- Devel - libvirt List Archives

[libvirt] libvirt current git & F18
by Gene Czarcinski 06 Dec '12

06 Dec '12

Anyone know of problems with the libvirt based on today's git and Fedora 18. Trying to rebuild some rpms which build fine on Fedora 17 fail on Fedora 18. It appears that it may be related to xen-devel. Gene

3 3

[libvirt] [PATCHv3 0/3] IPv6 enhancements; put dnsmasq parameters in conf-file
by Gene Czarcinski 06 Dec '12

06 Dec '12

Rebased 3 December 2012 These three patch files are packaged together because they serially depend on each other. This version includes updates to add the ipv6='yes' for enabling the guest-to-guest communications. The DHCPv6 support checks dnsmasq's version and requires a minimum of 2.64. Also, using dnsmasq for providing the RA service is checked against the dnsmasq version and is currently 2.64. There are separate checks for DHCPv6 and Router Advertising support by dnsmasq. As with IPv4, IPv6 DHCP is only one subnetwork on an interface. Additionally, if other IPv6 addresses are defined, a warning message is issued since the Router Advertisement service will support only state-full (DHCP) or state-less (SLAAC) addressing on a network interface (not both). Thus, the additional subnetworks will need to be manually configured to properly function. If dnsmasq provides the RA service, it also points to itself as a RDNSS (Recursive DNS Server) as part of the information is supplies. If IPv6 DHCP is not being run, then SLAAC addressing is supported for any IPv6 addresses specified. Gene Czarcinski (3): v2.0: allow guest to guest IPv6 without gateway definition v8.2 add support for DHCPv6 v7.9: put dnsmasq parameters into conf-file docs/formatnetwork.html.in | 136 ++++- docs/schemas/network.rng | 22 +- src/conf/network_conf.c | 108 ++-- src/conf/network_conf.h | 5 + src/network/bridge_driver.c | 594 ++++++++++++++------- src/network/bridge_driver.h | 7 +- src/util/dnsmasq.c | 9 +- tests/networkxml2argvdata/dhcp6-nat-network.argv | 14 + tests/networkxml2argvdata/dhcp6-nat-network.xml | 24 + tests/networkxml2argvdata/dhcp6-network.argv | 14 + tests/networkxml2argvdata/dhcp6-network.xml | 14 + .../dhcp6host-routed-network.argv | 12 + .../dhcp6host-routed-network.xml | 19 + tests/networkxml2argvdata/isolated-network.argv | 25 +- .../networkxml2argvdata/nat-network-dns-hosts.argv | 14 +- .../nat-network-dns-srv-record-minimal.argv | 34 +- .../nat-network-dns-srv-record.argv | 24 +- .../nat-network-dns-txt-record.argv | 22 +- tests/networkxml2argvdata/nat-network.argv | 22 +- tests/networkxml2argvdata/netboot-network.argv | 28 +- .../networkxml2argvdata/netboot-proxy-network.argv | 26 +- tests/networkxml2argvdata/routed-network.argv | 11 +- tests/networkxml2argvtest.c | 47 +- 23 files changed, 876 insertions(+), 355 deletions(-) create mode 100644 tests/networkxml2argvdata/dhcp6-nat-network.argv create mode 100644 tests/networkxml2argvdata/dhcp6-nat-network.xml create mode 100644 tests/networkxml2argvdata/dhcp6-network.argv create mode 100644 tests/networkxml2argvdata/dhcp6-network.xml create mode 100644 tests/networkxml2argvdata/dhcp6host-routed-network.argv create mode 100644 tests/networkxml2argvdata/dhcp6host-routed-network.xml -- 1.7.11.7

3 18

[libvirt] [jenkins@libvirt.sigxcpu.org: Build failed in Jenkins: libvirt-tck-debian-wheezy-qemu-session #227]
by Guido Günther 06 Dec '12

06 Dec '12

Hi, this commit ae2163f852448fafce3bfcb2814e823d18e394ea Only let VM drivers block libvirtd timed shutdown broke the libvirt-tck integration build with qemu:///session: http://honk.sigxcpu.org:8001/job/libvirt-tck-debian-wheezy-qemu-session/227… I won't have a chance to look into this in detail the near future but I thought I'd at least send out a notice. Cheers, -- Guido

3 6

[libvirt] [PATCH] dnsmasq: Fix parsing of the version number
by Michal Privoznik 06 Dec '12

