- Devel - libvirt List Archives

[libvirt] [PATCH 8/14] Implementation of the RPC call dispatch
by Stefan Berger 18 Mar '10

18 Mar '10

This patch extends the RPC dispatcher to support the newly added RPC calls for network filtering (ACL) support. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>

1 0

[libvirt] [PATCH 7/14] Implementation of the RPC client
by Stefan Berger 18 Mar '10

18 Mar '10

This patch extends the RPC client for the new network filtering (ACL) functionality. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>

1 0

[libvirt] [PATCH 6/14] Definition of the wire format
by Stefan Berger 18 Mar '10

18 Mar '10

This patch adds the definition of the wire format for RPC calls for the new network filtering (ACL) functionality added to libvirt. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>

1 0

[libvirt] [PATCH 4/14] Add internal API
by Stefan Berger 18 Mar '10

18 Mar '10

This patch adds the internal API extensions for network filtering (ACL) support. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>

1 0

[libvirt] [PATCH 3/14] Add public API
by Stefan Berger 18 Mar '10

18 Mar '10

This patch adds extensions to libvirt's public API necessary for controlling the new functionality from remote for example. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>

1 0

[libvirt] [PATCH 0/14 [RFC] Network filtering (ACL) extensions for libvirt
by Stefan Berger 18 Mar '10

