- Devel - libvirt List Archives

[libvirt] [PATCH] nwfilter: extensions of docs with advanced filtering topics
by Stefan Berger 19 Jun '10

19 Jun '10

As requested, here a couple of paragraphs about the recently added statematch attribute and some advanced (and tricky) traffic filtering topics. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/formatnwfilter.html.in | 117 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 117 insertions(+) Index: libvirt-acl/docs/formatnwfilter.html.in =================================================================== --- libvirt-acl.orig/docs/formatnwfilter.html.in +++ libvirt-acl/docs/formatnwfilter.html.in @@ -277,6 +277,13 @@ Valid values are in the range of 0 to 1000. If this attribute is not provided, the value 500 will automatically be assigned. </li> + <li> + statematch -- optional; possible values are '0' or 'false' to + turn the underlying connection state matching off; default is 'true' + <br> + Also read the section on <a href="#nwfelemsRulesAdv">advanced configuration</a> + topics. + </li> </ul> <p> The above example indicates that the traffic of type <code>ip</code> @@ -1117,6 +1124,116 @@ <br><br> </p> + <h3><a name="nwfelemsRulesAdv">Advanced Filter Configuration Topics</a></h3> + <p> + The following sections discuss advanced filter configuration + topics. + </p> + <h4><a name="nwfelemsRulesAdvTracking">Connection tracking</a></h4> + <p> + The network filtering subsystem (on Linux) makes use of the connection + tracking support of iptables. This helps in enforcing the + directionality of network traffic (state match) as well as + counting and limiting the number of simultaneous connections towards + a VM. As an example, if a VM has TCP port 8080 + open, clients may connect to it on port 8080. The tracking of the + connection then prevents the client from initiating a connection from + (TCP client) port 8080 to the host back (after previously having + gained access to the VM). More importantly, tracking helps to prevent + remote attackers to establish a connection back to a VM for example + if the user inside the VM has established a connection to + port 80 on an attacker site, then the attacker won't be able to + initiate a connection from TCP port 80 towards the VM. + By default the connection state match that enables the enforcement + of directionality of traffic is turned on. <br> + The following shows an example XML fragement where this feature has been + turned off for incoming connections to TCP port 12345. + </p> +<pre> + [...] + <rule direction='in' action='accept' statematch='false'> + <tcp dstportstart='12345'/> + </rule> + [...] +</pre> + <p> + This now allows incoming traffic to TCP port 12345, but would also + enable the initiation from (client) TCP port 12345 within the VM, + which may or may not be desirable. + </p> + + <h4><a name="nwfelemsRulesAdvLimiting">Limiting Number of Connections</a></h4> + <p> + To limit the number of connections a VM may establish, a rule must + be provided that sets a limit of connections for a given + type of traffic. If for example a VM + is supposed to be allowed to only ping one other IP address at a time + and is supposed to have only one active incoming ssh connection at a + time, the following XML fragment can be used to achieve this. + </p> +<pre> + [...] + <rule action='drop' direction='in' priority='400'> + <tcp connlimit-above='1'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <tcp dstportstart='22'/> + </rule> + <rule action='drop' direction='out' priority='400'> + <icmp connlimit-above='1'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='accept' direction='out' priority='500'> + <udp dstportstart='53'/> + </rule> + <rule action='drop' direction='inout' priority='1000'> + <all/> + </rule> + [...] +</pre> + <p> + Note that the rule for the limit has to logically appear + before the rule for accepting the traffic.<br> + An additional rule for letting DNS traffic to port 22 + go out the VM has been added to avoid ssh sessions not + getting established for reasons related to DNS lookup failures + by the ssh daemon. Leaving this rule out may otherwise lead to + fun-filled debugging joy. + <br><br> + Lot of care must be taken with timeouts related + to tracking of traffic. An ICMP ping that + the user may have terminated inside the VM may have a long + timeout in the host's connection tracking system and therefore + not allow another ICMP ping to go through for a while. Therefore, + the timeouts have to be tuned in the host's sysfs, i.e., + </p> + +<pre> + echo 3 > /proc/sys/net/netfilter/nf_conntrack_icmp_timeout +</pre> + <p> + sets the ICMP connection tracking timeout to 3 seconds. The + effect of this is that once one ping is terminated, another + one can start after 3 seconds.<br> + Further, we want to point out that a client that for whatever + reason has not properly closed a TCP connection may cause a + connection to be held open for a longer period of time, + depending to what timeout the <code>TCP established</code> state + timeout has been set to on the host. Also, idle connections may time + out in the connection tracking system but can be reactivated once + packets are exchanged. However, a newly initated connection may force + an idle connection into TCP backoff if the number of allowed connections + is set to a too low limit, the new connection is established + and hits (not exceeds) the limit of allowed connections and for + example a key is pressed on the old ssh session, which now has become + unresponsive due to traffic being dropped. + Therefore, the limit of connections should be rather high so that + fluctuations in new TCP connections don't cause odd + traffic behavior in relaton to idle connections. + </p> + <h2><a name="nwfcli">Command line tools</a></h2> <p> The libvirt command line tool <code>virsh</code> has been extended

