- Devel - libvirt List Archives

[libvirt] [PATCH] Fix autostart flag when loading running domains
by Michael Chapman 13 Jun '11

13 Jun '11

Drivers load running persistent and transient domain configs before inactive persistent domain configs, however only the latter would set a domain's autostart flag. This mismatch between the loaded and on-disk state could later cause problems with "virsh autostart": # virsh autostart example error: Failed to mark domain example as autostarted error: Failed to create symlink '/etc/libvirt/qemu/autostart/example.xml to '/etc/libvirt/qemu/example.xml': File exists This patch ensures the autostart flag is set correctly even when the domain is already defined. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=632100 https://bugzilla.redhat.com/show_bug.cgi?id=675319 Signed-off-by: Michael Chapman <mike(a)very.puzzling.org> --- src/conf/domain_conf.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 0d9fef4..5a6ff8b 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -9859,21 +9859,22 @@ static virDomainObjPtr virDomainLoadConfig(virCapsPtr caps, VIR_DOMAIN_XML_INACTIVE))) goto error; + if ((autostartLink = virDomainConfigFile(autostartDir, name)) == NULL) + goto error; + + if ((autostart = virFileLinkPointsTo(autostartLink, configFile)) < 0) + goto error; + /* if the domain is already in our hashtable, we don't need to do * anything further */ if ((dom = virDomainFindByUUID(doms, def->uuid))) { VIR_FREE(configFile); virDomainDefFree(def); + dom->autostart = autostart; return dom; } - if ((autostartLink = virDomainConfigFile(autostartDir, name)) == NULL) - goto error; - - if ((autostart = virFileLinkPointsTo(autostartLink, configFile)) < 0) - goto error; - if (!(dom = virDomainAssignDef(caps, doms, def, false))) goto error; -- 1.7.4.4

2 1

[libvirt] [RFC] OpenVSwitch datapath support (was: Driver development)
by Carlos N. A. Corrêa 13 Jun '11

