- Devel - libvirt List Archives

[libvirt] [PATCH] qemu: Use the CPU index in capabilities to map NUMA node to cpu list.
by Osier Yang 15 May '12

15 May '12

On some of the NUMA platforms, the CPU index in each NUMA node grows sequentially. While on other platforms, it can be inconsecutive, E.g. % numactl --hardware available: 4 nodes (0-3) node 0 cpus: 0 4 8 12 16 20 24 28 node 0 size: 131058 MB node 0 free: 86531 MB node 1 cpus: 1 5 9 13 17 21 25 29 node 1 size: 131072 MB node 1 free: 127070 MB node 2 cpus: 2 6 10 14 18 22 26 30 node 2 size: 131072 MB node 2 free: 127758 MB node 3 cpus: 3 7 11 15 19 23 27 31 node 3 size: 131072 MB node 3 free: 127226 MB node distances: node 0 1 2 3 0: 10 20 20 20 1: 20 10 20 20 2: 20 20 10 20 3: 20 20 20 10 This patch is to fix the problem by using the CPU index in caps->host.numaCell[i]->cpus[i] to set the bitmask instead of assuming the CPU index of the NUMA nodes are always sequential. --- src/qemu/qemu_process.c | 11 ++--------- 1 files changed, 2 insertions(+), 9 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 19bb22a..58ba5bf 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -1825,20 +1825,13 @@ qemuProcessInitCpuAffinity(struct qemud_driver *driver, if (vm->def->placement_mode == VIR_DOMAIN_CPU_PLACEMENT_MODE_AUTO) { VIR_DEBUG("Set CPU affinity with advisory nodeset from numad"); /* numad returns the NUMA node list, convert it to cpumap */ - int prev_total_ncpus = 0; for (i = 0; i < driver->caps->host.nnumaCell; i++) { int j; int cur_ncpus = driver->caps->host.numaCell[i]->ncpus; if (nodemask[i]) { - for (j = prev_total_ncpus; - j < cur_ncpus + prev_total_ncpus && - j < maxcpu && - j < VIR_DOMAIN_CPUMASK_LEN; - j++) { - VIR_USE_CPU(cpumap, j); - } + for (j = 0; j < cur_ncpus; j++) + VIR_USE_CPU(cpumap, driver->caps->host.numaCell[i]->cpus[j]); } - prev_total_ncpus += cur_ncpus; } } else { VIR_DEBUG("Set CPU affinity with specified cpuset"); -- 1.7.7.3