2 2

[libvirt] [PATCH] libvirt-java-0.4.5 where libvirt-java-0.4.6 Refactored and Modify
by Luis Carlos Moreira da Costa 19 Jun '10

19 Jun '10

Thu Jun 17 2010 Luis Carlos Moreira da Costa <tcljava(a)gmail.com> * Refactored the all code of the libvirt. * Modify the method toString() to Strng.format in all classes. * Add final in classes, methods and attributes. * Alter of test Junit. * Modify and alter javadoc the methods. * Add .project and .classpath in Eclipse Galileo IDE. *Luís Carlos Moreira da Costa* *Engenharia & Tecnologia** **---------------------------------------------------------** **ALOG Data Centers do Brasil** **Excelência em Projetos de Hosting* Rua Dr. Miguel Couto, 58 -- Centro CEP 01008-010 -- São Paulo (SP) Telefone: (11) 3524-4970 (11) 8476-0040 *http://www.alog.com.br* <http://www.alog.com.br/>

2 1

[libvirt] [PATCH 2/2] virsh: add new --details option to vol-list
by Justin Clift 19 Jun '10

19 Jun '10

This patch adds a new --details option to the virsh vol-list command, making its output more useful to people who use virsh for significant lengths of time. --- Output from the new option (hopefully this doesn't wrap): virsh # pool-list Name State Autostart ----------------------------------------- default active yes image_dir active yes tmp active no virsh # vol-list default Name Path --------------------------------------------------------------------------------------------- CentOS-5.5-x86_64-bin-DVD-1of2.iso /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-1of2.iso CentOS-5.5-x86_64-bin-DVD-2of2.iso /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-2of2.iso virsh # vol-list image_dir Name Path ------------------------------------------------------------------------- snap1.img /export/backend/centos_home/jc/tmp/images/snap1.img testimage1 /export/backend/centos_home/jc/tmp/images/testimage1 virsh # vol-list tmp Name Path ------------------------------------------ disk1.img /tmp/images/disk1.img disk2.img /tmp/images/disk2.img disk3.img /tmp/images/disk3.img disk4.img /tmp/images/disk4.img disk5.img /tmp/images/disk5.img disk6.img /tmp/images/disk6.img virsh # vol-list default --details Name Type Capacity Allocation Path ---------------------------------------------------------------- CentOS-5.5-x86_64-bin-DVD-1of2.iso file 4.09 GB 4.10 GB /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-1of2.iso CentOS-5.5-x86_64-bin-DVD-2of2.iso file 412.33 MB 412.74 MB /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-2of2.iso virsh # vol-list image_dir --details Name Type Capacity Allocation Path ---------------------------------------------------------- snap1.img file 20.00 GB 140.00 KB /export/backend/centos_home/jc/tmp/images/snap1.img testimage1 file 20.00 GB 20.02 GB /export/backend/centos_home/jc/tmp/images/testimage1 virsh # vol-list tmp --details Name Type Capacity Allocation Path ------------------------------------------------------------- disk1.img file 20.00 GB 136.00 KB /tmp/images/disk1.img disk2.img file 20.00 GB 136.00 KB /tmp/images/disk2.img disk3.img file 20.00 GB 136.00 KB /tmp/images/disk3.img disk4.img file 20.00 GB 136.00 KB /tmp/images/disk4.img disk5.img file 20.00 GB 136.00 KB /tmp/images/disk5.img disk6.img file 20.00 GB 136.00 KB /tmp/images/disk6.img virsh # Much more practical than running vol-info individually on each volume. tools/virsh.c | 212 ++++++++++++++++++++++++++++++++++++++++++++++++------- tools/virsh.pod | 4 +- 2 files changed, 189 insertions(+), 27 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index afa84e6..7a12e15 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -6047,67 +6047,227 @@ static const vshCmdInfo info_vol_list[] = { static const vshCmdOptDef opts_vol_list[] = { {"pool", VSH_OT_DATA, VSH_OFLAG_REQ, N_("pool name or uuid")}, + {"details", VSH_OT_BOOL, 0, N_("display extended details for volumes")}, {NULL, 0, 0, NULL} }; static int cmdVolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) { + virStorageVolInfo **volumeInfos = NULL; virStoragePoolPtr pool; - int maxactive = 0, i; + int details = vshCommandOptBool(cmd, "details"); + int maxName = 0, maxPath = 0; + int numVolumes = 0, i; char **activeNames = NULL; + char **volumePaths = NULL; + /* Check the connection to libvirtd daemon is still working */ if (!vshConnectionUsability(ctl, ctl->conn, TRUE)) return FALSE; + /* Look up the pool information given to us by the user */ if (!