- Devel - libvirt List Archives

[libvirt] with these, clang vs. libvirt reports no errors
by Jim Meyering 16 Apr '10

16 Apr '10

I've been running clang regularly, and there have been a few pesky false-positives that just won't go away. It's not productive to reexamine them each time, so I've wanted a way to educate clang without polluting the code with work-arounds that we'll be stuck maintaining and asking questions about long after clang becomes smart enough that those work-arounds are no longer required. My solution is to mark the work-arounds with a new macro, sa_assert (for "static analysis assert"), which acts just like the classical "assert", but is only enabled when compiled by a static analyzer like clang or coverity. The advantage of using an assert-like macro is that people already know that it must have no side-effects and that will make it easy to remove later, when clang grows up. One question you may ask is why add a new symbol, when "assert" itself can already do this via NDEBUG (defined, any assertions are disabled, not defined, they are enabled). There are a few assertions in the code now, and I prefer not to touch them, and to make it clear that these are helping us cater to static analyzers. [PATCH 1/7] sa_assert: new assert-like macro, enabled only for use with static analyzers [PATCH 2/7] build: set STATIC_ANALYSIS when running via clang or coverity [PATCH 3/7] nwfilter_ebiptables_driver.c: avoid NULL dereference [PATCH 4/7] virGetHostnameLocalhost: avoid FP NULL-ptr-deref from clang [PATCH 5/7] qemudDomainAttachSCSIDisk: avoid FP NULL-ptr-deref from clang [PATCH 6/7] xend_internal.c: assure clang that we do not dereference NULL [PATCH 7/7] qemudDomainAttachSCSIDisk: avoid FP NULL-ptr-deref from clang

6 38

[libvirt] [PATCH] Add testing for CDROM media change / eject
by Daniel P. Berrange 15 Apr '10

15 Apr '10

This tests the 3 main operations in removeable media - Eject existing media - Insert new media - Change existing media (eject followed by insert) * lib/Sys/Virt/TCK.pm: Allow a specific ostype to be requested when getting a guest config * scripts/domain/207-disk-media-change.t: Test media change, eject, and re-insert --- lib/Sys/Virt/TCK.pm | 20 +++++- scripts/domain/207-disk-media-change.t | 95 ++++++++++++++++++++++++++++++++ 2 files changed, 111 insertions(+), 4 deletions(-) create mode 100644 scripts/domain/207-disk-media-change.t diff --git a/lib/Sys/Virt/TCK.pm b/lib/Sys/Virt/TCK.pm index d32b03d..9f67c08 100644 --- a/lib/Sys/Virt/TCK.pm +++ b/lib/Sys/Virt/TCK.pm @@ -416,6 +416,7 @@ sub match_kernel { sub best_kernel { my $self = shift; my $caps = shift; + my $wantostype = shift; my $kernels = $self->config("kernels", []); @@ -425,6 +426,11 @@ sub best_kernel { my @ostype = ref($ostype) ? @{$ostype} : ($ostype); foreach $ostype (@ostype) { + if ((defined $wantostype) && + ($wantostype ne $ostype)) { + next; + } + my ($domain, $emulator, $loader) = $self->match_kernel($caps, $arch, $ostype); @@ -440,9 +446,10 @@ sub best_kernel { sub get_kernel { my $self = shift; my $caps = shift; + my $wantostype = shift; my ($cfgindex, $domain, $arch, $ostype, $emulator, $loader) = - $self->best_kernel($caps); + $self->best_kernel($caps, $wantostype); if (!defined $cfgindex) { die "cannot find any supported kernel configuration"; @@ -500,8 +507,9 @@ sub generic_machine_domain { my $self = shift; my $name = shift; my $caps = shift; + my $ostype = shift; - my %config = $self->get_kernel($caps); + my %config = $self->get_kernel($caps, $ostype); my $b = Sys::Virt::TCK::DomainBuilder->new(conn => $self->{conn}, name => $name, @@ -568,15 +576,19 @@ sub generic_container_domain { sub generic_domain { my $self = shift; my $name = @_ ? shift : "tck"; + my $ostype = @_ ? shift : undef; my $caps = Sys::Virt::TCK::Capabilities->new(xml => $self->conn->get_capabilities); - my $container = $self->best_container_domain($caps); + my $container; + + $container = $self->best_container_domain($caps) + unless $ostype && $ostype ne "exe"; if ($container) { return $self->generic_container_domain($name, $caps, $container); } else { - return $self->generic_machine_domain($name, $caps); + return $self->generic_machine_domain($name, $caps, $ostype); } } diff --git a/scripts/domain/207-disk-media-change.t b/scripts/domain/207-disk-media-change.t new file mode 100644 index 0000000..2976800 --- /dev/null +++ b/scripts/domain/207-disk-media-change.t @@ -0,0 +1,95 @@ +# -*- perl -*- +# +# Copyright (C) 2009 Red Hat, Inc. +# Copyright (C) 2009 Daniel P. Berrange +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +domain/207-disk-media-change.t - verify disk media change works + +=head1 DESCRIPTION + +The test case validates that it is possible to change media +on a CDROM disk in a running domain. + +=cut + +use strict; +use warnings; + +use Test::More tests => 7; + +use Sys::Virt::TCK; +use Test::Exception; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +my $path1 = $tck->create_sparse_disk("200-disk-media-change", "extra1.img", 100); +my $path2 = $tck->create_sparse_disk("207-disk-media-change", "extra2.img", 100); + +my $xml = $tck->generic_domain("tck", "wibble") + ->disk(src => $path1, dst => "hdc", type => "file", device => "cdrom") + ->as_xml; + +diag "Creating a new transient domain"; +my $dom; +ok_domain(sub { $dom = $conn->create_domain($xml) }, "created transient domain object"); + + +my $diskxml1 = <<EOF; +<disk type='file' device='cdrom'> + <source file='$path1'/> + <target dev='hdc'/> +</disk> +EOF +my $diskxml2 = <<EOF; +<disk type='file' device='cdrom'> + <source file='$path2'/> + <target dev='hdc'/> +</disk> +EOF +my $diskxml3 = <<EOF; +<disk type='file' device='cdrom'> + <target dev='hdc'/> +</disk> +EOF + + +my $initialxml = $dom->get_xml_description; + +diag "Changing CDROM to $path2"; +lives_ok(sub { $dom->attach_device($diskxml2); }, "disk media has been changed"); + +my $newxml = $dom->get_xml_description; + +ok($newxml =~ m|$path2|, "new XML has updated media"); + +diag "Ejecting CDROM media"; +lives_ok(sub { $dom->attach_device($diskxml3); }, "disk media has been ejected"); + +$newxml = $dom->get_xml_description; + +ok($newxml !~ m|$path2|, "new XML has no media"); + +diag "Inserting CDROM media"; +lives_ok(sub { $dom->attach_device($diskxml1); }, "disk media has been inserted"); + +my $finalxml = $dom->get_xml_description; + +is($initialxml, $finalxml, "final XML matches initial XML"); -- 1.6.6.1

1 0

[libvirt] [PATCH] Fix close_used_without_including_unistd_h error
by Matthias Bolte 15 Apr '10

15 Apr '10

Triggered by gnulib when compiling with MinGW. --- I just pushed this trivial compile fix too. src/conf/nwfilter_conf.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/conf/nwfilter_conf.c b/src/conf/nwfilter_conf.c index f4af126..336ea3b 100644 --- a/src/conf/nwfilter_conf.c +++ b/src/conf/nwfilter_conf.c @@ -33,6 +33,7 @@ #if HAVE_NET_ETHERNET_H # include <net/ethernet.h> #endif +#include <unistd.h> #include "internal.h" -- 1.6.3.3

1 0

[libvirt] [PATCH 0/1] Variable length structure allocator
by David Allan 15 Apr '10

15 Apr '10

I've had this patch hanging around for a while, and I think it's worth committing even though the original reason for it went away. The kind of structure it allocates is reasonably common, and the oversize calculation is tricky to get right. Since we've already done the work (thanks Jim for the oversize calculation) I think it's worth keeping. Dave David Allan (1): Implement variable length structure allocator src/util/memory.c | 40 ++++++++++++++++++++++++++++++++++++++++ src/util/memory.h | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 75 insertions(+), 0 deletions(-)

4 9

[libvirt] [PATCH] build: fix recent 'make syntax-check' failure
by Eric Blake 15 Apr '10

15 Apr '10

* src/esx/esx_vi_methods.h: Placate cppi. --- Pushing under the rule for obvious build fixes. src/esx/esx_vi_methods.h | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/esx/esx_vi_methods.h b/src/esx/esx_vi_methods.h index 7b6be4e..c78c649 100644 --- a/src/esx/esx_vi_methods.h +++ b/src/esx/esx_vi_methods.h @@ -2,7 +2,7 @@ /* * esx_vi_methods.h: client for the VMware VI API 2.5 to manage ESX hosts * - * Copyright (C) 2009 Matthias Bolte <matthias.bolte(a)googlemail.com> + * Copyright (C) 2009, 2010 Matthias Bolte <matthias.bolte(a)googlemail.com> * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -45,6 +45,6 @@ int esxVI_ValidateMigration esxVI_ManagedObjectReference *host, /* optional */ esxVI_Event **output); /* optional, list */ -#include "esx_vi_methods.generated.h" +# include "esx_vi_methods.generated.h" #endif /* __ESX_VI_METHODS_H__ */ -- 1.6.6.1

1 0

[libvirt] [PATCH] schematestutils.sh: improve shell portability: avoid "echo -e"
by Jim Meyering 15 Apr '10

15 Apr '10

echo -e is not portable. This is the sole remaining use in all of libvirt. >From a58cf340b5ebbca2157f43c6f23d4d6f56b848c7 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 14 Apr 2010 13:25:46 +0200 Subject: [PATCH] schematestutils.sh: improve shell portability: avoid "echo -e" * tests/schematestutils.sh: Use printf rather than echo -e. --- tests/schematestutils.sh | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tests/schematestutils.sh b/tests/schematestutils.sh index f172857..f2b3b50 100644 --- a/tests/schematestutils.sh +++ b/tests/schematestutils.sh @@ -22,7 +22,7 @@ do test_result $n $(basename $(dirname $xml))"/"$(basename $xml) $ret if test "$verbose" = "1" && test $ret != 0 ; then - echo -e "$cmd\n$result" + printf '%s\n' "$cmd" "$result" fi if test "$ret" != 0 ; then f=`expr $f + 1` -- 1.7.1.rc1.248.gcefbb

4 11

[libvirt] [RFC] maint: forbid most files without extension
by Eric Blake 15 Apr '10

15 Apr '10

* .gitignore: Add rule that requires . in name, then add exemptions. --- Given Chris' recent accident in committing a binary file, then blasting the list with it, here's a (hack) approach to prevent a relapse in the future. It assumes that non-binary files either have an extension, or are easy enough to enumerate. Personally, I do NOT want to apply this patch. It has the nasty side-effect of rendering .git/info/exclude useless (git unfortunately stops processing ignore rules once it finds an explicit accept rule, so any reject rules in .git/info/exclude for files containing '.' are overruled as accepts by this patch). Hence, this is only an RFC, documenting my thought process. .gitignore | 38 ++++++++++++++++++++++++++++++++++++++ 1 files changed, 38 insertions(+), 0 deletions(-) diff --git a/.gitignore b/.gitignore index a7466fd..7d2bce3 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,41 @@ +# To reduce likelihood of committing binaries, require that a '.' be +# in all non-directories, then add exceptions as needed. +* +!*.* +!/AUTHORS +!/ChangeLog-old +!/HACKING +!README +!TODO +!/bootstrap +!/examples/apparmor/TEMPLATE +!/examples/apparmor/libvirt-qemu +!/tests/capabilityschematest +!/tests/cpuset +!/tests/daemon-conf +!/tests/define-dev-segfault +!/tests/domainschematest +!/tests/int-overflow +!/tests/interfaceschematest +!/tests/libvirtd-fail +!/tests/libvirtd-pool +!/tests/networkschematest +!/tests/nodedevschematest +!/tests/nwfilterschematest +!/tests/qemuhelpdata/kvm-74 +!/tests/qemuhelpdata/kvm-86 +!/tests/read-bufsiz +!/tests/read-non-seekable +!/tests/start +!/tests/storagepoolschematest +!/tests/storagevolschematest +!/tests/undefine +!/tests/vcpupin +!/tests/virsh-all +!/tests/virsh-synopsis +!/tests/virt-aa-helper-test + +# Other files to exclude *#*# *.#*# *.a -- 1.6.6.1

4 3

[libvirt] clang vs. libvirt
by Jim Meyering 15 Apr '10

15 Apr '10

I've been running the clang static analyzer against libvirt regularly, but it's usually been that of F12 or F13. Yesterday I used rawhide's version of clang: scan-build -o clang ./autogen.sh --enable-compile-warnings=error && scan-build -o clang make -j6 and it spotted a few new problems. Most are false positives, but a few were not. Here are the latest additions. I have an additional handful of patches that address the remaining false positives, and will post those later today.

3 13

[libvirt] [PATCH] Implement forgotten backend of virInterfaceIsActive()
by Laine Stump 15 Apr '10

15 Apr '10

Somehow the backend of this function was never implemented in libvirt's netcf driver, and nobody noticed until now. (The required netcf function was already in place, so nothing needs to change there.) --- src/interface/netcf_driver.c | 31 ++++++++++++++++++++++++++++++- 1 files changed, 30 insertions(+), 1 deletions(-) diff --git a/src/interface/netcf_driver.c b/src/interface/netcf_driver.c index 708f1f8..7163066 100644 --- a/src/interface/netcf_driver.c +++ b/src/interface/netcf_driver.c @@ -511,6 +511,35 @@ cleanup: return ret; } +static int interfaceIsActive(virInterfacePtr ifinfo) +{ + struct interface_driver *driver = ifinfo->conn->interfacePrivateData; + struct netcf_if *iface = NULL; + unsigned int flags = 0; + + interfaceDriverLock(driver); + + iface = interfaceDriverGetNetcfIF(driver->netcf, ifinfo); + if (!iface) { + /* helper already reported error */ + goto cleanup; + } + + if (ncf_if_status(iface, &flags) < 0) { + const char *errmsg, *details; + int errcode = ncf_error(driver->netcf, &errmsg, &details); + interfaceReportError(netcf_to_vir_err(errcode), + "failed to get status of interface %s (netcf: %s - %s)", + ifinfo->name, errmsg, details ? details : ""); + goto cleanup; + } + +cleanup: + ncf_if_free(iface); + interfaceDriverUnlock(driver); + return flags & NETCF_IFACE_ACTIVE ? 1 : 0; +} + static virInterfaceDriver interfaceDriver = { "Interface", interfaceOpenInterface, /* open */ @@ -526,7 +555,7 @@ static virInterfaceDriver interfaceDriver = { interfaceUndefine, /* interfaceUndefine */ interfaceCreate, /* interfaceCreate */ interfaceDestroy, /* interfaceDestroy */ - NULL, /* interfaceIsActive */ + interfaceIsActive, /* interfaceIsActive */ }; int interfaceRegister(void) { -- 1.6.6.1

4 4

[libvirt] hellolibvirt: no hypervisor driver available for xen:///
by Ganesh Pagade 14 Apr '10

14 Apr '10

Hi, I downloaded and built the latest libvirt source code 0.8. I installed the library in a custom directory libvirt-0.8.0-install/ keeping all other configurations default. After this I tried to execute the example hellolibvirt: [hellolibvirt]# ./hellolibvirt xen Attempting to connect to hypervisor libvir: Remote error : unable to connect to '/root/ganeshp/libvirt-0.8.0-install/var/run/libvirt/libvirt-sock', libvirtd may need to be started: Connection refused No connection to hypervisor Parameter error when attempting to get last error My libvirtd was running from /etc/init.d/libvirtd. Still why is it trying to connect to the newly built libvirtd? I stopped the /etc/init.d/libvirtd and started my newly built daemon: [hellolibvirt]# /root/ganeshp/libvirt-0.8.0-install/sbin/libvirtd start & 04:47:07.534: warning : qemudStartup:1574 : Unable to create cgroup for driver: No such device or address 04:47:07.540: error : parse_socket:126 : cannot open /sys/devices/system/cpu/cpu1/topology/physical_package_id: No such file or directory 04:47:07.540: warning : qemudCapsInit:1068 : Failed to get host CPU 04:47:07.544: warning : lxcStartup:1835 : Unable to create cgroup for driver: No such device or address After this I tried running hellolibvirt example again: [hellolibvirt]# ./hellolibvirt xen Attempting to connect to hypervisor 04:48:43.166: error : virLibConnError:450 : no hypervisor driver available for xen:/// libvir: error : no hypervisor driver available for xen:/// libvir: error : no hypervisor driver available for xen:/// No connection to hypervisor Parameter error when attempting to get last error I do not understand why the program is not able to find the xen driver. I am able to launch VMM GUI and create VMs using xen connection. The system already has xen hypervisor (3.1.0). Even the newly built virsh gives similar errors. Whereas /usr/bin/virsh works perfectly fine. Am I missing some configuration or dependency? Any pointers/suggestion would greatly help. Thanks. Regards, -Ganesh

2 2

[libvirt] [PATCH] Run test suite as part of RPM build process
by Daniel P. Berrange 14 Apr '10

14 Apr '10

To ensure that patches in the RPM don't break any functionality it is neccessary to run the test suites during build. It currently has 3 tests disabled - daemon-conf: this is totally broken, since it relies on being able to resolve the 'libvirt' group & being able to resolve hostnames at daemon startup. This isn't possible in a mock build root - seclabeltest: fails to initialize selinux in the mock build root. Possibly fixable - nodeinfotest: broken on s390 + ppc - this is a real bug * libvirt.spec.in: Add a %check section, with 3 tests temporarily disabled --- libvirt.spec.in | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 748a1e7..a8b078a 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -618,6 +618,17 @@ chmod 0644 $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/libvirtd %clean rm -fr %{buildroot} +%check +cd tests +# These 3 tests don't current work in a mock build root +for i in nodeinfotest daemon-conf seclabeltest +do + rm -f $i + echo -e "#!/bin/sh\nexit 0" > $i + chmod +x $i +done +make check + %pre %if 0%{?fedora} >= 12 || 0%{?rhel} >= 6 # Normally 'setup' adds this in /etc/passwd, but this is -- 1.6.6.1

2 1

[libvirt] [PATCH] Fix off-by-one check in QEMU memory stats
by Daniel P. Berrange 14 Apr '10

14 Apr '10

The QEMU memory stats JSON monitor command was too cautious in checking array bounds, dropping the last requested stat * src/qemu/qemu_monitor_json.c: Fix off-by-1 check in memory stats --- src/qemu/qemu_monitor_json.c | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 7c0d372..3c97e9d 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -965,7 +965,7 @@ int qemuMonitorJSONGetMemoryStats(qemuMonitorPtr mon, goto cleanup; } - if (virJSONValueObjectHasKey(data, "mem_swapped_in") && (got < (nr_stats-1))) { + if (virJSONValueObjectHasKey(data, "mem_swapped_in") && (got < nr_stats)) { if (virJSONValueObjectGetNumberUlong(data, "mem_swapped_in", &mem) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("info balloon reply was missing balloon mem_swapped_in")); @@ -976,7 +976,7 @@ int qemuMonitorJSONGetMemoryStats(qemuMonitorPtr mon, stats[got].val = (mem/1024); got++; } - if (virJSONValueObjectHasKey(data, "mem_swapped_out") && (got < (nr_stats-1))) { + if (virJSONValueObjectHasKey(data, "mem_swapped_out") && (got < nr_stats)) { if (virJSONValueObjectGetNumberUlong(data, "mem_swapped_out", &mem) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("info balloon reply was missing balloon mem_swapped_out")); @@ -987,7 +987,7 @@ int qemuMonitorJSONGetMemoryStats(qemuMonitorPtr mon, stats[got].val = (mem/1024); got++; } - if (virJSONValueObjectHasKey(data, "major_page_faults") && (got < (nr_stats-1))) { + if (virJSONValueObjectHasKey(data, "major_page_faults") && (got < nr_stats)) { if (virJSONValueObjectGetNumberUlong(data, "major_page_faults", &mem) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("info balloon reply was missing balloon major_page_faults")); @@ -998,7 +998,7 @@ int qemuMonitorJSONGetMemoryStats(qemuMonitorPtr mon, stats[got].val = mem; got++; } - if (virJSONValueObjectHasKey(data, "minor_page_faults") && (got < (nr_stats-1))) { + if (virJSONValueObjectHasKey(data, "minor_page_faults") && (got < nr_stats)) { if (virJSONValueObjectGetNumberUlong(data, "minor_page_faults", &mem) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("info balloon reply was missing balloon minor_page_faults")); @@ -1009,7 +1009,7 @@ int qemuMonitorJSONGetMemoryStats(qemuMonitorPtr mon, stats[got].val = mem; got++; } - if (virJSONValueObjectHasKey(data, "free_mem") && (got < (nr_stats-1))) { + if (virJSONValueObjectHasKey(data, "free_mem") && (got < nr_stats)) { if (virJSONValueObjectGetNumberUlong(data, "free_mem", &mem) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("info balloon reply was missing balloon free_mem")); @@ -1020,7 +1020,7 @@ int qemuMonitorJSONGetMemoryStats(qemuMonitorPtr mon, stats[got].val = (mem/1024); got++; } - if (virJSONValueObjectHasKey(data, "total_mem") && (got < (nr_stats-1))) { + if (virJSONValueObjectHasKey(data, "total_mem") && (got < nr_stats)) { if (virJSONValueObjectGetNumberUlong(data, "total_mem", &mem) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("info balloon reply was missing balloon total_mem")); -- 1.6.6.1

1 1

[libvirt] php bindings
by David W King 14 Apr '10

14 Apr '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I know this topic has come up multiple times in the past and every time it does people keep commenting on how it would be a good thing to do but they just don't have the time. So my question is, has anyone found the time to work on php bindings for libvirt? - -- David King Goshen College ITS davidwk(a)goshen.edu 574-535-7726 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAku7NWoACgkQH+/Vg7DylXYcEACgmvs0p0YIF3pzu8Cp9xkNk+zZ 2YgAni7YdROnRIrvmpyh1kbb5MH8kT2Y =DSLD -----END PGP SIGNATURE-----

2 1

[libvirt] [PATCH] esx: Extend esx_vi_generator.py to cover methods too
by Matthias Bolte 14 Apr '10

14 Apr '10

Generate almost all SOAP method mapping code. Update the driver code to use the complete paramater list of some methods that had parameters skipped before. Improve the ESX_VI__METHOD marco to do automatic output deserialization based on output occurrence. Also incorporate automatic _this binding and output pointer check. --- src/esx/esx_driver.c | 26 +- src/esx/esx_vi.c | 7 +- src/esx/esx_vi_generator.input | 191 +++++++++- src/esx/esx_vi_generator.py | 489 ++++++++++++++++++------ src/esx/esx_vi_methods.c | 854 ++++++---------------------------------- src/esx/esx_vi_methods.h | 132 +------ 6 files changed, 723 insertions(+), 976 deletions(-) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index 4ed9890..e3340c9 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -1333,7 +1333,8 @@ esxDomainResume(virDomainPtr domain) goto failure; } - if (esxVI_PowerOnVM_Task(priv->host, virtualMachine->obj, &task) < 0 || + if (esxVI_PowerOnVM_Task(priv->host, virtualMachine->obj, NULL, + &task) < 0 || esxVI_WaitForTaskCompletion(priv->host, task, domain->uuid, priv->autoAnswer, &taskInfoState) < 0) { goto failure; @@ -1710,8 +1711,9 @@ esxDomainGetInfo(virDomainPtr domain, virDomainInfoPtr info) esxVI_PerfCounterInfo *perfCounterInfo = NULL; esxVI_PerfCounterInfo *perfCounterInfoList = NULL; esxVI_PerfQuerySpec *querySpec = NULL; + esxVI_PerfEntityMetricBase *perfEntityMetricBase = NULL; + esxVI_PerfEntityMetricBase *perfEntityMetricBaseList = NULL; esxVI_PerfEntityMetric *perfEntityMetric = NULL; - esxVI_PerfEntityMetric *perfEntityMetricList = NULL; esxVI_PerfMetricIntSeries *perfMetricIntSeries = NULL; esxVI_Long *value = NULL; @@ -1883,17 +1885,26 @@ esxDomainGetInfo(virDomainPtr domain, virDomainInfoPtr info) querySpec->metricId->instance = (char *)""; querySpec->format = (char *)"normal"; - if (esxVI_QueryPerf(priv->host, querySpec, &perfEntityMetricList) < 0) { + if (esxVI_QueryPerf(priv->host, querySpec, + &perfEntityMetricBaseList) < 0) { querySpec->entity = NULL; querySpec->metricId->instance = NULL; querySpec->format = NULL; goto failure; } - for (perfEntityMetric = perfEntityMetricList; perfEntityMetric != NULL; - perfEntityMetric = perfEntityMetric->_next) { + for (perfEntityMetricBase = perfEntityMetricBaseList; + perfEntityMetricBase != NULL; + perfEntityMetricBase = perfEntityMetricBase->_next) { VIR_DEBUG0("perfEntityMetric ..."); + perfEntityMetric = + esxVI_PerfEntityMetric_DynamicCast(perfEntityMetricBase); + + if (perfMetricIntSeries == NULL) { + VIR_ERROR0("QueryPerf returned object with unexpected type"); + } + perfMetricIntSeries = esxVI_PerfMetricIntSeries_DynamicCast(perfEntityMetric->value); @@ -1927,7 +1938,7 @@ esxDomainGetInfo(virDomainPtr domain, virDomainInfoPtr info) esxVI_Int_Free(&counterIdList); esxVI_PerfCounterInfo_Free(&perfCounterInfoList); esxVI_PerfQuerySpec_Free(&querySpec); - esxVI_PerfEntityMetric_Free(&perfEntityMetricList); + esxVI_PerfEntityMetricBase_Free(&perfEntityMetricBaseList); return result; @@ -2367,7 +2378,8 @@ esxDomainCreate(virDomainPtr domain) goto failure; } - if (esxVI_PowerOnVM_Task(priv->host, virtualMachine->obj, &task) < 0 || + if (esxVI_PowerOnVM_Task(priv->host, virtualMachine->obj, NULL, + &task) < 0 || esxVI_WaitForTaskCompletion(priv->host, task, domain->uuid, priv->autoAnswer, &taskInfoState) < 0) { goto failure; diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 1a71558..4318ff1 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -444,7 +444,7 @@ esxVI_Context_Connect(esxVI_Context *ctx, const char *url, goto failure; } - if (esxVI_Login(ctx, username, password, &ctx->session) < 0) { + if (esxVI_Login(ctx, username, password, NULL, &ctx->session) < 0) { goto failure; } @@ -1344,7 +1344,7 @@ esxVI_EnsureSession(esxVI_Context *ctx) if (active != esxVI_Boolean_True) { esxVI_UserSession_Free(&ctx->session); - if (esxVI_Login(ctx, ctx->username, ctx->password, + if (esxVI_Login(ctx, ctx->username, ctx->password, NULL, &ctx->session) < 0) { return -1; } @@ -1378,7 +1378,8 @@ esxVI_EnsureSession(esxVI_Context *ctx) if (currentSession == NULL) { esxVI_UserSession_Free(&ctx->session); - if (esxVI_Login(ctx, ctx->username, ctx->password, &ctx->session) < 0) { + if (esxVI_Login(ctx, ctx->username, ctx->password, NULL, + &ctx->session) < 0) { goto failure; } } else if (STRNEQ(ctx->session->key, currentSession->key)) { diff --git a/src/esx/esx_vi_generator.input b/src/esx/esx_vi_generator.input index 9c545eb..a016c63 100644 --- a/src/esx/esx_vi_generator.input +++ b/src/esx/esx_vi_generator.input @@ -28,7 +28,22 @@ # - ol for an optional list # - i for an ignored item or list # -# Object member sequence has to match the WSDL sequence +# Object member sequence has to match the WSDL sequence. +# +# +# Method definition: +# +# method <name> [returns <type> <occurrence>] +# <type> <name> <occurrence> +# ... +# end +# +# The _this paramater can have a type attached to it: +# +# _this:<type> +# +# The <type> refers to one of the ServiceContent members. This make the +# generator auto-bind _this to the corresponding ServiceContent member. # @@ -436,3 +451,177 @@ object VirtualMachineSnapshotTree Boolean quiesced r VirtualMachineSnapshotTree childSnapshotList ol end + + +# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # +# Methods +# + +method AnswerVM + ManagedObjectReference _this r + String questionId r + String answerChoice r +end + + +method CancelTask + ManagedObjectReference _this r +end + + +method CreateFilter returns ManagedObjectReference r + ManagedObjectReference _this:PropertyCollector r + PropertyFilterSpec spec r + Boolean partialUpdates r +end + + +method CreateSnapshot_Task returns ManagedObjectReference r + ManagedObjectReference _this r + String name r + String description o + Boolean memory r + Boolean quiesce r +end + + +method DestroyPropertyFilter + ManagedObjectReference _this r +end + + +method FindByIp returns ManagedObjectReference o + ManagedObjectReference _this:SearchIndex r + ManagedObjectReference datacenter o + String ip r + Boolean vmSearch r +end + + +method FindByUuid returns ManagedObjectReference o + ManagedObjectReference _this:SearchIndex r + ManagedObjectReference datacenter o + String uuid r + Boolean vmSearch r +end + + +method Login returns UserSession r + ManagedObjectReference _this:SessionManager r + String userName r + String password r + String locale o +end + + +method Logout + ManagedObjectReference _this:SessionManager r +end + + +method MigrateVM_Task returns ManagedObjectReference r + ManagedObjectReference _this r + ManagedObjectReference pool o + ManagedObjectReference host o + VirtualMachineMovePriority priority r + VirtualMachinePowerState state o +end + + +method PowerOffVM_Task returns ManagedObjectReference r + ManagedObjectReference _this r +end + + +method PowerOnVM_Task returns ManagedObjectReference r + ManagedObjectReference _this r + ManagedObjectReference host o +end + + +method QueryAvailablePerfMetric returns PerfMetricId ol + ManagedObjectReference _this:PerformanceManager r + ManagedObjectReference entity r + DateTime beginTime o + DateTime endTime o + Int intervalId o +end + + +method QueryPerf returns PerfEntityMetricBase ol + ManagedObjectReference _this:PerformanceManager r + PerfQuerySpec querySpec rl +end + + +method QueryPerfCounter returns PerfCounterInfo ol + ManagedObjectReference _this:PerformanceManager r + Int counterId rl +end + + +method RebootGuest + ManagedObjectReference _this r +end + + +method ReconfigVM_Task returns ManagedObjectReference r + ManagedObjectReference _this r + VirtualMachineConfigSpec spec r +end + + +method RegisterVM_Task returns ManagedObjectReference r + ManagedObjectReference _this r + String path r + String name o + Boolean asTemplate r + ManagedObjectReference pool o + ManagedObjectReference host o +end + + +method RemoveSnapshot_Task returns ManagedObjectReference r + ManagedObjectReference _this r + Boolean removeChildren r +end + + +method RetrieveProperties returns ObjectContent ol + ManagedObjectReference _this:PropertyCollector r + PropertyFilterSpec specSet rl +end + + +method RevertToSnapshot_Task returns ManagedObjectReference r + ManagedObjectReference _this r + ManagedObjectReference host o +end + + +method SessionIsActive returns Boolean r + ManagedObjectReference _this:SessionManager r + String sessionID r + String userName r +end + + +method ShutdownGuest + ManagedObjectReference _this r +end + + +method SuspendVM_Task returns ManagedObjectReference r + ManagedObjectReference _this r +end + + +method UnregisterVM + ManagedObjectReference _this r +end + + +method WaitForUpdates returns UpdateSet r + ManagedObjectReference _this:PropertyCollector r + String version o +end diff --git a/src/esx/esx_vi_generator.py b/src/esx/esx_vi_generator.py index b933d5b..272b219 100755 --- a/src/esx/esx_vi_generator.py +++ b/src/esx/esx_vi_generator.py @@ -27,34 +27,247 @@ import os.path +OCCURRENCE__REQUIRED_ITEM = "r" +OCCURRENCE__REQUIRED_LIST = "rl" +OCCURRENCE__OPTIONAL_ITEM = "o" +OCCURRENCE__OPTIONAL_LIST = "ol" +OCCURRENCE__IGNORED = "i" +valid_occurrences = [OCCURRENCE__REQUIRED_ITEM, + OCCURRENCE__REQUIRED_LIST, + OCCURRENCE__OPTIONAL_ITEM, + OCCURRENCE__OPTIONAL_LIST, + OCCURRENCE__IGNORED] -class Property: - OCCURRENCE__REQUIRED_ITEM = "r" - OCCURRENCE__REQUIRED_LIST = "rl" - OCCURRENCE__OPTIONAL_ITEM = "o" - OCCURRENCE__OPTIONAL_LIST = "ol" - OCCURRENCE__IGNORED = "i" - - valid_occurrences = [OCCURRENCE__REQUIRED_ITEM, - OCCURRENCE__REQUIRED_LIST, - OCCURRENCE__OPTIONAL_ITEM, - OCCURRENCE__OPTIONAL_LIST, - OCCURRENCE__IGNORED] + + + + + +class Parameter: + autobind_map = { "PerformanceManager" : "perfManager", + "PropertyCollector" : "propertyCollector", + "SearchIndex" : "searchIndex", + "SessionManager" : "sessionManager" } def __init__(self, type, name, occurrence): self.type = type + self.occurrence = occurrence + + if ':' in name and name.startswith("_this"): + self.name, self.autobind_type = name.split(":") + else: + self.name = name + self.autobind_type = None + + + def is_enum(self): + global predefined_enums + global enums_by_name + + return self.type in predefined_enums or self.type in enums_by_name + + + def generate_paramater(self, is_last = False, is_header = True, offset = 0): + if self.occurrence == OCCURRENCE__IGNORED: + raise ValueError("invalid function parameter occurrence value '%s'" % self.occurrence) + elif self.autobind_type is not None: + return "" + else: + string = " " + string += " " * offset + string += "%s%s" % (self.get_type_string(), self.name) + + if is_last: + if is_header: + string += "); " + else: + string += "), " + else: + string += ", " + + while len(string) < 59: + string += " " + + return string + self.get_occurrence_comment() + "\n" + + + def generate_return(self, offset = 0, end_of_line = ";"): + if self.occurrence == OCCURRENCE__IGNORED: + raise ValueError("invalid function parameteroccurrence value '%s'" % self.occurrence) + else: + string = " " + string += " " * offset + string += "%s*%s)%s" % (self.get_type_string(), self.name, end_of_line) + + while len(string) < 59: + string += " " + + return string + self.get_occurrence_comment() + "\n" + + + def generate_require_code(self): + if self.occurrence in [OCCURRENCE__REQUIRED_ITEM, + OCCURRENCE__REQUIRED_LIST]: + return " ESX_VI__METHOD__PARAMETER__REQUIRE(%s)\n" % self.name + else: + return "" + + + def generate_serialize_code(self): + if self.occurrence in [OCCURRENCE__REQUIRED_LIST, + OCCURRENCE__OPTIONAL_LIST]: + return " ESX_VI__METHOD__PARAMETER__SERIALIZE_LIST(%s, %s)\n" % (self.type, self.name) + elif self.type == "String": + return " ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, %s)\n" % self.name + else: + return " ESX_VI__METHOD__PARAMETER__SERIALIZE(%s, %s)\n" % (self.type, self.name) + + + def get_type_string(self): + if self.type == "String" and \ + self.occurrence not in [OCCURRENCE__REQUIRED_LIST, + OCCURRENCE__OPTIONAL_LIST]: + return "const char *" + elif self.is_enum(): + return "esxVI_%s " % self.type + else: + return "esxVI_%s *" % self.type + + + def get_occurrence_comment(self): + if self.occurrence == OCCURRENCE__REQUIRED_ITEM: + return "/* required */" + elif self.occurrence == OCCURRENCE__REQUIRED_LIST: + return "/* required, list */" + elif self.occurrence == OCCURRENCE__OPTIONAL_ITEM: + return "/* optional */" + elif self.occurrence == OCCURRENCE__OPTIONAL_LIST: + return "/* optional, list */" + + raise ValueError("unknown occurrence value '%s'" % self.occurrence) + + + def get_occurrence_short_enum(self): + if self.occurrence == OCCURRENCE__REQUIRED_ITEM: + return "RequiredItem" + elif self.occurrence == OCCURRENCE__REQUIRED_LIST: + return "RequiredList" + elif self.occurrence == OCCURRENCE__OPTIONAL_ITEM: + return "OptionalItem" + elif self.occurrence == OCCURRENCE__OPTIONAL_LIST: + return "OptionalList" + + raise ValueError("unknown occurrence value '%s'" % self.occurrence) + + + +class Method: + def __init__(self, name, parameters, returns): + self.name = name + self.parameters = [] + self.autobind_parameter = None + self.returns = returns + + for parameter in parameters: + if parameter.autobind_type is None: + self.parameters.append(parameter) + else: + self.autobind_parameter = parameter + + + def generate_header(self): + header = "int esxVI_%s\n" % self.name + header += " (esxVI_Context *ctx" + + if len(self.parameters) > 0 or self.returns is not None: + header += ",\n" + + for parameter in self.parameters[:-1]: + header += parameter.generate_paramater() + + if self.returns is None: + header += self.parameters[-1].generate_paramater(is_last = True) + else: + header += self.parameters[-1].generate_paramater() + header += self.returns.generate_return() + else: + header += ");\n" + + header += "\n" + + return header + + + def generate_source(self): + source = "/* esxVI_%s */\n" % self.name + source += "ESX_VI__METHOD(%s," % self.name + + if self.autobind_parameter is not None: + source += " %s,\n" % Parameter.autobind_map[self.autobind_parameter.autobind_type] + else: + source += " /* explicit _this */,\n" + + source += " (esxVI_Context *ctx" + + if len(self.parameters) > 0 or self.returns is not None: + source += ",\n" + + for parameter in self.parameters[:-1]: + source += parameter.generate_paramater(is_header = False, offset = 9) + + if self.returns is None: + source += self.parameters[-1].generate_paramater(is_last = True, is_header = False, offset = 9) + else: + source += self.parameters[-1].generate_paramater(is_header = False, offset = 9) + source += self.returns.generate_return(offset = 9, end_of_line = ",") + else: + source += "),\n" + + if self.returns is None: + source += " void, None,\n" + else: + source += " %s, %s,\n" % (self.returns.type, self.returns.get_occurrence_short_enum()) + + source += "{\n" + + if self.autobind_parameter is not None: + source += self.autobind_parameter.generate_require_code() + + for parameter in self.parameters: + source += parameter.generate_require_code() + + source += "},\n" + source += "{\n" + + if self.autobind_parameter is not None: + source += self.autobind_parameter.generate_serialize_code() + + for parameter in self.parameters: + source += parameter.generate_serialize_code() + + source += "})\n\n\n\n" + + return source + + + +class Property: + def __init__(self, type, name, occurrence): + self.type = type self.name = name self.occurrence = occurrence + def is_enum(self): global predefined_enums global enums_by_name return self.type in predefined_enums or self.type in enums_by_name + def generate_struct_member(self): - if self.occurrence == Property.OCCURRENCE__IGNORED: + if self.occurrence == OCCURRENCE__IGNORED: return " /* FIXME: %s is currently ignored */\n" % self.name else: string = " %s%s; " % (self.get_type_string(), self.name) @@ -62,36 +275,39 @@ class Property: while len(string) < 59: string += " " - return string + "/* %s */\n" % self.get_occurrence_string() + return string + self.get_occurrence_comment() + "\n" + def generate_free_code(self): if self.type == "String" and \ - self.occurrence not in [Property.OCCURRENCE__REQUIRED_LIST, - Property.OCCURRENCE__OPTIONAL_LIST, - Property.OCCURRENCE__IGNORED]: + self.occurrence not in [OCCURRENCE__REQUIRED_LIST, + OCCURRENCE__OPTIONAL_LIST, + OCCURRENCE__IGNORED]: return " VIR_FREE(item->%s);\n" % self.name elif self.is_enum(): return "" else: - if self.occurrence == Property.OCCURRENCE__IGNORED: + if self.occurrence == OCCURRENCE__IGNORED: return " /* FIXME: %s is currently ignored */\n" % self.name else: return " esxVI_%s_Free(&item->%s);\n" % (self.type, self.name) + def generate_validate_code(self): - if self.occurrence in [Property.OCCURRENCE__REQUIRED_ITEM, - Property.OCCURRENCE__REQUIRED_LIST]: + if self.occurrence in [OCCURRENCE__REQUIRED_ITEM, + OCCURRENCE__REQUIRED_LIST]: return " ESX_VI__TEMPLATE__PROPERTY__REQUIRE(%s)\n" % self.name - elif self.occurrence == Property.OCCURRENCE__IGNORED: + elif self.occurrence == OCCURRENCE__IGNORED: return " /* FIXME: %s is currently ignored */\n" % self.name else: return "" + def generate_deep_copy_code(self): - if self.occurrence == Property.OCCURRENCE__IGNORED: + if self.occurrence == OCCURRENCE__IGNORED: return " /* FIXME: %s is currently ignored */\n" % self.name - elif self.occurrence in [Property.OCCURRENCE__REQUIRED_LIST, - Property.OCCURRENCE__OPTIONAL_LIST]: + elif self.occurrence in [OCCURRENCE__REQUIRED_LIST, + OCCURRENCE__OPTIONAL_LIST]: return " ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY_LIST(%s, %s)\n" % (self.type, self.name) elif self.type == "String": return " ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY_VALUE(String, %s)\n" % self.name @@ -100,54 +316,53 @@ class Property: else: return " ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY(%s, %s)\n" % (self.type, self.name) + def generate_serialize_code(self): - if self.occurrence == Property.OCCURRENCE__IGNORED: + if self.occurrence == OCCURRENCE__IGNORED: return " /* FIXME: %s is currently ignored */\n" % self.name - elif self.occurrence in [Property.OCCURRENCE__REQUIRED_LIST, - Property.OCCURRENCE__OPTIONAL_LIST]: + elif self.occurrence in [OCCURRENCE__REQUIRED_LIST, + OCCURRENCE__OPTIONAL_LIST]: return " ESX_VI__TEMPLATE__PROPERTY__SERIALIZE_LIST(%s, %s)\n" % (self.type, self.name) elif self.type == "String": return " ESX_VI__TEMPLATE__PROPERTY__SERIALIZE_VALUE(String, %s)\n" % self.name else: return " ESX_VI__TEMPLATE__PROPERTY__SERIALIZE(%s, %s)\n" % (self.type, self.name) + def generate_deserialize_code(self): - if self.occurrence == Property.OCCURRENCE__IGNORED: + if self.occurrence == OCCURRENCE__IGNORED: return " ESX_VI__TEMPLATE__PROPERTY__DESERIALIZE_IGNORE(%s) /* FIXME */\n" % self.name - elif self.occurrence in [Property.OCCURRENCE__REQUIRED_LIST, - Property.OCCURRENCE__OPTIONAL_LIST]: + elif self.occurrence in [OCCURRENCE__REQUIRED_LIST, + OCCURRENCE__OPTIONAL_LIST]: return " ESX_VI__TEMPLATE__PROPERTY__DESERIALIZE_LIST(%s, %s)\n" % (self.type, self.name) elif self.type == "String": return " ESX_VI__TEMPLATE__PROPERTY__DESERIALIZE_VALUE(String, %s)\n" % self.name else: return " ESX_VI__TEMPLATE__PROPERTY__DESERIALIZE(%s, %s)\n" % (self.type, self.name) + def get_type_string(self): if self.type == "String" and \ - self.occurrence not in [Property.OCCURRENCE__REQUIRED_LIST, - Property.OCCURRENCE__OPTIONAL_LIST]: + self.occurrence not in [OCCURRENCE__REQUIRED_LIST, + OCCURRENCE__OPTIONAL_LIST]: return "char *" elif self.is_enum(): return "esxVI_%s " % self.type else: return "esxVI_%s *" % self.type - def get_occurrence_string(self): - if self.occurrence == Property.OCCURRENCE__REQUIRED_ITEM: - return "required" - elif self.occurrence == Property.OCCURRENCE__REQUIRED_LIST: - return "required, list" - elif self.occurrence == Property.OCCURRENCE__OPTIONAL_ITEM: - return "optional" - elif self.occurrence == Property.OCCURRENCE__OPTIONAL_LIST: - return "optional, list" - - raise ValueError("unknown cardinality value '%s'" % self.cardinality) - - - + def get_occurrence_comment(self): + if self.occurrence == OCCURRENCE__REQUIRED_ITEM: + return "/* required */" + elif self.occurrence == OCCURRENCE__REQUIRED_LIST: + return "/* required, list */" + elif self.occurrence == OCCURRENCE__OPTIONAL_ITEM: + return "/* optional */" + elif self.occurrence == OCCURRENCE__OPTIONAL_LIST: + return "/* optional, list */" + raise ValueError("unknown occurrence value '%s'" % self.occurrence) @@ -159,6 +374,7 @@ class Object: FEATURE__SERIALIZE = (1 << 5) FEATURE__DESERIALIZE = (1 << 6) + def __init__(self, name, extends, properties, features = 0, extended_by = None): self.name = name self.extends = extends @@ -166,10 +382,6 @@ class Object: self.properties = properties self.extended_by = extended_by - self.properties_by_name = {} - - for property in self.properties: - self.properties_by_name[property.name] = property def generate_struct_members(self, add_banner = False, struct_gap = False): global objects_by_name @@ -201,6 +413,7 @@ class Object: return members + def generate_free_code(self, add_banner = False): global objects_by_name source = "" @@ -226,6 +439,7 @@ class Object: return source + def generate_validate_code(self, add_banner = False): global objects_by_name source = "" @@ -251,6 +465,7 @@ class Object: return source + def generate_dynamic_cast_code(self): global objects_by_name source = "" @@ -266,6 +481,7 @@ class Object: return source + def generate_deep_copy_code(self, add_banner = False): global objects_by_name source = "" @@ -291,6 +507,7 @@ class Object: return source + def generate_serialize_code(self, add_banner = False): global objects_by_name source = "" @@ -309,6 +526,7 @@ class Object: return source + def generate_deserialize_code(self, add_banner = False): global objects_by_name source = "" @@ -327,18 +545,22 @@ class Object: return source + def generate_typedef(self): return "typedef struct _esxVI_%s esxVI_%s;\n" % (self.name, self.name) + def generate_typeenum(self): return " esxVI_Type_%s,\n" % self.name + def generate_typetostring(self): string = " case esxVI_Type_%s:\n" % self.name string += " return \"%s\";\n\n" % self.name return string + def generate_typefromstring(self): string = " else if (STREQ(type, \"%s\")) {\n" % self.name string += " return esxVI_Type_%s;\n" % self.name @@ -346,6 +568,7 @@ class Object: return string + def generate_header(self): header = "/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *\n" header += " * VI Type: %s\n" % self.name @@ -424,6 +647,7 @@ class Object: return header + def generate_source(self): source = "/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *\n" source += " * VI Type: %s\n" % self.name @@ -601,11 +825,6 @@ class Object: - - - - - class Enum: FEATURE__ANY_TYPE = (1 << 1) FEATURE__SERIALIZE = (1 << 2) @@ -617,18 +836,22 @@ class Enum: self.values = values self.features = features | Enum.FEATURE__SERIALIZE | Enum.FEATURE__DESERIALIZE + def generate_typedef(self): return "typedef enum _esxVI_%s esxVI_%s;\n" % (self.name, self.name) + def generate_typeenum(self): return " esxVI_Type_%s,\n" % self.name + def generate_typetostring(self): string = " case esxVI_Type_%s:\n" % self.name string += " return \"%s\";\n\n" % self.name return string + def generate_typefromstring(self): string = " else if (STREQ(type, \"%s\")) {\n" % self.name string += " return esxVI_Type_%s;\n" % self.name @@ -636,6 +859,7 @@ class Enum: return string + def generate_header(self): header = "/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *\n" header += " * VI Enum: %s\n" % self.name @@ -664,6 +888,7 @@ class Enum: return header + def generate_source(self): source = "/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *\n" source += " * VI Enum: %s\n" % self.name @@ -698,20 +923,12 @@ class Enum: - - def report_error(message): print "error: " + message sys.exit(1) -def usage(): - print "%s <input-filename> <output-directory>" % sys.argv[0] - sys.exit(0) - - - def capitalize_first(string): return string[:1].upper() + string[1:] @@ -744,7 +961,7 @@ def parse_object(block): if len(items) != 3: report_error("line %d: invalid property" % line[0]) - if items[2] not in Property.valid_occurrences: + if items[2] not in valid_occurrences: report_error("line %d: invalid occurrence" % line[0]) properties.append(Property(type = items[0], name = items[1], @@ -775,6 +992,44 @@ def parse_enum(block): +def parse_method(block): + # expected format: method <name> [returns <type> <occurrence>] + header_items = block[0][1].split() + + if len(header_items) < 2: + report_error("line %d: invalid block header" % (number)) + + assert header_items[0] == "method" + + name = header_items[1] + returns = None + + if len(header_items) > 2: + if header_items[2] != "returns": + report_error("line %d: invalid block header" % (number)) + else: + returns = Parameter(type = header_items[3], name = "output", + occurrence = header_items[4]) + + parameters = [] + + for line in block[1:]: + # expected format: <type> <name> <occurrence> + items = line[1].split() + + if len(items) != 3: + report_error("line %d: invalid property" % line[0]) + + if items[2] not in valid_occurrences: + report_error("line %d: invalid occurrence" % line[0]) + + parameters.append(Parameter(type = items[0], name = items[1], + occurrence = items[2])) + + return Method(name = name, parameters = parameters, returns = returns) + + + def inherit_features(obj): if obj.extended_by is not None: for extended_by in obj.extended_by: @@ -834,7 +1089,7 @@ additional_object_features = { "Event" : Object.FEATURE__LI "ManagedObjectReference" : Object.FEATURE__ANY_TYPE, "ObjectContent" : Object.FEATURE__DEEP_COPY | Object.FEATURE__LIST, "PerfCounterInfo" : Object.FEATURE__LIST, - "PerfEntityMetric" : Object.FEATURE__LIST, + "PerfEntityMetric" : Object.FEATURE__LIST | Object.FEATURE__DYNAMIC_CAST, "PerfQuerySpec" : Object.FEATURE__LIST, "PerfMetricIntSeries" : Object.FEATURE__DYNAMIC_CAST, "PropertyFilterSpec" : Object.FEATURE__LIST, @@ -859,7 +1114,6 @@ removed_object_features = { "DynamicProperty" : Object.FEATURE__SERIA - if "srcdir" in os.environ: input_filename = os.path.join(os.environ["srcdir"], "esx/esx_vi_generator.input") output_dirname = os.path.join(os.environ["srcdir"], "esx") @@ -869,18 +1123,21 @@ else: -typedef = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.typedef")) -typeenum = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.typeenum")) -typetostring = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.typetostring")) -typefromstring = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.typefromstring")) -header = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.h")) -source = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.c")) +types_typedef = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.typedef")) +types_typeenum = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.typeenum")) +types_typetostring = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.typetostring")) +types_typefromstring = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.typefromstring")) +types_header = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.h")) +types_source = open_and_print(os.path.join(output_dirname, "esx_vi_types.generated.c")) +methods_header = open_and_print(os.path.join(output_dirname, "esx_vi_methods.generated.h")) +methods_source = open_and_print(os.path.join(output_dirname, "esx_vi_methods.generated.c")) number = 0 objects_by_name = {} enums_by_name = {} +methods_by_name = {} block = None @@ -896,7 +1153,7 @@ for line in file(input_filename, "rb").readlines(): if len(line) < 1: continue - if line.startswith("object") or line.startswith("enum"): + if line.startswith("object") or line.startswith("enum") or line.startswith("method"): if block is not None: report_error("line %d: nested block found" % (number)) else: @@ -907,9 +1164,12 @@ for line in file(input_filename, "rb").readlines(): if block[0][1].startswith("object"): obj = parse_object(block) objects_by_name[obj.name] = obj - else: + elif block[0][1].startswith("enum"): enum = parse_enum(block) enums_by_name[enum.name] = enum + else: + method = parse_method(block) + methods_by_name[method.name] = method block = None else: @@ -926,7 +1186,7 @@ for enum in enums_by_name.values(): for obj in objects_by_name.values(): for property in obj.properties: - if property.occurrence != Property.OCCURRENCE__IGNORED and \ + if property.occurrence != OCCURRENCE__IGNORED and \ not is_known_type(property.type): report_error("object '%s' contains unknown property type '%s'" % (obj.name, property.type)) @@ -936,8 +1196,8 @@ for obj in objects_by_name.values(): # detect list usage for property in obj.properties: - if (property.occurrence == Property.OCCURRENCE__REQUIRED_LIST or \ - property.occurrence == Property.OCCURRENCE__OPTIONAL_LIST) and \ + if (property.occurrence == OCCURRENCE__REQUIRED_LIST or \ + property.occurrence == OCCURRENCE__OPTIONAL_LIST) and \ property.type not in predefined_objects: objects_by_name[property.type].features |= Object.FEATURE__LIST @@ -951,7 +1211,7 @@ for obj in objects_by_name.values(): # spread deep copy onto properties if obj.features & Object.FEATURE__DEEP_COPY: for property in obj.properties: - if property.occurrence != Property.OCCURRENCE__IGNORED and \ + if property.occurrence != OCCURRENCE__IGNORED and \ property.type not in predefined_objects and \ property.type in objects_by_name: objects_by_name[property.type].features |= Object.FEATURE__DEEP_COPY @@ -976,55 +1236,62 @@ for obj in objects_by_name.values(): -typedef.write("/* Generated by esx_vi_generator.py */\n\n\n\n") -typeenum.write("/* Generated by esx_vi_generator.py */\n\n") -typetostring.write("/* Generated by esx_vi_generator.py */\n\n") -typefromstring.write("/* Generated by esx_vi_generator.py */\n\n") -header.write("/* Generated by esx_vi_generator.py */\n\n\n\n") -source.write("/* Generated by esx_vi_generator.py */\n\n\n\n") - - -typedef.write("/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *\n" + - " * VI Enums\n" + - " */\n\n") +types_typedef.write("/* Generated by esx_vi_generator.py */\n\n\n\n") +types_typeenum.write("/* Generated by esx_vi_generator.py */\n\n") +types_typetostring.write("/* Generated by esx_vi_generator.py */\n\n") +types_typefromstring.write("/* Generated by esx_vi_generator.py */\n\n") +types_header.write("/* Generated by esx_vi_generator.py */\n\n\n\n") +types_source.write("/* Generated by esx_vi_generator.py */\n\n\n\n") +methods_header.write("/* Generated by esx_vi_generator.py */\n\n\n\n") +methods_source.write("/* Generated by esx_vi_generator.py */\n\n\n\n") +# output enums +types_typedef.write("/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *\n" + + " * VI Enums\n" + + " */\n\n") names = enums_by_name.keys() names.sort() - for name in names: - typedef.write(enums_by_name[name].generate_typedef()) - typeenum.write(enums_by_name[name].generate_typeenum()) - typetostring.write(enums_by_name[name].generate_typetostring()) - typefromstring.write(enums_by_name[name].generate_typefromstring()) - header.write(enums_by_name[name].generate_header()) - source.write(enums_by_name[name].generate_source()) + types_typedef.write(enums_by_name[name].generate_typedef()) + types_typeenum.write(enums_by_name[name].generate_typeenum()) + types_typetostring.write(enums_by_name[name].generate_typetostring()) + types_typefromstring.write(enums_by_name[name].generate_typefromstring()) + types_header.write(enums_by_name[name].generate_header()) + types_source.write(enums_by_name[name].generate_source()) -typedef.write("\n\n\n" + - "/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *\n" + - " * VI Types\n" + - " */\n\n") +# output objects +types_typedef.write("\n\n\n" + + "/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *\n" + + " * VI Types\n" + + " */\n\n") +types_typeenum.write("\n") +types_typetostring.write("\n") +types_typefromstring.write("\n") -typeenum.write("\n") -typetostring.write("\n") -typefromstring.write("\n") +names = objects_by_name.keys() +names.sort() +for name in names: + types_typedef.write(objects_by_name[name].generate_typedef()) + types_typeenum.write(objects_by_name[name].generate_typeenum()) + types_typetostring.write(objects_by_name[name].generate_typetostring()) + types_typefromstring.write(objects_by_name[name].generate_typefromstring()) + types_header.write(objects_by_name[name].generate_header()) + types_source.write(objects_by_name[name].generate_source()) -names = objects_by_name.keys() -names.sort() +# output methods +names = methods_by_name.keys() +names.sort() for name in names: - typedef.write(objects_by_name[name].generate_typedef()) - typeenum.write(objects_by_name[name].generate_typeenum()) - typetostring.write(objects_by_name[name].generate_typetostring()) - typefromstring.write(objects_by_name[name].generate_typefromstring()) - header.write(objects_by_name[name].generate_header()) - source.write(objects_by_name[name].generate_source()) + methods_header.write(methods_by_name[name].generate_header()) + methods_source.write(methods_by_name[name].generate_source()) diff --git a/src/esx/esx_vi_methods.c b/src/esx/esx_vi_methods.c index b2b3e8d..5c52167 100644 --- a/src/esx/esx_vi_methods.c +++ b/src/esx/esx_vi_methods.c @@ -51,18 +51,88 @@ -#define ESX_VI__METHOD(_name, _parameters, _occurrence, _prolog, _validate, \ - _serialize, _deserialize) \ +#define ESX_VI__METHOD__CHECK_OUTPUT__None \ + /* nothing */ + + + +#define ESX_VI__METHOD__CHECK_OUTPUT__NotNone \ + if (output == NULL || *output != 0) { \ + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); \ + return -1; \ + } + + + +#define ESX_VI__METHOD__CHECK_OUTPUT__RequiredItem \ + ESX_VI__METHOD__CHECK_OUTPUT__NotNone + + + +#define ESX_VI__METHOD__CHECK_OUTPUT__RequiredList \ + ESX_VI__METHOD__CHECK_OUTPUT__NotNone + + + +#define ESX_VI__METHOD__CHECK_OUTPUT__OptionalItem \ + ESX_VI__METHOD__CHECK_OUTPUT__NotNone + + + +#define ESX_VI__METHOD__CHECK_OUTPUT__OptionalList \ + ESX_VI__METHOD__CHECK_OUTPUT__NotNone + + + +#define ESX_VI__METHOD__DESERIALIZE_OUTPUT__None(_type) \ + /* nothing */ + + + +#define ESX_VI__METHOD__DESERIALIZE_OUTPUT__RequiredItem(_type) \ + if (esxVI_##_type##_Deserialize(response->node, output) < 0) { \ + goto failure; \ + } + + + +#define ESX_VI__METHOD__DESERIALIZE_OUTPUT__RequiredList(_type) \ + if (esxVI_##_type##_DeserializeList(response->node, output) < 0) { \ + goto failure; \ + } + + + +#define ESX_VI__METHOD__DESERIALIZE_OUTPUT__OptionalItem(_type) \ + if (response->node != NULL && \ + esxVI_##_type##_Deserialize(response->node, output) < 0) { \ + goto failure; \ + } + + + +#define ESX_VI__METHOD__DESERIALIZE_OUTPUT__OptionalList(_type) \ + if (response->node != NULL && \ + esxVI_##_type##_DeserializeList(response->node, output) < 0) { \ + goto failure; \ + } + + + +#define ESX_VI__METHOD(_name, _this_from_service, _parameters, _output_type, \ + _occurrence, _validate, _serialize) \ int \ esxVI_##_name _parameters \ { \ int result = 0; \ - const char* method_name = #_name; \ + const char *methodName = #_name; \ virBuffer buffer = VIR_BUFFER_INITIALIZER; \ char *request = NULL; \ esxVI_Response *response = NULL; \ \ - _prolog \ + ESX_VI__METHOD__PARAMETER__THIS__##_this_from_service \ + \ + ESX_VI__METHOD__CHECK_OUTPUT__##_occurrence \ \ _validate \ \ @@ -81,14 +151,12 @@ \ request = virBufferContentAndReset(&buffer); \ \ - if (esxVI_Context_Execute(ctx, #_name, request, &response, \ + if (esxVI_Context_Execute(ctx, methodName, request, &response, \ esxVI_Occurrence_##_occurrence) < 0) { \ goto failure; \ } \ \ - if (response->node != NULL) { \ - _deserialize \ - } \ + ESX_VI__METHOD__DESERIALIZE_OUTPUT__##_occurrence(_output_type) \ \ cleanup: \ VIR_FREE(request); \ @@ -106,19 +174,44 @@ -#define ESX_VI__METHOD__CHECK_SERVICE() \ +#define ESX_VI__METHOD__PARAMETER__THIS_FROM_SERVICE(_type, _name) \ + esxVI_##_type *_this = NULL; \ + \ if (ctx->service == NULL) { \ ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid call")); \ return -1; \ - } + } \ + \ + _this = ctx->service->_name; -#define ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(_name) \ - if (_name == NULL || *_name != NULL) { \ - ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); \ - return -1; \ - } +#define ESX_VI__METHOD__PARAMETER__THIS__/* explicit _this */ \ + /* nothing */ + + + +#define ESX_VI__METHOD__PARAMETER__THIS__perfManager \ + ESX_VI__METHOD__PARAMETER__THIS_FROM_SERVICE(ManagedObjectReference, \ + perfManager) + + + +#define ESX_VI__METHOD__PARAMETER__THIS__propertyCollector \ + ESX_VI__METHOD__PARAMETER__THIS_FROM_SERVICE(ManagedObjectReference, \ + propertyCollector) + + + +#define ESX_VI__METHOD__PARAMETER__THIS__searchIndex \ + ESX_VI__METHOD__PARAMETER__THIS_FROM_SERVICE(ManagedObjectReference, \ + searchIndex) + + + +#define ESX_VI__METHOD__PARAMETER__THIS__sessionManager \ + ESX_VI__METHOD__PARAMETER__THIS_FROM_SERVICE(ManagedObjectReference, \ + sessionManager) @@ -132,17 +225,7 @@ if (_name == 0) { \ ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, \ "Required parameter '%s' is missing for call to %s", \ - #_name, method_name); \ - return -1; \ - } - - - -#define ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(_name) \ - if (_name == 0) { \ - ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, \ - "Required parameter '_this' is missing for call to %s", \ - method_name); \ + #_name, methodName); \ return -1; \ } @@ -169,13 +252,6 @@ -#define ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(_type, _name) \ - if (esxVI_##_type##_Serialize(_name, "_this", &buffer) < 0) { \ - goto failure; \ - } - - - /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * VI Methods */ @@ -220,553 +296,16 @@ esxVI_RetrieveServiceContent(esxVI_Context *ctx, -/* esxVI_Login */ -ESX_VI__METHOD(Login, - (esxVI_Context *ctx, - const char *userName, const char *password, - esxVI_UserSession **userSession), - RequiredItem, -{ - ESX_VI__METHOD__CHECK_SERVICE() - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(userSession) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->sessionManager) - ESX_VI__METHOD__PARAMETER__REQUIRE(userName) - ESX_VI__METHOD__PARAMETER__REQUIRE(password) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->sessionManager) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, userName) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, password) -}, -{ - if (esxVI_UserSession_Deserialize(response->node, userSession) < 0) { - goto failure; - } -}) - - - -/* esxVI_Logout */ -ESX_VI__METHOD(Logout, (esxVI_Context *ctx), None, -{ - ESX_VI__METHOD__CHECK_SERVICE() -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->sessionManager) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->sessionManager) -}, -{ -}) - - - -/* esxVI_SessionIsActive */ -ESX_VI__METHOD(SessionIsActive, - (esxVI_Context *ctx, const char *sessionID, - const char *userName, esxVI_Boolean *active), - RequiredItem, -{ - ESX_VI__METHOD__CHECK_SERVICE() - - if (active == NULL) { - ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); - return -1; - } -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->sessionManager) - ESX_VI__METHOD__PARAMETER__REQUIRE(sessionID) - ESX_VI__METHOD__PARAMETER__REQUIRE(userName) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->sessionManager) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, sessionID) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, userName) -}, -{ - if (esxVI_Boolean_Deserialize(response->node, active) < 0) { - goto failure; - } -}) - - - -/* esxVI_RetrieveProperties */ -ESX_VI__METHOD(RetrieveProperties, - (esxVI_Context *ctx, - esxVI_PropertyFilterSpec *specSet, /* list */ - esxVI_ObjectContent **objectContentList), - OptionalList, -{ - ESX_VI__METHOD__CHECK_SERVICE() - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(objectContentList) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->propertyCollector) - ESX_VI__METHOD__PARAMETER__REQUIRE(specSet) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->propertyCollector) - ESX_VI__METHOD__PARAMETER__SERIALIZE_LIST(PropertyFilterSpec, specSet) -}, -{ - if (esxVI_ObjectContent_DeserializeList(response->node, - objectContentList) < 0) { - goto failure; - } -}) - - - -/* esxVI_PowerOnVM_Task */ -ESX_VI__METHOD(PowerOnVM_Task, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - esxVI_ManagedObjectReference **task), - RequiredItem, -{ - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachine) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { - goto failure; - } -}) - - - -/* esxVI_PowerOffVM_Task */ -ESX_VI__METHOD(PowerOffVM_Task, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - esxVI_ManagedObjectReference **task), - RequiredItem, -{ - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachine) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { - goto failure; - } -}) - - - -/* esxVI_SuspendVM_Task */ -ESX_VI__METHOD(SuspendVM_Task, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - esxVI_ManagedObjectReference **task), - RequiredItem, -{ - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachine) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { - goto failure; - } -}) - - - -/* esxVI_MigrateVM_Task */ -ESX_VI__METHOD(MigrateVM_Task, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - esxVI_ManagedObjectReference *pool, - esxVI_ManagedObjectReference *host, - esxVI_VirtualMachineMovePriority priority, - esxVI_VirtualMachinePowerState state, - esxVI_ManagedObjectReference **task), - RequiredItem, -{ - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) - ESX_VI__METHOD__PARAMETER__REQUIRE(priority) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachine) - ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, pool) - ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, host) - ESX_VI__METHOD__PARAMETER__SERIALIZE(VirtualMachineMovePriority, priority) - ESX_VI__METHOD__PARAMETER__SERIALIZE(VirtualMachinePowerState, state) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { - goto failure; - } -}) - - - -/* esxVI_ReconfigVM_Task */ -ESX_VI__METHOD(ReconfigVM_Task, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - esxVI_VirtualMachineConfigSpec *spec, - esxVI_ManagedObjectReference **task), - RequiredItem, -{ - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) - ESX_VI__METHOD__PARAMETER__REQUIRE(spec) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachine) - ESX_VI__METHOD__PARAMETER__SERIALIZE(VirtualMachineConfigSpec, spec) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { - goto failure; - } -}) - - - -/* esxVI_RegisterVM_Task */ -ESX_VI__METHOD(RegisterVM_Task, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *folder, - const char *path, const char *name, - esxVI_Boolean asTemplate, - esxVI_ManagedObjectReference *pool, - esxVI_ManagedObjectReference *host, - esxVI_ManagedObjectReference **task), - RequiredItem, -{ - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(folder) - ESX_VI__METHOD__PARAMETER__REQUIRE(path) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, folder) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, path) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, name) - ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, asTemplate) - ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, pool) - ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, host) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { - goto failure; - } -}) - - - -/* esxVI_CreateSnapshot_Task */ -ESX_VI__METHOD(CreateSnapshot_Task, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - const char *name, const char *description, - esxVI_Boolean memory, esxVI_Boolean quiesce, - esxVI_ManagedObjectReference **task), - RequiredItem, -{ - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) - ESX_VI__METHOD__PARAMETER__REQUIRE(name) - ESX_VI__METHOD__PARAMETER__REQUIRE(memory) - ESX_VI__METHOD__PARAMETER__REQUIRE(quiesce) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachine) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, name) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, description) - ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, memory) - ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, quiesce) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { - goto failure; - } -}) - - - -/* esxVI_RevertToSnapshot_Task */ -ESX_VI__METHOD(RevertToSnapshot_Task, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachineSnapshot, - esxVI_ManagedObjectReference *host, - esxVI_ManagedObjectReference **task), - RequiredItem, -{ - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachineSnapshot) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachineSnapshot) - ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, host) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { - goto failure; - } -}) - - - -/* esxVI_RemoveSnapshot_Task */ -ESX_VI__METHOD(RemoveSnapshot_Task, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachineSnapshot, - esxVI_Boolean removeChildren, - esxVI_ManagedObjectReference **task), - RequiredItem, -{ - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachineSnapshot) - ESX_VI__METHOD__PARAMETER__REQUIRE(removeChildren) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachineSnapshot) - ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, removeChildren) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { - goto failure; - } -}) - - - -/* esxVI_CancelTask */ -ESX_VI__METHOD(CancelTask, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *task), - None, -{ -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(task) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, task) -}, -{ -}) - - - -/* esxVI_UnregisterVM */ -ESX_VI__METHOD(UnregisterVM, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine), - None, -{ -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachine) -}, -{ -}) - - - -/* esxVI_AnswerVM */ -ESX_VI__METHOD(AnswerVM, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - const char *questionId, - const char *answerChoice), - None, -{ -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) - ESX_VI__METHOD__PARAMETER__REQUIRE(questionId) - ESX_VI__METHOD__PARAMETER__REQUIRE(answerChoice) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachine) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, questionId) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, answerChoice) -}, -{ -}) - - - -/* esxVI_CreateFilter */ -ESX_VI__METHOD(CreateFilter, - (esxVI_Context *ctx, - esxVI_PropertyFilterSpec *spec, - esxVI_Boolean partialUpdates, - esxVI_ManagedObjectReference **propertyFilter), - RequiredItem, -{ - ESX_VI__METHOD__CHECK_SERVICE() - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(propertyFilter) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->propertyCollector) - ESX_VI__METHOD__PARAMETER__REQUIRE(spec) - ESX_VI__METHOD__PARAMETER__REQUIRE(partialUpdates) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->propertyCollector) - ESX_VI__METHOD__PARAMETER__SERIALIZE(PropertyFilterSpec, spec) - ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, partialUpdates) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, - propertyFilter) < 0) { - goto failure; - } -}) - - - -/* esxVI_DestroyPropertyFilter */ -ESX_VI__METHOD(DestroyPropertyFilter, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *propertyFilter), - None, -{ -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(propertyFilter) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - propertyFilter) -}, -{ -}) - - - -/* esxVI_WaitForUpdates */ -ESX_VI__METHOD(WaitForUpdates, - (esxVI_Context *ctx, - const char *version, - esxVI_UpdateSet **updateSet), - RequiredItem, -{ - ESX_VI__METHOD__CHECK_SERVICE() - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(updateSet) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->propertyCollector) - ESX_VI__METHOD__PARAMETER__REQUIRE(version) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->propertyCollector) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, version) -}, -{ - if (esxVI_UpdateSet_Deserialize(response->node, updateSet) < 0) { - goto failure; - } -}) - - - -/* esxVI_RebootGuest */ -ESX_VI__METHOD(RebootGuest, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine), - None, -{ -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachine) -}, -{ -}) - - - -/* esxVI_ShutdownGuest */ -ESX_VI__METHOD(ShutdownGuest, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine), - None, -{ -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - virtualMachine) -}, -{ -}) - - - /* esxVI_ValidateMigration */ -ESX_VI__METHOD(ValidateMigration, +ESX_VI__METHOD(ValidateMigration, /* special _this */, (esxVI_Context *ctx, - esxVI_ManagedObjectReference *vm, /* list */ - esxVI_VirtualMachinePowerState state, - esxVI_String *testType, /* list */ - esxVI_ManagedObjectReference *pool, - esxVI_ManagedObjectReference *host, - esxVI_Event **eventList), - OptionalList, -{ - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(eventList) -}, + esxVI_ManagedObjectReference *vm, /* required, list */ + esxVI_VirtualMachinePowerState state, /* optional */ + esxVI_String *testType, /* optional, list */ + esxVI_ManagedObjectReference *pool, /* optional */ + esxVI_ManagedObjectReference *host, /* optional */ + esxVI_Event **output), /* optional, list */ + Event, OptionalList, { ESX_VI__METHOD__PARAMETER__REQUIRE(vm) }, @@ -781,165 +320,8 @@ ESX_VI__METHOD(ValidateMigration, ESX_VI__METHOD__PARAMETER__SERIALIZE_LIST(String, testType) ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, pool) ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, host) -}, -{ - if (esxVI_Event_DeserializeList(response->node, eventList) < 0) { - goto failure; - } }) -/* esxVI_FindByIp */ -ESX_VI__METHOD(FindByIp, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *datacenter, - const char *ip, - esxVI_Boolean vmSearch, - esxVI_ManagedObjectReference **managedObjectReference), - OptionalItem, -{ - ESX_VI__METHOD__CHECK_SERVICE() - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(managedObjectReference) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->searchIndex) - ESX_VI__METHOD__PARAMETER__REQUIRE(ip) - ESX_VI__METHOD__PARAMETER__REQUIRE(vmSearch) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->searchIndex) - ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, datacenter) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, ip) - ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, vmSearch) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, - managedObjectReference) < 0) { - goto failure; - } -}) - - - -/* esxVI_FindByUuid */ -ESX_VI__METHOD(FindByUuid, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *datacenter, - const char *uuid, /* string */ - esxVI_Boolean vmSearch, - esxVI_ManagedObjectReference **managedObjectReference), - OptionalItem, -{ - ESX_VI__METHOD__CHECK_SERVICE() - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(managedObjectReference) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->searchIndex) - ESX_VI__METHOD__PARAMETER__REQUIRE(uuid) - ESX_VI__METHOD__PARAMETER__REQUIRE(vmSearch) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->searchIndex) - ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, datacenter) - ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, uuid) - ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, vmSearch) -}, -{ - if (esxVI_ManagedObjectReference_Deserialize(response->node, - managedObjectReference) < 0) { - goto failure; - } -}) - - - -/* esxVI_QueryAvailablePerfMetric */ -ESX_VI__METHOD(QueryAvailablePerfMetric, - (esxVI_Context *ctx, - esxVI_ManagedObjectReference *entity, - esxVI_DateTime *beginTime, - esxVI_DateTime *endTime, - esxVI_Int *intervalId, - esxVI_PerfMetricId **perfMetricIdList), - OptionalList, -{ - ESX_VI__METHOD__CHECK_SERVICE() - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(perfMetricIdList) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->perfManager) - ESX_VI__METHOD__PARAMETER__REQUIRE(entity) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->perfManager) - ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, entity) - ESX_VI__METHOD__PARAMETER__SERIALIZE(DateTime, beginTime) - ESX_VI__METHOD__PARAMETER__SERIALIZE(DateTime, endTime) - ESX_VI__METHOD__PARAMETER__SERIALIZE(Int, intervalId) -}, -{ - if (esxVI_PerfMetricId_DeserializeList(response->node, - perfMetricIdList) < 0) { - goto failure; - } -}) - - - -/* esxVI_QueryPerfCounter */ -ESX_VI__METHOD(QueryPerfCounter, - (esxVI_Context *ctx, - esxVI_Int *counterId, /* list */ - esxVI_PerfCounterInfo **perfCounterInfoList), - OptionalList, -{ - ESX_VI__METHOD__CHECK_SERVICE() - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(perfCounterInfoList) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->perfManager) - ESX_VI__METHOD__PARAMETER__REQUIRE(counterId) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->perfManager) - ESX_VI__METHOD__PARAMETER__SERIALIZE_LIST(Int, counterId) -}, -{ - if (esxVI_PerfCounterInfo_DeserializeList(response->node, - perfCounterInfoList) < 0) { - goto failure; - } -}) - - - -/* esxVI_QueryPerf */ -ESX_VI__METHOD(QueryPerf, - (esxVI_Context *ctx, - esxVI_PerfQuerySpec *querySpec, /* list */ - esxVI_PerfEntityMetric **perfEntityMetricList), - OptionalList, -{ - ESX_VI__METHOD__CHECK_SERVICE() - ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(perfEntityMetricList) -}, -{ - ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(ctx->service->perfManager) - ESX_VI__METHOD__PARAMETER__REQUIRE(querySpec) -}, -{ - ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, - ctx->service->perfManager) - ESX_VI__METHOD__PARAMETER__SERIALIZE_LIST(PerfQuerySpec, querySpec) -}, -{ - if (esxVI_PerfEntityMetric_DeserializeList(response->node, - perfEntityMetricList) < 0) { - goto failure; - } -}) +#include "esx_vi_methods.generated.c" diff --git a/src/esx/esx_vi_methods.h b/src/esx/esx_vi_methods.h index 9ff8b4b..7b6be4e 100644 --- a/src/esx/esx_vi_methods.h +++ b/src/esx/esx_vi_methods.h @@ -32,123 +32,19 @@ * VI Methods */ -int esxVI_RetrieveServiceContent(esxVI_Context *ctx, - esxVI_ServiceContent **serviceContent); - -int esxVI_Login(esxVI_Context *ctx, const char *userName, const char *password, - esxVI_UserSession **userSession); - -int esxVI_Logout(esxVI_Context *ctx); - -int esxVI_SessionIsActive(esxVI_Context *ctx, const char *sessionID, - const char *userName, esxVI_Boolean *active); - -int esxVI_RetrieveProperties(esxVI_Context *ctx, - esxVI_PropertyFilterSpec *specSet, /* list */ - esxVI_ObjectContent **objectContentList); - -int esxVI_PowerOnVM_Task(esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - esxVI_ManagedObjectReference **task); - -int esxVI_PowerOffVM_Task(esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - esxVI_ManagedObjectReference **task); - -int esxVI_SuspendVM_Task(esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - esxVI_ManagedObjectReference **task); - -int esxVI_MigrateVM_Task(esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - esxVI_ManagedObjectReference *pool, - esxVI_ManagedObjectReference *host, - esxVI_VirtualMachineMovePriority priority, - esxVI_VirtualMachinePowerState state, - esxVI_ManagedObjectReference **task); - -int esxVI_ReconfigVM_Task(esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - esxVI_VirtualMachineConfigSpec *spec, - esxVI_ManagedObjectReference **task); - -int esxVI_RegisterVM_Task(esxVI_Context *ctx, - esxVI_ManagedObjectReference *folder, - const char *path, const char *name, - esxVI_Boolean asTemplate, - esxVI_ManagedObjectReference *pool, - esxVI_ManagedObjectReference *host, - esxVI_ManagedObjectReference **task); - -int esxVI_CreateSnapshot_Task(esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - const char *name, const char *description, - esxVI_Boolean memory, esxVI_Boolean quiesce, - esxVI_ManagedObjectReference **task); - -int esxVI_RevertToSnapshot_Task - (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachineSnapshot, - esxVI_ManagedObjectReference *host, esxVI_ManagedObjectReference **task); - -int esxVI_RemoveSnapshot_Task - (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachineSnapshot, - esxVI_Boolean removeChildren, esxVI_ManagedObjectReference **task); - -int esxVI_CancelTask(esxVI_Context *ctx, esxVI_ManagedObjectReference *task); - -int esxVI_UnregisterVM(esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine); - -int esxVI_AnswerVM(esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine, - const char *questionId, const char *answerChoice); - -int esxVI_CreateFilter(esxVI_Context *ctx, - esxVI_PropertyFilterSpec *spec, - esxVI_Boolean partialUpdates, - esxVI_ManagedObjectReference **propertyFilter); - -int esxVI_DestroyPropertyFilter(esxVI_Context *ctx, - esxVI_ManagedObjectReference *propertyFilter); - -int esxVI_WaitForUpdates(esxVI_Context *ctx, const char *version, - esxVI_UpdateSet **updateSet); - -int esxVI_RebootGuest(esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine); - -int esxVI_ShutdownGuest(esxVI_Context *ctx, - esxVI_ManagedObjectReference *virtualMachine); - -int esxVI_ValidateMigration(esxVI_Context *ctx, - esxVI_ManagedObjectReference *vm, /* list */ - esxVI_VirtualMachinePowerState state, - esxVI_String *testType, /* list */ // FIXME: see ValidateMigrationTestType - esxVI_ManagedObjectReference *pool, - esxVI_ManagedObjectReference *host, - esxVI_Event **eventList); - -int esxVI_FindByIp(esxVI_Context *ctx, esxVI_ManagedObjectReference *datacenter, - const char *ip, esxVI_Boolean vmSearch, - esxVI_ManagedObjectReference **managedObjectReference); - -int esxVI_FindByUuid(esxVI_Context *ctx, - esxVI_ManagedObjectReference *datacenter, - const char *uuid, /* string */ - esxVI_Boolean vmSearch, - esxVI_ManagedObjectReference **managedObjectReference); - -int esxVI_QueryAvailablePerfMetric(esxVI_Context *ctx, - esxVI_ManagedObjectReference *entity, - esxVI_DateTime *beginTime, - esxVI_DateTime *endTime, - esxVI_Int *intervalId, - esxVI_PerfMetricId **perfMetricIdList); - -int esxVI_QueryPerfCounter(esxVI_Context *ctx, esxVI_Int *counterId, /* list */ - esxVI_PerfCounterInfo **perfCounterInfoList); - -int esxVI_QueryPerf(esxVI_Context *ctx, esxVI_PerfQuerySpec *querySpecList, - esxVI_PerfEntityMetric **perfEntityMetricList); +int esxVI_RetrieveServiceContent + (esxVI_Context *ctx, + esxVI_ServiceContent **serviceContent); /* required */ + +int esxVI_ValidateMigration + (esxVI_Context *ctx, + esxVI_ManagedObjectReference *vm, /* required, list */ + esxVI_VirtualMachinePowerState state, /* optional */ + esxVI_String *testType, /* optional, list */ + esxVI_ManagedObjectReference *pool, /* optional */ + esxVI_ManagedObjectReference *host, /* optional */ + esxVI_Event **output); /* optional, list */ + +#include "esx_vi_methods.generated.h" #endif /* __ESX_VI_METHODS_H__ */ -- 1.6.3.3

