- Devel - libvirt List Archives

[libvirt] [PATCH] Added new attribute accessmode to filesystem element
by Harsh Prateek Bora 14 Oct '10

14 Oct '10

This patch introduces new attribute to filesystem element to support customizable access mode for mount type. Valid accessmode are: passthrough, mapped and squash. Usage: <filesystem type='mount' accessmode='passthrough'> <source dir='/export/to/guest'/> <target dir='mount_tag'/> </filesystem> Here is the detailed explanation on these access modes: Access mode: mapped -------------------- Fileserver intercepts and maps all the file object create requests. Files on the fileserver will be created with Fileserver's user credentials and the client-user's credentials are stored in extended attributes. During getattr() server extracts the client-user's credentials from extended attributes and sends to the client. This adds a great deal of security in the cloud environments where the guest's(client) user space is kept completely isolated from host's user space. Access mode : passthrough -------------------------- In this security model, Fileserver passes down all requests to the underlying filesystem. File system objects on the fileserver will be created with client-user's credentials. This is done by setting setuid()/setgid() during creation or chmod/chown after file creation. At the end of create protocol request, files on the fileserver will be owned by cleint-user's uid/gid. This model mimic's current NFSv3 level of security. Access mode: squash -------------------- In 'squash' mode, the (filesystem) server attempts to preserve user/group ownership from guest, however: - If the server is running as root this mode is equivalent to passthrough. - If the server is running as non-root, all files just have uid/gid matching the server process. Note: This patch is based on Daniel's patch to support 9pfs. It shall be applied after applying Daniel's patch to support 9pfs. Signed-off-by: Harsh Prateek Bora <harsh(a)linux.vnet.ibm.com> --- docs/schemas/domain.rng | 7 +++++++ src/conf/domain_conf.c | 30 ++++++++++++++++++++++++++++-- src/conf/domain_conf.h | 11 +++++++++++ src/qemu/qemu_conf.c | 10 ++++++++-- 4 files changed, 54 insertions(+), 4 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index ccb8cf3..c0e5149 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -761,6 +761,13 @@ </choice> <optional> <ref name="address"/> + <attribute name="accessmode"> + <choice> + <value>passthrough</value> + <value>mapped</value> + <value>squash</value> + </choice> + </attribute> </optional> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index e05d5d7..68c8441 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -161,6 +161,12 @@ VIR_ENUM_IMPL(virDomainFS, VIR_DOMAIN_FS_TYPE_LAST, "file", "template") +VIR_ENUM_IMPL(virDomainFSAccessMode, VIR_DOMAIN_FS_SECURITY_LAST, + "passthrough", + "mapped", + "squash") + + VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", "ethernet", @@ -1847,6 +1853,7 @@ virDomainFSDefParseXML(xmlNodePtr node, char *type = NULL; char *source = NULL; char *target = NULL; + char *accessmode = NULL; if (VIR_ALLOC(def) < 0) { virReportOOMError(); @@ -1864,6 +1871,17 @@ virDomainFSDefParseXML(xmlNodePtr node, def->type = VIR_DOMAIN_FS_TYPE_MOUNT; } + accessmode = virXMLPropString(node, "accessmode"); + if (accessmode) { + if ((def->accessmode = virDomainFSAccessModeTypeFromString(accessmode)) < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unknown accessmode '%s'"), accessmode); + goto error; + } + } else { + def->accessmode = VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH; + } + cur = node->children; while (cur != NULL) { if (cur->type == XML_ELEMENT_NODE) { @@ -5602,6 +5620,7 @@ virDomainFSDefFormat(virBufferPtr buf, int flags) { const char *type = virDomainFSTypeToString(def->type); + const char *accessmode = virDomainFSAccessModeTypeToString(def->accessmode); if (!type) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, @@ -5609,9 +5628,16 @@ virDomainFSDefFormat(virBufferPtr buf, return -1; } + if (!accessmode) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unexpected accessmode %d"), def->accessmode); + return -1; + } + + virBufferVSprintf(buf, - " <filesystem type='%s'>\n", - type); + " <filesystem type='%s' accessmode='%s'>\n", + type, accessmode); if (def->src) { switch (def->type) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 7195c04..0668ce5 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -236,10 +236,20 @@ enum virDomainFSType { VIR_DOMAIN_FS_TYPE_LAST }; +/* Filesystem mount access mode */ +enum virDomainFSAccessMode { + VIR_DOMAIN_FS_ACCESSMODE_PASSTHROUGH, + VIR_DOMAIN_FS_ACCESSMODE_MAPPED, + VIR_DOMAIN_FS_ACCESSMODE_SQUASH, + + VIR_DOMAIN_FS_ACCESSMODE_LAST +}; + typedef struct _virDomainFSDef virDomainFSDef; typedef virDomainFSDef *virDomainFSDefPtr; struct _virDomainFSDef { int type; + int accessmode; char *src; char *dst; unsigned int readonly : 1; @@ -1167,6 +1177,7 @@ VIR_ENUM_DECL(virDomainDiskErrorPolicy) VIR_ENUM_DECL(virDomainController) VIR_ENUM_DECL(virDomainControllerModel) VIR_ENUM_DECL(virDomainFS) +VIR_ENUM_DECL(virDomainFSAccessMode) VIR_ENUM_DECL(virDomainNet) VIR_ENUM_DECL(virDomainChrDevice) VIR_ENUM_DECL(virDomainChrChannelTarget) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 18a302a..0961d8a 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -2783,11 +2783,17 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, if (fs->type != VIR_DOMAIN_FS_TYPE_MOUNT) { qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("can only passthrough directories")); + _("only supports mount filesystem type")); goto error; } - virBufferAddLit(&opt, "local,security_model=passthrough"); + virBufferAddLit(&opt, "local"); + if (fs->accessmode == VIR_DOMAIN_FS_ACCESSMODE_SQUASH) { + virBufferAddLit(&opt, ",security_model=none"); + } else { + virBufferAddLit(&opt, ",security_model=%s", + virDomainFSAccessModeTypeToString(fs->accessmode)); + } virBufferVSprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); virBufferVSprintf(&opt, ",path=%s", fs->src); -- 1.7.1.1

