- Devel - libvirt List Archives

[libvirt] How to get the host network stats
by Zhang, Yijing 03 Jul '13

03 Jul '13

Hello there, I want to find how to get the host's network stats by using libvirt. I found one from PHP API reference which is called libvirt_domain_interface_stats, I'm guessing it's for guest since it's 'domain'. However, I'm not really sure. Looking forward to hear the answers from you guys. Thank you, Tracey

3 2

[libvirt] [PATCH v3 00/12] Add user namespace support for libvirt lxc
by Gao feng 03 Jul '13

03 Jul '13

This patchset try to add userns support for libvirt lxc. Since userns is nearly completed in linux-3.9, the old kernel doesn't support userns, I add some New XML elements to let people decide if enable userns.The userns is enabled only when user configure the XML. The format of user namespace related XML file like below: <idmap> <uid start='0' target='1000' count='10'> <gid start='0' target='1000' count='10'> </idmap> it means the user in container (which uid:gid is 0:0) will be mapped to the user in host (uid:gid is 1000:1000), count is used to form an u/gid range: The users in container which uid in [start, start + count -1] will be mapped. You can have multiple lines to map differnet id ranges, caution, you must make sure the root user of container has been mapped. This patchset also does the below jobs. 1, Because the uninit userns has no right to create devices, we should create devices for container on host. 2, Changes the owner of fuse and tty device. Change from v2: 1, Mount tmpfs on /stateDir/domain.dev 2, Create devices under /stateDir/doamin.dev/ 3, Mount Move the /.oldroot/stateDir/doamin.dev/ on the /dev/ of container 4, Enhance the configuration, disallow the semi configuration Gao feng (12): LXC: Introduce New XML element for user namespace LXC: enable user namespace only when user set the uidmap LXC: sort the uidmap/gidmap of domain LXC: introduce virLXCControllerSetupUserns and lxcContainerSetID LXC: Creating devices for container on host side LXC: Move creating /dev/ptmx to virLXCControllerSetupDevPTS LXC: fuse: Change files owner to the root user of container LXC: controller: change the owner of tty devices to the root user of container LXC: controller: change the owner of /dev to the root user of container LXC: controller: change the owner of devices created on host LXC: controller: change the owner of /dev/pts and ptmx to the root of container LXC: introduce virLXCControllerChown docs/formatdomain.html.in | 23 ++++ docs/schemas/domaincommon.rng | 31 +++++ src/conf/domain_conf.c | 115 ++++++++++++++++++ src/conf/domain_conf.h | 22 ++++ src/lxc/lxc_container.c | 183 ++++++++++++++-------------- src/lxc/lxc_controller.c | 271 +++++++++++++++++++++++++++++++++++++++++- src/lxc/lxc_fuse.c | 6 + 7 files changed, 557 insertions(+), 94 deletions(-) -- 1.8.1.4

6 49

[libvirt] [PATCH] LXC: blkio: allow to setup weight_device
by Gao feng 03 Jul '13

03 Jul '13

libivrt lxc can only set generic weight for container, This patch allows user to setup per device blkio weigh for container. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- src/lxc/lxc_cgroup.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/src/lxc/lxc_cgroup.c b/src/lxc/lxc_cgroup.c index 5c8acb3..4443b83 100644 --- a/src/lxc/lxc_cgroup.c +++ b/src/lxc/lxc_cgroup.c @@ -123,21 +123,35 @@ cleanup: static int virLXCCgroupSetupBlkioTune(virDomainDefPtr def, virCgroupPtr cgroup) { - int ret = -1; + int i, rc; if (def->blkio.weight) { - int rc = virCgroupSetBlkioWeight(cgroup, def->blkio.weight); + rc = virCgroupSetBlkioWeight(cgroup, def->blkio.weight); if (rc != 0) { virReportSystemError(-rc, _("Unable to set Blkio weight for domain %s"), def->name); - goto cleanup; + return -1; } } - ret = 0; -cleanup: - return ret; + if (def->blkio.ndevices) { + for (i = 0; i < def->blkio.ndevices; i++) { + virBlkioDeviceWeightPtr dw = &def->blkio.devices[i]; + if (!dw->weight) + continue; + rc = virCgroupSetBlkioDeviceWeight(cgroup, dw->path, dw->weight); + if (rc != 0) { + virReportSystemError(-rc, + _("Unable to set io device weight " + "for domain %s"), + def->name); + return -1; + } + } + } + + return 0; } -- 1.8.1.4

2 1

[libvirt] Memory access API
by Marek Marczykowski-Górecki 03 Jul '13

03 Jul '13

Hi, Is there any zero-copy VM memory access API in libvirt? I see only virDomainMemoryPeek function, which copy some memory from VM and do not permit VM memory modifications. What I'm looking for is xen xc_map_foreign_pages or xc_gnttab_map_domain_grant_refs equivalent/wrapper. IOW map memory pages to dom0 address space, without copy. I know that not every hypervisor supports it, but it is useful to build a high-performance communication channel on top of it. -- Best Regards, Marek Marczykowski-Górecki Invisible Things Lab

2 1

[libvirt] [PATCH 0/8] Filtering of object lists via ACLs
by Daniel P. Berrange 03 Jul '13

03 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The current ACL checks validate access to the object being passed in to the API calls. There are a few APIs (all the virConnectList* / virConnectNum* ones) which are used to get lists of objects in the first place. Currently you could find out that there is a VM called "foo", but you can't then do virDomainLookupByName since the ACL check may block it. This series introduces filtering in the object list APIs, so you can't even see the existance of an object called "foo", if you don't have permission over it. This is not yet filtering the legacy Xen driver. Daniel P. Berrange (8): Add access control filtering of domain objects Add access control filtering of network objects Add access control filtering of node device objects Add access control filtering of storage objects Add access control filtering of secret objects Add access control filtering of nwfilter objects Add access control filtering of interface objects Extend the ACL test case to validate filter rule checks src/Makefile.am | 1 + src/check-aclrules.pl | 97 ++++++++++++ src/conf/domain_conf.c | 91 +++++++---- src/conf/domain_conf.h | 17 ++- src/conf/interface_conf.h | 3 + src/conf/network_conf.c | 12 +- src/conf/network_conf.h | 13 +- src/conf/node_device_conf.c | 12 +- src/conf/node_device_conf.h | 12 +- src/conf/storage_conf.c | 12 +- src/conf/storage_conf.h | 11 +- src/interface/interface_backend_netcf.c | 262 +++++++++++++++++++++++++++----- src/interface/interface_backend_udev.c | 56 +++++-- src/libvirt_private.syms | 6 +- src/libxl/libxl_driver.c | 15 +- src/lxc/lxc_driver.c | 15 +- src/network/bridge_driver.c | 44 +++--- src/node_device/node_device_driver.c | 28 ++-- src/nwfilter/nwfilter_driver.c | 39 +++-- src/openvz/openvz_driver.c | 7 +- src/parallels/parallels_driver.c | 14 +- src/parallels/parallels_network.c | 2 +- src/qemu/qemu_driver.c | 24 +-- src/rpc/gendispatch.pl | 42 +++-- src/secret/secret_driver.c | 14 +- src/storage/storage_driver.c | 62 +++++--- src/test/test_driver.c | 18 ++- src/uml/uml_driver.c | 15 +- src/vmware/vmware_driver.c | 12 +- 29 files changed, 716 insertions(+), 240 deletions(-) -- 1.8.1.4

2 19

[libvirt] Hostdev: USB passthrough, about hostport support
by Gonglei (Arei) 03 Jul '13

03 Jul '13

Hi, the Qemu upstream has a hostport property which allows to specify the host usb devices to pass through by bus number and physical port. Will the libvirt have a plan to support this? Thanks! The Qemu's patch: http://git.qemu.org/?p=qemu-stable-1.4.git;a=commitdiff;h=9056a2972a9e93519… Best Regards! -Gonglei

1 0

[libvirt] [PATCH 1/2] virCgroupNewPartition: Don't leak @newpath
by Michal Privoznik 03 Jul '13

03 Jul '13

The @newpath variable is allocated in virCgroupSetPartitionSuffix(). But it's newer freed. --- src/util/vircgroup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c index ae71859..e0b25ed 100644 --- a/src/util/vircgroup.c +++ b/src/util/vircgroup.c @@ -1249,7 +1249,7 @@ int virCgroupNewPartition(const char *path, int rc; char *parentPath = NULL; virCgroupPtr parent = NULL; - char *newpath; + char *newpath = NULL; VIR_DEBUG("path=%s create=%d controllers=%x", path, create, controllers); @@ -1295,6 +1295,7 @@ cleanup: virCgroupFree(group); virCgroupFree(&parent); VIR_FREE(parentPath); + VIR_FREE(newpath); return rc; } #else -- 1.8.1.5

2 4

[libvirt] [libvirt-perl][PATCH] Add missing bracket to Sys::Virt::Domain man page
by Ján Tomko 03 Jul '13

03 Jul '13

https://bugzilla.redhat.com/show_bug.cgi?id=954254 --- Pushed as trivial. lib/Sys/Virt/Domain.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/Sys/Virt/Domain.pm b/lib/Sys/Virt/Domain.pm index 053f127..3630cf0 100644 --- a/lib/Sys/Virt/Domain.pm +++ b/lib/Sys/Virt/Domain.pm @@ -540,7 +540,7 @@ Update the configuration of an existing device. The new configuration is given by C<$xml>. The optional <$flags> parameter defaults to 0 but can accept one of the device hotplug flags described later. -=item $data = $dom->block_peek($path, $offset, $size[, $flags) +=item $data = $dom->block_peek($path, $offset, $size[, $flags]) Peek into the guest disk C<$path>, at byte C<$offset> capturing C<$size> bytes of data. The returned scalar may contain embedded -- 1.8.1.5

1 0

[libvirt] [PATCH] doc: blkio: add some notification
by Gao feng 03 Jul '13

03 Jul '13

If the I/O elevator of disk is not cfq, the setting of blkio.weight is ineffective. And the setting up blkio.weight_device will fail. Add notification for this situation. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com> --- docs/formatdomain.html.in | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 47d91ab..8d048be 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -740,7 +740,8 @@ <dd> The optional <code>blkiotune</code> element provides the ability to tune Blkio cgroup tunable parameters for the domain. If this is omitted, it defaults to the OS provided - defaults. <span class="since">Since 0.8.8</span></dd> + defaults. Notice: blkiotune is effective only when the I/O elevator + of disk is cfq. <span class="since">Since 0.8.8</span></dd> <dt><code>weight</code></dt> <dd> The optional <code>weight</code> element is the overall I/O weight of the guest. The value should be in the range [100, @@ -761,7 +762,8 @@ mandatory sub-elements, <code>path</code> describing the absolute path of the device, and <code>weight</code> giving the relative weight of that device, in the range [100, - 1000]. <span class="since">Since 0.9.8</span></dd> + 1000]. The setting up device.weight will fail if the I/O elevator + of this disk device is not cfq. <span class="since">Since 0.9.8</span></dd> </dl> -- 1.8.1.4

2 2

[libvirt] [PATCH] Crash of libvirtd by unprivileged user in virConnectListAllInterfaces
by Eric Blake 03 Jul '13

03 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> On Thu, Jun 27, 2013 at 03:56:42PM +0100, Daniel P. Berrange wrote: > Hi Security Team, > > I've discovered a way for an unprivileged user with a readonly connection > to libvirtd, to crash the daemon. Ok, the final patch for this is issue will be the simpler variant that Eric suggested The embargo can be considered to be lifted on Monday July 1st, at 0900 UTC The following is the GIT change that DV or myself will apply to libvirt GIT master immediately before the 1.1.0 release: >From 177b4165c531a4b3ba7f6ab6aa41dca9ceb0b8cf Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" <berrange(a)redhat.com> Date: Fri, 28 Jun 2013 10:48:37 +0100 Subject: [PATCH] CVE-2013-2218: Fix crash listing network interfaces with filters The virConnectListAllInterfaces method has a double-free of the 'struct netcf_if' object when any of the filtering flags cause an interface to be skipped over. For example when running the command 'virsh iface-list --inactive' This is a regression introduced in release 1.0.6 by commit 7ac2c4fe624f30f2c8270116513fa2ddab07631f Author: Guannan Ren <gren(a)redhat.com> Date: Tue May 21 21:29:38 2013 +0800 interface: list all interfaces with flags == 0 Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- Posting as a courtesy FYI for anyone reading this list but who does not have access to the security list and doesn't want to crawl through git. This commit has been included in 1.1.0 and has been applied to all affected stable branches (just v1.0.6-maint). The rule in determining that a CVE was necessary is the "escalation of privilege" test - any time a read-only client can cause a denial-of-service against a more-privileged read-write client (by crashing libvirtd), there is an escalation. src/interface/interface_backend_netcf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/interface/interface_backend_netcf.c b/src/interface/interface_backend_netcf.c index a995816..9aa673d 100644 --- a/src/interface/interface_backend_netcf.c +++ b/src/interface/interface_backend_netcf.c @@ -412,6 +412,7 @@ netcfConnectListAllInterfaces(virConnectPtr conn, (MATCH(VIR_CONNECT_LIST_INTERFACES_INACTIVE) && (status & NETCF_IFACE_INACTIVE)))) { ncf_if_free(iface); + iface = NULL; continue; } -- 1.8.1.4

2 1

[libvirt] Bug 980449 - resource leak about event
by Wangyufei (A) 03 Jul '13

03 Jul '13

Hi All, I have filed the following bug for Libvirt event issue : Bug 980449<https://bugzilla.redhat.com/show_bug.cgi?id=980449> - resource leak about event Thanks, WangYufei

1 0

[libvirt] [PATCH v6 0/5] libvirt supports Guest Panicked
by Chen Fan 03 Jul '13

03 Jul '13

Changes: v5-v6: Refactor the patches, and fix the incorrect indentation and name. v4-v5: 1. fix the incorrect indentation and explanation (of some reasons). v3-v4: 1. Supports the dumpcore options of the oncrash element in the XML. 2. Move the previous code to processWatchdogEvent(). v2-v3: 1. split into 3 patches v1-v2: 1. fix the incorrect domain state: paused -> crashed, when crash the guest while libvirt isn't running, then restart libvirtd. Chen Fan (5): libvirt: Define domain crash event types qemu: Refactor the processwatchdogEvent code that can make the driver workpool more generalized qemu: Need to use qemuProcessShutdownOrReboot(), so we defined it at qemu_process.h qemu: Implement 'oncrash' events when guest panicked qemu: Implement 'oncrash' coredump events when guest panicked examples/domain-events/events-c/event-test.c | 10 ++ include/libvirt/libvirt.h.in | 16 ++ src/conf/domain_conf.c | 12 +- src/qemu/qemu_domain.h | 11 +- src/qemu/qemu_driver.c | 222 ++++++++++++++++++++++++--- src/qemu/qemu_monitor.c | 14 +- src/qemu/qemu_monitor.h | 4 + src/qemu/qemu_monitor_json.c | 7 + src/qemu/qemu_process.c | 60 +++++++- src/qemu/qemu_process.h | 3 + tools/virsh-domain-monitor.c | 8 + 11 files changed, 328 insertions(+), 39 deletions(-) -- 1.8.1.4

5 14

[libvirt] [PATCHv2] build: don't ship access syms files in tarball
by Eric Blake 03 Jul '13

03 Jul '13

On a mingw VPATH build (such as done by ./autobuild.sh), the tarball created by 'make dist' was including generated files. The VPATH rules were then seeing that the tarball files were up-to-date, and not regenerating files locally, leading to this failure: GEN libvirt.syms cat: libvirt_access.syms: No such file or directory cat: libvirt_access_qemu.syms: No such file or directory cat: libvirt_access_lxc.syms: No such file or directory make: *** [libvirt.syms] Error 1 We already have a category for generated sym files, which are intentionally not part of the tarball; stick the access sym files in that category. Rearrange the declarations a bit to make it harder to repeat the problem in the future, and drop assignments that are now redundant (GENERATED_SYM_FILES are already listed as BUILT_FILES, so we don't have to repeat that for ACCESS_DRIVER_SYM_FILES). * src/Makefile.am (USED_SYM_FILES): Don't include generated files. (GENERATED_SYM_FILES): Access syms files are generated. (libvirt.syms): Include access syms files here. (ACCESS_DRIVER_SYMFILES): Rename... (ACCESS_DRIVER_SYM_FILES): ...for consistency. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- v1 discussion was here: https://www.redhat.com/archives/libvir-list/2013-July/msg00054.html Pushing under the build-breaker rule; now that I'm more confident at why the build was failing, and also pushing to v1.1.0-maint. src/Makefile.am | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 285334b..15a2840 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -815,7 +815,7 @@ ACCESS_DRIVER_GENERATED = \ $(srcdir)/access/viraccessapichecklxc.h \ $(srcdir)/access/viraccessapichecklxc.c -ACCESS_DRIVER_SYMFILES = \ +ACCESS_DRIVER_SYM_FILES = \ libvirt_access.syms \ libvirt_access_qemu.syms \ libvirt_access_lxc.syms @@ -927,8 +927,14 @@ libvirt_driver_la_CFLAGS = \ libvirt_driver_la_LIBADD = \ $(GNUTLS_LIBS) $(CURL_LIBS) $(DLOPEN_LIBS) +# All .syms files should be placed in exactly one of these three lists, +# depending on whether they are stored in git and/or used in the build. SYM_FILES = $(USED_SYM_FILES) USED_SYM_FILES = $(srcdir)/libvirt_private.syms +GENERATED_SYM_FILES = \ + $(ACCESS_DRIVER_SYM_FILES) \ + libvirt.syms libvirt.def libvirt_qemu.def libvirt_lxc.def \ + $(NULL) if WITH_TEST noinst_LTLIBRARIES += libvirt_driver_test.la @@ -1474,9 +1480,8 @@ EXTRA_DIST += $(ACCESS_DRIVER_POLKIT_SOURCES) endif -USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) -BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) -CLEANFILES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) +BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) +CLEANFILES += $(ACCESS_DRIVER_GENERATED) libvirt_access.syms: $(srcdir)/rpc/gendispatch.pl \ $(REMOTE_PROTOCOL) Makefile.am @@ -1713,12 +1718,9 @@ EXTRA_DIST += \ $(SYM_FILES) \ $(NULL) -GENERATED_SYM_FILES = \ - libvirt.syms libvirt.def libvirt_qemu.def libvirt_lxc.def - BUILT_SOURCES += $(GENERATED_SYM_FILES) -libvirt.syms: libvirt_public.syms $(USED_SYM_FILES) \ +libvirt.syms: libvirt_public.syms $(USED_SYM_FILES) $(ACCESS_DRIVER_SYM_FILES) \ $(top_builddir)/config.status $(AM_V_GEN)rm -f $@-tmp $@ ; \ printf '# WARNING: generated from the following:\n# $^\n\n' >$@-tmp && \ @@ -1726,7 +1728,7 @@ libvirt.syms: libvirt_public.syms $(USED_SYM_FILES) \ printf '\n\n# Private symbols\n\n' >>$@-tmp && \ printf 'LIBVIRT_PRIVATE_$(VERSION) {\n\n' >>$@-tmp && \ printf 'global:\n\n' >>$@-tmp && \ - cat $(USED_SYM_FILES) >>$@-tmp && \ + cat $(USED_SYM_FILES) $(ACCESS_DRIVER_SYM_FILES) >>$@-tmp && \ printf '\n\nlocal:\n*;\n\n};' >>$@-tmp && \ chmod a-w $@-tmp && \ mv $@-tmp libvirt.syms -- 1.8.1.4

1 0

[libvirt] [PATCH] build: avoid build failure without polkit
by Eric Blake 03 Jul '13

