- Devel - libvirt List Archives

[libvirt] PATCH 0/4: AppArmor updates
by Jamie Strandboge 14 Aug '10

14 Aug '10

This patchset consists of various small updates to the AppArmor security driver: 0001-apparmor-dont-ignore-open.patch: Exit with error if virDomainDiskDefForeachPath() fails, unless the disk doesn't exist, at which point we skip it without error. Also add several tests to virt-aa-helper-test for '-p' option. 0002-apparmor-chardev.patch: fix serial ports, parallel ports and channels 0003-apparmor-examples.patch: update to example AppArmor profile 0004-apparmor-fix-warn.patch: fix a compiler warning The updates in 0001-apparmor-dont-ignore-open.patch are needed to ensure that it works consistently with and without '-p 1' and that the security fix works as advertised. The other patches should speak for themselves. -- Jamie Strandboge | http://www.canonical.com

1 0

[libvirt] [PATCH v2] nwfilter: Discard class D and E IP addresses when sniffing packets
by Stefan Berger 14 Aug '10

14 Aug '10

V2: Corrected comment and simplified mask to check for class D and E IP addresses When sniffing the network traffic, discard class D and E IP addresses when sniffing traffic. This was a reason why filters were not correctly rebuilt on VMs on the local 192.* network when libvirt was restarted and those VMs did not use a DHCP request to get its IP address. Signed-off-by: Stefan Berger<stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_learnipaddr.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -546,9 +546,11 @@ learnIPAddressThread(void *arg) struct iphdr *iphdr = (struct iphdr*)(packet + ethHdrSize); vmaddr = iphdr->saddr; - // skip eth. bcast and mcast addresses, - // and zero address in DHCP Requests - if ((ntohl(vmaddr)& 0xc0000000) || vmaddr == 0) { + // skip mcast addresses (224.0.0.0 - 239.255.255.255), + // class E (240.0.0.0 - 255.255.255.255, includes eth. + // bcast) and zero address in DHCP Requests + if ( (ntohl(vmaddr)& 0xe0000000) == 0xe0000000 || + vmaddr == 0) { vmaddr = 0; continue; }

3 2

[libvirt] [PATCH[ nwfilter: Discard class D and E IP addresses when sniffing
by Stefan Berger 14 Aug '10

14 Aug '10

When sniffing the network traffic, discard class D and E IP addresses when sniffing traffic. This was a reason why filters were not correctly rebuilt on VMs on the local 192.* network when libvirt was restarted and those VMs did not use a DHCP request to get its IP address. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_learnipaddr.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -546,9 +546,12 @@ learnIPAddressThread(void *arg) struct iphdr *iphdr = (struct iphdr*)(packet + ethHdrSize); vmaddr = iphdr->saddr; - // skip eth. bcast and mcast addresses, + // skip eth. bcast and mcast addresses (224.0.0.0 - + // 239.255.255.255), class E (255.*) // and zero address in DHCP Requests - if ((ntohl(vmaddr) & 0xc0000000) || vmaddr == 0) { + if ( (ntohl(vmaddr) & 0xe0000000) == 0xe0000000 || + (ntohl(vmaddr) & 0xf0000000) == 0xf0000000 || + vmaddr == 0) { vmaddr = 0; continue; }

3 4

[libvirt] [PATCH] nwfilter: fix a memory leak
by Stefan Berger 14 Aug '10

14 Aug '10

Fixing a memory leak. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 3 +++ 1 file changed, 3 insertions(+) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -2973,6 +2973,9 @@ static int ebtablesCleanAll(const char * ebtablesRemoveTmpRootChain(&buf, 0, ifname); ebiptablesExecCLI(&buf, &cli_status); + + virBufferFreeAndReset(&buf); + return 0; }

3 2

[libvirt] [PATCH] Only require XDR when building libvirtd or the remote driver
by Matthias Bolte 14 Aug '10

