- Devel - libvirt List Archives

[libvirt] [PATCH] storage: Add comment to picking return value of qemu-img
by Michal Privoznik 24 May '11

24 May '11

Commit d7b2679253504d6defa9fc7159b572cfd6a25a95 introduced a return value picking of qemu-img on '-h', but without any comment. --- src/storage/storage_backend.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index c8e19c8..b423d11 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -628,6 +628,9 @@ static int virStorageBackendQEMUImgBackingFormat(const char *qemuimg) virCommandSetOutputBuffer(cmd, &help); virCommandClearCaps(cmd); + /* qemuimg doesn't return zero exit status on -h, + * therefore we need to provide pointer for storing + * exit status, although we don't parse it any later */ if (virCommandRun(cmd, &exitstatus) < 0) goto cleanup; -- 1.7.5.rc3

2 1

[libvirt] [PATCH 0/3] add support for changing blkio parameters for inactive domains
by Hu Tao 24 May '11

24 May '11

This series enables user to change blkio parameters for inactive domains from virsh command line. Hu Tao (3): Add new parameters for blkiotune update qemuDomainGetBlkioParameters to use flags Update qemuDomainSetBlkioParameters to use flags include/libvirt/libvirt.h.in | 6 + src/qemu/qemu_driver.c | 250 +++++++++++++++++++++++++++++------------- tools/virsh.c | 26 ++++- tools/virsh.pod | 6 +- 4 files changed, 210 insertions(+), 78 deletions(-) -- 1.7.3.1

1 3

[libvirt] Suggested schedule for next release 0.9.2
by Daniel Veillard 24 May '11

24 May '11

To try to keep on the monthly release schedule, I suggest to start the freeze for 0.9.2 at the beginning of next week. We are already at 227 commits since 0.9.1 and there is a number of patches that were sent and not finished reviewing or ack'ing. So let's try to push those this week and possibly over the week-end, with the target of entering freeze on Monday 30, targetting a release at the end of the next week. As usual if you submitted a patch which didn't get any review, please raise the attention about it on list, hopefully we can get everything reviewed in time. thanks ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH] spice: support streaming-video parameter
by Alon Levy 24 May '11

