- Devel - libvirt List Archives

[Libvir] OCaml bindings now build and run under Windows (MinGW)
by Richard W.M. Jones 05 Jan '08

05 Jan '08

The OCaml bindings, examples, and mlvirsh tool, now build and run under Windows (MinGW), both for bytecode and native code. You'll need the libvirt patches for MinGW as in my previous email. OCaml bindings: http://hg.et.redhat.com/virt/applications/virt-top--devel Example of using mlvirsh (native code version) to access a remote libvirtd: rjones@WIN-MJ27YD6XBZI /c/d/virt-top--devel $ ./mlvirsh/mlvirsh.opt -c test+tcp://192.168.2.128/default list 1 test running rjones@WIN-MJ27YD6XBZI /c/d/virt-top--devel $ ./mlvirsh/mlvirsh.opt -c test+tcp://192.168.2.128/default nodeinfo model: i686 memory: 3145728 K cpus: 16 mhz: 1400 nodes: 2 sockets: 2 cores: 2 threads: 2 [Screenshot: http://www.annexia.org/tmp/Screenshot-VNC_win-mj27yd6xbzi.png ] Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

1 0

Re: [Libvir] [patch 9/9] Remove --with-iptables-dir
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:34PM +0000, Mark McLoughlin wrote: > --with-iptables-dir was added to integrate with > a proposed system for letting iptables know how to > reload our rules. > > The idea was that we'd save our rules to a file > under /etc/sysconfig/iptable.d and the iptables > init script would load the rules from there when > it was reloading. > > The proposed system wasn't accepted so, although > there might be some theoretical use for this other > than the lokkit support, let's just remove it > for now. ACK Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 8/9] Remove --with-iptables-prefix
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:33PM +0000, Mark McLoughlin wrote: > --with-iptables-prefix was added to integrate with > a proposed system for letting iptables know how to > reload our rules. > > The idea was that we'd add our rules to a chain > like libvirt-INPUT rather than INPUT, and there'd > be a configuration file which would specify whether > INPUT should include libvirt-INPUT. > > The proposed system wasn't accepted so, although > there might be some other theoretical use for this, > let's just remove it. I rather doubt anyone's using it, so ACK to killing it off. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 4/9] Re-name the "flipflop" variable to "command_idx"
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:29PM +0000, Mark McLoughlin wrote: > The "flipflop" variable marks the index into argv where > the "--insert" is at, so that when we're reloading the > rules we can easily change it to "--delete" and back > again. > > It's a rather silly name, and the next patch is going > to make more use out of it, so let's use the more sane > "command_idx" name. Fair, enough. ACK. Dan -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 3/9] Make iptables code use common utils
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:28PM +0000, Mark McLoughlin wrote: > utils.c has grown some functions since the iptables code > was written - make use of virFileMakePath() and virFileBuildPath(). ACK. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 2/9] Fix minor iptables error logging issue
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:27PM +0000, Mark McLoughlin wrote: > Fix a minor issue with some error reporting in the iptables > code - namely that we use errno after it may have been set > to something other than the error reported. ACK Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 1/9] Fix compile error in --with-iptables-dir code
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:26PM +0000, Mark McLoughlin wrote: > It seems no-one ever used --with-iptables-dir, since it > doesn't compile :-) ACK. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

