- Devel - libvirt List Archives

[libvirt] [PATCH] virsh: improve documentation
by Eric Blake 06 Apr '10

06 Apr '10

Document several missing commands. There's more work that could be done, but incremental improvements is better than no patch at all. * tools/virsh.pod (autostart, connect): Improve grammar. (create): Improve example. (domjobabort, domjobinfo, domxml-from-native, domxml-to-native): Document. (storage pool commands): New section. --- tools/virsh.pod | 167 ++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 files changed, 154 insertions(+), 13 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 62395d7..fdf687f 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -103,10 +103,12 @@ Will print the current directory. =item B<connect> I<URI> optional I<--readonly> -(Re)-Connect to the hypervisor. This is a build-in command after shell -start up, and usually get an I<URI> parameter specifying how to connect -to the hypervisor. The documentation page at L<http://libvirt.org/uri.html> -list the values supported but the most common are: +(Re)-Connect to the hypervisor. When the shell is first started, this +is automatically run with the I<URI> parameter requested by the C<-c> +option on the command line. The I<URI> parameter specifies how to +connect to the hypervisor. The documentation page at +L<http://libvirt.org/uri.html> list the values supported, but the most +common are: =over 4 @@ -116,11 +118,11 @@ this is used to connect to the local Xen hypervisor, this is the default =item qemu:///system -allow to connect locally as root to the daemon supervising QEmu and KVM domains +connect locally as root to the daemon supervising QEmu and KVM domains =item qemu:///session -allow to connect locally as a normal user to his own set of QEmu and KVM domains +connect locally as a normal user to his own set of QEmu and KVM domains =item lxc:/// @@ -252,7 +254,7 @@ I<domain-id> can be specified as an short integer, a name or a full UUID. Configure a domain to be automatically started at boot. -The option I<--disable> disable autostarting. +The option I<--disable> disables autostarting. =item B<console> I<domain-id> @@ -260,11 +262,15 @@ Connect the virtual serial console for the guest. =item B<create> I<FILE> -Create a domain from an XML <file>. An easy way to create the XML <file> is to use the B<dumpxml> command to obtain the definition of a pre-existing guest. +Create a domain from an XML <file>. An easy way to create the XML +<file> is to use the B<dumpxml> command to obtain the definition of a +pre-existing guest. B<Example> -virsh dumpxml <domain-id> > file. +virsh dumpxml <domain-id> > +edit file +virsh create < file =item B<define> I<FILE> @@ -306,6 +312,14 @@ Convert a domain name (or UUID) to a domain id Returns basic information about the domain. +=item B<domjobabort I<domain-id-or-uuid> + +Abort the currently running domain job. + +=item B<domjobinfo> I<domain-id-or-uuid> + +Returns information about jobs running on a domain. + =item B<domname> I<domain-id-or-uuid> Convert a domain Id (or UUID) to domain name @@ -314,13 +328,24 @@ Convert a domain Id (or UUID) to domain name Returns state about a running domain. +=item B<domxml-from-native> I<format> I<config> + +Convert the file I<config> in the native guest configuration format +named by I<format> to a domain XML format. + +=item B<domxml-to-native> I<format> I<xml> + +Convert the file I<xml> in domain XML format to the native guest +configuration format named by I<format>. + =item B<dump> I<domain-id> I<corefilepath> Dumps the core of a domain to a file for analysis. =item B<dumpxml> I<domain-id> -Output the domain information as an XML dump to stdout, this format can be used by the B<create> command. +Output the domain information as an XML dump to stdout, this format +can be used by the B<create> command. =item B<edit> I<domain-id> @@ -566,7 +591,7 @@ Edit the XML configuration file for a network. This is equivalent to: virsh net-dumpxml network > network.xml edit network.xml - virsh define network.xml + virsh net-define network.xml except that it does some error checking. The editor used can be supplied by the C<$VISUAL> or C<$EDITOR> environment @@ -596,6 +621,122 @@ Convert a network name to network UUID. =back +=head1 STORAGE POOL COMMANDS + +The following commands manipulate storage pools. Libvirt has the +capability to manage various storage solutions, including files, raw +partitions, and domain-specific formats, used to provide the storage +volumes visible as devices within virtual machines. For more detailed +information about this feature, see the documentation at +L<http://libvirt.org/formatstorage.html> . A lot of the commands for +pools are similar to the ones used for domains. + +=over 4 + +=item B<find-storage-pool-sources> I<type> optional I<srcSpec> + +Returns XML describing all storage pools of a given I<type> that could +be found. If I<srcSpec> is provided, it is a file that contains XML +to further restrict the query for pools. + +=item B<find-storage-pool-sources> I<type> optional I<host> I<port> + +Returns XML describing all storage pools of a given I<type> that could +be found. If I<host> and I<port> are provided, they control where the +query is performed. + +=item B<pool-autostart> I<pool-or-uuid> optional I<--disable> + +Configure whether I<pool> should automatically start at boot. + +=item B<pool-build> I<pool-or-uuid> + +Build a given pool. + +=item B<pool-create> I<file> + +Create and start a pool object from the XML I<file>. + +=item B<pool-create-as> I<name> I<--print-xml> I<type> optional I<source-host> +I<source-path> I<source-dev> I<source-name> <target> + +Create and start a pool object I<name> from the raw parameters. If +I<--print-xml> is specified, then print the XML of the pool object +without creating the pool. Otherwise, the pool has the specified +I<type>. + +=item B<pool-define> I<file> + +Create, but do not start, a pool object from the XML I<file>. + +=item B<pool-define-as> I<name> I<--print-xml> I<type> optional I<source-host> +I<source-path> I<source-dev> I<source-name> <target> + +Create, but do not start, a pool object I<name> from the raw parameters. If +I<--print-xml> is specified, then print the XML of the pool object +without defining the pool. Otherwise, the pool has the specified +I<type>. + +=item B<pool-destroy> I<pool-or-uuid> + +Destroy a given I<pool> object. Libvirt will no longer manage the +storage described by the pool object, but the raw data contained in +the pool is not changed, and can be later recovered with +B<pool-create>. + +=item B<pool-delete> I<pool-or-uuid> + +Destroy the resources used by a given I<pool> object. This operation +is non-recoverable. The I<pool> object will still exist after this +command. + +=item B<pool-dumpxml> I<pool-or-uuid> + +Returns the XML information about the I<pool> object. + +=item B<pool-edit> I<pool-or-uuid> + +Edit the XML configuration file for a storage pool. + +This is equivalent to: + virsh pool-dumpxml pool > pool.xml + edit pool.xml + virsh pool-define pool.xml +except that it does some error checking. + +The editor used can be supplied by the C<$VISUAL> or C<$EDITOR> environment +variables, and defaults to C<vi>. + +=item B<pool-info> I<pool-or-uuid> + +Returns basic information about the I<pool> object. + +=item B<pool-list> optional I<--inactive> I<--all> + +List pool objects known to libvirt. By default, only pools in use by +active domains are listed; I<--inactive> lists just the inactive +pools, and I<--all> lists all pools. + +=item B<pool-name> I<uuid> + +Convert the I<uuid> to a pool name. + +=item B<pool-refresh> I<pool-or-uuid> + +Refresh the list of volumes contained in I<pool>. + +=item B<pool-start> I<pool-or-uuid> + +Start the storage I<pool>, which is previously defined but inactive. + +=item B<pool-undefine> I<pool-or-uuid> + +Undefine the configuration for an inactive I<pool>. + +=item B<pool-uuid> I<pool> + +Returns the UUID of the named I<pool>. + =head1 SECRET COMMMANDS The following commands manipulate "secrets" (e.g. passwords, passphrases and @@ -653,11 +794,11 @@ format as accepted by the B<connect> option. =item VISUAL -The editor to use by the B<edit> and B<net-edit> options. +The editor to use by the B<edit> and related options. =item EDITOR -The editor to use by the B<edit> and B<net-edit> options, if C<VISUAL> +The editor to use by the B<edit> and related options, if C<VISUAL> is not set. =item LIBVIRT_DEBUG=LEVEL -- 1.6.6.1

2 2

[libvirt] [PATCH] Clarify an error message in setmem.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index ad64bc0..d241fa0 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -2407,7 +2407,8 @@ cmdSetmem(vshControl *ctl, const vshCmd *cmd) if (kilobytes > info.maxMem) { virDomainFree(dom); - vshError(ctl, _("Invalid value of %d for memory size"), kilobytes); + vshError(ctl, _("Requested memory size %d kb is larger than maximum of %lu kb"), + kilobytes, info.maxMem); return FALSE; } -- 1.6.6.1

2 2

[libvirt] [PATCH] Fix up comments for isEncrypted, isSecure, domainIsActive, and domainIsPersistent.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/lxc/lxc_driver.c | 8 ++++---- src/opennebula/one_driver.c | 4 ++-- src/phyp/phyp_driver.c | 4 ++-- src/qemu/qemu_driver.c | 8 ++++---- src/uml/uml_driver.c | 8 ++++---- src/vbox/vbox_tmpl.c | 8 ++++---- src/xen/xen_driver.c | 8 ++++---- 7 files changed, 24 insertions(+), 24 deletions(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index b5d422c..c6b652d 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -2527,10 +2527,10 @@ static virDriver lxcDriver = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - lxcIsEncrypted, - lxcIsSecure, - lxcDomainIsActive, - lxcDomainIsPersistent, + lxcIsEncrypted, /* isEncrypted */ + lxcIsSecure, /* isSecure */ + lxcDomainIsActive, /* domainIsActive */ + lxcDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ diff --git a/src/opennebula/one_driver.c b/src/opennebula/one_driver.c index 4554d95..0d80d1f 100644 --- a/src/opennebula/one_driver.c +++ b/src/opennebula/one_driver.c @@ -781,8 +781,8 @@ static virDriver oneDriver = { NULL, /* nodeDeviceReAttach; */ NULL, /* nodeDeviceReset; */ NULL, /* domainMigratePrepareTunnel */ - oneIsEncrypted, - oneIsSecure, + oneIsEncrypted, /* isEncrypted */ + oneIsSecure, /* isSecure */ NULL, /* domainIsActive */ NULL, /* domainIsPersistent */ NULL, /* cpuCompare */ diff --git a/src/phyp/phyp_driver.c b/src/phyp/phyp_driver.c index 28e17ff..b712d0a 100644 --- a/src/phyp/phyp_driver.c +++ b/src/phyp/phyp_driver.c @@ -1640,8 +1640,8 @@ virDriver phypDriver = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - phypIsEncrypted, - phypIsSecure, + phypIsEncrypted, /* isEncrypted */ + phypIsSecure, /* isSecure */ NULL, /* domainIsActive */ NULL, /* domainIsPersistent */ NULL, /* cpuCompare */ diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index a87b974..bc94ce6 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -11325,10 +11325,10 @@ static virDriver qemuDriver = { qemudNodeDeviceReAttach, /* nodeDeviceReAttach */ qemudNodeDeviceReset, /* nodeDeviceReset */ qemudDomainMigratePrepareTunnel, /* domainMigratePrepareTunnel */ - qemuIsEncrypted, - qemuIsSecure, - qemuDomainIsActive, - qemuDomainIsPersistent, + qemuIsEncrypted, /* isEncrypted */ + qemuIsSecure, /* isSecure */ + qemuDomainIsActive, /* domainIsActive */ + qemuDomainIsPersistent, /* domainIsPersistent */ qemuCPUCompare, /* cpuCompare */ qemuCPUBaseline, /* cpuBaseline */ qemuDomainGetJobInfo, /* domainGetJobInfo */ diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index dfa5de5..0179b2e 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -1926,10 +1926,10 @@ static virDriver umlDriver = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - umlIsEncrypted, - umlIsSecure, - umlDomainIsActive, - umlDomainIsPersistent, + umlIsEncrypted, /* isEncrypted */ + umlIsSecure, /* isSecure */ + umlDomainIsActive, /* domainIsActive */ + umlDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 62fd8e1..4b00a80 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -8138,10 +8138,10 @@ virDriver NAME(Driver) = { NULL, /* nodeDeviceReAttach */ NULL, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - vboxIsEncrypted, - vboxIsSecure, - vboxDomainIsActive, - vboxDomainIsPersistent, + vboxIsEncrypted, /* isEncrypted */ + vboxIsSecure, /* isSecure */ + vboxDomainIsActive, /* domainIsActive */ + vboxDomainIsPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ diff --git a/src/xen/xen_driver.c b/src/xen/xen_driver.c index 7c4eb5e..0835406 100644 --- a/src/xen/xen_driver.c +++ b/src/xen/xen_driver.c @@ -1969,10 +1969,10 @@ static virDriver xenUnifiedDriver = { xenUnifiedNodeDeviceReAttach, /* nodeDeviceReAttach */ xenUnifiedNodeDeviceReset, /* nodeDeviceReset */ NULL, /* domainMigratePrepareTunnel */ - xenUnifiedIsEncrypted, - xenUnifiedIsSecure, - xenUnifiedDomainIsActive, - xenUnifiedDomainisPersistent, + xenUnifiedIsEncrypted, /* isEncrypted */ + xenUnifiedIsSecure, /* isSecure */ + xenUnifiedDomainIsActive, /* domainIsActive */ + xenUnifiedDomainisPersistent, /* domainIsPersistent */ NULL, /* cpuCompare */ NULL, /* cpuBaseline */ NULL, /* domainGetJobInfo */ -- 1.6.6.1

2 2

[libvirt] [PATCH] Document snapshot virsh commands in the man page.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.pod | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 49 insertions(+), 0 deletions(-) diff --git a/tools/virsh.pod b/tools/virsh.pod index 62395d7..9e2c3e5 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -639,6 +639,55 @@ Output a list of UUIDs of known secrets to stdout. =back +=head1 SNAPSHOT COMMMANDS + +The following commands manipulate domain snapshots. Snapshots take the +disk, memory, and device state of a domain at a point-of-time, and save it +for future use. They have many uses, from saving a "clean" copy of an OS +image to saving a domain's state before a potentially destructive operation. +Snapshots are identified with a unique name. See +L<http://libvirt.org/formatsnapshot.html> for documentation of the XML format +used to represent properties of snapshots. + +=over 4 + +=item B<snapshot-create> I<domain> I<xmlfile> + +Create a snapshot for domain I<domain> with the properties specified in +I<xmlfile>. The only properties settable for a domain snapshot are the +<name> and <description>; the rest of the fields are ignored, and +automatically filled in by libvirt. If I<xmlfile> is completely ommitted, +then libvirt will choose a value for all fields. + +=item B<snapshot-current> I<domain> + +Output the snapshot XML for the domain's current snapshot (if any). + +=item B<snapshot-list> I<domain> + +List all of the available snapshots for the given domain. + +=item B<snapshot-dumpxml> I<domain> I<snapshot> + +Output the snapshot XML for the domain's snapshot named I<snapshot>. + +=item B<revert-to-snapshot> I<domain> I<snapshot> + +Revert the given domain to the snapshot specified by I<snapshot>. Be aware +that this is a destructive action; any changes in the domain since the +snapshot is taken will be lost. Also note that the state of the domain after +revert-to-snapshot is complete will be the state of the domain at the time +the original snapshot was taken. + +=item B<snapshot-delete> I<domain> I<snapshot> I<--children> + +Delete the snapshot for the domain named I<snapshot>. If this snapshot +has child snapshots, changes from this snapshot will be merged into the +children. If I<--children> is passed, then delete this snapshot and any +children of this snapshot. + +=back + =head1 ENVIRONMENT The following environment variables can be set to alter the behaviour -- 1.6.6.1

2 2

[libvirt] [PATCH] Better error reporting in virsh.
by Chris Lalancette 06 Apr '10

06 Apr '10

When hitting failures in virsh, a common idiom is to jump to a cleanup label, free some resources, and then return a FALSE error code to vshCommandRun. In theory, vshCommandRun is then supposed to print out the last error. The problem is that many of the cleanup paths have library calls to free resources, and all of those library calls clear out the last error. This is leading to situations where no error is being reported at all. This patch remedies the situation somewhat by printing out the errors inside the command methods themselves when we know it will go through a cleanup path that will lose the error. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- tools/virsh.c | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index d241fa0..aaae7ca 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -2623,9 +2623,8 @@ cmdDomXMLFromNative(vshControl *ctl, const vshCmd *cmd) format = vshCommandOptString(cmd, "format", NULL); configFile = vshCommandOptString(cmd, "config", NULL); - if (virFileReadAll(configFile, 1024*1024, &configData) < 0) { + if (virFileReadAll(configFile, 1024*1024, &configData) < 0) return FALSE; - } xmlData = virConnectDomainXMLFromNative(ctl->conn, format, configData, flags); if (xmlData != NULL) { @@ -2669,9 +2668,8 @@ cmdDomXMLToNative(vshControl *ctl, const vshCmd *cmd) format = vshCommandOptString(cmd, "format", NULL); xmlFile = vshCommandOptString(cmd, "xml", NULL); - if (virFileReadAll(xmlFile, 1024*1024, &xmlData) < 0) { + if (virFileReadAll(xmlFile, 1024*1024, &xmlData) < 0) return FALSE; - } configData = virConnectDomainXMLToNative(ctl->conn, format, xmlData, flags); if (configData != NULL) { @@ -4330,9 +4328,8 @@ cmdNodeDeviceCreate(vshControl *ctl, const vshCmd *cmd) return FALSE; } - if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) return FALSE; - } dev = virNodeDeviceCreateXML(ctl->conn, buffer, 0); VIR_FREE(buffer); @@ -5427,6 +5424,7 @@ cmdVolCreate(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virStoragePoolFree(pool); return FALSE; } @@ -5488,6 +5486,7 @@ cmdVolCreateFrom(vshControl *ctl, const vshCmd *cmd) goto cleanup; if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); goto cleanup; } @@ -6928,6 +6927,7 @@ cmdAttachDevice(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virDomainFree(dom); return FALSE; } @@ -6995,6 +6995,7 @@ cmdDetachDevice(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virDomainFree(dom); return FALSE; } @@ -7062,6 +7063,7 @@ cmdUpdateDevice(vshControl *ctl, const vshCmd *cmd) } if (virFileReadAll(from, VIRSH_MAX_XML_FILE, &buffer) < 0) { + virshReportError(ctl); virDomainFree(dom); return FALSE; } -- 1.6.6.1

2 2

[libvirt] [PATCH] Website documentation for the snapshot XML.
by Chris Lalancette 06 Apr '10

06 Apr '10

Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- docs/formatsnapshot.html.in | 72 +++++++++++++++++++++++++++++++++++++++++++ docs/sitemap.html.in | 4 ++ 2 files changed, 76 insertions(+), 0 deletions(-) create mode 100644 docs/formatsnapshot.html.in diff --git a/docs/formatsnapshot.html.in b/docs/formatsnapshot.html.in new file mode 100644 index 0000000..fa007ea --- /dev/null +++ b/docs/formatsnapshot.html.in @@ -0,0 +1,72 @@ +<html> + <body> + <h1>Snapshot XML format</h1> + + <ul id="toc"></ul> + + <h2><a name="SnapshotAttributes">Snapshot XML</a></h2> + + <p> + Attributes of libvirt snapshots are stored as child elements of + the <code>domainsnapshot</code> element. At snapshot creation + time, only the <code>name</code> and <code>description</code> + elements are settable; the rest of the fields are informational + (and readonly) and will be filled in by libvirt when the + snapshot is created. + </p> + <p> + The top-level <code>domainsnapshot</code> element may contain + the following elements: + </p> + <dl> + <dt><code>name</code></dt> + <dd>The name for this snapshot. If the name is specified when + initially creating the snapshot, then the snapshot will have + that particular name. If the name is omitted when initially + creating the snapshot, then libvirt will make up a name for the snapshot. + </dd> + <dt><code>description</code></dt> + <dd>A human-readable description of the snapshot. If the + description is omitted when initially creating the snapshot, + then this field will be empty. + </dd> + <dt><code>creationTime</code></dt> + <dd>The time this snapshot was created. The time is specified + in seconds since the Epoch (i.e. Unix time). Readonly. + </dd> + <dt><code>state</code></dt> + <dd>The state of the domain at the time this snapshot was + taken. When the domain is reverted to this snapshot, the domain's state + will be set to whatever is in this field. Readonly. + </dd> + <dt><code>parent</code></dt> + <dd>The parent of this snapshot. This element contains exactly + one child element, name. This specifies the name of the parent + snapshot of this snapshot, and is used to represent trees of + snapshots. Readonly. + </dd> + <dt><code>domain</code></dt> + <dd>The domain that this snapshot was taken against. This + element contains exactly one child element, uuid. This + specifies the uuid of the domain that this snapshot was taken + against. Readonly. + </dd> + </dl> + + <h2><a name="example">Example</a></h2> + + <pre> + <domainsnapshot> + <name>os-updates</name> + <description>Snapshot of OS install and updates</description> + <state>running</state> + <creationTime>1270477159</creationTime> + <parent> + <name>bare-os-install</name> + </parent> + <domain> + <uuid>93a5c045-6457-2c09-e56c-927cdf34e178</uuid> + </domain> + </domainsnapshot></pre> + </body> +</html> diff --git a/docs/sitemap.html.in b/docs/sitemap.html.in index 76d8faa..ae2bfde 100644 --- a/docs/sitemap.html.in +++ b/docs/sitemap.html.in @@ -114,6 +114,10 @@ <a href="formatsecret.html">Secrets</a> <span>The secret XML format</span> </li> + <li> + <a href="formatsnapshot.html">Secrets</a> + <span>The snapshot XML format</span> + </li> </ul> </li> <li> -- 1.6.6.1

2 2

[libvirt] [PATCH] Increase the number of available VNC ports.
by Chris Lalancette 06 Apr '10

06 Apr '10

When starting up qemu VNC autoport guests, we were only looking through ports 5900 to 6000, meaning we were limited to 100 total clients. Increase that limit to 65535 (the last available port), so we can have up to 59635 VNC autoport guests. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> --- src/qemu/qemu_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index bc94ce6..ce43fd3 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -2598,7 +2598,7 @@ qemuInitPCIAddresses(struct qemud_driver *driver, static int qemudNextFreeVNCPort(struct qemud_driver *driver ATTRIBUTE_UNUSED) { int i; - for (i = 5900 ; i < 6000 ; i++) { + for (i = 5900 ; i < 65535 ; i++) { int fd; int reuse = 1; struct sockaddr_in addr; -- 1.6.6.1

3 3

[libvirt] [PATCH] nwfilter: RHEL 5 gcc fixes
by Stefan Berger 06 Apr '10

06 Apr '10

This patch fixes some compilation issues for the RHEL5 build. I am also removing the IPV6 constant where it appears in the wrong place. Seems like a new bad thing to rely on the compiler to tell about potentially uninitialized vars... Signed-off-by; Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -392,7 +392,9 @@ struct _virXMLAttr2Struct static const struct int_map macProtoMap[] = { INTMAP_ENTRY(ETHERTYPE_ARP , "arp"), INTMAP_ENTRY(ETHERTYPE_IP , "ipv4"), +#ifdef ETHERTYPE_IPV6 INTMAP_ENTRY(ETHERTYPE_IPV6, "ipv6"), +#endif INTMAP_ENTRY_LAST }; @@ -547,7 +549,6 @@ static const struct int_map ipProtoMap[] #ifdef IPPROTO_SCTP INTMAP_ENTRY(IPPROTO_SCTP, "sctp"), #endif - INTMAP_ENTRY(IPPROTO_IPV6, "ipv6"), INTMAP_ENTRY(IPPROTO_ICMPV6, "icmpv6"), INTMAP_ENTRY_LAST }; @@ -1124,7 +1125,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n nwItemDesc *item; int int_val; unsigned int uint_val; - void *data_ptr, *storage_ptr; + void *data_ptr = NULL, *storage_ptr; valueValidator validator; char *match = virXMLPropString(node, "match"); nwIPAddress ipaddr; @@ -1550,7 +1551,7 @@ virNWFilterRuleParse(xmlNodePtr node) char *direction; char *prio; int found; - int found_i; + int found_i = 0; unsigned int priority; xmlNodePtr cur;

2 2

[libvirt] [PATCH] Fix compiler warning about unused conn parameter
by Matthias Bolte 06 Apr '10

06 Apr '10

This only affects builds without NUMA support. --- I just pushed this patch. src/nodeinfo.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/nodeinfo.c b/src/nodeinfo.c index 402a6b7..4d7fac1 100644 --- a/src/nodeinfo.c +++ b/src/nodeinfo.c @@ -450,7 +450,7 @@ int nodeCapsInitNUMA(virCapsPtr caps ATTRIBUTE_UNUSED) { return 0; } -int nodeGetCellsFreeMemory(virConnectPtr conn, +int nodeGetCellsFreeMemory(virConnectPtr conn ATTRIBUTE_UNUSED, unsigned long long *freeMems ATTRIBUTE_UNUSED, int startCell ATTRIBUTE_UNUSED, int maxCells ATTRIBUTE_UNUSED) @@ -460,7 +460,7 @@ int nodeGetCellsFreeMemory(virConnectPtr conn, return -1; } -unsigned long long nodeGetFreeMemory(virConnectPtr conn) +unsigned long long nodeGetFreeMemory(virConnectPtr conn ATTRIBUTE_UNUSED) { nodeReportError(VIR_ERR_NO_SUPPORT, "%s", _("NUMA memory information not available on this platform")); -- 1.6.3.3

1 0

[libvirt] Sys::Virt Perl bindings - calling newSVpv with unsafe length
by Richard W.M. Jones 06 Apr '10

06 Apr '10

Dan, After tracking down a very obscure bug in hivex & libguestfs Perl bindings, I started looking for places where we call newSVpv with a variable length argument that could be zero. In such cases, one should call newSVpvn instead, otherwise Perl will try to use strlen() to calculate the length of the data buffer when length is passed in as zero [I'm sure you are aware of this already]. There seems to be one such case in the Sys::Virt bindings: http://cpansearch.perl.org/src/DANBERR/Sys-Virt-0.2.3/Virt.xs CODE: if ((bytes = virSecretGetValue(sec, &len, flags)) == NULL) { _croak_error(virConnGetLastError(virSecretGetConnect(sec))); } RETVAL = newSVpv((char*)bytes, len); Maybe 'len' can never be zero here, but I think it's safer to turn this into a call to newSVpvn anyway. Also, if you look at the source to newSVpv: http://github.com/mirrors/perl/blob/blead/sv.c#L7752 You'll see there is an extra test, not present with newSVpvn. So it's better to always call newSVpvn wherever there is a constant-sized buffer, eg in code like this: if ((virDomainGetUUID(dom, rawuuid)) < 0) { _croak_error(virConnGetLastError(virDomainGetConnect(dom))); } RETVAL = newSVpv((char*)rawuuid, sizeof(rawuuid)); Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones New in Fedora 11: Fedora Windows cross-compiler. Compile Windows programs, test, and build Windows installers. Over 70 libraries supprt'd http://fedoraproject.org/wiki/MinGW http://www.annexia.org/fedora_mingw

2 1

[libvirt] [PATCH] [0/4] Managed save APIs version 2
by Daniel Veillard 06 Apr '10

06 Apr '10

Change w.r.t. version 1 is the saving path under /var/lib and not /var/run, the restore bug fix spotted by Laine and the various typo and improvement from Eric. As posted earlier, I have implemented the small set of managed save APIs, where libvirt stores the domain state itself and can then recover that state when the domain is started up. I think the code is complete, but not really tested (I still need to debug a failure which seems unrelated), with the exception of the virsh commands which probably need to be extended for convenience. Also I implemented it only for the qemu driver, I would not be surprized if an ESX backend could be implemented since there is no file path in this API. A command "virsh saveall" would be convenient, to be added later. More documentation is needed too. Thanks to Chris Lalancette who wrote a large part of this code ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

5 22

[libvirt] [PATCH] Fix compiler warning about non-literal format string
by Matthias Bolte 06 Apr '10

06 Apr '10

--- I just pushed this patch. src/security/security_apparmor.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/security/security_apparmor.c b/src/security/security_apparmor.c index db04d5c..8e1c794 100644 --- a/src/security/security_apparmor.c +++ b/src/security/security_apparmor.c @@ -483,7 +483,7 @@ AppArmorSetSecurityProcessLabel(virSecurityDriverPtr drv, virDomainObjPtr vm) } if (aa_change_profile(profile_name) < 0) { - virSecurityReportError(VIR_ERR_INTERNAL_ERROR, + virSecurityReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("error calling aa_change_profile()")); goto clean; } -- 1.6.3.3

1 0

[libvirt] Build fails on RHEL-5
by Chris Lalancette 05 Apr '10

05 Apr '10

Hey Stefan, When trying to build libvirt head on RHEL-5, I'm getting this error: gcc -DHAVE_CONFIG_H -I. -I. -I.. -I../gnulib/lib -I../gnulib/lib -I../include -I../src/util -I../include -I/usr/include/libxml2 -DLIBDIR=\"/usr/local/lib\" -DBINDIR=\"/usr/local/libexec\" -DSBINDIR=\"/usr/local/sbin\" -DSYSCONF_DIR=\"/usr/local/etc\" -DLOCALEBASEDIR=\"/usr/local/share/locale\" -DPKGDATADIR=\"/usr/local/share/libvirt\" -DLOCAL_STATE_DIR=\"/usr/local/var\" -DGETTEXT_PACKAGE=\"libvirt\" -Wall -Wformat -Wformat-security -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Winline -Wredundant-decls -Wno-sign-compare -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fasynchronous-unwind-tables -fdiagnostics-show-option -Werror -DIN_LIBVIRT -g -O2 -MT libvirt_conf_la-nwfilter_conf.lo -MD -MP -MF .deps/libvirt_conf_la-nwfilter_conf.Tpo -c conf/nwfilter_conf.c -fPIC -DPIC -o .libs/libvirt_conf_la-nwfilter_conf.o conf/nwfilter_conf.c:395: error: 'ETHERTYPE_IPV6' undeclared here (not in a function) make[3]: *** [libvirt_conf_la-nwfilter_conf.lo] Error 1 It seems that ETHERTYPE_IPV6 is not declared in /usr/include/net/ethernet.h in RHEL-5. We can probably get around this by adding (untested): #ifndef ETHERTYPE_IPV6 #define ETHERTYPE_IPV6 0x86dd #endif At the top of nwfilter_conf.c -- Chris Lalancette

2 2

[libvirt] [PATCH] Only parse 'CPU XML' in virCPUDefParseXML()
by Jim Fehlig 05 Apr '10

