- Devel - libvirt List Archives

[libvirt] [RESEND] qemu_monitor_json: Drop timestamp from command object
by Luiz Capitulino 23 Apr '10

23 Apr '10

It's not needed and is currently ignored, but this is a bug. It will get fixed soon and QMP will return an error for keys it doesn't know about, this will break libvirt. Signed-off-by: Luiz Capitulino <lcapitulino(a)redhat.com> --- src/qemu/qemu_monitor_json.c | 34 ---------------------------------- 1 files changed, 0 insertions(+), 34 deletions(-) diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 96f246f..7c8387d 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -356,37 +356,6 @@ qemuMonitorJSONHasError(virJSONValuePtr reply, return STREQ(klass, thisklass); } -static int -qemuMonitorJSONCommandAddTimestamp(virJSONValuePtr obj) -{ - struct timeval tv; - virJSONValuePtr timestamp = NULL; - - if (gettimeofday(&tv, NULL) < 0) { - virReportSystemError(errno, "%s", - _("cannot query time of day")); - return -1; - } - - if (!(timestamp = virJSONValueNewObject())) - goto no_memory; - - if (virJSONValueObjectAppendNumberLong(timestamp, "seconds", tv.tv_sec) < 0) - goto no_memory; - if (virJSONValueObjectAppendNumberLong(timestamp, "microseconds", tv.tv_usec) < 0) - goto no_memory; - - if (virJSONValueObjectAppend(obj, "timestamp", timestamp) < 0) - goto no_memory; - - return 0; - -no_memory: - virReportOOMError(); - virJSONValueFree(timestamp); - return -1; -} - static virJSONValuePtr ATTRIBUTE_SENTINEL qemuMonitorJSONMakeCommand(const char *cmdname, ...) @@ -404,9 +373,6 @@ qemuMonitorJSONMakeCommand(const char *cmdname, if (virJSONValueObjectAppendString(obj, "execute", cmdname) < 0) goto no_memory; - if (qemuMonitorJSONCommandAddTimestamp(obj) < 0) - goto error; - while ((key = va_arg(args, char *)) != NULL) { int ret; char type; -- 1.7.1.rc1.12.ga6018

3 2

[libvirt] [PATCH] nwfilter: extend schema + add testcase w/ connlimit-above test
by Stefan Berger 23 Apr '10

23 Apr '10

I am extending the schema with the recently added connlimit-above attribute and adding a test case to the test suite. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/schemas/nwfilter.rng | 5 +++++ tests/nwfilterxml2xmlin/conntrack-test.xml | 14 ++++++++++++++ tests/nwfilterxml2xmlout/conntrack-test.xml | 12 ++++++++++++ tests/nwfilterxml2xmltest.c | 2 ++ 4 files changed, 33 insertions(+) Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -387,6 +387,11 @@ <ref name="sixbitrange"/> </attribute> </optional> + <optional> + <attribute name="connlimit-above"> + <ref name="uint16range"/> + </attribute> + </optional> </interleave> </define> Index: libvirt-acl/tests/nwfilterxml2xmlin/conntrack-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/conntrack-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase' chain='root'> + <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid> + <rule action='drop' direction='out' priority='500'> + <icmp connlimit-above='1'/> + </rule> + <rule action='drop' direction='out' priority='500'> + <tcp connlimit-above='2'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <all/> + </rule> +</filter> + + Index: libvirt-acl/tests/nwfilterxml2xmlout/conntrack-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/conntrack-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid> + <rule action='drop' direction='out' priority='500'> + <icmp connlimit-above='1'/> + </rule> + <rule action='drop' direction='out' priority='500'> + <tcp connlimit-above='2'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <all/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -119,6 +119,8 @@ mymain(int argc, char **argv) DO_TEST("icmp-direction2-test"); DO_TEST("icmp-direction3-test"); + DO_TEST("conntrack-test"); + return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); }

2 2

[libvirt] [RFC] libvirt-TCK scripts to verify spoofing prevention
by Gerhard Stenzel 23 Apr '10

