- Devel - libvirt List Archives

[libvirt] [PATCH] qemu: checkpoint: Do ACL check prior to snapshot interlocking
by Peter Krempa 30 Sep '19

30 Sep '19

The interlocking with snapshots is executed prior to the ACL check so if a VM has snapshots invoking the checkpoint API may leak it's existance. Introduced with the qemuDomainCheckpointCreateXML API implementation in commit 5f4e0796503. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- Split out from the checkpoint refactor series as I didn't notice this one originally. src/qemu/qemu_driver.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index d5f5fd6990..3b2eb30606 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -17283,18 +17283,18 @@ qemuDomainCheckpointCreateXML(virDomainPtr domain, if (!(vm = qemuDomObjFromDomain(domain))) goto cleanup; - if (virDomainSnapshotObjListNum(vm->snapshots, NULL, 0) > 0) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("cannot create checkpoint while snapshot exists")); - goto cleanup; - } - priv = vm->privateData; cfg = virQEMUDriverGetConfig(driver); if (virDomainCheckpointCreateXMLEnsureACL(domain->conn, vm->def, flags) < 0) goto cleanup; + if (virDomainSnapshotObjListNum(vm->snapshots, NULL, 0) > 0) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("cannot create checkpoint while snapshot exists")); + goto cleanup; + } + if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_BITMAP_MERGE)) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("qemu binary lacks persistent bitmaps support")); -- 2.21.0

2 1

[libvirt] [PATCH] qemu: make attaching disk partition to VM illegal
by Pavel Mores 30 Sep '19

30 Sep '19

The way in which the qemu driver generates aliases for disks involves ignoring the partition number part of a target dev name. This means that all partitions of a block device and the device itself all end up with the same alias. If multiple such disks are specified in XML, the resulting name clash makes qemu invocation fail. Since attaching partitions to qemu VMs doesn't seem to make much sense anyway, disallow partitions in target specifications altogether. https://bugzilla.redhat.com/show_bug.cgi?id=1346265 Signed-off-by: Pavel Mores <pmores(a)redhat.com> --- src/qemu/qemu_domain.c | 10 +++++++ .../disk-attaching-partition-invalid.xml | 27 +++++++++++++++++++ tests/qemuxml2argvtest.c | 1 + 3 files changed, 38 insertions(+) create mode 100644 tests/qemuxml2argvdata/disk-attaching-partition-invalid.xml diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index e8e895d9aa..d03f3bed5f 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -5880,6 +5880,8 @@ qemuDomainDeviceDefValidateDisk(const virDomainDiskDef *disk, { const char *driverName = virDomainDiskGetDriver(disk); virStorageSourcePtr n; + int idx; + int partition; if (disk->src->shared && !disk->src->readonly && !qemuBlockStorageSourceSupportsConcurrentAccess(disk->src)) { @@ -5948,6 +5950,14 @@ qemuDomainDeviceDefValidateDisk(const virDomainDiskDef *disk, return -1; } + int result = virDiskNameParse(disk->dst, &idx, &partition); + if (result != 0 || partition != 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("can't attach disk partition '%s', please attach whole disk instead"), + disk->dst); + return -1; + } + for (n = disk->src; virStorageSourceIsBacking(n); n = n->backingStore) { if (qemuDomainValidateStorageSource(n, qemuCaps) < 0) return -1; diff --git a/tests/qemuxml2argvdata/disk-attaching-partition-invalid.xml b/tests/qemuxml2argvdata/disk-attaching-partition-invalid.xml new file mode 100644 index 0000000000..591819fbb6 --- /dev/null +++ b/tests/qemuxml2argvdata/disk-attaching-partition-invalid.xml @@ -0,0 +1,27 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219100</memory> + <currentMemory unit='KiB'>219100</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-i686</emulator> + <disk type='file' device='disk'> + <driver name='qemu' type='raw'/> + <source file='/export/vmimages/1.raw'/> + <target dev='vdb1' bus='virtio'/> + </disk> + <controller type='usb' index='0'/> + <controller type='ide' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <memballoon model='virtio'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 5bbac1c8b8..b54b4bbf35 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -1097,6 +1097,7 @@ mymain(void) DO_TEST("disk-no-boot", NONE); DO_TEST_PARSE_ERROR("disk-device-lun-type-invalid", QEMU_CAPS_VIRTIO_SCSI); + DO_TEST_CAPS_LATEST_PARSE_ERROR("disk-attaching-partition-invalid"); DO_TEST_FAILURE("disk-usb-nosupport", NONE); DO_TEST("disk-usb-device", QEMU_CAPS_DEVICE_USB_STORAGE); -- 2.21.0

