July 2019 - Devel - libvirt List Archives

[libvirt] UDP broadcasts vs. nat Masquerading issue
by Nikolai Zhubr 04 Jul '19

04 Jul '19

Hi all, I'm observing an issue that as soon as libvirt starts, UPD broadcasts flowing through physical network (and intended for other services, unrelated to any virtualization) get broken. Specifically, windows neighbourhood browsing through samba's nmbd starts suffering badly (Samba is running on this same box). At the moment I'm running a quite outdated version 1.2.9 of libvirt, but because other than this issue it does its job pretty well I'd first consider some patching/backporting rather than totally replacing it with a new one. Anyway, I first need to better understand what is going on and what is wrong with it. This could also be related somewhat to https://www.redhat.com/archives/libvir-list/2013-September/msg01311.html but I suppose it is not exactly that thing, and besides, my version does already include a fix for the broadcasts issue mentioned in the msg01311. I've already figured the source of trouble is anyway related to these rules added: -A POSTROUTING -o br0 -j MASQUERADE -A POSTROUTING -o enp0s25 -j MASQUERADE -A POSTROUTING -o virbr2_nic -j MASQUERADE -A POSTROUTING -o vnet0 -j MASQUERADE Here, virbr2_nic and vnet0 are used by libvirt for arranging NAT-mode network configurations for VMs, unrelated to normal network stuff, so it looks ok. However, br0 (with enp0s25 in it) is a main interface of this host with primary ip address. And enp0s25 is a physical nic of this host, and it is used for all sorts of regular (unrelated to virtualization) communications as well. Also, br0 is used for attaching some bridge-mode (as opposed to NAT-mode) VMs managed by libvirt, but bridge mode is not supposed to employ address translation anyway. So, clearly, libvirt somehow chooses to set up masquerading for literally all existing network interfaces here (except lo), but I can't see a reason for the first two rules in the list above. Furthermore, they corrupt UDP broadcats coming from outside and reaching this host (through enp0s25/br0) such that source address gets replaced by this hosts primary address (as per masquerading). I've verified this by arranging a hand-crafted UDP listener and printing the respective source addresses as seen by normal userspace. Obviously Samba server can not work correctly under such conditions. Now I've discovered that I can "eliminate" the problem by e.g.: 1. Removing "-A POSTROUTING -o br0 -j MASQUERADE" (manual brute force) 2. Inserting "-A POSTROUTING -s 192.168.0.0/24 -d 192.168.0.255/32 -j ACCEPT" (Of course correcting rules by hand is not a solution, just a test) So question is, how the correct rules should ideally look like? And, is this issue known/fixed in most current libvirt? Thank you, Regards, Nikolai

2 1

[libvirt] [PATCH] remote: remove the only use of LIBVIRTD_CONFIGURATION_FILE
by Fabiano Fidêncio 04 Jul '19

04 Jul '19

86fbce56f27e removed the constant, but didn't actually adjust the only place where the constant was used. Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com> --- This patch fixes a build breakage. It's either this, or reverting 86fbce56f27e. --- src/remote/remote_daemon.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/remote/remote_daemon.c b/src/remote/remote_daemon.c index fdc9e4333a..3cd7b16163 100644 --- a/src/remote/remote_daemon.c +++ b/src/remote/remote_daemon.c @@ -899,9 +899,6 @@ daemonUsage(const char *argv0, bool privileged) _("\n" " Default paths:\n" "\n" - " Configuration file (unless overridden by -f):\n" - " %s\n" - "\n" " Sockets:\n" " %s\n" " %s\n" @@ -914,7 +911,6 @@ daemonUsage(const char *argv0, bool privileged) " PID file (unless overridden by -p):\n" " %s/run/libvirtd.pid\n" "\n"), - LIBVIRTD_CONFIGURATION_FILE, LIBVIRTD_PRIV_UNIX_SOCKET, LIBVIRTD_PRIV_UNIX_SOCKET_RO, LIBVIRT_CACERT, -- 2.21.0

5 5

[libvirt] [PATCH] Revert "remote: remove unused constant for libvirtd config file"
by Peter Krempa 04 Jul '19

