- Devel - libvirt List Archives

[libvirt] [PATCH] Add dummy nwfilter driver to test driver
by Stefan Berger 30 Mar '10

30 Mar '10

This patch adds a dummy nwfilter driver to the test driver so that the int-overflow test passes without modifications. Signed-off-by: Stefan Berger <Stefanb(a)us.ibm.com> Index: libvirt/src/test/test_driver.c =================================================================== --- libvirt.orig/src/test/test_driver.c +++ libvirt/src/test/test_driver.c @@ -5205,6 +5205,22 @@ static int testSecretClose(virConnectPtr return 0; } + +static virDrvOpenStatus testNWFilterOpen(virConnectPtr conn, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, + int flags ATTRIBUTE_UNUSED) { + if (STRNEQ(conn->driver->name, "Test")) + return VIR_DRV_OPEN_DECLINED; + + conn->secretPrivateData = conn->privateData; + return VIR_DRV_OPEN_SUCCESS; +} + +static int testNWFilterClose(virConnectPtr conn) { + conn->nwfilterPrivateData = NULL; + return 0; +} + static virDriver testDriver = { VIR_DRV_TEST, "Test", @@ -5398,6 +5414,12 @@ static virSecretDriver testSecretDriver }; +static virNWFilterDriver testNWFilterDriver = { + .name = "Test", + .open = testNWFilterOpen, + .close = testNWFilterClose, +}; + /** * testRegister: * @@ -5418,6 +5440,8 @@ testRegister(void) return -1; if (virRegisterSecretDriver(&testSecretDriver) < 0) return -1; + if (virRegisterNWFilterDriver(&testNWFilterDriver) < 0) + return -1; return 0; }

4 4

[libvirt] [PATCH] Use libvirt's existing ipv6/ipv4 parser/printer rather than self-written ones
by Stefan Berger 30 Mar '10