24 May '11

This adds a streaming-video=filter|all|off attribute. It is used to change the behavior of video stream detection in spice, the default is filter (the default for libvirt is not to specify it - the actual default is defined in libspice-server.so). Usage: <graphics type='spice' autoport='yes'> <streaming mode='off'/> </graphics> Tested with the above and with tests/qemuxml2argvtest. Signed-off-by: Alon Levy <alevy(a)redhat.com> --- Sorry for the resend, don't have the message id of my original message (now I'm registered to the list so won't happen again I hope). Michal, is this version good? --- docs/formatdomain.html.in | 6 ++++ docs/schemas/domain.rng | 12 ++++++++ src/conf/domain_conf.c | 30 ++++++++++++++++++++ src/conf/domain_conf.h | 11 +++++++ src/libvirt_private.syms | 2 + src/qemu/qemu_command.c | 3 ++ .../qemuxml2argv-graphics-spice.args | 2 +- .../qemuxml2argv-graphics-spice.xml | 1 + 8 files changed, 66 insertions(+), 1 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 59c3d51..6146a5d 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1798,6 +1798,7 @@ qemu-kvm -net nic,model=? /dev/null <channel name='main' mode='secure'/> <channel name='record' mode='insecure'/> <image compression='auto_glz'/> + <streaming mode='filter'/> </graphics></pre> Spice supports variable compression settings for audio, @@ -1816,6 +1817,11 @@ qemu-kvm -net nic,model=? /dev/null and <code>playback</code> for enabling audio stream compression (accepts <code>on</code> or <code>off</code>). + + Streaming mode is set by the <code>streaming</code> + element, settings it's <code>mode</code> attribute to one + of <code>filter</code>,<code>all</code> or <code>off</code>. + </dd> <dt><code>"rdp"</code></dt> <dd> diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index b252547..563981d 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -1334,6 +1334,18 @@ <empty/> </element> </optional> + <optional> + <element name="streaming"> + <attribute name="mode"> + <choice> + <value>filter</value> + <value>all</value> + <value>off</value> + </choice> + </attribute> + <empty/> + </element> + </optional> </interleave> </group> <group> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 6129bbc..c187450 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -359,6 +359,13 @@ VIR_ENUM_IMPL(virDomainGraphicsSpicePlaybackCompression, "on", "off"); +VIR_ENUM_IMPL(virDomainGraphicsSpiceStreamingMode, + VIR_DOMAIN_GRAPHICS_SPICE_STREAMING_MODE_LAST, + "default", + "filter", + "all", + "off"); + VIR_ENUM_IMPL(virDomainHostdevMode, VIR_DOMAIN_HOSTDEV_MODE_LAST, "subsystem", "capabilities") @@ -4168,6 +4175,26 @@ virDomainGraphicsDefParseXML(xmlNodePtr node, int flags) { VIR_FREE(compression); def->data.spice.playback = compressionVal; + } else if (xmlStrEqual(cur->name, BAD_CAST "streaming")) { + const char *mode = virXMLPropString(cur, "mode"); + int modeVal; + + if (!mode) { + virDomainReportError(VIR_ERR_XML_ERROR, "%s", + _("spice streaming missing mode")); + goto error; + } + if ((modeVal = + virDomainGraphicsSpiceStreamingModeTypeFromString(mode)) <= 0) { + virDomainReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unknown spice streaming mode")); + VIR_FREE(mode); + goto error; + + } + VIR_FREE(mode); + + def->data.spice.streaming = modeVal; } } cur = cur->next; @@ -8067,6 +8094,9 @@ virDomainGraphicsDefFormat(virBufferPtr buf, if (def->data.spice.playback) virBufferAsprintf(buf, " <playback compression='%s'/>\n", virDomainGraphicsSpicePlaybackCompressionTypeToString(def->data.spice.playback)); + if (def->data.spice.streaming) + virBufferVSprintf(buf, " <streaming