06 Dec '12

If the debugging is enabled, the virCommand subsystem catches debug messages in the command output as well. In that case, we can't assume the string corresponding to command's stdout will start with specific prefix. But the prefix can be moved deeper in the string. This bug shows itself when parsing dnsmasq output: 2012-12-06 11:18:11.445+0000: 18491: error : dnsmasqCapsSetFromBuffer:664 : internal error cannot parse /usr/sbin/dnsmasq version number in '2012-12-06 11:11:02.232+0000: 18492: debug : virFileClose:72 : Closed fd 22' We can clearly see that the output of dnsmasq --version doesn't start with expected "Dnsmasq version " string but a libvirt debug output. --- src/util/dnsmasq.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/dnsmasq.c b/src/util/dnsmasq.c index 4f210d2..de0293a 100644 --- a/src/util/dnsmasq.c +++ b/src/util/dnsmasq.c @@ -641,9 +641,9 @@ dnsmasqCapsSetFromBuffer(dnsmasqCapsPtr caps, const char *buf) caps->noRefresh = true; - p = STRSKIP(buf, DNSMASQ_VERSION_STR); - if (!p) + if (!(p = strstr(buf, DNSMASQ_VERSION_STR))) goto fail; + p += sizeof(DNSMASQ_VERSION_STR) - 1; virSkipSpaces(&p); if (virParseVersionString(p, &caps->version, true) < 0) goto fail; -- 1.7.8.6

3 6

[libvirt] [PATCH 1/1] add vnc unix sockets to apparmor policy
by Serge Hallyn 06 Dec '12

06 Dec '12

When using vnc gaphics over a unix socket, virt-aa-helper needs to provide access for the qemu domain to access the sockfile. Signed-off-by: Serge Hallyn <serge.hallyn(a)ubuntu.com> --- src/security/virt-aa-helper.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index e480b30..c6b9903 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1003,6 +1003,13 @@ get_files(vahControl * ctl) if (vah_add_file(&buf, ctl->def->os.loader, "r") != 0) goto clean; + for (i = 0; i < ctl->def->ngraphics; i++) { + if (ctl->def->graphics[i]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC && + ctl->def->graphics[i]->data.vnc.socket && + vah_add_file(&buf, ctl->def->graphics[i]->data.vnc.socket, "rw")) + goto clean; + } + if (ctl->def->ngraphics == 1 && ctl->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL) if (vah_add_file(&buf, ctl->def->graphics[0]->data.sdl.xauth, -- 1.7.10.4

1 0

[libvirt] add security hook for permitting hugetlbfs access (v2)
by Serge Hallyn 06 Dec '12

