- Devel - libvirt List Archives

[libvirt] [PATCH] Fix TLS tests with gnutls 3
by Daniel P. Berrange 04 Mar '13

04 Mar '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> When given a CA cert with basic constraints to set non-critical, and key usage of 'key signing', this should be rejected. Version of GNUTLS < 3 do not rejecte it though, so we never noticed the test case was broken Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- tests/virnettlscontexttest.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c index 3df8a70..f53ea0e 100644 --- a/tests/virnettlscontexttest.c +++ b/tests/virnettlscontexttest.c @@ -873,15 +873,6 @@ mymain(void) false, false, NULL, NULL, 0, 0, }; - /* Key usage:dig-sig:not-critical */ - static struct testTLSCertReq cacert5req = { - NULL, NULL, "cacert5.pem", "UK", - "libvirt CA 5", NULL, NULL, NULL, NULL, - true, true, true, - true, false, GNUTLS_KEY_DIGITAL_SIGNATURE, - false, false, NULL, NULL, - 0, 0, - }; DO_CTX_TEST(true, cacert1req, servercertreq, false); DO_CTX_TEST(true, cacert2req, servercertreq, false); @@ -889,10 +880,18 @@ mymain(void) DO_CTX_TEST(true, cacert3req, servercertreq, false); # endif DO_CTX_TEST(true, cacert4req, servercertreq, false); - DO_CTX_TEST(true, cacert5req, servercertreq, false); /* Now some bad certs */ + /* Key usage:dig-sig:not-critical */ + static struct testTLSCertReq cacert5req = { + NULL, NULL, "cacert5.pem", "UK", + "libvirt CA 5", NULL, NULL, NULL, NULL, + true, true, true, + true, false, GNUTLS_KEY_DIGITAL_SIGNATURE, + false, false, NULL, NULL, + 0, 0, + }; /* no-basic */ static struct testTLSCertReq cacert6req = { NULL, NULL, "cacert6.pem", "UK", @@ -912,6 +911,16 @@ mymain(void) 0, 0, }; + /* Technically a CA cert with basic constraints + * key purpose == key signing + non-critical should + * be rejected. GNUTLS < 3 does not reject it and + * we don't anticipate them changing this behaviour + */ +# if GNUTLS_VERSION_MAJOR >= 3 + DO_CTX_TEST(true, cacert5req, servercertreq, true); +# else + DO_CTX_TEST(true, cacert5req, servercertreq, false); +# endif DO_CTX_TEST(true, cacert6req, servercertreq, true); DO_CTX_TEST(true, cacert7req, servercertreq, true); -- 1.8.1.2

2 2

[libvirt] [PATCH] qemu: fix wrong evaluation in qemuDomainSetMemoryParameters
by Satoru Moriya 04 Mar '13

04 Mar '13

19c6ad9a (qemu: Refactor qemuDomainSetMemoryParameters) introduced a new macro, VIR_GET_LIMIT_PARAMETER(PARAM, VALUE). But if statement in the macro is not correct and so set_XXXX flags are set to false in the wrong. As a result, libvirt ignores all memtune parameters. This patch fixes the conditional expression to work correctly. Signed-off-by: Satoru Moriya <satoru.moriya(a)hds.com> --- src/qemu/qemu_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 7048ce9..42b8c77 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7280,7 +7280,7 @@ qemuDomainSetMemoryParameters(virDomainPtr dom, } #define VIR_GET_LIMIT_PARAMETER(PARAM, VALUE) \ - if ((rc = virTypedParamsGetULLong(params, nparams, PARAM, &VALUE) < 0)) \ + if ((rc = virTypedParamsGetULLong(params, nparams, PARAM, &VALUE)) < 0) \ goto cleanup; \ \ if (rc == 1) \ -- 1.7.11.7

3 2

[libvirt] [PATCH] util: use string libvirt to prefix error message instead of libvir
by Guannan Ren 04 Mar '13

