- Devel - libvirt List Archives

[libvirt] FYI: qemu -M option deprecated upstream, removed from -help output
by Richard W.M. Jones 27 Jul '11

27 Jul '11

I guess this may affect the qemu driver in future ... Thanks to Markus Armbruster for bringing this to my/our attention. commit 80f52a6694423da7a40e2ec39e14a5817184c7ef Author: Jan Kiszka <> Date: Sat Jul 23 12:39:46 2011 +0200 Deprecate -M command line options Superseded by -machine. Therefore, this patch removes -M from the help list and pushes -machine at the same place in the output. commit 9052ea6bf4962b1342aa56d4341bb55176ed9e45 Author: Jan Kiszka <> Date: Sat Jul 23 12:38:37 2011 +0200 Generalize -machine command line option -machine somehow suggests that it selects the machine, but it doesn't. Fix that before this command is set in stone. Actually, -machine should supersede -M and allow to introduce arbitrary per-machine options to the command line. That will change the internal realization again, but we will be able to keep the user interface stable. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones virt-df lists disk usage of guests without needing to install any software inside the virtual machine. Supports Linux and Windows. http://et.redhat.com/~rjones/virt-df/

3 4

[libvirt] [PATCH] Build: fix build if HAVE_AVAHI is not defined
by Stefan Berger 27 Jul '11

27 Jul '11

Fix the build if HAVE_AVAHI is not defined. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/rpc/virnetserver.c | 2 ++ 1 file changed, 2 insertions(+) Index: libvirt-acl/src/rpc/virnetserver.c =================================================================== --- libvirt-acl.orig/src/rpc/virnetserver.c +++ libvirt-acl/src/rpc/virnetserver.c @@ -783,7 +783,9 @@ void virNetServerFree(virNetServerPtr sr VIR_FREE(srv->clients); VIR_FREE(srv->mdnsGroupName); +#if HAVE_AVAHI virNetServerMDNSFree(srv->mdns); +#endif #if HAVE_DBUS if (srv->sysbus)

2 2

[libvirt] two manpage fixups
by Dave Allan 27 Jul '11

27 Jul '11

The following two patches fix up a couple of errors in the virsh manpage. Dave

3 7

[libvirt] [PATCH] Fix race in ref counting when handling RPC jobs
by Daniel P. Berrange 27 Jul '11

27 Jul '11

From: "Daniel P. Berrange" <berrange(a)redhat.com> When an incoming RPC message is ready for processing, virNetServerClientDispatchRead() will invoke the 'dispatchFunc' callback. This is set to virNetServerDispatchNewMessage This function puts the message + client in a queue for processing by the thread pool. The thread pool worker function is virNetServerHandleJob The first thing this does is acquire an extra reference on the 'client'. Unfortunately, between the time the message+client are put on the thread pool queue, and the time the worker runs, the client object may have had its last reference removed. We clearly need to add the reference to the client object before putting the client on the processing queue * src/rpc/virnetserverclient.c: Add a reference to the client when invoking the dispatch function * src/rpc/virnetserver.c: Don't acquire a reference to the client when in the worker thread --- src/rpc/virnetserver.c | 2 -- src/rpc/virnetserverclient.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/rpc/virnetserver.c b/src/rpc/virnetserver.c index 2b9dd4d..c93c3f8 100644 --- a/src/rpc/virnetserver.c +++ b/src/rpc/virnetserver.c @@ -131,8 +131,6 @@ static void virNetServerHandleJob(void *jobOpaque, void *opaque) virNetServerProgramPtr prog = NULL; size_t i; - virNetServerClientRef(job->client); - virNetServerLock(srv); VIR_DEBUG("server=%p client=%p message=%p", srv, job->client, job->msg); diff --git a/src/rpc/virnetserverclient.c b/src/rpc/virnetserverclient.c index 317d59c..3c0dba8 100644 --- a/src/rpc/virnetserverclient.c +++ b/src/rpc/virnetserverclient.c @@ -763,10 +763,12 @@ readmore: /* Send off to for normal dispatch to workers */ if (msg) { + client->refs++; if (!client->dispatchFunc || client->dispatchFunc(client, msg, client->dispatchOpaque) < 0) { virNetMessageFree(msg); client->wantClose = true; + client->refs--; return; } } -- 1.7.6