3 3

[libvirt] [PATCH] tools: fix regression passing command with virt-login-shell
by Daniel P. Berrangé 30 Sep '19

30 Sep '19

It is documented that a command to run inside the container can be passed with the -c arg. virt-login-shell -c "ls -l /" This fixes commit 4feeb2d986b98013ebfb1d41ab6b9007b6cce6e2 Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Thu Aug 1 10:58:31 2019 +0100 tools: split virt-login-shell into two binaries Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- tools/virt-login-shell.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/tools/virt-login-shell.c b/tools/virt-login-shell.c index f92cc0a749..f5aa02420b 100644 --- a/tools/virt-login-shell.c +++ b/tools/virt-login-shell.c @@ -38,11 +38,13 @@ int main(int argc, char **argv) { char uidstr[INT_BUFSIZE_BOUND(uid_t)]; char gidstr[INT_BUFSIZE_BOUND(gid_t)]; - const char *const newargv[] = { + const char * newargv[] = { LIBEXECDIR "/virt-login-shell-helper", uidstr, gidstr, NULL, + NULL, + NULL, }; char *newenv[] = { NULL, @@ -60,8 +62,15 @@ int main(int argc, char **argv) { exit(EXIT_FAILURE); } - if (argc != 1) { - fprintf(stderr, "%s: no arguments expected\n", argv[0]); + if (argc == 3) { + if (strcmp(argv[1], "-c") != 0) { + fprintf(stderr, "%s: syntax: %s [-c CMDSTR]\n", argv[0], argv[0]); + exit(EXIT_FAILURE); + } + newargv[3] = argv[1]; + newargv[4] = argv[2]; + } else if (argc != 1) { + fprintf(stderr, "%s: syntax: %s [-c CMDSTR]\n", argv[0], argv[0]); exit(EXIT_FAILURE); } -- 2.21.0

2 1

[libvirt] [PATCH] network: allow DHCP/DNS/TFTP explicitly in OUTPUT rules
by Daniel P. Berrangé 28 Sep '19

