- Devel - libvirt List Archives

[libvirt] [PATCH v2] qemuDomainUndefineFlags: Fix error message
by Michal Privoznik 11 Dec '17

11 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1522706 If domain is active, but the undefine API was called without the VIR_DOMAIN_UNDEFINE_KEEP_NVRAM flag set, the following incorrect error message is produced: error: Requested operation is not valid: cannot delete inactive domain with nvram Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- Diff to v1: - switched to different code pattern to make it easier for translators src/qemu/qemu_driver.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index aa30b119a..cc5520c54 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7537,8 +7537,13 @@ qemuDomainUndefineFlags(virDomainPtr dom, goto endjob; } } else if (!(flags & VIR_DOMAIN_UNDEFINE_KEEP_NVRAM)) { - virReportError(VIR_ERR_OPERATION_INVALID, "%s", - _("cannot delete inactive domain with nvram")); + if (virDomainObjIsActive(vm)) { + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("cannot delete active domain with nvram")); + } else { + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("cannot delete inactive domain with nvram")); + } goto endjob; } } -- 2.13.6

3 2

[libvirt] [libvirt-php][PATCH 0/5] Couple of fixes
by Michal Privoznik 11 Dec '17

11 Dec '17

Mostly memleaks. Michal Privoznik (5): maint: Drop INSTALL install-sh and missing src: Don't leak @uuid in libvirt_nwfilter_get_uuid_string src: Fix a typo in php_libvirt_nwfilter_dtor src: Free @filters array in libvirt_list_all_nwfilters src: Don't leak connection_get_emulator retval INSTALL | 370 ---------------------------------- install-sh | 501 ----------------------------------------------- missing | 215 -------------------- src/libvirt-connection.c | 2 + src/libvirt-nwfilter.c | 7 +- src/libvirt-php.c | 11 +- 6 files changed, 14 insertions(+), 1092 deletions(-) delete mode 100644 INSTALL delete mode 100755 install-sh delete mode 100755 missing -- 2.13.6

2 12

[libvirt] [PATCH] qemuDomainUndefineFlags: Fix error message
by Michal Privoznik 11 Dec '17

11 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1522706 If domain is active, but the undefine API was called without the VIR_DOMAIN_UNDEFINE_KEEP_NVRAM flag set, the following incorrect error message is produced: error: Requested operation is not valid: cannot delete inactive domain with nvram Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_driver.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index aa30b119a..f2e8f3edc 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7537,8 +7537,10 @@ qemuDomainUndefineFlags(virDomainPtr dom, goto endjob; } } else if (!(flags & VIR_DOMAIN_UNDEFINE_KEEP_NVRAM)) { - virReportError(VIR_ERR_OPERATION_INVALID, "%s", - _("cannot delete inactive domain with nvram")); + virReportError(VIR_ERR_OPERATION_INVALID, + _("cannot delete %s domain with nvram"), + virDomainObjIsActive(vm) ? + _("active") : _("inactive")); goto endjob; } } -- 2.13.6

2 1

[libvirt] [PATCH v3 00/12] Move qemu command line controller checks to qemuDomainDeviceDefValidateController* checks
by John Ferlan 09 Dec '17

09 Dec '17

v2: https://www.redhat.com/archives/libvir-list/2017-December/msg00173.html Changes since v2: * Push a few patches from v1 that were ACK'd * Make the Skip helper private to qemu_command.c and just copied the various skip checks from the new helper into the specific controller validate helper to make it painfully obvious what was being skipped rather than having common code handle that and possibly obsfuscate those details from the casual reader. John Ferlan (11): qemu: Introduce qemuBuildSkipController qemu: Introduce qemuDomainDeviceDefValidateController qemu: Move CCW S390 Address check to controller def validate qemu: Introduce qemuDomainDeviceDefValidateControllerSCSI qemu: Introduce qemuDomainDeviceDefValidateControllerPCI qemu: Use virDomainPCIControllerOpts in qemuBuildControllerDevStr qemu: Move PCI command modelName check to controller def validate qemu: Move PCI command modelName TypeToString to controller def validate qemu: Move PCI more command checks to controller def validate qemu: Complete PCI command checks to controller def validate qemu: Introduce qemuDomainDeviceDefValidateControllerSATA Lin Ma (1): qemu: Introduce qemuDomainDeviceDefValidateControllerIDE src/qemu/qemu_command.c | 497 ++++++++---------------------------------------- src/qemu/qemu_domain.c | 469 ++++++++++++++++++++++++++++++++++++++++++++- tests/qemumemlocktest.c | 14 ++ tests/qemuxml2xmltest.c | 5 +- 4 files changed, 564 insertions(+), 421 deletions(-) -- 2.13.6

3 27

[libvirt] [PATCH] migration.html: Clarify configuration file handling docs
by Jiri Denemark 08 Dec '17

08 Dec '17

Migration never removes any configuration files on the destination host. Thus when the domain is already defined on the destination, it will stay persistent even after migration without --persist. https://bugzilla.redhat.com/show_bug.cgi?id=1514930 Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- docs/migration.html.in | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/docs/migration.html.in b/docs/migration.html.in index de7d4def75..7c345b65b7 100644 --- a/docs/migration.html.in +++ b/docs/migration.html.in @@ -206,14 +206,14 @@ <h2><a id="config">Configuration file handling</a></h2> <p> - There are two types of virtual machine known to libvirt. A <em>transient</em> + There are two types of virtual machines known to libvirt. A <em>transient</em> guest only exists while it is running, and has no configuration file stored on disk. A <em>persistent</em> guest maintains a configuration file on disk even when it is not running. </p> <p> - By default, a migration operation will not attempt to change any configuration + By default, a migration operation will not attempt to modify any configuration files that may be stored on either the source or destination host. It is the administrator, or management application's, responsibility to manage distribution of configuration files (if desired). It is important to note that the <code>/etc/libvirt</code> @@ -230,14 +230,14 @@ host and removed on the original. </li> <li>Centralized configuration files outside libvirt, in a database. A data center - management application may not storage configuration files at all. Instead it + management application may not store configuration files at all. Instead it may generate libvirt XML on the fly when a guest is booted. It will typically use transient guests, and thus not have to consider configuration files during migration. </li> <li>Distributed configuration inside libvirt. The configuration file for each guest is copied to every host where the guest is able to run. Upon migration - the existing config merely needs to be updated with any changes + the existing config merely needs to be updated with any changes. </li> <li>Ad-hoc configuration management inside libvirt. Each guest is tied to a specific host and rarely migrated. When migration is required, the config @@ -246,7 +246,7 @@ </ul> <p> - As mentioned above, libvirt will not touch configuration files during + As mentioned above, libvirt will not modify configuration files during migration by default. The <code>virsh</code> command has two flags to influence this behaviour. The <code>--undefine-source</code> flag will cause the configuration file to be removed on the source host @@ -265,12 +265,12 @@ <th colspan="3">After migration</th> </tr> <tr class="subhead"> - <th>Guest type</th> + <th>Source type</th> <th>Source config</th> <th>Dest config</th> <th>--undefine-source</th> <th>--persist</th> - <th>Guest type</th> + <th>Dest type</th> <th>Source config</th> <th>Dest config</th> </tr> @@ -325,9 +325,9 @@ <td class="y">Y</td> <td class="n">N</td> <td class="n">N</td> - <td>Transient</td> - <td class="n">N</td> + <td>Persistent</td> <td class="n">N</td> + <td class="y">Y<br/>(unchanged dest config)</td> </tr> <tr> <td>Transient</td> @@ -335,9 +335,9 @@ <td class="y">Y</td> <td class="y">Y</td> <td class="n">N</td> - <td>Transient</td> - <td class="n">N</td> + <td>Persistent</td> <td class="n">N</td> + <td class="y">Y<br/>(unchanged dest config)</td> </tr> <tr> <td>Transient</td> @@ -347,7 +347,7 @@ <td class="y">Y</td> <td>Persistent</td> <td class="n">N</td> - <td class="y">Y</td> + <td class="y">Y<br/>(replaced with source)</td> </tr> <tr> <td>Transient</td> @@ -357,7 +357,7 @@ <td class="y">Y</td> <td>Persistent</td> <td class="n">N</td> - <td class="y">Y</td> + <td class="y">Y<br/>(replaced with source)</td> </tr>  @@ -411,7 +411,7 @@ <td class="n">N</td> <td>Persistent</td> <td class="y">Y</td> - <td class="y">Y</td> + <td class="y">Y<br/>(unchanged dest config)</td> </tr> <tr> <td>Persistent</td> @@ -421,7 +421,7 @@ <td class="n">N</td> <td>Persistent</td> <td class="n">N</td> - <td class="y">Y</td> + <td class="y">Y<br/>(unchanged dest config)</td> </tr> <tr> <td>Persistent</td> @@ -431,7 +431,7 @@ <td class="y">Y</td> <td>Persistent</td> <td class="y">Y</td> - <td class="y">Y</td> + <td class="y">Y<br/>(replaced with source)</td> </tr> <tr> <td>Persistent</td> @@ -441,7 +441,7 @@ <td class="y">Y</td> <td>Persistent</td> <td class="n">N</td> - <td class="y">Y</td> + <td class="y">Y<br/>(replaced with source)</td> </tr> </tbody> </table> -- 2.15.1

2 1

[libvirt] [libvirt-php][PATCH 0/7] Rework libvirt_domain_new a bit
by Michal Privoznik 08 Dec '17