2 2

[libvirt] [PATCH] nwfilter: use virFindFileInPath for needed CLI tools
by Stefan Berger 14 Apr '10

14 Apr '10

I am getting rid of determining the path to necessary CLI tools at compile time. Instead, now the firewall driver has an initialization function that uses virFindFileInPath() to determine the path to necessary CLI tools and a shutdown function to free allocated memory. The rest of the patch mostly deals with availability of the CLI tools and to not call certain code blocks if a tool is not available and that strings now have to be built slightly differently. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- configure.ac | 12 src/conf/nwfilter_conf.h | 10 src/nwfilter/nwfilter_driver.c | 3 src/nwfilter/nwfilter_ebiptables_driver.c | 454 +++++++++++++++++++----------- src/nwfilter/nwfilter_gentech_driver.c | 25 + src/nwfilter/nwfilter_gentech_driver.h | 2 6 files changed, 337 insertions(+), 169 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -451,6 +451,9 @@ struct domUpdateCBStruct { }; +typedef int (*virNWFilterTechDrvInit)(void); +typedef void (*virNWFilterTechDrvShutdown)(void); + enum virDomainNetType; typedef int (*virNWFilterRuleCreateInstance)(virConnectPtr conn, @@ -484,9 +487,16 @@ typedef int (*virNWFilterRuleFreeInstanc typedef int (*virNWFilterRuleDisplayInstanceData)(virConnectPtr conn, void *_inst); +enum techDrvFlags { + TECHDRV_FLAG_INITIALIZED = (1 << 0), +}; struct _virNWFilterTechDriver { const char *name; + enum techDrvFlags flags; + + virNWFilterTechDrvInit init; + virNWFilterTechDrvShutdown shutdown; virNWFilterRuleCreateInstance createRuleInstance; virNWFilterRuleApplyNewRules applyNewRules; Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -62,12 +62,13 @@ : "" -#define EBTABLES_CMD EBTABLES_PATH -#define IPTABLES_CMD IPTABLES_PATH -#define IP6TABLES_CMD IP6TABLES_PATH -#define BASH_CMD BASH_PATH -#define GREP_CMD GREP_PATH -#define GAWK_CMD GAWK_PATH +static char *ebtables_cmd_path; +static char *iptables_cmd_path; +static char *ip6tables_cmd_path; +static char *bash_cmd_path; +static char *grep_cmd_path; +static char *gawk_cmd_path; + #define PRINT_ROOT_CHAIN(buf, prefix, ifname) \ snprintf(buf, sizeof(buf), "libvirt-%c-%s", prefix, ifname) @@ -97,6 +98,10 @@ static const char *m_physdev_out_str = " #define MATCH_PHYSDEV_OUT m_physdev_out_str +static int ebiptablesDriverInit(void); +static void ebiptablesDriverShutdown(void); + + static const char *supported_protocols[] = { "ipv4", "ipv6", @@ -367,11 +372,11 @@ static int iptablesLinkIPTablesBaseChain { virBufferVSprintf(buf, "res=$(%s -L %s -n --line-number | " - GREP_CMD " \" %s \")\n" + "%s \" %s \")\n" "if [ $? -ne 0 ]; then\n" " %s -I %s %d -j %s\n" "else\n" - " r=$(echo $res | " GAWK_CMD " '{print $1}')\n" + " r=$(echo $res | %s '{print $1}')\n" " if [ \"${r}\" != \"%d\" ]; then\n" " " CMD_DEF("%s -I %s %d -j %s") CMD_SEPARATOR " " CMD_EXEC @@ -384,9 +389,10 @@ static int iptablesLinkIPTablesBaseChain "fi\n", iptables_cmd, syschain, - udchain, + grep_cmd_path, udchain, iptables_cmd, syschain, pos, udchain, + gawk_cmd_path, pos, @@ -1052,10 +1058,19 @@ _iptablesCreateRuleInstance(int directio char number[20]; virBuffer buf = VIR_BUFFER_INITIALIZER; const char *target; - const char *iptables_cmd = (isIPv6) ? IP6TABLES_CMD : IPTABLES_CMD; + const char *iptables_cmd = (isIPv6) ? ip6tables_cmd_path + : iptables_cmd_path; unsigned int bufUsed; bool srcMacSkipped = false; + if (!iptables_cmd) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("cannot create rule since %s tool is " + "missing."), + isIPv6 ? "ip6tables" : "iptables"); + goto err_exit; + } + PRINT_IPT_ROOT_CHAIN(chain, chainPrefix, ifname); switch (rule->prtclType) { @@ -1518,6 +1533,13 @@ ebtablesCreateRuleInstance(char chainPre char chain[MAX_CHAINNAME_LENGTH]; virBuffer buf = VIR_BUFFER_INITIALIZER; + if (!ebtables_cmd_path) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("cannot create rule since ebtables tool is " + "missing.")); + goto err_exit; + } + if (nwfilter->chainsuffix == VIR_NWFILTER_CHAINSUFFIX_ROOT) PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); else @@ -1529,8 +1551,8 @@ ebtablesCreateRuleInstance(char chainPre case VIR_NWFILTER_RULE_PROTOCOL_MAC: virBufferVSprintf(&buf, - CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", - EBTABLES_DEFAULT_TABLE, chain); + CMD_DEF_PRE "%s -t %s -%%c %s %%s", + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain); if (ebtablesHandleEthHdr(&buf, @@ -1554,8 +1576,8 @@ ebtablesCreateRuleInstance(char chainPre case VIR_NWFILTER_RULE_PROTOCOL_ARP: virBufferVSprintf(&buf, - CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", - EBTABLES_DEFAULT_TABLE, chain); + CMD_DEF_PRE "%s -t %s -%%c %s %%s", + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain); if (ebtablesHandleEthHdr(&buf, vars, @@ -1653,8 +1675,8 @@ ebtablesCreateRuleInstance(char chainPre case VIR_NWFILTER_RULE_PROTOCOL_IP: virBufferVSprintf(&buf, - CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", - EBTABLES_DEFAULT_TABLE, chain); + CMD_DEF_PRE "%s -t %s -%%c %s %%s", + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain); if (ebtablesHandleEthHdr(&buf, vars, @@ -1789,8 +1811,8 @@ ebtablesCreateRuleInstance(char chainPre case VIR_NWFILTER_RULE_PROTOCOL_IPV6: virBufferVSprintf(&buf, - CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", - EBTABLES_DEFAULT_TABLE, chain); + CMD_DEF_PRE "%s -t %s -%%c %s %%s", + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain); if (ebtablesHandleEthHdr(&buf, vars, @@ -1913,8 +1935,8 @@ ebtablesCreateRuleInstance(char chainPre case VIR_NWFILTER_RULE_PROTOCOL_NONE: virBufferVSprintf(&buf, - CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", - EBTABLES_DEFAULT_TABLE, chain); + CMD_DEF_PRE "%s -t %s -%%c %s %%s", + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain); break; default: @@ -2103,16 +2125,26 @@ ebiptablesWriteToTempFile(const char *st char filename[] = "/tmp/virtdXXXXXX"; int len; char *filnam; - const char header[] = "#!" BASH_CMD "\n"; + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *header; size_t written; + virBufferVSprintf(&buf, "#!%s\n", bash_cmd_path); + + if (virBufferError(&buf)) { + virBufferFreeAndReset(&buf); + virReportOOMError(); + return NULL; + } + header = virBufferContentAndReset(&buf); + int fd = mkstemp(filename); if (fd < 0) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot create temporary file")); - return NULL; + goto err_exit; } if (fchmod(fd, S_IXUSR| S_IRUSR | S_IWUSR) < 0) { @@ -2146,10 +2178,12 @@ ebiptablesWriteToTempFile(const char *st goto err_exit; } + VIR_FREE(header); close(fd); return filnam; err_exit: + VIR_FREE(header); close(fd); unlink(filename); return NULL; @@ -2227,10 +2261,10 @@ ebtablesCreateTmpRootChain(virBufferPtr PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); virBufferVSprintf(buf, - CMD_DEF(EBTABLES_CMD " -t %s -N %s") CMD_SEPARATOR + CMD_DEF("%s -t %s -N %s") CMD_SEPARATOR CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, chain, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain, CMD_STOPONERR(stopOnError)); return 0; @@ -2250,10 +2284,10 @@ ebtablesLinkTmpRootChain(virBufferPtr bu PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); virBufferVSprintf(buf, - CMD_DEF(EBTABLES_CMD " -t %s -A %s -%c %s -j %s") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s -%c %s -j %s") CMD_SEPARATOR CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, (incoming) ? EBTABLES_CHAIN_INCOMING : EBTABLES_CHAIN_OUTGOING, iodev, ifname, chain, @@ -2281,10 +2315,10 @@ _ebtablesRemoveRootChain(virBufferPtr bu PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); virBufferVSprintf(buf, - EBTABLES_CMD " -t %s -F %s" CMD_SEPARATOR - EBTABLES_CMD " -t %s -X %s" CMD_SEPARATOR, - EBTABLES_DEFAULT_TABLE, chain, - EBTABLES_DEFAULT_TABLE, chain); + "%s -t %s -F %s" CMD_SEPARATOR + "%s -t %s -X %s" CMD_SEPARATOR, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain); return 0; } @@ -2326,8 +2360,8 @@ _ebtablesUnlinkRootChain(virBufferPtr bu PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); virBufferVSprintf(buf, - EBTABLES_CMD " -t %s -D %s -%c %s -j %s" CMD_SEPARATOR, - EBTABLES_DEFAULT_TABLE, + "%s -t %s -D %s -%c %s -j %s" CMD_SEPARATOR, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, (incoming) ? EBTABLES_CHAIN_INCOMING : EBTABLES_CHAIN_OUTGOING, iodev, ifname, chain); @@ -2367,20 +2401,19 @@ ebtablesCreateTmpSubChain(virBufferPtr b PRINT_CHAIN(chain, chainPrefix, ifname, protocol); virBufferVSprintf(buf, - CMD_DEF(EBTABLES_CMD " -t %s -N %s") CMD_SEPARATOR + CMD_DEF("%s -t %s -N %s") CMD_SEPARATOR CMD_EXEC "%s" - CMD_DEF(EBTABLES_CMD " -t %s -A %s -p %s -j %s") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s -p %s -j %s") CMD_SEPARATOR CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, chain, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain, CMD_STOPONERR(stopOnError), - EBTABLES_DEFAULT_TABLE, - rootchain, - protocol, chain, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, + rootchain, protocol, chain, CMD_STOPONERR(stopOnError)); @@ -2409,16 +2442,15 @@ _ebtablesRemoveSubChain(virBufferPtr buf PRINT_CHAIN(chain, chainPrefix, ifname, protocol); virBufferVSprintf(buf, - EBTABLES_CMD " -t %s -D %s -p %s -j %s" CMD_SEPARATOR - EBTABLES_CMD " -t %s -F %s" CMD_SEPARATOR - EBTABLES_CMD " -t %s -X %s" CMD_SEPARATOR, - EBTABLES_DEFAULT_TABLE, - rootchain, - protocol, chain, + "%s -t %s -D %s -p %s -j %s" CMD_SEPARATOR + "%s -t %s -F %s" CMD_SEPARATOR + "%s -t %s -X %s" CMD_SEPARATOR, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, + rootchain, protocol, chain, - EBTABLES_DEFAULT_TABLE, chain, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain, - EBTABLES_DEFAULT_TABLE, chain); + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain); return 0; } @@ -2497,10 +2529,8 @@ ebtablesRenameTmpSubChain(virBufferPtr b } virBufferVSprintf(buf, - EBTABLES_CMD " -t %s -E %s %s" CMD_SEPARATOR, - EBTABLES_DEFAULT_TABLE, - tmpchain, - chain); + "%s -t %s -E %s %s" CMD_SEPARATOR, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, tmpchain, chain); return 0; } @@ -2568,6 +2598,13 @@ ebtablesApplyBasicRules(const char *ifna char chainPrefix = CHAINPREFIX_HOST_IN_TEMP; char macaddr_str[VIR_MAC_STRING_BUFLEN]; + if (!ebtables_cmd_path) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("cannot create rules since ebtables tool is " + "missing.")); + return 1; + } + virFormatMacAddr(macaddr, macaddr_str); ebtablesUnlinkTmpRootChain(&buf, 1, ifname); @@ -2581,44 +2618,36 @@ ebtablesApplyBasicRules(const char *ifna PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); virBufferVSprintf(&buf, - CMD_DEF(EBTABLES_CMD - " -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, - chain, - macaddr_str, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, + chain, macaddr_str, CMD_STOPONERR(1)); virBufferVSprintf(&buf, - CMD_DEF(EBTABLES_CMD - " -t %s -A %s -p IPv4 -j ACCEPT") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s -p IPv4 -j ACCEPT") CMD_SEPARATOR CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, - chain, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain, CMD_STOPONERR(1)); virBufferVSprintf(&buf, - CMD_DEF(EBTABLES_CMD - " -t %s -A %s -p ARP -j ACCEPT") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s -p ARP -j ACCEPT") CMD_SEPARATOR CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, - chain, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain, CMD_STOPONERR(1)); virBufferVSprintf(&buf, - CMD_DEF(EBTABLES_CMD - " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s -j DROP") CMD_SEPARATOR CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, - chain, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain, CMD_STOPONERR(1)); ebtablesLinkTmpRootChain(&buf, 1, ifname, 1); @@ -2665,6 +2694,13 @@ ebtablesApplyDHCPOnlyRules(const char *i char macaddr_str[VIR_MAC_STRING_BUFLEN]; char *srcIPParam = NULL; + if (!ebtables_cmd_path) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("cannot create rules since ebtables tool is " + "missing.")); + return 1; + } + if (dhcpserver) { virBufferVSprintf(&buf, " --ip-src %s", dhcpserver); if (virBufferError(&buf)) @@ -2688,8 +2724,7 @@ ebtablesApplyDHCPOnlyRules(const char *i PRINT_ROOT_CHAIN(chain_out, CHAINPREFIX_HOST_OUT_TEMP, ifname); virBufferVSprintf(&buf, - CMD_DEF(EBTABLES_CMD - " -t %s -A %s" + CMD_DEF("%s -t %s -A %s" " -s %s -d Broadcast " " -p ipv4 --ip-protocol udp" " --ip-src 0.0.0.0 --ip-dst 255.255.255.255" @@ -2698,24 +2733,20 @@ ebtablesApplyDHCPOnlyRules(const char *i CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, - chain_in, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain_in, macaddr_str, CMD_STOPONERR(1)); virBufferVSprintf(&buf, - CMD_DEF(EBTABLES_CMD - " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s -j DROP") CMD_SEPARATOR CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, - chain_in, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain_in, CMD_STOPONERR(1)); virBufferVSprintf(&buf, - CMD_DEF(EBTABLES_CMD - " -t %s -A %s" + CMD_DEF("%s -t %s -A %s" " -d %s" " -p ipv4 --ip-protocol udp" " %s" @@ -2724,20 +2755,17 @@ ebtablesApplyDHCPOnlyRules(const char *i CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, - chain_out, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain_out, macaddr_str, srcIPParam != NULL ? srcIPParam : "", CMD_STOPONERR(1)); virBufferVSprintf(&buf, - CMD_DEF(EBTABLES_CMD - " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_DEF("%s -t %s -A %s -j DROP") CMD_SEPARATOR CMD_EXEC "%s", - EBTABLES_DEFAULT_TABLE, - chain_out, + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain_out, CMD_STOPONERR(1)); ebtablesLinkTmpRootChain(&buf, 1, ifname, 1); @@ -2769,6 +2797,9 @@ ebtablesRemoveBasicRules(const char *ifn virBuffer buf = VIR_BUFFER_INITIALIZER; int cli_status; + if (!ebtables_cmd_path) + return 0; + ebtablesUnlinkTmpRootChain(&buf, 1, ifname); ebtablesUnlinkTmpRootChain(&buf, 0, ifname); ebtablesRemoveTmpSubChains(&buf, ifname); @@ -2800,8 +2831,8 @@ ebiptablesApplyNewRules(virConnectPtr co ebiptablesRuleInstPtr *inst = (ebiptablesRuleInstPtr *)_inst; int chains_in = 0, chains_out = 0; virBuffer buf = VIR_BUFFER_INITIALIZER; - int haveIptables = 0; - int haveIp6tables = 0; + bool haveIptables = false; + bool haveIp6tables = false; if (inst) qsort(inst, nruleInstances, sizeof(inst[0]), @@ -2816,12 +2847,14 @@ ebiptablesApplyNewRules(virConnectPtr co } } - ebtablesUnlinkTmpRootChain(&buf, 1, ifname); - ebtablesUnlinkTmpRootChain(&buf, 0, ifname); - ebtablesRemoveTmpSubChains(&buf, ifname); - ebtablesRemoveTmpRootChain(&buf, 1, ifname); - ebtablesRemoveTmpRootChain(&buf, 0, ifname); - ebiptablesExecCLI(&buf, &cli_status); + if (ebtables_cmd_path) { + ebtablesUnlinkTmpRootChain(&buf, 1, ifname); + ebtablesUnlinkTmpRootChain(&buf, 0, ifname); + ebtablesRemoveTmpSubChains(&buf, ifname); + ebtablesRemoveTmpRootChain(&buf, 1, ifname); + ebtablesRemoveTmpRootChain(&buf, 0, ifname); + ebiptablesExecCLI(&buf, &cli_status); + } if (chains_in != 0) ebtablesCreateTmpRootChain(&buf, 1, ifname, 1); @@ -2855,34 +2888,32 @@ ebiptablesApplyNewRules(virConnectPtr co 'A', -1, 1); break; case RT_IPTABLES: - haveIptables = 1; + haveIptables = true; break; case RT_IP6TABLES: - haveIp6tables = 1; + haveIp6tables = true; break; } if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpebchains; - // FIXME: establishment of iptables user define table tree goes here - if (haveIptables) { - iptablesUnlinkTmpRootChains(IPTABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(iptables_cmd_path, &buf, ifname); + iptablesRemoveTmpRootChains(iptables_cmd_path, &buf, ifname); - iptablesCreateBaseChains(IPTABLES_CMD, &buf); + iptablesCreateBaseChains(iptables_cmd_path, &buf); if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpebchains; - iptablesCreateTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesCreateTmpRootChains(iptables_cmd_path, &buf, ifname); if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; - iptablesLinkTmpRootChains(IPTABLES_CMD, &buf, ifname); - iptablesSetupVirtInPost(IPTABLES_CMD, &buf, ifname); + iptablesLinkTmpRootChains(iptables_cmd_path, &buf, ifname); + iptablesSetupVirtInPost(iptables_cmd_path, &buf, ifname); if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; @@ -2898,21 +2929,21 @@ ebiptablesApplyNewRules(virConnectPtr co } if (haveIp6tables) { - iptablesUnlinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(ip6tables_cmd_path, &buf, ifname); + iptablesRemoveTmpRootChains(ip6tables_cmd_path, &buf, ifname); - iptablesCreateBaseChains(IP6TABLES_CMD, &buf); + iptablesCreateBaseChains(ip6tables_cmd_path, &buf); if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; - iptablesCreateTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesCreateTmpRootChains(ip6tables_cmd_path, &buf, ifname); if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpip6tchains; - iptablesLinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); - iptablesSetupVirtInPost(IP6TABLES_CMD, &buf, ifname); + iptablesLinkTmpRootChains(ip6tables_cmd_path, &buf, ifname); + iptablesSetupVirtInPost(ip6tables_cmd_path, &buf, ifname); if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpip6tchains; @@ -2927,9 +2958,6 @@ ebiptablesApplyNewRules(virConnectPtr co goto tear_down_tmpip6tchains; } - - // END IPTABLES stuff - if (chains_in != 0) ebtablesLinkTmpRootChain(&buf, 1, ifname, 1); if (chains_out != 0) @@ -2941,25 +2969,29 @@ ebiptablesApplyNewRules(virConnectPtr co return 0; tear_down_ebsubchains_and_unlink: - ebtablesUnlinkTmpRootChain(&buf, 1, ifname); - ebtablesUnlinkTmpRootChain(&buf, 0, ifname); + if (ebtables_cmd_path) { + ebtablesUnlinkTmpRootChain(&buf, 1, ifname); + ebtablesUnlinkTmpRootChain(&buf, 0, ifname); + } tear_down_tmpip6tchains: if (haveIp6tables) { - iptablesUnlinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(ip6tables_cmd_path, &buf, ifname); + iptablesRemoveTmpRootChains(ip6tables_cmd_path, &buf, ifname); } tear_down_tmpiptchains: if (haveIptables) { - iptablesUnlinkTmpRootChains(IPTABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(iptables_cmd_path, &buf, ifname); + iptablesRemoveTmpRootChains(iptables_cmd_path, &buf, ifname); } tear_down_tmpebchains: - ebtablesRemoveTmpSubChains(&buf, ifname); - ebtablesRemoveTmpRootChain(&buf, 1, ifname); - ebtablesRemoveTmpRootChain(&buf, 0, ifname); + if (ebtables_cmd_path) { + ebtablesRemoveTmpSubChains(&buf, ifname); + ebtablesRemoveTmpRootChain(&buf, 1, ifname); + ebtablesRemoveTmpRootChain(&buf, 0, ifname); + } ebiptablesExecCLI(&buf, &cli_status); @@ -2978,18 +3010,24 @@ ebiptablesTearNewRules(virConnectPtr con int cli_status; virBuffer buf = VIR_BUFFER_INITIALIZER; - iptablesUnlinkTmpRootChains(IPTABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(IPTABLES_CMD, &buf, ifname); + if (iptables_cmd_path) { + iptablesUnlinkTmpRootChains(iptables_cmd_path, &buf, ifname); + iptablesRemoveTmpRootChains(iptables_cmd_path, &buf, ifname); + } - iptablesUnlinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(IP6TABLES_CMD, &buf, ifname); + if (ip6tables_cmd_path) { + iptablesUnlinkTmpRootChains(ip6tables_cmd_path, &buf, ifname); + iptablesRemoveTmpRootChains(ip6tables_cmd_path, &buf, ifname); + } - ebtablesUnlinkTmpRootChain(&buf, 1, ifname); - ebtablesUnlinkTmpRootChain(&buf, 0, ifname); + if (ebtables_cmd_path) { + ebtablesUnlinkTmpRootChain(&buf, 1, ifname); + ebtablesUnlinkTmpRootChain(&buf, 0, ifname); - ebtablesRemoveTmpSubChains(&buf, ifname); - ebtablesRemoveTmpRootChain(&buf, 1, ifname); - ebtablesRemoveTmpRootChain(&buf, 0, ifname); + ebtablesRemoveTmpSubChains(&buf, ifname); + ebtablesRemoveTmpRootChain(&buf, 1, ifname); + ebtablesRemoveTmpRootChain(&buf, 0, ifname); + } ebiptablesExecCLI(&buf, &cli_status); @@ -3005,31 +3043,37 @@ ebiptablesTearOldRules(virConnectPtr con virBuffer buf = VIR_BUFFER_INITIALIZER; // switch to new iptables user defined chains - iptablesUnlinkRootChains(IPTABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(IPTABLES_CMD, &buf, ifname); + if (iptables_cmd_path) { + iptablesUnlinkRootChains(iptables_cmd_path, &buf, ifname); + iptablesRemoveRootChains(iptables_cmd_path, &buf, ifname); - iptablesRenameTmpRootChains(IPTABLES_CMD, &buf, ifname); - ebiptablesExecCLI(&buf, &cli_status); + iptablesRenameTmpRootChains(iptables_cmd_path, &buf, ifname); + ebiptablesExecCLI(&buf, &cli_status); + } - iptablesUnlinkRootChains(IP6TABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(IP6TABLES_CMD, &buf, ifname); + if (ip6tables_cmd_path) { + iptablesUnlinkRootChains(ip6tables_cmd_path, &buf, ifname); + iptablesRemoveRootChains(ip6tables_cmd_path, &buf, ifname); - iptablesRenameTmpRootChains(IP6TABLES_CMD, &buf, ifname); - ebiptablesExecCLI(&buf, &cli_status); + iptablesRenameTmpRootChains(ip6tables_cmd_path, &buf, ifname); + ebiptablesExecCLI(&buf, &cli_status); + } - ebtablesUnlinkRootChain(&buf, 1, ifname); - ebtablesUnlinkRootChain(&buf, 0, ifname); + if (ebtables_cmd_path) { + ebtablesUnlinkRootChain(&buf, 1, ifname); + ebtablesUnlinkRootChain(&buf, 0, ifname); - ebtablesRemoveSubChains(&buf, ifname); + ebtablesRemoveSubChains(&buf, ifname); - ebtablesRemoveRootChain(&buf, 1, ifname); - ebtablesRemoveRootChain(&buf, 0, ifname); + ebtablesRemoveRootChain(&buf, 1, ifname); + ebtablesRemoveRootChain(&buf, 0, ifname); - ebtablesRenameTmpSubChains(&buf, ifname); - ebtablesRenameTmpRootChain(&buf, 1, ifname); - ebtablesRenameTmpRootChain(&buf, 0, ifname); + ebtablesRenameTmpSubChains(&buf, ifname); + ebtablesRenameTmpRootChain(&buf, 1, ifname); + ebtablesRenameTmpRootChain(&buf, 0, ifname); - ebiptablesExecCLI(&buf, &cli_status); + ebiptablesExecCLI(&buf, &cli_status); + } return 0; } @@ -3095,21 +3139,27 @@ ebiptablesAllTeardown(const char *ifname virBuffer buf = VIR_BUFFER_INITIALIZER; int cli_status; - iptablesUnlinkRootChains(IPTABLES_CMD, &buf, ifname); - iptablesClearVirtInPost (IPTABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(IPTABLES_CMD, &buf, ifname); + if (iptables_cmd_path) { + iptablesUnlinkRootChains(iptables_cmd_path, &buf, ifname); + iptablesClearVirtInPost (iptables_cmd_path, &buf, ifname); + iptablesRemoveRootChains(iptables_cmd_path, &buf, ifname); + } - iptablesUnlinkRootChains(IP6TABLES_CMD, &buf, ifname); - iptablesClearVirtInPost (IP6TABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(IP6TABLES_CMD, &buf, ifname); + if (ip6tables_cmd_path) { + iptablesUnlinkRootChains(ip6tables_cmd_path, &buf, ifname); + iptablesClearVirtInPost (ip6tables_cmd_path, &buf, ifname); + iptablesRemoveRootChains(ip6tables_cmd_path, &buf, ifname); + } - ebtablesUnlinkRootChain(&buf, 1, ifname); - ebtablesUnlinkRootChain(&buf, 0, ifname); + if (ebtables_cmd_path) { + ebtablesUnlinkRootChain(&buf, 1, ifname); + ebtablesUnlinkRootChain(&buf, 0, ifname); - ebtablesRemoveRootChain(&buf, 1, ifname); - ebtablesRemoveRootChain(&buf, 0, ifname); + ebtablesRemoveRootChain(&buf, 1, ifname); + ebtablesRemoveRootChain(&buf, 0, ifname); - ebtablesRemoveSubChains(&buf, ifname); + ebtablesRemoveSubChains(&buf, ifname); + } ebiptablesExecCLI(&buf, &cli_status); @@ -3119,6 +3169,10 @@ ebiptablesAllTeardown(const char *ifname virNWFilterTechDriver ebiptables_driver = { .name = EBIPTABLES_DRIVER_ID, + .flags = 0, + + .init = ebiptablesDriverInit, + .shutdown = ebiptablesDriverShutdown, .createRuleInstance = ebiptablesCreateRuleInstance, .applyNewRules = ebiptablesApplyNewRules, @@ -3129,3 +3183,91 @@ virNWFilterTechDriver ebiptables_driver .freeRuleInstance = ebiptablesFreeRuleInstance, .displayRuleInstance = ebiptablesDisplayRuleInstance, }; + + +static int +ebiptablesDriverInit(void) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + + bash_cmd_path = virFindFileInPath("bash"); + gawk_cmd_path = virFindFileInPath("gawk"); + grep_cmd_path = virFindFileInPath("grep"); + + ebtables_cmd_path = virFindFileInPath("ebtables"); + if (ebtables_cmd_path) { + /* basic probing */ + virBufferVSprintf(&buf, + CMD_DEF("%s -t %s -L") CMD_SEPARATOR + CMD_EXEC + "%s", + ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, + CMD_STOPONERR(1)); + + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status) + VIR_FREE(ebtables_cmd_path); + } + + iptables_cmd_path = virFindFileInPath("iptables"); + if (iptables_cmd_path) { + virBufferVSprintf(&buf, + CMD_DEF("%s -L FORWARD") CMD_SEPARATOR + CMD_EXEC + "%s", + iptables_cmd_path, + CMD_STOPONERR(1)); + + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status) + VIR_FREE(iptables_cmd_path); + } + + ip6tables_cmd_path = virFindFileInPath("ip6tables"); + if (ip6tables_cmd_path) { + virBufferVSprintf(&buf, + CMD_DEF("%s -L FORWARD") CMD_SEPARATOR + CMD_EXEC + "%s", + ip6tables_cmd_path, + CMD_STOPONERR(1)); + + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status) + VIR_FREE(ip6tables_cmd_path); + } + + /* ip(6)tables support needs bash, gawk & grep, ebtables doesn't */ + if ((iptables_cmd_path != NULL || ip6tables_cmd_path != NULL) && + (!grep_cmd_path || !bash_cmd_path || !gawk_cmd_path)) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("essential tools to support ip(6)tables " + "firewalls could not be located")); + VIR_FREE(iptables_cmd_path); + VIR_FREE(ip6tables_cmd_path); + } + + + if (!ebtables_cmd_path && !iptables_cmd_path && !ip6tables_cmd_path) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("firewall tools were not found or " + "cannot be used")); + ebiptablesDriverShutdown(); + return ENOTSUP; + } + + ebiptables_driver.flags = TECHDRV_FLAG_INITIALIZED; + + return 0; +} + + +static void +ebiptablesDriverShutdown() +{ + VIR_FREE(gawk_cmd_path); + VIR_FREE(bash_cmd_path); + VIR_FREE(grep_cmd_path); + VIR_FREE(ebtables_cmd_path); + VIR_FREE(iptables_cmd_path); + VIR_FREE(ip6tables_cmd_path); + ebiptables_driver.flags = 0; +} Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -50,12 +50,35 @@ static virNWFilterTechDriverPtr filter_t }; +void virNWFilterTechDriversInit() { + int i = 0; + while (filter_tech_drivers[i]) { + if (!(filter_tech_drivers[i]->flags & TECHDRV_FLAG_INITIALIZED)) + filter_tech_drivers[i]->init(); + i++; + } +} + + +void virNWFilterTechDriversShutdown() { + int i = 0; + while (filter_tech_drivers[i]) { + if ((filter_tech_drivers[i]->flags & TECHDRV_FLAG_INITIALIZED)) + filter_tech_drivers[i]->shutdown(); + i++; + } +} + + virNWFilterTechDriverPtr virNWFilterTechDriverForName(const char *name) { int i = 0; while (filter_tech_drivers[i]) { - if (STREQ(filter_tech_drivers[i]->name, name)) + if (STREQ(filter_tech_drivers[i]->name, name)) { + if ((filter_tech_drivers[i]->flags & TECHDRV_FLAG_INITIALIZED) == 0) + break; return filter_tech_drivers[i]; + } i++; } return NULL; Index: libvirt-acl/configure.ac =================================================================== --- libvirt-acl.orig/configure.ac +++ libvirt-acl/configure.ac @@ -295,24 +295,12 @@ if test x"$with_rhel5_api" = x"yes"; the AC_DEFINE([WITH_RHEL5_API], [1], [whether building for the RHEL-5 API]) fi -AC_PATH_PROG([BASH_PATH], [bash], /bin/bash, [/bin:$PATH]) -AC_DEFINE_UNQUOTED([BASH_PATH], "$BASH_PATH", [path to bash binary]) - AC_PATH_PROG([IPTABLES_PATH], [iptables], /sbin/iptables, [/usr/sbin:$PATH]) AC_DEFINE_UNQUOTED([IPTABLES_PATH], "$IPTABLES_PATH", [path to iptables binary]) -AC_PATH_PROG([IP6TABLES_PATH], [ip6tables], /sbin/ip6tables, [/usr/sbin:$PATH]) -AC_DEFINE_UNQUOTED([IP6TABLES_PATH], "$IP6TABLES_PATH", [path to ip6tables binary]) - AC_PATH_PROG([EBTABLES_PATH], [ebtables], /sbin/ebtables, [/usr/sbin:$PATH]) AC_DEFINE_UNQUOTED([EBTABLES_PATH], "$EBTABLES_PATH", [path to ebtables binary]) -AC_PATH_PROG([GREP_PATH], [grep], /bin/grep, [/bin:$PATH]) -AC_DEFINE_UNQUOTED([GREP_PATH], "$GREP_PATH", [path to grep binary]) - -AC_PATH_PROG([GAWK_PATH], [gawk], /bin/gawk, [/bin:$PATH]) -AC_DEFINE_UNQUOTED([GAWK_PATH], "$GAWK_PATH", [path to gawk binary]) - if test "$with_openvz" = "yes"; then AC_DEFINE_UNQUOTED([WITH_OPENVZ], 1, [whether OpenVZ driver is enabled]) Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -70,6 +70,8 @@ nwfilterDriverStartup(int privileged) { if (virNWFilterLearnInit() < 0) return -1; + virNWFilterTechDriversInit(); + if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) goto conf_init_err; @@ -126,6 +128,7 @@ alloc_err_exit: virNWFilterConfLayerShutdown(); conf_init_err: + virNWFilterTechDriversShutdown(); virNWFilterLearnShutdown(); return -1; Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -28,6 +28,8 @@ virNWFilterTechDriverPtr virNWFilterTech int virNWFilterRuleInstAddData(virNWFilterRuleInstPtr res, void *data); +void virNWFilterTechDriversInit(void); +void virNWFilterTechDriversShutdown(void); enum instCase { INSTANTIATE_ALWAYS,

2 1

[libvirt] [PATCH] Fix build of openvz on RHEL-5.
by Chris Lalancette 14 Apr '10

14 Apr '10

When building libvirt on RHEL-5, I saw this error: cc1: warnings being treated as errors openvz/openvz_conf.c: In function 'openvzGetVPSUUID': openvz/openvz_conf.c:835: warning: 'saveptr' may be used uninitialized in this function make[3]: *** [libvirt_driver_openvz_la-openvz_conf.lo] Error 1 gcc in RHEL-5 gets upset about this usage of strtok_r (even though it is perfectly valid). Just set *saveptr to NULL at the start to quiet it down. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/openvz/openvz_conf.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/openvz/openvz_conf.c b/src/openvz/openvz_conf.c index 51567d4..8735cc1 100644 --- a/src/openvz/openvz_conf.c +++ b/src/openvz/openvz_conf.c @@ -832,7 +832,7 @@ openvzGetVPSUUID(int vpsid, char *uuidstr, size_t len) { char conf_file[PATH_MAX]; char line[1024]; - char *saveptr; + char *saveptr = NULL; char *uuidbuf; char *iden; int fd, ret; -- 1.6.6.1

