November 2014 - Devel - libvirt List Archives

[libvirt] [PATCH] test: fix nwfilter tests following changes in virfirewall.c
by Stefan Berger 27 Nov '14

27 Nov '14

Some of the nwfilter tests are now failing since --concurrent shows up in the ebtables command. To avoid this, implement a few functions that allow to set the booleans indicating how the locking is to be done to false, overriding the probing. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/libvirt_private.syms | 3 +++ src/util/virfirewall.c | 18 ++++++++++++++++++ src/util/virfirewall.h | 4 ++++ tests/nwfilterebiptablestest.c | 5 +++++ tests/nwfilterxml2firewalltest.c | 4 ++++ 5 files changed, 34 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 2647d36..376826a 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1353,7 +1353,10 @@ virFindFileInPath; virFirewallAddRule; virFirewallAddRuleFull; virFirewallApply; +virFirewallEbtablesNotUseLock; virFirewallFree; +virFirewallIp6tablesNotUseLock; +virFirewallIptablesNotUseLock; virFirewallNew; virFirewallRemoveRule; virFirewallRuleAddArg; diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c index 8496062..5df2a5f 100644 --- a/src/util/virfirewall.c +++ b/src/util/virfirewall.c @@ -108,6 +108,24 @@ static bool iptablesUseLock; static bool ip6tablesUseLock; static bool ebtablesUseLock; +void +virFirewallIptablesNotUseLock(void) +{ + iptablesUseLock = false; +} + +void +virFirewallIp6tablesNotUseLock(void) +{ + ip6tablesUseLock = false; +} + +void +virFirewallEbtablesNotUseLock(void) +{ + ebtablesUseLock = false; +} + static void virFirewallCheckUpdateLock(bool *lockflag, const char *const*args) diff --git a/src/util/virfirewall.h b/src/util/virfirewall.h index 1129219..aa72a76 100644 --- a/src/util/virfirewall.h +++ b/src/util/virfirewall.h @@ -106,4 +106,8 @@ void virFirewallStartRollback(virFirewallPtr firewall, int virFirewallApply(virFirewallPtr firewall); +void virFirewallIptablesNotUseLock(void); +void virFirewallIp6tablesNotUseLock(void); +void virFirewallEbtablesNotUseLock(void); + #endif /* __VIR_FIREWALL_H__ */ diff --git a/tests/nwfilterebiptablestest.c b/tests/nwfilterebiptablestest.c index e04bc21..e18a6c7 100644 --- a/tests/nwfilterebiptablestest.c +++ b/tests/nwfilterebiptablestest.c @@ -24,6 +24,7 @@ #include "testutils.h" #include "nwfilter/nwfilter_ebiptables_driver.h" #include "virbuffer.h" +#include "virfirewall.h" #define __VIR_FIREWALL_PRIV_H_ALLOW__ #include "virfirewallpriv.h" @@ -527,6 +528,10 @@ mymain(void) goto cleanup; } + virFirewallEbtablesNotUseLock(); + virFirewallIptablesNotUseLock(); + virFirewallIp6tablesNotUseLock(); + if (virtTestRun("ebiptablesAllTeardown", testNWFilterEBIPTablesAllTeardown, NULL) < 0) diff --git a/tests/nwfilterxml2firewalltest.c b/tests/nwfilterxml2firewalltest.c index 01527f4..f6ef0e0 100644 --- a/tests/nwfilterxml2firewalltest.c +++ b/tests/nwfilterxml2firewalltest.c @@ -479,6 +479,10 @@ mymain(void) goto cleanup; } + virFirewallEbtablesNotUseLock(); + virFirewallIptablesNotUseLock(); + virFirewallIp6tablesNotUseLock(); + DO_TEST("ah"); DO_TEST("ah-ipv6"); DO_TEST("all"); -- 1.9.3

2 1

[libvirt] [PATCH 0/5] Getting virt-sandbox-service to work
by Cédric Bosdonnat 26 Nov '14

