- Devel - libvirt List Archives

[libvirt] heads up: tag v0.8.4 moved
by Eric Blake 22 Sep '10

22 Sep '10

If you recently cloned libvirt.git, you may have inadvertently picked up a broken v0.8.4 tag. The tag has now been fixed upstream, so clones after today are unaffected; and if you cloned before 0.8.4 was released, you are probably not affected unless you explicitly fetched the broken tag. Here's how to check if you have the bad tag, and if so, how to fix it: case $(git rev-parse v0.8.4 2>/dev/null) in 37b0b91*) git tag -d v0.8.4 && git fetch origin tag v0.8.4 &&\ echo 'tag fixed' ;; v0.8.4) echo 'tag not present, not a problem' ;; 7862e07*) echo 'tag already okay' ;; *) echo 'where did you get this tag from?' ;; esac -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

1 0

[libvirt] [PATCH] nodeinfo: work when hot-plugging is disabled
by Eric Blake 22 Sep '10

22 Sep '10

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=635857. * src/nodeinfo.c (cpu_online): Allow missing directory for all CPUs, not just cpu0. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- src/nodeinfo.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/nodeinfo.c b/src/nodeinfo.c index 65eeb24..3dac9f3 100644 --- a/src/nodeinfo.c +++ b/src/nodeinfo.c @@ -65,7 +65,8 @@ int linuxNodeInfoCPUPopulate(FILE *cpuinfo, /* Return the positive decimal contents of the given * CPU_SYS_PATH/cpu%u/FILE, or -1 on error. If MISSING_OK and the * file could not be found, return 1 instead of an error; this is - * because some machines cannot hot-unplug cpu0. */ + * because some machines cannot hot-unplug cpu0, or because + * hot-unplugging is disabled. */ static int get_cpu_value(unsigned int cpu, const char *file, bool missing_ok) { @@ -113,7 +114,7 @@ cleanup: static int cpu_online(unsigned int cpu) { - return get_cpu_value(cpu, "online", cpu == 0); + return get_cpu_value(cpu, "online", true); } static unsigned long count_thread_siblings(unsigned int cpu) -- 1.7.2.3

2 2

[libvirt] [PATCH] Set sensible defaults for cpu match and feature policy
by Daniel P. Berrange 22 Sep '10

22 Sep '10

To enable the CPU XML from the capabilities to be pasted directly into the guest XML with no editing, pick a sensible default for match and feature policy. The CPU match will be exact and the feature policy will be require. This should ensure safety for migration and give DWIM semantics for users * src/conf/cpu_conf.c: Default to exact match and require policy --- src/conf/cpu_conf.c | 15 ++++++++------- 1 files changed, 8 insertions(+), 7 deletions(-) diff --git a/src/conf/cpu_conf.c b/src/conf/cpu_conf.c index 3274659..68d3daf 100644 --- a/src/conf/cpu_conf.c +++ b/src/conf/cpu_conf.c @@ -147,12 +147,10 @@ virCPUDefParseXML(const xmlNodePtr node, char *match = virXMLPropString(node, "match"); if (!match) { - if (virXPathBoolean("boolean(./model)", ctxt)) { - virCPUReportError(VIR_ERR_INTERNAL_ERROR, - "%s", _("Missing match attribute for CPU specification")); - goto error; - } - def->match = -1; + if (virXPathBoolean("boolean(./model)", ctxt)) + def->match = VIR_CPU_MATCH_EXACT; + else + def->match = -1; } else { def->match = virCPUMatchTypeFromString(match); VIR_FREE(match); @@ -251,7 +249,10 @@ virCPUDefParseXML(const xmlNodePtr node, char *strpolicy; strpolicy = virXMLPropString(nodes[i], "policy"); - policy = virCPUFeaturePolicyTypeFromString(strpolicy); + if (strpolicy == NULL) + policy = VIR_CPU_FEATURE_REQUIRE; + else + policy = virCPUFeaturePolicyTypeFromString(strpolicy); VIR_FREE(strpolicy); if (policy < 0) { -- 1.7.2.3

2 1

[libvirt] [PATCH] Enable support for nested SVM
by Daniel P. Berrange 22 Sep '10

22 Sep '10

This enables support for nested SVM using the regular CPU model/features block. If the CPU model or features include 'svm' or 'vmx', then the '-enable-nesting' flag will be added to the QEMU command line. Several of the models already include svm support, but QEMU was just masking out the svm bit silently. So this will enable SVM on such models * src/qemu/qemu_conf.h: flag for -enable-nesting * src/qemu/qemu_conf.c: Use -enable-nesting if VMX or SVM are in the CPUID --- src/qemu/qemu_conf.c | 39 +++++++++++++++++++++++++++++++++++++-- src/qemu/qemu_conf.h | 1 + 2 files changed, 38 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 7a37c70..a2aab95 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -1210,6 +1210,8 @@ static unsigned long long qemudComputeCmdFlags(const char *help, flags |= QEMUD_CMD_FLAG_NO_KVM_PIT; if (strstr(help, "-tdf")) flags |= QEMUD_CMD_FLAG_TDF; + if (strstr(help, "-enable-nesting")) + flags |= QEMUD_CMD_FLAG_NESTING; if (strstr(help, ",menu=on")) flags |= QEMUD_CMD_FLAG_BOOT_MENU; @@ -3494,13 +3496,36 @@ error: } +#define CPUID_FUNCTION_SVM 0x80000001 +#define CPUID_ECX_SVM 0x00000004 + +#define CPUID_FUNCTION_VMX 0x00000001 +#define CPUID_ECX_VMX 0x00000020 + +static bool qemuCpuHasHwVirt(union cpuData *data) +{ + int i; + for (i = 0 ; i < data->x86.basic_len ; i++) { + if (data->x86.basic[i].function == CPUID_FUNCTION_VMX && + (data->x86.basic[i].ecx & CPUID_ECX_VMX)) + return true; + } + for (i = 0 ; i < data->x86.extended_len ; i++) { + if (data->x86.extended[i].function == CPUID_FUNCTION_SVM && + (data->x86.extended[i].ecx & CPUID_ECX_SVM)) + return true; + } + return false; +} + static int qemuBuildCpuArgStr(const struct qemud_driver *driver, const virDomainDefPtr def, const char *emulator, unsigned long long qemuCmdFlags, const struct utsname *ut, - char **opt) + char **opt, + bool *hasHwVirt) { const virCPUDefPtr host = driver->caps->host.cpu; virCPUDefPtr guest = NULL; @@ -3511,6 +3536,8 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, virBuffer buf = VIR_BUFFER_INITIALIZER; int i; + *hasHwVirt = false; + if (def->cpu && def->cpu->model) { if (qemudProbeCPUModels(emulator, qemuCmdFlags, ut->machine, &ncpus, &cpus) < 0) @@ -3552,6 +3579,8 @@ qemuBuildCpuArgStr(const struct qemud_driver *driver, if (cpuDecode(guest, data, cpus, ncpus, preferred) < 0) goto cleanup; + *hasHwVirt = qemuCpuHasHwVirt(data); + virBufferVSprintf(&buf, "%s", guest->model); for (i = 0; i < guest->nfeatures; i++) { char sign; @@ -3678,6 +3707,7 @@ int qemudBuildCommandLine(virConnectPtr conn, char *cpu; char *smp; int last_good_net = -1; + bool hasHwVirt = false; uname_normalize(&ut); @@ -3871,13 +3901,18 @@ int qemudBuildCommandLine(virConnectPtr conn, ADD_ARG_LIT(def->os.machine); } - if (qemuBuildCpuArgStr(driver, def, emulator, qemuCmdFlags, &ut, &cpu) < 0) + if (qemuBuildCpuArgStr(driver, def, emulator, qemuCmdFlags, + &ut, &cpu, &hasHwVirt) < 0) goto error; if (cpu) { ADD_ARG_LIT("-cpu"); ADD_ARG_LIT(cpu); VIR_FREE(cpu); + + if ((qemuCmdFlags & QEMUD_CMD_FLAG_NESTING) && + hasHwVirt) + ADD_ARG_LIT("-enable-nesting"); } if (disableKQEMU) diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 2c9e608..16f72f5 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -93,6 +93,7 @@ enum qemud_cmd_flags { QEMUD_CMD_FLAG_NODEFCONFIG = (1LL << 37), /* -nodefconfig */ QEMUD_CMD_FLAG_BOOT_MENU = (1LL << 38), /* -boot menu=on support */ QEMUD_CMD_FLAG_ENABLE_KQEMU = (1LL << 39), /* -enable-kqemu flag */ + QEMUD_CMD_FLAG_NESTING = (1LL << 40), /* -enable-nesting (SVM/VMX) */ }; /* Main driver state */ -- 1.7.2.3

2 1

[libvirt] [PATCH] nwfilter: fix an bug appearing on big endian machines
by Stefan Berger 22 Sep '10

22 Sep '10

Either one of the following patches fixes a bug appearing on big endian machines where the returned XML is not the one that is expected (see test/nwfilterxml2xmltest). The problem is due to for example the casting of a pointers to unsigned integers to void * and then back to 16 bit integers. I have prepared 2 different solutions for the problem. I think the one with the union is the better one, which I am posting before the shorted solution. Both solutions make the nwfilterxml2xmltest pass on a ppc64 machine. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -379,9 +379,14 @@ virNWFilterPoolObjRemove(virNWFilterPool } } +union data { + void *v; + char *c; + unsigned char *uc; + unsigned int ui; +}; - -typedef bool (*valueValidator)(enum attrDatatype datatype, void *valptr, +typedef bool (*valueValidator)(enum attrDatatype datatype, union data *valptr, virNWFilterRuleDefPtr nwf); typedef bool (*valueFormatter)(virBufferPtr buf, virNWFilterRuleDefPtr nwf); @@ -407,18 +412,18 @@ static const struct int_map macProtoMap[ static bool -checkMacProtocolID(enum attrDatatype datatype, void *value, +checkMacProtocolID(enum attrDatatype datatype, union data *value, virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED) { int32_t res = -1; if (datatype == DATATYPE_STRING) { - if (intMapGetByString(macProtoMap, (char *)value, 1, &res) == 0) + if (intMapGetByString(macProtoMap, value->c, 1, &res) == 0) res = -1; datatype = DATATYPE_UINT16; } else if (datatype == DATATYPE_UINT16 || datatype == DATATYPE_UINT16_HEX) { - res = (uint32_t)*(uint16_t *)value; + res = value->ui; if (res < 0x600) res = -1; } @@ -485,10 +490,10 @@ checkValidMask(unsigned char *data, int static bool checkMACMask(enum attrDatatype datatype ATTRIBUTE_UNUSED, - void *macMask, + union data *macMask, virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED) { - return checkValidMask((unsigned char *)macMask, 6); + return checkValidMask(macMask->uc, 6); } @@ -511,18 +516,18 @@ static const struct int_map arpOpcodeMap static bool arpOpcodeValidator(enum attrDatatype datatype, - void *value, + union data *value, virNWFilterRuleDefPtr nwf) { int32_t res = -1; if (datatype == DATATYPE_STRING) { - if (intMapGetByString(arpOpcodeMap, (char *)value, 1, &res) == 0) + if (intMapGetByString(arpOpcodeMap, value->c, 1, &res) == 0) res = -1; datatype = DATATYPE_UINT16; } else if (datatype == DATATYPE_UINT16 || datatype == DATATYPE_UINT16_HEX) { - res = (uint32_t)*(uint16_t *)value; + res = (uint32_t)value->ui; } if (res != -1) { @@ -570,18 +575,18 @@ static const struct int_map ipProtoMap[] static bool checkIPProtocolID(enum attrDatatype datatype, - void *value, + union data *value, virNWFilterRuleDefPtr nwf) { int32_t res = -1; if (datatype == DATATYPE_STRING) { - if (intMapGetByString(ipProtoMap, (char *)value, 1, &res) == 0) + if (intMapGetByString(ipProtoMap, value->c, 1, &res) == 0) res = -1; datatype = DATATYPE_UINT8_HEX; } else if (datatype == DATATYPE_UINT8 || datatype == DATATYPE_UINT8_HEX) { - res = (uint32_t)*(uint16_t *)value; + res = (uint32_t)value->ui; } if (res != -1) { @@ -615,10 +620,10 @@ formatIPProtocolID(virBufferPtr buf, static bool -dscpValidator(enum attrDatatype datatype, void *val, +dscpValidator(enum attrDatatype datatype, union data *val, virNWFilterRuleDefPtr nwf) { - uint8_t dscp = *(uint16_t *)val; + uint8_t dscp = val->ui; if (dscp > 63) return 0; @@ -1150,7 +1155,8 @@ virNWFilterRuleDetailsParse(xmlNodePtr n nwItemDesc *item; int int_val; unsigned int uint_val; - void *data_ptr = NULL, *storage_ptr; + void *storage_ptr; + union data data; valueValidator validator; char *match = virXMLPropString(node, "match"); nwIPAddress ipaddr; @@ -1206,7 +1212,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n if (uint_val <= 0xff) { *(uint8_t *)storage_ptr = uint_val; found = 1; - data_ptr = &uint_val; + data.ui = uint_val; } else rc = -1; } else @@ -1221,7 +1227,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n if (uint_val <= 0xffff) { *(uint16_t *)storage_ptr = uint_val; found = 1; - data_ptr = &uint_val; + data.ui = uint_val; } else rc = -1; } else @@ -1245,7 +1251,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n *(uint8_t *)storage_ptr = (uint8_t)uint_val; found = 1; - data_ptr = &uint_val; + data.ui = uint_val; } else rc = -1; } else { @@ -1278,7 +1284,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n (nwMACAddressPtr)storage_ptr)) { rc = -1; } - data_ptr = storage_ptr; + data.v = storage_ptr; found = 1; break; @@ -1299,7 +1305,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n *(uint8_t *)storage_ptr = (uint8_t)uint_val; found = 1; - data_ptr = &uint_val; + data.ui = uint_val; } else rc = -1; } else { @@ -1322,7 +1328,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n rc = -1; break; } - data_ptr = prop; + data.c = prop; found = 1; break; @@ -1344,7 +1350,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n *flags = NWFILTER_ENTRY_ITEM_FLAG_EXISTS | flags_set; item->datatype = datatype >> 1; if (validator) { - if (!validator(datatype >> 1, data_ptr, nwf)) { + if (!validator(datatype >> 1, &data, nwf)) { rc = -1; *flags = 0; } =============== 2nd solution ================= Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -181,6 +181,8 @@ static const char dscp_str[] = " #define DSCP dscp_str +#define PARSED_INT_TYPE unsigned int + /** * intMapGetByInt: * @intmap: Pointer to int-to-string map @@ -418,7 +420,7 @@ checkMacProtocolID(enum attrDatatype dat datatype = DATATYPE_UINT16; } else if (datatype == DATATYPE_UINT16 || datatype == DATATYPE_UINT16_HEX) { - res = (uint32_t)*(uint16_t *)value; + res = (uint32_t)*(PARSED_INT_TYPE *)value; if (res < 0x600) res = -1; } @@ -522,7 +524,7 @@ arpOpcodeValidator(enum attrDatatype dat datatype = DATATYPE_UINT16; } else if (datatype == DATATYPE_UINT16 || datatype == DATATYPE_UINT16_HEX) { - res = (uint32_t)*(uint16_t *)value; + res = (uint32_t)*(PARSED_INT_TYPE *)value; } if (res != -1) { @@ -581,7 +583,7 @@ static bool checkIPProtocolID(enum attrD datatype = DATATYPE_UINT8_HEX; } else if (datatype == DATATYPE_UINT8 || datatype == DATATYPE_UINT8_HEX) { - res = (uint32_t)*(uint16_t *)value; + res = (uint32_t)*(PARSED_INT_TYPE *)value; } if (res != -1) { @@ -618,7 +620,7 @@ static bool dscpValidator(enum attrDatatype datatype, void *val, virNWFilterRuleDefPtr nwf) { - uint8_t dscp = *(uint16_t *)val; + uint8_t dscp = *(PARSED_INT_TYPE *)val; if (dscp > 63) return 0; @@ -1149,7 +1151,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n enum virNWFilterEntryItemFlags *flags ,match_flag = 0, flags_set = 0; nwItemDesc *item; int int_val; - unsigned int uint_val; + PARSED_INT_TYPE uint_val; void *data_ptr = NULL, *storage_ptr; valueValidator validator; char *match = virXMLPropString(node, "match");

2 2

[libvirt] XML support for arbitrary command line arguments
by Harsh Bora 22 Sep '10

22 Sep '10

Hi, Is there a way by which I can pass arbitrary command line args to a hypervisor (Qemu), and let the hypervisor decide what to do with it? I mean, is there a generic XML tag define which can be used to specify 'n' number of command line args which are blindly passed to hypervisor to process? regards, Harsh

5 12

[libvirt] [PATCH 00/12] Implement memory control api
by Nikunj A. Dadhania 22 Sep '10

22 Sep '10

This patch series implement public api for controlling various memory tunables exported by the OS. This is based on the following RFC[1]. * Implement virDomainSetMemoryParameters api * Provide implementation for remote, QEmu and LXC drivers * Enable memory controller support fro QEmu * virsh command for runtime changes to the memory parameters * Domain configuration parsing for memory control parameters * Cgroup memory controller code for memory hard_limit/soft_limit, swap hard_limit To Do * Python bindings is just a place holder, need to implement * virDomainGetMemoryParameters 1. https://www.redhat.com/archives/libvir-list/2010-August/msg00607.html 2. https://www.redhat.com/archives/libvir-list/2010-August/msg00699.html --- Nikunj A. Dadhania (12): Adding virDomainSetMemoryParameters API Adding structure for virDomainSetMemoryParameter Adds xml entries for memory tunables XML parsing for memory tunables Hand-coded python bindings for virDomainSetMemoryParameters Implement driver interface domainSetMemoryParamters for QEmu Implement cgroup memory controller tunables Adding memtunables to libvirt-lxc command Adding memtunables to qemuSetupCgroup Adding memtune command to virsh tool Implements virDomainSetMemoryParameters for the remote driver Implement domainSetMemoryParameters function daemon/remote.c | 66 +++++++++++++++++ daemon/remote_dispatch_prototypes.h | 8 ++ daemon/remote_dispatch_table.h | 5 + docs/schemas/domain.rng | 31 ++++++++ include/libvirt/libvirt.h.in | 56 ++++++++++++++ python/generator.py | 1 python/libvirt-override-api.xml | 6 ++ python/libvirt-override.c | 7 ++ src/conf/domain_conf.c | 50 +++++++++++-- src/conf/domain_conf.h | 12 ++- src/driver.h | 6 ++ src/esx/esx_driver.c | 1 src/esx/esx_vmx.c | 30 ++++---- src/libvirt.c | 48 ++++++++++++ src/libvirt_private.syms | 6 ++ src/libvirt_public.syms | 5 + src/lxc/lxc_controller.c | 24 ++++++ src/lxc/lxc_driver.c | 101 ++++++++++++++++++++++++-- src/openvz/openvz_driver.c | 9 +- src/phyp/phyp_driver.c | 1 src/qemu/qemu.conf | 4 + src/qemu/qemu_conf.c | 11 ++- src/qemu/qemu_driver.c | 138 +++++++++++++++++++++++++++++++++-- src/remote/remote_driver.c | 66 +++++++++++++++++ src/remote/remote_protocol.c | 62 +++++++++++++++- src/remote/remote_protocol.h | 36 +++++++++ src/test/test_driver.c | 13 ++- src/uml/uml_conf.c | 2 - src/uml/uml_driver.c | 15 ++-- src/util/cgroup.c | 106 +++++++++++++++++++++++++++ src/util/cgroup.h | 7 ++ src/xen/xen_driver.c | 1 tools/virsh.c | 89 +++++++++++++++++++++++ 33 files changed, 955 insertions(+), 68 deletions(-)

