- Devel - libvirt List Archives

[libvirt] [PATCH v3] buf: Fix possible infinite loop in EscapeString, VSnprintf
by Cole Robinson 10 Sep '10

10 Sep '10

The current code will go into an infinite loop if the printf generated string is >= 1000, AND exactly 1 character smaller than the amount of free space in the buffer. When this happens, we are dropped into the loop body, but nothing will actually change, because count == (buf->size - buf->use - 1), and virBufferGrow returns unchanged if count < (buf->size - buf->use) Fix this by removing the '- 1' bit from 'size'. The *nprintf functions handle the NULL byte for us anyways, so we shouldn't need to manually accommodate for it. Here's a bug where we are actually hitting this issue: https://bugzilla.redhat.com/show_bug.cgi?id=602772 v2: Eric's improvements: while -> if (), remove extra va_list variable, make sure we report buffer error if snprintf fails v3: Add tests/virbuftest which reproduces the infinite loop before this patch, works correctly after --- src/util/buf.c | 70 ++++++++++++++++++++++++++++--------------- tests/.gitignore | 1 + tests/Makefile.am | 7 ++++- tests/virbuftest.c | 84 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 137 insertions(+), 25 deletions(-) create mode 100644 tests/virbuftest.c diff --git a/src/util/buf.c b/src/util/buf.c index fc1217b..553e2a0 100644 --- a/src/util/buf.c +++ b/src/util/buf.c @@ -224,7 +224,7 @@ void virBufferVSprintf(const virBufferPtr buf, const char *format, ...) { int size, count, grow_size; - va_list locarg, argptr; + va_list argptr; if ((format == NULL) || (buf == NULL)) return; @@ -236,27 +236,38 @@ virBufferVSprintf(const virBufferPtr buf, const char *format, ...) virBufferGrow(buf, 100) < 0) return; - size = buf->size - buf->use - 1; va_start(argptr, format); - va_copy(locarg, argptr); - while (((count = vsnprintf(&buf->content[buf->use], size, format, - locarg)) < 0) || (count >= size - 1)) { + + size = buf->size - buf->use; + if ((count = vsnprintf(&buf->content[buf->use], + size, format, argptr)) < 0) { + buf->error = 1; + goto err; + } + + /* Grow buffer if necessary and retry */ + if (count >= size) { buf->content[buf->use] = 0; - va_end(locarg); + va_end(argptr); + va_start(argptr, format); - grow_size = (count > 1000) ? count : 1000; + grow_size = (count + 1 > 1000) ? count + 1 : 1000; if (virBufferGrow(buf, grow_size) < 0) { - va_end(argptr); - return; + goto err; } - size = buf->size - buf->use - 1; - va_copy(locarg, argptr); + size = buf->size - buf->use; + if ((count = vsnprintf(&buf->content[buf->use], + size, format, argptr)) < 0) { + buf->error = 1; + goto err; + } } - va_end(argptr); - va_end(locarg); buf->use += count; - buf->content[buf->use] = '\0'; + +err: + va_end(argptr); + return; } /** @@ -336,23 +347,34 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st if ((buf->use >= buf->size) && virBufferGrow(buf, 100) < 0) { - VIR_FREE(escaped); - return; + goto err; + } + + size = buf->size - buf->use; + if ((count = snprintf(&buf->content[buf->use], size, + format, (char *)escaped)) < 0) { + buf->error = 1; + goto err; } - size = buf->size - buf->use - 1; - while (((count = snprintf(&buf->content[buf->use], size, format, - (char *)escaped)) < 0) || (count >= size - 1)) { + /* Grow buffer if necessary and retry */ + if (count >= size) { buf->content[buf->use] = 0; - grow_size = (count > 1000) ? count : 1000; + grow_size = (count + 1 > 1000) ? count + 1 : 1000; if (virBufferGrow(buf, grow_size) < 0) { - VIR_FREE(escaped); - return; + goto err; + } + size = buf->size - buf->use; + + if ((count = snprintf(&buf->content[buf->use], size, + format, (char *)escaped)) < 0) { + buf->error = 1; + goto err; } - size = buf->size - buf->use - 1; } buf->use += count; - buf->content[buf->use] = '\0'; + +err: VIR_FREE(escaped); } diff --git a/tests/.gitignore b/tests/.gitignore index 3f32939..e7c74c5 100644 --- a/tests/.gitignore +++ b/tests/.gitignore @@ -21,6 +21,7 @@ storagepoolxml2xmltest nodeinfotest statstest qparamtest +virbuftest seclabeltest eventtest *.exe diff --git a/tests/Makefile.am b/tests/Makefile.am index 1dc7f66..dd59034 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -73,7 +73,7 @@ EXTRA_DIST = \ qemuhelpdata check_PROGRAMS = virshtest conftest \ - nodeinfotest statstest qparamtest + nodeinfotest statstest qparamtest virbuftest if WITH_XEN check_PROGRAMS += xml2sexprtest sexpr2xmltest \ @@ -151,6 +151,7 @@ TESTS = virshtest \ nodeinfotest \ statstest \ qparamtest \ + virbuftest \ $(test_scripts) if WITH_XEN @@ -352,6 +353,10 @@ qparamtest_SOURCES = \ qparamtest.c testutils.h testutils.c qparamtest_LDADD = $(LDADDS) +virbuftest_SOURCES = \ + virbuftest.c testutils.h testutils.c +virbuftest_LDADD = $(LDADDS) + if WITH_LIBVIRTD eventtest_SOURCES = \ eventtest.c testutils.h testutils.c ../daemon/event.c diff --git a/tests/virbuftest.c b/tests/virbuftest.c new file mode 100644 index 0000000..1cc9410 --- /dev/null +++ b/tests/virbuftest.c @@ -0,0 +1,84 @@ +#include <config.h> + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#include "internal.h" +#include "util.h" +#include "testutils.h" +#include "buf.h" +#include "memory.h" + +#define TEST_ERROR(...) \ + do { \ + if (virTestGetDebug()) \ + fprintf(stderr, __VA_ARGS__); \ + } while (0) + +struct testInfo { + int doEscape; +}; + +static int testBufInfiniteLoop(const void *data ATTRIBUTE_UNUSED) +{ + virBuffer bufinit = VIR_BUFFER_INITIALIZER; + virBufferPtr buf = &bufinit; + char *addstr = NULL, *bufret = NULL; + int ret = -1; + const struct testInfo *info = data; + + virBufferAddChar(buf, 'a'); + if (buf->a != 1002 || buf->b != 1) { + TEST_ERROR("Buf was not expected size, size=%d use=%d\n", + buf->a, buf->b); + goto out; + } + + /* + * Infinite loop triggers if: + * (strlen + 1 > 1000) && (strlen == buf-size - buf-use - 1) + */ + if (virAsprintf(&addstr, "%*s", buf->a - buf->b - 1, "a") < 0) { + goto out; + } + + if (info->doEscape) + virBufferEscapeString(buf, "%s", addstr); + else + virBufferVSprintf(buf, "%s", addstr); + + ret = 0; +out: + bufret = virBufferContentAndReset(buf); + if (!bufret) { + TEST_ERROR("Buffer had error set"); + ret = -1; + } + + VIR_FREE(addstr); + VIR_FREE(bufret); + return ret; +} + +static int +mymain(int argc ATTRIBUTE_UNUSED, + char **argv ATTRIBUTE_UNUSED) +{ + int ret = 0; + + +# define DO_TEST(msg, cb, data) \ + do { \ + struct testInfo info = { data }; \ + if (virtTestRun("Buf: " msg, 1, cb, &info) < 0) \ + ret = -1; \ + } while (0) + + DO_TEST("EscapeString infinite loop", testBufInfiniteLoop, 1); + DO_TEST("VSprintf infinite loop", testBufInfiniteLoop, 0); + + return(ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); +} + +VIRT_TEST_MAIN(mymain) -- 1.7.2.1

2 2

[libvirt] [PATCH] fix path to xen device statistics for newer kernels
by Guido Günther 10 Sep '10

10 Sep '10

Hi, it seems Xen changed the paths to the block device statistics in sysfs: from "/sys/devices/xen-backend/vbd-%d-%d/statistics/%s" to "/sys/bus/xen-backend/devices/vbd-%d-%d/statistics/%s": http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596004 Attached patch fixes this. O.k. to apply? -- Guido

3 2

[libvirt] [PATCH] virsh: Option for overriding disk type in attach-disk
by Jiri Denemark 10 Sep '10

10 Sep '10

Unless --driver tap|file option was given to attach-disk, virsh would generate <disk type='block'> XML which might be fine for Xen but not for other hypervisors. This patch introduces a new option --sourcetype which can be used to explicitly set the type of disk source. The option accepts either "file" or "block" types. --- tools/virsh.c | 12 ++++++++++-- 1 files changed, 10 insertions(+), 2 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 7bc33d8..57ea618 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -8116,6 +8116,7 @@ static const vshCmdOptDef opts_attach_disk[] = { {"type", VSH_OT_STRING, 0, N_("target device type")}, {"mode", VSH_OT_STRING, 0, N_("mode of device reading and writing")}, {"persistent", VSH_OT_BOOL, 0, N_("persist disk attachment")}, + {"sourcetype", VSH_OT_STRING, 0, N_("type of source (block|file)")}, {NULL, 0, 0, NULL} }; @@ -8127,6 +8128,7 @@ cmdAttachDisk(vshControl *ctl, const vshCmd *cmd) int isFile = 0, ret = FALSE; char *buf = NULL, *tmp = NULL; unsigned int flags; + char *stype; if (!vshConnectionUsability(ctl, ctl->conn)) goto cleanup; @@ -8144,10 +8146,16 @@ cmdAttachDisk(vshControl *ctl, const vshCmd *cmd) subdriver = vshCommandOptString(cmd, "subdriver", NULL); type = vshCommandOptString(cmd, "type", NULL); mode = vshCommandOptString(cmd, "mode", NULL); + stype = vshCommandOptString(cmd, "sourcetype", NULL); - if (driver) { - if (STREQ(driver, "file") || STREQ(driver, "tap")) + if (!stype) { + if (driver && (STREQ(driver, "file") || STREQ(driver, "tap"))) isFile = 1; + } else if (STREQ(stype, "file")) { + isFile = 1; + } else if (STRNEQ(stype, "block")) { + vshError(ctl, _("Unknown source type: '%s'"), stype); + goto cleanup; } if (mode) { -- 1.7.2.2

3 3

[libvirt] [PATCH] bridge: Fix static-only DHCP configuration
by Jiri Denemark 10 Sep '10

10 Sep '10

For static-only DHCP, i.e. with no <range> but at least one <host> element within <dhcp> element, we have to add "--dhcp-range IP,static" option to dnsmasq to actually enable the service. Without this option, dnsmasq will not respond to DHCP requests. --- src/network/bridge_driver.c | 26 +++++++++++++++++++++++--- 1 files changed, 23 insertions(+), 3 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index d6d3068..01d2171 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -394,6 +394,16 @@ networkBuildDnsmasqArgv(virNetworkObjPtr network, int nbleases = 0; char *pidfileArg; char buf[1024]; + unsigned int ranges; + + /* + * For static-only DHCP, i.e. with no range but at least one host element, + * we have to add a special --dhcp-range option to enable the service in + * dnsmasq. + */ + ranges = network->def->nranges; + if (!ranges && network->def->nhosts) + ranges = 1; /* * NB, be careful about syntax for dnsmasq options in long format @@ -424,11 +434,11 @@ networkBuildDnsmasqArgv(virNetworkObjPtr network, /*2 + *//* --interface virbr0 */ 2 + /* --except-interface lo */ 2 + /* --listen-address 10.0.0.1 */ - (2 * network->def->nranges) + /* --dhcp-range 10.0.0.2,10.0.0.254 */ + (2 * ranges) + /* --dhcp-range 10.0.0.2,10.0.0.254 */ /* --dhcp-lease-max=xxx if needed */ (network->def->nranges ? 1 : 0) + /* --dhcp-no-override if needed */ - (network->def->nranges ? 1 : 0) + + (ranges ? 1 : 0) + /* --dhcp-hostsfile=/var/lib/dnsmasq/$NAME.hostsfile */ (network->def->nhosts > 0 ? 1 : 0) + /* --enable-tftp --tftp-root /srv/tftp */ @@ -496,12 +506,22 @@ networkBuildDnsmasqArgv(virNetworkObjPtr network, nbleases += network->def->ranges[r].size; } + if (!network->def->nranges && network->def->nhosts) { + snprintf(buf, sizeof(buf), "%s,static", + network->def->ipAddress); + + APPEND_ARG(*argv, i++, "--dhcp-range"); + APPEND_ARG(*argv, i++, buf); + } + if (network->def->nranges > 0) { snprintf(buf, sizeof(buf), "--dhcp-lease-max=%d", nbleases); APPEND_ARG(*argv, i++, buf); - APPEND_ARG(*argv, i++, "--dhcp-no-override"); } + if (ranges) + APPEND_ARG(*argv, i++, "--dhcp-no-override"); + if (network->def->nhosts > 0) { dnsmasqContext *dctx = dnsmasqContextNew(network->def->name, DNSMASQ_STATE_DIR); char *hostsfileArg; -- 1.7.2.2

2 2

[libvirt] kqemu
by Zvi Dubitzky 10 Sep '10

10 Sep '10

Hi I could not get an answer from the users list . Maybe here someone can give some advice . we have a Linux 64 bit system with qemu 0.9.1-10 ( uname -a = 2.6.26-2-amd64) installed . kvm is included and loaded to memory . Still when we create a VM we sometimes get the following error message: libvir: QEMU error : internal error unable to start guest: You do not have enough space in '/dev/shm' for the 499 MB of QEMU virtual RAM. To have more space available provided you have enough RAM and swap, do as root: mount -o remount,size=515m /dev/shm Or disable the accelerator module with -no-kqemu After we do the mount (as advised) we can create the VM . Does the error mean that kvm is not active ? It seems that kqemu is an old way to do the duties of kvm e.g supply memory to VMs via /dev/shm . Is there a way to avoid that error ? I guess the -no-kqemu should be to qemu but we do not have control over the invokation of qemu by libvirt. thanks Zvi Dubitzky Email:dubi@il.ibm.com

1 0

[libvirt] QEMU json related fixes
by Luiz Capitulino 10 Sep '10

10 Sep '10

Found these problems while running libvirt-tck with up to date libvirt and qemu.git. Details in the patches. Thanks.