2 2

[libvirt] [PATCH V3] nwfilter: Add support for ipset
by Stefan Berger 15 May '12

15 May '12

This patch adds support for the recent ipset iptables extension to libvirt's nwfilter subsystem. Ipset allows to maintain 'sets' of IP addresses, ports and other packet parameters and allows for faster lookup (in the order of O(1) vs. O(n)) and rule evaluation to achieve higher throughput than what can be achieved with individual iptables rules. On the command line iptables supports ipset using iptables ... -m set --match-set <ipset name> <flags> -j ... where 'ipset name' is the name of a previously created ipset and flags is a comma-separated list of up to 6 flags. Flags use 'src' and 'dst' for selecting IP addresses, ports etc. from the source or destination part of a packet. So a concrete example may look like this: iptables -A INPUT -m set --match-set test src,src -j ACCEPT Since ipset management is quite complex, the idea was to leave ipset management outside of libvirt but still allow users to reference an ipset. The user would have to make sure the ipset is available once the VM is started so that the iptables rule(s) referencing the ipset can be created. Using XML to describe an ipset in an nwfilter rule would then look as follows: <rule action='accept' direction='in'> <all ipset='test' ipsetflags='src,src'/> </rule> The two parameters on the command line are also the two distinct XML attributes 'ipset' and 'ipsetflags'. FYI: Here is the man page for ipset: https://ipset.netfilter.org/ipset.man.html Regards, Stefan --- v3: - use DATATYPE_IPSETNAME for the name of the ipset - adapted documentation for 0.9.12 v2: - split ipset description into ipset and ipsetflags attribute - improved on documentation --- docs/formatnwfilter.html.in | 64 ++++++++++++++ docs/schemas/nwfilter.rng | 23 +++++ src/conf/nwfilter_conf.c | 136 +++++++++++++++++++++++++++++- src/conf/nwfilter_conf.h | 13 ++ src/nwfilter/nwfilter_ebiptables_driver.c | 75 +++++++++++++++- tests/nwfilterxml2xmlin/ipset-test.xml | 24 +++++ tests/nwfilterxml2xmlout/ipset-test.xml | 24 +++++ tests/nwfilterxml2xmltest.c | 2 8 files changed, 356 insertions(+), 5 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -183,6 +183,8 @@ static const char dstportstart_str[] = " static const char dstportend_str[] = "dstportend"; static const char dscp_str[] = "dscp"; static const char state_str[] = "state"; +static const char ipset_str[] = "ipset"; +static const char ipsetflags_str[] = "ipsetflags"; #define SRCMACADDR srcmacaddr_str #define SRCMACMASK srcmacmask_str @@ -206,6 +208,8 @@ static const char state_str[] = " #define DSTPORTEND dstportend_str #define DSCP dscp_str #define STATE state_str +#define IPSET ipset_str +#define IPSETFLAGS ipsetflags_str /** @@ -980,6 +984,97 @@ tcpFlagsFormatter(virBufferPtr buf, return true; } +static bool +ipsetValidator(enum attrDatatype datatype ATTRIBUTE_UNUSED, union data *val, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, + nwItemDesc *item) +{ + const char *errmsg = NULL; + + if (virStrcpy(item->u.ipset.setname, val->c, + sizeof(item->u.ipset.setname)) == NULL) { + errmsg = _("ipset name is too long"); + goto arg_err_exit; + } + + if (item->u.ipset.setname[strspn(item->u.ipset.setname, + VALID_IPSETNAME)] != 0) { + errmsg = _("ipset name contains invalid characters"); + goto arg_err_exit; + } + + return true; + +arg_err_exit: + virNWFilterReportError(VIR_ERR_INVALID_ARG, + "%s", errmsg); + return false; +} + +static bool +ipsetFormatter(virBufferPtr buf, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, + nwItemDesc *item) +{ + virBufferAdd(buf, item->u.ipset.setname, -1); + + return true; +} + +static bool +ipsetFlagsValidator(enum attrDatatype datatype ATTRIBUTE_UNUSED, union data *val, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, nwItemDesc *item) +{ + const char *errmsg = NULL; + size_t idx = 0; + + item->u.ipset.numFlags = 0; + item->u.ipset.flags = 0; + + errmsg = _("malformed ipset flags"); + + while (item->u.ipset.numFlags < 6) { + if (STRCASEEQLEN(&val->c[idx], "src", 3)) { + item->u.ipset.flags |= (1 << item->u.ipset.numFlags); + } else if (!STRCASEEQLEN(&val->c[idx], "dst", 3)) { + goto arg_err_exit; + } + item->u.ipset.numFlags++; + idx += 3; + if (val->c[idx] != ',') + break; + idx++; + } + + if (val->c[idx] != '\0') + goto arg_err_exit; + + return true; + +arg_err_exit: + virNWFilterReportError(VIR_ERR_INVALID_ARG, + "%s", errmsg); + return false; +} + +static bool +ipsetFlagsFormatter(virBufferPtr buf, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, + nwItemDesc *item) +{ + uint8_t ctr; + + for (ctr = 0; ctr < item->u.ipset.numFlags; ctr++) { + if (ctr != 0) + virBufferAddLit(buf, ","); + if ((item->u.ipset.flags & (1 << ctr))) + virBufferAddLit(buf, "src"); + else + virBufferAddLit(buf, "dst"); + } + + return true; +} #define COMMON_MAC_PROPS(STRUCT) \ {\ @@ -1411,6 +1506,20 @@ static const virXMLAttr2Struct ipv6Attri .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataState),\ .validator = stateValidator,\ .formatter = stateFormatter,\ + },\ + {\ + .name = IPSET,\ + .datatype = DATATYPE_IPSETNAME,\ + .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataIPSet),\ + .validator = ipsetValidator,\ + .formatter = ipsetFormatter,\ + },\ + {\ + .name = IPSETFLAGS,\ + .datatype = DATATYPE_IPSETFLAGS,\ + .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataIPSetFlags),\ + .validator = ipsetFlagsValidator,\ + .formatter = ipsetFlagsFormatter,\ } #define COMMON_PORT_PROPS(STRUCT) \ @@ -1853,6 +1962,8 @@ virNWFilterRuleDetailsParse(xmlNodePtr n break; case DATATYPE_STRING: + case DATATYPE_IPSETFLAGS: + case DATATYPE_IPSETNAME: if (!validator) { /* not supported */ rc = -1; @@ -1964,6 +2075,19 @@ err_exit: goto cleanup; } +static void +virNWFilterRuleDefFixupIPSet(ipHdrDataDefPtr ipHdr) +{ + if (HAS_ENTRY_ITEM(&ipHdr->dataIPSet) && + !HAS_ENTRY_ITEM(&ipHdr->dataIPSetFlags)) { + ipHdr->dataIPSetFlags.flags = NWFILTER_ENTRY_ITEM_FLAG_EXISTS; + ipHdr->dataIPSetFlags.u.ipset.numFlags = 1; + ipHdr->dataIPSetFlags.u.ipset.flags = 1; + } else { + ipHdr->dataIPSet.flags = 0; + ipHdr->dataIPSetFlags.flags = 0; + } +} static void virNWFilterRuleDefFixup(virNWFilterRuleDefPtr rule) @@ -2017,6 +2141,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.ipHdrFilter.ipHdr.dataSrcIPAddr); COPY_NEG_SIGN(rule->p.ipHdrFilter.ipHdr.dataDstIPMask, rule->p.ipHdrFilter.ipHdr.dataDstIPAddr); + virNWFilterRuleDefFixupIPSet(&rule->p.ipHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_IPV6: @@ -2024,6 +2149,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.ipv6HdrFilter.ipHdr.dataSrcIPAddr); COPY_NEG_SIGN(rule->p.ipv6HdrFilter.ipHdr.dataDstIPMask, rule->p.ipv6HdrFilter.ipHdr.dataDstIPAddr); + virNWFilterRuleDefFixupIPSet(&rule->p.ipv6HdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ARP: @@ -2047,6 +2173,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.tcpHdrFilter.portData.dataSrcPortStart); COPY_NEG_SIGN(rule->p.tcpHdrFilter.portData.dataDstPortEnd, rule->p.tcpHdrFilter.portData.dataSrcPortStart); + virNWFilterRuleDefFixupIPSet(&rule->p.tcpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_UDP: @@ -2065,6 +2192,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.udpHdrFilter.portData.dataSrcPortStart); COPY_NEG_SIGN(rule->p.udpHdrFilter.portData.dataDstPortEnd, rule->p.udpHdrFilter.portData.dataSrcPortStart); + virNWFilterRuleDefFixupIPSet(&rule->p.udpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_UDPLITE: @@ -2077,6 +2205,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.udpliteHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.udpliteHdrFilter.ipHdr.dataDstIPTo, rule->p.udpliteHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.udpliteHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ESP: @@ -2089,6 +2218,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.espHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.espHdrFilter.ipHdr.dataDstIPTo, rule->p.espHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.espHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_AH: @@ -2101,6 +2231,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.ahHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.ahHdrFilter.ipHdr.dataDstIPTo, rule->p.ahHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.ahHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_SCTP: @@ -2119,6 +2250,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.sctpHdrFilter.portData.dataSrcPortStart); COPY_NEG_SIGN(rule->p.sctpHdrFilter.portData.dataDstPortEnd, rule->p.sctpHdrFilter.portData.dataSrcPortStart); + virNWFilterRuleDefFixupIPSet(&rule->p.sctpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ICMP: @@ -2133,6 +2265,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.icmpHdrFilter.ipHdr.dataDstIPFrom); COPY_NEG_SIGN(rule->p.icmpHdrFilter.dataICMPCode, rule->p.icmpHdrFilter.dataICMPType); + virNWFilterRuleDefFixupIPSet(&rule->p.icmpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ALL: @@ -2156,6 +2289,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.igmpHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.igmpHdrFilter.ipHdr.dataDstIPTo, rule->p.igmpHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.igmpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_LAST: @@ -3120,7 +3254,7 @@ virNWFilterRuleDefDetailsFormat(virBuffe virBufferAsprintf(buf, " %s='", att[i].name); - if (att[i].formatter) { + if (att[i].formatter && !(flags & NWFILTER_ENTRY_ITEM_FLAG_HAS_VAR)) { if (!att[i].formatter(buf, def, item)) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("formatter for %s %s reported error"), Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -103,8 +103,10 @@ enum attrDatatype { DATATYPE_BOOLEAN = (1 << 12), DATATYPE_UINT32 = (1 << 13), DATATYPE_UINT32_HEX = (1 << 14), + DATATYPE_IPSETNAME = (1 << 15), + DATATYPE_IPSETFLAGS = (1 << 16), - DATATYPE_LAST = (1 << 15), + DATATYPE_LAST = (1 << 17), }; # define NWFILTER_MAC_BGA "01:80:c2:00:00:00" @@ -136,9 +138,16 @@ struct _nwItemDesc { uint8_t mask; uint8_t flags; } tcpFlags; + struct { + char setname[32]; + uint8_t numFlags; + uint8_t flags; + } ipset; } u; }; +# define VALID_IPSETNAME \ + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:-+ " typedef struct _ethHdrDataDef ethHdrDataDef; typedef ethHdrDataDef *ethHdrDataDefPtr; @@ -232,6 +241,8 @@ struct _ipHdrDataDef { nwItemDesc dataState; nwItemDesc dataConnlimitAbove; nwItemDesc dataComment; + nwItemDesc dataIPSet; + nwItemDesc dataIPSetFlags; }; Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -256,10 +256,13 @@ static int _printDataType(virNWFilterVarCombIterPtr vars, char *buf, int bufsize, nwItemDescPtr item, - bool asHex) + bool asHex, bool directionIn) { int done; char *data; + uint8_t ctr; + virBuffer vb = VIR_BUFFER_INITIALIZER; + char *flags; if (printVar(vars, buf, bufsize, item, &done) < 0) return -1; @@ -346,6 +349,44 @@ _printDataType(virNWFilterVarCombIterPtr } break; + case DATATYPE_IPSETNAME: + snprintf(buf, bufsize, "%s", item->u.ipset.setname); + break; + + case DATATYPE_IPSETFLAGS: + for (ctr = 0; ctr < item->u.ipset.numFlags; ctr++) { + if (ctr != 0) + virBufferAddLit(&vb, ","); + if ((item->u.ipset.flags & (1 << ctr))) { + if (directionIn) + virBufferAddLit(&vb, "dst"); + else + virBufferAddLit(&vb, "src"); + } else { + if (directionIn) + virBufferAddLit(&vb, "src"); + else + virBufferAddLit(&vb, "dst"); + } + } + + if (virBufferError(&vb)) { + virReportOOMError(); + virBufferFreeAndReset(&vb); + return -1; + } + + flags = virBufferContentAndReset(&vb); + + if (snprintf(buf, bufsize, "%s", flags) >= bufsize) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Buffer too small for IPSETFLAGS type")); + VIR_FREE(flags); + return -1; + } + VIR_FREE(flags); + break; + default: virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Unhandled datatype %x"), item->datatype); @@ -362,16 +403,23 @@ printDataType(virNWFilterVarCombIterPtr char *buf, int bufsize, nwItemDescPtr item) { - return _printDataType(vars, buf, bufsize, item, 0); + return _printDataType(vars, buf, bufsize, item, 0, 0); } +static int +printDataTypeDirection(virNWFilterVarCombIterPtr vars, + char *buf, int bufsize, + nwItemDescPtr item, bool directionIn) +{ + return _printDataType(vars, buf, bufsize, item, 0, directionIn); +} static int printDataTypeAsHex(virNWFilterVarCombIterPtr vars, char *buf, int bufsize, nwItemDescPtr item) { - return _printDataType(vars, buf, bufsize, item, 1); + return _printDataType(vars, buf, bufsize, item, 1, 0); } @@ -927,6 +975,7 @@ iptablesHandleIpHdr(virBufferPtr buf, char ipaddr[INET6_ADDRSTRLEN], number[MAX(INT_BUFSIZE_BOUND(uint32_t), INT_BUFSIZE_BOUND(int))]; + char str[200]; const char *src = "--source"; const char *dst = "--destination"; const char *srcrange = "--src-range"; @@ -938,6 +987,26 @@ iptablesHandleIpHdr(virBufferPtr buf, dstrange = "--src-range"; } + if (HAS_ENTRY_ITEM(&ipHdr->dataIPSet) && + HAS_ENTRY_ITEM(&ipHdr->dataIPSetFlags)) { + + if (printDataType(vars, + str, sizeof(str), + &ipHdr->dataIPSet) < 0) + goto err_exit; + + virBufferAsprintf(afterStateMatch, + " -m set --match-set \"%s\" ", + str); + + if (printDataTypeDirection(vars, + str, sizeof(str), + &ipHdr->dataIPSetFlags, directionIn) < 0) + goto err_exit; + + virBufferAdd(afterStateMatch, str, -1); + } + if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPAddr)) { if (printDataType(vars, Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -485,6 +485,14 @@ <ref name="stateflags-type"/> </attribute> </optional> + <optional> + <attribute name="ipset"> + <ref name="ipset-type"/> + </attribute> + <attribute name="ipsetflags"> + <ref name="ipsetflags-type"/> + </attribute> + </optional> </interleave> </define> @@ -1060,4 +1068,19 @@ <param name="pattern">((SYN|ACK|URG|PSH|FIN|RST)(,(SYN|ACK|URG|PSH|FIN|RST))*|ALL|NONE)/((SYN|ACK|URG|PSH|FIN|RST)(,(SYN|ACK|URG|PSH|FIN|RST))*|ALL|NONE)</param> </data> </define> + + <define name='ipset-type'> + <choice> + <ref name="variable-name-type"/> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_\.:\-\+]{1,31}</param> + </data> + </choice> + </define> + + <define name='ipsetflags-type'> + <data type="string"> + <param name="pattern">(src|dst)(,(src|dst)){0,5}</param> + </data> + </define> </grammar> Index: libvirt-acl/tests/nwfilterxml2xmlin/ipset-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/ipset-test.xml @@ -0,0 +1,24 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all ipset='test' ipsetflags='src,dst' /> + </rule> + <rule action='accept' direction='in'> + <all state='NONE' ipset='test' ipsetflags='src,dst' comment='in+NONE'/> + </rule> + <rule action='accept' direction='out'> + <all state='NONE' ipset='test' ipsetflags='src,dst' comment='out+NONE'/> + </rule> + <rule action='accept' direction='in'> + <all ipset='test' ipsetflags='SRC,DST,SRC' /> + </rule> + <rule action='accept' direction='in'> + <all ipset='test:_.-+' ipsetflags='SRC,dSt,SRC' /> + </rule> + <rule action='accept' direction='in'> + <all ipset='$IPSETNAME' ipsetflags='src,dst' /> + </rule> + <rule action='accept' direction='inout'> + <all ipset='$IPSETNAME' ipsetflags='src,dst' comment='inout'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/ipset-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/ipset-test.xml @@ -0,0 +1,24 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out' priority='500'> + <all ipset='test' ipsetflags='src,dst'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all state='NONE' ipset='test' ipsetflags='src,dst' comment='in+NONE'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <all state='NONE' ipset='test' ipsetflags='src,dst' comment='out+NONE'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all ipset='test' ipsetflags='src,dst,src'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all ipset='test:_.-+' ipsetflags='src,dst,src'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all ipset='$IPSETNAME' ipsetflags='src,dst'/> + </rule> + <rule action='accept' direction='inout' priority='500'> + <all ipset='$IPSETNAME' ipsetflags='src,dst' comment='inout'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -157,6 +157,8 @@ mymain(void) DO_TEST("iter-test2", false); DO_TEST("iter-test3", false); + DO_TEST("ipset-test", false); + return ret==0 ? EXIT_SUCCESS : EXIT_FAILURE; } Index: libvirt-acl/docs/formatnwfilter.html.in =================================================================== --- libvirt-acl.orig/docs/formatnwfilter.html.in +++ libvirt-acl/docs/formatnwfilter.html.in @@ -528,6 +528,10 @@ <li>IPV6_MASK: IPv6 mask in numbers format (FFFF:FFFF:FC00::) or CIDR mask (0-128)</li> <li>STRING: A string</li> <li>BOOLEAN: 'true', 'yes', '1' or 'false', 'no', '0'</li> + <li>IPSETFLAGS: The source and destination flags of the ipset described + by up to 6 'src' or 'dst' elements selecting features from either + the source or destination part of the packet header; example: + src,src,dst</li> </ul> @@ -1169,6 +1173,16 @@ <td>STRING</td> <td>TCP-only: format of mask/flags with mask and flags each being a comma separated list of SYN,ACK,URG,PSH,FIN,RST or NONE or ALL</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1269,6 +1283,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1358,6 +1382,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1459,6 +1493,16 @@ <td>STRING</td> <td>TCP-only: format of mask/flags with mask and flags each being a comma separated list of SYN,ACK,URG,PSH,FIN,RST or NONE or ALL</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1545,6 +1589,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1619,6 +1673,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.12)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.12)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table>

