- Devel - libvirt List Archives

[libvirt] [PATCH v4] qemu: Check for existence of provided *_tls_x509_cert_dir
by John Ferlan 27 Jul '17

27 Jul '17

https://bugzilla.redhat.com/show_bug.cgi?id=1458630 Introduce virQEMUDriverConfigTLSDirResetDefaults in order to check if the defaultTLSx509certdir was changed, then change the default for any other *TLSx509certdir that was not set to the default default. Introduce virQEMUDriverConfigValidate to validate the existence of any of the *_tls_x509_cert_dir values that were uncommented/set, incuding the default. Update the qemu.conf description for default to describe the consequences if the default directory path does not exist. Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- v3: https://www.redhat.com/archives/libvir-list/2017-July/msg00915.html Changes since v3 - rework even more based on code review. src/qemu/qemu.conf | 8 ++++ src/qemu/qemu_conf.c | 105 ++++++++++++++++++++++++++++++++++++++++++++++++- src/qemu/qemu_conf.h | 4 ++ src/qemu/qemu_driver.c | 3 ++ 4 files changed, 119 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index 1d81472..f977e3b 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -13,6 +13,14 @@ # # dh-params.pem - the DH params configuration file # +# If the directory does not exist or contain the necessary files, QEMU +# domains will fail to start if they are configured to use TLS. +# +# In order to overwrite the default path alter the following. This path +# definition will be used as the default path for other *_tls_x509_cert_dir +# configuration settings if their default path does not exist or is not +# specifically set. +# #default_tls_x509_cert_dir = "/etc/pki/qemu" diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index c4714ed..1a4a998 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -425,6 +425,43 @@ virQEMUDriverConfigHugeTLBFSInit(virHugeTLBFSPtr hugetlbfs, } +/** + * @cfg: Just read config TLS values + * + * If the default_tls_x509_cert_dir was uncommented or changed from + * the default value assigned to the *_tls_x509_cert_dir values when + * virQEMUDriverConfigNew was executed, we need to check if we need + * to update the other defaults. + * + * Returns 0 on success, -1 on failure + */ +static int +virQEMUDriverConfigTLSDirResetDefaults(virQEMUDriverConfigPtr cfg) +{ + /* Not changed or set to the default default, nothing to do */ + if (!cfg->checkdefaultTLSx509certdir || + STREQ(cfg->defaultTLSx509certdir, SYSCONFDIR "/pki/qemu")) + return 0; + +#define CHECK_RESET_CERT_DIR_DEFAULT(val) \ + do { \ + if (STREQ(cfg->val ## TLSx509certdir, SYSCONFDIR "/pki/qemu")) { \ + VIR_FREE(cfg->val ## TLSx509certdir); \ + if (VIR_STRDUP(cfg->val ## TLSx509certdir, \ + cfg->defaultTLSx509certdir) < 0) \ + return -1; \ + } \ + } while (0) + + CHECK_RESET_CERT_DIR_DEFAULT(vnc); + CHECK_RESET_CERT_DIR_DEFAULT(spice); + CHECK_RESET_CERT_DIR_DEFAULT(chardev); + CHECK_RESET_CERT_DIR_DEFAULT(migrate); + + return 0; +} + + int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, const char *filename, bool privileged) @@ -452,8 +489,9 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, if (!(conf = virConfReadFile(filename, 0))) goto cleanup; - if (virConfGetValueString(conf, "default_tls_x509_cert_dir", &cfg->defaultTLSx509certdir) < 0) + if ((rv = virConfGetValueString(conf, "default_tls_x509_cert_dir", &cfg->defaultTLSx509certdir)) < 0) goto cleanup; + cfg->checkdefaultTLSx509certdir = (rv == 1); if (virConfGetValueBool(conf, "default_tls_x509_verify", &cfg->defaultTLSx509verify) < 0) goto cleanup; if (virConfGetValueString(conf, "default_tls_x509_secret_uuid", @@ -549,6 +587,9 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, #undef GET_CONFIG_TLS_CERTINFO + if (virQEMUDriverConfigTLSDirResetDefaults(cfg) < 0) + goto cleanup; + if (virConfGetValueUInt(conf, "remote_websocket_port_min", &cfg->webSocketPortMin) < 0) goto cleanup; if (cfg->webSocketPortMin < QEMU_WEBSOCKET_PORT_MIN) { @@ -873,6 +914,68 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, return ret; } + +/** + * @cfg: Recently read config values + * + * Validate the recently read configuration values. + * + * Returns 0 on success, -1 on failure + */ +int +virQEMUDriverConfigValidate(virQEMUDriverConfigPtr cfg) +{ + /* If the default entry was uncommented, then validate existence */ + if (cfg->checkdefaultTLSx509certdir) { + if (!virFileExists(cfg->defaultTLSx509certdir)) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("default_tls_x509_cert_dir directory '%s' " + "does not exist"), + cfg->defaultTLSx509certdir); + return -1; + } + } + + /* For each of the others - if the value is not to the default default + * then check if the directory exists (this may duplicate the check done + * during virQEMUDriverConfigNew). + */ + if (STRNEQ(cfg->vncTLSx509certdir, SYSCONFDIR "/pki/qemu") && + !virFileExists(cfg->vncTLSx509certdir)) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("vnc_tls_x509_cert_dir directory '%s' does not exist"), + cfg->vncTLSx509certdir); + return -1; + } + + if (STRNEQ(cfg->spiceTLSx509certdir, SYSCONFDIR "/pki/qemu") && + !virFileExists(cfg->spiceTLSx509certdir)) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("spice_tls_x509_cert_dir directory '%s' does not exist"), + cfg->spiceTLSx509certdir); + return -1; + } + + if (STRNEQ(cfg->chardevTLSx509certdir, SYSCONFDIR "/pki/qemu") && + !virFileExists(cfg->chardevTLSx509certdir)) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("chardev_tls_x509_cert_dir directory '%s' does not exist"), + cfg->chardevTLSx509certdir); + return -1; + } + + if (STRNEQ(cfg->migrateTLSx509certdir, SYSCONFDIR "/pki/qemu") && + !virFileExists(cfg->migrateTLSx509certdir)) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("migrate_tls_x509_cert_dir directory '%s' does not exist"), + cfg->migrateTLSx509certdir); + return -1; + } + + return 0; +} + + virQEMUDriverConfigPtr virQEMUDriverGetConfig(virQEMUDriverPtr driver) { virQEMUDriverConfigPtr conf; diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 3013f24..d469b50 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -113,6 +113,7 @@ struct _virQEMUDriverConfig { char *nvramDir; char *defaultTLSx509certdir; + bool checkdefaultTLSx509certdir; bool defaultTLSx509verify; char *defaultTLSx509secretUUID; @@ -302,6 +303,9 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, const char *filename, bool privileged); +int +virQEMUDriverConfigValidate(virQEMUDriverConfigPtr cfg); + virQEMUDriverConfigPtr virQEMUDriverGetConfig(virQEMUDriverPtr driver); bool virQEMUDriverIsPrivileged(virQEMUDriverPtr driver); diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index a423663..3ad71e6 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -667,6 +667,9 @@ qemuStateInitialize(bool privileged, goto error; VIR_FREE(driverConf); + if (virQEMUDriverConfigValidate(cfg) < 0) + goto error; + if (virFileMakePath(cfg->stateDir) < 0) { virReportSystemError(errno, _("Failed to create state dir %s"), cfg->stateDir); -- 2.9.4