2 3

[libvirt] [PATCH] Add nwfilter support to UML driver
by Soren Hansen 09 Sep '10

09 Sep '10

Extend user-mode-linux driver to support nwfilter. Signed-off-by: Soren Hansen <soren(a)linux2go.dk> --- src/uml/uml_conf.c | 16 +++++++++++++--- src/uml/uml_driver.c | 8 +++++++- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/src/uml/uml_conf.c b/src/uml/uml_conf.c index 4906192..f2eaef5 100644 --- a/src/uml/uml_conf.c +++ b/src/uml/uml_conf.c @@ -46,6 +46,7 @@ #include "verify.h" #include "bridge.h" #include "logging.h" +#include "domain_nwfilter.h" #define VIR_FROM_THIS VIR_FROM_UML @@ -108,7 +109,8 @@ virCapsPtr umlCapsInit(void) { static int -umlConnectTapDevice(virDomainNetDefPtr net, +umlConnectTapDevice(virConnectPtr conn, + virDomainNetDefPtr net, const char *bridge) { brControl *brctl = NULL; @@ -164,6 +166,14 @@ umlConnectTapDevice(virDomainNetDefPtr net, goto error; } + if (net->filter) { + if (virDomainConfNWFilterInstantiate(conn, net)) { + if (template_ifname) + VIR_FREE(net->ifname); + goto error; + } + } + brShutdown(brctl); return 0; @@ -239,7 +249,7 @@ umlBuildCommandLineNet(virConnectPtr conn, goto error; } - if (umlConnectTapDevice(def, bridge) < 0) { + if (umlConnectTapDevice(conn, def, bridge) < 0) { VIR_FREE(bridge); goto error; } @@ -250,7 +260,7 @@ umlBuildCommandLineNet(virConnectPtr conn, } case VIR_DOMAIN_NET_TYPE_BRIDGE: - if (umlConnectTapDevice(def, def->data.bridge.brname) < 0) + if (umlConnectTapDevice(conn, def, def->data.bridge.brname) < 0) goto error; /* ethNNN=tuntap,tapname,macaddr,gateway */ diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index 0a5c829..40345d5 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -58,6 +58,7 @@ #include "domain_conf.h" #include "datatypes.h" #include "logging.h" +#include "domain_nwfilter.h" #define VIR_FROM_THIS VIR_FROM_UML @@ -876,6 +877,7 @@ static int umlStartVMDaemon(virConnectPtr conn, if (umlBuildCommandLine(conn, driver, vm, &keepfd, &argv, &progenv) < 0) { close(logfd); + virDomainConfVMNWFilterTeardown(vm); umlCleanupTapDevices(conn, vm); return -1; } @@ -928,8 +930,11 @@ static int umlStartVMDaemon(virConnectPtr conn, VIR_FREE(progenv[i]); VIR_FREE(progenv); - if (ret < 0) + if (ret < 0) { + virDomainConfVMNWFilterTeardown(vm); umlCleanupTapDevices(conn, vm); + } + /* NB we don't mark it running here - we do that async with inotify */ @@ -965,6 +970,7 @@ static void umlShutdownVMDaemon(virConnectPtr conn ATTRIBUTE_UNUSED, vm->def->id = -1; vm->state = VIR_DOMAIN_SHUTOFF; + virDomainConfVMNWFilterTeardown(vm); umlCleanupTapDevices(conn, vm); if (vm->newDef) { -- 1.7.1

4 4

[libvirt] [PATCH] test: Don't overwrite storage volume target path and key
by Matthias Bolte 09 Sep '10

09 Sep '10

Only generate target path and key when they are not defined in the XML config. --- src/test/test_driver.c | 20 ++++++++++++-------- 1 files changed, 12 insertions(+), 8 deletions(-) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index 6c06cbc..9d22339 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -706,17 +706,21 @@ static int testOpenVolumesForPool(xmlDocPtr xml, goto error; } - if (virAsprintf(&def->target.path, "%s/%s", - pool->def->target.path, - def->name) == -1) { - virReportOOMError(); - goto error; + if (def->target.path == NULL) { + if (virAsprintf(&def->target.path, "%s/%s", + pool->def->target.path, + def->name) == -1) { + virReportOOMError(); + goto error; + } } - def->key = strdup(def->target.path); if (def->key == NULL) { - virReportOOMError(); - goto error; + def->key = strdup(def->target.path); + if (def->key == NULL) { + virReportOOMError(); + goto error; + } } pool->def->allocation += def->allocation; -- 1.7.0.4

2 2

[libvirt] [PATCH] Remove static binaries hack for DV environment
by Daniel Veillard 09 Sep '10

09 Sep '10

An old leftover from the early days, and it's getting into the way now. Trivial, and uncontroversial as this should not affect anybody else and clean this up, so I pushed this, Daniel diff --git a/configure.ac b/configure.ac index 6c0fc69..a71f5e8 100644 --- a/configure.ac +++ b/configure.ac @@ -237,13 +237,10 @@ AC_ARG_WITH([libvirtd], AC_HELP_STRING([--with-libvirtd], [add libvirtd support @<:@default=yes@:>@]),[],[with_libvirtd=yes]) dnl -dnl specific tests to setup DV devel environments with debug etc ... +dnl in case someone want to build static binaries +dnl STATIC_BINARIES="-static" dnl -if test "${LOGNAME}" = "veillard" && test "`pwd`" = "/u/veillard/libvirt" ; then - STATIC_BINARIES="-static" -else - STATIC_BINARIES= -fi +STATIC_BINARIES= AC_SUBST([STATIC_BINARIES]) dnl --enable-debug=(yes|no) -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] SVG sources for the libvirt wiki images is online
by Justin Clift 09 Sep '10

09 Sep '10

Hi all, The SVG sources for the images used in the libvirt wiki docs are online: http://wiki.libvirt.org/page/SVGImages That's a browsable list, still fairly disorganised (!), but contains a visual list of the images on the wiki so far, with the link to their SVG source. They're all licensed under the Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"): http://creativecommons.org/licenses/by-sa/3.0/ Feel welcome to use them in your wiki's, improve them, and so on. Updates, ideas, and contributions welcome too of course. :) Regards and best wishes, Justin Clift

2 2

[libvirt] [PATCH v2] buf: Fix possible infinite loop in EscapeString, VSnprintf
by Cole Robinson 09 Sep '10

09 Sep '10

The current code will go into an infinite loop if the printf generated string is >= 1000, AND exactly 1 character smaller than the amount of free space in the buffer. When this happens, we are dropped into the loop body, but nothing will actually change, because count == (buf->size - buf->use - 1), and virBufferGrow returns unchanged if count < (buf->size - buf->use) Fix this by removing the '- 1' bit from 'size'. The *nprintf functions handle the NULL byte for us anyways, so we shouldn't need to manually accomodate for it. Here's a bug where we are actually hitting this issue: https://bugzilla.redhat.com/show_bug.cgi?id=602772 v2: Eric's improvements: while -> if (), remove extra va_list variable, make sure we report buffer error if snprintf fails Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/util/buf.c | 70 ++++++++++++++++++++++++++++++++++++------------------- 1 files changed, 46 insertions(+), 24 deletions(-) diff --git a/src/util/buf.c b/src/util/buf.c index fc1217b..553e2a0 100644 --- a/src/util/buf.c +++ b/src/util/buf.c @@ -224,7 +224,7 @@ void virBufferVSprintf(const virBufferPtr buf, const char *format, ...) { int size, count, grow_size; - va_list locarg, argptr; + va_list argptr; if ((format == NULL) || (buf == NULL)) return; @@ -236,27 +236,38 @@ virBufferVSprintf(const virBufferPtr buf, const char *format, ...) virBufferGrow(buf, 100) < 0) return; - size = buf->size - buf->use - 1; va_start(argptr, format); - va_copy(locarg, argptr); - while (((count = vsnprintf(&buf->content[buf->use], size, format, - locarg)) < 0) || (count >= size - 1)) { + + size = buf->size - buf->use; + if ((count = vsnprintf(&buf->content[buf->use], + size, format, argptr)) < 0) { + buf->error = 1; + goto err; + } + + /* Grow buffer if necessary and retry */ + if (count >= size) { buf->content[buf->use] = 0; - va_end(locarg); + va_end(argptr); + va_start(argptr, format); - grow_size = (count > 1000) ? count : 1000; + grow_size = (count + 1 > 1000) ? count + 1 : 1000; if (virBufferGrow(buf, grow_size) < 0) { - va_end(argptr); - return; + goto err; } - size = buf->size - buf->use - 1; - va_copy(locarg, argptr); + size = buf->size - buf->use; + if ((count = vsnprintf(&buf->content[buf->use], + size, format, argptr)) < 0) { + buf->error = 1; + goto err; + } } - va_end(argptr); - va_end(locarg); buf->use += count; - buf->content[buf->use] = '\0'; + +err: + va_end(argptr); + return; } /** @@ -336,23 +347,34 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st if ((buf->use >= buf->size) && virBufferGrow(buf, 100) < 0) { - VIR_FREE(escaped); - return; + goto err; + } + + size = buf->size - buf->use; + if ((count = snprintf(&buf->content[buf->use], size, + format, (char *)escaped)) < 0) { + buf->error = 1; + goto err; } - size = buf->size - buf->use - 1; - while (((count = snprintf(&buf->content[buf->use], size, format, - (char *)escaped)) < 0) || (count >= size - 1)) { + /* Grow buffer if necessary and retry */ + if (count >= size) { buf->content[buf->use] = 0; - grow_size = (count > 1000) ? count : 1000; + grow_size = (count + 1 > 1000) ? count + 1 : 1000; if (virBufferGrow(buf, grow_size) < 0) { - VIR_FREE(escaped); - return; + goto err; + } + size = buf->size - buf->use; + + if ((count = snprintf(&buf->content[buf->use], size, + format, (char *)escaped)) < 0) { + buf->error = 1; + goto err; } - size = buf->size - buf->use - 1; } buf->use += count; - buf->content[buf->use] = '\0'; + +err: VIR_FREE(escaped); } -- 1.7.2.1

3 4

[libvirt] [PATCH v2] [TCK] [REPOST] nwfilter: apply filters and check firewall rules
by Stefan Berger 09 Sep '10