13 Jun '11

Hi, Cole! As I said, I gone through the list archives and got some insight on how to present my ideas. I tried to use the thread started by Laine Stump ( https://www.redhat.com/archives/libvir-list/2011-April/msg00591.html) as a model. Please, forgive me if my RFC is too verbose: I tried to produce something good. In time: I'm willing to implement this idea as part of my postgraduate work. Index ===== 1. Incorporating Open vSwitch support to libvirt 2. Background 3. Architecture 3.1. Option 1 3.2. Option 2 4. Implementation 1. Incorporating Open vSwitch support to libvirt ================================================ OpenFlow (http://www.openflow.org/) is a technology from the Software Defined Networks (SDN) fame. Switches supporting it export a software interface that allows special programs (Controllers) to dictate how the forwarding of ethernet frames should be done. That decision can not only be based on traditional layer-2 information (physical address 00:01:02:03:04:aa maps to port 1, address 05:06:07:08:09:bb maps to port 2, and so on) but also on information from a mix of network layers, like VLAN tags, IP addresses and/or TCP ports. Controllers may take network flexibility and efficiency to a new level, slicing switches' capacity transparently to run concurrent, isolated networks (FlowVisor, https://openflow.stanford.edu/display/flowvisor/Home) They can also incorporate logic to make the connectivity layer play a greater role in areas like IP routing (RouteFlow, http://sites.google.com/site/routeflow/) network access control (SMAC, http://www.openflowhub.org/display/Snac/SNAC+Home) hosts load-balancing ( http://www.cs.princeton.edu/~jrex/papers/loadwild10.pdf) and live migration (http://conferences.sigcomm.org/sigcomm/2008/papers/p513-ericksonA.pdf) In a very practical view, as libvirt supports a programmatic definition of network nodes, OpenFlow allows for a programmatic definition of traffic forwarding. An IaaS/cloud environment composed of many physical hosts and extensive use of libvirt for hypervisor management could use OpenFlow for virtualized switches management. Even tough its current libvirt enables one to define and instantiate virtual networks, those networks are, basically, Linux kernel bridges which configuration (device IP addresses, naming, connections) is stored into network XML files. Linux bridges doesn't offer a programmatic interface, and depend on not-so-easily-customizable approaches (VLANs, tunnels) to properly isolate traffic. Open vSwitch (or OVS, http://www.openvswitch.org/) is a full software implementation of a network switch. It supports standard management interfaces and protocols (e.g. NetFlow, sFlow) and is being used in a multitude of virtual and cloud-based computing (e.g. XenServer, OpenNebula). Even more, OVS can operate in "OpenFlow-mode". When operating in a traditional ("full switch") fashion, an OVS instance is similar to a Linux bridge - just supporting features that makes them work more like a "real" switch. In this scenario, OVS kernel driver even includes a compatibility layer that allows bridge-utils (and libvirt) to act upon OVS instances just as if they were Linux bridges! When operating in OpenFlow mode, the OVS instance is called a _datapath_. Host interfaces can be bound to and send traffic through it, but forwarding logic is provided by the Controller process. In this scenario, OpenFlow-based solutions could be leveraged to virtual networks. Even more, OpenFlow-based solutions which use virtual facilities (like VMs and OVS) could use libvirt as part of its frameworks! I'm proposing changes to libvirt's network XML format. It would allow for "datapath" elements, and it's attributes would allow libvirt to instantiate a OVS datapath, specifying it's controller address and hardware description, for example. 2. Background ============= To instantiate an OVS datapath (DP), one must call the ovs-openflowd daemon. Some relevant aspects of its syntax are covered below: ------------------------------- 8< ------------------------------- usage: ovs-openflowd [OPTIONS] DATAPATH [CONTROLLER...] Active OpenFlow connection methods: tcp:IP[:PORT] PORT (default: 6633) at remote IP ssl:IP[:PORT] SSL PORT (default: 6633) at remote IP unix:FILE Unix domain socket named FILE Passive OpenFlow connection methods: ptcp:[PORT][:IP] listen to TCP PORT (default: 6633) on IP pssl:[PORT][:IP] listen for SSL on PORT (default: 6633) on IP punix:FILE listen on Unix domain socket FILE OpenFlow options: -d, --datapath-id=ID Use ID as the OpenFlow switch ID (ID must consist of 16 hex digits) --mfr-desc=MFR Identify manufacturer as MFR --hw-desc=HW Identify hardware as HW --sw-desc=SW Identify software as SW Networking options: --out-of-band controller connection is out-of-band Daemon options: --detach run in background as daemon --pidfile[=FILE] create pidfile (default: /usr/local/var/run/openvswitch/ovs-openflowd.pid) ------------------------------- 8< ------------------------------- An execution example can be seen below: # ovs-openflowd --hw-desc=rfovs dp0 tcp:127.0.0.1:6633 --out-of-band --detach This instantiates an OVS datapath with hardware description "rfovs". The datapath name (and Linux virtual interface name) is "dp0". The controller software is running in the same machine as the OVS instance (IP address 127.0.0.1), and can be reached through port 6633/TCP. The connection to the controller must not be done through the datapath itself (out-of-band), and the ovs-openflowd will run as a background daemon. 3. Architecture =============== libvirt documentation available on http://www.libvirt.org/formatnetwork.htmldescribes the following format to network definition: <network>    </network> Based solely in that documentation, the format is somewhat bound to Linux bridges. This is not a problem most of the time, as OVS includes a compatibility module (brcompat_mod) that allows bridge-utils to configure an OVS "full switch" just as if it was a traditional Linux bridge. The syscalls offered also permit libvirt to manage these instances transparently. However, this format doesn't provide sufficient information to configure a OVS datapath. Next, I propose some options of how the libvirt network format could be changed to provide this facility (and, off course, to implement those changes). 