08 Dec '17

Patches for: https://bugzilla.redhat.com/show_bug.cgi?id=1513190 You can also get the patches from my github: https://github.com/zippy2/libvirt-php/commits/libvirt_domain_new Apart from usual case where I just push patches immediately, I'm gonna give others chance to review since it's not trivial change set. Michal Privoznik (7): Make installation_get_xml hurt my eyes less. Rework libvirt_domain_new a bit installation_get_xml: Don't override defaults of <on_reboot/> and friends util: Introduce VIR_FREE libvirt_domain_new: Resolve couple of memleaks installation_get_xml: Resolve couple of memleaks src: Use VIR_FREE instead of free src/libvirt-connection.c | 26 ++--- src/libvirt-domain.c | 278 +++++++++++++++++++++++++++-------------------- src/libvirt-network.c | 26 ++--- src/libvirt-node.c | 9 +- src/libvirt-nodedev.c | 52 ++++----- src/libvirt-nwfilter.c | 6 +- src/libvirt-php.c | 234 ++++++++++++++++++++------------------- src/libvirt-php.h | 2 +- src/libvirt-snapshot.c | 4 +- src/libvirt-storage.c | 20 ++-- src/util.c | 2 +- src/util.h | 6 + src/vncfunc.c | 5 +- 13 files changed, 362 insertions(+), 308 deletions(-) -- 2.13.6

2 15

[libvirt] [PATCH v2] qemu: Add support for hot unplug redirdev device
by Chen Hanxiao 08 Dec '17

08 Dec '17

From: Chen Hanxiao <chenhanxiao(a)gmail.com> We lacked of hot unplugging redirdev device. This patch add support for it. We could use detach-device --live now. Signed-off-by: Chen Hanxiao <chenhanxiao(a)gmail.com> --- v2: add news section docs/news.xml | 9 ++++ src/qemu/qemu_driver.c | 4 +- src/qemu/qemu_hotplug.c | 111 ++++++++++++++++++++++++++++++++++++++++++++++++ src/qemu/qemu_hotplug.h | 3 ++ 4 files changed, 126 insertions(+), 1 deletion(-) diff --git a/docs/news.xml b/docs/news.xml index 0ec9857e2..ec32dc850 100644 --- a/docs/news.xml +++ b/docs/news.xml @@ -35,6 +35,15 @@ <libvirt> <release version="v4.0.0" date="unreleased"> <section title="New features"> + <change> + <summary> + qemu: Add support for hot unplug redirdev device + </summary> + <description> + We've supported hotplug redirdev device, but lacked of + hot unplug feature. Now we can do it by libvirt. + </description> + </change> </section> <section title="Improvements"> </section> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index aa30b119a..180bd0ebf 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7787,6 +7787,9 @@ qemuDomainDetachDeviceLive(virDomainObjPtr vm, case VIR_DOMAIN_DEVICE_INPUT: ret = qemuDomainDetachInputDevice(vm, dev->data.input); break; + case VIR_DOMAIN_DEVICE_REDIRDEV: + ret = qemuDomainDetachRedirdevDevice(driver, vm, dev->data.redirdev); + break; case VIR_DOMAIN_DEVICE_FS: case VIR_DOMAIN_DEVICE_SOUND: @@ -7796,7 +7799,6 @@ qemuDomainDetachDeviceLive(virDomainObjPtr vm, case VIR_DOMAIN_DEVICE_SMARTCARD: case VIR_DOMAIN_DEVICE_MEMBALLOON: case VIR_DOMAIN_DEVICE_NVRAM: - case VIR_DOMAIN_DEVICE_REDIRDEV: case VIR_DOMAIN_DEVICE_NONE: case VIR_DOMAIN_DEVICE_TPM: case VIR_DOMAIN_DEVICE_PANIC: diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 24631cb8f..d97aa6051 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -4375,6 +4375,74 @@ qemuDomainRemoveInputDevice(virDomainObjPtr vm, return 0; } +static int +qemuDomainRemoveRedirdevDevice(virQEMUDriverPtr driver, + virDomainObjPtr vm, + virDomainRedirdevDefPtr redirdev) +{ + qemuDomainObjPrivatePtr priv = vm->privateData; + virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); + virObjectEventPtr event; + char *charAlias = NULL; + char *tlsAlias = NULL; + char *secAlias = NULL; + ssize_t idx; + int ret = -1; + + VIR_DEBUG("Removing redirdev device %s from domain %p %s", + redirdev->info.alias, vm, vm->def->name); + + if (!(charAlias = qemuAliasChardevFromDevAlias(redirdev->info.alias))) + goto cleanup; + + if (redirdev->source->type == VIR_DOMAIN_CHR_TYPE_TCP && + redirdev->source->data.tcp.haveTLS == VIR_TRISTATE_BOOL_YES) { + + if (!(tlsAlias = qemuAliasTLSObjFromSrcAlias(charAlias))) + goto cleanup; + + /* Best shot at this as the secinfo is destroyed after process launch + * and this path does not recreate it. Thus, if the config has the + * secret UUID and we have a serial TCP chardev, then formulate a + * secAlias which we'll attempt to destroy. */ + if (cfg->chardevTLSx509secretUUID && + !(secAlias = qemuDomainGetSecretAESAlias(charAlias, false))) + goto cleanup; + } + + qemuDomainObjEnterMonitor(driver, vm); + /* Usually device_del will remove related chardev as well, + * So we don't need to check its return value. + */ + ignore_value(qemuMonitorDetachCharDev(priv->mon, charAlias)); + + if (tlsAlias) + ignore_value(qemuMonitorDelObject(priv->mon, tlsAlias)); + if (secAlias) + ignore_value(qemuMonitorDelObject(priv->mon, secAlias)); + + if (qemuDomainObjExitMonitor(driver, vm) < 0) + goto cleanup; + + virDomainAuditRedirdev(vm, redirdev, "detach", true); + + event = virDomainEventDeviceRemovedNewFromObj(vm, redirdev->info.alias); + qemuDomainEventQueue(driver, event); + + if ((idx = virDomainRedirdevDefFind(vm->def, redirdev)) >= 0) + virDomainRedirdevDefRemove(vm->def, idx); + qemuDomainReleaseDeviceAddress(vm, &redirdev->info, NULL); + virDomainRedirdevDefFree(redirdev); + + ret = 0; + + cleanup: + VIR_FREE(charAlias); + VIR_FREE(tlsAlias); + VIR_FREE(secAlias); + return ret; +} + int qemuDomainRemoveDevice(virQEMUDriverPtr driver, @@ -5112,6 +5180,49 @@ qemuDomainDetachWatchdog(virQEMUDriverPtr driver, return ret; } +int +qemuDomainDetachRedirdevDevice(virQEMUDriverPtr driver, + virDomainObjPtr vm, + virDomainRedirdevDefPtr redirdev) +{ + int ret = -1; + qemuDomainObjPrivatePtr priv = vm->privateData; + virDomainDefPtr vmdef = vm->def; + virDomainRedirdevDefPtr tmpRedirdevDef; + ssize_t idx; + + if ((idx = virDomainRedirdevDefFind(vmdef, redirdev)) < 0) { + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("no matching redirdev was not found")); + return -1; + } + + tmpRedirdevDef = vm->def->redirdevs[idx]; + + if (!tmpRedirdevDef->info.alias) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("alias not set for redirdev device")); + return -1; + } + + qemuDomainMarkDeviceForRemoval(vm, &tmpRedirdevDef->info); + + qemuDomainObjEnterMonitor(driver, vm); + if (qemuMonitorDelDevice(priv->mon, tmpRedirdevDef->info.alias) < 0) { + ignore_value(qemuDomainObjExitMonitor(driver, vm)); + goto cleanup; + } + if (qemuDomainObjExitMonitor(driver, vm) < 0) + goto cleanup; + + if ((ret = qemuDomainWaitForDeviceRemoval(vm)) == 1) + ret = qemuDomainRemoveRedirdevDevice(driver, vm, tmpRedirdevDef); + + cleanup: + qemuDomainResetDeviceRemoval(vm); + return ret; +} + int qemuDomainDetachNetDevice(virQEMUDriverPtr driver, diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h index 3e0d618e0..6c642c4fd 100644 --- a/src/qemu/qemu_hotplug.h +++ b/src/qemu/qemu_hotplug.h @@ -125,6 +125,9 @@ int qemuDomainDetachShmemDevice(virQEMUDriverPtr driver, int qemuDomainDetachWatchdog(virQEMUDriverPtr driver, virDomainObjPtr vm, virDomainWatchdogDefPtr watchdog); +int qemuDomainDetachRedirdevDevice(virQEMUDriverPtr driver, + virDomainObjPtr vm, + virDomainRedirdevDefPtr redirdev); int qemuDomainAttachInputDevice(virQEMUDriverPtr driver, virDomainObjPtr vm, -- 2.14.3

2 2

[libvirt] [PATCH] qemu: blockjob: Reset disk source index after pivot
by Peter Krempa 07 Dec '17

07 Dec '17

Since we are re-detecting the backing chain after pivoting to the active block commit target (or block copy target) the disk index needs to be reset to 0. This is necessary since we move a member of the backing chain to disk->src but clear indexes only starting from disk->src->backingStore. The freshly detected images have indexes starting from 1, but since we've pivoted into an image which was previously a backing store it would have a non-0 index. The lookup function would then return the top of the chain for queries like 'vda[1]' instead of the first backing store. This problem will not be present once we keep the disk indexes stable. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1519745 --- src/qemu/qemu_blockjob.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/qemu/qemu_blockjob.c b/src/qemu/qemu_blockjob.c index 0b1616a214..617e4ee564 100644 --- a/src/qemu/qemu_blockjob.c +++ b/src/qemu/qemu_blockjob.c @@ -175,6 +175,7 @@ qemuBlockJobEventProcess(virQEMUDriverPtr driver, disk->mirror = NULL; disk->mirrorState = VIR_DOMAIN_DISK_MIRROR_STATE_NONE; disk->mirrorJob = VIR_DOMAIN_BLOCK_JOB_TYPE_UNKNOWN; + disk->src->id = 0; ignore_value(qemuDomainDetermineDiskChain(driver, vm, disk, true, true)); ignore_value(qemuBlockNodeNamesDetect(driver, vm, asyncJob)); -- 2.15.0

