- Devel - libvirt List Archives

[libvirt] [PATCH] build: avoid compiler warning
by Eric Blake 04 May '10

04 May '10

Necessary on cygwin, where uid_t and gid_t are 4-byte long rather than int, causing gcc -Wformat warnings. * src/util/util.c (virFileOperationNoFork, virDirCreateNoFork) (virFileOperation, virDirCreate, virGetUserEnt): Cast uid_t and gid_t before passing to printf. * .gitignore: Ignore cygwin executables. --- .gitignore | 1 + src/util/util.c | 21 ++++++++++++--------- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 8c275f4..4faf384 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ *#*# *.#*# *.a +*.exe *.o *.orig *.rej diff --git a/src/util/util.c b/src/util/util.c index 3209185..0c5a22b 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -74,11 +74,14 @@ #include "util.h" #include "memory.h" #include "threads.h" +#include "verify.h" #ifndef NSIG # define NSIG 32 #endif +verify(sizeof (gid_t) <= sizeof (int) && sizeof (uid_t) <= sizeof (int)); + #define VIR_FROM_THIS VIR_FROM_NONE #define virUtilError(code, ...) \ @@ -1277,7 +1280,7 @@ static int virFileOperationNoFork(const char *path, int openflags, mode_t mode, && (fchown(fd, uid, gid) < 0)) { ret = errno; virReportSystemError(errno, _("cannot chown '%s' to (%u, %u)"), - path, uid, gid); + path, (int) uid, (int) gid); goto error; } if ((flags & VIR_FILE_OP_FORCE_PERMS) @@ -1328,7 +1331,7 @@ static int virDirCreateNoFork(const char *path, mode_t mode, uid_t uid, gid_t gi && (chown(path, uid, gid) < 0)) { ret = errno; virReportSystemError(errno, _("cannot chown '%s' to (%u, %u)"), - path, uid, gid); + path, (int) uid, (int) gid); goto error; } if ((flags & VIR_DIR_CREATE_FORCE_PERMS) @@ -1407,14 +1410,14 @@ parenterror: ret = errno; virReportSystemError(errno, _("cannot set gid %u creating '%s'"), - gid, path); + (int) gid, path); goto childerror; } if ((uid != 0) && (setuid(uid) != 0)) { ret = errno; virReportSystemError(errno, _("cannot set uid %u creating '%s'"), - uid, path); + (int) uid, path); goto childerror; } if ((fd = open(path, openflags, mode)) < 0) { @@ -1436,7 +1439,7 @@ parenterror: && (fchown(fd, -1, gid) < 0)) { ret = errno; virReportSystemError(errno, _("cannot chown '%s' to (%u, %u)"), - path, uid, gid); + path, (int) uid, (int) gid); goto childerror; } if ((flags & VIR_FILE_OP_FORCE_PERMS) @@ -1517,13 +1520,13 @@ parenterror: if ((gid != 0) && (setgid(gid) != 0)) { ret = errno; virReportSystemError(errno, _("cannot set gid %u creating '%s'"), - gid, path); + (int) gid, path); goto childerror; } if ((uid != 0) && (setuid(uid) != 0)) { ret = errno; virReportSystemError(errno, _("cannot set uid %u creating '%s'"), - uid, path); + (int) uid, path); goto childerror; } if (mkdir(path, mode) < 0) { @@ -1547,7 +1550,7 @@ parenterror: ret = errno; virReportSystemError(errno, _("cannot chown '%s' to group %u"), - path, gid); + path, (int) gid); goto childerror; } if ((flags & VIR_DIR_CREATE_FORCE_PERMS) @@ -2564,7 +2567,7 @@ static char *virGetUserEnt(uid_t uid, if (getpwuid_r(uid, &pwbuf, strbuf, strbuflen, &pw) != 0 || pw == NULL) { virReportSystemError(errno, _("Failed to find user record for uid '%d'"), - uid); + (int) uid); VIR_FREE(strbuf); return NULL; } -- 1.6.6.1

2 5

[libvirt] [PATCH] dnsmasqReload: avoid mingw link failure
by Eric Blake 04 May '10

04 May '10

* src/util/dnsmasq.c (dnsmasqReload): Mingw lacks kill, but is not running a dnsmasq daemon either. --- I'm not as familiar with the mingw cross-build setup, but I finally got enough pieces installed on my F-12 machine that this was the only remaining compilation failure that I ran into. Let me know if we need an alternate patch that solves dnsmasq more gracefully than just crippling one function. src/util/dnsmasq.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/util/dnsmasq.c b/src/util/dnsmasq.c index 1cb5f21..d6cef40 100644 --- a/src/util/dnsmasq.c +++ b/src/util/dnsmasq.c @@ -328,14 +328,16 @@ dnsmasqDelete(const dnsmasqContext *ctx) * Reloads all the configurations associated to a context */ int -dnsmasqReload(pid_t pid) +dnsmasqReload(pid_t pid ATTRIBUTE_UNUSED) { +#ifndef __MINGW32__ if (kill(pid, SIGHUP) != 0) { virReportSystemError(errno, _("Failed to make dnsmasq (PID: %d) reload config files.\n"), pid); return -1; } +#endif /* __MINGW32__ */ return 0; } -- 1.6.6.1

2 5

[libvirt] [PATCH] nwfilter: pass info where request stems from to have rules applied
by Stefan Berger 03 May '10

03 May '10

For the decision on whether to instantiate the rules, the check for a pending IP address learn request is not sufficient since then only the thread could instantiate the rules. So, a boolean needs to be passed when the thread instantiates the filter rules late and the IP address learn request is still pending in order to override the check for the pending learn request. If the rules are to be updated while the thread is active, this will not be done immediately but the thread will do that later on. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_gentech_driver.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -543,6 +543,8 @@ virNWFilterRuleInstancesToArray(int nEnt * @ifname: The name of the interface to apply the rules to * @vars: A map holding variable names and values used for instantiating * the filter and its subfilters. + * @forceWithPendingReq: Ignore the check whether a pending learn request + * is active; 'true' only when the rules are applied late * * Returns 0 on success, a value otherwise. * @@ -563,7 +565,8 @@ virNWFilterInstantiate(virConnectPtr con enum instCase useNewFilter, int *foundNewFilter, bool teardownOld, const unsigned char *macaddr, - virNWFilterDriverStatePtr driver) + virNWFilterDriverStatePtr driver, + bool forceWithPendingReq) { int rc; int j, nptrs; @@ -610,7 +613,8 @@ virNWFilterInstantiate(virConnectPtr con } else if (virHashSize(missing_vars->hashTable) > 1) { rc = 1; goto err_exit; - } else if (virNWFilterLookupLearnReq(ifindex) == NULL) { + } else if (!forceWithPendingReq && + virNWFilterLookupLearnReq(ifindex) != NULL) { goto err_exit; } @@ -688,7 +692,8 @@ __virNWFilterInstantiateFilter(virConnec const char *filtername, virNWFilterHashTablePtr filterparams, enum instCase useNewFilter, - virNWFilterDriverStatePtr driver) + virNWFilterDriverStatePtr driver, + bool forceWithPendingReq) { int rc; const char *drvname = EBIPTABLES_DRIVER_ID; @@ -789,7 +794,8 @@ __virNWFilterInstantiateFilter(virConnec useNewFilter, &foundNewFilter, teardownOld, macaddr, - driver); + driver, + forceWithPendingReq); virNWFilterHashTableFree(vars); @@ -830,7 +836,8 @@ _virNWFilterInstantiateFilter(virConnect net->filter, net->filterparams, useNewFilter, - conn->nwfilterPrivateData); + conn->nwfilterPrivateData, + false); } @@ -856,7 +863,8 @@ virNWFilterInstantiateFilterLate(virConn filtername, filterparams, INSTANTIATE_ALWAYS, - driver); + driver, + true); if (rc) { //something went wrong... 'DOWN' the interface if (ifaceCheck(false, ifname, NULL, ifindex) != 0 ||

2 1

[libvirt] [PATCH] cgroup: Fix possible memory leak in virCgroupMakeGroup
by Ryota Ozaki 03 May '10

03 May '10

* src/util/cgroup.c: free temporal path string before breaking loop --- src/util/cgroup.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/util/cgroup.c b/src/util/cgroup.c index b649c3c..b8b2eb5 100644 --- a/src/util/cgroup.c +++ b/src/util/cgroup.c @@ -472,8 +472,10 @@ static int virCgroupMakeGroup(virCgroupPtr parent, virCgroupPtr group, int creat (i == VIR_CGROUP_CONTROLLER_CPUSET || STREQ(group->controllers[i].mountPoint, group->controllers[VIR_CGROUP_CONTROLLER_CPUSET].mountPoint))) { rc = virCgroupCpuSetInherit(parent, group); - if (rc != 0) + if (rc != 0) { + VIR_FREE(path); break; + } } } -- 1.6.5.2

2 1

[libvirt] [PATCH] dnsmasq.c: Fix OOM error reporting
by Matthias Bolte 03 May '10

03 May '10

Also do some indentation clean up. --- src/util/dnsmasq.c | 28 ++++++++++++++++------------ 1 files changed, 16 insertions(+), 12 deletions(-) diff --git a/src/util/dnsmasq.c b/src/util/dnsmasq.c index 1cb5f21..2d57884 100644 --- a/src/util/dnsmasq.c +++ b/src/util/dnsmasq.c @@ -84,12 +84,12 @@ hostsfileAdd(dnsmasqHostsfile *hostsfile, if (name) { if (virAsprintf(&hostsfile->hosts[hostsfile->nhosts].host, "%s,%s,%s", - mac, ip, name) < 0) { + mac, ip, name) < 0) { goto alloc_error; } } else { if (virAsprintf(&hostsfile->hosts[hostsfile->nhosts].host, "%s,%s", - mac, ip) < 0) { + mac, ip) < 0) { goto alloc_error; } } @@ -99,9 +99,8 @@ hostsfileAdd(dnsmasqHostsfile *hostsfile, return 0; alloc_error: - virReportSystemError(ENOMEM, - _("Failed to add dhcp host entry: mac=%s, ip=%s, name=%s\n"), - mac, ip, (name ? name : "(null)")); + virReportOOMError(); + return -1; } @@ -112,20 +111,23 @@ hostsfileNew(const char *name, int err; dnsmasqHostsfile *hostsfile; - if (VIR_ALLOC(hostsfile) < 0) + if (VIR_ALLOC(hostsfile) < 0) { + virReportOOMError(); return NULL; + } hostsfile->hosts = NULL; hostsfile->nhosts = 0; if (virAsprintf(&hostsfile->path, "%s/%s.%s", config_dir, name, - DNSMASQ_HOSTSFILE_SUFFIX) < 0) { + DNSMASQ_HOSTSFILE_SUFFIX) < 0) { + virReportOOMError(); goto error; } if ((err = virFileMakePath(config_dir))) { virReportSystemError(err, _("cannot create config directory '%s'"), - config_dir); + config_dir); goto error; } @@ -201,11 +203,11 @@ static int hostsfileSave(dnsmasqHostsfile *hostsfile) { int err = hostsfileWrite(hostsfile->path, hostsfile->hosts, - hostsfile->nhosts); + hostsfile->nhosts); if (err < 0) { virReportSystemError(err, _("cannot write config file '%s'"), - hostsfile->path); + hostsfile->path); return -1; } @@ -220,7 +222,7 @@ hostsfileDelete(dnsmasqHostsfile *hostsfile) if (unlink(hostsfile->path) < 0) { virReportSystemError(errno, _("cannot remove config file '%s'"), - hostsfile->path); + hostsfile->path); return -1; } @@ -240,8 +242,10 @@ dnsmasqContextNew(const char *network_name, { dnsmasqContext *ctx; - if (VIR_ALLOC(ctx) < 0) + if (VIR_ALLOC(ctx) < 0) { + virReportOOMError(); return NULL; + } if (!(ctx->hostsfile = hostsfileNew(network_name, config_dir))) goto error; -- 1.7.0.4

2 2

[libvirt] [PATCH] mingw: Fix symbol export
by Matthias Bolte 03 May '10

03 May '10

In commit 98fb83ce25f46e0236706fa6e0943032d921935f I changed the version script handling. But it seems that I didn't test this properly and broke it. The .def file is passed to the compiler directly, but it should get passed to the linker instead. Set VERSION_SCRIPT_FLAGS to -Wl, to pass the .def file correctly to the linker. This fixes the undefined symbol errors while linking virsh. --- configure.ac | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index f25e173..6ee5b90 100644 --- a/configure.ac +++ b/configure.ac @@ -78,7 +78,6 @@ AM_PROG_LD VERSION_SCRIPT_FLAGS=-Wl,--version-script= `$LD --help 2>&1 | grep -- --version-script >/dev/null` || \ VERSION_SCRIPT_FLAGS="-Wl,-M -Wl," -AC_SUBST(VERSION_SCRIPT_FLAGS) LIBVIRT_COMPILE_WARNINGS([maximum]) @@ -1824,10 +1823,11 @@ case "$host" in # from libvirt.syms and passes libvirt.def instead of libvirt.syms to the linker LIBVIRT_SYMBOL_FILE=libvirt.def # mingw's ld has the --version-script parameter, but it requires a .def file - # instead to work properly, therefore clear --version-script here + # instead to work properly, therefore clear --version-script here and use + # -Wl, to pass the .def file to the linker # cygwin's ld has the --version-script parameter too, but for some reason # it's working there as expected - VERSION_SCRIPT_FLAGS= + VERSION_SCRIPT_FLAGS="-Wl," ;; esac AC_SUBST([CYGWIN_EXTRA_LDFLAGS]) @@ -1836,6 +1836,7 @@ AC_SUBST([CYGWIN_EXTRA_PYTHON_LIBADD]) AC_SUBST([MINGW_EXTRA_LDFLAGS]) AC_SUBST([WIN32_EXTRA_CFLAGS]) AC_SUBST([LIBVIRT_SYMBOL_FILE]) +AC_SUBST([VERSION_SCRIPT_FLAGS]) dnl Look for windres to build a Windows icon resource. -- 1.7.0.4

2 2

[libvirt] [PATCH] Fix memory leaks in cmdInterfaceEdit and cmdNWFilterEdit.
by Laine Stump 03 May '10

03 May '10

This applies a fix to thos functions similar to that made to cmdEdit in 270895063d1cf86ab42fa220a8d090c24d58dbc0, thus fnixing a memory leak - if tmp is unlinked and NULLed early in the function, the memory used by tmp is never freed. Since we will always unlink tmp prior to freeing its memory at the end of the function, just remove the earlier code and let cleanup: do the cleanup. --- tools/virsh.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index eb11a78..fb66a72 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -3248,9 +3248,6 @@ cmdInterfaceEdit (vshControl *ctl, const vshCmd *cmd) doc_edited = editReadBackFile (ctl, tmp); if (!doc_edited) goto cleanup; - unlink (tmp); - tmp = NULL; - /* Compare original XML with edited. Has it changed at all? */ if (STREQ (doc, doc_edited)) { vshPrint (ctl, _("Interface %s XML configuration not changed.\n"), @@ -4193,9 +4190,6 @@ cmdNWFilterEdit (vshControl *ctl, const vshCmd *cmd) doc_edited = editReadBackFile (ctl, tmp); if (!doc_edited) goto cleanup; - unlink (tmp); - tmp = NULL; - /* Compare original XML with edited. Has it changed at all? */ if (STREQ (doc, doc_edited)) { vshPrint (ctl, _("Network filter %s XML configuration not changed.\n"), -- 1.6.6.1

3 3

[libvirt] [PATCH] lxc: Fix failure on starting a domain that has multiple network interfaces
by Ryota Ozaki 03 May '10

03 May '10

[Error message] error: Failed to start domain lxc_test1 error: internal error Failed to create veth device pair: 512 The reason of the failure is that lxc driver unexpectedly re-uses an auto-assigned veth name and tries to create the created veth again. The failure will happen when a domain has multiple network interfaces and the names of those are not specified in XML. The patch fixes the problem by resetting buffers of veth names in every iteration of creating veth. * src/lxc/lxc_driver.c: prevent re-using auto-assigned veth name Reported by Kumar L Srikanth-B22348. --- src/lxc/lxc_driver.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 409b1cf..554bf66 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -786,14 +786,15 @@ static int lxcSetupInterfaces(virConnectPtr conn, { int rc = -1, i; char *bridge = NULL; - char parentVeth[PATH_MAX] = ""; - char containerVeth[PATH_MAX] = ""; brControl *brctl = NULL; if (brInit(&brctl) != 0) return -1; for (i = 0 ; i < def->nnets ; i++) { + char parentVeth[PATH_MAX] = ""; + char containerVeth[PATH_MAX] = ""; + switch (def->nets[i]->type) { case VIR_DOMAIN_NET_TYPE_NETWORK: { -- 1.6.5.2

2 1

[libvirt] Creating multiple network interfaces in libvirt Domain.
by Kumar L Srikanth-B22348 01 May '10

01 May '10

Hi, I want to create a Domain with two interfaces. I am using LXC hypervisor in the libvirt. My domain XML is shown below: <domain type='lxc' id='1'> <name>srikanth_vm2</name> <memory>500000</memory> <os> <type>exe</type> <init>/bin/sh</init> </os> <vcpu>1</vcpu> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/libexec/libvirt_lxc</emulator> <filesystem type='mount'> <source dir='/root/lxc/fedora1'/> <target dir='/'/> </filesystem> <interface type='network'> <source network='default'/> </interface> <interface type='network'> <source network='default'/> </interface> <console type='pty' /> </devices> </domain> I am able to define the Domain. But, I am not able to start the Domain. While starting the domain, I am getting the following error: error: Failed to start domain srikanth_vm2 error: internal error Failed to create veth device pair: 512 Can you please let me know where I am going wrong? Regards, Srikanth.

2 2

[libvirt] [PATCH] Fix a virsh edit memory leak
by Chris Lalancette 01 May '10

01 May '10

When running virsh edit, we are unlinking and setting the tmp variable to NULL before going to the end of the function, meaning that we never free tmp. Since the exit to the function will always unlink and free tmp, just remove this bit of code and let it get done at the end. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 04b47a1..ab099da 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -8066,9 +8066,6 @@ cmdEdit (vshControl *ctl, const vshCmd *cmd) doc_edited = editReadBackFile (ctl, tmp); if (!doc_edited) goto cleanup; - unlink (tmp); - tmp = NULL; - /* Compare original XML with edited. Has it changed at all? */ if (STREQ (doc, doc_edited)) { vshPrint (ctl, _("Domain %s XML configuration not changed.\n"), -- 1.6.6.1

3 2

[libvirt] [PATCH] autobuild.sh: provide default prefix
by Eric Blake 30 Apr '10

30 Apr '10

Without this patch and with a clean environment, ./autobuild.sh tried to use ./configure --prefix=/, and fails. * autobuild.sh (AUTOBUILD_INSTALL_ROOT): Provide sensible default. Suggested by Daniel P. Berrange. --- autobuild.sh | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/autobuild.sh b/autobuild.sh index d3934ea..3379be4 100755 --- a/autobuild.sh +++ b/autobuild.sh @@ -6,6 +6,7 @@ set -v # Make things clean. test -n "$1" && RESULTS=$1 || RESULTS=results.log +: ${AUTOBUILD_INSTALL_ROOT=$HOME/builder} test -f Makefile && make -k distclean || : rm -rf coverage -- 1.6.6.1

3 3

[libvirt] Release of libvirt-0.8.1
by Daniel Veillard 30 Apr '10

30 Apr '10

As planned, here is the 0.8.1 bug fix release, available from libvirt.org FTP: ftp://libvirt.org/libvirt/ As planned it's rather light on features but includes a very large set of bug fixes, cleanups and portability enhancements, Features: - Add virDomainGetBlockInfo API to query disk sizing (Daniel P. Berrange) - Starts dnsmasq from libvirtd with --dhcp-hostsfile option (Satoru SATOH) Documentation: - cleanup the download section of the documentation (Daniel Veillard) - Fix messsage -> message. (Chris Lalancette) - Fix up a debug typo. (Chris Lalancette) - add nwfilter functions to virsh man page (Stefan Berger) Portability: - Fix build on Ubuntu. (Chris Lalancette) - cygwin/mingw: Fix version script handling (Matthias Bolte) - build: fix autogen rule for VPATH build (Eric Blake) - Fix build with DEBUG_RAW_IO=1 (Jiri Denemark) - Don't try to build qemu and lxc on non-Linux platforms (Daniel Veillard) - cygwin: Handle differences in the XDR implementation (Matthias Bolte) - Cygwin's GCC doesn't like this .sa_handler initialization for some reason (Matthias Bolte) - linux/if.h header is not available on non-Linux platforms (Matthias Bolte) - cygwin: Check explicitly for getmntent_r (Matthias Bolte) - Disable stateful OpenNebula driver if libvirtd is disabled (Matthias Bolte) - build: don't include winsock2.h on cygwin (Eric Blake) - portability fixes to tools/virt-pki-validate.in (Dustin Kirkland) - virt-aa-helper-test: avoid non-portable echo -n (Eric Blake) - schematestutils.sh: improve shell portability: avoid "echo -e" (Jim Meyering) - Fix build of openvz on RHEL-5. (Chris Lalancette) - Fix spec file for builds without lxc (Daniel Berteaud) Bug Fixes: - domain: Fix PCI address decimal parsing regression (Cole Robinson) - Fix virt-pki-validate's determination of CN (Dustin Kirkland) - Fix detection of disk in IO events (Daniel P. Berrange) - Fix a virsh edit memory leak (Chris Lalancette) - Fix a qemuDomainPCIAddressSetFree memory leak (Chris Lalancette) - Fix a memory leak in the node_device_udev code (Chris Lalancette) - qemuDomainSnapshotCreateXML: avoid NULL dereferences (Jim Meyering) - qemudDomainCreate: correct a slightly misdirected goto (Jim Meyering) - Fix handling of security driver restore failures in QEMU domain save (Daniel P. Berrange) - Fix QEMU domain save to block devices with cgroups enabled (Daniel P. Berrange) - Fix QEMU save/restore with block devices (Daniel P. Berrange) - Fix crash when cleaning up from failed save attempt (Daniel P. Berrange) - The base used for conversion of USB values should be 16 not 10. (Klaus Ethgen) - Fix up the locking in the snapshot code. (Chris Lalancette) - Ignore qemu STOP event when stopping CPUs (Jiri Denemark) - Fix memory leak in virsh snapshot-list. (Chris Lalancette) - Fix virDomainSnapshotObjFree memory leak. (Chris Lalancette) - Fix a memory leak in the snapshot code in libvirtd. (Chris Lalancette) - QEmu JSON drop timestamp from command object (Luiz Capitulino) - Fix crash in nwfilter driver check (Daniel P. Berrange) - qemu: fix security context references in DAC code (Spencer Shimko) - Properly indent encryption tags (David Allan) - Fix locking in qemudDomainCoreDump (Jiri Denemark) - Poll for migration end every 50ms instead of 50us (Jiri Denemark) - configure.ac SELinux fixes (Spencer Shimko) - Fix QEMU text monitor command error checking (Daniel P. Berrange) - Fix CPU hotplug command names (Daniel P. Berrange) - Fix printing of event detail in python events demo program (Daniel P. Berrange) - Fix initial VCPU pinning in qemu driver (Jiri Denemark) - Make avahi startup more robust. (Chris Lalancette) - esx: Don't treat an empty root snapshot list as error (Chris Wong) - esx: Fix FindByIp response handling (Matthias Bolte) - esx: Fix virtualHW.version generation (Matthias Bolte) - Fix device_del in JSON mode for QEMU (Daniel P. Berrange) - nwfilter: Free nwfilter hash of virConnectPtr (Matthias Bolte) - remote: react to failures on wakeupFD (Eric Blake) - Fix CDROM media change for QEMU when using -device syntax (Daniel P. Berrange) - Fix QEMU memory stats JSON mode (Daniel P. Berrange) - Trivial fix: Add braces to for statement to avoid crashes (Stefan Berger) - qemudDomainAttachSCSIDisk: avoid FP NULL-ptr-deref from clang (Jim Meyering) - qemudDomainAttachSCSIDisk: avoid FP NULL-ptr-deref from clang (Jim Meyering) - virGetHostnameLocalhost: avoid FP NULL-ptr-deref from clang (Jim Meyering) - nwfilter_ebiptables_driver.c: avoid NULL dereference (Jim Meyering) - esxVMX_GatherSCSIControllers: avoid NULL dereference (Jim Meyering) - Fix nodeinfotest on NUMA machines (Daniel P. Berrange) Improvements: - Add support for another explicit IO error event (Daniel P. Berrange) - Report all errors in SELinuxRestoreSecurityFileLabel (Jiri Denemark) - Prevent updates while IP address learn thread is running (Stefan Berger) - Syncronize the teardown of rules with the thread (Stefan Berger) - Clean all tables before applying 'basic' rules (Stefan Berger) - MAke virFileHasSuffix case insensitive (Paul Dorman) - nwfilter: Also pick IP address from a DHCP ACK message (Stefan Berger) - Implement python binding for virDomainGetBlockInfo (Daniel P. Berrange) - Add new domblkinfo command to virsh (Daniel P. Berrange) - Implement virDomainGetBlockInfo in QEMU driver (Daniel P. Berrange) - Remote protocol impl for virDomainGetBlockInfo (Daniel P. Berrange) - Internal driver API infrastructure for virDomainGetBlockInfo (Daniel P. Berrange) - Report better error if qemuSnapshotIsAllowed failed. (Chris Lalancette) - nwfilter: python bindings for nwfilter (Stefan Berger) - Move dnsmasq host file to a separate directory (Daniel Veillard) - nwfilter: allow to mix filterrefs and rules in the schema (Stefan Berger) - Avoid create/unlink with block devs used for QEMU save (Daniel P. Berrange) - nwfilter: let qemu's after-migration packet pass (Stefan Berger) - Fix up the error message if we can't parse the snapshot XML. (Chris Lalancette) - nwfilter: add support for RAPR protocol (Stefan Berger) - nwfilter: enable hex number inputs in filter XML (Stefan Berger) - Add build support for dnsmasq module (Satoru SATOH) - Add dnsmasq module files (Satoru SATOH) - Fix make dist missing ESX generated files (Daniel Veillard) - Fix printing of pathnames on error in qemuDomainSnapshotLoad. (Chris Lalancette) - Improve configure error message about missing Linux headers (Matthias Bolte) - nwfilter: extend schema + add testcase w/ connlimit-above (Stefan Berger) - addrToString: give better error message (Eric Blake) - Fake host CPU for qemu tests (Jiri Denemark) - Use configured CPU model if possible (Jiri Denemark) - Support removing features when converting data to CPU (Jiri Denemark) - Move MIN macro to util.h so that others can use it (Jiri Denemark) - Deal with CPU models in [] (Jiri Denemark) - Ignore empty type attribute in driver element of virtual disks (Guido Günther) - esx: Gather some XML generation macros in esx_vi.h (Matthias Bolte) - nwfilter: add support for connlimit match (Stefan Berger) - Extend fwall-drv interface and call functions via interface (Stefan Berger) - esx: Add support for the VMXNET 2 (Enhanced) NIC model (Matthias Bolte) - Install nwfilter xml files from source directory. (Philipp Hahn) - Fixup python binding for virDomainSnapshot APIs (Daniel P. Berrange) - Fix network hotplug to use device_add in QEMU (Daniel P. Berrange) - Fix error reporting for getfd + host_net_add in QEMU (Daniel P. Berrange) - Replace printf with logging macros (Matthias Bolte) - Mark internal.h for translation (Jiri Denemark) - Use virCheckFlags for APIs added in 0.8.0 (Jiri Denemark) - Introduce virCheckFlags for consistent flags checking (Jiri Denemark) - nwfilter: Clear all state tracking from a drop rule (Stefan Berger) - Update to latest gnulib to get strtok_r relaxed to LGPLv2+ (Matthias Bolte) - esx: Add nwfilter driver stub (Matthias Bolte) - util: ensure safe{read,write,zero} return is checked (Eric Blake) - Update QEMU device_add command in JSON mode (Daniel P. Berrange) - Rename parameter in qemuMonitorDeviceDel (Daniel P. Berrange) - Run test suite as part of RPM build process (Daniel P. Berrange) - Fix QEMU command building errors to reflect unsupported configuration (Daniel P. Berrange) - nwfilter: fix tear down order and consolidate functions (Stefan Berger) - Fix close_used_without_including_unistd_h error (Matthias Bolte) - Implement variable length structure allocator (David Allan) - build: set STATIC_ANALYSIS when running via clang or coverity (Jim Meyering) - sa_assert: assert-like macro, enabled only for use with static analyzers (Jim Meyering) - Implement forgotten backend of virInterfaceIsActive() (Laine Stump) - nwfilter: use virFindFileInPath for needed CLI tools (Stefan Berger) - esx: Extend esx_vi_generator.py to cover methods too (Matthias Bolte) - Consolidate interface related functions in interface.c (Stefan Berger) - build: include usleep gnulib module (Eric Blake) Cleanups: - qemudDomainSaveFlag: remove dead store (Jim Meyering) - Remove unused goto label from qemudDomainCreate (Daniel P. Berrange) - Fix indentation for storage conf XML (David Allan) - Make virDomainSnapshotObjListDeinit static. (Chris Lalancette) - Some NWFilter symbols are conditional and have to be exported conditional (Matthias Bolte) - xen: Fix inside_daemon beeing unused when libvirtd is disabled (Matthias Bolte) - maint: update AUTHORS (Marco Bozzolan) - maint: update AUTHORS with recent contributors (Eric Blake) - maint: enforce whitespace on shell scripts (Eric Blake) - testutilsqemu: avoid uninitialized variable (Eric Blake) - maint: ignore 'make syntax-check' failure files (Eric Blake) - build: fix preprocessor indentation (Eric Blake) - build: avoid compiler warning (Eric Blake) - Explicitly set virStoragePoolTypeInfo FS and NETFS defaults (Matthias Bolte) - Mark in_open parameter of remoteAuthenticate as unused when it's unused (Matthias Bolte) - Don't ship generated python/libvirt.? files. (Philipp Hahn) - esx: Replace scanf with STRSKIP and strtok_r (Matthias Bolte) - maint: another preprocessor fix (Eric Blake) - Remove code from JSON monitor for commands that won't be ported (Daniel P. Berrange) - Fix apibuild.py warnings about missing ':' (Matthias Bolte) - xend_internal.c: assure clang that we do not dereference NULL (Jim Meyering) - build: fix recent 'make syntax-check' failure (Eric Blake) - virStorageBackendFileSystemMount: prefer strdup over virAsprintf (Jim Meyering) - virStorageBackendFileSystemMount: placate clang (Jim Meyering) - openvzGetProcessInfo: address clang-detected low-probability flaw (Jim Meyering) - vshCommandRun: avoid used-uninitialized timing-related report from clang (Jim Meyering) - Fix up formatting of remote protocol stuff. (Chris Lalancette) - Remove some debugging leftovers. (Chris Lalancette) - build: fix syntax-check problems (Eric Blake) Thanks to everybody who helped for the release ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH] domain: Fix PCI address decimal parsing regression
by Cole Robinson 30 Apr '10

30 Apr '10

<hostdev> address parsing previously attempted to detect the number base: currently it is hardcoded to base 16, which can break PCI assignment via virt-manager. Revert to the previous behavior. Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/conf/domain_conf.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 1607e8b..546ddf2 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -1079,28 +1079,28 @@ virDomainDevicePCIAddressParseXML(xmlNodePtr node, function = virXMLPropString(node, "function"); if (domain && - virStrToLong_ui(domain, NULL, 16, &addr->domain) < 0) { + virStrToLong_ui(domain, NULL, 0, &addr->domain) < 0) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Cannot parse <address> 'domain' attribute")); goto cleanup; } if (bus && - virStrToLong_ui(bus, NULL, 16, &addr->bus) < 0) { + virStrToLong_ui(bus, NULL, 0, &addr->bus) < 0) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Cannot parse <address> 'bus' attribute")); goto cleanup; } if (slot && - virStrToLong_ui(slot, NULL, 16, &addr->slot) < 0) { + virStrToLong_ui(slot, NULL, 0, &addr->slot) < 0) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Cannot parse <address> 'slot' attribute")); goto cleanup; } if (function && - virStrToLong_ui(function, NULL, 16, &addr->function) < 0) { + virStrToLong_ui(function, NULL, 0, &addr->function) < 0) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Cannot parse <address> 'function' attribute")); goto cleanup; -- 1.7.0.1

2 1

[libvirt] [patch 0/3] Fixes related to the IP address learning thread
by Stefan Berger 30 Apr '10

30 Apr '10

Proper resubmission -- sorry for the noise. The following set of patches are primarily related to the thread learning the IP address of a VM and deal with: - ebtables cleanup before applying basic filtering rules while the IP address is detected - shutting down all traffic in case the filtering rules could not be applied by the thread - serialization of the teardown of eb/ip/ip6tables rules to occurr after the IP address learning thread has terminated - no to apply or tear any eb/ip/ip6tables rules while the IP address learning thread is active Regards, Stefan

2 9

[libvirt] [PATCH] Report all errors in SELinuxRestoreSecurityFileLabel
by jdenemar＠redhat.com 30 Apr '10

30 Apr '10

From: Jiri Denemark <jdenemar(a)redhat.com> --- src/security/security_selinux.c | 10 +++++++++- 1 files changed, 9 insertions(+), 1 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 3e20475..1aabb20 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -364,12 +364,20 @@ SELinuxRestoreSecurityFileLabel(const char *path) goto err; } - if (stat(newpath, &buf) != 0) + if (stat(newpath, &buf) != 0) { + virReportSystemError(errno, + _("cannot stat %s"), newpath); goto err; + } if (matchpathcon(newpath, buf.st_mode, &fcon) == 0) { rc = SELinuxSetFilecon(newpath, fcon); + } else { + virSecurityReportError(VIR_ERR_INTERNAL_ERROR, + _("cannot restore selinux file label for %s"), + newpath); } + err: VIR_FREE(fcon); VIR_FREE(newpath); -- 1.7.0.4

3 2

[libvirt] virFileHasSuffix case sensitivity
by Paul Dorman 30 Apr '10

30 Apr '10

Hi all, virFileHasSuffix fails on esx IDE fileName VMX entries that aren't lower case, e.g. '.ISO'. Unless there's a good reason, can the comparison be done with STRCASEEQ instead of STREQ? Kind regards, Paul

3 4

[libvirt] [PATCH] Add support for another explicit IO error event
by Daniel P. Berrange 30 Apr '10