2 1

[libvirt] Plans for next release
by Daniel Veillard 27 Jul '17

27 Jul '17

The end of the month is next week, so if we want to release around Aug 1st, I think we should enter freeze on Thursday morning, then I could make rc2 on Saturday and we could have the release on the Tuesday or Wed. Usually this is not the busiest time of the year but if this is a problem please raise this, thanks, Daniel -- Daniel Veillard | Red Hat Developers Tools http://developer.redhat.com/ veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

2 2

[libvirt] [PATCH] build: Distribute tests/{qemucpumock.c, testutilshostcpus.h}
by Martin Kletzander 26 Jul '17

26 Jul '17

Missed by 13554a9e7f4e. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- Pushed under the build-breaker rule. tests/Makefile.am | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/Makefile.am b/tests/Makefile.am index 562c1c77178e..11a380163177 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -560,7 +560,7 @@ libqemutestdriver_la_LDFLAGS = $(QEMULIB_LDFLAGS) libqemutestdriver_la_LIBADD = $(qemu_LDADDS) qemucpumock_la_SOURCES = \ - qemucpumock.c + qemucpumock.c testutilshostcpus.h qemucpumock_la_CFLAGS = $(AM_CFLAGS) qemucpumock_la_LDFLAGS = $(MOCKLIBS_LDFLAGS) qemucpumock_la_LIBADD = $(MOCKLIBS_LIBS) @@ -674,7 +674,7 @@ EXTRA_DIST += qemuxml2argvtest.c qemuxml2xmltest.c qemuargv2xmltest.c \ qemumonitorjsontest.c qemuhotplugtest.c \ qemuagenttest.c qemucapabilitiestest.c \ qemucaps2xmltest.c qemucommandutiltest.c \ - qemumemlocktest.c \ + qemumemlocktest.c qemucpumock.c testutilshostcpus.h \ $(QEMUMONITORTESTUTILS_SOURCES) endif ! WITH_QEMU -- 2.13.3

