- Devel - libvirt List Archives

Re: [libvirt] [RFC] Unify KVM kernel-space and user-space code into a single project
by Antoine Martin 09 Apr '10

09 Apr '10

Hi, I am moving this thread here as this seems more appropriate. Sorry it has taken so long.. Here are 2 things that really get in the way of moving my existing installations to libvirt: * I tend to store much meta data with each VM instance: it can be things like ownership (contact details as text), monitoring info (sms phone numbers), backup (list of paths), firewall rules (custom syntax, with failover rules, etc), etc. At the moment, these extra bits of information consist of just a few optional lines of shell in each VM's definition file. I can extend these whenever I need, enumerate the VMs using the standard mechanism and trigger my specific actions as needed (firewall rules, backup or whatever). I see no way of doing this with libvirt. But please correct me if I am wrong. * not everything is exposed via libvirt: virsh can retrieve vncdisplay but libvirt (or at least the python bindings) does not. How come? This happens to be one thing I need for writing a libvirt backend for my virtual desktop software. Cheers Antoine Antoine Martin wrote: > Hi Daniel, > > I'll take a look and get back to you asap. > > Cheers > Antoine > > Daniel P. Berrange wrote: >> On Tue, Mar 23, 2010 at 03:00:28AM +0700, Antoine Martin wrote: >>> On 03/23/2010 02:15 AM, Anthony Liguori wrote: >>>> On 03/22/2010 12:55 PM, Avi Kivity wrote: >>>>>> Lets look at the ${HOME}/.qemu/qmp/ enumeration method suggested by >>>>>> Anthony. >>>>>> There's numerous ways that this can break: >>>>> I don't like it either. We have libvirt for enumerating guests. >>>> We're stuck in a rut with libvirt and I think a lot of the >>>> dissatisfaction with qemu is rooted in that. It's not libvirt that's >>>> the probably, but the relationship between qemu and libvirt. >>> +1 >>> The obvious reason why so many people still use shell scripts rather >>> than libvirt is because if it just doesn't provide what they need. >>> Every time I've looked at it (and I've been looking for a better >>> solution for many years), it seems that it would have provided most of >>> the things I needed, but the remaining bits were unsolvable. >> If you happen to remember what missing features prevented you choosing >> libvirt, that would be invaluable information for us, to see if there >> are quick wins that will help out. We got very useful feedback when >> recently asking people this same question > >> http://rwmj.wordpress.com/2010/01/07/quick-quiz-what-stops-you-from-using-l… > >> Allowing arbitrary passthrough of QEMU commands/args will solve some of >> these issues, but certainly far from solving all of them. eg guest cut+ >> paste, host side control of guest screen resolution, easier x509/TLS >> configuration for remote management, soft reboot, Windows desktop support >> for virt-manager, host network interface management/setup, etc > >> Regards, >> Daniel

5 13

[libvirt] [PATCH] nwfilter: Process DHCP option to determine whether packet is a DHCP_OFFER
by Stefan Berger 09 Apr '10

09 Apr '10

I mistakenly took the op field in the DHCP message as the DHCP_OFFER type. Rather than basing the decision to read the VM's IP address on that field, process the appended DHCP options where option 53 indicates the actual type of the packet. I am also reading the broadcast address of the VM, but don't use it so far. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_learnipaddr.c | 61 +++++++++++++++++++++++++++++++++--- 1 file changed, 56 insertions(+), 5 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -64,6 +64,13 @@ struct f_arphdr { } ATTRIBUTE_PACKED; +struct dhcp_option { + uint8_t code; + uint8_t len; + uint8_t value[0]; /* length varies */ +} ATTRIBUTE_PACKED; + + /* structure representing DHCP message */ struct dhcp { uint8_t op; @@ -78,9 +85,12 @@ struct dhcp { uint32_t siaddr; uint32_t giaddr; uint8_t chaddr[16]; - /* omitted */ + uint8_t zeroes[192]; + uint32_t magic; + struct dhcp_option options[0]; } ATTRIBUTE_PACKED; +#define DHCP_MSGT_DHCPOFFER 2 struct ether_vlan_header { @@ -212,6 +222,40 @@ virNWFilterGetIpAddrForIfname(const char #ifdef HAVE_LIBPCAP +static void +procDHCPOpts(struct dhcp *dhcp, int dhcp_opts_len, + uint32_t *vmaddr, uint32_t *bcastaddr, + enum howDetect *howDetected) { + struct dhcp_option *dhcpopt = &dhcp->options[0]; + + while (dhcp_opts_len >= 2) { + + switch (dhcpopt->code) { + + case 28: /* Broadcast address */ + if (dhcp_opts_len >= 6) { + uint32_t *tmp = (uint32_t *)&dhcpopt->value; + (*bcastaddr) = ntohl(*tmp); + } + break; + + case 53: /* Message type */ + if (dhcp_opts_len >= 3) { + uint8_t *val = (uint8_t *)&dhcpopt->value; + switch (*val) { + case DHCP_MSGT_DHCPOFFER: + *vmaddr = dhcp->yiaddr; + *howDetected = DETECT_DHCP; + break; + } + } + } + dhcp_opts_len -= (2 + dhcpopt->len); + dhcpopt = (struct dhcp_option*)((char *)dhcpopt + 2 + dhcpopt->len); + } +} + + /** * learnIPAddressThread * arg: pointer to virNWFilterIPAddrLearnReq structure @@ -236,12 +280,13 @@ learnIPAddressThread(void *arg) struct ether_header *ether_hdr; struct ether_vlan_header *vlan_hdr; virNWFilterIPAddrLearnReqPtr req = arg; - uint32_t vmaddr = 0; + uint32_t vmaddr = 0, bcastaddr = 0; unsigned int ethHdrSize; char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev : req->ifname; int to_ms = (strlen(req->linkdev) != 0) ? 1000 : 0; + int dhcp_opts_len; char macaddr[VIR_MAC_STRING_BUFLEN]; virBuffer buf = VIR_BUFFER_INITIALIZER; char *filter= NULL; @@ -382,12 +427,18 @@ learnIPAddressThread(void *arg) sizeof(struct dhcp)) { struct dhcp *dhcp = (struct dhcp *) ((char *)udphdr + sizeof(udphdr)); - if (dhcp->op == 2 /* DHCP OFFER */ && + if (dhcp->op == 2 /* BOOTREPLY */ && !memcmp(&dhcp->chaddr[0], req->macaddr, 6)) { - vmaddr = dhcp->yiaddr; - howDetected = DETECT_DHCP; + dhcp_opts_len = header.len - + (ethHdrSize + iphdr->ihl * 4 + + sizeof(struct udphdr) + + sizeof(struct dhcp)); + procDHCPOpts(dhcp, dhcp_opts_len, + &vmaddr, + &bcastaddr, + &howDetected); } } }

2 1

[libvirt] [PATCH] Fix error in nwfilter test driver
by Stefan Berger 09 Apr '10

09 Apr '10

Trivial fix for the c&p error in the nwfilter test driver. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Index: libvirt-acl/src/test/test_driver.c =================================================================== --- libvirt-acl.orig/src/test/test_driver.c +++ libvirt-acl/src/test/test_driver.c @@ -5212,7 +5212,7 @@ static virDrvOpenStatus testNWFilterOpen if (STRNEQ(conn->driver->name, "Test")) return VIR_DRV_OPEN_DECLINED; - conn->secretPrivateData = conn->privateData; + conn->nwfilterPrivateData = conn->privateData; return VIR_DRV_OPEN_SUCCESS; }

2 2

[libvirt] libvirt: C++ or Java
by Gokhale, Shashibhushan 09 Apr '10

09 Apr '10

Hello, I am planning to develop a management application for managing Redhat Xen and Redhat KVM hypervisors. I am evaluating the Java bindings versus the C++ version of libvirt. As part of evaluation, I could not find meaningful answers to the questions below. Hence, I thought that people on this mailing list would be the most appropriate to comment on them. Can you please let me know your views? 1. Are all functions that are available in C API available in Java? 2. Are Java bindings added along with every enhancement to C API? 3. If answer to above question is negative, typically how long does it takes for the addition of Java bindings for the enhancement? 4. Most of libvirt based third party management applications use which of Java bindings or C API? 5. What are your good/bad experiences while using either of C API or Java bindings? 6. What is your concluding personal recommendation? And finally, since libvirt is a Redhat Emerging Technology project, does Redhat or any other third party service providers provide paid assistance, support? Thanks, Shashi

1 0

[libvirt] [RESEND][PATCH][QEMU driver] Catch cdrom change error
by Ryan Harper 09 Apr '10

09 Apr '10

Currently when we attempt to change the cdrom in a qemu VM the monitor doesn't generate an error if the target filename doesn't exist. I've submitted a patch[1] for this. This patch is the libvirt qemu-driver side which catches the error message from the monitor and reportes the error to libvirt. This means that virsh attach-disk cdrom commands won't appear to succeed when qemu change command actually failed. I've tested this patch on an older libvirt (rebuild libvirt-0.7.0 on my ubuntu host) but haven't rebuilt against git head since I can't quite compile that on my host. 1. http://lists.gnu.org/archive/html/qemu-devel/2010-03/msg01935.html Signed-off-by: Ryan Harper <ryanh(a)us.ibm.com> diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c index 1596e59..f868907 100644 --- a/src/qemu/qemu_monitor_text.c +++ b/src/qemu/qemu_monitor_text.c @@ -905,7 +905,14 @@ int qemuMonitorTextChangeMedia(qemuMonitorPtr mon, qemuReportError(VIR_ERR_OPERATION_FAILED, _("could not eject media on %s: %s"), devname, reply); goto cleanup; - } + } + + /* Could not open message indicates bad filename */ + if (strstr(reply, "\nCould not open ")) { + qemuReportError(VIR_ERR_OPERATION_FAILED, + _("could not change media on %s: %s"), devname, reply); + goto cleanup; + } ret = 0; -- Ryan Harper Software Engineer; Linux Technology Center IBM Corp., Austin, Tx ryanh(a)us.ibm.com

2 1

[libvirt] Documentation: misleading examples
by redshift＠gmx.com 09 Apr '10

09 Apr '10

Hello, at http://libvirt.org/formatdomain.html#elementsNICS there are three examples of interfaces with a particular MAC address specified. I understand the provided mac address is more a placeholder than a real value; but since '11:22:33:44:55:66' seems to be a multicast address[1], I would suggest providing '00:11:22:33:44:55' as example. Best regards [1] http://en.wikipedia.org/wiki/MAC_address#Address_details

2 1

[libvirt] [PATCH] More event callback fixes
by Daniel P. Berrange 09 Apr '10

09 Apr '10

In a couple of cases typos meant we were firing the wrong type of event. In the python code my previous commit accidentally missed some chunks of the code. * python/libvirt-override-virConnect.py: Add missing python glue accidentally left out of previous commit * src/conf/domain_event.c, src/qemu/qemu_monitor_json.c: Fix typos in event name / method name to invoke --- python/libvirt-override-virConnect.py | 48 +++++++++++++++++++++++++++++++++ src/conf/domain_event.c | 2 +- src/qemu/qemu_monitor_json.c | 2 +- 3 files changed, 50 insertions(+), 2 deletions(-) diff --git a/python/libvirt-override-virConnect.py b/python/libvirt-override-virConnect.py index 444a499..b49f786 100644 --- a/python/libvirt-override-virConnect.py +++ b/python/libvirt-override-virConnect.py @@ -63,6 +63,54 @@ except AttributeError: pass + def dispatchDomainEventRTCChangeCallback(self, dom, offset, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), offset ,opaque) + return 0 + except AttributeError: + pass + + def dispatchDomainEventWatchdogCallback(self, dom, action, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), action, opaque) + return 0 + except AttributeError: + pass + + def dispatchDomainEventIOErrorCallback(self, dom, srcPath, devAlias, action, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), opaque) + return 0 + except AttributeError: + pass + + def dispatchDomainEventGraphicsCallback(self, dom, phase, localAddr, remoteAddr, authScheme, subject, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), phase, localAddr, remoteAddr, authScheme, subject, opaque) + return 0 + except AttributeError: + pass + def domainEventDeregisterAny(self, callbackID): """Removes a Domain Event Callback. De-registering for a domain callback will disable delivery of this event type """ diff --git a/src/conf/domain_event.c b/src/conf/domain_event.c index 07d6a55..e3ce5ba 100644 --- a/src/conf/domain_event.c +++ b/src/conf/domain_event.c @@ -660,7 +660,7 @@ virDomainEventPtr virDomainEventIOErrorNewFromObj(virDomainObjPtr obj, obj->def->id, obj->def->name, obj->def->uuid); if (ev) { - ev->data.watchdog.action = action; + ev->data.ioError.action = action; if (!(ev->data.ioError.srcPath = strdup(srcPath)) || !(ev->data.ioError.devAlias = strdup(devAlias))) { virDomainEventFree(ev); diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 507e935..00bb275 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -536,7 +536,7 @@ static void qemuMonitorJSONHandleWatchdog(qemuMonitorPtr mon, virJSONValuePtr da } else { actionID = VIR_DOMAIN_EVENT_WATCHDOG_NONE; } - qemuMonitorEmitRTCChange(mon, actionID); + qemuMonitorEmitWatchdog(mon, actionID); } VIR_ENUM_DECL(qemuMonitorIOErrorAction) -- 1.6.6.1

2 1

[libvirt] [PATCH v2]
by Stefan Berger 09 Apr '10

09 Apr '10

This patch adds new test cases to the existing nwfilter test program and adds a test script that must be run while a VM is running. This test script verifies that input network filter XML creates expected user-defined tables and rules on ebtables, iptables & ip6tables layer and verifies their content against expected content. The idea is that these tools always return exactly the same output when displaying the content of a user-defined table so that the diff tool can be used for simple text comparison. All supported protocols have at least one test case. This test program is not run automatically since it requires a running VM. For all tests to pass the previously posted ICMP fix patch must be applied. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfiltervmtest.sh | 186 ++++++++++++++++++ tests/nwfilterxml2fwallout/ah-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/ah-test.fwall | 19 + tests/nwfilterxml2fwallout/all-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/all-test.fwall | 19 + tests/nwfilterxml2fwallout/arp-test.fwall | 9 tests/nwfilterxml2fwallout/esp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/esp-test.fwall | 19 + tests/nwfilterxml2fwallout/icmp-direction-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction2-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction3-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-test.fwall | 16 + tests/nwfilterxml2fwallout/icmpv6-test.fwall | 16 + tests/nwfilterxml2fwallout/igmp-test.fwall | 19 + tests/nwfilterxml2fwallout/ip-test.fwall | 12 + tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 12 + tests/nwfilterxml2fwallout/ipv6-test.fwall | 14 + tests/nwfilterxml2fwallout/mac-test.fwall | 12 + tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/sctp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/sctp-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/udp-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-test.fwall | 19 + tests/nwfilterxml2xmlin/icmp-direction-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 + tests/nwfilterxml2xmlout/icmp-direction-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction2-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction3-test.xml | 9 tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml | 9 tests/nwfilterxml2xmltest.c | 4 37 files changed, 748 insertions(+) Index: libvirt-acl/tests/nwfiltervmtest.sh =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfiltervmtest.sh @@ -0,0 +1,191 @@ +#!/bin/bash + +VIRSH=virsh +ORIG_IFNAME="vnet0" + +TMPFILE1="/tmp/nwfiltervmtest1.txt" +TMPFILE2="/tmp/nwfiltervmtest2.txt" + +function usage() { + local cmd="$0" + echo "Usage: ${cmd} [--help|-h|-?] [--ifname|-i <interfacename>" + cat <<EOF + +Options: + --help,-h,-? : Display this help screen. + --ifname, -i : Name of the backend interface of the VM. Default 'vnet0' + +Run this program while a KVM VM is running (preferably as only VM on the +system) and one of its interfaces uses a filter called 'testcase'. The name +of the interface of the VM is anticipated to be 'vnet0' unless set by the +'--ifname' option. The following interface description fulfills this +requirement: + + <interface type='bridge'> + <source bridge='virbr0'/> + <target dev='vnet0'/> + <filterref filter='testcase'/> + </interface> + +The individual tests are validated using string comparison where the output +of ebtables, iptables and ip6tables is compared against expected output. As +long as the output of those tools is the same, the tests should all pass. +The tests were developed on Fedore Core 12. + +Known problems: None of the running VMs' names may have spaces. +EOF +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local cmd line tmpfile tmpfile2 + local linenums ctr=0 + local regex="s/${ORIG_IFNAME}/${ifname}/g" + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + tmpfile="${TMPFILE1}" + tmpfile2="${TMPFILE2}" + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + exec 4<&0 + + exec < ${fwallfile} + + read line + while [ "x${line}x" != "xx" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + exec ${cmd} | grep -v "^Bridge" | grep -v "^$" > ${tmpfile} + + rm ${tmpfile2} 2>/dev/null + touch ${tmpfile2} + + while [ 1 ]; do + read + + line="${REPLY}" + + if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then + + diff ${tmpfile} ${tmpfile2} >/dev/null + + if [ $? -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + else + echo "PASS ${xmlfile} : ${cmd}" + fi + + break; + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 0<&4 + exec 4<&- + + rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null +} + + +function runTests() { + local ifname="$1" + local xmldir="$2" + local fwalldir="$3" + local fwallfiles f + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${ifname}" + done +} + + +function checkVM() { + local vmname="$1" + local ifname="$2" + local nwfilter="$3" + local f i c + + c=`${VIRSH} dumpxml ${vmname} | grep -c "<interface"` + if [ ${c} -ne 1 ]; then + echo "VM '${vmname}' has multiple interfaces. I cannot tell for sure " + echo "whether this VM has the correct interface name '${ifname}' and " + echo "reference the filter '${nwfilter}'. Cowardly skipping this VM..." + return 1 + fi + + f=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \ + sed "s/.*filterref filter='$[a-zA-Z0-9_]\+$'.*/\1/"` + i=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \ + sed "s/.*\<interface.*target dev='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + if [ "x${i}x" == "x${ifname}x" ] && [ "x${f}x" == "x${nwfilter}x" ]; then + return 0 + fi + + return 1 +} + + +function main() { + local prgname="$0" + local ifname="${ORIG_IFNAME}" + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms + local filtername="testcase" + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --ifname|-i) shift 1; ifname="$1";; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + if [ `uname` != "Linux" ]; then + echo "This script will only run on Linux." + exit 1; + fi + + vms=`${VIRSH} list | grep running | gawk '{print $2}'` + if [ "x${vms}x" == "xx" ]; then + echo "Error: Need a running VM." + exit 1; + fi + + for vm in ${vms}; do + checkVM "${vm}" "${ifname}" "${filtername}" + if [ $? -eq 0 ]; then + found=1; + break; + fi + done + + if [ ${found} -eq 0 ]; then + echo "Error: Suitable VM seems not to be running. Check the help screen"; + echo "to (--help) to read about requirements to the running VM."; + exit 1; + fi + + runTests "${ifname}" "${xmldir}" "${fwalldir}" +} + +main "$@" Index: libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,14 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,16 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21 +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21 +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21 +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21 +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -114,6 +114,10 @@ mymain(int argc, char **argv) DO_TEST("ref-test"); DO_TEST("ref-rule-test"); + DO_TEST("ipt-no-macspoof-test"); + DO_TEST("icmp-direction-test"); + DO_TEST("icmp-direction2-test"); + DO_TEST("icmp-direction3-test"); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout' priority='500'> + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + <rule action='drop' direction='in' priority='500'> + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,12 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/Makefile.am =================================================================== --- libvirt-acl.orig/tests/Makefile.am +++ libvirt-acl/tests/Makefile.am @@ -74,7 +74,9 @@ EXTRA_DIST = \ xml2vmxdata \ nwfilterxml2xmlout \ nwfilterxml2xmlin \ + nwfilterxml2fwallout \ nwfilterschematest \ + nwfiltervmtest.sh \ $(patsubst %,qemuhelpdata/%,$(qemuhelpdata)) noinst_PROGRAMS = virshtest conftest \

4 7

[libvirt] [PATCH] nwfilter: More XML parser test cases
by Stefan Berger 09 Apr '10

09 Apr '10

This patch adds a couple more nwfilter test cases for the XML parser tests. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -114,6 +114,10 @@ mymain(int argc, char **argv) DO_TEST("ref-test"); DO_TEST("ref-rule-test"); + DO_TEST("ipt-no-macspoof-test"); + DO_TEST("icmp-direction-test"); + DO_TEST("icmp-direction2-test"); + DO_TEST("icmp-direction3-test"); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout' priority='500'> + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + <rule action='drop' direction='in' priority='500'> + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter>

2 1

[libvirt] Domain not stable while created...
by Sankamesh 09 Apr '10

09 Apr '10

Hello Thanks for the reply. Now I use virsh -c "xen:///" define libvirt-ttylinux.xml (domain is created) and "virsh start ttyimage" the image starts and shuts down immediately. This time I can view the domain even after the shut down. So is there any reason for the image being shutdown immediately? What else should I check?? Thanks in advance. ________________________________ > Hello, > > I am using Scientific Linux 5.4 and xen. I want to deploy a sample ttyimage by creating a domain using virsh create. > > My configuration file is : > ----------------------------------------------------------------------------------------------------- > <?xml version="1.0" encoding="utf-8"?> > <domain type='xen'> > <name>ttyimage</name> > <os> > <type>linux</type> > <kernel>/boot/vmlinuz-2.6.18-164.2.1.el5xen</kernel> > </os> > <memory>65536</memory> > <vcpu>1</vcpu> > <on_poweroff>destroy</on_poweroff> > <on_reboot>restart</on_reboot> > <on_crash>destroy</on_crash> > <devices> > <graphics type='vnc' port='5900'/> > <disk type='file'> > <source file='/usr/local/ttylinux-xen-libvirt/ttylinux-xen.img' /> > <target dev='sda' /> > </disk> > <interface type='bridge'> > <source bridge='virbr0' /> > <mac address='00:1d:60:ec:ae:1c' /> > <target dev='testnimb-0' /> > </interface> > </devices> > </domain> > ------------------------------------------------------------------------------------------------------- > > when I use "virsh -c "xen:///" create libvirt-ttylinux.xml " to create a domain, the domain is crated and i can view the image (in paused mode) using the virt-manager. and when I resume the image it ,disappears (domain gets destroyed) after nearly 10 seconds..... > Further when I use vncviewer localhost::5900 when the image is running (during the 10 sec) ,i can view the console. But it closes once the domain is destroyed. > > Can someone explain why the image is not stable??? how can I make the domain to be stable???? > > Thanks in advance Using 'virsh create guest.xml' cmds can simply activate the guest, which only exist active domain instead of define domain, and the guest will disappear if it isn't in define domain and you carry out some operations, e.g. 'destroy' or 'shutdown' or 'save' etc. so you should correctly use virsh cmds: FYI, virsh -c xen:/// define libvirt-ttylinux.xml virsh start guestname Alex Send free SMS to your Friends on Mobile from your Yahoo! Messenger. Download Now! http://messenger.yahoo.com/download.php

1 0

[libvirt] [PATCH] Remove undefined symbols from symbols file
by Matthias Bolte 08 Apr '10

08 Apr '10

--- src/libvirt_private.syms | 7 +------ 1 files changed, 1 insertions(+), 6 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 814e2d8..b76f2da 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -209,7 +209,6 @@ virDomainTimerModeTypeFromString; virDomainSnapshotObjListGetNames; virDomainSnapshotObjListNum; virDomainSnapshotFindByName; -virDomainSnapshotObjListAdd; virDomainSnapshotObjListRemove; virDomainSnapshotHasChildren; virDomainSnapshotObjUnref; @@ -516,11 +515,7 @@ virNWFilterInstantiateFilter; virNWFilterTeardownFilter; -#nwfilter_learnipaddr.h -ipAddressMap; -ipAddressMapLock; -pendingLearnReq; -pendingLearnReqLock; +# nwfilter_learnipaddr.h virNWFilterGetIpAddrForIfname; virNWFilterDelIpAddrForIfname; virNWFilterLookupLearnReq; -- 1.6.3.3

2 2

[libvirt] [PATCH] esx: Add domain snapshot support
by Matthias Bolte 08 Apr '10

08 Apr '10

Fix invalid code generating in esx_vi_generator.py regarding deep copy types that contain enum properties. Add strptime and timegm to bootstrap.conf. Both are used to convert a xsd:dateTime to calendar time. --- bootstrap.conf | 2 + src/esx/esx_driver.c | 468 +++++++++++++++++++++++++++++++++++++--- src/esx/esx_vi.c | 290 +++++++++++++++++++++++++ src/esx/esx_vi.h | 27 +++ src/esx/esx_vi_generator.input | 12 + src/esx/esx_vi_generator.py | 25 ++- src/esx/esx_vi_methods.c | 86 ++++++++ src/esx/esx_vi_methods.h | 14 ++ src/esx/esx_vi_types.c | 99 +++++++++ src/esx/esx_vi_types.h | 12 + 10 files changed, 990 insertions(+), 45 deletions(-) diff --git a/bootstrap.conf b/bootstrap.conf index ac2f8e6..ca9332d 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -52,9 +52,11 @@ stpcpy strchrnul strndup strerror +strptime strsep sys_stat time_r +timegm useless-if-before-free vasprintf verify diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index eb06555..5272654 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -563,6 +563,7 @@ esxClose(virConnectPtr conn) esxVI_Logout(priv->host) < 0) { result = -1; } + esxVI_Context_Free(&priv->host); if (priv->vCenter != NULL) { @@ -570,6 +571,7 @@ esxClose(virConnectPtr conn) esxVI_Logout(priv->vCenter) < 0) { result = -1; } + esxVI_Context_Free(&priv->vCenter); } @@ -1742,23 +1744,8 @@ esxDomainGetInfo(virDomainPtr domain, virDomainInfoPtr info) goto failure; } - switch (powerState) { - case esxVI_VirtualMachinePowerState_PoweredOff: - info->state = VIR_DOMAIN_SHUTOFF; - break; - - case esxVI_VirtualMachinePowerState_PoweredOn: - info->state = VIR_DOMAIN_RUNNING; - break; - - case esxVI_VirtualMachinePowerState_Suspended: - info->state = VIR_DOMAIN_PAUSED; - break; - - default: - info->state = VIR_DOMAIN_NOSTATE; - break; - } + info->state = esxVI_VirtualMachinePowerState_ConvertToLibvirt + (powerState); } else if (STREQ(dynamicProperty->name, "config.hardware.memoryMB")) { if (esxVI_AnyType_ExpectType(dynamicProperty->val, esxVI_Type_Int) < 0) { @@ -2329,7 +2316,6 @@ esxListDefinedDomains(virConnectPtr conn, char **const names, int maxnames) count = -1; goto cleanup; - } @@ -3308,6 +3294,418 @@ esxDomainIsPersistent(virDomainPtr domain ATTRIBUTE_UNUSED) +static virDomainSnapshotPtr +esxDomainSnapshotCreateXML(virDomainPtr domain, const char *xmlDesc, + unsigned int flags ATTRIBUTE_UNUSED) +{ + esxPrivate *priv = domain->conn->privateData; + virDomainSnapshotDefPtr def = NULL; + esxVI_ObjectContent *virtualMachine = NULL; + esxVI_VirtualMachineSnapshotTree *rootSnapshotList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL; + esxVI_ManagedObjectReference *task = NULL; + esxVI_TaskInfoState taskInfoState; + virDomainSnapshotPtr snapshot = NULL; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + def = virDomainSnapshotDefParseString(xmlDesc, 1); + + if (def == NULL) { + goto failure; + } + + if (esxVI_LookupVirtualMachineByUuidAndPrepareForTask + (priv->host, domain->uuid, NULL, &virtualMachine, + priv->autoAnswer) < 0 || + esxVI_LookupRootSnapshotTreeList(priv->host, domain->uuid, + &rootSnapshotList) < 0 || + esxVI_GetSnapshotTreeByName(rootSnapshotList, def->name, + &snapshotTree, &snapshotTreeParent, + esxVI_Occurrence_OptionalItem) < 0) { + goto failure; + } + + if (snapshotTree != NULL) { + ESX_ERROR(VIR_ERR_OPERATION_INVALID, + _("Snapshot '%s' already exists"), def->name); + goto failure; + } + + if (esxVI_CreateSnapshot_Task(priv->host, virtualMachine->obj, + def->name, def->description, + esxVI_Boolean_True, + esxVI_Boolean_False, &task) < 0 || + esxVI_WaitForTaskCompletion(priv->host, task, domain->uuid, + priv->autoAnswer, &taskInfoState) < 0) { + goto failure; + } + + if (taskInfoState != esxVI_TaskInfoState_Success) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Could not create snapshot")); + goto failure; + } + + snapshot = virGetDomainSnapshot(domain, def->name); + + cleanup: + virDomainSnapshotDefFree(def); + esxVI_ObjectContent_Free(&virtualMachine); + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotList); + esxVI_ManagedObjectReference_Free(&task); + + return snapshot; + + failure: + domain = NULL; + + goto cleanup; +} + + + +static char * +esxDomainSnapshotDumpXML(virDomainSnapshotPtr snapshot, + unsigned int flags ATTRIBUTE_UNUSED) +{ + esxPrivate *priv = snapshot->domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL; + virDomainSnapshotDef def; + char uuid_string[VIR_UUID_STRING_BUFLEN] = ""; + char *xml = NULL; + + memset(&def, 0, sizeof (virDomainSnapshotDef)); + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, snapshot->domain->uuid, + &rootSnapshotList) < 0 || + esxVI_GetSnapshotTreeByName(rootSnapshotList, snapshot->name, + &snapshotTree, &snapshotTreeParent, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + def.name = snapshot->name; + def.description = snapshotTree->description; + def.parent = snapshotTreeParent != NULL ? snapshotTreeParent->name : NULL; + + if (esxVI_DateTime_ConvertToCalendarTime(snapshotTree->createTime, + &def.creationTime) < 0) { + goto failure; + } + + def.state = esxVI_VirtualMachinePowerState_ConvertToLibvirt + (snapshotTree->state); + + virUUIDFormat(snapshot->domain->uuid, uuid_string); + + xml = virDomainSnapshotDefFormat(uuid_string, &def, 0); + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotList); + + return xml; + + failure: + VIR_FREE(xml); + + goto cleanup; +} + + + +static int +esxDomainSnapshotNum(virDomainPtr domain, unsigned int flags ATTRIBUTE_UNUSED) +{ + int result = 0; + esxPrivate *priv = domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, domain->uuid, + &rootSnapshotTreeList) < 0) { + goto failure; + } + + result = esxVI_GetNumberOfSnapshotTrees(rootSnapshotTreeList); + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotTreeList); + + return result; + + failure: + result = -1; + + goto cleanup; +} + + + +static int +esxDomainSnapshotListNames(virDomainPtr domain, char **names, int nameslen, + unsigned int flags ATTRIBUTE_UNUSED) +{ + int result = 0; + esxPrivate *priv = domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL; + + if (names == NULL || nameslen < 0) { + ESX_ERROR(VIR_ERR_INVALID_ARG, "%s", _("Invalid argument")); + return -1; + } + + if (nameslen == 0) { + return 0; + } + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, domain->uuid, + &rootSnapshotTreeList) < 0) { + goto failure; + } + + result = esxVI_GetSnapshotTreeNames(rootSnapshotTreeList, names, nameslen); + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotTreeList); + + return result; + + failure: + result = -1; + + goto cleanup; +} + + + +static virDomainSnapshotPtr +esxDomainSnapshotLookupByName(virDomainPtr domain, const char *name, + unsigned int flags ATTRIBUTE_UNUSED) +{ + esxPrivate *priv = domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL; + virDomainSnapshotPtr snapshot = NULL; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, domain->uuid, + &rootSnapshotTreeList) < 0 || + esxVI_GetSnapshotTreeByName(rootSnapshotTreeList, name, &snapshotTree, + &snapshotTreeParent, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + snapshot = virGetDomainSnapshot(domain, name); + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotTreeList); + + return snapshot; + + failure: + snapshot = NULL; + + goto cleanup; +} + + + +static int +esxDomainHasCurrentSnapshot(virDomainPtr domain, + unsigned int flags ATTRIBUTE_UNUSED) +{ + int result = 0; + esxPrivate *priv = domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *currentSnapshotTree = NULL; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupCurrentSnapshotTree(priv->host, domain->uuid, + &currentSnapshotTree, + esxVI_Occurrence_OptionalItem) < 0) { + goto failure; + } + + if (currentSnapshotTree != NULL) { + result = 1; + } + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&currentSnapshotTree); + + return result; + + failure: + result = -1; + + goto cleanup; +} + + + +static virDomainSnapshotPtr +esxDomainSnapshotCurrent(virDomainPtr domain, + unsigned int flags ATTRIBUTE_UNUSED) +{ + + virDomainSnapshotPtr snapshot = NULL; + esxPrivate *priv = domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *currentSnapshotTree = NULL; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupCurrentSnapshotTree(priv->host, domain->uuid, + &currentSnapshotTree, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + snapshot = virGetDomainSnapshot(domain, currentSnapshotTree->name); + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&currentSnapshotTree); + + return snapshot; + + failure: + snapshot = NULL; + + goto cleanup; +} + + + +static int +esxDomainRevertToSnapshot(virDomainSnapshotPtr snapshot, + unsigned int flags ATTRIBUTE_UNUSED) +{ + int result = 0; + esxPrivate *priv = snapshot->domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL; + esxVI_ManagedObjectReference *task = NULL; + esxVI_TaskInfoState taskInfoState; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, snapshot->domain->uuid, + &rootSnapshotList) < 0 || + esxVI_GetSnapshotTreeByName(rootSnapshotList, snapshot->name, + &snapshotTree, &snapshotTreeParent, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + if (esxVI_RevertToSnapshot_Task(priv->host, snapshotTree->snapshot, NULL, + &task) < 0 || + esxVI_WaitForTaskCompletion(priv->host, task, snapshot->domain->uuid, + priv->autoAnswer, &taskInfoState) < 0) { + goto failure; + } + + if (taskInfoState != esxVI_TaskInfoState_Success) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("Could not revert to snapshot '%s'"), snapshot->name); + goto failure; + } + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotList); + esxVI_ManagedObjectReference_Free(&task); + + return result; + + failure: + result = -1; + + goto cleanup; +} + + + +static int +esxDomainSnapshotDelete(virDomainSnapshotPtr snapshot, unsigned int flags) +{ + int result = 0; + esxPrivate *priv = snapshot->domain->conn->privateData; + esxVI_VirtualMachineSnapshotTree *rootSnapshotList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTreeParent = NULL; + esxVI_Boolean removeChildren = esxVI_Boolean_False; + esxVI_ManagedObjectReference *task = NULL; + esxVI_TaskInfoState taskInfoState; + + if (esxVI_EnsureSession(priv->host) < 0) { + goto failure; + } + + if (flags & VIR_DOMAIN_SNAPSHOT_DELETE_CHILDREN) { + removeChildren = esxVI_Boolean_True; + } + + if (esxVI_LookupRootSnapshotTreeList(priv->host, snapshot->domain->uuid, + &rootSnapshotList) < 0 || + esxVI_GetSnapshotTreeByName(rootSnapshotList, snapshot->name, + &snapshotTree, &snapshotTreeParent, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + if (esxVI_RemoveSnapshot_Task(priv->host, snapshotTree->snapshot, + removeChildren, &task) < 0 || + esxVI_WaitForTaskCompletion(priv->host, task, snapshot->domain->uuid, + priv->autoAnswer, &taskInfoState) < 0) { + goto failure; + } + + if (taskInfoState != esxVI_TaskInfoState_Success) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("Could not delete snapshot '%s'"), snapshot->name); + goto failure; + } + + cleanup: + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotList); + esxVI_ManagedObjectReference_Free(&task); + + return result; + + failure: + result = -1; + + goto cleanup; +} + + + static virDriver esxDriver = { VIR_DRV_ESX, "ESX", @@ -3388,23 +3786,23 @@ static virDriver esxDriver = { esxDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ - NULL, /* domainGetJobInfo */ - NULL, /* domainAbortJob */ - NULL, /* domainMigrateSetMaxDowntime */ - NULL, /* domainEventRegisterAny */ - NULL, /* domainEventDeregisterAny */ - NULL, /* domainManagedSave */ - NULL, /* domainHasManagedSaveImage */ - NULL, /* domainManagedSaveRemove */ - NULL, /* domainSnapshotCreateXML */ - NULL, /* domainSnapshotDumpXML */ - NULL, /* domainSnapshotNum */ - NULL, /* domainSnapshotListNames */ - NULL, /* domainSnapshotLookupByName */ - NULL, /* domainHasCurrentSnapshot */ - NULL, /* domainSnapshotCurrent */ - NULL, /* domainRevertToSnapshot */ - NULL, /* domainSnapshotDelete */ + NULL, /* domainGetJobInfo */ + NULL, /* domainAbortJob */ + NULL, /* domainMigrateSetMaxDowntime */ + NULL, /* domainEventRegisterAny */ + NULL, /* domainEventDeregisterAny */ + NULL, /* domainManagedSave */ + NULL, /* domainHasManagedSaveImage */ + NULL, /* domainManagedSaveRemove */ + esxDomainSnapshotCreateXML, /* domainSnapshotCreateXML */ + esxDomainSnapshotDumpXML, /* domainSnapshotDumpXML */ + esxDomainSnapshotNum, /* domainSnapshotNum */ + esxDomainSnapshotListNames, /* domainSnapshotListNames */ + esxDomainSnapshotLookupByName, /* domainSnapshotLookupByName */ + esxDomainHasCurrentSnapshot, /* domainHasCurrentSnapshot */ + esxDomainSnapshotCurrent, /* domainSnapshotCurrent */ + esxDomainRevertToSnapshot, /* domainRevertToSnapshot */ + esxDomainSnapshotDelete, /* domainSnapshotDelete */ }; diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index c37dfa1..eb5371d 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -1719,6 +1719,152 @@ esxVI_GetVirtualMachineIdentity(esxVI_ObjectContent *virtualMachine, int +esxVI_GetNumberOfSnapshotTrees + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList) +{ + int count = 0; + esxVI_VirtualMachineSnapshotTree *snapshotTree; + + for (snapshotTree = snapshotTreeList; snapshotTree != NULL; + snapshotTree = snapshotTree->_next) { + count += 1 + esxVI_GetNumberOfSnapshotTrees + (snapshotTree->childSnapshotList); + } + + return count; +} + + + +int +esxVI_GetSnapshotTreeNames(esxVI_VirtualMachineSnapshotTree *snapshotTreeList, + char **names, int nameslen) +{ + int count = 0; + int result; + int i; + esxVI_VirtualMachineSnapshotTree *snapshotTree; + + for (snapshotTree = snapshotTreeList; + snapshotTree != NULL && count < nameslen; + snapshotTree = snapshotTree->_next) { + names[count] = strdup(snapshotTree->name); + + if (names[count] == NULL) { + virReportOOMError(); + goto failure; + } + + count++; + + if (count >= nameslen) { + break; + } + + result = esxVI_GetSnapshotTreeNames(snapshotTree->childSnapshotList, + names + count, nameslen - count); + + if (result < 0) { + goto failure; + } + + count += result; + } + + return count; + + failure: + for (i = 0; i < count; ++i) { + VIR_FREE(names[i]); + } + + return -1; +} + + + +int +esxVI_GetSnapshotTreeByName + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList, const char *name, + esxVI_VirtualMachineSnapshotTree **snapshotTree, + esxVI_VirtualMachineSnapshotTree **snapshotTreeParent, + esxVI_Occurrence occurrence) +{ + esxVI_VirtualMachineSnapshotTree *candidate; + + if (snapshotTree == NULL || *snapshotTree != NULL || + snapshotTreeParent == NULL || *snapshotTreeParent != NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + for (candidate = snapshotTreeList; candidate != NULL; + candidate = candidate->_next) { + if (STREQ(candidate->name, name)) { + *snapshotTree = candidate; + *snapshotTreeParent = NULL; + return 1; + } + + if (esxVI_GetSnapshotTreeByName(candidate->childSnapshotList, name, + snapshotTree, snapshotTreeParent, + occurrence) > 0) { + if (*snapshotTreeParent == NULL) { + *snapshotTreeParent = candidate; + } + + return 1; + } + } + + if (occurrence == esxVI_Occurrence_OptionalItem) { + return 0; + } else { + ESX_VI_ERROR(VIR_ERR_NO_DOMAIN_SNAPSHOT, + _("Could not find snapshot with name '%s'"), name); + + return -1; + } +} + + + +int +esxVI_GetSnapshotTreeBySnapshot + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList, + esxVI_ManagedObjectReference *snapshot, + esxVI_VirtualMachineSnapshotTree **snapshotTree) +{ + esxVI_VirtualMachineSnapshotTree *candidate; + + if (snapshotTree == NULL || *snapshotTree != NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + for (candidate = snapshotTreeList; candidate != NULL; + candidate = candidate->_next) { + if (STREQ(candidate->snapshot->value, snapshot->value)) { + *snapshotTree = candidate; + return 0; + } + + if (esxVI_GetSnapshotTreeBySnapshot(candidate->childSnapshotList, + snapshot, snapshotTree) >= 0) { + return 0; + } + } + + ESX_VI_ERROR(VIR_ERR_NO_DOMAIN_SNAPSHOT, + _("Could not find domain snapshot with internal name '%s'"), + snapshot->value); + + return -1; +} + + + +int esxVI_LookupResourcePoolByHostSystem (esxVI_Context *ctx, esxVI_ObjectContent *hostSystem, esxVI_ManagedObjectReference **resourcePool) @@ -2336,6 +2482,150 @@ esxVI_LookupAndHandleVirtualMachineQuestion(esxVI_Context *ctx, int +esxVI_LookupRootSnapshotTreeList + (esxVI_Context *ctx, const unsigned char *virtualMachineUuid, + esxVI_VirtualMachineSnapshotTree **rootSnapshotTreeList) +{ + int result = 0; + esxVI_String *propertyNameList = NULL; + esxVI_ObjectContent *virtualMachine = NULL; + esxVI_DynamicProperty *dynamicProperty = NULL; + + if (rootSnapshotTreeList == NULL || *rootSnapshotTreeList != NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + if (esxVI_String_AppendValueToList(&propertyNameList, + "snapshot.rootSnapshotList") < 0 || + esxVI_LookupVirtualMachineByUuid(ctx, virtualMachineUuid, + propertyNameList, &virtualMachine, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + for (dynamicProperty = virtualMachine->propSet; dynamicProperty != NULL; + dynamicProperty = dynamicProperty->_next) { + if (STREQ(dynamicProperty->name, "snapshot.rootSnapshotList")) { + if (esxVI_VirtualMachineSnapshotTree_CastListFromAnyType + (dynamicProperty->val, rootSnapshotTreeList) < 0) { + goto failure; + } + + break; + } else { + VIR_WARN("Unexpected '%s' property", dynamicProperty->name); + } + } + + if (*rootSnapshotTreeList == NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("Could not lookup root snapshot list")); + goto failure; + } + + cleanup: + esxVI_String_Free(&propertyNameList); + esxVI_ObjectContent_Free(&virtualMachine); + + return result; + + failure: + esxVI_VirtualMachineSnapshotTree_Free(rootSnapshotTreeList); + + result = -1; + + goto cleanup; +} + + + +int +esxVI_LookupCurrentSnapshotTree + (esxVI_Context *ctx, const unsigned char *virtualMachineUuid, + esxVI_VirtualMachineSnapshotTree **currentSnapshotTree, + esxVI_Occurrence occurrence) +{ + int result = 0; + esxVI_String *propertyNameList = NULL; + esxVI_ObjectContent *virtualMachine = NULL; + esxVI_DynamicProperty *dynamicProperty = NULL; + esxVI_ManagedObjectReference *currentSnapshot = NULL; + esxVI_VirtualMachineSnapshotTree *rootSnapshotTreeList = NULL; + esxVI_VirtualMachineSnapshotTree *snapshotTree = NULL; + + if (currentSnapshotTree == NULL || *currentSnapshotTree != NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + if (esxVI_String_AppendValueListToList(&propertyNameList, + "snapshot.currentSnapshot\0" + "snapshot.rootSnapshotList\0") < 0 || + esxVI_LookupVirtualMachineByUuid(ctx, virtualMachineUuid, + propertyNameList, &virtualMachine, + esxVI_Occurrence_RequiredItem) < 0) { + goto failure; + } + + for (dynamicProperty = virtualMachine->propSet; dynamicProperty != NULL; + dynamicProperty = dynamicProperty->_next) { + if (STREQ(dynamicProperty->name, "snapshot.currentSnapshot")) { + if (esxVI_ManagedObjectReference_CastFromAnyType + (dynamicProperty->val, &currentSnapshot) < 0) { + goto failure; + } + } else if (STREQ(dynamicProperty->name, "snapshot.rootSnapshotList")) { + if (esxVI_VirtualMachineSnapshotTree_CastListFromAnyType + (dynamicProperty->val, &rootSnapshotTreeList) < 0) { + goto failure; + } + } else { + VIR_WARN("Unexpected '%s' property", dynamicProperty->name); + } + } + + if (currentSnapshot == NULL) { + if (occurrence == esxVI_Occurrence_OptionalItem) { + return 0; + } else { + ESX_VI_ERROR(VIR_ERR_NO_DOMAIN_SNAPSHOT, "%s", + _("Domain has no current snapshot")); + goto failure; + } + } + + if (rootSnapshotTreeList == NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("Could not lookup root snapshot list")); + goto failure; + } + + if (esxVI_GetSnapshotTreeBySnapshot(rootSnapshotTreeList, currentSnapshot, + &snapshotTree) < 0 || + esxVI_VirtualMachineSnapshotTree_DeepCopy(currentSnapshotTree, + snapshotTree) < 0) { + goto failure; + } + + cleanup: + esxVI_String_Free(&propertyNameList); + esxVI_ObjectContent_Free(&virtualMachine); + esxVI_ManagedObjectReference_Free(&currentSnapshot); + esxVI_VirtualMachineSnapshotTree_Free(&rootSnapshotTreeList); + + return result; + + failure: + + result = -1; + + goto cleanup; +} + + + +int esxVI_HandleVirtualMachineQuestion (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachine, esxVI_VirtualMachineQuestionInfo *questionInfo, diff --git a/src/esx/esx_vi.h b/src/esx/esx_vi.h index 9b65e85..a8d4cc3 100644 --- a/src/esx/esx_vi.h +++ b/src/esx/esx_vi.h @@ -233,6 +233,24 @@ int esxVI_LookupNumberOfDomainsByPowerState int esxVI_GetVirtualMachineIdentity(esxVI_ObjectContent *virtualMachine, int *id, char **name, unsigned char *uuid); +int esxVI_GetNumberOfSnapshotTrees + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList); + +int esxVI_GetSnapshotTreeNames + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList, char **names, + int nameslen); + +int esxVI_GetSnapshotTreeByName + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList, const char *name, + esxVI_VirtualMachineSnapshotTree **snapshotTree, + esxVI_VirtualMachineSnapshotTree **snapshotTreeParent, + esxVI_Occurrence occurrence); + +int esxVI_GetSnapshotTreeBySnapshot + (esxVI_VirtualMachineSnapshotTree *snapshotTreeList, + esxVI_ManagedObjectReference *snapshot, + esxVI_VirtualMachineSnapshotTree **snapshotTree); + int esxVI_LookupResourcePoolByHostSystem (esxVI_Context *ctx, esxVI_ObjectContent *hostSystem, esxVI_ManagedObjectReference **resourcePool); @@ -274,6 +292,15 @@ int esxVI_LookupAndHandleVirtualMachineQuestion(esxVI_Context *ctx, const unsigned char *uuid, esxVI_Boolean autoAnswer); +int esxVI_LookupRootSnapshotTreeList + (esxVI_Context *ctx, const unsigned char *virtualMachineUuid, + esxVI_VirtualMachineSnapshotTree **rootSnapshotTreeList); + +int esxVI_LookupCurrentSnapshotTree + (esxVI_Context *ctx, const unsigned char *virtualMachineUuid, + esxVI_VirtualMachineSnapshotTree **currentSnapshotTree, + esxVI_Occurrence occurrence); + int esxVI_HandleVirtualMachineQuestion (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachine, diff --git a/src/esx/esx_vi_generator.input b/src/esx/esx_vi_generator.input index 06dddbf..9c545eb 100644 --- a/src/esx/esx_vi_generator.input +++ b/src/esx/esx_vi_generator.input @@ -424,3 +424,15 @@ object VirtualMachineQuestionInfo ChoiceOption choice r VirtualMachineMessage message i end + + +object VirtualMachineSnapshotTree + ManagedObjectReference snapshot r + ManagedObjectReference vm r + String name r + String description r + DateTime createTime r + VirtualMachinePowerState state r + Boolean quiesced r + VirtualMachineSnapshotTree childSnapshotList ol +end diff --git a/src/esx/esx_vi_generator.py b/src/esx/esx_vi_generator.py index 5ca6138..b933d5b 100755 --- a/src/esx/esx_vi_generator.py +++ b/src/esx/esx_vi_generator.py @@ -95,6 +95,8 @@ class Property: return " ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY_LIST(%s, %s)\n" % (self.type, self.name) elif self.type == "String": return " ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY_VALUE(String, %s)\n" % self.name + elif self.is_enum(): + return " (*dest)->%s = src->%s;\n" % (self.name, self.name) else: return " ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY(%s, %s)\n" % (self.type, self.name) @@ -841,17 +843,19 @@ additional_object_features = { "Event" : Object.FEATURE__LI "SharesInfo" : Object.FEATURE__ANY_TYPE, "TaskInfo" : Object.FEATURE__ANY_TYPE | Object.FEATURE__LIST, "UserSession" : Object.FEATURE__ANY_TYPE, - "VirtualMachineQuestionInfo" : Object.FEATURE__ANY_TYPE } + "VirtualMachineQuestionInfo" : Object.FEATURE__ANY_TYPE, + "VirtualMachineSnapshotTree" : Object.FEATURE__DEEP_COPY | Object.FEATURE__ANY_TYPE } -removed_object_features = { "DynamicProperty" : Object.FEATURE__SERIALIZE, - "ObjectContent" : Object.FEATURE__SERIALIZE, - "ObjectUpdate" : Object.FEATURE__SERIALIZE, - "PropertyChange" : Object.FEATURE__SERIALIZE, - "PropertyFilterUpdate" : Object.FEATURE__SERIALIZE, - "TaskInfo" : Object.FEATURE__SERIALIZE, - "UpdateSet" : Object.FEATURE__SERIALIZE, - "VirtualMachineConfigInfo" : Object.FEATURE__SERIALIZE } +removed_object_features = { "DynamicProperty" : Object.FEATURE__SERIALIZE, + "ObjectContent" : Object.FEATURE__SERIALIZE, + "ObjectUpdate" : Object.FEATURE__SERIALIZE, + "PropertyChange" : Object.FEATURE__SERIALIZE, + "PropertyFilterUpdate" : Object.FEATURE__SERIALIZE, + "TaskInfo" : Object.FEATURE__SERIALIZE, + "UpdateSet" : Object.FEATURE__SERIALIZE, + "VirtualMachineConfigInfo" : Object.FEATURE__SERIALIZE, + "VirtualMachineSnapshotTree" : Object.FEATURE__SERIALIZE } @@ -948,7 +952,8 @@ for obj in objects_by_name.values(): if obj.features & Object.FEATURE__DEEP_COPY: for property in obj.properties: if property.occurrence != Property.OCCURRENCE__IGNORED and \ - property.type not in predefined_objects: + property.type not in predefined_objects and \ + property.type in objects_by_name: objects_by_name[property.type].features |= Object.FEATURE__DEEP_COPY # detect extended_by relation diff --git a/src/esx/esx_vi_methods.c b/src/esx/esx_vi_methods.c index 3e095c7..b2b3e8d 100644 --- a/src/esx/esx_vi_methods.c +++ b/src/esx/esx_vi_methods.c @@ -491,6 +491,92 @@ ESX_VI__METHOD(RegisterVM_Task, +/* esxVI_CreateSnapshot_Task */ +ESX_VI__METHOD(CreateSnapshot_Task, + (esxVI_Context *ctx, + esxVI_ManagedObjectReference *virtualMachine, + const char *name, const char *description, + esxVI_Boolean memory, esxVI_Boolean quiesce, + esxVI_ManagedObjectReference **task), + RequiredItem, +{ + ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) +}, +{ + ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachine) + ESX_VI__METHOD__PARAMETER__REQUIRE(name) + ESX_VI__METHOD__PARAMETER__REQUIRE(memory) + ESX_VI__METHOD__PARAMETER__REQUIRE(quiesce) +}, +{ + ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, + virtualMachine) + ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, name) + ESX_VI__METHOD__PARAMETER__SERIALIZE_VALUE(String, description) + ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, memory) + ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, quiesce) +}, +{ + if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { + goto failure; + } +}) + + + +/* esxVI_RevertToSnapshot_Task */ +ESX_VI__METHOD(RevertToSnapshot_Task, + (esxVI_Context *ctx, + esxVI_ManagedObjectReference *virtualMachineSnapshot, + esxVI_ManagedObjectReference *host, + esxVI_ManagedObjectReference **task), + RequiredItem, +{ + ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) +}, +{ + ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachineSnapshot) +}, +{ + ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, + virtualMachineSnapshot) + ESX_VI__METHOD__PARAMETER__SERIALIZE(ManagedObjectReference, host) +}, +{ + if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { + goto failure; + } +}) + + + +/* esxVI_RemoveSnapshot_Task */ +ESX_VI__METHOD(RemoveSnapshot_Task, + (esxVI_Context *ctx, + esxVI_ManagedObjectReference *virtualMachineSnapshot, + esxVI_Boolean removeChildren, + esxVI_ManagedObjectReference **task), + RequiredItem, +{ + ESX_VI__METHOD__PARAMETER__CHECK_OUTPUT(task) +}, +{ + ESX_VI__METHOD__PARAMETER__REQUIRE_THIS(virtualMachineSnapshot) + ESX_VI__METHOD__PARAMETER__REQUIRE(removeChildren) +}, +{ + ESX_VI__METHOD__PARAMETER__SERIALIZE_THIS(ManagedObjectReference, + virtualMachineSnapshot) + ESX_VI__METHOD__PARAMETER__SERIALIZE(Boolean, removeChildren) +}, +{ + if (esxVI_ManagedObjectReference_Deserialize(response->node, task) < 0) { + goto failure; + } +}) + + + /* esxVI_CancelTask */ ESX_VI__METHOD(CancelTask, (esxVI_Context *ctx, diff --git a/src/esx/esx_vi_methods.h b/src/esx/esx_vi_methods.h index 40bff51..9ff8b4b 100644 --- a/src/esx/esx_vi_methods.h +++ b/src/esx/esx_vi_methods.h @@ -80,6 +80,20 @@ int esxVI_RegisterVM_Task(esxVI_Context *ctx, esxVI_ManagedObjectReference *host, esxVI_ManagedObjectReference **task); +int esxVI_CreateSnapshot_Task(esxVI_Context *ctx, + esxVI_ManagedObjectReference *virtualMachine, + const char *name, const char *description, + esxVI_Boolean memory, esxVI_Boolean quiesce, + esxVI_ManagedObjectReference **task); + +int esxVI_RevertToSnapshot_Task + (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachineSnapshot, + esxVI_ManagedObjectReference *host, esxVI_ManagedObjectReference **task); + +int esxVI_RemoveSnapshot_Task + (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachineSnapshot, + esxVI_Boolean removeChildren, esxVI_ManagedObjectReference **task); + int esxVI_CancelTask(esxVI_Context *ctx, esxVI_ManagedObjectReference *task); int esxVI_UnregisterVM(esxVI_Context *ctx, diff --git a/src/esx/esx_vi_types.c b/src/esx/esx_vi_types.c index a69ea44..40d8b9b 100644 --- a/src/esx/esx_vi_types.c +++ b/src/esx/esx_vi_types.c @@ -1177,6 +1177,12 @@ ESX_VI__TEMPLATE__VALIDATE(DateTime, ESX_VI__TEMPLATE__PROPERTY__REQUIRE(value); }) +/* esxVI_DateTime_DeepCopy */ +ESX_VI__TEMPLATE__DEEP_COPY(DateTime, +{ + ESX_VI__TEMPLATE__PROPERTY__DEEP_COPY_VALUE(String, value) +}) + /* esxVI_DateTime_Serialize */ ESX_VI__TEMPLATE__SERIALIZE(DateTime, { @@ -1213,6 +1219,72 @@ esxVI_DateTime_Deserialize(xmlNodePtr node, esxVI_DateTime **dateTime) return -1; } +int +esxVI_DateTime_ConvertToCalendarTime(esxVI_DateTime *dateTime, + time_t *secondsSinceEpoch) +{ + char value[64] = ""; + char *tmp; + struct tm tm; + int milliseconds; + char sign; + int tz_hours; + int tz_minutes; + int tz_offset = 0; + + if (dateTime == NULL || secondsSinceEpoch == NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + if (virStrcpyStatic(value, dateTime->value) == NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, + _("xsd:dateTime value '%s' too long for destination"), + dateTime->value); + return -1; + } + + /* expected format: 2010-04-05T12:13:55.316789+02:00 */ + tmp = strptime(value, "%Y-%m-%dT%H:%M:%S", &tm); + + if (tmp == NULL || *tmp != '.' || + virStrToLong_i(tmp + 1, &tmp, 10, &milliseconds) < 0) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, + _("xsd:dateTime value '%s' has unexpected format"), + dateTime->value); + return -1; + } + + sign = *tmp; + + if ((sign != '+' && sign != '-') || + virStrToLong_i(tmp + 1, &tmp, 10, &tz_hours) < 0 || *tmp != ':' || + virStrToLong_i(tmp + 1, NULL, 10, &tz_minutes) < 0) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, + _("xsd:dateTime value '%s' has unexpected format"), + dateTime->value); + return -1; + } + + tz_offset = tz_hours * 60 * 60 + tz_minutes * 60; + + if (sign == '-') { + tz_offset = -tz_offset; + } + + /* + * xsd:dateTime represents local time relative to the timezone given + * as offset. pretend the local time is in UTC and use timegm in order + * to avoid interference with the timezone to this computer. + * apply timezone correction afterwards, because it's simpler than + * handling all the possible over- and underflows when trying to apply + * it to the tm struct. + */ + *secondsSinceEpoch = timegm(&tm) - tz_offset; + + return 0; +} + /* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * @@ -1344,4 +1416,31 @@ esxVI_ManagedObjectReference_Deserialize return -1; } + + #include "esx_vi_types.generated.c" + + + +/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * + * VI Enum: VirtualMachinePowerState (Additions) + */ + +int +esxVI_VirtualMachinePowerState_ConvertToLibvirt + (esxVI_VirtualMachinePowerState powerState) +{ + switch (powerState) { + case esxVI_VirtualMachinePowerState_PoweredOff: + return VIR_DOMAIN_SHUTOFF; + + case esxVI_VirtualMachinePowerState_PoweredOn: + return VIR_DOMAIN_RUNNING; + + case esxVI_VirtualMachinePowerState_Suspended: + return VIR_DOMAIN_PAUSED; + + default: + return VIR_DOMAIN_NOSTATE; + } +} diff --git a/src/esx/esx_vi_types.h b/src/esx/esx_vi_types.h index d3c7115..4bedca9 100644 --- a/src/esx/esx_vi_types.h +++ b/src/esx/esx_vi_types.h @@ -230,9 +230,12 @@ struct _esxVI_DateTime { int esxVI_DateTime_Alloc(esxVI_DateTime **dateTime); void esxVI_DateTime_Free(esxVI_DateTime **dateTime); int esxVI_DateTime_Validate(esxVI_DateTime *dateTime); +int esxVI_DateTime_DeepCopy(esxVI_DateTime **dest, esxVI_DateTime *src); int esxVI_DateTime_Serialize(esxVI_DateTime *dateTime, const char *element, virBufferPtr output); int esxVI_DateTime_Deserialize(xmlNodePtr node, esxVI_DateTime **dateTime); +int esxVI_DateTime_ConvertToCalendarTime(esxVI_DateTime *dateTime, + time_t *secondsSinceEpoch); @@ -295,4 +298,13 @@ int esxVI_ManagedObjectReference_Deserialize # include "esx_vi_types.generated.h" + + +/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * + * VI Enum: VirtualMachinePowerState (Additions) + */ + +int esxVI_VirtualMachinePowerState_ConvertToLibvirt + (esxVI_VirtualMachinePowerState powerState); + #endif /* __ESX_VI_TYPES_H__ */ -- 1.6.3.3