mode='%s'/>\n", + virDomainGraphicsSpiceStreamingModeTypeToString(def->data.spice.streaming)); } if (children) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 5fe31d4..9d4349e 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -697,6 +697,15 @@ enum virDomainGraphicsSpicePlaybackCompression { VIR_DOMAIN_GRAPHICS_SPICE_PLAYBACK_COMPRESSION_LAST }; +enum virDomainGraphicsSpiceStreamingMode { + VIR_DOMAIN_GRAPHICS_SPICE_STREAMING_MODE_DEFAULT = 0, + VIR_DOMAIN_GRAPHICS_SPICE_STREAMING_MODE_FILTER, + VIR_DOMAIN_GRAPHICS_SPICE_STREAMING_MODE_ALL, + VIR_DOMAIN_GRAPHICS_SPICE_STREAMING_MODE_OFF, + + VIR_DOMAIN_GRAPHICS_SPICE_STREAMING_MODE_LAST +}; + typedef struct _virDomainGraphicsDef virDomainGraphicsDef; typedef virDomainGraphicsDef *virDomainGraphicsDefPtr; struct _virDomainGraphicsDef { @@ -738,6 +747,7 @@ struct _virDomainGraphicsDef { int jpeg; int zlib; int playback; + int streaming; } spice; } data; }; @@ -1506,6 +1516,7 @@ VIR_ENUM_DECL(virDomainGraphicsSpiceImageCompression) VIR_ENUM_DECL(virDomainGraphicsSpiceJpegCompression) VIR_ENUM_DECL(virDomainGraphicsSpiceZlibCompression) VIR_ENUM_DECL(virDomainGraphicsSpicePlaybackCompression) +VIR_ENUM_DECL(virDomainGraphicsSpiceStreamingMode) /* from libvirt.h */ VIR_ENUM_DECL(virDomainState) VIR_ENUM_DECL(virDomainNostateReason) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 7b6151c..d4f03fc 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -276,6 +276,8 @@ virDomainGraphicsSpicePlaybackCompressionTypeFromString; virDomainGraphicsSpicePlaybackCompressionTypeToString; virDomainGraphicsSpiceZlibCompressionTypeFromString; virDomainGraphicsSpiceZlibCompressionTypeToString; +virDomainGraphicsSpiceStreamingModeTypeFromString; +virDomainGraphicsSpiceStreamingModeTypeToString; virDomainGraphicsTypeFromString; virDomainGraphicsTypeToString; virDomainHostdevDefFree; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 2828823..1d30a6f 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -4037,6 +4037,9 @@ qemuBuildCommandLine(virConnectPtr conn, if (def->graphics[0]->data.spice.playback) virBufferAsprintf(&opt, ",playback-compression=%s", virDomainGraphicsSpicePlaybackCompressionTypeToString(def->graphics[0]->data.spice.playback)); + if (def->graphics[0]->data.spice.streaming) + virBufferVSprintf(&opt, ",streaming-video=%s", + virDomainGraphicsSpiceStreamingModeTypeToString(def->graphics[0]->data.spice.streaming)); virCommandAddArg(cmd, "-spice"); virCommandAddArgBuffer(cmd, &opt); diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args index 70cd35b..084a100 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args +++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.args @@ -4,6 +4,6 @@ unix:/tmp/test-monitor,server,nowait -no-acpi -boot c -hda \ /dev/HostVG/QEMUGuest1 -usb -spice port=5903,tls-port=5904,addr=127.0.0.1,\ x509-dir=/etc/pki/libvirt-spice,tls-channel=main,plaintext-channel=inputs,\ image-compression=auto_glz,jpeg-wan-compression=auto,zlib-glz-wan-compression=auto,\ -playback-compression=on -vga \ +playback-compression=on,streaming-video=filter -vga \ qxl -global qxl.vram_size=18874368 -device qxl,id=video1,vram_size=33554432,bus=pci.0,addr=0x4 \ -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml index a29f50d..0d3dd48 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml +++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice.xml @@ -28,6 +28,7 @@ <jpeg compression='auto'/> <zlib compression='auto'/> <playback compression='on'/> + <streaming mode='filter'/> </graphics> <video> <model type='qxl' vram='18432' heads='1'/> -- 1.7.5.1

