- Devel - libvirt List Archives

[libvirt] [RFC] Support for qemu's virtio-rng
by Peter Krempa 19 Dec '12

19 Dec '12

Commit 16c915ba42b45df7a64a6908287f03bfa3764bed in the qemu.git tree introduced support for emulating a virtio-rng device used to pass-through entropy to the guests. Qemu provides two backends to gather entropy from: 1) Default chardev backend This backend supports reading non-blocking character devices that provide entropy such as /dev/random (by default) or others according to configuration. This backend also supports basic rate limiting of the entropy read from the source. Unfortunately as the rate limiting is done just on a per-guest basis this cannot protect the host from being starved of entropy by multiple guests although their individual rates are limited. 2) EGD backend This backend uses the EGD protocol to communicate with a daemon that servers entropy. The EGD protocol is a simple protocol that was introduced by the entropy gathering daemon (a substitute for /dev/random on machines that don't support it). This protocol can be used for centralized management of entropy allocation to the hosts. This by itself isn't really useful as implementations of EGD daemons are trying to create the entropy instead of using available sources and multiplexing/rate-limiting them. For this functionality we will (probably) need a separate server to serve the entropy to the guests but more on this topic later. To represent the configuration of the virtio-rng device to the guest I propose the following domain XML snipped to be used: For the first use case I propose: <domain> [...] <devices> [...] <rng model='virtio'> <rate bytes='1024' period='1000'/> <source type='char'>/dev/urandom</source> -- or -- <source type='char'/> -- for the default source -- </rng> </devices> </domain> For the EGD backend used manually (without any managed server) I propose: <rng model='virtio'> <rate bytes='1024' period='1000'/> <source type='egd'> <remote type='unix'>/path/to/socket</remote> -- or -- <remote type='tcp' port='12345'>host.addr</remote> -- optionally or even more options, but they don't seem useful </source> </rng> Now these solutions are mere envelopes on top of the qemu functionality and don't really let us do any advanced configuration or management and they don't protect the host or guests by themselves from starving others from entropy. The solution for the problem described above is to have a central point where guests can request entropy and this central point will do all the rate limiting. To do this we will need to add a daemon that will talk the EGD protocol. This daemon will need to read entropy on request from the kernel software entropy device (/dev/random) or possibly a hardware RNG and distribute it to the hosts. To enable concurrent access and avoid starvation the daemon will implement a "shaping protocol" based on the hierarchical token bucket approach used to rate-limit network flows. For implementation details on this one I'll send a separate RFC. To allow configuration of the groups and sources I propose to create a separate driver with infrastructure similar to the network driver. This will allow to start multiple entropy distribution daemons with different sources and define the hierarchical classes to allow guest grouping. With this infrastructure you will be able to specify the rng device as follows: <rng model='virtio'> <source type='pool' pool='default'>classname</source> </rng> This will auto-configure all parameters according to the configuration of the pool and ensure that te guest gets classified correctly. As the start I'll implement the two basic options and then I'll propose another RFC how I will approach the second part more closely. Peter

2 1

[libvirt] [PATCH] Add smartcard support to libvirt-gconfig
by alexl＠redhat.com 19 Dec '12