18 Mar '10

Hi! This is a repost of this set of patches with some of the fixes recommended by Daniel Berrange applied and ipv6 support on the ebtables layer added. The following set of patches add network filtering (ACL) extensions to libvirt and enable network traffic filtering for VMs using ebtables and, depending on the networking technology being used (tap, but not macvtap), also iptables. Usage of either is optional and controlled through filters that a VM is referencing. The ebtables-level filtering is based on the XML derived from the CIM network slide 10 (filtering) from the DMTF website (http://www.dmtf.org/standards/cim/cim_schema_v2230/CIM_Network.pdf) The XML we derived from this was discussed on the list before. On the ebtables level we currently handle filtering of IPv4 and ARP traffic. The iptables-level filtering is based on similar XML where XML nodes described the particular protocol to filter for. Its extensions enable the filtering of traffic using iptables for tcp, udp, icmp, igmp, sctp and 'all' types of traffic. This list of protocols maps to the features supported by iptables and only excludes protocols like 'esp', 'ah' and 'udplite'. Currently only bridging mode is supported and based on availability of the physdev match. The filtering framework adds new libvirt virsh commands for managing the filters. The 5 new commands are: - virsh nwfilter-list - virsh nwfilter-dumpxml <name of filter> - virsh nwfilter-define <name of file containing filter desc.> - virsh nwfilter-undefine <name of filter> - virsh nwfilter-edit <name of filter> Above commands are similar to commands for already existing pools and as such much of the code directly related to the above commands could be borrowed from other drivers. The network filters can either contain rules using the above mentioned XML or contain references to other filters in order to build more complex filters that form some sort of filter tree or can contain both. An example for a filter referencing other filters would be this one here: <filter name='demofilter4' chain='root'> <uuid>66f62d1d-34c1-1421-824f-c62d5ee5e8b6</uuid> <filterref filter='no-mac-spoofing'/> <filterref filter='no-mac-broadcast'/> <filterref filter='no-arp-spoofing'/> <filterref filter='allow-dhcp'> <parameter name='DHCPSERVER' value='10.0.0.1'/> </filterref> <filterref filter='no-other-l2-traffic'/> <filterref filter='recv-only-vm-ipaddress'/> <filterref filter='recv-only-vm-macaddress'/> <filterref filter='l3-test'/> <filterref filter='ipv6test'/> </filter> A filter containing actual rules would look like this: <filter name='no-mac-broadcast' chain='ipv4'> <uuid>ffe2ccd6-edec-7360-1852-6b5ccb553234</uuid> <rule action='drop' direction='out' priority='500'> <mac dstmacaddr='ff:ff:ff:ff:ff:ff'/> </rule> </filter> The filter XML now also holds a priority attribute in the rule. This provides control over the ordering of the applied ebtables/iptables rules beyond their appearance in the XML. The domain XML has been extended to reference a top level filter from within each <interface> XML node. A valid reference to such a top level filter looks like this: <interface type='bridge'> <source bridge='static'/> <filterref filter='demofilter4'> <parameter name='IP' value='9.59.241.151'/> </filterref> </interface> In this XML a parameter IP is passed for instantiation of the referenced filters, that may require the availability of this parameter. In the above case the IP parameter's value describes the value of the IP address of the VM and allows to enable those filters to be instantiated that require this 'IP' variable. If a filter requires a parameter that is not provided, the VM will not start or the interface will not attach to a running VM. Any names of parameters can be provided for instantiation of filters and their names and values only need to pass a regular expression test. In a subsequent patch we will be adding capability to allow users to omit the IP parameter (only) and enable libvirt to learn the IP address of the VM and have it instantiate the filter once it knows it. While virtual machines are running, it is possible to update their filters. For that all running VMs' filter 'trees' are traversed to detect whether the updated filter is referenced by the VM. If so, its ebtables/iptable rules are applied. If one of the VMs' update fails allupdates are rolled back and the filter XML update is rejected. One comment about the instantiation of the rules: Since the XML allows to create nearly any possible combination of parameters to ebtables or iptables commands, I haven't used the ebtables or iptables wrappers. Instead, I am writing ebtables/iptables command into a buffer, add command line options to each one of them as described in the rule's XML, write the buffer into a file and run it as a script. For those commands that are not allowed to fail I am using the following format to run them: cmd="ebtables <some options>" r=`${cmd}` if [ $? -ne 0 ]; then echo "Failure in command ${cmd}." exit 1 fi cmd="..." [...] If one of the command fails in such a batch, the libvirt code is going pick up the error code '1', tear down anything previously established and report an error back. The actual error message shown above is currently not reported back, but can be later on with some changes to the commands running external programs that need to read the script's stdout. One comment to patch 14: It currently #include's a .c file into a .c file only for the reason so I don't have to change too much code once I change code in the underlying patch. So this has to be changed. The patch series works without patch 13, but then only supports ebtables. The patches apply to the current tip. They pass 'make syntax-check' and have been frequently run in valgrind for memory leak checks. The order in which I apply the patches is as follows: add_recursive_locks.diff add_build_support.diff add_public_api.diff add_internal_api.diff impl_pub_api.diff def_wire_protocol_format.diff impl_rpc_client.c impl_srv_dispatch.diff add_virsh_support.diff add_xml_parsing.diff add_qemu_support.diff impl_driver.diff add_ipv6_support.diff add_iptables_support.diff Looking forward to your feedback on the patches. Thanks and regards, Stefan and Gerhard

1 0

[libvirt] [PATCH] website: Increase text size
by Cole Robinson 18 Mar '10

18 Mar '10

Personally I find the text so small it is difficult to read, especially in the documentation pages where we can have a large wall of text. Here is a before and after shot of the main page on my machine (scaled down): http://fedorapeople.org/~crobinso/tmp/libvirt-web-before-after.png Text size is now similar to linux-kvm.org, which I find much easier to read. Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- docs/generic.css | 10 +++++----- docs/libvirt.css | 1 + 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/generic.css b/docs/generic.css index dbf7b56..d9cf49e 100644 --- a/docs/generic.css +++ b/docs/generic.css @@ -43,22 +43,22 @@ div.footer { } h1 { - font-size: 2em; + font-size: 1.6em; } h2 { - font-size: 1.6em; + font-size: 1.4em; } h3 { - font-size: 1.4em; + font-size: 1.2em; } h4 { - font-size: 1.2em; + font-size: 1.1em; } h5 { font-size: 1em; } h6 { - font-size: 0.8em; + font-size: 0.9em; } dl dt { diff --git a/docs/libvirt.css b/docs/libvirt.css index dfc93c6..46e9a3f 100644 --- a/docs/libvirt.css +++ b/docs/libvirt.css @@ -33,6 +33,7 @@ h2, h3, h4, h5, h6 { margin-right: 1em; padding: 0px; padding-bottom: 1em; + font-size: larger; } #menu { -- 1.6.6.1

