- Devel - libvirt List Archives

[libvirt] [PATCH] conf: Plug memory leaks on virDomainDiskDefParseXML
by Alex Jia 05 Apr '12

05 Apr '12

Detected by valgrind. Leaks are introduced in commit b22eaa7. * src/conf/domain_conf.c (virDomainDiskDefParseXML): fix memory leaks. How to reproduce? % make && make -C tests check TESTS=qemuxml2argvtest % cd tests && valgrind -v --leak-check=full ./qemuxml2argvtest actual result: ==2143== 12 bytes in 2 blocks are definitely lost in loss record 74 of 179 ==2143== at 0x4A05FDE: malloc (vg_replace_malloc.c:236) ==2143== by 0x39D90A67DD: xmlStrndup (xmlstring.c:45) ==2143== by 0x4F5EC0: virDomainDiskDefParseXML (domain_conf.c:3438) ==2143== by 0x502F00: virDomainDefParseXML (domain_conf.c:8304) ==2143== by 0x505FE3: virDomainDefParseNode (domain_conf.c:9080) ==2143== by 0x5069AE: virDomainDefParse (domain_conf.c:9030) ==2143== by 0x41CBF4: testCompareXMLToArgvHelper (qemuxml2argvtest.c:105) ==2143== by 0x41E5DD: virtTestRun (testutils.c:145) ==2143== by 0x416FA3: mymain (qemuxml2argvtest.c:399) ==2143== by 0x41DCB7: virtTestMain (testutils.c:700) ==2143== by 0x39CF01ECDC: (below main) (libc-start.c:226) Signed-off-by: Alex Jia <ajia(a)redhat.com> --- src/conf/domain_conf.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index cca757d..c6b97e1 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -3893,6 +3893,7 @@ cleanup: VIR_FREE(rawio); VIR_FREE(target); VIR_FREE(source); + VIR_FREE(tray); while (nhosts > 0) { virDomainDiskHostDefFree(&hosts[nhosts - 1]); nhosts--; -- 1.7.1

2 2

[libvirt] Experience with Libvirt JAVA API
by Yaniv Hadad 05 Apr '12

05 Apr '12

Hi All, I look for someone who have experience with the Java API. My aim is to investigate hyper visors and their guest details like : os, network , ran,vCPU and more... Can some one have experience with that ?? Yaniv. (Embedded image moved to file: pic59134.jpg) Yaniv Hadad , (Embedded image moved to file: pic50897.jpg)+972 4 8296594 (Embedded image moved to file: pic56120.jpg)+972 50-40-78-908

2 1

[libvirt] [PATCH] test: fix segfault in networkxml2argvtest
by Laine Stump 05 Apr '12

05 Apr '12

This bug resolves https://bugzilla.redhat.com/show_bug.cgi?id=810100 rpm builds for i686 were failing with a segfault in networkxml2argvtest. Running under valgrind showed that a region of memory was being referenced after it had been freed (as the result of realloc - see the valgrind report in the BZ). The problem (in replaceTokens() - added in commit 22ec60, meaning this bug was in 0.9.10 and 0.9.11) was that the pointers token_start and token_end were being computed based on the value of *buf, then *buf was being realloc'ed (potentially moving it), then token_start and token_end were used without recomputing them to account for movement of *buf. The solution is to change the code so that token_start and token_end are offsets into *buf rather than pointers. This way there is only a single pointer to the buffer, and nothing needs readjusting after a realloc. (You may note that some uses of token_start/token_end didn't need to be changed to add in "*buf +" - that's because there ended up being a +*buf and -*buf which canceled each other out). DV gets the credit for finding this bug and pointing out the valgrind report. --- tests/networkxml2argvtest.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) diff --git a/tests/networkxml2argvtest.c b/tests/networkxml2argvtest.c index cf00181..87519e4 100644 --- a/tests/networkxml2argvtest.c +++ b/tests/networkxml2argvtest.c @@ -18,18 +18,19 @@ /* Replace all occurrences of @token in @buf by @replacement and adjust size of * @buf accordingly. Returns 0 on success and -1 on out-of-memory errors. */ static int replaceTokens(char **buf, const char *token, const char *replacement) { - char *token_start, *token_end; + size_t token_start, token_end; size_t buf_len, rest_len; const size_t token_len = strlen(token); const size_t replacement_len = strlen(replacement); const int diff = replacement_len - token_len; buf_len = rest_len = strlen(*buf) + 1; - token_end = *buf; + token_end = 0; for (;;) { - token_start = strstr(token_end, token); - if (token_start == NULL) + char *match = strstr(*buf + token_end, token); + if (match == NULL) break; + token_start = match - *buf; rest_len -= token_start + token_len - token_end; token_end = token_start + token_len; buf_len += diff; @@ -37,8 +38,8 @@ static int replaceTokens(char **buf, const char *token, const char *replacement) if (VIR_REALLOC_N(*buf, buf_len) < 0) return -1; if (diff != 0) - memmove(token_end + diff, token_end, rest_len); - memcpy(token_start, replacement, replacement_len); + memmove(*buf + token_end + diff, *buf + token_end, rest_len); + memcpy(*buf + token_start, replacement, replacement_len); token_end += diff; } /* if diff < 0, we could shrink the buffer here... */ -- 1.7.7.6

