- Devel - libvirt List Archives

[libvirt] [PATCH] Fix ./configure: line 27875: [: missing `]'
by Matthias Bolte 31 Mar '10

31 Mar '10

Commit 7998714d60b997357bfea15d6f2d0f729fc8fb29 replaced '-a' with '&& test' but this single '-a' needs to stay. --- configure.ac | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 3c3d7b3..fc87e19 100644 --- a/configure.ac +++ b/configure.ac @@ -240,7 +240,7 @@ AC_ARG_WITH([libvirtd], dnl dnl specific tests to setup DV devel environments with debug etc ... dnl -if [[ "${LOGNAME}" = "veillard" && test "`pwd`" = "/u/veillard/libvirt" ]] ; then +if [[ "${LOGNAME}" = "veillard" -a "`pwd`" = "/u/veillard/libvirt" ]] ; then STATIC_BINARIES="-static" else STATIC_BINARIES= -- 1.6.3.3

2 4

[libvirt] [PATCH] nwfilter: Support for learning a VM's IP address
by Stefan Berger 31 Mar '10

31 Mar '10

Subject: Support for learning a VM's IP address This patch implements support for learning a VM's IP address. It uses the pcap library to listen on the VM's backend network interface (tap) or the physical ethernet device (macvtap) and tries to capture packets with source or destination MAC address of the VM and learn from DHCP Offers, ARP traffic, or first-sent IPv4 packet what the IP address of the VM's interface is. This then allows to instantiate the network traffic filtering rules without the user having to provide the IP parameter somewhere in the filter description or in the interface description as a parameter. This only supports to detect the parameter IP, which is for the assumed single IPv4 address of a VM. There is not support for interfaces that may have multiple IP addresses (IP aliasing) or IPv6 that may then require more than one valid IP address to be detected. A VM can have multiple independent interfaces that each uses a different IP address and in that case it will be attempted to detect each one of the address independently. So, when for example an interface description in the domain XML has looked like this up to now: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'> <parameter name='IP' value='10.2.3.4'/> </filterref> </interface> you may omit the IP parameter: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> Internally I am walking the 'tree' of a VM's referenced network filters and determine with the given variables which variables are missing. Now, the above IP parameter may be missing and this causes a libvirt-internal thread to be started that uses the pcap library's API to listen to the backend interface (in case of macvtap to the physical interface) in an attempt to determine the missing IP parameter. If the backend interface disappears the thread terminates assuming the VM was brought down. In case of a macvtap device a timeout is being used to wait for packets from the given VM (filtering by VM's interface MAC address). If the VM's macvtap device disappeared the thread also terminates. In all other cases it tries to determine the IP address of the VM and will then apply the rules late on the given interface, which would have happened immediately if the IP parameter had been explicitly given. In case an error happens while the firewall rules are applied, the VM's backend interface is 'down'ed preventing it to communicate. Reasons for failure for applying the network firewall rules may that an ebtables/iptables command failes or OOM errors. Essentially the same failure reasons may occur as when the firewall rules are applied immediately on VM start, except that due to the late application of the filtering rules the VM now is already running and cannot be hindered anymore from starting. Bringing down the whole VM would probably be considered too drastic. While a VM's IP address is attempted to be determined only limited updates to network filters are allowed. In particular it is prevented that filters are modified in such a way that they would introduce new variables. A caveat: The algorithm does not know which one is the appropriate IP address of a VM. If the VM spoofs an IP address in its first ARP traffic or IPv4 packets its filtering rules will be instantiated for this IP address, thus 'locking' it to the found IP address. So, it's still 'safer' to explicitly provide the IP address of a VM's interface in the filter description if it is known beforehand. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- configure.ac | 39 ++ src/Makefile.am | 13 src/conf/nwfilter_conf.c | 7 src/conf/nwfilter_conf.h | 3 src/libvirt_private.syms | 12 src/nwfilter/nwfilter_driver.c | 11 src/nwfilter/nwfilter_ebiptables_driver.c | 100 +++++ src/nwfilter/nwfilter_ebiptables_driver.h | 7 src/nwfilter/nwfilter_gentech_driver.c | 408 +++++++++++++++++++-- src/nwfilter/nwfilter_gentech_driver.h | 14 src/nwfilter/nwfilter_learnipaddr.c | 579 ++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_learnipaddr.h | 61 +++ 12 files changed, 1216 insertions(+), 38 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -0,0 +1,61 @@ +/* + * nwfilter_learnipaddr.h: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#ifndef __NWFILTER_LEARNIPADDR_H +#define __NWFILTER_LEARNIPADDR_H + +typedef struct _virNWFilterIPAddrLearnReq virNWFilterIPAddrLearnReq; +typedef virNWFilterIPAddrLearnReq *virNWFilterIPAddrLearnReqPtr; +struct _virNWFilterIPAddrLearnReq { + char ifname[IF_NAMESIZE]; + char linkdev[IF_NAMESIZE]; + enum virDomainNetType nettype; + unsigned char macaddr[VIR_MAC_BUFLEN]; + char *filtername; + virNWFilterHashTablePtr filterparams; + virNWFilterDriverStatePtr driver; + + int status; + pthread_t thread; +}; + +int virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); + +virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(const char *ifname); + + +void virNWFilterDelIpAddrForIfname(const char *ifname); +const char *virNWFilterGetIpAddrForIfname(const char *ifname); + +int virNWFilterLearnInit(void); +void virNWFilterLearnShutdown(void); + +#endif /* __NWFILTER_LEARNIPADDR_H */ Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -0,0 +1,579 @@ +/* + * nwfilter_learnipaddr.c: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#include <config.h> + +#ifdef HAVE_LIBPCAP +#include <pcap.h> +#endif + +#include <fcntl.h> +#include <sys/ioctl.h> + +#include <arpa/inet.h> +#include <net/ethernet.h> +#include <netinet/ip.h> +#include <netinet/udp.h> +#include <net/if_arp.h> +#include <linux/if.h> + +#include "internal.h" + +#include "buf.h" +#include "memory.h" +#include "logging.h" +#include "datatypes.h" +#include "virterror_internal.h" +#include "threads.h" +#include "conf/nwfilter_params.h" +#include "conf/domain_conf.h" +#include "nwfilter_gentech_driver.h" +#include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + + +/* structure of an ARP request/reply message */ +struct f_arphdr { + struct arphdr arphdr; + uint8_t ar_sha[ETH_ALEN]; + uint32_t ar_sip; + uint8_t ar_tha[ETH_ALEN]; + uint32_t ar_tip; +} __attribute__((packed)); + + +/* structure representing DHCP message */ +struct dhcp { + uint8_t op; + uint8_t htype; + uint8_t hlen; + uint8_t hops; + uint32_t xid; + uint16_t secs; + uint16_t flags; + uint32_t ciaddr; + uint32_t yiaddr; + uint32_t siaddr; + uint32_t giaddr; + uint32_t chaddr; + /* omitted */ +} __attribute__((packed)); + + +struct ether_vlan_header +{ + uint8_t dhost[ETH_ALEN]; + uint8_t shost[ETH_ALEN]; + uint16_t vlan_type; + uint16_t vlan_flags; + uint16_t ether_type; +} __attribute__((packed)); + + +static virMutex pendingLearnReqLock; +static virHashTablePtr pendingLearnReq; + +static virMutex ipAddressMapLock; +static virNWFilterHashTablePtr ipAddressMap; + + +static void +virNWFilterIPAddrLearnReqFree(virNWFilterIPAddrLearnReqPtr req) { + if (!req) + return; + + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->filterparams); + + VIR_FREE(req); +} + + +#if HAVE_LIBPCAP + +static int +virNWFilterRegisterLearnReq(virNWFilterIPAddrLearnReqPtr req) { + int res = -1; + virMutexLock(&pendingLearnReqLock); + + if (!virHashLookup(pendingLearnReq, req->ifname)) + res = virHashAddEntry(pendingLearnReq, req->ifname, req); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + +#endif + + +virNWFilterIPAddrLearnReqPtr +virNWFilterLookupLearnReq(const char *ifname) { + void *res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + +static void +freeLearnReqEntry(void *payload, const char *name ATTRIBUTE_UNUSED) { + virNWFilterIPAddrLearnReqFree(payload); +} + + +#ifdef HAVE_LIBPCAP + +static virNWFilterIPAddrLearnReqPtr +virNWFilterDeregisterLearnReq(const char *ifname) { + virNWFilterIPAddrLearnReqPtr res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + if (res) + virHashRemoveEntry(pendingLearnReq, ifname, NULL); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + + +static int +virNWFilterAddIpAddrForIfname(const char *ifname, char *addr) { + int ret; + + virMutexLock(&ipAddressMapLock); + + ret = virNWFilterHashTablePut(ipAddressMap, ifname, addr, 1); + + virMutexUnlock(&ipAddressMapLock); + + return ret; +} +#endif + + +void +virNWFilterDelIpAddrForIfname(const char *ifname) { + + virMutexLock(&ipAddressMapLock); + + if (virHashLookup(ipAddressMap->hashTable, ifname)) + virNWFilterHashTableRemoveEntry(ipAddressMap, ifname); + + virMutexUnlock(&ipAddressMapLock); +} + + +const char * +virNWFilterGetIpAddrForIfname(const char *ifname) { + const char *res; + + virMutexLock(&ipAddressMapLock); + + res = virHashLookup(ipAddressMap->hashTable, ifname); + + virMutexUnlock(&ipAddressMapLock); + + return res; +} + + +#ifdef HAVE_LIBPCAP + +/** + * learnIPAddressThread + * arg: pointer to virNWFilterIPAddrLearnReq structure + * + * Learn the IP address being used on an interface. Use ARP Request and + * Reply messages, DHCP offers and the first IP packet being sent from + * the VM to detect the IP address it is using. Detects only one IP address + * per interface (IP aliasing not supported) + */ +static void * +learnIPAddressThread(void *arg) +{ + char errbuf[PCAP_ERRBUF_SIZE] = {0}; + pcap_t *handle; + struct bpf_program fp; + struct pcap_pkthdr header; + const u_char *packet; + struct ether_header *ether_hdr; + struct ether_vlan_header *vlan_hdr; + virNWFilterIPAddrLearnReqPtr req = arg; + uint32_t vmaddr = 0; + unsigned int ethHdrSize; + char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev + : req->ifname; + int to_ms = (strlen(req->linkdev) != 0) ? 1000 + : 0; + char macaddr[VIR_MAC_STRING_BUFLEN]; + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *filter= NULL; + uint16_t etherType; + + req->status = 0; + + handle = pcap_open_live(listen_if, BUFSIZ, 0, to_ms, errbuf); + + if (handle == NULL) { + VIR_DEBUG("Couldn't open device %s: %s\n", listen_if, errbuf); + req->status = ENODEV; + goto done; + } + + virFormatMacAddr(req->macaddr, macaddr); + virBufferVSprintf(&buf, "ether host %s", macaddr); + if (virBufferError(&buf)) { + req->status = ENOMEM; + goto done; + } + + filter = virBufferContentAndReset(&buf); + + if (pcap_compile(handle, &fp, filter, 1, 0) != 0 || + pcap_setfilter(handle, &fp) != 0) { + VIR_DEBUG("Couldn't compile or set filter '%s'.\n", filter); + req->status = EINVAL; + goto done; + } + + while (req->status == 0 && vmaddr == 0) { + packet = pcap_next(handle, &header); + + if (!packet) { + if (to_ms == 0) { + /* assuming IF disappeared */ + req->status = ENODEV; + break; + } + /* listening on linkdev, check whether VM's dev is still there */ + if (checkIf(req->ifname, req->macaddr)) { + req->status = ENODEV; + break; + } + continue; + } + + if (header.len >= sizeof(struct ether_header)) { + ether_hdr = (struct ether_header*)packet; + + switch (ntohs(ether_hdr->ether_type)) { + + case ETHERTYPE_IP: + ethHdrSize = sizeof(struct ether_header); + etherType = ntohs(ether_hdr->ether_type); + break; + + case ETHERTYPE_VLAN: + ethHdrSize = sizeof(struct ether_vlan_header); + vlan_hdr = (struct ether_vlan_header *)packet; + if (ntohs(vlan_hdr->ether_type) != ETHERTYPE_IP || + header.len < ethHdrSize) + continue; + etherType = ntohs(vlan_hdr->ether_type); + break; + + default: + continue; + } + + if (memcmp(ether_hdr->ether_shost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets from the VM + + if ((header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + vmaddr = iphdr->saddr; + // skip eth. bcast and mcast addresses, + // and zero address in DHCP Requests + if ((ntohl(vmaddr) & 0xc0000000) || vmaddr == 0) { + vmaddr = 0; + continue; + } + + } else if (etherType == ETHERTYPE_ARP && + (header.len >= ethHdrSize + + sizeof(struct f_arphdr))) { + struct f_arphdr *arphdr = (struct f_arphdr*)(packet + + ethHdrSize); + switch (ntohs(arphdr->arphdr.ar_op)) { + case ARPOP_REPLY: + vmaddr = arphdr->ar_sip; + break; + case ARPOP_REQUEST: + vmaddr = arphdr->ar_tip; + break; + } + } + } else if (memcmp(ether_hdr->ether_dhost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets to the VM + if (etherType == ETHERTYPE_IP && + (header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + if ((iphdr->protocol == IPPROTO_UDP) && + (header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr))) { + struct udphdr *udphdr= (struct udphdr *) + ((char *)iphdr + iphdr->ihl * 4); + if (ntohs(udphdr->source) == 67 && + ntohs(udphdr->dest) == 68 && + header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr) + + sizeof(struct dhcp)) { + struct dhcp *dhcp = (struct dhcp *) + ((char *)udphdr + sizeof(udphdr)); + if (dhcp->op == 2 /* DHCP OFFER */) { + vmaddr = dhcp->yiaddr; + } + } + } + } + } + } + } + + done: + VIR_FREE(filter); + + if (handle) + pcap_close(handle); + + ebtablesRemoveBasicRules(NULL, req->ifname); + + if (req->status == 0) { + int ret; + char inetaddr[INET_ADDRSTRLEN]; + inet_ntop(AF_INET, &vmaddr, inetaddr, sizeof(inetaddr)); + + virNWFilterAddIpAddrForIfname(req->ifname, strdup(inetaddr)); + + ret = virNWFilterInstantiateFilterLate(NULL, + req->ifname, + req->linkdev, + req->nettype, + req->macaddr, + req->filtername, + req->filterparams, + req->driver); + VIR_DEBUG("Result from applying firewall rules on " + "%s with IP addr %s : %d\n", req->ifname, inetaddr, ret); + } + + memset(&req->thread, 0x0, sizeof(req->thread)); + + VIR_DEBUG("pcap thread terminating for interface %s\n",req->ifname); + + virNWFilterDeregisterLearnReq(req->ifname); + + virNWFilterIPAddrLearnReqFree(req); + + return 0; +} + + +/** + * virNWFilterLearnIPAddress + * @conn: pointer to virConnect object + * @ifname: the name of the interface + * @linkdev : the name of the link device; currently only used in case of a + * macvtap device + * @nettype : the type of interface + * @macaddr : the MAC address of the interface + * @filtername : the name of the top-level filter to apply to the interface + * once its IP address has been detected + * @driver : the network filter driver + * + * Instruct to learn the IP address being used on a given interface (ifname). + * Unless there already is a thread attempting to learn the IP address + * being used on the interface, a thread is started that will listen on + * the traffic being sent on the interface (or link device) with the + * MAC address that is provided. Will then launch the application of the + * firewall rules on the interface. + */ +int +virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) { + int rc; + virNWFilterIPAddrLearnReqPtr req = NULL; + virNWFilterHashTablePtr ht = NULL; + + if (VIR_ALLOC(req) < 