June 2012 - Devel - libvirt List Archives

[libvirt] Fwd: libvirt secret support password or encryption keys?
by Zhimou Peng 20 Jun '12

20 Jun '12

FWD Hi, all PLS help, i'm reviewing man doc of libvirt secrets # man virsh ... SECRET COMMMANDS The following commands manipulate "secrets" (e.g. passwords, passphrases -----> secret-set-value only support base64 "passphrases" and encryption keys). Libvirt can store secrets independently from their use, and other objects (e.g. volumes or domains) can refer to the secrets for encryption or possibly other uses. Secrets are identified using an UUID. See <http://libvirt.org/formatsecret.html> for documentation of the XML format used to represent properties of secrets. ... So, I want to know that if libvirt support other 2 kinds of "secrets". And if so, How to use password and encrytion keys ? If libvirt not support that, i will file a bug of this man doc. BR zhpeng ----- Forwarded Message ----- From: "Zhimou Peng" <zhpeng(a)redhat.com> To: "Daniel Berrange" <berrange(a)redhat.com> Sent: Thursday, June 14, 2012 1:38:09 PM Subject: Fwd: libvirt secret support password or encryption keys? Hi, Daniel I saw your blog:http://berrange.com/posts/2009/12/02/using-qcow2-disk-encryption-with-… and there is only "type=passphrases", so how can i use password or encrytion keys? zhpeng BR ----- Forwarded Message ----- From: "Zhimou Peng" <zhpeng(a)redhat.com> To: "Daniel Berrange" <berrange(a)redhat.com> Cc: "s3-bug-review" <s3-bug-review(a)redhat.com> Sent: Tuesday, June 12, 2012 2:03:05 PM Subject: libvirt secret support password or encryption keys? Hi all, # man virsh ... SECRET COMMMANDS The following commands manipulate "secrets" (e.g. passwords, passphrases -----> secret-set-value only support base64 "passphrases" and encryption keys). Libvirt can store secrets independently from their use, and other objects (e.g. volumes or domains) can refer to the secrets for encryption or possibly other uses. Secrets are identified using an UUID. See <http://libvirt.org/formatsecret.html> for documentation of the XML format used to represent properties of secrets. ... So, I want to know that if libvirt support other 2 kinds of "secrets". And if so, How to use password and encrytion keys ? If libvirt not support that, i will file a bug of this man doc. zhpeng BR

2 2

[libvirt] [PATCHv2 00/13] list all snapshots
by Eric Blake 19 Jun '12

19 Jun '12

This is a v2 of the remaining patches in: https://www.redhat.com/archives/libvir-list/2012-June/msg00273.html https://www.redhat.com/archives/libvir-list/2012-June/msg00284.html It assumes that Peter's list all domain patches have been applied already, at least through patch 6/12: https://www.redhat.com/archives/libvir-list/2012-June/msg00316.html In other words, this series will not apply to current libvirt.git at the time of this mail. And since I developed against v3 of Peter's patches and he has some tweaks to make, I will probably have to make minor tweaks to rebase on top of his eventual v4. I will follow up with a link to a git repo with Peter's v3 and my series, and/or my rebase on top of his v4. Overall changes since v1: actually tested this time address review comments lots of bug fixes due to corner case testing rearrange the patch series so that metaroot comes before filtering pick up some good ideas from Peter's v3 More details in some of the individual patches, if I can remember everything I did. In particular, I'm quite pleased that the overall diffstat for domain_conf.c reduced in size in spite of adding features :) Eric Blake (13): snapshot: new virsh function factored from snapshot-list snapshot: use new virsh function for snapshot-list snapshot: use metaroot node to simplify management snapshot: merge domain and snapshot computation snapshot: merge count and name collectoin snapshot: add additional filters when getting lists snapshot: expose new flags in virsh list: add virDomainListAllSnapshots API list: use the new snapshot API in virsh when possible list: provide python bindings for snapshots list: provide RPC call for snapshots list: new helper function to collect snapshots list: add qemu snapshot list support daemon/remote.c | 126 ++++++ include/libvirt/libvirt.h.in | 35 +- python/Makefile.am | 2 + python/generator.py | 2 + python/libvirt-override-api.xml | 16 +- python/libvirt-override-virDomain.py | 11 + python/libvirt-override-virDomainSnapshot.py | 11 + python/libvirt-override.c | 92 +++++ src/conf/domain_conf.c | 250 ++++------- src/conf/domain_conf.h | 19 +- src/conf/virdomainlist.c | 44 +- src/conf/virdomainlist.h | 18 + src/driver.h | 12 + src/libvirt.c | 275 +++++++++++-- src/libvirt_private.syms | 3 +- src/libvirt_public.syms | 2 + src/qemu/qemu_driver.c | 137 +++++-- src/qemu/qemu_migration.c | 3 +- src/remote/remote_driver.c | 126 ++++++ src/remote/remote_protocol.x | 26 +- src/remote_protocol-structs | 26 ++ tools/virsh.c | 570 +++++++++++++++++--------- tools/virsh.pod | 14 +- 23 files changed, 1371 insertions(+), 449 deletions(-) create mode 100644 python/libvirt-override-virDomain.py create mode 100644 python/libvirt-override-virDomainSnapshot.py -- 1.7.10.2