2 2

[libvirt] FYI: pushed trivial patches
by Chris Lalancette 14 Apr '10

14 Apr '10

I just pushed these 4 trivial patches: >From 9295dfda8632aeb19f2c7553b35817f01381491a Mon Sep 17 00:00:00 2001 From: Chris Lalancette <clalance(a)redhat.com> Date: Wed, 7 Apr 2010 11:23:11 -0400 Subject: [PATCH] Fix up formatting of remote protocol stuff. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- daemon/remote_dispatch_prototypes.h | 66 +++++++++++++++++----------------- src/remote/remote_protocol.x | 1 + 2 files changed, 34 insertions(+), 33 deletions(-) diff --git a/daemon/remote_dispatch_prototypes.h b/daemon/remote_dispatch_prototypes.h index 5ce2873..f6fcff8 100644 --- a/daemon/remote_dispatch_prototypes.h +++ b/daemon/remote_dispatch_prototypes.h @@ -282,6 +282,14 @@ static int remoteDispatchDomainGetVcpus( remote_error *err, remote_domain_get_vcpus_args *args, remote_domain_get_vcpus_ret *ret); +static int remoteDispatchDomainHasCurrentSnapshot( + struct qemud_server *server, + struct qemud_client *client, + virConnectPtr conn, + remote_message_header *hdr, + remote_error *err, + remote_domain_has_current_snapshot_args *args, + remote_domain_has_current_snapshot_ret *ret); static int remoteDispatchDomainHasManagedSaveImage( struct qemud_server *server, struct qemud_client *client, @@ -458,6 +466,14 @@ static int remoteDispatchDomainResume( remote_error *err, remote_domain_resume_args *args, void *ret); +static int remoteDispatchDomainRevertToSnapshot( + struct qemud_server *server, + struct qemud_client *client, + virConnectPtr conn, + remote_message_header *hdr, + remote_error *err, + remote_domain_revert_to_snapshot_args *args, + void *ret); static int remoteDispatchDomainSave( struct qemud_server *server, struct qemud_client *client, @@ -522,22 +538,30 @@ static int remoteDispatchDomainSnapshotCreateXml( remote_error *err, remote_domain_snapshot_create_xml_args *args, remote_domain_snapshot_create_xml_ret *ret); -static int remoteDispatchDomainSnapshotDumpXml( +static int remoteDispatchDomainSnapshotCurrent( struct qemud_server *server, struct qemud_client *client, virConnectPtr conn, remote_message_header *hdr, remote_error *err, - remote_domain_snapshot_dump_xml_args *args, - remote_domain_snapshot_dump_xml_ret *ret); -static int remoteDispatchDomainSnapshotNum( + remote_domain_snapshot_current_args *args, + remote_domain_snapshot_current_ret *ret); +static int remoteDispatchDomainSnapshotDelete( struct qemud_server *server, struct qemud_client *client, virConnectPtr conn, remote_message_header *hdr, remote_error *err, - remote_domain_snapshot_num_args *args, - remote_domain_snapshot_num_ret *ret); + remote_domain_snapshot_delete_args *args, + void *ret); +static int remoteDispatchDomainSnapshotDumpXml( + struct qemud_server *server, + struct qemud_client *client, + virConnectPtr conn, + remote_message_header *hdr, + remote_error *err, + remote_domain_snapshot_dump_xml_args *args, + remote_domain_snapshot_dump_xml_ret *ret); static int remoteDispatchDomainSnapshotListNames( struct qemud_server *server, struct qemud_client *client, @@ -554,38 +578,14 @@ static int remoteDispatchDomainSnapshotLookupByName( remote_error *err, remote_domain_snapshot_lookup_by_name_args *args, remote_domain_snapshot_lookup_by_name_ret *ret); -static int remoteDispatchDomainHasCurrentSnapshot( - struct qemud_server *server, - struct qemud_client *client, - virConnectPtr conn, - remote_message_header *hdr, - remote_error *err, - remote_domain_has_current_snapshot_args *args, - remote_domain_has_current_snapshot_ret *ret); -static int remoteDispatchDomainSnapshotCurrent( - struct qemud_server *server, - struct qemud_client *client, - virConnectPtr conn, - remote_message_header *hdr, - remote_error *err, - remote_domain_snapshot_current_args *args, - remote_domain_snapshot_current_ret *ret); -static int remoteDispatchDomainRevertToSnapshot( - struct qemud_server *server, - struct qemud_client *client, - virConnectPtr conn, - remote_message_header *hdr, - remote_error *err, - remote_domain_revert_to_snapshot_args *args, - void *ret); -static int remoteDispatchDomainSnapshotDelete( +static int remoteDispatchDomainSnapshotNum( struct qemud_server *server, struct qemud_client *client, virConnectPtr conn, remote_message_header *hdr, remote_error *err, - remote_domain_snapshot_delete_args *args, - void *ret); + remote_domain_snapshot_num_args *args, + remote_domain_snapshot_num_ret *ret); static int remoteDispatchDomainSuspend( struct qemud_server *server, struct qemud_client *client, diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 61b4bc1..9aa3a7e 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -1967,6 +1967,7 @@ enum remote_procedure { REMOTE_PROC_DOMAIN_SNAPSHOT_LIST_NAMES = 188, REMOTE_PROC_DOMAIN_SNAPSHOT_LOOKUP_BY_NAME = 189, REMOTE_PROC_DOMAIN_HAS_CURRENT_SNAPSHOT = 190, + REMOTE_PROC_DOMAIN_SNAPSHOT_CURRENT = 191, REMOTE_PROC_DOMAIN_REVERT_TO_SNAPSHOT = 192, REMOTE_PROC_DOMAIN_SNAPSHOT_DELETE = 193 -- 1.6.6.1 >From 1aad611e3a88940e275e795c0963ac26d7dcf350 Mon Sep 17 00:00:00 2001 From: Chris Lalancette <clalance(a)redhat.com> Date: Thu, 8 Apr 2010 08:19:35 -0400 Subject: [PATCH] Fix messsage -> message. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- daemon/dispatch.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/daemon/dispatch.c b/daemon/dispatch.c index f024900..e24acc1 100644 --- a/daemon/dispatch.c +++ b/daemon/dispatch.c @@ -348,7 +348,7 @@ remoteDispatchClientCall (struct qemud_server *server, * @msg: the complete incoming message packet, with header already decoded * * This function gets called from qemud when it pulls a incoming - * remote protocol messsage off the dispatch queue for processing. + * remote protocol message off the dispatch queue for processing. * * The @msg parameter must have had its header decoded already by * calling remoteDecodeClientMessageHeader -- 1.6.6.1 >From a94484ad7b7dbd4a16f12ae86053b876a253c337 Mon Sep 17 00:00:00 2001 From: Chris Lalancette <clalance(a)redhat.com> Date: Thu, 8 Apr 2010 08:47:02 -0400 Subject: [PATCH] Fix up a debug typo. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- daemon/dispatch.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/daemon/dispatch.c b/daemon/dispatch.c index e24acc1..8f55eaa 100644 --- a/daemon/dispatch.c +++ b/daemon/dispatch.c @@ -363,7 +363,7 @@ remoteDispatchClientRequest (struct qemud_server *server, int ret; remote_error rerr; - DEBUG("prog=%d ver=%d type=%d satus=%d serial=%d proc=%d", + DEBUG("prog=%d ver=%d type=%d status=%d serial=%d proc=%d", msg->hdr.prog, msg->hdr.vers, msg->hdr.type, msg->hdr.status, msg->hdr.serial, msg->hdr.proc); -- 1.6.6.1 >From 33857dfdeee444a7f5c7d856ebe5e64fb22610cd Mon Sep 17 00:00:00 2001 From: Chris Lalancette <clalance(a)redhat.com> Date: Thu, 8 Apr 2010 10:29:46 -0400 Subject: [PATCH] Remove some debugging leftovers. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/remote/remote_driver.c | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 98cc7f9..eec3322 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -7421,15 +7421,12 @@ remoteDomainReadEventGraphics(virConnectPtr conn, XDR *xdr) !(remoteAddr->node = strdup(msg.remote.node))) goto no_memory; - fprintf(stderr, "Got %d\n", msg.subject.subject_len); if (VIR_ALLOC(subject) < 0) goto no_memory; if (VIR_ALLOC_N(subject->identities, msg.subject.subject_len) < 0) goto no_memory; subject->nidentity = msg.subject.subject_len; for (i = 0 ; i < subject->nidentity ; i++) { - fprintf(stderr, " %s=%s\n", msg.subject.subject_val[i].type, - msg.subject.subject_val[i].name); if (!(subject->identities[i].type = strdup(msg.subject.subject_val[i].type)) || !(subject->identities[i].name = strdup(msg.subject.subject_val[i].name))) goto no_memory; -- 1.6.6.1

1 0

[libvirt] small bug in spec file (0.8.0)
by Daniel Berteaud 14 Apr '10

14 Apr '10

Hi. I've downloaded libvirt 0.8.0, and tried to re-build a rpm (on CentOS 5.4 x86_64), and found that there's a small bug in the spec file. Line 608: rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.qemu Should be: rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.lxc Without this modification, the package fails to build when LXC is disabled or not abailable. (Sorry, I really don't know GIT, and so, cannot provide a clean patch) Regards, Daniel -- Daniel Berteaud FIREWALL-SERVICES SARL. Société de Services en Logiciels Libres Technopôle Montesquieu 33650 MARTILLAC Tel : 05 56 64 15 32 Fax : 05 56 64 15 32 Mail: daniel(a)firewall-services.com Web : http://www.firewall-services.com

3 3

[libvirt] [PATCH v2] Consolidate interface related functions in interface.c
by Stefan Berger 14 Apr '10

14 Apr '10

Changes from v1 to v2: - changed function name prefixes to 'iface' from previous 'Iface' I am consolidating network interface related functions used in nwfilter and macvtap code in utils/interface.c. All function names are prefixed with 'Iface'. The following functions are now available through interface.h: int ifaceCtrl(const char *name, bool up); int ifaceUp(const char *name); int ifaceDown(const char *name); int ifaceCheck(bool reportError, const char *ifname, const unsigned char *macaddr, int ifindex); int ifaceGetIndex(bool reportError, const char *ifname, int *ifindex); I added 'int ifindex' as parameter to ifaceCheck to the original function and modified the code accordingly. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/Makefile.am | 1 src/libvirt_private.syms | 4 src/nwfilter/nwfilter_gentech_driver.c | 120 ----------------- src/nwfilter/nwfilter_gentech_driver.h | 2 src/nwfilter/nwfilter_learnipaddr.c | 3 src/util/interface.c | 224 +++++++++++++++++++++++++++++++++ src/util/interface.h | 31 ++++ src/util/macvtap.c | 112 ---------------- 8 files changed, 269 insertions(+), 228 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -23,16 +23,11 @@ #include <config.h> -#include <stdint.h> -#include <sys/socket.h> -#include <sys/ioctl.h> -#include <linux/if.h> - #include "internal.h" #include "memory.h" #include "logging.h" -#include "datatypes.h" +#include "interface.h" #include "domain_conf.h" #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" @@ -792,117 +787,6 @@ _virNWFilterInstantiateFilter(virConnect } -// FIXME: move chgIfFlags, ifUp, checkIf into common file & share w/ macvtap.c - -/* - * chgIfFlags: Change flags on an interface - * @ifname : name of the interface - * @flagclear : the flags to clear - * @flagset : the flags to set - * - * The new flags of the interface will be calculated as - * flagmask = (~0 ^ flagclear) - * newflags = (curflags & flagmask) | flagset; - * - * Returns 0 on success, errno on failure. - */ -static int chgIfFlags(const char *ifname, short flagclear, short flagset) { - struct ifreq ifr; - int rc = 0; - int flags; - short flagmask = (~0 ^ flagclear); - int fd = socket(PF_PACKET, SOCK_DGRAM, 0); - - if (fd < 0) - return errno; - - if (virStrncpy(ifr.ifr_name, - ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { - rc = ENODEV; - goto err_exit; - } - - if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { - rc = errno; - goto err_exit; - } - - flags = (ifr.ifr_flags & flagmask) | flagset; - - if (ifr.ifr_flags != flags) { - ifr.ifr_flags = flags; - - if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) - rc = errno; - } - -err_exit: - close(fd); - return rc; -} - -/* - * ifUp - * @name: name of the interface - * @up: 1 for up, 0 for down - * - * Function to control if an interface is activated (up, 1) or not (down, 0) - * - * Returns 0 in case of success or an errno code in case of failure. - */ -static int -ifUp(const char *name, int up) -{ - return chgIfFlags(name, - (up) ? 0 : IFF_UP, - (up) ? IFF_UP : 0); -} - - -/** - * checkIf - * - * @ifname: Name of the interface - * @macaddr: expected MAC address of the interface - * - * FIXME: the interface's index is another good parameter to check - * - * Determine whether a given interface is still available. If so, - * it must have the given MAC address. - * - * Returns an error code ENODEV in case the interface does not exist - * anymore or its MAC address is different, 0 otherwise. - */ -int -checkIf(const char *ifname, const unsigned char *macaddr) -{ - struct ifreq ifr; - int fd = socket(PF_PACKET, SOCK_DGRAM, 0); - int rc = 0; - - if (fd < 0) - return errno; - - if (virStrncpy(ifr.ifr_name, - ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { - rc = ENODEV; - goto err_exit; - } - - if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { - rc = errno; - goto err_exit; - } - - if (memcmp(&ifr.ifr_hwaddr.sa_data, macaddr, 6) != 0) - rc = ENODEV; - - err_exit: - close(fd); - return rc; -} - - int virNWFilterInstantiateFilterLate(virConnectPtr conn, const char *ifname, @@ -926,7 +810,7 @@ virNWFilterInstantiateFilterLate(virConn driver); if (rc) { //something went wrong... 'DOWN' the interface - if (ifUp(ifname ,0)) { + if (ifaceDown(ifname)) { // assuming interface disappeared... _virNWFilterTeardownFilter(ifname); } Index: libvirt-acl/src/util/interface.c =================================================================== --- /dev/null +++ libvirt-acl/src/util/interface.c @@ -0,0 +1,226 @@ +/* + * interface.c: interface support functions + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * chgIfaceFlags originated from bridge.c + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#include <config.h> + +#include <sys/socket.h> +#include <sys/ioctl.h> +#include <linux/if.h> + +#include "internal.h" + +#include "util.h" +#include "interface.h" +#include "virterror_internal.h" + +#define ifaceError(code, ...) \ + virReportErrorHelper(NULL, VIR_FROM_NET, code, __FILE__, \ + __FUNCTION__, __LINE__, __VA_ARGS__) + +/* + * chgIfFlags: Change flags on an interface + * + * @ifname : name of the interface + * @flagclear : the flags to clear + * @flagset : the flags to set + * + * The new flags of the interface will be calculated as + * flagmask = (~0 ^ flagclear) + * newflags = (curflags & flagmask) | flagset; + * + * Returns 0 on success, errno on failure. + */ +static int chgIfaceFlags(const char *ifname, short flagclear, short flagset) { + struct ifreq ifr; + int rc = 0; + int flags; + short flagmask = (~0 ^ flagclear); + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + flags = (ifr.ifr_flags & flagmask) | flagset; + + if (ifr.ifr_flags != flags) { + ifr.ifr_flags = flags; + + if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) + rc = errno; + } + +err_exit: + close(fd); + return rc; +} + + +/* + * ifaceCtrl + * @name: name of the interface + * @up: true (1) for up, false (0) for down + * + * Function to control if an interface is activated (up, 1) or not (down, 0) + * + * Returns 0 in case of success or an errno code in case of failure. + */ +int +ifaceCtrl(const char *name, bool up) +{ + return chgIfaceFlags(name, + (up) ? 0 : IFF_UP, + (up) ? IFF_UP : 0); +} + + +/** + * ifaceCheck + * + * @reportError: whether to report errors or keep silent + * @ifname: Name of the interface + * @macaddr: expected MAC address of the interface; not checked if NULL + * @ifindex: expected index of the interface; not checked if '-1' + * + * Determine whether a given interface is still available. If so, + * it must have the given MAC address and if an interface index is + * passed, it must also match the interface index. + * + * Returns 0 on success, an error code on failure. + * ENODEV : if interface with given name does not exist or its interface + * index is different than the one passed + * EINVAL : if interface name is invalid (too long) + */ +int +ifaceCheck(bool reportError, const char *ifname, + const unsigned char *macaddr, int ifindex) +{ + struct ifreq ifr; + int fd = -1; + int rc = 0; + int idx; + + if (macaddr != NULL) { + fd = socket(PF_PACKET, SOCK_DGRAM, 0); + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + if (reportError) + ifaceError(VIR_ERR_INTERNAL_ERROR, + _("invalid interface name %s"), + ifname); + rc = EINVAL; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { + if (reportError) + ifaceError(VIR_ERR_INTERNAL_ERROR, + _("coud not get MAC address of interface %s"), + ifname); + rc = errno; + goto err_exit; + } + + if (memcmp(&ifr.ifr_hwaddr.sa_data, macaddr, VIR_MAC_BUFLEN) != 0) { + rc = ENODEV; + goto err_exit; + } + } + + if (ifindex != -1) { + rc = ifaceGetIndex(reportError, ifname, &idx); + if (rc == 0 && idx != ifindex) + rc = ENODEV; + } + + err_exit: + if (fd >= 0) + close(fd); + + return rc; +} + + +/** + * ifaceGetIndex + * + * @reportError: whether to report errors or keep silent + * @ifname : Name of the interface whose index is to be found + * @ifindex: Pointer to int where the index will be written into + * + * Get the index of an interface given its name. + * + * Returns 0 on success, an error code on failure. + * ENODEV : if interface with given name does not exist + * EINVAL : if interface name is invalid (too long) + */ +int +ifaceGetIndex(bool reportError, const char *ifname, int *ifindex) +{ + int rc = 0; + struct ifreq ifreq; + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + + if (fd < 0) + return errno; + + if (virStrncpy(ifreq.ifr_name, ifname, strlen(ifname), + sizeof(ifreq.ifr_name)) == NULL) { + if (reportError) + ifaceError(VIR_ERR_INTERNAL_ERROR, + _("invalid interface name %s"), + ifname); + rc = EINVAL; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFINDEX, &ifreq) >= 0) + *ifindex = ifreq.ifr_ifindex; + else { + if (reportError) + ifaceError(VIR_ERR_INTERNAL_ERROR, + _("interface %s does not exist"), + ifname); + rc = ENODEV; + } + +err_exit: + close(fd); + + return rc; +} Index: libvirt-acl/src/util/interface.h =================================================================== --- /dev/null +++ libvirt-acl/src/util/interface.h @@ -0,0 +1,31 @@ +/* + * interface.h: interface helper APIs for libvirt + * + * Copyright (C) 2010 IBM Corporation, Inc. + * + * See COPYING.LIB for the License of this software + * + * Stefan Berger <stefanb(a)us.ibm.com> + */ +#ifndef __VIR_INTERFACE_H__ +# define __VIR_INTERFACE_H__ + +#include "datatypes.h" + +int ifaceCtrl(const char *name, bool up); + +static inline int ifaceUp(const char *name) { + return ifaceCtrl(name, true); +} + +static inline int ifaceDown(const char *name) { + return ifaceCtrl(name, false); +} + +int ifaceCheck(bool reportError, const char *ifname, + const unsigned char *macaddr, int ifindex); + +int ifaceGetIndex(bool reportError, const char *ifname, int *ifindex); + +#endif /* __VIR_INTERFACE_H__ */ + Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -67,6 +67,7 @@ UTIL_SOURCES = \ util/processinfo.c util/processinfo.h \ util/hostusb.c util/hostusb.h \ util/network.c util/network.h \ + util/interface.c util/interface.h \ util/qparams.c util/qparams.h \ util/stats_linux.c util/stats_linux.h \ util/storage_file.c util/storage_file.h \ Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -681,6 +681,10 @@ virFileWaitForDevices; virFileMatchesNameSuffix; virArgvToString; +# interface.h +ifaceCtrl; +ifaceCheck; +ifaceGetIndex; # usb.h usbGetDevice; Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -43,6 +43,7 @@ #include "memory.h" #include "logging.h" #include "datatypes.h" +#include "interface.h" #include "virterror_internal.h" #include "threads.h" #include "conf/nwfilter_params.h" @@ -339,7 +340,7 @@ learnIPAddressThread(void *arg) break; } /* listening on linkdev, check whether VM's dev is still there */ - if (checkIf(req->ifname, req->macaddr)) { + if (ifaceCheck(false, req->ifname, req->macaddr, -1)) { req->status = ENODEV; break; } Index: libvirt-acl/src/util/macvtap.c =================================================================== --- libvirt-acl.orig/src/util/macvtap.c +++ libvirt-acl/src/util/macvtap.c @@ -44,6 +44,7 @@ # include "util.h" # include "memory.h" # include "macvtap.h" +# include "interface.h" # include "conf/domain_conf.h" # include "virterror_internal.h" @@ -193,109 +194,6 @@ nlAppend(struct nlmsghdr *nlm, int totle static int -getIfIndex(bool reportError, - const char *ifname, - int *idx) -{ - int rc = 0; - struct ifreq ifreq; - int fd = socket(PF_PACKET, SOCK_DGRAM, 0); - - if (fd < 0) - return errno; - - if (virStrncpy(ifreq.ifr_name, ifname, strlen(ifname), - sizeof(ifreq.ifr_name)) == NULL) { - if (reportError) - macvtapError(VIR_ERR_INTERNAL_ERROR, - _("invalid interface name %s"), - ifname); - rc = EINVAL; - goto err_exit; - } - if (ioctl(fd, SIOCGIFINDEX, &ifreq) >= 0) - *idx = ifreq.ifr_ifindex; - else { - if (reportError) - macvtapError(VIR_ERR_INTERNAL_ERROR, - _("interface %s does not exist"), - ifname); - rc = ENODEV; - } - -err_exit: - close(fd); - - return rc; -} - - -/* - * chgIfFlags: Change flags on an interface - * @ifname : name of the interface - * @flagclear : the flags to clear - * @flagset : the flags to set - * - * The new flags of the interface will be calculated as - * flagmask = (~0 ^ flagclear) - * newflags = (curflags & flagmask) | flagset; - * - * Returns 0 on success, errno on failure. - */ -static int chgIfFlags(const char *ifname, short flagclear, short flagset) { - struct ifreq ifr; - int rc = 0; - int flags; - short flagmask = (~0 ^ flagclear); - int fd = socket(PF_PACKET, SOCK_DGRAM, 0); - - if (fd < 0) - return errno; - - if (virStrncpy(ifr.ifr_name, - ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { - rc = ENODEV; - goto err_exit; - } - - if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { - rc = errno; - goto err_exit; - } - - flags = (ifr.ifr_flags & flagmask) | flagset; - - if (ifr.ifr_flags != flags) { - ifr.ifr_flags = flags; - - if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) - rc = errno; - } - -err_exit: - close(fd); - return rc; -} - -/* - * ifUp - * @name: name of the interface - * @up: 1 for up, 0 for down - * - * Function to control if an interface is activated (up, 1) or not (down, 0) - * - * Returns 0 in case of success or an errno code in case of failure. - */ -static int -ifUp(const char *name, int up) -{ - return chgIfFlags(name, - (up) ? 0 : IFF_UP, - (up) ? IFF_UP : 0); -} - - -static int link_add(const char *type, const unsigned char *macaddress, int macaddrsize, const char *ifname, @@ -314,7 +212,7 @@ link_add(const char *type, char *recvbuf = NULL; int recvbuflen; - if (getIfIndex(true, srcdev, &ifindex) != 0) + if (ifaceGetIndex(true, srcdev, &ifindex) != 0) return -1; *retry = 0; @@ -708,7 +606,7 @@ openMacvtapTap(const char *tgifname, *res_ifname = NULL; if (tgifname) { - if(getIfIndex(false, tgifname, &ifindex) == 0) { + if(ifaceGetIndex(false, tgifname, &ifindex) == 0) { if (STRPREFIX(tgifname, MACVTAP_NAME_PREFIX)) { goto create_name; @@ -727,7 +625,7 @@ create_name: retries = 5; for (c = 0; c < 8192; c++) { snprintf(ifname, sizeof(ifname), MACVTAP_NAME_PATTERN, c); - if (getIfIndex(false, ifname, &ifindex) == ENODEV) { + if (ifaceGetIndex(false, ifname, &ifindex) == ENODEV) { rc = link_add(type, macaddress, 6, ifname, linkdev, macvtapMode, &do_retry); if (rc == 0) @@ -741,7 +639,7 @@ create_name: cr_ifname = ifname; } - rc = ifUp(cr_ifname, 1); + rc = ifaceUp(cr_ifname); if (rc != 0) { virReportSystemError(errno, _("cannot 'up' interface %s -- another " Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -63,6 +63,4 @@ void virNWFilterDomainFWUpdateCB(void *p const char *name ATTRIBUTE_UNUSED, void *data); -int checkIf(const char *ifname, const unsigned char *macaddr); - #endif

2 2

[libvirt] [PATCH] build: include usleep gnulib module
by Eric Blake 13 Apr '10

13 Apr '10

Without this module, attempts to sleep for 1 or more seconds on mingw instead become a no-delay no-op. * bootstrap.conf (gnulib_modules): Add usleep. --- bootstrap.conf | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/bootstrap.conf b/bootstrap.conf index ac2f8e6..d55dc71 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -56,6 +56,7 @@ strsep sys_stat time_r useless-if-before-free +usleep vasprintf verify vc-list-files -- 1.6.6.1

2 2

[libvirt] [PATCH] Fix nodeinfotest on NUMA machines
by Daniel P. Berrange 13 Apr '10

13 Apr '10

The nodeinfotest was reliant on the host NUMA topology, but all the test data files assumed 1 single NUMA node. This test thus failed on any NUMA machine with > 1 node * tests/nodeinfotest.c: Hardcode 1 single numa node --- tests/nodeinfotest.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/tests/nodeinfotest.c b/tests/nodeinfotest.c index 768fd4d..9aeb459 100644 --- a/tests/nodeinfotest.c +++ b/tests/nodeinfotest.c @@ -46,6 +46,11 @@ static int linuxTestCompareFiles(const char *cpuinfofile, const char *outputfile } fclose(cpuinfo); + /* 'nodes' is filled using libnuma.so from current machine + * topology, which makes it unsuitable for the test suite + * so blank it to a predictable value */ + nodeinfo.nodes = 1; + snprintf(actualData, MAX_FILE, "CPUs: %u, MHz: %u, Nodes: %u, Cores: %u\n", nodeinfo.cpus, nodeinfo.mhz, nodeinfo.nodes, nodeinfo.cores); -- 1.6.6.1

2 1

Re: [libvirt] Domain not stable while created...
by Sankamesh 13 Apr '10

13 Apr '10

Thanks Mr.Stefan I was getting some errors when i ran like xm create libvirt-ttylinux.conf ---------------------------------------------------------------------------------------------------------------------------------------- Mounting root filesystem. mount: could not find filesystem '/dev/root' Setting up other filesystems. Setting up new root fs setuproot: moving /dev failed: No such file or directory no fstab.sys, mounting internal defaults setuproot: error mounting /proc: No such file or directory setuproot: error mounting /sys: No such file or directory Switching to new root and running init. unmounting old /dev unmounting old /proc unmounting old /sys switchroot: mount failed: No such file or directory ------------------------------------------------------------------------ So this time as sure that there is some problem with my configuration file. I googled , then I found some solution to change the ramdisk option by some command mentioned in the following link. http://www.virtuatopia.com/index.php/A_Xen_Guest_OS_fails_to_boot_with_a_%2…. But after doing this when I restart my process by "xm create..." and "virsh console..." , I get -------------------------------------------------------------- Creating root device. Mounting root filesystem. ext3: No journal on filesystem on sda1 mount: error mounting /dev/root on /sysroot as ext3: Invalid argument Setting up other filesystems. Setting up new root fs setuproot: moving /dev failed: No such file or directory no fstab.sys, mounting internal defaults setuproot: error mounting /proc: No such file or directory setuproot: error mounting /sys: No such file or directory Switching to new root and running init. unmounting old /dev unmounting old /proc unmounting old /sys -------------------------------------------------------------------------------------------------------------------------- Similary when I try other way by changing the ramdisk option in ttylinux.xml file and use "virsh -c xen:/// create libvirt-ttylinux.xml" , then virsh console domainname, I get some kernel error -------------------------------------------------------------------------------------------------- .............................................................. Initalizing network drop monitor service Freeing unused kernel memory: 176k freed Write protecting the kernel read-only data: 390k Registering block device major 8 USB Universal Host Controller Interface driver v3.0 SCSI subsystem initialized device-mapper: uevent: version 1.0.3 device-mapper: ioctl: 4.11.5-ioctl (2007-12-12) initialised: dm-devel(a)redhat.com device-mapper: dm-raid45: initialized v0.2594l netfront: Initialising virtual ethernet driver. netfront: device eth0 has flipping receive path. ext3: No journal on filesystem on sda1 Kernel panic - not syncing: Attempted to kill init! -------------------------------------------------------------------------------------------------- So , There is something terribly wrong with my kernel options in the configuration file in both cases, that doesn't allow the image to boot. Can you identify the nature of the error? Can You help me out in someway? Thanks ________________________________ Sankamesh <sankamesh_rb(a)yahoo.co.in> wrote on 04/12/2010 04:29:36 AM: > > Thanks Mr. Stefan > Will that crash mainly be due to the kernel ? Since am not sure > about that,else I should try with different image. > When I use via a config file using "xm create libvirt-ttylinux.conf > ", then the domain runs stable.... > > But when I use the virsh -c xen:/// define libvirt-ttylinux.xml" and > "virsh start ttyimage, it crashes after sometime. > > The ibvirt-ttylinux.conf file :: > > -------------------------------------------------------------------------------------------------------------------------------- > kernel = "/boot/vmlinuz-2.6.18-164.2.1.el5xen" > ramdisk= "/boot/initrd-2.6.18-164.2.1.el5xen.img" > memory = 64 Maybe try to give it some more memory... Otherwise I can just guess as to why there is such a difference in this vm running stable. Are there any significant difference between an 'xm list' after the 'xm create' and an 'xm list' after the 'virsh -c ... define'? Did you ever try 'xm new <vm config file name>' followed by an 'xm start <domainname>'? > name = "ttylinux" > disk = ['file:/usr/local/ttylinux-xen-libvirt/ttylinux-xen.img,sda1,w'] > root = "/dev/sda1 ro" > vif = [''] > -------------------------------------------------------------------------------------------------------------------------------- > > I give the same Xen kernel parameter here in xml file, and use virsh > to create domain > > --------------------------------------------------------------------------------------------------------------------------------------- > <?xml version="1.0" encoding="utf-8"?> > <domain type='xen'> > <name>ttyimage</name> > <os> > <type>linux</type> > <kernel>/boot/vmlinuz-2.6.18-164.2.1.el5xen</kernel> > <initrd>/boot/initrd-2.6.18-164.2.1.el5xen.img</initrd> > </os> > <memory>65536</memory> > <vcpu>1</vcpu> > <on_poweroff>destroy</on_poweroff> > <on_reboot>restart</on_reboot> > <on_crash>destroy</on_crash> > <devices> > <graphics type='vnc' port='5900'/> > <disk type='file'> > <source file='/usr/local/ttylinux-xen-libvirt/ttylinux-xen.img' /> > <target dev='sda1' /> > </disk> > <interface type='bridge'> > <source bridge='virbr0' /> > <mac address='00:1d:60:ec:ae:1c' /> > <target dev='testnimb-0' /> > </interface> > </devices> > </domain> > --------------------------------------------------------------------------------------------------------------------------------------- > My Boot grub file data:: > > -------------------------------------------------------------------------------------------------------------------------------------- > title Scientific Linux (2.6.18-164.2.1.el5xen) > root (hd0,0) > kernel /xen.gz-2.6.18-164.2.1.el5 > module /vmlinuz-2.6.18-164.2.1.el5xen ro root=LABEL=/1 rhgb quiet > module /initrd-2.6.18-164.2.1.el5xen.img > -------------------------------------------------------------------------------------------------------------------------------------- > > > Why is this difference between the xm (when i destroy the > image,domain is also destroyed) and virsh (domain is not destroyed > while destroying the image) . xm new <vm definition filename> -> xm start <domainname> -> xm destroy <domainname> -> xm delete <domainname> is similar to virsh ... define -> virsh start <domainname> -> virsh destroy <domainname> -> virsh undefine <domainname> Stefan > > I doubt that am making some mistake with the xml file .... Is that true? > > Kindly give some suggestions > > Thanks > > > libvir-list-bounces(a)redhat.com wrote on 04/10/2010 09:47:17 AM: > > > > libvir-list > > > > Hello, > > > > Thanks Alex > > > > I created a domain using "virsh -c xen:/// define libvirt-ttylinux.xml" and > > "virsh start ttyimage" for a simple ttyimage. > > > > Problem I face is that the image shutsdown immedialtely once virsh > > start guest is typed. > > I checked the Xend Logs > > > ---------------------------------------------------------------------------------------------------------- > > ---[2010-04-11 07:08:02 xend 3155] DEBUG (DevController:116) > > DevController: writing {'frontend-id': '6', 'domain': 'ttyimage', > [...] > > [2010-04-11 07:08:02 xend 3155] DEBUG (vfbif:11) Spawn: ['/usr/lib/ > > xen/bin/qemu-dm', '-M', 'xenpv', '-d', '6', '-domain-name', > > 'ttyimage', '-vnc', '127.0.0.1:0', '-vncunused', '-k', 'en-us'] > > [2010-04-11 07:08:02 xend.XendDomainInfo 3155] DEBUG > > (XendDomainInfo:992) Storing VM details: {'shadow_memory': '0', > > 'uuid': 'd5e916b0-bc2d-01f9-8156-4808c754f67a', 'on_reboot': > > 'restart', 'start_time': '1270937282.29', 'on_poweroff': 'destroy', > > 'name': 'ttyimage', 'xend/restart_count': '0', 'vcpus': '1', > > 'vcpu_avail': '1', 'memory': '64', 'on_crash': 'destroy', 'image': > > '(linux (kernel /boot/vmlinuz-2.6.18-164.2.1.el5xen))', 'maxmem': '64'} > > [2010-04-11 07:08:02 xend.XendDomainInfo 3155] DEBUG > > (XendDomainInfo:1027) Storing domain details: {'console/ring-ref': > > '65674', 'console/port': '2', 'name': 'ttyimage', 'console/limit': > > '1048576', 'vm': '/vm/d5e916b0-bc2d-01f9-8156-4808c754f67a', > > 'domid': '6', 'cpu/0/availability': 'online', 'memory/target': > > '65536', 'store/ring-ref': '65675', 'store/port': '1'} > > [2010-04-11 07:08:02 xend.XendDomainInfo 3155] DEBUG > > (XendDomainInfo:1249) XendDomainInfo.handleShutdownWatch > > [2010-04-11 07:08:02 xend 3155] DEBUG (DevController:158) Waiting > > for devices vif. > > [2010-04-11 07:08:02 xend 3155] DEBUG (DevController:164) Waiting for 0. > > [2010-04-11 07:08:02 xend 3155] DEBUG (DevController:509) > > hotplugStatusCallback /local/domain/0/backend/vif/6/0/hotplug-status. > > [2010-04-11 07:08:51 xend 3155] INFO (XendDomain:387) Domain > > ttyimage (6) unpaused. > > [2010-04-11 07:08:54 xend.XendDomainInfo 3155] WARNING > > (XendDomainInfo:1177) Domain has crashed: name=ttyimage id=6. > > You domain crashed here... Is the VM image and kernel in that image > known to work? > > Regards, > Stefan > > Send free SMS to your Friends on Mobile from your Yahoo! Messenger. > Download Now! http://messenger.yahoo.com/download.php Send free SMS to your Friends on Mobile from your Yahoo! Messenger. Download Now! http://messenger.yahoo.com/download.php

1 0

[libvirt] [PATCH] build: fix syntax-check problems
by Eric Blake 13 Apr '10

13 Apr '10

* .x-sc_prohibit_gettext_noop: Add new exemption. * .x-sc_prohibit_test_minus_ao: Likewise. * Makefile.am (EXTRA_DIST): Distribute new files. * .gitignore: Ignore built file. --- Pushing as obvious, since otherwise 'make syntax-check' fails, and with my name prominently listed in the failure message, even though I wasn't the one that touched docs/news.html.in. It's interesting that documenting the commit logs for what we fixed introduces new instances of the broken semantics. :) .gitignore | 1 + .x-sc_prohibit_gettext_noop | 2 ++ .x-sc_prohibit_test_minus_ao | 1 + Makefile.am | 2 ++ 4 files changed, 6 insertions(+), 0 deletions(-) create mode 100644 .x-sc_prohibit_gettext_noop create mode 100644 .x-sc_prohibit_test_minus_ao diff --git a/.gitignore b/.gitignore index a638e0d..a7466fd 100644 --- a/.gitignore +++ b/.gitignore @@ -44,4 +44,5 @@ stamp-h stamp-h.in stamp-h1 tests/*.log +tests/nwfilterxml2xmltest update.log diff --git a/.x-sc_prohibit_gettext_noop b/.x-sc_prohibit_gettext_noop new file mode 100644 index 0000000..c40474e --- /dev/null +++ b/.x-sc_prohibit_gettext_noop @@ -0,0 +1,2 @@ +ChangeLog* +docs/news.html.in diff --git a/.x-sc_prohibit_test_minus_ao b/.x-sc_prohibit_test_minus_ao new file mode 100644 index 0000000..3939616 --- /dev/null +++ b/.x-sc_prohibit_test_minus_ao @@ -0,0 +1 @@ +docs/news.html.in diff --git a/Makefile.am b/Makefile.am index dd334b5..286b13b 100644 --- a/Makefile.am +++ b/Makefile.am @@ -27,12 +27,14 @@ EXTRA_DIST = \ .x-sc_prohibit_asprintf \ .x-sc_prohibit_gethostby \ .x-sc_prohibit_gethostname \ + .x-sc_prohibit_gettext_noop \ .x-sc_prohibit_have_config_h \ .x-sc_prohibit_HAVE_MBRTOWC \ .x-sc_prohibit_nonreentrant \ .x-sc_prohibit_strcmp \ .x-sc_prohibit_strcmp_and_strncmp \ .x-sc_prohibit_strncpy \ + .x-sc_prohibit_test_minus_ao \ .x-sc_prohibit_VIR_ERR_NO_MEMORY \ .x-sc_require_config_h \ .x-sc_require_config_h_first \ -- 1.6.6.1

2 1

[libvirt] [PATCH] Consolidate interface related functions in interface.c
by Stefan Berger 13 Apr '10

13 Apr '10

I am consolidating network interface related functions used in nwfilter and macvtap code in utils/interface.c. All function names are prefixed with 'Iface'. The following functions are now available through interface.h: int IfaceCtrl(const char *name, bool up); int IfaceUp(const char *name); int IfaceDown(const char *name); int IfaceCheck(bool reportError, const char *ifname, const unsigned char *macaddr, int ifindex); int IfaceGetIndex(bool reportError, const char *ifname, int *ifindex); I added 'int ifindex' as parameter to IfaceCheck to the original function and modified the code accordingly. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/Makefile.am | 1 src/libvirt_private.syms | 4 src/nwfilter/nwfilter_gentech_driver.c | 120 ----------------- src/nwfilter/nwfilter_gentech_driver.h | 2 src/nwfilter/nwfilter_learnipaddr.c | 3 src/util/interface.c | 224 +++++++++++++++++++++++++++++++++ src/util/interface.h | 31 ++++ src/util/macvtap.c | 112 ---------------- 8 files changed, 269 insertions(+), 228 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -23,16 +23,11 @@ #include <config.h> -#include <stdint.h> -#include <sys/socket.h> -#include <sys/ioctl.h> -#include <linux/if.h> - #include "internal.h" #include "memory.h" #include "logging.h" -#include "datatypes.h" +#include "interface.h" #include "domain_conf.h" #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" @@ -792,117 +787,6 @@ _virNWFilterInstantiateFilter(virConnect } -// FIXME: move chgIfFlags, ifUp, checkIf into common file & share w/ macvtap.c - -/* - * chgIfFlags: Change flags on an interface - * @ifname : name of the interface - * @flagclear : the flags to clear - * @flagset : the flags to set - * - * The new flags of the interface will be calculated as - * flagmask = (~0 ^ flagclear) - * newflags = (curflags & flagmask) | flagset; - * - * Returns 0 on success, errno on failure. - */ -static int chgIfFlags(const char *ifname, short flagclear, short flagset) { - struct ifreq ifr; - int rc = 0; - int flags; - short flagmask = (~0 ^ flagclear); - int fd = socket(PF_PACKET, SOCK_DGRAM, 0); - - if (fd < 0) - return errno; - - if (virStrncpy(ifr.ifr_name, - ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { - rc = ENODEV; - goto err_exit; - } - - if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { - rc = errno; - goto err_exit; - } - - flags = (ifr.ifr_flags & flagmask) | flagset; - - if (ifr.ifr_flags != flags) { - ifr.ifr_flags = flags; - - if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) - rc = errno; - } - -err_exit: - close(fd); - return rc; -} - -/* - * ifUp - * @name: name of the interface - * @up: 1 for up, 0 for down - * - * Function to control if an interface is activated (up, 1) or not (down, 0) - * - * Returns 0 in case of success or an errno code in case of failure. - */ -static int -ifUp(const char *name, int up) -{ - return chgIfFlags(name, - (up) ? 0 : IFF_UP, - (up) ? IFF_UP : 0); -} - - -/** - * checkIf - * - * @ifname: Name of the interface - * @macaddr: expected MAC address of the interface - * - * FIXME: the interface's index is another good parameter to check - * - * Determine whether a given interface is still available. If so, - * it must have the given MAC address. - * - * Returns an error code ENODEV in case the interface does not exist - * anymore or its MAC address is different, 0 otherwise. - */ -int -checkIf(const char *ifname, const unsigned char *macaddr) -{ - struct ifreq ifr; - int fd = socket(PF_PACKET, SOCK_DGRAM, 0); - int rc = 0; - - if (fd < 0) - return errno; - - if (virStrncpy(ifr.ifr_name, - ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { - rc = ENODEV; - goto err_exit; - } - - if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { - rc = errno; - goto err_exit; - } - - if (memcmp(&ifr.ifr_hwaddr.sa_data, macaddr, 6) != 0) - rc = ENODEV; - - err_exit: - close(fd); - return rc; -} - - int virNWFilterInstantiateFilterLate(virConnectPtr conn, const char *ifname, @@ -926,7 +810,7 @@ virNWFilterInstantiateFilterLate(virConn driver); if (rc) { //something went wrong... 'DOWN' the interface - if (ifUp(ifname ,0)) { + if (IfaceDown(ifname)) { // assuming interface disappeared... _virNWFilterTeardownFilter(ifname); } Index: libvirt-acl/src/util/interface.c =================================================================== --- /dev/null +++ libvirt-acl/src/util/interface.c @@ -0,0 +1,226 @@ +/* + * interface.c: interface support functions + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * chgIfaceFlags originated from bridge.c + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#include <config.h> + +#include <sys/socket.h> +#include <sys/ioctl.h> +#include <linux/if.h> + +#include "internal.h" + +#include "util.h" +#include "interface.h" +#include "virterror_internal.h" + +#define ifaceError(code, ...) \ + virReportErrorHelper(NULL, VIR_FROM_NET, code, __FILE__, \ + __FUNCTION__, __LINE__, __VA_ARGS__) + +/* + * chgIfFlags: Change flags on an interface + * + * @ifname : name of the interface + * @flagclear : the flags to clear + * @flagset : the flags to set + * + * The new flags of the interface will be calculated as + * flagmask = (~0 ^ flagclear) + * newflags = (curflags & flagmask) | flagset; + * + * Returns 0 on success, errno on failure. + */ +static int chgIfaceFlags(const char *ifname, short flagclear, short flagset) { + struct ifreq ifr; + int rc = 0; + int flags; + short flagmask = (~0 ^ flagclear); + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + flags = (ifr.ifr_flags & flagmask) | flagset; + + if (ifr.ifr_flags != flags) { + ifr.ifr_flags = flags; + + if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) + rc = errno; + } + +err_exit: + close(fd); + return rc; +} + + +/* + * IfaceCtrl + * @name: name of the interface + * @up: true (1) for up, false (0) for down + * + * Function to control if an interface is activated (up, 1) or not (down, 0) + * + * Returns 0 in case of success or an errno code in case of failure. + */ +int +IfaceCtrl(const char *name, bool up) +{ + return chgIfaceFlags(name, + (up) ? 0 : IFF_UP, + (up) ? IFF_UP : 0); +} + + +/** + * IfaceCheck + * + * @reportError: whether to report errors or keep silent + * @ifname: Name of the interface + * @macaddr: expected MAC address of the interface; not checked if NULL + * @ifindex: expected index of the interface; not checked if '-1' + * + * Determine whether a given interface is still available. If so, + * it must have the given MAC address and if an interface index is + * passed, it must also match the interface index. + * + * Returns 0 on success, an error code on failure. + * ENODEV : if interface with given name does not exist or its interface + * index is different than the one passed + * EINVAL : if interface name is invalid (too long) + */ +int +IfaceCheck(bool reportError, const char *ifname, + const unsigned char *macaddr, int ifindex) +{ + struct ifreq ifr; + int fd = -1; + int rc = 0; + int idx; + + if (macaddr != NULL) { + fd = socket(PF_PACKET, SOCK_DGRAM, 0); + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + if (reportError) + ifaceError(VIR_ERR_INTERNAL_ERROR, + _("invalid interface name %s"), + ifname); + rc = EINVAL; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { + if (reportError) + ifaceError(VIR_ERR_INTERNAL_ERROR, + _("coud not get MAC address of interface %s"), + ifname); + rc = errno; + goto err_exit; + } + + if (memcmp(&ifr.ifr_hwaddr.sa_data, macaddr, VIR_MAC_BUFLEN) != 0) { + rc = ENODEV; + goto err_exit; + } + } + + if (ifindex != -1) { + rc = IfaceGetIndex(reportError, ifname, &idx); + if (rc == 0 && idx != ifindex) + rc = ENODEV; + } + + err_exit: + if (fd >= 0) + close(fd); + + return rc; +} + + +/** + * IfaceGetIndex + * + * @reportError: whether to report errors or keep silent + * @ifname : Name of the interface whose index is to be found + * @ifindex: Pointer to int where the index will be written into + * + * Get the index of an interface given its name. + * + * Returns 0 on success, an error code on failure. + * ENODEV : if interface with given name does not exist + * EINVAL : if interface name is invalid (too long) + */ +int +IfaceGetIndex(bool reportError, const char *ifname, int *ifindex) +{ + int rc = 0; + struct ifreq ifreq; + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + + if (fd < 0) + return errno; + + if (virStrncpy(ifreq.ifr_name, ifname, strlen(ifname), + sizeof(ifreq.ifr_name)) == NULL) { + if (reportError) + ifaceError(VIR_ERR_INTERNAL_ERROR, + _("invalid interface name %s"), + ifname); + rc = EINVAL; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFINDEX, &ifreq) >= 0) + *ifindex = ifreq.ifr_ifindex; + else { + if (reportError) + ifaceError(VIR_ERR_INTERNAL_ERROR, + _("interface %s does not exist"), + ifname); + rc = ENODEV; + } + +err_exit: + close(fd); + + return rc; +} Index: libvirt-acl/src/util/interface.h =================================================================== --- /dev/null +++ libvirt-acl/src/util/interface.h @@ -0,0 +1,31 @@ +/* + * interface.h: interface helper APIs for libvirt + * + * Copyright (C) 2010 IBM Corporation, Inc. + * + * See COPYING.LIB for the License of this software + * + * Stefan Berger <stefanb(a)us.ibm.com> + */ +#ifndef __VIR_INTERFACE_H__ +# define __VIR_INTERFACE_H__ + +#include "datatypes.h" + +int IfaceCtrl(const char *name, bool up); + +static inline int IfaceUp(const char *name) { + return IfaceCtrl(name, true); +} + +static inline int IfaceDown(const char *name) { + return IfaceCtrl(name, false); +} + +int IfaceCheck(bool reportError, const char *ifname, + const unsigned char *macaddr, int ifindex); + +int IfaceGetIndex(bool reportError, const char *ifname, int *ifindex); + +#endif /* __VIR_INTERFACE_H__ */ + Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -67,6 +67,7 @@ UTIL_SOURCES = \ util/processinfo.c util/processinfo.h \ util/hostusb.c util/hostusb.h \ util/network.c util/network.h \ + util/interface.c util/interface.h \ util/qparams.c util/qparams.h \ util/stats_linux.c util/stats_linux.h \ util/storage_file.c util/storage_file.h \ Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -681,6 +681,10 @@ virFileWaitForDevices; virFileMatchesNameSuffix; virArgvToString; +# interface.h +IfaceCtrl; +IfaceCheck; +IfaceGetIndex; # usb.h usbGetDevice; Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -43,6 +43,7 @@ #include "memory.h" #include "logging.h" #include "datatypes.h" +#include "interface.h" #include "virterror_internal.h" #include "threads.h" #include "conf/nwfilter_params.h" @@ -339,7 +340,7 @@ learnIPAddressThread(void *arg) break; } /* listening on linkdev, check whether VM's dev is still there */ - if (checkIf(req->ifname, req->macaddr)) { + if (IfaceCheck(false, req->ifname, req->macaddr, -1)) { req->status = ENODEV; break; } Index: libvirt-acl/src/util/macvtap.c =================================================================== --- libvirt-acl.orig/src/util/macvtap.c +++ libvirt-acl/src/util/macvtap.c @@ -44,6 +44,7 @@ # include "util.h" # include "memory.h" # include "macvtap.h" +# include "interface.h" # include "conf/domain_conf.h" # include "virterror_internal.h" @@ -193,109 +194,6 @@ nlAppend(struct nlmsghdr *nlm, int totle static int -getIfIndex(bool reportError, - const char *ifname, - int *idx) -{ - int rc = 0; - struct ifreq ifreq; - int fd = socket(PF_PACKET, SOCK_DGRAM, 0); - - if (fd < 0) - return errno; - - if (virStrncpy(ifreq.ifr_name, ifname, strlen(ifname), - sizeof(ifreq.ifr_name)) == NULL) { - if (reportError) - macvtapError(VIR_ERR_INTERNAL_ERROR, - _("invalid interface name %s"), - ifname); - rc = EINVAL; - goto err_exit; - } - if (ioctl(fd, SIOCGIFINDEX, &ifreq) >= 0) - *idx = ifreq.ifr_ifindex; - else { - if (reportError) - macvtapError(VIR_ERR_INTERNAL_ERROR, - _("interface %s does not exist"), - ifname); - rc = ENODEV; - } - -err_exit: - close(fd); - - return rc; -} - - -/* - * chgIfFlags: Change flags on an interface - * @ifname : name of the interface - * @flagclear : the flags to clear - * @flagset : the flags to set - * - * The new flags of the interface will be calculated as - * flagmask = (~0 ^ flagclear) - * newflags = (curflags & flagmask) | flagset; - * - * Returns 0 on success, errno on failure. - */ -static int chgIfFlags(const char *ifname, short flagclear, short flagset) { - struct ifreq ifr; - int rc = 0; - int flags; - short flagmask = (~0 ^ flagclear); - int fd = socket(PF_PACKET, SOCK_DGRAM, 0); - - if (fd < 0) - return errno; - - if (virStrncpy(ifr.ifr_name, - ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { - rc = ENODEV; - goto err_exit; - } - - if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { - rc = errno; - goto err_exit; - } - - flags = (ifr.ifr_flags & flagmask) | flagset; - - if (ifr.ifr_flags != flags) { - ifr.ifr_flags = flags; - - if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) - rc = errno; - } - -err_exit: - close(fd); - return rc; -} - -/* - * ifUp - * @name: name of the interface - * @up: 1 for up, 0 for down - * - * Function to control if an interface is activated (up, 1) or not (down, 0) - * - * Returns 0 in case of success or an errno code in case of failure. - */ -static int -ifUp(const char *name, int up) -{ - return chgIfFlags(name, - (up) ? 0 : IFF_UP, - (up) ? IFF_UP : 0); -} - - -static int link_add(const char *type, const unsigned char *macaddress, int macaddrsize, const char *ifname, @@ -314,7 +212,7 @@ link_add(const char *type, char *recvbuf = NULL; int recvbuflen; - if (getIfIndex(true, srcdev, &ifindex) != 0) + if (IfaceGetIndex(true, srcdev, &ifindex) != 0) return -1; *retry = 0; @@ -708,7 +606,7 @@ openMacvtapTap(const char *tgifname, *res_ifname = NULL; if (tgifname) { - if(getIfIndex(false, tgifname, &ifindex) == 0) { + if(IfaceGetIndex(false, tgifname, &ifindex) == 0) { if (STRPREFIX(tgifname, MACVTAP_NAME_PREFIX)) { goto create_name; @@ -727,7 +625,7 @@ create_name: retries = 5; for (c = 0; c < 8192; c++) { snprintf(ifname, sizeof(ifname), MACVTAP_NAME_PATTERN, c); - if (getIfIndex(false, ifname, &ifindex) == ENODEV) { + if (IfaceGetIndex(false, ifname, &ifindex) == ENODEV) { rc = link_add(type, macaddress, 6, ifname, linkdev, macvtapMode, &do_retry); if (rc == 0) @@ -741,7 +639,7 @@ create_name: cr_ifname = ifname; } - rc = ifUp(cr_ifname, 1); + rc = IfaceUp(cr_ifname); if (rc != 0) { virReportSystemError(errno, _("cannot 'up' interface %s -- another " Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -63,6 +63,4 @@ void virNWFilterDomainFWUpdateCB(void *p const char *name ATTRIBUTE_UNUSED, void *data); -int checkIf(const char *ifname, const unsigned char *macaddr); - #endif

2 2

[libvirt] [PATCH] add nwfilter functions to virsh man page
by Stefan Berger 13 Apr '10

13 Apr '10

Unfortunately after the 0.8.0 release, but here's a beginning of the documentation of the nwfilter functionality. Signed-off-by; Stefan Berger <stefanb(a)us.ibm.com> --- tools/virsh.pod | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) Index: libvirt-acl/tools/virsh.pod =================================================================== --- libvirt-acl.orig/tools/virsh.pod +++ libvirt-acl/tools/virsh.pod @@ -840,6 +840,59 @@ children of this snapshot. =back +=head1 NWFILTER COMMMANDS + +The following commands manipulate network filters. Network filters allow +to filter the network traffic comming from and going to virtual machines. +Individual network traffic filters are written in XML, may contain +references to other network filters, describe traffic filtering rules, +or contain both. Network filters are referenced by virtual machines +from within their interface description. A network filter may be referenced +by multiple virtual machines' interfaces. + +=over 4 + +=item B<nwfilter-define> I<xmlfile> + +Make a new network filter known to libvirt. If a network filter with +the same name already exists, it will be replaced with the new XML. +Any running virtual machine referencing this network filter will have +its network traffic rules adapted. If for any reason the network traffic +filtering rules cannot be instantiated by any of the running virtual +machines, then the new XML will be rejected. + +=item B<nwfilter-undefine> I<nwfilter-name> + +Delete a network filter. The deletion will fail if any running virtual +machine is currently using this network filter. + +=item B<nwfilter-list> + +List all of the available network filters. + +=item B<nwfilter-dumpxml> I<nwfilter-name> + +Output the network filter XML. + +=item B<nwfilter-edit> I<nwfilter-name> + +Edit the XML of a network filter. + +This is equivalent to: + + virsh nwfilter-dumpxml myfilter > myfilter.xml + edit myfilter.xml + virsh nwfilter-define myfilter.xml + +except that it does some error checking. +The new network filter may be rejected due to the same reason as +mention in I<nwfilter-define>. + +The editor used can be supplied by the C<$VISUAL> or C<$EDITOR> environment +variables, and defaults to C<vi>. + +=back + =head1 ENVIRONMENT The following environment variables can be set to alter the behaviour

2 2

[libvirt] cannot start a qemu64 model on an Intel host
by Dan Kenigsberg 13 Apr '10

13 Apr '10

If I specify <cpu match="exact"> <model>qemu64</model> </cpu> according to the new cpu schema, I get error: internal error guest CPU is not compatible with host CPU because qemu64 supports svm, and my host does not. However, the error remains when I explicitly ask to disable svm with <feature policy="disable" name="svm"/> I am not sure if this is a bug or an intended feature, but I'd expect cpu_disable taken into account when doing x86ModelCompare(host_model, cpu_require) Regards, Dan.