2 2

[libvirt] [PATCH 0/15] Various MinGW/Windows fixes
by Matthias Bolte 08 Apr '10

08 Apr '10

This series fixes several MinGW compile problem on Windows. Most patches are about exported symbols or missing function bodies. There is also a gnulib issue with MinGW on Windows pending. Eric and I are working on a patch for it. Patches: 01/15 gnulib: Add usleep for MinGW builds 02/15 Make sure uid_t and gid_t are available 03/15 Export conditional state driver symbols only when they are defined 04/15 Remove interfaceRegister from libvirt_private.syms 05/15 Fix export of virConnectAuthPtrDefault for MinGW builds 06/15 Generate libvirt.def from libvirt.syms 07/15 virsh: Handle absence of SA_SIGINFO 08/15 Make sure virtTestCaptureProgramOutput has a body on Windows 09/15 util: Make some conditional symbols unconditional 10/15 bootstrap: Remove rsync from buildreq list 11/15 util: Handle lack of (f)chmod and (f)chown on Windows 12/15 bootstrap: Enable copy-mode for MinGW builds 13/15 util: Replace pciWaitForDeviceCleanup with a stub on Windows 14/15 Add HAVE_PTHREAD_H guard for pthread_sigmask 15/15 util: Add stubs for some functions on Windows Overall diffstat: bootstrap.conf | 8 ++- configure.ac | 17 +++++ docs/apibuild.py | 1 + include/libvirt/libvirt.h.in | 16 +++++- src/.gitignore | 1 + src/Makefile.am | 26 ++++++-- src/libvirt_daemon.syms | 10 +++ src/libvirt_private.syms | 9 --- src/remote/remote_driver.c | 6 ++ src/util/pci.c | 14 ++++ src/util/util.c | 135 ++++++++++++++++++++++++++++++++++++------ src/util/util.h | 4 - tests/testutils.c | 6 ++ tools/virsh.c | 4 + 14 files changed, 218 insertions(+), 39 deletions(-) Matthias

5 55

[libvirt] Problems accessing ESX using libvirt
by Matthew Booth 08 Apr '10

08 Apr '10

I was forwarded the following query relating to v2v: === There are no firewalls between the hosts and the ESX firewall is configured to allow all incoming & outgoing connections. The "virsh -c 'esx://elabhost011.xxx/' list --all" command also fails in the same way as the virt-v2v command. When I run the 'virsh list' command it doesn't prompt for a username/password as in the example below. If I run tcpdump on the ESX host, when 'virsh list' is run, I see the packet arrive from the test box and a reply sent back, only these two packets are sent between the hosts: 09:51:20.205524 bwyhs0020p.xxx.56436 > elabhost011.xxx.16514: S 338(0) win 5840 <mss 1460,sackOK,timestamp 1214177495 0,nop,wscale 7> (DF) 09:51:20.205544 elabhost011.xxx.16514 > bwyhs0020p.xxx.56436: R 0:9 win 0 (DF) The problem is there is nothing listening on port 16514 on the ESX host, hence the "Connection refused" message. Should the connection be using the TSL port as opposed to a 'ESX' port? === The user is using libvirt 0.6.3-20.1.el5_4. Unfortunately I'm not intimately familiar with how the libvirt ESX driver magic works. Can anybody shed any light? Thanks, Matt -- Matthew Booth, RHCA, RHCSS Red Hat Engineering, Virtualisation Team M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490

3 3

[libvirt] FYI: [PATCH] Fix unterminated B<...> in virsh man page
by Jiri Denemark 08 Apr '10

08 Apr '10

FYI, I've just pushed the following trivial fix: >From 7ea025aed0ff110bd7b5ab2037e04aa3205f2c13 Mon Sep 17 00:00:00 2001 Message-Id: <7ea025aed0ff110bd7b5ab2037e04aa3205f2c13.1270731158.git.jdenemar(a)redhat.com> From: Jiri Denemark <jdenemar(a)redhat.com> Date: Thu, 8 Apr 2010 14:44:48 +0200 Subject: [PATCH] Fix unterminated B<...> in virsh man page Mail-Followup-To: libvir-list(a)redhat.com --- tools/virsh.pod | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 9e9f4e0..1b5c1d6 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -312,7 +312,7 @@ Convert a domain name (or UUID) to a domain id Returns basic information about the domain. -=item B<domjobabort I<domain-id-or-uuid> +=item B<domjobabort> I<domain-id-or-uuid> Abort the currently running domain job. -- 1.7.0.4

2 1

[libvirt] [PATCH] Fix Win32 portability problems
by Daniel P. Berrange 08 Apr '10

08 Apr '10

The network filter / snapshot / hooks code introduced some non-portable pices that broke the win32 build * configure.ac: Check for net/ethernet.h required by nwfile config parsing code * src/conf/nwfilter_conf.c: Define ethernet protocol constants if net/ethernet.h is missing * src/util/hooks.c: Disable hooks build on Win32 since it lacks fork/exec/pipe * src/util/threads-win32.c: Fix unchecked return value * tools/virsh.c: Disable SIGPIPE on Win32 since it doesn't exist. Fix non-portable strftime() formats --- configure.ac | 2 +- src/conf/nwfilter_conf.c | 20 ++++++++++++++++++++ src/util/hooks.c | 16 ++++++++++++++++ src/util/threads-win32.c | 2 +- tools/virsh.c | 7 ++++++- 5 files changed, 44 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index e13961e..9a133e4 100644 --- a/configure.ac +++ b/configure.ac @@ -111,7 +111,7 @@ dnl Availability of various not common threadsafe functions AC_CHECK_FUNCS([strerror_r strtok_r getmntent_r getgrnam_r getpwuid_r]) dnl Availability of various common headers (non-fatal if missing). -AC_CHECK_HEADERS([pwd.h paths.h regex.h sys/syslimits.h sys/utsname.h sys/wait.h winsock2.h sched.h termios.h sys/poll.h syslog.h mntent.h]) +AC_CHECK_HEADERS([pwd.h paths.h regex.h sys/syslimits.h sys/utsname.h sys/wait.h winsock2.h sched.h termios.h sys/poll.h syslog.h mntent.h net/ethernet.h]) dnl Where are the XDR functions? dnl If portablexdr is installed, prefer that. diff --git a/src/conf/nwfilter_conf.c b/src/conf/nwfilter_conf.c index 16c1a25..0fe51e4 100644 --- a/src/conf/nwfilter_conf.c +++ b/src/conf/nwfilter_conf.c @@ -26,9 +26,13 @@ #include <config.h> +#include <sys/types.h> +#include <sys/stat.h> #include <fcntl.h> #include <dirent.h> +#if HAVE_NET_ETHERNET_H #include <net/ethernet.h> +#endif #include "internal.h" @@ -41,6 +45,22 @@ #include "domain_conf.h" +/* XXX + * The config parser/struts should not be using platform specific + * constants. Win32 lacks these constants, breaking the parser, + * so temporarily define them until this can be re-written to use + * locally defined enums for all consants + */ +#ifndef ETHERTYPE_IP +#define ETHERTYPE_IP 0x0800 +#endif +#ifndef ETHERTYPE_ARP +#define ETHERTYPE_ARP 0x0806 +#endif +#ifndef ETHERTYPE_IPV6 +#define ETHERTYPE_IPV6 0x86dd +#endif + #define VIR_FROM_THIS VIR_FROM_NWFILTER diff --git a/src/util/hooks.c b/src/util/hooks.c index 755679d..bcab4eb 100644 --- a/src/util/hooks.c +++ b/src/util/hooks.c @@ -24,7 +24,9 @@ #include <config.h> #include <sys/types.h> +#if HAVE_SYS_WAIT_H #include <sys/wait.h> +#endif #include <sys/stat.h> #include <unistd.h> #include <stdlib.h> @@ -188,6 +190,19 @@ virHookPresent(int driver) { * Returns: 0 if the execution succeeded, 1 if the script was not found or * invalid parameters, and -1 if script returned an error */ +#ifdef WIN32 +int +virHookCall(int driver ATTRIBUTE_UNUSED, + const char *id ATTRIBUTE_UNUSED, + int op ATTRIBUTE_UNUSED, + int sub_op ATTRIBUTE_UNUSED, + const char *extra ATTRIBUTE_UNUSED, + const char *input ATTRIBUTE_UNUSED) { + virReportSystemError(ENOSYS, "%s", + _("spawning hooks not supported on this platform")); + return -1; +} +#else int virHookCall(int driver, const char *id, int op, int sub_op, const char *extra, const char *input) { @@ -447,3 +462,4 @@ no_memory: #undef ADD_ENV_LIT #undef ADD_ENV_SPACE } +#endif diff --git a/src/util/threads-win32.c b/src/util/threads-win32.c index b1d1571..a30bccf 100644 --- a/src/util/threads-win32.c +++ b/src/util/threads-win32.c @@ -69,7 +69,7 @@ void virThreadOnExit(void) int virMutexInit(virMutexPtr m) { - virMutexInitRecursive(m); + return virMutexInitRecursive(m); } int virMutexInitRecursive(virMutexPtr m) diff --git a/tools/virsh.c b/tools/virsh.c index aaae7ca..8017beb 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -414,6 +414,7 @@ out: */ static int disconnected = 0; /* we may have been disconnected */ +#ifdef SIGPIPE /* * vshCatchDisconnect: * @@ -442,6 +443,10 @@ vshSetupSignals(void) { sigaction(SIGPIPE, &sig_action, NULL); } +#else +static void +vshSetupSignals(void) {} +#endif /* * vshReconnect: @@ -8425,7 +8430,7 @@ cmdSnapshotList(vshControl *ctl, const vshCmd *cmd) &creation) < 0) continue; localtime_r(&creation, &time_info); - strftime(timestr, sizeof(timestr), "%F %T %z", &time_info); + strftime(timestr, sizeof(timestr), "%Y-%m-%d %H:%M:%S %z", &time_info); vshPrint(ctl, " %-20s %-25s %s\n", names[i], timestr, state); } -- 1.6.6.1

2 2

[libvirt] [PATCH v2] nwfilter: fix for directionality of ICMP traffic
by Stefan Berger 08 Apr '10

08 Apr '10

Changes from V1 to V2 of this patch - I had reversed the logic thinking that icmp type 0 is a echo request,but it's reply -- needed to reverse the logic - Found that ebtables takes the --ip-tos argument only as a hex number This patch enables the skipping of some of the ICMP traffic rules on the iptables level under certain circumstances so that the following filter properly enables unidirectional pings: <filter name='testcase'> <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>  <rule action='accept' direction='in' priority='500'> <icmp type='8'/> </rule>  <rule action='accept' direction='out' priority='500'> <icmp type='0'/> </rule>  <rule action='drop' direction='inout' priority='600'> <icmp/> </rule> </filter> Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 108 +++++++++++++++++------------- 1 file changed, 64 insertions(+), 44 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1022,6 +1022,12 @@ err_exit: * @ifname : The name of the interface to apply the rule to * @vars : A map containing the variables to resolve * @res : The data structure to store the result(s) into + * @match : optional string for state match + * @accept_target : where to jump to on accepted traffic, i.e., "RETURN" + * "ACCEPT" + * @isIPv6 : Whether this is an IPv6 rule + * @maySkipICMP : whether this rule may under certain circumstances skip + * the ICMP rule from being created * * Convert a single rule into its representation for later instantiation * @@ -1039,7 +1045,8 @@ _iptablesCreateRuleInstance(int directio virNWFilterRuleInstPtr res, const char *match, const char *accept_target, - bool isIPv6) + bool isIPv6, + bool maySkipICMP) { char chain[MAX_CHAINNAME_LENGTH]; char number[20]; @@ -1265,6 +1272,10 @@ _iptablesCreateRuleInstance(int directio if (HAS_ENTRY_ITEM(&rule->p.icmpHdrFilter.dataICMPType)) { const char *parm; + + if (maySkipICMP) + goto exit_no_error; + if (rule->prtclType == VIR_NWFILTER_RULE_PROTOCOL_ICMP) parm = "--icmp-type"; else @@ -1386,6 +1397,10 @@ err_exit: return -1; +exit_no_error: + virBufferFreeAndReset(&buf); + + return 0; } @@ -1401,15 +1416,19 @@ iptablesCreateRuleInstance(virNWFilterDe int directionIn = 0; char chainPrefix[2]; int needState = 1; + bool maySkipICMP, inout = false; if ((rule->tt == VIR_NWFILTER_RULE_DIRECTION_IN) || (rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT)) { directionIn = 1; needState = 0; + inout = (rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT); } chainPrefix[0] = 'F'; + maySkipICMP = directionIn || inout; + chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; rc = _iptablesCreateRuleInstance(directionIn, chainPrefix, @@ -1421,10 +1440,14 @@ iptablesCreateRuleInstance(virNWFilterDe needState ? MATCH_STATE_OUT : NULL, "RETURN", - isIPv6); + isIPv6, + maySkipICMP); if (rc) return rc; + + maySkipICMP = !directionIn || inout; + chainPrefix[1] = CHAINPREFIX_HOST_OUT_TEMP; rc = _iptablesCreateRuleInstance(!directionIn, chainPrefix, @@ -1436,10 +1459,13 @@ iptablesCreateRuleInstance(virNWFilterDe needState ? MATCH_STATE_IN : NULL, "ACCEPT", - isIPv6); + isIPv6, + maySkipICMP); if (rc) return rc; + maySkipICMP = directionIn; + chainPrefix[0] = 'H'; chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; rc = _iptablesCreateRuleInstance(directionIn, @@ -1451,9 +1477,8 @@ iptablesCreateRuleInstance(virNWFilterDe res, NULL, "ACCEPT", - isIPv6); - if (rc) - return rc; + isIPv6, + maySkipICMP); return rc; } @@ -1750,9 +1775,9 @@ ebtablesCreateRuleInstance(char chainPre } if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataDSCP)) { - if (printDataType(vars, - number, sizeof(number), - &rule->p.ipHdrFilter.ipHdr.dataDSCP)) + if (printDataTypeAsHex(vars, + number, sizeof(number), + &rule->p.ipHdrFilter.ipHdr.dataDSCP)) goto err_exit; virBufferVSprintf(&buf,

2 2

[libvirt] [PATCH Repost] esx: Allow 'lsisas1068' as SCSI controller type
by Matthias Bolte 08 Apr '10

08 Apr '10

Extend tests to cover all SCSI controller types and document the new type. The lsisas1068 SCSI controller type was added in ESX 4.0. The VMX parser reports an error when this controller type is present. This makes virsh dumpxml fail for every domain that uses this controller type. This patch fixes this and adds lsisas1068 to the list of accepted SCSI controller types. Reported by Jonathan Kelley. --- This is a repost of this patch [1]. DanPB pointed out that the ESX driver is currently abusing the <driver> element to expose the SCSI controller type. Now we have the <controller> element to explicitly model stuff like SCSI controllers in the domain XML config. The ESX driver doesn't support this yet. Also there is currently no way to express the SCSI controller type in the <controller> element. Something like the model attribute for NICs need to be added here too. So I'd like to push this patch now in order to have the immediate problem of failing virsh dumpxml fixed in libvirt 0.8.0. I already got asked offlist when this problem will be fixed. [1] https://www.redhat.com/archives/libvir-list/2010-March/msg00548.html Matthias docs/drvesx.html.in | 4 +++ src/esx/esx_vmx.c | 14 +++++++----- tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx | 7 ------ tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml | 20 ------------------ tests/vmx2xmldata/vmx2xml-scsi-driver.vmx | 17 +++++++++++++++ tests/vmx2xmldata/vmx2xml-scsi-driver.xml | 30 +++++++++++++++++++++++++++ tests/vmx2xmltest.c | 2 +- tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx | 12 ---------- tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml | 15 ------------- tests/xml2vmxdata/xml2vmx-scsi-driver.vmx | 22 +++++++++++++++++++ tests/xml2vmxdata/xml2vmx-scsi-driver.xml | 25 ++++++++++++++++++++++ tests/xml2vmxtest.c | 2 +- 12 files changed, 108 insertions(+), 62 deletions(-) delete mode 100644 tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx delete mode 100644 tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml create mode 100644 tests/vmx2xmldata/vmx2xml-scsi-driver.vmx create mode 100644 tests/vmx2xmldata/vmx2xml-scsi-driver.xml delete mode 100644 tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx delete mode 100644 tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml create mode 100644 tests/xml2vmxdata/xml2vmx-scsi-driver.vmx create mode 100644 tests/xml2vmxdata/xml2vmx-scsi-driver.xml diff --git a/docs/drvesx.html.in b/docs/drvesx.html.in index d5c192d..422a7f0 100644 --- a/docs/drvesx.html.in +++ b/docs/drvesx.html.in @@ -282,6 +282,10 @@ ethernet0.checkMACAddress = "false" <dd> LSI Logic SCSI controller for recent guests. </dd> + <dt><code>lsisas1068</code></dt> + <dd> + LSI Logic SAS 1068 controller. + </dd> </dl> <p> Here a domain XML snippet: diff --git a/src/esx/esx_vmx.c b/src/esx/esx_vmx.c index d242fc6..647e720 100644 --- a/src/esx/esx_vmx.c +++ b/src/esx/esx_vmx.c @@ -552,10 +552,11 @@ esxVMX_GatherSCSIControllers(virDomainDefPtr def, char *virtualDev[4], if (disk->driverName != NULL && STRCASENEQ(disk->driverName, "buslogic") && - STRCASENEQ(disk->driverName, "lsilogic")) { + STRCASENEQ(disk->driverName, "lsilogic") && + STRCASENEQ(disk->driverName, "lsisas1068")) { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, _("Expecting domain XML entry 'devices/disk/target' to " - "be 'buslogic' or 'lsilogic' but found '%s'"), + "be 'buslogic' or 'lsilogic' or 'lsisas1068' but found '%s'"), disk->driverName); return -1; } @@ -1266,10 +1267,11 @@ esxVMX_ParseSCSIController(virConfPtr conf, int controller, int *present, if (*virtualDev != NULL && STRCASENEQ(*virtualDev, "buslogic") && - STRCASENEQ(*virtualDev, "lsilogic")) { + STRCASENEQ(*virtualDev, "lsilogic") && + STRCASENEQ(*virtualDev, "lsisas1068")) { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, - _("Expecting VMX entry '%s' to be 'buslogic' or 'lsilogic' " - "but found '%s'"), virtualDev_name, *virtualDev); + _("Expecting VMX entry '%s' to be 'buslogic' or 'lsilogic' or " + "'lsisas1068' but found '%s'"), virtualDev_name, *virtualDev); goto failure; } @@ -1309,7 +1311,7 @@ esxVMX_ParseDisk(esxVI_Context *ctx, virConfPtr conf, int device, int bus, * bus = VIR_DOMAIN_DISK_BUS_SCSI * controller = [0..3] * id = [0..6,8..15] - * virtualDev = {'buslogic', 'lsilogic'} + * virtualDev = {'buslogic', 'lsilogic', 'lsisas1068'} * * device = {VIR_DOMAIN_DISK_DEVICE_DISK, VIR_DOMAIN_DISK_DEVICE_CDROM} * bus = VIR_DOMAIN_DISK_BUS_IDE diff --git a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx b/tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx deleted file mode 100644 index 1725051..0000000 --- a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx +++ /dev/null @@ -1,7 +0,0 @@ -config.version = "8" -virtualHW.version = "4" -scsi0.present = "true" -scsi0.virtualDev = "buslogic" -scsi0:0.present = "true" -scsi0:0.deviceType = "scsi-hardDisk" -scsi0:0.fileName = "harddisk.vmdk" diff --git a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml b/tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml deleted file mode 100644 index 2ffb866..0000000 --- a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml +++ /dev/null @@ -1,20 +0,0 @@ -<domain type='vmware'> - <uuid>00000000-0000-0000-0000-000000000000</uuid> - <memory>32768</memory> - <currentMemory>32768</currentMemory> - <vcpu>1</vcpu> - <os> - <type arch='i686'>hvm</type> - </os> - <clock offset='utc'/> - <on_poweroff>destroy</on_poweroff> - <on_reboot>restart</on_reboot> - <on_crash>destroy</on_crash> - <devices> - <disk type='file' device='disk'> - <driver name='buslogic'/> - <source file='[datastore] directory/harddisk.vmdk'/> - <target dev='sda' bus='scsi'/> - </disk> - </devices> -</domain> diff --git a/tests/vmx2xmldata/vmx2xml-scsi-driver.vmx b/tests/vmx2xmldata/vmx2xml-scsi-driver.vmx new file mode 100644 index 0000000..cb055f6 --- /dev/null +++ b/tests/vmx2xmldata/vmx2xml-scsi-driver.vmx @@ -0,0 +1,17 @@ +config.version = "8" +virtualHW.version = "4" +scsi0.present = "true" +scsi0.virtualDev = "buslogic" +scsi1.present = "true" +scsi1.virtualDev = "lsilogic" +scsi2.present = "true" +scsi2.virtualDev = "lsisas1068" +scsi0:0.present = "true" +scsi0:0.deviceType = "scsi-hardDisk" +scsi0:0.fileName = "harddisk1.vmdk" +scsi1:0.present = "true" +scsi1:0.deviceType = "scsi-hardDisk" +scsi1:0.fileName = "harddisk2.vmdk" +scsi2:0.present = "true" +scsi2:0.deviceType = "scsi-hardDisk" +scsi2:0.fileName = "harddisk3.vmdk" diff --git a/tests/vmx2xmldata/vmx2xml-scsi-driver.xml b/tests/vmx2xmldata/vmx2xml-scsi-driver.xml new file mode 100644 index 0000000..1fa9ac4 --- /dev/null +++ b/tests/vmx2xmldata/vmx2xml-scsi-driver.xml @@ -0,0 +1,30 @@ +<domain type='vmware'> + <uuid>00000000-0000-0000-0000-000000000000</uuid> + <memory>32768</memory> + <currentMemory>32768</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='i686'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='buslogic'/> + <source file='[datastore] directory/harddisk1.vmdk'/> + <target dev='sda' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsilogic'/> + <source file='[datastore] directory/harddisk2.vmdk'/> + <target dev='sdp' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsisas1068'/> + <source file='[datastore] directory/harddisk3.vmdk'/> + <target dev='sdae' bus='scsi'/> + </disk> + </devices> +</domain> diff --git a/tests/vmx2xmltest.c b/tests/vmx2xmltest.c index b036f5b..f3b3b5e 100644 --- a/tests/vmx2xmltest.c +++ b/tests/vmx2xmltest.c @@ -130,7 +130,7 @@ mymain(int argc, char **argv) DO_TEST("graphics-vnc", "graphics-vnc", esxVI_APIVersion_25); - DO_TEST("scsi-buslogic", "scsi-buslogic", esxVI_APIVersion_25); + DO_TEST("scsi-driver", "scsi-driver", esxVI_APIVersion_25); DO_TEST("scsi-writethrough", "scsi-writethrough", esxVI_APIVersion_25); DO_TEST("harddisk-scsi-file", "harddisk-scsi-file", esxVI_APIVersion_25); diff --git a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx b/tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx deleted file mode 100644 index 2f98da3..0000000 --- a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx +++ /dev/null @@ -1,12 +0,0 @@ -config.version = "8" -virtualHW.version = "4" -guestOS = "other" -uuid.bios = "56 4d 9b ef ac d9 b4 e0-c8 f0 ae a8 b9 10 35 15" -displayName = "scsi-buslogic" -memsize = "4" -numvcpus = "1" -scsi0.present = "true" -scsi0.virtualDev = "buslogic" -scsi0:0.present = "true" -scsi0:0.deviceType = "scsi-hardDisk" -scsi0:0.fileName = "/vmfs/volumes/datastore/directory/harddisk.vmdk" diff --git a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml b/tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml deleted file mode 100644 index 5d52c54..0000000 --- a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml +++ /dev/null @@ -1,15 +0,0 @@ -<domain type='vmware'> - <name>scsi-buslogic</name> - <uuid>564d9bef-acd9-b4e0-c8f0-aea8b9103515</uuid> - <memory>4096</memory> - <os> - <type>hvm</type> - </os> - <devices> - <disk type='file' device='disk'> - <driver name='buslogic'/> - <source file='[datastore] directory/harddisk.vmdk'/> - <target dev='sda' bus='scsi'/> - </disk> - </devices> -</domain> diff --git a/tests/xml2vmxdata/xml2vmx-scsi-driver.vmx b/tests/xml2vmxdata/xml2vmx-scsi-driver.vmx new file mode 100644 index 0000000..7cceca0 --- /dev/null +++ b/tests/xml2vmxdata/xml2vmx-scsi-driver.vmx @@ -0,0 +1,22 @@ +config.version = "8" +virtualHW.version = "4" +guestOS = "other" +uuid.bios = "56 4d 9b ef ac d9 b4 e0-c8 f0 ae a8 b9 10 35 15" +displayName = "scsi-buslogic" +memsize = "4" +numvcpus = "1" +scsi0.present = "true" +scsi0.virtualDev = "buslogic" +scsi1.present = "true" +scsi1.virtualDev = "lsilogic" +scsi2.present = "true" +scsi2.virtualDev = "lsisas1068" +scsi0:0.present = "true" +scsi0:0.deviceType = "scsi-hardDisk" +scsi0:0.fileName = "/vmfs/volumes/datastore/directory/harddisk1.vmdk" +scsi1:0.present = "true" +scsi1:0.deviceType = "scsi-hardDisk" +scsi1:0.fileName = "/vmfs/volumes/datastore/directory/harddisk2.vmdk" +scsi2:0.present = "true" +scsi2:0.deviceType = "scsi-hardDisk" +scsi2:0.fileName = "/vmfs/volumes/datastore/directory/harddisk3.vmdk" diff --git a/tests/xml2vmxdata/xml2vmx-scsi-driver.xml b/tests/xml2vmxdata/xml2vmx-scsi-driver.xml new file mode 100644 index 0000000..797a26e --- /dev/null +++ b/tests/xml2vmxdata/xml2vmx-scsi-driver.xml @@ -0,0 +1,25 @@ +<domain type='vmware'> + <name>scsi-buslogic</name> + <uuid>564d9bef-acd9-b4e0-c8f0-aea8b9103515</uuid> + <memory>4096</memory> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file' device='disk'> + <driver name='buslogic'/> + <source file='[datastore] directory/harddisk1.vmdk'/> + <target dev='sda' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsilogic'/> + <source file='[datastore] directory/harddisk2.vmdk'/> + <target dev='sdp' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsisas1068'/> + <source file='[datastore] directory/harddisk3.vmdk'/> + <target dev='sdae' bus='scsi'/> + </disk> + </devices> +</domain> diff --git a/tests/xml2vmxtest.c b/tests/xml2vmxtest.c index b8b9d6f..f9c4730 100644 --- a/tests/xml2vmxtest.c +++ b/tests/xml2vmxtest.c @@ -175,7 +175,7 @@ mymain(int argc, char **argv) DO_TEST("graphics-vnc", "graphics-vnc", esxVI_APIVersion_25); - DO_TEST("scsi-buslogic", "scsi-buslogic", esxVI_APIVersion_25); + DO_TEST("scsi-driver", "scsi-driver", esxVI_APIVersion_25); DO_TEST("scsi-writethrough", "scsi-writethrough", esxVI_APIVersion_25); DO_TEST("harddisk-scsi-file", "harddisk-scsi-file", esxVI_APIVersion_25); -- 1.6.3.3

2 2

[libvirt] [PATCH] esx: Report an error for invalid arguments in esxList(Defined)Domains
by Matthias Bolte 08 Apr '10

08 Apr '10

--- src/esx/esx_driver.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index 888ac10..eb06555 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -964,7 +964,8 @@ esxListDomains(virConnectPtr conn, int *ids, int maxids) int count = 0; if (ids == NULL || maxids < 0) { - goto failure; + ESX_ERROR(VIR_ERR_INVALID_ARG, "%s", _("Invalid arguemnt")); + return -1; } if (maxids == 0) { @@ -2255,7 +2256,8 @@ esxListDefinedDomains(virConnectPtr conn, char **const names, int maxnames) int i; if (names == NULL || maxnames < 0) { - goto failure; + ESX_ERROR(VIR_ERR_INVALID_ARG, "%s", _("Invalid arguemnt")); + return -1; } if (maxnames == 0) { -- 1.6.3.3

2 2

[libvirt] [PATCH] Avoid searching for windres when not building for cygwin or mingw.
by Diego Elio Pettenò 08 Apr '10

08 Apr '10

Just checking for a windres tool might hit even on Linux systems when building for Linux (e.g.: when using Gentoo and having built binutils with multitarget support), and will then fail to link properly at the end of the build. Check the host string before deciding whether to look for windres or not. --- configure.ac | 9 +++++++-- 1 files changed, 7 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index 29c6396..e6122b9 100644 --- a/configure.ac +++ b/configure.ac @@ -1676,8 +1676,13 @@ AC_SUBST([CYGWIN_EXTRA_PYTHON_LIBADD]) AC_SUBST([MINGW_EXTRA_LDFLAGS]) dnl Look for windres to build a Windows icon resource. -AC_CHECK_TOOL([WINDRES], [windres], [no]) -AM_CONDITIONAL([WITH_WIN_ICON], [test "$WINDRES" != "no"]) +case "$host" in + *cygwin* | *mingw* ) + AC_CHECK_TOOL([WINDRES], [windres], []) + ;; +esac + +AM_CONDITIONAL([WITH_WIN_ICON], [test "$WINDRES" != ""]) -- 1.6.6.1

3 2

[libvirt] [PATCH] nwfilters: Test suite for checking created firewall entries
by Stefan Berger 08 Apr '10

08 Apr '10

This patch adds new test cases to the existing nwfilter test program and adds a test script that must be run while a VM is running. This test script verifies that input network filter XML creates expected user-defined tables and rules on ebtables, iptables & ip6tables layer and verifies their content against expected content. The idea is that these tools always return exactly the same output when displaying the content of a user-defined table so that the diff tool can be used for simple text comparison. All supported protocols have at least one test case. This test program is not run automatically since it requires a running VM. For all tests to pass the previously posted ICMP fix patch must be applied. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfiltervmtest.sh | 186 ++++++++++++++++++ tests/nwfilterxml2fwallout/ah-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/ah-test.fwall | 19 + tests/nwfilterxml2fwallout/all-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/all-test.fwall | 19 + tests/nwfilterxml2fwallout/arp-test.fwall | 9 tests/nwfilterxml2fwallout/esp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/esp-test.fwall | 19 + tests/nwfilterxml2fwallout/icmp-direction-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction2-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction3-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-test.fwall | 16 + tests/nwfilterxml2fwallout/icmpv6-test.fwall | 16 + tests/nwfilterxml2fwallout/igmp-test.fwall | 19 + tests/nwfilterxml2fwallout/ip-test.fwall | 12 + tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 12 + tests/nwfilterxml2fwallout/ipv6-test.fwall | 14 + tests/nwfilterxml2fwallout/mac-test.fwall | 12 + tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/sctp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/sctp-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/udp-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-test.fwall | 19 + tests/nwfilterxml2xmlin/icmp-direction-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 + tests/nwfilterxml2xmlout/icmp-direction-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction2-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction3-test.xml | 9 tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml | 9 tests/nwfilterxml2xmltest.c | 4 37 files changed, 748 insertions(+) Index: libvirt-acl/tests/nwfiltervmtest.sh =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfiltervmtest.sh @@ -0,0 +1,186 @@ +#!/bin/sh + +VIRSH=virsh +ORIG_IFNAME="vnet0" + +function usage() { + local cmd="$0" + echo "Usage: ${cmd} [--help|-h|-?] [--ifname|-i <interfacename>" + cat <<EOF + +Options: + --help,-h,-? : Display this help screen. + --ifname, -i : Name of the backend interface of the VM. Default 'vnet0' + +Run this program while a KVM VM is running (preferably as only VM on the +system) and one of its interfaces uses a filter called 'testcase'. The name +of the interface of the VM is anticipated to be 'vnet0' unless set by the +'--ifname' option. The following interface description fulfills this +requirement: + + <interface type='bridge'> + <source bridge='virbr0'/> + <target dev='vnet0'/> + <filterref filter='testcase'/> + </interface> + +The individual tests are validated using string comparison where the output +of ebtables, iptables and ip6tables is compared against expected output. As +long as the output of those tools is the same, the tests should all pass. +The tests were developed on Fedore Core 12. + +Known problems: None of the running VMs' names may have spaces. +EOF +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local cmd line tmpfile tmpfile2 + local linenums ctr=0 + local regex="s/${ORIG_IFNAME}/${ifname}/g" + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + tmpfile=`mktemp` + tmpfile2=`mktemp` + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + exec 4<&0 + + exec < ${fwallfile} + + read line + while [ ! -z "${line}" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + exec ${cmd} | grep -v "^Bridge" | grep -v "^$" > ${tmpfile} + + rm ${tmpfile2} + touch ${tmpfile2} + + while [ 1 ]; do + read + + line="${REPLY}" + + if [ "${line:0:1}" == "#" -o -z "${line}" ]; then + + diff ${tmpfile} ${tmpfile2} > /dev/null + + if [ $? -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + else + echo "PASS ${xmlfile} : ${cmd}" + fi + + break; + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 0<&4 + exec 4<&- + + rm -rf "${tmpfile}" "${tmpfile2}" +} + + +function runTests() { + local ifname="$1" + local xmldir="$2" + local fwalldir="$3" + local fwallfiles f + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${ifname}" + done +} + + +function checkVM() { + local vmname="$1" + local ifname="$2" + local nwfilter="$3" + local f i c + + c=`virsh dumpxml ${vmname} | grep -c "<interface"` + if [ ${c} -ne 1 ]; then + echo "VM '${vmname}' has multiple interfaces. I cannot tell for sure " + echo "whether this VM has the correct interface name '${ifname}' and " + echo "reference the filter '${nwfilter}'. Cowardly skipping this VM..." + return 1 + fi + + f=`${VIRSH} dumpxml ${vmname} | \ + tr -d "\n" | \ + sed "s/.*filterref filter='$[a-zA-Z0-9_]\+$'.*/\1/"` + i=`${VIRSH} dumpxml ${vmname} | \ + tr -d "\n" | \ + sed "s/.*\<interface.*target dev='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + if [ "${i}" == "${ifname}" -a "${f}" == "${nwfilter}" ]; then + return 0 + fi + + return 1 +} + + +function main() { + local prgname="$0" + local ifname="${ORIG_IFNAME}" + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms + local filtername="testcase" + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --ifname|-i) shift 1; ifname="$1";; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + vms=`${VIRSH} list | grep running | gawk '{print $2}'` + if [ -z ${vms} ]; then + echo "Error: Need a running VM." + exit 1; + fi + + for vm in ${vms}; do + checkVM "${vm}" "${ifname}" "${filtername}" + if [ $? -eq 0 ]; then + found=1; + break; + fi + done + + if [ ${found} -eq 0 ]; then + echo "Error: Suitable VM seems not to be running. Check the help screen"; + echo "to (--help) to read about requirements to the running VM."; + exit 1; + fi + + runTests "${ifname}" "${xmldir}" "${fwalldir}" +} + +main $* + Index: libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,14 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,16 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21 +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21 +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21 +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21 +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -114,6 +114,10 @@ mymain(int argc, char **argv) DO_TEST("ref-test"); DO_TEST("ref-rule-test"); + DO_TEST("ipt-no-macspoof-test"); + DO_TEST("icmp-direction-test"); + DO_TEST("icmp-direction2-test"); + DO_TEST("icmp-direction3-test"); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout' priority='500'> + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + <rule action='drop' direction='in' priority='500'> + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,12 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/Makefile.am =================================================================== --- libvirt-acl.orig/tests/Makefile.am +++ libvirt-acl/tests/Makefile.am @@ -74,7 +74,9 @@ EXTRA_DIST = \ xml2vmxdata \ nwfilterxml2xmlout \ nwfilterxml2xmlin \ + nwfilterxml2fwallout \ nwfilterschematest \ + nwfiltervmtest.sh \ $(patsubst %,qemuhelpdata/%,$(qemuhelpdata)) noinst_PROGRAMS = virshtest conftest \

3 5

[libvirt] [PATCH] nwfilter: fix for directionality of ICMP traffic
by Stefan Berger 08 Apr '10

08 Apr '10

This patch enables the skipping of some of the ICMP traffic rules on the iptables level under certain circumstances so that the following filter properly enables unidirectional pings: <filter name='testcase'> <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>  <rule action='accept' direction='in' priority='500'> <icmp type='0'/> </rule>  <rule action='accept' direction='out' priority='500'> <icmp type='8'/> </rule>  <rule action='drop' direction='inout' priority='600'> <icmp/> </rule> </filter> Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 108 +++++++++++++++++------------- 1 file changed, 64 insertions(+), 44 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1022,6 +1022,12 @@ err_exit: * @ifname : The name of the interface to apply the rule to * @vars : A map containing the variables to resolve * @res : The data structure to store the result(s) into + * @match : optional string for state match + * @accept_target : where to jump to on accepted traffic, i.e., "RETURN" + * "ACCEPT" + * @isIPv6 : Whether this is an IPv6 rule + * @maySkipICMP : whether this rule may under certain circumstances skip + * the ICMP rule from being created * * Convert a single rule into its representation for later instantiation * @@ -1039,7 +1045,8 @@ _iptablesCreateRuleInstance(int directio virNWFilterRuleInstPtr res, const char *match, const char *accept_target, - bool isIPv6) + bool isIPv6, + bool maySkipICMP) { char chain[MAX_CHAINNAME_LENGTH]; char number[20]; @@ -1265,6 +1272,10 @@ _iptablesCreateRuleInstance(int directio if (HAS_ENTRY_ITEM(&rule->p.icmpHdrFilter.dataICMPType)) { const char *parm; + + if (maySkipICMP) + goto exit_no_error; + if (rule->prtclType == VIR_NWFILTER_RULE_PROTOCOL_ICMP) parm = "--icmp-type"; else @@ -1386,6 +1397,10 @@ err_exit: return -1; +exit_no_error: + virBufferFreeAndReset(&buf); + + return 0; } @@ -1401,15 +1416,19 @@ iptablesCreateRuleInstance(virNWFilterDe int directionIn = 0; char chainPrefix[2]; int needState = 1; + bool maySkipICMP, inout = false; if ((rule->tt == VIR_NWFILTER_RULE_DIRECTION_IN) || (rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT)) { directionIn = 1; needState = 0; + inout = (rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT); } chainPrefix[0] = 'F'; + maySkipICMP = !directionIn && !inout; + chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; rc = _iptablesCreateRuleInstance(directionIn, chainPrefix, @@ -1421,10 +1440,14 @@ iptablesCreateRuleInstance(virNWFilterDe needState ? MATCH_STATE_OUT : NULL, "RETURN", - isIPv6); + isIPv6, + maySkipICMP); if (rc) return rc; + + maySkipICMP = directionIn && !inout; + chainPrefix[1] = CHAINPREFIX_HOST_OUT_TEMP; rc = _iptablesCreateRuleInstance(!directionIn, chainPrefix, @@ -1436,10 +1459,13 @@ iptablesCreateRuleInstance(virNWFilterDe needState ? MATCH_STATE_IN : NULL, "ACCEPT", - isIPv6); + isIPv6, + maySkipICMP); if (rc) return rc; + maySkipICMP = !directionIn; + chainPrefix[0] = 'H'; chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; rc = _iptablesCreateRuleInstance(directionIn, @@ -1451,9 +1477,8 @@ iptablesCreateRuleInstance(virNWFilterDe res, NULL, "ACCEPT", - isIPv6); - if (rc) - return rc; + isIPv6, + maySkipICMP); return rc; }

2 1

[libvirt] [PATCH] Avoid a race when restoring a qemu domain.
by Laine Stump 08 Apr '10

08 Apr '10

This patch adds a 1 second sleep after telling qemu to start the restore operation and before telling qemu to start up the CPUs. Without this sleep, my hardware would end up with the CPUs started before the restore was started, leading to random (but never good) behavior. Apparently this is caused by slow hardware, as I haven't heard of anyone else experiencing this problem. A sleep is a very inelegant way to eliminate the problem, but it's apparently the only way currently available to us. Note that sleep durations as low as 250msec were successful in eliminating the bad behavior; I made it 1 sec. just for extra safety. --- src/qemu/qemu_driver.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 60fa95a..1270c84 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5965,6 +5965,13 @@ static int qemudDomainRestore(virConnectPtr conn, /* If it was running before, resume it now. */ if (header.was_running) { qemuDomainObjPrivatePtr priv = vm->privateData; + + /* pause 1 second to allow qemu time to start the restore, + * otherwise it may start the CPUs before the restore, and end + * up in a "nondeterminate" state. + */ + usleep(1000000); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStartCPUs(priv->mon, conn) < 0) { if (virGetLastError() == NULL) -- 1.6.6.1

3 4

[libvirt] [PATCH v2] nwfilter: Support for learning a VM's IP address
by Stefan Berger 08 Apr '10

