- Devel - libvirt List Archives

[libvirt] [PATCH] configure: make --with-test-suite work
by Martin Kletzander 18 Dec '13

18 Dec '13

Our option '--with-test-suite' could have never worked since it was defined as AC_ARG_ENABLE([with-test-suite], ...), thus working only as '--enable-with-test-suite', but documented in configure.ac as AC_HELP_STRING([--with-test-suite], ...). In my optinion, the help string is as it should be, but the option is wrong. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- configure.ac | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/configure.ac b/configure.ac index 5446634..2ebb941 100644 --- a/configure.ac +++ b/configure.ac @@ -2035,14 +2035,14 @@ dnl Allow perl/python overrides AC_PATH_PROGS([PYTHON], [python2 python]) AC_PATH_PROG([PERL], [perl]) -AC_ARG_ENABLE([with-test-suite], - [AS_HELP_STRING([--with-test-suite], - [build test suite by default @<:@default=check@:>@])], - [case "${withval}" in - yes|no|check) ;; - *) AC_MSG_ERROR([bad value ${withval} for tests option]) ;; - esac], - [withval=check]) +AC_ARG_WITH([test-suite], + [AS_HELP_STRING([--with-test-suite], + [build test suite by default @<:@default=check@:>@])], + [case "${withval}" in + yes|no|check) ;; + *) AC_MSG_ERROR([bad value ${withval} for tests option]) ;; + esac], + [withval=check]) AC_MSG_CHECKING([Whether to build test suite by default]) if test "$withval" = "check" ; then -- 1.8.5.1

2 2

[libvirt] [PATCH] lxc: simplify command when connecting lxc multi console
by Chen Hanxiao 18 Dec '13

18 Dec '13

From: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> If we config more than one consoles for container, we always named them as "consoleN". We had to type a complex option "--devname consoleN". This patch enables option "--devname N" to be equal to "--devname consoleN". Signed-off-by: Chen Hanxiao <chenhanxiao(a)cn.fujitsu.com> --- src/lxc/lxc_driver.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 61a90ca..13213a5 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -2439,6 +2439,7 @@ lxcDomainOpenConsole(virDomainPtr dom, int ret = -1; virDomainChrDefPtr chr = NULL; size_t i; + char *tmp_name = NULL; virCheckFlags(0, -1); @@ -2455,9 +2456,17 @@ lxcDomainOpenConsole(virDomainPtr dom, } if (dev_name) { + if (STRPREFIX(dev_name, "console")) { + if (VIR_STRDUP(tmp_name, dev_name) < 0) + goto cleanup; + } else { + if (virAsprintf(&tmp_name, "console%s", dev_name) < 0) + goto cleanup; + } + for (i = 0; i < vm->def->nconsoles; i++) { if (vm->def->consoles[i]->info.alias && - STREQ(vm->def->consoles[i]->info.alias, dev_name)) { + STREQ(vm->def->consoles[i]->info.alias, tmp_name)) { chr = vm->def->consoles[i]; break; } @@ -2490,6 +2499,7 @@ lxcDomainOpenConsole(virDomainPtr dom, cleanup: if (vm) virObjectUnlock(vm); + VIR_FREE(tmp_name); return ret; } -- 1.8.2.1

3 4

[libvirt] [PATCH] libxl: libxl_get_max_cpus returning a libxl error from 4.4 onward
by Dario Faggioli 18 Dec '13

18 Dec '13

Starting from commit 2e82c18c in Xen (will be included in Xen 4.4) libxl_get_max_cpus() start returning a proper libxl error code, in case of failure. It returning 0 is now basically impossible but, theoretically, still wrong, not to mention that using '<= 0' makes this correct for both Xen 4.4 and Xen 4.3 (and 4.2). That's why we go for it (rather than just '< 0'). Signed-off-by: Dario Faggioli <dario.faggioli(a)citrix.com> Cc: Jim Fehlig <jfehlig(a)suse.com> Cc: Ian Jackson <Ian.Jackson(a)eu.citrix.com> --- src/libxl/libxl_driver.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index 692c3b7..a31b094 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -1101,9 +1101,11 @@ libxlConnectGetMaxVcpus(virConnectPtr conn, const char *type ATTRIBUTE_UNUSED) cfg = libxlDriverConfigGet(driver); ret = libxl_get_max_cpus(cfg->ctx); - /* libxl_get_max_cpus() will return 0 if there were any failures, - e.g. xc_physinfo() failing */ - if (ret == 0) + /* On failure, libxl_get_max_cpus() will return ERROR_FAIL from Xen 4.4 + * onward, but it ever returning 0 is obviously wrong too (and it is + * what happens, on failure, on Xen 4.3 and earlier). Therefore, a 'less + * or equal' is the catchall we want. */ + if (ret <= 0) ret = -1; virObjectUnref(cfg);