2 2

[libvirt] Release of libvirt-0.8.0
by Daniel Veillard 13 Apr '10

13 Apr '10

After heroic efforts in the last couple of weeks it is out ! That's by large the release packed with most new features ever, and the changelog is simply huge. I hope we didn't introduce too many bugs, but we certainly fixed a very large amount in the first place ! Tarball is available as usual from ftp://libvirt.org/libvirt/ And I won't try to sumarize the following ! Features: - esx: Add domain snapshot support (Matthias Bolte) - Snapshot API framework. (Chris Lalancette) - Add managed save API entry points (Daniel Veillard) - timer subselection for domain clock (Laine Stump) - Add hook utilities (Daniel Veillard) - cpuUpdate() for updating guest CPU according to host CPU (Jiri Denemark) - Network filtering API (Stefan Berger) - Introduce a new virDomainUpdateDeviceFlags public API (Daniel P. Berrange) - Introduce a new public API for domain events (Daniel P. Berrange) - Public virDomainMigrateSetMaxDowntime API (Jiri Denemark) - Add public API for volume wiping (David Allan) - xenapi: Initial commit of the new driver (Sharadha Prabhakar) Documentation: - Add documentation for synchronous hooks (Daniel Veillard) - Small fixes to virsh man page (Luiz Capitulino) - Avoid using multicast addresses for Ethernet MAC examples (redshift) - Fix unterminated B<...> in virsh man page (Jiri Denemark) - Document all options of virsh dumpxml (Jiri Denemark) - virsh: improve documentation (Eric Blake) - Document snapshot virsh commands in the man page. (Chris Lalancette) - Website documentation for the snapshot XML. (Chris Lalancette) - website: Add archive link for libvirt-users list (Matthias Bolte) - virsh: improve man page (Eric Blake) - Mention direct device support since 0.7.7 in docs (Stefan Berger) - esx: Improve documentation about remote URIs (Matthias Bolte) - doc: fix typos in hacking.html.in; mark HACKING as read-only (Jim Meyering) - doc: fix more typos in HACKING (Jim Meyering) - hacking: add a section on preprocessor conventions (Eric Blake) - hacking: fix typos (Eric Blake) - Update hacking.html.in (David Allan) Portability: - Fix Win32 portability problems (Daniel P. Berrange) - This patch fixes some compilation issues for the RHEL5 build (Stefan Berger) - util: Add stubs for some functions on Windows (Matthias Bolte) - Add HAVE_PTHREAD_H guard for pthread_sigmask (Matthias Bolte) - bootstrap: Enable copy-mode for MinGW builds (Matthias Bolte) - util: Handle lack of (f)chmod and (f)chown on Windows (Matthias Bolte) - bootstrap: Remove rsync from buildreq list (Matthias Bolte) - Make sure virtTestCaptureProgramOutput has a body on Windows (Matthias Bolte) - Fix export of virConnectAuthPtrDefault for MinGW builds (Matthias Bolte) - Make sure uid_t and gid_t are available (Matthias Bolte) Bug Fixes: - nwfilter: Fix memory leak on daemon init and shutdown (Stefan Berger) - More event callback fixes (Daniel P. Berrange) - Fix error in nwfilter test driver (Stefan Berger) - qemu: catch cdrom change error (Ryan Harper) - nwfilter: fix for directionality of ICMP traffic (Stefan Berger) - Fix CPU comparison for x86 arch (Jiri Denemark) - Don't ignore guest CPU selection when unsupported by HV (Jiri Denemark) - domain_event.c: don't deref NULL on an OOM error path (Jim Meyering) - nwfiler: fix due to non-symmetric src mac address match in iptables (Stefan Berger) - qemu_driver.c: don't close an arbitrary file descriptor (Jim Meyering) - Add VIR_DOMAIN_XML_INACTIVE flag when parsing domain XML (Jamie Strandboge) - virt-aa-helper should not fail if profile was removed (Jamie Strandboge) - Do nor clear caps when invoking virt-aa-helper (Jamie Strandboge) - virterror.c: avoid erroneous case "fall-through" (Jim Meyering) - Increase the number of available VNC ports. (Chris Lalancette) - Only assign newDef when we have a new def. (Chris Lalancette) - nwfilter: Fix random index in virNWFilterRuleDefDetailsFormat (Matthias Bolte) - xenapi: Fix uninitialized variable warning (Matthias Bolte) - Add a missing break statement to nwfilter errors. (Chris Lalancette) - VBox: Fix use of uninitialized value (Jiri Denemark) - Allow domain disk images on root-squash NFS to coexist with security driver. (Laine Stump) - Don't use virFileReadLimFD in qemuDomainRestore. (Chris Lalancette) - nwfilter's XML parser bug fixes (Stefan Berger) - ESX test case needs '/' in interface name (Stefan Berger) - Fix linker errors in proxy (Matthias Bolte) - virConnectGetLibVersion: Avoid error message on success. (Paolo Smiraglia) - Fix daemon hook script initialization (Daniel Veillard) - Fix QEMU cpu affinity at startup to include all threads (Daniel P. Berrange) - Fix "make check" run requesting authentication (Stefan Berger) - Don't replace persistent domain config with migrated config (Jiri Denemark) - Fix build break (David Allan) - esx: Make the conf parser compare names case insensitive in VMX mode (Matthias Bolte) - vbox: Fix segfault on empty device source (Matthias Bolte) - python example: poll(-0.001) does not sleep forever (Philipp Hahn) - Fix error reporting when parsing CPU XML strings (Jiri Denemark) - virDiskNameToIndex: ignore trailing digits (Jim Meyering) - esx: Fix potential memory leak in esxVI_BuildFullTraversalSpecItem (Matthias Bolte) - Avoid libvirtd crash when cgroups is not configured on host (Jim Fehlig) - security: selinux: Fix crash when releasing non-existent label (Cole Robinson) - Don't crash without a security driver (Guido Günther) - qemu: Fix FD leak in qemudStartVMDaemon (Matthias Bolte) - util: ensure virMutexInit is not recursive (Eric Blake) - Fix logroate rpm build breakage (Daniel Veillard) - Fix LSB compliance of init script (Daniel Veillard) - python: Fix networkLookupByUUID (Philip Hahn) - Fix make dist with XenAPI changes (Cole Robinson) - xenapi: Don't leak url and caps in case of error (Matthias Bolte) - xenapi: Check for NULL before accessing the scheme (Matthias Bolte) - xenapi: Request a username if there is non in the URI (Matthias Bolte) - xenapi: Check for valid private data in xenapiSessionErrorHandle (Matthias Bolte) - Use fsync() at the end of file allocation instead of O_DSYNC (Jiri Denemark) - security: Set permissions for kernel/initrd (Cole Robinson) - qemu: Fix USB by product with security enabled (Cole Robinson) - Make nodeGetInfo report the correct number of NUMA nodes. (Chris Lalancette) - Fix crash in virsh after bogus command (Chris Lalancette) - Fix virsh command 'cd' (Chris Lalancette) - Fix hang in qemudDomainCoreDump. (Chris Lalancette) - Make sure qemudDomainSetVcpus doesn't hang. (Chris Lalancette) - Fix a JSON CPU information bug. (Chris Lalancette) - Free resources on error in udev startup (David Allan) - Fix up nodeinfo parsing code. (Chris Lalancette) - Wipe nodeinfo structure before filling it (Jiri Denemark) - macvtap build detection fix (Stefan Berger) - Fix virDomainGetXMLDesc cache settings output (Soren Hansen) - Fix locking in qemudDomainMemoryStats (Adam Litke) - qemu restore: don't let corrupt input provoke unwarranted OOM (Jim Meyering) - virFileReadLimFD: diagnose maxlen <= 0, rather than passing it on... (Jim Meyering) - xen: don't let bogus packets trigger over-allocation and segfault (Jim Meyering) Improvements: - Rename virsh "revert-to-snapshot" to "snapshot-revert" (Chris Lalancette) - nwfilter: Process DHCP option to determine whether packet is a DHCP_OFFER (Stefan Berger) - Add enospace option to qemu disk error policy (David Allan) - nwfilter: More XML parser test cases (Stefan Berger) - remote: Replace some virRaiseError with remoteError (Matthias Bolte) - Generate libvirt.def from libvirt.syms (Matthias Bolte) - Fix up python bindings for new event callbacks (Daniel P. Berrange) - esx: Allow 'lsisas1068' as SCSI controller type (Matthias Bolte) - esx: Report an error for invalid arguments in esxList(Defined)Domains (Matthias Bolte) - nwfilter: Support for learning a VM's IP address (Stefan Berger) - Properly advertise cpuselection guest capability (Jiri Denemark) - Update of the apparmor regression tests (Jamie Strandboge) - Improve the apparmor example (Jamie Strandboge) - Improve virt-aa-helper to handle SDL graphics and cleanups (Jamie Strandboge) - Adjust virt-aa-helper to handle pci devices (Jamie Strandboge) - Add backingstore support to apparmor (Jamie Strandboge) - build: avoid autogen on 'make clean' (Eric Blake) - Add filter schema for nwfilter XML, extend domain XML schema (Stefan Berger) - Add filter schema for nwfilter XML, extend domain XML schema (Stefan Berger) - nwfilter: Fix instantiated layer 2 rules for 'inout' direction (Stefan Berger) - Better error reporting in virsh. (Chris Lalancette) - Snapshot virsh implementation. (Chris Lalancette) - Snapshots for VBox (Jiri Denemark) - Snapshot QEMU driver. (Chris Lalancette) - Snapshot internal methods. (Chris Lalancette) - xenapi: Add managedsave entries to the driver struct (Matthias Bolte) - Add a managedsave command to virsh (Daniel Veillard) - Implement managed save operations for qemu driver (Daniel Veillard) - Implement remote protocol for managed save (Daniel Veillard) - build: improve check for out-of-date .gnulib submodule (Eric Blake) - optimizes the validation of the name of an interface (Stefan Berger) - adds a couple of test cases for the XML parsing test suite (Stefan Berger) - build: import latest gnulib (Eric Blake) - Changes to clock timer XML to match final design. (Laine Stump) - Keep build quiet for generated file (Daniel P. Berrange) - Keep track of guest paused state after disk IO / watchdog events (Daniel P. Berrange) - virsh: add 'exit' as an alias for 'quit' (Eric Blake) - maint: mark xenapiSessionErrorHandler messages for translation (Jim Meyering) - Blank out invalid interface names with escaped letters etc. (Stefan Berger) - esx: Generate most SOAP mapping and improve inheritance handling (Matthias Bolte) - Distribute nwfilter xml files and add them to rpm (Daniel Veillard) - Make sure nwfilter headers are part of distribution (Daniel Veillard) - maint: show which compiler warning triggered (Eric Blake) - build: automate the rerun of autogen.sh (Eric Blake) - makes the entries in the int-2-string maps more readable (Stefan Berger) - Add ip6tables support for IPv6 filtering (Stefan Berger) - Add support for so-far missing protocols for iptables filtering (Stefan Berger) - Implement the qemu-kvm backend of clock timer elements (Laine Stump) - Add flags to indicate presence of timekeeping-related qemu options (Laine Stump) - Add timer element to domain schema (Laine Stump) - virsh: support VISUAL, and allow metacharacters in EDITOR (Eric Blake) - Add dummy nwfilter driver to test driver (Stefan Berger) - Add script hook support to the LXC driver (Daniel Veillard) - Add script hook support to the QEmu driver (Daniel Veillard) - Add the script hook support to the libvirt daemon (Daniel Veillard) - Add an error module and message for the hooks subsystem (Daniel Veillard) - Export virPipeReadUntilEOF internally (Daniel Veillard) - Introduce UPDATE_CPU flag for virDomainGetXMLDesc (Jiri Denemark) - Helper function for making a copy of virCPUDefPtr (Jiri Denemark) - filter new files through cppi, so syntax-check passes once again (Jim Meyering) - Add disk error policy to domain XML (David Allan) - build: don't lose prior configure args on autogen.sh (Eric Blake) - build: update gnulib (Eric Blake) - Add some examples filters (Stefan Berger) - Extensions for iptables rules (Stefan Berger) - Add IPv6 support for the ebtables layer (Stefan Berger) - Add qemu support (Stefan Berger) - Core driver implementation with ebtables support (Stefan Berger) - Add XML parser extensions for network filtering (Stefan Berger) - Add virsh support for new CLI commands (Stefan Berger) - Definition of the wire format, RPC client & server (Stefan Berger) - Add Network filtering internal API (Stefan Berger) - Add Network filtering public API (Stefan Berger) - Add recursive locks (Stefan Berger) - Implement VNC password change in QEMU (Daniel P. Berrange) - Allow parsing <graphics> in device XML (Daniel P. Berrange) - Introduce a update-device command in virsh (Daniel P. Berrange) - Implement virDomainUpdateDeviceFlags API in all drivers with media change (Daniel P. Berrange) - Remote protocol impl for virDomainUpdateDeviceFlags (Daniel P. Berrange) - Add domain events for graphics network clients (Daniel P. Berrange) - Add support for an explicit IO error event (Daniel P. Berrange) - Add support for an explicit watchdog event (Daniel P. Berrange) - Add support for an explicit RTC change event (Daniel P. Berrange) - Add support for an explicit guest reboot event (Daniel P. Berrange) - Rename domain lifecycle event message (Daniel P. Berrange) - Convert domain events example to new API (Daniel P. Berrange) - Remote driver & daemon impl of new event API (Daniel P. Berrange) - Support new event register/deregister APis in all drivers except remote (Daniel P. Berrange) - Add new internal domain events APIs for handling other event types (Daniel P. Berrange) - Refactor domain events to handle multiple event types (Daniel P. Berrange) - Make internal domain events struct definitions private (Daniel P. Berrange) - tests: teach syntax-check that virDomainDefFree has free-like semantics (Jim Meyering) - Add entry point logging for cpu functions (Jiri Denemark) - build: suppress distracting build output (Jim Meyering) - maint: add syntax-check rule to prohibit use of test's -a operator (Jim Meyering) - tests: shell script portability and clean-up (Jim Meyering) - tests: Don't add extra padding if counter mod 40 is 0 (Matthias Bolte) - Use common XML parsing functions (Jiri Denemark) - Introduce XML parsing utility functions (Jiri Denemark) - virDomainDiskDefAssignAddress: return int, not void (Jim Meyering) - tests: do not use the ":disk" suffix in sample xml input (Jim Meyering) - util: Make some conditional symbols unconditional (Matthias Bolte) - Export conditional state driver symbols only when they are defined (Matthias Bolte) - esx: Add esxVI_LookupVirtualMachineByName (Matthias Bolte) - esx: Generate method mappings via macros (Matthias Bolte) - Add migrate-setmaxdowntime command to virsh (Jiri Denemark) - Implement virDomainMigrateSetMaxDowntime in qemu driver (Jiri Denemark) - Implement virDomainMigrateSetMaxDowntime in remote driver (Jiri Denemark) - Wire protocol and dispatcher for virDomainMigrateSetMaxDowntime (Jiri Denemark) - Internal driver API for virDomainMigrateSetMaxDowntime (Jiri Denemark) - Virsh support for vol wiping (David Allan) - Simplified version of volume wiping based on feedback from the list. (David Allan) - Implement remote bits for vol wiping (David Allan) - Implement the public API for vol wiping (David Allan) - Define the internal driver API for vol wiping (David Allan) - Support vhost-net mode at qemu startup for virtio network devices (Laine Stump) - maint: enforce recent N_ usage (Eric Blake) - Allow suspend during live migration (Jiri Denemark) - do not require two ./autogen.sh runs to permit "make" (Jim Meyering) - esx: Move username and password helper functions to authhelper.c (Matthias Bolte) - Use WARN_CFLAGS when compiling virsh.c (Jiri Denemark) - qemu: Add some debugging at domain startup (Cole Robinson) - qemu: pass the information when disks are read-only (Daniel Veillard) - macvtap: Only export symbols if support is enabled (Matthias Bolte) - Only use the numa functions when they are available. (Chris Lalancette) - Allow devices without a parent (Ed Swierk) - build: change to gnulib module list should rerun bootstrap (Eric Blake) - build: enforce preprocessor indentation (Eric Blake) - build: update gnulib submodule to newer (but not latest) (Jim Meyering) - Make virsh reconnect when losing connection (Daniel Veillard) - Change logrotate to be per-hypervisor logs (Daniel Veillard) - build: consistently indent preprocessor directives (Eric Blake) - virsh: use N_ rather than gettext_noop (Eric Blake) - virsh: fix existing N_ uses (Eric Blake) - Get thread and socket information in virsh nodeinfo. (Chris Lalancette) - Eliminate large stack buffer in doTunnelSendAll (Laine Stump) - build: consistently use C99 varargs macros (Eric Blake) Cleanups: - Fix some cppi prepocessor indentation issues (Daniel Veillard) - Cleanup the msg_gen_function list in cfg.mk (Matthias Bolte) - remote: Remove virConnectPtr from error/errorf (Matthias Bolte) - Remove undefined symbols from symbols file (Matthias Bolte) - Add missing nwfilter_learnipaddr.c to POTFILES.in (Daniel P. Berrange) - Avoid searching for windres when not building for Windows (Diego Elio Pettenò) - Executable does not belong into repository. (Stefan Berger) - xenXMDomainDefineXML: remove dead store and useless/leaky virGetDomain (Jim Meyering) - createRawFileOpHook: avoid dead stores (Jim Meyering) - qemudDomainGetSecurityLabel: avoid dead store to "type" (Jim Meyering) - Cleanup x86Compute() (Jiri Denemark) - qemuDomainSnapshotLoad: avoid dead store (Jim Meyering) - maint: s/initialis/initializ/ (Eric Blake) - Fix 'avialable' typo (Matthias Bolte) - macvtap: Remove virConnectPtr from ReportError (Matthias Bolte) - phyp: Remove virConnectPtr from PHYP_ERROR (Matthias Bolte) - esx: Mark error messages for translation (Matthias Bolte) - vbox: Mark all error messages for translation (Matthias Bolte) - Clarify an error message in setmem. (Chris Lalancette) - Fix up comments for isEncrypted, isSecure, domainIsActive, and domainIsPersistent. (Chris Lalancette) - Fix compiler warning about unused conn parameter (Matthias Bolte) - openvz: Remove virConnectPtr from openvzError (Matthias Bolte) - one: Remove virConnectPtr from oneError (Matthias Bolte) - uml: Remove virConnectPtr from umlReportError (Matthias Bolte) - Remove virConnectPtr from eventReportError (Matthias Bolte) - Remove virConnectPtr from virLibConnError (Matthias Bolte) - xen: Remove virConnectPtr from xenUnifiedError (Matthias Bolte) - Remove virConnectPtr from nodeReportError (Matthias Bolte) - netcf: Remove virConnectPtr from interfaceReportError (Matthias Bolte) - xen: Remove virConnectPtr from virXenInotifyError (Matthias Bolte) - xen: Remove virConnectPtr from virXenStoreError (Matthias Bolte) - xen: Remove virConnectPtr from virXenError/virXenErrorFunc (Matthias Bolte) - xen: Remove virConnectPtr from virXMError (Matthias Bolte) - xen: Remove virConnectPtr from virXendError (Matthias Bolte) - proxy: Remove virConnectPtr from virProxyError (Matthias Bolte) - vbox: Remove virConnectPtr from vboxError (Matthias Bolte) - test: Remove virConnectPtr from testError (Matthias Bolte) - Remove unnecessary trailing \n in log messages (Matthias Bolte) - Fix compiler warning about non-literal format string (Matthias Bolte) - removes the virConnectPtr parameter where not necessary (Stefan Berger) - Clarified error message (David Allan) - Eliminate compiler warning about non-const format string (Laine Stump) - Get rid of the regular expressions (Stefan Berger) - Use the virStrToLong_ui() function rather than virStrToLong_i() (Stefan Berger) - Make virDomainLoadConfig static. (Chris Lalancette) - Eliminate compile warnings in nwfilter error log calls (Laine Stump) - Only parse 'CPU XML' in virCPUDefParseXML() (Jim Fehlig) - Replace sscanf in PCI device address parsing (Matthias Bolte) - xen: Use virStrToLong_i instead of sscanf for XenD port parsing (Matthias Bolte) - xenapi: Use virStrToLong_i instead of sscanf for CPU map parsing (Matthias Bolte) - openvz: Use strtok_r instead of sscanf for VPS UUID parsing (Matthias Bolte) - xen: Use virParseMacAddr instead of sscanf (Matthias Bolte) - vbox: Replace atoi with virStrToLong_i (Matthias Bolte) - cgroup: Replace sscanf with virStrToLong_ll (Matthias Bolte) - Refactor major.minor.micro version parsing into a function (Matthias Bolte) - Replace sscanf in nwfilter rule parsing (Matthias Bolte) - Replace sscanf in legacy device address parsing (Matthias Bolte) - build: more fallout from test -a (Eric Blake) - Fix apibuild.py warning about virNWFilterLookupByUUIDString (Matthias Bolte) - maint: remove redundant tests after virStrToLong (Eric Blake) - maint: update AUTHORS (Eric Blake) - maint: fix cpp indentation syntax-check failure (Jim Meyering) - Add virt-aa-helper and secaatest to .gitignore (Matthias Bolte) - esx: Remove redundant semicolons (Matthias Bolte) - Use libvirt's existing ipv6/ipv4 parser/printer (Stefan Berger) - Remove driver dependency from nwfilter_conf.c (Stefan Berger) - Fix a merge error leftover (Daniel Veillard) - Use enum of virDomainNetType (Stefan Berger) - Silence cppi syntax-check warning (Daniel Veillard) - maint: update syntax-check rule to also catch test's -o operator (Eric Blake) - build: don't use "test cond1 -o cond2": it's not portable (Eric Blake) - build: don't use "test cond1 -a cond2" in configure: it's not portable (Jim Meyering) - Remove interfaceRegister from libvirt_private.syms (Matthias Bolte) - esx: Cleanup file header comments (Matthias Bolte) - maint: enforce recent copyright style (Eric Blake) - maint: make Red Hat copyright notices consistent (Eric Blake) - maint: fix typo (Eric Blake) - docs: <pre> cannot be nested in (Matthias Bolte) - .gitignore: Ignore generated daemon/libvirtd.logrotate (Cole Robinson) - phyp: Use virRequestUsername and virRequestPassword (Matthias Bolte) - fix two "make syntax check" failures (Jim Meyering) - Fix syntax-check errors (Jiri Denemark) - Fix error messages in qemu text monitor (Jiri Denemark) - Fix compiler warnings in virsh.c (Laine Stump) - Silence compiler complaints about non-literal format strings (Laine Stump) - Remove qemudDomainSetMaxMemory. (Chris Lalancette) - Fix copy&paste typos in virProcessInfoGetAffinity (Jiri Denemark) - AUTHORS: add recent contributors (Eric Blake) - Fix format string warnings (Laine Stump) - ebtablesAddRemoveRule: avoid dead store (Jim Meyering) - virInterfaceDefParseBond: avoid dead stores (Jim Meyering) - xenXMDomainConfigParse: avoid dead store (Jim Meyering) - qemuMonitorTextGetMemoryStats: decrease risk of false positive in parsing (Jim Meyering) A lot of people helped for this release, including a number of new contributors, so let's all enjoy before the bugs start to pop up :-) ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] Documentation for synchronous hooks
by Daniel Veillard 13 Apr '10

13 Apr '10

Was still missing from main commits and would be needed for 0.8.0 Add documentation for synchronous hooks * docs/sitemap.html.in: add in navigation under Documentation/Deployment/Hooks * docs/hooks.html.in: new doc describing current support for 0.8.0 diff --git a/docs/hooks.html.in b/docs/hooks.html.in new file mode 100644 index 0000000..4ebeec3 --- /dev/null +++ b/docs/hooks.html.in @@ -0,0 +1,71 @@ +<?xml version="1.0"?> +<html> + <body> + <h1>Hooks for specific system management</h1> + Libvirt includes synchronous hooks starting from version 0.8.0, + this is a way to tie specific tailored system actions at specific + time. This is based on scripts being called on the Host where the + hypervisor is running, if the script is present when the libvirtd + daemon is doing some significant actions. + The scripts are expected to execute quickly, return a zero exit + status if all conditions are set for the daemon to continue the + action (non zero will be considered a failure which may + be ignored but in general will stops the ongoing operation). + The script also should not call back into libvirt as the daemon + is waiting for the script exit and deadlock is likely to occur + otherwise. + The scripts are stored in the directory <code>/etc/libvirt/hooks/</code> + when using a standard installation path + (<code>$SYSCONF_DIR/libvirt/hook/</code> in general). + The scripts gets arguments as parameter on their command line: + <ul> + <li> the first argument is the name of the object involved in the + operation or '-' if there is none. + <li> the second argument is the name of the operation. + <li> the third argument is a suboperation indication like 'start' + 'end' or '-' if there is none. + <li> the last argument is an extra argument string or '-' if there + is none. + </ul> + There is currently scripts for 3 domains of operation: + <ul> + <li><code>/etc/libvirt/hooks/daemon</code> script if + present is called at 3 points in time: + at daemon startup, typically started with the following + arguments: + <pre>/etc/libvirt/hooks/daemon - start - start</pre> + at daemon shutdown when it is about to exit, with the following + arguments: + <pre>/etc/libvirt/hooks/daemon - shutdown - shutdown</pre> + When the daemon is asked to reload its driver state when + receiving the SIGHUP signal, arguments are: + <pre>/etc/libvirt/hooks/daemon - reload begin SIGHUP</pre> + </li> + <li><code>/etc/libvirt/hooks/qemu</code> script and + <code>/etc/libvirt/hooks/lxc</code> to associate hooks for domain + operation on the respective QEmu/KVM and LXC drivers. + The domain related hooks also receive the full XML description + for the concerned domain on their stdin, which allows to get + all the informations from the domain, including UUID or storage + if that is needed for the script operation. + Currently only domain startup and domain end operations + involve the hook, the first one just before the domain gets + created. + For example if starting a QEmu domain named <code>test</code> + the following script will get called: + <pre>/etc/libvirt/hooks/qemu test start begin -</pre> + note that a non-zero return value from the script will abort the + domain startup operation, and if an error string is passed on + stderr by the hook script, it will be provided back to the user + at the libvirt API level. + For domain shutdown, the script will be called just after the + domain has finished execution, and the script will get: + <pre>/etc/libvirt/hooks/qemu test stopped end -</pre> + It is expected that other operation will be associated to hooks + but at the time of 0.8.0 only those 2 are associated to domains + lifecycle + </li> + </ul> + + </body> +</html> diff --git a/docs/sitemap.html.in b/docs/sitemap.html.in index 0c3f0c3..0117c8d 100644 --- a/docs/sitemap.html.in +++ b/docs/sitemap.html.in @@ -50,6 +50,10 @@ <a href="logging.html">Logging</a> The library and the daemon logging support </li> + <li> + <a href="hooks.html">Hooks</a> + Hooks for system specific management + </li> </ul> </li> <li> -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

3 3

[libvirt] [PATCH v1 0/2] Add missing protocol filters for IPv4 and add IPv6 support
by Stefan Berger 13 Apr '10

13 Apr '10

The first one of the following two patches adds support for filtering of ah, esp and udplite protocols. The 2nd one adds support for filtering of IPv6 traffic. With this now nearly all protocols of IPv4 and IPv6 (except mh) as supported by iptables/ip6tables are reachable via the filtering XML. Some features of those protocols still need support in data structures and XML attributes, though. Another thing that's missing is support for filtering of IPv6's NDP traffic (IPv6 equivalent of ARP) but there's no support for this in ebtables. Regards, Stefan

2 7

[libvirt] migration flags
by Kenneth Nagin 13 Apr '10

13 Apr '10

Could someone explain the usage of the following migration flags: --p2p --direct --tunneled --persistent Kenneth Nagin

2 1

[libvirt] creating domain with same name and different UUID
by Nikola Ciprich 13 Apr '10

13 Apr '10

Hello, I have small problem with libvirt, which I'm trying to solve... I'm using defineXML function to create KVM machines. from time to time, I need to delete the domain, and create new one with the same name. every newly created domain has new UUID. and this is where the problem starts, defineXML function documentation tells that previous definition domain would be overriden if it already exists, but it ends up with following error: libvir: Domain Config error : operation failed: domain 'vmnci01' already exists with uuid 8d9795b3-461e-11df-9882-00304834195b Traceback (most recent call last): File "/usr/libexec/vm2.py", line 173, in ? vm.start() File "/usr/libexec/vmmain2.py", line 433, in start self.dom = self.svconn.defineXML(self.xmldef.vm.domain.xml()) File "/usr/lib64/python2.4/site-packages/libvirt.py", line 1120, in defineXML if ret is None:raise libvirtError('virDomainDefineXML() failed', conn=self) libvirt.libvirtError: operation failed: domain 'vmnci01' already exists with uuid 8d9795b3-461e-11df-9882-00304834195b If I try to undefine domain first, it still seems to behave weirdly: [root@vbox1 libexec]# vm __start__ vmnci01 undefining domain... Starting HVM guest vmnci01 libvir: QEMU error : Domain not found: no domain with matching uuid '8d9795b3-461e-11df-9882-00304834195b' Traceback (most recent call last): File "/usr/libexec/vm2.py", line 173, in ? vm.start() File "/usr/libexec/vmmain2.py", line 436, in start self.dom.create() File "/usr/lib64/python2.4/site-packages/libvirt.py", line 300, in create if ret == -1: raise libvirtError ('virDomainCreate() failed', dom=self) libvirt.libvirtError: Domain not found: no domain with matching uuid '8d9795b3-461e-11df-9882-00304834195b' Could anybody help me with this? Am I doing something wrong? Currently, I'm using libvirt-0.7.6 Thanks a lot in advance! with best regards nik A -- ------------------------------------- Ing. Nikola CIPRICH LinuxBox.cz, s.r.o. 28. rijna 168, 709 01 Ostrava tel.: +420 596 603 142 fax: +420 596 621 273 mobil: +420 777 093 799 www.linuxbox.cz mobil servis: +420 737 238 656 email servis: servis(a)linuxbox.cz -------------------------------------

2 1

[libvirt] question about libvirt-tck/libivrt-perl
by Gerhard Stenzel 13 Apr '10

13 Apr '10

Hi, I have a small libvirt-TCK script, which fails in a for me unexpected way: ########################################################## use strict; use warnings; use Term::ReadKey; use Test::More tests => 4; use Sys::Virt::TCK; my $tck = Sys::Virt::TCK->new(); my $conn = eval { $tck->setup(); }; BAIL_OUT "failed to setup test harness: $@" if $@; END { $tck->cleanup if $tck; } # first domain my $xml = $tck->generic_domain("tck")->as_xml; my $dom; ok_domain(sub { $dom = $conn->create_domain($xml) }, "defined domain config"); my $uuid = $dom->get_uuid_string(); diag $uuid; $xml = $dom->get_xml_description; diag "Starting inactive domain config"; ok($dom->get_id() > 0, "running domain has an ID > 0"); $dom->destroy; # new domain my $newxml = $tck->generic_domain("tck")->as_xml; my $newdom; ok_domain(sub { $newdom = $conn->create_domain($newxml) }, "defined domain config"); my $newuuid = $newdom->get_uuid_string(); diag $newuuid; $newxml = $newdom->get_xml_description(); ok($newdom->get_id() > 0, "running domain has an ID > 0"); $newdom->destroy; ########################################################## scripts/network/001-prepare-image.t .. 1..4 ok 1 - defined domain config # 4317db52-00bb-3cac-5639-91cdce05a717 # Starting inactive domain config ok 2 - running domain has an ID > 0 ok 3 - defined domain config # 4317db52-00bb-3cac-5639-91cdce05a717 libvirt error code: 42, message: Domain not found: no domain with matching uuid '4317db52-00bb-3cac-5639-91cdce05a717' # Looks like you planned 4 tests but ran 3. # Looks like your test exited with 255 just after 3. Dubious, test returned 255 (wstat 65280, 0xff00) Failed 1/4 subtests Test Summary Report ------------------- scripts/network/001-prepare-image.t (Wstat: 65280 Tests: 3 Failed: 0) Non-zero exit status: 255 Parse errors: Bad plan. You planned 4 tests but ran 3. Files=1, Tests=3, 1 wallclock secs ( 0.02 usr 0.01 sys + 0.19 cusr 0.04 csys = 0.26 CPU) Result: FAIL ########################################################## If I change my $newxml = $tck->generic_domain("tck")->as_xml; to my $newxml = $tck->generic_domain("tck2")->as_xml; the script works as expected. I am wondering if this is a problem in the libvirt-perl wrapper or working as designed and my expectation is simply wrong? Thanks in advance... -- Best regards, Gerhard Stenzel, ----------------------------------------------------------------------------------------------------------------------------------- IBM Deutschland Research & Development GmbH Vorsitzender des Aufsichtsrats: Martin Jetter Geschäftsführung: Dirk Wittkopp Sitz der Gesellschaft: Böblingen Registergericht: Amtsgericht Stuttgart, HRB 243294

3 4

[libvirt] [PATCH 0/1] enospace disk error policy
by David Allan 13 Apr '10

13 Apr '10

Dan Kenigsberg requested that we add an option to explicitly request enospace as the disk error policy. David Allan (1): Add enospace option to qemu disk error policy docs/schemas/domain.rng | 1 + src/conf/domain_conf.c | 3 +- src/conf/domain_conf.h | 1 + src/qemu/qemu_conf.c | 2 + tests/qemuargv2xmltest.c | 3 ++ ...uxml2argv-disk-drive-error-policy-enospace.args | 1 + ...muxml2argv-disk-drive-error-policy-enospace.xml | 32 ++++++++++++++++++++ 7 files changed, 42 insertions(+), 1 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-error-policy-enospace.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-error-policy-enospace.xml

5 6

[libvirt] libvirt: C++ or Java?
by Ganesh Pagade 13 Apr '10

13 Apr '10

Hello, I am planning to develop a management application for managing Redhat Xen and Redhat KVM hypervisors. I am evaluating the Java bindings versus the C++ version of libvirt. As part of evaluation, I could not find meaningful answers to the questions below. Hence, I thought that people on this mailing list would be the most appropriate to comment on them. Can you please let me know your views? 1. Are all functions that are available in C API available in Java? 2. Are Java bindings added along with every enhancement to C API? 3. If answer to above question is negative, typically how long does it takes for the addition of Java bindings for the enhancement? 4. Most of libvirt based third party management applications use which of Java bindings or C API? 5. What are your good/bad experiences while using either of C API or Java bindings? 6. What is your concluding personal recommendation? And finally, since libvirt is a Redhat Emerging Technology project, does Redhat or any other third party service providers provide paid assistance, support? Appreciate your time. Thanks. Regards, Ganesh

3 2

[libvirt] [PATCH 0/6]: Domain Snapshot API
by Chris Lalancette 13 Apr '10

13 Apr '10

Hello, Here is the next set of patches for the snapshot API. This set is much more complete, and implements the virDomainRevertToSnapshot() semantic instead of virDomainCreateFromSnapshot() that we discussed earlier. I've also incorporated all of the comments from the review of the first round of patches. Aside from implementation bugs, I consider this patchset complete. The only thing missing from the patches is real documentation along the lines of the API docs that we had discussed on-list. Next week I'll followup with some additions to the documentation that explain the semantics of these calls. Again review and comments are welcome. Chris Lalancette

6 24

[libvirt] [PATCH] Rename virsh "revert-to-snapshot" to "snapshot-revert"
by Chris Lalancette 13 Apr '10

13 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.c | 10 +++++----- tools/virsh.pod | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 8017beb..d5fe6c4 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -8514,22 +8514,22 @@ cleanup: } /* - * "revert-to-snapshot" command + * "snapshot-revert" command */ -static const vshCmdInfo info_revert_to_snapshot[] = { +static const vshCmdInfo info_snapshot_revert[] = { {"help", N_("Revert a domain to a snapshot")}, {"desc", N_("Revert domain to snapshot")}, {NULL, NULL} }; -static const vshCmdOptDef opts_revert_to_snapshot[] = { +static const vshCmdOptDef opts_snapshot_revert[] = { {"domain", VSH_OT_DATA, VSH_OFLAG_REQ, N_("domain name, id or uuid")}, {"snapshotname", VSH_OT_DATA, VSH_OFLAG_REQ, N_("snapshot name")}, {NULL, 0, 0, NULL} }; static int -cmdDomainRevertToSnapshot(vshControl *ctl, const vshCmd *cmd) +cmdDomainSnapshotRevert(vshControl *ctl, const vshCmd *cmd) { virDomainPtr dom = NULL; int ret = FALSE; @@ -8786,7 +8786,7 @@ static const vshCmdDef commands[] = { {"snapshot-delete", cmdSnapshotDelete, opts_snapshot_delete, info_snapshot_delete}, {"snapshot-dumpxml", cmdSnapshotDumpXML, opts_snapshot_dumpxml, info_snapshot_dumpxml}, {"snapshot-list", cmdSnapshotList, opts_snapshot_list, info_snapshot_list}, - {"revert-to-snapshot", cmdDomainRevertToSnapshot, opts_revert_to_snapshot, info_revert_to_snapshot}, + {"snapshot-revert", cmdDomainSnapshotRevert, opts_snapshot_revert, info_snapshot_revert}, {NULL, NULL, NULL, NULL} }; diff --git a/tools/virsh.pod b/tools/virsh.pod index 46ba813..4af5603 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -819,12 +819,12 @@ List all of the available snapshots for the given domain. Output the snapshot XML for the domain's snapshot named I<snapshot>. -=item B<revert-to-snapshot> I<domain> I<snapshot> +=item B<snapshot-revert> I<domain> I<snapshot> Revert the given domain to the snapshot specified by I<snapshot>. Be aware that this is a destructive action; any changes in the domain since the snapshot was taken will be lost. Also note that the state of the domain after -revert-to-snapshot is complete will be the state of the domain at the time +snapshot-revert is complete will be the state of the domain at the time the original snapshot was taken. =item B<snapshot-delete> I<domain> I<snapshot> I<--children> -- 1.6.6.1

2 2

[libvirt] [PATCH 0/2]: Two small fixes
by Luiz Capitulino 12 Apr '10

12 Apr '10

Two small issues I found while testing libvirt under QMP, there is also a third I won't fix today: dommemstat doesn't work under QMP.

2 5

[libvirt] [PATCH 0/2] Enhance checking of supported flags in drivers
by Jiri Denemark 12 Apr '10

12 Apr '10

I think we need a simple and consistent way of checking whether flags passed to API entry points in drivers are valid/supported or not. So far some entry points don't check flags at all and some checks for 0 when no flags are expected/supported. The first patch introduces a macro which can be called with a whitelist of supported flags (more info about it inside the patch). I don't particularily like introducing a new header file but non of existing header files looked like a good place to stick this macro in. If you think such a place exist, I'll be very happy to adapt the patch. The second patch changes all API calls introduced since the last release to use the macro for checking valid flags. I'm not sure if we can change existing API calls to do the same as it could break some badly written apps which pass invalid flags. My opinion is that we may often do that as such apps don't use the API in a documented/valid way. But even if my thinking is correct, we don't want to change it before 0.8.0. Jirka Jiri Denemark (2): Introduce virCheckFlags for consistent flags checking Use virCheckFlags for APIs added in 0.8.0 src/Makefile.am | 3 +- src/esx/esx_driver.c | 44 ++++++++++++------------- src/nwfilter/nwfilter_driver.c | 5 ++- src/qemu/qemu_driver.c | 69 +++++++++++++++++++--------------------- src/storage/storage_driver.c | 7 +--- src/util/checks.h | 37 +++++++++++++++++++++ src/vbox/vbox_tmpl.c | 42 +++++++++++++++++------- src/xen/xend_internal.c | 5 +++ 8 files changed, 133 insertions(+), 79 deletions(-) create mode 100644 src/util/checks.h

2 3

[libvirt] [PATCH] nwfilter: Fix memory leak on daemon init and shutdown
by Stefan Berger 12 Apr '10

12 Apr '10

This patch fixes a memory leak on daemon init and shutdown. The module was initialized twice and not shut down. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>

2 2

[libvirt] libvirt Error Domain didn't show up
by Roche, Christian (EXT-Other - MA/Rabat) 12 Apr '10

12 Apr '10

Hi there, I'm trying to use kvm on CentOS 5.4 64-bit to virtualize Windows Server 2003. I've been able to install and start the system using 1GB of memory, however when I try to increase the amount of memory available to the VM to 4GB by editing /etc/libvirt/qemu/windows2003.xml, I get the following message when starting the VM through virt-manager: --------------------------------- Error starting domain: internal error Domain windows2003 didn't show up Traceback (most recent call last): File "/usr/share/virt-manager/virtManager/engine.py", line 498, in run_domain vm.startup() File "/usr/share/virt-manager/virtManager/domain.py", line 573, in startup self.vm.create() File "/usr/lib64/python2.4/site-packages/libvirt.py", line 287, in create if ret == -1: raise libvirtError ('virDomainCreate() failed', dom=self) libvirtError: internal error Domain windows2003 didn't show up --------------------------------- Here is the content of /var/log/libvirt/qemu/windows2003.log : --------------------------------- LC_ALL=C PATH=/sbin:/usr/sbin:/bin:/usr/bin /usr/bin/qemu-system-x86_64 -S -M pc -no-kqemu -m 4096 -smp 4 -monitor pty -pidfile /var/run/libvirt/qemu//windows2003.pid -localtime -boot c -hda /dev/mapper/Raid5-Windows -cdrom /var/lib/libvirt/images/viostor.iso -net nic,macaddr=54:52:00:07:a9:b6,vlan=0 -net tap,fd=16,script=,vlan=0,ifname=vnet0 -serial pty -parallel none -usb -usbdevice tablet -vnc 127.0.0.1:0 -k fr QEMU PC emulator version 0.9.0, Copyright (c) 2003-2007 Fabrice Bellard usage: qemu [options] [disk_image] 'disk_image' is a raw hard image image for IDE hard disk 0 Standard options: -M machine select emulated machine (-M ? for list) -fda/-fdb file use 'file' as floppy disk 0/1 image -hda/-hdb file use 'file' as IDE hard disk 0/1 image blah blah blah --------------------------------- It looks like qemu is unhappy about the memory parameter. Here is my config: >uname -a Linux silver 2.6.18-164.15.1.el5 #1 SMP Wed Mar 17 11:30:06 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux >grep virt /var/log/rpmpkgs libvirt-0.6.3-20.1.el5_4.x86_64.rpm libvirt-python-0.6.3-20.1.el5_4.x86_64.rpm python-virtinst-0.400.3-5.el5.noarch.rpm virt-manager-0.6.1-8.el5.x86_64.rpm Any idea ? Thanks, Christian Roche NSN/Rabat +212 6 61 44 11 71

1 0

Re: [libvirt] Domain not stable while created...
by Sankamesh 12 Apr '10

12 Apr '10

Thanks Mr. Stefan Will that crash mainly be due to the kernel ? Since am not sure about that,else I should try with different image. When I use via a config file using "xm create libvirt-ttylinux.conf ", then the domain runs stable.... But when I use the virsh -c xen:/// define libvirt-ttylinux.xml" and "virsh start ttyimage, it crashes after sometime. The ibvirt-ttylinux.conf file :: -------------------------------------------------------------------------------------------------------------------------------- kernel = "/boot/vmlinuz-2.6.18-164.2.1.el5xen" ramdisk= "/boot/initrd-2.6.18-164.2.1.el5xen.img" memory = 64 name = "ttylinux" disk = ['file:/usr/local/ttylinux-xen-libvirt/ttylinux-xen.img,sda1,w'] root = "/dev/sda1 ro" vif = [''] -------------------------------------------------------------------------------------------------------------------------------- I give the same Xen kernel parameter here in xml file, and use virsh to create domain --------------------------------------------------------------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?> <domain type='xen'> <name>ttyimage</name> <os> <type>linux</type> <kernel>/boot/vmlinuz-2.6.18-164.2.1.el5xen</kernel> <initrd>/boot/initrd-2.6.18-164.2.1.el5xen.img</initrd> </os> <memory>65536</memory> <vcpu>1</vcpu> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <graphics type='vnc' port='5900'/> <disk type='file'> <source file='/usr/local/ttylinux-xen-libvirt/ttylinux-xen.img' /> <target dev='sda1' /> </disk> <interface type='bridge'> <source bridge='virbr0' /> <mac address='00:1d:60:ec:ae:1c' /> <target dev='testnimb-0' /> </interface> </devices> </domain> --------------------------------------------------------------------------------------------------------------------------------------- My Boot grub file data:: --------------------------------------------------------------------------------------------------------------------------------------title Scientific Linux (2.6.18-164.2.1.el5xen) root (hd0,0) kernel /xen.gz-2.6.18-164.2.1.el5 module /vmlinuz-2.6.18-164.2.1.el5xen ro root=LABEL=/1 rhgb quiet module /initrd-2.6.18-164.2.1.el5xen.img -------------------------------------------------------------------------------------------------------------------------------------- Why is this difference between the xm (when i destroy the image,domain is also destroyed) and virsh (domain is not destroyed while destroying the image) . I doubt that am making some mistake with the xml file .... Is that true? Kindly give some suggestions Thanks ________________________________ libvir-list-bounces(a)redhat.com wrote on 04/10/2010 09:47:17 AM: > libvir-list > > Hello, > > Thanks Alex > > I created a domain using "virsh -c xen:/// define libvirt-ttylinux.xml" and > "virsh start ttyimage" for a simple ttyimage. > > Problem I face is that the image shutsdown immedialtely once virsh > start guest is typed. > I checked the Xend Logs > ---------------------------------------------------------------------------------------------------------- > ---[2010-04-11 07:08:02 xend 3155] DEBUG (DevController:116) > DevController: writing {'frontend-id': '6', 'domain': 'ttyimage', [...] > [2010-04-11 07:08:02 xend 3155] DEBUG (vfbif:11) Spawn: ['/usr/lib/ > xen/bin/qemu-dm', '-M', 'xenpv', '-d', '6', '-domain-name', > 'ttyimage', '-vnc', '127.0.0.1:0', '-vncunused', '-k', 'en-us'] > [2010-04-11 07:08:02 xend.XendDomainInfo 3155] DEBUG > (XendDomainInfo:992) Storing VM details: {'shadow_memory': '0', > 'uuid': 'd5e916b0-bc2d-01f9-8156-4808c754f67a', 'on_reboot': > 'restart', 'start_time': '1270937282.29', 'on_poweroff': 'destroy', > 'name': 'ttyimage', 'xend/restart_count': '0', 'vcpus': '1', > 'vcpu_avail': '1', 'memory': '64', 'on_crash': 'destroy', 'image': > '(linux (kernel /boot/vmlinuz-2.6.18-164.2.1.el5xen))', 'maxmem': '64'} > [2010-04-11 07:08:02 xend.XendDomainInfo 3155] DEBUG > (XendDomainInfo:1027) Storing domain details: {'console/ring-ref': > '65674', 'console/port': '2', 'name': 'ttyimage', 'console/limit': > '1048576', 'vm': '/vm/d5e916b0-bc2d-01f9-8156-4808c754f67a', > 'domid': '6', 'cpu/0/availability': 'online', 'memory/target': > '65536', 'store/ring-ref': '65675', 'store/port': '1'} > [2010-04-11 07:08:02 xend.XendDomainInfo 3155] DEBUG > (XendDomainInfo:1249) XendDomainInfo.handleShutdownWatch > [2010-04-11 07:08:02 xend 3155] DEBUG (DevController:158) Waiting > for devices vif. > [2010-04-11 07:08:02 xend 3155] DEBUG (DevController:164) Waiting for 0. > [2010-04-11 07:08:02 xend 3155] DEBUG (DevController:509) > hotplugStatusCallback /local/domain/0/backend/vif/6/0/hotplug-status. > [2010-04-11 07:08:51 xend 3155] INFO (XendDomain:387) Domain > ttyimage (6) unpaused. > [2010-04-11 07:08:54 xend.XendDomainInfo 3155] WARNING > (XendDomainInfo:1177) Domain has crashed: name=ttyimage id=6. You domain crashed here... Is the VM image and kernel in that image known to work? Regards, Stefan Send free SMS to your Friends on Mobile from your Yahoo! Messenger. Download Now! http://messenger.yahoo.com/download.php

2 1

[libvirt] about qemu monitor mode.
by Osier Yang 12 Apr '10

12 Apr '10

Hello there libvirt compiles JSON mode as the default qemu monitor mode if yajl-devel is available. As a result of this solution, the user has no way to change into the text mode. And because the qemu QMP always lacks commands currently, such as "savevm", it will prevent us creating the snapshot of domain, especially for us who want to do some testing. What I think is could we add the configuration item in qemu.conf? so that the user can choose which mode to use, such as: monitor_mode=json #monitor_mode=text Regards osier

2 1

[libvirt] libvirt: C++ or Java
by Gokhale, Shashibhushan 11 Apr '10

11 Apr '10

Hello, I am planning to develop a management application for managing Redhat Xen and Redhat KVM hypervisors. I am evaluating the Java bindings versus the C++ version of libvirt. As part of evaluation, I could not find meaningful answers to the questions below. Hence, I thought that people on this mailing list would be the most appropriate to comment on them. Can you please let me know your views? 1. Are all functions that are available in C API available in Java? 2. Are Java bindings added along with every enhancement to C API? 3. If answer to above question is negative, typically how long does it takes for the addition of Java bindings for the enhancement? 4. Most of libvirt based third party management applications use which of Java bindings or C API? 5. What are your good/bad experiences while using either of C API or Java bindings? 6. What is your concluding personal recommendation? And finally, since libvirt is a Redhat Emerging Technology project, does Redhat or any other third party service providers provide paid assistance, support? Thanks, Shashi

1 0

[libvirt] Domain not stable while created...
by Sankamesh 11 Apr '10

11 Apr '10

Hello, I am using Scientific Linux 5.4 and xen. I want to deploy a sample ttyimage by creating a domain using virsh create. My configuration file is : ----------------------------------------------------------------------------------------------------- <?xml version="1.0" encoding="utf-8"?> <domain type='xen'> <name>ttyimage</name> <os> <type>linux</type> <kernel>/boot/vmlinuz-2.6.18-164.2.1.el5xen</kernel> </os> <memory>65536</memory> <vcpu>1</vcpu> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <graphics type='vnc' port='5900'/> <disk type='file'> <source file='/usr/local/ttylinux-xen-libvirt/ttylinux-xen.img' /> <target dev='sda' /> </disk> <interface type='bridge'> <source bridge='virbr0' /> <mac address='00:1d:60:ec:ae:1c' /> <target dev='testnimb-0' /> </interface> </devices> </domain> ------------------------------------------------------------------------------------------------------- when I use "virsh -c "xen:///" create libvirt-ttylinux.xml " to create a domain, the domain is crated and i can view the image (in paused mode) using the virt-manager. and when I resume the image it ,disappears (domain gets destroyed) after nearly 10 seconds..... Further when I use vncviewer localhost::5900 when the image is running (during the 10 sec) ,i can view the console. But it closes once the domain is destroyed. Can someone explain why the image is not stable??? how can I make the domain to be stable???? Thanks in advance The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

3 3

Re: [libvirt] [RFC] Unify KVM kernel-space and user-space code into a single project
by Antoine Martin 10 Apr '10

10 Apr '10

Hi, I am moving this thread here as this seems more appropriate. Sorry it has taken so long.. Here are 2 things that really get in the way of moving my existing installations to libvirt: * I tend to store much meta data with each VM instance: it can be things like ownership (contact details as text), monitoring info (sms phone numbers), backup (list of paths), firewall rules (custom syntax, with failover rules, etc), etc. At the moment, these extra bits of information consist of just a few optional lines of shell in each VM's definition file. I can extend these whenever I need, enumerate the VMs using the standard mechanism and trigger my specific actions as needed (firewall rules, backup or whatever). I see no way of doing this with libvirt. But please correct me if I am wrong. * not everything is exposed via libvirt: virsh can retrieve vncdisplay but libvirt (or at least the python bindings) does not. How come? This happens to be one thing I need for writing a libvirt backend for my virtual desktop software. Cheers Antoine Antoine Martin wrote: > Hi Daniel, > > I'll take a look and get back to you asap. > > Cheers > Antoine > > Daniel P. Berrange wrote: >> On Tue, Mar 23, 2010 at 03:00:28AM +0700, Antoine Martin wrote: >>> On 03/23/2010 02:15 AM, Anthony Liguori wrote: >>>> On 03/22/2010 12:55 PM, Avi Kivity wrote: >>>>>> Lets look at the ${HOME}/.qemu/qmp/ enumeration method suggested by >>>>>> Anthony. >>>>>> There's numerous ways that this can break: >>>>> I don't like it either. We have libvirt for enumerating guests. >>>> We're stuck in a rut with libvirt and I think a lot of the >>>> dissatisfaction with qemu is rooted in that. It's not libvirt that's >>>> the probably, but the relationship between qemu and libvirt. >>> +1 >>> The obvious reason why so many people still use shell scripts rather >>> than libvirt is because if it just doesn't provide what they need. >>> Every time I've looked at it (and I've been looking for a better >>> solution for many years), it seems that it would have provided most of >>> the things I needed, but the remaining bits were unsolvable. >> If you happen to remember what missing features prevented you choosing >> libvirt, that would be invaluable information for us, to see if there >> are quick wins that will help out. We got very useful feedback when >> recently asking people this same question > >> http://rwmj.wordpress.com/2010/01/07/quick-quiz-what-stops-you-from-using-l… > >> Allowing arbitrary passthrough of QEMU commands/args will solve some of >> these issues, but certainly far from solving all of them. eg guest cut+ >> paste, host side control of guest screen resolution, easier x509/TLS >> configuration for remote management, soft reboot, Windows desktop support >> for virt-manager, host network interface management/setup, etc > >> Regards, >> Daniel

5 13

[libvirt] [PATCH] nwfilter: Process DHCP option to determine whether packet is a DHCP_OFFER
by Stefan Berger 10 Apr '10

10 Apr '10

I mistakenly took the op field in the DHCP message as the DHCP_OFFER type. Rather than basing the decision to read the VM's IP address on that field, process the appended DHCP options where option 53 indicates the actual type of the packet. I am also reading the broadcast address of the VM, but don't use it so far. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_learnipaddr.c | 61 +++++++++++++++++++++++++++++++++--- 1 file changed, 56 insertions(+), 5 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -64,6 +64,13 @@ struct f_arphdr { } ATTRIBUTE_PACKED; +struct dhcp_option { + uint8_t code; + uint8_t len; + uint8_t value[0]; /* length varies */ +} ATTRIBUTE_PACKED; + + /* structure representing DHCP message */ struct dhcp { uint8_t op; @@ -78,9 +85,12 @@ struct dhcp { uint32_t siaddr; uint32_t giaddr; uint8_t chaddr[16]; - /* omitted */ + uint8_t zeroes[192]; + uint32_t magic; + struct dhcp_option options[0]; } ATTRIBUTE_PACKED; +#define DHCP_MSGT_DHCPOFFER 2 struct ether_vlan_header { @@ -212,6 +222,40 @@ virNWFilterGetIpAddrForIfname(const char #ifdef HAVE_LIBPCAP +static void +procDHCPOpts(struct dhcp *dhcp, int dhcp_opts_len, + uint32_t *vmaddr, uint32_t *bcastaddr, + enum howDetect *howDetected) { + struct dhcp_option *dhcpopt = &dhcp->options[0]; + + while (dhcp_opts_len >= 2) { + + switch (dhcpopt->code) { + + case 28: /* Broadcast address */ + if (dhcp_opts_len >= 6) { + uint32_t *tmp = (uint32_t *)&dhcpopt->value; + (*bcastaddr) = ntohl(*tmp); + } + break; + + case 53: /* Message type */ + if (dhcp_opts_len >= 3) { + uint8_t *val = (uint8_t *)&dhcpopt->value; + switch (*val) { + case DHCP_MSGT_DHCPOFFER: + *vmaddr = dhcp->yiaddr; + *howDetected = DETECT_DHCP; + break; + } + } + } + dhcp_opts_len -= (2 + dhcpopt->len); + dhcpopt = (struct dhcp_option*)((char *)dhcpopt + 2 + dhcpopt->len); + } +} + + /** * learnIPAddressThread * arg: pointer to virNWFilterIPAddrLearnReq structure @@ -236,12 +280,13 @@ learnIPAddressThread(void *arg) struct ether_header *ether_hdr; struct ether_vlan_header *vlan_hdr; virNWFilterIPAddrLearnReqPtr req = arg; - uint32_t vmaddr = 0; + uint32_t vmaddr = 0, bcastaddr = 0; unsigned int ethHdrSize; char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev : req->ifname; int to_ms = (strlen(req->linkdev) != 0) ? 1000 : 0; + int dhcp_opts_len; char macaddr[VIR_MAC_STRING_BUFLEN]; virBuffer buf = VIR_BUFFER_INITIALIZER; char *filter= NULL; @@ -382,12 +427,18 @@ learnIPAddressThread(void *arg) sizeof(struct dhcp)) { struct dhcp *dhcp = (struct dhcp *) ((char *)udphdr + sizeof(udphdr)); - if (dhcp->op == 2 /* DHCP OFFER */ && + if (dhcp->op == 2 /* BOOTREPLY */ && !memcmp(&dhcp->chaddr[0], req->macaddr, 6)) { - vmaddr = dhcp->yiaddr; - howDetected = DETECT_DHCP; + dhcp_opts_len = header.len - + (ethHdrSize + iphdr->ihl * 4 + + sizeof(struct udphdr) + + sizeof(struct dhcp)); + procDHCPOpts(dhcp, dhcp_opts_len, + &vmaddr, + &bcastaddr, + &howDetected); } } }

2 1

[libvirt] [PATCH] Fix error in nwfilter test driver
by Stefan Berger 10 Apr '10

10 Apr '10

Trivial fix for the c&p error in the nwfilter test driver. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Index: libvirt-acl/src/test/test_driver.c =================================================================== --- libvirt-acl.orig/src/test/test_driver.c +++ libvirt-acl/src/test/test_driver.c @@ -5212,7 +5212,7 @@ static virDrvOpenStatus testNWFilterOpen if (STRNEQ(conn->driver->name, "Test")) return VIR_DRV_OPEN_DECLINED; - conn->secretPrivateData = conn->privateData; + conn->nwfilterPrivateData = conn->privateData; return VIR_DRV_OPEN_SUCCESS; }

2 2

[libvirt] libvirt: C++ or Java
by Gokhale, Shashibhushan 10 Apr '10

10 Apr '10

Hello, I am planning to develop a management application for managing Redhat Xen and Redhat KVM hypervisors. I am evaluating the Java bindings versus the C++ version of libvirt. As part of evaluation, I could not find meaningful answers to the questions below. Hence, I thought that people on this mailing list would be the most appropriate to comment on them. Can you please let me know your views? 1. Are all functions that are available in C API available in Java? 2. Are Java bindings added along with every enhancement to C API? 3. If answer to above question is negative, typically how long does it takes for the addition of Java bindings for the enhancement? 4. Most of libvirt based third party management applications use which of Java bindings or C API? 5. What are your good/bad experiences while using either of C API or Java bindings? 6. What is your concluding personal recommendation? And finally, since libvirt is a Redhat Emerging Technology project, does Redhat or any other third party service providers provide paid assistance, support? Thanks, Shashi

1 0

[libvirt] [RESEND][PATCH][QEMU driver] Catch cdrom change error
by Ryan Harper 09 Apr '10

09 Apr '10

Currently when we attempt to change the cdrom in a qemu VM the monitor doesn't generate an error if the target filename doesn't exist. I've submitted a patch[1] for this. This patch is the libvirt qemu-driver side which catches the error message from the monitor and reportes the error to libvirt. This means that virsh attach-disk cdrom commands won't appear to succeed when qemu change command actually failed. I've tested this patch on an older libvirt (rebuild libvirt-0.7.0 on my ubuntu host) but haven't rebuilt against git head since I can't quite compile that on my host. 1. http://lists.gnu.org/archive/html/qemu-devel/2010-03/msg01935.html Signed-off-by: Ryan Harper <ryanh(a)us.ibm.com> diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c index 1596e59..f868907 100644 --- a/src/qemu/qemu_monitor_text.c +++ b/src/qemu/qemu_monitor_text.c @@ -905,7 +905,14 @@ int qemuMonitorTextChangeMedia(qemuMonitorPtr mon, qemuReportError(VIR_ERR_OPERATION_FAILED, _("could not eject media on %s: %s"), devname, reply); goto cleanup; - } + } + + /* Could not open message indicates bad filename */ + if (strstr(reply, "\nCould not open ")) { + qemuReportError(VIR_ERR_OPERATION_FAILED, + _("could not change media on %s: %s"), devname, reply); + goto cleanup; + } ret = 0; -- Ryan Harper Software Engineer; Linux Technology Center IBM Corp., Austin, Tx ryanh(a)us.ibm.com

2 1

[libvirt] Documentation: misleading examples
by redshift＠gmx.com 09 Apr '10

09 Apr '10

Hello, at http://libvirt.org/formatdomain.html#elementsNICS there are three examples of interfaces with a particular MAC address specified. I understand the provided mac address is more a placeholder than a real value; but since '11:22:33:44:55:66' seems to be a multicast address[1], I would suggest providing '00:11:22:33:44:55' as example. Best regards [1] http://en.wikipedia.org/wiki/MAC_address#Address_details

2 1

[libvirt] [PATCH] More event callback fixes
by Daniel P. Berrange 09 Apr '10

09 Apr '10

In a couple of cases typos meant we were firing the wrong type of event. In the python code my previous commit accidentally missed some chunks of the code. * python/libvirt-override-virConnect.py: Add missing python glue accidentally left out of previous commit * src/conf/domain_event.c, src/qemu/qemu_monitor_json.c: Fix typos in event name / method name to invoke --- python/libvirt-override-virConnect.py | 48 +++++++++++++++++++++++++++++++++ src/conf/domain_event.c | 2 +- src/qemu/qemu_monitor_json.c | 2 +- 3 files changed, 50 insertions(+), 2 deletions(-) diff --git a/python/libvirt-override-virConnect.py b/python/libvirt-override-virConnect.py index 444a499..b49f786 100644 --- a/python/libvirt-override-virConnect.py +++ b/python/libvirt-override-virConnect.py @@ -63,6 +63,54 @@ except AttributeError: pass + def dispatchDomainEventRTCChangeCallback(self, dom, offset, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), offset ,opaque) + return 0 + except AttributeError: + pass + + def dispatchDomainEventWatchdogCallback(self, dom, action, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), action, opaque) + return 0 + except AttributeError: + pass + + def dispatchDomainEventIOErrorCallback(self, dom, srcPath, devAlias, action, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), opaque) + return 0 + except AttributeError: + pass + + def dispatchDomainEventGraphicsCallback(self, dom, phase, localAddr, remoteAddr, authScheme, subject, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), phase, localAddr, remoteAddr, authScheme, subject, opaque) + return 0 + except AttributeError: + pass + def domainEventDeregisterAny(self, callbackID): """Removes a Domain Event Callback. De-registering for a domain callback will disable delivery of this event type """ diff --git a/src/conf/domain_event.c b/src/conf/domain_event.c index 07d6a55..e3ce5ba 100644 --- a/src/conf/domain_event.c +++ b/src/conf/domain_event.c @@ -660,7 +660,7 @@ virDomainEventPtr virDomainEventIOErrorNewFromObj(virDomainObjPtr obj, obj->def->id, obj->def->name, obj->def->uuid); if (ev) { - ev->data.watchdog.action = action; + ev->data.ioError.action = action; if (!(ev->data.ioError.srcPath = strdup(srcPath)) || !(ev->data.ioError.devAlias = strdup(devAlias))) { virDomainEventFree(ev); diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 507e935..00bb275 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -536,7 +536,7 @@ static void qemuMonitorJSONHandleWatchdog(qemuMonitorPtr mon, virJSONValuePtr da } else { actionID = VIR_DOMAIN_EVENT_WATCHDOG_NONE; } - qemuMonitorEmitRTCChange(mon, actionID); + qemuMonitorEmitWatchdog(mon, actionID); } VIR_ENUM_DECL(qemuMonitorIOErrorAction) -- 1.6.6.1