3 2

[libvirt] [PATCH] qemu: Prohibit migration of guests with host devices
by Jiri Denemark 14 Oct '10

14 Oct '10

Explicitly raising a nice error in the case user tries to migrate a guest with assigned host devices is much better than waiting for a mysterious error with no clue for the reason. --- src/qemu/qemu_driver.c | 19 +++++++++++++++++++ 1 files changed, 19 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index f68995f..16f34f7 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10380,6 +10380,19 @@ static void qemuDomainEventQueue(struct qemud_driver *driver, /* Migration support. */ +static bool ATTRIBUTE_NONNULL(1) +qemuDomainIsMigratable(virDomainDefPtr def) +{ + if (def->nhostdevs > 0) { + qemuReportError(VIR_ERR_OPERATION_INVALID, + _("Domain with assigned host devices cannot be migrated")); + return false; + } + + return true; +} + + /* Tunnelled migration stream support */ struct qemuStreamMigFile { int fd; @@ -10709,6 +10722,9 @@ qemudDomainMigratePrepareTunnel(virConnectPtr dconn, goto cleanup; } + if (!qemuDomainIsMigratable(def)) + goto cleanup; + /* Target domain name, maybe renamed. */ if (dname) { VIR_FREE(def->name); @@ -10976,6 +10992,9 @@ qemudDomainMigratePrepare2 (virConnectPtr dconn, goto cleanup; } + if (!qemuDomainIsMigratable(def)) + goto cleanup; + /* Target domain name, maybe renamed. */ if (dname) { VIR_FREE(def->name); -- 1.7.3.1

3 4

[libvirt] Xen string2sexpr and sexpr2string lose quotes?
by Thomas Graves 14 Oct '10