0) { + virReportOOMError(); + goto err_exit; + } + + ht = virNWFilterHashTableCreate(0); + if (ht == NULL) { + virReportOOMError(); + goto err_exit; + } + + if (virNWFilterHashTablePutAll(conn, filterparams, ht)) + goto err_exit; + + req->filtername = strdup(filtername); + if (req->filtername == NULL) { + virReportOOMError(); + goto err_exit; + } + + if (virStrcpyStatic(req->ifname, ifname) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for ifname ('%s') " + "not large enough"), ifname); + goto err_exit; + } + + if (linkdev) { + if (virStrcpyStatic(req->linkdev, linkdev) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for linkdev ('%s') " + "not large enough"), linkdev); + goto err_exit; + } + } + req->nettype = nettype; + memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); + req->driver = driver; + req->filterparams = ht; + ht = NULL; + + rc = virNWFilterRegisterLearnReq(req); + + if (rc) + goto err_exit; + + if (ebtablesApplyBasicRules(conn, + ifname, + macaddr)) { + goto err_exit; + } + + if (pthread_create(&req->thread, + NULL, + learnIPAddressThread, + req) != 0) + goto err_exit; + + return 0; + +err_exit: + ebtablesRemoveBasicRules(conn, ifname); + virNWFilterIPAddrLearnReqFree(req); + virNWFilterHashTableFree(ht); + return 1; +} + +#else + +int +virNWFilterLearnIPAddress(virConnectPtr conn ATTRIBUTE_UNUSED, + const char *ifname ATTRIBUTE_UNUSED, + const char *linkdev ATTRIBUTE_UNUSED, + enum virDomainNetType nettype ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED, + const char *filtername ATTRIBUTE_UNUSED, + virNWFilterHashTablePtr filterparams ATTRIBUTE_UNUSED, + virNWFilterDriverStatePtr driver ATTRIBUTE_UNUSED) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("IP parameter must be given since libvirt " + "was not compiled with IP address learning " + "support")); + return 1; +} +#endif /* HAVE_LIBPCAP */ + + +/** + * virNWFilterLearnInit + * Initialization of this layer + */ +int +virNWFilterLearnInit(void) { + pendingLearnReq = virHashCreate(0); + if (!pendingLearnReq) { + virReportOOMError(); + return 1; + } + + if (virMutexInit(&pendingLearnReqLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + ipAddressMap = virNWFilterHashTableCreate(0); + if (!ipAddressMap) { + virReportOOMError(); + virNWFilterLearnShutdown(); + return 1; + } + + if (virMutexInit(&ipAddressMapLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + return 0; +} + + +/** + * virNWFilterLearnShutdown + * Shutdown of this layer + */ +void +virNWFilterLearnShutdown(void) { + virHashFree(pendingLearnReq, freeLearnReqEntry); + pendingLearnReq = NULL; + + virNWFilterHashTableFree(ipAddressMap); + ipAddressMap = NULL; +} Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -289,7 +289,8 @@ STORAGE_HELPER_DISK_SOURCES = \ NWFILTER_DRIVER_SOURCES = \ nwfilter/nwfilter_driver.h nwfilter/nwfilter_driver.c \ nwfilter/nwfilter_gentech_driver.c \ - nwfilter/nwfilter_ebiptables_driver.c + nwfilter/nwfilter_ebiptables_driver.c \ + nwfilter/nwfilter_learnipaddr.c # Security framework and drivers for various models SECURITY_DRIVER_SOURCES = \ @@ -740,10 +741,11 @@ else libvirt_la_LIBADD += libvirt_driver_nwfilter.la noinst_LTLIBRARIES += libvirt_driver_nwfilter.la endif -libvirt_driver_nwfilter_la_CFLAGS = \ +libvirt_driver_nwfilter_la_CFLAGS = $(LIBPCAP_CFLAGS) \ -I@top_srcdir@/src/conf +libvirt_driver_nwfilter_la_LDFLAGS = $(LIBPCAP_LIBS) if WITH_DRIVER_MODULES -libvirt_driver_nwfilter_la_LDFLAGS = -module -avoid-version ../gnulib/lib/libgnu.la +libvirt_driver_nwfilter_la_LDFLAGS += -module -avoid-version ../gnulib/lib/libgnu.la endif libvirt_driver_nwfilter_la_SOURCES = $(NWFILTER_DRIVER_SOURCES) endif @@ -887,6 +889,7 @@ libvirt_la_LDFLAGS = $(VERSION_SCRIPT_FL -version-info $(LIBVIRT_VERSION_INFO) \ $(COVERAGE_CFLAGS:-f%=-Wc,-f%) \ $(LIBXML_LIBS) \ + $(LIBPCAP_LIBS) \ $(DRIVER_MODULE_LIBS) \ $(CYGWIN_EXTRA_LDFLAGS) $(MINGW_EXTRA_LDFLAGS) libvirt_la_CFLAGS = $(COVERAGE_CFLAGS) -DIN_LIBVIRT @@ -935,8 +938,8 @@ libvirt_lxc_SOURCES = \ $(NODE_INFO_SOURCES) \ $(ENCRYPTION_CONF_SOURCES) \ $(DOMAIN_CONF_SOURCES) \ - $(NWFILTER_PARAM_CONF_SOURCES) \ - $(CPU_CONF_SOURCES) + $(CPU_CONF_SOURCES) \ + $(NWFILTER_PARAM_CONF_SOURCES) libvirt_lxc_LDFLAGS = $(WARN_CFLAGS) $(COVERAGE_LDCFLAGS) $(CAPNG_LIBS) $(YAJL_LIBS) libvirt_lxc_LDADD = $(LIBXML_LIBS) $(NUMACTL_LIBS) ../gnulib/lib/libgnu.la libvirt_lxc_CFLAGS = \ Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -24,6 +24,9 @@ #include <config.h> #include <stdint.h> +#include <sys/socket.h> +#include <sys/ioctl.h> +#include <linux/if.h> #include "internal.h" @@ -34,12 +37,16 @@ #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER #define NWFILTER_STD_VAR_MAC "MAC" +#define NWFILTER_STD_VAR_IP "IP" + +static int _virNWFilterTeardownFilter(const char *ifname); static virNWFilterTechDriverPtr filter_tech_drivers[] = { @@ -111,6 +118,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI * @tables: pointer to hash tabel to add values to * @macaddr: The string of the MAC address to add to the hash table, * may be NULL + * @ipaddr: The string of the IP address to add to the hash table; + * may be NULL * * Returns 0 in case of success, 1 in case an error happened with * error having been reported. @@ -120,7 +129,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI static int virNWFilterVarHashmapAddStdValues(virConnectPtr conn, virNWFilterHashTablePtr table, - char *macaddr) + char *macaddr, + char *ipaddr) { if (macaddr) { if (virHashAddEntry(table->hashTable, @@ -132,6 +142,16 @@ virNWFilterVarHashmapAddStdValues(virCon } } + if (ipaddr) { + if (virHashAddEntry(table->hashTable, + NWFILTER_STD_VAR_IP, + ipaddr) < 0) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + "%s", _("Could not add variable 'IP' to hashmap")); + return 1; + } + } + return 0; } @@ -140,23 +160,26 @@ virNWFilterVarHashmapAddStdValues(virCon * virNWFilterCreateVarHashmap: * @conn: pointer to virConnect object * @macaddr: pointer to string containing formatted MAC address of interface + * @ipaddr: pointer to string containing formatted IP address used by + * VM on this interface; may be NULL * * Create a hashmap used for evaluating the firewall rules. Initializes - * it with the standard variable 'MAC'. + * it with the standard variable 'MAC' and 'IP' if provided. * * Returns pointer to hashmap, NULL if an error occcurred and error message * is attached to the virConnect object. */ virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr) { + char *macaddr, + char *ipaddr) { virNWFilterHashTablePtr table = virNWFilterHashTableCreate(0); if (!table) { virReportOOMError(); return NULL; } - if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr)) { + if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr, ipaddr)) { virNWFilterHashTableFree(table); return NULL; } @@ -284,9 +307,9 @@ _virNWFilterInstantiateRec(virConnectPtr virNWFilterHashTablePtr vars, int *nEntries, virNWFilterRuleInstPtr **insts, - enum instCase useNewFilter, int *foundNewFilter) + enum instCase useNewFilter, int *foundNewFilter, + virNWFilterDriverStatePtr driver) { - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterPoolObjPtr obj; int rc = 0; int i; @@ -365,7 +388,96 @@ _virNWFilterInstantiateRec(virConnectPtr tmpvars, nEntries, insts, useNewFilter, - foundNewFilter); + foundNewFilter, + driver); + + virNWFilterHashTableFree(tmpvars); + + virNWFilterPoolObjUnlock(obj); + if (rc) + break; + } else { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("referenced filter '%s' is missing"), + inc->filterref); + rc = 1; + break; + } + } + } + return rc; +} + + +static int +virNWFilterDetermineMissingVarsRec(virConnectPtr conn, + virNWFilterDefPtr