03 Jul '13

rpmbuild of mingw-libvirt.spec failed with: GEN libvirt.syms GEN libvirt_qemu.def cat: libvirt_access.syms: No such file or directory cat: libvirt_access_qemu.syms: No such file or directory cat: libvirt_access_lxc.syms: No such file or directory I traced this to unconditionally trying to use the ACL .syms files, even when polkit isn't in use. build: avoid build failure without polkit * src/Makefile.am (USED_SYM_FILES): Mark access driver symbols according to use. --- Even though this fixes a build-breaker (./autobuild.sh), I'm reluctant to push this without review. In particular, I'm worried that I may need a v2 that further conditionalizes whether libvirt_access_qemu.syms is sometimes omitted based on rpm arguments, even if libvirt_access.syms is present. src/Makefile.am | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/Makefile.am b/src/Makefile.am index 4cf999d..042bcba 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1469,12 +1469,13 @@ $(ACCESS_DRIVER_POLKIT_POLICY): $(srcdir)/access/viraccessperm.h \ CLEANFILES += $(ACCESS_DRIVER_POLKIT_POLICY) BUILT_SOURCES += $(ACCESS_DRIVER_POLKIT_POLICY) +USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) else EXTRA_DIST += $(ACCESS_DRIVER_POLKIT_SOURCES) +SYM_FILES += $(ACCESS_DRIVER_SYMFILES) endif -USED_SYM_FILES += $(ACCESS_DRIVER_SYMFILES) BUILT_SOURCES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) CLEANFILES += $(ACCESS_DRIVER_GENERATED) $(ACCESS_DRIVER_SYMFILES) -- 1.8.1.4

2 5

[libvirt] [PATCH] qemu: Restored original console alias
by Michal Privoznik 02 Jul '13

02 Jul '13

Because of some crazy backward compatibility, console device is in some cases just an alias to a serial device. This means, in the process of generating XML description of a domain, all the interesting info is taken from corresponding serial device, if that's the case. Including the device alias. That means, we produce: <console type='pty' tty='/dev/pts/20'> ... <alias name='serial0'/> </console> (notice the assigned alias) Maybe this is okay, maybe its wrong either. Anyway, later, when libvirtd restarts, and we parse the state XML file, we read the wrong alias back. Hence, the internal representation is different to the state it was in prior the libvirtd restart. --- src/qemu/qemu_domain.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 8d79066..96d88ec 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -804,6 +804,34 @@ qemuDomainDeviceDefPostParse(virDomainDeviceDefPtr dev, dev->data.chr->source.data.nix.listen = true; } + /* For some really crazy back compat in virDomainDefFormatInternal we must + * restore the original console alias. For hvm domains, we are formatting + * a dummy console device (based on a serial device which it refers to) + * instead of the original one. That means the device aliases in memory + * and in the formatted XML are not in sync. While in memory we still have + * 'consoleN', in the formatted XML we have 'serialN'. */ + if (dev->type == VIR_DOMAIN_DEVICE_CHR && + dev->data.chr->deviceType == VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE && + dev->data.chr->targetType == VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL && + STREQ(def->os.type, "hvm")) { + int id; + char *alias = dev->data.chr->info.alias; + const char *serial_alias = "serial"; + + if (alias && STRPREFIX(alias, serial_alias)) { + alias += strlen(serial_alias); + + if (virStrToLong_i(alias, NULL, 10, &id) < 0) + goto cleanup; + + VIR_FREE(dev->data.chr->info.alias); + if (virAsprintf(&dev->data.chr->info.alias, "console%d", id) < 0) { + virReportOOMError(); + goto cleanup; + } + } + } + ret = 0; cleanup: -- 1.8.1.5

2 2

[libvirt] [PATCH] domain_conf: Include the correct console alias
by Michal Privoznik 02 Jul '13

02 Jul '13

For some crazy backward compatibility, a console can by just an alias to a serial device. This is detected in the XML formating function which takes the values to format from corresponding serial device. Including the device alias. This results in wrong alias being written into the XML definition: <console type='pty' tty='/dev/pts/5'> ... <alias name='serial0'/> </console> While holding the correct alias still in the memory, it doesn't matter. However, it starts to matter as soon as libvirtd is restarted and the (incorrect) alias is read from status file. --- src/conf/domain_conf.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 011de71..61de836 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -16417,6 +16417,7 @@ virDomainDefFormatInternal(virDomainDefPtr def, memcpy(&console, def->serials[n], sizeof(console)); console.deviceType = VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE; console.targetType = VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL; + memcpy(&console.info, &def->consoles[n]->info, sizeof(console.info)); } else { memcpy(&console, def->consoles[n], sizeof(console)); } @@ -16427,11 +16428,20 @@ virDomainDefFormatInternal(virDomainDefPtr def, def->nconsoles == 0 && def->nserials > 0) { virDomainChrDef console; + char *alias = NULL; memcpy(&console, def->serials[n], sizeof(console)); console.deviceType = VIR_DOMAIN_CHR_DEVICE_TYPE_CONSOLE; console.targetType = VIR_DOMAIN_CHR_CONSOLE_TARGET_TYPE_SERIAL; - if (virDomainChrDefFormat(buf, &console, flags) < 0) + if (console.info.alias) { + if (VIR_STRDUP(alias, "console0") < 0) + goto error; + console.info.alias = alias; + } + if (virDomainChrDefFormat(buf, &console, flags) < 0) { + VIR_FREE(alias); goto error; + } + VIR_FREE(alias); } for (n = 0; n < def->nchannels; n++) -- 1.8.1.5

2 7

[libvirt] [PATCH] build: work around mingw header pollution
by Eric Blake 02 Jul '13

02 Jul '13

On Fedora 18, when cross-compiling to mingw with the mingw*-dbus packages installed, compilation fails with: CC libvirt_net_rpc_server_la-virnetserver.lo In file included from /usr/i686-w64-mingw32/sys-root/mingw/include/dbus-1.0/dbus/dbus-connection.h:32:0, from /usr/i686-w64-mingw32/sys-root/mingw/include/dbus-1.0/dbus/dbus-bus.h:30, from /usr/i686-w64-mingw32/sys-root/mingw/include/dbus-1.0/dbus/dbus.h:31, from ../../src/util/virdbus.h:26, from ../../src/rpc/virnetserver.c:39: /usr/i686-w64-mingw32/sys-root/mingw/include/dbus-1.0/dbus/dbus-message.h:74:58: error: expected ';', ',' or ')' before 'struct' I have reported this as a bug against two packages: - mingw-headers, for polluting the namespace https://bugzilla.redhat.com/show_bug.cgi?id=980270 - dbus, for not dealing with the pollution https://bugzilla.redhat.com/show_bug.cgi?id=980278 At least dbus has agreed that a future version of dbus headers will do s/interface/iface/, regardless of what happens in mingw. But it is also easy to workaround in libvirt in the meantime, without having to wait for either mingw or dbus to upgrade. * src/util/virdbus.h (includes): Undo mingw's pollution so that dbus doesn't fail. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. src/util/virdbus.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/util/virdbus.h b/src/util/virdbus.h index a51dba7..302d40d 100644 --- a/src/util/virdbus.h +++ b/src/util/virdbus.h @@ -1,7 +1,7 @@ /* * virdbus.h: helper for using DBus * - * Copyright (C) 2012 Red Hat, Inc. + * Copyright (C) 2012, 2013 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -23,6 +23,7 @@ # define __VIR_DBUS_H__ # ifdef WITH_DBUS +# undef interface /* Work around namespace pollution in mingw's rpc.h */ # include <dbus/dbus.h> # else # define DBusConnection void -- 1.8.1.4

1 0

[libvirt] [PATCH] qemuNodeDeviceDetachFlags: Avoid use of uninitialized variables
by Michal Privoznik 02 Jul '13

02 Jul '13

After abf75aea24 the compiler screams: qemu/qemu_driver.c: In function 'qemuNodeDeviceDetachFlags': qemu/qemu_driver.c:10693:9: error: 'domain' may be used uninitialized in this function [-Werror=maybe-uninitialized] pci = virPCIDeviceNew(domain, bus, slot, function); ^ qemu/qemu_driver.c:10693:9: error: 'bus' may be used uninitialized in this function [-Werror=maybe-uninitialized] qemu/qemu_driver.c:10693:9: error: 'slot' may be used uninitialized in this function [-Werror=maybe-uninitialized] qemu/qemu_driver.c:10693:9: error: 'function' may be used uninitialized in this function [-Werror=maybe-uninitialized] Since the other functions qemuNodeDeviceReAttach and qemuNodeDeviceReset looks exactly the same, I've initialized the variables there as well. However, I am still wondering why those functions don't matter to gcc while the first one does. --- Pushed as build breaker. src/qemu/qemu_driver.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 6a9135a..4856f37 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10669,7 +10669,7 @@ qemuNodeDeviceDetachFlags(virNodeDevicePtr dev, { virQEMUDriverPtr driver = dev->conn->privateData; virPCIDevicePtr pci = NULL; - unsigned domain, bus, slot, function; + unsigned domain = 0, bus = 0, slot = 0, function = 0; int ret = -1; virNodeDeviceDefPtr def = NULL; char *xml = NULL; @@ -10737,7 +10737,7 @@ qemuNodeDeviceReAttach(virNodeDevicePtr dev) virQEMUDriverPtr driver = dev->conn->privateData; virPCIDevicePtr pci = NULL; virPCIDevicePtr other; - unsigned domain, bus, slot, function; + unsigned domain = 0, bus = 0, slot = 0, function = 0; int ret = -1; virNodeDeviceDefPtr def = NULL; char *xml = NULL; @@ -10799,7 +10799,7 @@ qemuNodeDeviceReset(virNodeDevicePtr dev) { virQEMUDriverPtr driver = dev->conn->privateData; virPCIDevicePtr pci; - unsigned domain, bus, slot, function; + unsigned domain = 0, bus = 0, slot = 0, function = 0; int ret = -1; virNodeDeviceDefPtr def = NULL; char *xml = NULL; -- 1.8.1.5

1 0

[libvirt] [PATCH 0/4] Fix image labeling when saving a guest
by Peter Krempa 02 Jul '13

02 Jul '13

This series cleans up a few places related to selinux labels and fixes issues with selinux when saving a machine with static selinux label and relabeling turned off. Peter Krempa (4): qemu: Improve info message and remove a variable in qemuDomainManagedSave conf: refactor virSecurityLabelDefParseXML security: Introduce method for labeling file descriptors of created files qemu: Always label newly created file on migration (save/managedsave) src/conf/domain_conf.c | 72 ++++++++++++++++++----------------------- src/libvirt_private.syms | 1 + src/qemu/qemu_driver.c | 7 ++-- src/qemu/qemu_migration.c | 4 +-- src/security/security_dac.c | 9 ++++++ src/security/security_driver.h | 4 +++ src/security/security_manager.c | 16 +++++++++ src/security/security_manager.h | 3 ++ src/security/security_nop.c | 1 + src/security/security_selinux.c | 21 ++++++++++++ src/security/security_stack.c | 19 +++++++++++ 11 files changed, 111 insertions(+), 46 deletions(-) -- 1.8.2.1

2 10

[libvirt] [PATCH] Add some misc debugging to LXC startup
by Daniel P. Berrange 02 Jul '13

02 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> Add some debug logging of LXC wait/continue messages and uid/gid map update code. --- src/lxc/lxc_container.c | 4 ++++ src/lxc/lxc_controller.c | 2 ++ 2 files changed, 6 insertions(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index b37300b..282c726 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -294,6 +294,7 @@ int lxcContainerSendContinue(int control) lxc_message_t msg = LXC_CONTINUE_MSG; int writeCount = 0; + VIR_DEBUG("Send continue on fd %d", control); writeCount = safewrite(control, &msg, sizeof(msg)); if (writeCount != sizeof(msg)) { goto error_out; @@ -319,7 +320,9 @@ int lxcContainerWaitForContinue(int control) lxc_message_t msg; int readLen; + VIR_DEBUG("Wait continue on fd %d", control); readLen = saferead(control, &msg, sizeof(msg)); + VIR_DEBUG("Got continue on fd %d %d", control, readLen); if (readLen != sizeof(msg)) { if (readLen >= 0) errno = EIO; @@ -348,6 +351,7 @@ static int lxcContainerSetID(virDomainDefPtr def) * for this container. And user namespace is only enabled * when nuidmap&ngidmap is not zero */ + VIR_DEBUG("Set UID/GID to 0/0"); if (def->idmap.nuidmap && virSetUIDGID(0, 0) < 0) { virReportSystemError(errno, "%s", _("setuid or setgid failed")); diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c index 4c825aa..88601f1 100644 --- a/src/lxc/lxc_controller.c +++ b/src/lxc/lxc_controller.c @@ -1158,6 +1158,8 @@ virLXCControllerSetupUsernsMap(virDomainIdMapEntryPtr map, if (virBufferError(&map_value)) goto no_memory; + VIR_DEBUG("Set '%s' to '%s'", path, virBufferCurrentContent(&map_value)); + if (virFileWriteStr(path, virBufferCurrentContent(&map_value), 0) < 0) { virReportSystemError(errno, _("unable write to %s"), path); goto cleanup; -- 1.8.1.4

3 2

[libvirt] [PATCH v4 00/10] Add user namespace support for libvirt lxc
by Gao feng 02 Jul '13

02 Jul '13

This patchset try to add userns support for libvirt lxc. Since userns is nearly completed in linux-3.9, the old kernel doesn't support userns, I add some New XML elements to let people decide if enable userns.The userns is enabled only when user configure the XML. The format of user namespace related XML file like below: <idmap> <uid start='0' target='1000' count='10'> <gid start='0' target='1000' count='10'> </idmap> it means the user in container (which uid:gid is 0:0) will be mapped to the user in host (uid:gid is 1000:1000), count is used to form an u/gid range: The users in container which uid in [start, start + count -1] will be mapped. You can have multiple lines to map differnet id ranges, caution, you must make sure the root user of container has been mapped. This patchset also does the below jobs. 1, Because the uninit userns has no right to create devices, we should create devices for container on host. 2, Changes the owner of fuse and tty device. Change from v3: 1, fix some bugs that Daniel pointed out 2, reorder the patchset,introduce virLXCControllerChown first. 3, rebase Change from v2: 1, Mount tmpfs on /stateDir/domain.dev 2, Create devices under /stateDir/doamin.dev/ 3, Mount Move the /.oldroot/stateDir/doamin.dev/ on the /dev/ of container 4, Enhance the configuration, disallow the semi configuration Gao feng (10): LXC: Introduce New XML element for user namespace LXC: enable user namespace only when user set the uidmap LXC: sort the uidmap/gidmap of domain LXC: introduce virLXCControllerSetupUserns and lxcContainerSetID LXC: Creating devices for container on host side LXC: controller: change the owner of tty devices to the root user of container LXC: controller: change the owner of /dev to the root user of container LXC: controller: change the owner of devices created on host LXC: controller: change the owner of /dev/pts and ptmx to the root of container LXC: fuse: Change files owner to the root user of container docs/formatdomain.html.in | 23 +++++ docs/schemas/domaincommon.rng | 31 ++++++ src/conf/domain_conf.c | 115 +++++++++++++++++++++ src/conf/domain_conf.h | 22 ++++ src/lxc/lxc_container.c | 173 +++++++++++++++++-------------- src/lxc/lxc_controller.c | 235 ++++++++++++++++++++++++++++++++++++++++-- src/lxc/lxc_fuse.c | 4 + 7 files changed, 516 insertions(+), 87 deletions(-) -- 1.8.1.4

2 25

[libvirt] [PATCH] Ignore failure to mount SELinux filesystem in container
by Daniel P. Berrange 02 Jul '13

02 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> User namespaces will deny the ability to mount the SELinux filesystem. This is harmless for libvirt's LXC needs, so the error can be ignored. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/lxc/lxc_container.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index d9734b5..b37300b 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -741,6 +741,12 @@ static int lxcContainerMountBasicFS(void) VIR_DEBUG("Mount %s on %s type=%s flags=%x, opts=%s", srcpath, mnts[i].dst, mnts[i].type, mnts[i].mflags, mnts[i].opts); if (mount(srcpath, mnts[i].dst, mnts[i].type, mnts[i].mflags, mnts[i].opts) < 0) { +#if WITH_SELINUX + if (STREQ(mnts[i].src, SELINUX_MOUNT) && + (errno == EINVAL || errno == EPERM)) + continue; +#endif + virReportSystemError(errno, _("Failed to mount %s on %s type %s flags=%x opts=%s"), srcpath, mnts[i].dst, NULLSTR(mnts[i].type), -- 1.8.1.4

2 1

[libvirt] [PATCH] qemu: don't use deprecated -no-kvm-pit-reinjection
by Ján Tomko 02 Jul '13

02 Jul '13

Since qemu-kvm 1.1 [1] '-no-kvm-pit-reinjection' has been deprecated in favor of '-global kvm-pit.lost_tick_policy=discard' In upstream qemu since 1.3 [2]. https://bugzilla.redhat.com/show_bug.cgi?id=978719 [1] http://git.kernel.org/cgit/virt/kvm/qemu-kvm.git/commit/?id=4e4fa39 [2] http://git.qemu.org/?p=qemu.git;a=commitdiff;h=c21fb4f --- src/qemu/qemu_capabilities.c | 12 ++++++++++-- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 5 ++++- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 969b001..c6df463 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -233,6 +233,7 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST, "mlock", "vnc-share-policy", /* 150 */ + "kvm-pit-property", ); struct _virQEMUCaps { @@ -2468,13 +2469,12 @@ virQEMUCapsInitArchQMPBasic(virQEMUCapsPtr qemuCaps, /* * Currently only x86_64 and i686 support PCI-multibus, - * -no-acpi and -no-kvm-pit-reinjection. + * -no-acpi */ if (qemuCaps->arch == VIR_ARCH_X86_64 || qemuCaps->arch == VIR_ARCH_I686) { virQEMUCapsSet(qemuCaps, QEMU_CAPS_PCI_MULTIBUS); virQEMUCapsSet(qemuCaps, QEMU_CAPS_NO_ACPI); - virQEMUCapsSet(qemuCaps, QEMU_CAPS_NO_KVM_PIT); } ret = 0; @@ -2640,6 +2640,14 @@ virQEMUCapsInitQMP(virQEMUCapsPtr qemuCaps, if (virQEMUCapsProbeQMPCommandLine(qemuCaps, mon) < 0) goto cleanup; + /* -global kvm-pit.lost_tick_policy=discard */ + if ((qemuCaps->arch == VIR_ARCH_X86_64 || + qemuCaps->arch == VIR_ARCH_I686) && + (qemuCaps->version >= 1003000 || + virQEMUCapsGet(qemuCaps, QEMU_CAPS_KVM))) { + virQEMUCapsSet(qemuCaps, QEMU_CAPS_KVM_PIT_PROPERTY); + } + ret = 0; cleanup: diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 7088747..c64f648 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -189,6 +189,7 @@ enum virQEMUCapsFlags { QEMU_CAPS_DRIVE_DISCARD = 148, /* -drive discard=off(ignore)|on(unmap) */ QEMU_CAPS_MLOCK = 149, /* -realtime mlock=on|off */ QEMU_CAPS_VNC_SHARE_POLICY = 150, /* set display sharing policy */ + QEMU_CAPS_KVM_PIT_PROPERTY = 151, /* -global kvm-pit.lost_tick_policy */ QEMU_CAPS_LAST, /* this must always be the last item */ }; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index ba93233..a678666 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7024,7 +7024,10 @@ qemuBuildCommandLine(virConnectPtr conn, case VIR_DOMAIN_TIMER_TICKPOLICY_DELAY: /* delay is the default if we don't have kernel (-no-kvm-pit), otherwise, the default is catchup. */ - if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_NO_KVM_PIT)) + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_KVM_PIT_PROPERTY)) + virCommandAddArgList(cmd, "-global", + "kvm-pit.lost_tick_policy=discard", NULL); + else if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_NO_KVM_PIT)) virCommandAddArg(cmd, "-no-kvm-pit-reinjection"); break; case VIR_DOMAIN_TIMER_TICKPOLICY_CATCHUP: -- 1.8.1.5

