[libvirt] UDP broadcasts vs. nat Masquerading issue
by Nikolai Zhubr
Hi all,
I'm observing an issue that as soon as libvirt starts, UPD broadcasts
flowing through physical network (and intended for other services,
unrelated to any virtualization) get broken. Specifically, windows
neighbourhood browsing through samba's nmbd starts suffering badly
(Samba is running on this same box).
At the moment I'm running a quite outdated version 1.2.9 of libvirt, but
because other than this issue it does its job pretty well I'd first
consider some patching/backporting rather than totally replacing it with
a new one. Anyway, I first need to better understand what is going on
and what is wrong with it.
This could also be related somewhat to
https://www.redhat.com/archives/libvir-list/2013-September/msg01311.html
but I suppose it is not exactly that thing, and besides, my version does
already include a fix for the broadcasts issue mentioned in the msg01311.
I've already figured the source of trouble is anyway related to these
rules added:
-A POSTROUTING -o br0 -j MASQUERADE
-A POSTROUTING -o enp0s25 -j MASQUERADE
-A POSTROUTING -o virbr2_nic -j MASQUERADE
-A POSTROUTING -o vnet0 -j MASQUERADE
Here, virbr2_nic and vnet0 are used by libvirt for arranging NAT-mode
network configurations for VMs, unrelated to normal network stuff, so it
looks ok. However, br0 (with enp0s25 in it) is a main interface of this
host with primary ip address. And enp0s25 is a physical nic of this
host, and it is used for all sorts of regular (unrelated to
virtualization) communications as well. Also, br0 is used for attaching
some bridge-mode (as opposed to NAT-mode) VMs managed by libvirt, but
bridge mode is not supposed to employ address translation anyway.
So, clearly, libvirt somehow chooses to set up masquerading for
literally all existing network interfaces here (except lo), but I can't
see a reason for the first two rules in the list above. Furthermore,
they corrupt UDP broadcats coming from outside and reaching this host
(through enp0s25/br0) such that source address gets replaced by this
hosts primary address (as per masquerading). I've verified this by
arranging a hand-crafted UDP listener and printing the respective source
addresses as seen by normal userspace. Obviously Samba server can not
work correctly under such conditions.
Now I've discovered that I can "eliminate" the problem by e.g.:
1. Removing "-A POSTROUTING -o br0 -j MASQUERADE" (manual brute force)
2. Inserting "-A POSTROUTING -s 192.168.0.0/24 -d 192.168.0.255/32 -j
ACCEPT"
(Of course correcting rules by hand is not a solution, just a test)
So question is, how the correct rules should ideally look like? And, is
this issue known/fixed in most current libvirt?
Thank you,
Regards,
Nikolai
6 years
[libvirt] [PATCH] remote: remove the only use of LIBVIRTD_CONFIGURATION_FILE
by Fabiano Fidêncio
86fbce56f27e removed the constant, but didn't actually adjust the only
place where the constant was used.
Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com>
---
This patch fixes a build breakage.
It's either this, or reverting 86fbce56f27e.
---
src/remote/remote_daemon.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/src/remote/remote_daemon.c b/src/remote/remote_daemon.c
index fdc9e4333a..3cd7b16163 100644
--- a/src/remote/remote_daemon.c
+++ b/src/remote/remote_daemon.c
@@ -899,9 +899,6 @@ daemonUsage(const char *argv0, bool privileged)
_("\n"
" Default paths:\n"
"\n"
- " Configuration file (unless overridden by -f):\n"
- " %s\n"
- "\n"
" Sockets:\n"
" %s\n"
" %s\n"
@@ -914,7 +911,6 @@ daemonUsage(const char *argv0, bool privileged)
" PID file (unless overridden by -p):\n"
" %s/run/libvirtd.pid\n"
"\n"),
- LIBVIRTD_CONFIGURATION_FILE,
LIBVIRTD_PRIV_UNIX_SOCKET,
LIBVIRTD_PRIV_UNIX_SOCKET_RO,
LIBVIRT_CACERT,
--
2.21.0
6 years
[libvirt] [PATCH] Revert "remote: remove unused constant for libvirtd config file"
by Peter Krempa
The constant is not unused and breaks the build of the remote driver.
