- Devel - libvirt List Archives

[libvirt] [PATCH] fix up dom-name validation
by John Levon 10 Jul '08

10 Jul '08

libvirt schema: improve domain name regex This regexp is based upon what xend actually allows, plus the existing &, which I presume is there for a reason. Signed-off-by: John Levon <john.levon> Index: docs/libvirt.rng =================================================================== RCS file: /data/cvs/libvirt/docs/libvirt.rng,v retrieving revision 1.8 diff -u -r1.8 libvirt.rng --- docs/libvirt.rng 8 Jul 2008 12:05:13 -0000 1.8 +++ docs/libvirt.rng 10 Jul 2008 04:04:58 -0000 @@ -840,7 +840,7 @@ </define> <define name='domainName'> <data type='string'> - <param name="pattern">[a-zA-Z0-9_\+\-&]+</param> + <param name="pattern">[A-Za-z0-9_.:/\+\-&-]+</param> </data> </define> <define name='genericName'>

2 1

[libvirt] [PATCH] SetAutostart and GetAutostart in openvz driver
by Evgeniy Sokolov 10 Jul '08

10 Jul '08

Implemented functions domainSetAutostart and domainGetAutostart. other: fixed closing file descriptor during reading uuid from config.

3 3

[libvirt] virDomainMemoryPeek & maximum remote message buffer size
by Richard W.M. Jones 09 Jul '08

09 Jul '08

The kernel images that I want to snoop in virt-mem are around 16 MB in size. In the qemu / KVM case, these images have to travel over the remote connection. Because of limits on the maximum message size, they have to travel currently in 64 KB chunks, and it turns out that this is slow. Apparently the dominating factors are how long it takes to issue the 'memsave' command in the qemu monitor (there is some big constant overhead), and extra network round trips. The current remote message size is intentionally limited to 256KB (fully serialized, including all XDR headers and overhead), so the most we could practically send in a single message at the moment is 128KB if we stick to powers of two, or ~255KB if we don't. The reason we limit it is to avoid denial of service attacks, where a rogue client or server sends excessively large messages and causes the peer to allocate lots of memory [eg. if we didn't have any limit, then you could send a message which was several GB in size and cause problems at the other end, because the message is slurped in before it is fully parsed]. There is a second problem with reading the kernel in small chunks, namely that this allows the virtual machine to make a lot of progress, so we don't get anything near an 'instantaneous' snapshot (getting the kernel in a single chunk doesn't necessarily guarantee this either, but it's better). As an experiment, I tried increasing the maximum message to 32 MB, so that I could send the whole kernel in one go. Unfortunately just increasing the limit doesn't work for two reasons, one prosaic and one very weird: (1) The current code likes to keep message buffers on the stack, and because Linux limits the stack to something artificially small, this fails. Increasing the stack ulimit is a short-term fix for this, while testing. In the long term we could rewrite any code which does this to use heap buffers instead. (2) There is some really odd problem with our use of recv(2) which causes messages > 64 KB to fail. I have no idea what is really happening, but the sequence of events seems to be this: server client write(sock,buf,len) = len-k recv(sock,buf,len) = len-k write(sock,buf+len-k,len-k) = k recv(sock,buf,k) = 0 [NOT k] At this point the client assumes that the server has unexpectedly closed the connection and fails. I have stared at this for a while, but I've got no idea at all what's going on. A test program is attached. You'll need a 32 bit KVM guest. Rich. -- Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://et.redhat.com/~rjones/virt-df/

3 2

[libvirt] Web Interface -> LibVirt Communication?
by Henri Cook 09 Jul '08

09 Jul '08

Hi, I want to write a web tool that lets me administer my cluster from one location (including operations that things like virt-manager don't provide) - what's the proper way of achieving this? Can i communicate over TCP with libvirt on each server (is this documented?) or should I be trying to get my web app to auth and run virsh commands over SSH? Thanks. Henri