23 Apr '10

The following patch mainly adds a set of test case to verify that several spoofing attacks are prevented by the nwfilter subsystem. In order to have a well defined test machine, the patch also includes test scripts to network install a virtual disk from scratch, to boot the virtual test machine prior to running the actual test scripts and to shut it down afterwards. While I have tried to remove as much dependency on my local setup as possible there is still some left, so I am currently more interested in feedback about the general approach, not necessarily actual inclusion into the libvirt-TCK git. For example, I am currently trying to find a suitable location for the kickstart file, and also a suitable place for the common_functions.pl. Comments are appreciated ... thanks, Gerhard Index: libvirt-tck/scripts/network/README =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/README @@ -0,0 +1,14 @@ + +Test cases: + +000-install-image.t creates and install a 2GB fedora virtual disk via kickstart file from the network +001-boot-image.t defines and boots a VM which uses the fedora virtual disk +100-ping-still-working.t verifies the VM is pingable +210-no-mac-spoofing.t verifies mac spoofing is prevented +220-no-ip-spoofing.t verifies ip spoofing is prevented +230-no-mac-broadcast.t verifies mac broadcasting is prevented +240-no-arp-spoofing.t verifies arp spoofing is prevented +999-shutdown-image.t shuts the VM down + + + Index: libvirt-tck/scripts/network/000-install-image.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/000-install-image.t @@ -0,0 +1,181 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/000-install-image.t - install network test image + +=head1 DESCRIPTION + +The test case creates and install a 2GB fedora virtual +disk via kickstart file from the network. + +=cut + +use strict; +use warnings; + +use Test::More tests => 1; + +use Sys::Virt::TCK; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { $tck->cleanup if $tck; } + +# variables which may need to be adapted +my $domain_name ="f12nwtest"; +my $disk_name = "/var/lib/libvirt/images/${domain_name}.img"; +my $disk_size = "2147483648"; + +my $kickstart_file ="http://192.168.122.1/ks.cfg"; +my $cmdline = "ip=dhcp gateway=192.168.122.1 ks=${kickstart_file}"; + +# see if the domain already exits +my $already_defined = 0; +diag "searching if ${domain_name} is already defined"; +my $nnames = $conn->num_of_defined_domains(); +my @names = $conn->list_defined_domain_names($nnames); +foreach (@names){ + if (/${domain_name}/) { + print "$_ already exists, no need to redefine\n"; + $already_defined = 1; + } +} +diag $already_defined; + +# check for installation disk and build it if not exists +my $already_installed = 0; +my $pool = $conn->get_storage_pool_by_name("default"); +my $nnames = $pool->num_of_storage_volumes(); +my @volNames = $pool->list_storage_vol_names($nnames); +foreach (@volNames){ + if (/${domain_name}/) { + print "$_ already exists, no need to install\n"; + $already_installed = 1; + } +} + +my $volumexml = "<volume>". +" <name>${domain_name}.img</name>". +" <key>${disk_name}</key>". +" <source>". +" </source>". +" <capacity>${disk_size}</capacity>". +" <allocation>4096</allocation>". +" <target>". +" <path>${disk_name}</path>". +" <format type='raw'/>". +" <permissions>". +" <mode>0644</mode>". +" <owner>0</owner>". +" <group>0</group>". +" </permissions>". +" </target>". +"</volume>"; + + +# prepare image +if ($already_installed == 0) { + diag "Creating ${disk_name}"; + diag $volumexml; + my $vol = $pool->create_volume($volumexml) +# system("qemu-img create ${disk_name} ${disk_size}"); +} + +my $topxml = " <name>${domain_name}</name>". +" <memory>524288</memory>". +" <currentMemory>524288</currentMemory>". +" <vcpu>1</vcpu>"; + +my $osxml = " <os>". +" <type arch='x86_64' machine='fedora-13'>hvm</type>". +" <kernel>/var/cache/libvirt-tck/os-i686-hvm/vmlinuz</kernel>". +" <initrd>/var/cache/libvirt-tck/os-i686-hvm/initrd</initrd>". +" <cmdline>${cmdline}</cmdline>". +" <boot dev='hd'/>". +" </os>"; + +my $bottomxml = " <features>". +" <acpi/>". +" <apic/>". +" </features>". +" <clock offset='utc'/>". +" <on_poweroff>destroy</on_poweroff>". +" <on_reboot>restart</on_reboot>". +" <on_crash>restart</on_crash>". +" <devices>". +" <emulator>/usr/bin/qemu-kvm</emulator>". +" <disk type='file' device='disk'>". +" <driver name='qemu' type='raw'/>". +" <source file='${disk_name}'/>". +" <target dev='hda' bus='ide'/>". +" </disk>". +" <controller type='ide' index='0'>". +" </controller>". +" <interface type='network'>". +" <source network='default'/>". +" <target dev='vnet0'/>". +" <model type='virtio'/>". +" </interface>". +" <serial type='pty'>". +" <target port='0'/>". +" </serial>". +" <console type='pty'>". +" <target port='0'/>". +" </console>". +" <graphics type='vnc' port='-1' autoport='yes' listen='127.0.0.1' keymap='de'/>". +" <video>". +" <model type='cirrus' vram='9216' heads='1'/>". +" </video>". +" </devices>"; + +my $xml = "<domain type='kvm'>" . +$topxml. +$osxml. +$bottomxml. +"</domain>"; + +diag $xml; +diag "Defining an inactive domain config"; +my $dom; + +# no need to start if already installed +if (($already_installed == 0) && ($already_defined == 0)) { + ok_domain(sub { $dom = $conn->define_domain($xml) }, "defined persistent domain config"); + $xml = $dom->get_xml_description; + diag $xml; + diag "Starting inactive domain config"; + $dom->create; + + # wait for completion of installation + diag "wait for installation to finish .. "; + while($dom->is_active()) { + sleep(10); + diag ".. to view progress connect to virtual machine ${domain_name} .. "; + } + sleep(10); + diag " .. done"; + # cleanup + $dom->undefine; +} else { + ok_domain { $dom = $conn->get_domain_by_name($domain_name) } "the existing domain object"; +} + + + + + Index: libvirt-tck/scripts/network/001-boot-image.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/001-boot-image.t @@ -0,0 +1,133 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/001-boot-image.t - boot installed test image + +=head1 DESCRIPTION + +The test case defines and boots a VM which uses the +fedora virtual disk create ny 000-install-image + +=cut + +use strict; +use warnings; + +use Test::More tests => 2; + +use Sys::Virt::TCK; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { $tck->cleanup if $tck; } + +my $already_defined = 0; +my $domain_name ="f12nwtest"; + +# see if the domain already exits +diag "searching if ${domain_name} is already defined"; +my $nnames = $conn->num_of_defined_domains(); +my @names = $conn->list_defined_domain_names($nnames); +foreach (@names){ + if (/${domain_name}/) { + print "$_ already exists, no need to redefine\n"; + $already_defined = 1; + } +} +diag $already_defined; + +my $dom; +my $xml; + +if ($already_defined == 1) { + ok_domain { $dom = $conn->get_domain_by_name($domain_name) } "the existing domain object"; +} else { + my $topxml = " <name>${domain_name}</name>". + " <memory>524288</memory>". + " <currentMemory>524288</currentMemory>". + " <vcpu>1</vcpu>"; + + my $osxml = " <os>". + " <type arch='x86_64' machine='fedora-13'>hvm</type>". + " <boot dev='hd'/>". + " </os>"; + + my $bottomxml = " <features>". + " <acpi/>". + " <apic/>". + " </features>". + " <clock offset='utc'/>". + " <on_poweroff>destroy</on_poweroff>". + " <on_reboot>restart</on_reboot>". + " <on_crash>restart</on_crash>". + " <devices>". + " <emulator>/usr/bin/qemu-kvm</emulator>". + " <disk type='file' device='disk'>". + " <driver name='qemu' type='raw'/>". + " <source file='/var/lib/libvirt/images/${domain_name}.img'/>". + " <target dev='hda' bus='ide'/>". + " </disk>". + " <controller type='ide' index='0'>". + " </controller>". + " <interface type='network'>". + " <source network='default'/>". + " <filterref filter='no-spoofing'/>". + " <target dev='vnet0'/>". + " <model type='virtio'/>". + " </interface>". + " <serial type='pty'>". + " <target port='0'/>". + " </serial>". + " <console type='pty'>". + " <target port='0'/>". + " </console>". + " <graphics type='vnc' port='-1' autoport='yes' listen='127.0.0.1' keymap='de'/>". + " <video>". + " <model type='cirrus' vram='9216' heads='1'/>". + " </video>". + " </devices>"; + + $xml = "<domain type='kvm'>" . + $topxml. + $osxml. + $bottomxml. + "</domain>"; + + diag $xml; + diag "Defining an inactive domain config"; + ok_domain(sub { $dom = $conn->define_domain($xml) }, "defined persistent domain config"); +} + +# already existing or newly defined, start it up +$dom->create; +my $uuid = $dom->get_uuid_string(); +diag $uuid; +$xml = $dom->get_xml_description(); +diag $xml; +ok($dom->get_id() > 0, "running domain has an ID > 0"); + +my $mac = get_macaddress($xml); +diag $mac; +# wait for guest to boot and request dhcp +sleep(20); +my $ip = get_ip_from_leases($mac); +diag "ip is $ip"; + Index: libvirt-tck/scripts/network/100-ping-still-working.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/100-ping-still-working.t @@ -0,0 +1,71 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/100-ping-still-working.t - verify machines can be pinged from host + +=head1 DESCRIPTION + +The test case validates that it is possible to ping a guest machine from +the host. + +=cut + +use strict; +use warnings; + +use Test::More tests => 4; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# create first domain and start it +diag "Trying domain lookup by name"; +my $dom1; +my $domain_name ="f12nwtest"; + +ok_domain { $dom1 = $conn->get_domain_by_name($domain_name) } "the running domain object"; +my $xml = $dom1->get_xml_description; +diag $xml; +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $mac1 = get_macaddress($xml); +diag $mac1; +my $guestip1 = get_ip_from_leases($mac1); +diag "ip is $guestip1"; + +# check ebtables entry +my $ebtable1 = `/sbin/ebtables -L;/sbin/ebtables -t nat -L`; +diag $ebtable1; +# fixme to include mac adress +ok($ebtable1 =~ "vnet0", "check ebtables entry"); + +# ping guest1 +my $ping1 = `ping -c 10 $guestip1`; +diag $ping1; +ok($ping1 =~ "10 received", "ping $guestip1 test"); + +exit 0; Index: libvirt-tck/scripts/network/210-no-mac-spoofing.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/210-no-mac-spoofing.t @@ -0,0 +1,113 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/210-no-mac-spoofing.t - verify MAC spoofing is prevented + +=head1 DESCRIPTION + +The test case validates that MAC spoofing is prevented + +=cut + +use strict; +use warnings; + +use Test::More tests => 5; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# create first domain and start it +diag "Trying domain lookup by name"; +my $domain_name ="f12nwtest"; +my $dom1; +ok_domain { $dom1 = $conn->get_domain_by_name($domain_name) } "the running domain object"; +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $xml = $dom1->get_xml_description; +diag $xml; + +# check ebtables entry +my $ebtable1 = `/sbin/ebtables -L;/sbin/ebtables -t nat -L`; +diag $ebtable1; +# fixme to include mac adress +ok($ebtable1 =~ "vnet0", "check ebtables entry"); + +# wait for guest to boot +diag "waiting for guests to boot"; +#system("sleep 20"); +diag "done"; + +# ping guest1 first nic +my $mac1 = get_macaddress($xml); +diag "$mac1"; +my $guestip1 = get_ip_from_leases($mac1); +diag "ip is $guestip1"; +my $gateway = "192.168.122.1"; +my $macfalse = "52:54:00:f9:21:22"; +my $ping1 = `ping -c 10 $guestip1`; +diag $ping1; +ok($ping1 =~ "10 received", "ping $guestip1 test"); + +# log into guest +my $ssh = Net::SSH::Perl->new($guestip1); +$ssh->login("root", "foobar"); + +# now bring eth0 down, change MAC and bring it up again +diag "fiddling with mac"; +my $cmdfile = "echo '" . + "/sbin/ifconfig eth0\n". + "/sbin/ifconfig eth0 down\n". + "/sbin/ifconfig eth0 hw ether ${macfalse}\n". + "/sbin/ifconfig eth0 up\n". + "/sbin/ifconfig eth0\n". + "ping -c 10 ${gateway}\n". + "/sbin/ifconfig eth0 down\n". + "/sbin/ifconfig eth0 hw ether ${mac1}\n". + "/sbin/ifconfig eth0 up\n". + "/sbin/ifconfig eth0\n". + "' > /test.sh"; +diag $cmdfile; +my ($stdout, $stderr, $exit) = $ssh->cmd($cmdfile); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("chmod +x /test.sh"); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("/test.sh > /test.log"); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("cat /test.log"); +diag $stdout; +diag $stderr; +diag $exit; +ok($stdout =~ "100% packet loss", "packet loss expected"); + +exit 0; Index: libvirt-tck/scripts/network/230-no-mac-broadcast.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/230-no-mac-broadcast.t @@ -0,0 +1,102 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/230-no-mac-broadcast.t - verify MAC broadcasts are prevented + +=head1 DESCRIPTION + +The test case validates that MAC broadcasts are prevented + +=cut + +use strict; +use warnings; + +use Test::More tests => 4; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# create first domain and start it +diag "Trying domain lookup by name"; +my $dom1; +ok_domain { $dom1 = $conn->get_domain_by_name("f12nwtest") } "the running domain object"; + +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $xml = $dom1->get_xml_description; +diag $xml; +my $mac1 = get_macaddress($xml); +diag "$mac1"; +my $guestip1 = get_ip_from_leases($mac1); +diag "ip is $guestip1"; + +# check ebtables entry +my $ebtable1 = `/sbin/ebtables -L;/sbin/ebtables -t nat -L`; +diag $ebtable1; +# fixme to include mac adress +ok($ebtable1 =~ "vnet0", "check ebtables entry"); + +# prepare tcpdump +diag "prepare tcpdump"; +system("/usr/sbin/tcpdump -v -i virbr0 -n host 255.255.255.255 2> /tmp/tcpdump.log &"); + +# log into guest +my $ssh = Net::SSH::Perl->new($guestip1); +$ssh->login("root", "foobar"); + +# now generate a mac broadcast paket +diag "generate mac broadcast"; +my $cmdfile = "echo '" . + "/bin/ping -c 1 192.168.122.255 -b\n". + "' > /test.sh"; +diag $cmdfile; +my ($stdout, $stderr, $exit) = $ssh->cmd($cmdfile); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("chmod +x /test.sh"); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("/test.sh > /test.log"); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("cat /test.log"); +diag $stdout; +diag $stderr; +diag $exit; + +# now stop tcpdump and verify result +diag "stopping tcpdump"; +system("kill -15 `/sbin/pidof tcpdump`"); +my $tcpdumplog = `cat /tmp/tcpdump.log`; +diag($tcpdumplog); +ok($tcpdumplog =~ "0 packets captured", "tcpdump expected to capture no packets"); + +exit 0; Index: libvirt-tck/scripts/network/240-no-arp-spoofing.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/240-no-arp-spoofing.t @@ -0,0 +1,111 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/240-no-arp-spoofing.t - verify ARP spoofing is prevented + +=head1 DESCRIPTION + +The test case validates that ARP spoofing is prevented + +=cut + +use strict; +use warnings; + +use Test::More tests => 4; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $spoofid = "192.168.122.183"; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# looking up domain +diag "Trying domain lookup by name"; +my $dom1; +my $domain_name ="f12nwtest"; +ok_domain { $dom1 = $conn->get_domain_by_name($domain_name) } "the running domain object"; +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $xml = $dom1->get_xml_description; +diag $xml; +my $mac1 = get_macaddress($xml); +diag "$mac1"; +my $guestip1 = get_ip_from_leases($mac1); +diag "ip is $guestip1"; + +# check ebtables entry +my $ebtable1 = `/sbin/ebtables -L;/sbin/ebtables -t nat -L`; +diag $ebtable1; +# check if mac address is listed +ok($ebtable1 =~ "$guestip1", "check ebtables entry"); + +# prepare tcpdump +diag "prepare tcpdump"; +system("/usr/sbin/tcpdump -v -i virbr0 not ip > /tmp/tcpdump.log &"); + +# log into guest +my $ssh = Net::SSH::Perl->new($guestip1); +$ssh->login("root", "foobar"); + +# now generate a arp spoofing packets +diag "generate arpspoof"; +my $cmdfile = "echo '" . + "/usr/bin/yum -y install dsniff\n". + "/usr/sbin/arpspoof ${spoofid} &\n". + "/bin/sleep 10\n". + "kill -15 `/sbin/pidof arpspoof`\n". + "' > /test.sh"; +diag "content of cmdfile:"; +diag $cmdfile; +diag "creating cmdfile"; +my ($stdout, $stderr, $exit) = $ssh->cmd($cmdfile); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("chmod +x /test.sh"); +diag $stdout; +diag $stderr; +diag $exit; +diag "excuting cmdfile"; +($stdout, $stderr, $exit) = $ssh->cmd("/test.sh > /test.log"); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("echo test.log\ncat /test.log"); +diag $stdout; +diag $stderr; +diag $exit; + +# now stop tcpdump and verify result +diag "stopping tcpdump"; +system("kill -15 `/sbin/pidof tcpdump`"); +diag "tcpdump.log:"; +my $tcpdumplog = `cat /tmp/tcpdump.log`; +diag($tcpdumplog); +ok($tcpdumplog !~ "${spoofid} is-at", "tcpdump expected to capture no arp reply packets"); + +exit 0; Index: libvirt-tck/scripts/network/220-no-ip-spoofing.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/220-no-ip-spoofing.t @@ -0,0 +1,101 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/220-no-ip-spoofing.t - verify IP spoofing is prevented + +=head1 DESCRIPTION + +The test case validates that IP spoofing is prevented + +=cut + +use strict; +use warnings; + +use Test::More tests => 4; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; +use XML::LibXML; + +require 'scripts/network/common_functions.pl'; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# looking up domain +diag "Trying domain lookup by name"; +my $dom1; +my $domain_name ="f12nwtest"; + +ok_domain { $dom1 = $conn->get_domain_by_name($domain_name) } "the running domain object"; +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $xml = $dom1->get_xml_description; +diag $xml; +my $mac1 = get_macaddress($xml); +diag "$mac1"; +my $guestip1 = get_ip_from_leases($mac1); +diag "ip is $guestip1"; + +# check ebtables entry +my $ebtable1 = `/sbin/ebtables -L;/sbin/ebtables -t nat -L`; +diag $ebtable1; +# check if IP address is listed +ok($ebtable1 =~ "$guestip1", "check ebtables entry"); + +# log into guest +my $ssh = Net::SSH::Perl->new($guestip1); +$ssh->login("root", "foobar"); + +# now bring eth0 down, change IP and bring it up again +diag "preparing ip spoof"; +my $cmdfile = "echo '" . + "/bin/sleep 1\n". + "/sbin/ifconfig eth0\n". + "/sbin/ifconfig eth0 down\n". + "/sbin/ifconfig eth0 192.168.122.183 netmask 255.255.255.0 up\n". + "/sbin/ifconfig eth0\n". + "/bin/sleep 1\n". + "/bin/ping -c 1 192.168.122.1\n". + "/sbin/ifconfig eth0 down\n". + "/sbin/ifconfig eth0 ${guestip1} netmask 255.255.255.0 up\n". + "/sbin/ifconfig eth0 \n". + "/bin/sleep 1\n". + "' > /test.sh"; +diag $cmdfile; +my ($stdout, $stderr, $exit) = $ssh->cmd($cmdfile); +diag $stdout; +diag $stderr; +diag $exit; +($stdout, $stderr, $exit) = $ssh->cmd("chmod +x /test.sh"); +diag $stdout; +diag $stderr; +diag $exit; +diag "running ip spoof"; +($stdout, $stderr, $exit) = $ssh->cmd("/test.sh"); +diag $stdout; +diag $stderr; +diag $exit; +diag "checking result"; +ok($stdout =~ "100% packet loss", "packet loss expected"); + +exit 0; Index: libvirt-tck/scripts/network/999-shutdown-image.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/999-shutdown-image.t @@ -0,0 +1,59 @@ +# -*- perl -*- +# +# Copyright (C) 2010 IBM Corp. +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +network/240-no-arp-spoofing.t - verify ARP spoofing is prevented + +=head1 DESCRIPTION + +The test case validates that ARP spoofing is prevented + +=cut + +use strict; +use warnings; + +use Test::More tests => 2; + +use Sys::Virt::TCK; +use Test::Exception; +use Net::SSH::Perl; + + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { + $tck->cleanup if $tck; +} + +# find domain +my $domain_name = "f12nwtest"; +diag "Trying domain lookup by name"; +my $dom; +ok_domain { $dom = $conn->get_domain_by_name($domain_name) } "the running domain object"; +ok($dom->get_id() > 0, "running domain has an ID > 0"); + +# cleanup guest +diag "cleaning up"; +$dom->shutdown(); + while($dom->is_active()) { + sleep(1); + diag ".. waiting for virtual machine ${domain_name} to shutdown.. "; + } +#$dom->undefine(); + +exit 0; Index: libvirt-tck/scripts/network/common_functions.pl =================================================================== --- /dev/null +++ libvirt-tck/scripts/network/common_functions.pl @@ -0,0 +1,35 @@ +use utf8; +#no utf8; + +sub get_macaddress { + my $xmldesc = shift; + + my $mac; + my $parser = XML::LibXML->new(); + + my $doc = $parser->parse_string($xmldesc); + + my $rootel = $doc -> getDocumentElement(); + + my @devices = $rootel->getChildrenByTagName("devices"); + foreach my $device(@devices) { + my @interfaces = $device->getChildrenByTagName("interface"); + foreach my $interface(@interfaces) { + my @targets = $interface->getChildrenByTagName("mac"); + foreach my $target(@targets) { + $mac = $target->getAttribute("address"); + } + } + } + utf8::decode($mac); + return $mac; +} + +sub get_ip_from_leases{ + my $mac = shift; + my $tmp = `grep $mac /var/lib/dnsmasq/dnsmasq.leases`; + my @fields = split(/ /, $tmp); + my $ip = $fields[2]; + return $ip; +} +1; -- Best regards, Gerhard Stenzel, ----------------------------------------------------------------------------------------------------------------------------------- IBM Deutschland Research & Development GmbH Vorsitzender des Aufsichtsrats: Martin Jetter Geschäftsführung: Dirk Wittkopp Sitz der Gesellschaft: Böblingen Registergericht: Amtsgericht Stuttgart, HRB 243294