30 Apr '10

This introduces a new event type VIR_DOMAIN_EVENT_ID_IO_ERROR_REASON This event is the same as the previous VIR_DOMAIN_ID_IO_ERROR event, but also includes a string describing the cause of the event. Thus there is a new callback definition for this event type typedef void (*virConnectDomainEventIOErrorReasonCallback)(virConnectPtr conn, virDomainPtr dom, const char *srcPath, const char *devAlias, int action, const char *reason, void *opaque); This is currently wired up to the QEMU block IO error events * daemon/remote.c: Dispatch IO error events to client * examples/domain-events/events-c/event-test.c: Watch for IO error events * include/libvirt/libvirt.h.in: Define new IO error event ID and callback signature * src/conf/domain_event.c, src/conf/domain_event.h, src/libvirt_private.syms: Extend API to handle IO error events * src/qemu/qemu_driver.c: Connect to the QEMU monitor event for block IO errors and emit a libvirt IO error event * src/remote/remote_driver.c: Receive and dispatch IO error events to application * src/remote/remote_protocol.x: Wire protocol definition for IO error events * src/qemu/qemu_monitor.c, src/qemu/qemu_monitor.h, src/qemu/qemu_monitor_json.c: Watch for BLOCK_IO_ERROR event from QEMU monitor --- daemon/remote.c | 38 +++++++++++++++ daemon/remote_dispatch_table.h | 5 ++ include/libvirt/libvirt.h.in | 23 +++++++++ python/libvirt-override-virConnect.py | 14 +++++- python/libvirt-override.c | 55 +++++++++++++++++++++ src/conf/domain_event.c | 84 ++++++++++++++++++++++++++++----- src/conf/domain_event.h | 10 ++++ src/libvirt_private.syms | 2 + src/qemu/qemu_driver.c | 9 +++- src/qemu/qemu_monitor.c | 5 +- src/qemu/qemu_monitor.h | 6 ++- src/qemu/qemu_monitor_json.c | 2 +- src/remote/remote_driver.c | 35 ++++++++++++++ src/remote/remote_protocol.c | 17 +++++++ src/remote/remote_protocol.h | 12 +++++ src/remote/remote_protocol.x | 11 ++++- 16 files changed, 307 insertions(+), 21 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index 6dbe7ee..c54565c 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -256,6 +256,43 @@ static int remoteRelayDomainEventIOError(virConnectPtr conn ATTRIBUTE_UNUSED, } +static int remoteRelayDomainEventIOErrorReason(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + const char *reason, + void *opaque) +{ + struct qemud_client *client = opaque; + remote_domain_event_io_error_reason_msg data; + + if (!client) + return -1; + + REMOTE_DEBUG("Relaying domain io error %s %d %s %s %d %s", + dom->name, dom->id, srcPath, devAlias, action, reason); + + virMutexLock(&client->lock); + + /* build return data */ + memset(&data, 0, sizeof data); + make_nonnull_domain (&data.dom, dom); + data.srcPath = (char*)srcPath; + data.devAlias = (char*)devAlias; + data.action = action; + data.reason = (char*)reason; + + remoteDispatchDomainEventSend (client, + REMOTE_PROC_DOMAIN_EVENT_IO_ERROR_REASON, + (xdrproc_t)xdr_remote_domain_event_io_error_reason_msg, &data); + + virMutexUnlock(&client->lock); + + return 0; +} + + static int remoteRelayDomainEventGraphics(virConnectPtr conn ATTRIBUTE_UNUSED, virDomainPtr dom, int phase, @@ -327,6 +364,7 @@ static virConnectDomainEventGenericCallback domainEventCallbacks[] = { VIR_DOMAIN_EVENT_CALLBACK(remoteRelayDomainEventWatchdog), VIR_DOMAIN_EVENT_CALLBACK(remoteRelayDomainEventIOError), VIR_DOMAIN_EVENT_CALLBACK(remoteRelayDomainEventGraphics), + VIR_DOMAIN_EVENT_CALLBACK(remoteRelayDomainEventIOErrorReason), }; verify(ARRAY_CARDINALITY(domainEventCallbacks) == VIR_DOMAIN_EVENT_ID_LAST); diff --git a/daemon/remote_dispatch_table.h b/daemon/remote_dispatch_table.h index 984634f..86bd3b0 100644 --- a/daemon/remote_dispatch_table.h +++ b/daemon/remote_dispatch_table.h @@ -977,3 +977,8 @@ .args_filter = (xdrproc_t) xdr_remote_domain_get_block_info_args, .ret_filter = (xdrproc_t) xdr_remote_domain_get_block_info_ret, }, +{ /* Async event DomainEventIoErrorReason => 195 */ + .fn = NULL, + .args_filter = (xdrproc_t) xdr_void, + .ret_filter = (xdrproc_t) xdr_void, +}, diff --git a/include/libvirt/libvirt.h.in b/include/libvirt/libvirt.h.in index 4237b7b..f296d16 100644 --- a/include/libvirt/libvirt.h.in +++ b/include/libvirt/libvirt.h.in @@ -2054,6 +2054,28 @@ typedef void (*virConnectDomainEventIOErrorCallback)(virConnectPtr conn, void *opaque); /** + * virConnectDomainEventWatchdogCallback: + * @conn: connection object + * @dom: domain on which the event occurred + * @srcPath: The host file on which the IO error occurred + * @devAlias: The guest device alias associated with the path + * @action: action that is to be taken due to the IO error + * @reason: the cause of the IO error + * @opaque: application specified data + * + * The callback signature to use when registering for an event of type + * VIR_DOMAIN_EVENT_ID_IO_ERROR with virConnectDomainEventRegisterAny() + * + */ +typedef void (*virConnectDomainEventIOErrorReasonCallback)(virConnectPtr conn, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + const char *reason, + void *opaque); + +/** * virDomainEventGraphicsPhase: * * The phase of the graphics client connection @@ -2161,6 +2183,7 @@ typedef enum { VIR_DOMAIN_EVENT_ID_WATCHDOG = 3, /* virConnectDomainEventWatchdogCallback */ VIR_DOMAIN_EVENT_ID_IO_ERROR = 4, /* virConnectDomainEventIOErrorCallback */ VIR_DOMAIN_EVENT_ID_GRAPHICS = 5, /* virConnectDomainEventGraphicsCallback */ + VIR_DOMAIN_EVENT_ID_IO_ERROR_REASON = 6, /* virConnectDomainEventIOErrorReasonCallback */ /* * NB: this enum value will increase over time as new events are diff --git a/python/libvirt-override-virConnect.py b/python/libvirt-override-virConnect.py index cb38e3f..df39b79 100644 --- a/python/libvirt-override-virConnect.py +++ b/python/libvirt-override-virConnect.py @@ -94,7 +94,19 @@ cb = cbData["cb"] opaque = cbData["opaque"] - cb(self, virDomain(self, _obj=dom), opaque) + cb(self, virDomain(self, _obj=dom), srcPath, devAlias, opaque) + return 0 + except AttributeError: + pass + + def dispatchDomainEventIOErrorReasonCallback(self, dom, srcPath, devAlias, action, reason, cbData): + """Dispatches events to python user domain IO error event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), srcPath, devAlias, action, reason, opaque) return 0 except AttributeError: pass diff --git a/python/libvirt-override.c b/python/libvirt-override.c index 7c7682c..b97445b 100644 --- a/python/libvirt-override.c +++ b/python/libvirt-override.c @@ -3208,6 +3208,58 @@ libvirt_virConnectDomainEventIOErrorCallback(virConnectPtr conn ATTRIBUTE_UNUSED } static int +libvirt_virConnectDomainEventIOErrorReasonCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + const char *reason, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventIOErrorCallback", + (char*)"OssisO", + pyobj_dom, + srcPath, devAlias, action, reason, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int libvirt_virConnectDomainEventGraphicsCallback(virConnectPtr conn ATTRIBUTE_UNUSED, virDomainPtr dom, int phase, @@ -3345,6 +3397,9 @@ libvirt_virConnectDomainEventRegisterAny(ATTRIBUTE_UNUSED PyObject * self, case VIR_DOMAIN_EVENT_ID_IO_ERROR: cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventIOErrorCallback); break; + case VIR_DOMAIN_EVENT_ID_IO_ERROR_REASON: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventIOErrorReasonCallback); + break; case VIR_DOMAIN_EVENT_ID_GRAPHICS: cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventGraphicsCallback); break; diff --git a/src/conf/domain_event.c b/src/conf/domain_event.c index e3ce5ba..e5bd458 100644 --- a/src/conf/domain_event.c +++ b/src/conf/domain_event.c @@ -74,6 +74,7 @@ struct _virDomainEvent { char *srcPath; char *devAlias; int action; + char *reason; } ioError; struct { int phase; @@ -474,6 +475,7 @@ void virDomainEventFree(virDomainEventPtr event) case VIR_DOMAIN_EVENT_ID_IO_ERROR: VIR_FREE(event->data.ioError.srcPath); VIR_FREE(event->data.ioError.devAlias); + VIR_FREE(event->data.ioError.reason); break; case VIR_DOMAIN_EVENT_ID_GRAPHICS: @@ -630,19 +632,22 @@ virDomainEventPtr virDomainEventWatchdogNewFromObj(virDomainObjPtr obj, return ev; } -virDomainEventPtr virDomainEventIOErrorNewFromDom(virDomainPtr dom, - const char *srcPath, - const char *devAlias, - int action) +static virDomainEventPtr virDomainEventIOErrorNewFromDomImpl(int event, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + const char *reason) { virDomainEventPtr ev = - virDomainEventNewInternal(VIR_DOMAIN_EVENT_ID_IO_ERROR, + virDomainEventNewInternal(event, dom->id, dom->name, dom->uuid); if (ev) { ev->data.ioError.action = action; if (!(ev->data.ioError.srcPath = strdup(srcPath)) || - !(ev->data.ioError.devAlias = strdup(devAlias))) { + !(ev->data.ioError.devAlias = strdup(devAlias)) || + (reason && !(ev->data.ioError.reason = strdup(reason)))) { virDomainEventFree(ev); ev = NULL; } @@ -650,19 +655,23 @@ virDomainEventPtr virDomainEventIOErrorNewFromDom(virDomainPtr dom, return ev; } -virDomainEventPtr virDomainEventIOErrorNewFromObj(virDomainObjPtr obj, - const char *srcPath, - const char *devAlias, - int action) + +static virDomainEventPtr virDomainEventIOErrorNewFromObjImpl(int event, + virDomainObjPtr obj, + const char *srcPath, + const char *devAlias, + int action, + const char *reason) { virDomainEventPtr ev = - virDomainEventNewInternal(VIR_DOMAIN_EVENT_ID_IO_ERROR, + virDomainEventNewInternal(event, obj->def->id, obj->def->name, obj->def->uuid); if (ev) { ev->data.ioError.action = action; if (!(ev->data.ioError.srcPath = strdup(srcPath)) || - !(ev->data.ioError.devAlias = strdup(devAlias))) { + !(ev->data.ioError.devAlias = strdup(devAlias)) || + !(ev->data.ioError.reason = strdup(reason))) { virDomainEventFree(ev); ev = NULL; } @@ -671,6 +680,48 @@ virDomainEventPtr virDomainEventIOErrorNewFromObj(virDomainObjPtr obj, return ev; } +virDomainEventPtr virDomainEventIOErrorNewFromDom(virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action) +{ + return virDomainEventIOErrorNewFromDomImpl(VIR_DOMAIN_EVENT_ID_IO_ERROR, + dom, srcPath, devAlias, + action, NULL); +} + +virDomainEventPtr virDomainEventIOErrorNewFromObj(virDomainObjPtr obj, + const char *srcPath, + const char *devAlias, + int action) +{ + return virDomainEventIOErrorNewFromObjImpl(VIR_DOMAIN_EVENT_ID_IO_ERROR, + obj, srcPath, devAlias, + action, NULL); +} + +virDomainEventPtr virDomainEventIOErrorReasonNewFromDom(virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + const char *reason) +{ + return virDomainEventIOErrorNewFromDomImpl(VIR_DOMAIN_EVENT_ID_IO_ERROR_REASON, + dom, srcPath, devAlias, + action, reason); +} + +virDomainEventPtr virDomainEventIOErrorReasonNewFromObj(virDomainObjPtr obj, + const char *srcPath, + const char *devAlias, + int action, + const char *reason) +{ + return virDomainEventIOErrorNewFromObjImpl(VIR_DOMAIN_EVENT_ID_IO_ERROR_REASON, + obj, srcPath, devAlias, + action, reason); +} + virDomainEventPtr virDomainEventGraphicsNewFromDom(virDomainPtr dom, int phase, @@ -853,6 +904,15 @@ void virDomainEventDispatchDefaultFunc(virConnectPtr conn, cbopaque); break; + case VIR_DOMAIN_EVENT_ID_IO_ERROR_REASON: + ((virConnectDomainEventIOErrorReasonCallback)cb)(conn, dom, + event->data.ioError.srcPath, + event->data.ioError.devAlias, + event->data.ioError.action, + event->data.ioError.reason, + cbopaque); + break; + case VIR_DOMAIN_EVENT_ID_GRAPHICS: ((virConnectDomainEventGraphicsCallback)cb)(conn, dom, event->data.graphics.phase, diff --git a/src/conf/domain_event.h b/src/conf/domain_event.h index f72ac58..e28293d 100644 --- a/src/conf/domain_event.h +++ b/src/conf/domain_event.h @@ -129,6 +129,16 @@ virDomainEventPtr virDomainEventIOErrorNewFromObj(virDomainObjPtr obj, const char *srcPath, const char *devAlias, int action); +virDomainEventPtr virDomainEventIOErrorReasonNewFromDom(virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + const char *reason); +virDomainEventPtr virDomainEventIOErrorReasonNewFromObj(virDomainObjPtr obj, + const char *srcPath, + const char *devAlias, + int action, + const char *reason); virDomainEventPtr virDomainEventGraphicsNewFromDom(virDomainPtr dom, int phase, diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 746327d..09f3da1 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -246,6 +246,8 @@ virDomainEventWatchdogNewFromDom; virDomainEventWatchdogNewFromObj; virDomainEventIOErrorNewFromDom; virDomainEventIOErrorNewFromObj; +virDomainEventIOErrorReasonNewFromDom; +virDomainEventIOErrorReasonNewFromObj; virDomainEventGraphicsNewFromDom; virDomainEventGraphicsNewFromObj; virDomainEventFree; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index c2902ac..52f2df8 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -1015,10 +1015,12 @@ static int qemuHandleDomainIOError(qemuMonitorPtr mon ATTRIBUTE_UNUSED, virDomainObjPtr vm, const char *diskAlias, - int action) + int action, + const char *reason) { struct qemud_driver *driver = qemu_driver; virDomainEventPtr ioErrorEvent = NULL; + virDomainEventPtr ioErrorEvent2 = NULL; virDomainEventPtr lifecycleEvent = NULL; const char *srcPath; const char *devAlias; @@ -1036,6 +1038,7 @@ qemuHandleDomainIOError(qemuMonitorPtr mon ATTRIBUTE_UNUSED, } ioErrorEvent = virDomainEventIOErrorNewFromObj(vm, srcPath, devAlias, action); + ioErrorEvent2 = virDomainEventIOErrorReasonNewFromObj(vm, srcPath, devAlias, action, reason); if (action == VIR_DOMAIN_EVENT_IO_ERROR_PAUSE && vm->state == VIR_DOMAIN_RUNNING) { @@ -1051,10 +1054,12 @@ qemuHandleDomainIOError(qemuMonitorPtr mon ATTRIBUTE_UNUSED, } virDomainObjUnlock(vm); - if (ioErrorEvent || lifecycleEvent) { + if (ioErrorEvent || ioErrorEvent2 || lifecycleEvent) { qemuDriverLock(driver); if (ioErrorEvent) qemuDomainEventQueue(driver, ioErrorEvent); + if (ioErrorEvent2) + qemuDomainEventQueue(driver, ioErrorEvent2); if (lifecycleEvent) qemuDomainEventQueue(driver, lifecycleEvent); qemuDriverUnlock(driver); diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 5e83afc..fca8590 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -833,7 +833,8 @@ int qemuMonitorEmitWatchdog(qemuMonitorPtr mon, int action) int qemuMonitorEmitIOError(qemuMonitorPtr mon, const char *diskAlias, - int action) + int action, + const char *reason) { int ret = -1; VIR_DEBUG("mon=%p", mon); @@ -841,7 +842,7 @@ int qemuMonitorEmitIOError(qemuMonitorPtr mon, qemuMonitorRef(mon); qemuMonitorUnlock(mon); if (mon->cb && mon->cb->domainIOError) - ret = mon->cb->domainIOError(mon, mon->vm, diskAlias, action); + ret = mon->cb->domainIOError(mon, mon->vm, diskAlias, action, reason); qemuMonitorLock(mon); qemuMonitorUnref(mon); return ret; diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index ec848a8..3fa83b7 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -95,7 +95,8 @@ struct _qemuMonitorCallbacks { int (*domainIOError)(qemuMonitorPtr mon, virDomainObjPtr vm, const char *diskAlias, - int action); + int action, + const char *reason); int (*domainGraphics)(qemuMonitorPtr mon, virDomainObjPtr vm, int phase, @@ -148,7 +149,8 @@ int qemuMonitorEmitRTCChange(qemuMonitorPtr mon, long long offset); int qemuMonitorEmitWatchdog(qemuMonitorPtr mon, int action); int qemuMonitorEmitIOError(qemuMonitorPtr mon, const char *diskAlias, - int action); + int action, + const char *reason); int qemuMonitorEmitGraphics(qemuMonitorPtr mon, int phase, int localFamily, diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 09a3562..8c77ab1 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -534,7 +534,7 @@ static void qemuMonitorJSONHandleIOError(qemuMonitorPtr mon, virJSONValuePtr dat actionID = VIR_DOMAIN_EVENT_IO_ERROR_NONE; } - qemuMonitorEmitIOError(mon, device, actionID); + qemuMonitorEmitIOError(mon, device, actionID, ""); } diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index e589f8e..317125f 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -7430,6 +7430,37 @@ remoteDomainReadEventIOError(virConnectPtr conn, XDR *xdr) static virDomainEventPtr +remoteDomainReadEventIOErrorReason(virConnectPtr conn, XDR *xdr) +{ + remote_domain_event_io_error_reason_msg msg; + virDomainPtr dom; + virDomainEventPtr event = NULL; + memset (&msg, 0, sizeof msg); + + /* unmarshall parameters, and process it*/ + if (! xdr_remote_domain_event_io_error_reason_msg(xdr, &msg) ) { + remoteError(VIR_ERR_RPC, "%s", + _("unable to demarshall reboot event")); + return NULL; + } + + dom = get_nonnull_domain(conn,msg.dom); + if (!dom) + return NULL; + + event = virDomainEventIOErrorReasonNewFromDom(dom, + msg.srcPath, + msg.devAlias, + msg.action, + msg.reason); + xdr_free ((xdrproc_t) &xdr_remote_domain_event_io_error_reason_msg, (char *) &msg); + + virDomainFree(dom); + return event; +} + + +static virDomainEventPtr remoteDomainReadEventGraphics(virConnectPtr conn, XDR *xdr) { remote_domain_event_graphics_msg msg; @@ -9327,6 +9358,10 @@ processCallDispatchMessage(virConnectPtr conn, struct private_data *priv, event = remoteDomainReadEventIOError(conn, xdr); break; + case REMOTE_PROC_DOMAIN_EVENT_IO_ERROR_REASON: + event = remoteDomainReadEventIOErrorReason(conn, xdr); + break; + case REMOTE_PROC_DOMAIN_EVENT_GRAPHICS: event = remoteDomainReadEventGraphics(conn, xdr); break; diff --git a/src/remote/remote_protocol.c b/src/remote/remote_protocol.c index 71eed42..187281d 100644 --- a/src/remote/remote_protocol.c +++ b/src/remote/remote_protocol.c @@ -3290,6 +3290,23 @@ xdr_remote_domain_event_io_error_msg (XDR *xdrs, remote_domain_event_io_error_ms } bool_t +xdr_remote_domain_event_io_error_reason_msg (XDR *xdrs, remote_domain_event_io_error_reason_msg *objp) +{ + + if (!xdr_remote_nonnull_domain (xdrs, &objp->dom)) + return FALSE; + if (!xdr_remote_nonnull_string (xdrs, &objp->srcPath)) + return FALSE; + if (!xdr_remote_nonnull_string (xdrs, &objp->devAlias)) + return FALSE; + if (!xdr_int (xdrs, &objp->action)) + return FALSE; + if (!xdr_remote_nonnull_string (xdrs, &objp->reason)) + return FALSE; + return TRUE; +} + +bool_t xdr_remote_domain_event_graphics_address (XDR *xdrs, remote_domain_event_graphics_address *objp) { diff --git a/src/remote/remote_protocol.h b/src/remote/remote_protocol.h index 8c4291f..6f01da7 100644 --- a/src/remote/remote_protocol.h +++ b/src/remote/remote_protocol.h @@ -1864,6 +1864,15 @@ struct remote_domain_event_io_error_msg { }; typedef struct remote_domain_event_io_error_msg remote_domain_event_io_error_msg; +struct remote_domain_event_io_error_reason_msg { + remote_nonnull_domain dom; + remote_nonnull_string srcPath; + remote_nonnull_string devAlias; + int action; + remote_nonnull_string reason; +}; +typedef struct remote_domain_event_io_error_reason_msg remote_domain_event_io_error_reason_msg; + struct remote_domain_event_graphics_address { int family; remote_nonnull_string node; @@ -2206,6 +2215,7 @@ enum remote_procedure { REMOTE_PROC_DOMAIN_REVERT_TO_SNAPSHOT = 192, REMOTE_PROC_DOMAIN_SNAPSHOT_DELETE = 193, REMOTE_PROC_DOMAIN_GET_BLOCK_INFO = 194, + REMOTE_PROC_DOMAIN_EVENT_IO_ERROR_REASON = 195, }; typedef enum remote_procedure remote_procedure; @@ -2541,6 +2551,7 @@ extern bool_t xdr_remote_domain_event_reboot_msg (XDR *, remote_domain_event_re extern bool_t xdr_remote_domain_event_rtc_change_msg (XDR *, remote_domain_event_rtc_change_msg*); extern bool_t xdr_remote_domain_event_watchdog_msg (XDR *, remote_domain_event_watchdog_msg*); extern bool_t xdr_remote_domain_event_io_error_msg (XDR *, remote_domain_event_io_error_msg*); +extern bool_t xdr_remote_domain_event_io_error_reason_msg (XDR *, remote_domain_event_io_error_reason_msg*); extern bool_t xdr_remote_domain_event_graphics_address (XDR *, remote_domain_event_graphics_address*); extern bool_t xdr_remote_domain_event_graphics_identity (XDR *, remote_domain_event_graphics_identity*); extern bool_t xdr_remote_domain_event_graphics_msg (XDR *, remote_domain_event_graphics_msg*); @@ -2873,6 +2884,7 @@ extern bool_t xdr_remote_domain_event_reboot_msg (); extern bool_t xdr_remote_domain_event_rtc_change_msg (); extern bool_t xdr_remote_domain_event_watchdog_msg (); extern bool_t xdr_remote_domain_event_io_error_msg (); +extern bool_t xdr_remote_domain_event_io_error_reason_msg (); extern bool_t xdr_remote_domain_event_graphics_address (); extern bool_t xdr_remote_domain_event_graphics_identity (); extern bool_t xdr_remote_domain_event_graphics_msg (); diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index ae306d2..8000ee0 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -1659,6 +1659,14 @@ struct remote_domain_event_io_error_msg { int action; }; +struct remote_domain_event_io_error_reason_msg { + remote_nonnull_domain dom; + remote_nonnull_string srcPath; + remote_nonnull_string devAlias; + int action; + remote_nonnull_string reason; +}; + struct remote_domain_event_graphics_address { int family; remote_nonnull_string node; @@ -1996,7 +2004,8 @@ enum remote_procedure { REMOTE_PROC_DOMAIN_SNAPSHOT_CURRENT = 191, REMOTE_PROC_DOMAIN_REVERT_TO_SNAPSHOT = 192, REMOTE_PROC_DOMAIN_SNAPSHOT_DELETE = 193, - REMOTE_PROC_DOMAIN_GET_BLOCK_INFO = 194 + REMOTE_PROC_DOMAIN_GET_BLOCK_INFO = 194, + REMOTE_PROC_DOMAIN_EVENT_IO_ERROR_REASON = 195 /* * Notice how the entries are grouped in sets of 10 ? -- 1.6.6.1

2 1

[libvirt] [PATCH v2] nwfilter: Also pick IP address from a DHCP ACK message
by Stefan Berger 30 Apr '10

30 Apr '10

The local DHCP server on virtbr0 sends DHCP ACK messages when a VM is started and requests an IP address while the initial DHCP lease on the VM's MAC address hasn't expired. So, also pick the IP address of the VM if that type of message is seen. Thanks to Gerhard Stenzel for providing a test case for this. Changes from V1 to V2: - cleanup: replacing DHCP option numbers through constants Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_learnipaddr.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -98,6 +98,11 @@ struct dhcp { } ATTRIBUTE_PACKED; #define DHCP_MSGT_DHCPOFFER 2 +#define DHCP_MSGT_DHCPACK 5 + + +#define DHCP_OPT_BCASTADDRESS 28 +#define DHCP_OPT_MESSAGETYPE 53 struct ether_vlan_header { @@ -336,17 +341,18 @@ procDHCPOpts(struct dhcp *dhcp, int dhcp switch (dhcpopt->code) { - case 28: /* Broadcast address */ + case DHCP_OPT_BCASTADDRESS: /* Broadcast address */ if (dhcp_opts_len >= 6) { uint32_t *tmp = (uint32_t *)&dhcpopt->value; (*bcastaddr) = ntohl(*tmp); } break; - case 53: /* Message type */ + case DHCP_OPT_MESSAGETYPE: /* Message type */ if (dhcp_opts_len >= 3) { uint8_t *val = (uint8_t *)&dhcpopt->value; switch (*val) { + case DHCP_MSGT_DHCPACK: case DHCP_MSGT_DHCPOFFER: *vmaddr = dhcp->yiaddr; *howDetected = DETECT_DHCP;

2 2

[libvirt] [PATCH] Ignore qemu STOP event when stopping CPUs
by jdenemar＠redhat.com 30 Apr '10

30 Apr '10

From: Jiri Denemark <jdenemar(a)redhat.com> With JSON qemu monitor, we get a STOP event from qemu whenever qemu stops guests CPUs. The downside of it is that vm->state is changed to PAUSED and a new generic paused event is send to applications. However, when we ask qemu to stop the CPUs we are not really interested in qemu event and we usually want to issue a more specific event. By setting vm->status to PAUSED before actually sending the request to qemu (and resetting it back if the request fails) we can ignore the event since the event handler does nothing when the guest is already paused. This solution is quite hacky but unfortunately it's the best solution which I was able to come up with and it doesn't introduce a race condition. --- src/qemu/qemu_driver.c | 25 +++++++++++++++++++------ 1 files changed, 19 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 3c4876e..8ccf0b7 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4117,13 +4117,16 @@ static int qemudDomainSuspend(virDomainPtr dom) { } if (vm->state != VIR_DOMAIN_PAUSED) { int rc; + int state = vm->state; + vm->state = VIR_DOMAIN_PAUSED; qemuDomainObjEnterMonitorWithDriver(driver, vm); rc = qemuMonitorStopCPUs(priv->mon); qemuDomainObjExitMonitorWithDriver(driver, vm); - if (rc < 0) + if (rc < 0) { + vm->state = state; goto endjob; - vm->state = VIR_DOMAIN_PAUSED; + } event = virDomainEventNewFromObj(vm, VIR_DOMAIN_EVENT_SUSPENDED, VIR_DOMAIN_EVENT_SUSPENDED_PAUSED); @@ -4491,8 +4494,10 @@ qemuDomainMigrateOffline(struct qemud_driver *driver, virDomainObjPtr vm) { qemuDomainObjPrivatePtr priv = vm->privateData; + int state = vm->state; int ret; + vm->state = VIR_DOMAIN_PAUSED; qemuDomainObjEnterMonitorWithDriver(driver, vm); ret = qemuMonitorStopCPUs(priv->mon); qemuDomainObjExitMonitorWithDriver(driver, vm); @@ -4500,13 +4505,13 @@ qemuDomainMigrateOffline(struct qemud_driver *driver, if (ret == 0) { virDomainEventPtr event; - vm->state = VIR_DOMAIN_PAUSED; event = virDomainEventNewFromObj(vm, VIR_DOMAIN_EVENT_SUSPENDED, VIR_DOMAIN_EVENT_SUSPENDED_MIGRATED); if (event) qemuDomainEventQueue(driver, event); - } + } else + vm->state = state; return ret; } @@ -4743,13 +4748,14 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path, /* Pause */ if (vm->state == VIR_DOMAIN_RUNNING) { header.was_running = 1; + vm->state = VIR_DOMAIN_PAUSED; qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStopCPUs(priv->mon) < 0) { qemuDomainObjExitMonitorWithDriver(driver, vm); + vm->state = VIR_DOMAIN_RUNNING; goto endjob; } qemuDomainObjExitMonitorWithDriver(driver, vm); - vm->state = VIR_DOMAIN_PAUSED; } /* Get XML for the domain */ @@ -5167,9 +5173,11 @@ static int qemudDomainCoreDump(virDomainPtr dom, /* Pause domain for non-live dump */ if (!(flags & VIR_DUMP_LIVE) && vm->state == VIR_DOMAIN_RUNNING) { + vm->state = VIR_DOMAIN_PAUSED; qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStopCPUs(priv->mon) < 0) { qemuDomainObjExitMonitorWithDriver(driver, vm); + vm->state = VIR_DOMAIN_RUNNING; goto endjob; } qemuDomainObjExitMonitorWithDriver(driver, vm); @@ -5214,6 +5222,7 @@ endjob: "%s", _("resuming after dump failed")); } qemuDomainObjExitMonitorWithDriver(driver, vm); + vm->state = VIR_DOMAIN_RUNNING; } if (qemuDomainObjEndJob(vm) == 0) @@ -11056,12 +11065,16 @@ static int qemuDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, /* qemu unconditionally starts the domain running again after * loadvm, so let's pause it to keep consistency */ + int state = vm->state; priv = vm->privateData; + vm->state = VIR_DOMAIN_PAUSED; qemuDomainObjEnterMonitorWithDriver(driver, vm); rc = qemuMonitorStopCPUs(priv->mon); qemuDomainObjExitMonitorWithDriver(driver, vm); - if (rc < 0) + if (rc < 0) { + vm->state = state; goto cleanup; + } } event = virDomainEventNewFromObj(vm, -- 1.7.0.4

5 7

[libvirt] 'dommemstat' is not working for LXC hypervisor.
by Kumar L Srikanth-B22348 30 Apr '10

30 Apr '10

Hi Daniel, I am using libvirt version 0.8.0. I created a domain 'srikanth_vm' using 'lxc' hypervisor. I am able to start the Domain. But, I am not able to get the memory stats for that Domain. If I issue 'dommemstat Srikanth_vm' in the virsh console, the following error is throwing: error: Failed to get memory statistics for domain srikanth_vm error: this function is not supported by the hypervisor: virDomainMemoryStats Can you please let me know, how can I get memory stats for a particular domain in libvirt? Regards, Srikanth.

3 15

[libvirt] [PATCH] Fix virt-pki-validate's determination of CN
by Dustin Kirkland 30 Apr '10

30 Apr '10

Fix virt-pki-validate's determination of CN This patch is a follow-up to: cb06a9bfe529e64b15773cb86781ae14c09f8216 "portability fixes to tools/virt-pki-validate.in" addressing Eric Blake's concerns about the regular expression. Ubuntu's gntls package generates an Issuer line that looks like this: Issuer: C=US,ST=NY,L=Rochester,O=example.com,CN=example.com CA,EMAIL=hostmaster(a)example.com While Red Hat's looks like this Issuer: CN=Red Hat Emerging Technologies Note the leading whitespace, and the additional fields in the former. This patch updates the regular expression to: * trim leading characters before "Issuer:" * trim anything between Issuer: and CN= * trim anything after the next , I've tested this against the certool output of both RH and Ubuntu generated certs. I know that Eric dislikes the leading grep. My apologies. I spent more time than I care to admit trying to get sed to select that one line, and then run two regexes against it. Feel free to correct this patch and educate me, if you have a better way. Thanks! Signed-off-by: Dustin Kirkland <kirkland(a)canonical.com> diff --git a/tools/virt-pki-validate.in b/tools/virt-pki-validate.in index f77521d..c44aa9d 100755 --- a/tools/virt-pki-validate.in +++ b/tools/virt-pki-validate.in @@ -130,7 +130,7 @@ then echo "as root do: chmod 644 $CA/cacert.pem" exit 1 fi -ORG=`$CERTOOL -i --infile $CA/cacert.pem | sed -n '/Issuer/ s+Issuer: CN=++p'` +ORG=`$CERTOOL -i --infile $CA/cacert.pem | grep "Issuer:" | sed -e 's/^.*Issuer:.*CN=//' -e 's/,.*$//'` if [ "$ORG" = "" ] then echo the CA certificate $CA/cacert.pem does not define the organization

2 4

[libvirt] [v2 0/3] Fixes related to the IP address learning thread
by Stefan Berger 30 Apr '10

30 Apr '10

The following set of patches are primarily related to the thread learning the IP address of a VM and deal with: - ebtables cleanup before applying basic filtering rules that are active while the IP address is detected - shutting down all traffic in case the filtering rules could not be applied by the thread - serialization of the teardown of eb/ip/ip6tables rules to occurr after the IP address learning thread has terminated - not to apply or tear any eb/ip/ip6tables rules of a VM's interface while the IP address learning thread is active. This may be due to a filter being updated concurrently using for exampe 'virsh define/edit'. Regards, Stefan

1 3

[libvirt] [PATCH] qemudDomainSaveFlag: remove dead store
by Jim Meyering 29 Apr '10

29 Apr '10

Clang spotted a new (albeit harmless) dead store: >From 0e37c524fb9c62d9b16443d6ff081c977963f4c5 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Thu, 29 Apr 2010 17:56:01 +0200 Subject: [PATCH] qemudDomainSaveFlag: remove dead store * src/qemu/qemu_driver.c (qemudDomainSaveFlag): Remove dead store to "rc". --- src/qemu/qemu_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 6ee5cc2..8c5d745 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4818,7 +4818,7 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path, virReportSystemError(errno, _("unable to open %s"), path); goto endjob; } - if ((rc = qemudDomainSaveFileOpHook(fd, &hdata)) != 0) { + if (qemudDomainSaveFileOpHook(fd, &hdata) != 0) { close(fd); goto endjob; } -- 1.7.1.328.g9993c

2 2

[libvirt] [PATCH 0/5] build: rely more on gnulib
by Eric Blake 29 Apr '10

29 Apr '10

I can't yet upgrade to the latest gnulib due to some LGPLv2+ issues being worked out upstream. But in the meantime, here's some cleanups that will make it easier to upgrade when gnulib is ready. I always like patch series with a net reduction in lines. I suppose I should try to get a mingw or cygwin build finished with these in place, before pushing anything, but that will have to be tomorrow (I tested on Linux, but it's late for me now). bootstrap.conf | 3 +++ configure.ac | 39 +++++++++++++-------------------------- src/Makefile.am | 3 ++- src/libvirt.c | 4 +--- src/nodeinfo.c | 12 ++---------- src/remote/remote_driver.c | 11 ++++------- src/storage/storage_backend.c | 4 +--- src/util/ebtables.c | 7 ++----- src/util/hooks.c | 4 +--- src/util/iptables.c | 7 ++----- src/util/threads.c | 4 ++-- src/util/threads.h | 4 ++-- src/util/util.c | 14 ++++++-------- 13 files changed, 41 insertions(+), 75 deletions(-) [PATCH 1/5] build: rely on gnulib's pthread module [PATCH 2/5] build: replace redundant header check with function check [PATCH 3/5] build: use gnulib's uname [PATCH 4/5] build: use gnulib's sys/wait.h [PATCH 5/5] build: drop more redundant configure checks

4 14

[libvirt] [PATCH] Fix handling of disk backing stores with cgroups
by Daniel P. Berrange 29 Apr '10

29 Apr '10

The cgroups ACL code was only allowing the primary disk image. It is possible to chain images together, so we need to search for backing stores and add them to the ACL too. Since the ACL only handles block devices, we ignore the EINVAL we get from plain files. * src/qemu/qemu_driver.c: Allow backing stores in cgroup ACLs --- src/qemu/qemu_driver.c | 47 +++++++++++++++++++++++++++++++++++------------ 1 files changed, 35 insertions(+), 12 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 326cb58..ae6addd 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -84,6 +84,7 @@ #include "macvtap.h" #include "nwfilter/nwfilter_gentech_driver.h" #include "hooks.h" +#include "storage_file.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -2957,18 +2958,40 @@ static int qemuSetupCgroup(struct qemud_driver *driver, } for (i = 0; i < vm->def->ndisks ; i++) { - if (vm->def->disks[i]->type != VIR_DOMAIN_DISK_TYPE_BLOCK || - vm->def->disks[i]->src == NULL) - continue; + char *path = vm->def->disks[i]->src; + while (path != NULL) { + virStorageFileMetadata meta; + int ret; + + VIR_DEBUG("Process path %s for disk %d", path, i); + rc = virCgroupAllowDevicePath(cgroup, path); + if (rc != 0) { + /* Get this for non-block devices */ + if (rc == -EINVAL) { + VIR_DEBUG("Ignoring EINVAL for %s", path); + } else { + virReportSystemError(-rc, + _("Unable to allow device %s for %s"), + path, vm->def->name); + if (path != vm->def->disks[i]->src) + VIR_FREE(path); + goto cleanup; + } + } - rc = virCgroupAllowDevicePath(cgroup, - vm->def->disks[i]->src); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to allow device %s for %s"), - vm->def->disks[i]->src, vm->def->name); - goto cleanup; - } + memset(&meta, 0, sizeof(meta)); + + ret = virStorageFileGetMetadata(path, &meta); + + if (path != vm->def->disks[i]->src) + VIR_FREE(path); + path = NULL; + + if (ret < 0) + goto cleanup; + + path = meta.backingStore; + } while (path != NULL); } rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_PTY_MAJOR); -- 1.6.5.2

2 2

[libvirt] [PATCH v2 0/8]: Add arbitrary qemu command-line and monitor commands
by Chris Lalancette 29 Apr '10

29 Apr '10

As we discussed previously, here is the patch series to add the ability to specify arbitrary qemu command-line parameters and environment variables, and also give arbitrary monitor commands to a guest. Because these extra arguments have a good shot at confusing libvirt, the use of them is not supported, but left available for advanced users and developers. They are also in a separate library and have a separate on-the-wire protocol. There is one bug left that I have not yet been able to fix. Because of the complicated way that virsh parses command-line arguments, it is not possible to pass through spaces and quotes when using the qemu-monitor-command. Unfortunately, the qemu monitor commands (and in particular when using QMP) depend heavily on quoting and spacing, so using virsh to send through command-lines is difficult. I'll have to think about how to better resolve this issue, but it should not hold up the rest of the series. Thanks to Dan Berrange and Eric Blake for their reviews already, and to DV for the Relax NG schema changes. Changes since v1 are listed in the individual patches.