2 3

[libvirt] [PATCHv3 1/1] Assign spapr-vio bus address to ibmvscsi controller
by Li Zhang 14 May '12

14 May '12

For pseries guest, the default controller model is ibmvscsi controller, this controller only can work on spapr-vio address. This patch is to assign spapr-vio address type to ibmvscsi controller and correct vscsi test case. Signed-off-by: Li Zhang <zhlcindy(a)linux.vnet.ibm.com> --- src/qemu/qemu_command.c | 17 +++++++++++++---- .../qemuxml2argv-disk-scsi-vscsi.args | 4 ++-- 2 files changed, 15 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 117542f..0a85d19 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -779,6 +779,7 @@ qemuAssignSpaprVIOAddress(virDomainDefPtr def, virDomainDeviceInfoPtr info, int qemuDomainAssignSpaprVIOAddresses(virDomainDefPtr def) { int i, rc; + int model; /* Default values match QEMU. See spapr_(llan|vscsi|vty).c */ @@ -790,10 +791,18 @@ int qemuDomainAssignSpaprVIOAddresses(virDomainDefPtr def) } for (i = 0 ; i < def->ncontrollers; i++) { - rc = qemuAssignSpaprVIOAddress(def, &def->controllers[i]->info, - 0x2000ul); - if (rc) - return rc; + model = def->controllers[i]->model; + if (model == -1 && + def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_SCSI) + model = qemuDefaultScsiControllerModel(def); + if (model == VIR_DOMAIN_CONTROLLER_MODEL_SCSI_IBMVSCSI && + def->controllers[i]->type == VIR_DOMAIN_CONTROLLER_TYPE_SCSI) { + def->controllers[i]->info.type = VIR_DOMAIN_DEVICE_ADDRESS_TYPE_SPAPRVIO; + rc = qemuAssignSpaprVIOAddress(def, &def->controllers[i]->info, + 0x2000ul); + if (rc) + return rc; + } } for (i = 0 ; i < def->nserials; i++) { diff --git a/tests/qemuxml2argvdata/qemuxml2argv-disk-scsi-vscsi.args b/tests/qemuxml2argvdata/qemuxml2argv-disk-scsi-vscsi.args index 4261a84..d57159f 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-disk-scsi-vscsi.args +++ b/tests/qemuxml2argvdata/qemuxml2argv-disk-scsi-vscsi.args @@ -1,8 +1,8 @@ LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test /usr/bin/qemu -S -M \ pc -m 214 -smp 1 -nographic -nodefconfig -nodefaults -monitor \ unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -device spapr-vscsi,id=scsi0,\ -bus=pci.0,addr=0x3 -drive file=/dev/HostVG/QEMUGuest1,if=none,\ +reg=0x2000 -drive file=/dev/HostVG/QEMUGuest1,if=none,\ id=drive-ide0-0-0 -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 \ -drive file=/tmp/scsidisk.img,if=none,id=drive-scsi0-0-3-0 \ -device scsi-disk,bus=scsi0.0,channel=0,scsi-id=3,lun=0,drive=drive-scsi0-0-3-0,id=scsi0-0-3-0 \ --usb -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x4 +-usb -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 -- 1.7.9.5

2 1

[libvirt] Re-4: [Patch] Libvirt - Fix locking for readonly devices
by David Weber 14 May '12

14 May '12

> On Mon, May 14, 2012 at 08:32:01AM +0000, David Weber wrote: > > > This isn't good - the lock manager implementation must be the > > > one to decide what todo with readonly & shared disks. The sanlock > > > plugin, however, does not currently support readonly/shared leases > > > hence why it rejects them. We could probably add a config param > > > to allow readonly/shared leases to be skipped by the sanlock plugin. > > > > Thanks for clarification. I've attached an updated patch which > > adds such a config param. It works but I can't test > > live-migration at the moment. But as far as I understood it > > shouldn't be a problem. > > Thanks, your patch looks good but needs two further small additions > to the libvirt_sanlock.aug and test_libvirt_sanlock.aug files to > take account of the new config parameter. Oops, Updated patch attached (tested with augparse) David ---------------------------------------- commit 33678a8b2d294bebf327106d586d41c9b157174f Author: David Weber <wb(a)munzinger.de> Date: Mon May 14 09:43:27 2012 +0200 Add ignore param for readonly and shared disk in sanlock diff --git a/src/locking/libvirt_sanlock.aug b/src/locking/libvirt_sanlock.aug index 5f5f8a1..d65b002 100644 --- a/src/locking/libvirt_sanlock.aug +++ b/src/locking/libvirt_sanlock.aug module Libvirt_sanlock = | bool_entry "auto_disk_leases" | int_entry "host_id" | bool_entry "require_lease_for_disks" + | bool_entry "ignore_readonly_and_shared_disks" let comment = [ label "#comment" . del /#[ \t]*/ "# " . store /([^ \t\n][^\n]*)?/ . del /\n/ "\n" ] let empty = [ label "#empty" . eol ] diff --git a/src/locking/lock_driver_sanlock.c b/src/locking/lock_driver_sanlock.c index d344d6a..57b688a 100644 --- a/src/locking/lock_driver_sanlock.c +++ b/src/locking/lock_driver_sanlock.c struct _virLockManagerSanlockDriver { bool requireLeaseForDisks; int hostID; bool autoDiskLease; + bool ignoreReadonlyShared; char *autoDiskLeasePath; }; static int virLockManagerSanlockLoadConfig(const char *configFile) CHECK_TYPE("auto_disk_leases", VIR_CONF_LONG); if (p) driver->autoDiskLease = p->l; + p = virConfGetValue(conf, "ignore_readonly_and_shared_disks"); + CHECK_TYPE("ignore_readonly_and_shared_disks", VIR_CONF_LONG); + if (p) driver->ignoreReadonlyShared = p->l; + p = virConfGetValue(conf, "disk_lease_dir"); CHECK_TYPE("disk_lease_dir", VIR_CONF_STRING); if (p && p->str) { static int virLockManagerSanlockAddResource(virLockManagerPtr lock, SANLK_MAX_RESOURCES); return -1; } + + if (((flags & VIR_LOCK_MANAGER_RESOURCE_READONLY) || + (flags &VIR_LOCK_MANAGER_RESOURCE_SHARED)) && + (driver->ignoreReadonlyShared)) { + return 0; + } if (flags & VIR_LOCK_MANAGER_RESOURCE_READONLY) { virLockError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", diff --git a/src/locking/sanlock.conf b/src/locking/sanlock.conf index efc35ee..5429522 100644 --- a/src/locking/sanlock.conf +++ b/src/locking/sanlock.conf # to enabled, otherwise it defaults to disabled. # #require_lease_for_disks = 1 + +# +# Ignore readonly and shared disks as they aren't supportet yet +# +#ignore_readonly_and_shared_disks = 1 diff --git a/src/locking/test_libvirt_sanlock.aug b/src/locking/test_libvirt_sanlock.aug index b5169e1..90ab59f 100644 --- a/src/locking/test_libvirt_sanlock.aug +++ b/src/locking/test_libvirt_sanlock.aug module Test_libvirt_sanlock = disk_lease_dir = \"/var/lib/libvirt/sanlock\" host_id = 1 require_lease_for_disks = 1 +ignore_readonly_and_shared_disks = 1 " test Libvirt_sanlock.lns get conf = require_lease_for_disks = 1 { "disk_lease_dir" = "/var/lib/libvirt/sanlock" } { "host_id" = "1" } { "require_lease_for_disks" = "1" } +{ "ignore_readonly_and_shared_disks" = "1" } To: berrange(a)redhat.com Cc: libvir-list(a)redhat.com sanlock-devel(a)lists.fedorahosted.org