06 Dec '12

When a qemu domain is backed by huge pages, apparmor needs to grant the domain rw access to files under the hugetlbfs mount point. Add a hook, called in qemu_process.c, which ends up adding the read-write access through virt-aa-helper. Qemu will be creating a randomly named file under the mountpoint and unlinking it as soon as it has mmap()d it, therefore we cannot predict the full pathname, but for the same reason it is generally safe to provide access to $path/**. Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/646468 Changelog: (v2) use virBuffer in place of snprintf. Index: libvirt/src/qemu/qemu_process.c =================================================================== --- libvirt.orig/src/qemu/qemu_process.c 2012-12-06 11:50:48.354763986 -0600 +++ libvirt/src/qemu/qemu_process.c 2012-12-06 11:57:58.234773649 -0600 @@ -3475,6 +3475,15 @@ } virDomainAuditSecurityLabel(vm, true); + if (driver->hugepage_path && vm->def->mem.hugepage_backed) { + if (virSecurityManagerSetHugepages(driver->securityManager, + vm->def, driver->hugepage_path) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("Unable to set huge path in security driver")); + goto cleanup; + } + } + /* Ensure no historical cgroup for this VM is lying around bogus * settings */ VIR_DEBUG("Ensuring no historical cgroup is lying around"); Index: libvirt/src/security/security_apparmor.c =================================================================== --- libvirt.orig/src/security/security_apparmor.c 2012-12-06 11:50:48.354763986 -0600 +++ libvirt/src/security/security_apparmor.c 2012-12-06 11:58:23.286774213 -0600 @@ -840,6 +840,31 @@ } static int +ApparmorSetHugepages(virSecurityManagerPtr mgr, + virDomainDefPtr def, + const char *path) +{ + const virSecurityLabelDefPtr secdef = + virDomainDefGetSecurityLabelDef(def, SECURITY_APPARMOR_NAME); + int ret = -1; + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *newpath; + + if (!secdef) + return -1; + + if (secdef->imagelabel == NULL) + return 0; + + virBufferAsprintf(&buf, "%s/**", path); + newpath = virBufferCurrentContent(&buf); + if (newpath) + ret = reload_profile(mgr, def, newpath, true); + virBufferFreeAndReset(&buf); + return ret; +} + +static int AppArmorSetFDLabel(virSecurityManagerPtr mgr, virDomainDefPtr def, int fd) @@ -908,4 +933,6 @@ .domainSetSecurityImageFDLabel = AppArmorSetFDLabel, .domainSetSecurityTapFDLabel = AppArmorSetFDLabel, + + .domainSetSecurityHugepages = ApparmorSetHugepages, }; Index: libvirt/src/security/security_manager.c =================================================================== --- libvirt.orig/src/security/security_manager.c 2012-12-06 11:50:48.354763986 -0600 +++ libvirt/src/security/security_manager.c 2012-12-06 11:57:58.238773649 -0600 @@ -511,3 +511,13 @@ list[1] = NULL; return list; } + +int virSecurityManagerSetHugepages(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + const char *path) +{ + if (mgr->drv->domainSetSecurityHugepages) + return mgr->drv->domainSetSecurityHugepages(mgr, vm, path); + + return 0; +} Index: libvirt/src/security/security_manager.h =================================================================== --- libvirt.orig/src/security/security_manager.h 2012-12-06 11:50:48.354763986 -0600 +++ libvirt/src/security/security_manager.h 2012-12-06 11:57:58.238773649 -0600 @@ -112,5 +112,8 @@ virDomainDefPtr vm); virSecurityManagerPtr* virSecurityManagerGetNested(virSecurityManagerPtr mgr); +int virSecurityManagerSetHugepages(virSecurityManagerPtr mgr, + virDomainDefPtr sec, + const char *hugepages_path); #endif /* VIR_SECURITY_MANAGER_H__ */ Index: libvirt/src/security/security_driver.h =================================================================== --- libvirt.orig/src/security/security_driver.h 2012-12-06 11:50:48.354763986 -0600 +++ libvirt/src/security/security_driver.h 2012-12-06 11:57:58.238773649 -0600 @@ -100,6 +100,9 @@ int fd); typedef char *(*virSecurityDomainGetMountOptions) (virSecurityManagerPtr mgr, virDomainDefPtr def); +typedef int (*virSecurityDomainSetHugepages) (virSecurityManagerPtr mgr, + virDomainDefPtr def, + const char *path); struct _virSecurityDriver { size_t privateDataLen; @@ -140,6 +143,7 @@ virSecurityDomainSetTapFDLabel domainSetSecurityTapFDLabel; virSecurityDomainGetMountOptions domainGetSecurityMountOptions; + virSecurityDomainSetHugepages domainSetSecurityHugepages; }; virSecurityDriverPtr virSecurityDriverLookup(const char *name, Index: libvirt/src/libvirt_private.syms =================================================================== --- libvirt.orig/src/libvirt_private.syms 2012-12-06 11:50:48.354763986 -0600 +++ libvirt/src/libvirt_private.syms 2012-12-06 11:57:58.238773649 -0600 @@ -1052,6 +1052,7 @@ virSecurityManagerStackAddNested; virSecurityManagerVerify; virSecurityManagerGetMountOptions; +virSecurityManagerSetHugepages; # sexpr.h sexpr_append; Index: libvirt/src/security/security_stack.c =================================================================== --- libvirt.orig/src/security/security_stack.c 2012-12-06 11:50:48.354763986 -0600 +++ libvirt/src/security/security_stack.c 2012-12-06 11:57:58.238773649 -0600 @@ -462,6 +462,23 @@ return rc; } +static int +virSecurityStackSetHugepages(virSecurityManagerPtr mgr, + virDomainDefPtr vm, + const char *path) +{ + virSecurityStackDataPtr priv = virSecurityManagerGetPrivateData(mgr); + virSecurityStackItemPtr item = priv->itemsHead; + int rc = 0; + + for (; item; item = item->next) { + if (virSecurityManagerSetHugepages(item->securityManager, vm, path) < 0) + rc = -1; + } + + return rc; +} + static char *virSecurityStackGetMountOptions(virSecurityManagerPtr mgr ATTRIBUTE_UNUSED, virDomainDefPtr vm ATTRIBUTE_UNUSED) { return NULL; @@ -529,4 +546,6 @@ .domainSetSecurityTapFDLabel = virSecurityStackSetTapFDLabel, .domainGetSecurityMountOptions = virSecurityStackGetMountOptions, + + .domainSetSecurityHugepages = virSecurityStackSetHugepages, };

1 0

[libvirt] [PATCH] network: prevent a few invalid configuration combinations
by Laine Stump 06 Dec '12

