- Devel - libvirt List Archives

[Libvir] brSetForwardDelay / brSetEnableSTP
by Richard W.M. Jones 21 Nov '07

21 Nov '07

This code in qemu_driver.c doesn't look right to me. I think the second should be a call to brSetEnableSTP? Rich. if (network->def->forwardDelay && (err = brSetForwardDelay(driver->brctl, network->bridge, network->def->forwardDelay))) { qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, "failed to set bridge forward delay to %d\n", network->def->forwardDelay); goto err_delbr; } if ((err = brSetForwardDelay(driver->brctl, network->bridge, network->def->disableSTP ? 0 : 1))) { qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, "failed to set bridge STP to %s\n", network->def->disableSTP ? "off" : "on"); goto err_delbr; } -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

2 3

[Libvir] [PATCH] virterror Cleanups
by Saori Fukuta 20 Nov '07

20 Nov '07

Hi, The virsh command sometimes says wrong message that indicating where the error is coming from. So I have some fixes for libvirt error. * Add two number for virErrorDomain (virterror.h) * Add six message indicating where it's coming from (virterror.c) * Fix virErrorDomain number specified with __virRaiseError (openvz_conf.c/openvz_driver.c/stats_linux.c/xm_internal.c) Regards, Saori Fukuta

3 4

[Libvir] ANNOUNCE: Ruby bindings for libvirt
by David Lutterkort 20 Nov '07

20 Nov '07

I'm pleased to announce the availability of Ruby bindings for libvirt. The main site for them is http://libvirt.org/ruby API docs can be found at http://libvirt.org/ruby/api/index.html An initial release is at http://libvirt.org/ruby/download - the bindings are mostly complete, though there are a number of less frequently used functions that are not covered yet. Please send all your patches (and comments/questions) to this list. David

3 3

[Libvir] [PATCH]: Add virNodeGetInfo to ruby bindings
by Chris Lalancette 19 Nov '07

19 Nov '07

All, Attached is a patch to add the virNodeGetInfo() call to the Libvirt Ruby bindings. Although it is not technically a virConn* function, it acts like one since it uses the virConnectPtr structure, so I put it with those functions. Let me know if I am doing anything completely crazy in here; this is my first stab at Ruby binding code. It works like so: require 'libvirt' conn = Libvirt::open("qemu:///system") ni = c.nodeGetInfo print ni Signed-off-by: Chris Lalancette <clalance(a)redhat.com>

2 1

[Libvir] [Suggestion] The "ISP scenario"
by Richard W.M. Jones 19 Nov '07

19 Nov '07

This pattern has come up a few times now: ISP provides a Xen hosting service to customers. ISP wants to provide some basic statistics to their customers. The statistics could be provided to a customer through the libvirt remote protocol, eg: customer$ virsh -c xen://dom0/ dominfo mydom But the problem with this is that (as libvirt is currently architected) _any_ access to dom0, if it authenticates, gives access to information from all domains. We've previously discussed adding access control using something like SELinux (see for example: https://www.redhat.com/archives/libvir-list/2007-August/msg00030.html) but nothing much has come of it so far. But can we solve the single common case above directly, without thwarting our ability to solve the bigger picture later? My suggestion is that we add an option to /etc/libvirt/libvirtd.conf, something like: tls_restrict_dn: [ "DN1", "name:customer1", "DN2", "uuid:12345678", "DN3", "*" ] with the meaning that (presumably a customer) connecting with certificate DN1 could only find out information about the domain "customer1", DN2 similarly, DN3 is a privileged client, and any other DN would be rejected. (Compare and contrast to tls_allowed_dn_list: http://libvirt.org/remote.html#Remote_libvirtd_configuration) An implementation of this would modify the call to virConnectOpen to add an additional flag (or call?) allowing the access control to be passed, and this would have to be checked in the relevant virDomain* calls. This is not dissimilar to how read-only connections are implemented in libvirtd currently. I would also suggest as a matter of course that we modify all public API calls in src/libvirt.c to add a call to a generic permission checking routine, for example: int virDomainSuspend(virDomainPtr domain) { virConnectPtr conn; DEBUG("domain=%p", domain); if (!VIR_IS_CONNECTED_DOMAIN(domain)) { virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); return (-1); } - if (domain->conn->flags & VIR_CONNECT_RO) { - virLibDomainError(domain, VIR_ERR_OPERATION_DENIED, __FUNCTION__); - return (-1); - } + if (!check_permission (domain, OP_SUSPEND)) return -1; With the initial implementation of check_permission just doing the VIR_CONNECT_RO check to start with, but able to do other checks in future. Also relevant to this is SASL support, see: https://www.redhat.com/archives/libvir-list/2007-November/msg00005.html since AIUI this changes the possible formats for Distinguished Names, or could even make DNs irrelevant. Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

3 2

[Libvir] [Bug] keymap tag for vnc connections ignored for qemu and kvm
by C. Hemsing 19 Nov '07

19 Nov '07

The keymap entry in the respective xml file is being ignored when starting qemu. It should be honoured in src/qemu_conf.c when setting up argv in function qemudBuildCommandLine in case keymap is set and vnc has been chosen. Ignoring the keymap (not issuing -k ...) will make vnc impossible to use for many international keyboards. I've filed a bug report (https://bugzilla.redhat.com/show_bug.cgi?id=390461) Cheers, Chris

1 0

[Libvir] [Bug] keymap tag for vnc connections ignored for qemu and kvm
by C. Hemsing 19 Nov '07