1 0

[libvirt] [PATCH 00/16] Make the virNetworkObjPtr private
by John Ferlan 26 Jul '17

26 Jul '17

All part of the effort I have to have a common object model. This series is network test, driver, and virnetworkobj related to work towards that goal. By the last patch, the object is now private to virnetworkobj.c John Ferlan (16): test: Fix up formatting in network test API's test: Use consistent variable names for network test driver APIs network: Perform some formatting cleanup in bridge_driver network: Use consistent naming in bridge_driver for virNetwork objects network: Move macmap mgmt from bridge_driver to virnetworkobj network: Add virNetworkObj Get/Set API's for @dnsmasqPid and @radvdPid network: Alter virNetworkObj @class_id to be @classIdMap network: Add virNetworkObj Get/Set API's for @floor_sum network: Add virNetworkObj Get API's for @def and @newDef network: Introduce virNetworkObj{Get|Set}Autostart network: Introduce virNetworkObj{Is|Set}Active network: Introduce virNetworkObjIsPersistent network: Consistent use of @obj for virnetworkobj network: Adjust virNetworkObjNew call and return network: Modify naming for virNetworkObjList* fetching APIs network: Privatize virNetworkObj src/conf/virnetworkobj.c | 679 +++++++++++++++------ src/conf/virnetworkobj.h | 107 +++- src/libvirt_private.syms | 20 + src/network/bridge_driver.c | 1415 +++++++++++++++++++++++-------------------- src/network/bridge_driver.h | 50 +- src/test/test_driver.c | 279 +++++---- tests/networkxml2conftest.c | 13 +- 7 files changed, 1538 insertions(+), 1025 deletions(-) -- 2.9.3

2 37

[libvirt] [PATCH] docs: Add build timestamps to generated html/php pages
by Martin Kletzander 26 Jul '17