2 2

[libvirt] [PATCH] qemu: fix typo PCi => PCI
by Martin Kletzander 18 Dec '13

18 Dec '13

Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/qemu/qemu_process.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index bd9546e..d0fde54 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -3829,7 +3829,7 @@ int qemuProcessStart(virConnectPtr conn, * Normally PCI addresses are assigned in the virDomainCreate * or virDomainDefine methods. We might still need to assign * some here to cope with the question of upgrades. Regardless - * we also need to populate the PCi address set cache for later + * we also need to populate the PCI address set cache for later * use in hotplug */ if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE)) { @@ -4560,7 +4560,7 @@ int qemuProcessAttach(virConnectPtr conn ATTRIBUTE_UNUSED, * Normally PCI addresses are assigned in the virDomainCreate * or virDomainDefine methods. We might still need to assign * some here to cope with the question of upgrades. Regardless - * we also need to populate the PCi address set cache for later + * we also need to populate the PCI address set cache for later * use in hotplug */ if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE)) { -- 1.8.5.1

4 4

[libvirt] [PATCH] qemu: add support for error messages greater than 1024 characters
by Michele Paolino 18 Dec '13

18 Dec '13

In libvirt, the default error message length is 1024 bytes. This is not enough for qemu to print long error messages such as the list of supported ARM machine models (more than 1700 chars). This is raised when the machine entry in the XML file is wrong, but there may be now or in future other verbose error messages. The above patch enables libvirt to print error messages >1024 for qemu. Signed-off-by: Michele Paolino <m.paolino(a)virtualopensystems.com> --- src/qemu/qemu_process.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index bd9546e..c2e2136 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -1904,10 +1904,25 @@ cleanup: * a possible read of the fd in the monitor code doesn't influence this * error delivery option */ ignore_value(lseek(logfd, pos, SEEK_SET)); - qemuProcessReadLog(logfd, buf + len, buf_size - len - 1, 0, true); - virReportError(VIR_ERR_INTERNAL_ERROR, - _("process exited while connecting to monitor: %s"), - buf); + len = qemuProcessReadLog(logfd, buf + len, buf_size - len - 1, 0, true); + + /* virReportError error buffer is limited to 1024 byte*/ + if (len < 1024){ + virReportError(VIR_ERR_INTERNAL_ERROR, + _("process exited while connecting to monitor: %s"), + buf); + } else { + if (STRPREFIX(buf, "Supported machines are:")) + virReportError(VIR_ERR_INTERNAL_ERROR, + _("process exited while connecting to monitor:" + "please check machine model")); + else + virReportError(VIR_ERR_INTERNAL_ERROR, + _("process exited while connecting to monitor")); + + VIR_ERROR("%s", buf); + } + ret = -1; } -- 1.7.9.5

5 9

[libvirt] [PATCH] tests: be more explicit on qcow2 versions in virstoragetest
by Eric Blake 18 Dec '13

