- Devel - libvirt List Archives

[libvirt] [PATCH] nwfilter: Add missing goto err_exit in error path
by Stefan Berger 12 Mar '14

12 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> https://bugzilla.redhat.com/show_bug.cgi?id=1071095 Add a missing goto err_exit in the error path where an unsupported value is assigned to the CTRL_IP_LEARNING key. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/nwfilter/nwfilter_gentech_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/nwfilter/nwfilter_gentech_driver.c b/src/nwfilter/nwfilter_gentech_driver.c index e576dc4..5c3b25e 100644 --- a/src/nwfilter/nwfilter_gentech_driver.c +++ b/src/nwfilter/nwfilter_gentech_driver.c @@ -732,6 +732,7 @@ virNWFilterInstantiate(const unsigned char *vmuuid ATTRIBUTE_UNUSED, _("filter '%s' " "learning value '%s' invalid."), filter->name, learning); + goto err_exit; } } else goto err_unresolvable_vars; -- 1.8.1.4

2 2

[libvirt] libvirtError: this function is not supported by the connection driver: virInterfaceDefineXML
by Sijo Jose 12 Mar '14

12 Mar '14

Hi, Could anyone help I'm getting the following error when I tried to add a new network interface. DETAILS Connection --------------------------- import libvirt conn = libvirt.open('qemu:///system') Interface XML ---------------------- <interface type="bridge" name="br0"> <start mode="onboot"/> <mtu size="1500"/> <protocol family="ipv4"> <dhcp/> </protocol> <bridge stp="off" delay="0.01"> <interface type="ethernet" name="eth0"> <mac address="ab:bb:cc:dd:ee:ff"/> </interface> <interface type="ethernet" name="eth1"/> </bridge> </interface> In [96]: conn.interfaceDefineXML(interfacexml,0) ---------------------------------------------------------------------------libvirtError Traceback (most recent call last)/home/saju/<ipython-input-96-0536ffe3fa23> in <module>()----> 1 conn.interfaceDefineXML(br1xml,0) /usr/lib/python2.7/dist-packages/libvirt.pyc in interfaceDefineXML(self, xml, flags) 2750 libvirtd. """ 2751 ret = libvirtmod.virInterfaceDefineXML(self._o, xml, flags)-> 2752 if ret is None:raise libvirtError('virInterfaceDefineXML() failed', conn=self) 2753 __tmp = virInterface(self, _obj=ret) 2754 return __tmp libvirtError: this function is not supported by the connection driver: virInterfaceDefineXML Regards Sijo Jose

1 0

[libvirt] [PATCH] qemu.conf: Mention virtlockd in @lock_manager description
by Michal Privoznik 12 Mar '14

12 Mar '14

When I played with virtlockd I was stunned by lacking documentation. My frustration got bigger when I had to read the patches to get the correct value to set in qemu.conf. Moreover, from pure libvirt-pride I'm changing commented value from sanlock to lockd. We want to favor our own implementation after all. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu.conf | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index e436084..f0e802f 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -402,11 +402,13 @@ #allow_disk_format_probing = 1 -# To enable 'Sanlock' project based locking of the file -# content (to prevent two VMs writing to the same -# disk), uncomment this +# In order to prevent accidentally starting two domains that +# share one writable disk, libvirt offers two approaches for +# locking files. The first one is sanlock, the other one, +# virtlockd, is then our own implementation. Accepted values +# are "sanlock" and "lockd". # -#lock_manager = "sanlock" +#lock_manager = "lockd" -- 1.9.0

3 4

[libvirt] [PATCH] qemu: don't munge user input during block commit
by Eric Blake 11 Mar '14

11 Mar '14

While investigating https://bugzilla.redhat.com/show_bug.cgi?id=1061827 I noticed that we pass user input unscathed for block-pull, but always pass a canonical absolute name through for block-commit. [Note that we probably _ought_ to validate that the user's request for block-pull actually matches the backing chain, the way we already do for block-commit - but that's a separate issue. Further note that the ability to pass user input through unscathed allows backdoors such as specifying a backing image that is a network URI such as a gluster disk, instead of forcing things to the local file system; which is an area still under active investigation on whether libvirt needs to behave differently for network disks.] Since qemu may write the name that the user passed in as the backing file, a user may have a reason to want a relative file name passed through to qemu, and always munging things to absolute prevents that. Put another way, if you have the backing chain: [A] <- [B(back=./A)] <- [C(back=./B)] and commit B into A (virsh blockcommit $dom vda --base A --top B), the metadata of C will have to be re-written. But should it be rewritten as [C(back=./A)] or as [C(back=/path/to/A)]? Still up in the air is whether qemu's decision should be based on whether B and/or C had relative paths, or on whether the --base and/or --top arguments to the command were relative paths; but if we always pass a canonical name, we've prevented the spelling of the command arguments from being part of the hueristics that qemu uses. I also audited the code, and verified that we never call qemuMonitorBlockCommit() with a NULL base, either before or after the change to qemu_driver.c. * src/qemu/qemu_driver.c (qemuDomainBlockCommit): Preserve user's spelling, since absolute vs. relative matters to qemu. * src/qemu/qemu_monitor.h (qemuMonitorBlockCommit): Base is never null. * src/qemu/qemu_monitor.c (qemuMonitorBlockCommit): Likewise. * src/qemu/qemu_monitor_json.h (qemuMonitorJSONBlockCommit): Likewise. * src/qemu/qemu_monitor_json.c (qemuMonitorJSONBlockCommit): Likewise. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- I was _hoping_ that this would solve the mentioned bugzilla. But even with this applied, qemu still ended up writing an absolute backing file name into the active file in the backing chain, so that bug has been reassigned back to qemu - it probably has to do with the fact that libvirt always spawns qemu with -drive pointing to an absolute name, which is unrelated to what this patch fixes. Therefore, I'm a little bit hesitant to apply this patch, but wanted to post it for review anyway. src/qemu/qemu_driver.c | 11 ++++++++--- src/qemu/qemu_monitor.c | 4 ++-- src/qemu/qemu_monitor.h | 3 ++- src/qemu/qemu_monitor_json.c | 2 +- src/qemu/qemu_monitor_json.h | 5 +++-- 5 files changed, 16 insertions(+), 9 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 9aad2dc..31adf78 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -15383,10 +15383,15 @@ qemuDomainBlockCommit(virDomainPtr dom, const char *path, const char *base, VIR_DISK_CHAIN_READ_WRITE) < 0)) goto endjob; - /* Start the commit operation. */ + /* Start the commit operation. Pass the user's original spelling, + * if any, through to qemu, since qemu behaves differently + * depending on whether the input was specified as relative or + * absolute (that is, our absolute top_canon may do the wrong + * thing if the user specified a name). */ qemuDomainObjEnterMonitor(driver, vm); - ret = qemuMonitorBlockCommit(priv->mon, device, top_canon, base_canon, - bandwidth); + ret = qemuMonitorBlockCommit(priv->mon, device, + top ? top : top_canon, + base ? base : base_canon, bandwidth); qemuDomainObjExitMonitor(driver, vm); endjob: diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index a2769db..e4707b7 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -1,7 +1,7 @@ /* * qemu_monitor.c: interaction with QEMU monitor console * - * Copyright (C) 2006-2013 Red Hat, Inc. + * Copyright (C) 2006-2014 Red Hat, Inc. * Copyright (C) 2006 Daniel P. Berrange * * This library is free software; you can redistribute it and/or @@ -3188,7 +3188,7 @@ qemuMonitorBlockCommit(qemuMonitorPtr mon, const char *device, unsigned long long speed; VIR_DEBUG("mon=%p, device=%s, top=%s, base=%s, bandwidth=%ld", - mon, device, NULLSTR(top), NULLSTR(base), bandwidth); + mon, device, top, base, bandwidth); /* Convert bandwidth MiB to bytes - unfortunately the JSON QMP protocol is * limited to LLONG_MAX also for unsigned values */ diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index eabf000..7bb465b 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -647,7 +647,8 @@ int qemuMonitorBlockCommit(qemuMonitorPtr mon, const char *top, const char *base, unsigned long bandwidth) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3); + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) + ATTRIBUTE_NONNULL(4); int qemuMonitorArbitraryCommand(qemuMonitorPtr mon, const char *cmd, diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index ee3ae15..40d6d1a 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -3307,7 +3307,7 @@ qemuMonitorJSONBlockCommit(qemuMonitorPtr mon, const char *device, "s:device", device, "U:speed", speed, "s:top", top, - base ? "s:base" : NULL, base, + "s:base", base, NULL); if (!cmd) return -1; diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h index a93c51e..ef71588 100644 --- a/src/qemu/qemu_monitor_json.h +++ b/src/qemu/qemu_monitor_json.h @@ -1,7 +1,7 @@ /* * qemu_monitor_json.h: interaction with QEMU monitor console * - * Copyright (C) 2006-2009, 2011-2013 Red Hat, Inc. + * Copyright (C) 2006-2009, 2011-2014 Red Hat, Inc. * Copyright (C) 2006 Daniel P. Berrange * * This library is free software; you can redistribute it and/or @@ -258,7 +258,8 @@ int qemuMonitorJSONBlockCommit(qemuMonitorPtr mon, const char *top, const char *base, unsigned long long bandwidth) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3); + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) + ATTRIBUTE_NONNULL(4); int qemuMonitorJSONArbitraryCommand(qemuMonitorPtr mon, const char *cmd_str, -- 1.8.5.3