14 Oct '10

Hello all, I am running xen on rhel5 and using libvirt0.7.2 (I also tried 0.7.7) and it looks like the routines string2sexpr and sexpr2string seem to lose the quotes around the image args in the configuration. Has anyone seen this and have a patch for this? I have the following libvirt config: <os> <type>linux</type> <kernel>/usr/lib/xen/boot/pv-grub-x86_64.gz</kernel> <cmdline>(hd0,0)/grub/menu.lst</cmdline> </os> It generates the xm config info: (image (linux (kernel /usr/lib/xen/boot/pv-grub-x86_64.gz) (args '(hd0,0)/grub/menu.lst') (device_model /usr/lib64/xen/bin/qemu-dm) ) ) I call virDomainSetAutostart on the domain and traced it through and saw that it gets the string quoted (args '(hd0,0)/grub/menu.lst') from xen then ends up calling string2sexpr, changes the xend_on_start, and then sexpr2string, and it ends up without quotes (args (hd0,0)/grub/menu.lst) and that is what it sends back to xen. Xen then seems to chop it off to (args ('hd0,0')) Thanks, Tom

3 2

[libvirt] [PATCH] Improve error reporting in test suites
by Daniel P. Berrange 14 Oct '10

14 Oct '10

Before running each test case clear the thread local error indicator. After running each test case, dispatch any error that was reported * tests/testutils.c: Fix error reporting in test suites --- tests/testutils.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/tests/testutils.c b/tests/testutils.c index 8171f10..70e7538 100644 --- a/tests/testutils.c +++ b/tests/testutils.c @@ -124,8 +124,12 @@ virtTestRun(const char *title, int nloops, int (*body)(const void *data), const if (ts) GETTIMEOFDAY(&before); + virResetLastError(); if ((ret = body(data)) != 0) break; + virErrorPtr err = virGetLastError(); + if (err) + virDispatchError(NULL); if (ts) { GETTIMEOFDAY(&after); ts[i] = DIFF_MSEC(&after, &before); -- 1.7.2.3

2 3

[libvirt] [PATCH v3] Added new attribute mount_security to filesystem element
by Harsh Prateek Bora 14 Oct '10

