April 2012 - Devel - libvirt List Archives

[libvirt] [PATCH V3] nwfilter: Add support for ipset
by Stefan Berger 15 May '12

15 May '12

This patch adds support for the recent ipset iptables extension to libvirt's nwfilter subsystem. Ipset allows to maintain 'sets' of IP addresses, ports and other packet parameters and allows for faster lookup (in the order of O(1) vs. O(n)) and rule evaluation to achieve higher throughput than what can be achieved with individual iptables rules. On the command line iptables supports ipset using iptables ... -m set --match-set <ipset name> <flags> -j ... where 'ipset name' is the name of a previously created ipset and flags is a comma-separated list of up to 6 flags. Flags use 'src' and 'dst' for selecting IP addresses, ports etc. from the source or destination part of a packet. So a concrete example may look like this: iptables -A INPUT -m set --match-set test src,src -j ACCEPT Since ipset management is quite complex, the idea was to leave ipset management outside of libvirt but still allow users to reference an ipset. The user would have to make sure the ipset is available once the VM is started so that the iptables rule(s) referencing the ipset can be created. Using XML to describe an ipset in an nwfilter rule would then look as follows: <rule action='accept' direction='in'> <all ipset='test' ipsetflags='src,src'/> </rule> The two parameters on the command line are also the two distinct XML attributes 'ipset' and 'ipsetflags'. FYI: Here is the man page for ipset: https://ipset.netfilter.org/ipset.man.html Regards, Stefan --- v3: - use DATATYPE_IPSETNAME for the name of the ipset - adapted documentation for 0.9.12 v2: - split ipset description into ipset and ipsetflags attribute - improved on documentation --- docs/formatnwfilter.html.in | 64 ++++++++++++++ docs/schemas/nwfilter.rng | 23 +++++ src/conf/nwfilter_conf.c | 136 +++++++++++++++++++++++++++++- src/conf/nwfilter_conf.h | 13 ++ src/nwfilter/nwfilter_ebiptables_driver.c | 75 +++++++++++++++- tests/nwfilterxml2xmlin/ipset-test.xml | 24 +++++ tests/nwfilterxml2xmlout/ipset-test.xml | 24 +++++ tests/nwfilterxml2xmltest.c | 2 8 files changed, 356 insertions(+), 5 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -183,6 +183,8 @@ static const char dstportstart_str[] = " static const char dstportend_str[] = "dstportend"; static const char dscp_str[] = "dscp"; static const char state_str[] = "state"; +static const char ipset_str[] = "ipset"; +static const char ipsetflags_str[] = "ipsetflags"; #define SRCMACADDR srcmacaddr_str #define SRCMACMASK srcmacmask_str @@ -206,6 +208,8 @@ static const char state_str[] = " #define DSTPORTEND dstportend_str #define DSCP dscp_str #define STATE state_str +#define IPSET ipset_str +#define IPSETFLAGS ipsetflags_str /** @@ -980,6 +984,97 @@ tcpFlagsFormatter(virBufferPtr buf, return true; } +static bool +ipsetValidator(enum attrDatatype datatype ATTRIBUTE_UNUSED, union data *val, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, + nwItemDesc *item) +{ + const char *errmsg = NULL; + + if (virStrcpy(item->u.ipset.setname, val->c, + sizeof(item->u.ipset.setname)) == NULL) { + errmsg = _("ipset name is too long"); + goto arg_err_exit; + } + + if (item->u.ipset.setname[strspn(item->u.ipset.setname, + VALID_IPSETNAME)] != 0) { + errmsg = _("ipset name contains invalid characters"); + goto arg_err_exit; + } + + return true; + +arg_err_exit: + virNWFilterReportError(VIR_ERR_INVALID_ARG, + "%s", errmsg); + return false; +} + +static bool +ipsetFormatter(virBufferPtr buf, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, + nwItemDesc *item) +{ + virBufferAdd(buf, item->u.ipset.setname, -1); + + return true; +} + +static bool +ipsetFlagsValidator(enum attrDatatype datatype ATTRIBUTE_UNUSED, union data *val, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, nwItemDesc *item) +{ + const char *errmsg = NULL; + size_t idx = 0; + + item->u.ipset.numFlags = 0; + item->u.ipset.flags = 0; + + errmsg = _("malformed ipset flags"); + + while (item->u.ipset.numFlags < 6) { + if (STRCASEEQLEN(&val->c[idx], "src", 3)) { + item->u.ipset.flags |= (1 << item->u.ipset.numFlags); + } else if (!STRCASEEQLEN(&val->c[idx], "dst", 3)) { + goto arg_err_exit; + } + item->u.ipset.numFlags++; + idx += 3; + if (val->c[idx] != ',') + break; + idx++; + } + + if (val->c[idx] != '\0') + goto arg_err_exit; + + return true; + +arg_err_exit: + virNWFilterReportError(VIR_ERR_INVALID_ARG, + "%s", errmsg); + return false; +} + +static bool +ipsetFlagsFormatter(virBufferPtr buf, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, + nwItemDesc *item) +{ + uint8_t ctr; + + for (ctr = 0; ctr < item->u.ipset.numFlags; ctr++) { + if (ctr != 0) + virBufferAddLit(buf, ","); + if ((item->u.ipset.flags & (1 << ctr))) + virBufferAddLit(buf, "src"); + else + virBufferAddLit(buf, "dst"); + } + + return true; +} #define COMMON_MAC_PROPS(STRUCT) \ {\ @@ -1411,6 +1506,20 @@ static const virXMLAttr2Struct ipv6Attri .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataState),\ .validator = stateValidator,\ .formatter = stateFormatter,\ + },\ + {\ + .name = IPSET,\ + .datatype = DATATYPE_IPSETNAME,\ + .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataIPSet),\ + .validator = ipsetValidator,\ + .formatter = ipsetFormatter,\ + },\ + {\ + .name = IPSETFLAGS,\ + .datatype = DATATYPE_IPSETFLAGS,\ + .