This patch hooks up the basic authentication RPC calls, and the specific SASL implementation. The SASL impl can be enabled/disable via the configurre script with --without-sasl / --with-sasl - it'll auto-enable it if it finds the headers & libs OK. The sample /etc/sasl2/libvirt.conf file enables the DIGEST-MD5 mechanism by default, since it is by far the easiest to setup for admins. No need for a Kerberos server, or certificates - it just uses username/password which can be set with 'saslpasswd2 -a libvirt [username]' and a list of all active users viewed with 'sasldblistusers2 -a libvirt' There are also example settings for enabling Kerberos (GSSAPI) but this is disabled by default. It requires a file /etc/libvirt/krb5.tab containing a service principle. On some distros you need to set KRB5_KTNAME to point to this file when starting the daemon, so our init script does that. Other distros, the 'keytab' config param in /etc/sasl2/libvirt.conf is actually honoured. With this patch you can successfully authentication client <-> server for any authentication mechansim which doesn't need to prompt the user for credentials. In effect this means it only works for GSSAPI/Kerberos, but the later patches in this series will enable callbacks making the default DIGEST-MD5 auth work. The way auth is controlled, is that if the 'auth' parameter is set on the struct qemud_client object, *NO* rpc call will be processed except for the REMOTE_PROC_AUTH_LIST, SASL_AUTH_INIT, SASL_AUTH_START & SASL_AUTH_STEP calls. If SASL is not compiled in, the latter 3 will send errors back to the caller. Only once authentication is complete, are the other calls allowed. It currently hardcodes use of SASL on the TCP socket. The TLS & UNIX sockets are unchanged. A subsequent patch will make it configurable. b/qemud/libvirtd.sasl | 28 ++ configure.in | 39 ++ include/libvirt/virterror.h | 1 libvirt.spec.in | 4 qemud/Makefile.am | 21 + qemud/internal.h | 8 qemud/libvirtd.init.in | 3 qemud/libvirtd.sysconf | 3 qemud/qemud.c | 28 +- qemud/remote.c | 392 +++++++++++++++++++++++++++- qemud/remote_dispatch_localvars.h | 6 qemud/remote_dispatch_proc_switch.h | 30 ++ qemud/remote_dispatch_prototypes.h | 4 qemud/remote_protocol.c | 87 ++++++ qemud/remote_protocol.h | 78 +++++ qemud/remote_protocol.x | 50 +++ src/Makefile.am | 3 src/remote_internal.c | 498 +++++++++++++++++++++++++++++++----- src/virsh.c | 4 src/virterror.c | 6 tests/Makefile.am | 2 21 files changed, 1205 insertions(+), 90 deletions(-) diff -r 1c3780349e89 configure.in --- a/configure.in Wed Nov 28 12:02:28 2007 -0500 +++ b/configure.in Thu Nov 29 09:24:10 2007 -0500 @@ -353,6 +353,40 @@ AC_CHECK_TYPE(gnutls_session, [#include <gnutls/gnutls.h>]) CFLAGS="$old_cflags" LDFLAGS="$old_ldflags" + + +dnl Cyrus SASL +AC_ARG_WITH(sasl, + [ --with-sasl use cyrus SASL for authentication], + [], + [with_sasl=yes]) + +SASL_CFLAGS= +SASL_LIBS= +if test "$with_sasl" != "no"; then + if test "$with_sasl" != "yes"; then + SASL_CFLAGS="-I$with_sasl" + SASL_LIBS="-L$with_sasl" + fi + old_cflags="$CFLAGS" + old_libs="$LIBS" + CFLAGS="$CFLAGS $SASL_CFLAGS" + LIBS="$LIBS $SASL_LIBS" + AC_CHECK_HEADER([sasl/sasl.h], + [], + AC_MSG_ERROR([You must install the Cyrus SASL development package in order to compile libvirt])) + AC_CHECK_LIB(sasl2, sasl_client_init, + [], + [AC_MSG_ERROR([You must install the Cyrus SASL library in order to compile and run libvirt])]) + CFLAGS="$old_cflags" + LIBS="$old_libs" + SASL_LIBS="$SASL_LIBS -lsasl2" + AC_DEFINE_UNQUOTED(HAVE_SASL, 1, [whether Cyrus SASL is available for authentication]) +fi +AM_CONDITIONAL(HAVE_SASL, [test "$with_sasl" != "no"]) +AC_SUBST(SASL_CFLAGS) +AC_SUBST(SASL_LIBS) + dnl Avahi library @@ -564,6 +598,11 @@ AC_MSG_NOTICE([]) AC_MSG_NOTICE([]) AC_MSG_NOTICE([ libxml: $LIBXML_CFLAGS $LIBXML_LIBS]) AC_MSG_NOTICE([ gnutls: $GNUTLS_CFLAGS $GNUTLS_LIBS]) +if test "$with_sasl" != "no" ; then +AC_MSG_NOTICE([ sasl: $SASL_CFLAGS $SASL_LIBS]) +else +AC_MSG_NOTICE([ sasl: no]) +fi if test "$with_avahi" = "yes" ; then AC_MSG_NOTICE([ avahi: $AVAHI_CFLAGS $AVAHI_LIBS]) else diff -r 1c3780349e89 include/libvirt/virterror.h --- a/include/libvirt/virterror.h Wed Nov 28 12:02:28 2007 -0500 +++ b/include/libvirt/virterror.h Thu Nov 29 09:24:10 2007 -0500 @@ -131,6 +131,7 @@ typedef enum { VIR_ERR_NO_DOMAIN, /* domain not found or unexpectedly disappeared */ VIR_ERR_NO_NETWORK, /* network not found */ VIR_ERR_INVALID_MAC, /* invalid MAC adress */ + VIR_ERR_AUTH_FAILED, /* authentication failed */ } virErrorNumber; /** diff -r 1c3780349e89 libvirt.spec.in --- a/libvirt.spec.in Wed Nov 28 12:02:28 2007 -0500 +++ b/libvirt.spec.in Thu Nov 29 09:24:10 2007 -0500 @@ -16,6 +16,8 @@ Requires: dnsmasq Requires: dnsmasq Requires: bridge-utils Requires: iptables +Requires: cyrus-sasl +Requires: cyrus-sasl-gssapi BuildRequires: xen-devel BuildRequires: libxml2-devel BuildRequires: readline-devel @@ -26,6 +28,7 @@ BuildRequires: dnsmasq BuildRequires: dnsmasq BuildRequires: bridge-utils BuildRequires: qemu +BuildRequires: cyrus-sasl-devel Obsoletes: libvir ExclusiveArch: i386 x86_64 ia64 @@ -132,6 +135,7 @@ fi %config(noreplace) %{_sysconfdir}/sysconfig/libvirtd %config(noreplace) %{_sysconfdir}/libvirt/libvirtd.conf %config(noreplace) %{_sysconfdir}/libvirt/qemu.conf +%config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf %dir %{_datadir}/libvirt/ %dir %{_datadir}/libvirt/networks/ %{_datadir}/libvirt/networks/default.xml diff -r 1c3780349e89 qemud/Makefile.am --- a/qemud/Makefile.am Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/Makefile.am Thu Nov 29 09:24:10 2007 -0500 @@ -17,6 +17,7 @@ EXTRA_DIST = libvirtd.init.in libvirtd.s remote_dispatch_localvars.h \ remote_dispatch_proc_switch.h \ mdns.c mdns.h \ + libvirtd.sasl \ $(conf_DATA) libvirtd_SOURCES = \ @@ -28,14 +29,14 @@ libvirtd_SOURCES = \ #-D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_POSIX_C_SOURCE=199506L libvirtd_CFLAGS = \ -I$(top_srcdir)/include -I$(top_builddir)/include \ - $(LIBXML_CFLAGS) $(GNUTLS_CFLAGS) \ + $(LIBXML_CFLAGS) $(GNUTLS_CFLAGS) $(SASL_CFLAGS) \ $(WARN_CFLAGS) -DLOCAL_STATE_DIR="\"$(localstatedir)\"" \ -DSYSCONF_DIR="\"$(sysconfdir)\"" \ -DQEMUD_PID_FILE="\"$(QEMUD_PID_FILE)\"" \ -DREMOTE_PID_FILE="\"$(REMOTE_PID_FILE)\"" \ -DGETTEXT_PACKAGE=\"$(PACKAGE)\" -libvirtd_LDFLAGS = $(WARN_CFLAGS) $(LIBXML_LIBS) $(GNUTLS_LIBS) +libvirtd_LDFLAGS = $(WARN_CFLAGS) $(LIBXML_LIBS) $(GNUTLS_LIBS) $(SASL_LIBS) libvirtd_DEPENDENCIES = ../src/libvirt.la libvirtd_LDADD = ../src/libvirt.la @@ -46,7 +47,7 @@ endif endif default_xml_dest = libvirt/qemu/networks/default.xml -install-data-local: install-init +install-data-local: install-init install-data-sasl mkdir -p $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart $(INSTALL_DATA) $(srcdir)/default-network.xml \ $(DESTDIR)$(sysconfdir)/$(default_xml_dest) @@ -59,7 +60,7 @@ install-data-local: install-init mkdir -p $(DESTDIR)$(localstatedir)/run/libvirt mkdir -p $(DESTDIR)$(localstatedir)/lib/libvirt -uninstall-local: uninstall-init +uninstall-local:: uninstall-init uninstall-data-sasl rm -f $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml rm -f $(DESTDIR)$(sysconfdir)/$(default_xml_dest) rmdir $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart || : @@ -67,6 +68,18 @@ uninstall-local: uninstall-init rmdir $(DESTDIR)$(localstatedir)/run/libvirt || : rmdir $(DESTDIR)$(localstatedir)/lib/libvirt || : +if HAVE_SASL +install-data-sasl:: install-init + mkdir -p $(DESTDIR)$(sysconfdir)/sasl2/ + $(INSTALL_DATA) $(srcdir)/libvirtd.sasl $(DESTDIR)$(sysconfdir)/sasl2/libvirt.conf + +uninstall-data-sasl:: install-init + rm -f $(DESTDIR)$(sysconfdir)/sasl2/libvirt.conf + rmdir $(DESTDIR)$(sysconfdir)/sasl2/ +else +install-data-sasl: +uninstall-data-sasl: +endif if RPCGEN .x.c: diff -r 1c3780349e89 qemud/internal.h --- a/qemud/internal.h Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/internal.h Thu Nov 29 09:24:10 2007 -0500 @@ -28,6 +28,9 @@ #include <gnutls/gnutls.h> #include <gnutls/x509.h> #include "../src/gnutls_1_0_compat.h" +#if HAVE_SASL +#include <sasl/sasl.h> +#endif #ifdef HAVE_SYS_SYSLIMITS_H #include <sys/syslimits.h> @@ -91,6 +94,10 @@ struct qemud_client { int tls; gnutls_session_t session; enum qemud_tls_direction direction; + int auth; +#if HAVE_SASL + sasl_conn_t *saslconn; +#endif unsigned int incomingSerial; unsigned int outgoingSerial; @@ -116,6 +123,7 @@ struct qemud_socket { int readonly; /* If set, TLS is required on this socket. */ int tls; + int auth; int port; struct qemud_socket *next; }; diff -r 1c3780349e89 qemud/libvirtd.init.in --- a/qemud/libvirtd.init.in Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/libvirtd.init.in Thu Nov 29 09:24:10 2007 -0500 @@ -37,6 +37,7 @@ PROCESS=libvirtd LIBVIRTD_CONFIG= LIBVIRTD_ARGS= +KRB5_KTNAME=/etc/libvirt/krb5.tab test -f @sysconfdir@/sysconfig/libvirtd && . @sysconfdir@/sysconfig/libvirtd @@ -50,7 +51,7 @@ RETVAL=0 start() { echo -n $"Starting $SERVICE daemon: " - daemon --check $SERVICE $PROCESS --daemon $LIBVIRTD_CONFIG_ARGS $LIBVIRTD_ARGS + KRB5_KTNAME=$KRB5_KTNAME daemon --check $SERVICE $PROCESS --daemon $LIBVIRTD_CONFIG_ARGS $LIBVIRTD_ARGS RETVAL=$? echo [ $RETVAL -eq 0 ] && touch @localstatedir@/lock/subsys/$SERVICE diff -r 1c3780349e89 qemud/libvirtd.sasl --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/qemud/libvirtd.sasl Thu Nov 29 09:24:10 2007 -0500 @@ -0,0 +1,28 @@ +# If you want to use the non-TLS socket, then you *must* include +# the GSSAPI or DIGEST-MD5 mechanisms, because they are the only +# ones that can offer session encryption as well as authentication. +# +# If you're only using TLS, then you can turn on any mechanisms +# you like for authentication, because TLS provides the encryption +# +# Default to a simple username+password mechanism +mech_list: digest-md5 + +# Before you can use GSSAPI, you need a service principle on the +# KDC server for libvirt, and that to be exported to the keytab +# file listed below +#mech_list: gssapi +# +# You can also list many mechanisms at once, then the user can choose +# by adding '?auth=sasl.gssapi' to their libvirt URI, eg +# qemu+tcp://hostname/system?auth=sasl.gssapi +#mech_list: digest-md5 gssapi + +# MIT kerberos ignores this option & needs KRB5_KTNAME env var. +# May be useful for other non-Linux OS though.... +keytab: /etc/libvirt/krb5.tab + +# If using digest-md5 for username/passwds, then this is the file +# containing the passwds. Use 'saslpasswd2 -a libvirt [username]' +# to add entries, and 'sasldblistusers2 -a libvirt' to browse it +sasldb_path: /etc/libvirt/passwd.db diff -r 1c3780349e89 qemud/libvirtd.sysconf --- a/qemud/libvirtd.sysconf Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/libvirtd.sysconf Thu Nov 29 09:24:10 2007 -0500 @@ -4,3 +4,6 @@ # Listen for TCP/IP connections # NB. must setup TLS/SSL keys prior to using this #LIBVIRTD_ARGS="--listen" + +# Override Kerberos service keytab for SASL/GSSAPI +#KRB5_KTNAME=/etc/libvirt/krb5.tab diff -r 1c3780349e89 qemud/qemud.c --- a/qemud/qemud.c Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/qemud.c Thu Nov 29 09:24:10 2007 -0500 @@ -577,7 +577,8 @@ static int static int remoteListenTCP (struct qemud_server *server, const char *port, - int tls) + int tls, + int auth) { int fds[2]; int nfds = 0; @@ -606,6 +607,7 @@ remoteListenTCP (struct qemud_server *se sock->fd = fds[i]; sock->tls = tls; + sock->auth = auth; if (getsockname(sock->fd, (struct sockaddr *)(&sa), &salen) < 0) return -1; @@ -701,6 +703,9 @@ static struct qemud_server *qemudInitial struct qemud_socket *sock; char sockname[PATH_MAX]; char roSockname[PATH_MAX]; +#if HAVE_SASL + int err; +#endif /* HAVE_SASL */ if (!(server = calloc(1, sizeof(struct qemud_server)))) { qemudLog(QEMUD_ERR, "Failed to allocate struct qemud_server"); @@ -730,15 +735,28 @@ static struct qemud_server *qemudInitial virStateInitialize(); +#if HAVE_SASL + if ((err = sasl_server_init(NULL, "libvirt")) != SASL_OK) { + qemudLog(QEMUD_ERR, "Failed to initialize SASL authentication %s", + sasl_errstring(err, NULL, NULL)); + goto cleanup; + } +#endif + if (ipsock) { - if (listen_tcp && remoteListenTCP (server, tcp_port, 0) < 0) +#if HAVE_SASL + if (listen_tcp && remoteListenTCP (server, tcp_port, 0, REMOTE_AUTH_SASL) < 0) goto cleanup; +#else + if (listen_tcp && remoteListenTCP (server, tcp_port, 0, REMOTE_AUTH_NONE) < 0) + goto cleanup; +#endif if (listen_tls) { if (remoteInitializeGnuTLS () < 0) goto cleanup; - if (remoteListenTCP (server, tls_port, 1) < 0) + if (remoteListenTCP (server, tls_port, 1, REMOTE_AUTH_NONE) < 0) goto cleanup; } } @@ -1048,6 +1066,7 @@ static int qemudDispatchServer(struct qe client->fd = fd; client->readonly = sock->readonly; client->tls = sock->tls; + client->auth = sock->auth; memcpy (&client->addr, &addr, sizeof addr); client->addrlen = addrlen; @@ -1128,6 +1147,9 @@ static void qemudDispatchClientFailure(s if (client->conn) virConnectClose(client->conn); +#if HAVE_SASL + if (client->saslconn) sasl_dispose(&client->saslconn); +#endif if (client->tls && client->session) gnutls_deinit (client->session); close(client->fd); free(client); diff -r 1c3780349e89 qemud/remote.c --- a/qemud/remote.c Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/remote.c Thu Nov 29 09:24:10 2007 -0500 @@ -52,6 +52,8 @@ #define DEBUG 0 +#define REMOTE_DEBUG(fmt,...) qemudDebug("REMOTE: " fmt, __VA_ARGS__) + static void remoteDispatchError (struct qemud_client *client, remote_message_header *req, const char *fmt, ...) @@ -116,6 +118,21 @@ remoteDispatchClientRequest (struct qemu (int) req.status); xdr_destroy (&xdr); return; + } + + /* If client is marked as needing auth, don't allow any RPC ops, + * except for authentication ones + */ + if (client->auth) { + if (req.proc != REMOTE_PROC_AUTH_LIST && + req.proc != REMOTE_PROC_AUTH_SASL_INIT && + req.proc != REMOTE_PROC_AUTH_SASL_START && + req.proc != REMOTE_PROC_AUTH_SASL_STEP + ) { + remoteDispatchError (client, &req, "authentication required"); + xdr_destroy (&xdr); + return; + } } /* Based on the procedure number, dispatch. In future we may base @@ -275,23 +292,14 @@ remoteDispatchClientRequest (struct qemu * reply. */ static void -remoteDispatchError (struct qemud_client *client, - remote_message_header *req, - const char *fmt, ...) +remoteDispatchSendError (struct qemud_client *client, + remote_message_header *req, + int code, const char *msg) { remote_message_header rep; remote_error error; - va_list args; - char msgbuf[1024]; - char *msg = msgbuf; XDR xdr; int len; - - va_start (args, fmt); - vsnprintf (msgbuf, sizeof msgbuf, fmt, args); - va_end (args); - - qemudDebug ("%s", msgbuf); /* Future versions of the protocol may use different vers or prog. Try * our hardest to send back a message that such clients could see. @@ -313,12 +321,12 @@ remoteDispatchError (struct qemud_client } /* Construct the error. */ - error.code = VIR_ERR_RPC; + error.code = code; error.domain = VIR_FROM_REMOTE; - error.message = &msg; + error.message = (char**)&msg; error.level = VIR_ERR_ERROR; error.dom = NULL; - error.str1 = &msg; + error.str1 = (char**)&msg; error.str2 = NULL; error.str3 = NULL; error.int1 = 0; @@ -363,6 +371,31 @@ remoteDispatchError (struct qemud_client client->bufferOffset = 0; if (client->tls) client->direction = QEMUD_TLS_DIRECTION_WRITE; } + +static void +remoteDispatchFailAuth (struct qemud_client *client, + remote_message_header *req) +{ + remoteDispatchSendError (client, req, VIR_ERR_AUTH_FAILED, "authentication failed"); +} + +static void +remoteDispatchError (struct qemud_client *client, + remote_message_header *req, + const char *fmt, ...) +{ + va_list args; + char msgbuf[1024]; + char *msg = msgbuf; + + va_start (args, fmt); + vsnprintf (msgbuf, sizeof msgbuf, fmt, args); + va_end (args); + + remoteDispatchSendError (client, req, VIR_ERR_RPC, msg); +} + + /*----- Functions. -----*/ @@ -1946,6 +1979,335 @@ remoteDispatchNumOfNetworks (struct qemu return 0; } + +static int +remoteDispatchAuthList (struct qemud_client *client, + remote_message_header *req ATTRIBUTE_UNUSED, + void *args ATTRIBUTE_UNUSED, + remote_auth_list_ret *ret) +{ + ret->types.types_len = 1; + if ((ret->types.types_val = calloc (ret->types.types_len, sizeof (remote_auth_type))) == NULL) { + remoteDispatchSendError(client, req, VIR_ERR_NO_MEMORY, "auth types"); + return -2; + } + ret->types.types_val[0] = client->auth; + return 0; +} + + +#if HAVE_SASL +/* + * NB, keep in sync with similar method in src/remote_internal.c + */ +static char *addrToString(struct qemud_client *client, + remote_message_header *req, + struct sockaddr_storage *sa, socklen_t salen) { + char host[1024], port[20]; + char *addr; + int err; + + if ((err = getnameinfo((struct sockaddr *)sa, salen, + host, sizeof(host), + port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { + remoteDispatchError(client, req, + "Cannot resolve address %d: %s", err, gai_strerror(err)); + return NULL; + } + + addr = malloc(strlen(host) + 1 + strlen(port) + 1); + if (!addr) { + remoteDispatchError(client, req, "cannot allocate address"); + return NULL; + } + + strcpy(addr, host); + strcat(addr, ";"); + strcat(addr, port); + return addr; +} + + +/* + * Initializes the SASL session in prepare for authentication + * and gives the client a list of allowed mechansims to choose + * + * XXX callbacks for stuff like password verification ? + */ +static int +remoteDispatchAuthSaslInit (struct qemud_client *client, + remote_message_header *req, + void *args ATTRIBUTE_UNUSED, + remote_auth_sasl_init_ret *ret) +{ + const char *mechlist = NULL; + int err; + struct sockaddr_storage sa; + socklen_t salen; + char *localAddr, *remoteAddr; + + REMOTE_DEBUG("Initialize SASL auth %d", client->fd); + if (client->auth != REMOTE_AUTH_SASL || + client->saslconn != NULL) { + qemudLog(QEMUD_ERR, "client tried invalid SASL init request"); + remoteDispatchFailAuth(client, req); + return -2; + } + + /* Get local address in form IPADDR:PORT */ + salen = sizeof(sa); + if (getsockname(client->fd, (struct sockaddr*)&sa, &salen) < 0) { + remoteDispatchError(client, req, "failed to get sock address %d (%s)", + errno, strerror(errno)); + return -2; + } + if ((localAddr = addrToString(client, req, &sa, salen)) == NULL) { + return -2; + } + + /* Get remote address in form IPADDR:PORT */ + salen = sizeof(sa); + if (getpeername(client->fd, (struct sockaddr*)&sa, &salen) < 0) { + remoteDispatchError(client, req, "failed to get peer address %d (%s)", + errno, strerror(errno)); + free(localAddr); + return -2; + } + if ((remoteAddr = addrToString(client, req, &sa, salen)) == NULL) { + free(localAddr); + return -2; + } + + err = sasl_server_new("libvirt", + NULL, /* FQDN - just delegates to gethostname */ + NULL, /* User realm */ + localAddr, + remoteAddr, + NULL, /* XXX Callbacks */ + SASL_SUCCESS_DATA, + &client->saslconn); + free(localAddr); + free(remoteAddr); + if (err != SASL_OK) { + qemudLog(QEMUD_ERR, "sasl context setup failed %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + remoteDispatchFailAuth(client, req); + client->saslconn = NULL; + return -2; + } + + err = sasl_listmech(client->saslconn, + NULL, /* Don't need to set user */ + "", /* Prefix */ + ",", /* Separator */ + "", /* Suffix */ + &mechlist, + NULL, + NULL); + if (err != SASL_OK) { + qemudLog(QEMUD_ERR, "cannot list SASL mechanisms %d (%s)", + err, sasl_errdetail(client->saslconn)); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -2; + } + REMOTE_DEBUG("Available mechanisms for client: '%s'", mechlist); + ret->mechlist = strdup(mechlist); + if (!ret->mechlist) { + qemudLog(QEMUD_ERR, "cannot allocate mechlist"); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -2; + } + + return 0; +} + + +/* + * This starts the SASL authentication negotiation. + */ +static int +remoteDispatchAuthSaslStart (struct qemud_client *client, + remote_message_header *req, + remote_auth_sasl_start_args *args, + remote_auth_sasl_start_ret *ret) +{ + const char *serverout; + unsigned int serveroutlen; + int err; + + REMOTE_DEBUG("Start SASL auth %d", client->fd); + if (client->auth != REMOTE_AUTH_SASL || + client->saslconn == NULL) { + qemudLog(QEMUD_ERR, "client tried invalid SASL start request"); + remoteDispatchFailAuth(client, req); + return -2; + } + + REMOTE_DEBUG("Using SASL mechanism %s. Data %d bytes, nil: %d", + args->mech, args->data.data_len, args->nil); + err = sasl_server_start(client->saslconn, + args->mech, + /* NB, distinction of NULL vs "" is *critical* in SASL */ + args->nil ? NULL : args->data.data_val, + args->data.data_len, + &serverout, + &serveroutlen); + if (err != SASL_OK && + err != SASL_CONTINUE) { + qemudLog(QEMUD_ERR, "sasl start failed %d (%s)", + err, sasl_errdetail(client->saslconn)); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + remoteDispatchFailAuth(client, req); + return -2; + } + if (serveroutlen > REMOTE_AUTH_SASL_DATA_MAX) { + qemudLog(QEMUD_ERR, "sasl start reply data too long %d", serveroutlen); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + remoteDispatchFailAuth(client, req); + return -2; + } + + /* NB, distinction of NULL vs "" is *critical* in SASL */ + if (serverout) { + ret->data.data_val = malloc(serveroutlen); + if (!ret->data.data_val) { + remoteDispatchError (client, req, "out of memory allocating array"); + return -2; + } + memcpy(ret->data.data_val, serverout, serveroutlen); + } else { + ret->data.data_val = NULL; + } + ret->nil = serverout ? 0 : 1; + ret->data.data_len = serveroutlen; + + REMOTE_DEBUG("SASL return data %d bytes, nil; %d", ret->data.data_len, ret->nil); + if (err == SASL_CONTINUE) { + ret->complete = 0; + } else { + REMOTE_DEBUG("Authentication successful %d", client->fd); + ret->complete = 1; + client->auth = REMOTE_AUTH_NONE; + } + + return 0; +} + + +static int +remoteDispatchAuthSaslStep (struct qemud_client *client, + remote_message_header *req, + remote_auth_sasl_step_args *args, + remote_auth_sasl_step_ret *ret) +{ + const char *serverout; + unsigned int serveroutlen; + int err; + + REMOTE_DEBUG("Step SASL auth %d", client->fd); + if (client->auth != REMOTE_AUTH_SASL || + client->saslconn == NULL) { + qemudLog(QEMUD_ERR, "client tried invalid SASL start request"); + remoteDispatchFailAuth(client, req); + return -2; + } + + REMOTE_DEBUG("Using SASL Data %d bytes, nil: %d", + args->data.data_len, args->nil); + err = sasl_server_step(client->saslconn, + /* NB, distinction of NULL vs "" is *critical* in SASL */ + args->nil ? NULL : args->data.data_val, + args->data.data_len, + &serverout, + &serveroutlen); + if (err != SASL_OK && + err != SASL_CONTINUE) { + qemudLog(QEMUD_ERR, "sasl step failed %d (%s)", + err, sasl_errdetail(client->saslconn)); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + remoteDispatchFailAuth(client, req); + return -2; + } + + if (serveroutlen > REMOTE_AUTH_SASL_DATA_MAX) { + qemudLog(QEMUD_ERR, "sasl step reply data too long %d", serveroutlen); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + remoteDispatchFailAuth(client, req); + return -2; + } + + /* NB, distinction of NULL vs "" is *critical* in SASL */ + if (serverout) { + ret->data.data_val = malloc(serveroutlen); + if (!ret->data.data_val) { + remoteDispatchError (client, req, "out of memory allocating array"); + return -2; + } + memcpy(ret->data.data_val, serverout, serveroutlen); + } else { + ret->data.data_val = NULL; + } + ret->nil = serverout ? 0 : 1; + ret->data.data_len = serveroutlen; + + REMOTE_DEBUG("SASL return data %d bytes, nil; %d", ret->data.data_len, ret->nil); + if (err == SASL_CONTINUE) { + ret->complete = 0; + } else { + REMOTE_DEBUG("Authentication successful %d", client->fd); + ret->complete = 1; + client->auth = REMOTE_AUTH_NONE; + } + + return 0; +} + + +#else /* HAVE_SASL */ +static int +remoteDispatchAuthSaslInit (struct qemud_client *client, + remote_message_header *req, + void *args ATTRIBUTE_UNUSED, + remote_auth_sasl_init_ret *ret ATTRIBUTE_UNUSED) +{ + qemudLog(QEMUD_ERR, "client tried unsupported SASL init request"); + remoteDispatchFailAuth(client, req); + return -1; +} + +static int +remoteDispatchAuthSaslStart (struct qemud_client *client, + remote_message_header *req, + remote_auth_sasl_start_args *args ATTRIBUTE_UNUSED, + remote_auth_sasl_start_ret *ret ATTRIBUTE_UNUSED) +{ + qemudLog(QEMUD_ERR, "client tried unsupported SASL start request"); + remoteDispatchFailAuth(client, req); + return -1; +} + +static int +remoteDispatchAuthSaslStep (struct qemud_client *client, + remote_message_header *req, + remote_auth_sasl_step_args *args ATTRIBUTE_UNUSED, + remote_auth_sasl_step_ret *ret ATTRIBUTE_UNUSED) +{ + qemudLog(QEMUD_ERR, "client tried unsupported SASL step request"); + remoteDispatchFailAuth(client, req); + return -1; +} +#endif /* HAVE_SASL */ + + /*----- Helpers. -----*/ /* get_nonnull_domain and get_nonnull_network turn an on-wire diff -r 1c3780349e89 qemud/remote_dispatch_localvars.h --- a/qemud/remote_dispatch_localvars.h Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/remote_dispatch_localvars.h Thu Nov 29 09:24:10 2007 -0500 @@ -9,6 +9,7 @@ remote_list_defined_domains_ret lv_remot remote_list_defined_domains_ret lv_remote_list_defined_domains_ret; remote_get_capabilities_ret lv_remote_get_capabilities_ret; remote_domain_set_max_memory_args lv_remote_domain_set_max_memory_args; +remote_auth_sasl_init_ret lv_remote_auth_sasl_init_ret; remote_domain_get_os_type_args lv_remote_domain_get_os_type_args; remote_domain_get_os_type_ret lv_remote_domain_get_os_type_ret; remote_domain_get_autostart_args lv_remote_domain_get_autostart_args; @@ -36,6 +37,8 @@ remote_domain_create_linux_args lv_remot remote_domain_create_linux_args lv_remote_domain_create_linux_args; remote_domain_create_linux_ret lv_remote_domain_create_linux_ret; remote_domain_set_scheduler_parameters_args lv_remote_domain_set_scheduler_parameters_args; +remote_auth_sasl_start_args lv_remote_auth_sasl_start_args; +remote_auth_sasl_start_ret lv_remote_auth_sasl_start_ret; remote_domain_interface_stats_args lv_remote_domain_interface_stats_args; remote_domain_interface_stats_ret lv_remote_domain_interface_stats_ret; remote_domain_get_max_vcpus_args lv_remote_domain_get_max_vcpus_args; @@ -50,6 +53,8 @@ remote_network_get_bridge_name_args lv_r remote_network_get_bridge_name_args lv_remote_network_get_bridge_name_args; remote_network_get_bridge_name_ret lv_remote_network_get_bridge_name_ret; remote_domain_destroy_args lv_remote_domain_destroy_args; +remote_auth_sasl_step_args lv_remote_auth_sasl_step_args; +remote_auth_sasl_step_ret lv_remote_auth_sasl_step_ret; remote_domain_migrate_finish_args lv_remote_domain_migrate_finish_args; remote_domain_migrate_finish_ret lv_remote_domain_migrate_finish_ret; remote_domain_get_vcpus_args lv_remote_domain_get_vcpus_args; @@ -74,6 +79,7 @@ remote_network_set_autostart_args lv_rem remote_network_set_autostart_args lv_remote_network_set_autostart_args; remote_network_get_autostart_args lv_remote_network_get_autostart_args; remote_network_get_autostart_ret lv_remote_network_get_autostart_ret; +remote_auth_list_ret lv_remote_auth_list_ret; remote_domain_core_dump_args lv_remote_domain_core_dump_args; remote_domain_get_max_memory_args lv_remote_domain_get_max_memory_args; remote_domain_get_max_memory_ret lv_remote_domain_get_max_memory_ret; diff -r 1c3780349e89 qemud/remote_dispatch_proc_switch.h --- a/qemud/remote_dispatch_proc_switch.h Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/remote_dispatch_proc_switch.h Thu Nov 29 09:24:10 2007 -0500 @@ -2,6 +2,36 @@ * Do not edit this file. Any changes you make will be lost. */ +case REMOTE_PROC_AUTH_LIST: + fn = (dispatch_fn) remoteDispatchAuthList; + ret_filter = (xdrproc_t) xdr_remote_auth_list_ret; + ret = (char *) &lv_remote_auth_list_ret; + memset (&lv_remote_auth_list_ret, 0, sizeof lv_remote_auth_list_ret); + break; +case REMOTE_PROC_AUTH_SASL_INIT: + fn = (dispatch_fn) remoteDispatchAuthSaslInit; + ret_filter = (xdrproc_t) xdr_remote_auth_sasl_init_ret; + ret = (char *) &lv_remote_auth_sasl_init_ret; + memset (&lv_remote_auth_sasl_init_ret, 0, sizeof lv_remote_auth_sasl_init_ret); + break; +case REMOTE_PROC_AUTH_SASL_START: + fn = (dispatch_fn) remoteDispatchAuthSaslStart; + args_filter = (xdrproc_t) xdr_remote_auth_sasl_start_args; + args = (char *) &lv_remote_auth_sasl_start_args; + memset (&lv_remote_auth_sasl_start_args, 0, sizeof lv_remote_auth_sasl_start_args); + ret_filter = (xdrproc_t) xdr_remote_auth_sasl_start_ret; + ret = (char *) &lv_remote_auth_sasl_start_ret; + memset (&lv_remote_auth_sasl_start_ret, 0, sizeof lv_remote_auth_sasl_start_ret); + break; +case REMOTE_PROC_AUTH_SASL_STEP: + fn = (dispatch_fn) remoteDispatchAuthSaslStep; + args_filter = (xdrproc_t) xdr_remote_auth_sasl_step_args; + args = (char *) &lv_remote_auth_sasl_step_args; + memset (&lv_remote_auth_sasl_step_args, 0, sizeof lv_remote_auth_sasl_step_args); + ret_filter = (xdrproc_t) xdr_remote_auth_sasl_step_ret; + ret = (char *) &lv_remote_auth_sasl_step_ret; + memset (&lv_remote_auth_sasl_step_ret, 0, sizeof lv_remote_auth_sasl_step_ret); + break; case REMOTE_PROC_CLOSE: fn = (dispatch_fn) remoteDispatchClose; break; diff -r 1c3780349e89 qemud/remote_dispatch_prototypes.h --- a/qemud/remote_dispatch_prototypes.h Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/remote_dispatch_prototypes.h Thu Nov 29 09:24:10 2007 -0500 @@ -2,6 +2,10 @@ * Do not edit this file. Any changes you make will be lost. */ +static int remoteDispatchAuthList (struct qemud_client *client, remote_message_header *req, void *args, remote_auth_list_ret *ret); +static int remoteDispatchAuthSaslInit (struct qemud_client *client, remote_message_header *req, void *args, remote_auth_sasl_init_ret *ret); +static int remoteDispatchAuthSaslStart (struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret); +static int remoteDispatchAuthSaslStep (struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret); static int remoteDispatchClose (struct qemud_client *client, remote_message_header *req, void *args, void *ret); static int remoteDispatchDomainAttachDevice (struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret); static int remoteDispatchDomainBlockStats (struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret); diff -r 1c3780349e89 qemud/remote_protocol.c --- a/qemud/remote_protocol.c Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/remote_protocol.c Thu Nov 29 09:24:10 2007 -0500 @@ -100,6 +100,15 @@ xdr_remote_error (XDR *xdrs, remote_erro if (!xdr_int (xdrs, &objp->int2)) return FALSE; if (!xdr_remote_network (xdrs, &objp->net)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_type (XDR *xdrs, remote_auth_type *objp) +{ + + if (!xdr_enum (xdrs, (enum_t *) objp)) return FALSE; return TRUE; } @@ -1222,6 +1231,84 @@ xdr_remote_network_set_autostart_args (X } bool_t +xdr_remote_auth_list_ret (XDR *xdrs, remote_auth_list_ret *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->types.types_val; + + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->types.types_len, REMOTE_AUTH_TYPE_LIST_MAX, + sizeof (remote_auth_type), (xdrproc_t) xdr_remote_auth_type)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_sasl_init_ret (XDR *xdrs, remote_auth_sasl_init_ret *objp) +{ + + if (!xdr_remote_nonnull_string (xdrs, &objp->mechlist)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_sasl_start_args (XDR *xdrs, remote_auth_sasl_start_args *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->data.data_val; + + if (!xdr_remote_nonnull_string (xdrs, &objp->mech)) + return FALSE; + if (!xdr_int (xdrs, &objp->nil)) + return FALSE; + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->data.data_len, REMOTE_AUTH_SASL_DATA_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_sasl_start_ret (XDR *xdrs, remote_auth_sasl_start_ret *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->data.data_val; + + if (!xdr_int (xdrs, &objp->complete)) + return FALSE; + if (!xdr_int (xdrs, &objp->nil)) + return FALSE; + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->data.data_len, REMOTE_AUTH_SASL_DATA_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_sasl_step_args (XDR *xdrs, remote_auth_sasl_step_args *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->data.data_val; + + if (!xdr_int (xdrs, &objp->nil)) + return FALSE; + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->data.data_len, REMOTE_AUTH_SASL_DATA_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_sasl_step_ret (XDR *xdrs, remote_auth_sasl_step_ret *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->data.data_val; + + if (!xdr_int (xdrs, &objp->complete)) + return FALSE; + if (!xdr_int (xdrs, &objp->nil)) + return FALSE; + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->data.data_len, REMOTE_AUTH_SASL_DATA_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + return TRUE; +} + +bool_t xdr_remote_procedure (XDR *xdrs, remote_procedure *objp) { diff -r 1c3780349e89 qemud/remote_protocol.h --- a/qemud/remote_protocol.h Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/remote_protocol.h Thu Nov 29 09:24:10 2007 -0500 @@ -28,6 +28,8 @@ typedef remote_nonnull_string *remote_st #define REMOTE_MIGRATE_COOKIE_MAX 256 #define REMOTE_NETWORK_NAME_LIST_MAX 256 #define REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX 16 +#define REMOTE_AUTH_SASL_DATA_MAX 65536 +#define REMOTE_AUTH_TYPE_LIST_MAX 20 typedef char remote_uuid[VIR_UUID_BUFLEN]; @@ -63,6 +65,12 @@ struct remote_error { }; typedef struct remote_error remote_error; +enum remote_auth_type { + REMOTE_AUTH_NONE = 0, + REMOTE_AUTH_SASL = 1, +}; +typedef enum remote_auth_type remote_auth_type; + struct remote_vcpu_info { u_int number; int state; @@ -659,6 +667,58 @@ struct remote_network_set_autostart_args int autostart; }; typedef struct remote_network_set_autostart_args remote_network_set_autostart_args; + +struct remote_auth_list_ret { + struct { + u_int types_len; + remote_auth_type *types_val; + } types; +}; +typedef struct remote_auth_list_ret remote_auth_list_ret; + +struct remote_auth_sasl_init_ret { + remote_nonnull_string mechlist; +}; +typedef struct remote_auth_sasl_init_ret remote_auth_sasl_init_ret; + +struct remote_auth_sasl_start_args { + remote_nonnull_string mech; + int nil; + struct { + u_int data_len; + char *data_val; + } data; +}; +typedef struct remote_auth_sasl_start_args remote_auth_sasl_start_args; + +struct remote_auth_sasl_start_ret { + int complete; + int nil; + struct { + u_int data_len; + char *data_val; + } data; +}; +typedef struct remote_auth_sasl_start_ret remote_auth_sasl_start_ret; + +struct remote_auth_sasl_step_args { + int nil; + struct { + u_int data_len; + char *data_val; + } data; +}; +typedef struct remote_auth_sasl_step_args remote_auth_sasl_step_args; + +struct remote_auth_sasl_step_ret { + int complete; + int nil; + struct { + u_int data_len; + char *data_val; + } data; +}; +typedef struct remote_auth_sasl_step_ret remote_auth_sasl_step_ret; #define REMOTE_PROGRAM 0x20008086 #define REMOTE_PROTOCOL_VERSION 1 @@ -728,6 +788,10 @@ enum remote_procedure { REMOTE_PROC_DOMAIN_MIGRATE_FINISH = 63, REMOTE_PROC_DOMAIN_BLOCK_STATS = 64, REMOTE_PROC_DOMAIN_INTERFACE_STATS = 65, + REMOTE_PROC_AUTH_LIST = 66, + REMOTE_PROC_AUTH_SASL_INIT = 67, + REMOTE_PROC_AUTH_SASL_START = 68, + REMOTE_PROC_AUTH_SASL_STEP = 69, }; typedef enum remote_procedure remote_procedure; @@ -766,6 +830,7 @@ extern bool_t xdr_remote_domain (XDR *, extern bool_t xdr_remote_domain (XDR *, remote_domain*); extern bool_t xdr_remote_network (XDR *, remote_network*); extern bool_t xdr_remote_error (XDR *, remote_error*); +extern bool_t xdr_remote_auth_type (XDR *, remote_auth_type*); extern bool_t xdr_remote_vcpu_info (XDR *, remote_vcpu_info*); extern bool_t xdr_remote_sched_param_value (XDR *, remote_sched_param_value*); extern bool_t xdr_remote_sched_param (XDR *, remote_sched_param*); @@ -864,6 +929,12 @@ extern bool_t xdr_remote_network_get_au extern bool_t xdr_remote_network_get_autostart_args (XDR *, remote_network_get_autostart_args*); extern bool_t xdr_remote_network_get_autostart_ret (XDR *, remote_network_get_autostart_ret*); extern bool_t xdr_remote_network_set_autostart_args (XDR *, remote_network_set_autostart_args*); +extern bool_t xdr_remote_auth_list_ret (XDR *, remote_auth_list_ret*); +extern bool_t xdr_remote_auth_sasl_init_ret (XDR *, remote_auth_sasl_init_ret*); +extern bool_t xdr_remote_auth_sasl_start_args (XDR *, remote_auth_sasl_start_args*); +extern bool_t xdr_remote_auth_sasl_start_ret (XDR *, remote_auth_sasl_start_ret*); +extern bool_t xdr_remote_auth_sasl_step_args (XDR *, remote_auth_sasl_step_args*); +extern bool_t xdr_remote_auth_sasl_step_ret (XDR *, remote_auth_sasl_step_ret*); extern bool_t xdr_remote_procedure (XDR *, remote_procedure*); extern bool_t xdr_remote_message_direction (XDR *, remote_message_direction*); extern bool_t xdr_remote_message_status (XDR *, remote_message_status*); @@ -878,6 +949,7 @@ extern bool_t xdr_remote_domain (); extern bool_t xdr_remote_domain (); extern bool_t xdr_remote_network (); extern bool_t xdr_remote_error (); +extern bool_t xdr_remote_auth_type (); extern bool_t xdr_remote_vcpu_info (); extern bool_t xdr_remote_sched_param_value (); extern bool_t xdr_remote_sched_param (); @@ -976,6 +1048,12 @@ extern bool_t xdr_remote_network_get_aut extern bool_t xdr_remote_network_get_autostart_args (); extern bool_t xdr_remote_network_get_autostart_ret (); extern bool_t xdr_remote_network_set_autostart_args (); +extern bool_t xdr_remote_auth_list_ret (); +extern bool_t xdr_remote_auth_sasl_init_ret (); +extern bool_t xdr_remote_auth_sasl_start_args (); +extern bool_t xdr_remote_auth_sasl_start_ret (); +extern bool_t xdr_remote_auth_sasl_step_args (); +extern bool_t xdr_remote_auth_sasl_step_ret (); extern bool_t xdr_remote_procedure (); extern bool_t xdr_remote_message_direction (); extern bool_t xdr_remote_message_status (); diff -r 1c3780349e89 qemud/remote_protocol.x --- a/qemud/remote_protocol.x Wed Nov 28 12:02:28 2007 -0500 +++ b/qemud/remote_protocol.x Thu Nov 29 09:24:10 2007 -0500 @@ -80,6 +80,12 @@ const REMOTE_NETWORK_NAME_LIST_MAX = 256 /* Upper limit on list of scheduler parameters. */ const REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX = 16; + +/* Upper limit on SASL auth negotiation packet */ +const REMOTE_AUTH_SASL_DATA_MAX = 65536; + +/* Maximum number of auth types */ +const REMOTE_AUTH_TYPE_LIST_MAX = 20; /* UUID. VIR_UUID_BUFLEN definition comes from libvirt.h */ typedef opaque remote_uuid[VIR_UUID_BUFLEN]; @@ -122,6 +128,13 @@ struct remote_error { int int2; remote_network net; }; + +/* Authentication types available thus far.... */ +enum remote_auth_type { + REMOTE_AUTH_NONE = 0, + REMOTE_AUTH_SASL = 1 +}; + /* Wire encoding of virVcpuInfo. */ struct remote_vcpu_info { @@ -610,6 +623,37 @@ struct remote_network_set_autostart_args struct remote_network_set_autostart_args { remote_nonnull_network net; int autostart; +}; + +struct remote_auth_list_ret { + remote_auth_type types<REMOTE_AUTH_TYPE_LIST_MAX>; +}; + +struct remote_auth_sasl_init_ret { + remote_nonnull_string mechlist; +}; + +struct remote_auth_sasl_start_args { + remote_nonnull_string mech; + int nil; + char data<REMOTE_AUTH_SASL_DATA_MAX>; +}; + +struct remote_auth_sasl_start_ret { + int complete; + int nil; + char data<REMOTE_AUTH_SASL_DATA_MAX>; +}; + +struct remote_auth_sasl_step_args { + int nil; + char data<REMOTE_AUTH_SASL_DATA_MAX>; +}; + +struct remote_auth_sasl_step_ret { + int complete; + int nil; + char data<REMOTE_AUTH_SASL_DATA_MAX>; }; /*----- Protocol. -----*/ @@ -683,7 +727,11 @@ enum remote_procedure { REMOTE_PROC_DOMAIN_MIGRATE_PERFORM = 62, REMOTE_PROC_DOMAIN_MIGRATE_FINISH = 63, REMOTE_PROC_DOMAIN_BLOCK_STATS = 64, - REMOTE_PROC_DOMAIN_INTERFACE_STATS = 65 + REMOTE_PROC_DOMAIN_INTERFACE_STATS = 65, + REMOTE_PROC_AUTH_LIST = 66, + REMOTE_PROC_AUTH_SASL_INIT = 67, + REMOTE_PROC_AUTH_SASL_START = 68, + REMOTE_PROC_AUTH_SASL_STEP = 69 }; /* Custom RPC structure. */ diff -r 1c3780349e89 src/Makefile.am --- a/src/Makefile.am Wed Nov 28 12:02:28 2007 -0500 +++ b/src/Makefile.am Thu Nov 29 09:24:10 2007 -0500 @@ -5,6 +5,7 @@ INCLUDES = -I$(top_builddir)/include \ -I@top_srcdir@/qemud \ $(LIBXML_CFLAGS) \ $(GNUTLS_CFLAGS) \ + $(SASL_CFLAGS) \ -DBINDIR=\""$(libexecdir)"\" \ -DSBINDIR=\""$(sbindir)"\" \ -DSYSCONF_DIR="\"$(sysconfdir)\"" \ @@ -24,7 +25,7 @@ EXTRA_DIST = libvirt_sym.version $(conf_ EXTRA_DIST = libvirt_sym.version $(conf_DATA) lib_LTLIBRARIES = libvirt.la -libvirt_la_LIBADD = $(LIBXML_LIBS) $(GNUTLS_LIBS) +libvirt_la_LIBADD = $(LIBXML_LIBS) $(GNUTLS_LIBS) $(SASL_LIBS) libvirt_la_LDFLAGS = -Wl,--version-script=$(srcdir)/libvirt_sym.version \ -version-info @LIBVIRT_VERSION_INFO@ \ $(COVERAGE_CFLAGS:-f%=-Wc,-f%) diff -r 1c3780349e89 src/remote_internal.c --- a/src/remote_internal.c Wed Nov 28 12:02:28 2007 -0500 +++ b/src/remote_internal.c Thu Nov 29 09:24:10 2007 -0500 @@ -48,6 +48,9 @@ #include <gnutls/gnutls.h> #include <gnutls/x509.h> #include "gnutls_1_0_compat.h" +#if HAVE_SASL +#include <sasl/sasl.h> +#endif #include <libxml/uri.h> #include "internal.h" @@ -72,6 +75,11 @@ struct private_data { char *type; /* Cached return from remoteType. */ int counter; /* Generates serial numbers for RPC. */ int networkOnly; /* Only used for network API */ + char *hostname; /* Original hostname */ + FILE *debugLog; /* Debug remote protocol */ +#if HAVE_SASL + sasl_conn_t *saslconn; /* SASL context */ +#endif }; #define GET_PRIVATE(conn,retcode) \ @@ -90,7 +98,20 @@ struct private_data { return (retcode); \ } -static int call (virConnectPtr conn, struct private_data *priv, int in_open, int proc_nr, xdrproc_t args_filter, char *args, xdrproc_t ret_filter, char *ret); +enum { + REMOTE_CALL_IN_OPEN = 1, + REMOTE_CALL_QUIET_MISSING_RPC = 2, +}; + + +static int call (virConnectPtr conn, struct private_data *priv, + int flags, int proc_nr, + xdrproc_t args_filter, char *args, + xdrproc_t ret_filter, char *ret); +static int remoteAuthenticate (virConnectPtr conn, struct private_data *priv, int in_open); +#if HAVE_SASL +static int remoteAuthSASL (virConnectPtr conn, struct private_data *priv, int in_open); +#endif static void error (virConnectPtr conn, virErrorNumber code, const char *info); static void server_error (virConnectPtr conn, remote_error *err); static virDomainPtr get_nonnull_domain (virConnectPtr conn, remote_nonnull_domain domain); @@ -121,7 +142,7 @@ static void query_free (struct query_fie /* GnuTLS functions used by remoteOpen. */ static int initialise_gnutls (virConnectPtr conn); -static gnutls_session_t negotiate_gnutls_on_connection (virConnectPtr conn, int sock, int no_verify, const char *hostname); +static gnutls_session_t negotiate_gnutls_on_connection (virConnectPtr conn, struct private_data *priv, int no_verify); static int remoteStartup(void) @@ -132,6 +153,22 @@ remoteStartup(void) inside_daemon = 1; return 0; } + +#if HAVE_SASL +static void +remoteDebug(struct private_data *priv, const char *msg,...) +{ + va_list args; + if (priv->debugLog == NULL) + return; + + va_start(args, msg); + vfprintf(priv->debugLog, msg, args); + va_end(args); + fprintf(priv->debugLog, "\n"); +} +#endif /* HAVE_SASL */ + /** * remoteFindServerPath: @@ -297,7 +334,7 @@ doRemoteOpen (virConnectPtr conn, struct * get freed in the failed: path. */ char *name = 0, *command = 0, *sockname = 0, *netcat = 0, *username = 0; - char *server = 0, *port = 0; + char *port = 0; int no_verify = 0, no_tty = 0; char **cmd_argv = 0; @@ -305,12 +342,6 @@ doRemoteOpen (virConnectPtr conn, struct int retcode = VIR_DRV_OPEN_ERROR; /* Remote server defaults to "localhost" if not specified. */ - server = strdup (uri->server ? uri->server : "localhost"); - if (!server) { - out_of_memory: - error (conn, VIR_ERR_NO_MEMORY, "duplicating server name"); - goto failed; - } if (uri->port != 0) { if (asprintf (&port, "%d", uri->port) == -1) goto out_of_memory; } else if (transport == trans_tls) { @@ -325,6 +356,12 @@ doRemoteOpen (virConnectPtr conn, struct } else port = NULL; /* Port not used for unix, ext. */ + + priv->hostname = strdup (uri->server ? uri->server : "localhost"); + if (!priv->hostname) { + error (NULL, VIR_ERR_NO_MEMORY, "allocating priv->hostname"); + goto failed; + } if (uri->user) { username = strdup (uri->user); if (!username) goto out_of_memory; @@ -367,6 +404,12 @@ doRemoteOpen (virConnectPtr conn, struct } else if (strcasecmp (var->name, "no_tty") == 0) { no_tty = atoi (var->value); var->ignore = 1; + } else if (strcasecmp (var->name, "debug") == 0) { + if (var->value && + strcasecmp(var->value, "stdout") == 0) + priv->debugLog = stdout; + else + priv->debugLog = stderr; } #if DEBUG else @@ -436,7 +479,7 @@ doRemoteOpen (virConnectPtr conn, struct memset (&hints, 0, sizeof hints); hints.ai_socktype = SOCK_STREAM; hints.ai_flags = AI_ADDRCONFIG; - int e = getaddrinfo (server, port, &hints, &res); + int e = getaddrinfo (priv->hostname, port, &hints, &res); if (e != 0) { error (conn, VIR_ERR_INVALID_ARG, gai_strerror (e)); goto failed; @@ -476,7 +519,7 @@ doRemoteOpen (virConnectPtr conn, struct if (priv->uses_tls) { priv->session = negotiate_gnutls_on_connection - (conn, priv->sock, no_verify, server); + (conn, priv, no_verify); if (!priv->session) { close (priv->sock); priv->sock = -1; @@ -603,7 +646,7 @@ doRemoteOpen (virConnectPtr conn, struct cmd_argv[j++] = strdup ("-e"); cmd_argv[j++] = strdup ("none"); } - cmd_argv[j++] = strdup (server); + cmd_argv[j++] = strdup (priv->hostname); cmd_argv[j++] = strdup (netcat ? netcat : "nc"); cmd_argv[j++] = strdup ("-U"); cmd_argv[j++] = strdup (sockname ? sockname : LIBVIRTD_PRIV_UNIX_SOCKET); @@ -665,10 +708,15 @@ doRemoteOpen (virConnectPtr conn, struct } } /* switch (transport) */ + + /* Try and authenticate with server */ + if (remoteAuthenticate(conn, priv, 1) == -1) + goto failed; + /* Finally we can call the remote side's open function. */ remote_open_args args = { &name, flags }; - if (call (conn, priv, 1, REMOTE_PROC_OPEN, + if (call (conn, priv, REMOTE_CALL_IN_OPEN, REMOTE_PROC_OPEN, (xdrproc_t) xdr_remote_open_args, (char *) &args, (xdrproc_t) xdr_void, (char *) NULL) == -1) goto failed; @@ -676,12 +724,35 @@ doRemoteOpen (virConnectPtr conn, struct /* Successful. */ retcode = VIR_DRV_OPEN_SUCCESS; - /*FALLTHROUGH*/ + cleanup: + /* Free up the URL and strings. */ + if (name) free (name); + if (command) free (command); + if (sockname) free (sockname); + if (netcat) free (netcat); + if (username) free (username); + if (port) free (port); + if (cmd_argv) { + char **cmd_argv_ptr = cmd_argv; + while (*cmd_argv_ptr) { + free (*cmd_argv_ptr); + cmd_argv_ptr++; + } + free (cmd_argv); + } + + return retcode; + + out_of_memory: + error (NULL, VIR_ERR_NO_MEMORY, "uri params"); + failed: /* Close the socket if we failed. */ - if (retcode != VIR_DRV_OPEN_SUCCESS && priv->sock >= 0) { - if (priv->uses_tls && priv->session) + if (priv->sock >= 0) { + if (priv->uses_tls && priv->session) { gnutls_bye (priv->session, GNUTLS_SHUT_RDWR); + gnutls_deinit (priv->session); + } close (priv->sock); if (priv->pid > 0) { pid_t reap; @@ -693,24 +764,12 @@ doRemoteOpen (virConnectPtr conn, struct } } - /* Free up the URL and strings. */ - if (name) free (name); - if (command) free (command); - if (sockname) free (sockname); - if (netcat) free (netcat); - if (username) free (username); - if (server) free (server); - if (port) free (port); - if (cmd_argv) { - char **cmd_argv_ptr = cmd_argv; - while (*cmd_argv_ptr) { - free (*cmd_argv_ptr); - cmd_argv_ptr++; - } - free (cmd_argv); - } - - return retcode; + if (priv->hostname) { + free (priv->hostname); + priv->hostname = NULL; + } + + goto cleanup; } static int @@ -1017,11 +1076,12 @@ initialise_gnutls (virConnectPtr conn) return 0; } -static int verify_certificate (virConnectPtr conn, gnutls_session_t session, const char *hostname); +static int verify_certificate (virConnectPtr conn, struct private_data *priv, gnutls_session_t session); static gnutls_session_t negotiate_gnutls_on_connection (virConnectPtr conn, - int sock, int no_verify, const char *hostname) + struct private_data *priv, + int no_verify) { const int cert_type_priority[3] = { GNUTLS_CRT_X509, @@ -1062,7 +1122,7 @@ negotiate_gnutls_on_connection (virConne } gnutls_transport_set_ptr (session, - (gnutls_transport_ptr_t) (long) sock); + (gnutls_transport_ptr_t) (long) priv->sock); /* Perform the TLS handshake. */ again: @@ -1075,7 +1135,7 @@ negotiate_gnutls_on_connection (virConne } /* Verify certificate. */ - if (verify_certificate (conn, session, hostname) == -1) { + if (verify_certificate (conn, priv, session) == -1) { fprintf (stderr, "remote_internal: failed to verify peer's certificate\n"); if (!no_verify) return NULL; @@ -1110,8 +1170,8 @@ negotiate_gnutls_on_connection (virConne static int verify_certificate (virConnectPtr conn ATTRIBUTE_UNUSED, - gnutls_session_t session, - const char *hostname) + struct private_data *priv, + gnutls_session_t session) { int ret; unsigned int status; @@ -1189,14 +1249,14 @@ verify_certificate (virConnectPtr conn A } if (i == 0) { - if (!gnutls_x509_crt_check_hostname (cert, hostname)) { + if (!gnutls_x509_crt_check_hostname (cert, priv->hostname)) { __virRaiseError (conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, - VIR_ERR_ERROR, hostname, NULL, NULL, + VIR_ERR_ERROR, priv->hostname, NULL, NULL, 0, 0, "Certificate's owner does not match the hostname (%s)", - hostname); + priv->hostname); gnutls_x509_crt_deinit (cert); return -1; } @@ -1218,8 +1278,14 @@ doRemoteClose (virConnectPtr conn, struc return -1; /* Close socket. */ - if (priv->uses_tls && priv->session) + if (priv->uses_tls && priv->session) { gnutls_bye (priv->session, GNUTLS_SHUT_RDWR); + gnutls_deinit (priv->session); + } +#if HAVE_SASL + if (priv->saslconn) + sasl_dispose (&priv->saslconn); +#endif close (priv->sock); if (priv->pid > 0) { @@ -1230,6 +1296,9 @@ doRemoteClose (virConnectPtr conn, struc continue; } while (reap != -1 && reap != priv->pid); } + + /* Free hostname copy */ + if (priv->hostname) free (priv->hostname); /* See comment for remoteType. */ if (priv->type) free (priv->type); @@ -2751,6 +2820,298 @@ remoteNetworkSetAutostart (virNetworkPtr /*----------------------------------------------------------------------*/ +static int +remoteAuthenticate (virConnectPtr conn, struct private_data *priv, int in_open) +{ + struct remote_auth_list_ret ret; + int err; + + memset(&ret, 0, sizeof ret); + err = call (conn, priv, + REMOTE_CALL_IN_OPEN | REMOTE_CALL_QUIET_MISSING_RPC, + REMOTE_PROC_AUTH_LIST, + (xdrproc_t) xdr_void, (char *) NULL, + (xdrproc_t) xdr_remote_auth_list_ret, (char *) &ret); + if (err == -2) /* Missing RPC - old server - ignore */ + return 0; + + if (err < 0) + return -1; + + if (ret.types.types_len == 0) + return 0; + + switch (ret.types.types_val[0]) { +#if HAVE_SASL + case REMOTE_AUTH_SASL: + if (remoteAuthSASL(conn, priv, in_open) < 0) { + free(ret.types.types_val); + return -1; + } + break; +#endif + + case REMOTE_AUTH_NONE: + /* Nothing todo, hurrah ! */ + break; + + default: + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "unsupported authentication type %d", ret.types.types_val[0]); + free(ret.types.types_val); + return -1; + } + + free(ret.types.types_val); + + return 0; +} + + + +#if HAVE_SASL +/* + * NB, keep in sync with similar method in qemud/remote.c + */ +static char *addrToString(struct sockaddr_storage *sa, socklen_t salen) +{ + char host[1024], port[20]; + char *addr; + int err; + + if ((err = getnameinfo((struct sockaddr *)sa, salen, + host, sizeof(host), + port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { + __virRaiseError (NULL, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_NO_MEMORY, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "Cannot resolve address %d: %s", err, gai_strerror(err)); + return NULL; + } + + addr = malloc(strlen(host) + 1 + strlen(port) + 1); + if (!addr) { + __virRaiseError (NULL, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_NO_MEMORY, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "address"); + return NULL; + } + + strcpy(addr, host); + strcat(addr, ";"); + strcat(addr, port); + return addr; +} + + +/* Perform the SASL authentication process + * + * XXX negotiate a session encryption layer for non-TLS sockets + * XXX fetch credentials from a libvirt client app callback + * XXX max packet size spec + * XXX better mechanism negotiation ? Ask client app ? + */ +static int +remoteAuthSASL (virConnectPtr conn, struct private_data *priv, int in_open) +{ + sasl_conn_t *saslconn = NULL; + remote_auth_sasl_init_ret iret; + remote_auth_sasl_start_args sargs; + remote_auth_sasl_start_ret sret; + remote_auth_sasl_step_args pargs; + remote_auth_sasl_step_ret pret; + const char *clientout; + char *serverin; + unsigned int clientoutlen, serverinlen; + const char *mech; + int err, complete; + struct sockaddr_storage sa; + socklen_t salen; + char *localAddr, *remoteAddr; + + remoteDebug(priv, "Client initialize SASL authentication"); + /* Sets up the SASL library as a whole */ + err = sasl_client_init(NULL); + if (err != SASL_OK) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "failed to initialize SASL library: %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + return -1; + } + + /* Get local address in form IPADDR:PORT */ + salen = sizeof(sa); + if (getsockname(priv->sock, (struct sockaddr*)&sa, &salen) < 0) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "failed to get sock address %d (%s)", + errno, strerror(errno)); + return -1; + } + if ((localAddr = addrToString(&sa, salen)) == NULL) { + return -1; + } + + /* Get remote address in form IPADDR:PORT */ + salen = sizeof(sa); + if (getpeername(priv->sock, (struct sockaddr*)&sa, &salen) < 0) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "failed to get peer address %d (%s)", + errno, strerror(errno)); + free(localAddr); + return -1; + } + if ((remoteAddr = addrToString(&sa, salen)) == NULL) { + free(localAddr); + return -1; + } + + /* Setup a handle for being a client */ + err = sasl_client_new("libvirt", + priv->hostname, + localAddr, + remoteAddr, + NULL, /* XXX callbacks */ + SASL_SUCCESS_DATA, + &saslconn); + free(localAddr); + free(remoteAddr); + if (err != SASL_OK) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "Failed to create SASL client context: %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + return -1; + } + + /* First call is to inquire about supported mechanisms in the server */ + memset (&iret, 0, sizeof iret); + if (call (conn, priv, in_open, REMOTE_PROC_AUTH_SASL_INIT, + (xdrproc_t) xdr_void, (char *)NULL, + (xdrproc_t) xdr_remote_auth_sasl_init_ret, (char *) &iret) != 0) { + sasl_dispose(&saslconn); + return -1; /* virError already set by call */ + } + + + /* Start the auth negotiation on the client end first */ + remoteDebug(priv, "Client start negotiation mechlist '%s'", iret.mechlist); + err = sasl_client_start(saslconn, + iret.mechlist, + NULL, /* XXX interactions */ + &clientout, + &clientoutlen, + &mech); + if (err != SASL_OK && err != SASL_CONTINUE) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "Failed to start SASL negotiation: %d (%s)", + err, sasl_errdetail(saslconn)); + free(iret.mechlist); + sasl_dispose(&saslconn); + return -1; + } + free(iret.mechlist); + + if (clientoutlen > REMOTE_AUTH_SASL_DATA_MAX) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "SASL negotiation data too long: %d bytes", clientoutlen); + sasl_dispose(&saslconn); + return -1; + } + /* NB, distinction of NULL vs "" is *critical* in SASL */ + memset(&sargs, 0, sizeof sargs); + sargs.nil = clientout ? 0 : 1; + sargs.data.data_val = (char*)clientout; + sargs.data.data_len = clientoutlen; + sargs.mech = (char*)mech; + remoteDebug(priv, "Server start negotiation with mech %s. Data %d bytes %p", mech, clientoutlen, clientout); + + /* Now send the initial auth data to the server */ + memset (&sret, 0, sizeof sret); + if (call (conn, priv, in_open, REMOTE_PROC_AUTH_SASL_START, + (xdrproc_t) xdr_remote_auth_sasl_start_args, (char *) &sargs, + (xdrproc_t) xdr_remote_auth_sasl_start_ret, (char *) &sret) != 0) { + sasl_dispose(&saslconn); + return -1; /* virError already set by call */ + } + + complete = sret.complete; + /* NB, distinction of NULL vs "" is *critical* in SASL */ + serverin = sret.nil ? NULL : sret.data.data_val; + serverinlen = sret.data.data_len; + remoteDebug(priv, "Client step result complete: %d. Data %d bytes %p", + complete, serverinlen, serverin); + + /* Loop-the-loop... + * Even if the server has completed, the client must *always* do at least one step + * in this loop to verify the server isn't lieing about something. Mutual auth */ + for (;;) { + err = sasl_client_step(saslconn, + serverin, + serverinlen, + NULL, /* XXX interactions */ + &clientout, + &clientoutlen); + if (serverin) free(serverin); + if (err != SASL_OK && err != SASL_CONTINUE) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "Failed SASL step: %d (%s)", + err, sasl_errdetail(saslconn)); + sasl_dispose(&saslconn); + return -1; + } + remoteDebug(priv, "Client step result %d. Data %d bytes %p", err, clientoutlen, clientout); + + /* Previous server call showed completion & we're now locally complete too */ + if (complete && err == SASL_OK) + break; + + /* Not done, prepare to talk with the server for another iteration */ + /* NB, distinction of NULL vs "" is *critical* in SASL */ + memset(&pargs, 0, sizeof pargs); + pargs.nil = clientout ? 0 : 1; + pargs.data.data_val = (char*)clientout; + pargs.data.data_len = clientoutlen; + remoteDebug(priv, "Server step with %d bytes %p", clientoutlen, clientout); + + memset (&pret, 0, sizeof pret); + if (call (conn, priv, in_open, REMOTE_PROC_AUTH_SASL_STEP, + (xdrproc_t) xdr_remote_auth_sasl_step_args, (char *) &pargs, + (xdrproc_t) xdr_remote_auth_sasl_step_ret, (char *) &pret) != 0) { + sasl_dispose(&saslconn); + return -1; /* virError already set by call */ + } + + complete = pret.complete; + /* NB, distinction of NULL vs "" is *critical* in SASL */ + serverin = pret.nil ? NULL : pret.data.data_val; + serverinlen = pret.data.data_len; + + remoteDebug(priv, "Client step result complete: %d. Data %d bytes %p", + complete, serverinlen, serverin); + + /* This server call shows complete, and earlier client step was OK */ + if (complete && err == SASL_OK) { + if (serverin) free(serverin); + break; + } + } + + remoteDebug(priv, "SASL authentication complete"); + /* XXX keep this around for wire encoding */ + sasl_dispose(&saslconn); + return 0; +} +#endif /* HAVE_SASL */ + +/*----------------------------------------------------------------------*/ + static int really_write (virConnectPtr conn, struct private_data *priv, int in_open, char *bytes, int len); static int really_read (virConnectPtr conn, struct private_data *priv, @@ -2768,7 +3129,7 @@ static int really_read (virConnectPtr co */ static int call (virConnectPtr conn, struct private_data *priv, - int in_open /* if we are in virConnectOpen */, + int flags /* if we are in virConnectOpen */, int proc_nr, xdrproc_t args_filter, char *args, xdrproc_t ret_filter, char *ret) @@ -2793,13 +3154,13 @@ call (virConnectPtr conn, struct private /* Serialise header followed by args. */ xdrmem_create (&xdr, buffer, sizeof buffer, XDR_ENCODE); if (!xdr_remote_message_header (&xdr, &hdr)) { - error (in_open ? NULL : conn, + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "xdr_remote_message_header"); return -1; } if (!(*args_filter) (&xdr, args)) { - error (in_open ? NULL : conn, VIR_ERR_RPC, "marshalling args"); + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "marshalling args"); return -1; } @@ -2815,23 +3176,23 @@ call (virConnectPtr conn, struct private /* Encode the length word. */ xdrmem_create (&xdr, buffer2, sizeof buffer2, XDR_ENCODE); if (!xdr_int (&xdr, &len)) { - error (in_open ? NULL : conn, VIR_ERR_RPC, "xdr_int (length word)"); + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "xdr_int (length word)"); return -1; } xdr_destroy (&xdr); /* Send length word followed by header+args. */ - if (really_write (conn, priv, in_open, buffer2, sizeof buffer2) == -1 || - really_write (conn, priv, in_open, buffer, len-4) == -1) + if (really_write (conn, priv, flags & REMOTE_CALL_IN_OPEN, buffer2, sizeof buffer2) == -1 || + really_write (conn, priv, flags & REMOTE_CALL_IN_OPEN, buffer, len-4) == -1) return -1; /* Read and deserialise length word. */ - if (really_read (conn, priv, in_open, buffer2, sizeof buffer2) == -1) + if (really_read (conn, priv, flags & REMOTE_CALL_IN_OPEN, buffer2, sizeof buffer2) == -1) return -1; xdrmem_create (&xdr, buffer2, sizeof buffer2, XDR_DECODE); if (!xdr_int (&xdr, &len)) { - error (in_open ? NULL : conn, + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "xdr_int (length word, reply)"); return -1; } @@ -2841,33 +3202,33 @@ call (virConnectPtr conn, struct private len -= 4; if (len < 0 || len > REMOTE_MESSAGE_MAX) { - error (in_open ? NULL : conn, + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "packet received from server too large"); return -1; } /* Read reply header and what follows (either a ret or an error). */ - if (really_read (conn, priv, in_open, buffer, len) == -1) + if (really_read (conn, priv, flags & REMOTE_CALL_IN_OPEN, buffer, len) == -1) return -1; /* Deserialise reply header. */ xdrmem_create (&xdr, buffer, len, XDR_DECODE); if (!xdr_remote_message_header (&xdr, &hdr)) { - error (in_open ? NULL : conn, + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "xdr_remote_message_header (reply)"); return -1; } /* Check program, version, etc. are what we expect. */ if (hdr.prog != REMOTE_PROGRAM) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown program (received %x, expected %x)", hdr.prog, REMOTE_PROGRAM); return -1; } if (hdr.vers != REMOTE_PROTOCOL_VERSION) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown protocol version (received %x, expected %x)", hdr.vers, REMOTE_PROTOCOL_VERSION); @@ -2879,21 +3240,21 @@ call (virConnectPtr conn, struct private * message being received at this point. */ if (hdr.proc != proc_nr) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown procedure (received %x, expected %x)", hdr.proc, proc_nr); return -1; } if (hdr.direction != REMOTE_REPLY) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown direction (received %x, expected %x)", hdr.direction, REMOTE_REPLY); return -1; } if (hdr.serial != serial) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown serial (received %x, expected %x)", hdr.serial, serial); @@ -2907,7 +3268,7 @@ call (virConnectPtr conn, struct private switch (hdr.status) { case REMOTE_OK: if (!(*ret_filter) (&xdr, ret)) { - error (in_open ? NULL : conn, VIR_ERR_RPC, "unmarshalling ret"); + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "unmarshalling ret"); return -1; } xdr_destroy (&xdr); @@ -2916,17 +3277,26 @@ call (virConnectPtr conn, struct private case REMOTE_ERROR: memset (&rerror, 0, sizeof rerror); if (!xdr_remote_error (&xdr, &rerror)) { - error (in_open ? NULL : conn, + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "unmarshalling remote_error"); return -1; } xdr_destroy (&xdr); - server_error (in_open ? NULL : conn, &rerror); + /* See if caller asked us to keep quiet about missing RPCs + * eg for interop with older servers */ + if (flags & REMOTE_CALL_QUIET_MISSING_RPC && + rerror.domain == VIR_FROM_REMOTE && + rerror.code == VIR_ERR_RPC && + rerror.level == VIR_ERR_ERROR && + STREQLEN(*rerror.message, "unknown procedure", 17)) { + return -2; + } + server_error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, &rerror); xdr_free ((xdrproc_t) xdr_remote_error, (char *) &rerror); return -1; default: - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown status (received %x)", hdr.status); diff -r 1c3780349e89 src/virsh.c --- a/src/virsh.c Wed Nov 28 12:02:28 2007 -0500 +++ b/src/virsh.c Thu Nov 29 09:24:10 2007 -0500 @@ -4525,8 +4525,10 @@ vshInit(vshControl * ctl) * vshConnectionUsability, except ones which don't need a connection * such as "help". */ - if (!ctl->conn) + if (!ctl->conn) { vshError(ctl, FALSE, _("failed to connect to the hypervisor")); + return FALSE; + } return TRUE; } diff -r 1c3780349e89 src/virterror.c --- a/src/virterror.c Wed Nov 28 12:02:28 2007 -0500 +++ b/src/virterror.c Thu Nov 29 09:24:10 2007 -0500 @@ -671,6 +671,12 @@ __virErrorMsg(virErrorNumber error, cons else errmsg = _("invalid MAC adress: %s"); break; + case VIR_ERR_AUTH_FAILED: + if (info == NULL) + errmsg = _("authentication failed"); + else + errmsg = _("authentication failed: %s"); + break; } return (errmsg); } diff -r 1c3780349e89 tests/Makefile.am --- a/tests/Makefile.am Wed Nov 28 12:02:28 2007 -0500 +++ b/tests/Makefile.am Thu Nov 29 09:24:10 2007 -0500 @@ -17,6 +17,7 @@ INCLUDES = \ -I$(top_srcdir)/src \ $(LIBXML_CFLAGS) \ $(GNUTLS_CFLAGS) \ + $(SASL_CFLAGS) \ -D_XOPEN_SOURCE=600 -D_POSIX_C_SOURCE=199506L \ -DGETTEXT_PACKAGE=\"$(PACKAGE)\" \ $(COVERAGE_CFLAGS) \ @@ -27,6 +28,7 @@ LDADDS = \ @STATIC_BINARIES@ \ $(LIBXML_LIBS) \ $(GNUTLS_LIBS) \ + $(SASL_LIBS) \ $(WARN_CFLAGS) \ $(LIBVIRT) \ $(COVERAGE_LDFLAGS) -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

This patch provides the ability to configure what authentication mechanism is used on each socket - UNIX RW, UNIX RO, TCP, and TLS sockets - all can have independant settings. By default the UNIX & TLS sockets have no auth, and the TCP socket has SASL auth enabled. The /etc/libvirt/libvirtd.conf file lets you override these options. There is also a new sasl_allowed_username_list = ["admin"] config param to let you whitelist the users you want to allow. This supports use of wildcards. The username is dependnat on the SASL auth mechanism. For DIGEST-MD5 it will be plain usernames, for Kerberos it will be a username + realm, eg admin EXAMPLE COM After discussion with Rich, I also remove the tls_allowed_ip_list for whitelisting source IP addresses. This was a) not protecting us because it was only checked after the TLS handshake - thus allowing trivial DOS attack b) much easier to handle via tcp wrappers, or IPtables. c) only ever checked for the TLS socket d) IP addresses are easily spoofed. If summary, if you're using a real authentication mechanism, this is only useful for protecting against DOS attacks & that's better done by iptables. Makefile.am | 12 - internal.h | 4 libvirtd.conf | 143 ++++++++++++---- qemud.c | 379 ++++++++++++++++++++++--------------------- remote.c | 290 ++++++++++++++++++++++++-------- remote_dispatch_prototypes.h | 138 +++++++-------- remote_generate_stubs.pl | 5 7 files changed, 602 insertions(+), 369 deletions(-) diff -r f28fe18bd7f5 qemud/Makefile.am --- a/qemud/Makefile.am Thu Nov 29 09:47:39 2007 -0500 +++ b/qemud/Makefile.am Thu Nov 29 09:51:32 2007 -0500 @@ -101,14 +101,14 @@ remote.c: remote_dispatch_prototypes.h \ remote_dispatch_localvars.h \ remote_dispatch_proc_switch.h -remote_dispatch_prototypes.h: remote_generate_stubs.pl remote_protocol.x - perl -w remote_generate_stubs.pl -i remote_protocol.x > $@ +remote_dispatch_prototypes.h: $(srcdir)/remote_generate_stubs.pl remote_protocol.x + perl -w $(srcdir)/remote_generate_stubs.pl -i $(srcdir)/remote_protocol.x > $@ -remote_dispatch_localvars.h: remote_generate_stubs.pl remote_protocol.x - perl -w remote_generate_stubs.pl -v remote_protocol.x > $@ +remote_dispatch_localvars.h: $(srcdir)/remote_generate_stubs.pl remote_protocol.x + perl -w $(srcdir)/remote_generate_stubs.pl -v $(srcdir)/remote_protocol.x > $@ -remote_dispatch_proc_switch.h: remote_generate_stubs.pl remote_protocol.x - perl -w remote_generate_stubs.pl -w remote_protocol.x > $@ +remote_dispatch_proc_switch.h: $(srcdir)/remote_generate_stubs.pl remote_protocol.x + perl -w $(srcdir)/remote_generate_stubs.pl -w $(srcdir)/remote_protocol.x > $@ if LIBVIRT_INIT_SCRIPTS_RED_HAT install-init: libvirtd.init diff -r f28fe18bd7f5 qemud/internal.h --- a/qemud/internal.h Thu Nov 29 09:47:39 2007 -0500 +++ b/qemud/internal.h Thu Nov 29 09:51:32 2007 -0500 @@ -109,6 +109,7 @@ struct qemud_client { const char *saslEncoded; unsigned int saslEncodedLength; unsigned int saslEncodedOffset; + char *saslUsername; #endif unsigned int incomingSerial; @@ -151,6 +152,9 @@ struct qemud_server { #ifdef HAVE_AVAHI struct libvirtd_mdns *mdns; #endif +#if HAVE_SASL + char **saslUsernameWhitelist; +#endif }; void qemudLog(int priority, const char *fmt, ...) diff -r f28fe18bd7f5 qemud/libvirtd.conf --- a/qemud/libvirtd.conf Thu Nov 29 09:47:39 2007 -0500 +++ b/qemud/libvirtd.conf Thu Nov 29 09:51:32 2007 -0500 @@ -2,6 +2,11 @@ # # For further information consult http://libvirt.org/format.html + +################################################################# +# +# Network connectivitiy controls +# # Flag listening for secure TLS connections on the public TCP/IP port. # NB, must pass the --listen flag to the libvirtd process for this to @@ -17,7 +22,9 @@ # NB, must pass the --listen flag to the libvirtd process for this to # have any effect. # -# NB, this is insecure. Do not use except for development. +# Using the TCP socket requires SASL authentication by default. Only +# SASL mechanisms which support data encryption are allowed. This is +# DIGEST_MD5 and GSSAPI (Kerberos5) # # This is disabled by default, uncomment this to enable it. # listen_tcp = 1 @@ -53,6 +60,10 @@ # mdns_name "Virtualization Host Joe Demo" +################################################################# +# +# UNIX socket access controls +# # Set the UNIX domain socket group ownership. This can be used to # allow a 'trusted' set of users access to management capabilities @@ -73,8 +84,88 @@ # # Default allows only root. If setting group ownership may want to # relax this to: -# unix_sock_rw_perms "octal-perms" "0770" - +# unix_sock_rw_perms "0770" + + + +################################################################# +# +# Authentication. +# +# - none: do not perform auth checks. If you can connect to the +# socket you are allowed. This is suitable if there are +# restrictions on connecting to the socket (eg, UNIX +# socket permissions), or if there is a lower layer in +# the network providing auth (eg, TLS/x509 certificates) +# +# - sasl: use SASL infrastructure. The actual auth scheme is then +# controlled from /etc/sasl2/libvirt.conf. For the TCP +# socket only GSSAPI & DIGEST-MD5 mechanisms will be used. +# For non-TCP or TLS sockets, any scheme is allowed. +# + +# Set an authentication scheme for UNIX read-only sockets +# By default socket permissions allow anyone to connect +# +# To restrict monitoring of domains you may wish to enable +# an authentication mechanism here +# auth_unix_ro = "none" + +# Set an authentication scheme for UNIX read-write sockets +# By default socket permissions only allow root. +# +# If the unix_sock_rw_perms are changed you may wish to enable +# an authentication mechanism here +# auth_unix_rw = "none" + +# Change the authentication scheme for TCP sockets. +# +# If you don't enable SASL, then all TCP traffic is cleartext. +# Don't do this outside of a dev/test scenario. For real world +# use, always enable SASL and use the GSSAPI or DIGEST-MD5 +# mechanism in /etc/sasl2/libvirt.conf +# auth_tcp = "sasl" + +# Change the authentication scheme for TLS sockets. +# +# TLS sockets already have encryption provided by the TLS +# layer, and limited authentication is done by certificates +# +# It is possible to make use of any SASL authentication +# mechanism as well, by using 'sasl' for this option +# auth_tls = "none" + + + +################################################################# +# +# TLS x509 certificate configuration +# + + +# Override the default server key file path +# +# key_file "/etc/pki/libvirt/private/serverkey.pem" + +# Override the default server certificate file path +# +# cert_file "/etc/pki/libvirt/servercert.pem" + +# Override the default CA certificate path +# +# ca_file "/etc/pki/CA/cacert.pem" + +# Specify a certificate revocation list. +# +# Defaults to not using a CRL, uncomment to enable it +# crl_file "/etc/pki/CA/crl.pem" + + + +################################################################# +# +# Authorization controls +# # Flag to disable verification of client certificates @@ -87,31 +178,6 @@ # verification - make sure an IP whitelist is set # tls_no_verify_certificate 1 -# Flag to disable verification of client IP address -# -# Client IP address will be verified against the CommonName field -# of the x509 certificate. This has minimal security benefit since -# it is easy to spoof source IP. -# -# Uncommenting this will disable verification -# tls_no_verify_address 1 - -# Override the default server key file path -# -# key_file "/etc/pki/libvirt/private/serverkey.pem" - -# Override the default server certificate file path -# -# cert_file "/etc/pki/libvirt/servercert.pem" - -# Override the default CA certificate path -# -# ca_file "/etc/pki/CA/cacert.pem" - -# Specify a certificate revocation list. -# -# Defaults to not using a CRL, uncomment to enable it -# crl_file "/etc/pki/CA/crl.pem" # A whitelist of allowed x509 Distinguished Names # This list may contain wildcards such as @@ -127,15 +193,20 @@ # tls_allowed_dn_list ["DN1", "DN2"] -# A whitelist of allowed client IP addresses -# -# This list may contain wildcards such as 192.168.* See the POSIX fnmatch -# function for the format of the wildcards. +# A whitelist of allowed SASL usernames. The format for usernames +# depends on the SASL authentication mechanism. Kerberos usernames +# look like username@REALM +# +# This list may contain wildcards such as +# +# &quot;*(a)EXAMPLE.COM&quot; +# +# See the POSIX fnmatch function for the format of the wildcards. # # NB If this is an empty list, no client can connect, so comment out # entirely rather than using empty list to disable these checks # -# By default, no IP's are checked. This can be IPv4 or IPv6 addresses -# tls_allowed_ip_list ["ip1", "ip2", "ip3"] - - +# By default, no Username's are checked +# sasl_allowed_username_list [&quot;joe(a)EXAMPLE.COM&quot;, &quot;fred(a)EXAMPLE.COM&quot; ] + + diff -r f28fe18bd7f5 qemud/qemud.c --- a/qemud/qemud.c Thu Nov 29 09:47:39 2007 -0500 +++ b/qemud/qemud.c Thu Nov 29 09:51:32 2007 -0500 @@ -77,15 +77,23 @@ static int unix_sock_rw_perms = 0700; /* static int unix_sock_rw_perms = 0700; /* Allow user only */ static int unix_sock_ro_perms = 0777; /* Allow world */ + +static int auth_unix_rw = REMOTE_AUTH_NONE; +static int auth_unix_ro = REMOTE_AUTH_NONE; +#if HAVE_SASL +static int auth_tcp = REMOTE_AUTH_SASL; +#else +static int auth_tcp = REMOTE_AUTH_NONE; +#endif +static int auth_tls = REMOTE_AUTH_NONE; + #ifdef HAVE_AVAHI static int mdns_adv = 1; static const char *mdns_name = NULL; #endif static int tls_no_verify_certificate = 0; -static int tls_no_verify_address = 0; -static const char **tls_allowed_ip_list = 0; -static const char **tls_allowed_dn_list = 0; +static char **tls_allowed_dn_list = 0; static const char *key_file = LIBVIRT_SERVERKEY; static const char *cert_file = LIBVIRT_SERVERCERT; @@ -450,7 +458,7 @@ static int qemudWritePidFile(const char } static int qemudListenUnix(struct qemud_server *server, - const char *path, int readonly) { + const char *path, int readonly, int auth) { struct qemud_socket *sock = calloc(1, sizeof(struct qemud_socket)); struct sockaddr_un addr; mode_t oldmask; @@ -464,6 +472,7 @@ static int qemudListenUnix(struct qemud_ sock->readonly = readonly; sock->port = -1; sock->type = QEMUD_SOCK_TYPE_UNIX; + sock->auth = auth; if ((sock->fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) { qemudLog(QEMUD_ERR, "Failed to create socket: %s", @@ -701,6 +710,27 @@ static int qemudInitPaths(struct qemud_s static struct qemud_server *qemudInitialize(int sigread) { struct qemud_server *server; + + if (!(server = calloc(1, sizeof(struct qemud_server)))) { + qemudLog(QEMUD_ERR, "Failed to allocate struct qemud_server"); + return NULL; + } + + server->sigread = sigread; + + __virEventRegisterImpl(virEventAddHandleImpl, + virEventUpdateHandleImpl, + virEventRemoveHandleImpl, + virEventAddTimeoutImpl, + virEventUpdateTimeoutImpl, + virEventRemoveTimeoutImpl); + + virStateInitialize(); + + return server; +} + +static struct qemud_server *qemudNetworkInit(struct qemud_server *server) { struct qemud_socket *sock; char sockname[PATH_MAX]; char roSockname[PATH_MAX]; @@ -708,56 +738,39 @@ static struct qemud_server *qemudInitial int err; #endif /* HAVE_SASL */ - if (!(server = calloc(1, sizeof(struct qemud_server)))) { - qemudLog(QEMUD_ERR, "Failed to allocate struct qemud_server"); - return NULL; - } - - /* We don't have a dom-0, so start from 1 */ - server->sigread = sigread; - roSockname[0] = '\0'; if (qemudInitPaths(server, sockname, roSockname, PATH_MAX) < 0) goto cleanup; - if (qemudListenUnix(server, sockname, 0) < 0) + if (qemudListenUnix(server, sockname, 0, auth_unix_rw) < 0) goto cleanup; - if (roSockname[0] != '\0' && qemudListenUnix(server, roSockname, 1) < 0) + if (roSockname[0] != '\0' && qemudListenUnix(server, roSockname, 1, auth_unix_ro) < 0) goto cleanup; - __virEventRegisterImpl(virEventAddHandleImpl, - virEventUpdateHandleImpl, - virEventRemoveHandleImpl, - virEventAddTimeoutImpl, - virEventUpdateTimeoutImpl, - virEventRemoveTimeoutImpl); - - virStateInitialize(); - #if HAVE_SASL - if ((err = sasl_server_init(NULL, "libvirt")) != SASL_OK) { - qemudLog(QEMUD_ERR, "Failed to initialize SASL authentication %s", - sasl_errstring(err, NULL, NULL)); - goto cleanup; + if (auth_unix_rw == REMOTE_AUTH_SASL || + auth_unix_ro == REMOTE_AUTH_SASL || + auth_tcp == REMOTE_AUTH_SASL || + auth_tls == REMOTE_AUTH_SASL) { + if ((err = sasl_server_init(NULL, "libvirt")) != SASL_OK) { + qemudLog(QEMUD_ERR, "Failed to initialize SASL authentication %s", + sasl_errstring(err, NULL, NULL)); + goto cleanup; + } } #endif if (ipsock) { -#if HAVE_SASL - if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, REMOTE_AUTH_SASL) < 0) + if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, auth_tcp) < 0) goto cleanup; -#else - if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, REMOTE_AUTH_NONE) < 0) - goto cleanup; -#endif if (listen_tls) { if (remoteInitializeGnuTLS () < 0) goto cleanup; - if (remoteListenTCP (server, tls_port, QEMUD_SOCK_TYPE_TLS, REMOTE_AUTH_NONE) < 0) + if (remoteListenTCP (server, tls_port, QEMUD_SOCK_TYPE_TLS, auth_tls) < 0) goto cleanup; } } @@ -859,7 +872,7 @@ remoteCheckDN (gnutls_x509_crt_t cert) { char name[256]; size_t namesize = sizeof name; - const char **wildcards; + char **wildcards; int err; err = gnutls_x509_crt_get_dn (cert, name, &namesize); @@ -977,53 +990,11 @@ static int static int remoteCheckAccess (struct qemud_client *client) { - char addr[NI_MAXHOST]; - const char **wildcards; - int found, err; - /* Verify client certificate. */ if (remoteCheckCertificate (client->tlssession) == -1) { qemudLog (QEMUD_ERR, "remoteCheckCertificate: failed to verify client's certificate"); if (!tls_no_verify_certificate) return -1; else qemudLog (QEMUD_INFO, "remoteCheckCertificate: tls_no_verify_certificate is set so the bad certificate is ignored"); - } - - /*----- IP address check, similar to tcp wrappers -----*/ - - /* Convert IP address to printable string (eg. "127.0.0.1" or "::1"). */ - err = getnameinfo ((struct sockaddr *) &client->addr, client->addrlen, - addr, sizeof addr, NULL, 0, - NI_NUMERICHOST); - if (err != 0) { - qemudLog (QEMUD_ERR, "getnameinfo: %s", gai_strerror (err)); - return -1; - } - - /* Verify the client is on the list of allowed clients. - * - * NB: No tls_allowed_ip_list in config file means anyone can access. - * If tls_allowed_ip_list is in the config file but empty, means no - * one can access (not particularly useful, but it's what the sysadmin - * would expect). - */ - wildcards = tls_allowed_ip_list; - if (wildcards) { - found = 0; - - while (*wildcards) { - if (fnmatch (*wildcards, addr, 0) == 0) { - found = 1; - break; - } - wildcards++; - } - } else - found = 1; - - if (!found) { - qemudLog (QEMUD_ERR, "remoteCheckAccess: client's IP address (%s) is not on the list of allowed clients (tls_allowed_ip_list)", addr); - if (!tls_no_verify_address) return -1; - else qemudLog (QEMUD_INFO, "remoteCheckAccess: tls_no_verify_address is set so the client's IP address is ignored"); } /* Checks have succeeded. Write a '\1' byte back to the client to @@ -1148,6 +1119,7 @@ static void qemudDispatchClientFailure(s #if HAVE_SASL if (client->saslconn) sasl_dispose(&client->saslconn); + if (client->saslUsername) free(client->saslUsername); #endif if (client->tlssession) gnutls_deinit (client->tlssession); close(client->fd); @@ -1649,17 +1621,114 @@ static void qemudCleanup(struct qemud_se sock = next; } - + if (server->saslUsernameWhitelist) { + char **list = server->saslUsernameWhitelist; + while (*list) { + if (*list) + free(*list); + list++; + } + } virStateCleanup(); free(server); +} + + +static int remoteConfigGetStringList(virConfPtr conf, const char *key, char ***list, const char *filename) { + virConfValuePtr p; + + p = virConfGetValue (conf, key); + if (p) { + switch (p->type) { + case VIR_CONF_STRING: + *list = malloc (2 * sizeof (char *)); + if (*list == NULL) { + qemudLog (QEMUD_ERR, "failed to allocate memory for %s config list", key); + return -1; + } + (*list)[0] = strdup (p->str); + (*list)[1] = 0; + if ((*list)[0] == NULL) { + qemudLog (QEMUD_ERR, "failed to allocate memory for %s config list value", key); + free(*list); + return -1; + } + break; + + case VIR_CONF_LIST: { + int i, len = 0; + virConfValuePtr pp; + for (pp = p->list; pp; pp = pp->next) + len++; + *list = + calloc (1+len, sizeof (char *)); + if (*list == NULL) { + qemudLog (QEMUD_ERR, "failed to allocate memory for %s config list", key); + return -1; + } + for (i = 0, pp = p->list; pp; ++i, pp = pp->next) { + if (pp->type != VIR_CONF_STRING) { + qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: %s: should be a string or list of strings\n", filename, key); + return -1; + } + (*list)[i] = strdup (pp->str); + if ((*list)[i] == NULL) { + for (i = 0 ; i < len ; i++) + if ((*list)[i]) free((*list)[i]); + free(*list); + qemudLog (QEMUD_ERR, "failed to allocate memory for %s config list value", key); + return -1; + } + + } + (*list)[i] = 0; + break; + } + + default: + qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: %s: should be a string or list of strings\n", filename, key); + return -1; + } + } + + return 0; +} + +static int remoteConfigGetAuth(virConfPtr conf, const char *key, int *auth, const char *filename) { + virConfValuePtr p; + + p = virConfGetValue (conf, key); + if (!p) + return 0; + + if (p->type != VIR_CONF_STRING) { + qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: %s: should be a string\n", filename, key); + return -1; + } + + if (!p->str) + return 0; + + if (STREQ(p->str, "none")) { + *auth = REMOTE_AUTH_NONE; +#if HAVE_SASL + } else if (STREQ(p->str, "sasl")) { + *auth = REMOTE_AUTH_SASL; +#endif + } else { + qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: %s: unsupported auth %s\n", filename, key, p->str); + return -1; + } + + return 0; } /* Read the config file if it exists. * Only used in the remote case, hence the name. */ static int -remoteReadConfigFile (const char *filename) +remoteReadConfigFile (struct qemud_server *server, const char *filename) { virConfPtr conf; @@ -1695,6 +1764,15 @@ remoteReadConfigFile (const char *filena p = virConfGetValue (conf, "tcp_port"); CHECK_TYPE ("tcp_port", VIR_CONF_STRING); tcp_port = p ? strdup (p->str) : tcp_port; + + if (remoteConfigGetAuth(conf, "auth_unix_rw", &auth_unix_rw, filename) < 0) + return -1; + if (remoteConfigGetAuth(conf, "auth_unix_ro", &auth_unix_ro, filename) < 0) + return -1; + if (remoteConfigGetAuth(conf, "auth_tcp", &auth_tcp, filename) < 0) + return -1; + if (remoteConfigGetAuth(conf, "auth_tls", &auth_tls, filename) < 0) + return -1; p = virConfGetValue (conf, "unix_sock_group"); CHECK_TYPE ("unix_sock_group", VIR_CONF_STRING); @@ -1743,10 +1821,6 @@ remoteReadConfigFile (const char *filena CHECK_TYPE ("tls_no_verify_certificate", VIR_CONF_LONG); tls_no_verify_certificate = p ? p->l : tls_no_verify_certificate; - p = virConfGetValue (conf, "tls_no_verify_address"); - CHECK_TYPE ("tls_no_verify_address", VIR_CONF_LONG); - tls_no_verify_address = p ? p->l : tls_no_verify_address; - p = virConfGetValue (conf, "key_file"); CHECK_TYPE ("key_file", VIR_CONF_STRING); key_file = p ? strdup (p->str) : key_file; @@ -1763,71 +1837,11 @@ remoteReadConfigFile (const char *filena CHECK_TYPE ("crl_file", VIR_CONF_STRING); crl_file = p ? strdup (p->str) : crl_file; - p = virConfGetValue (conf, "tls_allowed_dn_list"); - if (p) { - switch (p->type) { - case VIR_CONF_STRING: - tls_allowed_dn_list = malloc (2 * sizeof (char *)); - tls_allowed_dn_list[0] = strdup (p->str); - tls_allowed_dn_list[1] = 0; - break; - - case VIR_CONF_LIST: { - int i, len = 0; - virConfValuePtr pp; - for (pp = p->list; pp; pp = p->next) - len++; - tls_allowed_dn_list = - malloc ((1+len) * sizeof (char *)); - for (i = 0, pp = p->list; pp; ++i, pp = p->next) { - if (pp->type != VIR_CONF_STRING) { - qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: tls_allowed_dn_list: should be a string or list of strings\n", filename); - return -1; - } - tls_allowed_dn_list[i] = strdup (pp->str); - } - tls_allowed_dn_list[i] = 0; - break; - } - - default: - qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: tls_allowed_dn_list: should be a string or list of strings\n", filename); - return -1; - } - } - - p = virConfGetValue (conf, "tls_allowed_ip_list"); - if (p) { - switch (p->type) { - case VIR_CONF_STRING: - tls_allowed_ip_list = malloc (2 * sizeof (char *)); - tls_allowed_ip_list[0] = strdup (p->str); - tls_allowed_ip_list[1] = 0; - break; - - case VIR_CONF_LIST: { - int i, len = 0; - virConfValuePtr pp; - for (pp = p->list; pp; pp = p->next) - len++; - tls_allowed_ip_list = - malloc ((1+len) * sizeof (char *)); - for (i = 0, pp = p->list; pp; ++i, pp = p->next) { - if (pp->type != VIR_CONF_STRING) { - qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: tls_allowed_ip_list: should be a string or list of strings\n", filename); - return -1; - } - tls_allowed_ip_list[i] = strdup (pp->str); - } - tls_allowed_ip_list[i] = 0; - break; - } - - default: - qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: tls_allowed_ip_list: should be a string or list of strings\n", filename); - return -1; - } - } + if (remoteConfigGetStringList(conf, "tls_allowed_dn_list", &tls_allowed_dn_list, filename) < 0) + return -1; + + if (remoteConfigGetStringList(conf, "sasl_allowed_username_list", &server->saslUsernameWhitelist, filename) < 0) + return -1; virConfFree (conf); return 0; @@ -1950,13 +1964,6 @@ int main(int argc, char **argv) { } } - /* Read the config file (if it exists). */ - if (remoteReadConfigFile (remote_config_file) < 0) - goto error1; - - if (godaemon) - openlog("libvirtd", 0, 0); - if (pipe(sigpipe) < 0 || qemudSetNonBlock(sigpipe[0]) < 0 || qemudSetNonBlock(sigpipe[1]) < 0) { @@ -1964,8 +1971,38 @@ int main(int argc, char **argv) { strerror(errno)); goto error1; } - sigwrite = sigpipe[1]; + + if (!(server = qemudInitialize(sigpipe[0]))) { + ret = 2; + goto error1; + } + + /* Read the config file (if it exists). */ + if (remoteReadConfigFile (server, remote_config_file) < 0) + goto error1; + + if (godaemon) { + int pid; + openlog("libvirtd", 0, 0); + pid = qemudGoDaemon(); + if (pid < 0) { + qemudLog(QEMUD_ERR, "Failed to fork as daemon: %s", + strerror(errno)); + goto error1; + } + if (pid > 0) + goto out; + + /* Choose the name of the PID file. */ + if (!pid_file) { + if (REMOTE_PID_FILE[0] != '\0') + pid_file = REMOTE_PID_FILE; + } + + if (pid_file && qemudWritePidFile (pid_file) < 0) + goto error1; + } sig_action.sa_handler = sig_handler; sig_action.sa_flags = 0; @@ -1979,31 +2016,6 @@ int main(int argc, char **argv) { sig_action.sa_handler = SIG_IGN; sigaction(SIGPIPE, &sig_action, NULL); - - if (godaemon) { - int pid = qemudGoDaemon(); - if (pid < 0) { - qemudLog(QEMUD_ERR, "Failed to fork as daemon: %s", - strerror(errno)); - goto error1; - } - if (pid > 0) - goto out; - - /* Choose the name of the PID file. */ - if (!pid_file) { - if (REMOTE_PID_FILE[0] != '\0') - pid_file = REMOTE_PID_FILE; - } - - if (pid_file && qemudWritePidFile (pid_file) < 0) - goto error1; - } - - if (!