26 Jul '17

In order not to make the build even less reproducible, honour SOURCE_DATE_EPOCH environment variable as specified: https://reproducible-builds.org/specs/source-date-epoch/ Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- docs/Makefile.am | 13 +++++++++---- docs/newapi.xsl | 2 ++ docs/page.xsl | 4 ++++ docs/site.xsl | 1 + docs/subsite.xsl | 1 + 5 files changed, 17 insertions(+), 4 deletions(-) diff --git a/docs/Makefile.am b/docs/Makefile.am index e32758f4aa36..67a945a334f3 100644 --- a/docs/Makefile.am +++ b/docs/Makefile.am @@ -196,6 +196,8 @@ MAINTAINERCLEANFILES = \ $(addprefix $(srcdir)/,$(dot_php)) \ $(srcdir)/hvsupport.html.in $(srcdir)/aclperms.htmlinc +timestamp="$(shell if test -n "$$SOURCE_DATE_EPOCH"; then date --date="@$$SOURCE_DATE_EPOCH"; else date; fi)" + all-am: web api: $(srcdir)/libvirt-api.xml $(srcdir)/libvirt-refs.xml @@ -255,7 +257,8 @@ MAINTAINERCLEANFILES += \ $(MKDIR_P) $$dir; \ style=subsite.xsl; \ fi; \ - $(XSLTPROC) --stringparam pagename $$name --nonet \ + $(XSLTPROC) --stringparam pagename $$name \ + --stringparam timestamp $(timestamp) --nonet \ $(top_srcdir)/docs/$$style $< > $@ \ || { rm $@ && exit 1; }; fi @@ -270,9 +273,10 @@ MAINTAINERCLEANFILES += \ else echo "missing XHTML1 DTD"; cat $< > $(srcdir)/$@ ; fi ; fi %.php.tmp: %.php.in site.xsl page.xsl - @if [ -x $(XSLTPROC) ] ; then \ + if [ -x $(XSLTPROC) ] ; then \ echo "Generating $@"; \ - $(XSLTPROC) --stringparam pagename $(@:.tmp=) --nonet \ + $(XSLTPROC) --stringparam pagename $(@:.tmp=) \ + --stringparam timestamp $(timestamp) --nonet \ $(top_srcdir)/docs/site.xsl $< > $@ \ || { rm $@ && exit 1; }; fi @@ -289,6 +293,7 @@ html/index.html: libvirt-api.xml newapi.xsl page.xsl $(APIBUILD_STAMP) $(AM_V_GEN)if [ -x $(XSLTPROC) ] ; then \ $(XSLTPROC) --nonet -o $(srcdir)/ \ --stringparam builddir '$(abs_top_builddir)' \ + --stringparam timestamp $(timestamp) \ $(srcdir)/newapi.xsl $(srcdir)/libvirt-api.xml ; fi && \ if test -x $(XMLLINT) && test -x $(XMLCATALOG) ; then \ if $(XMLCATALOG) '$(XML_CATALOG_FILE)' "-//W3C//DTD XHTML 1.0 Strict//EN" \ @@ -299,7 +304,7 @@ html/index.html: libvirt-api.xml newapi.xsl page.xsl $(APIBUILD_STAMP) $(addprefix $(srcdir)/,$(devhelphtml)): $(srcdir)/libvirt-api.xml $(devhelpxsl) $(AM_V_GEN)if [ -x $(XSLTPROC) ] ; then \ - $(XSLTPROC) --nonet -o $(srcdir)/devhelp/ \ + $(XSLTPROC) --stringparam timestamp $(timestamp) --nonet -o $(srcdir)/devhelp/ \ $(top_srcdir)/docs/devhelp/devhelp.xsl $(srcdir)/libvirt-api.xml ; fi diff --git a/docs/newapi.xsl b/docs/newapi.xsl index 9dd961507af4..d45bfc192d63 100644 --- a/docs/newapi.xsl +++ b/docs/newapi.xsl @@ -818,6 +818,7 @@ doctype-system="http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <xsl:apply-templates select="exsl:node-set($mainpage)" mode="page"> <xsl:with-param name="pagename" select="concat($htmldir, '/index.html')"/> + <xsl:with-param name="timestamp" select="$timestamp"/> </xsl:apply-templates> </xsl:document> @@ -834,6 +835,7 @@ doctype-system="http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <xsl:apply-templates select="exsl:node-set($subpage)" mode="page"> <xsl:with-param name="pagename" select="concat($htmldir, '/libvirt-', @name, '.html')"/> + <xsl:with-param name="timestamp" select="$timestamp"/> </xsl:apply-templates> </xsl:document> </xsl:for-each> diff --git a/docs/page.xsl b/docs/page.xsl index 1d662c670686..5d8e6e8263c3 100644 --- a/docs/page.xsl +++ b/docs/page.xsl @@ -75,11 +75,15 @@  <xsl:template match="/" mode="page"> <xsl:param name="pagename"/> + <xsl:param name="timestamp"/> <html> <xsl:comment> This file is autogenerated from <xsl:value-of select="$pagename"/>.in Do not edit this file. Changes will be lost. </xsl:comment> + <xsl:comment> + This page was generated at <xsl:value-of select="$timestamp"/>. + </xsl:comment> <head> <link rel="stylesheet" type="text/css" href="{$href_base}main.css"/> <link rel="SHORTCUT ICON" href="{$href_base}32favicon.png"/> diff --git a/docs/site.xsl b/docs/site.xsl index ce354c32fb59..b84630e39029 100644 --- a/docs/site.xsl +++ b/docs/site.xsl @@ -29,6 +29,7 @@ <xsl:template match="/"> <xsl:apply-templates select="." mode="page"> <xsl:with-param name="pagename" select="$pagename"/> + <xsl:with-param name="timestamp" select="$timestamp"/> </xsl:apply-templates> </xsl:template> diff --git a/docs/subsite.xsl b/docs/subsite.xsl index 108d0d83e509..6d2453f98e9c 100644 --- a/docs/subsite.xsl +++ b/docs/subsite.xsl @@ -19,6 +19,7 @@ <xsl:template match="/"> <xsl:apply-templates select="." mode="page"> <xsl:with-param name="pagename" select="$pagename"/> + <xsl:with-param name="timestamp" select="$timestamp"/> </xsl:apply-templates> </xsl:template> -- 2.13.3

2 1

[libvirt] [PATCH] docs: Fix documentation related to memory locking
by Nitesh Konkar 26 Jul '17