filter, + virNWFilterHashTablePtr vars, + virNWFilterHashTablePtr missing_vars, + int useNewFilter, + virNWFilterDriverStatePtr driver) +{ + virNWFilterPoolObjPtr obj; + int rc = 0; + int i, j; + virNWFilterDefPtr next_filter; + + for (i = 0; i < filter->nentries; i++) { + virNWFilterRuleDefPtr rule = filter->filterEntries[i]->rule; + virNWFilterIncludeDefPtr inc = filter->filterEntries[i]->include; + if (rule) { + // check all variables of this rule + for (j = 0; j < rule->nvars; j++) { + if (!virHashLookup(vars->hashTable, rule->vars[j])) { + virNWFilterHashTablePut(missing_vars, rule->vars[j], + strdup("1"), 1); + } + } + } else if (inc) { + VIR_DEBUG("Following filter %s\n", inc->filterref); + obj = virNWFilterPoolObjFindByName(&driver->pools, + inc->filterref); + if (obj) { + + if (obj->wantRemoved) { + virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + _("Filter '%s' is in use."), + inc->filterref); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + // create a temporary hashmap for depth-first tree traversal + virNWFilterHashTablePtr tmpvars = + virNWFilterCreateVarsFrom(conn, + inc->params, + vars); + if (!tmpvars) { + virReportOOMError(); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + next_filter = obj->def; + + switch (useNewFilter) { + case INSTANTIATE_FOLLOW_NEWFILTER: + if (obj->newDef) { + next_filter = obj->newDef; + } + break; + case INSTANTIATE_ALWAYS: + break; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + next_filter, + tmpvars, + missing_vars, + useNewFilter, + driver); virNWFilterHashTableFree(tmpvars); @@ -438,9 +550,12 @@ virNWFilterInstantiate(virConnectPtr con enum virDomainNetType nettype, virNWFilterDefPtr filter, const char *ifname, + const char *linkdev, virNWFilterHashTablePtr vars, enum instCase useNewFilter, int *foundNewFilter, - bool teardownOld) + bool teardownOld, + const unsigned char *macaddr, + virNWFilterDriverStatePtr driver) { int rc; int j, nptrs; @@ -449,6 +564,44 @@ virNWFilterInstantiate(virConnectPtr con void **ptrs = NULL; int instantiate = 1; + virNWFilterLockFilterUpdates(); + + virNWFilterHashTablePtr missing_vars = virNWFilterHashTableCreate(0); + if (!missing_vars) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + filter, + vars, + missing_vars, + useNewFilter, + driver); + if (rc) + goto err_exit; + + if (virHashSize(missing_vars->hashTable) == 1) { + if (virHashLookup(missing_vars->hashTable, + NWFILTER_STD_VAR_IP) != NULL) { + if (virNWFilterLookupLearnReq(ifname) == NULL) { + rc = virNWFilterLearnIPAddress(conn, + ifname, + linkdev, + nettype, macaddr, + filter->name, + vars, driver); + } + goto err_exit; + } + rc = 1; + goto err_exit; + } else if (virHashSize(missing_vars->hashTable) > 1) { + rc = 1; + goto err_exit; + } + rc = _virNWFilterInstantiateRec(conn, techdriver, nettype, @@ -456,7 +609,8 @@ virNWFilterInstantiate(virConnectPtr con ifname, vars, &nEntries, &insts, - useNewFilter, foundNewFilter); + useNewFilter, foundNewFilter, + driver); if (rc) goto err_exit; @@ -487,24 +641,33 @@ virNWFilterInstantiate(virConnectPtr con err_exit: + virNWFilterUnlockFilterUpdates(); + for (j = 0; j < nEntries; j++) virNWFilterRuleInstFree(insts[j]); VIR_FREE(insts); + virNWFilterHashTableFree(missing_vars); + return rc; } static int -_virNWFilterInstantiateFilter(virConnectPtr conn, - const virDomainNetDefPtr net, - bool teardownOld, - enum instCase useNewFilter) +__virNWFilterInstantiateFilter(virConnectPtr conn, + bool teardownOld, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + enum instCase useNewFilter, + virNWFilterDriverStatePtr driver) { int rc; const char *drvname = EBIPTABLES_DRIVER_ID; - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterTechDriverPtr techdriver; virNWFilterPoolObjPtr obj; virNWFilterHashTablePtr vars, vars1; @@ -512,6 +675,8 @@ _virNWFilterInstantiateFilter(virConnect char vmmacaddr[VIR_MAC_STRING_BUFLEN] = {0}; int foundNewFilter = 0; char *str_macaddr = NULL; + const char *ipaddr; + char *str_ipaddr = NULL; techdriver = virNWFilterTechDriverForName(drvname); @@ -523,25 +688,25 @@ _virNWFilterInstantiateFilter(virConnect return 1; } - VIR_DEBUG("filter name: %s\n", net->filter); + VIR_DEBUG("filter name: %s\n", filtername); - obj = virNWFilterPoolObjFindByName(&driver->pools, net->filter); + obj = virNWFilterPoolObjFindByName(&driver->pools, filtername); if (!obj) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Could not find filter '%s'"), - net->filter); + filtername); return 1; } if (obj->wantRemoved) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Filter '%s' is in use."), - net->filter); + filtername); rc = 1; goto err_exit; } - virFormatMacAddr(net->mac, vmmacaddr); + virFormatMacAddr(macaddr, vmmacaddr); str_macaddr = strdup(vmmacaddr); if (!str_macaddr) { virReportOOMError(); @@ -549,18 +714,29 @@ _virNWFilterInstantiateFilter(virConnect goto err_exit; } + ipaddr = virNWFilterGetIpAddrForIfname(ifname); + if (ipaddr) { + str_ipaddr = strdup(ipaddr); + if (!str_ipaddr) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + } + vars1 = virNWFilterCreateVarHashmap(conn, - str_macaddr); + str_macaddr, str_ipaddr); if (!vars1) { rc = 1; goto err_exit; } str_macaddr = NULL; + str_ipaddr = NULL; vars = virNWFilterCreateVarsFrom(conn, vars1, - net->filterparams); + filterparams); if (!vars) { rc = 1; goto err_exit_vars1; @@ -582,12 +758,15 @@ _virNWFilterInstantiateFilter(virConnect rc = virNWFilterInstantiate(conn, techdriver, - net->type, + nettype, filter, - net->ifname, + ifname, + linkdev, vars, useNewFilter, &foundNewFilter, - teardownOld); + teardownOld, + macaddr, + driver); virNWFilterHashTableFree(vars); @@ -595,15 +774,180 @@ err_exit_vars1: virNWFilterHashTableFree(vars1); err_exit: - virNWFilterPoolObjUnlock(obj); + VIR_FREE(str_ipaddr); VIR_FREE(str_macaddr); return rc; } +static int +_virNWFilterInstantiateFilter(virConnectPtr conn, + const virDomainNetDefPtr net, + bool teardownOld, + enum instCase useNewFilter) +{ + const char *linkdev = (net->type == VIR_DOMAIN_NET_TYPE_DIRECT) + ? net->data.direct.linkdev + : NULL; + return __virNWFilterInstantiateFilter(conn, + teardownOld, + net->ifname, + linkdev, + net->type, + net->mac, + net->filter, + net->filterparams, + useNewFilter, + conn->nwfilterPrivateData); +} + + +// FIXME: move chgIfFlags, ifUp, checkIf into common file & share w/ macvtap.c + +/* + * chgIfFlags: Change flags on an interface + * @ifname : name of the interface + * @flagclear : the flags to clear + * @flagset : the flags to set + * + * The new flags of the interface will be calculated as + * flagmask = (~0 ^ flagclear) + * newflags = (curflags & flagmask) | flagset; + * + * Returns 0 on success, errno on failure. + */ +static int chgIfFlags(const char *ifname, short flagclear, short flagset) { + struct ifreq ifr; + int rc = 0; + int flags; + short flagmask = (~0 ^ flagclear); + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + flags = (ifr.ifr_flags & flagmask) | flagset; + + if (ifr.ifr_flags != flags) { + ifr.ifr_flags = flags; + + if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) + rc = errno; + } + +err_exit: + close(fd); + return rc; +} + +/* + * ifUp + * @name: name of the interface + * @up: 1 for up, 0 for down + * + * Function to control if an interface is activated (up, 1) or not (down, 0) + * + * Returns 0 in case of success or an errno code in case of failure. + */ +static int +ifUp(const char *name, int up) +{ + return chgIfFlags(name, + (up) ? 