- Devel - libvirt List Archives

[libvirt] [PATCH] docs: Harmonize backend names for QEMU and LXC
by Michael Weiser 03 Jan '20

03 Jan '20

Trivially replace usages of qemu and lxc in the virsh manpage with their more heavily used and (according to Wikipedia) correct upper-case spellings QEMU and LXC. Signed-off-by: Michael Weiser <michael.weiser(a)gmx.de> Suggested-by: Daniel Henrique Barboza <danielhb413(a)gmail.com> --- docs/manpages/virsh.rst | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/manpages/virsh.rst b/docs/manpages/virsh.rst index fea0527caf..7e26676570 100644 --- a/docs/manpages/virsh.rst +++ b/docs/manpages/virsh.rst @@ -577,7 +577,7 @@ from the domain's XML <os/> element and <type/> subelement or one from a list of machines from the ``virsh capabilities`` output for a specific architecture and domain type. -For the qemu hypervisor, a *virttype* of either 'qemu' or 'kvm' must be +For the QEMU hypervisor, a *virttype* of either 'qemu' or 'kvm' must be supplied along with either the *emulatorbin* or *arch* in order to generate output for the default *machine*. Supplying a *machine* value will generate output for the specific machine. @@ -1072,7 +1072,7 @@ read I/O operations limit. write I/O operations limit. *--size-iops-sec* specifies size I/O operations limit per second. *--group-name* specifies group name to share I/O quota between multiple drives. -For a qemu domain, if no name is provided, then the default is to have a single +For a QEMU domain, if no name is provided, then the default is to have a single group for each *device*. Older versions of virsh only accepted these options with underscore @@ -1084,7 +1084,7 @@ An explicit 0 also clears any limit. A non-zero value for a given total cannot be mixed with non-zero values for read or write. It is up to the hypervisor to determine how to handle the length values. -For the qemu hypervisor, if an I/O limit value or maximum value is set, +For the QEMU hypervisor, if an I/O limit value or maximum value is set, then the default value of 1 second will be displayed. Supplying a 0 will reset the value back to the default. @@ -1642,7 +1642,7 @@ domblkstat Get device block stats for a running domain. A *block-device* corresponds to a unique target name (<target dev='name'/>) or source file (<source file='name'/>) for one of the disk devices attached to *domain* (see -also ``domblklist`` for listing these names). On a lxc or qemu domain, +also ``domblklist`` for listing these names). On a LXC or QEMU domain, omitting the *block-device* yields device block stats summarily for the entire domain. @@ -3247,7 +3247,7 @@ destination). Some hypervisors do not support this feature and will return an error if this parameter is used. Optional *disks-port* sets the port that hypervisor on destination side should -bind to for incoming disks traffic. Currently it is supported only by qemu. +bind to for incoming disks traffic. Currently it is supported only by QEMU. migrate-compcache -- 2.24.1

2 1

[libvirt] [PATCH v2 0/3] Mark and document restore with managed save as risky
by Michael Weiser 03 Jan '20

03 Jan '20

This series marks restore of an inactive qemu snapshot while there is managed saved state as risky due to the reasons explained in patch 1 and 3. Patch 2 is a simple reformatting of the documentation with no other changes in preparation of addition of more reasons why reverts might need to be forced. Changes from v1: - reword error message to "error: revert requires force: snapshot without memory state, removal of existing managed saved state strongly recommended to avoid corruption" - add documentation of the new behaviour Michael Weiser (3): qemu: Warn of restore with managed save being risky docs: Reformat snapshot-revert force reasons docs: Add snapshot-revert qemu managedsave force docs/manpages/virsh.rst | 39 ++++++++++++++++++++++++--------------- src/qemu/qemu_driver.c | 9 +++++++++ 2 files changed, 33 insertions(+), 15 deletions(-) -- 2.24.1

2 5

[libvirt] [PATCH] Add overrides for network port UUID getter/lookup methods
by Daniel P. Berrangé 03 Jan '20

