- Devel - libvirt List Archives

[Libvir] PATCH: BZ 427107: fix crash wrt auth callback
by Daniel P. Berrange 14 Jan '08

14 Jan '08

If the application does not supply an authentication callback, and tries to connect to a server with PolicyKit auth turned on it will try to deference a NULL pointer with predictably crashtastic results: https://bugzilla.redhat.com/show_bug.cgi?id=427107 This patch has been tested by bug reporter to fix the issue Index: src/remote_internal.c =================================================================== RCS file: /data/cvs/libvirt/src/remote_internal.c,v retrieving revision 1.49 diff -u -p -r1.49 remote_internal.c --- src/remote_internal.c 17 Dec 2007 17:41:02 -0000 1.49 +++ src/remote_internal.c 31 Dec 2007 20:30:19 -0000 @@ -3347,24 +3347,26 @@ remoteAuthPolkit (virConnectPtr conn, st }; remoteDebug(priv, "Client initialize PolicyKit authentication"); - for (i = 0 ; i < auth->ncredtype ; i++) { - if (auth->credtype[i] == VIR_CRED_EXTERNAL) - allowcb = 1; - } + if (auth && auth->cb) { + /* Check if the neccessary credential type for PolicyKit is supported */ + for (i = 0 ; i < auth->ncredtype ; i++) { + if (auth->credtype[i] == VIR_CRED_EXTERNAL) + allowcb = 1; + } - /* Run the authentication callback */ - if (allowcb) { - if (auth && auth->cb && - (*(auth->cb))(&cred, 1, auth->cbdata) < 0) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, - VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, - "Failed to collect auth credentials"); - return -1; + if (allowcb) { + /* Run the authentication callback */ + if ((*(auth->cb))(&cred, 1, auth->cbdata) < 0) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "Failed to collect auth credentials"); + return -1; + } } else { - remoteDebug(priv, "No auth callback provided for PolicyKit"); + remoteDebug(priv, "Client auth callback does not support PolicyKit"); } } else { - remoteDebug(priv, "Client auth callback does not support PolicyKit"); + remoteDebug(priv, "No auth callback provided"); } memset (&ret, 0, sizeof ret); Regards, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

3 6

[Libvir] VMC - Virtual Machine Console
by Meng Kuan 14 Jan '08

14 Jan '08

Greetings, I would like to announce the availability of VMC (Virtual Machine Console). VMC is an attempt to provide an opensource, web-based VM management infrastructure. It uses libvirt as the underlying library to manage para-virtualized Xen VMs. You can find out more on our "Introduction to VMC" page: http://www.sxven.com/vmc List of current features and future plans: http://www.sxven.com/vmc/features To get started, we have made available a "VMC Install" document: http://www.sxven.com/vmc/gettingstarted We invite people to take a look at VMC and tell us what you like and what you don't like. If you have any problems, questions or suggestions please feel free to contact us at dev(a)sxven.com or post them on our forum: http://forum.sxven.com/ Best regards, Meng Kuan

1 0

Re: [Libvir] [patch 0/9] Add support for Fedora lokkit's --custom-rules option
by Mark McLoughlin 10 Jan '08

10 Jan '08

Hey, Sounds like this series is good to commit, but just to be clear: 1) Need Dan's virRun() and virReadFile() patches in first 2) Patch 5/9 wasn't ACK-ed 3) Also need ACKs for the "use virRun()" and "add --enable-iptables-lokkit=check" patches Cheers, Mark.

3 6

[Libvir] [PATCH] an irregular value is set as 'CPU Affinity' by virsh vcpupin
by Saori Fukuta 09 Jan '08

09 Jan '08

Hi, There is a difference between 'CPU Affinity' of 'virsh vcpuinfo' and 'CPU Affinity' of 'xm vcpu-list' when I set the vcpu affinity by 'virsh vcpupin'. i.e. 'xm vcpu-list' shows wrong value. But there is no difference between them when I set by 'xm vcpu-pin'. (a) set by 'virsh vcpupin' # virsh vcpupin guest_dom 0 1 # virsh vcpuinfo guest_dom VCPU: 0 CPU: 1 State: blocked CPU time: 17.1s CPU Affinity: -y------ # xm vcpu-list guest_dom Name ID VCPUs CPU State Time(s) CPU Affinity guest_dom 13 0 1 -b- 17.1 any cpu (b) set by 'xm vcpu-pin' # xm vcpu-pin guest_dom 0 0 # virsh vcpuinfo guest_dom VCPU: 0 CPU: 0 State: blocked CPU time: 17.1s CPU Affinity: y------- # xm vcpu-list guest_dom Name ID VCPUs CPU State Time(s) CPU Affinity guest_dom 13 0 0 -b- 17.1 0 I guess that the allocated memory to cpumap must be 8-byte for Xen because "xc_vcpu_setaffinity(a)libxc/xc_domain.c" is using uint64_t as cpumap. But the libvirt is allocating only maplen size for cpumap. virsh +--- cpumaplen ---+ (more than 1-byte) xen +----------------- 8-byte -----------------+ (uint64_t) Then, an irregular value is set to the buffer that is more than the number of physical CPU, because libvirt initialize maplen size only (i.e. not initialize 8-byte buffer). So, I changed the size of cpumap and the value of nr_cpus at xen_internal.c. Regards, Saori Fukuta

2 2

Re: [Libvir] [patch 6/9] Move iptablesSpawn()
by Daniel P. Berrange 09 Jan '08

09 Jan '08

On Fri, Jan 04, 2008 at 03:57:31PM +0000, Mark McLoughlin wrote: > The next patch requires iptablesSpawn() higher up in > the file. This patch just moves the code around; there > is no functional change. The util.c file has a virExec function, although its a little more cumbersome to use than iptablesSpawn. So for the storage APIs I've got a new virRun() function in util.c which is very similar to your iptablesSpawn code. How about we just make iptables use the virRun method in the attached patch ? diff -r a0ae4f87480b src/util.c --- a/src/util.c Thu Dec 06 15:35:43 2007 -0500 +++ b/src/util.c Thu Dec 06 15:39:34 2007 -0500 @@ -34,6 +34,7 @@ #include <errno.h> #include <sys/types.h> #include <sys/stat.h> +#include <sys/wait.h> #include <string.h> #include "libvirt/virterror.h" @@ -196,6 +197,43 @@ virExecNonBlock(virConnectPtr conn, int *retpid, int infd, int *outfd, int *errfd) { return(_virExec(conn, argv, retpid, infd, outfd, errfd, 1)); +} + +/** + * @conn connection to report errors against + * @argv NULL terminated argv to run + * @status optional variable to return exit status in + * + * Run a command without using the shell. + * + * If status is NULL, then return 0 if the command run and + * exited with 0 status; Otherwise return -1 + * + * If status is not-NULL, then return 0 if the command ran. + * The status variable is filled with the command exit status + * and should be checked by caller for success. Return -1 + * only if the command could not be run. + */ +int +virRun(virConnectPtr conn, + char **argv, + int *status) { + int childpid, exitstatus, ret; + + if ((ret = virExec(conn, argv, &childpid, -1, NULL, NULL)) < 0) + return ret; + + while ((ret = waitpid(childpid, &exitstatus, 0) == -1) && errno == EINTR); + if (ret == -1) + return -1; + + if (status == NULL) { + errno = EINVAL; + return (WIFEXITED(exitstatus) && WEXITSTATUS(exitstatus) == 0) ? 0 : -1; + } else { + *status = exitstatus; + return 0; + } } /* Like read(), but restarts after EINTR */ diff -r a0ae4f87480b src/util.h --- a/src/util.h Thu Dec 06 15:35:43 2007 -0500 +++ b/src/util.h Thu Dec 06 15:39:34 2007 -0500 @@ -28,6 +28,7 @@ int virExec(virConnectPtr conn, char **argv, int *retpid, int infd, int *outfd, int *errfd); int virExecNonBlock(virConnectPtr conn, char **argv, int *retpid, int infd, int *outfd, int *errfd); +int virRun(virConnectPtr conn, char **argv, int *status); int saferead(int fd, void *buf, size_t count); ssize_t safewrite(int fd, const void *buf, size_t count); Regards, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

3 3

Re: [Libvir] [patch 1/2] Do not try and delete built-in iptables chains
by Daniel P. Berrange 08 Jan '08

08 Jan '08

On Mon, Jan 07, 2008 at 06:12:37PM +0000, Mark McLoughlin wrote: > Previously, when we supported adding our rules to chains > with a custom prefix (e.g. libvirt-Fedora-POSTROUTING) > we needed to be able to handle adding and deleting these > custom chains. > > Now that we only use built-in iptables chains, we don't > need to add or delete them - in fact, deleting them is > not allowed. ACK Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 2/2] Enable stdout/stderr spew with --enable-debug
by Daniel P. Berrange 08 Jan '08

08 Jan '08

On Mon, Jan 07, 2008 at 06:12:38PM +0000, Mark McLoughlin wrote: > Change virExec() such that with --enable-debug, stdout > and stderr no longer go to /dev/null. ACK Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

[Libvir] PATCH: BZ 426425: Fix truncated reading of config files
by Daniel P. Berrange 08 Jan '08