3 2

[libvirt] [test-API] RFC: Stabilization of libvirt-test-API
by Martin Kletzander 05 Apr '12

05 Apr '12

Hi everyone, following our minutes, I'd like to start a discussion on what should be done with libvirt-test-API so we can say it's stable and usable. I would like to stress out that everything mentioned here is just an opinion and I don't mean to talk down to someone as it may have seemed earlier. I think we should get some ideas from everyone, mostly QE as they will be (are) the ones using this the most (if I understood correctly), and then I'll be happy to help getting the code to the agreed status. I was thinking about this from the wrong way probably and changing the angle from what I look at it (and knowing there is some deadline) makes me think of few levels of changes, which when introduced, could speed up the test development and code understandability. So here are the things I would like to do definitely (the optional things follow later on): - fix hard-coded options into real options (e.g. commit 65449e) - fix some env_* and util* code (functions duplicated with different behavior) - fix or remove harmful and pointless code (at this point, when creating domain on remote machine, be prepared for the test to fail with any other user then root and with root, have backup of both local and remote '/root/.ssh' directories as the contents will be erased!) - fix method names for the {connect,domain,etc.}API (get_host_name vs. lookupByUUID etc.) The optional things: - get rid of classes in lib and make just few utility functions covering *only* the methods that do something else than call the same method in underlying class from the libvirt module. - get rid of the new exception (I don't see any other difference than in the name, which can make a difference in "except:" clause, but it's converted everywhere) - be able to share variables between tests (connection object and anything else) - introduce new config file for tests (.ini format, can be parsed by ConfigParser, same as env.cfg, define variables used throughout the test specifications - update the documentation - use some python code style (PEP-8?), make use of True/False, None - eliminate duplicated (and x-plicated) code (append_path in all the files, etc.) I have all of these figured out, so I'm willing to discuss all of them, but in most cases changing it in the current code seems very time-consumable to me. Please, feel free to comment on any of these, add yours, discuss, shout at me, etc. =) Regards, Martin P.S.: I don't see any point in sending my patches until some of these points are resolved as that could mean rewriting more code.

5 10

[libvirt] [PATCH 1/3] Move linux specific symbol to src/libvirt_linux.syms
by Daniel P. Berrange 04 Apr '12

04 Apr '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> linuxNodeInfoCPUPopulate is not built on Mingw32 so should be in libvirt_linux.syms, not libvirt_private.syms Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> --- src/libvirt_linux.syms | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/src/libvirt_linux.syms b/src/libvirt_linux.syms index 018c892..2258739 100644 --- a/src/libvirt_linux.syms +++ b/src/libvirt_linux.syms @@ -6,3 +6,6 @@ # stats_linux.h linuxDomainInterfaceStats; xenLinuxDomainBlockStats; + +# nodeinfo.h +linuxNodeInfoCPUPopulate; -- 1.7.7.6