14 Aug '10

--- configure.ac | 31 +++++++++++++++++++------------ 1 files changed, 19 insertions(+), 12 deletions(-) diff --git a/configure.ac b/configure.ac index a762bae..764405c 100644 --- a/configure.ac +++ b/configure.ac @@ -111,18 +111,6 @@ dnl Availability of various common headers (non-fatal if missing). AC_CHECK_HEADERS([pwd.h paths.h regex.h sys/syslimits.h \ termios.h sys/poll.h syslog.h mntent.h net/ethernet.h linux/magic.h]) -dnl Where are the XDR functions? -dnl If portablexdr is installed, prefer that. -dnl Otherwise try -lrpc (Cygwin) -lxdr (some MinGW), -lnsl (Solaris) -dnl or none (most Unix) -AC_CHECK_LIB([portablexdr],[xdrmem_create],[],[ - AC_SEARCH_LIBS([xdrmem_create],[rpc xdr nsl],[], - [AC_MSG_ERROR([Cannot find a XDR library])]) - ]) - -dnl check for cygwin's variation in xdr function names -AC_CHECK_FUNCS([xdr_u_int64_t],[],[],[#include <rpc/xdr.h>]) - AC_CHECK_LIB([intl],[gettext],[]) dnl Do we have rpcgen? @@ -319,6 +307,25 @@ AM_CONDITIONAL([WITH_OPENVZ], [test "$with_openvz" = "yes"]) dnl +dnl check for XDR +dnl + +if test x"$with_remote" = x"yes" || test x"$with_libvirtd" = x"yes"; then + dnl Where are the XDR functions? + dnl If portablexdr is installed, prefer that. + dnl Otherwise try -lrpc (Cygwin) -lxdr (some MinGW), -lnsl (Solaris) + dnl or none (most Unix) + AC_CHECK_LIB([portablexdr],[xdrmem_create],[],[ + AC_SEARCH_LIBS([xdrmem_create],[rpc xdr nsl],[], + [AC_MSG_ERROR([Cannot find a XDR library])]) + ]) + + dnl check for cygwin's variation in xdr function names + AC_CHECK_FUNCS([xdr_u_int64_t],[],[],[#include <rpc/xdr.h>]) +fi + + +dnl dnl check for VirtualBox XPCOMC location dnl -- 1.7.0.4

2 2

[libvirt] [PATCH] nwfilter: serialize execution of scripts with ebtables cmds
by Stefan Berger 14 Aug '10

14 Aug '10

While testing the SIGHUP handling and reloading of the nwfilter driver, I found that when the filters are rebuilt and mutlipe threads handled the individual interfaces, concurrently running multiple external bash scripts causes strange failures even though the executed ebtables commands are working on different tables for different interfaces. I cannot say for sure where the concurrency problems are caused, but introducing this lock definitely helps. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -104,6 +104,7 @@ static int ebiptablesDriverInit(void); static void ebiptablesDriverShutdown(void); static int ebtablesCleanAll(const char *ifname); +static virMutex execCLIMutex; struct ushort_map { unsigned short attr; @@ -2309,8 +2310,13 @@ ebiptablesExecCLI(virBufferPtr buf, return 1; argv[0] = filename; + + virMutexLock(&execCLIMutex); + rc = virRun(argv, status); + virMutexUnlock(&execCLIMutex); + *status >>= 8; VIR_DEBUG("rc = %d, status = %d",rc, *status); @@ -3163,8 +3169,9 @@ tear_down_tmpebchains: ebiptablesExecCLI(&buf, &cli_status); virNWFilterReportError(VIR_ERR_BUILD_FIREWALL, - "%s", - _("Some rules could not be created.")); + _("Some rules could not be created for " + "interface %s."), + ifname); return 1; } @@ -3364,6 +3371,9 @@ ebiptablesDriverInit(void) virBuffer buf = VIR_BUFFER_INITIALIZER; int cli_status; + if (virMutexInit(&execCLIMutex)) + return EINVAL; + bash_cmd_path = virFindFileInPath("bash"); gawk_cmd_path = virFindFileInPath("gawk"); grep_cmd_path = virFindFileInPath("grep");

3 2

[libvirt] [PATCH v2] nwfilter: extend nwfilter reload support
by Stefan Berger 14 Aug '10