04 Mar '13

BZ:https://bugzilla.redhat.com/show_bug.cgi?id=912021 Without error handler set, virDefaultErrorFunc will be called, the error message is prefixed with "libvir:". It become a little better by using prefix "libvirt:" when working with upper application. For example: 1, stop libvirtd daemon 2, run virt-top. libvir: XML-RPC error : Failed to connect \ socket to '/var/run/libvirt/libvirt-sock-ro': \ No such file or directory libvirt: VIR_ERR_SYSTEM_ERROR: VIR_FROM_RPC: \ Failed to connect socket to '/var/run/libvirt/libvirt-sock-ro': \ No such file or directory --- src/util/virerror.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/util/virerror.c b/src/util/virerror.c index 301a1ac..40c3b25 100644 --- a/src/util/virerror.c +++ b/src/util/virerror.c @@ -525,13 +525,13 @@ virDefaultErrorFunc(virErrorPtr err) len = strlen(err->message); if ((err->domain == VIR_FROM_XML) && (err->code == VIR_ERR_XML_DETAIL) && (err->int1 != 0)) - fprintf(stderr, "libvir: %s %s %s%s: line %d: %s", + fprintf(stderr, "libvirt: %s %s %s%s: line %d: %s", dom, lvl, domain, network, err->int1, err->message); else if ((len == 0) || (err->message[len - 1] != '\n')) - fprintf(stderr, "libvir: %s %s %s%s: %s\n", + fprintf(stderr, "libvirt: %s %s %s%s: %s\n", dom, lvl, domain, network, err->message); else - fprintf(stderr, "libvir: %s %s %s%s: %s", + fprintf(stderr, "libvirt: %s %s %s%s: %s", dom, lvl, domain, network, err->message); } -- 1.7.11.2

3 3

[libvirt] libvirt does not logout of iscsi targets, causing system hang on shutdown
by Fritz Elfert 04 Mar '13

04 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi guys, There's a quite old bug entry here: https://bugzilla.redhat.com/show_bug.cgi?id=700010 I just stumbled over that very issue on F18. Doing a little bit debugging of the shutdown sequence, it turns out that - at least on my F18 installation - libvirtd is shutdown *after* iscsid, which makes it impossible for libvirt to perform the logout of the iscsi session properly. My local fix (diff) is attached. It simply adds another startup dependancy on iscsid.service which in turn delays iscsid shutdown until after libvirtd has stopped. Having that applied, the system shuts down properly again. I was asked to post that here for discussion... So please consider this trivial change for the next update. Cheers -Fritz -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlEvwhoACgkQboM4mAMyprB9agCgpIkGbSBKpfB4e0q6aqSMVGam rMoAnAtBpp3nFbleWLxJTbCt9EKO9Yx3 =2hHf -----END PGP SIGNATURE-----

2 3

[libvirt] [PATCH] qemu: Remove managed save flag from VM when starting with --force-boot
by Peter Krempa 04 Mar '13

04 Mar '13

At the start of the guest after the image is unlinked the state wasn't touched up to match the state on disk. --- src/qemu/qemu_driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index d40b5d5..7048ce9 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -5421,20 +5421,21 @@ qemuDomainObjStart(virConnectPtr conn, goto cleanup; if (virFileExists(managed_save)) { if (force_boot) { if (unlink(managed_save) < 0) { virReportSystemError(errno, _("cannot remove managed save file %s"), managed_save); goto cleanup; } + vm->hasManagedSave = false; } else { ret = qemuDomainObjRestore(conn, driver, vm, managed_save, start_paused, bypass_cache); if (ret == 0) { if (unlink(managed_save) < 0) VIR_WARN("Failed to remove the managed state %s", managed_save); else vm->hasManagedSave = false; } -- 1.8.1.1

2 3

[libvirt] libvirt-1.0.2 qith lxc and /proc/meminfo
by Thierry Parmentelat 04 Mar '13

04 Mar '13

Hello there I'm using libvirt-1.0.2 to spawn off linux containers We currently have 2 very similar setups that run on fedora 16 and f18 respectively And I'm seeing one weird difference concerning /proc/meminfo While everything is fine on the fedora16 world, on the fedora18 side here is what the container sees bash-4.2# ls /proc ls: cannot access /proc/meminfo: Permission denied 1 257 bus devices fb irq kpagecount mdstat net schedstat swaps tty 10 377 cgroups diskstats filesystems kallsyms kpageflags meminfo pagetypeinfo scsi sys uptime 15 522 cmdline dma fs kcore latency_stats misc partitions self sysrq-trigger version 16 542 consoles dri interrupts key-users loadavg modules pidsu slabinfo sysvipc vmallocinfo 18 acpi cpuinfo driver iomem keys locks mounts procprotect softirqs timer_list vmstat 19 buddyinfo crypto execdomains ioports kmsg lxcsu mtrr sched_debug stat timer_stats zoneinfo bash-4.2# ls -l /proc | grep meminfo ls: cannot access /proc/meminfo: Permission denied -????????? ? ? ? ? ? meminfo bash-4.2# cat /proc/meminfo cat: /proc/meminfo: Permission denied ===== we rebuild libvirt-1.0.2 more or less as is modulo a few features that are turned off, our specfile can be found here http://git.onelab.eu/?p=libvirt.git;a=blob;f=libvirt.spec the most obvious difference between both builds lies in using fuse: --- # fuse is used to provide virtualized /proc for LXC %if 0%{?fedora} >= 17 || 0%{?rhel} >= 7 %define with_fuse 0%{!?_without_fuse:1} %endif --- I was wondering what exactly should be the requirements on the root context for running this properly In particular the fuse rpm was not pulled as part of the libvirt dependencies, which might be an omission ? Can I expect my problem to go away if I make sure fuse gets installed ? Otherwise where should I try to look to solve this issue ? many thanks in advance -- Thierry