2 1

[libvirt] [PATCH 0/2] Rework RPC message buffer
by Michal Privoznik 14 May '12

14 May '12

This patch set tries to fix corner cases where libvirt runs on huge system, e.g. 4K CPU monster. In these cases, capabilities XML is enormously big, as we are transferring info about each singe CPU core (to which NUMA node it belongs, etc.). This XML is bigger than our RPC limit, therefore users cannot get it as it is dropped on server, leaving them with inability to connect. Therefore we need to increase those limits (whole RPC message and RPC string). However, simple lifting up will work, but increase mem usage. Therefore I've reworked RPC buffer handling: changed it from 'statically' to dynamically allocated. So in most cases - when small messages are sent - this will even decrease our memory consumption. Leaving us flexible for corner cases described above. On the other hand, I realize we've had our history with RPC breakage. So I think I'll require more than 1 ACK before pushing. What's your opinion? Michal Privoznik (2): rpc: Switch to dynamically allocated message buffer rpc: Size up RPC limits src/remote/remote_protocol.x | 2 +- src/rpc/virnetclient.c | 16 ++- src/rpc/virnetmessage.c | 12 ++- src/rpc/virnetmessage.h | 6 +- src/rpc/virnetprotocol.x | 6 +- src/rpc/virnetserverclient.c | 20 ++- tests/virnetmessagetest.c | 393 +++++++++++++++++++++++------------------- 7 files changed, 268 insertions(+), 187 deletions(-) -- 1.7.8.5

3 10

[libvirt] Release of libvirt-0.9.12
by Daniel Veillard 14 May '12

14 May '12

So I made the release, it is now available on the FTP server (the rpms are slowly being uploaded too): ftp://libvirt.org/libvirt/ This is mainly a stabilization release, with a lot of bugs fixes, and portability cleanups. There is still many improvements but relatively few new features as such (the new parallels driver being postponed to the actual release of the hypervisor). I would like to raise the attention to Dan patch set to implement ACL support to the API, a very needed feature which would bring us very close to what I would hope for a 1.0.0 release: https://www.redhat.com/archives/libvir-list/2012-May/msg00090.html Let's try to bring this in for the next release ! Features: - qemu: allow snapshotting of sheepdog and rbd disks (Josh Durgin) - blockjob: add new APIs (Eric Blake) Documentation: - mention migration issue of which credentials are used (Eric Blake) - Add 'maintenance releases' link in 'News' sidebar (Cole Robinson) - Added Snooze cloud manager to the IaaS section (Eugen Feller) - python: Fix doc directory name for stable releases (Cole Robinson) - virsh: Fix and clarify the --title flag for the list command in man page (Peter Krempa) - Improve the schema for fs device (Osier Yang) - openvz: Correct the comments for new node APIs (Osier Yang) - fix 'omitted' typo in <cputune> doc (Christophe Fergeau) - add missing in <vcpu placement> doc (Christophe Fergeau) - fix path to openvz network configuration file (Guido Günther) - Fix comment about GNUTLS initialization/cleanup (Daniel P. Berrange) - fix typo in previous patch (Eric Blake) - news.html.in: Fix void tag (Michal Privoznik) Portability: - qemu: fix build when !HAVE_NUMACTL (Eric Blake) - netlink: Fix build with libnl-3 (Jiri Denemark) - build: avoid link failure on Windows (Eric Blake) - qemu: avoid 32-bit compiler warning (Eric Blake) - build: fix build on cygwin (Eric Blake) - storage: fix build with iscsi (Eric Blake) - build: fix bootstrap on RHEL (Eric Blake) - win32: Properly handle TlsGetValue returning NULL (Matthias Bolte) - build: avoid type-punning in vbox (Eric Blake) - build: fix fresh checkout on RHEL5 (Eric Blake) - fix dependencies on DBus (Daniel P. Berrange) - tests: Fix libvirtdconftest in VPATH build (Jiri Denemark) - build: avoid s390 compiler warnings (Eric Blake) - Fix compilation error on 32bit (Stefan Berger) - test: fix build errors with gcc 4.7.0 and -O0 (Laine Stump) - Pull in GNULIB regex module for benefit of test suite on Win32 (Daniel P. Berrange) - Fix format specifiers in test cases on Win32 (Daniel P. Berrange) Bug Fixes: - esx: Fix memory leaks in error paths related to transferred ownership (Matthias Bolte) - qemu: Don't skip detection of virtual cpu's on non KVM targets (Peter Krempa) - qemu: Re-detect virtual cpu threads after cpu hot (un)plug. (Peter Krempa) - build: fix stamp file name (Eric Blake) - usb: fix crash when failing to attach a second usb device (Guannan Ren) - build: Fix the typo in configure.ac (Osier Yang) - conf: Fix memory leaks in virStoragePoolDefParseSource (Alex Jia) - Report error when parsing character device target type (Jim Fehlig) - snapshot: allow block devices past cgroup (Eric Blake) - domain_conf: add "default" to list of valid spice channels (Alon Levy) - domain_conf: add "usbredir" to list of valid spice channels (Alon Levy) - virsh: avoid heap corruption leading to virsh abort (Jim Meyering) - util: fix libvirtd startup failure due to netlink error (Laine Stump) - qemu: call usb search function for hostdev initialization and hotplug (Guannan Ren) - qemu: Emit compatible XML when migrating a domain (Jiri Denemark) - qemu: don't modify domain on failed blockiotune (Eric Blake) - node_device: fix possible non-terminated string (Stefan Berger) - uuid: fix possible non-terminated string (Stefan Berger) - tests: fix resource leak (Stefan Berger) - qemu: fix resource leak (Stefan Berger) - vmx: fix resource leak (Stefan Berger) - Coverity: Fix resource leak in virnetlink.c (Osier Yang) - Coverity: Fix resource leak in nodeinfo.c (Osier Yang) - Coverity: Fix resource leak in test driver (Osier Yang) - Coverity: Fix resource leak in xen driver (Osier Yang) - Coverity: Fix resource leaks in phyp driver (Osier Yang) - Coverity: Fix the forward_null error in Python binding codes (Osier Yang) - Correct indent errors in the function qemuDomainNetsRestart (Li Zhang) - Make lxcContainerSetStdio the last thing to be called in container startup (Daniel P. Berrange) - maint: avoid false positives on unmarked diagnostics (Eric Blake) - util: Avoid libvirtd crash in virNetDevTapCreate (Alex Jia) - storage: Break out the loop if duplicate pool is found (Osier Yang) - qemu: Make sure qemu can access its directory in hugetlbfs (Jiri Denemark) - More coverity findings addressed (Stefan Berger) - blockjob: fix block-stream bandwidth race (Eric Blake) - lxc: Fix coverity findings (Stefan Berger) - Serialize running apibuild.py (Cole Robinson) - macvtap: fix a typo (Stefan Berger) - nwfilter: address more coverity findings (Stefan Berger) - nwfilter: address coverity findings (Stefan Berger) - util: fix error messages in virNetlinkEventServiceStart (Laine Stump) - qemu: Avoid bogus error at the end of tunnelled migration (Jiri Denemark) - qemu: Fix detection of failed migration (Jiri Denemark) - rpc: Discard non-blocking calls only when necessary (Jiri Denemark) - qemu: Preserve original error during migration (Jiri Denemark) - util: fix crash when starting macvtap interfaces (Laine Stump) - fix memleak in linuxParseCPUmap (Hu Tao) - vbox: Fix passing an empty IMedium* array to IMachine::Delete (Matthias Bolte) - esx: Fix segfault in esxConnectToHost (Ryan Woodsmall) - virnetserver: handle sigaction correctly (Eric Blake) - virsh: avoid uninitialized memory usage (Eric Blake) - nwfilter: Fix support for trusted DHCP servers (Stefan Berger) - Fix a memory leak (Stefan Berger) - Do not enforce source type of console[0] (Jan Kiszka) - storage: lvm: use correct lv* command parameters (Cole Robinson) - Fix macvtap detection by also checking for IFLA_VF_MAX (Guido Günther) - conf: Avoid double assignment in virDomainDiskRemove (Michal Privoznik) - qemu: Fix mem leak in qemuProcessInitCpuAffinity (Michal Privoznik) - qemu,util: fix netlink callback registration for migration (D. Herrendoerfer) - qemuOpenFile: Don't force chown on NFS (Michal Privoznik) - daemon: Plug memory leaks (Alex Jia) - blockjob: allow for fast-finishing job (Eric Blake) - qemu: Fix deadlock when qemuDomainOpenConsole cleans up a connection (Peter Krempa) - snapshot: fix memory leak on error (Eric Blake) - qemu_ga: Don't overwrite errors on FSThaw (Michal Privoznik) - xen config: No vfb in HVM guest configuration (Stefan Bader) - virURIParse: don't forget to copy the user part (Guido Günther) - test: fix segfault in networkxml2argvtest (Laine Stump) - conf: Plug memory leaks on virDomainDiskDefParseXML (Alex Jia) - Fix parallel build in docs/ directory (Daniel P. Berrange) - qemu: Don't leak temporary list of USB devices (Michal Privoznik) Improvements: - qemu: Refactor qemuDomainSetVcpusFlags (Peter Krempa) - numad: Update comments in libvirt.spec.in (Osier Yang) - numad: Check numactl-devel if compiled with numad support (Osier Yang) - numad: Divide cur_balloon by 1024 before passing it to numad (Osier Yang) - numad: Always output 'placement' of <vcpu> (Osier Yang) - numad: Copy 'placement' of <numatune> to <vcpu> by default (Osier Yang) - numad: Set memory policy from numad advisory nodeset (Osier Yang) - tests: add some self-documentation to tests (Alon Levy) - util: set src_pid for virNetlinkCommand when appropriate (Laine Stump) - util: function to get local nl_pid used by netlink event socket (Laine Stump) - util: allow specifying both src and dst pid in virNetlinkCommand (Laine Stump) - openvz: simplify openvzDomainDefineCmd by using virCommandPtr (Guido Günther) - usb: create functions to search usb device accurately (Guannan Ren) - rpm: Handle different source URLs for maint releases (Cole Robinson) - qemu: Don't use virDomainDefFormat* directly (Jiri Denemark) - qemu: reject blockiotune if qemu too old (Eric Blake) - util: remove error log from stubs of virNetlinkEventServiceStart|Stop (Laine Stump) - openvz: read vmguarpages/privvmpages to set memory tunables (Guido Günther) - build: support libnl-3 (Serge Hallyn) - util: add functions for interating over json object (Dmitry Guryanov) - build: update pid_t type static check (Marc-André Lureau) - build: fix output of pid values (Marc-André Lureau) - virsh: output scaled values with correct units (Eric Blake) - virsh: make -h always give help (Eric Blake) - build: make ATTRIBUTE_NONNULL() a NOP unless STATIC_ANALYSIS is on (Laine Stump) - Ensure logging is initialized early in libvirt_lxc (Daniel P. Berrange) - Ensure LXC security driver is set unconditonally (Daniel P. Berrange) - Ensure libvirt_lxc process loads the live XML config (Daniel P. Berrange) - qemu: change rbd auth_supported separation character to ; (Josh Durgin) - storage: Allow multiple hosts for a storage pool (Wido den Hollander) - qemu_agent: Report error class at least (Michal Privoznik) - configure: Use ustar format for dist tarball (Cole Robinson) - qemu: Use common helper when probing qemu capabilities (Jiri Denemark) - qemu: improve errors related to offline domains (Eric Blake) - keepalive: Add ability to disable keepalive messages (Peter Krempa) - Add new functions to virSocketAddr (Stefan Berger) - macvtap: use embedded buffers (Stefan Berger) - Improve on virAtomic implementation (Stefan Berger) - build: Fix version of gettext macros (Peter Krempa) - openvz: add network interface stats (Guido Günther) - blockjob: enhance xml to track mirrors across libvirtd restart (Eric Blake) - blockjob: add 'blockcopy' to virsh (Eric Blake) - cpu: Improve error reporting on incompatible CPUs (Peter Krempa) - openvz: wire up getHostname (Guido Günther) - build: avoid strtol and strtod (Eric Blake) - conf: tighten up XML integer parsing (Eric Blake) - virsh: avoid strtol (Eric Blake) - Support for atomic operations on integers (Stefan Berger) - Implement virHashRemoveAll function (Stefan Berger) - util: only register callbacks for CREATE operations in virnetdevmacvlan.c (D. Herrendoerfer) - blockjob: add virsh blockpull --wait (Eric Blake) - qemu: use consistent error when qemu binary is too old (Eric Blake) - vbox: avoid provoking assertions in VBoxSVC (Jean-Baptiste Rouault) - conf: Do not parse cpuset only if the placement is auto (Osier Yang) - tests: Update read-bufsiz to delete the UUID of vm XML (Osier Yang) - test: Set the fixed uuid for the default XMLs (Osier Yang) - qemu: Split ide-drive into ide-cd and ide-hd (Osier Yang) - qemu: Split scsi-disk into into scsi-hd and scsi-cd (Osier Yang) - xen: do not use ioemu type for any emulated NIC (Stefan Bader) - qemuProcessStart: Switch to flags instead of bunch booleans (Michal Privoznik) - qemu: Avoid the memory allocation and freeing (Osier Yang) - numad: Ignore cpuset if placement is auto (Osier Yang) - numad: Convert node list to cpumap before setting affinity (Osier Yang) - openvz: wire up more node information functions (Guido Günther) - virnetdev: Check for defined IFLA_VF_* (Philipp Hahn) - Web placeholder for pending patches on the web site (Daniel Veillard) - xend_internal: Use domain/status for shutdown check (Stefan Bader) - blockjob: wire up qemu async virDomainBlockJobAbort (Eric Blake) - blockjob: optimize JSON event handler lookup (Eric Blake) - blockjob: add API for async virDomainBlockJobAbort (Adam Litke) - blockjob: add qemu capabilities related to block pull jobs (Eric Blake) - qemu: Warn on possibly incorrect usage of EnterMonitor* (Jiri Denemark) - qemu: Track job owner for better debugging (Jiri Denemark) - qemu: Avoid excessive calls to qemuDomainObjSaveJob() (Jiri Denemark) - daemon: Add libvirtd-config.c to the list of files to translate (Jiri Denemark) - Wire up <loader> to set the QEMU BIOS path (Daniel P. Berrange) - virsh: Clean up usage of boolean flag variables (Peter Krempa) - virsh: Clarify use of the --managed-save flag for the list command (Peter Krempa) - Replace daemon-conf test script with a proper test case (Daniel P. Berrange) - Switch libvirtd config loading code to use error APIs (Daniel P. Berrange) - Add API for loading daemon config from in-memory blob (Daniel P. Berrange) - Split libvirtd config file loading out into separate files (Daniel P. Berrange) - UML: fix iteration over consoles (MATSUDA, Daiki) - tests: avoid compiler warnings (Eric Blake) - openvz: support vzctl 3.1 (Ilja Livenson) - Don't install sysctl file on non-Linux hosts (Daniel P. Berrange) - Add linuxNodeInfoCPUPopulate to src/libvirt_linux.syms (Daniel P. Berrange) - qemu: Build activeUsbHostdevs list on process reconnect (Michal Privoznik) - qemu: Delete USB devices used by domain on stop (Michal Privoznik) - Fix initial hypervisor conditionals (Daniel P. Berrange) - Remove bogus xen-devel dep from libvirt-devel RPM (Daniel P. Berrange) - Introduce per-hypervisor virtual RPMs (Daniel P. Berrange) - Split config files & daemon off from main daemon RPM (Daniel P. Berrange) - Remove API XML files from libvirt RPM (Daniel P. Berrange) - Move all documentation into a -docs sub-RPM (Daniel P. Berrange) - virsh: Clarify escape sequence (Michal Privoznik) Cleanups: - building: remove libvirt_dbus.syms from EXTRA_DIST (Wen Congyang) - conf: remove redundant () (Eric Blake) - util: remove dead casts (Eric Blake) - virsh: minor syntactic cleanups (Eric Blake) - gitignore: Reorder alphabetically (Michal Privoznik) Thanks everybody for helping with the release, be it with suggestion, reports, documentation, patches or reviews ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