05 Apr '10

I received a report of user crashing libvirtd with virsh capabilities > capabilities.xml virsh cpu-compare capabilities.xml Breakpoint 1, x86ModelFind (map=0x6fb6f0, name=0x0) at cpu/cpu_x86.c:501 501 model = map->models; (gdb) bt #0 x86ModelFind (map=0x6fb6f0, name=0x0) at cpu/cpu_x86.c:501 #1 0x00007ffff70d0832 in x86ModelFromCPU (cpu=0x712070, map=0x6fb6f0, policy=1) at cpu/cpu_x86.c:541 #2 0x00007ffff70d12e9 in x86Compute (host=0x6ea610, cpu=0x712070, guest=0x0) at cpu/cpu_x86.c:822 #3 0x00007ffff70d1750 in x86Compare (host=0x6ea610, cpu=0x712070) at cpu/cpu_x86.c:927 #4 0x00007ffff70cf0c9 in cpuCompare (conn=0x6f69a0, host=0x6ea610, cpu=0x712070) at cpu/cpu.c:118 #5 0x00007ffff70ceff4 in cpuCompareXML (conn=0x6f69a0, host=0x6ea610, xml=0x6fa3e0 "<capabilities>\n\n <host>\n <cpu>\n <arch>x86_64</arch>\n <features>\n <pae/>\n </features>\n </cpu>\n <migration_features>\n <live/>\n <uri_transports>\n <uri_tra"...) at cpu/cpu.c:90 .. (gdb) n 503 if (STREQ(model->name, name)) (gdb) Program received signal SIGSEGV, Segmentation fault. 0x00007ffff4ff4960 in strcmp () from /lib64/libc.so.6 name, passed to x86ModelFind(), is NULL because virCPUDefParseXML() failed to parse anything meaningful from the "malformed" CPU XML. I waffled for quite a while on how to fix this and in the end decided to ensure the CPU XML passed to virCPUDefParseXML() does in fact contain an element named 'cpu'. AFAICT, all consumers of virCPUDefParseXML() pass an xmlNodePtr rooted at 'cpu' element. NB: I will be offline until Monday so if this patch is satisfactory please include it for 0.7.8/0.8.0 release :-). Otherwise I'll respin with suggested changes next week. Thanks! Jim

2 3

[libvirt] .so version number question
by Eric Blake 05 Apr '10

05 Apr '10

On IRC, Chris raised the question on what version number we should be using for libvirt.so. The libtool manual has an entire chapter on the matter: http://www.gnu.org/software/libtool/manual/libtool.html#Release-numbers In particular, it states that if you are using the -version-info flag to libtool (which our src/Makefile.am currently does), then you are promising to abide by the libtool versioning rules, where the .so version is treated as current:revision:age (and not major.minor.micro). In fact, libtool goes so far as to state that "Never try to set the interface numbers so that they correspond to the release number of your package. This is an abuse that only fosters misunderstanding of the purpose of library versions. Instead, use the -release flag (see Release numbers), but be warned that every release of your package will not be binary compatible with any other release." Should we be using -release instead of -version-info? Or should we continue using -version-info, but follow the advice of divorcing the .so version number from the release number? For example, according to the libtool rules, if the two version numbers are independent, then going from libtool 0.7.7 to 0.8.0 (that is, a minor version number bump in terms of packaging numbering), should go from libvirt.so.0:7:7 (we are at API version 0, with seven revisions of the code implementing that API, and are compatible back to -7:0:0, which is nonsense, so it effectively works out that we are compatible back to 0:0:0) to libvirt.so.1:0:1 (we added API, this is the first implementation of that new API, and we are compatible back to 0.x.x). Going by the libtool rules means that the c.r.a field will increment 'c' rather frequently (basically, every time we add an API!), but as long as 'a' increments just as frequently, then we are not making any backwards incompatible changes. But if you don't like that, the we should be going by the -release flag to libtool, where the .so numbering matches the libvirt release numbering. On the other hand, libtool states that using the -release flag means that anyone that uses libtool to link against libvirt.so is treated as being an incompatible change (basically, even though we are striving hard to maintain backwards compatibility, libtool can't exploit that). Again from the manual, "Note that this option causes a modification of the library name, so do not use it unless you want to break binary compatibility with any past library releases. In general, you should only use -release for package-internal libraries or for ones whose interfaces change very frequently." Libvirt's interface changes frequently, but libvirt.so is not a package-internal library so I don't think that -release is the way to go. Should I try to prepare a patch to start making better use of the -version-info libtool flag according to the libtool rules? And if so, is everyone okay with just punting on this issue until after 0.8.0 is out the door? -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org

1 0

[libvirt] clarified syntax-check error message
by Dave Allan 05 Apr '10

05 Apr '10

I pushed the attached trivial patch after noticing that I had a tab in one of my RNG schemas and that the error message was not quite right in that case. Dave

1 0

[libvirt] [PATCH Java] Add finalize to automatically free libvirt objects
by Matthias Bolte 05 Apr '10

05 Apr '10

The Connect and Network classes already had finalize, add it to all other classes that wrap libvirt objects to unify the behavior. --- src/main/java/org/libvirt/Device.java | 5 +++++ src/main/java/org/libvirt/Domain.java | 5 +++++ src/main/java/org/libvirt/Interface.java | 5 +++++ src/main/java/org/libvirt/Network.java | 1 + src/main/java/org/libvirt/StoragePool.java | 5 +++++ src/main/java/org/libvirt/StorageVol.java | 5 +++++ 6 files changed, 26 insertions(+), 0 deletions(-) diff --git a/src/main/java/org/libvirt/Device.java b/src/main/java/org/libvirt/Device.java index b4f9a0c..5329be5 100644 --- a/src/main/java/org/libvirt/Device.java +++ b/src/main/java/org/libvirt/Device.java @@ -132,6 +132,11 @@ public class Device { return desc; } + @Override + public void finalize() throws LibvirtException { + free(); + } + /** * Frees this device object. The running instance is kept alive. The data * structure is freed and should not be used thereafter. diff --git a/src/main/java/org/libvirt/Domain.java b/src/main/java/org/libvirt/Domain.java index e7b24ef..a80800c 100644 --- a/src/main/java/org/libvirt/Domain.java +++ b/src/main/java/org/libvirt/Domain.java @@ -162,6 +162,11 @@ public class Domain { processError(); } + @Override + public void finalize() throws LibvirtException { + free(); + } + /** * Frees this domain object. The running instance is kept alive. The data * structure is freed and should not be used thereafter. diff --git a/src/main/java/org/libvirt/Interface.java b/src/main/java/org/libvirt/Interface.java index 44bcad5..8b97925 100644 --- a/src/main/java/org/libvirt/Interface.java +++ b/src/main/java/org/libvirt/Interface.java @@ -112,6 +112,11 @@ public class Interface { return returnValue; } + @Override + public void finalize() throws LibvirtException { + free(); + } + /** * Frees this interface object. The running instance is kept alive. The data * structure is freed and should not be used thereafter. diff --git a/src/main/java/org/libvirt/Network.java b/src/main/java/org/libvirt/Network.java index 3c6f313..63b1f12 100644 --- a/src/main/java/org/libvirt/Network.java +++ b/src/main/java/org/libvirt/Network.java @@ -64,6 +64,7 @@ public class Network { processError(); } + @Override public void finalize() throws LibvirtException { free(); } diff --git a/src/main/java/org/libvirt/StoragePool.java b/src/main/java/org/libvirt/StoragePool.java index 7de7d50..54468bd 100644 --- a/src/main/java/org/libvirt/StoragePool.java +++ b/src/main/java/org/libvirt/StoragePool.java @@ -115,6 +115,11 @@ public class StoragePool { processError(); } + @Override + public void finalize() throws LibvirtException { + free(); + } + /** * Free a storage pool object, releasing all memory associated with it. Does * not change the state of the pool on the host. diff --git a/src/main/java/org/libvirt/StorageVol.java b/src/main/java/org/libvirt/StorageVol.java index 5ae5f5c..c5a3717 100644 --- a/src/main/java/org/libvirt/StorageVol.java +++ b/src/main/java/org/libvirt/StorageVol.java @@ -75,6 +75,11 @@ public class StorageVol { processError(); } + @Override + public void finalize() throws LibvirtException { + free(); + } + /** * Release the storage volume handle. The underlying storage volume contains * to exist -- 1.6.3.3

3 4

[libvirt] [PATCH] nwfilter: remove virConnectPtr conn from functions where it is not necessary
by Stefan Berger 05 Apr '10