2 2

[libvirt] [PATCH] iptables: don't log command probe failures
by Eric Blake 11 Mar '14

11 Mar '14

Commit b9dd878f caused a regression in iptables interaction by logging non-zero status at a higher level than VIR_INFO. Revert that portion of the commit, as well as adding a comment explaining why we check the status ourselves. Reported by Nehal J Wani. * src/util/viriptables.c (virIpTablesOnceInit): Undo log regression. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- src/util/viriptables.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/util/viriptables.c b/src/util/viriptables.c index 9e03cc4..45f7789 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -60,6 +60,7 @@ static int virIpTablesOnceInit(void) { virCommandPtr cmd; + int status; #if HAVE_FIREWALLD firewall_cmd_path = virFindFileInPath("firewall-cmd"); @@ -70,7 +71,8 @@ virIpTablesOnceInit(void) cmd = virCommandNew(firewall_cmd_path); virCommandAddArgList(cmd, "--state", NULL); - if (virCommandRun(cmd, NULL) < 0) { + /* don't log non-zero status */ + if (virCommandRun(cmd, &status) < 0 || status != 0) { VIR_INFO("firewall-cmd found but disabled for iptables"); VIR_FREE(firewall_cmd_path); firewall_cmd_path = NULL; @@ -87,7 +89,8 @@ virIpTablesOnceInit(void) cmd = virCommandNew(IPTABLES_PATH); virCommandAddArgList(cmd, "-w", "-L", "-n", NULL); - if (virCommandRun(cmd, NULL) < 0) { + /* don't log non-zero status */ + if (virCommandRun(cmd, &status) < 0 || status != 0) { VIR_INFO("xtables locking not supported by your iptables"); } else { VIR_INFO("using xtables locking for iptables"); -- 1.8.5.3

2 2

[libvirt] [PATCH] build: work around FreeBSD stdlib.h bug
by Eric Blake 11 Mar '14

11 Mar '14

POSIX requires that <stdlib.h> expose WIFEXITED and friends, but FreeBSD and others fail to comply. We can work around it manually by including <sys/wait.h>, or we can work around it automatically by using gnulib's system-posix module. * bootstrap.conf (gnulib_modules): Add system-posix. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- I'll wait for a review on this one - we don't use system(), and it feels a little bit odd to list the system() module merely for its side effect of a fixed <stdlib.h>. The alternative is to continue using <sys/wait.h> everywhere that we use WIFEXITED and friends. bootstrap.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bootstrap.conf b/bootstrap.conf index d24a714..bc6ce80 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -1,6 +1,6 @@ # Bootstrap configuration. -# Copyright (C) 2010-2013 Red Hat, Inc. +# Copyright (C) 2010-2014 Red Hat, Inc. # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public @@ -112,6 +112,7 @@ strerror_r-posix strptime strsep strtok_r +system-posix sys_stat sys_wait termios -- 1.8.5.3

3 7

[libvirt] [PATCH v3] nwfilter: Deactivate iptables MAC address check where needed
by Stefan Berger 11 Mar '14

11 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Recent Linux iptables (3.11.7) refuses to create iptables MAC address check rules using -m mac --mac-source <addr> where previous versions still allowed it. So we now need to deactivate the filtering rules for when the incoming traffic is filtered before it is sent into the VM. Those are typically the chains that start with FO-* or start with FP-* when they are being built. Adapt the documentation to reflect the fact that srcmacaddr, when used in iptables rules, should be regarded as deprecated due to the above mentioned problems. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 54 +++++++++++-------------------- src/nwfilter/nwfilter_ebiptables_driver.c | 29 ++++++++++------- 2 files changed, 36 insertions(+), 47 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 4b95fce..5c06bf2 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -1209,7 +1209,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> @@ -1320,22 +1322,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> @@ -1429,22 +1418,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> @@ -1529,7 +1505,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> @@ -1640,7 +1618,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> @@ -1735,7 +1715,9 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated and + MAC address filtering using for example the mac protocol + above should be used</td> </tr> <tr> <td>srcipaddr</td> diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 352c08f..bea9535 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -972,7 +972,7 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, - bool directionIn, + const char *chain, bool directionIn, bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -984,6 +984,14 @@ iptablesHandleSrcMacAddr(virBufferPtr buf, return 0; } + /* recent Linux iptables does not allow this filtering rule to be + * applied to the FP-/FO- chains + */ + if (chain[1] == CHAINPREFIX_HOST_OUT_TEMP) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr) < 0) @@ -1366,7 +1374,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1421,7 +1429,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1454,7 +1462,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1482,7 +1490,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1506,11 +1514,10 @@ _iptablesCreateRuleInstance(bool directionIn, virBufferAddLit(&buf, " -p ah"); bufUsed = virBufferUse(&buf); - if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1538,7 +1545,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1574,7 +1581,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1636,7 +1643,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1664,7 +1671,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; -- 1.8.1.4

1 0

[libvirt] Get disk size for disk type="network"
by Qiang Fu 11 Mar '14

11 Mar '14

Hi, In the output of "virsh dumpxml" command the disk section is as follows: <disk type='network' device='disk'> <driver name='qemu' type='raw' cache='writeback'/> <auth username='svl-cc1-cinder-user'> <secret type='ceph' uuid='e80afa94-a64c-486c-9e34-d55e85f26406'/> </auth> <source protocol='rbd' name='svl-cc1-cinder-volume-1/volume-0a4cdeab-863d-4394-845f-008b993bc4e9'> <host name='10.34.114.211' port='6789'/> <host name='10.34.114.212' port='6789'/> <host name='10.34.114.213' port='6789'/> </source> <target dev='vda' bus='virtio'/> <serial>0a4cdeab-863d-4394-845f-008b993bc4e9</serial> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </disk> In this case how can I use libvirt to get the disk/volume size information? Thanks, Bruce

2 2

[libvirt] [PATCH] libxl: support sexpr in native to XML conversion
by Jim Fehlig 11 Mar '14