2 1

[libvirt] [PATCH] libvirt-python : PyObject memory leak
by Peng Hao 07 Dec '17

07 Dec '17

libvirt_virConnectDomainEventTunableCallback leak a PyObject Signed-off-by: Peng Hao <peng.hao2(a)zte.com.cn> Signed-off-by: Wang Yechao <wang.yechao255(a)zte.com.cn> --- libvirt-override.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libvirt-override.c b/libvirt-override.c index d746350..eab9b62 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -6665,6 +6665,7 @@ libvirt_virConnectDomainEventTunableCallback(virConnectPtr conn ATTRIBUTE_UNUSED Py_XDECREF(pyobj_dict); } else { Py_DECREF(pyobj_ret); + Py_DECREF(pyobj_dict); ret = 0; } -- 1.8.3.1

2 1

[libvirt] [REBASE PATCH v2 00/10] Implement query-dump command
by John Ferlan 07 Dec '17

07 Dec '17

Original v2: https://www.redhat.com/archives/libvir-list/2017-November/msg00779.html Rebase due to additional capabilitiies v2 Cover: v1: https://www.redhat.com/archives/libvir-list/2017-November/msg00731.html Differences from v1 (besides more patches) Rather than use a timing loop in order to fetch the dump stats and the presence of the 'query-dump' command, let's use the DUMP_COMPLETED event and wire that up in order to determine when the dump has been completed. In the mean time, the previous timing loop is converted into a qemuDomainGetJobInfoDumpStats to be called if the "right conditions" exist. Also found/fixed a couple of minor issues from v1 regarding usage "dumpformat" instead of just "format" from my patch 2 adjustment and a type for qemuMonitorDumpStatus (was qemuMontiorDumpStatus in v1). NB: (from v1 cover): Details in the patches. Essentially though QEMU 2.6 added the ability to perform the 'dump-guest-memory' via a thread by adding a 'detach' boolean to the command. In order to watch the progress of the thread the 'query-dump' command was added. The query-dump will return just the current status, the total size to be dumped, and the current progress. So using the migrate stats data in the DomainJobInfo we can then save our current progress allowing tools such as virsh to watch that progress. As an added benefit, the dump-guest-memory is now truly asynchronous. John Ferlan (10): qemu: Clean up style for the qemuDumpToFd definition qemu: Alter dump-guest-memory command generation qemu: Add support for DUMP_COMPLETED event qemu: Introduce qemuProcessHandleDumpCompleted qemu: Introduce qemuMonitor[JSON]QueryDump qemu: Add new parameter to qemuMonitorDumpToFd qemu: Introduce qemuDomainGetJobInfoMigrationStats qemu: Introduce qemuDomainGetJobInfoDumpStats qemu: Add dump completed event to the capabilities qemu: Allow showing the dump progress for memory only dump src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_domain.c | 2 + src/qemu/qemu_domain.h | 2 + src/qemu/qemu_driver.c | 157 ++++++++++++++++++--- src/qemu/qemu_monitor.c | 39 ++++- src/qemu/qemu_monitor.h | 33 ++++- src/qemu/qemu_monitor_json.c | 122 ++++++++++++++-- src/qemu/qemu_monitor_json.h | 7 +- src/qemu/qemu_process.c | 23 +++ .../caps_2.10.0-gicv2.aarch64.xml | 1 + .../caps_2.10.0-gicv3.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.10.0.x86_64.xml | 1 + .../caps_2.6.0-gicv2.aarch64.xml | 1 + .../caps_2.6.0-gicv3.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.6.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.7.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.8.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.8.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.ppc64.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml | 1 + tests/qemumonitorjsontest.c | 3 +- 27 files changed, 365 insertions(+), 42 deletions(-) -- 2.13.6

2 12

[libvirt] [PATCHv2 0/7] Remove some repetitive code from qemuDomainNamespace* functions
by Ján Tomko 07 Dec '17

07 Dec '17

Rebased + rename path to paths in one more function. Ján Tomko (7): qemuDomainNamespaceTeardownHostdev: rename path to paths qemuDomainNamespaceSetupHostdev: rename path to paths Introduce qemuDomainNamespaceMknodPaths Introduce qemuDomainNamespaceMknodPath Introduce qemuDomainNamespaceUnlinkPaths Introduce qemuDomainNamespaceUnlinkPath Do not pass driver to qemuDomainNamespace{Setup,Teardown} functions src/qemu/qemu_domain.c | 394 ++++++++++++++++++------------------------------ src/qemu/qemu_domain.h | 30 ++-- src/qemu/qemu_driver.c | 2 +- src/qemu/qemu_hotplug.c | 42 +++--- 4 files changed, 176 insertions(+), 292 deletions(-) -- 2.13.6

3 11

[libvirt] [PATCH] qemuDomainNamespaceSetupDisk: initialize npaths
by Ján Tomko 07 Dec '17

07 Dec '17

Introduced by commit d3db304. Reported-by: John Ferlan <jferlan(a)redhat.com> --- Pushed as trivial. src/qemu/qemu_domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 75cecb1bb..d7150cae1 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -10034,7 +10034,7 @@ qemuDomainNamespaceSetupDisk(virDomainObjPtr vm, { virStorageSourcePtr next; char **paths = NULL; - size_t npaths; + size_t npaths = 0; int ret = -1; if (!qemuDomainNamespaceEnabled(vm, QEMU_DOMAIN_NS_MOUNT)) -- 2.13.6

1 0

[libvirt] [PATCH] docs: domain: Fix documentation of the 'snapshot' attribute for <disk>
by Peter Krempa 07 Dec '17

07 Dec '17

Emphasise the valid values by wrapping them in <code> and reword the last sentence so that the invalid value example can be dropped. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1523070 --- docs/formatdomain.html.in | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 29a9681467..01db83e608 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -2584,17 +2584,16 @@ <dt><code>snapshot</code></dt> <dd> Indicates the default behavior of the disk during disk snapshots: - "internal" requires a file format such as qcow2 that can store - both the snapshot and the data changes since the snapshot; - "external" will separate the snapshot from the live data; and - "no" means the disk will not participate in snapshots. Read-only - disks default to "no", while the default for other disks depends - on the hypervisor's capabilities. Some hypervisors allow a - per-snapshot choice as well, during + "<code>internal</code>" requires a file format such as qcow2 that + can store both the snapshot and the data changes since the snapshot; + "<code>external</code>" will separate the snapshot from the live + data; and "<code>no</code>" means the disk will not participate in + snapshots. Read-only disks default to "<code>no</code>", while the + default for other disks depends on the hypervisor's capabilities. + Some hypervisors allow a per-snapshot choice as well, during <a href="formatsnapshot.html">domain snapshot creation</a>. - Not all snapshot modes are supported; for example, - <code>snapshot='yes'</code> with a transient disk generally - does not make sense. + Not all snapshot modes are supported; for example, enabling + snapshots with a transient disk generally does not make sense. <span class="since">Since 0.9.5</span> </dd> </dl> -- 2.15.0

2 1

[libvirt] [PATCH] virerror: mark VIR_ERR_AGENT_UNSYNCED as DEPRECATED
by Chen Hanxiao 07 Dec '17

07 Dec '17

From: Chen Hanxiao <chenhanxiao(a)gmail.com> Since commit 5e5019bf, we've no longer use VIR_ERR_AGENT_UNSYNCED anymore. Mark it as DEPRECATED. Signed-off-by: Chen Hanxiao <chenhanxiao(a)gmail.com> --- include/libvirt/virterror.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/libvirt/virterror.h b/include/libvirt/virterror.h index d2b5f1fd4..91ba29784 100644 --- a/include/libvirt/virterror.h +++ b/include/libvirt/virterror.h @@ -318,7 +318,7 @@ typedef enum { VIR_ERR_NO_SERVER = 95, /* Server was not found */ VIR_ERR_NO_CLIENT = 96, /* Client was not found */ VIR_ERR_AGENT_UNSYNCED = 97, /* guest agent replies with wrong id - to guest-sync command */ + to guest-sync command (DEPRECATED)*/ VIR_ERR_LIBSSH = 98, /* error in libssh transport driver */ } virErrorNumber; -- 2.14.3

2 3

[libvirt] Snapshot: Request to review patch
by Madhu Pavan 07 Dec '17

07 Dec '17

Hi all, Could someone please review https://www.redhat.com/archives/libvir-list/2017-October/msg01333.html This patch is based on comments from Jiri Denemark ( https://www.redhat.com/archives/libvir-list/2017-October/msg01275.html ) This patch potentially fixes https://bugzilla.redhat.com/show_bug.cgi?id=1494471 Thanks, Madhu.