14 Oct '10

This patch introduces new attribute to filesystem element to support customizable security for mount type. Valid mount_security are: passthrough and mapped. Usage: <filesystem type='mount' mount_security='passthrough'> <source dir='/export/to/guest'/> <target dir='mount_tag'/> </filesystem> Here is the detailed explanation on these security models: Security model: mapped ---------------------- Fileserver intercepts and maps all the file object create requests. Files on the fileserver will be created with Fileserver's user credentials and the client-user's credentials are stored in extended attributes. During getattr() server extracts the client-user's credentials from extended attributes and sends to the client. This adds a great deal of security in the cloud environments where the guest's(client) user space is kept completely isolated from host's user space. Security model : passthrough ---------------------------- In this security model, Fileserver passes down all requests to the underlying filesystem. File system objects on the fileserver will be created with client-user's credentials. This is done by setting setuid()/setgid() during creation or chmod/chown after file creation. At the end of create protocol request, files on the fileserver will be owned by cleint-user's uid/gid. This model mimic's current NFSv3 level of security. Note: This patch is based on Daniel's patch to support 9pfs. It shall be applied after applying Daniel's patch to support 9pfs. v3: - QEMU cmdline still uses security_model, changes done by mistake reverted. Signed-off-by: Harsh Prateek Bora <harsh(a)linux.vnet.ibm.com> --- docs/schemas/domain.rng | 6 ++++++ src/conf/domain_conf.c | 29 +++++++++++++++++++++++++++-- src/conf/domain_conf.h | 10 ++++++++++ src/qemu/qemu_conf.c | 9 +++++++-- 4 files changed, 50 insertions(+), 4 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index ccb8cf3..36eec63 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -761,6 +761,12 @@ </choice> <optional> <ref name="address"/> + <attribute name="mount_security"> + <choice> + <value>passthrough</value> + <value>mapped</value> + </choice> + </attribute> </optional> </element> </define> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index e05d5d7..ece6937 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -161,6 +161,11 @@ VIR_ENUM_IMPL(virDomainFS, VIR_DOMAIN_FS_TYPE_LAST, "file", "template") +VIR_ENUM_IMPL(virDomainFSMountSecurity, VIR_DOMAIN_FS_SECURITY_LAST, + "passthrough", + "mapped") + + VIR_ENUM_IMPL(virDomainNet, VIR_DOMAIN_NET_TYPE_LAST, "user", "ethernet", @@ -1847,6 +1852,7 @@ virDomainFSDefParseXML(xmlNodePtr node, char *type = NULL; char *source = NULL; char *target = NULL; + char *mount_security = NULL; if (VIR_ALLOC(def) < 0) { virReportOOMError(); @@ -1864,6 +1870,17 @@ virDomainFSDefParseXML(xmlNodePtr node, def->type = VIR_DOMAIN_FS_TYPE_MOUNT; } + mount_security = virXMLPropString(node, "mount_security"); + if (mount_security) { + if ((def->mount_security = virDomainFSMountSecurityTypeFromString(mount_security)) < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unknown mount security '%s'"), mount_security); + goto error; + } + } else { + def->mount_security = VIR_DOMAIN_FS_SECURITY_PASSTHROUGH; + } + cur = node->children; while (cur != NULL) { if (cur->type == XML_ELEMENT_NODE) { @@ -5602,6 +5619,7 @@ virDomainFSDefFormat(virBufferPtr buf, int flags) { const char *type = virDomainFSTypeToString(def->type); + const char *mount_sec = virDomainFSMountSecurityTypeToString(def->mount_security); if (!type) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, @@ -5609,9 +5627,16 @@ virDomainFSDefFormat(virBufferPtr buf, return -1; } + if (!mount_sec) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + _("unexpected mount security %d"), def->mount_security); + return -1; + } + + virBufferVSprintf(buf, - " <filesystem type='%s'>\n", - type); + " <filesystem type='%s' mount_security='%s'>\n", + type, mount_sec); if (def->src) { switch (def->type) { diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 7195c04..3463942 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -236,10 +236,19 @@ enum virDomainFSType { VIR_DOMAIN_FS_TYPE_LAST }; +/* Filesystem mount security model */ +enum virDomainFSMountSecurity { + VIR_DOMAIN_FS_SECURITY_PASSTHROUGH, + VIR_DOMAIN_FS_SECURITY_MAPPED, + + VIR_DOMAIN_FS_SECURITY_LAST +}; + typedef struct _virDomainFSDef virDomainFSDef; typedef virDomainFSDef *virDomainFSDefPtr; struct _virDomainFSDef { int type; + int mount_security; char *src; char *dst; unsigned int readonly : 1; @@ -1167,6 +1176,7 @@ VIR_ENUM_DECL(virDomainDiskErrorPolicy) VIR_ENUM_DECL(virDomainController) VIR_ENUM_DECL(virDomainControllerModel) VIR_ENUM_DECL(virDomainFS) +VIR_ENUM_DECL(virDomainFSMountSecurity) VIR_ENUM_DECL(virDomainNet) VIR_ENUM_DECL(virDomainChrDevice) VIR_ENUM_DECL(virDomainChrChannelTarget) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 18a302a..53ebe5a 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -2014,6 +2014,7 @@ qemuAssignDeviceAliases(virDomainDefPtr def, unsigned long long qemuCmdFlags) if (virAsprintf(&def->fss[i]->info.alias, "fs%d", i) < 0) goto no_memory; } + for (i = 0; i < def->nsounds ; i++) { if (virAsprintf(&def->sounds[i]->info.alias, "sound%d", i) < 0) goto no_memory; @@ -2783,11 +2784,15 @@ char *qemuBuildFSStr(virDomainFSDefPtr fs, if (fs->type != VIR_DOMAIN_FS_TYPE_MOUNT) { qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("can only passthrough directories")); + _("only supports mount filesystem type")); goto error; } - virBufferAddLit(&opt, "local,security_model=passthrough"); + virBufferAddLit(&opt, "local"); + if (fs->mount_security == VIR_DOMAIN_FS_SECURITY_PASSTHROUGH) + virBufferAddLit(&opt, ",security_model=passthrough"); + else if (fs->mount_security == VIR_DOMAIN_FS_SECURITY_MAPPED) + virBufferAddLit(&opt, ",security_model=mapped"); virBufferVSprintf(&opt, ",id=%s%s", QEMU_FSDEV_HOST_PREFIX, fs->info.alias); virBufferVSprintf(&opt, ",path=%s", fs->src); -- 1.7.1.1

5 5

[libvirt] [PATCH] cpu: Fix vendor for recent CPU models
by Jiri Denemark 14 Oct '10