09 Sep '10

Any comments regarding this patch? V2: - Following Daniel Berrange's suggestions - if LIBVIRT_TCK_CONFIG is set, read the last occurrence of "^uri/s=" and assign the value to LIBVIRT_URI - check that LIBVIRT_URI is set to qemu:///system, otherwise skip test - if allowed, remove all VMs and nwfilters starting with tck- - rename all VMs and nwfilters created by this test program to start with 'tck-' - other: - terminate if sourcing the test-lib.sh from libvirt's tests dir is missing (would need to be copied) - redirect stderr to stdout whereever output is read into a variable This is a patch I previously posted for use in the tests/ directory of libvirt. Now I ported it to the TCK project and extended the script with output in the Test Anything Protocol (TAP) format. It now allows multiple output formats chosen via command line parameter supporting TAP (--tap-test), the output format used in the libvirt tests directory (the '.' and '!') (--libvirt-test) and one where all tests are displayed (--verbose). The program basically creates a filter called tck-testcase and two VMs where one of them references the tck-testcase filter and the other a filter called nwfiltertestfilter. The tck-testcase filter is then subsequently modified and the effect on iptables,ebtables and ip6tables verified against expected output for both VMs. The VMs are torn down at the end and the test filters removed. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- scripts/nwfilter/100-apply-verify.t | 10 scripts/nwfilter/nwfilter2vmtest.sh | 635 ++++++++++ scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall | 32 scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall | 30 scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall | 9 scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall | 24 scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall | 68 + scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall | 12 scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 19 scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall | 13 scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall | 12 scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall | 9 scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat | 73 + scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall | 26 scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/all-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml | 33 scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml | 12 scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml | 56 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml | 15 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml | 34 scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml | 43 scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml | 23 scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml | 33 scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml | 4 scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml | 18 61 files changed, 2059 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh @@ -0,0 +1,635 @@ +#!/bin/bash + +ORIG_IFNAME="vnet0" +ATTACH_IFNAME="attach0" +TESTFILTERNAME="nwfiltertestfilter" +TESTVM2FWALLDATA="nwfilterxml2fwallout/testvm.fwall.dat" + + +LIBVIRTD=`type -P ${PWD}/../daemon/libvirtd` +if [ "x${LIBVIRTD}x" == "xx" ]; then + LIBVIRTD=`type -P libvirtd` +fi + +VIRSH=`type -P ${PWD}/../tools/virsh` +if [ "x${VIRSH}x" == "xx" ]; then + VIRSH=`type -P virsh` +fi + +LD_LIBRARY_PATH="${PWD}../src/.libs/" + +uri="qemu:///system" +if [ "x${LIBVIRT_TCK_CONFIG}x" != "xx" ]; then + uri_exp=`cat ${LIBVIRT_TCK_CONFIG} | grep "^uri\s*=" | tail -n 1` + if [ "x${uri_exp}x" != "xx" ]; then + eval ${uri_exp} + fi +fi +LIBVIRT_URI=${uri} + +# Maybe no libvirtd was built +[ -z ${LIBVIRTD} ] && exit 0; + +FLAG_WAIT="$((1<<0))" +FLAG_ATTACH="$((1<<1))" +FLAG_VERBOSE="$((1<<2))" +FLAG_LIBVIRT_TEST="$((1<<3))" +FLAG_TAP_TEST="$((1<<4))" + +failctr=0 +passctr=0 +attachfailctr=0 +attachctr=0 + +TAP_FAIL_LIST="" +TAP_FAIL_CTR=0 +TAP_TOT_CTR=0 + +function usage() { + local cmd="$0" +cat <<EOF +Usage: ${cmd} [--help|-h|-?] [--noattach] [--wait] [--verbose] + [--libvirt-test] [--tap-test] + +Options: + --help,-h,-? : Display this help screen. + --noattach : Skip tests that attach and detach a network interface + --wait : Wait for the user to press the enter key once an error + was detected + --verbose : Verbose output + --libvirt-test : Use the libvirt test output format + --tap-test : TAP format output + +This test will create two virtual machines. The one virtual machine +will use a filter called '${TESTFILTERNAME}', and reference the filter +'clean-traffic' which should be available by default with every install. +The other virtual machine will reference the filter 'tck-testcase' and will +have its filter permanently updated. +EOF +} + + +function tap_fail() { + echo "not ok $1 - ${2:0:66}" + TAP_FAIL_LIST+="$1 " + ((TAP_FAIL_CTR++)) + ((TAP_TOT_CTR++)) +} + +function tap_pass() { + echo "ok $1 - ${2:0:70}" + ((TAP_TOT_CTR++)) +} + +function tap_final() { + local okay + + [ -n "${TAP_FAIL_LIST}" ] && echo "FAILED tests ${TAP_FAIL_LIST}" + + okay=`echo "($TAP_TOT_CTR-$TAP_FAIL_CTR)*100/$TAP_TOT_CTR" | bc -l` + echo "Failed ${TAP_FAIL_CTR}/${TAP_TOT_CTR} tests, ${okay:0:5}% okay" +} + +# A wrapper for mktemp in case it does not exist +# Echos the name of a temporary file. +function mktmpfile() { + local tmp + type -P mktemp > /dev/null + if [ $? -eq 0 ]; then + tmp=$(mktemp -t nwfvmtest.XXXXXX) + echo ${tmp} + else + while :; do + tmp="/tmp/nwfvmtest.${RANDOM}" + if [ ! -f ${tmp} ]; then + touch ${tmp} + chmod 666 ${tmp} + echo ${tmp} + break + fi + done + fi + return 0 +} + + +function checkExpectedOutput() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local flags="$4" + local skipregex="$5" + local regex="s/${ORIG_IFNAME}/${ifname}/g" + local cmd line tmpfile tmpfile2 skip + + tmpfile=`mktmpfile` + tmpfile2=`mktmpfile` + + exec 4<${fwallfile} + + read <&4 + line="${REPLY}" + + while [ "x${line}x" != "xx" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + skip=0 + if [ "x${skipregex}x" != "xx" ]; then + skip=`echo ${cmd} | grep -c -E ${skipregex}` + fi + + eval ${cmd} 2>&1 | tee ${tmpfile} 1>/dev/null + + rm ${tmpfile2} 2>/dev/null + touch ${tmpfile2} + + while [ 1 ]; do + read <&4 + line="${REPLY}" + + if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then + + if [ ${skip} -ne 0 ]; then + break + fi + + diff ${tmpfile} ${tmpfile2} >/dev/null + + if [ $? -ne 0 ]; then + if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + fi + ((failctr++)) + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "tmp files: $tmpfile, $tmpfile2" + echo "Press enter" + read + fi + [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \ + test_result $((passctr+failctr)) "" 1 + [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \ + tap_fail $((passctr+failctr)) "${xmlfile} : ${cmd}" + else + ((passctr++)) + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && \ + echo "PASS ${xmlfile} : ${cmd}" + [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \ + test_result $((passctr+failctr)) "" 0 + [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \ + tap_pass $((passctr+failctr)) "${xmlfile} : ${cmd}" + fi + + break + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 4>&- + + rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local vm1name="$3" + local vm2name="$4" + local flags="$5" + local testnum="$6" + local linenums ctr=0 + local tmpfile b msg rc + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${vm1name}" "${flags}" \ + "" + + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" "" + + if [ $((flags & FLAG_ATTACH)) -ne 0 ]; then + + tmpfile=`mktmpfile` + + b=`{ ${VIRSH} dumpxml ${vm1name} | tr -d "\n"; echo; } | \ + sed "s/.*\<interface.*source bridge='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + cat >>${tmpfile} <<EOF +<interface type='bridge'> + <source bridge='${b}'/> + <mac address='52:54:00:11:22:33'/> + <target dev='${ATTACH_IFNAME}'/> + <filterref filter='tck-testcase'/> +</interface> +EOF + msg=`${VIRSH} attach-device "${vm1name}" "${tmpfile}" > /dev/null` + rc=$? + + ((attachctr++)) + + if [ $rc -eq 0 ]; then + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \ + "${flags}" "(PRE|POST)ROUTING" + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" "(PRE|POST)ROUTING" + msg=`${VIRSH} detach-device "${vm1name}" "${tmpfile}"` + if [ $? -ne 0 ]; then + echo "FAIL: Detach of interface failed." + fi + else + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + # In case of TAP, run the test anyway so we get to the full number + # of tests + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \ + "${flags}" "" #"(PRE|POST)ROUTING" + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" #"(PRE|POST)ROUTING" + fi + + ((attachfailctr++)) + if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then + echo "FAIL: Could not attach interface to vm ${vm1name}." + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter" + read + fi + fi + fi + + rm -rf ${tmpfile} + fi + + return 0 +} + + +function runTests() { + local vm1name="$1" + local vm2name="$2" + local xmldir="$3" + local fwalldir="$4" + local flags="$5" + local fwallfiles f c + local tap_total=0 ctr=0 + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + # Need to count the number of total tests + for fil in ${fwallfiles}; do + c=$(grep -c "^#" ${fwalldir}/${fil}) + ((tap_total+=c)) + ((ctr++)) + done + c=$(grep -c "^#" "${TESTVM2FWALLDATA}") + ((tap_total+=c*ctr)) + [ $((flags & FLAG_ATTACH)) -ne 0 ] && ((tap_total*=2)) + echo "1..${tap_total}" + fi + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${vm1name}" \ + "${vm2name}" "${flags}" + done + + if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then + test_final $((passctr+failctr)) $failctr + elif [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + tap_final + else + echo "" + echo "Summary: ${failctr} failures, ${passctr} passes," + if [ ${attachctr} -ne 0 ]; then + echo " ${attachfailctr} interface attachment failures with ${attachctr} attempts" + fi + fi +} + + +function createVM() { + local vmname="$1" + local filtername="$2" + local ipaddr="$3" + local macaddr="$4" + local flags="$5" + local res + local tmpfile='mktmpfile' + + cat > ${tmpfile} << EOF + <domain type='kvm'> + <name>${vmname}</name> + <memory>32768</memory> + <currentMemory>32768</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='x86_64' machine='pc-0.11'>hvm</type> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-kvm</emulator> + <interface type='bridge'> + <mac address='${macaddr}'/> + <source bridge='virbr0'/> + <filterref filter='${filtername}'> + <parameter name='IP' value='${ipaddr}'/> + </filterref> + <target dev='${vmname}'/> + </interface> + <console type='pty'> + </console> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + </devices> + </domain> +EOF + + res=$(${VIRSH} define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define VM ${vmname} : ${res}" + return 1 + fi + + res=$(${VIRSH} start ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not start VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + $(${VIRSH} undefine ${vmname}) + return 1 + fi + + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Created VM ${vmname}." + + rm -rf ${tmpfile} + + return 0 +} + + +function destroyVM() { + local vmname="$1" + local flags="$2" + local res + + res=$(${VIRSH} destroy ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not destroy VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + + res=$(${VIRSH} undefine ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not undefine VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Destroyed VM ${vmname}." + + return 0 +} + + +function createTestFilters() { + local flags="$1" + local tmpfile=`mktmpfile` + local res + + cat >${tmpfile} << EOF +<filter name="${TESTFILTERNAME}"> + <filterref filter='clean-traffic'/> + + <rule action='drop' direction='inout' priority='1000'> + <all/> + </rule> + + <rule action='drop' direction='inout' priority='1000'> + <all-ipv6/> + </rule> +</filter> +EOF + res=$(${VIRSH} nwfilter-define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + rm -rf ${tmpfile} + return 1 + fi + + cat >${tmpfile} << EOF +<filter name="tck-testcase"> +</filter> +EOF + res=$(${VIRSH} nwfilter-define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + rm -rf ${tmpfile} + return 1 + fi + + rm -rf ${tmpfile} + + return 0 +} + + +function deleteTestFilter() { + local flags="$1" + local res + + res=$(${VIRSH} nwfilter-undefine ${TESTFILTERNAME} 2>&1) + if [ $? -ne 0 ]; then + echo "Could not undefine filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + res=$(${VIRSH} nwfilter-undefine tck-testcase 2>&1) + if [ $? -ne 0 ]; then + echo "Could not undefine filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + return 0 +} + + +function main() { + local prgname="$0" + local vm1 vm2 + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms res + local filtername="tck-testcase" + local libvirtdpid=-1 + local flags OPWD + + ((flags=${FLAG_ATTACH})) + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --noattach) ((flags ^= FLAG_ATTACH ));; + --wait) ((flags |= FLAG_WAIT ));; + --verbose) ((flags |= FLAG_VERBOSE ));; + --libvirt-test) ((flags |= FLAG_LIBVIRT_TEST ));; + --tap-test) ((flags |= FLAG_TAP_TEST ));; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + if [ `uname` != "Linux" ]; then + echo "This script will only run on Linux." + exit 1; + fi + + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + if [ "${LIBVIRT_URI}" != "qemu:///system" ]; then + echo "1..0 # Skipped: Only valid for Qemu system driver" + exit 0 + fi + + for name in `virsh nwfilter-list | awk '{print $2}'` + do + case ${name} in + tck*) + if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then + res=$(virsh nwfilter-undefine ${name} 2>&1) + if [ $? -ne 0 ]; then + echo "Bail out! Could not undefine nwfiler ${name}: ${res}" + exit 0 + fi + else + echo "Bail out! Filter ${name} already exists, use --force to clean" + exit 1 + fi + esac + done + + for name in `virsh nwfilter-list | awk '{print $2}'` + do + case ${name} in + tck*) + if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then + res=$(virsh undefine ${name} 2>&1) + if [ $? -ne 0 ]; then + echo "Bail out! Could not undefine domain ${name}: ${res}" + exit 1 + fi + else + echo "Bail out! Domain ${name} already exists, use --force to clean" + exit 1 + fi + esac + done + fi + + if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then + pushd ${PWD} > /dev/null + . test-lib.sh + if [ $? -ne 0 ]; then + exit 1 + fi + test_intro $this_test + popd > /dev/null + fi + + res=$(${VIRSH} capabilities 2>&1) + + if [ $? -ne 0 ]; then + if [ "x${LIBVIRTD}x" == "xx" ]; then + echo "Cannot find libvirtd. Exiting." + exit 1 + fi + + rm -rf pid-file 2>/dev/null + ${LIBVIRTD} --pid-file=pid-file 2>/dev/null 1>/dev/null & + libvirtdpid=$! + sleep 2 + + res=$(${VIRSH} capabilities 2>&1) + if [ $? -ne 0 ]; then + echo "Could not start the libvirt daemon : $res" + echo "Exiting." + exit 1 + fi + fi + + vm1="tck-testvm${RANDOM}" + vm2="tck-testvm${RANDOM}" + + createTestFilters "${flags}" + if [ $? -ne 0 ]; then + exit 1; + fi + + createVM "${vm1}" "tck-testcase" "10.2.2.2" "52:54:0:0:0:1" "${flags}" + if [ $? -ne 0 ]; then + echo "Could not create VM ${vm1}. Exiting." + exit 1 + fi + + createVM "${vm2}" "${TESTFILTERNAME}" "10.1.1.1" "52:54:0:9f:33:da" \ + "${flags}" + if [ $? -ne 0 ]; then + echo "Could not create VM ${vm2}. Exiting." + destroyVM "${vm1}" "${flags}" + exit 1 + fi + + runTests "${vm1}" "${vm2}" "${xmldir}" "${fwalldir}" "${flags}" + + destroyVM "${vm1}" "${flags}" + destroyVM "${vm2}" "${flags}" + deleteTestFilter "${flags}" + + [ ${libvirtdpid} -ge 0 ] && kill -9 ${libvirtdpid} + rm -rf pid-file 2>/dev/null + + return 0 +} + +main "$@" Index: libvirt-tck/scripts/nwfilter/100-apply-verify.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/100-apply-verify.t @@ -0,0 +1,10 @@ +#!/bin/bash + +pwd=$(dirname $0) + +pushd ${PWD} > /dev/null + +cd ${pwd} +bash ./nwfilter2vmtest.sh --tap-test --noattach + +popd > /dev/null \ No newline at end of file Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml @@ -0,0 +1,33 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='12' + protocoltype='34' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='1' hwtype='255' protocoltype='255'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='11' hwtype='256' protocoltype='256'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65535' hwtype='65535' protocoltype='65535' /> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65536' hwtype='65536' protocoltype='65536' /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat @@ -0,0 +1,73 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -j I-vnet0-ipv4 +-p ARP -j I-vnet0-arp +-p 0x8035 -j I-vnet0-rarp +-p 0x835 -j ACCEPT +-j DROP +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -j O-vnet0-ipv4 +-p ARP -j O-vnet0-arp +-p 0x8035 -j O-vnet0-rarp +-j DROP +#ebtables -t nat -L I-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$" +-s ! 52:54:0:9f:33:da -j DROP +-p IPv4 --ip-src ! 10.1.1.1 -j DROP +#ebtables -t nat -L O-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$" +-j ACCEPT +#ebtables -t nat -L I-vnet0-arp | grep -v "^Bridge" | grep -v "^$" +-s ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-mac-src ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-ip-src ! 10.1.1.1 -j DROP +-p ARP --arp-op Request -j ACCEPT +-p ARP --arp-op Reply -j ACCEPT +-j DROP +#ebtables -t nat -L O-vnet0-arp | grep -v "^Bridge" | grep -v "^$" +-p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-ip-dst ! 10.1.1.1 -j DROP +-p ARP --arp-op Request -j ACCEPT +-p ARP --arp-op Reply -j ACCEPT +-j DROP +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ah srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <ah srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <ah srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml @@ -0,0 +1,12 @@ +<filter name='tck-testcase' chain='root'> + <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid> + <rule action='drop' direction='out' priority='500'> + <icmp connlimit-above='1'/> + </rule> + <rule action='drop' direction='out' priority='500'> + <tcp connlimit-above='2'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <all/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <esp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <esp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <esp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml @@ -0,0 +1,56 @@ +<filter name='tck-testcase'> + <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid> + + <rule action='accept' direction='in'> + <mac protocolid='0x1234'/> + </rule> + + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='0x123' srcportend='0x234' + dstportstart='0x3456' dstportend='0x4567' + dscp='0x32'/> + </rule> + + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='tcp' + srcportstart='0x111' srcportend='400' + dstportstart='0x3333' dstportend='65535'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='0x12' + protocoltype='0x56' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='0x22' + srcportstart='0x123' srcportend='400' + dstportstart='0x234' dstportend='0x444'/> + </rule> + + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='0x40' + srcportstart='0x20' srcportend='0x21' + dstportstart='0x100' dstportend='0x1111'/> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='tck-testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='tck-testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='tck-testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <icmp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2' type='12' code='11'/> + </rule> + <rule action='accept' direction='in'> + <icmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' type='255' code='255'/> + </rule> + <rule action='accept' direction='in'> + <icmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' type='256' code='256'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2' type='12' code='11'/> + </rule> + <rule action='accept' direction='in'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' type='255' code='255'/> + </rule> + <rule action='accept' direction='in'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33' type='256' code='256'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <igmp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <igmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <igmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml @@ -0,0 +1,34 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='out'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.128.0' + dstipaddr='10.1.2.3' dstipmask='255.255.255.0' + protocol='17' dscp='63' + /> + </rule> + + <rule action='accept' direction='in'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.254' + dstipaddr='10.1.2.3' dstipmask='255.255.255.128' + protocol='255' dscp='64' + /> + </rule> + + <rule action='accept' direction='inout'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.127' + dstipaddr='10.1.2.3' dstipmask='255.255.255.254' + protocol='256' dscp='64' + /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml @@ -0,0 +1,43 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='udp' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='6' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='6' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='18' + /> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml @@ -0,0 +1,23 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='ipv4'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='1536'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='15'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='65535'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml @@ -0,0 +1,33 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='rarp' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='12' + protocoltype='34' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='1' hwtype='255' protocoltype='255'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='11' hwtype='256' protocoltype='256'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65535' hwtype='65535' protocoltype='65535' /> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65536' hwtype='65536' protocoltype='65536' /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase'> + <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid> + <filterref filter='clean-traffic'/> + <rule action='accept' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='accept' direction='out'> + <tcp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='out'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml @@ -0,0 +1,4 @@ +<filter name='tck-testcase'> + <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid> + <filterref filter='clean-traffic'/> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <sctp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <sctp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <sctp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in' statematch='false'> + <tcp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in' statematch='0'> + <tcp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <udp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udplite srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udplite srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <udplite srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,32 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L FORWARD --line-number | grep libvirt +1 libvirt-in all anywhere anywhere +2 libvirt-out all anywhere anywhere +3 libvirt-in-post all anywhere anywhere Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,30 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FORWARD --line-number | grep libvirt +1 libvirt-in all -- anywhere anywhere +2 libvirt-out all -- anywhere anywhere +3 libvirt-in-post all -- anywhere anywhere Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall @@ -0,0 +1,24 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1 +DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2 +RETURN all -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1 +DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 |tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall @@ -0,0 +1,68 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-tos 0x32 --ip-proto udp --ip-sport 291:564 --ip-dport 13398:17767 -j ACCEPT +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto tcp --ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 18 --arp-ptype 0x56 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p 0x1234 -j ACCEPT +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 state NEW,ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x22udp spts:564:1092 dpts:291:400 state ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 +#iptables -L libvirt-host-in -n | grep HI-vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep FI-vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::/128 tcp spts:256:4369 dpts:32:33 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::/128 tcp spts:256:4369 dpts:32:33 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 state NEW,ESTABLISHED +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,26 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state NEW,ESTABLISHED +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,13 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 | sed s/0x8035/RARP/g | grep -v "^Bridge" | grep -v "^$" +-p RARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p RARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0