0 : IFF_UP, + (up) ? IFF_UP : 0); +} + + +/** + * checkIf + * + * @ifname: Name of the interface + * @macaddr: expected MAC address of the interface + * + * FIXME: the interface's index is another good parameter to check + * + * Determine whether a given interface is still available. If so, + * it must have the given MAC address. + * + * Returns an error code ENODEV in case the interface does not exist + * anymore or its MAC address is different, 0 otherwise. + */ +int +checkIf(const char *ifname, const unsigned char *macaddr) +{ + struct ifreq ifr; + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + int rc = 0; + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + if (memcmp(&ifr.ifr_hwaddr.sa_data, macaddr, 6) != 0) + rc = ENODEV; + + err_exit: + close(fd); + return rc; +} + + +int +virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) +{ + int rc; + rc = __virNWFilterInstantiateFilter(conn, + 1, + ifname, + linkdev, + nettype, + macaddr, + filtername, + filterparams, + INSTANTIATE_ALWAYS, + driver); + if (rc) { + //something went wrong... 'DOWN' the interface + if (ifUp(ifname ,0)) { + // assuming interface disappeared... + _virNWFilterTeardownFilter(ifname); + } + } + return rc; +} + + int virNWFilterInstantiateFilter(virConnectPtr conn, const virDomainNetDefPtr net) @@ -660,8 +1004,8 @@ virNWFilterTearOldFilter(virConnectPtr c } -int -virNWFilterTeardownFilter(const virDomainNetDefPtr net) +static int +_virNWFilterTeardownFilter(const char *ifname) { const char *drvname = EBIPTABLES_DRIVER_ID; virNWFilterTechDriverPtr techdriver; @@ -676,13 +1020,21 @@ virNWFilterTeardownFilter(const virDomai #endif return 1; } + techdriver->allTeardown(ifname); - techdriver->allTeardown(net->ifname); + virNWFilterDelIpAddrForIfname(ifname); return 0; } +int +virNWFilterTeardownFilter(const virDomainNetDefPtr net) +{ + return _virNWFilterTeardownFilter(net->ifname); +} + + void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -37,6 +37,8 @@ #include "nwfilter_gentech_driver.h" +#include "nwfilter_learnipaddr.h" + #define VIR_FROM_THIS VIR_FROM_NWFILTER #define nwfilterLog(msg...) fprintf(stderr, msg) @@ -65,9 +67,12 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; - if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + if (virNWFilterLearnInit() < 0) return -1; + if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + goto conf_init_err; + if (VIR_ALLOC(driverState) < 0) goto alloc_err_exit; @@ -120,6 +125,9 @@ error: alloc_err_exit: virNWFilterConfLayerShutdown(); +conf_init_err: + virNWFilterLearnShutdown(); + return -1; } @@ -413,5 +421,6 @@ static virStateDriver stateDriver = { int nwfilterRegister(void) { virRegisterNWFilterDriver(&nwfilterDriver); virRegisterStateDriver(&stateDriver); + virNWFilterLearnInit(); return 0; } Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -46,13 +46,25 @@ int virNWFilterRollbackUpdateFilter(virC int virNWFilterTearOldFilter(virConnectPtr conn, const virDomainNetDefPtr net); +int virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); + int virNWFilterTeardownFilter(const virDomainNetDefPtr net); virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr); + char *macaddr, + char *ipaddr); void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, void *data); +int checkIf(const char *ifname, const unsigned char *macaddr); + #endif Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -488,6 +488,8 @@ virNWFilterRegisterCallbackDriver; virNWFilterTestUnassignDef; virNWFilterConfLayerInit; virNWFilterConfLayerShutdown; +virNWFilterLockFilterUpdates; +virNWFilterUnlockFilterUpdates; #nwfilter_params.h @@ -503,6 +505,16 @@ virNWFilterInstantiateFilter; virNWFilterTeardownFilter; +#nwfilter_learnipaddr.h +ipAddressMap; +ipAddressMapLock; +pendingLearnReq; +pendingLearnReqLock; +virNWFilterGetIpAddrForIfname; +virNWFilterDelIpAddrForIfname; +virNWFilterLookupLearnReq; + + # pci.h pciGetDevice; pciFreeDevice; Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -111,17 +111,18 @@ struct int_map { */ static virMutex updateMutex; -static void +void virNWFilterLockFilterUpdates(void) { virMutexLock(&updateMutex); } -static void +void virNWFilterUnlockFilterUpdates(void) { virMutexUnlock(&updateMutex); } + /* * attribute names for the rules XML */ @@ -2731,7 +2732,7 @@ int virNWFilterConfLayerInit(virHashIter { virNWFilterDomainFWUpdateCB = domUpdateCB; - if (virMutexInit(&updateMutex)) + if (virMutexInitRecursive(&updateMutex)) return 1; if (virNWFilterParamConfLayerInit()) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -565,6 +565,9 @@ virNWFilterDefPtr virNWFilterDefParseFil void virNWFilterPoolObjLock(virNWFilterPoolObjPtr obj); void virNWFilterPoolObjUnlock(virNWFilterPoolObjPtr obj); +void virNWFilterLockFilterUpdates(void); +void virNWFilterUnlockFilterUpdates(void); + int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -2533,6 +2533,106 @@ ebiptablesInstCommand(virConnectPtr conn } +int +ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + char chain[MAX_CHAINNAME_LENGTH]; + char chainPrefix = CHAINPREFIX_HOST_IN_TEMP; + char macaddr_str[VIR_MAC_STRING_BUFLEN]; + + virFormatMacAddr(macaddr, macaddr_str); + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebiptablesExecCLI(conn, &buf, &cli_status); + + ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + + PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p IPv4 -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p ARP -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + + if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + goto tear_down_tmpebchains; + + return 0; + +tear_down_tmpebchains: + ebtablesRemoveBasicRules(conn, ifname); + + virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + "%s", + _("Some rules could not be created.")); + + return 1; +} + + +int +ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + + ebiptablesExecCLI(conn, &buf, &cli_status); + return 0; +} + + static int ebiptablesRuleOrderSort(const void *a, const void *b) { Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h @@ -45,4 +45,11 @@ extern virNWFilterTechDriver ebiptables_ # define EBIPTABLES_DRIVER_ID "ebiptables" + +int ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr); +int ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname); + #endif Index: libvirt-acl/configure.ac =================================================================== --- libvirt-acl.orig/configure.ac +++ libvirt-acl/configure.ac @@ -41,6 +41,7 @@ XMLRPC_REQUIRED=1.14.0 HAL_REQUIRED=0.5.0 DEVMAPPER_REQUIRED=1.0.0 LIBCURL_REQUIRED="7.18.0" +LIBPCAP_REQUIRED="1.0.0" dnl Checks for C compiler. AC_PROG_CC @@ -1045,6 +1046,39 @@ AC_SUBST([NUMACTL_CFLAGS]) AC_SUBST([NUMACTL_LIBS]) +dnl pcap lib +LIBPCAP_CONFIG="pcap-config" +LIBPCAP_CFLAGS="" +LIBPCAP_LIBS="" +LIBPCAP_FOUND="no" + +AC_ARG_WITH([libpcap], AC_HELP_STRING([--with-libpcap=@<:@PFX@:>@], [libpcap location])) +if test "$with_qemu" = "yes"; then + if test "x$with_libpcap" != "xno" ; then + if test "x$with_libpcap" != "x" ; then + LIBPCAP_CONFIG=$with_libpcap/bin/$LIBPCAP_CONFIG + fi + AC_MSG_CHECKING(libpcap $LIBPCAP_CONFIG >= $LIBPCAP_REQUIRED ) + if ! $LIBPCAP_CONFIG --libs > /dev/null 2>&1 ; then + AC_MSG_RESULT(no) + else + LIBPCAP_LIBS="`$LIBPCAP_CONFIG --libs`" + LIBPCAP_CFLAGS="`$LIBPCAP_CONFIG --cflags`" + LIBPCAP_FOUND="yes" + AC_MSG_RESULT(yes) + fi + fi +fi + +if test "x$LIBPCAP_FOUND" = "xyes"; then + AC_DEFINE_UNQUOTED([HAVE_LIBPCAP], 1, [whether libpcap can be used]) +fi + +AC_SUBST([LIBPCAP_CFLAGS]) +AC_SUBST([LIBPCAP_LIBS]) + + + dnl dnl Checks for the UML driver dnl @@ -2129,6 +2163,11 @@ AC_MSG_NOTICE([ xmlrpc: $XMLRPC_CFLAGS else AC_MSG_NOTICE([ xmlrpc: no]) fi +if test "$with_qemu" = "yes" ; then +AC_MSG_NOTICE([ pcap: $LIBPCAP_CFLAGS $LIBPCAP_LIBS]) +else +AC_MSG_NOTICE([ pcap: no]) +fi AC_MSG_NOTICE([]) AC_MSG_NOTICE([Test suite]) AC_MSG_NOTICE([])