2 1

[libvirt] [PATCH] Fix error report from nl_recvmsg
by Daniel P. Berrange 04 Mar '13

04 Mar '13

From: "Daniel P. Berrange" <berrange(a)redhat.com> The nl_recvmsg does not always set errno. Instead it returns its own custom set of error codes. Thus we were reporting the wrong data. --- src/util/virnetlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/util/virnetlink.c b/src/util/virnetlink.c index 0b36fdc..8b47ede 100644 --- a/src/util/virnetlink.c +++ b/src/util/virnetlink.c @@ -335,8 +335,9 @@ virNetlinkEventCallback(int watch, if (length == 0) return; if (length < 0) { - virReportSystemError(errno, - "%s", _("nl_recv returned with error")); + virReportError(VIR_ERR_INTERNAL_ERROR, + _("nl_recv returned with error: %s"), + nl_geterror(length)); return; } -- 1.7.11.7

5 13

Re: [libvirt] [Qemu-devel] [Qemu PATCH v2] add a boot option to do strict boot
by Eric Blake 04 Mar '13

04 Mar '13

On 01/09/2013 01:39 AM, Amos Kong wrote: > Current seabios will try to boot from selected devices first, > if they are all failed, seabios will also try to boot from > un-selected devices. > > We need to make it configurable. I already posted a seabios > patch to add a new device type to halt booting. Qemu can add > "HALT" at the end of bootindex string, then seabios will halt > booting after trying to boot from selected devices. > > This option only effects when boot priority is changed by > bootindex options, the old style(-boot order=..) will still > try to boot from un-selected devices. > > v2: add HALT entry in get_boot_devices_list() > define boot_strict to bool > > Signed-off-by: Amos Kong <akong(a)redhat.com> > --- Libvirt will need to expose an attribute that lets the user control whether to use this new option; how do we probe via QMP whether the new -boot strict=on command-line option is available? > +++ b/qemu-options.hx > @@ -376,14 +376,14 @@ ETEXI > > DEF("boot", HAS_ARG, QEMU_OPTION_boot, > "-boot [order=drives][,once=drives][,menu=on|off]\n" > - " [,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time]\n" > + " [,splash=sp_name][,splash-time=sp_time][,reboot-timeout=rb_time][,strict=on|off]\n" > " 'drives': floppy (a), hard disk (c), CD-ROM (d), network (n)\n" > " 'sp_name': the file's name that would be passed to bios as logo picture, if menu=on\n" > " 'sp_time': the period that splash picture last if menu=on, unit is ms\n" > " 'rb_timeout': the timeout before guest reboot when boot failed, unit is ms\n", So if I understand correctly, -boot order=... is incompatible with -boot strict=on; even though you have listed both options under a single -boot entry in the -help. We've already declared that -help output is no longer guaranteed stable, so this doesn't really impact libvirt, but would it make any more sense to list this as two orthogonal entries, to make it clear that they don't mix? -boot order=drivers[,once=drives]... -boot strict=on|off[,menu=on|off]... But this is all bikeshedding, so it's not worth a v3 if you disagree. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

9 16

[libvirt] Entering freeze for libvirt-1.0.3
by Daniel Veillard 04 Mar '13

04 Mar '13

I have just tagged git and pushed the tarball. The rpms for F17 are following too at the usual place: ftp://libvirt.org/libvirt/ I gave a try to the set of rpms and this seems to work fine for relatively simple tests, but of course more testing and checking on other architectures is needed ! If everything goes fine, I will make an rc2 in a couple of days and then we can decide if a final release on Friday is fine or if we need to postpone to next week, Daniel -- Daniel Veillard | Open Source and Standards, Red Hat veillard(a)redhat.com | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | virtualization library http://libvirt.org/

11 25

[libvirt] TEST
by Han Cheng 04 Mar '13

04 Mar '13

Sorry, just a test.

1 0