- Devel - libvirt List Archives

[libvirt] Ejecting ISO from cdrom
by Jaromír Červenka 01 Oct '10

01 Oct '10

Hello, how can I remove ISO image from cdrom in running domain, please? I tried procedure which is described on your wiki ( http://wiki.libvirt.org/page/QEMUSwitchToLibvirt#eject_DEV) but it doesn't work for me: divinus:/kvm/iso # virsh attach-disk --type cdrom --mode readonly leon.i-tux.cz "" hdc error: command 'attach-disk' requires <target> option divinus:/kvm/iso # virsh attach-disk --type cdrom --mode readonly leon.i-tux.cz "" --target hdc error: command 'attach-disk' requires <source> option divinus:/kvm/iso # virsh attach-disk --type cdrom --mode readonly leon.i-tux.cz --source "" --target hdc error: expected syntax: --source <string> Thank you, Jaromír Červenka

2 2

[libvirt] [PATCH] phyp: Verify that domain XML contains at least one disk element
by Matthias Bolte 01 Oct '10

01 Oct '10

phypBuildLpar expects that at least one disk element is provided. --- src/phyp/phyp_driver.c | 18 +++++++++++------- 1 files changed, 11 insertions(+), 7 deletions(-) diff --git a/src/phyp/phyp_driver.c b/src/phyp/phyp_driver.c index ab12392..0a7d6f9 100644 --- a/src/phyp/phyp_driver.c +++ b/src/phyp/phyp_driver.c @@ -3715,13 +3715,17 @@ phypBuildLpar(virConnectPtr conn, virDomainDefPtr def) goto err; } - if (def->ndisks > 0) { - if (!def->disks[0]->src) { - PHYP_ERROR(VIR_ERR_XML_ERROR,"%s", - _("Field \"<src>\" under \"<disk>\" on the domain XML file is " - "missing.")); - goto err; - } + if (def->ndisks < 1) { + PHYP_ERROR(VIR_ERR_XML_ERROR, "%s", + _("Domain XML must contain at least one \"<disk>\" element.")); + goto err; + } + + if (!def->disks[0]->src) { + PHYP_ERROR(VIR_ERR_XML_ERROR,"%s", + _("Field \"<src>\" under \"<disk>\" on the domain XML file is " + "missing.")); + goto err; } virBufferAddLit(&buf, "mksyscfg"); -- 1.7.0.4

2 2

[libvirt] [PATCH] PHYP: Checking for NULL values when building new guest
by Eduardo Otubo 01 Oct '10

01 Oct '10

When creating a new gust, the function phypBuildLpar() was not checking for NULL values, making the driver to have a segmentation fault. --- src/phyp/phyp_driver.c | 19 +++++++++++++++++++ 1 files changed, 19 insertions(+), 0 deletions(-) diff --git a/src/phyp/phyp_driver.c b/src/phyp/phyp_driver.c index 251111d..999870e 100644 --- a/src/phyp/phyp_driver.c +++ b/src/phyp/phyp_driver.c @@ -3701,6 +3701,25 @@ phypBuildLpar(virConnectPtr conn, virDomainDefPtr def) int exit_status = 0; virBuffer buf = VIR_BUFFER_INITIALIZER; + if (!def->name) { + VIR_ERROR0(_("Field \"<name>\" on the domain XML file missing.")); + goto err; + } else if (!def->memory) { + VIR_ERROR0(_ + ("Field \"<memory>\" on the domain XML file missing.")); + goto err; + } else if (!def->maxmem) { + VIR_ERROR0(_ + ("Field \"<currentMemory>\" on the domain XML file missing.")); + goto err; + } else if (!def->vcpus) { + VIR_ERROR0(_("Field \"<vcpu>\" on the domain XML file missing.")); + goto err; + } else if (!def->disks[0]->src) { + VIR_ERROR0(_("Field \"<disk>\" on the domain XML file missing.")); + goto err; + } + virBufferAddLit(&buf, "mksyscfg"); if (system_type == HMC) virBufferVSprintf(&buf, " -m %s", managed_system); -- 1.7.0.4

3 9

[libvirt] dumpxml doesn't export 'boot' options
by Jaromír Červenka 01 Oct '10

01 Oct '10

Hi again, I added another boot options to my running domain, like this: # virsh edit leon.i-tux.cz <os> ... <boot dev='cdrom'/> <bootmenu enable='yes'/> </os> (Note: "dev='hd" was already present) Right after :wq (vim commands) -> # Domain leon.i-tux.cz XML configuration edited. Now when I did "virsh dumpxml leon.i-tux.cz" these new boot options are missing in output. But "cat /etc/libvirt/qemu/leon.i-tux.cz.xml" shows me these new options and "virsh edit" also. Is it some bug or normal behavior? I also noticed that these options disappear after restarting libvirt daemon - but only from "virsh edit", not from /etc/... xml file. I would like to do some kind of backups of my domains thru dumpxml :) Maybe the best way will be to backup all in /etc/libvirt. Thank you, Jaromír.

1 0

[libvirt] Storage volume
by Jaromír Červenka 01 Oct '10

01 Oct '10

Hello, is there any way, how to create storage volume from existing qcow2 image file? I have XML description for this new volume and image which was used without xml. But when I tried "vol-create" it automatically deleted this file and created new one. Thank you, Jaromír Červenka Official openSUSE community member Web: http://www.cervajz.com/ Jabber: cervajz(a)cervajz.com MSN: jara.cervenka(a)seznam.cz Tel.: +420 607 592 687 Alt. e-mails: jaromir.cervenka(a)opensuse.org, jaromir.cervenka(a)speel.cz

2 4

[libvirt] [PATCH] 1/1: implement usb and pci hot attach in AppArmor driver
by Jamie Strandboge 01 Oct '10

01 Oct '10

The AppArmor security driver has partial support for hostdev devices in that if they already exist in the XML, virt-aa-helper can find them and add them to the profile. Hot attach does not work[1] because AppArmorSetSecurityHostdevLabel and AppArmorRestoreSecurityHostdevLabel are not currently implemented. From the patch description: Implement AppArmorSetSecurityHostdevLabel() and AppArmorRestoreSecurityHostdevLabel() for hostdev and pcidev attach. virt-aa-helper also has to be adjusted because *FileIterate() is used for pci and usb devices and the corresponding XML for hot attached hostdev and pcidev is not in the XML passed to virt-aa-helper. The new '-F filename' option is added to append a rule to the profile as opposed to the existing '-f filename', which rewrites the libvirt-<uuid>.files file anew. This new '-F' option will append a rule to an existing libvirt-<uuid>.files if it exists, otherwise it acts the same as '-f'. load_profile() and reload_profile() have been adjusted to add an 'append' argument, which when true will use '-F' instead of '-f' when executing virt-aa-helper. All existing calls to load_profile() and reload_profile() have been adjusted to use the old behavior (ie append==false) except AppArmorSetSavedStateLabel() where it made sense to use the new behavior. This patch also adds tests for '-F' The tests still use the old convention of cat with sed that Eric Blake mentioned should be improved-- I will be submitting another patch for this. This patch compiles fine with --enable-compile-warnings=error, passes the parts of 'make check' that this patch touches (ie, the daemon-conf fails here, but it always fails for me) and passes 'syntax-check'. Jamie [1]https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/640993 -- Jamie Strandboge | http://www.canonical.com

3 4

[libvirt] [PATCH] virt-aa-helper: translate error messages
by Eric Blake 30 Sep '10