2 2

[libvirt] [PATCHv2] docs: Document hypervisor drivers that support certain timer models
by Peter Krempa 02 Jul '13

02 Jul '13

Not every timer model is supported with each hypervisor. Explicitly mention the driver supporting each timer model. --- Notes: Version 2: - corrected the support of HPET (xen, libxl, qemu) and KVMCLOCK (just qemu) timers docs/formatdomain.html.in | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index cc4c5ea..47d91ab 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -1310,8 +1310,10 @@ <dt><code>name</code></dt> <dd> The <code>name</code> attribute selects which timer is - being modified, and can be one of "platform", "hpet", - "kvmclock", "pit", "rtc", or "tsc". + being modified, and can be one of + "platform" (currently unsupported), + "hpet" (libxl, xen, qemu), "kvmclock" (qemu), + "pit" (qemu), "rtc" (qemu), or "tsc" (libxl). </dd> <dt><code>track</code></dt> <dd> -- 1.8.2.1

2 2

[libvirt] [PATCH 0/2] BlockPivot issues
by Ján Tomko 02 Jul '13

02 Jul '13

https://bugzilla.redhat.com/show_bug.cgi?id=977678 Ján Tomko (2): qemu: fix return value of qemuDomainBlockPivot on errors blockjob: make PIVOT and ASYNC flags mutually exclusive src/qemu/qemu_driver.c | 15 +++++++++++---- tools/virsh-domain.c | 9 ++++++--- 2 files changed, 17 insertions(+), 7 deletions(-) -- 1.8.1.5

3 8

[libvirt] Biweekly upstream qemu-kvm test report - July 1st, 2013
by chandrashekar shastri 02 Jul '13

02 Jul '13

Adding Libvirt list. Thanks, Shastri -------- Original Message -------- Subject: Biweekly upstream qemu-kvm test report - July 1st, 2013 Date: Mon, 01 Jul 2013 19:45:32 +0530 From: chandrashekar shastri <cshastri(a)linux.vnet.ibm.com> To: qemu-devel(a)nongnu.org, ltc-kvm(a)lists.linux.ibm.com, virt-test-devel(a)redhat.com Hi, Please find the status of the upstream testing: Kernel : 3.10.0-rc5+ Qemu : 1.5.50 Libvirt : 1.0.6 Total number of bugs filed : 6 Bugs filed in this week : 5 Qemu Bugs in Launchpad : 1) 1192499 - virsh migration copy-storage-all fails with "Unable to read from monitor: Connection reset by peer" 2) 1192847 - NMI watchdog fails to increment the NMI counter in /proc/interrupts 3) 1195170 - cpu hot-add doesn't work with upstream qemu 1.5.50 Libvirt Bugs Redhat Bugzilla: 1) 979260 - cpu hot-add doesn't work with upstream libvirt 1.0.6 + qemu 1.5.50 2) 979360 - Libvirt fails to Bootstrap fails for local gnulib with 1.0. Features tested in this week: 1. NMI Watchdog 2. Live Migration (with and without shared Storage) 3. CPU hotplug 4. QMP with latest qemu Features that will be taken up in the next cycle: 1. Chardev hotplug 2. VirtIO-scsi 3. Virt Guest Suspend Hibernate Thanks, Shastri

1 0

[libvirt] [PATCH] build: configure must not affect tarball contents
by Eric Blake 02 Jul '13

02 Jul '13

On mingw, configure sets the name of the lxc symfile to libvirt_lxc.defs rather than libvirt_lxc.syms. But tarballs must be arch-independent, regardless of the configure options used for the tree where we ran 'make dist'. This led to the following failure in autobuild.sh: CCLD libvirt-lxc.la CCLD libvirt-qemu.la /usr/lib64/gcc/i686-w64-mingw32/4.7.2/../../../../i686-w64-mingw32/bin/ld: cannot find libvirt_lxc.def: No such file or directory collect2: error: ld returned 1 exit status make[3]: *** [libvirt-lxc.la] Error 1 make[3]: *** Waiting for unfinished jobs.... We were already doing the right thing with libvirt_qemu.syms. * src/Makefile.am (EXTRA_DIST): Don't ship a built file which depends on configure for its final name. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. src/Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/src/Makefile.am b/src/Makefile.am index 042bcba..1a64855 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -1861,7 +1861,6 @@ libvirt_lxc_la_LDFLAGS = \ $(NULL) libvirt_lxc_la_CFLAGS = $(AM_CFLAGS) libvirt_lxc_la_LIBADD = libvirt.la $(CYGWIN_EXTRA_LIBADD) -EXTRA_DIST += $(LIBVIRT_LXC_SYMBOL_FILE) lockdriverdir = $(libdir)/libvirt/lock-driver lockdriver_LTLIBRARIES = -- 1.8.1.4

1 0

[libvirt] [PATCH] build: avoid build failure without gnutls
by Eric Blake 02 Jul '13

02 Jul '13

Found while trying to cross-compile to mingw: CC libvirt_driver_remote_la-remote_driver.lo ../../src/remote/remote_driver.c: In function 'doRemoteOpen': ../../src/remote/remote_driver.c:487:23: error: variable 'verify' set but not used [-Werror=unused-but-set-variable] * src/remote/remote_driver.c (doRemoteOpen): Also ignore 'verify'. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. I also had a report that libvirt fails to compile for mingw on Fedora 19; it looks like a gnulib submodule update will fix part of that issue, so I'm working on that now... https://lists.fedoraproject.org/pipermail/mingw/2013-June/007006.html http://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=86725346 src/remote/remote_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 7a0c1f6..7f3e833 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -609,6 +609,7 @@ doRemoteOpen(virConnectPtr conn, priv->is_secure = 1; #else (void)sanity; + (void)verify; virReportError(VIR_ERR_INVALID_ARG, "%s", _("GNUTLS support not available in this build")); goto failed; -- 1.8.1.4