2 1

[libvirt] [PATCH v2]
by Stefan Berger 09 Apr '10

09 Apr '10

This patch adds new test cases to the existing nwfilter test program and adds a test script that must be run while a VM is running. This test script verifies that input network filter XML creates expected user-defined tables and rules on ebtables, iptables & ip6tables layer and verifies their content against expected content. The idea is that these tools always return exactly the same output when displaying the content of a user-defined table so that the diff tool can be used for simple text comparison. All supported protocols have at least one test case. This test program is not run automatically since it requires a running VM. For all tests to pass the previously posted ICMP fix patch must be applied. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfiltervmtest.sh | 186 ++++++++++++++++++ tests/nwfilterxml2fwallout/ah-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/ah-test.fwall | 19 + tests/nwfilterxml2fwallout/all-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/all-test.fwall | 19 + tests/nwfilterxml2fwallout/arp-test.fwall | 9 tests/nwfilterxml2fwallout/esp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/esp-test.fwall | 19 + tests/nwfilterxml2fwallout/icmp-direction-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction2-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction3-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-test.fwall | 16 + tests/nwfilterxml2fwallout/icmpv6-test.fwall | 16 + tests/nwfilterxml2fwallout/igmp-test.fwall | 19 + tests/nwfilterxml2fwallout/ip-test.fwall | 12 + tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 12 + tests/nwfilterxml2fwallout/ipv6-test.fwall | 14 + tests/nwfilterxml2fwallout/mac-test.fwall | 12 + tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/sctp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/sctp-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/udp-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-test.fwall | 19 + tests/nwfilterxml2xmlin/icmp-direction-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 + tests/nwfilterxml2xmlout/icmp-direction-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction2-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction3-test.xml | 9 tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml | 9 tests/nwfilterxml2xmltest.c | 4 37 files changed, 748 insertions(+) Index: libvirt-acl/tests/nwfiltervmtest.sh =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfiltervmtest.sh @@ -0,0 +1,191 @@ +#!/bin/bash + +VIRSH=virsh +ORIG_IFNAME="vnet0" + +TMPFILE1="/tmp/nwfiltervmtest1.txt" +TMPFILE2="/tmp/nwfiltervmtest2.txt" + +function usage() { + local cmd="$0" + echo "Usage: ${cmd} [--help|-h|-?] [--ifname|-i <interfacename>" + cat <<EOF + +Options: + --help,-h,-? : Display this help screen. + --ifname, -i : Name of the backend interface of the VM. Default 'vnet0' + +Run this program while a KVM VM is running (preferably as only VM on the +system) and one of its interfaces uses a filter called 'testcase'. The name +of the interface of the VM is anticipated to be 'vnet0' unless set by the +'--ifname' option. The following interface description fulfills this +requirement: + + <interface type='bridge'> + <source bridge='virbr0'/> + <target dev='vnet0'/> + <filterref filter='testcase'/> + </interface> + +The individual tests are validated using string comparison where the output +of ebtables, iptables and ip6tables is compared against expected output. As +long as the output of those tools is the same, the tests should all pass. +The tests were developed on Fedore Core 12. + +Known problems: None of the running VMs' names may have spaces. +EOF +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local cmd line tmpfile tmpfile2 + local linenums ctr=0 + local regex="s/${ORIG_IFNAME}/${ifname}/g" + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + tmpfile="${TMPFILE1}" + tmpfile2="${TMPFILE2}" + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + exec 4<&0 + + exec < ${fwallfile} + + read line + while [ "x${line}x" != "xx" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + exec ${cmd} | grep -v "^Bridge" | grep -v "^$" > ${tmpfile} + + rm ${tmpfile2} 2>/dev/null + touch ${tmpfile2} + + while [ 1 ]; do + read + + line="${REPLY}" + + if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then + + diff ${tmpfile} ${tmpfile2} >/dev/null + + if [ $? -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + else + echo "PASS ${xmlfile} : ${cmd}" + fi + + break; + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 0<&4 + exec 4<&- + + rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null +} + + +function runTests() { + local ifname="$1" + local xmldir="$2" + local fwalldir="$3" + local fwallfiles f + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${ifname}" + done +} + + +function checkVM() { + local vmname="$1" + local ifname="$2" + local nwfilter="$3" + local f i c + + c=`${VIRSH} dumpxml ${vmname} | grep -c "<interface"` + if [ ${c} -ne 1 ]; then + echo "VM '${vmname}' has multiple interfaces. I cannot tell for sure " + echo "whether this VM has the correct interface name '${ifname}' and " + echo "reference the filter '${nwfilter}'. Cowardly skipping this VM..." + return 1 + fi + + f=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \ + sed "s/.*filterref filter='$[a-zA-Z0-9_]\+$'.*/\1/"` + i=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \ + sed "s/.*\<interface.*target dev='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + if [ "x${i}x" == "x${ifname}x" ] && [ "x${f}x" == "x${nwfilter}x" ]; then + return 0 + fi + + return 1 +} + + +function main() { + local prgname="$0" + local ifname="${ORIG_IFNAME}" + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms + local filtername="testcase" + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --ifname|-i) shift 1; ifname="$1";; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + if [ `uname` != "Linux" ]; then + echo "This script will only run on Linux." + exit 1; + fi + + vms=`${VIRSH} list | grep running | gawk '{print $2}'` + if [ "x${vms}x" == "xx" ]; then + echo "Error: Need a running VM." + exit 1; + fi + + for vm in ${vms}; do + checkVM "${vm}" "${ifname}" "${filtername}" + if [ $? -eq 0 ]; then + found=1; + break; + fi + done + + if [ ${found} -eq 0 ]; then + echo "Error: Suitable VM seems not to be running. Check the help screen"; + echo "to (--help) to read about requirements to the running VM."; + exit 1; + fi + + runTests "${ifname}" "${xmldir}" "${fwalldir}" +} + +main "$@" Index: libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,14 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,16 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21 +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21 +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21 +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21 +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -114,6 +114,10 @@ mymain(int argc, char **argv) DO_TEST("ref-test"); DO_TEST("ref-rule-test"); + DO_TEST("ipt-no-macspoof-test"); + DO_TEST("icmp-direction-test"); + DO_TEST("icmp-direction2-test"); + DO_TEST("icmp-direction3-test"); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout' priority='500'> + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + <rule action='drop' direction='in' priority='500'> + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,12 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/Makefile.am =================================================================== --- libvirt-acl.orig/tests/Makefile.am +++ libvirt-acl/tests/Makefile.am @@ -74,7 +74,9 @@ EXTRA_DIST = \ xml2vmxdata \ nwfilterxml2xmlout \ nwfilterxml2xmlin \ + nwfilterxml2fwallout \ nwfilterschematest \ + nwfiltervmtest.sh \ $(patsubst %,qemuhelpdata/%,$(qemuhelpdata)) noinst_PROGRAMS = virshtest conftest \

4 7

[libvirt] [PATCH] nwfilter: More XML parser test cases
by Stefan Berger 09 Apr '10

09 Apr '10

This patch adds a couple more nwfilter test cases for the XML parser tests. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -114,6 +114,10 @@ mymain(int argc, char **argv) DO_TEST("ref-test"); DO_TEST("ref-rule-test"); + DO_TEST("ipt-no-macspoof-test"); + DO_TEST("icmp-direction-test"); + DO_TEST("icmp-direction2-test"); + DO_TEST("icmp-direction3-test"); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout' priority='500'> + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + <rule action='drop' direction='in' priority='500'> + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter>

2 1

[libvirt] Domain not stable while created...
by Sankamesh 09 Apr '10

09 Apr '10

Hello Thanks for the reply. Now I use virsh -c "xen:///" define libvirt-ttylinux.xml (domain is created) and "virsh start ttyimage" the image starts and shuts down immediately. This time I can view the domain even after the shut down. So is there any reason for the image being shutdown immediately? What else should I check?? Thanks in advance. ________________________________ > Hello, > > I am using Scientific Linux 5.4 and xen. I want to deploy a sample ttyimage by creating a domain using virsh create. > > My configuration file is : > ----------------------------------------------------------------------------------------------------- > <?xml version="1.0" encoding="utf-8"?> > <domain type='xen'> > <name>ttyimage</name> > <os> > <type>linux</type> > <kernel>/boot/vmlinuz-2.6.18-164.2.1.el5xen</kernel> > </os> > <memory>65536</memory> > <vcpu>1</vcpu> > <on_poweroff>destroy</on_poweroff> > <on_reboot>restart</on_reboot> > <on_crash>destroy</on_crash> > <devices> > <graphics type='vnc' port='5900'/> > <disk type='file'> > <source file='/usr/local/ttylinux-xen-libvirt/ttylinux-xen.img' /> > <target dev='sda' /> > </disk> > <interface type='bridge'> > <source bridge='virbr0' /> > <mac address='00:1d:60:ec:ae:1c' /> > <target dev='testnimb-0' /> > </interface> > </devices> > </domain> > ------------------------------------------------------------------------------------------------------- > > when I use "virsh -c "xen:///" create libvirt-ttylinux.xml " to create a domain, the domain is crated and i can view the image (in paused mode) using the virt-manager. and when I resume the image it ,disappears (domain gets destroyed) after nearly 10 seconds..... > Further when I use vncviewer localhost::5900 when the image is running (during the 10 sec) ,i can view the console. But it closes once the domain is destroyed. > > Can someone explain why the image is not stable??? how can I make the domain to be stable???? > > Thanks in advance Using 'virsh create guest.xml' cmds can simply activate the guest, which only exist active domain instead of define domain, and the guest will disappear if it isn't in define domain and you carry out some operations, e.g. 'destroy' or 'shutdown' or 'save' etc. so you should correctly use virsh cmds: FYI, virsh -c xen:/// define libvirt-ttylinux.xml virsh start guestname Alex Send free SMS to your Friends on Mobile from your Yahoo! Messenger. Download Now! http://messenger.yahoo.com/download.php

1 0

[libvirt] [PATCH] Remove undefined symbols from symbols file
by Matthias Bolte 09 Apr '10

09 Apr '10

--- src/libvirt_private.syms | 7 +------ 1 files changed, 1 insertions(+), 6 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 814e2d8..b76f2da 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -209,7 +209,6 @@ virDomainTimerModeTypeFromString; virDomainSnapshotObjListGetNames; virDomainSnapshotObjListNum; virDomainSnapshotFindByName; -virDomainSnapshotObjListAdd; virDomainSnapshotObjListRemove; virDomainSnapshotHasChildren; virDomainSnapshotObjUnref; @@ -516,11 +515,7 @@ virNWFilterInstantiateFilter; virNWFilterTeardownFilter; -#nwfilter_learnipaddr.h -ipAddressMap; -ipAddressMapLock; -pendingLearnReq; -pendingLearnReqLock; +# nwfilter_learnipaddr.h virNWFilterGetIpAddrForIfname; virNWFilterDelIpAddrForIfname; virNWFilterLookupLearnReq; -- 1.6.3.3

2 2

[libvirt] [PATCH] esx: Add domain snapshot support
by Matthias Bolte 09 Apr '10

09 Apr '10

Fix invalid code generating in esx_vi_generator.py regarding deep copy types that contain enum properties. Add strptime and timegm to bootstrap.conf. Both are used to convert a xsd:dateTime to calendar time. --- bootstrap.conf | 2 + src/esx/esx_driver.c | 468 +++++++++++++++++++++++++++++++++++++--- src/esx/esx_vi.c | 290 +++++++++++++++++++++++++ src/esx/esx_vi.h | 27 +++ src/esx/esx_vi_generator.input | 12 + src/esx/esx_vi_generator.py | 25 ++- src/esx/esx_vi_methods.c | 86 ++++++++ src/esx/esx_vi_methods.h | 14 ++ src/esx/esx_vi_types.c | 99 +++++++++ src/esx/esx_vi_types.h | 12 + 10 files changed, 990 insertions(+), 45 deletions(-) diff --git a/bootstrap.conf b/bootstrap.conf index ac2f8e6..ca9332d 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -52,9 +52,11 @@ stpcpy strchrnul strndup strerror +strptime strsep sys_stat time_r +timegm useless-if-before-free vasprintf verify diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index eb06555..5272654 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -563,6 +563,7 @@ esxClose(virConnectPtr conn) esxVI_Logout(priv->host) < 0) { result = -1; } + esxVI_Context_Free(&priv->host); if (priv->vCenter != NULL) { @@ -570,6 +571,7 @@ esxClose(virConnectPtr conn) esxVI_Logout(priv->vCenter) < 0) { result = -1; } + esxVI_Context_Free(&priv->vCenter); } @@ -1742,23 +1744,8 @@ esxDomainGetInfo(virDomainPtr domain, virDomainInfoPtr info) goto failure; } - switch (powerState) { - case esxVI_VirtualMachinePowerState_PoweredOff: - info->state = VIR_DOMAIN_SHUTOFF; - break; - - case esxVI_VirtualMachinePowerState_PoweredOn: - info->state = VIR_DOMAIN_RUNNING; - break; - - case esxVI_VirtualMachinePowerState_Suspended: - info->state = VIR_DOMAIN_PAUSED; - break; - - default: - info->state = VIR_DOMAIN_NOSTATE; - break; - } + info->state = esxVI_VirtualMachinePowerState_ConvertToLibvirt + (powerState); } else if (STREQ(dynamicProperty->name, "config.hardware.memoryMB")) { if (esxVI_AnyType_ExpectType(dynamicProperty->val, esxVI_Type_Int) < 0) { @@ -2329,7 +2316,6 @@ esxListDefinedDomains(virConnectPtr conn, char **const names, int maxnames) count = -1; goto cleanup; - } @@ -3308,6 +3294,418 @@ esxDomainIsPersistent(virDomainPtr domain ATTRIBUTE_UNUSED) +static virDomainSnapshotPtr +esxDomainSnapshotCreateXML(virDomainPtr domain, const char *xmlDesc, + unsigned int flags ATTRIBUTE_UNUSED) +{ + esxPrivate *priv = domain->conn->privateData; + virDomainSnapshotDefPtr def = NULL; + esxVI_ObjectContent *virtualMachine = NULL; + esxVI_VirtualMachineSnapshotTree *rootSnapshotList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL; + esxVI_ManagedObjectReference *task = NULL; + esxVI_TaskInfoState taskInfoState; + virDomainSnapshotPtr snapshot = NULL; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + def = virDomainSnapshotDefParseString(xmlDesc, 1); + + if (def == NULL) { + goto failure; + } + + if (esxVI_LookupVirtualMachineByUuidAndPrepareForTask + (priv->host, domain->uuid, NULL, &virtualMachine, + priv->autoAnswer) < 0 || + esxVI_LookupRootSnapshotTreeList(priv->host, domain->uuid, + &rootSnapshotList) < 0 || + esxVI_GetSnapshotTreeByName(rootSnapshotList, def->name, + &snapshotTree, &snapshotTreeParent, + esxVI_Occurrence_OptionalItem) < 0) { + goto failure; + } + + if (snapshotTree != NULL) { + ESX_ERROR(VIR_ERR_OPERATION_INVALID, + _("Snapshot '%s' already exists"), def->name); + goto failure; + } + + if (esxVI_CreateSnapshot_Task(priv->host, virtualMachine->obj, + def->name, def->description, + esxVI_Boolean_True, + esxVI_Boolean_False, &task) < 0 || + esxVI_WaitForTaskCompletion(priv->host, task, domain->uuid, + priv->autoAnswer, &taskInfoState) < 0) { + goto failure; + } + + if (taskInfoState != esxVI_TaskInfoState_Success) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Could not create snapshot")); + goto failure; + } + + snapshot = virGetDomainSnapshot(domain, def->name); + + cleanup: + virDomainSnapshotDefFree(def); + esxVI_ObjectContent_Free(&virtualMachine); + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotList); + esxVI_ManagedObjectReference_Free(&task); + + return snapshot; + + failure: + domain = NULL; + + goto cleanup; +} + + + +static char * +esxDomainSnapshotDumpXML(virDomainSnapshotPtr snapshot, + unsigned int flags ATTRIBUTE_UNUSED) +{ + esxPrivate *priv = snapshot->domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL; + virDomainSnapshotDef def; + char uuid_string[VIR_UUID_STRING_BUFLEN] = ""; + char *xml = NULL; + + memset(&def, 0, sizeof (virDomainSnapshotDef)); + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, snapshot->domain->uuid, + &rootSnapshotList) < 0 || + esxVI_GetSnapshotTreeByName(rootSnapshotList, snapshot->name, + &snapshotTree, &snapshotTreeParent, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + def.name = snapshot->name; + def.description = snapshotTree->description; + def.parent = snapshotTreeParent != NULL ? snapshotTreeParent->name : NULL; + + if (esxVI_DateTime_ConvertToCalendarTime(snapshotTree->createTime, + &def.creationTime) < 0) { + goto failure; + } + + def.state = esxVI_VirtualMachinePowerState_ConvertToLibvirt + (snapshotTree->state); + + virUUIDFormat(snapshot->domain->uuid, uuid_string); + + xml = virDomainSnapshotDefFormat(uuid_string, &def, 0); + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotList); + + return xml; + + failure: + VIR_FREE(xml); + + goto cleanup; +} + + + +static int +esxDomainSnapshotNum(virDomainPtr domain, unsigned int flags ATTRIBUTE_UNUSED) +{ + int result = 0; + esxPrivate *priv = domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, domain->uuid, + &rootSnapshotTreeList) < 0) { + goto failure; + } + + result = esxVI_GetNumberOfSnapshotTrees(rootSnapshotTreeList); + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotTreeList); + + return result; + + failure: + result = -1; + + goto cleanup; +} + + + +static int +esxDomainSnapshotListNames(virDomainPtr domain, char **names, int nameslen, + unsigned int flags ATTRIBUTE_UNUSED) +{ + int result = 0; + esxPrivate *priv = domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL; + + if (names == NULL || nameslen < 0) { + ESX_ERROR(VIR_ERR_INVALID_ARG, "%s", _("Invalid argument")); + return -1; + } + + if (nameslen == 0) { + return 0; + } + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, domain->uuid, + &rootSnapshotTreeList) < 0) { + goto failure; + } + + result = esxVI_GetSnapshotTreeNames(rootSnapshotTreeList, names, nameslen); + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotTreeList); + + return result; + + failure: + result = -1; + + goto cleanup; +} + + + +static virDomainSnapshotPtr +esxDomainSnapshotLookupByName(virDomainPtr domain, const char *name, + unsigned int flags ATTRIBUTE_UNUSED) +{ + esxPrivate *priv = domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL; + virDomainSnapshotPtr snapshot = NULL; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, domain->uuid, + &rootSnapshotTreeList) < 0 || + esxVI_GetSnapshotTreeByName(rootSnapshotTreeList, name, &snapshotTree, + &snapshotTreeParent, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + snapshot = virGetDomainSnapshot(domain, name); + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotTreeList); + + return snapshot; + + failure: + snapshot = NULL; + + goto cleanup; +} + + + +static int +esxDomainHasCurrentSnapshot(virDomainPtr domain, + unsigned int flags ATTRIBUTE_UNUSED) +{ + int result = 0; + esxPrivate *priv = domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *currentSnapshotTree = NULL; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupCurrentSnapshotTree(priv->host, domain->uuid, + &currentSnapshotTree, + esxVI_Occurrence_OptionalItem) < 0) { + goto failure; + } + + if (currentSnapshotTree != NULL) { + result = 1; + } + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&currentSnapshotTree); + + return result; + + failure: + result = -1; + + goto cleanup; +} + + + +static virDomainSnapshotPtr +esxDomainSnapshotCurrent(virDomainPtr domain, + unsigned int flags ATTRIBUTE_UNUSED) +{ + + virDomainSnapshotPtr snapshot = NULL; + esxPrivate *priv = domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *currentSnapshotTree = NULL; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupCurrentSnapshotTree(priv->host, domain->uuid, + &currentSnapshotTree, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + snapshot = virGetDomainSnapshot(domain, currentSnapshotTree->name); + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&currentSnapshotTree); + + return snapshot; + + failure: + snapshot = NULL; + + goto cleanup; +} + + + +static int +esxDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, + unsigned int flags ATTRIBUTE_UNUSED) +{ + int result = 0; + esxPrivate *priv = snapshot->domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL; + esxVI_ManagedObjectReference *task = NULL; + esxVI_TaskInfoState taskInfoState; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, snapshot->domain->uuid, + &rootSnapshotList) < 0 || + esxVI_GetSnapshotTreeByName(rootSnapshotList, snapshot->name, + &snapshotTree, &snapshotTreeParent, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + if (esxVI_RevertToSnapshot_Task(priv->host, snapshotTree->snapshot, NULL, + &task) < 0 || + esxVI_WaitForTaskCompletion(priv->host, task, snapshot->domain->uuid, + priv->autoAnswer, &taskInfoState) < 0) { + goto failure; + } + + if (taskInfoState != esxVI_TaskInfoState_Success) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("Could not revert to snapshot '%s'"), snapshot->name); + goto failure; + } + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotList); + esxVI_ManagedObjectReference_Free(&task); + + return result; + + failure: + result = -1; + + goto cleanup; +} + + + +static int +esxDomainSnapshotDelete(virDomainSnapshotPtr snapshot, unsigned int flags) +{ + int result = 0; + esxPrivate *priv = snapshot->domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL; + esxVI_Boolean removeChildren = esxVI_Boolean_False; + esxVI_ManagedObjectReference *task = NULL; + esxVI_TaskInfoState taskInfoState; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (flags & VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN) { + removeChildren = esxVI_Boolean_True; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, snapshot->domain->uuid, + &rootSnapshotList) < 0 || + esxVI_GetSnapshotTreeByName(rootSnapshotList, snapshot->name, + &snapshotTree, &snapshotTreeParent, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + if (esxVI_RemoveSnapshot_Task(priv->host, snapshotTree->snapshot, + removeChildren, &task) < 0 || + esxVI_WaitForTaskCompletion(priv->host, task, snapshot->domain->uuid, + priv->autoAnswer, &taskInfoState) < 0) { + goto failure; + } + + if (taskInfoState != esxVI_TaskInfoState_Success) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("Could not delete snapshot '%s'"), snapshot->name); + goto failure; + } + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotList); + esxVI_ManagedObjectReference_Free(&task); + + return result; + + failure: + result = -1; + + goto cleanup; +} + + + static virDriver esxDriver = { VIR_DRV_ESX, "ESX", @@ -3388,23 +3786,23 @@ static virDriver esxDriver = { esxDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ - NULL, /* domainGetJobInfo */ - NULL, /* domainAbortJob */ - NULL, /* domainMigrateSetMaxDowntime */ - NULL, /* domainEventRegisterAny */ - NULL, /* domainEventDeregisterAny */ - NULL, /* domainManagedSave */ - NULL, /* domainHasManagedSaveImage */ - NULL, /* domainManagedSaveRemove */ - NULL, /* domainSnapshotCreateXML */ - NULL, /* domainSnapshotDumpXML */ - NULL, /* domainSnapshotNum */ - NULL, /* domainSnapshotListNames */ - NULL, /* domainSnapshotLookupByName */ - NULL, /* domainHasCurrentSnapshot */ - NULL, /* domainSnapshotCurrent */ - NULL, /* domainRevertToSnapshot */ - NULL, /* domainSnapshotDelete */ + NULL, /* domainGetJobInfo */ + NULL, /* domainAbortJob */ + NULL, /* domainMigrateSetMaxDowntime */ + NULL, /* domainEventRegisterAny */ + NULL, /* domainEventDeregisterAny */ + NULL, /* domainManagedSave */ + NULL, /* domainHasManagedSaveImage */ + NULL, /* domainManagedSaveRemove */ + esxDomainSnapshotCreateXML, /* domainSnapshotCreateXML */ + esxDomainSnapshotDumpXML, /* domainSnapshotDumpXML */ + esxDomainSnapshotNum, /* domainSnapshotNum */ + esxDomainSnapshotListNames, /* domainSnapshotListNames */ + esxDomainSnapshotLookupByName, /* domainSnapshotLookupByName */ + esxDomainHasCurrentSnapshot, /* domainHasCurrentSnapshot */ + esxDomainSnapshotCurrent, /* domainSnapshotCurrent */ + esxDomainRevertToSnapshot, /* domainRevertToSnapshot */ + esxDomainSnapshotDelete, /* domainSnapshotDelete */ }; diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index c37dfa1..eb5371d 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -1719,6 +1719,152 @@ esxVI_GetVirtualMachineIdentity(esxVI_ObjectContent *virtualMachine, int +esxVI_GetNumberOfSnapshotTrees + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList) +{ + int count = 0; + esxVI_VirtualMachineSnapshotTree *snapshotTree; + + for (snapshotTree = snapshotTreeList; snapshotTree != NULL; + snapshotTree = snapshotTree->_next) { + count += 1 + esxVI_GetNumberOfSnapshotTrees + (snapshotTree->childSnapshotList); + } + + return count; +} + + + +int +esxVI_GetSnapshotTreeNames(esxVI_VirtualMachineSnapshotTree *snapshotTreeList, + char **names, int nameslen) +{ + int count = 0; + int result; + int i; + esxVI_VirtualMachineSnapshotTree *snapshotTree; + + for (snapshotTree = snapshotTreeList; + snapshotTree != NULL && count < nameslen; + snapshotTree = snapshotTree->_next) { + names[count] = strdup(snapshotTree->name); + + if (names[count] == NULL) { + virReportOOMError(); + goto failure; + } + + count++; + + if (count >= nameslen) { + break; + } + + result = esxVI_GetSnapshotTreeNames(snapshotTree->childSnapshotList, + names + count, nameslen - count); + + if (result < 0) { + goto failure; + } + + count += result; + } + + return count; + + failure: + for (i = 0; i < count; ++i) { + VIR_FREE(names[i]); + } + + return -1; +} + + + +int +esxVI_GetSnapshotTreeByName + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList, const char *name, + esxVI_VirtualMachineSnapshotTree **snapshotTree, + esxVI_VirtualMachineSnapshotTree **snapshotTreeParent, + esxVI_Occurrence occurrence) +{ + esxVI_VirtualMachineSnapshotTree *candidate; + + if (snapshotTree == NULL || *snapshotTree != NULL || + snapshotTreeParent == NULL || *snapshotTreeParent != NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + for (candidate = snapshotTreeList; candidate != NULL; + candidate = candidate->_next) { + if (STREQ(candidate->name, name)) { + *snapshotTree = candidate; + *snapshotTreeParent = NULL; + return 1; + } + + if (esxVI_GetSnapshotTreeByName(candidate->childSnapshotList, name, + snapshotTree, snapshotTreeParent, + occurrence) > 0) { + if (*snapshotTreeParent == NULL) { + *snapshotTreeParent = candidate; + } + + return 1; + } + } + + if (occurrence == esxVI_Occurrence_OptionalItem) { + return 0; + } else { + ESX_VI_ERROR(VIR_ERR_NO_DOMAIN_SNAPSHOT, + _("Could not find snapshot with name '%s'"), name); + + return -1; + } +} + + + +int +esxVI_GetSnapshotTreeBySnapshot + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList, + esxVI_ManagedObjectReference *snapshot, + esxVI_VirtualMachineSnapshotTree **snapshotTree) +{ + esxVI_VirtualMachineSnapshotTree *candidate; + + if (snapshotTree == NULL || *snapshotTree != NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + for (candidate = snapshotTreeList; candidate != NULL; + candidate = candidate->_next) { + if (STREQ(candidate->snapshot->value, snapshot->value)) { + *snapshotTree = candidate; + return 0; + } + + if (esxVI_GetSnapshotTreeBySnapshot(candidate->childSnapshotList, + snapshot, snapshotTree) >= 0) { + return 0; + } + } + + ESX_VI_ERROR(VIR_ERR_NO_DOMAIN_SNAPSHOT, + _("Could not find domain snapshot with internal name '%s'"), + snapshot->value); + + return -1; +} + + + +int esxVI_LookupResourcePoolByHostSystem (esxVI_Context *ctx, esxVI_ObjectContent *hostSystem, esxVI_ManagedObjectReference **resourcePool) @@ -2336,6 +2482,150 @@ esxVI_LookupAndHandleVirtualMachineQuestion(esxVI_Context *ctx, int +esxVI_LookupRootSnapshotTreeList + (esxVI_Context *ctx, const unsigned char *virtualMachineUuid, + esxVI_VirtualMachineSnapshotTree **rootSnapshotTreeList) +{ + int result = 0; + esxVI_String *propertyNameList = NULL; + esxVI_ObjectContent *virtualMachine = NULL; + esxVI_DynamicProperty *dynamicProperty = NULL; + + if (rootSnapshotTreeList == NULL || *rootSnapshotTreeList != NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + if (esxVI_String_AppendValueToList(&propertyNameList, + "snapshot.rootSnapshotList") < 0 || + esxVI_LookupVirtualMachineByUuid(ctx, virtualMachineUuid, + propertyNameList, &virtualMachine, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + for (dynamicProperty = virtualMachine->propSet; dynamicProperty != NULL; + dynamicProperty = dynamicProperty->_next) { + if (STREQ(dynamicProperty->name, "snapshot.rootSnapshotList")) { + if (esxVI_VirtualMachineSnapshotTree_CastListFromAnyType + (dynamicProperty->val, rootSnapshotTreeList) < 0) { + goto failure; + } + + break; + } else { + VIR_WARN("Unexpected '%s' property", dynamicProperty->name); + } + } + + if (*rootSnapshotTreeList == NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("Could not lookup root snapshot list")); + goto failure; + } + + cleanup: + esxVI_String_Free(&propertyNameList); + esxVI_ObjectContent_Free(&virtualMachine); + + return result; + + failure: + esxVI_VirtualMachineSnapshotTree_Free(rootSnapshotTreeList); + + result = -1; + + goto cleanup; +} + + + +int +esxVI_LookupCurrentSnapshotTree + (esxVI_Context *ctx, const unsigned char *virtualMachineUuid, + esxVI_VirtualMachineSnapshotTree **currentSnapshotTree, + esxVI_Occurrence occurrence) +{ + int result = 0; + esxVI_String *propertyNameList = NULL; + esxVI_ObjectContent *virtualMachine = NULL; + esxVI_DynamicProperty *dynamicProperty = NULL; + esxVI_ManagedObjectReference *currentSnapshot = NULL; + esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + + if (currentSnapshotTree == NULL || *currentSnapshotTree != NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + if (esxVI_String_AppendValueListToList(&propertyNameList, + "snapshot.currentSnapshot\0" + "snapshot.rootSnapshotList\0") < 0 || + esxVI_LookupVirtualMachineByUuid(ctx, virtualMachineUuid, + propertyNameList, &virtualMachine, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + for (dynamicProperty = virtualMachine->propSet; dynamicProperty != NULL; + dynamicProperty = dynamicProperty->_next) { + if (STREQ(dynamicProperty->name, "snapshot.currentSnapshot")) { + if (esxVI_ManagedObjectReference_CastFromAnyType + (dynamicProperty->val, &currentSnapshot) < 0) { + goto failure; + } + } else if (STREQ(dynamicProperty->name, "snapshot.rootSnapshotList")) { + if (esxVI_VirtualMachineSnapshotTree_CastListFromAnyType + (dynamicProperty->val, &rootSnapshotTreeList) < 0) { + goto failure; + } + } else { + VIR_WARN("Unexpected '%s' property", dynamicProperty->name); + } + } + + if (currentSnapshot == NULL) { + if (occurrence == esxVI_Occurrence_OptionalItem) { + return 0; + } else { + ESX_VI_ERROR(VIR_ERR_NO_DOMAIN_SNAPSHOT, "%s", + _("Domain has no current snapshot")); + goto failure; + } + } + + if (rootSnapshotTreeList == NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("Could not lookup root snapshot list")); + goto failure; + } + + if (esxVI_GetSnapshotTreeBySnapshot(rootSnapshotTreeList, currentSnapshot, + &snapshotTree) < 0 || + esxVI_VirtualMachineSnapshotTree_DeepCopy(currentSnapshotTree, + snapshotTree) < 0) { + goto failure; + } + + cleanup: + esxVI_String_Free(&propertyNameList); + esxVI_ObjectContent_Free(&virtualMachine); + esxVI_ManagedObjectReference_Free(&currentSnapshot); + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotTreeList); + + return result; + + failure: + + result = -1; + + goto cleanup; +} + + + +int esxVI_HandleVirtualMachineQuestion (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachine, esxVI_VirtualMachineQuestionInfo *questionInfo, diff --git a/src/esx/esx_vi.h b/src/esx/esx_vi.h index 9b65e85..a8d4cc3 100644 --- a/src/esx/esx_vi.h +++ b/src/esx/esx_vi.h @@ -233,6 +233,24 @@ int esxVI_LookupNumberOfDomainsByPowerState int esxVI_GetVirtualMachineIdentity(esxVI_ObjectContent *virtualMachine, int *id, char **name, unsigned char *uuid); +int esxVI_GetNumberOfSnapshotTrees + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList); + +int esxVI_GetSnapshotTreeNames + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList, char **names, + int nameslen); + +int esxVI_GetSnapshotTreeByName + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList, const char *name, + esxVI_VirtualMachineSnapshotTree **snapshotTree, + esxVI_VirtualMachineSnapshotTree **snapshotTreeParent, + esxVI_Occurrence occurrence); + +int esxVI_GetSnapshotTreeBySnapshot + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList, + esxVI_ManagedObjectReference *snapshot, + esxVI_VirtualMachineSnapshotTree **snapshotTree); + int esxVI_LookupResourcePoolByHostSystem (esxVI_Context *ctx, esxVI_ObjectContent *hostSystem, esxVI_ManagedObjectReference **resourcePool); @@ -274,6 +292,15 @@ int esxVI_LookupAndHandleVirtualMachineQuestion(esxVI_Context *ctx, const unsigned char *uuid, esxVI_Boolean autoAnswer); +int esxVI_LookupRootSnapshotTreeList + (esxVI_Context *ctx, const unsigned char *virtualMachineUuid, + esxVI_VirtualMachineSnapshotTree **rootSnapshotTreeList); + +int esxVI_LookupCurrentSnapshotTree + (esxVI_Context *ctx, const unsigned char *virtualMachineUuid, + esxVI_VirtualMachineSnapshotTree **currentSnapshotTree, + esxVI_Occurrence occurrence); + int esxVI_HandleVirtualMachineQuestion (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachine, diff --git a/src/esx/esx_vi_generator.input b/src/esx/esx_vi_generator.input index 06dddbf..9c545eb 100644 --- a/src/esx/esx_vi_generator.input +++ b/src/esx/esx_vi_generator.input @@ -424,3 +424,15 @@ object VirtualMachineQuestionInfo ChoiceOption choice r VirtualMachineMessage message i end + + +object VirtualMachineSnapshotTree + ManagedObjectReference snapshot r + ManagedObjectReference vm r + String name r + String description r + DateTime createTime r + VirtualMachinePowerState state r + Boolean quiesced r + VirtualMachineSnapshotTree childSnapshotList ol +end diff --git a/src/esx/esx_vi_generator.py b/src/esx/esx_vi_generator.py index 5ca6138..b933d5b 100755 --- a/src/esx/esx_vi_generator.py +++ b/src/esx/esx_vi_generator.py @@ -95,6 +95,8 @@ class Property: return " ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY_LIST(%s, %s)\n" % (self.type, self.name) elif self.type == "String": return " ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY_VALUE(String, %s)\n" % self.name + elif self.is_enum(): + return " (*dest)->%s = src->%s;\n" % (self.name, self.name) else: return " ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY(%s, %s)\n" % (self.type, self.name) @@ -841,17 +843,19 @@ additional_object_features = { "Event" : Object.FEATURE__LI "SharesInfo" : Object.FEATURE__ANY_TYPE, "TaskInfo" : Object.FEATURE__ANY_TYPE | Object.FEATURE__LIST, "UserSession" : Object.FEATURE__ANY_TYPE, - "VirtualMachineQuestionInfo" : Object.FEATURE__ANY_TYPE } + "VirtualMachineQuestionInfo" : Object.FEATURE__ANY_TYPE, + "VirtualMachineSnapshotTree" : Object.FEATURE__DEEP_COPY | Object.FEATURE__ANY_TYPE } -removed_object_features = { "DynamicProperty" : Object.FEATURE__SERIALIZE, - "ObjectContent" : Object.FEATURE__SERIALIZE, - "ObjectUpdate" : Object.FEATURE__SERIALIZE, - "PropertyChange" : Object.FEATURE__SERIALIZE, - "PropertyFilterUpdate" : Object.FEATURE__SERIALIZE, - "TaskInfo" : Object.FEATURE__SERIALIZE, - "UpdateSet" : Object.FEATURE__SERIALIZE, - "VirtualMachineConfigInfo" : Object.FEATURE__SERIALIZE } +removed_object_features = { "DynamicProperty" : Object.FEATURE__SERIALIZE, + "ObjectContent" : Object.FEATURE__SERIALIZE, + "ObjectUpdate" : Object.FEATURE__SERIALIZE, + "PropertyChange" : Object.FEATURE__SERIALIZE, + "PropertyFilterUpdate" : Object.FEATURE__SERIALIZE, + "TaskInfo" : Object.FEATURE__SERIALIZE, + "UpdateSet" : Object.FEATURE__SERIALIZE, + "VirtualMachineConfigInfo" : Object.FEATURE__SERIALIZE, + "VirtualMachineSnapshotTree" : Object.FEATURE__SERIALIZE } @@ -948,7 +952,8 @@ for obj in objects_by_name.values(): if obj.features & Object.FEATURE__DEEP_COPY: for property in obj.properties: if property.occurrence != Property.OCCURRENCE__IGNORED and \ - property.type not in predefined_objects: + property.type not in predefined_objects and \ + property.type in objects_by_name: objects_by_name[property.type].features |= Object.FEATURE__DEEP_COPY # detect extended_by relation diff --git a/src/esx/esx_vi_methods.c b/src/esx/esx_vi_methods.c index 3e095c7..b2b3e8d 100644 --- a/src/esx/esx_vi_methods.c +++ b/src/esx/esx_vi_methods.c @@ -491,6 +491,92 @@ ESX_VI__METHOD(RegisterVM_Task, +/* esxVI_CreateSnapshot_Task */ +ESX_VI__METHOD(CreateSnapshot_Task, + (esxVI_Context *ctx, + esxVI_ManagedObjectReference *virtualMachine, + const char *name, const char *description, + esxVI_Boolean memory, esxVI_Boolean quiesce, + esxVI_ManagedObjectReference **task), + RequiredItem, +{ + ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) +}, +{ + ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) + ESX_VI__METHOD__PARAMETER__REQUIRE(name) + ESX_VI__METHOD__PARAMETER__REQUIRE(memory) + ESX_VI__METHOD__PARAMETER__REQUIRE(quiesce) +}, +{ + ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, + virtualMachine) + ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, name) + ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, description) + ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, memory) + ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, quiesce) +}, +{ + if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { + goto failure; + } +}) + + + +/* esxVI_RevertToSnapshot_Task */ +ESX_VI__METHOD(RevertToSnapshot_Task, + (esxVI_Context *ctx, + esxVI_ManagedObjectReference *virtualMachineSnapshot, + esxVI_ManagedObjectReference *host, + esxVI_ManagedObjectReference **task), + RequiredItem, +{ + ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) +}, +{ + ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachineSnapshot) +}, +{ + ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, + virtualMachineSnapshot) + ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, host) +}, +{ + if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { + goto failure; + } +}) + + + +/* esxVI_RemoveSnapshot_Task */ +ESX_VI__METHOD(RemoveSnapshot_Task, + (esxVI_Context *ctx, + esxVI_ManagedObjectReference *virtualMachineSnapshot, + esxVI_Boolean removeChildren, + esxVI_ManagedObjectReference **task), + RequiredItem, +{ + ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) +}, +{ + ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachineSnapshot) + ESX_VI__METHOD__PARAMETER__REQUIRE(removeChildren) +}, +{ + ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, + virtualMachineSnapshot) + ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, removeChildren) +}, +{ + if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { + goto failure; + } +}) + + + /* esxVI_CancelTask */ ESX_VI__METHOD(CancelTask, (esxVI_Context *ctx, diff --git a/src/esx/esx_vi_methods.h b/src/esx/esx_vi_methods.h index 40bff51..9ff8b4b 100644 --- a/src/esx/esx_vi_methods.h +++ b/src/esx/esx_vi_methods.h @@ -80,6 +80,20 @@ int esxVI_RegisterVM_Task(esxVI_Context *ctx, esxVI_ManagedObjectReference *host, esxVI_ManagedObjectReference **task); +int esxVI_CreateSnapshot_Task(esxVI_Context *ctx, + esxVI_ManagedObjectReference *virtualMachine, + const char *name, const char *description, + esxVI_Boolean memory, esxVI_Boolean quiesce, + esxVI_ManagedObjectReference **task); + +int esxVI_RevertToSnapshot_Task + (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachineSnapshot, + esxVI_ManagedObjectReference *host, esxVI_ManagedObjectReference **task); + +int esxVI_RemoveSnapshot_Task + (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachineSnapshot, + esxVI_Boolean removeChildren, esxVI_ManagedObjectReference **task); + int esxVI_CancelTask(esxVI_Context *ctx, esxVI_ManagedObjectReference *task); int esxVI_UnregisterVM(esxVI_Context *ctx, diff --git a/src/esx/esx_vi_types.c b/src/esx/esx_vi_types.c index a69ea44..40d8b9b 100644 --- a/src/esx/esx_vi_types.c +++ b/src/esx/esx_vi_types.c @@ -1177,6 +1177,12 @@ ESX_VI__TEMPLATE__VALIDATE(DateTime, ESX_VI__TEMPLATE__PROPERTY__REQUIRE(value); }) +/* esxVI_DateTime_DeepCopy */ +ESX_VI__TEMPLATE__DEEP_COPY(DateTime, +{ + ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY_VALUE(String, value) +}) + /* esxVI_DateTime_Serialize */ ESX_VI__TEMPLATE__SERIALIZE(DateTime, { @@ -1213,6 +1219,72 @@ esxVI_DateTime_Deserialize(xmlNodePtr node, esxVI_DateTime **dateTime) return -1; } +int +esxVI_DateTime_ConvertToCalendarTime(esxVI_DateTime *dateTime, + time_t *secondsSinceEpoch) +{ + char value[64] = ""; + char *tmp; + struct tm tm; + int milliseconds; + char sign; + int tz_hours; + int tz_minutes; + int tz_offset = 0; + + if (dateTime == NULL || secondsSinceEpoch == NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + if (virStrcpyStatic(value, dateTime->value) == NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, + _("xsd:dateTime value '%s' too long for destination"), + dateTime->value); + return -1; + } + + /* expected format: 2010-04-05T12:13:55.316789+02:00 */ + tmp = strptime(value, "%Y-%m-%dT%H:%M:%S", &tm); + + if (tmp == NULL || *tmp != '.' || + virStrToLong_i(tmp + 1, &tmp, 10, &milliseconds) < 0) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, + _("xsd:dateTime value '%s' has unexpected format"), + dateTime->value); + return -1; + } + + sign = *tmp; + + if ((sign != '+' && sign != '-') || + virStrToLong_i(tmp + 1, &tmp, 10, &tz_hours) < 0 || *tmp != ':' || + virStrToLong_i(tmp + 1, NULL, 10, &tz_minutes) < 0) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, + _("xsd:dateTime value '%s' has unexpected format"), + dateTime->value); + return -1; + } + + tz_offset = tz_hours * 60 * 60 + tz_minutes * 60; + + if (sign == '-') { + tz_offset = -tz_offset; + } + + /* + * xsd:dateTime represents local time relative to the timezone given + * as offset. pretend the local time is in UTC and use timegm in order + * to avoid interference with the timezone to this computer. + * apply timezone correction afterwards, because it's simpler than + * handling all the possible over- and underflows when trying to apply + * it to the tm struct. + */ + *secondsSinceEpoch = timegm(&tm) - tz_offset; + + return 0; +} + /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * @@ -1344,4 +1416,31 @@ esxVI_ManagedObjectReference_Deserialize return -1; } + + #include "esx_vi_types.generated.c" + + + +/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * + * VI Enum: VirtualMachinePowerState (Additions) + */ + +int +esxVI_VirtualMachinePowerState_ConvertToLibvirt + (esxVI_VirtualMachinePowerState powerState) +{ + switch (powerState) { + case esxVI_VirtualMachinePowerState_PoweredOff: + return VIR_DOMAIN_SHUTOFF; + + case esxVI_VirtualMachinePowerState_PoweredOn: + return VIR_DOMAIN_RUNNING; + + case esxVI_VirtualMachinePowerState_Suspended: + return VIR_DOMAIN_PAUSED; + + default: + return VIR_DOMAIN_NOSTATE; + } +} diff --git a/src/esx/esx_vi_types.h b/src/esx/esx_vi_types.h index d3c7115..4bedca9 100644 --- a/src/esx/esx_vi_types.h +++ b/src/esx/esx_vi_types.h @@ -230,9 +230,12 @@ struct _esxVI_DateTime { int esxVI_DateTime_Alloc(esxVI_DateTime **dateTime); void esxVI_DateTime_Free(esxVI_DateTime **dateTime); int esxVI_DateTime_Validate(esxVI_DateTime *dateTime); +int esxVI_DateTime_DeepCopy(esxVI_DateTime **dest, esxVI_DateTime *src); int esxVI_DateTime_Serialize(esxVI_DateTime *dateTime, const char *element, virBufferPtr output); int esxVI_DateTime_Deserialize(xmlNodePtr node, esxVI_DateTime **dateTime); +int esxVI_DateTime_ConvertToCalendarTime(esxVI_DateTime *dateTime, + time_t *secondsSinceEpoch); @@ -295,4 +298,13 @@ int esxVI_ManagedObjectReference_Deserialize # include "esx_vi_types.generated.h" + + +/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * + * VI Enum: VirtualMachinePowerState (Additions) + */ + +int esxVI_VirtualMachinePowerState_ConvertToLibvirt + (esxVI_VirtualMachinePowerState powerState); + #endif /* __ESX_VI_TYPES_H__ */ -- 1.6.3.3

2 2

[libvirt] [PATCH 0/15] Various MinGW/Windows fixes
by Matthias Bolte 09 Apr '10

09 Apr '10

This series fixes several MinGW compile problem on Windows. Most patches are about exported symbols or missing function bodies. There is also a gnulib issue with MinGW on Windows pending. Eric and I are working on a patch for it. Patches: 01/15 gnulib: Add usleep for MinGW builds 02/15 Make sure uid_t and gid_t are available 03/15 Export conditional state driver symbols only when they are defined 04/15 Remove interfaceRegister from libvirt_private.syms 05/15 Fix export of virConnectAuthPtrDefault for MinGW builds 06/15 Generate libvirt.def from libvirt.syms 07/15 virsh: Handle absence of SA_SIGINFO 08/15 Make sure virtTestCaptureProgramOutput has a body on Windows 09/15 util: Make some conditional symbols unconditional 10/15 bootstrap: Remove rsync from buildreq list 11/15 util: Handle lack of (f)chmod and (f)chown on Windows 12/15 bootstrap: Enable copy-mode for MinGW builds 13/15 util: Replace pciWaitForDeviceCleanup with a stub on Windows 14/15 Add HAVE_PTHREAD_H guard for pthread_sigmask 15/15 util: Add stubs for some functions on Windows Overall diffstat: bootstrap.conf | 8 ++- configure.ac | 17 +++++ docs/apibuild.py | 1 + include/libvirt/libvirt.h.in | 16 +++++- src/.gitignore | 1 + src/Makefile.am | 26 ++++++-- src/libvirt_daemon.syms | 10 +++ src/libvirt_private.syms | 9 --- src/remote/remote_driver.c | 6 ++ src/util/pci.c | 14 ++++ src/util/util.c | 135 ++++++++++++++++++++++++++++++++++++------ src/util/util.h | 4 - tests/testutils.c | 6 ++ tools/virsh.c | 4 + 14 files changed, 218 insertions(+), 39 deletions(-) Matthias

5 55

[libvirt] Problems accessing ESX using libvirt
by Matthew Booth 09 Apr '10

09 Apr '10

I was forwarded the following query relating to v2v: === There are no firewalls between the hosts and the ESX firewall is configured to allow all incoming & outgoing connections. The "virsh -c 'esx://elabhost011.xxx/' list --all" command also fails in the same way as the virt-v2v command. When I run the 'virsh list' command it doesn't prompt for a username/password as in the example below. If I run tcpdump on the ESX host, when 'virsh list' is run, I see the packet arrive from the test box and a reply sent back, only these two packets are sent between the hosts: 09:51:20.205524 bwyhs0020p.xxx.56436 > elabhost011.xxx.16514: S 338(0) win 5840 <mss 1460,sackOK,timestamp 1214177495 0,nop,wscale 7> (DF) 09:51:20.205544 elabhost011.xxx.16514 > bwyhs0020p.xxx.56436: R 0:9 win 0 (DF) The problem is there is nothing listening on port 16514 on the ESX host, hence the "Connection refused" message. Should the connection be using the TSL port as opposed to a 'ESX' port? === The user is using libvirt 0.6.3-20.1.el5_4. Unfortunately I'm not intimately familiar with how the libvirt ESX driver magic works. Can anybody shed any light? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat Engineering, Virtualisation Team M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

3 3

[libvirt] FYI: [PATCH] Fix unterminated B<...> in virsh man page
by Jiri Denemark 08 Apr '10

08 Apr '10

FYI, I've just pushed the following trivial fix: >From 7ea025aed0ff110bd7b5ab2037e04aa3205f2c13 Mon Sep 17 00:00:00 2001 Message-Id: <7ea025aed0ff110bd7b5ab2037e04aa3205f2c13.1270731158.git.jdenemar(a)redhat.com> From: Jiri Denemark <jdenemar(a)redhat.com> Date: Thu, 8 Apr 2010 14:44:48 +0200 Subject: [PATCH] Fix unterminated B<...> in virsh man page Mail-Followup-To: libvir-list(a)redhat.com --- tools/virsh.pod | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 9e9f4e0..1b5c1d6 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -312,7 +312,7 @@ Convert a domain name (or UUID) to a domain id Returns basic information about the domain. -=item B<domjobabort I<domain-id-or-uuid> +=item B<domjobabort> I<domain-id-or-uuid> Abort the currently running domain job. -- 1.7.0.4

2 1

[libvirt] [PATCH] Fix Win32 portability problems
by Daniel P. Berrange 08 Apr '10

08 Apr '10

The network filter / snapshot / hooks code introduced some non-portable pices that broke the win32 build * configure.ac: Check for net/ethernet.h required by nwfile config parsing code * src/conf/nwfilter_conf.c: Define ethernet protocol constants if net/ethernet.h is missing * src/util/hooks.c: Disable hooks build on Win32 since it lacks fork/exec/pipe * src/util/threads-win32.c: Fix unchecked return value * tools/virsh.c: Disable SIGPIPE on Win32 since it doesn't exist. Fix non-portable strftime() formats --- configure.ac | 2 +- src/conf/nwfilter_conf.c | 20 ++++++++++++++++++++ src/util/hooks.c | 16 ++++++++++++++++ src/util/threads-win32.c | 2 +- tools/virsh.c | 7 ++++++- 5 files changed, 44 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index e13961e..9a133e4 100644 --- a/configure.ac +++ b/configure.ac @@ -111,7 +111,7 @@ dnl Availability of various not common threadsafe functions AC_CHECK_FUNCS([strerror_r strtok_r getmntent_r getgrnam_r getpwuid_r]) dnl Availability of various common headers (non-fatal if missing). -AC_CHECK_HEADERS([pwd.h paths.h regex.h sys/syslimits.h sys/utsname.h sys/wait.h winsock2.h sched.h termios.h sys/poll.h syslog.h mntent.h]) +AC_CHECK_HEADERS([pwd.h paths.h regex.h sys/syslimits.h sys/utsname.h sys/wait.h winsock2.h sched.h termios.h sys/poll.h syslog.h mntent.h net/ethernet.h]) dnl Where are the XDR functions? dnl If portablexdr is installed, prefer that. diff --git a/src/conf/nwfilter_conf.c b/src/conf/nwfilter_conf.c index 16c1a25..0fe51e4 100644 --- a/src/conf/nwfilter_conf.c +++ b/src/conf/nwfilter_conf.c @@ -26,9 +26,13 @@ #include <config.h> +#include <sys/types.h> +#include <sys/stat.h> #include <fcntl.h> #include <dirent.h> +#if HAVE_NET_ETHERNET_H #include <net/ethernet.h> +#endif #include "internal.h" @@ -41,6 +45,22 @@ #include "domain_conf.h" +/* XXX + * The config parser/struts should not be using platform specific + * constants. Win32 lacks these constants, breaking the parser, + * so temporarily define them until this can be re-written to use + * locally defined enums for all consants + */ +#ifndef ETHERTYPE_IP +#define ETHERTYPE_IP 0x0800 +#endif +#ifndef ETHERTYPE_ARP +#define ETHERTYPE_ARP 0x0806 +#endif +#ifndef ETHERTYPE_IPV6 +#define ETHERTYPE_IPV6 0x86dd +#endif + #define VIR_FROM_THIS VIR_FROM_NWFILTER diff --git a/src/util/hooks.c b/src/util/hooks.c index 755679d..bcab4eb 100644 --- a/src/util/hooks.c +++ b/src/util/hooks.c @@ -24,7 +24,9 @@ #include <config.h> #include <sys/types.h> +#if HAVE_SYS_WAIT_H #include <sys/wait.h> +#endif #include <sys/stat.h> #include <unistd.h> #include <stdlib.h> @@ -188,6 +190,19 @@ virHookPresent(int driver) { * Returns: 0 if the execution succeeded, 1 if the script was not found or * invalid parameters, and -1 if script returned an error */ +#ifdef WIN32 +int +virHookCall(int driver ATTRIBUTE_UNUSED, + const char *id ATTRIBUTE_UNUSED, + int op ATTRIBUTE_UNUSED, + int sub_op ATTRIBUTE_UNUSED, + const char *extra ATTRIBUTE_UNUSED, + const char *input ATTRIBUTE_UNUSED) { + virReportSystemError(ENOSYS, "%s", + _("spawning hooks not supported on this platform")); + return -1; +} +#else int virHookCall(int driver, const char *id, int op, int sub_op, const char *extra, const char *input) { @@ -447,3 +462,4 @@ no_memory: #undef ADD_ENV_LIT #undef ADD_ENV_SPACE } +#endif diff --git a/src/util/threads-win32.c b/src/util/threads-win32.c index b1d1571..a30bccf 100644 --- a/src/util/threads-win32.c +++ b/src/util/threads-win32.c @@ -69,7 +69,7 @@ void virThreadOnExit(void) int virMutexInit(virMutexPtr m) { - virMutexInitRecursive(m); + return virMutexInitRecursive(m); } int virMutexInitRecursive(virMutexPtr m) diff --git a/tools/virsh.c b/tools/virsh.c index aaae7ca..8017beb 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -414,6 +414,7 @@ out: */ static int disconnected = 0; /* we may have been disconnected */ +#ifdef SIGPIPE /* * vshCatchDisconnect: * @@ -442,6 +443,10 @@ vshSetupSignals(void) { sigaction(SIGPIPE, &sig_action, NULL); } +#else +static void +vshSetupSignals(void) {} +#endif /* * vshReconnect: @@ -8425,7 +8430,7 @@ cmdSnapshotList(vshControl *ctl, const vshCmd *cmd) &creation) < 0) continue; localtime_r(&creation, &time_info); - strftime(timestr, sizeof(timestr), "%F %T %z", &time_info); + strftime(timestr, sizeof(timestr), "%Y-%m-%d %H:%M:%S %z", &time_info); vshPrint(ctl, " %-20s %-25s %s\n", names[i], timestr, state); } -- 1.6.6.1

2 2

[libvirt] [PATCH v2] nwfilter: fix for directionality of ICMP traffic
by Stefan Berger 08 Apr '10

08 Apr '10

Changes from V1 to V2 of this patch - I had reversed the logic thinking that icmp type 0 is a echo request,but it's reply -- needed to reverse the logic - Found that ebtables takes the --ip-tos argument only as a hex number This patch enables the skipping of some of the ICMP traffic rules on the iptables level under certain circumstances so that the following filter properly enables unidirectional pings: <filter name='testcase'> <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>  <rule action='accept' direction='in' priority='500'> <icmp type='8'/> </rule>  <rule action='accept' direction='out' priority='500'> <icmp type='0'/> </rule>  <rule action='drop' direction='inout' priority='600'> <icmp/> </rule> </filter> Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 108 +++++++++++++++++------------- 1 file changed, 64 insertions(+), 44 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1022,6 +1022,12 @@ err_exit: * @ifname : The name of the interface to apply the rule to * @vars : A map containing the variables to resolve * @res : The data structure to store the result(s) into + * @match : optional string for state match + * @accept_target : where to jump to on accepted traffic, i.e., "RETURN" + * "ACCEPT" + * @isIPv6 : Whether this is an IPv6 rule + * @maySkipICMP : whether this rule may under certain circumstances skip + * the ICMP rule from being created * * Convert a single rule into its representation for later instantiation * @@ -1039,7 +1045,8 @@ _iptablesCreateRuleInstance(int directio virNWFilterRuleInstPtr res, const char *match, const char *accept_target, - bool isIPv6) + bool isIPv6, + bool maySkipICMP) { char chain[MAX_CHAINNAME_LENGTH]; char number[20]; @@ -1265,6 +1272,10 @@ _iptablesCreateRuleInstance(int directio if (HAS_ENTRY_ITEM(&rule->p.icmpHdrFilter.dataICMPType)) { const char *parm; + + if (maySkipICMP) + goto exit_no_error; + if (rule->prtclType == VIR_NWFILTER_RULE_PROTOCOL_ICMP) parm = "--icmp-type"; else @@ -1386,6 +1397,10 @@ err_exit: return -1; +exit_no_error: + virBufferFreeAndReset(&buf); + + return 0; } @@ -1401,15 +1416,19 @@ iptablesCreateRuleInstance(virNWFilterDe int directionIn = 0; char chainPrefix[2]; int needState = 1; + bool maySkipICMP, inout = false; if ((rule->tt == VIR_NWFILTER_RULE_DIRECTION_IN) || (rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT)) { directionIn = 1; needState = 0; + inout = (rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT); } chainPrefix[0] = 'F'; + maySkipICMP = directionIn || inout; + chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; rc = _iptablesCreateRuleInstance(directionIn, chainPrefix, @@ -1421,10 +1440,14 @@ iptablesCreateRuleInstance(virNWFilterDe needState ? MATCH_STATE_OUT : NULL, "RETURN", - isIPv6); + isIPv6, + maySkipICMP); if (rc) return rc; + + maySkipICMP = !directionIn || inout; + chainPrefix[1] = CHAINPREFIX_HOST_OUT_TEMP; rc = _iptablesCreateRuleInstance(!directionIn, chainPrefix, @@ -1436,10 +1459,13 @@ iptablesCreateRuleInstance(virNWFilterDe needState ? MATCH_STATE_IN : NULL, "ACCEPT", - isIPv6); + isIPv6, + maySkipICMP); if (rc) return rc; + maySkipICMP = directionIn; + chainPrefix[0] = 'H'; chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; rc = _iptablesCreateRuleInstance(directionIn, @@ -1451,9 +1477,8 @@ iptablesCreateRuleInstance(virNWFilterDe res, NULL, "ACCEPT", - isIPv6); - if (rc) - return rc; + isIPv6, + maySkipICMP); return rc; } @@ -1750,9 +1775,9 @@ ebtablesCreateRuleInstance(char chainPre } if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataDSCP)) { - if (printDataType(vars, - number, sizeof(number), - &rule->p.ipHdrFilter.ipHdr.dataDSCP)) + if (printDataTypeAsHex(vars, + number, sizeof(number), + &rule->p.ipHdrFilter.ipHdr.dataDSCP)) goto err_exit; virBufferVSprintf(&buf,