03 Jan '20

The generator creates broken code for all these methods. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- generator.py | 3 ++ libvirt-override-api.xml | 16 ++++++++ libvirt-override.c | 83 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 102 insertions(+) diff --git a/generator.py b/generator.py index cba9d47..426f007 100755 --- a/generator.py +++ b/generator.py @@ -430,6 +430,9 @@ skip_impl = ( 'virNetworkGetUUID', 'virNetworkGetUUIDString', 'virNetworkLookupByUUID', + 'virNetworkPortGetUUID', + 'virNetworkPortGetUUIDString', + 'virNetworkPortLookupByUUID', 'virDomainGetAutostart', 'virNetworkGetAutostart', 'virDomainBlockStats', diff --git a/libvirt-override-api.xml b/libvirt-override-api.xml index 7a0d4c5..4ab403c 100644 --- a/libvirt-override-api.xml +++ b/libvirt-override-api.xml @@ -64,6 +64,12 @@ <arg name='conn' type='virConnectPtr' info='pointer to the hypervisor connection'/> <arg name='uuid' type='const unsigned char *' info='the UUID string for the network, must be 16 bytes'/> </function> + <function name='virNetworkPortLookupByUUID' file='python'> + <info>Try to lookup a port on the given network based on its UUID.</info> + <return type='virNetworkPortPtr' info='a new network port object or NULL in case of failure'/> + <arg name='net' type='virNetworkPtr' info='pointer to the network object'/> + <arg name='uuid' type='const unsigned char *' info='the UUID string for the network port, must be 16 bytes'/> + </function> <function name='virDomainGetInfo' file='python'> <info>Extract information about a domain. Note that if the connection used to get the domain is limited only a partial set of the information can be extracted.</info> <return type='char *' info='the list of information or None in case of error'/> @@ -153,6 +159,16 @@ <return type='char *' info='the UUID string or None in case of error'/> <arg name='net' type='virNetworkPtr' info='a network object'/> </function> + <function name='virNetworkPortGetUUID' file='python'> + <info>Extract the UUID unique Identifier of a network port.</info> + <return type='char *' info='the 16 bytes string or None in case of error'/> + <arg name='domain' type='virNetworkPortPtr' info='a network port object'/> + </function> + <function name='virNetworkPortGetUUIDString' file='python'> + <info>Fetch globally unique ID of the network port as a string.</info> + <return type='char *' info='the UUID string or None in case of error'/> + <arg name='net' type='virNetworkPortPtr' info='a network port object'/> + </function> <function name='virStoragePoolGetUUID' file='python'> <info>Extract the UUID unique Identifier of a storage pool.</info> <return type='char *' info='the 16 bytes string or None in case of error'/> diff --git a/libvirt-override.c b/libvirt-override.c index 4e4c00a..2b39ace 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -10185,6 +10185,86 @@ libvirt_virNetworkPortGetParameters(PyObject *self ATTRIBUTE_UNUSED, virTypedParamsFree(params, nparams); return dict; } + +static PyObject * +libvirt_virNetworkPortGetUUID(PyObject *self ATTRIBUTE_UNUSED, + PyObject *args) +{ + unsigned char uuid[VIR_UUID_BUFLEN]; + virNetworkPortPtr port; + PyObject *pyobj_port; + int c_retval; + + if (!PyArg_ParseTuple(args, (char *)"O:virNetworkPortGetUUID", &pyobj_port)) + return NULL; + port = (virNetworkPortPtr) PyvirNetworkPort_Get(pyobj_port); + + if (port == NULL) + return VIR_PY_NONE; + + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virNetworkPortGetUUID(port, &uuid[0]); + LIBVIRT_END_ALLOW_THREADS; + + if (c_retval < 0) + return VIR_PY_NONE; + + return libvirt_charPtrSizeWrap((char *) &uuid[0], VIR_UUID_BUFLEN); +} + +static PyObject * +libvirt_virNetworkPortGetUUIDString(PyObject *self ATTRIBUTE_UNUSED, + PyObject *args) +{ + char uuidstr[VIR_UUID_STRING_BUFLEN]; + virNetworkPortPtr port; + PyObject *pyobj_port; + int c_retval; + + if (!PyArg_ParseTuple(args, (char *)"O:virNetworkPortGetUUIDString", + &pyobj_port)) + return NULL; + port = (virNetworkPortPtr) PyvirNetworkPort_Get(pyobj_port); + + if (port == NULL) + return VIR_PY_NONE; + + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virNetworkPortGetUUIDString(port, &uuidstr[0]); + LIBVIRT_END_ALLOW_THREADS; + + if (c_retval < 0) + return VIR_PY_NONE; + + return libvirt_constcharPtrWrap((char *) &uuidstr[0]); +} + +static PyObject * +libvirt_virNetworkPortLookupByUUID(PyObject *self ATTRIBUTE_UNUSED, + PyObject *args) +{ + virNetworkPortPtr c_retval; + virNetworkPtr net; + PyObject *pyobj_net; + unsigned char *uuid; + int len; + + if (!PyArg_ParseTuple(args, (char *)"Oz#:virNetworkPortLookupByUUID", + &pyobj_net, &uuid, &len)) + return NULL; + net = (virNetworkPtr) PyvirNetwork_Get(pyobj_net); + + if ((uuid == NULL) || (len != VIR_UUID_BUFLEN)) + return VIR_PY_NONE; + + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virNetworkPortLookupByUUID(net, uuid); + LIBVIRT_END_ALLOW_THREADS; + + return libvirt_virNetworkPortPtrWrap((virNetworkPortPtr) c_retval); +} + + #endif /* LIBVIR_CHECK_VERSION(5, 5, 0) */ #if LIBVIR_CHECK_VERSION(5, 7, 0) @@ -10535,6 +10615,9 @@ static PyMethodDef libvirtMethods[] = { {(char *) "virNetworkListAllPorts", libvirt_virNetworkListAllPorts, METH_VARARGS, NULL}, {(char *) "virNetworkPortSetParameters", libvirt_virNetworkPortSetParameters, METH_VARARGS, NULL}, {(char *) "virNetworkPortGetParameters", libvirt_virNetworkPortGetParameters, METH_VARARGS, NULL}, + {(char *) "virNetworkPortGetUUID", libvirt_virNetworkPortGetUUID, METH_VARARGS, NULL}, + {(char *) "virNetworkPortGetUUIDString", libvirt_virNetworkPortGetUUIDString, METH_VARARGS, NULL}, + {(char *) "virNetworkPortLookupByUUID", libvirt_virNetworkPortLookupByUUID, METH_VARARGS, NULL}, #endif /* LIBVIR_CHECK_VERSION(5, 5, 0) */ #if LIBVIR_CHECK_VERSION(5, 7, 0) {(char *) "virDomainGetGuestInfo", libvirt_virDomainGetGuestInfo, METH_VARARGS, NULL}, -- 2.24.1