4 9

[libvirt] [PATCH V2] nwfilter: Add support for ipset
by Stefan Berger 04 Apr '12

04 Apr '12

This patch adds support for the recent ipset iptables extension to libvirt's nwfilter subsystem. Ipset allows to maintain 'sets' of IP addresses, ports and other packet parameters and allows for faster lookup (in the order of O(1) vs. O(n)) and rule evaluation to achieve higher throughput than what can be achieved with individual iptables rules. On the command line iptables supports ipset using iptables ... -m set --match-set <ipset name> <flags> -j ... where 'ipset name' is the name of a previously created ipset and flags is a comma-separated list of up to 6 flags. Flags use 'src' and 'dst' for selecting IP addresses, ports etc. from the source or destination part of a packet. So a concrete example may look like this: iptables -A INPUT -m set --match-set test src,src -j ACCEPT Since ipset management is quite complex, the idea was to leave ipset management outside of libvirt but still allow users to reference an ipset. The user would have to make sure the ipset is available once the VM is started so that the iptables rule(s) referencing the ipset can be created. Using XML to describe an ipset in an nwfilter rule would then look as follows: <rule action='accept' direction='in'> <all ipset='test' ipsetflags='src,src'/> </rule> The two parameters on the command line are also the two distinct XML attributes 'ipset' and 'ipsetflags'. FYI: Here is the man page for ipset: https://ipset.netfilter.org/ipset.man.html Regards, Stefan --- v2: - split ipset description into ipset and ipsetflags attribute - improved on documentation --- docs/formatnwfilter.html.in | 64 ++++++++++++++ docs/schemas/nwfilter.rng | 23 +++++ src/conf/nwfilter_conf.c | 135 +++++++++++++++++++++++++++++- src/conf/nwfilter_conf.h | 12 ++ src/nwfilter/nwfilter_ebiptables_driver.c | 71 +++++++++++++++ tests/nwfilterxml2xmlin/ipset-test.xml | 15 +++ tests/nwfilterxml2xmlout/ipset-test.xml | 15 +++ tests/nwfilterxml2xmltest.c | 2 8 files changed, 332 insertions(+), 5 deletions(-) Index: libvirt/src/conf/nwfilter_conf.c =================================================================== --- libvirt.orig/src/conf/nwfilter_conf.c +++ libvirt/src/conf/nwfilter_conf.c @@ -183,6 +183,8 @@ static const char dstportstart_str[] = " static const char dstportend_str[] = "dstportend"; static const char dscp_str[] = "dscp"; static const char state_str[] = "state"; +static const char ipset_str[] = "ipset"; +static const char ipsetflags_str[] = "ipsetflags"; #define SRCMACADDR srcmacaddr_str #define SRCMACMASK srcmacmask_str @@ -206,6 +208,8 @@ static const char state_str[] = " #define DSTPORTEND dstportend_str #define DSCP dscp_str #define STATE state_str +#define IPSET ipset_str +#define IPSETFLAGS ipsetflags_str /** @@ -980,6 +984,97 @@ tcpFlagsFormatter(virBufferPtr buf, return true; } +static bool +ipsetValidator(enum attrDatatype datatype ATTRIBUTE_UNUSED, union data *val, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, + nwItemDesc *item) +{ + const char *errmsg = NULL; + + if (virStrcpy(item->u.ipset.setname, val->c, + sizeof(item->u.ipset.setname)) == NULL) { + errmsg = _("ipset name is too long"); + goto arg_err_exit; + } + + if (item->u.ipset.setname[strspn(item->u.ipset.setname, + VALID_IPSETNAME)] != 0) { + errmsg = _("ipset name contains invalid characters"); + goto arg_err_exit; + } + + return true; + +arg_err_exit: + virNWFilterReportError(VIR_ERR_INVALID_ARG, + "%s", errmsg); + return false; +} + +static bool +ipsetFormatter(virBufferPtr buf, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, + nwItemDesc *item) +{ + virBufferAdd(buf, item->u.ipset.setname, -1); + + return true; +} + +static bool +ipsetFlagsValidator(enum attrDatatype datatype ATTRIBUTE_UNUSED, union data *val, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, nwItemDesc *item) +{ + const char *errmsg = NULL; + size_t idx = 0; + + item->u.ipset.numFlags = 0; + item->u.ipset.flags = 0; + + errmsg = _("malformed ipset flags"); + + while (item->u.ipset.numFlags < 6) { + if (STRCASEEQLEN(&val->c[idx], "src", 3)) { + item->u.ipset.flags |= (1 << item->u.ipset.numFlags); + } else if (!STRCASEEQLEN(&val->c[idx], "dst", 3)) { + goto arg_err_exit; + } + item->u.ipset.numFlags++; + idx += 3; + if (val->c[idx] != ',') + break; + idx++; + } + + if (val->c[idx] != '\0') + goto arg_err_exit; + + return true; + +arg_err_exit: + virNWFilterReportError(VIR_ERR_INVALID_ARG, + "%s", errmsg); + return false; +} + +static bool +ipsetFlagsFormatter(virBufferPtr buf, + virNWFilterRuleDefPtr nwf ATTRIBUTE_UNUSED, + nwItemDesc *item) +{ + uint8_t ctr; + + for (ctr = 0; ctr < item->u.ipset.numFlags; ctr++) { + if (ctr != 0) + virBufferAddLit(buf, ","); + if ((item->u.ipset.flags & (1 << ctr))) + virBufferAddLit(buf, "src"); + else + virBufferAddLit(buf, "dst"); + } + + return true; +} #define COMMON_MAC_PROPS(STRUCT) \ {\ @@ -1411,6 +1506,20 @@ static const virXMLAttr2Struct ipv6Attri .