(pool = vshCommandOptPool(ctl, cmd, "pool", NULL))) return FALSE; - maxactive = virStoragePoolNumOfVolumes(pool); - if (maxactive < 0) { + /* Determine the number of volumes in the pool */ + numVolumes = virStoragePoolNumOfVolumes(pool); + if (numVolumes < 0) { virStoragePoolFree(pool); vshError(ctl, "%s", _("Failed to list active vols")); return FALSE; } - if (maxactive) { - activeNames = vshMalloc(ctl, sizeof(char *) * maxactive); - if ((maxactive = virStoragePoolListVolumes(pool, activeNames, - maxactive)) < 0) { + /* Retrieve the list of volume names in the pool */ + if (numVolumes) { + activeNames = vshMalloc(ctl, sizeof(char *) * numVolumes); + if ((numVolumes = virStoragePoolListVolumes(pool, activeNames, + numVolumes)) < 0) { vshError(ctl, "%s", _("Failed to list active vols")); VIR_FREE(activeNames); virStoragePoolFree(pool); return FALSE; } - qsort(&activeNames[0], maxactive, sizeof(char *), namesorter); + /* Sort the volume names */ + qsort(&activeNames[0], numVolumes, sizeof(char *), namesorter); } - vshPrintExtra(ctl, "%-20s %-40s\n", _("Name"), _("Path")); - vshPrintExtra(ctl, "-----------------------------------------\n"); - for (i = 0; i < maxactive; i++) { - virStorageVolPtr vol = virStorageVolLookupByName(pool, activeNames[i]); - char *path; + /* Set aside memory for volume information pointers */ + volumePaths = vshMalloc(ctl, sizeof(char *) * numVolumes); + volumeInfos = vshMalloc(ctl, sizeof(virStorageVolInfo *) * numVolumes); - /* this kind of work with vols is not atomic operation */ - if (!vol) { - VIR_FREE(activeNames[i]); - continue; - } + /* Collect the rest of the volume information for display */ + for (i = 0; i < numVolumes; i++) { + int stringLength; + virStorageVolPtr vol = virStorageVolLookupByName(pool, + activeNames[i]); - if ((path = virStorageVolGetPath(vol)) == NULL) { - virStorageVolFree(vol); - continue; + /* Retrieve the volume path */ + if ((volumePaths[i] = virStorageVolGetPath(vol)) == NULL) { + /* Something went wrong retrieving a volume path, cope with it */ + volumePaths[i] = vshStrdup(ctl, _("unknown")); } + /* Keep the length of path string if longest so far */ + stringLength = strlen(volumePaths[i]); + if (stringLength > maxPath) + maxPath = stringLength; + + /* Keep the length of name string if longest so far */ + stringLength = strlen(activeNames[i]); + if (stringLength > maxName) + maxName = stringLength; + + /* Retrieve the volume capacity and allocation */ + volumeInfos[i] = vshMalloc(ctl, sizeof(virStorageVolInfo)); + if (virStorageVolGetInfo(vol, volumeInfos[i]) != 0) { + /* Something went wrong retrieving volume info, cope with it */ + volumeInfos[i] = NULL; + } - vshPrint(ctl, "%-20s %-40s\n", - virStorageVolGetName(vol), - path); - VIR_FREE(path); + /* Cleanup memory allocation */ virStorageVolFree(vol); - VIR_FREE(activeNames[i]); } + + /* Display the volume information */ + vshDebug(ctl, 5, "Longest name string = %d chars\n", maxName); + vshDebug(ctl, 5, "Longest path string = %d chars\n", maxPath); + if (details) { + virBuffer formatStr = VIR_BUFFER_INITIALIZER; + + /* Is the output too long to fit on one line? */ + if ((maxName + maxPath + 30) < 80) { + virBuffer headerStr = VIR_BUFFER_INITIALIZER; + + /* Output is not too long - use one line per entry */ + virBufferVSprintf(&formatStr, + "%%-%us %%-6s %%-10s %%-10s %%-%us\n", + maxName < 5 ? 5 : maxName, + maxPath); + virBufferVSprintf(&headerStr, + virBufferContentAndReset(&formatStr), + _("Name"), _("Type"), _("Capacity"), + _("Allocation"), _("Path")); + unsigned int headerLength = strlen(headerStr.d); + vshPrintExtra(ctl, "%s", virBufferContentAndReset(&headerStr)); + + /* Display an underline of appropriate length */ + for (i = 0; i < headerLength - 1; i++) + vshPrintExtra(ctl, "-"); + vshPrintExtra(ctl, "\n"); + + /* Define output format - one line per row of volume info */ + virBufferVSprintf(&formatStr, + "%%-%us %%-6s %%-10s %%-10s %%-%us\n", + maxName < 5 ? 