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataIPSetFlags),\ + .validator = ipsetFlagsValidator,\ + .formatter = ipsetFlagsFormatter,\ } #define COMMON_PORT_PROPS(STRUCT) \ @@ -1853,6 +1962,8 @@ virNWFilterRuleDetailsParse(xmlNodePtr n break; case DATATYPE_STRING: + case DATATYPE_IPSETFLAGS: + case DATATYPE_IPSETNAME: if (!validator) { /* not supported */ rc = -1; @@ -1964,6 +2075,19 @@ err_exit: goto cleanup; } +static void +virNWFilterRuleDefFixupIPSet(ipHdrDataDefPtr ipHdr) +{ + if (HAS_ENTRY_ITEM(&ipHdr->dataIPSet) && + !HAS_ENTRY_ITEM(&ipHdr->dataIPSetFlags)) { + ipHdr->dataIPSetFlags.flags = NWFILTER_ENTRY_ITEM_FLAG_EXISTS; + ipHdr->dataIPSetFlags.u.ipset.numFlags = 1; + ipHdr->dataIPSetFlags.u.ipset.flags = 1; + } else { + ipHdr->dataIPSet.flags = 0; + ipHdr->dataIPSetFlags.flags = 0; + } +} static void virNWFilterRuleDefFixup(virNWFilterRuleDefPtr rule) @@ -2017,6 +2141,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.ipHdrFilter.ipHdr.dataSrcIPAddr); COPY_NEG_SIGN(rule->p.ipHdrFilter.ipHdr.dataDstIPMask, rule->p.ipHdrFilter.ipHdr.dataDstIPAddr); + virNWFilterRuleDefFixupIPSet(&rule->p.ipHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_IPV6: @@ -2024,6 +2149,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.ipv6HdrFilter.ipHdr.dataSrcIPAddr); COPY_NEG_SIGN(rule->p.ipv6HdrFilter.ipHdr.dataDstIPMask, rule->p.ipv6HdrFilter.ipHdr.dataDstIPAddr); + virNWFilterRuleDefFixupIPSet(&rule->p.ipv6HdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ARP: @@ -2047,6 +2173,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.tcpHdrFilter.portData.dataSrcPortStart); COPY_NEG_SIGN(rule->p.tcpHdrFilter.portData.dataDstPortEnd, rule->p.tcpHdrFilter.portData.dataSrcPortStart); + virNWFilterRuleDefFixupIPSet(&rule->p.tcpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_UDP: @@ -2065,6 +2192,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.udpHdrFilter.portData.dataSrcPortStart); COPY_NEG_SIGN(rule->p.udpHdrFilter.portData.dataDstPortEnd, rule->p.udpHdrFilter.portData.dataSrcPortStart); + virNWFilterRuleDefFixupIPSet(&rule->p.udpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_UDPLITE: @@ -2077,6 +2205,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.udpliteHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.udpliteHdrFilter.ipHdr.dataDstIPTo, rule->p.udpliteHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.udpliteHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ESP: @@ -2089,6 +2218,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.espHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.espHdrFilter.ipHdr.dataDstIPTo, rule->p.espHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.espHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_AH: @@ -2101,6 +2231,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.ahHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.ahHdrFilter.ipHdr.dataDstIPTo, rule->p.ahHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.ahHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_SCTP: @@ -2119,6 +2250,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.sctpHdrFilter.portData.dataSrcPortStart); COPY_NEG_SIGN(rule->p.sctpHdrFilter.portData.dataDstPortEnd, rule->p.sctpHdrFilter.portData.dataSrcPortStart); + virNWFilterRuleDefFixupIPSet(&rule->p.sctpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ICMP: @@ -2133,6 +2265,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.icmpHdrFilter.ipHdr.dataDstIPFrom); COPY_NEG_SIGN(rule->p.icmpHdrFilter.dataICMPCode, rule->p.icmpHdrFilter.dataICMPType); + virNWFilterRuleDefFixupIPSet(&rule->p.icmpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ALL: @@ -2156,6 +2289,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.igmpHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.igmpHdrFilter.ipHdr.dataDstIPTo, rule->p.igmpHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.igmpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_LAST: @@ -3120,7 +3254,7 @@ virNWFilterRuleDefDetailsFormat(virBuffe virBufferAsprintf(buf, " %s='", att[i].name); - if (att[i].formatter) { + if (att[i].formatter && !(flags & NWFILTER_ENTRY_ITEM_FLAG_HAS_VAR)) { if (!att[i].formatter(buf, def, item)) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("formatter for %s %s reported error"), Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -103,8 +103,10 @@ enum attrDatatype { DATATYPE_BOOLEAN = (1 << 12), DATATYPE_UINT32 = (1 << 13), DATATYPE_UINT32_HEX = (1 << 14), + DATATYPE_IPSETNAME = (1 << 15), + DATATYPE_IPSETFLAGS = (1 << 16), - DATATYPE_LAST = (1 << 15), + DATATYPE_LAST = (1 << 17), }; # define NWFILTER_MAC_BGA "01:80:c2:00:00:00" @@ -136,9 +138,16 @@ struct _nwItemDesc { uint8_t mask; uint8_t flags; } tcpFlags; + struct { + char setname[32]; + uint8_t numFlags; + uint8_t flags; + } ipset; } u; }; +# define VALID_IPSETNAME \ + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:-+ " typedef struct _ethHdrDataDef ethHdrDataDef; typedef ethHdrDataDef *ethHdrDataDefPtr; @@ -232,6 +241,8 @@ struct _ipHdrDataDef { nwItemDesc dataState; nwItemDesc dataConnlimitAbove; nwItemDesc dataComment; + nwItemDesc dataIPSet; + nwItemDesc dataIPSetFlags; }; Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -256,10 +256,13 @@ static int _printDataType(virNWFilterVarCombIterPtr vars, char *buf, int bufsize, nwItemDescPtr item, - bool asHex) + bool asHex, bool directionIn) { int done; char *data; + uint8_t ctr; + virBuffer vb = VIR_BUFFER_INITIALIZER; + char *flags; if (printVar(vars, buf, bufsize, item, &done) < 0) return -1; @@ -346,6 +349,44 @@ _printDataType(virNWFilterVarCombIterPtr } break; + case DATATYPE_IPSETNAME: + snprintf(buf, bufsize, "%s", item->u.ipset.setname); + break; + + case DATATYPE_IPSETFLAGS: + for (ctr = 0; ctr < item->u.ipset.numFlags; ctr++) { + if (ctr != 0) + virBufferAddLit(&vb, ","); + if ((item->u.ipset.flags & (1 << ctr))) { + if (directionIn) + virBufferAddLit(&vb, "dst"); + else + virBufferAddLit(&vb, "src"); + } else { + if (directionIn) + virBufferAddLit(&vb, "src"); + else + virBufferAddLit(&vb, "dst"); + } + } + + if (virBufferError(&vb)) { + virReportOOMError(); + virBufferFreeAndReset(&vb); + return -1; + } + + flags = virBufferContentAndReset(&vb); + + if (snprintf(buf, bufsize, "%s", flags) >= bufsize) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Buffer too small for IPSETFLAGS type")); + VIR_FREE(flags); + return -1; + } + VIR_FREE(flags); + break; + default: virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Unhandled datatype %x"), item->datatype); @@ -362,16 +403,23 @@ printDataType(virNWFilterVarCombIterPtr char *buf, int bufsize, nwItemDescPtr item) { - return _printDataType(vars, buf, bufsize, item, 0); + return _printDataType(vars, buf, bufsize, item, 0, 0); } +static int +printDataTypeDirection(virNWFilterVarCombIterPtr vars, + char *buf, int bufsize, + nwItemDescPtr item, bool directionIn) +{ + return _printDataType(vars, buf, bufsize, item, 0, directionIn); +} static int printDataTypeAsHex(virNWFilterVarCombIterPtr vars, char *buf, int bufsize, nwItemDescPtr item) { - return _printDataType(vars, buf, bufsize, item, 1); + return _printDataType(vars, buf, bufsize, item, 1, 0); } @@ -927,6 +975,7 @@ iptablesHandleIpHdr(virBufferPtr buf, char ipaddr[INET6_ADDRSTRLEN], number[MAX(INT_BUFSIZE_BOUND(uint32_t), INT_BUFSIZE_BOUND(int))]; + char str[200]; const char *src = "--source"; const char *dst = "--destination"; const char *srcrange = "--src-range"; @@ -938,6 +987,26 @@ iptablesHandleIpHdr(virBufferPtr buf, dstrange = "--src-range"; } + if (HAS_ENTRY_ITEM(&ipHdr->dataIPSet) && + HAS_ENTRY_ITEM(&ipHdr->dataIPSetFlags)) { + + if (printDataType(vars, + str, sizeof(str), + &ipHdr->dataIPSet) < 0) + goto err_exit; + + virBufferAsprintf(afterStateMatch, + " -m set --match-set \"%s\" ", + str); + + if (printDataTypeDirection(vars, + str, sizeof(str), + &ipHdr->dataIPSetFlags, directionIn) < 0) + goto err_exit; + + virBufferAdd(afterStateMatch, str, -1); + } + if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPAddr)) { if (printDataType(vars, Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -485,6 +485,14 @@ <ref name="stateflags-type"/> </attribute> </optional> + <optional> + <attribute name="ipset"> + <ref name="ipset-type"/> + </attribute> + <attribute name="ipsetflags"> + <ref name="ipsetflags-type"/> + </attribute> + </optional> </interleave> </define> @@ -1060,4 +1068,19 @@ <param name="pattern">((SYN|ACK|URG|PSH|FIN|RST)(,(SYN|ACK|URG|PSH|FIN|RST))*|ALL|NONE)/((SYN|ACK|URG|PSH|FIN|RST)(,(SYN|ACK|URG|PSH|FIN|RST))*|ALL|NONE)</param> </data> </define> + + <define name='ipset-type'> + <choice> + <ref name="variable-name-type"/> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_\.:\-\+]{1,31}</param> + </data> + </choice> + </define> + + <define name='ipsetflags-type'> + <data type="string"> + <param name="pattern">(src|dst)(,(src|dst)){0,5}</param> + </data> + </define> </grammar> Index: libvirt-acl/tests/nwfilterxml2xmlin/ipset-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipset-test.xml @@ -0,0 +1,24 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all ipset='test' ipsetflags='src,dst' /> + </rule> + <rule action='accept' direction='in'> + <all state='NONE' ipset='test' ipsetflags='src,dst' comment='in+NONE'/> + </rule> + <rule action='accept' direction='out'> + <all state='NONE' ipset='test' ipsetflags='src,dst' comment='out+NONE'/> + </rule> + <rule action='accept' direction='in'> + <all ipset='test' ipsetflags='SRC,DST,SRC' /> + </rule> + <rule action='accept' direction='in'> + <all ipset='test:_.-+' ipsetflags='SRC,dSt,SRC' /> + </rule> + <rule action='accept' direction='in'> + <all ipset='$IPSETNAME' ipsetflags='src,dst' /> + </rule> + <rule action='accept' direction='inout'> + <all ipset='$IPSETNAME' ipsetflags='src,dst' comment='inout'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/ipset-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipset-test.xml @@ -0,0 +1,24 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out' priority='500'> + <all ipset='test' ipsetflags='src,dst'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all state='NONE' ipset='test' ipsetflags='src,dst' comment='in+NONE'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <all state='NONE' ipset='test' ipsetflags='src,dst' comment='out+NONE'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all ipset='test' ipsetflags='src,dst,src'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all ipset='test:_.-+' ipsetflags='src,dst,src'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all ipset='$IPSETNAME' ipsetflags='src,dst'/> + </rule> + <rule action='accept' direction='inout' priority='500'> + <all ipset='$IPSETNAME' ipsetflags='src,dst' comment='inout'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -157,6 +157,8 @@ mymain(void) DO_TEST("iter-test2", false); DO_TEST("iter-test3", false); + DO_TEST("ipset-test", false); + return ret==0 ? EXIT_SUCCESS : EXIT_FAILURE; } Index: libvirt-acl/docs/formatnwfilter.html.in =================================================================== --- libvirt-acl.orig/docs/formatnwfilter.html.in +++ libvirt-acl/docs/formatnwfilter.html.in @@ -528,6 +528,10 @@ <li>IPV6_MASK: IPv6 mask in numbers format (FFFF:FFFF:FC00::) or CIDR mask (0-128)</li> <li>STRING: A string</li> <li>BOOLEAN: 'true', 'yes', '1' or 'false', 'no', '0'</li> + <li>IPSETFLAGS: The source and destination flags of the ipset described + by up to 6 'src' or 'dst' elements selecting features from either + the source or destination part of the packet header; example: + src,src,dst</li> </ul> @@ -1169,6 +1173,16 @@ <td>STRING</td> <td>TCP-only: format of mask/flags with mask and flags each being a comma separated list of SYN,ACK,URG,PSH,FIN,RST or NONE or ALL</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1269,6 +1283,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1358,6 +1382,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1459,6 +1493,16 @@ <td>STRING</td> <td>TCP-only: format of mask/flags with mask and flags each being a comma separated list of SYN,ACK,URG,PSH,FIN,RST or NONE or ALL</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1545,6 +1589,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1619,6 +1673,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table>