05 Apr '10

This patch removes the virConnectPtr parameter from all functions where it's not necessary starting out with removing it as a parameter to the error reporting function. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 154 ++---- src/conf/nwfilter_conf.h | 24 src/conf/nwfilter_params.c | 7 src/conf/nwfilter_params.h | 3 src/nwfilter/nwfilter_driver.c | 24 src/nwfilter/nwfilter_ebiptables_driver.c | 760 ++++++++++++------------------ src/nwfilter/nwfilter_gentech_driver.c | 51 -- src/nwfilter/nwfilter_gentech_driver.h | 6 tests/nwfilterxml2xmltest.c | 2 9 files changed, 423 insertions(+), 608 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -518,13 +518,11 @@ virNWFilterPoolObjPtr const char *name); -int virNWFilterPoolObjSaveDef(virConnectPtr conn, - virNWFilterDriverStatePtr driver, +int virNWFilterPoolObjSaveDef(virNWFilterDriverStatePtr driver, virNWFilterPoolObjPtr pool, virNWFilterDefPtr def); -int virNWFilterPoolObjDeleteDef(virConnectPtr conn, - virNWFilterPoolObjPtr pool); +int virNWFilterPoolObjDeleteDef(virNWFilterPoolObjPtr pool); virNWFilterPoolObjPtr virNWFilterPoolObjAssignDef(virConnectPtr conn, virNWFilterPoolObjListPtr pools, @@ -533,28 +531,23 @@ virNWFilterPoolObjPtr virNWFilterPoolObj int virNWFilterTestUnassignDef(virConnectPtr conn, virNWFilterPoolObjPtr pool); -virNWFilterDefPtr virNWFilterDefParseNode(virConnectPtr conn, - xmlDocPtr xml, +virNWFilterDefPtr virNWFilterDefParseNode(xmlDocPtr xml, xmlNodePtr root); -char *virNWFilterDefFormat(virConnectPtr conn, - virNWFilterDefPtr def); +char *virNWFilterDefFormat(virNWFilterDefPtr def); -int virNWFilterSaveXML(virConnectPtr conn, - const char *configDir, +int virNWFilterSaveXML(const char *configDir, virNWFilterDefPtr def, const char *xml); -int virNWFilterSaveConfig(virConnectPtr conn, - const char *configDir, +int virNWFilterSaveConfig(const char *configDir, virNWFilterDefPtr def); int virNWFilterPoolLoadAllConfigs(virConnectPtr conn, virNWFilterPoolObjListPtr pools, const char *configDir); -char *virNWFilterConfigFile(virConnectPtr conn, - const char *dir, +char *virNWFilterConfigFile(const char *dir, const char *name); virNWFilterDefPtr virNWFilterDefParseString(virConnectPtr conn, @@ -568,8 +561,7 @@ void virNWFilterPoolObjUnlock(virNWFilte int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); -# define virNWFilterReportError(conn, code, fmt...) \ - (void)conn; \ +# define virNWFilterReportError(code, fmt...) \ virReportErrorHelper(NULL, VIR_FROM_NWFILTER, code, __FILE__, \ __FUNCTION__, __LINE__, fmt) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -310,8 +310,7 @@ virNWFilterPoolObjListFree(virNWFilterPo static int -virNWFilterRuleDefAddVar(virConnectPtr conn ATTRIBUTE_UNUSED, - virNWFilterRuleDefPtr nwf, +virNWFilterRuleDefAddVar(virNWFilterRuleDefPtr nwf, nwItemDesc *item, const char *var) { @@ -1112,8 +1111,7 @@ virNWIPv6AddressParser(const char *input static int -virNWFilterRuleDetailsParse(virConnectPtr conn ATTRIBUTE_UNUSED, - xmlNodePtr node, +virNWFilterRuleDetailsParse(xmlNodePtr node, virNWFilterRuleDefPtr nwf, const virXMLAttr2Struct *att) { @@ -1152,8 +1150,7 @@ virNWFilterRuleDetailsParse(virConnectPt flags_set |= NWFILTER_ENTRY_ITEM_FLAG_HAS_VAR; storage_ptr = NULL; - if (virNWFilterRuleDefAddVar(conn, - nwf, + if (virNWFilterRuleDefAddVar(nwf, item, &prop[1])) rc = -1; @@ -1325,7 +1322,7 @@ virNWFilterRuleDetailsParse(virConnectPt } if (!found || rc) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("%s has illegal value %s"), att[idx].name, prop); rc = -1; @@ -1348,8 +1345,7 @@ virNWFilterRuleDetailsParse(virConnectPt static virNWFilterIncludeDefPtr -virNWFilterIncludeParse(virConnectPtr conn, - xmlNodePtr cur) +virNWFilterIncludeParse(xmlNodePtr cur) { virNWFilterIncludeDefPtr ret; @@ -1360,7 +1356,7 @@ virNWFilterIncludeParse(virConnectPtr co ret->filterref = virXMLPropString(cur, "filter"); if (!ret->filterref) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("rule node requires action attribute")); goto err_exit; @@ -1548,8 +1544,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD static virNWFilterRuleDefPtr -virNWFilterRuleParse(virConnectPtr conn, - xmlNodePtr node) +virNWFilterRuleParse(xmlNodePtr node) { char *action; char *direction; @@ -1571,28 +1566,28 @@ virNWFilterRuleParse(virConnectPtr conn, prio = virXMLPropString(node, "priority"); if (!action) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("rule node requires action attribute")); goto err_exit; } if ((ret->action = virNWFilterRuleActionTypeFromString(action)) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("unknown rule action attribute value")); goto err_exit; } if (!direction) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("rule node requires direction attribute")); goto err_exit; } if ((ret->tt = virNWFilterRuleDirectionTypeFromString(direction)) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("unknown rule direction attribute value")); goto err_exit; @@ -1624,8 +1619,7 @@ virNWFilterRuleParse(virConnectPtr conn, found = 1; ret->prtclType = virAttr[i].prtclType; - if (virNWFilterRuleDetailsParse(conn, - cur, + if (virNWFilterRuleDetailsParse(cur, ret, virAttr[i].att) < 0) { /* we ignore malformed rules @@ -1663,8 +1657,7 @@ err_exit: static virNWFilterDefPtr -virNWFilterDefParseXML(virConnectPtr conn, - xmlXPathContextPtr ctxt) { +virNWFilterDefParseXML(xmlXPathContextPtr ctxt) { virNWFilterDefPtr ret; xmlNodePtr curr = ctxt->node; char *uuid = NULL; @@ -1678,7 +1671,7 @@ virNWFilterDefParseXML(virConnectPtr con ret->name = virXPathString("string(./@name)", ctxt); if (!ret->name) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("filter has no name")); goto cleanup; } @@ -1688,7 +1681,7 @@ virNWFilterDefParseXML(virConnectPtr con if (chain) { if ((ret->chainsuffix = virNWFilterChainSuffixTypeFromString(chain)) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("unknown chain suffix '%s'"), chain); goto cleanup; } @@ -1697,13 +1690,13 @@ virNWFilterDefParseXML(virConnectPtr con uuid = virXPathString("string(./uuid)", ctxt); if (uuid == NULL) { if (virUUIDGenerate(ret->uuid) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("unable to generate uuid")); goto cleanup; } } else { if (virUUIDParse(uuid, ret->uuid) < 0) { - virNWFilterReportError(conn, VIR_ERR_XML_ERROR, + virNWFilterReportError(VIR_ERR_XML_ERROR, "%s", _("malformed uuid element")); goto cleanup; } @@ -1721,9 +1714,9 @@ virNWFilterDefParseXML(virConnectPtr con /* ignore malformed rule and include elements */ if (xmlStrEqual(curr->name, BAD_CAST "rule")) - entry->rule = virNWFilterRuleParse(conn, curr); + entry->rule = virNWFilterRuleParse(curr); else if (xmlStrEqual(curr->name, BAD_CAST "filterref")) - entry->include = virNWFilterIncludeParse(conn, curr); + entry->include = virNWFilterIncludeParse(curr); if (entry->rule || entry->include) { if (VIR_REALLOC_N(ret->filterEntries, ret->nentries+1) < 0) { @@ -1762,7 +1755,7 @@ catchXMLError (void *ctx, const char *ms conn->err.code == VIR_ERR_NONE && ctxt->lastError.level == XML_ERR_FATAL && ctxt->lastError.message != NULL) { - virNWFilterReportError(conn, VIR_ERR_XML_DETAIL, + virNWFilterReportError(VIR_ERR_XML_DETAIL, _("at line %d: %s"), ctxt->lastError.line, ctxt->lastError.message); @@ -1772,14 +1765,13 @@ catchXMLError (void *ctx, const char *ms virNWFilterDefPtr -virNWFilterDefParseNode(virConnectPtr conn, - xmlDocPtr xml, +virNWFilterDefParseNode(xmlDocPtr xml, xmlNodePtr root) { xmlXPathContextPtr ctxt = NULL; virNWFilterDefPtr def = NULL; if (STRNEQ((const char *)root->name, "filter")) { - virNWFilterReportError(conn, VIR_ERR_XML_ERROR, + virNWFilterReportError(VIR_ERR_XML_ERROR, "%s", _("unknown root element for nw filter pool")); goto cleanup; @@ -1792,7 +1784,7 @@ virNWFilterDefParseNode(virConnectPtr co } ctxt->node = root; - def = virNWFilterDefParseXML(conn, ctxt); + def = virNWFilterDefParseXML(ctxt); cleanup: xmlXPathFreeContext(ctxt); @@ -1802,8 +1794,8 @@ cleanup: static virNWFilterDefPtr virNWFilterDefParse(virConnectPtr conn, - const char *xmlStr, - const char *filename) { + const char *xmlStr, + const char *filename) { virNWFilterDefPtr ret = NULL; xmlParserCtxtPtr pctxt; xmlDocPtr xml = NULL; @@ -1830,19 +1822,19 @@ virNWFilterDefParse(virConnectPtr conn, if (!xml) { if (conn && conn->err.code == VIR_ERR_NONE) - virNWFilterReportError(conn, VIR_ERR_XML_ERROR, + virNWFilterReportError(VIR_ERR_XML_ERROR, "%s",_("failed to parse xml document")); goto cleanup; } node = xmlDocGetRootElement(xml); if (node == NULL) { - virNWFilterReportError(conn, VIR_ERR_XML_ERROR, + virNWFilterReportError(VIR_ERR_XML_ERROR, "%s", _("missing root element")); goto cleanup; } - ret = virNWFilterDefParseNode(conn, xml, node); + ret = virNWFilterDefParseNode(xml, node); xmlFreeParserCtxt (pctxt); xmlFreeDoc(xml); @@ -1858,7 +1850,7 @@ virNWFilterDefParse(virConnectPtr conn, virNWFilterDefPtr virNWFilterDefParseString(virConnectPtr conn, - const char *xmlStr) + const char *xmlStr) { return virNWFilterDefParse(conn, xmlStr, NULL); } @@ -1874,7 +1866,7 @@ virNWFilterDefParseFile(virConnectPtr co virNWFilterPoolObjPtr virNWFilterPoolObjFindByUUID(virNWFilterPoolObjListPtr pools, - const unsigned char *uuid) + const unsigned char *uuid) { unsigned int i; @@ -1891,7 +1883,7 @@ virNWFilterPoolObjFindByUUID(virNWFilter virNWFilterPoolObjPtr virNWFilterPoolObjFindByName(virNWFilterPoolObjListPtr pools, - const char *name) + const char *name) { unsigned int i; @@ -1906,8 +1898,7 @@ virNWFilterPoolObjFindByName(virNWFilter } -int virNWFilterSaveXML(virConnectPtr conn, - const char *configDir, +int virNWFilterSaveXML(const char *configDir, virNWFilterDefPtr def, const char *xml) { @@ -1916,7 +1907,7 @@ int virNWFilterSaveXML(virConnectPtr con size_t towrite; int err; - if ((configFile = virNWFilterConfigFile(conn, configDir, def->name)) == NULL) + if ((configFile = virNWFilterConfigFile(configDir, def->name)) == NULL) goto cleanup; if ((err = virFileMakePath(configDir))) { @@ -1962,17 +1953,16 @@ int virNWFilterSaveXML(virConnectPtr con } -int virNWFilterSaveConfig(virConnectPtr conn, - const char *configDir, +int virNWFilterSaveConfig(const char *configDir, virNWFilterDefPtr def) { int ret = -1; char *xml; - if (!(xml = virNWFilterDefFormat(conn, def))) + if (!(xml = virNWFilterDefFormat(def))) goto cleanup; - if (virNWFilterSaveXML(conn, configDir, def, xml)) + if (virNWFilterSaveXML(configDir, def, xml)) goto cleanup; ret = 0; @@ -2119,13 +2109,13 @@ virNWFilterTestUnassignDef(virConnectPtr virNWFilterPoolObjPtr virNWFilterPoolObjAssignDef(virConnectPtr conn, - virNWFilterPoolObjListPtr pools, - virNWFilterDefPtr def) + virNWFilterPoolObjListPtr pools, + virNWFilterDefPtr def) { virNWFilterPoolObjPtr pool; if (virNWFilterDefLoopDetect(conn, pools, def)) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("filter would introduce a loop")); return NULL; } @@ -2154,7 +2144,7 @@ virNWFilterPoolObjAssignDef(virConnectPt } if (virMutexInitRecursive(&pool->lock) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot initialize mutex")); VIR_FREE(pool); return NULL; @@ -2178,9 +2168,9 @@ virNWFilterPoolObjAssignDef(virConnectPt static virNWFilterPoolObjPtr virNWFilterPoolObjLoad(virConnectPtr conn, - virNWFilterPoolObjListPtr pools, - const char *file, - const char *path) + virNWFilterPoolObjListPtr pools, + const char *file, + const char *path) { virNWFilterDefPtr def; virNWFilterPoolObjPtr pool; @@ -2190,7 +2180,7 @@ virNWFilterPoolObjLoad(virConnectPtr con } if (!virFileMatchesNameSuffix(file, def->name, ".xml")) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("network filter pool config filename '%s' does not match pool name '%s'"), path, def->name); virNWFilterDefFree(def); @@ -2215,8 +2205,8 @@ virNWFilterPoolObjLoad(virConnectPtr con int virNWFilterPoolLoadAllConfigs(virConnectPtr conn, - virNWFilterPoolObjListPtr pools, - const char *configDir) + virNWFilterPoolObjListPtr pools, + const char *configDir) { DIR *dir; struct dirent *entry; @@ -2242,7 +2232,7 @@ virNWFilterPoolLoadAllConfigs(virConnect if (virFileBuildPath(configDir, entry->d_name, NULL, path, PATH_MAX) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("config filename '%s/%s' is too long"), configDir, entry->d_name); continue; @@ -2260,10 +2250,9 @@ virNWFilterPoolLoadAllConfigs(virConnect int -virNWFilterPoolObjSaveDef(virConnectPtr conn, - virNWFilterDriverStatePtr driver, - virNWFilterPoolObjPtr pool, - virNWFilterDefPtr def) +virNWFilterPoolObjSaveDef(virNWFilterDriverStatePtr driver, + virNWFilterPoolObjPtr pool, + virNWFilterDefPtr def) { char *xml; int fd = -1, ret = -1; @@ -2282,7 +2271,7 @@ virNWFilterPoolObjSaveDef(virConnectPtr if (virFileBuildPath(driver->configDir, def->name, ".xml", path, sizeof(path)) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot construct config file path")); return -1; } @@ -2292,8 +2281,8 @@ virNWFilterPoolObjSaveDef(virConnectPtr } } - if (!(xml = virNWFilterDefFormat(conn, def))) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + if (!(xml = virNWFilterDefFormat(def))) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("failed to generate XML")); return -1; } @@ -2335,19 +2324,18 @@ virNWFilterPoolObjSaveDef(virConnectPtr int -virNWFilterPoolObjDeleteDef(virConnectPtr conn, - virNWFilterPoolObjPtr pool) +virNWFilterPoolObjDeleteDef(virNWFilterPoolObjPtr pool) { if (!pool->configFile) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, - _("no config file for %s"), pool->def->name); + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("no config file for %s"), pool->def->name); return -1; } if (unlink(pool->configFile) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, - _("cannot remove config for %s"), - pool->def->name); + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("cannot remove config for %s"), + pool->def->name); return -1; } @@ -2369,8 +2357,7 @@ virNWIPAddressFormat(virBufferPtr buf, n static void -virNWFilterRuleDefDetailsFormat(virConnectPtr conn, - virBufferPtr buf, +virNWFilterRuleDefDetailsFormat(virBufferPtr buf, const char *type, const virXMLAttr2Struct *att, virNWFilterRuleDefPtr def) @@ -2420,7 +2407,7 @@ virNWFilterRuleDefDetailsFormat(virConne att[i].name); if (att[i].formatter) { if (!att[i].formatter(buf, def)) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("formatter for %s %s reported error"), type, att[i].name); @@ -2484,8 +2471,7 @@ err_exit: static char * -virNWFilterRuleDefFormat(virConnectPtr conn, - virNWFilterRuleDefPtr def) +virNWFilterRuleDefFormat(virNWFilterRuleDefPtr def) { int i; virBuffer buf = VIR_BUFFER_INITIALIZER; @@ -2500,8 +2486,7 @@ virNWFilterRuleDefFormat(virConnectPtr c i = 0; while (virAttr[i].id) { if (virAttr[i].prtclType == def->prtclType) { - virNWFilterRuleDefDetailsFormat(conn, - &buf2, + virNWFilterRuleDefDetailsFormat(&buf2, virAttr[i].id, virAttr[i].att, def); @@ -2563,18 +2548,16 @@ virNWFilterIncludeDefFormat(virNWFilterI static char * -virNWFilterEntryFormat(virConnectPtr conn, - virNWFilterEntryPtr entry) +virNWFilterEntryFormat(virNWFilterEntryPtr entry) { if (entry->rule) - return virNWFilterRuleDefFormat(conn, entry->rule); + return virNWFilterRuleDefFormat(entry->rule); return virNWFilterIncludeDefFormat(entry->include); } char * -virNWFilterDefFormat(virConnectPtr conn, - virNWFilterDefPtr def) +virNWFilterDefFormat(virNWFilterDefPtr def) { virBuffer buf = VIR_BUFFER_INITIALIZER; char uuid[VIR_UUID_STRING_BUFLEN]; @@ -2590,7 +2573,7 @@ virNWFilterDefFormat(virConnectPtr conn, virBufferVSprintf(&buf," <uuid>%s</uuid>\n", uuid); for (i = 0; i < def->nentries; i++) { - xml = virNWFilterEntryFormat(conn, def->filterEntries[i]); + xml = virNWFilterEntryFormat(def->filterEntries[i]); if (!xml) goto err_exit; virBufferVSprintf(&buf, "%s", xml); @@ -2613,8 +2596,7 @@ virNWFilterDefFormat(virConnectPtr conn, } -char *virNWFilterConfigFile(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *dir, +char *virNWFilterConfigFile(const char *dir, const char *name) { char *ret = NULL; Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -194,8 +194,8 @@ nwfilterLookupByUUID(virConnectPtr conn, nwfilterDriverUnlock(driver); if (!pool) { - virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, - "%s", _("no pool with matching uuid")); + virNWFilterReportError(VIR_ERR_NO_NWFILTER, + "%s", _("no pool with matching uuid")); goto cleanup; } @@ -220,8 +220,8 @@ nwfilterLookupByName(virConnectPtr conn, nwfilterDriverUnlock(driver); if (!pool) { - virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, - _("no pool with matching name '%s'"), name); + virNWFilterReportError(VIR_ERR_NO_NWFILTER, + _("no pool with matching name '%s'"), name); goto cleanup; } @@ -306,7 +306,7 @@ nwfilterDefine(virConnectPtr conn, if (!(pool = virNWFilterPoolObjAssignDef(conn, &driver->pools, def))) goto cleanup; - if (virNWFilterPoolObjSaveDef(conn, driver, pool, def) < 0) { + if (virNWFilterPoolObjSaveDef(driver, pool, def) < 0) { virNWFilterPoolObjRemove(&driver->pools, pool); def = NULL; goto cleanup; @@ -333,19 +333,19 @@ nwfilterUndefine(virNWFilterPtr obj) { nwfilterDriverLock(driver); pool = virNWFilterPoolObjFindByUUID(&driver->pools, obj->uuid); if (!pool) { - virNWFilterReportError(obj->conn, VIR_ERR_INVALID_NWFILTER, - "%s", _("no nwfilter pool with matching uuid")); + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, + "%s", _("no nwfilter pool with matching uuid")); goto cleanup; } if (virNWFilterTestUnassignDef(obj->conn, pool)) { - virNWFilterReportError(obj->conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("nwfilter is in use")); goto cleanup; } - if (virNWFilterPoolObjDeleteDef(obj->conn, pool) < 0) + if (virNWFilterPoolObjDeleteDef(pool) < 0) goto cleanup; VIR_FREE(pool->configFile); @@ -374,12 +374,12 @@ nwfilterDumpXML(virNWFilterPtr obj, nwfilterDriverUnlock(driver); if (!pool) { - virNWFilterReportError(obj->conn, VIR_ERR_INVALID_NWFILTER, - "%s", _("no nwfilter pool with matching uuid")); + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, + "%s", _("no nwfilter pool with matching uuid")); goto cleanup; } - ret = virNWFilterDefFormat(obj->conn, pool->def); + ret = virNWFilterDefFormat(pool->def); cleanup: if (pool) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -106,8 +106,7 @@ static const char *supported_protocols[] static int -printVar(virConnectPtr conn, - virNWFilterHashTablePtr vars, +printVar(virNWFilterHashTablePtr vars, char *buf, int bufsize, nwItemDescPtr item, int *done) @@ -117,14 +116,14 @@ printVar(virConnectPtr conn, if ((item->flags & NWFILTER_ENTRY_ITEM_FLAG_HAS_VAR)) { char *val = (char *)virHashLookup(vars->hashTable, item->var); if (!val) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("cannot find value for '%s'"), item->var); return 1; } if (!virStrcpy(buf, val, bufsize)) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("Buffer to small to print MAC address " "'%s' into"), item->var); @@ -138,8 +137,7 @@ printVar(virConnectPtr conn, static int -_printDataType(virConnectPtr conn, - virNWFilterHashTablePtr vars, +_printDataType(virNWFilterHashTablePtr vars, char *buf, int bufsize, nwItemDescPtr item, bool asHex) @@ -147,7 +145,7 @@ _printDataType(virConnectPtr conn, int done; char *data; - if (printVar(conn, vars, buf, bufsize, item, &done)) + if (printVar(vars, buf, bufsize, item, &done)) return 1; if (done) @@ -157,13 +155,13 @@ _printDataType(virConnectPtr conn, case DATATYPE_IPADDR: data = virSocketFormatAddr(&item->u.ipaddr.addr); if (!data) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("internal IPv4 address representation " "is bad")); return 1; } if (snprintf(buf, bufsize, "%s", data) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("buffer too small for IP address")); VIR_FREE(data); return 1; @@ -174,14 +172,14 @@ _printDataType(virConnectPtr conn, case DATATYPE_IPV6ADDR: data = virSocketFormatAddr(&item->u.ipaddr.addr); if (!data) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("internal IPv6 address representation " "is bad")); return 1; } if (snprintf(buf, bufsize, "%s", data) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("buffer too small for IPv6 address")); VIR_FREE(data); return 1; @@ -192,7 +190,7 @@ _printDataType(virConnectPtr conn, case DATATYPE_MACADDR: case DATATYPE_MACMASK: if (bufsize < VIR_MAC_STRING_BUFLEN) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for MAC address")); return 1; } @@ -204,7 +202,7 @@ _printDataType(virConnectPtr conn, case DATATYPE_IPMASK: if (snprintf(buf, bufsize, "%d", item->u.u8) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("Buffer too small for uint8 type")); return 1; } @@ -213,7 +211,7 @@ _printDataType(virConnectPtr conn, case DATATYPE_UINT16: if (snprintf(buf, bufsize, asHex ? "0x%x" : "%d", item->u.u16) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for uint16 type")); return 1; } @@ -222,14 +220,14 @@ _printDataType(virConnectPtr conn, case DATATYPE_UINT8: if (snprintf(buf, bufsize, asHex ? "0x%x" : "%d", item->u.u8) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for uint8 type")); return 1; } break; default: - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("Unhandled datatype %x"), item->datatype); return 1; break; @@ -240,22 +238,20 @@ _printDataType(virConnectPtr conn, static int -printDataType(virConnectPtr conn, - virNWFilterHashTablePtr vars, +printDataType(virNWFilterHashTablePtr vars, char *buf, int bufsize, nwItemDescPtr item) { - return _printDataType(conn, vars, buf, bufsize, item, 0); + return _printDataType(vars, buf, bufsize, item, 0); } static int -printDataTypeAsHex(virConnectPtr conn, - virNWFilterHashTablePtr vars, +printDataTypeAsHex(virNWFilterHashTablePtr vars, char *buf, int bufsize, nwItemDescPtr item) { - return _printDataType(conn, vars, buf, bufsize, item, 1); + return _printDataType(vars, buf, bufsize, item, 1); } @@ -271,8 +267,7 @@ ebiptablesRuleInstFree(ebiptablesRuleIns static int -ebiptablesAddRuleInst(virConnectPtr conn, - virNWFilterRuleInstPtr res, +ebiptablesAddRuleInst(virNWFilterRuleInstPtr res, char *commandTemplate, enum virNWFilterChainSuffixType neededChain, char chainprefix, @@ -292,21 +287,19 @@ ebiptablesAddRuleInst(virConnectPtr conn inst->priority = priority; inst->ruleType = ruleType; - return virNWFilterRuleInstAddData(conn, res, inst); + return virNWFilterRuleInstAddData(res, inst); } static int -ebtablesHandleEthHdr(virConnectPtr conn, - virBufferPtr buf, +ebtablesHandleEthHdr(virBufferPtr buf, virNWFilterHashTablePtr vars, ethHdrDataDefPtr ethHdr) { char macaddr[VIR_MAC_STRING_BUFLEN]; if (HAS_ENTRY_ITEM(&ethHdr->dataSrcMACAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &ethHdr->dataSrcMACAddr)) goto err_exit; @@ -317,8 +310,7 @@ ebtablesHandleEthHdr(virConnectPtr conn, macaddr); if (HAS_ENTRY_ITEM(&ethHdr->dataSrcMACMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &ethHdr->dataSrcMACMask)) goto err_exit; @@ -330,8 +322,7 @@ ebtablesHandleEthHdr(virConnectPtr conn, } if (HAS_ENTRY_ITEM(&ethHdr->dataDstMACAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &ethHdr->dataDstMACAddr)) goto err_exit; @@ -342,8 +333,7 @@ ebtablesHandleEthHdr(virConnectPtr conn, macaddr); if (HAS_ENTRY_ITEM(&ethHdr->dataDstMACMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &ethHdr->dataDstMACMask)) goto err_exit; @@ -365,8 +355,7 @@ ebtablesHandleEthHdr(virConnectPtr conn, /************************ iptables support ************************/ -static int iptablesLinkIPTablesBaseChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +static int iptablesLinkIPTablesBaseChain(const char *iptables_cmd, virBufferPtr buf, const char *udchain, const char *syschain, @@ -407,8 +396,7 @@ static int iptablesLinkIPTablesBaseChain } -static int iptablesCreateBaseChains(virConnectPtr conn, - const char *iptables_cmd, +static int iptablesCreateBaseChains(const char *iptables_cmd, virBufferPtr buf) { virBufferVSprintf(buf,"%s -N " VIRT_IN_CHAIN CMD_SEPARATOR @@ -419,13 +407,13 @@ static int iptablesCreateBaseChains(virC iptables_cmd, iptables_cmd, iptables_cmd); - iptablesLinkIPTablesBaseChain(conn, iptables_cmd, buf, + iptablesLinkIPTablesBaseChain(iptables_cmd, buf, VIRT_IN_CHAIN , "FORWARD", 1, 1); - iptablesLinkIPTablesBaseChain(conn, iptables_cmd, buf, + iptablesLinkIPTablesBaseChain(iptables_cmd, buf, VIRT_OUT_CHAIN , "FORWARD", 2, 1); - iptablesLinkIPTablesBaseChain(conn, iptables_cmd, buf, + iptablesLinkIPTablesBaseChain(iptables_cmd, buf, VIRT_IN_POST_CHAIN, "FORWARD", 3, 1); - iptablesLinkIPTablesBaseChain(conn, iptables_cmd, buf, + iptablesLinkIPTablesBaseChain(iptables_cmd, buf, HOST_IN_CHAIN , "INPUT" , 1, 1); return 0; @@ -433,8 +421,7 @@ static int iptablesCreateBaseChains(virC static int -iptablesCreateTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesCreateTmpRootChain(const char *iptables_cmd, virBufferPtr buf, char prefix, int incoming, const char *ifname, @@ -462,21 +449,19 @@ iptablesCreateTmpRootChain(virConnectPtr static int -iptablesCreateTmpRootChains(virConnectPtr conn, - const char *iptables_cmd, +iptablesCreateTmpRootChains(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { - iptablesCreateTmpRootChain(conn, iptables_cmd, buf, 'F', 0, ifname, 1); - iptablesCreateTmpRootChain(conn, iptables_cmd, buf, 'F', 1, ifname, 1); - iptablesCreateTmpRootChain(conn, iptables_cmd, buf, 'H', 1, ifname, 1); + iptablesCreateTmpRootChain(iptables_cmd, buf, 'F', 0, ifname, 1); + iptablesCreateTmpRootChain(iptables_cmd, buf, 'F', 1, ifname, 1); + iptablesCreateTmpRootChain(iptables_cmd, buf, 'H', 1, ifname, 1); return 0; } static int -_iptablesRemoveRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +_iptablesRemoveRootChain(const char *iptables_cmd, virBufferPtr buf, char prefix, int incoming, const char *ifname, @@ -507,60 +492,55 @@ _iptablesRemoveRootChain(virConnectPtr c static int -iptablesRemoveRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesRemoveRootChain(const char *iptables_cmd, virBufferPtr buf, char prefix, int incoming, const char *ifname) { - return _iptablesRemoveRootChain(conn, iptables_cmd, + return _iptablesRemoveRootChain(iptables_cmd, buf, prefix, incoming, ifname, 0); } static int -iptablesRemoveTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesRemoveTmpRootChain(const char *iptables_cmd, virBufferPtr buf, char prefix, int incoming, const char *ifname) { - return _iptablesRemoveRootChain(conn, iptables_cmd, buf, prefix, + return _iptablesRemoveRootChain(iptables_cmd, buf, prefix, incoming, ifname, 1); } static int -iptablesRemoveTmpRootChains(virConnectPtr conn, - const char *iptables_cmd, +iptablesRemoveTmpRootChains(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { - iptablesRemoveTmpRootChain(conn, iptables_cmd, buf, 'F', 0, ifname); - iptablesRemoveTmpRootChain(conn, iptables_cmd, buf, 'F', 1, ifname); - iptablesRemoveTmpRootChain(conn, iptables_cmd, buf, 'H', 1, ifname); + iptablesRemoveTmpRootChain(iptables_cmd, buf, 'F', 0, ifname); + iptablesRemoveTmpRootChain(iptables_cmd, buf, 'F', 1, ifname); + iptablesRemoveTmpRootChain(iptables_cmd, buf, 'H', 1, ifname); return 0; } static int -iptablesRemoveRootChains(virConnectPtr conn, - const char *iptables_cmd, +iptablesRemoveRootChains(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { - iptablesRemoveRootChain(conn, iptables_cmd, buf, 'F', 0, ifname); - iptablesRemoveRootChain(conn, iptables_cmd, buf, 'F', 1, ifname); - iptablesRemoveRootChain(conn, iptables_cmd, buf, 'H', 1, ifname); + iptablesRemoveRootChain(iptables_cmd, buf, 'F', 0, ifname); + iptablesRemoveRootChain(iptables_cmd, buf, 'F', 1, ifname); + iptablesRemoveRootChain(iptables_cmd, buf, 'H', 1, ifname); return 0; } static int -iptablesLinkTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesLinkTmpRootChain(const char *iptables_cmd, virBufferPtr buf, const char *basechain, char prefix, @@ -594,22 +574,20 @@ iptablesLinkTmpRootChain(virConnectPtr c static int -iptablesLinkTmpRootChains(virConnectPtr conn, - const char *cmd, +iptablesLinkTmpRootChains(const char *cmd, virBufferPtr buf, const char *ifname) { - iptablesLinkTmpRootChain(conn, cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname, 1); - iptablesLinkTmpRootChain(conn, cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname, 1); - iptablesLinkTmpRootChain(conn, cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname, 1); + iptablesLinkTmpRootChain(cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname, 1); + iptablesLinkTmpRootChain(cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname, 1); + iptablesLinkTmpRootChain(cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname, 1); return 0; } static int -iptablesSetupVirtInPost(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesSetupVirtInPost(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { @@ -634,8 +612,7 @@ iptablesSetupVirtInPost(virConnectPtr co static int -iptablesClearVirtInPost(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesClearVirtInPost(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { @@ -649,13 +626,12 @@ iptablesClearVirtInPost(virConnectPtr co } static int -_iptablesUnlinkRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, - virBufferPtr buf, - const char *basechain, - char prefix, - int incoming, const char *ifname, - int isTempChain) +_iptablesUnlinkRootChain(const char *iptables_cmd, + virBufferPtr buf, + const char *basechain, + char prefix, + int incoming, const char *ifname, + int isTempChain) { char chain[MAX_CHAINNAME_LENGTH]; char chainPrefix[2] = { @@ -684,61 +660,56 @@ _iptablesUnlinkRootChain(virConnectPtr c static int -iptablesUnlinkRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesUnlinkRootChain(const char *iptables_cmd, virBufferPtr buf, const char *basechain, char prefix, int incoming, const char *ifname) { - return _iptablesUnlinkRootChain(conn, iptables_cmd, buf, + return _iptablesUnlinkRootChain(iptables_cmd, buf, basechain, prefix, incoming, ifname, 0); } static int -iptablesUnlinkTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesUnlinkTmpRootChain(const char *iptables_cmd, virBufferPtr buf, const char *basechain, char prefix, int incoming, const char *ifname) { - return _iptablesUnlinkRootChain(conn, iptables_cmd, buf, + return _iptablesUnlinkRootChain(iptables_cmd, buf, basechain, prefix, incoming, ifname, 1); } static int -iptablesUnlinkRootChains(virConnectPtr conn, - const char *cmd, +iptablesUnlinkRootChains(const char *cmd, virBufferPtr buf, const char *ifname) { - iptablesUnlinkRootChain(conn, cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname); - iptablesUnlinkRootChain(conn, cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname); - iptablesUnlinkRootChain(conn, cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname); + iptablesUnlinkRootChain(cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname); + iptablesUnlinkRootChain(cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname); + iptablesUnlinkRootChain(cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname); return 0; } static int -iptablesUnlinkTmpRootChains(virConnectPtr conn, - const char *cmd, +iptablesUnlinkTmpRootChains(const char *cmd, virBufferPtr buf, const char *ifname) { - iptablesUnlinkTmpRootChain(conn, cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname); - iptablesUnlinkTmpRootChain(conn, cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname); - iptablesUnlinkTmpRootChain(conn, cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname); + iptablesUnlinkTmpRootChain(cmd, buf, VIRT_OUT_CHAIN, 'F', 0, ifname); + iptablesUnlinkTmpRootChain(cmd, buf, VIRT_IN_CHAIN , 'F', 1, ifname); + iptablesUnlinkTmpRootChain(cmd, buf, HOST_IN_CHAIN , 'H', 1, ifname); return 0; } static int -iptablesRenameTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *iptables_cmd, +iptablesRenameTmpRootChain(const char *iptables_cmd, virBufferPtr buf, char prefix, int incoming, @@ -769,21 +740,19 @@ iptablesRenameTmpRootChain(virConnectPtr static int -iptablesRenameTmpRootChains(virConnectPtr conn, - const char *iptables_cmd, +iptablesRenameTmpRootChains(const char *iptables_cmd, virBufferPtr buf, const char *ifname) { - iptablesRenameTmpRootChain(conn, iptables_cmd, buf, 'F', 0, ifname); - iptablesRenameTmpRootChain(conn, iptables_cmd, buf, 'F', 1, ifname); - iptablesRenameTmpRootChain(conn, iptables_cmd, buf, 'H', 1, ifname); + iptablesRenameTmpRootChain(iptables_cmd, buf, 'F', 0, ifname); + iptablesRenameTmpRootChain(iptables_cmd, buf, 'F', 1, ifname); + iptablesRenameTmpRootChain(iptables_cmd, buf, 'H', 1, ifname); return 0; } static void -iptablesInstCommand(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +iptablesInstCommand(virBufferPtr buf, const char *templ, char cmd, int pos, int stopOnError) { @@ -797,8 +766,7 @@ iptablesInstCommand(virConnectPtr conn A static int -iptablesHandleSrcMacAddr(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +iptablesHandleSrcMacAddr(virBufferPtr buf, virNWFilterHashTablePtr vars, nwItemDescPtr srcMacAddr, int directionIn ATTRIBUTE_UNUSED) @@ -806,8 +774,7 @@ iptablesHandleSrcMacAddr(virConnectPtr c char macaddr[VIR_MAC_STRING_BUFLEN]; if (HAS_ENTRY_ITEM(srcMacAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), srcMacAddr)) goto err_exit; @@ -828,8 +795,7 @@ err_exit: static int -iptablesHandleIpHdr(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +iptablesHandleIpHdr(virBufferPtr buf, virNWFilterHashTablePtr vars, ipHdrDataDefPtr ipHdr, int directionIn) @@ -849,8 +815,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataSrcIPAddr)) goto err_exit; @@ -863,8 +828,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &ipHdr->dataSrcIPMask)) goto err_exit; @@ -875,8 +839,7 @@ iptablesHandleIpHdr(virConnectPtr conn A } } else if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPFrom)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataSrcIPFrom)) goto err_exit; @@ -889,8 +852,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPTo)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataSrcIPTo)) goto err_exit; @@ -903,8 +865,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataDstIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataDstIPAddr)) goto err_exit; @@ -917,8 +878,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataDstIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &ipHdr->dataDstIPMask)) goto err_exit; @@ -930,8 +890,7 @@ iptablesHandleIpHdr(virConnectPtr conn A } } else if (HAS_ENTRY_ITEM(&ipHdr->dataDstIPFrom)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataDstIPFrom)) goto err_exit; @@ -944,8 +903,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataDstIPTo)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &ipHdr->dataDstIPTo)) goto err_exit; @@ -958,8 +916,7 @@ iptablesHandleIpHdr(virConnectPtr conn A if (HAS_ENTRY_ITEM(&ipHdr->dataDSCP)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &ipHdr->dataDSCP)) goto err_exit; @@ -980,8 +937,7 @@ err_exit: static int -iptablesHandlePortData(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +iptablesHandlePortData(virBufferPtr buf, virNWFilterHashTablePtr vars, portDataDefPtr portData, int directionIn) @@ -995,8 +951,7 @@ iptablesHandlePortData(virConnectPtr con } if (HAS_ENTRY_ITEM(&portData->dataSrcPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, portstr, sizeof(portstr), &portData->dataSrcPortStart)) goto err_exit; @@ -1008,8 +963,7 @@ iptablesHandlePortData(virConnectPtr con portstr); if (HAS_ENTRY_ITEM(&portData->dataSrcPortEnd)) { - if (printDataType(conn, - vars, + if (printDataType(vars, portstr, sizeof(portstr), &portData->dataSrcPortEnd)) goto err_exit; @@ -1021,8 +975,7 @@ iptablesHandlePortData(virConnectPtr con } if (HAS_ENTRY_ITEM(&portData->dataDstPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, portstr, sizeof(portstr), &portData->dataDstPortStart)) goto err_exit; @@ -1034,8 +987,7 @@ iptablesHandlePortData(virConnectPtr con portstr); if (HAS_ENTRY_ITEM(&portData->dataDstPortEnd)) { - if (printDataType(conn, - vars, + if (printDataType(vars, portstr, sizeof(portstr), &portData->dataDstPortEnd)) goto err_exit; @@ -1054,7 +1006,6 @@ err_exit: /* * _iptablesCreateRuleInstance: - * @conn : Pointer to a virConnect object * @chainPrefix : The prefix to put in front of the name of the chain * @nwfilter : The filter * @rule: The rule of the filter to convert @@ -1069,8 +1020,7 @@ err_exit: * virConnect object. */ static int -_iptablesCreateRuleInstance(virConnectPtr conn, - int directionIn, +_iptablesCreateRuleInstance(int directionIn, const char *chainPrefix, virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, @@ -1099,30 +1049,26 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p tcp"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.tcpHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.tcpHdrFilter.ipHdr, directionIn)) goto err_exit; - if (iptablesHandlePortData(conn, - &buf, + if (iptablesHandlePortData(&buf, vars, &rule->p.tcpHdrFilter.portData, directionIn)) goto err_exit; if (HAS_ENTRY_ITEM(&rule->p.tcpHdrFilter.dataTCPOption)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.tcpHdrFilter.dataTCPOption)) goto err_exit; @@ -1144,22 +1090,19 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p udp"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.udpHdrFilter.ipHdr, directionIn)) goto err_exit; - if (iptablesHandlePortData(conn, - &buf, + if (iptablesHandlePortData(&buf, vars, &rule->p.udpHdrFilter.portData, directionIn)) @@ -1175,15 +1118,13 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p udplite"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.udpliteHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.udpliteHdrFilter.ipHdr, directionIn)) @@ -1200,15 +1141,13 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p esp"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.espHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.espHdrFilter.ipHdr, directionIn)) @@ -1225,15 +1164,13 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p ah"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.ahHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.ahHdrFilter.ipHdr, directionIn)) @@ -1250,22 +1187,19 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p sctp"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.sctpHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.sctpHdrFilter.ipHdr, directionIn)) goto err_exit; - if (iptablesHandlePortData(conn, - &buf, + if (iptablesHandlePortData(&buf, vars, &rule->p.sctpHdrFilter.portData, directionIn)) @@ -1284,15 +1218,13 @@ _iptablesCreateRuleInstance(virConnectPt else virBufferAddLit(&buf, " -p icmpv6"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.icmpHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.icmpHdrFilter.ipHdr, directionIn)) @@ -1305,8 +1237,7 @@ _iptablesCreateRuleInstance(virConnectPt else parm = "--icmpv6-type"; - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.icmpHdrFilter.dataICMPType)) goto err_exit; @@ -1318,8 +1249,7 @@ _iptablesCreateRuleInstance(virConnectPt number); if (HAS_ENTRY_ITEM(&rule->p.icmpHdrFilter.dataICMPCode)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.icmpHdrFilter.dataICMPCode)) goto err_exit; @@ -1339,15 +1269,13 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p igmp"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.igmpHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.igmpHdrFilter.ipHdr, directionIn)) @@ -1364,15 +1292,13 @@ _iptablesCreateRuleInstance(virConnectPt virBufferAddLit(&buf, " -p all"); - if (iptablesHandleSrcMacAddr(conn, - &buf, + if (iptablesHandleSrcMacAddr(&buf, vars, &rule->p.allHdrFilter.dataSrcMACAddr, directionIn)) goto err_exit; - if (iptablesHandleIpHdr(conn, - &buf, + if (iptablesHandleIpHdr(&buf, vars, &rule->p.allHdrFilter.ipHdr, directionIn)) @@ -1403,8 +1329,7 @@ _iptablesCreateRuleInstance(virConnectPt return -1; } - return ebiptablesAddRuleInst(conn, - res, + return ebiptablesAddRuleInst(res, virBufferContentAndReset(&buf), nwfilter->chainsuffix, '\0', @@ -1421,8 +1346,7 @@ err_exit: static int -iptablesCreateRuleInstance(virConnectPtr conn, - virNWFilterDefPtr nwfilter, +iptablesCreateRuleInstance(virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, const char *ifname, virNWFilterHashTablePtr vars, @@ -1443,8 +1367,7 @@ iptablesCreateRuleInstance(virConnectPtr chainPrefix[0] = 'F'; chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; - rc = _iptablesCreateRuleInstance(conn, - directionIn, + rc = _iptablesCreateRuleInstance(directionIn, chainPrefix, nwfilter, rule, @@ -1459,8 +1382,7 @@ iptablesCreateRuleInstance(virConnectPtr return rc; chainPrefix[1] = CHAINPREFIX_HOST_OUT_TEMP; - rc = _iptablesCreateRuleInstance(conn, - !directionIn, + rc = _iptablesCreateRuleInstance(!directionIn, chainPrefix, nwfilter, rule, @@ -1476,8 +1398,7 @@ iptablesCreateRuleInstance(virConnectPtr chainPrefix[0] = 'H'; chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP; - rc = _iptablesCreateRuleInstance(conn, - directionIn, + rc = _iptablesCreateRuleInstance(directionIn, chainPrefix, nwfilter, rule, @@ -1498,7 +1419,6 @@ iptablesCreateRuleInstance(virConnectPtr /* * ebtablesCreateRuleInstance: - * @conn : Pointer to a virConnect object * @chainPrefix : The prefix to put in front of the name of the chain * @nwfilter : The filter * @rule: The rule of the filter to convert @@ -1513,8 +1433,7 @@ iptablesCreateRuleInstance(virConnectPtr * virConnect object. */ static int -ebtablesCreateRuleInstance(virConnectPtr conn, - char chainPrefix, +ebtablesCreateRuleInstance(char chainPrefix, virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, const char *ifname, @@ -1543,15 +1462,13 @@ ebtablesCreateRuleInstance(virConnectPtr EBTABLES_DEFAULT_TABLE, chain); - if (ebtablesHandleEthHdr(conn, - &buf, + if (ebtablesHandleEthHdr(&buf, vars, &rule->p.ethHdrFilter.ethHdr)) goto err_exit; if (HAS_ENTRY_ITEM(&rule->p.ethHdrFilter.dataProtocolID)) { - if (printDataTypeAsHex(conn, - vars, + if (printDataTypeAsHex(vars, number, sizeof(number), &rule->p.ethHdrFilter.dataProtocolID)) goto err_exit; @@ -1568,8 +1485,7 @@ ebtablesCreateRuleInstance(virConnectPtr CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", EBTABLES_DEFAULT_TABLE, chain); - if (ebtablesHandleEthHdr(conn, - &buf, + if (ebtablesHandleEthHdr(&buf, vars, &rule->p.arpHdrFilter.ethHdr)) goto err_exit; @@ -1577,10 +1493,9 @@ ebtablesCreateRuleInstance(virConnectPtr virBufferAddLit(&buf, " -p arp"); if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataHWType)) { - if (printDataType(conn, - vars, - number, sizeof(number), - &rule->p.arpHdrFilter.dataHWType)) + if (printDataType(vars, + number, sizeof(number), + &rule->p.arpHdrFilter.dataHWType)) goto err_exit; virBufferVSprintf(&buf, " --arp-htype %s %s", @@ -1589,8 +1504,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataOpcode)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.arpHdrFilter.dataOpcode)) goto err_exit; @@ -1601,8 +1515,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataProtocolType)) { - if (printDataTypeAsHex(conn, - vars, + if (printDataTypeAsHex(vars, number, sizeof(number), &rule->p.arpHdrFilter.dataProtocolType)) goto err_exit; @@ -1613,8 +1526,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPSrcIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &rule->p.arpHdrFilter.dataARPSrcIPAddr)) goto err_exit; @@ -1626,8 +1538,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPDstIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &rule->p.arpHdrFilter.dataARPDstIPAddr)) goto err_exit; @@ -1639,8 +1550,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPSrcMACAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &rule->p.arpHdrFilter.dataARPSrcMACAddr)) goto err_exit; @@ -1652,8 +1562,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.arpHdrFilter.dataARPDstMACAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, macaddr, sizeof(macaddr), &rule->p.arpHdrFilter.dataARPDstMACAddr)) goto err_exit; @@ -1670,8 +1579,7 @@ ebtablesCreateRuleInstance(virConnectPtr CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", EBTABLES_DEFAULT_TABLE, chain); - if (ebtablesHandleEthHdr(conn, - &buf, + if (ebtablesHandleEthHdr(&buf, vars, &rule->p.ipHdrFilter.ethHdr)) goto err_exit; @@ -1680,8 +1588,7 @@ ebtablesCreateRuleInstance(virConnectPtr " -p ipv4"); if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataSrcIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &rule->p.ipHdrFilter.ipHdr.dataSrcIPAddr)) goto err_exit; @@ -1692,8 +1599,7 @@ ebtablesCreateRuleInstance(virConnectPtr ipaddr); if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataSrcIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.ipHdr.dataSrcIPMask)) goto err_exit; @@ -1705,8 +1611,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataDstIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipaddr, sizeof(ipaddr), &rule->p.ipHdrFilter.ipHdr.dataDstIPAddr)) goto err_exit; @@ -1717,8 +1622,7 @@ ebtablesCreateRuleInstance(virConnectPtr ipaddr); if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataDstIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.ipHdr.dataDstIPMask)) goto err_exit; @@ -1729,8 +1633,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataProtocolID)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.ipHdr.dataProtocolID)) goto err_exit; @@ -1743,8 +1646,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.portData.dataSrcPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.portData.dataSrcPortStart)) goto err_exit; @@ -1755,8 +1657,7 @@ ebtablesCreateRuleInstance(virConnectPtr number); if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.portData.dataSrcPortEnd)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.portData.dataSrcPortEnd)) goto err_exit; @@ -1769,8 +1670,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.portData.dataDstPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.portData.dataDstPortStart)) goto err_exit; @@ -1781,8 +1681,7 @@ ebtablesCreateRuleInstance(virConnectPtr number); if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.portData.dataDstPortEnd)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.portData.dataDstPortEnd)) goto err_exit; @@ -1794,8 +1693,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.ipHdrFilter.ipHdr.dataDSCP)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipHdrFilter.ipHdr.dataDSCP)) goto err_exit; @@ -1812,8 +1710,7 @@ ebtablesCreateRuleInstance(virConnectPtr CMD_DEF_PRE EBTABLES_CMD " -t %s -%%c %s %%s", EBTABLES_DEFAULT_TABLE, chain); - if (ebtablesHandleEthHdr(conn, - &buf, + if (ebtablesHandleEthHdr(&buf, vars, &rule->p.ipv6HdrFilter.ethHdr)) goto err_exit; @@ -1822,8 +1719,7 @@ ebtablesCreateRuleInstance(virConnectPtr " -p ipv6"); if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.ipHdr.dataSrcIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipv6addr, sizeof(ipv6addr), &rule->p.ipv6HdrFilter.ipHdr.dataSrcIPAddr)) goto err_exit; @@ -1834,8 +1730,7 @@ ebtablesCreateRuleInstance(virConnectPtr ipv6addr); if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.ipHdr.dataSrcIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.ipHdr.dataSrcIPMask)) goto err_exit; @@ -1847,8 +1742,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.ipHdr.dataDstIPAddr)) { - if (printDataType(conn, - vars, + if (printDataType(vars, ipv6addr, sizeof(ipv6addr), &rule->p.ipv6HdrFilter.ipHdr.dataDstIPAddr)) goto err_exit; @@ -1859,8 +1753,7 @@ ebtablesCreateRuleInstance(virConnectPtr ipv6addr); if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.ipHdr.dataDstIPMask)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.ipHdr.dataDstIPMask)) goto err_exit; @@ -1871,8 +1764,7 @@ ebtablesCreateRuleInstance(virConnectPtr } if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.ipHdr.dataProtocolID)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.ipHdr.dataProtocolID)) goto err_exit; @@ -1885,8 +1777,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.portData.dataSrcPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.portData.dataSrcPortStart)) goto err_exit; @@ -1897,8 +1788,7 @@ ebtablesCreateRuleInstance(virConnectPtr number); if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.portData.dataSrcPortEnd)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.portData.dataSrcPortEnd)) goto err_exit; @@ -1911,8 +1801,7 @@ ebtablesCreateRuleInstance(virConnectPtr if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.portData.dataDstPortStart)) { - if (printDataType(conn, - vars, + if (printDataType(vars, number, sizeof(number), &rule->p.ipv6HdrFilter.portData.dataDstPortStart)) goto err_exit; @@ -1923,10 +1812,9 @@ ebtablesCreateRuleInstance(virConnectPtr number); if (HAS_ENTRY_ITEM(&rule->p.ipv6HdrFilter.portData.dataDstPortEnd)) { - if (printDataType(conn, - vars, - number, sizeof(number), - &rule->p.ipv6HdrFilter.portData.dataDstPortEnd)) + if (printDataType(vars, + number, sizeof(number), + &rule->p.ipv6HdrFilter.portData.dataDstPortEnd)) goto err_exit; virBufferVSprintf(&buf, @@ -1957,8 +1845,7 @@ ebtablesCreateRuleInstance(virConnectPtr return -1; } - return ebiptablesAddRuleInst(conn, - res, + return ebiptablesAddRuleInst(res, virBufferContentAndReset(&buf), nwfilter->chainsuffix, chainPrefix, @@ -1988,7 +1875,7 @@ err_exit: * virConnect object. */ static int -ebiptablesCreateRuleInstance(virConnectPtr conn, +ebiptablesCreateRuleInstance(virConnectPtr conn ATTRIBUTE_UNUSED, enum virDomainNetType nettype, virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, @@ -2008,8 +1895,7 @@ ebiptablesCreateRuleInstance(virConnectP if (rule->tt == VIR_NWFILTER_RULE_DIRECTION_OUT || rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT) { - rc = ebtablesCreateRuleInstance(conn, - CHAINPREFIX_HOST_IN_TEMP, + rc = ebtablesCreateRuleInstance(CHAINPREFIX_HOST_IN_TEMP, nwfilter, rule, ifname, @@ -2021,8 +1907,7 @@ ebiptablesCreateRuleInstance(virConnectP if (rule->tt == VIR_NWFILTER_RULE_DIRECTION_IN || rule->tt == VIR_NWFILTER_RULE_DIRECTION_INOUT) { - rc = ebtablesCreateRuleInstance(conn, - CHAINPREFIX_HOST_OUT_TEMP, + rc = ebtablesCreateRuleInstance(CHAINPREFIX_HOST_OUT_TEMP, nwfilter, rule, ifname, @@ -2041,15 +1926,14 @@ ebiptablesCreateRuleInstance(virConnectP case VIR_NWFILTER_RULE_PROTOCOL_IGMP: case VIR_NWFILTER_RULE_PROTOCOL_ALL: if (nettype == VIR_DOMAIN_NET_TYPE_DIRECT) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("'%s' protocol not support for net type '%s'"), virNWFilterRuleProtocolTypeToString(rule->prtclType), virDomainNetTypeToString(nettype)); return 1; } isIPv6 = 0; - rc = iptablesCreateRuleInstance(conn, - nwfilter, + rc = iptablesCreateRuleInstance(nwfilter, rule, ifname, vars, @@ -2066,15 +1950,14 @@ ebiptablesCreateRuleInstance(virConnectP case VIR_NWFILTER_RULE_PROTOCOL_ICMPV6: case VIR_NWFILTER_RULE_PROTOCOL_ALLoIPV6: if (nettype == VIR_DOMAIN_NET_TYPE_DIRECT) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, _("'%s' protocol not support for net type '%s'"), virNWFilterRuleProtocolTypeToString(rule->prtclType), virDomainNetTypeToString(nettype)); return 1; } isIPv6 = 1; - rc = iptablesCreateRuleInstance(conn, - nwfilter, + rc = iptablesCreateRuleInstance(nwfilter, rule, ifname, vars, @@ -2083,7 +1966,7 @@ ebiptablesCreateRuleInstance(virConnectP break; case VIR_NWFILTER_RULE_PROTOCOL_LAST: - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(VIR_ERR_INVALID_NWFILTER, "%s", _("illegal protocol type")); rc = 1; break; @@ -2115,7 +1998,6 @@ ebiptablesDisplayRuleInstance(virConnect /** * ebiptablesWriteToTempFile: - * @conn: pointer to virConnect object * @string : the string to write into the file * * Returns the tempory filename where the string was written into, @@ -2128,8 +2010,7 @@ ebiptablesDisplayRuleInstance(virConnect * set so that the file can be run as an executable script. */ static char * -ebiptablesWriteToTempFile(virConnectPtr conn, - const char *string) { +ebiptablesWriteToTempFile(const char *string) { char filename[] = "/tmp/virtdXXXXXX"; int len; char *filnam; @@ -2139,14 +2020,14 @@ ebiptablesWriteToTempFile(virConnectPtr int fd = mkstemp(filename); if (fd < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot create temporary file")); return NULL; } if (fchmod(fd, S_IXUSR| S_IRUSR | S_IWUSR) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot change permissions on temp. file")); goto err_exit; @@ -2155,7 +2036,7 @@ ebiptablesWriteToTempFile(virConnectPtr len = strlen(header); written = safewrite(fd, header, len); if (written != len) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot write string to file")); goto err_exit; @@ -2164,7 +2045,7 @@ ebiptablesWriteToTempFile(virConnectPtr len = strlen(string); written = safewrite(fd, string, len); if (written != len) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("cannot write string to file")); goto err_exit; @@ -2188,7 +2069,6 @@ err_exit: /** * ebiptablesExecCLI: - * @conn : pointer to virConnect object * @buf : pointer to virBuffer containing the string with the commands to * execute. * @status: Pointer to an integer for returning the status of the @@ -2202,8 +2082,7 @@ err_exit: * script and return the status of the execution. */ static int -ebiptablesExecCLI(virConnectPtr conn, - virBufferPtr buf, +ebiptablesExecCLI(virBufferPtr buf, int *status) { char *cmds; @@ -2226,7 +2105,7 @@ ebiptablesExecCLI(virConnectPtr conn, if (!cmds) return 0; - filename = ebiptablesWriteToTempFile(conn, cmds); + filename = ebiptablesWriteToTempFile(cmds); VIR_FREE(cmds); if (!filename) @@ -2248,8 +2127,7 @@ ebiptablesExecCLI(virConnectPtr conn, static int -ebtablesCreateTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +ebtablesCreateTmpRootChain(virBufferPtr buf, int incoming, const char *ifname, int stopOnError) { @@ -2271,8 +2149,7 @@ ebtablesCreateTmpRootChain(virConnectPtr static int -ebtablesLinkTmpRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +ebtablesLinkTmpRootChain(virBufferPtr buf, int incoming, const char *ifname, int stopOnError) { @@ -2299,8 +2176,7 @@ ebtablesLinkTmpRootChain(virConnectPtr c static int -_ebtablesRemoveRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +_ebtablesRemoveRootChain(virBufferPtr buf, int incoming, const char *ifname, int isTempChain) { @@ -2326,26 +2202,23 @@ _ebtablesRemoveRootChain(virConnectPtr c static int -ebtablesRemoveRootChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesRemoveRootChain(virBufferPtr buf, int incoming, const char *ifname) { - return _ebtablesRemoveRootChain(conn, buf, incoming, ifname, 0); + return _ebtablesRemoveRootChain(buf, incoming, ifname, 0); } static int -ebtablesRemoveTmpRootChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesRemoveTmpRootChain(virBufferPtr buf, int incoming, const char *ifname) { - return _ebtablesRemoveRootChain(conn, buf, incoming, ifname, 1); + return _ebtablesRemoveRootChain(buf, incoming, ifname, 1); } static int -_ebtablesUnlinkRootChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +_ebtablesUnlinkRootChain(virBufferPtr buf, int incoming, const char *ifname, int isTempChain) { @@ -2375,26 +2248,23 @@ _ebtablesUnlinkRootChain(virConnectPtr c static int -ebtablesUnlinkRootChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesUnlinkRootChain(virBufferPtr buf, int incoming, const char *ifname) { - return _ebtablesUnlinkRootChain(conn, buf, incoming, ifname, 0); + return _ebtablesUnlinkRootChain(buf, incoming, ifname, 0); } static int -ebtablesUnlinkTmpRootChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesUnlinkTmpRootChain(virBufferPtr buf, int incoming, const char *ifname) { - return _ebtablesUnlinkRootChain(conn, buf, incoming, ifname, 1); + return _ebtablesUnlinkRootChain(buf, incoming, ifname, 1); } static int -ebtablesCreateTmpSubChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +ebtablesCreateTmpSubChain(virBufferPtr buf, int incoming, const char *ifname, const char *protocol, @@ -2430,8 +2300,7 @@ ebtablesCreateTmpSubChain(virConnectPtr static int -_ebtablesRemoveSubChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +_ebtablesRemoveSubChain(virBufferPtr buf, int incoming, const char *ifname, const char *protocol, @@ -2467,26 +2336,24 @@ _ebtablesRemoveSubChain(virConnectPtr co static int -ebtablesRemoveSubChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesRemoveSubChain(virBufferPtr buf, int incoming, const char *ifname, const char *protocol) { - return _ebtablesRemoveSubChain(conn, buf, + return _ebtablesRemoveSubChain(buf, incoming, ifname, protocol, 0); } static int -ebtablesRemoveSubChains(virConnectPtr conn, - virBufferPtr buf, - const char *ifname) +ebtablesRemoveSubChains(virBufferPtr buf, + const char *ifname) { int i; for (i = 0; supported_protocols[i]; i++) { - ebtablesRemoveSubChain(conn, buf, 1, ifname, supported_protocols[i]); - ebtablesRemoveSubChain(conn, buf, 0, ifname, supported_protocols[i]); + ebtablesRemoveSubChain(buf, 1, ifname, supported_protocols[i]); + ebtablesRemoveSubChain(buf, 0, ifname, supported_protocols[i]); } return 0; @@ -2494,27 +2361,25 @@ ebtablesRemoveSubChains(virConnectPtr co static int -ebtablesRemoveTmpSubChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesRemoveTmpSubChain(virBufferPtr buf, int incoming, const char *ifname, const char *protocol) { - return _ebtablesRemoveSubChain(conn, buf, + return _ebtablesRemoveSubChain(buf, incoming, ifname, protocol, 1); } static int -ebtablesRemoveTmpSubChains(virConnectPtr conn, - virBufferPtr buf, +ebtablesRemoveTmpSubChains(virBufferPtr buf, const char *ifname) { int i; for (i = 0; supported_protocols[i]; i++) { - ebtablesRemoveTmpSubChain(conn, buf, 1, ifname, + ebtablesRemoveTmpSubChain(buf, 1, ifname, supported_protocols[i]); - ebtablesRemoveTmpSubChain(conn, buf, 0, ifname, + ebtablesRemoveTmpSubChain(buf, 0, ifname, supported_protocols[i]); } @@ -2523,8 +2388,7 @@ ebtablesRemoveTmpSubChains(virConnectPtr static int -ebtablesRenameTmpSubChain(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +ebtablesRenameTmpSubChain(virBufferPtr buf, int incoming, const char *ifname, const char *protocol) @@ -2553,15 +2417,14 @@ ebtablesRenameTmpSubChain(virConnectPtr static int -ebtablesRenameTmpSubChains(virConnectPtr conn, - virBufferPtr buf, +ebtablesRenameTmpSubChains(virBufferPtr buf, const char *ifname) { int i; for (i = 0; supported_protocols[i]; i++) { - ebtablesRenameTmpSubChain (conn, buf, 1, ifname, + ebtablesRenameTmpSubChain (buf, 1, ifname, supported_protocols[i]); - ebtablesRenameTmpSubChain (conn, buf, 0, ifname, + ebtablesRenameTmpSubChain (buf, 0, ifname, supported_protocols[i]); } @@ -2570,18 +2433,16 @@ ebtablesRenameTmpSubChains(virConnectPtr static int -ebtablesRenameTmpRootChain(virConnectPtr conn, - virBufferPtr buf, +ebtablesRenameTmpRootChain(virBufferPtr buf, int incoming, const char *ifname) { - return ebtablesRenameTmpSubChain(conn, buf, incoming, ifname, NULL); + return ebtablesRenameTmpSubChain(buf, incoming, ifname, NULL); } static void -ebiptablesInstCommand(virConnectPtr conn ATTRIBUTE_UNUSED, - virBufferPtr buf, +ebiptablesInstCommand(virBufferPtr buf, const char *templ, char cmd, int pos, int stopOnError) { @@ -2604,7 +2465,7 @@ ebiptablesRuleOrderSort(const void *a, c static int -ebiptablesApplyNewRules(virConnectPtr conn, +ebiptablesApplyNewRules(virConnectPtr conn ATTRIBUTE_UNUSED, const char *ifname, int nruleInstances, void **_inst) @@ -2630,41 +2491,41 @@ ebiptablesApplyNewRules(virConnectPtr co } } - ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); - ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); - ebtablesRemoveTmpSubChains(conn, &buf, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + ebtablesUnlinkTmpRootChain(&buf, 1, ifname); + ebtablesUnlinkTmpRootChain(&buf, 0, ifname); + ebtablesRemoveTmpSubChains(&buf, ifname); + ebtablesRemoveTmpRootChain(&buf, 1, ifname); + ebtablesRemoveTmpRootChain(&buf, 0, ifname); + ebiptablesExecCLI(&buf, &cli_status); if (chains_in != 0) - ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + ebtablesCreateTmpRootChain(&buf, 1, ifname, 1); if (chains_out != 0) - ebtablesCreateTmpRootChain(conn, &buf, 0, ifname, 1); + ebtablesCreateTmpRootChain(&buf, 0, ifname, 1); if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4)) - ebtablesCreateTmpSubChain(conn, &buf, 1, ifname, "ipv4", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, "ipv4", 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv4)) - ebtablesCreateTmpSubChain(conn, &buf, 0, ifname, "ipv4", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, "ipv4", 1); if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv6)) - ebtablesCreateTmpSubChain(conn, &buf, 1, ifname, "ipv6", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, "ipv6", 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_IPv6)) - ebtablesCreateTmpSubChain(conn, &buf, 0, ifname, "ipv6", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, "ipv6", 1); // keep arp as last if (chains_in & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP)) - ebtablesCreateTmpSubChain(conn, &buf, 1, ifname, "arp", 1); + ebtablesCreateTmpSubChain(&buf, 1, ifname, "arp", 1); if (chains_out & (1 << VIR_NWFILTER_CHAINSUFFIX_ARP)) - ebtablesCreateTmpSubChain(conn, &buf, 0, ifname, "arp", 1); + ebtablesCreateTmpSubChain(&buf, 0, ifname, "arp", 1); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpebchains; for (i = 0; i < nruleInstances; i++) switch (inst[i]->ruleType) { case RT_EBTABLES: - ebiptablesInstCommand(conn, &buf, + ebiptablesInstCommand(&buf, inst[i]->commandTemplate, 'A', -1, 1); break; @@ -2676,68 +2537,68 @@ ebiptablesApplyNewRules(virConnectPtr co break; } - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpebchains; // FIXME: establishment of iptables user define table tree goes here if (haveIptables) { - iptablesUnlinkTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IPTABLES_CMD, &buf, ifname); - iptablesCreateBaseChains(conn, IPTABLES_CMD, &buf); + iptablesCreateBaseChains(IPTABLES_CMD, &buf); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpebchains; - iptablesCreateTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesCreateTmpRootChains(IPTABLES_CMD, &buf, ifname); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; - iptablesLinkTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesSetupVirtInPost(conn, IPTABLES_CMD, &buf, ifname); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + iptablesLinkTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesSetupVirtInPost(IPTABLES_CMD, &buf, ifname); + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; for (i = 0; i < nruleInstances; i++) { if (inst[i]->ruleType == RT_IPTABLES) - iptablesInstCommand(conn, &buf, + iptablesInstCommand(&buf, inst[i]->commandTemplate, 'A', -1, 1); } - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; } if (haveIp6tables) { - iptablesUnlinkTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IP6TABLES_CMD, &buf, ifname); - iptablesCreateBaseChains(conn, IP6TABLES_CMD, &buf); + iptablesCreateBaseChains(IP6TABLES_CMD, &buf); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpiptchains; - iptablesCreateTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesCreateTmpRootChains(IP6TABLES_CMD, &buf, ifname); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpip6tchains; - iptablesLinkTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesSetupVirtInPost(conn, IP6TABLES_CMD, &buf, ifname); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + iptablesLinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesSetupVirtInPost(IP6TABLES_CMD, &buf, ifname); + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpip6tchains; for (i = 0; i < nruleInstances; i++) { if (inst[i]->ruleType == RT_IP6TABLES) - iptablesInstCommand(conn, &buf, + iptablesInstCommand(&buf, inst[i]->commandTemplate, 'A', -1, 1); } - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_tmpip6tchains; } @@ -2745,39 +2606,39 @@ ebiptablesApplyNewRules(virConnectPtr co // END IPTABLES stuff if (chains_in != 0) - ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + ebtablesLinkTmpRootChain(&buf, 1, ifname, 1); if (chains_out != 0) - ebtablesLinkTmpRootChain(conn, &buf, 0, ifname, 1); + ebtablesLinkTmpRootChain(&buf, 0, ifname, 1); - if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + if (ebiptablesExecCLI(&buf, &cli_status) || cli_status != 0) goto tear_down_ebsubchains_and_unlink; return 0; tear_down_ebsubchains_and_unlink: - ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); - ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesUnlinkTmpRootChain(&buf, 1, ifname); + ebtablesUnlinkTmpRootChain(&buf, 0, ifname); tear_down_tmpip6tchains: if (haveIp6tables) { - iptablesUnlinkTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IP6TABLES_CMD, &buf, ifname); } tear_down_tmpiptchains: if (haveIptables) { - iptablesUnlinkTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IPTABLES_CMD, &buf, ifname); } tear_down_tmpebchains: - ebtablesRemoveTmpSubChains(conn, &buf, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(&buf, ifname); + ebtablesRemoveTmpRootChain(&buf, 1, ifname); + ebtablesRemoveTmpRootChain(&buf, 0, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + ebiptablesExecCLI(&buf, &cli_status); - virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + virNWFilterReportError(VIR_ERR_BUILD_FIREWALL, "%s", _("Some rules could not be created.")); @@ -2786,64 +2647,64 @@ tear_down_tmpebchains: static int -ebiptablesTearNewRules(virConnectPtr conn, +ebiptablesTearNewRules(virConnectPtr conn ATTRIBUTE_UNUSED, const char *ifname) { int cli_status; virBuffer buf = VIR_BUFFER_INITIALIZER; - iptablesUnlinkTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IPTABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IPTABLES_CMD, &buf, ifname); - iptablesUnlinkTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesRemoveTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkTmpRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesRemoveTmpRootChains(IP6TABLES_CMD, &buf, ifname); - ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); - ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesUnlinkTmpRootChain(&buf, 1, ifname); + ebtablesUnlinkTmpRootChain(&buf, 0, ifname); - ebtablesRemoveTmpSubChains(conn, &buf, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); - ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(&buf, ifname); + ebtablesRemoveTmpRootChain(&buf, 1, ifname); + ebtablesRemoveTmpRootChain(&buf, 0, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + ebiptablesExecCLI(&buf, &cli_status); return 0; } static int -ebiptablesTearOldRules(virConnectPtr conn, +ebiptablesTearOldRules(virConnectPtr conn ATTRIBUTE_UNUSED, const char *ifname) { int cli_status; virBuffer buf = VIR_BUFFER_INITIALIZER; // switch to new iptables user defined chains - iptablesUnlinkRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesUnlinkRootChains(IPTABLES_CMD, &buf, ifname); + iptablesRemoveRootChains(IPTABLES_CMD, &buf, ifname); - iptablesRenameTmpRootChains(conn, IPTABLES_CMD, &buf, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + iptablesRenameTmpRootChains(IPTABLES_CMD, &buf, ifname); + ebiptablesExecCLI(&buf, &cli_status); - iptablesUnlinkRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesRemoveRootChains(IP6TABLES_CMD, &buf, ifname); - iptablesRenameTmpRootChains(conn, IP6TABLES_CMD, &buf, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + iptablesRenameTmpRootChains(IP6TABLES_CMD, &buf, ifname); + ebiptablesExecCLI(&buf, &cli_status); - ebtablesUnlinkRootChain(conn, &buf, 1, ifname); - ebtablesUnlinkRootChain(conn, &buf, 0, ifname); + ebtablesUnlinkRootChain(&buf, 1, ifname); + ebtablesUnlinkRootChain(&buf, 0, ifname); - ebtablesRemoveSubChains(conn, &buf, ifname); + ebtablesRemoveSubChains(&buf, ifname); - ebtablesRemoveRootChain(conn, &buf, 1, ifname); - ebtablesRemoveRootChain(conn, &buf, 0, ifname); + ebtablesRemoveRootChain(&buf, 1, ifname); + ebtablesRemoveRootChain(&buf, 0, ifname); - ebtablesRenameTmpSubChains(conn, &buf, ifname); - ebtablesRenameTmpRootChain(conn, &buf, 1, ifname); - ebtablesRenameTmpRootChain(conn, &buf, 0, ifname); + ebtablesRenameTmpSubChains(&buf, ifname); + ebtablesRenameTmpRootChain(&buf, 1, ifname); + ebtablesRenameTmpRootChain(&buf, 0, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + ebiptablesExecCLI(&buf, &cli_status); return 0; } @@ -2862,7 +2723,7 @@ ebiptablesTearOldRules(virConnectPtr con * commands failed. */ static int -ebiptablesRemoveRules(virConnectPtr conn, +ebiptablesRemoveRules(virConnectPtr conn ATTRIBUTE_UNUSED, const char *ifname ATTRIBUTE_UNUSED, int nruleInstances, void **_inst) @@ -2874,16 +2735,16 @@ ebiptablesRemoveRules(virConnectPtr conn ebiptablesRuleInstPtr *inst = (ebiptablesRuleInstPtr *)_inst; for (i = 0; i < nruleInstances; i++) - ebiptablesInstCommand(conn, &buf, + ebiptablesInstCommand(&buf, inst[i]->commandTemplate, 'D', -1, 0); - if (ebiptablesExecCLI(conn, &buf, &cli_status)) + if (ebiptablesExecCLI(&buf, &cli_status)) goto err_exit; if (cli_status) { - virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + virNWFilterReportError(VIR_ERR_BUILD_FIREWALL, "%s", _("error while executing CLI commands")); rc = 1; @@ -2908,25 +2769,24 @@ ebiptablesAllTeardown(const char *ifname { virBuffer buf = VIR_BUFFER_INITIALIZER; int cli_status; - virConnectPtr conn = NULL; - iptablesUnlinkRootChains(conn, IPTABLES_CMD, &buf, ifname); - iptablesClearVirtInPost (conn, IPTABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(conn, IPTABLES_CMD, &buf, ifname); + iptablesUnlinkRootChains(IPTABLES_CMD, &buf, ifname); + iptablesClearVirtInPost (IPTABLES_CMD, &buf, ifname); + iptablesRemoveRootChains(IPTABLES_CMD, &buf, ifname); - iptablesUnlinkRootChains(conn, IP6TABLES_CMD, &buf, ifname); - iptablesClearVirtInPost (conn, IP6TABLES_CMD, &buf, ifname); - iptablesRemoveRootChains(conn, IP6TABLES_CMD, &buf, ifname); + iptablesUnlinkRootChains(IP6TABLES_CMD, &buf, ifname); + iptablesClearVirtInPost (IP6TABLES_CMD, &buf, ifname); + iptablesRemoveRootChains(IP6TABLES_CMD, &buf, ifname); - ebtablesUnlinkRootChain(conn, &buf, 1, ifname); - ebtablesUnlinkRootChain(conn, &buf, 0, ifname); + ebtablesUnlinkRootChain(&buf, 1, ifname); + ebtablesUnlinkRootChain(&buf, 0, ifname); - ebtablesRemoveRootChain(conn, &buf, 1, ifname); - ebtablesRemoveRootChain(conn, &buf, 0, ifname); + ebtablesRemoveRootChain(&buf, 1, ifname); + ebtablesRemoveRootChain(&buf, 0, ifname); - ebtablesRemoveSubChains(conn, &buf, ifname); + ebtablesRemoveSubChains(&buf, ifname); - ebiptablesExecCLI(conn, &buf, &cli_status); + ebiptablesExecCLI(&buf, &cli_status); return 0; } Index: libvirt-acl/src/conf/nwfilter_params.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.c +++ libvirt-acl/src/conf/nwfilter_params.c @@ -153,7 +153,6 @@ virNWFilterHashTableRemoveEntry(virNWFil struct addToTableStruct { virNWFilterHashTablePtr target; int errOccurred; - virConnectPtr conn; }; @@ -174,7 +173,7 @@ addToTable(void *payload, const char *na } if (virNWFilterHashTablePut(atts->target, name, val, 1) != 0) { - virNWFilterReportError(atts->conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Could not put variable '%s' into hashmap"), name); atts->errOccurred = 1; @@ -184,14 +183,12 @@ addToTable(void *payload, const char *na int -virNWFilterHashTablePutAll(virConnectPtr conn, - virNWFilterHashTablePtr src, +virNWFilterHashTablePutAll(virNWFilterHashTablePtr src, virNWFilterHashTablePtr dest) { struct addToTableStruct atts = { .target = dest, .errOccurred = 0, - .conn = conn, }; virHashForEach(src->hashTable, addToTable, &atts); Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -39,7 +39,7 @@ static int testCompareXMLToXMLFiles(cons if (!(dev = virNWFilterDefParseString(NULL, inXmlData))) goto fail; - if (!(actual = virNWFilterDefFormat(NULL, dev))) + if (!(actual = virNWFilterDefFormat(dev))) goto fail; if (STRNEQ(outXmlData, actual)) { Index: libvirt-acl/src/conf/nwfilter_params.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.h +++ libvirt-acl/src/conf/nwfilter_params.h @@ -46,8 +46,7 @@ int virNWFilterHashTablePut(virNWFilterH int freeName); int virNWFilterHashTableRemoveEntry(virNWFilterHashTablePtr table, const char *name); -int virNWFilterHashTablePutAll(virConnectPtr conn, - virNWFilterHashTablePtr src, +int virNWFilterHashTablePutAll(virNWFilterHashTablePtr src, virNWFilterHashTablePtr dest); # define VALID_VARNAME \ Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -62,7 +62,6 @@ virNWFilterTechDriverForName(const char /** * virNWFilterRuleInstAddData: - * @conn : pointer to virConnect object * @res : pointer to virNWFilterRuleInst object collecting the instantiation * data of a single firewall rule. * @data : the opaque data that the driver wants to add @@ -77,8 +76,7 @@ virNWFilterTechDriverForName(const char * message attached to the virConnect object. */ int -virNWFilterRuleInstAddData(virConnectPtr conn ATTRIBUTE_UNUSED, - virNWFilterRuleInstPtr res, +virNWFilterRuleInstAddData(virNWFilterRuleInstPtr res, void *data) { if (VIR_REALLOC_N(res->data, res->ndata+1) < 0) { @@ -107,7 +105,6 @@ virNWFilterRuleInstFree(virNWFilterRuleI /** * virNWFilterVarHashmapAddStdValues: - * @conn: Poijter to virConnect object * @tables: pointer to hash tabel to add values to * @macaddr: The string of the MAC address to add to the hash table, * may be NULL @@ -118,15 +115,14 @@ virNWFilterRuleInstFree(virNWFilterRuleI * Adds a couple of standard keys (MAC, IP) to the hash table. */ static int -virNWFilterVarHashmapAddStdValues(virConnectPtr conn, - virNWFilterHashTablePtr table, +virNWFilterVarHashmapAddStdValues(virNWFilterHashTablePtr table, char *macaddr) { if (macaddr) { if (virHashAddEntry(table->hashTable, NWFILTER_STD_VAR_MAC, macaddr) < 0) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("Could not add variable 'MAC' to hashmap")); return 1; } @@ -138,7 +134,6 @@ virNWFilterVarHashmapAddStdValues(virCon /** * virNWFilterCreateVarHashmap: - * @conn: pointer to virConnect object * @macaddr: pointer to string containing formatted MAC address of interface * * Create a hashmap used for evaluating the firewall rules. Initializes @@ -148,15 +143,14 @@ virNWFilterVarHashmapAddStdValues(virCon * is attached to the virConnect object. */ virNWFilterHashTablePtr -virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr) { +virNWFilterCreateVarHashmap(char *macaddr) { virNWFilterHashTablePtr table = virNWFilterHashTableCreate(0); if (!table) { virReportOOMError(); return NULL; } - if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr)) { + if (virNWFilterVarHashmapAddStdValues(table, macaddr)) { virNWFilterHashTableFree(table); return NULL; } @@ -216,7 +210,6 @@ virNWFilterRuleInstantiate(virConnectPtr /** * virNWFilterCreateVarsFrom: - * @conn: pointer to virConnect object * @vars1: pointer to hash table * @vars2: pointer to hash table * @@ -227,8 +220,7 @@ virNWFilterRuleInstantiate(virConnectPtr * contents of var2 will overwrite those of var1. */ static virNWFilterHashTablePtr -virNWFilterCreateVarsFrom(virConnectPtr conn, - virNWFilterHashTablePtr vars1, +virNWFilterCreateVarsFrom(virNWFilterHashTablePtr vars1, virNWFilterHashTablePtr vars2) { virNWFilterHashTablePtr res = virNWFilterHashTableCreate(0); @@ -237,10 +229,10 @@ virNWFilterCreateVarsFrom(virConnectPtr return NULL; } - if (virNWFilterHashTablePutAll(conn, vars1, res)) + if (virNWFilterHashTablePutAll(vars1, res)) goto err_exit; - if (virNWFilterHashTablePutAll(conn, vars2, res)) + if (virNWFilterHashTablePutAll(vars2, res)) goto err_exit; return res; @@ -324,7 +316,7 @@ _virNWFilterInstantiateRec(virConnectPtr if (obj) { if (obj->wantRemoved) { - virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + virNWFilterReportError(VIR_ERR_NO_NWFILTER, _("Filter '%s' is in use."), inc->filterref); rc = 1; @@ -334,8 +326,7 @@ _virNWFilterInstantiateRec(virConnectPtr // create a temporary hashmap for depth-first tree traversal virNWFilterHashTablePtr tmpvars = - virNWFilterCreateVarsFrom(conn, - inc->params, + virNWFilterCreateVarsFrom(inc->params, vars); if (!tmpvars) { virReportOOMError(); @@ -373,7 +364,7 @@ _virNWFilterInstantiateRec(virConnectPtr if (rc) break; } else { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("referenced filter '%s' is missing"), inc->filterref); rc = 1; @@ -516,7 +507,7 @@ _virNWFilterInstantiateFilter(virConnect techdriver = virNWFilterTechDriverForName(drvname); if (!techdriver) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Could not get access to ACL tech " "driver '%s'"), drvname); @@ -527,14 +518,14 @@ _virNWFilterInstantiateFilter(virConnect obj = virNWFilterPoolObjFindByName(&driver->pools, net->filter); if (!obj) { - virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + virNWFilterReportError(VIR_ERR_NO_NWFILTER, _("Could not find filter '%s'"), net->filter); return 1; } if (obj->wantRemoved) { - virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + virNWFilterReportError(VIR_ERR_NO_NWFILTER, _("Filter '%s' is in use."), net->filter); rc = 1; @@ -549,8 +540,7 @@ _virNWFilterInstantiateFilter(virConnect goto err_exit; } - vars1 = virNWFilterCreateVarHashmap(conn, - str_macaddr); + vars1 = virNWFilterCreateVarHashmap(str_macaddr); if (!vars1) { rc = 1; goto err_exit; @@ -558,8 +548,7 @@ _virNWFilterInstantiateFilter(virConnect str_macaddr = NULL; - vars = virNWFilterCreateVarsFrom(conn, - vars1, + vars = virNWFilterCreateVarsFrom(vars1, net->filterparams); if (!vars) { rc = 1; @@ -630,7 +619,7 @@ int virNWFilterRollbackUpdateFilter(virC virNWFilterTechDriverPtr techdriver; techdriver = virNWFilterTechDriverForName(drvname); if (!techdriver) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Could not get access to ACL tech " "driver '%s'"), drvname); @@ -649,7 +638,7 @@ virNWFilterTearOldFilter(virConnectPtr c virNWFilterTechDriverPtr techdriver; techdriver = virNWFilterTechDriverForName(drvname); if (!techdriver) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Could not get access to ACL tech " "driver '%s'"), drvname); @@ -668,12 +657,10 @@ virNWFilterTeardownFilter(const virDomai techdriver = virNWFilterTechDriverForName(drvname); if (!techdriver) { -#if 0 - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Could not get access to ACL tech " "driver '%s'"), drvname); -#endif return 1; } Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -25,8 +25,7 @@ virNWFilterTechDriverPtr virNWFilterTechDriverForName(const char *name); -int virNWFilterRuleInstAddData(virConnectPtr conn, - virNWFilterRuleInstPtr res, +int virNWFilterRuleInstAddData(virNWFilterRuleInstPtr res, void *data); @@ -48,8 +47,7 @@ int virNWFilterTearOldFilter(virConnectP int virNWFilterTeardownFilter(const virDomainNetDefPtr net); -virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr); +virNWFilterHashTablePtr virNWFilterCreateVarHashmap(char *macaddr); void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED,