08 Jan '08

The virConfReadFile API has a fixed 4096 byte buffer it reads the config file into, regardless of the config file size and silently drops any data exceeding this. This manifested itself in the 0.4.0 release by the fact that toggling the 'auth_unix_ro' config param from 'polkit' to 'none' had no effect at all. It turns out that with the user friendly verbose comments I added to the config file /etc/libvirt/libvirtd.cofn, the 'auth_unix_ro' param occurred beyond the 4096 byte mark in the file and was thus never read. In fixing this I decided to make virConfReadFile call to the recently added virFileReadAll() method. Except the latter takes a pre-allocated buffer as its input. So I've switched virFileReadAll() to pass in a char **, and auto-allocate the file as needed. As a sanity check there is also a 'maxlen' param to stop it reading stupidly huge files - for reading large files virFileReadll() shouldn't be used - they should be read incrementally. Finally, also added a larger test data file to trap this error case src/conf.c | 27 ++--- src/qemu_conf.c | 6 - src/util.c | 22 ++-- src/util.h | 4 tests/confdata/libvirtd.conf | 222 +++++++++++++++++++++++++++++++++++++++++++ tests/confdata/libvirtd.out | 180 ++++++++++++++++++++++++++++++++++ tests/test_conf.sh | 3 7 files changed, 441 insertions(+), 23 deletions(-) Index: src/conf.c =================================================================== RCS file: /data/cvs/libvirt/src/conf.c,v retrieving revision 1.15 diff -u -p -u -p -r1.15 conf.c --- src/conf.c 11 Dec 2007 21:57:29 -0000 1.15 +++ src/conf.c 3 Jan 2008 18:58:47 -0000 @@ -21,6 +21,7 @@ #include "internal.h" #include "buf.h" #include "conf.h" +#include "util.h" /************************************************************************ * * @@ -693,6 +694,9 @@ error: * * ************************************************************************/ +/* 10 MB limit on config file size as a sanity check */ +#define MAX_CONFIG_FILE_SIZE (1024*1024*10) + /** * __virConfReadFile: * @filename: the path to the configuration file. @@ -705,26 +709,25 @@ error: virConfPtr __virConfReadFile(const char *filename) { - char content[4096]; - int fd; + char *content; int len; + virConfPtr conf; if (filename == NULL) { virConfError(NULL, VIR_ERR_INVALID_ARG, __FUNCTION__, 0); return(NULL); } - fd = open(filename, O_RDONLY); - if (fd < 0) { + + if ((len = virFileReadAll(filename, MAX_CONFIG_FILE_SIZE, &content)) < 0) { virConfError(NULL, VIR_ERR_OPEN_FAILED, filename, 0); - return(NULL); + return NULL; } - len = read(fd, content, sizeof(content)); - close(fd); - if (len <= 0) { - virConfError(NULL, VIR_ERR_READ_FAILED, filename, 0); - return(NULL); - } - return(virConfParse(filename, content, len)); + + conf = virConfParse(filename, content, len); + + free(content); + + return conf; } /** Index: src/qemu_conf.c =================================================================== RCS file: /data/cvs/libvirt/src/qemu_conf.c,v retrieving revision 1.24 diff -u -p -u -p -r1.24 qemu_conf.c --- src/qemu_conf.c 11 Dec 2007 21:57:29 -0000 1.24 +++ src/qemu_conf.c 3 Jan 2008 18:58:48 -0000 @@ -2604,7 +2604,7 @@ int qemudScanConfigDir(struct qemud_driv } while ((entry = readdir(dir))) { - char xml[QEMUD_MAX_XML_LEN]; + char *xml; char path[PATH_MAX]; char autostartLink[PATH_MAX]; @@ -2626,13 +2626,15 @@ int qemudScanConfigDir(struct qemud_driv continue; } - if (virFileReadAll(path, xml, QEMUD_MAX_XML_LEN) < 0) + if (virFileReadAll(path, QEMUD_MAX_XML_LEN, &xml) < 0) continue; if (isGuest) qemudLoadConfig(driver, entry->d_name, path, xml, autostartLink); else qemudLoadNetworkConfig(driver, entry->d_name, path, xml, autostartLink); + + free(xml); } closedir(dir); Index: src/util.c =================================================================== RCS file: /data/cvs/libvirt/src/util.c,v retrieving revision 1.10 diff -u -p -u -p -r1.10 util.c --- src/util.c 7 Dec 2007 14:45:39 -0000 1.10 +++ src/util.c 3 Jan 2008 18:58:48 -0000 @@ -272,8 +272,8 @@ ssize_t safewrite(int fd, const void *bu int virFileReadAll(const char *path, - char *buf, - unsigned int buflen) + int maxlen, + char **buf) { FILE *fh; struct stat st; @@ -296,20 +296,28 @@ int virFileReadAll(const char *path, goto error; } - if (st.st_size >= (buflen-1)) { - virLog("File '%s' is too large", path); + if (st.st_size > maxlen) { + virLog("File '%s' is too large %d, max %d", path, st.st_size, maxlen); goto error; } - if ((ret = fread(buf, st.st_size, 1, fh)) != 1) { + *buf = malloc(st.st_size + 1); + if (*buf == NULL) { + virLog("Failed to allocate data"); + goto error; + } + + if ((ret = fread(*buf, st.st_size, 1, fh)) != 1) { + free(buf); + buf = NULL; virLog("Failed to read config file '%s': %s", path, strerror(errno)); goto error; } - buf[st.st_size] = '\0'; + (*buf)[st.st_size] = '\0'; - ret = 0; + ret = st.st_size; error: if (fh) Index: src/util.h =================================================================== RCS file: /data/cvs/libvirt/src/util.h,v retrieving revision 1.4 diff -u -p -u -p -r1.4 util.h --- src/util.h 3 Dec 2007 14:30:47 -0000 1.4 +++ src/util.h 3 Jan 2008 18:58:48 -0000 @@ -33,8 +33,8 @@ int saferead(int fd, void *buf, size_t c ssize_t safewrite(int fd, const void *buf, size_t count); int virFileReadAll(const char *path, - char *buf, - unsigned int buflen); + int maxlen, + char **buf); int virFileMatchesNameSuffix(const char *file, const char *name, Index: tests/test_conf.sh =================================================================== RCS file: /data/cvs/libvirt/tests/test_conf.sh,v retrieving revision 1.2 diff -u -p -u -p -r1.2 test_conf.sh --- tests/test_conf.sh 14 Nov 2007 10:35:59 -0000 1.2 +++ tests/test_conf.sh 3 Jan 2008 18:58:48 -0000 @@ -8,6 +8,9 @@ do diff $outfile conftest.$$ > /dev/null if [ $? != 0 ] then + if [ -n "$DEBUG_TESTS" ]; then + diff -u $outfile conftest.$$ + fi echo "$f FAILED" NOK=1 else Index: tests/confdata/libvirtd.conf =================================================================== RCS file: tests/confdata/libvirtd.conf diff -N tests/confdata/libvirtd.conf --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ tests/confdata/libvirtd.conf 3 Jan 2008 18:58:48 -0000 @@ -0,0 +1,222 @@ +# Master libvirt daemon configuration file +# +# For further information consult http://libvirt.org/format.html + + +################################################################# +# +# Network connectivitiy controls +# + +# Flag listening for secure TLS connections on the public TCP/IP port. +# NB, must pass the --listen flag to the libvirtd process for this to +# have any effect. +# +# It is neccessary to setup a CA and issue server certificates before +# using this capability. +# +# This is enabled by default, uncomment this to disable it +listen_tls = 0 + +# Listen for unencrypted TCP connections on the public TCP/IP port. +# NB, must pass the --listen flag to the libvirtd process for this to +# have any effect. +# +# Using the TCP socket requires SASL authentication by default. Only +# SASL mechanisms which support data encryption are allowed. This is +# DIGEST_MD5 and GSSAPI (Kerberos5) +# +# This is disabled by default, uncomment this to enable it. +listen_tcp = 1 + + + +# Override the port for accepting secure TLS connections +# This can be a port number, or service name +# +tls_port = "16514" + +# Override the port for accepting insecure TCP connections +# This can be a port number, or service name +# +tcp_port = "16509" + + + +# Flag toggling mDNS advertizement of the libvirt service. +# +# Alternatively can disable for all services on a host by +# stopping the Avahi daemon +# +# This is enabled by default, uncomment this to disable it +mdns_adv = 0 + +# Override the default mDNS advertizement name. This must be +# unique on the immediate broadcast network. +# +# The default is "Virtualization Host HOSTNAME", where HOSTNAME +# is subsituted for the short hostname of the machine (without domain) +# +mdns_name = "Virtualization Host Joe Demo" + + +################################################################# +# +# UNIX socket access controls +# + +# Set the UNIX domain socket group ownership. This can be used to +# allow a 'trusted' set of users access to management capabilities +# without becoming root. +# +# This is restricted to 'root' by default. +unix_sock_group = "libvirt" + +# Set the UNIX socket permissions for the R/O socket. This is used +# for monitoring VM status only +# +# Default allows any user. If setting group ownership may want to +# restrict this to: +unix_sock_ro_perms = "0777" + +# Set the UNIX socket permissions for the R/W socket. This is used +# for full management of VMs +# +# Default allows only root. If PolicyKit is enabled on the socket, +# the default will change to allow everyone (eg, 0777) +# +# If not using PolicyKit and setting group ownership for access +# control then you may want to relax this to: +unix_sock_rw_perms = "0770" + + + +################################################################# +# +# Authentication. +# +# - none: do not perform auth checks. If you can connect to the +# socket you are allowed. This is suitable if there are +# restrictions on connecting to the socket (eg, UNIX +# socket permissions), or if there is a lower layer in +# the network providing auth (eg, TLS/x509 certificates) +# +# - sasl: use SASL infrastructure. The actual auth scheme is then +# controlled from /etc/sasl2/libvirt.conf. For the TCP +# socket only GSSAPI & DIGEST-MD5 mechanisms will be used. +# For non-TCP or TLS sockets, any scheme is allowed. +# +# - polkit: use PolicyKit to authenticate. This is only suitable +# for use on the UNIX sockets. The default policy will +# require a user to supply their own password to gain +# full read/write access (aka sudo like), while anyone +# is allowed read/only access. +# +# Set an authentication scheme for UNIX read-only sockets +# By default socket permissions allow anyone to connect +# +# To restrict monitoring of domains you may wish to enable +# an authentication mechanism here +auth_unix_ro = "none" + +# Set an authentication scheme for UNIX read-write sockets +# By default socket permissions only allow root. If PolicyKit +# support was compiled into libvirt, the default will be to +# use 'polkit' auth. +# +# If the unix_sock_rw_perms are changed you may wish to enable +# an authentication mechanism here +auth_unix_rw = "none" + +# Change the authentication scheme for TCP sockets. +# +# If you don't enable SASL, then all TCP traffic is cleartext. +# Don't do this outside of a dev/test scenario. For real world +# use, always enable SASL and use the GSSAPI or DIGEST-MD5 +# mechanism in /etc/sasl2/libvirt.conf +auth_tcp = "sasl" + +# Change the authentication scheme for TLS sockets. +# +# TLS sockets already have encryption provided by the TLS +# layer, and limited authentication is done by certificates +# +# It is possible to make use of any SASL authentication +# mechanism as well, by using 'sasl' for this option +auth_tls = "none" + + + +################################################################# +# +# TLS x509 certificate configuration +# + + +# Override the default server key file path +# +key_file = "/etc/pki/libvirt/private/serverkey.pem" + +# Override the default server certificate file path +# +cert_file = "/etc/pki/libvirt/servercert.pem" + +# Override the default CA certificate path +# +ca_file = "/etc/pki/CA/cacert.pem" + +# Specify a certificate revocation list. +# +# Defaults to not using a CRL, uncomment to enable it +crl_file = "/etc/pki/CA/crl.pem" + + + +################################################################# +# +# Authorization controls +# + + +# Flag to disable verification of client certificates +# +# Client certificate verification is the primary authentication mechanism. +# Any client which does not present a certificate signed by the CA +# will be rejected. +# +# Default is to always verify. Uncommenting this will disable +# verification - make sure an IP whitelist is set +tls_no_verify_certificate = 1 + + +# A whitelist of allowed x509 Distinguished Names +# This list may contain wildcards such as +# +# "C=GB,ST=London,L=London,O=Red Hat,CN=*" +# +# See the POSIX fnmatch function for the format of the wildcards. +# +# NB If this is an empty list, no client can connect, so comment out +# entirely rather than using empty list to disable these checks +# +# By default, no DN's are checked +tls_allowed_dn_list = ["DN1", "DN2"] + + +# A whitelist of allowed SASL usernames. The format for usernames +# depends on the SASL authentication mechanism. Kerberos usernames +# look like username@REALM +# +# This list may contain wildcards such as +# +# "*(a)EXAMPLE.COM" +# +# See the POSIX fnmatch function for the format of the wildcards. +# +# NB If this is an empty list, no client can connect, so comment out +# entirely rather than using empty list to disable these checks +# +# By default, no Username's are checked +sasl_allowed_username_list = ["joe(a)EXAMPLE.COM", "fred(a)EXAMPLE.COM" ] + + Index: tests/confdata/libvirtd.out =================================================================== RCS file: tests/confdata/libvirtd.out diff -N tests/confdata/libvirtd.out --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ tests/confdata/libvirtd.out 3 Jan 2008 18:58:48 -0000 @@ -0,0 +1,180 @@ +# Master libvirt daemon configuration file +# +# For further information consult http://libvirt.org/format.html +################################################################# +# +# Network connectivitiy controls +# +# Flag listening for secure TLS connections on the public TCP/IP port. +# NB, must pass the --listen flag to the libvirtd process for this to +# have any effect. +# +# It is neccessary to setup a CA and issue server certificates before +# using this capability. +# +# This is enabled by default, uncomment this to disable it +listen_tls = 0 +# Listen for unencrypted TCP connections on the public TCP/IP port. +# NB, must pass the --listen flag to the libvirtd process for this to +# have any effect. +# +# Using the TCP socket requires SASL authentication by default. Only +# SASL mechanisms which support data encryption are allowed. This is +# DIGEST_MD5 and GSSAPI (Kerberos5) +# +# This is disabled by default, uncomment this to enable it. +listen_tcp = 1 +# Override the port for accepting secure TLS connections +# This can be a port number, or service name +# +tls_port = "16514" +# Override the port for accepting insecure TCP connections +# This can be a port number, or service name +# +tcp_port = "16509" +# Flag toggling mDNS advertizement of the libvirt service. +# +# Alternatively can disable for all services on a host by +# stopping the Avahi daemon +# +# This is enabled by default, uncomment this to disable it +mdns_adv = 0 +# Override the default mDNS advertizement name. This must be +# unique on the immediate broadcast network. +# +# The default is "Virtualization Host HOSTNAME", where HOSTNAME +# is subsituted for the short hostname of the machine (without domain) +# +mdns_name = "Virtualization Host Joe Demo" +################################################################# +# +# UNIX socket access controls +# +# Set the UNIX domain socket group ownership. This can be used to +# allow a 'trusted' set of users access to management capabilities +# without becoming root. +# +# This is restricted to 'root' by default. +unix_sock_group = "libvirt" +# Set the UNIX socket permissions for the R/O socket. This is used +# for monitoring VM status only +# +# Default allows any user. If setting group ownership may want to +# restrict this to: +unix_sock_ro_perms = "0777" +# Set the UNIX socket permissions for the R/W socket. This is used +# for full management of VMs +# +# Default allows only root. If PolicyKit is enabled on the socket, +# the default will change to allow everyone (eg, 0777) +# +# If not using PolicyKit and setting group ownership for access +# control then you may want to relax this to: +unix_sock_rw_perms = "0770" +################################################################# +# +# Authentication. +# +# - none: do not perform auth checks. If you can connect to the +# socket you are allowed. This is suitable if there are +# restrictions on connecting to the socket (eg, UNIX +# socket permissions), or if there is a lower layer in +# the network providing auth (eg, TLS/x509 certificates) +# +# - sasl: use SASL infrastructure. The actual auth scheme is then +# controlled from /etc/sasl2/libvirt.conf. For the TCP +# socket only GSSAPI & DIGEST-MD5 mechanisms will be used. +# For non-TCP or TLS sockets, any scheme is allowed. +# +# - polkit: use PolicyKit to authenticate. This is only suitable +# for use on the UNIX sockets. The default policy will +# require a user to supply their own password to gain +# full read/write access (aka sudo like), while anyone +# is allowed read/only access. +# +# Set an authentication scheme for UNIX read-only sockets +# By default socket permissions allow anyone to connect +# +# To restrict monitoring of domains you may wish to enable +# an authentication mechanism here +auth_unix_ro = "none" +# Set an authentication scheme for UNIX read-write sockets +# By default socket permissions only allow root. If PolicyKit +# support was compiled into libvirt, the default will be to +# use 'polkit' auth. +# +# If the unix_sock_rw_perms are changed you may wish to enable +# an authentication mechanism here +auth_unix_rw = "none" +# Change the authentication scheme for TCP sockets. +# +# If you don't enable SASL, then all TCP traffic is cleartext. +# Don't do this outside of a dev/test scenario. For real world +# use, always enable SASL and use the GSSAPI or DIGEST-MD5 +# mechanism in /etc/sasl2/libvirt.conf +auth_tcp = "sasl" +# Change the authentication scheme for TLS sockets. +# +# TLS sockets already have encryption provided by the TLS +# layer, and limited authentication is done by certificates +# +# It is possible to make use of any SASL authentication +# mechanism as well, by using 'sasl' for this option +auth_tls = "none" +################################################################# +# +# TLS x509 certificate configuration +# +# Override the default server key file path +# +key_file = "/etc/pki/libvirt/private/serverkey.pem" +# Override the default server certificate file path +# +cert_file = "/etc/pki/libvirt/servercert.pem" +# Override the default CA certificate path +# +ca_file = "/etc/pki/CA/cacert.pem" +# Specify a certificate revocation list. +# +# Defaults to not using a CRL, uncomment to enable it +crl_file = "/etc/pki/CA/crl.pem" +################################################################# +# +# Authorization controls +# +# Flag to disable verification of client certificates +# +# Client certificate verification is the primary authentication mechanism. +# Any client which does not present a certificate signed by the CA +# will be rejected. +# +# Default is to always verify. Uncommenting this will disable +# verification - make sure an IP whitelist is set +tls_no_verify_certificate = 1 +# A whitelist of allowed x509 Distinguished Names +# This list may contain wildcards such as +# +# "C=GB,ST=London,L=London,O=Red Hat,CN=*" +# +# See the POSIX fnmatch function for the format of the wildcards. +# +# NB If this is an empty list, no client can connect, so comment out +# entirely rather than using empty list to disable these checks +# +# By default, no DN's are checked +tls_allowed_dn_list = [ "DN1", "DN2" ] +# A whitelist of allowed SASL usernames. The format for usernames +# depends on the SASL authentication mechanism. Kerberos usernames +# look like username@REALM +# +# This list may contain wildcards such as +# +# "*(a)EXAMPLE.COM" +# +# See the POSIX fnmatch function for the format of the wildcards. +# +# NB If this is an empty list, no client can connect, so comment out +# entirely rather than using empty list to disable these checks +# +# By default, no Username's are checked +sasl_allowed_username_list = [ "joe(a)EXAMPLE.COM", "fred(a)EXAMPLE.COM" ] Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