2 3

[libvirt] [PATCH 0/2] Rework RPC message buffer
by Michal Privoznik 14 May '12

14 May '12

This patch set tries to fix corner cases where libvirt runs on huge system, e.g. 4K CPU monster. In these cases, capabilities XML is enormously big, as we are transferring info about each singe CPU core (to which NUMA node it belongs, etc.). This XML is bigger than our RPC limit, therefore users cannot get it as it is dropped on server, leaving them with inability to connect. Therefore we need to increase those limits (whole RPC message and RPC string). However, simple lifting up will work, but increase mem usage. Therefore I've reworked RPC buffer handling: changed it from 'statically' to dynamically allocated. So in most cases - when small messages are sent - this will even decrease our memory consumption. Leaving us flexible for corner cases described above. On the other hand, I realize we've had our history with RPC breakage. So I think I'll require more than 1 ACK before pushing. What's your opinion? Michal Privoznik (2): rpc: Switch to dynamically allocated message buffer rpc: Size up RPC limits src/remote/remote_protocol.x | 2 +- src/rpc/virnetclient.c | 16 ++- src/rpc/virnetmessage.c | 12 ++- src/rpc/virnetmessage.h | 6 +- src/rpc/virnetprotocol.x | 6 +- src/rpc/virnetserverclient.c | 20 ++- tests/virnetmessagetest.c | 393 +++++++++++++++++++++++------------------- 7 files changed, 268 insertions(+), 187 deletions(-) -- 1.7.8.5

3 10

[libvirt] [PATCH] docs: Serialize running apibuild.py
by Cole Robinson 11 May '12

11 May '12

Use a witness file approach like we do for python/generator.py, as suggested by Eric. Fixes the build issue reported here: https://www.redhat.com/archives/libvir-list/2012-April/msg01435.html Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- .gitignore | 1 + docs/Makefile.am | 12 ++++++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 14a21d0..3cc30e8 100644 --- a/.gitignore +++ b/.gitignore @@ -54,6 +54,7 @@ /daemon/libvirtd.init /daemon/libvirtd.pod /daemon/libvirtd.service +/docs/apibuild.py.stamp /docs/devhelp/libvirt.devhelp /docs/hvsupport.html.in /docs/libvirt-api.xml diff --git a/docs/Makefile.am b/docs/Makefile.am index 53328f7..9bcc866 100644 --- a/docs/Makefile.am +++ b/docs/Makefile.am @@ -200,12 +200,19 @@ python_generated_files = \ $(srcdir)/libvirt-qemu-api.xml \ $(srcdir)/libvirt-qemu-refs.xml -$(python_generated_files): $(srcdir)/apibuild.py \ +APIBUILD="$(srcdir)/apibuild.py" +APIBUILD_STAMP="$(APIBUILD).stamp" + +$(python_generated_files): $(APIBUILD_STAMP) + +$(APIBUILD_STAMP): $(srcdir)/apibuild.py \ $(srcdir)/../include/libvirt/*.h \ $(srcdir)/../src/libvirt.c \ $(srcdir)/../src/libvirt-qemu.c \ $(srcdir)/../src/util/virterror.c - $(AM_V_GEN)srcdir=$(srcdir) $(PYTHON) $(srcdir)/apibuild.py + $(AM_V_GEN)srcdir=$(srcdir) $(PYTHON) $(APIBUILD) + touch $@ + check-local: all @@ -215,6 +222,7 @@ clean-local: maintainer-clean-local: clean-local rm -rf $(srcdir)/libvirt-api.xml $(srcdir)/libvirt-refs.xml todo.html.in hvsupport.html.in rm -rf $(srcdir)/libvirt-qemu-api.xml $(srcdir)/libvirt-qemu-refs.xml + rm -rf $(APIBUILD_STAMP) rebuild: api qemu_api all -- 1.7.7.6

4 5

[libvirt] [PATCH] docs: mention migration issue of which credentials are used
by Eric Blake 10 May '12

10 May '12

Based on a report by Seth Vidal. Just because _you_ can use virsh to connect to both source and destinations does not mean that libvirtd on the source (aka _root_) can likewise connect to the destination; this matters when setting up a peer-to-peer migration instead of a native one. * docs/migration.html.in: Mention that in peer-to-peer, the owner of the source libvirtd (usually root) must be able to connect to the destination. --- docs/migration.html.in | 22 ++++++++++++++++++---- 1 files changed, 18 insertions(+), 4 deletions(-) diff --git a/docs/migration.html.in b/docs/migration.html.in index 9d9d9b9..6a0483d 100644 --- a/docs/migration.html.in +++ b/docs/migration.html.in @@ -87,7 +87,13 @@ daemon controls the entire migration process itself, by directly connecting the destination host libvirtd. If the client application crashes, or otherwise loses its connection to libvirtd, the migration process - will continue uninterrupted until completion. + will continue uninterrupted until completion. Note that the + source libvirtd uses its own credentials to connect to the + destination (typically root), rather than the credentials used + by the client to connect to the host; if these differ, it is + common to run into a situation where a client can connect to the + destination directly but the host cannot make the connection to + set up the peer-to-peer migration. @@ -139,7 +145,9 @@ connection to the source host, where the virtual guest is currently running. The second URI is that of the libvirt connection to the destination host, where the virtual guest - will be moved to. The third URI is a hypervisor specific + will be moved to (and in peer-to-peer migrations, this is from + the perspective of the source, not the client). The third URI is + a hypervisor specific URI used to control how the guest will be migrated. With any managed migration flow, the first and second URIs are compulsory, while the third URI is optional. With the @@ -533,7 +541,10 @@ destination libvirtd server will automatically determine the native hypervisor URI for migration, based off the primary hostname. There is no scope for forcing an alternative - network interface for the native migration data with this method. + network interface for the native migration data with this + method. The destination URI must be reachable using the source + libvirtd credentials (which are not necessarily the same as the + credentials of the client in connecting to the source). <pre> @@ -571,7 +582,10 @@ in case it is not accessible using the same address that the client uses to connect to the destination, or a different encryption/auth scheme is required. The native hypervisor URI - format is not used at all. + format is not used at all. The destination URI must be + reachable using the source libvirtd credentials (which are not + necessarily the same as the credentials of the client in + connecting to the source). <pre> -- 1.7.7.6