5 : maxName, + maxPath); + } else { + /* Output IS too long - use two lines per entry */ + virBufferVSprintf(&formatStr, + "%%-%us %%-6s %%-10s %%-10s\n %%-%us\n", + maxName < 5 ? 5 : maxName, + maxPath); + vshPrintExtra(ctl, virBufferContentAndReset(&formatStr), + _("Name"), _("Type"), _("Capacity"), + _("Allocation"), _("Path")); + + /* Display an underline of appropriate length */ + if ((maxName + 30) > (maxPath + 6)) { + /* 30 = # chars in the header not including the name field + * 6 = Padding number picked out of the air that seems + * to work ok + */ + for (i = 0; i < maxName + 30; i++) + vshPrintExtra(ctl, "-"); + } else { + for (i = 0; i < maxPath + 6; i++) + vshPrintExtra(ctl, "-"); + } + vshPrintExtra(ctl, "\n"); + + /* Define output format - two lines per row of volume info */ + virBufferVSprintf(&formatStr, + "%%-%us %%-6s %%-10s %%-10s\n %%-%us\n", + maxName < 5 ? 5 : maxName, + maxPath); + } + + /* Display the volume detail rows */ + for (i = 0; i < numVolumes; i++) { + /* Do we have detailed sizing info? */ + if (volumeInfos[i] != NULL) { + /* We have detailed sizing info */ + double capVal, allocVal; + const char *capUnit, *allocUnit; + virBuffer capBufStr = VIR_BUFFER_INITIALIZER; + virBuffer allocBufStr = VIR_BUFFER_INITIALIZER; + + /* Determine the capacity value to show */ + capVal = prettyCapacity(volumeInfos[i]->capacity, &capUnit); + virBufferVSprintf(&capBufStr, "%.2lf %s", capVal, capUnit); + + /* Determine the allocation value to show */ + allocVal = prettyCapacity(volumeInfos[i]->allocation, + &allocUnit); + virBufferVSprintf(&allocBufStr, "%.2lf %s", allocVal, + allocUnit); + + /* Output volume details, showing all volume info */ + vshPrintExtra(ctl, formatStr.d, + activeNames[i], + volumeInfos[i]->type == VIR_STORAGE_VOL_FILE ? + _("file") : _("block"), + virBufferContentAndReset(&capBufStr), + virBufferContentAndReset(&allocBufStr), + volumePaths[i]); + + /* Cleanup memory allocation */ + VIR_FREE(volumeInfos[i]); + } else { + /* We don't have detailed sizing info, so output + * what we have */ + vshPrintExtra(ctl, formatStr.d, + activeNames[i], + _("unknown"), + _("unknown"), + _("unknown"), + volumePaths[i]); + } + + /* Cleanup memory allocation for this volume */ + VIR_FREE(volumePaths[i]); + VIR_FREE(activeNames[i]); + } + } else { + /* Only basic volume information needs to be shown */ + if (maxName < 20) /* Minimum column widths in the output */ + maxName = 20; + if (maxPath < 4) /* Minimum column widths in the output */ + maxPath = 4; + virBuffer outputStr = VIR_BUFFER_INITIALIZER; + virBufferVSprintf(&outputStr, "%%-%us %%-%us\n", maxName, maxPath); + + /* Output header */ + vshPrintExtra(ctl, outputStr.d, _("Name"), _("Path")); + + /* Display underline */ + for (i = 0; i < maxName + maxPath + 1; i++) + vshPrintExtra(ctl, "-"); + vshPrintExtra(ctl, "\n"); + + /* Output the volume information rows */ + for (i = 0; i < numVolumes; i++) { + vshPrint(ctl, outputStr.d, activeNames[i], volumePaths[i]); + } + + /* Cleanup memory allocation */ + virBufferFreeAndReset(&outputStr); + } + + /* Cleanup remaining memory allocation */ + VIR_FREE(volumePaths); + VIR_FREE(volumeInfos); VIR_FREE(activeNames); virStoragePoolFree(pool); return TRUE; diff --git a/tools/virsh.pod b/tools/virsh.pod index 8432b44..0f387e6 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -839,10 +839,12 @@ Returns basic information about the given storage volume. I<--pool> I<pool-or-uuid> is the name or UUID of the storage pool the volume is in. I<vol-name-or-key-or-path> is the name or key or path of the volume to return information for. -=item B<vol-list> I<--pool> I<pool-or-uuid> +=item B<vol-list> I<--pool> I<pool-or-uuid> optional I<--details> Return the list of volumes in the given storage pool. I<--pool> I<pool-or-uuid> is the name or UUID of the storage pool. +The I<--details> option instructs virsh to additionally display volume +persistence and capacity related information where available. =item B<vol-pool> I<vol-key-or-path> -- 1.7.0.1