3 2

[libvirt] [PATCH] build: really silence the 32-bit warning
by Eric Blake 14 May '12

14 May '12

Commit cdce2f42d tried to silence a compiler warning on 32-bit builds, but the gcc shipped with RHEL 5 is old enough that the type conversion via multiplication by 1 was insufficient for the task. * src/qemu/qemu_monitor.c (qemuMonitorBlockJob): Previous attempt didn't get past all gcc versions. --- Pushing under the build-breaker rule. src/qemu/qemu_monitor.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 0d4319d..7d69c67 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -2785,13 +2785,14 @@ int qemuMonitorBlockJob(qemuMonitorPtr mon, modern); /* Convert bandwidth MiB to bytes */ - if (bandwidth * 1ULL > ULLONG_MAX / 1024 / 1024) { + speed = bandwidth; + if (speed > ULLONG_MAX / 1024 / 1024) { qemuReportError(VIR_ERR_OVERFLOW, _("bandwidth must be less than %llu"), ULLONG_MAX / 1024 / 1024); return -1; } - speed = bandwidth * 1024ULL * 1024ULL; + speed <<= 20; if (mon->json) ret = qemuMonitorJSONBlockJob(mon, device, base, speed, info, mode, -- 1.7.7.6

2 1

[libvirt] [PATCH] Move user libvirtd socket out of abstract namespace
by Daniel P. Berrange 14 May '12

14 May '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> The current unprivileged user libvirtd sockets are in the abstract namespace. This has a number of problems - You can't connect to them remotely using the nc/ssh tunnel - This is not portable for OS-X - Parent directory permissions don't apply --- daemon/libvirtd.c | 2 +- src/remote/remote_driver.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 5830069..2696c54 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -300,7 +300,7 @@ daemonUnixSocketPaths(struct daemonConfig *config, } umask(old_umask); - if (virAsprintf(sockfile, "@%s/libvirt-sock", rundir) < 0) { + if (virAsprintf(sockfile, "%s/libvirt-sock", rundir) < 0) { VIR_FREE(rundir); goto no_memory; } diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 4a9299a..5c87561 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -583,7 +583,7 @@ doRemoteOpen (virConnectPtr conn, if (!userdir) goto failed; - if (virAsprintf(&sockname, "@%s/" LIBVIRTD_USER_UNIX_SOCKET, userdir) < 0) { + if (virAsprintf(&sockname, "%s/" LIBVIRTD_USER_UNIX_SOCKET, userdir) < 0) { VIR_FREE(userdir); goto out_of_memory; } -- 1.7.10.1