2 21

[libvirt] dnsmasq, dhcp - bug or feature
by Zdenek Styblik 21 Sep '10

21 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello list, I have network definition like this: <network> <name>default</name> <uuid>5539715b-ae89-c15c-aa2e-2f5a7afd55b8</uuid> <forward mode='route'/> <bridge name='virbr0' stp='on' delay='0' /> <ip address='10.117.9.1' netmask='255.255.255.224'> </ip> </network> and I would assume it means DHCP is off. Even virt-manager claims it's off, yet dnsmasq gets started every time. And what's "worse", it's giving away IP addresses. So, I'm wondering if it's bug or feature or have I missed something? :o) libvirt version is 0.8.4 as I haven't upgraded to 0.8.5 yet. Thanks for reply and have a nice weekend, Zdenek Styblik - -- Zdenek Styblik Net/Linux admin OS TurnovFree.net email: stybla(a)turnovfree.net jabber: stybla(a)jabber.turnovfree.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkyTx74ACgkQ8MreUbSH7il8agCfRHP4IbW8t4MheQs5JIU4xGgE SmgAni4XwNdfYfYTq2hc1F99Y7sbPyeD =CebK -----END PGP SIGNATURE-----

2 2

Re: [libvirt] RFC [3/3]: Lock manager usage scenarios
by Ayal Baron 20 Sep '10

20 Sep '10

----- "Daniel P. Berrange" <berrange(a)redhat.com> wrote: > On Tue, Sep 14, 2010 at 05:03:21PM -0400, Ayal Baron wrote: > > > > ----- "Daniel P. Berrange" <berrange(a)redhat.com> wrote: > > > > > > > > That is probably possible with the current security driver > > > implementations > > > but more generally I think it will still hit some trouble. > > > Specifically > > > one of the items on our todo list is a new security driver that > makes > > > use > > > of Linux container namespace functionality to isolate the VMs, so > they > > > > > > can't even see other resources / processes on the host. This may > well > > > prevent the sync manager wrapper talking to a central sync mnager > > > process > > > The general rule we aim for is that once libvirtd has spawned a > VM > > > they > > > are completely isolated with exception of any disks marked with > > > <shareable/> > > > In other words, any communictions channels must be > > > initiated/established > > > by the mgmt layer to the VM process, with nothing to be > established in > > > the > > > reverse direction. > > Correct me if I'm wrong, but the security limitations (selinux > context) > > would only take effect after the "exec", no? so the process could > still > > communicate with the daemon, open an FD and then exec. After exec, > the > > VM would be locked down but the daemon could still wait on the FD to > see > > whether VM has died. > > It depends on which exec you are talking about here. If the comms to > the daemon are done straight from the libvirtd plugin, then it would > still be unrestricted. If the comms were done from the supervisor > process, it would be restricted. > > Daniel I'm talking about the supervisor. You said you spoke to Dan Walsh and that the supervisor and qemu processes could get different contexts. Now you're saying the supervisor would be restricted nonetheless. What am I missing? > -- > |: Red Hat, Engineering, London -o- > http://people.redhat.com/berrange/ :| > |: http://libvirt.org -o- http://virt-manager.org -o- > http://deltacloud.org :| > |: http://autobuild.org -o- > http://search.cpan.org/~danberr/ :| > |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B > 9505 :|

4 5

[libvirt] [PATCH 0/3] Experimental support for DTrace probes
by Daniel P. Berrange 17 Sep '10

17 Sep '10

This patchset provides the infrastructure for supporting dynamic probing of libvirtd, using static DTrace markers. This can be used by SystemTAP on Linux, or DTrace on Solaris/OS-X/BSD for low overhead tracing. The proof of concept provides a handful of markers wrt to network client connections, security & auth. Obviously it can be expanded to cover a huge area of our codebase for different tasks. The hard bit is deciding what should be exposed as a probe point. Ideally probes should not be changed/removed once added, since this would break any user tracing scripts. So a little care needs to be taken in placing probes to be robust against future code re-factoring. Daniel

2 5

[libvirt] Front page of wiki reorganised
by Justin Clift 17 Sep '10

17 Sep '10

Hi us, Just reorganised the front page of the wiki, pulling in links from some of the other pages, and ordering things by categories: http://wiki.libvirt.org/page/Main_Page It's now a longer page, more like a central jump point. Feedback/flames/etc, welcome. :) Regards and best wishes, Justin Clift

2 1

[libvirt] [PATCH 0/2] tests: silence qemuargv2xmltest
by Eric Blake 16 Sep '10

16 Sep '10

Oh well, this missed the 0.8.4 deadline. This cleanup has already been mentioned for some time on the list, and I finally got it done. Eric Blake (2): tests: clean up qemuargv2xmltest tests: silence qemuargv2xmltest noise tests/qemuargv2xmltest.c | 200 +++++++++++++++++++++++++++------------------- 1 files changed, 117 insertions(+), 83 deletions(-) -- 1.7.2.2

3 9

[libvirt] [PATCH] docs: reworked the policykit patch submitted by Patrick Dignan
by Justin Clift 16 Sep '10

16 Sep '10

Tweaked the PolicyKit documentation improvement patch submitted by Patrick Dignan. Additionally, removed the reference to PolicyKit.conf, which is no longer used by PolicyKit, plus added a link to the expanded PolicyKit example page on the wiki. --- The concept submitted was both valid and useful, but the keyswords in the "Result*" lines are case sensitive, so the example provided didn't work. docs/auth.html.in | 42 ++++++++++++++++++++---------------------- 1 files changed, 20 insertions(+), 22 deletions(-) diff --git a/docs/auth.html.in b/docs/auth.html.in index ab6c3e9..13731eb 100644 --- a/docs/auth.html.in +++ b/docs/auth.html.in @@ -65,29 +65,27 @@ auth, but does not require that the client application ultimately run as root. Default policy will still allow any application to connect to the RO socket. </p> <p> -The default policy can be overridden by the administrator using the PolicyKit -master configuration file in <code>/etc/PolicyKit/PolicyKit.conf</code>. The -<code>PolicyKit.conf(5)</code> manual page provides details on the syntax -available. The two libvirt daemon actions available are named <code>org.libvirt.unix.monitor</code> -for the RO socket, and <code>org.libvirt.unix.manage</code> for the RW socket. -</p> +The default policy can be overridden by creating a new policy file in the +local override directory <code>/etc/polkit-1/localauthority/50-local.d/</code>. +Policy files should have a unique name ending with .pkla. Using reverse DNS +naming works well. Information on the options available can be found by +reading the pklocalauthority man page. The two libvirt daemon actions +available are named <code>org.libvirt.unix.manage</code> for full management +access, and <code>org.libvirt.unix.monitor</code> for read-only access. + </p> <p> -As an example, to allow a user <code>fred</code> full access to the RW socket, -while requiring <code>joe</code> to authenticate with the admin password, -would require adding the following snippet to <code>PolicyKit.conf</code>. -</p> - <pre> - <match action="org.libvirt.unix.manage"> - <match user="fred"> - <return result="yes"/> - </match> - </match> - <match action="org.libvirt.unix.manage"> - <match user="joe"> - <return result="auth_admin"/> - </match> - </match> -</pre> +As an example, this gives the user <code>fred</code> full management access: + </p> +<pre>[Allow fred libvirt management permissions] +Identity=unix-user:fred +Action=org.libvirt.unix.manage +ResultAny=yes +ResultInactive=yes +ResultActive=yes</pre> + <p> +Further examples of PolicyKit setup can be found on the +<a href="http://wiki.libvirt.org/page/SSHPolicyKitSetup">wiki page</a>. + </p> <h3><a name="ACL_server_username">Username/password auth</a></h3> <p> The plain TCP socket of the libvirt daemon defaults to using SASL for authentication. -- 1.7.2.3

2 2

[libvirt] [PATCH] docs: fix the xml validity errors regarding name and id
by Justin Clift 16 Sep '10

16 Sep '10

Got sick of seeing the "validity error : ID Objects already defined" errors, which this patch addresses. --- docs/api.html.in | 8 ++++---- docs/architecture.html.in | 6 +++--- docs/downloads.html.in | 2 +- docs/remote.html.in | 30 +++++++++++++++--------------- docs/storage.html.in | 16 ++++++++-------- docs/uri.html.in | 24 ++++++++++++------------ 6 files changed, 43 insertions(+), 43 deletions(-) diff --git a/docs/api.html.in b/docs/api.html.in index 4b6a529..c9c0c67 100644 --- a/docs/api.html.in +++ b/docs/api.html.in @@ -19,7 +19,7 @@ <a href="#Remote">Daemon and remote access</a> </li> </ul> - <h2><a name="Objects" id="Objects">Objects exposed</a></h2> + <h2><a name="Objects" id="id-Objects">Objects exposed</a></h2> <p> As defined in the <a href="goals.html">goals section</a>, libvirt API need to expose all the resources needed to manage the virtualization support of recent operating systems. The first object manipulated though @@ -85,7 +85,7 @@ set of nodes.</li> </ul> - <h2><a name="Functions" id="Functions">Functions and naming + <h2><a name="Functions" id="id-Functions">Functions and naming conventions</a></h2> <p> The naming of the functions present in the library is usually made of a prefix describing the object associated to the function @@ -120,13 +120,13 @@ </ul> <p> For more in-depth details of the storage related APIs see <a href="storage.html">the storage management page</a>, - <h2><a name="Driver" id="Driver">The libvirt drivers</a></h2> + <h2><a name="Driver" id="id-Driver">The libvirt drivers</a></h2> <p></p> <p class="image"> <img alt="The libvirt driver architecture" src="libvirt-driver-arch.png"/> </p> - <h2><a name="Remote" id="Remote">Daemon and remote access</a></h2> + <h2><a name="Remote" id="id-Remote">Daemon and remote access</a></h2> <p></p> <p class="image"> <img alt="The libvirt daemon and remote architecture" diff --git a/docs/architecture.html.in b/docs/architecture.html.in index f5cc520..c147435 100644 --- a/docs/architecture.html.in +++ b/docs/architecture.html.in @@ -16,7 +16,7 @@ engines:</p> </li> </ul> <h3> - <a name="Xen" id="Xen">Libvirt Xen support</a> + <a name="Xen" id="id-Xen">Libvirt Xen support</a> </h3> <p>When running in a Xen environment, programs using libvirt have to execute in "Domain 0", which is the primary Linux OS loaded on the machine. That OS @@ -49,7 +49,7 @@ connect to initialize the library. It will then fork a libvirt_proxy program running as root and providing read_only access to the API, this is then only useful for reporting and monitoring.</p> <h3> - <a name="QEmu" id="QEmu">Libvirt QEmu and KVM support</a> + <a name="QEmu" id="id-QEmu">Libvirt QEmu and KVM support</a> </h3> <p>The model for QEmu and KVM is completely similar, basically KVM is based on QEmu for the process controlling a new domain, only small details differs @@ -63,7 +63,7 @@ domain, by specifying the architecture and machine type targeted.</p> <p>The code controlling the QEmu process is available in the <code>qemud/</code> directory.</p> <h3> - <a name="drivers" id="drivers">the driver based architecture</a> + <a name="drivers" id="id-drivers">the driver based architecture</a> </h3> <p>As the previous section explains, libvirt can communicate using different channels with the current hypervisor, and should also be able to use diff --git a/docs/downloads.html.in b/docs/downloads.html.in index 2ce1048..3bea264 100644 --- a/docs/downloads.html.in +++ b/docs/downloads.html.in @@ -91,7 +91,7 @@ <h1>libvirt Installation</h1> - <h2><a name="Compilatio" id="Compilatio">Compilation</a></h2> + <h2><a name="Compilatio" id="id-Compilatio">Compilation</a></h2> <p> libvirt uses the standard configure/make/install steps: diff --git a/docs/remote.html.in b/docs/remote.html.in index b8b8f2b..eb787c2 100644 --- a/docs/remote.html.in +++ b/docs/remote.html.in @@ -58,7 +58,7 @@ machines through authenticated and encrypted connections. </li> </ul> <h3> - <a name="Remote_basic_usage" id="Remote_basic_usage">Basic usage</a> + <a name="Remote_basic_usage" id="id-Remote_basic_usage">Basic usage</a> </h3> <p> On the remote machine, <code>libvirtd</code> should be running. @@ -92,7 +92,7 @@ relating to failures in the remote transport itself. </li> much slower than, say, direct hypervisor calls. </li> </ul> <h3> - <a name="Remote_transports" id="Remote_transports">Transports</a> + <a name="Remote_transports" id="id-Remote_transports">Transports</a> </h3> <p> Remote libvirt supports a range of transports: @@ -140,7 +140,7 @@ Remote libvirt supports a range of transports: The default transport, if no other is specified, is <code>tls</code>. </p> <h3> - <a name="Remote_URI_reference" id="Remote_URI_reference">Remote URIs</a> + <a name="Remote_URI_reference" id="id-Remote_URI_reference">Remote URIs</a> </h3> <p> See also: <a href="uri.html">documentation on ordinary ("local") URIs</a>. @@ -181,7 +181,7 @@ settings. </li> </ul> <h4> - <a name="Remote_URI_parameters" id="Remote_URI_parameters">Extra parameters</a> + <a name="Remote_URI_parameters" id="id-Remote_URI_parameters">Extra parameters</a> </h4> <p> Extra parameters can be added to remote URIs as part @@ -304,10 +304,10 @@ Note that parameter values must be </tr> </table> <h3> - <a name="Remote_certificates" id="Remote_certificates">Generating TLS certificates</a> + <a name="Remote_certificates" id="id-Remote_certificates">Generating TLS certificates</a> </h3> <h4> - <a name="Remote_PKI" id="Remote_PKI">Public Key Infrastructure set up</a> + <a name="Remote_PKI" id="id-Remote_PKI">Public Key Infrastructure set up</a> </h4> <p> If you are unsure how to create TLS certificates, skip to the @@ -367,7 +367,7 @@ next section. </tr> </table> <h4> - <a name="Remote_TLS_background" id="Remote_TLS_background">Background to TLS certificates</a> + <a name="Remote_TLS_background" id="id-Remote_TLS_background">Background to TLS certificates</a> </h4> <p> Libvirt supports TLS certificates for verifying the identity @@ -402,7 +402,7 @@ address. You may want to change this to make it less (or more) permissive, depending on your needs. </p> <h4> - <a name="Remote_TLS_CA" id="Remote_TLS_CA">Setting up a Certificate Authority (CA)</a> + <a name="Remote_TLS_CA" id="id-Remote_TLS_CA">Setting up a Certificate Authority (CA)</a> </h4> <p> You will need the <a href="http://www.gnu.org/software/gnutls/manual/html_node/Invoking-certtool.html">GnuTLS @@ -473,7 +473,7 @@ key carefully as you will need it when you come to issue certificates for your clients and servers. </p> <h4> - <a name="Remote_TLS_server_certificates" id="Remote_TLS_server_certificates">Issuing server certificates</a> + <a name="Remote_TLS_server_certificates" id="id-Remote_TLS_server_certificates">Issuing server certificates</a> </h4> <p> For each server (libvirtd) you need to issue a certificate @@ -556,7 +556,7 @@ which can be installed on the server as </li> </ul> <h4> - <a name="Remote_TLS_client_certificates" id="Remote_TLS_client_certificates">Issuing client certificates</a> + <a name="Remote_TLS_client_certificates" id="id-Remote_TLS_client_certificates">Issuing client certificates</a> </h4> <p> For each client (ie. any program linked with libvirt, such as @@ -609,7 +609,7 @@ cp clientcert.pem /etc/pki/libvirt/clientcert.pem </li> </ol> <h4> - <a name="Remote_TLS_troubleshooting" id="Remote_TLS_troubleshooting">Troubleshooting TLS certificate problems</a> + <a name="Remote_TLS_troubleshooting" id="id-Remote_TLS_troubleshooting">Troubleshooting TLS certificate problems</a> </h4> <dl> <dt> failed to verify client's certificate </dt> @@ -627,7 +627,7 @@ to analyze the setup on the client or server machines, preferably as root. It will try to point out the possible problems and provide solutions to fix the set up up to a point where you have secure remote access.</p> <h3> - <a name="Remote_libvirtd_configuration" id="Remote_libvirtd_configuration">libvirtd configuration file</a> + <a name="Remote_libvirtd_configuration" id="id-Remote_libvirtd_configuration">libvirtd configuration file</a> </h3> <p> Libvirtd (the remote daemon) is configured from a file called @@ -795,7 +795,7 @@ Blank lines and comments beginning with <code>#</code> are ignored. </tr> </table> <h3> - <a name="Remote_IPv6" id="Remote_IPv6">IPv6 support</a> + <a name="Remote_IPv6" id="id-Remote_IPv6">IPv6 support</a> </h3> <p> The libvirtd service and libvirt remote client driver both use the @@ -808,7 +808,7 @@ connection will be made, otherwise IPv4 will be used. In summary it should just 'do the right thing(tm)'. </p> <h3> - <a name="Remote_limitations" id="Remote_limitations">Limitations</a> + <a name="Remote_limitations" id="id-Remote_limitations">Limitations</a> </h3> <ul> <li> Fine-grained authentication: libvirt in general, @@ -821,7 +821,7 @@ just read-write/read-only as at present. Please come and discuss these issues and more on <a href="https://www.redhat.com/mailman/listinfo/libvir-list" title="libvir-list mailing list">the mailing list</a>. </p> <h3> - <a name="Remote_implementation_notes" id="Remote_implementation_notes">Implementation notes</a> + <a name="Remote_implementation_notes" id="id-Remote_implementation_notes">Implementation notes</a> </h3> <p> The current implementation uses <a href="http://en.wikipedia.org/wiki/External_Data_Representation" title="External Data Representation">XDR</a>-encoded packets with a diff --git a/docs/storage.html.in b/docs/storage.html.in index 079192b..a1eddf8 100644 --- a/docs/storage.html.in +++ b/docs/storage.html.in @@ -33,7 +33,7 @@ libvirt. </li> </ul> - <h2><a name="StorageBackendDir" id="StorageBackendDir">Directory pool</a></h2> + <h2><a name="StorageBackendDir" id="id-StorageBackendDir">Directory pool</a></h2> <p> A pool with a type of <code>dir</code> provides the means to manage files within a directory. The files can be fully allocated raw files, @@ -85,7 +85,7 @@ libvirt. </p> - <h2><a name="StorageBackendFS" id="StorageBackendFS">Filesystem pool</a></h2> + <h2><a name="StorageBackendFS" id="id-StorageBackendFS">Filesystem pool</a></h2> <p> This is a variant of the directory pool. Instead of creating a directory on an existing mounted filesystem though, it expects @@ -156,7 +156,7 @@ libvirt. </p> - <h2><a name="StorageBackendNetFS" id="StorageBackendNetFS">Network filesystem pool</a></h2> + <h2><a name="StorageBackendNetFS" id="id-StorageBackendNetFS">Network filesystem pool</a></h2> <p> This is a variant of the filesystem pool. Instead of requiring a local block device as the source, it requires the name of a @@ -196,7 +196,7 @@ libvirt. </p> - <h2><a name="StorageBackendLogical" id="StorageBackendLogical">Logical volume pools</a></h2> + <h2><a name="StorageBackendLogical" id="id-StorageBackendLogical">Logical volume pools</a></h2> <p> This provides a pool based on an LVM volume group. For a pre-defined LVM volume group, simply providing the group @@ -231,7 +231,7 @@ libvirt. </p> - <h2><a name="StorageBackendDisk" id="StorageBackendDisk">Disk volume pools</a></h2> + <h2><a name="StorageBackendDisk" id="id-StorageBackendDisk">Disk volume pools</a></h2> <p> This provides a pool based on a physical disk. Volumes are created by adding partitions to the disk. Disk pools are have constraints @@ -318,7 +318,7 @@ libvirt. </ul> - <h2><a name="StorageBackendISCSI" id="StorageBackendISCSI">iSCSI volume pools</a></h2> + <h2><a name="StorageBackendISCSI" id="id-StorageBackendISCSI">iSCSI volume pools</a></h2> <p> This provides a pool based on an iSCSI target. Volumes must be pre-allocated on the iSCSI server, and cannot be created via @@ -351,7 +351,7 @@ libvirt. The iSCSI volume pool does not use the volume format type element. </p> - <h2><a name="StorageBackendSCSI" id="StorageBackendSCSI">SCSI volume pools</a></h2> + <h2><a name="StorageBackendSCSI" id="id-StorageBackendSCSI">SCSI volume pools</a></h2> <p> This provides a pool based on a SCSI HBA. Volumes are preexisting SCSI LUNs, and cannot be created via the libvirt APIs. Since /dev/XXX names @@ -383,7 +383,7 @@ libvirt. The SCSI volume pool does not use the volume format type element. </p> - <h2><a name="StorageBackendMultipath" id="StorageBackendMultipath">Multipath pools</a></h2> + <h2><a name="StorageBackendMultipath" id="id-StorageBackendMultipath">Multipath pools</a></h2> <p> This provides a pool that contains all the multipath devices on the host. Volume creating is not supported via the libvirt APIs. diff --git a/docs/uri.html.in b/docs/uri.html.in index 0540dab..ffb86c1 100644 --- a/docs/uri.html.in +++ b/docs/uri.html.in @@ -37,7 +37,7 @@ documents libvirt URIs. </li> </ul> <h3> - <a name="URI_libvirt" id="URI_libvirt">Specifying URIs to libvirt</a> + <a name="URI_libvirt" id="id-URI_libvirt">Specifying URIs to libvirt</a> </h3> <p> The URI is passed as the <code>name</code> parameter to <a href="html/libvirt-libvirt.html#virConnectOpen"><code>virConnectOpen</code></a> or <a href="html/libvirt-libvirt.html#virConnectOpenReadOnly"><code>virConnectOpenReadOnly</code></a>. For example: @@ -46,7 +46,7 @@ The URI is passed as the <code>name</code> parameter to <a href="html/libvirt-li virConnectPtr conn = virConnectOpenReadOnly (<b>"test:///default"</b>); </pre> <h3> - <a name="URI_virsh" id="URI_virsh">Specifying URIs to virsh, virt-manager and virt-install</a> + <a name="URI_virsh" id="id-URI_virsh">Specifying URIs to virsh, virt-manager and virt-install</a> </h3> <p> In virsh use the <code>-c</code> or <code>--connect</code> option: @@ -77,7 +77,7 @@ In virt-install use the <code>--connect=</code><i>URI</i> option: virt-install <b>--connect=test:///default</b> <i>[other options]</i> </pre> <h3> - <a name="URI_xen" id="URI_xen">xen:/// URI</a> + <a name="URI_xen" id="id-URI_xen">xen:/// URI</a> </h3> <p> <i>This section describes a feature which is new in libvirt > @@ -88,7 +88,7 @@ To access a Xen hypervisor running on the local machine use the URI <code>xen:///</code>. </p> <h3> - <a name="URI_qemu" id="URI_qemu">qemu:///... QEMU and KVM URIs</a> + <a name="URI_qemu" id="id-URI_qemu">qemu:///... QEMU and KVM URIs</a> </h3> <p> To use QEMU support in libvirt you must be running the @@ -120,7 +120,7 @@ KVM guests in the <a href="format.html#KVM1">guest XML as described here</a>. </p> <h3> - <a name="URI_remote" id="URI_remote">Remote URIs</a> + <a name="URI_remote" id="id-URI_remote">Remote URIs</a> </h3> <p> Remote URIs are formed by taking ordinary local URIs and adding a @@ -183,7 +183,7 @@ remote URI reference</a> and <a href="remote.html">full documentation for libvirt remote support</a>. </p> <h3> - <a name="URI_test" id="URI_test">test:///... Test URIs</a> + <a name="URI_test" id="id-URI_test">test:///... Test URIs</a> </h3> <p> The test driver is a dummy hypervisor for test purposes. @@ -197,10 +197,10 @@ a set of host definitions held in the named file. </li> </ul> <h3> - <a name="URI_legacy" id="URI_legacy">Other & legacy URI formats</a> + <a name="URI_legacy" id="id-URI_legacy">Other & legacy URI formats</a> </h3> <h4> - <a name="URI_NULL" id="URI_NULL">NULL and empty string URIs</a> + <a name="URI_NULL" id="id-URI_NULL">NULL and empty string URIs</a> </h4> <p> Libvirt allows you to pass a <code>NULL</code> pointer to @@ -224,7 +224,7 @@ application wishes to connect specifically to a Xen hypervisor, then for future proofing it should choose a full <a href="#URI_xen"><code>xen:///</code> URI</a>. </p> <h4> - <a name="URI_file" id="URI_file">File paths (xend-unix-server)</a> + <a name="URI_file" id="id-URI_file">File paths (xend-unix-server)</a> </h4> <p> If XenD is running and configured in <code>/etc/xen/xend-config.sxp</code>: @@ -241,7 +241,7 @@ using a file URI such as: virsh -c ///var/run/xend/xend-socket </pre> <h4> - <a name="URI_http" id="URI_http">Legacy: <code>http://...</code> (xend-http-server)</a> + <a name="URI_http" id="id-URI_http">Legacy: <code>http://...</code> (xend-http-server)</a> </h4> <p> If XenD is running and configured in <code>/etc/xen/xend-config.sxp</code>: @@ -277,7 +277,7 @@ Notes: documentation as "unix server" or "http server".</li> </ol> <h4> - <a name="URI_legacy_xen" id="URI_legacy_xen">Legacy: <code>"xen"</code></a> + <a name="URI_legacy_xen" id="id-URI_legacy_xen">Legacy: <code>"xen"</code></a> </h4> <p> Another legacy URI is to specify name as the string @@ -285,7 +285,7 @@ Another legacy URI is to specify name as the string hypervisor. However you should prefer a full <a href="#URI_xen"><code>xen:///</code> URI</a> in all future code. </p> <h4> - <a name="URI_legacy_proxy" id="URI_legacy_proxy">Legacy: Xen proxy</a> + <a name="URI_legacy_proxy" id="id-URI_legacy_proxy">Legacy: Xen proxy</a> </h4> <p> Libvirt continues to support connections to a separately running Xen -- 1.7.2.3