08 Apr '10

Since v1, I have made the following changes: - remove unneeded include files - created a new ATTRIBUTE_PACKED in internal.h (please check) - added libpcap to rpm spec file (not built via rpm) - added 2 flags for the type of traffic to be used to detect the IP address of a VM: DETECT_DHCP & DETECT_STATIC. Now if DETECT_DHCP is chosen, temporary filtering rules are applied on the VM's interface that allow the VM to only send and receive DHCP traffic (optionally restricted to a certain DHCP server) until the actual rules are then applied. In that case the libpcap uses a filter that restricts packets the thread received to DHCP Response traffic. The function to request the learning of the IP address is currently invoked with both flags set, but either one by itself works. A user should consciously configure the VM that triggers that for example DETECT_DHCP is to be used alone since in that case a statically configured interface in the VM will not be able to communicate at all. Now the following ways for learning the IP address parameter are available: - explicitly provided IP address by user as filter parameter - snooping of DHCP OFFERs from a specific DHCP server - snooping of DHCP OFFERs from any server - snooping of any traffic from the VM indicating its IP address This patch implements support for learning a VM's IP address. It uses the pcap library to listen on the VM's backend network interface (tap) or the physical ethernet device (macvtap) and tries to capture packets with source or destination MAC address of the VM and learn from DHCP Offers, ARP traffic, or first-sent IPv4 packet what the IP address of the VM's interface is. This then allows to instantiate the network traffic filtering rules without the user having to provide the IP parameter somewhere in the filter description or in the interface description as a parameter. This only supports to detect the parameter IP, which is for the assumed single IPv4 address of a VM. There is not support for interfaces that may have multiple IP addresses (IP aliasing) or IPv6 that may then require more than one valid IP address to be detected. A VM can have multiple independent interfaces that each uses a different IP address and in that case it will be attempted to detect each one of the address independently. So, when for example an interface description in the domain XML has looked like this up to now: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'> <parameter name='IP' value='10.2.3.4'/> </filterref> </interface> you may omit the IP parameter: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> Internally I am walking the 'tree' of a VM's referenced network filters and determine with the given variables which variables are missing. Now, the above IP parameter may be missing and this causes a libvirt-internal thread to be started that uses the pcap library's API to listen to the backend interface (in case of macvtap to the physical interface) in an attempt to determine the missing IP parameter. If the backend interface disappears the thread terminates assuming the VM was brought down. In case of a macvtap device a timeout is being used to wait for packets from the given VM (filtering by VM's interface MAC address). If the VM's macvtap device disappeared the thread also terminates. In all other cases it tries to determine the IP address of the VM and will then apply the rules late on the given interface, which would have happened immediately if the IP parameter had been explicitly given. In case an error happens while the firewall rules are applied, the VM's backend interface is 'down'ed preventing it to communicate. Reasons for failure for applying the network firewall rules may that an ebtables/iptables command failes or OOM errors. Essentially the same failure reasons may occur as when the firewall rules are applied immediately on VM start, except that due to the late application of the filtering rules the VM now is already running and cannot be hindered anymore from starting. Bringing down the whole VM would probably be considered too drastic. While a VM's IP address is attempted to be determined only limited updates to network filters are allowed. In particular it is prevented that filters are modified in such a way that they would introduce new variables. A caveat: The algorithm does not know which one is the appropriate IP address of a VM. If the VM spoofs an IP address in its first ARP traffic or IPv4 packets its filtering rules will be instantiated for this IP address, thus 'locking' it to the found IP address. So, it's still 'safer' to explicitly provide the IP address of a VM's interface in the filter description if it is known beforehand. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- configure.ac | 39 + libvirt.spec.in | 9 src/Makefile.am | 14 src/conf/nwfilter_conf.c | 7 src/conf/nwfilter_conf.h | 3 src/internal.h | 8 src/libvirt_private.syms | 12 src/nwfilter/nwfilter_driver.c | 11 src/nwfilter/nwfilter_ebiptables_driver.c | 258 ++++++++++++ src/nwfilter/nwfilter_ebiptables_driver.h | 11 src/nwfilter/nwfilter_gentech_driver.c | 409 ++++++++++++++++++- src/nwfilter/nwfilter_gentech_driver.h | 14 src/nwfilter/nwfilter_learnipaddr.c | 625 ++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_learnipaddr.h | 68 +++ 14 files changed, 1450 insertions(+), 38 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -0,0 +1,68 @@ +/* + * nwfilter_learnipaddr.h: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#ifndef __NWFILTER_LEARNIPADDR_H +# define __NWFILTER_LEARNIPADDR_H + +enum howDetect { + DETECT_DHCP = 1, + DETECT_STATIC = 2, +}; + +typedef struct _virNWFilterIPAddrLearnReq virNWFilterIPAddrLearnReq; +typedef virNWFilterIPAddrLearnReq *virNWFilterIPAddrLearnReqPtr; +struct _virNWFilterIPAddrLearnReq { + char ifname[IF_NAMESIZE]; + char linkdev[IF_NAMESIZE]; + enum virDomainNetType nettype; + unsigned char macaddr[VIR_MAC_BUFLEN]; + char *filtername; + virNWFilterHashTablePtr filterparams; + virNWFilterDriverStatePtr driver; + enum howDetect howDetect; + + int status; + pthread_t thread; +}; + +int virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver, + enum howDetect howDetect); + +virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(const char *ifname); + + +void virNWFilterDelIpAddrForIfname(const char *ifname); +const char *virNWFilterGetIpAddrForIfname(const char *ifname); + +int virNWFilterLearnInit(void); +void virNWFilterLearnShutdown(void); + +#endif /* __NWFILTER_LEARNIPADDR_H */ Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -0,0 +1,625 @@ +/* + * nwfilter_learnipaddr.c: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#include <config.h> + +#ifdef HAVE_LIBPCAP +# include <pcap.h> +#endif + +#include <fcntl.h> +#include <sys/ioctl.h> + +#include <arpa/inet.h> +#include <net/ethernet.h> +#include <netinet/ip.h> +#include <netinet/udp.h> +#include <net/if_arp.h> + +#include "internal.h" + +#include "buf.h" +#include "memory.h" +#include "logging.h" +#include "datatypes.h" +#include "virterror_internal.h" +#include "threads.h" +#include "conf/nwfilter_params.h" +#include "conf/domain_conf.h" +#include "nwfilter_gentech_driver.h" +#include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + + +/* structure of an ARP request/reply message */ +struct f_arphdr { + struct arphdr arphdr; + uint8_t ar_sha[ETH_ALEN]; + uint32_t ar_sip; + uint8_t ar_tha[ETH_ALEN]; + uint32_t ar_tip; +} ATTRIBUTE_PACKED; + + +/* structure representing DHCP message */ +struct dhcp { + uint8_t op; + uint8_t htype; + uint8_t hlen; + uint8_t hops; + uint32_t xid; + uint16_t secs; + uint16_t flags; + uint32_t ciaddr; + uint32_t yiaddr; + uint32_t siaddr; + uint32_t giaddr; + uint8_t chaddr[16]; + /* omitted */ +} ATTRIBUTE_PACKED; + + +struct ether_vlan_header +{ + uint8_t dhost[ETH_ALEN]; + uint8_t shost[ETH_ALEN]; + uint16_t vlan_type; + uint16_t vlan_flags; + uint16_t ether_type; +} ATTRIBUTE_PACKED; + + +static virMutex pendingLearnReqLock; +static virHashTablePtr pendingLearnReq; + +static virMutex ipAddressMapLock; +static virNWFilterHashTablePtr ipAddressMap; + + +static void +virNWFilterIPAddrLearnReqFree(virNWFilterIPAddrLearnReqPtr req) { + if (!req) + return; + + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->filterparams); + + VIR_FREE(req); +} + + +#if HAVE_LIBPCAP + +static int +virNWFilterRegisterLearnReq(virNWFilterIPAddrLearnReqPtr req) { + int res = -1; + virMutexLock(&pendingLearnReqLock); + + if (!virHashLookup(pendingLearnReq, req->ifname)) + res = virHashAddEntry(pendingLearnReq, req->ifname, req); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + +#endif + + +virNWFilterIPAddrLearnReqPtr +virNWFilterLookupLearnReq(const char *ifname) { + void *res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + +static void +freeLearnReqEntry(void *payload, const char *name ATTRIBUTE_UNUSED) { + virNWFilterIPAddrLearnReqFree(payload); +} + + +#ifdef HAVE_LIBPCAP + +static virNWFilterIPAddrLearnReqPtr +virNWFilterDeregisterLearnReq(const char *ifname) { + virNWFilterIPAddrLearnReqPtr res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + if (res) + virHashRemoveEntry(pendingLearnReq, ifname, NULL); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + + +static int +virNWFilterAddIpAddrForIfname(const char *ifname, char *addr) { + int ret; + + virMutexLock(&ipAddressMapLock); + + ret = virNWFilterHashTablePut(ipAddressMap, ifname, addr, 1); + + virMutexUnlock(&ipAddressMapLock); + + return ret; +} +#endif + + +void +virNWFilterDelIpAddrForIfname(const char *ifname) { + + virMutexLock(&ipAddressMapLock); + + if (virHashLookup(ipAddressMap->hashTable, ifname)) + virNWFilterHashTableRemoveEntry(ipAddressMap, ifname); + + virMutexUnlock(&ipAddressMapLock); +} + + +const char * +virNWFilterGetIpAddrForIfname(const char *ifname) { + const char *res; + + virMutexLock(&ipAddressMapLock); + + res = virHashLookup(ipAddressMap->hashTable, ifname); + + virMutexUnlock(&ipAddressMapLock); + + return res; +} + + +#ifdef HAVE_LIBPCAP + +/** + * learnIPAddressThread + * arg: pointer to virNWFilterIPAddrLearnReq structure + * + * Learn the IP address being used on an interface. Use ARP Request and + * Reply messages, DHCP offers and the first IP packet being sent from + * the VM to detect the IP address it is using. Detects only one IP address + * per interface (IP aliasing not supported). The method on how the + * IP address is detected can be chosen through flags. DETECT_DHCP will + * require that the IP address is detected from a DHCP OFFER, DETECT_STATIC + * will require that the IP address was taken from an ARP packet or an IPv4 + * packet. Both flags can be set at the same time. + */ +static void * +learnIPAddressThread(void *arg) +{ + char errbuf[PCAP_ERRBUF_SIZE] = {0}; + pcap_t *handle; + struct bpf_program fp; + struct pcap_pkthdr header; + const u_char *packet; + struct ether_header *ether_hdr; + struct ether_vlan_header *vlan_hdr; + virNWFilterIPAddrLearnReqPtr req = arg; + uint32_t vmaddr = 0; + unsigned int ethHdrSize; + char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev + : req->ifname; + int to_ms = (strlen(req->linkdev) != 0) ? 1000 + : 0; + char macaddr[VIR_MAC_STRING_BUFLEN]; + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *filter= NULL; + uint16_t etherType; + enum howDetect howDetected = 0; + + req->status = 0; + + handle = pcap_open_live(listen_if, BUFSIZ, 0, to_ms, errbuf); + + if (handle == NULL) { + VIR_DEBUG("Couldn't open device %s: %s\n", listen_if, errbuf); + req->status = ENODEV; + goto done; + } + + virFormatMacAddr(req->macaddr, macaddr); + + switch (req->howDetect) { + case DETECT_DHCP: + virBufferVSprintf(&buf, " ether dst %s" + " and src port 67 and dst port 68", + macaddr); + break; + default: + virBufferVSprintf(&buf, "ether host %s", macaddr); + } + + if (virBufferError(&buf)) { + req->status = ENOMEM; + goto done; + } + + filter = virBufferContentAndReset(&buf); + + if (pcap_compile(handle, &fp, filter, 1, 0) != 0 || + pcap_setfilter(handle, &fp) != 0) { + VIR_DEBUG("Couldn't compile or set filter '%s'.\n", filter); + req->status = EINVAL; + goto done; + } + + while (req->status == 0 && vmaddr == 0) { + packet = pcap_next(handle, &header); + + if (!packet) { + if (to_ms == 0) { + /* assuming IF disappeared */ + req->status = ENODEV; + break; + } + /* listening on linkdev, check whether VM's dev is still there */ + if (checkIf(req->ifname, req->macaddr)) { + req->status = ENODEV; + break; + } + continue; + } + + if (header.len >= sizeof(struct ether_header)) { + ether_hdr = (struct ether_header*)packet; + + switch (ntohs(ether_hdr->ether_type)) { + + case ETHERTYPE_IP: + ethHdrSize = sizeof(struct ether_header); + etherType = ntohs(ether_hdr->ether_type); + break; + + case ETHERTYPE_VLAN: + ethHdrSize = sizeof(struct ether_vlan_header); + vlan_hdr = (struct ether_vlan_header *)packet; + if (ntohs(vlan_hdr->ether_type) != ETHERTYPE_IP || + header.len < ethHdrSize) + continue; + etherType = ntohs(vlan_hdr->ether_type); + break; + + default: + continue; + } + + if (memcmp(ether_hdr->ether_shost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets from the VM + + if (etherType == ETHERTYPE_IP && + (header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + vmaddr = iphdr->saddr; + // skip eth. bcast and mcast addresses, + // and zero address in DHCP Requests + if ((ntohl(vmaddr) & 0xc0000000) || vmaddr == 0) { + vmaddr = 0; + continue; + } + + howDetected = DETECT_STATIC; + } else if (etherType == ETHERTYPE_ARP && + (header.len >= ethHdrSize + + sizeof(struct f_arphdr))) { + struct f_arphdr *arphdr = (struct f_arphdr*)(packet + + ethHdrSize); + switch (ntohs(arphdr->arphdr.ar_op)) { + case ARPOP_REPLY: + vmaddr = arphdr->ar_sip; + howDetected = DETECT_STATIC; + break; + case ARPOP_REQUEST: + vmaddr = arphdr->ar_tip; + howDetected = DETECT_STATIC; + break; + } + } + } else if (memcmp(ether_hdr->ether_dhost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets to the VM + if (etherType == ETHERTYPE_IP && + (header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + if ((iphdr->protocol == IPPROTO_UDP) && + (header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr))) { + struct udphdr *udphdr= (struct udphdr *) + ((char *)iphdr + iphdr->ihl * 4); + if (ntohs(udphdr->source) == 67 && + ntohs(udphdr->dest) == 68 && + header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr) + + sizeof(struct dhcp)) { + struct dhcp *dhcp = (struct dhcp *) + ((char *)udphdr + sizeof(udphdr)); + if (dhcp->op == 2 /* DHCP OFFER */ && + !memcmp(&dhcp->chaddr[0], + req->macaddr, + 6)) { + vmaddr = dhcp->yiaddr; + howDetected = DETECT_DHCP; + } + } + } + } + } + } + if (vmaddr && (req->howDetect & howDetected) == 0) { + vmaddr = 0; + howDetected = 0; + } + } /* while */ + + done: + VIR_FREE(filter); + + if (handle) + pcap_close(handle); + + ebtablesRemoveBasicRules(NULL, req->ifname); + + if (req->status == 0) { + int ret; + char inetaddr[INET_ADDRSTRLEN]; + inet_ntop(AF_INET, &vmaddr, inetaddr, sizeof(inetaddr)); + + virNWFilterAddIpAddrForIfname(req->ifname, strdup(inetaddr)); + + ret = virNWFilterInstantiateFilterLate(NULL, + req->ifname, + req->linkdev, + req->nettype, + req->macaddr, + req->filtername, + req->filterparams, + req->driver); + VIR_DEBUG("Result from applying firewall rules on " + "%s with IP addr %s : %d\n", req->ifname, inetaddr, ret); + } + + memset(&req->thread, 0x0, sizeof(req->thread)); + + VIR_DEBUG("pcap thread terminating for interface %s \n",req->ifname); + + virNWFilterDeregisterLearnReq(req->ifname); + + virNWFilterIPAddrLearnReqFree(req); + + return 0; +} + + +/** + * virNWFilterLearnIPAddress + * @conn: pointer to virConnect object + * @ifname: the name of the interface + * @linkdev : the name of the link device; currently only used in case of a + * macvtap device + * @nettype : the type of interface + * @macaddr : the MAC address of the interface + * @filtername : the name of the top-level filter to apply to the interface + * once its IP address has been detected + * @driver : the network filter driver + * @howDetect : the method on how the thread is supposed to detect the + * IP address; must choose any of the available flags + * + * Instruct to learn the IP address being used on a given interface (ifname). + * Unless there already is a thread attempting to learn the IP address + * being used on the interface, a thread is started that will listen on + * the traffic being sent on the interface (or link device) with the + * MAC address that is provided. Will then launch the application of the + * firewall rules on the interface. + */ +int +virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver, + enum howDetect howDetect) { + int rc; + virNWFilterIPAddrLearnReqPtr req = NULL; + virNWFilterHashTablePtr ht = NULL; + + if (howDetect == 0) + return 1; + + if (VIR_ALLOC(req) < 0) { + virReportOOMError(); + goto err_no_req; + } + + ht = virNWFilterHashTableCreate(0); + if (ht == NULL) { + virReportOOMError(); + goto err_no_ht; + } + + if (virNWFilterHashTablePutAll(conn, filterparams, ht)) + goto err_free_ht; + + req->filtername = strdup(filtername); + if (req->filtername == NULL) { + virReportOOMError(); + goto err_free_ht; + } + + if (virStrcpyStatic(req->ifname, ifname) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for ifname ('%s') " + "not large enough"), ifname); + goto err_free_ht; + } + + if (linkdev) { + if (virStrcpyStatic(req->linkdev, linkdev) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for linkdev ('%s') " + "not large enough"), linkdev); + goto err_free_ht; + } + } + req->nettype = nettype; + memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); + req->driver = driver; + req->filterparams = ht; + ht = NULL; + req->howDetect = howDetect; + + rc = virNWFilterRegisterLearnReq(req); + + if (rc) + goto err_free_ht; + + switch (howDetect) { + case DETECT_DHCP: + if (ebtablesApplyDHCPOnlyRules(conn, + ifname, + macaddr, + NULL)) + goto err_free_ht; + break; + default: + if (ebtablesApplyBasicRules(conn, + ifname, + macaddr)) + goto err_free_ht; + } + + + if (pthread_create(&req->thread, + NULL, + learnIPAddressThread, + req) != 0) + goto err_remove_rules; + + return 0; + +err_remove_rules: + ebtablesRemoveBasicRules(conn, ifname); +err_free_ht: + virNWFilterHashTableFree(ht); +err_no_ht: + virNWFilterIPAddrLearnReqFree(req); +err_no_req: + return 1; +} + +#else + +int +virNWFilterLearnIPAddress(virConnectPtr conn ATTRIBUTE_UNUSED, + const char *ifname ATTRIBUTE_UNUSED, + const char *linkdev ATTRIBUTE_UNUSED, + enum virDomainNetType nettype ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED, + const char *filtername ATTRIBUTE_UNUSED, + virNWFilterHashTablePtr filterparams ATTRIBUTE_UNUSED, + virNWFilterDriverStatePtr driver ATTRIBUTE_UNUSED) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + _("IP parameter must be given since libvirt " + "was not compiled with IP address learning " + "support")); + return 1; +} +#endif /* HAVE_LIBPCAP */ + + +/** + * virNWFilterLearnInit + * Initialization of this layer + */ +int +virNWFilterLearnInit(void) { + pendingLearnReq = virHashCreate(0); + if (!pendingLearnReq) { + virReportOOMError(); + return 1; + } + + if (virMutexInit(&pendingLearnReqLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + ipAddressMap = virNWFilterHashTableCreate(0); + if (!ipAddressMap) { + virReportOOMError(); + virNWFilterLearnShutdown(); + return 1; + } + + if (virMutexInit(&ipAddressMapLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + return 0; +} + + +/** + * virNWFilterLearnShutdown + * Shutdown of this layer + */ +void +virNWFilterLearnShutdown(void) { + virHashFree(pendingLearnReq, freeLearnReqEntry); + pendingLearnReq = NULL; + + virNWFilterHashTableFree(ipAddressMap); + ipAddressMap = NULL; +} Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -308,7 +308,9 @@ NWFILTER_DRIVER_SOURCES = \ nwfilter/nwfilter_gentech_driver.c \ nwfilter/nwfilter_gentech_driver.h \ nwfilter/nwfilter_ebiptables_driver.c \ - nwfilter/nwfilter_ebiptables_driver.h + nwfilter/nwfilter_ebiptables_driver.h \ + nwfilter/nwfilter_learnipaddr.c \ + nwfilter/nwfilter_learnipaddr.h # Security framework and drivers for various models @@ -764,10 +766,11 @@ else libvirt_la_LIBADD += libvirt_driver_nwfilter.la noinst_LTLIBRARIES += libvirt_driver_nwfilter.la endif -libvirt_driver_nwfilter_la_CFLAGS = \ +libvirt_driver_nwfilter_la_CFLAGS = $(LIBPCAP_CFLAGS) \ -I@top_srcdir@/src/conf +libvirt_driver_nwfilter_la_LDFLAGS = $(LIBPCAP_LIBS) if WITH_DRIVER_MODULES -libvirt_driver_nwfilter_la_LDFLAGS = -module -avoid-version ../gnulib/lib/libgnu.la +libvirt_driver_nwfilter_la_LDFLAGS += -module -avoid-version ../gnulib/lib/libgnu.la endif libvirt_driver_nwfilter_la_SOURCES = $(NWFILTER_DRIVER_SOURCES) endif @@ -912,6 +915,7 @@ libvirt_la_LDFLAGS = $(VERSION_SCRIPT_FL -version-info $(LIBVIRT_VERSION_INFO) \ $(COVERAGE_CFLAGS:-f%=-Wc,-f%) \ $(LIBXML_LIBS) \ + $(LIBPCAP_LIBS) \ $(DRIVER_MODULE_LIBS) \ $(CYGWIN_EXTRA_LDFLAGS) $(MINGW_EXTRA_LDFLAGS) libvirt_la_CFLAGS = $(COVERAGE_CFLAGS) -DIN_LIBVIRT @@ -960,8 +964,8 @@ libvirt_lxc_SOURCES = \ $(NODE_INFO_SOURCES) \ $(ENCRYPTION_CONF_SOURCES) \ $(DOMAIN_CONF_SOURCES) \ - $(NWFILTER_PARAM_CONF_SOURCES) \ - $(CPU_CONF_SOURCES) + $(CPU_CONF_SOURCES) \ + $(NWFILTER_PARAM_CONF_SOURCES) libvirt_lxc_LDFLAGS = $(WARN_CFLAGS) $(COVERAGE_LDCFLAGS) $(CAPNG_LIBS) $(YAJL_LIBS) libvirt_lxc_LDADD = $(LIBXML_LIBS) $(NUMACTL_LIBS) ../gnulib/lib/libgnu.la libvirt_lxc_CFLAGS = \ Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -24,6 +24,9 @@ #include <config.h> #include <stdint.h> +#include <sys/socket.h> +#include <sys/ioctl.h> +#include <linux/if.h> #include "internal.h" @@ -34,12 +37,16 @@ #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER #define NWFILTER_STD_VAR_MAC "MAC" +#define NWFILTER_STD_VAR_IP "IP" + +static int _virNWFilterTeardownFilter(const char *ifname); static virNWFilterTechDriverPtr filter_tech_drivers[] = { @@ -111,6 +118,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI * @tables: pointer to hash tabel to add values to * @macaddr: The string of the MAC address to add to the hash table, * may be NULL + * @ipaddr: The string of the IP address to add to the hash table; + * may be NULL * * Returns 0 in case of success, 1 in case an error happened with * error having been reported. @@ -120,7 +129,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI static int virNWFilterVarHashmapAddStdValues(virConnectPtr conn, virNWFilterHashTablePtr table, - char *macaddr) + char *macaddr, + char *ipaddr) { if (macaddr) { if (virHashAddEntry(table->hashTable, @@ -132,6 +142,16 @@ virNWFilterVarHashmapAddStdValues(virCon } } + if (ipaddr) { + if (virHashAddEntry(table->hashTable, + NWFILTER_STD_VAR_IP, + ipaddr) < 0) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + "%s", _("Could not add variable 'IP' to hashmap")); + return 1; + } + } + return 0; } @@ -140,23 +160,26 @@ virNWFilterVarHashmapAddStdValues(virCon * virNWFilterCreateVarHashmap: * @conn: pointer to virConnect object * @macaddr: pointer to string containing formatted MAC address of interface + * @ipaddr: pointer to string containing formatted IP address used by + * VM on this interface; may be NULL * * Create a hashmap used for evaluating the firewall rules. Initializes - * it with the standard variable 'MAC'. + * it with the standard variable 'MAC' and 'IP' if provided. * * Returns pointer to hashmap, NULL if an error occcurred and error message * is attached to the virConnect object. */ virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr) { + char *macaddr, + char *ipaddr) { virNWFilterHashTablePtr table = virNWFilterHashTableCreate(0); if (!table) { virReportOOMError(); return NULL; } - if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr)) { + if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr, ipaddr)) { virNWFilterHashTableFree(table); return NULL; } @@ -284,9 +307,9 @@ _virNWFilterInstantiateRec(virConnectPtr virNWFilterHashTablePtr vars, int *nEntries, virNWFilterRuleInstPtr **insts, - enum instCase useNewFilter, int *foundNewFilter) + enum instCase useNewFilter, int *foundNewFilter, + virNWFilterDriverStatePtr driver) { - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterPoolObjPtr obj; int rc = 0; int i; @@ -365,7 +388,96 @@ _virNWFilterInstantiateRec(virConnectPtr tmpvars, nEntries, insts, useNewFilter, - foundNewFilter); + foundNewFilter, + driver); + + virNWFilterHashTableFree(tmpvars); + + virNWFilterPoolObjUnlock(obj); + if (rc) + break; + } else { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("referenced filter '%s' is missing"), + inc->filterref); + rc = 1; + break; + } + } + } + return rc; +} + + +static int +virNWFilterDetermineMissingVarsRec(virConnectPtr conn, + virNWFilterDefPtr filter, + virNWFilterHashTablePtr vars, + virNWFilterHashTablePtr missing_vars, + int useNewFilter, + virNWFilterDriverStatePtr driver) +{ + virNWFilterPoolObjPtr obj; + int rc = 0; + int i, j; + virNWFilterDefPtr next_filter; + + for (i = 0; i < filter->nentries; i++) { + virNWFilterRuleDefPtr rule = filter->filterEntries[i]->rule; + virNWFilterIncludeDefPtr inc = filter->filterEntries[i]->include; + if (rule) { + // check all variables of this rule + for (j = 0; j < rule->nvars; j++) { + if (!virHashLookup(vars->hashTable, rule->vars[j])) { + virNWFilterHashTablePut(missing_vars, rule->vars[j], + strdup("1"), 1); + } + } + } else if (inc) { + VIR_DEBUG("Following filter %s\n", inc->filterref); + obj = virNWFilterPoolObjFindByName(&driver->pools, + inc->filterref); + if (obj) { + + if (obj->wantRemoved) { + virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + _("Filter '%s' is in use."), + inc->filterref); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + // create a temporary hashmap for depth-first tree traversal + virNWFilterHashTablePtr tmpvars = + virNWFilterCreateVarsFrom(conn, + inc->params, + vars); + if (!tmpvars) { + virReportOOMError(); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + next_filter = obj->def; + + switch (useNewFilter) { + case INSTANTIATE_FOLLOW_NEWFILTER: + if (obj->newDef) { + next_filter = obj->newDef; + } + break; + case INSTANTIATE_ALWAYS: + break; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + next_filter, + tmpvars, + missing_vars, + useNewFilter, + driver); virNWFilterHashTableFree(tmpvars); @@ -438,9 +550,12 @@ virNWFilterInstantiate(virConnectPtr con enum virDomainNetType nettype, virNWFilterDefPtr filter, const char *ifname, + const char *linkdev, virNWFilterHashTablePtr vars, enum instCase useNewFilter, int *foundNewFilter, - bool teardownOld) + bool teardownOld, + const unsigned char *macaddr, + virNWFilterDriverStatePtr driver) { int rc; int j, nptrs; @@ -449,6 +564,45 @@ virNWFilterInstantiate(virConnectPtr con void **ptrs = NULL; int instantiate = 1; + virNWFilterLockFilterUpdates(); + + virNWFilterHashTablePtr missing_vars = virNWFilterHashTableCreate(0); + if (!missing_vars) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + filter, + vars, + missing_vars, + useNewFilter, + driver); + if (rc) + goto err_exit; + + if (virHashSize(missing_vars->hashTable) == 1) { + if (virHashLookup(missing_vars->hashTable, + NWFILTER_STD_VAR_IP) != NULL) { + if (virNWFilterLookupLearnReq(ifname) == NULL) { + rc = virNWFilterLearnIPAddress(conn, + ifname, + linkdev, + nettype, macaddr, + filter->name, + vars, driver, + DETECT_DHCP| DETECT_STATIC); + } + goto err_exit; + } + rc = 1; + goto err_exit; + } else if (virHashSize(missing_vars->hashTable) > 1) { + rc = 1; + goto err_exit; + } + rc = _virNWFilterInstantiateRec(conn, techdriver, nettype, @@ -456,7 +610,8 @@ virNWFilterInstantiate(virConnectPtr con ifname, vars, &nEntries, &insts, - useNewFilter, foundNewFilter); + useNewFilter, foundNewFilter, + driver); if (rc) goto err_exit; @@ -487,24 +642,33 @@ virNWFilterInstantiate(virConnectPtr con err_exit: + virNWFilterUnlockFilterUpdates(); + for (j = 0; j < nEntries; j++) virNWFilterRuleInstFree(insts[j]); VIR_FREE(insts); + virNWFilterHashTableFree(missing_vars); + return rc; } static int -_virNWFilterInstantiateFilter(virConnectPtr conn, - const virDomainNetDefPtr net, - bool teardownOld, - enum instCase useNewFilter) +__virNWFilterInstantiateFilter(virConnectPtr conn, + bool teardownOld, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + enum instCase useNewFilter, + virNWFilterDriverStatePtr driver) { int rc; const char *drvname = EBIPTABLES_DRIVER_ID; - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterTechDriverPtr techdriver; virNWFilterPoolObjPtr obj; virNWFilterHashTablePtr vars, vars1; @@ -512,6 +676,8 @@ _virNWFilterInstantiateFilter(virConnect char vmmacaddr[VIR_MAC_STRING_BUFLEN] = {0}; int foundNewFilter = 0; char *str_macaddr = NULL; + const char *ipaddr; + char *str_ipaddr = NULL; techdriver = virNWFilterTechDriverForName(drvname); @@ -523,25 +689,25 @@ _virNWFilterInstantiateFilter(virConnect return 1; } - VIR_DEBUG("filter name: %s\n", net->filter); + VIR_DEBUG("filter name: %s\n", filtername); - obj = virNWFilterPoolObjFindByName(&driver->pools, net->filter); + obj = virNWFilterPoolObjFindByName(&driver->pools, filtername); if (!obj) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Could not find filter '%s'"), - net->filter); + filtername); return 1; } if (obj->wantRemoved) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Filter '%s' is in use."), - net->filter); + filtername); rc = 1; goto err_exit; } - virFormatMacAddr(net->mac, vmmacaddr); + virFormatMacAddr(macaddr, vmmacaddr); str_macaddr = strdup(vmmacaddr); if (!str_macaddr) { virReportOOMError(); @@ -549,18 +715,29 @@ _virNWFilterInstantiateFilter(virConnect goto err_exit; } + ipaddr = virNWFilterGetIpAddrForIfname(ifname); + if (ipaddr) { + str_ipaddr = strdup(ipaddr); + if (!str_ipaddr) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + } + vars1 = virNWFilterCreateVarHashmap(conn, - str_macaddr); + str_macaddr, str_ipaddr); if (!vars1) { rc = 1; goto err_exit; } str_macaddr = NULL; + str_ipaddr = NULL; vars = virNWFilterCreateVarsFrom(conn, vars1, - net->filterparams); + filterparams); if (!vars) { rc = 1; goto err_exit_vars1; @@ -582,12 +759,15 @@ _virNWFilterInstantiateFilter(virConnect rc = virNWFilterInstantiate(conn, techdriver, - net->type, + nettype, filter, - net->ifname, + ifname, + linkdev, vars, useNewFilter, &foundNewFilter, - teardownOld); + teardownOld, + macaddr, + driver); virNWFilterHashTableFree(vars); @@ -595,15 +775,180 @@ err_exit_vars1: virNWFilterHashTableFree(vars1); err_exit: - virNWFilterPoolObjUnlock(obj); + VIR_FREE(str_ipaddr); VIR_FREE(str_macaddr); return rc; } +static int +_virNWFilterInstantiateFilter(virConnectPtr conn, + const virDomainNetDefPtr net, + bool teardownOld, + enum instCase useNewFilter) +{ + const char *linkdev = (net->type == VIR_DOMAIN_NET_TYPE_DIRECT) + ? net->data.direct.linkdev + : NULL; + return __virNWFilterInstantiateFilter(conn, + teardownOld, + net->ifname, + linkdev, + net->type, + net->mac, + net->filter, + net->filterparams, + useNewFilter, + conn->nwfilterPrivateData); +} + + +// FIXME: move chgIfFlags, ifUp, checkIf into common file & share w/ macvtap.c + +/* + * chgIfFlags: Change flags on an interface + * @ifname : name of the interface + * @flagclear : the flags to clear + * @flagset : the flags to set + * + * The new flags of the interface will be calculated as + * flagmask = (~0 ^ flagclear) + * newflags = (curflags & flagmask) | flagset; + * + * Returns 0 on success, errno on failure. + */ +static int chgIfFlags(const char *ifname, short flagclear, short flagset) { + struct ifreq ifr; + int rc = 0; + int flags; + short flagmask = (~0 ^ flagclear); + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + flags = (ifr.ifr_flags & flagmask) | flagset; + + if (ifr.ifr_flags != flags) { + ifr.ifr_flags = flags; + + if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) + rc = errno; + } + +err_exit: + close(fd); + return rc; +} + +/* + * ifUp + * @name: name of the interface + * @up: 1 for up, 0 for down + * + * Function to control if an interface is activated (up, 1) or not (down, 0) + * + * Returns 0 in case of success or an errno code in case of failure. + */ +static int +ifUp(const char *name, int up) +{ + return chgIfFlags(name, + (up) ? 0 : IFF_UP, + (up) ? IFF_UP : 0); +} + + +/** + * checkIf + * + * @ifname: Name of the interface + * @macaddr: expected MAC address of the interface + * + * FIXME: the interface's index is another good parameter to check + * + * Determine whether a given interface is still available. If so, + * it must have the given MAC address. + * + * Returns an error code ENODEV in case the interface does not exist + * anymore or its MAC address is different, 0 otherwise. + */ +int +checkIf(const char *ifname, const unsigned char *macaddr) +{ + struct ifreq ifr; + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + int rc = 0; + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + if (memcmp(&ifr.ifr_hwaddr.sa_data, macaddr, 6) != 0) + rc = ENODEV; + + err_exit: + close(fd); + return rc; +} + + +int +virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) +{ + int rc; + rc = __virNWFilterInstantiateFilter(conn, + 1, + ifname, + linkdev, + nettype, + macaddr, + filtername, + filterparams, + INSTANTIATE_ALWAYS, + driver); + if (rc) { + //something went wrong... 'DOWN' the interface + if (ifUp(ifname ,0)) { + // assuming interface disappeared... + _virNWFilterTeardownFilter(ifname); + } + } + return rc; +} + + int virNWFilterInstantiateFilter(virConnectPtr conn, const virDomainNetDefPtr net) @@ -660,8 +1005,8 @@ virNWFilterTearOldFilter(virConnectPtr c } -int -virNWFilterTeardownFilter(const virDomainNetDefPtr net) +static int +_virNWFilterTeardownFilter(const char *ifname) { const char *drvname = EBIPTABLES_DRIVER_ID; virNWFilterTechDriverPtr techdriver; @@ -676,13 +1021,21 @@ virNWFilterTeardownFilter(const virDomai #endif return 1; } + techdriver->allTeardown(ifname); - techdriver->allTeardown(net->ifname); + virNWFilterDelIpAddrForIfname(ifname); return 0; } +int +virNWFilterTeardownFilter(const virDomainNetDefPtr net) +{ + return _virNWFilterTeardownFilter(net->ifname); +} + + void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -37,6 +37,8 @@ #include "nwfilter_gentech_driver.h" +#include "nwfilter_learnipaddr.h" + #define VIR_FROM_THIS VIR_FROM_NWFILTER #define nwfilterLog(msg...) fprintf(stderr, msg) @@ -65,9 +67,12 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; - if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + if (virNWFilterLearnInit() < 0) return -1; + if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + goto conf_init_err; + if (VIR_ALLOC(driverState) < 0) goto alloc_err_exit; @@ -120,6 +125,9 @@ error: alloc_err_exit: virNWFilterConfLayerShutdown(); +conf_init_err: + virNWFilterLearnShutdown(); + return -1; } @@ -413,5 +421,6 @@ static virStateDriver stateDriver = { int nwfilterRegister(void) { virRegisterNWFilterDriver(&nwfilterDriver); virRegisterStateDriver(&stateDriver); + virNWFilterLearnInit(); return 0; } Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -46,13 +46,25 @@ int virNWFilterRollbackUpdateFilter(virC int virNWFilterTearOldFilter(virConnectPtr conn, const virDomainNetDefPtr net); +int virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); + int virNWFilterTeardownFilter(const virDomainNetDefPtr net); virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr); + char *macaddr, + char *ipaddr); void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, void *data); +int checkIf(const char *ifname, const unsigned char *macaddr); + #endif Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -488,6 +488,8 @@ virNWFilterRegisterCallbackDriver; virNWFilterTestUnassignDef; virNWFilterConfLayerInit; virNWFilterConfLayerShutdown; +virNWFilterLockFilterUpdates; +virNWFilterUnlockFilterUpdates; #nwfilter_params.h @@ -503,6 +505,16 @@ virNWFilterInstantiateFilter; virNWFilterTeardownFilter; +#nwfilter_learnipaddr.h +ipAddressMap; +ipAddressMapLock; +pendingLearnReq; +pendingLearnReqLock; +virNWFilterGetIpAddrForIfname; +virNWFilterDelIpAddrForIfname; +virNWFilterLookupLearnReq; + + # pci.h pciGetDevice; pciFreeDevice; Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -114,17 +114,18 @@ struct int_map { */ static virMutex updateMutex; -static void +void virNWFilterLockFilterUpdates(void) { virMutexLock(&updateMutex); } -static void +void virNWFilterUnlockFilterUpdates(void) { virMutexUnlock(&updateMutex); } + /* * attribute names for the rules XML */ @@ -2631,7 +2632,7 @@ int virNWFilterConfLayerInit(virHashIter { virNWFilterDomainFWUpdateCB = domUpdateCB; - if (virMutexInit(&updateMutex)) + if (virMutexInitRecursive(&updateMutex)) return 1; if (virNWFilterParamConfLayerInit()) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -565,6 +565,9 @@ virNWFilterDefPtr virNWFilterDefParseFil void virNWFilterPoolObjLock(virNWFilterPoolObjPtr obj); void virNWFilterPoolObjUnlock(virNWFilterPoolObjPtr obj); +void virNWFilterLockFilterUpdates(void); +void virNWFilterUnlockFilterUpdates(void); + int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -2594,6 +2594,264 @@ ebiptablesInstCommand(virConnectPtr conn } +/** + * ebtablesApplyBasicRules + * + * @conn: virConnect object + * @ifname: name of the backend-interface to which to apply the rules + * @macaddr: MAC address the VM is using in packets sent through the + * interface + * + * Returns 0 on success, 1 on failure with the rules removed + * + * Apply basic filtering rules on the given interface + * - filtering for MAC address spoofing + * - allowing IPv4 & ARP traffic + */ +int +ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + char chain[MAX_CHAINNAME_LENGTH]; + char chainPrefix = CHAINPREFIX_HOST_IN_TEMP; + char macaddr_str[VIR_MAC_STRING_BUFLEN]; + + virFormatMacAddr(macaddr, macaddr_str); + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebiptablesExecCLI(conn, &buf, &cli_status); + + ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + + PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p IPv4 -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p ARP -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + + if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + goto tear_down_tmpebchains; + + return 0; + +tear_down_tmpebchains: + ebtablesRemoveBasicRules(conn, ifname); + + virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + "%s", + _("Some rules could not be created.")); + + return 1; +} + + +/** + * ebtablesApplyDHCPOnlyRules + * + * @conn: virConnect object + * @ifname: name of the backend-interface to which to apply the rules + * @macaddr: MAC address the VM is using in packets sent through the + * interface + * @dhcpserver: The DHCP server from which the VM may receive traffic + * from; may be NULL + * + * Returns 0 on success, 1 on failure with the rules removed + * + * Apply filtering rules so that the VM can only send and receive + * DHCP traffic and nothing else. + */ +int +ebtablesApplyDHCPOnlyRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr, + const char *dhcpserver) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + char chain_in [MAX_CHAINNAME_LENGTH], + chain_out[MAX_CHAINNAME_LENGTH]; + char macaddr_str[VIR_MAC_STRING_BUFLEN]; + char *srcIPParam = NULL; + + if (dhcpserver) { + virBufferVSprintf(&buf, " --ip-src %s", dhcpserver); + if (virBufferError(&buf)) + return 1; + srcIPParam = virBufferContentAndReset(&buf); + } + + virFormatMacAddr(macaddr, macaddr_str); + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebiptablesExecCLI(conn, &buf, &cli_status); + + ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + ebtablesCreateTmpRootChain(conn, &buf, 0, ifname, 1); + + PRINT_ROOT_CHAIN(chain_in , CHAINPREFIX_HOST_IN_TEMP , ifname); + PRINT_ROOT_CHAIN(chain_out, CHAINPREFIX_HOST_OUT_TEMP, ifname); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_in, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s" + " -p ipv4 --ip-protocol udp" + " --ip-src 0.0.0.0 --ip-dst 255.255.255.255 " + " --ip-sport 68 --ip-dport 67 " + " -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_in, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_in, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -d ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_out, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s" + " -p ipv4 --ip-protocol udp" + " --ip-sport 67 --ip-dport 68" + " %s" + " -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_out, + srcIPParam != NULL ? srcIPParam : "", + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain_out, + CMD_STOPONERR(1)); + + ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + ebtablesLinkTmpRootChain(conn, &buf, 0, ifname, 1); + + if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + goto tear_down_tmpebchains; + + VIR_FREE(srcIPParam); + + return 0; + +tear_down_tmpebchains: + ebtablesRemoveBasicRules(conn, ifname); + + virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + "%s", + _("Some rules could not be created.")); + + VIR_FREE(srcIPParam); + + return 1; +} + + +int +ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + + ebiptablesExecCLI(conn, &buf, &cli_status); + return 0; +} + + static int ebiptablesRuleOrderSort(const void *a, const void *b) { Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h @@ -45,4 +45,15 @@ extern virNWFilterTechDriver ebiptables_ # define EBIPTABLES_DRIVER_ID "ebiptables" + +int ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr); +int ebtablesApplyDHCPOnlyRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr, + const char *dhcpServer); +int ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname); + #endif Index: libvirt-acl/configure.ac =================================================================== --- libvirt-acl.orig/configure.ac +++ libvirt-acl/configure.ac @@ -41,6 +41,7 @@ XMLRPC_REQUIRED=1.14.0 HAL_REQUIRED=0.5.0 DEVMAPPER_REQUIRED=1.0.0 LIBCURL_REQUIRED="7.18.0" +LIBPCAP_REQUIRED="1.0.0" dnl Checks for C compiler. AC_PROG_CC @@ -1045,6 +1046,39 @@ AC_SUBST([NUMACTL_CFLAGS]) AC_SUBST([NUMACTL_LIBS]) +dnl pcap lib +LIBPCAP_CONFIG="pcap-config" +LIBPCAP_CFLAGS="" +LIBPCAP_LIBS="" +LIBPCAP_FOUND="no" + +AC_ARG_WITH([libpcap], AC_HELP_STRING([--with-libpcap=@<:@PFX@:>@], [libpcap location])) +if test "$with_qemu" = "yes"; then + if test "x$with_libpcap" != "xno" ; then + if test "x$with_libpcap" != "x" ; then + LIBPCAP_CONFIG=$with_libpcap/bin/$LIBPCAP_CONFIG + fi + AC_MSG_CHECKING(libpcap $LIBPCAP_CONFIG >= $LIBPCAP_REQUIRED ) + if ! $LIBPCAP_CONFIG --libs > /dev/null 2>&1 ; then + AC_MSG_RESULT(no) + else + LIBPCAP_LIBS="`$LIBPCAP_CONFIG --libs`" + LIBPCAP_CFLAGS="`$LIBPCAP_CONFIG --cflags`" + LIBPCAP_FOUND="yes" + AC_MSG_RESULT(yes) + fi + fi +fi + +if test "x$LIBPCAP_FOUND" = "xyes"; then + AC_DEFINE_UNQUOTED([HAVE_LIBPCAP], 1, [whether libpcap can be used]) +fi + +AC_SUBST([LIBPCAP_CFLAGS]) +AC_SUBST([LIBPCAP_LIBS]) + + + dnl dnl Checks for the UML driver dnl @@ -2129,6 +2163,11 @@ AC_MSG_NOTICE([ xmlrpc: $XMLRPC_CFLAGS else AC_MSG_NOTICE([ xmlrpc: no]) fi +if test "$with_qemu" = "yes" ; then +AC_MSG_NOTICE([ pcap: $LIBPCAP_CFLAGS $LIBPCAP_LIBS]) +else +AC_MSG_NOTICE([ pcap: no]) +fi AC_MSG_NOTICE([]) AC_MSG_NOTICE([Test suite]) AC_MSG_NOTICE([]) Index: libvirt-acl/src/internal.h =================================================================== --- libvirt-acl.orig/src/internal.h +++ libvirt-acl/src/internal.h @@ -138,6 +138,14 @@ # endif # endif +# ifndef ATTRIBUTE_PACKED +# if __GNUC_PREREQ (3, 3) +# define ATTRIBUTE_PACKED __attribute__((packed)) +# else +# error "Need an __attribute__((packed)) equivalent" +# endif +# endif + # ifndef ATTRIBUTE_NONNULL # if __GNUC_PREREQ (3, 3) # define ATTRIBUTE_NONNULL(m) __attribute__((__nonnull__(m))) Index: libvirt-acl/libvirt.spec.in =================================================================== --- libvirt-acl.orig/libvirt.spec.in +++ libvirt-acl/libvirt.spec.in @@ -61,6 +61,7 @@ %define with_udev 0%{!?_without_udev:0} %define with_hal 0%{!?_without_hal:0} %define with_yajl 0%{!?_without_yajl:0} +%define with_libpcap 0%{!?_without_libpcap:0} # Non-server/HV driver defaults which are always enabled %define with_python 0%{!?_without_python:1} @@ -147,6 +148,11 @@ %define with_yajl 0%{!?_without_yajl:%{server_drivers}} %endif +# Enable libpcap library +%if %{with_qemu} +%define with_libpcap 0%{!?_without_libpcap:%{server_drivers}} +%endif + # Force QEMU to run as non-root %if 0%{?fedora} >= 12 || 0%{?rhel} >= 6 %define qemu_user qemu @@ -266,6 +272,9 @@ BuildRequires: libpciaccess-devel >= 0.1 %if %{with_yajl} BuildRequires: yajl-devel %endif +%if %{with_libpcap} +BuildRequires: libpcap-devel +%endif %if %{with_avahi} BuildRequires: avahi-devel %endif

2 2

[libvirt] [PATCH v2] nwfilters: Test suite for checking created firewall entries
by Stefan Berger 07 Apr '10

07 Apr '10

Changes from v1 to v2: - followed suggestions from Eric Blake on script improvements This patch adds new test cases to the existing nwfilter test program and adds a test script that must be run while a VM is running. This test script verifies that input network filter XML creates expected user-defined tables and rules on ebtables, iptables & ip6tables layer and verifies their content against expected content. The idea is that these tools always return exactly the same output when displaying the content of a user-defined table so that the diff tool can be used for simple text comparison. All supported protocols have at least one test case. This test program is not run automatically since it requires a running VM. For all tests to pass the previously posted ICMP fix patch must be applied. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfiltervmtest.sh | 186 ++++++++++++++++++ tests/nwfilterxml2fwallout/ah-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/ah-test.fwall | 19 + tests/nwfilterxml2fwallout/all-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/all-test.fwall | 19 + tests/nwfilterxml2fwallout/arp-test.fwall | 9 tests/nwfilterxml2fwallout/esp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/esp-test.fwall | 19 + tests/nwfilterxml2fwallout/icmp-direction-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction2-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-direction3-test.fwall | 16 + tests/nwfilterxml2fwallout/icmp-test.fwall | 16 + tests/nwfilterxml2fwallout/icmpv6-test.fwall | 16 + tests/nwfilterxml2fwallout/igmp-test.fwall | 19 + tests/nwfilterxml2fwallout/ip-test.fwall | 12 + tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 12 + tests/nwfilterxml2fwallout/ipv6-test.fwall | 14 + tests/nwfilterxml2fwallout/mac-test.fwall | 12 + tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/sctp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/sctp-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/tcp-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udp-ipv6-test.xml | 19 + tests/nwfilterxml2fwallout/udp-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 19 + tests/nwfilterxml2fwallout/udplite-test.fwall | 19 + tests/nwfilterxml2xmlin/icmp-direction-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 + tests/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 + tests/nwfilterxml2xmlout/icmp-direction-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction2-test.xml | 12 + tests/nwfilterxml2xmlout/icmp-direction3-test.xml | 9 tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml | 9 tests/nwfilterxml2xmltest.c | 4 37 files changed, 748 insertions(+) Index: libvirt-acl/tests/nwfiltervmtest.sh =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfiltervmtest.sh @@ -0,0 +1,191 @@ +#!/bin/bash + +VIRSH=virsh +ORIG_IFNAME="vnet0" + +TMPFILE1="/tmp/nwfiltervmtest1.txt" +TMPFILE2="/tmp/nwfiltervmtest2.txt" + +function usage() { + local cmd="$0" + echo "Usage: ${cmd} [--help|-h|-?] [--ifname|-i <interfacename>" + cat <<EOF + +Options: + --help,-h,-? : Display this help screen. + --ifname, -i : Name of the backend interface of the VM. Default 'vnet0' + +Run this program while a KVM VM is running (preferably as only VM on the +system) and one of its interfaces uses a filter called 'testcase'. The name +of the interface of the VM is anticipated to be 'vnet0' unless set by the +'--ifname' option. The following interface description fulfills this +requirement: + + <interface type='bridge'> + <source bridge='virbr0'/> + <target dev='vnet0'/> + <filterref filter='testcase'/> + </interface> + +The individual tests are validated using string comparison where the output +of ebtables, iptables and ip6tables is compared against expected output. As +long as the output of those tools is the same, the tests should all pass. +The tests were developed on Fedore Core 12. + +Known problems: None of the running VMs' names may have spaces. +EOF +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local cmd line tmpfile tmpfile2 + local linenums ctr=0 + local regex="s/${ORIG_IFNAME}/${ifname}/g" + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + tmpfile="${TMPFILE1}" + tmpfile2="${TMPFILE2}" + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + exec 4<&0 + + exec < ${fwallfile} + + read line + while [ "x${line}x" != "xx" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + exec ${cmd} | grep -v "^Bridge" | grep -v "^$" > ${tmpfile} + + rm ${tmpfile2} 2>/dev/null + touch ${tmpfile2} + + while [ 1 ]; do + read + + line="${REPLY}" + + if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then + + diff ${tmpfile} ${tmpfile2} >/dev/null + + if [ $? -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + else + echo "PASS ${xmlfile} : ${cmd}" + fi + + break; + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 0<&4 + exec 4<&- + + rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null +} + + +function runTests() { + local ifname="$1" + local xmldir="$2" + local fwalldir="$3" + local fwallfiles f + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${ifname}" + done +} + + +function checkVM() { + local vmname="$1" + local ifname="$2" + local nwfilter="$3" + local f i c + + c=`${VIRSH} dumpxml ${vmname} | grep -c "<interface"` + if [ ${c} -ne 1 ]; then + echo "VM '${vmname}' has multiple interfaces. I cannot tell for sure " + echo "whether this VM has the correct interface name '${ifname}' and " + echo "reference the filter '${nwfilter}'. Cowardly skipping this VM..." + return 1 + fi + + f=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \ + sed "s/.*filterref filter='$[a-zA-Z0-9_]\+$'.*/\1/"` + i=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \ + sed "s/.*\<interface.*target dev='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + if [ "x${i}x" == "x${ifname}x" ] && [ "x${f}x" == "x${nwfilter}x" ]; then + return 0 + fi + + return 1 +} + + +function main() { + local prgname="$0" + local ifname="${ORIG_IFNAME}" + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms + local filtername="testcase" + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --ifname|-i) shift 1; ifname="$1";; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + if [ `uname` != "Linux" ]; then + echo "This script will only run on Linux." + exit 1; + fi + + vms=`${VIRSH} list | grep running | gawk '{print $2}'` + if [ "x${vms}x" == "xx" ]; then + echo "Error: Need a running VM." + exit 1; + fi + + for vm in ${vms}; do + checkVM "${vm}" "${ifname}" "${filtername}" + if [ $? -eq 0 ]; then + found=1; + break; + fi + done + + if [ ${found} -eq 0 ]; then + echo "Error: Suitable VM seems not to be running. Check the help screen"; + echo "to (--help) to read about requirements to the running VM."; + exit 1; + fi + + runTests "${ifname}" "${xmldir}" "${fwalldir}" +} + +main "$@" Index: libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,14 @@ +#ebtables -t nat -L PREROUTING +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,16 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21 +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21 +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21 +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,19 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21 +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 + Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -114,6 +114,10 @@ mymain(int argc, char **argv) DO_TEST("ref-test"); DO_TEST("ref-rule-test"); + DO_TEST("ipt-no-macspoof-test"); + DO_TEST("icmp-direction-test"); + DO_TEST("icmp-direction2-test"); + DO_TEST("icmp-direction3-test"); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout' priority='500'> + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + <rule action='drop' direction='in' priority='500'> + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,12 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml @@ -0,0 +1,9 @@ +<filter name='testcase' chain='root'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,16 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 + Index: libvirt-acl/tests/Makefile.am =================================================================== --- libvirt-acl.orig/tests/Makefile.am +++ libvirt-acl/tests/Makefile.am @@ -74,7 +74,9 @@ EXTRA_DIST = \ xml2vmxdata \ nwfilterxml2xmlout \ nwfilterxml2xmlin \ + nwfilterxml2fwallout \ nwfilterschematest \ + nwfiltervmtest.sh \ $(patsubst %,qemuhelpdata/%,$(qemuhelpdata)) noinst_PROGRAMS = virshtest conftest \

1 0

[libvirt] [PATCH] Fix up python bindings for new event callbacks
by Daniel P. Berrange 07 Apr '10

07 Apr '10

The generator was disabled for the new event callbacks, since they need to be hand written. This patch adds the C and python glue to expose the new APIs in the python binding. The python example program is extended to demonstrate of the code * python/libvirt-override.c: Registration and dispatch of events at the C layer * python/libvirt-override-virConnect.py: Python glue for events * examples/domain-events/events-python/event-test.py: Demo use of new event callbacks --- examples/domain-events/events-python/event-test.py | 22 +- python/libvirt-override-virConnect.py | 45 ++ python/libvirt-override.c | 451 ++++++++++++++++++++ 3 files changed, 517 insertions(+), 1 deletions(-) diff --git a/examples/domain-events/events-python/event-test.py b/examples/domain-events/events-python/event-test.py index 181b389..0c6e2f0 100644 --- a/examples/domain-events/events-python/event-test.py +++ b/examples/domain-events/events-python/event-test.py @@ -412,6 +412,21 @@ def myDomainEventCallback1 (conn, dom, event, detail, opaque): def myDomainEventCallback2 (conn, dom, event, detail, opaque): print "myDomainEventCallback2 EVENT: Domain %s(%s) %s %d" % (dom.name(), dom.ID(), eventToString(event), detail) +def myDomainEventRebootCallback(conn, dom, opaque): + print "myDomainEventRebootCallback: Domain %s(%s)" % (dom.name(), dom.ID()) + +def myDomainEventRTCChangeCallback(conn, dom, utcoffset, opaque): + print "myDomainEventRTCChangeCallback: Domain %s(%s) %d" % (dom.name(), dom.ID(), utcoffset) + +def myDomainEventWatchdogCallback(conn, dom, action, opaque): + print "myDomainEventWatchdogCallback: Domain %s(%s) %d" % (dom.name(), dom.ID(), action) + +def myDomainEventIOErrorCallback(conn, dom, srcpath, devalias, action, opaque): + print "myDomainEventIOErrorCallback: Domain %s(%s) %s %s %d" % (dom.name(), dom.ID(), srcpath, devalias, action) + +def myDomainEventGraphicsCallback(conn, dom, phase, localAddr, remoteAddr, authScheme, subject, opaque): + print "myDomainEventGraphicsCallback: Domain %s(%s) %d %s" % (dom.name(), dom.ID(), phase, authScheme) + def usage(): print "usage: "+os.path.basename(sys.argv[0])+" [uri]" print " uri will default to qemu:///system" @@ -451,7 +466,12 @@ def main(): #Add 2 callbacks to prove this works with more than just one vc.domainEventRegister(myDomainEventCallback1,None) - vc.domainEventRegister(myDomainEventCallback2,None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_LIFECYCLE, myDomainEventCallback2, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_REBOOT, myDomainEventRebootCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_RTC_CHANGE, myDomainEventRTCChangeCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_IO_ERROR, myDomainEventIOErrorCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_WATCHDOG, myDomainEventWatchdogCallback, None) + vc.domainEventRegisterAny(None, libvirt.VIR_DOMAIN_EVENT_ID_GRAPHICS, myDomainEventGraphicsCallback, None) # The rest of your app would go here normally, but for sake # of demo we'll just go to sleep. The other option is to diff --git a/python/libvirt-override-virConnect.py b/python/libvirt-override-virConnect.py index 1fdf548..444a499 100644 --- a/python/libvirt-override-virConnect.py +++ b/python/libvirt-override-virConnect.py @@ -41,3 +41,48 @@ return 0 except AttributeError: pass + + def dispatchDomainEventLifecycleCallback(self, dom, event, detail, cbData): + """Dispatches events to python user domain event callbacks + """ + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), event, detail, opaque) + return 0 + + def dispatchDomainEventGenericCallback(self, dom, cbData): + """Dispatches events to python user domain event callbacks + """ + try: + cb = cbData["cb"] + opaque = cbData["opaque"] + + cb(self, virDomain(self, _obj=dom), opaque) + return 0 + except AttributeError: + pass + + def domainEventDeregisterAny(self, callbackID): + """Removes a Domain Event Callback. De-registering for a + domain callback will disable delivery of this event type """ + try: + ret = libvirtmod.virConnectDomainEventDeregisterAny(self._o, callbackID) + if ret == -1: raise libvirtError ('virConnectDomainEventDeregisterAny() failed', conn=self) + del self.domainEventCallbackID[callbackID] + except AttributeError: + pass + + def domainEventRegisterAny(self, dom, eventID, cb, opaque): + """Adds a Domain Event Callback. Registering for a domain + callback will enable delivery of the events """ + if not hasattr(self, 'domainEventCallbackID'): + self.domainEventCallbackID = {} + cbData = { "cb": cb, "conn": self, "opaque": opaque } + if dom is None: + ret = libvirtmod.virConnectDomainEventRegisterAny(self._o, None, eventID, cbData) + else: + ret = libvirtmod.virConnectDomainEventRegisterAny(self._o, dom._o, eventID, cbData) + if ret == -1: + raise libvirtError ('virConnectDomainEventRegisterAny() failed', conn=self) + self.domainEventCallbackID[ret] = opaque diff --git a/python/libvirt-override.c b/python/libvirt-override.c index e27bce6..02bc313 100644 --- a/python/libvirt-override.c +++ b/python/libvirt-override.c @@ -2761,6 +2761,455 @@ libvirt_virEventInvokeTimeoutCallback(PyObject *self ATTRIBUTE_UNUSED, return VIR_PY_INT_SUCCESS; } + +static void +libvirt_virConnectDomainEventFreeFunc(void *opaque) +{ + PyObject *pyobj_conn = (PyObject*)opaque; + LIBVIRT_ENSURE_THREAD_STATE; + Py_DECREF(pyobj_conn); + LIBVIRT_RELEASE_THREAD_STATE; +} + +static int +libvirt_virConnectDomainEventLifecycleCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + int event, + int detail, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventLifecycleCallback", + (char*)"OiiO", + pyobj_dom, + event, detail, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventGenericCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventGenericCallback", + (char*)"OO", + pyobj_dom, pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventRTCChangeCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + long long utcoffset, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventRTCChangeCallback", + (char*)"OLO", + pyobj_dom, + (PY_LONG_LONG)utcoffset, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventWatchdogCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + int action, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventWatchdogCallback", + (char*)"OiO", + pyobj_dom, + action, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventIOErrorCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + int ret = -1; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventIOErrorCallback", + (char*)"OssiO", + pyobj_dom, + srcPath, devAlias, action, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static int +libvirt_virConnectDomainEventGraphicsCallback(virConnectPtr conn ATTRIBUTE_UNUSED, + virDomainPtr dom, + int phase, + virDomainEventGraphicsAddressPtr local, + virDomainEventGraphicsAddressPtr remote, + const char *authScheme, + virDomainEventGraphicsSubjectPtr subject, + void *opaque) +{ + PyObject *pyobj_cbData = (PyObject*)opaque; + PyObject *pyobj_dom; + PyObject *pyobj_ret; + PyObject *pyobj_conn; + PyObject *dictKey; + PyObject *pyobj_local; + PyObject *pyobj_remote; + PyObject *pyobj_subject; + int ret = -1; + int i; + + LIBVIRT_ENSURE_THREAD_STATE; + + /* Create a python instance of this virDomainPtr */ + virDomainRef(dom); + pyobj_dom = libvirt_virDomainPtrWrap(dom); + Py_INCREF(pyobj_cbData); + + dictKey = libvirt_constcharPtrWrap("conn"); + pyobj_conn = PyDict_GetItem(pyobj_cbData, dictKey); + Py_DECREF(dictKey); + + pyobj_local = PyDict_New(); + PyDict_SetItem(pyobj_local, + libvirt_constcharPtrWrap("family"), + libvirt_intWrap(local->family)); + PyDict_SetItem(pyobj_local, + libvirt_constcharPtrWrap("node"), + libvirt_constcharPtrWrap(local->node)); + PyDict_SetItem(pyobj_local, + libvirt_constcharPtrWrap("service"), + libvirt_constcharPtrWrap(local->service)); + + pyobj_remote = PyDict_New(); + PyDict_SetItem(pyobj_remote, + libvirt_constcharPtrWrap("family"), + libvirt_intWrap(remote->family)); + PyDict_SetItem(pyobj_remote, + libvirt_constcharPtrWrap("node"), + libvirt_constcharPtrWrap(remote->node)); + PyDict_SetItem(pyobj_remote, + libvirt_constcharPtrWrap("service"), + libvirt_constcharPtrWrap(remote->service)); + + pyobj_subject = PyList_New(subject->nidentity); + for (i = 0 ; i < subject->nidentity ; i++) { + PyObject *pair = PyTuple_New(2); + PyTuple_SetItem(pair, 0, libvirt_constcharPtrWrap(subject->identities[i].type)); + PyTuple_SetItem(pair, 1, libvirt_constcharPtrWrap(subject->identities[i].name)); + + PyList_SetItem(pyobj_subject, i, pair); + } + + /* Call the Callback Dispatcher */ + pyobj_ret = PyObject_CallMethod(pyobj_conn, + (char*)"dispatchDomainEventGraphicsCallback", + (char*)"OiOOsOO", + pyobj_dom, + phase, pyobj_local, pyobj_remote, + authScheme, pyobj_subject, + pyobj_cbData); + + Py_DECREF(pyobj_cbData); + Py_DECREF(pyobj_dom); + + if(!pyobj_ret) { +#if DEBUG_ERROR + printf("%s - ret:%p\n", __FUNCTION__, pyobj_ret); +#endif + PyErr_Print(); + } else { + Py_DECREF(pyobj_ret); + ret = 0; + } + + LIBVIRT_RELEASE_THREAD_STATE; + return ret; +} + +static PyObject * +libvirt_virConnectDomainEventRegisterAny(ATTRIBUTE_UNUSED PyObject * self, + PyObject * args) +{ + PyObject *py_retval; /* return value */ + PyObject *pyobj_conn; /* virConnectPtr */ + PyObject *pyobj_dom; + PyObject *pyobj_cbData; /* hash of callback data */ + int eventID; + virConnectPtr conn; + int ret = 0; + virConnectDomainEventGenericCallback cb = NULL; + virDomainPtr dom; + + if (!PyArg_ParseTuple + (args, (char *) "OOiO:virConnectDomainEventRegisterAny", + &pyobj_conn, &pyobj_dom, &eventID, &pyobj_cbData)) { +#if DEBUG_ERROR + printf("%s failed parsing tuple\n", __FUNCTION__); +#endif + return VIR_PY_INT_FAIL; + } + +#ifdef DEBUG_ERROR + printf("libvirt_virConnectDomainEventRegister(%p %p %d %p) called\n", + pyobj_conn, pyobj_dom, eventID, pyobj_cbData); +#endif + conn = PyvirConnect_Get(pyobj_conn); + if (pyobj_dom == Py_None) + dom = NULL; + else + dom = PyvirDomain_Get(pyobj_dom); + + switch (eventID) { + case VIR_DOMAIN_EVENT_ID_LIFECYCLE: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventLifecycleCallback); + break; + case VIR_DOMAIN_EVENT_ID_REBOOT: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventGenericCallback); + break; + case VIR_DOMAIN_EVENT_ID_RTC_CHANGE: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventRTCChangeCallback); + break; + case VIR_DOMAIN_EVENT_ID_WATCHDOG: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventWatchdogCallback); + break; + case VIR_DOMAIN_EVENT_ID_IO_ERROR: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventIOErrorCallback); + break; + case VIR_DOMAIN_EVENT_ID_GRAPHICS: + cb = VIR_DOMAIN_EVENT_CALLBACK(libvirt_virConnectDomainEventGraphicsCallback); + break; + } + + if (!cb) { + return VIR_PY_INT_FAIL; + } + + Py_INCREF(pyobj_cbData); + + LIBVIRT_BEGIN_ALLOW_THREADS; + ret = virConnectDomainEventRegisterAny(conn, dom, eventID, + cb, pyobj_cbData, + libvirt_virConnectDomainEventFreeFunc); + LIBVIRT_END_ALLOW_THREADS; + + if (ret < 0) { + Py_DECREF(pyobj_cbData); + } + + py_retval = libvirt_intWrap(ret); + return (py_retval); +} + +static PyObject * +libvirt_virConnectDomainEventDeregisterAny(ATTRIBUTE_UNUSED PyObject * self, + PyObject * args) +{ + PyObject *py_retval; + PyObject *pyobj_conn; + int callbackID; + virConnectPtr conn; + int ret = 0; + + if (!PyArg_ParseTuple + (args, (char *) "Oi:virConnectDomainEventDeregister", + &pyobj_conn, &callbackID)) + return (NULL); + +#ifdef DEBUG_ERROR + printf("libvirt_virConnectDomainEventDeregister(%p) called\n", pyobj_conn); +#endif + + conn = (virConnectPtr) PyvirConnect_Get(pyobj_conn); + + LIBVIRT_BEGIN_ALLOW_THREADS; + + ret = virConnectDomainEventDeregisterAny(conn, callbackID); + + LIBVIRT_END_ALLOW_THREADS; + py_retval = libvirt_intWrap(ret); + return (py_retval); +} + + /************************************************************************ * * * The registration stuff * @@ -2776,6 +3225,8 @@ static PyMethodDef libvirtMethods[] = { {(char *) "virConnectListDefinedDomains", libvirt_virConnectListDefinedDomains, METH_VARARGS, NULL}, {(char *) "virConnectDomainEventRegister", libvirt_virConnectDomainEventRegister, METH_VARARGS, NULL}, {(char *) "virConnectDomainEventDeregister", libvirt_virConnectDomainEventDeregister, METH_VARARGS, NULL}, + {(char *) "virConnectDomainEventRegisterAny", libvirt_virConnectDomainEventRegisterAny, METH_VARARGS, NULL}, + {(char *) "virConnectDomainEventDeregisterAny", libvirt_virConnectDomainEventDeregisterAny, METH_VARARGS, NULL}, {(char *) "virDomainGetInfo", libvirt_virDomainGetInfo, METH_VARARGS, NULL}, {(char *) "virNodeGetInfo", libvirt_virNodeGetInfo, METH_VARARGS, NULL}, {(char *) "virDomainGetUUID", libvirt_virDomainGetUUID, METH_VARARGS, NULL}, -- 1.6.6.1

2 1

[libvirt] [PATCH] Fix CPU comparison for x86 arch
by Jiri Denemark 07 Apr '10

07 Apr '10

When comparing a CPU to host CPU, the result would be VIR_CPU_COMPARE_SUPERSET (or even VIR_CPU_COMPARE_INCOMPATIBLE if strict match was required) even though the two CPUs were identical. --- src/cpu/cpu_x86.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 46a9fbb..205528d 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -963,8 +963,8 @@ x86Compute(virCPUDefPtr host, x86ModelSubtract(diff, cpu_disable); x86ModelSubtract(diff, cpu_force); - for (i = 0; i < host_model->ncpuid; i++) { - if (!x86cpuidMatch(host_model->cpuid + i, &cpuid_zero)) { + for (i = 0; i < diff->ncpuid; i++) { + if (!x86cpuidMatch(diff->cpuid + i, &cpuid_zero)) { ret = VIR_CPU_COMPARE_SUPERSET; break; } -- 1.7.0.4

2 2

[libvirt] [PATCH] Cleanup x86Compute()
by Jiri Denemark 07 Apr '10

07 Apr '10

No change in semantics. --- src/cpu/cpu_x86.c | 46 +++++++++++++++++----------------------------- 1 files changed, 17 insertions(+), 29 deletions(-) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index e49f7c0..46a9fbb 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -901,7 +901,7 @@ x86Compute(virCPUDefPtr host, struct x86_model *guest_model = NULL; virCPUCompareResult ret; enum compare_result result; - int i; + unsigned int i; if (cpu->arch != NULL) { bool found = false; @@ -919,36 +919,15 @@ x86Compute(virCPUDefPtr host, } } - if ((map = x86LoadMap()) == NULL) - goto error; - - if (!(host_model = x86ModelFromCPU(host, map, 0))) - goto error; - - if (!(cpu_force = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORCE))) - goto error; - - if (!(cpu_require = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_REQUIRE))) - goto error; - - if (!(cpu_optional = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_OPTIONAL))) - goto error; - - if (!(cpu_disable = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_DISABLE))) - goto error; - - if (!(cpu_forbid = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORBID))) + if (!(map = x86LoadMap()) || + !(host_model = x86ModelFromCPU(host, map, 0)) || + !(cpu_force = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORCE)) || + !(cpu_require = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_REQUIRE)) || + !(cpu_optional = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_OPTIONAL)) || + !(cpu_disable = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_DISABLE)) || + !(cpu_forbid = x86ModelFromCPU(cpu, map, VIR_CPU_FEATURE_FORBID))) goto error; - x86ModelSubtract(cpu_require, cpu_disable); - - if ((diff = x86ModelCopy(host_model)) == NULL) - goto no_memory; - - x86ModelSubtract(diff, cpu_require); - x86ModelSubtract(diff, cpu_optional); - x86ModelSubtract(diff, cpu_force); - for (i = 0; i < cpu_forbid->ncpuid; i++) { const struct cpuX86cpuid *cpuid1; const struct cpuX86cpuid *cpuid2; @@ -966,6 +945,7 @@ x86Compute(virCPUDefPtr host, } } + x86ModelSubtract(cpu_require, cpu_disable); result = x86ModelCompare(host_model, cpu_require); if (result == SUBSET || result == UNRELATED) { VIR_DEBUG0("Host CPU does not provide all required features"); @@ -975,6 +955,14 @@ x86Compute(virCPUDefPtr host, ret = VIR_CPU_COMPARE_IDENTICAL; + if ((diff = x86ModelCopy(host_model)) == NULL) + goto no_memory; + + x86ModelSubtract(diff, cpu_optional); + x86ModelSubtract(diff, cpu_require); + x86ModelSubtract(diff, cpu_disable); + x86ModelSubtract(diff, cpu_force); + for (i = 0; i < host_model->ncpuid; i++) { if (!x86cpuidMatch(host_model->cpuid + i, &cpuid_zero)) { ret = VIR_CPU_COMPARE_SUPERSET; -- 1.7.0.4

2 2

[libvirt] [PATCH] Properly advertise cpuselection guest capability
by Jiri Denemark 07 Apr '10

07 Apr '10

There's no sense in advertising cpuselection capability when host CPU is not properly detected and advertised in host capabilities. --- src/qemu/qemu_conf.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 3fb0074..ff5bd43 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -892,7 +892,8 @@ qemudCapsInitGuest(virCapsPtr caps, guest->arch.defaultInfo.emulator_mtime = binary_mtime; - if (qemudProbeCPUModels(binary, info->arch, &ncpus, NULL) == 0 + if (caps->host.cpu + && qemudProbeCPUModels(binary, info->arch, &ncpus, NULL) == 0 && ncpus > 0 && !virCapabilitiesAddGuestFeature(guest, "cpuselection", 1, 0)) goto error; -- 1.7.0.4