28 Sep '19

From: Malina Salina <malina.salina(a)protonmail.com> While the default iptables setup used by Fedora/RHEL distros only restricts traffic on the INPUT and/or FORWARD rules, some users might have custom firewalls that restrict the OUTPUT rules too. These can prevent DHCP/DNS/TFTP responses from dnsmasq from reaching the guest VMs. We should thus whitelist these protocols in the OUTPUT chain, as well as the INPUT chain. Signed-off-by: Malina Salina <malina.salina(a)protonmail.com> Initial patch then modified to add unit tests and IPv6 support Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/libvirt_private.syms | 2 + src/network/bridge_driver_linux.c | 29 ++++++++++--- src/util/viriptables.c | 36 ++++++++++++++++ src/util/viriptables.h | 8 ++++ .../nat-default-linux.args | 21 ++++++++++ .../nat-ipv6-linux.args | 42 +++++++++++++++++++ .../nat-many-ips-linux.args | 21 ++++++++++ .../nat-no-dhcp-linux.args | 42 +++++++++++++++++++ .../nat-tftp-linux.args | 28 +++++++++++++ .../route-default-linux.args | 21 ++++++++++ 10 files changed, 244 insertions(+), 6 deletions(-) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 7b681fac64..83b97af364 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -2186,6 +2186,7 @@ iptablesAddForwardRejectIn; iptablesAddForwardRejectOut; iptablesAddOutputFixUdpChecksum; iptablesAddTcpInput; +iptablesAddTcpOutput; iptablesAddUdpInput; iptablesAddUdpOutput; iptablesRemoveDontMasquerade; @@ -2198,6 +2199,7 @@ iptablesRemoveForwardRejectIn; iptablesRemoveForwardRejectOut; iptablesRemoveOutputFixUdpChecksum; iptablesRemoveTcpInput; +iptablesRemoveTcpOutput; iptablesRemoveUdpInput; iptablesRemoveUdpOutput; iptablesSetDeletePrivate; diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_linux.c index 35459c10d1..0b6ff45b17 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -553,18 +553,23 @@ networkAddGeneralIPv4FirewallRules(virFirewallPtr fw, break; } - /* allow DHCP requests through to dnsmasq */ + /* allow DHCP requests through to dnsmasq & back out */ iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67); + iptablesAddTcpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 68); iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 68); - /* allow DNS requests through to dnsmasq */ + /* allow DNS requests through to dnsmasq & back out */ iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); + iptablesAddTcpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); + iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); - /* allow TFTP requests through to dnsmasq if necessary */ - if (ipv4def && ipv4def->tftproot) + /* allow TFTP requests through to dnsmasq if necessary & back out*/ + if (ipv4def && ipv4def->tftproot) { iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 69); + iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 69); + } /* Catch all rules to block forwarding to/from bridges */ iptablesAddForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge); @@ -592,13 +597,18 @@ networkRemoveGeneralIPv4FirewallRules(virFirewallPtr fw, iptablesRemoveForwardRejectIn(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge); iptablesRemoveForwardRejectOut(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge); - if (ipv4def && ipv4def->tftproot) + if (ipv4def && ipv4def->tftproot) { iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 69); + iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 69); + } iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); + iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); + iptablesRemoveTcpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 53); iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 68); + iptablesRemoveTcpOutput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 68); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67); iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV4, def->bridge, 67); } @@ -626,10 +636,14 @@ networkAddGeneralIPv6FirewallRules(virFirewallPtr fw, iptablesAddForwardAllowCross(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge); if (virNetworkDefGetIPByIndex(def, AF_INET6, 0)) { - /* allow DNS over IPv6 */ + /* allow DNS over IPv6 & back out */ iptablesAddTcpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); + iptablesAddTcpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); + iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); + /* allow DHCPv6 & back out */ iptablesAddUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 547); + iptablesAddUdpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 546); } } @@ -643,7 +657,10 @@ networkRemoveGeneralIPv6FirewallRules(virFirewallPtr fw, } if (virNetworkDefGetIPByIndex(def, AF_INET6, 0)) { + iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 546); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 547); + iptablesRemoveUdpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); + iptablesRemoveTcpOutput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); iptablesRemoveUdpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); iptablesRemoveTcpInput(fw, VIR_FIREWALL_LAYER_IPV6, def->bridge, 53); } diff --git a/src/util/viriptables.c b/src/util/viriptables.c index 0e3c0ad73a..46d0c3df7a 