14 Oct '10

Recent CPU models were specified using invalid vendor element <vendor>NAME</vendor>, which was silently ignored due to a bug in the code which was parsing it. --- src/cpu/cpu_map.xml | 12 ++++++------ src/cpu/cpu_x86.c | 11 +++++++++-- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/src/cpu/cpu_map.xml b/src/cpu/cpu_map.xml index edbb21c..75c6522 100644 --- a/src/cpu/cpu_map.xml +++ b/src/cpu/cpu_map.xml @@ -355,7 +355,7 @@ </model> <model name='Conroe'> - <vendor>Intel</vendor> + <vendor name='Intel'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -386,7 +386,7 @@ </model> <model name='Penryn'> - <vendor>Intel</vendor> + <vendor name='Intel'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -419,7 +419,7 @@ </model> <model name='Nehalem'> - <vendor>Intel</vendor> + <vendor name='Intel'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -454,7 +454,7 @@ </model> <model name='Opteron_G1'> - <vendor>AMD</vendor> + <vendor name='AMD'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -483,7 +483,7 @@ </model> <model name='Opteron_G2'> - <vendor>AMD</vendor> + <vendor name='AMD'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> @@ -516,7 +516,7 @@ </model> <model name='Opteron_G3'> - <vendor>AMD</vendor> + <vendor name='AMD'/> <feature name='sse2'/> <feature name='sse'/> <feature name='fxsr'/> diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 1937901..26a5c3f 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -1015,8 +1015,15 @@ x86ModelLoad(xmlXPathContextPtr ctxt, sizeof(*model->cpuid) * model->ncpuid); } - vendor = virXPathString("string(./vendor/@name)", ctxt); - if (vendor) { + if (virXPathBoolean("boolean(./vendor)", ctxt)) { + vendor = virXPathString("string(./vendor/@name)", ctxt); + if (!vendor) { + virCPUReportError(VIR_ERR_INTERNAL_ERROR, + _("Invalid vendor element in CPU model %s"), + model->name); + goto ignore; + } + if (!(model->vendor = x86VendorFind(map, vendor))) { virCPUReportError(VIR_ERR_INTERNAL_ERROR, _("Unknown vendor %s referenced by CPU model %s"), -- 1.7.3.1

2 2

[libvirt] [PATCH] cpu: Use vendor in baseline CPU only if all hosts use it
by Jiri Denemark 14 Oct '10

14 Oct '10

When only some host CPUs given to cpuBaseline contain <vendor> element, baseline CPU should not contain it. Otherwise the result would not be compatible with the host CPUs without vendor. CPU vendors are still taken into account when computing baseline CPU, it's just removed from the result. --- src/cpu/cpu_x86.c | 16 ++++++++++++---- 1 files changed, 12 insertions(+), 4 deletions(-) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 26a5c3f..c6ab871 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -1621,6 +1621,7 @@ x86Baseline(virCPUDefPtr *cpus, unsigned int i; const struct x86_vendor *vendor = NULL; struct x86_model *model = NULL; + bool outputVendor = true; if (!(map = x86LoadMap())) goto error; @@ -1634,8 +1635,9 @@ x86Baseline(virCPUDefPtr *cpus, cpu->type = VIR_CPU_TYPE_GUEST; cpu->match = VIR_CPU_MATCH_EXACT; - if (cpus[0]->vendor && - !(vendor = x86VendorFind(map, cpus[0]->vendor))) { + if (!cpus[0]->vendor) + outputVendor = false; + else if (!(vendor = x86VendorFind(map, cpus[0]->vendor))) { virCPUReportError(VIR_ERR_OPERATION_FAILED, _("Unknown CPU vendor %s"), cpus[0]->vendor); goto error; @@ -1657,8 +1659,11 @@ x86Baseline(virCPUDefPtr *cpus, if (cpus[i]->vendor) vn = cpus[i]->vendor; - else if (model->vendor) - vn = model->vendor->name; + else { + outputVendor = false; + if (model->vendor) + vn = model->vendor->name; + } if (vn) { if (!vendor) { @@ -1694,6 +1699,9 @@ x86Baseline(virCPUDefPtr *cpus, if (x86Decode(cpu, data, models, nmodels, NULL) < 0) goto error; + if (!outputVendor) + VIR_FREE(cpu->vendor); + VIR_FREE(cpu->arch); cleanup: -- 1.7.3.1