2 1

[libvirt] [PATCH] Documentation on www.libvirt.org about using PolicyKit authentication for libvirt is out of date
by Patrick Dignan 08 Sep '10

08 Sep '10

Hi all, I've created a patch for the bug here: https://bugzilla.redhat.com/show_bug.cgi?id=610822 It is attached to this message. The patch updates the docs to have more up-to-date information about how to use PolicyKit with libvirt Best, Patrick Dignan

2 1

[libvirt] [PATCH] esx: Use SessionIsActive when available
by Matthias Bolte 08 Sep '10

08 Sep '10

--- src/esx/esx_vi.c | 122 +++++++++++++++++++++++++++--------------------------- src/esx/esx_vi.h | 1 + 2 files changed, 62 insertions(+), 61 deletions(-) diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 78cfdfd..d361f01 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -464,6 +464,10 @@ esxVI_Context_Connect(esxVI_Context *ctx, const char *url, ctx->hasQueryVirtualDiskUuid = true; } + if (ctx->productVersion & esxVI_ProductVersion_VPX) { + ctx->hasSessionIsActive = true; + } + if (esxVI_Login(ctx, username, password, NULL, &ctx->session) < 0 || esxVI_BuildSelectSetCollection(ctx) < 0) { return -1; @@ -1452,6 +1456,7 @@ esxVI_BuildSelectSet(esxVI_SelectionSpec **selectSet, } + int esxVI_BuildSelectSetCollection(esxVI_Context *ctx) { @@ -1533,97 +1538,92 @@ esxVI_BuildSelectSetCollection(esxVI_Context *ctx) } -/* - * Can't use the SessionIsActive() function here, because at least - * 'ESX Server 3.5.0 build-64607' returns an 'method not implemented' fault if - * you try to call it. Query the session manager for the current session of - * this connection instead and re-login if there is no current session for this - * connection. - * - * Update: 'ESX 4.0.0 build-171294' doesn't implement this method. - */ -#define ESX_VI_USE_SESSION_IS_ACTIVE 0 int esxVI_EnsureSession(esxVI_Context *ctx) { -#if ESX_VI_USE_SESSION_IS_ACTIVE - esxVI_Boolean active = esxVI_Boolean_Undefined; -#else int result = -1; + esxVI_Boolean active = esxVI_Boolean_Undefined; esxVI_String *propertyNameList = NULL; esxVI_ObjectContent *sessionManager = NULL; esxVI_DynamicProperty *dynamicProperty = NULL; esxVI_UserSession *currentSession = NULL; -#endif if (ctx->session == NULL) { ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid call")); return -1; } -#if ESX_VI_USE_SESSION_IS_ACTIVE - if (esxVI_SessionIsActive(ctx, ctx->session->key, ctx->session->userName, - &active) < 0) { - return -1; - } - - if (active != esxVI_Boolean_True) { - esxVI_UserSession_Free(&ctx->session); - - if (esxVI_Login(ctx, ctx->username, ctx->password, NULL, - &ctx->session) < 0) { + if (ctx->hasSessionIsActive) { + /* + * Use SessionIsActive to check if there is an active session for this + * connection an re-login in there isn't. + */ + if (esxVI_SessionIsActive(ctx, ctx->session->key, + ctx->session->userName, &active) < 0) { return -1; } - } - return 0; -#else - if (esxVI_String_AppendValueToList(&propertyNameList, - "currentSession") < 0 || - esxVI_LookupObjectContentByType(ctx, ctx->service->sessionManager, - "SessionManager", propertyNameList, - &sessionManager) < 0) { - goto cleanup; - } + if (active != esxVI_Boolean_True) { + esxVI_UserSession_Free(&ctx->session); - for (dynamicProperty = sessionManager->propSet; dynamicProperty != NULL; - dynamicProperty = dynamicProperty->_next) { - if (STREQ(dynamicProperty->name, "currentSession")) { - if (esxVI_UserSession_CastFromAnyType(dynamicProperty->val, - &currentSession) < 0) { - goto cleanup; + if (esxVI_Login(ctx, ctx->username, ctx->password, NULL, + &ctx->session) < 0) { + return -1; } + } - break; - } else { - VIR_WARN("Unexpected '%s' property", dynamicProperty->name); + return 0; + } else { + /* + * Query the session manager for the current session of this connection + * and re-login if there is no current session for this connection. + */ + if (esxVI_String_AppendValueToList(&propertyNameList, + "currentSession") < 0 || + esxVI_LookupObjectContentByType(ctx, ctx->service->sessionManager, + "SessionManager", propertyNameList, + &sessionManager) < 0) { + goto cleanup; + } + + for (dynamicProperty = sessionManager->propSet; dynamicProperty != NULL; + dynamicProperty = dynamicProperty->_next) { + if (STREQ(dynamicProperty->name, "currentSession")) { + if (esxVI_UserSession_CastFromAnyType(dynamicProperty->val, + &currentSession) < 0) { + goto cleanup; + } + + break; + } else { + VIR_WARN("Unexpected '%s' property", dynamicProperty->name); + } } - } - if (currentSession == NULL) { - esxVI_UserSession_Free(&ctx->session); + if (currentSession == NULL) { + esxVI_UserSession_Free(&ctx->session); - if (esxVI_Login(ctx, ctx->username, ctx->password, NULL, - &ctx->session) < 0) { + if (esxVI_Login(ctx, ctx->username, ctx->password, NULL, + &ctx->session) < 0) { + goto cleanup; + } + } else if (STRNEQ(ctx->session->key, currentSession->key)) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("Key of the current session differs from the key at " + "last login")); goto cleanup; } - } else if (STRNEQ(ctx->session->key, currentSession->key)) { - ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", - _("Key of the current session differs from the key at " - "last login")); - goto cleanup; - } - result = 0; + result = 0; cleanup: - esxVI_String_Free(&propertyNameList); - esxVI_ObjectContent_Free(&sessionManager); - esxVI_UserSession_Free(&currentSession); + esxVI_String_Free(&propertyNameList); + esxVI_ObjectContent_Free(&sessionManager); + esxVI_UserSession_Free(&currentSession); - return result; -#endif + return result; + } } diff --git a/src/esx/esx_vi.h b/src/esx/esx_vi.h index b205b8c..aa47e87 100644 --- a/src/esx/esx_vi.h +++ b/src/esx/esx_vi.h @@ -168,6 +168,7 @@ struct _esxVI_Context { esxVI_SelectionSpec *selectSet_computeResourceToHost; esxVI_SelectionSpec *selectSet_computeResourceToParentToParent; bool hasQueryVirtualDiskUuid; + bool hasSessionIsActive; }; int esxVI_Context_Alloc(esxVI_Context **ctx); -- 1.7.0.4