18 Dec '13

While working on v1.0.5-maint (the branch in use on Fedora 19) with the host at Fedora 20, I got a failure in virstoragetest. I traced it to the fact that we were using qemu-img to create a qcow2 file, but qemu-img changed from creating v2 files by default in F19 to creating v3 files in F20. Rather than leaving it up to qemu-img, it is better to write the test to force testing of BOTH file formats (better code coverage and all). This patch alone does not fix all the failures in v1.0.5-maint; for that, we must decide to either teach the older branch to understand v3 files, or to reject them outright as unsupported. But for upstream, making the test less dependent on changing qemu-img defaults is always a good thing. * tests/virstoragetest.c (testPrepImages): Simplify creation of raw file; check if qemu supports compat and if so use it. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- tests/virstoragetest.c | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/tests/virstoragetest.c b/tests/virstoragetest.c index e5c73f5..db0cf1c 100644 --- a/tests/virstoragetest.c +++ b/tests/virstoragetest.c @@ -87,6 +87,8 @@ testPrepImages(void) { int ret = EXIT_FAILURE; virCommandPtr cmd = NULL; + char *buf = NULL; + bool compat = false; qemuimg = virFindFileInPath("kvm-img"); if (!qemuimg) @@ -94,6 +96,18 @@ testPrepImages(void) if (!qemuimg) goto skip; + /* See if qemu-img supports '-o compat=xxx'. If so, we force the + * use of both v2 and v3 files; if not, it is v2 only but the test + * still works. */ + cmd = virCommandNewArgList(qemuimg, "create", "-f", "qcow2", + "-o?", "/dev/null", NULL); + virCommandSetOutputBuffer(cmd, &buf); + if (virCommandRun(cmd, NULL) < 0) + goto skip; + if (strstr(buf, "compat ")) + compat = true; + VIR_FREE(buf); + if (virAsprintf(&absraw, "%s/raw", datadir) < 0 || virAsprintf(&absqcow2, "%s/qcow2", datadir) < 0 || virAsprintf(&abswrap, "%s/wrap", datadir) < 0 || @@ -111,10 +125,8 @@ testPrepImages(void) goto cleanup; } - /* I'm lazy enough to use a shell one-liner instead of open/write/close */ - virCommandFree(cmd); - cmd = virCommandNewArgList("sh", "-c", "printf %1024d 0 > raw", NULL); - if (virCommandRun(cmd, NULL) < 0) { + if (virAsprintf(&buf, "%1024d", 0) < 0 || + virFileWriteStr("raw", buf, 0600) < 0) { fprintf(stderr, "unable to create raw file\n"); goto cleanup; } @@ -126,9 +138,10 @@ testPrepImages(void) /* Create a qcow2 wrapping relative raw; later on, we modify its * metadata to test other configurations */ virCommandFree(cmd); - cmd = virCommandNewArgList(qemuimg, "create", "-f", "qcow2", - "-obacking_file=raw,backing_fmt=raw", "qcow2", - NULL); + cmd = virCommandNewArgList(qemuimg, "create", "-f", "qcow2", NULL); + virCommandAddArgFormat(cmd, "-obacking_file=raw,backing_fmt=raw%s", + compat ? ",compat=0.10" : ""); + virCommandAddArg(cmd, "qcow2"); if (virCommandRun(cmd, NULL) < 0) goto skip; /* Make sure our later uses of 'qemu-img rebase' will work */ @@ -146,8 +159,8 @@ testPrepImages(void) * can correctly avoid insecure probing. */ virCommandFree(cmd); cmd = virCommandNewArgList(qemuimg, "create", "-f", "qcow2", NULL); - virCommandAddArgFormat(cmd, "-obacking_file=%s,backing_fmt=qcow2", - absqcow2); + virCommandAddArgFormat(cmd, "-obacking_file=%s,backing_fmt=qcow2%s", + absqcow2, compat ? ",compat=1.1" : ""); virCommandAddArg(cmd, "wrap"); if (virCommandRun(cmd, NULL) < 0) goto skip; @@ -172,6 +185,7 @@ testPrepImages(void) ret = 0; cleanup: + VIR_FREE(buf); virCommandFree(cmd); if (ret) testCleanupImages(); -- 1.8.4.2

1 0

[libvirt] [PATCH] Fix build when default python is python3
by Lénaïc Huard 17 Dec '13

17 Dec '13

As the python generator scripts are written in python2, the ./configure script must check for python2 before checking for python otherwise, on platforms where both python2 and python3 are available and on which the default python points to python3, ./configure will try to use the wrong one. Signed-off-by: Lénaïc Huard <lenaic(a)lhuard.fr.eu.org> --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 10ce184..5446634 100644 --- a/configure.ac +++ b/configure.ac @@ -2032,7 +2032,7 @@ AM_CONDITIONAL([WITH_HYPERV], [test "$with_hyperv" = "yes"]) dnl Allow perl/python overrides -AC_PATH_PROG([PYTHON], [python]) +AC_PATH_PROGS([PYTHON], [python2 python]) AC_PATH_PROG([PERL], [perl]) AC_ARG_ENABLE([with-test-suite], -- 1.8.5.1