30 Sep '10

These messages are visible to the user, so they should be consistently translated. * cfg.mk (msg_gen_function): Add vah_error, vah_warning. * src/security/virt-aa-helper.c: Translate messages. (catchXMLError): Fix capitalization. --- I noticed this sitting on one of my branches (since May!) thanks to Jamie's recent apparmor patches. Any objections? cfg.mk | 2 + src/security/virt-aa-helper.c | 181 +++++++++++++++++++++-------------------- 2 files changed, 95 insertions(+), 88 deletions(-) diff --git a/cfg.mk b/cfg.mk index d50ffb7..fd64966 100644 --- a/cfg.mk +++ b/cfg.mk @@ -337,6 +337,8 @@ msg_gen_function += qemudReportError msg_gen_function += regerror msg_gen_function += remoteDispatchFormatError msg_gen_function += umlReportError +msg_gen_function += vah_error +msg_gen_function += vah_warning msg_gen_function += vboxError msg_gen_function += virConfError msg_gen_function += virDomainReportError diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c index eba34b0..cc1368a 100644 --- a/src/security/virt-aa-helper.c +++ b/src/security/virt-aa-helper.c @@ -1,6 +1,8 @@ /* * virt-aa-helper: wrapper program used by AppArmor security driver. + * + * Copyright (C) 2010 Red Hat, Inc. * Copyright (C) 2009-2010 Canonical Ltd. * * See COPYING.LIB for the License of this software @@ -80,28 +82,28 @@ vahDeinit(vahControl * ctl) static void vah_usage(void) { - fprintf(stdout, "\n%s [options] [< def.xml]\n\n" - " Options:\n" - " -a | --add load profile\n" - " -c | --create create profile from template\n" - " -D | --delete unload and delete profile\n" - " -f | --add-file <file> add file to profile\n" - " -F | --append-file <file> append file to profile\n" - " -r | --replace reload profile\n" - " -R | --remove unload profile\n" - " -h | --help this help\n" - " -u | --uuid <uuid> uuid (profile name)\n" - "\n", progname); - - fprintf(stdout, "This command is intended to be used by libvirtd " - "and not used directly.\n"); + fprintf(stdout, _("\n%s [options] [< def.xml]\n\n + Options:\n + -a | --add load profile\n + -c | --create create profile from template\n + -D | --delete unload and delete profile\n + -f | --add-file <file> add file to profile\n + -F | --append-file <file> append file to profile\n + -r | --replace reload profile\n + -R | --remove unload profile\n + -h | --help this help\n + -u | --uuid <uuid> uuid (profile name)\n +\n", progname); + + fputs(_("This command is intended to be used by libvirtd " + "and not used directly.\n")); return; } static void vah_error(vahControl * ctl, int doexit, const char *str) { - fprintf(stderr, _("%s: error: %s\n"), progname, str); + fprintf(stderr, _("%s: error: %s%c"), progname, str, '\n'); if (doexit) { if (ctl != NULL) @@ -113,13 +115,13 @@ vah_error(vahControl * ctl, int doexit, const char *str) static void vah_warning(const char *str) { - fprintf(stderr, _("%s: warning: %s\n"), progname, str); + fprintf(stderr, _("%s: warning: %s%c"), progname, str, '\n'); } static void vah_info(const char *str) { - fprintf(stderr, _("%s:\n%s\n"), progname, str); + fprintf(stderr, _("%s:\n%s%c"), progname, str, '\n'); } /* @@ -136,12 +138,12 @@ replace_string(char *orig, const size_t len, const char *oldstr, char *tmp = NULL; if ((pos = strstr(orig, oldstr)) == NULL) { - vah_error(NULL, 0, "could not find replacement string"); + vah_error(NULL, 0, _("could not find replacement string")); return -1; } if (VIR_ALLOC_N(tmp, len) < 0) { - vah_error(NULL, 0, "could not allocate memory for string"); + vah_error(NULL, 0, _("could not allocate memory for string")); return -1; } tmp[0] = '\0'; @@ -153,7 +155,7 @@ replace_string(char *orig, const size_t len, const char *oldstr, /* add the replacement string */ if (strlen(tmp) + strlen(repstr) > len - 1) { - vah_error(NULL, 0, "not enough space in target buffer"); + vah_error(NULL, 0, _("not enough space in target buffer")); VIR_FREE(tmp); return -1; } @@ -161,7 +163,7 @@ replace_string(char *orig, const size_t len, const char *oldstr, /* add everything after oldstr */ if (strlen(tmp) + strlen(orig) - (idx + strlen(oldstr)) > len - 1) { - vah_error(NULL, 0, "not enough space in target buffer"); + vah_error(NULL, 0, _("not enough space in target buffer")); VIR_FREE(tmp); return -1; } @@ -169,7 +171,7 @@ replace_string(char *orig, const size_t len, const char *oldstr, strlen(orig) - (idx + strlen(oldstr))); if (virStrcpy(orig, tmp, len) == NULL) { - vah_error(NULL, 0, "error replacing string"); + vah_error(NULL, 0, _("error replacing string")); VIR_FREE(tmp); return -1; } @@ -190,7 +192,7 @@ parserCommand(const char *profile_name, const char cmd) int ret; if (strchr("arR", cmd) == NULL) { - vah_error(NULL, 0, "invalid flag"); + vah_error(NULL, 0, _("invalid flag")); return -1; } @@ -198,12 +200,12 @@ parserCommand(const char *profile_name, const char cmd) if (snprintf(profile, PATH_MAX, "%s/%s", APPARMOR_DIR "/libvirt", profile_name) > PATH_MAX - 1) { - vah_error(NULL, 0, "profile name exceeds maximum length"); + vah_error(NULL, 0, _("profile name exceeds maximum length")); return -1; } if (!virFileExists(profile)) { - vah_error(NULL, 0, "profile does not exist"); + vah_error(NULL, 0, _("profile does not exist")); return -1; } else { const char * const argv[] = { @@ -212,12 +214,13 @@ parserCommand(const char *profile_name, const char cmd) if ((ret = virRun(argv, &status)) != 0 || (WIFEXITED(status) && WEXITSTATUS(status) != 0)) { if (ret != 0) { - vah_error(NULL, 0, "failed to run apparmor_parser"); + vah_error(NULL, 0, _("failed to run apparmor_parser")); return -1; - } else if (cmd == 'R' && WIFEXITED(status) && WEXITSTATUS(status) == 234) { - vah_warning("unable to unload already unloaded profile (non-fatal)"); + } else if (cmd == 'R' && WIFEXITED(status) && + WEXITSTATUS(status) == 234) { + vah_warning(_("unable to unload already unloaded profile")); } else { - vah_error(NULL, 0, "apparmor_parser exited with error"); + vah_error(NULL, 0, _("apparmor_parser exited with error")); return -1; } } @@ -249,19 +252,19 @@ update_include_file(const char *include_file, const char *included_files, if (append && virFileExists(include_file)) { if (virAsprintf(&pcontent, "%s%s", existing, included_files) == -1) { - vah_error(NULL, 0, "could not allocate memory for profile"); + vah_error(NULL, 0, _("could not allocate memory for profile")); goto clean; } } else { if (virAsprintf(&pcontent, "%s%s", warning, included_files) == -1) { - vah_error(NULL, 