On Thu, Nov 29, 2007 at 05:16:34PM +0000, Daniel P. Berrange wrote: Hum, shouldn't the spec file then Requires: cyrus-sasl-md5 to make sure this works ? [...] Requires: cyrus-sasl-md5 ? [...] So if libvirt was configured/compiled with SASL but for some reason we fail to initialize SASL we can't start the daemon at all ? Isn't that a bit excessive ? [...] Looks to me that as long as TLS can still work we should not fail on sasl_server_init error, right ? [...] Actually there we should looks for a password and store it, that's very common and convenient, e.g. use xen://foo:bar@server/ as the connection URI, libxml2 will just return the user as 'foo:bar' which could subsequently be split here to store the password (bar). [...] Looks fine to me, +1 Daniel -- Red Hat Virtualization group http://redhat.com/virtualization/ Daniel Veillard | virtualization library http://libvirt.org/ veillard(a)redhat.com | libxml GNOME XML XSLT toolkit http://xmlsoft.org/ http://veillard.com/ | Rpmfind RPM search engine http://rpmfind.net/

With the TLS socket, all data is encrypted on the wire. The TCP socket though is still clear text. Fortunately some SASL authentication mechanism can also supply encryption capabilities. This is called SSF in SASL terminology. This patch mandates the use of an SSF capable SASL authentiction mechanism on the TCP socket. This in effect restricts you to a choise between GSSAPI and DIGEST-MD5 as your SASL auth methods (the latter is a user/password based scheme). We also disallow anonymous & plaintext auth methods. If you really want to run the TCP socket in clear text & with anonymous auth, simply turn off SASL altogether. Since TLS already provides encryptiuon, if you run SASL over the TLS socket, we don't place any restrictions on the choice of SASL auth mechanism. On the server side I have removed the 'direction' field of the client object. This was only used on the TLS socket & was intended to track whether the handshake process was waiting to receive or send. Rather than try to set this in various places throughout the daemon code, we simply query the neccessary direction at the one point where we register a FD event handle with poll(). This makes the code clearer to follow & reduces the chance of accidentally messing up the state. The send & receive functions previously would call read vs gnutls_record_recv and write vs gnutls_record_send depending on the type of socket. If there is a SASL SSF layer enabled, we have to first pass the outgoing data through the sasl_encode() API, and pass incoming data through sasl_decode(). So the send/recive APIs have changed a little, to deal with this codec need and thus there is also some more state being tracked per connection - we may have to cache the output for sasl_decode for future calls depending on how much data we need in short term. NB, the SSF layer lets you choose a strength factor from 0 -> a large number and the docs all talk about * 0 = no protection * 1 = integrity protection only * 40 = 40-bit DES or 40-bit RC2/RC4 * 56 = DES * 112 = triple-DES * 128 = 128-bit RC2/RC4/BLOWFISH * 256 = baseline AES This is incredibly misleading. The GSSAPI mechanism in SASL will never report a strength of anything other than 56. Even if it is using triple-DES. The true strength of the GSSAPI/Kerberos impl is impossible to figure out from the SASL apis. To ensure that Kerberos uses strong encryption, you need to make sure that the Kerberos principles issued only have the 3-DES cipher/keys present. If you are truely paranoid though, you always have the option of using TLS (which gives at least 128 bit ciphers, often 256 bit), and then just using Kerberos for auth and ignore the SASL SSF layer. A subsequent patch will make it possible to configure this stuff. qemud/internal.h | 31 +++-- qemud/qemud.c | 248 +++++++++++++++++++++++++++++++++----------- qemud/remote.c | 106 ++++++++++++++++++ src/remote_internal.c | 279 ++++++++++++++++++++++++++++++++++++++++---------- 4 files changed, 538 insertions(+), 126 deletions(-) diff -r 5a37498017ac qemud/internal.h --- a/qemud/internal.h Wed Nov 28 23:00:04 2007 -0500 +++ b/qemud/internal.h Wed Nov 28 23:00:47 2007 -0500 @@ -73,10 +73,17 @@ enum qemud_mode { QEMUD_MODE_TLS_HANDSHAKE, }; -/* These have to remain compatible with gnutls_record_get_direction. */ -enum qemud_tls_direction { - QEMUD_TLS_DIRECTION_READ = 0, - QEMUD_TLS_DIRECTION_WRITE = 1, +/* Whether we're passing reads & writes through a sasl SSF */ +enum qemud_sasl_ssf { + QEMUD_SASL_SSF_NONE = 0, + QEMUD_SASL_SSF_READ = 1, + QEMUD_SASL_SSF_WRITE = 2, +}; + +enum qemud_sock_type { + QEMUD_SOCK_TYPE_UNIX = 0, + QEMUD_SOCK_TYPE_TCP = 1, + QEMUD_SOCK_TYPE_TLS = 2, }; /* Stores the per-client connection state */ @@ -90,13 +97,18 @@ struct qemud_client { struct sockaddr_storage addr; socklen_t addrlen; - /* If set, TLS is required on this socket. */ - int tls; - gnutls_session_t session; - enum qemud_tls_direction direction; + int type; /* qemud_sock_type */ + gnutls_session_t tlssession; int auth; #if HAVE_SASL sasl_conn_t *saslconn; + int saslSSF; + const char *saslDecoded; + unsigned int saslDecodedLength; + unsigned int saslDecodedOffset; + const char *saslEncoded; + unsigned int saslEncodedLength; + unsigned int saslEncodedOffset; #endif unsigned int incomingSerial; @@ -121,8 +133,7 @@ struct qemud_socket { struct qemud_socket { int fd; int readonly; - /* If set, TLS is required on this socket. */ - int tls; + int type; /* qemud_sock_type */ int auth; int port; struct qemud_socket *next; diff -r 5a37498017ac qemud/qemud.c --- a/qemud/qemud.c Wed Nov 28 23:00:04 2007 -0500 +++ b/qemud/qemud.c Wed Nov 28 23:00:47 2007 -0500 @@ -463,6 +463,7 @@ static int qemudListenUnix(struct qemud_ sock->readonly = readonly; sock->port = -1; + sock->type = QEMUD_SOCK_TYPE_UNIX; if ((sock->fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) { qemudLog(QEMUD_ERR, "Failed to create socket: %s", @@ -577,7 +578,7 @@ static int static int remoteListenTCP (struct qemud_server *server, const char *port, - int tls, + int type, int auth) { int fds[2]; @@ -606,7 +607,7 @@ remoteListenTCP (struct qemud_server *se server->nsockets++; sock->fd = fds[i]; - sock->tls = tls; + sock->type = type; sock->auth = auth; if (getsockname(sock->fd, (struct sockaddr *)(&sa), &salen) < 0) @@ -745,10 +746,10 @@ static struct qemud_server *qemudInitial if (ipsock) { #if HAVE_SASL - if (listen_tcp && remoteListenTCP (server, tcp_port, 0, REMOTE_AUTH_SASL) < 0) + if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, REMOTE_AUTH_SASL) < 0) goto cleanup; #else - if (listen_tcp && remoteListenTCP (server, tcp_port, 0, REMOTE_AUTH_NONE) < 0) + if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, REMOTE_AUTH_NONE) < 0) goto cleanup; #endif @@ -756,7 +757,7 @@ static struct qemud_server *qemudInitial if (remoteInitializeGnuTLS () < 0) goto cleanup; - if (remoteListenTCP (server, tls_port, 1, REMOTE_AUTH_NONE) < 0) + if (remoteListenTCP (server, tls_port, QEMUD_SOCK_TYPE_TLS, REMOTE_AUTH_NONE) < 0) goto cleanup; } } @@ -789,7 +790,7 @@ static struct qemud_server *qemudInitial */ sock = server->sockets; while (sock) { - if (sock->port != -1 && sock->tls) { + if (sock->port != -1 && sock->type == QEMUD_SOCK_TYPE_TLS) { port = sock->port; break; } @@ -981,7 +982,7 @@ remoteCheckAccess (struct qemud_client * int found, err; /* Verify client certificate. */ - if (remoteCheckCertificate (client->session) == -1) { + if (remoteCheckCertificate (client->tlssession) == -1) { qemudLog (QEMUD_ERR, "remoteCheckCertificate: failed to verify client's certificate"); if (!tls_no_verify_certificate) return -1; else qemudLog (QEMUD_INFO, "remoteCheckCertificate: tls_no_verify_certificate is set so the bad certificate is ignored"); @@ -1033,7 +1034,6 @@ remoteCheckAccess (struct qemud_client * client->bufferOffset = 0; client->buffer[0] = '\1'; client->mode = QEMUD_MODE_TX_PACKET; - client->direction = QEMUD_TLS_DIRECTION_WRITE; return 0; } @@ -1065,12 +1065,12 @@ static int qemudDispatchServer(struct qe client->magic = QEMUD_CLIENT_MAGIC; client->fd = fd; client->readonly = sock->readonly; - client->tls = sock->tls; + client->type = sock->type; client->auth = sock->auth; memcpy (&client->addr, &addr, sizeof addr); client->addrlen = addrlen; - if (!client->tls) { + if (client->type != QEMUD_SOCK_TYPE_TLS) { client->mode = QEMUD_MODE_RX_HEADER; client->bufferLength = REMOTE_MESSAGE_HEADER_XDR_LEN; @@ -1079,15 +1079,15 @@ static int qemudDispatchServer(struct qe } else { int ret; - client->session = remoteInitializeTLSSession (); - if (client->session == NULL) + client->tlssession = remoteInitializeTLSSession (); + if (client->tlssession == NULL) goto cleanup; - gnutls_transport_set_ptr (client->session, + gnutls_transport_set_ptr (client->tlssession, (gnutls_transport_ptr_t) (long) fd); /* Begin the TLS handshake. */ - ret = gnutls_handshake (client->session); + ret = gnutls_handshake (client->tlssession); if (ret == 0) { /* Unlikely, but ... Next step is to check the certificate. */ if (remoteCheckAccess (client) == -1) @@ -1099,7 +1099,6 @@ static int qemudDispatchServer(struct qe /* Most likely. */ client->mode = QEMUD_MODE_TLS_HANDSHAKE; client->bufferLength = -1; - client->direction = gnutls_record_get_direction (client->session); if (qemudRegisterClientEvent (server, client, 0) < 0) goto cleanup; @@ -1117,7 +1116,7 @@ static int qemudDispatchServer(struct qe return 0; cleanup: - if (client->session) gnutls_deinit (client->session); + if (client->tlssession) gnutls_deinit (client->tlssession); close (fd); free (client); return -1; @@ -1150,24 +1149,21 @@ static void qemudDispatchClientFailure(s #if HAVE_SASL if (client->saslconn) sasl_dispose(&client->saslconn); #endif - if (client->tls && client->session) gnutls_deinit (client->session); + if (client->tlssession) gnutls_deinit (client->tlssession); close(client->fd); free(client); } -static int qemudClientRead(struct qemud_server *server, - struct qemud_client *client) { - int ret, len; - char *data; - - data = client->buffer + client->bufferOffset; - len = client->bufferLength - client->bufferOffset; +static int qemudClientReadBuf(struct qemud_server *server, + struct qemud_client *client, + char *data, unsigned len) { + int ret; /*qemudDebug ("qemudClientRead: len = %d", len);*/ - if (!client->tls) { + if (!client->tlssession) { if ((ret = read (client->fd, data, len)) <= 0) { if (ret == 0 || errno != EAGAIN) { if (ret != 0) @@ -1177,8 +1173,7 @@ static int qemudClientRead(struct qemud_ return -1; } } else { - ret = gnutls_record_recv (client->session, data, len); - client->direction = gnutls_record_get_direction (client->session); + ret = gnutls_record_recv (client->tlssession, data, len); if (qemudRegisterClientEvent (server, client, 1) < 0) qemudDispatchClientFailure (server, client); else if (ret <= 0) { @@ -1193,9 +1188,79 @@ static int qemudClientRead(struct qemud_ } } + return ret; +} + +static int qemudClientReadPlain(struct qemud_server *server, + struct qemud_client *client) { + int ret; + ret = qemudClientReadBuf(server, client, + client->buffer + client->bufferOffset, + client->bufferLength - client->bufferOffset); + if (ret < 0) + return ret; client->bufferOffset += ret; return 0; } + +#if HAVE_SASL +static int qemudClientReadSASL(struct qemud_server *server, + struct qemud_client *client) { + int got, want; + + /* We're doing a SSF data read, so now its times to ensure + * future writes are under SSF too. + * + * cf remoteSASLCheckSSF in remote.c + */ + client->saslSSF |= QEMUD_SASL_SSF_WRITE; + + /* Need to read some more data off the wire */ + if (client->saslDecoded == NULL) { + char encoded[8192]; + int encodedLen = sizeof(encoded); + encodedLen = qemudClientReadBuf(server, client, encoded, encodedLen); + + if (encodedLen < 0) + return -1; + + sasl_decode(client->saslconn, encoded, encodedLen, + &client->saslDecoded, &client->saslDecodedLength); + + client->saslDecodedOffset = 0; + } + + /* Some buffered decoded data to return now */ + got = client->saslDecodedLength - client->saslDecodedOffset; + want = client->bufferLength - client->bufferOffset; + + if (want > got) + want = got; + + memcpy(client->buffer + client->bufferOffset, + client->saslDecoded + client->saslDecodedOffset, want); + client->saslDecodedOffset += want; + client->bufferOffset += want; + + if (client->saslDecodedOffset == client->saslDecodedLength) { + client->saslDecoded = NULL; + client->saslDecodedOffset = client->saslDecodedLength = 0; + } + + return 0; +} +#endif + +static int qemudClientRead(struct qemud_server *server, + struct qemud_client *client) { +#if HAVE_SASL + if (client->saslSSF & QEMUD_SASL_SSF_READ) + return qemudClientReadSASL(server, client); + else +#endif + return qemudClientReadPlain(server, client); +} + static void qemudDispatchClientRead(struct qemud_server *server, struct qemud_client *client) { @@ -1239,7 +1304,6 @@ static void qemudDispatchClientRead(stru client->mode = QEMUD_MODE_RX_PAYLOAD; client->bufferLength = len - REMOTE_MESSAGE_HEADER_XDR_LEN; client->bufferOffset = 0; - if (client->tls) client->direction = QEMUD_TLS_DIRECTION_READ; if (qemudRegisterClientEvent(server, client, 1) < 0) { qemudDispatchClientFailure(server, client); @@ -1267,7 +1331,7 @@ static void qemudDispatchClientRead(stru int ret; /* Continue the handshake. */ - ret = gnutls_handshake (client->session); + ret = gnutls_handshake (client->tlssession); if (ret == 0) { /* Finished. Next step is to check the certificate. */ if (remoteCheckAccess (client) == -1) @@ -1279,7 +1343,6 @@ static void qemudDispatchClientRead(stru gnutls_strerror (ret)); qemudDispatchClientFailure (server, client); } else { - client->direction = gnutls_record_get_direction (client->session); if (qemudRegisterClientEvent (server ,client, 1) < 0) qemudDispatchClientFailure (server, client); } @@ -1294,15 +1357,11 @@ static void qemudDispatchClientRead(stru } -static int qemudClientWrite(struct qemud_server *server, - struct qemud_client *client) { - int ret, len; - char *data; - - data = client->buffer + client->bufferOffset; - len = client->bufferLength - client->bufferOffset; - - if (!client->tls) { +static int qemudClientWriteBuf(struct qemud_server *server, + struct qemud_client *client, + const char *data, int len) { + int ret; + if (!client->tlssession) { if ((ret = write(client->fd, data, len)) == -1) { if (errno != EAGAIN) { qemudLog (QEMUD_ERR, "write: %s", strerror (errno)); @@ -1311,8 +1370,7 @@ static int qemudClientWrite(struct qemud return -1; } } else { - ret = gnutls_record_send (client->session, data, len); - client->direction = gnutls_record_get_direction (client->session); + ret = gnutls_record_send (client->tlssession, data, len); if (qemudRegisterClientEvent (server, client, 1) < 0) qemudDispatchClientFailure (server, client); else if (ret < 0) { @@ -1324,9 +1382,69 @@ static int qemudClientWrite(struct qemud return -1; } } - + return ret; +} + + +static int qemudClientWritePlain(struct qemud_server *server, + struct qemud_client *client) { + int ret = qemudClientWriteBuf(server, client, + client->buffer + client->bufferOffset, + client->bufferLength - client->bufferOffset); + if (ret < 0) + return -1; client->bufferOffset += ret; return 0; +} + + +#if HAVE_SASL +static int qemudClientWriteSASL(struct qemud_server *server, + struct qemud_client *client) { + int ret; + + /* Not got any pending encoded data, so we need to encode raw stuff */ + if (client->saslEncoded == NULL) { + int err; + err = sasl_encode(client->saslconn, + client->buffer + client->bufferOffset, + client->bufferLength - client->bufferOffset, + &client->saslEncoded, + &client->saslEncodedLength); + + client->saslEncodedOffset = 0; + } + + /* Send some of the encoded stuff out on the wire */ + ret = qemudClientWriteBuf(server, client, + client->saslEncoded + client->saslEncodedOffset, + client->saslEncodedLength - client->saslEncodedOffset); + + if (ret < 0) + return -1; + + /* Note how much we sent */ + client->saslEncodedOffset += ret; + + /* Sent all encoded, so update raw buffer to indicate completion */ + if (client->saslEncodedOffset == client->saslEncodedLength) { + client->saslEncoded = NULL; + client->saslEncodedOffset = client->saslEncodedLength = 0; + client->bufferOffset = client->bufferLength; + } + + return 0; +} +#endif + +static int qemudClientWrite(struct qemud_server *server, + struct qemud_client *client) { +#if HAVE_SASL + if (client->saslSSF & QEMUD_SASL_SSF_WRITE) + return qemudClientWriteSASL(server, client); + else +#endif + return qemudClientWritePlain(server, client); } @@ -1341,7 +1459,6 @@ static void qemudDispatchClientWrite(str client->mode = QEMUD_MODE_RX_HEADER; client->bufferLength = REMOTE_MESSAGE_HEADER_XDR_LEN; client->bufferOffset = 0; - if (client->tls) client->direction = QEMUD_TLS_DIRECTION_READ; if (qemudRegisterClientEvent (server, client, 1) < 0) qemudDispatchClientFailure (server, client); @@ -1354,7 +1471,7 @@ static void qemudDispatchClientWrite(str int ret; /* Continue the handshake. */ - ret = gnutls_handshake (client->session); + ret = gnutls_handshake (client->tlssession); if (ret == 0) { /* Finished. Next step is to check the certificate. */ if (remoteCheckAccess (client) == -1) @@ -1366,7 +1483,6 @@ static void qemudDispatchClientWrite(str gnutls_strerror (ret)); qemudDispatchClientFailure (server, client); } else { - client->direction = gnutls_record_get_direction (client->session); if (qemudRegisterClientEvent (server, client, 1)) qemudDispatchClientFailure (server, client); } @@ -1406,25 +1522,37 @@ static int qemudRegisterClientEvent(stru static int qemudRegisterClientEvent(struct qemud_server *server, struct qemud_client *client, int removeFirst) { + int mode; + switch (client->mode) { + case QEMUD_MODE_TLS_HANDSHAKE: + if (gnutls_record_get_direction (client->tlssession) == 0) + mode = POLLIN; + else + mode = POLLOUT; + break; + + case QEMUD_MODE_RX_HEADER: + case QEMUD_MODE_RX_PAYLOAD: + mode = POLLIN; + break; + + case QEMUD_MODE_TX_PACKET: + mode = POLLOUT; + break; + + default: + return -1; + } + if (removeFirst) if (virEventRemoveHandleImpl(client->fd) < 0) return -1; - if (client->tls) { - if (virEventAddHandleImpl(client->fd, - (client->direction ? - POLLOUT : POLLIN) | POLLERR | POLLHUP, - qemudDispatchClientEvent, - server) < 0) - return -1; - } else { - if (virEventAddHandleImpl(client->fd, - (client->mode == QEMUD_MODE_TX_PACKET ? - POLLOUT : POLLIN) | POLLERR | POLLHUP, - qemudDispatchClientEvent, - server) < 0) - return -1; - } + if (virEventAddHandleImpl(client->fd, + mode | POLLERR | POLLHUP, + qemudDispatchClientEvent, + server) < 0) + return -1; return 0; } diff -r 5a37498017ac qemud/remote.c --- a/qemud/remote.c Wed Nov 28 23:00:04 2007 -0500 +++ b/qemud/remote.c Wed Nov 28 23:00:47 2007 -0500 @@ -284,7 +284,6 @@ remoteDispatchClientRequest (struct qemu client->mode = QEMUD_MODE_TX_PACKET; client->bufferLength = len; client->bufferOffset = 0; - if (client->tls) client->direction = QEMUD_TLS_DIRECTION_WRITE; } /* An error occurred during the dispatching process itself (ie. not @@ -369,7 +368,6 @@ remoteDispatchSendError (struct qemud_cl client->mode = QEMUD_MODE_TX_PACKET; client->bufferLength = len; client->bufferOffset = 0; - if (client->tls) client->direction = QEMUD_TLS_DIRECTION_WRITE; } static void @@ -2042,6 +2040,7 @@ remoteDispatchAuthSaslInit (struct qemud remote_auth_sasl_init_ret *ret) { const char *mechlist = NULL; + sasl_security_properties_t secprops; int err; struct sockaddr_storage sa; socklen_t salen; @@ -2097,6 +2096,60 @@ remoteDispatchAuthSaslInit (struct qemud return -2; } + /* Inform SASL that we've got an external SSF layer from TLS */ + if (client->type == QEMUD_SOCK_TYPE_TLS) { + gnutls_cipher_algorithm_t cipher; + sasl_ssf_t ssf; + + cipher = gnutls_cipher_get(client->tlssession); + if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) { + qemudLog(QEMUD_ERR, "cannot TLS get cipher size"); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -2; + } + ssf *= 8; /* tls key size is bytes, sasl wants bits */ + + err = sasl_setprop(client->saslconn, SASL_SSF_EXTERNAL, &ssf); + if (err != SASL_OK) { + qemudLog(QEMUD_ERR, "cannot set SASL external SSF %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -2; + } + } + + memset (&secprops, 0, sizeof secprops); + if (client->type == QEMUD_SOCK_TYPE_TLS || + client->type == QEMUD_SOCK_TYPE_UNIX) { + /* If we've got TLS or UNIX domain sock, we don't care about SSF */ + secprops.min_ssf = 0; + secprops.max_ssf = 0; + secprops.maxbufsize = 8192; + secprops.security_flags = 0; + } else { + /* Plain TCP, better get an SSF layer */ + secprops.min_ssf = 56; /* Good enough to require kerberos */ + secprops.max_ssf = 100000; /* Arbitrary big number */ + secprops.maxbufsize = 8192; + /* Forbid any anonymous or trivially crackable auth */ + secprops.security_flags = + SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT; + } + + err = sasl_setprop(client->saslconn, SASL_SEC_PROPS, &secprops); + if (err != SASL_OK) { + qemudLog(QEMUD_ERR, "cannot set SASL security props %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -2; + } + err = sasl_listmech(client->saslconn, NULL, /* Don't need to set user */ "", /* Prefix */ @@ -2126,6 +2179,49 @@ remoteDispatchAuthSaslInit (struct qemud return 0; } + +/* We asked for an SSF layer, so sanity check that we actaully + * got what we asked for */ +static int +remoteSASLCheckSSF (struct qemud_client *client, + remote_message_header *req) { + const void *val; + int err, ssf; + + if (client->type == QEMUD_SOCK_TYPE_TLS || + client->type == QEMUD_SOCK_TYPE_UNIX) + return 0; /* TLS or UNIX domain sockets trivially OK */ + + err = sasl_getprop(client->saslconn, SASL_SSF, &val); + if (err != SASL_OK) { + qemudLog(QEMUD_ERR, "cannot query SASL ssf on connection %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + ssf = *(const int *)val; + REMOTE_DEBUG("negotiated an SSF of %d", ssf); + if (ssf < 56) { /* 56 is good for Kerberos */ + qemudLog(QEMUD_ERR, "negotiated SSF %d was not strong enough", ssf); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + + /* Only setup for read initially, because we're about to send an RPC + * reply which must be in plain text. When the next incoming RPC + * arrives, we'll switch on writes too + * + * cf qemudClientReadSASL in qemud.c + */ + client->saslSSF = QEMUD_SASL_SSF_READ; + + /* We have a SSF !*/ + return 0; +} /* * This starts the SASL authentication negotiation. @@ -2192,6 +2288,9 @@ remoteDispatchAuthSaslStart (struct qemu if (err == SASL_CONTINUE) { ret->complete = 0; } else { + if (remoteSASLCheckSSF(client, req) < 0) + return -2; + REMOTE_DEBUG("Authentication successful %d", client->fd); ret->complete = 1; client->auth = REMOTE_AUTH_NONE; @@ -2263,6 +2362,9 @@ remoteDispatchAuthSaslStep (struct qemud if (err == SASL_CONTINUE) { ret->complete = 0; } else { + if (remoteSASLCheckSSF(client, req) < 0) + return -2; + REMOTE_DEBUG("Authentication successful %d", client->fd); ret->complete = 1; client->auth = REMOTE_AUTH_NONE; diff -r 5a37498017ac src/remote_internal.c --- a/src/remote_internal.c Wed Nov 28 23:00:04 2007 -0500 +++ b/src/remote_internal.c Wed Nov 28 23:00:47 2007 -0500 @@ -79,6 +79,9 @@ struct private_data { FILE *debugLog; /* Debug remote protocol */ #if HAVE_SASL sasl_conn_t *saslconn; /* SASL context */ + const char *saslDecoded; + unsigned int saslDecodedLength; + unsigned int saslDecodedOffset; #endif }; @@ -2907,15 +2910,14 @@ static char *addrToString(struct sockadd /* Perform the SASL authentication process * - * XXX negotiate a session encryption layer for non-TLS sockets * XXX fetch credentials from a libvirt client app callback - * XXX max packet size spec * XXX better mechanism negotiation ? Ask client app ? */ static int remoteAuthSASL (virConnectPtr conn, struct private_data *priv, int in_open) { sasl_conn_t *saslconn = NULL; + sasl_security_properties_t secprops; remote_auth_sasl_init_ret iret; remote_auth_sasl_start_args sargs; remote_auth_sasl_start_ret sret; @@ -2929,6 +2931,8 @@ remoteAuthSASL (virConnectPtr conn, stru struct sockaddr_storage sa; socklen_t salen; char *localAddr, *remoteAddr; + const void *val; + sasl_ssf_t ssf; remoteDebug(priv, "Client initialize SASL authentication"); /* Sets up the SASL library as a whole */ @@ -2984,6 +2988,51 @@ remoteAuthSASL (virConnectPtr conn, stru VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "Failed to create SASL client context: %d (%s)", err, sasl_errstring(err, NULL, NULL)); + return -1; + } + + /* Initialize some connection props we care about */ + if (priv->uses_tls) { + gnutls_cipher_algorithm_t cipher; + + cipher = gnutls_cipher_get(priv->session); + if (!(ssf = (sasl_ssf_t)gnutls_cipher_get_key_size(cipher))) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_INTERNAL_ERROR, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "invalid cipher size for TLS session"); + sasl_dispose(&saslconn); + return -1; + } + ssf *= 8; /* key size is bytes, sasl wants bits */ + + remoteDebug(priv, "Setting external SSF %d", ssf); + err = sasl_setprop(saslconn, SASL_SSF_EXTERNAL, &ssf); + if (err != SASL_OK) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_INTERNAL_ERROR, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "cannot set external SSF %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + sasl_dispose(&saslconn); + return -1; + } + } + + memset (&secprops, 0, sizeof secprops); + /* If we've got TLS, we don't care about SSF */ + secprops.min_ssf = priv->uses_tls ? 0 : 56; /* Equiv to DES supported by all Kerberos */ + secprops.max_ssf = priv->uses_tls ? 0 : 100000; /* Very strong ! AES == 256 */ + secprops.maxbufsize = 100000; + /* If we're not TLS, then forbid any anonymous or trivially crackable auth */ + secprops.security_flags = priv->uses_tls ? 