3 3

[libvirt] [PATCHV2] qemu: ask for -enable-fips when FIPS is required
by Eric Blake 17 Dec '13

17 Dec '13

On a system that is enforcing FIPS, most libraries honor the current mode by default. Qemu, on the other hand, refused to honor FIPS mode unless you add the '-enable-fips' command line option; worse, this option is not discoverable via QMP, and is only present on binaries built for Linux. So, if we detect FIPS mode, then we unconditionally ask for FIPS; either qemu is new enough to have the option and then correctly cripple insecure VNC passwords, or it is so old that we are correctly avoiding a FIPS violation by preventing qemu from starting. Meanwhile, if we don't detect FIPS mode, then omitting the argument is safe whether the qemu has the option (but it would do nothing because FIPS is disabled) or whether qemu lacks the option (including in the case where we are not running on Linux). The testsuite was a bit interesting: we don't want our test to depend on whether it is being run in FIPS mode, so I had to tweak things to set the capability bit outside of our normal interaction with capability parsing. This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1035474 * src/qemu/qemu_capabilities.h (QEMU_CAPS_ENABLE_FIPS): New bit. * src/qemu/qemu_capabilities.c (virQEMUCapsInitQMP): Conditionally set capability according to detection of FIPS mode. * src/qemu/qemu_command.c (qemuBuildCommandLine): Use it. * tests/qemucapabilitiestest.c (testQemuCaps): Conditionally set capability to test expected output. * tests/qemucapabilitiesdata/caps_1.2.2-1.caps: Update list. * tests/qemucapabilitiesdata/caps_1.6.0-1.caps: Likewise. Signed-off-by: Eric Blake <eblake(a)redhat.com> --- src/qemu/qemu_capabilities.c | 28 +++++++++++++++++++++++++++- src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 2 ++ tests/qemucapabilitiesdata/caps_1.2.2-1.caps | 1 + tests/qemucapabilitiesdata/caps_1.6.0-1.caps | 1 + tests/qemucapabilitiestest.c | 20 +++++++++++++++----- 6 files changed, 47 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index 5e9c65e..9470814 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -245,7 +245,8 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST, "kvm-pit-lost-tick-policy", "boot-strict", /* 160 */ - "pvpanic", /* 161 */ + "pvpanic", + "enable-fips", ); struct _virQEMUCaps { @@ -2630,6 +2631,31 @@ virQEMUCapsInitQMP(virQEMUCapsPtr qemuCaps, config.data.nix.path = monpath; config.data.nix.listen = false; + /* Qemu 1.2 and later have a binary flag -enable-fips that must be + * used for VNC auth to obey FIPS settings; but the flag only + * exists on Linux, and with no way to probe for it via QMP. Our + * solution: if FIPS mode is required, then unconditionally use + * the flag, regardless of qemu version, for the following matrix: + * + * old QEMU new QEMU + * FIPS enabled doesn't start VNC auth disabled + * FIPS disabled/missing VNC auth enabled VNC auth enabled + * + * Setting the flag here instead of in virQEMUCapsInitQMPMonitor + * or virQEMUCapsInitHelp also allows the testsuite to be + * independent of FIPS setting. + */ + if (virFileExists("/proc/sys/crypto/fips_enabled")) { + char buf[sizeof("1\n")]; + char *ptr = buf; + + if (virFileReadAll("/proc/sys/crypto/fips_enabled", + sizeof(buf), &ptr) < 0) + goto cleanup; + if (*buf == '1') + virQEMUCapsSet(qemuCaps, QEMU_CAPS_ENABLE_FIPS); + } + VIR_DEBUG("Try to get caps via QMP qemuCaps=%p", qemuCaps); /* diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index bbf4972..efb3f43 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -200,6 +200,7 @@ enum virQEMUCapsFlags { QEMU_CAPS_KVM_PIT_TICK_POLICY = 159, /* kvm-pit.lost_tick_policy */ QEMU_CAPS_BOOT_STRICT = 160, /* -boot strict */ QEMU_CAPS_DEVICE_PANIC = 161, /* -device pvpanic */ + QEMU_CAPS_ENABLE_FIPS = 162, /* -enable-fips */ QEMU_CAPS_LAST, /* this must always be the last item */ }; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index a80559e..d723dc8 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -7747,6 +7747,8 @@ qemuBuildCommandLine(virConnectPtr conn, } } virCommandAddArg(cmd, "-S"); /* freeze CPU */ + if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_ENABLE_FIPS)) + virCommandAddArg(cmd, "-enable-fips"); if (qemuBuildMachineArgStr(cmd, def, qemuCaps) < 0) goto error; diff --git a/tests/qemucapabilitiesdata/caps_1.2.2-1.caps b/tests/qemucapabilitiesdata/caps_1.2.2-1.caps index 73a561d..c3ae814 100644 --- a/tests/qemucapabilitiesdata/caps_1.2.2-1.caps +++ b/tests/qemucapabilitiesdata/caps_1.2.2-1.caps @@ -112,4 +112,5 @@ <flag name='usb-storage'/> <flag name='usb-storage.removable'/> <flag name='kvm-pit-lost-tick-policy'/> + <flag name='enable-fips'/> </qemuCaps> diff --git a/tests/qemucapabilitiesdata/caps_1.6.0-1.caps b/tests/qemucapabilitiesdata/caps_1.6.0-1.caps index c7ce591..2d50cf9 100644 --- a/tests/qemucapabilitiesdata/caps_1.6.0-1.caps +++ b/tests/qemucapabilitiesdata/caps_1.6.0-1.caps @@ -138,4 +138,5 @@ <flag name='boot-strict'/> <flag name='pvpanic'/> <flag name='reboot-timeout'/> + <flag name='enable-fips'/> </qemuCaps> diff --git a/tests/qemucapabilitiestest.c b/tests/qemucapabilitiestest.c index d912171..3b34f78 100644 --- a/tests/qemucapabilitiestest.c +++ b/tests/qemucapabilitiestest.c @@ -31,6 +31,7 @@ typedef testQemuData *testQemuDataPtr; struct _testQemuData { virDomainXMLOptionPtr xmlopt; const char *base; + bool fips; }; static qemuMonitorTestPtr @@ -192,6 +193,12 @@ testQemuCaps(const void *opaque) qemuMonitorTestGetMonitor(mon)) < 0) goto cleanup; + /* So that our test does not depend on the contents of /proc, we + * hoisted the setting of ENABLE_FIPS to virQEMUCapsInitQMP. But + * we do want to test the effect of that flag. */ + if (data->fips) + virQEMUCapsSet(capsComputed, QEMU_CAPS_ENABLE_FIPS); + if (testQemuCapsCompare(capsProvided, capsComputed) < 0) goto cleanup; @@ -227,16 +234,19 @@ mymain(void) data.xmlopt = xmlopt; -#define DO_TEST(name) \ - data.base = name; \ - if (virtTestRun(name, testQemuCaps, &data) < 0) \ +#define DO_TEST_FULL(name, use_fips) \ + data.base = name; \ + data.fips = use_fips; \ + if (virtTestRun(name, testQemuCaps, &data) < 0) \ ret = -1 - DO_TEST("caps_1.2.2-1"); +#define DO_TEST(name) DO_TEST_FULL(name, false) + + DO_TEST_FULL("caps_1.2.2-1", true); DO_TEST("caps_1.3.1-1"); DO_TEST("caps_1.4.2-1"); DO_TEST("caps_1.5.3-1"); - DO_TEST("caps_1.6.0-1"); + DO_TEST_FULL("caps_1.6.0-1", true); DO_TEST("caps_1.6.50-1"); virObjectUnref(xmlopt); -- 1.8.4.2