(server = qemudInitialize(sigpipe[0]))) { - ret = 2; - goto error2; - } if (virEventAddHandleImpl(sigpipe[0], POLLIN, @@ -2011,6 +2023,11 @@ int main(int argc, char **argv) { server) < 0) { qemudLog(QEMUD_ERR, "Failed to register callback for signal pipe"); ret = 3; + goto error2; + } + + if (!(server = qemudNetworkInit(server))) { + ret = 2; goto error2; } diff -r f28fe18bd7f5 qemud/remote.c --- a/qemud/remote.c Thu Nov 29 09:47:39 2007 -0500 +++ b/qemud/remote.c Thu Nov 29 09:51:32 2007 -0500 @@ -44,6 +44,7 @@ #include <getopt.h> #include <ctype.h> #include <assert.h> +#include <fnmatch.h> #include <libvirt/virterror.h> @@ -65,14 +66,18 @@ static void make_nonnull_network (remote #include "remote_dispatch_prototypes.h" -typedef int (*dispatch_fn) (struct qemud_client *client, remote_message_header *req, char *args, char *ret); +typedef int (*dispatch_fn) (struct qemud_server *server, + struct qemud_client *client, + remote_message_header *req, + char *args, + char *ret); /* This function gets called from qemud when it detects an incoming * remote protocol message. At this point, client->buffer contains * the full call message (including length word which we skip). */ void -remoteDispatchClientRequest (struct qemud_server *server ATTRIBUTE_UNUSED, +remoteDispatchClientRequest (struct qemud_server *server, struct qemud_client *client) { XDR xdr; @@ -158,7 +163,7 @@ remoteDispatchClientRequest (struct qemu xdr_destroy (&xdr); /* Call function. */ - rv = fn (client, &req, args, ret); + rv = fn (server, client, &req, args, ret); xdr_free (args_filter, args); /* Dispatch function must return -2, -1 or 0. Anything else is @@ -398,7 +403,8 @@ remoteDispatchError (struct qemud_client /*----- Functions. -----*/ static int -remoteDispatchOpen (struct qemud_client *client, remote_message_header *req, +remoteDispatchOpen (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, struct remote_open_args *args, void *ret ATTRIBUTE_UNUSED) { const char *name; @@ -437,7 +443,8 @@ remoteDispatchOpen (struct qemud_client } static int -remoteDispatchClose (struct qemud_client *client, remote_message_header *req, +remoteDispatchClose (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, void *ret ATTRIBUTE_UNUSED) { int rv; @@ -450,7 +457,8 @@ remoteDispatchClose (struct qemud_client } static int -remoteDispatchSupportsFeature (struct qemud_client *client, remote_message_header *req, +remoteDispatchSupportsFeature (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_supports_feature_args *args, remote_supports_feature_ret *ret) { CHECK_CONN(client); @@ -462,7 +470,8 @@ remoteDispatchSupportsFeature (struct qe } static int -remoteDispatchGetType (struct qemud_client *client, remote_message_header *req, +remoteDispatchGetType (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_type_ret *ret) { const char *type; @@ -484,7 +493,8 @@ remoteDispatchGetType (struct qemud_clie } static int -remoteDispatchGetVersion (struct qemud_client *client, +remoteDispatchGetVersion (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_version_ret *ret) @@ -500,7 +510,8 @@ remoteDispatchGetVersion (struct qemud_c } static int -remoteDispatchGetHostname (struct qemud_client *client, +remoteDispatchGetHostname (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_hostname_ret *ret) @@ -516,7 +527,8 @@ remoteDispatchGetHostname (struct qemud_ } static int -remoteDispatchGetMaxVcpus (struct qemud_client *client, +remoteDispatchGetMaxVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_get_max_vcpus_args *args, remote_get_max_vcpus_ret *ret) @@ -532,7 +544,8 @@ remoteDispatchGetMaxVcpus (struct qemud_ } static int -remoteDispatchNodeGetInfo (struct qemud_client *client, +remoteDispatchNodeGetInfo (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_node_get_info_ret *ret) @@ -556,7 +569,8 @@ remoteDispatchNodeGetInfo (struct qemud_ } static int -remoteDispatchGetCapabilities (struct qemud_client *client, +remoteDispatchGetCapabilities (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_capabilities_ret *ret) @@ -572,7 +586,8 @@ remoteDispatchGetCapabilities (struct qe } static int -remoteDispatchDomainGetSchedulerType (struct qemud_client *client, +remoteDispatchDomainGetSchedulerType (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_type_args *args, remote_domain_get_scheduler_type_ret *ret) @@ -601,7 +616,8 @@ remoteDispatchDomainGetSchedulerType (st } static int -remoteDispatchDomainGetSchedulerParameters (struct qemud_client *client, +remoteDispatchDomainGetSchedulerParameters (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_parameters_args *args, remote_domain_get_scheduler_parameters_ret *ret) @@ -687,7 +703,8 @@ remoteDispatchDomainGetSchedulerParamete } static int -remoteDispatchDomainSetSchedulerParameters (struct qemud_client *client, +remoteDispatchDomainSetSchedulerParameters (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_scheduler_parameters_args *args, void *ret ATTRIBUTE_UNUSED) @@ -747,7 +764,8 @@ remoteDispatchDomainSetSchedulerParamete } static int -remoteDispatchDomainBlockStats (struct qemud_client *client, +remoteDispatchDomainBlockStats (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret) @@ -777,7 +795,8 @@ remoteDispatchDomainBlockStats (struct q } static int -remoteDispatchDomainInterfaceStats (struct qemud_client *client, +remoteDispatchDomainInterfaceStats (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_interface_stats_args *args, remote_domain_interface_stats_ret *ret) @@ -810,7 +829,8 @@ remoteDispatchDomainInterfaceStats (stru } static int -remoteDispatchDomainAttachDevice (struct qemud_client *client, +remoteDispatchDomainAttachDevice (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret ATTRIBUTE_UNUSED) @@ -833,7 +853,8 @@ remoteDispatchDomainAttachDevice (struct } static int -remoteDispatchDomainCreate (struct qemud_client *client, +remoteDispatchDomainCreate (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_create_args *args, void *ret ATTRIBUTE_UNUSED) @@ -856,7 +877,8 @@ remoteDispatchDomainCreate (struct qemud } static int -remoteDispatchDomainCreateLinux (struct qemud_client *client, +remoteDispatchDomainCreateLinux (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_create_linux_args *args, remote_domain_create_linux_ret *ret) @@ -874,7 +896,8 @@ remoteDispatchDomainCreateLinux (struct } static int -remoteDispatchDomainDefineXml (struct qemud_client *client, +remoteDispatchDomainDefineXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_define_xml_args *args, remote_domain_define_xml_ret *ret) @@ -892,7 +915,8 @@ remoteDispatchDomainDefineXml (struct qe } static int -remoteDispatchDomainDestroy (struct qemud_client *client, +remoteDispatchDomainDestroy (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_destroy_args *args, void *ret ATTRIBUTE_UNUSED) @@ -913,7 +937,8 @@ remoteDispatchDomainDestroy (struct qemu } static int -remoteDispatchDomainDetachDevice (struct qemud_client *client, +remoteDispatchDomainDetachDevice (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_detach_device_args *args, void *ret ATTRIBUTE_UNUSED) @@ -937,7 +962,8 @@ remoteDispatchDomainDetachDevice (struct } static int -remoteDispatchDomainDumpXml (struct qemud_client *client, +remoteDispatchDomainDumpXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_dump_xml_args *args, remote_domain_dump_xml_ret *ret) @@ -962,7 +988,8 @@ remoteDispatchDomainDumpXml (struct qemu } static int -remoteDispatchDomainGetAutostart (struct qemud_client *client, +remoteDispatchDomainGetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_autostart_args *args, remote_domain_get_autostart_ret *ret) @@ -985,7 +1012,8 @@ remoteDispatchDomainGetAutostart (struct } static int -remoteDispatchDomainGetInfo (struct qemud_client *client, +remoteDispatchDomainGetInfo (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_info_args *args, remote_domain_get_info_ret *ret) @@ -1017,7 +1045,8 @@ remoteDispatchDomainGetInfo (struct qemu } static int -remoteDispatchDomainGetMaxMemory (struct qemud_client *client, +remoteDispatchDomainGetMaxMemory (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_max_memory_args *args, remote_domain_get_max_memory_ret *ret) @@ -1041,7 +1070,8 @@ remoteDispatchDomainGetMaxMemory (struct } static int -remoteDispatchDomainGetMaxVcpus (struct qemud_client *client, +remoteDispatchDomainGetMaxVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_max_vcpus_args *args, remote_domain_get_max_vcpus_ret *ret) @@ -1065,7 +1095,8 @@ remoteDispatchDomainGetMaxVcpus (struct } static int -remoteDispatchDomainGetOsType (struct qemud_client *client, +remoteDispatchDomainGetOsType (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_os_type_args *args, remote_domain_get_os_type_ret *ret) @@ -1090,7 +1121,8 @@ remoteDispatchDomainGetOsType (struct qe } static int -remoteDispatchDomainGetVcpus (struct qemud_client *client, +remoteDispatchDomainGetVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_vcpus_args *args, remote_domain_get_vcpus_ret *ret) @@ -1154,7 +1186,8 @@ remoteDispatchDomainGetVcpus (struct qem } static int -remoteDispatchDomainMigratePrepare (struct qemud_client *client, +remoteDispatchDomainMigratePrepare (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_migrate_prepare_args *args, remote_domain_migrate_prepare_ret *ret) @@ -1189,7 +1222,8 @@ remoteDispatchDomainMigratePrepare (stru } static int -remoteDispatchDomainMigratePerform (struct qemud_client *client, +remoteDispatchDomainMigratePerform (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_migrate_perform_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1218,7 +1252,8 @@ remoteDispatchDomainMigratePerform (stru } static int -remoteDispatchDomainMigrateFinish (struct qemud_client *client, +remoteDispatchDomainMigrateFinish (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_migrate_finish_args *args, remote_domain_migrate_finish_ret *ret) @@ -1239,7 +1274,8 @@ remoteDispatchDomainMigrateFinish (struc } static int -remoteDispatchListDefinedDomains (struct qemud_client *client, +remoteDispatchListDefinedDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_defined_domains_args *args, remote_list_defined_domains_ret *ret) @@ -1264,7 +1300,8 @@ remoteDispatchListDefinedDomains (struct } static int -remoteDispatchDomainLookupById (struct qemud_client *client, +remoteDispatchDomainLookupById (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_id_args *args, remote_domain_lookup_by_id_ret *ret) @@ -1281,7 +1318,8 @@ remoteDispatchDomainLookupById (struct q } static int -remoteDispatchDomainLookupByName (struct qemud_client *client, +remoteDispatchDomainLookupByName (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_name_args *args, remote_domain_lookup_by_name_ret *ret) @@ -1298,7 +1336,8 @@ remoteDispatchDomainLookupByName (struct } static int -remoteDispatchDomainLookupByUuid (struct qemud_client *client, +remoteDispatchDomainLookupByUuid (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_uuid_args *args, remote_domain_lookup_by_uuid_ret *ret) @@ -1315,7 +1354,8 @@ remoteDispatchDomainLookupByUuid (struct } static int -remoteDispatchNumOfDefinedDomains (struct qemud_client *client, +remoteDispatchNumOfDefinedDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_defined_domains_ret *ret) @@ -1329,7 +1369,8 @@ remoteDispatchNumOfDefinedDomains (struc } static int -remoteDispatchDomainPinVcpu (struct qemud_client *client, +remoteDispatchDomainPinVcpu (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_pin_vcpu_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1362,7 +1403,8 @@ remoteDispatchDomainPinVcpu (struct qemu } static int -remoteDispatchDomainReboot (struct qemud_client *client, +remoteDispatchDomainReboot (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_reboot_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1385,7 +1427,8 @@ remoteDispatchDomainReboot (struct qemud } static int -remoteDispatchDomainRestore (struct qemud_client *client, +remoteDispatchDomainRestore (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_restore_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1399,7 +1442,8 @@ remoteDispatchDomainRestore (struct qemu } static int -remoteDispatchDomainResume (struct qemud_client *client, +remoteDispatchDomainResume (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_resume_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1422,7 +1466,8 @@ remoteDispatchDomainResume (struct qemud } static int -remoteDispatchDomainSave (struct qemud_client *client, +remoteDispatchDomainSave (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_save_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1445,7 +1490,8 @@ remoteDispatchDomainSave (struct qemud_c } static int -remoteDispatchDomainCoreDump (struct qemud_client *client, +remoteDispatchDomainCoreDump (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_core_dump_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1468,7 +1514,8 @@ remoteDispatchDomainCoreDump (struct qem } static int -remoteDispatchDomainSetAutostart (struct qemud_client *client, +remoteDispatchDomainSetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_autostart_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1491,7 +1538,8 @@ remoteDispatchDomainSetAutostart (struct } static int -remoteDispatchDomainSetMaxMemory (struct qemud_client *client, +remoteDispatchDomainSetMaxMemory (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_max_memory_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1514,7 +1562,8 @@ remoteDispatchDomainSetMaxMemory (struct } static int -remoteDispatchDomainSetMemory (struct qemud_client *client, +remoteDispatchDomainSetMemory (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_memory_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1537,7 +1586,8 @@ remoteDispatchDomainSetMemory (struct qe } static int -remoteDispatchDomainSetVcpus (struct qemud_client *client, +remoteDispatchDomainSetVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_vcpus_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1560,7 +1610,8 @@ remoteDispatchDomainSetVcpus (struct qem } static int -remoteDispatchDomainShutdown (struct qemud_client *client, +remoteDispatchDomainShutdown (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_shutdown_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1583,7 +1634,8 @@ remoteDispatchDomainShutdown (struct qem } static int -remoteDispatchDomainSuspend (struct qemud_client *client, +remoteDispatchDomainSuspend (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_suspend_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1606,7 +1658,8 @@ remoteDispatchDomainSuspend (struct qemu } static int -remoteDispatchDomainUndefine (struct qemud_client *client, +remoteDispatchDomainUndefine (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_undefine_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1629,7 +1682,8 @@ remoteDispatchDomainUndefine (struct qem } static int -remoteDispatchListDefinedNetworks (struct qemud_client *client, +remoteDispatchListDefinedNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_defined_networks_args *args, remote_list_defined_networks_ret *ret) @@ -1654,7 +1708,8 @@ remoteDispatchListDefinedNetworks (struc } static int -remoteDispatchListDomains (struct qemud_client *client, +remoteDispatchListDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_domains_args *args, remote_list_domains_ret *ret) @@ -1678,7 +1733,8 @@ remoteDispatchListDomains (struct qemud_ } static int -remoteDispatchListNetworks (struct qemud_client *client, +remoteDispatchListNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_networks_args *args, remote_list_networks_ret *ret) @@ -1703,7 +1759,8 @@ remoteDispatchListNetworks (struct qemud } static int -remoteDispatchNetworkCreate (struct qemud_client *client, +remoteDispatchNetworkCreate (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_create_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1726,7 +1783,8 @@ remoteDispatchNetworkCreate (struct qemu } static int -remoteDispatchNetworkCreateXml (struct qemud_client *client, +remoteDispatchNetworkCreateXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_create_xml_args *args, remote_network_create_xml_ret *ret) @@ -1743,7 +1801,8 @@ remoteDispatchNetworkCreateXml (struct q } static int -remoteDispatchNetworkDefineXml (struct qemud_client *client, +remoteDispatchNetworkDefineXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_define_xml_args *args, remote_network_define_xml_ret *ret) @@ -1760,7 +1819,8 @@ remoteDispatchNetworkDefineXml (struct q } static int -remoteDispatchNetworkDestroy (struct qemud_client *client, +remoteDispatchNetworkDestroy (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_destroy_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1783,7 +1843,8 @@ remoteDispatchNetworkDestroy (struct qem } static int -remoteDispatchNetworkDumpXml (struct qemud_client *client, +remoteDispatchNetworkDumpXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_dump_xml_args *args, remote_network_dump_xml_ret *ret) @@ -1808,7 +1869,8 @@ remoteDispatchNetworkDumpXml (struct qem } static int -remoteDispatchNetworkGetAutostart (struct qemud_client *client, +remoteDispatchNetworkGetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_get_autostart_args *args, remote_network_get_autostart_ret *ret) @@ -1831,7 +1893,8 @@ remoteDispatchNetworkGetAutostart (struc } static int -remoteDispatchNetworkGetBridgeName (struct qemud_client *client, +remoteDispatchNetworkGetBridgeName (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_get_bridge_name_args *args, remote_network_get_bridge_name_ret *ret) @@ -1856,7 +1919,8 @@ remoteDispatchNetworkGetBridgeName (stru } static int -remoteDispatchNetworkLookupByName (struct qemud_client *client, +remoteDispatchNetworkLookupByName (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_name_args *args, remote_network_lookup_by_name_ret *ret) @@ -1873,7 +1937,8 @@ remoteDispatchNetworkLookupByName (struc } static int -remoteDispatchNetworkLookupByUuid (struct qemud_client *client, +remoteDispatchNetworkLookupByUuid (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_uuid_args *args, remote_network_lookup_by_uuid_ret *ret) @@ -1890,7 +1955,8 @@ remoteDispatchNetworkLookupByUuid (struc } static int -remoteDispatchNetworkSetAutostart (struct qemud_client *client, +remoteDispatchNetworkSetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_set_autostart_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1913,7 +1979,8 @@ remoteDispatchNetworkSetAutostart (struc } static int -remoteDispatchNetworkUndefine (struct qemud_client *client, +remoteDispatchNetworkUndefine (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_undefine_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1936,7 +2003,8 @@ remoteDispatchNetworkUndefine (struct qe } static int -remoteDispatchNumOfDefinedNetworks (struct qemud_client *client, +remoteDispatchNumOfDefinedNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_defined_networks_ret *ret) @@ -1950,7 +2018,8 @@ remoteDispatchNumOfDefinedNetworks (stru } static int -remoteDispatchNumOfDomains (struct qemud_client *client, +remoteDispatchNumOfDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_domains_ret *ret) @@ -1964,7 +2033,8 @@ remoteDispatchNumOfDomains (struct qemud } static int -remoteDispatchNumOfNetworks (struct qemud_client *client, +remoteDispatchNumOfNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_networks_ret *ret) @@ -1979,7 +2049,8 @@ remoteDispatchNumOfNetworks (struct qemu static int -remoteDispatchAuthList (struct qemud_client *client, +remoteDispatchAuthList (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req ATTRIBUTE_UNUSED, void *args ATTRIBUTE_UNUSED, remote_auth_list_ret *ret) @@ -2034,7 +2105,8 @@ static char *addrToString(struct qemud_c * XXX callbacks for stuff like password verification ? */ static int -remoteDispatchAuthSaslInit (struct qemud_client *client, +remoteDispatchAuthSaslInit (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_auth_sasl_init_ret *ret) @@ -2223,11 +2295,67 @@ remoteSASLCheckSSF (struct qemud_client return 0; } +static int +remoteSASLCheckAccess (struct qemud_server *server, + struct qemud_client *client, + remote_message_header *req) { + const void *val; + int err; + char **wildcards; + + err = sasl_getprop(client->saslconn, SASL_USERNAME, &val); + if (err != SASL_OK) { + qemudLog(QEMUD_ERR, "cannot query SASL username on connection %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + if (val == NULL) { + qemudLog(QEMUD_ERR, "no client username was found"); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + REMOTE_DEBUG("SASL client username %s", (const char *)val); + + client->saslUsername = strdup((const char*)val); + if (client->saslUsername == NULL) { + qemudLog(QEMUD_ERR, "out of memory copying username"); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + + /* If the list is not set, allow any DN. */ + wildcards = server->saslUsernameWhitelist; + if (!wildcards) + return 0; /* No ACL, allow all */ + + while (*wildcards) { + if (fnmatch (*wildcards, client->saslUsername, 0) == 0) + return 0; /* Allowed */ + wildcards++; + } + + /* Denied */ + qemudLog(QEMUD_ERR, "SASL client %s not allowed in whitelist", client->saslUsername); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; +} + + /* * This starts the SASL authentication negotiation. */ static int -remoteDispatchAuthSaslStart (struct qemud_client *client, +remoteDispatchAuthSaslStart (struct qemud_server *server, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret) @@ -2291,6 +2419,10 @@ remoteDispatchAuthSaslStart (struct qemu if (remoteSASLCheckSSF(client, req) < 0) return -2; + /* Check username whitelist ACL */ + if (remoteSASLCheckAccess(server, client, req) < 0) + return -2; + REMOTE_DEBUG("Authentication successful %d", client->fd); ret->complete = 1; client->auth = REMOTE_AUTH_NONE; @@ -2301,7 +2433,8 @@ remoteDispatchAuthSaslStart (struct qemu static int -remoteDispatchAuthSaslStep (struct qemud_client *client, +remoteDispatchAuthSaslStep (struct qemud_server *server, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret) @@ -2365,6 +2498,10 @@ remoteDispatchAuthSaslStep (struct qemud if (remoteSASLCheckSSF(client, req) < 0) return -2; + /* Check username whitelist ACL */ + if (remoteSASLCheckAccess(server, client, req) < 0) + return -2; + REMOTE_DEBUG("Authentication successful %d", client->fd); ret->complete = 1; client->auth = REMOTE_AUTH_NONE; @@ -2376,7 +2513,8 @@ remoteDispatchAuthSaslStep (struct qemud #else /* HAVE_SASL */ static int -remoteDispatchAuthSaslInit (struct qemud_client *client, +remoteDispatchAuthSaslInit (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_auth_sasl_init_ret *ret ATTRIBUTE_UNUSED) @@ -2387,7 +2525,8 @@ remoteDispatchAuthSaslInit (struct qemud } static int -remoteDispatchAuthSaslStart (struct qemud_client *client, +remoteDispatchAuthSaslStart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args ATTRIBUTE_UNUSED, remote_auth_sasl_start_ret *ret ATTRIBUTE_UNUSED) @@ -2398,7 +2537,8 @@ remoteDispatchAuthSaslStart (struct qemu } static int -remoteDispatchAuthSaslStep (struct qemud_client *client, +remoteDispatchAuthSaslStep (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args ATTRIBUTE_UNUSED, remote_auth_sasl_step_ret *ret ATTRIBUTE_UNUSED) diff -r f28fe18bd7f5 qemud/remote_dispatch_prototypes.h --- a/qemud/remote_dispatch_prototypes.h Thu Nov 29 09:47:39 2007 -0500 +++ b/qemud/remote_dispatch_prototypes.h Thu Nov 29 09:51:32 2007 -0500 @@ -2,72 +2,72 @@ * Do not edit this file. Any changes you make will be lost. */ -static int remoteDispatchAuthList (struct qemud_client *client, remote_message_header *req, void *args, remote_auth_list_ret *ret); -static int remoteDispatchAuthSaslInit (struct qemud_client *client, remote_message_header *req, void *args, remote_auth_sasl_init_ret *ret); -static int remoteDispatchAuthSaslStart (struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret); -static int remoteDispatchAuthSaslStep (struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret); -static int remoteDispatchClose (struct qemud_client *client, remote_message_header *req, void *args, void *ret); -static int remoteDispatchDomainAttachDevice (struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret); -static int remoteDispatchDomainBlockStats (struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret); -static int remoteDispatchDomainCoreDump (struct qemud_client *client, remote_message_header *req, remote_domain_core_dump_args *args, void *ret); -static int remoteDispatchDomainCreate (struct qemud_client *client, remote_message_header *req, remote_domain_create_args *args, void *ret); -static int remoteDispatchDomainCreateLinux (struct qemud_client *client, remote_message_header *req, remote_domain_create_linux_args *args, remote_domain_create_linux_ret *ret); -static int remoteDispatchDomainDefineXml (struct qemud_client *client, remote_message_header *req, remote_domain_define_xml_args *args, remote_domain_define_xml_ret *ret); -static int remoteDispatchDomainDestroy (struct qemud_client *client, remote_message_header *req, remote_domain_destroy_args *args, void *ret); -static int remoteDispatchDomainDetachDevice (struct qemud_client *client, remote_message_header *req, remote_domain_detach_device_args *args, void *ret); -static int remoteDispatchDomainDumpXml (struct qemud_client *client, remote_message_header *req, remote_domain_dump_xml_args *args, remote_domain_dump_xml_ret *ret); -static int remoteDispatchDomainGetAutostart (struct qemud_client *client, remote_message_header *req, remote_domain_get_autostart_args *args, remote_domain_get_autostart_ret *ret); -static int remoteDispatchDomainGetInfo (struct qemud_client *client, remote_message_header *req, remote_domain_get_info_args *args, remote_domain_get_info_ret *ret); -static int remoteDispatchDomainGetMaxMemory (struct qemud_client *client, remote_message_header *req, remote_domain_get_max_memory_args *args, remote_domain_get_max_memory_ret *ret); -static int remoteDispatchDomainGetMaxVcpus (struct qemud_client *client, remote_message_header *req, remote_domain_get_max_vcpus_args *args, remote_domain_get_max_vcpus_ret *ret); -static int remoteDispatchDomainGetOsType (struct qemud_client *client, remote_message_header *req, remote_domain_get_os_type_args *args, remote_domain_get_os_type_ret *ret); -static int remoteDispatchDomainGetSchedulerParameters (struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_parameters_args *args, remote_domain_get_scheduler_parameters_ret *ret); -static int remoteDispatchDomainGetSchedulerType (struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_type_args *args, remote_domain_get_scheduler_type_ret *ret); -static int remoteDispatchDomainGetVcpus (struct qemud_client *client, remote_message_header *req, remote_domain_get_vcpus_args *args, remote_domain_get_vcpus_ret *ret); -static int remoteDispatchDomainInterfaceStats (struct qemud_client *client, remote_message_header *req, remote_domain_interface_stats_args *args, remote_domain_interface_stats_ret *ret); -static int remoteDispatchDomainLookupById (struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_id_args *args, remote_domain_lookup_by_id_ret *ret); -static int remoteDispatchDomainLookupByName (struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_name_args *args, remote_domain_lookup_by_name_ret *ret); -static int remoteDispatchDomainLookupByUuid (struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_uuid_args *args, remote_domain_lookup_by_uuid_ret *ret); -static int remoteDispatchDomainMigrateFinish (struct qemud_client *client, remote_message_header *req, remote_domain_migrate_finish_args *args, remote_domain_migrate_finish_ret *ret); -static int remoteDispatchDomainMigratePerform (struct qemud_client *client, remote_message_header *req, remote_domain_migrate_perform_args *args, void *ret); -static int remoteDispatchDomainMigratePrepare (struct qemud_client *client, remote_message_header *req, remote_domain_migrate_prepare_args *args, remote_domain_migrate_prepare_ret *ret); -static int remoteDispatchDomainPinVcpu (struct qemud_client *client, remote_message_header *req, remote_domain_pin_vcpu_args *args, void *ret); -static int remoteDispatchDomainReboot (struct qemud_client *client, remote_message_header *req, remote_domain_reboot_args *args, void *ret); -static int remoteDispatchDomainRestore (struct qemud_client *client, remote_message_header *req, remote_domain_restore_args *args, void *ret); -static int remoteDispatchDomainResume (struct qemud_client *client, remote_message_header *req, remote_domain_resume_args *args, void *ret); -static int remoteDispatchDomainSave (struct qemud_client *client, remote_message_header *req, remote_domain_save_args *args, void *ret); -static int remoteDispatchDomainSetAutostart (struct qemud_client *client, remote_message_header *req, remote_domain_set_autostart_args *args, void *ret); -static int remoteDispatchDomainSetMaxMemory (struct qemud_client *client, remote_message_header *req, remote_domain_set_max_memory_args *args, void *ret); -static int remoteDispatchDomainSetMemory (struct qemud_client *client, remote_message_header *req, remote_domain_set_memory_args *args, void *ret); -static int remoteDispatchDomainSetSchedulerParameters (struct qemud_client *client, remote_message_header *req, remote_domain_set_scheduler_parameters_args *args, void *ret); -static int remoteDispatchDomainSetVcpus (struct qemud_client *client, remote_message_header *req, remote_domain_set_vcpus_args *args, void *ret); -static int remoteDispatchDomainShutdown (struct qemud_client *client, remote_message_header *req, remote_domain_shutdown_args *args, void *ret); -static int remoteDispatchDomainSuspend (struct qemud_client *client, remote_message_header *req, remote_domain_suspend_args *args, void *ret); -static int remoteDispatchDomainUndefine (struct qemud_client *client, remote_message_header *req, remote_domain_undefine_args *args, void *ret); -static int remoteDispatchGetCapabilities (struct qemud_client *client, remote_message_header *req, void *args, remote_get_capabilities_ret *ret); -static int remoteDispatchGetHostname (struct qemud_client *client, remote_message_header *req, void *args, remote_get_hostname_ret *ret); -static int remoteDispatchGetMaxVcpus (struct qemud_client *client, remote_message_header *req, remote_get_max_vcpus_args *args, remote_get_max_vcpus_ret *ret); -static int remoteDispatchGetType (struct qemud_client *client, remote_message_header *req, void *args, remote_get_type_ret *ret); -static int remoteDispatchGetVersion (struct qemud_client *client, remote_message_header *req, void *args, remote_get_version_ret *ret); -static int remoteDispatchListDefinedDomains (struct qemud_client *client, remote_message_header *req, remote_list_defined_domains_args *args, remote_list_defined_domains_ret *ret); -static int remoteDispatchListDefinedNetworks (struct qemud_client *client, remote_message_header *req, remote_list_defined_networks_args *args, remote_list_defined_networks_ret *ret); -static int remoteDispatchListDomains (struct qemud_client *client, remote_message_header *req, remote_list_domains_args *args, remote_list_domains_ret *ret); -static int remoteDispatchListNetworks (struct qemud_client *client, remote_message_header *req, remote_list_networks_args *args, remote_list_networks_ret *ret); -static int remoteDispatchNetworkCreate (struct qemud_client *client, remote_message_header *req, remote_network_create_args *args, void *ret); -static int remoteDispatchNetworkCreateXml (struct qemud_client *client, remote_message_header *req, remote_network_create_xml_args *args, remote_network_create_xml_ret *ret); -static int remoteDispatchNetworkDefineXml (struct qemud_client *client, remote_message_header *req, remote_network_define_xml_args *args, remote_network_define_xml_ret *ret); -static int remoteDispatchNetworkDestroy (struct qemud_client *client, remote_message_header *req, remote_network_destroy_args *args, void *ret); -static int remoteDispatchNetworkDumpXml (struct qemud_client *client, remote_message_header *req, remote_network_dump_xml_args *args, remote_network_dump_xml_ret *ret); -static int remoteDispatchNetworkGetAutostart (struct qemud_client *client, remote_message_header *req, remote_network_get_autostart_args *args, remote_network_get_autostart_ret *ret); -static int remoteDispatchNetworkGetBridgeName (struct qemud_client *client, remote_message_header *req, remote_network_get_bridge_name_args *args, remote_network_get_bridge_name_ret *ret); -static int remoteDispatchNetworkLookupByName (struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_name_args *args, remote_network_lookup_by_name_ret *ret); -static int remoteDispatchNetworkLookupByUuid (struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_uuid_args *args, remote_network_lookup_by_uuid_ret *ret); -static int remoteDispatchNetworkSetAutostart (struct qemud_client *client, remote_message_header *req, remote_network_set_autostart_args *args, void *ret); -static int remoteDispatchNetworkUndefine (struct qemud_client *client, remote_message_header *req, remote_network_undefine_args *args, void *ret); -static int remoteDispatchNodeGetInfo (struct qemud_client *client, remote_message_header *req, void *args, remote_node_get_info_ret *ret); -static int remoteDispatchNumOfDefinedDomains (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_domains_ret *ret); -static int remoteDispatchNumOfDefinedNetworks (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_networks_ret *ret); -static int remoteDispatchNumOfDomains (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_domains_ret *ret); -static int remoteDispatchNumOfNetworks (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_networks_ret *ret); -static int remoteDispatchOpen (struct qemud_client *client, remote_message_header *req, remote_open_args *args, void *ret); -static int remoteDispatchSupportsFeature (struct qemud_client *client, remote_message_header *req, remote_supports_feature_args *args, remote_supports_feature_ret *ret); +static int remoteDispatchAuthList (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_auth_list_ret *ret); +static int remoteDispatchAuthSaslInit (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_auth_sasl_init_ret *ret); +static int remoteDispatchAuthSaslStart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret); +static int remoteDispatchAuthSaslStep (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret); +static int remoteDispatchClose (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, void *ret); +static int remoteDispatchDomainAttachDevice (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret); +static int remoteDispatchDomainBlockStats (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret); +static int remoteDispatchDomainCoreDump (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_core_dump_args *args, void *ret); +static int remoteDispatchDomainCreate (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_create_args *args, void *ret); +static int remoteDispatchDomainCreateLinux (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_create_linux_args *args, remote_domain_create_linux_ret *ret); +static int remoteDispatchDomainDefineXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_define_xml_args *args, remote_domain_define_xml_ret *ret); +static int remoteDispatchDomainDestroy (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_destroy_args *args, void *ret); +static int remoteDispatchDomainDetachDevice (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_detach_device_args *args, void *ret); +static int remoteDispatchDomainDumpXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_dump_xml_args *args, remote_domain_dump_xml_ret *ret); +static int remoteDispatchDomainGetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_autostart_args *args, remote_domain_get_autostart_ret *ret); +static int remoteDispatchDomainGetInfo (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_info_args *args, remote_domain_get_info_ret *ret); +static int remoteDispatchDomainGetMaxMemory (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_max_memory_args *args, remote_domain_get_max_memory_ret *ret); +static int remoteDispatchDomainGetMaxVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_max_vcpus_args *args, remote_domain_get_max_vcpus_ret *ret); +static int remoteDispatchDomainGetOsType (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_os_type_args *args, remote_domain_get_os_type_ret *ret); +static int remoteDispatchDomainGetSchedulerParameters (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_parameters_args *args, remote_domain_get_scheduler_parameters_ret *ret); +static int remoteDispatchDomainGetSchedulerType (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_type_args *args, remote_domain_get_scheduler_type_ret *ret); +static int remoteDispatchDomainGetVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_vcpus_args *args, remote_domain_get_vcpus_ret *ret); +static int remoteDispatchDomainInterfaceStats (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_interface_stats_args *args, remote_domain_interface_stats_ret *ret); +static int remoteDispatchDomainLookupById (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_id_args *args, remote_domain_lookup_by_id_ret *ret); +static int remoteDispatchDomainLookupByName (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_name_args *args, remote_domain_lookup_by_name_ret *ret); +static int remoteDispatchDomainLookupByUuid (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_uuid_args *args, remote_domain_lookup_by_uuid_ret *ret); +static int remoteDispatchDomainMigrateFinish (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_migrate_finish_args *args, remote_domain_migrate_finish_ret *ret); +static int remoteDispatchDomainMigratePerform (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_migrate_perform_args *args, void *ret); +static int remoteDispatchDomainMigratePrepare (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_migrate_prepare_args *args, remote_domain_migrate_prepare_ret *ret); +static int remoteDispatchDomainPinVcpu (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_pin_vcpu_args *args, void *ret); +static int remoteDispatchDomainReboot (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_reboot_args *args, void *ret); +static int remoteDispatchDomainRestore (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_restore_args *args, void *ret); +static int remoteDispatchDomainResume (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_resume_args *args, void *ret); +static int remoteDispatchDomainSave (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_save_args *args, void *ret); +static int remoteDispatchDomainSetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_autostart_args *args, void *ret); +static int remoteDispatchDomainSetMaxMemory (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_max_memory_args *args, void *ret); +static int remoteDispatchDomainSetMemory (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_memory_args *args, void *ret); +static int remoteDispatchDomainSetSchedulerParameters (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_scheduler_parameters_args *args, void *ret); +static int remoteDispatchDomainSetVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_vcpus_args *args, void *ret); +static int remoteDispatchDomainShutdown (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_shutdown_args *args, void *ret); +static int remoteDispatchDomainSuspend (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_suspend_args *args, void *ret); +static int remoteDispatchDomainUndefine (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_undefine_args *args, void *ret); +static int remoteDispatchGetCapabilities (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_capabilities_ret *ret); +static int remoteDispatchGetHostname (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_hostname_ret *ret); +static int remoteDispatchGetMaxVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_get_max_vcpus_args *args, remote_get_max_vcpus_ret *ret); +static int remoteDispatchGetType (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_type_ret *ret); +static int remoteDispatchGetVersion (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_version_ret *ret); +static int remoteDispatchListDefinedDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_defined_domains_args *args, remote_list_defined_domains_ret *ret); +static int remoteDispatchListDefinedNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_defined_networks_args *args, remote_list_defined_networks_ret *ret); +static int remoteDispatchListDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_domains_args *args, remote_list_domains_ret *ret); +static int remoteDispatchListNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_networks_args *args, remote_list_networks_ret *ret); +static int remoteDispatchNetworkCreate (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_create_args *args, void *ret); +static int remoteDispatchNetworkCreateXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_create_xml_args *args, remote_network_create_xml_ret *ret); +static int remoteDispatchNetworkDefineXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_define_xml_args *args, remote_network_define_xml_ret *ret); +static int remoteDispatchNetworkDestroy (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_destroy_args *args, void *ret); +static int remoteDispatchNetworkDumpXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_dump_xml_args *args, remote_network_dump_xml_ret *ret); +static int remoteDispatchNetworkGetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_get_autostart_args *args, remote_network_get_autostart_ret *ret); +static int remoteDispatchNetworkGetBridgeName (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_get_bridge_name_args *args, remote_network_get_bridge_name_ret *ret); +static int remoteDispatchNetworkLookupByName (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_name_args *args, remote_network_lookup_by_name_ret *ret); +static int remoteDispatchNetworkLookupByUuid (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_uuid_args *args, remote_network_lookup_by_uuid_ret *ret); +static int remoteDispatchNetworkSetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_set_autostart_args *args, void *ret); +static int remoteDispatchNetworkUndefine (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_undefine_args *args, void *ret); +static int remoteDispatchNodeGetInfo (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_node_get_info_ret *ret); +static int remoteDispatchNumOfDefinedDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_domains_ret *ret); +static int remoteDispatchNumOfDefinedNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_networks_ret *ret); +static int remoteDispatchNumOfDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_domains_ret *ret); +static int remoteDispatchNumOfNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_networks_ret *ret); +static int remoteDispatchOpen (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_open_args *args, void *ret); +static int remoteDispatchSupportsFeature (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_supports_feature_args *args, remote_supports_feature_ret *ret); diff -r f28fe18bd7f5 qemud/remote_generate_stubs.pl --- a/qemud/remote_generate_stubs.pl Thu Nov 29 09:47:39 2007 -0500 +++ b/qemud/remote_generate_stubs.pl Thu Nov 29 09:51:32 2007 -0500 @@ -93,7 +93,7 @@ elsif ($opt_i) { elsif ($opt_i) { my @keys = sort (keys %calls); foreach (@keys) { - print "static int remoteDispatch$calls{$_}->{ProcName} (struct qemud_client *client, remote_message_header *req, $calls{$_}->{args} *args, $calls{$_}->{ret} *ret);\n"; + print "static int remoteDispatch$calls{$_}->{ProcName} (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, $calls{$_}->{args} *args, $calls{$_}->{ret} *ret);\n"; } } @@ -196,7 +196,8 @@ elsif ($opt_s) { my $retvoid = $ret eq "void"; print "static int\n"; - print "remoteDispatch$calls{$_}->{ProcName} (struct qemud_client *client,\n"; + print "remoteDispatch$calls{$_}->{ProcName} (struct qemud_server *server,\n"; + print " struct qemud_client *client,\n"; print " remote_message_header *req,\n"; print " remote_get_max_vcpus_args *args,\n"; print " remote_get_max_vcpus_ret *ret)\n"; -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