2 2

[libvirt] [PATCH] esx: Fall back to path as key when QueryVirtualDiskUuid isn't available
by Matthias Bolte 07 Sep '10

07 Sep '10

QueryVirtualDiskUuid is only available on an ESX(i) server. vCenter returns an NotImplemented fault and a GSX server is missing the VirtualDiskManager completely. Therefore only use QueryVirtualDiskUuid with an ESX(i) server and fall back to path as storage volume key for vCenter and GSX server. --- src/esx/esx_storage_driver.c | 36 +++++++++++++++++++++++------ src/esx/esx_vi.c | 50 +++++++++++++++++++++++++++-------------- src/esx/esx_vi.h | 1 + 3 files changed, 62 insertions(+), 25 deletions(-) diff --git a/src/esx/esx_storage_driver.c b/src/esx/esx_storage_driver.c index 76f8769..329020b 100644 --- a/src/esx/esx_storage_driver.c +++ b/src/esx/esx_storage_driver.c @@ -783,6 +783,13 @@ esxStorageVolumeLookupByKey(virConnectPtr conn, const char *key) return esxStorageVolumeLookupByPath(conn, key); } + if (!priv->primary->hasQueryVirtualDiskUuid) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("QueryVirtualDiskUuid not avialable, cannot lookup storage " + "volume by UUID")); + return NULL; + } + if (esxVI_EnsureSession(priv->primary) < 0) { return NULL; } @@ -916,7 +923,7 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, esxVI_ManagedObjectReference *task = NULL; esxVI_TaskInfoState taskInfoState; char *uuid_string = NULL; - char key[VIR_UUID_STRING_BUFLEN] = ""; + char *key = NULL; virCheckFlags(0, NULL); @@ -1068,14 +1075,26 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, goto cleanup; } - if (esxVI_QueryVirtualDiskUuid(priv->primary, datastorePath, - priv->primary->datacenter->_reference, - &uuid_string) < 0) { - goto cleanup; - } + if (priv->primary->hasQueryVirtualDiskUuid) { + if (VIR_ALLOC_N(key, VIR_UUID_STRING_BUFLEN) < 0) { + virReportOOMError(); + goto cleanup; + } - if (esxUtil_ReformatUuid(uuid_string, key) < 0) { - goto cleanup; + if (esxVI_QueryVirtualDiskUuid(priv->primary, datastorePath, + priv->primary->datacenter->_reference, + &uuid_string) < 0) { + goto cleanup; + } + + if (esxUtil_ReformatUuid(uuid_string, key) < 0) { + goto cleanup; + } + } else { + /* Fall back to the path as key */ + if (esxVI_String_DeepCopyValue(&key, datastorePath) < 0) { + goto cleanup; + } } } else { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, @@ -1103,6 +1122,7 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, esxVI_FileBackedVirtualDiskSpec_Free(&virtualDiskSpec); esxVI_ManagedObjectReference_Free(&task); VIR_FREE(uuid_string); + VIR_FREE(key); return volume; } diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 00e15f0..78cfdfd 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -453,6 +453,17 @@ esxVI_Context_Connect(esxVI_Context *ctx, const char *url, return -1; } + if (ctx->productVersion & esxVI_ProductVersion_ESX) { + /* + * FIXME: Actually this should be detected by really calling + * QueryVirtualDiskUuid and checking if a NotImplemented fault is + * returned. But currently we don't deserialized the details of a + * possbile fault and therefore we don't know if the fault was a + * NotImplemented fault or not. + */ + ctx->hasQueryVirtualDiskUuid = true; + } + if (esxVI_Login(ctx, username, password, NULL, &ctx->session) < 0 || esxVI_BuildSelectSetCollection(ctx) < 0) { return -1; @@ -3267,28 +3278,33 @@ esxVI_LookupStorageVolumeKeyByDatastorePath(esxVI_Context *ctx, return -1; } - if (esxVI_LookupFileInfoByDatastorePath(ctx, datastorePath, false, &fileInfo, - esxVI_Occurrence_RequiredItem) < 0) { - goto cleanup; - } - - if (esxVI_VmDiskFileInfo_DynamicCast(fileInfo) != NULL) { - /* VirtualDisks have a UUID, use it as key */ - if (esxVI_QueryVirtualDiskUuid(ctx, datastorePath, - ctx->datacenter->_reference, - &uuid_string) < 0) { + if (ctx->hasQueryVirtualDiskUuid) { + if (esxVI_LookupFileInfoByDatastorePath + (ctx, datastorePath, false, &fileInfo, + esxVI_Occurrence_RequiredItem) < 0) { goto cleanup; } - if (VIR_ALLOC_N(*key, VIR_UUID_STRING_BUFLEN) < 0) { - virReportOOMError(); - goto cleanup; - } + if (esxVI_VmDiskFileInfo_DynamicCast(fileInfo) != NULL) { + /* VirtualDisks have a UUID, use it as key */ + if (esxVI_QueryVirtualDiskUuid(ctx, datastorePath, + ctx->datacenter->_reference, + &uuid_string) < 0) { + goto cleanup; + } - if (esxUtil_ReformatUuid(uuid_string, *key) < 0) { - goto cleanup; + if (VIR_ALLOC_N(*key, VIR_UUID_STRING_BUFLEN) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (esxUtil_ReformatUuid(uuid_string, *key) < 0) { + goto cleanup; + } } - } else { + } + + if (*key == NULL) { /* Other files don't have a UUID, fall back to the path as key */ if (esxVI_String_DeepCopyValue(key, datastorePath) < 0) { goto cleanup; diff --git a/src/esx/esx_vi.h b/src/esx/esx_vi.h index bd37b05..b205b8c 100644 --- a/src/esx/esx_vi.h +++ b/src/esx/esx_vi.h @@ -167,6 +167,7 @@ struct _esxVI_Context { esxVI_SelectionSpec *selectSet_hostSystemToDatastore; esxVI_SelectionSpec *selectSet_computeResourceToHost; esxVI_SelectionSpec *selectSet_computeResourceToParentToParent; + bool hasQueryVirtualDiskUuid; }; int esxVI_Context_Alloc(esxVI_Context **ctx); -- 1.7.0.4

2 2

[libvirt] [PATCH] mingw: match recent changes in spec file
by Eric Blake 07 Sep '10

07 Sep '10

These changes allow './autobuild.sh' to complete again, when a full mingw cross-compilation is available on Fedora. * libvirt.spec.in (%file): List new installed files. * configure.ac (with_init_script): Assume default of none when cross-compiling. --- configure.ac | 6 +++--- mingw32-libvirt.spec.in | 5 +++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index d42d9e6..6c0fc69 100644 --- a/configure.ac +++ b/configure.ac @@ -276,10 +276,10 @@ AC_ARG_WITH([init-script], [AC_HELP_STRING([--with-init-script=@<:@redhat|auto|none@:>@], [Style of init script to install @<:@default=auto@:>@])]) if test "x$with_init_script" = "x" || test "x$with_init_script" = "xauto"; then - if test -f /etc/redhat-release ; then - with_init_script=redhat - else + if test "$cross_compiling" = yes || test ! -f /etc/redhat-release; then with_init_script=none + else + with_init_script=redhat fi fi AM_CONDITIONAL([LIBVIRT_INIT_SCRIPT_RED_HAT], test x$with_init_script = xredhat) diff --git a/mingw32-libvirt.spec.in b/mingw32-libvirt.spec.in index 6b2b5c6..4bbbc3b 100644 --- a/mingw32-libvirt.spec.in +++ b/mingw32-libvirt.spec.in @@ -71,6 +71,7 @@ rm -rf $RPM_BUILD_ROOT%{_mingw32_datadir}/doc/* rm -rf $RPM_BUILD_ROOT%{_mingw32_datadir}/gtk-doc/* rm $RPM_BUILD_ROOT%{_mingw32_libdir}/libvirt.a +rm $RPM_BUILD_ROOT%{_mingw32_libdir}/libvirt-qemu.a %clean @@ -83,10 +84,13 @@ rm -rf $RPM_BUILD_ROOT %{_mingw32_bindir}/virsh.exe %{_mingw32_bindir}/virt-xml-validate %{_mingw32_bindir}/virt-pki-validate +%{_mingw32_bindir}/libvirt-qemu-0.dll %{_mingw32_libdir}/libvirt.dll.a %{_mingw32_libdir}/libvirt.la %{_mingw32_libdir}/pkgconfig/libvirt.pc +%{_mingw32_libdir}/libvirt-qemu.dll.a +%{_mingw32_libdir}/libvirt-qemu.la %dir %{_mingw32_datadir}/libvirt/ %dir %{_mingw32_datadir}/libvirt/schemas/ @@ -109,6 +113,7 @@ rm -rf $RPM_BUILD_ROOT %dir %{_mingw32_includedir}/libvirt %{_mingw32_includedir}/libvirt/libvirt.h %{_mingw32_includedir}/libvirt/virterror.h +%{_mingw32_includedir}/libvirt/libvirt-qemu.h %{_mingw32_mandir}/man1/virsh.1* %{_mingw32_mandir}/man1/virt-xml-validate.1* -- 1.7.2.2

2 2

Re: [libvirt] ruby-libvirt / rubygems
by Chris Lalancette 07 Sep '10

07 Sep '10

On 09/03/10 - 09:23:48PM, Roland Moriz wrote: > Hello Chris, > > could you publish the updated ruby-libvirt bindings to rubygems.org? > There is still only version 0.1.0 of 2008 available: > > http://rubygems.org/gems/ruby-libvirt > > Thank you! Hello, I'd be happy to update the gem on rubygems.org. Unfortunately I don't have permission to do so, so I can't right at the moment. I've written to the previous maintainer of ruby-libvirt to see if he can give me access to update the gems there. As soon as I get that access, I'll push a new version of the gem and let you know. Thanks, -- Chris Lalancette

1 0

[libvirt] [PATCH] build: Fix permissions of sysconfig files
by Jiri Denemark 07 Sep '10

07 Sep '10

--- daemon/Makefile.am | 2 +- libvirt.spec.in | 4 ---- tools/Makefile.am | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/daemon/Makefile.am b/daemon/Makefile.am index 53133d2..45c30a9 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -261,7 +261,7 @@ install-init: libvirtd.init $(INSTALL_SCRIPT) libvirtd.init \ $(DESTDIR)$(sysconfdir)/rc.d/init.d/libvirtd mkdir -p $(DESTDIR)$(sysconfdir)/sysconfig - $(INSTALL_SCRIPT) $(srcdir)/libvirtd.sysconf \ + $(INSTALL_DATA) $(srcdir)/libvirtd.sysconf \ $(DESTDIR)$(sysconfdir)/sysconfig/libvirtd uninstall-init: diff --git a/libvirt.spec.in b/libvirt.spec.in index e530b1a..3cb38cc 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -646,10 +646,6 @@ rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.lxc rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/libvirtd.uml %endif -%if %{with_libvirtd} -chmod 0644 $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/libvirtd -%endif - %clean rm -fr %{buildroot} diff --git a/tools/Makefile.am b/tools/Makefile.am index ac26cae..bfe4455 100644 --- a/tools/Makefile.am +++ b/tools/Makefile.am @@ -134,7 +134,7 @@ install-init: libvirt-guests.init $(INSTALL_SCRIPT) libvirt-guests.init \ $(DESTDIR)$(sysconfdir)/rc.d/init.d/libvirt-guests mkdir -p $(DESTDIR)$(sysconfdir)/sysconfig - $(INSTALL_SCRIPT) $(srcdir)/libvirt-guests.sysconf \ + $(INSTALL_DATA) $(srcdir)/libvirt-guests.sysconf \ $(DESTDIR)$(sysconfdir)/sysconfig/libvirt-guests uninstall-init: -- 1.7.2.2

2 2

Re: [libvirt] virt-top version bump in EPEL5
by Richard W.M. Jones 06 Sep '10

06 Sep '10

On Mon, Sep 06, 2010 at 05:46:03PM +0200, Wolfram Schlich wrote: > * Richard W.M. Jones <rjones(a)redhat.com> [2010-09-06 17:23]: > > On Mon, Sep 06, 2010 at 05:06:55PM +0200, Wolfram Schlich wrote: > > > We are experiencing a problem with virt-top on our RHEL5 virthosts. > > > > > > On a heavily loaded virthost, virt-top is damn slow -- it takes 4-5s > > > to update and imposes a noticeable load on the dom0 as well > > > (xenstored shows up in top eating all CPU for some seconds). > > > xentop seems to impose *much* less load on the dom0. > > > Is there something I can do about it? > > > > > > Another problem: 0.3.3.1 shows RDRQ/WRRQ/RXBY/TXBY after some seconds > > > whereas 1.0.4 does not...? > > > > I bet both of these will be libvirt issues. > > > > Try running: > > > > virsh list --all > > Takes around 2-4s depending on dom0 load. CC-ing to libvir-list. There may be a better way now for virt-top to get the list of domains, but if 'virsh list --all' is also slow, then it's probably a generic libvirt problem. > > virsh domblkstat DomainName hda > > s/hda/xvda/ I guess :) > This one is quite fast, below 0.2s. > > > virsh domifstat DomainName vnet0 > > This takes around 0.1s most of the time, but sometimes around 1.0s. > > > etc. > > > > If those commands (done in a suitable loop) also cause load on the > > dom0, and if domblkstat/domifstat don't show stats, then it's down to > > libvirt. > > > > virt-top is a simple little program that just exercises those libvirt > > APIs ... > > Hmm :/ So I guess we're better off with xentop... We should be able to have performance very close to xentop. After all, libvirt makes exactly the same direct hypervisor calls. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming blog: http://rwmj.wordpress.com Fedora now supports 80 OCaml packages (the OPEN alternative to F#) http://cocan.org/getting_started_with_ocaml_on_red_hat_and_fedora