2 1

[libvirt] [PATCH] storage: Don't dereference driver object if virStorageSource is not initialized
by Peter Krempa 07 Dec '17

07 Dec '17

virStorageFileReportBrokenChain uses data from the driver private data pointer to print the user and group. This would lead to a crash in call paths where we did not initialize the storage backend as recently added in commit 24e47ee2b93 to qemuDomainDetermineDiskChain. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1522682 --- Once pushed I'll also backport it to a maint branch of the last release if that's desired. src/storage/storage_source.c | 38 ++++++++++++++++++++++++++------------ 1 file changed, 26 insertions(+), 12 deletions(-) diff --git a/src/storage/storage_source.c b/src/storage/storage_source.c index 4586ef4ad4..a5df84bae3 100644 --- a/src/storage/storage_source.c +++ b/src/storage/storage_source.c @@ -419,19 +419,33 @@ virStorageFileReportBrokenChain(int errcode, virStorageSourcePtr src, virStorageSourcePtr parent) { - unsigned int access_user = src->drv->uid; - unsigned int access_group = src->drv->gid; - - if (src == parent) { - virReportSystemError(errcode, - _("Cannot access storage file '%s' " - "(as uid:%u, gid:%u)"), - src->path, access_user, access_group); + + if (src->drv) { + unsigned int access_user = src->drv->uid; + unsigned int access_group = src->drv->gid; + + if (src == parent) { + virReportSystemError(errcode, + _("Cannot access storage file '%s' " + "(as uid:%u, gid:%u)"), + src->path, access_user, access_group); + } else { + virReportSystemError(errcode, + _("Cannot access backing file '%s' " + "of storage file '%s' (as uid:%u, gid:%u)"), + src->path, parent->path, access_user, access_group); + } } else { - virReportSystemError(errcode, - _("Cannot access backing file '%s' " - "of storage file '%s' (as uid:%u, gid:%u)"), - src->path, parent->path, access_user, access_group); + if (src == parent) { + virReportSystemError(errcode, + _("Cannot access storage file '%s' "), + src->path); + } else { + virReportSystemError(errcode, + _("Cannot access backing file '%s' " + "of storage file '%s'"), + src->path, parent->path); + } } } -- 2.15.0

2 2

[libvirt] [PATCH php v2] Fix crash in VIRT_HASH_CURRENT_KEY_INFO macro
by Dawid Zamirski 07 Dec '17

07 Dec '17

The PHP7 variant of the macro wasn't safe if the hash key was not a string type. This was found when running php script with just libvirt_connect call under xdebug session which segfaulted. This patch makes the following changes: * make sure that tmp_name is initialized to NULL * set the key name only when zend_hash_get_current_key_ex did set it to something which happens only when type is HASH_KEY_IS_STRING * stash the key index in out php_libvirt_hash_key_info struct because it wasn't there before and separate variable had to be used. --- v1: https://www.redhat.com/archives/libvir-list/2017-December/msg00151.html Changes since v1: * use zend_ulong in php_libvirt_hash_key_info struct so that no type cast is needed src/libvirt-connection.c | 8 +++----- src/libvirt-php.c | 6 ++---- src/libvirt-php.h | 1 + src/util.h | 16 +++++++++------- 4 files changed, 15 insertions(+), 16 deletions(-) diff --git a/src/libvirt-connection.c b/src/libvirt-connection.c index 181b266..2d59d82 100644 --- a/src/libvirt-connection.c +++ b/src/libvirt-connection.c @@ -131,8 +131,6 @@ PHP_FUNCTION(libvirt_connect) HashPosition pointer; int array_count; - zend_ulong index; - unsigned long libVer; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sba", &url, &url_len, &readonly, &zcreds) == FAILURE) { @@ -176,13 +174,13 @@ PHP_FUNCTION(libvirt_connect) VIRT_FOREACH(arr_hash, pointer, data) { if (Z_TYPE_P(data) == IS_STRING) { php_libvirt_hash_key_info info; - VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, index, info); + VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, info); if (info.type == HASH_KEY_IS_STRING) { PHPWRITE(info.name, info.length); } else { - DPRINTF("%s: credentials index %d\n", PHPFUNC, (int)index); - creds[j].type = index; + DPRINTF("%s: credentials index %d\n", PHPFUNC, info.index); + creds[j].type = info.index; creds[j].result = (char *)emalloc(Z_STRLEN_P(data) + 1); memset(creds[j].result, 0, Z_STRLEN_P(data) + 1); creds[j].resultlen = Z_STRLEN_P(data); diff --git a/src/libvirt-php.c b/src/libvirt-php.c index ef057fe..efbef58 100644 --- a/src/libvirt-php.c +++ b/src/libvirt-php.c @@ -1921,7 +1921,6 @@ long get_next_free_numeric_value(virDomainPtr domain, char *xpath) HashPosition pointer; // int array_count; zval *data; - unsigned long index; long max_slot = -1; xml = virDomainGetXMLDesc(domain, VIR_DOMAIN_XML_INACTIVE); @@ -1934,7 +1933,7 @@ long get_next_free_numeric_value(virDomainPtr domain, char *xpath) VIRT_FOREACH(arr_hash, pointer, data) { if (Z_TYPE_P(data) == IS_STRING) { php_libvirt_hash_key_info info; - VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, index, info); + VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, info); if (info.type != HASH_KEY_IS_STRING) { long num = -1; @@ -2439,7 +2438,6 @@ void parse_array(zval *arr, tVMDisk *disk, tVMNetwork *network) zval *data; php_libvirt_hash_key_info key; HashPosition pointer; - unsigned long index; arr_hash = Z_ARRVAL_P(arr); //array_count = zend_hash_num_elements(arr_hash); @@ -2451,7 +2449,7 @@ void parse_array(zval *arr, tVMDisk *disk, tVMNetwork *network) VIRT_FOREACH(arr_hash, pointer, data) { if ((Z_TYPE_P(data) == IS_STRING) || (Z_TYPE_P(data) == IS_LONG)) { - VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, index, key); + VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, key); if (key.type == HASH_KEY_IS_STRING) { if (disk != NULL) { if ((Z_TYPE_P(data) == IS_STRING) && strcmp(key.name, "path") == 0) diff --git a/src/libvirt-php.h b/src/libvirt-php.h index 8d13a6b..aea43a2 100644 --- a/src/libvirt-php.h +++ b/src/libvirt-php.h @@ -137,6 +137,7 @@ typedef struct tVMNetwork { typedef struct _php_libvirt_hash_key_info { char *name; unsigned int length; + zend_ulong index; unsigned int type; } php_libvirt_hash_key_info; diff --git a/src/util.h b/src/util.h index ecb3a1f..fcd4075 100644 --- a/src/util.h +++ b/src/util.h @@ -135,12 +135,14 @@ # define VIRT_FOREACH_END(_dummy) -# define VIRT_HASH_CURRENT_KEY_INFO(_ht, _pos, _idx, _info) \ +# define VIRT_HASH_CURRENT_KEY_INFO(_ht, _pos, _info) \ do { \ - zend_string *tmp_key_info; \ - _info.type = zend_hash_get_current_key_ex(_ht, &tmp_key_info, &_idx, &_pos); \ - _info.name = ZSTR_VAL(tmp_key_info); \ - _info.length = ZSTR_LEN(tmp_key_info); \ + zend_string *tmp_name = NULL; \ + _info.type = zend_hash_get_current_key_ex(_ht, &tmp_name, &_info.index, &_pos); \ + if (tmp_name) { \ + _info.name = ZSTR_VAL(tmp_name); \ + _info.length = ZSTR_LEN(tmp_name); \ + } \ } while(0) # define VIRT_ARRAY_INIT(_name) do { \ @@ -213,9 +215,9 @@ # define VIRT_FOREACH_END(_dummy) \ }} -# define VIRT_HASH_CURRENT_KEY_INFO(_ht, _pos, _idx, _info) \ +# define VIRT_HASH_CURRENT_KEY_INFO(_ht, _pos, _info) \ do { \ - _info.type = zend_hash_get_current_key_ex(_ht, &_info.name, &_info.length, &_idx, 0, &_pos); \ + _info.type = zend_hash_get_current_key_ex(_ht, &_info.name, &_info.length, &_info.index, 0, &_pos); \ } while(0) # define VIRT_ARRAY_INIT(_name) do {\ -- 2.14.3

2 1

[libvirt] [PATCH] nwfilter: fix deadlock on firewalld restart/reload
by Nikolay Shirokovskiy 07 Dec '17

