- Devel - libvirt List Archives

[libvirt] [libvirt PATCHv3 00/10] DHCP snooping support for libvirt
by David L Stevens 26 Oct '11

26 Oct '11

This series of patches adds DHCP snooping support to libvirt. This version saves leases on disk for restoration after a libvirtd restart and allows selection of different ip_learning methods by setting filter parameter "ip_learning" to one of "any" (existing IP learning code) "none" (static only addresses) or "DHCP" (DHCP Snooping). This code does not (yet) support passing lease information across a migration. A migrated guest requires a DHCP ACK (e.g., via ifdown/ifup on the guest) to send/receive traffic for DHCP-learned addresses after a migration. Differences from v2: added support for multiple static IP addresses using a comma-separated list. David L Stevens (10): support continue/return allow required ARP packets reverse sense of address matching make default chain policy "DROP" allow chain modification support addRules support variable value changing add DHCP snooping add leasefile support support multiple static IP addresses examples/xml/nwfilter/Makefile.am | 5 +- examples/xml/nwfilter/allow-arp.xml | 5 +- examples/xml/nwfilter/allow-arpip.xml | 3 + examples/xml/nwfilter/allow-arpmac.xml | 3 + examples/xml/nwfilter/clean-traffic.xml | 6 +- examples/xml/nwfilter/no-arp-spoofing.xml | 38 +- examples/xml/nwfilter/no-arpip-spoofing.xml | 10 + examples/xml/nwfilter/no-arpmac-spoofing.xml | 5 + examples/xml/nwfilter/no-ip-spoofing.xml | 9 +- examples/xml/nwfilter/no-mac-spoofing.xml | 10 +- examples/xml/nwfilter/no-other-l2-traffic.xml | 13 +- examples/xml/nwfilter/no-other-rarp-traffic.xml | 3 - examples/xml/nwfilter/qemu-announce-self.xml | 1 - src/Makefile.am | 2 + src/conf/nwfilter_conf.c | 12 +- src/conf/nwfilter_conf.h | 16 +- src/nwfilter/nwfilter_dhcpsnoop.c | 938 +++++++++++++++++++++++ src/nwfilter/nwfilter_dhcpsnoop.h | 36 + src/nwfilter/nwfilter_driver.c | 5 + src/nwfilter/nwfilter_ebiptables_driver.c | 225 +++++-- src/nwfilter/nwfilter_gentech_driver.c | 225 +++++- src/nwfilter/nwfilter_gentech_driver.h | 11 + 22 files changed, 1445 insertions(+), 136 deletions(-) create mode 100644 examples/xml/nwfilter/allow-arpip.xml create mode 100644 examples/xml/nwfilter/allow-arpmac.xml create mode 100644 examples/xml/nwfilter/no-arpip-spoofing.xml create mode 100644 examples/xml/nwfilter/no-arpmac-spoofing.xml delete mode 100644 examples/xml/nwfilter/no-other-rarp-traffic.xml create mode 100644 src/nwfilter/nwfilter_dhcpsnoop.c create mode 100644 src/nwfilter/nwfilter_dhcpsnoop.h -- 1.7.6.4

3 34

[libvirt] [PATCH] build: use gnulib fdatasync
by Eric Blake 25 Oct '11

25 Oct '11

Commit 1726a73 hacked around MacOS' lack of fdatasync, since gnulib did not have it at the time. But now that we use newer gnulib, we can avoid the hack. * bootstrap.conf (gnulib_modules): Add fdatasync. * configure.ac (AC_CHECK_FUNCS_ONCE): Drop our own check. --- bootstrap.conf | 1 + configure.ac | 5 +---- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/bootstrap.conf b/bootstrap.conf index d029253..0faa2e2 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -40,6 +40,7 @@ environ fclose fcntl fcntl-h +fdatasync ffs fnmatch fsync diff --git a/configure.ac b/configure.ac index df19445..6a0936a 100644 --- a/configure.ac +++ b/configure.ac @@ -135,12 +135,9 @@ AC_CHECK_SIZEOF([long]) dnl Availability of various common functions (non-fatal if missing), dnl and various less common threadsafe functions -AC_CHECK_FUNCS_ONCE([cfmakeraw fdatasync geteuid getgid getgrnam_r getmntent_r \ +AC_CHECK_FUNCS_ONCE([cfmakeraw geteuid getgid getgrnam_r getmntent_r \ getpwuid_r getuid initgroups kill mmap posix_fallocate posix_memalign \ regexec sched_getaffinity]) -if test $ac_cv_func_fdatasync = no; then - AC_DEFINE([fdatasync], [fsync], [Define to fsync if you lack fdatasync]) -fi dnl Availability of pthread functions (if missing, win32 threading is dnl assumed). Because of $LIB_PTHREAD, we cannot use AC_CHECK_FUNCS_ONCE. -- 1.7.4.4