3 4

Re: [libvirt] Why is avahi-daemon being started?
by Eric Blake 16 Sep '10

16 Sep '10

[adding libvir-list] On 09/07/2010 07:42 AM, Tom Horsley wrote: > On Tue, 07 Sep 2010 13:51:09 +0100 > Adam Williamson wrote: > >>> I did find a "Should-start: avahi-daemon" comment in the libvirtd >>> init script, so maybe that is the source. >> >> Shouldn't be. 'Should-start' means 'if this other service is enabled, it >> should be started before this one': it's not a strict dependency, 'this >> other service MUST be started before this one'. > > Yea, changing the comment there didn't fix anything, but it was a good > hint since I finally found the "mdns_adv" setting in the libvirtd.conf > file and uncommenting it did finally squash avahi-daemon :-). I'm wondering if this means that libvirt should change any of its policies about auto-starting avahi-daemon, or at the very least, if there is a documentation shortcoming on why libvirt defaults to enabling this and when you might want to change that default. -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

4 6

Re: [libvirt] IPv6 structs on MacOS X
by Justin Clift 15 Sep '10

15 Sep '10

On 09/16/2010 04:52 AM, Bruno Haible wrote: <snip> > This message talks about the unportability of a field 's6_addr32' in > 'struct in6_addr'. Sure this is unportable: POSIX [1] specifies only the > presence of 's6_addr'. > > I don't see why gnulib should support this: An application can perfectly > access the 16 bytes of the s6_addr[] array. Why would it need to access a > specific part of it in a special way? My apologies. I should have been significantly clearer in what I was trying for there. :) (adding the libvirt devel mailing list back in, due to relevance) Tried compiling libvirt on OS X, which errored on this piece of IPv6 code: http://www.redhat.com/archives/libvir-list/2010-September/msg00243.html The message I quoted to Eric above, which you've then looked at, was danpb wondering whether we should be using gnulib to avoid the portability problem. This stuff is outside my area of expertise though. :) Regards and best wishes, Justin Clift

2 5

Re: [libvirt] OSX 10.6 build failures
by Osier 15 Sep '10

15 Sep '10

----- "Justin Clift" <jclift(a)redhat.com> wrote: > From: "Justin Clift" <jclift(a)redhat.com> > To: "Libvirt Developers Mailing List" <libvir-list(a)redhat.com> > Sent: Wednesday, September 15, 2010 7:42:48 AM GMT +08:00 Beijing / Chongqing / Hong Kong / Urumqi > Subject: [libvirt] OSX 10.6 build failures > > Hi us, > > Going through the process of getting libvirt to compile on OSX, making > > notes of the failures on the way through (from a clean system) to be > fixed. > > a) libtool -> glibtool > libtoolize -> glibtoolize > > It turns out that autogen.sh is hard coded to use "libtool", and > wants the GNU version. > > OSX supplies has it's own version, without a --version option, so > autogen.sh fails. > > Installing GNU libtool through MacPorts, makes it available as > glibtool, with libtoolize being glibtoolize. > > Adjusting autogen.sh to detect that, then set LIBTOOL and > LIBTOOLIZE > appropriately was fairly trivial. > > Will submit a patch to fix that in a bit. > > > b) pkg-config > > The next thing to barf was autoconf, complaining about > AC_MSG_ERROR > not being a defined macro. > > Googling with some persistence showed this is caused by > pkg-config > not being installed. Fixed that. > > Will submit a patch for that too. Probably "pkg-config > --version" > based, copying the approach used for the other autogen.sh checks. > > > c) This is a compilation failure, one I don't readily know how to > fix: > > ... > Making all in src > make all-am > CC libvirt_util_la-network.lo > util/network.c: In function 'getIPv6Addr': > util/network.c:50: error: 'struct in6_addr' has no member named > 's6_addr16' > util/network.c:50: error: 'struct in6_addr' has no member named > 's6_addr16' > util/network.c:50: error: 'struct in6_addr' has no member named > 's6_addr16' > util/network.c:50: error: 'struct in6_addr' has no member named > 's6_addr16' > make[3]: *** [libvirt_util_la-network.lo] Error 1 > make[2]: *** [all] Error 2 > make[1]: *** [all-recursive] Error 1 > make: *** [all] Error 2 > $ > > They're the only problems so far, though most things have been > disabled > on the ./configure line so it's only the client libraries being > built. > > Anyone know how to address that third one? > % man ipv6 Address Format struct sockaddr_in6 { sa_family_t sin6_family; /* AF_INET6 */ in_port_t sin6_port; /* port number */ uint32_t sin6_flowinfo; /* IPv6 flow information */ struct in6_addr sin6_addr; /* IPv6 address */ uint32_t sin6_scope_id; /* Scope ID (new in 2.4) */ }; struct in6_addr { unsigned char s6_addr[16]; /* IPv6 address */ }; % vim libvirt/src/util/network.c 43 static int getIPv6Addr(virSocketAddrPtr addr, virIPv6AddrPtr tab) { 44 int i; 45 46 if ((addr == NULL) || (tab == NULL) || (addr->stor.ss_family != AF_INET6 )) 47 return(-1); 48 49 for (i = 0;i < 8;i++) { 50 (*tab)[i] = ntohs(addr->inet6.sin6_addr.s6_addr16[i]); 51 } 52 53 return(0); 54 } I guess it's a typo, should be "addr->inet6.sin6_addr.s6_addr[i]", but not "addr->inet6.sin6_addr.s6_addr16[i]".. :-) - Osier > Regards and best wishes, > > Justin Clift > > -- > libvir-list mailing list > libvir-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/libvir-list

4 4

[libvirt] [PATCH] virsh: change wexitstatus order to allow compilation on mac osx
by Justin Clift 15 Sep '10

15 Sep '10

This is the simple fix Daniel Veillard suggested last year: http://www.redhat.com/archives/libvir-list/2009-May/msg00459.html --- tools/virsh.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 57ea618..c148f7b 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -8646,7 +8646,7 @@ editFile (vshControl *ctl, const char *filename) VIR_FREE(command); return -1; } - if (command_ret != WEXITSTATUS (0)) { + if (WEXITSTATUS(command_ret) != 0) { vshError(ctl, _("%s: command exited with non-zero status"), command); VIR_FREE(command); -- 1.7.2.2

2 3

Re: [libvirt] [PATCH] autogen.sh: added glibtool and pkg-config checks
by Bruce Korb 15 Sep '10

15 Sep '10

Please don't use my project name when talking about bootstrap process. "autogen.sh" has become a popular misnomer, so at least keep the ".sh" suffix. Thanks. On Wed, Sep 15, 2010 at 10:02 AM, Eric Blake <eblake(a)redhat.com> wrote: > [adding bug-gnulib] > > On 09/15/2010 06:36 AM, Justin Clift wrote: >> >> OSX MacPorts has libtool named as glibtool, with libtoolize >> named as glibtoolize. This patch adds support for this, and also >> adds a check for pkg-config, to warn when it is missing. > > Hmm - would it be easier to make bootstrap.conf list pkg-config as a > prerequisite, rather than having to hack up autogen.sh to do that? > > Also, if I'm reading the code right, changing bootstrap.conf to list > 'libtoolize' instead of 'libtool' as the prerequisite will let you get by > with overriding just $LIBTOOLIZE instead of both $LIBTOOL and $LIBTOOLIZE. > > Additionally it may be sufficient to just teach upstream > gnulib/build-aux/bootstrap to use 'find_tool LIBTOOLIZE libtoolize > glibtoolize', at which point re-syncing to upstream bootstrap will > automatically pick up on the right libtool for MacOS without you having to > hack libvirt's autogen.sh in the first place :) > > So, NACK to this version of the libvirt patch, and instead let me do some > gnulib work... Not to mention that Gary is working on some upstream patches > to improve bootstrap modularity, and there is also a request to add > 'bootstrap --skip-git' that I need to respond to... > > -- > Eric Blake eblake(a)redhat.com +1-801-349-2682 > Libvirt virtualization library http://libvirt.org > >

1 0

[libvirt] [PATCH] libvirtd: improve the error message displayed on tls client auth failure
by Justin Clift 15 Sep '10

15 Sep '10

This address BZ # 556599: https://bugzilla.redhat.com/show_bug.cgi?id=556599 --- daemon/libvirtd.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/daemon/libvirtd.c b/daemon/libvirtd.c index 711360b..46e22bd 100644 --- a/daemon/libvirtd.c +++ b/daemon/libvirtd.c @@ -1226,7 +1226,7 @@ remoteCheckCertificate (gnutls_session_t session) if (i == 0) { if (!remoteCheckDN (cert)) { /* This is the most common error: make it informative. */ - VIR_ERROR0(_("remoteCheckCertificate: client's Distinguished Name is not on the list of allowed clients (tls_allowed_dn_list). Use 'openssl x509 -in clientcert.pem -text' to view the Distinguished Name field in the client certificate, or run this daemon with --verbose option.")); + VIR_ERROR0(_("remoteCheckCertificate: client's Distinguished Name is not on the list of allowed clients (tls_allowed_dn_list). Use 'certtool -i --infile clientcert.pem' to view the Distinguished Name field in the client certificate, or run this daemon with --verbose option.")); gnutls_x509_crt_deinit (cert); return -1; } -- 1.7.2.2

3 6

[libvirt] [PATCH] maint: silence warning from libtool
by Eric Blake 14 Sep '10

14 Sep '10

I got tired of seeing this: config.status: executing libtool commands /bin/rm: cannot remove `libtoolT': No such file or directory config.status: executing po-directories commands While I was at it, there were a couple other unused variables. * configure.ac (RM, MV, TAR): Drop; nothing in libvirt directly uses this, and assigning RM interferes with libtool. --- configure.ac | 3 --- 1 files changed, 0 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index a71f5e8..5ded22b 100644 --- a/configure.ac +++ b/configure.ac @@ -122,9 +122,6 @@ AM_CONDITIONAL([HAVE_GLIBC_RPCGEN], $ac_cv_path_RPCGEN -t </dev/null >/dev/null 2>&1]) dnl Miscellaneous external programs. -AC_PATH_PROG([RM], [rm], [/bin/rm]) -AC_PATH_PROG([MV], [mv], [/bin/mv]) -AC_PATH_PROG([TAR], [tar], [/bin/tar]) AC_PATH_PROG([XMLLINT], [xmllint], [/usr/bin/xmllint]) AC_PATH_PROG([XMLCATALOG], [xmlcatalog], [/usr/bin/xmlcatalog]) AC_PATH_PROG([XSLTPROC], [xsltproc], [/usr/bin/xsltproc]) -- 1.7.2.2