1 0

[libvirt] [PATCH] Drop iptablesContext
by Roman Bogorodskiy 02 Jul '13

02 Jul '13

iptablesContext holds only 4 pairs of iptables (table, chain) and there's no need to pass it around. This is a first step towards separating bridge_driver.c in platform-specific parts. --- src/libvirt_private.syms | 2 - src/network/bridge_driver.c | 253 +++++++++++++++++-------------------------- src/util/viriptables.c | 257 +++++++++++--------------------------------- src/util/viriptables.h | 65 ++++------- 4 files changed, 183 insertions(+), 394 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 795e011..062c7fb 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -1417,8 +1417,6 @@ iptablesAddForwardRejectOut; iptablesAddOutputFixUdpChecksum; iptablesAddTcpInput; iptablesAddUdpInput; -iptablesContextFree; -iptablesContextNew; iptablesRemoveForwardAllowCross; iptablesRemoveForwardAllowIn; iptablesRemoveForwardAllowOut; diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 2cf49bb..062ec85 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -75,7 +75,6 @@ struct network_driver { virNetworkObjList networks; - iptablesContext *iptables; char *networkConfigDir; char *networkAutostartDir; char *stateDir; @@ -106,8 +105,7 @@ static int networkShutdownNetwork(struct network_driver *driver, static int networkStartNetworkVirtual(struct network_driver *driver, virNetworkObjPtr network); -static int networkShutdownNetworkVirtual(struct network_driver *driver, - virNetworkObjPtr network); +static int networkShutdownNetworkVirtual(virNetworkObjPtr network); static int networkStartNetworkExternal(struct network_driver *driver, virNetworkObjPtr network); @@ -420,10 +418,6 @@ networkStateInitialize(bool privileged, } } - if (!(driverState->iptables = iptablesContextNew())) { - goto out_of_memory; - } - /* if this fails now, it will be retried later with dnsmasqCapsRefresh() */ driverState->dnsmasqCaps = dnsmasqCapsNewFromBinary(DNSMASQ); @@ -531,9 +525,6 @@ networkStateCleanup(void) { VIR_FREE(driverState->dnsmasqStateDir); VIR_FREE(driverState->radvdStateDir); - if (driverState->iptables) - iptablesContextFree(driverState->iptables); - virObjectUnref(driverState->dnsmasqCaps); networkDriverUnlock(driverState); @@ -1544,8 +1535,7 @@ networkRefreshDaemons(struct network_driver *driver) } static int -networkAddMasqueradingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkAddMasqueradingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); @@ -1559,8 +1549,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } /* allow forwarding packets from the bridge interface */ - if (iptablesAddForwardAllowOut(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1573,8 +1562,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, /* allow forwarding packets to the bridge interface if they are * part of an existing connection */ - if (iptablesAddForwardAllowRelatedIn(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowRelatedIn(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1608,8 +1596,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, */ /* First the generic masquerade rule for other protocols */ - if (iptablesAddForwardMasquerade(driver->iptables, - &ipdef->address, + if (iptablesAddForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, @@ -1626,8 +1613,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } /* UDP with a source port restriction */ - if (iptablesAddForwardMasquerade(driver->iptables, - &ipdef->address, + if (iptablesAddForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, @@ -1644,8 +1630,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } /* TCP with a source port restriction */ - if (iptablesAddForwardMasquerade(driver->iptables, - &ipdef->address, + if (iptablesAddForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, @@ -1664,30 +1649,26 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, return 0; masqerr5: - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, "udp"); masqerr4: - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, NULL); masqerr3: - iptablesRemoveForwardAllowRelatedIn(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowRelatedIn(&ipdef->address, prefix, network->def->bridge, forwardIf); masqerr2: - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1696,43 +1677,37 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver, } static void -networkRemoveMasqueradingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkRemoveMasqueradingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); const char *forwardIf = virNetworkDefForwardIf(network->def, 0); if (prefix >= 0) { - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, "tcp"); - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, "udp"); - iptablesRemoveForwardMasquerade(driver->iptables, - &ipdef->address, + iptablesRemoveForwardMasquerade(&ipdef->address, prefix, forwardIf, &network->def->forward.addr, &network->def->forward.port, NULL); - iptablesRemoveForwardAllowRelatedIn(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowRelatedIn(&ipdef->address, prefix, network->def->bridge, forwardIf); - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1740,8 +1715,7 @@ networkRemoveMasqueradingIptablesRules(struct network_driver *driver, } static int -networkAddRoutingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkAddRoutingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); @@ -1755,8 +1729,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver, } /* allow routing packets from the bridge interface */ - if (iptablesAddForwardAllowOut(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1767,8 +1740,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver, } /* allow routing packets to the bridge interface */ - if (iptablesAddForwardAllowIn(driver->iptables, - &ipdef->address, + if (iptablesAddForwardAllowIn(&ipdef->address, prefix, network->def->bridge, forwardIf) < 0) { @@ -1781,8 +1753,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver, return 0; routeerr2: - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1791,22 +1762,19 @@ routeerr1: } static void -networkRemoveRoutingIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkRemoveRoutingIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { int prefix = virNetworkIpDefPrefix(ipdef); const char *forwardIf = virNetworkDefForwardIf(network->def, 0); if (prefix >= 0) { - iptablesRemoveForwardAllowIn(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowIn(&ipdef->address, prefix, network->def->bridge, forwardIf); - iptablesRemoveForwardAllowOut(driver->iptables, - &ipdef->address, + iptablesRemoveForwardAllowOut(&ipdef->address, prefix, network->def->bridge, forwardIf); @@ -1819,8 +1787,7 @@ networkRemoveRoutingIptablesRules(struct network_driver *driver, * If any IPv6 addresses are defined, then add the rules for regular operation. */ static int -networkAddGeneralIp6tablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkAddGeneralIp6tablesRules(virNetworkObjPtr network) { if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && @@ -1830,16 +1797,14 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, /* Catch all rules to block forwarding to/from bridges */ - if (iptablesAddForwardRejectOut(driver->iptables, AF_INET6, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectOut(AF_INET6, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to block outbound traffic from '%s'"), network->def->bridge); goto err1; } - if (iptablesAddForwardRejectIn(driver->iptables, AF_INET6, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectIn(AF_INET6, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to block inbound traffic to '%s'"), network->def->bridge); @@ -1847,8 +1812,7 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, } /* Allow traffic between guests on the same bridge */ - if (iptablesAddForwardAllowCross(driver->iptables, AF_INET6, - network->def->bridge) < 0) { + if (iptablesAddForwardAllowCross(AF_INET6, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow cross bridge traffic on '%s'"), network->def->bridge); @@ -1860,24 +1824,21 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, return 0; /* allow DNS over IPv6 */ - if (iptablesAddTcpInput(driver->iptables, AF_INET6, - network->def->bridge, 53) < 0) { + if (iptablesAddTcpInput(AF_INET6, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow DNS requests from '%s'"), network->def->bridge); goto err4; } - if (iptablesAddUdpInput(driver->iptables, AF_INET6, - network->def->bridge, 53) < 0) { + if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow DNS requests from '%s'"), network->def->bridge); goto err5; } - if (iptablesAddUdpInput(driver->iptables, AF_INET6, - network->def->bridge, 547) < 0) { + if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 547) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add ip6tables rule to allow DHCP6 requests from '%s'"), network->def->bridge); @@ -1888,44 +1849,42 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver, /* unwind in reverse order from the point of failure */ err6: - iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53); err5: - iptablesRemoveTcpInput(driver->iptables, AF_INET6, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53); err4: - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge); err3: - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge); err2: - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge); err1: return -1; } static void -networkRemoveGeneralIp6tablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkRemoveGeneralIp6tablesRules(virNetworkObjPtr network) { if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) && !network->def->ipv6nogw) { return; } if (virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) { - iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 547); - iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 53); - iptablesRemoveTcpInput(driver->iptables, AF_INET6, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 547); + iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53); } /* the following rules are there if no IPv6 address has been defined * but network->def->ipv6nogw == true */ - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET6, network->def->bridge); - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET6, network->def->bridge); - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET6, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge); } static int -networkAddGeneralIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkAddGeneralIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipv4def; @@ -1941,16 +1900,14 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* allow DHCP requests through to dnsmasq */ - if (iptablesAddTcpInput(driver->iptables, AF_INET, - network->def->bridge, 67) < 0) { + if (iptablesAddTcpInput(AF_INET, network->def->bridge, 67) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DHCP requests from '%s'"), network->def->bridge); goto err1; } - if (iptablesAddUdpInput(driver->iptables, AF_INET, - network->def->bridge, 67) < 0) { + if (iptablesAddUdpInput(AF_INET, network->def->bridge, 67) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DHCP requests from '%s'"), network->def->bridge); @@ -1964,24 +1921,21 @@ networkAddGeneralIptablesRules(struct network_driver *driver, */ if (ipv4def && (ipv4def->nranges || ipv4def->nhosts) && - (iptablesAddOutputFixUdpChecksum(driver->iptables, - network->def->bridge, 68) < 0)) { + (iptablesAddOutputFixUdpChecksum(network->def->bridge, 68) < 0)) { VIR_WARN("Could not add rule to fixup DHCP response checksums " "on network '%s'.", network->def->name); VIR_WARN("May need to update iptables package & kernel to support CHECKSUM rule."); } /* allow DNS requests through to dnsmasq */ - if (iptablesAddTcpInput(driver->iptables, AF_INET, - network->def->bridge, 53) < 0) { + if (iptablesAddTcpInput(AF_INET, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DNS requests from '%s'"), network->def->bridge); goto err3; } - if (iptablesAddUdpInput(driver->iptables, AF_INET, - network->def->bridge, 53) < 0) { + if (iptablesAddUdpInput(AF_INET, network->def->bridge, 53) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow DNS requests from '%s'"), network->def->bridge); @@ -1990,8 +1944,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* allow TFTP requests through to dnsmasq if necessary */ if (ipv4def && ipv4def->tftproot && - iptablesAddUdpInput(driver->iptables, AF_INET, - network->def->bridge, 69) < 0) { + iptablesAddUdpInput(AF_INET, network->def->bridge, 69) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow TFTP requests from '%s'"), network->def->bridge); @@ -2000,16 +1953,14 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* Catch all rules to block forwarding to/from bridges */ - if (iptablesAddForwardRejectOut(driver->iptables, AF_INET, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectOut(AF_INET, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to block outbound traffic from '%s'"), network->def->bridge); goto err6; } - if (iptablesAddForwardRejectIn(driver->iptables, AF_INET, - network->def->bridge) < 0) { + if (iptablesAddForwardRejectIn(AF_INET, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to block inbound traffic to '%s'"), network->def->bridge); @@ -2017,8 +1968,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver, } /* Allow traffic between guests on the same bridge */ - if (iptablesAddForwardAllowCross(driver->iptables, AF_INET, - network->def->bridge) < 0) { + if (iptablesAddForwardAllowCross(AF_INET, network->def->bridge) < 0) { virReportError(VIR_ERR_SYSTEM_ERROR, _("failed to add iptables rule to allow cross bridge traffic on '%s'"), network->def->bridge); @@ -2026,7 +1976,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver, } /* add IPv6 general rules, if needed */ - if (networkAddGeneralIp6tablesRules(driver, network) < 0) { + if (networkAddGeneralIp6tablesRules(network) < 0) { goto err9; } @@ -2034,35 +1984,34 @@ networkAddGeneralIptablesRules(struct network_driver *driver, /* unwind in reverse order from the point of failure */ err9: - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); err8: - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); err7: - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); err6: if (ipv4def && ipv4def->tftproot) { - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 69); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); } err5: - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); err4: - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); err3: - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 67); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); err2: - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 67); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67); err1: return -1; } static void -networkRemoveGeneralIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkRemoveGeneralIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipv4def; - networkRemoveGeneralIp6tablesRules(driver, network); + networkRemoveGeneralIp6tablesRules(network); for (ii = 0; (ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, ii)); @@ -2071,25 +2020,23 @@ networkRemoveGeneralIptablesRules(struct network_driver *driver, break; } - iptablesRemoveForwardAllowCross(driver->iptables, AF_INET, network->def->bridge); - iptablesRemoveForwardRejectIn(driver->iptables, AF_INET, network->def->bridge); - iptablesRemoveForwardRejectOut(driver->iptables, AF_INET, network->def->bridge); + iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge); + iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge); + iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge); if (ipv4def && ipv4def->tftproot) { - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 69); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69); } - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 53); - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 53); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53); if (ipv4def && (ipv4def->nranges || ipv4def->nhosts)) { - iptablesRemoveOutputFixUdpChecksum(driver->iptables, - network->def->bridge, 68); + iptablesRemoveOutputFixUdpChecksum(network->def->bridge, 68); } - iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 67); - iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 67); + iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67); + iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67); } static int -networkAddIpSpecificIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkAddIpSpecificIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { /* NB: in the case of IPv6, routing rules are added when the @@ -2098,48 +2045,46 @@ networkAddIpSpecificIptablesRules(struct network_driver *driver, if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) - return networkAddMasqueradingIptablesRules(driver, network, ipdef); + return networkAddMasqueradingIptablesRules(network, ipdef); else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) - return networkAddRoutingIptablesRules(driver, network, ipdef); + return networkAddRoutingIptablesRules(network, ipdef); } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { - return networkAddRoutingIptablesRules(driver, network, ipdef); + return networkAddRoutingIptablesRules(network, ipdef); } return 0; } static void -networkRemoveIpSpecificIptablesRules(struct network_driver *driver, - virNetworkObjPtr network, +networkRemoveIpSpecificIptablesRules(virNetworkObjPtr network, virNetworkIpDefPtr ipdef) { if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) { if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) - networkRemoveMasqueradingIptablesRules(driver, network, ipdef); + networkRemoveMasqueradingIptablesRules(network, ipdef); else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6)) - networkRemoveRoutingIptablesRules(driver, network, ipdef); + networkRemoveRoutingIptablesRules(network, ipdef); } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) { - networkRemoveRoutingIptablesRules(driver, network, ipdef); + networkRemoveRoutingIptablesRules(network, ipdef); } } /* Add all rules for all ip addresses (and general rules) on a network */ static int -networkAddIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkAddIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipdef; virErrorPtr orig_error; /* Add "once per network" rules */ - if (networkAddGeneralIptablesRules(driver, network) < 0) + if (networkAddGeneralIptablesRules(network) < 0) return -1; for (ii = 0; (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii)); ii++) { /* Add address-specific iptables rules */ - if (networkAddIpSpecificIptablesRules(driver, network, ipdef) < 0) { + if (networkAddIpSpecificIptablesRules(network, ipdef) < 0) { goto err; } } @@ -2155,9 +2100,9 @@ err: */ while ((--ii >= 0) && (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii))) { - networkRemoveIpSpecificIptablesRules(driver, network, ipdef); + networkRemoveIpSpecificIptablesRules(network, ipdef); } - networkRemoveGeneralIptablesRules(driver, network); + networkRemoveGeneralIptablesRules(network); /* return the original error */ virSetError(orig_error); @@ -2167,8 +2112,7 @@ err: /* Remove all rules for all ip addresses (and general rules) on a network */ static void -networkRemoveIptablesRules(struct network_driver *driver, - virNetworkObjPtr network) +networkRemoveIptablesRules(virNetworkObjPtr network) { int ii; virNetworkIpDefPtr ipdef; @@ -2176,9 +2120,9 @@ networkRemoveIptablesRules(struct network_driver *driver, for (ii = 0; (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii)); ii++) { - networkRemoveIpSpecificIptablesRules(driver, network, ipdef); + networkRemoveIpSpecificIptablesRules(network, ipdef); } - networkRemoveGeneralIptablesRules(driver, network); + networkRemoveGeneralIptablesRules(network); } static void @@ -2199,8 +2143,8 @@ networkReloadIptablesRules(struct network_driver *driver) /* Only the three L3 network types that are configured by libvirt * need to have iptables rules reloaded. */ - networkRemoveIptablesRules(driver, network); - if (networkAddIptablesRules(driver, network) < 0) { + networkRemoveIptablesRules(network); + if (networkAddIptablesRules(network) < 0) { /* failed to add but already logged */ } } @@ -2526,7 +2470,7 @@ networkStartNetworkVirtual(struct network_driver *driver, goto err1; /* Add "once per network" rules */ - if (networkAddIptablesRules(driver, network) < 0) + if (networkAddIptablesRules(network) < 0) goto err1; for (ii = 0; @@ -2619,7 +2563,7 @@ networkStartNetworkVirtual(struct network_driver *driver, err2: if (!save_err) save_err = virSaveLastError(); - networkRemoveIptablesRules(driver, network); + networkRemoveIptablesRules(network); err1: if (!save_err) @@ -2644,8 +2588,7 @@ networkStartNetworkVirtual(struct network_driver *driver, return -1; } -static int networkShutdownNetworkVirtual(struct network_driver *driver, - virNetworkObjPtr network) +static int networkShutdownNetworkVirtual(virNetworkObjPtr network) { virNetDevBandwidthClear(network->def->bridge); @@ -2677,7 +2620,7 @@ static int networkShutdownNetworkVirtual(struct network_driver *driver, ignore_value(virNetDevSetOnline(network->def->bridge, 0)); - networkRemoveIptablesRules(driver, network); + networkRemoveIptablesRules(network); ignore_value(virNetDevBridgeDelete(network->def->bridge)); @@ -2802,7 +2745,7 @@ static int networkShutdownNetwork(struct network_driver *driver, case VIR_NETWORK_FORWARD_NONE: case VIR_NETWORK_FORWARD_NAT: case VIR_NETWORK_FORWARD_ROUTE: - ret = networkShutdownNetworkVirtual(driver, network); + ret = networkShutdownNetworkVirtual(network); break; case VIR_NETWORK_FORWARD_BRIDGE: @@ -3490,8 +3433,8 @@ networkUpdate(virNetworkPtr net, network->def->forward.type == VIR_NETWORK_FORWARD_NAT || network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE)) { /* these could affect the iptables rules */ - networkRemoveIptablesRules(driver, network); - if (networkAddIptablesRules(driver, network) < 0) + networkRemoveIptablesRules(network); + if (networkAddIptablesRules(network) < 0) goto cleanup; } diff --git a/src/util/viriptables.c b/src/util/viriptables.c index 16fbe9c..63a8031 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -88,52 +88,8 @@ enum { REMOVE }; -typedef struct -{ - char *table; - char *chain; -} iptRules; - -struct _iptablesContext -{ - iptRules *input_filter; - iptRules *forward_filter; - iptRules *nat_postrouting; - iptRules *mangle_postrouting; -}; - -static void -iptRulesFree(iptRules *rules) -{ - VIR_FREE(rules->table); - VIR_FREE(rules->chain); - VIR_FREE(rules); -} - -static iptRules * -iptRulesNew(const char *table, - const char *chain) -{ - iptRules *rules; - - if (VIR_ALLOC(rules) < 0) - return NULL; - - if (VIR_STRDUP(rules->table, table) < 0) - goto error; - - if (VIR_STRDUP(rules->chain, chain) < 0) - goto error; - - return rules; - - error: - iptRulesFree(rules); - return NULL; -} - static virCommandPtr -iptablesCommandNew(iptRules *rules, int family, int action) +iptablesCommandNew(const char *table, const char *chain, int family, int action) { virCommandPtr cmd = NULL; #if HAVE_FIREWALLD @@ -150,9 +106,9 @@ iptablesCommandNew(iptRules *rules, int family, int action) ? IP6TABLES_PATH : IPTABLES_PATH); } - virCommandAddArgList(cmd, "--table", rules->table, + virCommandAddArgList(cmd, "--table", table, action == ADD ? "--insert" : "--delete", - rules->chain, NULL); + chain, NULL); return cmd; } @@ -166,14 +122,14 @@ iptablesCommandRunAndFree(virCommandPtr cmd) } static int ATTRIBUTE_SENTINEL -iptablesAddRemoveRule(iptRules *rules, int family, int action, +iptablesAddRemoveRule(const char *table, const char *chain, int family, int action, const char *arg, ...) { va_list args; virCommandPtr cmd = NULL; const char *s; - cmd = iptablesCommandNew(rules, family, action); + cmd = iptablesCommandNew(table, chain, family, action); virCommandAddArg(cmd, arg); va_start(args, arg); @@ -184,63 +140,8 @@ iptablesAddRemoveRule(iptRules *rules, int family, int action, return iptablesCommandRunAndFree(cmd); } -/** - * iptablesContextNew: - * - * Create a new IPtable context - * - * Returns a pointer to the new structure or NULL in case of error - */ -iptablesContext * -iptablesContextNew(void) -{ - iptablesContext *ctx; - - if (VIR_ALLOC(ctx) < 0) - return NULL; - - if (!(ctx->input_filter = iptRulesNew("filter", "INPUT"))) - goto error; - - if (!(ctx->forward_filter = iptRulesNew("filter", "FORWARD"))) - goto error; - - if (!(ctx->nat_postrouting = iptRulesNew("nat", "POSTROUTING"))) - goto error; - - if (!(ctx->mangle_postrouting = iptRulesNew("mangle", "POSTROUTING"))) - goto error; - - return ctx; - - error: - iptablesContextFree(ctx); - return NULL; -} - -/** - * iptablesContextFree: - * @ctx: pointer to the IP table context - * - * Free the resources associated with an IP table context - */ -void -iptablesContextFree(iptablesContext *ctx) -{ - if (ctx->input_filter) - iptRulesFree(ctx->input_filter); - if (ctx->forward_filter) - iptRulesFree(ctx->forward_filter); - if (ctx->nat_postrouting) - iptRulesFree(ctx->nat_postrouting); - if (ctx->mangle_postrouting) - iptRulesFree(ctx->mangle_postrouting); - VIR_FREE(ctx); -} - static int -iptablesInput(iptablesContext *ctx, - int family, +iptablesInput(int family, const char *iface, int port, int action, @@ -251,7 +152,7 @@ iptablesInput(iptablesContext *ctx, snprintf(portstr, sizeof(portstr), "%d", port); portstr[sizeof(portstr) - 1] = '\0'; - return iptablesAddRemoveRule(ctx->input_filter, + return iptablesAddRemoveRule("filter", "INPUT", family, action, "--in-interface", iface, @@ -274,12 +175,11 @@ iptablesInput(iptablesContext *ctx, */ int -iptablesAddTcpInput(iptablesContext *ctx, - int family, +iptablesAddTcpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, ADD, 1); + return iptablesInput(family, iface, port, ADD, 1); } /** @@ -294,12 +194,11 @@ iptablesAddTcpInput(iptablesContext *ctx, * Returns 0 in case of success or an error code in case of error */ int -iptablesRemoveTcpInput(iptablesContext *ctx, - int family, +iptablesRemoveTcpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, REMOVE, 1); + return iptablesInput(family, iface, port, REMOVE, 1); } /** @@ -315,12 +214,11 @@ iptablesRemoveTcpInput(iptablesContext *ctx, */ int -iptablesAddUdpInput(iptablesContext *ctx, - int family, +iptablesAddUdpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, ADD, 0); + return iptablesInput(family, iface, port, ADD, 0); } /** @@ -335,12 +233,11 @@ iptablesAddUdpInput(iptablesContext *ctx, * Returns 0 in case of success or an error code in case of error */ int -iptablesRemoveUdpInput(iptablesContext *ctx, - int family, +iptablesRemoveUdpInput(int family, const char *iface, int port) { - return iptablesInput(ctx, family, iface, port, REMOVE, 0); + return iptablesInput(family, iface, port, REMOVE, 0); } @@ -381,8 +278,7 @@ static char *iptablesFormatNetwork(virSocketAddr *netaddr, * to proceed to WAN */ static int -iptablesForwardAllowOut(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardAllowOut(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev, @@ -395,7 +291,7 @@ iptablesForwardAllowOut(iptablesContext *ctx, if (!(networkstr = iptablesFormatNetwork(netaddr, prefix))) return -1; - cmd = iptablesCommandNew(ctx->forward_filter, + cmd = iptablesCommandNew("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action); virCommandAddArgList(cmd, @@ -426,13 +322,12 @@ iptablesForwardAllowOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowOut(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardAllowOut(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowOut(ctx, netaddr, prefix, iface, physdev, ADD); + return iptablesForwardAllowOut(netaddr, prefix, iface, physdev, ADD); } /** @@ -449,13 +344,12 @@ iptablesAddForwardAllowOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowOut(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardAllowOut(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowOut(ctx, netaddr, prefix, iface, physdev, REMOVE); + return iptablesForwardAllowOut(netaddr, prefix, iface, physdev, REMOVE); } @@ -463,8 +357,7 @@ iptablesRemoveForwardAllowOut(iptablesContext *ctx, * and associated with an existing connection */ static int -iptablesForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev, @@ -477,7 +370,7 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx, return -1; if (physdev && physdev[0]) { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -488,7 +381,7 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx, "--jump", "ACCEPT", NULL); } else { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -516,13 +409,12 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowRelatedIn(ctx, netaddr, prefix, iface, physdev, ADD); + return iptablesForwardAllowRelatedIn(netaddr, prefix, iface, physdev, ADD); } /** @@ -539,20 +431,18 @@ iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowRelatedIn(ctx, netaddr, prefix, iface, physdev, REMOVE); + return iptablesForwardAllowRelatedIn(netaddr, prefix, iface, physdev, REMOVE); } /* Allow all traffic destined to the bridge, with a valid network address */ static int -iptablesForwardAllowIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardAllowIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev, @@ -565,7 +455,7 @@ iptablesForwardAllowIn(iptablesContext *ctx, return -1; if (physdev && physdev[0]) { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -574,7 +464,7 @@ iptablesForwardAllowIn(iptablesContext *ctx, "--jump", "ACCEPT", NULL); } else { - ret = iptablesAddRemoveRule(ctx->forward_filter, + ret = iptablesAddRemoveRule("filter", "FORWARD", VIR_SOCKET_ADDR_FAMILY(netaddr), action, "--destination", networkstr, @@ -600,13 +490,12 @@ iptablesForwardAllowIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardAllowIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowIn(ctx, netaddr, prefix, iface, physdev, ADD); + return iptablesForwardAllowIn(netaddr, prefix, iface, physdev, ADD); } /** @@ -623,13 +512,12 @@ iptablesAddForwardAllowIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowIn(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardAllowIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev) { - return iptablesForwardAllowIn(ctx, netaddr, prefix, iface, physdev, REMOVE); + return iptablesForwardAllowIn(netaddr, prefix, iface, physdev, REMOVE); } @@ -637,12 +525,11 @@ iptablesRemoveForwardAllowIn(iptablesContext *ctx, * with a valid network address */ static int -iptablesForwardAllowCross(iptablesContext *ctx, - int family, +iptablesForwardAllowCross(int family, const char *iface, int action) { - return iptablesAddRemoveRule(ctx->forward_filter, + return iptablesAddRemoveRule("filter", "FORWARD", family, action, "--in-interface", iface, @@ -663,11 +550,10 @@ iptablesForwardAllowCross(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardAllowCross(iptablesContext *ctx, - int family, +iptablesAddForwardAllowCross(int family, const char *iface) { - return iptablesForwardAllowCross(ctx, family, iface, ADD); + return iptablesForwardAllowCross(family, iface, ADD); } /** @@ -682,11 +568,10 @@ iptablesAddForwardAllowCross(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardAllowCross(iptablesContext *ctx, - int family, +iptablesRemoveForwardAllowCross(int family, const char *iface) { - return iptablesForwardAllowCross(ctx, family, iface, REMOVE); + return iptablesForwardAllowCross(family, iface, REMOVE); } @@ -694,12 +579,11 @@ iptablesRemoveForwardAllowCross(iptablesContext *ctx, * ie the bridge is the in interface */ static int -iptablesForwardRejectOut(iptablesContext *ctx, - int family, +iptablesForwardRejectOut(int family, const char *iface, int action) { - return iptablesAddRemoveRule(ctx->forward_filter, + return iptablesAddRemoveRule("filter", "FORWARD", family, action, "--in-interface", iface, @@ -718,11 +602,10 @@ iptablesForwardRejectOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardRejectOut(iptablesContext *ctx, - int family, +iptablesAddForwardRejectOut(int family, const char *iface) { - return iptablesForwardRejectOut(ctx, family, iface, ADD); + return iptablesForwardRejectOut(family, iface, ADD); } /** @@ -736,11 +619,10 @@ iptablesAddForwardRejectOut(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardRejectOut(iptablesContext *ctx, - int family, +iptablesRemoveForwardRejectOut(int family, const char *iface) { - return iptablesForwardRejectOut(ctx, family, iface, REMOVE); + return iptablesForwardRejectOut(family, iface, REMOVE); } @@ -750,12 +632,11 @@ iptablesRemoveForwardRejectOut(iptablesContext *ctx, * ie the bridge is the out interface */ static int -iptablesForwardRejectIn(iptablesContext *ctx, - int family, +iptablesForwardRejectIn(int family, const char *iface, int action) { - return iptablesAddRemoveRule(ctx->forward_filter, + return iptablesAddRemoveRule("filter", "FORWARD", family, action, "--out-interface", iface, @@ -774,11 +655,10 @@ iptablesForwardRejectIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardRejectIn(iptablesContext *ctx, - int family, +iptablesAddForwardRejectIn(int family, const char *iface) { - return iptablesForwardRejectIn(ctx, family, iface, ADD); + return iptablesForwardRejectIn(family, iface, ADD); } /** @@ -792,11 +672,10 @@ iptablesAddForwardRejectIn(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardRejectIn(iptablesContext *ctx, - int family, +iptablesRemoveForwardRejectIn(int family, const char *iface) { - return iptablesForwardRejectIn(ctx, family, iface, REMOVE); + return iptablesForwardRejectIn(family, iface, REMOVE); } @@ -804,8 +683,7 @@ iptablesRemoveForwardRejectIn(iptablesContext *ctx, * with the bridge */ static int -iptablesForwardMasquerade(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesForwardMasquerade(virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, @@ -841,7 +719,7 @@ iptablesForwardMasquerade(iptablesContext *ctx, } } - cmd = iptablesCommandNew(ctx->nat_postrouting, AF_INET, action); + cmd = iptablesCommandNew("nat", "POSTROUTING", AF_INET, action); virCommandAddArgList(cmd, "--source", networkstr, NULL); if (protocol && protocol[0]) @@ -922,15 +800,14 @@ cleanup: * Returns 0 in case of success or an error code otherwise */ int -iptablesAddForwardMasquerade(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesAddForwardMasquerade(virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol) { - return iptablesForwardMasquerade(ctx, netaddr, prefix, physdev, addr, port, + return iptablesForwardMasquerade(netaddr, prefix, physdev, addr, port, protocol, ADD); } @@ -948,22 +825,20 @@ iptablesAddForwardMasquerade(iptablesContext *ctx, * Returns 0 in case of success or an error code otherwise */ int -iptablesRemoveForwardMasquerade(iptablesContext *ctx, - virSocketAddr *netaddr, +iptablesRemoveForwardMasquerade(virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol) { - return iptablesForwardMasquerade(ctx, netaddr, prefix, physdev, addr, port, + return iptablesForwardMasquerade(netaddr, prefix, physdev, addr, port, protocol, REMOVE); } static int -iptablesOutputFixUdpChecksum(iptablesContext *ctx, - const char *iface, +iptablesOutputFixUdpChecksum(const char *iface, int port, int action) { @@ -972,7 +847,7 @@ iptablesOutputFixUdpChecksum(iptablesContext *ctx, snprintf(portstr, sizeof(portstr), "%d", port); portstr[sizeof(portstr) - 1] = '\0'; - return iptablesAddRemoveRule(ctx->mangle_postrouting, + return iptablesAddRemoveRule("mangle", "POSTROUTING", AF_INET, action, "--out-interface", iface, @@ -998,11 +873,10 @@ iptablesOutputFixUdpChecksum(iptablesContext *ctx, */ int -iptablesAddOutputFixUdpChecksum(iptablesContext *ctx, - const char *iface, +iptablesAddOutputFixUdpChecksum(const char *iface, int port) { - return iptablesOutputFixUdpChecksum(ctx, iface, port, ADD); + return iptablesOutputFixUdpChecksum(iface, port, ADD); } /** @@ -1019,9 +893,8 @@ iptablesAddOutputFixUdpChecksum(iptablesContext *ctx, * return an error, which should be ignored) */ int -iptablesRemoveOutputFixUdpChecksum(iptablesContext *ctx, - const char *iface, +iptablesRemoveOutputFixUdpChecksum(const char *iface, int port) { - return iptablesOutputFixUdpChecksum(ctx, iface, port, REMOVE); + return iptablesOutputFixUdpChecksum(iface, port, REMOVE); } diff --git a/src/util/viriptables.h b/src/util/viriptables.h index b7ce59b..447f4a8 100644 --- a/src/util/viriptables.h +++ b/src/util/viriptables.h @@ -26,102 +26,77 @@ # include "virsocketaddr.h" -typedef struct _iptablesContext iptablesContext; - -iptablesContext *iptablesContextNew (void); -void iptablesContextFree (iptablesContext *ctx); - -int iptablesAddTcpInput (iptablesContext *ctx, - int family, +int iptablesAddTcpInput (int family, const char *iface, int port); -int iptablesRemoveTcpInput (iptablesContext *ctx, - int family, +int iptablesRemoveTcpInput (int family, const char *iface, int port); -int iptablesAddUdpInput (iptablesContext *ctx, - int family, +int iptablesAddUdpInput (int family, const char *iface, int port); -int iptablesRemoveUdpInput (iptablesContext *ctx, - int family, +int iptablesRemoveUdpInput (int family, const char *iface, int port); -int iptablesAddForwardAllowOut (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardAllowOut (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesRemoveForwardAllowOut (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardAllowOut (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesAddForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardAllowRelatedIn(virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesAddForwardAllowIn (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardAllowIn (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesRemoveForwardAllowIn (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardAllowIn (virSocketAddr *netaddr, unsigned int prefix, const char *iface, const char *physdev); -int iptablesAddForwardAllowCross (iptablesContext *ctx, - int family, +int iptablesAddForwardAllowCross (int family, const char *iface); -int iptablesRemoveForwardAllowCross (iptablesContext *ctx, - int family, +int iptablesRemoveForwardAllowCross (int family, const char *iface); -int iptablesAddForwardRejectOut (iptablesContext *ctx, - int family, +int iptablesAddForwardRejectOut (int family, const char *iface); -int iptablesRemoveForwardRejectOut (iptablesContext *ctx, - int family, +int iptablesRemoveForwardRejectOut (int family, const char *iface); -int iptablesAddForwardRejectIn (iptablesContext *ctx, - int family, +int iptablesAddForwardRejectIn (int family, const char *iface); -int iptablesRemoveForwardRejectIn (iptablesContext *ctx, - int family, +int iptablesRemoveForwardRejectIn (int family, const char *iface); -int iptablesAddForwardMasquerade (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesAddForwardMasquerade (virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol); -int iptablesRemoveForwardMasquerade (iptablesContext *ctx, - virSocketAddr *netaddr, +int iptablesRemoveForwardMasquerade (virSocketAddr *netaddr, unsigned int prefix, const char *physdev, virSocketAddrRangePtr addr, virPortRangePtr port, const char *protocol); -int iptablesAddOutputFixUdpChecksum (iptablesContext *ctx, - const char *iface, +int iptablesAddOutputFixUdpChecksum (const char *iface, int port); -int iptablesRemoveOutputFixUdpChecksum (iptablesContext *ctx, - const char *iface, +int iptablesRemoveOutputFixUdpChecksum (const char *iface, int port); #endif /* __QEMUD_IPTABLES_H__ */ -- 1.8.1.4