2 1

[libvirt] [PATCHv4] Use XDG Base Directories instead of storing in home directory
by William Jon McCann 14 May '12

14 May '12

As defined in: http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html This offers a number of advantages: * Allows sharing a home directory between different machines, or sessions (eg. using NFS) * Cleanly separates cache, runtime (eg. sockets), or app data from user settings * Supports performing smart or selective migration of settings between different OS versions * Supports reseting settings without breaking things * Makes it possible to clear cache data to make room when the disk is filling up * Allows us to write a robust and efficient backup solution * Allows an admin flexibility to change where data and settings are stored * Dramatically reduces the complexity and incoherence of the system for administrators --- AUTHORS | 1 + daemon/libvirtd-config.c | 10 +-- daemon/libvirtd.c | 144 +++++++++++++++++++++++++++++++++------- daemon/libvirtd.pod.in | 2 +- docs/auth.html.in | 2 +- docs/uri.html.in | 2 +- src/libvirt.c | 4 +- src/libvirt_private.syms | 4 ++ src/network/bridge_driver.c | 8 ++- src/nwfilter/nwfilter_driver.c | 11 +-- src/qemu/qemu_driver.c | 32 ++++++--- src/remote/remote_driver.c | 4 +- src/remote/remote_driver.h | 2 +- src/secret/secret_driver.c | 11 +-- src/storage/storage_driver.c | 13 +--- src/uml/uml_driver.c | 10 +-- src/util/util.c | 62 +++++++++++++++++ src/util/util.h | 4 ++ src/util/virauth.c | 4 +- tools/virsh.c | 6 +- 20 files changed, 247 insertions(+), 89 deletions(-) diff --git a/AUTHORS b/AUTHORS index 31e3772..29b2c1d 100644 --- a/AUTHORS +++ b/AUTHORS @@ -236,6 +236,7 @@ Patches have also been contributed by: Wido den Hollander <wido(a)widodh.nl> Eugen Feller <eugen.feller(a)inria.fr> Dmitry Guryanov <dguryanov(a)parallels.com> + William Jon McCann <jmccann(a)redhat.com> [....send patches to get your name here....] diff --git a/daemon/libvirtd-config.c b/daemon/libvirtd-config.c index 471236c..8b95969 100644 --- a/daemon/libvirtd-config.c +++ b/daemon/libvirtd-config.c @@ -205,16 +205,16 @@ daemonConfigFilePath(bool privileged, char **configfile) if (!(*configfile = strdup(SYSCONFDIR "/libvirt/libvirtd.conf"))) goto no_memory; } else { - char *userdir = NULL; + char *configdir = NULL; - if (!(userdir = virGetUserDirectory(geteuid()))) + if (!(configdir = virGetUserConfigDirectory(geteuid()))) goto error; - if (virAsprintf(configfile, "%s/.libvirt/libvirtd.conf", userdir) < 0) { - VIR_FREE(userdir); + if (virAsprintf(configfile, "%s/libvirtd.conf", configdir) < 0) { + VIR_FREE(configdir); goto no_memory; } - VIR_FREE(userdir); + VIR_FREE(configdir); } return 0; diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index b098f6a..67248b3 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -239,17 +239,25 @@ daemonPidFilePath(bool privileged, if (!(*pidfile = strdup(LOCALSTATEDIR "/run/libvirtd.pid"))) goto no_memory; } else { - char *userdir = NULL; + char *rundir = NULL; + mode_t old_umask; - if (!(userdir = virGetUserDirectory(geteuid()))) + if (!(rundir = virGetUserRuntimeDirectory(geteuid()))) goto error; - if (virAsprintf(pidfile, "%s/.libvirt/libvirtd.pid", userdir) < 0) { - VIR_FREE(userdir); + old_umask = umask(077); + if (virFileMakePath(rundir) < 0) { + umask(old_umask); + goto error; + } + umask(old_umask); + + if (virAsprintf(pidfile, "%s/libvirtd.pid", rundir) < 0) { + VIR_FREE(rundir); goto no_memory; } - VIR_FREE(userdir); + VIR_FREE(rundir); } return 0; @@ -279,17 +287,25 @@ daemonUnixSocketPaths(struct daemonConfig *config, if (!(*rosockfile = strdup(LOCALSTATEDIR "/run/libvirt/libvirt-sock-ro"))) goto no_memory; } else { - char *userdir = NULL; + char *rundir = NULL; + mode_t old_umask; - if (!(userdir = virGetUserDirectory(geteuid()))) + if (!(rundir = virGetUserRuntimeDirectory(geteuid()))) goto error; - if (virAsprintf(sockfile, "@%s/.libvirt/libvirt-sock", userdir) < 0) { - VIR_FREE(userdir); + old_umask = umask(077); + if (virFileMakePath(rundir) < 0) { + umask(old_umask); + goto error; + } + umask(old_umask); + + if (virAsprintf(sockfile, "@%s/libvirt-sock", rundir) < 0) { + VIR_FREE(rundir); goto no_memory; } - VIR_FREE(userdir); + VIR_FREE(rundir); } } return 0; @@ -593,16 +609,25 @@ daemonSetupLogging(struct daemonConfig *config, LOCALSTATEDIR) == -1) goto no_memory; } else { - char *userdir = virGetUserDirectory(geteuid()); - if (!userdir) + char *logdir = virGetUserCacheDirectory(geteuid()); + mode_t old_umask; + + if (!logdir) + goto error; + + old_umask = umask(077); + if (virFileMakePath(logdir) < 0) { + umask(old_umask); goto error; + } + umask(old_umask); - if (virAsprintf(&tmp, "%d:file:%s/.libvirt/libvirtd.log", - virLogGetDefaultPriority(), userdir) == -1) { - VIR_FREE(userdir); + if (virAsprintf(&tmp, "%d:file:%s/libvirtd.log", + virLogGetDefaultPriority(), logdir) == -1) { + VIR_FREE(logdir); goto no_memory; } - VIR_FREE(userdir); + VIR_FREE(logdir); } } else { if (virAsprintf(&tmp, "%d:stderr", virLogGetDefaultPriority()) < 0) @@ -722,6 +747,76 @@ static int daemonStateInit(virNetServerPtr srv) return 0; } +static int migrateProfile(void) +{ + char *old_base = NULL; + char *updated = NULL; + char *home = NULL; + char *xdg_dir = NULL; + char *config_dir = NULL; + const char *config_home; + int ret = -1; + mode_t old_umask; + + if (!(home = virGetUserDirectory(geteuid()))) + goto cleanup; + + if (virAsprintf(&old_base, "%s/.libvirt", home) < 0) { + goto cleanup; + } + + /* if the new directory is there or the old one is not: do nothing */ + if (!(config_dir = virGetUserConfigDirectory(geteuid()))) + goto cleanup; + + if (!virFileIsDir(old_base) || virFileExists(config_dir)) { + ret = 0; + goto cleanup; + } + + /* test if we already attempted to migrate first */ + if (virAsprintf(&updated, "%s/DEPRECATED-DIRECTORY", old_base) < 0) { + goto cleanup; + } + if (virFileExists(updated)) { + goto cleanup; + } + + config_home = getenv("XDG_CONFIG_HOME"); + if (config_home && config_home[0] != '\0') { + xdg_dir = strdup(config_home); + } else { + if (virAsprintf(&xdg_dir, "%s/.config", home) < 0) { + goto cleanup; + } + } + + old_umask = umask(077); + if (virFileMakePath(xdg_dir) < 0) { + umask(old_umask); + goto cleanup; + } + umask(old_umask); + + if (rename(old_base, config_dir) < 0) { + int fd = creat(updated, 0600); + VIR_FORCE_CLOSE(fd); + VIR_ERROR(_("Unable to migrate %s to %s"), old_base, config_dir); + goto cleanup; + } + + ret = 0; + + cleanup: + VIR_FREE(home); + VIR_FREE(old_base); + VIR_FREE(xdg_dir); + VIR_FREE(config_dir); + VIR_FREE(updated); + + return ret; +} + /* Print command-line usage. */ static void daemonUsage(const char *argv0, bool privileged) @@ -775,10 +870,10 @@ libvirt management daemon:\n"), argv0); Default paths:\n\ \n\ Configuration file (unless overridden by -f):\n\ - $HOME/.libvirt/libvirtd.conf\n\ + $XDG_CONFIG_HOME/libvirt/libvirtd.conf\n\ \n\ Sockets:\n\ - $HOME/.libvirt/libvirt-sock (in UNIX abstract namespace)\n\ + $XDG_RUNTIME_HOME/libvirt/libvirt-sock (in UNIX abstract namespace)\n\ \n\ TLS:\n\ CA certificate: $HOME/.pki/libvirt/cacert.pem\n\ @@ -786,7 +881,7 @@ libvirt management daemon:\n"), argv0); Server private key: $HOME/.pki/libvirt/serverkey.pem\n\ \n\ PID file:\n\ - $HOME/.libvirt/libvirtd.pid\n\ + $XDG_RUNTIME_HOME/libvirt/libvirtd.pid\n\ \n")); } } @@ -931,6 +1026,9 @@ int main(int argc, char **argv) { exit(EXIT_FAILURE); } + if (migrateProfile() < 0) + exit(EXIT_FAILURE); + if (config->host_uuid && virSetHostUUIDStr(config->host_uuid) < 0) { VIR_ERROR(_("invalid host UUID: %s"), config->host_uuid); @@ -977,21 +1075,19 @@ int main(int argc, char **argv) { if (privileged) { run_dir = strdup(LOCALSTATEDIR "/run/libvirt"); } else { - char *user_dir = virGetUserDirectory(geteuid()); + run_dir = virGetUserRuntimeDirectory(geteuid()); - if (!user_dir) { + if (!run_dir) { VIR_ERROR(_("Can't determine user directory")); goto cleanup; } - ignore_value(virAsprintf(&run_dir, "%s/.libvirt/", user_dir)); - VIR_FREE(user_dir); } if (!run_dir) { virReportOOMError(); goto cleanup; } - old_umask = umask(022); + old_umask = umask(077); if (virFileMakePath(run_dir) < 0) { char ebuf[1024]; VIR_ERROR(_("unable to create rundir %s: %s"), run_dir, diff --git a/daemon/libvirtd.pod.in b/daemon/libvirtd.pod.in index 6e699b8..ea6c37d 100644 --- a/daemon/libvirtd.pod.in +++ b/daemon/libvirtd.pod.in @@ -85,7 +85,7 @@ command line using the B<-f>|B<--config> option. The sockets libvirtd will use when B<run as root>. -=item F<$HOME/.libvirt/libvirt-sock> +=item F<$XDG_RUNTIME_DIR/libvirt/libvirt-sock> The socket libvirtd will use when run as a B<non-root> user. diff --git a/docs/auth.html.in b/docs/auth.html.in index ecff0fc..60e4f11 100644 --- a/docs/auth.html.in +++ b/docs/auth.html.in @@ -25,7 +25,7 @@ for the authentication file using the following sequence: variable.</li> <li>The file path specified by the "authfile=/some/file" URI query parameter</li> - <li>The file $HOME/.libvirt/auth.conf</li> + <li>The file $XDG_CONFIG_DIR/libvirt/auth.conf</li> <li>The file /etc/libvirt/auth.conf</li> </ol> diff --git a/docs/uri.html.in b/docs/uri.html.in index 2f76e8f..5812ca9 100644 --- a/docs/uri.html.in +++ b/docs/uri.html.in @@ -30,7 +30,7 @@ virConnectPtr conn = virConnectOpenReadOnly ("test:///default"); To simplify life for administrators, it is possible to setup URI aliases in a libvirt client configuration file. The configuration file is <code>/etc/libvirt/libvirt.conf</code> -for the root user, or <code>$HOME/.libvirt/libvirt.conf</code> for any unprivileged user. +for the root user, or <code>$XDG_CONFIG_DIR/libvirt/libvirt.conf</code> for any unprivileged user. In this file, the following syntax can be used to setup aliases diff --git a/src/libvirt.c b/src/libvirt.c index cfd7711..22fc863 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -969,11 +969,11 @@ virConnectGetConfigFilePath(void) SYSCONFDIR) < 0) goto no_memory; } else { - char *userdir = virGetUserDirectory(geteuid()); + char *userdir = virGetUserConfigDirectory(geteuid()); if (!userdir) goto error; - if (virAsprintf(&path, "%s/.libvirt/libvirt.conf", + if (virAsprintf(&path, "%s/libvirt.conf", userdir) < 0) { VIR_FREE(userdir); goto no_memory; diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 88f8a21..250c8e4 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1112,6 +1112,7 @@ virFileFindMountPoint; virFileHasSuffix; virFileIsExecutable; virFileIsLink; +virFileIsDir; virFileLinkPointsTo; virFileLock; virFileMakePath; @@ -1132,6 +1133,9 @@ virGetGroupID; virGetGroupName; virGetHostname; virGetUserDirectory; +virGetUserConfigDirectory; +virGetUserCacheDirectory; +virGetUserRuntimeDirectory; virGetUserID; virGetUserName; virHexToBin; diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index d82212f..cea87c2 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -280,18 +280,20 @@ networkStartup(int privileged) { if ((base = strdup (SYSCONFDIR "/libvirt")) == NULL) goto out_of_memory; } else { - char *userdir = virGetUserDirectory(uid); + char *userdir = virGetUserCacheDirectory(uid); if (!userdir) goto error; if (virAsprintf(&driverState->logDir, - "%s/.libvirt/qemu/log", userdir) == -1) { + "%s/qemu/log", userdir) == -1) { VIR_FREE(userdir); goto out_of_memory; } + VIR_FREE(userdir); - if (virAsprintf(&base, "%s/.libvirt", userdir) == -1) { + userdir = virGetUserConfigDirectory(uid); + if (virAsprintf(&base, "%s", userdir) == -1) { VIR_FREE(userdir); goto out_of_memory; } diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c index ffb4b5d..3d732ab 100644 --- a/src/nwfilter/nwfilter_driver.c +++ b/src/nwfilter/nwfilter_driver.c @@ -87,16 +87,9 @@ nwfilterDriverStartup(int privileged) { goto out_of_memory; } else { uid_t uid = geteuid(); - char *userdir = virGetUserDirectory(uid); - - if (!userdir) + base = virGetUserConfigDirectory(uid); + if (!base) goto error; - - if (virAsprintf(&base, "%s/.libvirt", userdir) == -1) { - VIR_FREE(userdir); - goto out_of_memory; - } - VIR_FREE(userdir); } if (virAsprintf(&driverState->configDir, diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index bed8edb..954bb33 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -520,28 +520,38 @@ qemudStartup(int privileged) { goto out_of_memory; } else { uid_t uid = geteuid(); - char *userdir = virGetUserDirectory(uid); - if (!userdir) + char *rundir; + char *cachedir; + + cachedir = virGetUserCacheDirectory(uid); + if (!cachedir) goto error; if (virAsprintf(&qemu_driver->logDir, - "%s/.libvirt/qemu/log", userdir) == -1) { - VIR_FREE(userdir); + "%s/qemu/log", cachedir) == -1) { + VIR_FREE(cachedir); goto out_of_memory; } - - if (virAsprintf(&base, "%s/.libvirt", userdir) == -1) { - VIR_FREE(userdir); + if (virAsprintf(&qemu_driver->cacheDir, "%s/qemu/cache", cachedir) == -1) { + VIR_FREE(cachedir); goto out_of_memory; } - VIR_FREE(userdir); + VIR_FREE(cachedir); - if (virAsprintf(&qemu_driver->stateDir, "%s/qemu/run", base) == -1) + rundir = virGetUserRuntimeDirectory(uid); + if (!rundir) + goto error; + if (virAsprintf(&qemu_driver->stateDir, "%s/qemu/run", rundir) == -1) { + VIR_FREE(rundir); goto out_of_memory; + } + VIR_FREE(rundir); + + base = virGetUserConfigDirectory(uid); + if (!base) + goto error; if (virAsprintf(&qemu_driver->libDir, "%s/qemu/lib", base) == -1) goto out_of_memory; - if (virAsprintf(&qemu_driver->cacheDir, "%s/qemu/cache", base) == -1) - goto out_of_memory; if (virAsprintf(&qemu_driver->saveDir, "%s/qemu/save", base) == -1) goto out_of_memory; if (virAsprintf(&qemu_driver->snapshotDir, "%s/qemu/snapshot", base) == -1) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 7863b73..4a9299a 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -578,12 +578,12 @@ doRemoteOpen (virConnectPtr conn, case trans_unix: if (!sockname) { if (flags & VIR_DRV_OPEN_REMOTE_USER) { - char *userdir = virGetUserDirectory(getuid()); + char *userdir = virGetUserRuntimeDirectory(getuid()); if (!userdir) goto failed; - if (virAsprintf(&sockname, "@%s" LIBVIRTD_USER_UNIX_SOCKET, userdir) < 0) { + if (virAsprintf(&sockname, "@%s/" LIBVIRTD_USER_UNIX_SOCKET, userdir) < 0) { VIR_FREE(userdir); goto out_of_memory; } diff --git a/src/remote/remote_driver.h b/src/remote/remote_driver.h index 1504eec..aca9412 100644 --- a/src/remote/remote_driver.h +++ b/src/remote/remote_driver.h @@ -37,7 +37,7 @@ unsigned long remoteVersion(void); # define LIBVIRTD_TCP_PORT "16509" # define LIBVIRTD_PRIV_UNIX_SOCKET LOCALSTATEDIR "/run/libvirt/libvirt-sock" # define LIBVIRTD_PRIV_UNIX_SOCKET_RO LOCALSTATEDIR "/run/libvirt/libvirt-sock-ro" -# define LIBVIRTD_USER_UNIX_SOCKET "/.libvirt/libvirt-sock" +# define LIBVIRTD_USER_UNIX_SOCKET "libvirt-sock" # define LIBVIRTD_CONFIGURATION_FILE SYSCONFDIR "/libvirtd.conf" /* Defaults for PKI directory. */ diff --git a/src/secret/secret_driver.c b/src/secret/secret_driver.c index 088a243..f3fcce2 100644 --- a/src/secret/secret_driver.c +++ b/src/secret/secret_driver.c @@ -1013,16 +1013,9 @@ secretDriverStartup(int privileged) goto out_of_memory; } else { uid_t uid = geteuid(); - char *userdir = virGetUserDirectory(uid); - - if (!userdir) + base = virGetUserConfigDirectory(uid); + if (!base) goto error; - - if (virAsprintf(&base, "%s/.libvirt", userdir) == -1) { - VIR_FREE(userdir); - goto out_of_memory; - } - VIR_FREE(userdir); } if (virAsprintf(&driverState->directory, "%s/secrets", base) == -1) goto out_of_memory; diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c index f23ec7e..fd762c0 100644 --- a/src/storage/storage_driver.c +++ b/src/storage/storage_driver.c @@ -146,19 +146,12 @@ storageDriverStartup(int privileged) goto out_of_memory; } else { uid_t uid = geteuid(); - char *userdir = virGetUserDirectory(uid); - - if (!userdir) + base = virGetUserConfigDirectory(uid); + if (!base) goto error; - - if (virAsprintf(&base, "%s/.libvirt", userdir) == -1) { - VIR_FREE(userdir); - goto out_of_memory; - } - VIR_FREE(userdir); } - /* Configuration paths are either ~/.libvirt/storage/... (session) or + /* Configuration paths are either $USER_CONFIG_HOME/libvirt/storage/... (session) or * /etc/libvirt/storage/... (system). */ if (virAsprintf(&driverState->configDir, diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index 4e640ff..8a39d73 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -434,12 +434,12 @@ umlStartup(int privileged) "%s/run/libvirt/uml-guest", LOCALSTATEDIR) == -1) goto out_of_memory; } else { + base = virGetUserConfigDirectory(uid); + if (!base) + goto error; if (virAsprintf(&uml_driver->logDir, - "%s/.libvirt/uml/log", userdir) == -1) - goto out_of_memory; - - if (virAsprintf(&base, "%s/.libvirt", userdir) == -1) + "%s/uml/log", base) == -1) goto out_of_memory; if (virAsprintf(&uml_driver->monitorDir, @@ -447,7 +447,7 @@ umlStartup(int privileged) goto out_of_memory; } - /* Configuration paths are either ~/.libvirt/uml/... (session) or + /* Configuration paths are either $XDG_CONFIG_HOME/libvirt/uml/... (session) or * /etc/libvirt/uml/... (system). */ if (virAsprintf(&uml_driver->configDir, "%s/uml", base) == -1) diff --git a/src/util/util.c b/src/util/util.c index 48358b2..ec55118 100644 --- a/src/util/util.c +++ b/src/util/util.c @@ -665,6 +665,12 @@ char *virFindFileInPath(const char *file) return fullpath; } +bool virFileIsDir(const char *path) +{ + struct stat s; + return (stat (path, &s) == 0) && S_ISDIR (s.st_mode); +} + bool virFileExists(const char *path) { return access(path, F_OK) == 0; @@ -2304,6 +2310,62 @@ char *virGetUserDirectory(uid_t uid) return virGetUserEnt(uid, VIR_USER_ENT_DIRECTORY); } +static char *virGetXDGDirectory(uid_t uid, const char *xdgenvname, const char *xdgdefdir) +{ + const char *path = NULL; + char *ret = NULL; + char *home = virGetUserEnt(uid, VIR_USER_ENT_DIRECTORY); + + if (uid == getuid()) + path = getenv(xdgenvname); + + if (path && path[0]) { + if (virAsprintf(&ret, "%s/libvirt/", path) < 0) + goto no_memory; + } else { + if (virAsprintf(&ret, "%s/%s/libvirt/", home, xdgdefdir) < 0) + goto no_memory; + } + + cleanup: + VIR_FREE(home); + return ret; + no_memory: + virReportOOMError(); + goto cleanup; +} + +char *virGetUserConfigDirectory(uid_t uid) +{ + return virGetXDGDirectory(uid, "XDG_CONFIG_HOME", ".config"); +} + +char *virGetUserCacheDirectory(uid_t uid) +{ + return virGetXDGDirectory(uid, "XDG_CACHE_HOME", ".cache"); +} + +char *virGetUserRuntimeDirectory(uid_t uid) +{ + const char *path = NULL; + + if (uid == getuid ()) + path = getenv("XDG_RUNTIME_DIR"); + + if (!path || !path[0]) { + return virGetUserCacheDirectory(uid); + } else { + char *ret; + + if (virAsprintf(&ret, "%s/libvirt/", path) < 0) { + virReportOOMError(); + return NULL; + } + + return ret; + } +} + char *virGetUserName(uid_t uid) { return virGetUserEnt(uid, VIR_USER_ENT_NAME); diff --git a/src/util/util.h b/src/util/util.h index 85e8bd6..f5fa876 100644 --- a/src/util/util.h +++ b/src/util/util.h @@ -85,6 +85,7 @@ int virFileIsLink(const char *linkpath) char *virFindFileInPath(const char *file); +bool virFileIsDir (const char *file) ATTRIBUTE_NONNULL(1); bool virFileExists(const char *file) ATTRIBUTE_NONNULL(1); bool virFileIsExecutable(const char *file) ATTRIBUTE_NONNULL(1); @@ -228,6 +229,9 @@ char *virGetHostname(virConnectPtr conn); int virKillProcess(pid_t pid, int sig); char *virGetUserDirectory(uid_t uid); +char *virGetUserConfigDirectory(uid_t uid); +char *virGetUserCacheDirectory(uid_t uid); +char *virGetUserRuntimeDirectory(uid_t uid); char *virGetUserName(uid_t uid); char *virGetGroupName(gid_t gid); int virGetUserID(const char *name, diff --git a/src/util/virauth.c b/src/util/virauth.c index c59c55a..92ecb7c 100644 --- a/src/util/virauth.c +++ b/src/util/virauth.c @@ -65,10 +65,10 @@ int virAuthGetConfigFilePath(virConnectPtr conn, } } - if (!(userdir = virGetUserDirectory(geteuid()))) + if (!(userdir = virGetUserConfigDirectory(geteuid()))) goto cleanup; - if (virAsprintf(path, "%s/.libvirt/auth.conf", userdir) < 0) + if (virAsprintf(path, "%s/auth.conf", userdir) < 0) goto no_memory; VIR_DEBUG("Checking for readability of '%s'", *path); diff --git a/tools/virsh.c b/tools/virsh.c index 1207ac9..2ae9b71 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -19864,15 +19864,15 @@ vshReadlineInit(vshControl *ctl) /* Limit the total size of the history buffer */ stifle_history(500); - /* Prepare to read/write history from/to the ~/.virsh/history file */ - userdir = virGetUserDirectory(getuid()); + /* Prepare to read/write history from/to the $XDG_CACHE_HOME/virsh/history file */ + userdir = virGetUserCacheDirectory(getuid()); if (userdir == NULL) { vshError(ctl, "%s", _("Could not determine home directory")); return -1; } - if (virAsprintf(&ctl->historydir, "%s/.virsh", userdir) < 0) { + if (virAsprintf(&ctl->historydir, "%s/virsh", userdir) < 0) { vshError(ctl, "%s", _("Out of memory")); VIR_FREE(userdir); return -1; -- 1.7.10