2 2

[libvirt] when libvirt xml define nic driver e1000, my vm fail to start
by thomas.kuang 03 Jan '20

03 Jan '20

hi, all: my xml define interface as following: <interface type='ethernet'> <mac address='00:04:00:41:03:11'/> <model type='e1000'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </interface> when run the command: bash-4.1# virsh start root-vsys_v77 error: Failed to start domain root-vsys_v77 error: Unable to open /dev/net/tun, is tun module loaded?: No such file or directory is my xml define error ? how can create my vm with nic driver e1000 ? bash-4.1# libvirtd -v ,yum install libvirt 2020-01-02 10:00:49.261+0000: 8349: info : libvirt version: 4.5.0, package: 23.el7 (CentOS BuildSystem <http://bugs.centos.org>, 2019-08-09-00:39:08, x86-02.bsys.centos.org) 2020-01-02 10:00:49.261+0000: 8349: info : hostname: NSG 2020-01-02 10:00:49.261+0000: 8349: warning : virGetHostnameImpl:719 : getaddrinfo failed for 'NSG': Name or service not known 2020-01-02 10:00:49.263+0000: 8349: info : libvirt version: 4.5.0, package: 23.el7 (CentOS BuildSystem <http://bugs.centos.org>, 2019-08-09-00:39:08, x86-02.bsys.centos.org) 2020-01-02 10:00:49.263+0000: 8349: info : hostname: NSG 2020-01-02 10:00:49.263+0000: 8349: info : virObjectNew:248 : OBJECT_NEW: obj=0x5605a6104de0 classname=virAccessManager 2020-01-02 10:00:49.263+0000: 8349: info : virObjectNew:248 : OBJECT_NEW: obj=0x5605a60f54e0 classname=virAccessManager my emulator is qemu-3.0 ,i download qemu source code and compiled the emulator: bash-4.1# /usr/local/bin/qemu-system-x86_64 --version QEMU emulator version 3.0.0 Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers thanks !

