- Devel - libvirt List Archives

[libvirt] [PATCH 0/2] qemu: support setting vlan tag for <interface
by Laine Stump 16 Aug '12

16 Aug '12

This would have been just one small patch, but there was a deficiency in the low level functions to save and restore pre-existing state of a virtual function. I have tested these patches on a RHEL6 machine with an SR-IOV adapter, and it properly handled the save/set .. [attach-to-guest] .. [detach] .. restore cycle both when the original state of the VF had a vlan tag and not, and when the guest was requesting a vlan tag, and not. (Now I'm wondering if this would also work for macvtap "passthrough" mode when the adapter used is a VF - it looks like the only thing stopping it is that the code to save / set / restore in that mode uses the device name of the vf, rather than referring to it as <physical device> vf <n>; since only VFs understand setting the vlan tag, the lower level code just assumes it can't be done)

3 5

[libvirt] [PATCH v2] qemu: Set swap_hard_limit before hard_limit
by Osier Yang 16 Aug '12

16 Aug '12

Setting hard_limit larger than previous swap_hard_limit must fail, it's not that good if one wants to change the swap_hard_limit and hard_limit together. E.g. % virsh memtune rhel6 hard_limit : 1000000 soft_limit : 1000000 swap_hard_limit: 1000000 % virsh memtune rhel6 --hard-limit 1000020 --soft-limit 1000020 \ --swap-hard-limit 1000020 --live This patch reoder the limits setting to set the swap_hard_limit first, hard_limit then, and soft_limit last if it's greater than current swap_hard_limit. And soft_limit first, hard_limit then, swap_hard_limit last, if not. --- src/qemu/qemu_driver.c | 59 +++++++++++++++++++++++++++++++++++++++++------ 1 files changed, 51 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 80cfa84..a26d3cd 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6651,11 +6651,18 @@ qemuDomainSetMemoryParameters(virDomainPtr dom, virDomainDefPtr persistentDef = NULL; virCgroupPtr group = NULL; virDomainObjPtr vm = NULL; + virTypedParameterPtr hard_limit = NULL; + virTypedParameterPtr soft_limit = NULL; + virTypedParameterPtr swap_hard_limit = NULL; + virTypedParameterPtr sorted_params[nparams]; + unsigned long long val = 0; + int ret = -1; int rc; virCheckFlags(VIR_DOMAIN_AFFECT_LIVE | VIR_DOMAIN_AFFECT_CONFIG, -1); + if (virTypedParameterArrayValidate(params, nparams, VIR_DOMAIN_MEMORY_HARD_LIMIT, VIR_TYPED_PARAM_ULLONG, @@ -6694,13 +6701,49 @@ qemuDomainSetMemoryParameters(virDomainPtr dom, } } + for (i = 0; i < nparams; i++) { + if (STREQ(params[i].field, VIR_DOMAIN_MEMORY_HARD_LIMIT)) + hard_limit = &params[i]; + else if (STREQ(params[i].field, VIR_DOMAIN_MEMORY_SOFT_LIMIT)) + soft_limit = &params[i]; + else if (STREQ(params[i].field, VIR_DOMAIN_MEMORY_SWAP_HARD_LIMIT)) + swap_hard_limit = &params[i]; + } + + /* It will fail if hard limit greater than swap hard limit anyway */ + if (swap_hard_limit && + hard_limit && + (hard_limit->value.ul > swap_hard_limit->value.ul)) { + virReportError(VIR_ERR_INVALID_ARG, "%s", + _("hard limit must be lower than swap hard limit")); + goto cleanup; + } + + /* Get current swap hard limit */ + rc = virCgroupGetMemSwapHardLimit(group, &val); + if (rc != 0) { + virReportSystemError(-rc, "%s", + _("unable to get swap hard limit")); + goto cleanup; + } + + if (swap_hard_limit->value.ul > val) { + sorted_params[0] = swap_hard_limit; + sorted_params[1] = hard_limit; + sorted_params[2] = soft_limit; + } else { + sorted_params[0] = soft_limit; + sorted_params[1] = hard_limit; + sorted_params[2] = swap_hard_limit; + } + ret = 0; for (i = 0; i < nparams; i++) { - virTypedParameterPtr param = &params[i]; + virTypedParameterPtr param = sorted_params[i]; if (STREQ(param->field, VIR_DOMAIN_MEMORY_HARD_LIMIT)) { if (flags & VIR_DOMAIN_AFFECT_LIVE) { - rc = virCgroupSetMemoryHardLimit(group, params[i].value.ul); + rc = virCgroupSetMemoryHardLimit(group, sorted_params[i]->value.ul); if (rc != 0) { virReportSystemError(-rc, "%s", _("unable to set memory hard_limit tunable")); @@ -6709,11 +6752,11 @@ qemuDomainSetMemoryParameters(virDomainPtr dom, } if (flags & VIR_DOMAIN_AFFECT_CONFIG) { - persistentDef->mem.hard_limit = params[i].value.ul; + persistentDef->mem.hard_limit = sorted_params[i]->value.ul; } } else if (STREQ(param->field, VIR_DOMAIN_MEMORY_SOFT_LIMIT)) { if (flags & VIR_DOMAIN_AFFECT_LIVE) { - rc = virCgroupSetMemorySoftLimit(group, params[i].value.ul); + rc = virCgroupSetMemorySoftLimit(group, sorted_params[i]->value.ul); if (rc != 0) { virReportSystemError(-rc, "%s", _("unable to set memory soft_limit tunable")); @@ -6722,11 +6765,11 @@ qemuDomainSetMemoryParameters(virDomainPtr dom, } if (flags & VIR_DOMAIN_AFFECT_CONFIG) { - persistentDef->mem.soft_limit = params[i].value.ul; + persistentDef->mem.soft_limit = sorted_params[i]->value.ul; } } else if (STREQ(param->field, VIR_DOMAIN_MEMORY_SWAP_HARD_LIMIT)) { if (flags & VIR_DOMAIN_AFFECT_LIVE) { - rc = virCgroupSetMemSwapHardLimit(group, params[i].value.ul); + rc = virCgroupSetMemSwapHardLimit(group, sorted_params[i]->value.ul); if (rc != 0) { virReportSystemError(-rc, "%s", _("unable to set swap_hard_limit tunable")); @@ -6734,7 +6777,7 @@ qemuDomainSetMemoryParameters(virDomainPtr dom, } } if (flags & VIR_DOMAIN_AFFECT_CONFIG) { - persistentDef->mem.swap_hard_limit = params[i].value.ul; + persistentDef->mem.swap_hard_limit = sorted_params[i]->value.ul; } } } @@ -7011,7 +7054,7 @@ qemuDomainSetNumaParameters(virDomainPtr dom, continue; } - /* Ensure the cpuset string is formated before passing to cgroup */ + /* Ensure the cpuset string is formatted before passing to cgroup */ if (!(nodeset_str = virDomainCpuSetFormat(nodeset, VIR_DOMAIN_CPUMASK_LEN))) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", -- 1.7.7.3

2 1

[libvirt] [PATCH] qemu: Ensure the cpuset is formated as expected before passing to cgroup
by Osier Yang 16 Aug '12

