- Users - libvirt List Archives

[libvirt-users] TLS and intermediate CA
by Nathaniel Cook 22 Apr '14

22 Apr '14

I have been trying to get set of libvirtd system up and running. My PKI infrastructure involves a root CA and several intermediate CAs. I am trying to get the machines to trust each other across the different intermediate CAs. This is what I have so far: Libvirtd is starting and listening on tls port 16514 I have configured client/server certs/keys and it seems to be using all of these correctly. I have also configured the cacert.pem file (which has two certs in the chain). I have confirmed (recompiling with various debug statements) that the gnutls libraries are successfully loading both certs from the cacert.pem file. When I try to connect with openssl s_client -connect <host>:16514 I get something similar to this: --- Certificate chain 0 s:/CN=kvm999.example.com i:/C=US/ST=Utah/O=Qualtrics/OU=SRE/CN=intca1.example.com --- Server certificate -----BEGIN CERTIFICATE----- ... omitted for brevity -----END CERTIFICATE----- subject=/CN=kvm999.example.com issuer=/C=US/ST=Utah/O=Qualtrics/OU=SRE/CN=intca1.example.com --- Acceptable client certificate CA names /C=US/ST=Utah/O=Qualtrics/OU=SRE/CN=intca1.example.com /C=US/ST=Utah/O=Qualtrics/OU=SRE/CN=rootca.example.com --- The "Server certificate" and "Acceptable client certificate CA names" look right. The problem is that the certificate chain is just the single server cert and does not include the intermediate cert or root cert. As a result clients from other intermediate CAs fail to verify the libvirtd process. I have tried libvirtd 0.10.2 and 1.2.1 both on CentOS 6. Thanks. -- -Nathaniel Cook

2 4

[libvirt-users] Live snapshot merging (qemu 2.0)
by Thomas Stein 22 Apr '14

22 Apr '14

Hello. The Changelog of qemu-2.0.0 mentioned "Live snapshot merging". Someone has an idea what could be ment by this? I'm asking because i'm still struggling with finding a reliable backup solution for running kvm machines. Blockcopy is my current solution. best regards Thomas

2 2

[libvirt-users] "virt-install" source location boot disk
by Jay Vyas 22 Apr '14

22 Apr '14

Hi virt, im stumped... any help would be appreciated. I normally create my VMs like this: base="http://mirror.pnl.gov/fedora/linux/releases/20/Fedora/x86_64/os/" sudo virt-install --hvm --name $vm_name$i --ram 4000 \ --disk path=/VirtualMachines/$vm_name$i,size=30 \ --location $base -x "ks=http://xxx.os21.ks$kx" HOWEVER... I'm finding that my VMs dont boot after i restart the Host. My question is: Where is virt-install writing the boot disk to? I get a error message that the "boot failed" because the hard disk, is not a bootable disk. But I can't imagine where else to boot from ? Because I point my --location of the original boot to the source code repo itself.... ANY help would be appreciated thanks!

2 5

[libvirt-users] routed subnet problem
by Patric Buskas 22 Apr '14

22 Apr '14

Hi, I'm new to libvirt so please bear with me. I am trying to set up a routed subnet on my laptop with libvirt, hoping it to be able to communicate with all servers in my nw. My laptop is on a subnet, 192.168.2.0/24, with a static ip, 192.168.2.27. I have "more or less" followed this guide for routed networks, https://www.berrange.com/posts/2009/12/13/routed-subnets-without-nat-for-li… The "more or less" part is that I have a Asus RT-N56U router with the static route set as in the guide and I'm not running wifi. With this setup I can reach, within the 192.168.200.0/24, all guests within 192.168.200.0/24, internet and the laptop but I can not reach any server on the laptop subnet. traceroute from guests to servers in the laptop subnet is only giving "stars" infinitely nmap from guests to services in the laptop subnet is saying "filtered" Obviously I've done something wrong but I can't find out what. I also may have misunderstood the meaning of routed network within libvirt. Please give me some advise to solve this problem. Some facts: The laptop is running Ubuntu 13.04 The net-dumpxml https://gist.github.com/kakbit/11103807 Routing on laptop https://gist.github.com/kakbit/11103832 iptables on laptop https://gist.github.com/kakbit/11103947