26 Nov '14

Hi all, this patch series fixes a few problems I encountered when getting virt-sandbox-service containers with images to work. The very first patch fixes a crasher in virt-aa-helper tests... but we were pretty lucky it didn't explode before: virErrors weren't initialized. Cédric Bosdonnat (5): virt-aa-helper wasn't running virErrorInitialize virt-aa-helper: /etc/libvirt-sandbox/services isn't restricted ip link needs 'name' in 3.16 to create the veth pair lxc: be more patient while resolving symlinks lxc: don't unmount subtree if it contains the source of the mount src/conf/domain_conf.h | 1 + src/lxc/lxc_container.c | 85 ++++++++++++++++++++++++++++++------------- src/security/virt-aa-helper.c | 14 ++++++- src/util/virnetdevveth.c | 4 +- 4 files changed, 74 insertions(+), 30 deletions(-) -- 2.1.2

6 25

[libvirt] [PATCH] storage: remove a redundant NULL assignment
by Chen Hanxiao 26 Nov '14

26 Nov '14

We already did this in virSecretDefFree. Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- src/storage/storage_backend.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index 98720f6..440f8b1 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -558,7 +558,6 @@ virStorageGenerateQcowEncryption(virConnectPtr conn, goto cleanup; xml = virSecretDefFormat(def); virSecretDefFree(def); - def = NULL; if (xml == NULL) goto cleanup; -- 1.9.3

2 1

[libvirt] [PATCH RFC] storage: perform btrfs clone if possible
by Chen Hanxiao 26 Nov '14

26 Nov '14

We already had nocow flags in virStorageSource. But when creating RAW file, we don't take advantage of clone of btrfs. This file introduce btrfs_clone_file function, and try to use it when !nocow. Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- src/storage/storage_backend.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index 98720f6..f5ea34c 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -156,6 +156,27 @@ enum { #define READ_BLOCK_SIZE_DEFAULT (1024 * 1024) #define WRITE_BLOCK_SIZE_DEFAULT (4 * 1024) +/* + * Perform the O(1) btrfs clone operation, if possible. + * Upon success, return 0. Otherwise, return -1 and set errno. + */ +static inline int +btrfs_clone_file(int dest_fd, int src_fd) +{ +#ifdef __linux__ +# undef BTRFS_IOCTL_MAGICi +# define BTRFS_IOCTL_MAGIC 0x94 +# undef BTRFS_IOC_CLONE +# define BTRFS_IOC_CLONE _IOW (BTRFS_IOCTL_MAGIC, 9, int) + return ioctl(dest_fd, BTRFS_IOC_CLONE, src_fd); +#else + (void) dest_fd; + (void) src_fd; + errno = ENOTSUP; + return -1; +#endif +} + static int ATTRIBUTE_NONNULL(2) virStorageBackendCopyToFD(virStorageVolDefPtr vol, virStorageVolDefPtr inputvol, @@ -200,6 +221,16 @@ virStorageBackendCopyToFD(virStorageVolDefPtr vol, goto cleanup; } + if (!vol->target.nocow) { + if (btrfs_clone_file(fd, inputfd) == -1) { + if (errno == ENOTSUP) + VIR_DEBUG("btrfs clone not supported, try another way."); + } else { + VIR_DEBUG("btrfs clone findished."); + goto cleanup; + } + } + while (amtread != 0) { int amtleft; -- 1.9.3

4 6

[libvirt] [sandbox][PATCH 0/2] AppArmor support
by Cédric Bosdonnat 26 Nov '14

26 Nov '14

Hi all, Here are 2 patches: one to get apparmor support for virt-sandbox and virt-sandbox-service and 1 to get services with disk image actually start. The AppArmor support doesn't add any parameter to the user, virt-sandbox, just uses either apparmor or selinux depending on the one available... as those can't be running at the same time. Cédric Bosdonnat (2): AppArmor support virt-sandbox-service: mount /var after all other file systems bin/virt-sandbox-service | 21 ++++++++++++-------- libvirt-sandbox/libvirt-sandbox-builder.c | 32 +++++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+), 8 deletions(-) -- 2.1.2

3 5

[libvirt] [PATCH v3 repost] network: Bring netdevs online later
by Matthew Rosato 26 Nov '14