4 11

Re: [libvirt] libvirt-java
by Daniel Veillard 09 Jul '08

09 Jul '08

On Mon, Jul 07, 2008 at 01:14:40PM +0200, Tóth István wrote: > Daniel Veillard wrote: > > Ah, okay.... Well my perspective is that libvirt-java should include > > only parts which are directly releated to using libvirt on Java. I would > > really not try to reinvent or push any XML related APIs there, at least > > as part of libvirt bindings (I still have the scars from libxml2, believe > > me you don't want to push new XML APIs to programmers even specialized ones). > > > My thoughts exactly. Okay seems we agree on the fundamentals :-) > > But things like the XSD descriptiond might be useful generally, and > > IMHO are very tied to libvirt, so i think they are a good fit. > > > Absolutely. I've had major problems when I tried to use some Java XML > mapping libraries, because they can only process xsd, > and not the language you use. So having high-quality xsd definitions is > high on my personal wish-list. Okay > > Also fitting into this model are build makefiles for other environment, > > I understand that for most Java developpers, configure and make are really > > foreign tools, so adding ant/Eclipse/... build recipes for the package also > > makes a lot of sense. > > > Well, they certainly wouldn't hurt, but I don't see that as a priority. > Java-only programmers (end users) won't touch the JNI core parts. > They will just install the package, and get on with using it, by adding > the jar > to their devel enviroment, and perhaps the JNI lib file to the command line. > > These kind of users don't really care about the java-libvirt build > environment. okay, so just the Jar availability is sufficient for them, okidoc. > If you want to do something more interesting than renaming the java > classes and methods, > the you have to hit the JNI bindings, and that code is so ugly, that > no-one without some C experience will want to touch it. > > Having said that, I think that an ant build file would be the most > useful, as it can be used directly in all major > development enviroments. There is also this maven thing, that seems to > be widely used, but I still haven't figured out > exactly what that is :-) me either, though there are examples in the Fedora-java packaging pages. [...] > My current plans for java-libvirt are: > > 1. Add the storage API: It's really mostly just copy-paste-search > replace but it still takes some work okay > 2. There are some consistency problems with the naming of classes and > methods. I'd like to revisit the java api, and make some changes in > names, and maybe class structure Hum, better done early than late. Basically i would prefer to avoid pushing incompatible changes. what kind of inconsistencies problems ? > 3. There are many places where the C part leaks memory, this should also > be audited/ fixed. Ah, okay I will have to reread the bindings code then. Not sure how to track leaks, I doubt valgrind can work with java ... > Number 2 is what worries me, I don't know if it's a good idea to push > toFedora, when I know I want to make incompatible API changes soon. yes, which is why I would like to know a bit better :-) > (Or you can just say that you won't accept them, but I'm a big fan of > clean and consistent APIs, and the current one can be improved) > I believe that I will get around to doing 1. and 2. at least in late > july/early august, It's about a three day job, I just don't have that > three days right now :-( Maybe if you can expose what you think is wrong i can try to clean things up. Daniel -- Red Hat Virtualization group http://redhat.com/virtualization/ Daniel Veillard | virtualization library http://libvirt.org/ veillard(a)redhat.com | libxml GNOME XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/

3 3

[libvirt] PATCH: Fix ue of VIR_TEST_DEBUG var
by Daniel P. Berrange 09 Jul '08

09 Jul '08

The previous patch I did to add OOM testing accidentally disabled use of the VIR_TEST_DEBUG env variable when OOM testing is #ifdef'd out. This patch I just comitted makes sure its always used. Daniel diff -r d37150dc5895 tests/testutils.c --- a/tests/testutils.c Tue Jul 08 16:17:52 2008 +0100 +++ b/tests/testutils.c Wed Jul 09 11:23:27 2008 +0100 @@ -321,20 +321,24 @@ char **argv, int (*func)(int, char **)) { + char *debugStr; #if TEST_OOM int ret; int approxAlloc = 0; int n; - char *oomStr = NULL, *debugStr; + char *oomStr = NULL; int oomCount; int mp = 0; pid_t *workers; int worker = 0; +#endif + if ((debugStr = getenv("VIR_TEST_DEBUG")) != NULL) { if (virStrToLong_ui(debugStr, NULL, 10, &testDebug) < 0) testDebug = 0; } +#if TEST_OOM if ((oomStr = getenv("VIR_TEST_OOM")) != NULL) { if (virStrToLong_i(oomStr, NULL, 10, &oomCount) < 0) oomCount = 0; -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