2 1

[libvirt-users] Guest Virtual Bios in XEN
by Mui Le Van 21 Apr '14

21 Apr '14

Hi, I am using Libvirt with XEN hypervisor to manage the VM. I see there are 3 kinds of Virtual BIOS for XEN Guest VM, they are ROMBIOS,SEABIOS, OVMF ( is disabled by default as XEN Supporters said ). But I don't know how to pass the BIOS options to the Guest from XML file. Could you please suggest how to change the Virtual BIOS for the Guest from XML file in Libvirt or give some clues to do that? Below is the link that I asked XEN support: http://osdir.com/ml/general/2014-04/msg32102.html Thank for your time! Mui Le,

1 0

[libvirt-users] (no subject)
by Mui Le Van 21 Apr '14

21 Apr '14

Hi, I am using Libvirt with XEN hypervisor to manage the VM. I see there are 3 kinds of Virtual BIOS for XEN Guest VM, they are ROMBIOS,SEABIOS, OVMF ( is disabled by default as XEN Supporters said ). But I don't know how to pass the BIOS options to the Guest from XML file. Could you please suggest how to change the Virtual BIOS for the Guest from XML file in Libvirt or give some clues to do that? Below is the link that I asked XEN support: http://osdir.com/ml/general/2014-04/msg32102.html Thank for your time!

1 0

[libvirt-users] LXC + USB passthrough = Operation not permitted
by Filip Maj 18 Apr '14

18 Apr '14

Hi! First post, kind of a noobie. I've been working with LXC and libvirt for a few months now. Trying to do some interesting things with containers and Android devices :D I'm running ubuntu 13.10 with LXC 1.0.1 and tried both libvirt 1.1.1 and 1.2.2 (backported from ubuntu-trusty), but with either version of libvirt am getting issues as soon as I try to get access to USB devices inside the container. Relevant versions of stuff: $ dpkg -l | grep -i lxc ii liblxc1 1.0.1-0ubuntu1~ubuntu13.10.1~ppa1 i386 Linux Containers userspace tools (library) ii lxc 1.0.1-0ubuntu1~ubuntu13.10.1~ppa1 i386 Linux Containers userspace tools ii lxc-templates 1.0.1-0ubuntu1~ubuntu13.10.1~ppa1 i386 Linux Containers userspace tools (templates) ii python3-lxc 1.0.1-0ubuntu1~ubuntu13.10.1~ppa1 i386 Linux Containers userspace tools (Python 3.x bindings) $ dpkg -l | grep libvirt ii libvirt-bin 1.2.2-0ubuntu12 i386 programs for the libvirt library ii libvirt0 1.2.2-0ubuntu12 i386 library for interfacing with different virtualization systems ii python-libvirt 1.2.2-0ubuntu1 i386 libvirt Python bindings Here's my entire domain definition: <domain type='lxc'> <name>oshi32134</name> <uuid>xxxxx</uuid> <memory unit='KiB'>3145728</memory> <currentMemory unit='KiB'>3145728</currentMemory> <vcpu placement='static'>1</vcpu> <resource> <partition>/machine</partition> </resource> <os> <type arch='i686'>exe</type> <init>/sbin/init</init> </os> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/lib/libvirt/libvirt_lxc</emulator> <filesystem type='mount' accessmode='passthrough'> <source dir='/some/valid/filesystem/location'/> <target dir='/'/> </filesystem> <filesystem type='mount' accessmode='passthrough'> <source dir='/another/valid/filesystem/location'/> <target dir='/mnt/android'/> </filesystem> <interface type='bridge'> <mac address='xx:xx:xx:xx:xx:xx'/> <source bridge='br1'/> </interface> <console type='pty'> <target type='lxc' port='0'/> </console> <hostdev mode='capabilities' type='misc'> <source> <char>/dev/kvm</char> </source> </hostdev> <hostdev mode='subsystem' type='usb' managed='yes'> <source> <vendor id='0x04e8'/> <product id='0x6860'/> </source> </hostdev> </devices> </domain> Everything worked fine until I added the USB <hostdev> element. I'm essentially trying to get access to a physical Android device connected to the host from inside a container. When I go to start the container, I get an error about Operation not permitted. Here's the relevant bits from /var/log/libvirt/lxc/machine.log: 2014-04-11 22:46:40.491+0000: starting up PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/bin LIBVIRT_DEBUG=3 LIBVIRT_LOG_OUTPUTS=3:stderr /usr/lib/libvirt/libvirt_lxc --name oshi32134 --console 24 --security=none --handshake 27 --background --veth vnet1 2014-04-11 22:46:40.597+0000: 685: info : libvirt version: 1.2.2 2014-04-11 22:46:40.597+0000: 685: error : virLXCControllerSetupHostdevSubsysUSB:1390 : Unable to create device //var/run/libvirt/lxc/oshi32134.dev/bus/usb//002//003: Operation not permitted Unable to create device //var/run/libvirt/lxc/oshi32134.dev/bus/usb//002//003: Operation not permitted I get the same output above when I use libvirt 1.1.1. Tracing down through the libvirt code it looks like it fails when calling `mknod`. It's clear that libvirt converts the product/vendor ids I specified in the domain definition file to the appropriate USB bus (/dev/bus/usb/002/003, verified by comparing against output of `usb-devices`). In a parallel effort, a colleague of mine set up a vanilla LXContainer on a new install of the same version of ubuntu, and successfully was able to communicate with the Android device from a container. The only configuration tweaks he made was make sure to whitelist the cgroup with the appropriate major/minor device number (associated with the Android device) inside the LXC configuration file. From there the container was able to appropriately create the device file as you attach/detach the Android device. Hopefully someone can shed some light, and appreciate your patience with me as I am learning a lot of this stuff as I go :) Thanks in advance for any help! Fil