07 Dec '17

Deadlock scenario: 1. domain is being started and domain driver takes read lock for nwfilter update lock thru virNWFilterReadLockFilterUpdates. 2. firewalld restarted and event loop hangs trying to take write lock for nwfilter update lock in nwfilterStateReload. This is deadlock because for thread 1 to proceed we need a response from qemu/timeout but whole event loop is stuck by 2. Let's just offload nwfilter driver reload to a distinct thread. Besides resolving a deadlock this change offloads rather heavy operation (many hypervisor drivers X many domains for a driver) off the event loop. --- Concrete stacktrace. Thread 17 (Thread 0x7fbd5a22d880 (LWP 7329)): 0 0x00007fbd56bb903e in pthread_rwlock_wrlock () from /lib64/libpthread.so.0 1 0x00007fbd3d511297 in nwfilterStateReload () from /usr/lib64/libvirt/connection-driver/libvirt_driver_nwfilter.so 2 0x00007fbd3d511355 in nwfilterFirewalldDBusFilter () from /usr/lib64/libvirt/connection-driver/libvirt_driver_nwfilter.so 3 0x00007fbd57bc5dfe in dbus_connection_dispatch () from /lib64/libdbus-1.so.3 4 0x00007fbd5953e641 in virDBusWatchCallback () from /lib64/libvirt.so.0 5 0x00007fbd5954868e in virEventPollRunOnce () from /lib64/libvirt.so.0 6 0x00007fbd59547942 in virEventRunDefaultImpl () from /lib64/libvirt.so.0 7 0x00007fbd596a94ed in virNetDaemonRun () from /lib64/libvirt.so.0 8 0x00007fbd5a28b07c in main () Thread 3 (Thread 0x7fbd49553700 (LWP 8029)): 0 0x00007fbd56bb96d5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib64/libpthread.so.0 1 0x00007fbd59596816 in virCondWait () from /lib64/libvirt.so.0 2 0x00007fbd3d0183db in qemuMonitorSend () from /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so 3 0x00007fbd3d02c8d0 in qemuMonitorJSONCommandWithFd () from /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so 4 0x00007fbd3d02e1a1 in qemuMonitorJSONSetCapabilities () from /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so 5 0x00007fbd3cff965c in qemuConnectMonitor () from /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so 6 0x00007fbd3cffcb70 in qemuProcessWaitForMonitor () from /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so 7 0x00007fbd3d004668 in qemuProcessLaunch () from /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so 8 0x00007fbd3d0062a8 in qemuProcessStart () from /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so 9 0x00007fbd3d0679cb in qemuDomainObjStart.constprop.50 () from /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so 10 0x00007fbd3d068106 in qemuDomainCreateWithFlags () from /usr/lib64/libvirt/connection-driver/libvirt_driver_qemu.so 11 0x00007fbd5964247d in virDomainCreateWithFlags () from /lib64/libvirt.so.0 12 0x00007fbd5a2a3b81 in remoteDispatchDomainCreateWithFlagsHelper () 13 0x00007fbd596af3c3 in virNetServerProgramDispatch () from /lib64/libvirt.so.0 14 0x00007fbd5a2c56cd in virNetServerHandleJob () 15 0x00007fbd59597221 in virThreadPoolWorker () from /lib64/libvirt.so.0 16 0x00007fbd595965a8 in virThreadHelper () from /lib64/libvirt.so.0 17 0x00007fbd56bb5dc5 in start_thread () from /lib64/libpthread.so.0 18 0x00007fbd568e473d in clone () from /lib64/libc.so.6 src/nwfilter/nwfilter_driver.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c index 2f9a51c..bcb4400 100644 --- a/src/nwfilter/nwfilter_driver.c +++ b/src/nwfilter/nwfilter_driver.c @@ -81,6 +81,12 @@ static void nwfilterDriverUnlock(void) #if HAVE_FIREWALLD +static void +nwfilterStateReloadAdapter(void *opaque ATTRIBUTE_UNUSED) +{ + nwfilterStateReload(); +} + static DBusHandlerResult nwfilterFirewalldDBusFilter(DBusConnection *connection ATTRIBUTE_UNUSED, DBusMessage *message, @@ -90,8 +96,12 @@ nwfilterFirewalldDBusFilter(DBusConnection *connection ATTRIBUTE_UNUSED, "NameOwnerChanged") || dbus_message_is_signal(message, "org.fedoraproject.FirewallD1", "Reloaded")) { + virThread thread; + VIR_DEBUG("Reload in nwfilter_driver because of firewalld."); - nwfilterStateReload(); + if (virThreadCreate(&thread, false, nwfilterStateReloadAdapter, NULL) < 0) + VIR_ERROR(_("Could not create thread. Network filter " + "driver reload failed")); } return DBUS_HANDLER_RESULT_NOT_YET_HANDLED; -- 1.8.3.1

2 2

[libvirt] [PATCH v2 00/15] Move qemu command line controller checks to qemuDomainDeviceDefValidateController* checks
by John Ferlan 07 Dec '17

07 Dec '17

v1: https://www.redhat.com/archives/libvir-list/2017-December/msg00079.html Changes since v1: * Remove USB from the pile of things to move. That simplifies the Skip helper to remove the @flags argument. Even though it seems there was some sort of objection to Skip'ing during Validation I left that call in place since I feel it's better to have one common function rather than cutting out each individual check and placing it into the various ValidateController{IDE|PCI|SATA} helpers. Having two places to maintain such checks is less optimal in my viewpoint. * Be sure to Unref qemuCaps in patch 4 John Ferlan (12): qemu: Introduce qemuDomainDeviceDefValidateController qemu: Introduce qemuDomainDeviceDefSkipController qemu: Use virDomainControllerType in qemuBuildControllerDevStr switch qemu: Move CCW S390 Address check to controller def validate qemu: Introduce qemuDomainDeviceDefValidateControllerSCSI qemu: Introduce qemuDomainDeviceDefValidateControllerPCI qemu: Use virDomainPCIControllerOpts in qemuBuildControllerDevStr qemu: Move PCI command modelName check to controller def validate qemu: Move PCI command modelName TypeToString to controller def validate qemu: Move PCI more command checks to controller def validate qemu: Complete PCI command checks to controller def validate qemu: Introduce qemuDomainDeviceDefValidateControllerSATA Lin Ma (3): tests: Remove use of IDE disk for pseries floppy test tests: Drop IDE controller in CCW qemu: Introduce qemuDomainDeviceDefValidateControllerIDE src/qemu/qemu_command.c | 467 ++------------------ src/qemu/qemu_domain.c | 483 ++++++++++++++++++++- src/qemu/qemu_domain.h | 4 + .../qemuhotplug-base-ccw-live+ccw-virtio.xml | 4 - ...ive-with-2-ccw-virtio+ccw-virtio-1-explicit.xml | 4 - ...live-with-2-ccw-virtio+ccw-virtio-1-reverse.xml | 4 - ...qemuhotplug-base-ccw-live-with-2-ccw-virtio.xml | 4 - ...-live-with-ccw-virtio+ccw-virtio-2-explicit.xml | 4 - ...-base-ccw-live-with-ccw-virtio+ccw-virtio-2.xml | 4 - .../qemuhotplug-base-ccw-live-with-ccw-virtio.xml | 4 - .../qemuhotplug-base-ccw-live.xml | 4 - tests/qemumemlocktest.c | 14 + tests/qemuxml2argvdata/disk-floppy-pseries.args | 24 - tests/qemuxml2argvdata/disk-floppy-pseries.xml | 7 - tests/qemuxml2xmltest.c | 5 +- 15 files changed, 549 insertions(+), 487 deletions(-) delete mode 100644 tests/qemuxml2argvdata/disk-floppy-pseries.args -- 2.13.6

1 16

[libvirt] [PATCH] docs: remove outdated link to Fedora mingw staging repo
by Daniel P. Berrange 06 Dec '17

06 Dec '17

The Fedora mingw support is all merged in Fedora repos, so remove the outdated link. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- docs/windows.html.in | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/docs/windows.html.in b/docs/windows.html.in index df60940750..3f012d18da 100644 --- a/docs/windows.html.in +++ b/docs/windows.html.in @@ -169,9 +169,7 @@ <p> You can also cross-compile to a Windows target from a Fedora machine - using the packages available - <a href="http://hg.et.redhat.com/misc/fedora-mingw--devel/">from the Fedora MinGW project</a> - (which includes a working libvirt specfile). + using the packages available in the Fedora repos. </p> <h3><a id="configure">By hand</a></h3> -- 2.14.3

2 1

[libvirt] [PATCH] docs: update entries in the apps page
by Daniel P. Berrange 06 Dec '17