2 1

[libvirt] [PATCH] Eliminate compiler warning about non-const format string
by Laine Stump 05 Apr '10

05 Apr '10

--- src/nwfilter/nwfilter_ebiptables_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 6d66543..cffe027 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -204,7 +204,7 @@ _printDataType(virConnectPtr conn, case DATATYPE_IPMASK: if (snprintf(buf, bufsize, "%d", item->u.u8) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for uint8 type")); return 1; } -- 1.6.6.1

2 2

[libvirt] [PATCH] xenapi: Add managedsave entries to the driver struct
by Matthias Bolte 04 Apr '10

04 Apr '10

Commit 15c647a91e8c5bcfcb02ac4e755160c5c99a2a1e added the new managedsave entries to all driver structs except the XenAPI one. --- I just pushed this patch. src/xenapi/xenapi_driver.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/src/xenapi/xenapi_driver.c b/src/xenapi/xenapi_driver.c index dcfdc1e..240aa16 100644 --- a/src/xenapi/xenapi_driver.c +++ b/src/xenapi/xenapi_driver.c @@ -1783,6 +1783,9 @@ static virDriver xenapiDriver = { NULL, /* domainMigrateSetMaxDowntime */ NULL, /* domainEventRegisterAny */ NULL, /* domainEventDeregisterAny */ + NULL, /* domainManagedSave */ + NULL, /* domainHasManagedSaveImage */ + NULL, /* domainManagedSaveRemove */ }; /** -- 1.6.3.3

2 1

[libvirt] [PATCH] nwfilter: Fix random index in virNWFilterRuleDefDetailsFormat
by Matthias Bolte 04 Apr '10

04 Apr '10

An uninitialized int value was used to index an array. This can result in a segfault in nwfilterxml2xmltest. --- src/conf/nwfilter_conf.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/conf/nwfilter_conf.c b/src/conf/nwfilter_conf.c index 08934fb..7c71ece 100644 --- a/src/conf/nwfilter_conf.c +++ b/src/conf/nwfilter_conf.c @@ -2375,7 +2375,7 @@ virNWFilterRuleDefDetailsFormat(virConnectPtr conn, const virXMLAttr2Struct *att, virNWFilterRuleDefPtr def) { - int i, j; + int i = 0, j; bool typeShown = 0; bool neverShown = 1; enum match { -- 1.6.3.3

2 2

[libvirt] [PATCH] xenapi: Fix uninitialized variable warning
by Matthias Bolte 04 Apr '10

04 Apr '10

--- src/xenapi/xenapi_utils.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/xenapi/xenapi_utils.c b/src/xenapi/xenapi_utils.c index 581bd90..4eb17fa 100644 --- a/src/xenapi/xenapi_utils.c +++ b/src/xenapi/xenapi_utils.c @@ -405,7 +405,7 @@ createVifNetwork (virConnectPtr conn, xen_vm vm, char *device, vm_opt->u.handle = xvm; xen_network_set *net_set = NULL; xen_network_record *net_rec = NULL; - int cnt; + int cnt = 0; if (xen_network_get_all(session, &net_set)) { for(cnt = 0; cnt < net_set->size; cnt++) { if (xen_network_get_record(session, &net_rec, net_set->contents[cnt])) { -- 1.6.3.3

2 2

[libvirt] [PATCH] nwfilter: Get rid of regular expressions for testing of var names and values
by Stefan Berger 04 Apr '10

04 Apr '10

Get rid of the regular expressions when evaluating variable names and values. Rather use the strspn() function. Along with this cleanup the initialization function for the code that used the regular expression can also be removed. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 5 ---- src/conf/nwfilter_conf.h | 3 -- src/conf/nwfilter_params.c | 50 +++++++++++++++------------------------------ src/conf/nwfilter_params.h | 6 +++++ 4 files changed, 24 insertions(+), 40 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -568,9 +568,6 @@ void virNWFilterPoolObjUnlock(virNWFilte int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); -int virNWFilterParamConfLayerInit(void); -void virNWFilterParamConfLayerShutdown(void); - # define virNWFilterReportError(conn, code, fmt...) \ (void)conn; \ virReportErrorHelper(NULL, VIR_FROM_NWFILTER, code, __FILE__, \ Index: libvirt-acl/src/conf/nwfilter_params.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.c +++ libvirt-acl/src/conf/nwfilter_params.c @@ -22,8 +22,6 @@ #include <config.h> -#include <regex.h> - #include "internal.h" #include "memory.h" @@ -35,13 +33,6 @@ #define VIR_FROM_THIS VIR_FROM_NWFILTER -/* - * regular expressions for parameter names and values - */ -static regex_t regex_nam; -static regex_t regex_val; - - static void hashDealloc(void *payload, const char *name ATTRIBUTE_UNUSED) { @@ -215,6 +206,21 @@ err_exit: #ifndef PROXY + +static bool +isValidVarName(const char *var) +{ + return var[strspn(var, VALID_VARNAME)] == 0; +} + + +static bool +isValidVarValue(const char *value) +{ + return value[strspn(value, VALID_VARVALUE)] == 0; +} + + virNWFilterHashTablePtr virNWFilterParseParamAttributes(xmlNodePtr cur) { @@ -234,9 +240,9 @@ virNWFilterParseParamAttributes(xmlNodeP nam = virXMLPropString(cur, "name"); val = virXMLPropString(cur, "value"); if (nam != NULL && val != NULL) { - if (regexec(&regex_nam, nam, 0, NULL, 0) != 0) + if (!isValidVarName(nam)) goto skip_entry; - if (regexec(&regex_val, val, 0, NULL, 0) != 0) + if (!isValidVarValue(nam)) goto skip_entry; if (virNWFilterHashTablePut(table, nam, val, 1)) { VIR_FREE(nam); @@ -296,25 +302,3 @@ virNWFilterFormatParamAttributes(virNWFi return virBufferContentAndReset(&buf); } - - -int virNWFilterParamConfLayerInit(void) { - - if (regcomp(&regex_nam, "^[a-zA-Z0-9_]+$" , - REG_NOSUB|REG_EXTENDED) != 0) - return 1; - - if (regcomp(&regex_val, "^[a-zA-Z0-9_.:]+$", - REG_NOSUB|REG_EXTENDED) != 0) { - regfree(&regex_nam); - return 1; - } - - return 0; -} - - -void virNWFilterParamConfLayerShutdown(void) { - regfree(&regex_nam); - regfree(&regex_val); -} Index: libvirt-acl/src/conf/nwfilter_params.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.h +++ libvirt-acl/src/conf/nwfilter_params.h @@ -50,4 +50,10 @@ int virNWFilterHashTablePutAll(virConnec virNWFilterHashTablePtr src, virNWFilterHashTablePtr dest); +#define VALID_VARNAME \ + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_" + +#define VALID_VARVALUE \ + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:" + #endif /* NWFILTER_PARAMS_H */ Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -2634,16 +2634,13 @@ int virNWFilterConfLayerInit(virHashIter if (virMutexInit(&updateMutex)) return 1; - if (virNWFilterParamConfLayerInit()) - return 1; - return 0; } void virNWFilterConfLayerShutdown(void) { - virNWFilterParamConfLayerShutdown(); + virMutexDestroy(&updateMutex); }

2 1

[libvirt] [RFC PATCH 0/8]: Domain Snapshot API
by Chris Lalancette 03 Apr '10

03 Apr '10

Hello, Here is the first set of RFC patches for the snapshot API. Note that this definitely isn't finished; in particular, we are going to be changing the semantic for virDomainCreateFromSnapshot, and there are still a couple of known outstanding bugs. Nevertheless, that will probably be pretty minor in terms of code, so we'd like to get review on the rest of these patches for now. I've broken the series down along lines that I believe will compile independently, though I haven't yet done a git-bisect to confirm. Unfortunately it leaves patch 3/8 as a monster patch implementing the skeleton and remote driver. The good news is that it is mostly mechanical. Suggestions for how to better split it up are welcome. Thanks go to Jirka for lots of code contribution to this series, and all of the others who took part in the discussion of this API. Comments are welcome. Chris Lalancette

3 25

[libvirt] [PATCH] build: improve check for out-of-date .gnulib submodule
by Eric Blake 03 Apr '10

03 Apr '10

git reset --hard 96e5a2d4d5b13bf2cc887562dc11d146b78d5950 ./autogen.sh make -s git pull make -s <-- expecting auto-bootstrap here, doesn't happen Use git diff to expose whether the submodule has untracked changes, which are typical on an incremental pull if .gnulib was updated but the user did not manually run 'git submodule update'. After this patch is applied, I encountered a new problem when following the reproducing pattern. Basically, the change to .gnulib between libvirt's commit 96e5a2d4 and this patch introduced a change to sys_ioctl.in.h, but gnulib (intentionally) does not make the replacement headers depend on Makefile changes. Therefore, I ended up with the generated replacement header being broken: gnulib/lib/sys/ioctl.h complained about a use of @. But that seems like something that should be fixed upstream in gnulib's bootstrap script (that is, when doing a gnulib update, all files created from .in.h file should probably be deleted). Without the benefit of that proposed gnulib fix, I worked around the problem by manually removing the stale gnulib/lib/sys/ioctl.h. * autogen.sh (t): Also run bootstrap if the gnulib submodule needs to be updated. * cfg.mk (_autogen): Likewise. Reported by Matthias Bolte. --- That took a lot longer to fix than I originally expected. But I think this patch fixes the libvirt side of things, so that make will properly rerun autogen when the .gnulib submodule changes. Thanks again to Matthias for boiling it down to a reproducible step. And now I'm off to figure out whether gnulib's bootstrap script could do a better job of deleting any generated headers that might be rendered invalid by an update in gnulib modules. autogen.sh | 2 +- cfg.mk | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/autogen.sh b/autogen.sh index a618d86..2f5b42d 100755 --- a/autogen.sh +++ b/autogen.sh @@ -75,7 +75,7 @@ bootstrap_hash() # Ensure that whenever we pull in a gnulib update or otherwise change to a # different version (i.e., when switching branches), we also rerun ./bootstrap. curr_status=.git-module-status -t=$(bootstrap_hash) +t=$(bootstrap_hash; git diff .gnulib) if test "$t" = "$(cat $curr_status 2>/dev/null)"; then : # good, it's up to date, all we need is autoreconf autoreconf -if diff --git a/cfg.mk b/cfg.mk index b6b2530..74fe5ed 100644 --- a/cfg.mk +++ b/cfg.mk @@ -294,7 +294,8 @@ ifeq (0,$(MAKELEVEL)) _submodule_hash = sed 's/^[ +-]//;s/ .*//' _update_required := $(shell \ actual=$$(git submodule status | $(_submodule_hash); \ - git hash-object bootstrap.conf); \ + git hash-object bootstrap.conf; \ + git diff .gnulib); \ stamp="$$($(_submodule_hash) $(_curr_status) 2>/dev/null)"; \ test "$$stamp" = "$$actual"; echo $$?) ifeq (1,$(_update_required)) @@ -303,9 +304,12 @@ Makefile: _autogen endif endif +# It is necessary to call autogen any time gnulib changes. Autogen +# reruns configure, then we regenerate all Makefiles at once. .PHONY: _autogen _autogen: $(srcdir)/autogen.sh + ./config.status # Exempt @...@ uses of these symbols. _makefile_at_at_check_exceptions = ' && !/(SCHEMA|SYSCONF)DIR/' -- 1.6.6.1

2 2

[libvirt] [PATCH] [0/4] Managed save APIs
by Daniel Veillard 02 Apr '10

02 Apr '10

As posted earlier, I have implemented the small set of managed save APIs, where libvirt stores the domain state itself and can then recover that state when the domain is started up. I think the code is complete, but not really tested (I still need to debug a failure which seems unrelated), with the exception of the virsh commands which probably need to be extended for convenience. Also I implemented it only for the qemu driver, I would not be surprized if an ESX backend could be implemented since there is no file path in this API. More documentation is needed too. Thanks Chris Lalancette who wrote a large part of this code ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

3 8

[libvirt] [PATCH 0/3] Add dnsmasq module
by Satoru SATOH 02 Apr '10

02 Apr '10

The following series of patches is a prototype implementation of dnsmasq module. It implements an idea originally suggested by Daniel-san and can address the problem that too many --dhcp-host args hitting ARG_MAX limit I reported last year [1]. [1] https://www.redhat.com/archives/libvir-list/2009-October/msg00216.html Thanks, Satoru SATOH

1 3

[libvirt] [PATCH] Optimization of the check for valid interface name
by Stefan Berger 02 Apr '10

02 Apr '10

The attached patch optimizes the validation of the name of an interface. Signed-off-by: Stefan Berger Index: libvirt-acl/src/conf/domain_conf.c =================================================================== --- libvirt-acl.orig/src/conf/domain_conf.c +++ libvirt-acl/src/conf/domain_conf.c @@ -1795,7 +1795,7 @@ cleanup: static bool isValidIfname(const char *ifname) { - return (strspn(ifname, VALID_IFNAME_CHARS) == strlen(ifname)); + return ifname[strspn(ifname, VALID_IFNAME_CHARS)] == 0; }

3 2

[libvirt] [PATCH] Use virStrToLong_ui rather than virStrToLong_i where possible
by Stefan Berger 02 Apr '10

02 Apr '10

Use the virStrToLong_ui() function rather than the virStrToLong_i() where possible. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -1126,6 +1126,7 @@ virNWFilterRuleDetailsParse(virConnectPt enum virNWFilterEntryItemFlags *flags ,match_flag = 0, flags_set = 0; nwItemDesc *item; int int_val; + unsigned int uint_val; void *data_ptr, *storage_ptr; valueValidator validator; char *match = virXMLPropString(node, "match"); @@ -1175,12 +1176,12 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_UINT8: storage_ptr = &item->u.u8; - if (virStrToLong_i(prop, NULL, 10, &int_val) >= 0) { - if (int_val >= 0 && int_val <= 0xff) { + if (virStrToLong_ui(prop, NULL, 10, &uint_val) >= 0) { + if (uint_val <= 0xff) { if (!validator) - *(uint8_t *)storage_ptr = int_val; + *(uint8_t *)storage_ptr = uint_val; found = 1; - data_ptr = &int_val; + data_ptr = &uint_val; } else rc = -1; } else @@ -1189,12 +1190,12 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_UINT16: storage_ptr = &item->u.u16; - if (virStrToLong_i(prop, NULL, 10, &int_val) >= 0) { - if (int_val >= 0 && int_val <= 0xffff) { + if (virStrToLong_ui(prop, NULL, 10, &uint_val) >= 0) { + if (uint_val <= 0xffff) { if (!validator) - *(uint16_t *)storage_ptr = int_val; + *(uint16_t *)storage_ptr = uint_val; found = 1; - data_ptr = &int_val; + data_ptr = &uint_val; } else rc = -1; } else @@ -1212,13 +1213,13 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_IPMASK: storage_ptr = &item->u.u8; - if (virStrToLong_i(prop, NULL, 10, &int_val) == 0) { - if (int_val >= 0 && int_val <= 32) { + if (virStrToLong_ui(prop, NULL, 10, &uint_val) == 0) { + if (uint_val <= 32) { if (!validator) *(uint8_t *)storage_ptr = - (uint8_t)int_val; + (uint8_t)uint_val; found = 1; - data_ptr = &int_val; + data_ptr = &uint_val; } else rc = -1; } else { @@ -1266,13 +1267,13 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_IPV6MASK: storage_ptr = &item->u.u8; - if (virStrToLong_i(prop, NULL, 10, &int_val) == 0) { - if (int_val >= 0 && int_val <= 128) { + if (virStrToLong_ui(prop, NULL, 10, &uint_val) == 0) { + if (uint_val <= 128) { if (!validator) *(uint8_t *)storage_ptr = - (uint8_t)int_val; + (uint8_t)uint_val; found = 1; - data_ptr = &int_val; + data_ptr = &uint_val; } else rc = -1; } else {

2 1

[libvirt] [PATCH v1 0/2] Fixes to network filter rules instantiator + XML parser and XML parser test cases
by Stefan Berger 02 Apr '10

02 Apr '10

The following two patches fix some problems when instantiating the network filtering rules provided by the test cases in the 2nd patch on a running virtual machine using 'nwfilter-define'. There's one known problem realted to 'dscp' values not being capped at '63'. This will be fixed later. Regards, Stefan

2 5

[libvirt] [PATCH] build: import latest gnulib
by Eric Blake 02 Apr '10

02 Apr '10

* .gnulib: Update to latest. * cfg.mk (sc_prohibit_test_minus_ao): Delete, it was moved into gnulib's maint.mk. --- Here's the full list of gnulib changes: * .gnulib 4f01268...e01b458 (44): > maint.mk: check for [ as well as test > gnumakefile: don't squelch _version output > sys_time: avoid compiler warnings > maint.mk: split a long line > maint.mk: s/_header_without_use/_sc_header_without_use/ > maint: improve module indicators > fdopendir: work around FreeBSD bug > Emit #pragma system_header after the inclusion guard, not before. > Fix indentation. > save-cwd: don't leak a file descriptor when the caller execs > Remove vestiges of fts-lgpl module. > Fix definition of tests witness macro. > Fix definition of tests witness macro. > Fix ioctl's protoype on glibc systems. > Normalize copyright line formatting. > exclude: fix the case of globs vs. EXCLUDE_INCLUDE > maint.mk: prohibit use of test's -o and -a operators > Remove unused GNULIB_XYZ macro definitions. > Mark privileged tests modules. > Split C++ tests into separate tests modules. > gnulib-tool: Allow 'foo-tests' module even if there is no module 'foo'. > gnulib-tool: Add support for special categories of tests. > ansi-c++-opt: Allow turning off the C++ build by default. > unistd: Avoid #define replacements in C++ mode. > Fix link errors on mingw. > lib-ignore: Determine different options for different compilers. > Remove unused GNULIB_XYZ macro definitions. > Add a remark about certain modules. > Resolve conflict between the two kinds of module indicators. > autoupdate > Distinguish two kinds of module indicators. > New module description field 'Comment'. > Addendum to 2010-02-07 commit. > Use GNULIB_POSIXCHECK instead of GNULIB_PORTCHECK. > Avoid side effects from tests-related modules on the compilation of lib. > Factorize common .m4 code. > Fix a compilation error on Cygwin with g++ >= 4.3. > Rename gl_GETLOGIN. > Rename gl_GETLOGIN_R. > Rename gl_INET_NTOP. > Rename gl_INET_PTON. > Rename gl_MBSLEN. > Rename gl_FORKPTY and gl_OPENPTY. > top/maint.mk (sc_texinfo_acronym): Don't infloop if there is no *.texi files. .gnulib | 2 +- cfg.mk | 8 -------- 2 files changed, 1 insertions(+), 9 deletions(-) diff --git a/.gnulib b/.gnulib index 4f01268..e01b458 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit 4f01268d0c584c20704e42527f4fa125e7525aae +Subproject commit e01b458f40440e64ce6f59beb0b446219bb6302d diff --git a/cfg.mk b/cfg.mk index 2e7b68a..07360b0 100644 --- a/cfg.mk +++ b/cfg.mk @@ -272,14 +272,6 @@ sc_preprocessor_indentation: echo '$(ME): skipping test $@: cppi not installed' 1>&2; \ fi -_m1 = use "test C1 && test C2", not "test C1 -''a C2" -_m2 = use "test C1 || test C2", not "test C1 -''o C2" -# Using test's -a and -o operators is not portable. -sc_prohibit_test_minus_ao: - @re='(\<test| \[+) .+ -[ao] ' \ - msg='$(_m1); $(_m2)' \ - $(_prohibit_regexp) - sc_copyright_format: @$(VC_LIST_EXCEPT) | xargs grep -ni 'copyright .*Red 'Hat \ | grep -v Inc \ -- 1.6.6.1

2 3

[libvirt] Pushed qemuDomainRestore fix
by Chris Lalancette 02 Apr '10

02 Apr '10

FYI, I just pushed this fix (with blessing from DV): commit d62f4c36c2c28b96952143247a1360e8c18f64c7 Author: Chris Lalancette <clalance(a)redhat.com> Date: Tue Mar 23 09:11:29 2010 -0400 Don't use virFileReadLimFD in qemuDomainRestore. virFileReadLimFD is a poor fit for reading the header of the restore file. The problem is that virFileReadLimFD returns an error when there is more data after the amount you ask to read, but that is *expected* in this case. This patch is essentially a revert of 1a4d5c9543641c444dccd682f6256ee3faf22a80, but I don't think that commit does what it says anyway. It purports to prevent an unwarranted OOM error, but since virFileReadLimFD will allocate memory up to the maximum anyway, the upper limit on the total amount of memory allocated is the same for either the old version or the new version. Since the old saferead actually works and virFileReadLimFD does not, revert to using saferead. Signed-off-by: Chris Lalancette <clalance(a)redhat.com> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 4291bc7..70d2781 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5547,7 +5547,12 @@ static int qemudDomainRestore(virConnectPtr conn, goto cleanup; } - if (virFileReadLimFD(fd, header.xml_len, &xml) != header.xml_len) { + if (VIR_ALLOC_N(xml, header.xml_len) < 0) { + virReportOOMError(); + goto cleanup; + } + + if (saferead(fd, xml, header.xml_len) != header.xml_len) { qemuReportError(VIR_ERR_OPERATION_FAILED, "%s", _("failed to read XML")); goto cleanup; -- Chris Lalancette

2 1

[libvirt] [PATCH] VBox: Fix use of uninitialized value
by Jiri Denemark 02 Apr '10

02 Apr '10

--- src/vbox/vbox_tmpl.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 14fdcda..59ad1b8 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -1570,7 +1570,7 @@ static int vboxDomainDestroy(virDomainPtr dom) { #if VBOX_API_VERSION == 2002 console->vtbl->PowerDown(console); #else - IProgress *progress; + IProgress *progress = NULL; console->vtbl->PowerDown(console, &progress); if (progress) { progress->vtbl->WaitForCompletion(progress, -1); -- 1.7.0.4

2 2

[libvirt] [PATCH] Changes to clock timer XML to match final design.
by Laine Stump 02 Apr '10

02 Apr '10

The clock timer XML is being updated in the following ways (based on further off-list discussion that was missed during the initial implementation): 1) 'wallclock' is changed to 'track', and the possible values are 'boot' (corresponds to old 'host'), 'guest', and 'wall'. 2) 'mode' has an additional value 'smpsafe' 3) when tickpolicy='catchup', there can be an optional sub-element of timer called 'catchup': <catchup threshold=123 slew=120 limit=10000/> Those three values are all longs, always optional, and if they are present, they are positive. Internally, 0 indicates "unspecified". * docs/schemas/domain.rng: updated RNG definition to account for changes * src/conf/domain_conf.h: change the C struct and enums to match changes. * src/conf/domain_conf.c: timer parse and format functions changed to handle the new selections and new element. * src/libvirt_private.syms: *TimerWallclock* changes to *TimerTrack* * src/qemu/qemu_conf.c: again, account for Wallclock --> Track change. --- docs/schemas/domain.rng | 24 +++++++++++- src/conf/domain_conf.c | 89 +++++++++++++++++++++++++++++++++++---------- src/conf/domain_conf.h | 26 ++++++++++---- src/libvirt_private.syms | 4 +- src/qemu/qemu_conf.c | 17 +++++++-- 5 files changed, 126 insertions(+), 34 deletions(-) diff --git a/docs/schemas/domain.rng b/docs/schemas/domain.rng index d804301..228665c 100644 --- a/docs/schemas/domain.rng +++ b/docs/schemas/domain.rng @@ -344,10 +344,11 @@ </choice> </attribute> <optional> - <attribute name="wallclock"> + <attribute name="track"> <choice> - <value>host</value> + <value>boot</value> <value>guest</value> + <value>wall</value> </choice> </attribute> </optional> @@ -362,6 +363,9 @@ </attribute> </optional> <optional> + <ref name="catchup"/> + </optional> + <optional> <attribute name="frequency"> <ref name="unsignedInt"/> </attribute> @@ -373,6 +377,7 @@ <value>native</value> <value>emulate</value> <value>paravirt</value> + <value>smpsafe</value> </choice> </attribute> </optional> @@ -387,6 +392,21 @@ <empty/> </element> </define> + <define name="catchup"> + <element name="catchup"> + <optional> + <attribute name="threshold"> + <ref name="unsignedInt"/> + </attribute> + <attribute name="slew"> + <ref name="unsignedInt"/> + </attribute> + <attribute name="limit"> + <ref name="unsignedInt"/> + </attribute> + </optional> + </element> + </define> <!-- A bootloader may be used to extract the OS information instead of defining the OS parameter in the instance. It points just to the diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 66aa53e..b8acab9 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -252,9 +252,10 @@ VIR_ENUM_IMPL(virDomainTimerName, VIR_DOMAIN_TIMER_NAME_LAST, "hpet", "tsc"); -VIR_ENUM_IMPL(virDomainTimerWallclock, VIR_DOMAIN_TIMER_WALLCLOCK_LAST, - "host", - "guest"); +VIR_ENUM_IMPL(virDomainTimerTrack, VIR_DOMAIN_TIMER_TRACK_LAST, + "boot", + "guest", + "wall"); VIR_ENUM_IMPL(virDomainTimerTickpolicy, VIR_DOMAIN_TIMER_TICKPOLICY_LAST, "delay", @@ -266,7 +267,8 @@ VIR_ENUM_IMPL(virDomainTimerMode, VIR_DOMAIN_TIMER_MODE_LAST, "auto", "native", "emulate", - "paravirt"); + "paravirt", + "smpsafe"); #define virDomainReportError(code, ...) \ virReportErrorHelper(NULL, VIR_FROM_DOMAIN, code, __FILE__, \ @@ -2555,7 +2557,7 @@ virDomainTimerDefParseXML(const xmlNodePtr node, char *name = NULL; char *present = NULL; char *tickpolicy = NULL; - char *wallclock = NULL; + char *track = NULL; char *mode = NULL; virDomainTimerDefPtr def; @@ -2603,12 +2605,12 @@ virDomainTimerDefParseXML(const xmlNodePtr node, } } - def->wallclock = -1; - wallclock = virXMLPropString(node, "wallclock"); - if (wallclock != NULL) { - if ((def->wallclock = virDomainTimerWallclockTypeFromString(wallclock)) < 0) { + def->track = -1; + track = virXMLPropString(node, "track"); + if (track != NULL) { + if ((def->track = virDomainTimerTrackTypeFromString(track)) < 0) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, - _("unknown timer wallclock '%s'"), wallclock); + _("unknown timer track '%s'"), track); goto error; } } @@ -2616,7 +2618,7 @@ virDomainTimerDefParseXML(const xmlNodePtr node, int ret = virXPathULong("string(./frequency)", ctxt, &def->frequency); if (ret == -1) { def->frequency = 0; - } else if (ret <= 0) { + } else if (ret < 0) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("invalid timer frequency")); goto error; @@ -2632,11 +2634,42 @@ virDomainTimerDefParseXML(const xmlNodePtr node, } } + xmlNodePtr catchup = virXPathNode("./catchup", ctxt); + if (catchup != NULL) { + ret = virXPathULong("string(./catchup/@threshold)", ctxt, + &def->catchup.threshold); + if (ret == -1) { + def->catchup.threshold = 0; + } else if (ret < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("invalid catchup threshold")); + goto error; + } + + ret = virXPathULong("string(./catchup/@slew)", ctxt, &def->catchup.slew); + if (ret == -1) { + def->catchup.slew = 0; + } else if (ret < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("invalid catchup slew")); + goto error; + } + + ret = virXPathULong("string(./catchup/@limit)", ctxt, &def->catchup.limit); + if (ret == -1) { + def->catchup.limit = 0; + } else if (ret < 0) { + virDomainReportError(VIR_ERR_INTERNAL_ERROR, + "%s", _("invalid catchup limit")); + goto error; + } + } + cleanup: VIR_FREE(name); VIR_FREE(present); VIR_FREE(tickpolicy); - VIR_FREE(wallclock); + VIR_FREE(track); VIR_FREE(mode); ctxt->node = oldnode; @@ -5456,16 +5489,16 @@ virDomainTimerDefFormat(virBufferPtr buf, if ((def->name == VIR_DOMAIN_TIMER_NAME_PLATFORM) || (def->name == VIR_DOMAIN_TIMER_NAME_RTC)) { - if (def->wallclock != -1) { - const char *wallclock - = virDomainTimerWallclockTypeToString(def->wallclock); - if (!wallclock) { + if (def->track != -1) { + const char *track + = virDomainTimerTrackTypeToString(def->track); + if (!track) { virDomainReportError(VIR_ERR_INTERNAL_ERROR, - _("unexpected timer wallclock %d"), - def->wallclock); + _("unexpected timer track %d"), + def->track); return -1; } - virBufferVSprintf(buf, " wallclock='%s'", wallclock); + virBufferVSprintf(buf, " track='%s'", track); } } @@ -5487,7 +5520,23 @@ virDomainTimerDefFormat(virBufferPtr buf, } } - virBufferAddLit(buf, "/>\n"); + if ((def->catchup.threshold == 0) + && (def->catchup.slew == 0) + && (def->catchup.limit == 0)) { + virBufferAddLit(buf, "/>\n"); + } else { + virBufferAddLit(buf, ">\n <catchup "); + if (def->catchup.threshold > 0) { + virBufferVSprintf(buf, " threshold='%lu'", def->catchup.threshold); + } + if (def->catchup.slew > 0) { + virBufferVSprintf(buf, " slew='%lu'", def->catchup.slew); + } + if (def->catchup.limit > 0) { + virBufferVSprintf(buf, " limit='%lu'", def->catchup.limit); + } + virBufferAddLit(buf, "/>\n </timer>\n"); + } return 0; } diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index ed1a4ad..435d546 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -656,11 +656,12 @@ enum virDomainTimerNameType { VIR_DOMAIN_TIMER_NAME_LAST, }; -enum virDomainTimerWallclockType { - VIR_DOMAIN_TIMER_WALLCLOCK_HOST = 0, - VIR_DOMAIN_TIMER_WALLCLOCK_GUEST, +enum virDomainTimerTrackType { + VIR_DOMAIN_TIMER_TRACK_BOOT = 0, + VIR_DOMAIN_TIMER_TRACK_GUEST, + VIR_DOMAIN_TIMER_TRACK_WALL, - VIR_DOMAIN_TIMER_WALLCLOCK_LAST, + VIR_DOMAIN_TIMER_TRACK_LAST, }; enum virDomainTimerTickpolicyType { @@ -677,10 +678,19 @@ enum virDomainTimerModeType { VIR_DOMAIN_TIMER_MODE_NATIVE, VIR_DOMAIN_TIMER_MODE_EMULATE, VIR_DOMAIN_TIMER_MODE_PARAVIRT, + VIR_DOMAIN_TIMER_MODE_SMPSAFE, VIR_DOMAIN_TIMER_MODE_LAST, }; +typedef struct _virDomainTimerCatchupDef virDomainTimerCatchupDef; +typedef virDomainTimerCatchupDef *virDomainTimerCatchupDefPtr; +struct _virDomainTimerCatchupDef { + unsigned long threshold; + unsigned long slew; + unsigned long limit; +}; + typedef struct _virDomainTimerDef virDomainTimerDef; typedef virDomainTimerDef *virDomainTimerDefPtr; struct _virDomainTimerDef { @@ -688,8 +698,10 @@ struct _virDomainTimerDef { int present; /* unspecified = -1, no = 0, yes = 1 */ int tickpolicy; /* none|catchup|merge|discard */ - /* wallclock is only valid for name='platform|rtc' */ - int wallclock; /* host|guest */ + virDomainTimerCatchupDef catchup; + + /* track is only valid for name='platform|rtc' */ + int track; /* host|guest */ /* frequency & mode are only valid for name='tsc' */ unsigned long frequency; /* in Hz, unspecified = 0 */ @@ -1029,7 +1041,7 @@ VIR_ENUM_DECL(virDomainClockOffset) VIR_ENUM_DECL(virDomainNetdevMacvtap) VIR_ENUM_DECL(virDomainTimerName) -VIR_ENUM_DECL(virDomainTimerWallclock) +VIR_ENUM_DECL(virDomainTimerTrack) VIR_ENUM_DECL(virDomainTimerTickpolicy) VIR_ENUM_DECL(virDomainTimerMode) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index cc943f8..08a6b97 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -199,8 +199,8 @@ virDomainClockOffsetTypeFromString; virDomainDiskErrorPolicyTypeToString; virDomainTimerNameTypeToString; virDomainTimerNameTypeFromString; -virDomainTimerWallclockTypeToString; -virDomainTimerWallclockTypeFromString; +virDomainTimerTrackTypeToString; +virDomainTimerTrackTypeFromString; virDomainTimerTickpolicyTypeToString; virDomainTimerTickpolicyTypeFromString; virDomainTimerModeTypeToString; diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 8f6f7ec..4f279be 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -3183,11 +3183,22 @@ qemuBuildClockArgStr(virDomainClockDefPtr def) int i; for (i = 0; i < def->ntimers; i++) { if (def->timers[i]->name == VIR_DOMAIN_TIMER_NAME_RTC) { - if (def->timers[i]->wallclock == VIR_DOMAIN_TIMER_WALLCLOCK_HOST) { - virBufferAddLit(&buf, ",clock=host"); - } else if (def->timers[i]->wallclock == VIR_DOMAIN_TIMER_WALLCLOCK_GUEST) { + switch (def->timers[i]->track) { + case -1: /* unspecified - use hypervisor default */ + break; + case VIR_DOMAIN_TIMER_TRACK_BOOT: + qemuReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("unsupported rtc timer track '%s'"), + virDomainTimerTrackTypeToString(def->timers[i]->track)); + goto error; + case VIR_DOMAIN_TIMER_TRACK_GUEST: virBufferAddLit(&buf, ",clock=vm"); + break; + case VIR_DOMAIN_TIMER_TRACK_WALL: + virBufferAddLit(&buf, ",clock=host"); + break; } + switch (def->timers[i]->tickpolicy) { case -1: case VIR_DOMAIN_TIMER_TICKPOLICY_DELAY: -- 1.6.6.1