0, "could not allocate memory for profile"); + vah_error(NULL, 0, _("could not allocate memory for profile")); goto clean; } } plen = strlen(pcontent); if (plen > MAX_FILE_LEN) { - vah_error(NULL, 0, "invalid length for new profile"); + vah_error(NULL, 0, _("invalid length for new profile")); goto clean; } @@ -273,18 +276,18 @@ update_include_file(const char *include_file, const char *included_files, /* write the file */ if ((fd = open(include_file, O_CREAT | O_TRUNC | O_WRONLY, 0644)) == -1) { - vah_error(NULL, 0, "failed to create include file"); + vah_error(NULL, 0, _("failed to create include file")); goto clean; } if (safewrite(fd, pcontent, plen) < 0) { /* don't write the '\0' */ close(fd); - vah_error(NULL, 0, "failed to write to profile"); + vah_error(NULL, 0, _("failed to write to profile")); goto clean; } if (close(fd) != 0) { - vah_error(NULL, 0, "failed to close or write to profile"); + vah_error(NULL, 0, _("failed to close or write to profile")); goto clean; } rc = 0; @@ -315,45 +318,45 @@ create_profile(const char *profile, const char *profile_name, int rc = -1; if (virFileExists(profile)) { - vah_error(NULL, 0, "profile exists"); + vah_error(NULL, 0, _("profile exists")); goto end; } if (snprintf(template, PATH_MAX, "%s/TEMPLATE", APPARMOR_DIR "/libvirt") > PATH_MAX - 1) { - vah_error(NULL, 0, "template name exceeds maximum length"); + vah_error(NULL, 0, _("template name exceeds maximum length")); goto end; } if (!virFileExists(template)) { - vah_error(NULL, 0, "template does not exist"); + vah_error(NULL, 0, _("template does not exist")); goto end; } if ((tlen = virFileReadAll(template, MAX_FILE_LEN, &tcontent)) < 0) { - vah_error(NULL, 0, "failed to read AppArmor template"); + vah_error(NULL, 0, _("failed to read AppArmor template")); goto end; } if (strstr(tcontent, template_name) == NULL) { - vah_error(NULL, 0, "no replacement string in template"); + vah_error(NULL, 0, _("no replacement string in template")); goto clean_tcontent; } if (strstr(tcontent, template_end) == NULL) { - vah_error(NULL, 0, "no replacement string in template"); + vah_error(NULL, 0, _("no replacement string in template")); goto clean_tcontent; } /* '\nprofile <profile_name>\0' */ if (virAsprintf(&replace_name, "\nprofile %s", profile_name) == -1) { - vah_error(NULL, 0, "could not allocate memory for profile name"); + vah_error(NULL, 0, _("could not allocate memory for profile name")); goto clean_tcontent; } /* '\n<profile_files>\n}\0' */ if (virAsprintf(&replace_files, "\n%s\n}", profile_files) == -1) { - vah_error(NULL, 0, "could not allocate memory for profile files"); + vah_error(NULL, 0, _("could not allocate memory for profile files")); VIR_FREE(replace_name); goto clean_tcontent; } @@ -361,12 +364,12 @@ create_profile(const char *profile, const char *profile_name, plen = tlen + strlen(replace_name) - strlen(template_name) + strlen(replace_files) - strlen(template_end) + 1; if (plen > MAX_FILE_LEN || plen < tlen) { - vah_error(NULL, 0, "invalid length for new profile"); + vah_error(NULL, 0, _("invalid length for new profile")); goto clean_replace; } if (VIR_ALLOC_N(pcontent, plen) < 0) { - vah_error(NULL, 0, "could not allocate memory for profile"); + vah_error(NULL, 0, _("could not allocate memory for profile")); goto clean_replace; } pcontent[0] = '\0'; @@ -380,18 +383,18 @@ create_profile(const char *profile, const char *profile_name, /* write the file */ if ((fd = open(profile, O_CREAT | O_EXCL | O_WRONLY, 0644)) == -1) { - vah_error(NULL, 0, "failed to create profile"); + vah_error(NULL, 0, _("failed to create profile")); goto clean_all; } if (safewrite(fd, pcontent, plen - 1) < 0) { /* don't write the '\0' */ close(fd); - vah_error(NULL, 0, "failed to write to profile"); + vah_error(NULL, 0, _("failed to write to profile")); goto clean_all; } if (close(fd) != 0) { - vah_error(NULL, 0, "failed to close or write to profile"); + vah_error(NULL, 0, _("failed to close or write to profile")); goto clean_all; } rc = 0; @@ -530,7 +533,7 @@ valid_path(const char *path, const bool readonly) }; if (path == NULL || strlen(path) > PATH_MAX - 1) { - vah_error(NULL, 0, "bad pathname"); + vah_error(NULL, 0, _("bad pathname")); return -1; } @@ -545,7 +548,7 @@ valid_path(const char *path, const bool readonly) return 1; if (!virFileExists(path)) - vah_warning("path does not exist, skipping file type checks"); + vah_warning(_("path does not exist, skipping file type checks")); else { if (stat(path, &sb) == -1) return -1; @@ -595,7 +598,7 @@ catchXMLError (void *ctx, const char *msg ATTRIBUTE_UNUSED, ...) if (virAsprintf(&err_str, "XML error at line %d: %s", ctxt->lastError.line, ctxt->lastError.message) == -1) - vah_error(NULL, 0, "Could not get XML error"); + vah_error(NULL, 0, _("could not get XML error")); else { vah_error(NULL, 0, err_str); VIR_FREE(err_str); @@ -632,29 +635,29 @@ caps_mockup(vahControl * ctl, const char *xmlStr) XML_PARSE_NOWARNING); if (!xml) { if (virGetLastError() == NULL) - vah_error(NULL, 0, "failed to parse xml document"); + vah_error(NULL, 0, _("failed to parse xml document")); goto cleanup; } if ((root = xmlDocGetRootElement(xml)) == NULL) { - vah_error(NULL, 0, "missing root element"); + vah_error(NULL, 0, _("missing root element")); goto cleanup; } if (!xmlStrEqual(root->name, BAD_CAST "domain")) { - vah_error(NULL, 0, "incorrect root element"); + vah_error(NULL, 0, _("incorrect root element")); goto cleanup; } if ((ctxt = xmlXPathNewContext(xml)) == NULL) { - vah_error(ctl, 0, "could not allocate memory"); + vah_error(ctl, 0, _("could not allocate memory")); goto cleanup; } ctxt->node = root; ctl->hvm = virXPathString("string(./os/type[1])", ctxt); if (!ctl->hvm || STRNEQ(ctl->hvm, "hvm")) { - vah_error(ctl, 0, "os.type is not 'hvm'"); + vah_error(ctl, 0, _("os.type is not 'hvm'")); goto cleanup; } ctl->arch = virXPathString("string(./os/type[1]/@arch)", ctxt); @@ -667,7 +670,7 @@ caps_mockup(vahControl * ctl, const char *xmlStr) /* Really, this never fails - look at the man-page. */ uname (&utsname); if ((ctl->arch = strdup(utsname.machine)) == NULL) { - vah_error(ctl, 0, "could not allocate memory"); + vah_error(ctl, 0, _("could not allocate memory")); goto cleanup; } } @@ -700,7 +703,7 @@ get_definition(vahControl * ctl, const char *xmlStr) goto exit; if ((ctl->caps = virCapabilitiesNew(ctl->arch, 1, 1)) == NULL) { - vah_error(ctl, 0, "could not allocate memory"); + vah_error(ctl, 