ util/threadpool.c util/threadpool.h \
util/threads-pthread.h \
util/threads-win32.h \
- util/threadpool.c util/threadpool.h \
- util/uuid.c util/uuid.h \
+ util/threads.c util/threads.h \
util/util.c util/util.h \
+ util/uuid.c util/uuid.h \
util/viratomic.h util/viratomic.c \
util/viraudit.c util/viraudit.h \
util/virauth.c util/virauth.h \
util/virauthconfig.c util/virauthconfig.h \
- util/virfile.c util/virfile.h \
- util/virnodesuspend.c util/virnodesuspend.h \
- util/virobject.c util/virobject.h \
- util/virpidfile.c util/virpidfile.h \
- util/virprocess.c util/virprocess.h \
- util/virtypedparam.c util/virtypedparam.h \
- util/xml.c util/xml.h \
- util/virterror.c util/virterror_internal.h \
util/virdbus.c util/virdbus.h \
+ util/virfile.c util/virfile.h \
util/virhash.c util/virhash.h \
util/virhashcode.c util/virhashcode.h \
util/virinitctl.c util/virinitctl.h \
@@ -110,11 +103,18 @@ UTIL_SOURCES = \
util/virnetdevvlan.h util/virnetdevvlan.c \
util/virnetdevvportprofile.h util/virnetdevvportprofile.c \
util/virnetlink.c util/virnetlink.h \
+ util/virnodesuspend.c util/virnodesuspend.h \
+ util/virobject.c util/virobject.h \
+ util/virpidfile.c util/virpidfile.h \
+ util/virprocess.c util/virprocess.h \
util/virrandom.h util/virrandom.c \
util/virsocketaddr.h util/virsocketaddr.c \
util/virstring.h util/virstring.c \
+ util/virterror.c util/virterror_internal.h \
util/virtime.h util/virtime.c \
- util/viruri.h util/viruri.c
+ util/virtypedparam.c util/virtypedparam.h \
+ util/viruri.h util/viruri.c \
+ util/xml.c util/xml.h
EXTRA_DIST += $(srcdir)/util/virkeymaps.h $(srcdir)/util/keymaps.csv \
$(srcdir)/util/virkeycode-mapgen.py
--
1.8.0
12 years
[libvirt] [PATCH] dnsmasq: Fix parsing of the version number
by Michal Privoznik
If debugging is enabled, the debug messages are sent to stderr.
Moreover, if a command has catching of stderr set, the messages
gets mixed with stdout output (assuming both outputs are stored
in the same variable). The resulting string then doesn't
necessarily have to start with desired prefix then. This bug
exposes itself when parsing dnsmasq output:
2012-12-06 11:18:11.445+0000: 18491: error :
dnsmasqCapsSetFromBuffer:664 : internal error cannot parse
/usr/sbin/dnsmasq version number in '2012-12-06
11:11:02.232+0000: 18492: debug : virFileClose:72 : Closed fd 22'
We can clearly see that the output of dnsmasq --version doesn't
start with expected "Dnsmasq version " string but a libvirt debug
output.
---
src/util/dnsmasq.c | 2 --
1 files changed, 0 insertions(+), 2 deletions(-)
diff --git a/src/util/dnsmasq.c b/src/util/dnsmasq.c
index de0293a..a627ed2 100644
--- a/src/util/dnsmasq.c
+++ b/src/util/dnsmasq.c
@@ -715,7 +715,6 @@ dnsmasqCapsRefreshInternal(dnsmasqCapsPtr caps, bool force)
cmd = virCommandNewArgList(caps->binaryPath, "--version", NULL);
virCommandSetOutputBuffer(cmd, &version);
- virCommandSetErrorBuffer(cmd, &version);
virCommandAddEnvPassCommon(cmd);
virCommandClearCaps(cmd);
if (virCommandRun(cmd, NULL) < 0) {
@@ -727,7 +726,6 @@ dnsmasqCapsRefreshInternal(dnsmasqCapsPtr caps, bool force)
cmd = virCommandNewArgList(caps->binaryPath, "--help", NULL);
virCommandSetOutputBuffer(cmd, &help);
- virCommandSetErrorBuffer(cmd, &help);
virCommandAddEnvPassCommon(cmd);
virCommandClearCaps(cmd);
if (virCommandRun(cmd, NULL) < 0) {
--
1.7.8.6
12 years