2 10

[libvirt] [PATCH] Report better error if qemuSnapshotIsAllowed failed.
by Chris Lalancette 29 Apr '10

29 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/qemu/qemu_driver.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index f7084ca..5ab211a 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10782,8 +10782,8 @@ static int qemuDomainSnapshotIsAllowed(virDomainObjPtr vm) (!vm->def->disks[i]->driverType || STRNEQ(vm->def->disks[i]->driverType, "qcow2"))) { qemuReportError(VIR_ERR_OPERATION_INVALID, - _("Disk device '%s' does not support snapshotting"), - vm->def->disks[i]->info.alias); + _("Disk '%s' does not support snapshotting"), + vm->def->disks[i]->src); return 0; } } -- 1.6.6.1

3 3

[libvirt] nwfilter: Also pick IP address from a DHCP ACK message
by Stefan Berger 29 Apr '10

29 Apr '10

The local DHCP server on virtbr0 sends DHCP ACK messages when a VM is started and requests an IP address while the initial DHCP lease on the VM's MAC address hasn't expired. So, also pick the IP address of the VM if that type of message is seen. Thanks to Gerhard Stenzel for providing a test case for this. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -98,6 +98,7 @@ struct dhcp { } ATTRIBUTE_PACKED; #define DHCP_MSGT_DHCPOFFER 2 +#define DHCP_MSGT_DHCPACK 5 struct ether_vlan_header { @@ -347,6 +348,7 @@ procDHCPOpts(struct dhcp *dhcp, int dhcp if (dhcp_opts_len >= 3) { uint8_t *val = (uint8_t *)&dhcpopt->value; switch (*val) { + case DHCP_MSGT_DHCPACK: case DHCP_MSGT_DHCPOFFER: *vmaddr = dhcp->yiaddr; *howDetected = DETECT_DHCP;

1 0

[libvirt] [PATCH] Fix build on Ubuntu.
by Chris Lalancette 29 Apr '10

29 Apr '10

When building on Ubuntu with make -j3 (or more), it would always fail when trying to build virt-aa-helper. I'm not an expert in automake by any means, but I think the entry for virt-aa-helper is mis-using LDADD; it shouldn't be putting direct paths to libvirt_conf.la and libvirt_util.la, but instead referencing those names. With this patch in place, I'm able to successfully build on Ubuntu 9.04 with make -j3. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/Makefile.am | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index d8466f0..2531ac5 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1005,9 +1005,9 @@ virt_aa_helper_LDFLAGS = $(WARN_CFLAGS) virt_aa_helper_LDADD = \ $(WARN_CFLAGS) \ $(LIBXML_LIBS) \ - @top_srcdir@/src/libvirt_conf.la \ - @top_srcdir@/src/libvirt_util.la \ - @top_srcdir@/gnulib/lib/libgnu.la + libvirt_conf.la \ + libvirt_util.la \ + ../gnulib/lib/libgnu.la virt_aa_helper_CFLAGS = \ -I@top_srcdir@/src/conf \ -I@top_srcdir@/src/security -- 1.6.6.1

2 2

[libvirt] [PATCH] Fix a memory leak in the node_device_udev code
by Chris Lalancette 29 Apr '10

29 Apr '10

We were over-writing a pointer without freeing it in case of a disk device, leading to a memory leak. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/node_device/node_device_udev.c | 7 ------- 1 files changed, 0 insertions(+), 7 deletions(-) diff --git a/src/node_device/node_device_udev.c b/src/node_device/node_device_udev.c index 3a5a7e2..bcfe991 100644 --- a/src/node_device/node_device_udev.c +++ b/src/node_device/node_device_udev.c @@ -815,13 +815,6 @@ static int udevProcessDisk(struct udev_device *device, union _virNodeDevCapData *data = &def->caps->data; int ret = 0; - data->storage.drive_type = strdup("disk"); - if (data->storage.drive_type == NULL) { - virReportOOMError(); - ret = -1; - goto out; - } - if (udevGetUint64SysfsAttr(device, "size", &data->storage.num_blocks) == PROPERTY_ERROR) { -- 1.6.6.1

2 2

[libvirt] [PATCH] Fix a qemuDomainPCIAddressSetFree memory leak
by Chris Lalancette 29 Apr '10

29 Apr '10

qemuDomainPCIAddressSetFree was freeing up the hash table for the pci addresses, but not freeing up the addr structure. Looking over the callers of this function, it seems like they expect it to also free up the structure, so do that here. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/qemu/qemu_conf.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index ed24916..5fa8c0a 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -2110,7 +2110,7 @@ void qemuDomainPCIAddressSetFree(qemuDomainPCIAddressSetPtr addrs) return; virHashFree(addrs->used, qemuDomainPCIAddressSetFreeEntry); - addrs->used = NULL; + VIR_FREE(addrs); } -- 1.6.6.1

2 2

[libvirt] [PATCH] nwfilter: python bindings for nwfilter
by Stefan Berger 29 Apr '10

29 Apr '10

I have primarily followed the pattern of the 'secret' driver to provide support for the missing python bindings for the network filter API. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- python/generator.py | 35 ++++++++++- python/libvirt-override-api.xml | 21 ++++++ python/libvirt-override.c | 124 ++++++++++++++++++++++++++++++++++++++++ python/typewrappers.c | 13 ++++ python/typewrappers.h | 9 ++ 5 files changed, 198 insertions(+), 4 deletions(-) Index: libvirt-acl/python/generator.py =================================================================== --- libvirt-acl.orig/python/generator.py +++ libvirt-acl/python/generator.py @@ -175,7 +175,6 @@ skipped_types = { 'virConnectDomainEventIOErrorCallback': "No function types in python", 'virConnectDomainEventGraphicsCallback': "No function types in python", 'virEventAddHandleFunc': "No function types in python", - 'virNWFilterPtr': "No function types in python", } ####################################################################### @@ -237,6 +236,11 @@ py_types = { 'virSecret *': ('O', "virSecret", "virSecretPtr", "virSecretPtr"), 'const virSecret *': ('O', "virSecret", "virSecretPtr", "virSecretPtr"), + 'virNWFilterPtr': ('O', "virNWFilter", "virNWFilterPtr", "virNWFilterPtr"), + 'const virNWFilterPtr': ('O', "virNWFilter", "virNWFilterPtr", "virNWFilterPtr"), + 'virNWFilter *': ('O', "virNWFilter", "virNWFilterPtr", "virNWFilterPtr"), + 'const virNWFilter *': ('O', "virNWFilter", "virNWFilterPtr", "virNWFilterPtr"), + 'virStreamPtr': ('O', "virStream", "virStreamPtr", "virStreamPtr"), 'const virStreamPtr': ('O', "virStream", "virStreamPtr", "virStreamPtr"), 'virStream *': ('O', "virStream", "virStreamPtr", "virStreamPtr"), @@ -308,6 +312,9 @@ skip_impl = ( 'virSecretGetUUID', 'virSecretGetUUIDString', 'virSecretLookupByUUID', + 'virNWFilterGetUUID', + 'virNWFilterGetUUIDString', + 'virNWFilterLookupByUUID', 'virStreamRecv', 'virStreamSend', 'virStoragePoolGetUUID', @@ -361,6 +368,7 @@ skip_function = ( "virNetworkRef", "virNodeDeviceRef", "virSecretRef", + "virNWFilterRef", "virStoragePoolRef", "virStorageVolRef", @@ -371,6 +379,7 @@ skip_function = ( "virInterfaceGetConnect", "virNetworkGetConnect", "virSecretGetConnect", + "virNWFilterGetConnect", "virStoragePoolGetConnect", "virStorageVolGetConnect", ) @@ -643,6 +652,8 @@ classes_type = { "virNodeDevice *": ("._o", "virNodeDevice(self, _obj=%s)", "virNodeDevice"), "virSecretPtr": ("._o", "virSecret(self, _obj=%s)", "virSecret"), "virSecret *": ("._o", "virSecret(self, _obj=%s)", "virSecret"), + "virNWFilterPtr": ("._o", "virNWFilter(self, _obj=%s)", "virNWFilter"), + "virNWFilter *": ("._o", "virNWFilter(self, _obj=%s)", "virNWFilter"), "virStreamPtr": ("._o", "virStream(self, _obj=%s)", "virStream"), "virStream *": ("._o", "virStream(self, _obj=%s)", "virStream"), "virConnectPtr": ("._o", "virConnect(_obj=%s)", "virConnect"), @@ -657,7 +668,7 @@ converter_type = { primary_classes = ["virDomain", "virNetwork", "virInterface", "virStoragePool", "virStorageVol", "virConnect", "virNodeDevice", "virSecret", - "virStream", "virDomainSnapshot"] + "virNWFilter", "virStream", "virDomainSnapshot"] classes_ancestor = { } @@ -669,6 +680,7 @@ classes_destructors = { "virStorageVol": "virStorageVolFree", "virNodeDevice" : "virNodeDeviceFree", "virSecret": "virSecretFree", + "virNWFilter": "virNWFilterFree", "virDomainSnapshot": "virDomainSnapshotFree", # We hand-craft __del__ for this one #"virStream": "virStreamFree", @@ -691,6 +703,7 @@ functions_noexcept = { 'virNodeDeviceGetParent': True, 'virSecretGetUsageType': True, 'virSecretGetUsageID': True, + 'virNWFilterGetName': True, } reference_keepers = { @@ -756,6 +769,12 @@ def nameFixup(name, classe, type, file): elif name[0:15] == "virSecretLookup": func = name[3:] func = string.lower(func[0:1]) + func[1:] + elif name[0:17] == "virNWFilterDefine": + func = name[3:] + func = string.lower(func[0:3]) + func[3:] + elif name[0:17] == "virNWFilterLookup": + func = name[3:] + func = string.lower(func[0:3]) + func[3:] elif name[0:20] == "virStoragePoolDefine": func = name[3:] func = string.lower(func[0:1]) + func[1:] @@ -813,6 +832,12 @@ def nameFixup(name, classe, type, file): elif name[0:9] == 'virSecret': func = name[9:] func = string.lower(func[0:1]) + func[1:] + elif name[0:14] == 'virNWFilterGet': + func = name[14:] + func = string.lower(func[0:1]) + func[1:] + elif name[0:11] == 'virNWFilter': + func = name[11:] + func = string.lower(func[0:1]) + func[1:] elif name[0:12] == 'virStreamNew': func = "newStream" elif name[0:9] == 'virStream': @@ -1099,7 +1124,8 @@ def buildWrappers(): else: classes.write("class %s:\n" % (classname)) if classname in [ "virDomain", "virNetwork", "virInterface", "virStoragePool", - "virStorageVol", "virNodeDevice", "virSecret","virStream" ]: + "virStorageVol", "virNodeDevice", "virSecret","virStream", + "virNWFilter" ]: classes.write(" def __init__(self, conn, _obj=None):\n") else: classes.write(" def __init__(self, _obj=None):\n") @@ -1108,7 +1134,8 @@ def buildWrappers(): for ref in list: classes.write(" self.%s = None\n" % ref[1]) if classname in [ "virDomain", "virNetwork", "virInterface", - "virNodeDevice", "virSecret", "virStream" ]: + "virNodeDevice", "virSecret", "virStream", + "virNWFilter" ]: classes.write(" self._conn = conn\n") elif classname in [ "virStorageVol", "virStoragePool" ]: classes.write(" self._conn = conn\n" + \ Index: libvirt-acl/python/typewrappers.c =================================================================== --- libvirt-acl.orig/python/typewrappers.c +++ libvirt-acl/python/typewrappers.c @@ -215,6 +215,19 @@ libvirt_virSecretPtrWrap(virSecretPtr no } PyObject * +libvirt_virNWFilterPtrWrap(virNWFilterPtr node) +{ + PyObject *ret; + + if (node == NULL) { + Py_INCREF(Py_None); + return Py_None; + } + ret = PyCObject_FromVoidPtrAndDesc(node, (char *) "virNWFilterPtr", NULL); + return (ret); +} + +PyObject * libvirt_virStreamPtrWrap(virStreamPtr node) { PyObject *ret; Index: libvirt-acl/python/typewrappers.h =================================================================== --- libvirt-acl.orig/python/typewrappers.h +++ libvirt-acl/python/typewrappers.h @@ -91,6 +91,14 @@ typedef struct { virSecretPtr obj; } PyvirSecret_Object; +#define PyvirNWFilter_Get(v) (((v) == Py_None) ? NULL : \ + (((PyvirNWFilter_Object *)(v))->obj)) + +typedef struct { + PyObject_HEAD + virNWFilterPtr obj; +} PyvirNWFilter_Object; + #define PyvirStream_Get(v) (((v) == Py_None) ? NULL : \ (((PyvirStream_Object *)(v))->obj)) @@ -163,6 +171,7 @@ PyObject * libvirt_virFreeCallbackWrap(v PyObject * libvirt_virVoidPtrWrap(void* node); PyObject * libvirt_virNodeDevicePtrWrap(virNodeDevicePtr node); PyObject * libvirt_virSecretPtrWrap(virSecretPtr node); +PyObject * libvirt_virNWFilterPtrWrap(virNWFilterPtr node); PyObject * libvirt_virStreamPtrWrap(virStreamPtr node); PyObject * libvirt_virDomainSnapshotPtrWrap(virDomainSnapshotPtr node); Index: libvirt-acl/python/libvirt-override.c =================================================================== --- libvirt-acl.orig/python/libvirt-override.c +++ libvirt-acl/python/libvirt-override.c @@ -1957,6 +1957,126 @@ libvirt_virSecretSetValue(PyObject *self } static PyObject * +libvirt_virNWFilterGetUUID(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) { + PyObject *py_retval; + unsigned char uuid[VIR_UUID_BUFLEN]; + virNWFilterPtr nwfilter; + PyObject *pyobj_nwfilter; + int c_retval; + + if (!PyArg_ParseTuple(args, (char *)"O:virNWFilterGetUUID", &pyobj_nwfilter)) + return(NULL); + nwfilter = (virNWFilterPtr) PyvirNWFilter_Get(pyobj_nwfilter); + + if (nwfilter == NULL) + return VIR_PY_NONE; + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virNWFilterGetUUID(nwfilter, &uuid[0]); + LIBVIRT_END_ALLOW_THREADS; + + if (c_retval < 0) + return VIR_PY_NONE; + py_retval = PyString_FromStringAndSize((char *) &uuid[0], VIR_UUID_BUFLEN); + + return(py_retval); +} + +static PyObject * +libvirt_virNWFilterGetUUIDString(PyObject *self ATTRIBUTE_UNUSED, + PyObject *args) { + PyObject *py_retval; + char uuidstr[VIR_UUID_STRING_BUFLEN]; + virNWFilterPtr nwfilter; + PyObject *pyobj_nwfilter; + int c_retval; + + if (!PyArg_ParseTuple(args, (char *)"O:virNWFilterGetUUIDString", + &pyobj_nwfilter)) + return(NULL); + nwfilter = (virNWFilterPtr) PyvirNWFilter_Get(pyobj_nwfilter); + + if (nwfilter == NULL) + return VIR_PY_NONE; + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virNWFilterGetUUIDString(nwfilter, &uuidstr[0]); + LIBVIRT_END_ALLOW_THREADS; + + if (c_retval < 0) + return VIR_PY_NONE; + + py_retval = PyString_FromString((char *) &uuidstr[0]); + return(py_retval); +} + +static PyObject * +libvirt_virNWFilterLookupByUUID(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) { + PyObject *py_retval; + virNWFilterPtr c_retval; + virConnectPtr conn; + PyObject *pyobj_conn; + unsigned char * uuid; + int len; + + if (!PyArg_ParseTuple(args, (char *)"Oz#:virNWFilterLookupByUUID", &pyobj_conn, &uuid, &len)) + return(NULL); + conn = (virConnectPtr) PyvirConnect_Get(pyobj_conn); + + if ((uuid == NULL) || (len != VIR_UUID_BUFLEN)) + return VIR_PY_NONE; + + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virNWFilterLookupByUUID(conn, uuid); + LIBVIRT_END_ALLOW_THREADS; + py_retval = libvirt_virNWFilterPtrWrap((virNWFilterPtr) c_retval); + return(py_retval); +} + + +static PyObject * +libvirt_virConnectListNWFilters(PyObject *self ATTRIBUTE_UNUSED, + PyObject *args) { + PyObject *py_retval; + char **uuids = NULL; + virConnectPtr conn; + int c_retval, i; + PyObject *pyobj_conn; + + if (!PyArg_ParseTuple(args, (char *)"O:virConnectListNWFilters", &pyobj_conn)) + return NULL; + conn = (virConnectPtr) PyvirConnect_Get(pyobj_conn); + + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virConnectNumOfNWFilters(conn); + LIBVIRT_END_ALLOW_THREADS; + if (c_retval < 0) + return VIR_PY_NONE; + + if (c_retval) { + uuids = malloc(sizeof(*uuids) * c_retval); + if (!uuids) + return VIR_PY_NONE; + LIBVIRT_BEGIN_ALLOW_THREADS; + c_retval = virConnectListNWFilters(conn, uuids, c_retval); + LIBVIRT_END_ALLOW_THREADS; + if (c_retval < 0) { + free(uuids); + return VIR_PY_NONE; + } + } + py_retval = PyList_New(c_retval); + + if (uuids) { + for (i = 0;i < c_retval;i++) { + PyList_SetItem(py_retval, i, libvirt_constcharPtrWrap(uuids[i])); + free(uuids[i]); + } + free(uuids); + } + + return py_retval; +} + +static PyObject * libvirt_virConnectListInterfaces(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) { PyObject *py_retval; @@ -3316,6 +3436,10 @@ static PyMethodDef libvirtMethods[] = { {(char *) "virConnectListSecrets", libvirt_virConnectListSecrets, METH_VARARGS, NULL}, {(char *) "virSecretGetValue", libvirt_virSecretGetValue, METH_VARARGS, NULL}, {(char *) "virSecretSetValue", libvirt_virSecretSetValue, METH_VARARGS, NULL}, + {(char *) "virNWFilterGetUUID", libvirt_virNWFilterGetUUID, METH_VARARGS, NULL}, + {(char *) "virNWFilterGetUUIDString", libvirt_virNWFilterGetUUIDString, METH_VARARGS, NULL}, + {(char *) "virNWFilterLookupByUUID", libvirt_virNWFilterLookupByUUID, METH_VARARGS, NULL}, + {(char *) "virConnectListNWFilters", libvirt_virConnectListNWFilters, METH_VARARGS, NULL}, {(char *) "virConnectListInterfaces", libvirt_virConnectListInterfaces, METH_VARARGS, NULL}, {(char *) "virConnectListDefinedInterfaces", libvirt_virConnectListDefinedInterfaces, METH_VARARGS, NULL}, {(char *) "virConnectBaselineCPU", libvirt_virConnectBaselineCPU, METH_VARARGS, NULL}, Index: libvirt-acl/python/libvirt-override-api.xml =================================================================== --- libvirt-acl.orig/python/libvirt-override-api.xml +++ libvirt-acl/python/libvirt-override-api.xml @@ -226,6 +226,27 @@ <return type='char *' info='the UUID string or None in case of error'/> <arg name='secret' type='virSecretPtr' info='a secret object'/> </function> + <function name='virConnectListNWFilters' file='libvirt' module='libvirt'> + <info>List the defined network filters</info> + <arg name='conn' type='virConnectPtr' info='virConnect connection'/> + <return type='str *' info='the list of network filter IDs or None in case of error'/> + </function> + <function name='virNWFilterLookupByUUID' file='python'> + <info>Try to lookup a network filter on the given hypervisor based on its UUID.</info> + <return type='virNWFilterPtr' info='a new network filter object or NULL in case of failure'/> + <arg name='conn' type='virConnectPtr' info='pointer to the hypervisor connection'/> + <arg name='uuid' type='const unsigned char *' info='the UUID string for the secret, must be 16 bytes'/> + </function> + <function name='virNWFilterGetUUID' file='python'> + <info>Extract the UUID unique Identifier of a network filter.</info> + <return type='char *' info='the 16 bytes string or None in case of error'/> + <arg name='nwfilter' type='virNWFilterPtr' info='a network filter object'/> + </function> + <function name='virNWFilterGetUUIDString' file='python'> + <info>Fetch globally unique ID of the network filter as a string.</info> + <return type='char *' info='the UUID string or None in case of error'/> + <arg name='nwfilter' type='virNWFilterPtr' info='a network filter object'/> + </function> <function name='virConnectListInterfaces' file='python'> <info>list the running interfaces, stores the pointers to the names in @names</info> <arg name='conn' type='virConnectPtr' info='pointer to the hypervisor connection'/>

2 2

[libvirt] FW: Creating multiple network interfaces in libvirt Domain.
by Kumar L Srikanth-B22348 29 Apr '10

29 Apr '10

Hi All, Can anybody please help me in the issue? Regards, Srikanth. From: Kumar L Srikanth-B22348 Sent: Wednesday, April 28, 2010 4:47 PM To: 'Daniel P. Berrange' Subject: FW: Creating multiple network interfaces in libvirt Domain. Also, can you please let me know, how can I create multiple interfaces in the guest domain using Domain XML? Regards, Srikanth. From: Kumar L Srikanth-B22348 Sent: Wednesday, April 28, 2010 2:26 PM To: 'berrange(a)redhat.com' Cc: 'libvir-list(a)redhat.com' Subject: Creating multiple network interfaces in libvirt Domain. Hi, I want to create a Domain with two interfaces. I am using LXC hypervisor in the libvirt. My domain XML is shown below: <domain type='lxc' id='1'> <name>srikanth_vm2</name> <memory>500000</memory> <os> <type>exe</type> <init>/bin/sh</init> </os> <vcpu>1</vcpu> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/libexec/libvirt_lxc</emulator> <filesystem type='mount'> <source dir='/root/lxc/fedora1'/> <target dir='/'/> </filesystem> <interface type='network'> <source network='default'/> </interface> <interface type='network'> <source network='default'/> </interface> <console type='pty' /> </devices> </domain> I am able to define the Domain. But, I am not able to start the Domain. While starting the domain, I am getting the following error: error: Failed to start domain srikanth_vm2 error: internal error Failed to create veth device pair: 512 Can you please let me know where I am going wrong? Regards, Srikanth.

1 0

[libvirt] [PATCH] cygwin/mingw: Fix version script handling
by Matthias Bolte 29 Apr '10

29 Apr '10

Let configure detect ld instead of hardcoding /usr/bin/ld, because MinGW may have ld in /bin. Only use a .def file to export symbols on MinGW. Cygwin's ld supports the normal .syms file used on Linux. --- configure.ac | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 955a9e9..7121c3e 100644 --- a/configure.ac +++ b/configure.ac @@ -73,9 +73,10 @@ AC_LIBTOOL_WIN32_DLL AM_PROG_LIBTOOL AM_PROG_CC_C_O +AM_PROG_LD VERSION_SCRIPT_FLAGS=-Wl,--version-script= -`/usr/bin/ld --help 2>&1 | grep -- --version-script >/dev/null` || \ +`$LD --help 2>&1 | grep -- --version-script >/dev/null` || \ VERSION_SCRIPT_FLAGS="-Wl,-M -Wl," AC_SUBST(VERSION_SCRIPT_FLAGS) @@ -1804,9 +1805,17 @@ case "$host" in if test "x$enable_shared" = "xno"; then WIN32_EXTRA_CFLAGS="-DLIBVIRT_STATIC" fi +esac +case "$host" in + *-*-mingw* | *-*-msvc* ) # Also set the symbol file to .def, so src/Makefile generates libvirt.def # from libvirt.syms and passes libvirt.def instead of libvirt.syms to the linker LIBVIRT_SYMBOL_FILE=libvirt.def + # mingw's ld has the --version-script parameter, but it requires a .def file + # instead to work properly, therefore clear --version-script here + # cygwin's ld has the --version-script parameter too, but for some reason + # it's working there as expected + VERSION_SCRIPT_FLAGS= ;; esac AC_SUBST([CYGWIN_EXTRA_LDFLAGS]) -- 1.6.3.3

2 2

[libvirt] new NULL-dereference in qemu_driver.c
by Jim Meyering 28 Apr '10

28 Apr '10

I ran clang on the very latest and it spotted this problem: >From qemu_driver.c, around line 11100, else { /* qemu is a little funny with running guests and the restoration * of snapshots. If the snapshot was taken online, * then after a "loadvm" monitor command, the VM is set running * again. If the snapshot was taken offline, then after a "loadvm" * monitor command the VM is left paused. Unpausing it leads to * the memory state *before* the loadvm with the disk *after* the * loadvm, which obviously is bound to corrupt something. * Therefore we destroy the domain and set it to "off" in this case. */ if (virDomainObjIsActive(vm)) { qemudShutdownVMDaemon(driver, vm); event = virDomainEventNewFromObj(vm, VIR_DOMAIN_EVENT_STOPPED, VIR_DOMAIN_EVENT_STOPPED_FROM_SNAPSHOT); if (!vm->persistent) { if (qemuDomainObjEndJob(vm) > 0) virDomainRemoveInactive(&driver->domains, vm); vm = NULL; } } if (qemuDomainSnapshotSetActive(vm, driver->snapshotDir) < 0) goto endjob; } vm->state = snap->def->state; ret = 0; endjob: if (vm && qemuDomainObjEndJob(vm) == 0) vm = NULL; Note how "vm" is set to NULL. Then, it can be dereferenced both via qemuDomainSnapshotSetActive and via the vm->state = ... assignment.

3 7

[libvirt] [PATCH TCK] Add a test for QCow2 files with a backing store
by Daniel P. Berrange 28 Apr '10

28 Apr '10

This test case verifies that it is possible to run QEMU guest from a qcow2 file with a backing store pointing to a physical disk. This verifies backing store handling with SELinux, UID/GID changing code and CGroups ACLs * scripts/qemu/150-disk-backingstore.t: New test case * lib/Sys/Virt/TCK/StorageVolBuilder.pm: Allow volume backing store to be set in XML --- lib/Sys/Virt/TCK/StorageVolBuilder.pm | 14 +++++ scripts/qemu/150-disk-backingstore.t | 97 +++++++++++++++++++++++++++++++++ 2 files changed, 111 insertions(+), 0 deletions(-) create mode 100644 scripts/qemu/150-disk-backingstore.t diff --git a/lib/Sys/Virt/TCK/StorageVolBuilder.pm b/lib/Sys/Virt/TCK/StorageVolBuilder.pm index 00680ed..2772d51 100644 --- a/lib/Sys/Virt/TCK/StorageVolBuilder.pm +++ b/lib/Sys/Virt/TCK/StorageVolBuilder.pm @@ -68,6 +68,14 @@ sub secret { return $self; } +sub backing_store { + my $self = shift; + + $self->{backingStore} = shift; + + return $self; +} + sub as_xml { my $self = shift; @@ -95,6 +103,12 @@ sub as_xml { $w->endTag("target"); } + if ($self->{backingStore}) { + $w->startTag("backingStore"); + $w->dataElement("path", $self->{backingStore}); + $w->endTag("backingStore"); + } + $w->endTag("volume"); return $data; diff --git a/scripts/qemu/150-disk-backingstore.t b/scripts/qemu/150-disk-backingstore.t new file mode 100644 index 0000000..62d8faf --- /dev/null +++ b/scripts/qemu/150-disk-backingstore.t @@ -0,0 +1,97 @@ +# -*- perl -*- +# +# Copyright (C) 2009-2010 Red Hat, Inc. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +qemu/150-disk-backingstore.t - qcow2 image with a backing store on physical disk + +=head1 DESCRIPTION + +The test case validates that a guest can be booted from a +qcow2 file with a backing store pointing to a physical disk. +This verifies that SELinux labelling, uid/gid changes and +cgroups ACL setup is working correctly with backing stores + +=cut + +use strict; +use warnings; + +use Test::More tests => 8; + +use Sys::Virt::TCK; +use Test::Exception; +use File::Spec::Functions qw(catfile); + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { $tck->cleanup if $tck; } + +my $dev = $tck->get_host_block_device(); + +SKIP: { + skip "no block device available", 8 unless $dev; + skip "Only relevant to QEMU driver", 8 unless $conn->get_type() eq "QEMU"; + + ok(-b $dev, "$dev is a block device"); + + my $dir = $tck->bucket_dir("150-disk-backingstore"); + my $disk = catfile($dir, "demo.qcow2"); + + my $poolXML = Sys::Virt::TCK::StoragePoolBuilder->new() + ->source_dir($dir)->target($dir)->as_xml(); + + my $pool; + + diag "Creating pool $poolXML"; + lives_ok(sub { $pool = $conn->create_storage_pool($poolXML) }, "pool created"); + + + my $volXML = Sys::Virt::TCK::StorageVolBuilder->new(name => "demo.qcow2") + ->capacity(1024*1024*1024) + ->format("qcow2") + ->backing_store($dev) + ->as_xml(); + + my $vol; + + diag "Creating volume $volXML"; + lives_ok(sub { $vol = $pool->create_volume($volXML) }, "volume created"); + + my $xml = $tck->generic_domain("tck") + ->disk(format => ["qemu", "qcow2"], + type => "file", + src => $disk, + dst => "hdb") + ->as_xml; + + diag "Creating a transient guest with config $xml"; + my $dom; + ok_domain(sub { $dom = $conn->create_domain($xml) }, "started transient domain config"); + + ok($dom->get_id() > 0, "running domain has an ID > 0"); + + diag "Trying another domain lookup by name"; + my $dom1; + ok_domain(sub { $dom1 = $conn->get_domain_by_name("tck") }, "the running domain object"); + ok($dom1->get_id() > 0, "running domain has an ID > 0"); + + + diag "Destroying the running domain"; + $dom->destroy(); + + ok_error(sub { $conn->get_domain_by_name("tck") }, "NO_DOMAIN error raised from missing domain", 42); +} -- 1.6.5.2

2 2

[libvirt] [PATCH 0/4] Multiple problems with saving to block devices (v2)
by Daniel P. Berrange 28 Apr '10

28 Apr '10

Update of https://www.redhat.com/archives/libvir-list/2010-April/msg00912.html Changes this time: - Pad header/xml to multiple of 512 - Set dd block size & seek as a muliplier of that - Invert check for block dev, to check for regular file instead

3 12

[libvirt] [PATCH 0/6]: Add a API for query domain disk sizing info (v2)
by Daniel P. Berrange 28 Apr '10

28 Apr '10

A second version of: https://www.redhat.com/archives/libvir-list/2010-April/msg01248.html In this series - Add python binding - Add virsh.pod entry - Fix help text in virsh.c command description - Document flags parameter in libvirt.c

3 12

[libvirt] [PATCH] Fix detection of disk in IO events
by Daniel P. Berrange 28 Apr '10

28 Apr '10

When using -device syntax, the IO event will have a different prefix, 'drive-' that needs to be skipped over before matching against the libvirt disk alias * src/qemu/qemu_driver.c: Skip QEMU_DRIVE_HOST_PREFIX in IO event --- src/qemu/qemu_driver.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 3e0a38a..9434e00 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -763,6 +763,9 @@ findDomainDiskByAlias(virDomainObjPtr vm, { int i; + if (STRPREFIX(alias, QEMU_DRIVE_HOST_PREFIX)) + alias += strlen(QEMU_DRIVE_HOST_PREFIX); + for (i = 0; i < vm->def->ndisks; i++) { virDomainDiskDefPtr disk; -- 1.6.6.1

2 1

[libvirt] [PATCH 0/3] Add dnsmasq module (v2)
by Satoru SATOH 28 Apr '10

28 Apr '10

The following series of patches is a prototype implementation of dnsmasq module. It implements an idea to save dhcp hosts' macaddr vs. ipaddr mappings to static file and make dnsmasq loading it with "--dhcp-hostsfile" option, originally suggested by Dan-san, and can address the problem that too many "--dhcp-host" args hitting ARG_MAX limit I reported last year [1]. This is a updated version reflecting some advices from Jim-san [2] and Eric-san [3]. [1] https://www.redhat.com/archives/libvir-list/2009-October/msg00216.html [2] https://www.redhat.com/archives/libvir-list/2010-April/msg00849.html [3] https://www.redhat.com/archives/libvir-list/2010-April/msg00850.html - satoru

4 15

[libvirt] [PATCH] nwfilter: allow to mix filterrefs and rules in the schema
by Stefan Berger 28 Apr '10

28 Apr '10

So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/schemas/nwfilter.rng | 472 +++++++++++++++++++++++----------------------- 1 file changed, 237 insertions(+), 235 deletions(-) Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -6,249 +6,249 @@ <define name="filter"> <element name="filter"> <ref name="filter-node-attributes"/> + <optional> + <element name="uuid"> + <ref name="UUID"/> + </element> + </optional> <zeroOrMore> <choice> <element name="filterref"> <ref name="filterref-node-attributes"/> </element> - <element name="uuid"> - <ref name="UUID"/> + <element name="rule"> + <ref name="rule-node-attributes"/> + <optional> + <zeroOrMore> + <element name="mac"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="mac-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="arp"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="arp-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="rarp"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="arp-attributes"/>  + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ip"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-port-attributes"/> + <ref name="ip-attributes"/> + <ref name="dscp-attribute"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ipv6"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-port-attributes"/> + <ref name="ip-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="tcp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="sctp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="icmp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + <ref name="icmp-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="igmp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="all"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="esp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ah"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udplite"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="tcp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="sctp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="icmpv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + <ref name="icmp-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="all-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="esp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ah-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udplite-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> </element> </choice> </zeroOrMore> - <zeroOrMore> - <element name="rule"> - <ref name="rule-node-attributes"/> - <optional> - <zeroOrMore> - <element name="mac"> - <ref name="match-attribute"/> - <ref name="common-l2-attributes"/> - <ref name="mac-attributes"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="arp"> - <ref name="match-attribute"/> - <ref name="common-l2-attributes"/> - <ref name="arp-attributes"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="rarp"> - <ref name="match-attribute"/> - <ref name="common-l2-attributes"/> - <ref name="arp-attributes"/>  - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="ip"> - <ref name="match-attribute"/> - <ref name="common-l2-attributes"/> - <ref name="common-ip-attributes-p1"/> - <ref name="common-port-attributes"/> - <ref name="ip-attributes"/> - <ref name="dscp-attribute"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="ipv6"> - <ref name="match-attribute"/> - <ref name="common-l2-attributes"/> - <ref name="common-ipv6-attributes-p1"/> - <ref name="common-port-attributes"/> - <ref name="ip-attributes"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="tcp"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-port-attributes"/> - <ref name="common-ip-attributes-p1"/> - <ref name="common-ip-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="udp"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-port-attributes"/> - <ref name="common-ip-attributes-p1"/> - <ref name="common-ip-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="sctp"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-port-attributes"/> - <ref name="common-ip-attributes-p1"/> - <ref name="common-ip-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="icmp"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ip-attributes-p1"/> - <ref name="common-ip-attributes-p2"/> - <ref name="icmp-attributes"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="igmp"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ip-attributes-p1"/> - <ref name="common-ip-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="all"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ip-attributes-p1"/> - <ref name="common-ip-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="esp"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ip-attributes-p1"/> - <ref name="common-ip-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="ah"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ip-attributes-p1"/> - <ref name="common-ip-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="udplite"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ip-attributes-p1"/> - <ref name="common-ip-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="tcp-ipv6"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-port-attributes"/> - <ref name="common-ipv6-attributes-p1"/> - <ref name="common-ipv6-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="udp-ipv6"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-port-attributes"/> - <ref name="common-ipv6-attributes-p1"/> - <ref name="common-ipv6-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="sctp-ipv6"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-port-attributes"/> - <ref name="common-ipv6-attributes-p1"/> - <ref name="common-ipv6-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="icmpv6"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ipv6-attributes-p1"/> - <ref name="common-ipv6-attributes-p2"/> - <ref name="icmp-attributes"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="all-ipv6"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ipv6-attributes-p1"/> - <ref name="common-ipv6-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="esp-ipv6"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ipv6-attributes-p1"/> - <ref name="common-ipv6-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="ah-ipv6"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ipv6-attributes-p1"/> - <ref name="common-ipv6-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> - <element name="udplite-ipv6"> - <ref name="match-attribute"/> - <ref name="srcmac-attribute"/> - <ref name="common-ipv6-attributes-p1"/> - <ref name="common-ipv6-attributes-p2"/> - </element> - </zeroOrMore> - </optional> - </element> - </zeroOrMore> </element> </define> @@ -263,6 +263,7 @@ <choice> <value>root</value> <value>arp</value> + <value>rarp</value> <value>ipv4</value> <value>ipv6</value> </choice> @@ -690,6 +691,7 @@ <choice> <value>arp</value> + <value>rarp</value> <value>ipv4</value> <value>ipv6</value> </choice>

2 2

[libvirt] [PATCH 00/10]: Add arbitrary qemu command-line and monitor commands
by Chris Lalancette 28 Apr '10

28 Apr '10

As we discussed previously, here is the patch series to add the ability to specify arbitrary qemu command-line parameters and environment variables, and also give arbitrary monitor commands to a guest. Because these extra arguments have a good shot at confusing libvirt, the use of them is not supported, but left available for advanced users and developers. They are also in a separate library and have a separate on-the-wire protocol. There is one bug left that I have not yet been able to fix. Because of the complicated way that virsh parses command-line arguments, it is not possible to pass through spaces and quotes when using the qemu-monitor-command. Unfortunately, the qemu monitor commands (and in particular when using QMP) depend heavily on quoting and spacing, so using virsh to send through command-lines is difficult. I'll have to think about how to better resolve this issue, but it should not hold up the rest of the series. Thanks to Dan Berrange for his review already, and to DV for the Relax NG schema changes.

4 33

[libvirt] [PATCH 0/5]: Add a API for query domain disk sizing info
by Daniel P. Berrange 28 Apr '10

28 Apr '10

This is somewhat late for the 0.8.1 release, but this is a rather critical API for some of the use cases of RHEV. It introduces a new API against a virDomainPtr to allow the direct querying of the size of guest block devices. This is modelled on the virStorageVol API for getting size, so I'm pretty confident on the design and impl here.

3 15

[libvirt] [PATCH] qemudDomainCreate: correct a slightly misdirected goto
by Jim Meyering 27 Apr '10

27 Apr '10

I was looking at other uses of qemuDomainObjEndJob and saw this: >From f8ccc44e7890c1b2ae2ebc266ca5d6215fe9c80d Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Tue, 27 Apr 2010 22:16:02 +0200 Subject: [PATCH] qemudDomainCreate: correct a slightly misdirected goto * src/qemu/qemu_driver.c (qemudDomainCreate): Goto cleanup, not "endjob", since we know "vm" is already NULL. No semantic change. --- src/qemu/qemu_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index e1b1af3..2daf038 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4033,35 +4033,35 @@ static virDomainPtr qemudDomainCreate(virConnectPtr conn, const char *xml, goto cleanup; if (!(vm = virDomainAssignDef(driver->caps, &driver->domains, def, false))) goto cleanup; def = NULL; if (qemuDomainObjBeginJobWithDriver(driver, vm) < 0) goto cleanup; /* XXXX free the 'vm' we created ? */ if (qemudStartVMDaemon(conn, driver, vm, NULL, -1) < 0) { if (qemuDomainObjEndJob(vm) > 0) virDomainRemoveInactive(&driver->domains, vm); vm = NULL; - goto endjob; + goto cleanup; } event = virDomainEventNewFromObj(vm, VIR_DOMAIN_EVENT_STARTED, VIR_DOMAIN_EVENT_STARTED_BOOTED); dom = virGetDomain(conn, vm->def->name, vm->def->uuid); if (dom) dom->id = vm->def->id; endjob: if (vm && qemuDomainObjEndJob(vm) == 0) vm = NULL; cleanup: virDomainDefFree(def); if (vm) -- 1.7.1.328.g9993c

2 1

[libvirt] using clang
by Jim Meyering 27 Apr '10

27 Apr '10

Some people have expressed an interest in setting up a libvirt autobuilder using clang. If you do that, be aware that you'll see an ugly looking NULL-deref problem when using the clang that comes with F12 or F13, but if you're using a new enough version (rawhide), it's gone. The offending code is in qemu_monitor.c around line 377 and involves the CMSG_* macros: 365 memset(&msg, 0, sizeof(msg)); 366 367 iov[0].iov_base = (void *)data; 368 iov[0].iov_len = len; 369 370 msg.msg_iov = iov; 371 msg.msg_iovlen = 1; 372 373 msg.msg_control = control; 374 msg.msg_controllen = sizeof(control); 375 376 cmsg = CMSG_FIRSTHDR(&msg)((size_t) (&msg)->msg_controllen >= sizeof (struct cmsghdr ) ? (struct cmsghdr *) (&msg)->msg_control : (struct cmsghdr *) 0); *** 2 Null pointer value stored to 'cmsg' 377 cmsg->cmsg_len = CMSG_LEN(sizeof(int))((((sizeof (struct cmsghdr)) + sizeof (size_t) - 1) & (size_t) ~(sizeof (size_t) - 1)) + (sizeof(int))); *** 3 Dereference of null pointer Presuming this code is actually exercised, it's obviously not dereferencing NULL, so it would be a false positive. I looked at a few usage examples and it seems like glibc's own tests do allocate more storage. If this code is *not* currently being used, we should model it after the glibc test code. ----------------------------------------- FYI, anyone can (and all developers should) run clang. It's simple, but does require a configure-from-scratch, so it's good to keep a separate Build like this: scan-build -o clang ./autogen.sh --enable-compile-warnings=maximum && scan-build -o clang make The "-o clang" tells it to put results in a new directory named "clang".