2 2

[libvirt] [PATCH Repost] esx: Allow 'lsisas1068' as SCSI controller type
by Matthias Bolte 08 Apr '10

08 Apr '10

Extend tests to cover all SCSI controller types and document the new type. The lsisas1068 SCSI controller type was added in ESX 4.0. The VMX parser reports an error when this controller type is present. This makes virsh dumpxml fail for every domain that uses this controller type. This patch fixes this and adds lsisas1068 to the list of accepted SCSI controller types. Reported by Jonathan Kelley. --- This is a repost of this patch [1]. DanPB pointed out that the ESX driver is currently abusing the <driver> element to expose the SCSI controller type. Now we have the <controller> element to explicitly model stuff like SCSI controllers in the domain XML config. The ESX driver doesn't support this yet. Also there is currently no way to express the SCSI controller type in the <controller> element. Something like the model attribute for NICs need to be added here too. So I'd like to push this patch now in order to have the immediate problem of failing virsh dumpxml fixed in libvirt 0.8.0. I already got asked offlist when this problem will be fixed. [1] https://www.redhat.com/archives/libvir-list/2010-March/msg00548.html Matthias docs/drvesx.html.in | 4 +++ src/esx/esx_vmx.c | 14 +++++++----- tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx | 7 ------ tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml | 20 ------------------ tests/vmx2xmldata/vmx2xml-scsi-driver.vmx | 17 +++++++++++++++ tests/vmx2xmldata/vmx2xml-scsi-driver.xml | 30 +++++++++++++++++++++++++++ tests/vmx2xmltest.c | 2 +- tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx | 12 ---------- tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml | 15 ------------- tests/xml2vmxdata/xml2vmx-scsi-driver.vmx | 22 +++++++++++++++++++ tests/xml2vmxdata/xml2vmx-scsi-driver.xml | 25 ++++++++++++++++++++++ tests/xml2vmxtest.c | 2 +- 12 files changed, 108 insertions(+), 62 deletions(-) delete mode 100644 tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx delete mode 100644 tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml create mode 100644 tests/vmx2xmldata/vmx2xml-scsi-driver.vmx create mode 100644 tests/vmx2xmldata/vmx2xml-scsi-driver.xml delete mode 100644 tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx delete mode 100644 tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml create mode 100644 tests/xml2vmxdata/xml2vmx-scsi-driver.vmx create mode 100644 tests/xml2vmxdata/xml2vmx-scsi-driver.xml diff --git a/docs/drvesx.html.in b/docs/drvesx.html.in index d5c192d..422a7f0 100644 --- a/docs/drvesx.html.in +++ b/docs/drvesx.html.in @@ -282,6 +282,10 @@ ethernet0.checkMACAddress = "false" <dd> LSI Logic SCSI controller for recent guests. </dd> + <dt><code>lsisas1068</code></dt> + <dd> + LSI Logic SAS 1068 controller. + </dd> </dl> Here a domain XML snippet: diff --git a/src/esx/esx_vmx.c b/src/esx/esx_vmx.c index d242fc6..647e720 100644 --- a/src/esx/esx_vmx.c +++ b/src/esx/esx_vmx.c @@ -552,10 +552,11 @@ esxVMX_GatherSCSIControllers(virDomainDefPtr def, char *virtualDev[4], if (disk->driverName != NULL && STRCASENEQ(disk->driverName, "buslogic") && - STRCASENEQ(disk->driverName, "lsilogic")) { + STRCASENEQ(disk->driverName, "lsilogic") && + STRCASENEQ(disk->driverName, "lsisas1068")) { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, _("Expecting domain XML entry 'devices/disk/target' to " - "be 'buslogic' or 'lsilogic' but found '%s'"), + "be 'buslogic' or 'lsilogic' or 'lsisas1068' but found '%s'"), disk->driverName); return -1; } @@ -1266,10 +1267,11 @@ esxVMX_ParseSCSIController(virConfPtr conf, int controller, int *present, if (*virtualDev != NULL && STRCASENEQ(*virtualDev, "buslogic") && - STRCASENEQ(*virtualDev, "lsilogic")) { + STRCASENEQ(*virtualDev, "lsilogic") && + STRCASENEQ(*virtualDev, "lsisas1068")) { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, - _("Expecting VMX entry '%s' to be 'buslogic' or 'lsilogic' " - "but found '%s'"), virtualDev_name, *virtualDev); + _("Expecting VMX entry '%s' to be 'buslogic' or 'lsilogic' or " + "'lsisas1068' but found '%s'"), virtualDev_name, *virtualDev); goto failure; } @@ -1309,7 +1311,7 @@ esxVMX_ParseDisk(esxVI_Context *ctx, virConfPtr conf, int device, int bus, * bus = VIR_DOMAIN_DISK_BUS_SCSI * controller = [0..3] * id = [0..6,8..15] - * virtualDev = {'buslogic', 'lsilogic'} + * virtualDev = {'buslogic', 'lsilogic', 'lsisas1068'} * * device = {VIR_DOMAIN_DISK_DEVICE_DISK, VIR_DOMAIN_DISK_DEVICE_CDROM} * bus = VIR_DOMAIN_DISK_BUS_IDE diff --git a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx b/tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx deleted file mode 100644 index 1725051..0000000 --- a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx +++ /dev/null @@ -1,7 +0,0 @@ -config.version = "8" -virtualHW.version = "4" -scsi0.present = "true" -scsi0.virtualDev = "buslogic" -scsi0:0.present = "true" -scsi0:0.deviceType = "scsi-hardDisk" -scsi0:0.fileName = "harddisk.vmdk" diff --git a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml b/tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml deleted file mode 100644 index 2ffb866..0000000 --- a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml +++ /dev/null @@ -1,20 +0,0 @@ -<domain type='vmware'> - <uuid>00000000-0000-0000-0000-000000000000</uuid> - <memory>32768</memory> - <currentMemory>32768</currentMemory> - <vcpu>1</vcpu> - <os> - <type arch='i686'>hvm</type> - </os> - <clock offset='utc'/> - <on_poweroff>destroy</on_poweroff> - <on_reboot>restart</on_reboot> - <on_crash>destroy</on_crash> - <devices> - <disk type='file' device='disk'> - <driver name='buslogic'/> - <source file='[datastore] directory/harddisk.vmdk'/> - <target dev='sda' bus='scsi'/> - </disk> - </devices> -</domain> diff --git a/tests/vmx2xmldata/vmx2xml-scsi-driver.vmx b/tests/vmx2xmldata/vmx2xml-scsi-driver.vmx new file mode 100644 index 0000000..cb055f6 --- /dev/null +++ b/tests/vmx2xmldata/vmx2xml-scsi-driver.vmx @@ -0,0 +1,17 @@ +config.version = "8" +virtualHW.version = "4" +scsi0.present = "true" +scsi0.virtualDev = "buslogic" +scsi1.present = "true" +scsi1.virtualDev = "lsilogic" +scsi2.present = "true" +scsi2.virtualDev = "lsisas1068" +scsi0:0.present = "true" +scsi0:0.deviceType = "scsi-hardDisk" +scsi0:0.fileName = "harddisk1.vmdk" +scsi1:0.present = "true" +scsi1:0.deviceType = "scsi-hardDisk" +scsi1:0.fileName = "harddisk2.vmdk" +scsi2:0.present = "true" +scsi2:0.deviceType = "scsi-hardDisk" +scsi2:0.fileName = "harddisk3.vmdk" diff --git a/tests/vmx2xmldata/vmx2xml-scsi-driver.xml b/tests/vmx2xmldata/vmx2xml-scsi-driver.xml new file mode 100644 index 0000000..1fa9ac4 --- /dev/null +++ b/tests/vmx2xmldata/vmx2xml-scsi-driver.xml @@ -0,0 +1,30 @@ +<domain type='vmware'> + <uuid>00000000-0000-0000-0000-000000000000</uuid> + <memory>32768</memory> + <currentMemory>32768</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='i686'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='buslogic'/> + <source file='[datastore] directory/harddisk1.vmdk'/> + <target dev='sda' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsilogic'/> + <source file='[datastore] directory/harddisk2.vmdk'/> + <target dev='sdp' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsisas1068'/> + <source file='[datastore] directory/harddisk3.vmdk'/> + <target dev='sdae' bus='scsi'/> + </disk> + </devices> +</domain> diff --git a/tests/vmx2xmltest.c b/tests/vmx2xmltest.c index b036f5b..f3b3b5e 100644 --- a/tests/vmx2xmltest.c +++ b/tests/vmx2xmltest.c @@ -130,7 +130,7 @@ mymain(int argc, char **argv) DO_TEST("graphics-vnc", "graphics-vnc", esxVI_APIVersion_25); - DO_TEST("scsi-buslogic", "scsi-buslogic", esxVI_APIVersion_25); + DO_TEST("scsi-driver", "scsi-driver", esxVI_APIVersion_25); DO_TEST("scsi-writethrough", "scsi-writethrough", esxVI_APIVersion_25); DO_TEST("harddisk-scsi-file", "harddisk-scsi-file", esxVI_APIVersion_25); diff --git a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx b/tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx deleted file mode 100644 index 2f98da3..0000000 --- a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx +++ /dev/null @@ -1,12 +0,0 @@ -config.version = "8" -virtualHW.version = "4" -guestOS = "other" -uuid.bios = "56 4d 9b ef ac d9 b4 e0-c8 f0 ae a8 b9 10 35 15" -displayName = "scsi-buslogic" -memsize = "4" -numvcpus = "1" -scsi0.present = "true" -scsi0.virtualDev = "buslogic" -scsi0:0.present = "true" -scsi0:0.deviceType = "scsi-hardDisk" -scsi0:0.fileName = "/vmfs/volumes/datastore/directory/harddisk.vmdk" diff --git a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml b/tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml deleted file mode 100644 index 5d52c54..0000000 --- a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml +++ /dev/null @@ -1,15 +0,0 @@ -<domain type='vmware'> - <name>scsi-buslogic</name> - <uuid>564d9bef-acd9-b4e0-c8f0-aea8b9103515</uuid> - <memory>4096</memory> - <os> - <type>hvm</type> - </os> - <devices> - <disk type='file' device='disk'> - <driver name='buslogic'/> - <source file='[datastore] directory/harddisk.vmdk'/> - <target dev='sda' bus='scsi'/> - </disk> - </devices> -</domain> diff --git a/tests/xml2vmxdata/xml2vmx-scsi-driver.vmx b/tests/xml2vmxdata/xml2vmx-scsi-driver.vmx new file mode 100644 index 0000000..7cceca0 --- /dev/null +++ b/tests/xml2vmxdata/xml2vmx-scsi-driver.vmx @@ -0,0 +1,22 @@ +config.version = "8" +virtualHW.version = "4" +guestOS = "other" +uuid.bios = "56 4d 9b ef ac d9 b4 e0-c8 f0 ae a8 b9 10 35 15" +displayName = "scsi-buslogic" +memsize = "4" +numvcpus = "1" +scsi0.present = "true" +scsi0.virtualDev = "buslogic" +scsi1.present = "true" +scsi1.virtualDev = "lsilogic" +scsi2.present = "true" +scsi2.virtualDev = "lsisas1068" +scsi0:0.present = "true" +scsi0:0.deviceType = "scsi-hardDisk" +scsi0:0.fileName = "/vmfs/volumes/datastore/directory/harddisk1.vmdk" +scsi1:0.present = "true" +scsi1:0.deviceType = "scsi-hardDisk" +scsi1:0.fileName = "/vmfs/volumes/datastore/directory/harddisk2.vmdk" +scsi2:0.present = "true" +scsi2:0.deviceType = "scsi-hardDisk" +scsi2:0.fileName = "/vmfs/volumes/datastore/directory/harddisk3.vmdk" diff --git a/tests/xml2vmxdata/xml2vmx-scsi-driver.xml b/tests/xml2vmxdata/xml2vmx-scsi-driver.xml new file mode 100644 index 0000000..797a26e --- /dev/null +++ b/tests/xml2vmxdata/xml2vmx-scsi-driver.xml @@ -0,0 +1,25 @@ +<domain type='vmware'> + <name>scsi-buslogic</name> + <uuid>564d9bef-acd9-b4e0-c8f0-aea8b9103515</uuid> + <memory>4096</memory> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file' device='disk'> + <driver name='buslogic'/> + <source file='[datastore] directory/harddisk1.vmdk'/> + <target dev='sda' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsilogic'/> + <source file='[datastore] directory/harddisk2.vmdk'/> + <target dev='sdp' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsisas1068'/> + <source file='[datastore] directory/harddisk3.vmdk'/> + <target dev='sdae' bus='scsi'/> + </disk> + </devices> +</domain> diff --git a/tests/xml2vmxtest.c b/tests/xml2vmxtest.c index b8b9d6f..f9c4730 100644 --- a/tests/xml2vmxtest.c +++ b/tests/xml2vmxtest.c @@ -175,7 +175,7 @@ mymain(int argc, char **argv) DO_TEST("graphics-vnc", "graphics-vnc", esxVI_APIVersion_25); - DO_TEST("scsi-buslogic", "scsi-buslogic", esxVI_APIVersion_25); + DO_TEST("scsi-driver", "scsi-driver", esxVI_APIVersion_25); DO_TEST("scsi-writethrough", "scsi-writethrough", esxVI_APIVersion_25); DO_TEST("harddisk-scsi-file", "harddisk-scsi-file", esxVI_APIVersion_25); -- 1.6.3.3

2 2

[libvirt] [PATCH] esx: Report an error for invalid arguments in esxList(Defined)Domains
by Matthias Bolte 08 Apr '10

08 Apr '10

--- src/esx/esx_driver.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index 888ac10..eb06555 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -964,7 +964,8 @@ esxListDomains(virConnectPtr conn, int *ids, int maxids) int count = 0; if (ids == NULL || maxids < 0) { - goto failure; + ESX_ERROR(VIR_ERR_INVALID_ARG, "%s", _("Invalid arguemnt")); + return -1; } if (maxids == 0) { @@ -2255,7 +2256,8 @@ esxListDefinedDomains(virConnectPtr conn, char **const names, int maxnames) int i; if (names == NULL || maxnames < 0) { - goto failure; + ESX_ERROR(VIR_ERR_INVALID_ARG, "%s", _("Invalid arguemnt")); + return -1; } if (maxnames == 0) { -- 1.6.3.3

2 2

[libvirt] [PATCH] Avoid searching for windres when not building for cygwin or mingw.
by Diego Elio Pettenò 08 Apr '10

08 Apr '10

Just checking for a windres tool might hit even on Linux systems when building for Linux (e.g.: when using Gentoo and having built binutils with multitarget support), and will then fail to link properly at the end of the build. Check the host string before deciding whether to look for windres or not. --- configure.ac | 9 +++++++-- 1 files changed, 7 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 29c6396..e6122b9 100644 --- a/configure.ac +++ b/configure.ac @@ -1676,8 +1676,13 @@ AC_SUBST([CYGWIN_EXTRA_PYTHON_LIBADD]) AC_SUBST([MINGW_EXTRA_LDFLAGS]) dnl Look for windres to build a Windows icon resource. -AC_CHECK_TOOL([WINDRES], [windres], [no]) -AM_CONDITIONAL([WITH_WIN_ICON], [test "$WINDRES" != "no"]) +case "$host" in + *cygwin* | *mingw* ) + AC_CHECK_TOOL([WINDRES], [windres], []) + ;; +esac + +AM_CONDITIONAL([WITH_WIN_ICON], [test "$WINDRES" != ""]) -- 1.6.6.1

3 2

[libvirt] [PATCH] nwfilters: Test suite for checking created firewall entries
by Stefan Berger 08 Apr '10

08 Apr '10

This patch adds new test cases to the existing nwfilter test program and adds a test script that must be run while a VM is running. This test script verifies that input network filter XML creates expected user-defined tables and rules on ebtables, iptables & ip6tables layer and verifies their content against expected content. The idea is that these tools always return exactly the same output when displaying the content of a user-defined table so that the diff tool can be used for simple text comparison. All supported protocols have at least one test case. This test program is not run automatically since it requires a running VM. For all tests to pass the previously posted ICMP fix patch must be applied. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfiltervmtest.sh | 186 ++++++++++++++++++ tests/nwfilterxml2fwallout/ah-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/ah-test.fwall | 19 + tests/nwfilterxml2fwallout/all-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/all-test.fwall | 19 + tests/nwfilterxml2fwallout/arp-test.fwall | 9 tests/nwfilterxml2fwallout/esp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/esp-test.fwall | 19 + tests/nwfilterxml2fwallout/icmp-direction-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction2-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction3-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-test.fwall | 16 + tests/nwfilterxml2fwallout/icmpv6-test.fwall | 16 + tests/nwfilterxml2fwallout/igmp-test.fwall | 19 + tests/nwfilterxml2fwallout/ip-test.fwall | 12 + tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 12 + tests/nwfilterxml2fwallout/ipv6-test.fwall | 14 + tests/nwfilterxml2fwallout/mac-test.fwall | 12 + tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/sctp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/sctp-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/udp-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-test.fwall | 19 + tests/nwfilterxml2xmlin/icmp-direction-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 + tests/nwfilterxml2xmlout/icmp-direction-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction2-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction3-test.xml | 9 tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml | 9 tests/nwfilterxml2xmltest.c | 4 37 files changed, 748 insertions(+) Index: libvirt-acl/tests/nwfiltervmtest.sh =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfiltervmtest.sh @@ -0,0 +1,186 @@ +#!/bin/sh + +VIRSH=virsh +ORIG_IFNAME="vnet0" + +function usage() { + local cmd="$0" + echo "Usage: ${cmd} [--help|-h|-?] [--ifname|-i <interfacename>" + cat <<EOF + +Options: + --help,-h,-? : Display this help screen. + --ifname, -i : Name of the backend interface of the VM. Default 'vnet0' + +Run this program while a KVM VM is running (preferably as only VM on the +system) and one of its interfaces uses a filter called 'testcase'. The name +of the interface of the VM is anticipated to be 'vnet0' unless set by the +'--ifname' option. The following interface description fulfills this +requirement: + + <interface type='bridge'> + <source bridge='virbr0'/> + <target dev='vnet0'/> + <filterref filter='testcase'/> + </interface> + +The individual tests are validated using string comparison where the output +of ebtables, iptables and ip6tables is compared against expected output. As +long as the output of those tools is the same, the tests should all pass. +The tests were developed on Fedore Core 12. + +Known problems: None of the running VMs' names may have spaces. +EOF +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local cmd line tmpfile tmpfile2 + local linenums ctr=0 + local regex="s/${ORIG_IFNAME}/${ifname}/g" + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + tmpfile=`mktemp` + tmpfile2=`mktemp` + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + exec 4<&0 + + exec < ${fwallfile} + + read line + while [ ! -z "${line}" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + exec ${cmd} | grep -v "^Bridge" | grep -v "^$" > ${tmpfile} + + rm ${tmpfile2} + touch ${tmpfile2} + + while [ 1 ]; do + read + + line="${REPLY}" + + if [ "${line:0:1}" == "#" -o -z "${line}" ]; then + + diff ${tmpfile} ${tmpfile2} > /dev/null + + if [ $? -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + else + echo "PASS ${xmlfile} : ${cmd}" + fi + + break; + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 0<&4 + exec 4<&- + + rm -rf "${tmpfile}" "${tmpfile2}" +} + + +function runTests() { + local ifname="$1" + local xmldir="$2" + local fwalldir="$3" + local fwallfiles f + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${ifname}" + done +} + + +function checkVM() { + local vmname="$1" + local ifname="$2" + local nwfilter="$3" + local f i c + + c=`virsh dumpxml ${vmname} | grep -c "<interface"` + if [ ${c} -ne 1 ]; then + echo "VM '${vmname}' has multiple interfaces. I cannot tell for sure " + echo "whether this VM has the correct interface name '${ifname}' and " + echo "reference the filter '${nwfilter}'. Cowardly skipping this VM..." + return 1 + fi + + f=`${VIRSH} dumpxml ${vmname} | \ + tr -d "\n" | \ + sed "s/.*filterref filter='$[a-zA-Z0-9_]\+$'.*/\1/"` + i=`${VIRSH} dumpxml ${vmname} | \ + tr -d "\n" | \ + sed "s/.*\<interface.*target dev='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + if [ "${i}" == "${ifname}" -a "${f}" == "${nwfilter}" ]; then + return 0 + fi + + return 1 +} + + +function main() { + local prgname="$0" + local ifname="${ORIG_IFNAME}" + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms + local filtername="testcase" + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --ifname|-i) shift 1; ifname="$1";; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + vms=`${VIRSH} list | grep running | gawk '{print $2}'` + if [ -z ${vms} ]; then + echo "Error: Need a running VM." + exit 1; + fi + + for vm in ${vms}; do + checkVM "${vm}" "${ifname}" "${filtername}" + if [ $? -eq 0 ]; then + found=1; + break; + fi + done + + if [ ${found} -eq 0 ]; then + echo "Error: Suitable VM seems not to be running. Check the help screen"; + echo "to (--help) to read about requirements to the running VM."; + exit 1; + fi + + runTests "${ifname}" "${xmldir}" "${fwalldir}" +} + +main $* + Index: libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,14 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,16 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21 +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21 +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21 +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21 +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -114,6 +114,10 @@ mymain(int argc, char **argv) DO_TEST("ref-test"); DO_TEST("ref-rule-test"); + DO_TEST("ipt-no-macspoof-test"); + DO_TEST("icmp-direction-test"); + DO_TEST("icmp-direction2-test"); + DO_TEST("icmp-direction3-test"); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout' priority='500'> + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + <rule action='drop' direction='in' priority='500'> + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,12 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/Makefile.am =================================================================== --- libvirt-acl.orig/tests/Makefile.am +++ libvirt-acl/tests/Makefile.am @@ -74,7 +74,9 @@ EXTRA_DIST = \ xml2vmxdata \ nwfilterxml2xmlout \ nwfilterxml2xmlin \ + nwfilterxml2fwallout \ nwfilterschematest \ + nwfiltervmtest.sh \ $(patsubst %,qemuhelpdata/%,$(qemuhelpdata)) noinst_PROGRAMS = virshtest conftest \

3 5

[libvirt] [PATCH] nwfilter: fix for directionality of ICMP traffic
by Stefan Berger 08 Apr '10

08 Apr '10

This patch enables the skipping of some of the ICMP traffic rules on the iptables level under certain circumstances so that the following filter properly enables unidirectional pings: <filter name='testcase'> <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>  <rule action='accept' direction='in' priority='500'> <icmp type='0'/> </rule>  <rule action='accept' direction='out' priority='500'> <icmp type='8'/> </rule>  <rule action='drop' direction='inout' priority='600'> <icmp/> </rule> </filter> Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 108 +++++++++++++++++------------- 1 file changed, 64 insertions(+), 44 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1022,6 +1022,12 @@ err_exit: * @ifname : The name of the interface to apply the rule to * @vars : A map containing the variables to resolve * @res : The data structure to store the result(s) into + * @match : optional string for state match + * @accept_target : where to jump to on accepted traffic, i.e., "RETURN" + * "ACCEPT" + * @isIPv6 : Whether this is an IPv6 rule + * @maySkipICMP : whether this rule may under certain circumstances skip + * the ICMP rule from being created * * Convert a single rule into its representation for later instantiation * @@ -1039,7 +1045,8 @@ _iptablesCreateRuleInstance(int directio virNWFilterRuleInstPtr res, const char *match, const char *accept_target, - bool isIPv6) + bool isIPv6, + bool maySkipICMP) { char chain[MAX_CHAINNAME_LENGTH]; char number[20]; @@ -1265,6 +1272,10 @@ _iptablesCreateRuleInstance(int directio if (HAS_ENTRY_ITEM(&rule->p.icmpHdrFilter.dataICMPType)) { const char *parm; + + if (maySkipICMP) + goto exit_no_error; + if (rule->prtclType == VIR_NWFILTER_RULE_PROTOCOL_ICMP) parm = "--icmp-type"; else @@ -1386,6 +1397,10 @@ err_exit: return -1; +exit_no_error: + virBufferFreeAndReset(&buf); + + return 0; } @@ -1401,15 +1416,19 @@ iptablesCreateRuleInstance(virNWFilterDe int directionIn = 0; char chainPrefix[2]; int needState = 1; + bool maySkipICMP, inout = false; if ((rule->tt == VIR_NWFILTER_RULE_DIRECTION_IN) || (rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT)) { directionIn = 1; needState = 0; + inout = (rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT); } chainPrefix[0] = 'F'; + maySkipICMP = !directionIn && !inout; + chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; rc = _iptablesCreateRuleInstance(directionIn, chainPrefix, @@ -1421,10 +1440,14 @@ iptablesCreateRuleInstance(virNWFilterDe needState ? MATCH_STATE_OUT : NULL, "RETURN", - isIPv6); + isIPv6, + maySkipICMP); if (rc) return rc; + + maySkipICMP = directionIn && !inout; + chainPrefix[1] = CHAINPREFIX_HOST_OUT_TEMP; rc = _iptablesCreateRuleInstance(!directionIn, chainPrefix, @@ -1436,10 +1459,13 @@ iptablesCreateRuleInstance(virNWFilterDe needState ? MATCH_STATE_IN : NULL, "ACCEPT", - isIPv6); + isIPv6, + maySkipICMP); if (rc) return rc; + maySkipICMP = !directionIn; + chainPrefix[0] = 'H'; chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; rc = _iptablesCreateRuleInstance(directionIn, @@ -1451,9 +1477,8 @@ iptablesCreateRuleInstance(virNWFilterDe res, NULL, "ACCEPT", - isIPv6); - if (rc) - return rc; + isIPv6, + maySkipICMP); return rc; }

2 1

[libvirt] [PATCH] Avoid a race when restoring a qemu domain.
by Laine Stump 08 Apr '10

08 Apr '10

This patch adds a 1 second sleep after telling qemu to start the restore operation and before telling qemu to start up the CPUs. Without this sleep, my hardware would end up with the CPUs started before the restore was started, leading to random (but never good) behavior. Apparently this is caused by slow hardware, as I haven't heard of anyone else experiencing this problem. A sleep is a very inelegant way to eliminate the problem, but it's apparently the only way currently available to us. Note that sleep durations as low as 250msec were successful in eliminating the bad behavior; I made it 1 sec. just for extra safety. --- src/qemu/qemu_driver.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 60fa95a..1270c84 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5965,6 +5965,13 @@ static int qemudDomainRestore(virConnectPtr conn, /* If it was running before, resume it now. */ if (header.was_running) { qemuDomainObjPrivatePtr priv = vm->privateData; + + /* pause 1 second to allow qemu time to start the restore, + * otherwise it may start the CPUs before the restore, and end + * up in a "nondeterminate" state. + */ + usleep(1000000); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStartCPUs(priv->mon, conn) < 0) { if (virGetLastError() == NULL) -- 1.6.6.1

3 4

[libvirt] [PATCH v2] nwfilter: Support for learning a VM's IP address
by Stefan Berger 08 Apr '10

08 Apr '10

Since v1, I have made the following changes: - remove unneeded include files - created a new ATTRIBUTE_PACKED in internal.h (please check) - added libpcap to rpm spec file (not built via rpm) - added 2 flags for the type of traffic to be used to detect the IP address of a VM: DETECT_DHCP & DETECT_STATIC. Now if DETECT_DHCP is chosen, temporary filtering rules are applied on the VM's interface that allow the VM to only send and receive DHCP traffic (optionally restricted to a certain DHCP server) until the actual rules are then applied. In that case the libpcap uses a filter that restricts packets the thread received to DHCP Response traffic. The function to request the learning of the IP address is currently invoked with both flags set, but either one by itself works. A user should consciously configure the VM that triggers that for example DETECT_DHCP is to be used alone since in that case a statically configured interface in the VM will not be able to communicate at all. Now the following ways for learning the IP address parameter are available: - explicitly provided IP address by user as filter parameter - snooping of DHCP OFFERs from a specific DHCP server - snooping of DHCP OFFERs from any server - snooping of any traffic from the VM indicating its IP address This patch implements support for learning a VM's IP address. It uses the pcap library to listen on the VM's backend network interface (tap) or the physical ethernet device (macvtap) and tries to capture packets with source or destination MAC address of the VM and learn from DHCP Offers, ARP traffic, or first-sent IPv4 packet what the IP address of the VM's interface is. This then allows to instantiate the network traffic filtering rules without the user having to provide the IP parameter somewhere in the filter description or in the interface description as a parameter. This only supports to detect the parameter IP, which is for the assumed single IPv4 address of a VM. There is not support for interfaces that may have multiple IP addresses (IP aliasing) or IPv6 that may then require more than one valid IP address to be detected. A VM can have multiple independent interfaces that each uses a different IP address and in that case it will be attempted to detect each one of the address independently. So, when for example an interface description in the domain XML has looked like this up to now: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'> <parameter name='IP' value='10.2.3.4'/> </filterref> </interface> you may omit the IP parameter: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> Internally I am walking the 'tree' of a VM's referenced network filters and determine with the given variables which variables are missing. Now, the above IP parameter may be missing and this causes a libvirt-internal thread to be started that uses the pcap library's API to listen to the backend interface (in case of macvtap to the physical interface) in an attempt to determine the missing IP parameter. If the backend interface disappears the thread terminates assuming the VM was brought down. In case of a macvtap device a timeout is being used to wait for packets from the given VM (filtering by VM's interface MAC address). If the VM's macvtap device disappeared the thread also terminates. In all other cases it tries to determine the IP address of the VM and will then apply the rules late on the given interface, which would have happened immediately if the IP parameter had been explicitly given. In case an error happens while the firewall rules are applied, the VM's backend interface is 'down'ed preventing it to communicate. Reasons for failure for applying the network firewall rules may that an ebtables/iptables command failes or OOM errors. Essentially the same failure reasons may occur as when the firewall rules are applied immediately on VM start, except that due to the late application of the filtering rules the VM now is already running and cannot be hindered anymore from starting. Bringing down the whole VM would probably be considered too drastic. While a VM's IP address is attempted to be determined only limited updates to network filters are allowed. In particular it is prevented that filters are modified in such a way that they would introduce new variables. A caveat: The algorithm does not know which one is the appropriate IP address of a VM. If the VM spoofs an IP address in its first ARP traffic or IPv4 packets its filtering rules will be instantiated for this IP address, thus 'locking' it to the found IP address. So, it's still 'safer' to explicitly provide the IP address of a VM's interface in the filter description if it is known beforehand. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- configure.ac | 39 + libvirt.spec.in | 9 src/Makefile.am | 14 src/conf/nwfilter_conf.c | 7 src/conf/nwfilter_conf.h | 3 src/internal.h | 8 src/libvirt_private.syms | 12 src/nwfilter/nwfilter_driver.c | 11 src/nwfilter/nwfilter_ebiptables_driver.c | 258 ++++++++++++ src/nwfilter/nwfilter_ebiptables_driver.h | 11 src/nwfilter/nwfilter_gentech_driver.c | 409 ++++++++++++++++++- src/nwfilter/nwfilter_gentech_driver.h | 14 src/nwfilter/nwfilter_learnipaddr.c | 625 ++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_learnipaddr.h | 68 +++ 14 files changed, 1450 insertions(+), 38 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -0,0 +1,68 @@ +/* + * nwfilter_learnipaddr.h: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#ifndef __NWFILTER_LEARNIPADDR_H +# define __NWFILTER_LEARNIPADDR_H + +enum howDetect { + DETECT_DHCP = 1, + DETECT_STATIC = 2, +}; + +typedef struct _virNWFilterIPAddrLearnReq virNWFilterIPAddrLearnReq; +typedef virNWFilterIPAddrLearnReq *virNWFilterIPAddrLearnReqPtr; +struct _virNWFilterIPAddrLearnReq { + char ifname[IF_NAMESIZE]; + char linkdev[IF_NAMESIZE]; + enum virDomainNetType nettype; + unsigned char macaddr[VIR_MAC_BUFLEN]; + char *filtername; + virNWFilterHashTablePtr filterparams; + virNWFilterDriverStatePtr driver; + enum howDetect howDetect; + + int status; + pthread_t thread; +}; + +int virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver, + enum howDetect howDetect); + +virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(const char *ifname); + + +void virNWFilterDelIpAddrForIfname(const char *ifname); +const char *virNWFilterGetIpAddrForIfname(const char *ifname); + +int virNWFilterLearnInit(void); +void virNWFilterLearnShutdown(void); + +#endif /* __NWFILTER_LEARNIPADDR_H */ Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -0,0 +1,625 @@ +/* + * nwfilter_learnipaddr.c: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#include <config.h> + +#ifdef HAVE_LIBPCAP +# include <pcap.h> +#endif + +#include <fcntl.h> +#include <sys/ioctl.h> + +#include <arpa/inet.h> +#include <net/ethernet.h> +#include <netinet/ip.h> +#include <netinet/udp.h> +#include <net/if_arp.h> + +#include "internal.h" + +#include "buf.h" +#include "memory.h" +#include "logging.h" +#include "datatypes.h" +#include "virterror_internal.h" +#include "threads.h" +#include "conf/nwfilter_params.h" +#include "conf/domain_conf.h" +#include "nwfilter_gentech_driver.h" +#include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + + +/* structure of an ARP request/reply message */ +struct f_arphdr { + struct arphdr arphdr; + uint8_t ar_sha[ETH_ALEN]; + uint32_t ar_sip; + uint8_t ar_tha[ETH_ALEN]; + uint32_t ar_tip; +} ATTRIBUTE_PACKED; + + +/* structure representing DHCP message */ +struct dhcp { + uint8_t op; + uint8_t htype; + uint8_t hlen; + uint8_t hops; + uint32_t xid; + uint16_t secs; + uint16_t flags; + uint32_t ciaddr; + uint32_t yiaddr; + uint32_t siaddr; + uint32_t giaddr; + uint8_t chaddr[16]; + /* omitted */ +} ATTRIBUTE_PACKED; + + +struct ether_vlan_header +{ + uint8_t dhost[ETH_ALEN]; + uint8_t shost[ETH_ALEN]; + uint16_t vlan_type; + uint16_t vlan_flags; + uint16_t ether_type; +} ATTRIBUTE_PACKED; + + +static virMutex pendingLearnReqLock; +static virHashTablePtr pendingLearnReq; + +static virMutex ipAddressMapLock; +static virNWFilterHashTablePtr ipAddressMap; + + +static void +virNWFilterIPAddrLearnReqFree(virNWFilterIPAddrLearnReqPtr req) { + if (!req) + return; + + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->filterparams); + + VIR_FREE(req); +} + + +#if HAVE_LIBPCAP + +static int +virNWFilterRegisterLearnReq(virNWFilterIPAddrLearnReqPtr req) { + int res = -1; + virMutexLock(&pendingLearnReqLock); + + if (!virHashLookup(pendingLearnReq, req->ifname)) + res = virHashAddEntry(pendingLearnReq, req->ifname, req); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + +#endif + + +virNWFilterIPAddrLearnReqPtr +virNWFilterLookupLearnReq(const char *ifname) { + void *res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + +static void +freeLearnReqEntry(void *payload, const char *name ATTRIBUTE_UNUSED) { + virNWFilterIPAddrLearnReqFree(payload); +} + + +#ifdef HAVE_LIBPCAP + +static virNWFilterIPAddrLearnReqPtr +virNWFilterDeregisterLearnReq(const char *ifname) { + virNWFilterIPAddrLearnReqPtr res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + if (res) + virHashRemoveEntry(pendingLearnReq, ifname, NULL); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + + +static int +virNWFilterAddIpAddrForIfname(const char *ifname, char *addr) { + int ret; + + virMutexLock(&ipAddressMapLock); + + ret = virNWFilterHashTablePut(ipAddressMap, ifname, addr, 1); + + virMutexUnlock(&ipAddressMapLock); + + return ret; +} +#endif + + +void +virNWFilterDelIpAddrForIfname(const char *ifname) { + + virMutexLock(&ipAddressMapLock); + + if (virHashLookup(ipAddressMap->hashTable, ifname)) + virNWFilterHashTableRemoveEntry(ipAddressMap, ifname); + + virMutexUnlock(&ipAddressMapLock); +} + + +const char * +virNWFilterGetIpAddrForIfname(const char *ifname) { + const char *res; + + virMutexLock(&ipAddressMapLock); + + res = virHashLookup(ipAddressMap->hashTable, ifname); + + virMutexUnlock(&ipAddressMapLock); + + return res; +} + + +#ifdef HAVE_LIBPCAP + +/** + * learnIPAddressThread + * arg: pointer to virNWFilterIPAddrLearnReq structure + * + * Learn the IP address being used on an interface. Use ARP Request and + * Reply messages, DHCP offers and the first IP packet being sent from + * the VM to detect the IP address it is using. Detects only one IP address + * per interface (IP aliasing not supported). The method on how the + * IP address is detected can be chosen through flags. DETECT_DHCP will + * require that the IP address is detected from a DHCP OFFER, DETECT_STATIC + * will require that the IP address was taken from an ARP packet or an IPv4 + * packet. Both flags can be set at the same time. + */ +static void * +learnIPAddressThread(void *arg) +{ + char errbuf[PCAP_ERRBUF_SIZE] = {0}; + pcap_t *handle; + struct bpf_program fp; + struct pcap_pkthdr header; + const u_char *packet; + struct ether_header *ether_hdr; + struct ether_vlan_header *vlan_hdr; + virNWFilterIPAddrLearnReqPtr req = arg; + uint32_t vmaddr = 0; + unsigned int ethHdrSize; + char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev + : req->ifname; + int to_ms = (strlen(req->linkdev) != 0) ? 1000 + : 0; + char macaddr[VIR_MAC_STRING_BUFLEN]; + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *filter= NULL; + uint16_t etherType; + enum howDetect howDetected = 0; + + req->status = 0; + + handle = pcap_open_live(listen_if, BUFSIZ, 0, to_ms, errbuf); + + if (handle == NULL) { + VIR_DEBUG("Couldn't open device %s: %s\n", listen_if, errbuf); + req->status = ENODEV; + goto done; + } + + virFormatMacAddr(req->macaddr, macaddr); + + switch (req->howDetect) { + case DETECT_DHCP: + virBufferVSprintf(&buf, " ether dst %s" + " and src port 67 and dst port 68", + macaddr); + break; + default: + virBufferVSprintf(&buf, "ether host %s", macaddr); + } + + if (virBufferError(&buf)) { + req->status = ENOMEM; + goto done; + } + + filter = virBufferContentAndReset(&buf); + + if (pcap_compile(handle, &fp, filter, 1, 0) != 0 || + pcap_setfilter(handle, &fp) != 0) { + VIR_DEBUG("Couldn't compile or set filter '%s'.\n", filter); + req->status = EINVAL; + goto done; + } + + while (req->status == 0 && vmaddr == 0) { + packet = pcap_next(handle, &header); + + if (!packet) { + if (to_ms == 0) { + /* assuming IF disappeared */ + req->status = ENODEV; + break; + } + /* listening on linkdev, check whether VM's dev is still there */ + if (checkIf(req->ifname, req->macaddr)) { + req->status = ENODEV; + break; + } + continue; + } + + if (header.len >= sizeof(struct ether_header)) { + ether_hdr = (struct ether_header*)packet; + + switch (ntohs(ether_hdr->ether_type)) { + + case ETHERTYPE_IP: + ethHdrSize = sizeof(struct ether_header); + etherType = ntohs(ether_hdr->ether_type); + break; + + case ETHERTYPE_VLAN: + ethHdrSize = sizeof(struct ether_vlan_header); + vlan_hdr = (struct ether_vlan_header *)packet; + if (ntohs(vlan_hdr->ether_type) != ETHERTYPE_IP || + header.len < ethHdrSize) + continue; + etherType = ntohs(vlan_hdr->ether_type); + break; + + default: + continue; + } + + if (memcmp(ether_hdr->ether_shost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets from the VM + + if (etherType == ETHERTYPE_IP && + (header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + vmaddr = iphdr->saddr; + // skip eth. bcast and mcast addresses, + // and zero address in DHCP Requests + if ((ntohl(vmaddr) & 0xc0000000) || vmaddr == 0) { + vmaddr = 0; + continue; + } + + howDetected = DETECT_STATIC; + } else if (etherType == ETHERTYPE_ARP && + (header.len >= ethHdrSize + + sizeof(struct f_arphdr))) { + struct f_arphdr *arphdr = (struct f_arphdr*)(packet + + ethHdrSize); + switch (ntohs(arphdr->arphdr.ar_op)) { + case ARPOP_REPLY: + vmaddr = arphdr->ar_sip; + howDetected = DETECT_STATIC; + break; + case ARPOP_REQUEST: + vmaddr = arphdr->ar_tip; + howDetected = DETECT_STATIC; + break; + } + } + } else if (memcmp(ether_hdr->ether_dhost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets to the VM + if (etherType == ETHERTYPE_IP && + (header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + if ((iphdr->protocol == IPPROTO_UDP) && + (header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr))) { + struct udphdr *udphdr= (struct udphdr *) + ((char *)iphdr + iphdr->ihl * 4); + if (ntohs(udphdr->source) == 67 && + ntohs(udphdr->dest) == 68 && + header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr) + + sizeof(struct dhcp)) { + struct dhcp *dhcp = (struct dhcp *) + ((char *)udphdr + sizeof(udphdr)); + if (dhcp->op == 2 /* DHCP OFFER */ && + !memcmp(&dhcp->chaddr[0], + req->macaddr, + 6)) { + vmaddr = dhcp->yiaddr; + howDetected = DETECT_DHCP; + } + } + } + } + } + } + if (vmaddr && (req->howDetect & howDetected) == 0) { + vmaddr = 0; + howDetected = 0; + } + } /* while */ + + done: + VIR_FREE(filter); + + if (handle) + pcap_close(handle); + + ebtablesRemoveBasicRules(NULL, req->ifname); + + if (req->status == 0) { + int ret; + char inetaddr[INET_ADDRSTRLEN]; + inet_ntop(AF_INET, &vmaddr, inetaddr, sizeof(inetaddr)); + + virNWFilterAddIpAddrForIfname(req->ifname, strdup(inetaddr)); + + ret = virNWFilterInstantiateFilterLate(NULL, + req->ifname, + req->linkdev, + req->nettype, + req->macaddr, + req->filtername, + req->filterparams, + req->driver); + VIR_DEBUG("Result from applying firewall rules on " + "%s with IP addr %s : %d\n", req->ifname, inetaddr, ret); + } + + memset(&req->thread, 0x0, sizeof(req->thread)); + + VIR_DEBUG("pcap thread terminating for interface %s \n",req->ifname); + + virNWFilterDeregisterLearnReq(req->ifname); + + virNWFilterIPAddrLearnReqFree(req); + + return 0; +} + + +/** + * virNWFilterLearnIPAddress + * @conn: pointer to virConnect object + * @ifname: the name of the interface + * @linkdev : the name of the link device; currently only used in case of a + * macvtap device + * @nettype : the type of interface + * @macaddr : the MAC address of the interface + * @filtername : the name of the top-level filter to apply to the interface + * once its IP address has been detected + * @driver : the network filter driver + * @howDetect : the method on how the thread is supposed to detect the + * IP address; must choose any of the available flags + * + * Instruct to learn the IP address being used on a given interface (ifname). + * Unless there already is a thread attempting to learn the IP address + * being used on the interface, a thread is started that will listen on + * the traffic being sent on the interface (or link device) with the + * MAC address that is provided. Will then launch the application of the + * firewall rules on the interface. + */ +int +virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver, + enum howDetect howDetect) { + int rc; + virNWFilterIPAddrLearnReqPtr req = NULL; + virNWFilterHashTablePtr ht = NULL; + + if (howDetect == 0) + return 1; + + if (VIR_ALLOC(req) < 0) { + virReportOOMError(); + goto err_no_req; + } + + ht = virNWFilterHashTableCreate(0); + if (ht == NULL) { + virReportOOMError(); + goto err_no_ht; + } + + if (virNWFilterHashTablePutAll(conn, filterparams, ht)) + goto err_free_ht; + + req->filtername = strdup(filtername); + if (req->filtername == NULL) { + virReportOOMError(); + goto err_free_ht; + } + + if (virStrcpyStatic(req->ifname, ifname) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for ifname ('%s') " + "not large enough"), ifname); + goto err_free_ht; + } + + if (linkdev) { + if (virStrcpyStatic(req->linkdev, linkdev) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for linkdev ('%s') " + "not large enough"), linkdev); + goto err_free_ht; + } + } + req->nettype = nettype; + memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); + req->driver = driver; + req->filterparams = ht; + ht = NULL; + req->howDetect = howDetect; + + rc = virNWFilterRegisterLearnReq(req); + + if (rc) + goto err_free_ht; + + switch (howDetect) { + case DETECT_DHCP: + if (ebtablesApplyDHCPOnlyRules(conn, + ifname, + macaddr, + NULL)) + goto err_free_ht; + break; + default: + if (ebtablesApplyBasicRules(conn, + ifname, + macaddr)) + goto err_free_ht; + } + + + if (pthread_create(&req->thread, + NULL, + learnIPAddressThread, + req) != 0) + goto err_remove_rules; + + return 0; + +err_remove_rules: + ebtablesRemoveBasicRules(conn, ifname); +err_free_ht: + virNWFilterHashTableFree(ht); +err_no_ht: + virNWFilterIPAddrLearnReqFree(req); +err_no_req: + return 1; +} + +#else + +int +virNWFilterLearnIPAddress(virConnectPtr conn ATTRIBUTE_UNUSED, + const char *ifname ATTRIBUTE_UNUSED, + const char *linkdev ATTRIBUTE_UNUSED, + enum virDomainNetType nettype ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED, + const char *filtername ATTRIBUTE_UNUSED, + virNWFilterHashTablePtr filterparams ATTRIBUTE_UNUSED, + virNWFilterDriverStatePtr driver ATTRIBUTE_UNUSED) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + _("IP parameter must be given since libvirt " + "was not compiled with IP address learning " + "support")); + return 1; +} +#endif /* HAVE_LIBPCAP */ + + +/** + * virNWFilterLearnInit + * Initialization of this layer + */ +int +virNWFilterLearnInit(void) { + pendingLearnReq = virHashCreate(0); + if (!pendingLearnReq) { + virReportOOMError(); + return 1; + } + + if (virMutexInit(&pendingLearnReqLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + ipAddressMap = virNWFilterHashTableCreate(0); + if (!ipAddressMap) { + virReportOOMError(); + virNWFilterLearnShutdown(); + return 1; + } + + if (virMutexInit(&ipAddressMapLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + return 0; +} + + +/** + * virNWFilterLearnShutdown + * Shutdown of this layer + */ +void +virNWFilterLearnShutdown(void) { + virHashFree(pendingLearnReq, freeLearnReqEntry); + pendingLearnReq = NULL; + + virNWFilterHashTableFree(ipAddressMap); + ipAddressMap = NULL; +} Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -308,7 +308,9 @@ NWFILTER_DRIVER_SOURCES = \ nwfilter/nwfilter_gentech_driver.c \ nwfilter/nwfilter_gentech_driver.h \ nwfilter/nwfilter_ebiptables_driver.c \ - nwfilter/nwfilter_ebiptables_driver.h + nwfilter/nwfilter_ebiptables_driver.h \ + nwfilter/nwfilter_learnipaddr.c \ + nwfilter/nwfilter_learnipaddr.h # Security framework and drivers for various models @@ -764,10 +766,11 @@ else libvirt_la_LIBADD += libvirt_driver_nwfilter.la noinst_LTLIBRARIES += libvirt_driver_nwfilter.la endif -libvirt_driver_nwfilter_la_CFLAGS = \ +libvirt_driver_nwfilter_la_CFLAGS = $(LIBPCAP_CFLAGS) \ -I@top_srcdir@/src/conf +libvirt_driver_nwfilter_la_LDFLAGS = $(LIBPCAP_LIBS) if WITH_DRIVER_MODULES -libvirt_driver_nwfilter_la_LDFLAGS = -module -avoid-version ../gnulib/lib/libgnu.la +libvirt_driver_nwfilter_la_LDFLAGS += -module -avoid-version ../gnulib/lib/libgnu.la endif libvirt_driver_nwfilter_la_SOURCES = $(NWFILTER_DRIVER_SOURCES) endif @@ -912,6 +915,7 @@ libvirt_la_LDFLAGS = $(VERSION_SCRIPT_FL -version-info $(LIBVIRT_VERSION_INFO) \ $(COVERAGE_CFLAGS:-f%=-Wc,-f%) \ $(LIBXML_LIBS) \ + $(LIBPCAP_LIBS) \ $(DRIVER_MODULE_LIBS) \ $(CYGWIN_EXTRA_LDFLAGS) $(MINGW_EXTRA_LDFLAGS) libvirt_la_CFLAGS = $(COVERAGE_CFLAGS) -DIN_LIBVIRT @@ -960,8 +964,8 @@ libvirt_lxc_SOURCES = \ $(NODE_INFO_SOURCES) \ $(ENCRYPTION_CONF_SOURCES) \ $(DOMAIN_CONF_SOURCES) \ - $(NWFILTER_PARAM_CONF_SOURCES) \ - $(CPU_CONF_SOURCES) + $(CPU_CONF_SOURCES) \ + $(NWFILTER_PARAM_CONF_SOURCES) libvirt_lxc_LDFLAGS = $(WARN_CFLAGS) $(COVERAGE_LDCFLAGS) $(CAPNG_LIBS) $(YAJL_LIBS) libvirt_lxc_LDADD = $(LIBXML_LIBS) $(NUMACTL_LIBS) ../gnulib/lib/libgnu.la libvirt_lxc_CFLAGS = \ Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -24,6 +24,9 @@ #include <config.h> #include <stdint.h> +#include <sys/socket.h> +#include <sys/ioctl.h> +#include <linux/if.h> #include "internal.h" @@ -34,12 +37,16 @@ #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER #define NWFILTER_STD_VAR_MAC "MAC" +#define NWFILTER_STD_VAR_IP "IP" + +static int _virNWFilterTeardownFilter(const char *ifname); static virNWFilterTechDriverPtr filter_tech_drivers[] = { @@ -111,6 +118,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI * @tables: pointer to hash tabel to add values to * @macaddr: The string of the MAC address to add to the hash table, * may be NULL + * @ipaddr: The string of the IP address to add to the hash table; + * may be NULL * * Returns 0 in case of success, 1 in case an error happened with * error having been reported. @@ -120,7 +129,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI static int virNWFilterVarHashmapAddStdValues(virConnectPtr conn, virNWFilterHashTablePtr table, - char *macaddr) + char *macaddr, + char *ipaddr) { if (macaddr) { if (virHashAddEntry(table->hashTable, @@ -132,6 +142,16 @@ virNWFilterVarHashmapAddStdValues(virCon } } + if (ipaddr) { + if (virHashAddEntry(table->hashTable, + NWFILTER_STD_VAR_IP, + ipaddr) < 0) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + "%s", _("Could not add variable 'IP' to hashmap")); + return 1; + } + } + return 0; } @@ -140,23 +160,26 @@ virNWFilterVarHashmapAddStdValues(virCon * virNWFilterCreateVarHashmap: * @conn: pointer to virConnect object * @macaddr: pointer to string containing formatted MAC address of interface + * @ipaddr: pointer to string containing formatted IP address used by + * VM on this interface; may be NULL * * Create a hashmap used for evaluating the firewall rules. Initializes - * it with the standard variable 'MAC'. + * it with the standard variable 'MAC' and 'IP' if provided. * * Returns pointer to hashmap, NULL if an error occcurred and error message * is attached to the virConnect object. */ virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr) { + char *macaddr, + char *ipaddr) { virNWFilterHashTablePtr table = virNWFilterHashTableCreate(0); if (!table) { virReportOOMError(); return NULL; } - if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr)) { + if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr, ipaddr)) { virNWFilterHashTableFree(table); return NULL; } @@ -284,9 +307,9 @@ _virNWFilterInstantiateRec(virConnectPtr virNWFilterHashTablePtr vars, int *nEntries, virNWFilterRuleInstPtr **insts, - enum instCase useNewFilter, int *foundNewFilter) + enum instCase useNewFilter, int *foundNewFilter, + virNWFilterDriverStatePtr driver) { - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterPoolObjPtr obj; int rc = 0; int i; @@ -365,7 +388,96 @@ _virNWFilterInstantiateRec(virConnectPtr tmpvars, nEntries, insts, useNewFilter, - foundNewFilter); + foundNewFilter, + driver); + + virNWFilterHashTableFree(tmpvars); + + virNWFilterPoolObjUnlock(obj); + if (rc) + break; + } else { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("referenced filter '%s' is missing"), + inc->filterref); + rc = 1; + break; + } + } + } + return rc; +} + + +static int +virNWFilterDetermineMissingVarsRec(virConnectPtr conn, + virNWFilterDefPtr filter, + virNWFilterHashTablePtr vars, + virNWFilterHashTablePtr missing_vars, + int useNewFilter, + virNWFilterDriverStatePtr driver) +{ + virNWFilterPoolObjPtr obj; + int rc = 0; + int i, j; + virNWFilterDefPtr next_filter; + + for (i = 0; i < filter->nentries; i++) { + virNWFilterRuleDefPtr rule = filter->filterEntries[i]->rule; + virNWFilterIncludeDefPtr inc = filter->filterEntries[i]->include; + if (rule) { + // check all variables of this rule + for (j = 0; j < rule->nvars; j++) { + if (!virHashLookup(vars->hashTable, rule->vars[j])) { + virNWFilterHashTablePut(missing_vars, rule->vars[j], + strdup("1"), 1); + } + } + } else if (inc) { + VIR_DEBUG("Following filter %s\n", inc->filterref); + obj = virNWFilterPoolObjFindByName(&driver->pools, + inc->filterref); + if (obj) { + + if (obj->wantRemoved) { + virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + _("Filter '%s' is in use."), + inc->filterref); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + // create a temporary hashmap for depth-first tree traversal + virNWFilterHashTablePtr tmpvars = + virNWFilterCreateVarsFrom(conn, + inc->params, + vars); + if (!tmpvars) { + virReportOOMError(); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + next_filter = obj->def; + + switch (useNewFilter) { + case INSTANTIATE_FOLLOW_NEWFILTER: + if (obj->newDef) { + next_filter = obj->newDef; + } + break; + case INSTANTIATE_ALWAYS: + break; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + next_filter, + tmpvars, + missing_vars, + useNewFilter, + driver); virNWFilterHashTableFree(tmpvars); @@ -438,9 +550,12 @@ virNWFilterInstantiate(virConnectPtr con enum virDomainNetType nettype, virNWFilterDefPtr filter, const char *ifname, + const char *linkdev, virNWFilterHashTablePtr vars, enum instCase useNewFilter, int *foundNewFilter, - bool teardownOld) + bool teardownOld, + const unsigned char *macaddr, + virNWFilterDriverStatePtr driver) { int rc; int j, nptrs; @@ -449,6 +564,45 @@ virNWFilterInstantiate(virConnectPtr con void **ptrs = NULL; int instantiate = 1; + virNWFilterLockFilterUpdates(); + + virNWFilterHashTablePtr missing_vars = virNWFilterHashTableCreate(0); + if (!missing_vars) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + filter, + vars, + missing_vars, + useNewFilter, + driver); + if (rc) + goto err_exit; + + if (virHashSize(missing_vars->hashTable) == 1) { + if (virHashLookup(missing_vars->hashTable, + NWFILTER_STD_VAR_IP) != NULL) { + if (virNWFilterLookupLearnReq(ifname) == NULL) { + rc = virNWFilterLearnIPAddress(conn, + ifname, + linkdev, + nettype, macaddr, + filter->name, + vars, driver, + DETECT_DHCP| DETECT_STATIC); + } + goto err_exit; + } + rc = 1; + goto err_exit; + } else if (virHashSize(missing_vars->hashTable) > 1) { + rc = 1; + goto err_exit; + } + rc = _virNWFilterInstantiateRec(conn, techdriver, nettype, @@ -456,7 +610,8 @@ virNWFilterInstantiate(virConnectPtr con ifname, vars, &nEntries, &insts, - useNewFilter, foundNewFilter); + useNewFilter, foundNewFilter, + driver); if (rc) goto err_exit; @@ -487,24 +642,33 @@ virNWFilterInstantiate(virConnectPtr con err_exit: + virNWFilterUnlockFilterUpdates(); + for (j = 0; j < nEntries; j++) virNWFilterRuleInstFree(insts[j]); VIR_FREE(insts); + virNWFilterHashTableFree(missing_vars); + return rc; } static int -_virNWFilterInstantiateFilter(virConnectPtr conn, - const virDomainNetDefPtr net, - bool teardownOld, - enum instCase useNewFilter) +__virNWFilterInstantiateFilter(virConnectPtr conn, + bool teardownOld, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + enum instCase useNewFilter, + virNWFilterDriverStatePtr driver) { int rc; const char *drvname = EBIPTABLES_DRIVER_ID; - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterTechDriverPtr techdriver; virNWFilterPoolObjPtr obj; virNWFilterHashTablePtr vars, vars1; @@ -512,6 +676,8 @@ _virNWFilterInstantiateFilter(virConnect char vmmacaddr[VIR_MAC_STRING_BUFLEN] = {0}; int foundNewFilter = 0; char *str_macaddr = NULL; + const char *ipaddr; + char *str_ipaddr = NULL; techdriver = virNWFilterTechDriverForName(drvname); @@ -523,25 +689,25 @@ _virNWFilterInstantiateFilter(virConnect return 1; } - VIR_DEBUG("filter name: %s\n", net->filter); + VIR_DEBUG("filter name: %s\n", filtername); - obj = virNWFilterPoolObjFindByName(&driver->pools, net->filter); + obj = virNWFilterPoolObjFindByName(&driver->pools, filtername); if (!obj) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Could not find filter '%s'"), - net->filter); + filtername); return 1; } if (obj->wantRemoved) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Filter '%s' is in use."), - net->filter); + filtername); rc = 1; goto err_exit; } - virFormatMacAddr(net->mac, vmmacaddr); + virFormatMacAddr(macaddr, vmmacaddr); str_macaddr = strdup(vmmacaddr); if (!str_macaddr) { virReportOOMError(); @@ -549,18 +715,29 @@ _virNWFilterInstantiateFilter(virConnect goto err_exit; } + ipaddr = virNWFilterGetIpAddrForIfname(ifname); + if (ipaddr) { + str_ipaddr = strdup(ipaddr); + if (!str_ipaddr) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + } + vars1 = virNWFilterCreateVarHashmap(conn, - str_macaddr); + str_macaddr, str_ipaddr); if (!vars1) { rc = 1; goto err_exit; } str_macaddr = NULL; + str_ipaddr = NULL; vars = virNWFilterCreateVarsFrom(conn, vars1, - net->filterparams); + filterparams); if (!vars) { rc = 1; goto err_exit_vars1; @@ -582,12 +759,15 @@ _virNWFilterInstantiateFilter(virConnect rc = virNWFilterInstantiate(conn, techdriver, - net->type, + nettype, filter, - net->ifname, + ifname, + linkdev, vars, useNewFilter, &foundNewFilter, - teardownOld); + teardownOld, + macaddr, + driver); virNWFilterHashTableFree(vars); @@ -595,15 +775,180 @@ err_exit_vars1: virNWFilterHashTableFree(vars1); err_exit: - virNWFilterPoolObjUnlock(obj); + VIR_FREE(str_ipaddr); VIR_FREE(str_macaddr); return rc; } +static int +_virNWFilterInstantiateFilter(virConnectPtr conn, + const virDomainNetDefPtr net, + bool teardownOld, + enum instCase useNewFilter) +{ + const char *linkdev = (net->type == VIR_DOMAIN_NET_TYPE_DIRECT) + ? net->data.direct.linkdev + : NULL; + return __virNWFilterInstantiateFilter(conn, + teardownOld, + net->ifname, + linkdev, + net->type, + net->mac, + net->filter, + net->filterparams, + useNewFilter, + conn->nwfilterPrivateData); +} + + +// FIXME: move chgIfFlags, ifUp, checkIf into common file & share w/ macvtap.c + +/* + * chgIfFlags: Change flags on an interface + * @ifname : name of the interface + * @flagclear : the flags to clear + * @flagset : the flags to set + * + * The new flags of the interface will be calculated as + * flagmask = (~0 ^ flagclear) + * newflags = (curflags & flagmask) | flagset; + * + * Returns 0 on success, errno on failure. + */ +static int chgIfFlags(const char *ifname, short flagclear, short flagset) { + struct ifreq ifr; + int rc = 0; + int flags; + short flagmask = (~0 ^ flagclear); + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + flags = (ifr.ifr_flags & flagmask) | flagset; + + if (ifr.ifr_flags != flags) { + ifr.ifr_flags = flags; + + if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) + rc = errno; + } + +err_exit: + close(fd); + return rc; +} + +/* + * ifUp + * @name: name of the interface + * @up: 1 for up, 0 for down + * + * Function to control if an interface is activated (up, 1) or not (down, 0) + * + * Returns 0 in case of success or an errno code in case of failure. + */ +static int +ifUp(const char *name, int up) +{ + return chgIfFlags(name, + (up) ? 0 : IFF_UP, + (up) ? IFF_UP : 0); +} + + +/** + * checkIf + * + * @ifname: Name of the interface + * @macaddr: expected MAC address of the interface + * + * FIXME: the interface's index is another good parameter to check + * + * Determine whether a given interface is still available. If so, + * it must have the given MAC address. + * + * Returns an error code ENODEV in case the interface does not exist + * anymore or its MAC address is different, 0 otherwise. + */ +int +checkIf(const char *ifname, const unsigned char *macaddr) +{ + struct ifreq ifr; + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + int rc = 0; + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + if (memcmp(&ifr.ifr_hwaddr.sa_data, macaddr, 6) != 0) + rc = ENODEV; + + err_exit: + close(fd); + return rc; +} + + +int +virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) +{ + int rc; + rc = __virNWFilterInstantiateFilter(conn, + 1, + ifname, + linkdev, + nettype, + macaddr, + filtername, + filterparams, + INSTANTIATE_ALWAYS, + driver); + if (rc) { + //something went wrong... 'DOWN' the interface + if (ifUp(ifname ,0)) { + // assuming interface disappeared... + _virNWFilterTeardownFilter(ifname); + } + } + return rc; +} + + int virNWFilterInstantiateFilter(virConnectPtr conn, const virDomainNetDefPtr net) @@ -660,8 +1005,8 @@ virNWFilterTearOldFilter(virConnectPtr c } -int -virNWFilterTeardownFilter(const virDomainNetDefPtr net) +static int +_virNWFilterTeardownFilter(const char *ifname) { const char *drvname = EBIPTABLES_DRIVER_ID; virNWFilterTechDriverPtr techdriver; @@ -676,13 +1021,21 @@ virNWFilterTeardownFilter(const virDomai #endif return 1; } + techdriver->allTeardown(ifname); - techdriver->allTeardown(net->ifname); + virNWFilterDelIpAddrForIfname(ifname); return 0; } +int +virNWFilterTeardownFilter(const virDomainNetDefPtr net) +{ + return _virNWFilterTeardownFilter(net->ifname); +} + + void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -37,6 +37,8 @@ #include "nwfilter_gentech_driver.h" +#include "nwfilter_learnipaddr.h" + #define VIR_FROM_THIS VIR_FROM_NWFILTER #define nwfilterLog(msg...) fprintf(stderr, msg) @@ -65,9 +67,12 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; - if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + if (virNWFilterLearnInit() < 0) return -1; + if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + goto conf_init_err; + if (VIR_ALLOC(driverState) < 0) goto alloc_err_exit; @@ -120,6 +125,9 @@ error: alloc_err_exit: virNWFilterConfLayerShutdown(); +conf_init_err: + virNWFilterLearnShutdown(); + return -1; } @@ -413,5 +421,6 @@ static virStateDriver stateDriver = { int nwfilterRegister(void) { virRegisterNWFilterDriver(&nwfilterDriver); virRegisterStateDriver(&stateDriver); + virNWFilterLearnInit(); return 0; } Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -46,13 +46,25 @@ int virNWFilterRollbackUpdateFilter(virC int virNWFilterTearOldFilter(virConnectPtr conn, const virDomainNetDefPtr net); +int virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); + int virNWFilterTeardownFilter(const virDomainNetDefPtr net); virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr); + char *macaddr, + char *ipaddr); void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, void *data); +int checkIf(const char *ifname, const unsigned char *macaddr); + #endif Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -488,6 +488,8 @@ virNWFilterRegisterCallbackDriver; virNWFilterTestUnassignDef; virNWFilterConfLayerInit; virNWFilterConfLayerShutdown; +virNWFilterLockFilterUpdates; +virNWFilterUnlockFilterUpdates; #nwfilter_params.h @@ -503,6 +505,16 @@ virNWFilterInstantiateFilter; virNWFilterTeardownFilter; +#nwfilter_learnipaddr.h +ipAddressMap; +ipAddressMapLock; +pendingLearnReq; +pendingLearnReqLock; +virNWFilterGetIpAddrForIfname; +virNWFilterDelIpAddrForIfname; +virNWFilterLookupLearnReq; + + # pci.h pciGetDevice; pciFreeDevice; Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -114,17 +114,18 @@ struct int_map { */ static virMutex updateMutex; -static void +void virNWFilterLockFilterUpdates(void) { virMutexLock(&updateMutex); } -static void +void virNWFilterUnlockFilterUpdates(void) { virMutexUnlock(&updateMutex); } + /* * attribute names for the rules XML */ @@ -2631,7 +2632,7 @@ int virNWFilterConfLayerInit(virHashIter { virNWFilterDomainFWUpdateCB = domUpdateCB; - if (virMutexInit(&updateMutex)) + if (virMutexInitRecursive(&updateMutex)) return 1; if (virNWFilterParamConfLayerInit()) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -565,6 +565,9 @@ virNWFilterDefPtr virNWFilterDefParseFil void virNWFilterPoolObjLock(virNWFilterPoolObjPtr obj); void virNWFilterPoolObjUnlock(virNWFilterPoolObjPtr obj); +void virNWFilterLockFilterUpdates(void); +void virNWFilterUnlockFilterUpdates(void); + int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -2594,6 +2594,264 @@ ebiptablesInstCommand(virConnectPtr conn } +/** + * ebtablesApplyBasicRules + * + * @conn: virConnect object + * @ifname: name of the backend-interface to which to apply the rules + * @macaddr: MAC address the VM is using in packets sent through the + * interface + * + * Returns 0 on success, 1 on failure with the rules removed + * + * Apply basic filtering rules on the given interface + * - filtering for MAC address spoofing + * - allowing IPv4 & ARP traffic + */ +int +ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + char chain[MAX_CHAINNAME_LENGTH]; + char chainPrefix = CHAINPREFIX_HOST_IN_TEMP; + char macaddr_str[VIR_MAC_STRING_BUFLEN]; + + virFormatMacAddr(macaddr, macaddr_str); + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebiptablesExecCLI(conn, &buf, &cli_status); + + ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + + PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p IPv4 -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p ARP -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + + if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + goto tear_down_tmpebchains; + + return 0; + +tear_down_tmpebchains: + ebtablesRemoveBasicRules(conn, ifname); + + virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + "%s", + _("Some rules could not be created.")); + + return 1; +} + + +/** + * ebtablesApplyDHCPOnlyRules + * + * @conn: virConnect object + * @ifname: name of the backend-interface to which to apply the rules + * @macaddr: MAC address the VM is using in packets sent through the + * interface + * @dhcpserver: The DHCP server from which the VM may receive traffic + * from; may be NULL + * + * Returns 0 on success, 1 on failure with the rules removed + * + * Apply filtering rules so that the VM can only send and receive + * DHCP traffic and nothing else. + */ +int +ebtablesApplyDHCPOnlyRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr, + const char *dhcpserver) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + char chain_in [MAX_CHAINNAME_LENGTH], + chain_out[MAX_CHAINNAME_LENGTH]; + char macaddr_str[VIR_MAC_STRING_BUFLEN]; + char *srcIPParam = NULL; + + if (dhcpserver) { + virBufferVSprintf(&buf, " --ip-src %s", dhcpserver); + if (virBufferError(&buf)) + return 1; + srcIPParam = virBufferContentAndReset(&buf); + } + + virFormatMacAddr(macaddr, macaddr_str); + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebiptablesExecCLI(conn, &buf, &cli_status); + + ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + ebtablesCreateTmpRootChain(conn, &buf, 0, ifname, 1); + + PRINT_ROOT_CHAIN(chain_in , CHAINPREFIX_HOST_IN_TEMP , ifname); + PRINT_ROOT_CHAIN(chain_out, CHAINPREFIX_HOST_OUT_TEMP, ifname); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_in, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s" + " -p ipv4 --ip-protocol udp" + " --ip-src 0.0.0.0 --ip-dst 255.255.255.255 " + " --ip-sport 68 --ip-dport 67 " + " -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_in, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_in, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -d ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_out, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s" + " -p ipv4 --ip-protocol udp" + " --ip-sport 67 --ip-dport 68" + " %s" + " -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_out, + srcIPParam != NULL ? srcIPParam : "", + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_out, + CMD_STOPONERR(1)); + + ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + ebtablesLinkTmpRootChain(conn, &buf, 0, ifname, 1); + + if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + goto tear_down_tmpebchains; + + VIR_FREE(srcIPParam); + + return 0; + +tear_down_tmpebchains: + ebtablesRemoveBasicRules(conn, ifname); + + virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + "%s", + _("Some rules could not be created.")); + + VIR_FREE(srcIPParam); + + return 1; +} + + +int +ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + + ebiptablesExecCLI(conn, &buf, &cli_status); + return 0; +} + + static int ebiptablesRuleOrderSort(const void *a, const void *b) { Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h @@ -45,4 +45,15 @@ extern virNWFilterTechDriver ebiptables_ # define EBIPTABLES_DRIVER_ID "ebiptables" + +int ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr); +int ebtablesApplyDHCPOnlyRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr, + const char *dhcpServer); +int ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname); + #endif Index: libvirt-acl/configure.ac =================================================================== --- libvirt-acl.orig/configure.ac +++ libvirt-acl/configure.ac @@ -41,6 +41,7 @@ XMLRPC_REQUIRED=1.14.0 HAL_REQUIRED=0.5.0 DEVMAPPER_REQUIRED=1.0.0 LIBCURL_REQUIRED="7.18.0" +LIBPCAP_REQUIRED="1.0.0" dnl Checks for C compiler. AC_PROG_CC @@ -1045,6 +1046,39 @@ AC_SUBST([NUMACTL_CFLAGS]) AC_SUBST([NUMACTL_LIBS]) +dnl pcap lib +LIBPCAP_CONFIG="pcap-config" +LIBPCAP_CFLAGS="" +LIBPCAP_LIBS="" +LIBPCAP_FOUND="no" + +AC_ARG_WITH([libpcap], AC_HELP_STRING([--with-libpcap=@<:@PFX@:>@], [libpcap location])) +if test "$with_qemu" = "yes"; then + if test "x$with_libpcap" != "xno" ; then + if test "x$with_libpcap" != "x" ; then + LIBPCAP_CONFIG=$with_libpcap/bin/$LIBPCAP_CONFIG + fi + AC_MSG_CHECKING(libpcap $LIBPCAP_CONFIG >= $LIBPCAP_REQUIRED ) + if ! $LIBPCAP_CONFIG --libs > /dev/null 2>&1 ; then + AC_MSG_RESULT(no) + else + LIBPCAP_LIBS="`$LIBPCAP_CONFIG --libs`" + LIBPCAP_CFLAGS="`$LIBPCAP_CONFIG --cflags`" + LIBPCAP_FOUND="yes" + AC_MSG_RESULT(yes) + fi + fi +fi + +if test "x$LIBPCAP_FOUND" = "xyes"; then + AC_DEFINE_UNQUOTED([HAVE_LIBPCAP], 1, [whether libpcap can be used]) +fi + +AC_SUBST([LIBPCAP_CFLAGS]) +AC_SUBST([LIBPCAP_LIBS]) + + + dnl dnl Checks for the UML driver dnl @@ -2129,6 +2163,11 @@ AC_MSG_NOTICE([ xmlrpc: $XMLRPC_CFLAGS else AC_MSG_NOTICE([ xmlrpc: no]) fi +if test "$with_qemu" = "yes" ; then +AC_MSG_NOTICE([ pcap: $LIBPCAP_CFLAGS $LIBPCAP_LIBS]) +else +AC_MSG_NOTICE([ pcap: no]) +fi AC_MSG_NOTICE([]) AC_MSG_NOTICE([Test suite]) AC_MSG_NOTICE([]) Index: libvirt-acl/src/internal.h =================================================================== --- libvirt-acl.orig/src/internal.h +++ libvirt-acl/src/internal.h @@ -138,6 +138,14 @@ # endif # endif +# ifndef ATTRIBUTE_PACKED +# if __GNUC_PREREQ (3, 3) +# define ATTRIBUTE_PACKED __attribute__((packed)) +# else +# error "Need an __attribute__((packed)) equivalent" +# endif +# endif + # ifndef ATTRIBUTE_NONNULL # if __GNUC_PREREQ (3, 3) # define ATTRIBUTE_NONNULL(m) __attribute__((__nonnull__(m))) Index: libvirt-acl/libvirt.spec.in =================================================================== --- libvirt-acl.orig/libvirt.spec.in +++ libvirt-acl/libvirt.spec.in @@ -61,6 +61,7 @@ %define with_udev 0%{!?_without_udev:0} %define with_hal 0%{!?_without_hal:0} %define with_yajl 0%{!?_without_yajl:0} +%define with_libpcap 0%{!?_without_libpcap:0} # Non-server/HV driver defaults which are always enabled %define with_python 0%{!?_without_python:1} @@ -147,6 +148,11 @@ %define with_yajl 0%{!?_without_yajl:%{server_drivers}} %endif +# Enable libpcap library +%if %{with_qemu} +%define with_libpcap 0%{!?_without_libpcap:%{server_drivers}} +%endif + # Force QEMU to run as non-root %if 0%{?fedora} >= 12 || 0%{?rhel} >= 6 %define qemu_user qemu @@ -266,6 +272,9 @@ BuildRequires: libpciaccess-devel >= 0.1 %if %{with_yajl} BuildRequires: yajl-devel %endif +%if %{with_libpcap} +BuildRequires: libpcap-devel +%endif %if %{with_avahi} BuildRequires: avahi-devel %endif