19 Dec '12

From: Alexander Larsson <alexl(a)redhat.com> This handles <smartcard> devices. --- libvirt-gconfig/Makefile.am | 8 ++ .../libvirt-gconfig-domain-device-private.h | 3 + libvirt-gconfig/libvirt-gconfig-domain-device.c | 2 +- ...rt-gconfig-domain-smartcard-host-certificates.c | 124 +++++++++++++++++++++ ...rt-gconfig-domain-smartcard-host-certificates.h | 74 ++++++++++++ .../libvirt-gconfig-domain-smartcard-host.c | 75 +++++++++++++ .../libvirt-gconfig-domain-smartcard-host.h | 67 +++++++++++ .../libvirt-gconfig-domain-smartcard-passthrough.c | 116 +++++++++++++++++++ .../libvirt-gconfig-domain-smartcard-passthrough.h | 70 ++++++++++++ libvirt-gconfig/libvirt-gconfig-domain-smartcard.c | 90 +++++++++++++++ libvirt-gconfig/libvirt-gconfig-domain-smartcard.h | 67 +++++++++++ libvirt-gconfig/libvirt-gconfig.h | 4 + libvirt-gconfig/libvirt-gconfig.sym | 21 ++++ 13 files changed, 720 insertions(+), 1 deletion(-) create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-smartcard-host-certificates.c create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-smartcard-host-certificates.h create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-smartcard-host.c create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-smartcard-host.h create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-smartcard-passthrough.c create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-smartcard-passthrough.h create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-smartcard.c create mode 100644 libvirt-gconfig/libvirt-gconfig-domain-smartcard.h diff --git a/libvirt-gconfig/Makefile.am b/libvirt-gconfig/Makefile.am index 507e733..6b3b2cb 100644 --- a/libvirt-gconfig/Makefile.am +++ b/libvirt-gconfig/Makefile.am @@ -54,6 +54,10 @@ GCONFIG_HEADER_FILES = \ libvirt-gconfig-domain-redirdev.h \ libvirt-gconfig-domain-seclabel.h \ libvirt-gconfig-domain-serial.h \ + libvirt-gconfig-domain-smartcard.h \ + libvirt-gconfig-domain-smartcard-host.h \ + libvirt-gconfig-domain-smartcard-host-certificates.h \ + libvirt-gconfig-domain-smartcard-passthrough.h \ libvirt-gconfig-domain-snapshot.h \ libvirt-gconfig-domain-sound.h \ libvirt-gconfig-domain-timer.h \ @@ -127,6 +131,10 @@ GCONFIG_SOURCE_FILES = \ libvirt-gconfig-domain-redirdev.c \ libvirt-gconfig-domain-seclabel.c \ libvirt-gconfig-domain-serial.c \ + libvirt-gconfig-domain-smartcard.c \ + libvirt-gconfig-domain-smartcard-host.c \ + libvirt-gconfig-domain-smartcard-host-certificates.c \ + libvirt-gconfig-domain-smartcard-passthrough.c \ libvirt-gconfig-domain-snapshot.c \ libvirt-gconfig-domain-sound.c \ libvirt-gconfig-domain-timer.c \ diff --git a/libvirt-gconfig/libvirt-gconfig-domain-device-private.h b/libvirt-gconfig/libvirt-gconfig-domain-device-private.h index 3ec83c3..d8ac47f 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-device-private.h +++ b/libvirt-gconfig/libvirt-gconfig-domain-device-private.h @@ -45,6 +45,9 @@ gvir_config_domain_graphics_new_from_tree(GVirConfigXmlDoc *doc, GVirConfigDomainDevice * gvir_config_domain_interface_new_from_tree(GVirConfigXmlDoc *doc, xmlNodePtr tree); +GVirConfigDomainDevice * +gvir_config_domain_smartcard_new_from_tree(GVirConfigXmlDoc *doc, + xmlNodePtr tree); G_END_DECLS diff --git a/libvirt-gconfig/libvirt-gconfig-domain-device.c b/libvirt-gconfig/libvirt-gconfig-domain-device.c index 60d6bcc..e3dbe8d 100644 --- a/libvirt-gconfig/libvirt-gconfig-domain-device.c +++ b/libvirt-gconfig/libvirt-gconfig-domain-device.c @@ -72,7 +72,7 @@ gvir_config_domain_device_new_from_tree(GVirConfigXmlDoc *doc, } else if (xmlStrEqual(tree->name, (xmlChar*)"redirdev")) { type = GVIR_CONFIG_TYPE_DOMAIN_REDIRDEV; } else if (xmlStrEqual(tree->name, (xmlChar*)"smartcard")) { - goto unimplemented; + return gvir_config_domain_smartcard_new_from_tree(doc, tree); } else if (xmlStrEqual(tree->name, (xmlChar*)"interface")) { return gvir_config_domain_interface_new_from_tree(doc, tree); } else if (xmlStrEqual(tree->name, (xmlChar*)"input")) { diff --git a/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host-certificates.c b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host-certificates.c new file mode 100644 index 0000000..c013be7 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host-certificates.c @@ -0,0 +1,124 @@ +/* + * libvirt-gconfig-domain-smartcard-host-certificates.c: libvirt domain smartcard host-certificates configuration + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Alexander Larsson <alexl(a)redhat.com> + */ + +#include <config.h> + +#include "libvirt-gconfig/libvirt-gconfig.h" +#include "libvirt-gconfig/libvirt-gconfig-private.h" + +#define GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_CERTIFICATES_GET_PRIVATE(obj) \ + (G_TYPE_INSTANCE_GET_PRIVATE((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST_CERTIFICATES, GVirConfigDomainSmartcardHostCertificatesPrivate)) + +struct _GVirConfigDomainSmartcardHostCertificatesPrivate +{ + gboolean unused; +}; + +G_DEFINE_TYPE(GVirConfigDomainSmartcardHostCertificates, gvir_config_domain_smartcard_host_certificates, GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD); + + +static void gvir_config_domain_smartcard_host_certificates_class_init(GVirConfigDomainSmartcardHostCertificatesClass *klass) +{ + g_type_class_add_private(klass, sizeof(GVirConfigDomainSmartcardHostCertificatesPrivate)); +} + + +static void gvir_config_domain_smartcard_host_certificates_init(GVirConfigDomainSmartcardHostCertificates *smartcard) +{ + g_debug("Init GVirConfigDomainSmartcardHostCertificates=%p", smartcard); + + smartcard->priv = GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_CERTIFICATES_GET_PRIVATE(smartcard); +} + + +GVirConfigDomainSmartcardHostCertificates *gvir_config_domain_smartcard_host_certificates_new(void) +{ + GVirConfigObject *object; + + object = gvir_config_object_new(GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST_CERTIFICATES, + "smartcard", NULL); + gvir_config_object_set_attribute(object, "mode", "host-certificates", NULL); + return GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_CERTIFICATES(object); +} + +GVirConfigDomainSmartcardHostCertificates *gvir_config_domain_smartcard_host_certificates_new_from_xml(const gchar *xml, + GError **error) +{ + GVirConfigObject *object; + + object = gvir_config_object_new_from_xml(GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST_CERTIFICATES, + "smartcard", NULL, xml, error); + if (g_strcmp0(gvir_config_object_get_attribute(object, NULL, "mode"), "host-certificates") != 0) { + g_object_unref(G_OBJECT(object)); + return NULL; + } + return GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_CERTIFICATES(object); +} + +/** + * gvir_config_domain_smartcard_host_certificates_set_database: + * @path: (allow-none): + */ +void +gvir_config_domain_smartcard_host_certificates_set_database (GVirConfigDomainSmartcardHostCertificates *smartcard, + const char *path) +{ + g_return_if_fail(GVIR_CONFIG_IS_DOMAIN_SMARTCARD_HOST_CERTIFICATES(smartcard)); + + gvir_config_object_set_node_content(GVIR_CONFIG_OBJECT(smartcard), + "database", path); +} + +/** + * gvir_config_domain_smartcard_host_certificates_set_certificates: + * @cert1: (allow-none): + * @cert2: (allow-none): + * @cert3: (allow-none): + */ +void +gvir_config_domain_smartcard_host_certificates_set_certificates (GVirConfigDomainSmartcardHostCertificates *smartcard, + const char *cert1, + const char *cert2, + const char *cert3) +{ + GVirConfigObject *child; + + g_return_if_fail(GVIR_CONFIG_IS_DOMAIN_SMARTCARD_HOST_CERTIFICATES(smartcard)); + + gvir_config_object_delete_children(GVIR_CONFIG_OBJECT(smartcard), + "certificate", NULL); + + if (cert1 == NULL) + return; + + child = gvir_config_object_add_child(GVIR_CONFIG_OBJECT(smartcard), "certificate"); + gvir_config_object_set_node_content(GVIR_CONFIG_OBJECT(smartcard), NULL, cert1); + g_object_unref(G_OBJECT(child)); + + child = gvir_config_object_add_child(GVIR_CONFIG_OBJECT(smartcard), "certificate"); + gvir_config_object_set_node_content(GVIR_CONFIG_OBJECT(smartcard), NULL, cert2); + g_object_unref(G_OBJECT(child)); + + child = gvir_config_object_add_child(GVIR_CONFIG_OBJECT(smartcard), "certificate"); + gvir_config_object_set_node_content(GVIR_CONFIG_OBJECT(smartcard), NULL, cert3); + g_object_unref(G_OBJECT(child)); +} diff --git a/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host-certificates.h b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host-certificates.h new file mode 100644 index 0000000..3d370e3 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host-certificates.h @@ -0,0 +1,74 @@ +/* + * libvirt-gconfig-domain-smartcard-host-certificates.h: libvirt domain smartcard host-certificates configuration + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Alexander Larsson <alexl(a)redhat.com> + */ + +#if !defined(__LIBVIRT_GCONFIG_H__) && !defined(LIBVIRT_GCONFIG_BUILD) +#error "Only <libvirt-gconfig/libvirt-gconfig.h> can be included directly." +#endif + +#ifndef __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_HOST_CERTIFICATES_H__ +#define __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_HOST_CERTIFICATES_H__ + +G_BEGIN_DECLS + +#define GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST_CERTIFICATES (gvir_config_domain_smartcard_host_certificates_get_type ()) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_CERTIFICATES(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST_CERTIFICATES, GVirConfigDomainSmartcardHostCertificates)) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_CERTIFICATES_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST ((klass), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST_CERTIFICATES, GVirConfigDomainSmartcardHostCertificatesClass)) +#define GVIR_CONFIG_IS_DOMAIN_SMARTCARD_HOST_CERTIFICATES(obj) (G_TYPE_CHECK_INSTANCE_TYPE ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST_CERTIFICATES)) +#define