2 37

[libvirt] [PATCH] domain_conf: fix possible memory leak
by Martin Kletzander 19 Jun '12

19 Jun '12

Until now, it was possible to crash libvirtd when defining domain with channel device with missing source element. When creating new virDomainChrDef, target.port is set to -1, but unfortunately it is an union with addresses that virDomainChrDefFree tries to free in case the deviceType is channel. Having the port set to -1 is intended, however the cleanest way to get around the problems with the crash seems to be renumbering the VIR_DOMAIN_CHR_CHANNEL_ target types to cover new NONE type (with value 0) being the default (no target type yet). --- src/conf/domain_conf.c | 1 + src/conf/domain_conf.h | 3 ++- 2 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 7bd61a5..41f22d2 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -307,6 +307,7 @@ VIR_ENUM_IMPL(virDomainNetInterfaceLinkState, VIR_DOMAIN_NET_INTERFACE_LINK_STAT VIR_ENUM_IMPL(virDomainChrChannelTarget, VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_LAST, + "none", "guestfwd", "virtio") diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index d627ad8..531176c 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -855,7 +855,8 @@ enum virDomainChrDeviceType { }; enum virDomainChrChannelTargetType { - VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_GUESTFWD = 0, + VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_NONE = 0, + VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_GUESTFWD, VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_VIRTIO, VIR_DOMAIN_CHR_CHANNEL_TARGET_TYPE_LAST, -- 1.7.8.6

2 2

[libvirt] [PATCH] virsh: fix few typos on desc command
by Martin Kletzander 19 Jun '12

19 Jun '12

virsh help fix: - <--title> can also /get/ the title virsh man page: - missing <domain-id> - <new_desc> should be <new-desc> --- tools/virsh.c | 2 +- tools/virsh.pod | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 4d34d49..036e018 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -1227,7 +1227,7 @@ static const vshCmdOptDef opts_desc[] = { {"live", VSH_OT_BOOL, 0, N_("modify/get running state")}, {"config", VSH_OT_BOOL, 0, N_("modify/get persistent configuration")}, {"current", VSH_OT_BOOL, 0, N_("modify/get current state configuration")}, - {"title", VSH_OT_BOOL, 0, N_("modify the title instead of description")}, + {"title", VSH_OT_BOOL, 0, N_("modify/get the title instead of description")}, {"edit", VSH_OT_BOOL, 0, N_("open an editor to modify the description")}, {"new-desc", VSH_OT_ARGV, 0, N_("message")}, {NULL, 0, 0, NULL} diff --git a/tools/virsh.pod b/tools/virsh.pod index 910a187..252512a 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -497,8 +497,9 @@ Define a domain from an XML <file>. The domain definition is registered but not started. If domain is already running, the changes will take effect on the next boot. -=item B<desc> [[I<--live>] [I<--config>] | [I<--current>]] [I<--title>] - [I<--edit>] [I<--new-desc> New description or title message] +=item B<desc> I<domain-id> [[I<--live>] [I<--config>] | + [I<--current>]] [I<--title>] [I<--edit>] [I<--new-desc> + New description or title message] Show or modify description and title of a domain. These values are user fields that allow to store arbitrary textual data to allow easy @@ -516,7 +517,7 @@ description or title should be opened and the contents saved back afterwards. Flag I<--title> selects operation on the title field instead of description. -If neither of I<--edit> and I<--new_desc> are specified the note or description +If neither of I<--edit> and I<--new-desc> are specified the note or description is displayed instead of being modified. =item B<destroy> I<domain-id> [I<--graceful>] -- 1.7.8.6