06 Dec '12

This resolves: https://bugzilla.redhat.com/show_bug.cgi?id=767057 It was possible to define a network with <forward mode='bridge'> that had both a bridge device and a forward device defined. These two are mutually exclusive by definition (if you are using a bridge device, then this is a host bridge, and if you have a forward dev defined, this is using macvtap). It was also possible to put <ip>, <dns>, and <domain> elements in this definition, although those aren't supported by the current driver (although it's conceivable that some other driver might support that). The items that are invalid by definition, are now checked in the XML parser (since they will definitely *always* be wrong), and the others are checked in networkValidate() in the network driver (since, as mentioned, it's possible that some other network driver, or even this one, could some day support setting those). --- src/conf/network_conf.c | 9 +++++++++ src/libvirt_private.syms | 1 + src/network/bridge_driver.c | 29 +++++++++++++++++++++++++++++ 3 files changed, 39 insertions(+) diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c index 6ce2e63..06932d8 100644 --- a/src/conf/network_conf.c +++ b/src/conf/network_conf.c @@ -1577,6 +1577,15 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt) def->name); goto error; } + if (def->bridge && (def->nForwardIfs || nForwardPfs)) { + virReportError(VIR_ERR_XML_ERROR, + _("A network with forward mode='%s' can specify " + "a bridge name or a forward dev, but not " + "both (network '%s')"), + virNetworkForwardTypeToString(def->forwardType), + def->name); + goto error; + } break; } } diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 946bb20..bc01fe5 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -857,6 +857,7 @@ virNetworkDefParseString; virNetworkDeleteConfig; virNetworkFindByName; virNetworkFindByUUID; +virNetworkForwardTypeToString; virNetworkIpDefNetmask; virNetworkIpDefPrefix; virNetworkList; diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index e8be00a..0893e9b 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -2733,6 +2733,35 @@ networkValidate(struct network_driver *driver, return -1; virNetworkSetBridgeMacAddr(def); + } else { + /* They are also the only types that currently support setting + * an IP address for the host-side device (bridge) + */ + if (virNetworkDefGetIpByIndex(def, AF_UNSPEC, 0)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Unsupported <ip> element in network %s " + "with forward mode='%s'"), + def->name, + virNetworkForwardTypeToString(def->forwardType)); + return -1; + } + if (def->dns && + (def->dns->ntxtrecords || def->dns->nhosts || def->dns->nsrvrecords)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Unsupported <dns> element in network %s " + "with forward mode='%s'"), + def->name, + virNetworkForwardTypeToString(def->forwardType)); + return -1; + } + if (def->domain) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("Unsupported <domain> element in network %s " + "with forward mode='%s'"), + def->name, + virNetworkForwardTypeToString(def->forwardType)); + return -1; + } } /* We only support dhcp on one IPv4 address per defined network */ -- 1.7.11.7

3 3

[libvirt] [PATCH] maint: Sort util source file definitions in makefile
by Peter Krempa 06 Dec '12

06 Dec '12

--- src/Makefile.am | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 1a2f94f..9aff77a 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -54,44 +54,37 @@ augeastest_DATA = UTIL_SOURCES = \ util/bitmap.c util/bitmap.h \ util/buf.c util/buf.h \ + util/cgroup.c util/cgroup.h \ util/command.c util/command.h \ util/conf.c util/conf.h \ - util/cgroup.c util/cgroup.h \ + util/dnsmasq.c util/dnsmasq.h \ + util/ebtables.c util/ebtables.h \ util/event.c util/event.h \ util/event_poll.c util/event_poll.h \ util/hooks.c util/hooks.h \ + util/hostusb.c util/hostusb.h \ util/iptables.c util/iptables.h \ - util/ebtables.c util/ebtables.h \ - util/dnsmasq.c util/dnsmasq.h \ util/json.c util/json.h \ util/logging.c util/logging.h \ util/memory.c util/memory.h \ util/pci.c util/pci.h \ util/processinfo.c util/processinfo.h \ - util/hostusb.c util/hostusb.h \ util/sexpr.c util/sexpr.h \ util/stats_linux.c util/stats_linux.h \ util/storage_file.c util/storage_file.h \ util/sysinfo.c util/sysinfo.h \ - util/threads.c util/threads.h \ + util/threadpool.c util/threadpool.h \ util/threads-pthread.h \ util/threads-win32.h \ - util/threadpool.c util/threadpool.h \ - util/uuid.c util/uuid.h \ + util/threads.c util/threads.h \ util/util.c util/util.h \ + util/uuid.c util/uuid.h \ util/viratomic.h util/viratomic.c \ util/viraudit.c util/viraudit.h \ util/virauth.c util/virauth.h \ util/virauthconfig.c util/virauthconfig.h \ - util/virfile.c util/virfile.h \ - util/virnodesuspend.c util/virnodesuspend.h \ - util/virobject.c util/virobject.h \ - util/virpidfile.c util/virpidfile.h \ - util/virprocess.c util/virprocess.h \ - util/virtypedparam.c util/virtypedparam.h \ - util/xml.c util/xml.h \ - util/virterror.c util/virterror_internal.h \ util/virdbus.c util/virdbus.h \ + util/virfile.c util/virfile.h \ util/virhash.c util/virhash.h \ util/virhashcode.c util/virhashcode.h \ util/virinitctl.c util/virinitctl.h \ @@ -110,11 +103,18 @@ UTIL_SOURCES = \ util/virnetdevvlan.h util/virnetdevvlan.c \ util/virnetdevvportprofile.h util/virnetdevvportprofile.c \ util/virnetlink.c util/virnetlink.h \ + util/virnodesuspend.c util/virnodesuspend.h \ + util/virobject.c util/virobject.h \ + util/virpidfile.c util/virpidfile.h \ + util/virprocess.c util/virprocess.h \ util/virrandom.h util/virrandom.c \ util/virsocketaddr.h util/virsocketaddr.c \ util/virstring.h util/virstring.c \ + util/virterror.c util/virterror_internal.h \ util/virtime.h util/virtime.c \ - util/viruri.h util/viruri.c + util/virtypedparam.c util/virtypedparam.h \ + util/viruri.h util/viruri.c \ + util/xml.c util/xml.h EXTRA_DIST += $(srcdir)/util/virkeymaps.h $(srcdir)/util/keymaps.csv \ $(srcdir)/util/virkeycode-mapgen.py -- 1.8.0