2 3

[libvirt] [PATCHv2 0/2] a new flag VIR_DOMAIN_CPU_STATS_VCPU
by Hu Tao 09 May '12

09 May '12

From: root <root(a)KERNEL-128.(none)> This series adds a new flag VIR_DOMAIN_CPU_STATS_VCPU to virDomainGetCPUStats, which is for getting statistics of physical cpu time consumed by virtual cpus. Changes: v2: - added detailed documentation - added some error checks and fix some memleaks - the two patches rearranged slightly Hu Tao (2): Add a new flag VIR_DOMAIN_CPU_STATS_VCPU to virDomainGetCPUStats Adds support to VIR_DOMAIN_CPU_STATS_VCPU in qemu_driver. include/libvirt/libvirt.h.in | 8 ++ src/libvirt.c | 9 ++- src/qemu/qemu_driver.c | 186 ++++++++++++++++++++++++++++++++++++++---- src/util/cgroup.c | 4 +- tools/virsh.c | 16 +++- 5 files changed, 199 insertions(+), 24 deletions(-)

3 9

[libvirt] [PATCH libvirt 1/3] build: do not build shunloadtest if pthread missing
by Marc-André Lureau 08 May '12

08 May '12

Fixes build on Windows systems --- configure.ac | 2 ++ tests/Makefile.am | 8 +++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 89fe818..347c48c 100644 --- a/configure.ac +++ b/configure.ac @@ -154,6 +154,8 @@ AC_CHECK_FUNC([clock_gettime],[ LIBS=$old_libs AC_SUBST(RT_LIBS) +AM_CONDITIONAL([HAVE_PTHREAD], [test x"$HAVE_PTHREAD_H" = x"1"]) + dnl Availability of various common headers (non-fatal if missing). AC_CHECK_HEADERS([pwd.h paths.h regex.h sys/un.h \ sys/poll.h syslog.h mntent.h net/ethernet.h linux/magic.h \ diff --git a/tests/Makefile.am b/tests/Makefile.am index c4d550f..3d9235c 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -98,7 +98,7 @@ test_programs = virshtest sockettest \ nodeinfotest virbuftest \ commandtest seclabeltest \ virhashtest virnetmessagetest virnetsockettest \ - utiltest virnettlscontexttest shunloadtest \ + utiltest virnettlscontexttest \ virtimetest viruritest virkeyfiletest \ virauthconfigtest @@ -106,6 +106,10 @@ test_programs = virshtest sockettest \ ssh_SOURCES = ssh.c ssh_LDADD = $(COVERAGE_LDFLAGS) +if HAVE_PTHREAD +test_programs += shunloadtest +endif + if WITH_XEN test_programs += xml2sexprtest sexpr2xmltest \ xmconfigtest xencapstest statstest reconnect @@ -527,10 +531,12 @@ libshunload_la_SOURCES = shunloadhelper.c libshunload_la_LIBADD = ../src/libvirt.la libshunload_la_LDFLAGS = -module -avoid-version -rpath /evil/libtool/hack/to/force/shared/lib/creation +if HAVE_PTHREAD shunloadtest_SOURCES = \ shunloadtest.c shunloadtest_LDADD = -lpthread shunloadtest_DEPENDENCIES = libshunload.la +endif if WITH_CIL CILOPTFLAGS = -- 1.7.10

3 12

[libvirt] [PATCHv6 0/8] live block migration
by Eric Blake 07 May '12

07 May '12

v5: https://www.redhat.com/archives/libvir-list/2012-April/msg00753.html Differences in v6: - rebased on top of accepted patches v5:1-4/23 and latest tree - corresponds to patches v5:7-14/23 - patch 5/8 is new - patch v5:12/23 is dropped; qemu is giving us something better, but I still need to finish writing that patch - patch v5:11/23 comments were incorporated, with better cleanup on error - tweak series to deal with potential for qemu 1.1 to support copy but not pivot - limit series to just the bare minimum for now; patches from v5:15/23 are still on my tree, but not worth submitting until we know more about what qemu will provide I'm posting this more for reference for my efforts to backport this to RHEL 6 where I have tested against a candidate qemu build, and don't this is ready for upstream until we have confirmation that actual patches have gone into at least the qemu block queue for 1.1. Eric Blake (8): blockjob: react to active block copy blockjob: add qemu capabilities related to block jobs blockjob: return appropriate event and info blockjob: support pivot operation on cancel blockjob: make drive-reopen safer blockjob: implement block copy for qemu blockjob: allow for existing files blockjob: allow mirroring under SELinux src/conf/domain_conf.c | 12 ++ src/conf/domain_conf.h | 1 + src/libvirt_private.syms | 1 + src/qemu/qemu_capabilities.c | 3 + src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_driver.c | 396 +++++++++++++++++++++++++++++++++++++++++- src/qemu/qemu_hotplug.c | 7 + src/qemu/qemu_monitor.c | 37 ++++ src/qemu/qemu_monitor.h | 11 ++ src/qemu/qemu_monitor_json.c | 67 +++++++ src/qemu/qemu_monitor_json.h | 18 ++- 11 files changed, 549 insertions(+), 6 deletions(-) -- 1.7.7.6

3 15

[libvirt] [PATCH 1/1] Support libnl-3 as well as libnl-1
by Serge Hallyn 03 May '12