[Libvir] [patch 9/9] Remove --with-iptables-dir
by Mark McLoughlin 04 Jan '08

04 Jan '08

--with-iptables-dir was added to integrate with a proposed system for letting iptables know how to reload our rules. The idea was that we'd save our rules to a file under /etc/sysconfig/iptable.d and the iptables init script would load the rules from there when it was reloading. The proposed system wasn't accepted so, although there might be some theoretical use for this other than the lokkit support, let's just remove it for now. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/configure.in =================================================================== --- libvirt.orig/configure.in 2008-01-04 15:24:39.000000000 +0000 +++ libvirt.orig/configure.in 2008-01-04 15:24:39.000000000 +0000 @@ -183,18 +183,6 @@ AM_CONDITIONAL(LIBVIRT_INIT_SCRIPTS_RED_ AC_MSG_RESULT($with_init_scripts) dnl -dnl also support saving the various chains to files -dnl in e.g. /etc/sysconfig/iptables.d -dnl -AC_ARG_WITH(iptables-dir, - AC_HELP_STRING([--with-iptables-dir=path], - [directory used to save iptables chains, defaults to not saving]), - [IPTABLES_DIR=$withval]) -if test x"$IPTABLES_DIR" != "x"; then - AC_DEFINE_UNQUOTED(IPTABLES_DIR, "$IPTABLES_DIR", [directory used for saving iptables chains]) -fi - -dnl dnl ensure that Fedora's system-config-firewall knows dnl about libvirt's iptables rules dnl Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 15:25:07.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 15:25:07.000000000 +0000 @@ -48,11 +48,6 @@ #define qemudLog(level, msg...) fprintf(stderr, msg) -#ifdef ENABLE_IPTABLES_LOKKIT -#undef IPTABLES_DIR -#define IPTABLES_DIR LOCAL_STATE_DIR "/lib/libvirt/iptables" -#endif - enum { ADD = 0, REMOVE @@ -78,12 +73,12 @@ typedef struct int nrules; iptRule *rules; -#ifdef IPTABLES_DIR +#ifdef ENABLE_IPTABLES_LOKKIT char dir[PATH_MAX]; char path[PATH_MAX]; -#endif /* IPTABLES_DIR */ +#endif /* ENABLE_IPTABLES_LOKKIT */ } iptRules; @@ -137,7 +132,6 @@ iptablesSpawn(int errors, char * const * return (WIFEXITED(status) && WEXITSTATUS(status) == 0) ? 0 : EINVAL; } -#ifdef IPTABLES_DIR #ifdef ENABLE_IPTABLES_LOKKIT static void notifyRulesUpdated(const char *table, @@ -238,7 +232,6 @@ notifyRulesRemoved(const char *table, #undef MAX_FILE_LEN } -#endif /* ENABLE_IPTABLES_LOKKIT */ static int writeRules(const char *path, @@ -286,7 +279,7 @@ writeRules(const char *path, return 0; } -#endif /* IPTABLES_DIR */ +#endif /* ENABLE_IPTABLES_LOKKIT */ static void iptRuleFree(iptRule *rule) @@ -328,7 +321,7 @@ iptRulesAppend(iptRules *rules, rules->nrules++; -#ifdef IPTABLES_DIR +#ifdef ENABLE_IPTABLES_LOKKIT { int err; @@ -339,12 +332,9 @@ iptRulesAppend(iptRules *rules, return err; } -#ifdef ENABLE_IPTABLES_LOKKIT notifyRulesUpdated(rules->table, rules->path); #endif /* ENABLE_IPTABLES_LOKKIT */ -#endif /* IPTABLES_DIR */ - return 0; } @@ -369,7 +359,7 @@ iptRulesRemove(iptRules *rules, rules->nrules--; -#ifdef IPTABLES_DIR +#ifdef ENABLE_IPTABLES_LOKKIT { int err; @@ -377,15 +367,12 @@ iptRulesRemove(iptRules *rules, return err; } -#ifdef ENABLE_IPTABLES_LOKKIT if (rules->nrules > 0) notifyRulesUpdated(rules->table, rules->path); else notifyRulesRemoved(rules->table, rules->path); #endif /* ENABLE_IPTABLES_LOKKIT */ -#endif /* IPTABLES_DIR */ - return 0; } @@ -415,10 +402,10 @@ iptRulesFree(iptRules *rules) rules->nrules = 0; } -#ifdef IPTABLES_DIR +#ifdef ENABLE_IPTABLES_LOKKIT rules->dir[0] = '\0'; rules->path[0] = '\0'; -#endif /* IPTABLES_DIR */ +#endif /* ENABLE_IPTABLES_LOKKIT */ free(rules); } @@ -441,13 +428,14 @@ iptRulesNew(const char *table, rules->rules = NULL; rules->nrules = 0; -#ifdef IPTABLES_DIR - if (virFileBuildPath(IPTABLES_DIR, table, NULL, rules->dir, sizeof(rules->dir)) < 0) +#ifdef ENABLE_IPTABLES_LOKKIT + if (virFileBuildPath(LOCAL_STATE_DIR "/lib/libvirt/iptables", table, NULL, + rules->dir, sizeof(rules->dir)) < 0) goto error; if (virFileBuildPath(rules->dir, chain, ".chain", rules->path, sizeof(rules->path)) < 0) goto error; -#endif /* IPTABLES_DIR */ +#endif /* ENABLE_IPTABLES_LOKKIT */ return rules; --