2 1

[libvirt] [PATCH] nwfilter: let qemu's after-migration packet pass
by Stefan Berger 27 Apr '10

27 Apr '10

Qemu currently sends an Ethernet packet with protocol id 0x835 once a VM was successfully migrated. The content of the packet looks like a gratuitous RARP, just with the wrong protocol ID, which should be 0x8035. I wrote some filters to let either one of the packets pass and am adapting the clean-traffic sample filter to use it. I am also doing some changes on the existing ARP filter which was lacking a test for source MAC address. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- examples/xml/nwfilter/Makefile.am | 5 ++++- examples/xml/nwfilter/clean-traffic.xml | 3 +++ examples/xml/nwfilter/no-arp-spoofing.xml | 13 ++++++++----- examples/xml/nwfilter/no-other-rarp-traffic.xml | 4 ++++ examples/xml/nwfilter/qemu-announce-self-rarp.xml | 14 ++++++++++++++ examples/xml/nwfilter/qemu-announce-self.xml | 13 +++++++++++++ 6 files changed, 46 insertions(+), 6 deletions(-) Index: libvirt-acl/examples/xml/nwfilter/Makefile.am =================================================================== --- libvirt-acl.orig/examples/xml/nwfilter/Makefile.am +++ libvirt-acl/examples/xml/nwfilter/Makefile.am @@ -11,7 +11,10 @@ FILTERS = \ no-ip-spoofing.xml \ no-mac-broadcast.xml \ no-mac-spoofing.xml \ - no-other-l2-traffic.xml + no-other-l2-traffic.xml \ + no-other-rarp-traffic.xml \ + qemu-announce-self.xml \ + qemu-announce-self-rarp.xml EXTRA_DIST=$(FILTERS) Index: libvirt-acl/examples/xml/nwfilter/qemu-announce-self-rarp.xml =================================================================== --- /dev/null +++ libvirt-acl/examples/xml/nwfilter/qemu-announce-self-rarp.xml @@ -0,0 +1,14 @@ +<filter name='qemu-announce-self-rarp' chain='rarp'> + <rule action='accept' direction='out' priority='500'> + <rarp opcode='Request_Reverse' + srcmacaddr='$MAC' dstmacaddr='ff:ff:ff:ff:ff:ff' + arpsrcmacaddr='$MAC' arpdstmacaddr='$MAC' + arpsrcipaddr='0.0.0.0' arpdstipaddr='0.0.0.0'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <rarp opcode='Request_Reverse' + dstmacaddr='ff:ff:ff:ff:ff:ff' + arpsrcmacaddr='$MAC' arpdstmacaddr='$MAC' + arpsrcipaddr='0.0.0.0' arpdstipaddr='0.0.0.0'/> + </rule> +</filter> Index: libvirt-acl/examples/xml/nwfilter/clean-traffic.xml =================================================================== --- libvirt-acl.orig/examples/xml/nwfilter/clean-traffic.xml +++ libvirt-acl/examples/xml/nwfilter/clean-traffic.xml @@ -14,4 +14,7 @@  <filterref filter='no-other-l2-traffic'/> +  + <filterref filter='qemu-announce-self'/> + </filter> Index: libvirt-acl/examples/xml/nwfilter/no-arp-spoofing.xml =================================================================== --- libvirt-acl.orig/examples/xml/nwfilter/no-arp-spoofing.xml +++ libvirt-acl/examples/xml/nwfilter/no-arp-spoofing.xml @@ -1,27 +1,30 @@ <filter name='no-arp-spoofing' chain='arp'> <uuid>f88f1932-debf-4aa1-9fbe-f10d3aa4bc95</uuid> + <rule action='drop' direction='out' priority='300' > + <mac match='no' srcmacaddr='$MAC'/> + </rule>   - <rule action='drop' direction='out' priority='400' > + <rule action='drop' direction='out' priority='350' > <arp match='no' arpsrcmacaddr='$MAC'/> </rule> <rule action='drop' direction='out' priority='400' > <arp match='no' arpsrcipaddr='$IP' /> </rule>  - <rule action='drop' direction='in' priority='400' > + <rule action='drop' direction='in' priority='450' > <arp match='no' arpdstmacaddr='$MAC'/> <arp opcode='reply'/> </rule> - <rule action='drop' direction='in' priority='400' > + <rule action='drop' direction='in' priority='500' > <arp match='no' arpdstipaddr='$IP' /> </rule>  - <rule action='accept' direction='inout' priority='500' > + <rule action='accept' direction='inout' priority='600' > <arp opcode='request'/> </rule> - <rule action='accept' direction='inout' priority='500' > + <rule action='accept' direction='inout' priority='650' > <arp opcode='reply'/> </rule>  Index: libvirt-acl/examples/xml/nwfilter/no-other-rarp-traffic.xml =================================================================== --- /dev/null +++ libvirt-acl/examples/xml/nwfilter/no-other-rarp-traffic.xml @@ -0,0 +1,4 @@ +<filter name='no-other-rarp-traffic' chain='rarp'> + <rule action='drop' direction='inout' priority='1000'/> +</filter> + Index: libvirt-acl/examples/xml/nwfilter/qemu-announce-self.xml =================================================================== --- /dev/null +++ libvirt-acl/examples/xml/nwfilter/qemu-announce-self.xml @@ -0,0 +1,13 @@ +<filter name='qemu-announce-self' chain='root'> +  +  + <rule action='accept' direction='out'> + <mac protocolid='0x835'/> + </rule> + +  + <filterref filter='qemu-announce-self-rarp'/> + <filterref filter='no-other-rarp-traffic'/> + +</filter>

2 2

[libvirt] [PATCH 0/8]: Snapshot fixes
by Chris Lalancette 27 Apr '10

27 Apr '10

Hello, This series of patches fixes up a number of problems discovered while testing the snapshot code. Descriptions of the fixes are in the individual patches. Please review. Thanks, Chris Lalancette

3 24

[libvirt] nwfilter: add test case for RARP protocol
by Stefan Berger 27 Apr '10

27 Apr '10

This patch adds a test case for the RARP protocol. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfilterxml2xmlin/rarp-test.xml | 33 +++++++++++++++++++++++++++++++++ tests/nwfilterxml2xmlout/rarp-test.xml | 18 ++++++++++++++++++ tests/nwfilterxml2xmltest.c | 1 + 3 files changed, 52 insertions(+) Index: libvirt-acl/tests/nwfilterxml2xmlin/rarp-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/rarp-test.xml @@ -0,0 +1,33 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='rarp' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='12' + protocoltype='34' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='1' hwtype='255' protocoltype='255'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='11' hwtype='256' protocoltype='256'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65535' hwtype='65535' protocoltype='65535' /> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65536' hwtype='65536' protocoltype='65536' /> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/rarp-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/rarp-test.xml @@ -0,0 +1,18 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out' priority='500'> + <rarp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' hwtype='12' protocoltype='34' opcode='Request' arpsrcmacaddr='01:02:03:04:05:06' arpdstmacaddr='0a:0b:0c:0d:0e:0f'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <rarp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' hwtype='255' protocoltype='255' opcode='Request'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <rarp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' hwtype='256' protocoltype='256' opcode='11'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <rarp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' hwtype='65535' protocoltype='65535' opcode='65535'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <rarp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -90,6 +90,7 @@ mymain(int argc, char **argv) DO_TEST("mac-test"); DO_TEST("arp-test"); + DO_TEST("rarp-test"); DO_TEST("ip-test"); DO_TEST("ipv6-test");

2 1

[libvirt] [PATCH] nwfilter: add support for RAPR protocol
by Stefan Berger 27 Apr '10

27 Apr '10

This patch adds support for the RARP protocol. This may be needed due to qemu sending out a RARP packet (at least that's what it seems to want to do even though the protocol id is wrong) when migration finishes and we'd need a rule to let the packets pass. Unfortunately my installation of ebtables does not understand -p RARP and also seems to otherwise depend on strings in /etc/ethertype translated to protocol identifiers. Therefore I need to pass -p 0x8035 for RARP. To generally get rid of the dependency of that file I switch all so far supported protocols to use their protocol identifier in the -p parameter rather than the string. I am also extending the schema. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/schemas/nwfilter.rng | 9 ++ src/conf/nwfilter_conf.c | 29 ++----- src/conf/nwfilter_conf.h | 22 +++++- src/nwfilter/nwfilter_ebiptables_driver.c | 109 ++++++++++++++++++------------ 4 files changed, 106 insertions(+), 63 deletions(-) Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -39,6 +39,15 @@ </optional> <optional> <zeroOrMore> + <element name="rarp"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="arp-attributes"/>  + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> <element name="ip"> <ref name="match-attribute"/> <ref name="common-l2-attributes"/> Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -46,22 +46,6 @@ #include "domain_conf.h" -/* XXX - * The config parser/structs should not be using platform specific - * constants. Win32 lacks these constants, breaking the parser, - * so temporarily define them until this can be re-written to use - * locally defined enums for all constants - */ -#ifndef ETHERTYPE_IP -# define ETHERTYPE_IP 0x0800 -#endif -#ifndef ETHERTYPE_ARP -# define ETHERTYPE_ARP 0x0806 -#endif -#ifndef ETHERTYPE_IPV6 -# define ETHERTYPE_IPV6 0x86dd -#endif - #define VIR_FROM_THIS VIR_FROM_NWFILTER @@ -90,6 +74,7 @@ VIR_ENUM_IMPL(virNWFilterEbtablesTable, VIR_ENUM_IMPL(virNWFilterChainSuffix, VIR_NWFILTER_CHAINSUFFIX_LAST, "root", "arp", + "rarp", "ipv4", "ipv6"); @@ -97,6 +82,7 @@ VIR_ENUM_IMPL(virNWFilterRuleProtocol, V "none", "mac", "arp", + "rarp", "ip", "ipv6", "tcp", @@ -412,11 +398,10 @@ struct _virXMLAttr2Struct static const struct int_map macProtoMap[] = { - INTMAP_ENTRY(ETHERTYPE_ARP , "arp"), - INTMAP_ENTRY(ETHERTYPE_IP , "ipv4"), -#ifdef ETHERTYPE_IPV6 - INTMAP_ENTRY(ETHERTYPE_IPV6, "ipv6"), -#endif + INTMAP_ENTRY(ETHERTYPE_ARP , "arp"), + INTMAP_ENTRY(ETHERTYPE_REVARP, "rarp"), + INTMAP_ENTRY(ETHERTYPE_IP , "ipv4"), + INTMAP_ENTRY(ETHERTYPE_IPV6 , "ipv6"), INTMAP_ENTRY_LAST }; @@ -1084,6 +1069,7 @@ struct _virAttributes { static const virAttributes virAttr[] = { PROTOCOL_ENTRY("arp" , arpAttributes , VIR_NWFILTER_RULE_PROTOCOL_ARP), + PROTOCOL_ENTRY("rarp" , arpAttributes , VIR_NWFILTER_RULE_PROTOCOL_RARP), PROTOCOL_ENTRY("mac" , macAttributes , VIR_NWFILTER_RULE_PROTOCOL_MAC), PROTOCOL_ENTRY("ip" , ipAttributes , VIR_NWFILTER_RULE_PROTOCOL_IP), PROTOCOL_ENTRY("ipv6" , ipv6Attributes , VIR_NWFILTER_RULE_PROTOCOL_IPV6), @@ -1434,6 +1420,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD break; case VIR_NWFILTER_RULE_PROTOCOL_ARP: + case VIR_NWFILTER_RULE_PROTOCOL_RARP: case VIR_NWFILTER_RULE_PROTOCOL_NONE: break; Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -35,6 +35,24 @@ # include "xml.h" # include "network.h" +/* XXX + * The config parser/structs should not be using platform specific + * constants. Win32 lacks these constants, breaking the parser, + * so temporarily define them until this can be re-written to use + * locally defined enums for all constants + */ +# ifndef ETHERTYPE_IP +# define ETHERTYPE_IP 0x0800 +# endif +# ifndef ETHERTYPE_ARP +# define ETHERTYPE_ARP 0x0806 +# endif +# ifndef ETHERTYPE_REVARP +# define ETHERTYPE_REVARP 0x8035 +# endif +# ifndef ETHERTYPE_IPV6 +# define ETHERTYPE_IPV6 0x86dd +# endif /** * Chain suffix size is: @@ -290,6 +308,7 @@ enum virNWFilterRuleProtocolType { VIR_NWFILTER_RULE_PROTOCOL_NONE = 0, VIR_NWFILTER_RULE_PROTOCOL_MAC, VIR_NWFILTER_RULE_PROTOCOL_ARP, + VIR_NWFILTER_RULE_PROTOCOL_RARP, VIR_NWFILTER_RULE_PROTOCOL_IP, VIR_NWFILTER_RULE_PROTOCOL_IPV6, VIR_NWFILTER_RULE_PROTOCOL_TCP, @@ -334,7 +353,7 @@ struct _virNWFilterRuleDef { enum virNWFilterRuleProtocolType prtclType; union { ethHdrFilterDef ethHdrFilter; - arpHdrFilterDef arpHdrFilter; + arpHdrFilterDef arpHdrFilter; /* also used for rarp */ ipHdrFilterDef ipHdrFilter; ipv6HdrFilterDef ipv6HdrFilter; tcpHdrFilterDef tcpHdrFilter; @@ -371,6 +390,7 @@ struct _virNWFilterEntry { enum virNWFilterChainSuffixType { VIR_NWFILTER_CHAINSUFFIX_ROOT = 0, VIR_NWFILTER_CHAINSUFFIX_ARP, + VIR_NWFILTER_CHAINSUFFIX_RARP, VIR_NWFILTER_CHAINSUFFIX_IPv4, VIR_NWFILTER_CHAINSUFFIX_IPv6, Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -32,6 +32,7 @@ #include "logging.h" #include "virterror_internal.h" #include "domain_conf.h" +#include "nwfilter_conf.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" @@ -103,11 +104,28 @@ static int ebiptablesDriverInit(void); static void ebiptablesDriverShutdown(void); -static const char *supported_protocols[] = { - "ipv4", - "ipv6", - "arp", - NULL, +struct ushort_map { + unsigned short attr; + const char *val; +}; + + +enum l3_proto_idx { + L3_PROTO_IPV4_IDX = 0, + L3_PROTO_IPV6_IDX, + L3_PROTO_ARP_IDX, + L3_PROTO_RARP_IDX, + L3_PROTO_LAST_IDX +}; + +#define USHORTMAP_ENTRY_IDX(IDX, ATT, VAL) [IDX] = { .attr = ATT, .val = VAL } + +static const struct ushort_map l3_protocols[] = { + USHORTMAP_ENTRY_IDX(L3_PROTO_IPV4_IDX, ETHERTYPE_IP , "ipv4"), + USHORTMAP_ENTRY_IDX(L3_PROTO_IPV6_IDX, ETHERTYPE_IPV6 , "ipv6"), + USHORTMAP_ENTRY_IDX(L3_PROTO_ARP_IDX , ETHERTYPE_ARP , "arp"), + USHORTMAP_ENTRY_IDX(L3_PROTO_RARP_IDX, ETHERTYPE_REVARP, "rarp"), + USHORTMAP_ENTRY_IDX(L3_PROTO_LAST_IDX, 0 , NULL), }; @@ -1609,6 +1627,7 @@ ebtablesCreateRuleInstance(char chainPre break; case VIR_NWFILTER_RULE_PROTOCOL_ARP: + case VIR_NWFILTER_RULE_PROTOCOL_RARP: virBufferVSprintf(&buf, CMD_DEF_PRE "%s -t %s -%%c %s %%s", @@ -1620,7 +1639,10 @@ ebtablesCreateRuleInstance(char chainPre reverse)) goto err_exit; - virBufferAddLit(&buf, " -p arp"); + virBufferVSprintf(&buf, " -p 0x%x", + (rule->prtclType == VIR_NWFILTER_RULE_PROTOCOL_ARP) + ? l3_protocols[L3_PROTO_ARP_IDX].attr + : l3_protocols[L3_PROTO_RARP_IDX].attr); if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataHWType)) { if (printDataType(vars, @@ -2034,6 +2056,7 @@ ebiptablesCreateRuleInstance(virConnectP case VIR_NWFILTER_RULE_PROTOCOL_IP: case VIR_NWFILTER_RULE_PROTOCOL_MAC: case VIR_NWFILTER_RULE_PROTOCOL_ARP: + case VIR_NWFILTER_RULE_PROTOCOL_RARP: case VIR_NWFILTER_RULE_PROTOCOL_NONE: case VIR_NWFILTER_RULE_PROTOCOL_IPV6: @@ -2425,7 +2448,7 @@ static int ebtablesCreateTmpSubChain(virBufferPtr buf, int incoming, const char *ifname, - const char *protocol, + enum l3_proto_idx protoidx, int stopOnError) { char rootchain[MAX_CHAINNAME_LENGTH], chain[MAX_CHAINNAME_LENGTH]; @@ -2433,13 +2456,13 @@ ebtablesCreateTmpSubChain(virBufferPtr b : CHAINPREFIX_HOST_OUT_TEMP; PRINT_ROOT_CHAIN(rootchain, chainPrefix, ifname); - PRINT_CHAIN(chain, chainPrefix, ifname, protocol); + PRINT_CHAIN(chain, chainPrefix, ifname, l3_protocols[protoidx].val); virBufferVSprintf(buf, CMD_DEF("%s -t %s -N %s") CMD_SEPARATOR CMD_EXEC "%s" - CMD_DEF("%s -t %s -A %s -p %s -j %s") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s -p 0x%x -j %s") CMD_SEPARATOR CMD_EXEC "%s", @@ -2448,7 +2471,7 @@ ebtablesCreateTmpSubChain(virBufferPtr b CMD_STOPONERR(stopOnError), ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, - rootchain, protocol, chain, + rootchain, l3_protocols[protoidx].attr, chain, CMD_STOPONERR(stopOnError)); @@ -2460,11 +2483,12 @@ static int _ebtablesRemoveSubChain(virBufferPtr buf, int incoming, const char *ifname, - const char *protocol, + enum l3_proto_idx protoidx, int isTempChain) { char rootchain[MAX_CHAINNAME_LENGTH], chain[MAX_CHAINNAME_LENGTH]; char chainPrefix; + if (isTempChain) { chainPrefix =(incoming) ? CHAINPREFIX_HOST_IN_TEMP : CHAINPREFIX_HOST_OUT_TEMP; @@ -2474,14 +2498,14 @@ _ebtablesRemoveSubChain(virBufferPtr buf } PRINT_ROOT_CHAIN(rootchain, chainPrefix, ifname); - PRINT_CHAIN(chain, chainPrefix, ifname, protocol); + PRINT_CHAIN(chain, chainPrefix, ifname, l3_protocols[protoidx].val); virBufferVSprintf(buf, - "%s -t %s -D %s -p %s -j %s" CMD_SEPARATOR + "%s -t %s -D %s -p 0x%x -j %s" CMD_SEPARATOR "%s -t %s -F %s" CMD_SEPARATOR "%s -t %s -X %s" CMD_SEPARATOR, ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, - rootchain, protocol, chain, + rootchain, l3_protocols[protoidx].attr, chain, ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain, @@ -2495,10 +2519,10 @@ static int ebtablesRemoveSubChain(virBufferPtr buf, int incoming, const char *ifname, - const char *protocol) + enum l3_proto_idx protoidx) { return _ebtablesRemoveSubChain(buf, - incoming, ifname, protocol, 0); + incoming, ifname, protoidx, 0); } @@ -2506,10 +2530,11 @@ static int ebtablesRemoveSubChains(virBufferPtr buf, const char *ifname) { - int i; - for (i = 0; supported_protocols[i]; i++) { - ebtablesRemoveSubChain(buf, 1, ifname, supported_protocols[i]); - ebtablesRemoveSubChain(buf, 0, ifname, supported_protocols[i]); + enum l3_proto_idx i; + + for (i = 0; i < L3_PROTO_LAST_IDX; i++) { + ebtablesRemoveSubChain(buf, 1, ifname, i); + ebtablesRemoveSubChain(buf, 0, ifname, i); } return 0; @@ -2520,10 +2545,10 @@ static int ebtablesRemoveTmpSubChain(virBufferPtr buf, int incoming, const char *ifname, - const char *protocol) + enum l3_proto_idx protoidx) { return _ebtablesRemoveSubChain(buf, - incoming, ifname, protocol, 1); + incoming, ifname, protoidx, 1); } @@ -2531,12 +2556,11 @@ static int ebtablesRemoveTmpSubChains(virBufferPtr buf, const char *ifname) { - int i; - for (i = 0; supported_protocols[i]; i++) { - ebtablesRemoveTmpSubChain(buf, 1, ifname, - supported_protocols[i]); - ebtablesRemoveTmpSubChain(buf, 0, ifname, - supported_protocols[i]); + enum l3_proto_idx i; + + for (i = 0; i < L3_PROTO_LAST_IDX; i++) { + ebtablesRemoveTmpSubChain(buf, 1, ifname, i); + ebtablesRemoveTmpSubChain(buf, 0, ifname, i); } return 0; @@ -2574,12 +2598,11 @@ static int ebtablesRenameTmpSubChains(virBufferPtr buf, const char *ifname) { - int i; - for (i = 0; supported_protocols[i]; i++) { - ebtablesRenameTmpSubChain (buf, 1, ifname, - supported_protocols[i]); - ebtablesRenameTmpSubChain (buf, 0, ifname, - supported_protocols[i]); + enum l3_proto_idx i; + + for (i = 0; i < L3_PROTO_LAST_IDX; i++) { + ebtablesRenameTmpSubChain (buf, 1, ifname, l3_protocols[i].val); + ebtablesRenameTmpSubChain (buf, 0, ifname, l3_protocols[i].val); } return 0; @@ -2909,20 +2932,24 @@ ebiptablesApplyNewRules(virConnectPtr co ebtablesCreateTmpRootChain(&buf, 0, ifname, 1); if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4)) - ebtablesCreateTmpSubChain(&buf, 1, ifname, "ipv4", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_IPV4_IDX, 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4)) - ebtablesCreateTmpSubChain(&buf, 0, ifname, "ipv4", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_IPV4_IDX, 1); if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv6)) - ebtablesCreateTmpSubChain(&buf, 1, ifname, "ipv6", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_IPV6_IDX, 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv6)) - ebtablesCreateTmpSubChain(&buf, 0, ifname, "ipv6", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_IPV6_IDX, 1); - // keep arp as last + // keep arp,rarp as last if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP)) - ebtablesCreateTmpSubChain(&buf, 1, ifname, "arp", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_ARP_IDX, 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP)) - ebtablesCreateTmpSubChain(&buf, 0, ifname, "arp", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_ARP_IDX, 1); + if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_RARP)) + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_RARP_IDX, 1); + if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_RARP)) + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_RARP_IDX, 1); if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpebchains;

2 1

[libvirt] [Klaus@Ethgen.de: [Pkg-libvirt-maintainers] Bug#579208: USB Class/Number/... is base 16, not base 10 (Failed to convert 'ff' to unsigned int)]
by Guido Günther 27 Apr '10

27 Apr '10

Hi, this patch from Klau Ethgen looks right to me. O.k. to apply? I'll remove the comment with this patch then. Cheers, -- Guido ----- Forwarded message from Klaus Ethgen <Klaus(a)Ethgen.de> ----- in node_device_udev.c is the base 10 used for conversion of USB values. But they are hex values so that the conversion fail in the most of time. Funny is that the upstream did know that but didn't fix it (comment in line 551). The patch will fix that. But it do not remove the comment. --- a/src/node_device/node_device_udev.c +++ b/src/node_device/node_device_udev.c @@ -559,28 +559,28 @@ static int udevProcessUSBInterface(struc if (udevGetUintSysfsAttr(device, "bInterfaceNumber", &data->usb_if.number, - 10) == PROPERTY_ERROR) { + 16) == PROPERTY_ERROR) { goto out; } if (udevGetUintSysfsAttr(device, "bInterfaceClass", &data->usb_if._class, - 10) == PROPERTY_ERROR) { + 16) == PROPERTY_ERROR) { goto out; } if (udevGetUintSysfsAttr(device, "bInterfaceSubClass", &data->usb_if.subclass, - 10) == PROPERTY_ERROR) { + 16) == PROPERTY_ERROR) { goto out; } if (udevGetUintSysfsAttr(device, "bInterfaceProtocol", &data->usb_if.protocol, - 10) == PROPERTY_ERROR) { + 16) == PROPERTY_ERROR) { goto out; }

4 4

[libvirt] [PATCH] maint: update to latest gnulib
by Eric Blake 27 Apr '10

27 Apr '10

* cfg.mk (gnulib_dir): Override default in maint.mk. * .gnulib: Update to latest. Reported by Jim Meyering. --- Update to the latest gnulib for some portability fixes. Thankfully, we already pass all of the new syntax checks, but Jim did note (on the gnulib list) that we failed to define $(gnulib_dir) correctly. .gnulib | 2 +- cfg.mk | 3 +++ 2 files changed, 4 insertions(+), 1 deletions(-) diff --git a/.gnulib b/.gnulib index 7c1b995..411e141 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit 7c1b995a7041ea366acafeb8632e1080f349f03f +Subproject commit 411e141164861435385bb9bbb10012da28a077c0 diff --git a/cfg.mk b/cfg.mk index 105b625..9e8909b 100644 --- a/cfg.mk +++ b/cfg.mk @@ -24,6 +24,9 @@ gnu_rel_host = $(gnu_ftp_host-$(RELEASE_TYPE)) url_dir_list = \ ftp://$(gnu_rel_host)/gnu/coreutils +# We use .gnulib, not gnulib. +gnulib_dir = $(srcdir)/.gnulib + # Tests not to run as part of "make distcheck". local-checks-to-skip = \ changelog-check \ -- 1.6.6.1

2 1

[libvirt] [PATCH] Cygwin's GCC doesn't like this .sa_handler initialization for some reason
by Matthias Bolte 27 Apr '10

27 Apr '10

--- examples/domain-events/events-c/event-test.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/examples/domain-events/events-c/event-test.c b/examples/domain-events/events-c/event-test.c index 53a3195..74eabba 100644 --- a/examples/domain-events/events-c/event-test.c +++ b/examples/domain-events/events-c/event-test.c @@ -380,10 +380,11 @@ int main(int argc, char **argv) int callback5ret = -1; int callback6ret = -1; int callback7ret = -1; + struct sigaction action_stop; - struct sigaction action_stop = { - .sa_handler = stop - }; + memset(&action_stop, 0, sizeof action_stop); + + action_stop.sa_handler = stop; if(argc > 1 && STREQ(argv[1],"--help")) { usage(argv[0]); -- 1.6.3.3

5 10

[libvirt] [PATCH] cleanup the download section
by Daniel Veillard 27 Apr '10

27 Apr '10

Just removing reverences to the deprecated CVS server and the old git on et.redhat.com Daniel diff --git a/docs/downloads.html.in b/docs/downloads.html.in index 493923c..a0cb6fc 100644 --- a/docs/downloads.html.in +++ b/docs/downloads.html.in @@ -43,19 +43,6 @@ <a href="http://libvirt.org/git/?p=libvirt.git;a=summary">http://libvirt.org/git/?p=libvirt.git;a=summary</a> </pre> - <h2>CVS repository access (Deprecated) </h2> - <p> - The master source repository used to be under <a href="http://ximbiot.com/cvs/cvshome/docs/">CVS</a> - with anonymous access at: - </p> - <pre> - - # cvs -d :pserver:anoncvs@libvirt.org:2401/data/cvs co libvirt - </pre> - <p> The server is maintainened temporarilly for existing uses, but all - changes are only commited to git now and we expect to deprecate the CVS - server during summer 2009. </p> - <h2>Building from a source code checkout</h2> <p> The libvirt build process uses GNU autotools, so after obtaining a checkout it is necessary to generate the configure script and Makefile.in @@ -68,27 +55,5 @@ make make install </pre> - - <h2>GIT repository mirror</h2> - - <p> - Jim Mereying was maintaining a CVS to git mirror on - <a href="http://git.et.redhat.com/?p=libvirt.git">git.et.redhat.com</a>. - Existing users should migrate to the new libvirt.org git server, as the - old one is now deprecated. For the sake of old links including now- - rewritten SHA1s, we'll leave the old repository on-line for some time. - It is available as: - </p> - <pre> - - git clone git://git.et.redhat.com/libvirt.git - </pre> - <p> - It can also be browsed at - </p> - <pre> - <a href="http://git.et.redhat.com/?p=libvirt.git;a=summary">http://git.et.redhat.com/?p=libvirt.git;a=summary</a> - </pre> - </body> </html> -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

2 2

[libvirt] [PATCH v2] nwfilter: add support for RAPR protocol
by Stefan Berger 27 Apr '10

27 Apr '10

This patch adds support for the RARP protocol. This may be needed due to qemu sending out a RARP packet (at least that's what it seems to want to do even though the protocol id is wrong) when migration finishes and we'd need a rule to let the packets pass. Unfortunately my installation of ebtables does not understand -p RARP and also seems to otherwise depend on strings in /etc/ethertype translated to protocol identifiers. Therefore I need to pass -p 0x8035 for RARP. To generally get rid of the dependency of that file I switch all so far supported protocols to use their protocol identifier in the -p parameter rather than the string. I am also extending the schema and added a test case. changes from v1 to v2: - added test case into patch Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/schemas/nwfilter.rng | 9 ++ src/conf/nwfilter_conf.c | 29 ++----- src/conf/nwfilter_conf.h | 22 +++++- src/nwfilter/nwfilter_ebiptables_driver.c | 109 ++++++++++++++++++------------ tests/nwfilterxml2xmlin/rarp-test.xml | 33 +++++++++ tests/nwfilterxml2xmlout/rarp-test.xml | 18 ++++ tests/nwfilterxml2xmltest.c | 1 7 files changed, 158 insertions(+), 63 deletions(-) Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -39,6 +39,15 @@ </optional> <optional> <zeroOrMore> + <element name="rarp"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="arp-attributes"/>  + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> <element name="ip"> <ref name="match-attribute"/> <ref name="common-l2-attributes"/> Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -46,22 +46,6 @@ #include "domain_conf.h" -/* XXX - * The config parser/structs should not be using platform specific - * constants. Win32 lacks these constants, breaking the parser, - * so temporarily define them until this can be re-written to use - * locally defined enums for all constants - */ -#ifndef ETHERTYPE_IP -# define ETHERTYPE_IP 0x0800 -#endif -#ifndef ETHERTYPE_ARP -# define ETHERTYPE_ARP 0x0806 -#endif -#ifndef ETHERTYPE_IPV6 -# define ETHERTYPE_IPV6 0x86dd -#endif - #define VIR_FROM_THIS VIR_FROM_NWFILTER @@ -90,6 +74,7 @@ VIR_ENUM_IMPL(virNWFilterEbtablesTable, VIR_ENUM_IMPL(virNWFilterChainSuffix, VIR_NWFILTER_CHAINSUFFIX_LAST, "root", "arp", + "rarp", "ipv4", "ipv6"); @@ -97,6 +82,7 @@ VIR_ENUM_IMPL(virNWFilterRuleProtocol, V "none", "mac", "arp", + "rarp", "ip", "ipv6", "tcp", @@ -412,11 +398,10 @@ struct _virXMLAttr2Struct static const struct int_map macProtoMap[] = { - INTMAP_ENTRY(ETHERTYPE_ARP , "arp"), - INTMAP_ENTRY(ETHERTYPE_IP , "ipv4"), -#ifdef ETHERTYPE_IPV6 - INTMAP_ENTRY(ETHERTYPE_IPV6, "ipv6"), -#endif + INTMAP_ENTRY(ETHERTYPE_ARP , "arp"), + INTMAP_ENTRY(ETHERTYPE_REVARP, "rarp"), + INTMAP_ENTRY(ETHERTYPE_IP , "ipv4"), + INTMAP_ENTRY(ETHERTYPE_IPV6 , "ipv6"), INTMAP_ENTRY_LAST }; @@ -1096,6 +1081,7 @@ struct _virAttributes { static const virAttributes virAttr[] = { PROTOCOL_ENTRY("arp" , arpAttributes , VIR_NWFILTER_RULE_PROTOCOL_ARP), + PROTOCOL_ENTRY("rarp" , arpAttributes , VIR_NWFILTER_RULE_PROTOCOL_RARP), PROTOCOL_ENTRY("mac" , macAttributes , VIR_NWFILTER_RULE_PROTOCOL_MAC), PROTOCOL_ENTRY("ip" , ipAttributes , VIR_NWFILTER_RULE_PROTOCOL_IP), PROTOCOL_ENTRY("ipv6" , ipv6Attributes , VIR_NWFILTER_RULE_PROTOCOL_IPV6), @@ -1450,6 +1436,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD break; case VIR_NWFILTER_RULE_PROTOCOL_ARP: + case VIR_NWFILTER_RULE_PROTOCOL_RARP: case VIR_NWFILTER_RULE_PROTOCOL_NONE: break; Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -35,6 +35,24 @@ # include "xml.h" # include "network.h" +/* XXX + * The config parser/structs should not be using platform specific + * constants. Win32 lacks these constants, breaking the parser, + * so temporarily define them until this can be re-written to use + * locally defined enums for all constants + */ +# ifndef ETHERTYPE_IP +# define ETHERTYPE_IP 0x0800 +# endif +# ifndef ETHERTYPE_ARP +# define ETHERTYPE_ARP 0x0806 +# endif +# ifndef ETHERTYPE_REVARP +# define ETHERTYPE_REVARP 0x8035 +# endif +# ifndef ETHERTYPE_IPV6 +# define ETHERTYPE_IPV6 0x86dd +# endif /** * Chain suffix size is: @@ -292,6 +310,7 @@ enum virNWFilterRuleProtocolType { VIR_NWFILTER_RULE_PROTOCOL_NONE = 0, VIR_NWFILTER_RULE_PROTOCOL_MAC, VIR_NWFILTER_RULE_PROTOCOL_ARP, + VIR_NWFILTER_RULE_PROTOCOL_RARP, VIR_NWFILTER_RULE_PROTOCOL_IP, VIR_NWFILTER_RULE_PROTOCOL_IPV6, VIR_NWFILTER_RULE_PROTOCOL_TCP, @@ -336,7 +355,7 @@ struct _virNWFilterRuleDef { enum virNWFilterRuleProtocolType prtclType; union { ethHdrFilterDef ethHdrFilter; - arpHdrFilterDef arpHdrFilter; + arpHdrFilterDef arpHdrFilter; /* also used for rarp */ ipHdrFilterDef ipHdrFilter; ipv6HdrFilterDef ipv6HdrFilter; tcpHdrFilterDef tcpHdrFilter; @@ -373,6 +392,7 @@ struct _virNWFilterEntry { enum virNWFilterChainSuffixType { VIR_NWFILTER_CHAINSUFFIX_ROOT = 0, VIR_NWFILTER_CHAINSUFFIX_ARP, + VIR_NWFILTER_CHAINSUFFIX_RARP, VIR_NWFILTER_CHAINSUFFIX_IPv4, VIR_NWFILTER_CHAINSUFFIX_IPv6, Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -32,6 +32,7 @@ #include "logging.h" #include "virterror_internal.h" #include "domain_conf.h" +#include "nwfilter_conf.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" @@ -103,11 +104,28 @@ static int ebiptablesDriverInit(void); static void ebiptablesDriverShutdown(void); -static const char *supported_protocols[] = { - "ipv4", - "ipv6", - "arp", - NULL, +struct ushort_map { + unsigned short attr; + const char *val; +}; + + +enum l3_proto_idx { + L3_PROTO_IPV4_IDX = 0, + L3_PROTO_IPV6_IDX, + L3_PROTO_ARP_IDX, + L3_PROTO_RARP_IDX, + L3_PROTO_LAST_IDX +}; + +#define USHORTMAP_ENTRY_IDX(IDX, ATT, VAL) [IDX] = { .attr = ATT, .val = VAL } + +static const struct ushort_map l3_protocols[] = { + USHORTMAP_ENTRY_IDX(L3_PROTO_IPV4_IDX, ETHERTYPE_IP , "ipv4"), + USHORTMAP_ENTRY_IDX(L3_PROTO_IPV6_IDX, ETHERTYPE_IPV6 , "ipv6"), + USHORTMAP_ENTRY_IDX(L3_PROTO_ARP_IDX , ETHERTYPE_ARP , "arp"), + USHORTMAP_ENTRY_IDX(L3_PROTO_RARP_IDX, ETHERTYPE_REVARP, "rarp"), + USHORTMAP_ENTRY_IDX(L3_PROTO_LAST_IDX, 0 , NULL), }; @@ -1611,6 +1629,7 @@ ebtablesCreateRuleInstance(char chainPre break; case VIR_NWFILTER_RULE_PROTOCOL_ARP: + case VIR_NWFILTER_RULE_PROTOCOL_RARP: virBufferVSprintf(&buf, CMD_DEF_PRE "%s -t %s -%%c %s %%s", @@ -1622,7 +1641,10 @@ ebtablesCreateRuleInstance(char chainPre reverse)) goto err_exit; - virBufferAddLit(&buf, " -p arp"); + virBufferVSprintf(&buf, " -p 0x%x", + (rule->prtclType == VIR_NWFILTER_RULE_PROTOCOL_ARP) + ? l3_protocols[L3_PROTO_ARP_IDX].attr + : l3_protocols[L3_PROTO_RARP_IDX].attr); if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataHWType)) { if (printDataType(vars, @@ -2036,6 +2058,7 @@ ebiptablesCreateRuleInstance(virConnectP case VIR_NWFILTER_RULE_PROTOCOL_IP: case VIR_NWFILTER_RULE_PROTOCOL_MAC: case VIR_NWFILTER_RULE_PROTOCOL_ARP: + case VIR_NWFILTER_RULE_PROTOCOL_RARP: case VIR_NWFILTER_RULE_PROTOCOL_NONE: case VIR_NWFILTER_RULE_PROTOCOL_IPV6: @@ -2427,7 +2450,7 @@ static int ebtablesCreateTmpSubChain(virBufferPtr buf, int incoming, const char *ifname, - const char *protocol, + enum l3_proto_idx protoidx, int stopOnError) { char rootchain[MAX_CHAINNAME_LENGTH], chain[MAX_CHAINNAME_LENGTH]; @@ -2435,13 +2458,13 @@ ebtablesCreateTmpSubChain(virBufferPtr b : CHAINPREFIX_HOST_OUT_TEMP; PRINT_ROOT_CHAIN(rootchain, chainPrefix, ifname); - PRINT_CHAIN(chain, chainPrefix, ifname, protocol); + PRINT_CHAIN(chain, chainPrefix, ifname, l3_protocols[protoidx].val); virBufferVSprintf(buf, CMD_DEF("%s -t %s -N %s") CMD_SEPARATOR CMD_EXEC "%s" - CMD_DEF("%s -t %s -A %s -p %s -j %s") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s -p 0x%x -j %s") CMD_SEPARATOR CMD_EXEC "%s", @@ -2450,7 +2473,7 @@ ebtablesCreateTmpSubChain(virBufferPtr b CMD_STOPONERR(stopOnError), ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, - rootchain, protocol, chain, + rootchain, l3_protocols[protoidx].attr, chain, CMD_STOPONERR(stopOnError)); @@ -2462,11 +2485,12 @@ static int _ebtablesRemoveSubChain(virBufferPtr buf, int incoming, const char *ifname, - const char *protocol, + enum l3_proto_idx protoidx, int isTempChain) { char rootchain[MAX_CHAINNAME_LENGTH], chain[MAX_CHAINNAME_LENGTH]; char chainPrefix; + if (isTempChain) { chainPrefix =(incoming) ? CHAINPREFIX_HOST_IN_TEMP : CHAINPREFIX_HOST_OUT_TEMP; @@ -2476,14 +2500,14 @@ _ebtablesRemoveSubChain(virBufferPtr buf } PRINT_ROOT_CHAIN(rootchain, chainPrefix, ifname); - PRINT_CHAIN(chain, chainPrefix, ifname, protocol); + PRINT_CHAIN(chain, chainPrefix, ifname, l3_protocols[protoidx].val); virBufferVSprintf(buf, - "%s -t %s -D %s -p %s -j %s" CMD_SEPARATOR + "%s -t %s -D %s -p 0x%x -j %s" CMD_SEPARATOR "%s -t %s -F %s" CMD_SEPARATOR "%s -t %s -X %s" CMD_SEPARATOR, ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, - rootchain, protocol, chain, + rootchain, l3_protocols[protoidx].attr, chain, ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain, @@ -2497,10 +2521,10 @@ static int ebtablesRemoveSubChain(virBufferPtr buf, int incoming, const char *ifname, - const char *protocol) + enum l3_proto_idx protoidx) { return _ebtablesRemoveSubChain(buf, - incoming, ifname, protocol, 0); + incoming, ifname, protoidx, 0); } @@ -2508,10 +2532,11 @@ static int ebtablesRemoveSubChains(virBufferPtr buf, const char *ifname) { - int i; - for (i = 0; supported_protocols[i]; i++) { - ebtablesRemoveSubChain(buf, 1, ifname, supported_protocols[i]); - ebtablesRemoveSubChain(buf, 0, ifname, supported_protocols[i]); + enum l3_proto_idx i; + + for (i = 0; i < L3_PROTO_LAST_IDX; i++) { + ebtablesRemoveSubChain(buf, 1, ifname, i); + ebtablesRemoveSubChain(buf, 0, ifname, i); } return 0; @@ -2522,10 +2547,10 @@ static int ebtablesRemoveTmpSubChain(virBufferPtr buf, int incoming, const char *ifname, - const char *protocol) + enum l3_proto_idx protoidx) { return _ebtablesRemoveSubChain(buf, - incoming, ifname, protocol, 1); + incoming, ifname, protoidx, 1); } @@ -2533,12 +2558,11 @@ static int ebtablesRemoveTmpSubChains(virBufferPtr buf, const char *ifname) { - int i; - for (i = 0; supported_protocols[i]; i++) { - ebtablesRemoveTmpSubChain(buf, 1, ifname, - supported_protocols[i]); - ebtablesRemoveTmpSubChain(buf, 0, ifname, - supported_protocols[i]); + enum l3_proto_idx i; + + for (i = 0; i < L3_PROTO_LAST_IDX; i++) { + ebtablesRemoveTmpSubChain(buf, 1, ifname, i); + ebtablesRemoveTmpSubChain(buf, 0, ifname, i); } return 0; @@ -2576,12 +2600,11 @@ static int ebtablesRenameTmpSubChains(virBufferPtr buf, const char *ifname) { - int i; - for (i = 0; supported_protocols[i]; i++) { - ebtablesRenameTmpSubChain (buf, 1, ifname, - supported_protocols[i]); - ebtablesRenameTmpSubChain (buf, 0, ifname, - supported_protocols[i]); + enum l3_proto_idx i; + + for (i = 0; i < L3_PROTO_LAST_IDX; i++) { + ebtablesRenameTmpSubChain (buf, 1, ifname, l3_protocols[i].val); + ebtablesRenameTmpSubChain (buf, 0, ifname, l3_protocols[i].val); } return 0; @@ -2911,20 +2934,24 @@ ebiptablesApplyNewRules(virConnectPtr co ebtablesCreateTmpRootChain(&buf, 0, ifname, 1); if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4)) - ebtablesCreateTmpSubChain(&buf, 1, ifname, "ipv4", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_IPV4_IDX, 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4)) - ebtablesCreateTmpSubChain(&buf, 0, ifname, "ipv4", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_IPV4_IDX, 1); if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv6)) - ebtablesCreateTmpSubChain(&buf, 1, ifname, "ipv6", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_IPV6_IDX, 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv6)) - ebtablesCreateTmpSubChain(&buf, 0, ifname, "ipv6", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_IPV6_IDX, 1); - // keep arp as last + // keep arp,rarp as last if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP)) - ebtablesCreateTmpSubChain(&buf, 1, ifname, "arp", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_ARP_IDX, 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP)) - ebtablesCreateTmpSubChain(&buf, 0, ifname, "arp", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_ARP_IDX, 1); + if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_RARP)) + ebtablesCreateTmpSubChain(&buf, 1, ifname, L3_PROTO_RARP_IDX, 1); + if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_RARP)) + ebtablesCreateTmpSubChain(&buf, 0, ifname, L3_PROTO_RARP_IDX, 1); if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpebchains; Index: libvirt-acl/tests/nwfilterxml2xmlin/rarp-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/rarp-test.xml @@ -0,0 +1,33 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='rarp' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='12' + protocoltype='34' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='1' hwtype='255' protocoltype='255'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='11' hwtype='256' protocoltype='256'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65535' hwtype='65535' protocoltype='65535' /> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65536' hwtype='65536' protocoltype='65536' /> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/rarp-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/rarp-test.xml @@ -0,0 +1,18 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out' priority='500'> + <rarp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' hwtype='12' protocoltype='34' opcode='Request' arpsrcmacaddr='01:02:03:04:05:06' arpdstmacaddr='0a:0b:0c:0d:0e:0f'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <rarp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' hwtype='255' protocoltype='255' opcode='Request'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <rarp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' hwtype='256' protocoltype='256' opcode='11'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <rarp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' hwtype='65535' protocoltype='65535' opcode='65535'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <rarp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -90,6 +90,7 @@ mymain(int argc, char **argv) DO_TEST("mac-test"); DO_TEST("arp-test"); + DO_TEST("rarp-test"); DO_TEST("ip-test"); DO_TEST("ipv6-test");