03 May '12

configure.ac: Check for libnl-3. If found, find libnl-route-3. If not found, do the original check to look for libnl-1. src/util/virnetlink.c: support libnl3 api. I could play games to make the patch smaller, but this would just hide what is actually needing to be done at the expense of clarity. src/Makefile.am and daemon/Makefile.am: Add LIBNL_ROUTE3_{LIBS,CFLAGS} Unfortunately libnl3 moves netlink/msg.h to /usr/include/libnl3/netlink/msg.h, which is the reason why the LIBNL_CFLAGS need to be added to a bunch of places where they weren't needed with libnl1. Those spots probaby don't actually need to also have LIBNL*LIBS added, but while I may be looking at it wrong, it seemed right to do so. I haven't gotten as far as to compile this into a package on ubuntu, but the source does build with libnl-3 as well as with libnl-1. Signed-off-by: Serge Hallyn <serge.hallyn(a)canonical.com> --- configure.ac | 24 ++++++++++++----- daemon/Makefile.am | 5 +++- src/Makefile.am | 25 ++++++++++++------ src/util/virnetlink.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 108 insertions(+), 16 deletions(-) diff --git a/configure.ac b/configure.ac index a819898..ab40e1d 100644 --- a/configure.ac +++ b/configure.ac @@ -2626,19 +2626,29 @@ AM_CONDITIONAL([WITH_VIRTUALPORT], [test "$with_virtualport" = "yes"]) dnl netlink library +LIBNL_ROUTE3_CFLAGS="" +LIBNL_ROUTE3_LIBS="" LIBNL_CFLAGS="" LIBNL_LIBS="" have_libnl=no if test "$with_linux" = "yes"; then - PKG_CHECK_MODULES([LIBNL], [libnl-1 >= $LIBNL_REQUIRED], [ + PKG_CHECK_MODULES([LIBNL],[libnl-3.0],[ have_libnl=yes - AC_DEFINE_UNQUOTED([HAVE_LIBNL], 1, [whether the netlink library is available]) - ], [ - if test "$with_macvtap" = "yes"; then - AC_MSG_ERROR([libnl-devel >= $LIBNL_REQUIRED is required for macvtap support]) - fi - ]) + AC_DEFINE([HAVE_LIBNL3], [1], [Use libnl-3.0]) + AC_DEFINE([HAVE_LIBNL], [1], [whether the netlink library is available]) + PKG_CHECK_MODULES([LIBNL_ROUTE3],[libnl-route-3.0]) + ], + PKG_CHECK_MODULES([LIBNL], [libnl-1 >= $LIBNL_REQUIRED], [ + have_libnl=yes + AC_DEFINE_UNQUOTED([HAVE_LIBNL], 1, [whether the netlink library is available]) + AC_DEFINE_UNQUOTED([HAVE_LIBNL1], 1, [whether the netlink v1 library is available]) + ], [ + if test "$with_macvtap" = "yes"; then + AC_MSG_ERROR([libnl-devel >= $LIBNL_REQUIRED is required for macvtap support]) + fi + ]) + ) fi AM_CONDITIONAL([HAVE_LIBNL], [test "$have_libnl" = "yes"]) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 24cce8f..8074803 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -95,6 +95,7 @@ libvirtd_SOURCES = $(DAEMON_SOURCES) libvirtd_CFLAGS = \ $(LIBXML_CFLAGS) $(GNUTLS_CFLAGS) $(SASL_CFLAGS) \ $(XDR_CFLAGS) $(POLKIT_CFLAGS) $(DBUS_CFLAGS) \ + $(LIBNL_CFLAGS) $(LIBNL_ROUTE3_CFLAGS) \ $(WARN_CFLAGS) \ $(COVERAGE_CFLAGS) \ -DQEMUD_PID_FILE="\"$(QEMUD_PID_FILE)\"" \ @@ -109,7 +110,9 @@ libvirtd_LDADD = \ $(GNUTLS_LIBS) \ $(SASL_LIBS) \ $(DBUS_LIBS) \ - $(POLKIT_LIBS) + $(POLKIT_LIBS) \ + $(LIBNL_LIBS) \ + $(LIBNL_ROUTE3_LIBS) if WITH_DTRACE_PROBES libvirtd_LDADD += ../src/probes.o diff --git a/src/Makefile.am b/src/Makefile.am index e48dfa5..c159c1e 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -576,10 +576,10 @@ libvirt_util_la_SOURCES = \ $(UTIL_SOURCES) libvirt_util_la_CFLAGS = $(CAPNG_CFLAGS) $(YAJL_CFLAGS) $(LIBNL_CFLAGS) \ $(AM_CFLAGS) $(AUDIT_CFLAGS) $(DEVMAPPER_CFLAGS) \ - $(DBUS_CFLAGS) + $(DBUS_CFLAGS) $(LIBNL_ROUTE3_CFLAGS) libvirt_util_la_LIBADD = $(CAPNG_LIBS) $(YAJL_LIBS) $(LIBNL_LIBS) \ $(THREAD_LIBS) $(AUDIT_LIBS) $(DEVMAPPER_LIBS) \ - $(RT_LIBS) $(DBUS_LIBS) + $(RT_LIBS) $(DBUS_LIBS) $(LIBNL_ROUTE3_LIBS) noinst_LTLIBRARIES += libvirt_conf.la @@ -809,12 +809,16 @@ endif libvirt_driver_qemu_la_CFLAGS = $(NUMACTL_CFLAGS) \ $(GNUTLS_CFLAGS) \ $(LIBXML_CFLAGS) \ + $(LIBNL_CFLAGS) \ + $(LIBNL_ROUTE3_CFLAGS) \ -I$(top_srcdir)/src/conf $(AM_CFLAGS) libvirt_driver_qemu_la_LDFLAGS = $(AM_LDFLAGS) libvirt_driver_qemu_la_LIBADD = $(NUMACTL_LIBS) \ $(CAPNG_LIBS) \ $(GNUTLS_LIBS) \ - $(LIBXML_LIBS) + $(LIBXML_LIBS) \ + $(LIBNL_LIBS) \ + $(LIBNL_ROUTE3_LIBS) if WITH_DRIVER_MODULES libvirt_driver_qemu_la_LIBADD += ../gnulib/lib/libgnu.la libvirt_driver_qemu_la_LDFLAGS += -module -avoid-version @@ -840,8 +844,9 @@ noinst_LTLIBRARIES += libvirt_driver_lxc.la #libvirt_la_BUILT_LIBADD += libvirt_driver_lxc.la endif libvirt_driver_lxc_la_CFLAGS = \ + $(LIBNL_CFLAGS) $(LIBNL_ROUTE3_CFLAGS) \ -I$(top_srcdir)/src/conf $(AM_CFLAGS) -libvirt_driver_lxc_la_LIBADD = $(CAPNG_LIBS) +libvirt_driver_lxc_la_LIBADD = $(CAPNG_LIBS) $(LIBNL_LIBS) $(LIBNL_ROUTE3_LIBS) if WITH_SECDRIVER_SELINUX libvirt_driver_lxc_la_LIBADD += $(SELINUX_LIBS) endif @@ -941,9 +946,10 @@ noinst_LTLIBRARIES += libvirt_driver_network.la #libvirt_la_BUILT_LIBADD += libvirt_driver_network.la endif libvirt_driver_network_la_CFLAGS = \ + $(LIBNL_CFLAGS) $(LIBNL_ROUTE3_CFLAGS) \ -I$(top_srcdir)/src/conf $(AM_CFLAGS) if WITH_DRIVER_MODULES -libvirt_driver_network_la_LIBADD = ../gnulib/lib/libgnu.la +libvirt_driver_network_la_LIBADD = ../gnulib/lib/libgnu.la $(LIBNL_LIBS) $(LIBNL_ROUTE3_LIBS) libvirt_driver_network_la_LDFLAGS = -module -avoid-version $(AM_LDFLAGS) endif libvirt_driver_network_la_SOURCES = $(NETWORK_DRIVER_SOURCES) @@ -1086,9 +1092,10 @@ libvirt_la_BUILT_LIBADD += libvirt_driver_nwfilter.la