2 2

[libvirt] [PATCH] error: Fix macro checking for NULL arguments
by Peter Krempa 19 Jun '12

19 Jun '12

Macro virCheckNullArgGoto is supposed to check for NULL argument but checks non-NULL instead. --- src/internal.h | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/internal.h b/src/internal.h index 1b1598b..b09609e 100644 --- a/src/internal.h +++ b/src/internal.h @@ -241,21 +241,21 @@ # define virCheckNonNullArgReturn(argname, retval) \ do { \ if (argname == NULL) { \ virReportInvalidNullArg(argname); \ return retval; \ } \ } while (0) # define virCheckNullArgGoto(argname, label) \ do { \ - if (argname == NULL) { \ + if (argname != NULL) { \ virReportInvalidNullArg(argname); \ goto label; \ } \ } while (0) # define virCheckNonNullArgGoto(argname, label) \ do { \ if (argname == NULL) { \ virReportInvalidNonNullArg(argname); \ goto label; \ } \ -- 1.7.8.6

2 4

Re: [libvirt] ask for help to explain the network about tap
by Yong Sheng Gong 19 Jun '12

19 Jun '12

Can any one help? thanks -----Yong Sheng Gong/China/IBM wrote: ----- To: Eric Blake <eblake(a)redhat.com> From: Yong Sheng Gong/China/IBM Date: 06/17/2012 11:11AM Cc: libvir-list(a)redhat.com Subject: Re: [libvirt] ask for help to explain the network about tap Hi Eric, Thanks for the reply. I have a new question. I found I cannot ping the VM with predefined tap device in domain xml from other host(means the machine other than the hyper visor is running on): <interface type='ethernet'> <mac address='f6:19:e0:6c:84:c3'/> <script path=''/> <target dev='tap10'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> But I can ping the VM with libvirtd defined tap device in domain xml from other host: <interface type='bridge'> <mac address='52:54:00:e4:2e:c1'/> <source bridge='br200'/> <target dev='vnet0'/> <model type='virtio'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> [root@robinlinux ~]# brctl show bridge name bridge id STP enabled interfaces br100 8000.0021cc6d4440 no eth0 br200 8000.0021cc6d4443 no eth0.1000 gw200 tap10 vnet0 And I can ping both of VMs from local host. What does libvirtd do to allow the bridge to forward the packet to the tap device attached by target VM? As far as I know all the packets destined to the bridge's ports from outside will be consumed by bridge itself, not xmit to particular port. Thanks Yong Sheng Gong -----Eric Blake <eblake(a)redhat.com> wrote: ----- To: Yong Sheng Gong/China/IBM@IBMCN From: Eric Blake <eblake(a)redhat.com> Date: 06/15/2012 12:36PM Cc: libvir-list(a)redhat.com Subject: Re: [libvirt] ask for help to explain the network about tap On 06/14/2012 08:49 PM, Yong Sheng Gong wrote: > > Hi, > I don't know who helps qemu-kvm to create and open the tap file and when if I define an interface of a kvm vm like: > <interface type='bridge'> > <mac address='52:54:00:e4:2e:c1'/> > <source bridge='br200'/> > <model type='virtio'/> > <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> > </interface> > > The qemu-kvm process's command line will be: <snip> > > Note the -netdev tap,fd=24 That's libvirtd that opened the tap file, and passed it by inheritance to the new qemu process. Unfortunately, this means that you can't recreate the same qemu process without also opening the tap device yourself the same way that libvirtd would do it. But this approach of fd passing is essential to security, since libvirtd intentionally removes capabilities that prevent qemu from opening the tap itself, so libvirtd must pass in the fd pre-opened. Did you have specific questions about which functions in libvirt source code open the tap device? Also, note that libvirtd will issue an audit log event for every tapfd that it opens and gives to qemu. The fd number is unpredictable, but the fact that an fd was opened as backed by a tap device is pretty easy to follow in the audit logs. -- Eric Blake eblake(a)redhat.com +1-919-301-3266 Libvirt virtualization library http://libvirt.org [attachment "signature.asc" removed by Yong Sheng Gong/China/IBM]