04 Jul '19

The constant is not unused and breaks the build of the remote driver. This reverts commit 86fbce56f27e06b34d63879c9f634a58a1e0a04a. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Pushed under the build-breaker rule. src/remote/remote_driver.h | 1 + 1 file changed, 1 insertion(+) diff --git a/src/remote/remote_driver.h b/src/remote/remote_driver.h index 132e478ef3..8c7da6b000 100644 --- a/src/remote/remote_driver.h +++ b/src/remote/remote_driver.h @@ -34,6 +34,7 @@ unsigned long remoteVersion(void); #define LIBVIRTD_PRIV_UNIX_SOCKET LOCALSTATEDIR "/run/libvirt/libvirt-sock" #define LIBVIRTD_PRIV_UNIX_SOCKET_RO LOCALSTATEDIR "/run/libvirt/libvirt-sock-ro" #define LIBVIRTD_USER_UNIX_SOCKET "libvirt-sock" +#define LIBVIRTD_CONFIGURATION_FILE SYSCONFDIR "/libvirt/libvirtd.conf" /* Defaults for PKI directory. */ #define LIBVIRT_PKI_DIR SYSCONFDIR "/pki" -- 2.21.0

2 1

[libvirt] [PATCH python 0/2] spec: fedora tweaks
by Cole Robinson 04 Jul '19

04 Jul '19

Some fedora version tweaks Cole Robinson (2): spec: Unconditionally build python2 on Fedora spec: Bump minimum supported Fedora version to 29 libvirt-python.spec.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.21.0

2 3

[libvirt] [PATCH] remote: remove unused constant for libvirtd config file
by Daniel P. Berrangé 04 Jul '19

04 Jul '19

The LIBVIRTD_CONFIGURATION_FILE constant was introduced in commit b7c42619e69acd8416be88b8aa3b4161bc813f8a Author: Richard W.M. Jones <rjones(a)redhat.com> Date: Mon Jun 11 11:43:41 2007 +0000 Mon Jun 11 12:41:00 BST 2007 Richard W.M. Jones <rjones(a)redhat.com> and then never used ! Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Pushed under the trivial rule src/remote/remote_driver.h | 1 - 1 file changed, 1 deletion(-) diff --git a/src/remote/remote_driver.h b/src/remote/remote_driver.h index 8c7da6b000..132e478ef3 100644 --- a/src/remote/remote_driver.h +++ b/src/remote/remote_driver.h @@ -34,7 +34,6 @@ unsigned long remoteVersion(void); #define LIBVIRTD_PRIV_UNIX_SOCKET LOCALSTATEDIR "/run/libvirt/libvirt-sock" #define LIBVIRTD_PRIV_UNIX_SOCKET_RO LOCALSTATEDIR "/run/libvirt/libvirt-sock-ro" #define LIBVIRTD_USER_UNIX_SOCKET "libvirt-sock" -#define LIBVIRTD_CONFIGURATION_FILE SYSCONFDIR "/libvirt/libvirtd.conf" /* Defaults for PKI directory. */ #define LIBVIRT_PKI_DIR SYSCONFDIR "/pki" -- 2.21.0

3 2

[libvirt] ANNOUNCE: virt-manager 2.2.1 released
by Cole Robinson 04 Jul '19

04 Jul '19

I'm happy to announce the release of virt-manager 2.2.1! virt-manager is a desktop application for managing KVM, Xen, and LXC virtualization via libvirt. The release can be downloaded from: http://virt-manager.org/download/ This release includes: - CVE-2019-10183: Replace --unattended user-password and admin-password with user-password-file and admin-password-file (Fabiano Fidêncio) - Consistent --memballoon default across non-x86 (Andrea Bolognani) - virt-install: add --numatune memnode.* (Athina Plaskasoviti) - Drop hard dep on gtksourceview4, gtksourceview3 is fine as well Thanks to everyone who has contributed to this release through testing, bug reporting, submitting patches, and otherwise sending in feedback! Thanks, Cole

1 0

[libvirt] [PATCH] mingw: distribute schemas/networkport.rng
by Cole Robinson 03 Jul '19