2 7

[libvirt-users] virsh blockcommit hangs at 100%
by zyro 18 Apr '14

18 Apr '14

hi, i am trying to blockcommit a external qcow2 snapshot back into its raw backing file like: sudo virsh blockcommit myDomainName vda --wait --verbose the output just shows: Block Commit: [100 %] and stays like that (i waited about an hour or so...). No "Commit complete" message. - explicitly passing --base and/or --top arguments makes no difference. - did not find a related log entry in syslog and consorts env: - ubuntu server 14.04 x64 - libvirt-bin 1.2.2-0ubuntu13 i doubt that it just takes hours to complete after "100%", right? any ideas? kind of a dead-end for me :/ thanks, zyro

2 1

[libvirt-users] virtual subnet
by Lucio Crusca 18 Apr '14

18 Apr '14

Hello all, I need to setup a virtual subnet to create a test AD domain (server + clients): guests need to talk to each other, they need to reach the internet through a virtual router with nat (virbr0?), broadcasts must not reach the host nor the physical network (because of conflicts with the existing real AD domain) and libvirt must NOT offer a dhcp service inside the virtual subnet. What kind of networking model should I look at?

2 2

[libvirt-users] What's the meaning of sub-element <ip address='X.X.X.X'> in <interface type='bridge'> of domain xml?
by Jianwei Hu 18 Apr '14

18 Apr '14

Hi guys, I saw this sub-element in http://libvirt.org/firewall.html, there is some confusion, what's the meaning of sub-element <ip address='X.X.X.X'> in <interface type='bridge'> of domain xml? The detail <interface> in domain xml as below: <interface type='bridge'> <mac address='52:54:00:56:44:32'/> <source bridge='br1'/> <ip address='10.X.X.X'/> <===it's my question <target dev='vnet0'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> Is it static IP(specified by customer) in guest OS? or a IP of interface(e.g. eno1) in "br1" on host machine? what's definition about it? [root@localhost src]# brctl show bridge name bridge id STP enabled interfaces br1 8000.24be051881ce no eno1 If you know how to use it, please show me a detail scenario. Thanks, Jianwei

3 2