2 3

[libvirt] [PATCH v2] qemu: Fix crash on failed VM startup
by Cole Robinson 19 Jun '10

19 Jun '10

If VM startup fails early enough (can't find a referenced USB device), libvirtd will crash trying to clear the VNC port bit, since port = 0, which overflows us out of the bitmap bounds. Fix this by being more defensive in the bitmap operations, and only clearing a previously set VNC port. v2: Add safety check to all relevant bitmap ops. Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/qemu/qemu_driver.c | 2 +- src/util/bitmap.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index c8cd50a..f5a1310 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -3741,7 +3741,7 @@ retry: if ((vm->def->ngraphics == 1) && vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC && vm->def->graphics[0]->data.vnc.autoport && - vm->def->graphics[0]->data.vnc.port != -1) { + vm->def->graphics[0]->data.vnc.port >= QEMU_VNC_PORT_MIN) { if (virBitmapClearBit(driver->reservedVNCPorts, vm->def->graphics[0]->data.vnc.port - \ QEMU_VNC_PORT_MIN) < 0) { diff --git a/src/util/bitmap.c b/src/util/bitmap.c index 69094a5..cef3fc4 100644 --- a/src/util/bitmap.c +++ b/src/util/bitmap.c @@ -100,7 +100,7 @@ void virBitmapFree(virBitmapPtr bitmap) */ int virBitmapSetBit(virBitmapPtr bitmap, size_t b) { - if (b > bitmap->size - 1) + if (bitmap->size <= b) return -1; bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] |= (1 << VIR_BITMAP_BIT_OFFSET(b)); @@ -118,7 +118,7 @@ int virBitmapSetBit(virBitmapPtr bitmap, size_t b) */ int virBitmapClearBit(virBitmapPtr bitmap, size_t b) { - if (b > bitmap->size - 1) + if (bitmap->size <= b) return -1; bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &= ~(1 << VIR_BITMAP_BIT_OFFSET(b)); @@ -140,7 +140,7 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result) { uint32_t bit; - if (b > bitmap->size - 1) + if (bitmap->size <= b) return -1; bit = bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] & -- 1.6.6.1

3 3

[libvirt] [PATCH] Fix description of virStorageVolGetInfo()
by Philipp Hahn 18 Jun '10

18 Jun '10

Probably a copy-paste-bug in python/libvirt-override-api.xml: virStorageVolGetInfo() extracts information about a "storage volume", not the "storage pool" as virStoragePoolGetInfo() does. Signed-off-by: Philipp Hahn <hahn(a)univention.de> --- python/libvirt-override-api.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

3 2

[libvirt] [PATCHv2 0/2] virsh: add new --details option flag to pool-list and vol-list
by Justin Clift 18 Jun '10

18 Jun '10

Hi all, The following two patches add a new "--details" option flag to the virsh pool-list and vol-list commands. Adding these because trying to get sizing information for large numbers of pools or volumes is presently difficult, having to run the pool-info or vol-info command on each one individually. This shows the required info much more easily. :) + The first patch is for the pool-list command, and was pretty straightforward. + The second patch is for the vol-list command, and has been rewritten from the first submission. If the --details option is not specified, then the output is exactly as it has been historically, with only name and path info and the same fixed column widths. If the --details option is given now, additional info is shown and all column widths are sized to their widest string. Additionally the code in the 2nd version of the second patch is cleaner structured than the first version. Decent examples of the output from each command are in their email comments. Open for suggestions and better ideas of course. :) Regards and best wishes, Justin Clift -- Salasaga - Open Source eLearning IDE http://www.salasaga.org