3 3

[libvirt] [PATCH] qemu: indentation fix
by Ján Tomko 02 Jul '13

02 Jul '13

--- Pushed as trivial. src/qemu/qemu_command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 4d70004..ba93233 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7003,7 +7003,7 @@ qemuBuildCommandLine(virConnectPtr conn, virReportError(VIR_ERR_CONFIG_UNSUPPORTED, _("unsupported rtc tickpolicy '%s'"), virDomainTimerTickpolicyTypeToString(def->clock.timers[i]->tickpolicy)); - goto error; + goto error; } } else if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_RTC) && (def->clock.timers[i]->tickpolicy -- 1.8.1.5

1 0

[libvirt] Release of libvirt-1.1.0
by Daniel Veillard 01 Jul '13

01 Jul '13

As planned I released libvirt-1.1.0 a couple of hours ago after a couple more patches and a fix for CVE-2013-2218 were applied. It should be available on the server along with the rpms: ftp://libvirt.org/libvirt/ The biggest feature leading to the bump in medium release number is the adition of ACL for individual access control of each API, until now there was only two classes of access read-only and read write, this feature is a big enhancement we have been thinking about for years! This version includes a relatively smaller amount of patches though, around 200, with a balanced set of bug fixes and enhancements, plus the fix for CVE-2013-2218 which is afftecting 1.0.6 release. Features: - Extensible migration APIs (Jiri Denemark) - Fine grained ACL support for the API (Daniel P. Berrange) - various improvements in the Xen driver (Jim Fehlig and Marek Marczykowski-Górecki) - improve networking support on BSD (Roman Bogorodskiy) - agent based vCPU hotplug support (Peter Krempa) Security: - CVE-2013-2218: Fix crash listing network interfaces with filters (Daniel P. Berrange) Documentation: - Document security reporting & handling process (Daniel P. Berrange) - Fix reference to #elementsUSB (Philipp Hahn) - Fix sample TPM XML (Stefan Berger) - correct and update network vlan example (Laine Stump) - add spaces to formatstorage.html (Ján Tomko) Portability: - spec: require xen-devel for libxl driver (Eric Blake) - Conditionalize use of IF_MAXUNIT in virnetdevtap.c (Daniel P. Berrange) - Replace use of 'in_addr_t' with 'struct in_addr' (Daniel P. Berrange) - build: Fix VPATH build for access/* (Viktor Mihajlovski) - util: fix build error on non-Linux systems (Laine Stump) - conf: Swap order of AddImplicitControllers and DomainDefPostParse (Viktor Mihajlovski) - S390: Testcase for console default target type (virtio) (Viktor Mihajlovski) - Fix units in virNetDevBridgeSetSTPDelay on BSD (Roman Bogorodskiy) - build: Fix check-aclrules in VPATH build (Jiri Denemark) - build: Fix build with -Werror (Jim Fehlig) - use net/if.h instead of linux/if.h (Roman Bogorodskiy) - build: fix build without posix_fallocate (Eric Blake) - spec: Explicitly require libgcrypt-devel (Jiri Denemark) Bug Fixes: - pci: initialize virtual_functions array pointer to avoid segfault (Laine Stump) - node device driver: update driver name during dumpxml (Laine Stump) - Resolve valgrind errors for nodedev cap parsing (John Ferlan) - Resolve valgrind error in remoteConfigGetStringList() (John Ferlan) - Resolve valgrind error in virStorageBackendCreateQemuImgCmd() (John Ferlan) - Resolve valgrind error in virNetDevVlanParse() (John Ferlan) - Fix vPort management: FC vHBA creation (Dennis Chen) - bridge: don't crash on bandwidth unplug with no bandwidth (Ján Tomko) - Plug leak in virCgroupMoveTask (Ján Tomko) - Fix invalid read in virCgroupGetValueStr (Ján Tomko) - qemu: fix infinite loop in OOM error path (Laine Stump) - pci: fix dangling pointer in qemuDomainReAttachHostdevDevices (Laine Stump) - pci: eliminate leak in OOM condition (Laine Stump) - util: fix bug found by Coverity (Laine Stump) - Fix possible NULL dereference during migration (Jiri Denemark) - virsh: edit: don't leak XML string on reedit or redefine (Ján Tomko) - qemu: don't reset PCI devices being assigned with VFIO (Laine Stump) - pci: eliminate memory leak in virPCIDeviceReattach (Laine Stump) - qemu: check if block I/O limits fit into long long (Ján Tomko) - network: increase max number of routes (Laine Stump) - lxc: Resolve issue with GetScheduler APIs for non running domain (John Ferlan) - qemu: Resolve issue with GetScheduler APIs for non running domain (John Ferlan) - qemu: Avoid leaking uri in qemuMigrationPrepareDirect (Jiri Denemark) - udev: fix crash in libudev logging (Ján Tomko) - remote: Fix client crash when URI path is empty when using ssh (Peter Krempa) - remote: Forbid default "/session" connections when using ssh transport (Peter Krempa) - nodedev: fix vport detection for FC HBA (Ján Tomko) - qemu: Fix memory leak in Prepare phase (Jiri Denemark) - virSocketAddrIsWildcard: Use IN6_IS_ADDR_UNSPECIFIED correctly (Michal Privoznik) - Fix ordering of file open in virProcessGetNamespaces (Richard Weinberger) - qemuDomainGetVcpusFlags: Initialize ncpuinfo (Michal Privoznik) - virtlockd: fix socket path (Ján Tomko) - nwfilter: grab driver lock earlier during init (bz96649) (Stefan Berger) - Fix a invalid usage of virDomainNetDef in OpenVZ driver (Alvaro Polo) - use virBitmapFree instead of VIR_FREE for cpumask (Ján Tomko) - usb: don't spoil decimal addresses (Martin Kletzander) Improvements: - Allow RO connections to interface udev backend (Doug Goldstein) - virsh: Add parenthesis into virsh nodedev-detach help (xuzhang) - nodedev: add iommuGroup to node device object (Laine Stump) - pci: new iommu_group functions (Laine Stump) - network: allow <vlan> in type='hostdev' networks (Laine Stump) - test: include qemuhotplugtest data files in source rpm (Laine Stump) - pci: virPCIDeviceListAddCopy API (Laine Stump) - pci: update stubDriver name in virPCIDeviceBindToStub (Laine Stump) - pci: eliminate repetitive path constructions in virPCIDeviceBindToStub (Laine Stump) - pci: rename virPCIParseDeviceAddress and make it public (Laine Stump) - pci: rename virPCIDeviceGetVFIOGroupDev to virPCIDeviceGetIOMMUGroupDev (Laine Stump) - pci: eliminate unused driver arg from virPCIDeviceDetach (Laine Stump) - tests: Introduce qemuhotplugtest (Michal Privoznik) - qemu: Implement support for VIR_MIGRATE_PARAM_GRAPHICS_URI (Jiri Denemark) - Implement extensible migration APIs in qemu driver (Jiri Denemark) - qemu: Move internals of Confirm phase to qemu_migration.c (Jiri Denemark) - qemu: Move common parts of Prepare phase to qemu_migration.c (Jiri Denemark) - qemu: Move internals of Begin phase to qemu_migration.c (Jiri Denemark) - Use 1.1.0 everywhere in the documentation (Ján Tomko) - Add polkit policy for API checks to rpm spec (Daniel Veillard) - Configure native vlan modes on Open vSwitch ports (james robson) - Introduce VIR_MIGRATE_PARAM_GRAPHICS_URI parameter (Jiri Denemark) - virsh: Use extensible migration APIs (Jiri Denemark) - python: Add bindings for extensible migration APIs (Jiri Denemark) - Adapt virDomainMigratePeer2Peer for extensible migration APIs (Jiri Denemark) - Adapt virDomainMigrateVersion3 for extensible migration APIs (Jiri Denemark) - Implement extensible migration APIs in remote driver (Jiri Denemark) - New internal migration APIs with extensible parameters (Jiri Denemark) - Introduce migration parameters (Jiri Denemark) - Introduce virTypedParamsCopy internal API (Jiri Denemark) - Log input type parameters in API entry points (Jiri Denemark) - Introduce VIR_TYPED_PARAMS_DEBUG macro for dumping typed params (Jiri Denemark) - Introduce virTypedParamsReplaceString internal API (Jiri Denemark) - Introduce virTypedParamsCheck internal API (Jiri Denemark) - util: Emit proper error code in virTypedParamsValidate (Jiri Denemark) - Rename virTypedParameterArrayValidate as virTypedParamsValidate (Jiri Denemark) - pci: make virPCIDeviceDetach consistent in behavior (Laine Stump) - pci: new utility functions (Laine Stump) - pci: change stubDriver from const char* to char* (Laine Stump) - syntax: virPCIDeviceFree is also a NOP for NULL args (Laine Stump) - libxl: support qdisk backend (Jim Fehlig) - libxl: Fix disk format error message (Jim Fehlig) - Add validation that all APIs contain ACL checks (Daniel P. Berrange) - Set process ID in system identity (Daniel P. Berrange) - Add ACL checks into the secrets driver (Daniel P. Berrange) - Add ACL checks into the nwfilter driver (Daniel P. Berrange) - Add ACL checks into the node device driver (Daniel P. Berrange) - Add ACL checks into the interface driver (Daniel P. Berrange) - Add ACL checks into the network driver (Daniel P. Berrange) - Add ACL checks into the storage driver (Daniel P. Berrange) - Add ACL checks into the libxl driver (Daniel P. Berrange) - Add ACL checks into the Xen driver (Daniel P. Berrange) - Add ACL checks into the UML driver (Daniel P. Berrange) - Add ACL checks into the LXC driver (Daniel P. Berrange) - Add ACL checks into the QEMU driver (Daniel P. Berrange) - Auto-generate helpers for checking access control rules (Daniel P. Berrange) - Add ACL annotations to all RPC messages (Daniel P. Berrange) - Setup default access control manager in libvirtd (Daniel P. Berrange) - Set conn->driver before running driver connectOpen method (Daniel P. Berrange) - Define basic internal API for access control (Daniel P. Berrange) - netdev: accept NULL in virNetDevSetupControl (Ján Tomko) - xen: Implement virConnectGetSysinfo (Jim Fehlig) - libxl: Implement virConnectGetSysinfo (Jim Fehlig) - libxl: Allow libxl to set NIC devid (Jim Fehlig) - storage: add support for creating qcow2 images with extensions (Ján Tomko) - conf: add features to volume target XML (Ján Tomko) - util: add support for qcow2v3 image detection (Ján Tomko) - qemu: add hv_vapic and hv_spinlocks support (Ján Tomko) - conf: add vapic and spinlocks to hyperv features (Ján Tomko) - BSD: implement bridge add/remove port and set STP (Roman Bogorodskiy) - BSD: implement virNetDevBridgeCreate() and virNetDevBridgeDelete() (Roman Bogorodskiy) - conf: Requires either uuid or usage of secret (Osier Yang) - qemu: Make probing for commands declarative (Jiri Denemark) - qemu: Make probing for events declarative (Jiri Denemark) - libxl: support paused domain restore in virDomainRestoreFlags (Marek Marczykowski-Górecki) - qemuDomainChangeGraphics: Check listen address change by listen type (Michal Privoznik) - libxl: initialize device structures (Marek Marczykowski-Górecki) - libxl: populate xenstore memory entries at startup, handle dom0_mem (Marek Marczykowski-Górecki) - conf: split out snapshot disk XML formatting (Ján Tomko) - storage: rework qemu-img command line generation (Ján Tomko) - util: switch virBufferTrim to void (Ján Tomko) - migration: Don't propagate VIR_MIGRATE_ABORT_ON_ERROR (Peter Krempa) - migration: Make erroring out on I/O error controllable by flag (Peter Krempa) - qemu_migration: Move waiting for SPICE migration (Michal Privoznik) - spec: Enable KVM support on ARM (Cole Robinson) - virsh: Support SCSI_GENERIC cap flag for nodedev-list (Osier Yang) - nodedev: Support SCSI_GENERIC cap flag for listAllNodeDevices (Osier Yang) - nodedev_hal: Enumerate scsi generic device (Osier Yang) - nodedev_udev: Enumerate scsi generic device (Osier Yang) - qemu: set QEMU_CAPS_DEVICE_VIDEO_PRIMARY cap flag in QMP detection (Guannan Ren) - nodedev_udev: changes missed by commit 1aa0ba3cef (Osier Yang) - nodedev_udev: Refactor udevGetDeviceType (Osier Yang) - nodedev: Expose sysfs path of device (Osier Yang) - Move virGetUserEnt() to where its needed (Doug Goldstein) - BSD: implement virNetDevTapCreate() and virNetDevTapDelete() (Roman Bogorodskiy) - Make virNetDevSetupControl() public. (Roman Bogorodskiy) - LXC: s/chroot/chdir in lxcContainerPivotRoot() (Richard Weinberger) - Implement dispose method for libxlDomainObjPrivate (Frediano Ziglio) - libxl: allow only 'ethernet' and 'bridge' interfaces, allow script there (Marek Marczykowski-Górecki) - qemu: allow restore with non-migratable XML input (Ján Tomko) - libxl: set bootloader for PV domains if not specified (Jim Fehlig) - libxl: Report connect type as Xen (Jim Fehlig) - schema: simplify RNG pattern, remove superfluous <optional> (Claudio Bley) - libvirt_private.syms: add virProcessGetStartTime (Ján Tomko) - qemu: Forbid migration of machines with I/O errors (Peter Krempa) - qemu: Cancel migration if guest encoutners I/O error while migrating (Peter Krempa) - qemu_migrate: Dispose listen address if set from config (Michal Privoznik) - selinux: assume 's0' if the range is empty (Ján Tomko) - storage: fix description of versionOffset (Martin Kletzander) - spec: Drop Requires: vbox (Cole Robinson) - Prefer VIR_STRDUP over virAsprintf(&dst, "%s", str) (Michal Privoznik) - qemu: Implement new QMP command for cpu hotplug (Peter Krempa) - qemu: Implement support for VIR_DOMAIN_VCPU_AGENT in qemuDomainSetVcpusFlags (Peter Krempa) - qemu: Implement request of vCPU state using the guest agent (Peter Krempa) - API: Introduce VIR_DOMAIN_VCPU_AGENT, for agent based CPU hot(un)plug (Peter Krempa) - qemu_agent: Introduce helpers for agent based CPU hot(un)plug (Peter Krempa) - qemu: Use bool instead of int in qemuMonitorSetCPU APIs (Peter Krempa) - virsh-domain-monitor: Remove ATTRIBUTE_UNUSED from a argument (Peter Krempa) - Add support for VirtualBox 4.2 APIs (ryan woodsmall) - qemuDomainMigrateGraphicsRelocate: Use then new virSocketAddrIsWildcard (Michal Privoznik) - virsocket: Introduce virSocketAddrIsWildcard (Michal Privoznik) - iscsi: pass hostnames to iscsiadm instead of resolving them (Ján Tomko) - qemu: Report the offset from host UTC for RTC_CHANGE event (Osier Yang) - qemu: simplify CPU command line parsing (Ján Tomko) - qemu: change two-state int parameters to bool (Ján Tomko) - nwfilter: change two-state int parameters to bool (Ján Tomko) - Remove redundant two-state integers (Ján Tomko) - Replace two-state local integers with bool (Ján Tomko) - storage: Avoid unnecessary ternary operators and refactor the code (Peter Krempa) - openvz: Fix code coverage issue in OpenVZ driver (Alvaro Polo) - qemu: Reformat listen address prior to checking (Michal Privoznik) - Ensure non-root can read /proc/meminfo file in LXC containers (Daniel P. Berrange) - storage: Provide better error message if metadata pre-alloc is unsupported (Peter Krempa) - storage: Clean up function header and reflow error message (Peter Krempa) - storagevolxml2argvtest: Report better error messages on test failure (Peter Krempa) - maint: don't use config.h in .h files (Eric Blake) - qemu: Abstract code for the cpu controller setting into a helper (Osier Yang) - storage: Forbid to shrink the vol's capacity if no --shrink is specified (Osier Yang) - storage: Support preallocate the new capacity for vol-resize (Osier Yang) - snapshot: remove mutually exclusive memory and disk-only duplicate check (Guannan Ren) - virsh: Allow attach-disk to specify disk wwn (Osier Yang) - tests: fix typo in securityselinuxtest (Ján Tomko) - virsh: Obey pool-or-uuid spec when creating volumes (Jiri Denemark) - libvirt-qemu: Dispatch errors from virDomainQemuAgentCommand() (Peter Krempa) - qemu: Properly report guest agent errors on command passthrough (Peter Krempa) - virsh-domain: Report errors and don't deref NULL in qemu-agent-command (Peter Krempa) - RPC: Support up to 16384 cpus on the host and 4096 in the guest (Peter Krempa) - virsh iface-bridge: Ignore delay if stp is turned off (Jiri Denemark) - Fix warning about using an uninitialized next_unit value (Jiri Denemark) - virsh-domain: Add --live, --config, --current logic to cmdAttachInterface (Peter Krempa) - virsh-domain: Add --live, --config, --current logic to cmdAttachDisk (Peter Krempa) - virsh-domain: Add --live, --config, --current logic to cmdAttachDevice (Peter Krempa) Cleanups: - Get rid of useless VIR_STORAGE_FILE_FEATURE_NONE (Ján Tomko) - configure: Remove unused brctl check (Cole Robinson) - storage_backend: Drop unused code (Cole Robinson) - Remove legacy code for single-instance devpts filesystem (Daniel P. Berrange) Thanks everybody for your contributions to this release, with ideas, reports, patches, documentation or localizations ! Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