GVIR_CONFIG_IS_DOMAIN_SMARTCARD_HOST_CERTIFICATES_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST_CERTIFICATES)) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_CERTIFICATES_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST_CERTIFICATES, GVirConfigDomainSmartcardHostCertificatesClass)) + +typedef struct _GVirConfigDomainSmartcardHostCertificates GVirConfigDomainSmartcardHostCertificates; +typedef struct _GVirConfigDomainSmartcardHostCertificatesPrivate GVirConfigDomainSmartcardHostCertificatesPrivate; +typedef struct _GVirConfigDomainSmartcardHostCertificatesClass GVirConfigDomainSmartcardHostCertificatesClass; + +struct _GVirConfigDomainSmartcardHostCertificates +{ + GVirConfigDomainSmartcard parent; + + GVirConfigDomainSmartcardHostCertificatesPrivate *priv; + + /* Do not add fields to this struct */ +}; + +struct _GVirConfigDomainSmartcardHostCertificatesClass +{ + GVirConfigDomainSmartcardClass parent_class; + + gpointer padding[20]; +}; + +GType gvir_config_domain_smartcard_host_certificates_get_type(void); + +GVirConfigDomainSmartcardHostCertificates *gvir_config_domain_smartcard_host_certificates_new(void); +GVirConfigDomainSmartcardHostCertificates *gvir_config_domain_smartcard_host_certificates_new_from_xml(const gchar *xml, + GError **error); + +void gvir_config_domain_smartcard_host_certificates_set_database (GVirConfigDomainSmartcardHostCertificates *smartcard, + const char *path); +void gvir_config_domain_smartcard_host_certificates_set_certificates (GVirConfigDomainSmartcardHostCertificates *smartcard, + const char *cert1, + const char *cert2, + const char *cert3); + +G_END_DECLS + +#endif /* __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_HOST_CERTIFICATES_H__ */ diff --git a/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host.c b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host.c new file mode 100644 index 0000000..035c291 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host.c @@ -0,0 +1,75 @@ +/* + * libvirt-gconfig-domain-smartcard-host.c: libvirt domain smartcard host configuration + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Alexander Larsson <alexl(a)redhat.com> + */ + +#include <config.h> + +#include "libvirt-gconfig/libvirt-gconfig.h" +#include "libvirt-gconfig/libvirt-gconfig-private.h" + +#define GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_GET_PRIVATE(obj) \ + (G_TYPE_INSTANCE_GET_PRIVATE((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST, GVirConfigDomainSmartcardHostPrivate)) + +struct _GVirConfigDomainSmartcardHostPrivate +{ + gboolean unused; +}; + +G_DEFINE_TYPE(GVirConfigDomainSmartcardHost, gvir_config_domain_smartcard_host, GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD); + + +static void gvir_config_domain_smartcard_host_class_init(GVirConfigDomainSmartcardHostClass *klass) +{ + g_type_class_add_private(klass, sizeof(GVirConfigDomainSmartcardHostPrivate)); +} + + +static void gvir_config_domain_smartcard_host_init(GVirConfigDomainSmartcardHost *smartcard) +{ + g_debug("Init GVirConfigDomainSmartcardHost=%p", smartcard); + + smartcard->priv = GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_GET_PRIVATE(smartcard); +} + + +GVirConfigDomainSmartcardHost *gvir_config_domain_smartcard_host_new(void) +{ + GVirConfigObject *object; + + object = gvir_config_object_new(GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST, + "smartcard", NULL); + gvir_config_object_set_attribute(object, "mode", "host", NULL); + return GVIR_CONFIG_DOMAIN_SMARTCARD_HOST(object); +} + +GVirConfigDomainSmartcardHost *gvir_config_domain_smartcard_host_new_from_xml(const gchar *xml, + GError **error) +{ + GVirConfigObject *object; + + object = gvir_config_object_new_from_xml(GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST, + "smartcard", NULL, xml, error); + if (g_strcmp0(gvir_config_object_get_attribute(object, NULL, "mode"), "host") != 0) { + g_object_unref(G_OBJECT(object)); + return NULL; + } + return GVIR_CONFIG_DOMAIN_SMARTCARD_HOST(object); +} diff --git a/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host.h b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host.h new file mode 100644 index 0000000..f1dcba2 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-host.h @@ -0,0 +1,67 @@ +/* + * libvirt-gconfig-domain-smartcard-host.h: libvirt domain smartcard host configuration + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Alexander Larsson <alexl(a)redhat.com> + */ + +#if !defined(__LIBVIRT_GCONFIG_H__) && !defined(LIBVIRT_GCONFIG_BUILD) +#error "Only <libvirt-gconfig/libvirt-gconfig.h> can be included directly." +#endif + +#ifndef __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_HOST_H__ +#define __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_HOST_H__ + +G_BEGIN_DECLS + +#define GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST (gvir_config_domain_smartcard_host_get_type ()) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_HOST(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST, GVirConfigDomainSmartcardHost)) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST ((klass), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST, GVirConfigDomainSmartcardHostClass)) +#define GVIR_CONFIG_IS_DOMAIN_SMARTCARD_HOST(obj) (G_TYPE_CHECK_INSTANCE_TYPE ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST)) +#define GVIR_CONFIG_IS_DOMAIN_SMARTCARD_HOST_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST)) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_HOST_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST, GVirConfigDomainSmartcardHostClass)) + +typedef struct _GVirConfigDomainSmartcardHost GVirConfigDomainSmartcardHost; +typedef struct _GVirConfigDomainSmartcardHostPrivate GVirConfigDomainSmartcardHostPrivate; +typedef struct _GVirConfigDomainSmartcardHostClass GVirConfigDomainSmartcardHostClass; + +struct _GVirConfigDomainSmartcardHost +{ + GVirConfigDomainSmartcard parent; + + GVirConfigDomainSmartcardHostPrivate *priv; + + /* Do not add fields to this struct */ +}; + +struct _GVirConfigDomainSmartcardHostClass +{ + GVirConfigDomainSmartcardClass parent_class; + + gpointer padding[20]; +}; + +GType gvir_config_domain_smartcard_host_get_type(void); + +GVirConfigDomainSmartcardHost *gvir_config_domain_smartcard_host_new(void); +GVirConfigDomainSmartcardHost *gvir_config_domain_smartcard_host_new_from_xml(const gchar *xml, + GError **error); + +G_END_DECLS + +#endif /* __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_HOST_H__ */ diff --git a/libvirt-gconfig/libvirt-gconfig-domain-smartcard-passthrough.c b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-passthrough.c new file mode 100644 index 0000000..10fd460 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-passthrough.c @@ -0,0 +1,116 @@ +/* + * libvirt-gconfig-domain-smartcard-passthrough.c: libvirt domain smartcard passthrough configuration + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Alexander Larsson <alexl(a)redhat.com> + */ + +#include <config.h> + +#include "libvirt-gconfig/libvirt-gconfig.h" +#include "libvirt-gconfig/libvirt-gconfig-private.h" + +#define GVIR_CONFIG_DOMAIN_SMARTCARD_PASSTHROUGH_GET_PRIVATE(obj) \ + (G_TYPE_INSTANCE_GET_PRIVATE((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_PASSTHROUGH, GVirConfigDomainSmartcardPassthroughPrivate)) + +struct _GVirConfigDomainSmartcardPassthroughPrivate +{ + gboolean unused; +}; + +G_DEFINE_TYPE(GVirConfigDomainSmartcardPassthrough, gvir_config_domain_smartcard_passthrough, GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD); + + +static void gvir_config_domain_smartcard_passthrough_class_init(GVirConfigDomainSmartcardPassthroughClass *klass) +{ + g_type_class_add_private(klass, sizeof(GVirConfigDomainSmartcardPassthroughPrivate)); +} + + +static void gvir_config_domain_smartcard_passthrough_init(GVirConfigDomainSmartcardPassthrough *smartcard) +{ + g_debug("Init GVirConfigDomainSmartcardPassthrough=%p", smartcard); + + smartcard->priv = GVIR_CONFIG_DOMAIN_SMARTCARD_PASSTHROUGH_GET_PRIVATE(smartcard); +} + + +GVirConfigDomainSmartcardPassthrough *gvir_config_domain_smartcard_passthrough_new(void) +{ + GVirConfigObject *object; + + object = gvir_config_object_new(GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_PASSTHROUGH, + "smartcard", NULL); + gvir_config_object_set_attribute(object, "mode", "passthrough", NULL); + return GVIR_CONFIG_DOMAIN_SMARTCARD_PASSTHROUGH(object); +} + +GVirConfigDomainSmartcardPassthrough *gvir_config_domain_smartcard_passthrough_new_from_xml(const gchar *xml, + GError **error) +{ + GVirConfigObject *object; + + object = gvir_config_object_new_from_xml(GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_PASSTHROUGH, + "smartcard", NULL, xml, error); + if (g_strcmp0(gvir_config_object_get_attribute(object, NULL, "mode"), "passthrough") != 0) { + g_object_unref(G_OBJECT(object)); + return NULL; + } + return GVIR_CONFIG_DOMAIN_SMARTCARD_PASSTHROUGH(object); +} + + +static void prepend_prop(xmlNodePtr node, xmlAttrPtr prop) +{ + if (node->properties == NULL) { + node->properties = prop; + } else { + prop->next = node->properties; + node->properties->prev = prop; + node->properties = prop; + } +} + +void +gvir_config_domain_smartcard_passthrough_set_source(GVirConfigDomainSmartcardPassthrough *smartcard, + GVirConfigDomainChardevSource *source) +{ + xmlNodePtr smartcard_node; + xmlNodePtr source_node; + xmlNodePtr child; + xmlAttrPtr attr; + + g_return_if_fail(GVIR_CONFIG_IS_DOMAIN_SMARTCARD_PASSTHROUGH(smartcard)); + g_return_if_fail(GVIR_CONFIG_IS_DOMAIN_CHARDEV_SOURCE(source)); + + smartcard_node = gvir_config_object_get_xml_node(GVIR_CONFIG_OBJECT(smartcard)); + source_node = gvir_config_object_get_xml_node(GVIR_CONFIG_OBJECT(source)); + + g_return_if_fail((smartcard_node != NULL) && (source_node != NULL)); + + for (child = source_node->children; child != NULL; child = child->next) { + xmlUnlinkNode(child); + xmlAddChild(smartcard_node, child); + } + + for (attr = source_node->properties; attr != NULL; attr = attr->next) { + xmlAttrPtr new_attr; + new_attr = xmlCopyProp(smartcard_node, attr); + prepend_prop(smartcard_node, new_attr); + } +} diff --git a/libvirt-gconfig/libvirt-gconfig-domain-smartcard-passthrough.h b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-passthrough.h new file mode 100644 index 0000000..c2bd50c --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-smartcard-passthrough.h @@ -0,0 +1,70 @@ +/* + * libvirt-gconfig-domain-smartcard-passthrough.h: libvirt domain smartcard passthrough configuration + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Alexander Larsson <alexl(a)redhat.com> + */ + +#if !defined(__LIBVIRT_GCONFIG_H__) && !defined(LIBVIRT_GCONFIG_BUILD) +#error "Only <libvirt-gconfig/libvirt-gconfig.h> can be included directly." +#endif + +#ifndef __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_PASSTHROUGH_H__ +#define __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_PASSTHROUGH_H__ + +G_BEGIN_DECLS + +#define GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_PASSTHROUGH (gvir_config_domain_smartcard_passthrough_get_type ()) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_PASSTHROUGH(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_PASSTHROUGH, GVirConfigDomainSmartcardPassthrough)) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_PASSTHROUGH_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST ((klass), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_PASSTHROUGH, GVirConfigDomainSmartcardPassthroughClass)) +#define GVIR_CONFIG_IS_DOMAIN_SMARTCARD_PASSTHROUGH(obj) (G_TYPE_CHECK_INSTANCE_TYPE ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_PASSTHROUGH)) +#define GVIR_CONFIG_IS_DOMAIN_SMARTCARD_PASSTHROUGH_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_PASSTHROUGH)) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_PASSTHROUGH_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_PASSTHROUGH, GVirConfigDomainSmartcardPassthroughClass)) + +typedef struct _GVirConfigDomainSmartcardPassthrough GVirConfigDomainSmartcardPassthrough; +typedef struct _GVirConfigDomainSmartcardPassthroughPrivate GVirConfigDomainSmartcardPassthroughPrivate; +typedef struct _GVirConfigDomainSmartcardPassthroughClass GVirConfigDomainSmartcardPassthroughClass; + +struct _GVirConfigDomainSmartcardPassthrough +{ + GVirConfigDomainSmartcard parent; + + GVirConfigDomainSmartcardPassthroughPrivate *priv; + + /* Do not add fields to this struct */ +}; + +struct _GVirConfigDomainSmartcardPassthroughClass +{ + GVirConfigDomainSmartcardClass parent_class; + + gpointer padding[20]; +}; + +GType gvir_config_domain_smartcard_passthrough_get_type(void); + +GVirConfigDomainSmartcardPassthrough *gvir_config_domain_smartcard_passthrough_new(void); +GVirConfigDomainSmartcardPassthrough *gvir_config_domain_smartcard_passthrough_new_from_xml(const gchar *xml, + GError **error); +void gvir_config_domain_smartcard_passthrough_set_source(GVirConfigDomainSmartcardPassthrough *smartcard, + GVirConfigDomainChardevSource *source); + + +G_END_DECLS + +#endif /* __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_PASSTHROUGH_H__ */ diff --git a/libvirt-gconfig/libvirt-gconfig-domain-smartcard.c b/libvirt-gconfig/libvirt-gconfig-domain-smartcard.c new file mode 100644 index 0000000..73ea867 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-smartcard.c @@ -0,0 +1,90 @@ +/* + * libvirt-gconfig-domain-smartcard.c: libvirt domain smartcard configuration + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Alexander Larsson <alexl(a)redhat.com> + */ + +#include <config.h> + +#include "libvirt-gconfig/libvirt-gconfig.h" +#include "libvirt-gconfig/libvirt-gconfig-private.h" + +#define GVIR_CONFIG_DOMAIN_SMARTCARD_GET_PRIVATE(obj) \ + (G_TYPE_INSTANCE_GET_PRIVATE((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD, GVirConfigDomainSmartcardPrivate)) + +struct _GVirConfigDomainSmartcardPrivate +{ + gboolean unused; +}; + +G_DEFINE_ABSTRACT_TYPE(GVirConfigDomainSmartcard, gvir_config_domain_smartcard, GVIR_CONFIG_TYPE_DOMAIN_DEVICE); + + +static void gvir_config_domain_smartcard_class_init(GVirConfigDomainSmartcardClass *klass) +{ + g_type_class_add_private(klass, sizeof(GVirConfigDomainSmartcardPrivate)); +} + + +static void gvir_config_domain_smartcard_init(GVirConfigDomainSmartcard *smartcard) +{ + g_debug("Init GVirConfigDomainSmartcard=%p", smartcard); + + smartcard->priv = GVIR_CONFIG_DOMAIN_SMARTCARD_GET_PRIVATE(smartcard); +} + +/** + * gvir_config_domain_smartcard_set_address: + * @address: (allow-none): + */ +void gvir_config_domain_smartcard_set_address(GVirConfigDomainRedirdev *redirdev, + GVirConfigDomainAddress *address) +{ + g_return_if_fail(GVIR_CONFIG_IS_DOMAIN_REDIRDEV(redirdev)); + g_return_if_fail(address == NULL || GVIR_CONFIG_IS_DOMAIN_ADDRESS(address)); + + gvir_config_object_attach_replace(GVIR_CONFIG_OBJECT(redirdev), + "address", + GVIR_CONFIG_OBJECT(address)); +} + +G_GNUC_INTERNAL GVirConfigDomainDevice * +gvir_config_domain_smartcard_new_from_tree(GVirConfigXmlDoc *doc, + xmlNodePtr tree) +{ + const char *mode; + GType gtype; + + mode = gvir_config_xml_get_attribute_content(tree, "mode"); + if (mode == NULL) + return NULL; + + if (g_str_equal(mode, "host")) { + gtype = GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST; + } else if (g_str_equal(mode, "host-certificates")) { + gtype = GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_HOST_CERTIFICATES; + } else if (g_str_equal(mode, "passthrough")) { + gtype = GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD_PASSTHROUGH; + } else { + g_debug("Unknown domain smartcard node: %s", mode); + return NULL; + } + + return GVIR_CONFIG_DOMAIN_DEVICE(gvir_config_object_new_from_tree(gtype, doc, NULL, tree)); +} diff --git a/libvirt-gconfig/libvirt-gconfig-domain-smartcard.h b/libvirt-gconfig/libvirt-gconfig-domain-smartcard.h new file mode 100644 index 0000000..5136b02 --- /dev/null +++ b/libvirt-gconfig/libvirt-gconfig-domain-smartcard.h @@ -0,0 +1,67 @@ +/* + * libvirt-gconfig-domain-smartcard.h: libvirt domain smartcard configuration + * + * Copyright (C) 2012 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Alexander Larsson <alexl(a)redhat.com> + */ + +#if !defined(__LIBVIRT_GCONFIG_H__) && !defined(LIBVIRT_GCONFIG_BUILD) +#error "Only <libvirt-gconfig/libvirt-gconfig.h> can be included directly." +#endif + +#ifndef __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_H__ +#define __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_H__ + +G_BEGIN_DECLS + +#define GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD (gvir_config_domain_smartcard_get_type ()) +#define GVIR_CONFIG_DOMAIN_SMARTCARD(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD, GVirConfigDomainSmartcard)) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_CLASS(klass) (G_TYPE_CHECK_CLASS_CAST ((klass), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD, GVirConfigDomainSmartcardClass)) +#define GVIR_CONFIG_IS_DOMAIN_SMARTCARD(obj) (G_TYPE_CHECK_INSTANCE_TYPE ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD)) +#define GVIR_CONFIG_IS_DOMAIN_SMARTCARD_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD)) +#define GVIR_CONFIG_DOMAIN_SMARTCARD_GET_CLASS(obj) (G_TYPE_INSTANCE_GET_CLASS ((obj), GVIR_CONFIG_TYPE_DOMAIN_SMARTCARD, GVirConfigDomainSmartcardClass)) + +typedef struct _GVirConfigDomainSmartcard GVirConfigDomainSmartcard; +typedef struct _GVirConfigDomainSmartcardPrivate GVirConfigDomainSmartcardPrivate; +typedef struct _GVirConfigDomainSmartcardClass GVirConfigDomainSmartcardClass; + +struct _GVirConfigDomainSmartcard +{ + GVirConfigDomainDevice parent; + + GVirConfigDomainSmartcardPrivate *priv; + + /* Do not add fields to this struct */ +}; + +struct _GVirConfigDomainSmartcardClass +{ + GVirConfigDomainDeviceClass parent_class; + + gpointer padding[20]; +}; + + +GType gvir_config_domain_smartcard_get_type(void); + +void gvir_config_domain_smartcard_set_address(GVirConfigDomainRedirdev *redirdev, + GVirConfigDomainAddress *address); + +G_END_DECLS + +#endif /* __LIBVIRT_GCONFIG_DOMAIN_SMARTCARD_H__ */ diff --git a/libvirt-gconfig/libvirt-gconfig.h b/libvirt-gconfig/libvirt-gconfig.h index 0428259..9feaba2 100644 --- a/libvirt-gconfig/libvirt-gconfig.h +++ b/libvirt-gconfig/libvirt-gconfig.h @@ -71,6 +71,10 @@ #include <libvirt-gconfig/libvirt-gconfig-domain-redirdev.h> #include <libvirt-gconfig/libvirt-gconfig-domain-seclabel.h> #include <libvirt-gconfig/libvirt-gconfig-domain-serial.h> +#include <libvirt-gconfig/libvirt-gconfig-domain-smartcard.h> +#include <libvirt-gconfig/libvirt-gconfig-domain-smartcard-host.h> +#include <libvirt-gconfig/libvirt-gconfig-domain-smartcard-host-certificates.h> +#include <libvirt-gconfig/libvirt-gconfig-domain-smartcard-passthrough.h> #include <libvirt-gconfig/libvirt-gconfig-domain-snapshot.h> #include <libvirt-gconfig/libvirt-gconfig-domain-sound.h> #include <libvirt-gconfig/libvirt-gconfig-domain-timer.h> diff --git a/libvirt-gconfig/libvirt-gconfig.sym b/libvirt-gconfig/libvirt-gconfig.sym index 622e0f2..d9cff90 100644 --- a/libvirt-gconfig/libvirt-gconfig.sym +++ b/libvirt-gconfig/libvirt-gconfig.sym @@ -483,4 +483,25 @@ LIBVIRT_GCONFIG_0.1.4 { gvir_config_domain_set_power_management; } LIBVIRT_GCONFIG_0.1.3; +LIBVIRT_GCONFIG_0.1.5 { + global: + gvir_config_domain_smartcard_get_type; + gvir_config_domain_smartcard_set_address; + + gvir_config_domain_smartcard_host_get_type; + gvir_config_domain_smartcard_host_new; + gvir_config_domain_smartcard_host_new_from_xml; + + gvir_config_domain_smartcard_host_certificates_get_type; + gvir_config_domain_smartcard_host_certificates_new; + gvir_config_domain_smartcard_host_certificates_new_from_xml; + gvir_config_domain_smartcard_host_certificates_set_database; + gvir_config_domain_smartcard_host_certificates_set_certificates; + + gvir_config_domain_smartcard_passthrough_get_type; + gvir_config_domain_smartcard_passthrough_new; + gvir_config_domain_smartcard_passthrough_new_from_xml; + gvir_config_domain_smartcard_passthrough_set_source; +} LIBVIRT_GCONFIG_0.1.4; + # .... define new API here using predicted next version number .... -- 1.8.0.1