16 Aug '12

The parameter value for cpuset could be in special format like "0-10,^7", which is not recongnized by cgroup. This patch is to ensure the cpuset is formated as expected before passing it to cgroup. As a side effect, after the patch, it parses the cpuset early before cgroup setting, to avoid the rollback if cpuset parsing fails afterwards. --- src/qemu/qemu_driver.c | 77 +++++++++++++++++++++++++---------------------- 1 files changed, 41 insertions(+), 36 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 369e8ed..fc412a1 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -6952,8 +6952,23 @@ qemuDomainSetNumaParameters(virDomainPtr dom, } } else if (STREQ(param->field, VIR_DOMAIN_NUMA_NODESET)) { int rc; - bool savedmask; - char oldnodemask[VIR_DOMAIN_CPUMASK_LEN]; + char *nodeset = NULL; + char *nodeset_str = NULL; + + if (VIR_ALLOC_N(nodeset, VIR_DOMAIN_CPUMASK_LEN) < 0) { + virReportOOMError(); + ret = -1; + goto cleanup; + }; + + if (virDomainCpuSetParse(params[i].value.s, + 0, nodeset, + VIR_DOMAIN_CPUMASK_LEN) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Failed to parse nodeset")); + ret = -1; + continue; + } if (flags & VIR_DOMAIN_AFFECT_LIVE) { if (vm->def->numatune.memory.mode != @@ -6961,72 +6976,62 @@ qemuDomainSetNumaParameters(virDomainPtr dom, virReportError(VIR_ERR_OPERATION_INVALID, "%s", _("change of nodeset for running domain " "requires strict numa mode")); + VIR_FREE(nodeset); ret = -1; continue; } - rc = virCgroupSetCpusetMems(group, params[i].value.s); - if (rc != 0) { + + /* Ensure the cpuset string is formated before passing to cgroup */ + if (!(nodeset_str = virDomainCpuSetFormat(nodeset, + VIR_DOMAIN_CPUMASK_LEN))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Failed to format nodeset")); + VIR_FREE(nodeset); + ret = -1; + continue; + } + + if ((rc = virCgroupSetCpusetMems(group, nodeset_str) != 0)) { virReportSystemError(-rc, "%s", _("unable to set numa tunable")); + VIR_FREE(nodeset); + VIR_FREE(nodeset_str); ret = -1; continue; } + VIR_FREE(nodeset_str); /* update vm->def here so that dumpxml can read the new * values from vm->def. */ - savedmask = false; if (!vm->def->numatune.memory.nodemask) { if (VIR_ALLOC_N(vm->def->numatune.memory.nodemask, VIR_DOMAIN_CPUMASK_LEN) < 0) { virReportOOMError(); + VIR_FREE(nodeset); ret = -1; goto cleanup; } } else { - memcpy(oldnodemask, vm->def->numatune.memory.nodemask, - VIR_DOMAIN_CPUMASK_LEN); - savedmask = true; - } - if (virDomainCpuSetParse(params[i].value.s, - 0, - vm->def->numatune.memory.nodemask, - VIR_DOMAIN_CPUMASK_LEN) < 0) { - if (savedmask) - memcpy(vm->def->numatune.memory.nodemask, - oldnodemask, VIR_DOMAIN_CPUMASK_LEN); - else - VIR_FREE(vm->def->numatune.memory.nodemask); - ret = -1; - continue; + VIR_FREE(vm->def->numatune.memory.nodemask); } + + vm->def->numatune.memory.nodemask = nodeset; } if (flags & VIR_DOMAIN_AFFECT_CONFIG) { - savedmask = false; if (!persistentDef->numatune.memory.nodemask) { if (VIR_ALLOC_N(persistentDef->numatune.memory.nodemask, VIR_DOMAIN_CPUMASK_LEN) < 0) { virReportOOMError(); + VIR_FREE(nodeset); ret = -1; goto cleanup; } } else { - memcpy(oldnodemask, persistentDef->numatune.memory.nodemask, - VIR_DOMAIN_CPUMASK_LEN); - savedmask = true; - } - if (virDomainCpuSetParse(params[i].value.s, - 0, - persistentDef->numatune.memory.nodemask, - VIR_DOMAIN_CPUMASK_LEN) < 0) { - if (savedmask) - memcpy(persistentDef->numatune.memory.nodemask, - oldnodemask, VIR_DOMAIN_CPUMASK_LEN); - else - VIR_FREE(persistentDef->numatune.memory.nodemask); - ret = -1; - continue; + VIR_FREE(persistentDef->numatune.memory.nodemask); } + + persistentDef->numatune.memory.nodemask = nodeset; } } } -- 1.7.7.3

2 2

[libvirt] [PATCHv2] build: avoid warnings on older gcc
by Eric Blake 16 Aug '12

16 Aug '12

The previous patch pulled in a newer version of stat-time.h from gnulib, which tries to suppress some stupid gcc warnings (see <http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54113>) by exploiting a feature of newer gcc. But we still aim to compile on RHEL 6.3, with gcc 4.4.6 (not to mention even older devel platforms like RHEL 5), which fails to build thanks to our development -Werror. It took me a while to figure out how to make our set of warnings smaller on older gcc without losing the benefit of the warnings when using newer gcc (such as the one on Fedora 17), but this should do the trick. * m4/virt-compile-warnings.m4 (LIBVIRT_COMPILE_WARNINGS): Avoid warnings that gnulib can't silence on older gcc. --- v2: Use AC_CACHE_CHECK, add -Werror, and test further. Pushing under the build-breaker rule. m4/virt-compile-warnings.m4 | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/m4/virt-compile-warnings.m4 b/m4/virt-compile-warnings.m4 index 9dee000..26f6134 100644 --- a/m4/virt-compile-warnings.m4 +++ b/m4/virt-compile-warnings.m4 @@ -58,6 +58,24 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ # Gnulib's stat-time.h violates this dontwarn="$dontwarn -Waggregate-return" + # Gnulib uses '#pragma GCC diagnostic push' to silence some + # warnings, but older gcc doesn't support this. + AC_CACHE_CHECK([whether pragma GCC diagnostic push works], + [lv_cv_gcc_pragma_push_works], [ + save_CFLAGS=$CFLAGS + CFLAGS='-Wunknown-pragmas -Werror' + AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ + #pragma GCC diagnostic push + #pragma GCC diagnostic pop + ]])], + [lv_cv_gcc_pragma_push_works=yes], + [lv_cv_gcc_pragma_push_works=no]) + CFLAGS=$save_CFLAGS]) + if test $lv_cv_gcc_pragma_push_works = no; then + dontwarn="$dontwarn -Wmissing-prototypes" + dontwarn="$dontwarn -Wmissing-declarations" + fi + # We might fundamentally need some of these disabled forever, but # ideally we'd turn many of them on dontwarn="$dontwarn -Wfloat-equal" -- 1.7.11.2

3 2

[libvirt] [PATCH v3 0/5] Per-guest configurable user/group for QEMU processes
by Marcelo Cerri 15 Aug '12

15 Aug '12

This is a v3 patch series that updates the libvirt's security driver mechanism to support per-guest configurable user and group for QEMU processes running together with other security drivers, such as SELinux and AppArmor. Comments and feedbacks are welcome. Marcelo Cerri (5): Internal refactory of data structures Multiple security drivers in XML data Update security layer to handle many security labels Support for multiple default security drivers in QEMU config Update the remote API daemon/remote.c | 63 ++++ docs/formatdomain.html.in | 11 +- docs/schemas/capability.rng | 18 +- docs/schemas/domaincommon.rng | 30 ++- include/libvirt/libvirt.h.in | 2 + python/generator.py | 1 + src/conf/capabilities.c | 17 +- src/conf/capabilities.h | 6 +- src/conf/domain_audit.c | 14 +- src/conf/domain_conf.c | 342 +++++++++++++++----- src/conf/domain_conf.h | 18 +- src/driver.h | 4 + src/libvirt.c | 47 +++ src/libvirt_private.syms | 5 + src/libvirt_public.syms | 5 + src/lxc/lxc_conf.c | 8 +- src/lxc/lxc_controller.c | 8 +- src/lxc/lxc_driver.c | 11 +- src/lxc/lxc_process.c | 23 +- src/qemu/qemu_conf.c | 38 ++- src/qemu/qemu_conf.h | 2 +- src/qemu/qemu_driver.c | 218 +++++++++++--- src/qemu/qemu_process.c | 50 ++- src/remote/remote_driver.c | 46 +++ src/remote/remote_protocol.x | 17 +- src/remote_protocol-structs | 1 + src/security/security_apparmor.c | 118 +++++-- src/security/security_dac.c | 324 +++++++++++++++++-- src/security/security_manager.c | 101 +++++-- src/security/security_manager.h | 8 +- src/security/security_selinux.c | 256 ++++++++++----- src/security/security_stack.c | 237 +++++++++----- src/security/security_stack.h | 13 + src/test/test_driver.c | 11 +- .../qemuxml2argv-seclabel-dynamic-override.xml | 4 +- .../qemuxml2argv-seclabel-dynamic.xml | 2 +- 36 files changed, 1634 insertions(+), 445 deletions(-)

4 22

[libvirt] RFC: a <uuid> for every <interface> in each domain
by Laine Stump 15 Aug '12

15 Aug '12

A couple of situations have come up recently that could be solved by every interface in every domain always having a unique identifier associated with it: 1) In order to properly track information as a guest is disconnected and reconnected to an Open vSwitch bridge, the initial Open vSwitch support added an "interfaceid" parameter to virtualport. If the interfaceid isn't specified by the user when the interface is defined, one is automatically generated and placed into the persistent definition. But if the guest interface is just <interface type='network'>, it isn't known at the time of definition whether this interface will be using an Open vSwitch connection, or something else. Then, by the time we get into the network driver and decide that we're going to use Open vSwitch, it's too late to conveniently/cleanly generate an interfaceid and plug it back into the <virtualport> of the interface's persistent config. The result is that each time the guest is restarted, Open vSwitch gets a new interfaceid for it, and can't properly track things. If every interface had a uuid, the code that connects to an Open vSwitch network could just use the interface's uuid if interfaceid wasn't specified. 2) I'm about to write some patches that will allow enacting config changes to a network without needing to destroy/re-start the network. One thing that came up while I was mulling over what could and couldn't be modified without a restart is that it will be possible to allow removing physical interfaces from a network's interface pool (used for macvtap and hostdev modes), but only if that physical interface isn't currently in use. There is a use counter on each interface so we can easily tell when that situation occurs, but once we know of the failure, we have no way of pointing to which guest is causing the problem. If each interface had a uuid, we could save a list of the uuid's of all interfaces currently connected to a particular physical interface, and report that in the failure message. It would then be a fairly mechanical task to find that uuid in the guests' config. Does this sound like a reasonable idea? Any reasons *not* to do it? Problems we'll need to take care of if we add it (for example, existing guest interfaces will all need to get a uuid during the upgrade process, similar to the way we add a mac address to all existing networks that don't have one). Any other things you can think of doing with uuid if we add one?