26 Jul '17

Signed-off-by: Nitesh Konkar <nitkon12(a)linux.vnet.ibm.com> --- docs/formatdomain.html.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index bceddd2..91195be 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -964,7 +964,7 @@ option opens up to a potential security risk: the host will be unable to reclaim the locked memory back from the guest when it's running out of memory, which means a malicious guest allocating large amounts of - locked memory could cause a denial-of-service attach on the host. + locked memory could cause a denial-of-service attack on the host. Because of this, using this option is discouraged unless your workload demands it; even then, it's highly recommended to set an <code>hard_limit</code> (see -- 2.9.4

2 1

[libvirt] [PATCH 0/3] properly handle '=' in the VNC socket path
by Pavel Hrdina 26 Jul '17

26 Jul '17

Pavel Hrdina (3): qemu: capabilities: introduce QEMU_CAPS_VNC_MULTI_SERVERS qemu: properly handle '=' in the VNC socket path tests: add test case for VNC unix path with '=' src/qemu/qemu_capabilities.c | 4 ++ src/qemu/qemu_capabilities.h | 3 ++ src/qemu/qemu_command.c | 5 ++- src/qemu/qemu_process.c | 51 ++++++++++++++++++++-- tests/qemucapabilitiesdata/caps_2.4.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.5.0.x86_64.xml | 1 + .../caps_2.6.0-gicv2.aarch64.xml | 1 + .../caps_2.6.0-gicv3.aarch64.xml | 1 + tests/qemucapabilitiesdata/caps_2.6.0.ppc64le.xml | 1 + tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.7.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.8.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.8.0.x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.ppc64le.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.s390x.xml | 1 + tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml | 1 + ...muxml2argv-graphics-vnc-socket-new-cmdline.args | 22 ++++++++++ ...emuxml2argv-graphics-vnc-socket-new-cmdline.xml | 20 +++++++++ ...argv-graphics-vnc-socket-path-not-supported.xml | 1 + .../qemuxml2argvdata/qemuxml2argv-name-escape.args | 2 +- tests/qemuxml2argvtest.c | 5 +++ 22 files changed, 121 insertions(+), 5 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket-new-cmdline.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket-new-cmdline.xml create mode 120000 tests/qemuxml2argvdata/qemuxml2argv-graphics-vnc-socket-path-not-supported.xml -- 2.13.3

2 5

[libvirt] [PATCH] qemu_cgroup: Remove unnecessary virQEMUDriverPtr arguments
by Martin Kletzander 26 Jul '17