0 : + SASL_SEC_NOANONYMOUS | SASL_SEC_NOPLAINTEXT; + + err = sasl_setprop(saslconn, SASL_SEC_PROPS, &secprops); + if (err != SASL_OK) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_INTERNAL_ERROR, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "cannot set security props %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + sasl_dispose(&saslconn); return -1; } @@ -3103,9 +3152,30 @@ remoteAuthSASL (virConnectPtr conn, stru } } + /* Check for suitable SSF if non-TLS */ + if (!priv->uses_tls) { + err = sasl_getprop(saslconn, SASL_SSF, &val); + if (err != SASL_OK) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "cannot query SASL ssf on connection %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + sasl_dispose(&saslconn); + return -1; + } + ssf = *(const int *)val; + remoteDebug(priv, "SASL SSF value %d", ssf); + if (ssf < 56) { /* 56 == DES level, good for Kerberos */ + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "negotiation SSF %d was not strong enough", ssf); + sasl_dispose(&saslconn); + return -1; + } + } + remoteDebug(priv, "SASL authentication complete"); - /* XXX keep this around for wire encoding */ - sasl_dispose(&saslconn); + priv->saslconn = saslconn; return 0; } #endif /* HAVE_SASL */ @@ -3306,11 +3376,11 @@ call (virConnectPtr conn, struct private } static int -really_write (virConnectPtr conn, struct private_data *priv, - int in_open /* if we are in virConnectOpen */, - char *bytes, int len) -{ - char *p; +really_write_buf (virConnectPtr conn, struct private_data *priv, + int in_open /* if we are in virConnectOpen */, + const char *bytes, int len) +{ + const char *p; int err; p = bytes; @@ -3348,55 +3418,156 @@ really_write (virConnectPtr conn, struct } static int +really_write_plain (virConnectPtr conn, struct private_data *priv, + int in_open /* if we are in virConnectOpen */, + char *bytes, int len) +{ + return really_write_buf(conn, priv, in_open, bytes, len); +} + +#if HAVE_SASL +static int +really_write_sasl (virConnectPtr conn, struct private_data *priv, + int in_open /* if we are in virConnectOpen */, + char *bytes, int len) +{ + const char *output; + unsigned int outputlen; + int err; + + err = sasl_encode(priv->saslconn, bytes, len, &output, &outputlen); + if (err != SASL_OK) { + return -1; + } + + return really_write_buf(conn, priv, in_open, output, outputlen); +} +#endif + +static int +really_write (virConnectPtr conn, struct private_data *priv, + int in_open /* if we are in virConnectOpen */, + char *bytes, int len) +{ +#if HAVE_SASL + if (priv->saslconn) + return really_write_sasl(conn, priv, in_open, bytes, len); + else +#endif + return really_write_plain(conn, priv, in_open, bytes, len); +} + +static int +really_read_buf (virConnectPtr conn, struct private_data *priv, + int in_open /* if we are in virConnectOpen */, + char *bytes, int len) +{ + int err; + + if (priv->uses_tls) { + tlsreread: + err = gnutls_record_recv (priv->session, bytes, len); + if (err < 0) { + if (err == GNUTLS_E_INTERRUPTED) + goto tlsreread; + error (in_open ? NULL : conn, + VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + return -1; + } + if (err == 0) { + error (in_open ? NULL : conn, + VIR_ERR_RPC, "socket closed unexpectedly"); + return -1; + } + return err; + } else { + reread: + err = read (priv->sock, bytes, len); + if (err == -1) { + if (errno == EINTR) + goto reread; + error (in_open ? NULL : conn, + VIR_ERR_SYSTEM_ERROR, strerror (errno)); + return -1; + } + if (err == 0) { + error (in_open ? NULL : conn, + VIR_ERR_RPC, "socket closed unexpectedly"); + return -1; + } + return err; + } + + return 0; +} + +static int +really_read_plain (virConnectPtr conn, struct private_data *priv, + int in_open /* if we are in virConnectOpen */, + char *bytes, int len) +{ + do { + int ret = really_read_buf (conn, priv, in_open, bytes, len); + if (ret < 0) + return -1; + + len -= ret; + bytes += ret; + } while (len > 0); + + return 0; +} + +#if HAVE_SASL +static int +really_read_sasl (virConnectPtr conn, struct private_data *priv, + int in_open /* if we are in virConnectOpen */, + char *bytes, int len) +{ + do { + int want, got; + if (priv->saslDecoded == NULL) { + char encoded[8192]; + int encodedLen = sizeof(encoded); + int err, ret; + ret = really_read_buf (conn, priv, in_open, encoded, encodedLen); + if (ret < 0) + return -1; + + err = sasl_decode(priv->saslconn, encoded, ret, + &priv->saslDecoded, &priv->saslDecodedLength); + } + + got = priv->saslDecodedLength - priv->saslDecodedOffset; + want = len; + if (want > got) + want = got; + + memcpy(bytes, priv->saslDecoded + priv->saslDecodedOffset, want); + priv->saslDecodedOffset += want; + if (priv->saslDecodedOffset == priv->saslDecodedLength) { + priv->saslDecoded = NULL; + priv->saslDecodedOffset = priv->saslDecodedLength = 0; + } + bytes += want; + len -= want; + } while (len > 0); + + return 0; +} +#endif + +static int really_read (virConnectPtr conn, struct private_data *priv, int in_open /* if we are in virConnectOpen */, char *bytes, int len) { - char *p; - int err; - - p = bytes; - if (priv->uses_tls) { - do { - err = gnutls_record_recv (priv->session, p, len); - if (err < 0) { - if (err == GNUTLS_E_INTERRUPTED || err == GNUTLS_E_AGAIN) - continue; - error (in_open ? NULL : conn, - VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); - return -1; - } - if (err == 0) { - error (in_open ? NULL : conn, - VIR_ERR_RPC, "socket closed unexpectedly"); - return -1; - } - len -= err; - p += err; - } - while (len > 0); - } else { - do { - err = read (priv->sock, p, len); - if (err == -1) { - if (errno == EINTR || errno == EAGAIN) - continue; - error (in_open ? NULL : conn, - VIR_ERR_SYSTEM_ERROR, strerror (errno)); - return -1; - } - if (err == 0) { - error (in_open ? NULL : conn, - VIR_ERR_RPC, "socket closed unexpectedly"); - return -1; - } - len -= err; - p += err; - } - while (len > 0); - } - - return 0; +#if HAVE_SASL + if (priv->saslconn) + return really_read_sasl (conn, priv, in_open, bytes, len); + else +#endif + return really_read_plain (conn, priv, in_open, bytes, len); } /* For errors internal to this library. */ -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

On Thu, Nov 29, 2007 at 05:18:06PM +0000, Daniel P. Berrange wrote: Rebased to take account of Jim's changes, and incorporated fixes to the config file diff -r b68f6ec36358 qemud/Makefile.am --- a/qemud/Makefile.am Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/Makefile.am Fri Nov 30 15:15:26 2007 -0500 @@ -101,14 +101,14 @@ remote.c: remote_dispatch_prototypes.h \ remote_dispatch_localvars.h \ remote_dispatch_proc_switch.h -remote_dispatch_prototypes.h: remote_generate_stubs.pl remote_protocol.x - perl -w remote_generate_stubs.pl -i remote_protocol.x > $@ +remote_dispatch_prototypes.h: $(srcdir)/remote_generate_stubs.pl remote_protocol.x + perl -w $(srcdir)/remote_generate_stubs.pl -i $(srcdir)/remote_protocol.x > $@ -remote_dispatch_localvars.h: remote_generate_stubs.pl remote_protocol.x - perl -w remote_generate_stubs.pl -v remote_protocol.x > $@ +remote_dispatch_localvars.h: $(srcdir)/remote_generate_stubs.pl remote_protocol.x + perl -w $(srcdir)/remote_generate_stubs.pl -v $(srcdir)/remote_protocol.x > $@ -remote_dispatch_proc_switch.h: remote_generate_stubs.pl remote_protocol.x - perl -w remote_generate_stubs.pl -w remote_protocol.x > $@ +remote_dispatch_proc_switch.h: $(srcdir)/remote_generate_stubs.pl remote_protocol.x + perl -w $(srcdir)/remote_generate_stubs.pl -w $(srcdir)/remote_protocol.x > $@ if LIBVIRT_INIT_SCRIPTS_RED_HAT install-init: libvirtd.init diff -r b68f6ec36358 qemud/internal.h --- a/qemud/internal.h Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/internal.h Fri Nov 30 15:15:26 2007 -0500 @@ -109,6 +109,7 @@ struct qemud_client { const char *saslEncoded; unsigned int saslEncodedLength; unsigned int saslEncodedOffset; + char *saslUsername; #endif unsigned int incomingSerial; @@ -151,6 +152,9 @@ struct qemud_server { #ifdef HAVE_AVAHI struct libvirtd_mdns *mdns; #endif +#if HAVE_SASL + char **saslUsernameWhitelist; +#endif }; void qemudLog(int priority, const char *fmt, ...) diff -r b68f6ec36358 qemud/libvirtd.conf --- a/qemud/libvirtd.conf Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/libvirtd.conf Fri Nov 30 15:15:26 2007 -0500 @@ -2,6 +2,11 @@ # # For further information consult http://libvirt.org/format.html + +################################################################# +# +# Network connectivitiy controls +# # Flag listening for secure TLS connections on the public TCP/IP port. # NB, must pass the --listen flag to the libvirtd process for this to @@ -11,28 +16,30 @@ # using this capability. # # This is enabled by default, uncomment this to disable it -# listen_tls = 0 +#listen_tls = 0 # Listen for unencrypted TCP connections on the public TCP/IP port. # NB, must pass the --listen flag to the libvirtd process for this to # have any effect. # -# NB, this is insecure. Do not use except for development. +# Using the TCP socket requires SASL authentication by default. Only +# SASL mechanisms which support data encryption are allowed. This is +# DIGEST_MD5 and GSSAPI (Kerberos5) # # This is disabled by default, uncomment this to enable it. -# listen_tcp = 1 +#listen_tcp = 1 # Override the port for accepting secure TLS connections # This can be a port number, or service name # -# tls_port = "16514" +#tls_port = "16514" # Override the port for accepting insecure TCP connections # This can be a port number, or service name -# -# tcp_port = "16509" +# +#tcp_port = "16509" @@ -42,39 +49,123 @@ # stopping the Avahi daemon # # This is enabled by default, uncomment this to disable it -# mdns_adv = 0 +#mdns_adv = 0 # Override the default mDNS advertizement name. This must be # unique on the immediate broadcast network. -# +# # The default is "Virtualization Host HOSTNAME", where HOSTNAME # is subsituted for the short hostname of the machine (without domain) # -# mdns_name "Virtualization Host Joe Demo" - - +#mdns_name = "Virtualization Host Joe Demo" + + +################################################################# +# +# UNIX socket access controls +# # Set the UNIX domain socket group ownership. This can be used to # allow a 'trusted' set of users access to management capabilities # without becoming root. -# -# This is restricted to 'root' by default. -# unix_sock_group "libvirt" +# +# This is restricted to 'root' by default. +#unix_sock_group = "libvirt" # Set the UNIX socket permissions for the R/O socket. This is used # for monitoring VM status only # # Default allows any user. If setting group ownership may want to # restrict this to: -# unix_sock_ro_perms "0777" +#unix_sock_ro_perms = "0777" # Set the UNIX socket permissions for the R/W socket. This is used # for full management of VMs # # Default allows only root. If setting group ownership may want to # relax this to: -# unix_sock_rw_perms "octal-perms" "0770" - +#unix_sock_rw_perms = "0770" + + + +################################################################# +# +# Authentication. +# +# - none: do not perform auth checks. If you can connect to the +# socket you are allowed. This is suitable if there are +# restrictions on connecting to the socket (eg, UNIX +# socket permissions), or if there is a lower layer in +# the network providing auth (eg, TLS/x509 certificates) +# +# - sasl: use SASL infrastructure. The actual auth scheme is then +# controlled from /etc/sasl2/libvirt.conf. For the TCP +# socket only GSSAPI & DIGEST-MD5 mechanisms will be used. +# For non-TCP or TLS sockets, any scheme is allowed. +# + +# Set an authentication scheme for UNIX read-only sockets +# By default socket permissions allow anyone to connect +# +# To restrict monitoring of domains you may wish to enable +# an authentication mechanism here +#auth_unix_ro = "none" + +# Set an authentication scheme for UNIX read-write sockets +# By default socket permissions only allow root. +# +# If the unix_sock_rw_perms are changed you may wish to enable +# an authentication mechanism here +#auth_unix_rw = "none" + +# Change the authentication scheme for TCP sockets. +# +# If you don't enable SASL, then all TCP traffic is cleartext. +# Don't do this outside of a dev/test scenario. For real world +# use, always enable SASL and use the GSSAPI or DIGEST-MD5 +# mechanism in /etc/sasl2/libvirt.conf +#auth_tcp = "sasl" + +# Change the authentication scheme for TLS sockets. +# +# TLS sockets already have encryption provided by the TLS +# layer, and limited authentication is done by certificates +# +# It is possible to make use of any SASL authentication +# mechanism as well, by using 'sasl' for this option +#auth_tls = "none" + + + +################################################################# +# +# TLS x509 certificate configuration +# + + +# Override the default server key file path +# +#key_file = "/etc/pki/libvirt/private/serverkey.pem" + +# Override the default server certificate file path +# +#cert_file = "/etc/pki/libvirt/servercert.pem" + +# Override the default CA certificate path +# +#ca_file = "/etc/pki/CA/cacert.pem" + +# Specify a certificate revocation list. +# +# Defaults to not using a CRL, uncomment to enable it +#crl_file = "/etc/pki/CA/crl.pem" + + + +################################################################# +# +# Authorization controls +# # Flag to disable verification of client certificates @@ -85,36 +176,11 @@ # # Default is to always verify. Uncommenting this will disable # verification - make sure an IP whitelist is set -# tls_no_verify_certificate 1 - -# Flag to disable verification of client IP address -# -# Client IP address will be verified against the CommonName field -# of the x509 certificate. This has minimal security benefit since -# it is easy to spoof source IP. -# -# Uncommenting this will disable verification -# tls_no_verify_address 1 - -# Override the default server key file path -# -# key_file "/etc/pki/libvirt/private/serverkey.pem" - -# Override the default server certificate file path -# -# cert_file "/etc/pki/libvirt/servercert.pem" - -# Override the default CA certificate path -# -# ca_file "/etc/pki/CA/cacert.pem" - -# Specify a certificate revocation list. -# -# Defaults to not using a CRL, uncomment to enable it -# crl_file "/etc/pki/CA/crl.pem" +#tls_no_verify_certificate = 1 + # A whitelist of allowed x509 Distinguished Names -# This list may contain wildcards such as +# This list may contain wildcards such as # # "C=GB,ST=London,L=London,O=Red Hat,CN=*" # @@ -124,18 +190,23 @@ # entirely rather than using empty list to disable these checks # # By default, no DN's are checked -# tls_allowed_dn_list ["DN1", "DN2"] - - -# A whitelist of allowed client IP addresses -# -# This list may contain wildcards such as 192.168.* See the POSIX fnmatch -# function for the format of the wildcards. +#tls_allowed_dn_list = ["DN1", "DN2"] + + +# A whitelist of allowed SASL usernames. The format for usernames +# depends on the SASL authentication mechanism. Kerberos usernames +# look like username@REALM +# +# This list may contain wildcards such as +# +# &quot;*(a)EXAMPLE.COM&quot; +# +# See the POSIX fnmatch function for the format of the wildcards. # # NB If this is an empty list, no client can connect, so comment out # entirely rather than using empty list to disable these checks # -# By default, no IP's are checked. This can be IPv4 or IPv6 addresses -# tls_allowed_ip_list ["ip1", "ip2", "ip3"] - - +# By default, no Username's are checked +#sasl_allowed_username_list = [&quot;joe(a)EXAMPLE.COM&quot;, &quot;fred(a)EXAMPLE.COM&quot; ] + + diff -r b68f6ec36358 qemud/qemud.c --- a/qemud/qemud.c Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/qemud.c Fri Nov 30 15:15:26 2007 -0500 @@ -77,14 +77,21 @@ static int unix_sock_rw_mask = 0700; /* static int unix_sock_rw_mask = 0700; /* Allow user only */ static int unix_sock_ro_mask = 0777; /* Allow world */ +static int auth_unix_rw = REMOTE_AUTH_NONE; +static int auth_unix_ro = REMOTE_AUTH_NONE; +#if HAVE_SASL +static int auth_tcp = REMOTE_AUTH_SASL; +#else +static int auth_tcp = REMOTE_AUTH_NONE; +#endif +static int auth_tls = REMOTE_AUTH_NONE; + #ifdef HAVE_AVAHI static int mdns_adv = 1; static char *mdns_name = NULL; #endif static int tls_no_verify_certificate = 0; -static int tls_no_verify_address = 0; -static char **tls_allowed_ip_list = NULL; static char **tls_allowed_dn_list = NULL; static char *key_file = (char *) LIBVIRT_SERVERKEY; @@ -450,7 +457,7 @@ static int qemudWritePidFile(const char } static int qemudListenUnix(struct qemud_server *server, - const char *path, int readonly) { + const char *path, int readonly, int auth) { struct qemud_socket *sock = calloc(1, sizeof(struct qemud_socket)); struct sockaddr_un addr; mode_t oldmask; @@ -464,6 +471,7 @@ static int qemudListenUnix(struct qemud_ sock->readonly = readonly; sock->port = -1; sock->type = QEMUD_SOCK_TYPE_UNIX; + sock->auth = auth; if ((sock->fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) { qemudLog(QEMUD_ERR, "Failed to create socket: %s", @@ -701,6 +709,27 @@ static int qemudInitPaths(struct qemud_s static struct qemud_server *qemudInitialize(int sigread) { struct qemud_server *server; + + if (!(server = calloc(1, sizeof(struct qemud_server)))) { + qemudLog(QEMUD_ERR, "Failed to allocate struct qemud_server"); + return NULL; + } + + server->sigread = sigread; + + __virEventRegisterImpl(virEventAddHandleImpl, + virEventUpdateHandleImpl, + virEventRemoveHandleImpl, + virEventAddTimeoutImpl, + virEventUpdateTimeoutImpl, + virEventRemoveTimeoutImpl); + + virStateInitialize(); + + return server; +} + +static struct qemud_server *qemudNetworkInit(struct qemud_server *server) { struct qemud_socket *sock; char sockname[PATH_MAX]; char roSockname[PATH_MAX]; @@ -708,56 +737,39 @@ static struct qemud_server *qemudInitial int err; #endif /* HAVE_SASL */ - if (!(server = calloc(1, sizeof(struct qemud_server)))) { - qemudLog(QEMUD_ERR, "Failed to allocate struct qemud_server"); - return NULL; - } - - /* We don't have a dom-0, so start from 1 */ - server->sigread = sigread; - roSockname[0] = '\0'; if (qemudInitPaths(server, sockname, roSockname, PATH_MAX) < 0) goto cleanup; - if (qemudListenUnix(server, sockname, 0) < 0) + if (qemudListenUnix(server, sockname, 0, auth_unix_rw) < 0) goto cleanup; - if (roSockname[0] != '\0' && qemudListenUnix(server, roSockname, 1) < 0) + if (roSockname[0] != '\0' && qemudListenUnix(server, roSockname, 1, auth_unix_ro) < 0) goto cleanup; - __virEventRegisterImpl(virEventAddHandleImpl, - virEventUpdateHandleImpl, - virEventRemoveHandleImpl, - virEventAddTimeoutImpl, - virEventUpdateTimeoutImpl, - virEventRemoveTimeoutImpl); - - virStateInitialize(); - #if HAVE_SASL - if ((err = sasl_server_init(NULL, "libvirt")) != SASL_OK) { - qemudLog(QEMUD_ERR, "Failed to initialize SASL authentication %s", - sasl_errstring(err, NULL, NULL)); - goto cleanup; + if (auth_unix_rw == REMOTE_AUTH_SASL || + auth_unix_ro == REMOTE_AUTH_SASL || + auth_tcp == REMOTE_AUTH_SASL || + auth_tls == REMOTE_AUTH_SASL) { + if ((err = sasl_server_init(NULL, "libvirt")) != SASL_OK) { + qemudLog(QEMUD_ERR, "Failed to initialize SASL authentication %s", + sasl_errstring(err, NULL, NULL)); + goto cleanup; + } } #endif if (ipsock) { -#if HAVE_SASL - if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, REMOTE_AUTH_SASL) < 0) + if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, auth_tcp) < 0) goto cleanup; -#else - if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, REMOTE_AUTH_NONE) < 0) - goto cleanup; -#endif if (listen_tls) { if (remoteInitializeGnuTLS () < 0) goto cleanup; - if (remoteListenTCP (server, tls_port, QEMUD_SOCK_TYPE_TLS, REMOTE_AUTH_NONE) < 0) + if (remoteListenTCP (server, tls_port, QEMUD_SOCK_TYPE_TLS, auth_tls) < 0) goto cleanup; } } @@ -977,53 +989,11 @@ static int static int remoteCheckAccess (struct qemud_client *client) { - char addr[NI_MAXHOST]; - char **wildcards; - int found, err; - /* Verify client certificate. */ if (remoteCheckCertificate (client->tlssession) == -1) { qemudLog (QEMUD_ERR, "remoteCheckCertificate: failed to verify client's certificate"); if (!tls_no_verify_certificate) return -1; else qemudLog (QEMUD_INFO, "remoteCheckCertificate: tls_no_verify_certificate is set so the bad certificate is ignored"); - } - - /*----- IP address check, similar to tcp wrappers -----*/ - - /* Convert IP address to printable string (eg. "127.0.0.1" or "::1"). */ - err = getnameinfo ((struct sockaddr *) &client->addr, client->addrlen, - addr, sizeof addr, NULL, 0, - NI_NUMERICHOST); - if (err != 0) { - qemudLog (QEMUD_ERR, "getnameinfo: %s", gai_strerror (err)); - return -1; - } - - /* Verify the client is on the list of allowed clients. - * - * NB: No tls_allowed_ip_list in config file means anyone can access. - * If tls_allowed_ip_list is in the config file but empty, means no - * one can access (not particularly useful, but it's what the sysadmin - * would expect). - */ - wildcards = tls_allowed_ip_list; - if (wildcards) { - found = 0; - - while (*wildcards) { - if (fnmatch (*wildcards, addr, 0) == 0) { - found = 1; - break; - } - wildcards++; - } - } else - found = 1; - - if (!found) { - qemudLog (QEMUD_ERR, "remoteCheckAccess: client's IP address (%s) is not on the list of allowed clients (tls_allowed_ip_list)", addr); - if (!tls_no_verify_address) return -1; - else qemudLog (QEMUD_INFO, "remoteCheckAccess: tls_no_verify_address is set so the client's IP address is ignored"); } /* Checks have succeeded. Write a '\1' byte back to the client to @@ -1150,6 +1120,7 @@ static void qemudDispatchClientFailure(s #if HAVE_SASL if (client->saslconn) sasl_dispose(&client->saslconn); + if (client->saslUsername) free(client->saslUsername); #endif if (client->tlssession) gnutls_deinit (client->tlssession); close(client->fd); @@ -1651,6 +1622,14 @@ static void qemudCleanup(struct qemud_se sock = next; } + if (server->saslUsernameWhitelist) { + char **list = server->saslUsernameWhitelist; + while (*list) { + if (*list) + free(*list); + list++; + } + } virStateCleanup(); @@ -1782,11 +1761,41 @@ checkType (virConfValuePtr p, const char } \ } while (0) + +static int remoteConfigGetAuth(virConfPtr conf, const char *key, int *auth, const char *filename) { + virConfValuePtr p; + + p = virConfGetValue (conf, key); + if (!p) + return 0; + + if (p->type != VIR_CONF_STRING) { + qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: %s: should be a string\n", filename, key); + return -1; + } + + if (!p->str) + return 0; + + if (STREQ(p->str, "none")) { + *auth = REMOTE_AUTH_NONE; +#if HAVE_SASL + } else if (STREQ(p->str, "sasl")) { + *auth = REMOTE_AUTH_SASL; +#endif + } else { + qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: %s: unsupported auth %s\n", filename, key, p->str); + return -1; + } + + return 0; +} + /* Read the config file if it exists. * Only used in the remote case, hence the name. */ static int -remoteReadConfigFile (const char *filename) +remoteReadConfigFile (struct qemud_server *server, const char *filename) { virConfPtr conf; @@ -1806,6 +1815,15 @@ remoteReadConfigFile (const char *filena GET_CONF_STR (conf, filename, tls_port); GET_CONF_STR (conf, filename, tcp_port); + + if (remoteConfigGetAuth(conf, "auth_unix_rw", &auth_unix_rw, filename) < 0) + return -1; + if (remoteConfigGetAuth(conf, "auth_unix_ro", &auth_unix_ro, filename) < 0) + return -1; + if (remoteConfigGetAuth(conf, "auth_tcp", &auth_tcp, filename) < 0) + return -1; + if (remoteConfigGetAuth(conf, "auth_tls", &auth_tls, filename) < 0) + return -1; GET_CONF_STR (conf, filename, unix_sock_group); if (unix_sock_group) { @@ -1852,7 +1870,6 @@ remoteReadConfigFile (const char *filena #endif GET_CONF_INT (conf, filename, tls_no_verify_certificate); - GET_CONF_INT (conf, filename, tls_no_verify_address); GET_CONF_STR (conf, filename, key_file); GET_CONF_STR (conf, filename, cert_file); @@ -1863,8 +1880,8 @@ remoteReadConfigFile (const char *filena &tls_allowed_dn_list, filename) < 0) goto free_and_fail; - if (remoteConfigGetStringList (conf, "tls_allowed_ip_list", - &tls_allowed_ip_list, filename) < 0) + if (remoteConfigGetStringList (conf, "sasl_allowed_username_list", + &server->saslUsernameWhitelist, filename) < 0) goto free_and_fail; virConfFree (conf); @@ -1890,14 +1907,6 @@ remoteReadConfigFile (const char *filena free (tls_allowed_dn_list[i]); free (tls_allowed_dn_list); tls_allowed_dn_list = NULL; - } - - if (tls_allowed_ip_list) { - int i; - for (i = 0; tls_allowed_ip_list[i]; i++) - free (tls_allowed_ip_list[i]); - free (tls_allowed_ip_list); - tls_allowed_ip_list = NULL; } return -1; @@ -2020,13 +2029,6 @@ int main(int argc, char **argv) { } } - /* Read the config file (if it exists). */ - if (remoteReadConfigFile (remote_config_file) < 0) - goto error1; - - if (godaemon) - openlog("libvirtd", 0, 0); - if (pipe(sigpipe) < 0 || qemudSetNonBlock(sigpipe[0]) < 0 || qemudSetNonBlock(sigpipe[1]) < 0) { @@ -2034,8 +2036,38 @@ int main(int argc, char **argv) { strerror(errno)); goto error1; } - sigwrite = sigpipe[1]; + + if (!(server = qemudInitialize(sigpipe[0]))) { + ret = 2; + goto error1; + } + + /* Read the config file (if it exists). */ + if (remoteReadConfigFile (server, remote_config_file) < 0) + goto error1; + + if (godaemon) { + int pid; + openlog("libvirtd", 0, 0); + pid = qemudGoDaemon(); + if (pid < 0) { + qemudLog(QEMUD_ERR, "Failed to fork as daemon: %s", + strerror(errno)); + goto error1; + } + if (pid > 0) + goto out; + + /* Choose the name of the PID file. */ + if (!pid_file) { + if (REMOTE_PID_FILE[0] != '\0') + pid_file = REMOTE_PID_FILE; + } + + if (pid_file && qemudWritePidFile (pid_file) < 0) + goto error1; + } sig_action.sa_handler = sig_handler; sig_action.sa_flags = 0; @@ -2049,31 +2081,6 @@ int main(int argc, char **argv) { sig_action.sa_handler = SIG_IGN; sigaction(SIGPIPE, &sig_action, NULL); - - if (godaemon) { - int pid = qemudGoDaemon(); - if (pid < 0) { - qemudLog(QEMUD_ERR, "Failed to fork as daemon: %s", - strerror(errno)); - goto error1; - } - if (pid > 0) - goto out; - - /* Choose the name of the PID file. */ - if (!pid_file) { - if (REMOTE_PID_FILE[0] != '\0') - pid_file = REMOTE_PID_FILE; - } - - if (pid_file && qemudWritePidFile (pid_file) < 0) - goto error1; - } - - if (!