4 7

[libvirt] [PATCH/RFC] Introduce VIR_MIGRATE_FORCE flag to allow for risky migration
by Guido Günther 25 Oct '11

25 Oct '11

Hi, Migration will be disallowed when the vm uses host devices or has snapshots (qemuMigrationIsAllowed)[1]. Would it make sense to introduce a VIR_MIGRATE_FORCE similar to VIR_REVERT_FORCE here? We could then introduce error codes similar to the snapshot case (VIR_ERR_MIGRATE_RISKY). This path is just to illustrate the idea not to be applied as is. Cheers, -- Guido [1] Hopefully we can make migration with snapshots safe in the future by transfering the metadata. A current hack around is to put this onto shared storage and reread it on the destination side after migration.

3 4

[libvirt] [PATCH 0/8 v2] Allow a client to connect to QEMU's VNC by passing an FD via libvirt
by Daniel P. Berrange 25 Oct '11

25 Oct '11

A overdue followup to https://www.redhat.com/archives/libvir-list/2011-June/msg01130.html New in this series - Completely re-written all RPC integration, to work with the new RPC layer code - Added systemtap probes for FD passing - Split into multiple patches - Renamed API to virDomainOpenGraphics - Untangled a patch to the graphics event

2 21

[libvirt] [PATCH 0/4] New APIs and virsh commands to manage saved-state & core-dump files
by Hong Xiang 25 Oct '11

25 Oct '11

This patch series is a followup of "[PATCH 0/3] Restrict saved-state and core-dump files in controlled directories". A few new APIs and virsh commands are added to manage saved-state & core-dump files. Hong Xiang (4): New APIs to manage saved-state & core-dump files. qemu driver for new APIs to manage saved-state & core-dump files remote driver for new APIs to manage saved-state & core-dump files New virsh commands to manage saved-state and core-dump files include/libvirt/libvirt.h.in | 18 +++ python/generator.py | 2 + python/libvirt-override-api.xml | 10 ++ python/libvirt-override.c | 92 ++++++++++++ src/driver.h | 34 +++++ src/libvirt.c | 314 +++++++++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 12 ++ src/qemu/qemu_driver.c | 253 +++++++++++++++++++++++++++++++ src/remote/remote_driver.c | 8 + src/remote/remote_protocol.x | 61 ++++++++- src/rpc/gendispatch.pl | 1 + tools/virsh.c | 309 ++++++++++++++++++++++++++++++++++++++ 12 files changed, 1113 insertions(+), 1 deletions(-)

2 6

[libvirt] [PATCH] fix compile error :undefined reference to `virFileAccessibleAs'
by taget＠linux.vnet.ibm.com 25 Oct '11

25 Oct '11

From: Eli Qiao <taget(a)linux.vnet.ibm.com> Signed-off-by: Eli Qiao <taget(a)linux.vnet.ibm.com> --- src/libvirt_private.syms | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 3f97e23..e888204 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1154,6 +1154,7 @@ virTimeMs; virTimestamp; virTrimSpaces; virVasprintf; +virFileAccessibleAs; # uuid.h -- 1.7.4.4

2 1

[libvirt] [PATCH] util: Add virFileAccessibleAs to private symbols
by Michal Privoznik 25 Oct '11

25 Oct '11

Commit 458b7099b2e791b58f1286002974927d3e8bcc80 introduced this function. However it was not added into libvirt_private.syms so the compilation may not succeed on some hosts. --- Pushing under trivial & build breaker rules. src/libvirt_private.syms | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 3f97e23..a81966d 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1094,6 +1094,7 @@ virEnumToString; virEventAddHandle; virEventRemoveHandle; virFileAbsPath; +virFileAccessibleAs; virFileBuildPath; virFileExists; virFileFindMountPoint; -- 1.7.3.4

1 0

[libvirt] [PATCH 0/3] Restrict saved-state and core-dump files in controlled directories
by Hong Xiang 25 Oct '11