03 Jul '19

Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- Pushed as a build breaker. Anyone know why we list these explicitly rather than use a wildcard? libvirt.spec.in is the same mingw-libvirt.spec.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mingw-libvirt.spec.in b/mingw-libvirt.spec.in index 280db4d1aa..ad6d6e952e 100644 --- a/mingw-libvirt.spec.in +++ b/mingw-libvirt.spec.in @@ -237,6 +237,7 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh %{mingw32_datadir}/libvirt/schemas/interface.rng %{mingw32_datadir}/libvirt/schemas/network.rng %{mingw32_datadir}/libvirt/schemas/networkcommon.rng +%{mingw32_datadir}/libvirt/schemas/networkport.rng %{mingw32_datadir}/libvirt/schemas/nodedev.rng %{mingw32_datadir}/libvirt/schemas/nwfilter.rng %{mingw32_datadir}/libvirt/schemas/nwfilter_params.rng @@ -325,6 +326,7 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh %{mingw64_datadir}/libvirt/schemas/interface.rng %{mingw64_datadir}/libvirt/schemas/network.rng %{mingw64_datadir}/libvirt/schemas/networkcommon.rng +%{mingw64_datadir}/libvirt/schemas/networkport.rng %{mingw64_datadir}/libvirt/schemas/nodedev.rng %{mingw64_datadir}/libvirt/schemas/nwfilter.rng %{mingw64_datadir}/libvirt/schemas/nwfilter_params.rng -- 2.21.0

2 1

[libvirt] [PATCH] Do not keep empty log files for deleted domains
by Jan Zerebecki 03 Jul '19

03 Jul '19

With logrotates copytruncate when e.g. domain1 doesn't exist anymore /var/log/libvirt/qemu/domain1.log will still exist after rotation even though it will never be written to. When new domain names keep getting used this leads to a lot of empty logfiles. This may lead to slowdown or lack of free disk space / inodes. Fix this by replacing copytruncate with the apropriate postrotate command to reopen log files. Thus after the apropriate time log files for deleted domains will be gone. This also has the advantage that the chance for loss of a few lines during copytruncate is gone. Signed-off-by: Jan Zerebecki <jan.suse(a)zerebecki.de> --- src/remote/libvirtd.libxl.logrotate.in | 4 +++- src/remote/libvirtd.logrotate.in | 4 +++- src/remote/libvirtd.lxc.logrotate.in | 4 +++- src/remote/libvirtd.qemu.logrotate.in | 4 +++- 4 files changed, 12 insertions(+), 4 deletions(-) diff --git a/src/remote/libvirtd.libxl.logrotate.in b/src/remote/libvirtd.libxl.logrotate.in index cb7f07d846..d4f25f8cab 100644 --- a/src/remote/libvirtd.libxl.logrotate.in +++ b/src/remote/libvirtd.libxl.logrotate.in @@ -4,5 +4,7 @@ rotate 4 compress delaycompress - copytruncate + postrotate + /usr/bin/killall -USR1 virtlogd + endscript } diff --git a/src/remote/libvirtd.logrotate.in b/src/remote/libvirtd.logrotate.in index 4e02510c8b..73dab7579f 100644 --- a/src/remote/libvirtd.logrotate.in +++ b/src/remote/libvirtd.logrotate.in @@ -4,6 +4,8 @@ rotate 4 compress delaycompress - copytruncate minsize 100k + postrotate + /usr/bin/killall -USR1 virtlogd + endscript } diff --git a/src/remote/libvirtd.lxc.logrotate.in b/src/remote/libvirtd.lxc.logrotate.in index 2bb9dfba12..eed47bb55f 100644 --- a/src/remote/libvirtd.lxc.logrotate.in +++ b/src/remote/libvirtd.lxc.logrotate.in @@ -4,5 +4,7 @@ rotate 4 compress delaycompress - copytruncate + postrotate + /usr/bin/killall -USR1 virtlogd + endscript } diff --git a/src/remote/libvirtd.qemu.logrotate.in b/src/remote/libvirtd.qemu.logrotate.in index cdb399ef23..95407cec1a 100644 --- a/src/remote/libvirtd.qemu.logrotate.in +++ b/src/remote/libvirtd.qemu.logrotate.in @@ -4,5 +4,7 @@ rotate 4 compress delaycompress - copytruncate + postrotate + /usr/bin/killall -USR1 virtlogd + endscript } -- 2.20.1