2 2

[libvirt] [PATCH] Fix security context references in DAC code
by spencer＠beyondabstraction.net 23 Apr '10

23 Apr '10

* The error messages coming from qemu's DAC support contain strings from the original SELinux security driver code. This just removes references to "security context" and other SELinux-isms from the DAC code. Signed-off-by: Spencer Shimko <sshimko(a)tresys.com> --- src/qemu/qemu_security_dac.c | 18 ++++++------------ 1 files changed, 6 insertions(+), 12 deletions(-) diff --git a/src/qemu/qemu_security_dac.c b/src/qemu/qemu_security_dac.c index 1883fbe..e408dbf 100644 --- a/src/qemu/qemu_security_dac.c +++ b/src/qemu/qemu_security_dac.c @@ -37,7 +37,7 @@ void qemuSecurityDACSetDriver(struct qemud_driver *newdriver) static int qemuSecurityDACSetOwnership(const char *path, int uid, int gid) { - VIR_INFO("Setting DAC context on '%s' to '%d:%d'", path, uid, gid); + VIR_INFO("Setting DAC user and group on '%s' to '%d:%d'", path, uid, gid); if (chown(path, uid, gid) < 0) { struct stat sb; @@ -51,24 +51,18 @@ qemuSecurityDACSetOwnership(const char *path, int uid, int gid) } } - /* if the error complaint is related to an image hosted on - * an nfs mount, or a usbfs/sysfs filesystem not supporting - * labelling, then just ignore it & hope for the best. - * The user hopefully set one of the necessary qemuSecurityDAC - * virt_use_{nfs,usb,pci} boolean tunables to allow it... - */ if (chown_errno == EOPNOTSUPP) { - VIR_INFO("Setting security context '%d:%d' on '%s' not supported by filesystem", + VIR_INFO("Setting user and group to '%d:%d' on '%s' not supported by filesystem", uid, gid, path); } else if (chown_errno == EPERM) { - VIR_INFO("Setting security context '%d:%d' on '%s' not permitted", + VIR_INFO("Setting user and group to '%d:%d' on '%s' not permitted", uid, gid, path); } else if (chown_errno == EROFS) { - VIR_INFO("Setting security context '%d:%d' on '%s' not possible on readonly filesystem", + VIR_INFO("Setting user and group to '%d:%d' on '%s' not possible on readonly filesystem", uid, gid, path); } else { virReportSystemError(chown_errno, - _("unable to set security context '%d:%d' on '%s'"), + _("unable to set user and group to '%d:%d' on '%s'"), uid, gid, path); return -1; } @@ -84,7 +78,7 @@ qemuSecurityDACRestoreSecurityFileLabel(const char *path) int err; char *newpath = NULL; - VIR_INFO("Restoring DAC context on '%s'", path); + VIR_INFO("Restoring DAC user and group on '%s'", path); if ((err = virFileResolveLink(path, &newpath)) < 0) { virReportSystemError(err, -- 1.6.6.1

2 2

[libvirt] [PATCH] addrToString: give better error message
by Eric Blake 22 Apr '10

22 Apr '10

The user probably doesn't care what the gai error numbers are, as much as what the failed conversion IP address was. * src/remote/remote_driver.c (addrToString): Mention which address could not be converted. * daemon/remote.c (addrToString): Likewise. --- In response to https://www.redhat.com/archives/libvir-list/2010-April/msg00219.html daemon/remote.c | 24 +++++++++++++++++------- src/remote/remote_driver.c | 22 ++++++++++++++++------ 2 files changed, 33 insertions(+), 13 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index 149176f..093e9c6 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -1,7 +1,7 @@ /* * remote.c: handlers for RPC method calls * - * Copyright (C) 2007, 2008, 2009 Red Hat, Inc. + * Copyright (C) 2007-2010 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -41,6 +41,7 @@ #include <string.h> #include <errno.h> #include <fnmatch.h> +#include <arpa/inet.h> #include "virterror_internal.h" #if HAVE_POLKIT0 @@ -3169,21 +3170,30 @@ remoteDispatchAuthList (struct qemud_server *server, #if HAVE_SASL /* - * NB, keep in sync with similar method in src/remote_internal.c + * NB, keep in sync with similar method in src/remote/remote_driver.c */ static char *addrToString(remote_error *rerr, - struct sockaddr_storage *sa, socklen_t salen) { + struct sockaddr_storage *ss, socklen_t salen) { char host[1024], port[20]; char *addr; int err; + struct sockaddr *sa = (struct sockaddr *)ss; - if ((err = getnameinfo((struct sockaddr *)sa, salen, + if ((err = getnameinfo(sa, salen, host, sizeof(host), port, sizeof(port), NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { - remoteDispatchFormatError(rerr, - _("Cannot resolve address %d: %s"), - err, gai_strerror(err)); + char ip[INET6_ADDRSTRLEN]; + + if (inet_ntop(sa->sa_family, sa->sa_data, ip, sizeof ip)) { + remoteDispatchFormatError(rerr, + _("Cannot resolve address %s: %s"), + ip, gai_strerror(err)); + } else { + remoteDispatchFormatError(rerr, + _("Cannot resolve address: %s"), + gai_strerror(err)); + } return NULL; } diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 44d8c26..752964f 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -32,6 +32,7 @@ #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> +#include <arpa/inet.h> /* Windows socket compatibility functions. */ #include <errno.h> @@ -6570,21 +6571,30 @@ remoteAuthenticate (virConnectPtr conn, struct private_data *priv, #if HAVE_SASL /* - * NB, keep in sync with similar method in remote/remote.c + * NB, keep in sync with similar method in daemon/remote.c */ -static char *addrToString(struct sockaddr_storage *sa, socklen_t salen) +static char *addrToString(struct sockaddr_storage *ss, socklen_t salen) { char host[NI_MAXHOST], port[NI_MAXSERV]; char *addr; int err; + struct sockaddr *sa = (struct sockaddr *)ss; - if ((err = getnameinfo((struct sockaddr *)sa, salen, + if ((err = getnameinfo(sa, salen, host, sizeof(host), port, sizeof(port), NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { - remoteError(VIR_ERR_UNKNOWN_HOST, - _("Cannot resolve address %d: %s"), - err, gai_strerror(err)); + char ip[INET6_ADDRSTRLEN]; + + if (inet_ntop(sa->sa_family, sa->sa_data, ip, sizeof ip)) { + remoteError(VIR_ERR_UNKNOWN_HOST, + _("Cannot resolve address %s: %s"), + ip, gai_strerror(err)); + } else { + remoteError(VIR_ERR_UNKNOWN_HOST, + _("Cannot resolve address: %s"), + gai_strerror(err)); + } return NULL; } -- 1.6.6.1

2 5

[libvirt] [PATCH V2] nwfilter: lock interface by its index
by Stefan Berger 22 Apr '10