2 2

[libvirt] [PATCH v2] nwfilters: Test suite for checking created firewall entries
by Stefan Berger 08 Apr '10

08 Apr '10

Changes from v1 to v2: - followed suggestions from Eric Blake on script improvements This patch adds new test cases to the existing nwfilter test program and adds a test script that must be run while a VM is running. This test script verifies that input network filter XML creates expected user-defined tables and rules on ebtables, iptables & ip6tables layer and verifies their content against expected content. The idea is that these tools always return exactly the same output when displaying the content of a user-defined table so that the diff tool can be used for simple text comparison. All supported protocols have at least one test case. This test program is not run automatically since it requires a running VM. For all tests to pass the previously posted ICMP fix patch must be applied. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfiltervmtest.sh | 186 ++++++++++++++++++ tests/nwfilterxml2fwallout/ah-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/ah-test.fwall | 19 + tests/nwfilterxml2fwallout/all-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/all-test.fwall | 19 + tests/nwfilterxml2fwallout/arp-test.fwall | 9 tests/nwfilterxml2fwallout/esp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/esp-test.fwall | 19 + tests/nwfilterxml2fwallout/icmp-direction-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction2-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction3-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-test.fwall | 16 + tests/nwfilterxml2fwallout/icmpv6-test.fwall | 16 + tests/nwfilterxml2fwallout/igmp-test.fwall | 19 + tests/nwfilterxml2fwallout/ip-test.fwall | 12 + tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 12 + tests/nwfilterxml2fwallout/ipv6-test.fwall | 14 + tests/nwfilterxml2fwallout/mac-test.fwall | 12 + tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/sctp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/sctp-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/udp-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-test.fwall | 19 + tests/nwfilterxml2xmlin/icmp-direction-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 + tests/nwfilterxml2xmlout/icmp-direction-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction2-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction3-test.xml | 9 tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml | 9 tests/nwfilterxml2xmltest.c | 4 37 files changed, 748 insertions(+) Index: libvirt-acl/tests/nwfiltervmtest.sh =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfiltervmtest.sh @@ -0,0 +1,191 @@ +#!/bin/bash + +VIRSH=virsh +ORIG_IFNAME="vnet0" + +TMPFILE1="/tmp/nwfiltervmtest1.txt" +TMPFILE2="/tmp/nwfiltervmtest2.txt" + +function usage() { + local cmd="$0" + echo "Usage: ${cmd} [--help|-h|-?] [--ifname|-i <interfacename>" + cat <<EOF + +Options: + --help,-h,-? : Display this help screen. + --ifname, -i : Name of the backend interface of the VM. Default 'vnet0' + +Run this program while a KVM VM is running (preferably as only VM on the +system) and one of its interfaces uses a filter called 'testcase'. The name +of the interface of the VM is anticipated to be 'vnet0' unless set by the +'--ifname' option. The following interface description fulfills this +requirement: + + <interface type='bridge'> + <source bridge='virbr0'/> + <target dev='vnet0'/> + <filterref filter='testcase'/> + </interface> + +The individual tests are validated using string comparison where the output +of ebtables, iptables and ip6tables is compared against expected output. As +long as the output of those tools is the same, the tests should all pass. +The tests were developed on Fedore Core 12. + +Known problems: None of the running VMs' names may have spaces. +EOF +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local cmd line tmpfile tmpfile2 + local linenums ctr=0 + local regex="s/${ORIG_IFNAME}/${ifname}/g" + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + tmpfile="${TMPFILE1}" + tmpfile2="${TMPFILE2}" + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + exec 4<&0 + + exec < ${fwallfile} + + read line + while [ "x${line}x" != "xx" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + exec ${cmd} | grep -v "^Bridge" | grep -v "^$" > ${tmpfile} + + rm ${tmpfile2} 2>/dev/null + touch ${tmpfile2} + + while [ 1 ]; do + read + + line="${REPLY}" + + if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then + + diff ${tmpfile} ${tmpfile2} >/dev/null + + if [ $? -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + else + echo "PASS ${xmlfile} : ${cmd}" + fi + + break; + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 0<&4 + exec 4<&- + + rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null +} + + +function runTests() { + local ifname="$1" + local xmldir="$2" + local fwalldir="$3" + local fwallfiles f + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${ifname}" + done +} + + +function checkVM() { + local vmname="$1" + local ifname="$2" + local nwfilter="$3" + local f i c + + c=`${VIRSH} dumpxml ${vmname} | grep -c "<interface"` + if [ ${c} -ne 1 ]; then + echo "VM '${vmname}' has multiple interfaces. I cannot tell for sure " + echo "whether this VM has the correct interface name '${ifname}' and " + echo "reference the filter '${nwfilter}'. Cowardly skipping this VM..." + return 1 + fi + + f=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \ + sed "s/.*filterref filter='$[a-zA-Z0-9_]\+$'.*/\1/"` + i=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \ + sed "s/.*\<interface.*target dev='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + if [ "x${i}x" == "x${ifname}x" ] && [ "x${f}x" == "x${nwfilter}x" ]; then + return 0 + fi + + return 1 +} + + +function main() { + local prgname="$0" + local ifname="${ORIG_IFNAME}" + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms + local filtername="testcase" + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --ifname|-i) shift 1; ifname="$1";; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + if [ `uname` != "Linux" ]; then + echo "This script will only run on Linux." + exit 1; + fi + + vms=`${VIRSH} list | grep running | gawk '{print $2}'` + if [ "x${vms}x" == "xx" ]; then + echo "Error: Need a running VM." + exit 1; + fi + + for vm in ${vms}; do + checkVM "${vm}" "${ifname}" "${filtername}" + if [ $? -eq 0 ]; then + found=1; + break; + fi + done + + if [ ${found} -eq 0 ]; then + echo "Error: Suitable VM seems not to be running. Check the help screen"; + echo "to (--help) to read about requirements to the running VM."; + exit 1; + fi + + runTests "${ifname}" "${xmldir}" "${fwalldir}" +} + +main "$@" Index: libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,14 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,16 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21 +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21 +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21 +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21 +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -114,6 +114,10 @@ mymain(int argc, char **argv) DO_TEST("ref-test"); DO_TEST("ref-rule-test"); + DO_TEST("ipt-no-macspoof-test"); + DO_TEST("icmp-direction-test"); + DO_TEST("icmp-direction2-test"); + DO_TEST("icmp-direction3-test"); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout' priority='500'> + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + <rule action='drop' direction='in' priority='500'> + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,12 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/Makefile.am =================================================================== --- libvirt-acl.orig/tests/Makefile.am +++ libvirt-acl/tests/Makefile.am @@ -74,7 +74,9 @@ EXTRA_DIST = \ xml2vmxdata \ nwfilterxml2xmlout \ nwfilterxml2xmlin \ + nwfilterxml2fwallout \ nwfilterschematest \ + nwfiltervmtest.sh \ $(patsubst %,qemuhelpdata/%,$(qemuhelpdata)) noinst_PROGRAMS = virshtest conftest \

1 0

[libvirt] [PATCH] Fix up python bindings for new event callbacks
by Daniel P. Berrange 08 Apr '10

08 Apr '10

The generator was disabled for the new event callbacks, since they need to be hand written. This patch adds the C and python glue to expose the new APIs in the python binding. The python example program is extended to demonstrate of the code * python/libvirt-override.c: Registration and dispatch of events at the C layer * python/libvirt-override-virConnect.py: Python glue for events * examples/domain-events/events-python/event-test.py: Demo use of new event callbacks --- examples/domain-events/events-python/event-test.py | 22 +- python/libvirt-override-virConnect.py | 45 ++ python/libvirt-override.c | 451 ++++++++++++++++++++ 3 files changed, 517 insertions(+), 1 deletions(-) diff --git a/examples/domain-events/events-python/event-test.py b/examples/domain-events/events-python/event-test.py index 181b389..0c6e2f0 100644 --- a/examples/domain-events/events-python/event-test.py +++ b/examples/domain-events/events-python/event-test.py @@ -412,6 +412,21 @@ def myDomainEventCallback1 (conn, dom, event, detail, opaque): def myDomainEventCallback2 (conn, dom, event, detail, opaque): print "myDomainEventCallback2 EVENT: Domain %s(%s) %s %d" % (dom.name(), dom.ID(), eventToString(event), detail) +def myDomainEventRebootCallback(conn, dom, opaque): + print "myDomainEventRebootCallback: Domain %s(%s)" % (dom.name(), dom.ID()) + +def myDomainEventRTCChangeCallback(conn, dom, utcoffset, opaque): + print "myDomainEventRTCChangeCallback: Domain %s(%s) %d" % (dom.name(), dom.ID(), utcoffset) + +def myDomainEventWatchdogCallback(conn, dom, action, opaque): + print "myDomainEventWatchdogCallback: Domain %s(%s) %d" % (dom.name(), dom.ID(), action) + +def myDomainEventIOErrorCallback(conn, dom, srcpath, devalias, action, opaque): + print "myDomainEventIOErrorCallback: Domain %s(%s) %s %s %d" % (dom.name(), dom.ID(), srcpath, devalias, action) + +def myDomainEventGraphicsCallback(conn, dom, phase, localAddr, remoteAddr, authScheme, subject, opaque): + print "myDomainEventGraphicsCallback: Domain %s(%s) %d %s" % (dom.name(), dom.ID(), phase, authScheme) + def usage(): print "usage: "+os.path.basename(sys.argv[0])+" [uri]" print " uri will default to qemu:///system" @@ -451,7 +466,12 @@ def main(): #Add 2 callbacks to prove this works with more than just one vc.domainEventRegister(myDomainEventCallback1,None) - vc.domainEventRegister(myDomainEventCallback2,None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_LIFECYCLE, myDomainEventCallback2, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_REBOOT, myDomainEventRebootCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_RTC_CHANGE, myDomainEventRTCChangeCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_IO_ERROR, myDomainEventIOErrorCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_WATCHDOG, myDomainEventWatchdogCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_GRAPHICS, myDomainEventGraphicsCallback, None) # The rest of your app would go here normally, but for sake # of demo we'll just go to sleep. The other option is to diff --git a/python/libvirt-override-virConnect.py b/python/libvirt-override-virConnect.py index 1fdf548..444a499 100644 --- a/python/libvirt-override-virConnect.py +++ b/python/libvirt-override-virConnect.py @@ -41,3 +41,48 @@ return 0 except AttributeError: pass + + def dispatchDomainEventLifecycleCallback(self, dom, event, detail, cbData): + """Dispatches events to python user domain event callbacks + """ + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), event, detail, opaque) + return 0 + + def dispatchDomainEventGenericCallback(self, dom, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), opaque) + return 0 + except AttributeError: + pass + + def domainEventDeregisterAny(self, callbackID): + """Removes a Domain Event Callback. De-registering for a + domain callback will disable delivery of this event type """ + try: + ret = libvirtmod.virConnectDomainEventDeregisterAny(self._o, callbackID) + if ret == -1: raise libvirtError ('virConnectDomainEventDeregisterAny() failed', conn=self) + del self.domainEventCallbackID[callbackID] + except AttributeError: + pass + + def domainEventRegisterAny(self, dom, eventID, cb, opaque): + """Adds a Domain Event Callback. Registering for a domain + callback will enable delivery of the events """ + if not hasattr(self, 'domainEventCallbackID'): + self.domainEventCallbackID = {} + cbData = { "cb": cb, "conn": self, "opaque": opaque } + if dom is None: + ret = libvirtmod.virConnectDomainEventRegisterAny(self._o, None, eventID, cbData) + else: + ret = libvirtmod.virConnectDomainEventRegisterAny(self._o, dom._o, eventID, cbData) + if ret == -1: + raise libvirtError ('virConnectDomainEventRegisterAny() failed', conn=self) + self.domainEventCallbackID[ret] = opaque diff --git a/python/libvirt-override.c b/python/libvirt-override.c index e27bce6..02bc313 100644 --- a/python/libvirt-override.c +++ b/python/libvirt-override.c @@ -2761,6 +2761,455 @@ libvirt_virEventInvokeTimeoutCallback(PyObject *self ATTRIBUTE_UNUSED, return VIR_PY_INT_SUCCESS; } + +static void +libvirt_virConnectDomainEventFreeFunc(void *opaque) +{ + PyObject *pyobj_conn = (PyObject*)opaque; + LIBVIRT_ENSURE_THREAD_STATE; + Py_DECREF(pyobj_conn); + LIBVIRT_RELEASE_THREAD_STATE; +} + +static int +libvirt_virConnectDomainEventLifecycleCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + int event, + int detail, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventLifecycleCallback", + (char*)"OiiO", + pyobj_dom, + event, detail, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventGenericCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventGenericCallback", + (char*)"OO", + pyobj_dom, pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventRTCChangeCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + long long utcoffset, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventRTCChangeCallback", + (char*)"OLO", + pyobj_dom, + (PY_LONG_LONG)utcoffset, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventWatchdogCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + int action, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventWatchdogCallback", + (char*)"OiO", + pyobj_dom, + action, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventIOErrorCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventIOErrorCallback", + (char*)"OssiO", + pyobj_dom, + srcPath, devAlias, action, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventGraphicsCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + int phase, + virDomainEventGraphicsAddressPtr local, + virDomainEventGraphicsAddressPtr remote, + const char *authScheme, + virDomainEventGraphicsSubjectPtr subject, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + PyObject *pyobj_local; + PyObject *pyobj_remote; + PyObject *pyobj_subject; + int ret = -1; + int i; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + pyobj_local = PyDict_New(); + PyDict_SetItem(pyobj_local, + libvirt_constcharPtrWrap("family"), + libvirt_intWrap(local->family)); + PyDict_SetItem(pyobj_local, + libvirt_constcharPtrWrap("node"), + libvirt_constcharPtrWrap(local->node)); + PyDict_SetItem(pyobj_local, + libvirt_constcharPtrWrap("service"), + libvirt_constcharPtrWrap(local->service)); + + pyobj_remote = PyDict_New(); + PyDict_SetItem(pyobj_remote, + libvirt_constcharPtrWrap("family"), + libvirt_intWrap(remote->family)); + PyDict_SetItem(pyobj_remote, + libvirt_constcharPtrWrap("node"), + libvirt_constcharPtrWrap(remote->node)); + PyDict_SetItem(pyobj_remote, + libvirt_constcharPtrWrap("service"), + libvirt_constcharPtrWrap(remote->service)); + + pyobj_subject = PyList_New(subject->nidentity); + for (i = 0 ; i < subject->nidentity ; i++) { + PyObject *pair = PyTuple_New(2); + PyTuple_SetItem(pair, 0, libvirt_constcharPtrWrap(subject->identities[i].type)); + PyTuple_SetItem(pair, 1, libvirt_constcharPtrWrap(subject->identities[i].name)); + + PyList_SetItem(pyobj_subject, i, pair); + } + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventGraphicsCallback", + (char*)"OiOOsOO", + pyobj_dom, + phase, pyobj_local, pyobj_remote, + authScheme, pyobj_subject, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static PyObject * +libvirt_virConnectDomainEventRegisterAny(ATTRIBUTE_UNUSED PyObject * self, + PyObject * args) +{ + PyObject *py_retval; /* return value */ + PyObject *pyobj_conn; /* virConnectPtr */ + PyObject *pyobj_dom; + PyObject *pyobj_cbData; /* hash of callback data */ + int eventID; + virConnectPtr conn; + int ret = 0; + virConnectDomainEventGenericCallback cb = NULL; + virDomainPtr dom; + + if (!PyArg_ParseTuple + (args, (char *) "OOiO:virConnectDomainEventRegisterAny", + &pyobj_conn, &pyobj_dom, &eventID, &pyobj_cbData)) { +#if DEBUG_ERROR + printf("%s failed parsing tuple\n", __FUNCTION__); +#endif + return VIR_PY_INT_FAIL; + } + +#ifdef DEBUG_ERROR + printf("libvirt_virConnectDomainEventRegister(%p %p %d %p) called\n", + pyobj_conn, pyobj_dom, eventID, pyobj_cbData); +#endif + conn = PyvirConnect_Get(pyobj_conn); + if (pyobj_dom == Py_None) + dom = NULL; + else + dom = PyvirDomain_Get(pyobj_dom); + + switch (eventID) { + case VIR_DOMAIN_EVENT_ID_LIFECYCLE: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventLifecycleCallback); + break; + case VIR_DOMAIN_EVENT_ID_REBOOT: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventGenericCallback); + break; + case VIR_DOMAIN_EVENT_ID_RTC_CHANGE: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventRTCChangeCallback); + break; + case VIR_DOMAIN_EVENT_ID_WATCHDOG: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventWatchdogCallback); + break; + case VIR_DOMAIN_EVENT_ID_IO_ERROR: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventIOErrorCallback); + break; + case VIR_DOMAIN_EVENT_ID_GRAPHICS: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventGraphicsCallback); + break; + } + + if (!cb) { + return VIR_PY_INT_FAIL; + } + + Py_INCREF(pyobj_cbData); + + LIBVIRT_BEGIN_ALLOW_THREADS; + ret = virConnectDomainEventRegisterAny(conn, dom, eventID, + cb, pyobj_cbData, + libvirt_virConnectDomainEventFreeFunc); + LIBVIRT_END_ALLOW_THREADS; + + if (ret < 0) { + Py_DECREF(pyobj_cbData); + } + + py_retval = libvirt_intWrap(ret); + return (py_retval); +} + +static PyObject * +libvirt_virConnectDomainEventDeregisterAny(ATTRIBUTE_UNUSED PyObject * self, + PyObject * args) +{ + PyObject *py_retval; + PyObject *pyobj_conn; + int callbackID; + virConnectPtr conn; + int ret = 0; + + if (!PyArg_ParseTuple + (args, (char *) "Oi:virConnectDomainEventDeregister", + &pyobj_conn, &callbackID)) + return (NULL); + +#ifdef DEBUG_ERROR + printf("libvirt_virConnectDomainEventDeregister(%p) called\n", pyobj_conn); +#endif + + conn = (virConnectPtr) PyvirConnect_Get(pyobj_conn); + + LIBVIRT_BEGIN_ALLOW_THREADS; + + ret = virConnectDomainEventDeregisterAny(conn, callbackID); + + LIBVIRT_END_ALLOW_THREADS; + py_retval = libvirt_intWrap(ret); + return (py_retval); +} + + /************************************************************************ * * * The registration stuff * @@ -2776,6 +3225,8 @@ static PyMethodDef libvirtMethods[] = { {(char *) "virConnectListDefinedDomains", libvirt_virConnectListDefinedDomains, METH_VARARGS, NULL}, {(char *) "virConnectDomainEventRegister", libvirt_virConnectDomainEventRegister, METH_VARARGS, NULL}, {(char *) "virConnectDomainEventDeregister", libvirt_virConnectDomainEventDeregister, METH_VARARGS, NULL}, + {(char *) "virConnectDomainEventRegisterAny", libvirt_virConnectDomainEventRegisterAny, METH_VARARGS, NULL}, + {(char *) "virConnectDomainEventDeregisterAny", libvirt_virConnectDomainEventDeregisterAny, METH_VARARGS, NULL}, {(char *) "virDomainGetInfo", libvirt_virDomainGetInfo, METH_VARARGS, NULL}, {(char *) "virNodeGetInfo", libvirt_virNodeGetInfo, METH_VARARGS, NULL}, {(char *) "virDomainGetUUID", libvirt_virDomainGetUUID, METH_VARARGS, NULL}, -- 1.6.6.1

2 1

[libvirt] [PATCH] Fix CPU comparison for x86 arch
by Jiri Denemark 08 Apr '10

08 Apr '10

When comparing a CPU to host CPU, the result would be VIR_CPU_COMPARE_SUPERSET (or even VIR_CPU_COMPARE_INCOMPATIBLE if strict match was required) even though the two CPUs were identical. --- src/cpu/cpu_x86.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 46a9fbb..205528d 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -963,8 +963,8 @@ x86Compute(virCPUDefPtr host, x86ModelSubtract(diff, cpu_disable); x86ModelSubtract(diff, cpu_force); - for (i = 0; i < host_model->ncpuid; i++) { - if (!x86cpuidMatch(host_model->cpuid + i, &cpuid_zero)) { + for (i = 0; i < diff->ncpuid; i++) { + if (!x86cpuidMatch(diff->cpuid + i, &cpuid_zero)) { ret = VIR_CPU_COMPARE_SUPERSET; break; } -- 1.7.0.4

2 2

[libvirt] [PATCH] Cleanup x86Compute()
by Jiri Denemark 08 Apr '10

08 Apr '10

No change in semantics. --- src/cpu/cpu_x86.c | 46 +++++++++++++++++----------------------------- 1 files changed, 17 insertions(+), 29 deletions(-) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index e49f7c0..46a9fbb 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -901,7 +901,7 @@ x86Compute(virCPUDefPtr host, struct x86_model *guest_model = NULL; virCPUCompareResult ret; enum compare_result result; - int i; + unsigned int i; if (cpu->arch != NULL) { bool found = false; @@ -919,36 +919,15 @@ x86Compute(virCPUDefPtr host, } } - if ((map = x86LoadMap()) == NULL) - goto error; - - if (!(host_model = x86ModelFromCPU(host, map, 0))) - goto error; - - if (!(cpu_force = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORCE))) - goto error; - - if (!(cpu_require = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_REQUIRE))) - goto error; - - if (!(cpu_optional = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_OPTIONAL))) - goto error; - - if (!(cpu_disable = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_DISABLE))) - goto error; - - if (!(cpu_forbid = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORBID))) + if (!(map = x86LoadMap()) || + !(host_model = x86ModelFromCPU(host, map, 0)) || + !(cpu_force = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORCE)) || + !(cpu_require = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_REQUIRE)) || + !(cpu_optional = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_OPTIONAL)) || + !(cpu_disable = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_DISABLE)) || + !(cpu_forbid = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORBID))) goto error; - x86ModelSubtract(cpu_require, cpu_disable); - - if ((diff = x86ModelCopy(host_model)) == NULL) - goto no_memory; - - x86ModelSubtract(diff, cpu_require); - x86ModelSubtract(diff, cpu_optional); - x86ModelSubtract(diff, cpu_force); - for (i = 0; i < cpu_forbid->ncpuid; i++) { const struct cpuX86cpuid *cpuid1; const struct cpuX86cpuid *cpuid2; @@ -966,6 +945,7 @@ x86Compute(virCPUDefPtr host, } } + x86ModelSubtract(cpu_require, cpu_disable); result = x86ModelCompare(host_model, cpu_require); if (result == SUBSET || result == UNRELATED) { VIR_DEBUG0("Host CPU does not provide all required features"); @@ -975,6 +955,14 @@ x86Compute(virCPUDefPtr host, ret = VIR_CPU_COMPARE_IDENTICAL; + if ((diff = x86ModelCopy(host_model)) == NULL) + goto no_memory; + + x86ModelSubtract(diff, cpu_optional); + x86ModelSubtract(diff, cpu_require); + x86ModelSubtract(diff, cpu_disable); + x86ModelSubtract(diff, cpu_force); + for (i = 0; i < host_model->ncpuid; i++) { if (!x86cpuidMatch(host_model->cpuid + i, &cpuid_zero)) { ret = VIR_CPU_COMPARE_SUPERSET; -- 1.7.0.4

2 2

[libvirt] [PATCH] Properly advertise cpuselection guest capability
by Jiri Denemark 08 Apr '10

08 Apr '10

There's no sense in advertising cpuselection capability when host CPU is not properly detected and advertised in host capabilities. --- src/qemu/qemu_conf.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 3fb0074..ff5bd43 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -892,7 +892,8 @@ qemudCapsInitGuest(virCapsPtr caps, guest->arch.defaultInfo.emulator_mtime = binary_mtime; - if (qemudProbeCPUModels(binary, info->arch, &ncpus, NULL) == 0 + if (caps->host.cpu + && qemudProbeCPUModels(binary, info->arch, &ncpus, NULL) == 0 && ncpus > 0 && !virCapabilitiesAddGuestFeature(guest, "cpuselection", 1, 0)) goto error; -- 1.7.0.4

2 4

[libvirt] [PATCH] qemudDomainGetSecurityLabel: avoid dead store to "type"
by Jim Meyering 08 Apr '10

08 Apr '10

And another: >From 61f50761015a82906aec31e5a1cdeef0eaf2b0a1 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 7 Apr 2010 17:51:56 +0200 Subject: [PATCH] qemudDomainGetSecurityLabel: avoid dead store to "type" * src/qemu/qemu_driver.c (qemudDomainGetSecurityLabel): Remove store and declaration. --- src/qemu/qemu_driver.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 1e60591..f5cf1f1 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5564,7 +5564,6 @@ static int qemudDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr sec { struct qemud_driver *driver = (struct qemud_driver *)dom->conn->privateData; virDomainObjPtr vm; - const char *type; int ret = -1; qemuDriverLock(driver); @@ -5580,7 +5579,7 @@ static int qemudDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr sec goto cleanup; } - if (!(type = virDomainVirtTypeToString(vm->def->virtType))) { + if (!virDomainVirtTypeToString(vm->def->virtType)) { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("unknown virt type in domain definition '%d'"), vm->def->virtType); -- 1.7.1.rc0.212.gbd88f

2 2

[libvirt] [PATCH] Don't ignore guest CPU selection when unsupported by HV
by Jiri Denemark 08 Apr '10

08 Apr '10

When qemu libvirt driver doesn't support guest CPU selection with given qemu binary, guests requiring specific CPU should fail to start instead of being silently supplied with a default CPU. --- src/qemu/qemu_conf.c | 13 ++++++++++--- 1 files changed, 10 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 592360f..3fb0074 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -3249,9 +3249,16 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, virBuffer buf = VIR_BUFFER_INITIALIZER; int i; - if (def->cpu && def->cpu->model - && qemudProbeCPUModels(emulator, ut->machine, &ncpus, &cpus) < 0) - goto cleanup; + if (def->cpu && def->cpu->model) { + if (qemudProbeCPUModels(emulator, ut->machine, &ncpus, &cpus) < 0) + goto cleanup; + + if (!ncpus || !host) { + qemuReportError(VIR_ERR_NO_SUPPORT, "%s", + _("CPU specification not supported by hypervisor")); + goto cleanup; + } + } if (ncpus > 0 && host) { virCPUCompareResult cmp; -- 1.7.0.4

2 2

[libvirt] [PATCH] Document all options of virsh dumpxml
by Jiri Denemark 08 Apr '10

08 Apr '10

--- tools/virsh.pod | 13 +++++++++---- 1 files changed, 9 insertions(+), 4 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index a59e9b0..9e9f4e0 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -342,10 +342,15 @@ configuration format named by I<format>. Dumps the core of a domain to a file for analysis. -=item B<dumpxml> I<domain-id> - -Output the domain information as an XML dump to stdout, this format -can be used by the B<create> command. +=item B<dumpxml> I<domain-id> optional I<--inactive> I<--security-info> I<--update-cpu> + +Output the domain information as an XML dump to stdout, this format can be used +by the B<create> command. Additional options affecting the XML dump may be +used. I<--inactive> tells virsh to dump domain configuration that will be used +on next start of the domain as opposed to the current domain configuration. +Using I<--security-info> security sensitive information will also be included +in the XML dump. I<--update-cpu> updates domain CPU requirements according to +host CPU. =item B<edit> I<domain-id> -- 1.7.0.4

2 2

[libvirt] [PATCH] createRawFileOpHook: avoid dead stores
by Jim Meyering 08 Apr '10

08 Apr '10

Here are two more dead stores. >From 7c3d498d8572556d72d4633e9b39f89a08a0a682 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 7 Apr 2010 18:30:55 +0200 Subject: [PATCH] createRawFileOpHook: avoid dead stores * src/storage/storage_backend.c (createRawFileOpHook): Remove dead stores and declaration of each stored-to variable. --- src/storage/storage_backend.c | 9 +++------ 1 files changed, 3 insertions(+), 6 deletions(-) diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index 7294a00..f0074ed 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -308,12 +308,11 @@ static int createRawFileOpHook(int fd, void *data) { * update every 9s is a fair-enough trade-off */ unsigned long long bytes = 512 * 1024 * 1024; - int r; if (bytes > remain) bytes = remain; - if ((r = safezero(fd, 0, hdata->vol->allocation - remain, - bytes)) != 0) { + if (safezero(fd, 0, hdata->vol->allocation - remain, + bytes) != 0) { ret = errno; virReportSystemError(errno, _("cannot fill file '%s'"), hdata->vol->target.path); @@ -322,9 +321,7 @@ static int createRawFileOpHook(int fd, void *data) { remain -= bytes; } } else { /* No progress bars to be shown */ - int r; - - if ((r = safezero(fd, 0, 0, remain)) != 0) { + if (safezero(fd, 0, 0, remain) != 0) { ret = errno; virReportSystemError(errno, _("cannot fill file '%s'"), hdata->vol->target.path); -- 1.7.1.rc0.212.gbd88f

2 1

[libvirt] [PATCH] xenXMDomainDefineXML: remove dead store and useless/leaky virGetDomain
by Jim Meyering 08 Apr '10

08 Apr '10

clang complained about the dead store. Dan Berrange confirmed that this code has been useless-looking for ages. >From e6315e0b0d4b83b744cff86529b6b9e3144e2012 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 7 Apr 2010 20:17:44 +0200 Subject: [PATCH] xenXMDomainDefineXML: remove dead store and useless/leaky virGetDomain * src/xen/xm_internal.c (xenXMDomainDefineXML): Remove useless and leak-inducing call to virGetDomain, as well as decl of now-unused local. --- src/xen/xm_internal.c | 5 ----- 1 files changed, 0 insertions(+), 5 deletions(-) diff --git a/src/xen/xm_internal.c b/src/xen/xm_internal.c index d1265ba..a7a09a0 100644 --- a/src/xen/xm_internal.c +++ b/src/xen/xm_internal.c @@ -2622,7 +2622,6 @@ cleanup: */ virDomainPtr xenXMDomainDefineXML(virConnectPtr conn, const char *xml) { virDomainPtr ret; - virDomainPtr olddomain; char filename[PATH_MAX]; const char * oldfilename; virDomainDefPtr def = NULL; @@ -2688,10 +2687,6 @@ virDomainPtr xenXMDomainDefineXML(virConnectPtr conn, const char *xml) { goto error; } - /* XXX wtf.com is this line for - it appears to be amemory leak */ - if (!(olddomain = virGetDomain(conn, def->name, entry->def->uuid))) - goto error; - /* Remove the name -> filename mapping */ if (virHashRemoveEntry(priv->nameConfigMap, def->name, NULL) < 0) { xenXMError(VIR_ERR_INTERNAL_ERROR, -- 1.7.1.rc0.212.gbd88f

2 1

[libvirt] qemuDomainSnapshotLoad leak
by Jim Meyering 08 Apr '10

08 Apr '10

clang reports that the assignment to "snap" below is a dead store. Actually it's also a leak, and it seems like it deserves a diagnostic if/when that function returns NULL. It looks to me like this function should return something other than "void", so that it can inform its caller of such a failure. No? This is from qemu_driver.c: static void qemuDomainSnapshotLoad(void *payload, const char *name ATTRIBUTE_UNUSED, void *data) { ... virDomainSnapshotObjPtr snap = NULL; ... while ((entry = readdir(dir))) { ... def = virDomainSnapshotDefParseString(xmlStr, 0); if (def == NULL) { /* Nothing we can do here, skip this one */ VIR_ERROR("Failed to parse snapshot XML from file '%s'", fullpath); VIR_FREE(xmlStr); continue; } snap = virDomainSnapshotAssignDef(&vm->snapshots, def); VIR_FREE(xmlStr); } /* FIXME: qemu keeps internal track of snapshots. We can get access * to this info via the "info snapshots" monitor command for running * domains, or via "qemu-img snapshot -l" for shutoff domains. It would * be nice to update our internal state based on that, but there is a * a problem. qemu doesn't track all of the same metadata that we do. * In particular we wouldn't be able to fill in the <parent>, which is * pretty important in our metadata. */ virResetLastError(); cleanup: if (dir) closedir(dir); VIR_FREE(snapDir); virDomainObjUnlock(vm); }

2 4

[libvirt] [PATCH] maint: s/initialis/initializ/
by Eric Blake 08 Apr '10

08 Apr '10

git grep found 12 of the former but 100 of the latter in src/. * src/remote/remote_driver.c (initialise_gnutls): Rename... (initialize_gnutls): ...to this. (doRemoteOpen): Adjust caller. * src/xen/xen_driver.c (xenUnifiedOpen): Adjust output string. * src/util/network.c: Adjust comments. Suggested by Matthias Bolte. --- Should be a pretty trivial conversion from British to American English for a single word. Is it worth adding a rule to cfg.mk to have 'make syntax-check' diagnose future introductions of 'initialis.*'? src/remote/remote_driver.c | 14 +++++++------- src/util/network.c | 8 ++++---- src/xen/xen_driver.c | 4 ++-- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 20ad6c8..d5b68dd 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -271,7 +271,7 @@ void remoteDomainEventQueueFlush(int timer, void *opaque); static char *get_transport_from_scheme (char *scheme); /* GnuTLS functions used by remoteOpen. */ -static int initialise_gnutls (virConnectPtr conn); +static int initialize_gnutls (virConnectPtr conn); static gnutls_session_t negotiate_gnutls_on_connection (virConnectPtr conn, struct private_data *priv, int no_verify); #ifdef WITH_LIBVIRTD @@ -425,7 +425,7 @@ doRemoteOpen (virConnectPtr conn, transport = trans_unix; } - /* Local variables which we will initialise. These can + /* Local variables which we will initialize. These can * get freed in the failed: path. */ char *name = NULL, *command = NULL, *sockname = NULL, *netcat = NULL; @@ -579,7 +579,7 @@ doRemoteOpen (virConnectPtr conn, /* Connect to the remote service. */ switch (transport) { case trans_tls: - if (initialise_gnutls (conn) == -1) goto failed; + if (initialize_gnutls (conn) == -1) goto failed; priv->uses_tls = 1; priv->is_secure = 1; @@ -1140,12 +1140,12 @@ check_cert_file(const char *type, const char *file) static int -initialise_gnutls (virConnectPtr conn) +initialize_gnutls (virConnectPtr conn) { - static int initialised = 0; + static int initialized = 0; int err; - if (initialised) return 0; + if (initialized) return 0; gnutls_global_init (); @@ -1193,7 +1193,7 @@ initialise_gnutls (virConnectPtr conn) return -1; } - initialised = 1; + initialized = 1; return 0; } diff --git a/src/util/network.c b/src/util/network.c index 76f2791..6e24792 100644 --- a/src/util/network.c +++ b/src/util/network.c @@ -1,7 +1,7 @@ /* * network.c: network helper APIs for libvirt * - * Copyright (C) 2009-2009 Red Hat, Inc. + * Copyright (C) 2009-2010 Red Hat, Inc. * * See COPYING.LIB for the License of this software * @@ -116,7 +116,7 @@ virSocketParseIpv6Addr(const char *val, virSocketAddrPtr addr) { /* * virSocketFormatAddr: - * @addr: an initialised virSocketAddrPtr + * @addr: an initialized virSocketAddrPtr * * Returns a string representation of the given address * Returns NULL on any error @@ -158,7 +158,7 @@ virSocketFormatAddr(virSocketAddrPtr addr) { /* * virSocketSetPort: - * @addr: an initialised virSocketAddrPtr + * @addr: an initialized virSocketAddrPtr * @port: the port number to set * * Set the transport layer port of the given virtSocketAddr @@ -189,7 +189,7 @@ virSocketSetPort(virSocketAddrPtr addr, int port) { /* * virSocketGetPort: - * @addr: an initialised virSocketAddrPtr + * @addr: an initialized virSocketAddrPtr * * Returns the transport layer port of the given virtSocketAddr * Returns -1 if @addr is invalid diff --git a/src/xen/xen_driver.c b/src/xen/xen_driver.c index 68b627a..5ab169d 100644 --- a/src/xen/xen_driver.c +++ b/src/xen/xen_driver.c @@ -297,7 +297,7 @@ xenUnifiedOpen (virConnectPtr conn, virConnectAuthPtr auth, int flags) } if (virMutexInit(&priv->lock) < 0) { xenUnifiedError(VIR_ERR_INTERNAL_ERROR, - "%s", _("cannot initialise mutex")); + "%s", _("cannot initialize mutex")); VIR_FREE(priv); return VIR_DRV_OPEN_ERROR; } @@ -1892,7 +1892,7 @@ out: } -/*----- Register with libvirt.c, and initialise Xen drivers. -----*/ +/*----- Register with libvirt.c, and initialize Xen drivers. -----*/ /* The interface which we export upwards to libvirt.c. */ static virDriver xenUnifiedDriver = { -- 1.6.6.1

2 2

[libvirt] Live Migration with non-shared storage for kvm
by Kenneth Nagin 08 Apr '10

08 Apr '10

On February 16th I posted a patch and description for libvirt support of 'Live Migration with non-shared strorage for kvm.' What is the status of the proposed enhancement? Kenneth Nagin

2 4

[libvirt] [PATCH] domain_event.c: don't deref NULL on an OOM error path
by Jim Meyering 08 Apr '10

08 Apr '10

This fixes a pair of potential segfault-inducing bugs: >From 7ca7e9cd366b17e41da9207b68de7e9166a88da2 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Mon, 29 Mar 2010 17:43:01 +0200 Subject: [PATCH] domain_event.c: don't deref NULL on an OOM error path * src/conf/domain_event.c (virDomainEventGraphicsNewFromDom): Return NULL when handling out-of-memory error, rather than falling through with ev=NULL and then assigning to ev->member. (virDomainEventGraphicsNewFromObj): Likewise. --- src/conf/domain_event.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_event.c b/src/conf/domain_event.c index 41c70fc..1cf03e3 100644 --- a/src/conf/domain_event.c +++ b/src/conf/domain_event.c @@ -681,19 +681,19 @@ virDomainEventPtr virDomainEventGraphicsNewFromDom(virDomainPtr dom, { virDomainEventPtr ev = virDomainEventNewInternal(VIR_DOMAIN_EVENT_ID_GRAPHICS, dom->id, dom->name, dom->uuid); if (ev) { ev->data.graphics.phase = phase; if (!(ev->data.graphics.authScheme = strdup(authScheme))) { virDomainEventFree(ev); - ev = NULL; + return NULL; } ev->data.graphics.local = local; ev->data.graphics.remote = remote; ev->data.graphics.subject = subject; } return ev; } @@ -706,19 +706,19 @@ virDomainEventPtr virDomainEventGraphicsNewFromObj(virDomainObjPtr obj, { virDomainEventPtr ev = virDomainEventNewInternal(VIR_DOMAIN_EVENT_ID_GRAPHICS, obj->def->id, obj->def->name, obj->def->uuid); if (ev) { ev->data.graphics.phase = phase; if (!(ev->data.graphics.authScheme = strdup(authScheme))) { virDomainEventFree(ev); - ev = NULL; + return NULL; } ev->data.graphics.local = local; ev->data.graphics.remote = remote; ev->data.graphics.subject = subject; } return ev; } -- 1.7.0.3.448.g82eeb

2 2

[libvirt] [TCK PATCH] maint: use correct Red Hat copyright
by Eric Blake 08 Apr '10