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -303,6 +303,42 @@ iptablesRemoveUdpInput(virFirewallPtr fw, iptablesInput(fw, layer, deletePrivate, iface, port, REMOVE, 0); } +/** + * iptablesAddTcpOutput: + * @ctx: pointer to the IP table context + * @iface: the interface name + * @port: the TCP port to add + * + * Add an output to the IP table allowing access to the given @port from + * the given @iface interface for TCP packets + */ +void +iptablesAddTcpOutput(virFirewallPtr fw, + virFirewallLayer layer, + const char *iface, + int port) +{ + iptablesOutput(fw, layer, true, iface, port, ADD, 1); +} + +/** + * iptablesRemoveTcpOutput: + * @ctx: pointer to the IP table context + * @iface: the interface name + * @port: the UDP port to remove + * + * Removes an output from the IP table, hence forbidding access to the given + * @port from the given @iface interface for TCP packets + */ +void +iptablesRemoveTcpOutput(virFirewallPtr fw, + virFirewallLayer layer, + const char *iface, + int port) +{ + iptablesOutput(fw, layer, deletePrivate, iface, port, REMOVE, 1); +} + /** * iptablesAddUdpOutput: * @ctx: pointer to the IP table context diff --git a/src/util/viriptables.h b/src/util/viriptables.h index feea988acd..07b4851013 100644 --- a/src/util/viriptables.h +++ b/src/util/viriptables.h @@ -45,6 +45,14 @@ void iptablesRemoveUdpInput (virFirewallPtr fw, const char *iface, int port); +void iptablesAddTcpOutput (virFirewallPtr fw, + virFirewallLayer layer, + const char *iface, + int port); +void iptablesRemoveTcpOutput (virFirewallPtr fw, + virFirewallLayer layer, + const char *iface, + int port); void iptablesAddUdpOutput (virFirewallPtr fw, virFirewallLayer layer, const char *iface, diff --git a/tests/networkxml2firewalldata/nat-default-linux.args b/tests/networkxml2firewalldata/nat-default-linux.args index c9d523d043..ab18f30bd0 100644 --- a/tests/networkxml2firewalldata/nat-default-linux.args +++ b/tests/networkxml2firewalldata/nat-default-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT diff --git a/tests/networkxml2firewalldata/nat-ipv6-linux.args b/tests/networkxml2firewalldata/nat-ipv6-linux.args index a57b9266af..05d9ee33ca 100644 --- a/tests/networkxml2firewalldata/nat-ipv6-linux.args +++ b/tests/networkxml2firewalldata/nat-ipv6-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT @@ -81,11 +102,32 @@ ip6tables \ --jump ACCEPT ip6tables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +ip6tables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +ip6tables \ +--table filter \ --insert LIBVIRT_INP \ --in-interface virbr0 \ --protocol udp \ --destination-port 547 \ --jump ACCEPT +ip6tables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 546 \ +--jump ACCEPT iptables \ --table filter \ --insert LIBVIRT_FWO \ diff --git a/tests/networkxml2firewalldata/nat-many-ips-linux.args b/tests/networkxml2firewalldata/nat-many-ips-linux.args index 1bdc43fd6a..82e1380f51 100644 --- a/tests/networkxml2firewalldata/nat-many-ips-linux.args +++ b/tests/networkxml2firewalldata/nat-many-ips-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT diff --git a/tests/networkxml2firewalldata/nat-no-dhcp-linux.args b/tests/networkxml2firewalldata/nat-no-dhcp-linux.args index 7d359f3824..8954cc5473 100644 --- a/tests/networkxml2firewalldata/nat-no-dhcp-linux.args +++ b/tests/networkxml2firewalldata/nat-no-dhcp-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT @@ -81,11 +102,32 @@ ip6tables \ --jump ACCEPT ip6tables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +ip6tables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +ip6tables \ +--table filter \ --insert LIBVIRT_INP \ --in-interface virbr0 \ --protocol udp \ --destination-port 547 \ --jump ACCEPT +ip6tables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 546 \ +--jump ACCEPT iptables \ --table filter \ --insert LIBVIRT_FWO \ diff --git a/tests/networkxml2firewalldata/nat-tftp-linux.args b/tests/networkxml2firewalldata/nat-tftp-linux.args index b721801b70..88e9929b62 100644 --- a/tests/networkxml2firewalldata/nat-tftp-linux.args +++ b/tests/networkxml2firewalldata/nat-tftp-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_INP \ --in-interface virbr0 \ --protocol udp \ @@ -42,6 +63,13 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 69 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT diff --git a/tests/networkxml2firewalldata/route-default-linux.args b/tests/networkxml2firewalldata/route-default-linux.args index ed3c560f74..c427d9602d 100644 --- a/tests/networkxml2firewalldata/route-default-linux.args +++ b/tests/networkxml2firewalldata/route-default-linux.args @@ -16,6 +16,13 @@ iptables \ --table filter \ --insert LIBVIRT_OUT \ --out-interface virbr0 \ +--protocol tcp \ +--destination-port 68 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ --protocol udp \ --destination-port 68 \ --jump ACCEPT @@ -35,6 +42,20 @@ iptables \ --jump ACCEPT iptables \ --table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol tcp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ +--insert LIBVIRT_OUT \ +--out-interface virbr0 \ +--protocol udp \ +--destination-port 53 \ +--jump ACCEPT +iptables \ +--table filter \ --insert LIBVIRT_FWO \ --in-interface virbr0 \ --jump REJECT -- 2.21.0