1 0

[libvirt] PATCH: Misc changes to policykit policy file
by Daniel P. Berrange 09 Jul '08

09 Jul '08

After discussions with policykit maintainers I've come to the conclusion that it is better for security if we default to 'auth_admin_keep_sesion' instead of 'auth_self_keep_session'. ie prompt for the root password (ala 'su') instead of the user's password (ala 'sudo'). This is because having access to libvirtd gives you very significant power over the host machine. Secondly, newer versions of policykit have imposed a naming constraint on policy files, so when we install our policy it needs to be in a file called org.libvirt.unix.policy, instead of just libvirt.policy. So there's a change to the Makefile to support this. Daniel diff -r e17c1bd119fc libvirt.spec.in --- a/libvirt.spec.in Wed Jul 09 09:26:26 2008 +0100 +++ b/libvirt.spec.in Wed Jul 09 10:32:24 2008 +0100 @@ -240,7 +240,7 @@ %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/images/ %dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/boot/ %if %{with_polkit} -%{_datadir}/PolicyKit/policy/libvirtd.policy +%{_datadir}/PolicyKit/policy/org.libvirt.unix.policy %endif %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/qemu/ %if %{with_xen_proxy} diff -r e17c1bd119fc qemud/Makefile.am --- a/qemud/Makefile.am Wed Jul 09 09:26:26 2008 +0100 +++ b/qemud/Makefile.am Wed Jul 09 10:32:24 2008 +0100 @@ -13,7 +13,8 @@ remote_dispatch_proc_switch.h \ mdns.c mdns.h \ libvirtd.sasl \ - libvirtd.conf + libvirtd.conf \ + libvirtd.policy if RPCGEN SUFFIXES = .x @@ -75,9 +76,7 @@ if HAVE_POLKIT policydir = $(datadir)/PolicyKit/policy -policy_DATA = libvirtd.policy endif -EXTRA_DIST += libvirtd.policy if HAVE_AVAHI libvirtd_SOURCES += mdns.c mdns.h @@ -86,7 +85,7 @@ endif default_xml_dest = libvirt/qemu/networks/default.xml -install-data-local: install-init install-data-sasl +install-data-local: install-init install-data-sasl install-data-polkit mkdir -p $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart $(INSTALL_DATA) $(srcdir)/default-network.xml \ $(DESTDIR)$(sysconfdir)/$(default_xml_dest) @@ -99,7 +98,7 @@ mkdir -p $(DESTDIR)$(localstatedir)/run/libvirt mkdir -p $(DESTDIR)$(localstatedir)/lib/libvirt -uninstall-local:: uninstall-init uninstall-data-sasl +uninstall-local:: uninstall-init uninstall-data-sasl install-data-polkit rm -f $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml rm -f $(DESTDIR)$(sysconfdir)/$(default_xml_dest) rmdir $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart || : @@ -119,6 +118,18 @@ install-data-sasl: uninstall-data-sasl: endif + +if HAVE_POLKIT +install-data-polkit:: install-init + mkdir -p $(DESTDIR)$(policydir) + $(INSTALL_DATA) libvirtd.policy $(DESTDIR)$(policydir)/org.libvirt.unix.policy +uninstall-data-polkit:: install-init + rm -f $(DESTDIR)$(policydir)/org.libvirt.unix.policy +else +install-data-polkit:: +uninstall-data-polkit:: +endif + remote.c: remote_dispatch_prototypes.h \ remote_dispatch_localvars.h \ diff -r e17c1bd119fc qemud/libvirtd.policy --- a/qemud/libvirtd.policy Wed Jul 09 09:26:26 2008 +0100 +++ b/qemud/libvirtd.policy Wed Jul 09 10:32:24 2008 +0100 @@ -36,7 +36,7 @@ read-write mode for management, and we require user password --> <allow_any>no</allow_any> <allow_inactive>no</allow_inactive> - <allow_active>auth_self_keep_session</allow_active> + <allow_active>auth_admin_keep_session</allow_active> </defaults> </action> -</policyconfig> \ No newline at end of file +</policyconfig> -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