06 Dec '17

Change all links to https:// where the remote site supports it. Fix URLs for a few packages that moved, and delete entries which appear to be dead. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- docs/apps.html.in | 70 ++++++++++++++++++++++++------------------------------- 1 file changed, 30 insertions(+), 40 deletions(-) diff --git a/docs/apps.html.in b/docs/apps.html.in index 60edeb3af4..863be4ff23 100644 --- a/docs/apps.html.in +++ b/docs/apps.html.in @@ -65,21 +65,21 @@ management tasks on all libvirt managed domains, networks and storage. This is part of the libvirt core distribution. </dd> - <dt><a href="http://virt-manager.org/">virt-clone</a></dt> + <dt><a href="https://virt-manager.org/">virt-clone</a></dt> <dd> Allows the disk image(s) and configuration for an existing virtual machine to be cloned to form a new virtual machine. It automates copying of data across to new disk images, and updates the UUID, MAC address, and name in the configuration. </dd> - <dt><a href="http://et.redhat.com/~rjones/virt-df/">virt-df</a></dt> + <dt><a href="https://people.redhat.com/rjones/virt-df/">virt-df</a></dt> <dd> Examine the utilization of each filesystem in a virtual machine from the comfort of the host machine. This tool peeks into the guest disks and determines how much space is used. It can cope with common Linux filesystems and LVM volumes. </dd> - <dt><a href="http://virt-manager.org/">virt-image</a></dt> + <dt><a href="https://virt-manager.org/">virt-image</a></dt> <dd> Provides a way to deploy virtual appliances. It defines a simplified portable XML format describing the pre-requisites @@ -87,26 +87,26 @@ into the domain XML format for execution under any libvirt hypervisor meeting the pre-requisites. </dd> - <dt><a href="http://virt-manager.org/">virt-install</a></dt> + <dt><a href="https://virt-manager.org/">virt-install</a></dt> <dd> Provides a way to provision new virtual machines from a OS distribution install tree. It supports provisioning from local CD images, and the network over NFS, HTTP and FTP. </dd> - <dt><a href="http://et.redhat.com/~rjones/virt-top/">virt-top</a></dt> + <dt><a href="https://people.redhat.com/rjones/virt-top/">virt-top</a></dt> <dd> Watch the CPU, memory, network and disk utilization of all virtual machines running on a host. </dd> <dt> - <a href="http://people.redhat.com/~rjones/virt-what/">virt-what</a> + <a href="https://people.redhat.com/~rjones/virt-what/">virt-what</a> </dt> <dd> virt-what is a shell script for detecting if the program is running in a virtual machine. It prints out a list of facts about the virtual machine, derived from heuristics. </dd> - <dt><a href="http://sourceware.org/systemtap/">stap</a></dt> + <dt><a href="https://sourceware.org/systemtap/">stap</a></dt> <dd> SystemTap is a tool used to gather rich information about a running system through the use of scripts. Starting from v2.4, the front-end @@ -142,7 +142,7 @@ <h2><a id="continuousintegration">Continuous Integration</a></h2> <dl> - <dt><a href="http://buildbot.net/buildbot/docs/current/Libvirt.html">BuildBot</a></dt> + <dt><a href="https://buildbot.net/buildbot/docs/current/Libvirt.html">BuildBot</a></dt> <dd> BuildBot is a system to automate the compile/test cycle required by most software projects. CVS commits trigger new builds, run on @@ -152,7 +152,7 @@ </dl> <dl> - <dt><a href="http://wiki.jenkins-ci.org/display/JENKINS/Libvirt+Slaves+Plugin">Jenkins</a></dt> + <dt><a href="https://wiki.jenkins-ci.org/display/JENKINS/Libvirt+Slaves+Plugin">Jenkins</a></dt> <dd> This plugin for Jenkins adds a way to control guest domains hosted on Xen or QEMU/KVM. You configure a Jenkins Slave, @@ -197,28 +197,28 @@ <h2><a id="desktop">Desktop applications</a></h2> <dl> - <dt><a href="http://virt-manager.org/">virt-manager</a></dt> + <dt><a href="https://virt-manager.org/">virt-manager</a></dt> <dd> A general purpose desktop management tool, able to manage virtual machines across both local and remotely accessed hypervisors. It is targeted at home and small office usage up to managing 10-20 hosts and their VMs. </dd> - <dt><a href="http://virt-manager.org/">virt-viewer</a></dt> + <dt><a href="https://virt-manager.org/">virt-viewer</a></dt> <dd> A lightweight tool for accessing the graphical console associated with a virtual machine. It can securely connect to remote consoles supporting the VNC protocol. Also provides an optional mozilla browser plugin. </dd> - <dt><a href="http://f1ash.github.io/qt-virt-manager">qt-virt-manager</a></dt> + <dt><a href="https://f1ash.github.io/qt-virt-manager">qt-virt-manager</a></dt> <dd> The Qt GUI for create and control VMs and another virtual entities (aka networks, storages, interfaces, secrets, network filters). Contains integrated LXC/SPICE/VNC viewer for accessing the graphical or text console associated with a virtual machine or container. </dd> - <dt><a href="http://f1ash.github.io/qt-virt-manager/#virtual-machines-viewer">qt-remote-viewer</a></dt> + <dt><a href="https://f1ash.github.io/qt-virt-manager/#virtual-machines-viewer">qt-remote-viewer</a></dt> <dd> The Qt VNC/SPICE viewer for access to remote desktops or VMs. </dd> @@ -234,17 +234,7 @@ it easy to benefit from private Cloud Computing technology. </dd> - <dt><a href="http://www.emotivecloud.net">EMOTIVE Cloud</a></dt> - <dd>The EMOTIVE (Elastic Management Of Tasks In Virtualized - Environments) middleware allows executing tasks and providing - virtualized environments to the users with Xen, KVM or - VirtualBox hypervisor. EMOTIVE's main feature is VM management - with different scheduling policies. It can be also used as a - cloud provider and is very easy to extend thanks to its - modular Web Services architecture. - </dd> - - <dt><a href="http://www.eucalyptus.com">Eucalyptus</a></dt> + <dt><a href="https://github.com/eucalyptus/eucalyptus">Eucalyptus</a></dt> <dd> Eucalyptus is an on-premise Infrastructure as a Service cloud software platform that is open source and @@ -268,7 +258,7 @@ management. </dd> - <dt><a href="http://www.openstack.org">OpenStack</a></dt> + <dt><a href="https://www.openstack.org">OpenStack</a></dt> <dd> OpenStack is a "cloud operating system" usable for both public and private clouds. Its various parts take care of compute, @@ -314,7 +304,7 @@ Windows Registry in Windows guests. </dd> - <dt><a href="http://sandbox.libvirt.org">libvirt-sandbox</a></dt> + <dt><a href="https://sandbox.libvirt.org">libvirt-sandbox</a></dt> <dd> A library and command line tools for simplifying the creation of application sandboxes using virtualization technology. It currently @@ -334,7 +324,7 @@ <h2><a id="livecd">LiveCD / Appliances</a></h2> <dl> - <dt><a href="http://et.redhat.com/~rjones/virt-p2v/">virt-p2v</a></dt> + <dt><a href="http://libguestfs.org/virt-v2v/">virt-p2v</a></dt> <dd> An older tool for converting a physical machine into a virtual machine. It is a LiveCD which is booted on the machine to be @@ -346,7 +336,7 @@ <h2><a id="monitoring">Monitoring</a></h2> <dl> - <dt><a href="http://collectd.org/plugins/libvirt.shtml">collectd</a></dt> + <dt><a href="https://collectd.org/plugins/libvirt.shtml">collectd</a></dt> <dd> The libvirt-plugin is part of <a href="http://collectd.org/">collectd</a> and gathers statistics about virtualized guests on a system. This @@ -355,19 +345,19 @@ For a full description, please refer to the libvirt section in the collectd.conf(5) manual page. </dd> - <dt><a href="http://host-sflow.sourceforge.net/">Host sFlow</a></dt> + <dt><a href="http://www.sflow.net/">Host sFlow</a></dt> <dd> Host sFlow is a lightweight agent running on KVM hypervisors that links to libvirt library and exports standardized cpu, memory, network and disk metrics for all virtual machines. </dd> - <dt><a href="http://honk.sigxcpu.org/projects/libvirt/#munin">Munin</a></dt> + <dt><a href="https://honk.sigxcpu.org/projects/libvirt/#munin">Munin</a></dt> <dd> The plugins provided by Guido Günther allow to monitor various things like network and block I/O with <a href="http://munin.projects.linpro.no/">Munin</a>. </dd> - <dt><a href="http://et.redhat.com/~rjones/nagios-virt/">Nagios-virt</a></dt> + <dt><a href="http://people.redhat.com/rjones/nagios-virt/">Nagios-virt</a></dt> <dd> Nagios-virt is a configuration tool to add monitoring of your virtualised domains to <a href="http://www.nagios.org/">Nagios</a>. @@ -383,7 +373,7 @@ metrics. It supports pCPU, vCPU, memory, block device, network interface, and performance event metrics for each virtual guest. </dd> - <dt><a href="http://community.zenoss.org/docs/DOC-4687">Zenoss</a></dt> + <dt><a href="https://community.zenoss.org/docs/DOC-4687">Zenoss</a></dt> <dd> The Zenoss libvirt Zenpack adds support for monitoring virtualization servers. It has been tested with KVM, QEMU, VMware ESX, and VMware @@ -394,7 +384,7 @@ <h2><a id="provisioning">Provisioning</a></h2> <dl> - <dt><a href="http://www.ibm.com/software/tivoli/products/prov-mgr/">Tivoli Provisioning Manager</a></dt> + <dt><a href="https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/Tivo…">Tivoli Provisioning Manager</a></dt> <dd> Part of the IBM Tivoli family, Tivoli Provisioning Manager (TPM) is an IT lifecycle automation product. It @@ -404,7 +394,7 @@ </dl> <dl> - <dt><a href="http://theforeman.org">Foreman</a></dt> + <dt><a href="https://theforeman.org">Foreman</a></dt> <dd> Foreman is an open source web based application aimed to be a Single Address For All Machines Life Cycle Management. Foreman: @@ -428,7 +418,7 @@ <h2><a id="web">Web applications</a></h2> <dl> - <dt><a href="http://community.abiquo.com/display/AbiCloud">AbiCloud</a></dt> + <dt><a href="http://www.abiquo.com/">AbiCloud</a></dt> <dd> AbiCloud is an open source cloud platform manager which allows to easily deploy a private cloud in your datacenter. One of the key @@ -444,14 +434,14 @@ Kimchi manages KVM guests through libvirt. The management interface is accessed over the web using a browser that supports HTML5. </dd> - <dt><a href="http://ovirt.org/">oVirt</a></dt> + <dt><a href="https://ovirt.org/">oVirt</a></dt> <dd> oVirt provides the ability to manage large numbers of virtual machines across an entire data center of hosts. It integrates with FreeIPA for Kerberos authentication, and in the future, certificate management. </dd> - <dt><a href="http://ispsystem.com/en/software/vmmanager">VMmanager</a></dt> + <dt><a href="https://ispsystem.com/en/software/vmmanager">VMmanager</a></dt> <dd> VMmanager is a software solution for virtualization management that can be used both for hosting virtual machines and @@ -460,7 +450,7 @@ functions, such as live migration that allows for load balancing between cluster nodes, monitoring CPU, memory. </dd> - <dt><a href="http://mist.io/">mist.io</a></dt> + <dt><a href="https://mist.io/">mist.io</a></dt> <dd> Mist.io is an open source project and a service that can assist you in managing your virtual machines on a unified way, providing a simple @@ -468,7 +458,7 @@ providers, OpenStack based public/private clouds, Docker servers, bare metal servers and now KVM hypervisors). </dd> - <dt><a href="http://ravada.upc.edu/">Ravada</a></dt> + <dt><a href="https://ravada.upc.edu/">Ravada</a></dt> <dd> Ravada is an open source tool for managing Virtual Desktop Infrastructure (VDI). It is very easy to install and use. Following @@ -492,7 +482,7 @@ <h2><a id="other">Other</a></h2> <dl> - <dt><a href="http://cuckoosandbox.org/">Cuckoo Sandbox</a></dt> + <dt><a href="https://cuckoosandbox.org/">Cuckoo Sandbox</a></dt> <dd> Cuckoo Sandbox is a malware analysis system. You can throw any suspicious file at it and in a matter of seconds Cuckoo -- 2.14.3