1 0

[libvirt] [PATCH] qemu: Warn of restore with managed save being risky
by Michael Weiser 02 Jan '20

02 Jan '20

Internal snapshots of a non-running domain do not carry any memory state and restoring such a snapshot will not replace existing saved memory state. This allows a scenario, where a user first suspends a domain into managedsave, restores a non-running snapshot and then resumes the domain from managedsave. After that, the guest system will run with its previous memory state atop a different disk state. The most obvious possible fallout from this is extensive file system corruption. Swap content and RAID bitmaps might also be off. This has been discussed[1] and fixed[2] from the end-user perspective for virt-manager. This patch marks the restore operation as risky at the libvirt level, requiring the user to remove the saved memory state first or force the operation. [1] https://www.redhat.com/archives/virt-tools-list/2019-November/msg00011.html [2] https://www.redhat.com/archives/virt-tools-list/2019-December/msg00049.html Signed-off-by: Michael Weiser <michael.weiser(a)gmx.de> Cc: Cole Robinson <crobinso(a)redhat.com> --- src/qemu/qemu_driver.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ec8faf384c..dcd103d3bb 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -16652,6 +16652,15 @@ qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, _("must respawn qemu to start inactive snapshot")); goto endjob; } + if (vm->hasManagedSave && + !(snapdef->state == VIR_DOMAIN_SNAPSHOT_RUNNING || + snapdef->state == VIR_DOMAIN_SNAPSHOT_PAUSED)) { + virReportError(VIR_ERR_SNAPSHOT_REVERT_RISKY, "%s", + _("revert to snapshot while there is a managed " + "saved state will cause corruption when run, " + "remove saved state first")); + goto endjob; + } } if (snap->def->dom) { -- 2.24.1

2 6

[libvirt] [PATCH RFC] update cacrl without restarting libvirtd via virt-admin
by Zhangbo (Oscar) 02 Jan '20