3 4

[libvirt] [RFC]: Snapshot API v3
by Chris Lalancette 31 Mar '10

31 Mar '10

Hello, After our discussions about the snapshot API last week, I went ahead and implemented quite a bit of the API. I also went back to the ESX, Virtualbox, and QEMU API's to try and make sure our API's matched up. What's below is my revised API based on that survey. Following my revised API are notes that I took regarding how the libvirt API matches up to the various API's, and some questions about semantics that I had while doing the survey. More comments and questions are welcome. /* NOTE: struct _virDomainSnapshot is a private structure, ala * struct _virDomain. */ typedef struct _virDomainSnapshot virDomainSnapshot; /* Take a snapshot of the current VM state. Throws an error if * the VM is not currently running */ virDomainSnapshotPtr virDomainSnapshotCreateXML(virDomainPtr domain, const char *xmlDesc, unsigned int flags); /* Dump the XML of a snapshot */ /* NOTE: see below for proposed XML */ char *virDomainSnapshotGetXMLDesc(virDomainSnapshotPtr snapshot, unsigned int flags); /* Return the number of snapshots for this domain */ int virDomainSnapshotNum(virDomainPtr domain, unsigned int flags); /* Get the names of all snapshots for this domain */ int virDomainListSnapshotNames(virDomainPtr domain, char **names, int nameslen, unsigned int flags); /* Get a handle to a named snapshot */ virDomainSnapshotPtr virDomainSnapshotLookupByName(virDomainPtr domain, const char *name, unsigned int flags); /* Get a handle to the current in-use snapshot for the domain */ virDomainSnapshotPtr virDomainSnapshotCurrent(virDomainPtr domain, unsigned int flags); /* Start the guest from the snapshot "snapshot" */ int virDomainCreateFromSnapshot(virDomainSnapshotPtr snapshot, unsigned int flags); /* Rename the snapshot */ /* Do we really need this? In theory we could use * virsh snapshot-edit <domain> <name> and then detect * name changes, but that will require a UUID, which may * or may not be overkill */ int virDomainSnapshotRename(virDomainSnapshotPtr snapshot, char *newname, unsigned int flags); /* Delete a snapshot - with no flags, the snapshot is not used anymore, * but also not removed. With a MERGE flag, it merges the snapshot into * the parent snapshot (or the base image, if there is no parent snapshot). * Note that if other snapshots would be discarded because of this * MERGE action, this operation will fail. If that is really what is intended, * use MERGE_FORCE. * * With a DISCARD flag, it deletes the snapshot. Note that if children snapshots * would be discarded because of this delete action, this operation will * fail. If this is really what is intended, use DISCARD_FORCE. * * MERGE, MERGE_FORCE, DISCARD, and DISCARD_FORCE are mutually-exclusive. * * Note that this operation can happen when the domain is running or shut * down, though this is hypervisor specific */ typedef enum { VIR_DOMAIN_SNAPSHOT_DELETE_MERGE, VIR_DOMAIN_SNAPSHOT_DELETE_MERGE_FORCE, VIR_DOMAIN_SNAPSHOT_DELETE_DISCARD, VIR_DOMAIN_SNAPSHOT_DELETE_DISCARD_FORCE, } virDomainSnapshotDelete; int virDomainSnapshotDelete(virDomainSnapshotPtr snapshot, unsigned int flags); int virDomainSnapshotFree(virDomainSnapshotPtr snapshot); NOTE: During snapshot creation, *none* of the fields are required. That is, you can call virDomainSnapshotCreateXML() with an XML of "<domainsnapshot/>". In this case, the individual driver will make up a <name> and <uuid> for you, the <creationdate> will be set to the current time+date, <description> will be empty, <state> will be the current state of the VM, and <parent> will be set to the current snapshot (if any). If you do want to specify some fields during virDomainSnapshotCreateXML(), note that the only ones that are settable are <name>, <uuid>, and <description>; the rest are ignored, and filled in by the driver when the snapshot is actually created. NOTE: <state> refers to the state of the VM when the snapshot was taken. <domainsnapshot> <name>XYZ</name> <creationdate>...</creationdate> <description>...</description> <state>RUNNING</state> <domain> <uuid>XXXXX-XXXX-XXXX-XXXX-XXXXXXXXX</uuid> </domain> <parent> <name>ABC</name> </parent> </domainsnapshot> The virsh commands will be: virsh snapshot-create <dom> <xmlfile> virsh snapshot-list <dom> virsh snapshot-dumpxml <dom> <name> virsh start-with-snapshot <dom> <snapshotname> virsh snapshot-delete <dom> <snapshotname> [--merge|--mergeforce|--delete|--deleteforce] virsh snapshot-delete-all <dom> Possible issues: 1) I don't see a way to support "managed" save/restore and snapshotting with this API. I think we'll have to have a separate API for managed save/restore. 2) What is the semantic for deleting snapshots from a running domain? Virtualbox seems to not allow you to manipulate snapshots while the domain is running. Qemu does allow this, but it's currently unclear what the exact semantics are. VMware seems to allow manipulation of snapshots while the domain is running. 3) Do we need a snapshot UUID? Virtualbox allows you to have multiple snapshots with the same name, differentiated by UUID. Confusingly, they also have a "FindByName" method that returns the first depth-first search snapshot that matches a given name. For qemu, if you specify the same name twice it overwrites the previous one with the new one. I don't know what ESX does here. Mapping of our interface to various hypervisors: +-------------------------------+-----------------+-------------------+------------------------------+ | Libvirt | Qemu | Virtualbox | ESX | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotCreateXML | monitor command | takeSnapshot | CreateSnapshot_task | | | "savevm"; if | Snapshots can | takes a name, description, | | | snapshot name | be taken on | memory (true/false) and | | | is already in | powered off, | quiesce (true/false). | | | use, replaces | saved, running, | What does "memory" mean? | | | the previous | or paused VMs. | Should we model "quiesce" | | | snapshot. Also | The snapshot is | Trees of snapshots are | | | qemu-img | always taken | supported. What happens | | | snapshot -c can | against the | on a duplicate name? What | | | be used to | current snapshot. | state(s) can a VM be in | | | create a | What happens on | when calling this? Does | | | disk-only | a duplicate | a VM get paused when this | | | snapshot. What | name? Trees of | is called? | | | happens if the | snapshots are | | | | VM is running | not currently | | | | when you do | supported. | | | | this? Trees of | Taking a snapshot | | | | snapshots seem | of a running VM | | | | to be supported | pauses the VM | | | | VM gets paused | before taking the | | | | while this is | snapshot. | | | | happening. What | | | | | states can the | | | | | VM be in? | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotGetXMLDesc | Libvirt qemu | GetId | VirtualMachine object-> | | | snapshot | GetDescription | snapshot-> rootSnapshotList | | | metadata | GetTimeStamp | [i].createTime | | | | GetParent | .description | | | | GetCurrentSnapshot| .name | | | | | .id | | | | | .state | | | | | .quiesced | | | | | .vm | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotNum | Libvirt qemu | GetSnapshotCount | VirtualMachine object-> | | | snapshot | | snapshot-> rootSnapshotList | | | metadata | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainListSnapshotNames | Libvirt qemu | GetSnapshotCount | VirtualMachine object-> | | | snapshot | GetChildren | snapshot-> rootSnapshotList | | | metadata, or | | | | | listvm monitor | | | | | command or | | | | | qemu-img | | | | | snapshot -l | | | | | <file>. If the | | | | | VM has multiple | | | | | disks and the | | | | | disks have | | | | | different | | | | | snapshots, what | | | | | do you do? | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotLookupByName | " | findSnapshot | VirtualMachine object-> | | | | Takes a name and | snapshot-> rootSnapshotList | | | | returns a | | | | | snapshot object. | | | | | In case of | | | | | multiple snapshots| | | | | with the same | | | | | name, it returns | | | | | the first object | | | | | from a depth | | | | | first search. | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainCreateFromSnapshot | qemu-img | restoreSnapshot | RevertToSnapshot_Task | | | snapshot -a | Takes a snapshot | Changes execution state | | | <snapname> | object, and | of VM to state of this | | | <file>. What | resets the VM's | snapshot. Takes a | | | happens if the | state to that of | snapshot object, an | | | VM has multiple | the snapshot. | optional host, and | | | files with | If this is a | suppressPowerOn, which | | | different | snapshot taken | forces the VM to the off | | | snapshots? | against a running | state regardless of the | | | | machine, then the | state when the snapshot | | | | memory is | was taken. Implies that | | | | restored as well. | without this flag, VM | | | | Does *not* start | starts in whatever | | | | the VM. The VM | <state> was when snapshot | | | | must be off for | was taken. | | | | this operation to | | | | | succeed. | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotDelete | monitor command | deleteSnapshot | RemoveSnapshot_Task | | | "delvm". What | deletes the | removes this snapshot and | | | happens if the | specified | deletes any associated | | | snapshot is in | snapshot. Takes | storage. Operates on a | | | use? What | an ID. The VM | VirtualMachineSnapshot | | | states can the | must be off. | object. What states can | | | VM be in? Also | Differences to | the VM be in? What | | | qemu-img | children | happens if this snapshot | | | snapshot -d | snapshots will be | is in-use? What happens | | | <name> <file> | merged with the | to parents and children? | | | command can be | children to keep | | | | used. What | children valid. | | | | happens if the | Parent for this | | | | disk is in-use? | snapshot will | | | | What happens to | become parent of | | | | parents and | any children | | | | children? | snapshots. | | | | How do we | | | | | handle merges? | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotCurrent | Libvirt qemu | currentSnapshot | VirtualMachine object-> | | | snapshot | | snapshot-> currentSnapshot | | | metadata | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotRename | Libvirt qemu | ISnapshot->name | RenameSnapshot | | | snapshot | | | | | metadata | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotDelete with | Libvirt qemu | deleteSnapshot | RemoveAllSnapshots_Task | | DISCARD_FORCE flag against | snapshot | with manual depth | | | root snapshot | metadata | deletion of | | | | | children | | +-------------------------------+-----------------+-------------------+------------------------------+ | | | | RevertToCurrentSnapshot_Task | +-------------------------------+-----------------+-------------------+------------------------------+ Attribute mapping: +----------------+----------+-------------+----------------------------+ | Libvirt | Qemu | Virtualbox | ESX | +----------------+----------+-------------+----------------------------+ | <name> | TAG | name | name | +----------------+----------+-------------+----------------------------+ | <creationdate> | DATE | timeStamp | createTime | +----------------+----------+-------------+----------------------------+ | <description> | Libvirt | description | description | | | qemu | | | | | metadata | | | +----------------+----------+-------------+----------------------------+ | <state> | Libvirt | online | state (this is the *power* | | | qemu | | state of the VM when this | | | metadata | | snapshot was taken) | +----------------+----------+-------------+----------------------------+ | <domain><uuid> | Libvirt | machine | vm | | | qemu | | | | | metadata | | | +----------------+----------+-------------+----------------------------+ | <parent><name> | Libvirt | parent | N/A | | | qemu | | | | | metadata | | | +----------------+----------+-------------+----------------------------+ | N/A | N/A | id (uuid) | id | +----------------+----------+-------------+----------------------------+ | N/A | N/A | children | childSnapshotList | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | memory | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | quiesced | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | backupManifest | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | replaySupported | +----------------+----------+-------------+----------------------------+ -- Chris Lalancette