2 1

[libvirt] [PATCH] docs: update instructions for TLS cert generation
by Daniel P. Berrange 06 Dec '17

06 Dec '17

Currently we only describe setting the CN field for server certs. This leads to inevitable pain for users who set it to the fully qualified hostname and then use a unqualified hostname or IP address to connect in the URI. Describe the usage of Subject Alt Name extensions, to provide multiple hostnames and IP addresses. This will help users avoid the classic mistake and is important future proofing, since at least in browsers, TLS libraries no longer use the CN field for validation, mandating use of SAN info instead. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- docs/remote.html.in | 72 ++++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 52 insertions(+), 20 deletions(-) diff --git a/docs/remote.html.in b/docs/remote.html.in index 9bafd9de67..6ae40b2bb2 100644 --- a/docs/remote.html.in +++ b/docs/remote.html.in @@ -30,7 +30,7 @@ to <code>virConnectOpen</code> (or <code>virsh -c ...</code>). For example, if you normally use <code>qemu:///system</code> to access the system-wide QEMU daemon, then to access the system-wide QEMU daemon on a remote machine called -<code>oirase</code> you would use <code>qemu://oirase/system</code>. +<code>compute1.libvirt.org</code> you would use <code>qemu://compute1.libvirt.org/system</code>. </p> <p> The <a href="#Remote_URI_reference">section on remote URIs</a> @@ -412,7 +412,9 @@ next section. <td> Server's certificate signed by the CA. (<a href="#Remote_TLS_server_certificates">more info</a>) </td> <td> CommonName (CN) must be the hostname of the server as it - is seen by clients. </td> + is seen by clients. All hostname and IP address variants that might + be used to reach the server should be lkisted in Subject Alt Name + fields.</td> </tr> <tr> <td> @@ -564,8 +566,8 @@ X.509 certificate info: Version: 3 Serial Number (hex): 00 -Subject: CN=Red Hat Emerging Technologies -Issuer: CN=Red Hat Emerging Technologies +Subject: CN=Libvirt Project +Issuer: CN=Libvirt Project Signature Algorithm: RSA-SHA Validity: Not Before: Mon Jun 18 16:22:18 2007 @@ -582,14 +584,20 @@ for your clients and servers. </h3> <p> For each server (libvirtd) you need to issue a certificate -with the X.509 CommonName (CN) field set to the hostname -of the server. The CN must match the hostname which -clients will be using to connect to the server. +containing one or more hostnames and/or IP addresses. +Historically the CommonName (CN) field would contain the +hostname of the server, and would match the hostname used +in the URI that clients pass to libvirt. In most TLS impls +the CN field is considered legacy data, the Subject Alt Name +(SAN) extension fields we be preferentially validated against. +In the future use of the CN field for validation may be +discontinuned entirely, so it is strongly recommended to +include the SAN fields. </p> <p> In the example below, clients will be connecting to the server using a <a href="#Remote_URI_reference">URI</a> of -<code>xen://oirase/</code>, so the CN must be "<code>oirase</code>". +<code>xen://virt.example/</code>, so the CN must be "<code>oirase</code>". </p> <p> Make a private key for the server: @@ -599,13 +607,25 @@ certtool --generate-privkey > serverkey.pem </pre> <p> and sign that key with the CA's private key by first -creating a template file called <code>server.info</code> -(only the CN field matters, which as explained above must -be the server's hostname): +creating a template file called <code>server.info</code>. +The 'cn' field should refer to the fully qualified public +hostname of the server. For the SAN extension data, there +must also be one or more 'dns_name' fields that contain all +possible hostnames that can be reasonably used by clients +to reach the server, both with and without domain name +qualifiers. If clients are likely to connect to the server +by IP address, then one or 'ip_address' fields should also +be added. </p> <pre> organization = <i>Name of your organization</i> -cn = oirase +cn = compute1.libvirt.org +dns_name = compute1 +dns_name = compute1.libvirt.org +ip_address = 10.0.0.74 +ip_address = 192.168.1.24 +ip_address = 2001:cafe::74 +ip_address = fe20::24 tls_www_server encryption_key signing_key @@ -635,16 +655,28 @@ X.509 certificate info: Version: 3 Serial Number (hex): 00 -Subject: O=Red Hat Emerging Technologies,CN=oirase -Issuer: CN=Red Hat Emerging Technologies +Subject: O=Libvirt Project,CN=compute1.libvirt.org +Issuer: CN=Libvirt Project Signature Algorithm: RSA-SHA Validity: Not Before: Mon Jun 18 16:34:49 2007 Not After: Tue Jun 17 16:34:49 2008 +Extensions: + Basic Constraints (critical): + Certificate Authority (CA): FALSE + Subject Alternative Name (not critical): + DNSname: compute1 + DNSname: compute1.libvirt.org + IPAddress: 10.0.0.74 + IPAddress: 192.168.1.24 + IPAddress: 2001:cafe::74 + IPAddress: fe20::24 </pre> <p> -Note the "Issuer" CN is "Red Hat Emerging Technologies" (the CA) and -the "Subject" CN is "oirase" (the server). +Note the "Issuer" CN is "Libvirt Project" (the CA) and +the "Subject" CN is "compute1.libvirt.org" (the server). +Notice that the hostname listed in the CN must also +be duplicated as a DNSname entry </p> <p> Finally we have two files to install: @@ -665,13 +697,13 @@ which can be installed on the server as </h3> <p> For each client (ie. any program linked with libvirt, such as -<a href="http://virt-manager.et.redhat.com/">virt-manager</a>) +<a href="http://virt-manager.org/">virt-manager</a>) you need to issue a certificate with the X.509 Distinguished Name (DN) set to a suitable name. You can decide this on a company / organisation policy. For example, I use: </p> <pre> -C=GB,ST=London,L=London,O=Red Hat,CN=<i>name_of_client</i> +C=GB,ST=London,L=London,O=Libvirt Project,CN=<i>name_of_client</i> </pre> <p> The process is the same as for @@ -692,7 +724,7 @@ Act as CA and sign the certificate. Create client.info containing: country = GB state = London locality = London -organization = Red Hat +organization = Libvirt Project cn = client1 tls_www_client encryption_key @@ -884,7 +916,7 @@ Blank lines and comments beginning with <code>#</code> are ignored. The default is that DNs are not checked. </p> <p> - This list may contain wildcards such as <code>"C=GB,ST=London,L=London,O=Red Hat,CN=*"</code> + This list may contain wildcards such as <code>"C=GB,ST=London,L=London,O=Libvirt Project,CN=*"</code> See the POSIX <code>fnmatch</code> function for the format of the wildcards. </p> -- 2.14.3

2 1

[libvirt] [PATCH] rng: fix nwfilter rule contents
by Daniel P. Berrange 06 Dec '17

06 Dec '17

The contents of a <rule> are a choice of exactly one union member. The RNG schema, however, was allowing an arbitrary number of instances of every union member at once. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- docs/schemas/nwfilter.rng | 98 +---------------------------------------------- 1 file changed, 2 insertions(+), 96 deletions(-) diff --git a/docs/schemas/nwfilter.rng b/docs/schemas/nwfilter.rng index 7cfc05fa2e..cca6ff2954 100644 --- a/docs/schemas/nwfilter.rng +++ b/docs/schemas/nwfilter.rng @@ -19,58 +19,37 @@ </element> <element name="rule"> <ref name="rule-node-attributes"/> - <optional> - <zeroOrMore> + <choice> <element name="mac"> <ref name="match-attribute"/> <ref name="common-l2-attributes"/> <ref name="mac-attributes"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="vlan"> <ref name="match-attribute"/> <ref name="common-l2-attributes"/> <ref name="vlan-attributes"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="stp"> <ref name="match-attribute"/> <ref name="srcmacandmask-attributes"/> <ref name="stp-attributes"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="arp"> <ref name="match-attribute"/> <ref name="common-l2-attributes"/> <ref name="arp-attributes"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="rarp"> <ref name="match-attribute"/> <ref name="common-l2-attributes"/> <ref name="arp-attributes"/>  <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="ip"> <ref name="match-attribute"/> <ref name="common-l2-attributes"/> @@ -80,10 +59,6 @@ <ref name="dscp-attribute"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="ipv6"> <ref name="match-attribute"/> <ref name="common-l2-attributes"/> @@ -93,10 +68,6 @@ <ref name="icmp-attribute-ranges"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="tcp"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -106,10 +77,6 @@ <ref name="tcp-attributes"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="udp"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -118,10 +85,6 @@ <ref name="common-ip-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="sctp"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -130,10 +93,6 @@ <ref name="common-ip-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="icmp"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -142,10 +101,6 @@ <ref name="icmp-attributes"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="igmp"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -153,10 +108,6 @@ <ref name="common-ip-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="all"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -164,10 +115,6 @@ <ref name="common-ip-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="esp"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -175,10 +122,6 @@ <ref name="common-ip-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="ah"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -186,10 +129,6 @@ <ref name="common-ip-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="udplite"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -197,10 +136,6 @@ <ref name="common-ip-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="tcp-ipv6"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -210,10 +145,6 @@ <ref name="tcp-attributes"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="udp-ipv6"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -222,10 +153,6 @@ <ref name="common-ipv6-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="sctp-ipv6"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -234,10 +161,6 @@ <ref name="common-ipv6-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="icmpv6"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -246,10 +169,6 @@ <ref name="icmp-attributes"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="all-ipv6"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -257,10 +176,6 @@ <ref name="common-ipv6-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="esp-ipv6"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -268,10 +183,6 @@ <ref name="common-ipv6-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="ah-ipv6"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -279,10 +190,6 @@ <ref name="common-ipv6-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> - <optional> - <zeroOrMore> <element name="udplite-ipv6"> <ref name="match-attribute"/> <ref name="srcmac-attribute"/> @@ -290,8 +197,7 @@ <ref name="common-ipv6-attributes-p2"/> <ref name="comment-attribute"/> </element> - </zeroOrMore> - </optional> + </choice> </element> </choice> </zeroOrMore> -- 2.14.3