3.1. Option 1: network type --------------------------- I saw this in an e-mail from Laine Stump in last April ( https://www.redhat.com/archives/libvir-list/2011-April/msg00640.html) It seems like my preferred ideas about how the change could be accomplished. The network opening element would be extended to include an optional "type" attribute. It could be defined as "bridge" (the default behaviour, for backwards compatibility) or "ovs-datapath" (the case for which I would like to work): <network type="bridge"> (THE DEFAULT) or <network type="ovs-datapath"> As the "General metadata" from the network format is instrumental to libvirt, it would be necessary to a "ovs-datapath" network. As the control layer of an OVS datapath lie outside itself, the "Bridging, naming..." section of the network format would be replaced by the following elements/attributes: <datapath name="" id="" mfrdesc="" hwdesc="" swdesc=""> - Mandatory, this element would allow for datapath and OpenFlow general configuration. - The name attribute would be used to designate the datapath virtual interface. (Mandatory) - The id, mfrdesc, hwdesc and swdesc attributes would be mapped 1:1 to ovs-openflowd parameters presented before. (Optional) <controller protocol="" address="" port="" outofband=""> OR <controller protocol="" path=""> - Protocol. Would be one of "tcp" or "unix", by now. (Mandatory) - Address. Would be an IP address. (Mandatory, if protocol="tcp") - Path. Would be the path to a UNIX socket to which the controller process is listening. (Mandatory, if protocol="unix") - Port. Would be the port to which the controller is listening to. (Optional, default = 6633) - Outofband. If connection to the controller must be done "in" or "out" of band. (Optional, default = "NO"). - The controller element itself would be optional, as OVS includes a "controller discovery" process by default. If specified, however, it's mandatory attributes should be respected. For the sake of a proof-of-concept implementation, this would be the entire (!) scope of the initial change/implementation. After this step, things such as this could be added: - An "ssl" option for the "protocol=" attribute, to allow for SSL-encrypted connections between datapaths and its controllers. - An element to pass SSL connection data (private key, ca cert, etc.) to ovs-openflowd. E.g.: <pki privatekey...> - Elements to control networking operation (e.g. max-idle, max-backoff) and rate-limiting of the datapath. 3.2. Option 2: datapath element ------------------------------- In place of a network type definition, just a new "datapath" element would be added. The network_conf code should test if a "bridge" element is specified in a network definition, and look for a datapath if it can't find one. Addressing data found in a network using the "datapath" element would be ignored. The datapath element here could be overly long, including description, controller and ssl-related attributes - but the format change would be very minimal: <network>  <datapath name="" descriptions="..." controller_data="..."> </network> Other option would be set those properties as sub-elements of <datapath...>, merging this option with the first: <network>  <datapath name="" id="" mfrdesc="" hwdesc="" swdesc=""> <controller protocol="" address="" port="" outofband=""> <pki privatekey...> <networking...> </datapath> </network> Besides being and option, this scenario (in fact, the entire option 2) seems somewhat unclean to me. 4. Implementation ================= 1. I can hack through the network_conf code to make it parse the XML. That's an easy part. 2. I can use the bridge driver as a model + your command execution infrastructure (which is very cool, IMHO) to implement an OVS driver. 3. It's not yet very clear to me where is the code that instantiates each network after it's "def" get parsed. Well, after the first two steps, I think that I would need to just hook the parsing and driver functions together in instantiating/virsh/command-line code. That's all, folks! Best regards, Carlos "Bill" Nilton CISSP, RHCE, ITIL Foundations http://carlosnilton.com.br/ Em 8 de junho de 2011 17:34, Carlos N. A. Corrêa <carlos.nilton(a)gmail.com>escreveu: > Hi, > > I gathered information about that and I'll produce relevant documentation > of my point tonight. > > I'll be glad to do an informed and well structured work. Thanks! > > > Best regards, > Carlos "Bill" Nilton > CISSP, RHCE, ITIL Foundations > http://carlosnilton.com.br/ > > > > Em 8 de junho de 2011 15:41, Cole Robinson <crobinso(a)redhat.com> escreveu: > > On 06/08/2011 07:10 AM, Carlos N. A. Corręa wrote: >> > Hi, >> > >> > I'm interested in developing a new network driver for libvirt (one for >> the >> > definition and management of OpenVSwitch datapaths). >> > >> > I've read some of the code already, and by now my general directions >> are: >> > >> > - Change the function virNetworkDefParseXML in src/conf/network_conf.c >> to >> > define and parse new configuration directives needed by my driver >> > - Use src/network/bridge_driver.c as a template for my new driver, >> replacing >> > code from the services provided by the driver (listed on >> "virNetworkDriver" >> > type) with my own code, for my own net type. >> > >> > Have you any other directions in this matter? Any tips? If it works, >> would >> > be this code of any use to you? >> > >> >> For a starting point I'd recommend proposing your XML changes to the >> list, and describe exactly what the new functionality will enable, and a >> few use cases. Probably best to do this before starting any code so you >> don't head in a wrong direction. >> >> Check the past few month ML archives to see how some other developers >> have proposed RFCs or XML changes. >> >> - Cole >> > >