This patch introduces the public & driver APIs for collecting auth credentials via a callback. This allows username/password based auth schemes to be used. This basically introduces a 3rd variant of the virConnectOpen call which takes a set of authentication parameters, and some flags. virConnectPtr virConnectOpenAuth (const char *name, virConnectAuthPtr auth, int flags); The flags parameter allows VIR_CONNECT_RO, so there is no need for a separate ReadOnly API. The 'auth' parameter is a small struct containing a list of credentials that the calling application knows how to collect, a function pointer for the callback, and an opaque data blob. struct _virConnectAuth { int *credtype; /* List of supported virConnectCredentialType values */ unsigned int ncredtype; virConnectAuthCallbackPtr cb; /* Callback used to collect credentials */ void *cbdata; }; At the very least apps should support the VIR_CRED_AUTHNAME and the VIR_CRED_PASSPHRASE credential types for collecting username+password respectively. There are a bunch of other credential type, but they're for fairly niche use cases. When the callback is invoked, it will be passed a list of virConnectCredentialPtr structs which contain details on all the credentials that the authentication mechanism needs to collect. They are passed all at once to make it easy to construct a big form in UI: typedef int (*virConnectAuthCallbackPtr)(virConnectCredentialPtr cred, unsigned int ncred, void *cbdata); The virConnectCredentialPtr struct contains a prompt which can be displayed in the UI. There may optionally be a challenge if doing a challenge/response type authentication. There may also be a default result. The application should collect a credential from the user & fill it into the 'result' field, or use the default result. If the callback returns 0, authentication will continue. If it returns -1, it will assume the user wants to cancel the auth process. Makefile.am | 2 docs/devhelp/libvirt-libvirt.html | 80 ++++++++++++- docs/devhelp/libvirt-virterror.html | 3 docs/libvirt-api.xml | 114 +++++++++++++++---- docs/libvirt-refs.xml | 210 ++++++++++++++++++++++++++++++++---- include/libvirt/libvirt.h.in | 72 ++++++++++++ proxy/libvirt_proxy.c | 4 qemud/remote.c | 2 src/driver.h | 10 - src/internal.h | 5 src/libvirt.c | 40 +++++- src/openvz_driver.c | 23 +++ src/proxy_internal.c | 9 + src/qemu_driver.c | 2 src/remote_internal.c | 22 ++- src/test.c | 2 src/xen_internal.c | 1 src/xen_internal.h | 1 src/xen_unified.c | 4 src/xend_internal.c | 6 - src/xend_internal.h | 2 src/xm_internal.c | 4 src/xm_internal.h | 2 src/xs_internal.c | 3 src/xs_internal.h | 1 25 files changed, 526 insertions(+), 98 deletions(-) diff -r ec2d8c632fd9 Makefile.am --- a/Makefile.am Wed Nov 28 15:00:45 2007 -0500 +++ b/Makefile.am Wed Nov 28 20:35:23 2007 -0500 @@ -1,6 +1,6 @@ ## Process this file with automake to produce Makefile.in -SUBDIRS = src qemud proxy include docs @PYTHON_SUBDIR@ tests po m4 scripts +SUBDIRS = include src qemud proxy docs @PYTHON_SUBDIR@ tests po m4 scripts ACLOCAL_AMFLAGS = -I m4 diff -r ec2d8c632fd9 docs/devhelp/libvirt-libvirt.html --- a/docs/devhelp/libvirt-libvirt.html Wed Nov 28 15:00:45 2007 -0500 +++ b/docs/devhelp/libvirt-libvirt.html Wed Nov 28 20:35:23 2007 -0500 @@ -61,19 +61,26 @@ typedef enum <a href="#virDomainState">v typedef enum <a href="#virDomainState">virDomainState</a>; typedef struct _virDomain <a href="#virDomain">virDomain</a>; typedef <a href="libvirt-libvirt.html#virDomainInterfaceStatsStruct">virDomainInterfaceStatsStruct</a> * <a href="#virDomainInterfaceStatsPtr">virDomainInterfaceStatsPtr</a>; +typedef <a href="libvirt-libvirt.html#virConnectAuth">virConnectAuth</a> * <a href="#virConnectAuthPtr">virConnectAuthPtr</a>; typedef enum <a href="#virSchedParameterType">virSchedParameterType</a>; -typedef <a href="libvirt-libvirt.html#virSchedParameter">virSchedParameter</a> * <a href="#virSchedParameterPtr">virSchedParameterPtr</a>; +typedef <a href="libvirt-libvirt.html#virConnectCredential">virConnectCredential</a> * <a href="#virConnectCredentialPtr">virConnectCredentialPtr</a>; typedef <a href="libvirt-libvirt.html#virNodeInfo">virNodeInfo</a> * <a href="#virNodeInfoPtr">virNodeInfoPtr</a>; typedef <a href="libvirt-libvirt.html#virNetwork">virNetwork</a> * <a href="#virNetworkPtr">virNetworkPtr</a>; typedef <a href="libvirt-libvirt.html#virDomainInfo">virDomainInfo</a> * <a href="#virDomainInfoPtr">virDomainInfoPtr</a>; typedef <a href="libvirt-libvirt.html#virConnect">virConnect</a> * <a href="#virConnectPtr">virConnectPtr</a>; typedef struct _virSchedParameter <a href="#virSchedParameter">virSchedParameter</a>; +typedef enum <a href="#virConnectFlags">virConnectFlags</a>; +typedef <a href="libvirt-libvirt.html#virSchedParameter">virSchedParameter</a> * <a href="#virSchedParameterPtr">virSchedParameterPtr</a>; typedef enum <a href="#virVcpuState">virVcpuState</a>; +typedef struct _virConnectAuth <a href="#virConnectAuth">virConnectAuth</a>; +typedef struct _virConnectCredential <a href="#virConnectCredential">virConnectCredential</a>; typedef <a href="libvirt-libvirt.html#virVcpuInfo">virVcpuInfo</a> * <a href="#virVcpuInfoPtr">virVcpuInfoPtr</a>; typedef enum <a href="#virDomainXMLFlags">virDomainXMLFlags</a>; typedef <a href="libvirt-libvirt.html#virDomain">virDomain</a> * <a href="#virDomainPtr">virDomainPtr</a>; +typedef enum <a href="#virConnectCredentialType">virConnectCredentialType</a>; typedef enum <a href="#virDomainCreateFlags">virDomainCreateFlags</a>; int <a href="#virDomainGetInfo">virDomainGetInfo</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> <a href="libvirt-libvirt.html#virDomainInfoPtr">virDomainInfoPtr</a> info); +int <a href="#virNetworkCreate">virNetworkCreate</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network); int <a href="#virNetworkFree">virNetworkFree</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network); const char * <a href="#virNetworkGetName">virNetworkGetName</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network); const char * <a href="#virDomainGetName">virDomainGetName</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain); @@ -88,6 +95,7 @@ int <a href="#virInitialize">virInitiali <a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> <a href="#virDomainLookupByName">virDomainLookupByName</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * name); <a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> <a href="#virNetworkLookupByUUID">virNetworkLookupByUUID</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const unsigned char * uuid); char * <a href="#virNetworkGetBridgeName">virNetworkGetBridgeName</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network); +char * <a href="#virNetworkGetXMLDesc">virNetworkGetXMLDesc</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network, <br/> int flags); int <a href="#virDomainPinVcpu">virDomainPinVcpu</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> unsigned int vcpu, <br/> unsigned char * cpumap, <br/> int maplen); int <a href="#virDomainRestore">virDomainRestore</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * from); const char * <a href="#virConnectGetType">virConnectGetType</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn); @@ -119,21 +127,20 @@ int <a href="#virDomainSetAutostart">vir int <a href="#virDomainSetAutostart">virDomainSetAutostart</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> int autostart); int <a href="#virDomainSuspend">virDomainSuspend</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain); int <a href="#virConnectGetMaxVcpus">virConnectGetMaxVcpus</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * type); +int <a href="#virConnectNumOfDefinedDomains">virConnectNumOfDefinedDomains</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn); <a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> <a href="#virNetworkGetConnect">virNetworkGetConnect</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> net); -int <a href="#virConnectNumOfDefinedDomains">virConnectNumOfDefinedDomains</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn); -<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> <a href="#virNetworkCreateXML">virNetworkCreateXML</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * xmlDesc); <a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> <a href="#virNetworkDefineXML">virNetworkDefineXML</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * xml); -int <a href="#virNetworkCreate">virNetworkCreate</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network); +<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> <a href="#virDomainLookupByID">virDomainLookupByID</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> int id); int <a href="#virDomainSetSchedulerParameters">virDomainSetSchedulerParameters</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> <a href="libvirt-libvirt.html#virSchedParameterPtr">virSchedParameterPtr</a> params, <br/> int nparams); int <a href="#virNodeGetCellsFreeMemory">virNodeGetCellsFreeMemory</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> unsigned long long * freeMems, <br/> int startCell, <br/> int maxCells); int <a href="#virConnectClose">virConnectClose</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn); int <a href="#virDomainReboot">virDomainReboot</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> unsigned int flags); int <a href="#virDomainBlockStats">virDomainBlockStats</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> dom, <br/> const char * path, <br/> <a href="libvirt-libvirt.html#virDomainBlockStatsPtr">virDomainBlockStatsPtr</a> stats, <br/> size_t size); int <a href="#virDomainSetVcpus">virDomainSetVcpus</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> unsigned int nvcpus); -<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> <a href="#virDomainLookupByID">virDomainLookupByID</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> int id); +<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> <a href="#virConnectOpenAuth">virConnectOpenAuth</a> (const char * name, <br/> <a href="libvirt-libvirt.html#virConnectAuthPtr">virConnectAuthPtr</a> auth, <br/> int flags); int <a href="#virNetworkGetUUIDString">virNetworkGetUUIDString</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network, <br/> char * buf); <a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> <a href="#virDomainMigrate">virDomainMigrate</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> <a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> dconn, <br/> unsigned long flags, <br/> const char * dname, <br/> const char * uri, <br/> unsigned long bandwidth); -char * <a href="#virNetworkGetXMLDesc">virNetworkGetXMLDesc</a> (<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> network, <br/> int flags); +<a href="libvirt-libvirt.html#virNetworkPtr">virNetworkPtr</a> <a href="#virNetworkCreateXML">virNetworkCreateXML</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * xmlDesc); unsigned int <a href="#virDomainGetID">virDomainGetID</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain); int <a href="#virDomainResume">virDomainResume</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain); <a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> <a href="#virDomainCreateLinux">virDomainCreateLinux</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> const char * xmlDesc, <br/> unsigned int flags); @@ -149,6 +156,7 @@ char * <a href="#virDomainGetXMLDesc">vi char * <a href="#virDomainGetXMLDesc">virDomainGetXMLDesc</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> int flags); int <a href="#virDomainSetMaxMemory">virDomainSetMaxMemory</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> domain, <br/> unsigned long memory); int <a href="#virDomainInterfaceStats">virDomainInterfaceStats</a> (<a href="libvirt-libvirt.html#virDomainPtr">virDomainPtr</a> dom, <br/> const char * path, <br/> <a href="libvirt-libvirt.html#virDomainInterfaceStatsPtr">virDomainInterfaceStatsPtr</a> stats, <br/> size_t size); +typedef int <a href="#virConnectAuthCallbackPtr">virConnectAuthCallbackPtr</a> (<a href="libvirt-libvirt.html#virConnectCredentialPtr">virConnectCredentialPtr</a> cred, <br/> unsigned int ncred, <br/> void * cbdata); int <a href="#virConnectGetVersion">virConnectGetVersion</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> unsigned long * hvVer); int <a href="#virConnectListNetworks">virConnectListNetworks</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn, <br/> char ** const names, <br/> int maxnames); char * <a href="#virConnectGetURI">virConnectGetURI</a> (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn); @@ -212,6 +220,54 @@ The content of this structure is not mad </pre><p/> </div> <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectAuth">Structure </a>virConnectAuth</h3><pre class="programlisting">struct _virConnectAuth { + int * credtype : List of supported <a href="libvirt-libvirt.html#virConnectCredentialType">virConnectCredentialType</a> values + unsigned int ncredtype + <a href="libvirt-libvirt.html#virConnectAuthCallbackPtr">virConnectAuthCallbackPtr</a> cb : Callback used to collect credentials + void * cbdata +} virConnectAuth; +</pre><p/> +</div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectAuthPtr">Typedef </a>virConnectAuthPtr</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectAuth">virConnectAuth</a> * virConnectAuthPtr; +</pre><p/> +</div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectCredential">Structure </a>virConnectCredential</h3><pre class="programlisting">struct _virConnectCredential { + int type : One of <a href="libvirt-libvirt.html#virConnectCredentialType">virConnectCredentialType</a> constants + const char * prompt : Prompt to show to user + const char * challenge : Additional challenge to show + const char * defresult : Optional default result + char * result : Result to be filled with user response (or defresult) + unsigned int resultlen : Length of the result +} virConnectCredential; +</pre><p/> +</div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectCredentialPtr">Typedef </a>virConnectCredentialPtr</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectCredential">virConnectCredential</a> * virConnectCredentialPtr; +</pre><p/> +</div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectCredentialType">Enum </a>virConnectCredentialType</h3><pre class="programlisting">enum <a href="#virConnectCredentialType">virConnectCredentialType</a> { + <a name="VIR_CRED_USERNAME">VIR_CRED_USERNAME</a> = 1 /* Identity to act as */ + <a name="VIR_CRED_AUTHNAME">VIR_CRED_AUTHNAME</a> = 2 /* Identify to authorize as */ + <a name="VIR_CRED_LANGUAGE">VIR_CRED_LANGUAGE</a> = 3 /* RFC 1766 languages, comma separated */ + <a name="VIR_CRED_CNONCE">VIR_CRED_CNONCE</a> = 4 /* client supplies a nonce */ + <a name="VIR_CRED_PASSPHRASE">VIR_CRED_PASSPHRASE</a> = 5 /* Passphrase secret */ + <a name="VIR_CRED_ECHOPROMPT">VIR_CRED_ECHOPROMPT</a> = 6 /* Challenge response */ + <a name="VIR_CRED_NOECHOPROMPT">VIR_CRED_NOECHOPROMPT</a> = 7 /* Challenge response */ + <a name="VIR_CRED_REALM">VIR_CRED_REALM</a> = 8 /* Authentication realm */ + <a name="VIR_CRED_EXTERNAL">VIR_CRED_EXTERNAL</a> = 9 /* Externally managed credential More may be added - expect the unexpected */ +}; +</pre><p/> +</div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectFlags">Enum </a>virConnectFlags</h3><pre class="programlisting">enum <a href="#virConnectFlags">virConnectFlags</a> { + <a name="VIR_CONNECT_RO">VIR_CONNECT_RO</a> = 1 /* A readonly connection */ +}; +</pre><p/> +</div> + <hr/> <div class="refsect2" lang="en"><h3><a name="virConnectPtr">Typedef </a>virConnectPtr</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnect">virConnect</a> * virConnectPtr; </pre><p>a <a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> is pointer to a <a href="libvirt-libvirt.html#virConnect">virConnect</a> private structure, this is the type used to reference a connection to the Xen Hypervisor in the API.</p> </div> @@ -372,6 +428,14 @@ The content of this structure is not mad </pre><p/> </div> <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectAuthCallbackPtr"/>Function type virConnectAuthCallbackPtr</h3><pre class="programlisting">int virConnectAuthCallbackPtr (<a href="libvirt-libvirt.html#virConnectCredentialPtr">virConnectCredentialPtr</a> cred, <br/> unsigned int ncred, <br/> void * cbdata)<br/> +</pre><p/> +<div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>cred</tt></i>:</span></td><td/></tr><tr><td><span class="term"><i><tt>ncred</tt></i>:</span></td><td/></tr><tr><td><span class="term"><i><tt>cbdata</tt></i>:</span></td><td/></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td/></tr></tbody></table></div></div> + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectAuthPtrDefault">Variable </a>virConnectAuthPtrDefault</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectAuthPtr">virConnectAuthPtr</a> virConnectAuthPtrDefault; +</pre><p/> +</div> + <hr/> <div class="refsect2" lang="en"><h3><a name="virConnectClose"/>virConnectClose ()</h3><pre class="programlisting">int virConnectClose (<a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> conn)<br/> </pre><p>This function closes the connection to the Hypervisor. This should not be called if further interaction with the Hypervisor are needed especially if there is running domain which need further monitoring by the application.</p> <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>conn</tt></i>:</span></td><td>pointer to the hypervisor connection</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>0 in case of success or -1 in case of error.</td></tr></tbody></table></div></div> @@ -435,6 +499,10 @@ The content of this structure is not mad <div class="refsect2" lang="en"><h3><a name="virConnectOpen"/>virConnectOpen ()</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> virConnectOpen (const char * name)<br/> </pre><p>This function should be called first to get a connection to the Hypervisor and xen store</p> <div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>name</tt></i>:</span></td><td>URI of the hypervisor</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>a pointer to the hypervisor connection or NULL in case of error URIs are documented at http://libvirt.org/uri.html</td></tr></tbody></table... + <hr/> + <div class="refsect2" lang="en"><h3><a name="virConnectOpenAuth"/>virConnectOpenAuth ()</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> virConnectOpenAuth (const char * name, <br/> <a href="libvirt-libvirt.html#virConnectAuthPtr">virConnectAuthPtr</a> auth, <br/> int flags)<br/> +</pre><p>This function should be called first to get a connection to the Hypervisor. If neccessary, authentication will be performed fetching credentials via the callback</p> +<div class="variablelist"><table border="0"><col align="left"/><tbody><tr><td><span class="term"><i><tt>name</tt></i>:</span></td><td>URI of the hypervisor</td></tr><tr><td><span class="term"><i><tt>auth</tt></i>:</span></td><td>Authenticate callback parameters</td></tr><tr><td><span class="term"><i><tt>flags</tt></i>:</span></td><td>Open flags</td></tr><tr><td><span class="term"><i><tt>Returns</tt></i>:</span></td><td>a pointer to the hypervisor connection or NULL in case of error URIs are documented at http://libvirt.org/uri.html</td></tr></tbody></table... <hr/> <div class="refsect2" lang="en"><h3><a name="virConnectOpenReadOnly"/>virConnectOpenReadOnly ()</h3><pre class="programlisting"><a href="libvirt-libvirt.html#virConnectPtr">virConnectPtr</a> virConnectOpenReadOnly (const char * name)<br/> </pre><p>This function should be called first to get a restricted connection to the libbrary functionalities. The set of APIs usable are then restricted on the available methods to control the domains.</p> diff -r ec2d8c632fd9 docs/devhelp/libvirt-virterror.html --- a/docs/devhelp/libvirt-virterror.html Wed Nov 28 15:00:45 2007 -0500 +++ b/docs/devhelp/libvirt-virterror.html Wed Nov 28 20:35:23 2007 -0500 @@ -154,7 +154,8 @@ void <a href="#virConnResetLastError">vi <a name="VIR_WAR_NO_NETWORK">VIR_WAR_NO_NETWORK</a> = 41 /* failed to start network */ <a name="VIR_ERR_NO_DOMAIN">VIR_ERR_NO_DOMAIN</a> = 42 /* domain not found or unexpectedly disappeared */ <a name="VIR_ERR_NO_NETWORK">VIR_ERR_NO_NETWORK</a> = 43 /* network not found */ - <a name="VIR_ERR_INVALID_MAC">VIR_ERR_INVALID_MAC</a> = 44 /* invalid MAC adress */ + <a name="VIR_ERR_INVALID_MAC">VIR_ERR_INVALID_MAC</a> = 44 /* invalid MAC adress */ + <a name="VIR_ERR_AUTH_FAILED">VIR_ERR_AUTH_FAILED</a> = 45 /* authentication failed */ }; </pre><p/> </div> diff -r ec2d8c632fd9 docs/libvirt-api.xml --- a/docs/libvirt-api.xml Wed Nov 28 15:00:45 2007 -0500 +++ b/docs/libvirt-api.xml Wed Nov 28 20:35:23 2007 -0500 @@ -16,26 +16,36 @@ <exports symbol='VIR_UUID_STRING_BUFLEN' type='macro'/> <exports symbol='VIR_GET_CPUMAP' type='macro'/> <exports symbol='VIR_UNUSE_CPU' type='macro'/> + <exports symbol='VIR_CRED_EXTERNAL' type='enum'/> + <exports symbol='VIR_DOMAIN_SHUTDOWN' type='enum'/> + <exports symbol='VIR_DOMAIN_SCHED_FIELD_UINT' type='enum'/> + <exports symbol='VIR_CRED_CNONCE' type='enum'/> + <exports symbol='VIR_CRED_ECHOPROMPT' type='enum'/> + <exports symbol='VIR_DOMAIN_SCHED_FIELD_DOUBLE' type='enum'/> + <exports symbol='VIR_DOMAIN_SCHED_FIELD_LLONG' type='enum'/> + <exports symbol='VIR_CONNECT_RO' type='enum'/> + <exports symbol='VIR_CRED_AUTHNAME' type='enum'/> + <exports symbol='VIR_CRED_LANGUAGE' type='enum'/> + <exports symbol='VIR_CRED_NOECHOPROMPT' type='enum'/> + <exports symbol='VIR_DOMAIN_SCHED_FIELD_BOOLEAN' type='enum'/> + <exports symbol='VIR_MIGRATE_LIVE' type='enum'/> + <exports symbol='VIR_CRED_USERNAME' type='enum'/> + <exports symbol='VIR_VCPU_OFFLINE' type='enum'/> + <exports symbol='VIR_DOMAIN_RUNNING' type='enum'/> + <exports symbol='VIR_DOMAIN_BLOCKED' type='enum'/> <exports symbol='VIR_DOMAIN_SHUTOFF' type='enum'/> - <exports symbol='VIR_DOMAIN_SCHED_FIELD_DOUBLE' type='enum'/> + <exports symbol='VIR_VCPU_BLOCKED' type='enum'/> + <exports symbol='VIR_DOMAIN_SCHED_FIELD_INT' type='enum'/> <exports symbol='VIR_DOMAIN_SCHED_FIELD_ULLONG' type='enum'/> - <exports symbol='VIR_VCPU_OFFLINE' type='enum'/> + <exports symbol='VIR_CRED_REALM' type='enum'/> + <exports symbol='VIR_VCPU_RUNNING' type='enum'/> + <exports symbol='VIR_DOMAIN_PAUSED' type='enum'/> + <exports symbol='VIR_DOMAIN_CRASHED' type='enum'/> <exports symbol='VIR_DOMAIN_XML_INACTIVE' type='enum'/> - <exports symbol='VIR_DOMAIN_SCHED_FIELD_BOOLEAN' type='enum'/> - <exports symbol='VIR_DOMAIN_SCHED_FIELD_UINT' type='enum'/> - <exports symbol='VIR_MIGRATE_LIVE' type='enum'/> - <exports symbol='VIR_DOMAIN_SCHED_FIELD_INT' type='enum'/> - <exports symbol='VIR_VCPU_RUNNING' type='enum'/> - <exports symbol='VIR_DOMAIN_CRASHED' type='enum'/> <exports symbol='VIR_DOMAIN_NONE' type='enum'/> - <exports symbol='VIR_DOMAIN_SHUTDOWN' type='enum'/> - <exports symbol='VIR_VCPU_BLOCKED' type='enum'/> <exports symbol='VIR_DOMAIN_NOSTATE' type='enum'/> - <exports symbol='VIR_DOMAIN_PAUSED' type='enum'/> - <exports symbol='VIR_DOMAIN_SCHED_FIELD_LLONG' type='enum'/> - <exports symbol='VIR_DOMAIN_RUNNING' type='enum'/> + <exports symbol='VIR_CRED_PASSPHRASE' type='enum'/> <exports symbol='VIR_DOMAIN_XML_SECURE' type='enum'/> - <exports symbol='VIR_DOMAIN_BLOCKED' type='enum'/> <exports symbol='virDomainBlockStatsStruct' type='typedef'/> <exports symbol='virDomainMigrateFlags' type='typedef'/> <exports symbol='virNodeInfo' type='typedef'/> @@ -48,25 +58,35 @@ <exports symbol='virDomainState' type='typedef'/> <exports symbol='virDomain' type='typedef'/> <exports symbol='virDomainInterfaceStatsPtr' type='typedef'/> + <exports symbol='virConnectAuthPtr' type='typedef'/> <exports symbol='virSchedParameterType' type='typedef'/> - <exports symbol='virSchedParameterPtr' type='typedef'/> + <exports symbol='virConnectCredentialPtr' type='typedef'/> <exports symbol='virNodeInfoPtr' type='typedef'/> <exports symbol='virNetworkPtr' type='typedef'/> <exports symbol='virDomainInfoPtr' type='typedef'/> <exports symbol='virConnectPtr' type='typedef'/> <exports symbol='virSchedParameter' type='typedef'/> + <exports symbol='virConnectFlags' type='typedef'/> + <exports symbol='virSchedParameterPtr' type='typedef'/> <exports symbol='virVcpuState' type='typedef'/> + <exports symbol='virConnectAuth' type='typedef'/> + <exports symbol='virConnectCredential' type='typedef'/> <exports symbol='virVcpuInfoPtr' type='typedef'/> <exports symbol='virDomainXMLFlags' type='typedef'/> <exports symbol='virDomainPtr' type='typedef'/> + <exports symbol='virConnectCredentialType' type='typedef'/> <exports symbol='virDomainCreateFlags' type='typedef'/> <exports symbol='_virDomainInfo' type='struct'/> + <exports symbol='_virConnectAuth' type='struct'/> + <exports symbol='_virVcpuInfo' type='struct'/> <exports symbol='_virDomainInterfaceStats' type='struct'/> - <exports symbol='_virVcpuInfo' type='struct'/> - <exports symbol='_virSchedParameter' type='struct'/> + <exports symbol='_virConnectCredential' type='struct'/> <exports symbol='_virDomainBlockStats' type='struct'/> <exports symbol='_virNodeInfo' type='struct'/> + <exports symbol='_virSchedParameter' type='struct'/> + <exports symbol='virConnectAuthPtrDefault' type='variable'/> <exports symbol='virDomainGetInfo' type='function'/> + <exports symbol='virNetworkCreate' type='function'/> <exports symbol='virNetworkFree' type='function'/> <exports symbol='virNetworkGetName' type='function'/> <exports symbol='virDomainGetName' type='function'/> @@ -81,6 +101,7 @@ <exports symbol='virDomainLookupByName' type='function'/> <exports symbol='virNetworkLookupByUUID' type='function'/> <exports symbol='virNetworkGetBridgeName' type='function'/> + <exports symbol='virNetworkGetXMLDesc' type='function'/> <exports symbol='virDomainPinVcpu' type='function'/> <exports symbol='virDomainRestore' type='function'/> <exports symbol='virConnectGetType' type='function'/> @@ -112,21 +133,20 @@ <exports symbol='virDomainSetAutostart' type='function'/> <exports symbol='virDomainSuspend' type='function'/> <exports symbol='virConnectGetMaxVcpus' type='function'/> + <exports symbol='virConnectNumOfDefinedDomains' type='function'/> <exports symbol='virNetworkGetConnect' type='function'/> - <exports symbol='virConnectNumOfDefinedDomains' type='function'/> - <exports symbol='virNetworkCreateXML' type='function'/> <exports symbol='virNetworkDefineXML' type='function'/> - <exports symbol='virNetworkCreate' type='function'/> + <exports symbol='virDomainLookupByID' type='function'/> <exports symbol='virDomainSetSchedulerParameters' type='function'/> <exports symbol='virNodeGetCellsFreeMemory' type='function'/> <exports symbol='virConnectClose' type='function'/> <exports symbol='virDomainReboot' type='function'/> <exports symbol='virDomainBlockStats' type='function'/> <exports symbol='virDomainSetVcpus' type='function'/> - <exports symbol='virDomainLookupByID' type='function'/> + <exports symbol='virConnectOpenAuth' type='function'/> <exports symbol='virNetworkGetUUIDString' type='function'/> <exports symbol='virDomainMigrate' type='function'/> - <exports symbol='virNetworkGetXMLDesc' type='function'/> + <exports symbol='virNetworkCreateXML' type='function'/> <exports symbol='virDomainGetID' type='function'/> <exports symbol='virDomainResume' type='function'/> <exports symbol='virDomainCreateLinux' type='function'/> @@ -142,6 +162,7 @@ <exports symbol='virDomainGetXMLDesc' type='function'/> <exports symbol='virDomainSetMaxMemory' type='function'/> <exports symbol='virDomainInterfaceStats' type='function'/> + <exports symbol='virConnectAuthCallbackPtr' type='function'/> <exports symbol='virConnectGetVersion' type='function'/> <exports symbol='virConnectListNetworks' type='function'/> <exports symbol='virConnectGetURI' type='function'/> @@ -159,6 +180,7 @@ <exports symbol='VIR_ERR_WARNING' type='enum'/> <exports symbol='VIR_FROM_OPENVZ' type='enum'/> <exports symbol='VIR_ERR_NO_XEN' type='enum'/> + <exports symbol='VIR_FROM_STATS_LINUX' type='enum'/> <exports symbol='VIR_ERR_INVALID_ARG' type='enum'/> <exports symbol='VIR_ERR_ERROR' type='enum'/> <exports symbol='VIR_ERR_NO_OS' type='enum'/> @@ -176,7 +198,7 @@ <exports symbol='VIR_FROM_QEMU' type='enum'/> <exports symbol='VIR_FROM_CONF' type='enum'/> <exports symbol='VIR_ERR_INVALID_NETWORK' type='enum'/> - <exports symbol='VIR_FROM_STATS_LINUX' type='enum'/> + <exports symbol='VIR_ERR_AUTH_FAILED' type='enum'/> <exports symbol='VIR_ERR_OPERATION_DENIED' type='enum'/> <exports symbol='VIR_ERR_NO_KERNEL' type='enum'/> <exports symbol='VIR_ERR_GNUTLS_ERROR' type='enum'/> @@ -287,6 +309,16 @@ <macro name='VIR_UUID_STRING_BUFLEN' file='libvirt'> <info>This macro provides the length of the buffer required for virDomainGetUUIDString()</info> </macro> + <enum name='VIR_CONNECT_RO' file='libvirt' value='1' type='virConnectFlags' info=' A readonly connection'/> + <enum name='VIR_CRED_AUTHNAME' file='libvirt' value='2' type='virConnectCredentialType' info='Identify to authorize as'/> + <enum name='VIR_CRED_CNONCE' file='libvirt' value='4' type='virConnectCredentialType' info='client supplies a nonce'/> + <enum name='VIR_CRED_ECHOPROMPT' file='libvirt' value='6' type='virConnectCredentialType' info='Challenge response'/> + <enum name='VIR_CRED_EXTERNAL' file='libvirt' value='9' type='virConnectCredentialType' info=' Externally managed credential More may be added - expect the unexpected'/> + <enum name='VIR_CRED_LANGUAGE' file='libvirt' value='3' type='virConnectCredentialType' info='RFC 1766 languages, comma separated'/> + <enum name='VIR_CRED_NOECHOPROMPT' file='libvirt' value='7' type='virConnectCredentialType' info='Challenge response'/> + <enum name='VIR_CRED_PASSPHRASE' file='libvirt' value='5' type='virConnectCredentialType' info='Passphrase secret'/> + <enum name='VIR_CRED_REALM' file='libvirt' value='8' type='virConnectCredentialType' info='Authentication realm'/> + <enum name='VIR_CRED_USERNAME' file='libvirt' value='1' type='virConnectCredentialType' info='Identity to act as'/> <enum name='VIR_DOMAIN_BLOCKED' file='libvirt' value='2' type='virDomainState' info='the domain is blocked on resource'/> <enum name='VIR_DOMAIN_CRASHED' file='libvirt' value='6' type='virDomainState' info=' the domain is crashed'/> <enum name='VIR_DOMAIN_NONE' file='libvirt' value='0' type='virDomainCreateFlags'/> @@ -303,6 +335,7 @@ <enum name='VIR_DOMAIN_SHUTOFF' file='libvirt' value='5' type='virDomainState' info='the domain is shut off'/> <enum name='VIR_DOMAIN_XML_INACTIVE' file='libvirt' value='2' type='virDomainXMLFlags' info=' dump inactive domain informations'/> <enum name='VIR_DOMAIN_XML_SECURE' file='libvirt' value='1' type='virDomainXMLFlags' info='dump security sensitive informations too'/> + <enum name='VIR_ERR_AUTH_FAILED' file='virterror' value='45' type='virErrorNumber' info=' authentication failed'/> <enum name='VIR_ERR_CALL_FAILED' file='virterror' value='26' type='virErrorNumber' info='not supported by the drivers (DEPRECATED)'/> <enum name='VIR_ERR_CONF_SYNTAX' file='virterror' value='33' type='virErrorNumber' info='failed to parse the syntax of a conf file'/> <enum name='VIR_ERR_DOM_EXIST' file='virterror' value='28' type='virErrorNumber' info='the domain already exist'/> @@ -315,7 +348,7 @@ <enum name='VIR_ERR_INVALID_ARG' file='virterror' value='8' type='virErrorNumber' info='invalid function argument'/> <enum name='VIR_ERR_INVALID_CONN' file='virterror' value='6' type='virErrorNumber' info='invalid connection object'/> <enum name='VIR_ERR_INVALID_DOMAIN' file='virterror' value='7' type='virErrorNumber' info='invalid domain object'/> - <enum name='VIR_ERR_INVALID_MAC' file='virterror' value='44' type='virErrorNumber' info=' invalid MAC adress'/> + <enum name='VIR_ERR_INVALID_MAC' file='virterror' value='44' type='virErrorNumber' info='invalid MAC adress'/> <enum name='VIR_ERR_INVALID_NETWORK' file='virterror' value='36' type='virErrorNumber' info='invalid network object'/> <enum name='VIR_ERR_NETWORK_EXIST' file='virterror' value='37' type='virErrorNumber' info='the network already exist'/> <enum name='VIR_ERR_NONE' file='virterror' value='0' type='virErrorLevel'/> @@ -373,6 +406,24 @@ <enum name='VIR_VCPU_RUNNING' file='libvirt' value='1' type='virVcpuState' info='the virtual CPU is running'/> <enum name='VIR_WAR_NO_NETWORK' file='virterror' value='41' type='virErrorNumber' info='failed to start network'/> <struct name='virConnect' file='libvirt' type='struct _virConnect'/> + <struct name='virConnectAuth' file='libvirt' type='struct _virConnectAuth'> + <field name='credtype' type='int *' info=' List of supported virConnectCredentialType values'/> + <field name='ncredtype' type='unsigned int' info=''/> + <field name='cb' type='virConnectAuthCallbackPtr' info=' Callback used to collect credentials'/> + <field name='cbdata' type='void *' info=''/> + </struct> + <typedef name='virConnectAuthPtr' file='libvirt' type='virConnectAuth *'/> + <struct name='virConnectCredential' file='libvirt' type='struct _virConnectCredential'> + <field name='type' type='int' info=' One of virConnectCredentialType constants'/> + <field name='prompt' type='const char *' info=' Prompt to show to user'/> + <field name='challenge' type='const char *' info=' Additional challenge to show'/> + <field name='defresult' type='const char *' info=' Optional default result'/> + <field name='result' type='char *' info=' Result to be filled with user response (or defresult)'/> + <field name='resultlen' type='unsigned int' info=' Length of the result'/> + </struct> + <typedef name='virConnectCredentialPtr' file='libvirt' type='virConnectCredential *'/> + <typedef name='virConnectCredentialType' file='libvirt' type='enum'/> + <typedef name='virConnectFlags' file='libvirt' type='enum'/> <typedef name='virConnectPtr' file='libvirt' type='virConnect *'> <info>a virConnectPtr is pointer to a virConnect private structure, this is the type used to reference a connection to the Xen Hypervisor in the API.</info> </typedef> @@ -468,6 +519,7 @@ </struct> <typedef name='virVcpuInfoPtr' file='libvirt' type='virVcpuInfo *'/> <typedef name='virVcpuState' file='libvirt' type='enum'/> + <variable name='virConnectAuthPtrDefault' file='libvirt' type='virConnectAuthPtr'/> <function name='virConnCopyLastError' file='virterror' module='virterror'> <info>Copy the content of the last error caught on that connection One will need to free the result with virResetError()</info> <return type='int' info='0 if no error was found and the error code otherwise and -1 in case of parameter error.'/> @@ -491,6 +543,13 @@ <arg name='userData' type='void *' info='pointer to the user data provided in the handler callback'/> <arg name='handler' type='virErrorFunc' info='the function to get called in case of error or NULL'/> </function> + <functype name='virConnectAuthCallbackPtr' file='libvirt' module='libvirt'> + <info></info> + <return type='int' info=''/> + <arg name='cred' type='virConnectCredentialPtr' info=''/> + <arg name='ncred' type='unsigned int' info=''/> + <arg name='cbdata' type='void *' info=''/> + </functype> <function name='virConnectClose' file='libvirt' module='libvirt'> <info>This function closes the connection to the Hypervisor. This should not be called if further interaction with the Hypervisor are needed especially if there is running domain which need further monitoring by the application.</info> <return type='int' info='0 in case of success or -1 in case of error.'/> @@ -580,6 +639,13 @@ <info>This function should be called first to get a connection to the Hypervisor and xen store</info> <return type='virConnectPtr' info='a pointer to the hypervisor connection or NULL in case of error URIs are documented at http://libvirt.org/uri.html'/> <arg name='name' type='const char *' info='URI of the hypervisor'/> + </function> + <function name='virConnectOpenAuth' file='libvirt' module='libvirt'> + <info>This function should be called first to get a connection to the Hypervisor. If neccessary, authentication will be performed fetching credentials via the callback</info> + <return type='virConnectPtr' info='a pointer to the hypervisor connection or NULL in case of error URIs are documented at http://libvirt.org/uri.html'/> + <arg name='name' type='const char *' info='URI of the hypervisor'/> + <arg name='auth' type='virConnectAuthPtr' info='Authenticate callback parameters'/> + <arg name='flags' type='int' info='Open flags'/> </function> <function name='virConnectOpenReadOnly' file='libvirt' module='libvirt'> <info>This function should be called first to get a restricted connection to the libbrary functionalities. The set of APIs usable are then restricted on the available methods to control the domains.