2 2

[libvirt] [PATCH] Fix arch datatype in vahControl in virt-aa-helper.c
by Daniel P. Berrange 19 Dec '12

19 Dec '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> When changing to virArch, the virt-aa-helper.c file was not completely changed. The vahControl struct was left with a char *arch field, instead of virArch arch field. Pushed as a build breaker fix --- src/security/virt-aa-helper.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index c07e69d..16ce7f3 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -72,7 +72,7 @@ typedef struct { virDomainDefPtr def; /* VM definition */ virCapsPtr caps; /* VM capabilities */ char *hvm; /* type of hypervisor (eg hvm, xen) */ - char *arch; /* machine architecture */ + virArch arch; /* machine architecture */ char *newfile; /* newly added file */ bool append; /* append to .files instead of rewrite */ } vahControl; @@ -87,7 +87,6 @@ vahDeinit(vahControl * ctl) virCapabilitiesFree(ctl->caps); VIR_FREE(ctl->files); VIR_FREE(ctl->hvm); - VIR_FREE(ctl->arch); VIR_FREE(ctl->newfile); return 0; -- 1.7.11.7

1 0

[libvirt] [PATCH] Change string form of VIR_ARCH_ITANIUM back to ia64
by Daniel P. Berrange 19 Dec '12

19 Dec '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Historically there was an inconsistency in handling of the itanium arch. The xen driver & CPU model code treated it as 'ia64' but the QEMU capabilities code used 'itanium'. On the grounds that no one has ever seriously used itanium with QEMU, while RHEL shipped itanium with Xen, we should favour 'ia64' as the canonical format Pushed as a test breaker fix from virArch fallout --- src/qemu/qemu_capabilities.c | 4 ---- src/util/virarch.c | 4 +--- 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index ae75bc6..50d999a 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -251,8 +251,6 @@ VIR_ONCE_GLOBAL_INIT(qemuCaps) static virArch qemuCapsArchFromString(const char *arch) { - if (STREQ(arch, "ia64")) - return VIR_ARCH_ITANIUM; if (STREQ(arch, "i386")) return VIR_ARCH_I686; if (STREQ(arch, "arm")) @@ -266,8 +264,6 @@ static const char *qemuCapsArchToString(virArch arch) { if (arch == VIR_ARCH_I686) return "i386"; - else if (arch == VIR_ARCH_ITANIUM) - return "ia64"; else if (arch == VIR_ARCH_ARMV7L) return "arm"; diff --git a/src/util/virarch.c b/src/util/virarch.c index 5458b74..1376887 100644 --- a/src/util/virarch.c +++ b/src/util/virarch.c @@ -39,7 +39,7 @@ static const struct virArchData { { "cris", 32, VIR_ARCH_LITTLE_ENDIAN }, { "i686", 32, VIR_ARCH_LITTLE_ENDIAN }, - { "itanium", 64, VIR_ARCH_LITTLE_ENDIAN }, + { "ia64", 64, VIR_ARCH_LITTLE_ENDIAN }, { "lm32", 32, VIR_ARCH_BIG_ENDIAN }, { "m68k", 32, VIR_ARCH_BIG_ENDIAN }, { "microblaze", 32, VIR_ARCH_BIG_ENDIAN }, @@ -159,8 +159,6 @@ virArch virArchFromHost(void) ut.machine[3] == '6' && ut.machine[4] == '\0') { arch = VIR_ARCH_I686; - } else if (STREQ(ut.machine, "ia64")) { - arch = VIR_ARCH_ITANIUM; } else if (STREQ(ut.machine, "amd64")) { arch = VIR_ARCH_X86_64; } else { -- 1.7.11.7

1 0

[libvirt] (no subject)
by Daniel P. Berrange 19 Dec '12

19 Dec '12

o

1 1

[libvirt] [PATCH] Fix CPU baseline to not hardcode arch
by Daniel P. Berrange 19 Dec '12

19 Dec '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> Prior to the virArch changes, the CPU baseline method would free the arch string in the returned CPU. Fix the regression by setting arch to VIR_ARCH_NONE at the end Pushed as a test breaker fix from virArch fallout Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/cpu/cpu_x86.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c index 2001b99..cb21910 100644 --- a/src/cpu/cpu_x86.c +++ b/src/cpu/cpu_x86.c @@ -1715,6 +1715,8 @@ x86Baseline(virCPUDefPtr *cpus, if (!outputVendor) VIR_FREE(cpu->vendor); + cpu->arch = VIR_ARCH_NONE; + cleanup: x86ModelFree(base_model); x86MapFree(map); -- 1.7.11.7

1 0

[libvirt] [PATCH] Fix SELinux security label test
by Daniel P. Berrange 19 Dec '12