3 5

[libvirt] [PATCHv2 0/4] support <vlan> element for interfaces and networks
by Laine Stump 15 Aug '12

15 Aug '12

danpb raised a (valid) objection about the XML format in the first version of these patches, so I've redone it to be like this: <vlan trunk='yes'> <tag id='42'/> <tag id='30'/> </vlan> The downside is that for a single vlan tag, it's more verbose: <vlan> <tag id='42'/> </vlan> On the other hand, it's more consistent. The rest of the patches in the series were unchanged (and even the data definition is unchanged). === The purpose of these patches is to define a data type that can properly describe an interface's vlan configuration (including multiple vlans for trunking), provide XML parser and formatter to translate to and from the new data type, add the new <vlan> element to both domain <interface> and to <network> in appropriate places, and to provide the new vlan data to the hypervisor driver. Once these 4 patches are applied, all that will be left to support vlan configuration for any network connection that supports it, is to request the vlan data for the interface with virDomainNetGetActualVlan(netdef). If that function returns NULL, there is no vlan config for this interface; if it's non-zero, it is a pointer to virNetDevVlan, and you can grab the data from there. Since I currently know of only two types of network connection we will be able to easily support this for (sr-iov VFs using PCI passthrough, and openvswitch), any type other than those will refuse to start if a vlan has been requested (see PATCH 4/4). This covers validation for the qemu and lxc drivers (since they use common code), but I'm not sure about xen, esx, or any other driver - they will likely require extra code to either implement transparent vlan configuration, or log an error if it's requested (my guess is that, in spite of our best efforts, *many* people will misunderstand the limitations of this functionality, and try to put all sorts of interfaces on vlans; it will be much friendlier to inform them of the problem rather than simply ignore the vlan config.

4 14

[libvirt] [PATCHv2 0/9] network: properly support openvswitch in <network>
by Laine Stump 15 Aug '12

15 Aug '12

This is mainly a refresh of the initial version of the patch to rebase, but there have also been a couple of small bugs fixed. In particular, if not <virtualport/> is specified in the domain's interface element, connection of the interface to an ovs switch won't fail because of a missing interfaceid (see http://www.redhat.com/archives/libvir-list/2012-August/msg00874.html and it's parents) Many of these patches are trivial or mechanical. ====== Although it's been possible (ever since openvswitch was added to libvirt in 0.9.11) for a libvirt network to use an openvswitch bridge (by adding <virtualport type='openvswitch'>), the virtualport in the network would always have a default random interfaceid included, which would be re-used for all interfaces using that network, which doesn't really work at all. The alternative was to not specify openvswitch in the <network> definition, but to do it in the guest's <interface> definition instead - this of course goes against the principle of not having host-specific config embedded in guest config. This patch series enhances the functionality of <virtualport> elements, to allow omitting some attributes (and even the type), and to merge the interface, network, and portgroup virtualports rather than simply picking one. This not only makes openvswitch <network>s more practical (because the network can specify type='openvswitch' without also specifying an interfaceid), but also makes <virtualport> in networks and portgroups more useful in general - for example, an interface can specify an interfaceid (used only by openvswitch) *and* an instanceid (used only by 802.1Qbh), while the network's virtualport specifies only the type, and the portgroups specify the managerid, typeid, profileid, or whatever is appropriate for the type of switch used by the network. The result is that the guest config can be completely devoid of knowledge about the type of switch being used on the hardware, but can still enjoy full configurability for whatever switch ends up being used.

6 26

[libvirt] [PATCH] build: avoid warnings on older gcc
by Eric Blake 15 Aug '12

15 Aug '12

The previous patch pulled in a newer version of stat-time.h from gnulib, which tries to suppress some stupid gcc warnings (see <http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54113>) by exploiting a feature of newer gcc. But we still aim to compile on RHEL 6.3, with gcc 4.4.6 (not to mention even older devel platforms like RHEL 5), which fails to build thanks to our development -Werror. It took me a while to figure out how to make our set of warnings smaller on older gcc without losing the benefit of the warnings when using newer gcc (such as the one on Fedora 17), but this should do the trick. * m4/virt-compile-warnings.m4 (LIBVIRT_COMPILE_WARNINGS): Avoid warnings that gnulib can't silence on older gcc. --- If I don't get a review by tomorrow, I will go ahead and push this under the build-breaker rule. m4/virt-compile-warnings.m4 | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/m4/virt-compile-warnings.m4 b/m4/virt-compile-warnings.m4 index 9dee000..702506d 100644 --- a/m4/virt-compile-warnings.m4 +++ b/m4/virt-compile-warnings.m4 @@ -58,6 +58,23 @@ AC_DEFUN([LIBVIRT_COMPILE_WARNINGS],[ # Gnulib's stat-time.h violates this dontwarn="$dontwarn -Waggregate-return" + # Gnulib uses '#pragma GCC diagnostic push' to silence some + # warnings, but older gcc doesn't support this. + AC_CACHE_VAL([lv_cv_gcc_pragma_push_works], [ + save_CFLAGS=$CFLAGS + CFLAGS=-Wunknown-pragmas + AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ + #pragma GCC diagnostic push + #pragma GCC diagnostic pop + ]])], + [lv_cv_gcc_pragma_push_works=yes], + [lv_cv_gcc_pragma_push_works=no]) + CFLAGS=$save_CFLAGS]) + if test $lv_cv_gcc_pragma_push_works = no; then + dontwarn="$dontwarn -Wmissing-prototypes" + dontwarn="$dontwarn -Wmissing-declarations" + fi + # We might fundamentally need some of these disabled forever, but # ideally we'd turn many of them on dontwarn="$dontwarn -Wfloat-equal" -- 1.7.11.2