This reverts commit 86fbce56f27e06b34d63879c9f634a58a1e0a04a.
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
Pushed under the build-breaker rule.
src/remote/remote_driver.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/remote/remote_driver.h b/src/remote/remote_driver.h
index 132e478ef3..8c7da6b000 100644
--- a/src/remote/remote_driver.h
+++ b/src/remote/remote_driver.h
@@ -34,6 +34,7 @@ unsigned long remoteVersion(void);
#define LIBVIRTD_PRIV_UNIX_SOCKET LOCALSTATEDIR "/run/libvirt/libvirt-sock"
#define LIBVIRTD_PRIV_UNIX_SOCKET_RO LOCALSTATEDIR "/run/libvirt/libvirt-sock-ro"
#define LIBVIRTD_USER_UNIX_SOCKET "libvirt-sock"
+#define LIBVIRTD_CONFIGURATION_FILE SYSCONFDIR "/libvirt/libvirtd.conf"
/* Defaults for PKI directory. */
#define LIBVIRT_PKI_DIR SYSCONFDIR "/pki"
--
2.21.0
6 years
[libvirt] [PATCH python 0/2] spec: fedora tweaks
by Cole Robinson
Some fedora version tweaks
Cole Robinson (2):
spec: Unconditionally build python2 on Fedora
spec: Bump minimum supported Fedora version to 29
libvirt-python.spec.in | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--
2.21.0
6 years
[libvirt] [PATCH] remote: remove unused constant for libvirtd config file
by Daniel P. Berrangé
The LIBVIRTD_CONFIGURATION_FILE constant was introduced in
commit b7c42619e69acd8416be88b8aa3b4161bc813f8a
Author: Richard W.M. Jones <rjones(a)redhat.com>
Date: Mon Jun 11 11:43:41 2007 +0000
Mon Jun 11 12:41:00 BST 2007 Richard W.M. Jones <rjones(a)redhat.com>
and then never used !
Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com>
---
Pushed under the trivial rule
src/remote/remote_driver.h | 1 -
1 file changed, 1 deletion(-)
diff --git a/src/remote/remote_driver.h b/src/remote/remote_driver.h
index 8c7da6b000..132e478ef3 100644
--- a/src/remote/remote_driver.h
+++ b/src/remote/remote_driver.h
@@ -34,7 +34,6 @@ unsigned long remoteVersion(void);
#define LIBVIRTD_PRIV_UNIX_SOCKET LOCALSTATEDIR "/run/libvirt/libvirt-sock"
#define LIBVIRTD_PRIV_UNIX_SOCKET_RO LOCALSTATEDIR "/run/libvirt/libvirt-sock-ro"
#define LIBVIRTD_USER_UNIX_SOCKET "libvirt-sock"
-#define LIBVIRTD_CONFIGURATION_FILE SYSCONFDIR "/libvirt/libvirtd.conf"
/* Defaults for PKI directory. */
#define LIBVIRT_PKI_DIR SYSCONFDIR "/pki"
--
2.21.0
6 years
[libvirt] ANNOUNCE: virt-manager 2.2.1 released
by Cole Robinson
I'm happy to announce the release of virt-manager 2.2.1!
virt-manager is a desktop application for managing KVM, Xen, and LXC
virtualization via libvirt.
The release can be downloaded from:
http://virt-manager.org/download/
This release includes:
- CVE-2019-10183: Replace --unattended user-password and admin-password
with user-password-file and admin-password-file (Fabiano Fidêncio)
- Consistent --memballoon default across non-x86 (Andrea Bolognani)
- virt-install: add --numatune memnode.* (Athina Plaskasoviti)
- Drop hard dep on gtksourceview4, gtksourceview3 is fine as well
Thanks to everyone who has contributed to this release through testing,
bug reporting, submitting patches, and otherwise sending in feedback!