3 5

[Libvir] [PATCH] Xen: Support cpu_weight and cpu_cap for Xen.
by Tatsuro Enokura 08 Jan '08

08 Jan '08

Hi, I set the information of cpu_weight/cpu_cap to configuration file or sxp format, and execute "virsh start". But the information of weight/cap is lost. libvirt doesn't support cpu_weight and cpu_cap for XML format. see also Bz#337591 https://bugzilla.redhat.com/show_bug.cgi?id=337591 I make a patch to add weight/cap attributes as vcpus element (eg. <vcpus weight='512' cap='280'>4</vcpus>) c.f. the thread at: https://www.redhat.com/archives/libvir-list/2007-October/msg00044.html Signed-off-by: Tatsuro Enokura <fj7716hz(a)aa.jp.fujitsu.com> Thanks, Tatsuro Enokura Index: libvirt/src/xend_internal.c =================================================================== RCS file: /data/cvs/libvirt/src/xend_internal.c,v retrieving revision 1.151 diff -u -p -r1.151 xend_internal.c --- libvirt/src/xend_internal.c 22 Oct 2007 20:28:55 -0000 1.151 +++ libvirt/src/xend_internal.c 24 Oct 2007 06:02:27 -0000 @@ -1438,8 +1438,19 @@ xend_parse_sexp_desc(virConnectPtr conn, if ((cur_mem >= MIN_XEN_GUEST_SIZE) && (cur_mem != max_mem)) virBufferVSprintf(&buf, " <currentMemory>%d</currentMemory>\n", cur_mem); - virBufferVSprintf(&buf, " <vcpu>%d</vcpu>\n", + virBufferVSprintf(&buf, " <vcpu"); + if (sexpr_node(root, "domain/cpu_weight") != NULL) { + virBufferVSprintf(&buf, " weight='%d'", + sexpr_int(root, "domain/cpu_weight")); + } + if (sexpr_node(root, "domain/cpu_cap") != NULL) { + virBufferVSprintf(&buf, " cap='%d'", + sexpr_int(root, "domain/cpu_cap")); + } + virBufferVSprintf(&buf, ">%d</vcpu>\n", sexpr_int(root, "domain/vcpus")); + + tmp = sexpr_node(root, "domain/on_poweroff"); if (tmp != NULL) virBufferVSprintf(&buf, " <on_poweroff>%s</on_poweroff>\n", tmp); Index: libvirt/src/xm_internal.c =================================================================== RCS file: /data/cvs/libvirt/src/xm_internal.c,v retrieving revision 1.41 diff -u -p -r1.41 xm_internal.c --- libvirt/src/xm_internal.c 10 Oct 2007 17:55:38 -0000 1.41 +++ libvirt/src/xm_internal.c 24 Oct 2007 06:02:28 -0000 @@ -661,9 +661,14 @@ char *xenXMDomainFormatXML(virConnectPtr virBufferVSprintf(buf, " <memory>%ld</memory>\n", val * 1024); + virBufferVSprintf(buf, " <vcpu"); + if (xenXMConfigGetInt(conf, "cpu_weight", &val) == 0) + virBufferVSprintf(buf, " weight='%ld'", val); + if (xenXMConfigGetInt(conf, "cpu_cap", &val) == 0) + virBufferVSprintf(buf, " cap='%ld'", val); if (xenXMConfigGetInt(conf, "vcpus", &val) < 0) val = 1; - virBufferVSprintf(buf, " <vcpu>%ld</vcpu>\n", val); + virBufferVSprintf(buf, ">%ld</vcpu>\n", val); if (xenXMConfigGetString(conf, "on_poweroff", &str) < 0) @@ -1820,6 +1825,12 @@ virConfPtr xenXMParseXMLToConfig(virConn if (xenXMConfigSetIntFromXPath(conn, conf, ctxt, "vcpus", "string(/domain/vcpu)", 0, 1, "cannot set vcpus config parameter") < 0) goto error; + if (xenXMConfigSetIntFromXPath(conn, conf, ctxt, "cpu_weight", "string(/domain/vcpu/@weight)", 0, 1, + "cannot set cpu_weight config paramerter") < 0) + goto error; + if (xenXMConfigSetIntFromXPath(conn, conf, ctxt, "cpu_cap", "string(/domain/vcpu/@cap)", 0, 1, + "cannot set cpu_cap config paramerter") < 0) + goto error; obj = xmlXPathEval(BAD_CAST "string(/domain/os/type)", ctxt); if ((obj != NULL) && (obj->type == XPATH_STRING) && Index: libvirt/src/xml.c =================================================================== RCS file: /data/cvs/libvirt/src/xml.c,v retrieving revision 1.94 diff -u -p -r1.94 xml.c --- libvirt/src/xml.c 23 Oct 2007 15:31:33 -0000 1.94 +++ libvirt/src/xml.c 24 Oct 2007 06:02:28 -0000 @@ -1529,6 +1529,12 @@ virDomainParseXMLDesc(virConnectPtr conn vcpus = (unsigned int) f; } virBufferVSprintf(&buf, "(vcpus %u)", vcpus); + if (virXPathNumber("number(/domain/vcpu[1]/@weight)", ctxt, &f) == 0) { + virBufferVSprintf(&buf, "(cpu_weight %ld)", (long) f); + } + if (virXPathNumber("number(/domain/vcpu[1]/@cap)", ctxt, &f) == 0) { + virBufferVSprintf(&buf, "(cpu_cap %ld)", (long) f); + } str = virXPathString("string(/domain/vcpu/@cpuset)", ctxt); if (str != NULL) {