4 5

[libvirt] [firewalld PATCHv3] firewalld PATCH v3
by Thomas Woerner 15 Aug '12

15 Aug '12

* configura.ac, spec file: firewalld now defaults to enabled, depends on dbus * fixed comment for with_firewalld define * bridge_driver, nwfilter_driver: new dbus filters to get FirewallD1.Reloaded signal and DBus.NameOwnerChanged on org.fedoraproject.FirewallD1 * iptables, ebtables, nwfilter_ebiptables_driver: use firewall-cmd direct passthrough interface * spec file changed as requested --- configure.ac | 17 ++++++++++++++++ libvirt.spec.in | 11 +++++++++++ src/Makefile.am | 4 ++-- src/network/bridge_driver.c | 47 +++++++++++++++++++++++++++++++++++++++++++++ src/util/ebtables.c | 35 +++++++++++++++++++++++++++++++++ src/util/iptables.c | 21 ++++++++++++++++++-- 6 files changed, 131 insertions(+), 4 deletions(-) diff --git a/configure.ac b/configure.ac index 8a04d91..c742d2f 100644 --- a/configure.ac +++ b/configure.ac @@ -1282,6 +1282,22 @@ AM_CONDITIONAL([HAVE_POLKIT1], [test "x$with_polkit1" = "xyes"]) AC_SUBST([POLKIT_CFLAGS]) AC_SUBST([POLKIT_LIBS]) +dnl firewalld +AC_ARG_WITH([firewalld], + AC_HELP_STRING([--with-firewalld], [enable firewalld support @<:@default=check@:>@]), + [], + [with_firewalld=check]) +if test "x$with_firewalld" = "xcheck" ; then + with_firewalld=$with_dbus +fi +if test "x$with_firewalld" == "xyes" ; then + if test "x$with_dbus" != "xyes" ; then + AC_MSG_ERROR([You must have dbus enabled for firewalld support]) + fi + AC_DEFINE_UNQUOTED([HAVE_FIREWALLD], [1], [whether firewalld support is enabled]) +fi +AM_CONDITIONAL([HAVE_FIREWALLD], [test "x$with_firewalld" != "xno"]) + dnl Avahi library AC_ARG_WITH([avahi], AC_HELP_STRING([--with-avahi], [use avahi to advertise remote daemon @<:@default=check@:>@]), @@ -2989,6 +3005,7 @@ AC_MSG_NOTICE([ sanlock: $SANLOCK_CFLAGS $SANLOCK_LIBS]) else AC_MSG_NOTICE([ sanlock: no]) fi +AC_MSG_NOTICE([firewalld: $with_firewalld]) if test "$with_avahi" = "yes" ; then AC_MSG_NOTICE([ avahi: $AVAHI_CFLAGS $AVAHI_LIBS]) else diff --git a/libvirt.spec.in b/libvirt.spec.in index 67b955a..ea2fd88 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -106,6 +106,7 @@ %define with_sanlock 0%{!?_without_sanlock:0} %define with_systemd 0%{!?_without_systemd:0} %define with_numad 0%{!?_without_numad:0} +%define with_firewalld 0%{!?_without_firewalld:0} # Non-server/HV driver defaults which are always enabled %define with_python 0%{!?_without_python:1} @@ -146,6 +147,11 @@ %define with_systemd 1 %endif +# Fedora 18 / RHEL-7 are first where firewalld support is enabled +%if 0%{?fedora} >= 17 || 0%{?rhel} >= 7 +%define with_firewalld 1 +%endif + # RHEL-5 has restricted QEMU to x86_64 only and is too old for LXC %if 0%{?rhel} == 5 %define with_qemu_tcg 0 @@ -1182,6 +1188,10 @@ of recent versions of Linux (and other OSes). %define _without_driver_modules --without-driver-modules %endif +%if %{with_firewalld} +%define _with_firewalld --with-firewalld +%endif + %define when %(date +"%%F-%%T") %define where %(hostname) %define who %{?packager}%{!?packager:Unknown} @@ -1240,6 +1250,7 @@ autoreconf -if %{?_without_audit} \ %{?_without_dtrace} \ %{?_without_driver_modules} \ + %{?_with_firewalld} \ %{with_packager} \ %{with_packager_version} \ --with-qemu-user=%{qemu_user} \ diff --git a/src/Makefile.am b/src/Makefile.am index 79b4e59..76570db 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -989,7 +989,7 @@ libvirt_driver_network_la_SOURCES = libvirt_driver_network_la_LIBADD = libvirt_driver_network_impl.la if WITH_DRIVER_MODULES mod_LTLIBRARIES += libvirt_driver_network.la -libvirt_driver_network_la_LIBADD += ../gnulib/lib/libgnu.la $(LIBNL_LIBS) +libvirt_driver_network_la_LIBADD += ../gnulib/lib/libgnu.la $(LIBNL_LIBS) $(DBUS_LIBS) libvirt_driver_network_la_LDFLAGS = -module -avoid-version $(AM_LDFLAGS) else noinst_LTLIBRARIES += libvirt_driver_network.la @@ -999,7 +999,7 @@ endif libvirt_driver_network_impl_la_CFLAGS = \ $(LIBNL_CFLAGS) \ - -I$(top_srcdir)/src/conf $(AM_CFLAGS) + -I$(top_srcdir)/src/conf $(AM_CFLAGS) $(DBUS_CFLAGS) libvirt_driver_network_impl_la_SOURCES = $(NETWORK_DRIVER_SOURCES) endif EXTRA_DIST += network/default.xml diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index a5046f1..39c0449 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -61,6 +61,7 @@ #include "virnetdev.h" #include "virnetdevbridge.h" #include "virnetdevtap.h" +#include "virdbus.h" #define NETWORK_PID_DIR LOCALSTATEDIR "/run/libvirt/network" #define NETWORK_STATE_DIR LOCALSTATEDIR "/lib/libvirt/network" @@ -248,6 +249,25 @@ networkAutostartConfigs(struct network_driver *driver) { } } +#if HAVE_FIREWALLD +static DBusHandlerResult +firewalld_dbus_filter_bridge(DBusConnection *connection ATTRIBUTE_UNUSED, + DBusMessage *message, void *user_data) { + struct network_driver *_driverState = user_data; + + if (dbus_message_is_signal(message, DBUS_INTERFACE_DBUS, + "NameOwnerChanged") || + dbus_message_is_signal(message, "org.fedoraproject.FirewallD1", + "Reloaded")) + { + VIR_DEBUG("Reload in bridge_driver because of firewalld."); + networkReloadIptablesRules(_driverState); + } + + return DBUS_HANDLER_RESULT_NOT_YET_HANDLED; +} +#endif + /** * networkStartup: * @@ -256,6 +276,9 @@ networkAutostartConfigs(struct network_driver *driver) { static int networkStartup(int privileged) { char *base = NULL; +#ifdef HAVE_FIREWALLD + DBusConnection *sysbus = NULL; +#endif if (VIR_ALLOC(driverState) < 0) goto error; @@ -322,6 +345,30 @@ networkStartup(int privileged) { networkDriverUnlock(driverState); +#ifdef HAVE_FIREWALLD + if (!(sysbus = virDBusGetSystemBus())) { + virErrorPtr err = virGetLastError(); + VIR_WARN("DBus not available, disabling firewalld support in bridge_driver: %s", err->message); + } else { + /* add matches for + * NameOwnerChanged on org.freedesktop.DBus for firewalld start/stop + * Reloaded on org.fedoraproject.FirewallD1 for firewalld reload + */ + dbus_bus_add_match(sysbus, + "type='signal'" + ",interface='"DBUS_INTERFACE_DBUS"'" + ",member='NameOwnerChanged'" + ",arg0='org.fedoraproject.FirewallD1'", + NULL); + dbus_bus_add_match(sysbus, + "type='signal'" + ",interface='org.fedoraproject.FirewallD1'" + ",member='Reloaded'", + NULL); + dbus_connection_add_filter(sysbus, firewalld_dbus_filter_bridge, driverState, NULL); + } +#endif + return 0; out_of_memory: diff --git a/src/util/ebtables.c b/src/util/ebtables.c index ca056b1..6f4d151 100644 --- a/src/util/ebtables.c +++ b/src/util/ebtables.c @@ -176,11 +176,34 @@ ebtablesAddRemoveRule(ebtRules *rules, int action, const char *arg, ...) const char *s; int n, command_idx; +#if HAVE_FIREWALLD + int ret; + char *firewall_cmd_path = NULL; + virCommandPtr cmd = NULL; + + firewall_cmd_path = virFindFileInPath("firewall-cmd"); + if (firewall_cmd_path) { + cmd = virCommandNew(firewall_cmd_path); + virCommandAddArgList(cmd, "--state", NULL); + ret = virCommandRun(cmd, NULL); + if (ret != 0) { + VIR_FREE(firewall_cmd_path); + firewall_cmd_path = NULL; + } + virCommandFree(cmd); + } +#endif + n = 1 + /* /sbin/ebtables */ 2 + /* --table foo */ 2 + /* --insert bar */ 1; /* arg */ +#if HAVE_FIREWALLD + if (firewall_cmd_path) + n += 3; /* --direct --passthrough eb */ +#endif + va_start(args, arg); while (va_arg(args, const char *)) n++; @@ -192,6 +215,18 @@ ebtablesAddRemoveRule(ebtRules *rules, int action, const char *arg, ...) n = 0; +#if HAVE_FIREWALLD + if (firewall_cmd_path) { + if (!(argv[n++] = strdup(firewall_cmd_path))) + goto error; + if (!(argv[n++] = strdup("--direct"))) + goto error; + if (!(argv[n++] = strdup("--passthrough"))) + goto error; + if (!(argv[n++] = strdup("eb"))) + goto error; + } else +#endif if (!(argv[n++] = strdup(EBTABLES_PATH))) goto error; diff --git a/src/util/iptables.c b/src/util/iptables.c index b23aca9..1378575 100644 --- a/src/util/iptables.c +++ b/src/util/iptables.c @@ -101,9 +101,26 @@ iptablesAddRemoveRule(iptRules *rules, int family, int action, { va_list args; int ret; - virCommandPtr cmd; + virCommandPtr cmd = NULL; const char *s; - +#if HAVE_FIREWALLD + char *firewall_cmd_path = NULL; + + firewall_cmd_path = virFindFileInPath("firewall-cmd"); + if (firewall_cmd_path) { + cmd = virCommandNew(firewall_cmd_path); + virCommandAddArgList(cmd, "--state", NULL); + ret = virCommandRun(cmd, NULL); + if (ret == 0) { + cmd = virCommandNew(firewall_cmd_path); + virCommandAddArgList(cmd, "--direct", "--passthrough", + (family == AF_INET6) ? "ipv6" : "ipv4", NULL); + } else + cmd = NULL; + VIR_FREE(firewall_cmd_path); + } + if (!cmd) +#endif cmd = virCommandNew((family == AF_INET6) ? IP6TABLES_PATH : IPTABLES_PATH); -- 1.7.11.2