2 2

[libvirt] [PATCH 0/2] tests: Make debuging 'make check' failures easier
by Jiri Denemark 14 Oct '10

14 Oct '10

Jiri Denemark (2): tests: Do not override LIBVIRT_DEBUG variable tests: Honor LIBVIRT_{DEBUG,LOG_*} variables tests/Makefile.am | 1 - tests/testutils.c | 1 + 2 files changed, 1 insertions(+), 1 deletions(-) -- 1.7.3.1

2 4

[libvirt] [PATCH] test: silence nwfilter test
by Stefan Berger 14 Oct '10

14 Oct '10

This patch silences the nwfilter test case. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- tests/nwfilterxml2xmltest.c | 120 +++++++++++++++++++++++++++----------------- 1 file changed, 75 insertions(+), 45 deletions(-) Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -4,6 +4,7 @@ #include <stdlib.h> #include <unistd.h> #include <string.h> +#include <stdbool.h> #include <sys/types.h> #include <fcntl.h> @@ -22,7 +23,9 @@ static char *abs_srcdir; #define MAX_FILE 4096 -static int testCompareXMLToXMLFiles(const char *inxml, const char *outxml) { +static int testCompareXMLToXMLFiles(const char *inxml, + const char *outxml, + bool expect_warning) { char inXmlData[MAX_FILE]; char *inXmlPtr = &(inXmlData[0]); char outXmlData[MAX_FILE]; @@ -30,6 +33,7 @@ static int testCompareXMLToXMLFiles(cons char *actual = NULL; int ret = -1; virNWFilterDefPtr dev = NULL; + char *log; if (virtTestLoadFile(inxml, &inXmlPtr, MAX_FILE) < 0) goto fail; @@ -39,6 +43,20 @@ static int testCompareXMLToXMLFiles(cons if (!(dev = virNWFilterDefParseString(NULL, inXmlData))) goto fail; + if ((log = virtTestLogContentAndReset()) == NULL) + goto fail; + + if ((*log != '\0') != expect_warning) { + free(log); + goto fail; + } + free(log); + + if (expect_warning) { + /* need to suppress the errors */ + virResetLastError(); + } + if (!(actual = virNWFilterDefFormat(dev))) goto fail; @@ -55,14 +73,20 @@ static int testCompareXMLToXMLFiles(cons return ret; } +typedef struct test_parms { + const char *name; + bool expect_warning; +} test_parms; + static int testCompareXMLToXMLHelper(const void *data) { + const test_parms *tp = data; char inxml[PATH_MAX]; char outxml[PATH_MAX]; snprintf(inxml, PATH_MAX, "%s/nwfilterxml2xmlin/%s.xml", - abs_srcdir, (const char*)data); + abs_srcdir, tp->name); snprintf(outxml, PATH_MAX, "%s/nwfilterxml2xmlout/%s.xml", - abs_srcdir, (const char*)data); - return testCompareXMLToXMLFiles(inxml, outxml); + abs_srcdir, tp->name); + return testCompareXMLToXMLFiles(inxml, outxml, !!tp->expect_warning); } @@ -83,51 +107,57 @@ mymain(int argc, char **argv) if (!abs_srcdir) abs_srcdir = getcwd(cwd, sizeof(cwd)); -#define DO_TEST(name) \ - if (virtTestRun("NWFilter XML-2-XML " name, \ - 1, testCompareXMLToXMLHelper, (name)) < 0) \ - ret = -1 - - DO_TEST("mac-test"); - DO_TEST("arp-test"); - DO_TEST("rarp-test"); - DO_TEST("ip-test"); - DO_TEST("ipv6-test"); - - DO_TEST("tcp-test"); - DO_TEST("udp-test"); - DO_TEST("icmp-test"); - DO_TEST("igmp-test"); - DO_TEST("sctp-test"); - DO_TEST("udplite-test"); - DO_TEST("esp-test"); - DO_TEST("ah-test"); - DO_TEST("all-test"); - - DO_TEST("tcp-ipv6-test"); - DO_TEST("udp-ipv6-test"); - DO_TEST("icmpv6-test"); - DO_TEST("sctp-ipv6-test"); - DO_TEST("udplite-ipv6-test"); - DO_TEST("esp-ipv6-test"); - DO_TEST("ah-ipv6-test"); - DO_TEST("all-ipv6-test"); - - DO_TEST("ref-test"); - DO_TEST("ref-rule-test"); - DO_TEST("ipt-no-macspoof-test"); - DO_TEST("icmp-direction-test"); - DO_TEST("icmp-direction2-test"); - DO_TEST("icmp-direction3-test"); +#define DO_TEST(NAME, EXPECT_WARN) \ + do { \ + test_parms tp = { \ + .name = NAME, \ + .expect_warning = EXPECT_WARN, \ + }; \ + if (virtTestRun("NWFilter XML-2-XML " NAME, \ + 1, testCompareXMLToXMLHelper, (&tp)) < 0) \ + ret = -1; \ + } while (0) + + DO_TEST("mac-test", true); + DO_TEST("arp-test", true); + DO_TEST("rarp-test", true); + DO_TEST("ip-test", true); + DO_TEST("ipv6-test", true); + + DO_TEST("tcp-test", true); + DO_TEST("udp-test", true); + DO_TEST("icmp-test", true); + DO_TEST("igmp-test", false); + DO_TEST("sctp-test", true); + DO_TEST("udplite-test", false); + DO_TEST("esp-test", false); + DO_TEST("ah-test", false); + DO_TEST("all-test", false); + + DO_TEST("tcp-ipv6-test", true); + DO_TEST("udp-ipv6-test", true); + DO_TEST("icmpv6-test", true); + DO_TEST("sctp-ipv6-test", true); + DO_TEST("udplite-ipv6-test", true); + DO_TEST("esp-ipv6-test", true); + DO_TEST("ah-ipv6-test", true); + DO_TEST("all-ipv6-test", true); + + DO_TEST("ref-test", false); + DO_TEST("ref-rule-test", false); + DO_TEST("ipt-no-macspoof-test", false); + DO_TEST("icmp-direction-test", false); + DO_TEST("icmp-direction2-test", false); + DO_TEST("icmp-direction3-test", false); - DO_TEST("conntrack-test"); + DO_TEST("conntrack-test", false); - DO_TEST("hex-data-test"); + DO_TEST("hex-data-test", true); - DO_TEST("comment-test"); + DO_TEST("comment-test", true); - DO_TEST("example-1"); - DO_TEST("example-2"); + DO_TEST("example-1", false); + DO_TEST("example-2", false); return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); }