22 Apr '10

Changes from V1 to V2: - using INT_BUFSIZE_BOUND() to determine the length of the buffersize for printing and integer into - not explicitly initializing static var threadsTerminate to false anymore, since that's done automatically - there are 2 calls in the virNWFilterLockIface function that can fail due to OOM error; in case that happens, loop until the memory is available to avoid a failing lock. The call initializing the mutex should never fail with pthreads, otherwise we'd have a compile-time problem (wrong parameters for recursive lock) and may fail due to OOM error on win-32, so I am also looping there. The interface name may cause a failure, but callers should be certain at this point that the string is suitable. I am adding ATTRIBUTE_RETURN_CHECK to force the caller to check for failure and adapting the code where the function is called. Since the name of an interface can be the same between stops and starts of different VMs I have to switch the IP address learning thread to use the index of the interface to determine whether an interface is still available or not - in the case of macvtap the thread needs to listen for traffic on the physical interface, thus having to time out periodically to check whether the VM's macvtap device is still there as an indication that the VM is still alive. Previously the following sequence of 2 VMs with macvtap device virsh start testvm1; virsh destroy testvm1 ; virsh start testvm2 would not terminate the thread upon testvm1's destroy since the name of the interface on the host could be the same (i.e, macvtap0) on testvm1 and testvm2, thus it was easily race-able. The thread would then determine the IP address parameter for testvm2 but apply the rule set for testvm1. :-( I am also introducing a lock for the interface (by name) that the thread must hold while it listens for the traffic and releases when it terminates upon VM termination or 0.5 second thereafter. Thus, the new thread for a newly started VM with the same interface name will not start while the old one still holds the lock. The only other code that I see that also needs to grab the lock to serialize operation is the one that tears down the firewall that were established on behalf of an interface. I am moving the code applying the 'basic' firewall rules during the IP address learning phase inside the thread but won't start the thread unless it is ensured that the firewall driver has the ability to apply the 'basic' firewall rules. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/nwfilter/nwfilter_gentech_driver.c | 24 +++ src/nwfilter/nwfilter_gentech_driver.h | 2 src/nwfilter/nwfilter_learnipaddr.c | 239 +++++++++++++++++++++++++++------ src/nwfilter/nwfilter_learnipaddr.h | 7 4 files changed, 229 insertions(+), 43 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -36,6 +36,7 @@ #include <netinet/ip.h> #include <netinet/udp.h> #include <net/if_arp.h> +#include <intprops.h> #include "internal.h" @@ -54,6 +55,11 @@ #define VIR_FROM_THIS VIR_FROM_NWFILTER +#define IFINDEX2STR(VARNAME, ifindex) \ + char VARNAME[INT_BUFSIZE_BOUND(ifindex)]; \ + snprintf(VARNAME, sizeof(VARNAME), "%d", ifindex); + +#define PKT_TIMEOUT_MS 500 /* ms */ /* structure of an ARP request/reply message */ struct f_arphdr { @@ -109,6 +115,96 @@ static virHashTablePtr pendingLearnReq; static virMutex ipAddressMapLock; static virNWFilterHashTablePtr ipAddressMap; +static virMutex ifaceMapLock; +static virHashTablePtr ifaceLockMap; + +typedef struct _virNWFilterIfaceLock virNWFilterIfaceLock; +typedef virNWFilterIfaceLock *virNWFilterIfaceLockPtr; +struct _virNWFilterIfaceLock { + char ifname[IF_NAMESIZE]; + virMutex lock; + int refctr; +}; + + +static bool threadsTerminate = false; + + +int +virNWFilterLockIface(const char *ifname) { + virNWFilterIfaceLockPtr ifaceLock; + + virMutexLock(&ifaceMapLock); + + ifaceLock = virHashLookup(ifaceLockMap, ifname); + if (!ifaceLock) { + while (VIR_ALLOC(ifaceLock) < 0) { + /* wait for memory */ + usleep(50); + } + + if (virMutexInitRecursive(&ifaceLock->lock)) { + /* win32 - wait for memory */ + usleep(50); + } + + if (virStrcpyStatic(ifaceLock->ifname, ifname) == NULL) { + VIR_FREE(ifaceLock); + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("%s: interface name %s does not fit into " + "buffer "), + __FUNCTION__, ifaceLock->ifname); + goto err_exit; + } + + while (virHashAddEntry(ifaceLockMap, ifname, ifaceLock)) { + /* wait for memory */ + usleep(50); + } + + ifaceLock->refctr = 0; + } + + ifaceLock->refctr++; + + virMutexUnlock(&ifaceMapLock); + + virMutexLock(&ifaceLock->lock); + + return 0; + + err_exit: + virMutexUnlock(&ifaceMapLock); + + return 1; +} + + +static void +freeIfaceLock(void *payload, const char *name ATTRIBUTE_UNUSED) { + VIR_FREE(payload); +} + + +void +virNWFilterUnlockIface(const char *ifname) { + virNWFilterIfaceLockPtr ifaceLock; + + virMutexLock(&ifaceMapLock); + + ifaceLock = virHashLookup(ifaceLockMap, ifname); + + if (ifaceLock) { + virMutexUnlock(&ifaceLock->lock); + + ifaceLock->refctr--; + if (ifaceLock->refctr == 0) + virHashRemoveEntry(ifaceLockMap, ifname, freeIfaceLock); + } + + virMutexUnlock(&ifaceMapLock); +} + static void virNWFilterIPAddrLearnReqFree(virNWFilterIPAddrLearnReqPtr req) { @@ -127,10 +223,12 @@ virNWFilterIPAddrLearnReqFree(virNWFilte static int virNWFilterRegisterLearnReq(virNWFilterIPAddrLearnReqPtr req) { int res = -1; + IFINDEX2STR(ifindex_str, req->ifindex); + virMutexLock(&pendingLearnReqLock); - if (!virHashLookup(pendingLearnReq, req->ifname)) - res = virHashAddEntry(pendingLearnReq, req->ifname, req); + if (!virHashLookup(pendingLearnReq, ifindex_str)) + res = virHashAddEntry(pendingLearnReq, ifindex_str, req); virMutexUnlock(&pendingLearnReqLock); @@ -141,12 +239,13 @@ virNWFilterRegisterLearnReq(virNWFilterI virNWFilterIPAddrLearnReqPtr -virNWFilterLookupLearnReq(const char *ifname) { +virNWFilterLookupLearnReq(int ifindex) { void *res; + IFINDEX2STR(ifindex_str, ifindex); virMutexLock(&pendingLearnReqLock); - res = virHashLookup(pendingLearnReq, ifname); + res = virHashLookup(pendingLearnReq, ifindex_str); virMutexUnlock(&pendingLearnReqLock); @@ -163,15 +262,16 @@ freeLearnReqEntry(void *payload, const c #ifdef HAVE_LIBPCAP static virNWFilterIPAddrLearnReqPtr -virNWFilterDeregisterLearnReq(const char *ifname) { +virNWFilterDeregisterLearnReq(int ifindex) { virNWFilterIPAddrLearnReqPtr res; + IFINDEX2STR(ifindex_str, ifindex); virMutexLock(&pendingLearnReqLock); - res = virHashLookup(pendingLearnReq, ifname); + res = virHashLookup(pendingLearnReq, ifindex_str); if (res) - virHashRemoveEntry(pendingLearnReq, ifname, NULL); + virHashRemoveEntry(pendingLearnReq, ifindex_str, NULL); virMutexUnlock(&pendingLearnReqLock); @@ -274,7 +374,7 @@ static void * learnIPAddressThread(void *arg) { char errbuf[PCAP_ERRBUF_SIZE] = {0}; - pcap_t *handle; + pcap_t *handle = NULL; struct bpf_program fp; struct pcap_pkthdr header; const u_char *packet; @@ -285,19 +385,27 @@ learnIPAddressThread(void *arg) unsigned int ethHdrSize; char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev : req->ifname; - int to_ms = (strlen(req->linkdev) != 0) ? 1000 - : 0; int dhcp_opts_len; char macaddr[VIR_MAC_STRING_BUFLEN]; virBuffer buf = VIR_BUFFER_INITIALIZER; - char *filter= NULL; + char *filter = NULL; uint16_t etherType; + bool showError = true; enum howDetect howDetected = 0; virNWFilterTechDriverPtr techdriver = req->techdriver; + if (virNWFilterLockIface(req->ifname)) + goto err_no_lock; + req->status = 0; - handle = pcap_open_live(listen_if, BUFSIZ, 0, to_ms, errbuf); + /* anything change to the VM's interface -- check at least once */ + if (ifaceCheck(false, req->ifname, NULL, req->ifindex)) { + req->status = ENODEV; + goto done; + } + + handle = pcap_open_live(listen_if, BUFSIZ, 0, PKT_TIMEOUT_MS, errbuf); if (handle == NULL) { VIR_DEBUG("Couldn't open device %s: %s\n", listen_if, errbuf); @@ -309,11 +417,22 @@ learnIPAddressThread(void *arg) switch (req->howDetect) { case DETECT_DHCP: + if (techdriver->applyDHCPOnlyRules(req->ifname, + req->macaddr, + NULL)) { + req->status = EINVAL; + goto done; + } virBufferVSprintf(&buf, " ether dst %s" " and src port 67 and dst port 68", macaddr); break; default: + if (techdriver->applyBasicRules(req->ifname, + req->macaddr)) { + req->status = EINVAL; + goto done; + } virBufferVSprintf(&buf, "ether host %s", macaddr); } @@ -324,25 +443,36 @@ learnIPAddressThread(void *arg) filter = virBufferContentAndReset(&buf); - if (pcap_compile(handle, &fp, filter, 1, 0) != 0 || - pcap_setfilter(handle, &fp) != 0) { - VIR_DEBUG("Couldn't compile or set filter '%s'.\n", filter); + if (pcap_compile(handle, &fp, filter, 1, 0) != 0) { + VIR_DEBUG("Couldn't compile filter '%s'.\n", filter); req->status = EINVAL; goto done; } + if (pcap_setfilter(handle, &fp) != 0) { + VIR_DEBUG("Couldn't set filter '%s'.\n", filter); + req->status = EINVAL; + pcap_freecode(&fp); + goto done; + } + + pcap_freecode(&fp); + while (req->status == 0 && vmaddr == 0) { packet = pcap_next(handle, &header); if (!packet) { - if (to_ms == 0) { - /* assuming IF disappeared */ - req->status = ENODEV; + + if (threadsTerminate) { + req->status = ECANCELED; + showError = false; break; } - /* listening on linkdev, check whether VM's dev is still there */ - if (ifaceCheck(false, req->ifname, req->macaddr, -1)) { + + /* check whether VM's dev is still there */ + if (ifaceCheck(false, req->ifname, NULL, req->ifindex)) { req->status = ENODEV; + showError = false; break; } continue; @@ -470,6 +600,7 @@ learnIPAddressThread(void *arg) ret = virNWFilterInstantiateFilterLate(NULL, req->ifname, + req->ifindex, req->linkdev, req->nettype, req->macaddr, @@ -478,13 +609,23 @@ learnIPAddressThread(void *arg) req->driver); VIR_DEBUG("Result from applying firewall rules on " "%s with IP addr %s : %d\n", req->ifname, inetaddr, ret); + } else { + if (showError) + virReportSystemError(req->status, + "%s encountered an error. Shutting down " + "interface %s", + __FUNCTION__, req->ifname); + ifaceDown(req->ifname); } memset(&req->thread, 0x0, sizeof(req->thread)); VIR_DEBUG("pcap thread terminating for interface %s\n",req->ifname); - virNWFilterDeregisterLearnReq(req->ifname); + virNWFilterUnlockIface(req->ifname); + + err_no_lock: + virNWFilterDeregisterLearnReq(req->ifindex); virNWFilterIPAddrLearnReqFree(req); @@ -496,6 +637,7 @@ learnIPAddressThread(void *arg) * virNWFilterLearnIPAddress * @techdriver : driver to build firewalls * @ifname: the name of the interface + * @ifindex: the index of the interface * @linkdev : the name of the link device; currently only used in case of a * macvtap device * @nettype : the type of interface @@ -516,6 +658,7 @@ learnIPAddressThread(void *arg) int virNWFilterLearnIPAddress(virNWFilterTechDriverPtr techdriver, const char *ifname, + int ifindex, const char *linkdev, enum virDomainNetType nettype, const unsigned char *macaddr, @@ -530,6 +673,14 @@ virNWFilterLearnIPAddress(virNWFilterTec if (howDetect == 0) return 1; + if ( !techdriver->canApplyBasicRules()) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("IP parameter must be provided since " + "snooping the IP address does not work " + "possibly due to missing tools")); + return 1; + } + if (VIR_ALLOC(req) < 0) { virReportOOMError(); goto err_no_req; @@ -538,7 +689,7 @@ virNWFilterLearnIPAddress(virNWFilterTec ht = virNWFilterHashTableCreate(0); if (ht == NULL) { virReportOOMError(); - goto err_no_ht; + goto err_free_req; } if (virNWFilterHashTablePutAll(filterparams, ht)) @@ -565,6 +716,8 @@ virNWFilterLearnIPAddress(virNWFilterTec goto err_free_ht; } } + + req->ifindex = ifindex; req->nettype = nettype; memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); req->driver = driver; @@ -576,35 +729,21 @@ virNWFilterLearnIPAddress(virNWFilterTec rc = virNWFilterRegisterLearnReq(req); if (rc) - goto err_free_ht; - - switch (howDetect) { - case DETECT_DHCP: - if (techdriver->applyDHCPOnlyRules(ifname, - macaddr, - NULL)) - goto err_free_ht; - break; - default: - if (techdriver->applyBasicRules(ifname, - macaddr)) - goto err_free_ht; - } - + goto err_free_req; if (pthread_create(&req->thread, NULL, learnIPAddressThread, req) != 0) - goto err_remove_rules; + goto err_dereg_req; return 0; -err_remove_rules: - techdriver->removeBasicRules(ifname); +err_dereg_req: + virNWFilterDeregisterLearnReq(ifindex); err_free_ht: virNWFilterHashTableFree(ht); -err_no_ht: +err_free_req: virNWFilterIPAddrLearnReqFree(req); err_no_req: return 1; @@ -615,6 +754,7 @@ err_no_req: int virNWFilterLearnIPAddress(virNWFilterTechDriverPtr techdriver ATTRIBUTE_UNUSED, const char *ifname ATTRIBUTE_UNUSED, + int ifindex ATTRIBUTE_UNUSED, const char *linkdev ATTRIBUTE_UNUSED, enum virDomainNetType nettype ATTRIBUTE_UNUSED, const unsigned char *macaddr ATTRIBUTE_UNUSED, @@ -637,6 +777,12 @@ virNWFilterLearnIPAddress(virNWFilterTec */ int virNWFilterLearnInit(void) { + + if (pendingLearnReq) + return 0; + + threadsTerminate = false; + pendingLearnReq = virHashCreate(0); if (!pendingLearnReq) { virReportOOMError(); @@ -660,6 +806,18 @@ virNWFilterLearnInit(void) { return 1; } + ifaceLockMap = virHashCreate(0); + if (!ifaceLockMap) { + virReportOOMError(); + virNWFilterLearnShutdown(); + return 1; + } + + if (virMutexInit(&ifaceMapLock)) { + virNWFilterLearnShutdown(); + return 1; + } + return 0; } @@ -670,9 +828,18 @@ virNWFilterLearnInit(void) { */ void virNWFilterLearnShutdown(void) { + + threadsTerminate = true; + + while (virHashSize(pendingLearnReq) != 0) + usleep((PKT_TIMEOUT_MS * 1000) / 3); + virHashFree(pendingLearnReq, freeLearnReqEntry); pendingLearnReq = NULL; virNWFilterHashTableFree(ipAddressMap); ipAddressMap = NULL; + + virHashFree(ifaceLockMap, freeIfaceLock); + ifaceLockMap = NULL; } Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.h +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -35,6 +35,7 @@ typedef virNWFilterIPAddrLearnReq *virNW struct _virNWFilterIPAddrLearnReq { virNWFilterTechDriverPtr techdriver; char ifname[IF_NAMESIZE]; + int ifindex; char linkdev[IF_NAMESIZE]; enum virDomainNetType nettype; unsigned char macaddr[VIR_MAC_BUFLEN]; @@ -49,6 +50,7 @@ struct _virNWFilterIPAddrLearnReq { int virNWFilterLearnIPAddress(virNWFilterTechDriverPtr techdriver, const char *ifname, + int ifindex, const char *linkdev, enum virDomainNetType nettype, const unsigned char *macaddr, @@ -57,12 +59,15 @@ int virNWFilterLearnIPAddress(virNWFilte virNWFilterDriverStatePtr driver, enum howDetect howDetect); -virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(const char *ifname); +virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(int ifindex); void virNWFilterDelIpAddrForIfname(const char *ifname); const char *virNWFilterGetIpAddrForIfname(const char *ifname); +int virNWFilterLockIface(const char *ifname) ATTRIBUTE_RETURN_CHECK; +void virNWFilterUnlockIface(const char *ifname); + int virNWFilterLearnInit(void); void virNWFilterLearnShutdown(void); Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -557,6 +557,7 @@ virNWFilterInstantiate(virConnectPtr con enum virDomainNetType nettype, virNWFilterDefPtr filter, const char *ifname, + int ifindex, const char *linkdev, virNWFilterHashTablePtr vars, enum instCase useNewFilter, int *foundNewFilter, @@ -592,9 +593,10 @@ virNWFilterInstantiate(virConnectPtr con if (virHashSize(missing_vars->hashTable) == 1) { if (virHashLookup(missing_vars->hashTable, NWFILTER_STD_VAR_IP) != NULL) { - if (virNWFilterLookupLearnReq(ifname) == NULL) { + if (virNWFilterLookupLearnReq(ifindex) == NULL) { rc = virNWFilterLearnIPAddress(techdriver, ifname, + ifindex, linkdev, nettype, macaddr, filter->name, @@ -639,11 +641,22 @@ virNWFilterInstantiate(virConnectPtr con if (rc) goto err_exit; + if (virNWFilterLockIface(ifname)) + goto err_exit; + rc = techdriver->applyNewRules(conn, ifname, nptrs, ptrs); if (teardownOld && rc == 0) techdriver->tearOldRules(conn, ifname); + if (rc == 0 && ifaceCheck(false, ifname, NULL, ifindex)) { + /* interface changed/disppeared */ + techdriver->allTeardown(ifname); + rc = 1; + } + + virNWFilterUnlockIface(ifname); + VIR_FREE(ptrs); } @@ -666,6 +679,7 @@ static int __virNWFilterInstantiateFilter(virConnectPtr conn, bool teardownOld, const char *ifname, + int ifindex, const char *linkdev, enum virDomainNetType nettype, const unsigned char *macaddr, @@ -767,6 +781,7 @@ __virNWFilterInstantiateFilter(virConnec nettype, filter, ifname, + ifindex, linkdev, vars, useNewFilter, &foundNewFilter, @@ -798,9 +813,15 @@ _virNWFilterInstantiateFilter(virConnect const char *linkdev = (net->type == VIR_DOMAIN_NET_TYPE_DIRECT) ? net->data.direct.linkdev : NULL; + int ifindex; + + if (ifaceGetIndex(true, net->ifname, &ifindex)) + return 1; + return __virNWFilterInstantiateFilter(conn, teardownOld, net->ifname, + ifindex, linkdev, net->type, net->mac, @@ -814,6 +835,7 @@ _virNWFilterInstantiateFilter(virConnect int virNWFilterInstantiateFilterLate(virConnectPtr conn, const char *ifname, + int ifindex, const char *linkdev, enum virDomainNetType nettype, const unsigned char *macaddr, @@ -825,6 +847,7 @@ virNWFilterInstantiateFilterLate(virConn rc = __virNWFilterInstantiateFilter(conn, 1, ifname, + ifindex, linkdev, nettype, macaddr, Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -49,6 +49,7 @@ int virNWFilterTearOldFilter(virConnectP int virNWFilterInstantiateFilterLate(virConnectPtr conn, const char *ifname, + int ifindex, const char *linkdev, enum virDomainNetType nettype, const unsigned char *macaddr, @@ -77,6 +78,7 @@ virNWFilterTearNWFilter(virDomainNetDefP static inline void virNWFilterTearVMNWFilters(virDomainObjPtr vm) { int i; + for (i = 0; i < vm->def->nnets; i++) virNWFilterTearNWFilter(vm->def->nets[i]); }