2 2

[libvirt] New wiki pages with libvirt SSH setup instructions
by Justin Clift 14 Sep '10

14 Sep '10

Hi all, Just added some new pages to the wiki, this time covering how to configure remote access to libvirt through SSH, not using root: http://wiki.libvirt.org/page/SSHSetup <--- entry page http://wiki.libvirt.org/page/SSHPolicyKitSetup This has details for several different Linux distributions: * RHEL 5 & 6 * Fedora 11-13 * Centos 5 & 6 * Ubuntu 10.04 Server & Desktop * openSUSE 11.2 onwards Does anyone have info they'd like to include for other distributions? :) Regards and best wishes, Justin Clift

1 0

[libvirt] [PATCH] Rebuild network filter for UML guests on updates
by Soren Hansen 14 Sep '10

14 Sep '10

When nwfilter support was added to UML, I didn't realise the UML driver needed instrumentation to make updating nwfilters on the fly work. This patch adds this bit of glue. Signed-off-by: Soren Hansen <soren(a)linux2go.dk> --- src/uml/uml_driver.c | 18 ++++++++++++++++++ 1 files changed, 18 insertions(+), 0 deletions(-) diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index 40345d5..9101928 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -2198,6 +2198,18 @@ static virDriver umlDriver = { NULL, /* qemuDomainMonitorCommand */ }; +static int +umlVMFilterRebuild(virConnectPtr conn ATTRIBUTE_UNUSED, + virHashIterator iter, void *data) +{ + struct uml_driver *driver = uml_driver; + + umlDriverLock(driver); + virHashForEach(uml_driver->domains.objs, iter, data); + umlDriverUnlock(driver); + + return 0; +} static virStateDriver umlStateDriver = { .name = "UML", @@ -2207,8 +2219,14 @@ static virStateDriver umlStateDriver = { .active = umlActive, }; +static virNWFilterCallbackDriver umlCallbackDriver = { + .name = "UML", + .vmFilterRebuild = umlVMFilterRebuild, +}; + int umlRegister(void) { virRegisterDriver(&umlDriver); virRegisterStateDriver(&umlStateDriver); + virNWFilterRegisterCallbackDriver(&umlCallbackDriver); return 0; } -- 1.7.1

2 1

[libvirt] [PATCH] virsh: Use virBuffer for generating XML
by Jiri Denemark 14 Sep '10

14 Sep '10

cmdAttachInterface and cmdAttachDisk still used vshRealloc and sprintf for generating XML, which is hardly maintainable. Let's get rid of this old code. --- tools/virsh.c | 152 ++++++++++++++++++++------------------------------------ 1 files changed, 54 insertions(+), 98 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 57ea618..9eb1e51 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -7874,8 +7874,9 @@ cmdAttachInterface(vshControl *ctl, const vshCmd *cmd) virDomainPtr dom = NULL; char *mac, *target, *script, *type, *source; int typ, ret = FALSE; - char *buf = NULL, *tmp = NULL; unsigned int flags; + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *xml; if (!vshConnectionUsability(ctl, ctl->conn)) goto cleanup; @@ -7903,52 +7904,40 @@ cmdAttachInterface(vshControl *ctl, const vshCmd *cmd) } /* Make XML of interface */ - tmp = vshMalloc(ctl, 1); - buf = vshMalloc(ctl, strlen(type) + 25); - sprintf(buf, " <interface type='%s'>\n" , type); + virBufferVSprintf(&buf, "<interface type='%s'>\n" , type); - tmp = vshRealloc(ctl, tmp, strlen(source) + 28); - if (typ == 1) { - sprintf(tmp, " <source network='%s'/>\n", source); - } else if (typ == 2) { - sprintf(tmp, " <source bridge='%s'/>\n", source); - } - buf = vshRealloc(ctl, buf, strlen(buf) + strlen(tmp) + 1); - strcat(buf, tmp); + if (typ == 1) + virBufferVSprintf(&buf, " <source network='%s'/>\n", source); + else if (typ == 2) + virBufferVSprintf(&buf, " <source bridge='%s'/>\n", source); - if (target != NULL) { - tmp = vshRealloc(ctl, tmp, strlen(target) + 24); - sprintf(tmp, " <target dev='%s'/>\n", target); - buf = vshRealloc(ctl, buf, strlen(buf) + strlen(tmp) + 1); - strcat(buf, tmp); - } + if (target != NULL) + virBufferVSprintf(&buf, " <target dev='%s'/>\n", target); + if (mac != NULL) + virBufferVSprintf(&buf, " <mac address='%s'/>\n", mac); + if (script != NULL) + virBufferVSprintf(&buf, " <script path='%s'/>\n", script); - if (mac != NULL) { - tmp = vshRealloc(ctl, tmp, strlen(mac) + 25); - sprintf(tmp, " <mac address='%s'/>\n", mac); - buf = vshRealloc(ctl, buf, strlen(buf) + strlen(tmp) + 1); - strcat(buf, tmp); - } + virBufferAddLit(&buf, "</interface>\n"); - if (script != NULL) { - tmp = vshRealloc(ctl, tmp, strlen(script) + 25); - sprintf(tmp, " <script path='%s'/>\n", script); - buf = vshRealloc(ctl, buf, strlen(buf) + strlen(tmp) + 1); - strcat(buf, tmp); + if (virBufferError(&buf)) { + vshPrint(ctl, "%s", _("Failed to allocate XML buffer")); + return FALSE; } - buf = vshRealloc(ctl, buf, strlen(buf) + 19); - strcat(buf, " </interface>\n"); + xml = virBufferContentAndReset(&buf); if (vshCommandOptBool(cmd, "persistent")) { flags = VIR_DOMAIN_DEVICE_MODIFY_CONFIG; if (virDomainIsActive(dom) == 1) flags |= VIR_DOMAIN_DEVICE_MODIFY_LIVE; - ret = virDomainAttachDeviceFlags(dom, buf, flags); + ret = virDomainAttachDeviceFlags(dom, xml, flags); } else { - ret = virDomainAttachDevice(dom, buf); + ret = virDomainAttachDevice(dom, xml); } + VIR_FREE(xml); + if (ret != 0) { vshError(ctl, "%s", _("Failed to attach interface")); ret = FALSE; @@ -7960,8 +7949,7 @@ cmdAttachInterface(vshControl *ctl, const vshCmd *cmd) cleanup: if (dom) virDomainFree(dom); - VIR_FREE(buf); - VIR_FREE(tmp); + virBufferFreeAndReset(&buf); return ret; } @@ -8126,9 +8114,10 @@ cmdAttachDisk(vshControl *ctl, const vshCmd *cmd) virDomainPtr dom = NULL; char *source, *target, *driver, *subdriver, *type, *mode; int isFile = 0, ret = FALSE; - char *buf = NULL, *tmp = NULL; unsigned int flags; char *stype; + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *xml; if (!vshConnectionUsability(ctl, ctl->conn)) goto cleanup; @@ -8167,77 +8156,45 @@ cmdAttachDisk(vshControl *ctl, const vshCmd *cmd) } /* Make XML of disk */ - tmp = vshMalloc(ctl, 1); - buf = vshMalloc(ctl, 23); - if (isFile) { - sprintf(buf, " <disk type='file'"); - } else { - sprintf(buf, " <disk type='block'"); - } - - if (type) { - tmp = vshRealloc(ctl, tmp, strlen(type) + 13); - sprintf(tmp, " device='%s'>\n", type); - } else { - tmp = vshRealloc(ctl, tmp, 3); - sprintf(tmp, ">\n"); - } - buf = vshRealloc(ctl, buf, strlen(buf) + strlen(tmp) + 1); - strcat(buf, tmp); - - if (driver) { - tmp = vshRealloc(ctl, tmp, strlen(driver) + 22); - sprintf(tmp, " <driver name='%s'", driver); - } else { - tmp = vshRealloc(ctl, tmp, 25); - sprintf(tmp, " <driver name='phy'"); - } - buf = vshRealloc(ctl, buf, strlen(buf) + strlen(tmp) + 1); - strcat(buf, tmp); - - if (subdriver) { - tmp = vshRealloc(ctl, tmp, strlen(subdriver) + 12); - sprintf(tmp, " type='%s'/>\n", subdriver); - } else { - tmp = vshRealloc(ctl, tmp, 4); - sprintf(tmp, "/>\n"); - } - buf = vshRealloc(ctl, buf, strlen(buf) + strlen(tmp) + 1); - strcat(buf, tmp); - - tmp = vshRealloc(ctl, tmp, strlen(source) + 25); - if (isFile) { - sprintf(tmp, " <source file='%s'/>\n", source); - } else { - sprintf(tmp, " <source dev='%s'/>\n", source); - } - buf = vshRealloc(ctl, buf, strlen(buf) + strlen(tmp) + 1); - strcat(buf, tmp); - - tmp = vshRealloc(ctl, tmp, strlen(target) + 24); - sprintf(tmp, " <target dev='%s'/>\n", target); - buf = vshRealloc(ctl, buf, strlen(buf) + strlen(tmp) + 1); - strcat(buf, tmp); + virBufferVSprintf(&buf, "<disk type='%s'", + (isFile) ? "file" : "block"); + if (type) + virBufferVSprintf(&buf, " device='%s'", type); + virBufferAddLit(&buf, ">\n"); + + virBufferVSprintf(&buf, " <driver name='%s'", + (driver) ? driver : "phy"); + if (subdriver) + virBufferVSprintf(&buf, " type='%s'", subdriver); + virBufferAddLit(&buf, "/>\n"); + + virBufferVSprintf(&buf, " <source %s='%s'/>\n", + (isFile) ? "file" : "dev", + source); + virBufferVSprintf(&buf, " <target dev='%s'/>\n", target); + if (mode) + virBufferVSprintf(&buf, " <%s/>\n", mode); + + virBufferAddLit(&buf, "</disk>\n"); - if (mode != NULL) { - tmp = vshRealloc(ctl, tmp, strlen(mode) + 11); - sprintf(tmp, " <%s/>\n", mode); - buf = vshRealloc(ctl, buf, strlen(buf) + strlen(tmp) + 1); - strcat(buf, tmp); + if (virBufferError(&buf)) { + vshPrint(ctl, "%s", _("Failed to allocate XML buffer")); + return FALSE; } - buf = vshRealloc(ctl, buf, strlen(buf) + 13); - strcat(buf, " </disk>\n"); + xml = virBufferContentAndReset(&buf); if (vshCommandOptBool(cmd, "persistent")) { flags = VIR_DOMAIN_DEVICE_MODIFY_CONFIG; if (virDomainIsActive(dom) == 1) flags |= VIR_DOMAIN_DEVICE_MODIFY_LIVE; - ret = virDomainAttachDeviceFlags(dom, buf, flags); + ret = virDomainAttachDeviceFlags(dom, xml, flags); } else { - ret = virDomainAttachDevice(dom, buf); + ret = virDomainAttachDevice(dom, xml); } + VIR_FREE(xml); + if (ret != 0) { vshError(ctl, "%s", _("Failed to attach disk")); ret = FALSE; @@ -8249,8 +8206,7 @@ cmdAttachDisk(vshControl *ctl, const vshCmd *cmd) cleanup: if (dom) virDomainFree(dom); - VIR_FREE(buf); - VIR_FREE(tmp); + virBufferFreeAndReset(&buf); return ret; } -- 1.7.2.3

2 2

[libvirt] [PATCH] Use SED variable for `sed` binary in src/Makefile
by Mitchell Hashimoto 14 Sep '10

14 Sep '10

Hi, I've been trying to get libvirt (client) to cleanly/easily compile on BSD-based systems (in this case OS X). "./configure" runs fine but the "make" caused an error with `sed` since BSD sed was reporting some sort of regex error. I realized that the "SED" variable was populated with "gsed" which worked properly. This made the make continue (failed again later, will address that when I can). This is my first contribution to a C-based project and I don't have much experience with autotools other than using them as a consumer. Let me know if anything can be improved. Thank you, Mitchell

4 6

[libvirt] [PATCH 0/3] test cases for spoofing prevention
by gstenzel＠linux.vnet.ibm.com 14 Sep '10

14 Sep '10

The following patches add a set of test cases to verify that several spoofing attacks are prevented by the nwfilter subsystem. In order to have a well defined test machine a virtual disk is installed from scratch over the network. I am currently trying to find a suitable location for the kickstart file. -- Best regards, Gerhard Stenzel, ----------------------------------------------------------------------------------------------------------------------------------- IBM Deutschland Research & Development GmbH Vorsitzender des Aufsichtsrats: Martin Jetter Geschäftsführung: Dirk Wittkopp Sitz der Gesellschaft: Böblingen Registergericht: Amtsgericht Stuttgart, HRB 243294

3 13

Re: [libvirt] Question, how to use virDomainQemuMonitorCommand()
by Chris Lalancette 14 Sep '10

14 Sep '10

On 09/07/10 - 04:08:13PM, Lai Jiangshan wrote: > Hi, Chris, > > I saw virDomainQemuMonitorCommand() in libvirt-qemu.c, > I think it will help me to send arbitrary qemu-monitor command to > qemu via libvirtd. > > But how can I use virDomainQemuMonitorCommand()? > Can I use it by just using current tools(virsh or other) without writing any code? Unfortunately, no. There is a bug in the current virsh command that prevents it from properly parsing the command-lines necessary to send monitor commands to the qemu monitor. Until we fix that bug, we won't push the support into virsh. For that reason you will need to write a custom program to call virDomainQemuMonitorCommand as appropriate. The absolute easiest program you can write looks something like (untested): #include <stdio.h> #include <stdlib.h> #include <libvirt/libvirt.h> int main() { virConnectPtr conn; virDomainPtr dom; char *reply; conn = virConnectOpen(NULL); dom = virDomainLookupByName(conn, "mydomain"); virDomainQemuMonitorCommand(dom, "info cpus", &reply, 0); fprintf(stderr, "Reply: %s\n", reply); free(reply); virConnectClose(conn); return 0; } -- Chris Lalancette

4 8

[libvirt] Remote access form windows - Java bindings
by Gandhiraj Natarajan 14 Sep '10

14 Sep '10

Hi I am developing tool to collect information on XenServer which is on Opensuse 11. I am using libvirt-0.4.6.jar and and jna-3.2.4 jar files. I tried to connect from Remote system(Windows) to server, but could not get the connection object. Any configuration needs to be done for remote access ? conn = new Connect("xen+tcp://192.168.10.22/"); it shows the exception Exception in thread "main" java.lang.UnsatisfiedLinkError: Unable to load library 'virt': The specified module could not be found. at com.sun.jna.NativeLibrary.loadLibrary(NativeLibrary.java:164) at com.sun.jna.NativeLibrary.getInstance(NativeLibrary.java:237) at com.sun.jna.Library$Handler.<init>(Library.java:140) at com.sun.jna.Native.loadLibrary(Native.java:374) at com.sun.jna.Native.loadLibrary(Native.java:359) at org.libvirt.jna.Libvirt.<clinit>(Unknown Source) at org.libvirt.Connect.<clinit>(Unknown Source) at LibvirtCon.main(LibvirtCon.java:29) Help me Regards Gandhiraj Natarajan

3 6

[libvirt] [PATCH] docs: improve wording for the dev guide
by Justin Clift 13 Sep '10

13 Sep '10

Wording tweak suggested by David Jorm, author of the libvirt App Dev Guide. --- docs/devguide.html.in | 14 +++++++------- docs/downloads.html.in | 14 +++++++------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/docs/devguide.html.in b/docs/devguide.html.in index 409952e..6c51c36 100644 --- a/docs/devguide.html.in +++ b/docs/devguide.html.in @@ -4,16 +4,16 @@ <h1>libvirt Application Development Guide</h1> <p> - This is both a guide to developing with libvirt, and a useful - reference document. It is a work in progress, contributed to by the - members of the libvirt team and being authored by a professional - author. + The guide is both a learning tool for developing with libvirt and an + API reference document. It is a work in progress, composed by a + professional author from contributions written by members of the + libvirt team. </p> <p> - Contributors to this are <b>VERY</b> welcome, so if you'd like to - get your name in this and demonstrate your virtualisation prowess, - contributing solidly to the content here will do it. :) + Contributions to the guide are <b>VERY</b> welcome. If you'd like to get + your name on this and demonstrate your virtualisation prowess, a solid + contribution to the content here will do it. :) </p> <h2>Browsable online</h2> diff --git a/docs/downloads.html.in b/docs/downloads.html.in index 66b99e1..2ce1048 100644 --- a/docs/downloads.html.in +++ b/docs/downloads.html.in @@ -49,16 +49,16 @@ <h1>libvirt Application Development Guide</h1> <p> - This is both a guide to developing with libvirt, and a useful - reference document. It is a work in progress, contributed to by the - members of the libvirt team and being authored by a professional - author. + The guide is both a learning tool for developing with libvirt and an + API reference document. It is a work in progress, composed by a + professional author from contributions written by members of the + libvirt team. </p> <p> - Contributors to this are <b>VERY</b> welcome, so if you'd like to - get your name in this and demonstrate your virtualisation prowess, - contributing solidly to the content here will do it. :) + Contributions to the guide are <b>VERY</b> welcome. If you'd like to get + your name on this and demonstrate your virtualisation prowess, a solid + contribution to the content here will do it. :) </p> <h2>Downloadable PDF</h2> -- 1.7.2.2

2 2

[libvirt] [PATCH] tests: Fix preprocessor indentation
by Jiri Denemark 13 Sep '10

13 Sep '10

--- Pushed as obvious to fix make syntax-check failure. tests/virbuftest.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/tests/virbuftest.c b/tests/virbuftest.c index d8258fc..db08fc4 100644 --- a/tests/virbuftest.c +++ b/tests/virbuftest.c @@ -70,7 +70,7 @@ mymain(int argc ATTRIBUTE_UNUSED, int ret = 0; -# define DO_TEST(msg, cb, data) \ +#define DO_TEST(msg, cb, data) \ do { \ struct testInfo info = { data }; \ if (virtTestRun("Buf: " msg, 1, cb, &info) < 0) \ -- 1.7.2.2