0, _("could not allocate memory")); goto exit; } @@ -712,24 +715,24 @@ get_definition(vahControl * ctl, const char *xmlStr) NULL, 0, NULL)) == NULL) { - vah_error(ctl, 0, "could not allocate memory"); + vah_error(ctl, 0, _("could not allocate memory")); goto exit; } ctl->def = virDomainDefParseString(ctl->caps, xmlStr, VIR_DOMAIN_XML_INACTIVE); if (ctl->def == NULL) { - vah_error(ctl, 0, "could not parse XML"); + vah_error(ctl, 0, _("could not parse XML")); goto exit; } if (!ctl->def->name) { - vah_error(ctl, 0, "could not find name in XML"); + vah_error(ctl, 0, _("could not find name in XML")); goto exit; } if (valid_name(ctl->def->name) != 0) { - vah_error(ctl, 0, "bad name"); + vah_error(ctl, 0, _("bad name")); goto exit; } @@ -755,14 +758,14 @@ vah_add_file(virBufferPtr buf, const char *path, const char *perms) */ if (STRNEQLEN(path, "/", 1)) { vah_warning(path); - vah_warning(" skipped non-absolute path"); + vah_warning(_(" skipped non-absolute path")); return 0; } if (virFileExists(path)) { if ((tmp = realpath(path, NULL)) == NULL) { vah_error(NULL, 0, path); - vah_error(NULL, 0, " could not find realpath for disk"); + vah_error(NULL, 0, _(" could not find realpath for disk")); return rc; } } else @@ -776,7 +779,7 @@ vah_add_file(virBufferPtr buf, const char *path, const char *perms) if (rc != 0) { if (rc > 0) { vah_error(NULL, 0, path); - vah_error(NULL, 0, " skipped restricted file"); + vah_error(NULL, 0, _(" skipped restricted file")); } goto clean; } @@ -846,12 +849,12 @@ get_files(vahControl * ctl) /* verify uuid is same as what we were given on the command line */ virUUIDFormat(ctl->def->uuid, uuidstr); if (virAsprintf(&uuid, "%s%s", AA_PREFIX, uuidstr) == -1) { - vah_error(ctl, 0, "could not allocate memory"); + vah_error(ctl, 0, _("could not allocate memory")); return rc; } if (STRNEQ(uuid, ctl->uuid)) { - vah_error(ctl, 0, "given uuid does not match XML uuid"); + vah_error(ctl, 0, _("given uuid does not match XML uuid")); goto clean; } @@ -972,7 +975,7 @@ get_files(vahControl * ctl) if (virBufferError(&buf)) { virBufferFreeAndReset(&buf); - vah_error(NULL, 0, "failed to allocate file buffer"); + vah_error(NULL, 0, _("failed to allocate file buffer")); goto clean; } @@ -1021,7 +1024,7 @@ vahParseArgv(vahControl * ctl, int argc, char **argv) case 'f': case 'F': if ((ctl->newfile = strdup(optarg)) == NULL) - vah_error(ctl, 1, "could not allocate memory for disk"); + vah_error(ctl, 1, _("could not allocate memory for disk")_; ctl->append = arg == 'F'; break; case 'h': @@ -1036,10 +1039,10 @@ vahParseArgv(vahControl * ctl, int argc, char **argv) break; case 'u': if (strlen(optarg) > PROFILE_NAME_SIZE - 1) - vah_error(ctl, 1, "invalid UUID"); + vah_error(ctl, 1, _("invalid UUID")); if (virStrcpy((char *) ctl->uuid, optarg, PROFILE_NAME_SIZE) == NULL) - vah_error(ctl, 1, "error copying UUID"); + vah_error(ctl, 1, _("error copying UUID")); break; case 'p': if (STREQ(optarg, "1")) @@ -1048,15 +1051,15 @@ vahParseArgv(vahControl * ctl, int argc, char **argv) ctl->allowDiskFormatProbing = false; break; default: - vah_error(ctl, 1, "unsupported option"); + vah_error(ctl, 1, _("unsupported option")); break; } } if (strchr("acDrR", ctl->cmd) == NULL) - vah_error(ctl, 1, "bad command"); + vah_error(ctl, 1, _("bad command")); if (valid_uuid(ctl->uuid) != 0) - vah_error(ctl, 1, "invalid UUID"); + vah_error(ctl, 1, _("invalid UUID")); if (!ctl->cmd) { vah_usage(); @@ -1066,16 +1069,16 @@ vahParseArgv(vahControl * ctl, int argc, char **argv) if (ctl->cmd == 'c' || ctl->cmd == 'r') { char *xmlStr = NULL; if (virFileReadLimFD(STDIN_FILENO, MAX_FILE_LEN, &xmlStr) < 0) - vah_error(ctl, 1, "could not read xml file"); + vah_error(ctl, 1, _("could not read xml file")); if (get_definition(ctl, xmlStr) != 0 || ctl->def == NULL) { VIR_FREE(xmlStr); - vah_error(ctl, 1, "could not get VM definition"); + vah_error(ctl, 1, _("could not get VM definition")); } VIR_FREE(xmlStr); if (get_files(ctl) != 0) - vah_error(ctl, 1, "invalid VM definition"); + vah_error(ctl, 1, _("invalid VM definition")); } return 0; } @@ -1100,10 +1103,11 @@ main(int argc, char **argv) /* clear the environment */ environ = NULL; if (setenv("PATH", "/sbin:/usr/sbin", 1) != 0) { - vah_error(ctl, 1, "could not set PATH"); + vah_error(ctl, 1, _("could not set PATH")); } + if (setenv("IFS", " \t\n", 1) != 0) { - vah_error(ctl, 1, "could not set IFS"); + vah_error(ctl, 1, _("could not set IFS")); } if (!(progname = strrchr(argv[0], '/'))) @@ -1114,15 +1118,15 @@ main(int argc, char **argv) memset(ctl, 0, sizeof(vahControl)); if (vahParseArgv(ctl, argc, argv) != 0) - vah_error(ctl, 1, "could not parse arguments"); + vah_error(ctl, 1, _("could not parse arguments")); if (snprintf(profile, PATH_MAX, "%s/%s", APPARMOR_DIR "/libvirt", ctl->uuid) > PATH_MAX - 1) - vah_error(ctl, 1, "profile name exceeds maximum length"); + vah_error(ctl, 1, _("profile name exceeds maximum length")); if (snprintf(include_file, PATH_MAX, "%s/%s.files", APPARMOR_DIR "/libvirt", ctl->uuid) > PATH_MAX - 1) - vah_error(ctl, 1, "disk profile name exceeds maximum length"); + vah_error(ctl, 1, _("disk profile name exceeds maximum length")); if (ctl->cmd == 'a') rc = parserLoad(ctl->uuid); @@ -1135,8 +1139,9 @@ main(int argc, char **argv) } else if (ctl->cmd == 'c' || ctl->cmd == 'r') { char *included_files = NULL; - if (ctl->cmd == 'c' && virFileExists(profile)) - vah_error(ctl, 1, "profile exists"); + if (ctl->cmd == 'c' && virFileExists(profile)) { + vah_error(ctl, 1, _("profile exists")); + } if (ctl->append && ctl->newfile) { if (vah_add_file(&buf, ctl->newfile, "rw") != 0) @@ -1154,7 +1159,7 @@ main(int argc, char **argv) if (virBufferError(&buf)) { virBufferFreeAndReset(&buf); - vah_error(ctl, 1, "failed to allocate buffer"); + vah_error(ctl, 1, _("failed to allocate buffer")); } included_files = virBufferContentAndReset(&buf); @@ -1175,7 +1180,7 @@ main(int argc, char **argv) char *tmp = NULL; if (virAsprintf(&tmp, " #include <libvirt/%s.files>\n", ctl->uuid) == -1) { - vah_error(ctl, 0, "could not allocate memory"); + vah_error(ctl, 0, _("could not allocate memory")); goto clean; } @@ -1185,7 +1190,7 @@ main(int argc, char **argv) vah_info(tmp); rc = 0; } else if ((rc = create_profile(profile, ctl->uuid, tmp)) != 0) { - vah_error(ctl, 0, "could not create profile"); + vah_error(ctl, 0, _("could not create profile")); unlink(include_file); } VIR_FREE(tmp); -- 1.7.2.3