2 1

[libvirt] [PATCH 00/16] More virCommand conversions and cleanups
by Cole Robinson 11 Jun '11

11 Jun '11

The following series converts all users of several older command wrappers (virRunWithHook, virExecDaemonize, and virExec) to use virCommand. The remaining functionality is then moved out of util.c and into command.c Cole Robinson (16): remote_driver: Convert virExecDaemonize usage to virCommand util: Combine __virExec and virExecWithHook command: Allow setting a NULL hook function storage_backend: Convert virRunWithHook usage to virCommand apparmor: Convert virExec usage to virCommand storage: Convert qemu-img -help parsing to virCommand storage: Covert regex helpers to virCommand storage: iscsi: Convert virExec to virCommand qemu: Convert virExec usage to virCommand openvz: Convert virExec usage to virCommand remote: Convert SSH tunnel to virCommand util: Remove unused virExec wrapper util: Implement virRun as a wrapper around virCommand Move virRun, virExec*, virFork to util/command storage_backend: Fix error reporting with regex helper command: Report stdout/stderr if command fails cfg.mk | 2 +- src/libvirt_private.syms | 8 +- src/lxc/veth.c | 2 +- src/nwfilter/nwfilter_ebiptables_driver.c | 1 + src/openvz/openvz_conf.c | 37 +- src/openvz/openvz_driver.c | 52 ++- src/qemu/qemu_driver.c | 14 +- src/qemu/qemu_process.c | 2 +- src/remote/remote_driver.c | 83 +-- src/security/security_apparmor.c | 70 +--- src/storage/storage_backend.c | 292 ++++-------- src/storage/storage_backend.h | 3 +- src/storage/storage_backend_fs.c | 7 +- src/storage/storage_backend_iscsi.c | 40 +- src/storage/storage_backend_logical.c | 32 +- src/util/command.c | 621 +++++++++++++++++++++++- src/util/command.h | 16 +- src/util/ebtables.c | 2 +- src/util/pci.c | 2 +- src/util/util.c | 764 +---------------------------- src/util/util.h | 44 -- src/vmware/vmware_driver.c | 1 + 22 files changed, 854 insertions(+), 1241 deletions(-) -- 1.7.4.4

4 40

[libvirt] Fwd: cvs commit: ports/devel/libvirt Makefile distinfo pkg-plist ports/devel/libvirt/files patch-docs__apibuild.py patch-src__util__command.c
by Jason Helfman 10 Jun '11

10 Jun '11

libvirt has been updated in the FreeBSD portstree. Thanks, Jason -- Jason Helfman System Administrator experts-exchange.com http://www.experts-exchange.com/M_4830110.html E4AD 7CF1 1396 27F6 79DD 4342 5E92 AD66 8C8C FBA5

1 0

[libvirt] does libvirt get disk->info.alias, when attaching a disk by virDomainAttachDevice?
by 李敬伟 10 Jun '11

10 Jun '11

Hi, I am using libvirt 0.9.1 on CentOS 5.5 64bit , Created a vm :virsh create libvirt.xml Attached a disk ,virsh attach-disk 3 /opt/vms/test.img vdb When getting blosk stats ,virsh domblkstats 3 vdb ,it showed error: Failed to get block stats 3 vdb error: internal error missing disk device alias name for vdb while virsh domblkstat 3 vda, it showed vda rd_req 6667 vda rd_bytes 154084864 vda wr_req 9530 vda wr_bytes 57196544 I guess libvirt does not get disk->info.alias when attaching a disk,so it can not get block status. # virsh version Compiled against library: libvir 0.9.1 Using library: libvir 0.9.1 Using API: QEMU 0.9.1 Running hypervisor: QEMU 0.9.1 # rpm -qa|grep kvm kmod-kvm-83-224.el5.centos.1 kvm-qemu-img-83-224.el5.centos.1 etherboot-zroms-kvm-5.4.4-13.el5.centos kvm-83-224.el5.centos.1 Jingwei Li (lijingwei9060(a)gmail.com<mailto:lijingwei9060@gmail.com> or lijw(a)bingosoft.net<mailto:lijw@bingosoft.net>)

3 2

[libvirt] [PATCH] xenapi: Improve error message on session failure
by Matthew Booth 10 Jun '11