2 2

[libvirt] [PATCH] dnsmasq: Fix parsing of the version number
by Michal Privoznik 06 Dec '12

06 Dec '12

If debugging is enabled, the debug messages are sent to stderr. Moreover, if a command has catching of stderr set, the messages gets mixed with stdout output (assuming both outputs are stored in the same variable). The resulting string then doesn't necessarily have to start with desired prefix then. This bug exposes itself when parsing dnsmasq output: 2012-12-06 11:18:11.445+0000: 18491: error : dnsmasqCapsSetFromBuffer:664 : internal error cannot parse /usr/sbin/dnsmasq version number in '2012-12-06 11:11:02.232+0000: 18492: debug : virFileClose:72 : Closed fd 22' We can clearly see that the output of dnsmasq --version doesn't start with expected "Dnsmasq version " string but a libvirt debug output. --- src/util/dnsmasq.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diff --git a/src/util/dnsmasq.c b/src/util/dnsmasq.c index de0293a..a627ed2 100644 --- a/src/util/dnsmasq.c +++ b/src/util/dnsmasq.c @@ -715,7 +715,6 @@ dnsmasqCapsRefreshInternal(dnsmasqCapsPtr caps, bool force) cmd = virCommandNewArgList(caps->binaryPath, "--version", NULL); virCommandSetOutputBuffer(cmd, &version); - virCommandSetErrorBuffer(cmd, &version); virCommandAddEnvPassCommon(cmd); virCommandClearCaps(cmd); if (virCommandRun(cmd, NULL) < 0) { @@ -727,7 +726,6 @@ dnsmasqCapsRefreshInternal(dnsmasqCapsPtr caps, bool force) cmd = virCommandNewArgList(caps->binaryPath, "--help", NULL); virCommandSetOutputBuffer(cmd, &help); - virCommandSetErrorBuffer(cmd, &help); virCommandAddEnvPassCommon(cmd); virCommandClearCaps(cmd); if (virCommandRun(cmd, NULL) < 0) { -- 1.7.8.6

2 1

[libvirt] [PATCH 0/4] qemu: Fix leaks in handling PCI devices
by Jiri Denemark 06 Dec '12

06 Dec '12

https://bugzilla.redhat.com/show_bug.cgi?id=877095 Patch 1/4 fixes a possible double free on error path and the other patches deal with memory and file descriptor leaks in PCI device attachment code. Jiri Denemark (4): qemu: Don't free PCI device if adding it to activePciHostdevs fails util: Slightly refactor PCI list functions qemu: Fix memory (and FD) leak on PCI device detach qemu: Do not keep PCI device config file open src/libvirt_private.syms | 3 +++ src/qemu/qemu_hostdev.c | 22 ++++++++-------- src/util/pci.c | 66 ++++++++++++++++++++++++++++-------------------- src/util/pci.h | 5 ++++ 4 files changed, 58 insertions(+), 38 deletions(-) -- 1.8.0

7 20