1 0

[libvirt] QEMU interfaces for image streaming and post-copy block migration
by Anthony Liguori 12 Sep '10

12 Sep '10

Hi, We've got copy-on-read and image streaming working in QED and before going much further, I wanted to bounce some interfaces off of the libvirt folks to make sure our final interface makes sense. Here's the basic idea: Today, you can create images based on base images that are copy on write. With QED, we also support copy on read which forces a copy from the backing image on read requests and write requests. In additional to copy on read, we introduce a notion of streaming a block device which means that we search for an unallocated region of the leaf image and force a copy-on-read operation. The combination of copy-on-read and streaming means that you can start a guest based on slow storage (like over the network) and bring in blocks on demand while also having a deterministic mechanism to complete the transfer. The interface for copy-on-read is just an option within qemu-img create. Streaming, on the other hand, requires a bit more thought. Today, I have a monitor command that does the following: stream <device> <sector offset> Which will try to stream the minimal amount of data for a single I/O operation and then return how many sectors were successfully streamed. The idea about how to drive this interface is a loop like: offset = 0; while offset < image_size: wait_for_idle_time() count = stream(device, offset) offset += count Obviously, the "wait_for_idle_time()" requires wide system awareness. The thing I'm not sure about is 1) would libvirt want to expose a similar stream interface and let management software determine idle time 2) attempt to detect idle time on it's own and provide a higher level interface. If (2), the question then becomes whether we should try to do this within qemu and provide libvirt a higher level interface. A related topic is block migration. Today we support pre-copy migration which means we transfer the block device and then do a live migration. Another approach is to do a live migration, and on the source, run a block server using image streaming on the destination to move the device. With QED, to implement this one would: 1) launch qemu-nbd on the source while the guest is running 2) create a qed file on the destination with copy-on-read enabled and a backing file using nbd: to point to the source qemu-nbd 3) run qemu -incoming on the destination with the qed file 4) execute the migration 5) when migration completes, begin streaming on the destination to complete the copy 6) when the streaming is complete, shut down the qemu-nbd instance on the source This is a bit involved and we could potentially automate some of this in qemu by launching qemu-nbd and providing commands to do some of this. Again though, I think the question is what type of interfaces would libvirt prefer? Low level interfaces + recipes on how to do high level things or higher level interfaces? Regards, Anthony Liguori

7 31

[libvirt] Release of libvirt-0.8.4
by Daniel Veillard 10 Sep '10

10 Sep '10

As planned the release is now available on the server at ftp://libvirt.org/libvirt/ This is mostly an enhancement and bug fix release, there is less patches than for usual monthly releases, I guess a number of people had a break in August :-) Features: - various improvements to UML driver (Soren Hansen) Documentation: - docs: fix lxc examples (Serge Hallyn) - docs: mention domain <clock> improvements (Eric Blake) - docs: fix an incorrect keyword in updated hooks page (Justin Clift) - docs: significant expansion of custom hook script information (Justin Clift) Portability - cygwin: build fix (Stefan Berger) - build: allow mingw VPATH build (Eric Blake) - Generate libvirt_qemu.def from libvirt_qemu.syms for MinGW builds (Matthias Bolte) - Only require XDR when building libvirtd or the remote driver (Matthias Bolte) - build-sys: fix build when daemon is disabled by not installing libvirtd.8 (Diego Elio Pettenò) Bug Fixes: - Fix block statistics with newer versions of Xen (Guido Günther) - Fix off-by-1 in QEMU boot arg array handling (Daniel P. Berrange) - bridge: Fix static-only DHCP configuration (Jiri Denemark) - qemu: qemuMonitorJSONEjectMedia(): Fix arguments' type (Luiz Capitulino) - qemu: qemuMonitorJSONMigrate(): Fix arguments' type (Luiz Capitulino) - test: Don't overwrite storage volume target path and key (Matthias Bolte) - build: Fix permissions of sysconfig files (Jiri Denemark) - virsh: remove driver check from attach-disk command (Ryan Harper) - phyp: Bad comparison when checking for existing domain name (Eduardo Otubo) - esx: Fix esxVI_BuildSelectSet's invalid argument check (Matthias Bolte) - spec: Fix undefined with_libnl (Jiri Denemark) - Fix handling of sparse NUMA topologies (Daniel P. Berrange) - qemu: Check for errors when converting PCI address to string (Jiri Denemark) - qemu: Fix JSON migrate_set_downtime command (Jiri Denemark) - uml: fix logic bug in checking reply length (Eric Blake) - xen: Fix scheduler setting problems (Daniel Veillard) - nodedev: Free the right pointers when getting WWNs fails (Jiri Denemark) - nodedev: Fix sysfs paths for vport operations (Dave Allan) - xen: Fix device count on detach (Daniel Berrange) - remote: Fix incorrect use of private data field (Daniel Berrange) - esx: Fix memory leak when looking up an non-existing domain by name (Matthias Bolte) - Fix up qemu domain save/managed save locking. (Chris Lalancette) - qemu: Release PCI slot when detaching disk and net devices (Jiri Denemark) - qemu: Re-reserve all PCI addresses on libvirtd restart (Jiri Denemark) - Close fd's of persistent tap devices (Soren Hansen) - Fix tunnelled migration with qemu running as qemu:qemu. (Chris Lalancette) - Fix valgrind complaints when using kill -SIGHUP on libvirtd (Stefan Berger) - bridge: Fix potential segfault when preparing dnsmasq arguments (Jiri Denemark) - Fix return value usage (Doug Goldstein) - nodeinfo: skip offline CPUs (Eric Blake) - Do not use boot=on on IDE device (Daniel Veillard) Improvements: - virsh: Option for overriding disk type in attach-disk (Jiri Denemark) - Explicitly pass uml_dir argument to user-mode-linux (Soren Hansen) - Fix dependancies for remote generated files (Daniel P. Berrange) - Ensure remote daemon unions are always non-zero length (Daniel P. Berrange) - Add nwfilter support to UML driver (Soren Hansen) - esx: Use SessionIsActive when available (Matthias Bolte) - esx: Fall back to path as key when QueryVirtualDiskUuid isn't available (Matthias Bolte) - mingw: match recent changes in spec file (Eric Blake) - Update of localization files (Daniel Veillard) - esx: Use the VirtualDisk UUID as storage volume key (Matthias Bolte) - esx: Add .vmdk storage volume creation (Matthias Bolte) - OpenVZ: add ethernet interface type support (Jean-Baptiste Rouault) - esx: Rework datastore path parsing and handling (Matthias Bolte) - esx: Fix generator for string return values (Matthias Bolte) - build: add some modules (Eric Blake) - Use global directory as UML's monitorDir for privileged connections (Soren Hansen) - maint: track moved file (Eric Blake) - Add tests for Xen's blktap2 implementation (Jim Fehlig) - Add blktap2 support to xend driver (Jim Fehlig) - esx: Map the .vmx annotation to the domain XML description (Matthias Bolte) - esx: Add read-only storage volume access (Matthias Bolte) - Move libvirt-guests init script and config to tools (Jiri Denemark) - Support virDomainAttachDevice and virDomainDetachDevice for disks in UML (Soren Hansen) - Log return value for virConnectGetCapabilities (Daniel P. Berrange) - Try harder to send RPC error message back to client (Daniel P. Berrange) - Add explicit warning messages when failing to serialize to XDR (Daniel P. Berrange) - Allow chardev of type 'file' for UML domains. (Soren Hansen) - esx: Improve object-by-type lookup performance (Matthias Bolte) - xen tests: Fix PV-VFB tests with RHEL-5 API (Jiri Denemark) - xen tests: Fix missing "type ioemu" with rhel5-api (Jiri Denemark) - nodeinfotest: Print libvirt error on failure (Jiri Denemark) - xenapi: support xenapi 5.6.0 headers (Eric Blake) - Add support for -enable-kqemu flag (Daniel P. Berrange) - esx: Use MD5 sum of mount path as storage pool UUID (Matthias Bolte) - esx: Make sure dumpxml outputs proper ID for active domains (Matthias Bolte) - Add actions to virDomainLifecycle enum (Jim Fehlig) - vbox: add location used in rpmfusion release (Eric Blake) - storage: add support for Vendor and Model in XML (Patrick Dignan) - qemu: Fix copy&paste error in warning message (Jiri Denemark) - nwfilter: extend nwfilter reload support (Stefan Berger) - esx: Explicitly disable unused floppy devices (Matthias Bolte) - phyp: Add rudimentary network driver (Eduardo Otubo) - Make umlConnectTapDevice ask brAddTap for a persistent tap device. (Soren Hansen) - Make sure all command line arguments get passed to UML (Soren Hansen) - nwfilter: Discard class D,E IP addresses when sniffing pkts (Stefan Berger) - nwfilter: serialize execution of scripts with ebtables cmds (Stefan Berger) - Move the tunnelled migration unix socket to /var/lib/libvirt/qemu (Chris Lalancette) - qemu: avoid calling the balloon info command if disabled (Daniel Veillard) - bridge: Add --dhcp-no-override option to dnsmasq (Jiri Denemark) - esx: Improve VMX file name parsing and formatting (Matthias Bolte) - esx: Split VMX code into a general and an ESX specific part (Matthias Bolte) - allow memballoon type of none to desactivate it (Daniel Veillard) - Add a detailed message when tap device add fails (Doug Goldstein) - qemu: Hack around asynchronous device_del (Jiri Denemark) - build-sys: only build the test programs during the check phase. (Diego Elio Pettenò) - Add "ubd" to the list of disk prefixes (Soren Hansen) - Extend virSocketParseAddr() to allow a NULL result pointer (Daniel Veillard) - bootloader_args is named bootargs in xen-xm (Philipp Hahn) - Fix return value usage (Doug Goldstein) - qemu: improve error if tun device is missing (Doug Goldstein) - build: rerun bootstrap if po/Makevars got nuked (Eric Blake) Cleanups: - Remove hack to get static binaries in DV environment (Daniel Veillard) - build: avoid uninitialized variable warning (Eric Blake) - vbox: factor a large function (Eric Blake) - lxc: avoid large stacks with veth creation (Eric Blake) - openvz: use virAsprintf to avoid large stacks (Eric Blake) - openvz: formatting cleanups (Eric Blake) - network: use virAsprintf when appropriate (Eric Blake) - Move hextobin as virHexToBin to util.c (Matthias Bolte) - Rename qemudShrinkDisks to virDomainDiskRemove and move to domain_conf.c (Soren Hansen) - xml2sexprtest: Remove graphics from unrelated tests (Jiri Denemark) - xenapi: Fix compile error in previous commit (Matthias Bolte) - qemu: Remove code duplication (Jiri Denemark) - vbox: factor a large function (Eric Blake) - xenapi: avoid sprintf (Eric Blake) - storage: avoid s[n]printf (Eric Blake) - maint: whitespace cleanups (Eric Blake) - build: delete dead comments (Eric Blake) - nwfilter: use consistent OOM reporting (Eric Blake) - build: fix compiler warning (Eric Blake) - build: fix AppArmor compilation (Jamie Strandboge) - Avoid unnecessary bootstrap runs in VPATH builds (Jiri Denemark) - maint: update an email address preference (Eric Blake) - phyp: refactor phypListDomainsGeneric to eliminate buffer overflow (Eduardo Otubo) Thanks everybody who helped for the release with patches, bug reports or documentation ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] Best place to put links to the libvirt App Dev Guide?
by Justin Clift 10 Sep '10

10 Sep '10

Hi guys, Where's the best place in the libvirt.org menu structure, to point people to the (developing) libvirt App Dev Guide? My initial thinking is: a) Have a link to the .pdf in the Downloads section + b) Maybe a new top title section like: Documentation -> "Dev Guide" With links to the html, html (one big page), and pdf files. Sound reasonable? Regards and best wishes, Justin Clift

5 8

[libvirt] [PATCH v3] buf: Fix possible infinite loop in EscapeString, VSnprintf
by Cole Robinson 10 Sep '10

10 Sep '10

The current code will go into an infinite loop if the printf generated string is >= 1000, AND exactly 1 character smaller than the amount of free space in the buffer. When this happens, we are dropped into the loop body, but nothing will actually change, because count == (buf->size - buf->use - 1), and virBufferGrow returns unchanged if count < (buf->size - buf->use) Fix this by removing the '- 1' bit from 'size'. The *nprintf functions handle the NULL byte for us anyways, so we shouldn't need to manually accommodate for it. Here's a bug where we are actually hitting this issue: https://bugzilla.redhat.com/show_bug.cgi?id=602772 v2: Eric's improvements: while -> if (), remove extra va_list variable, make sure we report buffer error if snprintf fails v3: Add tests/virbuftest which reproduces the infinite loop before this patch, works correctly after --- src/util/buf.c | 70 ++++++++++++++++++++++++++++--------------- tests/.gitignore | 1 + tests/Makefile.am | 7 ++++- tests/virbuftest.c | 84 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 137 insertions(+), 25 deletions(-) create mode 100644 tests/virbuftest.c diff --git a/src/util/buf.c b/src/util/buf.c index fc1217b..553e2a0 100644 --- a/src/util/buf.c +++ b/src/util/buf.c @@ -224,7 +224,7 @@ void virBufferVSprintf(const virBufferPtr buf, const char *format, ...) { int size, count, grow_size; - va_list locarg, argptr; + va_list argptr; if ((format == NULL) || (buf == NULL)) return; @@ -236,27 +236,38 @@ virBufferVSprintf(const virBufferPtr buf, const char *format, ...) virBufferGrow(buf, 100) < 0) return; - size = buf->size - buf->use - 1; va_start(argptr, format); - va_copy(locarg, argptr); - while (((count = vsnprintf(&buf->content[buf->use], size, format, - locarg)) < 0) || (count >= size - 1)) { + + size = buf->size - buf->use; + if ((count = vsnprintf(&buf->content[buf->use], + size, format, argptr)) < 0) { + buf->error = 1; + goto err; + } + + /* Grow buffer if necessary and retry */ + if (count >= size) { buf->content[buf->use] = 0; - va_end(locarg); + va_end(argptr); + va_start(argptr, format); - grow_size = (count > 1000) ? count : 1000; + grow_size = (count + 1 > 1000) ? count + 1 : 1000; if (virBufferGrow(buf, grow_size) < 0) { - va_end(argptr); - return; + goto err; } - size = buf->size - buf->use - 1; - va_copy(locarg, argptr); + size = buf->size - buf->use; + if ((count = vsnprintf(&buf->content[buf->use], + size, format, argptr)) < 0) { + buf->error = 1; + goto err; + } } - va_end(argptr); - va_end(locarg); buf->use += count; - buf->content[buf->use] = '\0'; + +err: + va_end(argptr); + return; } /** @@ -336,23 +347,34 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st if ((buf->use >= buf->size) && virBufferGrow(buf, 100) < 0) { - VIR_FREE(escaped); - return; + goto err; + } + + size = buf->size - buf->use; + if ((count = snprintf(&buf->content[buf->use], size, + format, (char *)escaped)) < 0) { + buf->error = 1; + goto err; } - size = buf->size - buf->use - 1; - while (((count = snprintf(&buf->content[buf->use], size, format, - (char *)escaped)) < 0) || (count >= size - 1)) { + /* Grow buffer if necessary and retry */ + if (count >= size) { buf->content[buf->use] = 0; - grow_size = (count > 1000) ? count : 1000; + grow_size = (count + 1 > 1000) ? count + 1 : 1000; if (virBufferGrow(buf, grow_size) < 0) { - VIR_FREE(escaped); - return; + goto err; + } + size = buf->size - buf->use; + + if ((count = snprintf(&buf->content[buf->use], size, + format, (char *)escaped)) < 0) { + buf->error = 1; + goto err; } - size = buf->size - buf->use - 1; } buf->use += count; - buf->content[buf->use] = '\0'; + +err: VIR_FREE(escaped); } diff --git a/tests/.gitignore b/tests/.gitignore index 3f32939..e7c74c5 100644 --- a/tests/.gitignore +++ b/tests/.gitignore @@ -21,6 +21,7 @@ storagepoolxml2xmltest nodeinfotest statstest qparamtest +virbuftest seclabeltest eventtest *.exe diff --git a/tests/Makefile.am b/tests/Makefile.am index 1dc7f66..dd59034 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -73,7 +73,7 @@ EXTRA_DIST = \ qemuhelpdata check_PROGRAMS = virshtest conftest \ - nodeinfotest statstest qparamtest + nodeinfotest statstest qparamtest virbuftest if WITH_XEN check_PROGRAMS += xml2sexprtest sexpr2xmltest \ @@ -151,6 +151,7 @@ TESTS = virshtest \ nodeinfotest \ statstest \ qparamtest \ + virbuftest \ $(test_scripts) if WITH_XEN @@ -352,6 +353,10 @@ qparamtest_SOURCES = \ qparamtest.c testutils.h testutils.c qparamtest_LDADD = $(LDADDS) +virbuftest_SOURCES = \ + virbuftest.c testutils.h testutils.c +virbuftest_LDADD = $(LDADDS) + if WITH_LIBVIRTD eventtest_SOURCES = \ eventtest.c testutils.h testutils.c ../daemon/event.c diff --git a/tests/virbuftest.c b/tests/virbuftest.c new file mode 100644 index 0000000..1cc9410 --- /dev/null +++ b/tests/virbuftest.c @@ -0,0 +1,84 @@ +#include <config.h> + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#include "internal.h" +#include "util.h" +#include "testutils.h" +#include "buf.h" +#include "memory.h" + +#define TEST_ERROR(...) \ + do { \ + if (virTestGetDebug()) \ + fprintf(stderr, __VA_ARGS__); \ + } while (0) + +struct testInfo { + int doEscape; +}; + +static int testBufInfiniteLoop(const void *data ATTRIBUTE_UNUSED) +{ + virBuffer bufinit = VIR_BUFFER_INITIALIZER; + virBufferPtr buf = &bufinit; + char *addstr = NULL, *bufret = NULL; + int ret = -1; + const struct testInfo *info = data; + + virBufferAddChar(buf, 'a'); + if (buf->a != 1002 || buf->b != 1) { + TEST_ERROR("Buf was not expected size, size=%d use=%d\n", + buf->a, buf->b); + goto out; + } + + /* + * Infinite loop triggers if: + * (strlen + 1 > 1000) && (strlen == buf-size - buf-use - 1) + */ + if (virAsprintf(&addstr, "%*s", buf->a - buf->b - 1, "a") < 0) { + goto out; + } + + if (info->doEscape) + virBufferEscapeString(buf, "%s", addstr); + else + virBufferVSprintf(buf, "%s", addstr); + + ret = 0; +out: + bufret = virBufferContentAndReset(buf); + if (!bufret) { + TEST_ERROR("Buffer had error set"); + ret = -1; + } + + VIR_FREE(addstr); + VIR_FREE(bufret); + return ret; +} + +static int +mymain(int argc ATTRIBUTE_UNUSED, + char **argv ATTRIBUTE_UNUSED) +{ + int ret = 0; + + +# define DO_TEST(msg, cb, data) \ + do { \ + struct testInfo info = { data }; \ + if (virtTestRun("Buf: " msg, 1, cb, &info) < 0) \ + ret = -1; \ + } while (0) + + DO_TEST("EscapeString infinite loop", testBufInfiniteLoop, 1); + DO_TEST("VSprintf infinite loop", testBufInfiniteLoop, 0); + + return(ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); +} + +VIRT_TEST_MAIN(mymain) -- 1.7.2.1