(server = qemudInitialize(sigpipe[0]))) { - ret = 2; - goto error2; - } if (virEventAddHandleImpl(sigpipe[0], POLLIN, @@ -2081,6 +2088,11 @@ int main(int argc, char **argv) { server) < 0) { qemudLog(QEMUD_ERR, "Failed to register callback for signal pipe"); ret = 3; + goto error2; + } + + if (!(server = qemudNetworkInit(server))) { + ret = 2; goto error2; } diff -r b68f6ec36358 qemud/remote.c --- a/qemud/remote.c Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/remote.c Fri Nov 30 15:15:26 2007 -0500 @@ -44,6 +44,7 @@ #include <getopt.h> #include <ctype.h> #include <assert.h> +#include <fnmatch.h> #include <libvirt/virterror.h> @@ -65,14 +66,18 @@ static void make_nonnull_network (remote #include "remote_dispatch_prototypes.h" -typedef int (*dispatch_fn) (struct qemud_client *client, remote_message_header *req, char *args, char *ret); +typedef int (*dispatch_fn) (struct qemud_server *server, + struct qemud_client *client, + remote_message_header *req, + char *args, + char *ret); /* This function gets called from qemud when it detects an incoming * remote protocol message. At this point, client->buffer contains * the full call message (including length word which we skip). */ void -remoteDispatchClientRequest (struct qemud_server *server ATTRIBUTE_UNUSED, +remoteDispatchClientRequest (struct qemud_server *server, struct qemud_client *client) { XDR xdr; @@ -158,7 +163,7 @@ remoteDispatchClientRequest (struct qemu xdr_destroy (&xdr); /* Call function. */ - rv = fn (client, &req, args, ret); + rv = fn (server, client, &req, args, ret); xdr_free (args_filter, args); /* Dispatch function must return -2, -1 or 0. Anything else is @@ -398,7 +403,8 @@ remoteDispatchError (struct qemud_client /*----- Functions. -----*/ static int -remoteDispatchOpen (struct qemud_client *client, remote_message_header *req, +remoteDispatchOpen (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, struct remote_open_args *args, void *ret ATTRIBUTE_UNUSED) { const char *name; @@ -437,7 +443,8 @@ remoteDispatchOpen (struct qemud_client } static int -remoteDispatchClose (struct qemud_client *client, remote_message_header *req, +remoteDispatchClose (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, void *ret ATTRIBUTE_UNUSED) { int rv; @@ -450,7 +457,8 @@ remoteDispatchClose (struct qemud_client } static int -remoteDispatchSupportsFeature (struct qemud_client *client, remote_message_header *req, +remoteDispatchSupportsFeature (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_supports_feature_args *args, remote_supports_feature_ret *ret) { CHECK_CONN(client); @@ -462,7 +470,8 @@ remoteDispatchSupportsFeature (struct qe } static int -remoteDispatchGetType (struct qemud_client *client, remote_message_header *req, +remoteDispatchGetType (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_type_ret *ret) { const char *type; @@ -484,7 +493,8 @@ remoteDispatchGetType (struct qemud_clie } static int -remoteDispatchGetVersion (struct qemud_client *client, +remoteDispatchGetVersion (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_version_ret *ret) @@ -500,7 +510,8 @@ remoteDispatchGetVersion (struct qemud_c } static int -remoteDispatchGetHostname (struct qemud_client *client, +remoteDispatchGetHostname (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_hostname_ret *ret) @@ -516,7 +527,8 @@ remoteDispatchGetHostname (struct qemud_ } static int -remoteDispatchGetMaxVcpus (struct qemud_client *client, +remoteDispatchGetMaxVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_get_max_vcpus_args *args, remote_get_max_vcpus_ret *ret) @@ -532,7 +544,8 @@ remoteDispatchGetMaxVcpus (struct qemud_ } static int -remoteDispatchNodeGetInfo (struct qemud_client *client, +remoteDispatchNodeGetInfo (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_node_get_info_ret *ret) @@ -556,7 +569,8 @@ remoteDispatchNodeGetInfo (struct qemud_ } static int -remoteDispatchGetCapabilities (struct qemud_client *client, +remoteDispatchGetCapabilities (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_capabilities_ret *ret) @@ -572,7 +586,8 @@ remoteDispatchGetCapabilities (struct qe } static int -remoteDispatchDomainGetSchedulerType (struct qemud_client *client, +remoteDispatchDomainGetSchedulerType (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_type_args *args, remote_domain_get_scheduler_type_ret *ret) @@ -601,7 +616,8 @@ remoteDispatchDomainGetSchedulerType (st } static int -remoteDispatchDomainGetSchedulerParameters (struct qemud_client *client, +remoteDispatchDomainGetSchedulerParameters (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_parameters_args *args, remote_domain_get_scheduler_parameters_ret *ret) @@ -687,7 +703,8 @@ remoteDispatchDomainGetSchedulerParamete } static int -remoteDispatchDomainSetSchedulerParameters (struct qemud_client *client, +remoteDispatchDomainSetSchedulerParameters (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_scheduler_parameters_args *args, void *ret ATTRIBUTE_UNUSED) @@ -747,7 +764,8 @@ remoteDispatchDomainSetSchedulerParamete } static int -remoteDispatchDomainBlockStats (struct qemud_client *client, +remoteDispatchDomainBlockStats (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret) @@ -777,7 +795,8 @@ remoteDispatchDomainBlockStats (struct q } static int -remoteDispatchDomainInterfaceStats (struct qemud_client *client, +remoteDispatchDomainInterfaceStats (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_interface_stats_args *args, remote_domain_interface_stats_ret *ret) @@ -810,7 +829,8 @@ remoteDispatchDomainInterfaceStats (stru } static int -remoteDispatchDomainAttachDevice (struct qemud_client *client, +remoteDispatchDomainAttachDevice (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret ATTRIBUTE_UNUSED) @@ -833,7 +853,8 @@ remoteDispatchDomainAttachDevice (struct } static int -remoteDispatchDomainCreate (struct qemud_client *client, +remoteDispatchDomainCreate (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_create_args *args, void *ret ATTRIBUTE_UNUSED) @@ -856,7 +877,8 @@ remoteDispatchDomainCreate (struct qemud } static int -remoteDispatchDomainCreateLinux (struct qemud_client *client, +remoteDispatchDomainCreateLinux (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_create_linux_args *args, remote_domain_create_linux_ret *ret) @@ -874,7 +896,8 @@ remoteDispatchDomainCreateLinux (struct } static int -remoteDispatchDomainDefineXml (struct qemud_client *client, +remoteDispatchDomainDefineXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_define_xml_args *args, remote_domain_define_xml_ret *ret) @@ -892,7 +915,8 @@ remoteDispatchDomainDefineXml (struct qe } static int -remoteDispatchDomainDestroy (struct qemud_client *client, +remoteDispatchDomainDestroy (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_destroy_args *args, void *ret ATTRIBUTE_UNUSED) @@ -913,7 +937,8 @@ remoteDispatchDomainDestroy (struct qemu } static int -remoteDispatchDomainDetachDevice (struct qemud_client *client, +remoteDispatchDomainDetachDevice (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_detach_device_args *args, void *ret ATTRIBUTE_UNUSED) @@ -937,7 +962,8 @@ remoteDispatchDomainDetachDevice (struct } static int -remoteDispatchDomainDumpXml (struct qemud_client *client, +remoteDispatchDomainDumpXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_dump_xml_args *args, remote_domain_dump_xml_ret *ret) @@ -962,7 +988,8 @@ remoteDispatchDomainDumpXml (struct qemu } static int -remoteDispatchDomainGetAutostart (struct qemud_client *client, +remoteDispatchDomainGetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_autostart_args *args, remote_domain_get_autostart_ret *ret) @@ -985,7 +1012,8 @@ remoteDispatchDomainGetAutostart (struct } static int -remoteDispatchDomainGetInfo (struct qemud_client *client, +remoteDispatchDomainGetInfo (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_info_args *args, remote_domain_get_info_ret *ret) @@ -1017,7 +1045,8 @@ remoteDispatchDomainGetInfo (struct qemu } static int -remoteDispatchDomainGetMaxMemory (struct qemud_client *client, +remoteDispatchDomainGetMaxMemory (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_max_memory_args *args, remote_domain_get_max_memory_ret *ret) @@ -1041,7 +1070,8 @@ remoteDispatchDomainGetMaxMemory (struct } static int -remoteDispatchDomainGetMaxVcpus (struct qemud_client *client, +remoteDispatchDomainGetMaxVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_max_vcpus_args *args, remote_domain_get_max_vcpus_ret *ret) @@ -1065,7 +1095,8 @@ remoteDispatchDomainGetMaxVcpus (struct } static int -remoteDispatchDomainGetOsType (struct qemud_client *client, +remoteDispatchDomainGetOsType (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_os_type_args *args, remote_domain_get_os_type_ret *ret) @@ -1090,7 +1121,8 @@ remoteDispatchDomainGetOsType (struct qe } static int -remoteDispatchDomainGetVcpus (struct qemud_client *client, +remoteDispatchDomainGetVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_vcpus_args *args, remote_domain_get_vcpus_ret *ret) @@ -1154,7 +1186,8 @@ remoteDispatchDomainGetVcpus (struct qem } static int -remoteDispatchDomainMigratePrepare (struct qemud_client *client, +remoteDispatchDomainMigratePrepare (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_migrate_prepare_args *args, remote_domain_migrate_prepare_ret *ret) @@ -1189,7 +1222,8 @@ remoteDispatchDomainMigratePrepare (stru } static int -remoteDispatchDomainMigratePerform (struct qemud_client *client, +remoteDispatchDomainMigratePerform (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_migrate_perform_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1218,7 +1252,8 @@ remoteDispatchDomainMigratePerform (stru } static int -remoteDispatchDomainMigrateFinish (struct qemud_client *client, +remoteDispatchDomainMigrateFinish (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_migrate_finish_args *args, remote_domain_migrate_finish_ret *ret) @@ -1239,7 +1274,8 @@ remoteDispatchDomainMigrateFinish (struc } static int -remoteDispatchListDefinedDomains (struct qemud_client *client, +remoteDispatchListDefinedDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_defined_domains_args *args, remote_list_defined_domains_ret *ret) @@ -1264,7 +1300,8 @@ remoteDispatchListDefinedDomains (struct } static int -remoteDispatchDomainLookupById (struct qemud_client *client, +remoteDispatchDomainLookupById (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_id_args *args, remote_domain_lookup_by_id_ret *ret) @@ -1281,7 +1318,8 @@ remoteDispatchDomainLookupById (struct q } static int -remoteDispatchDomainLookupByName (struct qemud_client *client, +remoteDispatchDomainLookupByName (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_name_args *args, remote_domain_lookup_by_name_ret *ret) @@ -1298,7 +1336,8 @@ remoteDispatchDomainLookupByName (struct } static int -remoteDispatchDomainLookupByUuid (struct qemud_client *client, +remoteDispatchDomainLookupByUuid (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_uuid_args *args, remote_domain_lookup_by_uuid_ret *ret) @@ -1315,7 +1354,8 @@ remoteDispatchDomainLookupByUuid (struct } static int -remoteDispatchNumOfDefinedDomains (struct qemud_client *client, +remoteDispatchNumOfDefinedDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_defined_domains_ret *ret) @@ -1329,7 +1369,8 @@ remoteDispatchNumOfDefinedDomains (struc } static int -remoteDispatchDomainPinVcpu (struct qemud_client *client, +remoteDispatchDomainPinVcpu (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_pin_vcpu_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1362,7 +1403,8 @@ remoteDispatchDomainPinVcpu (struct qemu } static int -remoteDispatchDomainReboot (struct qemud_client *client, +remoteDispatchDomainReboot (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_reboot_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1385,7 +1427,8 @@ remoteDispatchDomainReboot (struct qemud } static int -remoteDispatchDomainRestore (struct qemud_client *client, +remoteDispatchDomainRestore (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_restore_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1399,7 +1442,8 @@ remoteDispatchDomainRestore (struct qemu } static int -remoteDispatchDomainResume (struct qemud_client *client, +remoteDispatchDomainResume (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_resume_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1422,7 +1466,8 @@ remoteDispatchDomainResume (struct qemud } static int -remoteDispatchDomainSave (struct qemud_client *client, +remoteDispatchDomainSave (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_save_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1445,7 +1490,8 @@ remoteDispatchDomainSave (struct qemud_c } static int -remoteDispatchDomainCoreDump (struct qemud_client *client, +remoteDispatchDomainCoreDump (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_core_dump_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1468,7 +1514,8 @@ remoteDispatchDomainCoreDump (struct qem } static int -remoteDispatchDomainSetAutostart (struct qemud_client *client, +remoteDispatchDomainSetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_autostart_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1491,7 +1538,8 @@ remoteDispatchDomainSetAutostart (struct } static int -remoteDispatchDomainSetMaxMemory (struct qemud_client *client, +remoteDispatchDomainSetMaxMemory (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_max_memory_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1514,7 +1562,8 @@ remoteDispatchDomainSetMaxMemory (struct } static int -remoteDispatchDomainSetMemory (struct qemud_client *client, +remoteDispatchDomainSetMemory (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_memory_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1537,7 +1586,8 @@ remoteDispatchDomainSetMemory (struct qe } static int -remoteDispatchDomainSetVcpus (struct qemud_client *client, +remoteDispatchDomainSetVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_vcpus_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1560,7 +1610,8 @@ remoteDispatchDomainSetVcpus (struct qem } static int -remoteDispatchDomainShutdown (struct qemud_client *client, +remoteDispatchDomainShutdown (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_shutdown_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1583,7 +1634,8 @@ remoteDispatchDomainShutdown (struct qem } static int -remoteDispatchDomainSuspend (struct qemud_client *client, +remoteDispatchDomainSuspend (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_suspend_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1606,7 +1658,8 @@ remoteDispatchDomainSuspend (struct qemu } static int -remoteDispatchDomainUndefine (struct qemud_client *client, +remoteDispatchDomainUndefine (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_undefine_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1629,7 +1682,8 @@ remoteDispatchDomainUndefine (struct qem } static int -remoteDispatchListDefinedNetworks (struct qemud_client *client, +remoteDispatchListDefinedNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_defined_networks_args *args, remote_list_defined_networks_ret *ret) @@ -1654,7 +1708,8 @@ remoteDispatchListDefinedNetworks (struc } static int -remoteDispatchListDomains (struct qemud_client *client, +remoteDispatchListDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_domains_args *args, remote_list_domains_ret *ret) @@ -1678,7 +1733,8 @@ remoteDispatchListDomains (struct qemud_ } static int -remoteDispatchListNetworks (struct qemud_client *client, +remoteDispatchListNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_networks_args *args, remote_list_networks_ret *ret) @@ -1703,7 +1759,8 @@ remoteDispatchListNetworks (struct qemud } static int -remoteDispatchNetworkCreate (struct qemud_client *client, +remoteDispatchNetworkCreate (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_create_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1726,7 +1783,8 @@ remoteDispatchNetworkCreate (struct qemu } static int -remoteDispatchNetworkCreateXml (struct qemud_client *client, +remoteDispatchNetworkCreateXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_create_xml_args *args, remote_network_create_xml_ret *ret) @@ -1743,7 +1801,8 @@ remoteDispatchNetworkCreateXml (struct q } static int -remoteDispatchNetworkDefineXml (struct qemud_client *client, +remoteDispatchNetworkDefineXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_define_xml_args *args, remote_network_define_xml_ret *ret) @@ -1760,7 +1819,8 @@ remoteDispatchNetworkDefineXml (struct q } static int -remoteDispatchNetworkDestroy (struct qemud_client *client, +remoteDispatchNetworkDestroy (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_destroy_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1783,7 +1843,8 @@ remoteDispatchNetworkDestroy (struct qem } static int -remoteDispatchNetworkDumpXml (struct qemud_client *client, +remoteDispatchNetworkDumpXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_dump_xml_args *args, remote_network_dump_xml_ret *ret) @@ -1808,7 +1869,8 @@ remoteDispatchNetworkDumpXml (struct qem } static int -remoteDispatchNetworkGetAutostart (struct qemud_client *client, +remoteDispatchNetworkGetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_get_autostart_args *args, remote_network_get_autostart_ret *ret) @@ -1831,7 +1893,8 @@ remoteDispatchNetworkGetAutostart (struc } static int -remoteDispatchNetworkGetBridgeName (struct qemud_client *client, +remoteDispatchNetworkGetBridgeName (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_get_bridge_name_args *args, remote_network_get_bridge_name_ret *ret) @@ -1856,7 +1919,8 @@ remoteDispatchNetworkGetBridgeName (stru } static int -remoteDispatchNetworkLookupByName (struct qemud_client *client, +remoteDispatchNetworkLookupByName (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_name_args *args, remote_network_lookup_by_name_ret *ret) @@ -1873,7 +1937,8 @@ remoteDispatchNetworkLookupByName (struc } static int -remoteDispatchNetworkLookupByUuid (struct qemud_client *client, +remoteDispatchNetworkLookupByUuid (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_uuid_args *args, remote_network_lookup_by_uuid_ret *ret) @@ -1890,7 +1955,8 @@ remoteDispatchNetworkLookupByUuid (struc } static int -remoteDispatchNetworkSetAutostart (struct qemud_client *client, +remoteDispatchNetworkSetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_set_autostart_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1913,7 +1979,8 @@ remoteDispatchNetworkSetAutostart (struc } static int -remoteDispatchNetworkUndefine (struct qemud_client *client, +remoteDispatchNetworkUndefine (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_undefine_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1936,7 +2003,8 @@ remoteDispatchNetworkUndefine (struct qe } static int -remoteDispatchNumOfDefinedNetworks (struct qemud_client *client, +remoteDispatchNumOfDefinedNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_defined_networks_ret *ret) @@ -1950,7 +2018,8 @@ remoteDispatchNumOfDefinedNetworks (stru } static int -remoteDispatchNumOfDomains (struct qemud_client *client, +remoteDispatchNumOfDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_domains_ret *ret) @@ -1964,7 +2033,8 @@ remoteDispatchNumOfDomains (struct qemud } static int -remoteDispatchNumOfNetworks (struct qemud_client *client, +remoteDispatchNumOfNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_networks_ret *ret) @@ -1979,7 +2049,8 @@ remoteDispatchNumOfNetworks (struct qemu static int -remoteDispatchAuthList (struct qemud_client *client, +remoteDispatchAuthList (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req ATTRIBUTE_UNUSED, void *args ATTRIBUTE_UNUSED, remote_auth_list_ret *ret) @@ -2034,7 +2105,8 @@ static char *addrToString(struct qemud_c * XXX callbacks for stuff like password verification ? */ static int -remoteDispatchAuthSaslInit (struct qemud_client *client, +remoteDispatchAuthSaslInit (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_auth_sasl_init_ret *ret) @@ -2223,11 +2295,67 @@ remoteSASLCheckSSF (struct qemud_client return 0; } +static int +remoteSASLCheckAccess (struct qemud_server *server, + struct qemud_client *client, + remote_message_header *req) { + const void *val; + int err; + char **wildcards; + + err = sasl_getprop(client->saslconn, SASL_USERNAME, &val); + if (err != SASL_OK) { + qemudLog(QEMUD_ERR, "cannot query SASL username on connection %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + if (val == NULL) { + qemudLog(QEMUD_ERR, "no client username was found"); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + REMOTE_DEBUG("SASL client username %s", (const char *)val); + + client->saslUsername = strdup((const char*)val); + if (client->saslUsername == NULL) { + qemudLog(QEMUD_ERR, "out of memory copying username"); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + + /* If the list is not set, allow any DN. */ + wildcards = server->saslUsernameWhitelist; + if (!wildcards) + return 0; /* No ACL, allow all */ + + while (*wildcards) { + if (fnmatch (*wildcards, client->saslUsername, 0) == 0) + return 0; /* Allowed */ + wildcards++; + } + + /* Denied */ + qemudLog(QEMUD_ERR, "SASL client %s not allowed in whitelist", client->saslUsername); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; +} + + /* * This starts the SASL authentication negotiation. */ static int -remoteDispatchAuthSaslStart (struct qemud_client *client, +remoteDispatchAuthSaslStart (struct qemud_server *server, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret) @@ -2291,6 +2419,10 @@ remoteDispatchAuthSaslStart (struct qemu if (remoteSASLCheckSSF(client, req) < 0) return -2; + /* Check username whitelist ACL */ + if (remoteSASLCheckAccess(server, client, req) < 0) + return -2; + REMOTE_DEBUG("Authentication successful %d", client->fd); ret->complete = 1; client->auth = REMOTE_AUTH_NONE; @@ -2301,7 +2433,8 @@ remoteDispatchAuthSaslStart (struct qemu static int -remoteDispatchAuthSaslStep (struct qemud_client *client, +remoteDispatchAuthSaslStep (struct qemud_server *server, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret) @@ -2365,6 +2498,10 @@ remoteDispatchAuthSaslStep (struct qemud if (remoteSASLCheckSSF(client, req) < 0) return -2; + /* Check username whitelist ACL */ + if (remoteSASLCheckAccess(server, client, req) < 0) + return -2; + REMOTE_DEBUG("Authentication successful %d", client->fd); ret->complete = 1; client->auth = REMOTE_AUTH_NONE; @@ -2376,7 +2513,8 @@ remoteDispatchAuthSaslStep (struct qemud #else /* HAVE_SASL */ static int -remoteDispatchAuthSaslInit (struct qemud_client *client, +remoteDispatchAuthSaslInit (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_auth_sasl_init_ret *ret ATTRIBUTE_UNUSED) @@ -2387,7 +2525,8 @@ remoteDispatchAuthSaslInit (struct qemud } static int -remoteDispatchAuthSaslStart (struct qemud_client *client, +remoteDispatchAuthSaslStart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args ATTRIBUTE_UNUSED, remote_auth_sasl_start_ret *ret ATTRIBUTE_UNUSED) @@ -2398,7 +2537,8 @@ remoteDispatchAuthSaslStart (struct qemu } static int -remoteDispatchAuthSaslStep (struct qemud_client *client, +remoteDispatchAuthSaslStep (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args ATTRIBUTE_UNUSED, remote_auth_sasl_step_ret *ret ATTRIBUTE_UNUSED) diff -r b68f6ec36358 qemud/remote_dispatch_prototypes.h --- a/qemud/remote_dispatch_prototypes.h Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/remote_dispatch_prototypes.h Fri Nov 30 15:15:26 2007 -0500 @@ -2,72 +2,72 @@ * Do not edit this file. Any changes you make will be lost. */ -static int remoteDispatchAuthList (struct qemud_client *client, remote_message_header *req, void *args, remote_auth_list_ret *ret); -static int remoteDispatchAuthSaslInit (struct qemud_client *client, remote_message_header *req, void *args, remote_auth_sasl_init_ret *ret); -static int remoteDispatchAuthSaslStart (struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret); -static int remoteDispatchAuthSaslStep (struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret); -static int remoteDispatchClose (struct qemud_client *client, remote_message_header *req, void *args, void *ret); -static int remoteDispatchDomainAttachDevice (struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret); -static int remoteDispatchDomainBlockStats (struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret); -static int remoteDispatchDomainCoreDump (struct qemud_client *client, remote_message_header *req, remote_domain_core_dump_args *args, void *ret); -static int remoteDispatchDomainCreate (struct qemud_client *client, remote_message_header *req, remote_domain_create_args *args, void *ret); -static int remoteDispatchDomainCreateLinux (struct qemud_client *client, remote_message_header *req, remote_domain_create_linux_args *args, remote_domain_create_linux_ret *ret); -static int remoteDispatchDomainDefineXml (struct qemud_client *client, remote_message_header *req, remote_domain_define_xml_args *args, remote_domain_define_xml_ret *ret); -static int remoteDispatchDomainDestroy (struct qemud_client *client, remote_message_header *req, remote_domain_destroy_args *args, void *ret); -static int remoteDispatchDomainDetachDevice (struct qemud_client *client, remote_message_header *req, remote_domain_detach_device_args *args, void *ret); -static int remoteDispatchDomainDumpXml (struct qemud_client *client, remote_message_header *req, remote_domain_dump_xml_args *args, remote_domain_dump_xml_ret *ret); -static int remoteDispatchDomainGetAutostart (struct qemud_client *client, remote_message_header *req, remote_domain_get_autostart_args *args, remote_domain_get_autostart_ret *ret); -static int remoteDispatchDomainGetInfo (struct qemud_client *client, remote_message_header *req, remote_domain_get_info_args *args, remote_domain_get_info_ret *ret); -static int remoteDispatchDomainGetMaxMemory (struct qemud_client *client, remote_message_header *req, remote_domain_get_max_memory_args *args, remote_domain_get_max_memory_ret *ret); -static int remoteDispatchDomainGetMaxVcpus (struct qemud_client *client, remote_message_header *req, remote_domain_get_max_vcpus_args *args, remote_domain_get_max_vcpus_ret *ret); -static int remoteDispatchDomainGetOsType (struct qemud_client *client, remote_message_header *req, remote_domain_get_os_type_args *args, remote_domain_get_os_type_ret *ret); -static int remoteDispatchDomainGetSchedulerParameters (struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_parameters_args *args, remote_domain_get_scheduler_parameters_ret *ret); -static int remoteDispatchDomainGetSchedulerType (struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_type_args *args, remote_domain_get_scheduler_type_ret *ret); -static int remoteDispatchDomainGetVcpus (struct qemud_client *client, remote_message_header *req, remote_domain_get_vcpus_args *args, remote_domain_get_vcpus_ret *ret); -static int remoteDispatchDomainInterfaceStats (struct qemud_client *client, remote_message_header *req, remote_domain_interface_stats_args *args, remote_domain_interface_stats_ret *ret); -static int remoteDispatchDomainLookupById (struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_id_args *args, remote_domain_lookup_by_id_ret *ret); -static int remoteDispatchDomainLookupByName (struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_name_args *args, remote_domain_lookup_by_name_ret *ret); -static int remoteDispatchDomainLookupByUuid (struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_uuid_args *args, remote_domain_lookup_by_uuid_ret *ret); -static int remoteDispatchDomainMigrateFinish (struct qemud_client *client, remote_message_header *req, remote_domain_migrate_finish_args *args, remote_domain_migrate_finish_ret *ret); -static int remoteDispatchDomainMigratePerform (struct qemud_client *client, remote_message_header *req, remote_domain_migrate_perform_args *args, void *ret); -static int remoteDispatchDomainMigratePrepare (struct qemud_client *client, remote_message_header *req, remote_domain_migrate_prepare_args *args, remote_domain_migrate_prepare_ret *ret); -static int remoteDispatchDomainPinVcpu (struct qemud_client *client, remote_message_header *req, remote_domain_pin_vcpu_args *args, void *ret); -static int remoteDispatchDomainReboot (struct qemud_client *client, remote_message_header *req, remote_domain_reboot_args *args, void *ret); -static int remoteDispatchDomainRestore (struct qemud_client *client, remote_message_header *req, remote_domain_restore_args *args, void *ret); -static int remoteDispatchDomainResume (struct qemud_client *client, remote_message_header *req, remote_domain_resume_args *args, void *ret); -static int remoteDispatchDomainSave (struct qemud_client *client, remote_message_header *req, remote_domain_save_args *args, void *ret); -static int remoteDispatchDomainSetAutostart (struct qemud_client *client, remote_message_header *req, remote_domain_set_autostart_args *args, void *ret); -static int remoteDispatchDomainSetMaxMemory (struct qemud_client *client, remote_message_header *req, remote_domain_set_max_memory_args *args, void *ret); -static int remoteDispatchDomainSetMemory (struct qemud_client *client, remote_message_header *req, remote_domain_set_memory_args *args, void *ret); -static int remoteDispatchDomainSetSchedulerParameters (struct qemud_client *client, remote_message_header *req, remote_domain_set_scheduler_parameters_args *args, void *ret); -static int remoteDispatchDomainSetVcpus (struct qemud_client *client, remote_message_header *req, remote_domain_set_vcpus_args *args, void *ret); -static int remoteDispatchDomainShutdown (struct qemud_client *client, remote_message_header *req, remote_domain_shutdown_args *args, void *ret); -static int remoteDispatchDomainSuspend (struct qemud_client *client, remote_message_header *req, remote_domain_suspend_args *args, void *ret); -static int remoteDispatchDomainUndefine (struct qemud_client *client, remote_message_header *req, remote_domain_undefine_args *args, void *ret); -static int remoteDispatchGetCapabilities (struct qemud_client *client, remote_message_header *req, void *args, remote_get_capabilities_ret *ret); -static int remoteDispatchGetHostname (struct qemud_client *client, remote_message_header *req, void *args, remote_get_hostname_ret *ret); -static int remoteDispatchGetMaxVcpus (struct qemud_client *client, remote_message_header *req, remote_get_max_vcpus_args *args, remote_get_max_vcpus_ret *ret); -static int remoteDispatchGetType (struct qemud_client *client, remote_message_header *req, void *args, remote_get_type_ret *ret); -static int remoteDispatchGetVersion (struct qemud_client *client, remote_message_header *req, void *args, remote_get_version_ret *ret); -static int remoteDispatchListDefinedDomains (struct qemud_client *client, remote_message_header *req, remote_list_defined_domains_args *args, remote_list_defined_domains_ret *ret); -static int remoteDispatchListDefinedNetworks (struct qemud_client *client, remote_message_header *req, remote_list_defined_networks_args *args, remote_list_defined_networks_ret *ret); -static int remoteDispatchListDomains (struct qemud_client *client, remote_message_header *req, remote_list_domains_args *args, remote_list_domains_ret *ret); -static int remoteDispatchListNetworks (struct qemud_client *client, remote_message_header *req, remote_list_networks_args *args, remote_list_networks_ret *ret); -static int remoteDispatchNetworkCreate (struct qemud_client *client, remote_message_header *req, remote_network_create_args *args, void *ret); -static int remoteDispatchNetworkCreateXml (struct qemud_client *client, remote_message_header *req, remote_network_create_xml_args *args, remote_network_create_xml_ret *ret); -static int remoteDispatchNetworkDefineXml (struct qemud_client *client, remote_message_header *req, remote_network_define_xml_args *args, remote_network_define_xml_ret *ret); -static int remoteDispatchNetworkDestroy (struct qemud_client *client, remote_message_header *req, remote_network_destroy_args *args, void *ret); -static int remoteDispatchNetworkDumpXml (struct qemud_client *client, remote_message_header *req, remote_network_dump_xml_args *args, remote_network_dump_xml_ret *ret); -static int remoteDispatchNetworkGetAutostart (struct qemud_client *client, remote_message_header *req, remote_network_get_autostart_args *args, remote_network_get_autostart_ret *ret); -static int remoteDispatchNetworkGetBridgeName (struct qemud_client *client, remote_message_header *req, remote_network_get_bridge_name_args *args, remote_network_get_bridge_name_ret *ret); -static int remoteDispatchNetworkLookupByName (struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_name_args *args, remote_network_lookup_by_name_ret *ret); -static int remoteDispatchNetworkLookupByUuid (struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_uuid_args *args, remote_network_lookup_by_uuid_ret *ret); -static int remoteDispatchNetworkSetAutostart (struct qemud_client *client, remote_message_header *req, remote_network_set_autostart_args *args, void *ret); -static int remoteDispatchNetworkUndefine (struct qemud_client *client, remote_message_header *req, remote_network_undefine_args *args, void *ret); -static int remoteDispatchNodeGetInfo (struct qemud_client *client, remote_message_header *req, void *args, remote_node_get_info_ret *ret); -static int remoteDispatchNumOfDefinedDomains (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_domains_ret *ret); -static int remoteDispatchNumOfDefinedNetworks (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_networks_ret *ret); -static int remoteDispatchNumOfDomains (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_domains_ret *ret); -static int remoteDispatchNumOfNetworks (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_networks_ret *ret); -static int remoteDispatchOpen (struct qemud_client *client, remote_message_header *req, remote_open_args *args, void *ret); -static int remoteDispatchSupportsFeature (struct qemud_client *client, remote_message_header *req, remote_supports_feature_args *args, remote_supports_feature_ret *ret); +static int remoteDispatchAuthList (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_auth_list_ret *ret); +static int remoteDispatchAuthSaslInit (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_auth_sasl_init_ret *ret); +static int remoteDispatchAuthSaslStart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret); +static int remoteDispatchAuthSaslStep (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret); +static int remoteDispatchClose (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, void *ret); +static int remoteDispatchDomainAttachDevice (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret); +static int remoteDispatchDomainBlockStats (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret); +static int remoteDispatchDomainCoreDump (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_core_dump_args *args, void *ret); +static int remoteDispatchDomainCreate (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_create_args *args, void *ret); +static int remoteDispatchDomainCreateLinux (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_create_linux_args *args, remote_domain_create_linux_ret *ret); +static int remoteDispatchDomainDefineXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_define_xml_args *args, remote_domain_define_xml_ret *ret); +static int remoteDispatchDomainDestroy (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_destroy_args *args, void *ret); +static int remoteDispatchDomainDetachDevice (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_detach_device_args *args, void *ret); +static int remoteDispatchDomainDumpXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_dump_xml_args *args, remote_domain_dump_xml_ret *ret); +static int remoteDispatchDomainGetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_autostart_args *args, remote_domain_get_autostart_ret *ret); +static int remoteDispatchDomainGetInfo (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_info_args *args, remote_domain_get_info_ret *ret); +static int remoteDispatchDomainGetMaxMemory (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_max_memory_args *args, remote_domain_get_max_memory_ret *ret); +static int remoteDispatchDomainGetMaxVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_max_vcpus_args *args, remote_domain_get_max_vcpus_ret *ret); +static int remoteDispatchDomainGetOsType (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_os_type_args *args, remote_domain_get_os_type_ret *ret); +static int remoteDispatchDomainGetSchedulerParameters (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_parameters_args *args, remote_domain_get_scheduler_parameters_ret *ret); +static int remoteDispatchDomainGetSchedulerType (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_type_args *args, remote_domain_get_scheduler_type_ret *ret); +static int remoteDispatchDomainGetVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_vcpus_args *args, remote_domain_get_vcpus_ret *ret); +static int remoteDispatchDomainInterfaceStats (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_interface_stats_args *args, remote_domain_interface_stats_ret *ret); +static int remoteDispatchDomainLookupById (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_id_args *args, remote_domain_lookup_by_id_ret *ret); +static int remoteDispatchDomainLookupByName (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_name_args *args, remote_domain_lookup_by_name_ret *ret); +static int remoteDispatchDomainLookupByUuid (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_uuid_args *args, remote_domain_lookup_by_uuid_ret *ret); +static int remoteDispatchDomainMigrateFinish (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_migrate_finish_args *args, remote_domain_migrate_finish_ret *ret); +static int remoteDispatchDomainMigratePerform (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_migrate_perform_args *args, void *ret); +static int remoteDispatchDomainMigratePrepare (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_migrate_prepare_args *args, remote_domain_migrate_prepare_ret *ret); +static int remoteDispatchDomainPinVcpu (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_pin_vcpu_args *args, void *ret); +static int remoteDispatchDomainReboot (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_reboot_args *args, void *ret); +static int remoteDispatchDomainRestore (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_restore_args *args, void *ret); +static int remoteDispatchDomainResume (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_resume_args *args, void *ret); +static int remoteDispatchDomainSave (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_save_args *args, void *ret); +static int remoteDispatchDomainSetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_autostart_args *args, void *ret); +static int remoteDispatchDomainSetMaxMemory (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_max_memory_args *args, void *ret); +static int remoteDispatchDomainSetMemory (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_memory_args *args, void *ret); +static int remoteDispatchDomainSetSchedulerParameters (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_scheduler_parameters_args *args, void *ret); +static int remoteDispatchDomainSetVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_vcpus_args *args, void *ret); +static int remoteDispatchDomainShutdown (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_shutdown_args *args, void *ret); +static int remoteDispatchDomainSuspend (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_suspend_args *args, void *ret); +static int remoteDispatchDomainUndefine (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_undefine_args *args, void *ret); +static int remoteDispatchGetCapabilities (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_capabilities_ret *ret); +static int remoteDispatchGetHostname (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_hostname_ret *ret); +static int remoteDispatchGetMaxVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_get_max_vcpus_args *args, remote_get_max_vcpus_ret *ret); +static int remoteDispatchGetType (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_type_ret *ret); +static int remoteDispatchGetVersion (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_version_ret *ret); +static int remoteDispatchListDefinedDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_defined_domains_args *args, remote_list_defined_domains_ret *ret); +static int remoteDispatchListDefinedNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_defined_networks_args *args, remote_list_defined_networks_ret *ret); +static int remoteDispatchListDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_domains_args *args, remote_list_domains_ret *ret); +static int remoteDispatchListNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_networks_args *args, remote_list_networks_ret *ret); +static int remoteDispatchNetworkCreate (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_create_args *args, void *ret); +static int remoteDispatchNetworkCreateXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_create_xml_args *args, remote_network_create_xml_ret *ret); +static int remoteDispatchNetworkDefineXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_define_xml_args *args, remote_network_define_xml_ret *ret); +static int remoteDispatchNetworkDestroy (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_destroy_args *args, void *ret); +static int remoteDispatchNetworkDumpXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_dump_xml_args *args, remote_network_dump_xml_ret *ret); +static int remoteDispatchNetworkGetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_get_autostart_args *args, remote_network_get_autostart_ret *ret); +static int remoteDispatchNetworkGetBridgeName (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_get_bridge_name_args *args, remote_network_get_bridge_name_ret *ret); +static int remoteDispatchNetworkLookupByName (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_name_args *args, remote_network_lookup_by_name_ret *ret); +static int remoteDispatchNetworkLookupByUuid (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_uuid_args *args, remote_network_lookup_by_uuid_ret *ret); +static int remoteDispatchNetworkSetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_set_autostart_args *args, void *ret); +static int remoteDispatchNetworkUndefine (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_undefine_args *args, void *ret); +static int remoteDispatchNodeGetInfo (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_node_get_info_ret *ret); +static int remoteDispatchNumOfDefinedDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_domains_ret *ret); +static int remoteDispatchNumOfDefinedNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_networks_ret *ret); +static int remoteDispatchNumOfDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_domains_ret *ret); +static int remoteDispatchNumOfNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_networks_ret *ret); +static int remoteDispatchOpen (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_open_args *args, void *ret); +static int remoteDispatchSupportsFeature (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_supports_feature_args *args, remote_supports_feature_ret *ret); diff -r b68f6ec36358 qemud/remote_generate_stubs.pl --- a/qemud/remote_generate_stubs.pl Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/remote_generate_stubs.pl Fri Nov 30 15:15:26 2007 -0500 @@ -93,7 +93,7 @@ elsif ($opt_i) { elsif ($opt_i) { my @keys = sort (keys %calls); foreach (@keys) { - print "static int remoteDispatch$calls{$_}->{ProcName} (struct qemud_client *client, remote_message_header *req, $calls{$_}->{args} *args, $calls{$_}->{ret} *ret);\n"; + print "static int remoteDispatch$calls{$_}->{ProcName} (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, $calls{$_}->{args} *args, $calls{$_}->{ret} *ret);\n"; } } @@ -196,7 +196,8 @@ elsif ($opt_s) { my $retvoid = $ret eq "void"; print "static int\n"; - print "remoteDispatch$calls{$_}->{ProcName} (struct qemud_client *client,\n"; + print "remoteDispatch$calls{$_}->{ProcName} (struct qemud_server *server,\n"; + print " struct qemud_client *client,\n"; print " remote_message_header *req,\n"; print " remote_get_max_vcpus_args *args,\n"; print " remote_get_max_vcpus_ret *ret)\n"; -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

On Thu, Nov 29, 2007 at 05:18:41PM +0000, Daniel P. Berrange wrote: Rebased to latest CVS. Added RPM dep on PolicyKit stuff, dependant on being on Fedora 8 or later. diff -r ca9413d4d890 configure.in --- a/configure.in Fri Nov 30 15:15:26 2007 -0500 +++ b/configure.in Fri Nov 30 15:15:51 2007 -0500 @@ -25,6 +25,7 @@ LIBXML_REQUIRED="2.5.0" LIBXML_REQUIRED="2.5.0" GNUTLS_REQUIRED="1.0.25" AVAHI_REQUIRED="0.6.0" +POLKIT_REQUIRED="0.6" dnl Checks for C compiler. AC_PROG_CC @@ -395,6 +396,25 @@ AC_SUBST(SASL_LIBS) AC_SUBST(SASL_LIBS) +dnl PolicyKit library +POLKIT_CFLAGS= +POLKIT_LIBS= +AC_ARG_WITH(polkit, + [ --with-polkit use PolicyKit for UNIX socket access checks], + [], + [with_polkit=check]) + +if test "$with_polkit" = "check"; then + PKG_CHECK_EXISTS(polkit-dbus >= $POLKIT_REQUIRED, [with_polkit=yes], [with_polkit=no]) +fi + +if test "$with_polkit" = "yes"; then + PKG_CHECK_MODULES(POLKIT, polkit-dbus >= $POLKIT_REQUIRED) + AC_DEFINE_UNQUOTED(HAVE_POLKIT, 1, [use PolicyKit for UNIX socket access checks]) +fi +AM_CONDITIONAL(HAVE_POLKIT, [test "$with_polkit" = "yes"]) +AC_SUBST(POLKIT_CFLAGS) +AC_SUBST(POLKIT_LIBS) dnl Avahi library AC_ARG_WITH(avahi, @@ -634,6 +654,11 @@ else else AC_MSG_NOTICE([ avahi: no]) fi +if test "$with_polkit" = "yes" ; then +AC_MSG_NOTICE([ polkit: $POLKIT_CFLAGS $POLKIT_LIBS]) +else +AC_MSG_NOTICE([ polkit: no]) +fi AC_MSG_NOTICE([]) AC_MSG_NOTICE([Miscellaneous]) AC_MSG_NOTICE([]) diff -r ca9413d4d890 libvirt.spec.in --- a/libvirt.spec.in Fri Nov 30 15:15:26 2007 -0500 +++ b/libvirt.spec.in Fri Nov 30 15:15:51 2007 -0500 @@ -1,4 +1,10 @@ # -*- rpm-spec -*- + +%if %{fedora} >= 8 +%define with_polkit 1 +%else +%define with_polkit 0 +%endif Summary: Library providing a simple API virtualization Name: libvirt @@ -20,6 +26,9 @@ Requires: cyrus-sasl # Not technically required, but makes 'out-of-box' config # work correctly & doesn't have onerous dependancies Requires: cyrus-sasl-md5 +%if %{with_polkit} +Requires: PolicyKit >= 0.6 +%endif BuildRequires: xen-devel BuildRequires: libxml2-devel BuildRequires: readline-devel @@ -31,6 +40,9 @@ BuildRequires: bridge-utils BuildRequires: bridge-utils BuildRequires: qemu BuildRequires: cyrus-sasl-devel +%if %{with_polkit} +BuildRequires: PolicyKit-devel >= 0.6 +%endif Obsoletes: libvir ExclusiveArch: i386 x86_64 ia64 @@ -143,6 +155,7 @@ fi %{_datadir}/libvirt/networks/default.xml %dir %{_localstatedir}/run/libvirt/ %dir %{_localstatedir}/lib/libvirt/ +%{_datadir}/PolicyKit/policy/libvirtd.policy %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/qemu/ %attr(4755, root, root) %{_libexecdir}/libvirt_proxy %attr(0755, root, root) %{_sbindir}/libvirtd diff -r ca9413d4d890 qemud/Makefile.am --- a/qemud/Makefile.am Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/Makefile.am Fri Nov 30 15:15:51 2007 -0500 @@ -30,15 +30,24 @@ libvirtd_CFLAGS = \ libvirtd_CFLAGS = \ -I$(top_srcdir)/include -I$(top_builddir)/include \ $(LIBXML_CFLAGS) $(GNUTLS_CFLAGS) $(SASL_CFLAGS) \ + $(POLKIT_CFLAGS) \ $(WARN_CFLAGS) -DLOCAL_STATE_DIR="\"$(localstatedir)\"" \ -DSYSCONF_DIR="\"$(sysconfdir)\"" \ -DQEMUD_PID_FILE="\"$(QEMUD_PID_FILE)\"" \ -DREMOTE_PID_FILE="\"$(REMOTE_PID_FILE)\"" \ -DGETTEXT_PACKAGE=\"$(PACKAGE)\" -libvirtd_LDFLAGS = $(WARN_CFLAGS) $(LIBXML_LIBS) $(GNUTLS_LIBS) $(SASL_LIBS) +libvirtd_LDFLAGS = $(WARN_CFLAGS) $(LIBXML_LIBS) $(GNUTLS_LIBS) $(SASL_LIBS) \ + $(POLKIT_LIBS) libvirtd_DEPENDENCIES = ../src/libvirt.la libvirtd_LDADD = ../src/libvirt.la + + +if HAVE_POLKIT +policydir = $(datadir)/PolicyKit/policy +policy_DATA = libvirtd.policy +endif +EXTRA_DIST += libvirtd.policy if HAVE_AVAHI libvirtd_SOURCES += mdns.c mdns.h diff -r ca9413d4d890 qemud/internal.h --- a/qemud/internal.h Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/internal.h Fri Nov 30 15:15:51 2007 -0500 @@ -30,6 +30,10 @@ #include "../src/gnutls_1_0_compat.h" #if HAVE_SASL #include <sasl/sasl.h> +#endif + +#ifdef HAVE_POLKIT +#include <dbus/dbus.h> #endif #ifdef HAVE_SYS_SYSLIMITS_H @@ -155,6 +159,9 @@ struct qemud_server { #if HAVE_SASL char **saslUsernameWhitelist; #endif +#if HAVE_POLKIT + DBusConnection *sysbus; +#endif }; void qemudLog(int priority, const char *fmt, ...) diff -r ca9413d4d890 qemud/libvirtd.conf --- a/qemud/libvirtd.conf Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/libvirtd.conf Fri Nov 30 15:15:51 2007 -0500 @@ -82,8 +82,11 @@ # Set the UNIX socket permissions for the R/W socket. This is used # for full management of VMs # -# Default allows only root. If setting group ownership may want to -# relax this to: +# Default allows only root. If PolicyKit is enabled on the socket, +# the default will change to allow everyone (eg, 0777) +# +# If not using PolicyKit and setting group ownership for access +# control then you may want to relax this to: #unix_sock_rw_perms = "0770" @@ -103,7 +106,12 @@ # socket only GSSAPI & DIGEST-MD5 mechanisms will be used. # For non-TCP or TLS sockets, any scheme is allowed. # - +# - polkit: use PolicyKit to authenticate. This is only suitable +# for use on the UNIX sockets. The default policy will +# require a user to supply their own password to gain +# full read/write access (aka sudo like), while anyone +# is allowed read/only access. +# # Set an authentication scheme for UNIX read-only sockets # By default socket permissions allow anyone to connect # @@ -112,7 +120,9 @@ #auth_unix_ro = "none" # Set an authentication scheme for UNIX read-write sockets -# By default socket permissions only allow root. +# By default socket permissions only allow root. If PolicyKit +# support was compiled into libvirt, the default will be to +# use 'polkit' auth. # # If the unix_sock_rw_perms are changed you may wish to enable # an authentication mechanism here diff -r ca9413d4d890 qemud/libvirtd.policy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/qemud/libvirtd.policy Fri Nov 30 15:15:51 2007 -0500 @@ -0,0 +1,42 @@ +<!DOCTYPE policyconfig PUBLIC + "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" + "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd"> + +<!-- +Policy definitions for libvirt daemon + +Copyright (c) 2007 Daniel P. Berrange <berrange redhat com> + +libvirt is licensed to you under the GNU Lesser General Public License +version 2. See COPYING for details. + +NOTE: If you make changes to this file, make sure to validate the file +using the polkit-policy-file-validate(1) tool. Changes made to this +file are instantly applied. +--> + +<policyconfig> + <action id="org.libvirt.unix.monitor"> + <description>Monitor local virtualized systems</description> + <message>System policy prevents monitoring of local virtualized systems</message> + <defaults> + <!