30 Mar '10

This patch changes the network filtering code to use libvirt's existing IPv4 and IPv6 address parsers/printers rather than my self-written ones. I am introducing a new function in network.c that counts the number of bits in a netmask and ensures that the given address is indeed a netmask, return -1 on error or values of 0-32 for IPv4 addresses and 0-128 for IPv6 addresses. I then based the function checking for valid netmask on invoking this function. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 181 ++---------------------------- src/conf/nwfilter_conf.h | 8 - src/nwfilter/nwfilter_ebiptables_driver.c | 46 ++++--- src/util/network.c | 173 +++++++++++++++------------- src/util/network.h | 3 5 files changed, 142 insertions(+), 269 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -33,6 +33,8 @@ # include "util.h" # include "hash.h" # include "xml.h" +# include "network.h" + /** * Chain suffix size is: @@ -85,11 +87,7 @@ struct _nwMACAddress { typedef struct _nwIPAddress nwIPAddress; typedef nwIPAddress *nwIPAddressPtr; struct _nwIPAddress { - int isIPv6; - union { - unsigned char ipv4Addr[4]; - unsigned char ipv6Addr[16]; - } addr; + virSocketAddr addr; }; Index: libvirt-acl/src/util/network.c =================================================================== --- libvirt-acl.orig/src/util/network.c +++ libvirt-acl/src/util/network.c @@ -219,88 +219,10 @@ virSocketGetPort(virSocketAddrPtr addr) * Returns 0 in case of success and -1 in case of error */ int virSocketAddrIsNetmask(virSocketAddrPtr netmask) { - int i; - - if (netmask == NULL) - return(-1); - - if (netmask->stor.ss_family == AF_INET) { - virIPv4Addr tm; - unsigned char tmp; - int ok = 0; - - if (getIPv4Addr(netmask, &tm) < 0) - return(-1); - - for (i = 0;i < 4;i++) { - if (tm[i] != 0) - break; - } - - if (i >= 4) - return(0); - - tmp = 0xFF; - do { - if (tm[i] == tmp) { - ok = 1; - break; - } - tmp <<= 1; - } while (tmp != 0); - if (ok == 0) - return(-1); - i++; - - if (i >= 4) - return(0); - - for (;i < 4;i++) { - if (tm[i] != 0xFF) - return(-1); - } - } else if (netmask->stor.ss_family == AF_INET6) { - virIPv6Addr tm; - unsigned short tmp; - int ok = 0; - - /* - * Hum, on IPv6 people use prefixes instead of netmask - */ - if (getIPv6Addr(netmask, &tm) < 0) - return(-1); - - for (i = 0;i < 8;i++) { - if (tm[i] != 0) - break; - } - - if (i >= 8) - return(0); - - tmp = 0xFFFF; - do { - if (tm[i] == tmp) { - ok = 1; - break; - } - tmp <<= 1; - } while (tmp != 0); - if (ok == 0) - return(-1); - i++; - - if (i >= 8) - return(0); - - for (;i < 8;i++) { - if (tm[i] != 0xFFFF) - return(-1); - } - } else { - return(-1); - } - return(0); + int n = virSocketGetNumNetmaskBits(netmask); + if (n < 0) + return -1; + return 0; } /** @@ -415,3 +337,90 @@ int virSocketGetRange(virSocketAddrPtr s } return(ret); } + + +/** + * virGetNumNetmaskBits + * @netmask: the presumed netmask + * + * Get the number of netmask bits in a netmask. + * + * Returns the number of bits in the netmask or -1 if an error occurred + * or the netmask is invalid. + */ +int virSocketGetNumNetmaskBits(const virSocketAddrPtr netmask) +{ + int i, j; + int c = 0; + + if (netmask->stor.ss_family == AF_INET) { + virIPv4Addr tm; + uint8_t bit; + + if (getIPv4Addr(netmask, &tm) < 0) + return -1; + + for (i = 0; i < 4; i++) + if (tm[i] == 0xff) + c += 8; + else + break; + + if (c == 8 * 4) + return c; + + j = i << 3; + while (j < (8 * 4)) { + bit = 1 << (7 - (j & 7)); + if ((tm[j >> 3] & bit)) { + c++; + } else + break; + j++; + } + + while (j < (8 * 4)) { + bit = 1 << (7 - (j & 7)); + if ((tm[j >> 3] & bit)) + return -1; + j++; + } + + return c; + } else if (netmask->stor.ss_family == AF_INET6) { + virIPv6Addr tm; + uint16_t bit; + + if (getIPv6Addr(netmask, &tm) < 0) + return -1; + + for (i = 0; i < 8; i++) + if (tm[i] == 0xffff) + c += 16; + else + break; + + if (c == 16 * 8) + return c; + + j = i << 4; + while (j < (16 * 8)) { + bit = 1 << (15 - (j & 0xf)); + if ((tm[j >> 4] & bit)) { + c++; + } else + break; + j++; + } + + while (j < (16 * 8)) { + bit = 1 << (15 - (j & 0xf)); + if ((tm[j >> 4]) & bit) + return -1; + j++; + } + + return c; + } + return -1; +} Index: libvirt-acl/src/util/network.h =================================================================== --- libvirt-acl.orig/src/util/network.h +++ libvirt-acl/src/util/network.h @@ -48,4 +48,7 @@ int virSocketAddrIsNetmask(virSocketAddr int virSocketCheckNetmask (virSocketAddrPtr addr1, virSocketAddrPtr addr2, virSocketAddrPtr netmask); + +int virSocketGetNumNetmaskBits(const virSocketAddrPtr netmask); + #endif /* __VIR_NETWORK_H__ */ Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -473,22 +473,6 @@ checkValidMask(unsigned char *data, int } -/* check for a valid IPv4 mask */ -static bool -checkIPv4Mask(enum attrDatatype datatype ATTRIBUTE_UNUSED, void *maskptr, - virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED) -{ - return checkValidMask(maskptr, 4); -} - -static bool -checkIPv6Mask(enum attrDatatype datatype ATTRIBUTE_UNUSED, void *maskptr, - virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED) -{ - return checkValidMask(maskptr, 16); -} - - static bool checkMACMask(enum attrDatatype datatype ATTRIBUTE_UNUSED, void *macMask, @@ -498,16 +482,6 @@ checkMACMask(enum attrDatatype datatype } -static int getMaskNumBits(const unsigned char *mask, int len) { - int i = 0; - while (i < (len << 3)) { - if (!