6 11

[Libvir] OCaml bindings 0.4.0.1 released
by Richard W.M. Jones 08 Jan '08

08 Jan '08

I'm pleased to announce the latest release of the libvirt OCaml bindings and programs. http://libvirt.org/ocaml/ There's a large list of changes since the last release, so best thing is to refer to the Changelog itself: http://libvirt.org/ocaml/ChangeLog.txt Source code is available from here: http://libvirt.org/sources/ocaml/ Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

1 0

[Libvir] OCaml bindings - Windows installer
by Richard W.M. Jones 08 Jan '08

08 Jan '08

This is a Windows installer for the OCaml libvirt bindings and programs: http://libvirt.org/sources/ocaml/ocaml-libvirt-0.4.0.1.exe If someone has a 'virgin' Windows system and could test that the above installer works, particularly for Windows < Vista and for Windows which has not had any GTK/MinGW development tools installed. About 90% of the size of the installer is down to the GTK DLLs and configuration files which need to be carried along to support the GTK graphical program (Virt Control). It's possible that I haven't placed the GTK files in exactly the right place, so instead it is using my own GTK development environment. Screenshots showing the installer in action: http://annexia.org/tmp/wininstaller-1-desktop.png Desktop, nothing installed, showing the installer icon. http://annexia.org/tmp/wininstaller-2-packages.png List of required, recommended and optional subpackages. http://annexia.org/tmp/wininstaller-3-instpath.png Select the installation path. http://annexia.org/tmp/wininstaller-4-installdone.png Install complete. Notice the desktop icons, ... http://annexia.org/tmp/wininstaller-5-menu.png ... and the menu entries and uninstaller program. http://annexia.org/tmp/wininstaller-6-virtctrl.png Running Virt Control. http://annexia.org/tmp/wininstaller-7-uninstall.png After uninstall. Notice that the desktop icons have gone. The installer uses NSIS (the Nullsoft Scriptable Install System, http://nsis.sf.net/) and is reasonably well integrated into the autoconf / make build system. In particular if you are compiling under Windows and NSIS is installed, then a simple './configure --with-nsis; make wininstaller' will build a Windows installer. This is something to look at if libvirt wants/needs a Windows installer. Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

1 0

Re: [Libvir] [patch 2/2] Enable stdout/stderr spew with --enable-debug
by Daniel Veillard 08 Jan '08

08 Jan '08

On Mon, Jan 07, 2008 at 06:12:38PM +0000, Mark McLoughlin wrote: > Change virExec() such that with --enable-debug, stdout > and stderr no longer go to /dev/null. > Looks fine to me, but I didn't see [1/2] numbering problem ? I didn't see any bounced mail in the list either, Daniel -- Red Hat Virtualization group http://redhat.com/virtualization/ Daniel Veillard | virtualization library http://libvirt.org/ veillard(a)redhat.com | libxml GNOME XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/

2 1

[Libvir] [patch 2/2] Enable stdout/stderr spew with --enable-debug
by Mark McLoughlin 07 Jan '08

07 Jan '08

Change virExec() such that with --enable-debug, stdout and stderr no longer go to /dev/null. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/util.c =================================================================== --- libvirt.orig/src/util.c 2008-01-07 18:00:03.000000000 +0000 +++ libvirt.orig/src/util.c 2008-01-07 18:00:03.000000000 +0000 @@ -157,10 +157,17 @@ _virExec(virConnectPtr conn, if (dup2(infd >= 0 ? infd : null, STDIN_FILENO) < 0) _exit(1); +#ifndef ENABLE_DEBUG if (dup2(pipeout[1] > 0 ? pipeout[1] : null, STDOUT_FILENO) < 0) _exit(1); if (dup2(pipeerr[1] > 0 ? pipeerr[1] : null, STDERR_FILENO) < 0) _exit(1); +#else /* ENABLE_DEBUG */ + if (pipeout[1] > 0 && dup2(pipeout[1], STDOUT_FILENO) < 0) + _exit(1); + if (pipeerr[1] > 0 && dup2(pipeerr[1], STDERR_FILENO) < 0) + _exit(1); +#endif /* ENABLE_DEBUG */ close(null); if (pipeout[1] > 0) --

1 0

[Libvir] [patch 1/2] Do not try and delete built-in iptables chains
by Mark McLoughlin 07 Jan '08

07 Jan '08

Previously, when we supported adding our rules to chains with a custom prefix (e.g. libvirt-Fedora-POSTROUTING) we needed to be able to handle adding and deleting these custom chains. Now that we only use built-in iptables chains, we don't need to add or delete them - in fact, deleting them is not allowed. (Note: this was the only user of the iptablesSpawn(NO_ERRORS) stuff - we didn't want error spew when adding/deleting the chains failed as expected in most cases) Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-07 17:26:42.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-07 17:26:42.000000000 +0000 @@ -386,53 +386,6 @@ iptRulesNew(const char *table, return NULL; } -static int -iptablesAddRemoveChain(iptRules *rules, int action) -{ - char **argv; - int retval = ENOMEM; - int n, status; - - n = 1 + /* /sbin/iptables */ - 2 + /* --table foo */ - 2; /* --new-chain bar */ - - if (!(argv = calloc(n + 1, sizeof(*argv)))) - goto error; - - n = 0; - - if (!(argv[n++] = strdup(IPTABLES_PATH))) - goto error; - - if (!(argv[n++] = strdup("--table"))) - goto error; - - if (!(argv[n++] = strdup(rules->table))) - goto error; - - if (!(argv[n++] = strdup(action == ADD ? "--new-chain" : "--delete-chain"))) - goto error; - - if (!(argv[n++] = strdup(rules->chain))) - goto error; - - if (virRun(NULL, argv, &status) < 0) - retval = errno; - - retval = 0; - - error: - if (argv) { - n = 0; - while (argv[n]) - free(argv[n++]); - free(argv); - } - - return retval; -} - static char * argvToString(char **argv) { @@ -521,19 +474,11 @@ iptablesAddRemoveRule(iptRules *rules, i goto error; } - if (action == ADD && - (retval = iptablesAddRemoveChain(rules, action))) - goto error; - if (virRun(NULL, argv, NULL) < 0) { retval = errno; goto error; } - if (action == REMOVE && - (retval = iptablesAddRemoveChain(rules, action))) - goto error; - if (action == ADD) { retval = iptRulesAppend(rules, rule, argv, command_idx); rule = NULL; @@ -641,11 +586,6 @@ iptRulesReload(iptRules *rules) rule->argv[rule->command_idx] = orig; } - if ((retval = iptablesAddRemoveChain(rules, REMOVE)) || - (retval = iptablesAddRemoveChain(rules, ADD))) - qemudLog(QEMUD_WARN, "Failed to re-create chain '%s' in table '%s': %s", - rules->chain, rules->table, strerror(retval)); - for (i = 0; i < rules->nrules; i++) if (virRun(NULL, rules->rules[i].argv, NULL) < 0) qemudLog(QEMUD_WARN, "Failed to add iptables rule '%s' to chain '%s' in table '%s': %s", --

1 0

[Libvir] [patch 0/2] Couple more misc iptables related patches
by Mark McLoughlin 07 Jan '08

07 Jan '08

Hey, Dan's suggestion to enable debug spew from spawned processes with --enable-debug reminded me that the only reason I wanted the NO_ERRORS stuff in the iptables code was to avoid spewage when trying to add/delete builtin iptables chains. Cheers, Mark. --

1 0

Re: [Libvir] [patch 7/9] Add support for lokkit
by Daniel P. Berrange 07 Jan '08

07 Jan '08

On Fri, Jan 04, 2008 at 03:57:32PM +0000, Mark McLoughlin wrote: > Add support for integrating our iptables support with Fedora's > iptables configuration using the lokkit --custom-rules command. > > Basically, we write out our rules to /var/lib/libvirt/iptables > and run lokkit --custom-rules so that if e.g. iptables is > restarted or the user edits their firewall configuration, then > libvirt's rules get reloaded. Ahh, that's very nice to have. > +dnl > +dnl ensure that Fedora's system-config-firewall knows > +dnl about libvirt's iptables rules > +dnl > +AC_ARG_ENABLE(iptables-lokkit, > + AC_HELP_STRING([--enable-iptables-lokkit=no/yes], > + [enable registering libvirt's iptables rules with Fedora's lokkit]), > + [],[enable_iptables_lokkit=no]) > +if test x"$enable_iptables_lokkit" = x"yes"; then > + AC_DEFINE(ENABLE_IPTABLES_LOKKIT, [], [whether support for Fedora's lokkit is enabled]) > + AC_PATH_PROG(LOKKIT_PATH, lokkit, /usr/sbin/lokkit) > + AC_DEFINE_UNQUOTED(LOKKIT_PATH, "$LOKKIT_PATH", [path to lokkit binary]) > +fi > + Could we make the configure script a little more clever so that it is a tri-state and can auto-detect whether lokkit is available. - enable_iptables_lokkit=no - force disable - enable_iptables_lokkit=yes - check if it is supported, and error if not - enable_iptables_lokkit=check - check if it is supported and enable or disable as needed With 'check' being the default. This makes it 'do the right' thing by default, and lets the user have a strict override if neccessary. ACK to the rest of the patch Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

2 2

Re: [Libvir] [patch 5/9] Include the iptables command and chain name in the saved rules file
by Daniel P. Berrange 07 Jan '08

07 Jan '08

On Fri, Jan 04, 2008 at 03:57:30PM +0000, Mark McLoughlin wrote: > lokkit --custom-rules expects the passed file to include the > iptables command and chain name (e.g. "--inset INPUT") rather > than just the rest of the arguments. > > Add both of those to what will be saved to the rules file > and simplify the resulting code by splitting out a > argvToString() helper function. > > The one complication is that when we're removing a rule > we need to make sure we don't search for it using > "--delete" rather than "--insert". For that reason, > only change the argument to "--delete" once we've > constructed the string we use to search through the > existing rules. ACK. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

[Libvir] OCaml mlvirtmanager ported to Windows
by Richard W.M. Jones 05 Jan '08

05 Jan '08

(NB. This is _not_ the real virt-manager). Screenshots: http://www.annexia.org/tmp/mlvirtmanager-win-1.png http://www.annexia.org/tmp/mlvirtmanager-win-2.png http://www.annexia.org/tmp/mlvirtmanager-win-3.png The code is in the Mercurial repository, http://hg.et.redhat.com/virt/applications/virt-top--devel . You will need to install lablgtk2 binary from: http://wwwfun.kurims.kyoto-u.ac.jp/soft/olabl/lablgtk.html and Windows Gtk development binary from: http://gladewin32.sourceforge.net/ and then follow the installation instructions for lablgtk2 given here: http://wwwfun.kurims.kyoto-u.ac.jp/soft/olabl/install-win32.txt After that, ocaml-libvirt should automatically detect that you've got Gtk / lablgtk2 installed (you might need to restart the MSys shell so it gets the new $PATH), and will offer to compile mlvirtmanager. Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