4 4

[libvirt] [PATCH 1/4] Fix man page file paths to real paths
by Doug Goldstein 15 Aug '12

15 Aug '12

Currently the man page has paths that start with @sysconfdir@, @localstatedir@ and @remote_pid_file@. The sed command attempts to replace these during the build but unfortunately pod2man gets to the files first and escapes the @ character resulting in the sed not working. This removes the @ character and makes the paths correct. --- daemon/Makefile.am | 6 +++--- daemon/libvirtd.pod.in | 18 +++++++++--------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 928aeaf..c15c785 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -85,9 +85,9 @@ CLEANFILES += test_libvirtd.aug libvirtd.8: $(srcdir)/libvirtd.8.in sed \ - -e 's![@]sysconfdir[@]!$(sysconfdir)!g' \ - -e 's![@]localstatedir[@]!$(localstatedir)!g' \ - -e 's![@]remote_pid_file[@]!$(REMOTE_PID_FILE)!g' \ + -e 's!SYSCONFDIR!$(sysconfdir)!g' \ + -e 's!LOCALSTATEDIR!$(localstatedir)!g' \ + -e 's!REMOTE_PID_FILE!$(REMOTE_PID_FILE)!g' \ < $< > $@-t mv $@-t $@ diff --git a/daemon/libvirtd.pod.in b/daemon/libvirtd.pod.in index 57a3b27..7dc8d83 100644 --- a/daemon/libvirtd.pod.in +++ b/daemon/libvirtd.pod.in @@ -77,14 +77,14 @@ On receipt of B<SIGHUP> libvirtd will reload its configuration. =over -=item F<@sysconfdir@/libvirtd.conf> +=item F<SYSCONFDIR/libvirtd.conf> The default configuration file used by libvirtd, unless overridden on the command line using the B<-f>|B<--config> option. -=item F<@localstatedir@/run/libvirt/libvirt-sock> +=item F<LOCALSTATEDIR/run/libvirt/libvirt-sock> -=item F<@localstatedir@/run/libvirt/libvirt-sock-ro> +=item F<LOCALSTATEDIR/run/libvirt/libvirt-sock-ro> The sockets libvirtd will use when B<run as root>. @@ -92,19 +92,19 @@ The sockets libvirtd will use when B<run as root>. The socket libvirtd will use when run as a B<non-root> user. -=item F<@sysconfdir@/pki/CA/cacert.pem> +=item F<SYSCONFDIR/pki/CA/cacert.pem> The TLS B<Certificate Authority> certificate libvirtd will use. -=item F<@sysconfdir@/pki/libvirt/servercert.pem> +=item F<SYSCONFDIR/pki/libvirt/servercert.pem> The TLS B<Server> certificate libvirtd will use. -=item F<@sysconfdir@/pki/libvirt/private/serverkey.pem> +=item F<SYSCONFDIR/pki/libvirt/private/serverkey.pem> The TLS B<Server> private key libvirtd will use. -=item F<@remote_pid_file@> +=item F<REMOTE_PID_FILE> The PID file to use, unless overridden by the B<-p>|B<--pid-file> option. @@ -121,8 +121,8 @@ To retrieve the version of libvirtd: To start libvirtd, instructing it to daemonize and create a PID file: # libvirtd -d - # ls -la @remote_pid_file@ - -rw-r--r-- 1 root root 6 Jul 9 02:40 @remote_pid_file@ + # ls -la REMOTE_PID_FILE + -rw-r--r-- 1 root root 6 Jul 9 02:40 REMOTE_PID_FILE # =head1 BUGS -- 1.7.8.6

2 4

[libvirt] the arguments of qemudDispatchServerEvent
by mzawdx wang 15 Aug '12

15 Aug '12

Hi all: I am now reading the source codes of libvirt with version 0.9.2 , and be stuck by the function "qemudDispatchServerEvent". as you can see: static void qemudDispatchServerEvent(int watch, int fd, int events, void *opaque) { ... } My question is : except for the argument "void *opaque"， when and how the other three arguments (int watch, int fd, int events) being incoming ? For it is a static function, I look through the source file "libvirt.c" and find no answer . Could someone give me a help ? Thanks a lot. Yours. mzawdx

2 2

[libvirt] Schedule for next release: entering freeze in a week
by Daniel Veillard 15 Aug '12

15 Aug '12

I would rather have the release a bit earlier than expected, I was initially hoping to get a new set of localization for Sep 4 but it is clear at this point that we won't have them in time. Since we have been working on 0.10.0 for 6 weeks now, I think pushing it 2 weeks from now is reasonnable, so I suggest to enter the freeze next week on Wed 22 for a release on the 29 Aug (or a bit earlier if things go well). Considering the amount of changes done for 0.10.0, (we are already at 370 patches in) my guess is that an extra release at the end of September not too long after 0.10.0 but with enough testing feedack will make maintainance easier. So I'm shooting for a 0.10.1 release aproximately 4 weeks after 0.10.0 itself, If such a schedule is raising problem, please tell :-) And if you have patches you want in 0.10.0 which didn't got reviews or isn't pushed, please git rebase them and send them again so they get the attention needed and get pushed within a week ! thanks, Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

2 1

[libvirt] stateless drivers and stored lists of virDomainObjs
by Dmitry Guryanov 15 Aug '12

15 Aug '12

Hello, vmware, openvz and parallels driver, which was written with first two ones as an example, get list of domains in virConnectOpen and then use it for lookups and even for listing sometimes. This is not correct, because you can make several connections to the same driver and changes, made in one connection will not be visible to other. And you can also create or destroy domains using native tools. So I think keeping list of domains in a stateless driver is a bad idea - you should update this list each time when user requests some info. It's better to retrieve needed data only when it requested, like in xenapi driver. I asked this because I want to continue developing parallels driver and it'= s not so hard to change it now, so it should be fixed before adding any new code there. Maybe vmware and openvz drivers should be also fixed. -- Dmitry Guryanov

2 2

[libvirt] [PATCH 1/3] parallels: change URI to parallels:///system
by Dmitry Guryanov 15 Aug '12

15 Aug '12

Let's change URI to parallels:///system. Parallels Server supports creating VMs from non-privileged accounts, but it's not main usage scenario and it may be forbidden in the future. Also containers, which will be supported by the driver, can be managed only by root, so /system path is more suitable for this driver. Signed-off-by: Dmitry Guryanov <dguryanov(a)parallels.com> --- docs/drvparallels.html.in | 10 +++++----- src/parallels/parallels_driver.c | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/drvparallels.html.in b/docs/drvparallels.html.in index 40a0fe5..8e1430b 100644 --- a/docs/drvparallels.html.in +++ b/docs/drvparallels.html.in @@ -19,10 +19,10 @@ The libvirt Parallels driver is a single-instance privileged driver, with a driver name of 'parallels'. Some example connection URIs for the libvirt driver are: <pre> -parallels:///default (local access) -parallels+unix:///default (local access) -parallels://example.com/default (remote access, TLS/x509) -parallels+tcp://example.com/default (remote access, SASl/Kerberos) -parallels+ssh://root@example.com/default (remote access, SSH tunnelled) +parallels:///system (local access) +parallels+unix:///system (local access) +parallels://example.com/system (remote access, TLS/x509) +parallels+tcp://example.com/system (remote access, SASl/Kerberos) +parallels+ssh://root@example.com/system (remote access, SSH tunnelled) </pre> </body></html> diff --git a/src/parallels/parallels_driver.c b/src/parallels/parallels_driver.c index 05db54f..53b5a50 100644 --- a/src/parallels/parallels_driver.c +++ b/src/parallels/parallels_driver.c @@ -670,11 +670,11 @@ parallelsOpen(virConnectPtr conn, (conn->uri->path[0] == '/' && conn->uri->path[1] == '\0')) { virReportError(VIR_ERR_INVALID_ARG, "%s", _("parallelsOpen: supply a path or use " - "parallels:///session")); + "parallels:///system")); return VIR_DRV_OPEN_ERROR; } - if (STREQ(conn->uri->path, "/session")) + if (STREQ(conn->uri->path, "/system")) ret = parallelsOpenDefault(conn); else return VIR_DRV_OPEN_DECLINED; -- 1.7.1