1 0

[libvirt] 1. Domain Destroy , 2. Domain boot on a different host and 3. Domain start time
by IKI-サガル　バルウェ 18 Jun '10

18 Jun '10

Hello, Firstly, I have some confusion about the libvirt API "virDomainDestroy" method. here is the link to API: http://libvirt.org/html/libvirt-libvirt.html#virDomainDestroy Does this method completely removes the domain from the system? I have confusion because the "virsh destroy" tool option performs a forced shutdown and does not destroy/delete/remove the domain. So, what does "virDomainDestroy" method do exactly? Also, if it comletely removes the domain, then is there any other method to perform a force shutdown of the domain. I know the "virDomainShutdown" method performs a normal shutdown. Secondly, Is it possible to boot a domain on a completely different physical host with the same Hypervisor configuration? For. E.g: if I have a domain on a host 192.168.101.1 running Xen with a Domain "test" in shutdown state. If I have to start/boot the domain "test" on a different physical host, running Xen say 192.168.101.2, is it possible using libvirt API? If not, then is there any other method to do it? Thirdly, Is there a method to get the total running time of a domain? I mean, the amount of time since the domain had been booted. Currently, I can fetch the CPU time. But, is this the exact amount of time the domain is ON? i.e. If the domain is in a "IDLE" state, the CPU time does not increase. But what I want is the amount of time the domain was ON(including the idle time). So, If I can get the start time of the domain, I can calculate the duration. Sorry for the long mail and description. Any help would be greatly appreciated. Thanks and Regards Sagar Barve

2 4

[libvirt] [PATCH] virsh: add --uuid option to vol-pool
by Justin Clift 18 Jun '10

18 Jun '10

Adds an optional switch, --uuid, for telling the virsh vol-pool command to return the pool UUID rather than pool name. --- Just added for flexibility. tools/virsh.c | 13 +++++++++++-- tools/virsh.pod | 8 +++++--- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 7d8ae0e..7e65942 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -6049,6 +6049,7 @@ static const vshCmdInfo info_vol_pool[] = { }; static const vshCmdOptDef opts_vol_pool[] = { + {"uuid", VSH_OT_BOOL, 0, N_("return the pool uuid rather than pool name")}, {"vol", VSH_OT_DATA, VSH_OFLAG_REQ, N_("volume key or path")}, {NULL, 0, 0, NULL} }; @@ -6058,6 +6059,7 @@ cmdVolPool(vshControl *ctl, const vshCmd *cmd) { virStoragePoolPtr pool; virStorageVolPtr vol; + char uuid[VIR_UUID_STRING_BUFLEN]; /* Check the connection to libvirtd daemon is still working */ if (!vshConnectionUsability(ctl, ctl->conn, TRUE)) @@ -6077,8 +6079,15 @@ cmdVolPool(vshControl *ctl, const vshCmd *cmd) return FALSE; } - /* Return the name of the parent storage pool */ - vshPrint(ctl, "%s\n", virStoragePoolGetName(pool)); + /* Return the requested details of the parent storage pool */ + if (vshCommandOptBool(cmd, "uuid")) { + /* Retrieve and return pool UUID string */ + if (virStoragePoolGetUUIDString(pool, &uuid[0]) == 0) + vshPrint(ctl, "%s\n", uuid); + } else { + /* Return the storage pool name */ + vshPrint(ctl, "%s\n", virStoragePoolGetName(pool)); + } /* Cleanup */ virStorageVolFree(vol); diff --git a/tools/virsh.pod b/tools/virsh.pod index e83ea4d..8ef0e96 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -839,10 +839,12 @@ I<vol-name-or-key-or-path> is the name or key or path of the volume to return in Return the list of volumes in the given storage pool. I<--pool> I<pool-or-uuid> is the name or UUID of the storage pool. -=item B<vol-pool> I<vol-key-or-path> +=item B<vol-pool> [optional I<--uuid>] I<vol-key-or-path> -Return the pool for a given volume. -I<vol-key-or-path> is the key or path of the volume to return the pool name for. +Return the pool name or UUID for a given volume. By default, the pool name is +returned. If the I<--uuid> option is given, the pool UUID is returned instead. +I<vol-key-or-path> is the key or path of the volume to return the pool +information for. =item B<vol-path> [optional I<--pool> I<pool-or-uuid>] I<vol-name-or-key> -- 1.7.0.1

3 2

[libvirt] [PATCH v2] nwfilter: add XML attribute to control match target
by Stefan Berger 18 Jun '10