1 0

[Libvir] [PATCH] A few more Windows / MinGW fixups
by Richard W.M. Jones 05 Jan '08

05 Jan '08

A few fairly miscellaneous fixups for Windows (MinGW) which fix shared library builds and fix error handling for sockets. (1) XDR functions on MinGW come from a library called 'libxdr', not 'librpc'. (2) To build a DLL under MinGW we need to pass the -no-undefined flag to the linker. (3) Socket compatibility header file replaces <winsock2.h> inclusion. This just defines a portable 'socket_errno()' function which returns errno in the normal case, or WSAGetLastError() in the Windows case. (4) Use socket_errno() instead of errno in a few cases (but only when the code can be compiled under Windows, ie. only in the remote client case). Example -- a dynamically linked virsh.exe (linked to libvirt-0.dll) accessing a remote libvirtd: $ src/.libs/virsh.exe -c test+tcp://192.168.2.128/default list Id Name State ---------------------------------- 1 test running If you want to compile this under Windows, you will need: (a) MinGW & MSYS (select the "candidate" versions of MinGW tools if you are using Vista or W2K8, since otherwise nothing works because of a known bug). (b) Install gcc 4 experimental package from MinGW site. It's called gcc-sjlj for reasons which escape me. (c) Install GnuTLS binary from http://www.gnu.org/software/gnutls/download.html. I'm using GnuTLS Windows binary 1.6.3 and I had to hand-hack the *.la files in that distribution because they contain incorrect paths. (d) Compile and install latest libxml2 from http://xmlsoft.org/. I'm using 2.6.30. (e) Compile and install my XDR package for Windows (http://www.annexia.org/tmp/xdr-4.0-mingw5.tar.gz) (f) ./configure --without-xen --without-qemu --without-sasl --without-libvirtd (g) make Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

3 4

[Libvir] OCaml bindings now build and run under Windows (MinGW)
by Richard W.M. Jones 05 Jan '08

05 Jan '08

The OCaml bindings, examples, and mlvirsh tool, now build and run under Windows (MinGW), both for bytecode and native code. You'll need the libvirt patches for MinGW as in my previous email. OCaml bindings: http://hg.et.redhat.com/virt/applications/virt-top--devel Example of using mlvirsh (native code version) to access a remote libvirtd: rjones@WIN-MJ27YD6XBZI /c/d/virt-top--devel $ ./mlvirsh/mlvirsh.opt -c test+tcp://192.168.2.128/default list 1 test running rjones@WIN-MJ27YD6XBZI /c/d/virt-top--devel $ ./mlvirsh/mlvirsh.opt -c test+tcp://192.168.2.128/default nodeinfo model: i686 memory: 3145728 K cpus: 16 mhz: 1400 nodes: 2 sockets: 2 cores: 2 threads: 2 [Screenshot: http://www.annexia.org/tmp/Screenshot-VNC_win-mj27yd6xbzi.png ] Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

1 0

Re: [Libvir] [patch 9/9] Remove --with-iptables-dir
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:34PM +0000, Mark McLoughlin wrote: > --with-iptables-dir was added to integrate with > a proposed system for letting iptables know how to > reload our rules. > > The idea was that we'd save our rules to a file > under /etc/sysconfig/iptable.d and the iptables > init script would load the rules from there when > it was reloading. > > The proposed system wasn't accepted so, although > there might be some theoretical use for this other > than the lokkit support, let's just remove it > for now. ACK Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 8/9] Remove --with-iptables-prefix
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:33PM +0000, Mark McLoughlin wrote: > --with-iptables-prefix was added to integrate with > a proposed system for letting iptables know how to > reload our rules. > > The idea was that we'd add our rules to a chain > like libvirt-INPUT rather than INPUT, and there'd > be a configuration file which would specify whether > INPUT should include libvirt-INPUT. > > The proposed system wasn't accepted so, although > there might be some other theoretical use for this, > let's just remove it. I rather doubt anyone's using it, so ACK to killing it off. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 4/9] Re-name the "flipflop" variable to "command_idx"
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:29PM +0000, Mark McLoughlin wrote: > The "flipflop" variable marks the index into argv where > the "--insert" is at, so that when we're reloading the > rules we can easily change it to "--delete" and back > again. > > It's a rather silly name, and the next patch is going > to make more use out of it, so let's use the more sane > "command_idx" name. Fair, enough. ACK. Dan -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 3/9] Make iptables code use common utils
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:28PM +0000, Mark McLoughlin wrote: > utils.c has grown some functions since the iptables code > was written - make use of virFileMakePath() and virFileBuildPath(). ACK. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 2/9] Fix minor iptables error logging issue
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:27PM +0000, Mark McLoughlin wrote: > Fix a minor issue with some error reporting in the iptables > code - namely that we use errno after it may have been set > to something other than the error reported. ACK Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

Re: [Libvir] [patch 1/9] Fix compile error in --with-iptables-dir code
by Daniel P. Berrange 05 Jan '08

05 Jan '08

On Fri, Jan 04, 2008 at 03:57:26PM +0000, Mark McLoughlin wrote: > It seems no-one ever used --with-iptables-dir, since it > doesn't compile :-) ACK. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

1 0

[Libvir] [patch 9/9] Remove --with-iptables-dir
by Mark McLoughlin 04 Jan '08

04 Jan '08

--with-iptables-dir was added to integrate with a proposed system for letting iptables know how to reload our rules. The idea was that we'd save our rules to a file under /etc/sysconfig/iptable.d and the iptables init script would load the rules from there when it was reloading. The proposed system wasn't accepted so, although there might be some theoretical use for this other than the lokkit support, let's just remove it for now. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/configure.in =================================================================== --- libvirt.orig/configure.in 2008-01-04 15:24:39.000000000 +0000 +++ libvirt.orig/configure.in 2008-01-04 15:24:39.000000000 +0000 @@ -183,18 +183,6 @@ AM_CONDITIONAL(LIBVIRT_INIT_SCRIPTS_RED_ AC_MSG_RESULT($with_init_scripts) dnl -dnl also support saving the various chains to files -dnl in e.g. /etc/sysconfig/iptables.d -dnl -AC_ARG_WITH(iptables-dir, - AC_HELP_STRING([--with-iptables-dir=path], - [directory used to save iptables chains, defaults to not saving]), - [IPTABLES_DIR=$withval]) -if test x"$IPTABLES_DIR" != "x"; then - AC_DEFINE_UNQUOTED(IPTABLES_DIR, "$IPTABLES_DIR", [directory used for saving iptables chains]) -fi - -dnl dnl ensure that Fedora's system-config-firewall knows dnl about libvirt's iptables rules dnl Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 15:25:07.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 15:25:07.000000000 +0000 @@ -48,11 +48,6 @@ #define qemudLog(level, msg...) fprintf(stderr, msg) -#ifdef ENABLE_IPTABLES_LOKKIT -#undef IPTABLES_DIR -#define IPTABLES_DIR LOCAL_STATE_DIR "/lib/libvirt/iptables" -#endif - enum { ADD = 0, REMOVE @@ -78,12 +73,12 @@ typedef struct int nrules; iptRule *rules; -#ifdef IPTABLES_DIR +#ifdef ENABLE_IPTABLES_LOKKIT char dir[PATH_MAX]; char path[PATH_MAX]; -#endif /* IPTABLES_DIR */ +#endif /* ENABLE_IPTABLES_LOKKIT */ } iptRules; @@ -137,7 +132,6 @@ iptablesSpawn(int errors, char * const * return (WIFEXITED(status) && WEXITSTATUS(status) == 0) ? 0 : EINVAL; } -#ifdef IPTABLES_DIR #ifdef ENABLE_IPTABLES_LOKKIT static void notifyRulesUpdated(const char *table, @@ -238,7 +232,6 @@ notifyRulesRemoved(const char *table, #undef MAX_FILE_LEN } -#endif /* ENABLE_IPTABLES_LOKKIT */ static int writeRules(const char *path, @@ -286,7 +279,7 @@ writeRules(const char *path, return 0; } -#endif /* IPTABLES_DIR */ +#endif /* ENABLE_IPTABLES_LOKKIT */ static void iptRuleFree(iptRule *rule) @@ -328,7 +321,7 @@ iptRulesAppend(iptRules *rules, rules->nrules++; -#ifdef IPTABLES_DIR +#ifdef ENABLE_IPTABLES_LOKKIT { int err; @@ -339,12 +332,9 @@ iptRulesAppend(iptRules *rules, return err; } -#ifdef ENABLE_IPTABLES_LOKKIT notifyRulesUpdated(rules->table, rules->path); #endif /* ENABLE_IPTABLES_LOKKIT */ -#endif /* IPTABLES_DIR */ - return 0; } @@ -369,7 +359,7 @@ iptRulesRemove(iptRules *rules, rules->nrules--; -#ifdef IPTABLES_DIR +#ifdef ENABLE_IPTABLES_LOKKIT { int err; @@ -377,15 +367,12 @@ iptRulesRemove(iptRules *rules, return err; } -#ifdef ENABLE_IPTABLES_LOKKIT if (rules->nrules > 0) notifyRulesUpdated(rules->table, rules->path); else notifyRulesRemoved(rules->table, rules->path); #endif /* ENABLE_IPTABLES_LOKKIT */ -#endif /* IPTABLES_DIR */ - return 0; } @@ -415,10 +402,10 @@ iptRulesFree(iptRules *rules) rules->nrules = 0; } -#ifdef IPTABLES_DIR +#ifdef ENABLE_IPTABLES_LOKKIT rules->dir[0] = '\0'; rules->path[0] = '\0'; -#endif /* IPTABLES_DIR */ +#endif /* ENABLE_IPTABLES_LOKKIT */ free(rules); } @@ -441,13 +428,14 @@ iptRulesNew(const char *table, rules->rules = NULL; rules->nrules = 0; -#ifdef IPTABLES_DIR - if (virFileBuildPath(IPTABLES_DIR, table, NULL, rules->dir, sizeof(rules->dir)) < 0) +#ifdef ENABLE_IPTABLES_LOKKIT + if (virFileBuildPath(LOCAL_STATE_DIR "/lib/libvirt/iptables", table, NULL, + rules->dir, sizeof(rules->dir)) < 0) goto error; if (virFileBuildPath(rules->dir, chain, ".chain", rules->path, sizeof(rules->path)) < 0) goto error; -#endif /* IPTABLES_DIR */ +#endif /* ENABLE_IPTABLES_LOKKIT */ return rules; --