2 4

[libvirt] [PATCH] qemudDomainGetSecurityLabel: avoid dead store to "type"
by Jim Meyering 07 Apr '10

07 Apr '10

And another: >From 61f50761015a82906aec31e5a1cdeef0eaf2b0a1 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 7 Apr 2010 17:51:56 +0200 Subject: [PATCH] qemudDomainGetSecurityLabel: avoid dead store to "type" * src/qemu/qemu_driver.c (qemudDomainGetSecurityLabel): Remove store and declaration. --- src/qemu/qemu_driver.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 1e60591..f5cf1f1 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5564,7 +5564,6 @@ static int qemudDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr sec { struct qemud_driver *driver = (struct qemud_driver *)dom->conn->privateData; virDomainObjPtr vm; - const char *type; int ret = -1; qemuDriverLock(driver); @@ -5580,7 +5579,7 @@ static int qemudDomainGetSecurityLabel(virDomainPtr dom, virSecurityLabelPtr sec goto cleanup; } - if (!(type = virDomainVirtTypeToString(vm->def->virtType))) { + if (!virDomainVirtTypeToString(vm->def->virtType)) { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("unknown virt type in domain definition '%d'"), vm->def->virtType); -- 1.7.1.rc0.212.gbd88f

2 2

[libvirt] [PATCH] Don't ignore guest CPU selection when unsupported by HV
by Jiri Denemark 07 Apr '10

07 Apr '10

When qemu libvirt driver doesn't support guest CPU selection with given qemu binary, guests requiring specific CPU should fail to start instead of being silently supplied with a default CPU. --- src/qemu/qemu_conf.c | 13 ++++++++++--- 1 files changed, 10 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 592360f..3fb0074 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -3249,9 +3249,16 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, virBuffer buf = VIR_BUFFER_INITIALIZER; int i; - if (def->cpu && def->cpu->model - && qemudProbeCPUModels(emulator, ut->machine, &ncpus, &cpus) < 0) - goto cleanup; + if (def->cpu && def->cpu->model) { + if (qemudProbeCPUModels(emulator, ut->machine, &ncpus, &cpus) < 0) + goto cleanup; + + if (!ncpus || !host) { + qemuReportError(VIR_ERR_NO_SUPPORT, "%s", + _("CPU specification not supported by hypervisor")); + goto cleanup; + } + } if (ncpus > 0 && host) { virCPUCompareResult cmp; -- 1.7.0.4

2 2

[libvirt] [PATCH] Document all options of virsh dumpxml
by Jiri Denemark 07 Apr '10

07 Apr '10

--- tools/virsh.pod | 13 +++++++++---- 1 files changed, 9 insertions(+), 4 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index a59e9b0..9e9f4e0 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -342,10 +342,15 @@ configuration format named by I<format>. Dumps the core of a domain to a file for analysis. -=item B<dumpxml> I<domain-id> - -Output the domain information as an XML dump to stdout, this format -can be used by the B<create> command. +=item B<dumpxml> I<domain-id> optional I<--inactive> I<--security-info> I<--update-cpu> + +Output the domain information as an XML dump to stdout, this format can be used +by the B<create> command. Additional options affecting the XML dump may be +used. I<--inactive> tells virsh to dump domain configuration that will be used +on next start of the domain as opposed to the current domain configuration. +Using I<--security-info> security sensitive information will also be included +in the XML dump. I<--update-cpu> updates domain CPU requirements according to +host CPU. =item B<edit> I<domain-id> -- 1.7.0.4

2 2

[libvirt] [PATCH] createRawFileOpHook: avoid dead stores
by Jim Meyering 07 Apr '10

07 Apr '10

Here are two more dead stores. >From 7c3d498d8572556d72d4633e9b39f89a08a0a682 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 7 Apr 2010 18:30:55 +0200 Subject: [PATCH] createRawFileOpHook: avoid dead stores * src/storage/storage_backend.c (createRawFileOpHook): Remove dead stores and declaration of each stored-to variable. --- src/storage/storage_backend.c | 9 +++------ 1 files changed, 3 insertions(+), 6 deletions(-) diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index 7294a00..f0074ed 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -308,12 +308,11 @@ static int createRawFileOpHook(int fd, void *data) { * update every 9s is a fair-enough trade-off */ unsigned long long bytes = 512 * 1024 * 1024; - int r; if (bytes > remain) bytes = remain; - if ((r = safezero(fd, 0, hdata->vol->allocation - remain, - bytes)) != 0) { + if (safezero(fd, 0, hdata->vol->allocation - remain, + bytes) != 0) { ret = errno; virReportSystemError(errno, _("cannot fill file '%s'"), hdata->vol->target.path); @@ -322,9 +321,7 @@ static int createRawFileOpHook(int fd, void *data) { remain -= bytes; } } else { /* No progress bars to be shown */ - int r; - - if ((r = safezero(fd, 0, 0, remain)) != 0) { + if (safezero(fd, 0, 0, remain) != 0) { ret = errno; virReportSystemError(errno, _("cannot fill file '%s'"), hdata->vol->target.path); -- 1.7.1.rc0.212.gbd88f

2 1

[libvirt] [PATCH] xenXMDomainDefineXML: remove dead store and useless/leaky virGetDomain
by Jim Meyering 07 Apr '10

07 Apr '10

clang complained about the dead store. Dan Berrange confirmed that this code has been useless-looking for ages. >From e6315e0b0d4b83b744cff86529b6b9e3144e2012 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 7 Apr 2010 20:17:44 +0200 Subject: [PATCH] xenXMDomainDefineXML: remove dead store and useless/leaky virGetDomain * src/xen/xm_internal.c (xenXMDomainDefineXML): Remove useless and leak-inducing call to virGetDomain, as well as decl of now-unused local. --- src/xen/xm_internal.c | 5 ----- 1 files changed, 0 insertions(+), 5 deletions(-) diff --git a/src/xen/xm_internal.c b/src/xen/xm_internal.c index d1265ba..a7a09a0 100644 --- a/src/xen/xm_internal.c +++ b/src/xen/xm_internal.c @@ -2622,7 +2622,6 @@ cleanup: */ virDomainPtr xenXMDomainDefineXML(virConnectPtr conn, const char *xml) { virDomainPtr ret; - virDomainPtr olddomain; char filename[PATH_MAX]; const char * oldfilename; virDomainDefPtr def = NULL; @@ -2688,10 +2687,6 @@ virDomainPtr xenXMDomainDefineXML(virConnectPtr conn, const char *xml) { goto error; } - /* XXX wtf.com is this line for - it appears to be amemory leak */ - if (!(olddomain = virGetDomain(conn, def->name, entry->def->uuid))) - goto error; - /* Remove the name -> filename mapping */ if (virHashRemoveEntry(priv->nameConfigMap, def->name, NULL) < 0) { xenXMError(VIR_ERR_INTERNAL_ERROR, -- 1.7.1.rc0.212.gbd88f

2 1

[libvirt] qemuDomainSnapshotLoad leak
by Jim Meyering 07 Apr '10

07 Apr '10

clang reports that the assignment to "snap" below is a dead store. Actually it's also a leak, and it seems like it deserves a diagnostic if/when that function returns NULL. It looks to me like this function should return something other than "void", so that it can inform its caller of such a failure. No? This is from qemu_driver.c: static void qemuDomainSnapshotLoad(void *payload, const char *name ATTRIBUTE_UNUSED, void *data) { ... virDomainSnapshotObjPtr snap = NULL; ... while ((entry = readdir(dir))) { ... def = virDomainSnapshotDefParseString(xmlStr, 0); if (def == NULL) { /* Nothing we can do here, skip this one */ VIR_ERROR("Failed to parse snapshot XML from file '%s'", fullpath); VIR_FREE(xmlStr); continue; } snap = virDomainSnapshotAssignDef(&vm->snapshots, def); VIR_FREE(xmlStr); } /* FIXME: qemu keeps internal track of snapshots. We can get access * to this info via the "info snapshots" monitor command for running * domains, or via "qemu-img snapshot -l" for shutoff domains. It would * be nice to update our internal state based on that, but there is a * a problem. qemu doesn't track all of the same metadata that we do. * In particular we wouldn't be able to fill in the <parent>, which is * pretty important in our metadata. */ virResetLastError(); cleanup: if (dir) closedir(dir); VIR_FREE(snapDir); virDomainObjUnlock(vm); }

2 4

[libvirt] [PATCH] maint: s/initialis/initializ/
by Eric Blake 07 Apr '10

07 Apr '10

git grep found 12 of the former but 100 of the latter in src/. * src/remote/remote_driver.c (initialise_gnutls): Rename... (initialize_gnutls): ...to this. (doRemoteOpen): Adjust caller. * src/xen/xen_driver.c (xenUnifiedOpen): Adjust output string. * src/util/network.c: Adjust comments. Suggested by Matthias Bolte. --- Should be a pretty trivial conversion from British to American English for a single word. Is it worth adding a rule to cfg.mk to have 'make syntax-check' diagnose future introductions of 'initialis.*'? src/remote/remote_driver.c | 14 +++++++------- src/util/network.c | 8 ++++---- src/xen/xen_driver.c | 4 ++-- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 20ad6c8..d5b68dd 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -271,7 +271,7 @@ void remoteDomainEventQueueFlush(int timer, void *opaque); static char *get_transport_from_scheme (char *scheme); /* GnuTLS functions used by remoteOpen. */ -static int initialise_gnutls (virConnectPtr conn); +static int initialize_gnutls (virConnectPtr conn); static gnutls_session_t negotiate_gnutls_on_connection (virConnectPtr conn, struct private_data *priv, int no_verify); #ifdef WITH_LIBVIRTD @@ -425,7 +425,7 @@ doRemoteOpen (virConnectPtr conn, transport = trans_unix; } - /* Local variables which we will initialise. These can + /* Local variables which we will initialize. These can * get freed in the failed: path. */ char *name = NULL, *command = NULL, *sockname = NULL, *netcat = NULL; @@ -579,7 +579,7 @@ doRemoteOpen (virConnectPtr conn, /* Connect to the remote service. */ switch (transport) { case trans_tls: - if (initialise_gnutls (conn) == -1) goto failed; + if (initialize_gnutls (conn) == -1) goto failed; priv->uses_tls = 1; priv->is_secure = 1; @@ -1140,12 +1140,12 @@ check_cert_file(const char *type, const char *file) static int -initialise_gnutls (virConnectPtr conn) +initialize_gnutls (virConnectPtr conn) { - static int initialised = 0; + static int initialized = 0; int err; - if (initialised) return 0; + if (initialized) return 0; gnutls_global_init (); @@ -1193,7 +1193,7 @@ initialise_gnutls (virConnectPtr conn) return -1; } - initialised = 1; + initialized = 1; return 0; } diff --git a/src/util/network.c b/src/util/network.c index 76f2791..6e24792 100644 --- a/src/util/network.c +++ b/src/util/network.c @@ -1,7 +1,7 @@ /* * network.c: network helper APIs for libvirt * - * Copyright (C) 2009-2009 Red Hat, Inc. + * Copyright (C) 2009-2010 Red Hat, Inc. * * See COPYING.LIB for the License of this software * @@ -116,7 +116,7 @@ virSocketParseIpv6Addr(const char *val, virSocketAddrPtr addr) { /* * virSocketFormatAddr: - * @addr: an initialised virSocketAddrPtr + * @addr: an initialized virSocketAddrPtr * * Returns a string representation of the given address * Returns NULL on any error @@ -158,7 +158,7 @@ virSocketFormatAddr(virSocketAddrPtr addr) { /* * virSocketSetPort: - * @addr: an initialised virSocketAddrPtr + * @addr: an initialized virSocketAddrPtr * @port: the port number to set * * Set the transport layer port of the given virtSocketAddr @@ -189,7 +189,7 @@ virSocketSetPort(virSocketAddrPtr addr, int port) { /* * virSocketGetPort: - * @addr: an initialised virSocketAddrPtr + * @addr: an initialized virSocketAddrPtr * * Returns the transport layer port of the given virtSocketAddr * Returns -1 if @addr is invalid diff --git a/src/xen/xen_driver.c b/src/xen/xen_driver.c index 68b627a..5ab169d 100644 --- a/src/xen/xen_driver.c +++ b/src/xen/xen_driver.c @@ -297,7 +297,7 @@ xenUnifiedOpen (virConnectPtr conn, virConnectAuthPtr auth, int flags) } if (virMutexInit(&priv->lock) < 0) { xenUnifiedError(VIR_ERR_INTERNAL_ERROR, - "%s", _("cannot initialise mutex")); + "%s", _("cannot initialize mutex")); VIR_FREE(priv); return VIR_DRV_OPEN_ERROR; } @@ -1892,7 +1892,7 @@ out: } -/*----- Register with libvirt.c, and initialise Xen drivers. -----*/ +/*----- Register with libvirt.c, and initialize Xen drivers. -----*/ /* The interface which we export upwards to libvirt.c. */ static virDriver xenUnifiedDriver = { -- 1.6.6.1

2 2

[libvirt] Live Migration with non-shared storage for kvm
by Kenneth Nagin 07 Apr '10

07 Apr '10

On February 16th I posted a patch and description for libvirt support of 'Live Migration with non-shared strorage for kvm.' What is the status of the proposed enhancement? Kenneth Nagin

2 4

[libvirt] [PATCH] domain_event.c: don't deref NULL on an OOM error path
by Jim Meyering 07 Apr '10

07 Apr '10

This fixes a pair of potential segfault-inducing bugs: >From 7ca7e9cd366b17e41da9207b68de7e9166a88da2 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Mon, 29 Mar 2010 17:43:01 +0200 Subject: [PATCH] domain_event.c: don't deref NULL on an OOM error path * src/conf/domain_event.c (virDomainEventGraphicsNewFromDom): Return NULL when handling out-of-memory error, rather than falling through with ev=NULL and then assigning to ev->member. (virDomainEventGraphicsNewFromObj): Likewise. --- src/conf/domain_event.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/conf/domain_event.c b/src/conf/domain_event.c index 41c70fc..1cf03e3 100644 --- a/src/conf/domain_event.c +++ b/src/conf/domain_event.c @@ -681,19 +681,19 @@ virDomainEventPtr virDomainEventGraphicsNewFromDom(virDomainPtr dom, { virDomainEventPtr ev = virDomainEventNewInternal(VIR_DOMAIN_EVENT_ID_GRAPHICS, dom->id, dom->name, dom->uuid); if (ev) { ev->data.graphics.phase = phase; if (!(ev->data.graphics.authScheme = strdup(authScheme))) { virDomainEventFree(ev); - ev = NULL; + return NULL; } ev->data.graphics.local = local; ev->data.graphics.remote = remote; ev->data.graphics.subject = subject; } return ev; } @@ -706,19 +706,19 @@ virDomainEventPtr virDomainEventGraphicsNewFromObj(virDomainObjPtr obj, { virDomainEventPtr ev = virDomainEventNewInternal(VIR_DOMAIN_EVENT_ID_GRAPHICS, obj->def->id, obj->def->name, obj->def->uuid); if (ev) { ev->data.graphics.phase = phase; if (!(ev->data.graphics.authScheme = strdup(authScheme))) { virDomainEventFree(ev); - ev = NULL; + return NULL; } ev->data.graphics.local = local; ev->data.graphics.remote = remote; ev->data.graphics.subject = subject; } return ev; } -- 1.7.0.3.448.g82eeb

2 2

[libvirt] [TCK PATCH] maint: use correct Red Hat copyright
by Eric Blake 07 Apr '10

07 Apr '10

* scripts/domain/050-transient-lifecycle.t: Correct the copyright line. * scripts/domain/051-transient-autostart.t: Likewise. * scripts/domain/060-persistent-lifecycle.t: Likewise. * scripts/domain/061-persistent-autostart.t: Likewise. * scripts/domain/065-persistent-redefine.t: Likewise. * scripts/domain/070-transient-to-persistent.t: Likewise. * scripts/domain/080-unique-id-define.t: Likewise. * scripts/domain/081-unique-id-create.t: Likewise. * scripts/domain/090-invalid-ops-when-inactive.t: Likewise. * scripts/domain/100-transient-save-restore.t: Likewise. * scripts/domain/101-persistent-save-restore.t: Likewise. * scripts/domain/102-broken-save-restore.t: Likewise. * scripts/domain/120-disks-stats.t: Likewise. * scripts/domain/200-disk-hotplug.t: Likewise. * scripts/domain/205-disk-hotplug-ordering.t: Likewise. * scripts/domain/210-nic-hotplug.t: Likewise. * scripts/domain/215-nic-hotplug-many.t: Likewise. * scripts/domain/240-usb-host-hotplug.t: Likewise. * scripts/domain/250-pci-host-hotplug.t: Likewise. * scripts/qemu/100-disk-encryption.t: Likewise. * scripts/storage/100-create-vol-dir.t: Likewise. * scripts/storage/200-clone-vol-dir.t: Likewise. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- This probably counts as trivial, but since this is my first libvirt-tck patch, I thought I'd ask first. scripts/domain/050-transient-lifecycle.t | 2 +- scripts/domain/051-transient-autostart.t | 2 +- scripts/domain/060-persistent-lifecycle.t | 2 +- scripts/domain/061-persistent-autostart.t | 2 +- scripts/domain/065-persistent-redefine.t | 2 +- scripts/domain/070-transient-to-persistent.t | 2 +- scripts/domain/080-unique-id-define.t | 2 +- scripts/domain/081-unique-id-create.t | 2 +- scripts/domain/090-invalid-ops-when-inactive.t | 2 +- scripts/domain/100-transient-save-restore.t | 2 +- scripts/domain/101-persistent-save-restore.t | 2 +- scripts/domain/102-broken-save-restore.t | 2 +- scripts/domain/120-disks-stats.t | 2 +- scripts/domain/200-disk-hotplug.t | 2 +- scripts/domain/205-disk-hotplug-ordering.t | 2 +- scripts/domain/210-nic-hotplug.t | 2 +- scripts/domain/215-nic-hotplug-many.t | 2 +- scripts/domain/240-usb-host-hotplug.t | 2 +- scripts/domain/250-pci-host-hotplug.t | 2 +- scripts/qemu/100-disk-encryption.t | 2 +- scripts/storage/100-create-vol-dir.t | 2 +- scripts/storage/200-clone-vol-dir.t | 2 +- 22 files changed, 22 insertions(+), 22 deletions(-) diff --git a/scripts/domain/050-transient-lifecycle.t b/scripts/domain/050-transient-lifecycle.t index 22e5c70..89c9d1a 100644 --- a/scripts/domain/050-transient-lifecycle.t +++ b/scripts/domain/050-transient-lifecycle.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/051-transient-autostart.t b/scripts/domain/051-transient-autostart.t index 9114a28..d43caa1 100644 --- a/scripts/domain/051-transient-autostart.t +++ b/scripts/domain/051-transient-autostart.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/060-persistent-lifecycle.t b/scripts/domain/060-persistent-lifecycle.t index 55bdc6c..ddffa02 100644 --- a/scripts/domain/060-persistent-lifecycle.t +++ b/scripts/domain/060-persistent-lifecycle.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/061-persistent-autostart.t b/scripts/domain/061-persistent-autostart.t index c39ec72..5200454 100644 --- a/scripts/domain/061-persistent-autostart.t +++ b/scripts/domain/061-persistent-autostart.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/065-persistent-redefine.t b/scripts/domain/065-persistent-redefine.t index 712803c..c19b292 100644 --- a/scripts/domain/065-persistent-redefine.t +++ b/scripts/domain/065-persistent-redefine.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/070-transient-to-persistent.t b/scripts/domain/070-transient-to-persistent.t index 346b329..7d85ef6 100644 --- a/scripts/domain/070-transient-to-persistent.t +++ b/scripts/domain/070-transient-to-persistent.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/080-unique-id-define.t b/scripts/domain/080-unique-id-define.t index 066c2e8..ed4a8fc 100644 --- a/scripts/domain/080-unique-id-define.t +++ b/scripts/domain/080-unique-id-define.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/081-unique-id-create.t b/scripts/domain/081-unique-id-create.t index c081674..425116f 100644 --- a/scripts/domain/081-unique-id-create.t +++ b/scripts/domain/081-unique-id-create.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/090-invalid-ops-when-inactive.t b/scripts/domain/090-invalid-ops-when-inactive.t index 28f4936..86f332b 100644 --- a/scripts/domain/090-invalid-ops-when-inactive.t +++ b/scripts/domain/090-invalid-ops-when-inactive.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/100-transient-save-restore.t b/scripts/domain/100-transient-save-restore.t index 314493c..bab42da 100644 --- a/scripts/domain/100-transient-save-restore.t +++ b/scripts/domain/100-transient-save-restore.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/101-persistent-save-restore.t b/scripts/domain/101-persistent-save-restore.t index 251aacd..f1c8d4b 100644 --- a/scripts/domain/101-persistent-save-restore.t +++ b/scripts/domain/101-persistent-save-restore.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/102-broken-save-restore.t b/scripts/domain/102-broken-save-restore.t index 2981d64..b93e274 100644 --- a/scripts/domain/102-broken-save-restore.t +++ b/scripts/domain/102-broken-save-restore.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/120-disks-stats.t b/scripts/domain/120-disks-stats.t index c8b3420..5cbaf8c 100644 --- a/scripts/domain/120-disks-stats.t +++ b/scripts/domain/120-disks-stats.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/200-disk-hotplug.t b/scripts/domain/200-disk-hotplug.t index 1272448..0f10dbf 100644 --- a/scripts/domain/200-disk-hotplug.t +++ b/scripts/domain/200-disk-hotplug.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/205-disk-hotplug-ordering.t b/scripts/domain/205-disk-hotplug-ordering.t index f41d45c..a2e3088 100644 --- a/scripts/domain/205-disk-hotplug-ordering.t +++ b/scripts/domain/205-disk-hotplug-ordering.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/210-nic-hotplug.t b/scripts/domain/210-nic-hotplug.t index 6451fd2..7521978 100644 --- a/scripts/domain/210-nic-hotplug.t +++ b/scripts/domain/210-nic-hotplug.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/215-nic-hotplug-many.t b/scripts/domain/215-nic-hotplug-many.t index 48fdfcf..7465f2c 100644 --- a/scripts/domain/215-nic-hotplug-many.t +++ b/scripts/domain/215-nic-hotplug-many.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/240-usb-host-hotplug.t b/scripts/domain/240-usb-host-hotplug.t index ac71e7b..6e74434 100644 --- a/scripts/domain/240-usb-host-hotplug.t +++ b/scripts/domain/240-usb-host-hotplug.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009-2010 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009-2010 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/domain/250-pci-host-hotplug.t b/scripts/domain/250-pci-host-hotplug.t index 5bb4fd9..a9fe422 100644 --- a/scripts/domain/250-pci-host-hotplug.t +++ b/scripts/domain/250-pci-host-hotplug.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009-2010 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009-2010 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/qemu/100-disk-encryption.t b/scripts/qemu/100-disk-encryption.t index 5964aa5..d594607 100644 --- a/scripts/qemu/100-disk-encryption.t +++ b/scripts/qemu/100-disk-encryption.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/storage/100-create-vol-dir.t b/scripts/storage/100-create-vol-dir.t index 2a09036..3a12596 100644 --- a/scripts/storage/100-create-vol-dir.t +++ b/scripts/storage/100-create-vol-dir.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify diff --git a/scripts/storage/200-clone-vol-dir.t b/scripts/storage/200-clone-vol-dir.t index dbc17c5..3b4d864 100644 --- a/scripts/storage/200-clone-vol-dir.t +++ b/scripts/storage/200-clone-vol-dir.t @@ -1,6 +1,6 @@ # -*- perl -*- # -# Copyright (C) 2009 Red Hat +# Copyright (C) 2009-2010 Red Hat, Inc. # Copyright (C) 2009 Daniel P. Berrange # # This program is free software; You can redistribute it and/or modify -- 1.6.6.1

3 5

[libvirt] [PATCH] nwfiler: fix due to non-symmetric src mac address match in iptables
by Stefan Berger 07 Apr '10

07 Apr '10

The attached patch fixes a problem due to the mac match in iptables only supporting --mac-source and no --mac-destination, thus it not being symmetric. Therefore a rule like this one <rule action='drop' direction='out'> <all match='no' srcmacaddr='$MAC'/> </rule> should only have the MAC match on traffic leaving the VM and not test for the same source MAC address on traffic that the VM receives. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 61 +++++++++++++++++++++++++----- 1 file changed, 51 insertions(+), 10 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -772,11 +772,18 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterHashTablePtr vars, nwItemDescPtr srcMacAddr, - int directionIn ATTRIBUTE_UNUSED) + int directionIn, + bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; + *srcmacskipped = false; if (HAS_ENTRY_ITEM(srcMacAddr)) { + if (directionIn) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr)) @@ -1039,6 +1046,8 @@ _iptablesCreateRuleInstance(int directio virBuffer buf = VIR_BUFFER_INITIALIZER; const char *target; const char *iptables_cmd = (isIPv6) ? IP6TABLES_CMD : IPTABLES_CMD; + unsigned int bufUsed; + bool srcMacSkipped = false; PRINT_IPT_ROOT_CHAIN(chain, chainPrefix, ifname); @@ -1052,10 +1061,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p tcp"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1093,10 +1105,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p udp"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1121,10 +1136,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p udplite"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1144,10 +1162,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p esp"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1167,10 +1188,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p ah"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1190,10 +1214,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p sctp"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1221,10 +1248,13 @@ _iptablesCreateRuleInstance(int directio else virBufferAddLit(&buf, " -p icmpv6"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1272,10 +1302,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p igmp"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1295,10 +1328,13 @@ _iptablesCreateRuleInstance(int directio virBufferAddLit(&buf, " -p all"); + bufUsed = virBufferUse(&buf); + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn)) + directionIn, + &srcMacSkipped)) goto err_exit; if (iptablesHandleIpHdr(&buf, @@ -1313,6 +1349,11 @@ _iptablesCreateRuleInstance(int directio return -1; } + if (srcMacSkipped && bufUsed == virBufferUse(&buf)) { + virBufferFreeAndReset(&buf); + return 0; + } + if (match) virBufferVSprintf(&buf, " %s", match);

2 2

[libvirt] qemu smbios options in domain xml format
by vincent 07 Apr '10

07 Apr '10

Still no support for the smbios arg ? any other way to pass this arg to qemu (and continue to use libvirt)? Vincent On 12/09/2009 10:47 PM, Phillip Balli wrote: Hello, I could not find any explicit mention of support for the -smbios options which are present in qemu 0.10.5+ in the domain xml format or the qemu/kvm hypervisor driver pages. Is there some way to specify commands and options which are not described in the xml config by adjusting something in the way libvirt processes the xml? Or is providing smbios options just not supported currently? No, it's currently not supported. Paolo

1 0

[libvirt] [PATCH] qemu_driver.c: don't close an arbitrary file descriptor
by Jim Meyering 07 Apr '10

07 Apr '10

clang spotted this: An early failure makes us "goto" the cleanup code that tests (and probably closes) the "logfile" fd. >From 49e46a427832681b686b712fbfbc24a312c286c1 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Wed, 7 Apr 2010 09:17:27 +0200 Subject: [PATCH] qemu_driver.c: don't close an arbitrary file descriptor * src/qemu/qemu_driver.c (qemudStartVMDaemon): Initialize "logfile" to ensure that we don't use it uninitialized -- thus closing an arbitrary file descriptor -- in the cleanup block. --- src/qemu/qemu_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index ce43fd3..60fa95a 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -3159,7 +3159,7 @@ static int qemudStartVMDaemon(virConnectPtr conn, int pos = -1; char ebuf[1024]; char *pidfile = NULL; - int logfile; + int logfile = -1; qemuDomainObjPrivatePtr priv = vm->privateData; struct qemudHookData hookData; -- 1.7.0.4.552.gc303

2 1

[libvirt] [Fwd: Re: virsh dump blocking problem]
by Gui Jianfeng 07 Apr '10

07 Apr '10

Hi all, I think this is the right place to post the problem here. :) So I forward this mail. =========== On Tue, 06 Apr 2010 09:35:09 +0800 Gui Jianfeng <guijianfeng(a)cn.fujitsu.com> wrote: > Hi all, > > I'm not sure whether it's appropriate to post the problem here. > I played with "virsh" under Fedora 12, and started a KVM fedora12 guest > by "virsh start" command. The fedora12 guest is successfully started. > Than I run the following command to dump the guest core: > #virsh dump 1 mycoredump (domain id is 1) > > This command seemed blocking and not return. According to he strace > output, virsh dump seems that it's blocking at poll() call. I think > the following should be the call trace of virsh. > > cmdDump() > -> virDomainCoreDump() > -> remoteDomainCoreDump() > -> call() > -> remoteIO() > -> remoteIOEventLoop() > -> poll(fds, ARRAY_CARDINALITY(fds), -1) > > > Any one encounters this problem also, any thoughts? > I met and it seems qemu-kvm continues to counting the number of dirty pages and does no answer to libvirt. Guest never work and I have to kill it. I met this with 2.6.32+ qemu-0.12.3+ libvirt 0.7.7.1. When I updated the host kernel to 2.6.33, qemu-kvm never work. So, I moved back to fedora12's latest qemu-kvm. Now, 2.6.34-rc3+ qemu-0.11.0-13.fc12.x86_64 + libvirt 0.7.7.1 # virsh dump xxxx xxxx hangs. In most case, I see following 2 back trace.(with gdb) (gdb) bt #0 ram_save_remaining () at /usr/src/debug/qemu-kvm-0.11.0/vl.c:3104 #1 ram_bytes_remaining () at /usr/src/debug/qemu-kvm-0.11.0/vl.c:3112 #2 0x00000000004ab2cf in do_info_migrate (mon=0x16b7970) at migration.c:150 #3 0x0000000000414b1a in monitor_handle_command (mon=<value optimized out>, cmdline=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/monitor.c:2870 #4 0x0000000000414c6a in monitor_command_cb (mon=0x16b7970, cmdline=<value optimized out>, opaque=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/monitor.c:3160 #5 0x000000000048b71b in readline_handle_byte (rs=0x208d6a0, ch=<value optimized out>) at readline.c:369 #6 0x0000000000414cdc in monitor_read (opaque=<value optimized out>, buf=0x7fff1b1104b0 "info migrate\r", size=13) at /usr/src/debug/qemu-kvm-0.11.0/monitor.c:3146 #7 0x00000000004b2a53 in tcp_chr_read (opaque=0x1614c30) at qemu-char.c:2006 #8 0x000000000040a6c7 in main_loop_wait (timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:4188 #9 0x000000000040eed5 in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:4414 #10 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:6263 (gdb) bt #0 0x0000003c2680e0bd in write () at ../sysdeps/unix/syscall-template.S:82 #1 0x00000000004b304a in unix_write (fd=11, buf=<value optimized out>, len1=40) at qemu-char.c:512 #2 send_all (fd=11, buf=<value optimized out>, len1=40) at qemu-char.c:528 #3 0x0000000000411201 in monitor_flush (mon=0x16b7970) at /usr/src/debug/qemu-kvm-0.11.0/monitor.c:131 #4 0x0000000000414cdc in monitor_read (opaque=<value optimized out>, buf=0x7fff1b1104b0 "info migrate\r", size=13) at /usr/src/debug/qemu-kvm-0.11.0/monitor.c:3146 #5 0x00000000004b2a53 in tcp_chr_read (opaque=0x1614c30) at qemu-char.c:2006 #6 0x000000000040a6c7 in main_loop_wait (timeout=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:4188 #7 0x000000000040eed5 in main_loop (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:4414 #8 main (argc=<value optimized out>, argv=<value optimized out>, envp=<value optimized out>) at /usr/src/debug/qemu-kvm-0.11.0/vl.c:6263 And see no dump progress. I'm sorry if this is not a hang but just verrrrry slow. I don't see any progress at lease for 15 minutes and qemu-kvm continues to use 75% of cpus. I'm not sure why "dump" command trigger migration code... How long it takes to do "virsh dump xxx xxxx", an idle VM with 2G memory ? I'm sorry if I ask wrong mailing list. Thanks, -Kame

1 0

[libvirt] Linux-vServer Support in libvirt
by Walter Stanish 07 Apr '10

07 Apr '10

Hi libvir-list (cc: vserver list), I am another Linux-vServer user who would like to see support in libvirt. >From a very brief look back through the archives it appears that there may have been some architectural concerns re: libvirt's assumptions about what kind of network stack a virtualisation platform provides, in that Linux-vServer doesn't use a traditional approach to networking and thus may break previously valid assumptions. I found 2007 posts and a post last year (2009). Would it be possible for someone with a good overall understanding of previous integration attempts and the results thereof to summarise what issues were encountered and how difficult it would be to overcome these, so that users can understand what's going on. Thanks! - Walter

3 2

[libvirt] Release schedule ... 0.8.0 coming
by Daniel Veillard 07 Apr '10

07 Apr '10

Okay, since the snapshot API is in I suggest to start the freeze toward the 0.8.0 release. There is still 3 things I think we should look at and allow: 1/ the very large cleanup patch set from Matthias, as this should not break anything (isn't it :-) 2/ the nwfilter IP detection code, it still need a review, I didn't do it, libpcap intimidates me a bit, but I think I can be convinced. 3/ an ESX snapshot support if Matthias (or someone else !) manage to write one in the next days 2/ and 3/ sound fairly contained and about a new functionalitry in this release so the risk of breaking an existing feature is very limited. So hopefully we can ship 0.8.0 by the end of the week-end, now we need testing testing testing :-) Thanks ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

3 3

[libvirt] [PATCH] nwfilter: Add filter schema for nwfilter XML, extend domain XML schema
by Stefan Berger 06 Apr '10

06 Apr '10

This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Signed-off-by: Gerhard Stenzel <gerhard.stenzel(a)de.ibm.com> --- docs/schemas/Makefile.am | 3 docs/schemas/domain.rng | 31 + docs/schemas/nwfilter.rng | 783 ++++++++++++++++++++++++++++++++++++++++++++++ libvirt.spec.in | 1 tests/Makefile.am | 4 tests/nwfilterschematest | 11 6 files changed, 831 insertions(+), 2 deletions(-) Index: libvirt-acl/docs/schemas/Makefile.am =================================================================== --- libvirt-acl.orig/docs/schemas/Makefile.am +++ libvirt-acl/docs/schemas/Makefile.am @@ -10,6 +10,7 @@ schema_DATA = \ storagepool.rng \ storagevol.rng \ nodedev.rng \ - capability.rng + capability.rng \ + nwfilter.rng EXTRA_DIST = $(schema_DATA) Index: libvirt-acl/libvirt.spec.in =================================================================== --- libvirt-acl.orig/libvirt.spec.in +++ libvirt-acl/libvirt.spec.in @@ -785,6 +785,7 @@ fi %{_datadir}/libvirt/schemas/interface.rng %{_datadir}/libvirt/schemas/secret.rng %{_datadir}/libvirt/schemas/storageencryption.rng +%{_datadir}/libvirt/schemas/filter.rng %{_datadir}/libvirt/cpu_map.xml Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- /dev/null +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -0,0 +1,783 @@ +<?xml version="1.0" encoding="UTF-8"?> +<grammar ns="" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes"> + <start> + <ref name="filter"/> + </start> + <define name="filter"> + <element name="filter"> + <ref name="filter-node-attributes"/> + <zeroOrMore> + <choice> + <element name="filterref"> + <ref name="filterref-node-attributes"/> + </element> + <element name="uuid"> + <ref name="UUID"/> + </element> + </choice> + </zeroOrMore> + <zeroOrMore> + <element name="rule"> + <ref name="rule-node-attributes"/> + <optional> + <zeroOrMore> + <element name="mac"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="mac-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="arp"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="arp-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ip"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-port-attributes"/> + <ref name="ip-attributes"/> + <ref name="dscp-attribute"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ipv6"> + <ref name="match-attribute"/> + <ref name="common-l2-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-port-attributes"/> + <ref name="ip-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="tcp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="sctp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="icmp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + <ref name="icmp-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="igmp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="all"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="esp"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ah"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udplite"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ip-attributes-p1"/> + <ref name="common-ip-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="tcp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="sctp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-port-attributes"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="icmpv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + <ref name="icmp-attributes"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="all-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="esp-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="ah-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + <optional> + <zeroOrMore> + <element name="udplite-ipv6"> + <ref name="match-attribute"/> + <ref name="srcmac-attribute"/> + <ref name="common-ipv6-attributes-p1"/> + <ref name="common-ipv6-attributes-p2"/> + </element> + </zeroOrMore> + </optional> + </element> + </zeroOrMore> + </element> + </define> + +  + + <define name="filter-node-attributes"> + <attribute name="name"> + <data type="NCName"/> + </attribute> + <optional> + <attribute name="chain"> + <choice> + <value>root</value> + <value>arp</value> + <value>ipv4</value> + <value>ipv6</value> + </choice> + </attribute> + </optional> + </define> + + <define name="filterref-node-attributes"> + <attribute name="filter"> + <data type="NCName"/> + </attribute> + <optional> + <element name="parameter"> + <attribute name="name"> + <ref name="parameter-name"/> + </attribute> + <attribute name="value"> + <ref name="parameter-value"/> + </attribute> + </element> + </optional> + </define> + + <define name="rule-node-attributes"> + <attribute name="action"> + <ref name='action-type'/> + </attribute> + <attribute name="direction"> + <ref name='direction-type'/> + </attribute> + <optional> + <attribute name="priority"> + <ref name='priority-type'/> + </attribute> + </optional> + </define> + + <define name="match-attribute"> + <interleave> + <optional> + <attribute name="match"> + <choice> + <value>yes</value> + <value>no</value> + </choice> + </attribute> + </optional> + </interleave> + </define> + + <define name="srcmac-attribute"> + <interleave> + <optional> + <attribute name="srcmacaddr"> + <ref name="addrMAC"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-l2-attributes"> + <interleave> + <ref name="srcmac-attribute"/> + <optional> + <attribute name="srcmacmask"> + <ref name="addrMAC"/> + </attribute> + </optional> + <optional> + <attribute name="dstmacaddr"> + <ref name="addrMAC"/> + </attribute> + </optional> + <optional> + <attribute name="dstmacmask"> + <ref name="addrMAC"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-ip-attributes-p1"> + <interleave> + <optional> + <attribute name="srcipaddr"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="srcipmask"> + <ref name="addrMask"/> + </attribute> + </optional> + <optional> + <attribute name="dstipaddr"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="dstipmask"> + <ref name="addrMask"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-ip-attributes-p2"> + <interleave> + <optional> + <attribute name="srcipfrom"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="srcipto"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="dstipfrom"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="dstipto"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="dscp"> + <ref name="sixbitrange"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-ipv6-attributes-p1"> + <interleave> + <optional> + <attribute name="srcipaddr"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="srcipmask"> + <ref name="addrMaskv6"/> + </attribute> + </optional> + <optional> + <attribute name="dstipaddr"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="dstipmask"> + <ref name="addrMaskv6"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-ipv6-attributes-p2"> + <interleave> + <optional> + <attribute name="srcipfrom"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="srcipto"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="dstipfrom"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="dstipto"> + <ref name="addrIPv6"/> + </attribute> + </optional> + <optional> + <attribute name="dscp"> + <ref name="sixbitrange"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="common-port-attributes"> + <interleave> + <optional> + <attribute name="srcportstart"> + <ref name="uint16range"/> + </attribute> + </optional> + <optional> + <attribute name="srcportend"> + <ref name="uint16range"/> + </attribute> + </optional> + <optional> + <attribute name="dstportstart"> + <ref name="uint16range"/> + </attribute> + </optional> + <optional> + <attribute name="dstportend"> + <ref name="uint16range"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="icmp-attributes"> + <interleave> + <optional> + <attribute name="type"> + <ref name="uint8range"/> + </attribute> + </optional> + <optional> + <attribute name="code"> + <ref name="uint8range"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="mac-attributes"> + <interleave> + <optional> + <attribute name="protocolid"> + <ref name="mac-protocolid"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="arp-attributes"> + <interleave> + <optional> + <attribute name="arpsrcmacaddr"> + <ref name="addrMAC"/> + </attribute> + </optional> + <optional> + <attribute name="arpsrcipaddr"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="arpdstmacaddr"> + <ref name="addrMAC"/> + </attribute> + </optional> + <optional> + <attribute name="arpdstipaddr"> + <ref name="addrIP"/> + </attribute> + </optional> + <optional> + <attribute name="hwtype"> + <ref name="uint16range"/> + </attribute> + </optional> + <optional> + <attribute name="opcode"> + <ref name="arpOpcodeType"/> + </attribute> + </optional> + <optional> + <attribute name="protocoltype"> + <ref name="uint16range"/> + </attribute> + </optional> + </interleave> + </define> + + <define name="ip-attributes"> + <optional> + <attribute name="protocol"> + <ref name="ipProtocolType"/> + </attribute> + </optional> + </define> + + <define name="dscp-attribute"> + <optional> + <attribute name="dscp"> + <ref name="sixbitrange"/> + </attribute> + </optional> + </define> + +  + + <define name="UUID"> + <choice> + <data type="string"> + <param name="pattern">[a-fA-F0-9]{32}</param> + </data> + + <data type="string"> + <param name="pattern">[a-fA-F0-9]{8}\-([a-fA-F0-9]{4}\-){3}[a-fA-F0-9]{12}</param> + </data> + </choice> + </define> + + <define name="addrMAC"> + <choice> +  + <data type="string"> + <param name="pattern">[\\$]{1}[a-zA-Z0-9_]+</param> + </data> + + <data type="string"> + <param name="pattern">([a-fA-F0-9]{1,2}:){5}[a-fA-F0-9]{1,2}</param> + </data> + </choice> + </define> + + <define name="addrIP"> + <choice> +  + <data type="string"> + <param name="pattern">[\\$]{1}[a-zA-Z0-9_]+</param> + </data> + + <data type="string"> + <param name="pattern">([0-2]?[0-9]?[0-9]\.){3}[0-2]?[0-9]?[0-9]</param> + </data> + </choice> + </define> + + <define name="addrIPv6"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="string"> + <param name="pattern">([a-fA-F0-9]{0,4}:){2,7}([a-fA-F0-9]*)(([0-2]?[0-9]?[0-9]\.){3}[0-2]?[0-9]?[0-9])?</param> + </data> + </choice> + </define> + + <define name="addrMask"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">32</param> + </data> + + <data type="string"> + <param name="pattern">([0-2]?[0-9]?[0-9]\.){3}[0-2]?[0-9]?[0-9]</param> + </data> + </choice> + </define> + + <define name="addrMaskv6"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">128</param> + </data> + + <data type="string"> + <param name="pattern">([a-fA-F0-9]{0,4}:){2,7}([a-fA-F0-9]*)</param> + </data> + </choice> + </define> + + <define name="sixbitrange"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">63</param> + </data> + </choice> + </define> + + <define name="mac-protocolid"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">1536</param> + <param name="maxInclusive">65535</param> + </data> + + <choice> + <value>arp</value> + <value>ipv4</value> + <value>ipv6</value> + </choice> + </choice> + </define> + + <define name="uint8range"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">255</param> + </data> + </choice> + </define> + + <define name="uint16range"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">65535</param> + </data> + </choice> + </define> + + <define name="arpOpcodeType"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">65535</param> + </data> + + <data type="string"> + <param name="pattern">([Rr]eply|[Rr]equest|[Rr]equest_[Rr]everse|[Rr]eply_[Rr]everse|DRARP_[Rr]equest|DRARP_[Rr]eply|DRARP_[Ee]rror|InARP_[Rr]equest|ARP_NAK)</param> + </data> + + </choice> + </define> + + <define name="ipProtocolType"> + <choice> +  + <data type="string"> + <param name="pattern">^[\\$]{1}[a-zA-Z0-9_]+$</param> + </data> + + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">255</param> + </data> + + <choice> + <value>tcp</value> + <value>udp</value> + <value>udplite</value> + <value>esp</value> + <value>ah</value> + <value>icmp</value> + <value>igmp</value> + <value>sctp</value> + <value>icmpv6</value> + </choice> + </choice> + </define> + + <define name="parameter-name"> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_]+</param> + </data> + </define> + + <define name="parameter-value"> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_\.:]+</param> + </data> + </define> + + <define name='action-type'> + <choice> + <value>drop</value> + <value>accept</value> + </choice> + </define> + + <define name='direction-type'> + <choice> + <value>in</value> + <value>out</value> + <value>inout</value> + </choice> + </define> + + <define name='priority-type'> + <data type="int"> + <param name="minInclusive">0</param> + <param name="maxInclusive">1000</param> + </data> + </define> +</grammar> Index: libvirt-acl/tests/Makefile.am =================================================================== --- libvirt-acl.orig/tests/Makefile.am +++ libvirt-acl/tests/Makefile.am @@ -74,6 +74,7 @@ EXTRA_DIST = \ xml2vmxdata \ nwfilterxml2xmlout \ nwfilterxml2xmlin \ + nwfilterschematest \ $(patsubst %,qemuhelpdata/%,$(qemuhelpdata)) noinst_PROGRAMS = virshtest conftest \ @@ -120,7 +121,8 @@ test_scripts = \ storagepoolschematest \ storagevolschematest \ domainschematest \ - nodedevschematest + nodedevschematest \ + nwfilterschematest if WITH_LIBVIRTD test_scripts += \ Index: libvirt-acl/tests/nwfilterschematest =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterschematest @@ -0,0 +1,11 @@ +#!/bin/sh + +: ${srcdir=.} +. $srcdir/test-lib.sh +. $abs_srcdir/schematestutils.sh + +DIRS="nwfilterxml2xmlout" +SCHEMA="nwfilter.rng" + +check_schema "$DIRS" "$SCHEMA" + Index: libvirt-acl/docs/schemas/domain.rng =================================================================== --- libvirt-acl.orig/docs/schemas/domain.rng +++ libvirt-acl/docs/schemas/domain.rng @@ -894,6 +894,11 @@ <optional> <ref name="address"/> </optional> + <optional> + <element name="filterref"> + <ref name="filterref-node-attributes"/> + </element> + </optional> </interleave> </define> <!-- @@ -1577,6 +1582,22 @@ </element> </define> + <define name="filterref-node-attributes"> + <attribute name="filter"> + <data type="NCName"/> + </attribute> + <optional> + <element name="parameter"> + <attribute name="name"> + <ref name="parameter-name"/> + </attribute> + <attribute name="value"> + <ref name="parameter-value"/> + </attribute> + </element> + </optional> + </define> + <!-- Type library @@ -1737,4 +1758,14 @@ <param name="pattern">[a-zA-Z0-9_\.\+\-/]+</param> </data> </define> + <define name="parameter-name"> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_]+</param> + </data> + </define> + <define name="parameter-value"> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_\.:]+</param> + </data> + </define> </grammar>

2 7

[libvirt] [PATCH] Fix 'avialable' typo
by Matthias Bolte 06 Apr '10

06 Apr '10

Reported by Paul Jenner --- I just pushed this patch. src/util/util.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/util/util.c b/src/util/util.c index 28a3c7e..405c5f3 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -2682,7 +2682,7 @@ char * virGetUserDirectory(uid_t uid ATTRIBUTE_UNUSED) { virUtilError(VIR_ERR_INTERNAL_ERROR, - "%s", _("virGetUserDirectory is not avialable")); + "%s", _("virGetUserDirectory is not available")); return NULL; } @@ -2691,7 +2691,7 @@ char * virGetUserName(uid_t uid ATTRIBUTE_UNUSED) { virUtilError(VIR_ERR_INTERNAL_ERROR, - "%s", _("virGetUserName is not avialable")); + "%s", _("virGetUserName is not available")); return NULL; } @@ -2700,7 +2700,7 @@ int virGetUserID(const char *name ATTRIBUTE_UNUSED, uid_t *uid ATTRIBUTE_UNUSED) { virUtilError(VIR_ERR_INTERNAL_ERROR, - "%s", _("virGetUserID is not avialable")); + "%s", _("virGetUserID is not available")); return 0; } @@ -2710,7 +2710,7 @@ int virGetGroupID(const char *name ATTRIBUTE_UNUSED, gid_t *gid ATTRIBUTE_UNUSED) { virUtilError(VIR_ERR_INTERNAL_ERROR, - "%s", _("virGetGroupID is not avialable")); + "%s", _("virGetGroupID is not available")); return 0; } -- 1.6.3.3

1 0

[libvirt] [PATCH] build: avoid autogen on 'make clean'
by Eric Blake 06 Apr '10

06 Apr '10

Tested by running 'git submodule foreach git pull origin master', then seeing that 'make clean' skips autogen although 'make' properly runs it. * cfg.mk (_clean_requested): New check, to speed up 'make clean' even if gnulib submodule is outdated. Suggested by Daniel P. Berrange. --- cfg.mk | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/cfg.mk b/cfg.mk index 70465c3..f422a53 100644 --- a/cfg.mk +++ b/cfg.mk @@ -301,7 +301,8 @@ ifeq (0,$(MAKELEVEL)) git diff .gnulib); \ stamp="$$($(_submodule_hash) $(_curr_status) 2>/dev/null)"; \ test "$$stamp" = "$$actual"; echo $$?) - ifeq (1,$(_update_required)) + _clean_requested = $(filter %clean,$(MAKECMDGOALS)) + ifeq (1,$(_update_required)$(_clean_requested)) $(info INFO: gnulib update required; running ./autogen.sh first) Makefile: _autogen endif -- 1.6.6.1

2 2

[libvirt] [PATCH] virterror.c: avoid erroneous case "fall-through"
by Jim Meyering 06 Apr '10

06 Apr '10

IMHO, this qualifies as an "obvious" fix, but I'll wait for an ACK. >From 0c9eb193ccb0ad507c7dd6dbfe944bb9a0c8ff93 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Tue, 6 Apr 2010 19:07:14 +0200 Subject: [PATCH] virterror.c: avoid erroneous case "fall-through" * src/util/virterror.c (virErrorMsg): Insert missing "break;" --- src/util/virterror.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/util/virterror.c b/src/util/virterror.c index d29f95b..96dd1e7 100644 --- a/src/util/virterror.c +++ b/src/util/virterror.c @@ -1,10 +1,10 @@ /* * virterror.c: implements error handling and reporting code for libvirt * - * Copy: Copyright (C) 2006, 2008, 2009 Red Hat, Inc. + * Copy: Copyright (C) 2006, 2008-2010 Red Hat, Inc. * * See COPYING.LIB for the License of this software * * Author: Daniel Veillard <veillard(a)redhat.com> */ @@ -1147,12 +1147,13 @@ virErrorMsg(virErrorNumber error, const char *info) break; case VIR_ERR_MIGRATE_PERSIST_FAILED: if (info == NULL) errmsg = _("Failed to make domain persistent after migration"); else errmsg = _("Failed to make domain persistent after migration: %s"); + break; case VIR_ERR_HOOK_SCRIPT_FAILED: if (info == NULL) errmsg = _("Hook script execution failed"); else errmsg = _("Hook script execution failed: %s"); break; -- 1.7.0.4.552.gc303

3 3

[libvirt] [PATCH] nwfilter: Fix instantiated layer 2 rules for 'inout' direction
by Stefan Berger 06 Apr '10

06 Apr '10

The following rule for direction 'in' <rule direction='in' action='drop'> <mac srcmacaddr='1:2:3:4:5:6'/> </rule> drops all traffic from the given mac address. The following rule for direction 'out' <rule direction='out' action='drop'> <mac dstmacaddr='1:2:3:4:5:6'/> </rule> drops all traffic to the given mac address. The following rule in direction 'inout' <rule direction='inout' action='drop'> <mac srcmacaddr='1:2:3:4:5:6'/> </rule> now drops all traffic from and to the given MAC address. So far it would have dropped traffic from the given MAC address and outgoing traffic with the given MAC address, which is not useful since the packets will always have the VM's MAC address as source MAC address. The attached patch fixes this. This is the last bug I currently know of and want to fix. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 67 ++++++++++++++++++++---------- 1 file changed, 45 insertions(+), 22 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -294,7 +294,8 @@ ebiptablesAddRuleInst(virNWFilterRuleIns static int ebtablesHandleEthHdr(virBufferPtr buf, virNWFilterHashTablePtr vars, - ethHdrDataDefPtr ethHdr) + ethHdrDataDefPtr ethHdr, + bool reverse) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -305,7 +306,8 @@ ebtablesHandleEthHdr(virBufferPtr buf, goto err_exit; virBufferVSprintf(buf, - " -s %s %s", + " %s %s %s", + reverse ? "-d" : "-s", ENTRY_GET_NEG_SIGN(&ethHdr->dataSrcMACAddr), macaddr); @@ -328,7 +330,8 @@ ebtablesHandleEthHdr(virBufferPtr buf, goto err_exit; virBufferVSprintf(buf, - " -d %s %s", + " %s %s %s", + reverse ? "-s" : "-d", ENTRY_GET_NEG_SIGN(&ethHdr->dataDstMACAddr), macaddr); @@ -1425,6 +1428,7 @@ iptablesCreateRuleInstance(virNWFilterDe * @ifname : The name of the interface to apply the rule to * @vars : A map containing the variables to resolve * @res : The data structure to store the result(s) into + * @reverse : Whether to reverse src and dst attributes * * Convert a single rule into its representation for later instantiation * @@ -1438,7 +1442,8 @@ ebtablesCreateRuleInstance(char chainPre virNWFilterRuleDefPtr rule, const char *ifname, virNWFilterHashTablePtr vars, - virNWFilterRuleInstPtr res) + virNWFilterRuleInstPtr res, + bool reverse) { char macaddr[VIR_MAC_STRING_BUFLEN], ipaddr[INET_ADDRSTRLEN], @@ -1464,7 +1469,8 @@ ebtablesCreateRuleInstance(char chainPre if (ebtablesHandleEthHdr(&buf, vars, - &rule->p.ethHdrFilter.ethHdr)) + &rule->p.ethHdrFilter.ethHdr, + reverse)) goto err_exit; if (HAS_ENTRY_ITEM(&rule->p.ethHdrFilter.dataProtocolID)) { @@ -1487,7 +1493,8 @@ ebtablesCreateRuleInstance(char chainPre if (ebtablesHandleEthHdr(&buf, vars, - &rule->p.arpHdrFilter.ethHdr)) + &rule->p.arpHdrFilter.ethHdr, + reverse)) goto err_exit; virBufferAddLit(&buf, " -p arp"); @@ -1532,7 +1539,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --arp-ip-src %s %s", + " %s %s %s", + reverse ? "--arp-ip-dst" : "--arp-ip-src", ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPSrcIPAddr), ipaddr); } @@ -1544,7 +1552,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --arp-ip-dst %s %s", + " %s %s %s", + reverse ? "--arp-ip-src" : "--arp-ip-dst", ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPDstIPAddr), ipaddr); } @@ -1556,7 +1565,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --arp-mac-src %s %s", + " %s %s %s", + reverse ? "--arp-mac-dst" : "--arp-mac-src", ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPSrcMACAddr), macaddr); } @@ -1568,7 +1578,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --arp-mac-dst %s %s", + " %s %s %s", + reverse ? "--arp-mac-src" : "--arp-mac-dst", ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPDstMACAddr), macaddr); } @@ -1581,7 +1592,8 @@ ebtablesCreateRuleInstance(char chainPre if (ebtablesHandleEthHdr(&buf, vars, - &rule->p.ipHdrFilter.ethHdr)) + &rule->p.ipHdrFilter.ethHdr, + reverse)) goto err_exit; virBufferAddLit(&buf, @@ -1594,7 +1606,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip-source %s %s", + " %s %s %s", + reverse ? "--ip-destination" : "--ip-source", ENTRY_GET_NEG_SIGN(&rule->p.ipHdrFilter.ipHdr.dataSrcIPAddr), ipaddr); @@ -1617,7 +1630,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip-destination %s %s", + " %s %s %s", + reverse ? "--ip-source" : "--ip-destination", ENTRY_GET_NEG_SIGN(&rule->p.ipHdrFilter.ipHdr.dataDstIPAddr), ipaddr); @@ -1652,7 +1666,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip-source-port %s %s", + " %s %s %s", + reverse ? "--ip-destination-port" : "--ip-source-port", ENTRY_GET_NEG_SIGN(&rule->p.ipHdrFilter.portData.dataSrcPortStart), number); @@ -1676,7 +1691,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip-destination-port %s %s", + " %s %s %s", + reverse ? "--ip-source-port" : "--ip-destination-port", ENTRY_GET_NEG_SIGN(&rule->p.ipHdrFilter.portData.dataDstPortStart), number); @@ -1712,7 +1728,8 @@ ebtablesCreateRuleInstance(char chainPre if (ebtablesHandleEthHdr(&buf, vars, - &rule->p.ipv6HdrFilter.ethHdr)) + &rule->p.ipv6HdrFilter.ethHdr, + reverse)) goto err_exit; virBufferAddLit(&buf, @@ -1725,7 +1742,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip6-source %s %s", + " %s %s %s", + reverse ? "--ip6-destination" : "--ip6-source", ENTRY_GET_NEG_SIGN(&rule->p.ipv6HdrFilter.ipHdr.dataSrcIPAddr), ipv6addr); @@ -1748,7 +1766,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip6-destination %s %s", + " %s %s %s", + reverse ? "--ip6-source" : "--ip6-destination", ENTRY_GET_NEG_SIGN(&rule->p.ipv6HdrFilter.ipHdr.dataDstIPAddr), ipv6addr); @@ -1783,7 +1802,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip6-source-port %s %s", + " %s %s %s", + (!reverse) ? "--ip6-source-port" : "--ip6-destination-port", ENTRY_GET_NEG_SIGN(&rule->p.ipv6HdrFilter.portData.dataSrcPortStart), number); @@ -1807,7 +1827,8 @@ ebtablesCreateRuleInstance(char chainPre goto err_exit; virBufferVSprintf(&buf, - " --ip6-destination-port %s %s", + " %s %s %s", + reverse ? "--ip6-source-port" : "--ip6-destination-port", ENTRY_GET_NEG_SIGN(&rule->p.ipv6HdrFilter.portData.dataDstPortStart), number); @@ -1900,7 +1921,8 @@ ebiptablesCreateRuleInstance(virConnectP rule, ifname, vars, - res); + res, + rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT); if (rc) return rc; } @@ -1912,7 +1934,8 @@ ebiptablesCreateRuleInstance(virConnectP rule, ifname, vars, - res); + res, + 0); } break;