2 2

[libvirt] [PATCH] Fix locking in qemudDomainCoreDump
by y＠orkuz.home 22 Apr '10

22 Apr '10

From: Jiri Denemark <jdenemar(a)redhat.com> The hang fix in d376b7d63ec1ef24ba4c812d58b9a414ddb561f8 was incomplete since it left quite a few {Enter,Exit}Monitor calls which require driver to be unlocked. Since the driver is locked throughout the whole function, {Enter,Exit}MonitorWithDriver need to be used instead to ensure driver is not locked when issuing monitor commands. --- src/qemu/qemu_driver.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 4afed2f..0a0d9bc 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5165,18 +5165,18 @@ static int qemudDomainCoreDump(virDomainPtr dom, /* Pause domain for non-live dump */ if (!(flags & VIR_DUMP_LIVE) && vm->state == VIR_DOMAIN_RUNNING) { - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStopCPUs(priv->mon) < 0) { - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); goto endjob; } - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); paused = 1; } - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); ret = qemuMonitorMigrateToCommand(priv->mon, 1, args, path); - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); if (ret < 0) goto endjob; @@ -5205,13 +5205,13 @@ endjob: will support synchronous operations so we always get here after the migration is complete. */ else if (resume && paused) { - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStartCPUs(priv->mon, dom->conn) < 0) { if (virGetLastError() == NULL) qemuReportError(VIR_ERR_OPERATION_FAILED, "%s", _("resuming after dump failed")); } - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); } if (qemuDomainObjEndJob(vm) == 0) -- 1.7.0.4

3 2

[libvirt] [PATCH] Poll for migration end every 50ms instead of 50us
by Jiri Denemark 22 Apr '10

22 Apr '10

The comment in qemuDomainWaitForMigrationComplete says we are polling every 50ms but the code sleeps only for 50us. This was already discussed during review but apparently forgotten when the series was pushed. --- src/qemu/qemu_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 89cd291..4afed2f 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -4524,7 +4524,7 @@ qemuDomainWaitForMigrationComplete(struct qemud_driver *driver, virDomainObjPtr while (priv->jobInfo.type == VIR_DOMAIN_JOB_UNBOUNDED) { /* Poll every 50ms for progress & to allow cancellation */ - struct timespec ts = { .tv_sec = 0, .tv_nsec = 50 * 1000ull }; + struct timespec ts = { .tv_sec = 0, .tv_nsec = 50 * 1000 * 1000ull }; struct timeval now; int rc; -- 1.7.0.4

2 2

[libvirt] [PATCH v2 0/7] CPU selection fixes and tests
by Jiri Denemark 22 Apr '10

22 Apr '10

In this second version of the patchset, patches were reordered and a comment for format expected by qemudParseX86Models() was modified as suggested by Eric. In addition to these changes, qemu tests were fixed to pass on RHEL. Jirka Jiri Denemark (7): Deal with CPU models in [] Move MIN macro to util.h so that others can use it Support removing features when converting data to CPU Use configured CPU model if possible Fake host CPU for qemu tests Support for faking emulator in qemuxml2argv tests Tests for CPU selection in qemu driver src/cpu/cpu.c | 8 +- src/cpu/cpu.h | 6 +- src/cpu/cpu_x86.c | 82 +++++++++++++++----- src/qemu/qemu_conf.c | 39 ++++++++-- src/util/util.c | 4 - src/util/util.h | 4 + tests/qemuxml2argvdata/qemu.sh | 64 +++++++++++++++ .../qemuxml2argvdata/qemuxml2argv-cpu-exact1.args | 1 + tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.xml | 28 +++++++ .../qemuxml2argvdata/qemuxml2argv-cpu-exact2.args | 1 + tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.xml | 35 ++++++++ .../qemuxml2argv-cpu-minimum1.args | 1 + .../qemuxml2argvdata/qemuxml2argv-cpu-minimum1.xml | 21 +++++ .../qemuxml2argv-cpu-minimum2.args | 1 + .../qemuxml2argvdata/qemuxml2argv-cpu-minimum2.xml | 25 ++++++ .../qemuxml2argvdata/qemuxml2argv-cpu-strict1.args | 1 + .../qemuxml2argvdata/qemuxml2argv-cpu-strict1.xml | 38 +++++++++ .../qemuxml2argv-cpu-topology1.args | 1 + .../qemuxml2argv-cpu-topology1.xml | 21 +++++ .../qemuxml2argv-cpu-topology2.args | 1 + .../qemuxml2argv-cpu-topology2.xml | 22 +++++ .../qemuxml2argv-cpu-topology3.args | 1 + .../qemuxml2argv-cpu-topology3.xml | 21 +++++ tests/qemuxml2argvtest.c | 27 +++++++ tests/testutilsqemu.c | 30 +++++++- 25 files changed, 444 insertions(+), 39 deletions(-) create mode 100755 tests/qemuxml2argvdata/qemu.sh create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-exact1.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-exact2.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum1.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-minimum2.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-strict1.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology1.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology1.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology2.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology2.xml create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology3.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-cpu-topology3.xml