2 2

[libvirt] [PATCH] nwfilter: cut off connections after changing filters
by Stefan Berger 14 Oct '10

14 Oct '10

The following filter transition from a filter allowing incoming TCP connections <rule action='accept' direction='in' priority='401'> <tcp/> </rule> <rule action='accept' direction='out' priority='500'> <tcp/> </rule> to one that does not allow them <rule action='drop' direction='in' priority='401'> <tcp/> </rule> <rule action='accept' direction='out' priority='500'> <tcp/> </rule> did previously not cut off existing (ssh) connections but only prevented newly initiated ones. The attached patch allows to cut off existing connections as well, thus enforcing what the filter is showing. I had only tested with a configuration where the physical interface is connected to the bridge where the filters are applied. This patch now also solves a filtering problem where the physical interface is not connected to the bridge, but the bridge is given an IP address and the host routes between bridge and physical interface. Here the filters drop non-allowed traffic on the outgoing side on the host. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1100,6 +1100,19 @@ err_exit: return 1; } + +static void +iptablesEnforceDirection(int directionIn, + virNWFilterRuleDefPtr rule, + virBufferPtr buf) +{ + if (rule->tt != VIR_NWFILTER_RULE_DIRECTION_INOUT) + virBufferVSprintf(buf, " -m conntrack --ctdir %s", + (directionIn) ? "Original" + : "Reply"); +} + + /* * _iptablesCreateRuleInstance: * @chainPrefix : The prefix to put in front of the name of the chain @@ -1494,6 +1507,10 @@ _iptablesCreateRuleInstance(int directio if (match && !skipMatch) virBufferVSprintf(&buf, " %s", match); + if (defMatch && match != NULL) + iptablesEnforceDirection(directionIn, + rule, + &buf); virBufferVSprintf(&buf, " -j %s" CMD_DEF_POST CMD_SEPARATOR

2 1