</info> diff -r ec2d8c632fd9 docs/libvirt-refs.xml --- a/docs/libvirt-refs.xml Wed Nov 28 15:00:45 2007 -0500 +++ b/docs/libvirt-refs.xml Wed Nov 28 20:35:23 2007 -0500 @@ -2,9 +2,19 @@ <apirefs name='libvirt'> <references> <reference name='LIBVIR_VERSION_NUMBER' href='html/libvirt-libvirt.html#LIBVIR_VERSION_NUMBER'/> + <reference name='VIR_CONNECT_RO' href='html/libvirt-libvirt.html#VIR_CONNECT_RO'/> <reference name='VIR_COPY_CPUMAP' href='html/libvirt-libvirt.html#VIR_COPY_CPUMAP'/> <reference name='VIR_CPU_MAPLEN' href='html/libvirt-libvirt.html#VIR_CPU_MAPLEN'/> <reference name='VIR_CPU_USABLE' href='html/libvirt-libvirt.html#VIR_CPU_USABLE'/> + <reference name='VIR_CRED_AUTHNAME' href='html/libvirt-libvirt.html#VIR_CRED_AUTHNAME'/> + <reference name='VIR_CRED_CNONCE' href='html/libvirt-libvirt.html#VIR_CRED_CNONCE'/> + <reference name='VIR_CRED_ECHOPROMPT' href='html/libvirt-libvirt.html#VIR_CRED_ECHOPROMPT'/> + <reference name='VIR_CRED_EXTERNAL' href='html/libvirt-libvirt.html#VIR_CRED_EXTERNAL'/> + <reference name='VIR_CRED_LANGUAGE' href='html/libvirt-libvirt.html#VIR_CRED_LANGUAGE'/> + <reference name='VIR_CRED_NOECHOPROMPT' href='html/libvirt-libvirt.html#VIR_CRED_NOECHOPROMPT'/> + <reference name='VIR_CRED_PASSPHRASE' href='html/libvirt-libvirt.html#VIR_CRED_PASSPHRASE'/> + <reference name='VIR_CRED_REALM' href='html/libvirt-libvirt.html#VIR_CRED_REALM'/> + <reference name='VIR_CRED_USERNAME' href='html/libvirt-libvirt.html#VIR_CRED_USERNAME'/> <reference name='VIR_DOMAIN_BLOCKED' href='html/libvirt-libvirt.html#VIR_DOMAIN_BLOCKED'/> <reference name='VIR_DOMAIN_CRASHED' href='html/libvirt-libvirt.html#VIR_DOMAIN_CRASHED'/> <reference name='VIR_DOMAIN_NONE' href='html/libvirt-libvirt.html#VIR_DOMAIN_NONE'/> @@ -22,6 +32,7 @@ <reference name='VIR_DOMAIN_SHUTOFF' href='html/libvirt-libvirt.html#VIR_DOMAIN_SHUTOFF'/> <reference name='VIR_DOMAIN_XML_INACTIVE' href='html/libvirt-libvirt.html#VIR_DOMAIN_XML_INACTIVE'/> <reference name='VIR_DOMAIN_XML_SECURE' href='html/libvirt-libvirt.html#VIR_DOMAIN_XML_SECURE'/> + <reference name='VIR_ERR_AUTH_FAILED' href='html/libvirt-virterror.html#VIR_ERR_AUTH_FAILED'/> <reference name='VIR_ERR_CALL_FAILED' href='html/libvirt-virterror.html#VIR_ERR_CALL_FAILED'/> <reference name='VIR_ERR_CONF_SYNTAX' href='html/libvirt-virterror.html#VIR_ERR_CONF_SYNTAX'/> <reference name='VIR_ERR_DOM_EXIST' href='html/libvirt-virterror.html#VIR_ERR_DOM_EXIST'/> @@ -97,6 +108,8 @@ <reference name='VIR_VCPU_OFFLINE' href='html/libvirt-libvirt.html#VIR_VCPU_OFFLINE'/> <reference name='VIR_VCPU_RUNNING' href='html/libvirt-libvirt.html#VIR_VCPU_RUNNING'/> <reference name='VIR_WAR_NO_NETWORK' href='html/libvirt-virterror.html#VIR_WAR_NO_NETWORK'/> + <reference name='_virConnectAuth' href='html/libvirt-libvirt.html#_virConnectAuth'/> + <reference name='_virConnectCredential' href='html/libvirt-libvirt.html#_virConnectCredential'/> <reference name='_virDomainBlockStats' href='html/libvirt-libvirt.html#_virDomainBlockStats'/> <reference name='_virDomainInfo' href='html/libvirt-libvirt.html#_virDomainInfo'/> <reference name='_virDomainInterfaceStats' href='html/libvirt-libvirt.html#_virDomainInterfaceStats'/> @@ -109,7 +122,15 @@ <reference name='virConnResetLastError' href='html/libvirt-virterror.html#virConnResetLastError'/> <reference name='virConnSetErrorFunc' href='html/libvirt-virterror.html#virConnSetErrorFunc'/> <reference name='virConnect' href='html/libvirt-libvirt.html#virConnect'/> + <reference name='virConnectAuth' href='html/libvirt-libvirt.html#virConnectAuth'/> + <reference name='virConnectAuthCallbackPtr' href='html/libvirt-libvirt.html#virConnectAuthCallbackPtr'/> + <reference name='virConnectAuthPtr' href='html/libvirt-libvirt.html#virConnectAuthPtr'/> + <reference name='virConnectAuthPtrDefault' href='html/libvirt-libvirt.html#virConnectAuthPtrDefault'/> <reference name='virConnectClose' href='html/libvirt-libvirt.html#virConnectClose'/> + <reference name='virConnectCredential' href='html/libvirt-libvirt.html#virConnectCredential'/> + <reference name='virConnectCredentialPtr' href='html/libvirt-libvirt.html#virConnectCredentialPtr'/> + <reference name='virConnectCredentialType' href='html/libvirt-libvirt.html#virConnectCredentialType'/> + <reference name='virConnectFlags' href='html/libvirt-libvirt.html#virConnectFlags'/> <reference name='virConnectGetCapabilities' href='html/libvirt-libvirt.html#virConnectGetCapabilities'/> <reference name='virConnectGetHostname' href='html/libvirt-libvirt.html#virConnectGetHostname'/> <reference name='virConnectGetMaxVcpus' href='html/libvirt-libvirt.html#virConnectGetMaxVcpus'/> @@ -125,6 +146,7 @@ <reference name='virConnectNumOfDomains' href='html/libvirt-libvirt.html#virConnectNumOfDomains'/> <reference name='virConnectNumOfNetworks' href='html/libvirt-libvirt.html#virConnectNumOfNetworks'/> <reference name='virConnectOpen' href='html/libvirt-libvirt.html#virConnectOpen'/> + <reference name='virConnectOpenAuth' href='html/libvirt-libvirt.html#virConnectOpenAuth'/> <reference name='virConnectOpenReadOnly' href='html/libvirt-libvirt.html#virConnectOpenReadOnly'/> <reference name='virConnectPtr' href='html/libvirt-libvirt.html#virConnectPtr'/> <reference name='virCopyLastError' href='html/libvirt-virterror.html#virCopyLastError'/> @@ -231,9 +253,19 @@ <ref name='LIBVIR_VERSION_NUMBER'/> </letter> <letter name='V'> + <ref name='VIR_CONNECT_RO'/> <ref name='VIR_COPY_CPUMAP'/> <ref name='VIR_CPU_MAPLEN'/> <ref name='VIR_CPU_USABLE'/> + <ref name='VIR_CRED_AUTHNAME'/> + <ref name='VIR_CRED_CNONCE'/> + <ref name='VIR_CRED_ECHOPROMPT'/> + <ref name='VIR_CRED_EXTERNAL'/> + <ref name='VIR_CRED_LANGUAGE'/> + <ref name='VIR_CRED_NOECHOPROMPT'/> + <ref name='VIR_CRED_PASSPHRASE'/> + <ref name='VIR_CRED_REALM'/> + <ref name='VIR_CRED_USERNAME'/> <ref name='VIR_DOMAIN_BLOCKED'/> <ref name='VIR_DOMAIN_CRASHED'/> <ref name='VIR_DOMAIN_NONE'/> @@ -251,6 +283,7 @@ <ref name='VIR_DOMAIN_SHUTOFF'/> <ref name='VIR_DOMAIN_XML_INACTIVE'/> <ref name='VIR_DOMAIN_XML_SECURE'/> + <ref name='VIR_ERR_AUTH_FAILED'/> <ref name='VIR_ERR_CALL_FAILED'/> <ref name='VIR_ERR_CONF_SYNTAX'/> <ref name='VIR_ERR_DOM_EXIST'/> @@ -328,6 +361,8 @@ <ref name='VIR_WAR_NO_NETWORK'/> </letter> <letter name='_'> + <ref name='_virConnectAuth'/> + <ref name='_virConnectCredential'/> <ref name='_virDomainBlockStats'/> <ref name='_virDomainInfo'/> <ref name='_virDomainInterfaceStats'/> @@ -342,7 +377,15 @@ <ref name='virConnResetLastError'/> <ref name='virConnSetErrorFunc'/> <ref name='virConnect'/> + <ref name='virConnectAuth'/> + <ref name='virConnectAuthCallbackPtr'/> + <ref name='virConnectAuthPtr'/> + <ref name='virConnectAuthPtrDefault'/> <ref name='virConnectClose'/> + <ref name='virConnectCredential'/> + <ref name='virConnectCredentialPtr'/> + <ref name='virConnectCredentialType'/> + <ref name='virConnectFlags'/> <ref name='virConnectGetCapabilities'/> <ref name='virConnectGetHostname'/> <ref name='virConnectGetMaxVcpus'/> @@ -358,6 +401,7 @@ <ref name='virConnectNumOfDomains'/> <ref name='virConnectNumOfNetworks'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virConnectPtr'/> <ref name='virCopyLastError'/> @@ -472,6 +516,7 @@ </type> <type name='virConnectPtr'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainGetConnect'/> <ref name='virNetworkGetConnect'/> @@ -525,6 +570,7 @@ <ref name='virNetworkGetUUID'/> </type> <type name='unsigned int'> + <ref name='virConnectAuthCallbackPtr'/> <ref name='virDomainCreateLinux'/> <ref name='virDomainPinVcpu'/> <ref name='virDomainReboot'/> @@ -541,6 +587,12 @@ </type> <type name='unsigned long long *'> <ref name='virNodeGetCellsFreeMemory'/> + </type> + <type name='virConnectAuthPtr'> + <ref name='virConnectOpenAuth'/> + </type> + <type name='virConnectCredentialPtr'> + <ref name='virConnectAuthCallbackPtr'/> </type> <type name='virConnectPtr'> <ref name='virConnCopyLastError'/> @@ -662,6 +714,7 @@ </type> <type name='void *'> <ref name='virConnSetErrorFunc'/> + <ref name='virConnectAuthCallbackPtr'/> <ref name='virErrorFunc'/> <ref name='virSetErrorFunc'/> </type> @@ -669,9 +722,19 @@ <files> <file name='libvirt'> <ref name='LIBVIR_VERSION_NUMBER'/> + <ref name='VIR_CONNECT_RO'/> <ref name='VIR_COPY_CPUMAP'/> <ref name='VIR_CPU_MAPLEN'/> <ref name='VIR_CPU_USABLE'/> + <ref name='VIR_CRED_AUTHNAME'/> + <ref name='VIR_CRED_CNONCE'/> + <ref name='VIR_CRED_ECHOPROMPT'/> + <ref name='VIR_CRED_EXTERNAL'/> + <ref name='VIR_CRED_LANGUAGE'/> + <ref name='VIR_CRED_NOECHOPROMPT'/> + <ref name='VIR_CRED_PASSPHRASE'/> + <ref name='VIR_CRED_REALM'/> + <ref name='VIR_CRED_USERNAME'/> <ref name='VIR_DOMAIN_BLOCKED'/> <ref name='VIR_DOMAIN_CRASHED'/> <ref name='VIR_DOMAIN_NONE'/> @@ -699,6 +762,8 @@ <ref name='VIR_VCPU_BLOCKED'/> <ref name='VIR_VCPU_OFFLINE'/> <ref name='VIR_VCPU_RUNNING'/> + <ref name='_virConnectAuth'/> + <ref name='_virConnectCredential'/> <ref name='_virDomainBlockStats'/> <ref name='_virDomainInfo'/> <ref name='_virDomainInterfaceStats'/> @@ -706,7 +771,15 @@ <ref name='_virSchedParameter'/> <ref name='_virVcpuInfo'/> <ref name='virConnect'/> + <ref name='virConnectAuth'/> + <ref name='virConnectAuthCallbackPtr'/> + <ref name='virConnectAuthPtr'/> + <ref name='virConnectAuthPtrDefault'/> <ref name='virConnectClose'/> + <ref name='virConnectCredential'/> + <ref name='virConnectCredentialPtr'/> + <ref name='virConnectCredentialType'/> + <ref name='virConnectFlags'/> <ref name='virConnectGetCapabilities'/> <ref name='virConnectGetHostname'/> <ref name='virConnectGetMaxVcpus'/> @@ -722,6 +795,7 @@ <ref name='virConnectNumOfDomains'/> <ref name='virConnectNumOfNetworks'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virConnectPtr'/> <ref name='virDomain'/> @@ -812,6 +886,7 @@ <ref name='virVcpuState'/> </file> <file name='virterror'> + <ref name='VIR_ERR_AUTH_FAILED'/> <ref name='VIR_ERR_CALL_FAILED'/> <ref name='VIR_ERR_CONF_SYNTAX'/> <ref name='VIR_ERR_DOM_EXIST'/> @@ -912,11 +987,17 @@ <ref name='VIR_GET_CPUMAP'/> <ref name='virConnectOpenReadOnly'/> </word> + <word name='Additional'> + <ref name='_virConnectCredential'/> + </word> <word name='After'> <ref name='virDomainSave'/> </word> <word name='Attempt'> <ref name='virDomainMigrate'/> + </word> + <word name='Authenticate'> + <ref name='virConnectOpenAuth'/> </word> </letter> <letter name='B'> @@ -956,6 +1037,9 @@ <ref name='virDomainPinVcpu'/> <ref name='virDomainSetVcpus'/> </word> + <word name='Callback'> + <ref name='_virConnectAuth'/> + </word> <word name='Change'> <ref name='virDomainSetSchedulerParameters'/> </word> @@ -1058,6 +1142,7 @@ <ref name='virConnectGetType'/> <ref name='virConnectGetVersion'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> </word> </letter> <letter name='I'> @@ -1085,8 +1170,14 @@ <word name='Launch'> <ref name='virDomainCreateLinux'/> </word> + <word name='Length'> + <ref name='_virConnectCredential'/> + </word> <word name='Linux'> <ref name='virDomainCreateLinux'/> + </word> + <word name='List'> + <ref name='_virConnectAuth'/> </word> </letter> <letter name='M'> @@ -1132,12 +1223,22 @@ <ref name='virGetVersion'/> </word> <word name='One'> + <ref name='_virConnectCredential'/> <ref name='virConnCopyLastError'/> <ref name='virCopyLastError'/> <ref name='virDomainGetVcpus'/> </word> + <word name='Open'> + <ref name='virConnectOpenAuth'/> + </word> + <word name='Optional'> + <ref name='_virConnectCredential'/> + </word> </letter> <letter name='P'> + <word name='Prompt'> + <ref name='_virConnectCredential'/> + </word> <word name='Provide'> <ref name='virConnGetLastError'/> <ref name='virDomainGetXMLDesc'/> @@ -1179,6 +1280,9 @@ <ref name='virResetError'/> <ref name='virResetLastError'/> </word> + <word name='Result'> + <ref name='_virConnectCredential'/> + </word> <word name='Resume'> <ref name='virDomainResume'/> </word> @@ -1235,11 +1339,13 @@ <word name='URI'> <ref name='virConnectGetURI'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainMigrate'/> </word> <word name='URIs'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainMigrate'/> </word> @@ -1274,6 +1380,8 @@ <ref name='virDomainSuspend'/> </word> </letter> + </chunk> + <chunk name='chunk1'> <letter name='V'> <word name='VIR_COPY_CPUMAP'> <ref name='VIR_COPY_CPUMAP'/> @@ -1307,8 +1415,6 @@ <ref name='virNetworkGetUUIDString'/> </word> </letter> - </chunk> - <chunk name='chunk1'> <letter name='W'> <word name='WARNING:'> <ref name='virDomainGetConnect'/> @@ -1464,6 +1570,7 @@ <ref name='virConnectClose'/> <ref name='virConnectGetHostname'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainDestroy'/> <ref name='virDomainMigrate'/> @@ -1506,6 +1613,9 @@ <word name='attribute'> <ref name='virConnectGetMaxVcpus'/> <ref name='virDomainBlockStats'/> + </word> + <word name='authentication'> + <ref name='virConnectOpenAuth'/> </word> <word name='automatically'> <ref name='virDomainGetAutostart'/> @@ -1633,6 +1743,8 @@ <ref name='virNetworkGetUUIDString'/> </word> </letter> + </chunk> + <chunk name='chunk2'> <letter name='c'> <word name='calculate'> <ref name='VIR_NODEINFO_MAXCPUS'/> @@ -1654,6 +1766,7 @@ </word> <word name='callback'> <ref name='virConnSetErrorFunc'/> + <ref name='virConnectOpenAuth'/> <ref name='virErrorFunc'/> <ref name='virSetErrorFunc'/> </word> @@ -1661,6 +1774,7 @@ <ref name='virConnSetErrorFunc'/> <ref name='virConnectClose'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virSetErrorFunc'/> </word> @@ -1729,6 +1843,9 @@ <word name='cells'> <ref name='virNodeGetCellsFreeMemory'/> </word> + <word name='challenge'> + <ref name='_virConnectCredential'/> + </word> <word name='change'> <ref name='virDomainPinVcpu'/> <ref name='virDomainSetMaxMemory'/> @@ -1755,6 +1872,7 @@ <ref name='virGetVersion'/> </word> <word name='collect'> + <ref name='_virConnectAuth'/> <ref name='virConnectListDomains'/> <ref name='virConnectListNetworks'/> </word> @@ -1789,6 +1907,9 @@ </word> <word name='consequent'> <ref name='_virError'/> + </word> + <word name='constants'> + <ref name='_virConnectCredential'/> </word> <word name='content'> <ref name='virConnCopyLastError'/> @@ -1846,6 +1967,10 @@ <word name='create'> <ref name='virNetworkDefineXML'/> </word> + <word name='credentials'> + <ref name='_virConnectAuth'/> + <ref name='virConnectOpenAuth'/> + </word> <word name='cupmap'> <ref name='virDomainGetVcpus'/> </word> @@ -1856,8 +1981,6 @@ <ref name='virDomainCoreDump'/> </word> </letter> - </chunk> - <chunk name='chunk2'> <letter name='d'> <word name='data'> <ref name='virConnSetErrorFunc'/> @@ -1876,6 +1999,7 @@ <ref name='virNetworkGetName'/> </word> <word name='default'> + <ref name='_virConnectCredential'/> <ref name='virConnSetErrorFunc'/> <ref name='virDomainMigrate'/> <ref name='virSetErrorFunc'/> @@ -1892,6 +2016,9 @@ </word> <word name='defining'> <ref name='virConnectGetCapabilities'/> + </word> + <word name='defresult'> + <ref name='_virConnectCredential'/> </word> <word name='described'> <ref name='virDomainGetVcpus'/> @@ -1945,6 +2072,7 @@ </word> <word name='documented'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> </word> <word name='does'> @@ -1984,6 +2112,8 @@ <ref name='virDomainMigrate'/> </word> </letter> + </chunk> + <chunk name='chunk3'> <letter name='e'> <word name='each'> <ref name='virDomainBlockStats'/> @@ -2053,6 +2183,9 @@ <word name='features'> <ref name='virDomainMigrate'/> </word> + <word name='fetching'> + <ref name='virConnectOpenAuth'/> + </word> <word name='field'> <ref name='VIR_DOMAIN_SCHED_FIELD_LENGTH'/> </word> @@ -2065,6 +2198,7 @@ <ref name='virDomainSave'/> </word> <word name='filled'> + <ref name='_virConnectCredential'/> <ref name='virDomainGetSchedulerParameters'/> <ref name='virDomainGetVcpus'/> <ref name='virNodeGetCellsFreeMemory'/> @@ -2078,10 +2212,12 @@ </word> <word name='first'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virNodeGetCellsFreeMemory'/> </word> <word name='flags'> + <ref name='virConnectOpenAuth'/> <ref name='virDomainCoreDump'/> <ref name='virDomainMigrate'/> <ref name='virDomainReboot'/> @@ -2159,6 +2295,7 @@ <ref name='virConnSetErrorFunc'/> <ref name='virConnectClose'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainBlockStats'/> <ref name='virDomainCreateLinux'/> @@ -2191,6 +2328,7 @@ <word name='get'> <ref name='virConnSetErrorFunc'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainBlockStats'/> <ref name='virDomainGetInfo'/> @@ -2232,8 +2370,6 @@ <ref name='virDomainShutdown'/> </word> </letter> - </chunk> - <chunk name='chunk3'> <letter name='h'> <word name='handler'> <ref name='virConnSetErrorFunc'/> @@ -2276,11 +2412,13 @@ <word name='html'> <ref name='virConnectGetType'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> </word> <word name='http:'> <ref name='virConnectGetType'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> </word> <word name='human-readable'> @@ -2388,6 +2526,8 @@ <ref name='virNetworkLookupByUUIDString'/> </word> </letter> + </chunk> + <chunk name='chunk4'> <letter name='j'> <word name='join'> <ref name='virNetworkGetBridgeName'/> @@ -2479,6 +2619,7 @@ </word> <word name='libvirt'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainGetConnect'/> <ref name='virDomainMigrate'/> @@ -2709,8 +2850,6 @@ <ref name='_virDomainBlockStats'/> </word> </letter> - </chunk> - <chunk name='chunk4'> <letter name='n'> <word name='name'> <ref name='_virSchedParameter'/> @@ -2736,6 +2875,9 @@ </word> <word name='neccessarily'> <ref name='VIR_NODEINFO_MAXCPUS'/> + </word> + <word name='neccessary'> + <ref name='virConnectOpenAuth'/> </word> <word name='need'> <ref name='virConnCopyLastError'/> @@ -2789,6 +2931,8 @@ <ref name='virDomainSetSchedulerParameters'/> </word> </letter> + </chunk> + <chunk name='chunk5'> <letter name='o'> <word name='objects'> <ref name='virDomainSetSchedulerParameters'/> @@ -2839,6 +2983,7 @@ </word> <word name='org'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> </word> <word name='other'> @@ -2874,6 +3019,7 @@ <ref name='virDomainSetSchedulerParameters'/> </word> <word name='parameters'> + <ref name='virConnectOpenAuth'/> <ref name='virDomainGetSchedulerParameters'/> <ref name='virDomainGetSchedulerType'/> <ref name='virDomainSetSchedulerParameters'/> @@ -2908,6 +3054,9 @@ </word> <word name='perform'> <ref name='virDomainMigrate'/> + </word> + <word name='performed'> + <ref name='virConnectOpenAuth'/> </word> <word name='physical'> <ref name='VIR_CPU_MAPLEN'/> @@ -3102,6 +3251,9 @@ <ref name='virDomainSuspend'/> <ref name='virNetworkDestroy'/> </word> + <word name='response'> + <ref name='_virConnectCredential'/> + </word> <word name='restart'> <ref name='virDomainReboot'/> </word> @@ -3116,6 +3268,7 @@ <ref name='virConnectOpenReadOnly'/> </word> <word name='result'> + <ref name='_virConnectCredential'/> <ref name='virConnCopyLastError'/> <ref name='virConnectGetHostname'/> <ref name='virCopyLastError'/> @@ -3193,7 +3346,7 @@ </word> </letter> </chunk> - <chunk name='chunk5'> + <chunk name='chunk6'> <letter name='s'> <word name='same'> <ref name='virConnectGetURI'/> @@ -3242,6 +3395,7 @@ <word name='should'> <ref name='virConnectClose'/> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainBlockStats'/> <ref name='virDomainDestroy'/> @@ -3254,6 +3408,9 @@ <ref name='virNetworkDestroy'/> <ref name='virNetworkFree'/> <ref name='virNetworkSetAutostart'/> + </word> + <word name='show'> + <ref name='_virConnectCredential'/> </word> <word name='shutdown'> <ref name='virDomainDestroy'/> @@ -3428,6 +3585,7 @@ </word> <word name='supported'> <ref name='VIR_NODEINFO_MAXCPUS'/> + <ref name='_virConnectAuth'/> <ref name='virConnectGetMaxVcpus'/> <ref name='virDomainGetMaxVcpus'/> <ref name='virDomainMigrate'/> @@ -3589,7 +3747,7 @@ </word> </letter> </chunk> - <chunk name='chunk6'> + <chunk name='chunk7'> <letter name='u'> <word name='undefine'> <ref name='virDomainUndefine'/> @@ -3615,6 +3773,7 @@ </word> <word name='uri'> <ref name='virConnectOpen'/> + <ref name='virConnectOpenAuth'/> <ref name='virConnectOpenReadOnly'/> <ref name='virDomainMigrate'/> </word> @@ -3642,6 +3801,7 @@ <ref name='VIR_GET_CPUMAP'/> <ref name='VIR_UNUSE_CPU'/> <ref name='VIR_USE_CPU'/> + <ref name='_virConnectAuth'/> <ref name='_virDomainInfo'/> <ref name='_virVcpuInfo'/> <ref name='virConnectGetType'/> @@ -3658,6 +3818,7 @@ <ref name='virNetworkGetXMLDesc'/> </word> <word name='user'> + <ref name='_virConnectCredential'/> <ref name='virConnSetErrorFunc'/> <ref name='virDomainGetInfo'/> <ref name='virDomainMigrate'/> @@ -3686,6 +3847,7 @@ <ref name='virNetworkGetXMLDesc'/> </word> <word name='values'> + <ref name='_virConnectAuth'/> <ref name='virDomainGetSchedulerParameters'/> <ref name='virGetVersion'/> </word> @@ -3702,8 +3864,15 @@ <ref name='virConnectGetVersion'/> <ref name='virGetVersion'/> </word> + <word name='via'> + <ref name='virConnectOpenAuth'/> + </word> <word name='virConnCopyLastError'> <ref name='virConnGetLastError'/> + </word> + <word name='virConnectCredentialType'> + <ref name='_virConnectAuth'/> + <ref name='_virConnectCredential'/> </word> <word name='virConnectGetCapabilities'> <ref name='virDomainMigrate'/> @@ -3882,6 +4051,7 @@ <ref name='virConnCopyLastError'/> <ref name='virConnSetErrorFunc'/> <ref name='virConnectGetURI'/> + <ref name='virConnectOpenAuth'/> <ref name='virCopyLastError'/> <ref name='virDomainCoreDump'/> <ref name='virDomainGetMaxVcpus'/> @@ -3903,6 +4073,7 @@ <ref name='VIR_GET_CPUMAP'/> <ref name='VIR_UNUSE_CPU'/> <ref name='VIR_USE_CPU'/> + <ref name='_virConnectCredential'/> <ref name='virConnCopyLastError'/> <ref name='virConnectClose'/> <ref name='virConnectGetVersion'/> @@ -3935,7 +4106,7 @@ </word> </letter> </chunk> - <chunk name='chunk7'> + <chunk name='chunk8'> <letter name='x'> <word name='xen'> <ref name='virConnectOpen'/> @@ -3964,14 +4135,15 @@ </letter> </chunk> <chunks> - <chunk name='chunk0' start='A' end='V'/> - <chunk name='chunk1' start='W' end='c'/> - <chunk name='chunk2' start='d' end='g'/> - <chunk name='chunk3' start='h' end='m'/> - <chunk name='chunk4' start='n' end='r'/> - <chunk name='chunk5' start='s' end='t'/> - <chunk name='chunk6' start='u' end='w'/> - <chunk name='chunk7' start='x' end='z'/> + <chunk name='chunk0' start='A' end='U'/> + <chunk name='chunk1' start='V' end='b'/> + <chunk name='chunk2' start='c' end='d'/> + <chunk name='chunk3' start='e' end='i'/> + <chunk name='chunk4' start='j' end='n'/> + <chunk name='chunk5' start='o' end='r'/> + <chunk name='chunk6' start='s' end='t'/> + <chunk name='chunk7' start='u' end='w'/> + <chunk name='chunk8' start='x' end='z'/> </chunks> </index> </apirefs> diff -r ec2d8c632fd9 include/libvirt/libvirt.h.in --- a/include/libvirt/libvirt.h.in Wed Nov 28 15:00:45 2007 -0500 +++ b/include/libvirt/libvirt.h.in Wed Nov 28 20:35:24 2007 -0500 @@ -1,3 +1,4 @@ + /* -*- c -*- * libvirt.h: * Summary: core interfaces for the libvirt library @@ -275,6 +276,74 @@ typedef virNodeInfo *virNodeInfoPtr; typedef virNodeInfo *virNodeInfoPtr; /** + * virConnectFlags + * + * Flags when openning a connection to a hypervisor + */ +typedef enum { + VIR_CONNECT_RO = 1, /* A readonly connection */ +} virConnectFlags; + + +typedef enum { + VIR_CRED_USERNAME = 1, /* Identity to act as */ + VIR_CRED_AUTHNAME = 2, /* Identify to authorize as */ + VIR_CRED_LANGUAGE = 3, /* RFC 1766 languages, comma separated */ + VIR_CRED_CNONCE = 4, /* client supplies a nonce */ + VIR_CRED_PASSPHRASE = 5, /* Passphrase secret */ + VIR_CRED_ECHOPROMPT = 6, /* Challenge response */ + VIR_CRED_NOECHOPROMPT = 7, /* Challenge response */ + VIR_CRED_REALM = 8, /* Authentication realm */ + VIR_CRED_EXTERNAL = 9, /* Externally managed credential */ + + /* More may be added - expect the unexpected */ +} virConnectCredentialType; + +struct _virConnectCredential { + int type; /* One of virConnectCredentialType constants */ + const char *prompt; /* Prompt to show to user */ + const char *challenge; /* Additional challenge to show */ + const char *defresult; /* Optional default result */ + char *result; /* Result to be filled with user response (or defresult) */ + unsigned int resultlen; /* Length of the result */ +}; + +typedef struct _virConnectCredential virConnectCredential; +typedef virConnectCredential *virConnectCredentialPtr; + + +/** + * virConnectCredCallbackPtr + * + * @param authtype type of authentication being performed + * @param cred array of credentials to fetch from user + * @param ncred size of cred array + * @param cbdata opaque data passed to virConnectOpenAuth + * + * When authentication requires one or more interactions, this callback + * is invoked. For each interaction supplied, data must be gathered + * from the user and filled in to the 'result' and 'resultlen' fields. + * If an interaction can not be filled, fill in NULL and 0. + * + * Return 0 if all interactions were filled, or -1 upon error + */ +typedef int (*virConnectAuthCallbackPtr)(virConnectCredentialPtr cred, + unsigned int ncred, + void *cbdata); + +struct _virConnectAuth { + int *credtype; /* List of supported virConnectCredentialType values */ + unsigned int ncredtype; + + virConnectAuthCallbackPtr cb; /* Callback used to collect credentials */ + void *cbdata; +}; + + +typedef struct _virConnectAuth virConnectAuth; +typedef virConnectAuth *virConnectAuthPtr; + +/** * VIR_UUID_BUFLEN: * * This macro provides the length of the buffer required @@ -314,6 +383,9 @@ int virInitialize (void); virConnectPtr virConnectOpen (const char *name); virConnectPtr virConnectOpenReadOnly (const char *name); +virConnectPtr virConnectOpenAuth (const char *name, + virConnectAuthPtr auth, + int flags); int virConnectClose (virConnectPtr conn); const char * virConnectGetType (virConnectPtr conn); int virConnectGetVersion (virConnectPtr conn, diff -r ec2d8c632fd9 proxy/libvirt_proxy.c --- a/proxy/libvirt_proxy.c Wed Nov 28 15:00:45 2007 -0500 +++ b/proxy/libvirt_proxy.c Wed Nov 28 20:35:24 2007 -0500 @@ -77,7 +77,7 @@ proxyInitXen(void) { priv->xshandle = NULL; priv->proxy = -1; - ret = xenHypervisorOpen(conn, NULL, 0); + ret = xenHypervisorOpen(conn, NULL, NULL, 0); if (ret < 0) { fprintf(stderr, "Failed to open Xen hypervisor\n"); return(-1); @@ -93,7 +93,7 @@ proxyInitXen(void) { fprintf(stderr, "Failed to connect to Xen daemon\n"); return(-1); } - ret = xenStoreOpen(conn, NULL, VIR_DRV_OPEN_RO); + ret = xenStoreOpen(conn, NULL, NULL, VIR_CONNECT_RO); if (ret < 0) { fprintf(stderr, "Failed to open XenStore connection"); return (-1); diff -r ec2d8c632fd9 qemud/remote.c --- a/qemud/remote.c Wed Nov 28 15:00:45 2007 -0500 +++ b/qemud/remote.c Wed Nov 28 20:35:24 2007 -0500 @@ -2062,7 +2062,7 @@ remoteDispatchAuthList (struct qemud_ser remote_auth_list_ret *ret) { ret->types.types_len = 1; - if ((ret->types.types_val = calloc (ret->types.types_len, sizeof (remote_auth_type))) == NULL) { + if ((ret->types.types_val = calloc (ret->types.types_len, sizeof (u_int))) == NULL) { remoteDispatchSendError(client, req, VIR_ERR_NO_MEMORY, "auth types"); return -2; } diff -r ec2d8c632fd9 src/driver.h --- a/src/driver.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/driver.h Wed Nov 28 20:35:24 2007 -0500 @@ -27,11 +27,6 @@ typedef enum { } virDrvNo; -typedef enum { - /* VIR_DRV_OPEN_QUIET = 1 - removed by RWMJ */ - VIR_DRV_OPEN_RO = 2 -} virDrvOpenFlag; - /* Status codes returned from driver open call. */ typedef enum { /* Opened successfully. */ @@ -76,8 +71,9 @@ typedef enum { typedef virDrvOpenStatus (*virDrvOpen) (virConnectPtr conn, - xmlURIPtr uri, - int flags); + xmlURIPtr uri, + virConnectAuthPtr auth, + int flags); typedef int (*virDrvClose) (virConnectPtr conn); typedef int diff -r ec2d8c632fd9 src/internal.h --- a/src/internal.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/internal.h Wed Nov 28 20:35:24 2007 -0500 @@ -129,11 +129,6 @@ extern "C" { */ #define MAX_DRIVERS 10 #define MIN_XEN_GUEST_SIZE 64 /* 64 megabytes */ - -/* - * Flags for Xen connections - */ -#define VIR_CONNECT_RO 1 /** * _virConnect: diff -r ec2d8c632fd9 src/libvirt.c --- a/src/libvirt.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/libvirt.c Wed Nov 28 20:35:24 2007 -0500 @@ -395,7 +395,9 @@ virGetVersion(unsigned long *libVer, con } static virConnectPtr -do_open (const char *name, int flags) +do_open (const char *name, + virConnectAuthPtr auth, + int flags) { int i, res; virConnectPtr ret = NULL; @@ -458,7 +460,7 @@ do_open (const char *name, int flags) fprintf (stderr, "libvirt: do_open: trying driver %d (%s) ...\n", i, virDriverTab[i]->name); #endif - res = virDriverTab[i]->open (ret, uri, flags); + res = virDriverTab[i]->open (ret, uri, auth, flags); #ifdef ENABLE_DEBUG fprintf (stderr, "libvirt: do_open: driver %d %s returned %s\n", i, virDriverTab[i]->name, @@ -480,7 +482,7 @@ do_open (const char *name, int flags) } for (i = 0; i < virNetworkDriverTabCount; i++) { - res = virNetworkDriverTab[i]->open (ret, uri, flags); + res = virNetworkDriverTab[i]->open (ret, uri, auth, flags); #ifdef ENABLE_DEBUG fprintf (stderr, "libvirt: do_open: network driver %d %s returned %s\n", i, virNetworkDriverTab[i]->name, @@ -500,9 +502,8 @@ do_open (const char *name, int flags) } } - if (flags & VIR_DRV_OPEN_RO) { - ret->flags = VIR_CONNECT_RO; - } + /* Cleansing flags */ + ret->flags = flags & VIR_CONNECT_RO; xmlFreeURI (uri); @@ -531,7 +532,7 @@ virConnectOpen (const char *name) virConnectOpen (const char *name) { DEBUG("name=%s", name); - return do_open (name, 0); + return do_open (name, NULL, 0); } /** @@ -550,7 +551,30 @@ virConnectOpenReadOnly(const char *name) virConnectOpenReadOnly(const char *name) { DEBUG("name=%s", name); - return do_open (name, VIR_DRV_OPEN_RO); + return do_open (name, NULL, VIR_CONNECT_RO); +} + +/** + * virConnectOpenAuth: + * @name: URI of the hypervisor + * @auth: Authenticate callback parameters + * @flags: Open flags + * + * This function should be called first to get a connection to the + * Hypervisor. If neccessary, authentication will be performed fetching + * credentials via the callback + * + * Returns a pointer to the hypervisor connection or NULL in case of error + * + * URIs are documented at http://libvirt.org/uri.html + */ +virConnectPtr +virConnectOpenAuth(const char *name, + virConnectAuthPtr auth, + int flags) +{ + DEBUG("name=%s", name); + return do_open (name, auth, flags); } /** diff -r ec2d8c632fd9 src/openvz_driver.c --- a/src/openvz_driver.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/openvz_driver.c Wed Nov 28 20:35:24 2007 -0500 @@ -89,7 +89,12 @@ static int openvzActive(void); static int openvzActive(void); static int openvzCloseNetwork(virConnectPtr conn); static virDrvOpenStatus openvzOpenNetwork(virConnectPtr conn, - const char *name ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED); + const char *name ATTRIBUTE_UNUSED, + int *credtype ATTRIBUTE_UNUSED, + int ncredtype ATTRIBUTE_UNUSED, + virConnectAuthCallbackPtr cb ATTRIBUTE_UNUSED, + void *cbdata ATTRIBUTE_UNUSED, + int flags ATTRIBUTE_UNUSED); static virDomainPtr openvzDomainDefineXML(virConnectPtr conn, const char *xml); static virDomainPtr openvzDomainCreateLinux(virConnectPtr conn, const char *xml, @@ -551,8 +556,12 @@ bail_out5: } static virDrvOpenStatus openvzOpen(virConnectPtr conn, - const char *name, - int flags ATTRIBUTE_UNUSED) { + const char *name, + int *credtype ATTRIBUTE_UNUSED, + int ncredtype ATTRIBUTE_UNUSED, + virConnectAuthCallbackPtr cb ATTRIBUTE_UNUSED, + void *cbdata ATTRIBUTE_UNUSED, + int flags ATTRIBUTE_UNUSED) { struct openvz_vm *vms; /* Just check if the guy is root. Nothing really to open for OpenVZ */ @@ -693,8 +702,12 @@ static int openvzCloseNetwork(virConnect } static virDrvOpenStatus openvzOpenNetwork(virConnectPtr conn ATTRIBUTE_UNUSED, - const char *name ATTRIBUTE_UNUSED, - int flags ATTRIBUTE_UNUSED) { + const char *name ATTRIBUTE_UNUSED, + int *credtype ATTRIBUTE_UNUSED, + int ncredtype ATTRIBUTE_UNUSED, + virConnectAuthCallbackPtr cb ATTRIBUTE_UNUSED, + void *cbdata ATTRIBUTE_UNUSED, + int flags ATTRIBUTE_UNUSED) { return VIR_DRV_OPEN_SUCCESS; } diff -r ec2d8c632fd9 src/proxy_internal.c --- a/src/proxy_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/proxy_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -29,7 +29,7 @@ static int debug = 0; static int debug = 0; static int xenProxyClose(virConnectPtr conn); -static int xenProxyOpen(virConnectPtr conn, xmlURIPtr uri, int flags); +static int xenProxyOpen(virConnectPtr conn, xmlURIPtr uri, virConnectAuthPtr auth, int flags); static int xenProxyGetVersion(virConnectPtr conn, unsigned long *hvVer); static int xenProxyNodeGetInfo(virConnectPtr conn, virNodeInfoPtr info); static char *xenProxyGetCapabilities(virConnectPtr conn); @@ -521,14 +521,17 @@ retry: * Returns 0 in case of success, and -1 in case of failure */ int -xenProxyOpen(virConnectPtr conn, xmlURIPtr uri ATTRIBUTE_UNUSED, int flags) +xenProxyOpen(virConnectPtr conn, + xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, + int flags) { virProxyPacket req; int ret; int fd; xenUnifiedPrivatePtr priv; - if (!(flags & VIR_DRV_OPEN_RO)) + if (!(flags & VIR_CONNECT_RO)) return(-1); priv = (xenUnifiedPrivatePtr) conn->privateData; diff -r ec2d8c632fd9 src/qemu_driver.c --- a/src/qemu_driver.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/qemu_driver.c Wed Nov 28 20:35:24 2007 -0500 @@ -1387,6 +1387,7 @@ static int qemudMonitorCommand(struct qe static virDrvOpenStatus qemudOpen(virConnectPtr conn, xmlURIPtr uri, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { uid_t uid = getuid(); @@ -2572,6 +2573,7 @@ static virNetworkPtr qemudNetworkLookupB static virDrvOpenStatus qemudOpenNetwork(virConnectPtr conn, xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { if (!qemu_driver) return VIR_DRV_OPEN_DECLINED; diff -r ec2d8c632fd9 src/remote_internal.c --- a/src/remote_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/remote_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -286,7 +286,6 @@ remoteForkDaemon(virConnectPtr conn) } -/* Must not overlap with virDrvOpenFlags */ enum virDrvOpenRemoteFlags { VIR_DRV_OPEN_REMOTE_RO = (1 << 0), VIR_DRV_OPEN_REMOTE_UNIX = (1 << 1), @@ -295,8 +294,11 @@ enum virDrvOpenRemoteFlags { }; static int -doRemoteOpen (virConnectPtr conn, struct private_data *priv, - xmlURIPtr uri, int flags) +doRemoteOpen (virConnectPtr conn, + struct private_data *priv, + xmlURIPtr uri, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, + int flags) { if (!uri || !uri->scheme) return VIR_DRV_OPEN_DECLINED; /* Decline - not a URL. */ @@ -779,7 +781,10 @@ doRemoteOpen (virConnectPtr conn, struct } static int -remoteOpen (virConnectPtr conn, xmlURIPtr uri, int flags) +remoteOpen (virConnectPtr conn, + xmlURIPtr uri, + virConnectAuthPtr auth, + int flags) { struct private_data *priv; int ret, rflags = 0; @@ -793,7 +798,7 @@ remoteOpen (virConnectPtr conn, xmlURIPt return VIR_DRV_OPEN_ERROR; } - if (flags & VIR_DRV_OPEN_RO) + if (flags & VIR_CONNECT_RO) rflags |= VIR_DRV_OPEN_REMOTE_RO; if (uri && @@ -814,7 +819,7 @@ remoteOpen (virConnectPtr conn, xmlURIPt memset(priv, 0, sizeof(struct private_data)); priv->magic = DEAD; priv->sock = -1; - ret = doRemoteOpen(conn, priv, uri, rflags); + ret = doRemoteOpen(conn, priv, uri, auth, rflags); if (ret != VIR_DRV_OPEN_SUCCESS) { conn->privateData = NULL; free(priv); @@ -2442,6 +2447,7 @@ static int static int remoteNetworkOpen (virConnectPtr conn, xmlURIPtr uri, + virConnectAuthPtr auth, int flags) { if (inside_daemon) @@ -2468,14 +2474,14 @@ remoteNetworkOpen (virConnectPtr conn, error (conn, VIR_ERR_NO_MEMORY, "struct private_data"); return VIR_DRV_OPEN_ERROR; } - if (flags & VIR_DRV_OPEN_RO) + if (flags & VIR_CONNECT_RO) rflags |= VIR_DRV_OPEN_REMOTE_RO; rflags |= VIR_DRV_OPEN_REMOTE_UNIX; memset(priv, 0, sizeof(struct private_data)); priv->magic = DEAD; priv->sock = -1; - ret = doRemoteOpen(conn, priv, uri, rflags); + ret = doRemoteOpen(conn, priv, uri, auth, rflags); if (ret != VIR_DRV_OPEN_SUCCESS) { conn->networkPrivateData = NULL; free(priv); diff -r ec2d8c632fd9 src/test.c --- a/src/test.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/test.c Wed Nov 28 20:35:24 2007 -0500 @@ -882,6 +882,7 @@ static int getNetworkIndex(virNetworkPtr static int testOpen(virConnectPtr conn, xmlURIPtr uri, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { int ret; @@ -1644,6 +1645,7 @@ static int testDomainSetSchedulerParams( static virDrvOpenStatus testOpenNetwork(virConnectPtr conn, xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { if (STRNEQ(conn->driver->name, "Test")) return VIR_DRV_OPEN_DECLINED; diff -r ec2d8c632fd9 src/xen_internal.c --- a/src/xen_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xen_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -2060,6 +2060,7 @@ int int xenHypervisorOpen(virConnectPtr conn, xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { int ret; diff -r ec2d8c632fd9 src/xen_internal.h --- a/src/xen_internal.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xen_internal.h Wed Nov 28 20:35:24 2007 -0500 @@ -31,6 +31,7 @@ char * int xenHypervisorOpen (virConnectPtr conn, xmlURIPtr uri, + virConnectAuthPtr auth, int flags); int xenHypervisorClose (virConnectPtr conn); int xenHypervisorGetVersion (virConnectPtr conn, diff -r ec2d8c632fd9 src/xen_unified.c --- a/src/xen_unified.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xen_unified.c Wed Nov 28 20:35:24 2007 -0500 @@ -217,7 +217,7 @@ done: */ static int -xenUnifiedOpen (virConnectPtr conn, xmlURIPtr uri, int flags) +xenUnifiedOpen (virConnectPtr conn, xmlURIPtr uri, virConnectAuthPtr auth, int flags) { int i, j; xenUnifiedPrivatePtr priv; @@ -272,7 +272,7 @@ xenUnifiedOpen (virConnectPtr conn, xmlU #ifdef ENABLE_DEBUG fprintf (stderr, "libvirt: xenUnifiedOpen: trying Xen sub-driver %d\n", i); #endif - if (drivers[i]->open (conn, uri, flags) == VIR_DRV_OPEN_SUCCESS) + if (drivers[i]->open (conn, uri, auth, flags) == VIR_DRV_OPEN_SUCCESS) priv->opened[i] = 1; #ifdef ENABLE_DEBUG fprintf (stderr, "libvirt: xenUnifiedOpen: Xen sub-driver %d open %s\n", diff -r ec2d8c632fd9 src/xend_internal.c --- a/src/xend_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xend_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -237,7 +237,7 @@ do_connect(virConnectPtr xend) * is rather normal, this should fallback to the proxy (or * remote) mechanism. */ - if ((getuid() == 0) || (xend->flags & VIR_DRV_OPEN_RO)) { + if ((getuid() == 0) || (xend->flags & VIR_CONNECT_RO)) { virXendError(xend, VIR_ERR_INTERNAL_ERROR, "failed to connect to xend"); } @@ -2044,7 +2044,9 @@ error: * Returns 0 in case of success, -1 in case of error. */ int -xenDaemonOpen(virConnectPtr conn, xmlURIPtr uri, +xenDaemonOpen(virConnectPtr conn, + xmlURIPtr uri, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { int ret; diff -r ec2d8c632fd9 src/xend_internal.h --- a/src/xend_internal.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xend_internal.h Wed Nov 28 20:35:24 2007 -0500 @@ -183,7 +183,7 @@ char *xenDaemonDomainDumpXMLByName(virCo char *xend_parse_domain_sexp(virConnectPtr conn, char *root, int xendConfigVersion); /* refactored ones */ -int xenDaemonOpen(virConnectPtr conn, xmlURIPtr uri, int flags); +int xenDaemonOpen(virConnectPtr conn, xmlURIPtr uri, virConnectAuthPtr auth, int flags); int xenDaemonClose(virConnectPtr conn); int xenDaemonGetVersion(virConnectPtr conn, unsigned long *hvVer); int xenDaemonNodeGetInfo(virConnectPtr conn, virNodeInfoPtr info); diff -r ec2d8c632fd9 src/xm_internal.c --- a/src/xm_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xm_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -473,7 +473,9 @@ static int xenXMConfigCacheRefresh (virC */ int xenXMOpen (virConnectPtr conn ATTRIBUTE_UNUSED, - xmlURIPtr uri ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) + xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, + int flags ATTRIBUTE_UNUSED) { if (configCache == NULL) { configCache = virHashCreate(50); diff -r ec2d8c632fd9 src/xm_internal.h --- a/src/xm_internal.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xm_internal.h Wed Nov 28 20:35:24 2007 -0500 @@ -36,7 +36,7 @@ extern struct xenUnifiedDriver xenXMDriv extern struct xenUnifiedDriver xenXMDriver; int xenXMInit (void); -int xenXMOpen(virConnectPtr conn, xmlURIPtr uri, int flags); +int xenXMOpen(virConnectPtr conn, xmlURIPtr uri, virConnectAuthPtr auth, int flags); int xenXMClose(virConnectPtr conn); const char *xenXMGetType(virConnectPtr conn); int xenXMDomainGetInfo(virDomainPtr domain, virDomainInfoPtr info); diff -r ec2d8c632fd9 src/xs_internal.c --- a/src/xs_internal.c Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xs_internal.c Wed Nov 28 20:35:24 2007 -0500 @@ -327,6 +327,7 @@ int int xenStoreOpen(virConnectPtr conn, xmlURIPtr uri ATTRIBUTE_UNUSED, + virConnectAuthPtr auth ATTRIBUTE_UNUSED, int flags ATTRIBUTE_UNUSED) { xenUnifiedPrivatePtr priv = (xenUnifiedPrivatePtr) conn->privateData; @@ -334,7 +335,7 @@ xenStoreOpen(virConnectPtr conn, #ifdef PROXY priv->xshandle = xs_daemon_open_readonly(); #else - if (flags & VIR_DRV_OPEN_RO) + if (flags & VIR_CONNECT_RO) priv->xshandle = xs_daemon_open_readonly(); else priv->xshandle = xs_daemon_open(); diff -r ec2d8c632fd9 src/xs_internal.h --- a/src/xs_internal.h Wed Nov 28 15:00:45 2007 -0500 +++ b/src/xs_internal.h Wed Nov 28 20:35:24 2007 -0500 @@ -22,6 +22,7 @@ int xenStoreInit (void); int xenStoreOpen (virConnectPtr conn, xmlURIPtr uri, + virConnectAuthPtr auth, int flags); int xenStoreClose (virConnectPtr conn); int xenStoreGetDomainInfo (virDomainPtr domain, -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

This adds a binding for the virConnectOpenAuth() api in the python API. This allows a python function to be used as the callback. This short example code illustrates the use of the API from a python app which wants to support username/password credentials only. from getpass import getpass mydata = "Hello" def getCred(creds, data): print "yes" print str(creds) for cred in creds: print cred[1] + ": ", if cred[0] == libvirt.VIR_CRED_AUTHNAME: data = sys.stdin.readline() data = data[0:len(data)-1] cred[4] = data elif cred[0] == libvirt.VIR_CRED_PASSPHRASE: cred[4] = getpass("") else: return -1 return 0 uri = "qemu+tcp://localhost/system" conn = libvirt.openAuth(uri, [[libvirt.VIR_CRED_AUTHNAME, libvirt.VIR_CRED_PASSPHRASE], getCred, mydata], 0) print str(conn.listDefinedDomains()) python/libvir.c | 119 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ python/libvir.py | 6 ++ src/qemu_conf.c | 8 +-- 3 files changed, 129 insertions(+), 4 deletions(-) diff -r 8a79678f789f python/libvir.c --- a/python/libvir.c Wed Nov 28 23:01:30 2007 -0500 +++ b/python/libvir.c Wed Nov 28 23:29:40 2007 -0500 @@ -241,6 +241,124 @@ libvirt_virRegisterErrorHandler(ATTRIBUT return (py_retval); } +static int virConnectCredCallbackWrapper(virConnectCredentialPtr cred, + unsigned int ncred, + void *cbdata) { + PyObject *list; + PyObject *pycred; + PyObject *pyauth = (PyObject *)cbdata; + PyObject *pycbdata; + PyObject *pycb; + PyObject *pyret; + int ret = -1, i; + + LIBVIRT_ENSURE_THREAD_STATE; + + pycb = PyList_GetItem(pyauth, 1); + pycbdata = PyList_GetItem(pyauth, 2); + + list = PyTuple_New(2); + pycred = PyTuple_New(ncred); + for (i = 0 ; i < ncred ; i++) { + PyObject *pycreditem; + pycreditem = PyList_New(5); + Py_INCREF(Py_None); + PyTuple_SetItem(pycred, i, pycreditem); + PyList_SetItem(pycreditem, 0, PyInt_FromLong((long) cred[i].type)); + PyList_SetItem(pycreditem, 1, PyString_FromString(cred[i].prompt)); + if (cred[i].challenge) { + PyList_SetItem(pycreditem, 2, PyString_FromString(cred[i].challenge)); + } else { + Py_INCREF(Py_None); + PyList_SetItem(pycreditem, 2, Py_None); + } + if (cred[i].defresult) { + PyList_SetItem(pycreditem, 3, PyString_FromString(cred[i].defresult)); + } else { + Py_INCREF(Py_None); + PyList_SetItem(pycreditem, 3, Py_None); + } + PyList_SetItem(pycreditem, 4, Py_None); + } + + PyTuple_SetItem(list, 0, pycred); + Py_XINCREF(pycbdata); + PyTuple_SetItem(list, 1, pycbdata); + + PyErr_Clear(); + pyret = PyEval_CallObject(pycb, list); + if (PyErr_Occurred()) + goto cleanup; + + ret = PyLong_AsLong(pyret); + if (ret == 0) { + for (i = 0 ; i < ncred ; i++) { + PyObject *pycreditem; + PyObject *pyresult; + char *result = NULL; + pycreditem = PyTuple_GetItem(pycred, i); + pyresult = PyList_GetItem(pycreditem, 4); + if (pyresult != Py_None) + result = PyString_AsString(pyresult); + if (result != NULL) { + cred[i].result = strdup(result); + cred[i].resultlen = strlen(result); + } else { + cred[i].result = NULL; + cred[i].resultlen = 0; + } + } + } + + cleanup: + Py_XDECREF(list); + Py_XDECREF(pyret); + + LIBVIRT_RELEASE_THREAD_STATE; + + return ret; +} + + +static PyObject * +libvirt_virConnectOpenAuth(PyObject *self ATTRIBUTE_UNUSED, PyObject *args) { + PyObject *py_retval; + virConnectPtr c_retval; + char * name; + int flags; + PyObject *pyauth; + PyObject *pycredcb; + PyObject *pycredtype; + virConnectAuth auth; + + if (!PyArg_ParseTuple(args, (char *)"zOi:virConnectOpenAuth", &name, &pyauth, &flags)) + return(NULL); + + pycredtype = PyList_GetItem(pyauth, 0); + pycredcb = PyList_GetItem(pyauth, 1); + + auth.ncredtype = PyList_Size(pycredtype); + if (auth.ncredtype) { + int i; + auth.credtype = malloc(sizeof(int) * auth.ncredtype); + for (i = 0 ; i < auth.ncredtype ; i++) { + PyObject *val; + val = PyList_GetItem(pycredtype, i); + auth.credtype[i] = (int)PyLong_AsLong(val); + } + } + auth.cb = pycredcb ? virConnectCredCallbackWrapper : NULL; + auth.cbdata = pyauth; + + LIBVIRT_BEGIN_ALLOW_THREADS; + + c_retval = virConnectOpenAuth(name, &auth, flags); + LIBVIRT_END_ALLOW_THREADS; + py_retval = libvirt_virConnectPtrWrap((virConnectPtr) c_retval); + return(py_retval); +} + + /************************************************************************ * * * Wrappers for functions where generator fails * @@ -729,6 +847,7 @@ static PyMethodDef libvirtMethods[] = { #include "libvirt-export.c" {(char *) "virGetVersion", libvirt_virGetVersion, METH_VARARGS, NULL}, {(char *) "virDomainFree", libvirt_virDomainFree, METH_VARARGS, NULL}, + {(char *) "virConnectOpenAuth", libvirt_virConnectOpenAuth, METH_VARARGS, NULL}, {(char *) "virConnectClose", libvirt_virConnectClose, METH_VARARGS, NULL}, {(char *) "virConnectListDomainsID", libvirt_virConnectListDomainsID, METH_VARARGS, NULL}, {(char *) "virConnectListDefinedDomains", libvirt_virConnectListDefinedDomains, METH_VARARGS, NULL}, diff -r 8a79678f789f python/libvir.py --- a/python/libvir.py Wed Nov 28 23:01:30 2007 -0500 +++ b/python/libvir.py Wed Nov 28 23:29:40 2007 -0500 @@ -83,6 +83,12 @@ def registerErrorHandler(f, ctx): Returns 1 in case of success.""" return libvirtmod.virRegisterErrorHandler(f,ctx) +def openAuth(uri, auth, flags): + ret = libvirtmod.virConnectOpenAuth(uri, auth, flags) + if ret is None:raise libvirtError('virConnectOpenAuth() failed') + return virConnect(_obj=ret) + + # # Return library version. # diff -r 8a79678f789f src/qemu_conf.c --- a/src/qemu_conf.c Wed Nov 28 23:01:30 2007 -0500 +++ b/src/qemu_conf.c Wed Nov 28 23:29:40 2007 -0500 @@ -2667,7 +2667,7 @@ checkLinkPointsTo(const char *checkLink, char *p; strncpy(dir, checkLink, PATH_MAX); - dir[PATH_MAX] = '\0'; + dir[PATH_MAX-1] = '\0'; if (!(p = strrchr(dir, '/'))) { qemudLog(QEMUD_WARN, "Symlink path '%s' is not absolute", checkLink); @@ -2685,7 +2685,7 @@ checkLinkPointsTo(const char *checkLink, } strncpy(dest, tmp, PATH_MAX); - dest[PATH_MAX] = '\0'; + dest[PATH_MAX-1] = '\0'; } /* canonicalize both paths */ @@ -2693,14 +2693,14 @@ checkLinkPointsTo(const char *checkLink, qemudLog(QEMUD_WARN, "Failed to expand path '%s' :%s", dest, strerror(errno)); strncpy(real, dest, PATH_MAX); - real[PATH_MAX] = '\0'; + real[PATH_MAX-1] = '\0'; } if (!realpath(checkDest, checkReal)) { qemudLog(QEMUD_WARN, "Failed to expand path '%s' :%s", checkDest, strerror(errno)); strncpy(checkReal, checkDest, PATH_MAX); - checkReal[PATH_MAX] = '\0'; + checkReal[PATH_MAX-1] = '\0'; } /* compare */ -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

This patch will automatically disable the Xen setuid proxy if PolicyKit support is found to be enabled. It is possible to override this and force use of the proxy with --with-xen-proxy. Likewise it is possible to force disabling the proxy with the --without-xen-proxy arg. configure.in | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff -r 87b465795305 configure.in --- a/configure.in Thu Nov 29 10:02:55 2007 -0500 +++ b/configure.in Thu Nov 29 10:23:48 2007 -0500 @@ -571,7 +571,24 @@ fi fi dnl Enable building the proxy? -AM_CONDITIONAL(WITH_PROXY,[test "x$with_xen" = "xyes"]) + +AC_ARG_WITH(xen-proxy, +[ --with-xen-proxy add XEN setuid proxy support (on)],[],[with_xen_proxy=auto]) + +AC_MSG_CHECKING([if Xen setuid proxy is needed]) +if test "$with_xen_proxy" = "auto"; then + if test "$with_polkit" = "yes"; then + with_xen_proxy="no" + else + with_xen_proxy="yes" + fi +fi +if test "$with_xen" != "yes"; then + with_xen_proxy="no" +fi +AC_MSG_RESULT([$with_xen_proxy]) + +AM_CONDITIONAL(WITH_PROXY,[test "$with_xen_proxy" = "yes"]) dnl Check for gettext AM_GNU_GETTEXT_VERSION([0.14.1]) @@ -609,6 +626,7 @@ AC_MSG_NOTICE([Drivers]) AC_MSG_NOTICE([Drivers]) AC_MSG_NOTICE([]) AC_MSG_NOTICE([ Xen: $with_xen]) +AC_MSG_NOTICE([ Proxy: $with_xen_proxy]) AC_MSG_NOTICE([ QEMU: $with_qemu]) AC_MSG_NOTICE([ OpenVZ: $with_openvz]) AC_MSG_NOTICE([ Test: $with_test]) -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

Daniel P. Berrange wrote: All ACKed except: Don't we need to dup these strings because the following xdr_free (in the caller) will free them? Rich. -- Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/ Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 03798903

On Thu, Nov 29, 2007 at 05:28:07PM +0000, Richard W.M. Jones wrote: No, all the params to __virRaiseError, get strdup'd inside virRaiseError before being stored in the virError object. /* * Save the information about the error */ virResetError(to); to->conn = conn; to->dom = dom; to->net = net; to->domain = domain; to->code = code; to->message = str; to->level = level; if (str1 != NULL) to->str1 = strdup(str1); if (str2 != NULL) to->str2 = strdup(str2); if (str3 != NULL) to->str3 = strdup(str3); to->int1 = int1; to->int2 = int2; And the 'msg' arg gets re-allocated as the va-args are procssed with vsnprintf, so there's no need for the virRaiseError caller to strdup stuff itself Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