2 1

[libvirt] [PATCH] Fix peer2peer migration with transient VMs
by Daniel P. Berrange 24 May '11

24 May '11

The qemuMigrationConfirm method shouldn't deal with final VM cleanup, since it can be called from the peer2peer migration, which expects to still use the 'vm' object afterwards. Push the cleanup code out of qemuMigrationConfirm, into its caller, qemuDomainMigrateConfirm3 * src/qemu/qemu_driver.c: Add VM cleanup code to qemuDomainMigrateConfirm3 * src/qemu/qemu_migration.c, src/qemu/qemu_migration.h: Remove job handling cleanup from qemuMigrationConfirm --- src/qemu/qemu_driver.c | 25 +++++++++++++++++++++- src/qemu/qemu_migration.c | 51 +++++++++++++++------------------------------ src/qemu/qemu_migration.h | 3 +- 3 files changed, 42 insertions(+), 37 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 4fdf5e9..771e401 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6292,6 +6292,7 @@ qemuDomainMigrateConfirm3(virDomainPtr domain, struct qemud_driver *driver = domain->conn->privateData; virDomainObjPtr vm; int ret = -1; + virErrorPtr orig_err; virCheckFlags(VIR_MIGRATE_LIVE | VIR_MIGRATE_PEER2PEER | @@ -6312,11 +6313,33 @@ qemuDomainMigrateConfirm3(virDomainPtr domain, goto cleanup; } + if (qemuDomainObjBeginJobWithDriver(driver, vm) < 0) + goto cleanup; + ret = qemuMigrationConfirm(driver, domain->conn, vm, cookiein, cookieinlen, - flags, cancelled, false); + flags, cancelled); + + orig_err = virSaveLastError(); + + if (qemuDomainObjEndJob(vm) == 0) { + vm = NULL; + } else if (!virDomainObjIsActive(vm) && + (!vm->persistent || (flags & VIR_MIGRATE_UNDEFINE_SOURCE))) { + if (flags & VIR_MIGRATE_UNDEFINE_SOURCE) + virDomainDeleteConfig(driver->configDir, driver->autostartDir, vm); + virDomainRemoveInactive(&driver->domains, vm); + vm = NULL; + } + + if (orig_err) { + virSetError(orig_err); + virFreeError(orig_err); + } cleanup: + if (vm) + virDomainObjUnlock(vm); qemuDriverUnlock(driver); return ret; } diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 40c40f3..88cab77 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -1920,7 +1920,7 @@ finish: cookieoutlen = 0; ret = qemuMigrationConfirm(driver, sconn, vm, cookiein, cookieinlen, - flags, cancelled, true); + flags, cancelled); /* If Confirm3 returns -1, there's nothing more we can * do, but fortunately worst case is that there is a * domain left in 'paused' state on source. @@ -2086,12 +2086,6 @@ int qemuMigrationPerform(struct qemud_driver *driver, event = virDomainEventNewFromObj(vm, VIR_DOMAIN_EVENT_STOPPED, VIR_DOMAIN_EVENT_STOPPED_MIGRATED); - if (!vm->persistent || (flags & VIR_MIGRATE_UNDEFINE_SOURCE)) { - virDomainDeleteConfig(driver->configDir, driver->autostartDir, vm); - if (qemuDomainObjEndJob(vm) > 0) - virDomainRemoveInactive(&driver->domains, vm); - vm = NULL; - } } ret = 0; @@ -2113,9 +2107,17 @@ endjob: VIR_DOMAIN_EVENT_RESUMED, VIR_DOMAIN_EVENT_RESUMED_MIGRATED); } - if (vm && - qemuDomainObjEndJob(vm) == 0) - vm = NULL; + if (vm) { + if (qemuDomainObjEndJob(vm) == 0) { + vm = NULL; + } else if (!virDomainObjIsActive(vm) && + (!vm->persistent || (flags & VIR_MIGRATE_UNDEFINE_SOURCE))) { + if (flags & VIR_MIGRATE_UNDEFINE_SOURCE) + virDomainDeleteConfig(driver->configDir, driver->autostartDir, vm); + virDomainRemoveInactive(&driver->domains, vm); + vm = NULL; + } + } cleanup: if (vm) @@ -2306,9 +2308,8 @@ int qemuMigrationConfirm(struct qemud_driver *driver, virDomainObjPtr vm, const char *cookiein, int cookieinlen, - unsigned int flags, - int retcode, - bool skipJob) + unsigned int flags ATTRIBUTE_UNUSED, + int retcode) { qemuMigrationCookiePtr mig; virDomainEventPtr event = NULL; @@ -2317,14 +2318,10 @@ int qemuMigrationConfirm(struct qemud_driver *driver, if (!(mig = qemuMigrationEatCookie(vm, cookiein, cookieinlen, 0))) return -1; - if (!skipJob && - qemuDomainObjBeginJobWithDriver(driver, vm) < 0) - goto cleanup; - if (!virDomainObjIsActive(vm)) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("guest unexpectedly quit")); - goto endjob; + goto cleanup; } /* Did the migration go as planned? If yes, kill off the @@ -2337,12 +2334,6 @@ int qemuMigrationConfirm(struct qemud_driver *driver, event = virDomainEventNewFromObj(vm, VIR_DOMAIN_EVENT_STOPPED, VIR_DOMAIN_EVENT_STOPPED_MIGRATED); - if (!vm->persistent || (flags & VIR_MIGRATE_UNDEFINE_SOURCE)) { - virDomainDeleteConfig(driver->configDir, driver->autostartDir, vm); - if (qemuDomainObjEndJob(vm) > 0) - virDomainRemoveInactive(&driver->domains, vm); - vm = NULL; - } } else { /* run 'cont' on the destination, which allows migration on qemu @@ -2354,7 +2345,7 @@ int qemuMigrationConfirm(struct qemud_driver *driver, if (virGetLastError() == NULL) qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("resume operation failed")); - goto endjob; + goto cleanup; } event = virDomainEventNewFromObj(vm, @@ -2362,22 +2353,14 @@ int qemuMigrationConfirm(struct qemud_driver *driver, VIR_DOMAIN_EVENT_RESUMED_MIGRATED); if (virDomainSaveStatus(driver->caps, driver->stateDir, vm) < 0) { VIR_WARN("Failed to save status on vm %s", vm->def->name); - goto endjob; + goto cleanup; } } qemuMigrationCookieFree(mig); rv = 0; -endjob: - if (vm && - !skipJob && - qemuDomainObjEndJob(vm) == 0) - vm = NULL; - cleanup: - if (vm) - virDomainObjUnlock(vm); if (event) qemuDomainEventQueue(driver, event); return rv; diff --git a/src/qemu/qemu_migration.h b/src/qemu/qemu_migration.h index a350579..08e3acc 100644 --- a/src/qemu/qemu_migration.h +++ b/src/qemu/qemu_migration.h @@ -90,8 +90,7 @@ int qemuMigrationConfirm(struct qemud_driver *driver, const char *cookiein, int cookieinlen, unsigned int flags, - int retcode, - bool skipJob); + int retcode); int qemuMigrationToFile(struct qemud_driver *driver, virDomainObjPtr vm, -- 1.7.4.4