2 1

[libvirt] [PATCH] set cpu bandwidth for the vm
by Wen Congyang 26 Jul '11

26 Jul '11

The cpu bandwidth is applied at the vcpu group level. We should apply it at the vm group level too, because the vm may do heavy I/O, and it will affect the other vm. We apply cpu bandwidth at the vcpu and the vm group level, so we must ensure that max(child_quota) <= parent_quota when we modify cpu bandwidth. --- src/qemu/qemu_cgroup.c | 38 ++++++++++------- src/qemu/qemu_driver.c | 103 ++++++++++++++++++++++++++++++++++++----------- 2 files changed, 101 insertions(+), 40 deletions(-) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index d6e4cbc..2a10bd2 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -435,6 +435,7 @@ int qemuSetupCgroupForVcpu(struct qemud_driver *driver, virDomainObjPtr vm) unsigned int i; unsigned long long period = vm->def->cputune.period; long long quota = vm->def->cputune.quota; + long long vm_quota = 0; if (driver->cgroup == NULL) return 0; /* Not supported, so claim success */ @@ -447,26 +448,31 @@ int qemuSetupCgroupForVcpu(struct qemud_driver *driver, virDomainObjPtr vm) goto cleanup; } + /* Set cpu bandwidth for the vm */ + if (period || quota) { + if (qemuCgroupControllerActive(driver, VIR_CGROUP_CONTROLLER_CPU)) { + /* Ensure that we can multiply by vcpus without overflowing. */ + if (quota > LLONG_MAX / vm->def->vcpus) { + virReportSystemError(EINVAL, + _("%s"), + "Unable to set cpu bandwidth quota"); + goto cleanup; + } + + if (quota > 0) + vm_quota = quota * vm->def->vcpus; + else + vm_quota = quota; + if (qemuSetupCgroupVcpuBW(cgroup, period, vm_quota) < 0) + goto cleanup; + } + } + if (priv->nvcpupids == 0 || priv->vcpupids[0] == vm->pid) { /* If we does not know VCPU<->PID mapping or all vcpu runs in the same * thread, we cannot control each vcpu. */ - if (period || quota) { - if (qemuCgroupControllerActive(driver, VIR_CGROUP_CONTROLLER_CPU)) { - /* Ensure that we can multiply by vcpus without overflowing. */ - if (quota > LLONG_MAX / vm->def->vcpus) { - virReportSystemError(EINVAL, - _("%s"), - "Unable to set cpu bandwidth quota"); - goto cleanup; - } - - if (quota > 0) - quota *= vm->def->vcpus; - if (qemuSetupCgroupVcpuBW(cgroup, period, quota) < 0) - goto cleanup; - } - } + virCgroupFree(&cgroup); return 0; } diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 5df58b1..52e5d69 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6051,43 +6051,98 @@ qemuSetVcpusBWLive(virDomainObjPtr vm, virCgroupPtr cgroup, qemuDomainObjPrivatePtr priv = vm->privateData; virCgroupPtr cgroup_vcpu = NULL; int rc; + long long vm_quota = 0; + long long old_quota = 0; + unsigned long long old_period = 0; if (period == 0 && quota == 0) return 0; - if (priv->nvcpupids == 0 || priv->vcpupids[0] == vm->pid) { - /* If we does not know VCPU<->PID mapping or all vcpu runs in the same - * thread, we cannot control each vcpu. - */ - /* Ensure that we can multiply by vcpus without overflowing. */ - if (quota > LLONG_MAX / vm->def->vcpus) { - virReportSystemError(EINVAL, - _("%s"), - "Unable to set cpu bandwidth quota"); - goto cleanup; - } + /* Ensure that we can multiply by vcpus without overflowing. */ + if (quota > LLONG_MAX / vm->def->vcpus) { + virReportSystemError(EINVAL, + _("%s"), + "Unable to set cpu bandwidth quota"); + goto cleanup; + } + + if (quota > 0) + vm_quota = quota * vm->def->vcpus; + else + vm_quota = quota; - if (quota > 0) - quota *= vm->def->vcpus; - return qemuSetupCgroupVcpuBW(cgroup, period, quota); + rc = virCgroupGetCpuCfsQuota(cgroup, &old_quota); + if (rc < 0) { + virReportSystemError(-rc, "%s", + _("unable to get cpu bandwidth tunable")); + goto cleanup; } - for (i = 0; i < priv->nvcpupids; i++) { - rc = virCgroupForVcpu(cgroup, i, &cgroup_vcpu, 0); - if (rc < 0) { - virReportSystemError(-rc, - _("Unable to find vcpu cgroup for %s(vcpu:" - " %d)"), - vm->def->name, i); - goto cleanup; + rc = virCgroupGetCpuCfsPeriod(cgroup, &old_period); + if (rc < 0) { + virReportSystemError(-rc, "%s", + _("unable to get cpu bandwidth period tunable")); + goto cleanup; + } + + /* + * If quota will be changed to a small value, we should modify vcpu's quota + * first. Otherwise, we should modify vm's quota first. + * + * If period will be changed to a small value, we should modify vm's period + * first. Otherwise, we should modify vcpu's period first. + * + * If both quota and period will be changed to a big/small value, we cannot + * modify period and quota together. + */ + if ((quota != 0) && (period != 0)) { + if (((quota > old_quota) && (period > old_period)) || + ((quota < old_quota) && (period < old_period))) { + /* modify period */ + if (qemuSetVcpusBWLive(vm, cgroup, period, 0) < 0) + goto cleanup; + + /* modify quota */ + if (qemuSetVcpusBWLive(vm, cgroup, 0, quota) < 0) + goto cleanup; + return 0; } + } - if (qemuSetupCgroupVcpuBW(cgroup_vcpu, period, quota) < 0) + if (((vm_quota != 0) && (vm_quota > old_quota)) || + ((period != 0) && (period < old_period))) + /* Set cpu bandwidth for the vm */ + if (qemuSetupCgroupVcpuBW(cgroup, period, vm_quota) < 0) goto cleanup; - virCgroupFree(&cgroup_vcpu); + /* If we does not know VCPU<->PID mapping or all vcpu runs in the same + * thread, we cannot control each vcpu. So we only modify cpu bandwidth + * when each vcpu has a separated thread. + */ + if (priv->nvcpupids != 0 && priv->vcpupids[0] != vm->pid) { + for (i = 0; i < priv->nvcpupids; i++) { + rc = virCgroupForVcpu(cgroup, i, &cgroup_vcpu, 0); + if (rc < 0) { + virReportSystemError(-rc, + _("Unable to find vcpu cgroup for %s(vcpu:" + " %d)"), + vm->def->name, i); + goto cleanup; + } + + if (qemuSetupCgroupVcpuBW(cgroup_vcpu, period, quota) < 0) + goto cleanup; + + virCgroupFree(&cgroup_vcpu); + } } + if (((vm_quota != 0) && (vm_quota <= old_quota)) || + ((period != 0) && (period >= old_period))) + /* Set cpu bandwidth for the vm */ + if (qemuSetupCgroupVcpuBW(cgroup, period, vm_quota) < 0) + goto cleanup; + return 0; cleanup: -- 1.7.1