19 Dec '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> If securityselinuxtest was run on a system with newer SELinux policy it would fail, due to using svirt_tcg_t instead of svirt_t. Fixing the domain type to be KVM avoids this issue. Pushed as a build fix --- tests/securityselinuxtest.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/securityselinuxtest.c b/tests/securityselinuxtest.c index 8bcf3a1..0fa70ba 100644 --- a/tests/securityselinuxtest.c +++ b/tests/securityselinuxtest.c @@ -77,6 +77,7 @@ testBuildDomainDef(bool dynamic, if (VIR_ALLOC(secdef) < 0) goto no_memory; + def->virtType = VIR_DOMAIN_VIRT_KVM; def->seclabels[0] = secdef; def->seclabels[0]->type = dynamic ? VIR_DOMAIN_SECLABEL_DYNAMIC : VIR_DOMAIN_SECLABEL_STATIC; -- 1.7.11.7

1 0

[libvirt] [PATCH 0/8 v7] Unprivileged SG_IO support
by Osier Yang 19 Dec '12

19 Dec '12

As a result of RFC [1], this implements the unprivleged SG_IO support. v6 - v7: * No restoring of unpriv_sgio per Daniel's thought. * Use "major:minor" as the hash key per Jirka's suggestion. Osier Yang (8): util: Prepare helpers for unpriv_sgio setting qemu: Add a hash table for the shared disks docs: Add docs and rng schema for new XML cdbfilter conf: Parse and format the new XML tag cdbfilter qemu: set unpriv_sgio when domain starting qemu: Check if the shared disk's cdbfilter conflicts with others qemu: Set unpriv_sgio when attaching disk qemu: Error out if the shared disk conf conflicts with others when attaching docs/formatdomain.html.in | 13 ++- docs/schemas/domaincommon.rng | 52 ++++-- src/conf/domain_conf.c | 58 +++++-- src/conf/domain_conf.h | 10 + src/libvirt_private.syms | 4 + src/qemu/qemu_conf.c | 92 ++++++++++ src/qemu/qemu_conf.h | 12 ++ src/qemu/qemu_driver.c | 38 ++++ src/qemu/qemu_process.c | 75 ++++++++ src/qemu/qemu_process.h | 2 + src/util/util.c | 180 ++++++++++++++++++++ src/util/util.h | 8 + ...ml2argv-disk-scsi-lun-passthrough-cdbfilter.xml | 32 ++++ tests/qemuxml2xmltest.c | 1 + 14 files changed, 547 insertions(+), 30 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-scsi-lun-passthrough-cdbfilter.xml [1] https://www.redhat.com/archives/libvir-list/2012-November/msg00988.html [2] https://www.redhat.com/archives/libvir-list/2012-December/msg00325.html Regards, Osier

3 35

[libvirt] VirtualBox 4.2 Drivers Complete?
by Arslan Waqar 19 Dec '12

19 Dec '12

I was using a VM on Vbox (Ubuntu 12.04) and from the virsh I tried: virsh # dommemstat 2 and I got the following errors: error: Failed to get memory statistics for domain 2 error: this function is not supported by the connection driver: virDomainMemoryStats Are the Drivers for Vbox 4.2 incomplete? -- Regards, Arslan Waqar.

2 1

[libvirt] [PATCH 0/6] Use enum for tracking valid architectures
by Daniel P. Berrange 19 Dec '12

19 Dec '12

Different operating systems have different names for architectures. eg x86_64 x64, amd64. This can cause inconsistency in libvirt code dealing with architectures. To deal with this define an enum for valid architectures and a canonical string mapping. Update all code internally to use the enum instead of 'char *' for arch data.

5 21

[libvirt] [PATCH] spec: Do not install *.py[co] in python examples
by Jiri Denemark 19 Dec '12

19 Dec '12

Unfortunately, rpm is stupid enough to bytycompile python scripts even though they are located in /usr/share/doc/libvirt-python-*/examples and it does so after %install phase is finished. Thus there's no way we could remove those files from BUILDROOT. As a workaround, we may safely remove the examples subdirectory completely without losing anything. The python scripts that were installed there are also copied directly into /usr/share/doc/libvirt-python-*/ by %doc python/tests/*.py rule. And yes, the files are actually tests, not examples. --- libvirt.spec.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libvirt.spec.in b/libvirt.spec.in index 7457a48..13cc8a2 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1392,6 +1392,8 @@ rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_lxc.aug %if ! %{with_python} rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/libvirt-python-%{version} +%else +rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/libvirt-python-%{version}/examples %endif %if ! %{with_qemu} -- 1.8.0.2

2 2

[libvirt] [PATCH 00/28] Rename files in src/util to have a 'vir' prefix
by Daniel P. Berrange 19 Dec '12

19 Dec '12

Currently the files in src/util are 50/50 split between those having a 'vir' prefix and those which don't. Finish the job by remaining all remaining files to have a 'vir' prefix too, guaranteeing that they can't clash with system headers[1]. The only case which was not a plain rename, was merging processinfo.{c,h} into the virprocess.{c,h} since the functionality logically belongs together. At the end src/Makefile.am is updated to sort util files alphabetically. Left as further work - make sure all functions in these files also have a 'vir' prefix. eg dnsmasq, ebtables, iptables, usb and pci files are violators in this regard. Also left, much of virutil.c should move into virfile.c Daniel [1] Not a theoretical problem - we already hit a clsah on 'usb.h' before forcing us to use 'hostusb.h' and 'memory.h' clashes with a system header but we never noticed so far.

3 38

[libvirt] Important question
by Gene Czarcinski 19 Dec '12

19 Dec '12

OK, so maybe I an nuts but it seems to me that there is this 800 pound gorilla wondering around the Fedora 18 tent and its name is firewalld! Or it with respect to virtual guests and libvirt (since libvirt is a critical part of networking support). Maybe I am missing some critical information as to how to configure firewalld so that guests can perform functions which the same guest can do on a Fedora 17 host. She only firewalld configuration I have been able to come up with is to configure it disabled. https://bugzilla.redhat.com/show_bug.cgi?id=888288 I have test this problem on different hardware and with/without mu usual updates of libvirt-1.0.1 and NetworkManager-git20121130. Please tell me that there is just this little thing I need to do and everything will work. With Fedora 18 to be released "real soon now", this is a very big problem! I remember with SELinux first appeared ... most people disabled it. Is this what is going to happen with firewalld? A big part of my problem is that I see little notice that there is a problem. I do not like cross posting but this needs to be on a couple of lists so I will be sending each a copy of this message. Gene

1 0

[libvirt] [PATCH] spec: Fix script warning when uninstalling libvirt-client
by Cole Robinson 18 Dec '12

18 Dec '12

https://bugzilla.redhat.com/show_bug.cgi?id=888071 --- libvirt.spec.in | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 7457a48..a5dce14 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1605,8 +1605,9 @@ fi /sbin/chkconfig --add libvirt-guests %endif -%postun client -p /sbin/ldconfig +%postun client +/sbin/ldconfig %if %{with_systemd} %if %{with_systemd_macros} %systemd_postun_with_restart libvirt-guests.service -- 1.8.0.2

2 2

[libvirt] [PATCH 0/6 v8] Unprivleged SG_IO support
by Osier Yang 18 Dec '12

18 Dec '12

As a result of RFC [1], this implements the unprivleged SG_IO support. 1/6 and 2/6 are already acked. v7 - v8: * Change the XML tag name from "cdbfilter" to "sgio", and to leave enough room for future values, the values of "sgio" are "filtered" and "unfiltered" now. v6 - v7: * No restoring of unpriv_sgio per Daniel's thought. * Use "major:minor" as the hash key per Jirka's suggestion. Osier Yang (6): util: Prepare helpers for unpriv_sgio setting qemu: Add a hash table for the shared disks docs: Add docs and rng schema for new XML tag sgio conf: Parse and format the new XML qemu: qemu: set unpriv_sgio when starting domain and attaching disk qemu: Check if the shared disk's cdbfilter conflicts with others docs/formatdomain.html.in | 14 ++- docs/schemas/domaincommon.rng | 54 +++++--- src/conf/domain_conf.c | 55 ++++++-- src/conf/domain_conf.h | 10 ++ src/libvirt_private.syms | 4 + src/qemu/qemu_conf.c | 86 ++++++++++++ src/qemu/qemu_conf.h | 12 ++ src/qemu/qemu_driver.c | 30 ++++ src/qemu/qemu_process.c | 99 ++++++++++++++ src/qemu/qemu_process.h | 4 + src/util/util.c | 140 ++++++++++++++++++++ src/util/util.h | 13 ++ ...qemuxml2argv-disk-scsi-lun-passthrough-sgio.xml | 32 +++++ tests/qemuxml2xmltest.c | 1 + 14 files changed, 522 insertions(+), 32 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-scsi-lun-passthrough-sgio.xml [1] https://www.redhat.com/archives/libvir-list/2012-November/msg00988.html [2] https://www.redhat.com/archives/libvir-list/2012-December/msg00325.html Regards, Osier