25 Oct '11

This patch series tries to address the issue discussed in: https://www.redhat.com/archives/libvir-list/2011-September/msg01025.html In this series: . The filename parameter for virDomainSave[Flags], virDomainRestore[Flags], virDomainSaveImageGetXMLDesc, virDomainSaveImageDefineXML, and virDomainCoreDump, is interpreted as an ID; . The file ID is later translated to a real filesystem pathname by corresponding drivers; . The real file system paths are under controlled directories, different for saved-state-files and core-dumps, respectively; Hong Xiang (3): New util API virBase64EncodePathname/virBase64DecodePathname Remove virFileAbsPath() from virDomainSave*() and virDomainCoreDump() calls Encode input file id in qemuDomainSave/Restore and qemudDomainCoreDump src/libvirt.c | 84 +++------------------------------------ src/libvirt_private.syms | 2 + src/qemu/qemu_conf.h | 3 + src/qemu/qemu_driver.c | 98 +++++++++++++++++++++++++++++++++++++++++++-- src/util/util.c | 73 ++++++++++++++++++++++++++++++++++ src/util/util.h | 4 ++ 6 files changed, 182 insertions(+), 82 deletions(-)

2 5

[libvirt] [PATCH v4 0/5] Allow to make disk optional on migration
by Michal Privoznik 25 Oct '11

25 Oct '11

This is a 4rd version of patches [1]. Diff to v3 includes Daniel's review and some other improvements. The aim of these patches is to mark CDROM and floppy optional, thus they might get dropped during migration, domain startup, restore, etc. The granularity is set on disk level, so user can decide which cd-roms are important and which not. There are 3 levels of optionality: - mandatory - fail if missing for any reason (the default) - requisite - fail if missing on boot up, drop if missing on migrate/restore/revert - optional - drop if missing at any start attempt. To assign a disk one of these, just append 'startupPolicy' attribute to its <source>. If a domain is then eventually started (migrated, restored, whatever), we check for source path being accessible (currently only qemu driver is supported) from hypervisor's POV. This is done by virFileAccessibleAs() function. Currently, only uid+gid are considered. Ideally, this should be extended to SElinux labeling and cgroups. 1: https://www.redhat.com/archives/libvir-list/2011-October/msg00896.html Michal Privoznik (5): conf: Introduce optional startupPolicy attribute for cdrom and floppy util: Create virFileAccessibleAs function qemu: Move device alias assigning before command line construction qemu: implement startupPolicy on_missing: Emit event on disk source dropping daemon/remote.c | 39 ++++++++++ docs/formatdomain.html.in | 26 ++++++- docs/schemas/domaincommon.rng | 22 +++++- examples/domain-events/events-c/event-test.c | 28 +++++++- examples/domain-events/events-python/event-test.py | 4 + include/libvirt/libvirt.h.in | 29 +++++++ python/libvirt-override-virConnect.py | 9 ++ python/libvirt-override.c | 52 +++++++++++++ src/conf/domain_conf.c | 43 ++++++++++- src/conf/domain_conf.h | 11 +++ src/conf/domain_event.c | 61 +++++++++++++++ src/conf/domain_event.h | 9 ++ src/libvirt_private.syms | 4 + src/qemu/qemu_command.c | 5 +- src/qemu/qemu_command.h | 1 + src/qemu/qemu_domain.c | 73 ++++++++++++++++++ src/qemu/qemu_domain.h | 4 + src/qemu/qemu_driver.c | 3 + src/qemu/qemu_process.c | 7 ++ src/remote/remote_driver.c | 35 +++++++++ src/remote/remote_protocol.x | 10 ++- src/remote_protocol-structs | 6 ++ src/util/util.c | 78 ++++++++++++++++++++ src/util/util.h | 3 + tests/qemuxml2argvtest.c | 3 + .../qemuxml2xmlout-disk-cdrom-empty.xml | 31 ++++++++ tests/qemuxmlnstest.c | 3 + 27 files changed, 585 insertions(+), 14 deletions(-) create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-cdrom-empty.xml -- 1.7.3.4

4 21

[libvirt] [PATCH 1/2] storage: plug iscsi memory leak
by Eric Blake 25 Oct '11

25 Oct '11

Detected by Coverity. virStoragePoolSourceFree does not free the actual passed-in pointer. A bigger patch would be to rename it virStoragePoolSourceClear to match behavior, or even split it into two functions depending on needed behavior; but this is the minimal fix to the one location out of eight that leaked memory. * src/storage/storage_backend_iscsi.c (virStorageBackendISCSIFindPoolSources): Free memory. --- src/storage/storage_backend_iscsi.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/storage/storage_backend_iscsi.c b/src/storage/storage_backend_iscsi.c index 99e69c9..c6e782d 100644 --- a/src/storage/storage_backend_iscsi.c +++ b/src/storage/storage_backend_iscsi.c @@ -611,6 +611,7 @@ cleanup: VIR_FREE(targets); VIR_FREE(portal); virStoragePoolSourceFree(source); + VIR_FREE(source); return ret; } -- 1.7.4.4

2 4