- Users - libvirt List Archives

Re: [libvirt-users] [virt-tools-list] Possible to rename a volume
by Cole Robinson 21 Jul '10

21 Jul '10

On 07/20/2010 02:54 AM, Bla Blubb wrote: > Hi, > > is there a way to rename a volume via virsh? > > Regards Jessica > No, though you could use vol-clone and then vol-delete on the original. Would be slow/inefficient understandably. - Cole

1 0

[libvirt-users] Allow customer to stop and start their own VPS, but not others
by Neil Aggarwal 20 Jul '10

20 Jul '10

Hello: One of my customers asked for access to stop and start their VPS. Right now, I can do that using virsh, but I do not want to give this customer the ability to stop and start all VPSs running on the host. Is there a way to give stop and start control of one VPS to someone? I am using KVM on a CentOS 5.5 host. Thanks, Neil -- Neil Aggarwal, (281)846-8957 FREE trial: Virtualmin VPS with unmetered bandwidth http://UnmeteredVPS.net/virtualmin

1 0

[libvirt-users] kvm migration problem
by mahsa najafzadeh 19 Jul '10

19 Jul '10

Hi, I am running ubuntu 9.10, with kvm and libvirt-bin, etc. Using virsh, I can't live-migrate a VM from host1 to host2. It reports a unknown failure. The VM image is accessible on both source and destination hosts located on a shared storage using nfs. Image directory is on the same path on both hosts. The src and destination hosts are on the same subnet. I can connect to remote host with qemu+ssh but I can't migrate. my configuration is: $ uname -a Linux mahsa1-desktop 2.6.31-21-generic-pae #59-Ubuntu SMP Wed Mar 24 08:47:55 UTC 2010 i686 GNU/Linux $virsh # version Compiled against library: libvir 0.7.0 Using library: libvir 0.7.0 Using API: QEMU 0.7.0 Running hypervisor: QEMU 0.11.0 Connect to the local machine's hypervisor as follows and see the localmachines:$virsh # connect qemu:///system $virsh # list Id Name State -------------------------------- 2 VmLinux11 running 3 VMLinux12 running 4 VmLinux13 running Verify connectivity to the hypervisor of the remote target system asfollows:$virsh connect qemu+ssh://host2name/system Attempt the migration as follows:$virsh migrate --live VmLinux13 qemu+ssh://host2name/system Connecting to uri: qemu:///system root@host2name's password: error: Unknown failure the log file on the source physical host gives this:14:57:13.514: error : remoteIO:7184 : operation failed: migrate failed: migrate "tcp:host2name:49161" migration failed 14:57:13.709: error : remoteIO:7184 : Unknown failure I disable the firewall on both hosts but it doesn't still work. please help me.

1 0

[libvirt-users] ESX - How to create a new domain
by George Goh 19 Jul '10

19 Jul '10

Hi, I've been trying to figure out how to create a new domain(create a new virtual machine) using the ESX driver. The documentation at http://libvirt.org/drvesx.html says: To define a new domain the driver converts the domain XML into a VMware VMX file and uploads it to a datastore known to the ESX server. Because multiple datastores may be known to an ESX server the driver needs to decide to which datastores the VMX file should be uploaded. The driver deduces this information from the path of the source of the first file-based harddisk listed in the domain XML. But I can't find a way to do this in virsh. Any ideas? -George

2 1

[libvirt-users] How to create a guest os from existing disk image file
by Rajiv Rajaian 15 Jul '10

15 Jul '10

Hi I have configured KVM with Fedora Core 13 by enabling the KVM virtualization option while installing OS. I have successfully created the guest OS by using the virt-install API /usr/sbin/virt-install --name centos5 --ram 512 --disk path=/var/lib/libvirt/images/ centos.img,size=5 --network network:default --accelerate --vnc -c /tmp/CentOS-5.3-i386-bin-DVD.iso I am able to login to the guest OS using the virt-viewer command using vnc Now i want to the guest os from the existing configured disk /var/lib/libvirt/images/centos.img.. What modifications should be done with my configuration file ?? Pleas help me to solve this. [root@kvmcluster ~]# virsh dumpxml centos5 <domain type='qemu' id='2'> <name>centos5</name> <uuid>cabfad09-ff8b-e1ca-051a-6729e301f6a1</uuid> <memory>524288</memory> <currentMemory>524288</currentMemory> <vcpu>1</vcpu> <os> <type arch='i686' machine='fedora-13'>hvm</type> <boot dev='cdrom'/> </os> <features> <acpi/> <apic/> <pae/> </features> <clock offset='utc'/> <on_poweroff>destroy</on_poweroff> <on_reboot>destroy</on_reboot> <on_crash>destroy</on_crash> <devices> <emulator>/usr/bin/qemu</emulator> <disk type='file' device='disk'> <driver name='qemu' type='raw'/> <source file='/var/lib/libvirt/images/centos.img'/> <target dev='hda' bus='ide'/> <alias name='ide0-0-0'/> <address type='drive' controller='0' bus='0' unit='0'/> </disk> <disk type='file' device='cdrom'> <driver name='qemu'/> <source file='/tmp/CentOS-5.3-i386-bin-DVD.iso'/> <target dev='hdc' bus='ide'/> <readonly/> <alias name='ide0-1-0'/> <address type='drive' controller='0' bus='1' unit='0'/> </disk> <controller type='ide' index='0'> <alias name='ide0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/> </controller> <interface type='network'> <mac address='52:54:00:bf:32:c2'/> <source network='default'/> <target dev='vnet0'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </interface> <serial type='pty'> <source path='/dev/pts/2'/> <target port='0'/> <alias name='serial0'/> </serial> <console type='pty' tty='/dev/pts/2'> <source path='/dev/pts/2'/> <target port='0'/> <alias name='serial0'/> </console> <input type='mouse' bus='ps2'/> <graphics type='vnc' port='5900' autoport='yes' keymap='en-us'/> <video> <model type='cirrus' vram='9216' heads='1'/> <alias name='video0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/> </video> </devices> <seclabel type='dynamic' model='selinux'> <label>system_u:system_r:svirt_t:s0:c370,c413</label> <imagelabel>system_u:object_r:svirt_image_t:s0:c370,c413</imagelabel> </seclabel> </domain> Thanks/Regards. Rajiv.R Project Associate. CARE. MIT Anna University Chennai