1 6

[libvirt] [RFC] qcow2v3 features support
by Ján Tomko 18 Dec '12

18 Dec '12

Since 1.1 [1], QEMU supports qcow2 version 3 images. These are still reffered to as qcow2 everywhere (qmp, qemu/qemu-img command line). This format (besides some internal improvements) includes a bitfield of compatible/incompatible/auto-clear features. [2] The only feature so far is delayed refcount updating (since 1.2 [3]), which is compatible with 1.1 if the file has been closed properly, if not it has the dirty flag set. For qcow2v3 images, -o compat=1.1 has to be passed to qemu-img. (compat=0.10 means qcow2 which is the default at the moment) For delayed refcount updates it's -o lazy_refcounts=on. Using these options would require parsing 'qemu-img create -f qcow2 -o ? /dev/null' output, or assuming they are supported. Do we need a new format type (qcow2v3) that translates to qcow2 for qemu, or would XML like this be enough? <target> <path>/var/lib/libvirt/images/image</path> <format type='qcow2'/> <features version='1.1'> <lazy_refcounts compatible="no"/> </features> ... </target> Jan [1] http://git.qemu.org/?p=qemu.git;a=commitdiff;h=6744cbab8 [2] http://lists.gnu.org/archive/html/qemu-devel/2012-04/msg03077.html [3] http://git.qemu.org/?p=qemu.git;a=commitdiff;h=bfe8043e9

2 1

[libvirt] libvirt domcument question
by zhijun liu 18 Dec '12

18 Dec '12

hi,all when I read the document at http://libvirt.org/formatdomain.html about the domain's xml format ,"disk" element has a optional subelment is "readonly",when I read the paragraph:readonlyIf present, this indicates the device cannot be modified by the guest. For now, this is the default for disks with attribute type='cdrom'. it's say type='cdrom',I'm not sure that is correct or not,I think this is a slips of pen and a possible writting maybe device='cdrom'.forgive me if I misundestanded it. also I'm not sure should send this question to libvirt-list or libvirt-user or others?liuzhijun

2 1

[libvirt] [PATCH] docs: Fix documentation for readonly element
by Jiri Denemark 18 Dec '12

18 Dec '12

--- Pushed as trivial. docs/formatdomain.html.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 8d9ab9e..94df6f8 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1631,7 +1631,7 @@ <dt><code>readonly</code></dt> <dd>If present, this indicates the device cannot be modified by the guest. For now, this is the default for disks with - attribute <code>type='cdrom'</code>. + attribute <code>device='cdrom'</code>. </dd> <dt><code>shareable</code></dt> <dd>If present, this indicates the device is expected to be shared -- 1.8.0.2

1 0

[libvirt] [PATCH] Fix parsing of vendor_id
by Ken ICHIKAWA 18 Dec '12

18 Dec '12

I have a problem about parsing vendor_id of domain XML. When define vendor_id attribute, why definition of fallback attribute is needed? I explain below for example. (I used virsh edit.) Current domain xml state is like below, <domain> <cpu> </cpu> </domain> And I redefine domain xml like below, <domain> <cpu> <model vendor_id='aaaabbbbcccc'>core2duo</model> </cpu> </domain> Then, do dumpxml, vendor_id is not reflected like below. <domain> <cpu mode='custom' match='exact'> <model fallback='allow'>core2duo</model> </cpu> </domain> I think this is not right behavior. It should be defined like below. <domain> <cpu mode='custom' match='exact'> <model fallback='allow' vendor_id='aaaabbbbcccc'>core2duo</model> </cpu> </domain> And if I define fallback attribute and vendor_id attribute at the same time, or define vendor_id attribute after fallback attribute is defined, vendor_id attribute is reflected normally. Is it a bug? or is there some reason? I read past mailing list's thread about the patch adding vendor_id but I could not find the reason. https://www.redhat.com/archives/libvir-list/2012-June/thread.html#00917 It seems that patch v1 doesn't need definition of fallback attribute but v2 needs it. If it's a bug, please consider to apply this patch. This patch fixes a problem that vendor_id attribute can not be defined when fallback attribute is not defined. Signed-off-by: Ken ICHIKAWA <ichikawa.ken(a)jp.fujitsu.com> --- src/conf/cpu_conf.c | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/src/conf/cpu_conf.c b/src/conf/cpu_conf.c index 8cb54a3..6157ed7 100644 --- a/src/conf/cpu_conf.c +++ b/src/conf/cpu_conf.c @@ -300,32 +300,32 @@ virCPUDefParseXML(const xmlNodePtr node, goto error; } } + } - if (virXPathBoolean("boolean(./model[1]/@vendor_id)", ctxt)) { - char *vendor_id; - - vendor_id = virXPathString("string(./model[1]/@vendor_id)", - ctxt); - if (!vendor_id || - strlen(vendor_id) != VIR_CPU_VENDOR_ID_LENGTH) { - virReportError(VIR_ERR_XML_ERROR, - _("vendor_id must be exactly" - " %d characters long"), - VIR_CPU_VENDOR_ID_LENGTH); + if (virXPathBoolean("boolean(./model[1]/@vendor_id)", ctxt)) { + char *vendor_id; + + vendor_id = virXPathString("string(./model[1]/@vendor_id)", + ctxt); + if (!vendor_id || + strlen(vendor_id) != VIR_CPU_VENDOR_ID_LENGTH) { + virReportError(VIR_ERR_XML_ERROR, + _("vendor_id must be exactly" + " %d characters long"), + VIR_CPU_VENDOR_ID_LENGTH); + VIR_FREE(vendor_id); + goto error; + } + /* ensure that the string can be passed to qemu*/ + for (i = 0; i < strlen(vendor_id); i++) { + if (vendor_id[i]==',') { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("vendor id is invalid")); VIR_FREE(vendor_id); goto error; } - /* ensure that the string can be passed to qemu*/ - for (i = 0; i < strlen(vendor_id); i++) { - if (vendor_id[i]==',') { - virReportError(VIR_ERR_XML_ERROR, "%s", - _("vendor id is invalid")); - VIR_FREE(vendor_id); - goto error; - } - } - def->vendor_id = vendor_id; } + def->vendor_id = vendor_id; } } -- 1.7.11.7

2 2

[libvirt] [PATCH] hostusb: Move USB_DEVFS define to hostusb.h to fix the build
by Cole Robinson 18 Dec '12

18 Dec '12

--- Pushed since it's a trivial build breaker src/util/hostusb.c | 1 - src/util/hostusb.h | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/src/util/hostusb.c b/src/util/hostusb.c index 24f925b..2eb80a0 100644 --- a/src/util/hostusb.c +++ b/src/util/hostusb.c @@ -38,7 +38,6 @@ #include "virterror_internal.h" #define USB_SYSFS "/sys/bus/usb" -#define USB_DEVFS "/dev/bus/usb/" #define USB_ID_LEN 10 /* "1234 5678" */ #define USB_ADDR_LEN 8 /* "123:456" */ diff --git a/src/util/hostusb.h b/src/util/hostusb.h index aee1526..ad2476d 100644 --- a/src/util/hostusb.h +++ b/src/util/hostusb.h @@ -25,6 +25,8 @@ # include "internal.h" +# define USB_DEVFS "/dev/bus/usb/" + typedef struct _usbDevice usbDevice; typedef struct _usbDeviceList usbDeviceList; -- 1.8.0.2