2 2

[libvirt] [PATCH] virsh: improve documentation
by Eric Blake 06 Apr '10

06 Apr '10

Document several missing commands. There's more work that could be done, but incremental improvements is better than no patch at all. * tools/virsh.pod (autostart, connect): Improve grammar. (create): Improve example. (domjobabort, domjobinfo, domxml-from-native, domxml-to-native): Document. (storage pool commands): New section. --- tools/virsh.pod | 167 ++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 files changed, 154 insertions(+), 13 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 62395d7..fdf687f 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -103,10 +103,12 @@ Will print the current directory. =item B<connect> I<URI> optional I<--readonly> -(Re)-Connect to the hypervisor. This is a build-in command after shell -start up, and usually get an I<URI> parameter specifying how to connect -to the hypervisor. The documentation page at L<http://libvirt.org/uri.html> -list the values supported but the most common are: +(Re)-Connect to the hypervisor. When the shell is first started, this +is automatically run with the I<URI> parameter requested by the C<-c> +option on the command line. The I<URI> parameter specifies how to +connect to the hypervisor. The documentation page at +L<http://libvirt.org/uri.html> list the values supported, but the most +common are: =over 4 @@ -116,11 +118,11 @@ this is used to connect to the local Xen hypervisor, this is the default =item qemu:///system -allow to connect locally as root to the daemon supervising QEmu and KVM domains +connect locally as root to the daemon supervising QEmu and KVM domains =item qemu:///session -allow to connect locally as a normal user to his own set of QEmu and KVM domains +connect locally as a normal user to his own set of QEmu and KVM domains =item lxc:/// @@ -252,7 +254,7 @@ I<domain-id> can be specified as an short integer, a name or a full UUID. Configure a domain to be automatically started at boot. -The option I<--disable> disable autostarting. +The option I<--disable> disables autostarting. =item B<console> I<domain-id> @@ -260,11 +262,15 @@ Connect the virtual serial console for the guest. =item B<create> I<FILE> -Create a domain from an XML <file>. An easy way to create the XML <file> is to use the B<dumpxml> command to obtain the definition of a pre-existing guest. +Create a domain from an XML <file>. An easy way to create the XML +<file> is to use the B<dumpxml> command to obtain the definition of a +pre-existing guest. B<Example> -virsh dumpxml <domain-id> > file. +virsh dumpxml <domain-id> > +edit file +virsh create < file =item B<define> I<FILE> @@ -306,6 +312,14 @@ Convert a domain name (or UUID) to a domain id Returns basic information about the domain. +=item B<domjobabort I<domain-id-or-uuid> + +Abort the currently running domain job. + +=item B<domjobinfo> I<domain-id-or-uuid> + +Returns information about jobs running on a domain. + =item B<domname> I<domain-id-or-uuid> Convert a domain Id (or UUID) to domain name @@ -314,13 +328,24 @@ Convert a domain Id (or UUID) to domain name Returns state about a running domain. +=item B<domxml-from-native> I<format> I<config> + +Convert the file I<config> in the native guest configuration format +named by I<format> to a domain XML format. + +=item B<domxml-to-native> I<format> I<xml> + +Convert the file I<xml> in domain XML format to the native guest +configuration format named by I<format>. + =item B<dump> I<domain-id> I<corefilepath> Dumps the core of a domain to a file for analysis. =item B<dumpxml> I<domain-id> -Output the domain information as an XML dump to stdout, this format can be used by the B<create> command. +Output the domain information as an XML dump to stdout, this format +can be used by the B<create> command. =item B<edit> I<domain-id> @@ -566,7 +591,7 @@ Edit the XML configuration file for a network. This is equivalent to: virsh net-dumpxml network > network.xml edit network.xml - virsh define network.xml + virsh net-define network.xml except that it does some error checking. The editor used can be supplied by the C<$VISUAL> or C<$EDITOR> environment @@ -596,6 +621,122 @@ Convert a network name to network UUID. =back +=head1 STORAGE POOL COMMANDS + +The following commands manipulate storage pools. Libvirt has the +capability to manage various storage solutions, including files, raw +partitions, and domain-specific formats, used to provide the storage +volumes visible as devices within virtual machines. For more detailed +information about this feature, see the documentation at +L<http://libvirt.org/formatstorage.html> . A lot of the commands for +pools are similar to the ones used for domains. + +=over 4 + +=item B<find-storage-pool-sources> I<type> optional I<srcSpec> + +Returns XML describing all storage pools of a given I<type> that could +be found. If I<srcSpec> is provided, it is a file that contains XML +to further restrict the query for pools. + +=item B<find-storage-pool-sources> I<type> optional I<host> I<port> + +Returns XML describing all storage pools of a given I<type> that could +be found. If I<host> and I<port> are provided, they control where the +query is performed. + +=item B<pool-autostart> I<pool-or-uuid> optional I<--disable> + +Configure whether I<pool> should automatically start at boot. + +=item B<pool-build> I<pool-or-uuid> + +Build a given pool. + +=item B<pool-create> I<file> + +Create and start a pool object from the XML I<file>. + +=item B<pool-create-as> I<name> I<--print-xml> I<type> optional I<source-host> +I<source-path> I<source-dev> I<source-name> <target> + +Create and start a pool object I<name> from the raw parameters. If +I<--print-xml> is specified, then print the XML of the pool object +without creating the pool. Otherwise, the pool has the specified +I<type>. + +=item B<pool-define> I<file> + +Create, but do not start, a pool object from the XML I<file>. + +=item B<pool-define-as> I<name> I<--print-xml> I<type> optional I<source-host> +I<source-path> I<source-dev> I<source-name> <target> + +Create, but do not start, a pool object I<name> from the raw parameters. If +I<--print-xml> is specified, then print the XML of the pool object +without defining the pool. Otherwise, the pool has the specified +I<type>. + +=item B<pool-destroy> I<pool-or-uuid> + +Destroy a given I<pool> object. Libvirt will no longer manage the +storage described by the pool object, but the raw data contained in +the pool is not changed, and can be later recovered with +B<pool-create>. + +=item B<pool-delete> I<pool-or-uuid> + +Destroy the resources used by a given I<pool> object. This operation +is non-recoverable. The I<pool> object will still exist after this +command. + +=item B<pool-dumpxml> I<pool-or-uuid> + +Returns the XML information about the I<pool> object. + +=item B<pool-edit> I<pool-or-uuid> + +Edit the XML configuration file for a storage pool. + +This is equivalent to: + virsh pool-dumpxml pool > pool.xml + edit pool.xml + virsh pool-define pool.xml +except that it does some error checking. + +The editor used can be supplied by the C<$VISUAL> or C<$EDITOR> environment +variables, and defaults to C<vi>. + +=item B<pool-info> I<pool-or-uuid> + +Returns basic information about the I<pool> object. + +=item B<pool-list> optional I<--inactive> I<--all> + +List pool objects known to libvirt. By default, only pools in use by +active domains are listed; I<--inactive> lists just the inactive +pools, and I<--all> lists all pools. + +=item B<pool-name> I<uuid> + +Convert the I<uuid> to a pool name. + +=item B<pool-refresh> I<pool-or-uuid> + +Refresh the list of volumes contained in I<pool>. + +=item B<pool-start> I<pool-or-uuid> + +Start the storage I<pool>, which is previously defined but inactive. + +=item B<pool-undefine> I<pool-or-uuid> + +Undefine the configuration for an inactive I<pool>. + +=item B<pool-uuid> I<pool> + +Returns the UUID of the named I<pool>. + =head1 SECRET COMMMANDS The following commands manipulate "secrets" (e.g. passwords, passphrases and @@ -653,11 +794,11 @@ format as accepted by the B<connect> option. =item VISUAL -The editor to use by the B<edit> and B<net-edit> options. +The editor to use by the B<edit> and related options. =item EDITOR -The editor to use by the B<edit> and B<net-edit> options, if C<VISUAL> +The editor to use by the B<edit> and related options, if C<VISUAL> is not set. =item LIBVIRT_DEBUG=LEVEL -- 1.6.6.1

2 2

[libvirt] [PATCH] Clarify an error message in setmem.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index ad64bc0..d241fa0 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -2407,7 +2407,8 @@ cmdSetmem(vshControl *ctl, const vshCmd *cmd) if (kilobytes > info.maxMem) { virDomainFree(dom); - vshError(ctl, _("Invalid value of %d for memory size"), kilobytes); + vshError(ctl, _("Requested memory size %d kb is larger than maximum of %lu kb"), + kilobytes, info.maxMem); return FALSE; } -- 1.6.6.1

2 2

[libvirt] [PATCH] Fix up comments for isEncrypted, isSecure, domainIsActive, and domainIsPersistent.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/lxc/lxc_driver.c | 8 ++++---- src/opennebula/one_driver.c | 4 ++-- src/phyp/phyp_driver.c | 4 ++-- src/qemu/qemu_driver.c | 8 ++++---- src/uml/uml_driver.c | 8 ++++---- src/vbox/vbox_tmpl.c | 8 ++++---- src/xen/xen_driver.c | 8 ++++---- 7 files changed, 24 insertions(+), 24 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index b5d422c..c6b652d 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -2527,10 +2527,10 @@ static virDriver lxcDriver = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - lxcIsEncrypted, - lxcIsSecure, - lxcDomainIsActive, - lxcDomainIsPersistent, + lxcIsEncrypted, /* isEncrypted */ + lxcIsSecure, /* isSecure */ + lxcDomainIsActive, /* domainIsActive */ + lxcDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ diff --git a/src/opennebula/one_driver.c b/src/opennebula/one_driver.c index 4554d95..0d80d1f 100644 --- a/src/opennebula/one_driver.c +++ b/src/opennebula/one_driver.c @@ -781,8 +781,8 @@ static virDriver oneDriver = { NULL, /* nodeDeviceReAttach; */ NULL, /* nodeDeviceReset; */ NULL, /* domainMigratePrepareTunnel */ - oneIsEncrypted, - oneIsSecure, + oneIsEncrypted, /* isEncrypted */ + oneIsSecure, /* isSecure */ NULL, /* domainIsActive */ NULL, /* domainIsPersistent */ NULL, /* cpuCompare */ diff --git a/src/phyp/phyp_driver.c b/src/phyp/phyp_driver.c index 28e17ff..b712d0a 100644 --- a/src/phyp/phyp_driver.c +++ b/src/phyp/phyp_driver.c @@ -1640,8 +1640,8 @@ virDriver phypDriver = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - phypIsEncrypted, - phypIsSecure, + phypIsEncrypted, /* isEncrypted */ + phypIsSecure, /* isSecure */ NULL, /* domainIsActive */ NULL, /* domainIsPersistent */ NULL, /* cpuCompare */ diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index a87b974..bc94ce6 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -11325,10 +11325,10 @@ static virDriver qemuDriver = { qemudNodeDeviceReAttach, /* nodeDeviceReAttach */ qemudNodeDeviceReset, /* nodeDeviceReset */ qemudDomainMigratePrepareTunnel, /* domainMigratePrepareTunnel */ - qemuIsEncrypted, - qemuIsSecure, - qemuDomainIsActive, - qemuDomainIsPersistent, + qemuIsEncrypted, /* isEncrypted */ + qemuIsSecure, /* isSecure */ + qemuDomainIsActive, /* domainIsActive */ + qemuDomainIsPersistent, /* domainIsPersistent */ qemuCPUCompare, /* cpuCompare */ qemuCPUBaseline, /* cpuBaseline */ qemuDomainGetJobInfo, /* domainGetJobInfo */ diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index dfa5de5..0179b2e 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -1926,10 +1926,10 @@ static virDriver umlDriver = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - umlIsEncrypted, - umlIsSecure, - umlDomainIsActive, - umlDomainIsPersistent, + umlIsEncrypted, /* isEncrypted */ + umlIsSecure, /* isSecure */ + umlDomainIsActive, /* domainIsActive */ + umlDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 62fd8e1..4b00a80 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -8138,10 +8138,10 @@ virDriver NAME(Driver) = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - vboxIsEncrypted, - vboxIsSecure, - vboxDomainIsActive, - vboxDomainIsPersistent, + vboxIsEncrypted, /* isEncrypted */ + vboxIsSecure, /* isSecure */ + vboxDomainIsActive, /* domainIsActive */ + vboxDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ diff --git a/src/xen/xen_driver.c b/src/xen/xen_driver.c index 7c4eb5e..0835406 100644 --- a/src/xen/xen_driver.c +++ b/src/xen/xen_driver.c @@ -1969,10 +1969,10 @@ static virDriver xenUnifiedDriver = { xenUnifiedNodeDeviceReAttach, /* nodeDeviceReAttach */ xenUnifiedNodeDeviceReset, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - xenUnifiedIsEncrypted, - xenUnifiedIsSecure, - xenUnifiedDomainIsActive, - xenUnifiedDomainisPersistent, + xenUnifiedIsEncrypted, /* isEncrypted */ + xenUnifiedIsSecure, /* isSecure */ + xenUnifiedDomainIsActive, /* domainIsActive */ + xenUnifiedDomainisPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ -- 1.6.6.1

2 2

[libvirt] [PATCH] Document snapshot virsh commands in the man page.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.pod | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 49 insertions(+), 0 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 62395d7..9e2c3e5 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -639,6 +639,55 @@ Output a list of UUIDs of known secrets to stdout. =back +=head1 SNAPSHOT COMMMANDS + +The following commands manipulate domain snapshots. Snapshots take the +disk, memory, and device state of a domain at a point-of-time, and save it +for future use. They have many uses, from saving a "clean" copy of an OS +image to saving a domain's state before a potentially destructive operation. +Snapshots are identified with a unique name. See +L<http://libvirt.org/formatsnapshot.html> for documentation of the XML format +used to represent properties of snapshots. + +=over 4 + +=item B<snapshot-create> I<domain> I<xmlfile> + +Create a snapshot for domain I<domain> with the properties specified in +I<xmlfile>. The only properties settable for a domain snapshot are the +<name> and <description>; the rest of the fields are ignored, and +automatically filled in by libvirt. If I<xmlfile> is completely ommitted, +then libvirt will choose a value for all fields. + +=item B<snapshot-current> I<domain> + +Output the snapshot XML for the domain's current snapshot (if any). + +=item B<snapshot-list> I<domain> + +List all of the available snapshots for the given domain. + +=item B<snapshot-dumpxml> I<domain> I<snapshot> + +Output the snapshot XML for the domain's snapshot named I<snapshot>. + +=item B<revert-to-snapshot> I<domain> I<snapshot> + +Revert the given domain to the snapshot specified by I<snapshot>. Be aware +that this is a destructive action; any changes in the domain since the +snapshot is taken will be lost. Also note that the state of the domain after +revert-to-snapshot is complete will be the state of the domain at the time +the original snapshot was taken. + +=item B<snapshot-delete> I<domain> I<snapshot> I<--children> + +Delete the snapshot for the domain named I<snapshot>. If this snapshot +has child snapshots, changes from this snapshot will be merged into the +children. If I<--children> is passed, then delete this snapshot and any +children of this snapshot. + +=back + =head1 ENVIRONMENT The following environment variables can be set to alter the behaviour -- 1.6.6.1

2 2

[libvirt] [PATCH] Better error reporting in virsh.
by Chris Lalancette 06 Apr '10

06 Apr '10

When hitting failures in virsh, a common idiom is to jump to a cleanup label, free some resources, and then return a FALSE error code to vshCommandRun. In theory, vshCommandRun is then supposed to print out the last error. The problem is that many of the cleanup paths have library calls to free resources, and all of those library calls clear out the last error. This is leading to situations where no error is being reported at all. This patch remedies the situation somewhat by printing out the errors inside the command methods themselves when we know it will go through a cleanup path that will lose the error. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.c | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index d241fa0..aaae7ca 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -2623,9 +2623,8 @@ cmdDomXMLFromNative(vshControl *ctl, const vshCmd *cmd) format = vshCommandOptString(cmd, "format", NULL); configFile = vshCommandOptString(cmd, "config", NULL); - if (virFileReadAll(configFile, 1024*1024, &configData) < 0) { + if (virFileReadAll(configFile, 1024*1024, &configData) < 0) return FALSE; - } xmlData = virConnectDomainXMLFromNative(ctl->conn, format, configData, flags); if (xmlData != NULL) { @@ -2669,9 +2668,8 @@ cmdDomXMLToNative(vshControl *ctl, const vshCmd *cmd) format = vshCommandOptString(cmd, "format", NULL); xmlFile = vshCommandOptString(cmd, "xml", NULL); - if (virFileReadAll(xmlFile, 1024*1024, &xmlData) < 0) { + if (virFileReadAll(xmlFile, 1024*1024, &xmlData) < 0) return FALSE; - } configData = virConnectDomainXMLToNative(ctl->conn, format, xmlData, flags); if (configData != NULL) { @@ -4330,9 +4328,8 @@ cmdNodeDeviceCreate(vshControl *ctl, const vshCmd *cmd) return FALSE; } - if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) return FALSE; - } dev = virNodeDeviceCreateXML(ctl->conn, buffer, 0); VIR_FREE(buffer); @@ -5427,6 +5424,7 @@ cmdVolCreate(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virStoragePoolFree(pool); return FALSE; } @@ -5488,6 +5486,7 @@ cmdVolCreateFrom(vshControl *ctl, const vshCmd *cmd) goto cleanup; if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); goto cleanup; } @@ -6928,6 +6927,7 @@ cmdAttachDevice(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virDomainFree(dom); return FALSE; } @@ -6995,6 +6995,7 @@ cmdDetachDevice(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virDomainFree(dom); return FALSE; } @@ -7062,6 +7063,7 @@ cmdUpdateDevice(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virDomainFree(dom); return FALSE; } -- 1.6.6.1

2 2

[libvirt] [PATCH] Website documentation for the snapshot XML.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- docs/formatsnapshot.html.in | 72 +++++++++++++++++++++++++++++++++++++++++++ docs/sitemap.html.in | 4 ++ 2 files changed, 76 insertions(+), 0 deletions(-) create mode 100644 docs/formatsnapshot.html.in diff --git a/docs/formatsnapshot.html.in b/docs/formatsnapshot.html.in new file mode 100644 index 0000000..fa007ea --- /dev/null +++ b/docs/formatsnapshot.html.in @@ -0,0 +1,72 @@ +<html> + <body> + <h1>Snapshot XML format</h1> + + <ul id="toc"></ul> + + <h2><a name="SnapshotAttributes">Snapshot XML</a></h2> + + <p> + Attributes of libvirt snapshots are stored as child elements of + the <code>domainsnapshot</code> element. At snapshot creation + time, only the <code>name</code> and <code>description</code> + elements are settable; the rest of the fields are informational + (and readonly) and will be filled in by libvirt when the + snapshot is created. + </p> + <p> + The top-level <code>domainsnapshot</code> element may contain + the following elements: + </p> + <dl> + <dt><code>name</code></dt> + <dd>The name for this snapshot. If the name is specified when + initially creating the snapshot, then the snapshot will have + that particular name. If the name is omitted when initially + creating the snapshot, then libvirt will make up a name for the snapshot. + </dd> + <dt><code>description</code></dt> + <dd>A human-readable description of the snapshot. If the + description is omitted when initially creating the snapshot, + then this field will be empty. + </dd> + <dt><code>creationTime</code></dt> + <dd>The time this snapshot was created. The time is specified + in seconds since the Epoch (i.e. Unix time). Readonly. + </dd> + <dt><code>state</code></dt> + <dd>The state of the domain at the time this snapshot was + taken. When the domain is reverted to this snapshot, the domain's state + will be set to whatever is in this field. Readonly. + </dd> + <dt><code>parent</code></dt> + <dd>The parent of this snapshot. This element contains exactly + one child element, name. This specifies the name of the parent + snapshot of this snapshot, and is used to represent trees of + snapshots. Readonly. + </dd> + <dt><code>domain</code></dt> + <dd>The domain that this snapshot was taken against. This + element contains exactly one child element, uuid. This + specifies the uuid of the domain that this snapshot was taken + against. Readonly. + </dd> + </dl> + + <h2><a name="example">Example</a></h2> + + <pre> + <domainsnapshot> + <name>os-updates</name> + <description>Snapshot of OS install and updates</description> + <state>running</state> + <creationTime>1270477159</creationTime> + <parent> + <name>bare-os-install</name> + </parent> + <domain> + <uuid>93a5c045-6457-2c09-e56c-927cdf34e178</uuid> + </domain> + </domainsnapshot></pre> + </body> +</html> diff --git a/docs/sitemap.html.in b/docs/sitemap.html.in index 76d8faa..ae2bfde 100644 --- a/docs/sitemap.html.in +++ b/docs/sitemap.html.in @@ -114,6 +114,10 @@ <a href="formatsecret.html">Secrets</a> <span>The secret XML format</span> </li> + <li> + <a href="formatsnapshot.html">Secrets</a> + <span>The snapshot XML format</span> + </li> </ul> </li> <li> -- 1.6.6.1

2 2

[libvirt] [PATCH] Increase the number of available VNC ports.
by Chris Lalancette 06 Apr '10

06 Apr '10

When starting up qemu VNC autoport guests, we were only looking through ports 5900 to 6000, meaning we were limited to 100 total clients. Increase that limit to 65535 (the last available port), so we can have up to 59635 VNC autoport guests. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/qemu/qemu_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index bc94ce6..ce43fd3 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -2598,7 +2598,7 @@ qemuInitPCIAddresses(struct qemud_driver *driver, static int qemudNextFreeVNCPort(struct qemud_driver *driver ATTRIBUTE_UNUSED) { int i; - for (i = 5900 ; i < 6000 ; i++) { + for (i = 5900 ; i < 65535 ; i++) { int fd; int reuse = 1; struct sockaddr_in addr; -- 1.6.6.1

3 3

[libvirt] [PATCH] nwfilter: RHEL 5 gcc fixes
by Stefan Berger 06 Apr '10

06 Apr '10

This patch fixes some compilation issues for the RHEL5 build. I am also removing the IPV6 constant where it appears in the wrong place. Seems like a new bad thing to rely on the compiler to tell about potentially uninitialized vars... Signed-off-by; Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -392,7 +392,9 @@ struct _virXMLAttr2Struct static const struct int_map macProtoMap[] = { INTMAP_ENTRY(ETHERTYPE_ARP , "arp"), INTMAP_ENTRY(ETHERTYPE_IP , "ipv4"), +#ifdef ETHERTYPE_IPV6 INTMAP_ENTRY(ETHERTYPE_IPV6, "ipv6"), +#endif INTMAP_ENTRY_LAST }; @@ -547,7 +549,6 @@ static const struct int_map ipProtoMap[] #ifdef IPPROTO_SCTP INTMAP_ENTRY(IPPROTO_SCTP, "sctp"), #endif - INTMAP_ENTRY(IPPROTO_IPV6, "ipv6"), INTMAP_ENTRY(IPPROTO_ICMPV6, "icmpv6"), INTMAP_ENTRY_LAST }; @@ -1124,7 +1125,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n nwItemDesc *item; int int_val; unsigned int uint_val; - void *data_ptr, *storage_ptr; + void *data_ptr = NULL, *storage_ptr; valueValidator validator; char *match = virXMLPropString(node, "match"); nwIPAddress ipaddr; @@ -1550,7 +1551,7 @@ virNWFilterRuleParse(xmlNodePtr node) char *direction; char *prio; int found; - int found_i; + int found_i = 0; unsigned int priority; xmlNodePtr cur;

2 2

[libvirt] [PATCH] Fix compiler warning about unused conn parameter
by Matthias Bolte 06 Apr '10

06 Apr '10

This only affects builds without NUMA support. --- I just pushed this patch. src/nodeinfo.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/nodeinfo.c b/src/nodeinfo.c index 402a6b7..4d7fac1 100644 --- a/src/nodeinfo.c +++ b/src/nodeinfo.c @@ -450,7 +450,7 @@ int nodeCapsInitNUMA(virCapsPtr caps ATTRIBUTE_UNUSED) { return 0; } -int nodeGetCellsFreeMemory(virConnectPtr conn, +int nodeGetCellsFreeMemory(virConnectPtr conn ATTRIBUTE_UNUSED, unsigned long long *freeMems ATTRIBUTE_UNUSED, int startCell ATTRIBUTE_UNUSED, int maxCells ATTRIBUTE_UNUSED) @@ -460,7 +460,7 @@ int nodeGetCellsFreeMemory(virConnectPtr conn, return -1; } -unsigned long long nodeGetFreeMemory(virConnectPtr conn) +unsigned long long nodeGetFreeMemory(virConnectPtr conn ATTRIBUTE_UNUSED) { nodeReportError(VIR_ERR_NO_SUPPORT, "%s", _("NUMA memory information not available on this platform")); -- 1.6.3.3

1 0

[libvirt] Sys::Virt Perl bindings - calling newSVpv with unsafe length
by Richard W.M. Jones 06 Apr '10

06 Apr '10

Dan, After tracking down a very obscure bug in hivex & libguestfs Perl bindings, I started looking for places where we call newSVpv with a variable length argument that could be zero. In such cases, one should call newSVpvn instead, otherwise Perl will try to use strlen() to calculate the length of the data buffer when length is passed in as zero [I'm sure you are aware of this already]. There seems to be one such case in the Sys::Virt bindings: http://cpansearch.perl.org/src/DANBERR/Sys-Virt-0.2.3/Virt.xs CODE: if ((bytes = virSecretGetValue(sec, &len, flags)) == NULL) { _croak_error(virConnGetLastError(virSecretGetConnect(sec))); } RETVAL = newSVpv((char*)bytes, len); Maybe 'len' can never be zero here, but I think it's safer to turn this into a call to newSVpvn anyway. Also, if you look at the source to newSVpv: http://github.com/mirrors/perl/blob/blead/sv.c#L7752 You'll see there is an extra test, not present with newSVpvn. So it's better to always call newSVpvn wherever there is a constant-sized buffer, eg in code like this: if ((virDomainGetUUID(dom, rawuuid)) < 0) { _croak_error(virConnGetLastError(virDomainGetConnect(dom))); } RETVAL = newSVpv((char*)rawuuid, sizeof(rawuuid)); Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones New in Fedora 11: Fedora Windows cross-compiler. Compile Windows programs, test, and build Windows installers. Over 70 libraries supprt'd http://fedoraproject.org/wiki/MinGW http://www.annexia.org/fedora_mingw

2 1

[libvirt] [PATCH] [0/4] Managed save APIs version 2
by Daniel Veillard 06 Apr '10

06 Apr '10

Change w.r.t. version 1 is the saving path under /var/lib and not /var/run, the restore bug fix spotted by Laine and the various typo and improvement from Eric. As posted earlier, I have implemented the small set of managed save APIs, where libvirt stores the domain state itself and can then recover that state when the domain is started up. I think the code is complete, but not really tested (I still need to debug a failure which seems unrelated), with the exception of the virsh commands which probably need to be extended for convenience. Also I implemented it only for the qemu driver, I would not be surprized if an ESX backend could be implemented since there is no file path in this API. A command "virsh saveall" would be convenient, to be added later. More documentation is needed too. Thanks to Chris Lalancette who wrote a large part of this code ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

5 22

[libvirt] [PATCH] Fix compiler warning about non-literal format string
by Matthias Bolte 06 Apr '10

06 Apr '10

--- I just pushed this patch. src/security/security_apparmor.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index db04d5c..8e1c794 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -483,7 +483,7 @@ AppArmorSetSecurityProcessLabel(virSecurityDriverPtr drv, virDomainObjPtr vm) } if (aa_change_profile(profile_name) < 0) { - virSecurityReportError(VIR_ERR_INTERNAL_ERROR, + virSecurityReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("error calling aa_change_profile()")); goto clean; } -- 1.6.3.3

1 0

[libvirt] Build fails on RHEL-5
by Chris Lalancette 05 Apr '10

05 Apr '10

Hey Stefan, When trying to build libvirt head on RHEL-5, I'm getting this error: gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../gnulib/lib -I../gnulib/lib -I../include -I../src/util -I../include -I/usr/include/libxml2 -DLIBDIR=\"/usr/local/lib\" -DBINDIR=\"/usr/local/libexec\" -DSBINDIR=\"/usr/local/sbin\" -DSYSCONF_DIR=\"/usr/local/etc\" -DLOCALEBASEDIR=\"/usr/local/share/locale\" -DPKGDATADIR=\"/usr/local/share/libvirt\" -DLOCAL_STATE_DIR=\"/usr/local/var\" -DGETTEXT_PACKAGE=\"libvirt\" -Wall -Wformat -Wformat-security -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Winline -Wredundant-decls -Wno-sign-compare -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fasynchronous-unwind-tables -fdiagnostics-show-option -Werror -DIN_LIBVIRT -g -O2 -MT libvirt_conf_la-nwfilter_conf.lo -MD -MP -MF .deps/libvirt_conf_la-nwfilter_conf.Tpo -c conf/nwfilter_conf.c -fPIC -DPIC -o .libs/libvirt_conf_la-nwfilter_conf.o conf/nwfilter_conf.c:395: error: 'ETHERTYPE_IPV6' undeclared here (not in a function) make[3]: *** [libvirt_conf_la-nwfilter_conf.lo] Error 1 It seems that ETHERTYPE_IPV6 is not declared in /usr/include/net/ethernet.h in RHEL-5. We can probably get around this by adding (untested): #ifndef ETHERTYPE_IPV6 #define ETHERTYPE_IPV6 0x86dd #endif At the top of nwfilter_conf.c -- Chris Lalancette

2 2

[libvirt] [PATCH] Only parse 'CPU XML' in virCPUDefParseXML()
by Jim Fehlig 05 Apr '10

05 Apr '10

I received a report of user crashing libvirtd with virsh capabilities > capabilities.xml virsh cpu-compare capabilities.xml Breakpoint 1, x86ModelFind (map=0x6fb6f0, name=0x0) at cpu/cpu_x86.c:501 501 model = map->models; (gdb) bt #0 x86ModelFind (map=0x6fb6f0, name=0x0) at cpu/cpu_x86.c:501 #1 0x00007ffff70d0832 in x86ModelFromCPU (cpu=0x712070, map=0x6fb6f0, policy=1) at cpu/cpu_x86.c:541 #2 0x00007ffff70d12e9 in x86Compute (host=0x6ea610, cpu=0x712070, guest=0x0) at cpu/cpu_x86.c:822 #3 0x00007ffff70d1750 in x86Compare (host=0x6ea610, cpu=0x712070) at cpu/cpu_x86.c:927 #4 0x00007ffff70cf0c9 in cpuCompare (conn=0x6f69a0, host=0x6ea610, cpu=0x712070) at cpu/cpu.c:118 #5 0x00007ffff70ceff4 in cpuCompareXML (conn=0x6f69a0, host=0x6ea610, xml=0x6fa3e0 "<capabilities>\n\n <host>\n <cpu>\n <arch>x86_64</arch>\n <features>\n <pae/>\n </features>\n </cpu>\n <migration_features>\n <live/>\n <uri_transports>\n <uri_tra"...) at cpu/cpu.c:90 .. (gdb) n 503 if (STREQ(model->name, name)) (gdb) Program received signal SIGSEGV, Segmentation fault. 0x00007ffff4ff4960 in strcmp () from /lib64/libc.so.6 name, passed to x86ModelFind(), is NULL because virCPUDefParseXML() failed to parse anything meaningful from the "malformed" CPU XML. I waffled for quite a while on how to fix this and in the end decided to ensure the CPU XML passed to virCPUDefParseXML() does in fact contain an element named 'cpu'. AFAICT, all consumers of virCPUDefParseXML() pass an xmlNodePtr rooted at 'cpu' element. NB: I will be offline until Monday so if this patch is satisfactory please include it for 0.7.8/0.8.0 release :-). Otherwise I'll respin with suggested changes next week. Thanks! Jim

2 3

[libvirt] .so version number question
by Eric Blake 05 Apr '10

05 Apr '10

On IRC, Chris raised the question on what version number we should be using for libvirt.so. The libtool manual has an entire chapter on the matter: http://www.gnu.org/software/libtool/manual/libtool.html#Release-numbers In particular, it states that if you are using the -version-info flag to libtool (which our src/Makefile.am currently does), then you are promising to abide by the libtool versioning rules, where the .so version is treated as current:revision:age (and not major.minor.micro). In fact, libtool goes so far as to state that "Never try to set the interface numbers so that they correspond to the release number of your package. This is an abuse that only fosters misunderstanding of the purpose of library versions. Instead, use the -release flag (see Release numbers), but be warned that every release of your package will not be binary compatible with any other release." Should we be using -release instead of -version-info? Or should we continue using -version-info, but follow the advice of divorcing the .so version number from the release number? For example, according to the libtool rules, if the two version numbers are independent, then going from libtool 0.7.7 to 0.8.0 (that is, a minor version number bump in terms of packaging numbering), should go from libvirt.so.0:7:7 (we are at API version 0, with seven revisions of the code implementing that API, and are compatible back to -7:0:0, which is nonsense, so it effectively works out that we are compatible back to 0:0:0) to libvirt.so.1:0:1 (we added API, this is the first implementation of that new API, and we are compatible back to 0.x.x). Going by the libtool rules means that the c.r.a field will increment 'c' rather frequently (basically, every time we add an API!), but as long as 'a' increments just as frequently, then we are not making any backwards incompatible changes. But if you don't like that, the we should be going by the -release flag to libtool, where the .so numbering matches the libvirt release numbering. On the other hand, libtool states that using the -release flag means that anyone that uses libtool to link against libvirt.so is treated as being an incompatible change (basically, even though we are striving hard to maintain backwards compatibility, libtool can't exploit that). Again from the manual, "Note that this option causes a modification of the library name, so do not use it unless you want to break binary compatibility with any past library releases. In general, you should only use -release for package-internal libraries or for ones whose interfaces change very frequently." Libvirt's interface changes frequently, but libvirt.so is not a package-internal library so I don't think that -release is the way to go. Should I try to prepare a patch to start making better use of the -version-info libtool flag according to the libtool rules? And if so, is everyone okay with just punting on this issue until after 0.8.0 is out the door? -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

1 0

[libvirt] clarified syntax-check error message
by Dave Allan 05 Apr '10

05 Apr '10

I pushed the attached trivial patch after noticing that I had a tab in one of my RNG schemas and that the error message was not quite right in that case. Dave

1 0

[libvirt] [PATCH Java] Add finalize to automatically free libvirt objects
by Matthias Bolte 05 Apr '10

05 Apr '10

The Connect and Network classes already had finalize, add it to all other classes that wrap libvirt objects to unify the behavior. --- src/main/java/org/libvirt/Device.java | 5 +++++ src/main/java/org/libvirt/Domain.java | 5 +++++ src/main/java/org/libvirt/Interface.java | 5 +++++ src/main/java/org/libvirt/Network.java | 1 + src/main/java/org/libvirt/StoragePool.java | 5 +++++ src/main/java/org/libvirt/StorageVol.java | 5 +++++ 6 files changed, 26 insertions(+), 0 deletions(-) diff --git a/src/main/java/org/libvirt/Device.java b/src/main/java/org/libvirt/Device.java index b4f9a0c..5329be5 100644 --- a/src/main/java/org/libvirt/Device.java +++ b/src/main/java/org/libvirt/Device.java @@ -132,6 +132,11 @@ public class Device { return desc; } + @Override + public void finalize() throws LibvirtException { + free(); + } + /** * Frees this device object. The running instance is kept alive. The data * structure is freed and should not be used thereafter. diff --git a/src/main/java/org/libvirt/Domain.java b/src/main/java/org/libvirt/Domain.java index e7b24ef..a80800c 100644 --- a/src/main/java/org/libvirt/Domain.java +++ b/src/main/java/org/libvirt/Domain.java @@ -162,6 +162,11 @@ public class Domain { processError(); } + @Override + public void finalize() throws LibvirtException { + free(); + } + /** * Frees this domain object. The running instance is kept alive. The data * structure is freed and should not be used thereafter. diff --git a/src/main/java/org/libvirt/Interface.java b/src/main/java/org/libvirt/Interface.java index 44bcad5..8b97925 100644 --- a/src/main/java/org/libvirt/Interface.java +++ b/src/main/java/org/libvirt/Interface.java @@ -112,6 +112,11 @@ public class Interface { return returnValue; } + @Override + public void finalize() throws LibvirtException { + free(); + } + /** * Frees this interface object. The running instance is kept alive. The data * structure is freed and should not be used thereafter. diff --git a/src/main/java/org/libvirt/Network.java b/src/main/java/org/libvirt/Network.java index 3c6f313..63b1f12 100644 --- a/src/main/java/org/libvirt/Network.java +++ b/src/main/java/org/libvirt/Network.java @@ -64,6 +64,7 @@ public class Network { processError(); } + @Override public void finalize() throws LibvirtException { free(); } diff --git a/src/main/java/org/libvirt/StoragePool.java b/src/main/java/org/libvirt/StoragePool.java index 7de7d50..54468bd 100644 --- a/src/main/java/org/libvirt/StoragePool.java +++ b/src/main/java/org/libvirt/StoragePool.java @@ -115,6 +115,11 @@ public class StoragePool { processError(); } + @Override + public void finalize() throws LibvirtException { + free(); + } + /** * Free a storage pool object, releasing all memory associated with it. Does * not change the state of the pool on the host. diff --git a/src/main/java/org/libvirt/StorageVol.java b/src/main/java/org/libvirt/StorageVol.java index 5ae5f5c..c5a3717 100644 --- a/src/main/java/org/libvirt/StorageVol.java +++ b/src/main/java/org/libvirt/StorageVol.java @@ -75,6 +75,11 @@ public class StorageVol { processError(); } + @Override + public void finalize() throws LibvirtException { + free(); + } + /** * Release the storage volume handle. The underlying storage volume contains * to exist -- 1.6.3.3

3 4

[libvirt] [PATCH] nwfilter: remove virConnectPtr conn from functions where it is not necessary
by Stefan Berger 05 Apr '10