2 2

[libvirt] [PATCH] fix path to xen device statistics for newer kernels
by Guido Günther 10 Sep '10

10 Sep '10

Hi, it seems Xen changed the paths to the block device statistics in sysfs: from "/sys/devices/xen-backend/vbd-%d-%d/statistics/%s" to "/sys/bus/xen-backend/devices/vbd-%d-%d/statistics/%s": http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596004 Attached patch fixes this. O.k. to apply? -- Guido

3 2

[libvirt] [PATCH] virsh: Option for overriding disk type in attach-disk
by Jiri Denemark 10 Sep '10

10 Sep '10

Unless --driver tap|file option was given to attach-disk, virsh would generate <disk type='block'> XML which might be fine for Xen but not for other hypervisors. This patch introduces a new option --sourcetype which can be used to explicitly set the type of disk source. The option accepts either "file" or "block" types. --- tools/virsh.c | 12 ++++++++++-- 1 files changed, 10 insertions(+), 2 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 7bc33d8..57ea618 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -8116,6 +8116,7 @@ static const vshCmdOptDef opts_attach_disk[] = { {"type", VSH_OT_STRING, 0, N_("target device type")}, {"mode", VSH_OT_STRING, 0, N_("mode of device reading and writing")}, {"persistent", VSH_OT_BOOL, 0, N_("persist disk attachment")}, + {"sourcetype", VSH_OT_STRING, 0, N_("type of source (block|file)")}, {NULL, 0, 0, NULL} }; @@ -8127,6 +8128,7 @@ cmdAttachDisk(vshControl *ctl, const vshCmd *cmd) int isFile = 0, ret = FALSE; char *buf = NULL, *tmp = NULL; unsigned int flags; + char *stype; if (!vshConnectionUsability(ctl, ctl->conn)) goto cleanup; @@ -8144,10 +8146,16 @@ cmdAttachDisk(vshControl *ctl, const vshCmd *cmd) subdriver = vshCommandOptString(cmd, "subdriver", NULL); type = vshCommandOptString(cmd, "type", NULL); mode = vshCommandOptString(cmd, "mode", NULL); + stype = vshCommandOptString(cmd, "sourcetype", NULL); - if (driver) { - if (STREQ(driver, "file") || STREQ(driver, "tap")) + if (!stype) { + if (driver && (STREQ(driver, "file") || STREQ(driver, "tap"))) isFile = 1; + } else if (STREQ(stype, "file")) { + isFile = 1; + } else if (STRNEQ(stype, "block")) { + vshError(ctl, _("Unknown source type: '%s'"), stype); + goto cleanup; } if (mode) { -- 1.7.2.2

3 3

[libvirt] [PATCH] bridge: Fix static-only DHCP configuration
by Jiri Denemark 10 Sep '10

10 Sep '10

For static-only DHCP, i.e. with no <range> but at least one <host> element within <dhcp> element, we have to add "--dhcp-range IP,static" option to dnsmasq to actually enable the service. Without this option, dnsmasq will not respond to DHCP requests. --- src/network/bridge_driver.c | 26 +++++++++++++++++++++++--- 1 files changed, 23 insertions(+), 3 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index d6d3068..01d2171 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -394,6 +394,16 @@ networkBuildDnsmasqArgv(virNetworkObjPtr network, int nbleases = 0; char *pidfileArg; char buf[1024]; + unsigned int ranges; + + /* + * For static-only DHCP, i.e. with no range but at least one host element, + * we have to add a special --dhcp-range option to enable the service in + * dnsmasq. + */ + ranges = network->def->nranges; + if (!ranges && network->def->nhosts) + ranges = 1; /* * NB, be careful about syntax for dnsmasq options in long format @@ -424,11 +434,11 @@ networkBuildDnsmasqArgv(virNetworkObjPtr network, /*2 + *//* --interface virbr0 */ 2 + /* --except-interface lo */ 2 + /* --listen-address 10.0.0.1 */ - (2 * network->def->nranges) + /* --dhcp-range 10.0.0.2,10.0.0.254 */ + (2 * ranges) + /* --dhcp-range 10.0.0.2,10.0.0.254 */ /* --dhcp-lease-max=xxx if needed */ (network->def->nranges ? 1 : 0) + /* --dhcp-no-override if needed */ - (network->def->nranges ? 1 : 0) + + (ranges ? 1 : 0) + /* --dhcp-hostsfile=/var/lib/dnsmasq/$NAME.hostsfile */ (network->def->nhosts > 0 ? 1 : 0) + /* --enable-tftp --tftp-root /srv/tftp */ @@ -496,12 +506,22 @@ networkBuildDnsmasqArgv(virNetworkObjPtr network, nbleases += network->def->ranges[r].size; } + if (!network->def->nranges && network->def->nhosts) { + snprintf(buf, sizeof(buf), "%s,static", + network->def->ipAddress); + + APPEND_ARG(*argv, i++, "--dhcp-range"); + APPEND_ARG(*argv, i++, buf); + } + if (network->def->nranges > 0) { snprintf(buf, sizeof(buf), "--dhcp-lease-max=%d", nbleases); APPEND_ARG(*argv, i++, buf); - APPEND_ARG(*argv, i++, "--dhcp-no-override"); } + if (ranges) + APPEND_ARG(*argv, i++, "--dhcp-no-override"); + if (network->def->nhosts > 0) { dnsmasqContext *dctx = dnsmasqContextNew(network->def->name, DNSMASQ_STATE_DIR); char *hostsfileArg; -- 1.7.2.2

2 2

[libvirt] kqemu
by Zvi Dubitzky 10 Sep '10

10 Sep '10

Hi I could not get an answer from the users list . Maybe here someone can give some advice . we have a Linux 64 bit system with qemu 0.9.1-10 ( uname -a = 2.6.26-2-amd64) installed . kvm is included and loaded to memory . Still when we create a VM we sometimes get the following error message: libvir: QEMU error : internal error unable to start guest: You do not have enough space in '/dev/shm' for the 499 MB of QEMU virtual RAM. To have more space available provided you have enough RAM and swap, do as root: mount -o remount,size=515m /dev/shm Or disable the accelerator module with -no-kqemu After we do the mount (as advised) we can create the VM . Does the error mean that kvm is not active ? It seems that kqemu is an old way to do the duties of kvm e.g supply memory to VMs via /dev/shm . Is there a way to avoid that error ? I guess the -no-kqemu should be to qemu but we do not have control over the invokation of qemu by libvirt. thanks Zvi Dubitzky Email:dubi@il.ibm.com

1 0

[libvirt] QEMU json related fixes
by Luiz Capitulino 10 Sep '10

10 Sep '10

Found these problems while running libvirt-tck with up to date libvirt and qemu.git. Details in the patches. Thanks.

2 3

[libvirt] [PATCH] Add nwfilter support to UML driver
by Soren Hansen 09 Sep '10

09 Sep '10

Extend user-mode-linux driver to support nwfilter. Signed-off-by: Soren Hansen <soren(a)linux2go.dk> --- src/uml/uml_conf.c | 16 +++++++++++++--- src/uml/uml_driver.c | 8 +++++++- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/src/uml/uml_conf.c b/src/uml/uml_conf.c index 4906192..f2eaef5 100644 --- a/src/uml/uml_conf.c +++ b/src/uml/uml_conf.c @@ -46,6 +46,7 @@ #include "verify.h" #include "bridge.h" #include "logging.h" +#include "domain_nwfilter.h" #define VIR_FROM_THIS VIR_FROM_UML @@ -108,7 +109,8 @@ virCapsPtr umlCapsInit(void) { static int -umlConnectTapDevice(virDomainNetDefPtr net, +umlConnectTapDevice(virConnectPtr conn, + virDomainNetDefPtr net, const char *bridge) { brControl *brctl = NULL; @@ -164,6 +166,14 @@ umlConnectTapDevice(virDomainNetDefPtr net, goto error; } + if (net->filter) { + if (virDomainConfNWFilterInstantiate(conn, net)) { + if (template_ifname) + VIR_FREE(net->ifname); + goto error; + } + } + brShutdown(brctl); return 0; @@ -239,7 +249,7 @@ umlBuildCommandLineNet(virConnectPtr conn, goto error; } - if (umlConnectTapDevice(def, bridge) < 0) { + if (umlConnectTapDevice(conn, def, bridge) < 0) { VIR_FREE(bridge); goto error; } @@ -250,7 +260,7 @@ umlBuildCommandLineNet(virConnectPtr conn, } case VIR_DOMAIN_NET_TYPE_BRIDGE: - if (umlConnectTapDevice(def, def->data.bridge.brname) < 0) + if (umlConnectTapDevice(conn, def, def->data.bridge.brname) < 0) goto error; /* ethNNN=tuntap,tapname,macaddr,gateway */ diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index 0a5c829..40345d5 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -58,6 +58,7 @@ #include "domain_conf.h" #include "datatypes.h" #include "logging.h" +#include "domain_nwfilter.h" #define VIR_FROM_THIS VIR_FROM_UML @@ -876,6 +877,7 @@ static int umlStartVMDaemon(virConnectPtr conn, if (umlBuildCommandLine(conn, driver, vm, &keepfd, &argv, &progenv) < 0) { close(logfd); + virDomainConfVMNWFilterTeardown(vm); umlCleanupTapDevices(conn, vm); return -1; } @@ -928,8 +930,11 @@ static int umlStartVMDaemon(virConnectPtr conn, VIR_FREE(progenv[i]); VIR_FREE(progenv); - if (ret < 0) + if (ret < 0) { + virDomainConfVMNWFilterTeardown(vm); umlCleanupTapDevices(conn, vm); + } + /* NB we don't mark it running here - we do that async with inotify */ @@ -965,6 +970,7 @@ static void umlShutdownVMDaemon(virConnectPtr conn ATTRIBUTE_UNUSED, vm->def->id = -1; vm->state = VIR_DOMAIN_SHUTOFF; + virDomainConfVMNWFilterTeardown(vm); umlCleanupTapDevices(conn, vm); if (vm->newDef) { -- 1.7.1

4 4

[libvirt] [PATCH] test: Don't overwrite storage volume target path and key
by Matthias Bolte 09 Sep '10

09 Sep '10

Only generate target path and key when they are not defined in the XML config. --- src/test/test_driver.c | 20 ++++++++++++-------- 1 files changed, 12 insertions(+), 8 deletions(-) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index 6c06cbc..9d22339 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -706,17 +706,21 @@ static int testOpenVolumesForPool(xmlDocPtr xml, goto error; } - if (virAsprintf(&def->target.path, "%s/%s", - pool->def->target.path, - def->name) == -1) { - virReportOOMError(); - goto error; + if (def->target.path == NULL) { + if (virAsprintf(&def->target.path, "%s/%s", + pool->def->target.path, + def->name) == -1) { + virReportOOMError(); + goto error; + } } - def->key = strdup(def->target.path); if (def->key == NULL) { - virReportOOMError(); - goto error; + def->key = strdup(def->target.path); + if (def->key == NULL) { + virReportOOMError(); + goto error; + } } pool->def->allocation += def->allocation; -- 1.7.0.4

2 2

[libvirt] [PATCH] Remove static binaries hack for DV environment
by Daniel Veillard 09 Sep '10

09 Sep '10

An old leftover from the early days, and it's getting into the way now. Trivial, and uncontroversial as this should not affect anybody else and clean this up, so I pushed this, Daniel diff --git a/configure.ac b/configure.ac index 6c0fc69..a71f5e8 100644 --- a/configure.ac +++ b/configure.ac @@ -237,13 +237,10 @@ AC_ARG_WITH([libvirtd], AC_HELP_STRING([--with-libvirtd], [add libvirtd support @<:@default=yes@:>@]),[],[with_libvirtd=yes]) dnl -dnl specific tests to setup DV devel environments with debug etc ... +dnl in case someone want to build static binaries +dnl STATIC_BINARIES="-static" dnl -if test "${LOGNAME}" = "veillard" && test "`pwd`" = "/u/veillard/libvirt" ; then - STATIC_BINARIES="-static" -else - STATIC_BINARIES= -fi +STATIC_BINARIES= AC_SUBST([STATIC_BINARIES]) dnl --enable-debug=(yes|no) -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] SVG sources for the libvirt wiki images is online
by Justin Clift 09 Sep '10

09 Sep '10

Hi all, The SVG sources for the images used in the libvirt wiki docs are online: http://wiki.libvirt.org/page/SVGImages That's a browsable list, still fairly disorganised (!), but contains a visual list of the images on the wiki so far, with the link to their SVG source. They're all licensed under the Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"): http://creativecommons.org/licenses/by-sa/3.0/ Feel welcome to use them in your wiki's, improve them, and so on. Updates, ideas, and contributions welcome too of course. :) Regards and best wishes, Justin Clift

2 2

[libvirt] [PATCH v2] buf: Fix possible infinite loop in EscapeString, VSnprintf
by Cole Robinson 09 Sep '10

09 Sep '10

The current code will go into an infinite loop if the printf generated string is >= 1000, AND exactly 1 character smaller than the amount of free space in the buffer. When this happens, we are dropped into the loop body, but nothing will actually change, because count == (buf->size - buf->use - 1), and virBufferGrow returns unchanged if count < (buf->size - buf->use) Fix this by removing the '- 1' bit from 'size'. The *nprintf functions handle the NULL byte for us anyways, so we shouldn't need to manually accomodate for it. Here's a bug where we are actually hitting this issue: https://bugzilla.redhat.com/show_bug.cgi?id=602772 v2: Eric's improvements: while -> if (), remove extra va_list variable, make sure we report buffer error if snprintf fails Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/util/buf.c | 70 ++++++++++++++++++++++++++++++++++++------------------- 1 files changed, 46 insertions(+), 24 deletions(-) diff --git a/src/util/buf.c b/src/util/buf.c index fc1217b..553e2a0 100644 --- a/src/util/buf.c +++ b/src/util/buf.c @@ -224,7 +224,7 @@ void virBufferVSprintf(const virBufferPtr buf, const char *format, ...) { int size, count, grow_size; - va_list locarg, argptr; + va_list argptr; if ((format == NULL) || (buf == NULL)) return; @@ -236,27 +236,38 @@ virBufferVSprintf(const virBufferPtr buf, const char *format, ...) virBufferGrow(buf, 100) < 0) return; - size = buf->size - buf->use - 1; va_start(argptr, format); - va_copy(locarg, argptr); - while (((count = vsnprintf(&buf->content[buf->use], size, format, - locarg)) < 0) || (count >= size - 1)) { + + size = buf->size - buf->use; + if ((count = vsnprintf(&buf->content[buf->use], + size, format, argptr)) < 0) { + buf->error = 1; + goto err; + } + + /* Grow buffer if necessary and retry */ + if (count >= size) { buf->content[buf->use] = 0; - va_end(locarg); + va_end(argptr); + va_start(argptr, format); - grow_size = (count > 1000) ? count : 1000; + grow_size = (count + 1 > 1000) ? count + 1 : 1000; if (virBufferGrow(buf, grow_size) < 0) { - va_end(argptr); - return; + goto err; } - size = buf->size - buf->use - 1; - va_copy(locarg, argptr); + size = buf->size - buf->use; + if ((count = vsnprintf(&buf->content[buf->use], + size, format, argptr)) < 0) { + buf->error = 1; + goto err; + } } - va_end(argptr); - va_end(locarg); buf->use += count; - buf->content[buf->use] = '\0'; + +err: + va_end(argptr); + return; } /** @@ -336,23 +347,34 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st if ((buf->use >= buf->size) && virBufferGrow(buf, 100) < 0) { - VIR_FREE(escaped); - return; + goto err; + } + + size = buf->size - buf->use; + if ((count = snprintf(&buf->content[buf->use], size, + format, (char *)escaped)) < 0) { + buf->error = 1; + goto err; } - size = buf->size - buf->use - 1; - while (((count = snprintf(&buf->content[buf->use], size, format, - (char *)escaped)) < 0) || (count >= size - 1)) { + /* Grow buffer if necessary and retry */ + if (count >= size) { buf->content[buf->use] = 0; - grow_size = (count > 1000) ? count : 1000; + grow_size = (count + 1 > 1000) ? count + 1 : 1000; if (virBufferGrow(buf, grow_size) < 0) { - VIR_FREE(escaped); - return; + goto err; + } + size = buf->size - buf->use; + + if ((count = snprintf(&buf->content[buf->use], size, + format, (char *)escaped)) < 0) { + buf->error = 1; + goto err; } - size = buf->size - buf->use - 1; } buf->use += count; - buf->content[buf->use] = '\0'; + +err: VIR_FREE(escaped); } -- 1.7.2.1

3 4

[libvirt] [PATCH v2] [TCK] [REPOST] nwfilter: apply filters and check firewall rules
by Stefan Berger 09 Sep '10