2 1

[libvirt] libvirt-1.0.1 and F18 problem
by Gene Czarcinski 18 Dec '12

18 Dec '12

I am sure this not just a 1.0.1 problem and there appears to be a bugzilla report on it: https://bugzilla.redhat.com/show_bug.cgi?id=869625 Given a F17 host and a F18 host, there is significantly different behavior when running a guest (in my case a F18 guest). On F18, I cannot ssh or scp to the host let alone any other system. Also, although DHCPv6 is working and I am getting an IPv6 DHCP address assigned. Also, I can use firefox to access an Internet website. Oh, and host returns no response. I am not sure what is wrong but I hope this is easy to fix. Gene

1 1

[libvirt] [PATCH] network: don't require private addresses if dnsmasq uses SO_BINDTODEVICE
by Laine Stump 18 Dec '12

18 Dec '12

This is yet another refinement to the fix for CVE-2012-3411: https://bugzilla.redhat.com/show_bug.cgi?id=833033 It turns out that it would be very intrusive to correctly backport the entire --bind-dynamic option to older dnsmasq versions (e.g. dnsmasq-2.48 that is used on RHEL6.x and CentOS 6.x), but very simple to patch those versions to just use SO_BINDTODEVICE on all their listening sockets (SO_BINDTODEVICE also has the desired effect of permitting only traffic that was received on the interface(s) where dnsmasq was set to listen.) This patch modifies the dnsmasq capabilities detection to detect the string: --bind-interfaces with SO_BINDTODEVICE in the output of "dnsmasq --version", and in that case realize that using the old --bind-interfaces option is just as safe as --bind-dynamic (and therefore *not* forbid creation of networks that use public IP address ranges). If -bind-dynamic is available, it is still preferred over --bind-interfaces. Note that this patch does no harm in upstream, or in any distro's downstream if it happens to end up there, but builds for distros that have a new enough dnsmasq to support --bind-dynamic do *NOT* need to specifically backport this patch; it's only required for distro releases that have dnsmasq too old to have --bind-dynamic (and those distros will need to add the SO_BINDTODEVICE patch to dnsmasq, *including the extra string in the --version output*, as well. --- src/network/bridge_driver.c | 6 ++++-- src/util/dnsmasq.c | 15 ++++++++++++--- src/util/dnsmasq.h | 1 + 3 files changed, 17 insertions(+), 5 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index c62e729..fdd9382 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -725,13 +725,15 @@ networkDnsmasqConfContents(virNetworkObjPtr network, * dnsmasq doesn't have bind-dynamic, only allow listening on * private/local IP addresses (see RFC1918/RFC3484/RFC4193) */ - if (!virSocketAddrIsPrivate(&tmpipdef->address)) { + if (!dnsmasqCapsGet(caps, DNSMASQ_CAPS_BINDTODEVICE) && + !virSocketAddrIsPrivate(&tmpipdef->address)) { unsigned long version = dnsmasqCapsGetVersion(caps); virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("Publicly routable address %s is prohibited. " "The version of dnsmasq on this host (%d.%d) doesn't " - "support the bind-dynamic option, which is required " + "support the bind-dynamic option or use SO_BINDTODEVICE " + "on listening sockets, one of which is required " "for safe operation on a publicly routable subnet " "(see CVE-2012-3411). You must either upgrade dnsmasq, " "or use a private/local subnet range for this network " diff --git a/src/util/dnsmasq.c b/src/util/dnsmasq.c index e8eab1e..ba51447 100644 --- a/src/util/dnsmasq.c +++ b/src/util/dnsmasq.c @@ -664,10 +664,19 @@ dnsmasqCapsSetFromBuffer(dnsmasqCapsPtr caps, const char *buf) if (strstr(buf, "--bind-dynamic")) dnsmasqCapsSet(caps, DNSMASQ_CAPS_BIND_DYNAMIC); - VIR_INFO("dnsmasq version is %d.%d, --bind-dynamic is %s", + /* if this string is a part of the --version output, dnsmasq + * has been patched to use SO_BINDTODEVICE when listening, + * so that it will only accept requests that arrived on the + * listening interface(s) + */ + if (strstr(buf, "--bind-interfaces with SO_BINDTODEVICE")) + dnsmasqCapsSet(caps, DNSMASQ_CAPS_BINDTODEVICE); + + VIR_INFO("dnsmasq version is %d.%d, --bind-dynamic is %spresent, " + "SO_BINDTODEVICE is %sin use", (int)caps->version / 1000000, (int)(caps->version % 1000000) / 1000, - dnsmasqCapsGet(caps, DNSMASQ_CAPS_BIND_DYNAMIC) - ? "present" : "NOT present"); + dnsmasqCapsGet(caps, DNSMASQ_CAPS_BIND_DYNAMIC) ? "" : "NOT ", + dnsmasqCapsGet(caps, DNSMASQ_CAPS_BIND_DYNAMIC) ? "" : "NOT "); return 0; fail: diff --git a/src/util/dnsmasq.h b/src/util/dnsmasq.h index 7a39232..b83bc96 100644 --- a/src/util/dnsmasq.h +++ b/src/util/dnsmasq.h @@ -68,6 +68,7 @@ typedef struct typedef enum { DNSMASQ_CAPS_BIND_DYNAMIC = 0, /* support for --bind-dynamic */ + DNSMASQ_CAPS_BINDTODEVICE = 1, /* uses SO_BINDTODEVICE for --bind-interfaces */ DNSMASQ_CAPS_LAST, /* this must always be the last item */ } dnsmasqCapsFlags; -- 1.7.11.7

2 1

[libvirt] [PATCH] build: Fix AUTHORS generation
by Jiri Denemark 18 Dec '12

18 Dec '12

Using s/#authorslist#/$$out/ makes perl eat @domain part of all email addresses from $out since it tries to interpret them as array variables. I'm not sure if we can escape those in s/// but I know we can use print: s/#authorslist#// and print '$$out' to tell perl not to even inside $out. This patch also fixes gen-AUTHORS so that it works in VPATH. --- Makefile.am | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Makefile.am b/Makefile.am index 9556b42..05301cd 100644 --- a/Makefile.am +++ b/Makefile.am @@ -95,9 +95,9 @@ gen-ChangeLog: .PHONY: gen-AUTHORS gen-AUTHORS: - $(AM_V_GEN)if test -d .git; then \ - out="`git log --pretty=format:'%aN <%aE>' | sort -u`" && \ - cat $(srcdir)/AUTHORS.in | perl -p -e "s/#authorslist#/$$out/" > \ + $(AM_V_GEN)if test -d $(srcdir)/.git; then \ + out="`cd $(srcdir) && git log --pretty=format:'%aN <%aE>' | sort -u`" && \ + cat $(srcdir)/AUTHORS.in | perl -p -e "s/#authorslist#// and print '$$out'" > \ $(distdir)/AUTHORS-tmp && \ mv -f $(distdir)/AUTHORS-tmp $(distdir)/AUTHORS ; \ fi -- 1.8.0.2

2 2

[libvirt] [PATCH] apparmor: Fix build
by Jiri Denemark 18 Dec '12

18 Dec '12

--- Pushed as a trivial build-breaker. src/security/virt-aa-helper.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index 888c416..86fd5c4 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1022,7 +1022,8 @@ get_files(vahControl * ctl) switch (dev->source.subsys.type) { case VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_USB: { usbDevice *usb = usbGetDevice(dev->source.subsys.u.usb.bus, - dev->source.subsys.u.usb.device); + dev->source.subsys.u.usb.device, + NULL); if (usb == NULL) continue; -- 1.8.0.2

1 0

[libvirt] [PATCH] .gitignore: add tests/sysinfotest
by Cole Robinson 18 Dec '12

18 Dec '12

--- Pushed since it's trivial .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 32ae8a7..0557d59 100644 --- a/.gitignore +++ b/.gitignore @@ -164,6 +164,7 @@ /tests/ssh /tests/statstest /tests/storagebackendsheepdogtest +/tests/sysinfotest /tests/utiltest /tests/viratomictest /tests/virauthconfigtest -- 1.8.0.2

1 0