1 1

[libvirt] [PATCH] 1/1: virt-aa-helper-test cleanups
by Jamie Strandboge 30 Sep '10

30 Sep '10

Attached is a patch for tests/virt-aa-helper-test to use sed instead of 'cat ... | sed ...', as suggested by Eric Blake. This assumes that 0001-apparmor-hostdev.patch from my last submission for usb and pci hot attach is already applied. -- Jamie Strandboge | http://www.canonical.com

2 1

[libvirt] [Patch v3 0/5] nwfilter: Support comment attribute in filter rule descriptions
by Stefan Berger 30 Sep '10

30 Sep '10

V3: - moved MAX_COMMENT_LENGTH #define into include file (1/5) - renamed IPTABLES_MAX_COMMENT_SIZE to IPTABLES_MAX_COMMENT_LENGTH (2/5) - removal of regex from string patter in schema for comment attribute (3/5) - added libvirt version since when comment attribute is available (4/5) - added test cases (5/5) V2: - work on the iptables instantiation patch (2/5) - work on the parser patch (1/5) - small changes to the test cases (5/5) The following patch series adds support for a comment node to the XML attributes of all protocols. If possible, as for example in case of iptables, the comments are instantiated (iptables ... -m comment --comment ...). The patches do the following: - extend the parser and XML generator to parse and create XML with the comment attribute - instantiate the comment in case of ip(6)tables - extend the nwfilter.rng schema with the comment attribute - add the information to the web docs - add a test case for the XML parser/generator to be run during 'make check' Regards, Stefan

3 7

[libvirt] [PATCH] autogen: allow aclocal to receive arguments via an environment variable
by Justin Clift 30 Sep '10

30 Sep '10

On Mac OS X, the "Homebrew" build system (one of the three main ones) has its m4 macro directory placed in a user configurable location. This patch adds a simple way to pass this configuration information to aclocal, using an environment variable called ACLOCAL_FLAGS. This allows the packaging of libvirt into the Homebrew build system. ie: $ export ACLOCAL_FLAGS="-I /path/to/m4/macro/dir/" --- Although this patch works, I'm kind of expecting Eric will have a better way of achieving what this is trying to do, so this will get NACKed. No stress. :) README-hacking | 6 ++++++ bootstrap | 2 +- 2 files changed, 7 insertions(+), 1 deletions(-) diff --git a/README-hacking b/README-hacking index 80b022c..74f3bed 100644 --- a/README-hacking +++ b/README-hacking @@ -33,6 +33,12 @@ reduce download time and disk space requirements: $ export GNULIB_SRCDIR=/path/to/gnulib +Also, if you have M4 macro files (.m4) in a non-standard location, +you can include them in the build process with the ACLOCAL_FLAGS +environment variable: + + $ export ACLOCAL_FLAGS="-I /path/to/extra/macro/dir" + The next step is to get all required pieces from gnulib, to run autoreconf, and to invoke ./configure: diff --git a/bootstrap b/bootstrap index 2422549..593e0b2 100755 --- a/bootstrap +++ b/bootstrap @@ -775,7 +775,7 @@ grep -E '^[ ]*AC_CONFIG_HEADERS?\>' configure.ac >/dev/null || for command in \ libtool \ - "${ACLOCAL-aclocal} --force -I m4" \ + "${ACLOCAL-aclocal} --force -I m4 ${ACLOCAL_FLAGS}" \ "${AUTOCONF-autoconf} --force" \ "${AUTOHEADER-autoheader} --force" \ "${AUTOMAKE-automake} --add-missing --copy --force-missing" -- 1.7.2.1

2 1

[libvirt] [PATCH V2] Rework configure logic for virtualport support
by Stefan Berger 29 Sep '10

29 Sep '10

V2: - added missing AC_ARG_WITH() for --with-virtualport In this patch I am reworking the logic around detecting virtual port support and requiring the libnl dependency. - It requires --with-macvtap and displays an error in case of --without-macvtap --with-virtualport. - It tests for availability of certain data in include files and displays an error in case the include file is not at the correct level and --with-virtualport was chosen - displays 'checking' messages for macvtap and virtualport support and results - libnl support is required when macvtap is found or requested; if libnl is not there, please supply without-macvtap Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> diff --git a/configure.ac b/configure.ac index 6100610..da38b8b 100644 --- a/configure.ac +++ b/configure.ac @@ -2058,6 +2058,7 @@ AC_ARG_WITH([macvtap], [with_macvtap=${withval}], [with_macvtap=check]) +AC_MSG_CHECKING([whether to compile with macvtap support]) if test "$with_macvtap" != "no" ; then AC_TRY_COMPILE([ #include <sys/socket.h> #include <linux/rtnetlink.h> ], @@ -2075,19 +2076,35 @@ if test "$with_macvtap" != "no" ; then AC_DEFINE_UNQUOTED([WITH_MACVTAP], $val, [whether macvtap support is enabled]) fi AM_CONDITIONAL([WITH_MACVTAP], [test "$with_macvtap" = "yes"]) +AC_MSG_RESULT([$with_macvtap]) -AC_TRY_COMPILE([ #include <sys/socket.h> - #include <linux/rtnetlink.h> ], - [ int x = IFLA_PORT_MAX; ], - [ with_virtualport=yes ], - [ with_virtualport=no ]) -if test "$with_virtualport" = "yes"; then - val=1 -else - val=0 +AC_ARG_WITH([virtualport], + AC_HELP_STRING([--with-virtualport],[enable virtual port support @<:@default=check@:>@]), + [with_virtualport=${withval}], + [with_virtualport=check]) + +if test "$with_virtualport" != "no"; then + if test "$with_macvtap" = "no"; then + AC_MSG_ERROR([--with-virtualport requires --with-macvtap]) + fi + AC_MSG_CHECKING([whether to compile with virtual port support]) + AC_TRY_COMPILE([ #include <sys/socket.h> + #include <linux/rtnetlink.h> ], + [ int x = IFLA_PORT_MAX; ], + [ with_virtualport=yes ], + [ if test "$with_virtualport" = "yes" ; then + AC_MSG_ERROR([Installed linux headers don't show support for virtual port support.]) + fi + with_virtualport=no ]) + if test "$with_virtualport" = "yes"; then + val=1 + else + val=0 + fi + AC_DEFINE_UNQUOTED([WITH_VIRTUALPORT], $val, + [whether vsi vepa support is enabled]) + AC_MSG_RESULT([$with_virtualport]) fi -AC_DEFINE_UNQUOTED([WITH_VIRTUALPORT], $val, - [whether vsi vepa support is enabled]) AM_CONDITIONAL([WITH_VIRTUALPORT], [test "$with_virtualport" = "yes"]) @@ -2096,7 +2113,7 @@ dnl netlink library LIBNL_CFLAGS="" LIBNL_LIBS="" -if test "$with_macvtap" = "yes" || test "$with_virtualport" = "yes"; then +if test "$with_macvtap" = "yes"; then PKG_CHECK_MODULES([LIBNL], [libnl-1 >= $LIBNL_REQUIRED], [ ], [ AC_MSG_ERROR([libnl >= $LIBNL_REQUIRED is required for macvtap support])

3 9

[libvirt] [PATCH] mpath: disable devmapper-multipath checking on non-linux
by Justin Clift 29 Sep '10

29 Sep '10

The configure script was breaking on MacOS X unless passed: --without-storage-mpath This patch leverages Stefan Bergers earlier work for nwfilter, so non-linux systems don't even attempt to build multipath. --- configure.ac | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) diff --git a/configure.ac b/configure.ac index 8dcd756..ee6f9b1 100644 --- a/configure.ac +++ b/configure.ac @@ -1503,7 +1503,15 @@ if test "$with_storage_scsi" = "check"; then fi AM_CONDITIONAL([WITH_STORAGE_SCSI], [test "$with_storage_scsi" = "yes"]) -if test "$with_storage_mpath" = "check"; then +with_linux=no +case "$host" in + *-*-linux*) + with_linux=yes + ;; +esac +AM_CONDITIONAL([WITH_LINUX], [test "$with_linux" = "yes"]) + +if test "$with_storage_mpath" = "check" && test "$with_linux" = "yes"; then with_storage_mpath=yes AC_DEFINE_UNQUOTED([WITH_STORAGE_MPATH], 1, @@ -2022,14 +2030,6 @@ then fi AM_CONDITIONAL([WITH_NODE_DEVICES], [test "$with_nodedev" = "yes"]) -with_linux=no -case "$host" in - *-*-linux*) - with_linux=yes - ;; -esac -AM_CONDITIONAL([WITH_LINUX], [test "$with_linux" = "yes"]) - with_nwfilter=yes if test "$with_libvirtd" = "no" || test "$with_linux" != "yes"; then -- 1.7.3