5 4

[libvirt] [PATCH] Fix typos in virsh.pod file
by Daniel P. Berrange 26 Jul '11

26 Jul '11

From: "Daniel P. Berrange" <berrange(a)redhat.com> * tools/virsh.pod: Fix missing > tag in docs --- tools/virsh.pod | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 5b7fa9c..ed9eb93 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -798,7 +798,7 @@ value are kilobytes (i.e. blocks of 1024 bytes). =back =item B<blkiotune> I<domain-id> [I<--weight> B<weight>] [[I<--config>] -[I<--live] | [I<--current>]] +[I<--live>] | [I<--current>]] Display or set the blkio parameters. QEMU/KVM supports I<--weight>. I<--weight> is in range [100, 1000]. @@ -811,7 +811,7 @@ exclusive. If no flag is specified, behavior is different depending on hypervisor. =item B<setvcpus> I<domain-id> I<count> [I<--maximum>] [[I<--config>] -[I<--live>] | [I<--current]] +[I<--live>] | [I<--current>]] Change the number of virtual CPUs active in a guest domain. By default, this command works on active guest domains. To change the settings for an -- 1.7.6

3 2

[libvirt] [PATCH] Fix build with gnutls 1.0.x branch
by Daniel P. Berrange 26 Jul '11

26 Jul '11

From: "Daniel P. Berrange" <berrange(a)redhat.com> --- src/rpc/virnettlscontext.c | 15 +++++++++++++++ tests/virnettlscontexttest.c | 2 +- 2 files changed, 16 insertions(+), 1 deletions(-) diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index db03669..2a58ede 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -139,6 +139,15 @@ static int virNetTLSContextCheckCertTimes(gnutls_x509_crt_t cert, return 0; } + +#ifndef GNUTLS_1_0_COMPAT +/* + * The gnutls_x509_crt_get_basic_constraints function isn't + * available in GNUTLS 1.0.x branches. This isn't critical + * though, since gnutls_certificate_verify_peers2 will do + * pretty much the same check at runtime, so we can just + * disable this code + */ static int virNetTLSContextCheckCertBasicConstraints(gnutls_x509_crt_t cert, const char *certFile, bool isServer, @@ -180,6 +189,8 @@ static int virNetTLSContextCheckCertBasicConstraints(gnutls_x509_crt_t cert, return 0; } +#endif + static int virNetTLSContextCheckCertKeyUsage(gnutls_x509_crt_t cert, const char *certFile, @@ -412,9 +423,11 @@ static int virNetTLSContextCheckCert(gnutls_x509_crt_t cert, isServer, isCA) < 0) return -1; +#ifndef GNUTLS_1_0_COMPAT if (virNetTLSContextCheckCertBasicConstraints(cert, certFile, isServer, isCA) < 0) return -1; +#endif if (virNetTLSContextCheckCertKeyUsage(cert, certFile, isCA) < 0) @@ -1019,11 +1032,13 @@ static int virNetTLSContextValidCertificate(virNetTLSContextPtr ctxt, /* !sess->isServer, since on the client, we're validating the * server's cert, and on the server, the client's cert */ +#ifndef GNUTLS_1_0_COMPAT if (virNetTLSContextCheckCertBasicConstraints(cert, "[session]", !sess->isServer, false) < 0) { gnutls_x509_crt_deinit(cert); goto authdeny; } +#endif if (virNetTLSContextCheckCertKeyUsage(cert, "[session]", false) < 0) { diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c index f2af4f0..12ecf1e 100644 --- a/tests/virnettlscontexttest.c +++ b/tests/virnettlscontexttest.c @@ -33,7 +33,7 @@ #include "command.h" #include "network.h" -#if !defined WIN32 && HAVE_LIBTASN1_H +#if !defined WIN32 && HAVE_LIBTASN1_H && !defined GNUTLS_1_0_COMPAT # include <libtasn1.h> # include <gnutls/gnutls.h> # include <gnutls/x509.h> -- 1.7.6

2 1

[libvirt] [PATCH] Fix import of private key with older gnutls
by Daniel P. Berrange 26 Jul '11