noinst_LTLIBRARIES += libvirt_driver_nwfilter.la endif libvirt_driver_nwfilter_la_CFLAGS = $(LIBPCAP_CFLAGS) \ - -I$(top_srcdir)/src/conf $(AM_CFLAGS) + -I$(top_srcdir)/src/conf $(LIBNL_CFLAGS) \ + $(LIBNL_ROUTE3_CFLAGS) $(AM_CFLAGS) libvirt_driver_nwfilter_la_LDFLAGS = $(LD_AMFLAGS) -libvirt_driver_nwfilter_la_LIBADD = $(LIBPCAP_LIBS) +libvirt_driver_nwfilter_la_LIBADD = $(LIBPCAP_LIBS) $(LIBNL_LIBS) $(LIBNL_ROUTE3_LIBS) if WITH_DRIVER_MODULES libvirt_driver_nwfilter_la_LIBADD += ../gnulib/lib/libgnu.la libvirt_driver_nwfilter_la_LDFLAGS += -module -avoid-version @@ -1522,7 +1529,7 @@ libvirt_lxc_LDFLAGS = $(WARN_CFLAGS) $(AM_LDFLAGS) libvirt_lxc_LDADD = $(CAPNG_LIBS) $(YAJL_LIBS) \ $(LIBXML_LIBS) $(NUMACTL_LIBS) $(THREAD_LIBS) \ $(LIBNL_LIBS) $(AUDIT_LIBS) $(DEVMAPPER_LIBS) \ - $(RT_LIBS) $(DBUS_LIBS) \ + $(RT_LIBS) $(DBUS_LIBS) $(LIBNL_ROUTE3_LIBS) \ ../gnulib/lib/libgnu.la if WITH_DTRACE_PROBES libvirt_lxc_LDADD += probes.o @@ -1540,6 +1547,8 @@ libvirt_lxc_CFLAGS = \ $(YAJL_CFLAGS) \ $(AUDIT_CFLAGS) \ $(DBUS_CFLAGS) \ + $(LIBNL_CFLAGS) \ + $(LIBNL_ROUTE3_CFLAGS) \ -I$(top_srcdir)/src/conf \ $(AM_CFLAGS) if HAVE_LIBBLKID diff --git a/src/util/virnetlink.c b/src/util/virnetlink.c index b2e9d51..1d3cd2e 100644 --- a/src/util/virnetlink.c +++ b/src/util/virnetlink.c @@ -67,7 +67,11 @@ struct _virNetlinkEventSrvPrivate { virMutex lock; int eventwatch; int netlinkfd; +#ifdef HAVE_LIBNL1 struct nl_handle *netlinknh; +#else + struct nl_sock *netlinksock; +#endif /*Events*/ int handled; size_t handlesCount; @@ -121,15 +125,31 @@ int virNetlinkCommand(struct nl_msg *nl_msg, int fd; int n; struct nlmsghdr *nlmsg = nlmsg_hdr(nl_msg); +#ifdef HAVE_LIBNL1 struct nl_handle *nlhandle = nl_handle_alloc(); +#else + struct nl_sock *nlsock = nl_socket_alloc(); +#endif +#ifdef HAVE_LIBNL1 if (!nlhandle) { +#else + if (!nlsock) { +#endif virReportSystemError(errno, +#ifdef HAVE_LIBNL1 "%s", _("cannot allocate nlhandle for netlink")); +#else + "%s", _("cannot allocate nlsock for netlink")); +#endif return -1; } +#ifdef HAVE_LIBNL1 if (nl_connect(nlhandle, NETLINK_ROUTE) < 0) { +#else + if (nl_connect(nlsock, NETLINK_ROUTE) < 0) { +#endif virReportSystemError(errno, "%s", _("cannot connect to netlink socket")); rc = -1; @@ -140,7 +160,11 @@ int virNetlinkCommand(struct nl_msg *nl_msg, nlmsg->nlmsg_pid = getpid(); +#ifdef HAVE_LIBNL1 nbytes = nl_send_auto_complete(nlhandle, nl_msg); +#else + nbytes = nl_send_auto_complete(nlsock, nl_msg); +#endif if (nbytes < 0) { virReportSystemError(errno, "%s", _("cannot send to netlink socket")); @@ -148,7 +172,11 @@ int virNetlinkCommand(struct nl_msg *nl_msg, goto error; } +#ifdef HAVE_LIBNL1 fd = nl_socket_get_fd(nlhandle); +#else + fd = nl_socket_get_fd(nlsock); +#endif FD_ZERO(&readfds); FD_SET(fd, &readfds); @@ -165,7 +193,11 @@ int virNetlinkCommand(struct nl_msg *nl_msg, goto error; } +#ifdef HAVE_LIBNL1 *respbuflen = nl_recv(nlhandle, &nladdr, respbuf, NULL); +#else + *respbuflen = nl_recv(nlsock, &nladdr, respbuf, NULL); +#endif if (*respbuflen <= 0) { virReportSystemError(errno, "%s", _("nl_recv failed")); @@ -178,7 +210,11 @@ error: *respbuflen = 0; } +#ifdef HAVE_LIBNL1 nl_handle_destroy(nlhandle); +#else + nl_socket_free(nlsock); +#endif return rc; } @@ -233,7 +269,11 @@ virNetlinkEventCallback(int watch, int i, length; bool handled = false; +#ifdef HAVE_LIBNL1 length = nl_recv(srv->netlinknh, &peer, &msg, &creds); +#else + length = nl_recv(srv->netlinksock, &peer, &msg, &creds); +#endif if (length == 0) return; @@ -284,8 +324,13 @@ virNetlinkEventServiceStop(void) return 0; virNetlinkEventServerLock(srv); +#ifdef HAVE_LIBNL1 nl_close(srv->netlinknh); nl_handle_destroy(srv->netlinknh); +#else + nl_close(srv->netlinksock); + nl_socket_free(srv->netlinksock); +#endif virEventRemoveHandle(srv->eventwatch); /* free any remaining clients on the list */ @@ -346,21 +391,37 @@ virNetlinkEventServiceStart(void) virNetlinkEventServerLock(srv); /* Allocate a new socket and get fd */ +#ifdef HAVE_LIBNL1 srv->netlinknh = nl_handle_alloc(); +#else + srv->netlinksock = nl_socket_alloc(); +#endif +#ifdef HAVE_LIBNL1 if (!srv->netlinknh) { +#else + if (!srv->netlinksock) { +#endif virReportSystemError(errno, "%s", _("cannot allocate nlhandle for virNetlinkEvent server")); goto error_locked; } +#ifdef HAVE_LIBNL1 if (nl_connect(srv->netlinknh, NETLINK_ROUTE) < 0) { +#else + if (nl_connect(srv->netlinksock, NETLINK_ROUTE) < 0) { +#endif virReportSystemError(errno, "%s", _("cannot connect to netlink socket")); goto error_server; } +#ifdef HAVE_LIBNL1 fd = nl_socket_get_fd(srv->netlinknh); +#else + fd = nl_socket_get_fd(srv->netlinksock); +#endif if (fd < 0) { virReportSystemError(errno, @@ -368,7 +429,11 @@ virNetlinkEventServiceStart(void) goto error_server; } +#ifdef HAVE_LIBNL1 if (nl_socket_set_nonblocking(srv->netlinknh)) { +#else + if (nl_socket_set_nonblocking(srv->netlinksock)) { +#endif virReportSystemError(errno, "%s", _("cannot set netlink socket nonblocking")); goto error_server; @@ -391,8 +456,13 @@ virNetlinkEventServiceStart(void) error_server: if (ret < 0) { +#ifdef HAVE_LIBNL1 nl_close(srv->netlinknh); nl_handle_destroy(srv->netlinknh); +#else + nl_close(srv->netlinksock); + nl_socket_free(srv->netlinksock); +#endif } error_locked: virNetlinkEventServerUnlock(srv); -- 1.7.9.5