2 2

[libvirt] [PATCH] Fix build with DEBUG_RAW_IO=1
by jdenemar＠redhat.com 27 Apr '10

27 Apr '10

From: Jiri Denemark <jdenemar(a)redhat.com> --- src/qemu/qemu_monitor.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) At the top of qemu_monitor.c the following lines can be seen: #define DEBUG_IO 0 #define DEBUG_RAW_IO 0 diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index c4f2725..38ee058 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -166,7 +166,7 @@ char *qemuMonitorEscapeShell(const char *in) } -#if QEMU_DEBUG_RAW_IO +#if DEBUG_RAW_IO # include <c-ctype.h> static char * qemuMonitorEscapeNonPrintable(const char *text) { -- 1.7.0.4

3 2

[libvirt] [PATCH 0/1] Fix encryption XML indentation
by David Allan 27 Apr '10

27 Apr '10

The following patch fixes the storage XML indentation problem caused by my earlier patch to fix domain XML indentation problems. I liked the style of Laine's suggestion of passing in the number of spaces to indent, so I adopted that approach. I also added a regression test for the domain XML. Dave David Allan (1): Fix indentation for storage conf XML src/conf/domain_conf.c | 2 +- src/conf/storage_conf.c | 2 +- src/conf/storage_encryption_conf.c | 16 +++++++---- src/conf/storage_encryption_conf.h | 3 +- .../qemuxml2argv-encrypted-disk.args | 1 + .../qemuxml2argv-encrypted-disk.xml | 27 ++++++++++++++++++++ tests/qemuxml2xmltest.c | 2 + 7 files changed, 44 insertions(+), 9 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-encrypted-disk.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-encrypted-disk.xml

2 3

[libvirt] [PATCH] desactivate lxc and qemu support on non-linux systems
by Daniel Veillard 27 Apr '10

27 Apr '10

On Mon, Apr 26, 2010 at 12:09:19PM +0200, Daniel Veillard wrote: > On Mon, Apr 26, 2010 at 01:40:11AM -0600, gary mazzaferro wrote: > > Hi, > > > > I'm revisiting my libVirt install for opensolaris. I downloaded libvirt > > 0.8.0.. > > > > This is a bit embarassing, but I forgot how to build libVirt on opensolaris. > > (It's been a while) I'm currently stuck with the configure script failing > > to find linux kernel headers. > > Error: > > "configure: error: You must install kernel-headers in order to compile > > libvirt" > > > > Can anyone post the instructions to build under opensolaris? > > Well you need to desactivate qemu and lxc builds to avoid this error: > > ./configure --without-lxc --without-qemu ... > > that should be done automatically on non-linux systems, it's a bug, Very small patch to this intent. The requirement is imposed by the following test later on in configure.ac: ----------------------------------------------- dnl dnl check for kernel headers required by src/bridge.c dnl if test "$with_qemu" = "yes" || test "$with_lxc" = "yes" ; then AC_CHECK_HEADERS([linux/param.h linux/sockios.h linux/if_bridge.h linux/if_tun.h],, AC_MSG_ERROR([You must install kernel-headers in order to compile libvirt])) fi ----------------------------------------------- note that with_qemu is set to yes by default Daniel diff --git a/configure.ac b/configure.ac index 99bc906..d360b4e 100644 --- a/configure.ac +++ b/configure.ac @@ -205,6 +205,18 @@ if test "$prefix" = "/usr" && test "$sysconfdir" = '${prefix}/etc' ; then sysconfdir='/etc' fi +dnl lxc and qemu drivers require linux headers +if test `uname -s` != "Linux" +then + if test "x$with_lxc" != "xyes" + then + with_lxc=no + fi + if test "x$with_qemu" != "xyes" + then + with_qemu=no + fi +fi dnl Allow to build without Xen, QEMU/KVM, test or remote driver AC_ARG_WITH([xen], -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

3 3

[libvirt] [PATCH] cygwin: Handle differences in the XDR implementation
by Matthias Bolte 27 Apr '10

27 Apr '10

Cygwin's XDR implementation defines xdr_u_int64_t instead of xdr_uint64_t and lacks IXDR_PUT_INT32/IXDR_GET_INT32. Alter the IXDR_GET_LONG regex in rpcgen_fix.pl so it doesn't destroy the #define IXDR_GET_INT32 IXDR_GET_LONG in remote_protocol.x. Also fix the remote_protocol.h regex in rpcgen_fix.pl. --- configure.ac | 3 +++ src/remote/remote_protocol.c | 11 ++++++++++- src/remote/remote_protocol.h | 9 +++++++++ src/remote/remote_protocol.x | 13 +++++++++++++ src/remote/rpcgen_fix.pl | 4 ++-- 5 files changed, 37 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index d75fac8..955a9e9 100644 --- a/configure.ac +++ b/configure.ac @@ -124,6 +124,9 @@ AC_CHECK_LIB([portablexdr],[xdrmem_create],[],[ [AC_MSG_ERROR([Cannot find a XDR library])]) ]) +dnl check for cygwin's variation in xdr function names +AC_CHECK_FUNCS([xdr_u_int64_t],[],[],[#include <rpc/xdr.h>]) + AC_CHECK_LIB([intl],[gettext],[]) dnl Do we have rpcgen? diff --git a/src/remote/remote_protocol.c b/src/remote/remote_protocol.c index c9816dd..eb0f9c3 100644 --- a/src/remote/remote_protocol.c +++ b/src/remote/remote_protocol.c @@ -4,9 +4,18 @@ * It was generated using rpcgen. */ -#include "./remote/remote_protocol.h" +#include "remote_protocol.h" #include "internal.h" #include <arpa/inet.h> +#ifdef HAVE_XDR_U_INT64_T +# define xdr_uint64_t xdr_u_int64_t +#endif +#ifndef IXDR_PUT_INT32 +# define IXDR_PUT_INT32 IXDR_PUT_LONG +#endif +#ifndef IXDR_GET_INT32 +# define IXDR_GET_INT32 IXDR_GET_LONG +#endif bool_t xdr_remote_nonnull_string (XDR *xdrs, remote_nonnull_string *objp) diff --git a/src/remote/remote_protocol.h b/src/remote/remote_protocol.h index 57ed123..92fd6df 100644 --- a/src/remote/remote_protocol.h +++ b/src/remote/remote_protocol.h @@ -15,6 +15,15 @@ extern "C" { #include "internal.h" #include <arpa/inet.h> +#ifdef HAVE_XDR_U_INT64_T +# define xdr_uint64_t xdr_u_int64_t +#endif +#ifndef IXDR_PUT_INT32 +# define IXDR_PUT_INT32 IXDR_PUT_LONG +#endif +#ifndef IXDR_GET_INT32 +# define IXDR_GET_INT32 IXDR_GET_LONG +#endif #define REMOTE_MESSAGE_MAX 262144 #define REMOTE_MESSAGE_HEADER_MAX 24 #define REMOTE_MESSAGE_PAYLOAD_MAX 262120 diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 9aa3a7e..60f93b2 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -39,6 +39,19 @@ %#include "internal.h" %#include <arpa/inet.h> +/* cygwin's xdr implementation defines xdr_u_int64_t instead of xdr_uint64_t + * and lacks IXDR_PUT_INT32 and IXDR_GET_INT32 + */ +%#ifdef HAVE_XDR_U_INT64_T +%# define xdr_uint64_t xdr_u_int64_t +%#endif +%#ifndef IXDR_PUT_INT32 +%# define IXDR_PUT_INT32 IXDR_PUT_LONG +%#endif +%#ifndef IXDR_GET_INT32 +%# define IXDR_GET_INT32 IXDR_GET_LONG +%#endif + /*----- Data types. -----*/ /* Maximum total message size (serialised). */ diff --git a/src/remote/rpcgen_fix.pl b/src/remote/rpcgen_fix.pl index 4943765..3cf5479 100644 --- a/src/remote/rpcgen_fix.pl +++ b/src/remote/rpcgen_fix.pl @@ -31,8 +31,8 @@ while (<>) { s/quad_t/int64_t/g; s/xdr_u_quad_t/xdr_uint64_t/g; s/xdr_quad_t/xdr_int64_t/g; - s/IXDR_GET_LONG/IXDR_GET_INT32/g; - s,#include "\./remote_protocol\.h",#include "remote_protocol.h",; + s/(?<!IXDR_GET_INT32 )IXDR_GET_LONG/IXDR_GET_INT32/g; + s,#include "\./remote/remote_protocol\.h",#include "remote_protocol.h",; if (m/^}/) { $in_function = 0; -- 1.6.3.3

2 2

[libvirt] KVM live migration results in black screen
by Shi Jin 27 Apr '10

27 Apr '10

Hi there, I seem to be able to use either libvirt or virt-manger to live migrate a KVM VM between hosts mounting the same shared storage via NFS. However, when I open the migrated VM on the new host, the VM screen is black and keyboard/mouse has no response. The network is done as well. I wonder if anyone has any experience with this problem. I am using RHEL/CentOS-5. I've tried many times with either Windows or Linux VM. Thank you very much. -- Shi Jin, PhD

1 0

[libvirt] [PATCH] linux/if.h header is not available on non-Linux platforms
by Matthias Bolte 26 Apr '10

26 Apr '10

--- src/util/interface.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++-- 1 files changed, 47 insertions(+), 2 deletions(-) diff --git a/src/util/interface.c b/src/util/interface.c index 9b86f2d..3929a92 100644 --- a/src/util/interface.c +++ b/src/util/interface.c @@ -27,7 +27,10 @@ #include <sys/socket.h> #include <sys/ioctl.h> -#include <linux/if.h> + +#ifdef __linux__ +# include <linux/if.h> +#endif #include "internal.h" @@ -40,7 +43,7 @@ __FUNCTION__, __LINE__, __VA_ARGS__) /* - * chgIfFlags: Change flags on an interface + * chgIfaceFlags: Change flags on an interface * * @ifname : name of the interface * @flagclear : the flags to clear @@ -52,6 +55,7 @@ * * Returns 0 on success, errno on failure. */ +#ifdef __linux__ static int chgIfaceFlags(const char *ifname, short flagclear, short flagset) { struct ifreq ifr; int rc = 0; @@ -105,6 +109,15 @@ ifaceCtrl(const char *name, bool up) (up) ? IFF_UP : 0); } +#else + +int +ifaceCtrl(const char *name ATTRIBUTE_UNUSED, bool up ATTRIBUTE_UNUSED) +{ + return ENOSYS; +} + +#endif /* __linux__ */ /** * ifaceCheck @@ -123,6 +136,7 @@ ifaceCtrl(const char *name, bool up) * index is different than the one passed * EINVAL : if interface name is invalid (too long) */ +#ifdef __linux__ int ifaceCheck(bool reportError, const char *ifname, const unsigned char *macaddr, int ifindex) @@ -175,6 +189,19 @@ ifaceCheck(bool reportError, const char *ifname, return rc; } +#else + +int +ifaceCheck(bool reportError ATTRIBUTE_UNUSED, + const char *ifname ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED, + int ifindex ATTRIBUTE_UNUSED) +{ + return ENOSYS; +} + +#endif /* __linux__ */ + /** * ifaceGetIndex @@ -189,6 +216,7 @@ ifaceCheck(bool reportError, const char *ifname, * ENODEV : if interface with given name does not exist * EINVAL : if interface name is invalid (too long) */ +#ifdef __linux__ int ifaceGetIndex(bool reportError, const char *ifname, int *ifindex) { @@ -224,3 +252,20 @@ err_exit: return rc; } + +#else + +int +ifaceGetIndex(bool reportError, + const char *ifname ATTRIBUTE_UNUSED, + int *ifindex ATTRIBUTE_UNUSED) +{ + if (reportError) { + ifaceError(VIR_ERR_INTERNAL_ERROR, "%s", + _("ifaceGetIndex is not supported on non-linux platforms")); + } + + return ENOSYS; +} + +#endif /* __linux__ */ -- 1.6.3.3

2 2

[libvirt] [PATCH v2] nwfilter: enable hex number inputs in filter XML
by Stefan Berger 26 Apr '10

26 Apr '10

With this patch I want to enable hex number inputs in the filter XML. A number that was entered as hex is also printed as hex unless a string representing the meaning can be found. I am also extending the schema and adding a test case. A problem with the DSCP value is fixed on the way as well. Changes from V1 to V2: - using asHex boolean in all printf type of functions to select the output format in hex or decimal format Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/schemas/nwfilter.rng | 20 ++++ src/conf/nwfilter_conf.c | 121 +++++++++++++++++------------ src/conf/nwfilter_conf.h | 18 ++-- src/nwfilter/nwfilter_ebiptables_driver.c | 2 tests/nwfilterxml2xmlin/hex-data-test.xml | 56 +++++++++++++ tests/nwfilterxml2xmlout/hex-data-test.xml | 21 +++++ tests/nwfilterxml2xmltest.c | 2 7 files changed, 184 insertions(+), 56 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -65,15 +65,17 @@ enum virNWFilterEntryItemFlags { enum attrDatatype { DATATYPE_UINT16 = (1 << 0), DATATYPE_UINT8 = (1 << 1), - DATATYPE_MACADDR = (1 << 2), - DATATYPE_MACMASK = (1 << 3), - DATATYPE_IPADDR = (1 << 4), - DATATYPE_IPMASK = (1 << 5), - DATATYPE_STRING = (1 << 6), - DATATYPE_IPV6ADDR = (1 << 7), - DATATYPE_IPV6MASK = (1 << 8), + DATATYPE_UINT16_HEX = (1 << 2), + DATATYPE_UINT8_HEX = (1 << 3), + DATATYPE_MACADDR = (1 << 4), + DATATYPE_MACMASK = (1 << 5), + DATATYPE_IPADDR = (1 << 6), + DATATYPE_IPMASK = (1 << 7), + DATATYPE_STRING = (1 << 8), + DATATYPE_IPV6ADDR = (1 << 9), + DATATYPE_IPV6MASK = (1 << 10), - DATATYPE_LAST = (1 << 9), + DATATYPE_LAST = (1 << 11), }; Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -430,7 +430,9 @@ checkMacProtocolID(enum attrDatatype dat if (datatype == DATATYPE_STRING) { if (intMapGetByString(macProtoMap, (char *)value, 1, &res) == 0) res = -1; - } else if (datatype == DATATYPE_UINT16) { + datatype = DATATYPE_UINT16; + } else if (datatype == DATATYPE_UINT16 || + datatype == DATATYPE_UINT16_HEX) { res = (uint32_t)*(uint16_t *)value; if (res < 0x600) res = -1; @@ -438,7 +440,7 @@ checkMacProtocolID(enum attrDatatype dat if (res != -1) { nwf->p.ethHdrFilter.dataProtocolID.u.u16 = res; - nwf->p.ethHdrFilter.dataProtocolID.datatype = DATATYPE_UINT16; + nwf->p.ethHdrFilter.dataProtocolID.datatype = datatype; return 1; } @@ -451,13 +453,17 @@ macProtocolIDFormatter(virBufferPtr buf, virNWFilterRuleDefPtr nwf) { const char *str = NULL; + bool asHex = true; if (intMapGetByInt(macProtoMap, nwf->p.ethHdrFilter.dataProtocolID.u.u16, &str)) { virBufferVSprintf(buf, "%s", str); } else { - virBufferVSprintf(buf, "%d", nwf->p.ethHdrFilter.dataProtocolID.u.u16); + if (nwf->p.ethHdrFilter.dataProtocolID.datatype == DATATYPE_UINT16) + asHex = false; + virBufferVSprintf(buf, asHex ? "0x%x" : "%d", + nwf->p.ethHdrFilter.dataProtocolID.u.u16); } return 1; } @@ -528,13 +534,15 @@ arpOpcodeValidator(enum attrDatatype dat if (datatype == DATATYPE_STRING) { if (intMapGetByString(arpOpcodeMap, (char *)value, 1, &res) == 0) res = -1; - } else if (datatype == DATATYPE_UINT16) { + datatype = DATATYPE_UINT16; + } else if (datatype == DATATYPE_UINT16 || + datatype == DATATYPE_UINT16_HEX) { res = (uint32_t)*(uint16_t *)value; } if (res != -1) { nwf->p.arpHdrFilter.dataOpcode.u.u16 = res; - nwf->p.arpHdrFilter.dataOpcode.datatype = DATATYPE_UINT16; + nwf->p.arpHdrFilter.dataOpcode.datatype = datatype; return 1; } return 0; @@ -585,13 +593,15 @@ static bool checkIPProtocolID(enum attrD if (datatype == DATATYPE_STRING) { if (intMapGetByString(ipProtoMap, (char *)value, 1, &res) == 0) res = -1; - } else if (datatype == DATATYPE_UINT8) { + datatype = DATATYPE_UINT8_HEX; + } else if (datatype == DATATYPE_UINT8 || + datatype == DATATYPE_UINT8_HEX) { res = (uint32_t)*(uint16_t *)value; } if (res != -1) { nwf->p.ipHdrFilter.ipHdr.dataProtocolID.u.u8 = res; - nwf->p.ipHdrFilter.ipHdr.dataProtocolID.datatype = DATATYPE_UINT8; + nwf->p.ipHdrFilter.ipHdr.dataProtocolID.datatype = datatype; return 1; } return 0; @@ -603,13 +613,16 @@ formatIPProtocolID(virBufferPtr buf, virNWFilterRuleDefPtr nwf) { const char *str = NULL; + bool asHex = true; if (intMapGetByInt(ipProtoMap, nwf->p.ipHdrFilter.ipHdr.dataProtocolID.u.u8, &str)) { virBufferVSprintf(buf, "%s", str); } else { - virBufferVSprintf(buf, "%d", + if (nwf->p.ipHdrFilter.ipHdr.dataProtocolID.datatype == DATATYPE_UINT8) + asHex = false; + virBufferVSprintf(buf, asHex ? "0x%x" : "%d", nwf->p.ipHdrFilter.ipHdr.dataProtocolID.u.u8); } return 1; @@ -617,15 +630,14 @@ formatIPProtocolID(virBufferPtr buf, static bool -dscpValidator(enum attrDatatype datatype ATTRIBUTE_UNUSED, void *val, +dscpValidator(enum attrDatatype datatype, void *val, virNWFilterRuleDefPtr nwf) { uint8_t dscp = *(uint16_t *)val; if (dscp > 63) return 0; - nwf->p.ipHdrFilter.ipHdr.dataDSCP.u.u8 = dscp; - nwf->p.ipHdrFilter.ipHdr.dataDSCP.datatype = DATATYPE_UINT8; + nwf->p.ipHdrFilter.ipHdr.dataDSCP.datatype = datatype; return 1; } @@ -657,7 +669,7 @@ static const virXMLAttr2Struct macAttrib COMMON_MAC_PROPS(ethHdrFilter), { .name = "protocolid", - .datatype = DATATYPE_UINT16 | DATATYPE_STRING, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX | DATATYPE_STRING, .dataIdx = offsetof(virNWFilterRuleDef, p.ethHdrFilter.dataProtocolID), .validator= checkMacProtocolID, .formatter= macProtocolIDFormatter, @@ -671,15 +683,15 @@ static const virXMLAttr2Struct arpAttrib COMMON_MAC_PROPS(arpHdrFilter), { .name = "hwtype", - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataHWType), }, { .name = "protocoltype", - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataProtocolType), }, { .name = "opcode", - .datatype = DATATYPE_UINT16 | DATATYPE_STRING, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX | DATATYPE_STRING, .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataOpcode), .validator= arpOpcodeValidator, .formatter= arpOpcodeFormatter, @@ -729,34 +741,34 @@ static const virXMLAttr2Struct ipAttribu }, { .name = "protocol", - .datatype = DATATYPE_STRING | DATATYPE_UINT8, + .datatype = DATATYPE_STRING | DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.ipHdr.dataProtocolID), .validator= checkIPProtocolID, .formatter= formatIPProtocolID, }, { .name = SRCPORTSTART, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.portData.dataSrcPortStart), }, { .name = SRCPORTEND, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.portData.dataSrcPortEnd), }, { .name = DSTPORTSTART, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.portData.dataDstPortStart), }, { .name = DSTPORTEND, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.portData.dataDstPortEnd), }, { .name = DSCP, - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.ipHdr.dataDSCP), .validator = dscpValidator, }, @@ -790,29 +802,29 @@ static const virXMLAttr2Struct ipv6Attri }, { .name = "protocol", - .datatype = DATATYPE_STRING | DATATYPE_UINT8, + .datatype = DATATYPE_STRING | DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataProtocolID), .validator= checkIPProtocolID, .formatter= formatIPProtocolID, }, { .name = SRCPORTSTART, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.portData.dataSrcPortStart), }, { .name = SRCPORTEND, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.portData.dataSrcPortEnd), }, { .name = DSTPORTSTART, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.portData.dataDstPortStart), }, { .name = DSTPORTEND, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.portData.dataDstPortEnd), }, { @@ -872,9 +884,9 @@ static const virXMLAttr2Struct ipv6Attri },\ {\ .name = DSCP,\ - .datatype = DATATYPE_UINT8,\ + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataDSCP),\ - /*.validator = dscpValidator,*/\ + .validator = dscpValidator,\ },\ {\ .name = "connlimit-above",\ @@ -885,22 +897,22 @@ static const virXMLAttr2Struct ipv6Attri #define COMMON_PORT_PROPS(STRUCT) \ {\ .name = SRCPORTSTART,\ - .datatype = DATATYPE_UINT16,\ + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.portData.dataSrcPortStart),\ },\ {\ .name = SRCPORTEND,\ - .datatype = DATATYPE_UINT16,\ + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.portData.dataSrcPortEnd),\ },\ {\ .name = DSTPORTSTART,\ - .datatype = DATATYPE_UINT16,\ + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.portData.dataDstPortStart),\ },\ {\ .name = DSTPORTEND,\ - .datatype = DATATYPE_UINT16,\ + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.portData.dataDstPortEnd),\ } @@ -909,7 +921,7 @@ static const virXMLAttr2Struct tcpAttrib COMMON_PORT_PROPS(tcpHdrFilter), { .name = "option", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.tcpHdrFilter.dataTCPOption), }, { @@ -959,12 +971,12 @@ static const virXMLAttr2Struct icmpAttri COMMON_IP_PROPS(icmpHdrFilter, DATATYPE_IPADDR, DATATYPE_IPMASK), { .name = "type", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.icmpHdrFilter.dataICMPType), }, { .name = "code", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.icmpHdrFilter.dataICMPCode), }, { @@ -994,7 +1006,7 @@ static const virXMLAttr2Struct tcpipv6At COMMON_PORT_PROPS(tcpHdrFilter), { .name = "option", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.tcpHdrFilter.dataTCPOption), }, { @@ -1048,12 +1060,12 @@ static const virXMLAttr2Struct icmpv6Att COMMON_IP_PROPS(icmpHdrFilter, DATATYPE_IPV6ADDR, DATATYPE_IPV6MASK), { .name = "type", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.icmpHdrFilter.dataICMPType), }, { .name = "code", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.icmpHdrFilter.dataICMPCode), }, { @@ -1156,6 +1168,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n valueValidator validator; char *match = virXMLPropString(node, "match"); nwIPAddress ipaddr; + int base; if (match && STREQ(match, "no")) match_flag = NWFILTER_ENTRY_ITEM_FLAG_IS_NEG; @@ -1196,14 +1209,16 @@ virNWFilterRuleDetailsParse(xmlNodePtr n validator = att[idx].validator; - switch (datatype) { + base = 10; + switch (datatype) { + case DATATYPE_UINT8_HEX: + base = 16; case DATATYPE_UINT8: storage_ptr = &item->u.u8; - if (virStrToLong_ui(prop, NULL, 10, &uint_val) >= 0) { + if (virStrToLong_ui(prop, NULL, base, &uint_val) >= 0) { if (uint_val <= 0xff) { - if (!validator) - *(uint8_t *)storage_ptr = uint_val; + *(uint8_t *)storage_ptr = uint_val; found = 1; data_ptr = &uint_val; } else @@ -1212,12 +1227,13 @@ virNWFilterRuleDetailsParse(xmlNodePtr n rc = -1; break; + case DATATYPE_UINT16_HEX: + base = 16; case DATATYPE_UINT16: storage_ptr = &item->u.u16; - if (virStrToLong_ui(prop, NULL, 10, &uint_val) >= 0) { + if (virStrToLong_ui(prop, NULL, base, &uint_val) >= 0) { if (uint_val <= 0xffff) { - if (!validator) - *(uint16_t *)storage_ptr = uint_val; + *(uint16_t *)storage_ptr = uint_val; found = 1; data_ptr = &uint_val; } else @@ -2393,6 +2409,7 @@ virNWFilterRuleDefDetailsFormat(virBuffe int i = 0, j; bool typeShown = 0; bool neverShown = 1; + bool asHex; enum match { MATCH_NONE = 0, MATCH_YES, @@ -2444,19 +2461,27 @@ virNWFilterRuleDefDetailsFormat(virBuffe } else if ((flags & NWFILTER_ENTRY_ITEM_FLAG_HAS_VAR)) { virBufferVSprintf(buf, "$%s", item->var); } else { - switch (att[i].datatype) { + asHex = false; + + switch (item->datatype) { + case DATATYPE_UINT8_HEX: + asHex = true; case DATATYPE_IPMASK: case DATATYPE_IPV6MASK: // display all masks in CIDR format case DATATYPE_UINT8: storage_ptr = &item->u.u8; - virBufferVSprintf(buf, "%d", *(uint8_t *)storage_ptr); + virBufferVSprintf(buf, asHex ? "0x%x" : "%d", + *(uint8_t *)storage_ptr); break; + case DATATYPE_UINT16_HEX: + asHex = true; case DATATYPE_UINT16: storage_ptr = &item->u.u16; - virBufferVSprintf(buf, "%d", *(uint16_t *)storage_ptr); + virBufferVSprintf(buf, asHex ? "0x%x" : "%d", + *(uint16_t *)storage_ptr); break; case DATATYPE_IPADDR: Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -215,6 +215,7 @@ _printDataType(virNWFilterHashTablePtr v break; case DATATYPE_UINT16: + case DATATYPE_UINT16_HEX: if (snprintf(buf, bufsize, asHex ? "0x%x" : "%d", item->u.u16) >= bufsize) { virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", @@ -224,6 +225,7 @@ _printDataType(virNWFilterHashTablePtr v break; case DATATYPE_UINT8: + case DATATYPE_UINT8_HEX: if (snprintf(buf, bufsize, asHex ? "0x%x" : "%d", item->u.u8) >= bufsize) { virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -647,6 +647,10 @@ <define name="sixbitrange"> <choice> + <data type="string"> + <param name="pattern">0x([0-3][0-9a-fA-F]|[0-9a-fA-F])</param> + </data> +  <data type="string"> <param name="pattern">$[a-zA-Z0-9_]+</param> @@ -666,6 +670,10 @@ <param name="pattern">$[a-zA-Z0-9_]+</param> </data> + <data type="string"> + <param name="pattern">0x([6-9a-fA-F][0-9a-fA-F]{2}|[0-9a-fA-F]{4})</param> + </data> + <data type="int"> <param name="minInclusive">1536</param> <param name="maxInclusive">65535</param> @@ -686,6 +694,10 @@ <param name="pattern">$[a-zA-Z0-9_]+</param> </data> + <data type="string"> + <param name="pattern">0x[0-9a-fA-F]{1,2}</param> + </data> + <data type="int"> <param name="minInclusive">0</param> <param name="maxInclusive">255</param> @@ -700,6 +712,10 @@ <param name="pattern">$[a-zA-Z0-9_]+</param> </data> + <data type="string"> + <param name="pattern">0x[0-9a-fA-F]{1,4}</param> + </data> + <data type="int"> <param name="minInclusive">0</param> <param name="maxInclusive">65535</param> @@ -733,6 +749,10 @@ <param name="pattern">$[a-zA-Z0-9_]+</param> </data> + <data type="string"> + <param name="pattern">0x[0-9a-fA-F]{1,2}</param> + </data> + <data type="int"> <param name="minInclusive">0</param> <param name="maxInclusive">255</param> Index: libvirt-acl/tests/nwfilterxml2xmlin/hex-data-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/hex-data-test.xml @@ -0,0 +1,56 @@ +<filter name='testcase'> + <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid> + + <rule action='accept' direction='in'> + <mac protocolid='0x1234'/> + </rule> + + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='0x123' srcportend='0x234' + dstportstart='0x3456' dstportend='0x4567' + dscp='0x32'/> + </rule> + + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='tcp' + srcportstart='0x111' srcportend='400' + dstportstart='0x3333' dstportend='65535'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='0x12' + protocoltype='0x56' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='0x22' + srcportstart='0x123' srcportend='400' + dstportstart='0x234' dstportend='0x444'/> + </rule> + + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='0x40' + srcportstart='0x20' srcportend='0x21' + dstportstart='0x100' dstportend='0x1111'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -121,6 +121,8 @@ mymain(int argc, char **argv) DO_TEST("conntrack-test"); + DO_TEST("hex-data-test"); + return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/hex-data-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/hex-data-test.xml @@ -0,0 +1,21 @@ +<filter name='testcase' chain='root'> + <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid> + <rule action='accept' direction='in' priority='500'> + <mac protocolid='0x1234'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <ip srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' srcipaddr='10.1.2.3' srcipmask='32' dstipaddr='10.1.2.3' dstipmask='32' protocol='udp' srcportstart='0x123' srcportend='0x234' dstportstart='0x3456' dstportend='0x4567' dscp='0x32'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <ipv6 srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:fe' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' srcipaddr='::10.1.2.3' srcipmask='22' dstipaddr='::10.1.2.3' dstipmask='113' protocol='tcp' srcportstart='0x111' srcportend='400' dstportstart='0x3333' dstportend='65535'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <arp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' hwtype='0x12' protocoltype='0x56' opcode='Request' arpsrcmacaddr='01:02:03:04:05:06' arpdstmacaddr='0a:0b:0c:0d:0e:0f'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <udp srcmacaddr='01:02:03:04:05:06' dstipaddr='10.1.2.3' dstipmask='32' dscp='0x22' srcportstart='0x123' srcportend='400' dstportstart='0x234' dstportend='0x444'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <tcp-ipv6 srcmacaddr='01:02:03:04:05:06' srcipaddr='a:b:c::' srcipmask='128' srcportstart='0x20' srcportend='0x21' dstportstart='0x100' dstportend='0x1111'/> + </rule> +</filter>

2 1

[libvirt] [PATCH] nwfilter: enable hex number inputs in filter XML
by Stefan Berger 26 Apr '10