19 Nov '07

The keymap entry in the respective xml file is being ignored when starting qemu. It should be honoured in src/qemu_conf.c when setting up argv in function qemudBuildCommandLine in case keymap is set and vnc has been chosen. Ignoring the keymap (not issuing -k ...) will make vnc impossible to use for many international keyboards. I've filed a bug report (https://bugzilla.redhat.com/show_bug.cgi?id=390461) Cheers, Chris

1 0

[Libvir] PATCH: Fix stats overflow
by Daniel P. Berrange 19 Nov '07

19 Nov '07

FYI, I have just applied the attached patch to fix a 32-bit overflow in the stats code. We were doing a left shift of more than 32 bits on '1L' which is only 32-bit wide on 32-bit platforms. I simply cast to a long long instead. Regards, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

4 3

[Libvir] diagnose invalid domain ID numbers (and invalid integers, in general)
by Jim Meyering 18 Nov '07

18 Nov '07

Hello, There are over 30 uses of strtol in libvirt, and they all can silently accept invalid input. The invalid string might range from an outlandish domain ID like 4294967298 to strings of digits followed by bogus alpha. Maybe not worth worrying about, you say? But what if they indicate user confusion, e.g., 1,000 vs 1000? Silently interpreting "1,000" as "1" would leave the poor user even more confused :-) IMHO, they should all be diagnosed. Fixing them properly requires some infrastructure, so that you don't end up duplicating too much logic. This patch adds part of that infrastructure and fixes only a single instance, to start with. I'll fix the others once we're all agreed on the form of the infrastructure. I've fixed the bug that would make this command: echo domname $(echo 2^32+2|bc)|src/virsh ... act just like this one: echo domname 2|src/virsh ... Now, it does this: $ echo domname 4294967298|src/virsh --quiet --connect test://$PWD/docs/testnode.xml virsh > error: failed to get domain '4294967298' virsh > The new test script, tests/int-overflow demonstrates precisely that before/after behavior. This change adds some other new files. src/xstrtol.c and .h contain the first of a few new strtol-like functions. This first one, xstrtol_i, converts to an "int". Other wrappers will convert to wider types. The goal is to put the tedious tests into the wrappers so that applications can be robust without all the duplicated gore. It is important (from type-safety and maintainability standpoints) to ensure that the resulting integral value be "returned" via an argument pointer, not a return value. With the former, you're guaranteed to have matching types. Simply getting the value via "return", it is too easy to mistakenly change width or signedness. Here's the new function's description and signature: /* Like strtol, but produce an "int" result, and check more carefully. Return 0 upon success; return -1 to indicate failure. When END_PTR is NULL, the byte after the final valid digit must be NUL. Otherwise, it's like strtol and lets the caller check any suffix for validity. This function is careful to return -1 when the string S represents a number that is not representable as an "int". */ int xstrtol_i(char const *s, char **end_ptr, int base, int *result) My first attempt put the definition of xstrtol_i in the logical place: util.c. But that would have required linking virsh with util.c, and that fails due to an unsatisfied reference to __virRaiseError. So instead, it's in its own file, now. If you want it in some other file, just tell me where. BTW, I have no strong preference for the name xstrtol_i. Bear in mind that the name tells you that it's based on (and limited to) strtol's "long" type, and produces an 'i'nt value. It happens to be the same one used in at least one other project, and closely resembles the xstrto* functions in gnulib. Note that there are almost certainly places in the code where we'll want to use a variant that targets an unsigned type like "size_t" or a wider type like long long. In addition to other uses of strtol that I plan to fix, there are three uses of strtoll, too. Patch attached below. If you apply it with plain-old-patch, remember to run this: chmod a+x tests/int-overflow Thu Nov 8 09:59:43 CET 2007 Jim Meyering <meyering(a)redhat.com> Diagnose an invalid domain ID number. * src/virsh.c: Include "xstrtol.h" (vshCommandOptDomainBy): Detect integer overflow in domain ID number. * tests/int-overflow: New script. Test for the above-fixed bug. * tests/Makefile.am (TESTS): Add int-overflow. (TESTS_ENVIRONMENT): Define, to propagate $abs_top_* variables into the int-overflow script. (valgrind): Adapt rule not to clobber new TESTS_ENVIRONMENT. * src/xstrtol.h, src/xstrtol.c: New files. * src/Makefile.am (virsh_SOURCES): Add xstrtol.c and xstrtol.h. --- src/Makefile.am | 2 +- src/virsh.c | 10 ++++------ src/xstrtol.c | 33 +++++++++++++++++++++++++++++++++ src/xstrtol.h | 7 +++++++ tests/Makefile.am | 10 ++++++++-- tests/int-overflow | 22 ++++++++++++++++++++++ 6 files changed, 75 insertions(+), 9 deletions(-) create mode 100644 src/xstrtol.c create mode 100644 src/xstrtol.h create mode 100755 tests/int-overflow

3 8

[Libvir] [PATCH 0/2] KVM network stats
by Richard W.M. Jones 15 Nov '07

15 Nov '07

This two part patch collects network interface stats from KVM domains. With this patch, virt-top will show the stats in its network interface view, as in the screengrab below. Rich. virt-top 15:47:38 - x86_64 4/4CPU 2814MHz 3967MB 0.1% 1 domains, 1 active, 1 running, 0 sleeping, 0 paused, 0 inactive D:0 O:0 X:0 CPU: 3.0% Mem: 250 MB (250 MB by guests) ID S RXBY TXBY RXPK TXPK DOMAIN INTERFACE 1 R 222K 5436 175 78 debian32kvm vnet0 -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

2 5