3 11

[libvirt] [PATCH] Use XDG Base Directories instead of storing in home
by William Jon McCann 03 May '12

03 May '12

Hi, New to the list so hopefully I'm following the correct protocol. Attached is a patch (mostly untested at the moment) to change the default storage location from .libvirt to the locations defined in the XDG Base Directory Specification (http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html) This has a number of advantages for us: It allows sharing a home directory between different machines, or sessions (eg. using NFS) Cleanly separates cache, runtime (eg. sockets), or app data from user settings Supports performing smart or selective migration of settings between different OS versions Supports reseting settings without breaking things Makes it possible to clear cache data to make room when the disk is filling up Allows us to write a robust and efficient backup solution Allows an admin flexibility to change where data and settings are stored It dramatically reduces the complexity and incoherence of the system for administrators This is a pretty important set of features for both enterprise and individual use cases. I hope you will please consider the change. Thanks, Jon PS. This is also related to a goal for upstream GNOME https://live.gnome.org/GnomeGoals/XDGConfigFolders

3 7

[libvirt] [PATCH v5 0/9] Add basic driver for Parallels Virtuozzo Server
by Dmitry Guryanov 02 May '12

02 May '12

Parallels Virtuozzo Server is a cloud-ready virtualization solution that allows users to simultaneously run multiple virtual machines and containers on the same physical server. Current name of this product is Parallels Server Bare Metal and more information about it can be found here - http://www.parallels.com/products/server/baremetal/sp/. This driver will work with PVS version 6.0 , beta version scheduled at 2012 Q2. changes in v5: * rebased to current version changes in v4: * fix errors, found by 'make syntax-check' Dmitry Guryanov (9): pvs: add driver skeleton util: add functions for interating over json object pvs: add functions to list domains and get info pvs: implement functions for domain life cycle management pvs: get info about serial ports pvs: add support of VNC remote display pvs: implement virDomainDefineXML operation for existing domains pvs: add storage driver pvs: implement VM creation AUTHORS | 1 + cfg.mk | 1 + configure.ac | 23 + docs/drvpvs.html.in | 28 + include/libvirt/virterror.h | 1 + libvirt.spec.in | 7 + mingw32-libvirt.spec.in | 6 + po/POTFILES.in | 3 + src/Makefile.am | 23 + src/conf/domain_conf.c | 3 +- src/conf/domain_conf.h | 1 + src/driver.h | 1 + src/libvirt.c | 12 + src/pvs/pvs_driver.c | 1280 +++++++++++++++++++++++++++++++++++++ src/pvs/pvs_driver.h | 75 +++ src/pvs/pvs_storage.c | 1458 +++++++++++++++++++++++++++++++++++++++++++ src/pvs/pvs_utils.c | 143 +++++ src/util/json.c | 30 + src/util/json.h | 4 + src/util/virterror.c | 3 + 20 files changed, 3102 insertions(+), 1 deletions(-) create mode 100644 docs/drvpvs.html.in create mode 100644 src/pvs/pvs_driver.c create mode 100644 src/pvs/pvs_driver.h create mode 100644 src/pvs/pvs_storage.c create mode 100644 src/pvs/pvs_utils.c

2 22