26 Nov '14

Repost of a patch that got lost in the shuffle. The last version (v3) was based on review comments from Martin Kletzander but needs additional review. Here's a link back to the v2 post, which was the last to receive comments: http://www.redhat.com/archives/libvir-list/2014-August/msg01332.html This repost is identical in content to the previous v3 submission, save for retrofit needed. Associated bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1081461 Changes for v3: * Some minor formatting fixes. * in qemuNetworkIfaceConnect, set VIR_NETDEV_TAP_CREATE_IFUP unconditionally. * in qemuDomainAttachNetDevice, call qemuInterfaceStartDevice on for VIR_DOMAIN_NET_TYPE_DIRECT, _BRIDGE and _NETWORK. * in qemuProcessStartCPUs, use 'reason' to determine whether or not qemuInterfaceStartDevices needs to be called. Basically, it needs to be called for any reason that the system would be initializing, as well as potentially after a failed migration. Matthew Rosato (1): network: Bring netdevs online later src/Makefile.am | 3 +- src/conf/domain_conf.h | 2 ++ src/lxc/lxc_process.c | 4 ++- src/qemu/qemu_command.c | 3 ++ src/qemu/qemu_hotplug.c | 8 +++++ src/qemu/qemu_interface.c | 76 +++++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_interface.h | 32 ++++++++++++++++++ src/qemu/qemu_process.c | 7 ++++ src/util/virnetdevmacvlan.c | 8 +++-- src/util/virnetdevmacvlan.h | 2 ++ 10 files changed, 140 insertions(+), 5 deletions(-) create mode 100644 src/qemu/qemu_interface.c create mode 100644 src/qemu/qemu_interface.h -- 1.7.9.5

1 1

[libvirt] [PATCH 0/2] prep for backing chain stat reporting
by Eric Blake 26 Nov '14

26 Nov '14

I'm still working on more patches to expose the allocation watermark of backing images during a block commit, but want to get these preliminary patches posted now. Eric Blake (2): virsh: document block.n.allocation stat getstats: add block.n.source stat src/libvirt-domain.c | 16 +++++++++++++--- src/qemu/qemu_driver.c | 36 ++++++++++++++++++++---------------- tools/virsh.pod | 10 +++++++--- 3 files changed, 40 insertions(+), 22 deletions(-) -- 1.9.3

2 7

[libvirt] [python PATCH] event: Add bindings for agent lifecycle event
by Peter Krempa 26 Nov '14

26 Nov '14

Also add the example. --- examples/event-test.py | 13 +++++++++++ libvirt-override.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+) mode change 100644 => 100755 examples/event-test.py diff --git a/examples/event-test.py b/examples/event-test.py old mode 100644 new mode 100755 index be7a7d4..acc7f20 --- a/examples/event-test.py +++ b/examples/event-test.py @@ -464,6 +464,15 @@ def blockJobStatusToString(status): blockJobStatus = ( "Completed", "Failed", "Canceled", "Ready", ) return blockJobStatus[status] + +def agentLifecycleStateToString(state): + agentStates = ( "unknown", "connected", "disconnected", ) + return agentStates[state] + +def agentLifecycleReasonToString(reason): + agentReasons = ( "unknown", "domain booted", "channel event", ) + return agentReasons[reason] + def myDomainEventCallback1 (conn, dom, event, detail, opaque): print("myDomainEventCallback1 EVENT: Domain %s(%s) %s %s" % (dom.name(), dom.ID(), domEventToString(event), @@ -517,6 +526,9 @@ def myDomainEventBlockJob2Callback(conn, dom, disk, type, status, opaque): print("myDomainEventBlockJob2Callback: Domain %s(%s) %s on disk %s %s" % (dom.name(), dom.ID(), blockJobTypeToString(type), disk, blockJobStatusToString(status))) def myDomainEventTunableCallback(conn, dom, params, opaque): print("myDomainEventTunableCallback: Domain %s(%s) %s" % (dom.name(), dom.ID(), params)) +def myDomainEventAgentLifecycleCallback(conn, dom, state, reason, opaque): + print("myDomainEventAgentLifecycleCallback: Domain %s(%s) %s %s" % (dom.name(), dom.ID, agentLifecycleStateToString(state), agentLifecycleReasonToString(reason))) + ########################################################################## # Network events @@ -627,6 +639,7 @@ def main(): vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_DEVICE_REMOVED, myDomainEventDeviceRemovedCallback, None) vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_BLOCK_JOB_2, myDomainEventBlockJob2Callback, None) vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_TUNABLE, myDomainEventTunableCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_AGENT_LIFECYCLE, myDomainEventAgentLifecycleCallback, None) vc.networkEventRegisterAny(None, libvirt.VIR_NETWORK_EVENT_ID_LIFECYCLE, myNetworkEventLifecycleCallback, None) diff --git a/libvirt-override.c b/libvirt-override.c index a53b46f..af4f386 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -6566,6 +6566,61 @@ libvirt_virConnectDomainEventTunableCallback(virConnectPtr conn ATTRIBUTE_UNUSED } #endif /* LIBVIR_CHECK_VERSION(1, 2, 9) */ +#if LIBVIR_CHECK_VERSION(1, 2, 11) +static int +libvirt_virConnectDomainEventAgentLifecycleCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + int state, + int reason, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret = NULL; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + if (!(dictKey = libvirt_constcharPtrWrap("conn"))) + goto cleanup; + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + if (!(pyobj_dom = libvirt_virDomainPtrWrap(dom))) { + virDomainFree(dom); + goto cleanup; + } + Py_INCREF(pyobj_cbData); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"_dispatchDomainEventTunableCallback", + (char*)"OiiO", + pyobj_dom, state, reason, pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + cleanup: + if (!pyobj_ret) { + DEBUG("%s - ret:%p\n", __FUNCTION__, pyobj_ret); + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; + +} +#endif /* LIBVIR_CHECK_VERSION(1, 2, 11) */ + + static PyObject * libvirt_virConnectDomainEventRegisterAny(ATTRIBUTE_UNUSED PyObject *self, PyObject *args) @@ -6658,6 +6713,11 @@ libvirt_virConnectDomainEventRegisterAny(ATTRIBUTE_UNUSED PyObject *self, cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventTunableCallback); break; #endif /* LIBVIR_CHECK_VERSION(1, 2, 9) */ +#if LIBVIR_CHECK_VERSION(1, 2, 11) + case VIR_DOMAIN_EVENT_ID_AGENT_LIFECYCLE: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventAgentLifecycleCallback); + break; +#endif /* LIBVIR_CHECK_VERSION(1, 2, 11) */ case VIR_DOMAIN_EVENT_ID_LAST: break; } -- 2.1.0