2 1

[libvirt] [RESEND][PATCH v2] qemu allow persistent modifications of NICs
by KAMEZAWA Hiroyuki 24 May '11

24 May '11

Slightly updated against the latest git tree. but didn't update version number. == Now, only attach/detatch/update for disks are supporeted for inactive domains. This patch allows to modify network interfaces of inactive domains. Users can modify inactive domains with --persistent flag. Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu(a)jp.fujitsu.com> * src/conf/domain_conf.c: (virDomainNetInsert) : Insert a network device to domain definition. (virDomainNetIndexByMac) : Returns an index of net device in array. (virDomainNetRemoveByMac): Remove a NIC of passed MAC address. * src/qemu/qemu_driver.c (qemuDomainAttachDeviceConfig): add codes for NIC. (qemuDomainDetachDeviceConfig): add codes for NIC. Changelog v1->v2: - fixed virDomainNetInsert - removed target name check. (It seems I misunderstood something.) - fixed error check in qemuDomainAttachDeviceConfig - fixed error message in qemuDomainDetachDeviceConfig --- src/conf/domain_conf.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ src/conf/domain_conf.h | 4 ++++ src/libvirt_private.syms | 3 +++ src/qemu/qemu_driver.c | 31 +++++++++++++++++++++++++++++++ 4 files changed, 83 insertions(+), 0 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 6129bbc..d85c8bc 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -5177,6 +5177,51 @@ int virDomainDiskRemoveByName(virDomainDefPtr def, const char *name) return 0; } +int virDomainNetInsert(virDomainDefPtr def, virDomainNetDefPtr net) +{ + if (VIR_REALLOC_N(def->nets, def->nnets + 1) < 0) + return -1; + def->nets[def->nnets] = net; + def->nnets++; + return 0; +} + +int virDomainNetIndexByMac(virDomainDefPtr def, const unsigned char *mac) +{ + int i; + + for (i = 0; i < def->nnets; i++) + if (!memcmp(def->nets[i]->mac, mac, VIR_MAC_BUFLEN)) + return i; + return -1; +} + +static void virDomainNetRemove(virDomainDefPtr def, size_t i) +{ + if (def->nnets > 1) { + memmove(def->nets + i, + def->nets + i + 1, + sizeof(*def->nets) * (def->nnets - (i + 1))); + def->nnets--; + if (VIR_REALLOC_N(def->nets, def->nnets) < 0) { + /* ignore harmless */ + } + } else { + VIR_FREE(def->nets); + def->nnets = 0; + } +} + +int virDomainNetRemoveByMac(virDomainDefPtr def, const unsigned char *mac) +{ + int i = virDomainNetIndexByMac(def, mac); + + if (i < 0) + return -1; + virDomainNetRemove(def, i); + return 0; +} + int virDomainControllerInsert(virDomainDefPtr def, virDomainControllerDefPtr controller) diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 5fe31d4..f195caa 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1360,6 +1360,10 @@ int virDomainDiskDefAssignAddress(virCapsPtr caps, virDomainDiskDefPtr def); void virDomainDiskRemove(virDomainDefPtr def, size_t i); int virDomainDiskRemoveByName(virDomainDefPtr def, const char *name); +int virDomainNetIndexByMac(virDomainDefPtr def, const unsigned char *mac); +int virDomainNetInsert(virDomainDefPtr def, virDomainNetDefPtr net); +int virDomainNetRemoveByMac(virDomainDefPtr def, const unsigned char *mac); + int virDomainControllerInsert(virDomainDefPtr def, virDomainControllerDefPtr controller); void virDomainControllerInsertPreAlloced(virDomainDefPtr def, diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 7b6151c..eb55025 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -290,6 +290,9 @@ virDomainLoadAllConfigs; virDomainMemballoonModelTypeFromString; virDomainMemballoonModelTypeToString; virDomainNetDefFree; +virDomainNetIndexByMac; +virDomainNetInsert; +virDomainNetRemoveByMac; virDomainNetTypeToString; virDomainObjAssignDef; virDomainObjCopyPersistentDef; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 691965d..ef2c5f0 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4245,6 +4245,7 @@ qemuDomainAttachDeviceConfig(virDomainDefPtr vmdef, virDomainDeviceDefPtr dev) { virDomainDiskDefPtr disk; + virDomainNetDefPtr net; switch (dev->type) { case VIR_DOMAIN_DEVICE_DISK: @@ -4267,6 +4268,24 @@ qemuDomainAttachDeviceConfig(virDomainDefPtr vmdef, return -1; break; + case VIR_DOMAIN_DEVICE_NET: + net = dev->data.net; + if (virDomainNetIndexByMac(vmdef, net->mac) >= 0) { + char macbuf[VIR_MAC_STRING_BUFLEN]; + + virFormatMacAddr(net->mac, macbuf); + qemuReportError(VIR_ERR_INVALID_ARG, + _("mac %s already exists"), macbuf); + return -1; + } + if (virDomainNetInsert(vmdef, net)) { + virReportOOMError(); + return -1; + } + dev->data.net = NULL; + if (qemuDomainAssignPCIAddresses(vmdef) < 0) + return -1; + break; default: qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("persistent attach of device is not supported")); @@ -4281,6 +4300,7 @@ qemuDomainDetachDeviceConfig(virDomainDefPtr vmdef, virDomainDeviceDefPtr dev) { virDomainDiskDefPtr disk; + virDomainNetDefPtr net; switch (dev->type) { case VIR_DOMAIN_DEVICE_DISK: @@ -4291,6 +4311,17 @@ qemuDomainDetachDeviceConfig(virDomainDefPtr vmdef, return -1; } break; + case VIR_DOMAIN_DEVICE_NET: + net = dev->data.net; + if (virDomainNetRemoveByMac(vmdef, net->mac)) { + char macbuf[VIR_MAC_STRING_BUFLEN]; + + virFormatMacAddr(net->mac, macbuf); + qemuReportError(VIR_ERR_INVALID_ARG, + _("mac %s doesn't exist."), macbuf); + return -1; + } + break; default: qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("persistent detach of device is not supported")); -- 1.7.4.1