2 2

[libvirt] [PATCHv2.5] specfile: fix make rpm when with_driver_modules is 1
by Laine Stump 17 Dec '13

17 Dec '13

Commit ff76566 moved around things in the specfiles to put driver-specific files into their appropriate sub-packages (when with_driver_modules == 1), but accidentally changed things so that the deamon-driver-network and daemon-config-network files were only included in a package when with_driver_modules == 0. This broke "make rpm" on fedora (where with_driver_modules == 1). This patch follows the pattern (already used for the files in other sub-modules) of duplicating the files for the main package (!with_driver_modules) and the sub-package (with_driver_modules). --- Changes from V1: realized that %{_datadir} is /usr/share, so %{_datadir}/libvirt/networks/default.xml should be installed as a part of daemon-driver-network (or the main package, if not building with driver modules). libvirt.spec.in | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 849ec80..015e627 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1894,11 +1894,6 @@ exit 0 %endif %endif # ! %{with_driver_modules} - %if %{with_network} -%files daemon-config-network -%defattr(-, root, root) - %endif - %if %{with_nwfilter} %files daemon-config-nwfilter %defattr(-, root, root) @@ -1915,6 +1910,14 @@ exit 0 %if %{with_network} %files daemon-driver-network %defattr(-, root, root) +%dir %attr(0700, root, root) %{_sysconfdir}/libvirt/qemu/ +%dir %attr(0700, root, root) %{_sysconfdir}/libvirt/qemu/networks/ +%dir %attr(0700, root, root) %{_sysconfdir}/libvirt/qemu/networks/autostart +%dir %{_datadir}/libvirt/networks/ +%{_datadir}/libvirt/networks/default.xml +%ghost %dir %{_localstatedir}/run/libvirt/network/ +%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/network/ +%dir %attr(0755, root, root) %{_localstatedir}/lib/libvirt/dnsmasq/ %{_libdir}/%{name}/connection-driver/libvirt_driver_network.so %endif -- 1.8.3.1

3 4

[libvirt] hindsight on qcow2v3 format
by Eric Blake 17 Dec '13

17 Dec '13

I spent a couple hours today debugging a bug in an older branch of libvirt (0.10.2) - one where libvirt only knew how to parse version 2 qcow2 images. Alas, that version of libvirt can be coerced into reading the header of a random file under the assumption that it is qcow2 data, and where it tries to find the backing format information in the header extensions without first validating that the file format actually matches qcow2 (that is, it looks for header extensions starting at offset 72 without first checking the version field (bytes 4-7) contains 2). So far, we've been lucky: since libvirt is trying to parse 72-75 as a version 2 extension header magic number, and the number is stored in big endian format, we end up reading the first 4 bytes of the version 3 incompatible_features field, which so far are always 0 (we don't have that many incompatible features yet), and that happens to be the magic number for end of extension headers; and thus libvirt quit trying to look for any further extension headers. Furthermore, since libvirt already refuses to probe backing file format unless explicitly allowed by user action (since mis-probing a raw file is CVE-worthy if done automatically), the damage stopped there, and the worst I could do (without intentionally bypassing the CVE safety valve) was fail a test in the libvirt testsuite when using version 3 files. But it DOES mean that libvirt fails to find the backing header format extension of a v3 file, even when one is present, because libvirt fails to start looking at the right offset. But it does raise a question: What happens if we eventually DO reach bit 32, so that bytes 72-75 is no longer all 0s and therefore no longer the end-of-extension marker? It might be possible to write a file that has one interpretation as a valid qcow2v3, while having a different interpretation by the older libvirt, such that libvirt tries to treat a backing file as an incorrect format if it is probing. Is it worth tweaking docs/specs/qcow2.txt to permanently change the incompatible_features field to be 4 bytes (76-79) and mandate that bytes 72-75 always be 0, as a conservative way to prevent other misbehavior of programs like libvirt 0.10.2 that have code paths that don't correctly validate for version 2 files? And if we ever really did hit a situation of having 31 or more incompatible features, I could envision using bit 31 as an incompatible_feature witness that tells new enough qemu to look at some other offset for remaining feature bits (thankfully, the semantics of the incompatible_feature field mean that older qemu that honors version 3 formats will reject a file with incompatible_feature bit 31 set), so this is no real loss in the number of potential incompatible features being added. If we had a time machine, I would suggest that we change 72-75 to have constant contents as a new magic number, and 76-79 encode the length of the remaining header, and delay the location of incompatible_features into the remaining header; such that this situation of libvirt looking for extensions would still find known could have still found the backing file format extension header. But that ship has sailed - all we can do now is decide to encode 72-75 as permanent 0s. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

2 1