3 3

[libvirt] [PATCH 0/5] Introduce virDomainMigrateSetDowntime API
by Jiri Denemark 18 Mar '10

18 Mar '10

This API call is supposed to change maximum tolerable downtime for live migrations. Jiri Denemark (5): Internal driver API for virDomainMigrateSetDowntime Public virDomainMigrateSetDowntime API Implement virDomainMigrateSetDowntime in remote driver Wire protocol and dispatcher for virDomainMigrateSetDowntime Implement virDomainMigrateSetDowntime in qemu driver daemon/remote.c | 29 ++++++++++ daemon/remote_dispatch_args.h | 1 + daemon/remote_dispatch_prototypes.h | 8 +++ daemon/remote_dispatch_table.h | 5 ++ include/libvirt/libvirt.h.in | 3 + src/driver.h | 5 ++ src/esx/esx_driver.c | 1 + src/libvirt.c | 46 ++++++++++++++++ src/libvirt_public.syms | 5 ++ src/lxc/lxc_driver.c | 1 + src/opennebula/one_driver.c | 1 + src/openvz/openvz_driver.c | 1 + src/phyp/phyp_driver.c | 1 + src/qemu/qemu_driver.c | 47 +++++++++++++++++ src/qemu/qemu_monitor.c | 15 +++++ src/qemu/qemu_monitor.h | 3 + src/qemu/qemu_monitor_json.c | 29 ++++++++++ src/qemu/qemu_monitor_json.h | 3 + src/qemu/qemu_monitor_text.c | 27 ++++++++++ src/qemu/qemu_monitor_text.h | 3 + src/remote/remote_driver.c | 27 ++++++++++ src/remote/remote_protocol.c | 11 ++++ src/remote/remote_protocol.h | 97 +++++++++++++++++++---------------- src/remote/remote_protocol.x | 9 +++- src/test/test_driver.c | 1 + src/uml/uml_driver.c | 1 + src/vbox/vbox_tmpl.c | 1 + src/xen/xen_driver.c | 1 + src/xenapi/xenapi_driver.c | 1 + 29 files changed, 338 insertions(+), 45 deletions(-)

4 18

[libvirt] [PATCH] maint: enforce recent N_ usage
by Eric Blake 18 Mar '10

18 Mar '10

* cfg.mk (sc_prohibit_gettext_noop): New rule. --- cfg.mk | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/cfg.mk b/cfg.mk index 3fd9f7b..5b4d6ed 100644 --- a/cfg.mk +++ b/cfg.mk @@ -105,6 +105,11 @@ sc_prohibit_gethostname: msg='use virGetHostname, not gethostname' \ $(_prohibit_regexp) +sc_prohibit_gettext_noop: + @re='gettext_noop *\(' \ + msg='use _N, not gettext_noop' \ + $(_prohibit_regexp) + sc_prohibit_VIR_ERR_NO_MEMORY: @re='\<V''IR_ERR_NO_MEMORY\>' \ msg='use virReportOOMError, not V'IR_ERR_NO_MEMORY \ -- 1.6.6.1

2 2

[libvirt] View graphical desktop of linux distribution through libvirt.
by Kumar L Srikanth-B22348 18 Mar '10

18 Mar '10

Hi Daniel, Is it possible to view the graphical desktop(startx) of any linux distribution in libvirt through Linux Container(LXC)? If it is possible, what are the necessary dependents we need to take care in the Domain XML or in the minimal Root file system of the linux distribution. Can you please let me know. Regards, Srikanth.

1 0