2 2

[libvirt] [PATCH] autogen: added glibtool and pkg-config checks
by Justin Clift 29 Sep '10

29 Sep '10

OSX MacPorts has libtool named as glibtool, with libtoolize named as glibtoolize. This patch adds support for this, and also adds a check for pkg-config, to warn when it is missing. --- autogen.sh | 25 ++++++++++++++++++++----- 1 files changed, 20 insertions(+), 5 deletions(-) diff --git a/autogen.sh b/autogen.sh index 01ba59c..810a189 100755 --- a/autogen.sh +++ b/autogen.sh @@ -25,11 +25,18 @@ DIE=0 } (libtool --version) < /dev/null > /dev/null 2>&1 || { - echo - echo "You must have libtool installed to compile libvirt." - echo "Download the appropriate package for your distribution," - echo "or see http://www.gnu.org/software/libtool" - DIE=1 + # GNU libtool wasn't found as "libtool", + # so we check if it's known as "glibtool" + (glibtool --version) < /dev/null > /dev/null 2>&1 || { + echo + echo "You must have libtool installed to compile libvirt." + echo "Download the appropriate package for your distribution," + echo "or see http://www.gnu.org/software/libtool" + DIE=1 + } + # These are only used if glibtool is what we want + export LIBTOOL=glibtool + export LIBTOOLIZE=glibtoolize } (automake --version) < /dev/null > /dev/null 2>&1 || { @@ -40,6 +47,14 @@ DIE=0 echo "or see http://www.gnu.org/software/automake" } +(pkg-config --version) < /dev/null > /dev/null 2>&1 || { + echo + DIE=1 + echo "You must have pkg-config installed to compile libvirt." + echo "Download the appropriate package for your distribution," + echo "or see http://pkg-config.freedesktop.org" +} + if test "$DIE" -eq 1; then exit 1 fi -- 1.7.2.2

3 9

[libvirt] RFC: add <currentVcpu> element
by Eric Blake 29 Sep '10

29 Sep '10

Some hypervisors have the ability to hot-plug VCPUs exposed to the guest. Right now, libvirt XML only has the ability to describe the total number of vcpus assigned to a domain (the <vcpu> element under <domain>). It has the following APIs: virConnectGetMaxVcpus - provide maximum that host can assign to guests virDomainGetMaxVcpus - if domain is active, then max it was booted with; if inactive, then same as virConnectGetMaxVcpus virDomainSetVcpus - change current vcpus assigned to domain; active domain only virDomainPinVcpu - control how vcpus are pinned; active domain only virDomainGetVcpus - detailed map of how vcpus are mapped to host cpus And virsh has these commands: setvcpus - maps to virDomainSetVcpus vcpuinfo - maps to virDomainGetVcpus vcpupin - maps to virDomainPinVcpu https://bugzilla.redhat.com/show_bug.cgi?id=545118 describes the use case of booting a Xen HV with one value set for the maximum vcpu count, but another value for the current count. Technically, this can already be approximated by calling virDomainSetVcpus immediately after the guest is booted, but that can be resource-intensive, compared to the alternative of using xen's command line options to boot with a smaller current value than the maximum, and only later hot-plugging additional vcpus when needed (up to the maximum set at boot time). And it is not persistent, so the extra vcpus must be manually unplugged every boot. At the XML layer, I'm proposing the addition of a new element <currentVcpu>: <domain ...> <vcpu>2</vcpu> <currentVcpu>1</vcpu> ... If absent, then we keep the status quo of starting the domain with the same number of vcpus as the maximum. If present, it must be between 1 and <vcpu> inclusive (where supported, and exactly <vcpu> for hypervisors that lack vcpu hot-plug support), and dumping the xml of a domain will update the element to match virDomainSetVcpus; this provides the persistence aspect, and allows domain startup to take advantage of any command line options to start with a reduced current vcpu count rather than having to unplug vcpus after the fact. At the library API layer, I plan on adding: virDomainSetMaxVcpus - alter the <vcpu> xml aspect of a domain for next boot; only affects persistent state virDomainSetVcpusFlags - alter the <currentVcpu> xml aspect of a domain, with a flag to state whether the change is persistent (inactive domains or affecting next boot of active domain) or live (active domains only). and altering: virDomainSetVcpus - can additionally be used on inactive domains to affect next boot; no change to active semantics, basically now a wrapper for virDomainSetVcpusFlags(,0) virDomainGetMaxVcpus - on inactive domains, this value now matches the <vcpu> setting rather than blindly matching virConnectGetMaxVcpus I think that the existing virDomainGetVcpus is adequate for determining the number of current vcpus in an active domain. Any other API changes that you think might be necessary? Finally, at the virsh layer, I plan on: vcpuinfo: add --count flag; if flag is present, then inactive domains show current and max vcpus rather than erroring out, and active domains add current and max vcpu information to the overall output setvcpus: add --max and --persistent flags; without flags, this still maps to virDomainSetVcpus and only affects active domains; with --max, it maps to virDomainSetMaxVcpus, with --persistent, it maps to virDomainSetVcpusFlags Any thoughts on this plan of attack before I start submitting code patches? -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

2 12

[libvirt] [PATCH] Rework configure logic for virtualport support
by Stefan Berger 28 Sep '10

28 Sep '10

In this patch I am reworking the logic around detecting virtual port support and requiring the libnl dependency. - It requires --with-macvtap and displays an error in case of --without-macvtap --with-virtualport. - It tests for availability of certain data in include files and displays an error in case the include file is not at the correct level and --with-virtualport was chosen - displays 'checking' messages for macvtap and virtualport support and results - libnl support is required when macvtap is found or requested; if libnl is not there, please supply without-macvtap Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> diff --git a/configure.ac b/configure.ac index 6100610..d94b510 100644 --- a/configure.ac +++ b/configure.ac @@ -2058,6 +2058,7 @@ AC_ARG_WITH([macvtap], [with_macvtap=${withval}], [with_macvtap=check]) +AC_MSG_CHECKING([whether to compile with macvtap support]) if test "$with_macvtap" != "no" ; then AC_TRY_COMPILE([ #include <sys/socket.h> #include <linux/rtnetlink.h> ], @@ -2075,19 +2076,31 @@ if test "$with_macvtap" != "no" ; then AC_DEFINE_UNQUOTED([WITH_MACVTAP], $val, [whether macvtap support is enabled]) fi AM_CONDITIONAL([WITH_MACVTAP], [test "$with_macvtap" = "yes"]) +AC_MSG_RESULT([$with_macvtap]) -AC_TRY_COMPILE([ #include <sys/socket.h> - #include <linux/rtnetlink.h> ], - [ int x = IFLA_PORT_MAX; ], - [ with_virtualport=yes ], - [ with_virtualport=no ]) -if test "$with_virtualport" = "yes"; then - val=1 -else - val=0 +val=0 +if test "$with_virtualport" != "no"; then + if test "$with_macvtap" = "no"; then + AC_MSG_ERROR([--with-virtualport requires --with-macvtap]) + fi + AC_MSG_CHECKING([whether to compile with virtual port support]) + AC_TRY_COMPILE([ #include <sys/socket.h> + #include <linux/rtnetlink.h> ], + [ int x = IFLA_PORT_MAX; ], + [ with_virtualport=yes ], + [ if test "$with_virtualport" = "yes" ; then + AC_MSG_ERROR([Installed linux headers don't show support for virtual port support.]) + fi + with_virtualport=no ]) + if test "$with_virtualport" = "yes"; then + val=1 + else + val=0 + fi + AC_DEFINE_UNQUOTED([WITH_VIRTUALPORT], $val, + [whether vsi vepa support is enabled]) + AC_MSG_RESULT([$with_virtualport]) fi -AC_DEFINE_UNQUOTED([WITH_VIRTUALPORT], $val, - [whether vsi vepa support is enabled]) AM_CONDITIONAL([WITH_VIRTUALPORT], [test "$with_virtualport" = "yes"]) @@ -2096,7 +2109,7 @@ dnl netlink library LIBNL_CFLAGS="" LIBNL_LIBS="" -if test "$with_macvtap" = "yes" || test "$with_virtualport" = "yes"; then +if test "$with_macvtap" = "yes"; then PKG_CHECK_MODULES([LIBNL], [libnl-1 >= $LIBNL_REQUIRED], [ ], [ AC_MSG_ERROR([libnl >= $LIBNL_REQUIRED is required for macvtap support])