1 0

[Libvir] [patch 8/9] Remove --with-iptables-prefix
by Mark McLoughlin 04 Jan '08

04 Jan '08

--with-iptables-prefix was added to integrate with a proposed system for letting iptables know how to reload our rules. The idea was that we'd add our rules to a chain like libvirt-INPUT rather than INPUT, and there'd be a configuration file which would specify whether INPUT should include libvirt-INPUT. The proposed system wasn't accepted so, although there might be some other theoretical use for this, let's just remove it. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/configure.in =================================================================== --- libvirt.orig/configure.in 2008-01-04 14:51:29.000000000 +0000 +++ libvirt.orig/configure.in 2008-01-04 14:51:29.000000000 +0000 @@ -183,16 +183,6 @@ AM_CONDITIONAL(LIBVIRT_INIT_SCRIPTS_RED_ AC_MSG_RESULT($with_init_scripts) dnl -dnl allow the creation of iptables rules in chains with a -dnl specific prefix rather than in the standard toplevel chains -dnl -AC_ARG_WITH(iptables-prefix, - AC_HELP_STRING([--with-iptables-prefix=prefix], - [prefix used for iptables chains, default is to use standard toplevel chains]), - [IPTABLES_PREFIX=$withval]) -AC_DEFINE_UNQUOTED(IPTABLES_PREFIX, "$IPTABLES_PREFIX", [prefix used for iptables chains]) - -dnl dnl also support saving the various chains to files dnl in e.g. /etc/sysconfig/iptables.d dnl Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 15:17:18.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 15:17:18.000000000 +0000 @@ -636,13 +636,13 @@ iptablesContextNew(void) if (!(ctx = calloc(1, sizeof (*ctx)))) return NULL; - if (!(ctx->input_filter = iptRulesNew("filter", IPTABLES_PREFIX "INPUT"))) + if (!(ctx->input_filter = iptRulesNew("filter", "INPUT"))) goto error; - if (!(ctx->forward_filter = iptRulesNew("filter", IPTABLES_PREFIX "FORWARD"))) + if (!(ctx->forward_filter = iptRulesNew("filter", "FORWARD"))) goto error; - if (!(ctx->nat_postrouting = iptRulesNew("nat", IPTABLES_PREFIX "POSTROUTING"))) + if (!(ctx->nat_postrouting = iptRulesNew("nat", "POSTROUTING"))) goto error; return ctx; --

1 0

[Libvir] [patch 7/9] Add support for lokkit
by Mark McLoughlin 04 Jan '08

04 Jan '08

Add support for integrating our iptables support with Fedora's iptables configuration using the lokkit --custom-rules command. Basically, we write out our rules to /var/lib/libvirt/iptables and run lokkit --custom-rules so that if e.g. iptables is restarted or the user edits their firewall configuration, then libvirt's rules get reloaded. The slightly nasty bit is that rather than running something like lokkit --remove-custom-rules, we have to grub around in /etc/sysconfig/system-config-firewall to remove our rules files. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/configure.in =================================================================== --- libvirt.orig/configure.in 2008-01-04 14:48:49.000000000 +0000 +++ libvirt.orig/configure.in 2008-01-04 14:48:49.000000000 +0000 @@ -204,6 +204,20 @@ if test x"$IPTABLES_DIR" != "x"; then AC_DEFINE_UNQUOTED(IPTABLES_DIR, "$IPTABLES_DIR", [directory used for saving iptables chains]) fi +dnl +dnl ensure that Fedora's system-config-firewall knows +dnl about libvirt's iptables rules +dnl +AC_ARG_ENABLE(iptables-lokkit, + AC_HELP_STRING([--enable-iptables-lokkit=no/yes], + [enable registering libvirt's iptables rules with Fedora's lokkit]), + [],[enable_iptables_lokkit=no]) +if test x"$enable_iptables_lokkit" = x"yes"; then + AC_DEFINE(ENABLE_IPTABLES_LOKKIT, [], [whether support for Fedora's lokkit is enabled]) + AC_PATH_PROG(LOKKIT_PATH, lokkit, /usr/sbin/lokkit) + AC_DEFINE_UNQUOTED(LOKKIT_PATH, "$LOKKIT_PATH", [path to lokkit binary]) +fi + AC_PATH_PROG(IPTABLES_PATH, iptables, /sbin/iptables) AC_DEFINE_UNQUOTED(IPTABLES_PATH, "$IPTABLES_PATH", [path to iptables binary]) Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 14:51:29.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 14:51:29.000000000 +0000 @@ -48,6 +48,11 @@ #define qemudLog(level, msg...) fprintf(stderr, msg) +#ifdef ENABLE_IPTABLES_LOKKIT +#undef IPTABLES_DIR +#define IPTABLES_DIR LOCAL_STATE_DIR "/lib/libvirt/iptables" +#endif + enum { ADD = 0, REMOVE @@ -133,6 +138,108 @@ iptablesSpawn(int errors, char * const * } #ifdef IPTABLES_DIR +#ifdef ENABLE_IPTABLES_LOKKIT +static void +notifyRulesUpdated(const char *table, + const char *path) +{ + char arg[PATH_MAX]; + char *argv[4]; + int retval; + + snprintf(arg, sizeof(arg), "--custom-rules=ipv4:%s:%s", table, path); + + argv[0] = (char *) LOKKIT_PATH; + argv[1] = (char *) "--nostart"; + argv[2] = arg; + argv[3] = NULL; + + if ((retval = iptablesSpawn(WITH_ERRORS, argv))) + qemudLog(QEMUD_WARN, "Failed to run '" LOKKIT_PATH " %s' : %s", + arg, strerror(retval)); +} + +static int +stripLine(char *str, int len, const char *line) +{ + char *s, *p; + int changed; + + changed = 0; + s = str; + + while ((p = strchr(s, '\n'))) { + if (p == s || strncmp(s, line, p - s) != 0) { + s = ++p; + continue; + } + + ++p; + memmove(s, p, len - (p - str) + 1); + len -= p - s; + changed = 1; + } + + if (strcmp(s, line) == 0) { + *s = '\0'; + changed = 1; + } + + return changed; +} + +static void +notifyRulesRemoved(const char *table, + const char *path) +{ +/* 10 MB limit on config file size as a sanity check */ +#define MAX_FILE_LEN (1024*1024*10) + + char arg[PATH_MAX]; + char *content; + int len; + FILE *f = NULL; + + len = virFileReadAll(SYSCONF_DIR "/sysconfig/system-config-firewall", + MAX_FILE_LEN, &content); + if (len < 0) { + qemudLog(QEMUD_WARN, "Failed to read " SYSCONF_DIR "/sysconfig/system-config-firewall"); + return; + } + + snprintf(arg, sizeof(arg), "--custom-rules=ipv4:%s:%s", table, path); + + if (!stripLine(content, len, arg)) { + free(content); + return; + } + + if (!(f = fopen(SYSCONF_DIR "/sysconfig/system-config-firewall", "w"))) + goto write_error; + + if (fputs(content, f) == EOF) + goto write_error; + + if (fclose(f) == EOF) { + f = NULL; + goto write_error; + } + + free(content); + + return; + + write_error: + qemudLog(QEMUD_WARN, "Failed to write to " SYSCONF_DIR "/sysconfig/system-config-firewall : %s", + strerror(errno)); + if (f) + fclose(f); + free(content); + +#undef MAX_FILE_LEN +} +#endif /* ENABLE_IPTABLES_LOKKIT */ + static int writeRules(const char *path, const iptRule *rules, @@ -231,6 +338,11 @@ iptRulesAppend(iptRules *rules, if ((err = writeRules(rules->path, rules->rules, rules->nrules))) return err; } + +#ifdef ENABLE_IPTABLES_LOKKIT + notifyRulesUpdated(rules->table, rules->path); +#endif /* ENABLE_IPTABLES_LOKKIT */ + #endif /* IPTABLES_DIR */ return 0; @@ -264,6 +376,14 @@ iptRulesRemove(iptRules *rules, if ((err = writeRules(rules->path, rules->rules, rules->nrules))) return err; } + +#ifdef ENABLE_IPTABLES_LOKKIT + if (rules->nrules > 0) + notifyRulesUpdated(rules->table, rules->path); + else + notifyRulesRemoved(rules->table, rules->path); +#endif /* ENABLE_IPTABLES_LOKKIT */ + #endif /* IPTABLES_DIR */ return 0; --

1 0

[Libvir] [patch 6/9] Move iptablesSpawn()
by Mark McLoughlin 04 Jan '08

04 Jan '08

The next patch requires iptablesSpawn() higher up in the file. This patch just moves the code around; there is no functional change. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 11:55:21.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 11:55:21.000000000 +0000 @@ -89,6 +89,49 @@ struct _iptablesContext iptRules *nat_postrouting; }; +static int +iptablesSpawn(int errors, char * const *argv) +{ + pid_t pid, ret; + int status; + int null = -1; + + if (errors == NO_ERRORS && (null = open(_PATH_DEVNULL, O_RDONLY)) < 0) + return errno; + + pid = fork(); + if (pid == -1) { + if (errors == NO_ERRORS) + close(null); + return errno; + } + + if (pid == 0) { /* child */ + if (errors == NO_ERRORS) { + dup2(null, STDIN_FILENO); + dup2(null, STDOUT_FILENO); + dup2(null, STDERR_FILENO); + close(null); + } + + execvp(argv[0], argv); + + _exit (1); + } + + if (errors == NO_ERRORS) + close(null); + + while ((ret = waitpid(pid, &status, 0) == -1) && errno == EINTR); + if (ret == -1) + return errno; + + if (errors == NO_ERRORS) + return 0; + else + return (WIFEXITED(status) && WEXITSTATUS(status) == 0) ? 0 : EINVAL; +} + #ifdef IPTABLES_DIR static int writeRules(const char *path, @@ -294,49 +337,6 @@ iptRulesNew(const char *table, } static int -iptablesSpawn(int errors, char * const *argv) -{ - pid_t pid, ret; - int status; - int null = -1; - - if (errors == NO_ERRORS && (null = open(_PATH_DEVNULL, O_RDONLY)) < 0) - return errno; - - pid = fork(); - if (pid == -1) { - if (errors == NO_ERRORS) - close(null); - return errno; - } - - if (pid == 0) { /* child */ - if (errors == NO_ERRORS) { - dup2(null, STDIN_FILENO); - dup2(null, STDOUT_FILENO); - dup2(null, STDERR_FILENO); - close(null); - } - - execvp(argv[0], argv); - - _exit (1); - } - - if (errors == NO_ERRORS) - close(null); - - while ((ret = waitpid(pid, &status, 0) == -1) && errno == EINTR); - if (ret == -1) - return errno; - - if (errors == NO_ERRORS) - return 0; - else - return (WIFEXITED(status) && WEXITSTATUS(status) == 0) ? 0 : EINVAL; -} - -static int iptablesAddRemoveChain(iptRules *rules, int action) { char **argv; --

1 0

[Libvir] [patch 5/9] Include the iptables command and chain name in the saved rules file
by Mark McLoughlin 04 Jan '08