05 Apr '10

This patch removes the virConnectPtr parameter from all functions where it's not necessary starting out with removing it as a parameter to the error reporting function. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 154 ++---- src/conf/nwfilter_conf.h | 24 src/conf/nwfilter_params.c | 7 src/conf/nwfilter_params.h | 3 src/nwfilter/nwfilter_driver.c | 24 src/nwfilter/nwfilter_ebiptables_driver.c | 760 ++++++++++++------------------ src/nwfilter/nwfilter_gentech_driver.c | 51 -- src/nwfilter/nwfilter_gentech_driver.h | 6 tests/nwfilterxml2xmltest.c | 2 9 files changed, 423 insertions(+), 608 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -518,13 +518,11 @@ virNWFilterPoolObjPtr const char *name); -int virNWFilterPoolObjSaveDef(virConnectPtr conn, - virNWFilterDriverStatePtr driver, +int virNWFilterPoolObjSaveDef(virNWFilterDriverStatePtr driver, virNWFilterPoolObjPtr pool, virNWFilterDefPtr def); -int virNWFilterPoolObjDeleteDef(virConnectPtr conn, - virNWFilterPoolObjPtr pool); +int virNWFilterPoolObjDeleteDef(virNWFilterPoolObjPtr pool); virNWFilterPoolObjPtr virNWFilterPoolObjAssignDef(virConnectPtr conn, virNWFilterPoolObjListPtr pools, @@ -533,28 +531,23 @@ virNWFilterPoolObjPtr virNWFilterPoolObj int virNWFilterTestUnassignDef(virConnectPtr conn, virNWFilterPoolObjPtr pool); -virNWFilterDefPtr virNWFilterDefParseNode(virConnectPtr conn, - xmlDocPtr xml, +virNWFilterDefPtr virNWFilterDefParseNode(xmlDocPtr xml, xmlNodePtr root); -char *virNWFilterDefFormat(virConnectPtr conn, - virNWFilterDefPtr def); +char *virNWFilterDefFormat(virNWFilterDefPtr def); -int virNWFilterSaveXML(virConnectPtr conn, - const char *configDir, +int virNWFilterSaveXML(const char *configDir, virNWFilterDefPtr def, const char *xml); -int virNWFilterSaveConfig(virConnectPtr conn, - const char *configDir, +int virNWFilterSaveConfig(const char *configDir, virNWFilterDefPtr def); int virNWFilterPoolLoadAllConfigs(virConnectPtr conn, virNWFilterPoolObjListPtr pools, const char *configDir); -char *virNWFilterConfigFile(virConnectPtr conn, - const char *dir, +char *virNWFilterConfigFile(const char *dir, const char *name); virNWFilterDefPtr virNWFilterDefParseString(virConnectPtr conn, @@ -568,8 +561,7 @@ void virNWFilterPoolObjUnlock(virNWFilte int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); -# define virNWFilterReportError(conn, code, fmt...) \ - (void)conn; \ +# define virNWFilterReportError(code, fmt...) \ virReportErrorHelper(NULL, VIR_FROM_NWFILTER, code, __FILE__, \ __FUNCTION__, __LINE__, fmt) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -310,8 +310,7 @@ virNWFilterPoolObjListFree(virNWFilterPo static int -virNWFilterRuleDefAddVar(virConnectPtr conn ATTRIBUTE_UNUSED, - virNWFilterRuleDefPtr nwf, +virNWFilterRuleDefAddVar(virNWFilterRuleDefPtr nwf, nwItemDesc *item, const char *var) { @@ -1112,8 +1111,7 @@ virNWIPv6AddressParser(const char *input static int -virNWFilterRuleDetailsParse(virConnectPtr conn ATTRIBUTE_UNUSED, - xmlNodePtr node, +virNWFilterRuleDetailsParse(xmlNodePtr node, virNWFilterRuleDefPtr nwf, const virXMLAttr2Struct *att) { @@ -1152,8 +1150,7 @@ virNWFilterRuleDetailsParse(virConnectPt flags_set |= NWFILTER_ENTRY_ITEM_FLAG_HAS_VAR; storage_ptr = NULL; - if (virNWFilterRuleDefAddVar(conn, - nwf, + if (virNWFilterRuleDefAddVar(nwf, item, &prop[1])) rc = -1; @@ -1325,7 +1322,7 @@ virNWFilterRuleDetailsParse(virConnectPt } if (!found || rc) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("%s has illegal value %s"), att[idx].name, prop); rc = -1; @@ -1348,8 +1345,7 @@ virNWFilterRuleDetailsParse(virConnectPt static virNWFilterIncludeDefPtr -virNWFilterIncludeParse(virConnectPtr conn, - xmlNodePtr cur) +virNWFilterIncludeParse(xmlNodePtr cur) { virNWFilterIncludeDefPtr ret; @@ -1360,7 +1356,7 @@ virNWFilterIncludeParse(virConnectPtr co ret->filterref = virXMLPropString(cur, "filter"); if (!ret->filterref) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("rule node requires action attribute")); goto err_exit; @@ -1548,8 +1544,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD static virNWFilterRuleDefPtr -virNWFilterRuleParse(virConnectPtr conn, - xmlNodePtr node) +virNWFilterRuleParse(xmlNodePtr node) { char *action; char *direction; @@ -1571,28 +1566,28 @@ virNWFilterRuleParse(virConnectPtr conn, prio = virXMLPropString(node, "priority"); if (!action) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("rule node requires action attribute")); goto err_exit; } if ((ret->action = virNWFilterRuleActionTypeFromString(action)) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("unknown rule action attribute value")); goto err_exit; } if (!direction) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("rule node requires direction attribute")); goto err_exit; } if ((ret->tt = virNWFilterRuleDirectionTypeFromString(direction)) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("unknown rule direction attribute value")); goto err_exit; @@ -1624,8 +1619,7 @@ virNWFilterRuleParse(virConnectPtr conn, found = 1; ret->prtclType = virAttr[i].prtclType; - if (virNWFilterRuleDetailsParse(conn, - cur, + if (virNWFilterRuleDetailsParse(cur, ret, virAttr[i].att) < 0) { /* we ignore malformed rules @@ -1663,8 +1657,7 @@ err_exit: static virNWFilterDefPtr -virNWFilterDefParseXML(virConnectPtr conn, - xmlXPathContextPtr ctxt) { +virNWFilterDefParseXML(xmlXPathContextPtr ctxt) { virNWFilterDefPtr ret; xmlNodePtr curr = ctxt->node; char *uuid = NULL; @@ -1678,7 +1671,7 @@ virNWFilterDefParseXML(virConnectPtr con ret->name = virXPathString("string(./@name)", ctxt); if (!ret->name) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("filter has no name")); goto cleanup; } @@ -1688,7 +1681,7 @@ virNWFilterDefParseXML(virConnectPtr con if (chain) { if ((ret->chainsuffix = virNWFilterChainSuffixTypeFromString(chain)) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("unknown chain suffix '%s'"), chain); goto cleanup; } @@ -1697,13 +1690,13 @@ virNWFilterDefParseXML(virConnectPtr con uuid = virXPathString("string(./uuid)", ctxt); if (uuid == NULL) { if (virUUIDGenerate(ret->uuid) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("unable to generate uuid")); goto cleanup; } } else { if (virUUIDParse(uuid, ret->uuid) < 0) { - virNWFilterReportError(conn, VIR_ERR_XML_ERROR, + virNWFilterReportError(VIR_ERR_XML_ERROR, "%s", _("malformed uuid element")); goto cleanup; } @@ -1721,9 +1714,9 @@ virNWFilterDefParseXML(virConnectPtr con /* ignore malformed rule and include elements */ if (xmlStrEqual(curr->name, BAD_CAST "rule")) - entry->rule = virNWFilterRuleParse(conn, curr); + entry->rule = virNWFilterRuleParse(curr); else if (xmlStrEqual(curr->name, BAD_CAST "filterref")) - entry->include = virNWFilterIncludeParse(conn, curr); + entry->include = virNWFilterIncludeParse(curr); if (entry->rule || entry->include) { if (VIR_REALLOC_N(ret->filterEntries, ret->nentries+1) < 0) { @@ -1762,7 +1755,7 @@ catchXMLError (void *ctx, const char *ms conn->err.code == VIR_ERR_NONE && ctxt->lastError.level == XML_ERR_FATAL && ctxt->lastError.message != NULL) { - virNWFilterReportError(conn, VIR_ERR_XML_DETAIL, + virNWFilterReportError(VIR_ERR_XML_DETAIL, _("at line %d: %s"), ctxt->lastError.line, ctxt->lastError.message); @@ -1772,14 +1765,13 @@ catchXMLError (void *ctx, const char *ms virNWFilterDefPtr -virNWFilterDefParseNode(virConnectPtr conn, - xmlDocPtr xml, +virNWFilterDefParseNode(xmlDocPtr xml, xmlNodePtr root) { xmlXPathContextPtr ctxt = NULL; virNWFilterDefPtr def = NULL; if (STRNEQ((const char *)root->name, "filter")) { - virNWFilterReportError(conn, VIR_ERR_XML_ERROR, + virNWFilterReportError(VIR_ERR_XML_ERROR, "%s", _("unknown root element for nw filter pool")); goto cleanup; @@ -1792,7 +1784,7 @@ virNWFilterDefParseNode(virConnectPtr co } ctxt->node = root; - def = virNWFilterDefParseXML(conn, ctxt); + def = virNWFilterDefParseXML(ctxt); cleanup: xmlXPathFreeContext(ctxt); @@ -1802,8 +1794,8 @@ cleanup: static virNWFilterDefPtr virNWFilterDefParse(virConnectPtr conn, - const char *xmlStr, - const char *filename) { + const char *xmlStr, + const char *filename) { virNWFilterDefPtr ret = NULL; xmlParserCtxtPtr pctxt; xmlDocPtr xml = NULL; @@ -1830,19 +1822,19 @@ virNWFilterDefParse(virConnectPtr conn, if (!xml) { if (conn && conn->err.code == VIR_ERR_NONE) - virNWFilterReportError(conn, VIR_ERR_XML_ERROR, + virNWFilterReportError(VIR_ERR_XML_ERROR, "%s",_("failed to parse xml document")); goto cleanup; } node = xmlDocGetRootElement(xml); if (node == NULL) { - virNWFilterReportError(conn, VIR_ERR_XML_ERROR, + virNWFilterReportError(VIR_ERR_XML_ERROR, "%s", _("missing root element")); goto cleanup; } - ret = virNWFilterDefParseNode(conn, xml, node); + ret = virNWFilterDefParseNode(xml, node); xmlFreeParserCtxt (pctxt); xmlFreeDoc(xml); @@ -1858,7 +1850,7 @@ virNWFilterDefParse(virConnectPtr conn, virNWFilterDefPtr virNWFilterDefParseString(virConnectPtr conn, - const char *xmlStr) + const char *xmlStr) { return virNWFilterDefParse(conn, xmlStr, NULL); } @@ -1874,7 +1866,7 @@ virNWFilterDefParseFile(virConnectPtr co virNWFilterPoolObjPtr virNWFilterPoolObjFindByUUID(virNWFilterPoolObjListPtr pools, - const unsigned char *uuid) + const unsigned char *uuid) { unsigned int i; @@ -1891,7 +1883,7 @@ virNWFilterPoolObjFindByUUID(virNWFilter virNWFilterPoolObjPtr virNWFilterPoolObjFindByName(virNWFilterPoolObjListPtr pools, - const char *name) + const char *name) { unsigned int i; @@ -1906,8 +1898,7 @@ virNWFilterPoolObjFindByName(virNWFilter } -int virNWFilterSaveXML(virConnectPtr conn, - const char *configDir, +int virNWFilterSaveXML(const char *configDir, virNWFilterDefPtr def, const char *xml) { @@ -1916,7 +1907,7 @@ int virNWFilterSaveXML(virConnectPtr con size_t towrite; int err; - if ((configFile = virNWFilterConfigFile(conn, configDir, def->name)) == NULL) + if ((configFile = virNWFilterConfigFile(configDir, def->name)) == NULL) goto cleanup; if ((err = virFileMakePath(configDir))) { @@ -1962,17 +1953,16 @@ int virNWFilterSaveXML(virConnectPtr con } -int virNWFilterSaveConfig(virConnectPtr conn, - const char *configDir, +int virNWFilterSaveConfig(const char *configDir, virNWFilterDefPtr def) { int ret = -1; char *xml; - if (!(xml = virNWFilterDefFormat(conn, def))) + if (!(xml = virNWFilterDefFormat(def))) goto cleanup; - if (virNWFilterSaveXML(conn, configDir, def, xml)) + if (virNWFilterSaveXML(configDir, def, xml)) goto cleanup; ret = 0; @@ -2119,13 +2109,13 @@ virNWFilterTestUnassignDef(virConnectPtr virNWFilterPoolObjPtr virNWFilterPoolObjAssignDef(virConnectPtr conn, - virNWFilterPoolObjListPtr pools, - virNWFilterDefPtr def) + virNWFilterPoolObjListPtr pools, + virNWFilterDefPtr def) { virNWFilterPoolObjPtr pool; if (virNWFilterDefLoopDetect(conn, pools, def)) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("filter would introduce a loop")); return NULL; } @@ -2154,7 +2144,7 @@ virNWFilterPoolObjAssignDef(virConnectPt } if (virMutexInitRecursive(&pool->lock) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot initialize mutex")); VIR_FREE(pool); return NULL; @@ -2178,9 +2168,9 @@ virNWFilterPoolObjAssignDef(virConnectPt static virNWFilterPoolObjPtr virNWFilterPoolObjLoad(virConnectPtr conn, - virNWFilterPoolObjListPtr pools, - const char *file, - const char *path) + virNWFilterPoolObjListPtr pools, + const char *file, + const char *path) { virNWFilterDefPtr def; virNWFilterPoolObjPtr pool; @@ -2190,7 +2180,7 @@ virNWFilterPoolObjLoad(virConnectPtr con } if (!virFileMatchesNameSuffix(file, def->name, ".xml")) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("network filter pool config filename '%s' does not match pool name '%s'"), path, def->name); virNWFilterDefFree(def); @@ -2215,8 +2205,8 @@ virNWFilterPoolObjLoad(virConnectPtr con int virNWFilterPoolLoadAllConfigs(virConnectPtr conn, - virNWFilterPoolObjListPtr pools, - const char *configDir) + virNWFilterPoolObjListPtr pools, + const char *configDir) { DIR *dir; struct dirent *entry; @@ -2242,7 +2232,7 @@ virNWFilterPoolLoadAllConfigs(virConnect if (virFileBuildPath(configDir, entry->d_name, NULL, path, PATH_MAX) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("config filename '%s/%s' is too long"), configDir, entry->d_name); continue; @@ -2260,10 +2250,9 @@ virNWFilterPoolLoadAllConfigs(virConnect int -virNWFilterPoolObjSaveDef(virConnectPtr conn, - virNWFilterDriverStatePtr driver, - virNWFilterPoolObjPtr pool, - virNWFilterDefPtr def) +virNWFilterPoolObjSaveDef(virNWFilterDriverStatePtr driver, + virNWFilterPoolObjPtr pool, + virNWFilterDefPtr def) { char *xml; int fd = -1, ret = -1; @@ -2282,7 +2271,7 @@ virNWFilterPoolObjSaveDef(virConnectPtr if (virFileBuildPath(driver->configDir, def->name, ".xml", path, sizeof(path)) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot construct config file path")); return -1; } @@ -2292,8 +2281,8 @@ virNWFilterPoolObjSaveDef(virConnectPtr } } - if (!(xml = virNWFilterDefFormat(conn, def))) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + if (!(xml = virNWFilterDefFormat(def))) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("failed to generate XML")); return -1; } @@ -2335,19 +2324,18 @@ virNWFilterPoolObjSaveDef(virConnectPtr int -virNWFilterPoolObjDeleteDef(virConnectPtr conn, - virNWFilterPoolObjPtr pool) +virNWFilterPoolObjDeleteDef(virNWFilterPoolObjPtr pool) { if (!pool->configFile) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, - _("no config file for %s"), pool->def->name); + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("no config file for %s"), pool->def->name); return -1; } if (unlink(pool->configFile) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, - _("cannot remove config for %s"), - pool->def->name); + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("cannot remove config for %s"), + pool->def->name); return -1; } @@ -2369,8 +2357,7 @@ virNWIPAddressFormat(virBufferPtr buf, n static void -virNWFilterRuleDefDetailsFormat(virConnectPtr conn, - virBufferPtr buf, +virNWFilterRuleDefDetailsFormat(virBufferPtr buf, const char *type, const virXMLAttr2Struct *att, virNWFilterRuleDefPtr def) @@ -2420,7 +2407,7 @@ virNWFilterRuleDefDetailsFormat(virConne att[i].name); if (att[i].formatter) { if (!att[i].formatter(buf, def)) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("formatter for %s %s reported error"), type, att[i].name); @@ -2484,8 +2471,7 @@ err_exit: static char * -virNWFilterRuleDefFormat(virConnectPtr conn, - virNWFilterRuleDefPtr def) +virNWFilterRuleDefFormat(virNWFilterRuleDefPtr def) { int i; virBuffer buf = VIR_BUFFER_INITIALIZER; @@ -2500,8 +2486,7 @@ virNWFilterRuleDefFormat(virConnectPtr c i = 0; while (virAttr[i].id) { if (virAttr[i].prtclType == def->prtclType) { - virNWFilterRuleDefDetailsFormat(conn, - &buf2, + virNWFilterRuleDefDetailsFormat(&buf2, virAttr[i].id, virAttr[i].att, def); @@ -2563,18 +2548,16 @@ virNWFilterIncludeDefFormat(virNWFilterI static char * -virNWFilterEntryFormat(virConnectPtr conn, - virNWFilterEntryPtr entry) +virNWFilterEntryFormat(virNWFilterEntryPtr entry) { if (entry->rule) - return virNWFilterRuleDefFormat(conn, entry->rule); + return virNWFilterRuleDefFormat(entry->rule); return virNWFilterIncludeDefFormat(entry->include); } char * -virNWFilterDefFormat(virConnectPtr conn, - virNWFilterDefPtr def) +virNWFilterDefFormat(virNWFilterDefPtr def) { virBuffer buf = VIR_BUFFER_INITIALIZER; char uuid[VIR_UUID_STRING_BUFLEN]; @@ -2590,7 +2573,7 @@ virNWFilterDefFormat(virConnectPtr conn, virBufferVSprintf(&buf," <uuid>%s</uuid>\n", uuid); for (i = 0; i < def->nentries; i++) { - xml = virNWFilterEntryFormat(conn, def->filterEntries[i]); + xml = virNWFilterEntryFormat(def->filterEntries[i]); if (!xml) goto err_exit; virBufferVSprintf(&buf, "%s", xml); @@ -2613,8 +2596,7 @@ virNWFilterDefFormat(virConnectPtr conn, } -char *virNWFilterConfigFile(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *dir, +char *virNWFilterConfigFile(const char *dir, const char *name) { char *ret = NULL; Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -194,8 +194,8 @@ nwfilterLookupByUUID(virConnectPtr conn, nwfilterDriverUnlock(driver); if (!pool) { - virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, - "%s", _("no pool with matching uuid")); + virNWFilterReportError(VIR_ERR_NO_NWFILTER, + "%s", _("no pool with matching uuid")); goto cleanup; } @@ -220,8 +220,8 @@ nwfilterLookupByName(virConnectPtr conn, nwfilterDriverUnlock(driver); if (!pool) { - virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, - _("no pool with matching name '%s'"), name); + virNWFilterReportError(VIR_ERR_NO_NWFILTER, + _("no pool with matching name '%s'"), name); goto cleanup; } @@ -306,7 +306,7 @@ nwfilterDefine(virConnectPtr conn, if (!(pool = virNWFilterPoolObjAssignDef(conn, &driver->pools, def))) goto cleanup; - if (virNWFilterPoolObjSaveDef(conn, driver, pool, def) < 0) { + if (virNWFilterPoolObjSaveDef(driver, pool, def) < 0) { virNWFilterPoolObjRemove(&driver->pools, pool); def = NULL; goto cleanup; @@ -333,19 +333,19 @@ nwfilterUndefine(virNWFilterPtr obj) { nwfilterDriverLock(driver); pool = virNWFilterPoolObjFindByUUID(&driver->pools, obj->uuid); if (!pool) { - virNWFilterReportError(obj->conn, VIR_ERR_INVALID_NWFILTER, - "%s", _("no nwfilter pool with matching uuid")); + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, + "%s", _("no nwfilter pool with matching uuid")); goto cleanup; } if (virNWFilterTestUnassignDef(obj->conn, pool)) { - virNWFilterReportError(obj->conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("nwfilter is in use")); goto cleanup; } - if (virNWFilterPoolObjDeleteDef(obj->conn, pool) < 0) + if (virNWFilterPoolObjDeleteDef(pool) < 0) goto cleanup; VIR_FREE(pool->configFile); @@ -374,12 +374,12 @@ nwfilterDumpXML(virNWFilterPtr obj, nwfilterDriverUnlock(driver); if (!pool) { - virNWFilterReportError(obj->conn, VIR_ERR_INVALID_NWFILTER, - "%s", _("no nwfilter pool with matching uuid")); + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, + "%s", _("no nwfilter pool with matching uuid")); goto cleanup; } - ret = virNWFilterDefFormat(obj->conn, pool->def); + ret = virNWFilterDefFormat(pool->def); cleanup: if (pool) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -106,8 +106,7 @@ static const char *supported_protocols[] static int -printVar(virConnectPtr conn, - virNWFilterHashTablePtr vars, +printVar(virNWFilterHashTablePtr vars, char *buf, int bufsize, nwItemDescPtr item, int *done) @@ -117,14 +116,14 @@ printVar(virConnectPtr conn, if ((item->flags & NWFILTER_ENTRY_ITEM_FLAG_HAS_VAR)) { char *val = (char *)virHashLookup(vars->hashTable, item->var); if (!val) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("cannot find value for '%s'"), item->var); return 1; } if (!virStrcpy(buf, val, bufsize)) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("Buffer to small to print MAC address " "'%s' into"), item->var); @@ -138,8 +137,7 @@ printVar(virConnectPtr conn, static int -_printDataType(virConnectPtr conn, - virNWFilterHashTablePtr vars, +_printDataType(virNWFilterHashTablePtr vars, char *buf, int bufsize, nwItemDescPtr item, bool asHex) @@ -147,7 +145,7 @@ _printDataType(virConnectPtr conn, int done; char *data; - if (printVar(conn, vars, buf, bufsize, item, &done)) + if (printVar(vars, buf, bufsize, item, &done)) return 1; if (done) @@ -157,13 +155,13 @@ _printDataType(virConnectPtr conn, case DATATYPE_IPADDR: data = virSocketFormatAddr(&item->u.ipaddr.addr); if (!data) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("internal IPv4 address representation " "is bad")); return 1; } if (snprintf(buf, bufsize, "%s", data) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("buffer too small for IP address")); VIR_FREE(data); return 1; @@ -174,14 +172,14 @@ _printDataType(virConnectPtr conn, case DATATYPE_IPV6ADDR: data = virSocketFormatAddr(&item->u.ipaddr.addr); if (!data) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("internal IPv6 address representation " "is bad")); return 1; } if (snprintf(buf, bufsize, "%s", data) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("buffer too small for IPv6 address")); VIR_FREE(data); return 1; @@ -192,7 +190,7 @@ _printDataType(virConnectPtr conn, case DATATYPE_MACADDR: case DATATYPE_MACMASK: if (bufsize < VIR_MAC_STRING_BUFLEN) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for MAC address")); return 1; } @@ -204,7 +202,7 @@ _printDataType(virConnectPtr conn, case DATATYPE_IPMASK: if (snprintf(buf, bufsize, "%d", item->u.u8) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("Buffer too small for uint8 type")); return 1; } @@ -213,7 +211,7 @@ _printDataType(virConnectPtr conn, case DATATYPE_UINT16: if (snprintf(buf, bufsize, asHex ? "0x%x" : "%d", item->u.u16) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for uint16 type")); return 1; } @@ -222,14 +220,14 @@ _printDataType(virConnectPtr conn, case DATATYPE_UINT8: if (snprintf(buf, bufsize, asHex ? "0x%x" : "%d", item->u.u8) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for uint8 type")); return 1; } break; default: - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("Unhandled datatype %x"), item->datatype); return 1; break; @@ -240,22 +238,20 @@ _printDataType(virConnectPtr conn, static int -printDataType(virConnectPtr conn, - virNWFilterHashTablePtr vars, +printDataType(virNWFilterHashTablePtr vars, char *buf, int bufsize, nwItemDescPtr item) { - return _printDataType(conn, vars, buf, bufsize, item, 0); + return _printDataType(vars, buf, bufsize, item, 0); } static int -printDataTypeAsHex(virConnectPtr conn, - virNWFilterHashTablePtr vars, +printDataTypeAsHex(virNWFilterHashTablePtr vars, char *buf, int bufsize, nwItemDescPtr item) { - return _printDataType(conn, vars, buf, bufsize, item, 1); + return _printDataType(vars, buf, bufsize, item, 1); } @@ -271,8 +267,7 @@ ebiptablesRuleInstFree(ebiptablesRuleIns static int -ebiptablesAddRuleInst(virConnectPtr conn, - virNWFilterRuleInstPtr res, +ebiptablesAddRuleInst(virNWFilterRuleInstPtr res, char *commandTemplate, enum virNWFilterChainSuffixType neededChain, char chainprefix, @@ -292,21 +287,19 @@ ebiptablesAddRuleInst(virConnectPtr conn inst->priority = priority; inst->ruleType = ruleType; - return virNWFilterRuleInstAddData(conn, res, inst); + return virNWFilterRuleInstAddData(res, inst); } static int -ebtablesHandleEthHdr(virConnectPtr conn, - virBufferPtr buf, +ebtablesHandleEthHdr(virBufferPtr buf, virNWFilterHashTablePtr vars, ethHdrDataDefPtr ethHdr) { char macaddr[VIR_MAC_STRING_BUFLEN]; if (HAS_ENTRY_ITEM(&ethHdr->dataSrcMACAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &ethHdr->dataSrcMACAddr)) goto err_exit; @@ -317,8 +310,7 @@ ebtablesHandleEthHdr(virConnectPtr conn, macaddr); if (HAS_ENTRY_ITEM(&ethHdr->dataSrcMACMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &ethHdr->dataSrcMACMask)) goto err_exit; @@ -330,8 +322,7 @@ ebtablesHandleEthHdr(virConnectPtr conn, } if (HAS_ENTRY_ITEM(&ethHdr->dataDstMACAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &ethHdr->dataDstMACAddr)) goto err_exit; @@ -342,8 +333,7 @@ ebtablesHandleEthHdr(virConnectPtr conn, macaddr); if (HAS_ENTRY_ITEM(&ethHdr->dataDstMACMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &ethHdr->dataDstMACMask)) goto err_exit; @@ -365,8 +355,7 @@ ebtablesHandleEthHdr(virConnectPtr conn, /************************ iptables support ************************/ -static int iptablesLinkIPTablesBaseChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +static int iptablesLinkIPTablesBaseChain(const char *iptables_cmd, virBufferPtr buf, const char *udchain, const char *syschain, @@ -407,8 +396,7 @@ static int iptablesLinkIPTablesBaseChain } -static int iptablesCreateBaseChains(virConnectPtr conn, - const char *iptables_cmd, +static int iptablesCreateBaseChains(const char *iptables_cmd, virBufferPtr buf) { virBufferVSprintf(buf,"%s -N " VIRT_IN_CHAIN CMD_SEPARATOR @@ -419,13 +407,13 @@ static int iptablesCreateBaseChains(virC iptables_cmd, iptables_cmd, iptables_cmd); - iptablesLinkIPTablesBaseChain(conn, iptables_cmd, buf, + iptablesLinkIPTablesBaseChain(iptables_cmd, buf, VIRT_IN_CHAIN , "FORWARD", 1, 1); - iptablesLinkIPTablesBaseChain(conn, iptables_cmd, buf, + iptablesLinkIPTablesBaseChain(iptables_cmd, buf, VIRT_OUT_CHAIN , "FORWARD", 2, 1); - iptablesLinkIPTablesBaseChain(conn, iptables_cmd, buf, + iptablesLinkIPTablesBaseChain(iptables_cmd, buf, VIRT_IN_POST_CHAIN, "FORWARD", 3, 1); - iptablesLinkIPTablesBaseChain(conn, iptables_cmd, buf, + iptablesLinkIPTablesBaseChain(iptables_cmd, buf, HOST_IN_CHAIN , "INPUT" , 1, 1); return 0; @@ -433,8 +421,7 @@ static int iptablesCreateBaseChains(virC static int -iptablesCreateTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesCreateTmpRootChain(const char *iptables_cmd, virBufferPtr buf, char prefix, int incoming, const char *ifname, @@ -462,21 +449,19 @@ iptablesCreateTmpRootChain(virConnectPtr static int -iptablesCreateTmpRootChains(virConnectPtr conn, - const char *iptables_cmd, +iptablesCreateTmpRootChains(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { - iptablesCreateTmpRootChain(conn, iptables_cmd, buf, 'F', 0, ifname, 1); - iptablesCreateTmpRootChain(conn, iptables_cmd, buf, 'F', 1, ifname, 1); - iptablesCreateTmpRootChain(conn, iptables_cmd, buf, 'H', 1, ifname, 1); + iptablesCreateTmpRootChain(iptables_cmd, buf, 'F', 0, ifname, 1); + iptablesCreateTmpRootChain(iptables_cmd, buf, 'F', 1, ifname, 1); + iptablesCreateTmpRootChain(iptables_cmd, buf, 'H', 1, ifname, 1); return 0; } static int -_iptablesRemoveRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +_iptablesRemoveRootChain(const char *iptables_cmd, virBufferPtr buf, char prefix, int incoming, const char *ifname, @@ -507,60 +492,55 @@ _iptablesRemoveRootChain(virConnectPtr c static int -iptablesRemoveRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesRemoveRootChain(const char *iptables_cmd, virBufferPtr buf, char prefix, int incoming, const char *ifname) { - return _iptablesRemoveRootChain(conn, iptables_cmd, + return _iptablesRemoveRootChain(iptables_cmd, buf, prefix, incoming, ifname, 0); } static int -iptablesRemoveTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesRemoveTmpRootChain(const char *iptables_cmd, virBufferPtr buf, char prefix, int incoming, const char *ifname) { - return _iptablesRemoveRootChain(conn, iptables_cmd, buf, prefix, + return _iptablesRemoveRootChain(iptables_cmd, buf, prefix, incoming, ifname, 1); } static int -iptablesRemoveTmpRootChains(virConnectPtr conn, - const char *iptables_cmd, +iptablesRemoveTmpRootChains(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { - iptablesRemoveTmpRootChain(conn, iptables_cmd, buf, 'F', 0, ifname); - iptablesRemoveTmpRootChain(conn, iptables_cmd, buf, 'F', 1, ifname); - iptablesRemoveTmpRootChain(conn, iptables_cmd, buf, 'H', 1, ifname); + iptablesRemoveTmpRootChain(iptables_cmd, buf, 'F', 0, ifname); + iptablesRemoveTmpRootChain(iptables_cmd, buf, 'F', 1, ifname); + iptablesRemoveTmpRootChain(iptables_cmd, buf, 'H', 1, ifname); return 0; } static int -iptablesRemoveRootChains(virConnectPtr conn, - const char *iptables_cmd, +iptablesRemoveRootChains(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { - iptablesRemoveRootChain(conn, iptables_cmd, buf, 'F', 0, ifname); - iptablesRemoveRootChain(conn, iptables_cmd, buf, 'F', 1, ifname); - iptablesRemoveRootChain(conn, iptables_cmd, buf, 'H', 1, ifname); + iptablesRemoveRootChain(iptables_cmd, buf, 'F', 0, ifname); + iptablesRemoveRootChain(iptables_cmd, buf, 'F', 1, ifname); + iptablesRemoveRootChain(iptables_cmd, buf, 'H', 1, ifname); return 0; } static int -iptablesLinkTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesLinkTmpRootChain(const char *iptables_cmd, virBufferPtr buf, const char *basechain, char prefix, @@ -594,22 +574,20 @@ iptablesLinkTmpRootChain(virConnectPtr c static int -iptablesLinkTmpRootChains(virConnectPtr conn, - const char *cmd, +iptablesLinkTmpRootChains(const char *cmd, virBufferPtr buf, const char *ifname) { - iptablesLinkTmpRootChain(conn, cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname, 1); - iptablesLinkTmpRootChain(conn, cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname, 1); - iptablesLinkTmpRootChain(conn, cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname, 1); + iptablesLinkTmpRootChain(cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname, 1); + iptablesLinkTmpRootChain(cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname, 1); + iptablesLinkTmpRootChain(cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname, 1); return 0; } static int -iptablesSetupVirtInPost(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesSetupVirtInPost(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { @@ -634,8 +612,7 @@ iptablesSetupVirtInPost(virConnectPtr co static int -iptablesClearVirtInPost(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesClearVirtInPost(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { @@ -649,13 +626,12 @@ iptablesClearVirtInPost(virConnectPtr co } static int -_iptablesUnlinkRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, - virBufferPtr buf, - const char *basechain, - char prefix, - int incoming, const char *ifname, - int isTempChain) +_iptablesUnlinkRootChain(const char *iptables_cmd, + virBufferPtr buf, + const char *basechain, + char prefix, + int incoming, const char *ifname, + int isTempChain) { char chain[MAX_CHAINNAME_LENGTH]; char chainPrefix[2] = { @@ -684,61 +660,56 @@ _iptablesUnlinkRootChain(virConnectPtr c static int -iptablesUnlinkRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesUnlinkRootChain(const char *iptables_cmd, virBufferPtr buf, const char *basechain, char prefix, int incoming, const char *ifname) { - return _iptablesUnlinkRootChain(conn, iptables_cmd, buf, + return _iptablesUnlinkRootChain(iptables_cmd, buf, basechain, prefix, incoming, ifname, 0); } static int -iptablesUnlinkTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesUnlinkTmpRootChain(const char *iptables_cmd, virBufferPtr buf, const char *basechain, char prefix, int incoming, const char *ifname) { - return _iptablesUnlinkRootChain(conn, iptables_cmd, buf, + return _iptablesUnlinkRootChain(iptables_cmd, buf, basechain, prefix, incoming, ifname, 1); } static int -iptablesUnlinkRootChains(virConnectPtr conn, - const char *cmd, +iptablesUnlinkRootChains(const char *cmd, virBufferPtr buf, const char *ifname) { - iptablesUnlinkRootChain(conn, cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname); - iptablesUnlinkRootChain(conn, cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname); - iptablesUnlinkRootChain(conn, cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname); + iptablesUnlinkRootChain(cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname); + iptablesUnlinkRootChain(cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname); + iptablesUnlinkRootChain(cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname); return 0; } static int -iptablesUnlinkTmpRootChains(virConnectPtr conn, - const char *cmd, +iptablesUnlinkTmpRootChains(const char *cmd, virBufferPtr buf, const char *ifname) { - iptablesUnlinkTmpRootChain(conn, cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname); - iptablesUnlinkTmpRootChain(conn, cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname); - iptablesUnlinkTmpRootChain(conn, cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname); + iptablesUnlinkTmpRootChain(cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname); + iptablesUnlinkTmpRootChain(cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname); + iptablesUnlinkTmpRootChain(cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname); return 0; } static int -iptablesRenameTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesRenameTmpRootChain(const char *iptables_cmd, virBufferPtr buf, char prefix, int incoming, @@ -769,21 +740,19 @@ iptablesRenameTmpRootChain(virConnectPtr static int -iptablesRenameTmpRootChains(virConnectPtr conn, - const char *iptables_cmd, +iptablesRenameTmpRootChains(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { - iptablesRenameTmpRootChain(conn, iptables_cmd, buf, 'F', 0, ifname); - iptablesRenameTmpRootChain(conn, iptables_cmd, buf, 'F', 1, ifname); - iptablesRenameTmpRootChain(conn, iptables_cmd, buf, 'H', 1, ifname); + iptablesRenameTmpRootChain(iptables_cmd, buf, 'F', 0, ifname); + iptablesRenameTmpRootChain(iptables_cmd, buf, 'F', 1, ifname); + iptablesRenameTmpRootChain(iptables_cmd, buf, 'H', 1, ifname); return 0; } static void -iptablesInstCommand(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +iptablesInstCommand(virBufferPtr buf, const char *templ, char cmd, int pos, int stopOnError) { @@ -797,8 +766,7 @@ iptablesInstCommand(virConnectPtr conn A static int -iptablesHandleSrcMacAddr(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterHashTablePtr vars, nwItemDescPtr srcMacAddr, int directionIn ATTRIBUTE_UNUSED) @@ -806,8 +774,7 @@ iptablesHandleSrcMacAddr(virConnectPtr c char macaddr[VIR_MAC_STRING_BUFLEN]; if (HAS_ENTRY_ITEM(srcMacAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr)) goto err_exit; @@ -828,8 +795,7 @@ err_exit: static int -iptablesHandleIpHdr(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +iptablesHandleIpHdr(virBufferPtr buf, virNWFilterHashTablePtr vars, ipHdrDataDefPtr ipHdr, int directionIn) @@ -849,8 +815,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataSrcIPAddr)) goto err_exit; @@ -863,8 +828,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &ipHdr->dataSrcIPMask)) goto err_exit; @@ -875,8 +839,7 @@ iptablesHandleIpHdr(virConnectPtr conn A } } else if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPFrom)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataSrcIPFrom)) goto err_exit; @@ -889,8 +852,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPTo)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataSrcIPTo)) goto err_exit; @@ -903,8 +865,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataDstIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataDstIPAddr)) goto err_exit; @@ -917,8 +878,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataDstIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &ipHdr->dataDstIPMask)) goto err_exit; @@ -930,8 +890,7 @@ iptablesHandleIpHdr(virConnectPtr conn A } } else if (HAS_ENTRY_ITEM(&ipHdr->dataDstIPFrom)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataDstIPFrom)) goto err_exit; @@ -944,8 +903,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataDstIPTo)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataDstIPTo)) goto err_exit; @@ -958,8 +916,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataDSCP)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &ipHdr->dataDSCP)) goto err_exit; @@ -980,8 +937,7 @@ err_exit: static int -iptablesHandlePortData(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +iptablesHandlePortData(virBufferPtr buf, virNWFilterHashTablePtr vars, portDataDefPtr portData, int directionIn) @@ -995,8 +951,7 @@ iptablesHandlePortData(virConnectPtr con } if (HAS_ENTRY_ITEM(&portData->dataSrcPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, portstr, sizeof(portstr), &portData->dataSrcPortStart)) goto err_exit; @@ -1008,8 +963,7 @@ iptablesHandlePortData(virConnectPtr con portstr); if (HAS_ENTRY_ITEM(&portData->dataSrcPortEnd)) { - if (printDataType(conn, - vars, + if (printDataType(vars, portstr, sizeof(portstr), &portData->dataSrcPortEnd)) goto err_exit; @@ -1021,8 +975,7 @@ iptablesHandlePortData(virConnectPtr con } if (HAS_ENTRY_ITEM(&portData->dataDstPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, portstr, sizeof(portstr), &portData->dataDstPortStart)) goto err_exit; @@ -1034,8 +987,7 @@ iptablesHandlePortData(virConnectPtr con portstr); if (HAS_ENTRY_ITEM(&portData->dataDstPortEnd)) { - if (printDataType(conn, - vars, + if (printDataType(vars, portstr, sizeof(portstr), &portData->dataDstPortEnd)) goto err_exit; @@ -1054,7 +1006,6 @@ err_exit: /* * _iptablesCreateRuleInstance: - * @conn : Pointer to a virConnect object * @chainPrefix : The prefix to put in front of the name of the chain * @nwfilter : The filter * @rule: The rule of the filter to convert @@ -1069,8 +1020,7 @@ err_exit: * virConnect object. */ static int -_iptablesCreateRuleInstance(virConnectPtr conn, - int directionIn, +_iptablesCreateRuleInstance(int directionIn, const char *chainPrefix, virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, @@ -1099,30 +1049,26 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p tcp"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.tcpHdrFilter.ipHdr, directionIn)) goto err_exit; - if (iptablesHandlePortData(conn, - &buf, + if (iptablesHandlePortData(&buf, vars, &rule->p.tcpHdrFilter.portData, directionIn)) goto err_exit; if (HAS_ENTRY_ITEM(&rule->p.tcpHdrFilter.dataTCPOption)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.tcpHdrFilter.dataTCPOption)) goto err_exit; @@ -1144,22 +1090,19 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p udp"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.udpHdrFilter.ipHdr, directionIn)) goto err_exit; - if (iptablesHandlePortData(conn, - &buf, + if (iptablesHandlePortData(&buf, vars, &rule->p.udpHdrFilter.portData, directionIn)) @@ -1175,15 +1118,13 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p udplite"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.udpliteHdrFilter.ipHdr, directionIn)) @@ -1200,15 +1141,13 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p esp"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.espHdrFilter.ipHdr, directionIn)) @@ -1225,15 +1164,13 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p ah"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.ahHdrFilter.ipHdr, directionIn)) @@ -1250,22 +1187,19 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p sctp"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.sctpHdrFilter.ipHdr, directionIn)) goto err_exit; - if (iptablesHandlePortData(conn, - &buf, + if (iptablesHandlePortData(&buf, vars, &rule->p.sctpHdrFilter.portData, directionIn)) @@ -1284,15 +1218,13 @@ _iptablesCreateRuleInstance(virConnectPt else virBufferAddLit(&buf, " -p icmpv6"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.icmpHdrFilter.ipHdr, directionIn)) @@ -1305,8 +1237,7 @@ _iptablesCreateRuleInstance(virConnectPt else parm = "--icmpv6-type"; - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.icmpHdrFilter.dataICMPType)) goto err_exit; @@ -1318,8 +1249,7 @@ _iptablesCreateRuleInstance(virConnectPt number); if (HAS_ENTRY_ITEM(&rule->p.icmpHdrFilter.dataICMPCode)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.icmpHdrFilter.dataICMPCode)) goto err_exit; @@ -1339,15 +1269,13 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p igmp"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.igmpHdrFilter.ipHdr, directionIn)) @@ -1364,15 +1292,13 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p all"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.allHdrFilter.ipHdr, directionIn)) @@ -1403,8 +1329,7 @@ _iptablesCreateRuleInstance(virConnectPt return -1; } - return ebiptablesAddRuleInst(conn, - res, + return ebiptablesAddRuleInst(res, virBufferContentAndReset(&buf), nwfilter->chainsuffix, '\0', @@ -1421,8 +1346,7 @@ err_exit: static int -iptablesCreateRuleInstance(virConnectPtr conn, - virNWFilterDefPtr nwfilter, +iptablesCreateRuleInstance(virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, const char *ifname, virNWFilterHashTablePtr vars, @@ -1443,8 +1367,7 @@ iptablesCreateRuleInstance(virConnectPtr chainPrefix[0] = 'F'; chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; - rc = _iptablesCreateRuleInstance(conn, - directionIn, + rc = _iptablesCreateRuleInstance(directionIn, chainPrefix, nwfilter, rule, @@ -1459,8 +1382,7 @@ iptablesCreateRuleInstance(virConnectPtr return rc; chainPrefix[1] = CHAINPREFIX_HOST_OUT_TEMP; - rc = _iptablesCreateRuleInstance(conn, - !directionIn, + rc = _iptablesCreateRuleInstance(!directionIn, chainPrefix, nwfilter, rule, @@ -1476,8 +1398,7 @@ iptablesCreateRuleInstance(virConnectPtr chainPrefix[0] = 'H'; chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; - rc = _iptablesCreateRuleInstance(conn, - directionIn, + rc = _iptablesCreateRuleInstance(directionIn, chainPrefix, nwfilter, rule, @@ -1498,7 +1419,6 @@ iptablesCreateRuleInstance(virConnectPtr /* * ebtablesCreateRuleInstance: - * @conn : Pointer to a virConnect object * @chainPrefix : The prefix to put in front of the name of the chain * @nwfilter : The filter * @rule: The rule of the filter to convert @@ -1513,8 +1433,7 @@ iptablesCreateRuleInstance(virConnectPtr * virConnect object. */ static int -ebtablesCreateRuleInstance(virConnectPtr conn, - char chainPrefix, +ebtablesCreateRuleInstance(char chainPrefix, virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, const char *ifname, @@ -1543,15 +1462,13 @@ ebtablesCreateRuleInstance(virConnectPtr EBTABLES_DEFAULT_TABLE, chain); - if (ebtablesHandleEthHdr(conn, - &buf, + if (ebtablesHandleEthHdr(&buf, vars, &rule->p.ethHdrFilter.ethHdr)) goto err_exit; if (HAS_ENTRY_ITEM(&rule->p.ethHdrFilter.dataProtocolID)) { - if (printDataTypeAsHex(conn, - vars, + if (printDataTypeAsHex(vars, number, sizeof(number), &rule->p.ethHdrFilter.dataProtocolID)) goto err_exit; @@ -1568,8 +1485,7 @@ ebtablesCreateRuleInstance(virConnectPtr CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", EBTABLES_DEFAULT_TABLE, chain); - if (ebtablesHandleEthHdr(conn, - &buf, + if (ebtablesHandleEthHdr(&buf, vars, &rule->p.arpHdrFilter.ethHdr)) goto err_exit; @@ -1577,10 +1493,9 @@ ebtablesCreateRuleInstance(virConnectPtr virBufferAddLit(&buf, " -p arp"); if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataHWType)) { - if (printDataType(conn, - vars, - number, sizeof(number), - &rule->p.arpHdrFilter.dataHWType)) + if (printDataType(vars, + number, sizeof(number), + &rule->p.arpHdrFilter.dataHWType)) goto err_exit; virBufferVSprintf(&buf, " --arp-htype %s %s", @@ -1589,8 +1504,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataOpcode)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.arpHdrFilter.dataOpcode)) goto err_exit; @@ -1601,8 +1515,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataProtocolType)) { - if (printDataTypeAsHex(conn, - vars, + if (printDataTypeAsHex(vars, number, sizeof(number), &rule->p.arpHdrFilter.dataProtocolType)) goto err_exit; @@ -1613,8 +1526,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPSrcIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &rule->p.arpHdrFilter.dataARPSrcIPAddr)) goto err_exit; @@ -1626,8 +1538,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPDstIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &rule->p.arpHdrFilter.dataARPDstIPAddr)) goto err_exit; @@ -1639,8 +1550,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPSrcMACAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &rule->p.arpHdrFilter.dataARPSrcMACAddr)) goto err_exit; @@ -1652,8 +1562,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPDstMACAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &rule->p.arpHdrFilter.dataARPDstMACAddr)) goto err_exit; @@ -1670,8 +1579,7 @@ ebtablesCreateRuleInstance(virConnectPtr CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", EBTABLES_DEFAULT_TABLE, chain); - if (ebtablesHandleEthHdr(conn, - &buf, + if (ebtablesHandleEthHdr(&buf, vars, &rule->p.ipHdrFilter.ethHdr)) goto err_exit; @@ -1680,8 +1588,7 @@ ebtablesCreateRuleInstance(virConnectPtr " -p ipv4"); if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataSrcIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &rule->p.ipHdrFilter.ipHdr.dataSrcIPAddr)) goto err_exit; @@ -1692,8 +1599,7 @@ ebtablesCreateRuleInstance(virConnectPtr ipaddr); if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataSrcIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.ipHdr.dataSrcIPMask)) goto err_exit; @@ -1705,8 +1611,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataDstIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &rule->p.ipHdrFilter.ipHdr.dataDstIPAddr)) goto err_exit; @@ -1717,8 +1622,7 @@ ebtablesCreateRuleInstance(virConnectPtr ipaddr); if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataDstIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.ipHdr.dataDstIPMask)) goto err_exit; @@ -1729,8 +1633,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataProtocolID)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.ipHdr.dataProtocolID)) goto err_exit; @@ -1743,8 +1646,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.portData.dataSrcPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.portData.dataSrcPortStart)) goto err_exit; @@ -1755,8 +1657,7 @@ ebtablesCreateRuleInstance(virConnectPtr number); if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.portData.dataSrcPortEnd)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.portData.dataSrcPortEnd)) goto err_exit; @@ -1769,8 +1670,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.portData.dataDstPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.portData.dataDstPortStart)) goto err_exit; @@ -1781,8 +1681,7 @@ ebtablesCreateRuleInstance(virConnectPtr number); if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.portData.dataDstPortEnd)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.portData.dataDstPortEnd)) goto err_exit; @@ -1794,8 +1693,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataDSCP)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.ipHdr.dataDSCP)) goto err_exit; @@ -1812,8 +1710,7 @@ ebtablesCreateRuleInstance(virConnectPtr CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", EBTABLES_DEFAULT_TABLE, chain); - if (ebtablesHandleEthHdr(conn, - &buf, + if (ebtablesHandleEthHdr(&buf, vars, &rule->p.ipv6HdrFilter.ethHdr)) goto err_exit; @@ -1822,8 +1719,7 @@ ebtablesCreateRuleInstance(virConnectPtr " -p ipv6"); if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.ipHdr.dataSrcIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipv6addr, sizeof(ipv6addr), &rule->p.ipv6HdrFilter.ipHdr.dataSrcIPAddr)) goto err_exit; @@ -1834,8 +1730,7 @@ ebtablesCreateRuleInstance(virConnectPtr ipv6addr); if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.ipHdr.dataSrcIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.ipHdr.dataSrcIPMask)) goto err_exit; @@ -1847,8 +1742,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.ipHdr.dataDstIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipv6addr, sizeof(ipv6addr), &rule->p.ipv6HdrFilter.ipHdr.dataDstIPAddr)) goto err_exit; @@ -1859,8 +1753,7 @@ ebtablesCreateRuleInstance(virConnectPtr ipv6addr); if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.ipHdr.dataDstIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.ipHdr.dataDstIPMask)) goto err_exit; @@ -1871,8 +1764,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.ipHdr.dataProtocolID)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.ipHdr.dataProtocolID)) goto err_exit; @@ -1885,8 +1777,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.portData.dataSrcPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.portData.dataSrcPortStart)) goto err_exit; @@ -1897,8 +1788,7 @@ ebtablesCreateRuleInstance(virConnectPtr number); if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.portData.dataSrcPortEnd)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.portData.dataSrcPortEnd)) goto err_exit; @@ -1911,8 +1801,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.portData.dataDstPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.portData.dataDstPortStart)) goto err_exit; @@ -1923,10 +1812,9 @@ ebtablesCreateRuleInstance(virConnectPtr number); if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.portData.dataDstPortEnd)) { - if (printDataType(conn, - vars, - number, sizeof(number), - &rule->p.ipv6HdrFilter.portData.dataDstPortEnd)) + if (printDataType(vars, + number, sizeof(number), + &rule->p.ipv6HdrFilter.portData.dataDstPortEnd)) goto err_exit; virBufferVSprintf(&buf, @@ -1957,8 +1845,7 @@ ebtablesCreateRuleInstance(virConnectPtr return -1; } - return ebiptablesAddRuleInst(conn, - res, + return ebiptablesAddRuleInst(res, virBufferContentAndReset(&buf), nwfilter->chainsuffix, chainPrefix, @@ -1988,7 +1875,7 @@ err_exit: * virConnect object. */ static int -ebiptablesCreateRuleInstance(virConnectPtr conn, +ebiptablesCreateRuleInstance(virConnectPtr conn ATTRIBUTE_UNUSED, enum virDomainNetType nettype, virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, @@ -2008,8 +1895,7 @@ ebiptablesCreateRuleInstance(virConnectP if (rule->tt == VIR_NWFILTER_RULE_DIRECTION_OUT || rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT) { - rc = ebtablesCreateRuleInstance(conn, - CHAINPREFIX_HOST_IN_TEMP, + rc = ebtablesCreateRuleInstance(CHAINPREFIX_HOST_IN_TEMP, nwfilter, rule, ifname, @@ -2021,8 +1907,7 @@ ebiptablesCreateRuleInstance(virConnectP if (rule->tt == VIR_NWFILTER_RULE_DIRECTION_IN || rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT) { - rc = ebtablesCreateRuleInstance(conn, - CHAINPREFIX_HOST_OUT_TEMP, + rc = ebtablesCreateRuleInstance(CHAINPREFIX_HOST_OUT_TEMP, nwfilter, rule, ifname, @@ -2041,15 +1926,14 @@ ebiptablesCreateRuleInstance(virConnectP case VIR_NWFILTER_RULE_PROTOCOL_IGMP: case VIR_NWFILTER_RULE_PROTOCOL_ALL: if (nettype == VIR_DOMAIN_NET_TYPE_DIRECT) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("'%s' protocol not support for net type '%s'"), virNWFilterRuleProtocolTypeToString(rule->prtclType), virDomainNetTypeToString(nettype)); return 1; } isIPv6 = 0; - rc = iptablesCreateRuleInstance(conn, - nwfilter, + rc = iptablesCreateRuleInstance(nwfilter, rule, ifname, vars, @@ -2066,15 +1950,14 @@ ebiptablesCreateRuleInstance(virConnectP case VIR_NWFILTER_RULE_PROTOCOL_ICMPV6: case VIR_NWFILTER_RULE_PROTOCOL_ALLoIPV6: if (nettype == VIR_DOMAIN_NET_TYPE_DIRECT) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("'%s' protocol not support for net type '%s'"), virNWFilterRuleProtocolTypeToString(rule->prtclType), virDomainNetTypeToString(nettype)); return 1; } isIPv6 = 1; - rc = iptablesCreateRuleInstance(conn, - nwfilter, + rc = iptablesCreateRuleInstance(nwfilter, rule, ifname, vars, @@ -2083,7 +1966,7 @@ ebiptablesCreateRuleInstance(virConnectP break; case VIR_NWFILTER_RULE_PROTOCOL_LAST: - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("illegal protocol type")); rc = 1; break; @@ -2115,7 +1998,6 @@ ebiptablesDisplayRuleInstance(virConnect /** * ebiptablesWriteToTempFile: - * @conn: pointer to virConnect object * @string : the string to write into the file * * Returns the tempory filename where the string was written into, @@ -2128,8 +2010,7 @@ ebiptablesDisplayRuleInstance(virConnect * set so that the file can be run as an executable script. */ static char * -ebiptablesWriteToTempFile(virConnectPtr conn, - const char *string) { +ebiptablesWriteToTempFile(const char *string) { char filename[] = "/tmp/virtdXXXXXX"; int len; char *filnam; @@ -2139,14 +2020,14 @@ ebiptablesWriteToTempFile(virConnectPtr int fd = mkstemp(filename); if (fd < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot create temporary file")); return NULL; } if (fchmod(fd, S_IXUSR| S_IRUSR | S_IWUSR) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot change permissions on temp. file")); goto err_exit; @@ -2155,7 +2036,7 @@ ebiptablesWriteToTempFile(virConnectPtr len = strlen(header); written = safewrite(fd, header, len); if (written != len) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot write string to file")); goto err_exit; @@ -2164,7 +2045,7 @@ ebiptablesWriteToTempFile(virConnectPtr len = strlen(string); written = safewrite(fd, string, len); if (written != len) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot write string to file")); goto err_exit; @@ -2188,7 +2069,6 @@ err_exit: /** * ebiptablesExecCLI: - * @conn : pointer to virConnect object * @buf : pointer to virBuffer containing the string with the commands to * execute. * @status: Pointer to an integer for returning the status of the @@ -2202,8 +2082,7 @@ err_exit: * script and return the status of the execution. */ static int -ebiptablesExecCLI(virConnectPtr conn, - virBufferPtr buf, +ebiptablesExecCLI(virBufferPtr buf, int *status) { char *cmds; @@ -2226,7 +2105,7 @@ ebiptablesExecCLI(virConnectPtr conn, if (!cmds) return 0; - filename = ebiptablesWriteToTempFile(conn, cmds); + filename = ebiptablesWriteToTempFile(cmds); VIR_FREE(cmds); if (!filename) @@ -2248,8 +2127,7 @@ ebiptablesExecCLI(virConnectPtr conn, static int -ebtablesCreateTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +ebtablesCreateTmpRootChain(virBufferPtr buf, int incoming, const char *ifname, int stopOnError) { @@ -2271,8 +2149,7 @@ ebtablesCreateTmpRootChain(virConnectPtr static int -ebtablesLinkTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +ebtablesLinkTmpRootChain(virBufferPtr buf, int incoming, const char *ifname, int stopOnError) { @@ -2299,8 +2176,7 @@ ebtablesLinkTmpRootChain(virConnectPtr c static int -_ebtablesRemoveRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +_ebtablesRemoveRootChain(virBufferPtr buf, int incoming, const char *ifname, int isTempChain) { @@ -2326,26 +2202,23 @@ _ebtablesRemoveRootChain(virConnectPtr c static int -ebtablesRemoveRootChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesRemoveRootChain(virBufferPtr buf, int incoming, const char *ifname) { - return _ebtablesRemoveRootChain(conn, buf, incoming, ifname, 0); + return _ebtablesRemoveRootChain(buf, incoming, ifname, 0); } static int -ebtablesRemoveTmpRootChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesRemoveTmpRootChain(virBufferPtr buf, int incoming, const char *ifname) { - return _ebtablesRemoveRootChain(conn, buf, incoming, ifname, 1); + return _ebtablesRemoveRootChain(buf, incoming, ifname, 1); } static int -_ebtablesUnlinkRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +_ebtablesUnlinkRootChain(virBufferPtr buf, int incoming, const char *ifname, int isTempChain) { @@ -2375,26 +2248,23 @@ _ebtablesUnlinkRootChain(virConnectPtr c static int -ebtablesUnlinkRootChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesUnlinkRootChain(virBufferPtr buf, int incoming, const char *ifname) { - return _ebtablesUnlinkRootChain(conn, buf, incoming, ifname, 0); + return _ebtablesUnlinkRootChain(buf, incoming, ifname, 0); } static int -ebtablesUnlinkTmpRootChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesUnlinkTmpRootChain(virBufferPtr buf, int incoming, const char *ifname) { - return _ebtablesUnlinkRootChain(conn, buf, incoming, ifname, 1); + return _ebtablesUnlinkRootChain(buf, incoming, ifname, 1); } static int -ebtablesCreateTmpSubChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +ebtablesCreateTmpSubChain(virBufferPtr buf, int incoming, const char *ifname, const char *protocol, @@ -2430,8 +2300,7 @@ ebtablesCreateTmpSubChain(virConnectPtr static int -_ebtablesRemoveSubChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +_ebtablesRemoveSubChain(virBufferPtr buf, int incoming, const char *ifname, const char *protocol, @@ -2467,26 +2336,24 @@ _ebtablesRemoveSubChain(virConnectPtr co static int -ebtablesRemoveSubChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesRemoveSubChain(virBufferPtr buf, int incoming, const char *ifname, const char *protocol) { - return _ebtablesRemoveSubChain(conn, buf, + return _ebtablesRemoveSubChain(buf, incoming, ifname, protocol, 0); } static int -ebtablesRemoveSubChains(virConnectPtr conn, - virBufferPtr buf, - const char *ifname) +ebtablesRemoveSubChains(virBufferPtr buf, + const char *ifname) { int i; for (i = 0; supported_protocols[i]; i++) { - ebtablesRemoveSubChain(conn, buf, 1, ifname, supported_protocols[i]); - ebtablesRemoveSubChain(conn, buf, 0, ifname, supported_protocols[i]); + ebtablesRemoveSubChain(buf, 1, ifname, supported_protocols[i]); + ebtablesRemoveSubChain(buf, 0, ifname, supported_protocols[i]); } return 0; @@ -2494,27 +2361,25 @@ ebtablesRemoveSubChains(virConnectPtr co static int -ebtablesRemoveTmpSubChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesRemoveTmpSubChain(virBufferPtr buf, int incoming, const char *ifname, const char *protocol) { - return _ebtablesRemoveSubChain(conn, buf, + return _ebtablesRemoveSubChain(buf, incoming, ifname, protocol, 1); } static int -ebtablesRemoveTmpSubChains(virConnectPtr conn, - virBufferPtr buf, +ebtablesRemoveTmpSubChains(virBufferPtr buf, const char *ifname) { int i; for (i = 0; supported_protocols[i]; i++) { - ebtablesRemoveTmpSubChain(conn, buf, 1, ifname, + ebtablesRemoveTmpSubChain(buf, 1, ifname, supported_protocols[i]); - ebtablesRemoveTmpSubChain(conn, buf, 0, ifname, + ebtablesRemoveTmpSubChain(buf, 0, ifname, supported_protocols[i]); } @@ -2523,8 +2388,7 @@ ebtablesRemoveTmpSubChains(virConnectPtr static int -ebtablesRenameTmpSubChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +ebtablesRenameTmpSubChain(virBufferPtr buf, int incoming, const char *ifname, const char *protocol) @@ -2553,15 +2417,14 @@ ebtablesRenameTmpSubChain(virConnectPtr static int -ebtablesRenameTmpSubChains(virConnectPtr conn, - virBufferPtr buf, +ebtablesRenameTmpSubChains(virBufferPtr buf, const char *ifname) { int i; for (i = 0; supported_protocols[i]; i++) { - ebtablesRenameTmpSubChain (conn, buf, 1, ifname, + ebtablesRenameTmpSubChain (buf, 1, ifname, supported_protocols[i]); - ebtablesRenameTmpSubChain (conn, buf, 0, ifname, + ebtablesRenameTmpSubChain (buf, 0, ifname, supported_protocols[i]); } @@ -2570,18 +2433,16 @@ ebtablesRenameTmpSubChains(virConnectPtr static int -ebtablesRenameTmpRootChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesRenameTmpRootChain(virBufferPtr buf, int incoming, const char *ifname) { - return ebtablesRenameTmpSubChain(conn, buf, incoming, ifname, NULL); + return ebtablesRenameTmpSubChain(buf, incoming, ifname, NULL); } static void -ebiptablesInstCommand(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +ebiptablesInstCommand(virBufferPtr buf, const char *templ, char cmd, int pos, int stopOnError) { @@ -2604,7 +2465,7 @@ ebiptablesRuleOrderSort(const void *a, c static int -ebiptablesApplyNewRules(virConnectPtr conn, +ebiptablesApplyNewRules(virConnectPtr conn ATTRIBUTE_UNUSED, const char *ifname, int nruleInstances, void **_inst) @@ -2630,41 +2491,41 @@ ebiptablesApplyNewRules(virConnectPtr co } } - ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); - ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); - ebtablesRemoveTmpSubChains(conn, &buf, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + ebtablesUnlinkTmpRootChain(&buf, 1, ifname); + ebtablesUnlinkTmpRootChain(&buf, 0, ifname); + ebtablesRemoveTmpSubChains(&buf, ifname); + ebtablesRemoveTmpRootChain(&buf, 1, ifname); + ebtablesRemoveTmpRootChain(&buf, 0, ifname); + ebiptablesExecCLI(&buf, &cli_status); if (chains_in != 0) - ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + ebtablesCreateTmpRootChain(&buf, 1, ifname, 1); if (chains_out != 0) - ebtablesCreateTmpRootChain(conn, &buf, 0, ifname, 1); + ebtablesCreateTmpRootChain(&buf, 0, ifname, 1); if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4)) - ebtablesCreateTmpSubChain(conn, &buf, 1, ifname, "ipv4", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, "ipv4", 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4)) - ebtablesCreateTmpSubChain(conn, &buf, 0, ifname, "ipv4", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, "ipv4", 1); if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv6)) - ebtablesCreateTmpSubChain(conn, &buf, 1, ifname, "ipv6", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, "ipv6", 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv6)) - ebtablesCreateTmpSubChain(conn, &buf, 0, ifname, "ipv6", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, "ipv6", 1); // keep arp as last if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP)) - ebtablesCreateTmpSubChain(conn, &buf, 1, ifname, "arp", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, "arp", 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP)) - ebtablesCreateTmpSubChain(conn, &buf, 0, ifname, "arp", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, "arp", 1); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpebchains; for (i = 0; i < nruleInstances; i++) switch (inst[i]->ruleType) { case RT_EBTABLES: - ebiptablesInstCommand(conn, &buf, + ebiptablesInstCommand(&buf, inst[i]->commandTemplate, 'A', -1, 1); break; @@ -2676,68 +2537,68 @@ ebiptablesApplyNewRules(virConnectPtr co break; } - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpebchains; // FIXME: establishment of iptables user define table tree goes here if (haveIptables) { - iptablesUnlinkTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IPTABLES_CMD, &buf, ifname); - iptablesCreateBaseChains(conn, IPTABLES_CMD, &buf); + iptablesCreateBaseChains(IPTABLES_CMD, &buf); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpebchains; - iptablesCreateTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesCreateTmpRootChains(IPTABLES_CMD, &buf, ifname); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; - iptablesLinkTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesSetupVirtInPost(conn, IPTABLES_CMD, &buf, ifname); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + iptablesLinkTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesSetupVirtInPost(IPTABLES_CMD, &buf, ifname); + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; for (i = 0; i < nruleInstances; i++) { if (inst[i]->ruleType == RT_IPTABLES) - iptablesInstCommand(conn, &buf, + iptablesInstCommand(&buf, inst[i]->commandTemplate, 'A', -1, 1); } - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; } if (haveIp6tables) { - iptablesUnlinkTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IP6TABLES_CMD, &buf, ifname); - iptablesCreateBaseChains(conn, IP6TABLES_CMD, &buf); + iptablesCreateBaseChains(IP6TABLES_CMD, &buf); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; - iptablesCreateTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesCreateTmpRootChains(IP6TABLES_CMD, &buf, ifname); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpip6tchains; - iptablesLinkTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesSetupVirtInPost(conn, IP6TABLES_CMD, &buf, ifname); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + iptablesLinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesSetupVirtInPost(IP6TABLES_CMD, &buf, ifname); + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpip6tchains; for (i = 0; i < nruleInstances; i++) { if (inst[i]->ruleType == RT_IP6TABLES) - iptablesInstCommand(conn, &buf, + iptablesInstCommand(&buf, inst[i]->commandTemplate, 'A', -1, 1); } - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpip6tchains; } @@ -2745,39 +2606,39 @@ ebiptablesApplyNewRules(virConnectPtr co // END IPTABLES stuff if (chains_in != 0) - ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + ebtablesLinkTmpRootChain(&buf, 1, ifname, 1); if (chains_out != 0) - ebtablesLinkTmpRootChain(conn, &buf, 0, ifname, 1); + ebtablesLinkTmpRootChain(&buf, 0, ifname, 1); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_ebsubchains_and_unlink; return 0; tear_down_ebsubchains_and_unlink: - ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); - ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesUnlinkTmpRootChain(&buf, 1, ifname); + ebtablesUnlinkTmpRootChain(&buf, 0, ifname); tear_down_tmpip6tchains: if (haveIp6tables) { - iptablesUnlinkTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IP6TABLES_CMD, &buf, ifname); } tear_down_tmpiptchains: if (haveIptables) { - iptablesUnlinkTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IPTABLES_CMD, &buf, ifname); } tear_down_tmpebchains: - ebtablesRemoveTmpSubChains(conn, &buf, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(&buf, ifname); + ebtablesRemoveTmpRootChain(&buf, 1, ifname); + ebtablesRemoveTmpRootChain(&buf, 0, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + ebiptablesExecCLI(&buf, &cli_status); - virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + virNWFilterReportError(VIR_ERR_BUILD_FIREWALL, "%s", _("Some rules could not be created.")); @@ -2786,64 +2647,64 @@ tear_down_tmpebchains: static int -ebiptablesTearNewRules(virConnectPtr conn, +ebiptablesTearNewRules(virConnectPtr conn ATTRIBUTE_UNUSED, const char *ifname) { int cli_status; virBuffer buf = VIR_BUFFER_INITIALIZER; - iptablesUnlinkTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IPTABLES_CMD, &buf, ifname); - iptablesUnlinkTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IP6TABLES_CMD, &buf, ifname); - ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); - ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesUnlinkTmpRootChain(&buf, 1, ifname); + ebtablesUnlinkTmpRootChain(&buf, 0, ifname); - ebtablesRemoveTmpSubChains(conn, &buf, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(&buf, ifname); + ebtablesRemoveTmpRootChain(&buf, 1, ifname); + ebtablesRemoveTmpRootChain(&buf, 0, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + ebiptablesExecCLI(&buf, &cli_status); return 0; } static int -ebiptablesTearOldRules(virConnectPtr conn, +ebiptablesTearOldRules(virConnectPtr conn ATTRIBUTE_UNUSED, const char *ifname) { int cli_status; virBuffer buf = VIR_BUFFER_INITIALIZER; // switch to new iptables user defined chains - iptablesUnlinkRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesUnlinkRootChains(IPTABLES_CMD, &buf, ifname); + iptablesRemoveRootChains(IPTABLES_CMD, &buf, ifname); - iptablesRenameTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + iptablesRenameTmpRootChains(IPTABLES_CMD, &buf, ifname); + ebiptablesExecCLI(&buf, &cli_status); - iptablesUnlinkRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesRemoveRootChains(IP6TABLES_CMD, &buf, ifname); - iptablesRenameTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + iptablesRenameTmpRootChains(IP6TABLES_CMD, &buf, ifname); + ebiptablesExecCLI(&buf, &cli_status); - ebtablesUnlinkRootChain(conn, &buf, 1, ifname); - ebtablesUnlinkRootChain(conn, &buf, 0, ifname); + ebtablesUnlinkRootChain(&buf, 1, ifname); + ebtablesUnlinkRootChain(&buf, 0, ifname); - ebtablesRemoveSubChains(conn, &buf, ifname); + ebtablesRemoveSubChains(&buf, ifname); - ebtablesRemoveRootChain(conn, &buf, 1, ifname); - ebtablesRemoveRootChain(conn, &buf, 0, ifname); + ebtablesRemoveRootChain(&buf, 1, ifname); + ebtablesRemoveRootChain(&buf, 0, ifname); - ebtablesRenameTmpSubChains(conn, &buf, ifname); - ebtablesRenameTmpRootChain(conn, &buf, 1, ifname); - ebtablesRenameTmpRootChain(conn, &buf, 0, ifname); + ebtablesRenameTmpSubChains(&buf, ifname); + ebtablesRenameTmpRootChain(&buf, 1, ifname); + ebtablesRenameTmpRootChain(&buf, 0, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + ebiptablesExecCLI(&buf, &cli_status); return 0; } @@ -2862,7 +2723,7 @@ ebiptablesTearOldRules(virConnectPtr con * commands failed. */ static int -ebiptablesRemoveRules(virConnectPtr conn, +ebiptablesRemoveRules(virConnectPtr conn ATTRIBUTE_UNUSED, const char *ifname ATTRIBUTE_UNUSED, int nruleInstances, void **_inst) @@ -2874,16 +2735,16 @@ ebiptablesRemoveRules(virConnectPtr conn ebiptablesRuleInstPtr *inst = (ebiptablesRuleInstPtr *)_inst; for (i = 0; i < nruleInstances; i++) - ebiptablesInstCommand(conn, &buf, + ebiptablesInstCommand(&buf, inst[i]->commandTemplate, 'D', -1, 0); - if (ebiptablesExecCLI(conn, &buf, &cli_status)) + if (ebiptablesExecCLI(&buf, &cli_status)) goto err_exit; if (cli_status) { - virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + virNWFilterReportError(VIR_ERR_BUILD_FIREWALL, "%s", _("error while executing CLI commands")); rc = 1; @@ -2908,25 +2769,24 @@ ebiptablesAllTeardown(const char *ifname { virBuffer buf = VIR_BUFFER_INITIALIZER; int cli_status; - virConnectPtr conn = NULL; - iptablesUnlinkRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesClearVirtInPost (conn, IPTABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesUnlinkRootChains(IPTABLES_CMD, &buf, ifname); + iptablesClearVirtInPost (IPTABLES_CMD, &buf, ifname); + iptablesRemoveRootChains(IPTABLES_CMD, &buf, ifname); - iptablesUnlinkRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesClearVirtInPost (conn, IP6TABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesClearVirtInPost (IP6TABLES_CMD, &buf, ifname); + iptablesRemoveRootChains(IP6TABLES_CMD, &buf, ifname); - ebtablesUnlinkRootChain(conn, &buf, 1, ifname); - ebtablesUnlinkRootChain(conn, &buf, 0, ifname); + ebtablesUnlinkRootChain(&buf, 1, ifname); + ebtablesUnlinkRootChain(&buf, 0, ifname); - ebtablesRemoveRootChain(conn, &buf, 1, ifname); - ebtablesRemoveRootChain(conn, &buf, 0, ifname); + ebtablesRemoveRootChain(&buf, 1, ifname); + ebtablesRemoveRootChain(&buf, 0, ifname); - ebtablesRemoveSubChains(conn, &buf, ifname); + ebtablesRemoveSubChains(&buf, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + ebiptablesExecCLI(&buf, &cli_status); return 0; } Index: libvirt-acl/src/conf/nwfilter_params.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.c +++ libvirt-acl/src/conf/nwfilter_params.c @@ -153,7 +153,6 @@ virNWFilterHashTableRemoveEntry(virNWFil struct addToTableStruct { virNWFilterHashTablePtr target; int errOccurred; - virConnectPtr conn; }; @@ -174,7 +173,7 @@ addToTable(void *payload, const char *na } if (virNWFilterHashTablePut(atts->target, name, val, 1) != 0) { - virNWFilterReportError(atts->conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Could not put variable '%s' into hashmap"), name); atts->errOccurred = 1; @@ -184,14 +183,12 @@ addToTable(void *payload, const char *na int -virNWFilterHashTablePutAll(virConnectPtr conn, - virNWFilterHashTablePtr src, +virNWFilterHashTablePutAll(virNWFilterHashTablePtr src, virNWFilterHashTablePtr dest) { struct addToTableStruct atts = { .target = dest, .errOccurred = 0, - .conn = conn, }; virHashForEach(src->hashTable, addToTable, &atts); Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -39,7 +39,7 @@ static int testCompareXMLToXMLFiles(cons if (!(dev = virNWFilterDefParseString(NULL, inXmlData))) goto fail; - if (!(actual = virNWFilterDefFormat(NULL, dev))) + if (!(actual = virNWFilterDefFormat(dev))) goto fail; if (STRNEQ(outXmlData, actual)) { Index: libvirt-acl/src/conf/nwfilter_params.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.h +++ libvirt-acl/src/conf/nwfilter_params.h @@ -46,8 +46,7 @@ int virNWFilterHashTablePut(virNWFilterH int freeName); int virNWFilterHashTableRemoveEntry(virNWFilterHashTablePtr table, const char *name); -int virNWFilterHashTablePutAll(virConnectPtr conn, - virNWFilterHashTablePtr src, +int virNWFilterHashTablePutAll(virNWFilterHashTablePtr src, virNWFilterHashTablePtr dest); # define VALID_VARNAME \ Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -62,7 +62,6 @@ virNWFilterTechDriverForName(const char /** * virNWFilterRuleInstAddData: - * @conn : pointer to virConnect object * @res : pointer to virNWFilterRuleInst object collecting the instantiation * data of a single firewall rule. * @data : the opaque data that the driver wants to add @@ -77,8 +76,7 @@ virNWFilterTechDriverForName(const char * message attached to the virConnect object. */ int -virNWFilterRuleInstAddData(virConnectPtr conn ATTRIBUTE_UNUSED, - virNWFilterRuleInstPtr res, +virNWFilterRuleInstAddData(virNWFilterRuleInstPtr res, void *data) { if (VIR_REALLOC_N(res->data, res->ndata+1) < 0) { @@ -107,7 +105,6 @@ virNWFilterRuleInstFree(virNWFilterRuleI /** * virNWFilterVarHashmapAddStdValues: - * @conn: Poijter to virConnect object * @tables: pointer to hash tabel to add values to * @macaddr: The string of the MAC address to add to the hash table, * may be NULL @@ -118,15 +115,14 @@ virNWFilterRuleInstFree(virNWFilterRuleI * Adds a couple of standard keys (MAC, IP) to the hash table. */ static int -virNWFilterVarHashmapAddStdValues(virConnectPtr conn, - virNWFilterHashTablePtr table, +virNWFilterVarHashmapAddStdValues(virNWFilterHashTablePtr table, char *macaddr) { if (macaddr) { if (virHashAddEntry(table->hashTable, NWFILTER_STD_VAR_MAC, macaddr) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Could not add variable 'MAC' to hashmap")); return 1; } @@ -138,7 +134,6 @@ virNWFilterVarHashmapAddStdValues(virCon /** * virNWFilterCreateVarHashmap: - * @conn: pointer to virConnect object * @macaddr: pointer to string containing formatted MAC address of interface * * Create a hashmap used for evaluating the firewall rules. Initializes @@ -148,15 +143,14 @@ virNWFilterVarHashmapAddStdValues(virCon * is attached to the virConnect object. */ virNWFilterHashTablePtr -virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr) { +virNWFilterCreateVarHashmap(char *macaddr) { virNWFilterHashTablePtr table = virNWFilterHashTableCreate(0); if (!table) { virReportOOMError(); return NULL; } - if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr)) { + if (virNWFilterVarHashmapAddStdValues(table, macaddr)) { virNWFilterHashTableFree(table); return NULL; } @@ -216,7 +210,6 @@ virNWFilterRuleInstantiate(virConnectPtr /** * virNWFilterCreateVarsFrom: - * @conn: pointer to virConnect object * @vars1: pointer to hash table * @vars2: pointer to hash table * @@ -227,8 +220,7 @@ virNWFilterRuleInstantiate(virConnectPtr * contents of var2 will overwrite those of var1. */ static virNWFilterHashTablePtr -virNWFilterCreateVarsFrom(virConnectPtr conn, - virNWFilterHashTablePtr vars1, +virNWFilterCreateVarsFrom(virNWFilterHashTablePtr vars1, virNWFilterHashTablePtr vars2) { virNWFilterHashTablePtr res = virNWFilterHashTableCreate(0); @@ -237,10 +229,10 @@ virNWFilterCreateVarsFrom(virConnectPtr return NULL; } - if (virNWFilterHashTablePutAll(conn, vars1, res)) + if (virNWFilterHashTablePutAll(vars1, res)) goto err_exit; - if (virNWFilterHashTablePutAll(conn, vars2, res)) + if (virNWFilterHashTablePutAll(vars2, res)) goto err_exit; return res; @@ -324,7 +316,7 @@ _virNWFilterInstantiateRec(virConnectPtr if (obj) { if (obj->wantRemoved) { - virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + virNWFilterReportError(VIR_ERR_NO_NWFILTER, _("Filter '%s' is in use."), inc->filterref); rc = 1; @@ -334,8 +326,7 @@ _virNWFilterInstantiateRec(virConnectPtr // create a temporary hashmap for depth-first tree traversal virNWFilterHashTablePtr tmpvars = - virNWFilterCreateVarsFrom(conn, - inc->params, + virNWFilterCreateVarsFrom(inc->params, vars); if (!tmpvars) { virReportOOMError(); @@ -373,7 +364,7 @@ _virNWFilterInstantiateRec(virConnectPtr if (rc) break; } else { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("referenced filter '%s' is missing"), inc->filterref); rc = 1; @@ -516,7 +507,7 @@ _virNWFilterInstantiateFilter(virConnect techdriver = virNWFilterTechDriverForName(drvname); if (!techdriver) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Could not get access to ACL tech " "driver '%s'"), drvname); @@ -527,14 +518,14 @@ _virNWFilterInstantiateFilter(virConnect obj = virNWFilterPoolObjFindByName(&driver->pools, net->filter); if (!obj) { - virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + virNWFilterReportError(VIR_ERR_NO_NWFILTER, _("Could not find filter '%s'"), net->filter); return 1; } if (obj->wantRemoved) { - virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + virNWFilterReportError(VIR_ERR_NO_NWFILTER, _("Filter '%s' is in use."), net->filter); rc = 1; @@ -549,8 +540,7 @@ _virNWFilterInstantiateFilter(virConnect goto err_exit; } - vars1 = virNWFilterCreateVarHashmap(conn, - str_macaddr); + vars1 = virNWFilterCreateVarHashmap(str_macaddr); if (!vars1) { rc = 1; goto err_exit; @@ -558,8 +548,7 @@ _virNWFilterInstantiateFilter(virConnect str_macaddr = NULL; - vars = virNWFilterCreateVarsFrom(conn, - vars1, + vars = virNWFilterCreateVarsFrom(vars1, net->filterparams); if (!vars) { rc = 1; @@ -630,7 +619,7 @@ int virNWFilterRollbackUpdateFilter(virC virNWFilterTechDriverPtr techdriver; techdriver = virNWFilterTechDriverForName(drvname); if (!techdriver) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Could not get access to ACL tech " "driver '%s'"), drvname); @@ -649,7 +638,7 @@ virNWFilterTearOldFilter(virConnectPtr c virNWFilterTechDriverPtr techdriver; techdriver = virNWFilterTechDriverForName(drvname); if (!techdriver) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Could not get access to ACL tech " "driver '%s'"), drvname); @@ -668,12 +657,10 @@ virNWFilterTeardownFilter(const virDomai techdriver = virNWFilterTechDriverForName(drvname); if (!techdriver) { -#if 0 - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Could not get access to ACL tech " "driver '%s'"), drvname); -#endif return 1; } Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -25,8 +25,7 @@ virNWFilterTechDriverPtr virNWFilterTechDriverForName(const char *name); -int virNWFilterRuleInstAddData(virConnectPtr conn, - virNWFilterRuleInstPtr res, +int virNWFilterRuleInstAddData(virNWFilterRuleInstPtr res, void *data); @@ -48,8 +47,7 @@ int virNWFilterTearOldFilter(virConnectP int virNWFilterTeardownFilter(const virDomainNetDefPtr net); -virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr); +virNWFilterHashTablePtr virNWFilterCreateVarHashmap(char *macaddr); void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED,