2 1

[libvirt] [PATCH v2 0/5]Atomic API to delete snapshot object
by Guannan Ren 01 Jul '13

01 Jul '13

v1: https://www.redhat.com/archives/libvir-list/2013-June/msg00573.html v1->v2: Remove VIR_DOMAIN_SNAPSHOT_DELETE_CURRENT flag (name == NULL) means deleting current snapshot object Rebase work Add a new snapshot API to delete snapshot object atomically int virDomainSnapshotDeleteByName(virDomainPtr domain, const char *name, unsigned int flags); The existing virDomainSnapshotDelete API accepts the snapshot object being deleted as an argument that would be not API atomic. Guannan Ren(5) [PATCH v2 1/5] snapshot: define new API virDomainSnapshotDeleteByName [PATCH v2 2/5] auto generate RPC calls for remoteDomainSnapshotDeleteByName [PATCH v2 3/5] qemu: implement SnapshotDeleteByName [PATCH v2 4/5] python: make auto-generated function name nicer [PATCH v2 5/5] virsh: use virDomainSnapshotDeleteByName in virsh include/libvirt/libvirt.h.in | 4 ++++ python/generator.py | 3 +++ src/driver.h | 6 ++++++ src/libvirt.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 5 +++++ src/qemu/qemu_driver.c | 103 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---------------------- src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 14 +++++++++++++- src/remote_protocol-structs | 6 ++++++ tools/virsh-snapshot.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++++---------- 10 files changed, 245 insertions(+), 33 deletions(-)

2 8

[libvirt] [PATCH v5] qemu: Implement CPUs check against machine type's cpu-max
by Michal Novotny 01 Jul '13

01 Jul '13

Implement check whether (maximum) vCPUs doesn't exceed machine type's cpu-max settings. Differences between v4 and v5 (this one): - Changed type to unsigned int - Renamed variable to maxCpus to match previous naming - When machines types are parsed from command line set maxCpus = 0 to don't show Differences between v3 and v4: - Rebased to latest libvirt version - Capability XML output extended by maxCpus field - Extended caps-qemu-kvm.xml test by maxCpus for one of test emulators On older versions of QEMU the check is disabled. Signed-off-by: Michal Novotny <minovotn(a)redhat.com> --- docs/schemas/capability.rng | 5 ++++ src/conf/capabilities.c | 4 +++ src/conf/capabilities.h | 1 + src/qemu/qemu_capabilities.c | 40 +++++++++++++++++++++++++++- src/qemu/qemu_capabilities.h | 3 ++- src/qemu/qemu_monitor.h | 1 + src/qemu/qemu_monitor_json.c | 6 +++++ src/qemu/qemu_process.c | 21 +++++++++++++++ tests/capabilityschemadata/caps-qemu-kvm.xml | 16 +++++------ 9 files changed, 87 insertions(+), 10 deletions(-) diff --git a/docs/schemas/capability.rng b/docs/schemas/capability.rng index 106ca73..65c7c72 100644 --- a/docs/schemas/capability.rng +++ b/docs/schemas/capability.rng @@ -290,6 +290,11 @@ <text/> </attribute> </optional> + <optional> + <attribute name='maxCpus'> + <ref name='unsignedInt'/> + </attribute> + </optional> <text/> </element> </define> diff --git a/src/conf/capabilities.c b/src/conf/capabilities.c index da92c78..5aeb2ab 100644 --- a/src/conf/capabilities.c +++ b/src/conf/capabilities.c @@ -853,6 +853,8 @@ virCapabilitiesFormatXML(virCapsPtr caps) virBufferAddLit(&xml, " <machine"); if (machine->canonical) virBufferAsprintf(&xml, " canonical='%s'", machine->canonical); + if (machine->maxCpus > 0) + virBufferAsprintf(&xml, " maxCpus='%d'", machine->maxCpus); virBufferAsprintf(&xml, ">%s</machine>\n", machine->name); } @@ -871,6 +873,8 @@ virCapabilitiesFormatXML(virCapsPtr caps) virBufferAddLit(&xml, " <machine"); if (machine->canonical) virBufferAsprintf(&xml, " canonical='%s'", machine->canonical); + if (machine->maxCpus > 0) + virBufferAsprintf(&xml, " maxCpus='%d'", machine->maxCpus); virBufferAsprintf(&xml, ">%s</machine>\n", machine->name); } virBufferAddLit(&xml, " </domain>\n"); diff --git a/src/conf/capabilities.h b/src/conf/capabilities.h index abcf6de..6c7efde 100644 --- a/src/conf/capabilities.h +++ b/src/conf/capabilities.h @@ -46,6 +46,7 @@ typedef virCapsGuestMachine *virCapsGuestMachinePtr; struct _virCapsGuestMachine { char *name; char *canonical; + unsigned int maxCpus; }; typedef struct _virCapsGuestDomainInfo virCapsGuestDomainInfo; diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index c4e076a..969b001 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -256,6 +256,7 @@ struct _virQEMUCaps { size_t nmachineTypes; char **machineTypes; char **machineAliases; + unsigned int *machineMaxCpus; }; struct _virQEMUCapsCache { @@ -335,6 +336,7 @@ virQEMUCapsSetDefaultMachine(virQEMUCapsPtr qemuCaps, { char *name = qemuCaps->machineTypes[defIdx]; char *alias = qemuCaps->machineAliases[defIdx]; + unsigned int maxCpus = qemuCaps->machineMaxCpus[defIdx]; memmove(qemuCaps->machineTypes + 1, qemuCaps->machineTypes, @@ -342,8 +344,12 @@ virQEMUCapsSetDefaultMachine(virQEMUCapsPtr qemuCaps, memmove(qemuCaps->machineAliases + 1, qemuCaps->machineAliases, sizeof(qemuCaps->machineAliases[0]) * defIdx); + memmove(qemuCaps->machineMaxCpus + 1, + qemuCaps->machineMaxCpus, + sizeof(qemuCaps->machineMaxCpus[0]) * defIdx); qemuCaps->machineTypes[0] = name; qemuCaps->machineAliases[0] = alias; + qemuCaps->machineMaxCpus[0] = maxCpus; } /* Format is: @@ -390,7 +396,8 @@ virQEMUCapsParseMachineTypesStr(const char *output, } if (VIR_REALLOC_N(qemuCaps->machineTypes, qemuCaps->nmachineTypes + 1) < 0 || - VIR_REALLOC_N(qemuCaps->machineAliases, qemuCaps->nmachineTypes + 1) < 0) { + VIR_REALLOC_N(qemuCaps->machineAliases, qemuCaps->nmachineTypes + 1) < 0 || + VIR_REALLOC_N(qemuCaps->machineMaxCpus, qemuCaps->nmachineTypes + 1) < 0) { VIR_FREE(name); VIR_FREE(canonical); virReportOOMError(); @@ -404,6 +411,8 @@ virQEMUCapsParseMachineTypesStr(const char *output, qemuCaps->machineTypes[qemuCaps->nmachineTypes-1] = name; qemuCaps->machineAliases[qemuCaps->nmachineTypes-1] = NULL; } + /* When parsing from command line we don't have information about maxCpus */ + qemuCaps->machineMaxCpus[qemuCaps->nmachineTypes-1] = 0; } while ((p = next)); @@ -1764,11 +1773,14 @@ virQEMUCapsPtr virQEMUCapsNewCopy(virQEMUCapsPtr qemuCaps) goto no_memory; if (VIR_ALLOC_N(ret->machineAliases, qemuCaps->nmachineTypes) < 0) goto no_memory; + if (VIR_ALLOC_N(ret->machineMaxCpus, qemuCaps->nmachineTypes) < 0) + goto no_memory; ret->nmachineTypes = qemuCaps->nmachineTypes; for (i = 0; i < qemuCaps->nmachineTypes; i++) { if (VIR_STRDUP(ret->machineTypes[i], qemuCaps->machineTypes[i]) < 0 || VIR_STRDUP(ret->machineAliases[i], qemuCaps->machineAliases[i]) < 0) goto error; + ret->machineMaxCpus[i] = qemuCaps->machineMaxCpus[i]; } return ret; @@ -1792,6 +1804,7 @@ void virQEMUCapsDispose(void *obj) } VIR_FREE(qemuCaps->machineTypes); VIR_FREE(qemuCaps->machineAliases); + VIR_FREE(qemuCaps->machineMaxCpus); for (i = 0; i < qemuCaps->ncpuDefinitions; i++) { VIR_FREE(qemuCaps->cpuDefinitions[i]); @@ -1932,6 +1945,7 @@ int virQEMUCapsGetMachineTypesCaps(virQEMUCapsPtr qemuCaps, if (VIR_STRDUP(mach->name, qemuCaps->machineTypes[i]) < 0) goto error; } + mach->maxCpus = qemuCaps->machineMaxCpus[i]; (*machines)[i] = mach; } @@ -1966,6 +1980,25 @@ const char *virQEMUCapsGetCanonicalMachine(virQEMUCapsPtr qemuCaps, } +int virQEMUCapsGetMachineMaxCpus(virQEMUCapsPtr qemuCaps, + const char *name) +{ + size_t i; + + if (!name) + return 0; + + for (i = 0; i < qemuCaps->nmachineTypes; i++) { + if (!qemuCaps->machineMaxCpus[i]) + continue; + if (STREQ(qemuCaps->machineTypes[i], name)) + return qemuCaps->machineMaxCpus[i]; + } + + return 0; +} + + static int virQEMUCapsProbeQMPCommands(virQEMUCapsPtr qemuCaps, qemuMonitorPtr mon) @@ -2083,6 +2116,10 @@ virQEMUCapsProbeQMPMachineTypes(virQEMUCapsPtr qemuCaps, virReportOOMError(); goto cleanup; } + if (VIR_ALLOC_N(qemuCaps->machineMaxCpus, nmachines) < 0) { + virReportOOMError(); + goto cleanup; + } for (i = 0; i < nmachines; i++) { if (VIR_STRDUP(qemuCaps->machineAliases[i], machines[i]->alias) < 0 || @@ -2090,6 +2127,7 @@ virQEMUCapsProbeQMPMachineTypes(virQEMUCapsPtr qemuCaps, goto cleanup; if (machines[i]->isDefault) defIdx = i; + qemuCaps->machineMaxCpus[i] = machines[i]->maxCpus; } qemuCaps->nmachineTypes = nmachines; diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 64a4b1d..7088747 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -234,7 +234,8 @@ size_t virQEMUCapsGetMachineTypes(virQEMUCapsPtr qemuCaps, char ***names); const char *virQEMUCapsGetCanonicalMachine(virQEMUCapsPtr qemuCaps, const char *name); - +int virQEMUCapsGetMachineMaxCpus(virQEMUCapsPtr qemuCaps, + const char *name); int virQEMUCapsGetMachineTypesCaps(virQEMUCapsPtr qemuCaps, size_t *nmachines, virCapsGuestMachinePtr **machines); diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index 3d9afa3..86ef635 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -654,6 +654,7 @@ struct _qemuMonitorMachineInfo { char *name; bool isDefault; char *alias; + unsigned int maxCpus; }; int qemuMonitorGetMachines(qemuMonitorPtr mon, diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 88a0dc9..c0d7960 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -4042,6 +4042,12 @@ int qemuMonitorJSONGetMachines(qemuMonitorPtr mon, if (VIR_STRDUP(info->alias, tmp) < 0) goto cleanup; } + if (virJSONValueObjectHasKey(child, "cpu-max") && + virJSONValueObjectGetNumberUint(child, "cpu-max", &info->maxCpus) < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("query-machines reply has malformed 'cpu-max' data")); + goto cleanup; + } } ret = n; diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 5a0f18b..ac5ffcf 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3330,6 +3330,24 @@ error: } +static bool +qemuValidateCpuMax(virDomainDefPtr def, virQEMUCapsPtr qemuCaps) +{ + unsigned int maxCpus; + + maxCpus = virQEMUCapsGetMachineMaxCpus(qemuCaps, def->os.machine); + if (!maxCpus) + return true; + + if (def->maxvcpus > maxCpus) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + "%s", _("Maximum CPUs greater than specified machine type limit")); + return false; + } + + return true; +} + int qemuProcessStart(virConnectPtr conn, virQEMUDriverPtr driver, virDomainObjPtr vm, @@ -3519,6 +3537,9 @@ int qemuProcessStart(virConnectPtr conn, vm->def->emulator))) goto cleanup; + if (!qemuValidateCpuMax(vm->def, priv->qemuCaps)) + goto cleanup; + if (qemuAssignDeviceAliases(vm->def, priv->qemuCaps) < 0) goto cleanup; diff --git a/tests/capabilityschemadata/caps-qemu-kvm.xml b/tests/capabilityschemadata/caps-qemu-kvm.xml index 36c4b49..1fbc22b 100644 --- a/tests/capabilityschemadata/caps-qemu-kvm.xml +++ b/tests/capabilityschemadata/caps-qemu-kvm.xml @@ -33,18 +33,18 @@ <arch name='i686'> <wordsize>32</wordsize> <emulator>/usr/bin/qemu</emulator> - <machine>pc-0.11</machine> - <machine canonical='pc-0.11'>pc</machine> - <machine>pc-0.10</machine> - <machine>isapc</machine> + <machine maxCpus='255'>pc-0.11</machine> + <machine canonical='pc-0.11' maxCpus='255'>pc</machine> + <machine maxCpus='255'>pc-0.10</machine> + <machine maxCpus='1'>isapc</machine> <domain type='qemu'> </domain> <domain type='kvm'> <emulator>/usr/bin/qemu-kvm</emulator> - <machine>pc-0.11</machine> - <machine canonical='pc-0.11'>pc</machine> - <machine>pc-0.10</machine> - <machine>isapc</machine> + <machine maxCpus='255'>pc-0.11</machine> + <machine canonical='pc-0.11' maxCpus='255'>pc</machine> + <machine maxCpus='255'>pc-0.10</machine> + <machine maxCpus='1'>isapc</machine> </domain> </arch> <features> -- 1.7.11.7

2 3

[libvirt] [RFC PATCH 1/2] LXC: Drop capabilities only if we're not within a user namespace
by Richard Weinberger 01 Jul '13

01 Jul '13

Dropping capabilities within a user namespace makes no sense because any uid 0 process will regain all caps upon execve(). Signed-off-by: Richard Weinberger <richard(a)nod.at> --- src/lxc/lxc_container.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/src/lxc/lxc_container.c b/src/lxc/lxc_container.c index 958e20d..4f00420 100644 --- a/src/lxc/lxc_container.c +++ b/src/lxc/lxc_container.c @@ -1896,6 +1896,15 @@ static int lxcContainerDropCapabilities(bool keepReboot ATTRIBUTE_UNUSED) return 0; } +static int userns_supported(void) +{ + return lxcContainerAvailable(LXC_CONTAINER_FEATURE_USER) == 0; +} + +static int userns_required(virDomainDefPtr def) +{ + return def->idmap.uidmap && def->idmap.gidmap; +} /** * lxcContainerChild: @@ -1992,7 +2001,7 @@ static int lxcContainerChild(void *data) } /* drop a set of root capabilities */ - if (lxcContainerDropCapabilities(!!hasReboot) < 0) + if (!userns_required(vmDef) && lxcContainerDropCapabilities(!!hasReboot) < 0) goto cleanup; if (lxcContainerSendContinue(argv->handshakefd) < 0) { @@ -2025,16 +2034,6 @@ cleanup: return ret; } -static int userns_supported(void) -{ - return lxcContainerAvailable(LXC_CONTAINER_FEATURE_USER) == 0; -} - -static int userns_required(virDomainDefPtr def) -{ - return def->idmap.uidmap && def->idmap.gidmap; -} - virArch lxcContainerGetAlt32bitArch(virArch arch) { /* Any Linux 64bit arch which has a 32bit -- 1.8.1.4

3 27

[libvirt] [PATCH] Document security reporting & handling process
by Daniel P. Berrange 01 Jul '13

01 Jul '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> Historically security issues in libvirt have been primarily triaged & fixed by the Red Hat libvirt members & Red Hat security team, who then usually notify other vendors via appropriate channels. There have been a number of times when vendors have not been properly notified ahead of announcement. It has also disadvantaged community members who have to backport fixes to releases for which there are no current libvirt stable branches. To address this, we want to make the libvirt security process entirely community focused / driven. To this end I have setup a new email address "libvirt-security(a)redhat.com" for end users to report bugs which have (possible) security implications. This email addr is backed by an invitation only, private archive, mailing list. The intent is for the list membership to comprise a subset of the libvirt core team, along with any vendor security team engineers who wish to participate in a responsible disclosure process for libvirt. Members of the list will be responsible for analysing the problem to determine if a security issue exists and then issue fixes for all current official stable branches & git master. I am proposing the following libvirt core team people as members of the security team / list (all cc'd): Daniel Berrange (Red Hat) Eric Blake (Red Hat) Jiri Denemar (Red Hat) Daniel Veillard (Red Hat) Jim Fehlig (SUSE) Doug Goldstein (Gentoo) Guido Günther (Debian) We don't have anyone from Ubuntu on the libvirt core team. Serge Hallyn is the most frequent submitter of patches from Ubuntu in recent history, so I'd like to invite him to join. Alternatively, Serge, feel free to suggest someone else to represent Ubuntu's interests. If any other vendors/distros have security people who are responsible for dealing with libvirt security issues, and want to join to get early disclosure of issues, they can suggest people. Existing security team members will vet / approve such requests to ensure they are genuine. Anyone on the team / list will be **required** to honour any embargo period agreed between members for non-public issues that are reported. The aim will be to have a maximum 2 week embargo period in the common case, extendable to 1 month if there is sufficient justification made. If anyone feels they are unable to follow such an embargo process for whatever reason, please decline membership of the security list/team. The patch which follows puts up some docs on the website about all of this.... Document how to report security bugs and the process that will be used for addressing them. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- docs/bugs.html.in | 12 +++++ docs/contact.html.in | 12 +++++ docs/securityprocess.html.in | 113 +++++++++++++++++++++++++++++++++++++++++++ docs/sitemap.html.in | 4 ++ 4 files changed, 141 insertions(+) create mode 100644 docs/securityprocess.html.in diff --git a/docs/bugs.html.in b/docs/bugs.html.in index 3d79b32..71e43e4 100644 --- a/docs/bugs.html.in +++ b/docs/bugs.html.in @@ -7,6 +7,18 @@ <ul id="toc"></ul> + <h2><a name="security">Security Issues</a></h2> + + <p> + If you think that an issue with libvirt may have security + implications, <strong>please do not</strong> publically + report it in the bug tracker, mailing lists, or irc. Libvirt + has <a href="securityprocess.html">a dedicated process for handling (potential) security issues</a> + that should be used instead. So if your issue has security + implications, ignore the rest of this page and follow the + <a href="securityprocess.html">security process</a> instead. + </p> + <h2><a name="bugzilla">Bug Tracking</a></h2> <p> diff --git a/docs/contact.html.in b/docs/contact.html.in index e34de67..51cc775 100644 --- a/docs/contact.html.in +++ b/docs/contact.html.in @@ -6,6 +6,18 @@ <ul id="toc"></ul> + <h2><a name="security">Security Issues</a></h2> + + <p> + If you think that an issue with libvirt may have security + implications, <strong>please do not</strong> publically + report it in the bug tracker, mailing lists, or irc. Libvirt + has <a href="securityprocess.html">a dedicated process for handling (potential) security issues</a> + that should be used instead. So if your issue has security + implications, ignore the rest of this page and follow the + <a href="securityprocess.html">security process</a> instead. + </p> + <h2><a name="email">Mailing lists</a></h2> <p> diff --git a/docs/securityprocess.html.in b/docs/securityprocess.html.in new file mode 100644 index 0000000..c29ae80 --- /dev/null +++ b/docs/securityprocess.html.in @@ -0,0 +1,113 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> +<html xmlns="http://www.w3.org/1999/xhtml"> + <body> + + <h1>Security Process</h1> + + <ul id="toc"></ul> + + <p> + The libvirt project believes in responsible disclosure of + security problems, to allow vendors time to prepare and + distribute patches for problems ahead of their publication. + This page describes how the process works and how to report + potential security issues. + </p> + + <h2><a name="reporting">Reporting security issues</a></h2> + + <p> + In the event that a bug in libvirt is found which is + believed to have (potential) security implications there + is a dedicated contact to which a bug report / notification + should be directed. Send an email with as many details of + the problem as possible (ideally with steps to reproduce) + to the following email address: + </p> + + <pre> +<a href="mailto:libvirt-security@redhat.com">libvirt-security(a)redhat.com</a></pre> + + <p> + NB. while this email address is backed by a mailing list, it + is invitation only and moderated for non-members. As such you + will receive an auto-reply indicating the report is held for + moderation. Postings by non-members will be approved by a + moderator and the reporter copied on any replies. + </p> + + <h2><a name="seclist">Security team</a></h2> + + <p> + The libvirt security team is made up of a subset of the libvirt + core development team which covers the various distro maintainers + of libvirt, along with nominated security engineers representing + the various vendors who distribute libvirt. The team is responsible + for analysing incoming reports from users to identify whether a + security problem exists and its severity. It then works to produce + a fix for all official stable branches of libvirt and co-ordinate + embargo dates between vendors to allow simultaneous release of the + fix by all affected parties. + </p> + + <p> + If you are a security representative of a vendor distributing + libvirt and would like to join the security team, send an email + to the afore-mentioned security address. Typically an existing + member of the security team will have to vouch for your credentials + before membership is approved. All members of the security team + are <strong>required to respect the embargo policy</strong> + described below. + </p> + + <h2><a name="embargo">Publication embargo policy</a></h2> + + <p> + The libvirt security team operates a policy of + <a href="http://en.wikipedia.org/wiki/Responsible_disclosure">responsible disclosure</a>. + As such any security issue reported, that is not already publically disclosed + elswhere, will have an embargo date assigned. Members of the security team agree + not to publically disclose any details of the security issue until the embargo + date expires. + </p> + + <p> + The general aim of the team is to have embargo dates which + are two weeks or less in duration. If a problem is identified + with a proposed patch for a security issue, requiring further + investigation and bug fixing, the embargo clock may be restarted. + In exceptional circumstances longer initial embargos may be + negotiated by mutual agreement between members of the security + team and other relevant parties to the problem. Any such extended + embargoes will aim to be at most one month in duration. + </p> + + + <h2><a name="cve">CVE allocation</a></h2> + + <p> + The libvirt security team will associate each security issue with + a CVE number. The CVE numbers will usually be allocated by one of + the vendor security engineers on the security team. + </p> + + <h2><a name="branches">Branch fixing policy</a></h2> + + <p> + The libvirt community maintains one or more stable release branches + at any given point in time. The security team will aim to publish + fixes for GIT master (which will become the next major release) and + each currently maintained stable release branch. The distro maintainers + will be responsible for backporting the officially published fixes to + other release branches where applicable. + </p> + + <h2><a name="notification">Notification of issues</a></h2> + + <p> + When an embargo expires, security issues will be announced on both + the libvirt development and announcement <a href="http://libvirt.org/contact.html#email">mailing lists</a>. + </p> + </body> +</html> diff --git a/docs/sitemap.html.in b/docs/sitemap.html.in index cb7cc5b..fd10caf 100644 --- a/docs/sitemap.html.in +++ b/docs/sitemap.html.in @@ -349,6 +349,10 @@ <span>How and where to report bugs and request features</span> <ul> <li> + <a href="securityprocess.html">Security Process</a> + <span>Security bug reporting and resolution process</span> + </li> + <li> <a href="todo.html">Todo list</a> <span>Main feature request list</span> </li> -- 1.8.1.4