4 7

[libvirt] [PATCH] remote: remove obsolete rule for generating sysvinit script
by Daniel P. Berrangé 03 Jul '19

03 Jul '19

The sysvinit script was previously removed in commit 912fe2df9d8628b2f3d54485f1cb919cb124d07a Author: Andrea Bolognani <abologna(a)redhat.com> Date: Fri Mar 15 16:47:27 2019 +0100 Drop support for "Red Hat" init scripts A make rule was accidentally left behind. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/remote/Makefile.inc.am | 9 --------- 1 file changed, 9 deletions(-) diff --git a/src/remote/Makefile.inc.am b/src/remote/Makefile.inc.am index 013cd3e382..43ad53bedb 100644 --- a/src/remote/Makefile.inc.am +++ b/src/remote/Makefile.inc.am @@ -296,15 +296,6 @@ INSTALL_DATA_LOCAL += install-sasl UNINSTALL_LOCAL += uninstall-sasl endif WITH_SASL -libvirtd.init: remote/libvirtd.init.in $(top_builddir)/config.status - $(AM_V_GEN)sed \ - -e 's|[@]localstatedir[@]|$(localstatedir)|g' \ - -e 's|[@]sbindir[@]|$(sbindir)|g' \ - -e 's|[@]sysconfdir[@]|$(sysconfdir)|g' \ - < $< > $@-t && \ - chmod a+x $@-t && \ - mv $@-t $@ - libvirtd.service: remote/libvirtd.service.in $(top_builddir)/config.status $(AM_V_GEN)sed \ -e 's|[@]localstatedir[@]|$(localstatedir)|g' \ -- 2.21.0

2 2

[libvirt] [PATCH] remote: remove obsolete params from sysconf file
by Daniel P. Berrangé 03 Jul '19

03 Jul '19

The LIBVIRTD_CONFIG and LIBVIRTD_NOFILES_LIMIT parameters were only honoured when using the sysvinit scripts. This was removed already in commit 912fe2df9d8628b2f3d54485f1cb919cb124d07a Author: Andrea Bolognani <abologna(a)redhat.com> Date: Fri Mar 15 16:47:27 2019 +0100 Drop support for "Red Hat" init scripts so the parameters can safely be dropped. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/remote/libvirtd.sysconf | 18 +----------------- 1 file changed, 1 insertion(+), 17 deletions(-) diff --git a/src/remote/libvirtd.sysconf b/src/remote/libvirtd.sysconf index f15e5956eb..60a47c252f 100644 --- a/src/remote/libvirtd.sysconf +++ b/src/remote/libvirtd.sysconf @@ -1,8 +1,4 @@ -# Override the default config file -# NOTE: This setting is no longer honoured if using -# systemd. Set '--config /etc/libvirt/libvirtd.conf' -# in LIBVIRTD_ARGS instead. -#LIBVIRTD_CONFIG=/etc/libvirt/libvirtd.conf +# Customizations for the libvirtd.service systemd unit # Listen for TCP/IP connections # NB. must setup TLS/SSL keys prior to using this @@ -19,15 +15,3 @@ #QEMU_AUDIO_DRV=sdl # #SDL_AUDIODRIVER=pulse - -# Override the maximum number of opened files. -# This only works with traditional init scripts. -# In the systemd world, the limit can only be changed by overriding -# LimitNOFILE for libvirtd.service. To do that, just create a *.conf -# file in /etc/systemd/system/libvirtd.service.d/ (for example -# /etc/systemd/system/libvirtd.service.d/openfiles.conf) and write -# the following two lines in it: -# [Service] -# LimitNOFILE=2048 -# -#LIBVIRTD_NOFILES_LIMIT=2048 -- 2.21.0

2 3