1 0

[libvirt] [PATCH] virsh: make domiftune interface help string consistent
by Martin Kletzander 19 Jun '12

19 Jun '12

Append '(MAC Address)' after the help string of domiftune virsh command as it takes the same type of argument as domif-{get,set}link which have it specified. --- Pushed under 'trivial' rule. tools/virsh.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 1e1de39..fffa482 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -2019,7 +2019,7 @@ static const vshCmdInfo info_domiftune[] = { static const vshCmdOptDef opts_domiftune[] = { {"domain", VSH_OT_DATA, VSH_OFLAG_REQ, N_("domain name, id or uuid")}, - {"interface", VSH_OT_DATA, VSH_OFLAG_REQ, N_("interface device")}, + {"interface", VSH_OT_DATA, VSH_OFLAG_REQ, N_("interface device (MAC Address)")}, {"inbound", VSH_OT_DATA, VSH_OFLAG_NONE, N_("control domain's incoming traffics")}, {"outbound", VSH_OT_DATA, VSH_OFLAG_NONE, N_("control domain's outgoing traffics")}, {"config", VSH_OT_BOOL, VSH_OFLAG_NONE, N_("affect next boot")}, -- 1.7.8.6

1 0

[libvirt] [sandbox][PATCH] Typo and example fix
by Radu Caragea 19 Jun '12

19 Jun '12

I fixed a typo in the strace debug feature, if you specified LIBVIRT_SANDBOX_STRACE=poll it would write "strace =poll" in the kernel command line and consequently it wouldn't get picked up because of that extra space. Also, the example virt-sandbox.py was a bit outdated so I updated it. The shell.py doesn't work as it has serial1 hardcoded for qemu. I haven't checked the rest.

2 1

[libvirt] [PATCH] add handling EINTR to test example of event loop
by lvroyce＠linux.vnet.ibm.com 19 Jun '12

19 Jun '12

From: lvroyce <lvroyce(a)linux.vnet.ibm.com> some system call and signal will interrupt poll, making event loop stops and fails to react events and keepalive message from libvirt. adding handling EINTR to poll to make it more robust Signed-off-by: lvroyce <lvroyce(a)linux.vnet.ibm.com> --- examples/domain-events/events-python/event-test.py | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-) diff --git a/examples/domain-events/events-python/event-test.py b/examples/domain-events/events-python/event-test.py index 96dc268..b446c21 100644 --- a/examples/domain-events/events-python/event-test.py +++ b/examples/domain-events/events-python/event-test.py @@ -188,7 +188,13 @@ class virEventLoopPure: sleep = (next - now) / 1000.0 debug("Poll with a sleep of %d" % sleep) - events = self.poll.poll(sleep) + try: + events = self.poll.poll(sleep) + except select.error, e: + self.runningPoll = False + if not e.errno in (errno.EINTR, errno.EAGAIN): + raise + return # Dispatch any file handle events that occurred for (fd, revents) in events: -- 1.7.7.6

3 3

[libvirt] [PATCH 02/02] libvirt-java add domain flags and error constants up to 0.9, 2
by Stefan Majer 19 Jun '12

19 Jun '12

-- Stefan Majer

1 0