2 2

[libvirt] [TCK] [PATCH] nwfilter: Add a test case for filtering of gratuitous ARP packets
by Stefan Berger 23 May '11

23 May '11

This patch adds a test for filtering of gratuitous ARP packets to the TCK tests. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall | 2 ++ scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat | 1 + scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml | 4 ++++ 3 files changed, 7 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall @@ -4,6 +4,8 @@ -p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT -p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT -p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p ARP --arp-gratuitous -j ACCEPT #ebtables -t nat -L PREROUTING | grep vnet0 -i vnet0 -j libvirt-I-vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat @@ -26,6 +26,7 @@ -p ARP --arp-op Reply -j ACCEPT -j DROP #ebtables -t nat -L O-vnet0-arp | grep -v "^Bridge" | grep -v "^$" +-p ARP --arp-gratuitous -j ACCEPT -p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:9f:33:da -j DROP -p ARP --arp-ip-dst ! 10.1.1.1 -j DROP -p ARP --arp-op Request -j ACCEPT Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml =================================================================== --- libvirt-tck.orig/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml @@ -30,4 +30,8 @@ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' opcode='65536' hwtype='65536' protocoltype='65536' /> </rule> + + <rule action='accept' direction='in'> + <arp gratuitous='true'/> + </rule> </filter>

2 2

[libvirt] [PATCH] nwfilter: enable filtering of gratuitous ARP packets
by Stefan Berger 23 May '11