2 5

[libvirt] [PATCH] Update documentation for CPU quota/period support for LXC
by Sukadev Bhattiprolu 15 Aug '12

15 Aug '12

From: Sukadev Bhattiprolu <sukadev(a)linux.vnet.ibm.com> Date: Tue, 14 Aug 2012 17:09:11 -0700 Subject: [PATCH] Update documentation for CPU quota/period support for LXC Following commit added suport the CPU quota/period to the LXC driver. Update the documentation to reflect that. commit d9724a81b3c53a40f45bf76067a976cce73ed278 Author: Daniel P. Berrange <berrange(a)redhat.com> Date: Thu Nov 10 12:16:26 2011 +0000 Add support for CPU quota/period to LXC driver Signed-off-by: Sukadev Bhattiprolu <sukadev(a)linux.vnet.ibm.com> --- docs/formatdomain.html.in | 10 ++++++---- 1 files changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index ec160bd..fb25cb8 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -426,8 +426,9 @@ interval(unit: microseconds). Within <code>period</code>, each vcpu of the domain will not be allowed to consume more than <code>quota</code> worth of runtime. The value should be in range [1000, 1000000]. A period - with value 0 means no value. (NB: Only qemu driver support) - Since 0.9.4 + with value 0 means no value. + Only QEMU driver support since 0.9.4, LXC since + 0.9.10 </dd> <dt><code>quota</code></dt> <dd> @@ -437,8 +438,9 @@ means that it is not bandwidth controlled. The value should be in range [1000, 18446744073709551] or less than 0. A quota with value 0 means no value. You can use this feature to ensure that all vcpus run at the same - speed. (NB: Only qemu driver support) - Since 0.9.4 + speed. + Only QEMU driver support since 0.9.4, LXC since + 0.9.10 </dd> </dl> -- 1.7.1

2 1

[libvirt] [PATCH 00/48 v3] Atomic APIs to list objects
by Osier Yang 15 Aug '12

15 Aug '12

v2 - v3: * Various document fixes/improvements (Suggested by Laine and Eric) * Destroy virdomainlist.[ch], and folder all list helper funcs into its own *_conf.[ch] * Improve the helpers to get the object list. See https://www.redhat.com/archives/libvir-list/2012-July/msg01267.html * Rebased on top of commit 3df9626 by Peter and the virReportError series by Daniel. * Rebased on top of virsh split series. (I'm luck there is no change on those commands since v2). Except the already supported APIs for domain and domain snapshot, this series add the APIs for the left objects, including storage pool, storage vol, network, interface, node device, nwfilter, and secret. * Storage pool: - Support filtering the returned pool objects by active|inactive, persistent|transient, autostart|no-autostart, and pool types. - New options for virsh, --type to accept multiple pool types. * Storage vol: - Simply returns all the vol objects of a pool. * Network: - Support filtering the results using flags active|inactive, persistent|transient, autostart|no-autostart - New options for virsh. * Interface: - Support filtering the results using flags active|inactive. It's still O(n) underlying, as interface driver doesn't manage the objects itself, but using netcf lib instead. And netcf APIs don't support returning the struct yet. * Node Device: - Support filtering the results using capabilities type of the devices. - Extend --cap to accept multiple capability type. * Network Filter: - Simply returns all the objects. * Secret: - Simply returns all the objects. Osier Yang (48): Avoid strcase check for virsh-*.c Destroy virdomainlist.[ch] list: Define new API virStorageListALlStoragePools list: Add helpers for listing storage pool objects list: Implement the RPC calls for virConnectListAllStoragePools list: Implement listAllStoragePools for storage driver list: Implement listAllStoragePools for test driver list: Add helper to convert strings separated by ', ' to array virsh: Fix the wrong doc for pool-list list: Change MATCH for common use in virsh list: Use virConnectListAllStoragePools in virsh virsh: Use vshPrint instead of printf python: Expose virStorageListAllStoragePools to python binding list: Define new API virStoragePoolListAllVolumes list: Implemente RPC calls for virStoragePoolListAllVolumes list: Implement virStoragePoolListAllVolumes for storage driver list: Implement virStoragePoolListAllVolumes for test driver list: Use virStoragePoolListAllVolumes in virsh list: Expose virStoragePoolListAllVolumes to Python binding list: Define new API virConnectListAllNetworks list: Implement RPC calls for virConnectListAllNetworks list: Add helpers to list network objects list: Implement listAllNetworks for network driver list: Implement listAllNetworks for test driver list: Use virConnectListAllNetworks in virsh list: Expose virConnectListAllNetworks to Python binding list: Define new API virConnectListAllInterfaces list: Implemente RPC calls for virConnectListAllInterfaces list: Implement listAllInterfaces list: Use virConnectListAllInterfaces in virsh list: Expose virConnectListAllInterfaces to Python binding list: Define new API virConnectListAllNodeDevices list: Implemente RPC calls for virConnectListAllNodeDevices list: Add helpers for listing node devices list: Implement listAllNodeDevices list: Expose virConnectListAllNodeDevices to Python binding virsh: Fix a bug of nodedev-list list: Use virConnectListAllNodeDevices in virsh list: Define new API virConnectListAllNWFilters list: Implement RPC calls for virConnectListAllNWFilters list: Implement listAllNWFilters list: Use virConnectListAllNWFilters in virsh list: Expose virConnectListAllNWFilters to Python binding list: Define new API virConnectListAllSecrets list: Implement RPC calls for virConnectListAllSecrets list: Implement listAllSecrets list: Use virConnectListAllSecrets in virsh list: Expose virConnectListAllSecrets to Python binding cfg.mk | 5 +- daemon/remote.c | 382 ++++++++++++++++++++++ include/libvirt/libvirt.h.in | 101 ++++++- python/generator.py | 11 +- python/libvirt-override-api.xml | 44 +++- python/libvirt-override-virConnect.py | 72 +++++ python/libvirt-override-virStoragePool.py | 11 + python/libvirt-override.c | 337 ++++++++++++++++++++ src/Makefile.am | 125 ++++---- src/conf/domain_conf.c | 189 +++++++++++- src/conf/domain_conf.h | 56 ++++ src/conf/network_conf.c | 91 ++++++ src/conf/network_conf.h | 22 ++ src/conf/node_device_conf.c | 103 ++++++ src/conf/node_device_conf.h | 16 + src/conf/storage_conf.c | 116 +++++++ src/conf/storage_conf.h | 35 ++ src/conf/virdomainlist.c | 222 ------------- src/conf/virdomainlist.h | 84 ----- src/driver.h | 35 ++- src/interface/netcf_driver.c | 135 ++++++++ src/libvirt.c | 487 ++++++++++++++++++++++++++++- src/libvirt_private.syms | 4 + src/libvirt_public.syms | 7 + src/libxl/libxl_driver.c | 3 +- src/lxc/lxc_driver.c | 3 +- src/network/bridge_driver.c | 17 + src/node_device/node_device_driver.c | 15 + src/node_device/node_device_driver.h | 3 + src/node_device/node_device_hal.c | 1 + src/node_device/node_device_udev.c | 1 + src/nwfilter/nwfilter_driver.c | 56 ++++ src/openvz/openvz_driver.c | 3 +- src/parallels/parallels_driver.c | 3 +- src/qemu/qemu_driver.c | 3 +- src/remote/remote_driver.c | 449 ++++++++++++++++++++++++++ src/remote/remote_protocol.x | 80 +++++- src/remote_protocol-structs | 85 +++++ src/secret/secret_driver.c | 59 ++++- src/storage/storage_driver.c | 85 +++++ src/test/test_driver.c | 104 ++++++- src/uml/uml_driver.c | 3 +- src/vbox/vbox_tmpl.c | 9 +- src/vmware/vmware_driver.c | 3 +- tools/virsh-domain-monitor.c | 16 +- tools/virsh-domain.c | 19 +- tools/virsh-host.c | 2 +- tools/virsh-interface.c | 259 +++++++++++----- tools/virsh-network.c | 351 ++++++++++++++++----- tools/virsh-nodedev.c | 302 ++++++++++++++++--- tools/virsh-nwfilter.c | 163 ++++++++-- tools/virsh-pool.c | 441 ++++++++++++++++++++------ tools/virsh-secret.c | 182 +++++++++-- tools/virsh-volume.c | 197 +++++++++--- tools/virsh.c | 58 +++- tools/virsh.pod | 51 +++- 56 files changed, 4849 insertions(+), 867 deletions(-) create mode 100644 python/libvirt-override-virStoragePool.py delete mode 100644 src/conf/virdomainlist.c delete mode 100644 src/conf/virdomainlist.h -- 1.7.7.3