2 1

[libvirt] monitor cpu & network load
by Zu 09 Jul '08

09 Jul '08

Hi, I want to write a program to monitor the CPU and network usage of the Xen domUs. But I don't know how to implement. Can the libvirt APIs help me to do that? Does libvirt have the APIs to get the CPU and network usages? If yes I'll study libvirt APIs. Thanks Zu

3 2

[libvirt] PATCH: DOn't use policykit if running non-root
by Daniel P. Berrange 09 Jul '08

09 Jul '08

If the libvirtd daemon is running as non-root (ie a regular user) then there is no point in defaulting policykit, since only clients of same user account are able to connect to the UNIX socket anyway. This removes the pointless login prompt when using qemu:///session. Daniel diff -r 9a457b847ffc qemud/qemud.c --- a/qemud/qemud.c Tue Jul 08 16:17:52 2008 +0100 +++ b/qemud/qemud.c Wed Jul 09 09:24:53 2008 +0100 @@ -1926,6 +1926,14 @@ GET_CONF_STR (conf, filename, tcp_port); GET_CONF_STR (conf, filename, listen_addr); +#if HAVE_POLKIT + /* Change the default back to no auth for non-root */ + if (getuid() != 0 && auth_unix_rw == REMOTE_AUTH_POLKIT) + auth_unix_rw = REMOTE_AUTH_NONE; + if (getuid() != 0 && auth_unix_ro == REMOTE_AUTH_POLKIT) + auth_unix_ro = REMOTE_AUTH_NONE; +#endif + if (remoteConfigGetAuth(conf, "auth_unix_rw", &auth_unix_rw, filename) < 0) goto free_and_fail; #if HAVE_POLKIT -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

2 1

[libvirt] [PATCH] give a more useful diagnostic for tap-add failure w/ENOTSUP
by Jim Meyering 09 Jul '08

09 Jul '08

I invoked virt-isntall with --network=bridge:eth1 rather than --network=bridge:br1 and got the latter (current) diagnostic below. This change makes it so in this relatively common case people get a slightly more understandable diagnostic. >From 3d6dc8442fd9f1b0915c232040200154832fdf51 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Tue, 8 Jul 2008 13:58:10 +0200 Subject: [PATCH] give a more useful diagnostic for tap-add failure w/ENOTSUP * src/qemu_conf.c (qemudNetworkIfaceConnect): Suggestion from Daniel P. Berrange. --- src/qemu_conf.c | 14 +++++++++++--- 1 files changed, 11 insertions(+), 3 deletions(-) diff --git a/src/qemu_conf.c b/src/qemu_conf.c index 17f0162..4b8c01e 100644 --- a/src/qemu_conf.c +++ b/src/qemu_conf.c @@ -2304,9 +2304,17 @@ qemudNetworkIfaceConnect(virConnectPtr conn, if ((err = brAddTap(driver->brctl, brname, ifname, BR_IFNAME_MAXLEN, &tapfd))) { - qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, - _("Failed to add tap interface '%s' to bridge '%s' : %s"), - ifname, brname, strerror(err)); + if (errno == ENOTSUP) { + /* In this particular case, give a better diagnostic. */ + qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("Failed to add tap interface to bridge. " + "%s is not a bridge device"), brname); + } else { + qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("Failed to add tap interface '%s' " + "to bridge '%s' : %s"), + ifname, brname, strerror(err)); + } goto error; } -- 1.5.6.2.221.gb589

3 3