3 6

[libvirt] [PATCH] Default to qemu:///system if accessible
by Soren Hansen 06 Sep '10

06 Sep '10

If no uri is passed to one of the virConnectOpen-ish calls, libvirt attempts to autoprobe a sensible URI. Part of the current logic checks for getuid() > 0, and if that check is succesful, a libvirtd daemon is spawned. This patch replaces this check with a call to access(LIBVIRTD_PRIV_UNIX_SOCKET, W_OK) so that users with access to the qemu:///system UNIX socket connect to that one by default instead of spawning a new libvirtd daemon. Signed-off-by: Soren Hansen <soren(a)linux2go.dk> --- src/remote/remote_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index a945710..17e6ead 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -1086,7 +1086,7 @@ remoteOpen (virConnectPtr conn, if (!conn->uri) { DEBUG0("Auto-probe remote URI"); #ifndef __sun - if (getuid() > 0) { + if (access(LIBVIRTD_PRIV_UNIX_SOCKET, W_OK)) { DEBUG0("Auto-spawn user daemon instance"); rflags |= VIR_DRV_OPEN_REMOTE_USER; if (!autostart || -- 1.7.1

6 16

[libvirt] [PATCH] esx: Use the VirtualDisk UUID as storage volume key
by Matthias Bolte 04 Sep '10

04 Sep '10

VirtualDisks are .vmdk file based. Other files in a datastore like .iso or .flp files don't have a UUID attached, fall back to the path as key for them. --- src/esx/esx_storage_driver.c | 190 ++++++++++++++++++++++++++++++++++++---- src/esx/esx_util.c | 19 ++++ src/esx/esx_util.h | 2 + src/esx/esx_vi.c | 53 +++++++++++ src/esx/esx_vi.h | 4 + src/esx/esx_vi_generator.input | 7 ++ 6 files changed, 256 insertions(+), 19 deletions(-) diff --git a/src/esx/esx_storage_driver.c b/src/esx/esx_storage_driver.c index 3b959c2..a9a5633 100644 --- a/src/esx/esx_storage_driver.c +++ b/src/esx/esx_storage_driver.c @@ -697,7 +697,7 @@ esxStorageVolumeLookupByName(virStoragePoolPtr pool, const char *name) virStorageVolPtr volume = NULL; esxPrivate *priv = pool->conn->storagePrivateData; char *datastorePath = NULL; - esxVI_FileInfo *fileInfo = NULL; + char *key = NULL; if (esxVI_EnsureSession(priv->primary) < 0) { return NULL; @@ -708,17 +708,16 @@ esxStorageVolumeLookupByName(virStoragePoolPtr pool, const char *name) goto cleanup; } - if (esxVI_LookupFileInfoByDatastorePath(priv->primary, datastorePath, - false, &fileInfo, - esxVI_Occurrence_RequiredItem) < 0) { + if (esxVI_LookupStorageVolumeKeyByDatastorePath(priv->primary, + datastorePath, &key) < 0) { goto cleanup; } - volume = virGetStorageVol(pool->conn, pool->name, name, datastorePath); + volume = virGetStorageVol(pool->conn, pool->name, name, key); cleanup: VIR_FREE(datastorePath); - esxVI_FileInfo_Free(&fileInfo); + VIR_FREE(key); return volume; } @@ -726,36 +725,170 @@ esxStorageVolumeLookupByName(virStoragePoolPtr pool, const char *name) static virStorageVolPtr -esxStorageVolumeLookupByKeyOrPath(virConnectPtr conn, const char *keyOrPath) +esxStorageVolumeLookupByPath(virConnectPtr conn, const char *path) { virStorageVolPtr volume = NULL; esxPrivate *priv = conn->storagePrivateData; char *datastoreName = NULL; char *directoryAndFileName = NULL; - esxVI_FileInfo *fileInfo = NULL; + char *key = NULL; if (esxVI_EnsureSession(priv->primary) < 0) { return NULL; } - if (esxUtil_ParseDatastorePath(keyOrPath, &datastoreName, NULL, + if (esxUtil_ParseDatastorePath(path, &datastoreName, NULL, &directoryAndFileName) < 0) { goto cleanup; } - if (esxVI_LookupFileInfoByDatastorePath(priv->primary, keyOrPath, - false, &fileInfo, - esxVI_Occurrence_RequiredItem) < 0) { + if (esxVI_LookupStorageVolumeKeyByDatastorePath(priv->primary, path, + &key) < 0) { goto cleanup; } - volume = virGetStorageVol(conn, datastoreName, directoryAndFileName, - keyOrPath); + volume = virGetStorageVol(conn, datastoreName, directoryAndFileName, key); cleanup: VIR_FREE(datastoreName); VIR_FREE(directoryAndFileName); - esxVI_FileInfo_Free(&fileInfo); + VIR_FREE(key); + + return volume; +} + + + +static virStorageVolPtr +esxStorageVolumeLookupByKey(virConnectPtr conn, const char *key) +{ + virStorageVolPtr volume = NULL; + esxPrivate *priv = conn->storagePrivateData; + esxVI_String *propertyNameList = NULL; + esxVI_ObjectContent *datastoreList = NULL; + esxVI_ObjectContent *datastore = NULL; + char *datastoreName = NULL; + esxVI_HostDatastoreBrowserSearchResults *searchResultsList = NULL; + esxVI_HostDatastoreBrowserSearchResults *searchResults = NULL; + char *directoryAndFileName = NULL; + size_t length; + char *datastorePath = NULL; + char *volumeName = NULL; + esxVI_FileInfo *fileInfo = NULL; + char *uuid_string = NULL; + char key_candidate[VIR_UUID_STRING_BUFLEN] = ""; + + if (STRPREFIX(key, "[")) { + /* Key is probably a datastore path */ + return esxStorageVolumeLookupByPath(conn, key); + } + + if (esxVI_EnsureSession(priv->primary) < 0) { + return NULL; + } + + /* Lookup all datastores */ + if (esxVI_String_AppendValueToList(&propertyNameList, "summary.name") < 0 || + esxVI_LookupDatastoreList(priv->primary, propertyNameList, + &datastoreList) < 0) { + goto cleanup; + } + + for (datastore = datastoreList; datastore != NULL; + datastore = datastore->_next) { + datastoreName = NULL; + + if (esxVI_GetStringValue(datastore, "summary.name", &datastoreName, + esxVI_Occurrence_RequiredItem) < 0) { + goto cleanup; + } + + /* Lookup datastore content */ + esxVI_HostDatastoreBrowserSearchResults_Free(&searchResultsList); + + if (esxVI_LookupDatastoreContentByDatastoreName + (priv->primary, datastoreName, &searchResultsList) < 0) { + goto cleanup; + } + + /* Interpret search result */ + for (searchResults = searchResultsList; searchResults != NULL; + searchResults = searchResults->_next) { + VIR_FREE(directoryAndFileName); + + if (esxUtil_ParseDatastorePath(searchResults->folderPath, NULL, + NULL, &directoryAndFileName) < 0) { + goto cleanup; + } + + /* Strip trailing separators */ + length = strlen(directoryAndFileName); + + while (length > 0 && directoryAndFileName[length - 1] == '/') { + directoryAndFileName[length - 1] = '\0'; + --length; + } + + /* Build datastore path and query the UUID */ + for (fileInfo = searchResults->file; fileInfo != NULL; + fileInfo = fileInfo->_next) { + VIR_FREE(datastorePath); + + if (length < 1) { + if (virAsprintf(&volumeName, "%s", + fileInfo->path) < 0) { + virReportOOMError(); + goto cleanup; + } + } else if (virAsprintf(&volumeName, "%s/%s", + directoryAndFileName, + fileInfo->path) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (virAsprintf(&datastorePath, "[%s] %s", datastoreName, + volumeName) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (esxVI_VmDiskFileInfo_DynamicCast(fileInfo) == NULL) { + /* Only a VirtualDisk has a UUID */ + continue; + } + + VIR_FREE(uuid_string); + + if (esxVI_QueryVirtualDiskUuid + (priv->primary, datastorePath, + priv->primary->datacenter->_reference, + &uuid_string) < 0) { + goto cleanup; + } + + if (esxUtil_ReformatUuid(uuid_string, key_candidate) < 0) { + goto cleanup; + } + + if (STREQ(key, key_candidate)) { + /* Found matching UUID */ + volume = virGetStorageVol(conn, datastoreName, + volumeName, key); + goto cleanup; + } + } + } + } + + cleanup: + esxVI_String_Free(&propertyNameList); + esxVI_ObjectContent_Free(&datastoreList); + esxVI_HostDatastoreBrowserSearchResults_Free(&searchResultsList); + VIR_FREE(directoryAndFileName); + VIR_FREE(datastorePath); + VIR_FREE(volumeName); + VIR_FREE(uuid_string); return volume; } @@ -783,6 +916,8 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, esxVI_FileBackedVirtualDiskSpec *virtualDiskSpec = NULL; esxVI_ManagedObjectReference *task = NULL; esxVI_TaskInfoState taskInfoState; + char *uuid_string = NULL; + char key[VIR_UUID_STRING_BUFLEN] = ""; virCheckFlags(0, NULL); @@ -935,6 +1070,16 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Could not create volume")); goto cleanup; } + + if (esxVI_QueryVirtualDiskUuid(priv->primary, datastorePath, + priv->primary->datacenter->_reference, + &uuid_string) < 0) { + goto cleanup; + } + + if (esxUtil_ReformatUuid(uuid_string, key) < 0) { + goto cleanup; + } } else { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, _("Creation of %s volumes is not supported"), @@ -942,7 +1087,7 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, goto cleanup; } - volume = virGetStorageVol(pool->conn, pool->name, def->name, datastorePath); + volume = virGetStorageVol(pool->conn, pool->name, def->name, key); cleanup: if (virtualDiskSpec != NULL) { @@ -960,6 +1105,7 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, esxVI_FileInfo_Free(&fileInfo); esxVI_FileBackedVirtualDiskSpec_Free(&virtualDiskSpec); esxVI_ManagedObjectReference_Free(&task); + VIR_FREE(uuid_string); return volume; } @@ -1090,7 +1236,12 @@ esxStorageVolumeDumpXML(virStorageVolPtr volume, unsigned int flags) floppyImageFileInfo = esxVI_FloppyImageFileInfo_DynamicCast(fileInfo); def.name = volume->name; - def.key = datastorePath; + + if (esxVI_LookupStorageVolumeKeyByDatastorePath(priv->primary, datastorePath, + &def.key) < 0) { + goto cleanup; + } + def.type = VIR_STORAGE_VOL_FILE; def.target.path = datastorePath; @@ -1123,6 +1274,7 @@ esxStorageVolumeDumpXML(virStorageVolPtr volume, unsigned int flags) esxVI_DatastoreInfo_Free(&datastoreInfo); VIR_FREE(datastorePath); esxVI_FileInfo_Free(&fileInfo); + VIR_FREE(def.key); return xml; } @@ -1189,8 +1341,8 @@ static virStorageDriver esxStorageDriver = { esxStoragePoolNumberOfStorageVolumes, /* poolNumOfVolumes */ esxStoragePoolListStorageVolumes, /* poolListVolumes */ esxStorageVolumeLookupByName, /* volLookupByName */ - esxStorageVolumeLookupByKeyOrPath, /* volLookupByKey */ - esxStorageVolumeLookupByKeyOrPath, /* volLookupByPath */ + esxStorageVolumeLookupByKey, /* volLookupByKey */ + esxStorageVolumeLookupByPath, /* volLookupByPath */ esxStorageVolumeCreateXML, /* volCreateXML */ NULL, /* volCreateXMLFrom */ NULL, /* volDelete */ diff --git a/src/esx/esx_util.c b/src/esx/esx_util.c index 08c6c46..99cc4f6 100644 --- a/src/esx/esx_util.c +++ b/src/esx/esx_util.c @@ -602,3 +602,22 @@ esxUtil_GetConfigBoolean(virConfPtr conf, const char *name, bool *boolean_, return 0; } + + + +int +esxUtil_ReformatUuid(const char *input, char *output) +{ + unsigned char uuid[VIR_UUID_BUFLEN]; + + if (virUUIDParse(input, uuid) < 0) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, + _("Could not parse UUID from string '%s'"), + input); + return -1; + } + + virUUIDFormat(uuid, output); + + return 0; +} diff --git a/src/esx/esx_util.h b/src/esx/esx_util.h index 4d92333..650f145 100644 --- a/src/esx/esx_util.h +++ b/src/esx/esx_util.h @@ -69,4 +69,6 @@ int esxUtil_GetConfigLong(virConfPtr conf, const char *name, long long *number, int esxUtil_GetConfigBoolean(virConfPtr conf, const char *name, bool *boolean_, bool default_, bool optional); +int esxUtil_ReformatUuid(const char *input, char *output); + #endif /* __ESX_UTIL_H__ */ diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 8d83eac..fb2a499 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -3254,6 +3254,59 @@ esxVI_LookupDatastoreContentByDatastoreName int +esxVI_LookupStorageVolumeKeyByDatastorePath(esxVI_Context *ctx, + const char *datastorePath, + char **key) +{ + int result = -1; + esxVI_FileInfo *fileInfo = NULL; + char *uuid_string = NULL; + + if (key == NULL || *key != NULL) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); + return -1; + } + + if (esxVI_LookupFileInfoByDatastorePath(ctx, datastorePath, false, &fileInfo, + esxVI_Occurrence_RequiredItem) < 0) { + goto cleanup; + } + + if (esxVI_VmDiskFileInfo_DynamicCast(fileInfo) != NULL) { + /* VirtualDisks have a UUID, use it as key */ + if (esxVI_QueryVirtualDiskUuid(ctx, datastorePath, + ctx->datacenter->_reference, + &uuid_string) < 0) { + goto cleanup; + } + + if (VIR_ALLOC_N(*key, VIR_UUID_STRING_BUFLEN) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (esxUtil_ReformatUuid(uuid_string, *key) < 0) { + goto cleanup; + } + } else { + /* Other files don't have a UUID, fall back to the path as key */ + if (esxVI_String_DeepCopyValue(key, datastorePath) < 0) { + goto cleanup; + } + } + + result = 0; + + cleanup: + esxVI_FileInfo_Free(&fileInfo); + VIR_FREE(uuid_string); + + return result; +} + + + +int esxVI_HandleVirtualMachineQuestion (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachine, esxVI_VirtualMachineQuestionInfo *questionInfo, diff --git a/src/esx/esx_vi.h b/src/esx/esx_vi.h index 773a1c6..bd37b05 100644 --- a/src/esx/esx_vi.h +++ b/src/esx/esx_vi.h @@ -409,6 +409,10 @@ int esxVI_LookupDatastoreContentByDatastoreName (esxVI_Context *ctx, const char *datastoreName, esxVI_HostDatastoreBrowserSearchResults **searchResultsList); +int esxVI_LookupStorageVolumeKeyByDatastorePath(esxVI_Context *ctx, + const char *datastorePath, + char **key); + int esxVI_HandleVirtualMachineQuestion (esxVI_Context *ctx, esxVI_ManagedObjectReference *virtualMachine, diff --git a/src/esx/esx_vi_generator.input b/src/esx/esx_vi_generator.input index b911c22..2ee513a 100644 --- a/src/esx/esx_vi_generator.input +++ b/src/esx/esx_vi_generator.input @@ -801,6 +801,13 @@ method QueryPerfCounter returns PerfCounterInfo ol end +method QueryVirtualDiskUuid returns String r + ManagedObjectReference _this:VirtualDiskManager r + String name r + ManagedObjectReference datacenter o +end + + method RebootGuest ManagedObjectReference _this r end -- 1.7.0.4