Thanks,
Cole
6 years
[libvirt] [PATCH] mingw: distribute schemas/networkport.rng
by Cole Robinson
Signed-off-by: Cole Robinson <crobinso(a)redhat.com>
---
Pushed as a build breaker. Anyone know why we list these
explicitly rather than use a wildcard? libvirt.spec.in is
the same
mingw-libvirt.spec.in | 2 ++
1 file changed, 2 insertions(+)
diff --git a/mingw-libvirt.spec.in b/mingw-libvirt.spec.in
index 280db4d1aa..ad6d6e952e 100644
--- a/mingw-libvirt.spec.in
+++ b/mingw-libvirt.spec.in
@@ -237,6 +237,7 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh
%{mingw32_datadir}/libvirt/schemas/interface.rng
%{mingw32_datadir}/libvirt/schemas/network.rng
%{mingw32_datadir}/libvirt/schemas/networkcommon.rng
+%{mingw32_datadir}/libvirt/schemas/networkport.rng
%{mingw32_datadir}/libvirt/schemas/nodedev.rng
%{mingw32_datadir}/libvirt/schemas/nwfilter.rng
%{mingw32_datadir}/libvirt/schemas/nwfilter_params.rng
@@ -325,6 +326,7 @@ rm -rf $RPM_BUILD_ROOT%{mingw64_libexecdir}/libvirt-guests.sh
%{mingw64_datadir}/libvirt/schemas/interface.rng
%{mingw64_datadir}/libvirt/schemas/network.rng
%{mingw64_datadir}/libvirt/schemas/networkcommon.rng
+%{mingw64_datadir}/libvirt/schemas/networkport.rng
%{mingw64_datadir}/libvirt/schemas/nodedev.rng
%{mingw64_datadir}/libvirt/schemas/nwfilter.rng
%{mingw64_datadir}/libvirt/schemas/nwfilter_params.rng
--
2.21.0
6 years
[libvirt] [PATCH] Do not keep empty log files for deleted domains
by Jan Zerebecki
With logrotates copytruncate when e.g. domain1 doesn't exist anymore
/var/log/libvirt/qemu/domain1.log will still exist after rotation even
though it will never be written to. When new domain names keep getting
used this leads to a lot of empty logfiles. This may lead to slowdown or
lack of free disk space / inodes.
Fix this by replacing copytruncate with the apropriate postrotate
command to reopen log files. Thus after the apropriate time log files
for deleted domains will be gone. This also has the advantage that the
chance for loss of a few lines during copytruncate is gone.
Signed-off-by: Jan Zerebecki <jan.suse(a)zerebecki.de>
---
src/remote/libvirtd.libxl.logrotate.in | 4 +++-
src/remote/libvirtd.logrotate.in | 4 +++-
src/remote/libvirtd.lxc.logrotate.in | 4 +++-
src/remote/libvirtd.qemu.logrotate.in | 4 +++-
4 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/src/remote/libvirtd.libxl.logrotate.in b/src/remote/libvirtd.libxl.logrotate.in
index cb7f07d846..d4f25f8cab 100644
--- a/src/remote/libvirtd.libxl.logrotate.in
+++ b/src/remote/libvirtd.libxl.logrotate.in
@@ -4,5 +4,7 @@
rotate 4
compress
delaycompress
- copytruncate
+ postrotate
+ /usr/bin/killall -USR1 virtlogd
+ endscript
}
diff --git a/src/remote/libvirtd.logrotate.in b/src/remote/libvirtd.logrotate.in
index 4e02510c8b..73dab7579f 100644
--- a/src/remote/libvirtd.logrotate.in
+++ b/src/remote/libvirtd.logrotate.in
@@ -4,6 +4,8 @@
rotate 4
compress
delaycompress
- copytruncate
minsize 100k
+ postrotate
+ /usr/bin/killall -USR1 virtlogd
+ endscript
}
diff --git a/src/remote/libvirtd.lxc.logrotate.in b/src/remote/libvirtd.lxc.logrotate.in
index 2bb9dfba12..eed47bb55f 100644
--- a/src/remote/libvirtd.lxc.logrotate.in
+++ b/src/remote/libvirtd.lxc.logrotate.in
@@ -4,5 +4,7 @@
rotate 4
compress
delaycompress
- copytruncate
+ postrotate
+ /usr/bin/killall -USR1 virtlogd
+ endscript
}
diff --git a/src/remote/libvirtd.qemu.logrotate.in b/src/remote/libvirtd.qemu.logrotate.in
index cdb399ef23..95407cec1a 100644
--- a/src/remote/libvirtd.qemu.logrotate.in
+++ b/src/remote/libvirtd.qemu.logrotate.in
@@ -4,5 +4,7 @@
rotate 4
compress
delaycompress
- copytruncate
+ postrotate
+ /usr/bin/killall -USR1 virtlogd
+ endscript
}
--
2.20.1
6 years
[libvirt] [PATCH] remote: remove obsolete rule for generating sysvinit script
by Daniel P. Berrangé
The sysvinit script was previously removed in
commit 912fe2df9d8628b2f3d54485f1cb919cb124d07a
Author: Andrea Bolognani <abologna(a)redhat.com>
Date: Fri Mar 15 16:47:27 2019 +0100
Drop support for "Red Hat" init scripts
A make rule was accidentally left behind.
Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com>
---
src/remote/Makefile.inc.am | 9 ---------
1 file changed, 9 deletions(-)
diff --git a/src/remote/Makefile.inc.am b/src/remote/Makefile.inc.am
index 013cd3e382..43ad53bedb 100644
--- a/src/remote/Makefile.inc.am
+++ b/src/remote/Makefile.inc.am
@@ -296,15 +296,6 @@ INSTALL_DATA_LOCAL += install-sasl
UNINSTALL_LOCAL += uninstall-sasl
endif WITH_SASL
-libvirtd.init: remote/libvirtd.init.in $(top_builddir)/config.status
- $(AM_V_GEN)sed \
- -e 's|[@]localstatedir[@]|$(localstatedir)|g' \
- -e 's|[@]sbindir[@]|$(sbindir)|g' \
- -e 's|[@]sysconfdir[@]|$(sysconfdir)|g' \
- < $< > $@-t && \
- chmod a+x $@-t && \
- mv $@-t $@
-
libvirtd.service: remote/libvirtd.service.in $(top_builddir)/config.status
$(AM_V_GEN)sed \
-e 's|[@]localstatedir[@]|$(localstatedir)|g' \
--
2.21.0
6 years
[libvirt] [PATCH] remote: remove obsolete params from sysconf file
by Daniel P. Berrangé
The LIBVIRTD_CONFIG and LIBVIRTD_NOFILES_LIMIT parameters were only
honoured when using the sysvinit scripts. This was removed already in
commit 912fe2df9d8628b2f3d54485f1cb919cb124d07a
Author: Andrea Bolognani <abologna(a)redhat.com>
Date: Fri Mar 15 16:47:27 2019 +0100
Drop support for "Red Hat" init scripts
so the parameters can safely be dropped.
Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com>
---
src/remote/libvirtd.sysconf | 18 +-----------------
1 file changed, 1 insertion(+), 17 deletions(-)
diff --git a/src/remote/libvirtd.sysconf b/src/remote/libvirtd.sysconf
index f15e5956eb..60a47c252f 100644
--- a/src/remote/libvirtd.sysconf
+++ b/src/remote/libvirtd.sysconf
@@ -1,8 +1,4 @@
-# Override the default config file
-# NOTE: This setting is no longer honoured if using
-# systemd. Set '--config /etc/libvirt/libvirtd.conf'
-# in LIBVIRTD_ARGS instead.
-#LIBVIRTD_CONFIG=/etc/libvirt/libvirtd.conf
+# Customizations for the libvirtd.service systemd unit
# Listen for TCP/IP connections
# NB. must setup TLS/SSL keys prior to using this
@@ -19,15 +15,3 @@
#QEMU_AUDIO_DRV=sdl
#
#SDL_AUDIODRIVER=pulse
-
-# Override the maximum number of opened files.
-# This only works with traditional init scripts.
-# In the systemd world, the limit can only be changed by overriding
-# LimitNOFILE for libvirtd.service. To do that, just create a *.conf
-# file in /etc/systemd/system/libvirtd.service.d/ (for example
-# /etc/systemd/system/libvirtd.service.d/openfiles.conf) and write
-# the following two lines in it:
-# [Service]
-# LimitNOFILE=2048
-#
-#LIBVIRTD_NOFILES_LIMIT=2048
--
2.21.0
6 years