4 60

[libvirt] Seamless spice-migration on hosts with multiple interfaces
by Tiziano Müller 15 Aug '12

15 Aug '12

Hi everyone I have a setup in which the VM-nodes have different interfaces for migration (internal network) and public/spice access (public network). Now, when I try to migrate a VM with a connected spice client, the client always gets disconnected instead of seamlessly migrated. The problem is that libvirt passes the spice client the hostname according to the IP of the target interface of the migration instead of the public interface (this has been confirmed using the spicy client which displays an error during migration saying that it can't find the new host "<internal hostname>"). What I tried: * setting spice_listen in /etc/libvirt/qemu.conf * defining a network in libvirt for the public network and using a network in the listen-option for spice in the VMs XML But the problem persists and the client still gets the internal (migration) address instead of the public where spice is listening on. This is with libvirt 0.9.13. Has anyone seen this behaviour before? I tried to track down this problem and I'm not sure whether I find one bug already, but the following code didn't look right. So I tried to fix it (but the problem was still present): --- src/qemu/qemu_migration.c.orig 2012-07-20 16:46:59.669855341 +0200 +++ src/qemu/qemu_migration.c 2012-07-20 16:47:58.637546032 +0200 @@ -1036,7 +1036,7 @@ if (ret == 0) { ret = qemuMonitorGraphicsRelocate(priv->mon, cookie->graphics->type, - cookie->remoteHostname, + cookie->graphics->listen, cookie->graphics->port, cookie->graphics->tlsPort, cookie->graphics->tlsSubject); Thanks in advance, Tiziano

1 0

[libvirt] [PATCHv2 0/5] network: report #connections in network xml
by Laine Stump 15 Aug '12

15 Aug '12

This repost of an unreviewed patchset from last week is purely to rebase - the "openvswitch in <network> 9 patch series is a prerequisite of this, and this is a prerequisite of the vlan patch series resend coming up. These are all fairly short and simple, so shouldn't require too much hair pulling to review :-) ===== The forward devices in direct mode (aka macvtap) networks already have a counter to keep track of how many guest interfaces are using each physical device. This series renames that counter to "connections", then adds another connects counter to the toplevel of each network, and outputs both of these counters (when non-0) with the live XML for the network (i.e. it isn't output if you ask for the --inactive xml). Someone working on a management application had requested this info, and it already existed, so I thought I may as well expose it.

3 22

[libvirt] [PATCH] conf: log error when encountering multiple filterrefs in interface
by Laine Stump 15 Aug '12

15 Aug '12

Each interface has a single pointer to a filterref object. That filterref can itself point to multiple other filterrefs, but at the toplevel there is only one. The parser had previously just silently overwritten earlier filterrefs when a new one was encountered, so the interface was left with whichever was the last filterref in the xml, ignoring all the others. This patch logs an error when it sees more than one filterref. --- src/conf/domain_conf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index ae95d81..58c424f 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -4627,6 +4627,12 @@ virDomainNetDefParseXML(virCapsPtr caps, ioeventfd = virXMLPropString(cur, "ioeventfd"); event_idx = virXMLPropString(cur, "event_idx"); } else if (xmlStrEqual (cur->name, BAD_CAST "filterref")) { + if (filter) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("Invalid specification of multiple <filterref>s " + "in a single <interface>")); + goto error; + } filter = virXMLPropString(cur, "filter"); virNWFilterHashTableFree(filterparams); filterparams = virNWFilterParseParamAttributes(cur); -- 1.7.11.2

2 2

[libvirt] [PATCH] Allow sticky bit to be read and set.
by Ján Tomko 14 Aug '12

14 Aug '12

--- src/conf/storage_conf.c | 8 +++++--- src/storage/storage_backend.c | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c index 3132aae..017648d 100644 --- a/src/conf/storage_conf.c +++ b/src/conf/storage_conf.c @@ -667,7 +667,8 @@ virStorageDefParsePerms(xmlXPathContextPtr ctxt, } else { int tmp; - if (virStrToLong_i(mode, NULL, 8, &tmp) < 0 || (tmp & ~0777)) { + if (virStrToLong_i(mode, NULL, 8, &tmp) < 0 || + (tmp & ~(S_ISVTX | S_IRWXUGO))) { VIR_FREE(mode); virReportError(VIR_ERR_XML_ERROR, "%s", _("malformed octal mode")); @@ -1037,7 +1038,7 @@ virStoragePoolDefFormat(virStoragePoolDefPtr def) { virBufferAddLit(&buf," <permissions>\n"); virBufferAsprintf(&buf," <mode>0%o</mode>\n", - def->target.perms.mode); + def->target.perms.mode & (S_ISVTX | S_IRWXUGO)); virBufferAsprintf(&buf," <owner>%d</owner>\n", (int) def->target.perms.uid); virBufferAsprintf(&buf," <group>%d</group>\n", @@ -1290,7 +1291,8 @@ virStorageVolTargetDefFormat(virStorageVolOptionsPtr options, virBufferAddLit(buf," <permissions>\n"); virBufferAsprintf(buf," <mode>0%o</mode>\n", - def->perms.mode); + def->perms.mode & + (S_ISVTX | S_IRWXUGO)); virBufferAsprintf(buf," <owner>%u</owner>\n", (unsigned int) def->perms.uid); virBufferAsprintf(buf," <group>%u</group>\n", diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index df3833a..5fd14ed 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -1210,7 +1210,7 @@ virStorageBackendUpdateVolTargetInfoFD(virStorageVolTargetPtr target, } } - target->perms.mode = sb.st_mode & S_IRWXUGO; + target->perms.mode = sb.st_mode & (S_ISVTX | S_IRWXUGO); target->perms.uid = sb.st_uid; target->perms.gid = sb.st_gid; -- 1.7.8.6

2 2

[libvirt] [PATCH] storage: support all file permissions
by Ján Tomko 14 Aug '12

14 Aug '12

sticky, setuid and setgid are no longer ignored. --- src/conf/storage_conf.c | 6 ++++-- src/storage/storage_backend.c | 3 ++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c index 7944555..c492106 100644 --- a/src/conf/storage_conf.c +++ b/src/conf/storage_conf.c @@ -1035,7 +1035,8 @@ virStoragePoolDefFormat(virStoragePoolDefPtr def) { virBufferAddLit(&buf," <permissions>\n"); virBufferAsprintf(&buf," <mode>0%o</mode>\n", - def->target.perms.mode); + def->target.perms.mode & + (S_ISUID | S_ISGID | S_ISVTX | S_IRWXUGO)); virBufferAsprintf(&buf," <owner>%u</owner>\n", (unsigned int) def->target.perms.uid); virBufferAsprintf(&buf," <group>%u</group>\n", @@ -1275,7 +1276,8 @@ virStorageVolTargetDefFormat(virStorageVolOptionsPtr options, virBufferAddLit(buf," <permissions>\n"); virBufferAsprintf(buf," <mode>0%o</mode>\n", - def->perms.mode); + def->perms.mode & + (S_ISUID | S_ISGID | S_ISVTX | S_IRWXUGO)); virBufferAsprintf(buf," <owner>%u</owner>\n", (unsigned int) def->perms.uid); virBufferAsprintf(buf," <group>%u</group>\n", diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c index e677cda..e9ec7a5 100644 --- a/src/storage/storage_backend.c +++ b/src/storage/storage_backend.c @@ -1210,7 +1210,8 @@ virStorageBackendUpdateVolTargetInfoFD(virStorageVolTargetPtr target, } } - target->perms.mode = sb.st_mode & S_IRWXUGO; + target->perms.mode = sb.st_mode & + (S_ISUID | S_ISGID | S_ISVTX | S_IRWXUGO); target->perms.uid = sb.st_uid; target->perms.gid = sb.st_gid; -- 1.7.8.6