6 8

[libvirt] [PATCH] node device driver: update driver name during dumpxml
by Laine Stump 01 Jul '13

01 Jul '13

This fixes: https://bugzilla.redhat.com/show_bug.cgi?id=979290 https://bugzilla.redhat.com/show_bug.cgi?id=979330 The node device driver was written with the assumption that udev would use a "change" event to notify libvirt of any change to device status (including the name of the driver it was bound to). It turns out this is not the case (see Comment 4 of BZ 979290). That means that a dumpxml for a device would always show whatever driver happened to be bound at the time libvirt was started (when the node device cache was built). There was already code in the driver (for the benefit of the HAL backend) that updated the driver name from sysfs each time a device's info was retrieved from the cache. This patch just enables that manual update for the udev backend as well. --- src/node_device/node_device_driver.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c index 67e90a1..8e6911a 100644 --- a/src/node_device/node_device_driver.c +++ b/src/node_device/node_device_driver.c @@ -60,10 +60,15 @@ static int update_caps(virNodeDeviceObjPtr dev) } -#if defined (__linux__) && defined (WITH_HAL) -/* Under libudev changes to the driver name should be picked up as - * "change" events, so we don't call update driver name unless we're - * using the HAL backend. */ +#if defined (__linux__) && ( defined (WITH_HAL) || defined(WITH_UDEV)) +/* NB: It was previously believed that changes in driver name were + * relayed to libvirt as "change" events by udev, and the udev event + * notification is setup to recognize such events and effectively + * recreate the device entry in the cache. However, neither the kernel + * nor udev sends such an event, so it is necessary to manually update + * the driver name for a device each time its entry is used, both for + * udev *and* HAL backends. + */ static int update_driver_name(virNodeDeviceObjPtr dev) { char *driver_link = NULL; -- 1.7.11.7

2 2

[libvirt] [PATCH] pci: initialize virtual_functions array pointer to avoid segfault
by Laine Stump 01 Jul '13

01 Jul '13

This fixes https://bugzilla.redhat.com/show_bug.cgi?id=971325 The problem was that if virPCIGetVirtualFunctions was given the name of a non-existent interface, it would return to its caller without initializing the pointer to the array of virtual functions to NULL, and the caller (virNetDevGetVirtualFunctions) would try to VIR_FREE() the invalid pointer. The final error message before the crash would be: virPCIGetVirtualFunctions:2088 : Failed to open dir '/sys/class/net/eth2/device': No such file or directory In this patch I move the initialization in virPCIGetVirtualFunctions() to the begining of the function, and also do an explicit initialization in virNetDevGetVirtualFunctions, just in case someone in the future adds code into that function prior to the call to virPCIGetVirtualFunctions. --- src/util/virnetdev.c | 3 +++ src/util/virpci.c | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c index ebe20d0..5e8dffb 100644 --- a/src/util/virnetdev.c +++ b/src/util/virnetdev.c @@ -1100,6 +1100,9 @@ virNetDevGetVirtualFunctions(const char *pfname, char *pci_sysfs_device_link = NULL; char *pciConfigAddr = NULL; + *virt_fns = NULL; + *n_vfname = 0; + if (virNetDevSysfsFile(&pf_sysfs_device_link, pfname, "device") < 0) return ret; diff --git a/src/util/virpci.c b/src/util/virpci.c index 2acab1a..15de3f9 100644 --- a/src/util/virpci.c +++ b/src/util/virpci.c @@ -2449,6 +2449,9 @@ virPCIGetVirtualFunctions(const char *sysfs_path, VIR_DEBUG("Attempting to get SR IOV virtual functions for device" "with sysfs path '%s'", sysfs_path); + *virtual_functions = NULL; + *num_virtual_functions = 0; + dir = opendir(sysfs_path); if (dir == NULL) { memset(errbuf, '\0', sizeof(errbuf)); @@ -2458,8 +2461,6 @@ virPCIGetVirtualFunctions(const char *sysfs_path, return ret; } - *virtual_functions = NULL; - *num_virtual_functions = 0; while ((entry = readdir(dir))) { if (STRPREFIX(entry->d_name, "virtfn")) { virPCIDeviceAddress *config_addr = NULL; -- 1.7.11.7

2 2

[libvirt] [PATCH] spec: require xen-devel for libxl driver
by Eric Blake 30 Jun '13

30 Jun '13

When using 'rpmbuild --define "_without_xen"', but on a new enough Fedora where %{with_libxl} still gets set to 1 by default, the build dependencies were incomplete, which could result in 'make rpm' failing because ./configure failed to build the libxl driver. * libvirt.spec.in (BuildRequires): Fix xen-devel condition. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- Pushing under the build-breaker rule. I found this on a machine with 'xen-devel' uninstalled, while running ./autobuild.sh; it took me a while to find the root cause, since autobuild.sh uses 'rpmbuild --nodeps' and therefore failed to tell me which packages I did not have installed. libvirt.spec.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index f40b614..aee61fa 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -412,7 +412,7 @@ BuildRequires: python-devel %if %{with_systemd} BuildRequires: systemd-units %endif -%if %{with_xen} +%if %{with_xen} || %{with_libxl} BuildRequires: xen-devel %endif BuildRequires: libxml2-devel -- 1.8.1.4

1 0

[libvirt] [PATCH 0/4] Resolve some recent Valgrind errors
by John Ferlan 29 Jun '13

29 Jun '13

Ran Valgrind today and found, investigated, and resolved the errors seen. John Ferlan (4): Resolve valgrind error in virNetDevVlanParse() Resolve valgrind error in virStorageBackendCreateQemuImgCmd() Resolve valgrind error in remoteConfigGetStringList() Resolve valgrind errors for nodedev cap parsing daemon/libvirtd-config.c | 6 ++++++ src/conf/netdev_vlan_conf.c | 24 +++++++++++++----------- src/conf/node_device_conf.c | 3 +++ src/storage/storage_backend.c | 4 +++- 4 files changed, 25 insertions(+), 12 deletions(-) -- 1.8.1.4

2 9

[libvirt] [PATCH] doc: Fix reference to #elementsUSB
by Philipp Hahn 29 Jun '13

29 Jun '13

aae0fc2a922b3e31dae7648c547fca2ac2587625 removed the #elementsUSB anchor but did not update the links to point to the new section #elementsHostDev. Signed-off-by: Philipp Hahn <hahn(a)univention.de> --- docs/formatdomain.html.in | 2 +- docs/formatnode.html.in | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index d651816..cc4c5ea 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -146,7 +146,7 @@ configure in the desired way, which is why per-device boot elements (see <a href="#elementsDisks">disks</a>, <a href="#elementsNICS">network interfaces</a>, and - <a href="#elementsUSB">USB and PCI devices</a> sections below) were + <a href="#elementsHostDev">USB and PCI devices</a> sections below) were introduced and they are the preferred way providing full control over booting order. The <code>boot</code> element and per-device boot elements are mutually exclusive. <span class="since">Since 0.1.3, diff --git a/docs/formatnode.html.in b/docs/formatnode.html.in index ad05a70..5f57a5a 100644 --- a/docs/formatnode.html.in +++ b/docs/formatnode.html.in @@ -13,7 +13,7 @@ prefix <code>virNodeDevice</code>, which deal with management of host devices that can be handed to guests via passthrough as <hostdev> elements - in <a href="formatdomain.html#elementsUSB">the domain XML</a>. + in <a href="formatdomain.html#elementsHostDev">the domain XML</a>. These devices are represented as a hierarchy, where a device on a bus has a parent of the bus controller device; the root of the hierarchy is the node named "computer". -- 1.7.10.4

2 1

[libvirt] Entering freeze for libvirt-1.1.0
by Daniel Veillard 28 Jun '13

28 Jun '13

Since Dan pushed the fine grained ACL control patches, this release really ought to be 1.1.0, I just tagged it in git and pushed tarball and rpms to the server: ftp://libvirt.org/libvirt/ I know that Laine has still a patch set to push, now it seems they all got ACK'ed so better get them in for rc2, which I will probably push on thursday. Then if everything looks fine we can have the final release on Monday. I gave it my usual user test, on Fedora, seems to work fine from my limited perspective. I just had to push the attached patch as a build breaker otherwise make rpm would wail because the polkit API definitions would not be packaged. Probably worth a double checking by Dan for correctness. Thanks in advance for feedback on the candidate release, Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

6 9

[libvirt] Bug 979411 - virsh migration copy-storage-all fails with "Unable to read from monitor: Connection reset by peer"
by chandrashekar shastri 28 Jun '13

28 Jun '13

Hi, I have filed a bug for virsh migration copy-storage-all: Bug 979411 - virsh migration copy-storage-all fails with "Unable to read from monitor: Connection reset by peer" Earlier I had filed this bug in launched: Bug #1192499 : virsh migration copy-storage-all fails with "Unable to read from monitor: Connection reset by peer" Thanks, Chandrashekar Shastri

1 0

[libvirt] [PATCH] add support for libssh2 password from auth file
by David Maciejak 28 Jun '13

28 Jun '13

Hi, I was discussing with Daniel about the best way to pass the ssh password when using such kind of uri: 'xen+libssh2:// root(a)192.168.0.10?sshauth=password' As it seems passing the password in the uri is not a good option, maybe we can grab it from auth conf ? it seems it's not the case as now (tell me if i am wrong). So enclosed a patch to add this feature. As you can see in virnetclient.c there is no virAuthGetPassword call, so the authfile is never used. The patch enclosed is modifying the function prototype to add virConnectPtr parameter (so remote_driver.c virNetClientNewLibSSH2 call has to be updated too and the corresponding .h too). Once we have access to virConnectPtr, as you will see in the patch we can check if authMethods is set to 'password' and grab the password from auth file by calling virAuthGetPassword. regards, david

4 11

[libvirt] [PATCH] Replace use of 'in_addr_t' with 'struct in_addr'
by Daniel P. Berrange 28 Jun '13

28 Jun '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The 'in_addr_t' typedef is not present in Mingw64 headers. Instead we can use the more portable 'struct in_addr' and then access its 's_addr' field. Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/util/virsocketaddr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virsocketaddr.c b/src/util/virsocketaddr.c index 2666574..80b5c0b 100644 --- a/src/util/virsocketaddr.c +++ b/src/util/virsocketaddr.c @@ -235,10 +235,10 @@ virSocketAddrIsPrivate(const virSocketAddrPtr addr) bool virSocketAddrIsWildcard(const virSocketAddrPtr addr) { - in_addr_t tmp = INADDR_ANY; + struct in_addr tmp = { .s_addr = INADDR_ANY }; switch (addr->data.stor.ss_family) { case AF_INET: - return memcmp(&addr->data.inet4.sin_addr.s_addr, &tmp, + return memcmp(&addr->data.inet4.sin_addr.s_addr, &tmp.s_addr, sizeof(addr->data.inet4.sin_addr.s_addr)) == 0; case AF_INET6: return IN6_IS_ADDR_UNSPECIFIED(&addr->data.inet6.sin6_addr); -- 1.8.2.1

2 1

[libvirt] [PATCH] Allow RO connections to interface udev backend
by Doug Goldstein 28 Jun '13

28 Jun '13

The udev based interface backend did not allow querying data over a read-only connection which is different than how the netcf backend operates. This brings the behavior inline with the default, netcf backend. --- src/interface/interface_backend_udev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/interface/interface_backend_udev.c b/src/interface/interface_backend_udev.c index 68e1e2f..95034bf 100644 --- a/src/interface/interface_backend_udev.c +++ b/src/interface/interface_backend_udev.c @@ -139,7 +139,7 @@ udevInterfaceOpen(virConnectPtr conn, { struct udev_iface_driver *driverState = NULL; - virCheckFlags(0, VIR_DRV_OPEN_ERROR); + virCheckFlags(VIR_CONNECT_RO, VIR_DRV_OPEN_ERROR); if (VIR_ALLOC(driverState) < 0) { virReportOOMError(); -- 1.8.1.5

3 3

[libvirt] [PATCHv2 0/2] Swap order of AddImplicitControllers and DomainDefPostParse
by Viktor Mihajlovski 28 Jun '13

28 Jun '13

Implicit controllers may be dependent on device definitions altered in a post-parse callback. E.g., if a console device is defined without the target type, the type will be set in QEMU's callback. In the case of s390, this is virtio, which requires an implicit virtio-serial controller. By moving the implicit controller definition after the post-parse procssing this can be fixed. As Martin pointed out, implicit controllers should not need post-parsing, so the rearranging should not hurt. Probably this is only affecting the S390 virtio console anyway. V2 Changes: - Promoted from RFC to Patch Series - Added an qemuxml2xml testcase highlighting the issue: applying the first patch only will fail make check as the implicit controller is missing. Viktor Mihajlovski (2): S390: Testcase for console default target type (virtio) conf: Swap order of AddImplicitControllers and DomainDefPostParse src/conf/domain_conf.c | 8 +++---- .../qemuxml2argv-s390-defaultconsole.xml | 20 ++++++++++++++++ .../qemuxml2xmlout-balloon-device-auto.xml | 2 +- .../qemuxml2xmlout-channel-virtio-auto.xml | 2 +- .../qemuxml2xmlout-console-virtio.xml | 2 +- .../qemuxml2xmlout-disk-scsi-device-auto.xml | 2 +- .../qemuxml2xmlout-s390-defaultconsole.xml | 24 ++++++++++++++++++++ tests/qemuxml2xmltest.c | 2 ++ 8 files changed, 54 insertions(+), 8 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-s390-defaultconsole.xml create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-s390-defaultconsole.xml -- 1.7.9.5

4 6

[libvirt] [PATCH] build: Fix VPATH build for access/*
by Viktor Mihajlovski 28 Jun '13

28 Jun '13

VPATH build failed for the generated access driver files. Signed-off-by: Viktor Mihajlovski <mihajlov(a)linux.vnet.ibm.com> --- src/Makefile.am | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index e6b1927..4cf999d 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -808,9 +808,12 @@ SECURITY_DRIVER_APPARMOR_SOURCES = \ security/security_apparmor.h security/security_apparmor.c ACCESS_DRIVER_GENERATED = \ - access/viraccessapicheck.h access/viraccessapicheck.c \ - access/viraccessapicheckqemu.h access/viraccessapicheckqemu.c \ - access/viraccessapichecklxc.h access/viraccessapichecklxc.c + $(srcdir)/access/viraccessapicheck.h \ + $(srcdir)/access/viraccessapicheck.c \ + $(srcdir)/access/viraccessapicheckqemu.h \ + $(srcdir)/access/viraccessapicheckqemu.c \ + $(srcdir)/access/viraccessapichecklxc.h \ + $(srcdir)/access/viraccessapichecklxc.c ACCESS_DRIVER_SYMFILES = \ libvirt_access.syms \ @@ -828,7 +831,7 @@ ACCESS_DRIVER_POLKIT_SOURCES = \ access/viraccessdriverpolkit.h access/viraccessdriverpolkit.c ACCESS_DRIVER_POLKIT_POLICY = \ - access/org.libvirt.api.policy + $(srcdir)/access/org.libvirt.api.policy NODE_DEVICE_DRIVER_SOURCES = \ @@ -1488,29 +1491,29 @@ libvirt_access_lxc.syms: $(srcdir)/rpc/gendispatch.pl \ $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclsym \ lxc LXC $(LXC_PROTOCOL) > $@ -access/viraccessapicheck.h: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapicheck.h: $(srcdir)/rpc/gendispatch.pl \ $(REMOTE_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ remote REMOTE $(REMOTE_PROTOCOL) > $@ -access/viraccessapicheck.c: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapicheck.c: $(srcdir)/rpc/gendispatch.pl \ $(REMOTE_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ remote REMOTE $(REMOTE_PROTOCOL) access/viraccessapicheck.h > $@ -access/viraccessapicheckqemu.h: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapicheckqemu.h: $(srcdir)/rpc/gendispatch.pl \ $(QEMU_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ qemu QEMU $(QEMU_PROTOCOL) > $@ -access/viraccessapicheckqemu.c: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapicheckqemu.c: $(srcdir)/rpc/gendispatch.pl \ $(QEMU_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ qemu QEMU $(QEMU_PROTOCOL) access/viraccessapicheckqemu.h > $@ -access/viraccessapichecklxc.h: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapichecklxc.h: $(srcdir)/rpc/gendispatch.pl \ $(LXC_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclheader \ lxc LXC $(LXC_PROTOCOL) > $@ -access/viraccessapichecklxc.c: $(srcdir)/rpc/gendispatch.pl \ +$(srcdir)/access/viraccessapichecklxc.c: $(srcdir)/rpc/gendispatch.pl \ $(LXC_PROTOCOL) Makefile.am $(AM_V_GEN)$(PERL) -w $(srcdir)/rpc/gendispatch.pl --mode=aclbody \ lxc LXC $(LXC_PROTOCOL) access/viraccessapichecklxc.h > $@ -- 1.7.9.5