23 May '11

This patch enables filtering of gratuitous ARP packets using the following XML: <rule action='accept' direction='in' priority='425'> <arp gratuitous='true'/> </rule> Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/formatnwfilter.html.in | 6 ++++++ docs/schemas/nwfilter.rng | 16 ++++++++++++++++ examples/xml/nwfilter/no-arp-spoofing.xml | 6 +++++- src/conf/nwfilter_conf.c | 23 +++++++++++++++++++++++ src/conf/nwfilter_conf.h | 5 ++++- src/nwfilter/nwfilter_ebiptables_driver.c | 7 +++++++ tests/nwfilterxml2xmlin/arp-test.xml | 4 ++++ tests/nwfilterxml2xmlout/arp-test.xml | 3 +++ 8 files changed, 68 insertions(+), 2 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -970,6 +970,10 @@ static const virXMLAttr2Struct arpAttrib .name = ARPDSTIPADDR, .datatype = DATATYPE_IPADDR, .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataARPDstIPAddr), + }, { + .name = "gratuitous", + .datatype = DATATYPE_BOOLEAN, + .dataIdx = offsetof(virNWFilterRuleDef, p.arpHdrFilter.dataGratuitousARP), }, COMMENT_PROP(arpHdrFilter), { @@ -1611,6 +1615,18 @@ virNWFilterRuleDetailsParse(xmlNodePtr n found = 1; break; + case DATATYPE_BOOLEAN: + if (STREQ(prop, "true") || + STREQ(prop, "1") || + STREQ(prop, "yes")) + item->u.boolean = true; + else + item->u.boolean = false; + + data.ui = item->u.boolean; + found = 1; + break; + case DATATYPE_LAST: default: break; @@ -2744,6 +2760,13 @@ virNWFilterRuleDefDetailsFormat(virBuffe virBufferEscapeString(buf, "%s", item->u.string); break; + case DATATYPE_BOOLEAN: + if (item->u.boolean == true) + virBufferAddLit(buf, "true"); + else + virBufferAddLit(buf, "false"); + break; + case DATATYPE_STRING: default: virBufferAsprintf(buf, Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -97,8 +97,9 @@ enum attrDatatype { DATATYPE_IPV6ADDR = (1 << 9), DATATYPE_IPV6MASK = (1 << 10), DATATYPE_STRINGCOPY = (1 << 11), + DATATYPE_BOOLEAN = (1 << 12), - DATATYPE_LAST = (1 << 12), + DATATYPE_LAST = (1 << 13), }; @@ -118,6 +119,7 @@ struct _nwItemDesc { union { nwMACAddress macaddr; virSocketAddr ipaddr; + bool boolean; uint8_t u8; uint16_t u16; char protocolID[10]; @@ -160,6 +162,7 @@ struct _arpHdrFilterDef { nwItemDesc dataARPSrcIPAddr; nwItemDesc dataARPDstMACAddr; nwItemDesc dataARPDstIPAddr; + nwItemDesc dataGratuitousARP; nwItemDesc dataComment; }; Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -581,6 +581,11 @@ <ref name="uint16range"/> </attribute> </optional> + <optional> + <attribute name="gratuitous"> + <ref name="boolean"/> + </attribute> + </optional> </interleave> </define> @@ -784,6 +789,17 @@ </choice> </define> + <define name="boolean"> + <choice> + <value>yes</value> + <value>no</value> + <value>true</value> + <value>false</value> + <value>1</value> + <value>0</value> + </choice> + </define> + <define name="arpOpcodeType"> <choice>  Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -2033,6 +2033,13 @@ ebtablesCreateRuleInstance(char chainPre ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataARPDstMACAddr), macaddr); } + + if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataGratuitousARP) && + rule->p.arpHdrFilter.dataGratuitousARP.u.boolean == true) { + virBufferAsprintf(&buf, + " %s --arp-gratuitous", + ENTRY_GET_NEG_SIGN(&rule->p.arpHdrFilter.dataGratuitousARP)); + } break; case VIR_NWFILTER_RULE_PROTOCOL_IP: Index: libvirt-acl/examples/xml/nwfilter/no-arp-spoofing.xml =================================================================== --- libvirt-acl.orig/examples/xml/nwfilter/no-arp-spoofing.xml +++ libvirt-acl/examples/xml/nwfilter/no-arp-spoofing.xml @@ -12,7 +12,11 @@ <rule action='drop' direction='out' priority='400' > <arp match='no' arpsrcipaddr='$IP' /> </rule> -  +  + <rule action='accept' direction='in' priority='425'> + <arp gratuitous='true'/> + </rule> +  <rule action='drop' direction='in' priority='450' > <arp match='no' arpdstmacaddr='$MAC'/> <arp opcode='reply'/> Index: libvirt-acl/docs/formatnwfilter.html.in =================================================================== --- libvirt-acl.orig/docs/formatnwfilter.html.in +++ libvirt-acl/docs/formatnwfilter.html.in @@ -321,6 +321,7 @@ <li>IPV6_ADDR: IPv6 address in numbers format, i.e., FFFF::1</li> <li>IPV6_MASK: IPv6 mask in numbers format (FFFF:FFFF:FC00::) or CIDR mask (0-128)</li> <li>STRING: A string</li> + <li>BOOLEAN: 'true', 'yes', '1' or 'false', 'no', '0'</li> </ul> @@ -476,6 +477,11 @@ <td>STRING</td> <td>text with max. 256 characters</td> </tr> + <tr> + <td>gratuitous (Since 0.9.2)</td> + <td>BOOLEAN</td> + <td>boolean indicating whether to check for gratuitous ARP packet</td> + </tr> </table> Valid strings for the <code>Opcode</code> field are: Index: libvirt-acl/tests/nwfilterxml2xmlin/arp-test.xml =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmlin/arp-test.xml +++ libvirt-acl/tests/nwfilterxml2xmlin/arp-test.xml @@ -30,4 +30,8 @@ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' opcode='65536' hwtype='65536' protocoltype='65536' /> </rule> + + <rule action='accept' direction='in'> + <arp gratuitous='true'/> + </rule> </filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/arp-test.xml =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmlout/arp-test.xml +++ libvirt-acl/tests/nwfilterxml2xmlout/arp-test.xml @@ -15,4 +15,7 @@ <rule action='accept' direction='out' priority='500'> <arp srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff'/> </rule> + <rule action='accept' direction='in' priority='500'> + <arp gratuitous='true'/> + </rule> </filter>