26 Apr '10

With this patch I want to enable hex number inputs in the filter XML. A number that was entered as hex is also printed as hex unless a string representing the meaning can be found. I am also extending the schema and adding a test case. A problem with the DSCP value is fixed on the way as well. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 77 +++++++++++++++++++----------- src/conf/nwfilter_conf.h | 18 +++---- src/nwfilter/nwfilter_ebiptables_driver.c | 2 3 files changed, 62 insertions(+), 35 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -83,15 +83,17 @@ enum virNWFilterEntryItemFlags { enum attrDatatype { DATATYPE_UINT16 = (1 << 0), DATATYPE_UINT8 = (1 << 1), - DATATYPE_MACADDR = (1 << 2), - DATATYPE_MACMASK = (1 << 3), - DATATYPE_IPADDR = (1 << 4), - DATATYPE_IPMASK = (1 << 5), - DATATYPE_STRING = (1 << 6), - DATATYPE_IPV6ADDR = (1 << 7), - DATATYPE_IPV6MASK = (1 << 8), + DATATYPE_UINT16_HEX = (1 << 2), + DATATYPE_UINT8_HEX = (1 << 3), + DATATYPE_MACADDR = (1 << 4), + DATATYPE_MACMASK = (1 << 5), + DATATYPE_IPADDR = (1 << 6), + DATATYPE_IPMASK = (1 << 7), + DATATYPE_STRING = (1 << 8), + DATATYPE_IPV6ADDR = (1 << 9), + DATATYPE_IPV6MASK = (1 << 10), - DATATYPE_LAST = (1 << 9), + DATATYPE_LAST = (1 << 11), }; Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -415,7 +415,9 @@ checkMacProtocolID(enum attrDatatype dat if (datatype == DATATYPE_STRING) { if (intMapGetByString(macProtoMap, (char *)value, 1, &res) == 0) res = -1; - } else if (datatype == DATATYPE_UINT16) { + datatype = DATATYPE_UINT16; + } else if (datatype == DATATYPE_UINT16 || + datatype == DATATYPE_UINT16_HEX) { res = (uint32_t)*(uint16_t *)value; if (res < 0x600) res = -1; @@ -423,7 +425,7 @@ checkMacProtocolID(enum attrDatatype dat if (res != -1) { nwf->p.ethHdrFilter.dataProtocolID.u.u16 = res; - nwf->p.ethHdrFilter.dataProtocolID.datatype = DATATYPE_UINT16; + nwf->p.ethHdrFilter.dataProtocolID.datatype = datatype; return 1; } @@ -436,13 +438,17 @@ macProtocolIDFormatter(virBufferPtr buf, virNWFilterRuleDefPtr nwf) { const char *str = NULL; + const char *format = "0x%x"; if (intMapGetByInt(macProtoMap, nwf->p.ethHdrFilter.dataProtocolID.u.u16, &str)) { virBufferVSprintf(buf, "%s", str); } else { - virBufferVSprintf(buf, "%d", nwf->p.ethHdrFilter.dataProtocolID.u.u16); + if (nwf->p.ethHdrFilter.dataProtocolID.datatype == DATATYPE_UINT16) + format = "%d"; + virBufferVSprintf(buf, format, + nwf->p.ethHdrFilter.dataProtocolID.u.u16); } return 1; } @@ -513,13 +519,15 @@ arpOpcodeValidator(enum attrDatatype dat if (datatype == DATATYPE_STRING) { if (intMapGetByString(arpOpcodeMap, (char *)value, 1, &res) == 0) res = -1; - } else if (datatype == DATATYPE_UINT16) { + datatype = DATATYPE_UINT16; + } else if (datatype == DATATYPE_UINT16 || + datatype == DATATYPE_UINT16_HEX) { res = (uint32_t)*(uint16_t *)value; } if (res != -1) { nwf->p.arpHdrFilter.dataOpcode.u.u16 = res; - nwf->p.arpHdrFilter.dataOpcode.datatype = DATATYPE_UINT16; + nwf->p.arpHdrFilter.dataOpcode.datatype = datatype; return 1; } return 0; @@ -570,13 +578,15 @@ static bool checkIPProtocolID(enum attrD if (datatype == DATATYPE_STRING) { if (intMapGetByString(ipProtoMap, (char *)value, 1, &res) == 0) res = -1; - } else if (datatype == DATATYPE_UINT8) { + datatype = DATATYPE_UINT8_HEX; + } else if (datatype == DATATYPE_UINT8 || + datatype == DATATYPE_UINT8_HEX) { res = (uint32_t)*(uint16_t *)value; } if (res != -1) { nwf->p.ipHdrFilter.ipHdr.dataProtocolID.u.u8 = res; - nwf->p.ipHdrFilter.ipHdr.dataProtocolID.datatype = DATATYPE_UINT8; + nwf->p.ipHdrFilter.ipHdr.dataProtocolID.datatype = datatype; return 1; } return 0; @@ -588,13 +598,16 @@ formatIPProtocolID(virBufferPtr buf, virNWFilterRuleDefPtr nwf) { const char *str = NULL; + const char *format = "0x%x"; if (intMapGetByInt(ipProtoMap, nwf->p.ipHdrFilter.ipHdr.dataProtocolID.u.u8, &str)) { virBufferVSprintf(buf, "%s", str); } else { - virBufferVSprintf(buf, "%d", + if (nwf->p.ipHdrFilter.ipHdr.dataProtocolID.datatype == DATATYPE_UINT8) + format = "%d"; + virBufferVSprintf(buf, format, nwf->p.ipHdrFilter.ipHdr.dataProtocolID.u.u8); } return 1; @@ -602,15 +615,14 @@ formatIPProtocolID(virBufferPtr buf, static bool -dscpValidator(enum attrDatatype datatype ATTRIBUTE_UNUSED, void *val, +dscpValidator(enum attrDatatype datatype, void *val, virNWFilterRuleDefPtr nwf) { uint8_t dscp = *(uint16_t *)val; if (dscp > 63) return 0; - nwf->p.ipHdrFilter.ipHdr.dataDSCP.u.u8 = dscp; - nwf->p.ipHdrFilter.ipHdr.dataDSCP.datatype = DATATYPE_UINT8; + nwf->p.ipHdrFilter.ipHdr.dataDSCP.datatype = datatype; return 1; } @@ -642,7 +654,7 @@ static const virXMLAttr2Struct macAttrib COMMON_MAC_PROPS(ethHdrFilter), { .name = "protocolid", - .datatype = DATATYPE_UINT16 | DATATYPE_STRING, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX | DATATYPE_STRING, .dataIdx = offsetof(virNWFilterRuleDef, p.ethHdrFilter.dataProtocolID), .validator= checkMacProtocolID, .formatter= macProtocolIDFormatter, @@ -656,15 +668,15 @@ static const virXMLAttr2Struct arpAttrib COMMON_MAC_PROPS(arpHdrFilter), { .name = "hwtype", - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataHWType), }, { .name = "protocoltype", - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataProtocolType), }, { .name = "opcode", - .datatype = DATATYPE_UINT16 | DATATYPE_STRING, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX | DATATYPE_STRING, .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataOpcode), .validator= arpOpcodeValidator, .formatter= arpOpcodeFormatter, @@ -714,34 +726,34 @@ static const virXMLAttr2Struct ipAttribu }, { .name = "protocol", - .datatype = DATATYPE_STRING | DATATYPE_UINT8, + .datatype = DATATYPE_STRING | DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.ipHdr.dataProtocolID), .validator= checkIPProtocolID, .formatter= formatIPProtocolID, }, { .name = SRCPORTSTART, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.portData.dataSrcPortStart), }, { .name = SRCPORTEND, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.portData.dataSrcPortEnd), }, { .name = DSTPORTSTART, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.portData.dataDstPortStart), }, { .name = DSTPORTEND, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.portData.dataDstPortEnd), }, { .name = DSCP, - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.ipHdr.dataDSCP), .validator = dscpValidator, }, @@ -775,29 +787,29 @@ static const virXMLAttr2Struct ipv6Attri }, { .name = "protocol", - .datatype = DATATYPE_STRING | DATATYPE_UINT8, + .datatype = DATATYPE_STRING | DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataProtocolID), .validator= checkIPProtocolID, .formatter= formatIPProtocolID, }, { .name = SRCPORTSTART, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.portData.dataSrcPortStart), }, { .name = SRCPORTEND, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.portData.dataSrcPortEnd), }, { .name = DSTPORTSTART, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.portData.dataDstPortStart), }, { .name = DSTPORTEND, - .datatype = DATATYPE_UINT16, + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.portData.dataDstPortEnd), }, { @@ -857,9 +869,9 @@ static const virXMLAttr2Struct ipv6Attri },\ {\ .name = DSCP,\ - .datatype = DATATYPE_UINT8,\ + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataDSCP),\ - /*.validator = dscpValidator,*/\ + .validator = dscpValidator,\ },\ {\ .name = "connlimit-above",\ @@ -870,22 +882,22 @@ static const virXMLAttr2Struct ipv6Attri #define COMMON_PORT_PROPS(STRUCT) \ {\ .name = SRCPORTSTART,\ - .datatype = DATATYPE_UINT16,\ + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.portData.dataSrcPortStart),\ },\ {\ .name = SRCPORTEND,\ - .datatype = DATATYPE_UINT16,\ + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.portData.dataSrcPortEnd),\ },\ {\ .name = DSTPORTSTART,\ - .datatype = DATATYPE_UINT16,\ + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.portData.dataDstPortStart),\ },\ {\ .name = DSTPORTEND,\ - .datatype = DATATYPE_UINT16,\ + .datatype = DATATYPE_UINT16 | DATATYPE_UINT16_HEX,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.portData.dataDstPortEnd),\ } @@ -894,7 +906,7 @@ static const virXMLAttr2Struct tcpAttrib COMMON_PORT_PROPS(tcpHdrFilter), { .name = "option", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.tcpHdrFilter.dataTCPOption), }, { @@ -944,12 +956,12 @@ static const virXMLAttr2Struct icmpAttri COMMON_IP_PROPS(icmpHdrFilter, DATATYPE_IPADDR, DATATYPE_IPMASK), { .name = "type", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.icmpHdrFilter.dataICMPType), }, { .name = "code", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.icmpHdrFilter.dataICMPCode), }, { @@ -979,7 +991,7 @@ static const virXMLAttr2Struct tcpipv6At COMMON_PORT_PROPS(tcpHdrFilter), { .name = "option", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.tcpHdrFilter.dataTCPOption), }, { @@ -1033,12 +1045,12 @@ static const virXMLAttr2Struct icmpv6Att COMMON_IP_PROPS(icmpHdrFilter, DATATYPE_IPV6ADDR, DATATYPE_IPV6MASK), { .name = "type", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.icmpHdrFilter.dataICMPType), }, { .name = "code", - .datatype = DATATYPE_UINT8, + .datatype = DATATYPE_UINT8 | DATATYPE_UINT8_HEX, .dataIdx = offsetof(virNWFilterRuleDef, p.icmpHdrFilter.dataICMPCode), }, { @@ -1142,6 +1154,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n valueValidator validator; char *match = virXMLPropString(node, "match"); nwIPAddress ipaddr; + int base; if (match && STREQ(match, "no")) match_flag = NWFILTER_ENTRY_ITEM_FLAG_IS_NEG; @@ -1182,14 +1195,16 @@ virNWFilterRuleDetailsParse(xmlNodePtr n validator = att[idx].validator; - switch (datatype) { + base = 10; + switch (datatype) { + case DATATYPE_UINT8_HEX: + base = 16; case DATATYPE_UINT8: storage_ptr = &item->u.u8; - if (virStrToLong_ui(prop, NULL, 10, &uint_val) >= 0) { + if (virStrToLong_ui(prop, NULL, base, &uint_val) >= 0) { if (uint_val <= 0xff) { - if (!validator) - *(uint8_t *)storage_ptr = uint_val; + *(uint8_t *)storage_ptr = uint_val; found = 1; data_ptr = &uint_val; } else @@ -1198,12 +1213,13 @@ virNWFilterRuleDetailsParse(xmlNodePtr n rc = -1; break; + case DATATYPE_UINT16_HEX: + base = 16; case DATATYPE_UINT16: storage_ptr = &item->u.u16; - if (virStrToLong_ui(prop, NULL, 10, &uint_val) >= 0) { + if (virStrToLong_ui(prop, NULL, base, &uint_val) >= 0) { if (uint_val <= 0xffff) { - if (!validator) - *(uint16_t *)storage_ptr = uint_val; + *(uint16_t *)storage_ptr = uint_val; found = 1; data_ptr = &uint_val; } else @@ -2380,6 +2396,7 @@ virNWFilterRuleDefDetailsFormat(virBuffe int i = 0, j; bool typeShown = 0; bool neverShown = 1; + const char *format; enum match { MATCH_NONE = 0, MATCH_YES, @@ -2431,19 +2448,25 @@ virNWFilterRuleDefDetailsFormat(virBuffe } else if ((flags & NWFILTER_ENTRY_ITEM_FLAG_HAS_VAR)) { virBufferVSprintf(buf, "$%s", item->var); } else { - switch (att[i].datatype) { + format = "%d"; + + switch (item->datatype) { + case DATATYPE_UINT8_HEX: + format = "0x%x"; case DATATYPE_IPMASK: case DATATYPE_IPV6MASK: // display all masks in CIDR format case DATATYPE_UINT8: storage_ptr = &item->u.u8; - virBufferVSprintf(buf, "%d", *(uint8_t *)storage_ptr); + virBufferVSprintf(buf, format, *(uint8_t *)storage_ptr); break; + case DATATYPE_UINT16_HEX: + format = "0x%x"; case DATATYPE_UINT16: storage_ptr = &item->u.u16; - virBufferVSprintf(buf, "%d", *(uint16_t *)storage_ptr); + virBufferVSprintf(buf, format, *(uint16_t *)storage_ptr); break; case DATATYPE_IPADDR: Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -233,6 +233,7 @@ _printDataType(virNWFilterHashTablePtr v break; case DATATYPE_UINT16: + case DATATYPE_UINT16_HEX: if (snprintf(buf, bufsize, asHex ? "0x%x" : "%d", item->u.u16) >= bufsize) { virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", @@ -242,6 +243,7 @@ _printDataType(virNWFilterHashTablePtr v break; case DATATYPE_UINT8: + case DATATYPE_UINT8_HEX: if (snprintf(buf, bufsize, asHex ? "0x%x" : "%d", item->u.u8) >= bufsize) { virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -656,6 +656,10 @@ <define name="sixbitrange"> <choice> + <data type="string"> + <param name="pattern">0x([0-3][0-9a-fA-F]|[0-9a-fA-F])</param> + </data> +  <data type="string"> <param name="pattern">$[a-zA-Z0-9_]+</param> @@ -675,6 +679,10 @@ <param name="pattern">$[a-zA-Z0-9_]+</param> </data> + <data type="string"> + <param name="pattern">0x([6-9a-fA-F][0-9a-fA-F]{2}|[0-9a-fA-F]{4})</param> + </data> + <data type="int"> <param name="minInclusive">1536</param> <param name="maxInclusive">65535</param> @@ -695,6 +703,10 @@ <param name="pattern">$[a-zA-Z0-9_]+</param> </data> + <data type="string"> + <param name="pattern">0x[0-9a-fA-F]{1,2}</param> + </data> + <data type="int"> <param name="minInclusive">0</param> <param name="maxInclusive">255</param> @@ -709,6 +721,10 @@ <param name="pattern">$[a-zA-Z0-9_]+</param> </data> + <data type="string"> + <param name="pattern">0x[0-9a-fA-F]{1,4}</param> + </data> + <data type="int"> <param name="minInclusive">0</param> <param name="maxInclusive">65535</param> @@ -742,6 +758,10 @@ <param name="pattern">$[a-zA-Z0-9_]+</param> </data> + <data type="string"> + <param name="pattern">0x[0-9a-fA-F]{1,2}</param> + </data> + <data type="int"> <param name="minInclusive">0</param> <param name="maxInclusive">255</param> Index: libvirt-acl/tests/nwfilterxml2xmlin/hex-data-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/hex-data-test.xml @@ -0,0 +1,56 @@ +<filter name='testcase'> + <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid> + + <rule action='accept' direction='in'> + <mac protocolid='0x1234'/> + </rule> + + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='0x123' srcportend='0x234' + dstportstart='0x3456' dstportend='0x4567' + dscp='0x32'/> + </rule> + + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='tcp' + srcportstart='0x111' srcportend='400' + dstportstart='0x3333' dstportend='65535'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='0x12' + protocoltype='0x56' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='0x22' + srcportstart='0x123' srcportend='400' + dstportstart='0x234' dstportend='0x444'/> + </rule> + + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='0x40' + srcportstart='0x20' srcportend='0x21' + dstportstart='0x100' dstportend='0x1111'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -122,6 +122,8 @@ mymain(int argc, char **argv) DO_TEST("conntrack-test"); + DO_TEST("hex-data-test"); + return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/hex-data-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/hex-data-test.xml @@ -0,0 +1,21 @@ +<filter name='testcase' chain='root'> + <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid> + <rule action='accept' direction='in' priority='500'> + <mac protocolid='0x1234'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <ip srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' srcipaddr='10.1.2.3' srcipmask='32' dstipaddr='10.1.2.3' dstipmask='32' protocol='udp' srcportstart='0x123' srcportend='0x234' dstportstart='0x3456' dstportend='0x4567' dscp='0x32'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <ipv6 srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:fe' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' srcipaddr='::10.1.2.3' srcipmask='22' dstipaddr='::10.1.2.3' dstipmask='113' protocol='tcp' srcportstart='0x111' srcportend='400' dstportstart='0x3333' dstportend='65535'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <arp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' hwtype='0x12' protocoltype='0x56' opcode='Request' arpsrcmacaddr='01:02:03:04:05:06' arpdstmacaddr='0a:0b:0c:0d:0e:0f'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <udp srcmacaddr='01:02:03:04:05:06' dstipaddr='10.1.2.3' dstipmask='32' dscp='0x22' srcportstart='0x123' srcportend='400' dstportstart='0x234' dstportend='0x444'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <tcp-ipv6 srcmacaddr='01:02:03:04:05:06' srcipaddr='a:b:c::' srcipmask='128' srcportstart='0x20' srcportend='0x21' dstportstart='0x100' dstportend='0x1111'/> + </rule> +</filter>

2 2

[libvirt] Q of Libvirt and Xen
by ��... ��... 26 Apr '10

26 Apr '10

Hi ! sir I'm newbie of xen and libvirt. I'm practice use libvirt API for control xen on CenOS 5.4 using C language. How can I learn it. I can't found a simple C file for testing libvirt and xen. please suggest me for How can I using libvirt for control xen with C and May I have a example code C for run testing a libvirt. Thinks. Migkie _________________________________________________________________ The New Busy think 9 to 5 is a cute idea. Combine multiple calendars with Hotmail. http://www.windowslive.com/campaign/thenewbusy?tile=multicalendar&ocid=PID2…

1 0

[libvirt] [PATCH] esx: Distribute generated methods code
by Matthias Bolte 26 Apr '10

26 Apr '10

--- src/Makefile.am | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 17b2226..00ab65d 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -255,6 +255,8 @@ ESX_DRIVER_SOURCES = \ esx/esx_vmx.c esx/esx_vmx.h ESX_DRIVER_GENERATED = \ + esx/esx_vi_methods.generated.c \ + esx/esx_vi_methods.generated.h \ esx/esx_vi_types.generated.c \ esx/esx_vi_types.generated.h \ esx/esx_vi_types.generated.typedef \ -- 1.6.3.3

3 2

[libvirt] Libvirt debug API
by Chris Lalancette 26 Apr '10

26 Apr '10

Hello, In response to a lot of the talk of qemud lately on qemu-devel, the libvirt community would like to put forward a proposal to help enable debug/advanced options when using various hypervisors. The goals of this API are: 1) To enable more rapid access to hypervisor features before proper libvirt API's are designed around them. 2) To facilitate debugging and access to advanced features that may not fit into the normal libvirt world-view. Caveats: 1) Unlike other libvirt API's, this one will explicitly *not* be guaranteed ABI/API compatible between libvirt updates. 2) Again unlike other libvirt API's, access and configuration of the debug section of a domain will be highly hypervisor dependent. 3) Application developers will be strongly discouraged from using this API because of the above 2 issues. To help in this, the API's will be in a separate library that developers will explicitly have to link to, and it will have a different (but largely compatible) wire protocol. 4) We don't expect this API to solve all of the issues brought up during the qemud discussion. Our initial goal is just to give ready access of the qemu command-line and monitor to developers. With that being said, our initial proposal follows. We expect this to evolve over time as we get more feedback, but we think this proposal addresses at least 2 of the major pain points qemu developers have while trying to use libvirt. The initial debug XML for qemu would be: <domain type='kvm'> <name>myguest</name> ... <debug> <monitorpassthrough/> <commandline> <extra>qemu arguments</extra> <alter option="optname"> <rename>newname</rename> <match>REGEXP</match> <modify>foo=on</modify> <extra>-bar</extra> </alter> </commandline> </debug> </domain> Raw access to the qemu monitor will be disabled by default; the <monitorpassthrough/> tag enables the ability to send QMP (or text, if you are using older qemu) messages straight through to the monitor. To do this there will be an additional API entry point named virDomainDebugCommand() which takes an arbitrary string and passes it to the monitor, and returns an arbitrary string as a result. Thus you could pass in either "info cpus" if using the text monitor or '{ "execute": "query-cpus" }' if using QMP. The <commandline><extra> tag does exactly what you might expect; appends the exact string to the qemu command-line. The <alter> tag gets more interesting. The idea is that <alter> would allow you to modify the libvirt-generated qemu command-line in arbitrary ways. How this would work is probably best explained with some examples: <commandline> <alter option="-net"> <rename>-netdev</rename> </alter> </commandline> In this example, all options named -net on the qemu command-line are renamed to -netdev. <commandline> <alter option="-net"> <extra>-usbtablet</extra> </alter> </commandline> In this example, if (and only if) a -net option is seen, then -usbtablet is appended to the qemu command-line. <commandline> <alter option="-net"> <match>$.*name=hostnet0.*$</match> <modify>\1,tap</modify> </alter> </commandline> This gets more complicated (but also more powerful). In this case, any -net option where the argument *also* matches the regex in <match> will be modified to append the ",tap" string. Think of it as a sed expression, s/match/modify/, against the argument to the -net option, and it makes more sense. We are hoping to refine this proposal based on feedback, so comments and criticisms are welcome! -- Chris Lalancette

13 66

[libvirt] [PATCH] fix make dist, ESX method generated files missing
by Daniel Veillard 26 Apr '10

26 Apr '10

it was missing the new ESX method generated files, leading to a failure to build the resulting tarball, so I commited this simple fix, Daniel diff --git a/src/Makefile.am b/src/Makefile.am index 6435f01..fc64927 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -256,6 +256,8 @@ ESX_DRIVER_SOURCES = \ esx/esx_vmx.c esx/esx_vmx.h ESX_DRIVER_GENERATED = \ + esx/esx_vi_methods.generated.c \ + esx/esx_vi_methods.generated.h \ esx/esx_vi_types.generated.c \ esx/esx_vi_types.generated.h \ esx/esx_vi_types.generated.typedef \ -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH 0/1] port profile id
by David Allan 26 Apr '10

26 Apr '10

The following proof of concept patch attempts to show how we might support the use of port profile IDs. The ID would be associated with an interface on a VM and provided to the network infrastructure at VM start time. Since the interfaces by which the id can be provided are still in flux, the use function is only a stub. Dave David Allan (1): Initial POC of port profile id support docs/schemas/domain.rng | 8 ++++++++ src/conf/domain_conf.c | 12 ++++++++++++ src/conf/domain_conf.h | 1 + src/libvirt_private.syms | 3 +++ src/qemu/qemu_conf.c | 12 ++++++++++++ src/util/macvtap.c | 13 +++++++++++++ src/util/macvtap.h | 4 ++++ 7 files changed, 53 insertions(+), 0 deletions(-)

6 6

[libvirt] virsh is not working for other than root users.
by Kumar L Srikanth-B22348 26 Apr '10

26 Apr '10

Hi, I am using libvirt 0.8.0 on Fedora 32 bit system. When I issue "virsh -c lxc:///" with root permissions I m able to see 'virsh' console. But, if I changed to other user say "su srikanth", and issue the same command, I am not able to see the virsh console. I am getting "authentication failed" error. Can anybody please help me in solving the issue? Regards, Srikanth.

1 0

[libvirt] Question on xm and virsh listing
by Nandini Chandra 24 Apr '10

24 Apr '10

I'd like to understand the exact mechanism for retrieving the list of guests by xm/xend and virsh/libvirt.In what situations could the output of 'xm list' differ from 'virsh list'?Which of these two is more accurate? I'd appreciate any pointers. Thanks.

2 1

[libvirt] libvir and VDE
by Erik de Castro Lopo 24 Apr '10

24 Apr '10

Hi all, I am currently looking at looking at virsh to mamange my kvm and qemu VMs, but find that libvir doesn't support VDE networking which I prefer over other networking options. An obvious first step to adding support for VDE networking would be to allow the domxml-from-native subcommand to parse "-net vde" arguments like: -net vde,vlan=0,group=vde2-net,mode=0770,sock=/var/run/qemu-vde-ctl Apart from that, what else is required to support VDE networks in libvir? Cheers, Erik -- ---------------------------------------------------------------------- Erik de Castro Lopo http://www.mega-nerd.com/

1 0

[libvirt] [PATCH] Fix handling of security driver restore failures in QEMU domain save
by Daniel P. Berrange 24 Apr '10

24 Apr '10

In cases where the security driver failed to restore a label after a guest has saved, we mistakenly jumped to the error cleanup paths. This is not good, because the operation has in fact completed and cannot be rolled back completely. Label restore is non-critical, so just log the problem instead. Also add a missing restore call in the error cleanup path * src/qemu/qemu_driver.c: Fix handling of security driver restore failures in QEMU domain save --- src/qemu/qemu_driver.c | 48 +++++++++++++++++++++++++----------------------- 1 files changed, 25 insertions(+), 23 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index faecfb7..862c030 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5052,16 +5052,13 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path, driver->securityDriver && driver->securityDriver->domainRestoreSavedStateLabel && driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1) - goto endjob; + VIR_WARN("failed to restore save state label on %s", path); if (cgroup != NULL) { rc = virCgroupDenyDevicePath(cgroup, path); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to deny device %s for %s"), - path, vm->def->name); - goto endjob; - } + if (rc != 0) + VIR_WARN("Unable to deny device %s for %s %d", + path, vm->def->name, rc); } ret = 0; @@ -5080,24 +5077,29 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path, endjob: if (vm) { - if (ret != 0 && header.was_running && priv->mon) { - qemuDomainObjEnterMonitorWithDriver(driver, vm); - rc = qemuMonitorStartCPUs(priv->mon, dom->conn); - qemuDomainObjExitMonitorWithDriver(driver, vm); - if (rc < 0) - VIR_WARN0("Unable to resume guest CPUs after save failure"); - else - vm->state = VIR_DOMAIN_RUNNING; - } + if (ret != 0) { + if (header.was_running && priv->mon) { + qemuDomainObjEnterMonitorWithDriver(driver, vm); + rc = qemuMonitorStartCPUs(priv->mon, dom->conn); + qemuDomainObjExitMonitorWithDriver(driver, vm); + if (rc < 0) + VIR_WARN0("Unable to resume guest CPUs after save failure"); + else + vm->state = VIR_DOMAIN_RUNNING; + } - if (ret != 0 && cgroup != NULL) { - rc = virCgroupDenyDevicePath(cgroup, path); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to deny device %s for %s"), - path, vm->def->name); - goto endjob; + if (cgroup != NULL) { + rc = virCgroupDenyDevicePath(cgroup, path); + if (rc != 0) + VIR_WARN("Unable to deny device %s for %s: %d", + path, vm->def->name, rc); } + + if ((!bypassSecurityDriver) && + driver->securityDriver && + driver->securityDriver->domainRestoreSavedStateLabel && + driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1) + VIR_WARN("failed to restore save state label on %s", path); } if (qemuDomainObjEndJob(vm) == 0) -- 1.6.5.2

3 2

[libvirt] Error saving/restoring VM with attached disks
by Shi Jin 23 Apr '10

23 Apr '10

Hi there, I have been playing with libvirt/KVM on saving the VM to a checkpoint file and restoring it from this file. It has worked very well for me on my RHEL-5.5 setup, until I added hot-plugged volumes. If I add a volume to a running VM using "virsh attach-disk" and then call "virsh save". The checkpoint file was successfully written and VM stopped. However, I get errors restoring it with "virsh restore": $ virsh restore checkpoint error: Failed to restore domain from checkpoint error: operation failed: failed to start VM I did two thinngs to narrow down the problem: 1. If I manually remove the lines of attached volume from the checkpoint file, then it restores fine. 2. If I have the additioinal volumes in the original XML template instead of hot-plugging them on the fly, the save/restore work very well. So I think the problem is in save/restore hot-plugged volumes. Do you think this is a bug or an expected behaviour? Should I file a bug report? Any fix already? Thank you very much. Shi -- Shi Jin, PhD

1 0

[libvirt] [PATCH] cygwin: Check explicitly for getmntent_r
by Matthias Bolte 23 Apr '10

23 Apr '10

Cygwin has mntent.h but lacks getmntent_r. Update preprocessor checks to catch this combination. --- src/qemu/qemu_conf.c | 2 +- src/util/cgroup.c | 10 +++++----- src/util/util.c | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 2cbcc4f..ed24916 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -114,7 +114,7 @@ int qemudLoadDriverConfig(struct qemud_driver *driver, return -1; } -#ifdef HAVE_MNTENT_H +#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R /* For privileged driver, try and find hugepage mount automatically. * Non-privileged driver requires admin to create a dir for the * user, chown it, and then let user configure it manually */ diff --git a/src/util/cgroup.c b/src/util/cgroup.c index 4cb09b6..b649c3c 100644 --- a/src/util/cgroup.c +++ b/src/util/cgroup.c @@ -12,7 +12,7 @@ #include <stdio.h> #include <stdint.h> -#ifdef HAVE_MNTENT_H +#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R # include <mntent.h> #endif #include <fcntl.h> @@ -69,7 +69,7 @@ void virCgroupFree(virCgroupPtr *group) VIR_FREE(*group); } -#ifdef HAVE_MNTENT_H +#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R /* * Process /proc/mounts figuring out what controllers are * mounted and where @@ -403,7 +403,7 @@ out: } -#ifdef HAVE_MNTENT_H +#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R static int virCgroupCpuSetInherit(virCgroupPtr parent, virCgroupPtr group) { int i; @@ -628,7 +628,7 @@ int virCgroupAddTask(virCgroupPtr group, pid_t pid) * * Returns 0 on success */ -#ifdef HAVE_MNTENT_H +#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R int virCgroupForDriver(const char *name, virCgroupPtr *group, int privileged, @@ -682,7 +682,7 @@ int virCgroupForDriver(const char *name ATTRIBUTE_UNUSED, * * Returns 0 on success */ -#ifdef HAVE_MNTENT_H +#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R int virCgroupForDomain(virCgroupPtr driver, const char *name, virCgroupPtr *group, diff --git a/src/util/util.c b/src/util/util.c index 99383d1..a7bb67c 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -61,7 +61,7 @@ #if HAVE_CAPNG # include <cap-ng.h> #endif -#ifdef HAVE_MNTENT_H +#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R # include <mntent.h> #endif @@ -2716,7 +2716,7 @@ int virGetGroupID(const char *name ATTRIBUTE_UNUSED, #endif /* HAVE_GETPWUID_R */ -#ifdef HAVE_MNTENT_H +#if defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R /* search /proc/mounts for mount point of *type; return pointer to * malloc'ed string of the path if found, otherwise return NULL * with errno set to an appropriate value. @@ -2748,7 +2748,7 @@ cleanup: return ret; } -#else /* HAVE_MNTENT_H */ +#else /* defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R */ char * virFileFindMountPoint(const char *type ATTRIBUTE_UNUSED) @@ -2758,7 +2758,7 @@ virFileFindMountPoint(const char *type ATTRIBUTE_UNUSED) return NULL; } -#endif /* HAVE_MNTENT_H */ +#endif /* defined HAVE_MNTENT_H && defined HAVE_GETMNTENT_R */ #ifndef PROXY # if defined(UDEVADM) || defined(UDEVSETTLE) -- 1.6.3.3

2 3

[libvirt] [PATCH] Some NWFilter symbols are conditional and have to be exported conditional
by Matthias Bolte 23 Apr '10

23 Apr '10

--- src/Makefile.am | 7 ++++++- src/libvirt_nwfilter.syms | 14 ++++++++++++++ src/libvirt_private.syms | 13 +------------ 3 files changed, 21 insertions(+), 13 deletions(-) create mode 100644 src/libvirt_nwfilter.syms diff --git a/src/Makefile.am b/src/Makefile.am index 66dc349..17b2226 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -884,6 +884,10 @@ if WITH_LIBVIRTD USED_SYM_FILES += libvirt_daemon.syms endif +if WITH_NWFILTER +USED_SYM_FILES += libvirt_nwfilter.syms +endif + EXTRA_DIST += \ libvirt_public.syms \ libvirt_private.syms \ @@ -891,7 +895,8 @@ EXTRA_DIST += \ libvirt_bridge.syms \ libvirt_linux.syms \ libvirt_macvtap.syms \ - libvirt_daemon.syms + libvirt_daemon.syms \ + libvirt_nwfilter.syms BUILT_SOURCES += libvirt.syms libvirt.def diff --git a/src/libvirt_nwfilter.syms b/src/libvirt_nwfilter.syms new file mode 100644 index 0000000..106415f --- /dev/null +++ b/src/libvirt_nwfilter.syms @@ -0,0 +1,14 @@ +# +# These symbols are dependent on WITH_NWFILTER. +# + + +# nwfilter_gentech_driver.h +virNWFilterInstantiateFilter; +virNWFilterTeardownFilter; + + +# nwfilter_learnipaddr.h +virNWFilterGetIpAddrForIfname; +virNWFilterDelIpAddrForIfname; +virNWFilterLookupLearnReq; diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 7950bcd..f8e9d01 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -502,7 +502,7 @@ virNWFilterLockFilterUpdates; virNWFilterUnlockFilterUpdates; -#nwfilter_params.h +# nwfilter_params.h virNWFilterHashTableCreate; virNWFilterHashTableFree; virNWFilterHashTablePut; @@ -510,17 +510,6 @@ virNWFilterHashTablePutAll; virNWFilterHashTableRemoveEntry; -# nwfilter_gentech_driver.h -virNWFilterInstantiateFilter; -virNWFilterTeardownFilter; - - -# nwfilter_learnipaddr.h -virNWFilterGetIpAddrForIfname; -virNWFilterDelIpAddrForIfname; -virNWFilterLookupLearnReq; - - # pci.h pciGetDevice; pciFreeDevice; -- 1.6.3.3

2 2

[libvirt] [PATCH] xen: Fix inside_daemon being unused when libvirtd is disabled
by Matthias Bolte 23 Apr '10

23 Apr '10

The defined __sun is there, because inside_daemon is used in xenUnifiedOpen if __sun is defined. Also initialize it to 0. --- src/xen/xen_driver.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/xen/xen_driver.c b/src/xen/xen_driver.c index 5ab169d..b16a16a 100644 --- a/src/xen/xen_driver.c +++ b/src/xen/xen_driver.c @@ -70,7 +70,9 @@ static struct xenUnifiedDriver const * const drivers[XEN_UNIFIED_NR_DRIVERS] = { #endif }; -static int inside_daemon; +#if defined WITH_LIBVIRTD || defined __sun +static int inside_daemon = 0; +#endif #define xenUnifiedError(code, ...) \ virReportErrorHelper(NULL, VIR_FROM_XEN, code, __FILE__, \ -- 1.6.3.3

2 2

[libvirt] [PATCH] Disable stateful OpenNebula driver if libvirtd is disabled
by Matthias Bolte 23 Apr '10

23 Apr '10

Also move the equivalent checks for LXC and UML before their header checks. This way configure doesn't check for the headers when the driver gets disabled anyway. --- configure.ac | 15 +++++++++------ 1 files changed, 9 insertions(+), 6 deletions(-) diff --git a/configure.ac b/configure.ac index e34f417..aeab7d9 100644 --- a/configure.ac +++ b/configure.ac @@ -484,6 +484,9 @@ AC_CHECK_HEADERS([linux/kvm.h]) dnl dnl check for sufficient headers for LXC dnl +if test "$with_libvirtd" = "no" ; then + with_lxc=no +fi if test "$with_lxc" = "yes" || test "$with_lxc" = "check"; then AC_CHECK_HEADER([sched.h], dnl Header is there, check for unshare() @@ -514,9 +517,6 @@ if test "$with_lxc" = "yes" || test "$with_lxc" = "check"; then ]) fi -if test "$with_libvirtd" = "no" ; then - with_lxc=no -fi if test "$with_lxc" = "yes" ; then AC_DEFINE_UNQUOTED([WITH_LXC], 1, [whether LXC driver is enabled]) fi @@ -538,6 +538,9 @@ PKG_PROG_PKG_CONFIG dnl OpenNebula driver Compilation setting dnl +if test "$with_libvirtd" = "no" ; then + with_one=no +fi XMLRPC_CFLAGS= XMLRPC_LIBS= if test "x$with_one" = "xyes" || test "x$with_one" = "xcheck"; then @@ -1071,6 +1074,9 @@ dnl dnl Checks for the UML driver dnl +if test "$with_libvirtd" = "no" ; then + with_uml=no +fi if test "$with_uml" = "yes" || test "$with_uml" = "check"; then AC_CHECK_HEADER([sys/inotify.h], [ with_uml=yes @@ -1083,9 +1089,6 @@ if test "$with_uml" = "yes" || test "$with_uml" = "check"; then fi ]) fi -if test "$with_libvirtd" = "no" ; then - with_uml=no -fi if test "$with_uml" = "yes" ; then AC_DEFINE_UNQUOTED([WITH_UML], 1, [whether UML driver is enabled]) fi -- 1.6.3.3

2 2

[libvirt] [PATCH] Improve configure error message about missing Linux headers
by Matthias Bolte 23 Apr '10

23 Apr '10

--- configure.ac | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 99bc906..e34f417 100644 --- a/configure.ac +++ b/configure.ac @@ -528,7 +528,7 @@ dnl check for kernel headers required by src/bridge.c dnl if test "$with_qemu" = "yes" || test "$with_lxc" = "yes" ; then AC_CHECK_HEADERS([linux/param.h linux/sockios.h linux/if_bridge.h linux/if_tun.h],, - AC_MSG_ERROR([You must install kernel-headers in order to compile libvirt])) + AC_MSG_ERROR([You must install kernel-headers in order to compile libvirt with QEMU or LXC support])) fi -- 1.6.3.3

2 2

[libvirt] [PATCH] build: don't include winsock2.h on cygwin
by Eric Blake 23 Apr '10

23 Apr '10

Under cygwin, winsock2.h is intentionally incompatible with, <sys/socket.h>, and checking for existence is wrong. Under mingw, HAVE_WINSOCK2_H is defined on our behalf by gnulib, in a way that does not interfere with cygwin. * configure.ac: Drop unnecessary header check. Reported by Matthias Bolte. --- configure.ac | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 99bc906..deaa697 100644 --- a/configure.ac +++ b/configure.ac @@ -112,7 +112,8 @@ dnl Availability of various not common threadsafe functions AC_CHECK_FUNCS([strerror_r strtok_r getmntent_r getgrnam_r getpwuid_r]) dnl Availability of various common headers (non-fatal if missing). -AC_CHECK_HEADERS([pwd.h paths.h regex.h sys/syslimits.h sys/utsname.h sys/wait.h winsock2.h sched.h termios.h sys/poll.h syslog.h mntent.h net/ethernet.h]) +AC_CHECK_HEADERS([pwd.h paths.h regex.h sys/syslimits.h sys/utsname.h + sys/wait.h sched.h termios.h sys/poll.h syslog.h mntent.h net/ethernet.h]) dnl Where are the XDR functions? dnl If portablexdr is installed, prefer that. -- 1.6.6.1

2 3

[libvirt] [PATCH 0/1] pushed the following trivial patch
by David Allan 23 Apr '10

23 Apr '10

I just pushed the following trivial patch to fix a problem with indentation in the domain XML. The problem was reported as: https://bugzilla.redhat.com/show_bug.cgi?id=573908 Dave David Allan (1): Properly indent encryption tags src/conf/storage_encryption_conf.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)

5 5

[libvirt] [RESEND] qemu_monitor_json: Drop timestamp from command object
by Luiz Capitulino 23 Apr '10