14 Aug '10

v2: Fixes to the nwfilter driver reload function that also needs a valid virConnectPtr. In this patch I am extending and fixing the nwfilter module's reload support to stop all ongoing threads (for learning IP addresses of interfaces) and rebuild the filtering rules of all interfaces of all VMs when libvirt is started. Now libvirtd rebuilds the filters upon the SIGHUP signal and libvirtd restart. About the patch: The nwfilter functions require a virConnectPtr. Therefore I am opening a connection in qemudStartup, which later on needs to be closed outside where the driver lock is held since otherwise it ends up in a deadlock due to virConnectClose() trying to lock the driver as well. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_driver.c | 21 ++++++++++---- src/nwfilter/nwfilter_learnipaddr.c | 15 +++++++--- src/nwfilter/nwfilter_learnipaddr.h | 1 src/qemu/qemu_driver.c | 52 +++++++++++++++++++++++++++++++++--- 4 files changed, 75 insertions(+), 14 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -143,15 +143,25 @@ conf_init_err: */ static int nwfilterDriverReload(void) { + virConnectPtr conn; if (!driverState) { return -1; } - nwfilterDriverLock(driverState); - virNWFilterPoolLoadAllConfigs(NULL, - &driverState->pools, - driverState->configDir); - nwfilterDriverUnlock(driverState); + conn = virConnectOpen("qemu:///system"); + + if (conn) { + /* shut down all threads -- qemud for example will restart them */ + virNWFilterLearnThreadsTerminate(); + + nwfilterDriverLock(driverState); + virNWFilterPoolLoadAllConfigs(conn, + &driverState->pools, + driverState->configDir); + nwfilterDriverUnlock(driverState); + + virConnectClose(conn); + } return 0; } Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -855,6 +855,16 @@ virNWFilterLearnInit(void) { } +void +virNWFilterLearnThreadsTerminate() { + threadsTerminate = true; + + while (virHashSize(pendingLearnReq) != 0) + usleep((PKT_TIMEOUT_MS * 1000) / 3); + + threadsTerminate = false; +} + /** * virNWFilterLearnShutdown * Shutdown of this layer @@ -862,10 +872,7 @@ virNWFilterLearnInit(void) { void virNWFilterLearnShutdown(void) { - threadsTerminate = true; - - while (virHashSize(pendingLearnReq) != 0) - usleep((PKT_TIMEOUT_MS * 1000) / 3); + virNWFilterLearnThreadsTerminate(); virHashFree(pendingLearnReq, freeLearnReqEntry); pendingLearnReq = NULL; Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.h +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -71,5 +71,6 @@ void virNWFilterUnlockIface(const char * int virNWFilterLearnInit(void); void virNWFilterLearnShutdown(void); +void virNWFilterLearnThreadsTerminate(void); #endif /* __NWFILTER_LEARNIPADDR_H */ Index: libvirt-acl/src/qemu/qemu_driver.c =================================================================== --- libvirt-acl.orig/src/qemu/qemu_driver.c +++ libvirt-acl/src/qemu/qemu_driver.c @@ -170,6 +170,9 @@ static int qemuDetectVcpuPIDs(struct qem static int qemuUpdateActivePciHostdevs(struct qemud_driver *driver, virDomainDefPtr def); +static int qemudVMFiltersInstantiate(virConnectPtr conn, + virDomainDefPtr def); + static struct qemud_driver *qemu_driver = NULL; @@ -1423,6 +1426,10 @@ error: return ret; } +struct virReconnectDomainData { + virConnectPtr conn; + struct qemud_driver *driver; +}; /* * Open an existing VM's monitor, re-detect VCPU threads * and re-reserve the security labels in use @@ -1431,9 +1438,11 @@ static void qemuReconnectDomain(void *payload, const char *name ATTRIBUTE_UNUSED, void *opaque) { virDomainObjPtr obj = payload; - struct qemud_driver *driver = opaque; + struct virReconnectDomainData *data = opaque; + struct qemud_driver *driver = data->driver; qemuDomainObjPrivatePtr priv; unsigned long long qemuCmdFlags; + virConnectPtr conn = data->conn; virDomainObjLock(obj); @@ -1467,6 +1476,9 @@ qemuReconnectDomain(void *payload, const obj) < 0) goto error; + if (qemudVMFiltersInstantiate(conn, obj->def)) + goto error; + if (obj->def->id >= driver->nextvmid) driver->nextvmid = obj->def->id + 1; @@ -1491,9 +1503,10 @@ error: * about. */ static void -qemuReconnectDomains(struct qemud_driver *driver) +qemuReconnectDomains(virConnectPtr conn, struct qemud_driver *driver) { - virHashForEach(driver->domains.objs, qemuReconnectDomain, driver); + struct virReconnectDomainData data = {conn, driver}; + virHashForEach(driver->domains.objs, qemuReconnectDomain, &data); } @@ -1691,6 +1704,7 @@ qemudStartup(int privileged) { char *base = NULL; char driverConf[PATH_MAX]; int rc; + virConnectPtr conn = NULL; if (VIR_ALLOC(qemu_driver) < 0) return -1; @@ -1912,7 +1926,11 @@ qemudStartup(int privileged) { 1, NULL, NULL) < 0) goto error; - qemuReconnectDomains(qemu_driver); + conn = virConnectOpen(qemu_driver->privileged ? + "qemu:///system" : + "qemu:///session"); + + qemuReconnectDomains(conn, qemu_driver); /* Then inactive persistent configs */ if (virDomainLoadAllConfigs(qemu_driver->caps, @@ -1930,6 +1948,8 @@ qemudStartup(int privileged) { qemudAutostartConfigs(qemu_driver); + if (conn) + virConnectClose(conn); return 0; @@ -1938,6 +1958,8 @@ out_of_memory: error: if (qemu_driver) qemuDriverUnlock(qemu_driver); + if (conn) + virConnectClose(conn); VIR_FREE(base); qemudShutdown(); return -1; @@ -12731,6 +12753,28 @@ qemudVMFilterRebuild(virConnectPtr conn return 0; } +static int +qemudVMFiltersInstantiate(virConnectPtr conn, + virDomainDefPtr def) +{ + int err = 0; + int i; + + if (!conn) + return 1; + + for (i = 0 ; i < def->nnets ; i++) { + virDomainNetDefPtr net = def->nets[i]; + if ((net->filter) && (net->ifname)) { + if (virDomainConfNWFilterInstantiate(conn, net)) { + err = 1; + break; + } + } + } + + return err; +} static virNWFilterCallbackDriver qemuCallbackDriver = { .name = "QEMU",