10 Jun '11

XenAPI session login can fail for a number of reasons, but currently no specific reason is displayed to the user, e.g.: virsh -c XenAPI://citrix-xen.example.com/ Enter username for citrix-xen.example.com: root Enter root's password for citrix-xen.example.com: error: authentication failed: (null) error: failed to connect to the hypervisor This patch displays the session error description on failure. --- src/xenapi/xenapi_driver.c | 20 ++++++++++++++++++-- 1 files changed, 18 insertions(+), 2 deletions(-) diff --git a/src/xenapi/xenapi_driver.c b/src/xenapi/xenapi_driver.c index 6f64208..3fc35c6 100644 --- a/src/xenapi/xenapi_driver.c +++ b/src/xenapi/xenapi_driver.c @@ -166,7 +166,22 @@ xenapiOpen (virConnectPtr conn, virConnectAuthPtr auth, int flags ATTRIBUTE_UNUS privP->session = xen_session_login_with_password(call_func, privP, username, password, xen_api_latest_version); - if (privP->session != NULL && privP->session->ok) { + if (privP->session == NULL) { + /* From inspection of xen_session_login_with_password in + * libxenserver(Version 5.6.100-1), this appears not to be currently + * possible. The only way for this to be NULL would be on malloc + * failure, except that the code doesn't check for this and would + * segfault before returning. + * + * We don't assume the reason here for a failure in an external library. + */ + xenapiSessionErrorHandler(conn, VIR_ERR_INTERNAL_ERROR, + _("Failed to allocate xen session")); + + goto error; + } + + if (privP->session->ok) { conn->privateData = privP; VIR_FREE(username); @@ -175,7 +190,8 @@ xenapiOpen (virConnectPtr conn, virConnectAuthPtr auth, int flags ATTRIBUTE_UNUS return VIR_DRV_OPEN_SUCCESS; } - xenapiSessionErrorHandler(conn, VIR_ERR_AUTH_FAILED, NULL); + xenapiSessionErrorHandler(conn, VIR_ERR_AUTH_FAILED, + *privP->session->error_description); error: VIR_FREE(username); -- 1.7.4.4

3 2

[libvirt] [PATCH] qemu: Fix one type in the error prompt string
by Osier Yang 10 Jun '11

10 Jun '11

Pushed in trivial rule. --- src/qemu/qemu_command.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index ef2d002..4e68241 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -553,7 +553,7 @@ qemuAssignDeviceHostdevAlias(virDomainDefPtr def, virDomainHostdevDefPtr hostdev int thisidx; if ((thisidx = qemuDomainDeviceAliasIndex(&def->hostdevs[i]->info, "hostdev")) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("Unable to determine device index for hostdevwork device")); + _("Unable to determine device index for hostdev device")); return -1; } if (thisidx >= idx) -- 1.7.4

1 0

[libvirt] Make check on current git fails when building --with-vbox
by Ruben Kerkhof 09 Jun '11

09 Jun '11

Hi all, ./configure --without-vbox make make check produces on my F-13 and F-15 machines. make[1]: Entering directory `/home/ruben/src/libvirt/tests' make virshtest conftest sockettest nodeinfotest qparamtest virbuftest commandtest commandhelper seclabeltest hashtest qemuxml2argvtest qemuxml2xmltest qemuargv2xmltest qemuhelptest openvzutilstest vmx2xmltest xml2vmxtest networkxml2xmltest nwfilterxml2xmltest storagevolxml2xmltest storagepoolxml2xmltest nodedevxml2xmltest interfacexml2xmltest cputest eventtest make[2]: Entering directory `/home/ruben/src/libvirt/tests' CC virshtest.o CC testutils.o CCLD virshtest CC conftest.o CCLD conftest CC sockettest.o CCLD sockettest CC nodeinfotest.o CCLD nodeinfotest CC qparamtest.o CCLD qparamtest CC virbuftest.o CCLD virbuftest CC commandtest-commandtest.o CC commandtest-testutils.o CCLD commandtest CC commandhelper-commandhelper.o CCLD commandhelper CC seclabeltest.o CCLD seclabeltest CC hashtest.o CCLD hashtest CC qemuxml2argvtest.o CC testutilsqemu.o CCLD qemuxml2argvtest /usr/bin/ld: ../src/.libs/libvirt_test.a(libvirt_driver_la-lock_manager.o): undefined reference to symbol 'dlclose@@GLIBC_2.2.5' /usr/bin/ld: note: 'dlclose@@GLIBC_2.2.5' is defined in DSO /lib64/libdl.so.2 so try adding it to the linker command line /lib64/libdl.so.2: could not read symbols: Invalid operation collect2: ld returned 1 exit status make[2]: *** [qemuxml2argvtest] Error 1 make[2]: Leaving directory `/home/ruben/src/libvirt/tests' make[1]: *** [check-am] Error 2 make[1]: Leaving directory `/home/ruben/src/libvirt/tests' make: *** [check-recursive] Error 1 Kind regards, Ruben