26 Jul '17

Since commit 2e6ecba1bcac, the pointer to the qemu driver is saved in domain object's private data and hence does not have to be passed as yet another parameter if domain object is already one of them. This is a first (example) patch of this kind of clean up, others will hopefully follow. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/qemu/qemu_cgroup.c | 33 ++++++++++++++------------------- src/qemu/qemu_cgroup.h | 6 ++---- src/qemu/qemu_process.c | 4 ++-- 3 files changed, 18 insertions(+), 25 deletions(-) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index 7355527c1cc5..6fc413098ae8 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -604,8 +604,7 @@ qemuTeardownChardevCgroup(virDomainObjPtr vm, static int -qemuSetupDevicesCgroup(virQEMUDriverPtr driver, - virDomainObjPtr vm) +qemuSetupDevicesCgroup(virDomainObjPtr vm) { qemuDomainObjPrivatePtr priv = vm->privateData; virQEMUDriverConfigPtr cfg = NULL; @@ -644,7 +643,7 @@ qemuSetupDevicesCgroup(virQEMUDriverPtr driver, if (rv < 0) goto cleanup; - cfg = virQEMUDriverGetConfig(driver); + cfg = virQEMUDriverGetConfig(priv->driver); deviceACL = cfg->cgroupDeviceACL ? (const char *const *)cfg->cgroupDeviceACL : defaultDeviceACL; @@ -769,8 +768,7 @@ qemuSetupCpusetCgroup(virDomainObjPtr vm) static int -qemuSetupCpuCgroup(virQEMUDriverPtr driver, - virDomainObjPtr vm) +qemuSetupCpuCgroup(virDomainObjPtr vm) { qemuDomainObjPrivatePtr priv = vm->privateData; virObjectEventPtr event = NULL; @@ -806,7 +804,7 @@ qemuSetupCpuCgroup(virQEMUDriverPtr driver, event = virDomainEventTunableNewFromObj(vm, eventParams, eventNparams); } - qemuDomainEventQueue(driver, event); + qemuDomainEventQueue(priv->driver, event); } return 0; @@ -814,16 +812,15 @@ qemuSetupCpuCgroup(virQEMUDriverPtr driver, static int -qemuInitCgroup(virQEMUDriverPtr driver, - virDomainObjPtr vm, +qemuInitCgroup(virDomainObjPtr vm, size_t nnicindexes, int *nicindexes) { int ret = -1; qemuDomainObjPrivatePtr priv = vm->privateData; - virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); + virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(priv->driver); - if (!virQEMUDriverIsPrivileged(driver)) + if (!virQEMUDriverIsPrivileged(priv->driver)) goto done; if (!virCgroupAvailable()) @@ -954,14 +951,13 @@ qemuRestoreCgroupState(virDomainObjPtr vm) } int -qemuConnectCgroup(virQEMUDriverPtr driver, - virDomainObjPtr vm) +qemuConnectCgroup(virDomainObjPtr vm) { - virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); qemuDomainObjPrivatePtr priv = vm->privateData; + virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(priv->driver); int ret = -1; - if (!virQEMUDriverIsPrivileged(driver)) + if (!virQEMUDriverIsPrivileged(priv->driver)) goto done; if (!virCgroupAvailable()) @@ -991,8 +987,7 @@ qemuConnectCgroup(virQEMUDriverPtr driver, } int -qemuSetupCgroup(virQEMUDriverPtr driver, - virDomainObjPtr vm, +qemuSetupCgroup(virDomainObjPtr vm, size_t nnicindexes, int *nicindexes) { @@ -1005,13 +1000,13 @@ qemuSetupCgroup(virQEMUDriverPtr driver, return -1; } - if (qemuInitCgroup(driver, vm, nnicindexes, nicindexes) < 0) + if (qemuInitCgroup(vm, nnicindexes, nicindexes) < 0) return -1; if (!priv->cgroup) return 0; - if (qemuSetupDevicesCgroup(driver, vm) < 0) + if (qemuSetupDevicesCgroup(vm) < 0) goto cleanup; if (qemuSetupBlkioCgroup(vm) < 0) @@ -1020,7 +1015,7 @@ qemuSetupCgroup(virQEMUDriverPtr driver, if (qemuSetupMemoryCgroup(vm) < 0) goto cleanup; - if (qemuSetupCpuCgroup(driver, vm) < 0) + if (qemuSetupCpuCgroup(vm) < 0) goto cleanup; if (qemuSetupCpusetCgroup(vm) < 0) diff --git a/src/qemu/qemu_cgroup.h b/src/qemu/qemu_cgroup.h index d016ce29d87e..3fc1583612e1 100644 --- a/src/qemu/qemu_cgroup.h +++ b/src/qemu/qemu_cgroup.h @@ -55,10 +55,8 @@ int qemuSetupChardevCgroup(virDomainObjPtr vm, virDomainChrDefPtr dev); int qemuTeardownChardevCgroup(virDomainObjPtr vm, virDomainChrDefPtr dev); -int qemuConnectCgroup(virQEMUDriverPtr driver, - virDomainObjPtr vm); -int qemuSetupCgroup(virQEMUDriverPtr driver, - virDomainObjPtr vm, +int qemuConnectCgroup(virDomainObjPtr vm); +int qemuSetupCgroup(virDomainObjPtr vm, size_t nnicindexes, int *nicindexes); int qemuSetupCpusetMems(virDomainObjPtr vm); diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 87ab85fdb476..535c16b03705 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -5595,7 +5595,7 @@ qemuProcessLaunch(virConnectPtr conn, } VIR_DEBUG("Setting up domain cgroup (if required)"); - if (qemuSetupCgroup(driver, vm, nnicindexes, nicindexes) < 0) + if (qemuSetupCgroup(vm, nnicindexes, nicindexes) < 0) goto cleanup; if (!(priv->perf = virPerfNew())) @@ -6821,7 +6821,7 @@ qemuProcessReconnect(void *opaque) if (qemuHostdevUpdateActiveDomainDevices(driver, obj->def) < 0) goto error; - if (qemuConnectCgroup(driver, obj) < 0) + if (qemuConnectCgroup(obj) < 0) goto error; if (qemuDomainPerfRestart(obj) < 0) -- 2.13.3

2 1

[libvirt] [PATCH v3] qemu: Check for existence of provided *_tls_x509_cert_dir
by John Ferlan 26 Jul '17