-- Any program can use libvirt in read-only mode for monitoring, + even if not part of a session --> + <allow_any>yes</allow_any> + <allow_inactive>yes</allow_inactive> + <allow_active>yes</allow_active> + </defaults> + </action> + + <action id="org.libvirt.unix.manage"> + <description>Manage local virtualized systems</description> + <message>System policy prevents management of local virtualized systems</message> + <defaults> + <!-- Only a program in the active host session can use libvirt in + read-write mode for management, and we require user password --> + <allow_any>no</allow_any> + <allow_inactive>no</allow_inactive> + <allow_active>auth_self_keep_session</allow_active> + </defaults> + </action> +</policyconfig> \ No newline at end of file diff -r ca9413d4d890 qemud/qemud.c --- a/qemud/qemud.c Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/qemud.c Fri Nov 30 15:15:51 2007 -0500 @@ -77,8 +77,13 @@ static int unix_sock_rw_mask = 0700; /* static int unix_sock_rw_mask = 0700; /* Allow user only */ static int unix_sock_ro_mask = 0777; /* Allow world */ +#if HAVE_POLKIT +static int auth_unix_rw = REMOTE_AUTH_POLKIT; +static int auth_unix_ro = REMOTE_AUTH_POLKIT; +#else static int auth_unix_rw = REMOTE_AUTH_NONE; static int auth_unix_ro = REMOTE_AUTH_NONE; +#endif /* HAVE_POLKIT */ #if HAVE_SASL static int auth_tcp = REMOTE_AUTH_SASL; #else @@ -761,6 +766,21 @@ static struct qemud_server *qemudNetwork } #endif +#ifdef HAVE_POLKIT + if (auth_unix_rw == REMOTE_AUTH_POLKIT || + auth_unix_ro == REMOTE_AUTH_POLKIT) { + DBusError derr; + dbus_error_init(&derr); + server->sysbus = dbus_bus_get(DBUS_BUS_SYSTEM, &derr); + if (!(server->sysbus)) { + qemudLog(QEMUD_ERR, "Failed to connect to system bus for PolicyKit auth: %s", + derr.message); + dbus_error_free(&derr); + goto cleanup; + } + } +#endif + if (ipsock) { if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, auth_tcp) < 0) goto cleanup; @@ -828,6 +848,10 @@ static struct qemud_server *qemudNetwork sock = sock->next; } +#ifdef HAVE_POLKIT + if (server->sysbus) + dbus_connection_unref(server->sysbus); +#endif free(server); } return NULL; @@ -1783,6 +1807,10 @@ static int remoteConfigGetAuth(virConfPt } else if (STREQ(p->str, "sasl")) { *auth = REMOTE_AUTH_SASL; #endif +#if HAVE_POLKIT + } else if (STREQ(p->str, "polkit")) { + *auth = REMOTE_AUTH_POLKIT; +#endif } else { qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: %s: unsupported auth %s\n", filename, key, p->str); return -1; @@ -1818,6 +1846,13 @@ remoteReadConfigFile (struct qemud_serve if (remoteConfigGetAuth(conf, "auth_unix_rw", &auth_unix_rw, filename) < 0) return -1; +#if HAVE_POLKIT + /* Change default perms to be wide-open if PolicyKit is enabled. + * Admin can always override in config file + */ + if (auth_unix_rw == REMOTE_AUTH_POLKIT) + unix_sock_rw_mask = 0777; +#endif if (remoteConfigGetAuth(conf, "auth_unix_ro", &auth_unix_ro, filename) < 0) return -1; if (remoteConfigGetAuth(conf, "auth_tcp", &auth_tcp, filename) < 0) diff -r ca9413d4d890 qemud/remote.c --- a/qemud/remote.c Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/remote.c Fri Nov 30 15:15:51 2007 -0500 @@ -46,6 +46,11 @@ #include <assert.h> #include <fnmatch.h> +#ifdef HAVE_POLKIT +#include <polkit/polkit.h> +#include <polkit-dbus/polkit-dbus.h> +#endif + #include <libvirt/virterror.h> #include "internal.h" @@ -132,7 +137,8 @@ remoteDispatchClientRequest (struct qemu if (req.proc != REMOTE_PROC_AUTH_LIST && req.proc != REMOTE_PROC_AUTH_SASL_INIT && req.proc != REMOTE_PROC_AUTH_SASL_START && - req.proc != REMOTE_PROC_AUTH_SASL_STEP + req.proc != REMOTE_PROC_AUTH_SASL_STEP && + req.proc != REMOTE_PROC_AUTH_POLKIT ) { remoteDispatchError (client, &req, "authentication required"); xdr_destroy (&xdr); @@ -2550,6 +2556,133 @@ remoteDispatchAuthSaslStep (struct qemud #endif /* HAVE_SASL */ +#if HAVE_POLKIT +static int qemudGetSocketIdentity(int fd, uid_t *uid, pid_t *pid) { +#ifdef SO_PEERCRED + struct ucred cr; + unsigned int cr_len = sizeof (cr); + + if (getsockopt (fd, SOL_SOCKET, SO_PEERCRED, &cr, &cr_len) < 0) { + qemudLog(QEMUD_ERR, "Failed to verify client credentials: %s", strerror(errno)); + return -1; + } + + *pid = cr.pid; + *uid = cr.uid; +#else + /* XXX Many more OS support UNIX socket credentials we could port to. See dbus ....*/ +#error "UNIX socket credentials not supported/implemented on this platform yet..." +#endif + return 0; +} + + +static int +remoteDispatchAuthPolkit (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, + remote_message_header *req, + void *args ATTRIBUTE_UNUSED, + remote_auth_polkit_ret *ret) +{ + pid_t callerPid; + uid_t callerUid; + + REMOTE_DEBUG("Start PolicyKit auth %d", client->fd); + if (client->auth != REMOTE_AUTH_POLKIT) { + qemudLog(QEMUD_ERR, "client tried invalid PolicyKit init request"); + remoteDispatchFailAuth(client, req); + return -2; + } + + if (qemudGetSocketIdentity(client->fd, &callerUid, &callerPid) < 0) { + qemudLog(QEMUD_ERR, "cannot get peer socket identity"); + remoteDispatchFailAuth(client, req); + return -2; + } + + /* Only do policy checks for non-root - allow root user + through with no checks, as a fail-safe - root can easily + change policykit policy anyway, so its pointless trying + to restrict root */ + if (callerUid == 0) { + qemudLog(QEMUD_INFO, "Allowing PID %d running as root", callerPid); + ret->complete = 1; + client->auth = REMOTE_AUTH_NONE; + } else { + PolKitCaller *pkcaller = NULL; + PolKitAction *pkaction = NULL; + PolKitContext *pkcontext = NULL; + PolKitError *pkerr; + PolKitResult pkresult; + DBusError err; + const char *action = client->readonly ? + "org.libvirt.unix.monitor" : + "org.libvirt.unix.manage"; + + qemudLog(QEMUD_INFO, "Checking PID %d running as %d", callerPid, callerUid); + dbus_error_init(&err); + if (!(pkcaller = polkit_caller_new_from_pid(server->sysbus, callerPid, &err))) { + qemudLog(QEMUD_ERR, "Failed to lookup policy kit caller: %s", err.message); + dbus_error_free(&err); + remoteDispatchFailAuth(client, req); + return -2; + } + + if (!(pkaction = polkit_action_new())) { + qemudLog(QEMUD_ERR, "Failed to create polkit action %s\n", strerror(errno)); + polkit_caller_unref(pkcaller); + remoteDispatchFailAuth(client, req); + return -2; + } + polkit_action_set_action_id(pkaction, action); + + if (!(pkcontext = polkit_context_new()) || + !polkit_context_init(pkcontext, &pkerr)) { + qemudLog(QEMUD_ERR, "Failed to create polkit context %s\n", + pkerr ? polkit_error_get_error_message(pkerr) : strerror(errno)); + if (pkerr) + polkit_error_free(pkerr); + polkit_caller_unref(pkcaller); + polkit_action_unref(pkaction); + dbus_error_free(&err); + remoteDispatchFailAuth(client, req); + return -2; + } + + pkresult = polkit_context_can_caller_do_action(pkcontext, pkaction, pkcaller); + polkit_context_unref(pkcontext); + polkit_caller_unref(pkcaller); + polkit_action_unref(pkaction); + if (pkresult != POLKIT_RESULT_YES) { + qemudLog(QEMUD_ERR, "Policy kit denied action %s from pid %d, uid %d, result: %s\n", + action, callerPid, callerUid, polkit_result_to_string_representation(pkresult)); + remoteDispatchFailAuth(client, req); + return -2; + } + qemudLog(QEMUD_INFO, "Policy allowed action %s from pid %d, uid %d, result %s", + action, callerPid, callerUid, polkit_result_to_string_representation(pkresult)); + ret->complete = 1; + client->auth = REMOTE_AUTH_NONE; + } + + return 0; +} + +#else /* HAVE_POLKIT */ + +static int +remoteDispatchAuthPolkitInit (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, + remote_message_header *req, + void *args ATTRIBUTE_UNUSED, + remote_auth_polkit_ret *ret ATTRIBUTE_UNUSED) +{ + qemudLog(QEMUD_ERR, "client tried unsupported PolicyKit init request"); + remoteDispatchFailAuth(client, req); + return -1; +} +#endif /* HAVE_POLKIT */ + /*----- Helpers. -----*/ /* get_nonnull_domain and get_nonnull_network turn an on-wire diff -r ca9413d4d890 qemud/remote_dispatch_localvars.h --- a/qemud/remote_dispatch_localvars.h Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/remote_dispatch_localvars.h Fri Nov 30 15:15:51 2007 -0500 @@ -37,6 +37,7 @@ remote_domain_create_linux_args lv_remot remote_domain_create_linux_args lv_remote_domain_create_linux_args; remote_domain_create_linux_ret lv_remote_domain_create_linux_ret; remote_domain_set_scheduler_parameters_args lv_remote_domain_set_scheduler_parameters_args; +remote_auth_polkit_ret lv_remote_auth_polkit_ret; remote_auth_sasl_start_args lv_remote_auth_sasl_start_args; remote_auth_sasl_start_ret lv_remote_auth_sasl_start_ret; remote_domain_interface_stats_args lv_remote_domain_interface_stats_args; diff -r ca9413d4d890 qemud/remote_dispatch_proc_switch.h --- a/qemud/remote_dispatch_proc_switch.h Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/remote_dispatch_proc_switch.h Fri Nov 30 15:15:51 2007 -0500 @@ -8,6 +8,12 @@ case REMOTE_PROC_AUTH_LIST: ret = (char *) &lv_remote_auth_list_ret; memset (&lv_remote_auth_list_ret, 0, sizeof lv_remote_auth_list_ret); break; +case REMOTE_PROC_AUTH_POLKIT: + fn = (dispatch_fn) remoteDispatchAuthPolkit; + ret_filter = (xdrproc_t) xdr_remote_auth_polkit_ret; + ret = (char *) &lv_remote_auth_polkit_ret; + memset (&lv_remote_auth_polkit_ret, 0, sizeof lv_remote_auth_polkit_ret); + break; case REMOTE_PROC_AUTH_SASL_INIT: fn = (dispatch_fn) remoteDispatchAuthSaslInit; ret_filter = (xdrproc_t) xdr_remote_auth_sasl_init_ret; diff -r ca9413d4d890 qemud/remote_dispatch_prototypes.h --- a/qemud/remote_dispatch_prototypes.h Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/remote_dispatch_prototypes.h Fri Nov 30 15:15:51 2007 -0500 @@ -3,6 +3,7 @@ */ static int remoteDispatchAuthList (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_auth_list_ret *ret); +static int remoteDispatchAuthPolkit (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_auth_polkit_ret *ret); static int remoteDispatchAuthSaslInit (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_auth_sasl_init_ret *ret); static int remoteDispatchAuthSaslStart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret); static int remoteDispatchAuthSaslStep (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret); diff -r ca9413d4d890 qemud/remote_protocol.c --- a/qemud/remote_protocol.c Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/remote_protocol.c Fri Nov 30 15:15:51 2007 -0500 @@ -1309,6 +1309,15 @@ xdr_remote_auth_sasl_step_ret (XDR *xdrs } bool_t +xdr_remote_auth_polkit_ret (XDR *xdrs, remote_auth_polkit_ret *objp) +{ + + if (!xdr_int (xdrs, &objp->complete)) + return FALSE; + return TRUE; +} + +bool_t xdr_remote_procedure (XDR *xdrs, remote_procedure *objp) { diff -r ca9413d4d890 qemud/remote_protocol.h --- a/qemud/remote_protocol.h Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/remote_protocol.h Fri Nov 30 15:15:51 2007 -0500 @@ -68,6 +68,7 @@ enum remote_auth_type { enum remote_auth_type { REMOTE_AUTH_NONE = 0, REMOTE_AUTH_SASL = 1, + REMOTE_AUTH_POLKIT = 2, }; typedef enum remote_auth_type remote_auth_type; @@ -719,6 +720,11 @@ struct remote_auth_sasl_step_ret { } data; }; typedef struct remote_auth_sasl_step_ret remote_auth_sasl_step_ret; + +struct remote_auth_polkit_ret { + int complete; +}; +typedef struct remote_auth_polkit_ret remote_auth_polkit_ret; #define REMOTE_PROGRAM 0x20008086 #define REMOTE_PROTOCOL_VERSION 1 @@ -792,6 +798,7 @@ enum remote_procedure { REMOTE_PROC_AUTH_SASL_INIT = 67, REMOTE_PROC_AUTH_SASL_START = 68, REMOTE_PROC_AUTH_SASL_STEP = 69, + REMOTE_PROC_AUTH_POLKIT = 70, }; typedef enum remote_procedure remote_procedure; @@ -935,6 +942,7 @@ extern bool_t xdr_remote_auth_sasl_star extern bool_t xdr_remote_auth_sasl_start_ret (XDR *, remote_auth_sasl_start_ret*); extern bool_t xdr_remote_auth_sasl_step_args (XDR *, remote_auth_sasl_step_args*); extern bool_t xdr_remote_auth_sasl_step_ret (XDR *, remote_auth_sasl_step_ret*); +extern bool_t xdr_remote_auth_polkit_ret (XDR *, remote_auth_polkit_ret*); extern bool_t xdr_remote_procedure (XDR *, remote_procedure*); extern bool_t xdr_remote_message_direction (XDR *, remote_message_direction*); extern bool_t xdr_remote_message_status (XDR *, remote_message_status*); @@ -1054,6 +1062,7 @@ extern bool_t xdr_remote_auth_sasl_start extern bool_t xdr_remote_auth_sasl_start_ret (); extern bool_t xdr_remote_auth_sasl_step_args (); extern bool_t xdr_remote_auth_sasl_step_ret (); +extern bool_t xdr_remote_auth_polkit_ret (); extern bool_t xdr_remote_procedure (); extern bool_t xdr_remote_message_direction (); extern bool_t xdr_remote_message_status (); diff -r ca9413d4d890 qemud/remote_protocol.x --- a/qemud/remote_protocol.x Fri Nov 30 15:15:26 2007 -0500 +++ b/qemud/remote_protocol.x Fri Nov 30 15:15:51 2007 -0500 @@ -132,7 +132,8 @@ struct remote_error { /* Authentication types available thus far.... */ enum remote_auth_type { REMOTE_AUTH_NONE = 0, - REMOTE_AUTH_SASL = 1 + REMOTE_AUTH_SASL = 1, + REMOTE_AUTH_POLKIT = 2 }; @@ -654,6 +655,10 @@ struct remote_auth_sasl_step_ret { int complete; int nil; char data<REMOTE_AUTH_SASL_DATA_MAX>; +}; + +struct remote_auth_polkit_ret { + int complete; }; /*----- Protocol. -----*/ @@ -731,7 +736,8 @@ enum remote_procedure { REMOTE_PROC_AUTH_LIST = 66, REMOTE_PROC_AUTH_SASL_INIT = 67, REMOTE_PROC_AUTH_SASL_START = 68, - REMOTE_PROC_AUTH_SASL_STEP = 69 + REMOTE_PROC_AUTH_SASL_STEP = 69, + REMOTE_PROC_AUTH_POLKIT = 70 }; /* Custom RPC structure. */ diff -r ca9413d4d890 src/remote_internal.c --- a/src/remote_internal.c Fri Nov 30 15:15:26 2007 -0500 +++ b/src/remote_internal.c Fri Nov 30 15:15:51 2007 -0500 @@ -115,6 +115,9 @@ static int remoteAuthenticate (virConnec #if HAVE_SASL static int remoteAuthSASL (virConnectPtr conn, struct private_data *priv, int in_open); #endif +#if HAVE_POLKIT +static int remoteAuthPolkit (virConnectPtr conn, struct private_data *priv, int in_open); +#endif /* HAVE_POLKIT */ static void error (virConnectPtr conn, virErrorNumber code, const char *info); static void server_error (virConnectPtr conn, remote_error *err); static virDomainPtr get_nonnull_domain (virConnectPtr conn, remote_nonnull_domain domain); @@ -2854,6 +2857,15 @@ remoteAuthenticate (virConnectPtr conn, break; #endif +#if HAVE_POLKIT + case REMOTE_AUTH_POLKIT: + if (remoteAuthPolkit(conn, priv, in_open) < 0) { + free(ret.types.types_val); + return -1; + } + break; +#endif + case REMOTE_AUTH_NONE: /* Nothing todo, hurrah ! */ break; @@ -3443,6 +3455,29 @@ really_write_sasl (virConnectPtr conn, s return really_write_buf(conn, priv, in_open, output, outputlen); } #endif + + +#if HAVE_POLKIT +/* Perform the PolicyKit authentication process + */ +static int +remoteAuthPolkit (virConnectPtr conn, struct private_data *priv, int in_open) +{ + remote_auth_polkit_ret ret; + + remoteDebug(priv, "Client initialize PolicyKit authentication"); + + memset (&ret, 0, sizeof ret); + if (call (conn, priv, in_open, REMOTE_PROC_AUTH_POLKIT, + (xdrproc_t) xdr_void, (char *)NULL, + (xdrproc_t) xdr_remote_auth_polkit_ret, (char *) &ret) != 0) { + return -1; /* virError already set by call */ + } + + remoteDebug(priv, "PolicyKit authentication complete"); + return 0; +} +#endif /* HAVE_POLKIT */ static int really_write (virConnectPtr conn, struct private_data *priv, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

This patch introduces the public & driver APIs for collecting auth credentials via a callback. This allows username/password based auth schemes to be used. This basically introduces a 3rd variant of the virConnectOpen call which takes a set of authentication parameters, and some flags. virConnectPtr virConnectOpenAuth (const char *name, virConnectAuthPtr auth, int flags); The flags parameter allows VIR_CONNECT_RO, so there is no need for a separate ReadOnly API. The 'auth' parameter is a small struct containing a list of credentials that the calling application knows how to collect, a function pointer for the callback, and an opaque data blob. struct _virConnectAuth { int *credtype; /* List of supported virConnectCredentialType values */ unsigned int ncredtype; virConnectAuthCallbackPtr cb; /* Callback used to collect credentials */ void *cbdata; }; At the very least apps should support the VIR_CRED_AUTHNAME and the VIR_CRED_PASSPHRASE credential types for collecting username+password respectively. There are a bunch of other credential type, but they're for fairly niche use cases. When the callback is invoked, it will be passed a list of virConnectCredentialPtr structs which contain details on all the credentials that the authentication mechanism needs to collect. They are passed all at once to make it easy to construct a big form in UI: typedef int (*virConnectAuthCallbackPtr)(virConnectCredentialPtr cred, unsigned int ncred, void *cbdata); The virConnectCredentialPtr struct contains a prompt which can be displayed in the UI. There may optionally be a challenge if doing a challenge/response type authentication. There may also be a default result. The application should collect a credential from the user & fill it into the 'result' field, or use the default result. If the callback returns 0, authentication will continue. If it returns -1, it will assume the user wants to cancel the auth process. Makefile.am | 2 docs/devhelp/libvirt-libvirt.html | 80 ++++++++++++- docs/devhelp/libvirt-virterror.html | 3 docs/libvirt-api.xml | 114 +++++++++++++++---- docs/libvirt-refs.xml | 210 ++++++++++++++++++++++++++++++++---- include/libvirt/libvirt.h.in | 72 ++++++++++++ proxy/libvirt_proxy.c | 4 qemud/remote.c | 2 src/driver.h | 10 - src/internal.h | 5 src/libvirt.c | 40 +++++- src/openvz_driver.c | 23 +++ src/proxy_internal.c | 9 + src/qemu_driver.c | 2 src/remote_internal.c | 22 ++- src/test.c | 2 src/xen_internal.c | 1 src/xen_internal.h | 1 src/xen_unified.c | 4 src/xend_internal.c | 6 - src/xend_internal.h | 2 src/xm_internal.c | 4 src/xm_internal.h | 2 src/xs_internal.c | 3 src/xs_internal.h | 1 25 files changed, 526 insertions(+), 98 deletions(-) diff -r ec2d8c632fd9 Makefile.am --- a/Makefile.am Wed Nov 28 15:00:45 2007 -0500 +++ b/Makefile.am Wed Nov 28 20:35:23 2007 -0500 @@ -1,6 +1,6 @@ ## Process this file with automake to produce Makefile.in -SUBDIRS = src qemud proxy include docs @PYTHON_SUBDIR@ tests po m4 scripts +SUBDIRS = include src qemud proxy docs @PYTHON_SUBDIR@ tests po m4 scripts ACLOCAL_AMFLAGS = -I m4 diff -r ec2d8c632fd9 docs/devhelp/libvirt-libvirt.html --- a/docs/devhelp/libvirt-libvirt.html Wed Nov 28 15:00:45 2007 -0500 +++ b/docs/devhelp/libvirt-libvirt.html Wed Nov 28 20:35:23 2007 -0500 @@ -61,19 +61,26 @@ typedef enum <a href="#virDomainState">v typedef enum <a href="#virDomainState">virDomainState</a>; typedef struct _virDomain <a href="#virDomain">virDomain</a>; typedef <a href="libvirt-libvirt.html#virDomainInterfaceStatsStruct">virDomainInterfaceStatsStruct</a> * <a href="#virDomainInterfaceStatsPtr">virDomainInterfaceStatsPtr</a>; +typedef <a href="libvirt-libvirt.html#virConnectAuth">virConnectAuth</a> * <a href="#virConnectAuthPtr">virConnectAuthPtr</a>; typedef enum <a href="#virSchedParameterType">virSchedParameterType</a>; -typedef <a href="libvirt-libvirt.html#virSchedParameter">virSchedParameter</a> * <a href="#virSchedParameterPtr">virSchedParameterPtr</a>; +typedef <a href="libvirt-libvirt.html#virConnectCredential">virConnectCredential</a> * <a href="#virConnectCredentialPtr">virConnectCredentialPtr</a>; typedef <a href="libvirt-libvirt.html#virNodeInfo">virNodeInfo</a> * <a href="#virNodeInfoPtr">virNodeInfoPtr</a>; typedef <a href="libvirt-libvirt.html#virNetwork">virNetwork</a> * <a href="#virNetworkPtr">virNetworkPtr</a>; typedef <a href="libvirt-libvirt.html#virDomainInfo">virDomainInfo</a> * <a href="#virDomainInfoPtr">virDomainInfoPtr</a>; typedef <a href="libvirt-libvirt.html#virConnect">virConnect</a> * <a href="#virConnectPtr">virConnectPtr</a>; typedef struct _virSchedParameter <a href="#virSchedParameter">virSchedParameter</a>; +typedef enum <a href="#virConnectFlags">virConnectFlags</a>; +typedef <a href="libvirt-libvirt.html#virSchedParameter">virSchedParameter</a> * <a href="#virSchedParameterPtr">virSchedParameterPtr</a>; typedef enum <a href="#virVcpuState">virVcpuState</a>; +typedef struct _virConnectAuth <a href="#virConnectAuth">virConnectAuth</a>; +typedef struct _virConnectCredential <a href="#virConnectCredential">virConnectCredential</a>; typedef <a href="libvirt-libvirt.html#virVcpuInfo">virVcpuInfo</a> * <a href="#virVcpuInfoPtr">virVcpuInfoPtr</a>; typedef enum <a href="#virDomainXMLFlags">virDomainXMLFlags</a>; typedef <a href="libvirt-libvirt.html#virDomain">virDomain</a> * <a href="#virDomainPtr">virDomainPtr</a>; +typedef enum <a href="#virConnectCredentialType">virConnectCredentialType</a>; typedef enum <a href="#virDomainCreateFlags">virDomainCreateFlags</a>; int <a href="#virDomainGetInfo">virDomainGetInfo</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> <a href="libvirt-libvirt.html#virDomainInfoPtr">virDomainInfoPtr</a> info); +int <a href="#virNetworkCreate">virNetworkCreate</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network); int <a href="#virNetworkFree">virNetworkFree</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network); const char * <a href="#virNetworkGetName">virNetworkGetName</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network); const char * <a href="#virDomainGetName">virDomainGetName</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain); @@ -88,6 +95,7 @@ int <a href="#virInitialize">virInitiali <a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> <a href="#virDomainLookupByName">virDomainLookupByName</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * name); <a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> <a href="#virNetworkLookupByUUID">virNetworkLookupByUUID</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const unsigned char * uuid); char * <a href="#virNetworkGetBridgeName">virNetworkGetBridgeName</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network); +char * <a href="#virNetworkGetXMLDesc">virNetworkGetXMLDesc</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network, <br/> int flags); int <a href="#virDomainPinVcpu">virDomainPinVcpu</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> unsigned int vcpu, <br/> unsigned char * cpumap, <br/> int maplen); int <a href="#virDomainRestore">virDomainRestore</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * from); const char * <a href="#virConnectGetType">virConnectGetType</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn); @@ -119,21 +127,20 @@ int <a href="#virDomainSetAutostart">vir int <a href="#virDomainSetAutostart">virDomainSetAutostart</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> int autostart); int <a href="#virDomainSuspend">virDomainSuspend</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain); int <a href="#virConnectGetMaxVcpus">virConnectGetMaxVcpus</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * type); +int <a href="#virConnectNumOfDefinedDomains">virConnectNumOfDefinedDomains</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn); <a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> <a href="#virNetworkGetConnect">virNetworkGetConnect</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> net); -int <a href="#virConnectNumOfDefinedDomains">virConnectNumOfDefinedDomains</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn); -<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> <a href="#virNetworkCreateXML">virNetworkCreateXML</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * xmlDesc); <a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> <a href="#virNetworkDefineXML">virNetworkDefineXML</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * xml); -int <a href="#virNetworkCreate">virNetworkCreate</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network); +<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> <a href="#virDomainLookupByID">virDomainLookupByID</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> int id); int <a href="#virDomainSetSchedulerParameters">virDomainSetSchedulerParameters</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> <a href="libvirt-libvirt.html#virSchedParameterPtr">virSchedParameterPtr</a> params, <br/> int nparams); int <a href="#virNodeGetCellsFreeMemory">virNodeGetCellsFreeMemory</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> unsigned long long * freeMems, <br/> int startCell, <br/> int maxCells); int <a href="#virConnectClose">virConnectClose</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn); int <a href="#virDomainReboot">virDomainReboot</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> unsigned int flags); int <a href="#virDomainBlockStats">virDomainBlockStats</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> dom, <br/> const char * path, <br/> <a href="libvirt-libvirt.html#virDomainBlockStatsPtr">virDomainBlockStatsPtr</a> stats, <br/> size_t size); int <a href="#virDomainSetVcpus">virDomainSetVcpus</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> unsigned int nvcpus); -<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> <a href="#virDomainLookupByID">virDomainLookupByID</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> int id); +<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> <a href="#virConnectOpenAuth">virConnectOpenAuth</a> (const char * name, <br/> <a href="libvirt-libvirt.html#virConnectAuthPtr">virConnectAuthPtr</a> auth, <br/> int flags); int <a href="#virNetworkGetUUIDString">virNetworkGetUUIDString</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network, <br/> char * buf); <a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> <a href="#virDomainMigrate">virDomainMigrate</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> <a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> dconn, <br/> unsigned long flags, <br/> const char * dname, <br/> const char * uri, <br/> unsigned long bandwidth); -char * <a href="#virNetworkGetXMLDesc">virNetworkGetXMLDesc</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network, <br/> int flags); +<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> <a href="#virNetworkCreateXML">virNetworkCreateXML</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * xmlDesc); unsigned int <a href="#virDomainGetID">virDomainGetID</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain); int <a href="#virDomainResume">virDomainResume</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain); <a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> <a href="#virDomainCreateLinux">virDomainCreateLinux</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * xmlDesc, <br/> unsigned int flags); @@ -149,6 +156,7 @@ char * <a href="#virDomainGetXMLDesc">vi char * <a href="#virDomainGetXMLDesc">virDomainGetXMLDesc</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> int flags); int <a href="#virDomainSetMaxMemory">virDomainSetMaxMemory</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> unsigned long memory); int <a href="#virDomainInterfaceStats">virDomainInterfaceStats</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> dom, <br/> const char * path, <br/> <a href="libvirt-libvirt.html#virDomainInterfaceStatsPtr">virDomainInterfaceStatsPtr</a> stats, <br/> size_t size); +typedef int <a href="#virConnectAuthCallbackPtr">virConnectAuthCallbackPtr</a> (<a href="libvirt-libvirt.html#virConnectCredentialPtr">virConnectCredentialPtr</a> cred, <br/> unsigned int ncred, <br/> void * cbdata); int <a href="#virConnectGetVersion">virConnectGetVersion</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> unsigned long * hvVer); int <a href="#virConnectListNetworks">virConnectListNetworks</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> char ** const names, <br/> int maxnames); char * <a href="#virConnectGetURI">virConnectGetURI</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn); @@ -212,6 +220,54 @@ The content of this structure is not mad </pre><p/> </div> <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectAuth">Structure </a>virConnectAuth</h3><pre class="programlisting">struct _virConnectAuth { + int * credtype : List of supported <a href="libvirt-libvirt.html#virConnectCredentialType">virConnectCredentialType</a> values + unsigned int ncredtype + <a href="libvirt-libvirt.html#virConnectAuthCallbackPtr">virConnectAuthCallbackPtr</a> cb : Callback used to collect credentials + void * cbdata +} virConnectAuth; +</pre><p/> +</div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectAuthPtr">Typedef </a>virConnectAuthPtr</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectAuth">virConnectAuth</a> * virConnectAuthPtr; +</pre><p/> +</div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectCredential">Structure </a>virConnectCredential</h3><pre class="programlisting">struct _virConnectCredential { + int type : One of <a href="libvirt-libvirt.html#virConnectCredentialType">virConnectCredentialType</a> constants + const char * prompt : Prompt to show to user + const char * challenge : Additional challenge to show + const char * defresult : Optional default result + char * result : Result to be filled with user response (or defresult) + unsigned int resultlen : Length of the result +} virConnectCredential; +</pre><p/> +</div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectCredentialPtr">Typedef </a>virConnectCredentialPtr</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectCredential">virConnectCredential</a> * virConnectCredentialPtr; +</pre><p/> +</div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectCredentialType">Enum </a>virConnectCredentialType</h3><pre class="programlisting">enum <a href="#virConnectCredentialType">virConnectCredentialType</a> { + <a name="VIR_CRED_USERNAME">VIR_CRED_USERNAME</a> = 1 /* Identity to act as */ + <a name="VIR_CRED_AUTHNAME">VIR_CRED_AUTHNAME</a> = 2 /* Identify to authorize as */ + <a name="VIR_CRED_LANGUAGE">VIR_CRED_LANGUAGE</a> = 3 /* RFC 1766 languages, comma separated */ + <a name="VIR_CRED_CNONCE">VIR_CRED_CNONCE</a> = 4 /* client supplies a nonce */ + <a name="VIR_CRED_PASSPHRASE">VIR_CRED_PASSPHRASE</a> = 5 /* Passphrase secret */ + <a name="VIR_CRED_ECHOPROMPT">VIR_CRED_ECHOPROMPT</a> = 6 /* Challenge response */ + <a name="VIR_CRED_NOECHOPROMPT">VIR_CRED_NOECHOPROMPT</a> = 7 /* Challenge response */ + <a name="VIR_CRED_REALM">VIR_CRED_REALM</a> = 8 /* Authentication realm */ + <a name="VIR_CRED_EXTERNAL">VIR_CRED_EXTERNAL</a> = 9 /* Externally managed credential More may be added - expect the unexpected */ +}; +</pre><p/> +</div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectFlags">Enum </a>virConnectFlags</h3><pre class="programlisting">enum <a href="#virConnectFlags">virConnectFlags</a> { + <a name="VIR_CONNECT_RO">VIR_CONNECT_RO</a> = 1 /* A readonly connection */ +}; +</pre><p/> +</div> + <hr/> <div class="refsect2" lang="en"><h3><a name="virConnectPtr">Typedef </a>virConnectPtr</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnect">virConnect</a> * virConnectPtr; </pre><p>a <a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> is pointer to a <a href="libvirt-libvirt.html#virConnect">virConnect</a> private structure, this is the type used to reference a connection to the Xen Hypervisor in the API.</p> </div> @@ -372,6 +428,14 @@ The content of this structure is not mad </pre><p/> </div> <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectAuthCallbackPtr"/>Function type virConnectAuthCallbackPtr</h3><pre class="programlisting">int virConnectAuthCallbackPtr (<a href="libvirt-libvirt.html#virConnectCredentialPtr">virConnectCredentialPtr</a> cred, <br/> unsigned int ncred, <br/> void * cbdata)<br/> +</pre><p/> +<div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>cred</tt></i>:</span></td><td/></tr><tr><td><span class="term"><i><tt>ncred</tt></i>:</span></td><td/></tr><tr><td><span class="term"><i><tt>cbdata</tt></i>:</span></td><td/></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td/></tr></tbody></table></div></div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectAuthPtrDefault">Variable </a>virConnectAuthPtrDefault</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectAuthPtr">virConnectAuthPtr</a> virConnectAuthPtrDefault; +</pre><p/> +</div> + <hr/> <div class="refsect2" lang="en"><h3><a name="virConnectClose"/>virConnectClose ()</h3><pre class="programlisting">int virConnectClose (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn)<br/> </pre><p>This function closes the connection to the Hypervisor. This should not be called if further interaction with the Hypervisor are needed especially if there is running domain which need further monitoring by the application.</p> <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>conn</tt></i>:</span></td><td>pointer to the hypervisor connection</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>0 in case of success or -1 in case of error.</td></tr></tbody></table></div></div> @@ -435,6 +499,10 @@ The content of this structure is not mad <div class="refsect2" lang="en"><h3><a name="virConnectOpen"/>virConnectOpen ()</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> virConnectOpen (const char * name)<br/> </pre><p>This function should be called first to get a connection to the Hypervisor and xen store</p> <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>name</tt></i>:</span></td><td>URI of the hypervisor</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>a pointer to the hypervisor connection or NULL in case of error URIs are documented at http://libvirt.org/uri.html</td></tr></tbody></table... + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectOpenAuth"/>virConnectOpenAuth ()</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> virConnectOpenAuth (const char * name, <br/> <a href="libvirt-libvirt.html#virConnectAuthPtr">virConnectAuthPtr</a> auth, <br/> int flags)<br/> +</pre><p>This function should be called first to get a connection to the Hypervisor. If neccessary, authentication will be performed fetching credentials via the callback</p> +<div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>name</tt></i>:</span></td><td>URI of the hypervisor</td></tr><tr><td><span class="term"><i><tt>auth</tt></i>:</span></td><td>Authenticate callback parameters</td></tr><tr><td><span class="term"><i><tt>flags</tt></i>:</span></td><td>Open flags</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>a pointer to the hypervisor connection or NULL in case of error URIs are documented at http://libvirt.org/uri.html</td></tr></tbody></table... <hr/> <div class="refsect2" lang="en"><h3><a name="virConnectOpenReadOnly"/>virConnectOpenReadOnly ()</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> virConnectOpenReadOnly (const char * name)<br/> </pre><p>This function should be called first to get a restricted connection to the libbrary functionalities. The set of APIs usable are then restricted on the available methods to control the domains.</p> diff -r ec2d8c632fd9 docs/devhelp/libvirt-virterror.html --- a/docs/devhelp/libvirt-virterror.html Wed Nov 28 15:00:45 2007 -0500 +++ b/docs/devhelp/libvirt-virterror.html Wed Nov 28 20:35:23 2007 -0500 @@ -154,7 +154,8 @@ void <a href="#virConnResetLastError">vi <a name="VIR_WAR_NO_NETWORK">VIR_WAR_NO_NETWORK</a> = 41 /* failed to start network */ <a name="VIR_ERR_NO_DOMAIN">VIR_ERR_NO_DOMAIN</a> = 42 /* domain not found or unexpectedly disappeared */ <a name="VIR_ERR_NO_NETWORK">VIR_ERR_NO_NETWORK</a> = 43 /* network not found */ - <a name="VIR_ERR_INVALID_MAC">VIR_ERR_INVALID_MAC</a> = 44 /* invalid MAC adress */ + <a name="VIR_ERR_INVALID_MAC">VIR_ERR_INVALID_MAC</a> = 44 /* invalid MAC adress */ + <a name="VIR_ERR_AUTH_FAILED">VIR_ERR_AUTH_FAILED</a> = 45 /* authentication failed */ }; </pre><p/> </div> diff -r ec2d8c632fd9 docs/libvirt-api.xml --- a/docs/libvirt-api.xml Wed Nov 28 15:00:45 2007 -0500 +++ b/docs/libvirt-api.xml Wed Nov 28 20:35:23 2007 -0500 @@ -16,26 +16,36 @@ <exports symbol='VIR_UUID_STRING_BUFLEN' type='macro'/> <exports symbol='VIR_GET_CPUMAP' type='macro'/> <exports symbol='VIR_UNUSE_CPU' type='macro'/> + <exports symbol='VIR_CRED_EXTERNAL' type='enum'/> + <exports symbol='VIR_DOMAIN_SHUTDOWN' type='enum'/> + <exports symbol='VIR_DOMAIN_SCHED_FIELD_UINT' type='enum'/> + <exports symbol='VIR_CRED_CNONCE' type='enum'/> + <exports symbol='VIR_CRED_ECHOPROMPT' type='enum'/> + <exports symbol='VIR_DOMAIN_SCHED_FIELD_DOUBLE' type='enum'/> + <exports symbol='VIR_DOMAIN_SCHED_FIELD_LLONG' type='enum'/> + <exports symbol='VIR_CONNECT_RO' type='enum'/> + <exports symbol='VIR_CRED_AUTHNAME' type='enum'/> + <exports symbol='VIR_CRED_LANGUAGE' type='enum'/> + <exports symbol='VIR_CRED_NOECHOPROMPT' type='enum'/> + <exports symbol='VIR_DOMAIN_SCHED_FIELD_BOOLEAN' type='enum'/> + <exports symbol='VIR_MIGRATE_LIVE' type='enum'/> + <exports symbol='VIR_CRED_USERNAME' type='enum'/> + <exports symbol='VIR_VCPU_OFFLINE' type='enum'/> + <exports symbol='VIR_DOMAIN_RUNNING' type='enum'/> + <exports symbol='VIR_DOMAIN_BLOCKED' type='enum'/> <exports symbol='VIR_DOMAIN_SHUTOFF' type='enum'/> - <exports symbol='VIR_DOMAIN_SCHED_FIELD_DOUBLE' type='enum'/> + <exports symbol='VIR_VCPU_BLOCKED' type='enum'/> + <exports symbol='VIR_DOMAIN_SCHED_FIELD_INT' type='enum'/> <exports symbol='VIR_DOMAIN_SCHED_FIELD_ULLONG' type='enum'/> - <exports symbol='VIR_VCPU_OFFLINE' type='enum'/> + <exports symbol='VIR_CRED_REALM' type='enum'/> + <exports symbol='VIR_VCPU_RUNNING' type='enum'/> + <exports symbol='VIR_DOMAIN_PAUSED' type='enum'/> + <exports symbol='VIR_DOMAIN_CRASHED' type='enum'/> <exports symbol='VIR_DOMAIN_XML_INACTIVE' type='enum'/> - <exports symbol='VIR_DOMAIN_SCHED_FIELD_BOOLEAN' type='enum'/> - <exports symbol='VIR_DOMAIN_SCHED_FIELD_UINT' type='enum'/> - <exports symbol='VIR_MIGRATE_LIVE' type='enum'/> - <exports symbol='VIR_DOMAIN_SCHED_FIELD_INT' type='enum'/> - <exports symbol='VIR_VCPU_RUNNING' type='enum'/> - <exports symbol='VIR_DOMAIN_CRASHED' type='enum'/> <exports symbol='VIR_DOMAIN_NONE' type='enum'/> - <exports symbol='VIR_DOMAIN_SHUTDOWN' type='enum'/> - <exports symbol='VIR_VCPU_BLOCKED' type='enum'/> <exports symbol='VIR_DOMAIN_NOSTATE' type='enum'/> - <exports symbol='VIR_DOMAIN_PAUSED' type='enum'/> - <exports symbol='VIR_DOMAIN_SCHED_FIELD_LLONG' type='enum'/> - <exports symbol='VIR_DOMAIN_RUNNING' type='enum'/> + <exports symbol='VIR_CRED_PASSPHRASE' type='enum'/> <exports symbol='VIR_DOMAIN_XML_SECURE' type='enum'/> - <exports symbol='VIR_DOMAIN_BLOCKED' type='enum'/> <exports symbol='virDomainBlockStatsStruct' type='typedef'/> <exports symbol='virDomainMigrateFlags' type='typedef'/> <exports symbol='virNodeInfo' type='typedef'/> @@ -48,25 +58,35 @@ <exports symbol='virDomainState' type='typedef'/> <exports symbol='virDomain' type='typedef'/> <exports symbol='virDomainInterfaceStatsPtr' type='typedef'/> + <exports symbol='virConnectAuthPtr' type='typedef'/> <exports symbol='virSchedParameterType' type='typedef'/> - <exports symbol='virSchedParameterPtr' type='typedef'/> + <exports symbol='virConnectCredentialPtr' type='typedef'/> <exports symbol='virNodeInfoPtr' type='typedef'/> <exports symbol='virNetworkPtr' type='typedef'/> <exports symbol='virDomainInfoPtr' type='typedef'/> <exports symbol='virConnectPtr' type='typedef'/> <exports symbol='virSchedParameter' type='typedef'/> + <exports symbol='virConnectFlags' type='typedef'/> + <exports symbol='virSchedParameterPtr' type='typedef'/> <exports symbol='virVcpuState' type='typedef'/> + <exports symbol='virConnectAuth' type='typedef'/> + <exports symbol='virConnectCredential' type='typedef'/> <exports symbol='virVcpuInfoPtr' type='typedef'/> <exports symbol='virDomainXMLFlags' type='typedef'/> <exports symbol='virDomainPtr' type='typedef'/> + <exports symbol='virConnectCredentialType' type='typedef'/> <exports symbol='virDomainCreateFlags' type='typedef'/> <exports symbol='_virDomainInfo' type='struct'/> + <exports symbol='_virConnectAuth' type='struct'/> + <exports symbol='_virVcpuInfo' type='struct'/> <exports symbol='_virDomainInterfaceStats' type='struct'/> - <exports symbol='_virVcpuInfo' type='struct'/> - <exports symbol='_virSchedParameter' type='struct'/> + <exports symbol='_virConnectCredential' type='struct'/> <exports symbol='_virDomainBlockStats' type='struct'/> <exports symbol='_virNodeInfo' type='struct'/> + <exports symbol='_virSchedParameter' type='struct'/> + <exports symbol='virConnectAuthPtrDefault' type='variable'/> <exports symbol='virDomainGetInfo' type='function'/> + <exports symbol='virNetworkCreate' type='function'/> <exports symbol='virNetworkFree' type='function'/> <exports symbol='virNetworkGetName' type='function'/> <exports symbol='virDomainGetName' type='function'/> @@ -81,6 +101,7 @@ <exports symbol='virDomainLookupByName' type='function'/> <exports symbol='virNetworkLookupByUUID' type='function'/> <exports symbol='virNetworkGetBridgeName' type='function'/> + <exports symbol='virNetworkGetXMLDesc' type='function'/> <exports symbol='virDomainPinVcpu' type='function'/> <exports symbol='virDomainRestore' type='function'/> <exports symbol='virConnectGetType' type='function'/> @@ -112,21 +133,20 @@ <exports symbol='virDomainSetAutostart' type='function'/> <exports symbol='virDomainSuspend' type='function'/> <exports symbol='virConnectGetMaxVcpus' type='function'/> + <exports symbol='virConnectNumOfDefinedDomains' type='function'/> <exports symbol='virNetworkGetConnect' type='function'/> - <exports symbol='virConnectNumOfDefinedDomains' type='function'/> - <exports symbol='virNetworkCreateXML' type='function'/> <exports symbol='virNetworkDefineXML' type='function'/> - <exports symbol='virNetworkCreate' type='function'/> + <exports symbol='virDomainLookupByID' type='function'/> <exports symbol='virDomainSetSchedulerParameters' type='function'/> <exports symbol='virNodeGetCellsFreeMemory' type='function'/> <exports symbol='virConnectClose' type='function'/> <exports symbol='virDomainReboot' type='function'/> <exports symbol='virDomainBlockStats' type='function'/> <exports symbol='virDomainSetVcpus' type='function'/> - <exports symbol='virDomainLookupByID' type='function'/> + <exports symbol='virConnectOpenAuth' type='function'/> <exports symbol='virNetworkGetUUIDString' type='function'/> <exports symbol='virDomainMigrate' type='function'/> - <exports symbol='virNetworkGetXMLDesc' type='function'/> + <exports symbol='virNetworkCreateXML' type='function'/> <exports symbol='virDomainGetID' type='function'/> <exports symbol='virDomainResume' type='function'/> <exports symbol='virDomainCreateLinux' type='function'/> @@ -142,6 +162,7 @@ <exports symbol='virDomainGetXMLDesc' type='function'/> <exports symbol='virDomainSetMaxMemory' type='function'/> <exports symbol='virDomainInterfaceStats' type='function'/> + <exports symbol='virConnectAuthCallbackPtr' type='function'/> <exports symbol='virConnectGetVersion' type='function'/> <exports symbol='virConnectListNetworks' type='function'/> <exports symbol='virConnectGetURI' type='function'/> @@ -159,6 +180,7 @@ <exports symbol='VIR_ERR_WARNING' type='enum'/> <exports symbol='VIR_FROM_OPENVZ' type='enum'/> <exports symbol='VIR_ERR_NO_XEN' type='enum'/> + <exports symbol='VIR_FROM_STATS_LINUX' type='enum'/> <exports symbol='VIR_ERR_INVALID_ARG' type='enum'/> <exports symbol='VIR_ERR_ERROR' type='enum'/> <exports symbol='VIR_ERR_NO_OS' type='enum'/> @@ -176,7 +198,7 @@ <exports symbol='VIR_FROM_QEMU' type='enum'/> <exports symbol='VIR_FROM_CONF' type='enum'/> <exports symbol='VIR_ERR_INVALID_NETWORK' type='enum'/> - <exports symbol='VIR_FROM_STATS_LINUX' type='enum'/> + <exports symbol='VIR_ERR_AUTH_FAILED' type='enum'/> <exports symbol='VIR_ERR_OPERATION_DENIED' type='enum'/> <exports symbol='VIR_ERR_NO_KERNEL' type='enum'/> <exports symbol='VIR_ERR_GNUTLS_ERROR' type='enum'/> @@ -287,6 +309,16 @@ <macro name='VIR_UUID_STRING_BUFLEN' file='libvirt'> <info>This macro provides the length of the buffer required for virDomainGetUUIDString()</info> </macro> + <enum name='VIR_CONNECT_RO' file='libvirt' value='1' type='virConnectFlags' info=' A readonly connection'/> + <enum name='VIR_CRED_AUTHNAME' file='libvirt' value='2' type='virConnectCredentialType' info='Identify to authorize as'/> + <enum name='VIR_CRED_CNONCE' file='libvirt' value='4' type='virConnectCredentialType' info='client supplies a nonce'/> + <enum name='VIR_CRED_ECHOPROMPT' file='libvirt' value='6' type='virConnectCredentialType' info='Challenge response'/> + <enum name='VIR_CRED_EXTERNAL' file='libvirt' value='9' type='virConnectCredentialType' info=' Externally managed credential More may be added - expect the unexpected'/> + <enum name='VIR_CRED_LANGUAGE' file='libvirt' value='3' type='virConnectCredentialType' info='RFC 1766 languages, comma separated'/> + <enum name='VIR_CRED_NOECHOPROMPT' file='libvirt' value='7' type='virConnectCredentialType' info='Challenge response'/> + <enum name='VIR_CRED_PASSPHRASE' file='libvirt' value='5' type='virConnectCredentialType' info='Passphrase secret'/> + <enum name='VIR_CRED_REALM' file='libvirt' value='8' type='virConnectCredentialType' info='Authentication realm'/> + <enum name='VIR_CRED_USERNAME' file='libvirt' value='1' type='virConnectCredentialType' info='Identity to act as'/> <enum name='VIR_DOMAIN_BLOCKED' file='libvirt' value='2' type='virDomainState' info='the domain is blocked on resource'/> <enum name='VIR_DOMAIN_CRASHED' file='libvirt' value='6' type='virDomainState' info=' the domain is crashed'/> <enum name='VIR_DOMAIN_NONE' file='libvirt' value='0' type='virDomainCreateFlags'/> @@ -303,6 +335,7 @@ <enum name='VIR_DOMAIN_SHUTOFF' file='libvirt' value='5' type='virDomainState' info='the domain is shut off'/> <enum name='VIR_DOMAIN_XML_INACTIVE' file='libvirt' value='2' type='virDomainXMLFlags' info=' dump inactive domain informations'/> <enum name='VIR_DOMAIN_XML_SECURE' file='libvirt' value='1' type='virDomainXMLFlags' info='dump security sensitive informations too'/> + <enum name='VIR_ERR_AUTH_FAILED' file='virterror' value='45' type='virErrorNumber' info=' authentication failed'/> <enum name='VIR_ERR_CALL_FAILED' file='virterror' value='26' type='virErrorNumber' info='not supported by the drivers (DEPRECATED)'/> <enum name='VIR_ERR_CONF_SYNTAX' file='virterror' value='33' type='virErrorNumber' info='failed to parse the syntax of a conf file'/> <enum name='VIR_ERR_DOM_EXIST' file='virterror' value='28' type='virErrorNumber' info='the domain already exist'/> @@ -315,7 +348,7 @@ <enum name='VIR_ERR_INVALID_ARG' file='virterror' value='8' type='virErrorNumber' info='invalid function argument'/> <enum name='VIR_ERR_INVALID_CONN' file='virterror' value='6' type='virErrorNumber' info='invalid connection object'/> <enum name='VIR_ERR_INVALID_DOMAIN' file='virterror' value='7' type='virErrorNumber' info='invalid domain object'/> - <enum name='VIR_ERR_INVALID_MAC' file='virterror' value='44' type='virErrorNumber' info=' invalid MAC adress'/> + <enum name='VIR_ERR_INVALID_MAC' file='virterror' value='44' type='virErrorNumber' info='invalid MAC adress'/> <enum name='VIR_ERR_INVALID_NETWORK' file='virterror' value='36' type='virErrorNumber' info='invalid network object'/> <enum name='VIR_ERR_NETWORK_EXIST' file='virterror' value='37' type='virErrorNumber' info='the network already exist'/> <enum name='VIR_ERR_NONE' file='virterror' value='0' type='virErrorLevel'/> @@ -373,6 +406,24 @@ <enum name='VIR_VCPU_RUNNING' file='libvirt' value='1' type='virVcpuState' info='the virtual CPU is running'/> <enum name='VIR_WAR_NO_NETWORK' file='virterror' value='41' type='virErrorNumber' info='failed to start network'/> <struct name='virConnect' file='libvirt' type='struct _virConnect'/> + <struct name='virConnectAuth' file='libvirt' type='struct _virConnectAuth'> + <field name='credtype' type='int *' info=' List of supported virConnectCredentialType values'/> + <field name='ncredtype' type='unsigned int' info=''/> + <field name='cb' type='virConnectAuthCallbackPtr' info=' Callback used to collect credentials'/> + <field name='cbdata' type='void *' info=''/> + </struct> + <typedef name='virConnectAuthPtr' file='libvirt' type='virConnectAuth *'/> + <struct name='virConnectCredential' file='libvirt' type='struct _virConnectCredential'> + <field name='type' type='int' info=' One of virConnectCredentialType constants'/> + <field name='prompt' type='const char *' info=' Prompt to show to user'/> + <field name='challenge' type='const char *' info=' Additional challenge to show'/> + <field name='defresult' type='const char *' info=' Optional default result'/> + <field name='result' type='char *' info=' Result to be filled with user response (or defresult)'/> + <field name='resultlen' type='unsigned int' info=' Length of the result'/> + </struct> + <typedef name='virConnectCredentialPtr' file='libvirt' type='virConnectCredential *'/> + <typedef name='virConnectCredentialType' file='libvirt' type='enum'/> + <typedef name='virConnectFlags' file='libvirt' type='enum'/> <typedef name='virConnectPtr' file='libvirt' type='virConnect *'> <info>a virConnectPtr is pointer to a virConnect private structure, this is the type used to reference a connection to the Xen Hypervisor in the API.</info> </typedef> @@ -468,6 +519,7 @@ </struct> <typedef name='virVcpuInfoPtr' file='libvirt' type='virVcpuInfo *'/> <typedef name='virVcpuState' file='libvirt' type='enum'/> + <variable name='virConnectAuthPtrDefault' file='libvirt' type='virConnectAuthPtr'/> <function name='virConnCopyLastError' file='virterror' module='virterror'> <info>Copy the content of the last error caught on that connection One will need to free the result with virResetError()</info> <return type='int' info='0 if no error was found and the error code otherwise and -1 in case of parameter error.'/> @@ -491,6 +543,13 @@ <arg name='userData' type='void *' info='pointer to the user data provided in the handler callback'/> <arg name='handler' type='virErrorFunc' info='the function to get called in case of error or NULL'/> </function> + <functype name='virConnectAuthCallbackPtr' file='libvirt' module='libvirt'> + <info></info> + <return type='int' info=''/> + <arg name='cred' type='virConnectCredentialPtr' info=''/> + <arg name='ncred' type='unsigned int' info=''/> + <arg name='cbdata' type='void *' info=''/> + </functype> <function name='virConnectClose' file='libvirt' module='libvirt'> <info>This function closes the connection to the Hypervisor. This should not be called if further interaction with the Hypervisor are needed especially if there is running domain which need further monitoring by the application.</info> <return type='int' info='0 in case of success or -1 in case of error.'/> @@ -580,6 +639,13 @@ <info>This function should be called first to get a connection to the Hypervisor and xen store</info> <return type='virConnectPtr' info='a pointer to the hypervisor connection or NULL in case of error URIs are documented at http://libvirt.org/uri.html'/> <arg name='name' type='const char *' info='URI of the hypervisor'/> + </function> + <function name='virConnectOpenAuth' file='libvirt' module='libvirt'> + <info>This function should be called first to get a connection to the Hypervisor. If neccessary, authentication will be performed fetching credentials via the callback</info> + <return type='virConnectPtr' info='a pointer to the hypervisor connection or NULL in case of error URIs are documented at http://libvirt.org/uri.html'/> + <arg name='name' type='const char *' info='URI of the hypervisor'/> + <arg name='auth' type='virConnectAuthPtr' info='Authenticate callback parameters'/> + <arg name='flags' type='int' info='Open flags'/> </function> <function name='virConnectOpenReadOnly' file='libvirt' module='libvirt'> <info>This function should be called first to get a restricted connection to the libbrary functionalities. The set of APIs usable are then restricted on the available methods to control the domains.