11 Mar '14

Supporting sexpr in connectDomainXMLFromNative in the libxl driver adds flexibility for users importing legacy Xen configuration into libvirt. E.g. this patch allows importing previous xend-managed domains from /var/lib/xend/domains/<dom-uuid>/config.sxp into the libvirt libxl driver. Signed-off-by: Jim Fehlig <jfehlig(a)suse.com> --- src/libxl/libxl_driver.c | 40 +++++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 13 deletions(-) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index a79efcb..65d80a2 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -46,6 +46,7 @@ #include "libxl_driver.h" #include "libxl_conf.h" #include "xen_xm.h" +#include "xen_sxpr.h" #include "virtypedparam.h" #include "viruri.h" #include "virstring.h" @@ -62,6 +63,7 @@ #define LIBXL_DOM_REQ_HALT 4 #define LIBXL_CONFIG_FORMAT_XM "xen-xm" +#define LIBXL_CONFIG_FORMAT_SEXPR "xen-sxpr" /* Number of Xen scheduler parameters */ #define XEN_SCHED_CREDIT_NPARAM 2 @@ -2867,8 +2869,9 @@ libxlDomainGetXMLDesc(virDomainPtr dom, unsigned int flags) } static char * -libxlConnectDomainXMLFromNative(virConnectPtr conn, const char * nativeFormat, - const char * nativeConfig, +libxlConnectDomainXMLFromNative(virConnectPtr conn, + const char *nativeFormat, + const char *nativeConfig, unsigned int flags) { libxlDriverPrivatePtr driver = conn->privateData; @@ -2882,22 +2885,33 @@ libxlConnectDomainXMLFromNative(virConnectPtr conn, const char * nativeFormat, if (virConnectDomainXMLFromNativeEnsureACL(conn) < 0) goto cleanup; - if (STRNEQ(nativeFormat, LIBXL_CONFIG_FORMAT_XM)) { + if (STREQ(nativeFormat, LIBXL_CONFIG_FORMAT_XM)) { + if (!(conf = virConfReadMem(nativeConfig, strlen(nativeConfig), 0))) + goto cleanup; + + if (!(def = xenParseXM(conf, + cfg->verInfo->xen_version_major, + cfg->caps))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("parsing xm config failed")); + goto cleanup; + } + } else if (STREQ(nativeFormat, LIBXL_CONFIG_FORMAT_SEXPR)) { + /* only support latest xend config format */ + if (!(def = xenParseSxprString(nativeConfig, + XEND_CONFIG_VERSION_3_1_0, + NULL, + -1))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("parsing sxpr config failed")); + goto cleanup; + } + } else { virReportError(VIR_ERR_INVALID_ARG, _("unsupported config type %s"), nativeFormat); goto cleanup; } - if (!(conf = virConfReadMem(nativeConfig, strlen(nativeConfig), 0))) - goto cleanup; - - if (!(def = xenParseXM(conf, - cfg->verInfo->xen_version_major, - cfg->caps))) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("parsing xm config failed")); - goto cleanup; - } - xml = virDomainDefFormat(def, VIR_DOMAIN_XML_INACTIVE); cleanup: -- 1.8.1.4

2 2

[libvirt] [PATCH] storage: Fix bugs in VIR_APPEND_ELEMENT series
by John Ferlan 11 Mar '14

11 Mar '14

>From commit id 'd53bbfd1' Found one core and one possible memory leak. Core seen during local virt-test/tp_libvirt run for the vol_create_from test. The memory leak was seen by inspection during a review of all VIR_APPEND_ELEMENT changes In storage_backend_disk/virStorageBackendDiskMakeDataVol(), the 'vol' needs to be kept around since it's used later, so use the _COPY macro. This caused a segv in libvirtd: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffe87c3700 (LWP 6919)] virStorageBackendDiskMakeDataVol (vol=0x0, groups=0x7fffc8000d70, pool=0x7fffc8002460) at storage/storage_backend_disk.c:66 66 if (vol->target.path == NULL) { In storage_backend_rbd/virStorageBackendRBDRefreshPool() there's a failure path where the 'vol' needs to go through virStorageVolDefFree() since it wouldn't be appended. Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- src/storage/storage_backend_disk.c | 3 ++- src/storage/storage_backend_rbd.c | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/storage/storage_backend_disk.c b/src/storage/storage_backend_disk.c index b261773..2b6011b 100644 --- a/src/storage/storage_backend_disk.c +++ b/src/storage/storage_backend_disk.c @@ -57,7 +57,8 @@ virStorageBackendDiskMakeDataVol(virStoragePoolObjPtr pool, */ tmp = strrchr(groups[0], '/'); if (VIR_STRDUP(vol->name, tmp ? tmp + 1 : groups[0]) < 0 || - VIR_APPEND_ELEMENT(pool->volumes.objs, pool->volumes.count, vol) < 0) { + VIR_APPEND_ELEMENT_COPY(pool->volumes.objs, + pool->volumes.count, vol) < 0) { virStorageVolDefFree(vol); return -1; } diff --git a/src/storage/storage_backend_rbd.c b/src/storage/storage_backend_rbd.c index bc52474..d78dbe4 100644 --- a/src/storage/storage_backend_rbd.c +++ b/src/storage/storage_backend_rbd.c @@ -401,6 +401,7 @@ static int virStorageBackendRBDRefreshPool(virConnectPtr conn, } if (VIR_APPEND_ELEMENT(pool->volumes.objs, pool->volumes.count, vol) < 0) { + virStorageVolDefFree(vol); virStoragePoolObjClearVols(pool); goto cleanup; } -- 1.8.5.3

2 1

[libvirt] [PATCH v2] nwfilter: Deactivate iptables MAC address check where needed
by Stefan Berger 11 Mar '14

11 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Recent Linux iptables (3.11.7) refuses to create iptables MAC address check rules using -m mac --mac-source <addr> where previous versions still allowed it. So we now need to deactivate the filtering rules for when the incoming traffic is filtered before it is sent into the VM. Those are typically the chains that start with FO-* or start with FP-* when they are being built. Adapt the documentation to reflect the fact that srcmacaddr, when used in iptables rules, should be regarded as deprecated due to the above mentioned problems. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 42 +++++-------------------------- src/nwfilter/nwfilter_ebiptables_driver.c | 29 +++++++++++++-------- 2 files changed, 24 insertions(+), 47 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 4b95fce..ee23d8e 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -1209,7 +1209,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1320,22 +1320,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1429,22 +1414,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1529,7 +1499,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1640,7 +1610,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1735,7 +1705,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 352c08f..ae20bf0 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -972,7 +972,7 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, - bool directionIn, + const char *chain, bool directionIn, bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -984,6 +984,14 @@ iptablesHandleSrcMacAddr(virBufferPtr buf, return 0; } + /* recent Linux iptables does not allow this filteirng rule to be + * applied to all FO-* chains + */ + if (chain[1] == CHAINPREFIX_HOST_OUT_TEMP) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr) < 0) @@ -1366,7 +1374,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1421,7 +1429,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1454,7 +1462,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1482,7 +1490,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1506,11 +1514,10 @@ _iptablesCreateRuleInstance(bool directionIn, virBufferAddLit(&buf, " -p ah"); bufUsed = virBufferUse(&buf); - if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1538,7 +1545,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1574,7 +1581,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1636,7 +1643,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1664,7 +1671,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; -- 1.8.1.4

2 1

[libvirt] Google Summer of Code 2014 - Rewriting Virtual-Box Driver
by prashanth sunder 11 Mar '14

11 Mar '14

Hello, I am applying for the project idea "Rewriting Virtual-Box Driver" suggested by Michal Privoznik(mprivozn(a)redhat.com) in the "Qemu" ideas page ( http://wiki.qemu.org/Google_Summer_of_Code_2014) In the short span of time that I had after my discussion with Mr. Privoznik, the current Virtual Box driver code is not structured very well(lot of #ifdef's in the current code) and very hard to read. Since libvirt has to support all versions of Virtual Box, the current code decides on what code to compile based on the value of the macro VBOX_API_VERSION that is checked during ./configure. The only thing after discussion that we were able to come up with is putting version specific code under particular files and only compile the those necessary files during "make" For instance, if a function X() supports version A, B, C we will have function X() in vbox_A.c just for version A, function X() in vbox_B.c just for version B and so on. Any other suggestions than the above mentioned one which can be used to fix the problem?? Regards, Prashanth Sunder

2 1

[libvirt] [PATCH] Fix sec label setup when attaching to QEMU processes
by Daniel P. Berrange 11 Mar '14