1 0

[Libvir] [patch 8/9] Remove --with-iptables-prefix
by Mark McLoughlin 04 Jan '08

04 Jan '08

--with-iptables-prefix was added to integrate with a proposed system for letting iptables know how to reload our rules. The idea was that we'd add our rules to a chain like libvirt-INPUT rather than INPUT, and there'd be a configuration file which would specify whether INPUT should include libvirt-INPUT. The proposed system wasn't accepted so, although there might be some other theoretical use for this, let's just remove it. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/configure.in =================================================================== --- libvirt.orig/configure.in 2008-01-04 14:51:29.000000000 +0000 +++ libvirt.orig/configure.in 2008-01-04 14:51:29.000000000 +0000 @@ -183,16 +183,6 @@ AM_CONDITIONAL(LIBVIRT_INIT_SCRIPTS_RED_ AC_MSG_RESULT($with_init_scripts) dnl -dnl allow the creation of iptables rules in chains with a -dnl specific prefix rather than in the standard toplevel chains -dnl -AC_ARG_WITH(iptables-prefix, - AC_HELP_STRING([--with-iptables-prefix=prefix], - [prefix used for iptables chains, default is to use standard toplevel chains]), - [IPTABLES_PREFIX=$withval]) -AC_DEFINE_UNQUOTED(IPTABLES_PREFIX, "$IPTABLES_PREFIX", [prefix used for iptables chains]) - -dnl dnl also support saving the various chains to files dnl in e.g. /etc/sysconfig/iptables.d dnl Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 15:17:18.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 15:17:18.000000000 +0000 @@ -636,13 +636,13 @@ iptablesContextNew(void) if (!(ctx = calloc(1, sizeof (*ctx)))) return NULL; - if (!(ctx->input_filter = iptRulesNew("filter", IPTABLES_PREFIX "INPUT"))) + if (!(ctx->input_filter = iptRulesNew("filter", "INPUT"))) goto error; - if (!(ctx->forward_filter = iptRulesNew("filter", IPTABLES_PREFIX "FORWARD"))) + if (!(ctx->forward_filter = iptRulesNew("filter", "FORWARD"))) goto error; - if (!(ctx->nat_postrouting = iptRulesNew("nat", IPTABLES_PREFIX "POSTROUTING"))) + if (!(ctx->nat_postrouting = iptRulesNew("nat", "POSTROUTING"))) goto error; return ctx; --