23 Apr '10

It's not needed and is currently ignored, but this is a bug. It will get fixed soon and QMP will return an error for keys it doesn't know about, this will break libvirt. Signed-off-by: Luiz Capitulino <lcapitulino(a)redhat.com> --- src/qemu/qemu_monitor_json.c | 34 ---------------------------------- 1 files changed, 0 insertions(+), 34 deletions(-) diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 96f246f..7c8387d 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -356,37 +356,6 @@ qemuMonitorJSONHasError(virJSONValuePtr reply, return STREQ(klass, thisklass); } -static int -qemuMonitorJSONCommandAddTimestamp(virJSONValuePtr obj) -{ - struct timeval tv; - virJSONValuePtr timestamp = NULL; - - if (gettimeofday(&tv, NULL) < 0) { - virReportSystemError(errno, "%s", - _("cannot query time of day")); - return -1; - } - - if (!(timestamp = virJSONValueNewObject())) - goto no_memory; - - if (virJSONValueObjectAppendNumberLong(timestamp, "seconds", tv.tv_sec) < 0) - goto no_memory; - if (virJSONValueObjectAppendNumberLong(timestamp, "microseconds", tv.tv_usec) < 0) - goto no_memory; - - if (virJSONValueObjectAppend(obj, "timestamp", timestamp) < 0) - goto no_memory; - - return 0; - -no_memory: - virReportOOMError(); - virJSONValueFree(timestamp); - return -1; -} - static virJSONValuePtr ATTRIBUTE_SENTINEL qemuMonitorJSONMakeCommand(const char *cmdname, ...) @@ -404,9 +373,6 @@ qemuMonitorJSONMakeCommand(const char *cmdname, if (virJSONValueObjectAppendString(obj, "execute", cmdname) < 0) goto no_memory; - if (qemuMonitorJSONCommandAddTimestamp(obj) < 0) - goto error; - while ((key = va_arg(args, char *)) != NULL) { int ret; char type; -- 1.7.1.rc1.12.ga6018

3 2

[libvirt] [PATCH] nwfilter: extend schema + add testcase w/ connlimit-above test
by Stefan Berger 23 Apr '10

23 Apr '10

I am extending the schema with the recently added connlimit-above attribute and adding a test case to the test suite. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/schemas/nwfilter.rng | 5 +++++ tests/nwfilterxml2xmlin/conntrack-test.xml | 14 ++++++++++++++ tests/nwfilterxml2xmlout/conntrack-test.xml | 12 ++++++++++++ tests/nwfilterxml2xmltest.c | 2 ++ 4 files changed, 33 insertions(+) Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -387,6 +387,11 @@ <ref name="sixbitrange"/> </attribute> </optional> + <optional> + <attribute name="connlimit-above"> + <ref name="uint16range"/> + </attribute> + </optional> </interleave> </define> Index: libvirt-acl/tests/nwfilterxml2xmlin/conntrack-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/conntrack-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase' chain='root'> + <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid> + <rule action='drop' direction='out' priority='500'> + <icmp connlimit-above='1'/> + </rule> + <rule action='drop' direction='out' priority='500'> + <tcp connlimit-above='2'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <all/> + </rule> +</filter> + + Index: libvirt-acl/tests/nwfilterxml2xmlout/conntrack-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/conntrack-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid> + <rule action='drop' direction='out' priority='500'> + <icmp connlimit-above='1'/> + </rule> + <rule action='drop' direction='out' priority='500'> + <tcp connlimit-above='2'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -119,6 +119,8 @@ mymain(int argc, char **argv) DO_TEST("icmp-direction2-test"); DO_TEST("icmp-direction3-test"); + DO_TEST("conntrack-test"); + return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); }

2 2

[libvirt] [RFC] libvirt-TCK scripts to verify spoofing prevention
by Gerhard Stenzel 23 Apr '10

23 Apr '10

The following patch mainly adds a set of test case to verify that several spoofing attacks are prevented by the nwfilter subsystem. In order to have a well defined test machine, the patch also includes test scripts to network install a virtual disk from scratch, to boot the virtual test machine prior to running the actual test scripts and to shut it down afterwards. While I have tried to remove as much dependency on my local setup as possible there is still some left, so I am currently more interested in feedback about the general approach, not necessarily actual inclusion into the libvirt-TCK git. For example, I am currently trying to find a suitable location for the kickstart file, and also a suitable place for the common_functions.pl. Comments are appreciated ... thanks, Gerhard Index: libvirt-tck/scripts/network/README =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/README @@ -0,0 +1,14 @@ + +Test cases: + +000-install-image.t creates and install a 2GB fedora virtual disk via kickstart file from the network +001-boot-image.t defines and boots a VM which uses the fedora virtual disk +100-ping-still-working.t verifies the VM is pingable +210-no-mac-spoofing.t verifies mac spoofing is prevented +220-no-ip-spoofing.t verifies ip spoofing is prevented +230-no-mac-broadcast.t verifies mac broadcasting is prevented +240-no-arp-spoofing.t verifies arp spoofing is prevented +999-shutdown-image.t shuts the VM down + + + Index: libvirt-tck/scripts/network/000-install-image.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/000-install-image.t @@ -0,0 +1,181 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/000-install-image.t - install network test image + +=head1 DESCRIPTION + +The test case creates and install a 2GB fedora virtual +disk via kickstart file from the network. + +=cut + +use strict; +use warnings; + +use Test::More tests => 1; + +use Sys::Virt::TCK; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { $tck->cleanup if $tck; } + +# variables which may need to be adapted +my $domain_name ="f12nwtest"; +my $disk_name = "/var/lib/libvirt/images/${domain_name}.img"; +my $disk_size = "2147483648"; + +my $kickstart_file ="http://192.168.122.1/ks.cfg"; +my $cmdline = "ip=dhcp gateway=192.168.122.1 ks=${kickstart_file}"; + +# see if the domain already exits +my $already_defined = 0; +diag "searching if ${domain_name} is already defined"; +my $nnames = $conn->num_of_defined_domains(); +my @names = $conn->list_defined_domain_names($nnames); +foreach (@names){ + if (/${domain_name}/) { + print "$_ already exists, no need to redefine\n"; + $already_defined = 1; + } +} +diag $already_defined; + +# check for installation disk and build it if not exists +my $already_installed = 0; +my $pool = $conn->get_storage_pool_by_name("default"); +my $nnames = $pool->num_of_storage_volumes(); +my @volNames = $pool->list_storage_vol_names($nnames); +foreach (@volNames){ + if (/${domain_name}/) { + print "$_ already exists, no need to install\n"; + $already_installed = 1; + } +} + +my $volumexml = "<volume>". +" <name>${domain_name}.img</name>". +" <key>${disk_name}</key>". +" <source>". +" </source>". +" <capacity>${disk_size}</capacity>". +" <allocation>4096</allocation>". +" <target>". +" <path>${disk_name}</path>". +" <format type='raw'/>". +" <permissions>". +" <mode>0644</mode>". +" <owner>0</owner>". +" <group>0</group>". +" </permissions>". +" </target>". +"</volume>"; + + +# prepare image +if ($already_installed == 0) { + diag "Creating ${disk_name}"; + diag $volumexml; + my $vol = $pool->create_volume($volumexml) +# system("qemu-img create ${disk_name} ${disk_size}"); +} + +my $topxml = " <name>${domain_name}</name>". +" <memory>524288</memory>". +" <currentMemory>524288</currentMemory>". +" <vcpu>1</vcpu>"; + +my $osxml = " <os>". +" <type arch='x86_64' machine='fedora-13'>hvm</type>". +" <kernel>/var/cache/libvirt-tck/os-i686-hvm/vmlinuz</kernel>". +" <initrd>/var/cache/libvirt-tck/os-i686-hvm/initrd</initrd>". +" <cmdline>${cmdline}</cmdline>". +" <boot dev='hd'/>". +" </os>"; + +my $bottomxml = " <features>". +" <acpi/>". +" <apic/>". +" </features>". +" <clock offset='utc'/>". +" <on_poweroff>destroy</on_poweroff>". +" <on_reboot>restart</on_reboot>". +" <on_crash>restart</on_crash>". +" <devices>". +" <emulator>/usr/bin/qemu-kvm</emulator>". +" <disk type='file' device='disk'>". +" <driver name='qemu' type='raw'/>". +" <source file='${disk_name}'/>". +" <target dev='hda' bus='ide'/>". +" </disk>". +" <controller type='ide' index='0'>". +" </controller>". +" <interface type='network'>". +" <source network='default'/>". +" <target dev='vnet0'/>". +" <model type='virtio'/>". +" </interface>". +" <serial type='pty'>". +" <target port='0'/>". +" </serial>". +" <console type='pty'>". +" <target port='0'/>". +" </console>". +" <graphics type='vnc' port='-1' autoport='yes' listen='127.0.0.1' keymap='de'/>". +" <video>". +" <model type='cirrus' vram='9216' heads='1'/>". +" </video>". +" </devices>"; + +my $xml = "<domain type='kvm'>" . +$topxml. +$osxml. +$bottomxml. +"</domain>"; + +diag $xml; +diag "Defining an inactive domain config"; +my $dom; + +# no need to start if already installed +if (($already_installed == 0) && ($already_defined == 0)) { + ok_domain(sub { $dom = $conn->define_domain($xml) }, "defined persistent domain config"); + $xml = $dom->get_xml_description; + diag $xml; + diag "Starting inactive domain config"; + $dom->create; + + # wait for completion of installation + diag "wait for installation to finish .. "; + while($dom->is_active()) { + sleep(10); + diag ".. to view progress connect to virtual machine ${domain_name} .. "; + } + sleep(10); + diag " .. done"; + # cleanup + $dom->undefine; +} else { + ok_domain { $dom = $conn->get_domain_by_name($domain_name) } "the existing domain object"; +} + + + + + Index: libvirt-tck/scripts/network/001-boot-image.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/001-boot-image.t @@ -0,0 +1,133 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/001-boot-image.t - boot installed test image + +=head1 DESCRIPTION + +The test case defines and boots a VM which uses the +fedora virtual disk create ny 000-install-image + +=cut + +use strict; +use warnings; + +use Test::More tests => 2; + +use Sys::Virt::TCK; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { $tck->cleanup if $tck; } + +my $already_defined = 0; +my $domain_name ="f12nwtest"; + +# see if the domain already exits +diag "searching if ${domain_name} is already defined"; +my $nnames = $conn->num_of_defined_domains(); +my @names = $conn->list_defined_domain_names($nnames); +foreach (@names){ + if (/${domain_name}/) { + print "$_ already exists, no need to redefine\n"; + $already_defined = 1; + } +} +diag $already_defined; + +my $dom; +my $xml; + +if ($already_defined == 1) { + ok_domain { $dom = $conn->get_domain_by_name($domain_name) } "the existing domain object"; +} else { + my $topxml = " <name>${domain_name}</name>". + " <memory>524288</memory>". + " <currentMemory>524288</currentMemory>". + " <vcpu>1</vcpu>"; + + my $osxml = " <os>". + " <type arch='x86_64' machine='fedora-13'>hvm</type>". + " <boot dev='hd'/>". + " </os>"; + + my $bottomxml = " <features>". + " <acpi/>". + " <apic/>". + " </features>". + " <clock offset='utc'/>". + " <on_poweroff>destroy</on_poweroff>". + " <on_reboot>restart</on_reboot>". + " <on_crash>restart</on_crash>". + " <devices>". + " <emulator>/usr/bin/qemu-kvm</emulator>". + " <disk type='file' device='disk'>". + " <driver name='qemu' type='raw'/>". + " <source file='/var/lib/libvirt/images/${domain_name}.img'/>". + " <target dev='hda' bus='ide'/>". + " </disk>". + " <controller type='ide' index='0'>". + " </controller>". + " <interface type='network'>". + " <source network='default'/>". + " <filterref filter='no-spoofing'/>". + " <target dev='vnet0'/>". + " <model type='virtio'/>". + " </interface>". + " <serial type='pty'>". + " <target port='0'/>". + " </serial>". + " <console type='pty'>". + " <target port='0'/>". + " </console>". + " <graphics type='vnc' port='-1' autoport='yes' listen='127.0.0.1' keymap='de'/>". + " <video>". + " <model type='cirrus' vram='9216' heads='1'/>". + " </video>". + " </devices>"; + + $xml = "<domain type='kvm'>" . + $topxml. + $osxml. + $bottomxml. + "</domain>"; + + diag $xml; + diag "Defining an inactive domain config"; + ok_domain(sub { $dom = $conn->define_domain($xml) }, "defined persistent domain config"); +} + +# already existing or newly defined, start it up +$dom->create; +my $uuid = $dom->get_uuid_string(); +diag $uuid; +$xml = $dom->get_xml_description(); +diag $xml; +ok($dom->get_id() > 0, "running domain has an ID > 0"); + +my $mac = get_macaddress($xml); +diag $mac; +# wait for guest to boot and request dhcp +sleep(20); +my $ip = get_ip_from_leases($mac); +diag "ip is $ip"; + Index: libvirt-tck/scripts/network/100-ping-still-working.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/100-ping-still-working.t @@ -0,0 +1,71 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/100-ping-still-working.t - verify machines can be pinged from host + +=head1 DESCRIPTION + +The test case validates that it is possible to ping a guest machine from +the host. + +=cut + +use strict; +use warnings; + +use Test::More tests => 4; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# create first domain and start it +diag "Trying domain lookup by name"; +my $dom1; +my $domain_name ="f12nwtest"; + +ok_domain { $dom1 = $conn->get_domain_by_name($domain_name) } "the running domain object"; +my $xml = $dom1->get_xml_description; +diag $xml; +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $mac1 = get_macaddress($xml); +diag $mac1; +my $guestip1 = get_ip_from_leases($mac1); +diag "ip is $guestip1"; + +# check ebtables entry +my $ebtable1 = `/sbin/ebtables -L;/sbin/ebtables -t nat -L`; +diag $ebtable1; +# fixme to include mac adress +ok($ebtable1 =~ "vnet0", "check ebtables entry"); + +# ping guest1 +my $ping1 = `ping -c 10 $guestip1`; +diag $ping1; +ok($ping1 =~ "10 received", "ping $guestip1 test"); + +exit 0; Index: libvirt-tck/scripts/network/210-no-mac-spoofing.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/210-no-mac-spoofing.t @@ -0,0 +1,113 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/210-no-mac-spoofing.t - verify MAC spoofing is prevented + +=head1 DESCRIPTION + +The test case validates that MAC spoofing is prevented + +=cut + +use strict; +use warnings; + +use Test::More tests => 5; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# create first domain and start it +diag "Trying domain lookup by name"; +my $domain_name ="f12nwtest"; +my $dom1; +ok_domain { $dom1 = $conn->get_domain_by_name($domain_name) } "the running domain object"; +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $xml = $dom1->get_xml_description; +diag $xml; + +# check ebtables entry +my $ebtable1 = `/sbin/ebtables -L;/sbin/ebtables -t nat -L`; +diag $ebtable1; +# fixme to include mac adress +ok($ebtable1 =~ "vnet0", "check ebtables entry"); + +# wait for guest to boot +diag "waiting for guests to boot"; +#system("sleep 20"); +diag "done"; + +# ping guest1 first nic +my $mac1 = get_macaddress($xml); +diag "$mac1"; +my $guestip1 = get_ip_from_leases($mac1); +diag "ip is $guestip1"; +my $gateway = "192.168.122.1"; +my $macfalse = "52:54:00:f9:21:22"; +my $ping1 = `ping -c 10 $guestip1`; +diag $ping1; +ok($ping1 =~ "10 received", "ping $guestip1 test"); + +# log into guest +my $ssh = Net::SSH::Perl->new($guestip1); +$ssh->login("root", "foobar"); + +# now bring eth0 down, change MAC and bring it up again +diag "fiddling with mac"; +my $cmdfile = "echo '" . + "/sbin/ifconfig eth0\n". + "/sbin/ifconfig eth0 down\n". + "/sbin/ifconfig eth0 hw ether ${macfalse}\n". + "/sbin/ifconfig eth0 up\n". + "/sbin/ifconfig eth0\n". + "ping -c 10 ${gateway}\n". + "/sbin/ifconfig eth0 down\n". + "/sbin/ifconfig eth0 hw ether ${mac1}\n". + "/sbin/ifconfig eth0 up\n". + "/sbin/ifconfig eth0\n". + "' > /test.sh"; +diag $cmdfile; +my ($stdout, $stderr, $exit) = $ssh->cmd($cmdfile); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("chmod +x /test.sh"); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("/test.sh > /test.log"); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("cat /test.log"); +diag $stdout; +diag $stderr; +diag $exit; +ok($stdout =~ "100% packet loss", "packet loss expected"); + +exit 0; Index: libvirt-tck/scripts/network/230-no-mac-broadcast.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/230-no-mac-broadcast.t @@ -0,0 +1,102 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/230-no-mac-broadcast.t - verify MAC broadcasts are prevented + +=head1 DESCRIPTION + +The test case validates that MAC broadcasts are prevented + +=cut + +use strict; +use warnings; + +use Test::More tests => 4; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# create first domain and start it +diag "Trying domain lookup by name"; +my $dom1; +ok_domain { $dom1 = $conn->get_domain_by_name("f12nwtest") } "the running domain object"; + +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $xml = $dom1->get_xml_description; +diag $xml; +my $mac1 = get_macaddress($xml); +diag "$mac1"; +my $guestip1 = get_ip_from_leases($mac1); +diag "ip is $guestip1"; + +# check ebtables entry +my $ebtable1 = `/sbin/ebtables -L;/sbin/ebtables -t nat -L`; +diag $ebtable1; +# fixme to include mac adress +ok($ebtable1 =~ "vnet0", "check ebtables entry"); + +# prepare tcpdump +diag "prepare tcpdump"; +system("/usr/sbin/tcpdump -v -i virbr0 -n host 255.255.255.255 2> /tmp/tcpdump.log &"); + +# log into guest +my $ssh = Net::SSH::Perl->new($guestip1); +$ssh->login("root", "foobar"); + +# now generate a mac broadcast paket +diag "generate mac broadcast"; +my $cmdfile = "echo '" . + "/bin/ping -c 1 192.168.122.255 -b\n". + "' > /test.sh"; +diag $cmdfile; +my ($stdout, $stderr, $exit) = $ssh->cmd($cmdfile); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("chmod +x /test.sh"); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("/test.sh > /test.log"); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("cat /test.log"); +diag $stdout; +diag $stderr; +diag $exit; + +# now stop tcpdump and verify result +diag "stopping tcpdump"; +system("kill -15 `/sbin/pidof tcpdump`"); +my $tcpdumplog = `cat /tmp/tcpdump.log`; +diag($tcpdumplog); +ok($tcpdumplog =~ "0 packets captured", "tcpdump expected to capture no packets"); + +exit 0; Index: libvirt-tck/scripts/network/240-no-arp-spoofing.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/240-no-arp-spoofing.t @@ -0,0 +1,111 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/240-no-arp-spoofing.t - verify ARP spoofing is prevented + +=head1 DESCRIPTION + +The test case validates that ARP spoofing is prevented + +=cut + +use strict; +use warnings; + +use Test::More tests => 4; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $spoofid = "192.168.122.183"; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# looking up domain +diag "Trying domain lookup by name"; +my $dom1; +my $domain_name ="f12nwtest"; +ok_domain { $dom1 = $conn->get_domain_by_name($domain_name) } "the running domain object"; +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $xml = $dom1->get_xml_description; +diag $xml; +my $mac1 = get_macaddress($xml); +diag "$mac1"; +my $guestip1 = get_ip_from_leases($mac1); +diag "ip is $guestip1"; + +# check ebtables entry +my $ebtable1 = `/sbin/ebtables -L;/sbin/ebtables -t nat -L`; +diag $ebtable1; +# check if mac address is listed +ok($ebtable1 =~ "$guestip1", "check ebtables entry"); + +# prepare tcpdump +diag "prepare tcpdump"; +system("/usr/sbin/tcpdump -v -i virbr0 not ip > /tmp/tcpdump.log &"); + +# log into guest +my $ssh = Net::SSH::Perl->new($guestip1); +$ssh->login("root", "foobar"); + +# now generate a arp spoofing packets +diag "generate arpspoof"; +my $cmdfile = "echo '" . + "/usr/bin/yum -y install dsniff\n". + "/usr/sbin/arpspoof ${spoofid} &\n". + "/bin/sleep 10\n". + "kill -15 `/sbin/pidof arpspoof`\n". + "' > /test.sh"; +diag "content of cmdfile:"; +diag $cmdfile; +diag "creating cmdfile"; +my ($stdout, $stderr, $exit) = $ssh->cmd($cmdfile); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("chmod +x /test.sh"); +diag $stdout; +diag $stderr; +diag $exit; +diag "excuting cmdfile"; +($stdout, $stderr, $exit) = $ssh->cmd("/test.sh > /test.log"); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("echo test.log\ncat /test.log"); +diag $stdout; +diag $stderr; +diag $exit; + +# now stop tcpdump and verify result +diag "stopping tcpdump"; +system("kill -15 `/sbin/pidof tcpdump`"); +diag "tcpdump.log:"; +my $tcpdumplog = `cat /tmp/tcpdump.log`; +diag($tcpdumplog); +ok($tcpdumplog !~ "${spoofid} is-at", "tcpdump expected to capture no arp reply packets"); + +exit 0; Index: libvirt-tck/scripts/network/220-no-ip-spoofing.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/220-no-ip-spoofing.t @@ -0,0 +1,101 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/220-no-ip-spoofing.t - verify IP spoofing is prevented + +=head1 DESCRIPTION + +The test case validates that IP spoofing is prevented + +=cut + +use strict; +use warnings; + +use Test::More tests => 4; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# looking up domain +diag "Trying domain lookup by name"; +my $dom1; +my $domain_name ="f12nwtest"; + +ok_domain { $dom1 = $conn->get_domain_by_name($domain_name) } "the running domain object"; +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $xml = $dom1->get_xml_description; +diag $xml; +my $mac1 = get_macaddress($xml); +diag "$mac1"; +my $guestip1 = get_ip_from_leases($mac1); +diag "ip is $guestip1"; + +# check ebtables entry +my $ebtable1 = `/sbin/ebtables -L;/sbin/ebtables -t nat -L`; +diag $ebtable1; +# check if IP address is listed +ok($ebtable1 =~ "$guestip1", "check ebtables entry"); + +# log into guest +my $ssh = Net::SSH::Perl->new($guestip1); +$ssh->login("root", "foobar"); + +# now bring eth0 down, change IP and bring it up again +diag "preparing ip spoof"; +my $cmdfile = "echo '" . + "/bin/sleep 1\n". + "/sbin/ifconfig eth0\n". + "/sbin/ifconfig eth0 down\n". + "/sbin/ifconfig eth0 192.168.122.183 netmask 255.255.255.0 up\n". + "/sbin/ifconfig eth0\n". + "/bin/sleep 1\n". + "/bin/ping -c 1 192.168.122.1\n". + "/sbin/ifconfig eth0 down\n". + "/sbin/ifconfig eth0 ${guestip1} netmask 255.255.255.0 up\n". + "/sbin/ifconfig eth0 \n". + "/bin/sleep 1\n". + "' > /test.sh"; +diag $cmdfile; +my ($stdout, $stderr, $exit) = $ssh->cmd($cmdfile); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("chmod +x /test.sh"); +diag $stdout; +diag $stderr; +diag $exit; +diag "running ip spoof"; +($stdout, $stderr, $exit) = $ssh->cmd("/test.sh"); +diag $stdout; +diag $stderr; +diag $exit; +diag "checking result"; +ok($stdout =~ "100% packet loss", "packet loss expected"); + +exit 0; Index: libvirt-tck/scripts/network/999-shutdown-image.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/999-shutdown-image.t @@ -0,0 +1,59 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/240-no-arp-spoofing.t - verify ARP spoofing is prevented + +=head1 DESCRIPTION + +The test case validates that ARP spoofing is prevented + +=cut + +use strict; +use warnings; + +use Test::More tests => 2; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; + + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# find domain +my $domain_name = "f12nwtest"; +diag "Trying domain lookup by name"; +my $dom; +ok_domain { $dom = $conn->get_domain_by_name($domain_name) } "the running domain object"; +ok($dom->get_id() > 0, "running domain has an ID > 0"); + +# cleanup guest +diag "cleaning up"; +$dom->shutdown(); + while($dom->is_active()) { + sleep(1); + diag ".. waiting for virtual machine ${domain_name} to shutdown.. "; + } +#$dom->undefine(); + +exit 0; Index: libvirt-tck/scripts/network/common_functions.pl =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/common_functions.pl @@ -0,0 +1,35 @@ +use utf8; +#no utf8; + +sub get_macaddress { + my $xmldesc = shift; + + my $mac; + my $parser = XML::LibXML->new(); + + my $doc = $parser->parse_string($xmldesc); + + my $rootel = $doc -> getDocumentElement(); + + my @devices = $rootel->getChildrenByTagName("devices"); + foreach my $device(@devices) { + my @interfaces = $device->getChildrenByTagName("interface"); + foreach my $interface(@interfaces) { + my @targets = $interface->getChildrenByTagName("mac"); + foreach my $target(@targets) { + $mac = $target->getAttribute("address"); + } + } + } + utf8::decode($mac); + return $mac; +} + +sub get_ip_from_leases{ + my $mac = shift; + my $tmp = `grep $mac /var/lib/dnsmasq/dnsmasq.leases`; + my @fields = split(/ /, $tmp); + my $ip = $fields[2]; + return $ip; +} +1; -- Best regards, Gerhard Stenzel, ----------------------------------------------------------------------------------------------------------------------------------- IBM Deutschland Research & Development GmbH Vorsitzender des Aufsichtsrats: Martin Jetter Geschäftsführung: Dirk Wittkopp Sitz der Gesellschaft: Böblingen Registergericht: Amtsgericht Stuttgart, HRB 243294

2 2

[libvirt] [PATCH] Fix security context references in DAC code
by spencer＠beyondabstraction.net 23 Apr '10

23 Apr '10

* The error messages coming from qemu's DAC support contain strings from the original SELinux security driver code. This just removes references to "security context" and other SELinux-isms from the DAC code. Signed-off-by: Spencer Shimko <sshimko(a)tresys.com> --- src/qemu/qemu_security_dac.c | 18 ++++++------------ 1 files changed, 6 insertions(+), 12 deletions(-) diff --git a/src/qemu/qemu_security_dac.c b/src/qemu/qemu_security_dac.c index 1883fbe..e408dbf 100644 --- a/src/qemu/qemu_security_dac.c +++ b/src/qemu/qemu_security_dac.c @@ -37,7 +37,7 @@ void qemuSecurityDACSetDriver(struct qemud_driver *newdriver) static int qemuSecurityDACSetOwnership(const char *path, int uid, int gid) { - VIR_INFO("Setting DAC context on '%s' to '%d:%d'", path, uid, gid); + VIR_INFO("Setting DAC user and group on '%s' to '%d:%d'", path, uid, gid); if (chown(path, uid, gid) < 0) { struct stat sb; @@ -51,24 +51,18 @@ qemuSecurityDACSetOwnership(const char *path, int uid, int gid) } } - /* if the error complaint is related to an image hosted on - * an nfs mount, or a usbfs/sysfs filesystem not supporting - * labelling, then just ignore it & hope for the best. - * The user hopefully set one of the necessary qemuSecurityDAC - * virt_use_{nfs,usb,pci} boolean tunables to allow it... - */ if (chown_errno == EOPNOTSUPP) { - VIR_INFO("Setting security context '%d:%d' on '%s' not supported by filesystem", + VIR_INFO("Setting user and group to '%d:%d' on '%s' not supported by filesystem", uid, gid, path); } else if (chown_errno == EPERM) { - VIR_INFO("Setting security context '%d:%d' on '%s' not permitted", + VIR_INFO("Setting user and group to '%d:%d' on '%s' not permitted", uid, gid, path); } else if (chown_errno == EROFS) { - VIR_INFO("Setting security context '%d:%d' on '%s' not possible on readonly filesystem", + VIR_INFO("Setting user and group to '%d:%d' on '%s' not possible on readonly filesystem", uid, gid, path); } else { virReportSystemError(chown_errno, - _("unable to set security context '%d:%d' on '%s'"), + _("unable to set user and group to '%d:%d' on '%s'"), uid, gid, path); return -1; } @@ -84,7 +78,7 @@ qemuSecurityDACRestoreSecurityFileLabel(const char *path) int err; char *newpath = NULL; - VIR_INFO("Restoring DAC context on '%s'", path); + VIR_INFO("Restoring DAC user and group on '%s'", path); if ((err = virFileResolveLink(path, &newpath)) < 0) { virReportSystemError(err, -- 1.6.6.1

2 2

[libvirt] [PATCH] addrToString: give better error message
by Eric Blake 22 Apr '10

22 Apr '10

The user probably doesn't care what the gai error numbers are, as much as what the failed conversion IP address was. * src/remote/remote_driver.c (addrToString): Mention which address could not be converted. * daemon/remote.c (addrToString): Likewise. --- In response to https://www.redhat.com/archives/libvir-list/2010-April/msg00219.html daemon/remote.c | 24 +++++++++++++++++------- src/remote/remote_driver.c | 22 ++++++++++++++++------ 2 files changed, 33 insertions(+), 13 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index 149176f..093e9c6 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -1,7 +1,7 @@ /* * remote.c: handlers for RPC method calls * - * Copyright (C) 2007, 2008, 2009 Red Hat, Inc. + * Copyright (C) 2007-2010 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -41,6 +41,7 @@ #include <string.h> #include <errno.h> #include <fnmatch.h> +#include <arpa/inet.h> #include "virterror_internal.h" #if HAVE_POLKIT0 @@ -3169,21 +3170,30 @@ remoteDispatchAuthList (struct qemud_server *server, #if HAVE_SASL /* - * NB, keep in sync with similar method in src/remote_internal.c + * NB, keep in sync with similar method in src/remote/remote_driver.c */ static char *addrToString(remote_error *rerr, - struct sockaddr_storage *sa, socklen_t salen) { + struct sockaddr_storage *ss, socklen_t salen) { char host[1024], port[20]; char *addr; int err; + struct sockaddr *sa = (struct sockaddr *)ss; - if ((err = getnameinfo((struct sockaddr *)sa, salen, + if ((err = getnameinfo(sa, salen, host, sizeof(host), port, sizeof(port), NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { - remoteDispatchFormatError(rerr, - _("Cannot resolve address %d: %s"), - err, gai_strerror(err)); + char ip[INET6_ADDRSTRLEN]; + + if (inet_ntop(sa->sa_family, sa->sa_data, ip, sizeof ip)) { + remoteDispatchFormatError(rerr, + _("Cannot resolve address %s: %s"), + ip, gai_strerror(err)); + } else { + remoteDispatchFormatError(rerr, + _("Cannot resolve address: %s"), + gai_strerror(err)); + } return NULL; } diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 44d8c26..752964f 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -32,6 +32,7 @@ #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> +#include <arpa/inet.h> /* Windows socket compatibility functions. */ #include <errno.h> @@ -6570,21 +6571,30 @@ remoteAuthenticate (virConnectPtr conn, struct private_data *priv, #if HAVE_SASL /* - * NB, keep in sync with similar method in remote/remote.c + * NB, keep in sync with similar method in daemon/remote.c */ -static char *addrToString(struct sockaddr_storage *sa, socklen_t salen) +static char *addrToString(struct sockaddr_storage *ss, socklen_t salen) { char host[NI_MAXHOST], port[NI_MAXSERV]; char *addr; int err; + struct sockaddr *sa = (struct sockaddr *)ss; - if ((err = getnameinfo((struct sockaddr *)sa, salen, + if ((err = getnameinfo(sa, salen, host, sizeof(host), port, sizeof(port), NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { - remoteError(VIR_ERR_UNKNOWN_HOST, - _("Cannot resolve address %d: %s"), - err, gai_strerror(err)); + char ip[INET6_ADDRSTRLEN]; + + if (inet_ntop(sa->sa_family, sa->sa_data, ip, sizeof ip)) { + remoteError(VIR_ERR_UNKNOWN_HOST, + _("Cannot resolve address %s: %s"), + ip, gai_strerror(err)); + } else { + remoteError(VIR_ERR_UNKNOWN_HOST, + _("Cannot resolve address: %s"), + gai_strerror(err)); + } return NULL; } -- 1.6.6.1

2 5

[libvirt] [PATCH V2] nwfilter: lock interface by its index
by Stefan Berger 22 Apr '10