26 Jul '17

https://bugzilla.redhat.com/show_bug.cgi?id=1458630 Introduce virQEMUDriverConfigTLSDirValidateResetDefault to validate that if any of the *_tls_x509_cert_dir values were set properly and reset the default value if the default_tls_x509_cert_dir changed. Update the qemu.conf description for default to describe the consequences if the default directory path does not exist. Signed-off-by: John Ferlan <jferlan(a)redhat.com> --- v2: https://www.redhat.com/archives/libvir-list/2017-June/msg01341.html Follow-ups in July though. Changes since v2 - reduced verbosity in qemu.conf and adjusted the logic to create/call virQEMUDriverConfigTLSDirValidateResetDefault after all the values are read in order to validate the values and adjust the default if necessary. Tested by 1. Having everything commented out, w/ no /etc/pki/qemu: Works as expected 2. Uncomment the default_tls_x509_cert_dir, w/ no /etc/pki/qemu: Fails as expected 3. Uncomment each of the other *_tls_x509_cert_dir's when directory not exist: Fails as expected 4. Use a directory that exists for other _*tls_x509_cert_dirs: Works as expected 5. Change the default_tls_x509_cert_dir to an existing directory: Works as expected, each of the other uncommented *_tls_x509_cert_dirs will get the new value (tested via debug code) while one that used an existing default didn't change from it's default /etc/pki/libvirt-* src/qemu/qemu.conf | 8 +++++++ src/qemu/qemu_conf.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++- src/qemu/qemu_conf.h | 4 ++++ src/qemu/qemu_driver.c | 3 +++ 4 files changed, 79 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index e6c0832..9526aed 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -13,6 +13,14 @@ # # dh-params.pem - the DH params configuration file # +# If the directory does not exist or contain the necessary files, QEMU +# domains will fail to start if they are configured to use TLS. +# +# In order to overwrite the default path alter the following. This path +# definition will be used as the default path for other *_tls_x509_cert_dir +# configuration settings if their default path does not exist or is not +# specifically set. +# #default_tls_x509_cert_dir = "/etc/pki/qemu" diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 6f44cbf..87d2c2d 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -451,8 +451,9 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, if (!(conf = virConfReadFile(filename, 0))) goto cleanup; - if (virConfGetValueString(conf, "default_tls_x509_cert_dir", &cfg->defaultTLSx509certdir) < 0) + if ((rv = virConfGetValueString(conf, "default_tls_x509_cert_dir", &cfg->defaultTLSx509certdir)) < 0) goto cleanup; + cfg->checkdefaultTLSx509certdir = (rv == 1); if (virConfGetValueBool(conf, "default_tls_x509_verify", &cfg->defaultTLSx509verify) < 0) goto cleanup; if (virConfGetValueString(conf, "default_tls_x509_secret_uuid", @@ -872,6 +873,68 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, return ret; } + +/** + * @cfg: Recently config values + * + * Validate the recently read *_tls_x509_cert_dir values and if necessary + * update the default value to match the default_tls_x509_cert_dir + * + * Returns 0 on success, -1 on failure + */ +int +virQEMUDriverConfigTLSDirValidateResetDefault(virQEMUDriverConfigPtr cfg) +{ + bool newDefault = false; + + /* If the default entry was uncommented, then validate existence */ + if (cfg->checkdefaultTLSx509certdir) { + if (!virFileExists(cfg->defaultTLSx509certdir)) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("default_tls_x509_cert_dir directory '%s' " + "does not exist"), + cfg->defaultTLSx509certdir); + return -1; + } + if (STRNEQ(cfg->defaultTLSx509certdir, SYSCONFDIR "/pki/qemu")) + newDefault = true; + } + + /* We know virQEMUDriverConfigNew set the particular value to either + * it's default or default_tls_x509_cert_dir's default. So, if not the + * default default and the directory doesn't exist, then the entry was + * set in the config file to something that doesn't exist, so error. + * + * Also, if the defaultTLSx509certdir value was changed from the default, + * then we need to update the default for each setting as well to match + * the default_tls_x509_cert_dir. + */ +#define VALIDATE_TLS_X509_CERT_DIR(val) \ + do { \ + if (STRNEQ(cfg->val ## TLSx509certdir, SYSCONFDIR "/pki/qemu") && \ + !virFileExists(cfg->val ## TLSx509certdir)) { \ + virReportError(VIR_ERR_CONF_SYNTAX, \ + _(#val"_tls_x509_cert_dir directory '%s' " \ + "does not exist"), \ + cfg->val ## TLSx509certdir); \ + return -1; \ + } else if (newDefault) { \ + VIR_FREE(cfg->val ## TLSx509certdir); \ + if (VIR_STRDUP(cfg->val ## TLSx509certdir, \ + cfg->defaultTLSx509certdir) < 0) \ + return -1; \ + } \ + } while (0) + + VALIDATE_TLS_X509_CERT_DIR(vnc); + VALIDATE_TLS_X509_CERT_DIR(spice); + VALIDATE_TLS_X509_CERT_DIR(chardev); + VALIDATE_TLS_X509_CERT_DIR(migrate); + + return 0; +} + + virQEMUDriverConfigPtr virQEMUDriverGetConfig(virQEMUDriverPtr driver) { virQEMUDriverConfigPtr conf; diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 1407eef..fffa871 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -112,6 +112,7 @@ struct _virQEMUDriverConfig { char *nvramDir; char *defaultTLSx509certdir; + bool checkdefaultTLSx509certdir; bool defaultTLSx509verify; char *defaultTLSx509secretUUID; @@ -301,6 +302,9 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg, const char *filename, bool privileged); +int +virQEMUDriverConfigTLSDirValidateResetDefault(virQEMUDriverConfigPtr cfg); + virQEMUDriverConfigPtr virQEMUDriverGetConfig(virQEMUDriverPtr driver); bool virQEMUDriverIsPrivileged(virQEMUDriverPtr driver); diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 6568def..2731f8e 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -667,6 +667,9 @@ qemuStateInitialize(bool privileged, goto error; VIR_FREE(driverConf); + if (virQEMUDriverConfigTLSDirValidateResetDefault(cfg) < 0) + goto error; + if (virFileMakePath(cfg->stateDir) < 0) { virReportSystemError(errno, _("Failed to create state dir %s"), cfg->stateDir); -- 2.9.4