2 2

[libvirt] [PATCH]Fix vPort Manage of FC vHBA creation
by Dennis Chen 28 Jun '13

28 Jun '13

When create a virtual FC HBA with virsh/libvirt API, an error message will be returned:"error: Node device not found", also the 'nodedev-dumpxml' shows wrong information of wwpn & wwnn for the new created device. Signed-off-by:xschen@tnsoft.com.cn --- src/util/virutil.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virutil.c b/src/util/virutil.c index 6fa0212e..569d035 100644 --- a/src/util/virutil.c +++ b/src/util/virutil.c @@ -1792,8 +1792,8 @@ virManageVport(const int parent_host, if (virAsprintf(&vport_name, "%s:%s", - wwnn, - wwpn) < 0) { + wwpn, + wwnn) < 0) { virReportOOMError(); goto cleanup; }

3 5

[libvirt] Bug 979260 - cpu hot-add doesn't work with upstream libvirt 1.0.6 + qemu 1.5.50
by chandrashekar shastri 28 Jun '13

28 Jun '13

Hi All, I have filed the following bug for CPU hot-add issue: Bug 979260 - cpu hot-add doesn't work with upstream libvirt 1.0.6 + qemu 1.5.50 Thanks, Chandrashekar

2 2

[libvirt] [PATCH v2] Make logical pools independent on target path
by Martin Kletzander 28 Jun '13

28 Jun '13

When using logical pools, we had to trust the target->path provided. This parameter, however, can be completely ommited and we can get the correct path using 'lvdisplay' command. In order not to omit the target.path completely, we rather default it to '/dev/<source.name>' which is used to check the pool anyway. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=952973 Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Notes: v2: - don't drop target.path, but fix it instead to '/dev/<source.name>' Thanks to the change from v1, we can now safely drop all the hunks from logical backend and even the dependency on lvdisplay command. There might be some systems where the path is different and the part of this patch using lvdisplay command would make most of them work. However, checkPool() still depends on '/dev/<source.name>' and I haven't found any other way how to fix that, so feel free to ACK just the {conf,docs,tests}/ part in case you think that we shouldn't try to support anything else than '/dev/<source.name>'. configure.ac | 4 + docs/schemas/storagepool.rng | 13 ++- src/conf/storage_conf.c | 19 +++-- src/storage/storage_backend_logical.c | 95 +++++++++++++--------- src/storage/storage_driver.c | 2 +- tests/storagepoolxml2xmlin/pool-logical-create.xml | 2 +- tests/storagepoolxml2xmlin/pool-logical-nopath.xml | 18 ++++ .../storagepoolxml2xmlout/pool-logical-nopath.xml | 19 +++++ tests/storagepoolxml2xmltest.c | 1 + 9 files changed, 125 insertions(+), 48 deletions(-) create mode 100644 tests/storagepoolxml2xmlin/pool-logical-nopath.xml create mode 100644 tests/storagepoolxml2xmlout/pool-logical-nopath.xml diff --git a/configure.ac b/configure.ac index ef246a6..221b6cb 100644 --- a/configure.ac +++ b/configure.ac @@ -1601,6 +1601,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then AC_PATH_PROG([PVS], [pvs], [], [$PATH:/sbin:/usr/sbin]) AC_PATH_PROG([VGS], [vgs], [], [$PATH:/sbin:/usr/sbin]) AC_PATH_PROG([LVS], [lvs], [], [$PATH:/sbin:/usr/sbin]) + AC_PATH_PROG([LVDISPLAY], [lvdisplay], [], [$PATH:/sbin:/usr/sbin]) if test "$with_storage_lvm" = "yes" ; then if test -z "$PVCREATE" ; then AC_MSG_ERROR([We need pvcreate for LVM storage driver]) ; fi @@ -1615,6 +1616,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then if test -z "$PVS" ; then AC_MSG_ERROR([We need pvs for LVM storage driver]) ; fi if test -z "$VGS" ; then AC_MSG_ERROR([We need vgs for LVM storage driver]) ; fi if test -z "$LVS" ; then AC_MSG_ERROR([We need lvs for LVM storage driver]) ; fi + if test -z "$LVDISPLAY" ; then AC_MSG_ERROR([We need lvdisplay for LVM storage driver]) ; fi else if test -z "$PVCREATE" ; then with_storage_lvm=no ; fi if test -z "$VGCREATE" ; then with_storage_lvm=no ; fi @@ -1628,6 +1630,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then if test -z "$PVS" ; then with_storage_lvm=no ; fi if test -z "$VGS" ; then with_storage_lvm=no ; fi if test -z "$LVS" ; then with_storage_lvm=no ; fi + if test -z "$LVDISPLAY" ; then with_storage_lvm=no ; fi if test "$with_storage_lvm" = "check" ; then with_storage_lvm=yes ; fi fi @@ -1646,6 +1649,7 @@ if test "$with_storage_lvm" = "yes" || test "$with_storage_lvm" = "check"; then AC_DEFINE_UNQUOTED([PVS],["$PVS"],[Location of pvs program]) AC_DEFINE_UNQUOTED([VGS],["$VGS"],[Location of vgs program]) AC_DEFINE_UNQUOTED([LVS],["$LVS"],[Location of lvs program]) + AC_DEFINE_UNQUOTED([LVDISPLAY],["$LVDISPLAY"],[Location of lvdisplay program]) fi fi AM_CONDITIONAL([WITH_STORAGE_LVM], [test "$with_storage_lvm" = "yes"]) diff --git a/docs/schemas/storagepool.rng b/docs/schemas/storagepool.rng index 3c2158a..1b3f4bc 100644 --- a/docs/schemas/storagepool.rng +++ b/docs/schemas/storagepool.rng @@ -62,7 +62,7 @@ <ref name='commonmetadata'/> <ref name='sizing'/> <ref name='sourcelogical'/> - <ref name='target'/> + <ref name='targetlogical'/> </define> <define name='pooldisk'> @@ -207,6 +207,17 @@ </element> </define> + <define name='targetlogical'> + <element name='target'> + <optional> + <element name='path'> + <ref name='absFilePath'/> + </element> + </optional> + <ref name='permissions'/> + </element> + </define> + <define name='sourceinfohost'> <oneOrMore> <element name='host'> diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c index 288e265..7ffe58c 100644 --- a/src/conf/storage_conf.c +++ b/src/conf/storage_conf.c @@ -1,7 +1,7 @@ /* * storage_conf.c: config handling for storage driver * - * Copyright (C) 2006-2012 Red Hat, Inc. + * Copyright (C) 2006-2013 Red Hat, Inc. * Copyright (C) 2006-2008 Daniel P. Berrange * * This library is free software; you can redistribute it and/or @@ -959,15 +959,22 @@ virStoragePoolDefParseXML(xmlXPathContextPtr ctxt) /* When we are working with a virtual disk we can skip the target * path and permissions */ if (!(options->flags & VIR_STORAGE_POOL_SOURCE_NETWORK)) { - if (!(target_path = virXPathString("string(./target/path)", ctxt))) { - virReportError(VIR_ERR_XML_ERROR, "%s", - _("missing storage pool target path")); - goto error; + if (ret->type == VIR_STORAGE_POOL_LOGICAL) { + if (virAsprintf(&target_path, "/dev/%s", ret->source.name) < 0) { + virReportOOMError(); + goto error; + } + } else { + target_path = virXPathString("string(./target/path)", ctxt); + if (!target_path) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("missing storage pool target path")); + goto error; + } } ret->target.path = virFileSanitizePath(target_path); if (!ret->target.path) goto error; - if (virStorageDefParsePerms(ctxt, &ret->target.perms, "./target/permissions", DEFAULT_POOL_PERM_MODE) < 0) diff --git a/src/storage/storage_backend_logical.c b/src/storage/storage_backend_logical.c index 944aa0e..471f8d9 100644 --- a/src/storage/storage_backend_logical.c +++ b/src/storage/storage_backend_logical.c @@ -45,6 +45,37 @@ #define PV_BLANK_SECTOR_SIZE 512 +static char * +virStorageBackendGetVolPath(const char *poolname, const char *volname) +{ + char *start = NULL; + char *lvpath = NULL; + char *output = NULL; + + virCommandPtr cmd = virCommandNewArgList(LVDISPLAY, + "--columns", + "--options", "lv_path", + "--noheadings", + "--unbuffered", + NULL); + + virCommandAddArgFormat(cmd, "%s/%s", poolname, volname); + virCommandSetOutputBuffer(cmd, &output); + + if (virCommandRun(cmd, NULL) < 0 || + !(start = strchr(output, '/'))) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Cannot get LV path")); + goto cleanup; + } + + ignore_value(VIR_STRDUP(lvpath, start)); + + cleanup: + VIR_FREE(output); + virCommandFree(cmd); + return lvpath; +} + static int virStorageBackendLogicalSetActive(virStoragePoolObjPtr pool, int on) @@ -116,11 +147,8 @@ virStorageBackendLogicalMakeVol(virStoragePoolObjPtr pool, } if (vol->target.path == NULL) { - if (virAsprintf(&vol->target.path, "%s/%s", - pool->def->target.path, vol->name) < 0) { - virReportOOMError(); + if (VIR_STRDUP(vol->target.path, groups[10]) < 0) goto cleanup; - } } /* Skips the backingStore of lv created with "--virtualsize", @@ -130,12 +158,11 @@ virStorageBackendLogicalMakeVol(virStoragePoolObjPtr pool, * (lvs outputs "[$lvname_vorigin] for field "origin" if the * lv is created with "--virtualsize"). */ - if (groups[1] && !STREQ(groups[1], "") && (groups[1][0] != '[')) { - if (virAsprintf(&vol->backingStore.path, "%s/%s", - pool->def->target.path, groups[1]) < 0) { - virReportOOMError(); + if (groups[1] && STRNEQ(groups[1], "") && (groups[1][0] != '[')) { + vol->backingStore.path = virStorageBackendGetVolPath(pool->def->source.name, + groups[1]); + if (!vol->backingStore.path) goto cleanup; - } vol->backingStore.format = VIR_STORAGE_POOL_LOGICAL_LVM2; } @@ -277,21 +304,21 @@ virStorageBackendLogicalFindLVs(virStoragePoolObjPtr pool, virStorageVolDefPtr vol) { /* - * # lvs --separator , --noheadings --units b --unbuffered --nosuffix --options \ - * "lv_name,origin,uuid,devices,seg_size,vg_extent_size,size,lv_attr" VGNAME + * # lvs --separator '#' --noheadings --units b --unbuffered --nosuffix --options \ + * "lv_name,origin,uuid,devices,seg_size,vg_extent_size,size,lv_attr,lv_path" VGNAME * - * RootLV,,06UgP5-2rhb-w3Bo-3mdR-WeoL-pytO-SAa2ky,/dev/hda2(0),5234491392,33554432,5234491392,-wi-ao - * SwapLV,,oHviCK-8Ik0-paqS-V20c-nkhY-Bm1e-zgzU0M,/dev/hda2(156),1040187392,33554432,1040187392,-wi-ao - * Test2,,3pg3he-mQsA-5Sui-h0i6-HNmc-Cz7W-QSndcR,/dev/hda2(219),1073741824,33554432,1073741824,owi-a- - * Test3,,UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht,/dev/hda2(251),2181038080,33554432,2181038080,-wi-a- - * Test3,Test2,UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht,/dev/hda2(187),1040187392,33554432,1040187392,swi-a- + * RootLV##06UgP5-2rhb-w3Bo-3mdR-WeoL-pytO-SAa2ky#/dev/hda2(0)#5234491392#33554432#5234491392#-wi-ao#/dev/VGNAME/RootLV + * SwapLV##oHviCK-8Ik0-paqS-V20c-nkhY-Bm1e-zgzU0M#/dev/hda2(156)#1040187392#33554432#1040187392#-wi-ao#/dev/VGNAME/SwapLV + * Test2##3pg3he-mQsA-5Sui-h0i6-HNmc-Cz7W-QSndcR#/dev/hda2(219)#1073741824#33554432#1073741824#owi-a-#/dev/VGNAME/Test2 + * Test3##UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht#/dev/hda2(251)#2181038080#33554432#2181038080#-wi-a-#/dev/VGNAME/Test3 + * Test3#Test2#UB5hFw-kmlm-LSoX-EI1t-ioVd-h7GL-M0W8Ht#/dev/hda2(187)#1040187392#33554432#1040187392#swi-a-#/dev/VGNAME/Test3 * * Pull out name, origin, & uuid, device, device extent start #, * segment size, extent size, size, attrs * * NB can be multiple rows per volume if they have many extents * - * NB lvs from some distros (e.g. SLES10 SP2) outputs trailing "," on each line + * NB lvs from some distros (e.g. SLES10 SP2) outputs trailing separator on each line * * NB Encrypted logical volumes can print ':' in their name, so it is * not a suitable separator (rhbz 470693). @@ -299,7 +326,7 @@ virStorageBackendLogicalFindLVs(virStoragePoolObjPtr pool, * striped, so "," is not a suitable separator either (rhbz 727474). */ const char *regexes[] = { - "^\\s*(\\S+)#(\\S*)#(\\S+)#(\\S+)#(\\S+)#([0-9]+)#(\\S+)#([0-9]+)#([0-9]+)#(\\S+)#?\\s*$" + "^\\s*(\\S+)#(\\S*)#(\\S+)#(\\S+)#(\\S+)#([0-9]+)#(\\S+)#([0-9]+)#([0-9]+)#(\\S+)#(\\S+)#?\\s*$" }; int vars[] = { 10 @@ -314,7 +341,7 @@ virStorageBackendLogicalFindLVs(virStoragePoolObjPtr pool, "--unbuffered", "--nosuffix", "--options", - "lv_name,origin,uuid,devices,segtype,stripes,seg_size,vg_extent_size,size,lv_attr", + "lv_name,origin,uuid,devices,segtype,stripes,seg_size,vg_extent_size,size,lv_attr,lv_path", pool->def->source.name, NULL); if (virStorageBackendRunProgRegex(pool, @@ -470,18 +497,7 @@ virStorageBackendLogicalCheckPool(virConnectPtr conn ATTRIBUTE_UNUSED, virStoragePoolObjPtr pool, bool *isActive) { - char *path; - - *isActive = false; - if (virAsprintf(&path, "/dev/%s", pool->def->source.name) < 0) { - virReportOOMError(); - return -1; - } - - if (access(path, F_OK) == 0) - *isActive = true; - - VIR_FREE(path); + *isActive = (access(pool->def->target.path, F_OK) == 0); return 0; } @@ -702,6 +718,7 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, int fd = -1; virCommandPtr cmd = NULL; virErrorPtr err; + bool created = false; if (vol->target.encryption != NULL) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, @@ -717,13 +734,6 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, VIR_FREE(vol->target.path); } - if (virAsprintf(&vol->target.path, "%s/%s", - pool->def->target.path, - vol->name) == -1) { - virReportOOMError(); - return -1; - } - cmd = virCommandNewArgList(LVCREATE, "--name", vol->name, NULL); @@ -742,9 +752,15 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, if (virCommandRun(cmd, NULL) < 0) goto error; + created = true; virCommandFree(cmd); cmd = NULL; + vol->target.path = virStorageBackendGetVolPath(pool->def->source.name, + vol->name); + if (!vol->target.path) + goto error; + if ((fd = virStorageBackendVolOpen(vol->target.path)) < 0) goto error; @@ -784,7 +800,8 @@ virStorageBackendLogicalCreateVol(virConnectPtr conn, error: err = virSaveLastError(); VIR_FORCE_CLOSE(fd); - virStorageBackendLogicalDeleteVol(conn, pool, vol, 0); + if (created) + virStorageBackendLogicalDeleteVol(conn, pool, vol, 0); virCommandFree(cmd); virSetError(err); virFreeError(err); diff --git a/src/storage/storage_driver.c b/src/storage/storage_driver.c index cc8eaa9..891097f 100644 --- a/src/storage/storage_driver.c +++ b/src/storage/storage_driver.c @@ -1,7 +1,7 @@ /* * storage_driver.c: core driver for storage APIs * - * Copyright (C) 2006-2012 Red Hat, Inc. + * Copyright (C) 2006-2013 Red Hat, Inc. * Copyright (C) 2006-2008 Daniel P. Berrange * * This library is free software; you can redistribute it and/or diff --git a/tests/storagepoolxml2xmlin/pool-logical-create.xml b/tests/storagepoolxml2xmlin/pool-logical-create.xml index 4c67089..fd551e0 100644 --- a/tests/storagepoolxml2xmlin/pool-logical-create.xml +++ b/tests/storagepoolxml2xmlin/pool-logical-create.xml @@ -10,7 +10,7 @@ <device path="/dev/sdb3"/> </source> <target> - <path>/dev/HostVG</path> + <path>/invalid/nonexistent/path</path> <permissions> <mode>0700</mode> <owner>0</owner> diff --git a/tests/storagepoolxml2xmlin/pool-logical-nopath.xml b/tests/storagepoolxml2xmlin/pool-logical-nopath.xml new file mode 100644 index 0000000..307e2ab --- /dev/null +++ b/tests/storagepoolxml2xmlin/pool-logical-nopath.xml @@ -0,0 +1,18 @@ +<pool type='logical'> + <name>HostVG</name> + <uuid>1c13165a-d0f4-3aee-b447-30fb38789091</uuid> + <capacity>99891544064</capacity> + <allocation>99220455424</allocation> + <available>671088640</available> + <source> + <name>HostVG</name> + <format type='lvm2'/> + </source> + <target> + <permissions> + <mode>0700</mode> + <owner>0</owner> + <group>0</group> + </permissions> + </target> +</pool> diff --git a/tests/storagepoolxml2xmlout/pool-logical-nopath.xml b/tests/storagepoolxml2xmlout/pool-logical-nopath.xml new file mode 100644 index 0000000..07860ef --- /dev/null +++ b/tests/storagepoolxml2xmlout/pool-logical-nopath.xml @@ -0,0 +1,19 @@ +<pool type='logical'> + <name>HostVG</name> + <uuid>1c13165a-d0f4-3aee-b447-30fb38789091</uuid> + <capacity unit='bytes'>0</capacity> + <allocation unit='bytes'>0</allocation> + <available unit='bytes'>0</available> + <source> + <name>HostVG</name> + <format type='lvm2'/> + </source> + <target> + <path>/dev/HostVG</path> + <permissions> + <mode>0700</mode> + <owner>0</owner> + <group>0</group> + </permissions> + </target> +</pool> diff --git a/tests/storagepoolxml2xmltest.c b/tests/storagepoolxml2xmltest.c index 0376e63..3becdcf 100644 --- a/tests/storagepoolxml2xmltest.c +++ b/tests/storagepoolxml2xmltest.c @@ -85,6 +85,7 @@ mymain(void) DO_TEST("pool-dir"); DO_TEST("pool-fs"); DO_TEST("pool-logical"); + DO_TEST("pool-logical-nopath"); DO_TEST("pool-logical-create"); DO_TEST("pool-disk"); DO_TEST("pool-iscsi"); -- 1.8.2.1

1 0