22 Apr '10

Changes from V1 to V2: - using INT_BUFSIZE_BOUND() to determine the length of the buffersize for printing and integer into - not explicitly initializing static var threadsTerminate to false anymore, since that's done automatically - there are 2 calls in the virNWFilterLockIface function that can fail due to OOM error; in case that happens, loop until the memory is available to avoid a failing lock. The call initializing the mutex should never fail with pthreads, otherwise we'd have a compile-time problem (wrong parameters for recursive lock) and may fail due to OOM error on win-32, so I am also looping there. The interface name may cause a failure, but callers should be certain at this point that the string is suitable. I am adding ATTRIBUTE_RETURN_CHECK to force the caller to check for failure and adapting the code where the function is called. Since the name of an interface can be the same between stops and starts of different VMs I have to switch the IP address learning thread to use the index of the interface to determine whether an interface is still available or not - in the case of macvtap the thread needs to listen for traffic on the physical interface, thus having to time out periodically to check whether the VM's macvtap device is still there as an indication that the VM is still alive. Previously the following sequence of 2 VMs with macvtap device virsh start testvm1; virsh destroy testvm1 ; virsh start testvm2 would not terminate the thread upon testvm1's destroy since the name of the interface on the host could be the same (i.e, macvtap0) on testvm1 and testvm2, thus it was easily race-able. The thread would then determine the IP address parameter for testvm2 but apply the rule set for testvm1. :-( I am also introducing a lock for the interface (by name) that the thread must hold while it listens for the traffic and releases when it terminates upon VM termination or 0.5 second thereafter. Thus, the new thread for a newly started VM with the same interface name will not start while the old one still holds the lock. The only other code that I see that also needs to grab the lock to serialize operation is the one that tears down the firewall that were established on behalf of an interface. I am moving the code applying the 'basic' firewall rules during the IP address learning phase inside the thread but won't start the thread unless it is ensured that the firewall driver has the ability to apply the 'basic' firewall rules. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_gentech_driver.c | 24 +++ src/nwfilter/nwfilter_gentech_driver.h | 2 src/nwfilter/nwfilter_learnipaddr.c | 239 +++++++++++++++++++++++++++------ src/nwfilter/nwfilter_learnipaddr.h | 7 4 files changed, 229 insertions(+), 43 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -36,6 +36,7 @@ #include <netinet/ip.h> #include <netinet/udp.h> #include <net/if_arp.h> +#include <intprops.h> #include "internal.h" @@ -54,6 +55,11 @@ #define VIR_FROM_THIS VIR_FROM_NWFILTER +#define IFINDEX2STR(VARNAME, ifindex) \ + char VARNAME[INT_BUFSIZE_BOUND(ifindex)]; \ + snprintf(VARNAME, sizeof(VARNAME), "%d", ifindex); + +#define PKT_TIMEOUT_MS 500 /* ms */ /* structure of an ARP request/reply message */ struct f_arphdr { @@ -109,6 +115,96 @@ static virHashTablePtr pendingLearnReq; static virMutex ipAddressMapLock; static virNWFilterHashTablePtr ipAddressMap; +static virMutex ifaceMapLock; +static virHashTablePtr ifaceLockMap; + +typedef struct _virNWFilterIfaceLock virNWFilterIfaceLock; +typedef virNWFilterIfaceLock *virNWFilterIfaceLockPtr; +struct _virNWFilterIfaceLock { + char ifname[IF_NAMESIZE]; + virMutex lock; + int refctr; +}; + + +static bool threadsTerminate = false; + + +int +virNWFilterLockIface(const char *ifname) { + virNWFilterIfaceLockPtr ifaceLock; + + virMutexLock(&ifaceMapLock); + + ifaceLock = virHashLookup(ifaceLockMap, ifname); + if (!ifaceLock) { + while (VIR_ALLOC(ifaceLock) < 0) { + /* wait for memory */ + usleep(50); + } + + if (virMutexInitRecursive(&ifaceLock->lock)) { + /* win32 - wait for memory */ + usleep(50); + } + + if (virStrcpyStatic(ifaceLock->ifname, ifname) == NULL) { + VIR_FREE(ifaceLock); + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("%s: interface name %s does not fit into " + "buffer "), + __FUNCTION__, ifaceLock->ifname); + goto err_exit; + } + + while (virHashAddEntry(ifaceLockMap, ifname, ifaceLock)) { + /* wait for memory */ + usleep(50); + } + + ifaceLock->refctr = 0; + } + + ifaceLock->refctr++; + + virMutexUnlock(&ifaceMapLock); + + virMutexLock(&ifaceLock->lock); + + return 0; + + err_exit: + virMutexUnlock(&ifaceMapLock); + + return 1; +} + + +static void +freeIfaceLock(void *payload, const char *name ATTRIBUTE_UNUSED) { + VIR_FREE(payload); +} + + +void +virNWFilterUnlockIface(const char *ifname) { + virNWFilterIfaceLockPtr ifaceLock; + + virMutexLock(&ifaceMapLock); + + ifaceLock = virHashLookup(ifaceLockMap, ifname); + + if (ifaceLock) { + virMutexUnlock(&ifaceLock->lock); + + ifaceLock->refctr--; + if (ifaceLock->refctr == 0) + virHashRemoveEntry(ifaceLockMap, ifname, freeIfaceLock); + } + + virMutexUnlock(&ifaceMapLock); +} + static void virNWFilterIPAddrLearnReqFree(virNWFilterIPAddrLearnReqPtr req) { @@ -127,10 +223,12 @@ virNWFilterIPAddrLearnReqFree(virNWFilte static int virNWFilterRegisterLearnReq(virNWFilterIPAddrLearnReqPtr req) { int res = -1; + IFINDEX2STR(ifindex_str, req->ifindex); + virMutexLock(&pendingLearnReqLock); - if (!virHashLookup(pendingLearnReq, req->ifname)) - res = virHashAddEntry(pendingLearnReq, req->ifname, req); + if (!virHashLookup(pendingLearnReq, ifindex_str)) + res = virHashAddEntry(pendingLearnReq, ifindex_str, req); virMutexUnlock(&pendingLearnReqLock); @@ -141,12 +239,13 @@ virNWFilterRegisterLearnReq(virNWFilterI virNWFilterIPAddrLearnReqPtr -virNWFilterLookupLearnReq(const char *ifname) { +virNWFilterLookupLearnReq(int ifindex) { void *res; + IFINDEX2STR(ifindex_str, ifindex); virMutexLock(&pendingLearnReqLock); - res = virHashLookup(pendingLearnReq, ifname); + res = virHashLookup(pendingLearnReq, ifindex_str); virMutexUnlock(&pendingLearnReqLock); @@ -163,15 +262,16 @@ freeLearnReqEntry(void *payload, const c #ifdef HAVE_LIBPCAP static virNWFilterIPAddrLearnReqPtr -virNWFilterDeregisterLearnReq(const char *ifname) { +virNWFilterDeregisterLearnReq(int ifindex) { virNWFilterIPAddrLearnReqPtr res; + IFINDEX2STR(ifindex_str, ifindex); virMutexLock(&pendingLearnReqLock); - res = virHashLookup(pendingLearnReq, ifname); + res = virHashLookup(pendingLearnReq, ifindex_str); if (res) - virHashRemoveEntry(pendingLearnReq, ifname, NULL); + virHashRemoveEntry(pendingLearnReq, ifindex_str, NULL); virMutexUnlock(&pendingLearnReqLock); @@ -274,7 +374,7 @@ static void * learnIPAddressThread(void *arg) { char errbuf[PCAP_ERRBUF_SIZE] = {0}; - pcap_t *handle; + pcap_t *handle = NULL; struct bpf_program fp; struct pcap_pkthdr header; const u_char *packet; @@ -285,19 +385,27 @@ learnIPAddressThread(void *arg) unsigned int ethHdrSize; char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev : req->ifname; - int to_ms = (strlen(req->linkdev) != 0) ? 1000 - : 0; int dhcp_opts_len; char macaddr[VIR_MAC_STRING_BUFLEN]; virBuffer buf = VIR_BUFFER_INITIALIZER; - char *filter= NULL; + char *filter = NULL; uint16_t etherType; + bool showError = true; enum howDetect howDetected = 0; virNWFilterTechDriverPtr techdriver = req->techdriver; + if (virNWFilterLockIface(req->ifname)) + goto err_no_lock; + req->status = 0; - handle = pcap_open_live(listen_if, BUFSIZ, 0, to_ms, errbuf); + /* anything change to the VM's interface -- check at least once */ + if (ifaceCheck(false, req->ifname, NULL, req->ifindex)) { + req->status = ENODEV; + goto done; + } + + handle = pcap_open_live(listen_if, BUFSIZ, 0, PKT_TIMEOUT_MS, errbuf); if (handle == NULL) { VIR_DEBUG("Couldn't open device %s: %s\n", listen_if, errbuf); @@ -309,11 +417,22 @@ learnIPAddressThread(void *arg) switch (req->howDetect) { case DETECT_DHCP: + if (techdriver->applyDHCPOnlyRules(req->ifname, + req->macaddr, + NULL)) { + req->status = EINVAL; + goto done; + } virBufferVSprintf(&buf, " ether dst %s" " and src port 67 and dst port 68", macaddr); break; default: + if (techdriver->applyBasicRules(req->ifname, + req->macaddr)) { + req->status = EINVAL; + goto done; + } virBufferVSprintf(&buf, "ether host %s", macaddr); } @@ -324,25 +443,36 @@ learnIPAddressThread(void *arg) filter = virBufferContentAndReset(&buf); - if (pcap_compile(handle, &fp, filter, 1, 0) != 0 || - pcap_setfilter(handle, &fp) != 0) { - VIR_DEBUG("Couldn't compile or set filter '%s'.\n", filter); + if (pcap_compile(handle, &fp, filter, 1, 0) != 0) { + VIR_DEBUG("Couldn't compile filter '%s'.\n", filter); req->status = EINVAL; goto done; } + if (pcap_setfilter(handle, &fp) != 0) { + VIR_DEBUG("Couldn't set filter '%s'.\n", filter); + req->status = EINVAL; + pcap_freecode(&fp); + goto done; + } + + pcap_freecode(&fp); + while (req->status == 0 && vmaddr == 0) { packet = pcap_next(handle, &header); if (!packet) { - if (to_ms == 0) { - /* assuming IF disappeared */ - req->status = ENODEV; + + if (threadsTerminate) { + req->status = ECANCELED; + showError = false; break; } - /* listening on linkdev, check whether VM's dev is still there */ - if (ifaceCheck(false, req->ifname, req->macaddr, -1)) { + + /* check whether VM's dev is still there */ + if (ifaceCheck(false, req->ifname, NULL, req->ifindex)) { req->status = ENODEV; + showError = false; break; } continue; @@ -470,6 +600,7 @@ learnIPAddressThread(void *arg) ret = virNWFilterInstantiateFilterLate(NULL, req->ifname, + req->ifindex, req->linkdev, req->nettype, req->macaddr, @@ -478,13 +609,23 @@ learnIPAddressThread(void *arg) req->driver); VIR_DEBUG("Result from applying firewall rules on " "%s with IP addr %s : %d\n", req->ifname, inetaddr, ret); + } else { + if (showError) + virReportSystemError(req->status, + "%s encountered an error. Shutting down " + "interface %s", + __FUNCTION__, req->ifname); + ifaceDown(req->ifname); } memset(&req->thread, 0x0, sizeof(req->thread)); VIR_DEBUG("pcap thread terminating for interface %s\n",req->ifname); - virNWFilterDeregisterLearnReq(req->ifname); + virNWFilterUnlockIface(req->ifname); + + err_no_lock: + virNWFilterDeregisterLearnReq(req->ifindex); virNWFilterIPAddrLearnReqFree(req); @@ -496,6 +637,7 @@ learnIPAddressThread(void *arg) * virNWFilterLearnIPAddress * @techdriver : driver to build firewalls * @ifname: the name of the interface + * @ifindex: the index of the interface * @linkdev : the name of the link device; currently only used in case of a * macvtap device * @nettype : the type of interface @@ -516,6 +658,7 @@ learnIPAddressThread(void *arg) int virNWFilterLearnIPAddress(virNWFilterTechDriverPtr techdriver, const char *ifname, + int ifindex, const char *linkdev, enum virDomainNetType nettype, const unsigned char *macaddr, @@ -530,6 +673,14 @@ virNWFilterLearnIPAddress(virNWFilterTec if (howDetect == 0) return 1; + if ( !techdriver->canApplyBasicRules()) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("IP parameter must be provided since " + "snooping the IP address does not work " + "possibly due to missing tools")); + return 1; + } + if (VIR_ALLOC(req) < 0) { virReportOOMError(); goto err_no_req; @@ -538,7 +689,7 @@ virNWFilterLearnIPAddress(virNWFilterTec ht = virNWFilterHashTableCreate(0); if (ht == NULL) { virReportOOMError(); - goto err_no_ht; + goto err_free_req; } if (virNWFilterHashTablePutAll(filterparams, ht)) @@ -565,6 +716,8 @@ virNWFilterLearnIPAddress(virNWFilterTec goto err_free_ht; } } + + req->ifindex = ifindex; req->nettype = nettype; memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); req->driver = driver; @@ -576,35 +729,21 @@ virNWFilterLearnIPAddress(virNWFilterTec rc = virNWFilterRegisterLearnReq(req); if (rc) - goto err_free_ht; - - switch (howDetect) { - case DETECT_DHCP: - if (techdriver->applyDHCPOnlyRules(ifname, - macaddr, - NULL)) - goto err_free_ht; - break; - default: - if (techdriver->applyBasicRules(ifname, - macaddr)) - goto err_free_ht; - } - + goto err_free_req; if (pthread_create(&req->thread, NULL, learnIPAddressThread, req) != 0) - goto err_remove_rules; + goto err_dereg_req; return 0; -err_remove_rules: - techdriver->removeBasicRules(ifname); +err_dereg_req: + virNWFilterDeregisterLearnReq(ifindex); err_free_ht: virNWFilterHashTableFree(ht); -err_no_ht: +err_free_req: virNWFilterIPAddrLearnReqFree(req); err_no_req: return 1; @@ -615,6 +754,7 @@ err_no_req: int virNWFilterLearnIPAddress(virNWFilterTechDriverPtr techdriver ATTRIBUTE_UNUSED, const char *ifname ATTRIBUTE_UNUSED, + int ifindex ATTRIBUTE_UNUSED, const char *linkdev ATTRIBUTE_UNUSED, enum virDomainNetType nettype ATTRIBUTE_UNUSED, const unsigned char *macaddr ATTRIBUTE_UNUSED, @@ -637,6 +777,12 @@ virNWFilterLearnIPAddress(virNWFilterTec */ int virNWFilterLearnInit(void) { + + if (pendingLearnReq) + return 0; + + threadsTerminate = false; + pendingLearnReq = virHashCreate(0); if (!pendingLearnReq) { virReportOOMError(); @@ -660,6 +806,18 @@ virNWFilterLearnInit(void) { return 1; } + ifaceLockMap = virHashCreate(0); + if (!ifaceLockMap) { + virReportOOMError(); + virNWFilterLearnShutdown(); + return 1; + } + + if (virMutexInit(&ifaceMapLock)) { + virNWFilterLearnShutdown(); + return 1; + } + return 0; } @@ -670,9 +828,18 @@ virNWFilterLearnInit(void) { */ void virNWFilterLearnShutdown(void) { + + threadsTerminate = true; + + while (virHashSize(pendingLearnReq) != 0) + usleep((PKT_TIMEOUT_MS * 1000) / 3); + virHashFree(pendingLearnReq, freeLearnReqEntry); pendingLearnReq = NULL; virNWFilterHashTableFree(ipAddressMap); ipAddressMap = NULL; + + virHashFree(ifaceLockMap, freeIfaceLock); + ifaceLockMap = NULL; } Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.h +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -35,6 +35,7 @@ typedef virNWFilterIPAddrLearnReq *virNW struct _virNWFilterIPAddrLearnReq { virNWFilterTechDriverPtr techdriver; char ifname[IF_NAMESIZE]; + int ifindex; char linkdev[IF_NAMESIZE]; enum virDomainNetType nettype; unsigned char macaddr[VIR_MAC_BUFLEN]; @@ -49,6 +50,7 @@ struct _virNWFilterIPAddrLearnReq { int virNWFilterLearnIPAddress(virNWFilterTechDriverPtr techdriver, const char *ifname, + int ifindex, const char *linkdev, enum virDomainNetType nettype, const unsigned char *macaddr, @@ -57,12 +59,15 @@ int virNWFilterLearnIPAddress(virNWFilte virNWFilterDriverStatePtr driver, enum howDetect howDetect); -virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(const char *ifname); +virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(int ifindex); void virNWFilterDelIpAddrForIfname(const char *ifname); const char *virNWFilterGetIpAddrForIfname(const char *ifname); +int virNWFilterLockIface(const char *ifname) ATTRIBUTE_RETURN_CHECK; +void virNWFilterUnlockIface(const char *ifname); + int virNWFilterLearnInit(void); void virNWFilterLearnShutdown(void); Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -557,6 +557,7 @@ virNWFilterInstantiate(virConnectPtr con enum virDomainNetType nettype, virNWFilterDefPtr filter, const char *ifname, + int ifindex, const char *linkdev, virNWFilterHashTablePtr vars, enum instCase useNewFilter, int *foundNewFilter, @@ -592,9 +593,10 @@ virNWFilterInstantiate(virConnectPtr con if (virHashSize(missing_vars->hashTable) == 1) { if (virHashLookup(missing_vars->hashTable, NWFILTER_STD_VAR_IP) != NULL) { - if (virNWFilterLookupLearnReq(ifname) == NULL) { + if (virNWFilterLookupLearnReq(ifindex) == NULL) { rc = virNWFilterLearnIPAddress(techdriver, ifname, + ifindex, linkdev, nettype, macaddr, filter->name, @@ -639,11 +641,22 @@ virNWFilterInstantiate(virConnectPtr con if (rc) goto err_exit; + if (virNWFilterLockIface(ifname)) + goto err_exit; + rc = techdriver->applyNewRules(conn, ifname, nptrs, ptrs); if (teardownOld && rc == 0) techdriver->tearOldRules(conn, ifname); + if (rc == 0 && ifaceCheck(false, ifname, NULL, ifindex)) { + /* interface changed/disppeared */ + techdriver->allTeardown(ifname); + rc = 1; + } + + virNWFilterUnlockIface(ifname); + VIR_FREE(ptrs); } @@ -666,6 +679,7 @@ static int __virNWFilterInstantiateFilter(virConnectPtr conn, bool teardownOld, const char *ifname, + int ifindex, const char *linkdev, enum virDomainNetType nettype, const unsigned char *macaddr, @@ -767,6 +781,7 @@ __virNWFilterInstantiateFilter(virConnec nettype, filter, ifname, + ifindex, linkdev, vars, useNewFilter, &foundNewFilter, @@ -798,9 +813,15 @@ _virNWFilterInstantiateFilter(virConnect const char *linkdev = (net->type == VIR_DOMAIN_NET_TYPE_DIRECT) ? net->data.direct.linkdev : NULL; + int ifindex; + + if (ifaceGetIndex(true, net->ifname, &ifindex)) + return 1; + return __virNWFilterInstantiateFilter(conn, teardownOld, net->ifname, + ifindex, linkdev, net->type, net->mac, @@ -814,6 +835,7 @@ _virNWFilterInstantiateFilter(virConnect int virNWFilterInstantiateFilterLate(virConnectPtr conn, const char *ifname, + int ifindex, const char *linkdev, enum virDomainNetType nettype, const unsigned char *macaddr, @@ -825,6 +847,7 @@ virNWFilterInstantiateFilterLate(virConn rc = __virNWFilterInstantiateFilter(conn, 1, ifname, + ifindex, linkdev, nettype, macaddr, Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -49,6 +49,7 @@ int virNWFilterTearOldFilter(virConnectP int virNWFilterInstantiateFilterLate(virConnectPtr conn, const char *ifname, + int ifindex, const char *linkdev, enum virDomainNetType nettype, const unsigned char *macaddr, @@ -77,6 +78,7 @@ virNWFilterTearNWFilter(virDomainNetDefP static inline void virNWFilterTearVMNWFilters(virDomainObjPtr vm) { int i; + for (i = 0; i < vm->def->nnets; i++) virNWFilterTearNWFilter(vm->def->nets[i]); }

2 2

[libvirt] [PATCH] Fix locking in qemudDomainCoreDump
by y＠orkuz.home 22 Apr '10

22 Apr '10

From: Jiri Denemark <jdenemar(a)redhat.com> The hang fix in d376b7d63ec1ef24ba4c812d58b9a414ddb561f8 was incomplete since it left quite a few {Enter,Exit}Monitor calls which require driver to be unlocked. Since the driver is locked throughout the whole function, {Enter,Exit}MonitorWithDriver need to be used instead to ensure driver is not locked when issuing monitor commands. --- src/qemu/qemu_driver.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 4afed2f..0a0d9bc 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5165,18 +5165,18 @@ static int qemudDomainCoreDump(virDomainPtr dom, /* Pause domain for non-live dump */ if (!(flags & VIR_DUMP_LIVE) && vm->state == VIR_DOMAIN_RUNNING) { - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStopCPUs(priv->mon) < 0) { - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); goto endjob; } - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); paused = 1; } - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); ret = qemuMonitorMigrateToCommand(priv->mon, 1, args, path); - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); if (ret < 0) goto endjob; @@ -5205,13 +5205,13 @@ endjob: will support synchronous operations so we always get here after the migration is complete. */ else if (resume && paused) { - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStartCPUs(priv->mon, dom->conn) < 0) { if (virGetLastError() == NULL) qemuReportError(VIR_ERR_OPERATION_FAILED, "%s", _("resuming after dump failed")); } - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); } if (qemuDomainObjEndJob(vm) == 0) -- 1.7.0.4

3 2

[libvirt] [PATCH] Poll for migration end every 50ms instead of 50us
by Jiri Denemark 22 Apr '10

22 Apr '10

The comment in qemuDomainWaitForMigrationComplete says we are polling every 50ms but the code sleeps only for 50us. This was already discussed during review but apparently forgotten when the series was pushed. --- src/qemu/qemu_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 89cd291..4afed2f 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4524,7 +4524,7 @@ qemuDomainWaitForMigrationComplete(struct qemud_driver *driver, virDomainObjPtr while (priv->jobInfo.type == VIR_DOMAIN_JOB_UNBOUNDED) { /* Poll every 50ms for progress & to allow cancellation */ - struct timespec ts = { .tv_sec = 0, .tv_nsec = 50 * 1000ull }; + struct timespec ts = { .tv_sec = 0, .tv_nsec = 50 * 1000 * 1000ull }; struct timeval now; int rc; -- 1.7.0.4

2 2

[libvirt] [PATCH v2 0/7] CPU selection fixes and tests
by Jiri Denemark 22 Apr '10

22 Apr '10

In this second version of the patchset, patches were reordered and a comment for format expected by qemudParseX86Models() was modified as suggested by Eric. In addition to these changes, qemu tests were fixed to pass on RHEL. Jirka Jiri Denemark (7): Deal with CPU models in [] Move MIN macro to util.h so that others can use it Support removing features when converting data to CPU Use configured CPU model if possible Fake host CPU for qemu tests Support for faking emulator in qemuxml2argv tests Tests for CPU selection in qemu driver src/cpu/cpu.c | 8 +- src/cpu/cpu.h | 6 +- src/cpu/cpu_x86.c | 82 +++++++++++++++----- src/qemu/qemu_conf.c | 39 ++++++++-- src/util/util.c | 4 - src/util/util.h | 4 + tests/qemuxml2argvdata/qemu.sh | 64 +++++++++++++++ .../qemuxml2argvdata/qemuxml2argv-cpu-exact1.args | 1 + tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.xml | 28 +++++++ .../qemuxml2argvdata/qemuxml2argv-cpu-exact2.args | 1 + tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.xml | 35 ++++++++ .../qemuxml2argv-cpu-minimum1.args | 1 + .../qemuxml2argvdata/qemuxml2argv-cpu-minimum1.xml | 21 +++++ .../qemuxml2argv-cpu-minimum2.args | 1 + .../qemuxml2argvdata/qemuxml2argv-cpu-minimum2.xml | 25 ++++++ .../qemuxml2argvdata/qemuxml2argv-cpu-strict1.args | 1 + .../qemuxml2argvdata/qemuxml2argv-cpu-strict1.xml | 38 +++++++++ .../qemuxml2argv-cpu-topology1.args | 1 + .../qemuxml2argv-cpu-topology1.xml | 21 +++++ .../qemuxml2argv-cpu-topology2.args | 1 + .../qemuxml2argv-cpu-topology2.xml | 22 +++++ .../qemuxml2argv-cpu-topology3.args | 1 + .../qemuxml2argv-cpu-topology3.xml | 21 +++++ tests/qemuxml2argvtest.c | 27 +++++++ tests/testutilsqemu.c | 30 +++++++- 25 files changed, 444 insertions(+), 39 deletions(-) create mode 100755 tests/qemuxml2argvdata/qemu.sh create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology1.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology1.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology2.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology2.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology3.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology3.xml

2 18

[libvirt] [PATCH] Fix locking in qemudDomainCoreDump
by Jiri Denemark 22 Apr '10

22 Apr '10

The hang fix in d376b7d63ec1ef24ba4c812d58b9a414ddb561f8 was incomplete since it left quite a few {Enter,Exit}Monitor calls which require driver to be unlocked. Since the driver is locked throughout the whole function, {Enter,Exit}MonitorWithDriver need to be used instead to ensure driver is not locked when issuing monitor commands. --- src/qemu/qemu_driver.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 4afed2f..0a0d9bc 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5165,18 +5165,18 @@ static int qemudDomainCoreDump(virDomainPtr dom, /* Pause domain for non-live dump */ if (!(flags & VIR_DUMP_LIVE) && vm->state == VIR_DOMAIN_RUNNING) { - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStopCPUs(priv->mon) < 0) { - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); goto endjob; } - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); paused = 1; } - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); ret = qemuMonitorMigrateToCommand(priv->mon, 1, args, path); - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); if (ret < 0) goto endjob; @@ -5205,13 +5205,13 @@ endjob: will support synchronous operations so we always get here after the migration is complete. */ else if (resume && paused) { - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStartCPUs(priv->mon, dom->conn) < 0) { if (virGetLastError() == NULL) qemuReportError(VIR_ERR_OPERATION_FAILED, "%s", _("resuming after dump failed")); } - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); } if (qemuDomainObjEndJob(vm) == 0) -- 1.7.0.4

2 2

[libvirt] [PATCH TCK] Add a minimal test case for CPU hotplug
by Daniel P. Berrange 22 Apr '10

22 Apr '10

Adds a minimal test case which verifies that it is possible to set the CPU count to max, and then back to the min. This really needs libguestfs integration to validate that the guest sees the change --- scripts/domain/130-cpu-hotplug.t | 78 ++++++++++++++++++++++++++++++++++++++ 1 files changed, 78 insertions(+), 0 deletions(-) create mode 100644 scripts/domain/130-cpu-hotplug.t diff --git a/scripts/domain/130-cpu-hotplug.t b/scripts/domain/130-cpu-hotplug.t new file mode 100644 index 0000000..2976f2d --- /dev/null +++ b/scripts/domain/130-cpu-hotplug.t @@ -0,0 +1,78 @@ +# -*- perl -*- +# +# Copyright (C) 2009-2010 Red Hat, Inc. +# Copyright (C) 2009-2010 Daniel P. Berrange +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +domain/130-cpu-hotplug.t - whether CPU count can be changed + +=head1 DESCRIPTION + +The test case validates the it is possible to change the CPU +on a running guest. + +XXX: Need libguestfs integration to check that it has truely +worked. + +=cut + +use strict; +use warnings; + +use Test::More tests => 7; +use Test::Exception; + +use Sys::Virt::TCK; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { $tck->cleanup if $tck; } + + +my $xml = $tck->generic_domain("tck")->as_xml; + + +diag "Creating a new transient domain"; +my $dom; +ok_domain(sub { $dom = $conn->create_domain($xml) }, "created transient domain object"); + +my $max; +lives_ok(sub { $max = $dom->get_max_vcpus() }, "queried max vcpus"); + +SKIP: { + skip "SMP guests not supported", 4 unless $max > 1; + + diag "Increasing CPU count to max"; + lives_ok(sub { $dom->set_vcpus($max); }, "set vcpus to $max"); + + my $info = $dom->get_info(); + + is($info->{nrVirtCpu}, $max, "cpu count $info->{nrVirtCpu} is $max"); + + diag "Decreasing CPU count to min"; + lives_ok(sub { $dom->set_vcpus(1); }, "set vcpus to 1"); + + $info = $dom->get_info(); + is($info->{nrVirtCpu}, 1, "cpu count $info->{nrVirtCpu} is 1"); +} + +diag "Destroying the transient domain"; +$dom->destroy; + +diag "Checking that transient domain has gone away"; +ok_error(sub { $conn->get_domain_by_name("tck") }, "NO_DOMAIN error raised from missing domain", 42); + +# end -- 1.6.5.2

2 2

[libvirt] [PATCH] configure.ac SELinux fixes
by spencer＠beyondabstraction.net 22 Apr '10

22 Apr '10

* Fix a logic error in configure.ac that prevented --with-selinux=no from being used with --with-secdriver-selinux=no. * Fix some strings to clarify the difference between --with-selinux and --with-secdriver-selinux. Signed-off-by: Spencer Shimko <sshimko(a)tresys.com> --- configure.ac | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) diff --git a/configure.ac b/configure.ac index 42c09b4..68dca54 100644 --- a/configure.ac +++ b/configure.ac @@ -869,14 +869,14 @@ if test "$with_selinux" != "no"; then AC_CHECK_HEADER([selinux/selinux.h],[],[fail=1]) AC_CHECK_LIB([selinux], [fgetfilecon],[],[fail=1]) test $fail = 1 && - AC_MSG_ERROR([You must install the SELinux development package in order to compile libvirt]) + AC_MSG_ERROR([You must install the libselinux development package in order to compile libvirt with basic SELinux support]) fi CFLAGS="$old_cflags" LIBS="$old_libs" fi if test "$with_selinux" = "yes"; then SELINUX_LIBS="-lselinux" - AC_DEFINE_UNQUOTED([HAVE_SELINUX], 1, [whether SELinux is available for security]) + AC_DEFINE_UNQUOTED([HAVE_SELINUX], 1, [whether basic SELinux functionality is available]) fi AM_CONDITIONAL([HAVE_SELINUX], [test "$with_selinux" != "no"]) AC_SUBST([SELINUX_CFLAGS]) @@ -891,9 +891,9 @@ AC_ARG_WITH([secdriver-selinux], if test "$with_selinux" != "yes" ; then if test "$with_secdriver_selinux" = "check" ; then with_secdriver_selinux=no - else - AC_MSG_ERROR([You must install the SELinux development package in order to compile libvirt]) - fi + elif test "$with_secdriver_selinux" = "yes"; then + AC_MSG_ERROR([You must install the libselinux development package and enable SELinux with the --with-selinux=yes in order to compile libvirt --with-secdriver-selinux=yes]) + fi else old_cflags="$CFLAGS" old_libs="$LIBS" @@ -910,7 +910,7 @@ else if test "$with_secdriver_selinux" = "check" ; then with_secdriver_selinux=no else - AC_MSG_ERROR([You must install the SELinux development package in order to compile libvirt]) + AC_MSG_ERROR([You must install libselinux development package >= 2.0.82 in order to compile libvirt --with-secdriver-selinux=yes]) fi else with_secdriver_selinux=yes -- 1.6.6.1

2 1

[libvirt] seg fault when running snapshot-create
by Stephen Shaw 22 Apr '10

22 Apr '10

I'm getting a seg fault when running virsh snapshot-create 1, but only when virt-manager is open and connected. Here is some of the debug info I was able to come up with - http://fpaste.org/9GO6/ (bt) http://fpaste.org/7gkH/ ('thread apply all bt) * After the crash (gdb) p mon->msg $1 = (qemuMonitorMessagePtr) 0x0 nibbler:~ # libvirtd --version libvirtd (libvirt) 0.8.0 Please let me know if there is any other information you need. Stephen

4 13

[libvirt] [PATCH] Fix handling of security driver restore failures in QEMU domain save
by Daniel P. Berrange 22 Apr '10

22 Apr '10

In cases where the security driver failed to restore a label after a guest has saved, we mistakenly jumped to the error cleanup paths. This is not good, because the operation has in fact completed and cannot be rolled back completely. Label restore is non-critical, so just log the problem instead. Also add a missing restore call in the error cleanup path * src/qemu/qemu_driver.c: Fix handling of security driver restore failures in QEMU domain save --- src/qemu/qemu_driver.c | 48 +++++++++++++++++++++++++----------------------- 1 files changed, 25 insertions(+), 23 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 3bea7e7..7b92965 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5050,16 +5050,13 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path, driver->securityDriver && driver->securityDriver->domainRestoreSavedStateLabel && driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1) - goto endjob; + VIR_WARN("failed to restore save state label on %s", path); if (cgroup != NULL) { rc = virCgroupDenyDevicePath(cgroup, path); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to deny device %s for %s"), - path, vm->def->name); - goto endjob; - } + if (rc != 0) + VIR_WARN("Unable to deny device %s for %s %d", + path, vm->def->name, rc); } ret = 0; @@ -5078,24 +5075,29 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path, endjob: if (vm) { - if (ret != 0 && header.was_running && priv->mon) { - qemuDomainObjEnterMonitorWithDriver(driver, vm); - rc = qemuMonitorStartCPUs(priv->mon, dom->conn); - qemuDomainObjExitMonitorWithDriver(driver, vm); - if (rc < 0) - VIR_WARN0("Unable to resume guest CPUs after save failure"); - else - vm->state = VIR_DOMAIN_RUNNING; - } + if (ret != 0) { + if (header.was_running && priv->mon) { + qemuDomainObjEnterMonitorWithDriver(driver, vm); + rc = qemuMonitorStartCPUs(priv->mon, dom->conn); + qemuDomainObjExitMonitorWithDriver(driver, vm); + if (rc < 0) + VIR_WARN0("Unable to resume guest CPUs after save failure"); + else + vm->state = VIR_DOMAIN_RUNNING; + } - if (ret != 0 && cgroup != NULL) { - rc = virCgroupDenyDevicePath(cgroup, path); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to deny device %s for %s"), - path, vm->def->name); - goto endjob; + if (cgroup != NULL) { + rc = virCgroupDenyDevicePath(cgroup, path); + if (rc != 0) + VIR_WARN("Unable to deny device %s for %s: %d", + path, vm->def->name, rc); } + + if ((!bypassSecurityDriver) && + driver->securityDriver && + driver->securityDriver->domainRestoreSavedStateLabel && + driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1) + VIR_WARN("failed to restore save state label on %s", path); } if (qemuDomainObjEndJob(vm) == 0) -- 1.6.5.2

1 0

[libvirt] [PATCH] Fix printing of event detail in python events demo program
by Daniel P. Berrange 22 Apr '10

22 Apr '10

The events demo program is slightly misleading printing myDomainEventCallback1 EVENT: Domain f14i686(-1) Added which is not distinguishing Add vs Update events. It should have been doing myDomainEventCallback1 EVENT: Domain f14i686(-1) Defined Updated * examples/domain-events/events-python/event-test.py: Fully print event detail info string --- examples/domain-events/events-python/event-test.py | 27 ++++++++++++++----- 1 files changed, 20 insertions(+), 7 deletions(-) diff --git a/examples/domain-events/events-python/event-test.py b/examples/domain-events/events-python/event-test.py index 0c6e2f0..7c5af68 100644 --- a/examples/domain-events/events-python/event-test.py +++ b/examples/domain-events/events-python/event-test.py @@ -396,21 +396,34 @@ def virEventLoopPureStart(): # Everything that now follows is a simple demo of domain lifecycle events ########################################################################## def eventToString(event): - eventStrings = ( "Added", - "Removed", + eventStrings = ( "Defined", + "Undefined", "Started", "Suspended", "Resumed", - "Stopped", - "Saved", - "Restored" ); + "Stopped" ); return eventStrings[event]; +def detailToString(event, detail): + eventStrings = ( + ( "Added", "Updated" ), + ( "Removed" ), + ( "Booted", "Migrated", "Restored", "Snapshot" ), + ( "Paused", "Migrated", "IOError", "Watchdog" ), + ( "Unpaused", "Migrated"), + ( "Shutdown", "Destroyed", "Crashed", "Migrated", "Saved", "Failed", "Snapshot") + ) + return eventStrings[event][detail] + def myDomainEventCallback1 (conn, dom, event, detail, opaque): - print "myDomainEventCallback1 EVENT: Domain %s(%s) %s %d" % (dom.name(), dom.ID(), eventToString(event), detail) + print "myDomainEventCallback1 EVENT: Domain %s(%s) %s %s" % (dom.name(), dom.ID(), + eventToString(event), + detailToString(event, detail)) def myDomainEventCallback2 (conn, dom, event, detail, opaque): - print "myDomainEventCallback2 EVENT: Domain %s(%s) %s %d" % (dom.name(), dom.ID(), eventToString(event), detail) + print "myDomainEventCallback2 EVENT: Domain %s(%s) %s %s" % (dom.name(), dom.ID(), + eventToString(event), + detailToString(event, detail)) def myDomainEventRebootCallback(conn, dom, opaque): print "myDomainEventRebootCallback: Domain %s(%s)" % (dom.name(), dom.ID()) -- 1.6.6.1

2 1

[libvirt] [PATCH 1/2] Fix CPU hotplug command names
by Daniel P. Berrange 22 Apr '10

22 Apr '10

Probably as a result of a merge error, the CPU hotplug command names were completely wrong. * src/qemu/qemu_monitor_json.c, src/qemu/qemu_monitor_text.c: Fix the CPU hotplug command names --- src/qemu/qemu_monitor_json.c | 2 +- src/qemu/qemu_monitor_text.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index cde9899..96f246f 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -1181,7 +1181,7 @@ int qemuMonitorJSONSetCPU(qemuMonitorPtr mon, int cpu, int online) { int ret; - virJSONValuePtr cmd = qemuMonitorJSONMakeCommand("balloon", + virJSONValuePtr cmd = qemuMonitorJSONMakeCommand("cpu_set", "U:cpu", (unsigned long long)cpu, "s:state", online ? "online" : "offline", NULL); diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c index 6ad07b1..db3806d 100644 --- a/src/qemu/qemu_monitor_text.c +++ b/src/qemu/qemu_monitor_text.c @@ -800,7 +800,7 @@ int qemuMonitorTextSetBalloon(qemuMonitorPtr mon, /* - * Returns: 0 if balloon not supported, +1 if balloon adjust worked + * Returns: 0 if CPU hotplug not supported, +1 if CPU hotplug worked * or -1 on failure */ int qemuMonitorTextSetCPU(qemuMonitorPtr mon, int cpu, int online) @@ -809,7 +809,7 @@ int qemuMonitorTextSetCPU(qemuMonitorPtr mon, int cpu, int online) char *reply = NULL; int ret = -1; - if (virAsprintf(&cmd, "set_cpu %d %s", cpu, online ? "online" : "offline") < 0) { + if (virAsprintf(&cmd, "cpu_set %d %s", cpu, online ? "online" : "offline") < 0) { virReportOOMError(); return -1; } -- 1.6.6.1

3 5

[libvirt] Plan for a 0.8.1 by end of next week
by Daniel Veillard 22 Apr '10

22 Apr '10

Checking git history since the release of 0.8.0, I'm seeing an impressive set of bug fixes and cleanups, and relatively few actual features changes. So I think it's sensible to try to make a new release 0.8.1 basically a 0.8.0 fixed version, and in a relatively short timeframe. To try to realign with our initial goal of releasing on Friday at the end of the month, I suggest we plan to make 0.8.1 by next Friday, the 30th April. Having a release with the snapshot feature fixed would IMHO suffice to justify this release, but git history right now makes a good case for such an early push. So unless we get serious objections, I suggest to continue the bug fixing trend, limit features commit next week and, have a cleaned up 0.8.1 available end of next week. Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH] portability fixes to tools/virt-pki-validate.in
by Dustin Kirkland 22 Apr '10

22 Apr '10

portability fixes to tools/virt-pki-validate.in A few fixes will help make tools/virt-pki-validate.in useful on Debian and Ubuntu. And one fix should be useful to everyone (see #4). 1) note our gnutls-bin package (in addition to your gnutls-utils package) in the no-certtool error text 2) adjust the ORG-setting sed regular expressions to work with both Red Hat and Ubuntu style cacert.pem Issuer format 3) fix a bashism, == should be = in the case where /bin/sh is a symlink to dash 4) $(SYSCONFDIR) cannot evaluate; set a single shell SYSCONFDIR variable to the autoconf @SYSCONFDIR@ value, and use $SYSCONFDIR everywhere This was tested against gnutls 2.8.5. And against both Red Hat and Ubuntu cacert.pem files. Credit Jamie Strandboge with the regular expression changes. Bug report: * https://bugs.edge.launchpad.net/ubuntu/+source/libvirt/+bug/562266 Signed-off-by: Dustin Kirkland <kirkland(a)canonical.com> diff --git a/tools/virt-pki-validate.in b/tools/virt-pki-validate.in index ee7b79d..d335997 100755 --- a/tools/virt-pki-validate.in +++ b/tools/virt-pki-validate.in @@ -16,8 +16,8 @@ PORT=16514 CERTOOL=`which certtool 2>/dev/null` if [ ! -x $CERTOOL ] then - echo Could not locate the certtool program - echo make sure the gnutls-utils package is installed + echo "Could not locate the certtool program" + echo "make sure the gnutls-utils (or gnutls-bin) package is installed" exit 1 fi echo Found $CERTOOL @@ -25,7 +25,8 @@ echo Found $CERTOOL # # Check the directory structure # -PKI="@SYSCONFDIR@/pki" +SYSCONFDIR="@SYSCONFDIR@" +PKI="$SYSCONFDIR/pki" if [ ! -d $PKI ] then echo the $PKI directory is missing, it is usually @@ -129,8 +130,8 @@ then echo "as root do: chmod 644 $CA/cacert.pem" exit 1 fi -ORG=`$CERTOOL -i --infile $CA/cacert.pem | grep Issuer | sed 's+Issuer: CN=++'` -if [ "$ORG" == "" ] +ORG=`$CERTOOL -i --infile $CA/cacert.pem | grep Issuer | sed -e 's+\s*Issuer: .*CN=++' -e 's+,EMAIL=.*++'` +if [ "$ORG" = "" ] then echo the CA certificate $CA/cacert.pem does not define the organization echo it should probably regenerated @@ -240,19 +241,19 @@ fi if [ "$SERVER" = "1" ] then - if [ -r $(SYSCONFDIR)/sysconfig/libvirtd ] + if [ -r $SYSCONFDIR/sysconfig/libvirtd ] then - if [ "`grep '^LIBVIRTD_ARGS' $(SYSCONFDIR)/sysconfig/libvirtd | grep -- '--listen'`" = "" ] + if [ "`grep '^LIBVIRTD_ARGS' $SYSCONFDIR/sysconfig/libvirtd | grep -- '--listen'`" = "" ] then - echo Make sure $(SYSCONFDIR)/sysconfig/libvirtd is setup to listen to + echo Make sure $SYSCONFDIR/sysconfig/libvirtd is setup to listen to echo TCP/IP connections and restart the libvirtd service fi fi - if [ -r $(SYSCONFDIR)/sysconfig/iptables ] + if [ -r $SYSCONFDIR/sysconfig/iptables ] then - if [ "`grep $PORT $(SYSCONFDIR)/sysconfig/iptables`" = "" ] + if [ "`grep $PORT $SYSCONFDIR/sysconfig/iptables`" = "" ] then - echo Make sure $(SYSCONFDIR)/sysconfig/iptables is setup to allow + echo Make sure $SYSCONFDIR/sysconfig/iptables is setup to allow echo incoming TCP/IP connections on port $PORT and echo restart the iptables service fi

3 6

Re: [libvirt] Failed to insert a cd in a virtual machine running
by Jorge Alejandro Rodríguez 22 Apr '10

22 Apr '10

the problem is because of new version of qemu, the name of devices isn't ide0-0-, is drive-ide0-0-1. 2010/4/22 Jorge Alejandro Rodríguez <jrodriguez(a)dit.upm.es> > I can't attach a cd when a vm is running with qemu 0.12.3 (ubuntu 10.04), > the problem is not with qemu because when I start the vm with kvm command > (without libvirt) I can change the cd with qemu-monitor without any problem > and eject it too (libvirt say me that it isn't supported by hypervisor). > > the versions of libvirt that I have tried are 0.7.7 and 0.8.0. > > Any ideas? > > Thanks. > Jorge >

1 0

[libvirt] [Resend][PATCH 0/3] Add dnsmasq module
by Satoru SATOH 22 Apr '10

22 Apr '10

I posted this just before 0.8.0 is out and it was bad timing, I suppose. So try to resend. The following series of patches is a prototype implementation of dnsmasq module. It implements an idea originally suggested by Dan-san and can address the problem that too many --dhcp-host args hitting ARG_MAX limit I reported last year [1]. [1] https://www.redhat.com/archives/libvir-list/2009-October/msg00216.html Thanks, Satoru SATOH

3 6

Re: [libvirt] unable to set security context (NFSv4 problem?)
by Harald Dunkel 22 Apr '10

22 Apr '10

Hi Spencer, I could reproduce the EINVAL on the command line: srvl022:/storage# touch /storage/x srvl022:/storage# chown 110:140 /storage/x chown: changing ownership of `/storage/x': Invalid argument 110 and 140 are not valid UIDs and GIDs on the NFS server. They are defined in the local passwd/group files on the libvirt server only. After defining the user and group on the NFS server the error message is gone. Obviously NFSv4 is a little bit picky about remote root users trying to change the ownership of files. This seems to break qemuSecurityDACSetOwnership() in qemu_security_dac.c, giving me the "unable to set security context" message. Do you think it would be possible to introduce a configure option '--with-dac=no'? Regards Harri

3 6