2 1

[libvirt] [PATCH] Eliminate compiler warning about non-const format string
by Laine Stump 05 Apr '10

05 Apr '10

--- src/nwfilter/nwfilter_ebiptables_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 6d66543..cffe027 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -204,7 +204,7 @@ _printDataType(virConnectPtr conn, case DATATYPE_IPMASK: if (snprintf(buf, bufsize, "%d", item->u.u8) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for uint8 type")); return 1; } -- 1.6.6.1

2 2

[libvirt] [PATCH] xenapi: Add managedsave entries to the driver struct
by Matthias Bolte 04 Apr '10

04 Apr '10

Commit 15c647a91e8c5bcfcb02ac4e755160c5c99a2a1e added the new managedsave entries to all driver structs except the XenAPI one. --- I just pushed this patch. src/xenapi/xenapi_driver.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/src/xenapi/xenapi_driver.c b/src/xenapi/xenapi_driver.c index dcfdc1e..240aa16 100644 --- a/src/xenapi/xenapi_driver.c +++ b/src/xenapi/xenapi_driver.c @@ -1783,6 +1783,9 @@ static virDriver xenapiDriver = { NULL, /* domainMigrateSetMaxDowntime */ NULL, /* domainEventRegisterAny */ NULL, /* domainEventDeregisterAny */ + NULL, /* domainManagedSave */ + NULL, /* domainHasManagedSaveImage */ + NULL, /* domainManagedSaveRemove */ }; /** -- 1.6.3.3

2 1

[libvirt] [PATCH] nwfilter: Fix random index in virNWFilterRuleDefDetailsFormat
by Matthias Bolte 04 Apr '10

04 Apr '10

An uninitialized int value was used to index an array. This can result in a segfault in nwfilterxml2xmltest. --- src/conf/nwfilter_conf.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/conf/nwfilter_conf.c b/src/conf/nwfilter_conf.c index 08934fb..7c71ece 100644 --- a/src/conf/nwfilter_conf.c +++ b/src/conf/nwfilter_conf.c @@ -2375,7 +2375,7 @@ virNWFilterRuleDefDetailsFormat(virConnectPtr conn, const virXMLAttr2Struct *att, virNWFilterRuleDefPtr def) { - int i, j; + int i = 0, j; bool typeShown = 0; bool neverShown = 1; enum match { -- 1.6.3.3

2 2

[libvirt] [PATCH] xenapi: Fix uninitialized variable warning
by Matthias Bolte 04 Apr '10

04 Apr '10

--- src/xenapi/xenapi_utils.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/xenapi/xenapi_utils.c b/src/xenapi/xenapi_utils.c index 581bd90..4eb17fa 100644 --- a/src/xenapi/xenapi_utils.c +++ b/src/xenapi/xenapi_utils.c @@ -405,7 +405,7 @@ createVifNetwork (virConnectPtr conn, xen_vm vm, char *device, vm_opt->u.handle = xvm; xen_network_set *net_set = NULL; xen_network_record *net_rec = NULL; - int cnt; + int cnt = 0; if (xen_network_get_all(session, &net_set)) { for(cnt = 0; cnt < net_set->size; cnt++) { if (xen_network_get_record(session, &net_rec, net_set->contents[cnt])) { -- 1.6.3.3

2 2

[libvirt] [PATCH] nwfilter: Get rid of regular expressions for testing of var names and values
by Stefan Berger 04 Apr '10

04 Apr '10

Get rid of the regular expressions when evaluating variable names and values. Rather use the strspn() function. Along with this cleanup the initialization function for the code that used the regular expression can also be removed. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 5 ---- src/conf/nwfilter_conf.h | 3 -- src/conf/nwfilter_params.c | 50 +++++++++++++++------------------------------ src/conf/nwfilter_params.h | 6 +++++ 4 files changed, 24 insertions(+), 40 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -568,9 +568,6 @@ void virNWFilterPoolObjUnlock(virNWFilte int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); -int virNWFilterParamConfLayerInit(void); -void virNWFilterParamConfLayerShutdown(void); - # define virNWFilterReportError(conn, code, fmt...) \ (void)conn; \ virReportErrorHelper(NULL, VIR_FROM_NWFILTER, code, __FILE__, \ Index: libvirt-acl/src/conf/nwfilter_params.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.c +++ libvirt-acl/src/conf/nwfilter_params.c @@ -22,8 +22,6 @@ #include <config.h> -#include <regex.h> - #include "internal.h" #include "memory.h" @@ -35,13 +33,6 @@ #define VIR_FROM_THIS VIR_FROM_NWFILTER -/* - * regular expressions for parameter names and values - */ -static regex_t regex_nam; -static regex_t regex_val; - - static void hashDealloc(void *payload, const char *name ATTRIBUTE_UNUSED) { @@ -215,6 +206,21 @@ err_exit: #ifndef PROXY + +static bool +isValidVarName(const char *var) +{ + return var[strspn(var, VALID_VARNAME)] == 0; +} + + +static bool +isValidVarValue(const char *value) +{ + return value[strspn(value, VALID_VARVALUE)] == 0; +} + + virNWFilterHashTablePtr virNWFilterParseParamAttributes(xmlNodePtr cur) { @@ -234,9 +240,9 @@ virNWFilterParseParamAttributes(xmlNodeP nam = virXMLPropString(cur, "name"); val = virXMLPropString(cur, "value"); if (nam != NULL && val != NULL) { - if (regexec(&regex_nam, nam, 0, NULL, 0) != 0) + if (!isValidVarName(nam)) goto skip_entry; - if (regexec(&regex_val, val, 0, NULL, 0) != 0) + if (!isValidVarValue(nam)) goto skip_entry; if (virNWFilterHashTablePut(table, nam, val, 1)) { VIR_FREE(nam); @@ -296,25 +302,3 @@ virNWFilterFormatParamAttributes(virNWFi return virBufferContentAndReset(&buf); } - - -int virNWFilterParamConfLayerInit(void) { - - if (regcomp(&regex_nam, "^[a-zA-Z0-9_]+$" , - REG_NOSUB|REG_EXTENDED) != 0) - return 1; - - if (regcomp(&regex_val, "^[a-zA-Z0-9_.:]+$", - REG_NOSUB|REG_EXTENDED) != 0) { - regfree(&regex_nam); - return 1; - } - - return 0; -} - - -void virNWFilterParamConfLayerShutdown(void) { - regfree(&regex_nam); - regfree(&regex_val); -} Index: libvirt-acl/src/conf/nwfilter_params.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.h +++ libvirt-acl/src/conf/nwfilter_params.h @@ -50,4 +50,10 @@ int virNWFilterHashTablePutAll(virConnec virNWFilterHashTablePtr src, virNWFilterHashTablePtr dest); +#define VALID_VARNAME \ + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_" + +#define VALID_VARVALUE \ + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:" + #endif /* NWFILTER_PARAMS_H */ Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -2634,16 +2634,13 @@ int virNWFilterConfLayerInit(virHashIter if (virMutexInit(&updateMutex)) return 1; - if (virNWFilterParamConfLayerInit()) - return 1; - return 0; } void virNWFilterConfLayerShutdown(void) { - virNWFilterParamConfLayerShutdown(); + virMutexDestroy(&updateMutex); }

2 1

[libvirt] [RFC PATCH 0/8]: Domain Snapshot API
by Chris Lalancette 03 Apr '10

03 Apr '10

Hello, Here is the first set of RFC patches for the snapshot API. Note that this definitely isn't finished; in particular, we are going to be changing the semantic for virDomainCreateFromSnapshot, and there are still a couple of known outstanding bugs. Nevertheless, that will probably be pretty minor in terms of code, so we'd like to get review on the rest of these patches for now. I've broken the series down along lines that I believe will compile independently, though I haven't yet done a git-bisect to confirm. Unfortunately it leaves patch 3/8 as a monster patch implementing the skeleton and remote driver. The good news is that it is mostly mechanical. Suggestions for how to better split it up are welcome. Thanks go to Jirka for lots of code contribution to this series, and all of the others who took part in the discussion of this API. Comments are welcome. Chris Lalancette

3 25

[libvirt] [PATCH] build: improve check for out-of-date .gnulib submodule
by Eric Blake 03 Apr '10

03 Apr '10

git reset --hard 96e5a2d4d5b13bf2cc887562dc11d146b78d5950 ./autogen.sh make -s git pull make -s <-- expecting auto-bootstrap here, doesn't happen Use git diff to expose whether the submodule has untracked changes, which are typical on an incremental pull if .gnulib was updated but the user did not manually run 'git submodule update'. After this patch is applied, I encountered a new problem when following the reproducing pattern. Basically, the change to .gnulib between libvirt's commit 96e5a2d4 and this patch introduced a change to sys_ioctl.in.h, but gnulib (intentionally) does not make the replacement headers depend on Makefile changes. Therefore, I ended up with the generated replacement header being broken: gnulib/lib/sys/ioctl.h complained about a use of @. But that seems like something that should be fixed upstream in gnulib's bootstrap script (that is, when doing a gnulib update, all files created from .in.h file should probably be deleted). Without the benefit of that proposed gnulib fix, I worked around the problem by manually removing the stale gnulib/lib/sys/ioctl.h. * autogen.sh (t): Also run bootstrap if the gnulib submodule needs to be updated. * cfg.mk (_autogen): Likewise. Reported by Matthias Bolte. --- That took a lot longer to fix than I originally expected. But I think this patch fixes the libvirt side of things, so that make will properly rerun autogen when the .gnulib submodule changes. Thanks again to Matthias for boiling it down to a reproducible step. And now I'm off to figure out whether gnulib's bootstrap script could do a better job of deleting any generated headers that might be rendered invalid by an update in gnulib modules. autogen.sh | 2 +- cfg.mk | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/autogen.sh b/autogen.sh index a618d86..2f5b42d 100755 --- a/autogen.sh +++ b/autogen.sh @@ -75,7 +75,7 @@ bootstrap_hash() # Ensure that whenever we pull in a gnulib update or otherwise change to a # different version (i.e., when switching branches), we also rerun ./bootstrap. curr_status=.git-module-status -t=$(bootstrap_hash) +t=$(bootstrap_hash; git diff .gnulib) if test "$t" = "$(cat $curr_status 2>/dev/null)"; then : # good, it's up to date, all we need is autoreconf autoreconf -if diff --git a/cfg.mk b/cfg.mk index b6b2530..74fe5ed 100644 --- a/cfg.mk +++ b/cfg.mk @@ -294,7 +294,8 @@ ifeq (0,$(MAKELEVEL)) _submodule_hash = sed 's/^[ +-]//;s/ .*//' _update_required := $(shell \ actual=$$(git submodule status | $(_submodule_hash); \ - git hash-object bootstrap.conf); \ + git hash-object bootstrap.conf; \ + git diff .gnulib); \ stamp="$$($(_submodule_hash) $(_curr_status) 2>/dev/null)"; \ test "$$stamp" = "$$actual"; echo $$?) ifeq (1,$(_update_required)) @@ -303,9 +304,12 @@ Makefile: _autogen endif endif +# It is necessary to call autogen any time gnulib changes. Autogen +# reruns configure, then we regenerate all Makefiles at once. .PHONY: _autogen _autogen: $(srcdir)/autogen.sh + ./config.status # Exempt @...@ uses of these symbols. _makefile_at_at_check_exceptions = ' && !/(SCHEMA|SYSCONF)DIR/' -- 1.6.6.1

2 2

[libvirt] [PATCH] [0/4] Managed save APIs
by Daniel Veillard 02 Apr '10

02 Apr '10

As posted earlier, I have implemented the small set of managed save APIs, where libvirt stores the domain state itself and can then recover that state when the domain is started up. I think the code is complete, but not really tested (I still need to debug a failure which seems unrelated), with the exception of the virsh commands which probably need to be extended for convenience. Also I implemented it only for the qemu driver, I would not be surprized if an ESX backend could be implemented since there is no file path in this API. More documentation is needed too. Thanks Chris Lalancette who wrote a large part of this code ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

3 8

[libvirt] [PATCH 0/3] Add dnsmasq module
by Satoru SATOH 02 Apr '10

02 Apr '10

The following series of patches is a prototype implementation of dnsmasq module. It implements an idea originally suggested by Daniel-san and can address the problem that too many --dhcp-host args hitting ARG_MAX limit I reported last year [1]. [1] https://www.redhat.com/archives/libvir-list/2009-October/msg00216.html Thanks, Satoru SATOH

1 3

[libvirt] [PATCH] Optimization of the check for valid interface name
by Stefan Berger 02 Apr '10

02 Apr '10

The attached patch optimizes the validation of the name of an interface. Signed-off-by: Stefan Berger Index: libvirt-acl/src/conf/domain_conf.c =================================================================== --- libvirt-acl.orig/src/conf/domain_conf.c +++ libvirt-acl/src/conf/domain_conf.c @@ -1795,7 +1795,7 @@ cleanup: static bool isValidIfname(const char *ifname) { - return (strspn(ifname, VALID_IFNAME_CHARS) == strlen(ifname)); + return ifname[strspn(ifname, VALID_IFNAME_CHARS)] == 0; }

3 2

[libvirt] [PATCH] Use virStrToLong_ui rather than virStrToLong_i where possible
by Stefan Berger 02 Apr '10

02 Apr '10

Use the virStrToLong_ui() function rather than the virStrToLong_i() where possible. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -1126,6 +1126,7 @@ virNWFilterRuleDetailsParse(virConnectPt enum virNWFilterEntryItemFlags *flags ,match_flag = 0, flags_set = 0; nwItemDesc *item; int int_val; + unsigned int uint_val; void *data_ptr, *storage_ptr; valueValidator validator; char *match = virXMLPropString(node, "match"); @@ -1175,12 +1176,12 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_UINT8: storage_ptr = &item->u.u8; - if (virStrToLong_i(prop, NULL, 10, &int_val) >= 0) { - if (int_val >= 0 && int_val <= 0xff) { + if (virStrToLong_ui(prop, NULL, 10, &uint_val) >= 0) { + if (uint_val <= 0xff) { if (!validator) - *(uint8_t *)storage_ptr = int_val; + *(uint8_t *)storage_ptr = uint_val; found = 1; - data_ptr = &int_val; + data_ptr = &uint_val; } else rc = -1; } else @@ -1189,12 +1190,12 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_UINT16: storage_ptr = &item->u.u16; - if (virStrToLong_i(prop, NULL, 10, &int_val) >= 0) { - if (int_val >= 0 && int_val <= 0xffff) { + if (virStrToLong_ui(prop, NULL, 10, &uint_val) >= 0) { + if (uint_val <= 0xffff) { if (!validator) - *(uint16_t *)storage_ptr = int_val; + *(uint16_t *)storage_ptr = uint_val; found = 1; - data_ptr = &int_val; + data_ptr = &uint_val; } else rc = -1; } else @@ -1212,13 +1213,13 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_IPMASK: storage_ptr = &item->u.u8; - if (virStrToLong_i(prop, NULL, 10, &int_val) == 0) { - if (int_val >= 0 && int_val <= 32) { + if (virStrToLong_ui(prop, NULL, 10, &uint_val) == 0) { + if (uint_val <= 32) { if (!validator) *(uint8_t *)storage_ptr = - (uint8_t)int_val; + (uint8_t)uint_val; found = 1; - data_ptr = &int_val; + data_ptr = &uint_val; } else rc = -1; } else { @@ -1266,13 +1267,13 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_IPV6MASK: storage_ptr = &item->u.u8; - if (virStrToLong_i(prop, NULL, 10, &int_val) == 0) { - if (int_val >= 0 && int_val <= 128) { + if (virStrToLong_ui(prop, NULL, 10, &uint_val) == 0) { + if (uint_val <= 128) { if (!validator) *(uint8_t *)storage_ptr = - (uint8_t)int_val; + (uint8_t)uint_val; found = 1; - data_ptr = &int_val; + data_ptr = &uint_val; } else rc = -1; } else {

2 1

[libvirt] [PATCH v1 0/2] Fixes to network filter rules instantiator + XML parser and XML parser test cases
by Stefan Berger 02 Apr '10

02 Apr '10

The following two patches fix some problems when instantiating the network filtering rules provided by the test cases in the 2nd patch on a running virtual machine using 'nwfilter-define'. There's one known problem realted to 'dscp' values not being capped at '63'. This will be fixed later. Regards, Stefan

2 5

[libvirt] [PATCH] build: import latest gnulib
by Eric Blake 02 Apr '10

02 Apr '10

* .gnulib: Update to latest. * cfg.mk (sc_prohibit_test_minus_ao): Delete, it was moved into gnulib's maint.mk. --- Here's the full list of gnulib changes: * .gnulib 4f01268...e01b458 (44): > maint.mk: check for [ as well as test > gnumakefile: don't squelch _version output > sys_time: avoid compiler warnings > maint.mk: split a long line > maint.mk: s/_header_without_use/_sc_header_without_use/ > maint: improve module indicators > fdopendir: work around FreeBSD bug > Emit #pragma system_header after the inclusion guard, not before. > Fix indentation. > save-cwd: don't leak a file descriptor when the caller execs > Remove vestiges of fts-lgpl module. > Fix definition of tests witness macro. > Fix definition of tests witness macro. > Fix ioctl's protoype on glibc systems. > Normalize copyright line formatting. > exclude: fix the case of globs vs. EXCLUDE_INCLUDE > maint.mk: prohibit use of test's -o and -a operators > Remove unused GNULIB_XYZ macro definitions. > Mark privileged tests modules. > Split C++ tests into separate tests modules. > gnulib-tool: Allow 'foo-tests' module even if there is no module 'foo'. > gnulib-tool: Add support for special categories of tests. > ansi-c++-opt: Allow turning off the C++ build by default. > unistd: Avoid #define replacements in C++ mode. > Fix link errors on mingw. > lib-ignore: Determine different options for different compilers. > Remove unused GNULIB_XYZ macro definitions. > Add a remark about certain modules. > Resolve conflict between the two kinds of module indicators. > autoupdate > Distinguish two kinds of module indicators. > New module description field 'Comment'. > Addendum to 2010-02-07 commit. > Use GNULIB_POSIXCHECK instead of GNULIB_PORTCHECK. > Avoid side effects from tests-related modules on the compilation of lib. > Factorize common .m4 code. > Fix a compilation error on Cygwin with g++ >= 4.3. > Rename gl_GETLOGIN. > Rename gl_GETLOGIN_R. > Rename gl_INET_NTOP. > Rename gl_INET_PTON. > Rename gl_MBSLEN. > Rename gl_FORKPTY and gl_OPENPTY. > top/maint.mk (sc_texinfo_acronym): Don't infloop if there is no *.texi files. .gnulib | 2 +- cfg.mk | 8 -------- 2 files changed, 1 insertions(+), 9 deletions(-) diff --git a/.gnulib b/.gnulib index 4f01268..e01b458 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit 4f01268d0c584c20704e42527f4fa125e7525aae +Subproject commit e01b458f40440e64ce6f59beb0b446219bb6302d diff --git a/cfg.mk b/cfg.mk index 2e7b68a..07360b0 100644 --- a/cfg.mk +++ b/cfg.mk @@ -272,14 +272,6 @@ sc_preprocessor_indentation: echo '$(ME): skipping test $@: cppi not installed' 1>&2; \ fi -_m1 = use "test C1 && test C2", not "test C1 -''a C2" -_m2 = use "test C1 || test C2", not "test C1 -''o C2" -# Using test's -a and -o operators is not portable. -sc_prohibit_test_minus_ao: - @re='(\<test| \[+) .+ -[ao] ' \ - msg='$(_m1); $(_m2)' \ - $(_prohibit_regexp) - sc_copyright_format: @$(VC_LIST_EXCEPT) | xargs grep -ni 'copyright .*Red 'Hat \ | grep -v Inc \ -- 1.6.6.1

2 3

[libvirt] Pushed qemuDomainRestore fix
by Chris Lalancette 02 Apr '10

02 Apr '10

FYI, I just pushed this fix (with blessing from DV): commit d62f4c36c2c28b96952143247a1360e8c18f64c7 Author: Chris Lalancette <clalance(a)redhat.com> Date: Tue Mar 23 09:11:29 2010 -0400 Don't use virFileReadLimFD in qemuDomainRestore. virFileReadLimFD is a poor fit for reading the header of the restore file. The problem is that virFileReadLimFD returns an error when there is more data after the amount you ask to read, but that is *expected* in this case. This patch is essentially a revert of 1a4d5c9543641c444dccd682f6256ee3faf22a80, but I don't think that commit does what it says anyway. It purports to prevent an unwarranted OOM error, but since virFileReadLimFD will allocate memory up to the maximum anyway, the upper limit on the total amount of memory allocated is the same for either the old version or the new version. Since the old saferead actually works and virFileReadLimFD does not, revert to using saferead. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 4291bc7..70d2781 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5547,7 +5547,12 @@ static int qemudDomainRestore(virConnectPtr conn, goto cleanup; } - if (virFileReadLimFD(fd, header.xml_len, &xml) != header.xml_len) { + if (VIR_ALLOC_N(xml, header.xml_len) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (saferead(fd, xml, header.xml_len) != header.xml_len) { qemuReportError(VIR_ERR_OPERATION_FAILED, "%s", _("failed to read XML")); goto cleanup; -- Chris Lalancette

2 1

[libvirt] [PATCH] VBox: Fix use of uninitialized value
by Jiri Denemark 02 Apr '10

02 Apr '10

--- src/vbox/vbox_tmpl.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 14fdcda..59ad1b8 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -1570,7 +1570,7 @@ static int vboxDomainDestroy(virDomainPtr dom) { #if VBOX_API_VERSION == 2002 console->vtbl->PowerDown(console); #else - IProgress *progress; + IProgress *progress = NULL; console->vtbl->PowerDown(console, &progress); if (progress) { progress->vtbl->WaitForCompletion(progress, -1); -- 1.7.0.4

2 2

[libvirt] [PATCH] Changes to clock timer XML to match final design.
by Laine Stump 02 Apr '10

02 Apr '10

The clock timer XML is being updated in the following ways (based on further off-list discussion that was missed during the initial implementation): 1) 'wallclock' is changed to 'track', and the possible values are 'boot' (corresponds to old 'host'), 'guest', and 'wall'. 2) 'mode' has an additional value 'smpsafe' 3) when tickpolicy='catchup', there can be an optional sub-element of timer called 'catchup': <catchup threshold=123 slew=120 limit=10000/> Those three values are all longs, always optional, and if they are present, they are positive. Internally, 0 indicates "unspecified". * docs/schemas/domain.rng: updated RNG definition to account for changes * src/conf/domain_conf.h: change the C struct and enums to match changes. * src/conf/domain_conf.c: timer parse and format functions changed to handle the new selections and new element. * src/libvirt_private.syms: *TimerWallclock* changes to *TimerTrack* * src/qemu/qemu_conf.c: again, account for Wallclock --> Track change. --- docs/schemas/domain.rng | 24 +++++++++++- src/conf/domain_conf.c | 89 +++++++++++++++++++++++++++++++++++---------- src/conf/domain_conf.h | 26 ++++++++++---- src/libvirt_private.syms | 4 +- src/qemu/qemu_conf.c | 17 +++++++-- 5 files changed, 126 insertions(+), 34 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index d804301..228665c 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -344,10 +344,11 @@ </choice> </attribute> <optional> - <attribute name="wallclock"> + <attribute name="track"> <choice> - <value>host</value> + <value>boot</value> <value>guest</value> + <value>wall</value> </choice> </attribute> </optional> @@ -362,6 +363,9 @@ </attribute> </optional> <optional> + <ref name="catchup"/> + </optional> + <optional> <attribute name="frequency"> <ref name="unsignedInt"/> </attribute> @@ -373,6 +377,7 @@ <value>native</value> <value>emulate</value> <value>paravirt</value> + <value>smpsafe</value> </choice> </attribute> </optional> @@ -387,6 +392,21 @@ <empty/> </element> </define> + <define name="catchup"> + <element name="catchup"> + <optional> + <attribute name="threshold"> + <ref name="unsignedInt"/> + </attribute> + <attribute name="slew"> + <ref name="unsignedInt"/> + </attribute> + <attribute name="limit"> + <ref name="unsignedInt"/> + </attribute> + </optional> + </element> + </define> <!-- A bootloader may be used to extract the OS information instead of defining the OS parameter in the instance. It points just to the diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 66aa53e..b8acab9 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -252,9 +252,10 @@ VIR_ENUM_IMPL(virDomainTimerName, VIR_DOMAIN_TIMER_NAME_LAST, "hpet", "tsc"); -VIR_ENUM_IMPL(virDomainTimerWallclock, VIR_DOMAIN_TIMER_WALLCLOCK_LAST, - "host", - "guest"); +VIR_ENUM_IMPL(virDomainTimerTrack, VIR_DOMAIN_TIMER_TRACK_LAST, + "boot", + "guest", + "wall"); VIR_ENUM_IMPL(virDomainTimerTickpolicy, VIR_DOMAIN_TIMER_TICKPOLICY_LAST, "delay", @@ -266,7 +267,8 @@ VIR_ENUM_IMPL(virDomainTimerMode, VIR_DOMAIN_TIMER_MODE_LAST, "auto", "native", "emulate", - "paravirt"); + "paravirt", + "smpsafe"); #define virDomainReportError(code, ...) \ virReportErrorHelper(NULL, VIR_FROM_DOMAIN, code, __FILE__, \ @@ -2555,7 +2557,7 @@ virDomainTimerDefParseXML(const xmlNodePtr node, char *name = NULL; char *present = NULL; char *tickpolicy = NULL; - char *wallclock = NULL; + char *track = NULL; char *mode = NULL; virDomainTimerDefPtr def; @@ -2603,12 +2605,12 @@ virDomainTimerDefParseXML(const xmlNodePtr node, } } - def->wallclock = -1; - wallclock = virXMLPropString(node, "wallclock"); - if (wallclock != NULL) { - if ((def->wallclock = virDomainTimerWallclockTypeFromString(wallclock)) < 0) { + def->track = -1; + track = virXMLPropString(node, "track"); + if (track != NULL) { + if ((def->track = virDomainTimerTrackTypeFromString(track)) < 0) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, - _("unknown timer wallclock '%s'"), wallclock); + _("unknown timer track '%s'"), track); goto error; } } @@ -2616,7 +2618,7 @@ virDomainTimerDefParseXML(const xmlNodePtr node, int ret = virXPathULong("string(./frequency)", ctxt, &def->frequency); if (ret == -1) { def->frequency = 0; - } else if (ret <= 0) { + } else if (ret < 0) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("invalid timer frequency")); goto error; @@ -2632,11 +2634,42 @@ virDomainTimerDefParseXML(const xmlNodePtr node, } } + xmlNodePtr catchup = virXPathNode("./catchup", ctxt); + if (catchup != NULL) { + ret = virXPathULong("string(./catchup/@threshold)", ctxt, + &def->catchup.threshold); + if (ret == -1) { + def->catchup.threshold = 0; + } else if (ret < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("invalid catchup threshold")); + goto error; + } + + ret = virXPathULong("string(./catchup/@slew)", ctxt, &def->catchup.slew); + if (ret == -1) { + def->catchup.slew = 0; + } else if (ret < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("invalid catchup slew")); + goto error; + } + + ret = virXPathULong("string(./catchup/@limit)", ctxt, &def->catchup.limit); + if (ret == -1) { + def->catchup.limit = 0; + } else if (ret < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("invalid catchup limit")); + goto error; + } + } + cleanup: VIR_FREE(name); VIR_FREE(present); VIR_FREE(tickpolicy); - VIR_FREE(wallclock); + VIR_FREE(track); VIR_FREE(mode); ctxt->node = oldnode; @@ -5456,16 +5489,16 @@ virDomainTimerDefFormat(virBufferPtr buf, if ((def->name == VIR_DOMAIN_TIMER_NAME_PLATFORM) || (def->name == VIR_DOMAIN_TIMER_NAME_RTC)) { - if (def->wallclock != -1) { - const char *wallclock - = virDomainTimerWallclockTypeToString(def->wallclock); - if (!wallclock) { + if (def->track != -1) { + const char *track + = virDomainTimerTrackTypeToString(def->track); + if (!track) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, - _("unexpected timer wallclock %d"), - def->wallclock); + _("unexpected timer track %d"), + def->track); return -1; } - virBufferVSprintf(buf, " wallclock='%s'", wallclock); + virBufferVSprintf(buf, " track='%s'", track); } } @@ -5487,7 +5520,23 @@ virDomainTimerDefFormat(virBufferPtr buf, } } - virBufferAddLit(buf, "/>\n"); + if ((def->catchup.threshold == 0) + && (def->catchup.slew == 0) + && (def->catchup.limit == 0)) { + virBufferAddLit(buf, "/>\n"); + } else { + virBufferAddLit(buf, ">\n <catchup "); + if (def->catchup.threshold > 0) { + virBufferVSprintf(buf, " threshold='%lu'", def->catchup.threshold); + } + if (def->catchup.slew > 0) { + virBufferVSprintf(buf, " slew='%lu'", def->catchup.slew); + } + if (def->catchup.limit > 0) { + virBufferVSprintf(buf, " limit='%lu'", def->catchup.limit); + } + virBufferAddLit(buf, "/>\n </timer>\n"); + } return 0; } diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index ed1a4ad..435d546 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -656,11 +656,12 @@ enum virDomainTimerNameType { VIR_DOMAIN_TIMER_NAME_LAST, }; -enum virDomainTimerWallclockType { - VIR_DOMAIN_TIMER_WALLCLOCK_HOST = 0, - VIR_DOMAIN_TIMER_WALLCLOCK_GUEST, +enum virDomainTimerTrackType { + VIR_DOMAIN_TIMER_TRACK_BOOT = 0, + VIR_DOMAIN_TIMER_TRACK_GUEST, + VIR_DOMAIN_TIMER_TRACK_WALL, - VIR_DOMAIN_TIMER_WALLCLOCK_LAST, + VIR_DOMAIN_TIMER_TRACK_LAST, }; enum virDomainTimerTickpolicyType { @@ -677,10 +678,19 @@ enum virDomainTimerModeType { VIR_DOMAIN_TIMER_MODE_NATIVE, VIR_DOMAIN_TIMER_MODE_EMULATE, VIR_DOMAIN_TIMER_MODE_PARAVIRT, + VIR_DOMAIN_TIMER_MODE_SMPSAFE, VIR_DOMAIN_TIMER_MODE_LAST, }; +typedef struct _virDomainTimerCatchupDef virDomainTimerCatchupDef; +typedef virDomainTimerCatchupDef *virDomainTimerCatchupDefPtr; +struct _virDomainTimerCatchupDef { + unsigned long threshold; + unsigned long slew; + unsigned long limit; +}; + typedef struct _virDomainTimerDef virDomainTimerDef; typedef virDomainTimerDef *virDomainTimerDefPtr; struct _virDomainTimerDef { @@ -688,8 +698,10 @@ struct _virDomainTimerDef { int present; /* unspecified = -1, no = 0, yes = 1 */ int tickpolicy; /* none|catchup|merge|discard */ - /* wallclock is only valid for name='platform|rtc' */ - int wallclock; /* host|guest */ + virDomainTimerCatchupDef catchup; + + /* track is only valid for name='platform|rtc' */ + int track; /* host|guest */ /* frequency & mode are only valid for name='tsc' */ unsigned long frequency; /* in Hz, unspecified = 0 */ @@ -1029,7 +1041,7 @@ VIR_ENUM_DECL(virDomainClockOffset) VIR_ENUM_DECL(virDomainNetdevMacvtap) VIR_ENUM_DECL(virDomainTimerName) -VIR_ENUM_DECL(virDomainTimerWallclock) +VIR_ENUM_DECL(virDomainTimerTrack) VIR_ENUM_DECL(virDomainTimerTickpolicy) VIR_ENUM_DECL(virDomainTimerMode) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index cc943f8..08a6b97 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -199,8 +199,8 @@ virDomainClockOffsetTypeFromString; virDomainDiskErrorPolicyTypeToString; virDomainTimerNameTypeToString; virDomainTimerNameTypeFromString; -virDomainTimerWallclockTypeToString; -virDomainTimerWallclockTypeFromString; +virDomainTimerTrackTypeToString; +virDomainTimerTrackTypeFromString; virDomainTimerTickpolicyTypeToString; virDomainTimerTickpolicyTypeFromString; virDomainTimerModeTypeToString; diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 8f6f7ec..4f279be 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -3183,11 +3183,22 @@ qemuBuildClockArgStr(virDomainClockDefPtr def) int i; for (i = 0; i < def->ntimers; i++) { if (def->timers[i]->name == VIR_DOMAIN_TIMER_NAME_RTC) { - if (def->timers[i]->wallclock == VIR_DOMAIN_TIMER_WALLCLOCK_HOST) { - virBufferAddLit(&buf, ",clock=host"); - } else if (def->timers[i]->wallclock == VIR_DOMAIN_TIMER_WALLCLOCK_GUEST) { + switch (def->timers[i]->track) { + case -1: /* unspecified - use hypervisor default */ + break; + case VIR_DOMAIN_TIMER_TRACK_BOOT: + qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unsupported rtc timer track '%s'"), + virDomainTimerTrackTypeToString(def->timers[i]->track)); + goto error; + case VIR_DOMAIN_TIMER_TRACK_GUEST: virBufferAddLit(&buf, ",clock=vm"); + break; + case VIR_DOMAIN_TIMER_TRACK_WALL: + virBufferAddLit(&buf, ",clock=host"); + break; } + switch (def->timers[i]->tickpolicy) { case -1: case VIR_DOMAIN_TIMER_TICKPOLICY_DELAY: -- 1.6.6.1

2 2

[libvirt] [PATCH] Eliminate compile warnings in nwfilter error log calls
by Laine Stump 02 Apr '10

02 Apr '10

--- src/nwfilter/nwfilter_ebiptables_driver.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 68bada6..172394d 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -156,13 +156,13 @@ printDataType(virConnectPtr conn, case DATATYPE_IPADDR: data = virSocketFormatAddr(&item->u.ipaddr.addr); if (!data) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", _("internal IPv4 address representation " "is bad")); return 1; } if (snprintf(buf, bufsize, "%s", data) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", _("buffer too small for IP address")); VIR_FREE(data); return 1; @@ -173,14 +173,14 @@ printDataType(virConnectPtr conn, case DATATYPE_IPV6ADDR: data = virSocketFormatAddr(&item->u.ipaddr.addr); if (!data) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", _("internal IPv6 address representation " "is bad")); return 1; } if (snprintf(buf, bufsize, "%s", data) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", _("buffer too small for IPv6 address")); VIR_FREE(data); return 1; @@ -191,7 +191,7 @@ printDataType(virConnectPtr conn, case DATATYPE_MACADDR: case DATATYPE_MACMASK: if (bufsize < VIR_MAC_STRING_BUFLEN) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for MAC address")); return 1; } @@ -202,7 +202,7 @@ printDataType(virConnectPtr conn, case DATATYPE_UINT16: if (snprintf(buf, bufsize, "%d", item->u.u16) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for uint16 type")); return 1; } @@ -213,7 +213,7 @@ printDataType(virConnectPtr conn, case DATATYPE_UINT8: if (snprintf(buf, bufsize, "%d", item->u.u8) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for uint8 type")); return 1; } -- 1.6.6.1

2 2

[libvirt] [PATCH] Allow domain disk images on root-squash NFS to coexist with security driver.
by Laine Stump 02 Apr '10

02 Apr '10

(suggested by Daniel Berrange, tested by Dan Kenigsberg) virStorageFileGetMetadata will fail for disk images that are stored on a root-squash NFS share that isn't world-readable. SELinuxSetSecurityImageLabel is called during the startup of every domain (as long as security_driver != "none"), and it will propogate the error from virStorageFileGetMetadata, causing the domain startup to fail. This is, however, a common scenario when qemu is run as a non-root user and the disk image is stored on NFS. Ignoring this failure (which doesn't matter in this case, since the next thing done by SELinuxSetSecurityImageLabel - setting the file context - will also fail (and that function already ignores failures due to root-squash NFS) will allow us to continue bringing up the domain. The result is that we don't need to disable the entire security driver just because a domain's disk image is stored on root-squashed NFS. --- src/security/security_selinux.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 6680e2d..3e20475 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -430,7 +430,7 @@ SELinuxSetSecurityImageLabel(virDomainObjPtr vm, path = NULL; if (ret < 0) - return -1; + break; if (meta.backingStore != NULL && SELinuxSetFilecon(meta.backingStore, -- 1.6.6.1

2 2

[libvirt] [RFC]: Snapshot API v4
by Chris Lalancette 02 Apr '10

02 Apr '10

Hello, Here is the 4th (and hopefully final) draft for the snapshot API that we've been discussing. There is one minor change and one major change in this draft. The minor change is that we've added a virDomainSnapshotHasCurrent and virDomainSnapshotCurrent methods to get at the current snapshot. The major change is that I've removed all but one of the possible virDomainSnapshotDelete() flags. After reviewing ESX, virtualbox, and qemu, it seems that the deletion of any snapshots that have children will *automatically* merge the changes from that snapshot into the children to keep the children viable. Therefore, the MERGE and MERGE_FORCE flags are nonsensical. Since this is the virDomainSnapshotDelete call, we don't really need a flag to say "delete", so I've removed the DISCARD flag. What that leaves us with is a single flag to the delete API that says to delete this snapshot, and all children of this snapshot. This could be useful to clean out a tree of snapshots instead of doing it one-by-one. If there are no further major objections to this API, we'll be posting patches later today or tomorrow that implement this API for both qemu and virtualbox. Note that I've not included my full notes from last time. If anyone is still interested in those, I can either repost them or send them privately. /* NOTE: struct _virDomainSnapshot is a private structure, ala * struct _virDomain. */ typedef struct _virDomainSnapshot virDomainSnapshot; /* Take a snapshot of the current VM state. */ virDomainSnapshotPtr virDomainSnapshotCreateXML(virDomainPtr domain, const char *xmlDesc, unsigned int flags); /* Dump the XML of a snapshot */ /* NOTE: see below for proposed XML */ char *virDomainSnapshotGetXMLDesc(virDomainSnapshotPtr snapshot, unsigned int flags); /* Return the number of snapshots for this domain */ int virDomainSnapshotNum(virDomainPtr domain, unsigned int flags); /* Get the names of all snapshots for this domain */ int virDomainListSnapshotNames(virDomainPtr domain, char **names, int nameslen, unsigned int flags); /* Get a handle to a named snapshot */ virDomainSnapshotPtr virDomainSnapshotLookupByName(virDomainPtr domain, const char *name, unsigned int flags); /* Find out if domain "domain" has a current snapshot */ int virDomainSnapshotHasCurrent(virDomainPtr domain, unsigned int flags); /* Get a handle to the current in-use snapshot for the domain. */ int virDomainSnapshotCurrent(virDomainPtr domain, unsigned int flags); /* Start the guest from the snapshot "snapshot". Note that * the guest may either be running or not. * * In the case the VM is running, then the snapshot *must* have * been taken while the VM was running (i.e. the snapshot <state> * tag must be "RUNNING"). This will revert the disk and memory to * "snapshot". * * In the case the VM is not running, then the snapshot may * have been taken while the VM was not running or not. In * either case it will revert just the disk to "snapshot". */ int virDomainCreateFromSnapshot(virDomainSnapshotPtr snapshot, unsigned int flags); /* Delete a snapshot. * * TREE: discard this snapshot and any children snapshots * * Note that this operation can happen when the domain is running or shut * down, though this is hypervisor specific */ */ typedef enum { VIR_DOMAIN_SNAPSHOT_DELETE_TREE, } virDomainSnapshotDelete; int virDomainSnapshotDelete(virDomainSnapshotPtr snapshot, unsigned int flags); int virDomainSnapshotFree(virDomainSnapshotPtr snapshot); NOTE: During snapshot creation, *none* of the fields are required. That is, you can call virDomainSnapshotCreateXML() with an XML of "<domainsnapshot/>". In this case, the individual driver will make up a <name> for you, the <creationdate> will be set to the current time+date, <description> will be empty, <state> will be the current state of the VM, and <parent> will be set to the current snapshot (if any). If you do want to specify some fields during virDomainSnapshotCreateXML(), note that the only ones that are settable are <name> and <description>; the rest are ignored, and filled in by the driver when the snapshot is actually created. NOTE: <state> refers to the state of the VM when the snapshot was taken. NOTE: <creationdate> is in the format %Y-%m-%d_%T as defined by strptime. Also note that the granularity of <creationdate> is in seconds. <domainsnapshot> <name>XYZ</name> <creationdate>...</creationdate> <description>...</description> <state>RUNNING</state> <domain> <uuid>XXXXX-XXXX-XXXX-XXXX-XXXXXXXXX</uuid> </domain> <parent> <name>ABC</name> </parent> </domainsnapshot> The virsh commands will be: virsh snapshot-create <dom> [<xmlfile>] virsh snapshot-list <dom> virsh snapshot-dumpxml <dom> <name> virsh start-from-snapshot <dom> <snapshotname> virsh snapshot-delete <dom> <snapshotname> [--children] -- Chris Lalancette

2 2

[libvirt] [PATCH] nwfilter: Some fixes to XML parser
by Stefan Berger 01 Apr '10

01 Apr '10

While writing a couple of test cases for the nwfilter's XML parser I found some cases where the output ended up not looking as expected. So the following changes are in the patch below: - if the protocol ID in the MAC header is an integer, just write it into the datastructure without trying to find a corresponding string for it and if none is found failing - when writing the protocol ID as string, simply write it as integer if no corresponding string can be found - same changes for arpOpcode parsing and printing - same changes for protocol ID in an IP packet - DSCP value needs to be written into the data structure - IP protocol version number is redundant at this level, so remove it - parse the protocol ID found inside an IP packet not only as string but also as uint8 - arrange the display of the src and destination masks to be shown after the src and destination ip address respectively in the XML - the existing libvirt IP address parser accepts for example '25' as an IP address. I want this to be parsed as a CIDR type netmask. So try to parse it as an integer first (CIDR netmask) and if that doesn't work as a dotted IP address style netmask. - instantiation of rules with MAC masks didn't work because they weren't printed into a buffer, yet. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 128 ++++++++++++++---------------- src/nwfilter/nwfilter_ebiptables_driver.c | 1 2 files changed, 61 insertions(+), 68 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -403,15 +403,12 @@ checkMacProtocolID(enum attrDatatype dat virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED) { int32_t res = -1; - const char *str; if (datatype == DATATYPE_STRING) { if (intMapGetByString(macProtoMap, (char *)value, 1, &res) == 0) res = -1; } else if (datatype == DATATYPE_UINT16) { - if (intMapGetByInt(macProtoMap, - (int32_t)*(uint16_t *)value, &str) == 0) - res = -1; + res = (uint32_t)*(uint16_t *)value; } if (res != -1) { @@ -433,9 +430,10 @@ macProtocolIDFormatter(virBufferPtr buf, nwf->p.ethHdrFilter.dataProtocolID.u.u16, &str)) { virBufferVSprintf(buf, "%s", str); - return 1; + } else { + virBufferVSprintf(buf, "%d", nwf->p.ethHdrFilter.dataProtocolID.u.u16); } - return 0; + return 1; } @@ -500,15 +498,12 @@ arpOpcodeValidator(enum attrDatatype dat virNWFilterRuleDefPtr nwf) { int32_t res = -1; - const char *str; if (datatype == DATATYPE_STRING) { if (intMapGetByString(arpOpcodeMap, (char *)value, 1, &res) == 0) res = -1; } else if (datatype == DATATYPE_UINT16) { - if (intMapGetByInt(arpOpcodeMap, - (uint32_t)*(uint16_t *)value, &str) == 0) - res = -1; + res = (uint32_t)*(uint16_t *)value; } if (res != -1) { @@ -530,9 +525,10 @@ arpOpcodeFormatter(virBufferPtr buf, nwf->p.arpHdrFilter.dataOpcode.u.u16, &str)) { virBufferVSprintf(buf, "%s", str); - return 1; + } else { + virBufferVSprintf(buf, "%d", nwf->p.arpHdrFilter.dataOpcode.u.u16); } - return 0; + return 1; } @@ -560,16 +556,12 @@ static bool checkIPProtocolID(enum attrD virNWFilterRuleDefPtr nwf) { int32_t res = -1; - const char *str; if (datatype == DATATYPE_STRING) { if (intMapGetByString(ipProtoMap, (char *)value, 1, &res) == 0) res = -1; } else if (datatype == DATATYPE_UINT8) { - // may just accept what user provides and not test... - if (intMapGetByInt(ipProtoMap, - (uint32_t)*(uint16_t *)value, &str) == 0) - res = -1; + res = (uint32_t)*(uint16_t *)value; } if (res != -1) { @@ -591,19 +583,24 @@ formatIPProtocolID(virBufferPtr buf, nwf->p.ipHdrFilter.ipHdr.dataProtocolID.u.u8, &str)) { virBufferVSprintf(buf, "%s", str); - return 1; + } else { + virBufferVSprintf(buf, "%d", + nwf->p.ipHdrFilter.ipHdr.dataProtocolID.u.u8); } - return 0; + return 1; } static bool dscpValidator(enum attrDatatype datatype ATTRIBUTE_UNUSED, void *val, - virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED) + virNWFilterRuleDefPtr nwf) { uint8_t dscp = *(uint16_t *)val; if (dscp > 63) return 0; + + nwf->p.ipHdrFilter.ipHdr.dataDSCP.u.u8 = dscp; + return 1; } @@ -685,11 +682,6 @@ static const virXMLAttr2Struct arpAttrib static const virXMLAttr2Struct ipAttributes[] = { COMMON_MAC_PROPS(ipHdrFilter), { - .name = "version", - .datatype = DATATYPE_UINT8, - .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.ipHdr.dataIPVersion), - }, - { .name = SRCIPADDR, .datatype = DATATYPE_IPADDR, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.ipHdr.dataSrcIPAddr), @@ -711,7 +703,7 @@ static const virXMLAttr2Struct ipAttribu }, { .name = "protocol", - .datatype = DATATYPE_STRING, + .datatype = DATATYPE_STRING | DATATYPE_UINT8, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.ipHdr.dataProtocolID), .validator= checkIPProtocolID, .formatter= formatIPProtocolID, @@ -756,16 +748,16 @@ static const virXMLAttr2Struct ipv6Attri .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataSrcIPAddr), }, { - .name = DSTIPADDR, - .datatype = DATATYPE_IPV6ADDR, - .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataDstIPAddr), - }, - { .name = SRCIPMASK, .datatype = DATATYPE_IPV6MASK, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataSrcIPMask), }, { + .name = DSTIPADDR, + .datatype = DATATYPE_IPV6ADDR, + .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataDstIPAddr), + }, + { .name = DSTIPMASK, .datatype = DATATYPE_IPV6MASK, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataDstIPMask), @@ -818,16 +810,16 @@ static const virXMLAttr2Struct ipv6Attri .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataSrcIPAddr),\ },\ {\ - .name = DSTIPADDR,\ - .datatype = ADDRTYPE,\ - .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataDstIPAddr),\ - },\ - {\ .name = SRCIPMASK,\ .datatype = MASKTYPE,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataSrcIPMask),\ },\ {\ + .name = DSTIPADDR,\ + .datatype = ADDRTYPE,\ + .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataDstIPAddr),\ + },\ + {\ .name = DSTIPMASK,\ .datatype = MASKTYPE,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataDstIPMask),\ @@ -1276,26 +1268,26 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_IPMASK: storage_ptr = &item->u.u8; - if (!virNWIPv4AddressParser(prop, &ipaddr)) { - if (sscanf(prop, "%d", &int_val) == 1) { - if (int_val >= 0 && int_val <= 32) { - if (!validator) - *(uint8_t *)storage_ptr = - (uint8_t)int_val; - found = 1; - data_ptr = &int_val; - } else - rc = -1; + if (virStrToLong_i(prop, NULL, 10, &int_val) == 0) { + if (int_val >= 0 && int_val <= 32) { + if (!validator) + *(uint8_t *)storage_ptr = + (uint8_t)int_val; + found = 1; + data_ptr = &int_val; } else rc = -1; } else { - int_val = virSocketGetNumNetmaskBits( + if (virNWIPv4AddressParser(prop, &ipaddr)) { + int_val = virSocketGetNumNetmaskBits( &ipaddr.addr); - if (int_val >= 0) - *(uint8_t *)storage_ptr = int_val; - else + if (int_val >= 0) + *(uint8_t *)storage_ptr = int_val; + else + rc = -1; + found = 1; + } else rc = -1; - found = 1; } break; @@ -1330,26 +1322,26 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_IPV6MASK: storage_ptr = &item->u.u8; - if (!virNWIPv6AddressParser(prop, &ipaddr)) { - if (sscanf(prop, "%d", &int_val) == 1) { - if (int_val >= 0 && int_val <= 128) { - if (!validator) - *(uint8_t *)storage_ptr = - (uint8_t)int_val; - found = 1; - data_ptr = &int_val; - } else - rc = -1; + if (virStrToLong_i(prop, NULL, 10, &int_val) == 0) { + if (int_val >= 0 && int_val <= 128) { + if (!validator) + *(uint8_t *)storage_ptr = + (uint8_t)int_val; + found = 1; + data_ptr = &int_val; } else rc = -1; } else { - int_val = virSocketGetNumNetmaskBits( - &ipaddr.addr); - if (int_val >= 0) - *(uint8_t *)storage_ptr = int_val; - else - rc = -1; - found = 1; + if (virNWIPv6AddressParser(prop, &ipaddr)) { + int_val = virSocketGetNumNetmaskBits( + &ipaddr.addr); + if (int_val >= 0) + *(uint8_t *)storage_ptr = int_val; + else + rc = -1; + found = 1; + } else + rc = -1; } break; Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -189,6 +189,7 @@ printDataType(virConnectPtr conn, break; case DATATYPE_MACADDR: + case DATATYPE_MACMASK: if (bufsize < VIR_MAC_STRING_BUFLEN) { virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, _("Buffer too small for MAC address"));

3 3

[libvirt] Node devices XML format
by Dev.Atom 01 Apr '10

01 Apr '10

Hi, I need help about Node devices XML format description, there's no infos at libvirt.org, is there another info source where I can have description of this XML file ? Thanks, Best regards, Arnaud Champion

2 1

[libvirt] [PATCHv2 00/10] Begin to replace scanf and atoi
by Matthias Bolte 01 Apr '10

01 Apr '10

This set of patches is a first step towards removing the scanf and atoi usage in libvirt. I began with the simple cases and post this now to get some feedback before I start to convert the more difficult cases. Changes in v2: - don't test tmp for NULL - note in commit message if parsing is stricter now - don't leak in PRUnicharToInt (vbox) - strip a trailing \n in openvzGetVPSUUID, as it was done before - don't use strspn to skip whitespaces, virStrToLong* does this already - fix virStrToLong* return value tests to check for < 0 instead of < 3 or != 1 - add STRSKIP to skip a given prefix of a string Thanks to Eric Blake and Jim Meyering. Matthias

2 22

[libvirt] [PATCH] ESX test case needs '/' in interface name
by Stefan Berger 01 Apr '10

01 Apr '10

To fix an ESX test case, valid interface names need '/' as valid letter. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Index: libvirt-acl/src/conf/domain_conf.h =================================================================== --- libvirt-acl.orig/src/conf/domain_conf.h +++ libvirt-acl/src/conf/domain_conf.h @@ -298,7 +298,7 @@ struct _virDomainNetDef { }; # define VALID_IFNAME_CHARS \ - "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_" + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_/" enum virDomainChrTargetType { VIR_DOMAIN_CHR_TARGET_TYPE_NULL = 0,

2 2

[libvirt] [PATCH] Fix linker errors in proxy
by Matthias Bolte 31 Mar '10

31 Mar '10

domain_conf.c:494: undefined reference to 'virNWFilterHashTableFree' domain_conf.c:5107: undefined reference to 'virNWFilterFormatParamAttributes' Add missing source to the proxy and disable XML parsing code in nwfilter_params.c for a proxy build. --- proxy/Makefile.am | 2 ++ src/conf/nwfilter_params.c | 2 ++ 2 files changed, 4 insertions(+), 0 deletions(-) diff --git a/proxy/Makefile.am b/proxy/Makefile.am index aef11ca..9ea91d8 100644 --- a/proxy/Makefile.am +++ b/proxy/Makefile.am @@ -15,6 +15,7 @@ libexec_PROGRAMS = libvirt_proxy libvirt_proxy_SOURCES = libvirt_proxy.c \ @top_srcdir@/src/util/buf.c \ + @top_srcdir@/src/util/hash.c \ @top_srcdir@/src/util/logging.c \ @top_srcdir@/src/util/memory.c \ @top_srcdir@/src/util/network.c \ @@ -26,6 +27,7 @@ libvirt_proxy_SOURCES = libvirt_proxy.c \ @top_srcdir@/src/conf/storage_encryption_conf.c \ @top_srcdir@/src/conf/domain_conf.c \ @top_srcdir@/src/conf/cpu_conf.c \ + @top_srcdir@/src/conf/nwfilter_params.c \ @top_srcdir@/src/xen/xend_internal.c \ @top_srcdir@/src/xen/xen_hypervisor.c \ @top_srcdir@/src/xen/sexpr.c \ diff --git a/src/conf/nwfilter_params.c b/src/conf/nwfilter_params.c index 38a51c9..286c5ef 100644 --- a/src/conf/nwfilter_params.c +++ b/src/conf/nwfilter_params.c @@ -214,6 +214,7 @@ err_exit: } +#ifndef PROXY virNWFilterHashTablePtr virNWFilterParseParamAttributes(xmlNodePtr cur) { @@ -254,6 +255,7 @@ skip_entry: } return table; } +#endif struct formatterParam { -- 1.6.3.3

2 2

[libvirt] [PATCH] Fix ./configure: line 27875: [: missing `]'
by Matthias Bolte 31 Mar '10

31 Mar '10

Commit 7998714d60b997357bfea15d6f2d0f729fc8fb29 replaced '-a' with '&& test' but this single '-a' needs to stay. --- configure.ac | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 3c3d7b3..fc87e19 100644 --- a/configure.ac +++ b/configure.ac @@ -240,7 +240,7 @@ AC_ARG_WITH([libvirtd], dnl dnl specific tests to setup DV devel environments with debug etc ... dnl -if [[ "${LOGNAME}" = "veillard" && test "`pwd`" = "/u/veillard/libvirt" ]] ; then +if [[ "${LOGNAME}" = "veillard" -a "`pwd`" = "/u/veillard/libvirt" ]] ; then STATIC_BINARIES="-static" else STATIC_BINARIES= -- 1.6.3.3

2 4

[libvirt] [PATCH] nwfilter: Support for learning a VM's IP address
by Stefan Berger 31 Mar '10