2 2

[libvirt] [PATCH] mac os x: don't compile failing example program on 32 bit mac os x
by Justin Clift 28 Sep '10

28 Sep '10

This addresses a compilation failure issue reported last year on OS X: https://www.redhat.com/archives/libvir-list/2009-May/msg00166.html In testing here, the compilation only fails on 32 bit OS X, but works on 64 bit, even when using exact same compile and linking flags. This commit surgically disables compilation of this one example program on 32 bit Mac OS X (only). Compilation still occurs, with a working executable produced, on 64 bit Mac OS X. --- examples/domain-events/events-c/event-test.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/examples/domain-events/events-c/event-test.c b/examples/domain-events/events-c/event-test.c index 74eabba..3dff13b 100644 --- a/examples/domain-events/events-c/event-test.c +++ b/examples/domain-events/events-c/event-test.c @@ -5,7 +5,7 @@ #include <string.h> #include <signal.h> -#if HAVE_SYS_POLL_H +#if HAVE_SYS_POLL_H && !(defined(__i386__) && defined(__APPLE__) && defined(__MACH__)) # include <sys/types.h> # include <sys/poll.h> # include <libvirt/libvirt.h> -- 1.7.3

2 3

[libvirt] [PATCH] mac os x: use awk selected by build system rather than first in path
by Justin Clift 28 Sep '10

28 Sep '10

Prior to this patch, the ChangeLog generation was hard coded to use "awk", when it should have been using the AWK variable set by our build system. This breaks compilation on a newly installed OS X system, where the default path has the Mac (non GNU) awk in the default search PATH before any installed GNU awk (gawk). --- docs/Makefile.am | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/docs/Makefile.am b/docs/Makefile.am index 114ea1f..7fae40d 100644 --- a/docs/Makefile.am +++ b/docs/Makefile.am @@ -88,7 +88,7 @@ api: libvirt-api.xml libvirt-refs.xml web: $(dot_html) html/index.html devhelp/index.html ChangeLog.xml: ../ChangeLog ChangeLog.awk - awk -f ChangeLog.awk < $< > $@ + $(AWK) -f ChangeLog.awk < $< > $@ ChangeLog.html.in: ChangeLog.xml ChangeLog.xsl @if [ -x $(XSLTPROC) ] ; then \ -- 1.7.2.3

2 2

[libvirt] [PATCH v2] nwfilter: Don't compile nwfilter driver on other systems than Linux
by Stefan Berger 28 Sep '10

28 Sep '10

v2: check 'with_linux' rather than using uname -s for checking for target system Don't compile the nwfilter driver (instantiating the rules) on other systems than Linux. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> diff --git a/configure.ac b/configure.ac index 23181dd..6100610 100644 --- a/configure.ac +++ b/configure.ac @@ -1360,15 +1360,6 @@ if test "$with_secrets" = "yes" ; then fi AM_CONDITIONAL([WITH_SECRETS], [test "$with_secrets" = "yes"]) -with_nwfilter=yes -if test "$with_libvirtd" = "no"; then - with_nwfilter=no -fi -if test "$with_nwfilter" = "yes" ; then - AC_DEFINE([WITH_NWFILTER], 1, [whether local network filter management driver is available]) -fi -AM_CONDITIONAL([WITH_NWFILTER], [test "$with_nwfilter" = "yes"]) - AC_ARG_WITH([storage-fs], AC_HELP_STRING([--with-storage-fs], [with FileSystem backend for the storage driver @<:@default=check@:>@]),[],[with_storage_fs=check]) @@ -2040,6 +2031,16 @@ esac AM_CONDITIONAL([WITH_LINUX], [test "$with_linux" = "yes"]) +with_nwfilter=yes +if test "$with_libvirtd" = "no" || test "$with_linux" != "yes"; then + with_nwfilter=no +fi +if test "$with_nwfilter" = "yes" ; then + AC_DEFINE([WITH_NWFILTER], 1, [whether local network filter management driver is available]) +fi +AM_CONDITIONAL([WITH_NWFILTER], [test "$with_nwfilter" = "yes"]) + + AC_ARG_WITH([qemu-user], AC_HELP_STRING([--with-qemu-user], [username to run QEMU system instance as @<:@default=root@:>@]), [QEMU_USER=${withval}],

3 6

[libvirt] [PATCH] virtualbox: fix a typo in the expected location on mac os x
by Justin Clift 28 Sep '10

28 Sep '10

Mac OS X provides an "/Applications" folder, not an "/Application" folder, so installed VirtualBox wasn't being detected by default. This 1 character patch fixes this. --- Pushed this under the "trivial" rule. It really is fixing someones typo. :) configure.ac | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 6100610..0403d1c 100644 --- a/configure.ac +++ b/configure.ac @@ -340,7 +340,7 @@ if test "x$with_vbox" = "xyes" || test "x$with_vbox" = "xcheck"; then /opt/VirtualBox/amd64/VBoxXPCOMC.so \ /usr/local/lib/virtualbox/VBoxXPCOMC.so \ /usr/local/lib/VirtualBox/VBoxXPCOMC.so \ - /Application/VirtualBox.app/Contents/MacOS/VBoxXPCOMC.dylib \ + /Applications/VirtualBox.app/Contents/MacOS/VBoxXPCOMC.dylib \ ; do if test -f "$vbox"; then vbox_xpcomc_dir=`AS_DIRNAME(["$vbox"])` -- 1.7.2.3

1 0

[libvirt] nwfilter: Don't compile nwfilter driver on other systems than Linux
by Stefan Berger 28 Sep '10

28 Sep '10

Don't compile the nwfilter driver (instantiating the rules) on other systems than Linux. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> diff --git a/configure.ac b/configure.ac index 23181dd..4cb0f50 100644 --- a/configure.ac +++ b/configure.ac @@ -1361,7 +1361,7 @@ fi AM_CONDITIONAL([WITH_SECRETS], [test "$with_secrets" = "yes"]) with_nwfilter=yes -if test "$with_libvirtd" = "no"; then +if test "$with_libvirtd" = "no" || test `uname -s` != "Linux"; then with_nwfilter=no fi if test "$with_nwfilter" = "yes" ; then

3 2

[libvirt] [PATCH] python: drop unneccesary conn assignment
by Dan Kenigsberg 27 Sep '10

27 Sep '10

Since 554d82a200289938d5639a782a9f12e3e2e968f0, conn is unused. Let's drop it - but keep the signature of the constructor for backward compatibility. --- python/libvirt-override.py | 9 --------- 1 files changed, 0 insertions(+), 9 deletions(-) diff --git a/python/libvirt-override.py b/python/libvirt-override.py index de1af2d..d544a0e 100644 --- a/python/libvirt-override.py +++ b/python/libvirt-override.py @@ -18,15 +18,6 @@ import types class libvirtError(Exception): def __init__(self, defmsg, conn=None, dom=None, net=None, pool=None, vol=None): - if dom is not None: - conn = dom._conn - elif net is not None: - conn = net._conn - elif pool is not None: - conn = pool._conn - elif vol is not None: - conn = vol._conn - # Never call virConnGetLastError(). # virGetLastError() is now thread local err = virGetLastError() -- 1.7.2.1