6 13

[libvirt] [RFC] Managed save APIs
by Daniel Veillard 31 Mar '10

31 Mar '10

The current API provides the following Save abd Restore functions: int virDomainSave (virDomainPtr domain, const char *to); int virDomainRestore (virConnectPtr conn, const char *from); where the user provide the path to the file used to hold the domain saved state. However it can be really useful to have a managed version where libvirt itself stores the data. It can then automatically reuse it once the domain is to be restarted. This also avoid the problem of keeping stale saved data once a domain has been restarted independantly. One of our use case was to save the running domains state on shutdown, and unfortunately virDomainSave()/virDomainRestore() can't be used for that because if one of the domain is labelled as autorestart, as soon as the daemon would restart it would recreate the guest but without knowledge of the backup state. So we propose the 3 following new APIs to deal with managed saves: int virDomainManagedSave(virDomainPtr dom, unsigned int flags); int virDomainHasManagedSaveImage(virDomainPtr dom, unsigned int flags); int virDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags); virDomainManagedSave() is to be run on a running domain. Once the call complete, as in virDomainSave() the domain is stopped upon completion, but there is no restore counterpart as any order to start the domain from the API would load the state from the managed file, similary if the domain is autostarted when libvirtd starts. Once a domain has restarted his managed save image is destroyed, basically managed save image can only exist for a stopped domain, for a running domain that would be by definition outdated data. Suggested new entry points in libvirt.c are below, thanks in advance for any feedback (and thanks to Chris Lalancette who started this work): diff --git a/src/libvirt.c b/src/libvirt.c index cc5b4c5..293ea17 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -12135,3 +12135,143 @@ error: virDispatchError(conn); return -1; } + +/** + * virDomainManagedSave: + * @dom: pointer to the domain + * @flags: optional flags currently unused + * + * This method will suspend a domain and save its memory contents to + * a file on disk. After the call, if successful, the domain is not + * listed as running anymore. + * The difference from virDomainSave() is that libvirt is keeping track of + * the saved state itself, and will reuse it once the domain is being + * restarted (automatically or via an explicit libvirt call). + * As a result any running domain is sure to not have a managed saved image. + * + * Returns 0 in case of success or -1 in case of failure + */ +int virDomainManagedSave(virDomainPtr dom, unsigned int flags) +{ + virConnectPtr conn; + + VIR_DEBUG("dom=%p, flags=%u", dom, flags); + + virResetLastError(); + + if (!VIR_IS_CONNECTED_DOMAIN(dom)) { + virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + conn = dom->conn; + if (conn->flags & VIR_CONNECT_RO) { + virLibDomainError(dom, VIR_ERR_OPERATION_DENIED, __FUNCTION__); + goto error; + } + + if (conn->driver->domainManagedSave) { + int ret; + + ret = conn->driver->domainManagedSave(dom, flags); + if (ret < 0) + goto error; + return ret; + } + + virLibConnError(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + +error: + virDispatchError(conn); + return -1; +} + +/** + * virDomainHasManagedSaveImage: + * @dom: pointer to the domain + * @flags: optional flags currently unused + * + * Check if a domain has a managed save image as created by + * virDomainManagedSave(). Note that any running domain should not have + * such an image, as it should have been removed on restart. + * + * Returns 0 if no image is present, 1 if an image is present, and + * -1 in case of error + */ +int virDomainHasManagedSaveImage(virDomainPtr dom, unsigned int flags) +{ + virConnectPtr conn; + + VIR_DEBUG("dom=%p, flags=%u", dom, flags); + + virResetLastError(); + + if (!VIR_IS_CONNECTED_DOMAIN(dom)) { + virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + conn = dom->conn; + + if (conn->driver->domainHasManagedSaveImage) { + int ret; + + ret = conn->driver->domainHasManagedSaveImage(dom, flags); + if (ret < 0) + goto error; + return ret; + } + + virLibConnError(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + +error: + virDispatchError(conn); + return -1; +} + +/** + * virDomainManagedSaveRemove: + * @dom: pointer to the domain + * @flags: optional flags currently unused + * + * Remove any managed save image as for this domain. + * + * Returns 0 in case of success, and -1 in case of error + */ +int virDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags) +{ + virConnectPtr conn; + + VIR_DEBUG("dom=%p, flags=%u", dom, flags); + + virResetLastError(); + + if (!VIR_IS_CONNECTED_DOMAIN(dom)) { + virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + conn = dom->conn; + if (conn->flags & VIR_CONNECT_RO) { + virLibDomainError(dom, VIR_ERR_OPERATION_DENIED, __FUNCTION__); + goto error; + } + + if (conn->driver->domainManagedSaveRemove) { + int ret; + + ret = conn->driver->domainManagedSaveRemove(dom, flags); + if (ret < 0) + goto error; + return ret; + } + + virLibConnError(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + +error: + virDispatchError(conn); + return -1; +} Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH 00/10] Begin to replace scanf and atoi
by Matthias Bolte 31 Mar '10

31 Mar '10

This set of patches is a first step towards removing the scanf and atoi usage in libvirt. I began with the simple cases and post this now to get some feedback before I start to convert the more difficult ones. 01/10 Replace sscanf in legacy device address parsing 02/10 Replace sscanf in nwfilter rule parsing 03/10 Refactor major.minor.micro version parsing into a function 04/10 cgroup: Replace sscanf with virStrToLong_ll 05/10 vbox: Replace atoi with virStrToLong_i 06/10 xen: Use virParseMacAddr instead of sscanf 07/10 openvz: Use strtok_r instead of sscanf for VPS UUID parsing 08/10 xenapi: Use virStrToLong_i instead of sscanf for CPU map parsing 09/10 xen: Use virStrToLong_i instead of sscanf for XenD port parsing 10/10 Replace sscanf in PCI device address parsing src/conf/domain_conf.c | 38 +++++++++++++++++++--------- src/conf/nwfilter_conf.c | 10 +++--- src/esx/esx_driver.c | 31 ++++------------------ src/libvirt_private.syms | 1 + src/lxc/lxc_driver.c | 10 +------ src/openvz/openvz_conf.c | 27 ++++++++++++------- src/uml/uml_conf.h | 2 +- src/uml/uml_driver.c | 17 ++++++------ src/util/cgroup.c | 3 +- src/util/pci.c | 59 ++++++++++++++++++++++++++++++++++--------- src/util/util.c | 37 +++++++++++++++++++++++++++ src/util/util.h | 1 + src/vbox/vbox_tmpl.c | 18 +++++-------- src/xen/xend_internal.c | 20 ++------------ src/xen/xm_internal.c | 19 +++---------- src/xenapi/xenapi_driver.c | 21 +++++++-------- src/xenapi/xenapi_utils.c | 3 +- 17 files changed, 179 insertions(+), 138 deletions(-) Matthias