2 2

[libvirt] [PATCH] esx: Add .vmdk storage volume creation
by Matthias Bolte 03 Sep '10

03 Sep '10

--- src/esx/esx_driver.c | 3 +- src/esx/esx_storage_driver.c | 215 +++++++++++++++++++++++++++++++++++++++- src/esx/esx_vi.c | 57 +++++++----- src/esx/esx_vi.h | 1 + src/esx/esx_vi_generator.input | 32 ++++++ src/esx/esx_vi_generator.py | 7 +- src/esx/esx_vi_methods.c | 12 +++ 7 files changed, 296 insertions(+), 31 deletions(-) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index eda3fc2..f8d4771 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -353,7 +353,8 @@ esxAutodetectSCSIControllerModel(virDomainDiskDefPtr def, int *model, return 0; } - if (esxVI_LookupFileInfoByDatastorePath(data->ctx, def->src, &fileInfo, + if (esxVI_LookupFileInfoByDatastorePath(data->ctx, def->src, + false, &fileInfo, esxVI_Occurrence_RequiredItem) < 0) { goto cleanup; } diff --git a/src/esx/esx_storage_driver.c b/src/esx/esx_storage_driver.c index d2d8f22..3b959c2 100644 --- a/src/esx/esx_storage_driver.c +++ b/src/esx/esx_storage_driver.c @@ -709,7 +709,7 @@ esxStorageVolumeLookupByName(virStoragePoolPtr pool, const char *name) } if (esxVI_LookupFileInfoByDatastorePath(priv->primary, datastorePath, - &fileInfo, + false, &fileInfo, esxVI_Occurrence_RequiredItem) < 0) { goto cleanup; } @@ -743,7 +743,8 @@ esxStorageVolumeLookupByKeyOrPath(virConnectPtr conn, const char *keyOrPath) goto cleanup; } - if (esxVI_LookupFileInfoByDatastorePath(priv->primary, keyOrPath, &fileInfo, + if (esxVI_LookupFileInfoByDatastorePath(priv->primary, keyOrPath, + false, &fileInfo, esxVI_Occurrence_RequiredItem) < 0) { goto cleanup; } @@ -761,6 +762,210 @@ esxStorageVolumeLookupByKeyOrPath(virConnectPtr conn, const char *keyOrPath) +static virStorageVolPtr +esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, + unsigned int flags) +{ + virStorageVolPtr volume = NULL; + esxPrivate *priv = pool->conn->storagePrivateData; + esxVI_String *propertyNameList = NULL; + esxVI_ObjectContent *datastore = NULL; + esxVI_DynamicProperty *dynamicProperty = NULL; + esxVI_DatastoreInfo *datastoreInfo = NULL; + virStoragePoolDef poolDef; + virStorageVolDefPtr def = NULL; + char *tmp1; + char *tmp2; + char *datastorePath = NULL; + char *directoryName = NULL; + char *datastorePathWithoutFileName = NULL; + esxVI_FileInfo *fileInfo = NULL; + esxVI_FileBackedVirtualDiskSpec *virtualDiskSpec = NULL; + esxVI_ManagedObjectReference *task = NULL; + esxVI_TaskInfoState taskInfoState; + + virCheckFlags(0, NULL); + + memset(&poolDef, 0, sizeof (poolDef)); + + if (esxVI_EnsureSession(priv->primary) < 0) { + return NULL; + } + + /* Lookup storage pool type */ + if (esxVI_String_AppendValueToList(&propertyNameList, "info") < 0 || + esxVI_LookupDatastoreByName(priv->primary, pool->name, + propertyNameList, &datastore, + esxVI_Occurrence_RequiredItem) < 0) { + goto cleanup; + } + + for (dynamicProperty = datastore->propSet; dynamicProperty != NULL; + dynamicProperty = dynamicProperty->_next) { + if (STREQ(dynamicProperty->name, "info")) { + if (esxVI_DatastoreInfo_CastFromAnyType(dynamicProperty->val, + &datastoreInfo) < 0) { + goto cleanup; + } + + break; + } + } + + if (esxVI_LocalDatastoreInfo_DynamicCast(datastoreInfo) != NULL) { + poolDef.type = VIR_STORAGE_POOL_DIR; + } else if (esxVI_NasDatastoreInfo_DynamicCast(datastoreInfo) != NULL) { + poolDef.type = VIR_STORAGE_POOL_NETFS; + } else if (esxVI_VmfsDatastoreInfo_DynamicCast(datastoreInfo) != NULL) { + poolDef.type = VIR_STORAGE_POOL_FS; + } else { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("DatastoreInfo has unexpected type")); + goto cleanup; + } + + /* Parse config */ + def = virStorageVolDefParseString(&poolDef, xmldesc); + + if (def == NULL) { + goto cleanup; + } + + if (def->type != VIR_STORAGE_VOL_FILE) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("Creating non-file volumes is not supported")); + goto cleanup; + } + + /* Validate config */ + tmp1 = strchr(def->name, '/'); + tmp2 = strrchr(def->name, '/'); + + if (tmp1 == NULL || tmp1 == def->name || + tmp2 == NULL || tmp2[1] == '\0') { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("Volume name '%s' doesn't have expected format " + "'<directory>/<file>'"), def->name); + goto cleanup; + } + + if (! virFileHasSuffix(def->name, ".vmdk")) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("Volume name '%s' has unsupported suffix, expecting '.vmdk'"), + def->name); + goto cleanup; + } + + if (virAsprintf(&datastorePath, "[%s] %s", pool->name, def->name) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (def->target.format == VIR_STORAGE_FILE_VMDK) { + /* Create directory, if it doesn't exist yet */ + if (esxUtil_ParseDatastorePath(datastorePath, NULL, &directoryName, + NULL) < 0) { + goto cleanup; + } + + if (virAsprintf(&datastorePathWithoutFileName, "[%s] %s", pool->name, + directoryName) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (esxVI_LookupFileInfoByDatastorePath + (priv->primary, datastorePathWithoutFileName, true, &fileInfo, + esxVI_Occurrence_OptionalItem) < 0) { + goto cleanup; + } + + if (fileInfo == NULL) { + if (esxVI_MakeDirectory(priv->primary, datastorePathWithoutFileName, + priv->primary->datacenter->_reference, + esxVI_Boolean_True) < 0) { + goto cleanup; + } + } + + /* Create VirtualDisk */ + if (esxVI_FileBackedVirtualDiskSpec_Alloc(&virtualDiskSpec) < 0 || + esxVI_Long_Alloc(&virtualDiskSpec->capacityKb) < 0) { + goto cleanup; + } + + /* From the vSphere API documentation about VirtualDiskType ... */ + if (def->allocation == def->capacity) { + /* + * "A preallocated disk has all space allocated at creation time + * and the space is zeroed on demand as the space is used." + */ + virtualDiskSpec->diskType = (char *)"preallocated"; + } else if (def->allocation == 0) { + /* + * "Space required for thin-provisioned virtual disk is allocated + * and zeroed on demand as the space is used." + */ + virtualDiskSpec->diskType = (char *)"thin"; + } else { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("Unsupported capacity-to-allocation relation")); + goto cleanup; + } + + /* + * FIXME: The adapter type is a required parameter, but there is no + * way to let the user specifiy it in the volume XML config. Therefore, + * default to 'busLogic' here. + */ + virtualDiskSpec->adapterType = (char *)"busLogic"; + + virtualDiskSpec->capacityKb->value = def->capacity / 1024; /* Scale from byte to kilobyte */ + + if (esxVI_CreateVirtualDisk_Task + (priv->primary, datastorePath, priv->primary->datacenter->_reference, + esxVI_VirtualDiskSpec_DynamicCast(virtualDiskSpec), &task) < 0 || + esxVI_WaitForTaskCompletion(priv->primary, task, NULL, + esxVI_Occurrence_None, + priv->autoAnswer, &taskInfoState) < 0) { + goto cleanup; + } + + if (taskInfoState != esxVI_TaskInfoState_Success) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Could not create volume")); + goto cleanup; + } + } else { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, + _("Creation of %s volumes is not supported"), + virStorageFileFormatTypeToString(def->target.format)); + goto cleanup; + } + + volume = virGetStorageVol(pool->conn, pool->name, def->name, datastorePath); + + cleanup: + if (virtualDiskSpec != NULL) { + virtualDiskSpec->diskType = NULL; + virtualDiskSpec->adapterType = NULL; + } + + esxVI_String_Free(&propertyNameList); + esxVI_ObjectContent_Free(&datastore); + esxVI_DatastoreInfo_Free(&datastoreInfo); + virStorageVolDefFree(def); + VIR_FREE(datastorePath); + VIR_FREE(directoryName); + VIR_FREE(datastorePathWithoutFileName); + esxVI_FileInfo_Free(&fileInfo); + esxVI_FileBackedVirtualDiskSpec_Free(&virtualDiskSpec); + esxVI_ManagedObjectReference_Free(&task); + + return volume; +} + + + static int esxStorageVolumeGetInfo(virStorageVolPtr volume, virStorageVolInfoPtr info) { @@ -782,7 +987,7 @@ esxStorageVolumeGetInfo(virStorageVolPtr volume, virStorageVolInfoPtr info) } if (esxVI_LookupFileInfoByDatastorePath(priv->primary, datastorePath, - &fileInfo, + false, &fileInfo, esxVI_Occurrence_RequiredItem) < 0) { goto cleanup; } @@ -875,7 +1080,7 @@ esxStorageVolumeDumpXML(virStorageVolPtr volume, unsigned int flags) } if (esxVI_LookupFileInfoByDatastorePath(priv->primary, datastorePath, - &fileInfo, + false, &fileInfo, esxVI_Occurrence_RequiredItem) < 0) { goto cleanup; } @@ -986,7 +1191,7 @@ static virStorageDriver esxStorageDriver = { esxStorageVolumeLookupByName, /* volLookupByName */ esxStorageVolumeLookupByKeyOrPath, /* volLookupByKey */ esxStorageVolumeLookupByKeyOrPath, /* volLookupByPath */ - NULL, /* volCreateXML */ + esxStorageVolumeCreateXML, /* volCreateXML */ NULL, /* volCreateXMLFrom */ NULL, /* volDelete */ NULL, /* volWipe */ diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index a6950fd..8d83eac 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -2940,6 +2940,7 @@ esxVI_LookupCurrentSnapshotTree int esxVI_LookupFileInfoByDatastorePath(esxVI_Context *ctx, const char *datastorePath, + bool lookupFolder, esxVI_FileInfo **fileInfo, esxVI_Occurrence occurrence) { @@ -2954,6 +2955,7 @@ esxVI_LookupFileInfoByDatastorePath(esxVI_Context *ctx, esxVI_ObjectContent *datastore = NULL; esxVI_ManagedObjectReference *hostDatastoreBrowser = NULL; esxVI_HostDatastoreBrowserSearchSpec *searchSpec = NULL; + esxVI_FolderFileQuery *folderFileQuery = NULL; esxVI_VmDiskFileQuery *vmDiskFileQuery = NULL; esxVI_IsoImageFileQuery *isoImageFileQuery = NULL; esxVI_FloppyImageFileQuery *floppyImageFileQuery = NULL; @@ -3030,32 +3032,41 @@ esxVI_LookupFileInfoByDatastorePath(esxVI_Context *ctx, searchSpec->details->fileSize = esxVI_Boolean_True; searchSpec->details->modification = esxVI_Boolean_False; - if (esxVI_VmDiskFileQuery_Alloc(&vmDiskFileQuery) < 0 || - esxVI_VmDiskFileQueryFlags_Alloc(&vmDiskFileQuery->details) < 0 || - esxVI_FileQuery_AppendToList - (&searchSpec->query, - esxVI_FileQuery_DynamicCast(vmDiskFileQuery)) < 0) { - goto cleanup; - } + if (lookupFolder) { + if (esxVI_FolderFileQuery_Alloc(&folderFileQuery) < 0 || + esxVI_FileQuery_AppendToList + (&searchSpec->query, + esxVI_FileQuery_DynamicCast(folderFileQuery)) < 0) { + goto cleanup; + } + } else { + if (esxVI_VmDiskFileQuery_Alloc(&vmDiskFileQuery) < 0 || + esxVI_VmDiskFileQueryFlags_Alloc(&vmDiskFileQuery->details) < 0 || + esxVI_FileQuery_AppendToList + (&searchSpec->query, + esxVI_FileQuery_DynamicCast(vmDiskFileQuery)) < 0) { + goto cleanup; + } - vmDiskFileQuery->details->diskType = esxVI_Boolean_False; - vmDiskFileQuery->details->capacityKb = esxVI_Boolean_True; - vmDiskFileQuery->details->hardwareVersion = esxVI_Boolean_False; - vmDiskFileQuery->details->controllerType = esxVI_Boolean_True; - vmDiskFileQuery->details->diskExtents = esxVI_Boolean_False; + vmDiskFileQuery->details->diskType = esxVI_Boolean_False; + vmDiskFileQuery->details->capacityKb = esxVI_Boolean_True; + vmDiskFileQuery->details->hardwareVersion = esxVI_Boolean_False; + vmDiskFileQuery->details->controllerType = esxVI_Boolean_True; + vmDiskFileQuery->details->diskExtents = esxVI_Boolean_False; - if (esxVI_IsoImageFileQuery_Alloc(&isoImageFileQuery) < 0 || - esxVI_FileQuery_AppendToList - (&searchSpec->query, - esxVI_FileQuery_DynamicCast(isoImageFileQuery)) < 0) { - goto cleanup; - } + if (esxVI_IsoImageFileQuery_Alloc(&isoImageFileQuery) < 0 || + esxVI_FileQuery_AppendToList + (&searchSpec->query, + esxVI_FileQuery_DynamicCast(isoImageFileQuery)) < 0) { + goto cleanup; + } - if (esxVI_FloppyImageFileQuery_Alloc(&floppyImageFileQuery) < 0 || - esxVI_FileQuery_AppendToList - (&searchSpec->query, - esxVI_FileQuery_DynamicCast(floppyImageFileQuery)) < 0) { - goto cleanup; + if (esxVI_FloppyImageFileQuery_Alloc(&floppyImageFileQuery) < 0 || + esxVI_FileQuery_AppendToList + (&searchSpec->query, + esxVI_FileQuery_DynamicCast(floppyImageFileQuery)) < 0) { + goto cleanup; + } } if (esxVI_String_Alloc(&searchSpec->matchPattern) < 0) { diff --git a/src/esx/esx_vi.h b/src/esx/esx_vi.h index 3d1aee0..773a1c6 100644 --- a/src/esx/esx_vi.h +++ b/src/esx/esx_vi.h @@ -401,6 +401,7 @@ int esxVI_LookupCurrentSnapshotTree int esxVI_LookupFileInfoByDatastorePath(esxVI_Context *ctx, const char *datastorePath, + bool lookupFolder, esxVI_FileInfo **fileInfo, esxVI_Occurrence occurrence); diff --git a/src/esx/esx_vi_generator.input b/src/esx/esx_vi_generator.input index 0fb9448..b911c22 100644 --- a/src/esx/esx_vi_generator.input +++ b/src/esx/esx_vi_generator.input @@ -166,6 +166,11 @@ object Description end +object DeviceBackedVirtualDiskSpec extends VirtualDiskSpec + String device r +end + + object DynamicProperty String name r AnyType val r @@ -190,6 +195,11 @@ object Event end +object FileBackedVirtualDiskSpec extends VirtualDiskSpec + Long capacityKb r +end + + object FileInfo String path r Long fileSize o @@ -528,6 +538,12 @@ object UserSession end +object VirtualDiskSpec + String diskType r + String adapterType r +end + + object VirtualMachineConfigSpec String changeVersion o String name o @@ -694,6 +710,14 @@ method CreateSnapshot_Task returns ManagedObjectReference r end +method CreateVirtualDisk_Task returns ManagedObjectReference r + ManagedObjectReference _this:VirtualDiskManager r + String name r + ManagedObjectReference datacenter o + VirtualDiskSpec spec r +end + + method DestroyPropertyFilter ManagedObjectReference _this r end @@ -728,6 +752,14 @@ method Logout end +method MakeDirectory + ManagedObjectReference _this:FileManager r + String name r + ManagedObjectReference datacenter o + Boolean createParentDirectories o +end + + method MigrateVM_Task returns ManagedObjectReference r ManagedObjectReference _this r ManagedObjectReference pool o diff --git a/src/esx/esx_vi_generator.py b/src/esx/esx_vi_generator.py index 411fd80..be96a03 100755 --- a/src/esx/esx_vi_generator.py +++ b/src/esx/esx_vi_generator.py @@ -45,10 +45,12 @@ valid_occurrences = [OCCURRENCE__REQUIRED_ITEM, class Parameter: - autobind_map = { "PerformanceManager" : "perfManager", + autobind_map = { "FileManager" : "fileManager", + "PerformanceManager" : "perfManager", "PropertyCollector" : "propertyCollector", "SearchIndex" : "searchIndex", - "SessionManager" : "sessionManager" } + "SessionManager" : "sessionManager", + "VirtualDiskManager" : "virtualDiskManager" } def __init__(self, type, name, occurrence): self.type = type @@ -1146,6 +1148,7 @@ additional_object_features = { "DatastoreHostMount" : Object.FEATURE__DE "SharesInfo" : Object.FEATURE__ANY_TYPE, "TaskInfo" : Object.FEATURE__ANY_TYPE | Object.FEATURE__LIST, "UserSession" : Object.FEATURE__ANY_TYPE, + "VirtualDiskSpec" : Object.FEATURE__DYNAMIC_CAST, "VirtualMachineQuestionInfo" : Object.FEATURE__ANY_TYPE, "VirtualMachineSnapshotTree" : Object.FEATURE__DEEP_COPY | Object.FEATURE__ANY_TYPE } diff --git a/src/esx/esx_vi_methods.c b/src/esx/esx_vi_methods.c index 56d2e58..a00561f 100644 --- a/src/esx/esx_vi_methods.c +++ b/src/esx/esx_vi_methods.c @@ -173,6 +173,12 @@ +#define ESX_VI__METHOD__PARAMETER__THIS__fileManager \ + ESX_VI__METHOD__PARAMETER__THIS_FROM_SERVICE(ManagedObjectReference, \ + fileManager) + + + #define ESX_VI__METHOD__PARAMETER__THIS__perfManager \ ESX_VI__METHOD__PARAMETER__THIS_FROM_SERVICE(ManagedObjectReference, \ perfManager) @@ -197,6 +203,12 @@ +#define ESX_VI__METHOD__PARAMETER__THIS__virtualDiskManager \ + ESX_VI__METHOD__PARAMETER__THIS_FROM_SERVICE(ManagedObjectReference, \ + virtualDiskManager) + + + /* * A required parameter must be != 0 (NULL for pointers, "undefined" == 0 for * enumeration values). -- 1.7.0.4