2 1

[libvirt] [PATCH] nwfilter: add a missing define, so libvirtd builds on macos x
by Justin Clift 27 Sep '10

27 Sep '10

The nwfilter code uses ETH_ALEN, which isn't defined on MacOS X. This is a simple workaround, to add it when missing. --- src/nwfilter/nwfilter_learnipaddr.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/src/nwfilter/nwfilter_learnipaddr.c b/src/nwfilter/nwfilter_learnipaddr.c index 7c94fc2..554422b 100644 --- a/src/nwfilter/nwfilter_learnipaddr.c +++ b/src/nwfilter/nwfilter_learnipaddr.c @@ -38,6 +38,11 @@ #include <net/if_arp.h> #include <intprops.h> +// Add Linux define missing from OSX +#ifndef ETH_ALEN +#define ETH_ALEN 6 /* Octets in one ethernet addr */ +#endif + #include "internal.h" #include "buf.h" -- 1.7.2.3

3 3

[libvirt] [patch 0/5] nwfilter: Support comment attribute in filter rule descriptions
by Stefan Berger 25 Sep '10

25 Sep '10

The following patch series adds support for a comment node to the XML attributes of all protocols. If possible, as for example in case of iptables, the comments are instantiated (iptables ... -m comment --comment ...). The patches do the following: - extend the parser and XML generator to parse and create XML with the comment attribute - instantiate the comment in case of ip(6)tables - extend the nwfilter.rng schema with the comment attribute - add the information to the web docs - add a test case for the XML parser/generator to be run during 'make check' Regards, Stefan

2 9

[libvirt] [PATCH] [TCK] nwfilter: test case for comment attribute
by Stefan Berger 24 Sep '10

24 Sep '10

This patch adds data for a test case for the comment attribute in the nwfilter XML. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall | 71 +++++++++++++++ scripts/nwfilter/nwfilterxml2xmlin/comment-test.xml | 68 ++++++++++++++ 2 files changed, 139 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/comment-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/comment-test.xml @@ -0,0 +1,68 @@ +<filter name='tck-testcase'> + <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid> + + <rule action='accept' direction='in'> + <mac protocolid='0x1234' comment='mac rule'/> + </rule> + + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='0x123' srcportend='0x234' + dstportstart='0x3456' dstportend='0x4567' + dscp='0x32' comment='ip rule'/> + </rule> + + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='tcp' + srcportstart='0x111' srcportend='400' + dstportstart='0x3333' dstportend='65535' comment='ipv6 rule'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='0x12' + protocoltype='0x56' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f' + comment='arp rule'/> + </rule> + + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='0x22' + srcportstart='0x123' srcportend='400' + dstportstart='0x234' dstportend='0x444' + comment='udp rule'/> + </rule> + + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='0x40' + srcportstart='0x20' srcportend='0x21' + dstportstart='0x100' dstportend='0x1111' + comment='tcp/ipv6 rule'/> + </rule> + + <rule action='accept' direction='in'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='0x40' + srcportstart='0x20' srcportend='0x21' + dstportstart='0x100' dstportend='0x1111' + comment='`ls`;${COLUMNS};$(ls);"test";&'/> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall @@ -0,0 +1,71 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-tos 0x32 --ip-proto udp --ip-sport 291:564 --ip-dport 13398:17767 -j ACCEPT +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto tcp --ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 18 --arp-ptype 0x56 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p 0x1234 -j ACCEPT +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x22/* udp rule */ udp spts:291:400 dpts:564:1092 state NEW,ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x22/* udp rule */ udp spts:564:1092 dpts:291:400 state ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x22/* udp rule */ udp spts:291:400 dpts:564:1092 +#iptables -L libvirt-host-in -n | grep HI-vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep FI-vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::/128 /* tcp/ipv6 rule */ tcp spts:256:4369 dpts:32:33 state ESTABLISHED +RETURN udp ::/0 a:b:c::/128 /* `ls`;${COLUMNS};$(ls);"test";& */ udp spts:256:4369 dpts:32:33 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 /* tcp/ipv6 rule */ tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED +ACCEPT udp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 /* `ls`;${COLUMNS};$(ls);"test";& */ udp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::/128 /* tcp/ipv6 rule */ tcp spts:256:4369 dpts:32:33 +ACCEPT udp ::/0 a:b:c::/128 /* `ls`;${COLUMNS};$(ls);"test";& */ udp spts:256:4369 dpts:32:33 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0

1 0

[libvirt] [PATCH] nwfilter: report if ip(6)tables rules would not be effective
by Stefan Berger 24 Sep '10

24 Sep '10

The patch below reports a warning in the log if the generated ip(6)tables rules would not be effective due to the proc filesystem entries /proc/sys/net/bridge/bridge-nf-call-iptables /proc/sys/net/bridge/bridge-nf-call-ip6tables containing a '0'. The warning tells the user what to do. I am rate-limiting the warning message to appear only every 10 seconds. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 51 ++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -24,6 +24,7 @@ #include <config.h> #include <sys/stat.h> +#include <fcntl.h> #include "internal.h" @@ -63,6 +64,13 @@ : "" +#define PROC_BRIDGE_NF_CALL_IPTABLES \ + "/proc/sys/net/bridge/bridge-nf-call-iptables" +#define PROC_BRIDGE_NF_CALL_IP6TABLES \ + "/proc/sys/net/bridge/bridge-nf-call-ip6tables" + +#define BRIDGE_NF_CALL_ALERT_INTERVAL 10 /* seconds */ + static char *ebtables_cmd_path; static char *iptables_cmd_path; static char *ip6tables_cmd_path; @@ -2986,6 +2994,45 @@ ebiptablesRuleOrderSort(const void *a, c } +static void +iptablesCheckBridgeNFCallEnabled(bool isIPv6) +{ + static time_t lastReport, lastReportIPv6; + const char *pathname = NULL; + char buffer[1]; + time_t now = time(NULL); + + if (isIPv6 && + (now - lastReportIPv6) > BRIDGE_NF_CALL_ALERT_INTERVAL ) { + pathname = PROC_BRIDGE_NF_CALL_IP6TABLES; + } else if (now - lastReport > BRIDGE_NF_CALL_ALERT_INTERVAL) { + pathname = PROC_BRIDGE_NF_CALL_IPTABLES; + } + + if (pathname) { + int fd = open(pathname, O_RDONLY); + if (fd >= 0) { + if (read(fd, buffer, 1) == 1) { + if (buffer[0] == '0') { + char msg[256]; + snprintf(msg, sizeof(msg), + _("To enable ip%stables filtering for the VM do " + "'echo 1 > %s'\n"), + isIPv6 ? "6" : "", + pathname); + VIR_WARN0(msg); + if (isIPv6) + lastReportIPv6 = now; + else + lastReport = now; + } + } + close(fd); + } + } +} + + static int ebiptablesApplyNewRules(virConnectPtr conn ATTRIBUTE_UNUSED, const char *ifname, @@ -3099,6 +3146,8 @@ ebiptablesApplyNewRules(virConnectPtr co if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; + + iptablesCheckBridgeNFCallEnabled(false); } if (haveIp6tables) { @@ -3129,6 +3178,8 @@ ebiptablesApplyNewRules(virConnectPtr co if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpip6tchains; + + iptablesCheckBridgeNFCallEnabled(true); } if (chains_in != 0)

2 2