09 Sep '10

Any comments regarding this patch? V2: - Following Daniel Berrange's suggestions - if LIBVIRT_TCK_CONFIG is set, read the last occurrence of "^uri/s=" and assign the value to LIBVIRT_URI - check that LIBVIRT_URI is set to qemu:///system, otherwise skip test - if allowed, remove all VMs and nwfilters starting with tck- - rename all VMs and nwfilters created by this test program to start with 'tck-' - other: - terminate if sourcing the test-lib.sh from libvirt's tests dir is missing (would need to be copied) - redirect stderr to stdout whereever output is read into a variable This is a patch I previously posted for use in the tests/ directory of libvirt. Now I ported it to the TCK project and extended the script with output in the Test Anything Protocol (TAP) format. It now allows multiple output formats chosen via command line parameter supporting TAP (--tap-test), the output format used in the libvirt tests directory (the '.' and '!') (--libvirt-test) and one where all tests are displayed (--verbose). The program basically creates a filter called tck-testcase and two VMs where one of them references the tck-testcase filter and the other a filter called nwfiltertestfilter. The tck-testcase filter is then subsequently modified and the effect on iptables,ebtables and ip6tables verified against expected output for both VMs. The VMs are torn down at the end and the test filters removed. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- scripts/nwfilter/100-apply-verify.t | 10 scripts/nwfilter/nwfilter2vmtest.sh | 635 ++++++++++ scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall | 32 scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall | 30 scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall | 9 scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall | 24 scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall | 68 + scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall | 12 scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 19 scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall | 13 scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall | 12 scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall | 9 scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat | 73 + scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall | 26 scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/all-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml | 33 scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml | 12 scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml | 56 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml | 15 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml | 34 scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml | 43 scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml | 23 scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml | 33 scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml | 4 scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml | 18 61 files changed, 2059 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh @@ -0,0 +1,635 @@ +#!/bin/bash + +ORIG_IFNAME="vnet0" +ATTACH_IFNAME="attach0" +TESTFILTERNAME="nwfiltertestfilter" +TESTVM2FWALLDATA="nwfilterxml2fwallout/testvm.fwall.dat" + + +LIBVIRTD=`type -P ${PWD}/../daemon/libvirtd` +if [ "x${LIBVIRTD}x" == "xx" ]; then + LIBVIRTD=`type -P libvirtd` +fi + +VIRSH=`type -P ${PWD}/../tools/virsh` +if [ "x${VIRSH}x" == "xx" ]; then + VIRSH=`type -P virsh` +fi + +LD_LIBRARY_PATH="${PWD}../src/.libs/" + +uri="qemu:///system" +if [ "x${LIBVIRT_TCK_CONFIG}x" != "xx" ]; then + uri_exp=`cat ${LIBVIRT_TCK_CONFIG} | grep "^uri\s*=" | tail -n 1` + if [ "x${uri_exp}x" != "xx" ]; then + eval ${uri_exp} + fi +fi +LIBVIRT_URI=${uri} + +# Maybe no libvirtd was built +[ -z ${LIBVIRTD} ] && exit 0; + +FLAG_WAIT="$((1<<0))" +FLAG_ATTACH="$((1<<1))" +FLAG_VERBOSE="$((1<<2))" +FLAG_LIBVIRT_TEST="$((1<<3))" +FLAG_TAP_TEST="$((1<<4))" + +failctr=0 +passctr=0 +attachfailctr=0 +attachctr=0 + +TAP_FAIL_LIST="" +TAP_FAIL_CTR=0 +TAP_TOT_CTR=0 + +function usage() { + local cmd="$0" +cat <<EOF +Usage: ${cmd} [--help|-h|-?] [--noattach] [--wait] [--verbose] + [--libvirt-test] [--tap-test] + +Options: + --help,-h,-? : Display this help screen. + --noattach : Skip tests that attach and detach a network interface + --wait : Wait for the user to press the enter key once an error + was detected + --verbose : Verbose output + --libvirt-test : Use the libvirt test output format + --tap-test : TAP format output + +This test will create two virtual machines. The one virtual machine +will use a filter called '${TESTFILTERNAME}', and reference the filter +'clean-traffic' which should be available by default with every install. +The other virtual machine will reference the filter 'tck-testcase' and will +have its filter permanently updated. +EOF +} + + +function tap_fail() { + echo "not ok $1 - ${2:0:66}" + TAP_FAIL_LIST+="$1 " + ((TAP_FAIL_CTR++)) + ((TAP_TOT_CTR++)) +} + +function tap_pass() { + echo "ok $1 - ${2:0:70}" + ((TAP_TOT_CTR++)) +} + +function tap_final() { + local okay + + [ -n "${TAP_FAIL_LIST}" ] && echo "FAILED tests ${TAP_FAIL_LIST}" + + okay=`echo "($TAP_TOT_CTR-$TAP_FAIL_CTR)*100/$TAP_TOT_CTR" | bc -l` + echo "Failed ${TAP_FAIL_CTR}/${TAP_TOT_CTR} tests, ${okay:0:5}% okay" +} + +# A wrapper for mktemp in case it does not exist +# Echos the name of a temporary file. +function mktmpfile() { + local tmp + type -P mktemp > /dev/null + if [ $? -eq 0 ]; then + tmp=$(mktemp -t nwfvmtest.XXXXXX) + echo ${tmp} + else + while :; do + tmp="/tmp/nwfvmtest.${RANDOM}" + if [ ! -f ${tmp} ]; then + touch ${tmp} + chmod 666 ${tmp} + echo ${tmp} + break + fi + done + fi + return 0 +} + + +function checkExpectedOutput() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local flags="$4" + local skipregex="$5" + local regex="s/${ORIG_IFNAME}/${ifname}/g" + local cmd line tmpfile tmpfile2 skip + + tmpfile=`mktmpfile` + tmpfile2=`mktmpfile` + + exec 4<${fwallfile} + + read <&4 + line="${REPLY}" + + while [ "x${line}x" != "xx" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + skip=0 + if [ "x${skipregex}x" != "xx" ]; then + skip=`echo ${cmd} | grep -c -E ${skipregex}` + fi + + eval ${cmd} 2>&1 | tee ${tmpfile} 1>/dev/null + + rm ${tmpfile2} 2>/dev/null + touch ${tmpfile2} + + while [ 1 ]; do + read <&4 + line="${REPLY}" + + if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then + + if [ ${skip} -ne 0 ]; then + break + fi + + diff ${tmpfile} ${tmpfile2} >/dev/null + + if [ $? -ne 0 ]; then + if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + fi + ((failctr++)) + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "tmp files: $tmpfile, $tmpfile2" + echo "Press enter" + read + fi + [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \ + test_result $((passctr+failctr)) "" 1 + [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \ + tap_fail $((passctr+failctr)) "${xmlfile} : ${cmd}" + else + ((passctr++)) + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && \ + echo "PASS ${xmlfile} : ${cmd}" + [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \ + test_result $((passctr+failctr)) "" 0 + [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \ + tap_pass $((passctr+failctr)) "${xmlfile} : ${cmd}" + fi + + break + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 4>&- + + rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local vm1name="$3" + local vm2name="$4" + local flags="$5" + local testnum="$6" + local linenums ctr=0 + local tmpfile b msg rc + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${vm1name}" "${flags}" \ + "" + + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" "" + + if [ $((flags & FLAG_ATTACH)) -ne 0 ]; then + + tmpfile=`mktmpfile` + + b=`{ ${VIRSH} dumpxml ${vm1name} | tr -d "\n"; echo; } | \ + sed "s/.*\<interface.*source bridge='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + cat >>${tmpfile} <<EOF +<interface type='bridge'> + <source bridge='${b}'/> + <mac address='52:54:00:11:22:33'/> + <target dev='${ATTACH_IFNAME}'/> + <filterref filter='tck-testcase'/> +</interface> +EOF + msg=`${VIRSH} attach-device "${vm1name}" "${tmpfile}" > /dev/null` + rc=$? + + ((attachctr++)) + + if [ $rc -eq 0 ]; then + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \ + "${flags}" "(PRE|POST)ROUTING" + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" "(PRE|POST)ROUTING" + msg=`${VIRSH} detach-device "${vm1name}" "${tmpfile}"` + if [ $? -ne 0 ]; then + echo "FAIL: Detach of interface failed." + fi + else + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + # In case of TAP, run the test anyway so we get to the full number + # of tests + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \ + "${flags}" "" #"(PRE|POST)ROUTING" + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" #"(PRE|POST)ROUTING" + fi + + ((attachfailctr++)) + if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then + echo "FAIL: Could not attach interface to vm ${vm1name}." + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter" + read + fi + fi + fi + + rm -rf ${tmpfile} + fi + + return 0 +} + + +function runTests() { + local vm1name="$1" + local vm2name="$2" + local xmldir="$3" + local fwalldir="$4" + local flags="$5" + local fwallfiles f c + local tap_total=0 ctr=0 + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + # Need to count the number of total tests + for fil in ${fwallfiles}; do + c=$(grep -c "^#" ${fwalldir}/${fil}) + ((tap_total+=c)) + ((ctr++)) + done + c=$(grep -c "^#" "${TESTVM2FWALLDATA}") + ((tap_total+=c*ctr)) + [ $((flags & FLAG_ATTACH)) -ne 0 ] && ((tap_total*=2)) + echo "1..${tap_total}" + fi + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${vm1name}" \ + "${vm2name}" "${flags}" + done + + if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then + test_final $((passctr+failctr)) $failctr + elif [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + tap_final + else + echo "" + echo "Summary: ${failctr} failures, ${passctr} passes," + if [ ${attachctr} -ne 0 ]; then + echo " ${attachfailctr} interface attachment failures with ${attachctr} attempts" + fi + fi +} + + +function createVM() { + local vmname="$1" + local filtername="$2" + local ipaddr="$3" + local macaddr="$4" + local flags="$5" + local res + local tmpfile='mktmpfile' + + cat > ${tmpfile} << EOF + <domain type='kvm'> + <name>${vmname}</name> + <memory>32768</memory> + <currentMemory>32768</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='x86_64' machine='pc-0.11'>hvm</type> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-kvm</emulator> + <interface type='bridge'> + <mac address='${macaddr}'/> + <source bridge='virbr0'/> + <filterref filter='${filtername}'> + <parameter name='IP' value='${ipaddr}'/> + </filterref> + <target dev='${vmname}'/> + </interface> + <console type='pty'> + </console> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + </devices> + </domain> +EOF + + res=$(${VIRSH} define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define VM ${vmname} : ${res}" + return 1 + fi + + res=$(${VIRSH} start ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not start VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + $(${VIRSH} undefine ${vmname}) + return 1 + fi + + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Created VM ${vmname}." + + rm -rf ${tmpfile} + + return 0 +} + + +function destroyVM() { + local vmname="$1" + local flags="$2" + local res + + res=$(${VIRSH} destroy ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not destroy VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + + res=$(${VIRSH} undefine ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not undefine VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Destroyed VM ${vmname}." + + return 0 +} + + +function createTestFilters() { + local flags="$1" + local tmpfile=`mktmpfile` + local res + + cat >${tmpfile} << EOF +<filter name="${TESTFILTERNAME}"> + <filterref filter='clean-traffic'/> + + <rule action='drop' direction='inout' priority='1000'> + <all/> + </rule> + + <rule action='drop' direction='inout' priority='1000'> + <all-ipv6/> + </rule> +</filter> +EOF + res=$(${VIRSH} nwfilter-define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + rm -rf ${tmpfile} + return 1 + fi + + cat >${tmpfile} << EOF +<filter name="tck-testcase"> +</filter> +EOF + res=$(${VIRSH} nwfilter-define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + rm -rf ${tmpfile} + return 1 + fi + + rm -rf ${tmpfile} + + return 0 +} + + +function deleteTestFilter() { + local flags="$1" + local res + + res=$(${VIRSH} nwfilter-undefine ${TESTFILTERNAME} 2>&1) + if [ $? -ne 0 ]; then + echo "Could not undefine filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + res=$(${VIRSH} nwfilter-undefine tck-testcase 2>&1) + if [ $? -ne 0 ]; then + echo "Could not undefine filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + return 0 +} + + +function main() { + local prgname="$0" + local vm1 vm2 + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms res + local filtername="tck-testcase" + local libvirtdpid=-1 + local flags OPWD + + ((flags=${FLAG_ATTACH})) + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --noattach) ((flags ^= FLAG_ATTACH ));; + --wait) ((flags |= FLAG_WAIT ));; + --verbose) ((flags |= FLAG_VERBOSE ));; + --libvirt-test) ((flags |= FLAG_LIBVIRT_TEST ));; + --tap-test) ((flags |= FLAG_TAP_TEST ));; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + if [ `uname` != "Linux" ]; then + echo "This script will only run on Linux." + exit 1; + fi + + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + if [ "${LIBVIRT_URI}" != "qemu:///system" ]; then + echo "1..0 # Skipped: Only valid for Qemu system driver" + exit 0 + fi + + for name in `virsh nwfilter-list | awk '{print $2}'` + do + case ${name} in + tck*) + if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then + res=$(virsh nwfilter-undefine ${name} 2>&1) + if [ $? -ne 0 ]; then + echo "Bail out! Could not undefine nwfiler ${name}: ${res}" + exit 0 + fi + else + echo "Bail out! Filter ${name} already exists, use --force to clean" + exit 1 + fi + esac + done + + for name in `virsh nwfilter-list | awk '{print $2}'` + do + case ${name} in + tck*) + if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then + res=$(virsh undefine ${name} 2>&1) + if [ $? -ne 0 ]; then + echo "Bail out! Could not undefine domain ${name}: ${res}" + exit 1 + fi + else + echo "Bail out! Domain ${name} already exists, use --force to clean" + exit 1 + fi + esac + done + fi + + if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then + pushd ${PWD} > /dev/null + . test-lib.sh + if [ $? -ne 0 ]; then + exit 1 + fi + test_intro $this_test + popd > /dev/null + fi + + res=$(${VIRSH} capabilities 2>&1) + + if [ $? -ne 0 ]; then + if [ "x${LIBVIRTD}x" == "xx" ]; then + echo "Cannot find libvirtd. Exiting." + exit 1 + fi + + rm -rf pid-file 2>/dev/null + ${LIBVIRTD} --pid-file=pid-file 2>/dev/null 1>/dev/null & + libvirtdpid=$! + sleep 2 + + res=$(${VIRSH} capabilities 2>&1) + if [ $? -ne 0 ]; then + echo "Could not start the libvirt daemon : $res" + echo "Exiting." + exit 1 + fi + fi + + vm1="tck-testvm${RANDOM}" + vm2="tck-testvm${RANDOM}" + + createTestFilters "${flags}" + if [ $? -ne 0 ]; then + exit 1; + fi + + createVM "${vm1}" "tck-testcase" "10.2.2.2" "52:54:0:0:0:1" "${flags}" + if [ $? -ne 0 ]; then + echo "Could not create VM ${vm1}. Exiting." + exit 1 + fi + + createVM "${vm2}" "${TESTFILTERNAME}" "10.1.1.1" "52:54:0:9f:33:da" \ + "${flags}" + if [ $? -ne 0 ]; then + echo "Could not create VM ${vm2}. Exiting." + destroyVM "${vm1}" "${flags}" + exit 1 + fi + + runTests "${vm1}" "${vm2}" "${xmldir}" "${fwalldir}" "${flags}" + + destroyVM "${vm1}" "${flags}" + destroyVM "${vm2}" "${flags}" + deleteTestFilter "${flags}" + + [ ${libvirtdpid} -ge 0 ] && kill -9 ${libvirtdpid} + rm -rf pid-file 2>/dev/null + + return 0 +} + +main "$@" Index: libvirt-tck/scripts/nwfilter/100-apply-verify.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/100-apply-verify.t @@ -0,0 +1,10 @@ +#!/bin/bash + +pwd=$(dirname $0) + +pushd ${PWD} > /dev/null + +cd ${pwd} +bash ./nwfilter2vmtest.sh --tap-test --noattach + +popd > /dev/null \ No newline at end of file Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml @@ -0,0 +1,33 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='12' + protocoltype='34' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='1' hwtype='255' protocoltype='255'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='11' hwtype='256' protocoltype='256'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65535' hwtype='65535' protocoltype='65535' /> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65536' hwtype='65536' protocoltype='65536' /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat @@ -0,0 +1,73 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -j I-vnet0-ipv4 +-p ARP -j I-vnet0-arp +-p 0x8035 -j I-vnet0-rarp +-p 0x835 -j ACCEPT +-j DROP +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -j O-vnet0-ipv4 +-p ARP -j O-vnet0-arp +-p 0x8035 -j O-vnet0-rarp +-j DROP +#ebtables -t nat -L I-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$" +-s ! 52:54:0:9f:33:da -j DROP +-p IPv4 --ip-src ! 10.1.1.1 -j DROP +#ebtables -t nat -L O-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$" +-j ACCEPT +#ebtables -t nat -L I-vnet0-arp | grep -v "^Bridge" | grep -v "^$" +-s ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-mac-src ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-ip-src ! 10.1.1.1 -j DROP +-p ARP --arp-op Request -j ACCEPT +-p ARP --arp-op Reply -j ACCEPT +-j DROP +#ebtables -t nat -L O-vnet0-arp | grep -v "^Bridge" | grep -v "^$" +-p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-ip-dst ! 10.1.1.1 -j DROP +-p ARP --arp-op Request -j ACCEPT +-p ARP --arp-op Reply -j ACCEPT +-j DROP +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ah srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <ah srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <ah srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml @@ -0,0 +1,12 @@ +<filter name='tck-testcase' chain='root'> + <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid> + <rule action='drop' direction='out' priority='500'> + <icmp connlimit-above='1'/> + </rule> + <rule action='drop' direction='out' priority='500'> + <tcp connlimit-above='2'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <all/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <esp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <esp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <esp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml @@ -0,0 +1,56 @@ +<filter name='tck-testcase'> + <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid> + + <rule action='accept' direction='in'> + <mac protocolid='0x1234'/> + </rule> + + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='0x123' srcportend='0x234' + dstportstart='0x3456' dstportend='0x4567' + dscp='0x32'/> + </rule> + + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='tcp' + srcportstart='0x111' srcportend='400' + dstportstart='0x3333' dstportend='65535'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='0x12' + protocoltype='0x56' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='0x22' + srcportstart='0x123' srcportend='400' + dstportstart='0x234' dstportend='0x444'/> + </rule> + + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='0x40' + srcportstart='0x20' srcportend='0x21' + dstportstart='0x100' dstportend='0x1111'/> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='tck-testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='tck-testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='tck-testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <icmp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2' type='12' code='11'/> + </rule> + <rule action='accept' direction='in'> + <icmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' type='255' code='255'/> + </rule> + <rule action='accept' direction='in'> + <icmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' type='256' code='256'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2' type='12' code='11'/> + </rule> + <rule action='accept' direction='in'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' type='255' code='255'/> + </rule> + <rule action='accept' direction='in'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33' type='256' code='256'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <igmp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <igmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <igmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml @@ -0,0 +1,34 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='out'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.128.0' + dstipaddr='10.1.2.3' dstipmask='255.255.255.0' + protocol='17' dscp='63' + /> + </rule> + + <rule action='accept' direction='in'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.254' + dstipaddr='10.1.2.3' dstipmask='255.255.255.128' + protocol='255' dscp='64' + /> + </rule> + + <rule action='accept' direction='inout'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.127' + dstipaddr='10.1.2.3' dstipmask='255.255.255.254' + protocol='256' dscp='64' + /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml @@ -0,0 +1,43 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='udp' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='6' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='6' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='18' + /> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml @@ -0,0 +1,23 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='ipv4'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='1536'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='15'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='65535'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml @@ -0,0 +1,33 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='rarp' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='12' + protocoltype='34' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='1' hwtype='255' protocoltype='255'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='11' hwtype='256' protocoltype='256'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65535' hwtype='65535' protocoltype='65535' /> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65536' hwtype='65536' protocoltype='65536' /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase'> + <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid> + <filterref filter='clean-traffic'/> + <rule action='accept' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='accept' direction='out'> + <tcp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='out'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml @@ -0,0 +1,4 @@ +<filter name='tck-testcase'> + <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid> + <filterref filter='clean-traffic'/> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <sctp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <sctp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <sctp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in' statematch='false'> + <tcp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in' statematch='0'> + <tcp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <udp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udplite srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udplite srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <udplite srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,32 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L FORWARD --line-number | grep libvirt +1 libvirt-in all anywhere anywhere +2 libvirt-out all anywhere anywhere +3 libvirt-in-post all anywhere anywhere Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,30 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FORWARD --line-number | grep libvirt +1 libvirt-in all -- anywhere anywhere +2 libvirt-out all -- anywhere anywhere +3 libvirt-in-post all -- anywhere anywhere Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall @@ -0,0 +1,24 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1 +DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2 +RETURN all -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1 +DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 |tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall @@ -0,0 +1,68 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-tos 0x32 --ip-proto udp --ip-sport 291:564 --ip-dport 13398:17767 -j ACCEPT +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto tcp --ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 18 --arp-ptype 0x56 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p 0x1234 -j ACCEPT +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 state NEW,ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x22udp spts:564:1092 dpts:291:400 state ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 +#iptables -L libvirt-host-in -n | grep HI-vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep FI-vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::/128 tcp spts:256:4369 dpts:32:33 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::/128 tcp spts:256:4369 dpts:32:33 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 state NEW,ESTABLISHED +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,26 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state NEW,ESTABLISHED +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,13 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 | sed s/0x8035/RARP/g | grep -v "^Bridge" | grep -v "^$" +-p RARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p RARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0