31 Mar '10

Subject: Support for learning a VM's IP address This patch implements support for learning a VM's IP address. It uses the pcap library to listen on the VM's backend network interface (tap) or the physical ethernet device (macvtap) and tries to capture packets with source or destination MAC address of the VM and learn from DHCP Offers, ARP traffic, or first-sent IPv4 packet what the IP address of the VM's interface is. This then allows to instantiate the network traffic filtering rules without the user having to provide the IP parameter somewhere in the filter description or in the interface description as a parameter. This only supports to detect the parameter IP, which is for the assumed single IPv4 address of a VM. There is not support for interfaces that may have multiple IP addresses (IP aliasing) or IPv6 that may then require more than one valid IP address to be detected. A VM can have multiple independent interfaces that each uses a different IP address and in that case it will be attempted to detect each one of the address independently. So, when for example an interface description in the domain XML has looked like this up to now: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'> <parameter name='IP' value='10.2.3.4'/> </filterref> </interface> you may omit the IP parameter: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> Internally I am walking the 'tree' of a VM's referenced network filters and determine with the given variables which variables are missing. Now, the above IP parameter may be missing and this causes a libvirt-internal thread to be started that uses the pcap library's API to listen to the backend interface (in case of macvtap to the physical interface) in an attempt to determine the missing IP parameter. If the backend interface disappears the thread terminates assuming the VM was brought down. In case of a macvtap device a timeout is being used to wait for packets from the given VM (filtering by VM's interface MAC address). If the VM's macvtap device disappeared the thread also terminates. In all other cases it tries to determine the IP address of the VM and will then apply the rules late on the given interface, which would have happened immediately if the IP parameter had been explicitly given. In case an error happens while the firewall rules are applied, the VM's backend interface is 'down'ed preventing it to communicate. Reasons for failure for applying the network firewall rules may that an ebtables/iptables command failes or OOM errors. Essentially the same failure reasons may occur as when the firewall rules are applied immediately on VM start, except that due to the late application of the filtering rules the VM now is already running and cannot be hindered anymore from starting. Bringing down the whole VM would probably be considered too drastic. While a VM's IP address is attempted to be determined only limited updates to network filters are allowed. In particular it is prevented that filters are modified in such a way that they would introduce new variables. A caveat: The algorithm does not know which one is the appropriate IP address of a VM. If the VM spoofs an IP address in its first ARP traffic or IPv4 packets its filtering rules will be instantiated for this IP address, thus 'locking' it to the found IP address. So, it's still 'safer' to explicitly provide the IP address of a VM's interface in the filter description if it is known beforehand. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- configure.ac | 39 ++ src/Makefile.am | 13 src/conf/nwfilter_conf.c | 7 src/conf/nwfilter_conf.h | 3 src/libvirt_private.syms | 12 src/nwfilter/nwfilter_driver.c | 11 src/nwfilter/nwfilter_ebiptables_driver.c | 100 +++++ src/nwfilter/nwfilter_ebiptables_driver.h | 7 src/nwfilter/nwfilter_gentech_driver.c | 408 +++++++++++++++++++-- src/nwfilter/nwfilter_gentech_driver.h | 14 src/nwfilter/nwfilter_learnipaddr.c | 579 ++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_learnipaddr.h | 61 +++ 12 files changed, 1216 insertions(+), 38 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -0,0 +1,61 @@ +/* + * nwfilter_learnipaddr.h: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#ifndef __NWFILTER_LEARNIPADDR_H +#define __NWFILTER_LEARNIPADDR_H + +typedef struct _virNWFilterIPAddrLearnReq virNWFilterIPAddrLearnReq; +typedef virNWFilterIPAddrLearnReq *virNWFilterIPAddrLearnReqPtr; +struct _virNWFilterIPAddrLearnReq { + char ifname[IF_NAMESIZE]; + char linkdev[IF_NAMESIZE]; + enum virDomainNetType nettype; + unsigned char macaddr[VIR_MAC_BUFLEN]; + char *filtername; + virNWFilterHashTablePtr filterparams; + virNWFilterDriverStatePtr driver; + + int status; + pthread_t thread; +}; + +int virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); + +virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(const char *ifname); + + +void virNWFilterDelIpAddrForIfname(const char *ifname); +const char *virNWFilterGetIpAddrForIfname(const char *ifname); + +int virNWFilterLearnInit(void); +void virNWFilterLearnShutdown(void); + +#endif /* __NWFILTER_LEARNIPADDR_H */ Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -0,0 +1,579 @@ +/* + * nwfilter_learnipaddr.c: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#include <config.h> + +#ifdef HAVE_LIBPCAP +#include <pcap.h> +#endif + +#include <fcntl.h> +#include <sys/ioctl.h> + +#include <arpa/inet.h> +#include <net/ethernet.h> +#include <netinet/ip.h> +#include <netinet/udp.h> +#include <net/if_arp.h> +#include <linux/if.h> + +#include "internal.h" + +#include "buf.h" +#include "memory.h" +#include "logging.h" +#include "datatypes.h" +#include "virterror_internal.h" +#include "threads.h" +#include "conf/nwfilter_params.h" +#include "conf/domain_conf.h" +#include "nwfilter_gentech_driver.h" +#include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + + +/* structure of an ARP request/reply message */ +struct f_arphdr { + struct arphdr arphdr; + uint8_t ar_sha[ETH_ALEN]; + uint32_t ar_sip; + uint8_t ar_tha[ETH_ALEN]; + uint32_t ar_tip; +} __attribute__((packed)); + + +/* structure representing DHCP message */ +struct dhcp { + uint8_t op; + uint8_t htype; + uint8_t hlen; + uint8_t hops; + uint32_t xid; + uint16_t secs; + uint16_t flags; + uint32_t ciaddr; + uint32_t yiaddr; + uint32_t siaddr; + uint32_t giaddr; + uint32_t chaddr; + /* omitted */ +} __attribute__((packed)); + + +struct ether_vlan_header +{ + uint8_t dhost[ETH_ALEN]; + uint8_t shost[ETH_ALEN]; + uint16_t vlan_type; + uint16_t vlan_flags; + uint16_t ether_type; +} __attribute__((packed)); + + +static virMutex pendingLearnReqLock; +static virHashTablePtr pendingLearnReq; + +static virMutex ipAddressMapLock; +static virNWFilterHashTablePtr ipAddressMap; + + +static void +virNWFilterIPAddrLearnReqFree(virNWFilterIPAddrLearnReqPtr req) { + if (!req) + return; + + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->filterparams); + + VIR_FREE(req); +} + + +#if HAVE_LIBPCAP + +static int +virNWFilterRegisterLearnReq(virNWFilterIPAddrLearnReqPtr req) { + int res = -1; + virMutexLock(&pendingLearnReqLock); + + if (!virHashLookup(pendingLearnReq, req->ifname)) + res = virHashAddEntry(pendingLearnReq, req->ifname, req); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + +#endif + + +virNWFilterIPAddrLearnReqPtr +virNWFilterLookupLearnReq(const char *ifname) { + void *res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + +static void +freeLearnReqEntry(void *payload, const char *name ATTRIBUTE_UNUSED) { + virNWFilterIPAddrLearnReqFree(payload); +} + + +#ifdef HAVE_LIBPCAP + +static virNWFilterIPAddrLearnReqPtr +virNWFilterDeregisterLearnReq(const char *ifname) { + virNWFilterIPAddrLearnReqPtr res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + if (res) + virHashRemoveEntry(pendingLearnReq, ifname, NULL); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + + +static int +virNWFilterAddIpAddrForIfname(const char *ifname, char *addr) { + int ret; + + virMutexLock(&ipAddressMapLock); + + ret = virNWFilterHashTablePut(ipAddressMap, ifname, addr, 1); + + virMutexUnlock(&ipAddressMapLock); + + return ret; +} +#endif + + +void +virNWFilterDelIpAddrForIfname(const char *ifname) { + + virMutexLock(&ipAddressMapLock); + + if (virHashLookup(ipAddressMap->hashTable, ifname)) + virNWFilterHashTableRemoveEntry(ipAddressMap, ifname); + + virMutexUnlock(&ipAddressMapLock); +} + + +const char * +virNWFilterGetIpAddrForIfname(const char *ifname) { + const char *res; + + virMutexLock(&ipAddressMapLock); + + res = virHashLookup(ipAddressMap->hashTable, ifname); + + virMutexUnlock(&ipAddressMapLock); + + return res; +} + + +#ifdef HAVE_LIBPCAP + +/** + * learnIPAddressThread + * arg: pointer to virNWFilterIPAddrLearnReq structure + * + * Learn the IP address being used on an interface. Use ARP Request and + * Reply messages, DHCP offers and the first IP packet being sent from + * the VM to detect the IP address it is using. Detects only one IP address + * per interface (IP aliasing not supported) + */ +static void * +learnIPAddressThread(void *arg) +{ + char errbuf[PCAP_ERRBUF_SIZE] = {0}; + pcap_t *handle; + struct bpf_program fp; + struct pcap_pkthdr header; + const u_char *packet; + struct ether_header *ether_hdr; + struct ether_vlan_header *vlan_hdr; + virNWFilterIPAddrLearnReqPtr req = arg; + uint32_t vmaddr = 0; + unsigned int ethHdrSize; + char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev + : req->ifname; + int to_ms = (strlen(req->linkdev) != 0) ? 1000 + : 0; + char macaddr[VIR_MAC_STRING_BUFLEN]; + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *filter= NULL; + uint16_t etherType; + + req->status = 0; + + handle = pcap_open_live(listen_if, BUFSIZ, 0, to_ms, errbuf); + + if (handle == NULL) { + VIR_DEBUG("Couldn't open device %s: %s\n", listen_if, errbuf); + req->status = ENODEV; + goto done; + } + + virFormatMacAddr(req->macaddr, macaddr); + virBufferVSprintf(&buf, "ether host %s", macaddr); + if (virBufferError(&buf)) { + req->status = ENOMEM; + goto done; + } + + filter = virBufferContentAndReset(&buf); + + if (pcap_compile(handle, &fp, filter, 1, 0) != 0 || + pcap_setfilter(handle, &fp) != 0) { + VIR_DEBUG("Couldn't compile or set filter '%s'.\n", filter); + req->status = EINVAL; + goto done; + } + + while (req->status == 0 && vmaddr == 0) { + packet = pcap_next(handle, &header); + + if (!packet) { + if (to_ms == 0) { + /* assuming IF disappeared */ + req->status = ENODEV; + break; + } + /* listening on linkdev, check whether VM's dev is still there */ + if (checkIf(req->ifname, req->macaddr)) { + req->status = ENODEV; + break; + } + continue; + } + + if (header.len >= sizeof(struct ether_header)) { + ether_hdr = (struct ether_header*)packet; + + switch (ntohs(ether_hdr->ether_type)) { + + case ETHERTYPE_IP: + ethHdrSize = sizeof(struct ether_header); + etherType = ntohs(ether_hdr->ether_type); + break; + + case ETHERTYPE_VLAN: + ethHdrSize = sizeof(struct ether_vlan_header); + vlan_hdr = (struct ether_vlan_header *)packet; + if (ntohs(vlan_hdr->ether_type) != ETHERTYPE_IP || + header.len < ethHdrSize) + continue; + etherType = ntohs(vlan_hdr->ether_type); + break; + + default: + continue; + } + + if (memcmp(ether_hdr->ether_shost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets from the VM + + if ((header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + vmaddr = iphdr->saddr; + // skip eth. bcast and mcast addresses, + // and zero address in DHCP Requests + if ((ntohl(vmaddr) & 0xc0000000) || vmaddr == 0) { + vmaddr = 0; + continue; + } + + } else if (etherType == ETHERTYPE_ARP && + (header.len >= ethHdrSize + + sizeof(struct f_arphdr))) { + struct f_arphdr *arphdr = (struct f_arphdr*)(packet + + ethHdrSize); + switch (ntohs(arphdr->arphdr.ar_op)) { + case ARPOP_REPLY: + vmaddr = arphdr->ar_sip; + break; + case ARPOP_REQUEST: + vmaddr = arphdr->ar_tip; + break; + } + } + } else if (memcmp(ether_hdr->ether_dhost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets to the VM + if (etherType == ETHERTYPE_IP && + (header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + if ((iphdr->protocol == IPPROTO_UDP) && + (header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr))) { + struct udphdr *udphdr= (struct udphdr *) + ((char *)iphdr + iphdr->ihl * 4); + if (ntohs(udphdr->source) == 67 && + ntohs(udphdr->dest) == 68 && + header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr) + + sizeof(struct dhcp)) { + struct dhcp *dhcp = (struct dhcp *) + ((char *)udphdr + sizeof(udphdr)); + if (dhcp->op == 2 /* DHCP OFFER */) { + vmaddr = dhcp->yiaddr; + } + } + } + } + } + } + } + + done: + VIR_FREE(filter); + + if (handle) + pcap_close(handle); + + ebtablesRemoveBasicRules(NULL, req->ifname); + + if (req->status == 0) { + int ret; + char inetaddr[INET_ADDRSTRLEN]; + inet_ntop(AF_INET, &vmaddr, inetaddr, sizeof(inetaddr)); + + virNWFilterAddIpAddrForIfname(req->ifname, strdup(inetaddr)); + + ret = virNWFilterInstantiateFilterLate(NULL, + req->ifname, + req->linkdev, + req->nettype, + req->macaddr, + req->filtername, + req->filterparams, + req->driver); + VIR_DEBUG("Result from applying firewall rules on " + "%s with IP addr %s : %d\n", req->ifname, inetaddr, ret); + } + + memset(&req->thread, 0x0, sizeof(req->thread)); + + VIR_DEBUG("pcap thread terminating for interface %s\n",req->ifname); + + virNWFilterDeregisterLearnReq(req->ifname); + + virNWFilterIPAddrLearnReqFree(req); + + return 0; +} + + +/** + * virNWFilterLearnIPAddress + * @conn: pointer to virConnect object + * @ifname: the name of the interface + * @linkdev : the name of the link device; currently only used in case of a + * macvtap device + * @nettype : the type of interface + * @macaddr : the MAC address of the interface + * @filtername : the name of the top-level filter to apply to the interface + * once its IP address has been detected + * @driver : the network filter driver + * + * Instruct to learn the IP address being used on a given interface (ifname). + * Unless there already is a thread attempting to learn the IP address + * being used on the interface, a thread is started that will listen on + * the traffic being sent on the interface (or link device) with the + * MAC address that is provided. Will then launch the application of the + * firewall rules on the interface. + */ +int +virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) { + int rc; + virNWFilterIPAddrLearnReqPtr req = NULL; + virNWFilterHashTablePtr ht = NULL; + + if (VIR_ALLOC(req) < 0) { + virReportOOMError(); + goto err_exit; + } + + ht = virNWFilterHashTableCreate(0); + if (ht == NULL) { + virReportOOMError(); + goto err_exit; + } + + if (virNWFilterHashTablePutAll(conn, filterparams, ht)) + goto err_exit; + + req->filtername = strdup(filtername); + if (req->filtername == NULL) { + virReportOOMError(); + goto err_exit; + } + + if (virStrcpyStatic(req->ifname, ifname) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for ifname ('%s') " + "not large enough"), ifname); + goto err_exit; + } + + if (linkdev) { + if (virStrcpyStatic(req->linkdev, linkdev) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for linkdev ('%s') " + "not large enough"), linkdev); + goto err_exit; + } + } + req->nettype = nettype; + memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); + req->driver = driver; + req->filterparams = ht; + ht = NULL; + + rc = virNWFilterRegisterLearnReq(req); + + if (rc) + goto err_exit; + + if (ebtablesApplyBasicRules(conn, + ifname, + macaddr)) { + goto err_exit; + } + + if (pthread_create(&req->thread, + NULL, + learnIPAddressThread, + req) != 0) + goto err_exit; + + return 0; + +err_exit: + ebtablesRemoveBasicRules(conn, ifname); + virNWFilterIPAddrLearnReqFree(req); + virNWFilterHashTableFree(ht); + return 1; +} + +#else + +int +virNWFilterLearnIPAddress(virConnectPtr conn ATTRIBUTE_UNUSED, + const char *ifname ATTRIBUTE_UNUSED, + const char *linkdev ATTRIBUTE_UNUSED, + enum virDomainNetType nettype ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED, + const char *filtername ATTRIBUTE_UNUSED, + virNWFilterHashTablePtr filterparams ATTRIBUTE_UNUSED, + virNWFilterDriverStatePtr driver ATTRIBUTE_UNUSED) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("IP parameter must be given since libvirt " + "was not compiled with IP address learning " + "support")); + return 1; +} +#endif /* HAVE_LIBPCAP */ + + +/** + * virNWFilterLearnInit + * Initialization of this layer + */ +int +virNWFilterLearnInit(void) { + pendingLearnReq = virHashCreate(0); + if (!pendingLearnReq) { + virReportOOMError(); + return 1; + } + + if (virMutexInit(&pendingLearnReqLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + ipAddressMap = virNWFilterHashTableCreate(0); + if (!ipAddressMap) { + virReportOOMError(); + virNWFilterLearnShutdown(); + return 1; + } + + if (virMutexInit(&ipAddressMapLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + return 0; +} + + +/** + * virNWFilterLearnShutdown + * Shutdown of this layer + */ +void +virNWFilterLearnShutdown(void) { + virHashFree(pendingLearnReq, freeLearnReqEntry); + pendingLearnReq = NULL; + + virNWFilterHashTableFree(ipAddressMap); + ipAddressMap = NULL; +} Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -289,7 +289,8 @@ STORAGE_HELPER_DISK_SOURCES = \ NWFILTER_DRIVER_SOURCES = \ nwfilter/nwfilter_driver.h nwfilter/nwfilter_driver.c \ nwfilter/nwfilter_gentech_driver.c \ - nwfilter/nwfilter_ebiptables_driver.c + nwfilter/nwfilter_ebiptables_driver.c \ + nwfilter/nwfilter_learnipaddr.c # Security framework and drivers for various models SECURITY_DRIVER_SOURCES = \ @@ -740,10 +741,11 @@ else libvirt_la_LIBADD += libvirt_driver_nwfilter.la noinst_LTLIBRARIES += libvirt_driver_nwfilter.la endif -libvirt_driver_nwfilter_la_CFLAGS = \ +libvirt_driver_nwfilter_la_CFLAGS = $(LIBPCAP_CFLAGS) \ -I@top_srcdir@/src/conf +libvirt_driver_nwfilter_la_LDFLAGS = $(LIBPCAP_LIBS) if WITH_DRIVER_MODULES -libvirt_driver_nwfilter_la_LDFLAGS = -module -avoid-version ../gnulib/lib/libgnu.la +libvirt_driver_nwfilter_la_LDFLAGS += -module -avoid-version ../gnulib/lib/libgnu.la endif libvirt_driver_nwfilter_la_SOURCES = $(NWFILTER_DRIVER_SOURCES) endif @@ -887,6 +889,7 @@ libvirt_la_LDFLAGS = $(VERSION_SCRIPT_FL -version-info $(LIBVIRT_VERSION_INFO) \ $(COVERAGE_CFLAGS:-f%=-Wc,-f%) \ $(LIBXML_LIBS) \ + $(LIBPCAP_LIBS) \ $(DRIVER_MODULE_LIBS) \ $(CYGWIN_EXTRA_LDFLAGS) $(MINGW_EXTRA_LDFLAGS) libvirt_la_CFLAGS = $(COVERAGE_CFLAGS) -DIN_LIBVIRT @@ -935,8 +938,8 @@ libvirt_lxc_SOURCES = \ $(NODE_INFO_SOURCES) \ $(ENCRYPTION_CONF_SOURCES) \ $(DOMAIN_CONF_SOURCES) \ - $(NWFILTER_PARAM_CONF_SOURCES) \ - $(CPU_CONF_SOURCES) + $(CPU_CONF_SOURCES) \ + $(NWFILTER_PARAM_CONF_SOURCES) libvirt_lxc_LDFLAGS = $(WARN_CFLAGS) $(COVERAGE_LDCFLAGS) $(CAPNG_LIBS) $(YAJL_LIBS) libvirt_lxc_LDADD = $(LIBXML_LIBS) $(NUMACTL_LIBS) ../gnulib/lib/libgnu.la libvirt_lxc_CFLAGS = \ Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -24,6 +24,9 @@ #include <config.h> #include <stdint.h> +#include <sys/socket.h> +#include <sys/ioctl.h> +#include <linux/if.h> #include "internal.h" @@ -34,12 +37,16 @@ #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER #define NWFILTER_STD_VAR_MAC "MAC" +#define NWFILTER_STD_VAR_IP "IP" + +static int _virNWFilterTeardownFilter(const char *ifname); static virNWFilterTechDriverPtr filter_tech_drivers[] = { @@ -111,6 +118,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI * @tables: pointer to hash tabel to add values to * @macaddr: The string of the MAC address to add to the hash table, * may be NULL + * @ipaddr: The string of the IP address to add to the hash table; + * may be NULL * * Returns 0 in case of success, 1 in case an error happened with * error having been reported. @@ -120,7 +129,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI static int virNWFilterVarHashmapAddStdValues(virConnectPtr conn, virNWFilterHashTablePtr table, - char *macaddr) + char *macaddr, + char *ipaddr) { if (macaddr) { if (virHashAddEntry(table->hashTable, @@ -132,6 +142,16 @@ virNWFilterVarHashmapAddStdValues(virCon } } + if (ipaddr) { + if (virHashAddEntry(table->hashTable, + NWFILTER_STD_VAR_IP, + ipaddr) < 0) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + "%s", _("Could not add variable 'IP' to hashmap")); + return 1; + } + } + return 0; } @@ -140,23 +160,26 @@ virNWFilterVarHashmapAddStdValues(virCon * virNWFilterCreateVarHashmap: * @conn: pointer to virConnect object * @macaddr: pointer to string containing formatted MAC address of interface + * @ipaddr: pointer to string containing formatted IP address used by + * VM on this interface; may be NULL * * Create a hashmap used for evaluating the firewall rules. Initializes - * it with the standard variable 'MAC'. + * it with the standard variable 'MAC' and 'IP' if provided. * * Returns pointer to hashmap, NULL if an error occcurred and error message * is attached to the virConnect object. */ virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr) { + char *macaddr, + char *ipaddr) { virNWFilterHashTablePtr table = virNWFilterHashTableCreate(0); if (!table) { virReportOOMError(); return NULL; } - if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr)) { + if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr, ipaddr)) { virNWFilterHashTableFree(table); return NULL; } @@ -284,9 +307,9 @@ _virNWFilterInstantiateRec(virConnectPtr virNWFilterHashTablePtr vars, int *nEntries, virNWFilterRuleInstPtr **insts, - enum instCase useNewFilter, int *foundNewFilter) + enum instCase useNewFilter, int *foundNewFilter, + virNWFilterDriverStatePtr driver) { - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterPoolObjPtr obj; int rc = 0; int i; @@ -365,7 +388,96 @@ _virNWFilterInstantiateRec(virConnectPtr tmpvars, nEntries, insts, useNewFilter, - foundNewFilter); + foundNewFilter, + driver); + + virNWFilterHashTableFree(tmpvars); + + virNWFilterPoolObjUnlock(obj); + if (rc) + break; + } else { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("referenced filter '%s' is missing"), + inc->filterref); + rc = 1; + break; + } + } + } + return rc; +} + + +static int +virNWFilterDetermineMissingVarsRec(virConnectPtr conn, + virNWFilterDefPtr filter, + virNWFilterHashTablePtr vars, + virNWFilterHashTablePtr missing_vars, + int useNewFilter, + virNWFilterDriverStatePtr driver) +{ + virNWFilterPoolObjPtr obj; + int rc = 0; + int i, j; + virNWFilterDefPtr next_filter; + + for (i = 0; i < filter->nentries; i++) { + virNWFilterRuleDefPtr rule = filter->filterEntries[i]->rule; + virNWFilterIncludeDefPtr inc = filter->filterEntries[i]->include; + if (rule) { + // check all variables of this rule + for (j = 0; j < rule->nvars; j++) { + if (!virHashLookup(vars->hashTable, rule->vars[j])) { + virNWFilterHashTablePut(missing_vars, rule->vars[j], + strdup("1"), 1); + } + } + } else if (inc) { + VIR_DEBUG("Following filter %s\n", inc->filterref); + obj = virNWFilterPoolObjFindByName(&driver->pools, + inc->filterref); + if (obj) { + + if (obj->wantRemoved) { + virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + _("Filter '%s' is in use."), + inc->filterref); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + // create a temporary hashmap for depth-first tree traversal + virNWFilterHashTablePtr tmpvars = + virNWFilterCreateVarsFrom(conn, + inc->params, + vars); + if (!tmpvars) { + virReportOOMError(); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + next_filter = obj->def; + + switch (useNewFilter) { + case INSTANTIATE_FOLLOW_NEWFILTER: + if (obj->newDef) { + next_filter = obj->newDef; + } + break; + case INSTANTIATE_ALWAYS: + break; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + next_filter, + tmpvars, + missing_vars, + useNewFilter, + driver); virNWFilterHashTableFree(tmpvars); @@ -438,9 +550,12 @@ virNWFilterInstantiate(virConnectPtr con enum virDomainNetType nettype, virNWFilterDefPtr filter, const char *ifname, + const char *linkdev, virNWFilterHashTablePtr vars, enum instCase useNewFilter, int *foundNewFilter, - bool teardownOld) + bool teardownOld, + const unsigned char *macaddr, + virNWFilterDriverStatePtr driver) { int rc; int j, nptrs; @@ -449,6 +564,44 @@ virNWFilterInstantiate(virConnectPtr con void **ptrs = NULL; int instantiate = 1; + virNWFilterLockFilterUpdates(); + + virNWFilterHashTablePtr missing_vars = virNWFilterHashTableCreate(0); + if (!missing_vars) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + filter, + vars, + missing_vars, + useNewFilter, + driver); + if (rc) + goto err_exit; + + if (virHashSize(missing_vars->hashTable) == 1) { + if (virHashLookup(missing_vars->hashTable, + NWFILTER_STD_VAR_IP) != NULL) { + if (virNWFilterLookupLearnReq(ifname) == NULL) { + rc = virNWFilterLearnIPAddress(conn, + ifname, + linkdev, + nettype, macaddr, + filter->name, + vars, driver); + } + goto err_exit; + } + rc = 1; + goto err_exit; + } else if (virHashSize(missing_vars->hashTable) > 1) { + rc = 1; + goto err_exit; + } + rc = _virNWFilterInstantiateRec(conn, techdriver, nettype, @@ -456,7 +609,8 @@ virNWFilterInstantiate(virConnectPtr con ifname, vars, &nEntries, &insts, - useNewFilter, foundNewFilter); + useNewFilter, foundNewFilter, + driver); if (rc) goto err_exit; @@ -487,24 +641,33 @@ virNWFilterInstantiate(virConnectPtr con err_exit: + virNWFilterUnlockFilterUpdates(); + for (j = 0; j < nEntries; j++) virNWFilterRuleInstFree(insts[j]); VIR_FREE(insts); + virNWFilterHashTableFree(missing_vars); + return rc; } static int -_virNWFilterInstantiateFilter(virConnectPtr conn, - const virDomainNetDefPtr net, - bool teardownOld, - enum instCase useNewFilter) +__virNWFilterInstantiateFilter(virConnectPtr conn, + bool teardownOld, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + enum instCase useNewFilter, + virNWFilterDriverStatePtr driver) { int rc; const char *drvname = EBIPTABLES_DRIVER_ID; - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterTechDriverPtr techdriver; virNWFilterPoolObjPtr obj; virNWFilterHashTablePtr vars, vars1; @@ -512,6 +675,8 @@ _virNWFilterInstantiateFilter(virConnect char vmmacaddr[VIR_MAC_STRING_BUFLEN] = {0}; int foundNewFilter = 0; char *str_macaddr = NULL; + const char *ipaddr; + char *str_ipaddr = NULL; techdriver = virNWFilterTechDriverForName(drvname); @@ -523,25 +688,25 @@ _virNWFilterInstantiateFilter(virConnect return 1; } - VIR_DEBUG("filter name: %s\n", net->filter); + VIR_DEBUG("filter name: %s\n", filtername); - obj = virNWFilterPoolObjFindByName(&driver->pools, net->filter); + obj = virNWFilterPoolObjFindByName(&driver->pools, filtername); if (!obj) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Could not find filter '%s'"), - net->filter); + filtername); return 1; } if (obj->wantRemoved) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Filter '%s' is in use."), - net->filter); + filtername); rc = 1; goto err_exit; } - virFormatMacAddr(net->mac, vmmacaddr); + virFormatMacAddr(macaddr, vmmacaddr); str_macaddr = strdup(vmmacaddr); if (!str_macaddr) { virReportOOMError(); @@ -549,18 +714,29 @@ _virNWFilterInstantiateFilter(virConnect goto err_exit; } + ipaddr = virNWFilterGetIpAddrForIfname(ifname); + if (ipaddr) { + str_ipaddr = strdup(ipaddr); + if (!str_ipaddr) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + } + vars1 = virNWFilterCreateVarHashmap(conn, - str_macaddr); + str_macaddr, str_ipaddr); if (!vars1) { rc = 1; goto err_exit; } str_macaddr = NULL; + str_ipaddr = NULL; vars = virNWFilterCreateVarsFrom(conn, vars1, - net->filterparams); + filterparams); if (!vars) { rc = 1; goto err_exit_vars1; @@ -582,12 +758,15 @@ _virNWFilterInstantiateFilter(virConnect rc = virNWFilterInstantiate(conn, techdriver, - net->type, + nettype, filter, - net->ifname, + ifname, + linkdev, vars, useNewFilter, &foundNewFilter, - teardownOld); + teardownOld, + macaddr, + driver); virNWFilterHashTableFree(vars); @@ -595,15 +774,180 @@ err_exit_vars1: virNWFilterHashTableFree(vars1); err_exit: - virNWFilterPoolObjUnlock(obj); + VIR_FREE(str_ipaddr); VIR_FREE(str_macaddr); return rc; } +static int +_virNWFilterInstantiateFilter(virConnectPtr conn, + const virDomainNetDefPtr net, + bool teardownOld, + enum instCase useNewFilter) +{ + const char *linkdev = (net->type == VIR_DOMAIN_NET_TYPE_DIRECT) + ? net->data.direct.linkdev + : NULL; + return __virNWFilterInstantiateFilter(conn, + teardownOld, + net->ifname, + linkdev, + net->type, + net->mac, + net->filter, + net->filterparams, + useNewFilter, + conn->nwfilterPrivateData); +} + + +// FIXME: move chgIfFlags, ifUp, checkIf into common file & share w/ macvtap.c + +/* + * chgIfFlags: Change flags on an interface + * @ifname : name of the interface + * @flagclear : the flags to clear + * @flagset : the flags to set + * + * The new flags of the interface will be calculated as + * flagmask = (~0 ^ flagclear) + * newflags = (curflags & flagmask) | flagset; + * + * Returns 0 on success, errno on failure. + */ +static int chgIfFlags(const char *ifname, short flagclear, short flagset) { + struct ifreq ifr; + int rc = 0; + int flags; + short flagmask = (~0 ^ flagclear); + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + flags = (ifr.ifr_flags & flagmask) | flagset; + + if (ifr.ifr_flags != flags) { + ifr.ifr_flags = flags; + + if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) + rc = errno; + } + +err_exit: + close(fd); + return rc; +} + +/* + * ifUp + * @name: name of the interface + * @up: 1 for up, 0 for down + * + * Function to control if an interface is activated (up, 1) or not (down, 0) + * + * Returns 0 in case of success or an errno code in case of failure. + */ +static int +ifUp(const char *name, int up) +{ + return chgIfFlags(name, + (up) ? 0 : IFF_UP, + (up) ? IFF_UP : 0); +} + + +/** + * checkIf + * + * @ifname: Name of the interface + * @macaddr: expected MAC address of the interface + * + * FIXME: the interface's index is another good parameter to check + * + * Determine whether a given interface is still available. If so, + * it must have the given MAC address. + * + * Returns an error code ENODEV in case the interface does not exist + * anymore or its MAC address is different, 0 otherwise. + */ +int +checkIf(const char *ifname, const unsigned char *macaddr) +{ + struct ifreq ifr; + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + int rc = 0; + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + if (memcmp(&ifr.ifr_hwaddr.sa_data, macaddr, 6) != 0) + rc = ENODEV; + + err_exit: + close(fd); + return rc; +} + + +int +virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) +{ + int rc; + rc = __virNWFilterInstantiateFilter(conn, + 1, + ifname, + linkdev, + nettype, + macaddr, + filtername, + filterparams, + INSTANTIATE_ALWAYS, + driver); + if (rc) { + //something went wrong... 'DOWN' the interface + if (ifUp(ifname ,0)) { + // assuming interface disappeared... + _virNWFilterTeardownFilter(ifname); + } + } + return rc; +} + + int virNWFilterInstantiateFilter(virConnectPtr conn, const virDomainNetDefPtr net) @@ -660,8 +1004,8 @@ virNWFilterTearOldFilter(virConnectPtr c } -int -virNWFilterTeardownFilter(const virDomainNetDefPtr net) +static int +_virNWFilterTeardownFilter(const char *ifname) { const char *drvname = EBIPTABLES_DRIVER_ID; virNWFilterTechDriverPtr techdriver; @@ -676,13 +1020,21 @@ virNWFilterTeardownFilter(const virDomai #endif return 1; } + techdriver->allTeardown(ifname); - techdriver->allTeardown(net->ifname); + virNWFilterDelIpAddrForIfname(ifname); return 0; } +int +virNWFilterTeardownFilter(const virDomainNetDefPtr net) +{ + return _virNWFilterTeardownFilter(net->ifname); +} + + void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -37,6 +37,8 @@ #include "nwfilter_gentech_driver.h" +#include "nwfilter_learnipaddr.h" + #define VIR_FROM_THIS VIR_FROM_NWFILTER #define nwfilterLog(msg...) fprintf(stderr, msg) @@ -65,9 +67,12 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; - if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + if (virNWFilterLearnInit() < 0) return -1; + if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + goto conf_init_err; + if (VIR_ALLOC(driverState) < 0) goto alloc_err_exit; @@ -120,6 +125,9 @@ error: alloc_err_exit: virNWFilterConfLayerShutdown(); +conf_init_err: + virNWFilterLearnShutdown(); + return -1; } @@ -413,5 +421,6 @@ static virStateDriver stateDriver = { int nwfilterRegister(void) { virRegisterNWFilterDriver(&nwfilterDriver); virRegisterStateDriver(&stateDriver); + virNWFilterLearnInit(); return 0; } Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -46,13 +46,25 @@ int virNWFilterRollbackUpdateFilter(virC int virNWFilterTearOldFilter(virConnectPtr conn, const virDomainNetDefPtr net); +int virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); + int virNWFilterTeardownFilter(const virDomainNetDefPtr net); virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr); + char *macaddr, + char *ipaddr); void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, void *data); +int checkIf(const char *ifname, const unsigned char *macaddr); + #endif Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -488,6 +488,8 @@ virNWFilterRegisterCallbackDriver; virNWFilterTestUnassignDef; virNWFilterConfLayerInit; virNWFilterConfLayerShutdown; +virNWFilterLockFilterUpdates; +virNWFilterUnlockFilterUpdates; #nwfilter_params.h @@ -503,6 +505,16 @@ virNWFilterInstantiateFilter; virNWFilterTeardownFilter; +#nwfilter_learnipaddr.h +ipAddressMap; +ipAddressMapLock; +pendingLearnReq; +pendingLearnReqLock; +virNWFilterGetIpAddrForIfname; +virNWFilterDelIpAddrForIfname; +virNWFilterLookupLearnReq; + + # pci.h pciGetDevice; pciFreeDevice; Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -111,17 +111,18 @@ struct int_map { */ static virMutex updateMutex; -static void +void virNWFilterLockFilterUpdates(void) { virMutexLock(&updateMutex); } -static void +void virNWFilterUnlockFilterUpdates(void) { virMutexUnlock(&updateMutex); } + /* * attribute names for the rules XML */ @@ -2731,7 +2732,7 @@ int virNWFilterConfLayerInit(virHashIter { virNWFilterDomainFWUpdateCB = domUpdateCB; - if (virMutexInit(&updateMutex)) + if (virMutexInitRecursive(&updateMutex)) return 1; if (virNWFilterParamConfLayerInit()) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -565,6 +565,9 @@ virNWFilterDefPtr virNWFilterDefParseFil void virNWFilterPoolObjLock(virNWFilterPoolObjPtr obj); void virNWFilterPoolObjUnlock(virNWFilterPoolObjPtr obj); +void virNWFilterLockFilterUpdates(void); +void virNWFilterUnlockFilterUpdates(void); + int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -2533,6 +2533,106 @@ ebiptablesInstCommand(virConnectPtr conn } +int +ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + char chain[MAX_CHAINNAME_LENGTH]; + char chainPrefix = CHAINPREFIX_HOST_IN_TEMP; + char macaddr_str[VIR_MAC_STRING_BUFLEN]; + + virFormatMacAddr(macaddr, macaddr_str); + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebiptablesExecCLI(conn, &buf, &cli_status); + + ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + + PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p IPv4 -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p ARP -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + + if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + goto tear_down_tmpebchains; + + return 0; + +tear_down_tmpebchains: + ebtablesRemoveBasicRules(conn, ifname); + + virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + "%s", + _("Some rules could not be created.")); + + return 1; +} + + +int +ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + + ebiptablesExecCLI(conn, &buf, &cli_status); + return 0; +} + + static int ebiptablesRuleOrderSort(const void *a, const void *b) { Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h @@ -45,4 +45,11 @@ extern virNWFilterTechDriver ebiptables_ # define EBIPTABLES_DRIVER_ID "ebiptables" + +int ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr); +int ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname); + #endif Index: libvirt-acl/configure.ac =================================================================== --- libvirt-acl.orig/configure.ac +++ libvirt-acl/configure.ac @@ -41,6 +41,7 @@ XMLRPC_REQUIRED=1.14.0 HAL_REQUIRED=0.5.0 DEVMAPPER_REQUIRED=1.0.0 LIBCURL_REQUIRED="7.18.0" +LIBPCAP_REQUIRED="1.0.0" dnl Checks for C compiler. AC_PROG_CC @@ -1045,6 +1046,39 @@ AC_SUBST([NUMACTL_CFLAGS]) AC_SUBST([NUMACTL_LIBS]) +dnl pcap lib +LIBPCAP_CONFIG="pcap-config" +LIBPCAP_CFLAGS="" +LIBPCAP_LIBS="" +LIBPCAP_FOUND="no" + +AC_ARG_WITH([libpcap], AC_HELP_STRING([--with-libpcap=@<:@PFX@:>@], [libpcap location])) +if test "$with_qemu" = "yes"; then + if test "x$with_libpcap" != "xno" ; then + if test "x$with_libpcap" != "x" ; then + LIBPCAP_CONFIG=$with_libpcap/bin/$LIBPCAP_CONFIG + fi + AC_MSG_CHECKING(libpcap $LIBPCAP_CONFIG >= $LIBPCAP_REQUIRED ) + if ! $LIBPCAP_CONFIG --libs > /dev/null 2>&1 ; then + AC_MSG_RESULT(no) + else + LIBPCAP_LIBS="`$LIBPCAP_CONFIG --libs`" + LIBPCAP_CFLAGS="`$LIBPCAP_CONFIG --cflags`" + LIBPCAP_FOUND="yes" + AC_MSG_RESULT(yes) + fi + fi +fi + +if test "x$LIBPCAP_FOUND" = "xyes"; then + AC_DEFINE_UNQUOTED([HAVE_LIBPCAP], 1, [whether libpcap can be used]) +fi + +AC_SUBST([LIBPCAP_CFLAGS]) +AC_SUBST([LIBPCAP_LIBS]) + + + dnl dnl Checks for the UML driver dnl @@ -2129,6 +2163,11 @@ AC_MSG_NOTICE([ xmlrpc: $XMLRPC_CFLAGS else AC_MSG_NOTICE([ xmlrpc: no]) fi +if test "$with_qemu" = "yes" ; then +AC_MSG_NOTICE([ pcap: $LIBPCAP_CFLAGS $LIBPCAP_LIBS]) +else +AC_MSG_NOTICE([ pcap: no]) +fi AC_MSG_NOTICE([]) AC_MSG_NOTICE([Test suite]) AC_MSG_NOTICE([])

3 4

[libvirt] [RFC]: Snapshot API v3
by Chris Lalancette 31 Mar '10

31 Mar '10

Hello, After our discussions about the snapshot API last week, I went ahead and implemented quite a bit of the API. I also went back to the ESX, Virtualbox, and QEMU API's to try and make sure our API's matched up. What's below is my revised API based on that survey. Following my revised API are notes that I took regarding how the libvirt API matches up to the various API's, and some questions about semantics that I had while doing the survey. More comments and questions are welcome. /* NOTE: struct _virDomainSnapshot is a private structure, ala * struct _virDomain. */ typedef struct _virDomainSnapshot virDomainSnapshot; /* Take a snapshot of the current VM state. Throws an error if * the VM is not currently running */ virDomainSnapshotPtr virDomainSnapshotCreateXML(virDomainPtr domain, const char *xmlDesc, unsigned int flags); /* Dump the XML of a snapshot */ /* NOTE: see below for proposed XML */ char *virDomainSnapshotGetXMLDesc(virDomainSnapshotPtr snapshot, unsigned int flags); /* Return the number of snapshots for this domain */ int virDomainSnapshotNum(virDomainPtr domain, unsigned int flags); /* Get the names of all snapshots for this domain */ int virDomainListSnapshotNames(virDomainPtr domain, char **names, int nameslen, unsigned int flags); /* Get a handle to a named snapshot */ virDomainSnapshotPtr virDomainSnapshotLookupByName(virDomainPtr domain, const char *name, unsigned int flags); /* Get a handle to the current in-use snapshot for the domain */ virDomainSnapshotPtr virDomainSnapshotCurrent(virDomainPtr domain, unsigned int flags); /* Start the guest from the snapshot "snapshot" */ int virDomainCreateFromSnapshot(virDomainSnapshotPtr snapshot, unsigned int flags); /* Rename the snapshot */ /* Do we really need this? In theory we could use * virsh snapshot-edit <domain> <name> and then detect * name changes, but that will require a UUID, which may * or may not be overkill */ int virDomainSnapshotRename(virDomainSnapshotPtr snapshot, char *newname, unsigned int flags); /* Delete a snapshot - with no flags, the snapshot is not used anymore, * but also not removed. With a MERGE flag, it merges the snapshot into * the parent snapshot (or the base image, if there is no parent snapshot). * Note that if other snapshots would be discarded because of this * MERGE action, this operation will fail. If that is really what is intended, * use MERGE_FORCE. * * With a DISCARD flag, it deletes the snapshot. Note that if children snapshots * would be discarded because of this delete action, this operation will * fail. If this is really what is intended, use DISCARD_FORCE. * * MERGE, MERGE_FORCE, DISCARD, and DISCARD_FORCE are mutually-exclusive. * * Note that this operation can happen when the domain is running or shut * down, though this is hypervisor specific */ typedef enum { VIR_DOMAIN_SNAPSHOT_DELETE_MERGE, VIR_DOMAIN_SNAPSHOT_DELETE_MERGE_FORCE, VIR_DOMAIN_SNAPSHOT_DELETE_DISCARD, VIR_DOMAIN_SNAPSHOT_DELETE_DISCARD_FORCE, } virDomainSnapshotDelete; int virDomainSnapshotDelete(virDomainSnapshotPtr snapshot, unsigned int flags); int virDomainSnapshotFree(virDomainSnapshotPtr snapshot); NOTE: During snapshot creation, *none* of the fields are required. That is, you can call virDomainSnapshotCreateXML() with an XML of "<domainsnapshot/>". In this case, the individual driver will make up a <name> and <uuid> for you, the <creationdate> will be set to the current time+date, <description> will be empty, <state> will be the current state of the VM, and <parent> will be set to the current snapshot (if any). If you do want to specify some fields during virDomainSnapshotCreateXML(), note that the only ones that are settable are <name>, <uuid>, and <description>; the rest are ignored, and filled in by the driver when the snapshot is actually created. NOTE: <state> refers to the state of the VM when the snapshot was taken. <domainsnapshot> <name>XYZ</name> <creationdate>...</creationdate> <description>...</description> <state>RUNNING</state> <domain> <uuid>XXXXX-XXXX-XXXX-XXXX-XXXXXXXXX</uuid> </domain> <parent> <name>ABC</name> </parent> </domainsnapshot> The virsh commands will be: virsh snapshot-create <dom> <xmlfile> virsh snapshot-list <dom> virsh snapshot-dumpxml <dom> <name> virsh start-with-snapshot <dom> <snapshotname> virsh snapshot-delete <dom> <snapshotname> [--merge|--mergeforce|--delete|--deleteforce] virsh snapshot-delete-all <dom> Possible issues: 1) I don't see a way to support "managed" save/restore and snapshotting with this API. I think we'll have to have a separate API for managed save/restore. 2) What is the semantic for deleting snapshots from a running domain? Virtualbox seems to not allow you to manipulate snapshots while the domain is running. Qemu does allow this, but it's currently unclear what the exact semantics are. VMware seems to allow manipulation of snapshots while the domain is running. 3) Do we need a snapshot UUID? Virtualbox allows you to have multiple snapshots with the same name, differentiated by UUID. Confusingly, they also have a "FindByName" method that returns the first depth-first search snapshot that matches a given name. For qemu, if you specify the same name twice it overwrites the previous one with the new one. I don't know what ESX does here. Mapping of our interface to various hypervisors: +-------------------------------+-----------------+-------------------+------------------------------+ | Libvirt | Qemu | Virtualbox | ESX | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotCreateXML | monitor command | takeSnapshot | CreateSnapshot_task | | | "savevm"; if | Snapshots can | takes a name, description, | | | snapshot name | be taken on | memory (true/false) and | | | is already in | powered off, | quiesce (true/false). | | | use, replaces | saved, running, | What does "memory" mean? | | | the previous | or paused VMs. | Should we model "quiesce" | | | snapshot. Also | The snapshot is | Trees of snapshots are | | | qemu-img | always taken | supported. What happens | | | snapshot -c can | against the | on a duplicate name? What | | | be used to | current snapshot. | state(s) can a VM be in | | | create a | What happens on | when calling this? Does | | | disk-only | a duplicate | a VM get paused when this | | | snapshot. What | name? Trees of | is called? | | | happens if the | snapshots are | | | | VM is running | not currently | | | | when you do | supported. | | | | this? Trees of | Taking a snapshot | | | | snapshots seem | of a running VM | | | | to be supported | pauses the VM | | | | VM gets paused | before taking the | | | | while this is | snapshot. | | | | happening. What | | | | | states can the | | | | | VM be in? | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotGetXMLDesc | Libvirt qemu | GetId | VirtualMachine object-> | | | snapshot | GetDescription | snapshot-> rootSnapshotList | | | metadata | GetTimeStamp | [i].createTime | | | | GetParent | .description | | | | GetCurrentSnapshot| .name | | | | | .id | | | | | .state | | | | | .quiesced | | | | | .vm | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotNum | Libvirt qemu | GetSnapshotCount | VirtualMachine object-> | | | snapshot | | snapshot-> rootSnapshotList | | | metadata | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainListSnapshotNames | Libvirt qemu | GetSnapshotCount | VirtualMachine object-> | | | snapshot | GetChildren | snapshot-> rootSnapshotList | | | metadata, or | | | | | listvm monitor | | | | | command or | | | | | qemu-img | | | | | snapshot -l | | | | | <file>. If the | | | | | VM has multiple | | | | | disks and the | | | | | disks have | | | | | different | | | | | snapshots, what | | | | | do you do? | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotLookupByName | " | findSnapshot | VirtualMachine object-> | | | | Takes a name and | snapshot-> rootSnapshotList | | | | returns a | | | | | snapshot object. | | | | | In case of | | | | | multiple snapshots| | | | | with the same | | | | | name, it returns | | | | | the first object | | | | | from a depth | | | | | first search. | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainCreateFromSnapshot | qemu-img | restoreSnapshot | RevertToSnapshot_Task | | | snapshot -a | Takes a snapshot | Changes execution state | | | <snapname> | object, and | of VM to state of this | | | <file>. What | resets the VM's | snapshot. Takes a | | | happens if the | state to that of | snapshot object, an | | | VM has multiple | the snapshot. | optional host, and | | | files with | If this is a | suppressPowerOn, which | | | different | snapshot taken | forces the VM to the off | | | snapshots? | against a running | state regardless of the | | | | machine, then the | state when the snapshot | | | | memory is | was taken. Implies that | | | | restored as well. | without this flag, VM | | | | Does *not* start | starts in whatever | | | | the VM. The VM | <state> was when snapshot | | | | must be off for | was taken. | | | | this operation to | | | | | succeed. | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotDelete | monitor command | deleteSnapshot | RemoveSnapshot_Task | | | "delvm". What | deletes the | removes this snapshot and | | | happens if the | specified | deletes any associated | | | snapshot is in | snapshot. Takes | storage. Operates on a | | | use? What | an ID. The VM | VirtualMachineSnapshot | | | states can the | must be off. | object. What states can | | | VM be in? Also | Differences to | the VM be in? What | | | qemu-img | children | happens if this snapshot | | | snapshot -d | snapshots will be | is in-use? What happens | | | <name> <file> | merged with the | to parents and children? | | | command can be | children to keep | | | | used. What | children valid. | | | | happens if the | Parent for this | | | | disk is in-use? | snapshot will | | | | What happens to | become parent of | | | | parents and | any children | | | | children? | snapshots. | | | | How do we | | | | | handle merges? | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotCurrent | Libvirt qemu | currentSnapshot | VirtualMachine object-> | | | snapshot | | snapshot-> currentSnapshot | | | metadata | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotRename | Libvirt qemu | ISnapshot->name | RenameSnapshot | | | snapshot | | | | | metadata | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotDelete with | Libvirt qemu | deleteSnapshot | RemoveAllSnapshots_Task | | DISCARD_FORCE flag against | snapshot | with manual depth | | | root snapshot | metadata | deletion of | | | | | children | | +-------------------------------+-----------------+-------------------+------------------------------+ | | | | RevertToCurrentSnapshot_Task | +-------------------------------+-----------------+-------------------+------------------------------+ Attribute mapping: +----------------+----------+-------------+----------------------------+ | Libvirt | Qemu | Virtualbox | ESX | +----------------+----------+-------------+----------------------------+ | <name> | TAG | name | name | +----------------+----------+-------------+----------------------------+ | <creationdate> | DATE | timeStamp | createTime | +----------------+----------+-------------+----------------------------+ | <description> | Libvirt | description | description | | | qemu | | | | | metadata | | | +----------------+----------+-------------+----------------------------+ | <state> | Libvirt | online | state (this is the *power* | | | qemu | | state of the VM when this | | | metadata | | snapshot was taken) | +----------------+----------+-------------+----------------------------+ | <domain><uuid> | Libvirt | machine | vm | | | qemu | | | | | metadata | | | +----------------+----------+-------------+----------------------------+ | <parent><name> | Libvirt | parent | N/A | | | qemu | | | | | metadata | | | +----------------+----------+-------------+----------------------------+ | N/A | N/A | id (uuid) | id | +----------------+----------+-------------+----------------------------+ | N/A | N/A | children | childSnapshotList | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | memory | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | quiesced | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | backupManifest | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | replaySupported | +----------------+----------+-------------+----------------------------+ -- Chris Lalancette

6 13

[libvirt] [RFC] Managed save APIs
by Daniel Veillard 31 Mar '10

31 Mar '10

The current API provides the following Save abd Restore functions: int virDomainSave (virDomainPtr domain, const char *to); int virDomainRestore (virConnectPtr conn, const char *from); where the user provide the path to the file used to hold the domain saved state. However it can be really useful to have a managed version where libvirt itself stores the data. It can then automatically reuse it once the domain is to be restarted. This also avoid the problem of keeping stale saved data once a domain has been restarted independantly. One of our use case was to save the running domains state on shutdown, and unfortunately virDomainSave()/virDomainRestore() can't be used for that because if one of the domain is labelled as autorestart, as soon as the daemon would restart it would recreate the guest but without knowledge of the backup state. So we propose the 3 following new APIs to deal with managed saves: int virDomainManagedSave(virDomainPtr dom, unsigned int flags); int virDomainHasManagedSaveImage(virDomainPtr dom, unsigned int flags); int virDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags); virDomainManagedSave() is to be run on a running domain. Once the call complete, as in virDomainSave() the domain is stopped upon completion, but there is no restore counterpart as any order to start the domain from the API would load the state from the managed file, similary if the domain is autostarted when libvirtd starts. Once a domain has restarted his managed save image is destroyed, basically managed save image can only exist for a stopped domain, for a running domain that would be by definition outdated data. Suggested new entry points in libvirt.c are below, thanks in advance for any feedback (and thanks to Chris Lalancette who started this work): diff --git a/src/libvirt.c b/src/libvirt.c index cc5b4c5..293ea17 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -12135,3 +12135,143 @@ error: virDispatchError(conn); return -1; } + +/** + * virDomainManagedSave: + * @dom: pointer to the domain + * @flags: optional flags currently unused + * + * This method will suspend a domain and save its memory contents to + * a file on disk. After the call, if successful, the domain is not + * listed as running anymore. + * The difference from virDomainSave() is that libvirt is keeping track of + * the saved state itself, and will reuse it once the domain is being + * restarted (automatically or via an explicit libvirt call). + * As a result any running domain is sure to not have a managed saved image. + * + * Returns 0 in case of success or -1 in case of failure + */ +int virDomainManagedSave(virDomainPtr dom, unsigned int flags) +{ + virConnectPtr conn; + + VIR_DEBUG("dom=%p, flags=%u", dom, flags); + + virResetLastError(); + + if (!VIR_IS_CONNECTED_DOMAIN(dom)) { + virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + conn = dom->conn; + if (conn->flags & VIR_CONNECT_RO) { + virLibDomainError(dom, VIR_ERR_OPERATION_DENIED, __FUNCTION__); + goto error; + } + + if (conn->driver->domainManagedSave) { + int ret; + + ret = conn->driver->domainManagedSave(dom, flags); + if (ret < 0) + goto error; + return ret; + } + + virLibConnError(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + +error: + virDispatchError(conn); + return -1; +} + +/** + * virDomainHasManagedSaveImage: + * @dom: pointer to the domain + * @flags: optional flags currently unused + * + * Check if a domain has a managed save image as created by + * virDomainManagedSave(). Note that any running domain should not have + * such an image, as it should have been removed on restart. + * + * Returns 0 if no image is present, 1 if an image is present, and + * -1 in case of error + */ +int virDomainHasManagedSaveImage(virDomainPtr dom, unsigned int flags) +{ + virConnectPtr conn; + + VIR_DEBUG("dom=%p, flags=%u", dom, flags); + + virResetLastError(); + + if (!VIR_IS_CONNECTED_DOMAIN(dom)) { + virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + conn = dom->conn; + + if (conn->driver->domainHasManagedSaveImage) { + int ret; + + ret = conn->driver->domainHasManagedSaveImage(dom, flags); + if (ret < 0) + goto error; + return ret; + } + + virLibConnError(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + +error: + virDispatchError(conn); + return -1; +} + +/** + * virDomainManagedSaveRemove: + * @dom: pointer to the domain + * @flags: optional flags currently unused + * + * Remove any managed save image as for this domain. + * + * Returns 0 in case of success, and -1 in case of error + */ +int virDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags) +{ + virConnectPtr conn; + + VIR_DEBUG("dom=%p, flags=%u", dom, flags); + + virResetLastError(); + + if (!VIR_IS_CONNECTED_DOMAIN(dom)) { + virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + conn = dom->conn; + if (conn->flags & VIR_CONNECT_RO) { + virLibDomainError(dom, VIR_ERR_OPERATION_DENIED, __FUNCTION__); + goto error; + } + + if (conn->driver->domainManagedSaveRemove) { + int ret; + + ret = conn->driver->domainManagedSaveRemove(dom, flags); + if (ret < 0) + goto error; + return ret; + } + + virLibConnError(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + +error: + virDispatchError(conn); + return -1; +} Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH 00/10] Begin to replace scanf and atoi
by Matthias Bolte 31 Mar '10

31 Mar '10

This set of patches is a first step towards removing the scanf and atoi usage in libvirt. I began with the simple cases and post this now to get some feedback before I start to convert the more difficult ones. 01/10 Replace sscanf in legacy device address parsing 02/10 Replace sscanf in nwfilter rule parsing 03/10 Refactor major.minor.micro version parsing into a function 04/10 cgroup: Replace sscanf with virStrToLong_ll 05/10 vbox: Replace atoi with virStrToLong_i 06/10 xen: Use virParseMacAddr instead of sscanf 07/10 openvz: Use strtok_r instead of sscanf for VPS UUID parsing 08/10 xenapi: Use virStrToLong_i instead of sscanf for CPU map parsing 09/10 xen: Use virStrToLong_i instead of sscanf for XenD port parsing 10/10 Replace sscanf in PCI device address parsing src/conf/domain_conf.c | 38 +++++++++++++++++++--------- src/conf/nwfilter_conf.c | 10 +++--- src/esx/esx_driver.c | 31 ++++------------------ src/libvirt_private.syms | 1 + src/lxc/lxc_driver.c | 10 +------ src/openvz/openvz_conf.c | 27 ++++++++++++------- src/uml/uml_conf.h | 2 +- src/uml/uml_driver.c | 17 ++++++------ src/util/cgroup.c | 3 +- src/util/pci.c | 59 ++++++++++++++++++++++++++++++++++--------- src/util/util.c | 37 +++++++++++++++++++++++++++ src/util/util.h | 1 + src/vbox/vbox_tmpl.c | 18 +++++-------- src/xen/xend_internal.c | 20 ++------------ src/xen/xm_internal.c | 19 +++---------- src/xenapi/xenapi_driver.c | 21 +++++++-------- src/xenapi/xenapi_utils.c | 3 +- 17 files changed, 179 insertions(+), 138 deletions(-) Matthias

5 31

[libvirt] [PATCH] website: Add archive link for libvirt-users list
by Matthias Bolte 31 Mar '10

31 Mar '10

--- docs/contact.html.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/docs/contact.html.in b/docs/contact.html.in index 09f8e35..c9dceda 100644 --- a/docs/contact.html.in +++ b/docs/contact.html.in @@ -21,7 +21,7 @@ </ul> </dd> - <dt><a href="">libvirt-users(a)redhat.com</a></dt> + <dt><a href="https://www.redhat.com/archives/libvirt-users/">libvirt-users(a)redhat.com</a></dt> <dd>This list a place for discussions involving libvirt <strong>users</strong>. Topics for discussion include <ul> <li>Usage of libvirt / virsh</li> -- 1.6.3.3

2 2

[libvirt] [PATCH] Fix apibuild.py warning about virNWFilterLookupByUUIDString
by Matthias Bolte 31 Mar '10

31 Mar '10

The function name was written with capital I in the Filter part. --- src/libvirt.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index 138dd31..5247fe7 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -11333,7 +11333,7 @@ error: } /** - * virNWFIlterLookupByUUIDString: + * virNWFilterLookupByUUIDString: * @conn: pointer to the hypervisor connection * @uuidstr: the string UUID for the nwfilter * -- 1.6.3.3

2 2

[libvirt] Patch for Vepa support in brctl
by Kumar L Srikanth-B22348 31 Mar '10

31 Mar '10

Hi Daniel, Can you please provide a valid patch for 'brctl' utility, to support 'vepa' mode. Regards, Srikanth.

3 2