2 3

[libvirt] [PATCH] Move VMware Workstation/Player driver to correct spec file section
by Matthias Bolte 09 Jun '11

09 Jun '11

The VMware driver works like the OpenVZ driver by using a commandline tool for management. It dosen't use it's own remote protocol. --- libvirt.spec.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index c7ef8d0..97ebd65 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -46,11 +46,11 @@ %define with_uml 0%{!?_without_uml:%{server_drivers}} %define with_xenapi 0%{!?_without_xenapi:%{server_drivers}} %define with_libxl 0%{!?_without_libxl:%{server_drivers}} +%define with_vmware 0%{!?_without_vmware:%{server_drivers}} # Then the hypervisor drivers that talk a native remote protocol %define with_phyp 0%{!?_without_phyp:1} %define with_esx 0%{!?_without_esx:1} -%define with_vmware 0%{!?_without_vmware:1} # Then the secondary host drivers %define with_network 0%{!?_without_network:%{server_drivers}} -- 1.7.0.4

2 2

[libvirt] [PATCH v3] graphics: add support for action_if_connected in qemu
by Michal Prívozník 09 Jun '11

09 Jun '11

From: Michal Privoznik <mprivozn(a)redhat.com> This option accepts 3 values: -keep, to keep current client connected (Spice+VNC) -disconnect, to disconnect client (Spice) -fail, to fail setting password if there is a client connected (Spice) --- diff to v2: -fixed typo -added test. However, functionality provided by this patch will show up only when talking to qemu monitor (set_password command). diff to v1: -Eric's review suggestions included -update 'Since' docs/formatdomain.html.in | 13 +++++- docs/schemas/domain.rng | 16 +++++++ src/conf/domain_conf.c | 44 ++++++++++++++++++- src/conf/domain_conf.h | 11 +++++ src/libvirt_private.syms | 2 + src/qemu/qemu_hotplug.c | 15 +++++- .../qemuxml2argv-graphics-spice-timeout.xml | 2 +- 7 files changed, 94 insertions(+), 9 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 98fb2b4..2ed16ff 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1801,7 +1801,11 @@ qemu-kvm -net nic,model=? /dev/null in clear text. The <code>keymap</code> attribute specifies the keymap to use. It is possible to set a limit on the validity of the password be giving an timestamp <code>passwdValidTo='2010-04-09T15:51:00'</code> - assumed to be in UTC. NB, this may not be supported by all hypervisors. + assumed to be in UTC. Since 0.8.5 + The <code>connected</code> attribute allows control of connected client + during password changes. VNC accepts <code>keep</code> value only. + since 0.9.3 + NB, this may not be supported by all hypervisors. Rather than using listen/port, QEMU supports a <code>socket</code> attribute for listening on a unix domain socket path. @@ -1820,7 +1824,12 @@ qemu-kvm -net nic,model=? /dev/null in clear text. The <code>keymap</code> attribute specifies the keymap to use. It is possible to set a limit on the validity of the password be giving an timestamp <code>passwdValidTo='2010-04-09T15:51:00'</code> - assumed to be in UTC. NB, this may not be supported by all hypervisors. + assumed to be in UTC. Since 0.8.5 + The <code>connected</code> attribute allows control of connected client + during password changes. SPICE accepts <code>keep</code> to keep client + connected, <code>disconnect</code> to disconnect client and + <code>fail</code> to fail changing password. Since 0.9.3 + NB, this may not be supported by all hypervisors. "spice" since 0.8.6. diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index 0be0371..e71b683 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -1250,6 +1250,13 @@ <data type="dateTime"/> </attribute> </optional> + <optional> + <attribute name="connected"> + <choice> + <value>keep</value> + </choice> + </attribute> + </optional> </group> <group> <attribute name="type"> @@ -1293,6 +1300,15 @@ <data type="dateTime"/> </attribute> </optional> + <optional> + <attribute