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataState),\ .validator = stateValidator,\ .formatter = stateFormatter,\ + },\ + {\ + .name = IPSET,\ + .datatype = DATATYPE_STRING,\ + .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataIPSet),\ + .validator = ipsetValidator,\ + .formatter = ipsetFormatter,\ + },\ + {\ + .name = IPSETFLAGS,\ + .datatype = DATATYPE_IPSETFLAGS,\ + .dataIdx = offsetof(virNWFilterRuleDef, p.STRUCT.ipHdr.dataIPSetFlags),\ + .validator = ipsetFlagsValidator,\ + .formatter = ipsetFlagsFormatter,\ } #define COMMON_PORT_PROPS(STRUCT) \ @@ -1853,6 +1962,7 @@ virNWFilterRuleDetailsParse(xmlNodePtr n break; case DATATYPE_STRING: + case DATATYPE_IPSETFLAGS: if (!validator) { /* not supported */ rc = -1; @@ -1964,6 +2074,19 @@ err_exit: goto cleanup; } +static void +virNWFilterRuleDefFixupIPSet(ipHdrDataDefPtr ipHdr) +{ + if (HAS_ENTRY_ITEM(&ipHdr->dataIPSet) && + !HAS_ENTRY_ITEM(&ipHdr->dataIPSetFlags)) { + ipHdr->dataIPSetFlags.flags = NWFILTER_ENTRY_ITEM_FLAG_EXISTS; + ipHdr->dataIPSetFlags.u.ipset.numFlags = 1; + ipHdr->dataIPSetFlags.u.ipset.flags = 1; + } else { + ipHdr->dataIPSet.flags = 0; + ipHdr->dataIPSetFlags.flags = 0; + } +} static void virNWFilterRuleDefFixup(virNWFilterRuleDefPtr rule) @@ -2017,6 +2140,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.ipHdrFilter.ipHdr.dataSrcIPAddr); COPY_NEG_SIGN(rule->p.ipHdrFilter.ipHdr.dataDstIPMask, rule->p.ipHdrFilter.ipHdr.dataDstIPAddr); + virNWFilterRuleDefFixupIPSet(&rule->p.ipHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_IPV6: @@ -2024,6 +2148,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.ipv6HdrFilter.ipHdr.dataSrcIPAddr); COPY_NEG_SIGN(rule->p.ipv6HdrFilter.ipHdr.dataDstIPMask, rule->p.ipv6HdrFilter.ipHdr.dataDstIPAddr); + virNWFilterRuleDefFixupIPSet(&rule->p.ipv6HdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ARP: @@ -2047,6 +2172,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.tcpHdrFilter.portData.dataSrcPortStart); COPY_NEG_SIGN(rule->p.tcpHdrFilter.portData.dataDstPortEnd, rule->p.tcpHdrFilter.portData.dataSrcPortStart); + virNWFilterRuleDefFixupIPSet(&rule->p.tcpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_UDP: @@ -2065,6 +2191,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.udpHdrFilter.portData.dataSrcPortStart); COPY_NEG_SIGN(rule->p.udpHdrFilter.portData.dataDstPortEnd, rule->p.udpHdrFilter.portData.dataSrcPortStart); + virNWFilterRuleDefFixupIPSet(&rule->p.udpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_UDPLITE: @@ -2077,6 +2204,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.udpliteHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.udpliteHdrFilter.ipHdr.dataDstIPTo, rule->p.udpliteHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.udpliteHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ESP: @@ -2089,6 +2217,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.espHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.espHdrFilter.ipHdr.dataDstIPTo, rule->p.espHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.espHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_AH: @@ -2101,6 +2230,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.ahHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.ahHdrFilter.ipHdr.dataDstIPTo, rule->p.ahHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.ahHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_SCTP: @@ -2119,6 +2249,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.sctpHdrFilter.portData.dataSrcPortStart); COPY_NEG_SIGN(rule->p.sctpHdrFilter.portData.dataDstPortEnd, rule->p.sctpHdrFilter.portData.dataSrcPortStart); + virNWFilterRuleDefFixupIPSet(&rule->p.sctpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ICMP: @@ -2133,6 +2264,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.icmpHdrFilter.ipHdr.dataDstIPFrom); COPY_NEG_SIGN(rule->p.icmpHdrFilter.dataICMPCode, rule->p.icmpHdrFilter.dataICMPType); + virNWFilterRuleDefFixupIPSet(&rule->p.icmpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_ALL: @@ -2156,6 +2288,7 @@ virNWFilterRuleDefFixup(virNWFilterRuleD rule->p.igmpHdrFilter.ipHdr.dataSrcIPFrom); COPY_NEG_SIGN(rule->p.igmpHdrFilter.ipHdr.dataDstIPTo, rule->p.igmpHdrFilter.ipHdr.dataDstIPFrom); + virNWFilterRuleDefFixupIPSet(&rule->p.igmpHdrFilter.ipHdr); break; case VIR_NWFILTER_RULE_PROTOCOL_LAST: @@ -3120,7 +3253,7 @@ virNWFilterRuleDefDetailsFormat(virBuffe virBufferAsprintf(buf, " %s='", att[i].name); - if (att[i].formatter) { + if (att[i].formatter && !