11 Mar '14

When attaching to a QEMU process, the def->seclabels array is going to be empty. The qemuProcessAttach method must thus populate it with data for the security drivers. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/qemu/qemu_process.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 1f00840..7d41c93 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -4479,6 +4479,7 @@ int qemuProcessAttach(virConnectPtr conn ATTRIBUTE_UNUSED, virDomainPausedReason reason; virSecurityLabelPtr seclabel = NULL; virSecurityLabelDefPtr seclabeldef = NULL; + bool seclabelgen = false; virSecurityManagerPtr* sec_managers = NULL; const char *model; virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); @@ -4529,10 +4530,16 @@ int qemuProcessAttach(virConnectPtr conn ATTRIBUTE_UNUSED, goto error; for (i = 0; sec_managers[i]; i++) { + seclabelgen = false; + VIR_ERROR("Iter %zu", i); model = virSecurityManagerGetModel(sec_managers[i]); seclabeldef = virDomainDefGetSecurityLabelDef(vm->def, model); - if (seclabeldef == NULL) - goto error; + VIR_ERROR("model %s def %p", model, seclabeldef); + if (seclabeldef == NULL) { + if (!(seclabeldef = virDomainDefGenSecurityLabelDef(model))) + goto error; + seclabelgen = true; + } seclabeldef->type = VIR_DOMAIN_SECLABEL_STATIC; if (VIR_ALLOC(seclabel) < 0) goto error; @@ -4546,6 +4553,12 @@ int qemuProcessAttach(virConnectPtr conn ATTRIBUTE_UNUSED, if (VIR_STRDUP(seclabeldef->label, seclabel->label) < 0) goto error; VIR_FREE(seclabel); + + if (seclabelgen) { + if (VIR_APPEND_ELEMENT(vm->def->seclabels, vm->def->nseclabels, seclabeldef) < 0) + goto error; + seclabelgen = false; + } } VIR_DEBUG("Creating domain log file"); @@ -4692,6 +4705,8 @@ error: VIR_FORCE_CLOSE(logfile); VIR_FREE(seclabel); VIR_FREE(sec_managers); + if (seclabelgen) + virSecurityLabelDefFree(seclabeldef); virDomainChrSourceDefFree(monConfig); virObjectUnref(cfg); virObjectUnref(caps); -- 1.8.5.3

2 2

[libvirt] Suspending access to opened/active /dev/nodes during application runtime
by Lukasz Pawelczyk 11 Mar '14

11 Mar '14

Problem: Has anyone thought about a mechanism to limit/remove an access to a device during an application runtime? Meaning we have an application that has an open file descriptor to some /dev/node and depending on *something* it gains or looses the access to it gracefully (with or without a notification, but without any fatal consequences). Example: LXC. Imagine we have 2 separate containers. Both running full operating systems. Specifically with 2 X servers. Both running concurrently of course. Both need the same input devices (e.g. we have just one mouse). This creates a security problem when we want to have completely separate environments. One container is active (being displayed on a monitor and controlled with a mouse) while the other container runs evtest /dev/input/something and grabs the secret password user typed in the other. Solutions: The complete solution would comprise of 2 parts: - a mechanism that would allow to temporally "hide" a device from an open file descriptor. - a mechanism for deciding whether application/process/namespace should have an access to a specific device at a specific moment Let's focus on the first problem only, as it would need to be solved first anyway. I haven't found anything that would allow me to do it. There are a lot mechanisms that make it possible to restrict an access during open(): - DAC - ACL (controlled by hand or with uaccess) - LSM (in general) - device cgroups But all of those can't do a thing when the device is already opened and an application has a file descriptor. I don't see such mechanism in kernel sources either. I do imagine that it would not be possible for every device to handle such a thing (dri comes to mind) without breaking something (graphics card state in dri example). But there is class of simple input/output devices that would handle this without problems. I did implement some proof-of-concept solution for an evdev driver by allowing or disallowing events that go to evdev_client structure using some arbitrary condition. But this is far from a generic solution. My proof-of-concept is somewhat similar to this (I just found it): http://www.spinics.net/lists/linux-input/msg25547.html Though a little bit wider in scope. But neither is flawless nor generic. Has anyone had any thoughts about a similar problem? -- Regards Havner

4 5

[libvirt] How to apply for Google Summer of Code
by Stefan Hajnoczi 11 Mar '14

11 Mar '14

Dear students, Applications for Google Summer of Code opened on Monday, 10th of March and will continue until Friday, 21st of March. The common question we are getting is "How do I apply?" :). Here is the application checklist: 1. Choose a project idea and get in touch with the mentor. The project ideas and mentors are listed here: http://qemu-project.org/Google_Summer_of_Code_2014 2. Put together a rough project plan (design + schedule) that breaks down the solution you are proposing. You can email a draft to your mentor for feedback or ask for clarifications about the project idea. 3. Go to http://google-melange.com/, log in and submit your application form for QEMU. The application template is here: https://www.google-melange.com/gsoc/org2/google/gsoc2014/qemu Remember the deadline for applications Friday, 21st of March. You can reach mentors on #qemu-gsoc on irc.oftc.net or via email. Stefan

1 0

[libvirt] [PATCH v2 0/3] Add caching of QEMU probed capabilities
by Daniel P. Berrange 11 Mar '14

11 Mar '14

A followup to https://www.redhat.com/archives/libvir-list/2014-March/msg00297.html Probing capabilities takes 200-300ms per binary and we have as many as 26 binaries. This noticably slows down libvirtd startup. It does not look like performance of probing QEMU can be improved, so this series introduces caching of the capabilities information. So the first time libvirtd starts it'll be slow, but thereafter it is fast. The cache is invalidated any time the QEMU binary timestamp changes or the libvirtd binary or driver module timestamp changes. In v2: - Store timestamps in XML file instead of non-portable utimes() - Use ctime instead of mtime since the latter can be faked by package managers to go backwards in time. Daniel P. Berrange (3): Add helper APIs to track if libvirtd or loadable modules have changed Change QEMU capabilities cache to check ctime instead of mtime Cache result of QEMU capabilities extraction daemon/libvirtd.c | 2 + src/driver.c | 2 + src/libvirt_private.syms | 2 + src/qemu/qemu_capabilities.c | 442 +++++++++++++++++++++++++++++++++++++++++-- src/qemu/qemu_capabilities.h | 2 + src/qemu/qemu_driver.c | 1 + src/util/virutil.c | 23 +++ src/util/virutil.h | 4 + 8 files changed, 467 insertions(+), 11 deletions(-) -- 1.8.5.3

3 8

[libvirt] [PATCH] tests: Distribute securityselinuxhelperdata
by Jiri Denemark 11 Mar '14

11 Mar '14

Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com> --- Notes: Pushed as a build-breaker since 'make distcheck' fails without this patch. tests/Makefile.am | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/Makefile.am b/tests/Makefile.am index 5c1f420..3267ad3 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -97,6 +97,7 @@ EXTRA_DIST = \ qemuxml2xmloutdata \ qemuxmlnsdata \ secretxml2xmlin \ + securityselinuxhelperdata \ securityselinuxlabeldata \ schematestutils.sh \ sexpr2xmldata \ -- 1.9.0

1 0

[libvirt] [PATCH] BZ1072677: Avoid freeing of 0 file descriptor
by Stefan Berger 11 Mar '14

11 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Avoid the freeing of an array of zero file descriptors in case of error. Introduce a macro VIR_INIT_N_FD to initialize such an array's elements to -1. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- src/qemu/qemu_hotplug.c | 14 +++++++++++--- src/util/virfile.h | 12 ++++++++++++ 2 files changed, 23 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 6703c92..b295db2 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -874,9 +874,12 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, tapfdSize = vhostfdSize = net->driver.virtio.queues; if (!tapfdSize) tapfdSize = vhostfdSize = 1; - if (VIR_ALLOC_N(tapfd, tapfdSize) < 0 || - VIR_ALLOC_N(vhostfd, vhostfdSize) < 0) + if (VIR_ALLOC_N(tapfd, tapfdSize) < 0) goto cleanup; + VIR_INIT_N_FD(tapfd, tapfdSize); + if (VIR_ALLOC_N(vhostfd, vhostfdSize) < 0) + goto cleanup; + VIR_INIT_N_FD(vhostfd, vhostfdSize); if (qemuNetworkIfaceConnect(vm->def, conn, driver, net, priv->qemuCaps, tapfd, &tapfdSize) < 0) goto cleanup; @@ -885,8 +888,12 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, goto cleanup; } else if (actualType == VIR_DOMAIN_NET_TYPE_DIRECT) { tapfdSize = vhostfdSize = 1; - if (VIR_ALLOC(tapfd) < 0 || VIR_ALLOC(vhostfd) < 0) + if (VIR_ALLOC(tapfd) < 0) + goto cleanup; + *tapfd = -1; + if (VIR_ALLOC(vhostfd) < 0) goto cleanup; + *vhostfd = -1; if ((tapfd[0] = qemuPhysIfaceConnect(vm->def, driver, net, priv->qemuCaps, VIR_NETDEV_VPORT_PROFILE_OP_CREATE)) < 0) @@ -898,6 +905,7 @@ int qemuDomainAttachNetDevice(virConnectPtr conn, vhostfdSize = 1; if (VIR_ALLOC(vhostfd) < 0) goto cleanup; + *vhostfd = -1; if (qemuOpenVhostNet(vm->def, net, priv->qemuCaps, vhostfd, &vhostfdSize) < 0) goto cleanup; } diff --git a/src/util/virfile.h b/src/util/virfile.h index 20baf6f..802cf01 100644 --- a/src/util/virfile.h +++ b/src/util/virfile.h @@ -75,6 +75,18 @@ FILE *virFileFdopen(int *fdptr, const char *mode) ATTRIBUTE_RETURN_CHECK; VIR_FILE_CLOSE_PRESERVE_ERRNO | \ VIR_FILE_CLOSE_DONT_LOG)) +static inline void vir_init_n_int(int *ptr, int count, int value) +{ + int i; + + for (i = 0; i < count; i++) + ptr[i] = value; +} + +/* Initialize an array of file descriptors to -1 */ +# define VIR_INIT_N_FD(ptr, count) \ + vir_init_n_int(ptr, count, -1) + /* Opaque type for managing a wrapper around a fd. */ struct _virFileWrapperFd; -- 1.8.1.4