2 1

[libvirt] [PATCH] dbus: fix arrays of bools
by Eric Blake 26 Nov '14

26 Nov '14

Commit 2aa167ca tried to fix the DBus interaction code to allow callers to use native types instead of 4-byte bools. But in fixing the issue, I missed the case of an arrayref; Conrad Meyer shows the following valid complaint issued by clang: CC util/libvirt_util_la-virdbus.lo util/virdbus.c:956:13: error: cast from 'bool *' to 'dbus_bool_t *' (aka 'unsigned int *') increases required alignment from 1 to 4 [-Werror,-Wcast-align] GET_NEXT_VAL(dbus_bool_t, bool_val, bool, "%d"); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ util/virdbus.c:858:17: note: expanded from macro 'GET_NEXT_VAL' x = (dbustype *)(*xptrptr + (*narrayptr - 1)); \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 error generated. But fixing that points out that we have NEVER supported arrayrefs of sub-int types (byte, i16, u16, and now bool). Again, while raw types promote, arrays do not; so the macros HAVE to deal with both size possibilities rather than assuming that an arrayref uses the same sizing as the promoted raw type. Obviously, our testsuite wasn't covering as much as it should have. * src/util/virdbus.c (GET_NEXT_VAL): Also fix array cases. (SET_NEXT_VAL): Fix uses of sub-int arrays. * tests/virdbustest.c (testMessageArray, testMessageArrayRef): Test it. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Although this fixes a build-breaker, it is not trivial, and therefore I will wait for a full review. src/util/virdbus.c | 39 +++++++++++++++++++++------------------ tests/virdbustest.c | 29 +++++++++++++++++++++++++---- 2 files changed, 46 insertions(+), 22 deletions(-) diff --git a/src/util/virdbus.c b/src/util/virdbus.c index f27fce7..ee8732c 100644 --- a/src/util/virdbus.c +++ b/src/util/virdbus.c @@ -574,11 +574,11 @@ virDBusIsAllowedRefType(const char *sig) } -# define SET_NEXT_VAL(dbustype, vargtype, sigtype, fmt) \ +# define SET_NEXT_VAL(dbustype, vargtype, arrtype, sigtype, fmt) \ do { \ dbustype x; \ if (arrayref) { \ - vargtype *valarray = arrayptr; \ + arrtype valarray = arrayptr; \ x = (dbustype)*valarray; \ valarray++; \ arrayptr = valarray; \ @@ -666,45 +666,48 @@ virDBusMessageIterEncode(DBusMessageIter *rootiter, switch (*t) { case DBUS_TYPE_BYTE: - SET_NEXT_VAL(unsigned char, int, *t, "%d"); + SET_NEXT_VAL(unsigned char, int, unsigned char *, *t, "%d"); break; case DBUS_TYPE_BOOLEAN: - SET_NEXT_VAL(dbus_bool_t, int, *t, "%d"); + SET_NEXT_VAL(dbus_bool_t, int, bool *, *t, "%d"); break; case DBUS_TYPE_INT16: - SET_NEXT_VAL(dbus_int16_t, int, *t, "%d"); + SET_NEXT_VAL(dbus_int16_t, int, short *, *t, "%d"); break; case DBUS_TYPE_UINT16: - SET_NEXT_VAL(dbus_uint16_t, unsigned int, *t, "%d"); + SET_NEXT_VAL(dbus_uint16_t, unsigned int, unsigned short *, + *t, "%d"); break; case DBUS_TYPE_INT32: - SET_NEXT_VAL(dbus_int32_t, int, *t, "%d"); + SET_NEXT_VAL(dbus_int32_t, int, int *, *t, "%d"); break; case DBUS_TYPE_UINT32: - SET_NEXT_VAL(dbus_uint32_t, unsigned int, *t, "%u"); + SET_NEXT_VAL(dbus_uint32_t, unsigned int, unsigned int *, + *t, "%u"); break; case DBUS_TYPE_INT64: - SET_NEXT_VAL(dbus_int64_t, long long, *t, "%lld"); + SET_NEXT_VAL(dbus_int64_t, long long, long long *, *t, "%lld"); break; case DBUS_TYPE_UINT64: - SET_NEXT_VAL(dbus_uint64_t, unsigned long long, *t, "%llu"); + SET_NEXT_VAL(dbus_uint64_t, unsigned long long, + unsigned long long *, *t, "%llu"); break; case DBUS_TYPE_DOUBLE: - SET_NEXT_VAL(double, double, *t, "%lf"); + SET_NEXT_VAL(double, double, double *, *t, "%lf"); break; case DBUS_TYPE_STRING: case DBUS_TYPE_OBJECT_PATH: case DBUS_TYPE_SIGNATURE: - SET_NEXT_VAL(char *, char *, *t, "%s"); + SET_NEXT_VAL(char *, char *, char **, *t, "%s"); break; case DBUS_TYPE_ARRAY: @@ -848,23 +851,23 @@ virDBusMessageIterEncode(DBusMessageIter *rootiter, # define GET_NEXT_VAL(dbustype, member, vargtype, fmt) \ do { \ - dbustype *x; \ DBusBasicValue v; \ + dbustype *x = (dbustype *)&v.member; \ + vargtype *y; \ if (arrayref) { \ VIR_DEBUG("Use arrayref"); \ vargtype **xptrptr = arrayptr; \ if (VIR_EXPAND_N(*xptrptr, *narrayptr, 1) < 0) \ goto cleanup; \ - x = (dbustype *)(*xptrptr + (*narrayptr - 1)); \ + y = (*xptrptr + (*narrayptr - 1)); \ VIR_DEBUG("Expanded to %zu", *narrayptr); \ } else { \ - x = (dbustype *)&(v.member); \ + y = va_arg(args, vargtype *); \ } \ dbus_message_iter_get_basic(iter, x); \ - if (!arrayref) \ - *va_arg(args, vargtype *) = v.member; \ + *y = *x; \ VIR_DEBUG("Read basic type '" #dbustype "' varg '" #vargtype \ - "' val '" fmt "'", (vargtype)*x); \ + "' val '" fmt "'", (vargtype)*y); \ } while (0) diff --git a/tests/virdbustest.c b/tests/virdbustest.c index 98b4bf6..4ec3c0d 100644 --- a/tests/virdbustest.c +++ b/tests/virdbustest.c @@ -183,6 +183,7 @@ static int testMessageArray(const void *args ATTRIBUTE_UNUSED) int in_int32a = 1000000000, out_int32a = 0; int in_int32b = 2000000000, out_int32b = 0; int in_int32c = -2000000000, out_int32c = 0; + bool in_bool[] = { true, false, true }, out_bool[] = { false, true, false}; const char *in_str2 = "World"; char *out_str1 = NULL, *out_str2 = NULL; @@ -195,18 +196,20 @@ static int testMessageArray(const void *args ATTRIBUTE_UNUSED) } if (virDBusMessageEncode(msg, - "sais", + "saiabs", in_str1, 3, in_int32a, in_int32b, in_int32c, + 3, in_bool[0], in_bool[1], in_bool[2], in_str2) < 0) { VIR_DEBUG("Failed to encode arguments"); goto cleanup; } if (virDBusMessageDecode(msg, - "sais", + "saiabs", &out_str1, 3, &out_int32a, &out_int32b, &out_int32c, + 3, &out_bool[0], &out_bool[1], &out_bool[2], &out_str2) < 0) { VIR_DEBUG("Failed to decode arguments"); goto cleanup; @@ -217,6 +220,9 @@ static int testMessageArray(const void *args ATTRIBUTE_UNUSED) VERIFY("int32a", in_int32a, out_int32a, "%d"); VERIFY("int32b", in_int32b, out_int32b, "%d"); VERIFY("int32c", in_int32c, out_int32c, "%d"); + VERIFY("bool[0]", in_bool[0], out_bool[0], "%d"); + VERIFY("bool[1]", in_bool[1], out_bool[1], "%d"); + VERIFY("bool[2]", in_bool[2], out_bool[2], "%d"); VERIFY_STR("str2", in_str2, out_str2, "%s"); ret = 0; @@ -329,6 +335,7 @@ static int testMessageArrayRef(const void *args ATTRIBUTE_UNUSED) int in_int32[] = { 100000000, 2000000000, -2000000000 }; + bool in_bool[] = { true, false, true }; const char *in_strv1[] = { "Fishfood", }; @@ -337,6 +344,8 @@ static int testMessageArrayRef(const void *args ATTRIBUTE_UNUSED) }; int *out_int32 = NULL; size_t out_nint32 = 0; + bool *out_bool = NULL; + size_t out_nbool = 0; char **out_strv1 = NULL; char **out_strv2 = NULL; size_t out_nstrv1 = 0; @@ -354,10 +363,11 @@ static int testMessageArrayRef(const void *args ATTRIBUTE_UNUSED) } if (virDBusMessageEncode(msg, - "sa&sa&ia&ss", + "sa&sa&ia&ba&ss", in_str1, 1, in_strv1, 3, in_int32, + 3, in_bool, 2, in_strv2, in_str2) < 0) { VIR_DEBUG("Failed to encode arguments"); @@ -365,10 +375,11 @@ static int testMessageArrayRef(const void *args ATTRIBUTE_UNUSED) } if (virDBusMessageDecode(msg, - "sa&sa&ia&ss", + "sa&sa&ia&ba&ss", &out_str1, &out_nstrv1, &out_strv1, &out_nint32, &out_int32, + &out_nbool, &out_bool, &out_nstrv2, &out_strv2, &out_str2) < 0) { VIR_DEBUG("Failed to decode arguments"); @@ -393,6 +404,15 @@ static int testMessageArrayRef(const void *args ATTRIBUTE_UNUSED) VERIFY("int32b", in_int32[1], out_int32[1], "%d"); VERIFY("int32c", in_int32[2], out_int32[2], "%d"); + if (out_nbool != 3) { + fprintf(stderr, "Expected 3 bools, but got %zu\n", + out_nbool); + goto cleanup; + } + VERIFY("bool[0]", in_bool[0], out_bool[0], "%d"); + VERIFY("bool[1]", in_bool[1], out_bool[1], "%d"); + VERIFY("bool[2]", in_bool[2], out_bool[2], "%d"); + if (out_nstrv2 != 2) { fprintf(stderr, "Expected 2 strings, but got %zu\n", out_nstrv2); @@ -407,6 +427,7 @@ static int testMessageArrayRef(const void *args ATTRIBUTE_UNUSED) cleanup: VIR_FREE(out_int32); + VIR_FREE(out_bool); VIR_FREE(out_str1); VIR_FREE(out_str2); for (i = 0; i < out_nstrv1; i++) -- 1.9.3