2 1

[libvirt] [PATCH] Documentation on www.libvirt.org about using PolicyKit authentication for libvirt is out of date
by Patrick Dignan 08 Sep '10

08 Sep '10

Hi all, I've created a patch for the bug here: https://bugzilla.redhat.com/show_bug.cgi?id=610822 It is attached to this message. The patch updates the docs to have more up-to-date information about how to use PolicyKit with libvirt Best, Patrick Dignan

2 1

[libvirt] [PATCH] esx: Use SessionIsActive when available
by Matthias Bolte 08 Sep '10

08 Sep '10

--- src/esx/esx_vi.c | 122 +++++++++++++++++++++++++++--------------------------- src/esx/esx_vi.h | 1 + 2 files changed, 62 insertions(+), 61 deletions(-) diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 78cfdfd..d361f01 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -464,6 +464,10 @@ esxVI_Context_Connect(esxVI_Context *ctx, const char *url, ctx->hasQueryVirtualDiskUuid = true; } + if (ctx->productVersion & esxVI_ProductVersion_VPX) { + ctx->hasSessionIsActive = true; + } + if (esxVI_Login(ctx, username, password, NULL, &ctx->session) < 0 || esxVI_BuildSelectSetCollection(ctx) < 0) { return -1; @@ -1452,6 +1456,7 @@ esxVI_BuildSelectSet(esxVI_SelectionSpec **selectSet, } + int esxVI_BuildSelectSetCollection(esxVI_Context *ctx) { @@ -1533,97 +1538,92 @@ esxVI_BuildSelectSetCollection(esxVI_Context *ctx) } -/* - * Can't use the SessionIsActive() function here, because at least - * 'ESX Server 3.5.0 build-64607' returns an 'method not implemented' fault if - * you try to call it. Query the session manager for the current session of - * this connection instead and re-login if there is no current session for this - * connection. - * - * Update: 'ESX 4.0.0 build-171294' doesn't implement this method. - */ -#define ESX_VI_USE_SESSION_IS_ACTIVE 0 int esxVI_EnsureSession(esxVI_Context *ctx) { -#if ESX_VI_USE_SESSION_IS_ACTIVE - esxVI_Boolean active = esxVI_Boolean_Undefined; -#else int result = -1; + esxVI_Boolean active = esxVI_Boolean_Undefined; esxVI_String *propertyNameList = NULL; esxVI_ObjectContent *sessionManager = NULL; esxVI_DynamicProperty *dynamicProperty = NULL; esxVI_UserSession *currentSession = NULL; -#endif if (ctx->session == NULL) { ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid call")); return -1; } -#if ESX_VI_USE_SESSION_IS_ACTIVE - if (esxVI_SessionIsActive(ctx, ctx->session->key, ctx->session->userName, - &active) < 0) { - return -1; - } - - if (active != esxVI_Boolean_True) { - esxVI_UserSession_Free(&ctx->session); - - if (esxVI_Login(ctx, ctx->username, ctx->password, NULL, - &ctx->session) < 0) { + if (ctx->hasSessionIsActive) { + /* + * Use SessionIsActive to check if there is an active session for this + * connection an re-login in there isn't. + */ + if (esxVI_SessionIsActive(ctx, ctx->session->key, + ctx->session->userName, &active) < 0) { return -1; } - } - return 0; -#else - if (esxVI_String_AppendValueToList(&propertyNameList, - "currentSession") < 0 || - esxVI_LookupObjectContentByType(ctx, ctx->service->sessionManager, - "SessionManager", propertyNameList, - &sessionManager) < 0) { - goto cleanup; - } + if (active != esxVI_Boolean_True) { + esxVI_UserSession_Free(&ctx->session); - for (dynamicProperty = sessionManager->propSet; dynamicProperty != NULL; - dynamicProperty = dynamicProperty->_next) { - if (STREQ(dynamicProperty->name, "currentSession")) { - if (esxVI_UserSession_CastFromAnyType(dynamicProperty->val, - &currentSession) < 0) { - goto cleanup; + if (esxVI_Login(ctx, ctx->username, ctx->password, NULL, + &ctx->session) < 0) { + return -1; } + } - break; - } else { - VIR_WARN("Unexpected '%s' property", dynamicProperty->name); + return 0; + } else { + /* + * Query the session manager for the current session of this connection + * and re-login if there is no current session for this connection. + */ + if (esxVI_String_AppendValueToList(&propertyNameList, + "currentSession") < 0 || + esxVI_LookupObjectContentByType(ctx, ctx->service->sessionManager, + "SessionManager", propertyNameList, + &sessionManager) < 0) { + goto cleanup; + } + + for (dynamicProperty = sessionManager->propSet; dynamicProperty != NULL; + dynamicProperty = dynamicProperty->_next) { + if (STREQ(dynamicProperty->name, "currentSession")) { + if (esxVI_UserSession_CastFromAnyType(dynamicProperty->val, + &currentSession) < 0) { + goto cleanup; + } + + break; + } else { + VIR_WARN("Unexpected '%s' property", dynamicProperty->name); + } } - } - if (currentSession == NULL) { - esxVI_UserSession_Free(&ctx->session); + if (currentSession == NULL) { + esxVI_UserSession_Free(&ctx->session); - if (esxVI_Login(ctx, ctx->username, ctx->password, NULL, - &ctx->session) < 0) { + if (esxVI_Login(ctx, ctx->username, ctx->password, NULL, + &ctx->session) < 0) { + goto cleanup; + } + } else if (STRNEQ(ctx->session->key, currentSession->key)) { + ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("Key of the current session differs from the key at " + "last login")); goto cleanup; } - } else if (STRNEQ(ctx->session->key, currentSession->key)) { - ESX_VI_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", - _("Key of the current session differs from the key at " - "last login")); - goto cleanup; - } - result = 0; + result = 0; cleanup: - esxVI_String_Free(&propertyNameList); - esxVI_ObjectContent_Free(&sessionManager); - esxVI_UserSession_Free(&currentSession); + esxVI_String_Free(&propertyNameList); + esxVI_ObjectContent_Free(&sessionManager); + esxVI_UserSession_Free(&currentSession); - return result; -#endif + return result; + } } diff --git a/src/esx/esx_vi.h b/src/esx/esx_vi.h index b205b8c..aa47e87 100644 --- a/src/esx/esx_vi.h +++ b/src/esx/esx_vi.h @@ -168,6 +168,7 @@ struct _esxVI_Context { esxVI_SelectionSpec *selectSet_computeResourceToHost; esxVI_SelectionSpec *selectSet_computeResourceToParentToParent; bool hasQueryVirtualDiskUuid; + bool hasSessionIsActive; }; int esxVI_Context_Alloc(esxVI_Context **ctx); -- 1.7.0.4

2 2

[libvirt] [PATCH] esx: Fall back to path as key when QueryVirtualDiskUuid isn't available
by Matthias Bolte 07 Sep '10

07 Sep '10

QueryVirtualDiskUuid is only available on an ESX(i) server. vCenter returns an NotImplemented fault and a GSX server is missing the VirtualDiskManager completely. Therefore only use QueryVirtualDiskUuid with an ESX(i) server and fall back to path as storage volume key for vCenter and GSX server. --- src/esx/esx_storage_driver.c | 36 +++++++++++++++++++++++------ src/esx/esx_vi.c | 50 +++++++++++++++++++++++++++-------------- src/esx/esx_vi.h | 1 + 3 files changed, 62 insertions(+), 25 deletions(-) diff --git a/src/esx/esx_storage_driver.c b/src/esx/esx_storage_driver.c index 76f8769..329020b 100644 --- a/src/esx/esx_storage_driver.c +++ b/src/esx/esx_storage_driver.c @@ -783,6 +783,13 @@ esxStorageVolumeLookupByKey(virConnectPtr conn, const char *key) return esxStorageVolumeLookupByPath(conn, key); } + if (!priv->primary->hasQueryVirtualDiskUuid) { + ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", + _("QueryVirtualDiskUuid not avialable, cannot lookup storage " + "volume by UUID")); + return NULL; + } + if (esxVI_EnsureSession(priv->primary) < 0) { return NULL; } @@ -916,7 +923,7 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, esxVI_ManagedObjectReference *task = NULL; esxVI_TaskInfoState taskInfoState; char *uuid_string = NULL; - char key[VIR_UUID_STRING_BUFLEN] = ""; + char *key = NULL; virCheckFlags(0, NULL); @@ -1068,14 +1075,26 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, goto cleanup; } - if (esxVI_QueryVirtualDiskUuid(priv->primary, datastorePath, - priv->primary->datacenter->_reference, - &uuid_string) < 0) { - goto cleanup; - } + if (priv->primary->hasQueryVirtualDiskUuid) { + if (VIR_ALLOC_N(key, VIR_UUID_STRING_BUFLEN) < 0) { + virReportOOMError(); + goto cleanup; + } - if (esxUtil_ReformatUuid(uuid_string, key) < 0) { - goto cleanup; + if (esxVI_QueryVirtualDiskUuid(priv->primary, datastorePath, + priv->primary->datacenter->_reference, + &uuid_string) < 0) { + goto cleanup; + } + + if (esxUtil_ReformatUuid(uuid_string, key) < 0) { + goto cleanup; + } + } else { + /* Fall back to the path as key */ + if (esxVI_String_DeepCopyValue(&key, datastorePath) < 0) { + goto cleanup; + } } } else { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, @@ -1103,6 +1122,7 @@ esxStorageVolumeCreateXML(virStoragePoolPtr pool, const char *xmldesc, esxVI_FileBackedVirtualDiskSpec_Free(&virtualDiskSpec); esxVI_ManagedObjectReference_Free(&task); VIR_FREE(uuid_string); + VIR_FREE(key); return volume; } diff --git a/src/esx/esx_vi.c b/src/esx/esx_vi.c index 00e15f0..78cfdfd 100644 --- a/src/esx/esx_vi.c +++ b/src/esx/esx_vi.c @@ -453,6 +453,17 @@ esxVI_Context_Connect(esxVI_Context *ctx, const char *url, return -1; } + if (ctx->productVersion & esxVI_ProductVersion_ESX) { + /* + * FIXME: Actually this should be detected by really calling + * QueryVirtualDiskUuid and checking if a NotImplemented fault is + * returned. But currently we don't deserialized the details of a + * possbile fault and therefore we don't know if the fault was a + * NotImplemented fault or not. + */ + ctx->hasQueryVirtualDiskUuid = true; + } + if (esxVI_Login(ctx, username, password, NULL, &ctx->session) < 0 || esxVI_BuildSelectSetCollection(ctx) < 0) { return -1; @@ -3267,28 +3278,33 @@ esxVI_LookupStorageVolumeKeyByDatastorePath(esxVI_Context *ctx, return -1; } - if (esxVI_LookupFileInfoByDatastorePath(ctx, datastorePath, false, &fileInfo, - esxVI_Occurrence_RequiredItem) < 0) { - goto cleanup; - } - - if (esxVI_VmDiskFileInfo_DynamicCast(fileInfo) != NULL) { - /* VirtualDisks have a UUID, use it as key */ - if (esxVI_QueryVirtualDiskUuid(ctx, datastorePath, - ctx->datacenter->_reference, - &uuid_string) < 0) { + if (ctx->hasQueryVirtualDiskUuid) { + if (esxVI_LookupFileInfoByDatastorePath + (ctx, datastorePath, false, &fileInfo, + esxVI_Occurrence_RequiredItem) < 0) { goto cleanup; } - if (VIR_ALLOC_N(*key, VIR_UUID_STRING_BUFLEN) < 0) { - virReportOOMError(); - goto cleanup; - } + if (esxVI_VmDiskFileInfo_DynamicCast(fileInfo) != NULL) { + /* VirtualDisks have a UUID, use it as key */ + if (esxVI_QueryVirtualDiskUuid(ctx, datastorePath, + ctx->datacenter->_reference, + &uuid_string) < 0) { + goto cleanup; + } - if (esxUtil_ReformatUuid(uuid_string, *key) < 0) { - goto cleanup; + if (VIR_ALLOC_N(*key, VIR_UUID_STRING_BUFLEN) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (esxUtil_ReformatUuid(uuid_string, *key) < 0) { + goto cleanup; + } } - } else { + } + + if (*key == NULL) { /* Other files don't have a UUID, fall back to the path as key */ if (esxVI_String_DeepCopyValue(key, datastorePath) < 0) { goto cleanup; diff --git a/src/esx/esx_vi.h b/src/esx/esx_vi.h index bd37b05..b205b8c 100644 --- a/src/esx/esx_vi.h +++ b/src/esx/esx_vi.h @@ -167,6 +167,7 @@ struct _esxVI_Context { esxVI_SelectionSpec *selectSet_hostSystemToDatastore; esxVI_SelectionSpec *selectSet_computeResourceToHost; esxVI_SelectionSpec *selectSet_computeResourceToParentToParent; + bool hasQueryVirtualDiskUuid; }; int esxVI_Context_Alloc(esxVI_Context **ctx); -- 1.7.0.4

2 2

[libvirt] [PATCH] mingw: match recent changes in spec file
by Eric Blake 07 Sep '10

07 Sep '10

These changes allow './autobuild.sh' to complete again, when a full mingw cross-compilation is available on Fedora. * libvirt.spec.in (%file): List new installed files. * configure.ac (with_init_script): Assume default of none when cross-compiling. --- configure.ac | 6 +++--- mingw32-libvirt.spec.in | 5 +++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index d42d9e6..6c0fc69 100644 --- a/configure.ac +++ b/configure.ac @@ -276,10 +276,10 @@ AC_ARG_WITH([init-script], [AC_HELP_STRING([--with-init-script=@<:@redhat|auto|none@:>@], [Style of init script to install @<:@default=auto@:>@])]) if test "x$with_init_script" = "x" || test "x$with_init_script" = "xauto"; then - if test -f /etc/redhat-release ; then - with_init_script=redhat - else + if test "$cross_compiling" = yes || test ! -f /etc/redhat-release; then with_init_script=none + else + with_init_script=redhat fi fi AM_CONDITIONAL([LIBVIRT_INIT_SCRIPT_RED_HAT], test x$with_init_script = xredhat) diff --git a/mingw32-libvirt.spec.in b/mingw32-libvirt.spec.in index 6b2b5c6..4bbbc3b 100644 --- a/mingw32-libvirt.spec.in +++ b/mingw32-libvirt.spec.in @@ -71,6 +71,7 @@ rm -rf $RPM_BUILD_ROOT%{_mingw32_datadir}/doc/* rm -rf $RPM_BUILD_ROOT%{_mingw32_datadir}/gtk-doc/* rm $RPM_BUILD_ROOT%{_mingw32_libdir}/libvirt.a +rm $RPM_BUILD_ROOT%{_mingw32_libdir}/libvirt-qemu.a %clean @@ -83,10 +84,13 @@ rm -rf $RPM_BUILD_ROOT %{_mingw32_bindir}/virsh.exe %{_mingw32_bindir}/virt-xml-validate %{_mingw32_bindir}/virt-pki-validate +%{_mingw32_bindir}/libvirt-qemu-0.dll %{_mingw32_libdir}/libvirt.dll.a %{_mingw32_libdir}/libvirt.la %{_mingw32_libdir}/pkgconfig/libvirt.pc +%{_mingw32_libdir}/libvirt-qemu.dll.a +%{_mingw32_libdir}/libvirt-qemu.la %dir %{_mingw32_datadir}/libvirt/ %dir %{_mingw32_datadir}/libvirt/schemas/ @@ -109,6 +113,7 @@ rm -rf $RPM_BUILD_ROOT %dir %{_mingw32_includedir}/libvirt %{_mingw32_includedir}/libvirt/libvirt.h %{_mingw32_includedir}/libvirt/virterror.h +%{_mingw32_includedir}/libvirt/libvirt-qemu.h %{_mingw32_mandir}/man1/virsh.1* %{_mingw32_mandir}/man1/virt-xml-validate.1* -- 1.7.2.2

2 2

Re: [libvirt] ruby-libvirt / rubygems
by Chris Lalancette 07 Sep '10

07 Sep '10

On 09/03/10 - 09:23:48PM, Roland Moriz wrote: > Hello Chris, > > could you publish the updated ruby-libvirt bindings to rubygems.org? > There is still only version 0.1.0 of 2008 available: > > http://rubygems.org/gems/ruby-libvirt > > Thank you! Hello, I'd be happy to update the gem on rubygems.org. Unfortunately I don't have permission to do so, so I can't right at the moment. I've written to the previous maintainer of ruby-libvirt to see if he can give me access to update the gems there. As soon as I get that access, I'll push a new version of the gem and let you know. Thanks, -- Chris Lalancette

1 0