(mask[i>>3] & (0x80 >> (i & 3)))) - break; - i++; - } - return i; -} - /* * supported arp opcode -- see 'ebtables -h arp' for the naming */ @@ -1227,21 +1201,8 @@ static bool virNWIPv4AddressParser(const char *input, nwIPAddressPtr output) { - int i; - char *endptr; - const char *n = input; - long int d; - - for (i = 0; i < 4; i++) { - d = strtol(n, &endptr, 10); - if (d < 0 || d > 255 || - (endptr - n > 3 ) || - (i <= 2 && *endptr != '.' ) || - (i == 3 && *endptr != '\0')) - return 0; - output->addr.ipv4Addr[i] = (unsigned char)d; - n = endptr + 1; - } + if (virSocketParseIpv4Addr(input, &output->addr) == -1) + return 0; return 1; } @@ -1250,81 +1211,8 @@ static bool virNWIPv6AddressParser(const char *input, nwIPAddressPtr output) { - int i, j, pos; - uint16_t n; - int shiftpos = -1; - char prevchar; - char base; - - memset(output, 0x0, sizeof(*output)); - - output->isIPv6 = 1; - - pos = 0; - i = 0; - - while (i < 8) { - j = 0; - n = 0; - while (1) { - prevchar = input[pos++]; - if (prevchar == ':' || prevchar == 0) { - if (j > 0) { - output->addr.ipv6Addr[i * 2 + 0] = n >> 8; - output->addr.ipv6Addr[i * 2 + 1] = n; - i++; - } - break; - } - - if (j >= 4) - return 0; - - if (prevchar >= '0' && prevchar <= '9') - base = '0'; - else if (prevchar >= 'a' && prevchar <= 'f') - base = 'a' - 10; - else if (prevchar >= 'A' && prevchar <= 'F') - base = 'A' - 10; - else - return 0; - n <<= 4; - n |= (prevchar - base); - j++; - } - - if (prevchar == 0) - break; - - if (input[pos] == ':') { - pos ++; - // sequence of zeros - if (prevchar != ':') - return 0; - - if (shiftpos != -1) - return 0; - - shiftpos = i; - } - } - - if (shiftpos != -1) { - if (i >= 7) - return 0; - i--; - j = 0; - while (i >= shiftpos) { - output->addr.ipv6Addr[15 - (j*2) - 1] = - output->addr.ipv6Addr[i * 2 + 0]; - output->addr.ipv6Addr[15 - (j*2) - 0] = - output->addr.ipv6Addr[i * 2 + 1]; - output->addr.ipv6Addr[i * 2 + 0] = 0; - output->addr.ipv6Addr[i * 2 + 1] = 0; - i--; - j++; - } - } + if (virSocketParseIpv6Addr(input, &output->addr) == -1) + return 0; return 1; } @@ -1442,11 +1330,10 @@ virNWFilterRuleDetailsParse(virConnectPt } else rc = -1; } else { - if (checkIPv4Mask(datatype, - ipaddr.addr.ipv4Addr, nwf)) - *(uint8_t *)storage_ptr = - getMaskNumBits(ipaddr.addr.ipv4Addr, - sizeof(ipaddr.addr.ipv4Addr)); + int_val = virSocketGetNumNetmaskBits( + &ipaddr.addr); + if (int_val >= 0) + *(uint8_t *)storage_ptr = int_val; else rc = -1; found = 1; @@ -1497,11 +1384,10 @@ virNWFilterRuleDetailsParse(virConnectPt } else rc = -1; } else { - if (checkIPv6Mask(datatype, - ipaddr.addr.ipv6Addr, nwf)) - *(uint8_t *)storage_ptr = - getMaskNumBits(ipaddr.addr.ipv6Addr, - sizeof(ipaddr.addr.ipv6Addr)); + int_val = virSocketGetNumNetmaskBits( + &ipaddr.addr); + if (int_val >= 0) + *(uint8_t *)storage_ptr = int_val; else rc = -1; found = 1; @@ -2571,43 +2457,12 @@ virNWFilterPoolObjDeleteDef(virConnectPt static void virNWIPAddressFormat(virBufferPtr buf, nwIPAddressPtr ipaddr) { - if (!ipaddr->isIPv6) { - virBufferVSprintf(buf, "%d.%d.%d.%d", - ipaddr->addr.ipv4Addr[0], - ipaddr->addr.ipv4Addr[1], - ipaddr->addr.ipv4Addr[2], - ipaddr->addr.ipv4Addr[3]); - } else { - int i; - int dcshown = 0, in_dc = 0; - unsigned short n; - while (i < 8) { - n = (ipaddr->addr.ipv6Addr[i * 2 + 0] << 8) | - ipaddr->addr.ipv6Addr[i * 2 + 1]; - if (n == 0) { - if (!dcshown) { - in_dc = 1; - if (i == 0) - virBufferAddLit(buf, ":"); - dcshown = 1; - } - if (in_dc) { - i++; - continue; - } - } - if (in_dc) { - dcshown = 1; - virBufferAddLit(buf, ":"); - in_dc = 0; - } - i++; - virBufferVSprintf(buf, "%x", n); - if (i < 8) - virBufferAddLit(buf, ":"); - } - if (in_dc) - virBufferAddLit(buf, ":"); + virSocketAddrPtr addr = &ipaddr->addr; + char *output = virSocketFormatAddr(addr); + + if (output) { + virBufferVSprintf(buf, "%s", output); + VIR_FREE(output); } } Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -144,7 +144,7 @@ printDataType(virConnectPtr conn, nwItemDescPtr item) { int done; - int i, pos, s; + char *data; if (printVar(conn, vars, buf, bufsize, item, &done)) return 1; @@ -154,30 +154,38 @@ printDataType(virConnectPtr conn, switch (item->datatype) { case DATATYPE_IPADDR: - if (snprintf(buf, bufsize, "%d.%d.%d.%d", - item->u.ipaddr.addr.ipv4Addr[0], - item->u.ipaddr.addr.ipv4Addr[1], - item->u.ipaddr.addr.ipv4Addr[2], - item->u.ipaddr.addr.ipv4Addr[3]) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, - _("Buffer too small for IP address")); + data = virSocketFormatAddr(&item->u.ipaddr.addr); + if (!data) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("internal IPv4 address representation " + "is bad")); + return 1; + } + if (snprintf(buf, bufsize, "%s", data) >= bufsize) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("buffer too small for IP address")); + VIR_FREE(data); return 1; } + VIR_FREE(data); break; case DATATYPE_IPV6ADDR: - pos = 0; - for (i = 0; i < 16; i++) { - s = snprintf(&buf[pos], bufsize - pos, "%x%s", - (unsigned int)item->u.ipaddr.addr.ipv6Addr[i], - ((i & 1) && (i < 15)) ? ":" : "" ); - if (s >= bufsize - pos) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, - _("Buffer too small for IPv6 address")); - return 1; - } - pos += s; + data = virSocketFormatAddr(&item->u.ipaddr.addr); + if (!data) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("internal IPv6 address representation " + "is bad")); + return 1; + } + + if (snprintf(buf, bufsize, "%s", data) >= bufsize) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("buffer too small for IPv6 address")); + VIR_FREE(data); + return 1; } + VIR_FREE(data); break; case DATATYPE_MACADDR:

2 1

[libvirt] [PATCH] Remove driver dependency from nwfilter_conf.c
by Stefan Berger 30 Mar '10

30 Mar '10

This patch removes the driver dependency from nwfilter_conf.c and moves a callback function calling into the driver into nwfilter_gentech_driver.c and passes a pointer to that callback function upon initialization of nwfilter_conf.c. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -39,7 +39,6 @@ #include "nwfilter_params.h" #include "nwfilter_conf.h" #include "domain_conf.h" -#include "nwfilter/nwfilter_gentech_driver.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER @@ -2064,56 +2063,7 @@ virNWFilterRegisterCallbackDriver(virNWF } -enum UpdateStep { - STEP_APPLY_NEW, - STEP_TEAR_NEW, - STEP_TEAR_OLD, -}; - -struct cbStruct { - virConnectPtr conn; - enum UpdateStep step; - int err; -}; - -static void -virNWFilterDomainFWUpdateCB(void *payload, - const char *name ATTRIBUTE_UNUSED, - void *data) -{ - virDomainObjPtr obj = payload; - virDomainDefPtr vm = obj->def; - struct cbStruct *cb = data; - int i; - - virDomainObjLock(obj); - - if (virDomainObjIsActive(obj)) { - for (i = 0; i < vm->nnets; i++) { - virDomainNetDefPtr net = vm->nets[i]; - if ((net->filter) && (net->ifname)) { - switch (cb->step) { - case STEP_APPLY_NEW: - cb->err = virNWFilterUpdateInstantiateFilter(cb->conn, - net); - break; - - case STEP_TEAR_NEW: - cb->err = virNWFilterRollbackUpdateFilter(cb->conn, net); - break; - - case STEP_TEAR_OLD: - cb->err = virNWFilterTearOldFilter(cb->conn, net); - break; - } - if (cb->err) - break; - } - } - } - - virDomainObjUnlock(obj); -} +static virHashIterator virNWFilterDomainFWUpdateCB; static int @@ -2121,7 +2071,7 @@ virNWFilterTriggerVMFilterRebuild(virCon { int i; int err; - struct cbStruct cb = { + struct domUpdateCBStruct cb = { .conn = conn, .err = 0, .step = STEP_APPLY_NEW, @@ -2717,8 +2667,10 @@ char *virNWFilterConfigFile(virConnectPt } -int virNWFilterConfLayerInit(void) +int virNWFilterConfLayerInit(virHashIterator domUpdateCB) { + virNWFilterDomainFWUpdateCB = domUpdateCB; + if (virMutexInit(&updateMutex)) return 1; Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -402,6 +402,19 @@ struct _virNWFilterRuleInst { }; +enum UpdateStep { + STEP_APPLY_NEW, + STEP_TEAR_NEW, + STEP_TEAR_OLD, +}; + +struct domUpdateCBStruct { + virConnectPtr conn; + enum UpdateStep step; + int err; +}; + + enum virDomainNetType; typedef int (*virNWFilterRuleCreateInstance)(virConnectPtr conn, @@ -516,7 +529,7 @@ virNWFilterDefPtr virNWFilterDefParseFil void virNWFilterPoolObjLock(virNWFilterPoolObjPtr obj); void virNWFilterPoolObjUnlock(virNWFilterPoolObjPtr obj); -int virNWFilterConfLayerInit(void); +int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); int virNWFilterParamConfLayerInit(void); Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -34,6 +34,7 @@ #include "memory.h" #include "domain_conf.h" #include "nwfilter_driver.h" +#include "nwfilter_gentech_driver.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER @@ -64,7 +65,7 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; - if (virNWFilterConfLayerInit() < 0) + if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) return -1; if (VIR_ALLOC(driverState) < 0) Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -681,3 +681,43 @@ virNWFilterTeardownFilter(const virDomai return 0; } + + +void +virNWFilterDomainFWUpdateCB(void *payload, + const char *name ATTRIBUTE_UNUSED, + void *data) +{ + virDomainObjPtr obj = payload; + virDomainDefPtr vm = obj->def; + struct domUpdateCBStruct *cb = data; + int i; + + virDomainObjLock(obj); + + if (virDomainObjIsActive(obj)) { + for (i = 0; i < vm->nnets; i++) { + virDomainNetDefPtr net = vm->nets[i]; + if ((net->filter) && (net->ifname)) { + switch (cb->step) { + case STEP_APPLY_NEW: + cb->err = virNWFilterUpdateInstantiateFilter(cb->conn, + net); + break; + + case STEP_TEAR_NEW: + cb->err = virNWFilterRollbackUpdateFilter(cb->conn, net); + break; + + case STEP_TEAR_OLD: + cb->err = virNWFilterTearOldFilter(cb->conn, net); + break; + } + if (cb->err) + break; + } + } + } + + virDomainObjUnlock(obj); +} Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -51,4 +51,8 @@ int virNWFilterTeardownFilter(const virD virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, char *macaddr); +void virNWFilterDomainFWUpdateCB(void *payload, + const char *name ATTRIBUTE_UNUSED, + void *data); + #endif

2 1

[libvirt] [PATCH] [0/6] implement synchronous hook scripts
by Daniel Veillard 30 Mar '10