1 0

[Libvir] [patch 7/9] Add support for lokkit
by Mark McLoughlin 04 Jan '08

04 Jan '08

Add support for integrating our iptables support with Fedora's iptables configuration using the lokkit --custom-rules command. Basically, we write out our rules to /var/lib/libvirt/iptables and run lokkit --custom-rules so that if e.g. iptables is restarted or the user edits their firewall configuration, then libvirt's rules get reloaded. The slightly nasty bit is that rather than running something like lokkit --remove-custom-rules, we have to grub around in /etc/sysconfig/system-config-firewall to remove our rules files. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/configure.in =================================================================== --- libvirt.orig/configure.in 2008-01-04 14:48:49.000000000 +0000 +++ libvirt.orig/configure.in 2008-01-04 14:48:49.000000000 +0000 @@ -204,6 +204,20 @@ if test x"$IPTABLES_DIR" != "x"; then AC_DEFINE_UNQUOTED(IPTABLES_DIR, "$IPTABLES_DIR", [directory used for saving iptables chains]) fi +dnl +dnl ensure that Fedora's system-config-firewall knows +dnl about libvirt's iptables rules +dnl +AC_ARG_ENABLE(iptables-lokkit, + AC_HELP_STRING([--enable-iptables-lokkit=no/yes], + [enable registering libvirt's iptables rules with Fedora's lokkit]), + [],[enable_iptables_lokkit=no]) +if test x"$enable_iptables_lokkit" = x"yes"; then + AC_DEFINE(ENABLE_IPTABLES_LOKKIT, [], [whether support for Fedora's lokkit is enabled]) + AC_PATH_PROG(LOKKIT_PATH, lokkit, /usr/sbin/lokkit) + AC_DEFINE_UNQUOTED(LOKKIT_PATH, "$LOKKIT_PATH", [path to lokkit binary]) +fi + AC_PATH_PROG(IPTABLES_PATH, iptables, /sbin/iptables) AC_DEFINE_UNQUOTED(IPTABLES_PATH, "$IPTABLES_PATH", [path to iptables binary]) Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 14:51:29.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 14:51:29.000000000 +0000 @@ -48,6 +48,11 @@ #define qemudLog(level, msg...) fprintf(stderr, msg) +#ifdef ENABLE_IPTABLES_LOKKIT +#undef IPTABLES_DIR +#define IPTABLES_DIR LOCAL_STATE_DIR "/lib/libvirt/iptables" +#endif + enum { ADD = 0, REMOVE @@ -133,6 +138,108 @@ iptablesSpawn(int errors, char * const * } #ifdef IPTABLES_DIR +#ifdef ENABLE_IPTABLES_LOKKIT +static void +notifyRulesUpdated(const char *table, + const char *path) +{ + char arg[PATH_MAX]; + char *argv[4]; + int retval; + + snprintf(arg, sizeof(arg), "--custom-rules=ipv4:%s:%s", table, path); + + argv[0] = (char *) LOKKIT_PATH; + argv[1] = (char *) "--nostart"; + argv[2] = arg; + argv[3] = NULL; + + if ((retval = iptablesSpawn(WITH_ERRORS, argv))) + qemudLog(QEMUD_WARN, "Failed to run '" LOKKIT_PATH " %s' : %s", + arg, strerror(retval)); +} + +static int +stripLine(char *str, int len, const char *line) +{ + char *s, *p; + int changed; + + changed = 0; + s = str; + + while ((p = strchr(s, '\n'))) { + if (p == s || strncmp(s, line, p - s) != 0) { + s = ++p; + continue; + } + + ++p; + memmove(s, p, len - (p - str) + 1); + len -= p - s; + changed = 1; + } + + if (strcmp(s, line) == 0) { + *s = '\0'; + changed = 1; + } + + return changed; +} + +static void +notifyRulesRemoved(const char *table, + const char *path) +{ +/* 10 MB limit on config file size as a sanity check */ +#define MAX_FILE_LEN (1024*1024*10) + + char arg[PATH_MAX]; + char *content; + int len; + FILE *f = NULL; + + len = virFileReadAll(SYSCONF_DIR "/sysconfig/system-config-firewall", + MAX_FILE_LEN, &content); + if (len < 0) { + qemudLog(QEMUD_WARN, "Failed to read " SYSCONF_DIR "/sysconfig/system-config-firewall"); + return; + } + + snprintf(arg, sizeof(arg), "--custom-rules=ipv4:%s:%s", table, path); + + if (!stripLine(content, len, arg)) { + free(content); + return; + } + + if (!(f = fopen(SYSCONF_DIR "/sysconfig/system-config-firewall", "w"))) + goto write_error; + + if (fputs(content, f) == EOF) + goto write_error; + + if (fclose(f) == EOF) { + f = NULL; + goto write_error; + } + + free(content); + + return; + + write_error: + qemudLog(QEMUD_WARN, "Failed to write to " SYSCONF_DIR "/sysconfig/system-config-firewall : %s", + strerror(errno)); + if (f) + fclose(f); + free(content); + +#undef MAX_FILE_LEN +} +#endif /* ENABLE_IPTABLES_LOKKIT */ + static int writeRules(const char *path, const iptRule *rules, @@ -231,6 +338,11 @@ iptRulesAppend(iptRules *rules, if ((err = writeRules(rules->path, rules->rules, rules->nrules))) return err; } + +#ifdef ENABLE_IPTABLES_LOKKIT + notifyRulesUpdated(rules->table, rules->path); +#endif /* ENABLE_IPTABLES_LOKKIT */ + #endif /* IPTABLES_DIR */ return 0; @@ -264,6 +376,14 @@ iptRulesRemove(iptRules *rules, if ((err = writeRules(rules->path, rules->rules, rules->nrules))) return err; } + +#ifdef ENABLE_IPTABLES_LOKKIT + if (rules->nrules > 0) + notifyRulesUpdated(rules->table, rules->path); + else + notifyRulesRemoved(rules->table, rules->path); +#endif /* ENABLE_IPTABLES_LOKKIT */ + #endif /* IPTABLES_DIR */ return 0; --

1 0