02 Jan '20

This is an RFC request for supporting virt-admin to update cacrl without restarting libvirtd. When a client wants to establish a TLS connection with libvirtd, a CRL file is used by libvirtd to verify the client's certificate. Right now, if the CRL file is changed, you must restart libvirtd to make it take effect. The restart behavior of libvirtd will cause clients connecting with libvirtd to fail. In a server cluster, the CRL file may be updated quite frequently due to the large amount of certificates. If the new CRL does not take effect in time, there are security risks. So you may need to restart libvirtd frequently to make the CRL take effect in time. However, frequent restarts will affect the reliability of cluster virtual machine management(such as openstack) services. This RFC patch adds a virt-admin command to update the server's CRL *online*. This patch is not elegant enough, if this feature makes sense, I'd do more improvements. --- include/libvirt/libvirt-admin.h | 4 ++ src/admin/admin_protocol.x | 13 +++++- src/admin/admin_server.c | 13 ++++++ src/admin/admin_server.h | 4 ++ src/admin/libvirt-admin.c | 33 ++++++++++++++++ src/admin/libvirt_admin_private.syms | 1 + src/admin/libvirt_admin_public.syms | 1 + src/rpc/virnetserver.c | 58 +++++++++++++++++++++++++++ src/rpc/virnetserver.h | 3 ++ src/rpc/virnettlscontext.c | 33 ++++++++++++++++ src/rpc/virnettlscontext.h | 3 ++ tools/virt-admin.c | 59 ++++++++++++++++++++++++++++ 12 files changed, 224 insertions(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-admin.h b/include/libvirt/libvirt-admin.h index abf2792926..2df43db567 100644 --- a/include/libvirt/libvirt-admin.h +++ b/include/libvirt/libvirt-admin.h @@ -402,6 +402,10 @@ int virAdmServerSetClientLimits(virAdmServerPtr srv, int nparams, unsigned int flags); +int virAdmServerUpdateTlsFile(virAdmServerPtr srv, + unsigned int filetype, + unsigned int flags); + int virAdmConnectGetLoggingOutputs(virAdmConnectPtr conn, char **outputs, unsigned int flags); diff --git a/src/admin/admin_protocol.x b/src/admin/admin_protocol.x index 42e215d23a..c74c0d777b 100644 --- a/src/admin/admin_protocol.x +++ b/src/admin/admin_protocol.x @@ -181,6 +181,12 @@ struct admin_server_set_client_limits_args { unsigned int flags; }; +struct admin_server_update_tls_file_args { + admin_nonnull_server srv; + unsigned int filetype; + unsigned int flags; +}; + struct admin_connect_get_logging_outputs_args { unsigned int flags; }; @@ -314,5 +320,10 @@ enum admin_procedure { /** * @generate: both */ - ADMIN_PROC_CONNECT_SET_LOGGING_FILTERS = 17 + ADMIN_PROC_CONNECT_SET_LOGGING_FILTERS = 17, + + /** + * @generate: both + */ + ADMIN_PROC_SERVER_UPDATE_TLS_FILE = 18 }; diff --git a/src/admin/admin_server.c b/src/admin/admin_server.c index ba87f701c3..2f695eea4f 100644 --- a/src/admin/admin_server.c +++ b/src/admin/admin_server.c @@ -367,3 +367,16 @@ adminServerSetClientLimits(virNetServerPtr srv, return 0; } + +int +adminServerUpdateTlsFile(virNetServerPtr srv, + unsigned int filetype, + unsigned int flags) +{ + virCheckFlags(0, -1); + + if (virNetServerUpdateTlsFile(srv, filetype) < 0) + return -1; + + return 0; +} diff --git a/src/admin/admin_server.h b/src/admin/admin_server.h index 1d5cbec55f..748235811a 100644 --- a/src/admin/admin_server.h +++ b/src/admin/admin_server.h @@ -67,3 +67,7 @@ int adminServerSetClientLimits(virNetServerPtr srv, virTypedParameterPtr params, int nparams, unsigned int flags); + +int adminServerUpdateTlsFile(virNetServerPtr srv, + unsigned int filetype, + unsigned int flags); diff --git a/src/admin/libvirt-admin.c b/src/admin/libvirt-admin.c index 4099a54854..13c8db016d 100644 --- a/src/admin/libvirt-admin.c +++ b/src/admin/libvirt-admin.c @@ -1082,6 +1082,39 @@ virAdmServerSetClientLimits(virAdmServerPtr srv, return ret; } +/** + * virAdmServerUpdateTlsFile: + * @srv: a valid server object reference + * @filetype: TLS file type, such as crl, cert, key + * @flags: extra flags; not used yet, so callers should always pass 0 + * + * update TLS Context in TLS service. + * + * Returns 0 if the TLS files have been updated successfully or -1 in case of an + * error. + */ +int +virAdmServerUpdateTlsFile(virAdmServerPtr srv, + unsigned int filetype, + unsigned int flags) +{ + int ret = -1; + + VIR_DEBUG("srv=%p, filetype=%u flags=%x", srv, filetype, flags); + virResetLastError(); + + virCheckAdmServerGoto(srv, error); + + /* rpc call to update tls file */ + if ((ret = remoteAdminServerUpdateTlsFile(srv, filetype, flags)) < 0) + goto error; + + return ret; + error: + virDispatchError(NULL); + return ret; +} + /** * virAdmConnectGetLoggingOutputs: * @conn: pointer to an active admin connection diff --git a/src/admin/libvirt_admin_private.syms b/src/admin/libvirt_admin_private.syms index 9526412de8..d563757482 100644 --- a/src/admin/libvirt_admin_private.syms +++ b/src/admin/libvirt_admin_private.syms @@ -31,6 +31,7 @@ xdr_admin_server_lookup_client_args; xdr_admin_server_lookup_client_ret; xdr_admin_server_set_client_limits_args; xdr_admin_server_set_threadpool_parameters_args; +xdr_admin_server_update_tls_file_args; # datatypes.h virAdmClientClass; diff --git a/src/admin/libvirt_admin_public.syms b/src/admin/libvirt_admin_public.syms index 9a3f843780..97b223bfba 100644 --- a/src/admin/libvirt_admin_public.syms +++ b/src/admin/libvirt_admin_public.syms @@ -38,6 +38,7 @@ LIBVIRT_ADMIN_2.0.0 { virAdmClientClose; virAdmServerGetClientLimits; virAdmServerSetClientLimits; + virAdmServerUpdateTlsFile; }; LIBVIRT_ADMIN_3.0.0 { diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c index 4122636805..fc18b2a224 100644 --- a/src/rpc/virnetserver.c +++ b/src/rpc/virnetserver.c @@ -1209,3 +1209,61 @@ virNetServerSetClientLimits(virNetServerPtr srv, virObjectUnlock(srv); return ret; } + +int +virNetServerUpdateTlsFile(virNetServerPtr srv, + unsigned int filetype) +{ + int ret = -1; +#if WITH_GNUTLS + size_t i; + int cnt = 0; + virNetTLSContextPtr ctxt = NULL; + virNetServerServicePtr svc = NULL; + + if (filetype != TYPE_CACRL_LIBVIRT) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Don't support CRL filetype: %d"), + filetype); + return ret; + } + + virObjectLock(srv); + + /* find svcTLS from srv */ + for (i = 0; i < srv->nservices; i++) { + svc = srv->services[i]; + /* find tls from svc */ + ctxt = virNetServerServiceGetTLSContext(svc); + if (ctxt == NULL) + continue; + + ret = virNetTLSContextUpdateCRL(ctxt); + if (ret < 0) { + VIR_ERROR(_("update tls file fail, " + "filetype: %d, svcID: %zu"), filetype, i); + ret = -1; + goto cleanup; + } + VIR_INFO("update success, filetype: %d, svcID: %zu", filetype, i); + cnt++; + } + + if (cnt == 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("no tls server found, don't need update %d"), + filetype); + } else { + VIR_INFO("update tls file complete, filetype: %d", + filetype); + } + + cleanup: + virObjectUnlock(srv); +#else + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Don't support GNUTLS: %d"), + filetype); +#endif + return ret; +} diff --git a/src/rpc/virnetserver.h b/src/rpc/virnetserver.h index 260c99b22d..d0138d250f 100644 --- a/src/rpc/virnetserver.h +++ b/src/rpc/virnetserver.h @@ -133,3 +133,6 @@ size_t virNetServerGetCurrentUnauthClients(virNetServerPtr srv); int virNetServerSetClientLimits(virNetServerPtr srv, long long int maxClients, long long int maxClientsUnauth); + +int