</info> diff -r ec2d8c632fd9 docs/libvirt-refs.xml --- a/docs/libvirt-refs.xml Wed Nov 28 15:00:45 2007 -0500 +++ b/docs/libvirt-refs.xml Wed Nov 28 20:35:23 2007 -0500 @@ -2,9 +2,19 @@ <apirefs name='libvirt'> <references> <reference name='LIBVIR_VERSION_NUMBER' href='html/libvirt-libvirt.html#LIBVIR_VERSION_NUMBER'/> + <reference name='VIR_CONNECT_RO' href='html/libvirt-libvirt.html#VIR_CONNECT_RO'/> <reference name='VIR_COPY_CPUMAP' href='html/libvirt-libvirt.html#VIR_COPY_CPUMAP'/> <reference name='VIR_CPU_MAPLEN' href='html/libvirt-libvirt.html#VIR_CPU_MAPLEN'/> <reference name='VIR_CPU_USABLE' href='html/libvirt-libvirt.html#VIR_CPU_USABLE'/> + <reference name='VIR_CRED_AUTHNAME' href='html/libvirt-libvirt.html#VIR_CRED_AUTHNAME'/> + <reference name='VIR_CRED_CNONCE' href='html/libvirt-libvirt.html#VIR_CRED_CNONCE'/> + <reference name='VIR_CRED_ECHOPROMPT' href='html/libvirt-libvirt.html#VIR_CRED_ECHOPROMPT'/> + <reference name='VIR_CRED_EXTERNAL' href='html/libvirt-libvirt.html#VIR_CRED_EXTERNAL'/> + <reference name='VIR_CRED_LANGUAGE' href='html/libvirt-libvirt.html#VIR_CRED_LANGUAGE'/> + <reference name='VIR_CRED_NOECHOPROMPT' href='html/libvirt-libvirt.html#VIR_CRED_NOECHOPROMPT'/> + <reference name='VIR_CRED_PASSPHRASE' href='html/libvirt-libvirt.html#VIR_CRED_PASSPHRASE'/> + <reference name='VIR_CRED_REALM' href='html/libvirt-libvirt.html#VIR_CRED_REALM'/> + <reference name='VIR_CRED_USERNAME' href='html/libvirt-libvirt.html#VIR_CRED_USERNAME'/> <reference name='VIR_DOMAIN_BLOCKED' href='html/libvirt-libvirt.html#VIR_DOMAIN_BLOCKED'/> <reference name='VIR_DOMAIN_CRASHED' href='html/libvirt-libvirt.html#VIR_DOMAIN_CRASHED'/> <reference name='VIR_DOMAIN_NONE' href='html/libvirt-libvirt.html#VIR_DOMAIN_NONE'/> @@ -22,6 +32,7 @@ <reference name='VIR_DOMAIN_SHUTOFF' href='html/libvirt-libvirt.html#VIR_DOMAIN_SHUTOFF'/> <reference name='VIR_DOMAIN_XML_INACTIVE' href='html/libvirt-libvirt.html#VIR_DOMAIN_XML_INACTIVE'/> <reference name='VIR_DOMAIN_XML_SECURE' href='html/libvirt-libvirt.html#VIR_DOMAIN_XML_SECURE'/> + <reference name='VIR_ERR_AUTH_FAILED' href='html/libvirt-virterror.html#VIR_ERR_AUTH_FAILED'/> <reference name='VIR_ERR_CALL_FAILED' href='html/libvirt-virterror.html#VIR_ERR_CALL_FAILED'/> <reference name='VIR_ERR_CONF_SYNTAX' href='html/libvirt-virterror.html#VIR_ERR_CONF_SYNTAX'/> <reference name='VIR_ERR_DOM_EXIST' href='html/libvirt-virterror.html#VIR_ERR_DOM_EXIST'/> @@ -97,6 +108,8 @@ <reference name='VIR_VCPU_OFFLINE' href='html/libvirt-libvirt.html#VIR_VCPU_OFFLINE'/> <reference name='VIR_VCPU_RUNNING' href='html/libvirt-libvirt.html#VIR_VCPU_RUNNING'/> <reference name='VIR_WAR_NO_NETWORK' href='html/libvirt-virterror.html#VIR_WAR_NO_NETWORK'/> + <reference name='_virConnectAuth' href='html/libvirt-libvirt.html#_virConnectAuth'/> + <reference name='_virConnectCredential' href='html/libvirt-libvirt.html#_virConnectCredential'/> <reference name='_virDomainBlockStats' href='html/libvirt-libvirt.html#_virDomainBlockStats'/> <reference name='_virDomainInfo' href='html/libvirt-libvirt.html#_virDomainInfo'/> <reference name='_virDomainInterfaceStats' href='html/libvirt-libvirt.html#_virDomainInterfaceStats'/> @@ -109,7 +122,15 @@ <reference name='virConnResetLastError' href='html/libvirt-virterror.html#virConnResetLastError'/> <reference name='virConnSetErrorFunc' href='html/libvirt-virterror.html#virConnSetErrorFunc'/> <reference name='virConnect' href='html/libvirt-libvirt.html#virConnect'/> + <reference name='virConnectAuth' href='html/libvirt-libvirt.html#virConnectAuth'/> + <reference name='virConnectAuthCallbackPtr' href='html/libvirt-libvirt.html#virConnectAuthCallbackPtr'/> + <reference name='virConnectAuthPtr' href='html/libvirt-libvirt.html#virConnectAuthPtr'/> + <reference name='virConnectAuthPtrDefault' href='html/libvirt-libvirt.html#virConnectAuthPtrDefault'/> <reference name='virConnectClose' href='html/libvirt-libvirt.html#virConnectClose'/> + <reference name='virConnectCredential' href='html/libvirt-libvirt.html#virConnectCredential'/> + <reference name='virConnectCredentialPtr' href='html/libvirt-libvirt.html#virConnectCredentialPtr'/> + <reference name='virConnectCredentialType' href='html/libvirt-libvirt.html#virConnectCredentialType'/> + <reference name='virConnectFlags' href='html/libvirt-libvirt.html#virConnectFlags'/> <reference name='virConnectGetCapabilities' href='html/libvirt-libvirt.html#virConnectGetCapabilities'/> <reference name='virConnectGetHostname' href='html/libvirt-libvirt.html#virConnectGetHostname'/> <reference name='virConnectGetMaxVcpus' href='html/libvirt-libvirt.html#virConnectGetMaxVcpus'/> @@ -125,6 +146,7 @@ <reference name='virConnectNumOfDomains' href='html/libvirt-libvirt.html#virConnectNumOfDomains'/> <reference name='virConnectNumOfNetworks' href='html/libvirt-libvirt.html#virConnectNumOfNetworks'/> <reference name='virConnectOpen' href='html/libvirt-libvirt.html#virConnectOpen'/> + <reference name='virConnectOpenAuth' href='html/libvirt-libvirt.html#virConnectOpenAuth'/> <reference name='virConnectOpenReadOnly' href='html/libvirt-libvirt.html#virConnectOpenReadOnly'/> <reference name='virConnectPtr' href='html/libvirt-libvirt.html#virConnectPtr'/> <reference name='virCopyLastError' href='html/libvirt-virterror.html#virCopyLastError'/> @@ -231,9 +253,19 @@ <ref name='LIBVIR_VERSION_NUMBER'/> </letter> <letter name='V'> + <ref name='VIR_CONNECT_RO'/> <ref name='VIR_COPY_CPUMAP'/> <ref name='VIR_CPU_MAPLEN'/> <ref name='VIR_CPU_USABLE'/> + <ref name='VIR_CRED_AUTHNAME'/> + <ref name='VIR_CRED_CNONCE'/> + <ref name='VIR_CRED_ECHOPROMPT'/> + <ref name='VIR_CRED_EXTERNAL'/> + <ref name='VIR_CRED_LANGUAGE'/> + <ref name='VIR_CRED_NOECHOPROMPT'/> + <ref name='VIR_CRED_PASSPHRASE'/> + <ref name='VIR_CRED_REALM'/> + <ref name='VIR_CRED_USERNAME'/> <ref name='VIR_DOMAIN_BLOCKED'/> <ref name='VIR_DOMAIN_CRASHED'/> <ref name='VIR_DOMAIN_NONE'/> @@ -251,6 +283,7 @@ <ref name='VIR_DOMAIN_SHUTOFF'/> <ref name='VIR_DOMAIN_XML_INACTIVE'/> <ref name='VIR_DOMAIN_XML_SECURE'/> + <ref name='VIR_ERR_AUTH_FAILED'/> <ref name='VIR_ERR_CALL_FAILED'/> <ref name='VIR_ERR_CONF_SYNTAX'/> <ref name='VIR_ERR_DOM_EXIST'/> @@ -328,6 +361,8 @@ <ref name='VIR_WAR_NO_NETWORK'/> </letter> <letter name='_'> + <ref name='_virConnectAuth'/> + <ref name='_virConnectCredential'/> <ref name='_virDomainBlockStats'/> <ref name='_virDomainInfo'/> <ref name='_virDomainInterfaceStats'/> @@ -342,7 +377,15 @@ <ref name='virConnResetLastError'/> <ref name='virConnSetErrorFunc'/> <ref name='virConnect'/> + <ref name='virConnectAuth'/> + <ref name='virConnectAuthCallbackPtr'/> + <ref name='virConnectAuthPtr'/> + <ref name='virConnectAuthPtrDefault'/> <ref name='virConnectClose'/> + <ref name='virConnectCredential'/> + <ref name='virConnectCredentialPtr'/> + <ref name='virConnectCredentialType'/> + <ref name='virConnectFlags'/> <ref name='virConnectGetCapabilities'/> <ref name='virConnectGetHostname'/> <ref name='virConnectGetMaxVcpus'/> @@ -358,6 +401,7 @@ <ref name='virConnectNumOfDomains'/> <ref name='virConnectNumOfNetworks'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virConnectPtr'/> <ref name='virCopyLastError'/> @@ -472,6 +516,7 @@ </type> <type name='virConnectPtr'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainGetConnect'/> <ref name='virNetworkGetConnect'/> @@ -525,6 +570,7 @@ <ref name='virNetworkGetUUID'/> </type> <type name='unsigned int'> + <ref name='virConnectAuthCallbackPtr'/> <ref name='virDomainCreateLinux'/> <ref name='virDomainPinVcpu'/> <ref name='virDomainReboot'/> @@ -541,6 +587,12 @@ </type> <type name='unsigned long long *'> <ref name='virNodeGetCellsFreeMemory'/> + </type> + <type name='virConnectAuthPtr'> + <ref name='virConnectOpenAuth'/> + </type> + <type name='virConnectCredentialPtr'> + <ref name='virConnectAuthCallbackPtr'/> </type> <type name='virConnectPtr'> <ref name='virConnCopyLastError'/> @@ -662,6 +714,7 @@ </type> <type name='void *'> <ref name='virConnSetErrorFunc'/> + <ref name='virConnectAuthCallbackPtr'/> <ref name='virErrorFunc'/> <ref name='virSetErrorFunc'/> </type> @@ -669,9 +722,19 @@ <files> <file name='libvirt'> <ref name='LIBVIR_VERSION_NUMBER'/> + <ref name='VIR_CONNECT_RO'/> <ref name='VIR_COPY_CPUMAP'/> <ref name='VIR_CPU_MAPLEN'/> <ref name='VIR_CPU_USABLE'/> + <ref name='VIR_CRED_AUTHNAME'/> + <ref name='VIR_CRED_CNONCE'/> + <ref name='VIR_CRED_ECHOPROMPT'/> + <ref name='VIR_CRED_EXTERNAL'/> + <ref name='VIR_CRED_LANGUAGE'/> + <ref name='VIR_CRED_NOECHOPROMPT'/> + <ref name='VIR_CRED_PASSPHRASE'/> + <ref name='VIR_CRED_REALM'/> + <ref name='VIR_CRED_USERNAME'/> <ref name='VIR_DOMAIN_BLOCKED'/> <ref name='VIR_DOMAIN_CRASHED'/> <ref name='VIR_DOMAIN_NONE'/> @@ -699,6 +762,8 @@ <ref name='VIR_VCPU_BLOCKED'/> <ref name='VIR_VCPU_OFFLINE'/> <ref name='VIR_VCPU_RUNNING'/> + <ref name='_virConnectAuth'/> + <ref name='_virConnectCredential'/> <ref name='_virDomainBlockStats'/> <ref name='_virDomainInfo'/> <ref name='_virDomainInterfaceStats'/> @@ -706,7 +771,15 @@ <ref name='_virSchedParameter'/> <ref name='_virVcpuInfo'/> <ref name='virConnect'/> + <ref name='virConnectAuth'/> + <ref name='virConnectAuthCallbackPtr'/> + <ref name='virConnectAuthPtr'/> + <ref name='virConnectAuthPtrDefault'/> <ref name='virConnectClose'/> + <ref name='virConnectCredential'/> + <ref name='virConnectCredentialPtr'/> + <ref name='virConnectCredentialType'/> + <ref name='virConnectFlags'/> <ref name='virConnectGetCapabilities'/> <ref name='virConnectGetHostname'/> <ref name='virConnectGetMaxVcpus'/> @@ -722,6 +795,7 @@ <ref name='virConnectNumOfDomains'/> <ref name='virConnectNumOfNetworks'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virConnectPtr'/> <ref name='virDomain'/> @@ -812,6 +886,7 @@ <ref name='virVcpuState'/> </file> <file name='virterror'> + <ref name='VIR_ERR_AUTH_FAILED'/> <ref name='VIR_ERR_CALL_FAILED'/> <ref name='VIR_ERR_CONF_SYNTAX'/> <ref name='VIR_ERR_DOM_EXIST'/> @@ -912,11 +987,17 @@ <ref name='VIR_GET_CPUMAP'/> <ref name='virConnectOpenReadOnly'/> </word> + <word name='Additional'> + <ref name='_virConnectCredential'/> + </word> <word name='After'> <ref name='virDomainSave'/> </word> <word name='Attempt'> <ref name='virDomainMigrate'/> + </word> + <word name='Authenticate'> + <ref name='virConnectOpenAuth'/> </word> </letter> <letter name='B'> @@ -956,6 +1037,9 @@ <ref name='virDomainPinVcpu'/> <ref name='virDomainSetVcpus'/> </word> + <word name='Callback'> + <ref name='_virConnectAuth'/> + </word> <word name='Change'> <ref name='virDomainSetSchedulerParameters'/> </word> @@ -1058,6 +1142,7 @@ <ref name='virConnectGetType'/> <ref name='virConnectGetVersion'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> </word> </letter> <letter name='I'> @@ -1085,8 +1170,14 @@ <word name='Launch'> <ref name='virDomainCreateLinux'/> </word> + <word name='Length'> + <ref name='_virConnectCredential'/> + </word> <word name='Linux'> <ref name='virDomainCreateLinux'/> + </word> + <word name='List'> + <ref name='_virConnectAuth'/> </word> </letter> <letter name='M'> @@ -1132,12 +1223,22 @@ <ref name='virGetVersion'/> </word> <word name='One'> + <ref name='_virConnectCredential'/> <ref name='virConnCopyLastError'/> <ref name='virCopyLastError'/> <ref name='virDomainGetVcpus'/> </word> + <word name='Open'> + <ref name='virConnectOpenAuth'/> + </word> + <word name='Optional'> + <ref name='_virConnectCredential'/> + </word> </letter> <letter name='P'> + <word name='Prompt'> + <ref name='_virConnectCredential'/> + </word> <word name='Provide'> <ref name='virConnGetLastError'/> <ref name='virDomainGetXMLDesc'/> @@ -1179,6 +1280,9 @@ <ref name='virResetError'/> <ref name='virResetLastError'/> </word> + <word name='Result'> + <ref name='_virConnectCredential'/> + </word> <word name='Resume'> <ref name='virDomainResume'/> </word> @@ -1235,11 +1339,13 @@ <word name='URI'> <ref name='virConnectGetURI'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainMigrate'/> </word> <word name='URIs'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainMigrate'/> </word> @@ -1274,6 +1380,8 @@ <ref name='virDomainSuspend'/> </word> </letter> + </chunk> + <chunk name='chunk1'> <letter name='V'> <word name='VIR_COPY_CPUMAP'> <ref name='VIR_COPY_CPUMAP'/> @@ -1307,8 +1415,6 @@ <ref name='virNetworkGetUUIDString'/> </word> </letter> - </chunk> - <chunk name='chunk1'> <letter name='W'> <word name='WARNING:'> <ref name='virDomainGetConnect'/> @@ -1464,6 +1570,7 @@ <ref name='virConnectClose'/> <ref name='virConnectGetHostname'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainDestroy'/> <ref name='virDomainMigrate'/> @@ -1506,6 +1613,9 @@ <word name='attribute'> <ref name='virConnectGetMaxVcpus'/> <ref name='virDomainBlockStats'/> + </word> + <word name='authentication'> + <ref name='virConnectOpenAuth'/> </word> <word name='automatically'> <ref name='virDomainGetAutostart'/> @@ -1633,6 +1743,8 @@ <ref name='virNetworkGetUUIDString'/> </word> </letter> + </chunk> + <chunk name='chunk2'> <letter name='c'> <word name='calculate'> <ref name='VIR_NODEINFO_MAXCPUS'/> @@ -1654,6 +1766,7 @@ </word> <word name='callback'> <ref name='virConnSetErrorFunc'/> + <ref name='virConnectOpenAuth'/> <ref name='virErrorFunc'/> <ref name='virSetErrorFunc'/> </word> @@ -1661,6 +1774,7 @@ <ref name='virConnSetErrorFunc'/> <ref name='virConnectClose'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virSetErrorFunc'/> </word> @@ -1729,6 +1843,9 @@ <word name='cells'> <ref name='virNodeGetCellsFreeMemory'/> </word> + <word name='challenge'> + <ref name='_virConnectCredential'/> + </word> <word name='change'> <ref name='virDomainPinVcpu'/> <ref name='virDomainSetMaxMemory'/> @@ -1755,6 +1872,7 @@ <ref name='virGetVersion'/> </word> <word name='collect'> + <ref name='_virConnectAuth'/> <ref name='virConnectListDomains'/> <ref name='virConnectListNetworks'/> </word> @@ -1789,6 +1907,9 @@ </word> <word name='consequent'> <ref name='_virError'/> + </word> + <word name='constants'> + <ref name='_virConnectCredential'/> </word> <word name='content'> <ref name='virConnCopyLastError'/> @@ -1846,6 +1967,10 @@ <word name='create'> <ref name='virNetworkDefineXML'/> </word> + <word name='credentials'> + <ref name='_virConnectAuth'/> + <ref name='virConnectOpenAuth'/> + </word> <word name='cupmap'> <ref name='virDomainGetVcpus'/> </word> @@ -1856,8 +1981,6 @@ <ref name='virDomainCoreDump'/> </word> </letter> - </chunk> - <chunk name='chunk2'> <letter name='d'> <word name='data'> <ref name='virConnSetErrorFunc'/> @@ -1876,6 +1999,7 @@ <ref name='virNetworkGetName'/> </word> <word name='default'> + <ref name='_virConnectCredential'/> <ref name='virConnSetErrorFunc'/> <ref name='virDomainMigrate'/> <ref name='virSetErrorFunc'/> @@ -1892,6 +2016,9 @@ </word> <word name='defining'> <ref name='virConnectGetCapabilities'/> + </word> + <word name='defresult'> + <ref name='_virConnectCredential'/> </word> <word name='described'> <ref name='virDomainGetVcpus'/> @@ -1945,6 +2072,7 @@ </word> <word name='documented'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> </word> <word name='does'> @@ -1984,6 +2112,8 @@ <ref name='virDomainMigrate'/> </word> </letter> + </chunk> + <chunk name='chunk3'> <letter name='e'> <word name='each'> <ref name='virDomainBlockStats'/> @@ -2053,6 +2183,9 @@ <word name='features'> <ref name='virDomainMigrate'/> </word> + <word name='fetching'> + <ref name='virConnectOpenAuth'/> + </word> <word name='field'> <ref name='VIR_DOMAIN_SCHED_FIELD_LENGTH'/> </word> @@ -2065,6 +2198,7 @@ <ref name='virDomainSave'/> </word> <word name='filled'> + <ref name='_virConnectCredential'/> <ref name='virDomainGetSchedulerParameters'/> <ref name='virDomainGetVcpus'/> <ref name='virNodeGetCellsFreeMemory'/> @@ -2078,10 +2212,12 @@ </word> <word name='first'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virNodeGetCellsFreeMemory'/> </word> <word name='flags'> + <ref name='virConnectOpenAuth'/> <ref name='virDomainCoreDump'/> <ref name='virDomainMigrate'/> <ref name='virDomainReboot'/> @@ -2159,6 +2295,7 @@ <ref name='virConnSetErrorFunc'/> <ref name='virConnectClose'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainBlockStats'/> <ref name='virDomainCreateLinux'/> @@ -2191,6 +2328,7 @@ <word name='get'> <ref name='virConnSetErrorFunc'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainBlockStats'/> <ref name='virDomainGetInfo'/> @@ -2232,8 +2370,6 @@ <ref name='virDomainShutdown'/> </word> </letter> - </chunk> - <chunk name='chunk3'> <letter name='h'> <word name='handler'> <ref name='virConnSetErrorFunc'/> @@ -2276,11 +2412,13 @@ <word name='html'> <ref name='virConnectGetType'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> </word> <word name='http:'> <ref name='virConnectGetType'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> </word> <word name='human-readable'> @@ -2388,6 +2526,8 @@ <ref name='virNetworkLookupByUUIDString'/> </word> </letter> + </chunk> + <chunk name='chunk4'> <letter name='j'> <word name='join'> <ref name='virNetworkGetBridgeName'/> @@ -2479,6 +2619,7 @@ </word> <word name='libvirt'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainGetConnect'/> <ref name='virDomainMigrate'/> @@ -2709,8 +2850,6 @@ <ref name='_virDomainBlockStats'/> </word> </letter> - </chunk> - <chunk name='chunk4'> <letter name='n'> <word name='name'> <ref name='_virSchedParameter'/> @@ -2736,6 +2875,9 @@ </word> <word name='neccessarily'> <ref name='VIR_NODEINFO_MAXCPUS'/> + </word> + <word name='neccessary'> + <ref name='virConnectOpenAuth'/> </word> <word name='need'> <ref name='virConnCopyLastError'/> @@ -2789,6 +2931,8 @@ <ref name='virDomainSetSchedulerParameters'/> </word> </letter> + </chunk> + <chunk name='chunk5'> <letter name='o'> <word name='objects'> <ref name='virDomainSetSchedulerParameters'/> @@ -2839,6 +2983,7 @@ </word> <word name='org'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> </word> <word name='other'> @@ -2874,6 +3019,7 @@ <ref name='virDomainSetSchedulerParameters'/> </word> <word name='parameters'> + <ref name='virConnectOpenAuth'/> <ref name='virDomainGetSchedulerParameters'/> <ref name='virDomainGetSchedulerType'/> <ref name='virDomainSetSchedulerParameters'/> @@ -2908,6 +3054,9 @@ </word> <word name='perform'> <ref name='virDomainMigrate'/> + </word> + <word name='performed'> + <ref name='virConnectOpenAuth'/> </word> <word name='physical'> <ref name='VIR_CPU_MAPLEN'/> @@ -3102,6 +3251,9 @@ <ref name='virDomainSuspend'/> <ref name='virNetworkDestroy'/> </word> + <word name='response'> + <ref name='_virConnectCredential'/> + </word> <word name='restart'> <ref name='virDomainReboot'/> </word> @@ -3116,6 +3268,7 @@ <ref name='virConnectOpenReadOnly'/> </word> <word name='result'> + <ref name='_virConnectCredential'/> <ref name='virConnCopyLastError'/> <ref name='virConnectGetHostname'/> <ref name='virCopyLastError'/> @@ -3193,7 +3346,7 @@ </word> </letter> </chunk> - <chunk name='chunk5'> + <chunk name='chunk6'> <letter name='s'> <word name='same'> <ref name='virConnectGetURI'/> @@ -3242,6 +3395,7 @@ <word name='should'> <ref name='virConnectClose'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainBlockStats'/> <ref name='virDomainDestroy'/> @@ -3254,6 +3408,9 @@ <ref name='virNetworkDestroy'/> <ref name='virNetworkFree'/> <ref name='virNetworkSetAutostart'/> + </word> + <word name='show'> + <ref name='_virConnectCredential'/> </word> <word name='shutdown'> <ref name='virDomainDestroy'/> @@ -3428,6 +3585,7 @@ </word> <word name='supported'> <ref name='VIR_NODEINFO_MAXCPUS'/> + <ref name='_virConnectAuth'/> <ref name='virConnectGetMaxVcpus'/> <ref name='virDomainGetMaxVcpus'/> <ref name='virDomainMigrate'/> @@ -3589,7 +3747,7 @@ </word> </letter> </chunk> - <chunk name='chunk6'> + <chunk name='chunk7'> <letter name='u'> <word name='undefine'> <ref name='virDomainUndefine'/> @@ -3615,6 +3773,7 @@ </word> <word name='uri'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainMigrate'/> </word> @@ -3642,6 +3801,7 @@ <ref name='VIR_GET_CPUMAP'/> <ref name='VIR_UNUSE_CPU'/> <ref name='VIR_USE_CPU'/> + <ref name='_virConnectAuth'/> <ref name='_virDomainInfo'/> <ref name='_virVcpuInfo'/> <ref name='virConnectGetType'/> @@ -3658,6 +3818,7 @@ <ref name='virNetworkGetXMLDesc'/> </word> <word name='user'> + <ref name='_virConnectCredential'/> <ref name='virConnSetErrorFunc'/> <ref name='virDomainGetInfo'/> <ref name='virDomainMigrate'/> @@ -3686,6 +3847,7 @@ <ref name='virNetworkGetXMLDesc'/> </word> <word name='values'> + <ref name='_virConnectAuth'/> <ref name='virDomainGetSchedulerParameters'/> <ref name='virGetVersion'/> </word> @@ -3702,8 +3864,15 @@ <ref name='virConnectGetVersion'/> <ref name='virGetVersion'/> </word> + <word name='via'> + <ref name='virConnectOpenAuth'/> + </word> <word name='virConnCopyLastError'> <ref name='virConnGetLastError'/> + </word> + <word name='virConnectCredentialType'> + <ref name='_virConnectAuth'/> + <ref name='_virConnectCredential'/> </word> <word name='virConnectGetCapabilities'> <ref name='virDomainMigrate'/> @@ -3882,6 +4051,7 @@ <ref name='virConnCopyLastError'/> <ref name='virConnSetErrorFunc'/> <ref name='virConnectGetURI'/> + <ref name='virConnectOpenAuth'/> <ref name='virCopyLastError'/> <ref name='virDomainCoreDump'/> <ref name='virDomainGetMaxVcpus'/> @@ -3903,6 +4073,7 @@ <ref name='VIR_GET_CPUMAP'/> <ref name='VIR_UNUSE_CPU'/> <ref name='VIR_USE_CPU'/> + <ref name='_virConnectCredential'/> <ref name='virConnCopyLastError'/> <ref name='virConnectClose'/> <ref name='virConnectGetVersion'/> @@ -3935,7 +4106,7 @@ </word> </letter> </chunk> - <chunk name='chunk7'> + <chunk name='chunk8'> <letter name='x'> <word name='xen'> <ref name='virConnectOpen'/> @@ -3964,14 +4135,15 @@ </letter> </chunk> <chunks> - <chunk name='chunk0' start='A' end='V'/> - <chunk name='chunk1' start='W' end='c'/> - <chunk name='chunk2' start='d' end='g'/> - <chunk name='chunk3' start='h' end='m'/> - <chunk name='chunk4' start='n' end='r'/> - <chunk name='chunk5' start='s' end='t'/> - <chunk name='chunk6' start='u' end='w'/> - <chunk name='chunk7' start='x' end='z'/> + <chunk name='chunk0' start='A' end='U'/> + <chunk name='chunk1' start='V' end='b'/> + <chunk name='chunk2' start='c' end='d'/> + <chunk name='chunk3' start='e' end='i'/> + <chunk name='chunk4' start='j' end='n'/> + <chunk name='chunk5' start='o' end='r'/> + <chunk name='chunk6' start='s' end='t'/> + <chunk name='chunk7' start='u' end='w'/> + <chunk name='chunk8' start='x' end='z'/> </chunks> </index> </apirefs> diff -r ec2d8c632fd9 include/libvirt/libvirt.h.in --- a/include/libvirt/libvirt.h.in Wed Nov 28 15:00:45 2007 -0500 +++ b/include/libvirt/libvirt.h.in Wed Nov 28 20:35:24 2007 -0500 @@ -1,3 +1,4 @@ + /* -*- c -*- * libvirt.h: * Summary: core interfaces for the libvirt library @@ -275,6 +276,74 @@ typedef virNodeInfo *virNodeInfoPtr; typedef virNodeInfo *virNodeInfoPtr; /** + * virConnectFlags + * + * Flags when openning a connection to a hypervisor + */ +typedef enum { + VIR_CONNECT_RO = 1, /* A readonly connection */ +} virConnectFlags; + + +typedef enum { + VIR_CRED_USERNAME = 1, /* Identity to act as */ + VIR_CRED_AUTHNAME = 2, /* Identify to authorize as */ + VIR_CRED_LANGUAGE = 3, /* RFC 1766 languages, comma separated */ + VIR_CRED_CNONCE = 4, /* client supplies a nonce */ + VIR_CRED_PASSPHRASE = 5, /* Passphrase secret */ + VIR_CRED_ECHOPROMPT = 6, /* Challenge response */ + VIR_CRED_NOECHOPROMPT = 7, /* Challenge response */ + VIR_CRED_REALM = 8, /* Authentication realm */ + VIR_CRED_EXTERNAL = 9, /* Externally managed credential */ + + /* More may be added - expect the unexpected */ +} virConnectCredentialType; + +struct _virConnectCredential { + int type; /* One of virConnectCredentialType constants */ + const char *prompt; /* Prompt to show to user */ + const char *challenge; /* Additional challenge to show */ + const char *defresult; /* Optional default result */ + char *result; /* Result to be filled with user response (or defresult) */ + unsigned int resultlen; /* Length of the result */ +}; + +typedef struct _virConnectCredential virConnectCredential; +typedef virConnectCredential *virConnectCredentialPtr; + + +/** + * virConnectCredCallbackPtr + * + * @param authtype type of authentication being performed + * @param cred array of credentials to fetch from user + * @param ncred size of cred array + * @param cbdata opaque data passed to virConnectOpenAuth + * + * When authentication requires one or more interactions, this callback + * is invoked. For each interaction supplied, data must be gathered + * from the user and filled in to the 'result' and 'resultlen' fields. + * If an interaction can not be filled, fill in NULL and 0. + * + * Return 0 if all interactions were filled, or -1 upon error + */ +typedef int (*virConnectAuthCallbackPtr)(virConnectCredentialPtr cred, + unsigned int ncred, + void *cbdata); + +struct _virConnectAuth { + int *credtype; /* List of supported virConnectCredentialType values */ + unsigned int ncredtype; + + virConnectAuthCallbackPtr cb; /* Callback used to collect credentials */ + void *cbdata; +}; + + +typedef struct _virConnectAuth virConnectAuth; +typedef virConnectAuth *virConnectAuthPtr; + +/** * VIR_UUID_BUFLEN: * * This macro provides the length of the buffer required @@ -314,6 +383,9 @@ int virInitialize (void); virConnectPtr virConnectOpen (const char *name); virConnectPtr virConnectOpenReadOnly (const char *name); +virConnectPtr virConnectOpenAuth (const char *name, + virConnectAuthPtr auth, + int flags); int virConnectClose (virConnectPtr conn); const char * virConnectGetType (virConnectPtr conn); int virConnectGetVersion (virConnectPtr conn, diff -r ec2d8c632fd9 proxy/libvirt_proxy.c --- a/proxy/libvirt_proxy.c Wed Nov 28 15:00:45 2007 -0500 +++ b/proxy/libvirt_proxy.c Wed Nov 28 20:35:24 2007 -0500 @@ -77,7 +77,7 @@ proxyInitXen(void) { priv->xshandle = NULL; priv->proxy = -1; - ret = xenHypervisorOpen(conn, NULL, 0); + ret = xenHypervisorOpen(conn, NULL, NULL, 0); if (ret < 0) { fprintf(stderr, "Failed to open Xen hypervisor\n"); return(-1); @@ -93,7 +93,7 @@ proxyInitXen(void) { fprintf(stderr, "Failed to connect to Xen daemon\n"); return(-1); } - ret = xenStoreOpen(conn, NULL, VIR_DRV_OPEN_RO); + ret = xenStoreOpen(conn, NULL, NULL, VIR_CONNECT_RO); if (ret < 0) { fprintf(stderr, "Failed to open XenStore connection"); return (-1); diff -r ec2d8c632fd9 qemud/remote.c --- a/qemud/remote.c Wed Nov 28 15:00:45 2007 -0500 +++ b/qemud/remote.c Wed Nov 28 20:35:24 2007 -0500 @@ -2062,7 +2062,7 @@ remoteDispatchAuthList (struct qemud_ser remote_auth_list_ret *ret) { ret->types.types_len = 1; - if ((ret->types.types_val = calloc (ret->types.types_len, sizeof (remote_auth_type))) == NULL) { + if ((ret->types.types_val = calloc (ret->types.types_len, sizeof (u_int))) == NULL) { remoteDispatchSendError(client, req, VIR_ERR_NO_MEMORY, "auth types"); return -2; } diff -r ec2d8c632fd9 src/driver.h --- a/src/driver.