2 18

[libvirt] [PATCH] Fix locking in qemudDomainCoreDump
by Jiri Denemark 22 Apr '10

22 Apr '10

The hang fix in d376b7d63ec1ef24ba4c812d58b9a414ddb561f8 was incomplete since it left quite a few {Enter,Exit}Monitor calls which require driver to be unlocked. Since the driver is locked throughout the whole function, {Enter,Exit}MonitorWithDriver need to be used instead to ensure driver is not locked when issuing monitor commands. --- src/qemu/qemu_driver.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 4afed2f..0a0d9bc 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5165,18 +5165,18 @@ static int qemudDomainCoreDump(virDomainPtr dom, /* Pause domain for non-live dump */ if (!(flags & VIR_DUMP_LIVE) && vm->state == VIR_DOMAIN_RUNNING) { - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStopCPUs(priv->mon) < 0) { - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); goto endjob; } - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); paused = 1; } - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); ret = qemuMonitorMigrateToCommand(priv->mon, 1, args, path); - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); if (ret < 0) goto endjob; @@ -5205,13 +5205,13 @@ endjob: will support synchronous operations so we always get here after the migration is complete. */ else if (resume && paused) { - qemuDomainObjEnterMonitor(vm); + qemuDomainObjEnterMonitorWithDriver(driver, vm); if (qemuMonitorStartCPUs(priv->mon, dom->conn) < 0) { if (virGetLastError() == NULL) qemuReportError(VIR_ERR_OPERATION_FAILED, "%s", _("resuming after dump failed")); } - qemuDomainObjExitMonitor(vm); + qemuDomainObjExitMonitorWithDriver(driver, vm); } if (qemuDomainObjEndJob(vm) == 0) -- 1.7.0.4

2 2

[libvirt] [PATCH TCK] Add a minimal test case for CPU hotplug
by Daniel P. Berrange 22 Apr '10

22 Apr '10

Adds a minimal test case which verifies that it is possible to set the CPU count to max, and then back to the min. This really needs libguestfs integration to validate that the guest sees the change --- scripts/domain/130-cpu-hotplug.t | 78 ++++++++++++++++++++++++++++++++++++++ 1 files changed, 78 insertions(+), 0 deletions(-) create mode 100644 scripts/domain/130-cpu-hotplug.t diff --git a/scripts/domain/130-cpu-hotplug.t b/scripts/domain/130-cpu-hotplug.t new file mode 100644 index 0000000..2976f2d --- /dev/null +++ b/scripts/domain/130-cpu-hotplug.t @@ -0,0 +1,78 @@ +# -*- perl -*- +# +# Copyright (C) 2009-2010 Red Hat, Inc. +# Copyright (C) 2009-2010 Daniel P. Berrange +# +# This program is free software; You can redistribute it and/or modify +# it under the GNU General Public License as published by the Free +# Software Foundation; either version 2, or (at your option) any +# later version +# +# The file "LICENSE" distributed along with this file provides full +# details of the terms and conditions +# + +=pod + +=head1 NAME + +domain/130-cpu-hotplug.t - whether CPU count can be changed + +=head1 DESCRIPTION + +The test case validates the it is possible to change the CPU +on a running guest. + +XXX: Need libguestfs integration to check that it has truely +worked. + +=cut + +use strict; +use warnings; + +use Test::More tests => 7; +use Test::Exception; + +use Sys::Virt::TCK; + +my $tck = Sys::Virt::TCK->new(); +my $conn = eval { $tck->setup(); }; +BAIL_OUT "failed to setup test harness: $@" if $@; +END { $tck->cleanup if $tck; } + + +my $xml = $tck->generic_domain("tck")->as_xml; + + +diag "Creating a new transient domain"; +my $dom; +ok_domain(sub { $dom = $conn->create_domain($xml) }, "created transient domain object"); + +my $max; +lives_ok(sub { $max = $dom->get_max_vcpus() }, "queried max vcpus"); + +SKIP: { + skip "SMP guests not supported", 4 unless $max > 1; + + diag "Increasing CPU count to max"; + lives_ok(sub { $dom->set_vcpus($max); }, "set vcpus to $max"); + + my $info = $dom->get_info(); + + is($info->{nrVirtCpu}, $max, "cpu count $info->{nrVirtCpu} is $max"); + + diag "Decreasing CPU count to min"; + lives_ok(sub { $dom->set_vcpus(1); }, "set vcpus to 1"); + + $info = $dom->get_info(); + is($info->{nrVirtCpu}, 1, "cpu count $info->{nrVirtCpu} is 1"); +} + +diag "Destroying the transient domain"; +$dom->destroy; + +diag "Checking that transient domain has gone away"; +ok_error(sub { $conn->get_domain_by_name("tck") }, "NO_DOMAIN error raised from missing domain", 42); + +# end -- 1.6.5.2

2 2

[libvirt] [PATCH] configure.ac SELinux fixes
by spencer＠beyondabstraction.net 22 Apr '10

22 Apr '10

* Fix a logic error in configure.ac that prevented --with-selinux=no from being used with --with-secdriver-selinux=no. * Fix some strings to clarify the difference between --with-selinux and --with-secdriver-selinux. Signed-off-by: Spencer Shimko <sshimko(a)tresys.com> --- configure.ac | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) diff --git a/configure.ac b/configure.ac index 42c09b4..68dca54 100644 --- a/configure.ac +++ b/configure.ac @@ -869,14 +869,14 @@ if test "$with_selinux" != "no"; then AC_CHECK_HEADER([selinux/selinux.h],[],[fail=1]) AC_CHECK_LIB([selinux], [fgetfilecon],[],[fail=1]) test $fail = 1 && - AC_MSG_ERROR([You must install the SELinux development package in order to compile libvirt]) + AC_MSG_ERROR([You must install the libselinux development package in order to compile libvirt with basic SELinux support]) fi CFLAGS="$old_cflags" LIBS="$old_libs" fi if test "$with_selinux" = "yes"; then SELINUX_LIBS="-lselinux" - AC_DEFINE_UNQUOTED([HAVE_SELINUX], 1, [whether SELinux is available for security]) + AC_DEFINE_UNQUOTED([HAVE_SELINUX], 1, [whether basic SELinux functionality is available]) fi AM_CONDITIONAL([HAVE_SELINUX], [test "$with_selinux" != "no"]) AC_SUBST([SELINUX_CFLAGS]) @@ -891,9 +891,9 @@ AC_ARG_WITH([secdriver-selinux], if test "$with_selinux" != "yes" ; then if test "$with_secdriver_selinux" = "check" ; then with_secdriver_selinux=no - else - AC_MSG_ERROR([You must install the SELinux development package in order to compile libvirt]) - fi + elif test "$with_secdriver_selinux" = "yes"; then + AC_MSG_ERROR([You must install the libselinux development package and enable SELinux with the --with-selinux=yes in order to compile libvirt --with-secdriver-selinux=yes]) + fi else old_cflags="$CFLAGS" old_libs="$LIBS" @@ -910,7 +910,7 @@ else if test "$with_secdriver_selinux" = "check" ; then with_secdriver_selinux=no else - AC_MSG_ERROR([You must install the SELinux development package in order to compile libvirt]) + AC_MSG_ERROR([You must install libselinux development package >= 2.0.82 in order to compile libvirt --with-secdriver-selinux=yes]) fi else with_secdriver_selinux=yes -- 1.6.6.1

2 1

[libvirt] seg fault when running snapshot-create
by Stephen Shaw 22 Apr '10

22 Apr '10

I'm getting a seg fault when running virsh snapshot-create 1, but only when virt-manager is open and connected. Here is some of the debug info I was able to come up with - http://fpaste.org/9GO6/ (bt) http://fpaste.org/7gkH/ ('thread apply all bt) * After the crash (gdb) p mon->msg $1 = (qemuMonitorMessagePtr) 0x0 nibbler:~ # libvirtd --version libvirtd (libvirt) 0.8.0 Please let me know if there is any other information you need. Stephen

4 13

[libvirt] [PATCH] Fix handling of security driver restore failures in QEMU domain save
by Daniel P. Berrange 22 Apr '10

22 Apr '10

In cases where the security driver failed to restore a label after a guest has saved, we mistakenly jumped to the error cleanup paths. This is not good, because the operation has in fact completed and cannot be rolled back completely. Label restore is non-critical, so just log the problem instead. Also add a missing restore call in the error cleanup path * src/qemu/qemu_driver.c: Fix handling of security driver restore failures in QEMU domain save --- src/qemu/qemu_driver.c | 48 +++++++++++++++++++++++++----------------------- 1 files changed, 25 insertions(+), 23 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 3bea7e7..7b92965 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5050,16 +5050,13 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path, driver->securityDriver && driver->securityDriver->domainRestoreSavedStateLabel && driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1) - goto endjob; + VIR_WARN("failed to restore save state label on %s", path); if (cgroup != NULL) { rc = virCgroupDenyDevicePath(cgroup, path); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to deny device %s for %s"), - path, vm->def->name); - goto endjob; - } + if (rc != 0) + VIR_WARN("Unable to deny device %s for %s %d", + path, vm->def->name, rc); } ret = 0; @@ -5078,24 +5075,29 @@ static int qemudDomainSaveFlag(virDomainPtr dom, const char *path, endjob: if (vm) { - if (ret != 0 && header.was_running && priv->mon) { - qemuDomainObjEnterMonitorWithDriver(driver, vm); - rc = qemuMonitorStartCPUs(priv->mon, dom->conn); - qemuDomainObjExitMonitorWithDriver(driver, vm); - if (rc < 0) - VIR_WARN0("Unable to resume guest CPUs after save failure"); - else - vm->state = VIR_DOMAIN_RUNNING; - } + if (ret != 0) { + if (header.was_running && priv->mon) { + qemuDomainObjEnterMonitorWithDriver(driver, vm); + rc = qemuMonitorStartCPUs(priv->mon, dom->conn); + qemuDomainObjExitMonitorWithDriver(driver, vm); + if (rc < 0) + VIR_WARN0("Unable to resume guest CPUs after save failure"); + else + vm->state = VIR_DOMAIN_RUNNING; + } - if (ret != 0 && cgroup != NULL) { - rc = virCgroupDenyDevicePath(cgroup, path); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to deny device %s for %s"), - path, vm->def->name); - goto endjob; + if (cgroup != NULL) { + rc = virCgroupDenyDevicePath(cgroup, path); + if (rc != 0) + VIR_WARN("Unable to deny device %s for %s: %d", + path, vm->def->name, rc); } + + if ((!bypassSecurityDriver) && + driver->securityDriver && + driver->securityDriver->domainRestoreSavedStateLabel && + driver->securityDriver->domainRestoreSavedStateLabel(vm, path) == -1) + VIR_WARN("failed to restore save state label on %s", path); } if (qemuDomainObjEndJob(vm) == 0) -- 1.6.5.2

1 0

[libvirt] [PATCH] Fix printing of event detail in python events demo program
by Daniel P. Berrange 22 Apr '10

22 Apr '10

The events demo program is slightly misleading printing myDomainEventCallback1 EVENT: Domain f14i686(-1) Added which is not distinguishing Add vs Update events. It should have been doing myDomainEventCallback1 EVENT: Domain f14i686(-1) Defined Updated * examples/domain-events/events-python/event-test.py: Fully print event detail info string --- examples/domain-events/events-python/event-test.py | 27 ++++++++++++++----- 1 files changed, 20 insertions(+), 7 deletions(-) diff --git a/examples/domain-events/events-python/event-test.py b/examples/domain-events/events-python/event-test.py index 0c6e2f0..7c5af68 100644 --- a/examples/domain-events/events-python/event-test.py +++ b/examples/domain-events/events-python/event-test.py @@ -396,21 +396,34 @@ def virEventLoopPureStart(): # Everything that now follows is a simple demo of domain lifecycle events ########################################################################## def eventToString(event): - eventStrings = ( "Added", - "Removed", + eventStrings = ( "Defined", + "Undefined", "Started", "Suspended", "Resumed", - "Stopped", - "Saved", - "Restored" ); + "Stopped" ); return eventStrings[event]; +def detailToString(event, detail): + eventStrings = ( + ( "Added", "Updated" ), + ( "Removed" ), + ( "Booted", "Migrated", "Restored", "Snapshot" ), + ( "Paused", "Migrated", "IOError", "Watchdog" ), + ( "Unpaused", "Migrated"), + ( "Shutdown", "Destroyed", "Crashed", "Migrated", "Saved", "Failed", "Snapshot") + ) + return eventStrings[event][detail] + def myDomainEventCallback1 (conn, dom, event, detail, opaque): - print "myDomainEventCallback1 EVENT: Domain %s(%s) %s %d" % (dom.name(), dom.ID(), eventToString(event), detail) + print "myDomainEventCallback1 EVENT: Domain %s(%s) %s %s" % (dom.name(), dom.ID(), + eventToString(event), + detailToString(event, detail)) def myDomainEventCallback2 (conn, dom, event, detail, opaque): - print "myDomainEventCallback2 EVENT: Domain %s(%s) %s %d" % (dom.name(), dom.ID(), eventToString(event), detail) + print "myDomainEventCallback2 EVENT: Domain %s(%s) %s %s" % (dom.name(), dom.ID(), + eventToString(event), + detailToString(event, detail)) def myDomainEventRebootCallback(conn, dom, opaque): print "myDomainEventRebootCallback: Domain %s(%s)" % (dom.name(), dom.ID()) -- 1.6.6.1