virNetServerUpdateTlsFile(virNetServerPtr srv, + unsigned int filetype); diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index 08944f6771..1cc3cb8620 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -1106,6 +1106,39 @@ int virNetTLSContextCheckCertificate(virNetTLSContextPtr ctxt, return ret; } +int virNetTLSContextUpdateCRL(virNetTLSContextPtr ctxt) +{ + int ret = -1; + char *cacrl = NULL; + + if (VIR_STRDUP(cacrl, LIBVIRT_CACRL) < 0) + return -1; + + if (!virFileExists(cacrl)) { + virReportSystemError(errno, _("%s not exist"), cacrl); + goto cleanup; + } + + virObjectLock(ctxt); + + ret = gnutls_certificate_set_x509_crl_file(ctxt->x509cred, + cacrl, + GNUTLS_X509_FMT_PEM); + if (ret < 0) { + virReportError(VIR_ERR_SYSTEM_ERROR, + _("Unable to update x509 CRL %s: %s"), + cacrl, gnutls_strerror(ret)); + } else { + VIR_INFO("Load %d CRL from %s", ret, cacrl); + ret = 0; + } + + virObjectUnlock(ctxt); + cleanup: + VIR_FREE(cacrl); + return ret; +} + void virNetTLSContextDispose(void *obj) { virNetTLSContextPtr ctxt = obj; diff --git a/src/rpc/virnettlscontext.h b/src/rpc/virnettlscontext.h index f3273bc26a..b823ab2c3f 100644 --- a/src/rpc/virnettlscontext.h +++ b/src/rpc/virnettlscontext.h @@ -23,6 +23,8 @@ #include "internal.h" #include "virobject.h" +#define TYPE_CACRL_LIBVIRT 13 + typedef struct _virNetTLSContext virNetTLSContext; typedef virNetTLSContext *virNetTLSContextPtr; @@ -65,6 +67,7 @@ virNetTLSContextPtr virNetTLSContextNewClient(const char *cacert, int virNetTLSContextCheckCertificate(virNetTLSContextPtr ctxt, virNetTLSSessionPtr sess); +int virNetTLSContextUpdateCRL(virNetTLSContextPtr ctxt); typedef ssize_t (*virNetTLSSessionWriteFunc)(const char *buf, size_t len, void *opaque); diff --git a/tools/virt-admin.c b/tools/virt-admin.c index 30106d1971..25971dbf27 100644 --- a/tools/virt-admin.c +++ b/tools/virt-admin.c @@ -50,6 +50,8 @@ /* we don't need precision to milliseconds in this module */ #define VIRT_ADMIN_TIME_BUFLEN VIR_TIME_STRING_BUFLEN - 3 +#define LIBVIRT_CACRL_TYPE 13 + static char *progname; static const vshCmdGrp cmdGroups[]; @@ -1103,6 +1105,57 @@ cmdDaemonLogOutputs(vshControl *ctl, const vshCmd *cmd) return true; } +/* ------------------------ + * Command update-crl-file + * ------------------------ + */ +static const vshCmdInfo info_srv_update_tls_file[] = { + {.name = "help", + .data = N_("notify tls file type, current only support libvirt cacrl(13)") + }, + {.name = "desc", + .data = N_("notify libvirtd TLS server hot update CACRL.") + }, + {.name = NULL} +}; + +static const vshCmdOptDef opts_srv_update_tls_file[] = { + {.name = "server", + .type = VSH_OT_DATA, + .flags = VSH_OFLAG_REQ, + .help = N_("Server to reload the CRL file."), + }, + {.name = NULL} +}; + +static bool +cmdSrvUpdateTlsFile(vshControl *ctl, const vshCmd *cmd) +{ + bool ret = false; + const char *srvname = NULL; + unsigned int filetype = LIBVIRT_CACRL_TYPE; + + virAdmServerPtr srv = NULL; + vshAdmControlPtr priv = ctl->privData; + + if (vshCommandOptStringReq(ctl, cmd, "server", &srvname) < 0) + return false; + + if (!(srv = virAdmConnectLookupServer(priv->conn, srvname, 0))) + goto cleanup; + + if (virAdmServerUpdateTlsFile(srv, filetype, 0) < 0) { + vshError(ctl, "%s", _("Unable to update server's tls file.")); + goto cleanup; + } + + ret = true; + + cleanup: + virAdmServerFree(srv); + return ret; +} + static void * vshAdmConnectionHandler(vshControl *ctl) { @@ -1486,6 +1539,12 @@ static const vshCmdDef managementCmds[] = { .info = info_daemon_log_outputs, .flags = 0 }, + {.name = "update-crl-file", + .handler = cmdSrvUpdateTlsFile, + .opts = opts_srv_update_tls_file, + .info = info_srv_update_tls_file, + .flags = 0 + }, {.name = NULL} };