(flags & NWFILTER_ENTRY_ITEM_FLAG_HAS_VAR)) { if (!att[i].formatter(buf, def, item)) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("formatter for %s %s reported error"), Index: libvirt/src/conf/nwfilter_conf.h =================================================================== --- libvirt.orig/src/conf/nwfilter_conf.h +++ libvirt/src/conf/nwfilter_conf.h @@ -103,8 +103,9 @@ enum attrDatatype { DATATYPE_BOOLEAN = (1 << 12), DATATYPE_UINT32 = (1 << 13), DATATYPE_UINT32_HEX = (1 << 14), + DATATYPE_IPSETFLAGS = (1 << 15), - DATATYPE_LAST = (1 << 15), + DATATYPE_LAST = (1 << 16), }; # define NWFILTER_MAC_BGA "01:80:c2:00:00:00" @@ -136,9 +137,16 @@ struct _nwItemDesc { uint8_t mask; uint8_t flags; } tcpFlags; + struct { + char setname[32]; + uint8_t numFlags; + uint8_t flags; + } ipset; } u; }; +# define VALID_IPSETNAME \ + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:-+ " typedef struct _ethHdrDataDef ethHdrDataDef; typedef ethHdrDataDef *ethHdrDataDefPtr; @@ -232,6 +240,8 @@ struct _ipHdrDataDef { nwItemDesc dataState; nwItemDesc dataConnlimitAbove; nwItemDesc dataComment; + nwItemDesc dataIPSet; + nwItemDesc dataIPSetFlags; }; Index: libvirt/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt/src/nwfilter/nwfilter_ebiptables_driver.c @@ -256,10 +256,13 @@ static int _printDataType(virNWFilterVarCombIterPtr vars, char *buf, int bufsize, nwItemDescPtr item, - bool asHex) + bool asHex, bool directionIn) { int done; char *data; + uint8_t ctr; + virBuffer vb = VIR_BUFFER_INITIALIZER; + char *flags; if (printVar(vars, buf, bufsize, item, &done) < 0) return -1; @@ -346,6 +349,40 @@ _printDataType(virNWFilterVarCombIterPtr } break; + case DATATYPE_IPSETFLAGS: + for (ctr = 0; ctr < item->u.ipset.numFlags; ctr++) { + if (ctr != 0) + virBufferAddLit(&vb, ","); + if ((item->u.ipset.flags & (1 << ctr))) { + if (directionIn) + virBufferAddLit(&vb, "dst"); + else + virBufferAddLit(&vb, "src"); + } else { + if (directionIn) + virBufferAddLit(&vb, "src"); + else + virBufferAddLit(&vb, "dst"); + } + } + + if (virBufferError(&vb)) { + virReportOOMError(); + virBufferFreeAndReset(&vb); + return -1; + } + + flags = virBufferContentAndReset(&vb); + + if (snprintf(buf, bufsize, "%s", flags) >= bufsize) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Buffer too small for IPSETFLAGS type")); + VIR_FREE(flags); + return -1; + } + VIR_FREE(flags); + break; + default: virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, _("Unhandled datatype %x"), item->datatype); @@ -362,16 +399,23 @@ printDataType(virNWFilterVarCombIterPtr char *buf, int bufsize, nwItemDescPtr item) { - return _printDataType(vars, buf, bufsize, item, 0); + return _printDataType(vars, buf, bufsize, item, 0, 0); } +static int +printDataTypeDirection(virNWFilterVarCombIterPtr vars, + char *buf, int bufsize, + nwItemDescPtr item, bool directionIn) +{ + return _printDataType(vars, buf, bufsize, item, 0, directionIn); +} static int printDataTypeAsHex(virNWFilterVarCombIterPtr vars, char *buf, int bufsize, nwItemDescPtr item) { - return _printDataType(vars, buf, bufsize, item, 1); + return _printDataType(vars, buf, bufsize, item, 1, 0); } @@ -927,6 +971,7 @@ iptablesHandleIpHdr(virBufferPtr buf, char ipaddr[INET6_ADDRSTRLEN], number[MAX(INT_BUFSIZE_BOUND(uint32_t), INT_BUFSIZE_BOUND(int))]; + char str[200]; const char *src = "--source"; const char *dst = "--destination"; const char *srcrange = "--src-range"; @@ -938,6 +983,26 @@ iptablesHandleIpHdr(virBufferPtr buf, dstrange = "--src-range"; } + if (HAS_ENTRY_ITEM(&ipHdr->dataIPSet) && + HAS_ENTRY_ITEM(&ipHdr->dataIPSetFlags)) { + + if (printDataType(vars, + str, sizeof(str), + &ipHdr->dataIPSet) < 0) + goto err_exit; + + virBufferAsprintf(afterStateMatch, + " -m set --match-set \"%s\" ", + str); + + if (printDataTypeDirection(vars, + str, sizeof(str), + &ipHdr->dataIPSetFlags, directionIn) < 0) + goto err_exit; + + virBufferAdd(afterStateMatch, str, -1); + } + if (HAS_ENTRY_ITEM(&ipHdr->dataSrcIPAddr)) { if (printDataType(vars, Index: libvirt/docs/schemas/nwfilter.rng =================================================================== --- libvirt.orig/docs/schemas/nwfilter.rng +++ libvirt/docs/schemas/nwfilter.rng @@ -485,6 +485,14 @@ <ref name="stateflags-type"/> </attribute> </optional> + <optional> + <attribute name="ipset"> + <ref name="ipset-type"/> + </attribute> + <attribute name="ipsetflags"> + <ref name="ipsetflags-type"/> + </attribute> + </optional> </interleave> </define> @@ -1060,4 +1068,19 @@ <param name="pattern">((SYN|ACK|URG|PSH|FIN|RST)(,(SYN|ACK|URG|PSH|FIN|RST))*|ALL|NONE)/((SYN|ACK|URG|PSH|FIN|RST)(,(SYN|ACK|URG|PSH|FIN|RST))*|ALL|NONE)</param> </data> </define> + + <define name='ipset-type'> + <choice> + <ref name="variable-name-type"/> + <data type="string"> + <param name="pattern">[a-zA-Z0-9_\.:\-\+]{1,31}</param> + </data> + </choice> + </define> + + <define name='ipsetflags-type'> + <data type="string"> + <param name="pattern">(src|dst)(,(src|dst)){0,5}</param> + </data> + </define> </grammar> Index: libvirt/tests/nwfilterxml2xmlin/ipset-test.xml =================================================================== --- /dev/null +++ libvirt/tests/nwfilterxml2xmlin/ipset-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all ipset='test' ipsetflags='src,dst' /> + </rule> + <rule action='accept' direction='in'> + <all ipset='test' ipsetflags='SRC,DST,SRC' /> + </rule> + <rule action='accept' direction='in'> + <all ipset='test:_.-+' ipsetflags='SRC,dSt,SRC' /> + </rule> + <rule action='accept' direction='in'> + <all ipset='$IPSETNAME' ipsetflags='src,dst' /> + </rule> +</filter> Index: libvirt/tests/nwfilterxml2xmlout/ipset-test.xml =================================================================== --- /dev/null +++ libvirt/tests/nwfilterxml2xmlout/ipset-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out' priority='500'> + <all ipset='test' ipsetflags='src,dst'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all ipset='test' ipsetflags='src,dst,src'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all ipset='test:_.-+' ipsetflags='src,dst,src'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <all ipset='$IPSETNAME' ipsetflags='src,dst'/> + </rule> +</filter> Index: libvirt/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt.orig/tests/nwfilterxml2xmltest.c +++ libvirt/tests/nwfilterxml2xmltest.c @@ -157,6 +157,8 @@ mymain(void) DO_TEST("iter-test2", false); DO_TEST("iter-test3", false); + DO_TEST("ipset-test", false); + return ret==0 ? EXIT_SUCCESS : EXIT_FAILURE; } Index: libvirt/docs/formatnwfilter.html.in =================================================================== --- libvirt.orig/docs/formatnwfilter.html.in +++ libvirt/docs/formatnwfilter.html.in @@ -528,6 +528,10 @@ <li>IPV6_MASK: IPv6 mask in numbers format (FFFF:FFFF:FC00::) or CIDR mask (0-128)</li> <li>STRING: A string</li> <li>BOOLEAN: 'true', 'yes', '1' or 'false', 'no', '0'</li> + <li>IPSETFLAGS: The source and destination flags of the ipset described + by up to 6 'src' or 'dst' elements selecting features from either + the source or destination part of the packet header; example: + src,src,dst</li> </ul> @@ -1169,6 +1173,16 @@ <td>STRING</td> <td>TCP-only: format of mask/flags with mask and flags each being a comma separated list of SYN,ACK,URG,PSH,FIN,RST or NONE or ALL</td> </tr> + <tr> + <td>ipset (Since 0.9.11)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.11)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1269,6 +1283,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.11)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.11)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1358,6 +1382,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.11)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.11)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1459,6 +1493,16 @@ <td>STRING</td> <td>TCP-only: format of mask/flags with mask and flags each being a comma separated list of SYN,ACK,URG,PSH,FIN,RST or NONE or ALL</td> </tr> + <tr> + <td>ipset (Since 0.9.11)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.11)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1545,6 +1589,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.11)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.11)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table> @@ -1619,6 +1673,16 @@ <td>STRING</td> <td>comma separated list of NEW,ESTABLISHED,RELATED,INVALID or NONE</td> </tr> + <tr> + <td>ipset (Since 0.9.11)</td> + <td>STRING</td> + <td>The name of an IPSet managed outside of libvirt</td> + </tr> + <tr> + <td>ipsetflags (Since 0.9.11)</td> + <td>IPSETFLAGS</td> + <td>flags for the IPSet; requires ipset attributed</td> + </tr> </table>