1 1

[libvirt] [PATCH] Re-add use of locking with iptables/ip6tables/ebtables
by Daniel P. Berrange 26 Nov '14

26 Nov '14

A previous commit introduced use of locking with invocation of iptables in the viriptables.c module commit ba95426d6f39aec1da6e069dd7222f7a8c6a5862 Author: Serge Hallyn <serge.hallyn(a)ubuntu.com> Date: Fri Nov 1 12:36:59 2013 -0500 util: use -w flag when calling iptables This only ever had effect with the virtual network driver, as it was not wired up into the nwfilter driver. Unfortunately in the firewall refactoring the use of the -w flag was accidentally lost. This patch introduces it to the virfirewall.c module so that both the virtual network and nwfilter drivers will be using it. It also ensures that the equivalent --concurrent flag to ebtables is used. --- src/util/virfirewall.c | 67 +++++++++++++++++++++++++++++++++++++++++++++++--- src/util/viriptables.c | 2 -- 2 files changed, 63 insertions(+), 6 deletions(-) diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c index bab1634..c83fdc6 100644 --- a/src/util/virfirewall.c +++ b/src/util/virfirewall.c @@ -104,6 +104,44 @@ virFirewallOnceInit(void) VIR_ONCE_GLOBAL_INIT(virFirewall) +static bool iptablesUseLock; +static bool ip6tablesUseLock; +static bool ebtablesUseLock; + +static void +virFirewallCheckUpdateLock(bool *lockflag, + const char *const*args) +{ + virCommandPtr cmd = virCommandNewArgs(args); + if (virCommandRun(cmd, NULL) < 0) { + VIR_INFO("locking not supported by %s", args[0]); + } else { + VIR_INFO("using locking for %s", args[0]); + *lockflag = true; + } + virCommandFree(cmd); +} + +static void +virFirewallCheckUpdateLocking(void) +{ + const char *iptablesArgs[] = { + IPTABLES_PATH, "-w", "-L", "-n", NULL, + }; + const char *ip6tablesArgs[] = { + IP6TABLES_PATH, "-w", "-L", "-n", NULL, + }; + const char *ebtablesArgs[] = { + EBTABLES_PATH, "--concurrent", "-L", NULL, + }; + virFirewallCheckUpdateLock(&iptablesUseLock, + iptablesArgs); + virFirewallCheckUpdateLock(&ip6tablesUseLock, + ip6tablesArgs); + virFirewallCheckUpdateLock(&ebtablesUseLock, + ebtablesArgs); +} + static int virFirewallValidateBackend(virFirewallBackend backend) { @@ -161,6 +199,9 @@ virFirewallValidateBackend(virFirewallBackend backend) } currentBackend = backend; + + virFirewallCheckUpdateLocking(); + return 0; } @@ -201,6 +242,9 @@ virFirewallPtr virFirewallNew(void) { virFirewallPtr firewall; + if (virFirewallInitialize() < 0) + return NULL; + if (VIR_ALLOC(firewall) < 0) return NULL; @@ -321,6 +365,23 @@ virFirewallAddRuleFullV(virFirewallPtr firewall, rule->queryOpaque = opaque; rule->ignoreErrors = ignoreErrors; + switch (rule->layer) { + case VIR_FIREWALL_LAYER_ETHERNET: + if (ebtablesUseLock) + ADD_ARG(rule, "--concurrent"); + break; + case VIR_FIREWALL_LAYER_IPV4: + if (iptablesUseLock) + ADD_ARG(rule, "-w"); + break; + case VIR_FIREWALL_LAYER_IPV6: + if (ip6tablesUseLock) + ADD_ARG(rule, "-w"); + break; + case VIR_FIREWALL_LAYER_LAST: + break; + } + while ((str = va_arg(args, char *)) != NULL) { ADD_ARG(rule, str); } @@ -840,8 +901,8 @@ virFirewallApplyGroup(virFirewallPtr firewall, bool ignoreErrors = (group->actionFlags & VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); size_t i; - VIR_INFO("Starting transaction for %p flags=%x", - group, group->actionFlags); + VIR_INFO("Starting transaction for firewall=%p group=%p flags=%x", + firewall, group, group->actionFlags); firewall->currentGroup = idx; group->addingRollback = false; for (i = 0; i < group->naction; i++) { @@ -879,8 +940,6 @@ virFirewallApply(virFirewallPtr firewall) int ret = -1; virMutexLock(&ruleLock); - if (virFirewallInitialize() < 0) - goto cleanup; if (!firewall || firewall->err == ENOMEM) { virReportOOMError(); diff --git a/src/util/viriptables.c b/src/util/viriptables.c index 4f3ac9c..46b4017 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -52,8 +52,6 @@ VIR_LOG_INIT("util.iptables"); -bool iptables_supports_xlock = false; - #define VIR_FROM_THIS VIR_FROM_NONE enum { -- 2.1.0

5 6