On Thu, Nov 29, 2007 at 05:16:34PM +0000, Daniel P. Berrange wrote: Updated to add constants for getnameinfo() params as Jim suggested. Also remove the dep on cyrus-sasl-gssapi, and add one on cyrus-sasl-md5 diff -r e24d542af4fb configure.in --- a/configure.in Fri Nov 30 14:31:10 2007 -0500 +++ b/configure.in Fri Nov 30 15:32:16 2007 -0500 @@ -360,6 +360,40 @@ AC_CHECK_TYPE(gnutls_session, [#include <gnutls/gnutls.h>]) CFLAGS="$old_cflags" LDFLAGS="$old_ldflags" + + +dnl Cyrus SASL +AC_ARG_WITH(sasl, + [ --with-sasl use cyrus SASL for authentication], + [], + [with_sasl=yes]) + +SASL_CFLAGS= +SASL_LIBS= +if test "$with_sasl" != "no"; then + if test "$with_sasl" != "yes"; then + SASL_CFLAGS="-I$with_sasl" + SASL_LIBS="-L$with_sasl" + fi + old_cflags="$CFLAGS" + old_libs="$LIBS" + CFLAGS="$CFLAGS $SASL_CFLAGS" + LIBS="$LIBS $SASL_LIBS" + AC_CHECK_HEADER([sasl/sasl.h], + [], + AC_MSG_ERROR([You must install the Cyrus SASL development package in order to compile libvirt])) + AC_CHECK_LIB(sasl2, sasl_client_init, + [], + [AC_MSG_ERROR([You must install the Cyrus SASL library in order to compile and run libvirt])]) + CFLAGS="$old_cflags" + LIBS="$old_libs" + SASL_LIBS="$SASL_LIBS -lsasl2" + AC_DEFINE_UNQUOTED(HAVE_SASL, 1, [whether Cyrus SASL is available for authentication]) +fi +AM_CONDITIONAL(HAVE_SASL, [test "$with_sasl" != "no"]) +AC_SUBST(SASL_CFLAGS) +AC_SUBST(SASL_LIBS) + dnl Avahi library @@ -590,6 +624,11 @@ AC_MSG_NOTICE([]) AC_MSG_NOTICE([]) AC_MSG_NOTICE([ libxml: $LIBXML_CFLAGS $LIBXML_LIBS]) AC_MSG_NOTICE([ gnutls: $GNUTLS_CFLAGS $GNUTLS_LIBS]) +if test "$with_sasl" != "no" ; then +AC_MSG_NOTICE([ sasl: $SASL_CFLAGS $SASL_LIBS]) +else +AC_MSG_NOTICE([ sasl: no]) +fi if test "$with_avahi" = "yes" ; then AC_MSG_NOTICE([ avahi: $AVAHI_CFLAGS $AVAHI_LIBS]) else diff -r e24d542af4fb include/libvirt/virterror.h --- a/include/libvirt/virterror.h Fri Nov 30 14:31:10 2007 -0500 +++ b/include/libvirt/virterror.h Fri Nov 30 15:32:16 2007 -0500 @@ -131,6 +131,7 @@ typedef enum { VIR_ERR_NO_DOMAIN, /* domain not found or unexpectedly disappeared */ VIR_ERR_NO_NETWORK, /* network not found */ VIR_ERR_INVALID_MAC, /* invalid MAC adress */ + VIR_ERR_AUTH_FAILED, /* authentication failed */ } virErrorNumber; /** diff -r e24d542af4fb libvirt.spec.in --- a/libvirt.spec.in Fri Nov 30 14:31:10 2007 -0500 +++ b/libvirt.spec.in Fri Nov 30 15:32:16 2007 -0500 @@ -16,6 +16,10 @@ Requires: dnsmasq Requires: dnsmasq Requires: bridge-utils Requires: iptables +Requires: cyrus-sasl +# Not technically required, but makes 'out-of-box' config +# work correctly & doesn't have onerous dependancies +Requires: cyrus-sasl-md5 BuildRequires: xen-devel BuildRequires: libxml2-devel BuildRequires: readline-devel @@ -26,6 +30,7 @@ BuildRequires: dnsmasq BuildRequires: dnsmasq BuildRequires: bridge-utils BuildRequires: qemu +BuildRequires: cyrus-sasl-devel Obsoletes: libvir ExclusiveArch: i386 x86_64 ia64 @@ -132,6 +137,7 @@ fi %config(noreplace) %{_sysconfdir}/sysconfig/libvirtd %config(noreplace) %{_sysconfdir}/libvirt/libvirtd.conf %config(noreplace) %{_sysconfdir}/libvirt/qemu.conf +%config(noreplace) %{_sysconfdir}/sasl2/libvirt.conf %dir %{_datadir}/libvirt/ %dir %{_datadir}/libvirt/networks/ %{_datadir}/libvirt/networks/default.xml diff -r e24d542af4fb qemud/Makefile.am --- a/qemud/Makefile.am Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/Makefile.am Fri Nov 30 15:32:16 2007 -0500 @@ -17,6 +17,7 @@ EXTRA_DIST = libvirtd.init.in libvirtd.s remote_dispatch_localvars.h \ remote_dispatch_proc_switch.h \ mdns.c mdns.h \ + libvirtd.sasl \ $(conf_DATA) libvirtd_SOURCES = \ @@ -28,14 +29,14 @@ libvirtd_SOURCES = \ #-D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_POSIX_C_SOURCE=199506L libvirtd_CFLAGS = \ -I$(top_srcdir)/include -I$(top_builddir)/include \ - $(LIBXML_CFLAGS) $(GNUTLS_CFLAGS) \ + $(LIBXML_CFLAGS) $(GNUTLS_CFLAGS) $(SASL_CFLAGS) \ $(WARN_CFLAGS) -DLOCAL_STATE_DIR="\"$(localstatedir)\"" \ -DSYSCONF_DIR="\"$(sysconfdir)\"" \ -DQEMUD_PID_FILE="\"$(QEMUD_PID_FILE)\"" \ -DREMOTE_PID_FILE="\"$(REMOTE_PID_FILE)\"" \ -DGETTEXT_PACKAGE=\"$(PACKAGE)\" -libvirtd_LDFLAGS = $(WARN_CFLAGS) $(LIBXML_LIBS) $(GNUTLS_LIBS) +libvirtd_LDFLAGS = $(WARN_CFLAGS) $(LIBXML_LIBS) $(GNUTLS_LIBS) $(SASL_LIBS) libvirtd_DEPENDENCIES = ../src/libvirt.la libvirtd_LDADD = ../src/libvirt.la @@ -46,7 +47,7 @@ endif endif default_xml_dest = libvirt/qemu/networks/default.xml -install-data-local: install-init +install-data-local: install-init install-data-sasl mkdir -p $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart $(INSTALL_DATA) $(srcdir)/default-network.xml \ $(DESTDIR)$(sysconfdir)/$(default_xml_dest) @@ -59,7 +60,7 @@ install-data-local: install-init mkdir -p $(DESTDIR)$(localstatedir)/run/libvirt mkdir -p $(DESTDIR)$(localstatedir)/lib/libvirt -uninstall-local: uninstall-init +uninstall-local:: uninstall-init uninstall-data-sasl rm -f $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart/default.xml rm -f $(DESTDIR)$(sysconfdir)/$(default_xml_dest) rmdir $(DESTDIR)$(sysconfdir)/libvirt/qemu/networks/autostart || : @@ -67,6 +68,18 @@ uninstall-local: uninstall-init rmdir $(DESTDIR)$(localstatedir)/run/libvirt || : rmdir $(DESTDIR)$(localstatedir)/lib/libvirt || : +if HAVE_SASL +install-data-sasl:: install-init + mkdir -p $(DESTDIR)$(sysconfdir)/sasl2/ + $(INSTALL_DATA) $(srcdir)/libvirtd.sasl $(DESTDIR)$(sysconfdir)/sasl2/libvirt.conf + +uninstall-data-sasl:: install-init + rm -f $(DESTDIR)$(sysconfdir)/sasl2/libvirt.conf + rmdir $(DESTDIR)$(sysconfdir)/sasl2/ +else +install-data-sasl: +uninstall-data-sasl: +endif if RPCGEN .x.c: diff -r e24d542af4fb qemud/internal.h --- a/qemud/internal.h Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/internal.h Fri Nov 30 15:32:16 2007 -0500 @@ -28,6 +28,9 @@ #include <gnutls/gnutls.h> #include <gnutls/x509.h> #include "../src/gnutls_1_0_compat.h" +#if HAVE_SASL +#include <sasl/sasl.h> +#endif #ifdef HAVE_SYS_SYSLIMITS_H #include <sys/syslimits.h> @@ -91,6 +94,10 @@ struct qemud_client { int tls; gnutls_session_t session; enum qemud_tls_direction direction; + int auth; +#if HAVE_SASL + sasl_conn_t *saslconn; +#endif unsigned int incomingSerial; unsigned int outgoingSerial; @@ -116,6 +123,7 @@ struct qemud_socket { int readonly; /* If set, TLS is required on this socket. */ int tls; + int auth; int port; struct qemud_socket *next; }; diff -r e24d542af4fb qemud/libvirtd.init.in --- a/qemud/libvirtd.init.in Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/libvirtd.init.in Fri Nov 30 15:32:16 2007 -0500 @@ -37,6 +37,7 @@ PROCESS=libvirtd LIBVIRTD_CONFIG= LIBVIRTD_ARGS= +KRB5_KTNAME=/etc/libvirt/krb5.tab test -f @sysconfdir@/sysconfig/libvirtd && . @sysconfdir@/sysconfig/libvirtd @@ -50,7 +51,7 @@ RETVAL=0 start() { echo -n $"Starting $SERVICE daemon: " - daemon --check $SERVICE $PROCESS --daemon $LIBVIRTD_CONFIG_ARGS $LIBVIRTD_ARGS + KRB5_KTNAME=$KRB5_KTNAME daemon --check $SERVICE $PROCESS --daemon $LIBVIRTD_CONFIG_ARGS $LIBVIRTD_ARGS RETVAL=$? echo [ $RETVAL -eq 0 ] && touch @localstatedir@/lock/subsys/$SERVICE diff -r e24d542af4fb qemud/libvirtd.sasl --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/qemud/libvirtd.sasl Fri Nov 30 15:32:16 2007 -0500 @@ -0,0 +1,28 @@ +# If you want to use the non-TLS socket, then you *must* include +# the GSSAPI or DIGEST-MD5 mechanisms, because they are the only +# ones that can offer session encryption as well as authentication. +# +# If you're only using TLS, then you can turn on any mechanisms +# you like for authentication, because TLS provides the encryption +# +# Default to a simple username+password mechanism +mech_list: digest-md5 + +# Before you can use GSSAPI, you need a service principle on the +# KDC server for libvirt, and that to be exported to the keytab +# file listed below +#mech_list: gssapi +# +# You can also list many mechanisms at once, then the user can choose +# by adding '?auth=sasl.gssapi' to their libvirt URI, eg +# qemu+tcp://hostname/system?auth=sasl.gssapi +#mech_list: digest-md5 gssapi + +# MIT kerberos ignores this option & needs KRB5_KTNAME env var. +# May be useful for other non-Linux OS though.... +keytab: /etc/libvirt/krb5.tab + +# If using digest-md5 for username/passwds, then this is the file +# containing the passwds. Use 'saslpasswd2 -a libvirt [username]' +# to add entries, and 'sasldblistusers2 -a libvirt' to browse it +sasldb_path: /etc/libvirt/passwd.db diff -r e24d542af4fb qemud/libvirtd.sysconf --- a/qemud/libvirtd.sysconf Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/libvirtd.sysconf Fri Nov 30 15:32:16 2007 -0500 @@ -4,3 +4,6 @@ # Listen for TCP/IP connections # NB. must setup TLS/SSL keys prior to using this #LIBVIRTD_ARGS="--listen" + +# Override Kerberos service keytab for SASL/GSSAPI +#KRB5_KTNAME=/etc/libvirt/krb5.tab diff -r e24d542af4fb qemud/qemud.c --- a/qemud/qemud.c Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/qemud.c Fri Nov 30 15:32:16 2007 -0500 @@ -577,7 +577,8 @@ static int static int remoteListenTCP (struct qemud_server *server, const char *port, - int tls) + int tls, + int auth) { int fds[2]; int nfds = 0; @@ -606,6 +607,7 @@ remoteListenTCP (struct qemud_server *se sock->fd = fds[i]; sock->tls = tls; + sock->auth = auth; if (getsockname(sock->fd, (struct sockaddr *)(&sa), &salen) < 0) return -1; @@ -701,6 +703,9 @@ static struct qemud_server *qemudInitial struct qemud_socket *sock; char sockname[PATH_MAX]; char roSockname[PATH_MAX]; +#if HAVE_SASL + int err; +#endif /* HAVE_SASL */ if (!(server = calloc(1, sizeof(struct qemud_server)))) { qemudLog(QEMUD_ERR, "Failed to allocate struct qemud_server"); @@ -730,15 +735,28 @@ static struct qemud_server *qemudInitial virStateInitialize(); +#if HAVE_SASL + if ((err = sasl_server_init(NULL, "libvirt")) != SASL_OK) { + qemudLog(QEMUD_ERR, "Failed to initialize SASL authentication %s", + sasl_errstring(err, NULL, NULL)); + goto cleanup; + } +#endif + if (ipsock) { - if (listen_tcp && remoteListenTCP (server, tcp_port, 0) < 0) +#if HAVE_SASL + if (listen_tcp && remoteListenTCP (server, tcp_port, 0, REMOTE_AUTH_SASL) < 0) goto cleanup; +#else + if (listen_tcp && remoteListenTCP (server, tcp_port, 0, REMOTE_AUTH_NONE) < 0) + goto cleanup; +#endif if (listen_tls) { if (remoteInitializeGnuTLS () < 0) goto cleanup; - if (remoteListenTCP (server, tls_port, 1) < 0) + if (remoteListenTCP (server, tls_port, 1, REMOTE_AUTH_NONE) < 0) goto cleanup; } } @@ -1050,6 +1068,7 @@ static int qemudDispatchServer(struct qe client->fd = fd; client->readonly = sock->readonly; client->tls = sock->tls; + client->auth = sock->auth; memcpy (&client->addr, &addr, sizeof addr); client->addrlen = addrlen; @@ -1130,6 +1149,9 @@ static void qemudDispatchClientFailure(s if (client->conn) virConnectClose(client->conn); +#if HAVE_SASL + if (client->saslconn) sasl_dispose(&client->saslconn); +#endif if (client->tls && client->session) gnutls_deinit (client->session); close(client->fd); free(client); diff -r e24d542af4fb qemud/remote.c --- a/qemud/remote.c Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/remote.c Fri Nov 30 15:32:16 2007 -0500 @@ -52,6 +52,8 @@ #define DEBUG 0 +#define REMOTE_DEBUG(fmt,...) qemudDebug("REMOTE: " fmt, __VA_ARGS__) + static void remoteDispatchError (struct qemud_client *client, remote_message_header *req, const char *fmt, ...) @@ -116,6 +118,21 @@ remoteDispatchClientRequest (struct qemu (int) req.status); xdr_destroy (&xdr); return; + } + + /* If client is marked as needing auth, don't allow any RPC ops, + * except for authentication ones + */ + if (client->auth) { + if (req.proc != REMOTE_PROC_AUTH_LIST && + req.proc != REMOTE_PROC_AUTH_SASL_INIT && + req.proc != REMOTE_PROC_AUTH_SASL_START && + req.proc != REMOTE_PROC_AUTH_SASL_STEP + ) { + remoteDispatchError (client, &req, "authentication required"); + xdr_destroy (&xdr); + return; + } } /* Based on the procedure number, dispatch. In future we may base @@ -275,23 +292,14 @@ remoteDispatchClientRequest (struct qemu * reply. */ static void -remoteDispatchError (struct qemud_client *client, - remote_message_header *req, - const char *fmt, ...) +remoteDispatchSendError (struct qemud_client *client, + remote_message_header *req, + int code, const char *msg) { remote_message_header rep; remote_error error; - va_list args; - char msgbuf[1024]; - char *msg = msgbuf; XDR xdr; int len; - - va_start (args, fmt); - vsnprintf (msgbuf, sizeof msgbuf, fmt, args); - va_end (args); - - qemudDebug ("%s", msgbuf); /* Future versions of the protocol may use different vers or prog. Try * our hardest to send back a message that such clients could see. @@ -313,12 +321,12 @@ remoteDispatchError (struct qemud_client } /* Construct the error. */ - error.code = VIR_ERR_RPC; + error.code = code; error.domain = VIR_FROM_REMOTE; - error.message = &msg; + error.message = (char**)&msg; error.level = VIR_ERR_ERROR; error.dom = NULL; - error.str1 = &msg; + error.str1 = (char**)&msg; error.str2 = NULL; error.str3 = NULL; error.int1 = 0; @@ -363,6 +371,31 @@ remoteDispatchError (struct qemud_client client->bufferOffset = 0; if (client->tls) client->direction = QEMUD_TLS_DIRECTION_WRITE; } + +static void +remoteDispatchFailAuth (struct qemud_client *client, + remote_message_header *req) +{ + remoteDispatchSendError (client, req, VIR_ERR_AUTH_FAILED, "authentication failed"); +} + +static void +remoteDispatchError (struct qemud_client *client, + remote_message_header *req, + const char *fmt, ...) +{ + va_list args; + char msgbuf[1024]; + char *msg = msgbuf; + + va_start (args, fmt); + vsnprintf (msgbuf, sizeof msgbuf, fmt, args); + va_end (args); + + remoteDispatchSendError (client, req, VIR_ERR_RPC, msg); +} + + /*----- Functions. -----*/ @@ -1946,6 +1979,335 @@ remoteDispatchNumOfNetworks (struct qemu return 0; } + +static int +remoteDispatchAuthList (struct qemud_client *client, + remote_message_header *req ATTRIBUTE_UNUSED, + void *args ATTRIBUTE_UNUSED, + remote_auth_list_ret *ret) +{ + ret->types.types_len = 1; + if ((ret->types.types_val = calloc (ret->types.types_len, sizeof (remote_auth_type))) == NULL) { + remoteDispatchSendError(client, req, VIR_ERR_NO_MEMORY, "auth types"); + return -2; + } + ret->types.types_val[0] = client->auth; + return 0; +} + + +#if HAVE_SASL +/* + * NB, keep in sync with similar method in src/remote_internal.c + */ +static char *addrToString(struct qemud_client *client, + remote_message_header *req, + struct sockaddr_storage *sa, socklen_t salen) { + char host[1024], port[20]; + char *addr; + int err; + + if ((err = getnameinfo((struct sockaddr *)sa, salen, + host, sizeof(host), + port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { + remoteDispatchError(client, req, + "Cannot resolve address %d: %s", err, gai_strerror(err)); + return NULL; + } + + addr = malloc(strlen(host) + 1 + strlen(port) + 1); + if (!addr) { + remoteDispatchError(client, req, "cannot allocate address"); + return NULL; + } + + strcpy(addr, host); + strcat(addr, ";"); + strcat(addr, port); + return addr; +} + + +/* + * Initializes the SASL session in prepare for authentication + * and gives the client a list of allowed mechansims to choose + * + * XXX callbacks for stuff like password verification ? + */ +static int +remoteDispatchAuthSaslInit (struct qemud_client *client, + remote_message_header *req, + void *args ATTRIBUTE_UNUSED, + remote_auth_sasl_init_ret *ret) +{ + const char *mechlist = NULL; + int err; + struct sockaddr_storage sa; + socklen_t salen; + char *localAddr, *remoteAddr; + + REMOTE_DEBUG("Initialize SASL auth %d", client->fd); + if (client->auth != REMOTE_AUTH_SASL || + client->saslconn != NULL) { + qemudLog(QEMUD_ERR, "client tried invalid SASL init request"); + remoteDispatchFailAuth(client, req); + return -2; + } + + /* Get local address in form IPADDR:PORT */ + salen = sizeof(sa); + if (getsockname(client->fd, (struct sockaddr*)&sa, &salen) < 0) { + remoteDispatchError(client, req, "failed to get sock address %d (%s)", + errno, strerror(errno)); + return -2; + } + if ((localAddr = addrToString(client, req, &sa, salen)) == NULL) { + return -2; + } + + /* Get remote address in form IPADDR:PORT */ + salen = sizeof(sa); + if (getpeername(client->fd, (struct sockaddr*)&sa, &salen) < 0) { + remoteDispatchError(client, req, "failed to get peer address %d (%s)", + errno, strerror(errno)); + free(localAddr); + return -2; + } + if ((remoteAddr = addrToString(client, req, &sa, salen)) == NULL) { + free(localAddr); + return -2; + } + + err = sasl_server_new("libvirt", + NULL, /* FQDN - just delegates to gethostname */ + NULL, /* User realm */ + localAddr, + remoteAddr, + NULL, /* XXX Callbacks */ + SASL_SUCCESS_DATA, + &client->saslconn); + free(localAddr); + free(remoteAddr); + if (err != SASL_OK) { + qemudLog(QEMUD_ERR, "sasl context setup failed %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + remoteDispatchFailAuth(client, req); + client->saslconn = NULL; + return -2; + } + + err = sasl_listmech(client->saslconn, + NULL, /* Don't need to set user */ + "", /* Prefix */ + ",", /* Separator */ + "", /* Suffix */ + &mechlist, + NULL, + NULL); + if (err != SASL_OK) { + qemudLog(QEMUD_ERR, "cannot list SASL mechanisms %d (%s)", + err, sasl_errdetail(client->saslconn)); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -2; + } + REMOTE_DEBUG("Available mechanisms for client: '%s'", mechlist); + ret->mechlist = strdup(mechlist); + if (!ret->mechlist) { + qemudLog(QEMUD_ERR, "cannot allocate mechlist"); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -2; + } + + return 0; +} + + +/* + * This starts the SASL authentication negotiation. + */ +static int +remoteDispatchAuthSaslStart (struct qemud_client *client, + remote_message_header *req, + remote_auth_sasl_start_args *args, + remote_auth_sasl_start_ret *ret) +{ + const char *serverout; + unsigned int serveroutlen; + int err; + + REMOTE_DEBUG("Start SASL auth %d", client->fd); + if (client->auth != REMOTE_AUTH_SASL || + client->saslconn == NULL) { + qemudLog(QEMUD_ERR, "client tried invalid SASL start request"); + remoteDispatchFailAuth(client, req); + return -2; + } + + REMOTE_DEBUG("Using SASL mechanism %s. Data %d bytes, nil: %d", + args->mech, args->data.data_len, args->nil); + err = sasl_server_start(client->saslconn, + args->mech, + /* NB, distinction of NULL vs "" is *critical* in SASL */ + args->nil ? NULL : args->data.data_val, + args->data.data_len, + &serverout, + &serveroutlen); + if (err != SASL_OK && + err != SASL_CONTINUE) { + qemudLog(QEMUD_ERR, "sasl start failed %d (%s)", + err, sasl_errdetail(client->saslconn)); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + remoteDispatchFailAuth(client, req); + return -2; + } + if (serveroutlen > REMOTE_AUTH_SASL_DATA_MAX) { + qemudLog(QEMUD_ERR, "sasl start reply data too long %d", serveroutlen); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + remoteDispatchFailAuth(client, req); + return -2; + } + + /* NB, distinction of NULL vs "" is *critical* in SASL */ + if (serverout) { + ret->data.data_val = malloc(serveroutlen); + if (!ret->data.data_val) { + remoteDispatchError (client, req, "out of memory allocating array"); + return -2; + } + memcpy(ret->data.data_val, serverout, serveroutlen); + } else { + ret->data.data_val = NULL; + } + ret->nil = serverout ? 0 : 1; + ret->data.data_len = serveroutlen; + + REMOTE_DEBUG("SASL return data %d bytes, nil; %d", ret->data.data_len, ret->nil); + if (err == SASL_CONTINUE) { + ret->complete = 0; + } else { + REMOTE_DEBUG("Authentication successful %d", client->fd); + ret->complete = 1; + client->auth = REMOTE_AUTH_NONE; + } + + return 0; +} + + +static int +remoteDispatchAuthSaslStep (struct qemud_client *client, + remote_message_header *req, + remote_auth_sasl_step_args *args, + remote_auth_sasl_step_ret *ret) +{ + const char *serverout; + unsigned int serveroutlen; + int err; + + REMOTE_DEBUG("Step SASL auth %d", client->fd); + if (client->auth != REMOTE_AUTH_SASL || + client->saslconn == NULL) { + qemudLog(QEMUD_ERR, "client tried invalid SASL start request"); + remoteDispatchFailAuth(client, req); + return -2; + } + + REMOTE_DEBUG("Using SASL Data %d bytes, nil: %d", + args->data.data_len, args->nil); + err = sasl_server_step(client->saslconn, + /* NB, distinction of NULL vs "" is *critical* in SASL */ + args->nil ? NULL : args->data.data_val, + args->data.data_len, + &serverout, + &serveroutlen); + if (err != SASL_OK && + err != SASL_CONTINUE) { + qemudLog(QEMUD_ERR, "sasl step failed %d (%s)", + err, sasl_errdetail(client->saslconn)); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + remoteDispatchFailAuth(client, req); + return -2; + } + + if (serveroutlen > REMOTE_AUTH_SASL_DATA_MAX) { + qemudLog(QEMUD_ERR, "sasl step reply data too long %d", serveroutlen); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + remoteDispatchFailAuth(client, req); + return -2; + } + + /* NB, distinction of NULL vs "" is *critical* in SASL */ + if (serverout) { + ret->data.data_val = malloc(serveroutlen); + if (!ret->data.data_val) { + remoteDispatchError (client, req, "out of memory allocating array"); + return -2; + } + memcpy(ret->data.data_val, serverout, serveroutlen); + } else { + ret->data.data_val = NULL; + } + ret->nil = serverout ? 0 : 1; + ret->data.data_len = serveroutlen; + + REMOTE_DEBUG("SASL return data %d bytes, nil; %d", ret->data.data_len, ret->nil); + if (err == SASL_CONTINUE) { + ret->complete = 0; + } else { + REMOTE_DEBUG("Authentication successful %d", client->fd); + ret->complete = 1; + client->auth = REMOTE_AUTH_NONE; + } + + return 0; +} + + +#else /* HAVE_SASL */ +static int +remoteDispatchAuthSaslInit (struct qemud_client *client, + remote_message_header *req, + void *args ATTRIBUTE_UNUSED, + remote_auth_sasl_init_ret *ret ATTRIBUTE_UNUSED) +{ + qemudLog(QEMUD_ERR, "client tried unsupported SASL init request"); + remoteDispatchFailAuth(client, req); + return -1; +} + +static int +remoteDispatchAuthSaslStart (struct qemud_client *client, + remote_message_header *req, + remote_auth_sasl_start_args *args ATTRIBUTE_UNUSED, + remote_auth_sasl_start_ret *ret ATTRIBUTE_UNUSED) +{ + qemudLog(QEMUD_ERR, "client tried unsupported SASL start request"); + remoteDispatchFailAuth(client, req); + return -1; +} + +static int +remoteDispatchAuthSaslStep (struct qemud_client *client, + remote_message_header *req, + remote_auth_sasl_step_args *args ATTRIBUTE_UNUSED, + remote_auth_sasl_step_ret *ret ATTRIBUTE_UNUSED) +{ + qemudLog(QEMUD_ERR, "client tried unsupported SASL step request"); + remoteDispatchFailAuth(client, req); + return -1; +} +#endif /* HAVE_SASL */ + + /*----- Helpers. -----*/ /* get_nonnull_domain and get_nonnull_network turn an on-wire diff -r e24d542af4fb qemud/remote_dispatch_localvars.h --- a/qemud/remote_dispatch_localvars.h Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/remote_dispatch_localvars.h Fri Nov 30 15:32:16 2007 -0500 @@ -9,6 +9,7 @@ remote_list_defined_domains_ret lv_remot remote_list_defined_domains_ret lv_remote_list_defined_domains_ret; remote_get_capabilities_ret lv_remote_get_capabilities_ret; remote_domain_set_max_memory_args lv_remote_domain_set_max_memory_args; +remote_auth_sasl_init_ret lv_remote_auth_sasl_init_ret; remote_domain_get_os_type_args lv_remote_domain_get_os_type_args; remote_domain_get_os_type_ret lv_remote_domain_get_os_type_ret; remote_domain_get_autostart_args lv_remote_domain_get_autostart_args; @@ -36,6 +37,8 @@ remote_domain_create_linux_args lv_remot remote_domain_create_linux_args lv_remote_domain_create_linux_args; remote_domain_create_linux_ret lv_remote_domain_create_linux_ret; remote_domain_set_scheduler_parameters_args lv_remote_domain_set_scheduler_parameters_args; +remote_auth_sasl_start_args lv_remote_auth_sasl_start_args; +remote_auth_sasl_start_ret lv_remote_auth_sasl_start_ret; remote_domain_interface_stats_args lv_remote_domain_interface_stats_args; remote_domain_interface_stats_ret lv_remote_domain_interface_stats_ret; remote_domain_get_max_vcpus_args lv_remote_domain_get_max_vcpus_args; @@ -50,6 +53,8 @@ remote_network_get_bridge_name_args lv_r remote_network_get_bridge_name_args lv_remote_network_get_bridge_name_args; remote_network_get_bridge_name_ret lv_remote_network_get_bridge_name_ret; remote_domain_destroy_args lv_remote_domain_destroy_args; +remote_auth_sasl_step_args lv_remote_auth_sasl_step_args; +remote_auth_sasl_step_ret lv_remote_auth_sasl_step_ret; remote_domain_migrate_finish_args lv_remote_domain_migrate_finish_args; remote_domain_migrate_finish_ret lv_remote_domain_migrate_finish_ret; remote_domain_get_vcpus_args lv_remote_domain_get_vcpus_args; @@ -74,6 +79,7 @@ remote_network_set_autostart_args lv_rem remote_network_set_autostart_args lv_remote_network_set_autostart_args; remote_network_get_autostart_args lv_remote_network_get_autostart_args; remote_network_get_autostart_ret lv_remote_network_get_autostart_ret; +remote_auth_list_ret lv_remote_auth_list_ret; remote_domain_core_dump_args lv_remote_domain_core_dump_args; remote_domain_get_max_memory_args lv_remote_domain_get_max_memory_args; remote_domain_get_max_memory_ret lv_remote_domain_get_max_memory_ret; diff -r e24d542af4fb qemud/remote_dispatch_proc_switch.h --- a/qemud/remote_dispatch_proc_switch.h Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/remote_dispatch_proc_switch.h Fri Nov 30 15:32:16 2007 -0500 @@ -2,6 +2,36 @@ * Do not edit this file. Any changes you make will be lost. */ +case REMOTE_PROC_AUTH_LIST: + fn = (dispatch_fn) remoteDispatchAuthList; + ret_filter = (xdrproc_t) xdr_remote_auth_list_ret; + ret = (char *) &lv_remote_auth_list_ret; + memset (&lv_remote_auth_list_ret, 0, sizeof lv_remote_auth_list_ret); + break; +case REMOTE_PROC_AUTH_SASL_INIT: + fn = (dispatch_fn) remoteDispatchAuthSaslInit; + ret_filter = (xdrproc_t) xdr_remote_auth_sasl_init_ret; + ret = (char *) &lv_remote_auth_sasl_init_ret; + memset (&lv_remote_auth_sasl_init_ret, 0, sizeof lv_remote_auth_sasl_init_ret); + break; +case REMOTE_PROC_AUTH_SASL_START: + fn = (dispatch_fn) remoteDispatchAuthSaslStart; + args_filter = (xdrproc_t) xdr_remote_auth_sasl_start_args; + args = (char *) &lv_remote_auth_sasl_start_args; + memset (&lv_remote_auth_sasl_start_args, 0, sizeof lv_remote_auth_sasl_start_args); + ret_filter = (xdrproc_t) xdr_remote_auth_sasl_start_ret; + ret = (char *) &lv_remote_auth_sasl_start_ret; + memset (&lv_remote_auth_sasl_start_ret, 0, sizeof lv_remote_auth_sasl_start_ret); + break; +case REMOTE_PROC_AUTH_SASL_STEP: + fn = (dispatch_fn) remoteDispatchAuthSaslStep; + args_filter = (xdrproc_t) xdr_remote_auth_sasl_step_args; + args = (char *) &lv_remote_auth_sasl_step_args; + memset (&lv_remote_auth_sasl_step_args, 0, sizeof lv_remote_auth_sasl_step_args); + ret_filter = (xdrproc_t) xdr_remote_auth_sasl_step_ret; + ret = (char *) &lv_remote_auth_sasl_step_ret; + memset (&lv_remote_auth_sasl_step_ret, 0, sizeof lv_remote_auth_sasl_step_ret); + break; case REMOTE_PROC_CLOSE: fn = (dispatch_fn) remoteDispatchClose; break; diff -r e24d542af4fb qemud/remote_dispatch_prototypes.h --- a/qemud/remote_dispatch_prototypes.h Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/remote_dispatch_prototypes.h Fri Nov 30 15:32:16 2007 -0500 @@ -2,6 +2,10 @@ * Do not edit this file. Any changes you make will be lost. */ +static int remoteDispatchAuthList (struct qemud_client *client, remote_message_header *req, void *args, remote_auth_list_ret *ret); +static int remoteDispatchAuthSaslInit (struct qemud_client *client, remote_message_header *req, void *args, remote_auth_sasl_init_ret *ret); +static int remoteDispatchAuthSaslStart (struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret); +static int remoteDispatchAuthSaslStep (struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret); static int remoteDispatchClose (struct qemud_client *client, remote_message_header *req, void *args, void *ret); static int remoteDispatchDomainAttachDevice (struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret); static int remoteDispatchDomainBlockStats (struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret); diff -r e24d542af4fb qemud/remote_protocol.c --- a/qemud/remote_protocol.c Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/remote_protocol.c Fri Nov 30 15:32:16 2007 -0500 @@ -100,6 +100,15 @@ xdr_remote_error (XDR *xdrs, remote_erro if (!xdr_int (xdrs, &objp->int2)) return FALSE; if (!xdr_remote_network (xdrs, &objp->net)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_type (XDR *xdrs, remote_auth_type *objp) +{ + + if (!xdr_enum (xdrs, (enum_t *) objp)) return FALSE; return TRUE; } @@ -1222,6 +1231,84 @@ xdr_remote_network_set_autostart_args (X } bool_t +xdr_remote_auth_list_ret (XDR *xdrs, remote_auth_list_ret *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->types.types_val; + + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->types.types_len, REMOTE_AUTH_TYPE_LIST_MAX, + sizeof (remote_auth_type), (xdrproc_t) xdr_remote_auth_type)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_sasl_init_ret (XDR *xdrs, remote_auth_sasl_init_ret *objp) +{ + + if (!xdr_remote_nonnull_string (xdrs, &objp->mechlist)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_sasl_start_args (XDR *xdrs, remote_auth_sasl_start_args *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->data.data_val; + + if (!xdr_remote_nonnull_string (xdrs, &objp->mech)) + return FALSE; + if (!xdr_int (xdrs, &objp->nil)) + return FALSE; + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->data.data_len, REMOTE_AUTH_SASL_DATA_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_sasl_start_ret (XDR *xdrs, remote_auth_sasl_start_ret *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->data.data_val; + + if (!xdr_int (xdrs, &objp->complete)) + return FALSE; + if (!xdr_int (xdrs, &objp->nil)) + return FALSE; + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->data.data_len, REMOTE_AUTH_SASL_DATA_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_sasl_step_args (XDR *xdrs, remote_auth_sasl_step_args *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->data.data_val; + + if (!xdr_int (xdrs, &objp->nil)) + return FALSE; + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->data.data_len, REMOTE_AUTH_SASL_DATA_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + return TRUE; +} + +bool_t +xdr_remote_auth_sasl_step_ret (XDR *xdrs, remote_auth_sasl_step_ret *objp) +{ + char **objp_cpp0 = (char **) (void *) &objp->data.data_val; + + if (!xdr_int (xdrs, &objp->complete)) + return FALSE; + if (!xdr_int (xdrs, &objp->nil)) + return FALSE; + if (!xdr_array (xdrs, objp_cpp0, (u_int *) &objp->data.data_len, REMOTE_AUTH_SASL_DATA_MAX, + sizeof (char), (xdrproc_t) xdr_char)) + return FALSE; + return TRUE; +} + +bool_t xdr_remote_procedure (XDR *xdrs, remote_procedure *objp) { diff -r e24d542af4fb qemud/remote_protocol.h --- a/qemud/remote_protocol.h Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/remote_protocol.h Fri Nov 30 15:32:16 2007 -0500 @@ -28,6 +28,8 @@ typedef remote_nonnull_string *remote_st #define REMOTE_MIGRATE_COOKIE_MAX 256 #define REMOTE_NETWORK_NAME_LIST_MAX 256 #define REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX 16 +#define REMOTE_AUTH_SASL_DATA_MAX 65536 +#define REMOTE_AUTH_TYPE_LIST_MAX 20 typedef char remote_uuid[VIR_UUID_BUFLEN]; @@ -63,6 +65,12 @@ struct remote_error { }; typedef struct remote_error remote_error; +enum remote_auth_type { + REMOTE_AUTH_NONE = 0, + REMOTE_AUTH_SASL = 1, +}; +typedef enum remote_auth_type remote_auth_type; + struct remote_vcpu_info { u_int number; int state; @@ -659,6 +667,58 @@ struct remote_network_set_autostart_args int autostart; }; typedef struct remote_network_set_autostart_args remote_network_set_autostart_args; + +struct remote_auth_list_ret { + struct { + u_int types_len; + remote_auth_type *types_val; + } types; +}; +typedef struct remote_auth_list_ret remote_auth_list_ret; + +struct remote_auth_sasl_init_ret { + remote_nonnull_string mechlist; +}; +typedef struct remote_auth_sasl_init_ret remote_auth_sasl_init_ret; + +struct remote_auth_sasl_start_args { + remote_nonnull_string mech; + int nil; + struct { + u_int data_len; + char *data_val; + } data; +}; +typedef struct remote_auth_sasl_start_args remote_auth_sasl_start_args; + +struct remote_auth_sasl_start_ret { + int complete; + int nil; + struct { + u_int data_len; + char *data_val; + } data; +}; +typedef struct remote_auth_sasl_start_ret remote_auth_sasl_start_ret; + +struct remote_auth_sasl_step_args { + int nil; + struct { + u_int data_len; + char *data_val; + } data; +}; +typedef struct remote_auth_sasl_step_args remote_auth_sasl_step_args; + +struct remote_auth_sasl_step_ret { + int complete; + int nil; + struct { + u_int data_len; + char *data_val; + } data; +}; +typedef struct remote_auth_sasl_step_ret remote_auth_sasl_step_ret; #define REMOTE_PROGRAM 0x20008086 #define REMOTE_PROTOCOL_VERSION 1 @@ -728,6 +788,10 @@ enum remote_procedure { REMOTE_PROC_DOMAIN_MIGRATE_FINISH = 63, REMOTE_PROC_DOMAIN_BLOCK_STATS = 64, REMOTE_PROC_DOMAIN_INTERFACE_STATS = 65, + REMOTE_PROC_AUTH_LIST = 66, + REMOTE_PROC_AUTH_SASL_INIT = 67, + REMOTE_PROC_AUTH_SASL_START = 68, + REMOTE_PROC_AUTH_SASL_STEP = 69, }; typedef enum remote_procedure remote_procedure; @@ -766,6 +830,7 @@ extern bool_t xdr_remote_domain (XDR *, extern bool_t xdr_remote_domain (XDR *, remote_domain*); extern bool_t xdr_remote_network (XDR *, remote_network*); extern bool_t xdr_remote_error (XDR *, remote_error*); +extern bool_t xdr_remote_auth_type (XDR *, remote_auth_type*); extern bool_t xdr_remote_vcpu_info (XDR *, remote_vcpu_info*); extern bool_t xdr_remote_sched_param_value (XDR *, remote_sched_param_value*); extern bool_t xdr_remote_sched_param (XDR *, remote_sched_param*); @@ -864,6 +929,12 @@ extern bool_t xdr_remote_network_get_au extern bool_t xdr_remote_network_get_autostart_args (XDR *, remote_network_get_autostart_args*); extern bool_t xdr_remote_network_get_autostart_ret (XDR *, remote_network_get_autostart_ret*); extern bool_t xdr_remote_network_set_autostart_args (XDR *, remote_network_set_autostart_args*); +extern bool_t xdr_remote_auth_list_ret (XDR *, remote_auth_list_ret*); +extern bool_t xdr_remote_auth_sasl_init_ret (XDR *, remote_auth_sasl_init_ret*); +extern bool_t xdr_remote_auth_sasl_start_args (XDR *, remote_auth_sasl_start_args*); +extern bool_t xdr_remote_auth_sasl_start_ret (XDR *, remote_auth_sasl_start_ret*); +extern bool_t xdr_remote_auth_sasl_step_args (XDR *, remote_auth_sasl_step_args*); +extern bool_t xdr_remote_auth_sasl_step_ret (XDR *, remote_auth_sasl_step_ret*); extern bool_t xdr_remote_procedure (XDR *, remote_procedure*); extern bool_t xdr_remote_message_direction (XDR *, remote_message_direction*); extern bool_t xdr_remote_message_status (XDR *, remote_message_status*); @@ -878,6 +949,7 @@ extern bool_t xdr_remote_domain (); extern bool_t xdr_remote_domain (); extern bool_t xdr_remote_network (); extern bool_t xdr_remote_error (); +extern bool_t xdr_remote_auth_type (); extern bool_t xdr_remote_vcpu_info (); extern bool_t xdr_remote_sched_param_value (); extern bool_t xdr_remote_sched_param (); @@ -976,6 +1048,12 @@ extern bool_t xdr_remote_network_get_aut extern bool_t xdr_remote_network_get_autostart_args (); extern bool_t xdr_remote_network_get_autostart_ret (); extern bool_t xdr_remote_network_set_autostart_args (); +extern bool_t xdr_remote_auth_list_ret (); +extern bool_t xdr_remote_auth_sasl_init_ret (); +extern bool_t xdr_remote_auth_sasl_start_args (); +extern bool_t xdr_remote_auth_sasl_start_ret (); +extern bool_t xdr_remote_auth_sasl_step_args (); +extern bool_t xdr_remote_auth_sasl_step_ret (); extern bool_t xdr_remote_procedure (); extern bool_t xdr_remote_message_direction (); extern bool_t xdr_remote_message_status (); diff -r e24d542af4fb qemud/remote_protocol.x --- a/qemud/remote_protocol.x Fri Nov 30 14:31:10 2007 -0500 +++ b/qemud/remote_protocol.x Fri Nov 30 15:32:16 2007 -0500 @@ -80,6 +80,12 @@ const REMOTE_NETWORK_NAME_LIST_MAX = 256 /* Upper limit on list of scheduler parameters. */ const REMOTE_DOMAIN_SCHEDULER_PARAMETERS_MAX = 16; + +/* Upper limit on SASL auth negotiation packet */ +const REMOTE_AUTH_SASL_DATA_MAX = 65536; + +/* Maximum number of auth types */ +const REMOTE_AUTH_TYPE_LIST_MAX = 20; /* UUID. VIR_UUID_BUFLEN definition comes from libvirt.h */ typedef opaque remote_uuid[VIR_UUID_BUFLEN]; @@ -122,6 +128,13 @@ struct remote_error { int int2; remote_network net; }; + +/* Authentication types available thus far.... */ +enum remote_auth_type { + REMOTE_AUTH_NONE = 0, + REMOTE_AUTH_SASL = 1 +}; + /* Wire encoding of virVcpuInfo. */ struct remote_vcpu_info { @@ -610,6 +623,37 @@ struct remote_network_set_autostart_args struct remote_network_set_autostart_args { remote_nonnull_network net; int autostart; +}; + +struct remote_auth_list_ret { + remote_auth_type types<REMOTE_AUTH_TYPE_LIST_MAX>; +}; + +struct remote_auth_sasl_init_ret { + remote_nonnull_string mechlist; +}; + +struct remote_auth_sasl_start_args { + remote_nonnull_string mech; + int nil; + char data<REMOTE_AUTH_SASL_DATA_MAX>; +}; + +struct remote_auth_sasl_start_ret { + int complete; + int nil; + char data<REMOTE_AUTH_SASL_DATA_MAX>; +}; + +struct remote_auth_sasl_step_args { + int nil; + char data<REMOTE_AUTH_SASL_DATA_MAX>; +}; + +struct remote_auth_sasl_step_ret { + int complete; + int nil; + char data<REMOTE_AUTH_SASL_DATA_MAX>; }; /*----- Protocol. -----*/ @@ -683,7 +727,11 @@ enum remote_procedure { REMOTE_PROC_DOMAIN_MIGRATE_PERFORM = 62, REMOTE_PROC_DOMAIN_MIGRATE_FINISH = 63, REMOTE_PROC_DOMAIN_BLOCK_STATS = 64, - REMOTE_PROC_DOMAIN_INTERFACE_STATS = 65 + REMOTE_PROC_DOMAIN_INTERFACE_STATS = 65, + REMOTE_PROC_AUTH_LIST = 66, + REMOTE_PROC_AUTH_SASL_INIT = 67, + REMOTE_PROC_AUTH_SASL_START = 68, + REMOTE_PROC_AUTH_SASL_STEP = 69 }; /* Custom RPC structure. */ diff -r e24d542af4fb src/Makefile.am --- a/src/Makefile.am Fri Nov 30 14:31:10 2007 -0500 +++ b/src/Makefile.am Fri Nov 30 15:32:16 2007 -0500 @@ -5,6 +5,7 @@ INCLUDES = -I$(top_builddir)/include \ -I@top_srcdir@/qemud \ $(LIBXML_CFLAGS) \ $(GNUTLS_CFLAGS) \ + $(SASL_CFLAGS) \ -DBINDIR=\""$(libexecdir)"\" \ -DSBINDIR=\""$(sbindir)"\" \ -DSYSCONF_DIR="\"$(sysconfdir)\"" \ @@ -59,7 +60,7 @@ SERVER_SOURCES = \ ../qemud/remote_protocol.c ../qemud/remote_protocol.h libvirt_la_SOURCES = $(CLIENT_SOURCES) $(SERVER_SOURCES) -libvirt_la_LIBADD = $(LIBXML_LIBS) $(GNUTLS_LIBS) $(LTLIBOBJS) \ +libvirt_la_LIBADD = $(LIBXML_LIBS) $(GNUTLS_LIBS) $(SASL_LIBS) $(LTLIBOBJS) \ @CYGWIN_EXTRA_LIBADD@ libvirt_la_LDFLAGS = -Wl,--version-script=$(srcdir)/libvirt_sym.version \ -version-info @LIBVIRT_VERSION_INFO@ \ diff -r e24d542af4fb src/remote_internal.c --- a/src/remote_internal.c Fri Nov 30 14:31:10 2007 -0500 +++ b/src/remote_internal.c Fri Nov 30 15:32:16 2007 -0500 @@ -48,6 +48,9 @@ #include <gnutls/gnutls.h> #include <gnutls/x509.h> #include "gnutls_1_0_compat.h" +#if HAVE_SASL +#include <sasl/sasl.h> +#endif #include <libxml/uri.h> #include "internal.h" @@ -72,6 +75,11 @@ struct private_data { char *type; /* Cached return from remoteType. */ int counter; /* Generates serial numbers for RPC. */ int networkOnly; /* Only used for network API */ + char *hostname; /* Original hostname */ + FILE *debugLog; /* Debug remote protocol */ +#if HAVE_SASL + sasl_conn_t *saslconn; /* SASL context */ +#endif }; #define GET_PRIVATE(conn,retcode) \ @@ -90,7 +98,20 @@ struct private_data { return (retcode); \ } -static int call (virConnectPtr conn, struct private_data *priv, int in_open, int proc_nr, xdrproc_t args_filter, char *args, xdrproc_t ret_filter, char *ret); +enum { + REMOTE_CALL_IN_OPEN = 1, + REMOTE_CALL_QUIET_MISSING_RPC = 2, +}; + + +static int call (virConnectPtr conn, struct private_data *priv, + int flags, int proc_nr, + xdrproc_t args_filter, char *args, + xdrproc_t ret_filter, char *ret); +static int remoteAuthenticate (virConnectPtr conn, struct private_data *priv, int in_open); +#if HAVE_SASL +static int remoteAuthSASL (virConnectPtr conn, struct private_data *priv, int in_open); +#endif static void error (virConnectPtr conn, virErrorNumber code, const char *info); static void server_error (virConnectPtr conn, remote_error *err); static virDomainPtr get_nonnull_domain (virConnectPtr conn, remote_nonnull_domain domain); @@ -121,7 +142,7 @@ static void query_free (struct query_fie /* GnuTLS functions used by remoteOpen. */ static int initialise_gnutls (virConnectPtr conn); -static gnutls_session_t negotiate_gnutls_on_connection (virConnectPtr conn, int sock, int no_verify, const char *hostname); +static gnutls_session_t negotiate_gnutls_on_connection (virConnectPtr conn, struct private_data *priv, int no_verify); static int remoteStartup(void) @@ -132,6 +153,22 @@ remoteStartup(void) inside_daemon = 1; return 0; } + +#if HAVE_SASL +static void +remoteDebug(struct private_data *priv, const char *msg,...) +{ + va_list args; + if (priv->debugLog == NULL) + return; + + va_start(args, msg); + vfprintf(priv->debugLog, msg, args); + va_end(args); + fprintf(priv->debugLog, "\n"); +} +#endif /* HAVE_SASL */ + /** * remoteFindServerPath: @@ -297,7 +334,7 @@ doRemoteOpen (virConnectPtr conn, struct * get freed in the failed: path. */ char *name = 0, *command = 0, *sockname = 0, *netcat = 0, *username = 0; - char *server = 0, *port = 0; + char *port = 0; int no_verify = 0, no_tty = 0; char **cmd_argv = 0; @@ -305,12 +342,6 @@ doRemoteOpen (virConnectPtr conn, struct int retcode = VIR_DRV_OPEN_ERROR; /* Remote server defaults to "localhost" if not specified. */ - server = strdup (uri->server ? uri->server : "localhost"); - if (!server) { - out_of_memory: - error (conn, VIR_ERR_NO_MEMORY, "duplicating server name"); - goto failed; - } if (uri->port != 0) { if (asprintf (&port, "%d", uri->port) == -1) goto out_of_memory; } else if (transport == trans_tls) { @@ -325,6 +356,12 @@ doRemoteOpen (virConnectPtr conn, struct } else port = NULL; /* Port not used for unix, ext. */ + + priv->hostname = strdup (uri->server ? uri->server : "localhost"); + if (!priv->hostname) { + error (NULL, VIR_ERR_NO_MEMORY, "allocating priv->hostname"); + goto failed; + } if (uri->user) { username = strdup (uri->user); if (!username) goto out_of_memory; @@ -367,6 +404,12 @@ doRemoteOpen (virConnectPtr conn, struct } else if (strcasecmp (var->name, "no_tty") == 0) { no_tty = atoi (var->value); var->ignore = 1; + } else if (strcasecmp (var->name, "debug") == 0) { + if (var->value && + strcasecmp(var->value, "stdout") == 0) + priv->debugLog = stdout; + else + priv->debugLog = stderr; } #if DEBUG else @@ -436,7 +479,7 @@ doRemoteOpen (virConnectPtr conn, struct memset (&hints, 0, sizeof hints); hints.ai_socktype = SOCK_STREAM; hints.ai_flags = AI_ADDRCONFIG; - int e = getaddrinfo (server, port, &hints, &res); + int e = getaddrinfo (priv->hostname, port, &hints, &res); if (e != 0) { error (conn, VIR_ERR_INVALID_ARG, gai_strerror (e)); goto failed; @@ -476,7 +519,7 @@ doRemoteOpen (virConnectPtr conn, struct if (priv->uses_tls) { priv->session = negotiate_gnutls_on_connection - (conn, priv->sock, no_verify, server); + (conn, priv, no_verify); if (!priv->session) { close (priv->sock); priv->sock = -1; @@ -603,7 +646,7 @@ doRemoteOpen (virConnectPtr conn, struct cmd_argv[j++] = strdup ("-e"); cmd_argv[j++] = strdup ("none"); } - cmd_argv[j++] = strdup (server); + cmd_argv[j++] = strdup (priv->hostname); cmd_argv[j++] = strdup (netcat ? netcat : "nc"); cmd_argv[j++] = strdup ("-U"); cmd_argv[j++] = strdup (sockname ? sockname : LIBVIRTD_PRIV_UNIX_SOCKET); @@ -665,10 +708,15 @@ doRemoteOpen (virConnectPtr conn, struct } } /* switch (transport) */ + + /* Try and authenticate with server */ + if (remoteAuthenticate(conn, priv, 1) == -1) + goto failed; + /* Finally we can call the remote side's open function. */ remote_open_args args = { &name, flags }; - if (call (conn, priv, 1, REMOTE_PROC_OPEN, + if (call (conn, priv, REMOTE_CALL_IN_OPEN, REMOTE_PROC_OPEN, (xdrproc_t) xdr_remote_open_args, (char *) &args, (xdrproc_t) xdr_void, (char *) NULL) == -1) goto failed; @@ -676,12 +724,35 @@ doRemoteOpen (virConnectPtr conn, struct /* Successful. */ retcode = VIR_DRV_OPEN_SUCCESS; - /*FALLTHROUGH*/ + cleanup: + /* Free up the URL and strings. */ + if (name) free (name); + if (command) free (command); + if (sockname) free (sockname); + if (netcat) free (netcat); + if (username) free (username); + if (port) free (port); + if (cmd_argv) { + char **cmd_argv_ptr = cmd_argv; + while (*cmd_argv_ptr) { + free (*cmd_argv_ptr); + cmd_argv_ptr++; + } + free (cmd_argv); + } + + return retcode; + + out_of_memory: + error (NULL, VIR_ERR_NO_MEMORY, "uri params"); + failed: /* Close the socket if we failed. */ - if (retcode != VIR_DRV_OPEN_SUCCESS && priv->sock >= 0) { - if (priv->uses_tls && priv->session) + if (priv->sock >= 0) { + if (priv->uses_tls && priv->session) { gnutls_bye (priv->session, GNUTLS_SHUT_RDWR); + gnutls_deinit (priv->session); + } close (priv->sock); if (priv->pid > 0) { pid_t reap; @@ -693,24 +764,12 @@ doRemoteOpen (virConnectPtr conn, struct } } - /* Free up the URL and strings. */ - if (name) free (name); - if (command) free (command); - if (sockname) free (sockname); - if (netcat) free (netcat); - if (username) free (username); - if (server) free (server); - if (port) free (port); - if (cmd_argv) { - char **cmd_argv_ptr = cmd_argv; - while (*cmd_argv_ptr) { - free (*cmd_argv_ptr); - cmd_argv_ptr++; - } - free (cmd_argv); - } - - return retcode; + if (priv->hostname) { + free (priv->hostname); + priv->hostname = NULL; + } + + goto cleanup; } static int @@ -1017,11 +1076,12 @@ initialise_gnutls (virConnectPtr conn) return 0; } -static int verify_certificate (virConnectPtr conn, gnutls_session_t session, const char *hostname); +static int verify_certificate (virConnectPtr conn, struct private_data *priv, gnutls_session_t session); static gnutls_session_t negotiate_gnutls_on_connection (virConnectPtr conn, - int sock, int no_verify, const char *hostname) + struct private_data *priv, + int no_verify) { const int cert_type_priority[3] = { GNUTLS_CRT_X509, @@ -1062,7 +1122,7 @@ negotiate_gnutls_on_connection (virConne } gnutls_transport_set_ptr (session, - (gnutls_transport_ptr_t) (long) sock); + (gnutls_transport_ptr_t) (long) priv->sock); /* Perform the TLS handshake. */ again: @@ -1075,7 +1135,7 @@ negotiate_gnutls_on_connection (virConne } /* Verify certificate. */ - if (verify_certificate (conn, session, hostname) == -1) { + if (verify_certificate (conn, priv, session) == -1) { fprintf (stderr, "remote_internal: failed to verify peer's certificate\n"); if (!no_verify) return NULL; @@ -1110,8 +1170,8 @@ negotiate_gnutls_on_connection (virConne static int verify_certificate (virConnectPtr conn ATTRIBUTE_UNUSED, - gnutls_session_t session, - const char *hostname) + struct private_data *priv, + gnutls_session_t session) { int ret; unsigned int status; @@ -1189,14 +1249,14 @@ verify_certificate (virConnectPtr conn A } if (i == 0) { - if (!gnutls_x509_crt_check_hostname (cert, hostname)) { + if (!gnutls_x509_crt_check_hostname (cert, priv->hostname)) { __virRaiseError (conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, - VIR_ERR_ERROR, hostname, NULL, NULL, + VIR_ERR_ERROR, priv->hostname, NULL, NULL, 0, 0, "Certificate's owner does not match the hostname (%s)", - hostname); + priv->hostname); gnutls_x509_crt_deinit (cert); return -1; } @@ -1218,8 +1278,14 @@ doRemoteClose (virConnectPtr conn, struc return -1; /* Close socket. */ - if (priv->uses_tls && priv->session) + if (priv->uses_tls && priv->session) { gnutls_bye (priv->session, GNUTLS_SHUT_RDWR); + gnutls_deinit (priv->session); + } +#if HAVE_SASL + if (priv->saslconn) + sasl_dispose (&priv->saslconn); +#endif close (priv->sock); if (priv->pid > 0) { @@ -1230,6 +1296,9 @@ doRemoteClose (virConnectPtr conn, struc continue; } while (reap != -1 && reap != priv->pid); } + + /* Free hostname copy */ + if (priv->hostname) free (priv->hostname); /* See comment for remoteType. */ if (priv->type) free (priv->type); @@ -2751,6 +2820,298 @@ remoteNetworkSetAutostart (virNetworkPtr /*----------------------------------------------------------------------*/ +static int +remoteAuthenticate (virConnectPtr conn, struct private_data *priv, int in_open) +{ + struct remote_auth_list_ret ret; + int err; + + memset(&ret, 0, sizeof ret); + err = call (conn, priv, + REMOTE_CALL_IN_OPEN | REMOTE_CALL_QUIET_MISSING_RPC, + REMOTE_PROC_AUTH_LIST, + (xdrproc_t) xdr_void, (char *) NULL, + (xdrproc_t) xdr_remote_auth_list_ret, (char *) &ret); + if (err == -2) /* Missing RPC - old server - ignore */ + return 0; + + if (err < 0) + return -1; + + if (ret.types.types_len == 0) + return 0; + + switch (ret.types.types_val[0]) { +#if HAVE_SASL + case REMOTE_AUTH_SASL: + if (remoteAuthSASL(conn, priv, in_open) < 0) { + free(ret.types.types_val); + return -1; + } + break; +#endif + + case REMOTE_AUTH_NONE: + /* Nothing todo, hurrah ! */ + break; + + default: + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "unsupported authentication type %d", ret.types.types_val[0]); + free(ret.types.types_val); + return -1; + } + + free(ret.types.types_val); + + return 0; +} + + + +#if HAVE_SASL +/* + * NB, keep in sync with similar method in qemud/remote.c + */ +static char *addrToString(struct sockaddr_storage *sa, socklen_t salen) +{ + char host[NI_MAXHOST], port[NI_MAXSERV]; + char *addr; + int err; + + if ((err = getnameinfo((struct sockaddr *)sa, salen, + host, sizeof(host), + port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV)) != 0) { + __virRaiseError (NULL, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_NO_MEMORY, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "Cannot resolve address %d: %s", err, gai_strerror(err)); + return NULL; + } + + addr = malloc(strlen(host) + 1 + strlen(port) + 1); + if (!addr) { + __virRaiseError (NULL, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_NO_MEMORY, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "address"); + return NULL; + } + + strcpy(addr, host); + strcat(addr, ";"); + strcat(addr, port); + return addr; +} + + +/* Perform the SASL authentication process + * + * XXX negotiate a session encryption layer for non-TLS sockets + * XXX fetch credentials from a libvirt client app callback + * XXX max packet size spec + * XXX better mechanism negotiation ? Ask client app ? + */ +static int +remoteAuthSASL (virConnectPtr conn, struct private_data *priv, int in_open) +{ + sasl_conn_t *saslconn = NULL; + remote_auth_sasl_init_ret iret; + remote_auth_sasl_start_args sargs; + remote_auth_sasl_start_ret sret; + remote_auth_sasl_step_args pargs; + remote_auth_sasl_step_ret pret; + const char *clientout; + char *serverin; + unsigned int clientoutlen, serverinlen; + const char *mech; + int err, complete; + struct sockaddr_storage sa; + socklen_t salen; + char *localAddr, *remoteAddr; + + remoteDebug(priv, "Client initialize SASL authentication"); + /* Sets up the SASL library as a whole */ + err = sasl_client_init(NULL); + if (err != SASL_OK) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "failed to initialize SASL library: %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + return -1; + } + + /* Get local address in form IPADDR:PORT */ + salen = sizeof(sa); + if (getsockname(priv->sock, (struct sockaddr*)&sa, &salen) < 0) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "failed to get sock address %d (%s)", + errno, strerror(errno)); + return -1; + } + if ((localAddr = addrToString(&sa, salen)) == NULL) { + return -1; + } + + /* Get remote address in form IPADDR:PORT */ + salen = sizeof(sa); + if (getpeername(priv->sock, (struct sockaddr*)&sa, &salen) < 0) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "failed to get peer address %d (%s)", + errno, strerror(errno)); + free(localAddr); + return -1; + } + if ((remoteAddr = addrToString(&sa, salen)) == NULL) { + free(localAddr); + return -1; + } + + /* Setup a handle for being a client */ + err = sasl_client_new("libvirt", + priv->hostname, + localAddr, + remoteAddr, + NULL, /* XXX callbacks */ + SASL_SUCCESS_DATA, + &saslconn); + free(localAddr); + free(remoteAddr); + if (err != SASL_OK) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "Failed to create SASL client context: %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + return -1; + } + + /* First call is to inquire about supported mechanisms in the server */ + memset (&iret, 0, sizeof iret); + if (call (conn, priv, in_open, REMOTE_PROC_AUTH_SASL_INIT, + (xdrproc_t) xdr_void, (char *)NULL, + (xdrproc_t) xdr_remote_auth_sasl_init_ret, (char *) &iret) != 0) { + sasl_dispose(&saslconn); + return -1; /* virError already set by call */ + } + + + /* Start the auth negotiation on the client end first */ + remoteDebug(priv, "Client start negotiation mechlist '%s'", iret.mechlist); + err = sasl_client_start(saslconn, + iret.mechlist, + NULL, /* XXX interactions */ + &clientout, + &clientoutlen, + &mech); + if (err != SASL_OK && err != SASL_CONTINUE) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "Failed to start SASL negotiation: %d (%s)", + err, sasl_errdetail(saslconn)); + free(iret.mechlist); + sasl_dispose(&saslconn); + return -1; + } + free(iret.mechlist); + + if (clientoutlen > REMOTE_AUTH_SASL_DATA_MAX) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "SASL negotiation data too long: %d bytes", clientoutlen); + sasl_dispose(&saslconn); + return -1; + } + /* NB, distinction of NULL vs "" is *critical* in SASL */ + memset(&sargs, 0, sizeof sargs); + sargs.nil = clientout ? 0 : 1; + sargs.data.data_val = (char*)clientout; + sargs.data.data_len = clientoutlen; + sargs.mech = (char*)mech; + remoteDebug(priv, "Server start negotiation with mech %s. Data %d bytes %p", mech, clientoutlen, clientout); + + /* Now send the initial auth data to the server */ + memset (&sret, 0, sizeof sret); + if (call (conn, priv, in_open, REMOTE_PROC_AUTH_SASL_START, + (xdrproc_t) xdr_remote_auth_sasl_start_args, (char *) &sargs, + (xdrproc_t) xdr_remote_auth_sasl_start_ret, (char *) &sret) != 0) { + sasl_dispose(&saslconn); + return -1; /* virError already set by call */ + } + + complete = sret.complete; + /* NB, distinction of NULL vs "" is *critical* in SASL */ + serverin = sret.nil ? NULL : sret.data.data_val; + serverinlen = sret.data.data_len; + remoteDebug(priv, "Client step result complete: %d. Data %d bytes %p", + complete, serverinlen, serverin); + + /* Loop-the-loop... + * Even if the server has completed, the client must *always* do at least one step + * in this loop to verify the server isn't lieing about something. Mutual auth */ + for (;;) { + err = sasl_client_step(saslconn, + serverin, + serverinlen, + NULL, /* XXX interactions */ + &clientout, + &clientoutlen); + if (serverin) free(serverin); + if (err != SASL_OK && err != SASL_CONTINUE) { + __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + VIR_ERR_AUTH_FAILED, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, + "Failed SASL step: %d (%s)", + err, sasl_errdetail(saslconn)); + sasl_dispose(&saslconn); + return -1; + } + remoteDebug(priv, "Client step result %d. Data %d bytes %p", err, clientoutlen, clientout); + + /* Previous server call showed completion & we're now locally complete too */ + if (complete && err == SASL_OK) + break; + + /* Not done, prepare to talk with the server for another iteration */ + /* NB, distinction of NULL vs "" is *critical* in SASL */ + memset(&pargs, 0, sizeof pargs); + pargs.nil = clientout ? 0 : 1; + pargs.data.data_val = (char*)clientout; + pargs.data.data_len = clientoutlen; + remoteDebug(priv, "Server step with %d bytes %p", clientoutlen, clientout); + + memset (&pret, 0, sizeof pret); + if (call (conn, priv, in_open, REMOTE_PROC_AUTH_SASL_STEP, + (xdrproc_t) xdr_remote_auth_sasl_step_args, (char *) &pargs, + (xdrproc_t) xdr_remote_auth_sasl_step_ret, (char *) &pret) != 0) { + sasl_dispose(&saslconn); + return -1; /* virError already set by call */ + } + + complete = pret.complete; + /* NB, distinction of NULL vs "" is *critical* in SASL */ + serverin = pret.nil ? NULL : pret.data.data_val; + serverinlen = pret.data.data_len; + + remoteDebug(priv, "Client step result complete: %d. Data %d bytes %p", + complete, serverinlen, serverin); + + /* This server call shows complete, and earlier client step was OK */ + if (complete && err == SASL_OK) { + if (serverin) free(serverin); + break; + } + } + + remoteDebug(priv, "SASL authentication complete"); + /* XXX keep this around for wire encoding */ + sasl_dispose(&saslconn); + return 0; +} +#endif /* HAVE_SASL */ + +/*----------------------------------------------------------------------*/ + static int really_write (virConnectPtr conn, struct private_data *priv, int in_open, char *bytes, int len); static int really_read (virConnectPtr conn, struct private_data *priv, @@ -2768,7 +3129,7 @@ static int really_read (virConnectPtr co */ static int call (virConnectPtr conn, struct private_data *priv, - int in_open /* if we are in virConnectOpen */, + int flags /* if we are in virConnectOpen */, int proc_nr, xdrproc_t args_filter, char *args, xdrproc_t ret_filter, char *ret) @@ -2793,13 +3154,13 @@ call (virConnectPtr conn, struct private /* Serialise header followed by args. */ xdrmem_create (&xdr, buffer, sizeof buffer, XDR_ENCODE); if (!xdr_remote_message_header (&xdr, &hdr)) { - error (in_open ? NULL : conn, + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "xdr_remote_message_header"); return -1; } if (!(*args_filter) (&xdr, args)) { - error (in_open ? NULL : conn, VIR_ERR_RPC, "marshalling args"); + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "marshalling args"); return -1; } @@ -2815,23 +3176,23 @@ call (virConnectPtr conn, struct private /* Encode the length word. */ xdrmem_create (&xdr, buffer2, sizeof buffer2, XDR_ENCODE); if (!xdr_int (&xdr, &len)) { - error (in_open ? NULL : conn, VIR_ERR_RPC, "xdr_int (length word)"); + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "xdr_int (length word)"); return -1; } xdr_destroy (&xdr); /* Send length word followed by header+args. */ - if (really_write (conn, priv, in_open, buffer2, sizeof buffer2) == -1 || - really_write (conn, priv, in_open, buffer, len-4) == -1) + if (really_write (conn, priv, flags & REMOTE_CALL_IN_OPEN, buffer2, sizeof buffer2) == -1 || + really_write (conn, priv, flags & REMOTE_CALL_IN_OPEN, buffer, len-4) == -1) return -1; /* Read and deserialise length word. */ - if (really_read (conn, priv, in_open, buffer2, sizeof buffer2) == -1) + if (really_read (conn, priv, flags & REMOTE_CALL_IN_OPEN, buffer2, sizeof buffer2) == -1) return -1; xdrmem_create (&xdr, buffer2, sizeof buffer2, XDR_DECODE); if (!xdr_int (&xdr, &len)) { - error (in_open ? NULL : conn, + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "xdr_int (length word, reply)"); return -1; } @@ -2841,33 +3202,33 @@ call (virConnectPtr conn, struct private len -= 4; if (len < 0 || len > REMOTE_MESSAGE_MAX) { - error (in_open ? NULL : conn, + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "packet received from server too large"); return -1; } /* Read reply header and what follows (either a ret or an error). */ - if (really_read (conn, priv, in_open, buffer, len) == -1) + if (really_read (conn, priv, flags & REMOTE_CALL_IN_OPEN, buffer, len) == -1) return -1; /* Deserialise reply header. */ xdrmem_create (&xdr, buffer, len, XDR_DECODE); if (!xdr_remote_message_header (&xdr, &hdr)) { - error (in_open ? NULL : conn, + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "xdr_remote_message_header (reply)"); return -1; } /* Check program, version, etc. are what we expect. */ if (hdr.prog != REMOTE_PROGRAM) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown program (received %x, expected %x)", hdr.prog, REMOTE_PROGRAM); return -1; } if (hdr.vers != REMOTE_PROTOCOL_VERSION) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown protocol version (received %x, expected %x)", hdr.vers, REMOTE_PROTOCOL_VERSION); @@ -2879,21 +3240,21 @@ call (virConnectPtr conn, struct private * message being received at this point. */ if (hdr.proc != proc_nr) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown procedure (received %x, expected %x)", hdr.proc, proc_nr); return -1; } if (hdr.direction != REMOTE_REPLY) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown direction (received %x, expected %x)", hdr.direction, REMOTE_REPLY); return -1; } if (hdr.serial != serial) { - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown serial (received %x, expected %x)", hdr.serial, serial); @@ -2907,7 +3268,7 @@ call (virConnectPtr conn, struct private switch (hdr.status) { case REMOTE_OK: if (!(*ret_filter) (&xdr, ret)) { - error (in_open ? NULL : conn, VIR_ERR_RPC, "unmarshalling ret"); + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "unmarshalling ret"); return -1; } xdr_destroy (&xdr); @@ -2916,17 +3277,26 @@ call (virConnectPtr conn, struct private case REMOTE_ERROR: memset (&rerror, 0, sizeof rerror); if (!xdr_remote_error (&xdr, &rerror)) { - error (in_open ? NULL : conn, + error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, VIR_ERR_RPC, "unmarshalling remote_error"); return -1; } xdr_destroy (&xdr); - server_error (in_open ? NULL : conn, &rerror); + /* See if caller asked us to keep quiet about missing RPCs + * eg for interop with older servers */ + if (flags & REMOTE_CALL_QUIET_MISSING_RPC && + rerror.domain == VIR_FROM_REMOTE && + rerror.code == VIR_ERR_RPC && + rerror.level == VIR_ERR_ERROR && + STREQLEN(*rerror.message, "unknown procedure", 17)) { + return -2; + } + server_error (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, &rerror); xdr_free ((xdrproc_t) xdr_remote_error, (char *) &rerror); return -1; default: - __virRaiseError (in_open ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, + __virRaiseError (flags & REMOTE_CALL_IN_OPEN ? NULL : conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, "unknown status (received %x)", hdr.status); diff -r e24d542af4fb src/virsh.c --- a/src/virsh.c Fri Nov 30 14:31:10 2007 -0500 +++ b/src/virsh.c Fri Nov 30 15:32:16 2007 -0500 @@ -4526,8 +4526,10 @@ vshInit(vshControl * ctl) * vshConnectionUsability, except ones which don't need a connection * such as "help". */ - if (!ctl->conn) + if (!ctl->conn) { vshError(ctl, FALSE, _("failed to connect to the hypervisor")); + return FALSE; + } return TRUE; } diff -r e24d542af4fb src/virterror.c --- a/src/virterror.c Fri Nov 30 14:31:10 2007 -0500 +++ b/src/virterror.c Fri Nov 30 15:32:16 2007 -0500 @@ -671,6 +671,12 @@ __virErrorMsg(virErrorNumber error, cons else errmsg = _("invalid MAC adress: %s"); break; + case VIR_ERR_AUTH_FAILED: + if (info == NULL) + errmsg = _("authentication failed"); + else + errmsg = _("authentication failed: %s"); + break; } return (errmsg); } diff -r e24d542af4fb tests/Makefile.am --- a/tests/Makefile.am Fri Nov 30 14:31:10 2007 -0500 +++ b/tests/Makefile.am Fri Nov 30 15:32:16 2007 -0500 @@ -17,6 +17,7 @@ INCLUDES = \ -I$(top_srcdir)/src \ $(LIBXML_CFLAGS) \ $(GNUTLS_CFLAGS) \ + $(SASL_CFLAGS) \ -D_XOPEN_SOURCE=600 -D_POSIX_C_SOURCE=199506L \ -DGETTEXT_PACKAGE=\"$(PACKAGE)\" \ $(COVERAGE_CFLAGS) \ @@ -27,6 +28,7 @@ LDADDS = \ @STATIC_BINARIES@ \ $(LIBXML_LIBS) \ $(GNUTLS_LIBS) \ + $(SASL_LIBS) \ $(WARN_CFLAGS) \ $(LIBVIRT) \ $(COVERAGE_LDFLAGS) Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

On Thu, Nov 29, 2007 at 05:18:06PM +0000, Daniel P. Berrange wrote: Rebased to take account of Jim's changes, and incorporated fixes to the config file diff -r b68f6ec36358 qemud/Makefile.am --- a/qemud/Makefile.am Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/Makefile.am Fri Nov 30 15:15:26 2007 -0500 @@ -101,14 +101,14 @@ remote.c: remote_dispatch_prototypes.h \ remote_dispatch_localvars.h \ remote_dispatch_proc_switch.h -remote_dispatch_prototypes.h: remote_generate_stubs.pl remote_protocol.x - perl -w remote_generate_stubs.pl -i remote_protocol.x > $@ +remote_dispatch_prototypes.h: $(srcdir)/remote_generate_stubs.pl remote_protocol.x + perl -w $(srcdir)/remote_generate_stubs.pl -i $(srcdir)/remote_protocol.x > $@ -remote_dispatch_localvars.h: remote_generate_stubs.pl remote_protocol.x - perl -w remote_generate_stubs.pl -v remote_protocol.x > $@ +remote_dispatch_localvars.h: $(srcdir)/remote_generate_stubs.pl remote_protocol.x + perl -w $(srcdir)/remote_generate_stubs.pl -v $(srcdir)/remote_protocol.x > $@ -remote_dispatch_proc_switch.h: remote_generate_stubs.pl remote_protocol.x - perl -w remote_generate_stubs.pl -w remote_protocol.x > $@ +remote_dispatch_proc_switch.h: $(srcdir)/remote_generate_stubs.pl remote_protocol.x + perl -w $(srcdir)/remote_generate_stubs.pl -w $(srcdir)/remote_protocol.x > $@ if LIBVIRT_INIT_SCRIPTS_RED_HAT install-init: libvirtd.init diff -r b68f6ec36358 qemud/internal.h --- a/qemud/internal.h Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/internal.h Fri Nov 30 15:15:26 2007 -0500 @@ -109,6 +109,7 @@ struct qemud_client { const char *saslEncoded; unsigned int saslEncodedLength; unsigned int saslEncodedOffset; + char *saslUsername; #endif unsigned int incomingSerial; @@ -151,6 +152,9 @@ struct qemud_server { #ifdef HAVE_AVAHI struct libvirtd_mdns *mdns; #endif +#if HAVE_SASL + char **saslUsernameWhitelist; +#endif }; void qemudLog(int priority, const char *fmt, ...) diff -r b68f6ec36358 qemud/libvirtd.conf --- a/qemud/libvirtd.conf Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/libvirtd.conf Fri Nov 30 15:15:26 2007 -0500 @@ -2,6 +2,11 @@ # # For further information consult http://libvirt.org/format.html + +################################################################# +# +# Network connectivitiy controls +# # Flag listening for secure TLS connections on the public TCP/IP port. # NB, must pass the --listen flag to the libvirtd process for this to @@ -11,28 +16,30 @@ # using this capability. # # This is enabled by default, uncomment this to disable it -# listen_tls = 0 +#listen_tls = 0 # Listen for unencrypted TCP connections on the public TCP/IP port. # NB, must pass the --listen flag to the libvirtd process for this to # have any effect. # -# NB, this is insecure. Do not use except for development. +# Using the TCP socket requires SASL authentication by default. Only +# SASL mechanisms which support data encryption are allowed. This is +# DIGEST_MD5 and GSSAPI (Kerberos5) # # This is disabled by default, uncomment this to enable it. -# listen_tcp = 1 +#listen_tcp = 1 # Override the port for accepting secure TLS connections # This can be a port number, or service name # -# tls_port = "16514" +#tls_port = "16514" # Override the port for accepting insecure TCP connections # This can be a port number, or service name -# -# tcp_port = "16509" +# +#tcp_port = "16509" @@ -42,39 +49,123 @@ # stopping the Avahi daemon # # This is enabled by default, uncomment this to disable it -# mdns_adv = 0 +#mdns_adv = 0 # Override the default mDNS advertizement name. This must be # unique on the immediate broadcast network. -# +# # The default is "Virtualization Host HOSTNAME", where HOSTNAME # is subsituted for the short hostname of the machine (without domain) # -# mdns_name "Virtualization Host Joe Demo" - - +#mdns_name = "Virtualization Host Joe Demo" + + +################################################################# +# +# UNIX socket access controls +# # Set the UNIX domain socket group ownership. This can be used to # allow a 'trusted' set of users access to management capabilities # without becoming root. -# -# This is restricted to 'root' by default. -# unix_sock_group "libvirt" +# +# This is restricted to 'root' by default. +#unix_sock_group = "libvirt" # Set the UNIX socket permissions for the R/O socket. This is used # for monitoring VM status only # # Default allows any user. If setting group ownership may want to # restrict this to: -# unix_sock_ro_perms "0777" +#unix_sock_ro_perms = "0777" # Set the UNIX socket permissions for the R/W socket. This is used # for full management of VMs # # Default allows only root. If setting group ownership may want to # relax this to: -# unix_sock_rw_perms "octal-perms" "0770" - +#unix_sock_rw_perms = "0770" + + + +################################################################# +# +# Authentication. +# +# - none: do not perform auth checks. If you can connect to the +# socket you are allowed. This is suitable if there are +# restrictions on connecting to the socket (eg, UNIX +# socket permissions), or if there is a lower layer in +# the network providing auth (eg, TLS/x509 certificates) +# +# - sasl: use SASL infrastructure. The actual auth scheme is then +# controlled from /etc/sasl2/libvirt.conf. For the TCP +# socket only GSSAPI & DIGEST-MD5 mechanisms will be used. +# For non-TCP or TLS sockets, any scheme is allowed. +# + +# Set an authentication scheme for UNIX read-only sockets +# By default socket permissions allow anyone to connect +# +# To restrict monitoring of domains you may wish to enable +# an authentication mechanism here +#auth_unix_ro = "none" + +# Set an authentication scheme for UNIX read-write sockets +# By default socket permissions only allow root. +# +# If the unix_sock_rw_perms are changed you may wish to enable +# an authentication mechanism here +#auth_unix_rw = "none" + +# Change the authentication scheme for TCP sockets. +# +# If you don't enable SASL, then all TCP traffic is cleartext. +# Don't do this outside of a dev/test scenario. For real world +# use, always enable SASL and use the GSSAPI or DIGEST-MD5 +# mechanism in /etc/sasl2/libvirt.conf +#auth_tcp = "sasl" + +# Change the authentication scheme for TLS sockets. +# +# TLS sockets already have encryption provided by the TLS +# layer, and limited authentication is done by certificates +# +# It is possible to make use of any SASL authentication +# mechanism as well, by using 'sasl' for this option +#auth_tls = "none" + + + +################################################################# +# +# TLS x509 certificate configuration +# + + +# Override the default server key file path +# +#key_file = "/etc/pki/libvirt/private/serverkey.pem" + +# Override the default server certificate file path +# +#cert_file = "/etc/pki/libvirt/servercert.pem" + +# Override the default CA certificate path +# +#ca_file = "/etc/pki/CA/cacert.pem" + +# Specify a certificate revocation list. +# +# Defaults to not using a CRL, uncomment to enable it +#crl_file = "/etc/pki/CA/crl.pem" + + + +################################################################# +# +# Authorization controls +# # Flag to disable verification of client certificates @@ -85,36 +176,11 @@ # # Default is to always verify. Uncommenting this will disable # verification - make sure an IP whitelist is set -# tls_no_verify_certificate 1 - -# Flag to disable verification of client IP address -# -# Client IP address will be verified against the CommonName field -# of the x509 certificate. This has minimal security benefit since -# it is easy to spoof source IP. -# -# Uncommenting this will disable verification -# tls_no_verify_address 1 - -# Override the default server key file path -# -# key_file "/etc/pki/libvirt/private/serverkey.pem" - -# Override the default server certificate file path -# -# cert_file "/etc/pki/libvirt/servercert.pem" - -# Override the default CA certificate path -# -# ca_file "/etc/pki/CA/cacert.pem" - -# Specify a certificate revocation list. -# -# Defaults to not using a CRL, uncomment to enable it -# crl_file "/etc/pki/CA/crl.pem" +#tls_no_verify_certificate = 1 + # A whitelist of allowed x509 Distinguished Names -# This list may contain wildcards such as +# This list may contain wildcards such as # # "C=GB,ST=London,L=London,O=Red Hat,CN=*" # @@ -124,18 +190,23 @@ # entirely rather than using empty list to disable these checks # # By default, no DN's are checked -# tls_allowed_dn_list ["DN1", "DN2"] - - -# A whitelist of allowed client IP addresses -# -# This list may contain wildcards such as 192.168.* See the POSIX fnmatch -# function for the format of the wildcards. +#tls_allowed_dn_list = ["DN1", "DN2"] + + +# A whitelist of allowed SASL usernames. The format for usernames +# depends on the SASL authentication mechanism. Kerberos usernames +# look like username@REALM +# +# This list may contain wildcards such as +# +# &quot;*(a)EXAMPLE.COM&quot; +# +# See the POSIX fnmatch function for the format of the wildcards. # # NB If this is an empty list, no client can connect, so comment out # entirely rather than using empty list to disable these checks # -# By default, no IP's are checked. This can be IPv4 or IPv6 addresses -# tls_allowed_ip_list ["ip1", "ip2", "ip3"] - - +# By default, no Username's are checked +#sasl_allowed_username_list = [&quot;joe(a)EXAMPLE.COM&quot;, &quot;fred(a)EXAMPLE.COM&quot; ] + + diff -r b68f6ec36358 qemud/qemud.c --- a/qemud/qemud.c Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/qemud.c Fri Nov 30 15:15:26 2007 -0500 @@ -77,14 +77,21 @@ static int unix_sock_rw_mask = 0700; /* static int unix_sock_rw_mask = 0700; /* Allow user only */ static int unix_sock_ro_mask = 0777; /* Allow world */ +static int auth_unix_rw = REMOTE_AUTH_NONE; +static int auth_unix_ro = REMOTE_AUTH_NONE; +#if HAVE_SASL +static int auth_tcp = REMOTE_AUTH_SASL; +#else +static int auth_tcp = REMOTE_AUTH_NONE; +#endif +static int auth_tls = REMOTE_AUTH_NONE; + #ifdef HAVE_AVAHI static int mdns_adv = 1; static char *mdns_name = NULL; #endif static int tls_no_verify_certificate = 0; -static int tls_no_verify_address = 0; -static char **tls_allowed_ip_list = NULL; static char **tls_allowed_dn_list = NULL; static char *key_file = (char *) LIBVIRT_SERVERKEY; @@ -450,7 +457,7 @@ static int qemudWritePidFile(const char } static int qemudListenUnix(struct qemud_server *server, - const char *path, int readonly) { + const char *path, int readonly, int auth) { struct qemud_socket *sock = calloc(1, sizeof(struct qemud_socket)); struct sockaddr_un addr; mode_t oldmask; @@ -464,6 +471,7 @@ static int qemudListenUnix(struct qemud_ sock->readonly = readonly; sock->port = -1; sock->type = QEMUD_SOCK_TYPE_UNIX; + sock->auth = auth; if ((sock->fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) { qemudLog(QEMUD_ERR, "Failed to create socket: %s", @@ -701,6 +709,27 @@ static int qemudInitPaths(struct qemud_s static struct qemud_server *qemudInitialize(int sigread) { struct qemud_server *server; + + if (!(server = calloc(1, sizeof(struct qemud_server)))) { + qemudLog(QEMUD_ERR, "Failed to allocate struct qemud_server"); + return NULL; + } + + server->sigread = sigread; + + __virEventRegisterImpl(virEventAddHandleImpl, + virEventUpdateHandleImpl, + virEventRemoveHandleImpl, + virEventAddTimeoutImpl, + virEventUpdateTimeoutImpl, + virEventRemoveTimeoutImpl); + + virStateInitialize(); + + return server; +} + +static struct qemud_server *qemudNetworkInit(struct qemud_server *server) { struct qemud_socket *sock; char sockname[PATH_MAX]; char roSockname[PATH_MAX]; @@ -708,56 +737,39 @@ static struct qemud_server *qemudInitial int err; #endif /* HAVE_SASL */ - if (!(server = calloc(1, sizeof(struct qemud_server)))) { - qemudLog(QEMUD_ERR, "Failed to allocate struct qemud_server"); - return NULL; - } - - /* We don't have a dom-0, so start from 1 */ - server->sigread = sigread; - roSockname[0] = '\0'; if (qemudInitPaths(server, sockname, roSockname, PATH_MAX) < 0) goto cleanup; - if (qemudListenUnix(server, sockname, 0) < 0) + if (qemudListenUnix(server, sockname, 0, auth_unix_rw) < 0) goto cleanup; - if (roSockname[0] != '\0' && qemudListenUnix(server, roSockname, 1) < 0) + if (roSockname[0] != '\0' && qemudListenUnix(server, roSockname, 1, auth_unix_ro) < 0) goto cleanup; - __virEventRegisterImpl(virEventAddHandleImpl, - virEventUpdateHandleImpl, - virEventRemoveHandleImpl, - virEventAddTimeoutImpl, - virEventUpdateTimeoutImpl, - virEventRemoveTimeoutImpl); - - virStateInitialize(); - #if HAVE_SASL - if ((err = sasl_server_init(NULL, "libvirt")) != SASL_OK) { - qemudLog(QEMUD_ERR, "Failed to initialize SASL authentication %s", - sasl_errstring(err, NULL, NULL)); - goto cleanup; + if (auth_unix_rw == REMOTE_AUTH_SASL || + auth_unix_ro == REMOTE_AUTH_SASL || + auth_tcp == REMOTE_AUTH_SASL || + auth_tls == REMOTE_AUTH_SASL) { + if ((err = sasl_server_init(NULL, "libvirt")) != SASL_OK) { + qemudLog(QEMUD_ERR, "Failed to initialize SASL authentication %s", + sasl_errstring(err, NULL, NULL)); + goto cleanup; + } } #endif if (ipsock) { -#if HAVE_SASL - if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, REMOTE_AUTH_SASL) < 0) + if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, auth_tcp) < 0) goto cleanup; -#else - if (listen_tcp && remoteListenTCP (server, tcp_port, QEMUD_SOCK_TYPE_TCP, REMOTE_AUTH_NONE) < 0) - goto cleanup; -#endif if (listen_tls) { if (remoteInitializeGnuTLS () < 0) goto cleanup; - if (remoteListenTCP (server, tls_port, QEMUD_SOCK_TYPE_TLS, REMOTE_AUTH_NONE) < 0) + if (remoteListenTCP (server, tls_port, QEMUD_SOCK_TYPE_TLS, auth_tls) < 0) goto cleanup; } } @@ -977,53 +989,11 @@ static int static int remoteCheckAccess (struct qemud_client *client) { - char addr[NI_MAXHOST]; - char **wildcards; - int found, err; - /* Verify client certificate. */ if (remoteCheckCertificate (client->tlssession) == -1) { qemudLog (QEMUD_ERR, "remoteCheckCertificate: failed to verify client's certificate"); if (!tls_no_verify_certificate) return -1; else qemudLog (QEMUD_INFO, "remoteCheckCertificate: tls_no_verify_certificate is set so the bad certificate is ignored"); - } - - /*----- IP address check, similar to tcp wrappers -----*/ - - /* Convert IP address to printable string (eg. "127.0.0.1" or "::1"). */ - err = getnameinfo ((struct sockaddr *) &client->addr, client->addrlen, - addr, sizeof addr, NULL, 0, - NI_NUMERICHOST); - if (err != 0) { - qemudLog (QEMUD_ERR, "getnameinfo: %s", gai_strerror (err)); - return -1; - } - - /* Verify the client is on the list of allowed clients. - * - * NB: No tls_allowed_ip_list in config file means anyone can access. - * If tls_allowed_ip_list is in the config file but empty, means no - * one can access (not particularly useful, but it's what the sysadmin - * would expect). - */ - wildcards = tls_allowed_ip_list; - if (wildcards) { - found = 0; - - while (*wildcards) { - if (fnmatch (*wildcards, addr, 0) == 0) { - found = 1; - break; - } - wildcards++; - } - } else - found = 1; - - if (!found) { - qemudLog (QEMUD_ERR, "remoteCheckAccess: client's IP address (%s) is not on the list of allowed clients (tls_allowed_ip_list)", addr); - if (!tls_no_verify_address) return -1; - else qemudLog (QEMUD_INFO, "remoteCheckAccess: tls_no_verify_address is set so the client's IP address is ignored"); } /* Checks have succeeded. Write a '\1' byte back to the client to @@ -1150,6 +1120,7 @@ static void qemudDispatchClientFailure(s #if HAVE_SASL if (client->saslconn) sasl_dispose(&client->saslconn); + if (client->saslUsername) free(client->saslUsername); #endif if (client->tlssession) gnutls_deinit (client->tlssession); close(client->fd); @@ -1651,6 +1622,14 @@ static void qemudCleanup(struct qemud_se sock = next; } + if (server->saslUsernameWhitelist) { + char **list = server->saslUsernameWhitelist; + while (*list) { + if (*list) + free(*list); + list++; + } + } virStateCleanup(); @@ -1782,11 +1761,41 @@ checkType (virConfValuePtr p, const char } \ } while (0) + +static int remoteConfigGetAuth(virConfPtr conf, const char *key, int *auth, const char *filename) { + virConfValuePtr p; + + p = virConfGetValue (conf, key); + if (!p) + return 0; + + if (p->type != VIR_CONF_STRING) { + qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: %s: should be a string\n", filename, key); + return -1; + } + + if (!p->str) + return 0; + + if (STREQ(p->str, "none")) { + *auth = REMOTE_AUTH_NONE; +#if HAVE_SASL + } else if (STREQ(p->str, "sasl")) { + *auth = REMOTE_AUTH_SASL; +#endif + } else { + qemudLog (QEMUD_ERR, "remoteReadConfigFile: %s: %s: unsupported auth %s\n", filename, key, p->str); + return -1; + } + + return 0; +} + /* Read the config file if it exists. * Only used in the remote case, hence the name. */ static int -remoteReadConfigFile (const char *filename) +remoteReadConfigFile (struct qemud_server *server, const char *filename) { virConfPtr conf; @@ -1806,6 +1815,15 @@ remoteReadConfigFile (const char *filena GET_CONF_STR (conf, filename, tls_port); GET_CONF_STR (conf, filename, tcp_port); + + if (remoteConfigGetAuth(conf, "auth_unix_rw", &auth_unix_rw, filename) < 0) + return -1; + if (remoteConfigGetAuth(conf, "auth_unix_ro", &auth_unix_ro, filename) < 0) + return -1; + if (remoteConfigGetAuth(conf, "auth_tcp", &auth_tcp, filename) < 0) + return -1; + if (remoteConfigGetAuth(conf, "auth_tls", &auth_tls, filename) < 0) + return -1; GET_CONF_STR (conf, filename, unix_sock_group); if (unix_sock_group) { @@ -1852,7 +1870,6 @@ remoteReadConfigFile (const char *filena #endif GET_CONF_INT (conf, filename, tls_no_verify_certificate); - GET_CONF_INT (conf, filename, tls_no_verify_address); GET_CONF_STR (conf, filename, key_file); GET_CONF_STR (conf, filename, cert_file); @@ -1863,8 +1880,8 @@ remoteReadConfigFile (const char *filena &tls_allowed_dn_list, filename) < 0) goto free_and_fail; - if (remoteConfigGetStringList (conf, "tls_allowed_ip_list", - &tls_allowed_ip_list, filename) < 0) + if (remoteConfigGetStringList (conf, "sasl_allowed_username_list", + &server->saslUsernameWhitelist, filename) < 0) goto free_and_fail; virConfFree (conf); @@ -1890,14 +1907,6 @@ remoteReadConfigFile (const char *filena free (tls_allowed_dn_list[i]); free (tls_allowed_dn_list); tls_allowed_dn_list = NULL; - } - - if (tls_allowed_ip_list) { - int i; - for (i = 0; tls_allowed_ip_list[i]; i++) - free (tls_allowed_ip_list[i]); - free (tls_allowed_ip_list); - tls_allowed_ip_list = NULL; } return -1; @@ -2020,13 +2029,6 @@ int main(int argc, char **argv) { } } - /* Read the config file (if it exists). */ - if (remoteReadConfigFile (remote_config_file) < 0) - goto error1; - - if (godaemon) - openlog("libvirtd", 0, 0); - if (pipe(sigpipe) < 0 || qemudSetNonBlock(sigpipe[0]) < 0 || qemudSetNonBlock(sigpipe[1]) < 0) { @@ -2034,8 +2036,38 @@ int main(int argc, char **argv) { strerror(errno)); goto error1; } - sigwrite = sigpipe[1]; + + if (!(server = qemudInitialize(sigpipe[0]))) { + ret = 2; + goto error1; + } + + /* Read the config file (if it exists). */ + if (remoteReadConfigFile (server, remote_config_file) < 0) + goto error1; + + if (godaemon) { + int pid; + openlog("libvirtd", 0, 0); + pid = qemudGoDaemon(); + if (pid < 0) { + qemudLog(QEMUD_ERR, "Failed to fork as daemon: %s", + strerror(errno)); + goto error1; + } + if (pid > 0) + goto out; + + /* Choose the name of the PID file. */ + if (!pid_file) { + if (REMOTE_PID_FILE[0] != '\0') + pid_file = REMOTE_PID_FILE; + } + + if (pid_file && qemudWritePidFile (pid_file) < 0) + goto error1; + } sig_action.sa_handler = sig_handler; sig_action.sa_flags = 0; @@ -2049,31 +2081,6 @@ int main(int argc, char **argv) { sig_action.sa_handler = SIG_IGN; sigaction(SIGPIPE, &sig_action, NULL); - - if (godaemon) { - int pid = qemudGoDaemon(); - if (pid < 0) { - qemudLog(QEMUD_ERR, "Failed to fork as daemon: %s", - strerror(errno)); - goto error1; - } - if (pid > 0) - goto out; - - /* Choose the name of the PID file. */ - if (!pid_file) { - if (REMOTE_PID_FILE[0] != '\0') - pid_file = REMOTE_PID_FILE; - } - - if (pid_file && qemudWritePidFile (pid_file) < 0) - goto error1; - } - - if (!(server = qemudInitialize(sigpipe[0]))) { - ret = 2; - goto error2; - } if (virEventAddHandleImpl(sigpipe[0], POLLIN, @@ -2081,6 +2088,11 @@ int main(int argc, char **argv) { server) < 0) { qemudLog(QEMUD_ERR, "Failed to register callback for signal pipe"); ret = 3; + goto error2; + } + + if (!