2 2

[libvirt] [PATCH] Eliminate compile warnings in nwfilter error log calls
by Laine Stump 02 Apr '10

02 Apr '10

--- src/nwfilter/nwfilter_ebiptables_driver.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 68bada6..172394d 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -156,13 +156,13 @@ printDataType(virConnectPtr conn, case DATATYPE_IPADDR: data = virSocketFormatAddr(&item->u.ipaddr.addr); if (!data) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", _("internal IPv4 address representation " "is bad")); return 1; } if (snprintf(buf, bufsize, "%s", data) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", _("buffer too small for IP address")); VIR_FREE(data); return 1; @@ -173,14 +173,14 @@ printDataType(virConnectPtr conn, case DATATYPE_IPV6ADDR: data = virSocketFormatAddr(&item->u.ipaddr.addr); if (!data) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", _("internal IPv6 address representation " "is bad")); return 1; } if (snprintf(buf, bufsize, "%s", data) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, "%s", _("buffer too small for IPv6 address")); VIR_FREE(data); return 1; @@ -191,7 +191,7 @@ printDataType(virConnectPtr conn, case DATATYPE_MACADDR: case DATATYPE_MACMASK: if (bufsize < VIR_MAC_STRING_BUFLEN) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for MAC address")); return 1; } @@ -202,7 +202,7 @@ printDataType(virConnectPtr conn, case DATATYPE_UINT16: if (snprintf(buf, bufsize, "%d", item->u.u16) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for uint16 type")); return 1; } @@ -213,7 +213,7 @@ printDataType(virConnectPtr conn, case DATATYPE_UINT8: if (snprintf(buf, bufsize, "%d", item->u.u8) >= bufsize) { - virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, + virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, "%s", _("Buffer too small for uint8 type")); return 1; } -- 1.6.6.1

2 2

[libvirt] [PATCH] Allow domain disk images on root-squash NFS to coexist with security driver.
by Laine Stump 02 Apr '10

02 Apr '10

(suggested by Daniel Berrange, tested by Dan Kenigsberg) virStorageFileGetMetadata will fail for disk images that are stored on a root-squash NFS share that isn't world-readable. SELinuxSetSecurityImageLabel is called during the startup of every domain (as long as security_driver != "none"), and it will propogate the error from virStorageFileGetMetadata, causing the domain startup to fail. This is, however, a common scenario when qemu is run as a non-root user and the disk image is stored on NFS. Ignoring this failure (which doesn't matter in this case, since the next thing done by SELinuxSetSecurityImageLabel - setting the file context - will also fail (and that function already ignores failures due to root-squash NFS) will allow us to continue bringing up the domain. The result is that we don't need to disable the entire security driver just because a domain's disk image is stored on root-squashed NFS. --- src/security/security_selinux.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c index 6680e2d..3e20475 100644 --- a/src/security/security_selinux.c +++ b/src/security/security_selinux.c @@ -430,7 +430,7 @@ SELinuxSetSecurityImageLabel(virDomainObjPtr vm, path = NULL; if (ret < 0) - return -1; + break; if (meta.backingStore != NULL && SELinuxSetFilecon(meta.backingStore, -- 1.6.6.1

2 2

[libvirt] [RFC]: Snapshot API v4
by Chris Lalancette 02 Apr '10

02 Apr '10

Hello, Here is the 4th (and hopefully final) draft for the snapshot API that we've been discussing. There is one minor change and one major change in this draft. The minor change is that we've added a virDomainSnapshotHasCurrent and virDomainSnapshotCurrent methods to get at the current snapshot. The major change is that I've removed all but one of the possible virDomainSnapshotDelete() flags. After reviewing ESX, virtualbox, and qemu, it seems that the deletion of any snapshots that have children will *automatically* merge the changes from that snapshot into the children to keep the children viable. Therefore, the MERGE and MERGE_FORCE flags are nonsensical. Since this is the virDomainSnapshotDelete call, we don't really need a flag to say "delete", so I've removed the DISCARD flag. What that leaves us with is a single flag to the delete API that says to delete this snapshot, and all children of this snapshot. This could be useful to clean out a tree of snapshots instead of doing it one-by-one. If there are no further major objections to this API, we'll be posting patches later today or tomorrow that implement this API for both qemu and virtualbox. Note that I've not included my full notes from last time. If anyone is still interested in those, I can either repost them or send them privately. /* NOTE: struct _virDomainSnapshot is a private structure, ala * struct _virDomain. */ typedef struct _virDomainSnapshot virDomainSnapshot; /* Take a snapshot of the current VM state. */ virDomainSnapshotPtr virDomainSnapshotCreateXML(virDomainPtr domain, const char *xmlDesc, unsigned int flags); /* Dump the XML of a snapshot */ /* NOTE: see below for proposed XML */ char *virDomainSnapshotGetXMLDesc(virDomainSnapshotPtr snapshot, unsigned int flags); /* Return the number of snapshots for this domain */ int virDomainSnapshotNum(virDomainPtr domain, unsigned int flags); /* Get the names of all snapshots for this domain */ int virDomainListSnapshotNames(virDomainPtr domain, char **names, int nameslen, unsigned int flags); /* Get a handle to a named snapshot */ virDomainSnapshotPtr virDomainSnapshotLookupByName(virDomainPtr domain, const char *name, unsigned int flags); /* Find out if domain "domain" has a current snapshot */ int virDomainSnapshotHasCurrent(virDomainPtr domain, unsigned int flags); /* Get a handle to the current in-use snapshot for the domain. */ int virDomainSnapshotCurrent(virDomainPtr domain, unsigned int flags); /* Start the guest from the snapshot "snapshot". Note that * the guest may either be running or not. * * In the case the VM is running, then the snapshot *must* have * been taken while the VM was running (i.e. the snapshot <state> * tag must be "RUNNING"). This will revert the disk and memory to * "snapshot". * * In the case the VM is not running, then the snapshot may * have been taken while the VM was not running or not. In * either case it will revert just the disk to "snapshot". */ int virDomainCreateFromSnapshot(virDomainSnapshotPtr snapshot, unsigned int flags); /* Delete a snapshot. * * TREE: discard this snapshot and any children snapshots * * Note that this operation can happen when the domain is running or shut * down, though this is hypervisor specific */ */ typedef enum { VIR_DOMAIN_SNAPSHOT_DELETE_TREE, } virDomainSnapshotDelete; int virDomainSnapshotDelete(virDomainSnapshotPtr snapshot, unsigned int flags); int virDomainSnapshotFree(virDomainSnapshotPtr snapshot); NOTE: During snapshot creation, *none* of the fields are required. That is, you can call virDomainSnapshotCreateXML() with an XML of "<domainsnapshot/>". In this case, the individual driver will make up a <name> for you, the <creationdate> will be set to the current time+date, <description> will be empty, <state> will be the current state of the VM, and <parent> will be set to the current snapshot (if any). If you do want to specify some fields during virDomainSnapshotCreateXML(), note that the only ones that are settable are <name> and <description>; the rest are ignored, and filled in by the driver when the snapshot is actually created. NOTE: <state> refers to the state of the VM when the snapshot was taken. NOTE: <creationdate> is in the format %Y-%m-%d_%T as defined by strptime. Also note that the granularity of <creationdate> is in seconds. <domainsnapshot> <name>XYZ</name> <creationdate>...</creationdate> <description>...</description> <state>RUNNING</state> <domain> <uuid>XXXXX-XXXX-XXXX-XXXX-XXXXXXXXX</uuid> </domain> <parent> <name>ABC</name> </parent> </domainsnapshot> The virsh commands will be: virsh snapshot-create <dom> [<xmlfile>] virsh snapshot-list <dom> virsh snapshot-dumpxml <dom> <name> virsh start-from-snapshot <dom> <snapshotname> virsh snapshot-delete <dom> <snapshotname> [--children] -- Chris Lalancette

2 2

[libvirt] [PATCH] nwfilter: Some fixes to XML parser
by Stefan Berger 01 Apr '10

01 Apr '10

While writing a couple of test cases for the nwfilter's XML parser I found some cases where the output ended up not looking as expected. So the following changes are in the patch below: - if the protocol ID in the MAC header is an integer, just write it into the datastructure without trying to find a corresponding string for it and if none is found failing - when writing the protocol ID as string, simply write it as integer if no corresponding string can be found - same changes for arpOpcode parsing and printing - same changes for protocol ID in an IP packet - DSCP value needs to be written into the data structure - IP protocol version number is redundant at this level, so remove it - parse the protocol ID found inside an IP packet not only as string but also as uint8 - arrange the display of the src and destination masks to be shown after the src and destination ip address respectively in the XML - the existing libvirt IP address parser accepts for example '25' as an IP address. I want this to be parsed as a CIDR type netmask. So try to parse it as an integer first (CIDR netmask) and if that doesn't work as a dotted IP address style netmask. - instantiation of rules with MAC masks didn't work because they weren't printed into a buffer, yet. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/conf/nwfilter_conf.c | 128 ++++++++++++++---------------- src/nwfilter/nwfilter_ebiptables_driver.c | 1 2 files changed, 61 insertions(+), 68 deletions(-) Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -403,15 +403,12 @@ checkMacProtocolID(enum attrDatatype dat virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED) { int32_t res = -1; - const char *str; if (datatype == DATATYPE_STRING) { if (intMapGetByString(macProtoMap, (char *)value, 1, &res) == 0) res = -1; } else if (datatype == DATATYPE_UINT16) { - if (intMapGetByInt(macProtoMap, - (int32_t)*(uint16_t *)value, &str) == 0) - res = -1; + res = (uint32_t)*(uint16_t *)value; } if (res != -1) { @@ -433,9 +430,10 @@ macProtocolIDFormatter(virBufferPtr buf, nwf->p.ethHdrFilter.dataProtocolID.u.u16, &str)) { virBufferVSprintf(buf, "%s", str); - return 1; + } else { + virBufferVSprintf(buf, "%d", nwf->p.ethHdrFilter.dataProtocolID.u.u16); } - return 0; + return 1; } @@ -500,15 +498,12 @@ arpOpcodeValidator(enum attrDatatype dat virNWFilterRuleDefPtr nwf) { int32_t res = -1; - const char *str; if (datatype == DATATYPE_STRING) { if (intMapGetByString(arpOpcodeMap, (char *)value, 1, &res) == 0) res = -1; } else if (datatype == DATATYPE_UINT16) { - if (intMapGetByInt(arpOpcodeMap, - (uint32_t)*(uint16_t *)value, &str) == 0) - res = -1; + res = (uint32_t)*(uint16_t *)value; } if (res != -1) { @@ -530,9 +525,10 @@ arpOpcodeFormatter(virBufferPtr buf, nwf->p.arpHdrFilter.dataOpcode.u.u16, &str)) { virBufferVSprintf(buf, "%s", str); - return 1; + } else { + virBufferVSprintf(buf, "%d", nwf->p.arpHdrFilter.dataOpcode.u.u16); } - return 0; + return 1; } @@ -560,16 +556,12 @@ static bool checkIPProtocolID(enum attrD virNWFilterRuleDefPtr nwf) { int32_t res = -1; - const char *str; if (datatype == DATATYPE_STRING) { if (intMapGetByString(ipProtoMap, (char *)value, 1, &res) == 0) res = -1; } else if (datatype == DATATYPE_UINT8) { - // may just accept what user provides and not test... - if (intMapGetByInt(ipProtoMap, - (uint32_t)*(uint16_t *)value, &str) == 0) - res = -1; + res = (uint32_t)*(uint16_t *)value; } if (res != -1) { @@ -591,19 +583,24 @@ formatIPProtocolID(virBufferPtr buf, nwf->p.ipHdrFilter.ipHdr.dataProtocolID.u.u8, &str)) { virBufferVSprintf(buf, "%s", str); - return 1; + } else { + virBufferVSprintf(buf, "%d", + nwf->p.ipHdrFilter.ipHdr.dataProtocolID.u.u8); } - return 0; + return 1; } static bool dscpValidator(enum attrDatatype datatype ATTRIBUTE_UNUSED, void *val, - virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED) + virNWFilterRuleDefPtr nwf) { uint8_t dscp = *(uint16_t *)val; if (dscp > 63) return 0; + + nwf->p.ipHdrFilter.ipHdr.dataDSCP.u.u8 = dscp; + return 1; } @@ -685,11 +682,6 @@ static const virXMLAttr2Struct arpAttrib static const virXMLAttr2Struct ipAttributes[] = { COMMON_MAC_PROPS(ipHdrFilter), { - .name = "version", - .datatype = DATATYPE_UINT8, - .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.ipHdr.dataIPVersion), - }, - { .name = SRCIPADDR, .datatype = DATATYPE_IPADDR, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.ipHdr.dataSrcIPAddr), @@ -711,7 +703,7 @@ static const virXMLAttr2Struct ipAttribu }, { .name = "protocol", - .datatype = DATATYPE_STRING, + .datatype = DATATYPE_STRING | DATATYPE_UINT8, .dataIdx = offsetof(virNWFilterRuleDef, p.ipHdrFilter.ipHdr.dataProtocolID), .validator= checkIPProtocolID, .formatter= formatIPProtocolID, @@ -756,16 +748,16 @@ static const virXMLAttr2Struct ipv6Attri .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataSrcIPAddr), }, { - .name = DSTIPADDR, - .datatype = DATATYPE_IPV6ADDR, - .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataDstIPAddr), - }, - { .name = SRCIPMASK, .datatype = DATATYPE_IPV6MASK, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataSrcIPMask), }, { + .name = DSTIPADDR, + .datatype = DATATYPE_IPV6ADDR, + .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataDstIPAddr), + }, + { .name = DSTIPMASK, .datatype = DATATYPE_IPV6MASK, .dataIdx = offsetof(virNWFilterRuleDef, p.ipv6HdrFilter.ipHdr.dataDstIPMask), @@ -818,16 +810,16 @@ static const virXMLAttr2Struct ipv6Attri .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataSrcIPAddr),\ },\ {\ - .name = DSTIPADDR,\ - .datatype = ADDRTYPE,\ - .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataDstIPAddr),\ - },\ - {\ .name = SRCIPMASK,\ .datatype = MASKTYPE,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataSrcIPMask),\ },\ {\ + .name = DSTIPADDR,\ + .datatype = ADDRTYPE,\ + .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataDstIPAddr),\ + },\ + {\ .name = DSTIPMASK,\ .datatype = MASKTYPE,\ .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataDstIPMask),\ @@ -1276,26 +1268,26 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_IPMASK: storage_ptr = &item->u.u8; - if (!virNWIPv4AddressParser(prop, &ipaddr)) { - if (sscanf(prop, "%d", &int_val) == 1) { - if (int_val >= 0 && int_val <= 32) { - if (!validator) - *(uint8_t *)storage_ptr = - (uint8_t)int_val; - found = 1; - data_ptr = &int_val; - } else - rc = -1; + if (virStrToLong_i(prop, NULL, 10, &int_val) == 0) { + if (int_val >= 0 && int_val <= 32) { + if (!validator) + *(uint8_t *)storage_ptr = + (uint8_t)int_val; + found = 1; + data_ptr = &int_val; } else rc = -1; } else { - int_val = virSocketGetNumNetmaskBits( + if (virNWIPv4AddressParser(prop, &ipaddr)) { + int_val = virSocketGetNumNetmaskBits( &ipaddr.addr); - if (int_val >= 0) - *(uint8_t *)storage_ptr = int_val; - else + if (int_val >= 0) + *(uint8_t *)storage_ptr = int_val; + else + rc = -1; + found = 1; + } else rc = -1; - found = 1; } break; @@ -1330,26 +1322,26 @@ virNWFilterRuleDetailsParse(virConnectPt case DATATYPE_IPV6MASK: storage_ptr = &item->u.u8; - if (!virNWIPv6AddressParser(prop, &ipaddr)) { - if (sscanf(prop, "%d", &int_val) == 1) { - if (int_val >= 0 && int_val <= 128) { - if (!validator) - *(uint8_t *)storage_ptr = - (uint8_t)int_val; - found = 1; - data_ptr = &int_val; - } else - rc = -1; + if (virStrToLong_i(prop, NULL, 10, &int_val) == 0) { + if (int_val >= 0 && int_val <= 128) { + if (!validator) + *(uint8_t *)storage_ptr = + (uint8_t)int_val; + found = 1; + data_ptr = &int_val; } else rc = -1; } else { - int_val = virSocketGetNumNetmaskBits( - &ipaddr.addr); - if (int_val >= 0) - *(uint8_t *)storage_ptr = int_val; - else - rc = -1; - found = 1; + if (virNWIPv6AddressParser(prop, &ipaddr)) { + int_val = virSocketGetNumNetmaskBits( + &ipaddr.addr); + if (int_val >= 0) + *(uint8_t *)storage_ptr = int_val; + else + rc = -1; + found = 1; + } else + rc = -1; } break; Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -189,6 +189,7 @@ printDataType(virConnectPtr conn, break; case DATATYPE_MACADDR: + case DATATYPE_MACMASK: if (bufsize < VIR_MAC_STRING_BUFLEN) { virNWFilterReportError(conn, VIR_ERR_INVALID_NWFILTER, _("Buffer too small for MAC address"));

3 3

[libvirt] Node devices XML format
by Dev.Atom 01 Apr '10

01 Apr '10

Hi, I need help about Node devices XML format description, there's no infos at libvirt.org, is there another info source where I can have description of this XML file ? Thanks, Best regards, Arnaud Champion

2 1

[libvirt] [PATCHv2 00/10] Begin to replace scanf and atoi
by Matthias Bolte 01 Apr '10

01 Apr '10

This set of patches is a first step towards removing the scanf and atoi usage in libvirt. I began with the simple cases and post this now to get some feedback before I start to convert the more difficult cases. Changes in v2: - don't test tmp for NULL - note in commit message if parsing is stricter now - don't leak in PRUnicharToInt (vbox) - strip a trailing \n in openvzGetVPSUUID, as it was done before - don't use strspn to skip whitespaces, virStrToLong* does this already - fix virStrToLong* return value tests to check for < 0 instead of < 3 or != 1 - add STRSKIP to skip a given prefix of a string Thanks to Eric Blake and Jim Meyering. Matthias

2 22

[libvirt] [PATCH] ESX test case needs '/' in interface name
by Stefan Berger 01 Apr '10

01 Apr '10

To fix an ESX test case, valid interface names need '/' as valid letter. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> Index: libvirt-acl/src/conf/domain_conf.h =================================================================== --- libvirt-acl.orig/src/conf/domain_conf.h +++ libvirt-acl/src/conf/domain_conf.h @@ -298,7 +298,7 @@ struct _virDomainNetDef { }; # define VALID_IFNAME_CHARS \ - "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_" + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_/" enum virDomainChrTargetType { VIR_DOMAIN_CHR_TARGET_TYPE_NULL = 0,

2 2

[libvirt] [PATCH] Fix linker errors in proxy
by Matthias Bolte 31 Mar '10

31 Mar '10

domain_conf.c:494: undefined reference to 'virNWFilterHashTableFree' domain_conf.c:5107: undefined reference to 'virNWFilterFormatParamAttributes' Add missing source to the proxy and disable XML parsing code in nwfilter_params.c for a proxy build. --- proxy/Makefile.am | 2 ++ src/conf/nwfilter_params.c | 2 ++ 2 files changed, 4 insertions(+), 0 deletions(-) diff --git a/proxy/Makefile.am b/proxy/Makefile.am index aef11ca..9ea91d8 100644 --- a/proxy/Makefile.am +++ b/proxy/Makefile.am @@ -15,6 +15,7 @@ libexec_PROGRAMS = libvirt_proxy libvirt_proxy_SOURCES = libvirt_proxy.c \ @top_srcdir@/src/util/buf.c \ + @top_srcdir@/src/util/hash.c \ @top_srcdir@/src/util/logging.c \ @top_srcdir@/src/util/memory.c \ @top_srcdir@/src/util/network.c \ @@ -26,6 +27,7 @@ libvirt_proxy_SOURCES = libvirt_proxy.c \ @top_srcdir@/src/conf/storage_encryption_conf.c \ @top_srcdir@/src/conf/domain_conf.c \ @top_srcdir@/src/conf/cpu_conf.c \ + @top_srcdir@/src/conf/nwfilter_params.c \ @top_srcdir@/src/xen/xend_internal.c \ @top_srcdir@/src/xen/xen_hypervisor.c \ @top_srcdir@/src/xen/sexpr.c \ diff --git a/src/conf/nwfilter_params.c b/src/conf/nwfilter_params.c index 38a51c9..286c5ef 100644 --- a/src/conf/nwfilter_params.c +++ b/src/conf/nwfilter_params.c @@ -214,6 +214,7 @@ err_exit: } +#ifndef PROXY virNWFilterHashTablePtr virNWFilterParseParamAttributes(xmlNodePtr cur) { @@ -254,6 +255,7 @@ skip_entry: } return table; } +#endif struct formatterParam { -- 1.6.3.3

2 2

[libvirt] [PATCH] Fix ./configure: line 27875: [: missing `]'
by Matthias Bolte 31 Mar '10

31 Mar '10

Commit 7998714d60b997357bfea15d6f2d0f729fc8fb29 replaced '-a' with '&& test' but this single '-a' needs to stay. --- configure.ac | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 3c3d7b3..fc87e19 100644 --- a/configure.ac +++ b/configure.ac @@ -240,7 +240,7 @@ AC_ARG_WITH([libvirtd], dnl dnl specific tests to setup DV devel environments with debug etc ... dnl -if [[ "${LOGNAME}" = "veillard" && test "`pwd`" = "/u/veillard/libvirt" ]] ; then +if [[ "${LOGNAME}" = "veillard" -a "`pwd`" = "/u/veillard/libvirt" ]] ; then STATIC_BINARIES="-static" else STATIC_BINARIES= -- 1.6.3.3

2 4

[libvirt] [PATCH] nwfilter: Support for learning a VM's IP address
by Stefan Berger 31 Mar '10