name="connected"> + <choice> + <value>fail</value> + <value>disconnect</value> + <value>keep</value> + </choice> + </attribute> + </optional> <interleave> <zeroOrMore> <element name="channel"> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 0d9fef4..19f22e0 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -311,6 +311,13 @@ VIR_ENUM_IMPL(virDomainGraphics, VIR_DOMAIN_GRAPHICS_TYPE_LAST, "desktop", "spice") +VIR_ENUM_IMPL(virDomainGraphicsAuthConnected, + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_LAST, + "default", + "fail", + "disconnect", + "keep") + VIR_ENUM_IMPL(virDomainGraphicsSpiceChannelName, VIR_DOMAIN_GRAPHICS_SPICE_CHANNEL_LAST, "main", @@ -3892,9 +3899,12 @@ error: static int -virDomainGraphicsAuthDefParseXML(xmlNodePtr node, virDomainGraphicsAuthDefPtr def) +virDomainGraphicsAuthDefParseXML(xmlNodePtr node, + virDomainGraphicsAuthDefPtr def, + int type) { char *validTo = NULL; + char *connected = virXMLPropString(node, "connected"); def->passwd = virXMLPropString(node, "passwd"); @@ -3935,6 +3945,28 @@ virDomainGraphicsAuthDefParseXML(xmlNodePtr node, virDomainGraphicsAuthDefPtr de def->expires = 1; } + if (connected) { + int action = virDomainGraphicsAuthConnectedTypeFromString(connected); + if (action <= 0) { + virDomainReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unknown connected value %s"), + connected); + VIR_FREE(connected); + return -1; + } + VIR_FREE(connected); + + /* VNC supports connected='keep' only */ + if (type == VIR_DOMAIN_GRAPHICS_TYPE_VNC && + action != VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_KEEP) { + virDomainReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("VNC supports connected='keep' only")); + return -1; + } + + def->connected = action; + } + return 0; } @@ -4004,7 +4036,8 @@ virDomainGraphicsDefParseXML(xmlNodePtr node, int flags) { !def->data.vnc.listenAddr[0]) VIR_FREE(def->data.vnc.listenAddr); - if (virDomainGraphicsAuthDefParseXML(node, &def->data.vnc.auth) < 0) + if (virDomainGraphicsAuthDefParseXML(node, &def->data.vnc.auth, + def->type) < 0) goto error; } else if (def->type == VIR_DOMAIN_GRAPHICS_TYPE_SDL) { char *fullscreen = virXMLPropString(node, "fullscreen"); @@ -4140,7 +4173,8 @@ virDomainGraphicsDefParseXML(xmlNodePtr node, int flags) { !def->data.spice.listenAddr[0]) VIR_FREE(def->data.spice.listenAddr); - if (virDomainGraphicsAuthDefParseXML(node, &def->data.spice.auth) < 0) + if (virDomainGraphicsAuthDefParseXML(node, &def->data.spice.auth, + def->type) < 0) goto error; cur = node->children; @@ -9075,6 +9109,10 @@ virDomainGraphicsAuthDefFormatAttr(virBufferPtr buf, strftime(strbuf, sizeof(strbuf), "%Y-%m-%dT%H:%M:%S", tm); virBufferAsprintf(buf, " passwdValidTo='%s'", strbuf); } + + if (def->connected) + virBufferEscapeString(buf, " connected='%s'", + virDomainGraphicsAuthConnectedTypeToString(def->connected)); } static int diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 41c8136..6bfc337 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -640,12 +640,22 @@ enum virDomainGraphicsType { VIR_DOMAIN_GRAPHICS_TYPE_LAST, }; +enum virDomainGraphicsAuthConnectedType { + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_DEFAULT = 0, + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_FAIL, + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_DISCONNECT, + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_KEEP, + + VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_LAST +}; + typedef struct _virDomainGraphicsAuthDef virDomainGraphicsAuthDef; typedef virDomainGraphicsAuthDef *virDomainGraphicsAuthDefPtr; struct _virDomainGraphicsAuthDef { char *passwd; unsigned int expires: 1; /* Whether there is an expiry time set */ time_t validTo; /* seconds since epoch */ + int connected; /* action if connected */ }; enum virDomainGraphicsSpiceChannelName { @@ -1546,6 +1556,7 @@ VIR_ENUM_DECL(virDomainHostdevSubsys) VIR_ENUM_DECL(virDomainInput) VIR_ENUM_DECL(virDomainInputBus) VIR_ENUM_DECL(virDomainGraphics) +VIR_ENUM_DECL(virDomainGraphicsAuthConnected) VIR_ENUM_DECL(virDomainGraphicsSpiceChannelName) VIR_ENUM_DECL(virDomainGraphicsSpiceChannelMode) VIR_ENUM_DECL(virDomainGraphicsSpiceImageCompression) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 9d4e163..c43da44 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -269,6 +269,8 @@ virDomainFindByID; virDomainFindByName; virDomainFindByUUID; virDomainGetRootFilesystem; +virDomainGraphicsAuthConnectedTypeFromString; +virDomainGraphicsAuthConnectedTypeToString; virDomainGraphicsDefFree; virDomainGraphicsSpiceChannelModeTypeFromString; virDomainGraphicsSpiceChannelModeTypeToString; diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index d33fc87..da6629b 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1061,10 +1061,12 @@ qemuDomainChangeGraphics(struct qemud_driver *driver, return -1; } - /* If a password lifetime was, or is set, then we must always run, - * even if new password matches old password */ + /* If a password lifetime was, or is set, or action if connected has + * changed, then we must always run, even if new password matches + * old password */ if (olddev->data.vnc.auth.expires || dev->data.vnc.auth.expires || + olddev->data.vnc.auth.connected != dev->data.vnc.auth.connected || STRNEQ_NULLABLE(olddev->data.vnc.auth.passwd, dev->data.vnc.auth.passwd)) { VIR_DEBUG("Updating password on VNC server %p %p", @@ -1080,6 +1082,7 @@ qemuDomainChangeGraphics(struct qemud_driver *driver, dev->data.vnc.auth.passwd = NULL; olddev->data.vnc.auth.validTo = dev->data.vnc.auth.validTo; olddev->data.vnc.auth.expires = dev->data.vnc.auth.expires; + olddev->data.vnc.auth.connected = dev->data.vnc.auth.connected; } else { ret = 0; } @@ -1112,6 +1115,7 @@ qemuDomainChangeGraphics(struct qemud_driver *driver, * even if new password matches old password */ if (olddev->data.spice.auth.expires || dev->data.spice.auth.expires || + olddev->data.spice.auth.connected != dev->data.spice.auth.connected || STRNEQ_NULLABLE(olddev->data.spice.auth.passwd, dev->data.spice.auth.passwd)) { VIR_DEBUG("Updating password on SPICE server %p %p", @@ -1127,6 +1131,7 @@ qemuDomainChangeGraphics(struct qemud_driver *driver, dev->data.spice.auth.passwd = NULL; olddev->data.spice.auth.validTo = dev->data.spice.auth.validTo; olddev->data.spice.auth.expires = dev->data.spice.auth.expires; + olddev->data.spice.auth.connected = dev->data.spice.auth.connected; } else { VIR_DEBUG("Not updating since password didn't change"); ret = 0; @@ -1812,16 +1817,20 @@ qemuDomainChangeGraphicsPasswords(struct qemud_driver *driver, qemuDomainObjPrivatePtr priv = vm->privateData; time_t now = time(NULL); char expire_time [64]; + const char *connected = NULL; int ret; if (!auth->passwd && !driver->vncPassword) return 0; + if (auth->connected) + connected = virDomainGraphicsAuthConnectedTypeToString(auth->connected); + qemuDomainObjEnterMonitorWithDriver(driver, vm); ret = qemuMonitorSetPassword(priv->mon, type, auth->passwd ? auth->passwd : defaultPasswd, - NULL); + connected); if (ret == -2) { if (type != VIR_DOMAIN_GRAPHICS_TYPE_VNC) { diff --git a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml index 4c0c57e..6389de5 100644 --- a/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml +++ b/tests/qemuxml2argvdata/qemuxml2argv-graphics-spice-timeout.xml @@ -71,7 +71,7 @@ </console> <input type='tablet' bus='usb'/> <input type='mouse' bus='ps2'/> - <graphics type='spice' port='5900' autoport='no' passwd='sercet' passwdValidTo='2011-05-31T16:11:22'/> + <graphics type='spice' port='5900' autoport='no' passwd='sercet' passwdValidTo='2011-05-31T16:11:22' connected='disconnect'/> <sound model='ac97'> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/> </sound> -- 1.7.5.rc3

1 0