5 31

[libvirt] [PATCH] website: Add archive link for libvirt-users list
by Matthias Bolte 31 Mar '10

31 Mar '10

--- docs/contact.html.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/docs/contact.html.in b/docs/contact.html.in index 09f8e35..c9dceda 100644 --- a/docs/contact.html.in +++ b/docs/contact.html.in @@ -21,7 +21,7 @@ </ul> </dd> - <dt><a href="">libvirt-users(a)redhat.com</a></dt> + <dt><a href="https://www.redhat.com/archives/libvirt-users/">libvirt-users(a)redhat.com</a></dt> <dd>This list a place for discussions involving libvirt <strong>users</strong>. Topics for discussion include <ul> <li>Usage of libvirt / virsh</li> -- 1.6.3.3

2 2

[libvirt] [PATCH] Fix apibuild.py warning about virNWFilterLookupByUUIDString
by Matthias Bolte 31 Mar '10

31 Mar '10

The function name was written with capital I in the Filter part. --- src/libvirt.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index 138dd31..5247fe7 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -11333,7 +11333,7 @@ error: } /** - * virNWFIlterLookupByUUIDString: + * virNWFilterLookupByUUIDString: * @conn: pointer to the hypervisor connection * @uuidstr: the string UUID for the nwfilter * -- 1.6.3.3

2 2

[libvirt] Patch for Vepa support in brctl
by Kumar L Srikanth-B22348 31 Mar '10

31 Mar '10

Hi Daniel, Can you please provide a valid patch for 'brctl' utility, to support 'vepa' mode. Regards, Srikanth.

3 2

[libvirt] [PATCH] Blank out invalid interface names with escaped letters etc.
by Stefan Berger 31 Mar '10

31 Mar '10

Hunt interface names through a regular expression matcher to check whether they only contain valid characters. Valid characters in this code are currently a-z,A-Z,0-9, and '_'. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/domain_conf.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) Index: libvirt-acl/src/conf/domain_conf.c =================================================================== --- libvirt-acl.orig/src/conf/domain_conf.c +++ libvirt-acl/src/conf/domain_conf.c @@ -28,6 +28,7 @@ #include <unistd.h> #include <fcntl.h> #include <dirent.h> +#include <regex.h> #include "virterror_internal.h" #include "datatypes.h" @@ -1776,6 +1777,23 @@ cleanup: } +static bool +isValidIfname(const char *ifname) { + int rc = 1; + regex_t regex_ifname; + + if (regcomp(&regex_ifname, "^[a-zA-Z0-9_]+$", + REG_NOSUB|REG_EXTENDED) != 0) + return 0; + + if (regexec(&regex_ifname, ifname, 0, NULL, 0) != 0) + rc = 0; + + regfree(&regex_ifname); + return rc; +} + + /* Parse the XML definition for a network interface * @param node XML nodeset to parse for net definition @@ -1859,8 +1877,10 @@ virDomainNetDefParseXML(virCapsPtr caps, xmlStrEqual(cur->name, BAD_CAST "target")) { ifname = virXMLPropString(cur, "dev"); if ((ifname != NULL) && - (STRPREFIX((const char*)ifname, "vnet"))) { + ((STRPREFIX((const char*)ifname, "vnet")) || + (!isValidIfname(ifname)))) { /* An auto-generated target name, blank it out */ + /* blank out invalid interface names */ VIR_FREE(ifname); } } else if ((script == NULL) &&

3 2

[libvirt] [PATCH] maint: remove redundant tests after virStrToLong
by Eric Blake 31 Mar '10

31 Mar '10

virStrToLong* guarantees (via strtol) that the end pointer will be set to the point at which parsing stopped (even on failure, this point is the start of the input string). * src/esx/esx_driver.c (esxGetVersion): Remove pointless conditional. * src/qemu/qemu_conf.c (qemuParseCommandLinePCI) (qemuParseCommandLineUSB, qemuParseCommandLineSmp): Likewise. * src/qemu/qemu_monitor_text.c (qemuMonitorTextGetMigrationStatus): Likewise. --- src/esx/esx_driver.c | 6 ++---- src/qemu/qemu_conf.c | 14 ++++++-------- src/qemu/qemu_monitor_text.c | 6 +++--- 3 files changed, 11 insertions(+), 15 deletions(-) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index bbe8a51..f07493e 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -690,13 +690,11 @@ esxGetVersion(virConnectPtr conn, unsigned long *version) temp = (char *)priv->host->service->about->version; /* Expecting 'major.minor.release' format */ - if (virStrToLong_ui(temp, &temp, 10, &major) < 0 || temp == NULL || - *temp != '.') { + if (virStrToLong_ui(temp, &temp, 10, &major) < 0 || *temp != '.') { goto failure; } - if (virStrToLong_ui(temp + 1, &temp, 10, &minor) < 0 || temp == NULL || - *temp != '.') { + if (virStrToLong_ui(temp + 1, &temp, 10, &minor) < 0 || *temp != '.') { goto failure; } diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 8f6f7ec..5d0b211 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -5217,14 +5217,14 @@ qemuParseCommandLinePCI(const char *val) } start = val + strlen("host="); - if (virStrToLong_i(start, &end, 16, &bus) < 0 || !end || *end != ':') { + if (virStrToLong_i(start, &end, 16, &bus) < 0 || *end != ':') { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("cannot extract PCI device bus '%s'"), val); VIR_FREE(def); goto cleanup; } start = end + 1; - if (virStrToLong_i(start, &end, 16, &slot) < 0 || !end || *end != '.') { + if (virStrToLong_i(start, &end, 16, &slot) < 0 || *end != '.') { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("cannot extract PCI device slot '%s'"), val); VIR_FREE(def); @@ -5275,7 +5275,7 @@ qemuParseCommandLineUSB(const char *val) start = val + strlen("host:"); if (strchr(start, ':')) { - if (virStrToLong_i(start, &end, 16, &first) < 0 || !end || *end != ':') { + if (virStrToLong_i(start, &end, 16, &first) < 0 || *end != ':') { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("cannot extract USB device vendor '%s'"), val); VIR_FREE(def); @@ -5289,7 +5289,7 @@ qemuParseCommandLineUSB(const char *val) goto cleanup; } } else { - if (virStrToLong_i(start, &end, 10, &first) < 0 || !end || *end != '.') { + if (virStrToLong_i(start, &end, 10, &first) < 0 || *end != '.') { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("cannot extract USB device bus '%s'"), val); VIR_FREE(def); @@ -5573,13 +5573,11 @@ qemuParseCommandLineSmp(virDomainDefPtr dom, for (i = 0; i < nkws; i++) { if (vals[i] == NULL) { if (i > 0 || - virStrToLong_i(kws[i], &end, 10, &n) < 0 || - !end || *end != '\0') + virStrToLong_i(kws[i], &end, 10, &n) < 0 || *end != '\0') goto syntax; dom->vcpus = n; } else { - if (virStrToLong_i(vals[i], &end, 10, &n) < 0 || - !end || *end != '\0') + if (virStrToLong_i(vals[i], &end, 10, &n) < 0 || *end != '\0') goto syntax; if (STREQ(kws[i], "sockets")) sockets = n; diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c index 1596e59..a199de7 100644 --- a/src/qemu/qemu_monitor_text.c +++ b/src/qemu/qemu_monitor_text.c @@ -1075,7 +1075,7 @@ int qemuMonitorTextGetMigrationStatus(qemuMonitorPtr mon, goto done; tmp += strlen(MIGRATION_TRANSFER_PREFIX); - if (virStrToLong_ull(tmp, &end, 10, transferred) < 0 || !end) { + if (virStrToLong_ull(tmp, &end, 10, transferred) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("cannot parse migration data transferred statistic %s"), tmp); goto cleanup; @@ -1087,7 +1087,7 @@ int qemuMonitorTextGetMigrationStatus(qemuMonitorPtr mon, goto done; tmp += strlen(MIGRATION_REMAINING_PREFIX); - if (virStrToLong_ull(tmp, &end, 10, remaining) < 0 || !end) { + if (virStrToLong_ull(tmp, &end, 10, remaining) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("cannot parse migration data remaining statistic %s"), tmp); goto cleanup; @@ -1098,7 +1098,7 @@ int qemuMonitorTextGetMigrationStatus(qemuMonitorPtr mon, goto done; tmp += strlen(MIGRATION_TOTAL_PREFIX); - if (virStrToLong_ull(tmp, &end, 10, total) < 0 || !end) { + if (virStrToLong_ull(tmp, &end, 10, total) < 0) { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("cannot parse migration data total statistic %s"), tmp); goto cleanup; -- 1.6.6.1

2 2