31 Mar '10

Subject: Support for learning a VM's IP address This patch implements support for learning a VM's IP address. It uses the pcap library to listen on the VM's backend network interface (tap) or the physical ethernet device (macvtap) and tries to capture packets with source or destination MAC address of the VM and learn from DHCP Offers, ARP traffic, or first-sent IPv4 packet what the IP address of the VM's interface is. This then allows to instantiate the network traffic filtering rules without the user having to provide the IP parameter somewhere in the filter description or in the interface description as a parameter. This only supports to detect the parameter IP, which is for the assumed single IPv4 address of a VM. There is not support for interfaces that may have multiple IP addresses (IP aliasing) or IPv6 that may then require more than one valid IP address to be detected. A VM can have multiple independent interfaces that each uses a different IP address and in that case it will be attempted to detect each one of the address independently. So, when for example an interface description in the domain XML has looked like this up to now: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'> <parameter name='IP' value='10.2.3.4'/> </filterref> </interface> you may omit the IP parameter: <interface type='bridge'> <source bridge='mybridge'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> Internally I am walking the 'tree' of a VM's referenced network filters and determine with the given variables which variables are missing. Now, the above IP parameter may be missing and this causes a libvirt-internal thread to be started that uses the pcap library's API to listen to the backend interface (in case of macvtap to the physical interface) in an attempt to determine the missing IP parameter. If the backend interface disappears the thread terminates assuming the VM was brought down. In case of a macvtap device a timeout is being used to wait for packets from the given VM (filtering by VM's interface MAC address). If the VM's macvtap device disappeared the thread also terminates. In all other cases it tries to determine the IP address of the VM and will then apply the rules late on the given interface, which would have happened immediately if the IP parameter had been explicitly given. In case an error happens while the firewall rules are applied, the VM's backend interface is 'down'ed preventing it to communicate. Reasons for failure for applying the network firewall rules may that an ebtables/iptables command failes or OOM errors. Essentially the same failure reasons may occur as when the firewall rules are applied immediately on VM start, except that due to the late application of the filtering rules the VM now is already running and cannot be hindered anymore from starting. Bringing down the whole VM would probably be considered too drastic. While a VM's IP address is attempted to be determined only limited updates to network filters are allowed. In particular it is prevented that filters are modified in such a way that they would introduce new variables. A caveat: The algorithm does not know which one is the appropriate IP address of a VM. If the VM spoofs an IP address in its first ARP traffic or IPv4 packets its filtering rules will be instantiated for this IP address, thus 'locking' it to the found IP address. So, it's still 'safer' to explicitly provide the IP address of a VM's interface in the filter description if it is known beforehand. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- configure.ac | 39 ++ src/Makefile.am | 13 src/conf/nwfilter_conf.c | 7 src/conf/nwfilter_conf.h | 3 src/libvirt_private.syms | 12 src/nwfilter/nwfilter_driver.c | 11 src/nwfilter/nwfilter_ebiptables_driver.c | 100 +++++ src/nwfilter/nwfilter_ebiptables_driver.h | 7 src/nwfilter/nwfilter_gentech_driver.c | 408 +++++++++++++++++++-- src/nwfilter/nwfilter_gentech_driver.h | 14 src/nwfilter/nwfilter_learnipaddr.c | 579 ++++++++++++++++++++++++++++++ src/nwfilter/nwfilter_learnipaddr.h | 61 +++ 12 files changed, 1216 insertions(+), 38 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.h @@ -0,0 +1,61 @@ +/* + * nwfilter_learnipaddr.h: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#ifndef __NWFILTER_LEARNIPADDR_H +#define __NWFILTER_LEARNIPADDR_H + +typedef struct _virNWFilterIPAddrLearnReq virNWFilterIPAddrLearnReq; +typedef virNWFilterIPAddrLearnReq *virNWFilterIPAddrLearnReqPtr; +struct _virNWFilterIPAddrLearnReq { + char ifname[IF_NAMESIZE]; + char linkdev[IF_NAMESIZE]; + enum virDomainNetType nettype; + unsigned char macaddr[VIR_MAC_BUFLEN]; + char *filtername; + virNWFilterHashTablePtr filterparams; + virNWFilterDriverStatePtr driver; + + int status; + pthread_t thread; +}; + +int virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); + +virNWFilterIPAddrLearnReqPtr virNWFilterLookupLearnReq(const char *ifname); + + +void virNWFilterDelIpAddrForIfname(const char *ifname); +const char *virNWFilterGetIpAddrForIfname(const char *ifname); + +int virNWFilterLearnInit(void); +void virNWFilterLearnShutdown(void); + +#endif /* __NWFILTER_LEARNIPADDR_H */ Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- /dev/null +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -0,0 +1,579 @@ +/* + * nwfilter_learnipaddr.c: support for learning IP address used by a VM + * on an interface + * + * Copyright (C) 2010 IBM Corp. + * Copyright (C) 2010 Stefan Berger + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#include <config.h> + +#ifdef HAVE_LIBPCAP +#include <pcap.h> +#endif + +#include <fcntl.h> +#include <sys/ioctl.h> + +#include <arpa/inet.h> +#include <net/ethernet.h> +#include <netinet/ip.h> +#include <netinet/udp.h> +#include <net/if_arp.h> +#include <linux/if.h> + +#include "internal.h" + +#include "buf.h" +#include "memory.h" +#include "logging.h" +#include "datatypes.h" +#include "virterror_internal.h" +#include "threads.h" +#include "conf/nwfilter_params.h" +#include "conf/domain_conf.h" +#include "nwfilter_gentech_driver.h" +#include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" + +#define VIR_FROM_THIS VIR_FROM_NWFILTER + + +/* structure of an ARP request/reply message */ +struct f_arphdr { + struct arphdr arphdr; + uint8_t ar_sha[ETH_ALEN]; + uint32_t ar_sip; + uint8_t ar_tha[ETH_ALEN]; + uint32_t ar_tip; +} __attribute__((packed)); + + +/* structure representing DHCP message */ +struct dhcp { + uint8_t op; + uint8_t htype; + uint8_t hlen; + uint8_t hops; + uint32_t xid; + uint16_t secs; + uint16_t flags; + uint32_t ciaddr; + uint32_t yiaddr; + uint32_t siaddr; + uint32_t giaddr; + uint32_t chaddr; + /* omitted */ +} __attribute__((packed)); + + +struct ether_vlan_header +{ + uint8_t dhost[ETH_ALEN]; + uint8_t shost[ETH_ALEN]; + uint16_t vlan_type; + uint16_t vlan_flags; + uint16_t ether_type; +} __attribute__((packed)); + + +static virMutex pendingLearnReqLock; +static virHashTablePtr pendingLearnReq; + +static virMutex ipAddressMapLock; +static virNWFilterHashTablePtr ipAddressMap; + + +static void +virNWFilterIPAddrLearnReqFree(virNWFilterIPAddrLearnReqPtr req) { + if (!req) + return; + + VIR_FREE(req->filtername); + virNWFilterHashTableFree(req->filterparams); + + VIR_FREE(req); +} + + +#if HAVE_LIBPCAP + +static int +virNWFilterRegisterLearnReq(virNWFilterIPAddrLearnReqPtr req) { + int res = -1; + virMutexLock(&pendingLearnReqLock); + + if (!virHashLookup(pendingLearnReq, req->ifname)) + res = virHashAddEntry(pendingLearnReq, req->ifname, req); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + +#endif + + +virNWFilterIPAddrLearnReqPtr +virNWFilterLookupLearnReq(const char *ifname) { + void *res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + +static void +freeLearnReqEntry(void *payload, const char *name ATTRIBUTE_UNUSED) { + virNWFilterIPAddrLearnReqFree(payload); +} + + +#ifdef HAVE_LIBPCAP + +static virNWFilterIPAddrLearnReqPtr +virNWFilterDeregisterLearnReq(const char *ifname) { + virNWFilterIPAddrLearnReqPtr res; + + virMutexLock(&pendingLearnReqLock); + + res = virHashLookup(pendingLearnReq, ifname); + + if (res) + virHashRemoveEntry(pendingLearnReq, ifname, NULL); + + virMutexUnlock(&pendingLearnReqLock); + + return res; +} + + + +static int +virNWFilterAddIpAddrForIfname(const char *ifname, char *addr) { + int ret; + + virMutexLock(&ipAddressMapLock); + + ret = virNWFilterHashTablePut(ipAddressMap, ifname, addr, 1); + + virMutexUnlock(&ipAddressMapLock); + + return ret; +} +#endif + + +void +virNWFilterDelIpAddrForIfname(const char *ifname) { + + virMutexLock(&ipAddressMapLock); + + if (virHashLookup(ipAddressMap->hashTable, ifname)) + virNWFilterHashTableRemoveEntry(ipAddressMap, ifname); + + virMutexUnlock(&ipAddressMapLock); +} + + +const char * +virNWFilterGetIpAddrForIfname(const char *ifname) { + const char *res; + + virMutexLock(&ipAddressMapLock); + + res = virHashLookup(ipAddressMap->hashTable, ifname); + + virMutexUnlock(&ipAddressMapLock); + + return res; +} + + +#ifdef HAVE_LIBPCAP + +/** + * learnIPAddressThread + * arg: pointer to virNWFilterIPAddrLearnReq structure + * + * Learn the IP address being used on an interface. Use ARP Request and + * Reply messages, DHCP offers and the first IP packet being sent from + * the VM to detect the IP address it is using. Detects only one IP address + * per interface (IP aliasing not supported) + */ +static void * +learnIPAddressThread(void *arg) +{ + char errbuf[PCAP_ERRBUF_SIZE] = {0}; + pcap_t *handle; + struct bpf_program fp; + struct pcap_pkthdr header; + const u_char *packet; + struct ether_header *ether_hdr; + struct ether_vlan_header *vlan_hdr; + virNWFilterIPAddrLearnReqPtr req = arg; + uint32_t vmaddr = 0; + unsigned int ethHdrSize; + char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev + : req->ifname; + int to_ms = (strlen(req->linkdev) != 0) ? 1000 + : 0; + char macaddr[VIR_MAC_STRING_BUFLEN]; + virBuffer buf = VIR_BUFFER_INITIALIZER; + char *filter= NULL; + uint16_t etherType; + + req->status = 0; + + handle = pcap_open_live(listen_if, BUFSIZ, 0, to_ms, errbuf); + + if (handle == NULL) { + VIR_DEBUG("Couldn't open device %s: %s\n", listen_if, errbuf); + req->status = ENODEV; + goto done; + } + + virFormatMacAddr(req->macaddr, macaddr); + virBufferVSprintf(&buf, "ether host %s", macaddr); + if (virBufferError(&buf)) { + req->status = ENOMEM; + goto done; + } + + filter = virBufferContentAndReset(&buf); + + if (pcap_compile(handle, &fp, filter, 1, 0) != 0 || + pcap_setfilter(handle, &fp) != 0) { + VIR_DEBUG("Couldn't compile or set filter '%s'.\n", filter); + req->status = EINVAL; + goto done; + } + + while (req->status == 0 && vmaddr == 0) { + packet = pcap_next(handle, &header); + + if (!packet) { + if (to_ms == 0) { + /* assuming IF disappeared */ + req->status = ENODEV; + break; + } + /* listening on linkdev, check whether VM's dev is still there */ + if (checkIf(req->ifname, req->macaddr)) { + req->status = ENODEV; + break; + } + continue; + } + + if (header.len >= sizeof(struct ether_header)) { + ether_hdr = (struct ether_header*)packet; + + switch (ntohs(ether_hdr->ether_type)) { + + case ETHERTYPE_IP: + ethHdrSize = sizeof(struct ether_header); + etherType = ntohs(ether_hdr->ether_type); + break; + + case ETHERTYPE_VLAN: + ethHdrSize = sizeof(struct ether_vlan_header); + vlan_hdr = (struct ether_vlan_header *)packet; + if (ntohs(vlan_hdr->ether_type) != ETHERTYPE_IP || + header.len < ethHdrSize) + continue; + etherType = ntohs(vlan_hdr->ether_type); + break; + + default: + continue; + } + + if (memcmp(ether_hdr->ether_shost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets from the VM + + if ((header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + vmaddr = iphdr->saddr; + // skip eth. bcast and mcast addresses, + // and zero address in DHCP Requests + if ((ntohl(vmaddr) & 0xc0000000) || vmaddr == 0) { + vmaddr = 0; + continue; + } + + } else if (etherType == ETHERTYPE_ARP && + (header.len >= ethHdrSize + + sizeof(struct f_arphdr))) { + struct f_arphdr *arphdr = (struct f_arphdr*)(packet + + ethHdrSize); + switch (ntohs(arphdr->arphdr.ar_op)) { + case ARPOP_REPLY: + vmaddr = arphdr->ar_sip; + break; + case ARPOP_REQUEST: + vmaddr = arphdr->ar_tip; + break; + } + } + } else if (memcmp(ether_hdr->ether_dhost, + req->macaddr, + VIR_MAC_BUFLEN) == 0) { + // packets to the VM + if (etherType == ETHERTYPE_IP && + (header.len >= ethHdrSize + + sizeof(struct iphdr))) { + struct iphdr *iphdr = (struct iphdr*)(packet + + ethHdrSize); + if ((iphdr->protocol == IPPROTO_UDP) && + (header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr))) { + struct udphdr *udphdr= (struct udphdr *) + ((char *)iphdr + iphdr->ihl * 4); + if (ntohs(udphdr->source) == 67 && + ntohs(udphdr->dest) == 68 && + header.len >= ethHdrSize + + iphdr->ihl * 4 + + sizeof(struct udphdr) + + sizeof(struct dhcp)) { + struct dhcp *dhcp = (struct dhcp *) + ((char *)udphdr + sizeof(udphdr)); + if (dhcp->op == 2 /* DHCP OFFER */) { + vmaddr = dhcp->yiaddr; + } + } + } + } + } + } + } + + done: + VIR_FREE(filter); + + if (handle) + pcap_close(handle); + + ebtablesRemoveBasicRules(NULL, req->ifname); + + if (req->status == 0) { + int ret; + char inetaddr[INET_ADDRSTRLEN]; + inet_ntop(AF_INET, &vmaddr, inetaddr, sizeof(inetaddr)); + + virNWFilterAddIpAddrForIfname(req->ifname, strdup(inetaddr)); + + ret = virNWFilterInstantiateFilterLate(NULL, + req->ifname, + req->linkdev, + req->nettype, + req->macaddr, + req->filtername, + req->filterparams, + req->driver); + VIR_DEBUG("Result from applying firewall rules on " + "%s with IP addr %s : %d\n", req->ifname, inetaddr, ret); + } + + memset(&req->thread, 0x0, sizeof(req->thread)); + + VIR_DEBUG("pcap thread terminating for interface %s\n",req->ifname); + + virNWFilterDeregisterLearnReq(req->ifname); + + virNWFilterIPAddrLearnReqFree(req); + + return 0; +} + + +/** + * virNWFilterLearnIPAddress + * @conn: pointer to virConnect object + * @ifname: the name of the interface + * @linkdev : the name of the link device; currently only used in case of a + * macvtap device + * @nettype : the type of interface + * @macaddr : the MAC address of the interface + * @filtername : the name of the top-level filter to apply to the interface + * once its IP address has been detected + * @driver : the network filter driver + * + * Instruct to learn the IP address being used on a given interface (ifname). + * Unless there already is a thread attempting to learn the IP address + * being used on the interface, a thread is started that will listen on + * the traffic being sent on the interface (or link device) with the + * MAC address that is provided. Will then launch the application of the + * firewall rules on the interface. + */ +int +virNWFilterLearnIPAddress(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) { + int rc; + virNWFilterIPAddrLearnReqPtr req = NULL; + virNWFilterHashTablePtr ht = NULL; + + if (VIR_ALLOC(req) < 0) { + virReportOOMError(); + goto err_exit; + } + + ht = virNWFilterHashTableCreate(0); + if (ht == NULL) { + virReportOOMError(); + goto err_exit; + } + + if (virNWFilterHashTablePutAll(conn, filterparams, ht)) + goto err_exit; + + req->filtername = strdup(filtername); + if (req->filtername == NULL) { + virReportOOMError(); + goto err_exit; + } + + if (virStrcpyStatic(req->ifname, ifname) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for ifname ('%s') " + "not large enough"), ifname); + goto err_exit; + } + + if (linkdev) { + if (virStrcpyStatic(req->linkdev, linkdev) == NULL) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("Destination buffer for linkdev ('%s') " + "not large enough"), linkdev); + goto err_exit; + } + } + req->nettype = nettype; + memcpy(req->macaddr, macaddr, sizeof(req->macaddr)); + req->driver = driver; + req->filterparams = ht; + ht = NULL; + + rc = virNWFilterRegisterLearnReq(req); + + if (rc) + goto err_exit; + + if (ebtablesApplyBasicRules(conn, + ifname, + macaddr)) { + goto err_exit; + } + + if (pthread_create(&req->thread, + NULL, + learnIPAddressThread, + req) != 0) + goto err_exit; + + return 0; + +err_exit: + ebtablesRemoveBasicRules(conn, ifname); + virNWFilterIPAddrLearnReqFree(req); + virNWFilterHashTableFree(ht); + return 1; +} + +#else + +int +virNWFilterLearnIPAddress(virConnectPtr conn ATTRIBUTE_UNUSED, + const char *ifname ATTRIBUTE_UNUSED, + const char *linkdev ATTRIBUTE_UNUSED, + enum virDomainNetType nettype ATTRIBUTE_UNUSED, + const unsigned char *macaddr ATTRIBUTE_UNUSED, + const char *filtername ATTRIBUTE_UNUSED, + virNWFilterHashTablePtr filterparams ATTRIBUTE_UNUSED, + virNWFilterDriverStatePtr driver ATTRIBUTE_UNUSED) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("IP parameter must be given since libvirt " + "was not compiled with IP address learning " + "support")); + return 1; +} +#endif /* HAVE_LIBPCAP */ + + +/** + * virNWFilterLearnInit + * Initialization of this layer + */ +int +virNWFilterLearnInit(void) { + pendingLearnReq = virHashCreate(0); + if (!pendingLearnReq) { + virReportOOMError(); + return 1; + } + + if (virMutexInit(&pendingLearnReqLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + ipAddressMap = virNWFilterHashTableCreate(0); + if (!ipAddressMap) { + virReportOOMError(); + virNWFilterLearnShutdown(); + return 1; + } + + if (virMutexInit(&ipAddressMapLock)) { + virNWFilterLearnShutdown(); + return 1; + } + + return 0; +} + + +/** + * virNWFilterLearnShutdown + * Shutdown of this layer + */ +void +virNWFilterLearnShutdown(void) { + virHashFree(pendingLearnReq, freeLearnReqEntry); + pendingLearnReq = NULL; + + virNWFilterHashTableFree(ipAddressMap); + ipAddressMap = NULL; +} Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -289,7 +289,8 @@ STORAGE_HELPER_DISK_SOURCES = \ NWFILTER_DRIVER_SOURCES = \ nwfilter/nwfilter_driver.h nwfilter/nwfilter_driver.c \ nwfilter/nwfilter_gentech_driver.c \ - nwfilter/nwfilter_ebiptables_driver.c + nwfilter/nwfilter_ebiptables_driver.c \ + nwfilter/nwfilter_learnipaddr.c # Security framework and drivers for various models SECURITY_DRIVER_SOURCES = \ @@ -740,10 +741,11 @@ else libvirt_la_LIBADD += libvirt_driver_nwfilter.la noinst_LTLIBRARIES += libvirt_driver_nwfilter.la endif -libvirt_driver_nwfilter_la_CFLAGS = \ +libvirt_driver_nwfilter_la_CFLAGS = $(LIBPCAP_CFLAGS) \ -I@top_srcdir@/src/conf +libvirt_driver_nwfilter_la_LDFLAGS = $(LIBPCAP_LIBS) if WITH_DRIVER_MODULES -libvirt_driver_nwfilter_la_LDFLAGS = -module -avoid-version ../gnulib/lib/libgnu.la +libvirt_driver_nwfilter_la_LDFLAGS += -module -avoid-version ../gnulib/lib/libgnu.la endif libvirt_driver_nwfilter_la_SOURCES = $(NWFILTER_DRIVER_SOURCES) endif @@ -887,6 +889,7 @@ libvirt_la_LDFLAGS = $(VERSION_SCRIPT_FL -version-info $(LIBVIRT_VERSION_INFO) \ $(COVERAGE_CFLAGS:-f%=-Wc,-f%) \ $(LIBXML_LIBS) \ + $(LIBPCAP_LIBS) \ $(DRIVER_MODULE_LIBS) \ $(CYGWIN_EXTRA_LDFLAGS) $(MINGW_EXTRA_LDFLAGS) libvirt_la_CFLAGS = $(COVERAGE_CFLAGS) -DIN_LIBVIRT @@ -935,8 +938,8 @@ libvirt_lxc_SOURCES = \ $(NODE_INFO_SOURCES) \ $(ENCRYPTION_CONF_SOURCES) \ $(DOMAIN_CONF_SOURCES) \ - $(NWFILTER_PARAM_CONF_SOURCES) \ - $(CPU_CONF_SOURCES) + $(CPU_CONF_SOURCES) \ + $(NWFILTER_PARAM_CONF_SOURCES) libvirt_lxc_LDFLAGS = $(WARN_CFLAGS) $(COVERAGE_LDCFLAGS) $(CAPNG_LIBS) $(YAJL_LIBS) libvirt_lxc_LDADD = $(LIBXML_LIBS) $(NUMACTL_LIBS) ../gnulib/lib/libgnu.la libvirt_lxc_CFLAGS = \ Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.c @@ -24,6 +24,9 @@ #include <config.h> #include <stdint.h> +#include <sys/socket.h> +#include <sys/ioctl.h> +#include <linux/if.h> #include "internal.h" @@ -34,12 +37,16 @@ #include "virterror_internal.h" #include "nwfilter_gentech_driver.h" #include "nwfilter_ebiptables_driver.h" +#include "nwfilter_learnipaddr.h" #define VIR_FROM_THIS VIR_FROM_NWFILTER #define NWFILTER_STD_VAR_MAC "MAC" +#define NWFILTER_STD_VAR_IP "IP" + +static int _virNWFilterTeardownFilter(const char *ifname); static virNWFilterTechDriverPtr filter_tech_drivers[] = { @@ -111,6 +118,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI * @tables: pointer to hash tabel to add values to * @macaddr: The string of the MAC address to add to the hash table, * may be NULL + * @ipaddr: The string of the IP address to add to the hash table; + * may be NULL * * Returns 0 in case of success, 1 in case an error happened with * error having been reported. @@ -120,7 +129,8 @@ virNWFilterRuleInstFree(virNWFilterRuleI static int virNWFilterVarHashmapAddStdValues(virConnectPtr conn, virNWFilterHashTablePtr table, - char *macaddr) + char *macaddr, + char *ipaddr) { if (macaddr) { if (virHashAddEntry(table->hashTable, @@ -132,6 +142,16 @@ virNWFilterVarHashmapAddStdValues(virCon } } + if (ipaddr) { + if (virHashAddEntry(table->hashTable, + NWFILTER_STD_VAR_IP, + ipaddr) < 0) { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + "%s", _("Could not add variable 'IP' to hashmap")); + return 1; + } + } + return 0; } @@ -140,23 +160,26 @@ virNWFilterVarHashmapAddStdValues(virCon * virNWFilterCreateVarHashmap: * @conn: pointer to virConnect object * @macaddr: pointer to string containing formatted MAC address of interface + * @ipaddr: pointer to string containing formatted IP address used by + * VM on this interface; may be NULL * * Create a hashmap used for evaluating the firewall rules. Initializes - * it with the standard variable 'MAC'. + * it with the standard variable 'MAC' and 'IP' if provided. * * Returns pointer to hashmap, NULL if an error occcurred and error message * is attached to the virConnect object. */ virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr) { + char *macaddr, + char *ipaddr) { virNWFilterHashTablePtr table = virNWFilterHashTableCreate(0); if (!table) { virReportOOMError(); return NULL; } - if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr)) { + if (virNWFilterVarHashmapAddStdValues(conn, table, macaddr, ipaddr)) { virNWFilterHashTableFree(table); return NULL; } @@ -284,9 +307,9 @@ _virNWFilterInstantiateRec(virConnectPtr virNWFilterHashTablePtr vars, int *nEntries, virNWFilterRuleInstPtr **insts, - enum instCase useNewFilter, int *foundNewFilter) + enum instCase useNewFilter, int *foundNewFilter, + virNWFilterDriverStatePtr driver) { - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterPoolObjPtr obj; int rc = 0; int i; @@ -365,7 +388,96 @@ _virNWFilterInstantiateRec(virConnectPtr tmpvars, nEntries, insts, useNewFilter, - foundNewFilter); + foundNewFilter, + driver); + + virNWFilterHashTableFree(tmpvars); + + virNWFilterPoolObjUnlock(obj); + if (rc) + break; + } else { + virNWFilterReportError(conn, VIR_ERR_INTERNAL_ERROR, + _("referenced filter '%s' is missing"), + inc->filterref); + rc = 1; + break; + } + } + } + return rc; +} + + +static int +virNWFilterDetermineMissingVarsRec(virConnectPtr conn, + virNWFilterDefPtr filter, + virNWFilterHashTablePtr vars, + virNWFilterHashTablePtr missing_vars, + int useNewFilter, + virNWFilterDriverStatePtr driver) +{ + virNWFilterPoolObjPtr obj; + int rc = 0; + int i, j; + virNWFilterDefPtr next_filter; + + for (i = 0; i < filter->nentries; i++) { + virNWFilterRuleDefPtr rule = filter->filterEntries[i]->rule; + virNWFilterIncludeDefPtr inc = filter->filterEntries[i]->include; + if (rule) { + // check all variables of this rule + for (j = 0; j < rule->nvars; j++) { + if (!virHashLookup(vars->hashTable, rule->vars[j])) { + virNWFilterHashTablePut(missing_vars, rule->vars[j], + strdup("1"), 1); + } + } + } else if (inc) { + VIR_DEBUG("Following filter %s\n", inc->filterref); + obj = virNWFilterPoolObjFindByName(&driver->pools, + inc->filterref); + if (obj) { + + if (obj->wantRemoved) { + virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, + _("Filter '%s' is in use."), + inc->filterref); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + // create a temporary hashmap for depth-first tree traversal + virNWFilterHashTablePtr tmpvars = + virNWFilterCreateVarsFrom(conn, + inc->params, + vars); + if (!tmpvars) { + virReportOOMError(); + rc = 1; + virNWFilterPoolObjUnlock(obj); + break; + } + + next_filter = obj->def; + + switch (useNewFilter) { + case INSTANTIATE_FOLLOW_NEWFILTER: + if (obj->newDef) { + next_filter = obj->newDef; + } + break; + case INSTANTIATE_ALWAYS: + break; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + next_filter, + tmpvars, + missing_vars, + useNewFilter, + driver); virNWFilterHashTableFree(tmpvars); @@ -438,9 +550,12 @@ virNWFilterInstantiate(virConnectPtr con enum virDomainNetType nettype, virNWFilterDefPtr filter, const char *ifname, + const char *linkdev, virNWFilterHashTablePtr vars, enum instCase useNewFilter, int *foundNewFilter, - bool teardownOld) + bool teardownOld, + const unsigned char *macaddr, + virNWFilterDriverStatePtr driver) { int rc; int j, nptrs; @@ -449,6 +564,44 @@ virNWFilterInstantiate(virConnectPtr con void **ptrs = NULL; int instantiate = 1; + virNWFilterLockFilterUpdates(); + + virNWFilterHashTablePtr missing_vars = virNWFilterHashTableCreate(0); + if (!missing_vars) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + + rc = virNWFilterDetermineMissingVarsRec(conn, + filter, + vars, + missing_vars, + useNewFilter, + driver); + if (rc) + goto err_exit; + + if (virHashSize(missing_vars->hashTable) == 1) { + if (virHashLookup(missing_vars->hashTable, + NWFILTER_STD_VAR_IP) != NULL) { + if (virNWFilterLookupLearnReq(ifname) == NULL) { + rc = virNWFilterLearnIPAddress(conn, + ifname, + linkdev, + nettype, macaddr, + filter->name, + vars, driver); + } + goto err_exit; + } + rc = 1; + goto err_exit; + } else if (virHashSize(missing_vars->hashTable) > 1) { + rc = 1; + goto err_exit; + } + rc = _virNWFilterInstantiateRec(conn, techdriver, nettype, @@ -456,7 +609,8 @@ virNWFilterInstantiate(virConnectPtr con ifname, vars, &nEntries, &insts, - useNewFilter, foundNewFilter); + useNewFilter, foundNewFilter, + driver); if (rc) goto err_exit; @@ -487,24 +641,33 @@ virNWFilterInstantiate(virConnectPtr con err_exit: + virNWFilterUnlockFilterUpdates(); + for (j = 0; j < nEntries; j++) virNWFilterRuleInstFree(insts[j]); VIR_FREE(insts); + virNWFilterHashTableFree(missing_vars); + return rc; } static int -_virNWFilterInstantiateFilter(virConnectPtr conn, - const virDomainNetDefPtr net, - bool teardownOld, - enum instCase useNewFilter) +__virNWFilterInstantiateFilter(virConnectPtr conn, + bool teardownOld, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + enum instCase useNewFilter, + virNWFilterDriverStatePtr driver) { int rc; const char *drvname = EBIPTABLES_DRIVER_ID; - virNWFilterDriverStatePtr driver = conn->nwfilterPrivateData; virNWFilterTechDriverPtr techdriver; virNWFilterPoolObjPtr obj; virNWFilterHashTablePtr vars, vars1; @@ -512,6 +675,8 @@ _virNWFilterInstantiateFilter(virConnect char vmmacaddr[VIR_MAC_STRING_BUFLEN] = {0}; int foundNewFilter = 0; char *str_macaddr = NULL; + const char *ipaddr; + char *str_ipaddr = NULL; techdriver = virNWFilterTechDriverForName(drvname); @@ -523,25 +688,25 @@ _virNWFilterInstantiateFilter(virConnect return 1; } - VIR_DEBUG("filter name: %s\n", net->filter); + VIR_DEBUG("filter name: %s\n", filtername); - obj = virNWFilterPoolObjFindByName(&driver->pools, net->filter); + obj = virNWFilterPoolObjFindByName(&driver->pools, filtername); if (!obj) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Could not find filter '%s'"), - net->filter); + filtername); return 1; } if (obj->wantRemoved) { virNWFilterReportError(conn, VIR_ERR_NO_NWFILTER, _("Filter '%s' is in use."), - net->filter); + filtername); rc = 1; goto err_exit; } - virFormatMacAddr(net->mac, vmmacaddr); + virFormatMacAddr(macaddr, vmmacaddr); str_macaddr = strdup(vmmacaddr); if (!str_macaddr) { virReportOOMError(); @@ -549,18 +714,29 @@ _virNWFilterInstantiateFilter(virConnect goto err_exit; } + ipaddr = virNWFilterGetIpAddrForIfname(ifname); + if (ipaddr) { + str_ipaddr = strdup(ipaddr); + if (!str_ipaddr) { + virReportOOMError(); + rc = 1; + goto err_exit; + } + } + vars1 = virNWFilterCreateVarHashmap(conn, - str_macaddr); + str_macaddr, str_ipaddr); if (!vars1) { rc = 1; goto err_exit; } str_macaddr = NULL; + str_ipaddr = NULL; vars = virNWFilterCreateVarsFrom(conn, vars1, - net->filterparams); + filterparams); if (!vars) { rc = 1; goto err_exit_vars1; @@ -582,12 +758,15 @@ _virNWFilterInstantiateFilter(virConnect rc = virNWFilterInstantiate(conn, techdriver, - net->type, + nettype, filter, - net->ifname, + ifname, + linkdev, vars, useNewFilter, &foundNewFilter, - teardownOld); + teardownOld, + macaddr, + driver); virNWFilterHashTableFree(vars); @@ -595,15 +774,180 @@ err_exit_vars1: virNWFilterHashTableFree(vars1); err_exit: - virNWFilterPoolObjUnlock(obj); + VIR_FREE(str_ipaddr); VIR_FREE(str_macaddr); return rc; } +static int +_virNWFilterInstantiateFilter(virConnectPtr conn, + const virDomainNetDefPtr net, + bool teardownOld, + enum instCase useNewFilter) +{ + const char *linkdev = (net->type == VIR_DOMAIN_NET_TYPE_DIRECT) + ? net->data.direct.linkdev + : NULL; + return __virNWFilterInstantiateFilter(conn, + teardownOld, + net->ifname, + linkdev, + net->type, + net->mac, + net->filter, + net->filterparams, + useNewFilter, + conn->nwfilterPrivateData); +} + + +// FIXME: move chgIfFlags, ifUp, checkIf into common file & share w/ macvtap.c + +/* + * chgIfFlags: Change flags on an interface + * @ifname : name of the interface + * @flagclear : the flags to clear + * @flagset : the flags to set + * + * The new flags of the interface will be calculated as + * flagmask = (~0 ^ flagclear) + * newflags = (curflags & flagmask) | flagset; + * + * Returns 0 on success, errno on failure. + */ +static int chgIfFlags(const char *ifname, short flagclear, short flagset) { + struct ifreq ifr; + int rc = 0; + int flags; + short flagmask = (~0 ^ flagclear); + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + flags = (ifr.ifr_flags & flagmask) | flagset; + + if (ifr.ifr_flags != flags) { + ifr.ifr_flags = flags; + + if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) + rc = errno; + } + +err_exit: + close(fd); + return rc; +} + +/* + * ifUp + * @name: name of the interface + * @up: 1 for up, 0 for down + * + * Function to control if an interface is activated (up, 1) or not (down, 0) + * + * Returns 0 in case of success or an errno code in case of failure. + */ +static int +ifUp(const char *name, int up) +{ + return chgIfFlags(name, + (up) ? 0 : IFF_UP, + (up) ? IFF_UP : 0); +} + + +/** + * checkIf + * + * @ifname: Name of the interface + * @macaddr: expected MAC address of the interface + * + * FIXME: the interface's index is another good parameter to check + * + * Determine whether a given interface is still available. If so, + * it must have the given MAC address. + * + * Returns an error code ENODEV in case the interface does not exist + * anymore or its MAC address is different, 0 otherwise. + */ +int +checkIf(const char *ifname, const unsigned char *macaddr) +{ + struct ifreq ifr; + int fd = socket(PF_PACKET, SOCK_DGRAM, 0); + int rc = 0; + + if (fd < 0) + return errno; + + if (virStrncpy(ifr.ifr_name, + ifname, strlen(ifname), sizeof(ifr.ifr_name)) == NULL) { + rc = ENODEV; + goto err_exit; + } + + if (ioctl(fd, SIOCGIFHWADDR, &ifr) < 0) { + rc = errno; + goto err_exit; + } + + if (memcmp(&ifr.ifr_hwaddr.sa_data, macaddr, 6) != 0) + rc = ENODEV; + + err_exit: + close(fd); + return rc; +} + + +int +virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver) +{ + int rc; + rc = __virNWFilterInstantiateFilter(conn, + 1, + ifname, + linkdev, + nettype, + macaddr, + filtername, + filterparams, + INSTANTIATE_ALWAYS, + driver); + if (rc) { + //something went wrong... 'DOWN' the interface + if (ifUp(ifname ,0)) { + // assuming interface disappeared... + _virNWFilterTeardownFilter(ifname); + } + } + return rc; +} + + int virNWFilterInstantiateFilter(virConnectPtr conn, const virDomainNetDefPtr net) @@ -660,8 +1004,8 @@ virNWFilterTearOldFilter(virConnectPtr c } -int -virNWFilterTeardownFilter(const virDomainNetDefPtr net) +static int +_virNWFilterTeardownFilter(const char *ifname) { const char *drvname = EBIPTABLES_DRIVER_ID; virNWFilterTechDriverPtr techdriver; @@ -676,13 +1020,21 @@ virNWFilterTeardownFilter(const virDomai #endif return 1; } + techdriver->allTeardown(ifname); - techdriver->allTeardown(net->ifname); + virNWFilterDelIpAddrForIfname(ifname); return 0; } +int +virNWFilterTeardownFilter(const virDomainNetDefPtr net) +{ + return _virNWFilterTeardownFilter(net->ifname); +} + + void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -37,6 +37,8 @@ #include "nwfilter_gentech_driver.h" +#include "nwfilter_learnipaddr.h" + #define VIR_FROM_THIS VIR_FROM_NWFILTER #define nwfilterLog(msg...) fprintf(stderr, msg) @@ -65,9 +67,12 @@ static int nwfilterDriverStartup(int privileged) { char *base = NULL; - if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + if (virNWFilterLearnInit() < 0) return -1; + if (virNWFilterConfLayerInit(virNWFilterDomainFWUpdateCB) < 0) + goto conf_init_err; + if (VIR_ALLOC(driverState) < 0) goto alloc_err_exit; @@ -120,6 +125,9 @@ error: alloc_err_exit: virNWFilterConfLayerShutdown(); +conf_init_err: + virNWFilterLearnShutdown(); + return -1; } @@ -413,5 +421,6 @@ static virStateDriver stateDriver = { int nwfilterRegister(void) { virRegisterNWFilterDriver(&nwfilterDriver); virRegisterStateDriver(&stateDriver); + virNWFilterLearnInit(); return 0; } Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -46,13 +46,25 @@ int virNWFilterRollbackUpdateFilter(virC int virNWFilterTearOldFilter(virConnectPtr conn, const virDomainNetDefPtr net); +int virNWFilterInstantiateFilterLate(virConnectPtr conn, + const char *ifname, + const char *linkdev, + enum virDomainNetType nettype, + const unsigned char *macaddr, + const char *filtername, + virNWFilterHashTablePtr filterparams, + virNWFilterDriverStatePtr driver); + int virNWFilterTeardownFilter(const virDomainNetDefPtr net); virNWFilterHashTablePtr virNWFilterCreateVarHashmap(virConnectPtr conn, - char *macaddr); + char *macaddr, + char *ipaddr); void virNWFilterDomainFWUpdateCB(void *payload, const char *name ATTRIBUTE_UNUSED, void *data); +int checkIf(const char *ifname, const unsigned char *macaddr); + #endif Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -488,6 +488,8 @@ virNWFilterRegisterCallbackDriver; virNWFilterTestUnassignDef; virNWFilterConfLayerInit; virNWFilterConfLayerShutdown; +virNWFilterLockFilterUpdates; +virNWFilterUnlockFilterUpdates; #nwfilter_params.h @@ -503,6 +505,16 @@ virNWFilterInstantiateFilter; virNWFilterTeardownFilter; +#nwfilter_learnipaddr.h +ipAddressMap; +ipAddressMapLock; +pendingLearnReq; +pendingLearnReqLock; +virNWFilterGetIpAddrForIfname; +virNWFilterDelIpAddrForIfname; +virNWFilterLookupLearnReq; + + # pci.h pciGetDevice; pciFreeDevice; Index: libvirt-acl/src/conf/nwfilter_conf.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.c +++ libvirt-acl/src/conf/nwfilter_conf.c @@ -111,17 +111,18 @@ struct int_map { */ static virMutex updateMutex; -static void +void virNWFilterLockFilterUpdates(void) { virMutexLock(&updateMutex); } -static void +void virNWFilterUnlockFilterUpdates(void) { virMutexUnlock(&updateMutex); } + /* * attribute names for the rules XML */ @@ -2731,7 +2732,7 @@ int virNWFilterConfLayerInit(virHashIter { virNWFilterDomainFWUpdateCB = domUpdateCB; - if (virMutexInit(&updateMutex)) + if (virMutexInitRecursive(&updateMutex)) return 1; if (virNWFilterParamConfLayerInit()) Index: libvirt-acl/src/conf/nwfilter_conf.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_conf.h +++ libvirt-acl/src/conf/nwfilter_conf.h @@ -565,6 +565,9 @@ virNWFilterDefPtr virNWFilterDefParseFil void virNWFilterPoolObjLock(virNWFilterPoolObjPtr obj); void virNWFilterPoolObjUnlock(virNWFilterPoolObjPtr obj); +void virNWFilterLockFilterUpdates(void); +void virNWFilterUnlockFilterUpdates(void); + int virNWFilterConfLayerInit(virHashIterator domUpdateCB); void virNWFilterConfLayerShutdown(void); Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -2533,6 +2533,106 @@ ebiptablesInstCommand(virConnectPtr conn } +int +ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + char chain[MAX_CHAINNAME_LENGTH]; + char chainPrefix = CHAINPREFIX_HOST_IN_TEMP; + char macaddr_str[VIR_MAC_STRING_BUFLEN]; + + virFormatMacAddr(macaddr, macaddr_str); + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + ebiptablesExecCLI(conn, &buf, &cli_status); + + ebtablesCreateTmpRootChain(conn, &buf, 1, ifname, 1); + + PRINT_ROOT_CHAIN(chain, chainPrefix, ifname); + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + macaddr_str, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p IPv4 -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -p ARP -j ACCEPT") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + virBufferVSprintf(&buf, + CMD_DEF(EBTABLES_CMD + " -t %s -A %s -j DROP") CMD_SEPARATOR + CMD_EXEC + "%s", + + EBTABLES_DEFAULT_TABLE, + chain, + CMD_STOPONERR(1)); + + ebtablesLinkTmpRootChain(conn, &buf, 1, ifname, 1); + + if (ebiptablesExecCLI(conn, &buf, &cli_status) || cli_status != 0) + goto tear_down_tmpebchains; + + return 0; + +tear_down_tmpebchains: + ebtablesRemoveBasicRules(conn, ifname); + + virNWFilterReportError(conn, VIR_ERR_BUILD_FIREWALL, + "%s", + _("Some rules could not be created.")); + + return 1; +} + + +int +ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname) +{ + virBuffer buf = VIR_BUFFER_INITIALIZER; + int cli_status; + + ebtablesUnlinkTmpRootChain(conn, &buf, 1, ifname); + ebtablesUnlinkTmpRootChain(conn, &buf, 0, ifname); + ebtablesRemoveTmpSubChains(conn, &buf, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 1, ifname); + ebtablesRemoveTmpRootChain(conn, &buf, 0, ifname); + + ebiptablesExecCLI(conn, &buf, &cli_status); + return 0; +} + + static int ebiptablesRuleOrderSort(const void *a, const void *b) { Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h @@ -45,4 +45,11 @@ extern virNWFilterTechDriver ebiptables_ # define EBIPTABLES_DRIVER_ID "ebiptables" + +int ebtablesApplyBasicRules(virConnectPtr conn, + const char *ifname, + const unsigned char *macaddr); +int ebtablesRemoveBasicRules(virConnectPtr conn, + const char *ifname); + #endif Index: libvirt-acl/configure.ac =================================================================== --- libvirt-acl.orig/configure.ac +++ libvirt-acl/configure.ac @@ -41,6 +41,7 @@ XMLRPC_REQUIRED=1.14.0 HAL_REQUIRED=0.5.0 DEVMAPPER_REQUIRED=1.0.0 LIBCURL_REQUIRED="7.18.0" +LIBPCAP_REQUIRED="1.0.0" dnl Checks for C compiler. AC_PROG_CC @@ -1045,6 +1046,39 @@ AC_SUBST([NUMACTL_CFLAGS]) AC_SUBST([NUMACTL_LIBS]) +dnl pcap lib +LIBPCAP_CONFIG="pcap-config" +LIBPCAP_CFLAGS="" +LIBPCAP_LIBS="" +LIBPCAP_FOUND="no" + +AC_ARG_WITH([libpcap], AC_HELP_STRING([--with-libpcap=@<:@PFX@:>@], [libpcap location])) +if test "$with_qemu" = "yes"; then + if test "x$with_libpcap" != "xno" ; then + if test "x$with_libpcap" != "x" ; then + LIBPCAP_CONFIG=$with_libpcap/bin/$LIBPCAP_CONFIG + fi + AC_MSG_CHECKING(libpcap $LIBPCAP_CONFIG >= $LIBPCAP_REQUIRED ) + if ! $LIBPCAP_CONFIG --libs > /dev/null 2>&1 ; then + AC_MSG_RESULT(no) + else + LIBPCAP_LIBS="`$LIBPCAP_CONFIG --libs`" + LIBPCAP_CFLAGS="`$LIBPCAP_CONFIG --cflags`" + LIBPCAP_FOUND="yes" + AC_MSG_RESULT(yes) + fi + fi +fi + +if test "x$LIBPCAP_FOUND" = "xyes"; then + AC_DEFINE_UNQUOTED([HAVE_LIBPCAP], 1, [whether libpcap can be used]) +fi + +AC_SUBST([LIBPCAP_CFLAGS]) +AC_SUBST([LIBPCAP_LIBS]) + + + dnl dnl Checks for the UML driver dnl @@ -2129,6 +2163,11 @@ AC_MSG_NOTICE([ xmlrpc: $XMLRPC_CFLAGS else AC_MSG_NOTICE([ xmlrpc: no]) fi +if test "$with_qemu" = "yes" ; then +AC_MSG_NOTICE([ pcap: $LIBPCAP_CFLAGS $LIBPCAP_LIBS]) +else +AC_MSG_NOTICE([ pcap: no]) +fi AC_MSG_NOTICE([]) AC_MSG_NOTICE([Test suite]) AC_MSG_NOTICE([])