3 5

[libvirt] [PATCH v2] qemu: cleanup tap devices on FreeBSD
by Roman Bogorodskiy 11 Mar '14

11 Mar '14

We have to explicitly destroy TAP devices on FreeBSD because they're not freed after being closed, otherwise we end up with orphaned TAP devices after destroying a domain. --- src/qemu/qemu_process.c | 7 +++++++ src/util/virnetdevtap.h | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index ffa939a..6806539 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -61,6 +61,7 @@ #include "viruuid.h" #include "virprocess.h" #include "virtime.h" +#include "virnetdevbridge.h" #include "virnetdevtap.h" #include "virbitmap.h" #include "viratomic.h" @@ -4381,6 +4382,12 @@ void qemuProcessStop(virQEMUDriverPtr driver, virDomainNetGetActualVirtPortProfile(net), cfg->stateDir)); VIR_FREE(net->ifname); +#ifdef VIR_NETDEV_TAP_REQUIRE_MANUAL_CLEANUP + } else if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_BRIDGE) { + ignore_value(virNetDevBridgeRemovePort(virDomainNetGetActualBridgeName(net), + net->ifname)); + ignore_value(virNetDevTapDelete(net->ifname)); +#endif } /* release the physical device (or any other resources used by * this interface in the network driver diff --git a/src/util/virnetdevtap.h b/src/util/virnetdevtap.h index a762b31..1e5bd19 100644 --- a/src/util/virnetdevtap.h +++ b/src/util/virnetdevtap.h @@ -27,6 +27,12 @@ # include "virnetdevvportprofile.h" # include "virnetdevvlan.h" +# ifdef __FreeBSD__ +/* This should be defined on OSes that don't automatically + * cleanup released devices */ +# define VIR_NETDEV_TAP_REQUIRE_MANUAL_CLEANUP 1 +# endif + int virNetDevTapCreate(char **ifname, int *tapfd, int tapfdSize, -- 1.8.4.3

2 2

[libvirt] [PATCH] datatypes: Fix comments
by Michael Chapman 11 Mar '14

11 Mar '14

- As of commit 2ff4c137, all virGet*() functions in datatypes.c always return pointers to new objects. Objects are not cached in a per-connection hashtable. - Fix variable names in comments for all vir*Dispose() functions in datatypes.c. - Add comments for virGetStream(), virStreamDispose(), virGetDomainSnapshot(), virDomainSnapshotDispose(). Signed-off-by: Michael Chapman <mike(a)very.puzzling.org> --- src/datatypes.c | 126 +++++++++++++++++++++++++++++++++----------------------- 1 file changed, 74 insertions(+), 52 deletions(-) diff --git a/src/datatypes.c b/src/datatypes.c index 20752cd..6f98aed 100644 --- a/src/datatypes.c +++ b/src/datatypes.c @@ -96,9 +96,9 @@ VIR_ONCE_GLOBAL_INIT(virDataTypes) /** * virGetConnect: * - * Allocates a new hypervisor connection structure + * Allocates a new hypervisor connection object. * - * Returns a new pointer or NULL in case of error. + * Returns a pointer to the connection object, or NULL on error. */ virConnectPtr virGetConnect(void) @@ -126,7 +126,7 @@ error: /** * virConnectDispose: - * @conn: the hypervisor connection to release + * @obj: the hypervisor connection to release * * Unconditionally release all memory associated with a connection. * The connection object must not be used once this method returns. @@ -196,12 +196,10 @@ virConnectCloseCallbackDataDispose(void *obj) * @name: pointer to the domain name * @uuid: pointer to the uuid * - * Lookup if the domain is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new domain object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the domain, or NULL in case of failure + * Returns a pointer to the domain object, or NULL on error. */ virDomainPtr virGetDomain(virConnectPtr conn, const char *name, const unsigned char *uuid) @@ -234,7 +232,7 @@ error: /** * virDomainDispose: - * @domain: the domain to release + * @obj: the domain to release * * Unconditionally release all memory associated with a domain. * The domain object must not be used once this method returns. @@ -262,12 +260,10 @@ virDomainDispose(void *obj) * @name: pointer to the network name * @uuid: pointer to the uuid * - * Lookup if the network is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new network object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the network, or NULL in case of failure + * Returns a pointer to the network object, or NULL on error. */ virNetworkPtr virGetNetwork(virConnectPtr conn, const char *name, const unsigned char *uuid) @@ -299,7 +295,7 @@ error: /** * virNetworkDispose: - * @network: the network to release + * @obj: the network to release * * Unconditionally release all memory associated with a network. * The network object must not be used once this method returns. @@ -327,13 +323,10 @@ virNetworkDispose(void *obj) * @name: pointer to the interface name * @mac: pointer to the mac * - * Lookup if the interface is already registered for that connection, - * if yes return a new pointer to it (possibly updating the MAC - * address), if no allocate a new structure, and register it in the - * table. In any case a corresponding call to virObjectUnref() is - * needed to not leak data. + * Allocates a new interface object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the interface, or NULL in case of failure + * Returns a pointer to the interface object, or NULL on error. */ virInterfacePtr virGetInterface(virConnectPtr conn, const char *name, const char *mac) @@ -368,7 +361,7 @@ error: /** * virInterfaceDispose: - * @interface: the interface to release + * @obj: the interface to release * * Unconditionally release all memory associated with an interface. * The interface object must not be used once this method returns. @@ -396,12 +389,10 @@ virInterfaceDispose(void *obj) * @privateData: pointer to driver specific private data * @freeFunc: private data cleanup function pointer specfic to driver * - * Lookup if the storage pool is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new storage pool object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the storage pool, or NULL in case of failure + * Returns a pointer to the storage pool object, or NULL on error. */ virStoragePoolPtr virGetStoragePool(virConnectPtr conn, const char *name, @@ -440,7 +431,7 @@ error: /** * virStoragePoolDispose: - * @pool: the pool to release + * @obj: the storage pool to release * * Unconditionally release all memory associated with a pool. * The pool object must not be used once this method returns. @@ -475,12 +466,10 @@ virStoragePoolDispose(void *obj) * @privateData: pointer to driver specific private data * @freeFunc: private data cleanup function pointer specfic to driver * - * Lookup if the storage vol is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new storage volume object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the storage vol, or NULL in case of failure + * Returns a pointer to the storage volume object, or NULL on error. */ virStorageVolPtr virGetStorageVol(virConnectPtr conn, const char *pool, const char *name, @@ -520,7 +509,7 @@ error: /** * virStorageVolDispose: - * @vol: the vol to release + * @obj: the storage volume to release * * Unconditionally release all memory associated with a volume. * The volume object must not be used once this method returns. @@ -550,12 +539,10 @@ virStorageVolDispose(void *obj) * @conn: the hypervisor connection * @name: device name (unique on node) * - * Lookup if the device is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new node device object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the node device, or NULL in case of failure + * Returns a pointer to the node device object, or NULL on error. */ virNodeDevicePtr virGetNodeDevice(virConnectPtr conn, const char *name) @@ -585,7 +572,7 @@ error: /** * virNodeDeviceDispose: - * @dev: the dev to release + * @obj: the node device to release * * Unconditionally release all memory associated with a device. * The device object must not be used once this method returns. @@ -611,12 +598,10 @@ virNodeDeviceDispose(void *obj) * @conn: the hypervisor connection * @uuid: secret UUID * - * Lookup if the secret is already registered for that connection, if so return - * a pointer to it, otherwise allocate a new structure, and register it in the - * table. In any case a corresponding call to virObjectUnref() is needed to not - * leak data. + * Allocates a new secret object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the secret, or NULL in case of failure + * Returns a pointer to the secret object, or NULL on error. */ virSecretPtr virGetSecret(virConnectPtr conn, const unsigned char *uuid, @@ -650,7 +635,7 @@ error: /** * virSecretDispose: - * @secret: the secret to release + * @obj: the secret to release * * Unconditionally release all memory associated with a secret. * The secret object must not be used once this method returns. @@ -672,6 +657,15 @@ virSecretDispose(void *obj) } +/** + * virGetStream: + * @conn: the hypervisor connection + * + * Allocates a new stream object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. + * + * Returns a pointer to the stream object, or NULL on error. + */ virStreamPtr virGetStream(virConnectPtr conn) { @@ -688,6 +682,16 @@ virGetStream(virConnectPtr conn) return ret; } +/** + * virStreamDispose: + * @obj: the stream to release + * + * Unconditionally release all memory associated with a stream. + * The stream object must not be used once this method returns. + * + * It will also unreference the associated connection object, + * which may also be released if its ref count hits zero. + */ static void virStreamDispose(void *obj) { @@ -704,12 +708,10 @@ virStreamDispose(void *obj) * @name: pointer to the network filter pool name * @uuid: pointer to the uuid * - * Lookup if the network filter is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates a new network filter object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. * - * Returns a pointer to the network, or NULL in case of failure + * Returns a pointer to the network filter object, or NULL on error. */ virNWFilterPtr virGetNWFilter(virConnectPtr conn, const char *name, @@ -744,7 +746,7 @@ error: /** * virNWFilterDispose: - * @nwfilter: the nwfilter to release + * @obj: the network filter to release * * Unconditionally release all memory associated with a nwfilter. * The nwfilter object must not be used once this method returns. @@ -766,6 +768,16 @@ virNWFilterDispose(void *obj) } +/** + * virGetDomainSnapshot: + * @domain: the domain to snapshot + * @name: pointer to the domain snapshot name + * + * Allocates a new domain snapshot object. When the object is no longer needed, + * virObjectUnref() must be called in order to not leak data. + * + * Returns a pointer to the domain snapshot object, or NULL on error. + */ virDomainSnapshotPtr virGetDomainSnapshot(virDomainPtr domain, const char *name) { @@ -792,6 +804,16 @@ error: } +/** + * virDomainSnapshotDispose: + * @obj: the domain snapshot to release + * + * Unconditionally release all memory associated with a snapshot. + * The snapshot object must not be used once this method returns. + * + * It will also unreference the associated connection object, + * which may also be released if its ref count hits zero. + */ static void virDomainSnapshotDispose(void *obj) { -- 1.8.5.3