4 7

[libvirt] [PATCH v11 0/7] file descriptor passing using fd sets
by Corey Bryant 14 Aug '12

14 Aug '12

libvirt's sVirt security driver provides SELinux MAC isolation for Qemu guest processes and their corresponding image files. In other words, sVirt uses SELinux to prevent a QEMU process from opening files that do not belong to it. sVirt provides this support by labeling guests and resources with security labels that are stored in file system extended attributes. Some file systems, such as NFS, do not support the extended attribute security namespace, and therefore cannot support sVirt isolation. A solution to this problem is to provide fd passing support, where libvirt opens files and passes file descriptors to QEMU. This, along with SELinux policy to prevent QEMU from opening files, can provide image file isolation for NFS files stored on the same NFS mount. This patch series adds the add-fd, remove-fd, and query-fdsets QMP monitor commands, which allow file descriptors to be passed via SCM_RIGHTS, and assigned to specified fd sets. This allows fd sets to be created per file with fds having, for example, different access rights. When QEMU needs to reopen a file with different access rights, it can search for a matching fd in the fd set. Fd sets also allow for easy tracking of fds per file, helping to prevent fd leaks. Support is also added to the block layer to allow QEMU to dup an fd from an fdset when the filename is of the /dev/fdset/nnn format, where nnn is the fd set ID. No new SELinux policy is required to prevent open of NFS files (files with type nfs_t). The virt_use_nfs boolean type simply needs to be set to false, and open will be prevented (and dup will be allowed). For example: # setsebool virt_use_nfs 0 # getsebool virt_use_nfs virt_use_nfs --> off Corey Bryant (7): qemu-char: Add MSG_CMSG_CLOEXEC flag to recvmsg qapi: Introduce add-fd, remove-fd, query-fdsets block: Prevent detection of /dev/fdset/ as floppy block: Convert open calls to qemu_open block: Convert close calls to qemu_close block: Enable qemu_open/close to work with fd sets monitor: Clean up fd sets on monitor disconnect Makefile | 2 +- block/raw-posix.c | 46 +++++---- block/raw-win32.c | 6 +- block/vdi.c | 5 +- block/vmdk.c | 25 ++--- block/vpc.c | 4 +- block/vvfat.c | 16 +-- cutils.c | 5 + monitor.c | 291 +++++++++++++++++++++++++++++++++++++++++++++++++++++ monitor.h | 5 + osdep.c | 114 +++++++++++++++++++++ qapi-schema.json | 98 ++++++++++++++++++ qemu-char.c | 12 ++- qemu-common.h | 2 + qemu-tool.c | 20 ++++ qemu-user.c | 20 ++++ qmp-commands.hx | 122 ++++++++++++++++++++++ savevm.c | 4 +- tests/Makefile | 2 +- 19 files changed, 742 insertions(+), 57 deletions(-) -- 1.7.10.4

1 7

[libvirt] [PATCH] random: link with -lm when needed
by Eric Blake 14 Aug '12

14 Aug '12

Use of ldexp() requires -lm on some platforms; use gnulib to determine this for our makefile. Also, optimize virRandomInt() for the case of a power-of-two limit (actually rather common, given that Daniel has a pending patch to replace virRandomBis(10) with code that will default to virRandomInt(1024) on default SELinux settings). * .gnulib: Update to latest, for ldexp. * bootstrap.conf (gnulib_modules): Import ldexp. * src/Makefile.am (libvirt_util_la_CFLAGS): Link with -lm when needed. * src/util/virrandom.c (virRandomInt): Optimize powers of 2. --- Gnulib changes: * .gnulib dbd9144...271dd74 (37): > ldexp: relax license > update from texinfo > gnulib-tool: Fix persistence of --witness-c-macro option. > count-leading-zeros: use a lookup table on non-gcc compilers > count-leading-zeros: new module > maintainer-makefile: Fix syntax error with dash. > extern-inline: also ignore -Wmissing-declarations > autoupdate > maint.mk: sc_prohibit_magic_number_exit: avoid new false positives > gnumakefile: better interaction with Automake-NG > base64: Use extern C scope in header file, for C++. > stat-time, timespec, u64: support naive out-of-dir builds > Fix typo: 'linline' -> 'inline' (thanks to Eric Blake). > Keep the extern-inline macros closer together. > Fix indenting. > utimens: use extern-inline > u64: use extern-inline > timespec: use extern-inline > stat-time: use extern-inline > extern-inline: new module > maint.mk: a "release-commit" wrapper to do-release-commit-and-tag > autoupdate > autoupdate > maint.mk: use silent-rules support from Automake > maint.mk: provide a web-manual-update target > README-release: shorten the circuit to post a news > gnu-web-doc-update: fix --help > passfd: fix comment on recvfd > maint.mk: avoid a sub-shell > maint.mk: absolute VPATH issue > update from texinfo > gitlog-to-changelog: fix previous change > gitlog-to-changelog: don't expect .git to be in $srcdir > maint.mk: absolute VPATH build fix > clean-temp: Fix memory leak. > maint: fix grammar in a ChangeLog entry > maint.mk: new rule: refresh-gnulib-patches .gnulib | 2 +- bootstrap.conf | 1 + src/Makefile.am | 2 +- src/util/virrandom.c | 4 ++++ 4 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gnulib b/.gnulib index dbd9144..271dd74 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit dbd914496c99c52220e5f5ba4121d6cb55fb3beb +Subproject commit 271dd74fdf54ec2a03e73a5173b0b5697f6088f1 diff --git a/bootstrap.conf b/bootstrap.conf index a4e1c2f..a6cfe24 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -61,6 +61,7 @@ intprops ioctl isatty largefile +ldexp listen localeconv maintainer-makefile diff --git a/src/Makefile.am b/src/Makefile.am index e94f977..cec4789 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -654,7 +654,7 @@ libvirt_util_la_SOURCES = \ $(UTIL_SOURCES) libvirt_util_la_CFLAGS = $(CAPNG_CFLAGS) $(YAJL_CFLAGS) $(LIBNL_CFLAGS) \ $(AM_CFLAGS) $(AUDIT_CFLAGS) $(DEVMAPPER_CFLAGS) \ - $(DBUS_CFLAGS) + $(DBUS_CFLAGS) $(LDEXP_LIBM) libvirt_util_la_LIBADD = $(CAPNG_LIBS) $(YAJL_LIBS) $(LIBNL_LIBS) \ $(THREAD_LIBS) $(AUDIT_LIBS) $(DEVMAPPER_LIBS) \ $(RT_LIBS) $(DBUS_LIBS) $(MSCOM_LIBS) $(LIBXML_LIBS) diff --git a/src/util/virrandom.c b/src/util/virrandom.c index 363fcab..8870865 100644 --- a/src/util/virrandom.c +++ b/src/util/virrandom.c @@ -24,6 +24,7 @@ #include <stdlib.h> #include <inttypes.h> #include <math.h> +#include <strings.h> #include "virrandom.h" #include "threads.h" @@ -135,6 +136,9 @@ double virRandom(void) */ uint32_t virRandomInt(uint32_t max) { + if ((max & (max - 1)) == 0) + return virRandomBits(ffs(max)); + double val = virRandom(); return val * max; } -- 1.7.11.2

2 3

[libvirt] [PATCH 0/9] network: properly support openvswitch in <network>
by Laine Stump 14 Aug '12

14 Aug '12

Although it's been possible (ever since openvswitch was added to libvirt in 0.9.11) for a libvirt network to use an openvswitch bridge (by adding <virtualport type='openvswitch'>), the virtualport in the network would always have a default random interfaceid included, which would be re-used for all interfaces using that network, which doesn't really work at all. The alternative was to not specify openvswitch in the <network> definition, but to do it in the guest's <interface> definition instead - this of course goes against the principle of not having host-specific config embedded in guest config. This patch series enhances the functionality of <virtualport> elements, to allow omitting some attributes (and even the type), and to merge the interface, network, and portgroup virtualports rather than simply picking one. This not only makes openvswitch <network>s more practical (because the network can specify type='openvswitch' without also specifying an interfaceid), but also makes <virtualport> in networks and portgroups more useful in general - for example, an interface can specify an interfaceid (used only by openvswitch) *and* an instanceid (used only by 802.1Qbh), while the network's virtualport specifies only the type, and the portgroups specify the managerid, typeid, profileid, or whatever is appropriate for the type of switch used by the network. The result is that the guest config can be completely devoid of knowledge about the type of switch being used on the hardware, but can still enjoy full configurability for whatever switch ends up being used.

5 23