18 Jun '10

This patch adds an optional XML attribute to a nwfilter rule to give the user control over whether the rule is supposed to be using the state match or not. A rule may now look like shown in the XML below with the statematch attribute either having value '0' or 'false' (case-insensitive). [...] <rule action='accept' direction='in' statematch='false'> <tcp srcmacaddr='1:2:3:4:5:6' srcipaddr='10.1.2.3' srcipmask='32' dscp='33' srcportstart='20' srcportend='21' dstportstart='100' dstportend='1111'/> </rule> [...] I am also extending the nwfilter schema and add this attribute to a test case. V2: - Following D. Berrange's suggestion I inverted the logic from 'nomatch' XML attribute to statematch attribute Signed-off-by: Stefan Berger --- docs/schemas/nwfilter.rng | 10 ++++++++++ src/conf/nwfilter_conf.c | 10 ++++++++++ src/conf/nwfilter_conf.h | 5 +++++ src/nwfilter/nwfilter_ebiptables_driver.c | 3 +++ tests/nwfilterxml2xmlin/tcp-test.xml | 4 ++-- tests/nwfilterxml2xmlout/tcp-test.xml | 4 ++-- 6 files changed, 32 insertions(+), 4 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1498,6 +1498,9 @@ iptablesCreateRuleInstance(virNWFilterDe needState = 0; } + if ((rule->flags & RULE_FLAG_NO_STATEMATCH)) + needState = 0; + chainPrefix[0] = 'F'; maySkipICMP = directionIn || inout; Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -1580,6 +1580,7 @@ virNWFilterRuleParse(xmlNodePtr node) char *action; char *direction; char *prio; + char *statematch; int found; int found_i = 0; unsigned int priority; @@ -1595,6 +1596,7 @@ virNWFilterRuleParse(xmlNodePtr node) action = virXMLPropString(node, "action"); direction = virXMLPropString(node, "direction"); prio = virXMLPropString(node, "priority"); + statematch= virXMLPropString(node, "statematch"); if (!action) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, @@ -1633,6 +1635,10 @@ virNWFilterRuleParse(xmlNodePtr node) } } + if (statematch && + (STREQ(statematch, "0") || STRCASEEQ(statematch, "false"))) + ret->flags |= RULE_FLAG_NO_STATEMATCH; + cur = node->children; found = 0; @@ -1677,6 +1683,7 @@ cleanup: VIR_FREE(prio); VIR_FREE(action); VIR_FREE(direction); + VIR_FREE(statematch); return ret; @@ -2532,6 +2539,9 @@ virNWFilterRuleDefFormat(virNWFilterRule virNWFilterRuleDirectionTypeToString(def->tt), def->priority); + if ((def->flags & RULE_FLAG_NO_STATEMATCH)) + virBufferAddLit(&buf, " statematch='false'"); + i = 0; while (virAttr[i].id) { if (virAttr[i].prtclType == def->prtclType) { Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -345,11 +345,16 @@ enum virNWFilterEbtablesTableType { # define MAX_RULE_PRIORITY 1000 +enum virNWFilterRuleFlags { + RULE_FLAG_NO_STATEMATCH = (1 << 0), +}; + typedef struct _virNWFilterRuleDef virNWFilterRuleDef; typedef virNWFilterRuleDef *virNWFilterRuleDefPtr; struct _virNWFilterRuleDef { unsigned int priority; + enum virNWFilterRuleFlags flags; int action; /*enum virNWFilterRuleActionType*/ int tt; /*enum virNWFilterRuleDirectionType*/ enum virNWFilterRuleProtocolType prtclType; Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -299,6 +299,11 @@ <ref name='priority-type'/> </attribute> </optional> + <optional> + <attribute name="statematch"> + <ref name='statematch-type'/> + </attribute> + </optional> </define> <define name="match-attribute"> @@ -816,4 +821,9 @@ <param name="maxInclusive">1000</param> </data> </define> + <define name='statematch-type'> + <data type="string"> + <param name="pattern">([Ff][Aa][Ll][Ss][Ee]|0)</param> + </data> + </define> </grammar> Index: libvirt-acl/tests/nwfilterxml2xmlin/tcp-test.xml =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmlin/tcp-test.xml +++ libvirt-acl/tests/nwfilterxml2xmlin/tcp-test.xml @@ -5,14 +5,14 @@ dstipaddr='10.1.2.3' dstipmask='255.255.255.255' dscp='2'/> </rule> - <rule action='accept' direction='in'> + <rule action='accept' direction='in' statematch='false'> <tcp srcmacaddr='1:2:3:4:5:6' srcipaddr='10.1.2.3' srcipmask='32' dscp='33' srcportstart='20' srcportend='21' dstportstart='100' dstportend='1111'/> </rule> - <rule action='accept' direction='in'> + <rule action='accept' direction='in' statematch='0'> <tcp srcmacaddr='1:2:3:4:5:6' srcipaddr='10.1.2.3' srcipmask='32' dscp='63' Index: libvirt-acl/tests/nwfilterxml2xmlout/tcp-test.xml =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmlout/tcp-test.xml +++ libvirt-acl/tests/nwfilterxml2xmlout/tcp-test.xml @@ -3,10 +3,10 @@ <rule action='accept' direction='out' priority='500'> <tcp srcmacaddr='01:02:03:04:05:06' dstipaddr='10.1.2.3' dstipmask='32' dscp='2'/> </rule> - <rule action='accept' direction='in' priority='500'> + <rule action='accept' direction='in' priority='500' statematch='false'> <tcp srcmacaddr='01:02:03:04:05:06' srcipaddr='10.1.2.3' srcipmask='32' dscp='33' srcportstart='20' srcportend='21' dstportstart='100' dstportend='1111'/> </rule> - <rule action='accept' direction='in' priority='500'> + <rule action='accept' direction='in' priority='500' statematch='false'> <tcp srcmacaddr='01:02:03:04:05:06' srcipaddr='10.1.2.3' srcipmask='32' dscp='63' srcportstart='255' srcportend='256' dstportstart='65535'/> </rule> </filter>