2 1

[libvirt] [PATCH v2] tools: fix regression passing command with virt-login-shell
by Daniel P. Berrangé 28 Sep '19

28 Sep '19

It is documented that a command to run inside the container can be passed with the -c arg. virt-login-shell -c "ls -l /" This fixes commit 4feeb2d986b98013ebfb1d41ab6b9007b6cce6e2 Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Thu Aug 1 10:58:31 2019 +0100 tools: split virt-login-shell into two binaries Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- tools/virt-login-shell.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/tools/virt-login-shell.c b/tools/virt-login-shell.c index f92cc0a749..7d1e0ccc8a 100644 --- a/tools/virt-login-shell.c +++ b/tools/virt-login-shell.c @@ -38,12 +38,8 @@ int main(int argc, char **argv) { char uidstr[INT_BUFSIZE_BOUND(uid_t)]; char gidstr[INT_BUFSIZE_BOUND(gid_t)]; - const char *const newargv[] = { - LIBEXECDIR "/virt-login-shell-helper", - uidstr, - gidstr, - NULL, - }; + const char * newargv[6]; + size_t nargs = 0; char *newenv[] = { NULL, NULL, @@ -60,10 +56,23 @@ int main(int argc, char **argv) { exit(EXIT_FAILURE); } - if (argc != 1) { - fprintf(stderr, "%s: no arguments expected\n", argv[0]); + newargv[nargs++] = LIBEXECDIR "/virt-login-shell-helper"; + if (argc == 3) { + if (strcmp(argv[1], "-c") != 0) { + fprintf(stderr, "%s: syntax: %s [-c CMDSTR]\n", argv[0], argv[0]); + exit(EXIT_FAILURE); + } + newargv[nargs++] = argv[1]; + newargv[nargs++] = argv[2]; + } else if (argc != 1) { + fprintf(stderr, "%s: syntax: %s [-c CMDSTR]\n", argv[0], argv[0]); exit(EXIT_FAILURE); } + newargv[nargs++] = uidstr; + newargv[nargs++] = gidstr; + newargv[nargs++] = NULL; + + assert(nargs <= (sizeof(newargv)/sizeof(newargv[0]))); if (term && asprintf(&(newenv[0]), "TERM=%s", term) < 0) { -- 2.21.0

2 1

[libvirt] [PATCH 0/2] Fix cgroupv2 issue on Fedora 31
by Cole Robinson 27 Sep '19

27 Sep '19

There's been a bunch of reports of VM startup failures on Fedora 31 and elsewhere: https://bugzilla.redhat.com/show_bug.cgi?id=1751120 The reproducer I found is running a mock build, which adds a name=systemd cgroup to /proc/self/cgroup, which messes up libvirt's logic. The first patch has a bit more detail. I'm not positive this is entirely correct... maybe we should be doing something with that cgroup in some way? I'm kinda ignorant here. I also filed a systemd bug incase that behavior is unintentional. We probably want to change libvirt regardless though https://bugzilla.redhat.com/show_bug.cgi?id=1756143 Cole Robinson (2): vircgroupv2: Fix VM startup when legacy cgroups are defined vircgroup: Add some VIR_DEBUG statements src/util/vircgroup.c | 3 ++- src/util/vircgroupv2.c | 15 ++++++++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) -- 2.23.0

2 5

[libvirt] [PATCH v2 0/7] qemu: checkpoints: Collect most code in a single place
by Peter Krempa 27 Sep '19