1 0

[libvirt] patch for openvz driver to support vzctl 3.1
by Ilja Livenson 04 Apr '12

04 Apr '12

Hi, there was a recent update of vzctl from openvz, which made openvz driver crash: https://www.redhat.com/archives/libvirt-users/2012-March/msg00203.html Not sure about the correct procedure, but the patch is very simple and is shown here: https://bugzilla.redhat.com/show_bug.cgi?id=809895 . Basically, openvz dropped strict version numbering (3.1 vs 3.1.0), which caused parsing to fail. cheers, Ilya

2 1

[libvirt] problems starting several qemu VMS simultaneously
by Serge Hallyn 04 Apr '12

04 Apr '12

Hi, I grabbed today's git head of libvirt. Created a VM (clean install of ubuntu oneiric, installed through virt-manager), and cloned it 3 times. Then I did serge@ubuntu:~$ for i in `seq 1 4`; do virsh start o$i > /tmp/o$i 2>&1 & done [1] 12184 [2] 12185 [3] 12186 [4] 12187 serge@ubuntu:~$ virsh list error: Failed to list active domains error: End of file while reading data: Input/output error serge@ubuntu:~$ virsh list Id Name State ---------------------------------------------------- 5 o2 shut off 7 o3 shut off 8 o4 shut off [1] Exit 1 virsh start o$i > /tmp/o$i 2>&1 [2] Done virsh start o$i > /tmp/o$i 2>&1 serge@ubuntu:~$ virsh list Id Name State ---------------------------------------------------- 5 o2 running 7 o3 running 8 o4 running [3]- Done virsh start o$i > /tmp/o$i 2>&1 [4]+ Done virsh start o$i > /tmp/o$i 2>&1 serge@ubuntu:~$ cat /tmp/o1 error: Failed to start domain o1 error: Unable to wait for child process: Bad file descriptor It's quite reproducible. An ubuntu bug report was filed at https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/961217 It's also very reminiscent of some lxc startup handshake issues which have been fixed. You can find the last chunk of the log file at http://people.canonical.com/~serge/libvirtd-parallel-startup.log -serge