3 2

[libvirt] [libvirt-php PATCH] Fix installation of libvirt-php.ini
by Ivo van den Abeelen 14 May '12

14 May '12

Building/installing libvirt-php seems to create an incomplete libvirt-php.ini file. This patch solves this issue, and replaces the '#' comments (deprecated in PHP 5.4). --- src/Makefile.am | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 4efd960..dd08d36 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -18,14 +18,14 @@ install-exec-local: $(INSTALL) -m 644 -D $(PACKAGE).so $(DESTDIR)$(PHPEDIR)/$(PACKAGE).so $(INSTALL) -m 755 -d $(DESTDIR)$(PHPCDIR) $(ECHO) "extension=$(PACKAGE).so" > $(DESTDIR)$(PHPCDIR)/libvirt-php.ini - $(ECHO) > $(DESTDIR)$(PHPCDIR)/libvirt-php.ini - $(ECHO) "[libvirt"] > $(DESTDIR)$(PHPCDIR)/libvirt-php.ini - $(ECHO) "# Path to ISO images for VM installations" > $(DESTDIR)$(PHPCDIR)/libvirt-php.ini - $(ECHO) "libvirt.iso_path=/var/lib/libvirt/images" > $(DESTDIR)$(PHPCDIR)/libvirt-php.ini - $(ECHO) "# Path where disk images for new VMs should be created" > $(DESTDIR)$(PHPCDIR)/libvirt-php.ini - $(ECHO) "libvirt.image_path=/var/lib/libvirt/images" > $(DESTDIR)$(PHPCDIR)/libvirt-php.ini - $(ECHO) "# Limit maximum number of libvirt connections" > $(DESTDIR)$(PHPCDIR)/libvirt-php.ini - $(ECHO) "libvirt.max_connections=5" > $(DESTDIR)$(PHPCDIR)/libvirt-php.ini + $(ECHO) >> $(DESTDIR)$(PHPCDIR)/libvirt-php.ini + $(ECHO) "[libvirt]" >> $(DESTDIR)$(PHPCDIR)/libvirt-php.ini + $(ECHO) "; Path to ISO images for VM installations" >> $(DESTDIR)$(PHPCDIR)/libvirt-php.ini + $(ECHO) "libvirt.iso_path=/var/lib/libvirt/images" >> $(DESTDIR)$(PHPCDIR)/libvirt-php.ini + $(ECHO) "; Path where disk images for new VMs should be created" >> $(DESTDIR)$(PHPCDIR)/libvirt-php.ini + $(ECHO) "libvirt.image_path=/var/lib/libvirt/images" >> $(DESTDIR)$(PHPCDIR)/libvirt-php.ini + $(ECHO) "; Limit maximum number of libvirt connections" >> $(DESTDIR)$(PHPCDIR)/libvirt-php.ini + $(ECHO) "libvirt.max_connections=5" >> $(DESTDIR)$(PHPCDIR)/libvirt-php.ini uninstall-local: $(RM) -f $(DESTDIR)$(PHPCDIR)/$(PACKAGE).ini -- 1.7.10.1

3 2