2 1

[libvirt] [PATCH v2 0/7] introduce virFileCache and use it for qemu capabilities
by Pavel Hrdina 26 Jul '17

26 Jul '17

Pavel Hrdina (7): util: introduce virFileCache tests: add virfilecachetest qemu: introduce struct _virQEMUCapsCachePriv tests: rewrite host CPU mocking qemu: pass only host arch instead of the whole virCaps qemu: switch QEMU capabilities to use virFileCache qemu: privatize _virQEMUCapsCachePriv struct po/POTFILES.in | 1 + src/Makefile.am | 1 + src/libvirt_private.syms | 9 + src/qemu/qemu_capabilities.c | 372 ++++++----------- src/qemu/qemu_capabilities.h | 20 +- src/qemu/qemu_capspriv.h | 17 +- src/qemu/qemu_conf.h | 3 +- src/qemu/qemu_domain.c | 17 +- src/qemu/qemu_driver.c | 10 +- src/qemu/qemu_process.c | 9 +- src/util/virfilecache.c | 439 +++++++++++++++++++++ src/util/virfilecache.h | 137 +++++++ tests/Makefile.am | 12 + tests/domaincapstest.c | 55 +-- tests/qemucapsprobe.c | 3 +- tests/qemucpumock.c | 14 +- tests/qemuxml2argvtest.c | 9 +- tests/testutilshostcpus.h | 148 +++++++ tests/testutilsqemu.c | 107 +---- tests/testutilsqemu.h | 3 +- tests/testutilsxen.c | 29 +- ...a15b1658aa16923e46497dd8deeb6be287ddb0ca0.cache | 1 + ...ae4bc3a28e75bc3e262757001e8b953580f5e75ef.cache | 1 + tests/virfilecachemock.c | 31 ++ tests/virfilecachetest.c | 238 +++++++++++ 25 files changed, 1200 insertions(+), 486 deletions(-) create mode 100644 src/util/virfilecache.c create mode 100644 src/util/virfilecache.h create mode 100644 tests/testutilshostcpus.h create mode 100644 tests/virfilecachedata/5f3154560c130108b282a2aa15b1658aa16923e46497dd8deeb6be287ddb0ca0.cache create mode 120000 tests/virfilecachedata/9ca150bf3119b75dcac8e8bae4bc3a28e75bc3e262757001e8b953580f5e75ef.cache create mode 100644 tests/virfilecachemock.c create mode 100644 tests/virfilecachetest.c -- 2.13.3

2 14