30 Mar '10

As discussed previously this implement hook scripts which may be called from libvirtd at specific times. The script are supposed to be small, execute fast as it's synchronous, their exit value is 0 otherwise it's considered a failure (which may be ignored but in general will stops the ongoing operation). Scripts are stored under /etc/libvirt/hook/ (or rather $SYSCONF_DIR/libvirt/hook/) if missing no script invocation will ever be done. There is one script per 'driver' there is currently hooks for the daemon, qemu and lxc, so right now only /etc/libvirt/hook/daemon /etc/libvirt/hook/qemu /etc/libvirt/hook/lxc are potentially used. The implemented set of operations is rather simple currently daemon start, reload, and exit, and for domain operations, domain startup and exit. This can be extended to more drivers in the future of more fine-grained modularity for the scripts. The current API to the script israther simple it get passed arguments about the object name, the operation name, suboperation, and an extra string. Right now for the daemon the script would get the fallowing calls: /etc/libvirt/hooks/daemon - start - start /etc/libvirt/hooks/daemon - reload begin SIGHUP /etc/libvirt/hooks/daemon - shutdown - shutdown and for qemu (or lxc): /etc/libvirt/hooks/qemu RHEL-5.4-64 start begin - /etc/libvirt/hooks/qemu RHEL-5.4-64 stopped end - with the XML configuration of the domain passed on the script stdin if needed. In case of script failure at domain startup, this is raised as an normal error, e.g.: [root@paphio tmp]# virsh start RHEL-5.4-64 error: Failed to start domain RHEL-5.4-64 error: Hook script execution failed: Hook script /etc/libvirt/hooks/qemu qemu failed with error code 256:forbidden startup [root@paphio tmp]# Some hooks could certainly be added at different place in domain lifetime operations, for example we plan to add some for migration, but one thing to remember is that those synchronous scripts can have a serious impact on execution, so to some extend it's better to use the asynchronous async event mechanism when possible. Among the things left to improve and check, there is the behaviour when the daemon is started by the user for example for qemu:///user and double check some of the script interaction with security, SELinux in particular. But the basics are there, and I would hope to have this in the next release, Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

4 23

[libvirt] virsh setmaxmem
by Chris Lalancette 30 Mar '10

30 Mar '10

All, My recent patch to remove qemudDomainSetMaxMem() revealed some surprising (to me) behavior of "virsh setmaxmem". In particular, if you run setmaxmem, and the hypervisor doesn't support it, this fact will be reported to you. However, if the amount you were setting for maxmem happens to be lower than "currentMemory", setmaxmem will silently balloon down the domain for you. This is a surprising result exactly because virsh reports error, but did something anyway. What I would expect is that if a hypervisor doesn't support virDomainSetMaxMem(), nothing at all is done. If we agree that this is behavior that needs to be fixed, I would suggest that we move the code to do the auto-ballooning into each of the individual drivers that *do* support virDomainSetMaxMem(). Currently that includes the test driver, the LXC driver, and the Xen driver. This way, we maintain the current behavior for the hypervisors that support this call, and make sure not to do anything at all for the hypervisors that do not. Opinions? -- Chris Lalancette

3 4

[libvirt] [PATCH 0/4] Add timer element to domain clock elements
by Laine Stump 30 Mar '10

30 Mar '10

This patchset implements the XML described in http://www.redhat.com/archives/libvir-list/2010-March/msg00304.html (with one small change - the tickpolicy 'none' was changed to 'delay' after a later discussion). It also implements the qemu backend for those timer types that qemu supports. One thing to point out to 'early adopters': qemu's driftfix option is currently broken, so if you try to specify a tickpolicy=catchup in an rtc timer, the domain will give an error on startup. A patch for that has been posted by Zach Amsden to qemu-devel: http://lists.gnu.org/archive/html/qemu-devel/2010-03/msg02036.html Backends for other hypervisors have not been implemented. That is left as an exercise for later ;-)

2 5

[libvirt] [PATCH 0/2] virsh: honor VISUAL
by Eric Blake 29 Mar '10

29 Mar '10

On IRC yesterday, the comment came up that 'virsh edit' is over-protective, because it prevented me from editing in-terminal using my favorite editor, even after I worked around the fact that sudo sanitizes EDITOR. Besides, historically, VISUAL is used in situations where opening a new window is okay, while EDITOR is used when editing should reuse the current terminal; so we should honor that convention.

3 7

[libvirt] [PATCH] esx: Allow 'lsisas1068' as SCSI controller type
by Matthias Bolte 29 Mar '10