1 0

[libvirt] [PATCH] datatypes: Fix comments
by Michael Chapman 11 Mar '14

11 Mar '14

- As of commit 2ff4c137, all virGet*() functions in datatypes.c always return pointers to new objects. Objects are not cached in a per-connection hashtable. - As of commit 46ec5f85, the conn.lock mutex does not need to be held when calling any vir*Dispose() function in datatypes.c (via virObjectUnref()). - Add comments for virGetStream(), virStreamDispose(), virGetDomainSnapshot(), virDomainSnapshotDispose(). Signed-off-by: Michael Chapman <mike(a)very.puzzling.org> --- src/datatypes.c | 174 ++++++++++++++++++++++++++++++++------------------------ 1 file changed, 99 insertions(+), 75 deletions(-) diff --git a/src/datatypes.c b/src/datatypes.c index 73f17e7..aafa54b 100644 --- a/src/datatypes.c +++ b/src/datatypes.c @@ -96,9 +96,8 @@ VIR_ONCE_GLOBAL_INIT(virDataTypes) /** * virGetConnect: * - * Allocates a new hypervisor connection structure - * - * Returns a new pointer or NULL in case of error. + * Allocates and returns a pointer to a new hypervisor connection object. + * Returns NULL on error. */ virConnectPtr virGetConnect(void) @@ -129,9 +128,7 @@ error: * @conn: the hypervisor connection to release * * Unconditionally release all memory associated with a connection. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The connection obj must not - * be used once this method returns. + * The connection object must not be used once this method returns. */ static void virConnectDispose(void *obj) @@ -198,12 +195,12 @@ virConnectCloseCallbackDataDispose(void *obj) * @name: pointer to the domain name * @uuid: pointer to the uuid * - * Lookup if the domain is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new domain object. + * Returns NULL on error. * - * Returns a pointer to the domain, or NULL in case of failure + * The domain object holds a reference to the hypervisor connection. + * When the domain object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virDomainPtr virGetDomain(virConnectPtr conn, const char *name, const unsigned char *uuid) @@ -239,9 +236,7 @@ error: * @domain: the domain to release * * Unconditionally release all memory associated with a domain. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The domain obj must not - * be used once this method returns. + * The domain object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -266,12 +261,12 @@ virDomainDispose(void *obj) * @name: pointer to the network name * @uuid: pointer to the uuid * - * Lookup if the network is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new network object. + * Returns NULL on error. * - * Returns a pointer to the network, or NULL in case of failure + * The network object holds a reference to the hypervisor connection. + * When the network object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virNetworkPtr virGetNetwork(virConnectPtr conn, const char *name, const unsigned char *uuid) @@ -306,9 +301,7 @@ error: * @network: the network to release * * Unconditionally release all memory associated with a network. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The network obj must not - * be used once this method returns. + * The network object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -333,13 +326,12 @@ virNetworkDispose(void *obj) * @name: pointer to the interface name * @mac: pointer to the mac * - * Lookup if the interface is already registered for that connection, - * if yes return a new pointer to it (possibly updating the MAC - * address), if no allocate a new structure, and register it in the - * table. In any case a corresponding call to virObjectUnref() is - * needed to not leak data. + * Allocates and returns a pointer to a new interface object. + * Returns NULL on error. * - * Returns a pointer to the interface, or NULL in case of failure + * The interface object holds a reference to the hypervisor connection. + * When the interface object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virInterfacePtr virGetInterface(virConnectPtr conn, const char *name, const char *mac) @@ -377,9 +369,7 @@ error: * @interface: the interface to release * * Unconditionally release all memory associated with an interface. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The interface obj must not - * be used once this method returns. + * The interface object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -404,12 +394,12 @@ virInterfaceDispose(void *obj) * @privateData: pointer to driver specific private data * @freeFunc: private data cleanup function pointer specfic to driver * - * Lookup if the storage pool is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new storage pool object. + * Returns NULL on error. * - * Returns a pointer to the storage pool, or NULL in case of failure + * The pool object holds a reference to the hypervisor connection. + * When the pool object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virStoragePoolPtr virGetStoragePool(virConnectPtr conn, const char *name, @@ -451,9 +441,7 @@ error: * @pool: the pool to release * * Unconditionally release all memory associated with a pool. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The pool obj must not - * be used once this method returns. + * The pool object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -485,12 +473,12 @@ virStoragePoolDispose(void *obj) * @privateData: pointer to driver specific private data * @freeFunc: private data cleanup function pointer specfic to driver * - * Lookup if the storage vol is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new storage volume object. + * Returns NULL on error. * - * Returns a pointer to the storage vol, or NULL in case of failure + * The volume object holds a reference to the hypervisor connection. + * When the volume object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virStorageVolPtr virGetStorageVol(virConnectPtr conn, const char *pool, const char *name, @@ -532,10 +520,8 @@ error: * virStorageVolDispose: * @vol: the vol to release * - * Unconditionally release all memory associated with a vol. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The vol obj must not - * be used once this method returns. + * Unconditionally release all memory associated with a volume. + * The volume object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -562,12 +548,12 @@ virStorageVolDispose(void *obj) * @conn: the hypervisor connection * @name: device name (unique on node) * - * Lookup if the device is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new node device object. + * Returns NULL on error. * - * Returns a pointer to the node device, or NULL in case of failure + * The device object holds a reference to the hypervisor connection. + * When the device object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virNodeDevicePtr virGetNodeDevice(virConnectPtr conn, const char *name) @@ -599,10 +585,8 @@ error: * virNodeDeviceDispose: * @dev: the dev to release * - * Unconditionally release all memory associated with a dev. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The dev obj must not - * be used once this method returns. + * Unconditionally release all memory associated with a device. + * The device object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -625,12 +609,12 @@ virNodeDeviceDispose(void *obj) * @conn: the hypervisor connection * @uuid: secret UUID * - * Lookup if the secret is already registered for that connection, if so return - * a pointer to it, otherwise allocate a new structure, and register it in the - * table. In any case a corresponding call to virObjectUnref() is needed to not - * leak data. + * Allocates and returns a pointer to a new secret object. + * Returns NULL on error. * - * Returns a pointer to the secret, or NULL in case of failure + * The secret object holds a reference to the hypervisor connection. + * When the secret object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virSecretPtr virGetSecret(virConnectPtr conn, const unsigned char *uuid, @@ -666,12 +650,11 @@ error: * virSecretDispose: * @secret: the secret to release * - * Unconditionally release all memory associated with a secret. The conn.lock - * mutex must be held prior to calling this, and will be released prior to this - * returning. The secret obj must not be used once this method returns. + * Unconditionally release all memory associated with a secret. + * The secret object must not be used once this method returns. * - * It will also unreference the associated connection object, which may also be - * released if its ref count hits zero. + * It will also unreference the associated connection object, + * which may also be released if its ref count hits zero. */ static void virSecretDispose(void *obj) @@ -687,6 +670,17 @@ virSecretDispose(void *obj) } +/** + * virGetStream: + * @conn: the hypervisor connection + * + * Allocates and returns a pointer to a new stream object. + * Returns NULL on error. + * + * The secret object holds a reference to the hypervisor connection. + * When the secret object is no longer needed, virObjectUnref() must be + * called in order to not leak data. + */ virStreamPtr virGetStream(virConnectPtr conn) { @@ -703,6 +697,16 @@ virGetStream(virConnectPtr conn) return ret; } +/** + * virStreamDispose: + * @stream: the stream to release + * + * Unconditionally release all memory associated with a stream. + * The stream object must not be used once this method returns. + * + * It will also unreference the associated connection object, + * which may also be released if its ref count hits zero. + */ static void virStreamDispose(void *obj) { @@ -719,12 +723,12 @@ virStreamDispose(void *obj) * @name: pointer to the network filter pool name * @uuid: pointer to the uuid * - * Lookup if the network filter is already registered for that connection, - * if yes return a new pointer to it, if no allocate a new structure, - * and register it in the table. In any case a corresponding call to - * virObjectUnref() is needed to not leak data. + * Allocates and returns a pointer to a new nwfilter object. + * Returns NULL on error. * - * Returns a pointer to the network, or NULL in case of failure + * The nwfilter object holds a reference to the hypervisor connection. + * When the nwfilter object is no longer needed, virObjectUnref() must be + * called in order to not leak data. */ virNWFilterPtr virGetNWFilter(virConnectPtr conn, const char *name, @@ -762,9 +766,7 @@ error: * @nwfilter: the nwfilter to release * * Unconditionally release all memory associated with a nwfilter. - * The conn.lock mutex must be held prior to calling this, and will - * be released prior to this returning. The nwfilter obj must not - * be used once this method returns. + * The nwfilter object must not be used once this method returns. * * It will also unreference the associated connection object, * which may also be released if its ref count hits zero. @@ -783,6 +785,18 @@ virNWFilterDispose(void *obj) } +/** + * virGetDomainSnapshot: + * @conn: the hypervisor connection + * @name: pointer to the domain snapshot name + * + * Allocates and returns a pointer to a new domain snapshot object. + * Returns NULL on error. + * + * The snapshot object holds a reference to the hypervisor connection. + * When the snapshot object is no longer needed, virObjectUnref() must be + * called in order to not leak data. + */ virDomainSnapshotPtr virGetDomainSnapshot(virDomainPtr domain, const char *name) { @@ -809,6 +823,16 @@ error: } +/** + * virDomainSnapshotDispose: + * @snapshot: the snapshot to release + * + * Unconditionally release all memory associated with a snapshot. + * The snapshot object must not be used once this method returns. + * + * It will also unreference the associated connection object, + * which may also be released if its ref count hits zero. + */ static void virDomainSnapshotDispose(void *obj) { -- 1.8.5.3