2 1

[libvirt] [PATCH] fix class type instantiated when listing network ports
by Daniel P. Berrangé 02 Jan '20

02 Jan '20

Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- libvirt-override-virNetwork.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt-override-virNetwork.py b/libvirt-override-virNetwork.py index 749ee44..4245322 100644 --- a/libvirt-override-virNetwork.py +++ b/libvirt-override-virNetwork.py @@ -6,6 +6,6 @@ retlist = list() for domptr in ret: - retlist.append(virNetwork(self, _obj=domptr)) + retlist.append(virNetworkPort(self, _obj=domptr)) return retlist -- 2.24.1

2 1

[libvirt] [PATCH v2 0/5] Remove the last "no_memory" label
by Fabiano Fidêncio 02 Jan '20

02 Jan '20

This series touches virfirewall.c, the last place where a no_memory label can be found. The series: - Gets rid of setting and checking for ENOMEM as a firewall's error; - Use g_auto / g_autofree in a few different places; - Adapt ADD_ARG() macro as VIR_RESIZE_N() just aborts in case of OOM; - Remove no_memory mention from the hacking guide; Changes since v1: https://www.redhat.com/archives/libvir-list/2020-January/msg00018.html - Daniel suggested to get rid of ADD_ARG(). Instead of doing so, I've adapted the macro (as it does more than just a realloc) and, by doing so, got rid of the no_memory labels; - Dropped: - util: Rename 'no_memory' label to 'cleanup' - util: Add ADD_ARG_RETURN_ON_ERROR - util: Add ADD_ARG_RETURN_VALUE_ON_ERROR - Added: - util: Adapt ADD_ARG() macro Fabiano Fidêncio (5): util: Don't set/check for ENOMEM as a firewall error util: Use g_auto/g_autofree in virFirewallAddRuleFullV() util: Use g_auto in virFirewallStartTransaction() util: Adapt ADD_ARG() macro docs: Remove mention to no_memory label docs/hacking.html.in | 1 - src/util/virfirewall.c | 65 +++++++++++------------------------------- 2 files changed, 16 insertions(+), 50 deletions(-) -- 2.24.1

1 5

[libvirt] [PATCH] travis: fix homebrew install of python3
by Daniel P. Berrangé 02 Jan '20

02 Jan '20

The Python3 package has started failing to install from HomeBrew with the following: Error: The `brew link` step did not complete successfully The formula built, but is not symlinked into /usr/local Could not symlink Frameworks/Python.framework/Headers Target /usr/local/Frameworks/Python.framework/Headers is a symlink belonging to python@2. You can unlink it: brew unlink python@2 To force the link and overwrite all conflicting files: brew link --overwrite python The result is that libvirt fails to find python3: checking for python3... no configure: error: 'python3' binary is required to build libvirt It is unclear what changed in Travis/HomeBrew to break our previously working setup, but running the suggested command fixes it well enough for libvirt's CI needs. Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- Pushed as a CI build fix .travis.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.travis.yml b/.travis.yml index 44ff5e9898..f129706456 100644 --- a/.travis.yml +++ b/.travis.yml @@ -67,6 +67,9 @@ matrix: env: - PATH="/usr/local/opt/gettext/bin:/usr/local/opt/ccache/libexec:/usr/local/opt/rpcgen/bin:$PATH" - PKG_CONFIG_PATH="/usr/local/opt/libxml2/lib/pkgconfig" + before_script: + # Hack to blow away py2 + - brew link --overwrite python script: # We can't run 'distcheck' or 'syntax-check' because they fail on # macOS, but doing 'install' and 'dist' gives us some useful coverage -- 2.24.1

1 0

[libvirt] [PATCH 0/7] Remove the last "no_memory" label
by Fabiano Fidêncio 02 Jan '20

02 Jan '20

This series touches virfirewall.c, the last place where a no_memory label can be found. The series: - Renames no_memory to cleanup; - Gets rid of ENOMEM error treatment; - Use g_auto / g_autofree in a few different places; - Add new macros as ADD_ARG heavily rely on a goto; - Remove no_memory mention from the hacking guide; I'm not totally sure whether the new macros addition are worth it. Fabiano Fidêncio (7): util: Rename 'no_memory' label to 'cleanup' util: Don't set/check for ENOMEM as a firewall error util: Use g_auto/g_autofree in virFirewallAddRuleFullV() util: Use g_auto in virFirewallStartTransaction() util: Add ADD_ARG_RETURN_ON_ERROR util: Add ADD_ARG_RETURN_VALUE_ON_ERROR docs: Remove mention to no_memory label docs/hacking.html.in | 1 - src/util/virfirewall.c | 94 +++++++++++++++++++----------------------- 2 files changed, 42 insertions(+), 53 deletions(-) -- 2.24.1

2 9