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/driver.h Wed Nov 28 20:35:24 2007 -0500 @@ -27,11 +27,6 @@ typedef enum { } virDrvNo; -typedef enum { - /* VIR_DRV_OPEN_QUIET = 1 - removed by RWMJ */ - VIR_DRV_OPEN_RO = 2 -} virDrvOpenFlag; - /* Status codes returned from driver open call. */ typedef enum { /* Opened successfully. */ @@ -76,8 +71,9 @@ typedef enum { typedef virDrvOpenStatus (*virDrvOpen) (virConnectPtr conn, - xmlURIPtr uri, - int flags); + xmlURIPtr uri, + virConnectAuthPtr auth, + int flags); typedef int (*virDrvClose) (virConnectPtr conn); typedef int diff -r ec2d8c632fd9 src/internal.h --- a/src/internal.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/internal.h Wed Nov 28 20:35:24 2007 -0500 @@ -129,11 +129,6 @@ extern "C" { */ #define MAX_DRIVERS 10 #define MIN_XEN_GUEST_SIZE 64 /* 64 megabytes */ - -/* - * Flags for Xen connections - */ -#define VIR_CONNECT_RO 1 /** * _virConnect: diff -r ec2d8c632fd9 src/libvirt.c --- a/src/libvirt.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/libvirt.c Wed Nov 28 20:35:24 2007 -0500 @@ -395,7 +395,9 @@ virGetVersion(unsigned long *libVer, con } static virConnectPtr -do_open (const char *name, int flags) +do_open (const char *name, + virConnectAuthPtr auth, + int flags) { int i, res; virConnectPtr ret = NULL; @@ -458,7 +460,7 @@ do_open (const char *name, int flags) fprintf (stderr, "libvirt: do_open: trying driver %d (%s) ...\n", i, virDriverTab[i]->name); #endif - res = virDriverTab[i]->open (ret, uri, flags); + res = virDriverTab[i]->open (ret, uri, auth, flags); #ifdef ENABLE_DEBUG fprintf (stderr, "libvirt: do_open: driver %d %s returned %s\n", i, virDriverTab[i]->name, @@ -480,7 +482,7 @@ do_open (const char *name, int flags) } for (i = 0; i < virNetworkDriverTabCount; i++) { - res = virNetworkDriverTab[i]->open (ret, uri, flags); + res = virNetworkDriverTab[i]->open (ret, uri, auth, flags); #ifdef ENABLE_DEBUG fprintf (stderr, "libvirt: do_open: network driver %d %s returned %s\n", i, virNetworkDriverTab[i]->name, @@ -500,9 +502,8 @@ do_open (const char *name, int flags) } } - if (flags & VIR_DRV_OPEN_RO) { - ret->flags = VIR_CONNECT_RO; - } + /* Cleansing flags */ + ret->flags = flags & VIR_CONNECT_RO; xmlFreeURI (uri); @@ -531,7 +532,7 @@ virConnectOpen (const char *name) virConnectOpen (const char *name) { DEBUG("name=%s", name); - return do_open (name, 0); + return do_open (name, NULL, 0); } /** @@ -550,7 +551,30 @@ virConnectOpenReadOnly(const char *name) virConnectOpenReadOnly(const char *name) { DEBUG("name=%s", name); - return do_open (name, VIR_DRV_OPEN_RO); + return do_open (name, NULL, VIR_CONNECT_RO); +} + +/** + * virConnectOpenAuth: + * @name: URI of the hypervisor + * @auth: Authenticate callback parameters + * @flags: Open flags + * + * This function should be called first to get a connection to the + * Hypervisor. If neccessary, authentication will be performed fetching + * credentials via the callback + * + * Returns a pointer to the hypervisor connection or NULL in case of error + * + * URIs are documented at http://libvirt.org/uri.html + */ +virConnectPtr +virConnectOpenAuth(const char *name, + virConnectAuthPtr auth, + int flags) +{ + DEBUG("name=%s", name); + return do_open (name, auth, flags); } /** diff -r ec2d8c632fd9 src/openvz_driver.c --- a/src/openvz_driver.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/openvz_driver.c Wed Nov 28 20:35:24 2007 -0500 @@ -89,7 +89,12 @@ static int openvzActive(void); static int openvzActive(void); static int openvzCloseNetwork(virConnectPtr conn); static virDrvOpenStatus openvzOpenNetwork(virConnectPtr conn, - const char *name ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED); + const char *name ATTRIBUTE_UNUSED, + int *credtype ATTRIBUTE_UNUSED, + int ncredtype ATTRIBUTE_UNUSED, + virConnectAuthCallbackPtr cb ATTRIBUTE_UNUSED, + void *cbdata ATTRIBUTE_UNUSED, + int flags ATTRIBUTE_UNUSED); static virDomainPtr openvzDomainDefineXML(virConnectPtr conn, const char *xml); static virDomainPtr openvzDomainCreateLinux(virConnectPtr conn, const char *xml, @@ -551,8 +556,12 @@ bail_out5: } static virDrvOpenStatus openvzOpen(virConnectPtr conn, - const char *name, - int flags ATTRIBUTE_UNUSED) { + const char *name, + int *credtype ATTRIBUTE_UNUSED, + int ncredtype ATTRIBUTE_UNUSED, + virConnectAuthCallbackPtr cb ATTRIBUTE_UNUSED, + void *cbdata ATTRIBUTE_UNUSED, + int flags ATTRIBUTE_UNUSED) { struct openvz_vm *vms; /* Just check if the guy is root. Nothing really to open for OpenVZ */ @@ -693,8 +702,12 @@ static int openvzCloseNetwork(virConnect } static virDrvOpenStatus openvzOpenNetwork(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *name ATTRIBUTE_UNUSED, - int flags ATTRIBUTE_UNUSED) { + const char *name ATTRIBUTE_UNUSED, + int *credtype ATTRIBUTE_UNUSED, + int ncredtype ATTRIBUTE_UNUSED, + virConnectAuthCallbackPtr cb ATTRIBUTE_UNUSED, + void *cbdata ATTRIBUTE_UNUSED, + int flags ATTRIBUTE_UNUSED) { return VIR_DRV_OPEN_SUCCESS; } diff -r ec2d8c632fd9 src/proxy_internal.c --- a/src/proxy_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/proxy_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -29,7 +29,7 @@ static int debug = 0; static int debug = 0; static int xenProxyClose(virConnectPtr conn); -static int xenProxyOpen(virConnectPtr conn, xmlURIPtr uri, int flags); +static int xenProxyOpen(virConnectPtr conn, xmlURIPtr uri, virConnectAuthPtr auth, int flags); static int xenProxyGetVersion(virConnectPtr conn, unsigned long *hvVer); static int xenProxyNodeGetInfo(virConnectPtr conn, virNodeInfoPtr info); static char *xenProxyGetCapabilities(virConnectPtr conn); @@ -521,14 +521,17 @@ retry: * Returns 0 in case of success, and -1 in case of failure */ int -xenProxyOpen(virConnectPtr conn, xmlURIPtr uri ATTRIBUTE_UNUSED, int flags) +xenProxyOpen(virConnectPtr conn, + xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, + int flags) { virProxyPacket req; int ret; int fd; xenUnifiedPrivatePtr priv; - if (!(flags & VIR_DRV_OPEN_RO)) + if (!(flags & VIR_CONNECT_RO)) return(-1); priv = (xenUnifiedPrivatePtr) conn->privateData; diff -r ec2d8c632fd9 src/qemu_driver.c --- a/src/qemu_driver.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/qemu_driver.c Wed Nov 28 20:35:24 2007 -0500 @@ -1387,6 +1387,7 @@ static int qemudMonitorCommand(struct qe static virDrvOpenStatus qemudOpen(virConnectPtr conn, xmlURIPtr uri, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { uid_t uid = getuid(); @@ -2572,6 +2573,7 @@ static virNetworkPtr qemudNetworkLookupB static virDrvOpenStatus qemudOpenNetwork(virConnectPtr conn, xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { if (!qemu_driver) return VIR_DRV_OPEN_DECLINED; diff -r ec2d8c632fd9 src/remote_internal.c --- a/src/remote_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/remote_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -286,7 +286,6 @@ remoteForkDaemon(virConnectPtr conn) } -/* Must not overlap with virDrvOpenFlags */ enum virDrvOpenRemoteFlags { VIR_DRV_OPEN_REMOTE_RO = (1 << 0), VIR_DRV_OPEN_REMOTE_UNIX = (1 << 1), @@ -295,8 +294,11 @@ enum virDrvOpenRemoteFlags { }; static int -doRemoteOpen (virConnectPtr conn, struct private_data *priv, - xmlURIPtr uri, int flags) +doRemoteOpen (virConnectPtr conn, + struct private_data *priv, + xmlURIPtr uri, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, + int flags) { if (!uri || !uri->scheme) return VIR_DRV_OPEN_DECLINED; /* Decline - not a URL. */ @@ -779,7 +781,10 @@ doRemoteOpen (virConnectPtr conn, struct } static int -remoteOpen (virConnectPtr conn, xmlURIPtr uri, int flags) +remoteOpen (virConnectPtr conn, + xmlURIPtr uri, + virConnectAuthPtr auth, + int flags) { struct private_data *priv; int ret, rflags = 0; @@ -793,7 +798,7 @@ remoteOpen (virConnectPtr conn, xmlURIPt return VIR_DRV_OPEN_ERROR; } - if (flags & VIR_DRV_OPEN_RO) + if (flags & VIR_CONNECT_RO) rflags |= VIR_DRV_OPEN_REMOTE_RO; if (uri && @@ -814,7 +819,7 @@ remoteOpen (virConnectPtr conn, xmlURIPt memset(priv, 0, sizeof(struct private_data)); priv->magic = DEAD; priv->sock = -1; - ret = doRemoteOpen(conn, priv, uri, rflags); + ret = doRemoteOpen(conn, priv, uri, auth, rflags); if (ret != VIR_DRV_OPEN_SUCCESS) { conn->privateData = NULL; free(priv); @@ -2442,6 +2447,7 @@ static int static int remoteNetworkOpen (virConnectPtr conn, xmlURIPtr uri, + virConnectAuthPtr auth, int flags) { if (inside_daemon) @@ -2468,14 +2474,14 @@ remoteNetworkOpen (virConnectPtr conn, error (conn, VIR_ERR_NO_MEMORY, "struct private_data"); return VIR_DRV_OPEN_ERROR; } - if (flags & VIR_DRV_OPEN_RO) + if (flags & VIR_CONNECT_RO) rflags |= VIR_DRV_OPEN_REMOTE_RO; rflags |= VIR_DRV_OPEN_REMOTE_UNIX; memset(priv, 0, sizeof(struct private_data)); priv->magic = DEAD; priv->sock = -1; - ret = doRemoteOpen(conn, priv, uri, rflags); + ret = doRemoteOpen(conn, priv, uri, auth, rflags); if (ret != VIR_DRV_OPEN_SUCCESS) { conn->networkPrivateData = NULL; free(priv); diff -r ec2d8c632fd9 src/test.c --- a/src/test.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/test.c Wed Nov 28 20:35:24 2007 -0500 @@ -882,6 +882,7 @@ static int getNetworkIndex(virNetworkPtr static int testOpen(virConnectPtr conn, xmlURIPtr uri, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { int ret; @@ -1644,6 +1645,7 @@ static int testDomainSetSchedulerParams( static virDrvOpenStatus testOpenNetwork(virConnectPtr conn, xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { if (STRNEQ(conn->driver->name, "Test")) return VIR_DRV_OPEN_DECLINED; diff -r ec2d8c632fd9 src/xen_internal.c --- a/src/xen_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xen_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -2060,6 +2060,7 @@ int int xenHypervisorOpen(virConnectPtr conn, xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { int ret; diff -r ec2d8c632fd9 src/xen_internal.h --- a/src/xen_internal.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xen_internal.h Wed Nov 28 20:35:24 2007 -0500 @@ -31,6 +31,7 @@ char * int xenHypervisorOpen (virConnectPtr conn, xmlURIPtr uri, + virConnectAuthPtr auth, int flags); int xenHypervisorClose (virConnectPtr conn); int xenHypervisorGetVersion (virConnectPtr conn, diff -r ec2d8c632fd9 src/xen_unified.c --- a/src/xen_unified.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xen_unified.c Wed Nov 28 20:35:24 2007 -0500 @@ -217,7 +217,7 @@ done: */ static int -xenUnifiedOpen (virConnectPtr conn, xmlURIPtr uri, int flags) +xenUnifiedOpen (virConnectPtr conn, xmlURIPtr uri, virConnectAuthPtr auth, int flags) { int i, j; xenUnifiedPrivatePtr priv; @@ -272,7 +272,7 @@ xenUnifiedOpen (virConnectPtr conn, xmlU #ifdef ENABLE_DEBUG fprintf (stderr, "libvirt: xenUnifiedOpen: trying Xen sub-driver %d\n", i); #endif - if (drivers[i]->open (conn, uri, flags) == VIR_DRV_OPEN_SUCCESS) + if (drivers[i]->open (conn, uri, auth, flags) == VIR_DRV_OPEN_SUCCESS) priv->opened[i] = 1; #ifdef ENABLE_DEBUG fprintf (stderr, "libvirt: xenUnifiedOpen: Xen sub-driver %d open %s\n", diff -r ec2d8c632fd9 src/xend_internal.c --- a/src/xend_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xend_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -237,7 +237,7 @@ do_connect(virConnectPtr xend) * is rather normal, this should fallback to the proxy (or * remote) mechanism. */ - if ((getuid() == 0) || (xend->flags & VIR_DRV_OPEN_RO)) { + if ((getuid() == 0) || (xend->flags & VIR_CONNECT_RO)) { virXendError(xend, VIR_ERR_INTERNAL_ERROR, "failed to connect to xend"); } @@ -2044,7 +2044,9 @@ error: * Returns 0 in case of success, -1 in case of error. */ int -xenDaemonOpen(virConnectPtr conn, xmlURIPtr uri, +xenDaemonOpen(virConnectPtr conn, + xmlURIPtr uri, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { int ret; diff -r ec2d8c632fd9 src/xend_internal.h --- a/src/xend_internal.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xend_internal.h Wed Nov 28 20:35:24 2007 -0500 @@ -183,7 +183,7 @@ char *xenDaemonDomainDumpXMLByName(virCo char *xend_parse_domain_sexp(virConnectPtr conn, char *root, int xendConfigVersion); /* refactored ones */ -int xenDaemonOpen(virConnectPtr conn, xmlURIPtr uri, int flags); +int xenDaemonOpen(virConnectPtr conn, xmlURIPtr uri, virConnectAuthPtr auth, int flags); int xenDaemonClose(virConnectPtr conn); int xenDaemonGetVersion(virConnectPtr conn, unsigned long *hvVer); int xenDaemonNodeGetInfo(virConnectPtr conn, virNodeInfoPtr info); diff -r ec2d8c632fd9 src/xm_internal.c --- a/src/xm_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xm_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -473,7 +473,9 @@ static int xenXMConfigCacheRefresh (virC */ int xenXMOpen (virConnectPtr conn ATTRIBUTE_UNUSED, - xmlURIPtr uri ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) + xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, + int flags ATTRIBUTE_UNUSED) { if (configCache == NULL) { configCache = virHashCreate(50); diff -r ec2d8c632fd9 src/xm_internal.h --- a/src/xm_internal.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xm_internal.h Wed Nov 28 20:35:24 2007 -0500 @@ -36,7 +36,7 @@ extern struct xenUnifiedDriver xenXMDriv extern struct xenUnifiedDriver xenXMDriver; int xenXMInit (void); -int xenXMOpen(virConnectPtr conn, xmlURIPtr uri, int flags); +int xenXMOpen(virConnectPtr conn, xmlURIPtr uri, virConnectAuthPtr auth, int flags); int xenXMClose(virConnectPtr conn); const char *xenXMGetType(virConnectPtr conn); int xenXMDomainGetInfo(virDomainPtr domain, virDomainInfoPtr info); diff -r ec2d8c632fd9 src/xs_internal.c --- a/src/xs_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xs_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -327,6 +327,7 @@ int int xenStoreOpen(virConnectPtr conn, xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { xenUnifiedPrivatePtr priv = (xenUnifiedPrivatePtr) conn->privateData; @@ -334,7 +335,7 @@ xenStoreOpen(virConnectPtr conn, #ifdef PROXY priv->xshandle = xs_daemon_open_readonly(); #else - if (flags & VIR_DRV_OPEN_RO) + if (flags & VIR_CONNECT_RO) priv->xshandle = xs_daemon_open_readonly(); else priv->xshandle = xs_daemon_open(); diff -r ec2d8c632fd9 src/xs_internal.h --- a/src/xs_internal.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xs_internal.h Wed Nov 28 20:35:24 2007 -0500 @@ -22,6 +22,7 @@ int xenStoreInit (void); int xenStoreOpen (virConnectPtr conn, xmlURIPtr uri, + virConnectAuthPtr auth, int flags); int xenStoreClose (virConnectPtr conn); int xenStoreGetDomainInfo (virDomainPtr domain, -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

On Mon, Dec 03, 2007 at 07:33:49PM +0100, Jim Meyering wrote: Yes, everything in src & qemud dirs includes libvirt.h, and if you ever change libvirt.h.in, then we need to make sure libvirt.h is re-generated before compiling src & qemud otherwise we potentially mis-compile. Its a minor thing, but worth getting right to avoid suprising developers like myself in future :-) Sounds reasonable to me. Regards, Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

"Daniel P. Berrange" <berrange(a)redhat.com&gt; wrote: Hi Dan, I have to start by admitting I've never used or even looked at policykit before. If printf or fflush fails, this probably return -1. A consistency nit: you might want to make EOF be treated the same as an empty name. Currently typing EOF to fgets (which then returns NULL) makes this code return -1, while entering an empty line doesn't. At least with passwords, I confirmed that cvs login treats ^D like the empty string. On the other hand, an empty name probably makes no sense in many applications. If getpass fails (it'd return NULL), return -1. Otherwise, the following strdup would segfault.

On Mon, Dec 03, 2007 at 11:53:04PM +0100, Jim Meyering wrote: Committed with this & the other suggested fixes all included. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

Daniel P. Berrange wrote: All ACKed except: Don't we need to dup these strings because the following xdr_free (in the caller) will free them? Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

Daniel P. Berrange wrote: Right you are, so +1. Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

This patch will automatically disable the Xen setuid proxy if PolicyKit support is found to be enabled. It is possible to override this and force use of the proxy with --with-xen-proxy. Likewise it is possible to force disabling the proxy with the --without-xen-proxy arg. configure.in | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff -r 87b465795305 configure.in --- a/configure.in Thu Nov 29 10:02:55 2007 -0500 +++ b/configure.in Thu Nov 29 10:23:48 2007 -0500 @@ -571,7 +571,24 @@ fi fi dnl Enable building the proxy? -AM_CONDITIONAL(WITH_PROXY,[test "x$with_xen" = "xyes"]) + +AC_ARG_WITH(xen-proxy, +[ --with-xen-proxy add XEN setuid proxy support (on)],[],[with_xen_proxy=auto]) + +AC_MSG_CHECKING([if Xen setuid proxy is needed]) +if test "$with_xen_proxy" = "auto"; then + if test "$with_polkit" = "yes"; then + with_xen_proxy="no" + else + with_xen_proxy="yes" + fi +fi +if test "$with_xen" != "yes"; then + with_xen_proxy="no" +fi +AC_MSG_RESULT([$with_xen_proxy]) + +AM_CONDITIONAL(WITH_PROXY,[test "$with_xen_proxy" = "yes"]) dnl Check for gettext AM_GNU_GETTEXT_VERSION([0.14.1]) @@ -609,6 +626,7 @@ AC_MSG_NOTICE([Drivers]) AC_MSG_NOTICE([Drivers]) AC_MSG_NOTICE([]) AC_MSG_NOTICE([ Xen: $with_xen]) +AC_MSG_NOTICE([ Proxy: $with_xen_proxy]) AC_MSG_NOTICE([ QEMU: $with_qemu]) AC_MSG_NOTICE([ OpenVZ: $with_openvz]) AC_MSG_NOTICE([ Test: $with_test]) -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

On Thu, Nov 29, 2007 at 05:22:06PM +0000, Daniel P. Berrange wrote: Added RPM spec magic to disable proxy too diff -r d2943aa5f7db configure.in --- a/configure.in Fri Nov 30 15:15:55 2007 -0500 +++ b/configure.in Fri Nov 30 15:21:42 2007 -0500 @@ -578,7 +578,24 @@ fi fi dnl Enable building the proxy? -AM_CONDITIONAL(WITH_PROXY,[test "x$with_xen" = "xyes"]) + +AC_ARG_WITH(xen-proxy, +[ --with-xen-proxy add XEN setuid proxy support (on)],[],[with_xen_proxy=auto]) + +AC_MSG_CHECKING([if Xen setuid proxy is needed]) +if test "$with_xen_proxy" = "auto"; then + if test "$with_polkit" = "yes"; then + with_xen_proxy="no" + else + with_xen_proxy="yes" + fi +fi +if test "$with_xen" != "yes"; then + with_xen_proxy="no" +fi +AC_MSG_RESULT([$with_xen_proxy]) + +AM_CONDITIONAL(WITH_PROXY,[test "$with_xen_proxy" = "yes"]) dnl Check for gettext AM_GNU_GETTEXT_VERSION([0.14.1]) @@ -635,6 +652,7 @@ AC_MSG_NOTICE([Drivers]) AC_MSG_NOTICE([Drivers]) AC_MSG_NOTICE([]) AC_MSG_NOTICE([ Xen: $with_xen]) +AC_MSG_NOTICE([ Proxy: $with_xen_proxy]) AC_MSG_NOTICE([ QEMU: $with_qemu]) AC_MSG_NOTICE([ OpenVZ: $with_openvz]) AC_MSG_NOTICE([ Test: $with_test]) diff -r d2943aa5f7db libvirt.spec.in --- a/libvirt.spec.in Fri Nov 30 15:15:55 2007 -0500 +++ b/libvirt.spec.in Fri Nov 30 15:21:42 2007 -0500 @@ -2,8 +2,10 @@ %if %{fedora} >= 8 %define with_polkit 1 +%define with_proxy no %else %define with_polkit 0 +%define with_proxy yes %endif Summary: Library providing a simple API virtualization @@ -77,7 +79,10 @@ of recent versions of Linux (and other O %setup -q %build -%configure --with-init-script=redhat --with-qemud-pid-file=%{_localstatedir}/run/libvirt_qemud.pid --with-remote-file=%{_localstatedir}/run/libvirtd.pid +%configure --with-init-script=redhat \ + --with-qemud-pid-file=%{_localstatedir}/run/libvirt_qemud.pid \ + --with-remote-file=%{_localstatedir}/run/libvirtd.pid \ + --with-xen-proxy=%{with_proxy} make %install @@ -157,7 +162,9 @@ fi %dir %{_localstatedir}/lib/libvirt/ %{_datadir}/PolicyKit/policy/libvirtd.policy %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/qemu/ +%if %{with_proxy} == "yes" %attr(4755, root, root) %{_libexecdir}/libvirt_proxy +%endif %attr(0755, root, root) %{_sbindir}/libvirtd %doc docs/*.rng %doc docs/*.xml Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

If building using --without-xen to disable the Xen driver there are a whole bunch of methods in the src/xml.c file which are not used. There are littered with #if WITH_XEN to disable small parts of the API, but not the whole APIs. This is pointless and results in many compile time warnings about unused variables. This patch just disables all the Xen specific APIs in xml.c entirely. src/xml.c | 19 +++++-------------- src/xml.h | 2 ++ tests/xml2sexprtest.c | 10 ++++++++++ 3 files changed, 17 insertions(+), 14 deletions(-) diff -r 8565c5bfacf5 src/xml.c --- a/src/xml.c Thu Nov 29 10:23:48 2007 -0500 +++ b/src/xml.c Thu Nov 29 10:42:15 2007 -0500 @@ -57,7 +57,7 @@ virXMLError(virConnectPtr conn, virError * Parser and converter for the CPUset strings used in libvirt * * * ************************************************************************/ - +#if WITH_XEN /** * skipSpaces: * @str: pointer to the char pointer used @@ -448,6 +448,7 @@ virConvertCpuSet(virConnectPtr conn, con free(cpuset); return (res); } +#endif /* WITH_XEN */ #ifndef PROXY /************************************************************************ @@ -694,7 +695,7 @@ virXPathNodeSet(const char *xpath, xmlXP * Converter functions to go from the XML tree to an S-Expr for Xen * * * ************************************************************************/ - +#if WITH_XEN /** * virtDomainParseXMLGraphicsDescImage: * @conn: pointer to the hypervisor connection @@ -1625,11 +1626,7 @@ virDomainParseXMLDesc(virConnectPtr conn str = virXPathString("string(/domain/vcpu/@cpuset)", ctxt); if (str != NULL) { -#ifdef WITH_XEN int maxcpu = xenNbCpus(conn); -#else - int maxcpu = 64; -#endif char *cpuset = NULL; char *ranges = NULL; const char *cur = str; @@ -1879,6 +1876,7 @@ virParseXMLDevice(virConnectPtr conn, co goto cleanup; } + /** * virDomainXMLDevID: * @domain: pointer to domain object @@ -1901,9 +1899,7 @@ virDomainXMLDevID(virDomainPtr domain, c xmlNodePtr node, cur; xmlChar *attr = NULL; -#ifdef WITH_XEN char *xref; -#endif /* WITH_XEN */ int ret = 0; xml = xmlReadDoc((const xmlChar *) xmldesc, "device.xml", NULL, @@ -1925,7 +1921,6 @@ virDomainXMLDevID(virDomainPtr domain, c attr = xmlGetProp(cur, BAD_CAST "dev"); if (attr == NULL) goto error; -#ifdef WITH_XEN xref = xenStoreDomainGetDiskID(domain->conn, domain->id, (char *) attr); if (xref != NULL) { @@ -1934,11 +1929,9 @@ virDomainXMLDevID(virDomainPtr domain, c ref[ref_len - 1] = '\0'; goto cleanup; } -#else /* !WITH_XEN */ /* hack to avoid the warning that domain is unused */ if (domain->id < 0) ret = -1; -#endif /* !WITH_XEN */ goto error; } @@ -1952,7 +1945,6 @@ virDomainXMLDevID(virDomainPtr domain, c if (attr == NULL) goto error; -#ifdef WITH_XEN xref = xenStoreDomainGetNetworkID(domain->conn, domain->id, (char *) attr); if (xref != NULL) { @@ -1961,11 +1953,9 @@ virDomainXMLDevID(virDomainPtr domain, c ref[ref_len - 1] = '\0'; goto cleanup; } -#else /* !WITH_XEN */ /* hack to avoid the warning that domain is unused */ if (domain->id < 0) ret = -1; -#endif /* !WITH_XEN */ goto error; } @@ -1981,6 +1971,7 @@ virDomainXMLDevID(virDomainPtr domain, c xmlFree(attr); return ret; } +#endif /* WITH_XEN */ #endif /* !PROXY */ /* diff -r 8565c5bfacf5 src/xml.h --- a/src/xml.h Thu Nov 29 10:23:48 2007 -0500 +++ b/src/xml.h Thu Nov 29 10:42:15 2007 -0500 @@ -32,6 +32,7 @@ int virXPathNodeSet (const char *xpath, xmlXPathContextPtr ctxt, xmlNodePtr **list); +#if WITH_XEN int virParseXenCpuTopology(virConnectPtr conn, virBufferPtr xml, const char *str, @@ -60,6 +61,7 @@ int virDomainXMLDevID(virDomainPtr doma char *class, char *ref, int ref_len); +#endif #ifdef __cplusplus } diff -r 8565c5bfacf5 tests/xml2sexprtest.c --- a/tests/xml2sexprtest.c Thu Nov 29 10:23:48 2007 -0500 +++ b/tests/xml2sexprtest.c Thu Nov 29 10:42:15 2007 -0500 @@ -1,7 +1,9 @@ + #include "config.h" #include <stdio.h> #include <string.h> +#include <stdlib.h> #include <sys/types.h> #include <fcntl.h> @@ -9,6 +11,8 @@ #ifdef HAVE_SYS_SYSLIMITS_H #include <sys/syslimits.h> #endif + +#if WITH_XEN #include "xml.h" #include "testutils.h" @@ -354,3 +358,9 @@ main(int argc, char **argv) exit(ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); } + +#else /* WITH_XEN */ + +int main (void) { exit (77); /* means 'test skipped' for automake */ } + +#endif /* ! WITH_XEN */ -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|