3 2

[libvirt] Block-migrate
by Ruben Kerkhof 14 Aug '10

14 Aug '10

I've been playing with the new block-migrate feature, but am unable to get it to work. [root@src ~]# virsh migrate --live --p2p --tunnelled --copy-storage-all 4c5c75b9-decc-41c9-9296-20ca5bd5c355 qemu://dst/system error: Unknown failure /var/log/libvirt/qemu/4c5c75b9-decc-41c9-9296-20ca5bd5c355.log on the destination host shows: bind(unix:/var/run/libvirt/qemu/qemu.tunnelmigrate.dest.4c5c75b9-decc-41c9-9296-20ca5bd5c355): Permission denied Migration failed. Exit code unix:/var/run/libvirt/qemu/qemu.tunnelmigrate.dest.4c5c75b9-decc-41c9-9296-20ca5bd5c355(-22), exiting It seems that qemu is not able to write to that location. [root@dst qemu]# ls -ld /var/run/libvirt/qemu/ drwx------. 2 root root 4096 Aug 7 15:40 /var/run/libvirt/qemu/ As a workaround I gave qemu write permission, and now the block migrate starts. Receiving block device images Completed 100 % Then the migrate command fails: [root@src ~]# virsh migrate --live --p2p --tunnelled --copy-storage-all 4c5c75b9-decc-41c9-9296-20ca5bd5c355 qemu://phy004.tilaa.nl/system error: Unknown failure and the only thing I can find is in /var/log/libvirt/libvirt.log on the destination: 15:40:12.370: error : qemuStreamMigWrite:10376 : cannot write to stream: Broken pipe Maybe I'm using the wrong options for virsh migrate, but they're not described in the manpage. Any hints? Regards, Ruben Kerkhof

4 10

[libvirt] [PATCH] Move the tunnelled migration unix socket to /var/lib/libvirt/qemu
by Chris Lalancette 13 Aug '10

13 Aug '10

Since the qemu process is running as qemu:qemu, it can't actually look at the unix socket in /var/run/libvirt/qemu which is owned by root and has permission 700. Move the unix socket to /var/lib/libvirt/qemu, which is already owned by qemu:qemu. Thanks to Justin Clift for test this out for me. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/qemu/qemu_driver.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index b6b6633..007b09a 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10470,7 +10470,7 @@ qemudDomainMigratePrepareTunnel(virConnectPtr dconn, vm->def->id = -1; if (virAsprintf(&unixfile, "%s/qemu.tunnelmigrate.dest.%s", - driver->stateDir, vm->def->name) < 0) { + driver->libDir, vm->def->name) < 0) { virReportOOMError(); goto endjob; } @@ -10941,7 +10941,7 @@ static int doTunnelMigrate(virDomainPtr dom, /* Stage 1. setup local support infrastructure */ if (virAsprintf(&unixfile, "%s/qemu.tunnelmigrate.src.%s", - driver->stateDir, vm->def->name) < 0) { + driver->libDir, vm->def->name) < 0) { virReportOOMError(); goto cleanup; } -- 1.7.2.1

3 3

[libvirt] [PATCH] Fix tunnelled migration with qemu running as qemu:qemu.
by Chris Lalancette 13 Aug '10

13 Aug '10

The problem is that on the source of the migration, libvirtd is responsible for creating the unix socket over which the data will flow. Since libvirtd is running as root, this file will be created as root. When the qemu process running as qemu:qemu goes to access the unix file to write data to it, it will get permission denied and fail. Make sure to change the owner of the unix file to qemu:qemu. Thanks to Justin Clift for testing this patch out for me. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/qemu/qemu_driver.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 3dfd1ae..b6b6633 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10975,6 +10975,13 @@ static int doTunnelMigrate(virDomainPtr dom, goto cleanup; } + if (chown(unixfile, qemu_driver->user, qemu_driver->group) < 0) { + virReportSystemError(errno, + _("Cannot change unix socket '%s' owner"), + unixfile); + goto cleanup; + } + /* check that this qemu version supports the unix migration */ if (qemudExtractVersionInfo(vm->def->emulator, NULL, &qemuCmdFlags) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, -- 1.7.2.1

2 2