2 2

[libvirt] [PATCH 2/9] add DHCP snooping support to nwfilter
by David L Stevens 23 May '11

23 May '11

The ARP protocol requires processing of packets that may not be explicitly addressed to a host and only defines request and reply. This patch removes the filtering of gratuitous ARPs and ARP requests which must update a VMs patch for correct function and removes the unnecessary check for arpop of request or reply. Signed-off-by: David L Stevens <dlstevens(a)us.ibm.com> diff --git a/examples/xml/nwfilter/no-arp-spoofing.xml b/examples/xml/nwfilter/no-arp-spoofing.xml index c6c858d..fdd4e60 100644 --- a/examples/xml/nwfilter/no-arp-spoofing.xml +++ b/examples/xml/nwfilter/no-arp-spoofing.xml @@ -12,21 +12,6 @@ <rule action='drop' direction='out' priority='400' > <arp match='no' arpsrcipaddr='$IP' /> </rule> -  - <rule action='drop' direction='in' priority='450' > - <arp match='no' arpdstmacaddr='$MAC'/> - <arp opcode='reply'/> - </rule> - <rule action='drop' direction='in' priority='500' > - <arp match='no' arpdstipaddr='$IP' /> - </rule> -  - <rule action='accept' direction='inout' priority='600' > - <arp opcode='request'/> - </rule> - <rule action='accept' direction='inout' priority='650' > - <arp opcode='reply'/> - </rule>  - <rule action='drop' direction='inout' priority='1000' /> + <rule action='drop' direction='out' priority='1000' /> </filter>

3 2

[libvirt] [PATCH] Use per-user TLS certificates when possible
by Doug Goldstein 23 May '11

23 May '11

When using TLS authentication and operating as the non-root user, initially attempt to use that specific user's TLS certificates before attempting to use the system wide TLS certificates. Signed-off-by: Doug Goldstein <cardoe(a)cardoe.com> --- src/remote/remote_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 8c69743..1691dab 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -1159,7 +1159,7 @@ initialize_gnutls(char *pkipath, int flags) if ((virAsprintf(&libvirt_clientcert, "%s/%s", pkipath, "clientcert.pem")) < 0) goto out_of_memory; - } else if (flags & VIR_DRV_OPEN_REMOTE_USER) { + } else if (flags & VIR_DRV_OPEN_REMOTE_USER || getuid() > 0) { userdir = virGetUserDirectory(getuid()); if (!userdir) -- 1.7.5.rc3

3 2