08 Apr '10

* scripts/domain/050-transient-lifecycle.t: Correct the copyright line. * scripts/domain/051-transient-autostart.t: Likewise. * scripts/domain/060-persistent-lifecycle.t: Likewise. * scripts/domain/061-persistent-autostart.t: Likewise. * scripts/domain/065-persistent-redefine.t: Likewise. * scripts/domain/070-transient-to-persistent.t: Likewise. * scripts/domain/080-unique-id-define.t: Likewise. * scripts/domain/081-unique-id-create.t: Likewise. * scripts/domain/090-invalid-ops-when-inactive.t: Likewise. * scripts/domain/100-transient-save-restore.t: Likewise. * scripts/domain/101-persistent-save-restore.t: Likewise. * scripts/domain/102-broken-save-restore.t: Likewise. * scripts/domain/120-disks-stats.t: Likewise. * scripts/domain/200-disk-hotplug.t: Likewise. * scripts/domain/205-disk-hotplug-ordering.t: Likewise. * scripts/domain/210-nic-hotplug.t: Likewise. * scripts/domain/215-nic-hotplug-many.t: Likewise. * scripts/domain/240-usb-host-hotplug.t: Likewise. * scripts/domain/250-pci-host-hotplug.t: Likewise. * scripts/qemu/100-disk-encryption.t: Likewise. * scripts/storage/100-create-vol-dir.t: Likewise. * scripts/storage/200-clone-vol-dir.t: Likewise. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- This probably counts as trivial, but since this is my first libvirt-tck patch, I thought I'd ask first. scripts/domain/050-transient-lifecycle.t | 2 +- scripts/domain/051-transient-autostart.t | 2 +- scripts/domain/060-persistent-lifecycle.t | 2 +- scripts/domain/061-persistent-autostart.t | 2 +- scripts/domain/065-persistent-redefine.t | 2 +- scripts/domain/070-transient-to-persistent.t | 2 +- scripts/domain/080-unique-id-define.t | 2 +- scripts/domain/081-unique-id-create.t | 2 +- scripts/domain/090-invalid-ops-when-inactive.t | 2 +- scripts/domain/100-transient-save-restore.t | 2 +- scripts/domain/101-persistent-save-restore.t | 2 +- scripts/domain/102-broken-save-restore.t | 2 +- scripts/domain/120-disks-stats.t | 2 +- scripts/domain/200-disk-hotplug.t | 2 +- scripts/domain/205-disk-hotplug-ordering.t | 2 +- scripts/domain/210-nic-hotplug.t | 2 +- scripts/domain/215-nic-hotplug-many.t | 2 +- scripts/domain/240-usb-host-hotplug.t | 2 +- scripts/domain/250-pci-host-hotplug.t | 2 +- scripts/qemu/100-disk-encryption.t | 2 +- scripts/storage/100-create-vol-dir.t | 2 +- scripts/storage/200-clone-vol-dir.t | 2 +- 22 files changed, 22 insertions(+), 22 deletions(-) diff --git a/scripts/domain/050-transient-lifecycle.t b/scripts/domain/050-transient-lifecycle.t index 22e5c70..89c9d1a 100644 --- a/scripts/domain/050-transient-lifecycle.t +++ b/scripts/domain/050-transient-lifecycle.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/051-transient-autostart.t b/scripts/domain/051-transient-autostart.t index 9114a28..d43caa1 100644 --- a/scripts/domain/051-transient-autostart.t +++ b/scripts/domain/051-transient-autostart.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/060-persistent-lifecycle.t b/scripts/domain/060-persistent-lifecycle.t index 55bdc6c..ddffa02 100644 --- a/scripts/domain/060-persistent-lifecycle.t +++ b/scripts/domain/060-persistent-lifecycle.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/061-persistent-autostart.t b/scripts/domain/061-persistent-autostart.t index c39ec72..5200454 100644 --- a/scripts/domain/061-persistent-autostart.t +++ b/scripts/domain/061-persistent-autostart.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/065-persistent-redefine.t b/scripts/domain/065-persistent-redefine.t index 712803c..c19b292 100644 --- a/scripts/domain/065-persistent-redefine.t +++ b/scripts/domain/065-persistent-redefine.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/070-transient-to-persistent.t b/scripts/domain/070-transient-to-persistent.t index 346b329..7d85ef6 100644 --- a/scripts/domain/070-transient-to-persistent.t +++ b/scripts/domain/070-transient-to-persistent.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/080-unique-id-define.t b/scripts/domain/080-unique-id-define.t index 066c2e8..ed4a8fc 100644 --- a/scripts/domain/080-unique-id-define.t +++ b/scripts/domain/080-unique-id-define.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/081-unique-id-create.t b/scripts/domain/081-unique-id-create.t index c081674..425116f 100644 --- a/scripts/domain/081-unique-id-create.t +++ b/scripts/domain/081-unique-id-create.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/090-invalid-ops-when-inactive.t b/scripts/domain/090-invalid-ops-when-inactive.t index 28f4936..86f332b 100644 --- a/scripts/domain/090-invalid-ops-when-inactive.t +++ b/scripts/domain/090-invalid-ops-when-inactive.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/100-transient-save-restore.t b/scripts/domain/100-transient-save-restore.t index 314493c..bab42da 100644 --- a/scripts/domain/100-transient-save-restore.t +++ b/scripts/domain/100-transient-save-restore.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/101-persistent-save-restore.t b/scripts/domain/101-persistent-save-restore.t index 251aacd..f1c8d4b 100644 --- a/scripts/domain/101-persistent-save-restore.t +++ b/scripts/domain/101-persistent-save-restore.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/102-broken-save-restore.t b/scripts/domain/102-broken-save-restore.t index 2981d64..b93e274 100644 --- a/scripts/domain/102-broken-save-restore.t +++ b/scripts/domain/102-broken-save-restore.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/120-disks-stats.t b/scripts/domain/120-disks-stats.t index c8b3420..5cbaf8c 100644 --- a/scripts/domain/120-disks-stats.t +++ b/scripts/domain/120-disks-stats.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/200-disk-hotplug.t b/scripts/domain/200-disk-hotplug.t index 1272448..0f10dbf 100644 --- a/scripts/domain/200-disk-hotplug.t +++ b/scripts/domain/200-disk-hotplug.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/205-disk-hotplug-ordering.t b/scripts/domain/205-disk-hotplug-ordering.t index f41d45c..a2e3088 100644 --- a/scripts/domain/205-disk-hotplug-ordering.t +++ b/scripts/domain/205-disk-hotplug-ordering.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/210-nic-hotplug.t b/scripts/domain/210-nic-hotplug.t index 6451fd2..7521978 100644 --- a/scripts/domain/210-nic-hotplug.t +++ b/scripts/domain/210-nic-hotplug.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/215-nic-hotplug-many.t b/scripts/domain/215-nic-hotplug-many.t index 48fdfcf..7465f2c 100644 --- a/scripts/domain/215-nic-hotplug-many.t +++ b/scripts/domain/215-nic-hotplug-many.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/240-usb-host-hotplug.t b/scripts/domain/240-usb-host-hotplug.t index ac71e7b..6e74434 100644 --- a/scripts/domain/240-usb-host-hotplug.t +++ b/scripts/domain/240-usb-host-hotplug.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009-2010 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009-2010 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/250-pci-host-hotplug.t b/scripts/domain/250-pci-host-hotplug.t index 5bb4fd9..a9fe422 100644 --- a/scripts/domain/250-pci-host-hotplug.t +++ b/scripts/domain/250-pci-host-hotplug.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009-2010 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009-2010 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/qemu/100-disk-encryption.t b/scripts/qemu/100-disk-encryption.t index 5964aa5..d594607 100644 --- a/scripts/qemu/100-disk-encryption.t +++ b/scripts/qemu/100-disk-encryption.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/storage/100-create-vol-dir.t b/scripts/storage/100-create-vol-dir.t index 2a09036..3a12596 100644 --- a/scripts/storage/100-create-vol-dir.t +++ b/scripts/storage/100-create-vol-dir.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/storage/200-clone-vol-dir.t b/scripts/storage/200-clone-vol-dir.t index dbc17c5..3b4d864 100644 --- a/scripts/storage/200-clone-vol-dir.t +++ b/scripts/storage/200-clone-vol-dir.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify -- 1.6.6.1

3 5

[libvirt] [PATCH] nwfiler: fix due to non-symmetric src mac address match in iptables
by Stefan Berger 07 Apr '10

07 Apr '10

The attached patch fixes a problem due to the mac match in iptables only supporting --mac-source and no --mac-destination, thus it not being symmetric. Therefore a rule like this one <rule action='drop' direction='out'> <all match='no' srcmacaddr='$MAC'/> </rule> should only have the MAC match on traffic leaving the VM and not test for the same source MAC address on traffic that the VM receives. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 61 +++++++++++++++++++++++++----- 1 file changed, 51 insertions(+), 10 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -772,11 +772,18 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterHashTablePtr vars, nwItemDescPtr srcMacAddr, - int directionIn ATTRIBUTE_UNUSED) + int directionIn, + bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; + *srcmacskipped = false; if (HAS_ENTRY_ITEM(srcMacAddr)) { + if (directionIn) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr)) @@ -1039,6 +1046,8 @@ _iptablesCreateRuleInstance(int directio virBuffer buf = VIR_BUFFER_INITIALIZER; const char *target; const char *iptables_cmd = (isIPv6) ? IP6TABLES_CMD : IPTABLES_CMD; + unsigned int bufUsed; + bool srcMacSkipped = false; PRINT_IPT_ROOT_CHAIN(chain, chainPrefix, ifname); @@ -1052,10 +1061,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p tcp"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1093,10 +1105,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p udp"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1121,10 +1136,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p udplite"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1144,10 +1162,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p esp"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1167,10 +1188,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p ah"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1190,10 +1214,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p sctp"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1221,10 +1248,13 @@ _iptablesCreateRuleInstance(int directio else virBufferAddLit(&buf, " -p icmpv6"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1272,10 +1302,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p igmp"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1295,10 +1328,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p all"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1313,6 +1349,11 @@ _iptablesCreateRuleInstance(int directio return -1; } + if (srcMacSkipped && bufUsed == virBufferUse(&buf)) { + virBufferFreeAndReset(&buf); + return 0; + } + if (match) virBufferVSprintf(&buf, " %s", match);

2 2

[libvirt] qemu smbios options in domain xml format
by vincent 07 Apr '10

07 Apr '10

Still no support for the smbios arg ? any other way to pass this arg to qemu (and continue to use libvirt)? Vincent On 12/09/2009 10:47 PM, Phillip Balli wrote: Hello, I could not find any explicit mention of support for the -smbios options which are present in qemu 0.10.5+ in the domain xml format or the qemu/kvm hypervisor driver pages. Is there some way to specify commands and options which are not described in the xml config by adjusting something in the way libvirt processes the xml? Or is providing smbios options just not supported currently? No, it's currently not supported. Paolo

1 0

[libvirt] [PATCH] qemu_driver.c: don't close an arbitrary file descriptor
by Jim Meyering 07 Apr '10

07 Apr '10

clang spotted this: An early failure makes us "goto" the cleanup code that tests (and probably closes) the "logfile" fd. >From 49e46a427832681b686b712fbfbc24a312c286c1 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 7 Apr 2010 09:17:27 +0200 Subject: [PATCH] qemu_driver.c: don't close an arbitrary file descriptor * src/qemu/qemu_driver.c (qemudStartVMDaemon): Initialize "logfile" to ensure that we don't use it uninitialized -- thus closing an arbitrary file descriptor -- in the cleanup block. --- src/qemu/qemu_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ce43fd3..60fa95a 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -3159,7 +3159,7 @@ static int qemudStartVMDaemon(virConnectPtr conn, int pos = -1; char ebuf[1024]; char *pidfile = NULL; - int logfile; + int logfile = -1; qemuDomainObjPrivatePtr priv = vm->privateData; struct qemudHookData hookData; -- 1.7.0.4.552.gc303

2 1

[libvirt] [Fwd: Re: virsh dump blocking problem]
by Gui Jianfeng 07 Apr '10

07 Apr '10

Hi all, I think this is the right place to post the problem here. :) So I forward this mail. =========== On Tue, 06 Apr 2010 09:35:09 +0800 Gui Jianfeng <guijianfeng(a)cn.fujitsu.com> wrote: > Hi all, > > I'm not sure whether it's appropriate to post the problem here. > I played with "virsh" under Fedora 12, and started a KVM fedora12 guest > by "virsh start" command. The fedora12 guest is successfully started. > Than I run the following command to dump the guest core: > #virsh dump 1 mycoredump (domain id is 1) > > This command seemed blocking and not return. According to he strace > output, virsh dump seems that it's blocking at poll() call. I think > the following should be the call trace of virsh. > > cmdDump() > -> virDomainCoreDump() > -> remoteDomainCoreDump() > -> call() > -> remoteIO() > -> remoteIOEventLoop() > -> poll(fds, ARRAY_CARDINALITY(fds), -1) > > > Any one encounters this problem also, any thoughts? > I met and it seems qemu-kvm continues to counting the number of dirty pages and does no answer to libvirt. Guest never work and I have to kill it. I met this with 2.6.32+ qemu-0.12.3+ libvirt 0.7.7.1. When I updated the host kernel to 2.6.33, qemu-kvm never work. So, I moved back to fedora12's latest qemu-kvm. Now, 2.6.34-rc3+ qemu-0.11.0-13.fc12.x86_64 + libvirt 0.7.7.1 # virsh dump xxxx xxxx hangs. In most case, I see following 2 back trace.(with gdb) (gdb) bt #0 ram_save_remaining () at /usr/src/debug/qemu-kvm-0.11.0/vl.c:3104 #1 ram_bytes_remaining () at /usr/src/debug/qemu-kvm-0.11.0/vl.c:3112 #2 0x00000000004ab2cf in do_info_migrate (mon=0x16b7970) at migration.c:150 #3 0x0000000000414b1a in monitor_handle_command (mon=<value optimized out>, cmdline=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/monitor.c:2870 #4 0x0000000000414c6a in monitor_command_cb (mon=0x16b7970, cmdline=<value optimized out>, opaque=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/monitor.c:3160 #5 0x000000000048b71b in readline_handle_byte (rs=0x208d6a0, ch=<value optimized out>) at readline.c:369 #6 0x0000000000414cdc in monitor_read (opaque=<value optimized out>, buf=0x7fff1b1104b0 "info migrate\r", size=13) at /usr/src/debug/qemu-kvm-0.11.0/monitor.c:3146 #7 0x00000000004b2a53 in tcp_chr_read (opaque=0x1614c30) at qemu-char.c:2006 #8 0x000000000040a6c7 in main_loop_wait (timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:4188 #9 0x000000000040eed5 in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:4414 #10 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:6263 (gdb) bt #0 0x0000003c2680e0bd in write () at ../sysdeps/unix/syscall-template.S:82 #1 0x00000000004b304a in unix_write (fd=11, buf=<value optimized out>, len1=40) at qemu-char.c:512 #2 send_all (fd=11, buf=<value optimized out>, len1=40) at qemu-char.c:528 #3 0x0000000000411201 in monitor_flush (mon=0x16b7970) at /usr/src/debug/qemu-kvm-0.11.0/monitor.c:131 #4 0x0000000000414cdc in monitor_read (opaque=<value optimized out>, buf=0x7fff1b1104b0 "info migrate\r", size=13) at /usr/src/debug/qemu-kvm-0.11.0/monitor.c:3146 #5 0x00000000004b2a53 in tcp_chr_read (opaque=0x1614c30) at qemu-char.c:2006 #6 0x000000000040a6c7 in main_loop_wait (timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:4188 #7 0x000000000040eed5 in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:4414 #8 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:6263 And see no dump progress. I'm sorry if this is not a hang but just verrrrry slow. I don't see any progress at lease for 15 minutes and qemu-kvm continues to use 75% of cpus. I'm not sure why "dump" command trigger migration code... How long it takes to do "virsh dump xxx xxxx", an idle VM with 2G memory ? I'm sorry if I ask wrong mailing list. Thanks, -Kame

1 0

[libvirt] Linux-vServer Support in libvirt
by Walter Stanish 07 Apr '10

07 Apr '10

Hi libvir-list (cc: vserver list), I am another Linux-vServer user who would like to see support in libvirt. >From a very brief look back through the archives it appears that there may have been some architectural concerns re: libvirt's assumptions about what kind of network stack a virtualisation platform provides, in that Linux-vServer doesn't use a traditional approach to networking and thus may break previously valid assumptions. I found 2007 posts and a post last year (2009). Would it be possible for someone with a good overall understanding of previous integration attempts and the results thereof to summarise what issues were encountered and how difficult it would be to overcome these, so that users can understand what's going on. Thanks! - Walter

3 2

[libvirt] Release schedule ... 0.8.0 coming
by Daniel Veillard 07 Apr '10

07 Apr '10

Okay, since the snapshot API is in I suggest to start the freeze toward the 0.8.0 release. There is still 3 things I think we should look at and allow: 1/ the very large cleanup patch set from Matthias, as this should not break anything (isn't it :-) 2/ the nwfilter IP detection code, it still need a review, I didn't do it, libpcap intimidates me a bit, but I think I can be convinced. 3/ an ESX snapshot support if Matthias (or someone else !) manage to write one in the next days 2/ and 3/ sound fairly contained and about a new functionalitry in this release so the risk of breaking an existing feature is very limited. So hopefully we can ship 0.8.0 by the end of the week-end, now we need testing testing testing :-) Thanks ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

3 3

[libvirt] [PATCH] nwfilter: Add filter schema for nwfilter XML, extend domain XML schema
by Stefan Berger 07 Apr '10

07 Apr '10

This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Signed-off-by: Gerhard Stenzel <gerhard.stenzel(a)de.ibm.com> --- docs/schemas/Makefile.am | 3 docs/schemas/domain.rng | 31 + docs/schemas/nwfilter.rng | 783 ++++++++++++++++++++++++++++++++++++++++++++++ libvirt.spec.in | 1 tests/Makefile.am | 4 tests/nwfilterschematest | 11 6 files changed, 831 insertions(+), 2 deletions(-) Index: libvirt-acl/docs/schemas/Makefile.am =================================================================== --- libvirt-acl.orig/docs/schemas/Makefile.am +++ libvirt-acl/docs/schemas/Makefile.am @@ -10,6 +10,7 @@ schema_DATA = \ storagepool.rng \ storagevol.rng \ nodedev.rng \ - capability.rng + capability.rng \ + nwfilter.rng EXTRA_DIST = $(schema_DATA) Index: libvirt-acl/libvirt.spec.in =================================================================== --- libvirt-acl.orig/libvirt.spec.in +++ libvirt-acl/libvirt.spec.in @@ -785,6 +785,7 @@ fi %{_datadir}/libvirt/schemas/interface.rng %{_datadir}/libvirt/schemas/secret.rng %{_datadir}/libvirt/schemas/storageencryption.rng +%{_datadir}/libvirt/schemas/filter.rng %{_datadir}/libvirt/cpu_map.xml Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- /dev/null +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -0,0 +1,783 @@ +<?xml version="1.0" encoding="UTF-8"?> +<grammar ns="" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes"> + <start> + <ref name="filter"/> + </start> + <define name="filter"> + <element name="filter"> + <ref name="filter-node-attributes"/> + <zeroOrMore> + <choice> + <element name="filterref"> + <ref name="filterref-node-attributes"/> + </element> + <element name="uuid"> + <ref name="UUID"/> + </element> + </choice> + </zeroOrMore> + <zeroOrMore> + <element name="rule"> + <ref name="rule-node-attributes"/> + <optional> + <zeroOrMore> + <element name="mac"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="mac-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="arp"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="arp-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ip"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-port-attributes"/> + <ref name="ip-attributes"/> + <ref name="dscp-attribute"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ipv6"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-port-attributes"/> + <ref name="ip-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="tcp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="sctp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="icmp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + <ref name="icmp-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="igmp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="all"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="esp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ah"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udplite"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="tcp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="sctp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="icmpv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + <ref name="icmp-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="all-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="esp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ah-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udplite-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + </element> + </zeroOrMore> + </element> + </define> + +  + + <define name="filter-node-attributes"> + <attribute name="name"> + <data type="NCName"/> + </attribute> + <optional> + <attribute name="chain"> + <choice> + <value>root</value> + <value>arp</value> + <value>ipv4</value> + <value>ipv6</value> + </choice> + </attribute> + </optional> + </define> + + <define name="filterref-node-attributes"> + <attribute name="filter"> + <data type="NCName"/> + </attribute> + <optional> + <element name="parameter"> + <attribute name="name"> + <ref name="parameter-name"/> + </attribute> + <attribute name="value"> + <ref name="parameter-value"/> + </attribute> + </element> + </optional> + </define> + + <define name="rule-node-attributes"> + <attribute name="action"> + <ref name='action-type'/> + </attribute> + <attribute name="direction"> + <ref name='direction-type'/> + </attribute> + <optional> + <attribute name="priority"> + <ref name='priority-type'/> + </attribute> + </optional> + </define> + + <define name="match-attribute"> + <interleave> + <optional> + <attribute name="match"> + <choice> + <value>yes</value> + <value>no</value> + </choice> + </attribute> + </optional> + </interleave> + </define> + + <define name="srcmac-attribute"> + <interleave> + <optional> + <attribute name="srcmacaddr"> + <ref name="addrMAC"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-l2-attributes"> + <interleave> + <ref name="srcmac-attribute"/> + <optional> + <attribute name="srcmacmask"> + <ref name="addrMAC"/> + </attribute> + </optional> + <optional> + <attribute name="dstmacaddr"> + <ref name="addrMAC"/> + </attribute> + </optional> + <optional> + <attribute name="dstmacmask"> + <ref name="addrMAC"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-ip-attributes-p1"> + <interleave> + <optional> + <attribute name="srcipaddr"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="srcipmask"> + <ref name="addrMask"/> + </attribute> + </optional> + <optional> + <attribute name="dstipaddr"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="dstipmask"> + <ref name="addrMask"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-ip-attributes-p2"> + <interleave> + <optional> + <attribute name="srcipfrom"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="srcipto"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="dstipfrom"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="dstipto"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="dscp"> + <ref name="sixbitrange"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-ipv6-attributes-p1"> + <interleave> + <optional> + <attribute name="srcipaddr"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="srcipmask"> + <ref name="addrMaskv6"/> + </attribute> + </optional> + <optional> + <attribute name="dstipaddr"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="dstipmask"> + <ref name="addrMaskv6"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-ipv6-attributes-p2"> + <interleave> + <optional> + <attribute name="srcipfrom"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="srcipto"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="dstipfrom"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="dstipto"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="dscp"> + <ref name="sixbitrange"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-port-attributes"> + <interleave> + <optional> + <attribute name="srcportstart"> + <ref name="uint16range"/> + </attribute> + </optional> + <optional> + <attribute name="srcportend"> + <ref name="uint16range"/> + </attribute> + </optional> + <optional> + <attribute name="dstportstart"> + <ref name="uint16range"/> + </attribute> + </optional> + <optional> + <attribute name="dstportend"> + <ref name="uint16range"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="icmp-attributes"> + <interleave> + <optional> + <attribute name="type"> + <ref name="uint8range"/> + </attribute> + </optional> + <optional> + <attribute name="code"> + <ref name="uint8range"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="mac-attributes"> + <interleave> + <optional> + <attribute name="protocolid"> + <ref name="mac-protocolid"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="arp-attributes"> + <interleave> + <optional> + <attribute name="arpsrcmacaddr"> + <ref name="addrMAC"/> + </attribute> + </optional> + <optional> + <attribute name="arpsrcipaddr"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="arpdstmacaddr"> + <ref name="addrMAC"/> + </attribute> + </optional> + <optional> + <attribute name="arpdstipaddr"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="hwtype"> + <ref name="uint16range"/> + </attribute> + </optional> + <optional> + <attribute name="opcode"> + <ref name="arpOpcodeType"/> + </attribute> + </optional> + <optional> + <attribute name="protocoltype"> + <ref name="uint16range"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="ip-attributes"> + <optional> + <attribute name="protocol"> + <ref name="ipProtocolType"/> + </attribute> + </optional> + </define> + + <define name="dscp-attribute"> + <optional> + <attribute name="dscp"> + <ref name="sixbitrange"/> + </attribute> + </optional> + </define> + +  + + <define name="UUID"> + <choice> + <data type="string"> + <param name="pattern">[a-fA-F0-9]{32}</param> + </data> + + <data type="string"> + <param name="pattern">[a-fA-F0-9]{8}\-([a-fA-F0-9]{4}\-){3}[a-fA-F0-9]{12}</param> + </data> + </choice> + </define> + + <define name="addrMAC"> + <choice> +  + <data type="string"> + <param name="pattern">[\\$]{1}[a-zA-Z0-9_]+</param> + </data> + + <data type="string"> + <param name="pattern">([a-fA-F0-9]{1,2}:){5}[a-fA-F0-9]{1,2}</param> + </data> + </choice> + </define> + + <define name="addrIP"> + <choice> +  + <data type="string"> + <param name="pattern">[\\$]{1}[a-zA-Z0-9_]+</param> + </data> + + <data type="string"> + <param name="pattern">([0-2]?[0-9]?[0-9]\.){3}[0-2]?[0-9]?[0-9]</param> + </data> + </choice> + </define> + + <define name="addrIPv6"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="string"> + <param name="pattern">([a-fA-F0-9]{0,4}:){2,7}([a-fA-F0-9]*)(([0-2]?[0-9]?[0-9]\.){3}[0-2]?[0-9]?[0-9])?</param> + </data> + </choice> + </define> + + <define name="addrMask"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">32</param> + </data> + + <data type="string"> + <param name="pattern">([0-2]?[0-9]?[0-9]\.){3}[0-2]?[0-9]?[0-9]</param> + </data> + </choice> + </define> + + <define name="addrMaskv6"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">128</param> + </data> + + <data type="string"> + <param name="pattern">([a-fA-F0-9]{0,4}:){2,7}([a-fA-F0-9]*)</param> + </data> + </choice> + </define> + + <define name="sixbitrange"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">63</param> + </data> + </choice> + </define> + + <define name="mac-protocolid"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">1536</param> + <param name="maxInclusive">65535</param> + </data> + + <choice> + <value>arp</value> + <value>ipv4</value> + <value>ipv6</value> + </choice> + </choice> + </define> + + <define name="uint8range"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">255</param> + </data> + </choice> + </define> + + <define name="uint16range"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">65535</param> + </data> + </choice> + </define> + + <define name="arpOpcodeType"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">65535</param> + </data> + + <data type="string"> + <param name="pattern">([Rr]eply|[Rr]equest|[Rr]equest_[Rr]everse|[Rr]eply_[Rr]everse|DRARP_[Rr]equest|DRARP_[Rr]eply|DRARP_[Ee]rror|InARP_[Rr]equest|ARP_NAK)</param> + </data> + + </choice> + </define> + + <define name="ipProtocolType"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">255</param> + </data> + + <choice> + <value>tcp</value> + <value>udp</value> + <value>udplite</value> + <value>esp</value> + <value>ah</value> + <value>icmp</value> + <value>igmp</value> + <value>sctp</value> + <value>icmpv6</value> + </choice> + </choice> + </define> + + <define name="parameter-name"> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_]+</param> + </data> + </define> + + <define name="parameter-value"> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_\.:]+</param> + </data> + </define> + + <define name='action-type'> + <choice> + <value>drop</value> + <value>accept</value> + </choice> + </define> + + <define name='direction-type'> + <choice> + <value>in</value> + <value>out</value> + <value>inout</value> + </choice> + </define> + + <define name='priority-type'> + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">1000</param> + </data> + </define> +</grammar> Index: libvirt-acl/tests/Makefile.am =================================================================== --- libvirt-acl.orig/tests/Makefile.am +++ libvirt-acl/tests/Makefile.am @@ -74,6 +74,7 @@ EXTRA_DIST = \ xml2vmxdata \ nwfilterxml2xmlout \ nwfilterxml2xmlin \ + nwfilterschematest \ $(patsubst %,qemuhelpdata/%,$(qemuhelpdata)) noinst_PROGRAMS = virshtest conftest \ @@ -120,7 +121,8 @@ test_scripts = \ storagepoolschematest \ storagevolschematest \ domainschematest \ - nodedevschematest + nodedevschematest \ + nwfilterschematest if WITH_LIBVIRTD test_scripts += \ Index: libvirt-acl/tests/nwfilterschematest =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterschematest @@ -0,0 +1,11 @@ +#!/bin/sh + +: ${srcdir=.} +. $srcdir/test-lib.sh +. $abs_srcdir/schematestutils.sh + +DIRS="nwfilterxml2xmlout" +SCHEMA="nwfilter.rng" + +check_schema "$DIRS" "$SCHEMA" + Index: libvirt-acl/docs/schemas/domain.rng =================================================================== --- libvirt-acl.orig/docs/schemas/domain.rng +++ libvirt-acl/docs/schemas/domain.rng @@ -894,6 +894,11 @@ <optional> <ref name="address"/> </optional> + <optional> + <element name="filterref"> + <ref name="filterref-node-attributes"/> + </element> + </optional> </interleave> </define> <!-- @@ -1577,6 +1582,22 @@ </element> </define> + <define name="filterref-node-attributes"> + <attribute name="filter"> + <data type="NCName"/> + </attribute> + <optional> + <element name="parameter"> + <attribute name="name"> + <ref name="parameter-name"/> + </attribute> + <attribute name="value"> + <ref name="parameter-value"/> + </attribute> + </element> + </optional> + </define> + <!-- Type library @@ -1737,4 +1758,14 @@ <param name="pattern">[a-zA-Z0-9_\.\+\-/]+</param> </data> </define> + <define name="parameter-name"> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_]+</param> + </data> + </define> + <define name="parameter-value"> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_\.:]+</param> + </data> + </define> </grammar>

2 7

[libvirt] [PATCH] Fix 'avialable' typo
by Matthias Bolte 07 Apr '10

07 Apr '10

Reported by Paul Jenner --- I just pushed this patch. src/util/util.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/util/util.c b/src/util/util.c index 28a3c7e..405c5f3 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -2682,7 +2682,7 @@ char * virGetUserDirectory(uid_t uid ATTRIBUTE_UNUSED) { virUtilError(VIR_ERR_INTERNAL_ERROR, - "%s", _("virGetUserDirectory is not avialable")); + "%s", _("virGetUserDirectory is not available")); return NULL; } @@ -2691,7 +2691,7 @@ char * virGetUserName(uid_t uid ATTRIBUTE_UNUSED) { virUtilError(VIR_ERR_INTERNAL_ERROR, - "%s", _("virGetUserName is not avialable")); + "%s", _("virGetUserName is not available")); return NULL; } @@ -2700,7 +2700,7 @@ int virGetUserID(const char *name ATTRIBUTE_UNUSED, uid_t *uid ATTRIBUTE_UNUSED) { virUtilError(VIR_ERR_INTERNAL_ERROR, - "%s", _("virGetUserID is not avialable")); + "%s", _("virGetUserID is not available")); return 0; } @@ -2710,7 +2710,7 @@ int virGetGroupID(const char *name ATTRIBUTE_UNUSED, gid_t *gid ATTRIBUTE_UNUSED) { virUtilError(VIR_ERR_INTERNAL_ERROR, - "%s", _("virGetGroupID is not avialable")); + "%s", _("virGetGroupID is not available")); return 0; } -- 1.6.3.3

1 0

[libvirt] [PATCH] build: avoid autogen on 'make clean'
by Eric Blake 07 Apr '10

07 Apr '10

Tested by running 'git submodule foreach git pull origin master', then seeing that 'make clean' skips autogen although 'make' properly runs it. * cfg.mk (_clean_requested): New check, to speed up 'make clean' even if gnulib submodule is outdated. Suggested by Daniel P. Berrange. --- cfg.mk | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/cfg.mk b/cfg.mk index 70465c3..f422a53 100644 --- a/cfg.mk +++ b/cfg.mk @@ -301,7 +301,8 @@ ifeq (0,$(MAKELEVEL)) git diff .gnulib); \ stamp="$$($(_submodule_hash) $(_curr_status) 2>/dev/null)"; \ test "$$stamp" = "$$actual"; echo $$?) - ifeq (1,$(_update_required)) + _clean_requested = $(filter %clean,$(MAKECMDGOALS)) + ifeq (1,$(_update_required)$(_clean_requested)) $(info INFO: gnulib update required; running ./autogen.sh first) Makefile: _autogen endif -- 1.6.6.1

2 2

[libvirt] [PATCH] virterror.c: avoid erroneous case "fall-through"
by Jim Meyering 07 Apr '10

07 Apr '10

IMHO, this qualifies as an "obvious" fix, but I'll wait for an ACK. >From 0c9eb193ccb0ad507c7dd6dbfe944bb9a0c8ff93 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Tue, 6 Apr 2010 19:07:14 +0200 Subject: [PATCH] virterror.c: avoid erroneous case "fall-through" * src/util/virterror.c (virErrorMsg): Insert missing "break;" --- src/util/virterror.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/util/virterror.c b/src/util/virterror.c index d29f95b..96dd1e7 100644 --- a/src/util/virterror.c +++ b/src/util/virterror.c @@ -1,10 +1,10 @@ /* * virterror.c: implements error handling and reporting code for libvirt * - * Copy: Copyright (C) 2006, 2008, 2009 Red Hat, Inc. + * Copy: Copyright (C) 2006, 2008-2010 Red Hat, Inc. * * See COPYING.LIB for the License of this software * * Author: Daniel Veillard <veillard(a)redhat.com> */ @@ -1147,12 +1147,13 @@ virErrorMsg(virErrorNumber error, const char *info) break; case VIR_ERR_MIGRATE_PERSIST_FAILED: if (info == NULL) errmsg = _("Failed to make domain persistent after migration"); else errmsg = _("Failed to make domain persistent after migration: %s"); + break; case VIR_ERR_HOOK_SCRIPT_FAILED: if (info == NULL) errmsg = _("Hook script execution failed"); else errmsg = _("Hook script execution failed: %s"); break; -- 1.7.0.4.552.gc303

3 3

[libvirt] [PATCH] nwfilter: Fix instantiated layer 2 rules for 'inout' direction
by Stefan Berger 07 Apr '10

07 Apr '10

The following rule for direction 'in' <rule direction='in' action='drop'> <mac srcmacaddr='1:2:3:4:5:6'/> </rule> drops all traffic from the given mac address. The following rule for direction 'out' <rule direction='out' action='drop'> <mac dstmacaddr='1:2:3:4:5:6'/> </rule> drops all traffic to the given mac address. The following rule in direction 'inout' <rule direction='inout' action='drop'> <mac srcmacaddr='1:2:3:4:5:6'/> </rule> now drops all traffic from and to the given MAC address. So far it would have dropped traffic from the given MAC address and outgoing traffic with the given MAC address, which is not useful since the packets will always have the VM's MAC address as source MAC address. The attached patch fixes this. This is the last bug I currently know of and want to fix. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 67 ++++++++++++++++++++---------- 1 file changed, 45 insertions(+), 22 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -294,7 +294,8 @@ ebiptablesAddRuleInst(virNWFilterRuleIns static int ebtablesHandleEthHdr(virBufferPtr buf, virNWFilterHashTablePtr vars, - ethHdrDataDefPtr ethHdr) + ethHdrDataDefPtr ethHdr, + bool reverse) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -305,7 +306,8 @@ ebtablesHandleEthHdr(virBufferPtr buf, goto err_exit; virBufferVSprintf(buf, - " -s %s %s", + " %s %s %s", + reverse ? "-d" : "-s", ENTRY_GET_NEG_SIGN(&ethHdr->dataSrcMACAddr), macaddr); @@ -328,7 +330,8 @@ ebtablesHandleEthHdr(virBufferPtr buf, goto err_exit; virBufferVSprintf(buf, - " -d %s %s", + " %s %s %s", + reverse ? "-s" : "-d", ENTRY_GET_NEG_SIGN(&ethHdr->dataDstMACAddr), macaddr); @@ -1425,6 +1428,7 @@ iptablesCreateRuleInstance(virNWFilterDe * @ifname : The name of the interface to apply the rule to * @vars : A map containing the variables to resolve * @res : The data structure to store the result(s) into + * @reverse : Whether to reverse src and dst attributes * * Convert a single rule into its representation for later instantiation * @@ -1438,7 +1442,8 @@ ebtablesCreateRuleInstance(char chainPre virNWFilterRuleDefPtr rule, const char *ifname, virNWFilterHashTablePtr vars, - virNWFilterRuleInstPtr res) + virNWFilterRuleInstPtr res, + bool reverse) { char macaddr[VIR_MAC_STRING_BUFLEN], ipaddr[INET_ADDRSTRLEN], @@ -1464,7 +1469,8 @@ ebtablesCreateRuleInstance(char chainPre if (ebtablesHandleEthHdr(&buf, vars, - &rule->p.ethHdrFilter.ethHdr)) + &rule->p.ethHdrFilter.ethHdr, + reverse)) goto err_exit; if (HAS_ENTRY_ITEM(&rule->p.ethHdrFilter.dataProtocolID)) { @@ -1487,7 +1493,8 @@ ebtablesCreateRuleInstance(char chainPre if (ebtablesHandleEthHdr(&buf, vars, - &rule->p.arpHdrFilter.ethHdr)) + &rule->p.arpHdrFilter.ethHdr, + reverse)) goto err_exit; virBufferAddLit(&buf, " -p arp"); @@ -1532,7 +1539,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --arp-ip-src %s %s", + " %s %s %s", + reverse ? "--arp-ip-dst" : "--arp-ip-src", ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPSrcIPAddr), ipaddr); } @@ -1544,7 +1552,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --arp-ip-dst %s %s", + " %s %s %s", + reverse ? "--arp-ip-src" : "--arp-ip-dst", ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPDstIPAddr), ipaddr); } @@ -1556,7 +1565,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --arp-mac-src %s %s", + " %s %s %s", + reverse ? "--arp-mac-dst" : "--arp-mac-src", ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPSrcMACAddr), macaddr); } @@ -1568,7 +1578,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --arp-mac-dst %s %s", + " %s %s %s", + reverse ? "--arp-mac-src" : "--arp-mac-dst", ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPDstMACAddr), macaddr); } @@ -1581,7 +1592,8 @@ ebtablesCreateRuleInstance(char chainPre if (ebtablesHandleEthHdr(&buf, vars, - &rule->p.ipHdrFilter.ethHdr)) + &rule->p.ipHdrFilter.ethHdr, + reverse)) goto err_exit; virBufferAddLit(&buf, @@ -1594,7 +1606,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip-source %s %s", + " %s %s %s", + reverse ? "--ip-destination" : "--ip-source", ENTRY_GET_NEG_SIGN(&rule->p.ipHdrFilter.ipHdr.dataSrcIPAddr), ipaddr); @@ -1617,7 +1630,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip-destination %s %s", + " %s %s %s", + reverse ? "--ip-source" : "--ip-destination", ENTRY_GET_NEG_SIGN(&rule->p.ipHdrFilter.ipHdr.dataDstIPAddr), ipaddr); @@ -1652,7 +1666,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip-source-port %s %s", + " %s %s %s", + reverse ? "--ip-destination-port" : "--ip-source-port", ENTRY_GET_NEG_SIGN(&rule->p.ipHdrFilter.portData.dataSrcPortStart), number); @@ -1676,7 +1691,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip-destination-port %s %s", + " %s %s %s", + reverse ? "--ip-source-port" : "--ip-destination-port", ENTRY_GET_NEG_SIGN(&rule->p.ipHdrFilter.portData.dataDstPortStart), number); @@ -1712,7 +1728,8 @@ ebtablesCreateRuleInstance(char chainPre if (ebtablesHandleEthHdr(&buf, vars, - &rule->p.ipv6HdrFilter.ethHdr)) + &rule->p.ipv6HdrFilter.ethHdr, + reverse)) goto err_exit; virBufferAddLit(&buf, @@ -1725,7 +1742,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip6-source %s %s", + " %s %s %s", + reverse ? "--ip6-destination" : "--ip6-source", ENTRY_GET_NEG_SIGN(&rule->p.ipv6HdrFilter.ipHdr.dataSrcIPAddr), ipv6addr); @@ -1748,7 +1766,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip6-destination %s %s", + " %s %s %s", + reverse ? "--ip6-source" : "--ip6-destination", ENTRY_GET_NEG_SIGN(&rule->p.ipv6HdrFilter.ipHdr.dataDstIPAddr), ipv6addr); @@ -1783,7 +1802,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip6-source-port %s %s", + " %s %s %s", + (!reverse) ? "--ip6-source-port" : "--ip6-destination-port", ENTRY_GET_NEG_SIGN(&rule->p.ipv6HdrFilter.portData.dataSrcPortStart), number); @@ -1807,7 +1827,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip6-destination-port %s %s", + " %s %s %s", + reverse ? "--ip6-source-port" : "--ip6-destination-port", ENTRY_GET_NEG_SIGN(&rule->p.ipv6HdrFilter.portData.dataDstPortStart), number); @@ -1900,7 +1921,8 @@ ebiptablesCreateRuleInstance(virConnectP rule, ifname, vars, - res); + res, + rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT); if (rc) return rc; } @@ -1912,7 +1934,8 @@ ebiptablesCreateRuleInstance(virConnectP rule, ifname, vars, - res); + res, + 0); } break;

2 2

[libvirt] [PATCH] virsh: improve documentation
by Eric Blake 06 Apr '10

06 Apr '10

Document several missing commands. There's more work that could be done, but incremental improvements is better than no patch at all. * tools/virsh.pod (autostart, connect): Improve grammar. (create): Improve example. (domjobabort, domjobinfo, domxml-from-native, domxml-to-native): Document. (storage pool commands): New section. --- tools/virsh.pod | 167 ++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 files changed, 154 insertions(+), 13 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 62395d7..fdf687f 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -103,10 +103,12 @@ Will print the current directory. =item B<connect> I<URI> optional I<--readonly> -(Re)-Connect to the hypervisor. This is a build-in command after shell -start up, and usually get an I<URI> parameter specifying how to connect -to the hypervisor. The documentation page at L<http://libvirt.org/uri.html> -list the values supported but the most common are: +(Re)-Connect to the hypervisor. When the shell is first started, this +is automatically run with the I<URI> parameter requested by the C<-c> +option on the command line. The I<URI> parameter specifies how to +connect to the hypervisor. The documentation page at +L<http://libvirt.org/uri.html> list the values supported, but the most +common are: =over 4 @@ -116,11 +118,11 @@ this is used to connect to the local Xen hypervisor, this is the default =item qemu:///system -allow to connect locally as root to the daemon supervising QEmu and KVM domains +connect locally as root to the daemon supervising QEmu and KVM domains =item qemu:///session -allow to connect locally as a normal user to his own set of QEmu and KVM domains +connect locally as a normal user to his own set of QEmu and KVM domains =item lxc:/// @@ -252,7 +254,7 @@ I<domain-id> can be specified as an short integer, a name or a full UUID. Configure a domain to be automatically started at boot. -The option I<--disable> disable autostarting. +The option I<--disable> disables autostarting. =item B<console> I<domain-id> @@ -260,11 +262,15 @@ Connect the virtual serial console for the guest. =item B<create> I<FILE> -Create a domain from an XML <file>. An easy way to create the XML <file> is to use the B<dumpxml> command to obtain the definition of a pre-existing guest. +Create a domain from an XML <file>. An easy way to create the XML +<file> is to use the B<dumpxml> command to obtain the definition of a +pre-existing guest. B<Example> -virsh dumpxml <domain-id> > file. +virsh dumpxml <domain-id> > +edit file +virsh create < file =item B<define> I<FILE> @@ -306,6 +312,14 @@ Convert a domain name (or UUID) to a domain id Returns basic information about the domain. +=item B<domjobabort I<domain-id-or-uuid> + +Abort the currently running domain job. + +=item B<domjobinfo> I<domain-id-or-uuid> + +Returns information about jobs running on a domain. + =item B<domname> I<domain-id-or-uuid> Convert a domain Id (or UUID) to domain name @@ -314,13 +328,24 @@ Convert a domain Id (or UUID) to domain name Returns state about a running domain. +=item B<domxml-from-native> I<format> I<config> + +Convert the file I<config> in the native guest configuration format +named by I<format> to a domain XML format. + +=item B<domxml-to-native> I<format> I<xml> + +Convert the file I<xml> in domain XML format to the native guest +configuration format named by I<format>. + =item B<dump> I<domain-id> I<corefilepath> Dumps the core of a domain to a file for analysis. =item B<dumpxml> I<domain-id> -Output the domain information as an XML dump to stdout, this format can be used by the B<create> command. +Output the domain information as an XML dump to stdout, this format +can be used by the B<create> command. =item B<edit> I<domain-id> @@ -566,7 +591,7 @@ Edit the XML configuration file for a network. This is equivalent to: virsh net-dumpxml network > network.xml edit network.xml - virsh define network.xml + virsh net-define network.xml except that it does some error checking. The editor used can be supplied by the C<$VISUAL> or C<$EDITOR> environment @@ -596,6 +621,122 @@ Convert a network name to network UUID. =back +=head1 STORAGE POOL COMMANDS + +The following commands manipulate storage pools. Libvirt has the +capability to manage various storage solutions, including files, raw +partitions, and domain-specific formats, used to provide the storage +volumes visible as devices within virtual machines. For more detailed +information about this feature, see the documentation at +L<http://libvirt.org/formatstorage.html> . A lot of the commands for +pools are similar to the ones used for domains. + +=over 4 + +=item B<find-storage-pool-sources> I<type> optional I<srcSpec> + +Returns XML describing all storage pools of a given I<type> that could +be found. If I<srcSpec> is provided, it is a file that contains XML +to further restrict the query for pools. + +=item B<find-storage-pool-sources> I<type> optional I<host> I<port> + +Returns XML describing all storage pools of a given I<type> that could +be found. If I<host> and I<port> are provided, they control where the +query is performed. + +=item B<pool-autostart> I<pool-or-uuid> optional I<--disable> + +Configure whether I<pool> should automatically start at boot. + +=item B<pool-build> I<pool-or-uuid> + +Build a given pool. + +=item B<pool-create> I<file> + +Create and start a pool object from the XML I<file>. + +=item B<pool-create-as> I<name> I<--print-xml> I<type> optional I<source-host> +I<source-path> I<source-dev> I<source-name> <target> + +Create and start a pool object I<name> from the raw parameters. If +I<--print-xml> is specified, then print the XML of the pool object +without creating the pool. Otherwise, the pool has the specified +I<type>. + +=item B<pool-define> I<file> + +Create, but do not start, a pool object from the XML I<file>. + +=item B<pool-define-as> I<name> I<--print-xml> I<type> optional I<source-host> +I<source-path> I<source-dev> I<source-name> <target> + +Create, but do not start, a pool object I<name> from the raw parameters. If +I<--print-xml> is specified, then print the XML of the pool object +without defining the pool. Otherwise, the pool has the specified +I<type>. + +=item B<pool-destroy> I<pool-or-uuid> + +Destroy a given I<pool> object. Libvirt will no longer manage the +storage described by the pool object, but the raw data contained in +the pool is not changed, and can be later recovered with +B<pool-create>. + +=item B<pool-delete> I<pool-or-uuid> + +Destroy the resources used by a given I<pool> object. This operation +is non-recoverable. The I<pool> object will still exist after this +command. + +=item B<pool-dumpxml> I<pool-or-uuid> + +Returns the XML information about the I<pool> object. + +=item B<pool-edit> I<pool-or-uuid> + +Edit the XML configuration file for a storage pool. + +This is equivalent to: + virsh pool-dumpxml pool > pool.xml + edit pool.xml + virsh pool-define pool.xml +except that it does some error checking. + +The editor used can be supplied by the C<$VISUAL> or C<$EDITOR> environment +variables, and defaults to C<vi>. + +=item B<pool-info> I<pool-or-uuid> + +Returns basic information about the I<pool> object. + +=item B<pool-list> optional I<--inactive> I<--all> + +List pool objects known to libvirt. By default, only pools in use by +active domains are listed; I<--inactive> lists just the inactive +pools, and I<--all> lists all pools. + +=item B<pool-name> I<uuid> + +Convert the I<uuid> to a pool name. + +=item B<pool-refresh> I<pool-or-uuid> + +Refresh the list of volumes contained in I<pool>. + +=item B<pool-start> I<pool-or-uuid> + +Start the storage I<pool>, which is previously defined but inactive. + +=item B<pool-undefine> I<pool-or-uuid> + +Undefine the configuration for an inactive I<pool>. + +=item B<pool-uuid> I<pool> + +Returns the UUID of the named I<pool>. + =head1 SECRET COMMMANDS The following commands manipulate "secrets" (e.g. passwords, passphrases and @@ -653,11 +794,11 @@ format as accepted by the B<connect> option. =item VISUAL -The editor to use by the B<edit> and B<net-edit> options. +The editor to use by the B<edit> and related options. =item EDITOR -The editor to use by the B<edit> and B<net-edit> options, if C<VISUAL> +The editor to use by the B<edit> and related options, if C<VISUAL> is not set. =item LIBVIRT_DEBUG=LEVEL -- 1.6.6.1

2 2

[libvirt] [PATCH] Clarify an error message in setmem.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index ad64bc0..d241fa0 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -2407,7 +2407,8 @@ cmdSetmem(vshControl *ctl, const vshCmd *cmd) if (kilobytes > info.maxMem) { virDomainFree(dom); - vshError(ctl, _("Invalid value of %d for memory size"), kilobytes); + vshError(ctl, _("Requested memory size %d kb is larger than maximum of %lu kb"), + kilobytes, info.maxMem); return FALSE; } -- 1.6.6.1

2 2

[libvirt] [PATCH] Fix up comments for isEncrypted, isSecure, domainIsActive, and domainIsPersistent.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/lxc/lxc_driver.c | 8 ++++---- src/opennebula/one_driver.c | 4 ++-- src/phyp/phyp_driver.c | 4 ++-- src/qemu/qemu_driver.c | 8 ++++---- src/uml/uml_driver.c | 8 ++++---- src/vbox/vbox_tmpl.c | 8 ++++---- src/xen/xen_driver.c | 8 ++++---- 7 files changed, 24 insertions(+), 24 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index b5d422c..c6b652d 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -2527,10 +2527,10 @@ static virDriver lxcDriver = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - lxcIsEncrypted, - lxcIsSecure, - lxcDomainIsActive, - lxcDomainIsPersistent, + lxcIsEncrypted, /* isEncrypted */ + lxcIsSecure, /* isSecure */ + lxcDomainIsActive, /* domainIsActive */ + lxcDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ diff --git a/src/opennebula/one_driver.c b/src/opennebula/one_driver.c index 4554d95..0d80d1f 100644 --- a/src/opennebula/one_driver.c +++ b/src/opennebula/one_driver.c @@ -781,8 +781,8 @@ static virDriver oneDriver = { NULL, /* nodeDeviceReAttach; */ NULL, /* nodeDeviceReset; */ NULL, /* domainMigratePrepareTunnel */ - oneIsEncrypted, - oneIsSecure, + oneIsEncrypted, /* isEncrypted */ + oneIsSecure, /* isSecure */ NULL, /* domainIsActive */ NULL, /* domainIsPersistent */ NULL, /* cpuCompare */ diff --git a/src/phyp/phyp_driver.c b/src/phyp/phyp_driver.c index 28e17ff..b712d0a 100644 --- a/src/phyp/phyp_driver.c +++ b/src/phyp/phyp_driver.c @@ -1640,8 +1640,8 @@ virDriver phypDriver = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - phypIsEncrypted, - phypIsSecure, + phypIsEncrypted, /* isEncrypted */ + phypIsSecure, /* isSecure */ NULL, /* domainIsActive */ NULL, /* domainIsPersistent */ NULL, /* cpuCompare */ diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index a87b974..bc94ce6 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -11325,10 +11325,10 @@ static virDriver qemuDriver = { qemudNodeDeviceReAttach, /* nodeDeviceReAttach */ qemudNodeDeviceReset, /* nodeDeviceReset */ qemudDomainMigratePrepareTunnel, /* domainMigratePrepareTunnel */ - qemuIsEncrypted, - qemuIsSecure, - qemuDomainIsActive, - qemuDomainIsPersistent, + qemuIsEncrypted, /* isEncrypted */ + qemuIsSecure, /* isSecure */ + qemuDomainIsActive, /* domainIsActive */ + qemuDomainIsPersistent, /* domainIsPersistent */ qemuCPUCompare, /* cpuCompare */ qemuCPUBaseline, /* cpuBaseline */ qemuDomainGetJobInfo, /* domainGetJobInfo */ diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index dfa5de5..0179b2e 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -1926,10 +1926,10 @@ static virDriver umlDriver = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - umlIsEncrypted, - umlIsSecure, - umlDomainIsActive, - umlDomainIsPersistent, + umlIsEncrypted, /* isEncrypted */ + umlIsSecure, /* isSecure */ + umlDomainIsActive, /* domainIsActive */ + umlDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 62fd8e1..4b00a80 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -8138,10 +8138,10 @@ virDriver NAME(Driver) = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - vboxIsEncrypted, - vboxIsSecure, - vboxDomainIsActive, - vboxDomainIsPersistent, + vboxIsEncrypted, /* isEncrypted */ + vboxIsSecure, /* isSecure */ + vboxDomainIsActive, /* domainIsActive */ + vboxDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ diff --git a/src/xen/xen_driver.c b/src/xen/xen_driver.c index 7c4eb5e..0835406 100644 --- a/src/xen/xen_driver.c +++ b/src/xen/xen_driver.c @@ -1969,10 +1969,10 @@ static virDriver xenUnifiedDriver = { xenUnifiedNodeDeviceReAttach, /* nodeDeviceReAttach */ xenUnifiedNodeDeviceReset, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - xenUnifiedIsEncrypted, - xenUnifiedIsSecure, - xenUnifiedDomainIsActive, - xenUnifiedDomainisPersistent, + xenUnifiedIsEncrypted, /* isEncrypted */ + xenUnifiedIsSecure, /* isSecure */ + xenUnifiedDomainIsActive, /* domainIsActive */ + xenUnifiedDomainisPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ -- 1.6.6.1

2 2

[libvirt] [PATCH] Document snapshot virsh commands in the man page.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.pod | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 49 insertions(+), 0 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 62395d7..9e2c3e5 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -639,6 +639,55 @@ Output a list of UUIDs of known secrets to stdout. =back +=head1 SNAPSHOT COMMMANDS + +The following commands manipulate domain snapshots. Snapshots take the +disk, memory, and device state of a domain at a point-of-time, and save it +for future use. They have many uses, from saving a "clean" copy of an OS +image to saving a domain's state before a potentially destructive operation. +Snapshots are identified with a unique name. See +L<http://libvirt.org/formatsnapshot.html> for documentation of the XML format +used to represent properties of snapshots. + +=over 4 + +=item B<snapshot-create> I<domain> I<xmlfile> + +Create a snapshot for domain I<domain> with the properties specified in +I<xmlfile>. The only properties settable for a domain snapshot are the +<name> and <description>; the rest of the fields are ignored, and +automatically filled in by libvirt. If I<xmlfile> is completely ommitted, +then libvirt will choose a value for all fields. + +=item B<snapshot-current> I<domain> + +Output the snapshot XML for the domain's current snapshot (if any). + +=item B<snapshot-list> I<domain> + +List all of the available snapshots for the given domain. + +=item B<snapshot-dumpxml> I<domain> I<snapshot> + +Output the snapshot XML for the domain's snapshot named I<snapshot>. + +=item B<revert-to-snapshot> I<domain> I<snapshot> + +Revert the given domain to the snapshot specified by I<snapshot>. Be aware +that this is a destructive action; any changes in the domain since the +snapshot is taken will be lost. Also note that the state of the domain after +revert-to-snapshot is complete will be the state of the domain at the time +the original snapshot was taken. + +=item B<snapshot-delete> I<domain> I<snapshot> I<--children> + +Delete the snapshot for the domain named I<snapshot>. If this snapshot +has child snapshots, changes from this snapshot will be merged into the +children. If I<--children> is passed, then delete this snapshot and any +children of this snapshot. + +=back + =head1 ENVIRONMENT The following environment variables can be set to alter the behaviour -- 1.6.6.1

2 2

[libvirt] [PATCH] Better error reporting in virsh.
by Chris Lalancette 06 Apr '10

06 Apr '10

When hitting failures in virsh, a common idiom is to jump to a cleanup label, free some resources, and then return a FALSE error code to vshCommandRun. In theory, vshCommandRun is then supposed to print out the last error. The problem is that many of the cleanup paths have library calls to free resources, and all of those library calls clear out the last error. This is leading to situations where no error is being reported at all. This patch remedies the situation somewhat by printing out the errors inside the command methods themselves when we know it will go through a cleanup path that will lose the error. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.c | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index d241fa0..aaae7ca 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -2623,9 +2623,8 @@ cmdDomXMLFromNative(vshControl *ctl, const vshCmd *cmd) format = vshCommandOptString(cmd, "format", NULL); configFile = vshCommandOptString(cmd, "config", NULL); - if (virFileReadAll(configFile, 1024*1024, &configData) < 0) { + if (virFileReadAll(configFile, 1024*1024, &configData) < 0) return FALSE; - } xmlData = virConnectDomainXMLFromNative(ctl->conn, format, configData, flags); if (xmlData != NULL) { @@ -2669,9 +2668,8 @@ cmdDomXMLToNative(vshControl *ctl, const vshCmd *cmd) format = vshCommandOptString(cmd, "format", NULL); xmlFile = vshCommandOptString(cmd, "xml", NULL); - if (virFileReadAll(xmlFile, 1024*1024, &xmlData) < 0) { + if (virFileReadAll(xmlFile, 1024*1024, &xmlData) < 0) return FALSE; - } configData = virConnectDomainXMLToNative(ctl->conn, format, xmlData, flags); if (configData != NULL) { @@ -4330,9 +4328,8 @@ cmdNodeDeviceCreate(vshControl *ctl, const vshCmd *cmd) return FALSE; } - if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) return FALSE; - } dev = virNodeDeviceCreateXML(ctl->conn, buffer, 0); VIR_FREE(buffer); @@ -5427,6 +5424,7 @@ cmdVolCreate(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virStoragePoolFree(pool); return FALSE; } @@ -5488,6 +5486,7 @@ cmdVolCreateFrom(vshControl *ctl, const vshCmd *cmd) goto cleanup; if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); goto cleanup; } @@ -6928,6 +6927,7 @@ cmdAttachDevice(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virDomainFree(dom); return FALSE; } @@ -6995,6 +6995,7 @@ cmdDetachDevice(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virDomainFree(dom); return FALSE; } @@ -7062,6 +7063,7 @@ cmdUpdateDevice(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virDomainFree(dom); return FALSE; } -- 1.6.6.1

2 2

[libvirt] [PATCH] Website documentation for the snapshot XML.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- docs/formatsnapshot.html.in | 72 +++++++++++++++++++++++++++++++++++++++++++ docs/sitemap.html.in | 4 ++ 2 files changed, 76 insertions(+), 0 deletions(-) create mode 100644 docs/formatsnapshot.html.in diff --git a/docs/formatsnapshot.html.in b/docs/formatsnapshot.html.in new file mode 100644 index 0000000..fa007ea --- /dev/null +++ b/docs/formatsnapshot.html.in @@ -0,0 +1,72 @@ +<html> + <body> + <h1>Snapshot XML format</h1> + + <ul id="toc"></ul> + + <h2><a name="SnapshotAttributes">Snapshot XML</a></h2> + + + Attributes of libvirt snapshots are stored as child elements of + the <code>domainsnapshot</code> element. At snapshot creation + time, only the <code>name</code> and <code>description</code> + elements are settable; the rest of the fields are informational + (and readonly) and will be filled in by libvirt when the + snapshot is created. + + + The top-level <code>domainsnapshot</code> element may contain + the following elements: + + <dl> + <dt><code>name</code></dt> + <dd>The name for this snapshot. If the name is specified when + initially creating the snapshot, then the snapshot will have + that particular name. If the name is omitted when initially + creating the snapshot, then libvirt will make up a name for the snapshot. + </dd> + <dt><code>description</code></dt> + <dd>A human-readable description of the snapshot. If the + description is omitted when initially creating the snapshot, + then this field will be empty. + </dd> + <dt><code>creationTime</code></dt> + <dd>The time this snapshot was created. The time is specified + in seconds since the Epoch (i.e. Unix time). Readonly. + </dd> + <dt><code>state</code></dt> + <dd>The state of the domain at the time this snapshot was + taken. When the domain is reverted to this snapshot, the domain's state + will be set to whatever is in this field. Readonly. + </dd> + <dt><code>parent</code></dt> + <dd>The parent of this snapshot. This element contains exactly + one child element, name. This specifies the name of the parent + snapshot of this snapshot, and is used to represent trees of + snapshots. Readonly. + </dd> + <dt><code>domain</code></dt> + <dd>The domain that this snapshot was taken against. This + element contains exactly one child element, uuid. This + specifies the uuid of the domain that this snapshot was taken + against. Readonly. + </dd> + </dl> + + <h2><a name="example">Example</a></h2> + + <pre> + <domainsnapshot> + <name>os-updates</name> + <description>Snapshot of OS install and updates</description> + <state>running</state> + <creationTime>1270477159</creationTime> + <parent> + <name>bare-os-install</name> + </parent> + <domain> + <uuid>93a5c045-6457-2c09-e56c-927cdf34e178</uuid> + </domain> + </domainsnapshot></pre> + </body> +</html> diff --git a/docs/sitemap.html.in b/docs/sitemap.html.in index 76d8faa..ae2bfde 100644 --- a/docs/sitemap.html.in +++ b/docs/sitemap.html.in @@ -114,6 +114,10 @@ <a href="formatsecret.html">Secrets</a> The secret XML format </li> + <li> + <a href="formatsnapshot.html">Secrets</a> + The snapshot XML format + </li> </ul> </li> <li> -- 1.6.6.1

2 2