2 4

[libvirt] [PATCH] Don't install sysctl file on non-Linux hosts
by Daniel P. Berrange 04 Apr '12

04 Apr '12

From: "Daniel P. Berrange" <berrange(a)redhat.com> * configure.ac: Set WITH_SYSCTL only on Linux hosts * daemon/Makefile.am: Conditionalize install-sysctl using WITH_SYSCTL Signed-off-by: Daniel P. Berrange <berrange(a)redhat.com> Cc: Jason Helfman <jhelfman(a)e-e.com> --- configure.ac | 25 +++++++++++++++++++++++++ daemon/Makefile.am | 5 +++++ 2 files changed, 30 insertions(+), 0 deletions(-) diff --git a/configure.ac b/configure.ac index 0e83019..3f5b3ff 100644 --- a/configure.ac +++ b/configure.ac @@ -403,6 +403,31 @@ AM_CONDITIONAL([LIBVIRT_INIT_SCRIPT_UPSTART], test "$init_upstart" = "yes") AM_CONDITIONAL([LIBVIRT_INIT_SCRIPT_SYSTEMD], test "$init_systemd" = "yes") AC_MSG_RESULT($with_init_script) + +AC_MSG_CHECKING([for whether to install sysctl config]) +AC_ARG_WITH([sysctl], + [AC_HELP_STRING([--with-sysctl@<:@=yes/no@:>@], + [Whether to install sysctl configs @<:@default=auto@:>@])], + [],[with_sysctl=check]) + +if test "$with_sysctl" = "yes" || test "$with_sysctl" = "check" +then + case $host in + *-*-linux*) + with_sysctl=yes + ;; + **) + if test "$with_sysctl" = "yes"; then + AC_MSG_ERROR([No sysctl configuration supported for $host]) + else + with_sysctl=no + fi + ;; + esac +fi +AM_CONDITIONAL([WITH_SYSCTL], test "$with_sysctl" = "yes") +AC_MSG_RESULT($with_sysctl) + dnl RHEL-5 has a peculiar version of Xen, which requires some special casing AC_ARG_WITH([rhel5-api], [AC_HELP_STRING([--with-rhel5-api=@<:@ARG@:>@], diff --git a/daemon/Makefile.am b/daemon/Makefile.am index db4abf5..391cd99 100644 --- a/daemon/Makefile.am +++ b/daemon/Makefile.am @@ -256,6 +256,7 @@ uninstall-sysconfig: rm -f $(DESTDIR)$(sysconfdir)/sysconfig/libvirtd rmdir $(DESTDIR)$(sysconfdir)/sysconfig || : +if WITH_SYSCTL install-sysctl: $(MKDIR_P) $(DESTDIR)$(sysconfdir)/sysctl.d $(INSTALL_DATA) $(srcdir)/libvirtd.sysctl \ @@ -264,6 +265,10 @@ install-sysctl: uninstall-sysctl: rm -f $(DESTDIR)$(sysconfdir)/sysctl.d/libvirtd rmdir $(DESTDIR)$(sysconfdir)/sysctl.d || : +else +install-sysctl: +uninstall-sysctl: +endif if LIBVIRT_INIT_SCRIPT_RED_HAT -- 1.7.7.6

3 2

[libvirt] [test-API PATCH 0/3] Console tests
by Peter Krempa 04 Apr '12

04 Apr '12

This series adds two tests that check interactions with the domain's console. As a helper the first patch contains a new exception that signalizes a test error other than raised by libvirt. The two tests are not contained in any test cases yet, as they require a specific VM configuration to work correctly. Peter Krempa (3): utils: Add exception for general test errors repo: Add test for mutualy exclusive console access repo: Add test for console input and output operations repos/domain/console_io.py | 76 +++++++++++++++++++++++++++++++++++ repos/domain/console_mutex.py | 89 +++++++++++++++++++++++++++++++++++++++++ utils/Python/testError.py | 26 ++++++++++++ 3 files changed, 191 insertions(+), 0 deletions(-) create mode 100644 repos/domain/console_io.py create mode 100644 repos/domain/console_mutex.py create mode 100644 utils/Python/testError.py -- 1.7.3.4

2 7