2 3

[libvirt] [PATCH] nwfilter: Deactivate iptables MAC address check where needed
by Stefan Berger 10 Mar '14

10 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Recent Linux iptables (3.11.7) refuses to create iptables MAC address check rules using -m mac --mac-source <addr> where previous versions still allowed it. So we now need to deactivate the filtering rules for when the incoming traffic is filtered before it is sent into the VM. Those are typically the chains that start with FO-* or start with FP-* when they are being built. Adapt the documentation to reflect the fact that srcmacaddr, when used in iptables rules, should be regarded as deprecated due to the above mentioned problems. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 42 +++++-------------------------- src/nwfilter/nwfilter_ebiptables_driver.c | 29 +++++++++++++-------- 2 files changed, 24 insertions(+), 47 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 4b95fce..ee23d8e 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -1209,7 +1209,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1320,22 +1320,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1429,22 +1414,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1529,7 +1499,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1640,7 +1610,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1735,7 +1705,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 9d6cc90..ebc3505 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -972,7 +972,7 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, - bool directionIn, + const char *chain, bool directionIn, bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -984,6 +984,14 @@ iptablesHandleSrcMacAddr(virBufferPtr buf, return 0; } + /* recent Linux iptables does not allow this filteirng rule to be + * applied to all FO-* chains + */ + if (chain[1] == CHAINPREFIX_HOST_OUT_TEMP ) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr) < 0) @@ -1366,7 +1374,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1421,7 +1429,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1454,7 +1462,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1482,7 +1490,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1506,11 +1514,10 @@ _iptablesCreateRuleInstance(bool directionIn, virBufferAddLit(&buf, " -p ah"); bufUsed = virBufferUse(&buf); - if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1538,7 +1545,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1574,7 +1581,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1636,7 +1643,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1664,7 +1671,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; -- 1.8.1.4

2 2

[libvirt] [PATCH 1/3] no_mac_source
by Stefan Berger 10 Mar '14

10 Mar '14

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com> Subject nwfilter: Deactivate iptables MAC address check where needed Recent Linux iptables (3.11.7) refuses to create iptables MAC address check rules using -m mac --mac-source <addr> where previous versions still allowed it. So we now need to deactivate the filtering rules for when the incoming traffic is filtered before it is sent into the VM. Those are typically the chains that start with FO-* or start with FP-* when they are being built. Adapt the documentation to reflect the fact that srcmacaddr, when used in iptables rules, should be regarded as deprecated due to the above mentioned problems. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- docs/formatnwfilter.html.in | 42 +++++-------------------------- src/nwfilter/nwfilter_ebiptables_driver.c | 29 +++++++++++++-------- 2 files changed, 24 insertions(+), 47 deletions(-) diff --git a/docs/formatnwfilter.html.in b/docs/formatnwfilter.html.in index 4b95fce..ee23d8e 100644 --- a/docs/formatnwfilter.html.in +++ b/docs/formatnwfilter.html.in @@ -1209,7 +1209,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1320,22 +1320,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1429,22 +1414,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> - </tr> - <tr> - <td>srcmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of sender</td> - </tr> - <tr> - <td>dstmacaddr</td> - <td>MAC_ADDR</td> - <td>MAC address of destination</td> - </tr> - <tr> - <td>dstmacmask</td> - <td>MAC_MASK</td> - <td>Mask applied to MAC address of destination</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1529,7 +1499,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1640,7 +1610,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> @@ -1735,7 +1705,7 @@ <tr> <td>srcmacaddr</td> <td>MAC_ADDR</td> - <td>MAC address of sender</td> + <td>MAC address of sender; this option is deprecated</td> </tr> <tr> <td>srcipaddr</td> diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 9d6cc90..ebc3505 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -972,7 +972,7 @@ static int iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, - bool directionIn, + const char *chain, bool directionIn, bool *srcmacskipped) { char macaddr[VIR_MAC_STRING_BUFLEN]; @@ -984,6 +984,14 @@ iptablesHandleSrcMacAddr(virBufferPtr buf, return 0; } + /* recent Linux iptables does not allow this filteirng rule to be + * applied to all FO-* chains + */ + if (chain[1] == CHAINPREFIX_HOST_OUT_TEMP ) { + *srcmacskipped = true; + return 0; + } + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr) < 0) @@ -1366,7 +1374,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1421,7 +1429,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1454,7 +1462,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1482,7 +1490,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1506,11 +1514,10 @@ _iptablesCreateRuleInstance(bool directionIn, virBufferAddLit(&buf, " -p ah"); bufUsed = virBufferUse(&buf); - if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1538,7 +1545,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1574,7 +1581,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1636,7 +1643,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; @@ -1664,7 +1671,7 @@ _iptablesCreateRuleInstance(bool directionIn, if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, - directionIn, + chain, directionIn, &srcMacSkipped) < 0) goto err_exit; -- 1.8.1.4