26 Jul '11

With older GNUTLS the gnutls_x509_privkey_import function is unable to import our private key. Instead we must use the alternative gnutls_x509_privkey_import_pkcs8() (as certtool does). * virnettlscontexttest.c: Fix import of private key with older gnutls. Also add missing newlines to key --- tests/virnettlscontexttest.c | 47 ++++++++++++++++++++++++----------------- 1 files changed, 27 insertions(+), 20 deletions(-) diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c index dfc0ac4..f2af4f0 100644 --- a/tests/virnettlscontexttest.c +++ b/tests/virnettlscontexttest.c @@ -57,24 +57,24 @@ extern const ASN1_ARRAY_TYPE pkix_asn1_tab[]; * here's one we prepared earlier :-) */ gnutls_x509_privkey_t privkey; -# define PRIVATE_KEY \ - "-----BEGIN PRIVATE KEY-----\n" \ - "MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALVcr" \ - "BL40Tm6yq88FBhJNw1aaoCjmtg0l4dWQZ/e9Fimx4ARxFpT+ji4FE" \ - "Cgl9s/SGqC+1nvlkm9ViSo0j7MKDbnDB+VRHDvMAzQhA2X7e8M0n9" \ - "rPolUY2lIVC83q0BBaOBkCj2RSmT2xTEbbC2xLukSrg2WP/ihVOxc" \ - "kXRuyFtzAgMBAAECgYB7slBexDwXrtItAMIH6m/U+LUpNe0Xx48OL" \ - "IOn4a4whNgO/o84uIwygUK27ZGFZT0kAGAk8CdF9hA6ArcbQ62s1H" \ - "myxrUbF9/mrLsQw1NEqpuUk9Ay2Tx5U/wPx35S3W/X2AvR/ZpTnCn" \ - "2q/7ym9fyiSoj86drD7BTvmKXlOnOwQJBAPOFMp4mMa9NGpGuEssO" \ - "m3Uwbp6lhcP0cA9MK+iOmeANpoKWfBdk5O34VbmeXnGYWEkrnX+9J" \ - "bM4wVhnnBWtgBMCQQC+qAEmvwcfhauERKYznMVUVksyeuhxhCe7EK" \ - "mPh+U2+g0WwdKvGDgO0PPt1gq0ILEjspMDeMHVdTwkaVBo/uMhAkA" \ - "Z5SsZyCP2aTOPFDypXRdI4eqRcjaEPOUBq27r3uYb/jeboVb2weLa" \ - "L1MmVuHiIHoa5clswPdWVI2y0em2IGoDAkBPSp/v9VKJEZabk9Frd" \ - "a+7u4fanrM9QrEjY3KhduslSilXZZSxrWjjAJPyPiqFb3M8XXA26W" \ - "nz1KYGnqYKhLcBAkB7dt57n9xfrhDpuyVEv+Uv1D3VVAhZlsaZ5Pp" \ - "dcrhrkJn2sa/+O8OKvdrPSeeu/N5WwYhJf61+CPoenMp7IFci\n" \ +# define PRIVATE_KEY \ + "-----BEGIN PRIVATE KEY-----\n" \ + "MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBALVcr\n" \ + "BL40Tm6yq88FBhJNw1aaoCjmtg0l4dWQZ/e9Fimx4ARxFpT+ji4FE\n" \ + "Cgl9s/SGqC+1nvlkm9ViSo0j7MKDbnDB+VRHDvMAzQhA2X7e8M0n9\n" \ + "rPolUY2lIVC83q0BBaOBkCj2RSmT2xTEbbC2xLukSrg2WP/ihVOxc\n" \ + "kXRuyFtzAgMBAAECgYB7slBexDwXrtItAMIH6m/U+LUpNe0Xx48OL\n" \ + "IOn4a4whNgO/o84uIwygUK27ZGFZT0kAGAk8CdF9hA6ArcbQ62s1H\n" \ + "myxrUbF9/mrLsQw1NEqpuUk9Ay2Tx5U/wPx35S3W/X2AvR/ZpTnCn\n" \ + "2q/7ym9fyiSoj86drD7BTvmKXlOnOwQJBAPOFMp4mMa9NGpGuEssO\n" \ + "m3Uwbp6lhcP0cA9MK+iOmeANpoKWfBdk5O34VbmeXnGYWEkrnX+9J\n" \ + "bM4wVhnnBWtgBMCQQC+qAEmvwcfhauERKYznMVUVksyeuhxhCe7EK\n" \ + "mPh+U2+g0WwdKvGDgO0PPt1gq0ILEjspMDeMHVdTwkaVBo/uMhAkA\n" \ + "Z5SsZyCP2aTOPFDypXRdI4eqRcjaEPOUBq27r3uYb/jeboVb2weLa\n" \ + "L1MmVuHiIHoa5clswPdWVI2y0em2IGoDAkBPSp/v9VKJEZabk9Frd\n" \ + "a+7u4fanrM9QrEjY3KhduslSilXZZSxrWjjAJPyPiqFb3M8XXA26W\n" \ + "nz1KYGnqYKhLcBAkB7dt57n9xfrhDpuyVEv+Uv1D3VVAhZlsaZ5Pp\n" \ + "dcrhrkJn2sa/+O8OKvdrPSeeu/N5WwYhJf61+CPoenMp7IFci\n" \ "-----END PRIVATE KEY-----\n" @@ -419,8 +419,15 @@ static gnutls_x509_privkey_t testTLSLoadKey(void) if ((err = gnutls_x509_privkey_import(key, &data, GNUTLS_X509_FMT_PEM)) < 0) { - VIR_WARN("Failed to init key %s", gnutls_strerror(err)); - abort(); + if (err != GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR) { + VIR_WARN("Failed to import key %s", gnutls_strerror(err)); + abort(); + } + + if ((err = gnutls_x509_privkey_import_pkcs8(key, &data, GNUTLS_X509_FMT_PEM, NULL, 0)) < 0) { + VIR_WARN("Failed to import PKCS8 key %s", gnutls_strerror(err)); + abort(); + } } return key; -- 1.7.1

4 4

[libvirt] [PATCH 1/2] Allow certificate sanity checking to be disabled
by Daniel P. Berrange 26 Jul '11