27 Sep '19

The checkpoint code is quite complex and was dispersed in many places. Refactor it to be in one new separate file. I also plan to do the same to the snapshot code once this is dealt with. Additionally aggregating all the code in one place will allow refactoring and reuse in the incremental backup implementation. diff to v1: - rebased on top of the patches to remove checking of AUTODESTROY - kept only one instance of virCheckFlags per API (inside qemu_checkpoint.c) Peter Krempa (7): qemu: Move, rename and export qemuDomObjFromDomain conf: Drop pointless 'domain' argument from virDomainCheckpointRedefinePrep conf: Drop pointless 'domain' argument from virDomainSnapshotRedefinePrep qemu: driver: Remove misplaced qemuDomainObjEndJob in qemuDomainCheckpointGetXMLDesc qemu: driver: Move checkpoint-related code to qemu_checkpoint.c qemu: domain: Move checkpoint related code to qemu_checkpoint.c qemu: driver: Don't pull in qemu_monitor_json.h directly src/conf/checkpoint_conf.c | 7 +- src/conf/checkpoint_conf.h | 3 +- src/conf/snapshot_conf.c | 5 +- src/conf/snapshot_conf.h | 3 +- src/qemu/Makefile.inc.am | 2 + src/qemu/qemu_checkpoint.c | 646 ++++++++++++++++++++++++++++++++++ src/qemu/qemu_checkpoint.h | 55 +++ src/qemu/qemu_domain.c | 193 ++--------- src/qemu/qemu_domain.h | 16 +- src/qemu/qemu_driver.c | 689 ++++++++----------------------------- src/test/test_driver.c | 4 +- 11 files changed, 887 insertions(+), 736 deletions(-) create mode 100644 src/qemu/qemu_checkpoint.c create mode 100644 src/qemu/qemu_checkpoint.h -- 2.21.0

3 16

[libvirt] [PATCH 0/8] qemu: Lock-out checkpoints until backups are ready
by Peter Krempa 27 Sep '19

27 Sep '19

See patch 6/8 for the reasoning. This series applies on top of the v2 of splitting checkpoints into a separate file. Peter Krempa (8): qemu: checkpoint: Refactor cleanup in qemuCheckpointCreateXML qemu: checkpoint: Remove open-ended TODOs qemu: Simplify argument list of qemuDomainBlockPullCommon qemu: Don't repeat virDomainObjEndAPI in qemuDomainBlockPull qemu: caps: Add capability for incremental backup support qemu: checkpoint: Forbid creating checkpoints until we support backups qemu: Aggregate interlocking of blockjobs by checkpoints in one place qemu: domain: Base block job interlocking on QEMU_CAPS_INCREMENTAL_BACKUP src/qemu/qemu_capabilities.c | 3 +++ src/qemu/qemu_capabilities.h | 3 +++ src/qemu/qemu_checkpoint.c | 42 +++++++++++++----------------- src/qemu/qemu_domain.c | 24 +++++++++++++++++ src/qemu/qemu_domain.h | 4 +++ src/qemu/qemu_driver.c | 50 +++++++++++++----------------------- 6 files changed, 70 insertions(+), 56 deletions(-) -- 2.21.0

2 15

[libvirt] [PATCH] remote: fix systemd IP socket activation with virtproxyd
by Daniel P. Berrangé 27 Sep '19

27 Sep '19

We recently forbid the use of --listen with socket activation: commit 3a6a725b8f575890ee6c151ad1f46ea0ceea1f3b Author: Daniel P. Berrangé <berrange(a)redhat.com> Date: Thu Aug 22 14:52:16 2019 +0100 remote: forbid the --listen arg when systemd socket activation In this change we forgot that virtproxyd doesn't have a --listen parameter, and instead behaves as if it was always present. Thus when systemd socket activation is present, we must disable this built-in default Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com> --- src/remote/remote_daemon.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/remote/remote_daemon.c b/src/remote/remote_daemon.c index 7195ac9218..43409edd24 100644 --- a/src/remote/remote_daemon.c +++ b/src/remote/remote_daemon.c @@ -423,11 +423,20 @@ daemonSetupNetworking(virNetServerPtr srv, return -1; #ifdef WITH_IP +# ifdef (LIBVIRTD if (act && ipsock) { VIR_ERROR(_("--listen parameter not permitted with systemd activation " "sockets, see 'man libvirtd' for further guidance")); return -1; } +# else /* ! LIBVIRTD */ + /* We don't have a --listen arg with virtproxyd, we're just + * hardcoded to assume --listen. Thus with systemd we must + * change that default + */ + if (act) + ipsock = 0; +# endif /* ! LIBVIRTD */ #endif /* ! WITH_IP */ if (config->unix_sock_group) { -- 2.21.0