2 1

[libvirt] Unable to start Nehalem VM on Nehalem host
by Ruben Kerkhof 10 Mar '14

10 Mar '14

Hi list, I'm trying to debug a strange issue I have, and I'd appreciate some help. I've upgraded libvirt to 1.2.2, on Scientific Linux, with qemu-kvm-0.12.1.2-2.415.el6_5.3 Here’s my analysis so far: I figured out that libvirt uses HMP to get the list of models from qemu-kvm by running qemu-kvm -cpu ?model -nodefconfig. This returns the following: x86 Opteron_G5 AMD Opteron 63xx class CPU x86 Opteron_G4 AMD Opteron 62xx class CPU x86 Opteron_G3 AMD Opteron 23xx (Gen 3 Class Opteron) x86 Opteron_G2 AMD Opteron 22xx (Gen 2 Class Opteron) x86 Opteron_G1 AMD Opteron 240 (Gen 1 Class Opteron) x86 Haswell Intel Core Processor (Haswell) x86 SandyBridge Intel Xeon E312xx (Sandy Bridge) x86 Westmere Westmere E56xx/L56xx/X56xx (Nehalem-C) x86 Nehalem Intel Core i7 9xx (Nehalem Class Core i7) x86 Penryn Intel Core 2 Duo P9xxx (Penryn Class Core 2) x86 Conroe Intel Celeron_4x0 (Conroe/Merom Class Core 2) x86 cpu64-rhel5 QEMU Virtual CPU version (cpu64-rhel5) x86 cpu64-rhel6 QEMU Virtual CPU version (cpu64-rhel6) x86 n270 Intel(R) Atom(TM) CPU N270 @ 1.60GHz x86 athlon QEMU Virtual CPU version 0.12.1 x86 pentium3 x86 pentium2 x86 pentium x86 486 x86 coreduo Genuine Intel(R) CPU T2600 @ 2.16GHz x86 qemu32 QEMU Virtual CPU version 0.12.1 x86 kvm64 Common KVM processor x86 core2duo Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHz x86 phenom AMD Phenom(tm) 9550 Quad-Core Processor x86 qemu64 QEMU Virtual CPU version 0.12.1 The comment describing the function parsing this list states that the output is expected to be as follows: /* Format: * <arch> <model> * qemu-0.13 encloses some model names in []: * <arch> [<model>] */ static int virQEMUCapsParseX86Models(const char *output, virQEMUCapsPtr qemuCaps) { but this function doesn’t strip the rest of the line, so the models array becomes: Breakpoint 1, x86Decode (cpu=0x7fffd82a8460, data=0x7fffd8272d00, models=0x7fffd82b7440, nmodels=25, preferred=0x7fffd82a81f0 "Nehalem", flags=0) at cpu/cpu_x86.c:1487 1487 { (gdb) p models $1 = (const char **) 0x7fffd82b7440 (gdb) p *models $2 = 0x7fffd82ba240 "Opteron_G5 AMD Opteron 63xx class CPU", ' ' <repeats 22 times> (gdb) p *models@25 $3 = {0x7fffd82ba240 "Opteron_G5 AMD Opteron 63xx class CPU", ' ' <repeats 22 times>, 0x7fffd82c8c30 "Opteron_G4 AMD Opteron 62xx class CPU", ' ' <repeats 22 times>, 0x7fffd8169e00 "Opteron_G3 AMD Opteron 23xx (Gen 3 Class Opteron) ", 0x7fffd8169cb0 "Opteron_G2 AMD Opteron 22xx (Gen 2 Class Opteron) ", 0x7fffd8169b60 "Opteron_G1 AMD Opteron 240 (Gen 1 Class Opteron)", ' ' <repeats 11 times>, 0x7fffd8169a10 "Haswell Intel Core Processor (Haswell)", ' ' <repeats 18 times>, 0x7fffd81697e0 "SandyBridge Intel Xeon E312xx (Sandy Bridge)", ' ' <repeats 16 times>, 0x7fffd8169690 "Westmere Westmere E56xx/L56xx/X56xx (Nehalem-C) ", 0x7fffd8169460 "Nehalem Intel Core i7 9xx (Nehalem Class Core i7) ", 0x7fffd81693f0 "Penryn Intel Core 2 Duo P9xxx (Penryn Class Core 2) ", 0x7fffd8169310 "Conroe Intel Celeron_4x0 (Conroe/Merom Class Core 2) ", 0x7fffd8169230 "cpu64-rhel5 QEMU Virtual CPU version (cpu64-rhel5) ", 0x7fffd8169150 "cpu64-rhel6 QEMU Virtual CPU version (cpu64-rhel6) ", 0x7fffd82ba2b0 "n270 Intel(R) Atom(TM) CPU N270 @ 1.60GHz ", 0x7fffd81690e0 "athlon QEMU Virtual CPU version 0.12.1", ' ' <repeats 17 times>, 0x7fffd8169000 "pentium3", ' ' <repeats 50 times>, 0x7fffd8168f90 "pentium2", ' ' <repeats 50 times>, 0x7fffd8168eb0 "pentium", ' ' <repeats 50 times>, 0x7fffd82a8760 "486", ' ' <repeats 50 times>, 0x7fffd8168e40 "coreduo Genuine Intel(R) CPU", ' ' <repeats 11 times>, "T2600 @ 2.16GHz ", 0x7fffd8168d60 "qemu32 QEMU Virtual CPU version 0.12.1", ' ' <repeats 17 times>, 0x7fffd82bb150 "kvm64 Common KVM processor", ' ' <repeats 28 times>, 0x7fffd8168cf0 "core2duo Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHz ", 0x7fffd8168c10 "phenom AMD Phenom(tm) 9550 Quad-Core Processor ", 0x7fffd8168b30 "qemu64 QEMU Virtual CPU version 0.12.1", ' ' <repeats 17 times>} cpuModellsAllowed then does a strcmp between “Nehalem” and "Nehalem Intel Core i7 9xx (Nehalem Class Core i7)” which fails, and the vm fails to start with: 2014-03-10 14:56:16.917+0000: 8328: info : qemuDomainDefineXML:6231 : Creating domain '530df8bd-7b64-4553-b4f4-18922e1327bf' 2014-03-10 14:56:17.114+0000: 8329: warning : x86Decode:1515 : Preferred CPU model Nehalem not allowed by hypervisor; closest supported model will be used 2014-03-10 14:56:17.114+0000: 8329: error : x86Decode:1571 : internal error: Cannot find suitable CPU model for given data Kind regards, Ruben Kerkhof

2 2

[libvirt] [PATCH] virSecurityDACSetSecurityImageLabel: Unmark @def as unused
by Michal Privoznik 10 Mar '14

10 Mar '14

The @def is clearly used just a few lines below. There's no need to use ATTRIBUTE_UNUSED for it. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/security/security_dac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/security/security_dac.c b/src/security/security_dac.c index 09b5e57..85e6eec 100644 --- a/src/security/security_dac.c +++ b/src/security/security_dac.c @@ -342,25 +342,25 @@ virSecurityDACSetSecurityFileLabel(virDomainDiskDefPtr disk ATTRIBUTE_UNUSED, static int virSecurityDACSetSecurityImageLabel(virSecurityManagerPtr mgr, - virDomainDefPtr def ATTRIBUTE_UNUSED, + virDomainDefPtr def, virDomainDiskDefPtr disk) { void *params[2]; virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr); if (!priv->dynamicOwnership) return 0; if (disk->type == VIR_DOMAIN_DISK_TYPE_NETWORK) return 0; params[0] = mgr; params[1] = def; return virDomainDiskDefForeachPath(disk, false, virSecurityDACSetSecurityFileLabel, params); } -- 1.9.0

2 1