2 1

[libvirt] [PATCH] nwfilter: remove bogus 'protocolid' attribute on arp/rarp fields
by Daniel P. Berrange 06 Dec '17

06 Dec '17

Various example XML documents for arp/rarp filtering have a protocolid XML attribute defined. This is never parsed or output by the libvirt XML handling code, so shouldn't be present in example XML files either Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- tests/nwfilterxml2firewalldata/arp.xml | 1 - tests/nwfilterxml2firewalldata/rarp.xml | 1 - tests/nwfilterxml2xmlin/arp-test.xml | 1 - tests/nwfilterxml2xmlin/chain_prefixtest1.xml | 1 - tests/nwfilterxml2xmlin/rarp-test.xml | 1 - 5 files changed, 5 deletions(-) diff --git a/tests/nwfilterxml2firewalldata/arp.xml b/tests/nwfilterxml2firewalldata/arp.xml index d0abf946ad..657c4958a6 100644 --- a/tests/nwfilterxml2firewalldata/arp.xml +++ b/tests/nwfilterxml2firewalldata/arp.xml @@ -2,7 +2,6 @@ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> <rule action='accept' direction='out'> <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' - protocolid='arp' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' hwtype='12' protocoltype='34' diff --git a/tests/nwfilterxml2firewalldata/rarp.xml b/tests/nwfilterxml2firewalldata/rarp.xml index 77c1127efc..15f1ac92d1 100644 --- a/tests/nwfilterxml2firewalldata/rarp.xml +++ b/tests/nwfilterxml2firewalldata/rarp.xml @@ -2,7 +2,6 @@ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> <rule action='accept' direction='out'> <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' - protocolid='rarp' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' hwtype='12' protocoltype='34' diff --git a/tests/nwfilterxml2xmlin/arp-test.xml b/tests/nwfilterxml2xmlin/arp-test.xml index e9d3768361..02bf4a8857 100644 --- a/tests/nwfilterxml2xmlin/arp-test.xml +++ b/tests/nwfilterxml2xmlin/arp-test.xml @@ -2,7 +2,6 @@ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> <rule action='accept' direction='out'> <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' - protocolid='arp' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' hwtype='12' protocoltype='34' diff --git a/tests/nwfilterxml2xmlin/chain_prefixtest1.xml b/tests/nwfilterxml2xmlin/chain_prefixtest1.xml index c2f3f77791..bd7f76f7d1 100644 --- a/tests/nwfilterxml2xmlin/chain_prefixtest1.xml +++ b/tests/nwfilterxml2xmlin/chain_prefixtest1.xml @@ -2,7 +2,6 @@ <uuid>e5700920-a333-4c05-8016-b669e46b7599</uuid> <rule action='accept' direction='out'> <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' - protocolid='arp' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' hwtype='12' protocoltype='34' diff --git a/tests/nwfilterxml2xmlin/rarp-test.xml b/tests/nwfilterxml2xmlin/rarp-test.xml index e08722204f..0e3ee91db5 100644 --- a/tests/nwfilterxml2xmlin/rarp-test.xml +++ b/tests/nwfilterxml2xmlin/rarp-test.xml @@ -2,7 +2,6 @@ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> <rule action='accept' direction='out'> <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' - protocolid='rarp' dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' hwtype='12' protocoltype='34' -- 2.14.3

2 1

[libvirt] [libvirt-php PATCH] Fix crash in VIRT_HASH_CURRENT_KEY_INFO macro
by Dawid Zamirski 06 Dec '17

06 Dec '17

The PHP7 variant of the macro wasn't safe if the hash key was not a string type. This was found when running php script with just libvirt_connect call under xdebug session which segfaulted. This patch makes the following changes: * make sure that tmp_name is initialized to NULL * set the key name only when zend_hash_get_current_key_ex did set it to something which happens only when type is HASH_KEY_IS_STRING * stash the key index in out php_libvirt_hash_key_info struct because it wasn't there before and separate variable had to be used. --- src/libvirt-connection.c | 8 +++----- src/libvirt-php.c | 6 ++---- src/libvirt-php.h | 1 + src/util.h | 16 +++++++++------- 4 files changed, 15 insertions(+), 16 deletions(-) diff --git a/src/libvirt-connection.c b/src/libvirt-connection.c index 181b266..2d59d82 100644 --- a/src/libvirt-connection.c +++ b/src/libvirt-connection.c @@ -131,8 +131,6 @@ PHP_FUNCTION(libvirt_connect) HashPosition pointer; int array_count; - zend_ulong index; - unsigned long libVer; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sba", &url, &url_len, &readonly, &zcreds) == FAILURE) { @@ -176,13 +174,13 @@ PHP_FUNCTION(libvirt_connect) VIRT_FOREACH(arr_hash, pointer, data) { if (Z_TYPE_P(data) == IS_STRING) { php_libvirt_hash_key_info info; - VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, index, info); + VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, info); if (info.type == HASH_KEY_IS_STRING) { PHPWRITE(info.name, info.length); } else { - DPRINTF("%s: credentials index %d\n", PHPFUNC, (int)index); - creds[j].type = index; + DPRINTF("%s: credentials index %d\n", PHPFUNC, info.index); + creds[j].type = info.index; creds[j].result = (char *)emalloc(Z_STRLEN_P(data) + 1); memset(creds[j].result, 0, Z_STRLEN_P(data) + 1); creds[j].resultlen = Z_STRLEN_P(data); diff --git a/src/libvirt-php.c b/src/libvirt-php.c index ef057fe..efbef58 100644 --- a/src/libvirt-php.c +++ b/src/libvirt-php.c @@ -1921,7 +1921,6 @@ long get_next_free_numeric_value(virDomainPtr domain, char *xpath) HashPosition pointer; // int array_count; zval *data; - unsigned long index; long max_slot = -1; xml = virDomainGetXMLDesc(domain, VIR_DOMAIN_XML_INACTIVE); @@ -1934,7 +1933,7 @@ long get_next_free_numeric_value(virDomainPtr domain, char *xpath) VIRT_FOREACH(arr_hash, pointer, data) { if (Z_TYPE_P(data) == IS_STRING) { php_libvirt_hash_key_info info; - VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, index, info); + VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, info); if (info.type != HASH_KEY_IS_STRING) { long num = -1; @@ -2439,7 +2438,6 @@ void parse_array(zval *arr, tVMDisk *disk, tVMNetwork *network) zval *data; php_libvirt_hash_key_info key; HashPosition pointer; - unsigned long index; arr_hash = Z_ARRVAL_P(arr); //array_count = zend_hash_num_elements(arr_hash); @@ -2451,7 +2449,7 @@ void parse_array(zval *arr, tVMDisk *disk, tVMNetwork *network) VIRT_FOREACH(arr_hash, pointer, data) { if ((Z_TYPE_P(data) == IS_STRING) || (Z_TYPE_P(data) == IS_LONG)) { - VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, index, key); + VIRT_HASH_CURRENT_KEY_INFO(arr_hash, pointer, key); if (key.type == HASH_KEY_IS_STRING) { if (disk != NULL) { if ((Z_TYPE_P(data) == IS_STRING) && strcmp(key.name, "path") == 0) diff --git a/src/libvirt-php.h b/src/libvirt-php.h index 8d13a6b..f24a329 100644 --- a/src/libvirt-php.h +++ b/src/libvirt-php.h @@ -137,6 +137,7 @@ typedef struct tVMNetwork { typedef struct _php_libvirt_hash_key_info { char *name; unsigned int length; + unsigned int index; unsigned int type; } php_libvirt_hash_key_info; diff --git a/src/util.h b/src/util.h index ecb3a1f..72cfa91 100644 --- a/src/util.h +++ b/src/util.h @@ -135,12 +135,14 @@ # define VIRT_FOREACH_END(_dummy) -# define VIRT_HASH_CURRENT_KEY_INFO(_ht, _pos, _idx, _info) \ +# define VIRT_HASH_CURRENT_KEY_INFO(_ht, _pos, _info) \ do { \ - zend_string *tmp_key_info; \ - _info.type = zend_hash_get_current_key_ex(_ht, &tmp_key_info, &_idx, &_pos); \ - _info.name = ZSTR_VAL(tmp_key_info); \ - _info.length = ZSTR_LEN(tmp_key_info); \ + zend_string *tmp_name = NULL; \ + _info.type = zend_hash_get_current_key_ex(_ht, &tmp_name, (zend_ulong *) &_info.index, &_pos); \ + if (tmp_name) { \ + _info.name = ZSTR_VAL(tmp_name); \ + _info.length = ZSTR_LEN(tmp_name); \ + } \ } while(0) # define VIRT_ARRAY_INIT(_name) do { \ @@ -213,9 +215,9 @@ # define VIRT_FOREACH_END(_dummy) \ }} -# define VIRT_HASH_CURRENT_KEY_INFO(_ht, _pos, _idx, _info) \ +# define VIRT_HASH_CURRENT_KEY_INFO(_ht, _pos, _info) \ do { \ - _info.type = zend_hash_get_current_key_ex(_ht, &_info.name, &_info.length, &_idx, 0, &_pos); \ + _info.type = zend_hash_get_current_key_ex(_ht, &_info.name, &_info.length, &_info.index, 0, &_pos); \ } while(0) # define VIRT_ARRAY_INIT(_name) do {\ -- 2.14.3

2 3