29 Mar '10

Extend tests to cover all SCSI controller types and document the new type. --- docs/drvesx.html.in | 4 +++ src/esx/esx_vmx.c | 14 +++++++----- tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx | 7 ------ tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml | 20 ------------------ tests/vmx2xmldata/vmx2xml-scsi-driver.vmx | 17 +++++++++++++++ tests/vmx2xmldata/vmx2xml-scsi-driver.xml | 30 +++++++++++++++++++++++++++ tests/vmx2xmltest.c | 2 +- tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx | 12 ---------- tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml | 15 ------------- tests/xml2vmxdata/xml2vmx-scsi-driver.vmx | 22 +++++++++++++++++++ tests/xml2vmxdata/xml2vmx-scsi-driver.xml | 25 ++++++++++++++++++++++ tests/xml2vmxtest.c | 2 +- 12 files changed, 108 insertions(+), 62 deletions(-) delete mode 100644 tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx delete mode 100644 tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml create mode 100644 tests/vmx2xmldata/vmx2xml-scsi-driver.vmx create mode 100644 tests/vmx2xmldata/vmx2xml-scsi-driver.xml delete mode 100644 tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx delete mode 100644 tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml create mode 100644 tests/xml2vmxdata/xml2vmx-scsi-driver.vmx create mode 100644 tests/xml2vmxdata/xml2vmx-scsi-driver.xml diff --git a/docs/drvesx.html.in b/docs/drvesx.html.in index 44a144f..9b413ab 100644 --- a/docs/drvesx.html.in +++ b/docs/drvesx.html.in @@ -275,6 +275,10 @@ ethernet0.checkMACAddress = "false" <dd> LSI Logic SCSI controller for recent guests. </dd> + <dt><code>lsisas1068</code></dt> + <dd> + LSI Logic SAS 1068 controller. + </dd> </dl> <p> Here a domain XML snippet: diff --git a/src/esx/esx_vmx.c b/src/esx/esx_vmx.c index ba4c608..6c1d56e 100644 --- a/src/esx/esx_vmx.c +++ b/src/esx/esx_vmx.c @@ -557,10 +557,11 @@ esxVMX_GatherSCSIControllers(virDomainDefPtr def, char *virtualDev[4], if (disk->driverName != NULL && STRCASENEQ(disk->driverName, "buslogic") && - STRCASENEQ(disk->driverName, "lsilogic")) { + STRCASENEQ(disk->driverName, "lsilogic") && + STRCASENEQ(disk->driverName, "lsisas1068")) { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "Expecting domain XML entry 'devices/disk/target' to be " - "'buslogic' or 'lsilogic' but found '%s'", + "'buslogic' or 'lsilogic' or 'lsisas1068' but found '%s'", disk->driverName); return -1; } @@ -1269,10 +1270,11 @@ esxVMX_ParseSCSIController(virConfPtr conf, int controller, int *present, if (*virtualDev != NULL && STRCASENEQ(*virtualDev, "buslogic") && - STRCASENEQ(*virtualDev, "lsilogic")) { + STRCASENEQ(*virtualDev, "lsilogic") && + STRCASENEQ(*virtualDev, "lsisas1068")) { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, - "Expecting VMX entry '%s' to be 'buslogic' or 'lsilogic' " - "but found '%s'", virtualDev_name, *virtualDev); + "Expecting VMX entry '%s' to be 'buslogic' or 'lsilogic' or " + "'lsisas1068' but found '%s'", virtualDev_name, *virtualDev); goto failure; } @@ -1312,7 +1314,7 @@ esxVMX_ParseDisk(esxVI_Context *ctx, virConfPtr conf, int device, int bus, * bus = VIR_DOMAIN_DISK_BUS_SCSI * controller = [0..3] * id = [0..6,8..15] - * virtualDev = {'buslogic', 'lsilogic'} + * virtualDev = {'buslogic', 'lsilogic', 'lsisas1068'} * * device = {VIR_DOMAIN_DISK_DEVICE_DISK, VIR_DOMAIN_DISK_DEVICE_CDROM} * bus = VIR_DOMAIN_DISK_BUS_IDE diff --git a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx b/tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx deleted file mode 100644 index 1725051..0000000 --- a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.vmx +++ /dev/null @@ -1,7 +0,0 @@ -config.version = "8" -virtualHW.version = "4" -scsi0.present = "true" -scsi0.virtualDev = "buslogic" -scsi0:0.present = "true" -scsi0:0.deviceType = "scsi-hardDisk" -scsi0:0.fileName = "harddisk.vmdk" diff --git a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml b/tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml deleted file mode 100644 index 2ffb866..0000000 --- a/tests/vmx2xmldata/vmx2xml-scsi-buslogic.xml +++ /dev/null @@ -1,20 +0,0 @@ -<domain type='vmware'> - <uuid>00000000-0000-0000-0000-000000000000</uuid> - <memory>32768</memory> - <currentMemory>32768</currentMemory> - <vcpu>1</vcpu> - <os> - <type arch='i686'>hvm</type> - </os> - <clock offset='utc'/> - <on_poweroff>destroy</on_poweroff> - <on_reboot>restart</on_reboot> - <on_crash>destroy</on_crash> - <devices> - <disk type='file' device='disk'> - <driver name='buslogic'/> - <source file='[datastore] directory/harddisk.vmdk'/> - <target dev='sda' bus='scsi'/> - </disk> - </devices> -</domain> diff --git a/tests/vmx2xmldata/vmx2xml-scsi-driver.vmx b/tests/vmx2xmldata/vmx2xml-scsi-driver.vmx new file mode 100644 index 0000000..cb055f6 --- /dev/null +++ b/tests/vmx2xmldata/vmx2xml-scsi-driver.vmx @@ -0,0 +1,17 @@ +config.version = "8" +virtualHW.version = "4" +scsi0.present = "true" +scsi0.virtualDev = "buslogic" +scsi1.present = "true" +scsi1.virtualDev = "lsilogic" +scsi2.present = "true" +scsi2.virtualDev = "lsisas1068" +scsi0:0.present = "true" +scsi0:0.deviceType = "scsi-hardDisk" +scsi0:0.fileName = "harddisk1.vmdk" +scsi1:0.present = "true" +scsi1:0.deviceType = "scsi-hardDisk" +scsi1:0.fileName = "harddisk2.vmdk" +scsi2:0.present = "true" +scsi2:0.deviceType = "scsi-hardDisk" +scsi2:0.fileName = "harddisk3.vmdk" diff --git a/tests/vmx2xmldata/vmx2xml-scsi-driver.xml b/tests/vmx2xmldata/vmx2xml-scsi-driver.xml new file mode 100644 index 0000000..1fa9ac4 --- /dev/null +++ b/tests/vmx2xmldata/vmx2xml-scsi-driver.xml @@ -0,0 +1,30 @@ +<domain type='vmware'> + <uuid>00000000-0000-0000-0000-000000000000</uuid> + <memory>32768</memory> + <currentMemory>32768</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='i686'>hvm</type> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <disk type='file' device='disk'> + <driver name='buslogic'/> + <source file='[datastore] directory/harddisk1.vmdk'/> + <target dev='sda' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsilogic'/> + <source file='[datastore] directory/harddisk2.vmdk'/> + <target dev='sdp' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsisas1068'/> + <source file='[datastore] directory/harddisk3.vmdk'/> + <target dev='sdae' bus='scsi'/> + </disk> + </devices> +</domain> diff --git a/tests/vmx2xmltest.c b/tests/vmx2xmltest.c index b4eb5d5..e75def4 100644 --- a/tests/vmx2xmltest.c +++ b/tests/vmx2xmltest.c @@ -122,7 +122,7 @@ mymain(int argc, char **argv) DO_TEST("graphics-vnc", "graphics-vnc", esxVI_APIVersion_25); - DO_TEST("scsi-buslogic", "scsi-buslogic", esxVI_APIVersion_25); + DO_TEST("scsi-driver", "scsi-driver", esxVI_APIVersion_25); DO_TEST("scsi-writethrough", "scsi-writethrough", esxVI_APIVersion_25); DO_TEST("harddisk-scsi-file", "harddisk-scsi-file", esxVI_APIVersion_25); diff --git a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx b/tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx deleted file mode 100644 index 2f98da3..0000000 --- a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.vmx +++ /dev/null @@ -1,12 +0,0 @@ -config.version = "8" -virtualHW.version = "4" -guestOS = "other" -uuid.bios = "56 4d 9b ef ac d9 b4 e0-c8 f0 ae a8 b9 10 35 15" -displayName = "scsi-buslogic" -memsize = "4" -numvcpus = "1" -scsi0.present = "true" -scsi0.virtualDev = "buslogic" -scsi0:0.present = "true" -scsi0:0.deviceType = "scsi-hardDisk" -scsi0:0.fileName = "/vmfs/volumes/datastore/directory/harddisk.vmdk" diff --git a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml b/tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml deleted file mode 100644 index 5d52c54..0000000 --- a/tests/xml2vmxdata/xml2vmx-scsi-buslogic.xml +++ /dev/null @@ -1,15 +0,0 @@ -<domain type='vmware'> - <name>scsi-buslogic</name> - <uuid>564d9bef-acd9-b4e0-c8f0-aea8b9103515</uuid> - <memory>4096</memory> - <os> - <type>hvm</type> - </os> - <devices> - <disk type='file' device='disk'> - <driver name='buslogic'/> - <source file='[datastore] directory/harddisk.vmdk'/> - <target dev='sda' bus='scsi'/> - </disk> - </devices> -</domain> diff --git a/tests/xml2vmxdata/xml2vmx-scsi-driver.vmx b/tests/xml2vmxdata/xml2vmx-scsi-driver.vmx new file mode 100644 index 0000000..7cceca0 --- /dev/null +++ b/tests/xml2vmxdata/xml2vmx-scsi-driver.vmx @@ -0,0 +1,22 @@ +config.version = "8" +virtualHW.version = "4" +guestOS = "other" +uuid.bios = "56 4d 9b ef ac d9 b4 e0-c8 f0 ae a8 b9 10 35 15" +displayName = "scsi-buslogic" +memsize = "4" +numvcpus = "1" +scsi0.present = "true" +scsi0.virtualDev = "buslogic" +scsi1.present = "true" +scsi1.virtualDev = "lsilogic" +scsi2.present = "true" +scsi2.virtualDev = "lsisas1068" +scsi0:0.present = "true" +scsi0:0.deviceType = "scsi-hardDisk" +scsi0:0.fileName = "/vmfs/volumes/datastore/directory/harddisk1.vmdk" +scsi1:0.present = "true" +scsi1:0.deviceType = "scsi-hardDisk" +scsi1:0.fileName = "/vmfs/volumes/datastore/directory/harddisk2.vmdk" +scsi2:0.present = "true" +scsi2:0.deviceType = "scsi-hardDisk" +scsi2:0.fileName = "/vmfs/volumes/datastore/directory/harddisk3.vmdk" diff --git a/tests/xml2vmxdata/xml2vmx-scsi-driver.xml b/tests/xml2vmxdata/xml2vmx-scsi-driver.xml new file mode 100644 index 0000000..797a26e --- /dev/null +++ b/tests/xml2vmxdata/xml2vmx-scsi-driver.xml @@ -0,0 +1,25 @@ +<domain type='vmware'> + <name>scsi-buslogic</name> + <uuid>564d9bef-acd9-b4e0-c8f0-aea8b9103515</uuid> + <memory>4096</memory> + <os> + <type>hvm</type> + </os> + <devices> + <disk type='file' device='disk'> + <driver name='buslogic'/> + <source file='[datastore] directory/harddisk1.vmdk'/> + <target dev='sda' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsilogic'/> + <source file='[datastore] directory/harddisk2.vmdk'/> + <target dev='sdp' bus='scsi'/> + </disk> + <disk type='file' device='disk'> + <driver name='lsisas1068'/> + <source file='[datastore] directory/harddisk3.vmdk'/> + <target dev='sdae' bus='scsi'/> + </disk> + </devices> +</domain> diff --git a/tests/xml2vmxtest.c b/tests/xml2vmxtest.c index b8b9d6f..f9c4730 100644 --- a/tests/xml2vmxtest.c +++ b/tests/xml2vmxtest.c @@ -175,7 +175,7 @@ mymain(int argc, char **argv) DO_TEST("graphics-vnc", "graphics-vnc", esxVI_APIVersion_25); - DO_TEST("scsi-buslogic", "scsi-buslogic", esxVI_APIVersion_25); + DO_TEST("scsi-driver", "scsi-driver", esxVI_APIVersion_25); DO_TEST("scsi-writethrough", "scsi-writethrough", esxVI_APIVersion_25); DO_TEST("harddisk-scsi-file", "harddisk-scsi-file", esxVI_APIVersion_25); -- 1.6.3.3