04 Jan '08

lokkit --custom-rules expects the passed file to include the iptables command and chain name (e.g. "--inset INPUT") rather than just the rest of the arguments. Add both of those to what will be saved to the rules file and simplify the resulting code by splitting out a argvToString() helper function. The one complication is that when we're removing a rule we need to make sure we don't search for it using "--delete" rather than "--insert". For that reason, only change the argument to "--delete" once we've constructed the string we use to search through the existing rules. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 12:09:05.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 12:09:05.000000000 +0000 @@ -380,37 +380,55 @@ iptablesAddRemoveChain(iptRules *rules, return retval; } +static char * +argvToString(char **argv) +{ + int len, i; + char *ret, *p; + + for (len = 1, i = 0; argv[i]; i++) + len += strlen(argv[i]) + 1; + + if (!(p = ret = (char *)malloc(len))) + return NULL; + + for (i = 0; argv[i]; i++) { + if (i != 0) + *(p++) = ' '; + + strcpy(p, argv[i]); + p += strlen(argv[i]); + } + + *p = '\0'; + + return ret; +} + static int iptablesAddRemoveRule(iptRules *rules, int action, const char *arg, ...) { va_list args; int retval = ENOMEM; char **argv; - char *rule = NULL, *p; + char *rule = NULL; const char *s; - int n, rulelen, command_idx; + int n, command_idx; n = 1 + /* /sbin/iptables */ 2 + /* --table foo */ 2 + /* --insert bar */ 1; /* arg */ - rulelen = strlen(arg) + 1; - va_start(args, arg); - while ((s = va_arg(args, const char *))) { + while ((s = va_arg(args, const char *))) n++; - rulelen += strlen(s) + 1; - } va_end(args); if (!(argv = calloc(n + 1, sizeof(*argv)))) goto error; - if (!(rule = (char *)malloc(rulelen))) - goto error; - n = 0; if (!(argv[n++] = strdup(IPTABLES_PATH))) @@ -424,7 +442,7 @@ iptablesAddRemoveRule(iptRules *rules, i command_idx = n; - if (!(argv[n++] = strdup(action == ADD ? "--insert" : "--delete"))) + if (!(argv[n++] = strdup("--insert"))) goto error; if (!(argv[n++] = strdup(rules->chain))) @@ -433,23 +451,22 @@ iptablesAddRemoveRule(iptRules *rules, i if (!(argv[n++] = strdup(arg))) goto error; - p = strcpy(rule, arg); - p += strlen(arg); - va_start(args, arg); - while ((s = va_arg(args, const char *))) { + while ((s = va_arg(args, const char *))) if (!(argv[n++] = strdup(s))) goto error; - *(p++) = ' '; - strcpy(p, s); - p += strlen(s); - } - va_end(args); - *p = '\0'; + if (!(rule = argvToString(&argv[command_idx]))) + goto error; + + if (action == REMOVE) { + free(argv[command_idx]); + if (!(argv[command_idx] = strdup("--delete"))) + goto error; + } if (action == ADD && (retval = iptablesAddRemoveChain(rules, action))) --

1 0

[Libvir] [patch 4/9] Re-name the "flipflop" variable to "command_idx"
by Mark McLoughlin 04 Jan '08

04 Jan '08

The "flipflop" variable marks the index into argv where the "--insert" is at, so that when we're reloading the rules we can easily change it to "--delete" and back again. It's a rather silly name, and the next patch is going to make more use out of it, so let's use the more sane "command_idx" name. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 10:00:03.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 10:00:03.000000000 +0000 @@ -62,7 +62,7 @@ typedef struct { char *rule; char **argv; - int flipflop; + int command_idx; } iptRule; typedef struct @@ -158,7 +158,7 @@ static int iptRulesAppend(iptRules *rules, char *rule, char **argv, - int flipflop) + int command_idx) { iptRule *r; @@ -172,9 +172,9 @@ iptRulesAppend(iptRules *rules, rules->rules = r; - rules->rules[rules->nrules].rule = rule; - rules->rules[rules->nrules].argv = argv; - rules->rules[rules->nrules].flipflop = flipflop; + rules->rules[rules->nrules].rule = rule; + rules->rules[rules->nrules].argv = argv; + rules->rules[rules->nrules].command_idx = command_idx; rules->nrules++; @@ -388,7 +388,7 @@ iptablesAddRemoveRule(iptRules *rules, i char **argv; char *rule = NULL, *p; const char *s; - int n, rulelen, flipflop; + int n, rulelen, command_idx; n = 1 + /* /sbin/iptables */ 2 + /* --table foo */ @@ -422,7 +422,7 @@ iptablesAddRemoveRule(iptRules *rules, i if (!(argv[n++] = strdup(rules->table))) goto error; - flipflop = n; + command_idx = n; if (!(argv[n++] = strdup(action == ADD ? "--insert" : "--delete"))) goto error; @@ -463,7 +463,7 @@ iptablesAddRemoveRule(iptRules *rules, i goto error; if (action == ADD) { - retval = iptRulesAppend(rules, rule, argv, flipflop); + retval = iptRulesAppend(rules, rule, argv, command_idx); rule = NULL; argv = NULL; } else { @@ -543,14 +543,14 @@ iptRulesReload(iptRules *rules) iptRule *rule = &rules->rules[i]; char *orig; - orig = rule->argv[rule->flipflop]; - rule->argv[rule->flipflop] = (char *) "--delete"; + orig = rule->argv[rule->command_idx]; + rule->argv[rule->command_idx] = (char *) "--delete"; if ((retval = iptablesSpawn(WITH_ERRORS, rule->argv))) qemudLog(QEMUD_WARN, "Failed to remove iptables rule '%s' from chain '%s' in table '%s': %s", rule->rule, rules->chain, rules->table, strerror(retval)); - rule->argv[rule->flipflop] = orig; + rule->argv[rule->command_idx] = orig; } if ((retval = iptablesAddRemoveChain(rules, REMOVE)) || --

1 0

[Libvir] [patch 3/9] Make iptables code use common utils
by Mark McLoughlin 04 Jan '08

04 Jan '08

utils.c has grown some functions since the iptables code was written - make use of virFileMakePath() and virFileBuildPath(). Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 09:46:19.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 09:46:19.000000000 +0000 @@ -44,6 +44,7 @@ #include "internal.h" #include "iptables.h" +#include "util.h" #define qemudLog(level, msg...) fprintf(stderr, msg) @@ -135,60 +136,6 @@ writeRules(const char *path, return 0; } - -static int -ensureDir(const char *path) -{ - struct stat st; - char parent[PATH_MAX]; - char *p; - int err; - - if (stat(path, &st) >= 0) - return 0; - - strncpy(parent, path, PATH_MAX); - parent[PATH_MAX - 1] = '\0'; - - if (!(p = strrchr(parent, '/'))) - return EINVAL; - - if (p == parent) - return EPERM; - - *p = '\0'; - - if ((err = ensureDir(parent))) - return err; - - if (mkdir(path, 0700) < 0 && errno != EEXIST) - return errno; - - return 0; -} - -static int -buildDir(const char *table, - char *path, - int maxlen) -{ - if (snprintf(path, maxlen, IPTABLES_DIR "/%s", table) >= maxlen) - return EINVAL; - else - return 0; -} - -static int -buildPath(const char *table, - const char *chain, - char *path, - int maxlen) -{ - if (snprintf(path, maxlen, IPTABLES_DIR "/%s/%s.chain", table, chain) >= maxlen) - return EINVAL; - else - return 0; -} #endif /* IPTABLES_DIR */ static void @@ -235,7 +182,7 @@ iptRulesAppend(iptRules *rules, { int err; - if ((err = ensureDir(rules->dir))) + if ((err = virFileMakePath(rules->dir))) return err; if ((err = writeRules(rules->path, rules->rules, rules->nrules))) @@ -332,10 +279,10 @@ iptRulesNew(const char *table, rules->nrules = 0; #ifdef IPTABLES_DIR - if (buildDir(table, rules->dir, sizeof(rules->dir))) + if (virFileBuildPath(IPTABLES_DIR, table, NULL, rules->dir, sizeof(rules->dir)) < 0) goto error; - if (buildPath(table, chain, rules->path, sizeof(rules->path))) + if (virFileBuildPath(rules->dir, chain, ".chain", rules->path, sizeof(rules->path)) < 0) goto error; #endif /* IPTABLES_DIR */ --

1 0

[Libvir] [patch 2/9] Fix minor iptables error logging issue
by Mark McLoughlin 04 Jan '08

04 Jan '08

Fix a minor issue with some error reporting in the iptables code - namely that we use errno after it may have been set to something other than the error reported. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2008-01-04 11:46:38.000000000 +0000 +++ libvirt.orig/src/iptables.c 2008-01-04 11:46:38.000000000 +0000 @@ -601,7 +601,7 @@ iptRulesReload(iptRules *rules) if ((retval = iptablesSpawn(WITH_ERRORS, rule->argv))) qemudLog(QEMUD_WARN, "Failed to remove iptables rule '%s' from chain '%s' in table '%s': %s", - rule->rule, rules->chain, rules->table, strerror(errno)); + rule->rule, rules->chain, rules->table, strerror(retval)); rule->argv[rule->flipflop] = orig; } --

1 0

[Libvir] [patch 1/9] Fix compile error in --with-iptables-dir code
by Mark McLoughlin 04 Jan '08

04 Jan '08

It seems no-one ever used --with-iptables-dir, since it doesn't compile :-) Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/iptables.c =================================================================== --- libvirt.orig/src/iptables.c 2007-12-13 09:05:31.000000000 +0000 +++ libvirt.orig/src/iptables.c 2007-12-13 09:05:31.000000000 +0000 @@ -91,7 +91,7 @@ struct _iptablesContext #ifdef IPTABLES_DIR static int writeRules(const char *path, - const iptRules *rules, + const iptRule *rules, int nrules) { char tmp[PATH_MAX]; --

1 0

[Libvir] [patch 0/9] Add support for Fedora lokkit's --custom-rules option
by Mark McLoughlin 04 Jan '08

04 Jan '08

Hey, When the iptables support was first added to libvirtd, we proposed a change to iptables to allow us to register our rules so that the rules would be automatically reloaded e.g. "service iptables restart" was run or if the user modified their firewall configuration with system-config-firewall. See: https://bugzilla.redhat.com/227011 That proposal wasn't accepted and so users must currently force libvirt to reload its iptables configuration using SIGHUP in those circumstances. However, since Fedora 8, lokkit has grown a --custom-rules option which we can use to achieve the same effect. The following series of patches does just that. Most of the patches are pretty trivial; the only really significant one is 7/9. (Oh, 7/9 requires Dan's virFileReadAll() patch) Thanks, Mark. --

1 0

[Libvir] [PATCH] #include "config.h" needed
by Richard W.M. Jones 04 Jan '08

04 Jan '08

There is one file missing: #include "config.h" which ought to be included at the beginning of every C file. If missing, it causes problems on Windows -- in particular the C99 keyword 'restrict' won't be recognised and that causes compile errors all over the place. I've also changed a few <config.h> --> "config.h", which I think is more correct because config.h is a local file and should never come from the system include files (CC'd to Jim Meyering -- is this right in your opinion?) Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

3 4

Re: [Libvir] java-libvirt on cvs:libvirt.org
by Richard W.M. Jones 02 Jan '08

02 Jan '08

[Sorry, accidentally deleted the attached message while combing through the awesome amount of spam that this list receives ...] -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