3 4

[libvirt] [RFC]: Snapshot API v3
by Chris Lalancette 31 Mar '10

31 Mar '10

Hello, After our discussions about the snapshot API last week, I went ahead and implemented quite a bit of the API. I also went back to the ESX, Virtualbox, and QEMU API's to try and make sure our API's matched up. What's below is my revised API based on that survey. Following my revised API are notes that I took regarding how the libvirt API matches up to the various API's, and some questions about semantics that I had while doing the survey. More comments and questions are welcome. /* NOTE: struct _virDomainSnapshot is a private structure, ala * struct _virDomain. */ typedef struct _virDomainSnapshot virDomainSnapshot; /* Take a snapshot of the current VM state. Throws an error if * the VM is not currently running */ virDomainSnapshotPtr virDomainSnapshotCreateXML(virDomainPtr domain, const char *xmlDesc, unsigned int flags); /* Dump the XML of a snapshot */ /* NOTE: see below for proposed XML */ char *virDomainSnapshotGetXMLDesc(virDomainSnapshotPtr snapshot, unsigned int flags); /* Return the number of snapshots for this domain */ int virDomainSnapshotNum(virDomainPtr domain, unsigned int flags); /* Get the names of all snapshots for this domain */ int virDomainListSnapshotNames(virDomainPtr domain, char **names, int nameslen, unsigned int flags); /* Get a handle to a named snapshot */ virDomainSnapshotPtr virDomainSnapshotLookupByName(virDomainPtr domain, const char *name, unsigned int flags); /* Get a handle to the current in-use snapshot for the domain */ virDomainSnapshotPtr virDomainSnapshotCurrent(virDomainPtr domain, unsigned int flags); /* Start the guest from the snapshot "snapshot" */ int virDomainCreateFromSnapshot(virDomainSnapshotPtr snapshot, unsigned int flags); /* Rename the snapshot */ /* Do we really need this? In theory we could use * virsh snapshot-edit <domain> <name> and then detect * name changes, but that will require a UUID, which may * or may not be overkill */ int virDomainSnapshotRename(virDomainSnapshotPtr snapshot, char *newname, unsigned int flags); /* Delete a snapshot - with no flags, the snapshot is not used anymore, * but also not removed. With a MERGE flag, it merges the snapshot into * the parent snapshot (or the base image, if there is no parent snapshot). * Note that if other snapshots would be discarded because of this * MERGE action, this operation will fail. If that is really what is intended, * use MERGE_FORCE. * * With a DISCARD flag, it deletes the snapshot. Note that if children snapshots * would be discarded because of this delete action, this operation will * fail. If this is really what is intended, use DISCARD_FORCE. * * MERGE, MERGE_FORCE, DISCARD, and DISCARD_FORCE are mutually-exclusive. * * Note that this operation can happen when the domain is running or shut * down, though this is hypervisor specific */ typedef enum { VIR_DOMAIN_SNAPSHOT_DELETE_MERGE, VIR_DOMAIN_SNAPSHOT_DELETE_MERGE_FORCE, VIR_DOMAIN_SNAPSHOT_DELETE_DISCARD, VIR_DOMAIN_SNAPSHOT_DELETE_DISCARD_FORCE, } virDomainSnapshotDelete; int virDomainSnapshotDelete(virDomainSnapshotPtr snapshot, unsigned int flags); int virDomainSnapshotFree(virDomainSnapshotPtr snapshot); NOTE: During snapshot creation, *none* of the fields are required. That is, you can call virDomainSnapshotCreateXML() with an XML of "<domainsnapshot/>". In this case, the individual driver will make up a <name> and <uuid> for you, the <creationdate> will be set to the current time+date, <description> will be empty, <state> will be the current state of the VM, and <parent> will be set to the current snapshot (if any). If you do want to specify some fields during virDomainSnapshotCreateXML(), note that the only ones that are settable are <name>, <uuid>, and <description>; the rest are ignored, and filled in by the driver when the snapshot is actually created. NOTE: <state> refers to the state of the VM when the snapshot was taken. <domainsnapshot> <name>XYZ</name> <creationdate>...</creationdate> <description>...</description> <state>RUNNING</state> <domain> <uuid>XXXXX-XXXX-XXXX-XXXX-XXXXXXXXX</uuid> </domain> <parent> <name>ABC</name> </parent> </domainsnapshot> The virsh commands will be: virsh snapshot-create <dom> <xmlfile> virsh snapshot-list <dom> virsh snapshot-dumpxml <dom> <name> virsh start-with-snapshot <dom> <snapshotname> virsh snapshot-delete <dom> <snapshotname> [--merge|--mergeforce|--delete|--deleteforce] virsh snapshot-delete-all <dom> Possible issues: 1) I don't see a way to support "managed" save/restore and snapshotting with this API. I think we'll have to have a separate API for managed save/restore. 2) What is the semantic for deleting snapshots from a running domain? Virtualbox seems to not allow you to manipulate snapshots while the domain is running. Qemu does allow this, but it's currently unclear what the exact semantics are. VMware seems to allow manipulation of snapshots while the domain is running. 3) Do we need a snapshot UUID? Virtualbox allows you to have multiple snapshots with the same name, differentiated by UUID. Confusingly, they also have a "FindByName" method that returns the first depth-first search snapshot that matches a given name. For qemu, if you specify the same name twice it overwrites the previous one with the new one. I don't know what ESX does here. Mapping of our interface to various hypervisors: +-------------------------------+-----------------+-------------------+------------------------------+ | Libvirt | Qemu | Virtualbox | ESX | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotCreateXML | monitor command | takeSnapshot | CreateSnapshot_task | | | "savevm"; if | Snapshots can | takes a name, description, | | | snapshot name | be taken on | memory (true/false) and | | | is already in | powered off, | quiesce (true/false). | | | use, replaces | saved, running, | What does "memory" mean? | | | the previous | or paused VMs. | Should we model "quiesce" | | | snapshot. Also | The snapshot is | Trees of snapshots are | | | qemu-img | always taken | supported. What happens | | | snapshot -c can | against the | on a duplicate name? What | | | be used to | current snapshot. | state(s) can a VM be in | | | create a | What happens on | when calling this? Does | | | disk-only | a duplicate | a VM get paused when this | | | snapshot. What | name? Trees of | is called? | | | happens if the | snapshots are | | | | VM is running | not currently | | | | when you do | supported. | | | | this? Trees of | Taking a snapshot | | | | snapshots seem | of a running VM | | | | to be supported | pauses the VM | | | | VM gets paused | before taking the | | | | while this is | snapshot. | | | | happening. What | | | | | states can the | | | | | VM be in? | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotGetXMLDesc | Libvirt qemu | GetId | VirtualMachine object-> | | | snapshot | GetDescription | snapshot-> rootSnapshotList | | | metadata | GetTimeStamp | [i].createTime | | | | GetParent | .description | | | | GetCurrentSnapshot| .name | | | | | .id | | | | | .state | | | | | .quiesced | | | | | .vm | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotNum | Libvirt qemu | GetSnapshotCount | VirtualMachine object-> | | | snapshot | | snapshot-> rootSnapshotList | | | metadata | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainListSnapshotNames | Libvirt qemu | GetSnapshotCount | VirtualMachine object-> | | | snapshot | GetChildren | snapshot-> rootSnapshotList | | | metadata, or | | | | | listvm monitor | | | | | command or | | | | | qemu-img | | | | | snapshot -l | | | | | <file>. If the | | | | | VM has multiple | | | | | disks and the | | | | | disks have | | | | | different | | | | | snapshots, what | | | | | do you do? | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotLookupByName | " | findSnapshot | VirtualMachine object-> | | | | Takes a name and | snapshot-> rootSnapshotList | | | | returns a | | | | | snapshot object. | | | | | In case of | | | | | multiple snapshots| | | | | with the same | | | | | name, it returns | | | | | the first object | | | | | from a depth | | | | | first search. | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainCreateFromSnapshot | qemu-img | restoreSnapshot | RevertToSnapshot_Task | | | snapshot -a | Takes a snapshot | Changes execution state | | | <snapname> | object, and | of VM to state of this | | | <file>. What | resets the VM's | snapshot. Takes a | | | happens if the | state to that of | snapshot object, an | | | VM has multiple | the snapshot. | optional host, and | | | files with | If this is a | suppressPowerOn, which | | | different | snapshot taken | forces the VM to the off | | | snapshots? | against a running | state regardless of the | | | | machine, then the | state when the snapshot | | | | memory is | was taken. Implies that | | | | restored as well. | without this flag, VM | | | | Does *not* start | starts in whatever | | | | the VM. The VM | <state> was when snapshot | | | | must be off for | was taken. | | | | this operation to | | | | | succeed. | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotDelete | monitor command | deleteSnapshot | RemoveSnapshot_Task | | | "delvm". What | deletes the | removes this snapshot and | | | happens if the | specified | deletes any associated | | | snapshot is in | snapshot. Takes | storage. Operates on a | | | use? What | an ID. The VM | VirtualMachineSnapshot | | | states can the | must be off. | object. What states can | | | VM be in? Also | Differences to | the VM be in? What | | | qemu-img | children | happens if this snapshot | | | snapshot -d | snapshots will be | is in-use? What happens | | | <name> <file> | merged with the | to parents and children? | | | command can be | children to keep | | | | used. What | children valid. | | | | happens if the | Parent for this | | | | disk is in-use? | snapshot will | | | | What happens to | become parent of | | | | parents and | any children | | | | children? | snapshots. | | | | How do we | | | | | handle merges? | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotCurrent | Libvirt qemu | currentSnapshot | VirtualMachine object-> | | | snapshot | | snapshot-> currentSnapshot | | | metadata | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotRename | Libvirt qemu | ISnapshot->name | RenameSnapshot | | | snapshot | | | | | metadata | | | +-------------------------------+-----------------+-------------------+------------------------------+ | virDomainSnapshotDelete with | Libvirt qemu | deleteSnapshot | RemoveAllSnapshots_Task | | DISCARD_FORCE flag against | snapshot | with manual depth | | | root snapshot | metadata | deletion of | | | | | children | | +-------------------------------+-----------------+-------------------+------------------------------+ | | | | RevertToCurrentSnapshot_Task | +-------------------------------+-----------------+-------------------+------------------------------+ Attribute mapping: +----------------+----------+-------------+----------------------------+ | Libvirt | Qemu | Virtualbox | ESX | +----------------+----------+-------------+----------------------------+ | <name> | TAG | name | name | +----------------+----------+-------------+----------------------------+ | <creationdate> | DATE | timeStamp | createTime | +----------------+----------+-------------+----------------------------+ | <description> | Libvirt | description | description | | | qemu | | | | | metadata | | | +----------------+----------+-------------+----------------------------+ | <state> | Libvirt | online | state (this is the *power* | | | qemu | | state of the VM when this | | | metadata | | snapshot was taken) | +----------------+----------+-------------+----------------------------+ | <domain><uuid> | Libvirt | machine | vm | | | qemu | | | | | metadata | | | +----------------+----------+-------------+----------------------------+ | <parent><name> | Libvirt | parent | N/A | | | qemu | | | | | metadata | | | +----------------+----------+-------------+----------------------------+ | N/A | N/A | id (uuid) | id | +----------------+----------+-------------+----------------------------+ | N/A | N/A | children | childSnapshotList | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | memory | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | quiesced | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | backupManifest | +----------------+----------+-------------+----------------------------+ | N/A | N/A | N/A | replaySupported | +----------------+----------+-------------+----------------------------+ -- Chris Lalancette

6 13

[libvirt] [RFC] Managed save APIs
by Daniel Veillard 31 Mar '10

31 Mar '10

The current API provides the following Save abd Restore functions: int virDomainSave (virDomainPtr domain, const char *to); int virDomainRestore (virConnectPtr conn, const char *from); where the user provide the path to the file used to hold the domain saved state. However it can be really useful to have a managed version where libvirt itself stores the data. It can then automatically reuse it once the domain is to be restarted. This also avoid the problem of keeping stale saved data once a domain has been restarted independantly. One of our use case was to save the running domains state on shutdown, and unfortunately virDomainSave()/virDomainRestore() can't be used for that because if one of the domain is labelled as autorestart, as soon as the daemon would restart it would recreate the guest but without knowledge of the backup state. So we propose the 3 following new APIs to deal with managed saves: int virDomainManagedSave(virDomainPtr dom, unsigned int flags); int virDomainHasManagedSaveImage(virDomainPtr dom, unsigned int flags); int virDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags); virDomainManagedSave() is to be run on a running domain. Once the call complete, as in virDomainSave() the domain is stopped upon completion, but there is no restore counterpart as any order to start the domain from the API would load the state from the managed file, similary if the domain is autostarted when libvirtd starts. Once a domain has restarted his managed save image is destroyed, basically managed save image can only exist for a stopped domain, for a running domain that would be by definition outdated data. Suggested new entry points in libvirt.c are below, thanks in advance for any feedback (and thanks to Chris Lalancette who started this work): diff --git a/src/libvirt.c b/src/libvirt.c index cc5b4c5..293ea17 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -12135,3 +12135,143 @@ error: virDispatchError(conn); return -1; } + +/** + * virDomainManagedSave: + * @dom: pointer to the domain + * @flags: optional flags currently unused + * + * This method will suspend a domain and save its memory contents to + * a file on disk. After the call, if successful, the domain is not + * listed as running anymore. + * The difference from virDomainSave() is that libvirt is keeping track of + * the saved state itself, and will reuse it once the domain is being + * restarted (automatically or via an explicit libvirt call). + * As a result any running domain is sure to not have a managed saved image. + * + * Returns 0 in case of success or -1 in case of failure + */ +int virDomainManagedSave(virDomainPtr dom, unsigned int flags) +{ + virConnectPtr conn; + + VIR_DEBUG("dom=%p, flags=%u", dom, flags); + + virResetLastError(); + + if (!VIR_IS_CONNECTED_DOMAIN(dom)) { + virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + conn = dom->conn; + if (conn->flags & VIR_CONNECT_RO) { + virLibDomainError(dom, VIR_ERR_OPERATION_DENIED, __FUNCTION__); + goto error; + } + + if (conn->driver->domainManagedSave) { + int ret; + + ret = conn->driver->domainManagedSave(dom, flags); + if (ret < 0) + goto error; + return ret; + } + + virLibConnError(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + +error: + virDispatchError(conn); + return -1; +} + +/** + * virDomainHasManagedSaveImage: + * @dom: pointer to the domain + * @flags: optional flags currently unused + * + * Check if a domain has a managed save image as created by + * virDomainManagedSave(). Note that any running domain should not have + * such an image, as it should have been removed on restart. + * + * Returns 0 if no image is present, 1 if an image is present, and + * -1 in case of error + */ +int virDomainHasManagedSaveImage(virDomainPtr dom, unsigned int flags) +{ + virConnectPtr conn; + + VIR_DEBUG("dom=%p, flags=%u", dom, flags); + + virResetLastError(); + + if (!VIR_IS_CONNECTED_DOMAIN(dom)) { + virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + conn = dom->conn; + + if (conn->driver->domainHasManagedSaveImage) { + int ret; + + ret = conn->driver->domainHasManagedSaveImage(dom, flags); + if (ret < 0) + goto error; + return ret; + } + + virLibConnError(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + +error: + virDispatchError(conn); + return -1; +} + +/** + * virDomainManagedSaveRemove: + * @dom: pointer to the domain + * @flags: optional flags currently unused + * + * Remove any managed save image as for this domain. + * + * Returns 0 in case of success, and -1 in case of error + */ +int virDomainManagedSaveRemove(virDomainPtr dom, unsigned int flags) +{ + virConnectPtr conn; + + VIR_DEBUG("dom=%p, flags=%u", dom, flags); + + virResetLastError(); + + if (!VIR_IS_CONNECTED_DOMAIN(dom)) { + virLibDomainError(NULL, VIR_ERR_INVALID_DOMAIN, __FUNCTION__); + virDispatchError(NULL); + return -1; + } + + conn = dom->conn; + if (conn->flags & VIR_CONNECT_RO) { + virLibDomainError(dom, VIR_ERR_OPERATION_DENIED, __FUNCTION__); + goto error; + } + + if (conn->driver->domainManagedSaveRemove) { + int ret; + + ret = conn->driver->domainManagedSaveRemove(dom, flags); + if (ret < 0) + goto error; + return ret; + } + + virLibConnError(conn, VIR_ERR_NO_SUPPORT, __FUNCTION__); + +error: + virDispatchError(conn); + return -1; +} Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt] [PATCH 00/10] Begin to replace scanf and atoi
by Matthias Bolte 31 Mar '10

31 Mar '10

This set of patches is a first step towards removing the scanf and atoi usage in libvirt. I began with the simple cases and post this now to get some feedback before I start to convert the more difficult ones. 01/10 Replace sscanf in legacy device address parsing 02/10 Replace sscanf in nwfilter rule parsing 03/10 Refactor major.minor.micro version parsing into a function 04/10 cgroup: Replace sscanf with virStrToLong_ll 05/10 vbox: Replace atoi with virStrToLong_i 06/10 xen: Use virParseMacAddr instead of sscanf 07/10 openvz: Use strtok_r instead of sscanf for VPS UUID parsing 08/10 xenapi: Use virStrToLong_i instead of sscanf for CPU map parsing 09/10 xen: Use virStrToLong_i instead of sscanf for XenD port parsing 10/10 Replace sscanf in PCI device address parsing src/conf/domain_conf.c | 38 +++++++++++++++++++--------- src/conf/nwfilter_conf.c | 10 +++--- src/esx/esx_driver.c | 31 ++++------------------ src/libvirt_private.syms | 1 + src/lxc/lxc_driver.c | 10 +------ src/openvz/openvz_conf.c | 27 ++++++++++++------- src/uml/uml_conf.h | 2 +- src/uml/uml_driver.c | 17 ++++++------ src/util/cgroup.c | 3 +- src/util/pci.c | 59 ++++++++++++++++++++++++++++++++++--------- src/util/util.c | 37 +++++++++++++++++++++++++++ src/util/util.h | 1 + src/vbox/vbox_tmpl.c | 18 +++++-------- src/xen/xend_internal.c | 20 ++------------ src/xen/xm_internal.c | 19 +++---------- src/xenapi/xenapi_driver.c | 21 +++++++-------- src/xenapi/xenapi_utils.c | 3 +- 17 files changed, 179 insertions(+), 138 deletions(-) Matthias

5 31

[libvirt] [PATCH] website: Add archive link for libvirt-users list
by Matthias Bolte 31 Mar '10

31 Mar '10

--- docs/contact.html.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/docs/contact.html.in b/docs/contact.html.in index 09f8e35..c9dceda 100644 --- a/docs/contact.html.in +++ b/docs/contact.html.in @@ -21,7 +21,7 @@ </ul> </dd> - <dt><a href="">libvirt-users(a)redhat.com</a></dt> + <dt><a href="https://www.redhat.com/archives/libvirt-users/">libvirt-users(a)redhat.com</a></dt> <dd>This list a place for discussions involving libvirt <strong>users</strong>. Topics for discussion include <ul> <li>Usage of libvirt / virsh</li> -- 1.6.3.3

2 2

[libvirt] [PATCH] Fix apibuild.py warning about virNWFilterLookupByUUIDString
by Matthias Bolte 31 Mar '10

31 Mar '10

The function name was written with capital I in the Filter part. --- src/libvirt.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/libvirt.c b/src/libvirt.c index 138dd31..5247fe7 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -11333,7 +11333,7 @@ error: } /** - * virNWFIlterLookupByUUIDString: + * virNWFilterLookupByUUIDString: * @conn: pointer to the hypervisor connection * @uuidstr: the string UUID for the nwfilter * -- 1.6.3.3

2 2

[libvirt] Patch for Vepa support in brctl
by Kumar L Srikanth-B22348 31 Mar '10

31 Mar '10

Hi Daniel, Can you please provide a valid patch for 'brctl' utility, to support 'vepa' mode. Regards, Srikanth.

3 2