2 5

[libvirt] 0.7.8 schedule
by Daniel Veillard 29 Mar '10

29 Mar '10

So clearly we are a bit late we didn't freezed this week-end, hopefully we can push the last bits for the release tomorrow. I would be tempted to actually name the release 0.8.0 if we get the snapshot API in (which I expect), then start freeze on Wed, and make the official release early next week. There is still a few things to clean up left and right, some patches for bug fixes need ACKs, so I still expect some work before being able to declare the new release ready ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH] nwfilter_ebiptables_driver.c: avoid NULL dereference
by Jim Meyering 29 Mar '10

29 Mar '10

Another one caught by clang: Note the first test to see if "inst" may be NULL. Then, in the following loop, "inst" is unconditionally dereferenced via "inst[i]". There are other unprotected used of "inst[i]" below, too. Rather than trying to protect all uses, one by one, I chose to return "success" when given an empty list of rules. In addition, not only does it appear to be possible to call this function with a NULL "inst" pointer, but it may even be undefined. At least one caller is virNWFilterInstantiate, where "inst" maps to the caller's "ptrs" variable. There, ptrs is initialized (or not, in some cases) by virNWFilterRuleInstancesToArray. Fortunately, at least this one caller (virNWFilterRuleInstancesToArray) does initialize "ptrs" to NULL, so in actuality, it cannot currently be used undefined. But the fact that a function like virNWFilterRuleInstancesToArray can return "successfully" without defining that output parameter is a little risky. >From f2d1a49095ed6f7caa3d5ee67409ac561c55ba77 Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Mon, 29 Mar 2010 18:27:26 +0200 Subject: [PATCH] nwfilter_ebiptables_driver.c: avoid NULL dereference * src/nwfilter/nwfilter_ebiptables_driver.c (ebiptablesApplyNewRules): Don't dereference a NULL or uninitialized pointer when given an empty list of rules --- src/nwfilter/nwfilter_ebiptables_driver.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 7871926..3932b44 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -2378,31 +2378,32 @@ ebiptablesRuleOrderSort(const void *a, const void *b) static int ebiptablesApplyNewRules(virConnectPtr conn, const char *ifname, int nruleInstances, void **_inst) { int i; int cli_status; ebiptablesRuleInstPtr *inst = (ebiptablesRuleInstPtr *)_inst; int chains_in = 0, chains_out = 0; virBuffer buf = VIR_BUFFER_INITIALIZER; int haveIptables = 0; - if (inst) - qsort(inst, nruleInstances, sizeof(inst[0]), - ebiptablesRuleOrderSort); + if (nruleInstances == 0 || inst == NULL) + return 0; + + qsort(inst, nruleInstances, sizeof(inst[0]), ebiptablesRuleOrderSort); for (i = 0; i < nruleInstances; i++) { if (inst[i]->ruleType == RT_EBTABLES) { if (inst[i]->chainprefix == CHAINPREFIX_HOST_IN_TEMP) chains_in |= (1 << inst[i]->neededProtocolChain); else chains_out |= (1 << inst[i]->neededProtocolChain); } } ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); ebtablesRemoveTmpSubChains(conn, &buf, ifname); ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); -- 1.7.0.3.448.g82eeb

4 7