3 4

[libvirt] [PATCH] virsh: ensure persistence and autostart are shown for dominfo and pool-info
by Justin Clift 18 Jun '10

18 Jun '10

This patch adds the persistence status (yes/no) to the output of the virsh dominfo and pool-info commands. This patch also adds the autostart status to the output of the virsh pool-info command. Red Hat BZ for this: https://bugzilla.redhat.com/show_bug.cgi?id=603696 --- tools/virsh.c | 28 ++++++++++++++++++++++++++++ 1 files changed, 28 insertions(+), 0 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 56e1bd7..90fd59e 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -1903,6 +1903,7 @@ cmdDominfo(vshControl *ctl, const vshCmd *cmd) virDomainPtr dom; virSecurityModel secmodel; virSecurityLabel seclabel; + int persistent = 0; int ret = TRUE, autostart; unsigned int id; char *str, uuid[VIR_UUID_STRING_BUFLEN]; @@ -1956,6 +1957,15 @@ cmdDominfo(vshControl *ctl, const vshCmd *cmd) ret = FALSE; } + /* Check and display whether the domain is persistent or not */ + persistent = virDomainIsPersistent(dom); + vshDebug(ctl, 5, "Domain persistent flag value: %d\n", persistent); + if (persistent < 0) + vshPrint(ctl, "%-15s %s\n", _("Persistent:"), _("unknown")); + else + vshPrint(ctl, "%-15s %s\n", _("Persistent:"), persistent ? _("yes") : _("no")); + + /* Check and display whether the domain autostarts or not */ if (!virDomainGetAutostart(dom, &autostart)) { vshPrint(ctl, "%-15s %s\n", _("Autostart:"), autostart ? _("enable") : _("disable") ); @@ -5134,6 +5144,8 @@ cmdPoolInfo(vshControl *ctl, const vshCmd *cmd) { virStoragePoolInfo info; virStoragePoolPtr pool; + int autostart = 0; + int persistent = 0; int ret = TRUE; char uuid[VIR_UUID_STRING_BUFLEN]; @@ -5174,6 +5186,22 @@ cmdPoolInfo(vshControl *ctl, const vshCmd *cmd) break; } + /* Check and display whether the pool is persistent or not */ + persistent = virStoragePoolIsPersistent(pool); + vshDebug(ctl, 5, "Pool persistent flag value: %d\n", persistent); + if (persistent < 0) + vshPrint(ctl, "%-15s %s\n", _("Persistent:"), _("unknown")); + else + vshPrint(ctl, "%-15s %s\n", _("Persistent:"), persistent ? _("yes") : _("no")); + + /* Check and display whether the pool is autostarted or not */ + virStoragePoolGetAutostart(pool, &autostart); + vshDebug(ctl, 5, "Pool autostart flag value: %d\n", autostart); + if (autostart < 0) + vshPrint(ctl, "%-15s %s\n", _("Autostart:"), _("no autostart")); + else + vshPrint(ctl, "%-15s %s\n", _("Autostart:"), autostart ? _("yes") : _("no")); + if (info.state == VIR_STORAGE_POOL_RUNNING || info.state == VIR_STORAGE_POOL_DEGRADED) { val = prettyCapacity(info.capacity, &unit); -- 1.7.0.1

3 8