2 5

[libvirt] [PATCH] qemu_monitor: s/size_t/ULL/ in qemuMonitorSave{Virtual, Physical}Memory
by Michal Privoznik 27 Sep '19

27 Sep '19

As it turns out, on my 32bit ARM machine size_t is not the same size as ULL. However, @length argument for both functions is type of size_t but it's treated as ULL - for instance when passed to qemuMonitorJSONMakeCommand(). The problem is that because of "U:size" the virJSONValueObjectAddVArgs() expects an ULL argument but on the stack there are size_t and char * arguments (which coincidentally add up to size of ULL). So the created command has only two arguments "val" and incorrect "size" and no "path" which is required. I've tried to find other occurrences of this pattern but at the rest of places where size_t is used it tracks size of an array so that's safe. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/qemu/qemu_monitor.c | 8 ++++---- src/qemu/qemu_monitor.h | 4 ++-- src/qemu/qemu_monitor_json.c | 6 +++--- src/qemu/qemu_monitor_json.h | 4 ++-- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index b6d2936872..7959933e7c 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -2348,10 +2348,10 @@ qemuMonitorChangeMedia(qemuMonitorPtr mon, int qemuMonitorSaveVirtualMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path) { - VIR_DEBUG("offset=%llu length=%zu path=%s", offset, length, path); + VIR_DEBUG("offset=%llu length=%llu path=%s", offset, length, path); QEMU_CHECK_MONITOR(mon); @@ -2362,10 +2362,10 @@ qemuMonitorSaveVirtualMemory(qemuMonitorPtr mon, int qemuMonitorSavePhysicalMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path) { - VIR_DEBUG("offset=%llu length=%zu path=%s", offset, length, path); + VIR_DEBUG("offset=%llu length=%llu path=%s", offset, length, path); QEMU_CHECK_MONITOR(mon); diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index 8fc11c955e..95de891150 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -726,11 +726,11 @@ int qemuMonitorChangeMedia(qemuMonitorPtr mon, int qemuMonitorSaveVirtualMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path); int qemuMonitorSavePhysicalMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path); int qemuMonitorSetMigrationSpeed(qemuMonitorPtr mon, diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index cdfaf9785a..d99d291d89 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -3100,7 +3100,7 @@ int qemuMonitorJSONChangeMedia(qemuMonitorPtr mon, static int qemuMonitorJSONSaveMemory(qemuMonitorPtr mon, const char *cmdtype, unsigned long long offset, - size_t length, + unsigned long long length, const char *path) { int ret = -1; @@ -3129,7 +3129,7 @@ static int qemuMonitorJSONSaveMemory(qemuMonitorPtr mon, int qemuMonitorJSONSaveVirtualMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path) { return qemuMonitorJSONSaveMemory(mon, "memsave", offset, length, path); @@ -3137,7 +3137,7 @@ int qemuMonitorJSONSaveVirtualMemory(qemuMonitorPtr mon, int qemuMonitorJSONSavePhysicalMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path) { return qemuMonitorJSONSaveMemory(mon, "pmemsave", offset, length, path); diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h index a608410703..63f569716d 100644 --- a/src/qemu/qemu_monitor_json.h +++ b/src/qemu/qemu_monitor_json.h @@ -118,11 +118,11 @@ int qemuMonitorJSONChangeMedia(qemuMonitorPtr mon, int qemuMonitorJSONSaveVirtualMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path); int qemuMonitorJSONSavePhysicalMemory(qemuMonitorPtr mon, unsigned long long offset, - size_t length, + unsigned long long length, const char *path); int qemuMonitorJSONSetMigrationSpeed(qemuMonitorPtr mon, -- 2.21.0

2 1