1 0

[Libvir] Re: Documentation on the xml format
by Daniel Schwager 29 Dec '07

29 Dec '07

Hi Rich, >Unfortunately this level of detail is only in the source, and usually >depends on the backend (Xen/QEMU/whatever). > >If you'd like to help document these sorts of issues, then we'd welcome >patches. The source for this page is in libvirt CVS doc/ directory. > >http://libvirt.org/format.html I want extend the java-libvirt implementation based on the code of István Tóth. Therefore, I created a XSD file (XML description file). This could be a base for the XML-documentation. Should I post it ? One more question: Is there a changelist for the libvirt API between 0.3.2 and 0.4 ? The code based on 0.3.2 ... regards Danny ------------------------------------------------------------------- DT Netsolution GmbH - Taläckerstr. 30 - D-70437 Stuttgart Geschäftsführer: Daniel Schwager, Stefan Hörz - HRB Stuttgart 19870 Tel: +49-711-849910-32, Fax: -932 - Mailto:daniel.schwager@dtnet.de

3 4

[Libvir] with-openvz compile error
by Mikhail A. Pokidko 26 Dec '07

26 Dec '07

Hi all! I try to build-up libvirt-0.4.0 with openvz support : %configure --with-init-script=redhat --with-qemud-pid-file=/var/run/libvirt_qemud.pid \ --with-remote-file=/var/run/libvirtd.pid \ --with-xen-proxy=yes --with-openvz I`ve got the error on the following stage: gcc -DHAVE_CONFIG_H -I. -I.. -I../gnulib/lib -I../gnulib/lib -I../include -I../include -I../qemud -I/usr/include/libxml2 -DBINDIR=\"/usr/lib\" -DSBINDIR=\"/usr/sbin\" -DSYSCONF_DIR=\"/etc\" -DLOCALEBASEDIR=\"/usr/share/locale\" -DLOCAL_STATE_DIR=\"/var/lib\" -DGETTEXT_PACKAGE=\"libvirt\" -Wall -Wformat -Wformat-security -Wmissing-prototypes -Wnested-externs -Wpointer-arith -Wextra -Wshadow -Wcast-align -Wwrite-strings -Waggregate-return -Wstrict-prototypes -Winline -Wredundant-decls -Wno-sign-compare -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fasynchronous-unwind-tables -DWITH_OPENVZ -DWITH_QEMU -DWITH_TEST -DWITH_REMOTE -DWITH_XEN -pipe -Wall -O2 -march=i686 -mtune=i686 -c openvz_driver.c -fPIC -DPIC -o .libs/libvirt_la-openvz_driver.o openvz_driver.c:562: error: conflicting types for 'openvzOpen' openvz_driver.c:76: error: previous declaration of 'openvzOpen' was here openvz_driver.c:716: warning: initialization from incompatible pointer type openvz_driver.c:773: warning: initialization from incompatible pointer type Unfortunately i`m not confident neither with C nor with C/C++ so can anyone educate me whats wrong with that declarating openvzOpen in openvz_driver.c? -- ALTLinux Team xmpp: solar AT solar.net.ru

4 4

[Libvir] Documentation on the xml format
by Gerrard Geldenhuis 21 Dec '07

21 Dec '07

Hi I am looking for documentation on the xml-format for virtlib. The information on the website is handy but not nearly complete enough. I am looking for documentation that will tell me what options are available to use in the xml and what things will be done automatically by the libraries. If I thus leave out the uuid will it create it automatically? etc. Regards

2 1

[Libvir] OCaml bindings 0.4.0.0 released
by Richard W.M. Jones 20 Dec '07

20 Dec '07

The only significant change here is that these now don't block all threads during a long-running libvirt API call. So you can have a thread to keep the display updated and another making libvirt calls. As with all libvirt programs, each thread that needs to make libvirt calls should have its own connection. http://libvirt.org/ocaml/ Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

1 0

[Libvir] Libvirt version
by Katti, Vadiraj (STSD-Openview) 18 Dec '07

18 Dec '07

Hi, Currently the latest version of libvirt available is 0.3.3. But SLES 10 ships 0.2.0 version of libvirt (not sure what version RHEL 5.1 ships). Any idea when and on what basis SLES decides to ship the upgraded version of libvirt. Thanks, Vadiraj

3 3

[Libvir] PATCH: Add dep on 'nc' RPM
by Daniel P. Berrange 18 Dec '07

18 Dec '07

The libvirt SSH tunnelling support requires 'nc' to operate. The libvirt RPM does not, however, have any dependancy on 'nc'. So by default it is pure luck whether you can use SSH tunnelling after installing the libvirt package & starting the daemon. Even though we don't technically need it on the client end, I figure nc is so small we may as well add a dep to the main libvirt RPM. This ensures nc is present anywhere the daemon is. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

2 3

[Libvir] PATCH: Compatability with Xen 3.2.0
by Daniel P. Berrange 18 Dec '07

18 Dec '07

In Xen 3.2.0 the physinfo hypercall was changed to remove the field 'sockets_per_node' and add in 'nr_cpus'. We use the sockets_per_node field in livirt for the virNodeInfo struct :-( This patch re-calculates its value in terms of 'nr_cpus / (nodes*cores*threads)' which is how older Xen used to figure it out. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

4 5

[Libvir] Release of libvirt-0.4.0
by Daniel Veillard 18 Dec '07

18 Dec '07

A new release is available from ftp://libvirt.org/libvirt/ We ddin;t had a release since the end of September and the logs below shows it, in retrospect I should have done an intermediate release around mid November. There is so much new code that it makes sense to bump the minor version: * New features: - Compilation on Windows cygwin/mingw (Richard Jones) - Ruby bindings (David Lutterkort) - SASL based authentication for libvirt remote support (Daniel Berrange) - PolicyKit authentication (Daniel Berrange) * Documentation: - example files for QEMU and libvirtd configuations (Daniel Berrange) - english cleanups (Jim Paris) - CIM and OpenVZ references - document <shareable/> - daemon startup when using QEMU/KVM - document HV support for new NUMA calls (Richard Jones) - various english fixes (Bruce Montague) - OCaml docs links (Richard Jones) - describe the various bindings add Ruby link - Windows support page (Richard Jones) - authentication documentation updates (Daniel Berrange) * Bug fixes: - NUMA topology error handling (Beth Kon) - NUMA topology cells without CPU (Beth Kon) - XML to/from XM bridge config (Daniel Berrange) - XM processing of vnc parameters (Daniel Berrange) - Reset migration source after failure (Jim Paris) - negative integer in config (Tatsuro Enokura) - zero terminating string buffer - detect integer overflow (Jim Meyering) - QEmu command line ending fixes (Daniel Berrange) - recursion problem in the daemon (Daniel Berrange) - HVM domain with CDRom (Masayuki Sunou) - off by one error in NUMA cpu count (Beth Kon) - avoid xend errors when adding disks (Masayuki Sunou) - compile error (Chris Lalancette) - transposed fwrite args (Jim Meyering) - compile without xen and on solaris (Jim Paris) - parsing of interface names (Richard Jones) - overflow for starts on 32bits (Daniel Berrange) - fix problems in error reporting (Saori Fukuta) - wrong call to brSetForwardDelay changed to brSetEnableSTP (Richard Jones) - allow shareable disk in old Xen - fix wrong certificate file (Jim Meyering) - avoid some startup error when non-root - off-by-1 buffer NULL termination (Daniel Berrange) - various string allocation fixes (Daniel Berrange) - avoid problems with vnetXXX interfaces in domain dumps (Daniel Berrange) - build fixes for RHEL (Daniel Berrange) - virsh prompt should not depend on uid (Richard Jones) - fix scaping of '<' (Richard Jones) - fix detach-disk on Xen tap devices (Saori Fukuta) - CPU parameter setting in XM config (Saori Fukuta) - credential handling fixes (Daniel Berrange) - fix compatibility with Xen 3.2.0 (Daniel Berrange) * Improvements: - /etc/libvirt/qemu.conf configuration for QEMU driver (Daniel Berrange) - NUMA cpu pinning in config files (DV and Saori Fukuta) - CDRom media change in KVM/QEMU (Daniel Berrange) - tests for <shareable/> in configs - pinning inactive domains for Xen 3.0.3 (Saori Fukuta) - use gnulib for portability enhancement (Jim Meyering) - --without-libvirtd config option (Richard Jones) - Python bindings for NUMA - add extra utility functions to buffer (Richard Jones) - separate qparams module for handling query parameters (Richard Jones) * Code cleanups: - remove virDomainRestart from API as it was never used (Richard Jones) - constify params for attach/detach APIs (Daniel Berrange) - gcc printf attribute checkings (Jim Meyering) - refactoring of device parsing code and shell escaping (Daniel Berrange) - virsh schedinfo parameters validation (Masayuki Sunou) - Avoid risk of format string abuse (Jim Meyering) - integer parsing cleanups (Jim Meyering) - build out of the source tree (Jim Meyering) - URI parsing refactoring (Richard Jones) - failed strdup/malloc handling (Jim Meyering) - Make "make distcheck" work (Jim Meyering) - improve xen internall error reports (Richard Jones) - cleanup of the daemon remote code (Daniel Berrange) - rename error VIR_FROM_LINUX to VIR_FROM_STATS_LINUX (Richard Jones) - don't compile the proxy if without Xen (Richard Jones) - fix paths when configuring for /usr prefix - improve error reporting code (Jim Meyering) - detect heap allocation failure (Jim Meyering) - disable xen sexpr parsing code if Xen is disabled (Daniel Berrange) - cleanup of the GetType entry point for Xen drivers - move some QEmu path handling to generic module (Daniel Berrange) - many code cleanups related to the Windows port (Richard Jones) - disable the proxy if using PolicyKit (Daniel Berrange) - readline availability detection - test libvirtd's config-processing code (Jim Meyering) - use a variable name as sizeof argument (Jim Meyering) Thanks to everybody who helped for this release, by providing feedback, documentation, patches, etc. ! Daniel -- Red Hat Virtualization group http://redhat.com/virtualization/ Daniel Veillard | virtualization library http://libvirt.org/ veillard(a)redhat.com | libxml GNOME XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/

1 0

[Libvir] [PATCH] Enhance virBuffer code
by Richard W.M. Jones 17 Dec '07

17 Dec '07

Apart from a couple of minor fixes, this adds the following useful functions to the virBuffer implementation: virBufferAddChar: Append a single character to the buffer. virBufferURIEncodeString: Append a %-encoded string to the buffer (eg. virBufferEscapeString and the similar function in libxml2). Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

5 22

[Libvir] More queries
by Katti, Vadiraj (STSD-Openview) 17 Dec '07

17 Dec '07

Hi, I've more quries on libvirt apis: 1. Is there any API in libvirt that gives me the uptime of the guets. 2. Can I know how many physical CPUs are dedicated to a VM or if they are shared. 3. How do I know the logical cpu consumption of the guests( from dom0 using libvirt obviously). 4. Can get the ip address of each of the guests with any of the APIs Thanks, Vadiraj

3 5

[Libvir] [PATCH] 0/2 Factor out query parsing from remote
by Richard W.M. Jones 15 Dec '07

15 Dec '07

We need to do query string assembly and parsing for the Amazon EC2 backend. These two patches factor out this code from inside remote_internal.c into a separate utility file. Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

3 6

[Libvir] [PATCH] Fix the cpus parameter setting of xenXMParseXMLToConfig
by Saori Fukuta 14 Dec '07

14 Dec '07

I think there is a unnecessary code for setting cpus parameter at xenXMParseXMLToConfig, since the cpus parameter is already set on the upper code. Because of this, converted cpus string will not be used. So, can I remove it ? Regards, Saori Fukuta

4 4