(server = qemudNetworkInit(server))) { + ret = 2; goto error2; } diff -r b68f6ec36358 qemud/remote.c --- a/qemud/remote.c Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/remote.c Fri Nov 30 15:15:26 2007 -0500 @@ -44,6 +44,7 @@ #include <getopt.h> #include <ctype.h> #include <assert.h> +#include <fnmatch.h> #include <libvirt/virterror.h> @@ -65,14 +66,18 @@ static void make_nonnull_network (remote #include "remote_dispatch_prototypes.h" -typedef int (*dispatch_fn) (struct qemud_client *client, remote_message_header *req, char *args, char *ret); +typedef int (*dispatch_fn) (struct qemud_server *server, + struct qemud_client *client, + remote_message_header *req, + char *args, + char *ret); /* This function gets called from qemud when it detects an incoming * remote protocol message. At this point, client->buffer contains * the full call message (including length word which we skip). */ void -remoteDispatchClientRequest (struct qemud_server *server ATTRIBUTE_UNUSED, +remoteDispatchClientRequest (struct qemud_server *server, struct qemud_client *client) { XDR xdr; @@ -158,7 +163,7 @@ remoteDispatchClientRequest (struct qemu xdr_destroy (&xdr); /* Call function. */ - rv = fn (client, &req, args, ret); + rv = fn (server, client, &req, args, ret); xdr_free (args_filter, args); /* Dispatch function must return -2, -1 or 0. Anything else is @@ -398,7 +403,8 @@ remoteDispatchError (struct qemud_client /*----- Functions. -----*/ static int -remoteDispatchOpen (struct qemud_client *client, remote_message_header *req, +remoteDispatchOpen (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, struct remote_open_args *args, void *ret ATTRIBUTE_UNUSED) { const char *name; @@ -437,7 +443,8 @@ remoteDispatchOpen (struct qemud_client } static int -remoteDispatchClose (struct qemud_client *client, remote_message_header *req, +remoteDispatchClose (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, void *ret ATTRIBUTE_UNUSED) { int rv; @@ -450,7 +457,8 @@ remoteDispatchClose (struct qemud_client } static int -remoteDispatchSupportsFeature (struct qemud_client *client, remote_message_header *req, +remoteDispatchSupportsFeature (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_supports_feature_args *args, remote_supports_feature_ret *ret) { CHECK_CONN(client); @@ -462,7 +470,8 @@ remoteDispatchSupportsFeature (struct qe } static int -remoteDispatchGetType (struct qemud_client *client, remote_message_header *req, +remoteDispatchGetType (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_type_ret *ret) { const char *type; @@ -484,7 +493,8 @@ remoteDispatchGetType (struct qemud_clie } static int -remoteDispatchGetVersion (struct qemud_client *client, +remoteDispatchGetVersion (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_version_ret *ret) @@ -500,7 +510,8 @@ remoteDispatchGetVersion (struct qemud_c } static int -remoteDispatchGetHostname (struct qemud_client *client, +remoteDispatchGetHostname (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_hostname_ret *ret) @@ -516,7 +527,8 @@ remoteDispatchGetHostname (struct qemud_ } static int -remoteDispatchGetMaxVcpus (struct qemud_client *client, +remoteDispatchGetMaxVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_get_max_vcpus_args *args, remote_get_max_vcpus_ret *ret) @@ -532,7 +544,8 @@ remoteDispatchGetMaxVcpus (struct qemud_ } static int -remoteDispatchNodeGetInfo (struct qemud_client *client, +remoteDispatchNodeGetInfo (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_node_get_info_ret *ret) @@ -556,7 +569,8 @@ remoteDispatchNodeGetInfo (struct qemud_ } static int -remoteDispatchGetCapabilities (struct qemud_client *client, +remoteDispatchGetCapabilities (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_get_capabilities_ret *ret) @@ -572,7 +586,8 @@ remoteDispatchGetCapabilities (struct qe } static int -remoteDispatchDomainGetSchedulerType (struct qemud_client *client, +remoteDispatchDomainGetSchedulerType (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_type_args *args, remote_domain_get_scheduler_type_ret *ret) @@ -601,7 +616,8 @@ remoteDispatchDomainGetSchedulerType (st } static int -remoteDispatchDomainGetSchedulerParameters (struct qemud_client *client, +remoteDispatchDomainGetSchedulerParameters (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_parameters_args *args, remote_domain_get_scheduler_parameters_ret *ret) @@ -687,7 +703,8 @@ remoteDispatchDomainGetSchedulerParamete } static int -remoteDispatchDomainSetSchedulerParameters (struct qemud_client *client, +remoteDispatchDomainSetSchedulerParameters (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_scheduler_parameters_args *args, void *ret ATTRIBUTE_UNUSED) @@ -747,7 +764,8 @@ remoteDispatchDomainSetSchedulerParamete } static int -remoteDispatchDomainBlockStats (struct qemud_client *client, +remoteDispatchDomainBlockStats (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret) @@ -777,7 +795,8 @@ remoteDispatchDomainBlockStats (struct q } static int -remoteDispatchDomainInterfaceStats (struct qemud_client *client, +remoteDispatchDomainInterfaceStats (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_interface_stats_args *args, remote_domain_interface_stats_ret *ret) @@ -810,7 +829,8 @@ remoteDispatchDomainInterfaceStats (stru } static int -remoteDispatchDomainAttachDevice (struct qemud_client *client, +remoteDispatchDomainAttachDevice (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret ATTRIBUTE_UNUSED) @@ -833,7 +853,8 @@ remoteDispatchDomainAttachDevice (struct } static int -remoteDispatchDomainCreate (struct qemud_client *client, +remoteDispatchDomainCreate (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_create_args *args, void *ret ATTRIBUTE_UNUSED) @@ -856,7 +877,8 @@ remoteDispatchDomainCreate (struct qemud } static int -remoteDispatchDomainCreateLinux (struct qemud_client *client, +remoteDispatchDomainCreateLinux (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_create_linux_args *args, remote_domain_create_linux_ret *ret) @@ -874,7 +896,8 @@ remoteDispatchDomainCreateLinux (struct } static int -remoteDispatchDomainDefineXml (struct qemud_client *client, +remoteDispatchDomainDefineXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_define_xml_args *args, remote_domain_define_xml_ret *ret) @@ -892,7 +915,8 @@ remoteDispatchDomainDefineXml (struct qe } static int -remoteDispatchDomainDestroy (struct qemud_client *client, +remoteDispatchDomainDestroy (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_destroy_args *args, void *ret ATTRIBUTE_UNUSED) @@ -913,7 +937,8 @@ remoteDispatchDomainDestroy (struct qemu } static int -remoteDispatchDomainDetachDevice (struct qemud_client *client, +remoteDispatchDomainDetachDevice (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_detach_device_args *args, void *ret ATTRIBUTE_UNUSED) @@ -937,7 +962,8 @@ remoteDispatchDomainDetachDevice (struct } static int -remoteDispatchDomainDumpXml (struct qemud_client *client, +remoteDispatchDomainDumpXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_dump_xml_args *args, remote_domain_dump_xml_ret *ret) @@ -962,7 +988,8 @@ remoteDispatchDomainDumpXml (struct qemu } static int -remoteDispatchDomainGetAutostart (struct qemud_client *client, +remoteDispatchDomainGetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_autostart_args *args, remote_domain_get_autostart_ret *ret) @@ -985,7 +1012,8 @@ remoteDispatchDomainGetAutostart (struct } static int -remoteDispatchDomainGetInfo (struct qemud_client *client, +remoteDispatchDomainGetInfo (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_info_args *args, remote_domain_get_info_ret *ret) @@ -1017,7 +1045,8 @@ remoteDispatchDomainGetInfo (struct qemu } static int -remoteDispatchDomainGetMaxMemory (struct qemud_client *client, +remoteDispatchDomainGetMaxMemory (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_max_memory_args *args, remote_domain_get_max_memory_ret *ret) @@ -1041,7 +1070,8 @@ remoteDispatchDomainGetMaxMemory (struct } static int -remoteDispatchDomainGetMaxVcpus (struct qemud_client *client, +remoteDispatchDomainGetMaxVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_max_vcpus_args *args, remote_domain_get_max_vcpus_ret *ret) @@ -1065,7 +1095,8 @@ remoteDispatchDomainGetMaxVcpus (struct } static int -remoteDispatchDomainGetOsType (struct qemud_client *client, +remoteDispatchDomainGetOsType (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_os_type_args *args, remote_domain_get_os_type_ret *ret) @@ -1090,7 +1121,8 @@ remoteDispatchDomainGetOsType (struct qe } static int -remoteDispatchDomainGetVcpus (struct qemud_client *client, +remoteDispatchDomainGetVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_get_vcpus_args *args, remote_domain_get_vcpus_ret *ret) @@ -1154,7 +1186,8 @@ remoteDispatchDomainGetVcpus (struct qem } static int -remoteDispatchDomainMigratePrepare (struct qemud_client *client, +remoteDispatchDomainMigratePrepare (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_migrate_prepare_args *args, remote_domain_migrate_prepare_ret *ret) @@ -1189,7 +1222,8 @@ remoteDispatchDomainMigratePrepare (stru } static int -remoteDispatchDomainMigratePerform (struct qemud_client *client, +remoteDispatchDomainMigratePerform (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_migrate_perform_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1218,7 +1252,8 @@ remoteDispatchDomainMigratePerform (stru } static int -remoteDispatchDomainMigrateFinish (struct qemud_client *client, +remoteDispatchDomainMigrateFinish (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_migrate_finish_args *args, remote_domain_migrate_finish_ret *ret) @@ -1239,7 +1274,8 @@ remoteDispatchDomainMigrateFinish (struc } static int -remoteDispatchListDefinedDomains (struct qemud_client *client, +remoteDispatchListDefinedDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_defined_domains_args *args, remote_list_defined_domains_ret *ret) @@ -1264,7 +1300,8 @@ remoteDispatchListDefinedDomains (struct } static int -remoteDispatchDomainLookupById (struct qemud_client *client, +remoteDispatchDomainLookupById (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_id_args *args, remote_domain_lookup_by_id_ret *ret) @@ -1281,7 +1318,8 @@ remoteDispatchDomainLookupById (struct q } static int -remoteDispatchDomainLookupByName (struct qemud_client *client, +remoteDispatchDomainLookupByName (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_name_args *args, remote_domain_lookup_by_name_ret *ret) @@ -1298,7 +1336,8 @@ remoteDispatchDomainLookupByName (struct } static int -remoteDispatchDomainLookupByUuid (struct qemud_client *client, +remoteDispatchDomainLookupByUuid (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_uuid_args *args, remote_domain_lookup_by_uuid_ret *ret) @@ -1315,7 +1354,8 @@ remoteDispatchDomainLookupByUuid (struct } static int -remoteDispatchNumOfDefinedDomains (struct qemud_client *client, +remoteDispatchNumOfDefinedDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_defined_domains_ret *ret) @@ -1329,7 +1369,8 @@ remoteDispatchNumOfDefinedDomains (struc } static int -remoteDispatchDomainPinVcpu (struct qemud_client *client, +remoteDispatchDomainPinVcpu (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_pin_vcpu_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1362,7 +1403,8 @@ remoteDispatchDomainPinVcpu (struct qemu } static int -remoteDispatchDomainReboot (struct qemud_client *client, +remoteDispatchDomainReboot (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_reboot_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1385,7 +1427,8 @@ remoteDispatchDomainReboot (struct qemud } static int -remoteDispatchDomainRestore (struct qemud_client *client, +remoteDispatchDomainRestore (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_restore_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1399,7 +1442,8 @@ remoteDispatchDomainRestore (struct qemu } static int -remoteDispatchDomainResume (struct qemud_client *client, +remoteDispatchDomainResume (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_resume_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1422,7 +1466,8 @@ remoteDispatchDomainResume (struct qemud } static int -remoteDispatchDomainSave (struct qemud_client *client, +remoteDispatchDomainSave (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_save_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1445,7 +1490,8 @@ remoteDispatchDomainSave (struct qemud_c } static int -remoteDispatchDomainCoreDump (struct qemud_client *client, +remoteDispatchDomainCoreDump (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_core_dump_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1468,7 +1514,8 @@ remoteDispatchDomainCoreDump (struct qem } static int -remoteDispatchDomainSetAutostart (struct qemud_client *client, +remoteDispatchDomainSetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_autostart_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1491,7 +1538,8 @@ remoteDispatchDomainSetAutostart (struct } static int -remoteDispatchDomainSetMaxMemory (struct qemud_client *client, +remoteDispatchDomainSetMaxMemory (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_max_memory_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1514,7 +1562,8 @@ remoteDispatchDomainSetMaxMemory (struct } static int -remoteDispatchDomainSetMemory (struct qemud_client *client, +remoteDispatchDomainSetMemory (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_memory_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1537,7 +1586,8 @@ remoteDispatchDomainSetMemory (struct qe } static int -remoteDispatchDomainSetVcpus (struct qemud_client *client, +remoteDispatchDomainSetVcpus (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_set_vcpus_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1560,7 +1610,8 @@ remoteDispatchDomainSetVcpus (struct qem } static int -remoteDispatchDomainShutdown (struct qemud_client *client, +remoteDispatchDomainShutdown (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_shutdown_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1583,7 +1634,8 @@ remoteDispatchDomainShutdown (struct qem } static int -remoteDispatchDomainSuspend (struct qemud_client *client, +remoteDispatchDomainSuspend (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_suspend_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1606,7 +1658,8 @@ remoteDispatchDomainSuspend (struct qemu } static int -remoteDispatchDomainUndefine (struct qemud_client *client, +remoteDispatchDomainUndefine (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_domain_undefine_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1629,7 +1682,8 @@ remoteDispatchDomainUndefine (struct qem } static int -remoteDispatchListDefinedNetworks (struct qemud_client *client, +remoteDispatchListDefinedNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_defined_networks_args *args, remote_list_defined_networks_ret *ret) @@ -1654,7 +1708,8 @@ remoteDispatchListDefinedNetworks (struc } static int -remoteDispatchListDomains (struct qemud_client *client, +remoteDispatchListDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_domains_args *args, remote_list_domains_ret *ret) @@ -1678,7 +1733,8 @@ remoteDispatchListDomains (struct qemud_ } static int -remoteDispatchListNetworks (struct qemud_client *client, +remoteDispatchListNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_list_networks_args *args, remote_list_networks_ret *ret) @@ -1703,7 +1759,8 @@ remoteDispatchListNetworks (struct qemud } static int -remoteDispatchNetworkCreate (struct qemud_client *client, +remoteDispatchNetworkCreate (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_create_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1726,7 +1783,8 @@ remoteDispatchNetworkCreate (struct qemu } static int -remoteDispatchNetworkCreateXml (struct qemud_client *client, +remoteDispatchNetworkCreateXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_create_xml_args *args, remote_network_create_xml_ret *ret) @@ -1743,7 +1801,8 @@ remoteDispatchNetworkCreateXml (struct q } static int -remoteDispatchNetworkDefineXml (struct qemud_client *client, +remoteDispatchNetworkDefineXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_define_xml_args *args, remote_network_define_xml_ret *ret) @@ -1760,7 +1819,8 @@ remoteDispatchNetworkDefineXml (struct q } static int -remoteDispatchNetworkDestroy (struct qemud_client *client, +remoteDispatchNetworkDestroy (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_destroy_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1783,7 +1843,8 @@ remoteDispatchNetworkDestroy (struct qem } static int -remoteDispatchNetworkDumpXml (struct qemud_client *client, +remoteDispatchNetworkDumpXml (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_dump_xml_args *args, remote_network_dump_xml_ret *ret) @@ -1808,7 +1869,8 @@ remoteDispatchNetworkDumpXml (struct qem } static int -remoteDispatchNetworkGetAutostart (struct qemud_client *client, +remoteDispatchNetworkGetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_get_autostart_args *args, remote_network_get_autostart_ret *ret) @@ -1831,7 +1893,8 @@ remoteDispatchNetworkGetAutostart (struc } static int -remoteDispatchNetworkGetBridgeName (struct qemud_client *client, +remoteDispatchNetworkGetBridgeName (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_get_bridge_name_args *args, remote_network_get_bridge_name_ret *ret) @@ -1856,7 +1919,8 @@ remoteDispatchNetworkGetBridgeName (stru } static int -remoteDispatchNetworkLookupByName (struct qemud_client *client, +remoteDispatchNetworkLookupByName (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_name_args *args, remote_network_lookup_by_name_ret *ret) @@ -1873,7 +1937,8 @@ remoteDispatchNetworkLookupByName (struc } static int -remoteDispatchNetworkLookupByUuid (struct qemud_client *client, +remoteDispatchNetworkLookupByUuid (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_uuid_args *args, remote_network_lookup_by_uuid_ret *ret) @@ -1890,7 +1955,8 @@ remoteDispatchNetworkLookupByUuid (struc } static int -remoteDispatchNetworkSetAutostart (struct qemud_client *client, +remoteDispatchNetworkSetAutostart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_set_autostart_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1913,7 +1979,8 @@ remoteDispatchNetworkSetAutostart (struc } static int -remoteDispatchNetworkUndefine (struct qemud_client *client, +remoteDispatchNetworkUndefine (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_network_undefine_args *args, void *ret ATTRIBUTE_UNUSED) @@ -1936,7 +2003,8 @@ remoteDispatchNetworkUndefine (struct qe } static int -remoteDispatchNumOfDefinedNetworks (struct qemud_client *client, +remoteDispatchNumOfDefinedNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_defined_networks_ret *ret) @@ -1950,7 +2018,8 @@ remoteDispatchNumOfDefinedNetworks (stru } static int -remoteDispatchNumOfDomains (struct qemud_client *client, +remoteDispatchNumOfDomains (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_domains_ret *ret) @@ -1964,7 +2033,8 @@ remoteDispatchNumOfDomains (struct qemud } static int -remoteDispatchNumOfNetworks (struct qemud_client *client, +remoteDispatchNumOfNetworks (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_num_of_networks_ret *ret) @@ -1979,7 +2049,8 @@ remoteDispatchNumOfNetworks (struct qemu static int -remoteDispatchAuthList (struct qemud_client *client, +remoteDispatchAuthList (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req ATTRIBUTE_UNUSED, void *args ATTRIBUTE_UNUSED, remote_auth_list_ret *ret) @@ -2034,7 +2105,8 @@ static char *addrToString(struct qemud_c * XXX callbacks for stuff like password verification ? */ static int -remoteDispatchAuthSaslInit (struct qemud_client *client, +remoteDispatchAuthSaslInit (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_auth_sasl_init_ret *ret) @@ -2223,11 +2295,67 @@ remoteSASLCheckSSF (struct qemud_client return 0; } +static int +remoteSASLCheckAccess (struct qemud_server *server, + struct qemud_client *client, + remote_message_header *req) { + const void *val; + int err; + char **wildcards; + + err = sasl_getprop(client->saslconn, SASL_USERNAME, &val); + if (err != SASL_OK) { + qemudLog(QEMUD_ERR, "cannot query SASL username on connection %d (%s)", + err, sasl_errstring(err, NULL, NULL)); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + if (val == NULL) { + qemudLog(QEMUD_ERR, "no client username was found"); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + REMOTE_DEBUG("SASL client username %s", (const char *)val); + + client->saslUsername = strdup((const char*)val); + if (client->saslUsername == NULL) { + qemudLog(QEMUD_ERR, "out of memory copying username"); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; + } + + /* If the list is not set, allow any DN. */ + wildcards = server->saslUsernameWhitelist; + if (!wildcards) + return 0; /* No ACL, allow all */ + + while (*wildcards) { + if (fnmatch (*wildcards, client->saslUsername, 0) == 0) + return 0; /* Allowed */ + wildcards++; + } + + /* Denied */ + qemudLog(QEMUD_ERR, "SASL client %s not allowed in whitelist", client->saslUsername); + remoteDispatchFailAuth(client, req); + sasl_dispose(&client->saslconn); + client->saslconn = NULL; + return -1; +} + + /* * This starts the SASL authentication negotiation. */ static int -remoteDispatchAuthSaslStart (struct qemud_client *client, +remoteDispatchAuthSaslStart (struct qemud_server *server, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret) @@ -2291,6 +2419,10 @@ remoteDispatchAuthSaslStart (struct qemu if (remoteSASLCheckSSF(client, req) < 0) return -2; + /* Check username whitelist ACL */ + if (remoteSASLCheckAccess(server, client, req) < 0) + return -2; + REMOTE_DEBUG("Authentication successful %d", client->fd); ret->complete = 1; client->auth = REMOTE_AUTH_NONE; @@ -2301,7 +2433,8 @@ remoteDispatchAuthSaslStart (struct qemu static int -remoteDispatchAuthSaslStep (struct qemud_client *client, +remoteDispatchAuthSaslStep (struct qemud_server *server, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret) @@ -2365,6 +2498,10 @@ remoteDispatchAuthSaslStep (struct qemud if (remoteSASLCheckSSF(client, req) < 0) return -2; + /* Check username whitelist ACL */ + if (remoteSASLCheckAccess(server, client, req) < 0) + return -2; + REMOTE_DEBUG("Authentication successful %d", client->fd); ret->complete = 1; client->auth = REMOTE_AUTH_NONE; @@ -2376,7 +2513,8 @@ remoteDispatchAuthSaslStep (struct qemud #else /* HAVE_SASL */ static int -remoteDispatchAuthSaslInit (struct qemud_client *client, +remoteDispatchAuthSaslInit (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, void *args ATTRIBUTE_UNUSED, remote_auth_sasl_init_ret *ret ATTRIBUTE_UNUSED) @@ -2387,7 +2525,8 @@ remoteDispatchAuthSaslInit (struct qemud } static int -remoteDispatchAuthSaslStart (struct qemud_client *client, +remoteDispatchAuthSaslStart (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args ATTRIBUTE_UNUSED, remote_auth_sasl_start_ret *ret ATTRIBUTE_UNUSED) @@ -2398,7 +2537,8 @@ remoteDispatchAuthSaslStart (struct qemu } static int -remoteDispatchAuthSaslStep (struct qemud_client *client, +remoteDispatchAuthSaslStep (struct qemud_server *server ATTRIBUTE_UNUSED, + struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args ATTRIBUTE_UNUSED, remote_auth_sasl_step_ret *ret ATTRIBUTE_UNUSED) diff -r b68f6ec36358 qemud/remote_dispatch_prototypes.h --- a/qemud/remote_dispatch_prototypes.h Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/remote_dispatch_prototypes.h Fri Nov 30 15:15:26 2007 -0500 @@ -2,72 +2,72 @@ * Do not edit this file. Any changes you make will be lost. */ -static int remoteDispatchAuthList (struct qemud_client *client, remote_message_header *req, void *args, remote_auth_list_ret *ret); -static int remoteDispatchAuthSaslInit (struct qemud_client *client, remote_message_header *req, void *args, remote_auth_sasl_init_ret *ret); -static int remoteDispatchAuthSaslStart (struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret); -static int remoteDispatchAuthSaslStep (struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret); -static int remoteDispatchClose (struct qemud_client *client, remote_message_header *req, void *args, void *ret); -static int remoteDispatchDomainAttachDevice (struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret); -static int remoteDispatchDomainBlockStats (struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret); -static int remoteDispatchDomainCoreDump (struct qemud_client *client, remote_message_header *req, remote_domain_core_dump_args *args, void *ret); -static int remoteDispatchDomainCreate (struct qemud_client *client, remote_message_header *req, remote_domain_create_args *args, void *ret); -static int remoteDispatchDomainCreateLinux (struct qemud_client *client, remote_message_header *req, remote_domain_create_linux_args *args, remote_domain_create_linux_ret *ret); -static int remoteDispatchDomainDefineXml (struct qemud_client *client, remote_message_header *req, remote_domain_define_xml_args *args, remote_domain_define_xml_ret *ret); -static int remoteDispatchDomainDestroy (struct qemud_client *client, remote_message_header *req, remote_domain_destroy_args *args, void *ret); -static int remoteDispatchDomainDetachDevice (struct qemud_client *client, remote_message_header *req, remote_domain_detach_device_args *args, void *ret); -static int remoteDispatchDomainDumpXml (struct qemud_client *client, remote_message_header *req, remote_domain_dump_xml_args *args, remote_domain_dump_xml_ret *ret); -static int remoteDispatchDomainGetAutostart (struct qemud_client *client, remote_message_header *req, remote_domain_get_autostart_args *args, remote_domain_get_autostart_ret *ret); -static int remoteDispatchDomainGetInfo (struct qemud_client *client, remote_message_header *req, remote_domain_get_info_args *args, remote_domain_get_info_ret *ret); -static int remoteDispatchDomainGetMaxMemory (struct qemud_client *client, remote_message_header *req, remote_domain_get_max_memory_args *args, remote_domain_get_max_memory_ret *ret); -static int remoteDispatchDomainGetMaxVcpus (struct qemud_client *client, remote_message_header *req, remote_domain_get_max_vcpus_args *args, remote_domain_get_max_vcpus_ret *ret); -static int remoteDispatchDomainGetOsType (struct qemud_client *client, remote_message_header *req, remote_domain_get_os_type_args *args, remote_domain_get_os_type_ret *ret); -static int remoteDispatchDomainGetSchedulerParameters (struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_parameters_args *args, remote_domain_get_scheduler_parameters_ret *ret); -static int remoteDispatchDomainGetSchedulerType (struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_type_args *args, remote_domain_get_scheduler_type_ret *ret); -static int remoteDispatchDomainGetVcpus (struct qemud_client *client, remote_message_header *req, remote_domain_get_vcpus_args *args, remote_domain_get_vcpus_ret *ret); -static int remoteDispatchDomainInterfaceStats (struct qemud_client *client, remote_message_header *req, remote_domain_interface_stats_args *args, remote_domain_interface_stats_ret *ret); -static int remoteDispatchDomainLookupById (struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_id_args *args, remote_domain_lookup_by_id_ret *ret); -static int remoteDispatchDomainLookupByName (struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_name_args *args, remote_domain_lookup_by_name_ret *ret); -static int remoteDispatchDomainLookupByUuid (struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_uuid_args *args, remote_domain_lookup_by_uuid_ret *ret); -static int remoteDispatchDomainMigrateFinish (struct qemud_client *client, remote_message_header *req, remote_domain_migrate_finish_args *args, remote_domain_migrate_finish_ret *ret); -static int remoteDispatchDomainMigratePerform (struct qemud_client *client, remote_message_header *req, remote_domain_migrate_perform_args *args, void *ret); -static int remoteDispatchDomainMigratePrepare (struct qemud_client *client, remote_message_header *req, remote_domain_migrate_prepare_args *args, remote_domain_migrate_prepare_ret *ret); -static int remoteDispatchDomainPinVcpu (struct qemud_client *client, remote_message_header *req, remote_domain_pin_vcpu_args *args, void *ret); -static int remoteDispatchDomainReboot (struct qemud_client *client, remote_message_header *req, remote_domain_reboot_args *args, void *ret); -static int remoteDispatchDomainRestore (struct qemud_client *client, remote_message_header *req, remote_domain_restore_args *args, void *ret); -static int remoteDispatchDomainResume (struct qemud_client *client, remote_message_header *req, remote_domain_resume_args *args, void *ret); -static int remoteDispatchDomainSave (struct qemud_client *client, remote_message_header *req, remote_domain_save_args *args, void *ret); -static int remoteDispatchDomainSetAutostart (struct qemud_client *client, remote_message_header *req, remote_domain_set_autostart_args *args, void *ret); -static int remoteDispatchDomainSetMaxMemory (struct qemud_client *client, remote_message_header *req, remote_domain_set_max_memory_args *args, void *ret); -static int remoteDispatchDomainSetMemory (struct qemud_client *client, remote_message_header *req, remote_domain_set_memory_args *args, void *ret); -static int remoteDispatchDomainSetSchedulerParameters (struct qemud_client *client, remote_message_header *req, remote_domain_set_scheduler_parameters_args *args, void *ret); -static int remoteDispatchDomainSetVcpus (struct qemud_client *client, remote_message_header *req, remote_domain_set_vcpus_args *args, void *ret); -static int remoteDispatchDomainShutdown (struct qemud_client *client, remote_message_header *req, remote_domain_shutdown_args *args, void *ret); -static int remoteDispatchDomainSuspend (struct qemud_client *client, remote_message_header *req, remote_domain_suspend_args *args, void *ret); -static int remoteDispatchDomainUndefine (struct qemud_client *client, remote_message_header *req, remote_domain_undefine_args *args, void *ret); -static int remoteDispatchGetCapabilities (struct qemud_client *client, remote_message_header *req, void *args, remote_get_capabilities_ret *ret); -static int remoteDispatchGetHostname (struct qemud_client *client, remote_message_header *req, void *args, remote_get_hostname_ret *ret); -static int remoteDispatchGetMaxVcpus (struct qemud_client *client, remote_message_header *req, remote_get_max_vcpus_args *args, remote_get_max_vcpus_ret *ret); -static int remoteDispatchGetType (struct qemud_client *client, remote_message_header *req, void *args, remote_get_type_ret *ret); -static int remoteDispatchGetVersion (struct qemud_client *client, remote_message_header *req, void *args, remote_get_version_ret *ret); -static int remoteDispatchListDefinedDomains (struct qemud_client *client, remote_message_header *req, remote_list_defined_domains_args *args, remote_list_defined_domains_ret *ret); -static int remoteDispatchListDefinedNetworks (struct qemud_client *client, remote_message_header *req, remote_list_defined_networks_args *args, remote_list_defined_networks_ret *ret); -static int remoteDispatchListDomains (struct qemud_client *client, remote_message_header *req, remote_list_domains_args *args, remote_list_domains_ret *ret); -static int remoteDispatchListNetworks (struct qemud_client *client, remote_message_header *req, remote_list_networks_args *args, remote_list_networks_ret *ret); -static int remoteDispatchNetworkCreate (struct qemud_client *client, remote_message_header *req, remote_network_create_args *args, void *ret); -static int remoteDispatchNetworkCreateXml (struct qemud_client *client, remote_message_header *req, remote_network_create_xml_args *args, remote_network_create_xml_ret *ret); -static int remoteDispatchNetworkDefineXml (struct qemud_client *client, remote_message_header *req, remote_network_define_xml_args *args, remote_network_define_xml_ret *ret); -static int remoteDispatchNetworkDestroy (struct qemud_client *client, remote_message_header *req, remote_network_destroy_args *args, void *ret); -static int remoteDispatchNetworkDumpXml (struct qemud_client *client, remote_message_header *req, remote_network_dump_xml_args *args, remote_network_dump_xml_ret *ret); -static int remoteDispatchNetworkGetAutostart (struct qemud_client *client, remote_message_header *req, remote_network_get_autostart_args *args, remote_network_get_autostart_ret *ret); -static int remoteDispatchNetworkGetBridgeName (struct qemud_client *client, remote_message_header *req, remote_network_get_bridge_name_args *args, remote_network_get_bridge_name_ret *ret); -static int remoteDispatchNetworkLookupByName (struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_name_args *args, remote_network_lookup_by_name_ret *ret); -static int remoteDispatchNetworkLookupByUuid (struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_uuid_args *args, remote_network_lookup_by_uuid_ret *ret); -static int remoteDispatchNetworkSetAutostart (struct qemud_client *client, remote_message_header *req, remote_network_set_autostart_args *args, void *ret); -static int remoteDispatchNetworkUndefine (struct qemud_client *client, remote_message_header *req, remote_network_undefine_args *args, void *ret); -static int remoteDispatchNodeGetInfo (struct qemud_client *client, remote_message_header *req, void *args, remote_node_get_info_ret *ret); -static int remoteDispatchNumOfDefinedDomains (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_domains_ret *ret); -static int remoteDispatchNumOfDefinedNetworks (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_networks_ret *ret); -static int remoteDispatchNumOfDomains (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_domains_ret *ret); -static int remoteDispatchNumOfNetworks (struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_networks_ret *ret); -static int remoteDispatchOpen (struct qemud_client *client, remote_message_header *req, remote_open_args *args, void *ret); -static int remoteDispatchSupportsFeature (struct qemud_client *client, remote_message_header *req, remote_supports_feature_args *args, remote_supports_feature_ret *ret); +static int remoteDispatchAuthList (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_auth_list_ret *ret); +static int remoteDispatchAuthSaslInit (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_auth_sasl_init_ret *ret); +static int remoteDispatchAuthSaslStart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_auth_sasl_start_args *args, remote_auth_sasl_start_ret *ret); +static int remoteDispatchAuthSaslStep (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_auth_sasl_step_args *args, remote_auth_sasl_step_ret *ret); +static int remoteDispatchClose (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, void *ret); +static int remoteDispatchDomainAttachDevice (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_attach_device_args *args, void *ret); +static int remoteDispatchDomainBlockStats (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_block_stats_args *args, remote_domain_block_stats_ret *ret); +static int remoteDispatchDomainCoreDump (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_core_dump_args *args, void *ret); +static int remoteDispatchDomainCreate (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_create_args *args, void *ret); +static int remoteDispatchDomainCreateLinux (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_create_linux_args *args, remote_domain_create_linux_ret *ret); +static int remoteDispatchDomainDefineXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_define_xml_args *args, remote_domain_define_xml_ret *ret); +static int remoteDispatchDomainDestroy (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_destroy_args *args, void *ret); +static int remoteDispatchDomainDetachDevice (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_detach_device_args *args, void *ret); +static int remoteDispatchDomainDumpXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_dump_xml_args *args, remote_domain_dump_xml_ret *ret); +static int remoteDispatchDomainGetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_autostart_args *args, remote_domain_get_autostart_ret *ret); +static int remoteDispatchDomainGetInfo (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_info_args *args, remote_domain_get_info_ret *ret); +static int remoteDispatchDomainGetMaxMemory (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_max_memory_args *args, remote_domain_get_max_memory_ret *ret); +static int remoteDispatchDomainGetMaxVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_max_vcpus_args *args, remote_domain_get_max_vcpus_ret *ret); +static int remoteDispatchDomainGetOsType (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_os_type_args *args, remote_domain_get_os_type_ret *ret); +static int remoteDispatchDomainGetSchedulerParameters (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_parameters_args *args, remote_domain_get_scheduler_parameters_ret *ret); +static int remoteDispatchDomainGetSchedulerType (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_scheduler_type_args *args, remote_domain_get_scheduler_type_ret *ret); +static int remoteDispatchDomainGetVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_get_vcpus_args *args, remote_domain_get_vcpus_ret *ret); +static int remoteDispatchDomainInterfaceStats (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_interface_stats_args *args, remote_domain_interface_stats_ret *ret); +static int remoteDispatchDomainLookupById (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_id_args *args, remote_domain_lookup_by_id_ret *ret); +static int remoteDispatchDomainLookupByName (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_name_args *args, remote_domain_lookup_by_name_ret *ret); +static int remoteDispatchDomainLookupByUuid (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_lookup_by_uuid_args *args, remote_domain_lookup_by_uuid_ret *ret); +static int remoteDispatchDomainMigrateFinish (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_migrate_finish_args *args, remote_domain_migrate_finish_ret *ret); +static int remoteDispatchDomainMigratePerform (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_migrate_perform_args *args, void *ret); +static int remoteDispatchDomainMigratePrepare (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_migrate_prepare_args *args, remote_domain_migrate_prepare_ret *ret); +static int remoteDispatchDomainPinVcpu (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_pin_vcpu_args *args, void *ret); +static int remoteDispatchDomainReboot (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_reboot_args *args, void *ret); +static int remoteDispatchDomainRestore (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_restore_args *args, void *ret); +static int remoteDispatchDomainResume (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_resume_args *args, void *ret); +static int remoteDispatchDomainSave (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_save_args *args, void *ret); +static int remoteDispatchDomainSetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_autostart_args *args, void *ret); +static int remoteDispatchDomainSetMaxMemory (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_max_memory_args *args, void *ret); +static int remoteDispatchDomainSetMemory (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_memory_args *args, void *ret); +static int remoteDispatchDomainSetSchedulerParameters (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_scheduler_parameters_args *args, void *ret); +static int remoteDispatchDomainSetVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_set_vcpus_args *args, void *ret); +static int remoteDispatchDomainShutdown (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_shutdown_args *args, void *ret); +static int remoteDispatchDomainSuspend (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_suspend_args *args, void *ret); +static int remoteDispatchDomainUndefine (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_domain_undefine_args *args, void *ret); +static int remoteDispatchGetCapabilities (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_capabilities_ret *ret); +static int remoteDispatchGetHostname (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_hostname_ret *ret); +static int remoteDispatchGetMaxVcpus (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_get_max_vcpus_args *args, remote_get_max_vcpus_ret *ret); +static int remoteDispatchGetType (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_type_ret *ret); +static int remoteDispatchGetVersion (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_get_version_ret *ret); +static int remoteDispatchListDefinedDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_defined_domains_args *args, remote_list_defined_domains_ret *ret); +static int remoteDispatchListDefinedNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_defined_networks_args *args, remote_list_defined_networks_ret *ret); +static int remoteDispatchListDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_domains_args *args, remote_list_domains_ret *ret); +static int remoteDispatchListNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_list_networks_args *args, remote_list_networks_ret *ret); +static int remoteDispatchNetworkCreate (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_create_args *args, void *ret); +static int remoteDispatchNetworkCreateXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_create_xml_args *args, remote_network_create_xml_ret *ret); +static int remoteDispatchNetworkDefineXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_define_xml_args *args, remote_network_define_xml_ret *ret); +static int remoteDispatchNetworkDestroy (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_destroy_args *args, void *ret); +static int remoteDispatchNetworkDumpXml (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_dump_xml_args *args, remote_network_dump_xml_ret *ret); +static int remoteDispatchNetworkGetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_get_autostart_args *args, remote_network_get_autostart_ret *ret); +static int remoteDispatchNetworkGetBridgeName (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_get_bridge_name_args *args, remote_network_get_bridge_name_ret *ret); +static int remoteDispatchNetworkLookupByName (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_name_args *args, remote_network_lookup_by_name_ret *ret); +static int remoteDispatchNetworkLookupByUuid (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_lookup_by_uuid_args *args, remote_network_lookup_by_uuid_ret *ret); +static int remoteDispatchNetworkSetAutostart (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_set_autostart_args *args, void *ret); +static int remoteDispatchNetworkUndefine (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_network_undefine_args *args, void *ret); +static int remoteDispatchNodeGetInfo (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_node_get_info_ret *ret); +static int remoteDispatchNumOfDefinedDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_domains_ret *ret); +static int remoteDispatchNumOfDefinedNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_defined_networks_ret *ret); +static int remoteDispatchNumOfDomains (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_domains_ret *ret); +static int remoteDispatchNumOfNetworks (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, void *args, remote_num_of_networks_ret *ret); +static int remoteDispatchOpen (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_open_args *args, void *ret); +static int remoteDispatchSupportsFeature (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, remote_supports_feature_args *args, remote_supports_feature_ret *ret); diff -r b68f6ec36358 qemud/remote_generate_stubs.pl --- a/qemud/remote_generate_stubs.pl Fri Nov 30 14:31:14 2007 -0500 +++ b/qemud/remote_generate_stubs.pl Fri Nov 30 15:15:26 2007 -0500 @@ -93,7 +93,7 @@ elsif ($opt_i) { elsif ($opt_i) { my @keys = sort (keys %calls); foreach (@keys) { - print "static int remoteDispatch$calls{$_}->{ProcName} (struct qemud_client *client, remote_message_header *req, $calls{$_}->{args} *args, $calls{$_}->{ret} *ret);\n"; + print "static int remoteDispatch$calls{$_}->{ProcName} (struct qemud_server *server, struct qemud_client *client, remote_message_header *req, $calls{$_}->{args} *args, $calls{$_}->{ret} *ret);\n"; } } @@ -196,7 +196,8 @@ elsif ($opt_s) { my $retvoid = $ret eq "void"; print "static int\n"; - print "remoteDispatch$calls{$_}->{ProcName} (struct qemud_client *client,\n"; + print "remoteDispatch$calls{$_}->{ProcName} (struct qemud_server *server,\n"; + print " struct qemud_client *client,\n"; print " remote_message_header *req,\n"; print " remote_get_max_vcpus_args *args,\n"; print " remote_get_max_vcpus_ret *ret)\n"; -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

On Thu, Nov 29, 2007 at 05:22:06PM +0000, Daniel P. Berrange wrote: Added RPM spec magic to disable proxy too diff -r d2943aa5f7db configure.in --- a/configure.in Fri Nov 30 15:15:55 2007 -0500 +++ b/configure.in Fri Nov 30 15:21:42 2007 -0500 @@ -578,7 +578,24 @@ fi fi dnl Enable building the proxy? -AM_CONDITIONAL(WITH_PROXY,[test "x$with_xen" = "xyes"]) + +AC_ARG_WITH(xen-proxy, +[ --with-xen-proxy add XEN setuid proxy support (on)],[],[with_xen_proxy=auto]) + +AC_MSG_CHECKING([if Xen setuid proxy is needed]) +if test "$with_xen_proxy" = "auto"; then + if test "$with_polkit" = "yes"; then + with_xen_proxy="no" + else + with_xen_proxy="yes" + fi +fi +if test "$with_xen" != "yes"; then + with_xen_proxy="no" +fi +AC_MSG_RESULT([$with_xen_proxy]) + +AM_CONDITIONAL(WITH_PROXY,[test "$with_xen_proxy" = "yes"]) dnl Check for gettext AM_GNU_GETTEXT_VERSION([0.14.1]) @@ -635,6 +652,7 @@ AC_MSG_NOTICE([Drivers]) AC_MSG_NOTICE([Drivers]) AC_MSG_NOTICE([]) AC_MSG_NOTICE([ Xen: $with_xen]) +AC_MSG_NOTICE([ Proxy: $with_xen_proxy]) AC_MSG_NOTICE([ QEMU: $with_qemu]) AC_MSG_NOTICE([ OpenVZ: $with_openvz]) AC_MSG_NOTICE([ Test: $with_test]) diff -r d2943aa5f7db libvirt.spec.in --- a/libvirt.spec.in Fri Nov 30 15:15:55 2007 -0500 +++ b/libvirt.spec.in Fri Nov 30 15:21:42 2007 -0500 @@ -2,8 +2,10 @@ %if %{fedora} >= 8 %define with_polkit 1 +%define with_proxy no %else %define with_polkit 0 +%define with_proxy yes %endif Summary: Library providing a simple API virtualization @@ -77,7 +79,10 @@ of recent versions of Linux (and other O %setup -q %build -%configure --with-init-script=redhat --with-qemud-pid-file=%{_localstatedir}/run/libvirt_qemud.pid --with-remote-file=%{_localstatedir}/run/libvirtd.pid +%configure --with-init-script=redhat \ + --with-qemud-pid-file=%{_localstatedir}/run/libvirt_qemud.pid \ + --with-remote-file=%{_localstatedir}/run/libvirtd.pid \ + --with-xen-proxy=%{with_proxy} make %install @@ -157,7 +162,9 @@ fi %dir %{_localstatedir}/lib/libvirt/ %{_datadir}/PolicyKit/policy/libvirtd.policy %dir %attr(0700, root, root) %{_localstatedir}/log/libvirt/qemu/ +%if %{with_proxy} == "yes" %attr(4755, root, root) %{_libexecdir}/libvirt_proxy +%endif %attr(0755, root, root) %{_sbindir}/libvirtd %doc docs/*.rng %doc docs/*.xml Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

On Mon, Dec 03, 2007 at 11:53:04PM +0100, Jim Meyering wrote: Good point. Actually an empty name does make sense for things like REALM/AUTHNAME as it potentially means use the default value. Its upto underlying SASL impl whether is likes emptry names or not, so we should be treating EOF as same as "". Yep, will do. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|

On Mon, Dec 03, 2007 at 11:53:04PM +0100, Jim Meyering wrote: Committed with this & the other suggested fixes all included. Dan. -- |=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=| |=- Perl modules: http://search.cpan.org/~danberr/ -=| |=- Projects: http://freshmeat.net/~danielpb/ -=| |=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|