2 1

[libvirt] [PATCH 1/2] Fix CPU hotplug command names
by Daniel P. Berrange 22 Apr '10

22 Apr '10

Probably as a result of a merge error, the CPU hotplug command names were completely wrong. * src/qemu/qemu_monitor_json.c, src/qemu/qemu_monitor_text.c: Fix the CPU hotplug command names --- src/qemu/qemu_monitor_json.c | 2 +- src/qemu/qemu_monitor_text.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index cde9899..96f246f 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -1181,7 +1181,7 @@ int qemuMonitorJSONSetCPU(qemuMonitorPtr mon, int cpu, int online) { int ret; - virJSONValuePtr cmd = qemuMonitorJSONMakeCommand("balloon", + virJSONValuePtr cmd = qemuMonitorJSONMakeCommand("cpu_set", "U:cpu", (unsigned long long)cpu, "s:state", online ? "online" : "offline", NULL); diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c index 6ad07b1..db3806d 100644 --- a/src/qemu/qemu_monitor_text.c +++ b/src/qemu/qemu_monitor_text.c @@ -800,7 +800,7 @@ int qemuMonitorTextSetBalloon(qemuMonitorPtr mon, /* - * Returns: 0 if balloon not supported, +1 if balloon adjust worked + * Returns: 0 if CPU hotplug not supported, +1 if CPU hotplug worked * or -1 on failure */ int qemuMonitorTextSetCPU(qemuMonitorPtr mon, int cpu, int online) @@ -809,7 +809,7 @@ int qemuMonitorTextSetCPU(qemuMonitorPtr mon, int cpu, int online) char *reply = NULL; int ret = -1; - if (virAsprintf(&cmd, "set_cpu %d %s", cpu, online ? "online" : "offline") < 0) { + if (virAsprintf(&cmd, "cpu_set %d %s", cpu, online ? "online" : "offline") < 0) { virReportOOMError(); return -1; } -- 1.6.6.1

3 5

[libvirt] Plan for a 0.8.1 by end of next week
by Daniel Veillard 22 Apr '10

22 Apr '10

Checking git history since the release of 0.8.0, I'm seeing an impressive set of bug fixes and cleanups, and relatively few actual features changes. So I think it's sensible to try to make a new release 0.8.1 basically a 0.8.0 fixed version, and in a relatively short timeframe. To try to realign with our initial goal of releasing on Friday at the end of the month, I suggest we plan to make 0.8.1 by next Friday, the 30th April. Having a release with the snapshot feature fixed would IMHO suffice to justify this release, but git history right now makes a good case for such an early push. So unless we get serious objections, I suggest to continue the bug fixing trend, limit features commit next week and, have a cleaned up 0.8.1 available end of next week. Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH] portability fixes to tools/virt-pki-validate.in
by Dustin Kirkland 22 Apr '10

22 Apr '10

portability fixes to tools/virt-pki-validate.in A few fixes will help make tools/virt-pki-validate.in useful on Debian and Ubuntu. And one fix should be useful to everyone (see #4). 1) note our gnutls-bin package (in addition to your gnutls-utils package) in the no-certtool error text 2) adjust the ORG-setting sed regular expressions to work with both Red Hat and Ubuntu style cacert.pem Issuer format 3) fix a bashism, == should be = in the case where /bin/sh is a symlink to dash 4) $(SYSCONFDIR) cannot evaluate; set a single shell SYSCONFDIR variable to the autoconf @SYSCONFDIR@ value, and use $SYSCONFDIR everywhere This was tested against gnutls 2.8.5. And against both Red Hat and Ubuntu cacert.pem files. Credit Jamie Strandboge with the regular expression changes. Bug report: * https://bugs.edge.launchpad.net/ubuntu/+source/libvirt/+bug/562266 Signed-off-by: Dustin Kirkland <kirkland(a)canonical.com> diff --git a/tools/virt-pki-validate.in b/tools/virt-pki-validate.in index ee7b79d..d335997 100755 --- a/tools/virt-pki-validate.in +++ b/tools/virt-pki-validate.in @@ -16,8 +16,8 @@ PORT=16514 CERTOOL=`which certtool 2>/dev/null` if [ ! -x $CERTOOL ] then - echo Could not locate the certtool program - echo make sure the gnutls-utils package is installed + echo "Could not locate the certtool program" + echo "make sure the gnutls-utils (or gnutls-bin) package is installed" exit 1 fi echo Found $CERTOOL @@ -25,7 +25,8 @@ echo Found $CERTOOL # # Check the directory structure # -PKI="@SYSCONFDIR@/pki" +SYSCONFDIR="@SYSCONFDIR@" +PKI="$SYSCONFDIR/pki" if [ ! -d $PKI ] then echo the $PKI directory is missing, it is usually @@ -129,8 +130,8 @@ then echo "as root do: chmod 644 $CA/cacert.pem" exit 1 fi -ORG=`$CERTOOL -i --infile $CA/cacert.pem | grep Issuer | sed 's+Issuer: CN=++'` -if [ "$ORG" == "" ] +ORG=`$CERTOOL -i --infile $CA/cacert.pem | grep Issuer | sed -e 's+\s*Issuer: .*CN=++' -e 's+,EMAIL=.*++'` +if [ "$ORG" = "" ] then echo the CA certificate $CA/cacert.pem does not define the organization echo it should probably regenerated @@ -240,19 +241,19 @@ fi if [ "$SERVER" = "1" ] then - if [ -r $(SYSCONFDIR)/sysconfig/libvirtd ] + if [ -r $SYSCONFDIR/sysconfig/libvirtd ] then - if [ "`grep '^LIBVIRTD_ARGS' $(SYSCONFDIR)/sysconfig/libvirtd | grep -- '--listen'`" = "" ] + if [ "`grep '^LIBVIRTD_ARGS' $SYSCONFDIR/sysconfig/libvirtd | grep -- '--listen'`" = "" ] then - echo Make sure $(SYSCONFDIR)/sysconfig/libvirtd is setup to listen to + echo Make sure $SYSCONFDIR/sysconfig/libvirtd is setup to listen to echo TCP/IP connections and restart the libvirtd service fi fi - if [ -r $(SYSCONFDIR)/sysconfig/iptables ] + if [ -r $SYSCONFDIR/sysconfig/iptables ] then - if [ "`grep $PORT $(SYSCONFDIR)/sysconfig/iptables`" = "" ] + if [ "`grep $PORT $SYSCONFDIR/sysconfig/iptables`" = "" ] then - echo Make sure $(SYSCONFDIR)/sysconfig/iptables is setup to allow + echo Make sure $SYSCONFDIR/sysconfig/iptables is setup to allow echo incoming TCP/IP connections on port $PORT and echo restart the iptables service fi

3 6

Re: [libvirt] Failed to insert a cd in a virtual machine running
by Jorge Alejandro Rodríguez 22 Apr '10

22 Apr '10

the problem is because of new version of qemu, the name of devices isn't ide0-0-, is drive-ide0-0-1. 2010/4/22 Jorge Alejandro Rodríguez <jrodriguez(a)dit.upm.es> > I can't attach a cd when a vm is running with qemu 0.12.3 (ubuntu 10.04), > the problem is not with qemu because when I start the vm with kvm command > (without libvirt) I can change the cd with qemu-monitor without any problem > and eject it too (libvirt say me that it isn't supported by hypervisor). > > the versions of libvirt that I have tried are 0.7.7 and 0.8.0. > > Any ideas? > > Thanks. > Jorge >

1 0

[libvirt] [Resend][PATCH 0/3] Add dnsmasq module
by Satoru SATOH 22 Apr '10

22 Apr '10

I posted this just before 0.8.0 is out and it was bad timing, I suppose. So try to resend. The following series of patches is a prototype implementation of dnsmasq module. It implements an idea originally suggested by Dan-san and can address the problem that too many --dhcp-host args hitting ARG_MAX limit I reported last year [1]. [1] https://www.redhat.com/archives/libvir-list/2009-October/msg00216.html Thanks, Satoru SATOH

3 6

Re: [libvirt] unable to set security context (NFSv4 problem?)
by Harald Dunkel 22 Apr '10

22 Apr '10

Hi Spencer, I could reproduce the EINVAL on the command line: srvl022:/storage# touch /storage/x srvl022:/storage# chown 110:140 /storage/x chown: changing ownership of `/storage/x': Invalid argument 110 and 140 are not valid UIDs and GIDs on the NFS server. They are defined in the local passwd/group files on the libvirt server only. After defining the user and group on the NFS server the error message is gone. Obviously NFSv4 is a little bit picky about remote root users trying to change the ownership of files. This seems to break qemuSecurityDACSetOwnership() in qemu_security_dac.c, giving me the "unable to set security context" message. Do you think it would be possible to introduce a configure option '--with-dac=no'? Regards Harri

3 6

[libvirt] [PATCH] maint: enforce whitespace on shell scripts
by Eric Blake 22 Apr '10