2 2

[libvirt] [PATCH] OpenVZ: add ethernet interface type support
by Jean-Baptiste Rouault 03 Sep '10

03 Sep '10

Hi all, This patch adds support for ethernet interface type to OpenVZ domains as stated in this previous message: http://www.redhat.com/archives/libvir- list/2010-July/msg00658.html Regards, Jean-Baptiste

2 2

[libvirt] libvirt-guests and ./configure --without-libvirtd
by Eric Blake 03 Sep '10

03 Sep '10

On mingw, libvirt is typically configured --without-libvirtd, because the mingw build is designed to target other hosts, but cannot natively run as a hypervisor. Additionally, mingw doesn't really have a notion of /etc/sysconf, so installing /etc/sysconfig/libvirt-guests doesn't work too well. Should tools/Makefile.am make the build and installation of libvirt-guests dependent on the already-existing WITH_LIBVIRTD Makefile conditional, or would it ever make sense to build libvirt-guests but not libvirtd? I guess the answer to that boils down to whether it ever makes sense to use libvirt-guests on a system that is not running libvirtd, in which case it would only be able to control remote URIs. But the whole point of the script is to cleanly save state for local VMs, so I don't see using libvirt-guests as a management tool for remote URIs. Unless anyone speaks up with another opinion, I'll prepare a patch that makes libvirt-guests depend on WITH_LIBVIRTD. -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

2 2

[libvirt] [PATCH] build: avoid unused variable warning
by Eric Blake 03 Sep '10

03 Sep '10

* src/vbox/vbox_tmpl.c (vboxAttachDrives): Capture return value. --- Pushing under the build-breaker rule. Gcc didn't catch this under '-g -O0', but with -Werror and -O2, it dies with a warning that rc is used uninitialized. I suspect that clang would have also reported this, although I haven't tested that suspicion. This was a pre-existing bug; my refactoring exposed it (before the refactoring, rc contained stale contents, unrelated to the actual message being printed; after the refactoring, rc was indeed used without initialization). src/vbox/vbox_tmpl.c | 34 ++++++++++++++++++---------------- 1 files changed, 18 insertions(+), 16 deletions(-) diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 3e8ff23..b5cd2e4 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -3788,40 +3788,42 @@ vboxAttachDrives(virDomainDefPtr def, vboxGlobalData *data, IMachine *machine) VBOX_UTF16_FREE(mediumFileUtf16); continue; } if (!medium) { PRUnichar *mediumEmpty = NULL; VBOX_UTF8_TO_UTF16("", &mediumEmpty); if (def->disks[i]->device == VIR_DOMAIN_DISK_DEVICE_DISK) { - data->vboxObj->vtbl->OpenHardDisk(data->vboxObj, - mediumFileUtf16, - AccessMode_ReadWrite, - false, - mediumEmpty, - false, - mediumEmpty, - &medium); + rc = data->vboxObj->vtbl->OpenHardDisk(data->vboxObj, + mediumFileUtf16, + AccessMode_ReadWrite, + false, + mediumEmpty, + false, + mediumEmpty, + &medium); } else if (def->disks[i]->device == VIR_DOMAIN_DISK_DEVICE_CDROM) { - data->vboxObj->vtbl->OpenDVDImage(data->vboxObj, - mediumFileUtf16, - mediumEmpty, - &medium); + rc = data->vboxObj->vtbl->OpenDVDImage(data->vboxObj, + mediumFileUtf16, + mediumEmpty, + &medium); } else if (def->disks[i]->device == VIR_DOMAIN_DISK_DEVICE_FLOPPY) { - data->vboxObj->vtbl->OpenFloppyImage(data->vboxObj, - mediumFileUtf16, - mediumEmpty, - &medium); + rc = data->vboxObj->vtbl->OpenFloppyImage(data->vboxObj, + mediumFileUtf16, + mediumEmpty, + &medium); + } else { + rc = 0; } VBOX_UTF16_FREE(mediumEmpty); } if (!medium) { vboxError(VIR_ERR_INTERNAL_ERROR, _("Failed to attach the following disk/dvd/floppy " "to the machine: %s, rc=%08x"), def->disks[i]->src, (unsigned)rc); -- 1.7.2.2

1 0