26 Jul '11

From: "Daniel P. Berrange" <berrange(a)redhat.com> When libvirtd starts it it will sanity check its own certs, and before libvirt clients connect to a remote server they will sanity check their own certs. This patch allows such sanity checking to be skipped. There is no strong reason to need to do this, other than to bypass possible libvirt bugs in sanity checking, or for testing purposes. libvirt.conf gains tls_no_sanity_certificate parameter to go along with tls_no_verify_certificate. The remote driver client URIs gain a no_sanity URI parameter * daemon/test_libvirtd.aug, daemon/libvirtd.conf, daemon/libvirtd.c, daemon/libvirtd.aug: Add parameter to allow cert sanity checks to be skipped * src/remote/remote_driver.c: Add no_sanity parameter to skip cert checks * src/rpc/virnettlscontext.c, src/rpc/virnettlscontext.h: Add new parameter for skipping sanity checks independantly of skipping session cert validation checks --- daemon/libvirtd.aug | 1 + daemon/libvirtd.c | 4 ++++ daemon/libvirtd.conf | 9 +++++++++ daemon/test_libvirtd.aug | 2 ++ src/remote/remote_driver.c | 15 +++++++++------ src/rpc/virnettlscontext.c | 36 +++++++++++++++++++++++------------- src/rpc/virnettlscontext.h | 4 ++++ 7 files changed, 52 insertions(+), 19 deletions(-) diff --git a/daemon/libvirtd.aug b/daemon/libvirtd.aug index 0e06142..3f47ebb 100644 --- a/daemon/libvirtd.aug +++ b/daemon/libvirtd.aug @@ -48,6 +48,7 @@ module Libvirtd = | str_entry "crl_file" let authorization_entry = bool_entry "tls_no_verify_certificate" + | bool_entry "tls_no_sanity_certificate" | str_array_entry "tls_allowed_dn_list" | str_array_entry "sasl_allowed_username_list" diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index f2f3a4e..9e044e2 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -120,6 +120,7 @@ struct daemonConfig { char *mdns_name; int tls_no_verify_certificate; + int tls_no_sanity_certificate; char **tls_allowed_dn_list; char **sasl_allowed_username_list; @@ -535,12 +536,14 @@ static int daemonSetupNetworking(virNetServerPtr srv, config->cert_file, config->key_file, (const char *const*)config->tls_allowed_dn_list, + config->tls_no_sanity_certificate ? false : true, config->tls_no_verify_certificate ? false : true))) goto error; } else { if (!(ctxt = virNetTLSContextNewServerPath(NULL, !privileged, (const char *const*)config->tls_allowed_dn_list, + config->tls_no_sanity_certificate ? false : true, config->tls_no_verify_certificate ? false : true))) goto error; } @@ -1054,6 +1057,7 @@ daemonConfigLoad(struct daemonConfig *data, GET_CONF_INT (conf, filename, mdns_adv); GET_CONF_STR (conf, filename, mdns_name); + GET_CONF_INT (conf, filename, tls_no_sanity_certificate); GET_CONF_INT (conf, filename, tls_no_verify_certificate); GET_CONF_STR (conf, filename, key_file); diff --git a/daemon/libvirtd.conf b/daemon/libvirtd.conf index 3a071b0..217f2f4 100644 --- a/daemon/libvirtd.conf +++ b/daemon/libvirtd.conf @@ -187,6 +187,15 @@ # +# Flag to disable verification of our own server certificates +# +# When libvirtd starts it performs some sanity checks against +# its own certificates. +# +# Default is to always sanity. Uncommenting this will disable +# sanity checks which is not a good idea +#tls_no_sanity_certificate = 1 + # Flag to disable verification of client certificates # # Client certificate verification is the primary authentication mechanism. diff --git a/daemon/test_libvirtd.aug b/daemon/test_libvirtd.aug index 5f8b644..58b7170 100644 --- a/daemon/test_libvirtd.aug +++ b/daemon/test_libvirtd.aug @@ -193,6 +193,7 @@ crl_file = \"/etc/pki/CA/crl.pem\" # Default is to always verify. Uncommenting this will disable # verification - make sure an IP whitelist is set tls_no_verify_certificate = 1 +tls_no_sanity_certificate = 1 # A whitelist of allowed x509 Distinguished Names @@ -468,6 +469,7 @@ audit_level = 2 { "#comment" = "Default is to always verify. Uncommenting this will disable" } { "#comment" = "verification - make sure an IP whitelist is set" } { "tls_no_verify_certificate" = "1" } + { "tls_no_sanity_certificate" = "1" } { "#empty" } { "#empty" } { "#comment" = "A whitelist of allowed x509 Distinguished Names" } diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index ec4133b..7993d50 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -351,7 +351,7 @@ doRemoteOpen (virConnectPtr conn, */ char *name = NULL, *command = NULL, *sockname = NULL, *netcat = NULL; char *port = NULL, *authtype = NULL, *username = NULL; - int no_verify = 0, no_tty = 0; + bool sanity = true, verify = true, tty = true; char *pkipath = NULL; /* Return code from this function, and the private data. */ @@ -425,11 +425,14 @@ doRemoteOpen (virConnectPtr conn, netcat = strdup (var->value); if (!netcat) goto out_of_memory; var->ignore = 1; + } else if (STRCASEEQ (var->name, "no_sanity")) { + sanity = atoi(var->value) == 0; + var->ignore = 1; } else if (STRCASEEQ (var->name, "no_verify")) { - no_verify = atoi (var->value); + verify = atoi (var->value) == 0; var->ignore = 1; } else if (STRCASEEQ (var->name, "no_tty")) { - no_tty = atoi (var->value); + tty = atoi (var->value) == 0; var->ignore = 1; } else if (STRCASEEQ(var->name, "pkipath")) { VIR_FREE(pkipath); @@ -509,7 +512,7 @@ doRemoteOpen (virConnectPtr conn, case trans_tls: priv->tls = virNetTLSContextNewClientPath(pkipath, geteuid() != 0 ? true : false, - no_verify ? false : true); + sanity, verify); if (!priv->tls) goto failed; priv->is_secure = 1; @@ -579,8 +582,8 @@ doRemoteOpen (virConnectPtr conn, port, command, username, - no_tty, - no_verify, + !tty, + !verify, netcat ? netcat : "nc", sockname))) goto failed; diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c index 5c94df6..bde4e7a 100644 --- a/src/rpc/virnettlscontext.c +++ b/src/rpc/virnettlscontext.c @@ -382,7 +382,7 @@ virNetTLSContextCheckCertDN(gnutls_x509_crt_t cert, certFile, gnutls_strerror(ret)); return -1; } - + VIR_DEBUG("Peer DN is %s", name); if (whitelist && virNetTLSContextCheckCertDNWhitelist(name, whitelist) <= 0) return -1; @@ -637,6 +637,7 @@ static virNetTLSContextPtr virNetTLSContextNew(const char *cacert, const char *cert, const char *key, const char *const*x509dnWhitelist, + bool sanityCheckCert, bool requireValidCert, bool isServer) { @@ -644,8 +645,8 @@ static virNetTLSContextPtr virNetTLSContextNew(const char *cacert, char *gnutlsdebug; int err; - VIR_DEBUG("cacert=%s cacrl=%s cert=%s key=%s requireValid=%d isServer=%d", - cacert, NULLSTR(cacrl), cert, key, requireValidCert, isServer); + VIR_DEBUG("cacert=%s cacrl=%s cert=%s key=%s sanityCheckCert=%d requireValid=%d isServer=%d", + cacert, NULLSTR(cacrl), cert, key, sanityCheckCert, requireValidCert, isServer); if (VIR_ALLOC(ctxt) < 0) { virReportOOMError(); @@ -675,7 +676,7 @@ static virNetTLSContextPtr virNetTLSContextNew(const char *cacert, goto error; } - if (requireValidCert && + if (sanityCheckCert && virNetTLSContextSanityCheckCredentials(isServer, cacert, cert) < 0) goto error; @@ -851,6 +852,7 @@ out_of_memory: static virNetTLSContextPtr virNetTLSContextNewPath(const char *pkipath, bool tryUserPkiPath, const char *const*x509dnWhitelist, + bool sanityCheckCert, bool requireValidCert, bool isServer) { @@ -862,7 +864,8 @@ static virNetTLSContextPtr virNetTLSContextNewPath(const char *pkipath, return NULL; ctxt = virNetTLSContextNew(cacert, cacrl, cert, key, - x509dnWhitelist, requireValidCert, isServer); + x509dnWhitelist, sanityCheckCert, + requireValidCert, isServer); VIR_FREE(cacert); VIR_FREE(cacrl); @@ -875,18 +878,20 @@ static virNetTLSContextPtr virNetTLSContextNewPath(const char *pkipath, virNetTLSContextPtr virNetTLSContextNewServerPath(const char *pkipath, bool tryUserPkiPath, const char *const*x509dnWhitelist, + bool sanityCheckCert, bool requireValidCert) { - return virNetTLSContextNewPath(pkipath, tryUserPkiPath, - x509dnWhitelist, requireValidCert, true); + return virNetTLSContextNewPath(pkipath, tryUserPkiPath, x509dnWhitelist, + sanityCheckCert, requireValidCert, true); } virNetTLSContextPtr virNetTLSContextNewClientPath(const char *pkipath, bool tryUserPkiPath, + bool sanityCheckCert, bool requireValidCert) { - return virNetTLSContextNewPath(pkipath, tryUserPkiPath, - NULL, requireValidCert, false); + return virNetTLSContextNewPath(pkipath, tryUserPkiPath, NULL, + sanityCheckCert, requireValidCert, false); } @@ -895,10 +900,11 @@ virNetTLSContextPtr virNetTLSContextNewServer(const char *cacert, const char *cert, const char *key, const char *const*x509dnWhitelist, + bool sanityCheckCert, bool requireValidCert) { - return virNetTLSContextNew(cacert, cacrl, cert, key, - x509dnWhitelist, requireValidCert, true); + return virNetTLSContextNew(cacert, cacrl, cert, key, x509dnWhitelist, + sanityCheckCert, requireValidCert, true); } @@ -906,10 +912,11 @@ virNetTLSContextPtr virNetTLSContextNewClient(const char *cacert, const char *cacrl, const char *cert, const char *key, + bool sanityCheckCert, bool requireValidCert) { - return virNetTLSContextNew(cacert, cacrl, key, cert, - NULL, requireValidCert, false); + return virNetTLSContextNew(cacert, cacrl, cert, key, NULL, + sanityCheckCert, requireValidCert, false); } @@ -1047,11 +1054,14 @@ int virNetTLSContextCheckCertificate(virNetTLSContextPtr ctxt, virNetTLSSessionPtr sess) { if (virNetTLSContextValidCertificate(ctxt, sess) < 0) { + virErrorPtr err = virGetLastError(); + VIR_WARN("Certificate check failed %s", err && err->message ? err->message : "<unknown>"); if (ctxt->requireValidCert) { virNetError(VIR_ERR_AUTH_FAILED, "%s", _("Failed to verify peer's certificate")); return -1; } + virResetLastError(); VIR_INFO("Ignoring bad certificate at user request"); } return 0; diff --git a/src/rpc/virnettlscontext.h b/src/rpc/virnettlscontext.h index f23667f..641d67e 100644 --- a/src/rpc/virnettlscontext.h +++ b/src/rpc/virnettlscontext.h @@ -33,10 +33,12 @@ typedef virNetTLSSession *virNetTLSSessionPtr; virNetTLSContextPtr virNetTLSContextNewServerPath(const char *pkipath, bool tryUserPkiPath, const char *const*x509dnWhitelist, + bool sanityCheckCert, bool requireValidCert); virNetTLSContextPtr virNetTLSContextNewClientPath(const char *pkipath, bool tryUserPkiPath, + bool sanityCheckCert, bool requireValidCert); virNetTLSContextPtr virNetTLSContextNewServer(const char *cacert, @@ -44,12 +46,14 @@ virNetTLSContextPtr virNetTLSContextNewServer(const char *cacert, const char *cert, const char *key, const char *const*x509dnWhitelist, + bool sanityCheckCert, bool requireValidCert); virNetTLSContextPtr virNetTLSContextNewClient(const char *cacert, const char *cacrl, const char *cert, const char *key, + bool sanityCheckCert, bool requireValidCert); void virNetTLSContextRef(virNetTLSContextPtr ctxt); -- 1.7.6

2 8

[libvirt] [PATCH 1/4] Fix memory leaks in MDNS code
by Daniel P. Berrange 26 Jul '11

26 Jul '11

From: "Daniel P. Berrange" <berrange(a)redhat.com> * src/rpc/virnetservermdns.c: Fix leaks --- src/rpc/virnetservermdns.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/src/rpc/virnetservermdns.c b/src/rpc/virnetservermdns.c index ff2d92d..335274a 100644 --- a/src/rpc/virnetservermdns.c +++ b/src/rpc/virnetservermdns.c @@ -583,6 +583,7 @@ void virNetServerMDNSFree(virNetServerMDNSPtr mdns) group = tmp; } + VIR_FREE(mdns->poller); VIR_FREE(mdns); } @@ -601,6 +602,7 @@ void virNetServerMDNSGroupFree(virNetServerMDNSGroupPtr grp) entry = tmp; } + VIR_FREE(grp->name); VIR_FREE(grp); } @@ -610,5 +612,6 @@ void virNetServerMDNSEntryFree(virNetServerMDNSEntryPtr entry) if (!entry) return; + VIR_FREE(entry->type); VIR_FREE(entry); } -- 1.7.6

3 8