22 Apr '10

Noticed because virt-pki-validate was very inconsistent on using tabs vs. 8 spaces, sometimes mixing both paradigms on a single line. 'git diff -b' shows significant changes only in cfg.mk. * cfg.mk (sc_TAB_in_indentation): Add a few files. * daemon/libvirtd.init.in: Avoid tabs. * tools/virt-pki-validate.in: Likewise. --- cfg.mk | 4 +- daemon/libvirtd.init.in | 6 +- tools/virt-pki-validate.in | 138 ++++++++++++++++++++++---------------------- 3 files changed, 74 insertions(+), 74 deletions(-) diff --git a/cfg.mk b/cfg.mk index 790d357..105b625 100644 --- a/cfg.mk +++ b/cfg.mk @@ -139,8 +139,8 @@ sc_prohibit_ctype_h: # files in gnulib, since they're imported. sc_TAB_in_indentation: @prohibit='^ * ' \ - in_vc_files='\.(rng|[ch](\.in)?)$$' \ - halt='use spaces, not TAB, for indentation in C sources and RNG schemas' \ + in_vc_files='(\.(rng|[ch](\.in)?)|(daemon|tools)/.*\.in)$$' \ + halt='use spaces, not TAB, for indentation in C, sh, and RNG schemas' \ $(_sc_search_regexp) ctype_re = isalnum|isalpha|isascii|isblank|iscntrl|isdigit|isgraph|islower\ diff --git a/daemon/libvirtd.init.in b/daemon/libvirtd.init.in index 4c8821b..d4dc98b 100644 --- a/daemon/libvirtd.init.in +++ b/daemon/libvirtd.init.in @@ -72,7 +72,7 @@ stop() { if [ $RETVAL -eq 0 ]; then rm -f @localstatedir@/lock/subsys/$SERVICE rm -f $PIDFILE - rm -rf @localstatedir@/cache/libvirt/* + rm -rf @localstatedir@/cache/libvirt/* fi } @@ -101,13 +101,13 @@ case "$1" in ;; force-reload) reload - ;; + ;; condrestart|try-restart) [ -f @localstatedir@/lock/subsys/$SERVICE ] && restart || : ;; *) echo $"Usage: $0 {start|stop|status|restart|condrestart|reload|force-reload|try-restart}" - exit 2 + exit 2 ;; esac exit $RETVAL diff --git a/tools/virt-pki-validate.in b/tools/virt-pki-validate.in index ee7b79d..9a1c6fa 100755 --- a/tools/virt-pki-validate.in +++ b/tools/virt-pki-validate.in @@ -147,35 +147,35 @@ then if [ ! -r $LIBVIRT/clientcert.pem ] then echo Client certificate $LIBVIRT/clientcert.pem should be world readable - echo "as root do: chown root:root $LIBVIRT/clientcert.pem ; chmod 644 $LIBVIRT/clientcert.pem" + echo "as root do: chown root:root $LIBVIRT/clientcert.pem ; chmod 644 $LIBVIRT/clientcert.pem" else S_ORG=`$CERTOOL -i --infile $LIBVIRT/clientcert.pem | grep Subject: | sed 's+.*O=$[a-zA-Z \._-]*$.*+\1+'` - if [ "$ORG" != "$S_ORG" ] - then - echo The CA certificate and the client certificate do not match - echo CA organization: $ORG - echo Client organization: $S_ORG - fi - CLIENT=`$CERTOOL -i --infile $LIBVIRT/clientcert.pem | grep Subject: | sed 's+.*CN=$.[a-zA-Z \._-]*$.*+\1+'` - echo Found client certificate $LIBVIRT/clientcert.pem for $CLIENT - if [ ! -e $LIBVIRTP/clientkey.pem ] - then - echo Missing client private key $LIBVIRTP/clientkey.pem - else - echo Found client private key $LIBVIRTP/clientkey.pem - OWN=`ls -l $LIBVIRTP/clientkey.pem | awk '{ print $3 }'` - MOD=`ls -l $LIBVIRTP/clientkey.pem | awk '{ print $1 }'` - if [ "$OWN" != "root" ] - then - echo The client private key should be owned by root - echo "as root do: chown root $LIBVIRTP/clientkey.pem" - fi - if [ "$MOD" != "-rw-r--r--" ] - then - echo The client private key need to be read by client tools - echo "as root do: chmod 644 $LIBVIRTP/clientkey.pem" - fi - fi + if [ "$ORG" != "$S_ORG" ] + then + echo The CA certificate and the client certificate do not match + echo CA organization: $ORG + echo Client organization: $S_ORG + fi + CLIENT=`$CERTOOL -i --infile $LIBVIRT/clientcert.pem | grep Subject: | sed 's+.*CN=$.[a-zA-Z \._-]*$.*+\1+'` + echo Found client certificate $LIBVIRT/clientcert.pem for $CLIENT + if [ ! -e $LIBVIRTP/clientkey.pem ] + then + echo Missing client private key $LIBVIRTP/clientkey.pem + else + echo Found client private key $LIBVIRTP/clientkey.pem + OWN=`ls -l $LIBVIRTP/clientkey.pem | awk '{ print $3 }'` + MOD=`ls -l $LIBVIRTP/clientkey.pem | awk '{ print $1 }'` + if [ "$OWN" != "root" ] + then + echo The client private key should be owned by root + echo "as root do: chown root $LIBVIRTP/clientkey.pem" + fi + if [ "$MOD" != "-rw-r--r--" ] + then + echo The client private key need to be read by client tools + echo "as root do: chmod 644 $LIBVIRTP/clientkey.pem" + fi + fi fi else @@ -193,41 +193,41 @@ then if [ ! -r $LIBVIRT/servercert.pem ] then echo Server certificate $LIBVIRT/servercert.pem should be world readable - echo "as root do: chown root:root $LIBVIRT/servercert.pem ; chmod 644 $LIBVIRT/servercert.pem" + echo "as root do: chown root:root $LIBVIRT/servercert.pem ; chmod 644 $LIBVIRT/servercert.pem" else S_ORG=`$CERTOOL -i --infile $LIBVIRT/servercert.pem | grep Subject: | sed 's+.*O=$[a-zA-Z\. _-]*$.*+\1+'` - if [ "$ORG" != "$S_ORG" ] - then - echo The CA certificate and the server certificate do not match - echo CA organization: $ORG - echo Server organization: $S_ORG - fi - S_HOST=`$CERTOOL -i --infile $LIBVIRT/servercert.pem | grep Subject: | sed 's+.*CN=$[a-zA-Z\. _-]*$+\1+'` - if test "$S_HOST" != "`hostname -s`" && test "$S_HOST" != "`hostname`" - then - echo The server certificate does not seem to match the host name - echo hostname: '"'`hostname`'"' - echo Server certificate CN: '"'$S_HOST'"' - fi - echo Found server certificate $LIBVIRT/servercert.pem for $S_HOST - if [ ! -e $LIBVIRTP/serverkey.pem ] - then - echo Missing server private key $LIBVIRTP/serverkey.pem - else - echo Found server private key $LIBVIRTP/serverkey.pem - OWN=`ls -l $LIBVIRTP/serverkey.pem | awk '{ print $3 }'` - MOD=`ls -l $LIBVIRTP/serverkey.pem | awk '{ print $1 }'` - if [ "$OWN" != "root" ] - then - echo The server private key should be owned by root - echo "as root do: chown root $LIBVIRTP/serverkey.pem" - fi - if [ "$MOD" != "-rw-------" ] - then - echo The server private key need to be read only by root - echo "as root do: chmod 600 $LIBVIRTP/serverkey.pem" - fi - fi + if [ "$ORG" != "$S_ORG" ] + then + echo The CA certificate and the server certificate do not match + echo CA organization: $ORG + echo Server organization: $S_ORG + fi + S_HOST=`$CERTOOL -i --infile $LIBVIRT/servercert.pem | grep Subject: | sed 's+.*CN=$[a-zA-Z\. _-]*$+\1+'` + if test "$S_HOST" != "`hostname -s`" && test "$S_HOST" != "`hostname`" + then + echo The server certificate does not seem to match the host name + echo hostname: '"'`hostname`'"' + echo Server certificate CN: '"'$S_HOST'"' + fi + echo Found server certificate $LIBVIRT/servercert.pem for $S_HOST + if [ ! -e $LIBVIRTP/serverkey.pem ] + then + echo Missing server private key $LIBVIRTP/serverkey.pem + else + echo Found server private key $LIBVIRTP/serverkey.pem + OWN=`ls -l $LIBVIRTP/serverkey.pem | awk '{ print $3 }'` + MOD=`ls -l $LIBVIRTP/serverkey.pem | awk '{ print $1 }'` + if [ "$OWN" != "root" ] + then + echo The server private key should be owned by root + echo "as root do: chown root $LIBVIRTP/serverkey.pem" + fi + if [ "$MOD" != "-rw-------" ] + then + echo The server private key need to be read only by root + echo "as root do: chmod 600 $LIBVIRTP/serverkey.pem" + fi + fi fi else @@ -243,19 +243,19 @@ then if [ -r $(SYSCONFDIR)/sysconfig/libvirtd ] then if [ "`grep '^LIBVIRTD_ARGS' $(SYSCONFDIR)/sysconfig/libvirtd | grep -- '--listen'`" = "" ] - then - echo Make sure $(SYSCONFDIR)/sysconfig/libvirtd is setup to listen to - echo TCP/IP connections and restart the libvirtd service - fi + then + echo Make sure $(SYSCONFDIR)/sysconfig/libvirtd is setup to listen to + echo TCP/IP connections and restart the libvirtd service + fi fi if [ -r $(SYSCONFDIR)/sysconfig/iptables ] then if [ "`grep $PORT $(SYSCONFDIR)/sysconfig/iptables`" = "" ] - then - echo Make sure $(SYSCONFDIR)/sysconfig/iptables is setup to allow - echo incoming TCP/IP connections on port $PORT and - echo restart the iptables service - fi + then + echo Make sure $(SYSCONFDIR)/sysconfig/iptables is setup to allow + echo incoming TCP/IP connections on port $PORT and + echo restart the iptables service + fi fi fi -- 1.6.6.1

2 1

[libvirt] [PATCH] Fix initial VCPU pinning in qemu driver
by Jiri Denemark 22 Apr '10

22 Apr '10

First, inital VCPU pinning is set correctly but then it is reset by assigning qemu process to a new cgroup (which contains all CPUs). It's easily fixed by swapping these two actions. --- src/qemu/qemu_driver.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) Originally, I thought it would be better to change the initial pinning at cgroup level but then I realized it was not a good idea. AFAIK cgroup olny works for processes and is not usable for per-VCPU pinning. That is, it is fine to have all CPUs in cgroup and fine tune VCPU pinning by setting procss affinity. diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 5f4adfd..cc3e3b2 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -3081,10 +3081,10 @@ static int qemudSecurityHook(void *data) { /* This must take place before exec(), so that all QEMU * memory allocation is on the correct NUMA node */ - if (qemudInitCpuAffinity(h->vm) < 0) + if (qemuAddToCgroup(h->driver, h->vm->def) < 0) return -1; - if (qemuAddToCgroup(h->driver, h->vm->def) < 0) + if (qemudInitCpuAffinity(h->vm) < 0) return -1; if (h->driver->securityDriver && -- 1.7.0.4

2 2

[libvirt] [PATCH] Make avahi startup more robust.
by Chris Lalancette 21 Apr '10

21 Apr '10

If the hostname of the current virtualization machine could not be resolved, then libvirtd would fail to start. However, for disconnected operation (on a laptop, for instance) the hostname may very legitimately not be resolvable. This patch makes it so that if we can't resolve the hostname, avahi doesn't fail, it just uses a less useful MDNS string. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- daemon/libvirtd.c | 28 ++++++++++++++++++++-------- 1 files changed, 20 insertions(+), 8 deletions(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 863bf21..4533f40 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -998,22 +998,34 @@ static int qemudNetworkInit(struct qemud_server *server) { struct libvirtd_mdns_group *group; struct qemud_socket *sock; int port = 0; + int ret; server->mdns = libvirtd_mdns_new(); if (!mdns_name) { - char groupname[64], *localhost, *tmp; - /* Extract the host part of the potentially FQDN */ + char *groupname, *localhost, *tmp; + localhost = virGetHostname(NULL); if (localhost == NULL) + /* we couldn't resolve the hostname; assume that we are + * running in disconnected operation, and report a less + * useful Avahi string + */ + ret = virAsprintf(&groupname, "Virtualization Host"); + else { + /* Extract the host part of the potentially FQDN */ + if ((tmp = strchr(localhost, '.'))) + *tmp = '\0'; + ret = virAsprintf(&groupname, "Virtualization Host %s", + localhost); + } + VIR_FREE(localhost); + if (ret < 0) { + virReportOOMError(); goto cleanup; - - if ((tmp = strchr(localhost, '.'))) - *tmp = '\0'; - snprintf(groupname, sizeof(groupname)-1, "Virtualization Host %s", localhost); - groupname[sizeof(groupname)-1] = '\0'; + } group = libvirtd_mdns_add_group(server->mdns, groupname); - VIR_FREE(localhost); + VIR_FREE(groupname); } else { group = libvirtd_mdns_add_group(server->mdns, mdns_name); } -- 1.6.6.1

2 1

[libvirt] [PATCH] maint: ignore 'make syntax-check' failure files
by Eric Blake 21 Apr '10

21 Apr '10

* .gitignore: Add exemption. * cfg.mk (local-checks-to-skip): Ignore a test to silence a skip warning. --- Noticed these while fixing the 'make syntax-check' fallout. They border on trivial, but I decided to wait for an ACK. .gitignore | 1 + cfg.mk | 1 + 2 files changed, 2 insertions(+), 0 deletions(-) diff --git a/.gitignore b/.gitignore index a7466fd..8c275f4 100644 --- a/.gitignore +++ b/.gitignore @@ -7,6 +7,7 @@ *~ .git .git-module-status +.sc-start-sc_* /GNUmakefile /maint.mk ABOUT-NLS diff --git a/cfg.mk b/cfg.mk index 5d8103e..790d357 100644 --- a/cfg.mk +++ b/cfg.mk @@ -34,6 +34,7 @@ local-checks-to-skip = \ sc_GPL_version \ sc_always_defined_macros \ sc_cast_of_alloca_return_value \ + sc_cross_check_PATH_usage_in_tests \ sc_dd_max_sym_length \ sc_error_exit_success \ sc_file_system \ -- 1.6.6.1

2 2