1 0

[libvirt-users] C# Client Fails to Locate libvirt-0.dll
by Development 15 Jul '10

15 Jul '10

Attempting to develop C sharp client that uses libvirt DLL. Despite placing the libvirt DLL in a number of different locations, call to virConnectOpen() fails consistently with a DLL not found exception. Declaration as follows: [DllImport("libvirt-0.dll")] private static extern IntPtr virConnectOpen(String name); Called as follows: IntPtr conn = virConnectOpen(null); Suggestions? Tim McLeod

1 0

[libvirt-users] how to deactivate an active network with virsh? (and what is that anyway)
by John Lumby 15 Jul '10

15 Jul '10

virsh provides net-start <netname-or-id> to activate an inactive network. Does virsh provide any way to do the exact converse? deactivate an active network without destroying, undefining, removing, ... Also - I am curious - what does activate actually do? What change in state of anything occurs? ( I read the document at http://libvirt.org/formatnetwork.html which the man page referred me to but it had nothing to say on this. I did not try to read the code). John _________________________________________________________________ MSN Dating: Find someone special. Start now. http://go.microsoft.com/?linkid=9734384

2 1

[libvirt-users] virStream functions
by Camilo Aguilar 09 Jul '10

09 Jul '10

May anybody tell me which is the porpose of virStream functions ? Thanks in advance. Camilo Aguilar

2 1

[libvirt-users] Get ip address of a running domain
by adrian wyssen 09 Jul '10

09 Jul '10

Hi, I wanted to know if it is possible to get the IP address of a running domain. The domain get's this IP dynamicly via DHCP, but I need to know it once it gets it. I tired virDomainGetXMLDesc, but this only returns the MAC address... Thanks for any help. Adrian

1 0

[libvirt-users] Blockpeek.. A little help please
by steven765＠yahoo.com 08 Jul '10

08 Jul '10

Hi, I'm trying to use blockpeek to open the contents of a file. Inside the vm i ran debugfs: imap /test/findme and got: inode 32642 is part of block group 4 located at block 131074, offset 0x0100 I try using 0x100 or 256 as the offset to blockpeek into that VM and get nonsense as a result. Am I calculating the offset incorrectly, is there a better way to find a file's location on disk? And then open it? I'm just printing the return as a string from the buffer looping over size. Is that incorrect? Thanks again, Steve

2 1

[libvirt-users] Release 0.4.6 of the libvirt java bindings
by Bryan Kearney 07 Jul '10

07 Jul '10

I have just released 0.4.6 of the java libvirt bindings. This release adds support for the 0.8.2 libvirt API as well as some code cleanup patches from Luis Costa (Thank you!). You can access the latest version via the following means: Source Code: http://www.libvirt.org/git/?p=libvirt-java.git;a=summary Bundled Source (tarball and SRPM): http://libvirt.org/sources/java/ Maven: http://libvirt.org/maven2/. They should hit the central repo in a day or two. RPMS are making their way though the Fedora Rawhide build path Thank you! -- bk

1 0

[libvirt-users] Release of libvirt-0.8.2
by Daniel Veillard 06 Jul '10

06 Jul '10

Following Dan advice, I decided to not wait for more patches and push the current git head as the release. Let's plan to have another release by this month end with the QEmu debugging and hacking APIs. The release is available as usual at ftp://libvirt.org/libvirt Quite a lot of bug fixes during the two months since 0.8.1, and a few new feature. It also tagged more commits as being documentation or portability fixes, it's good :-) Features: - phyp: adding support for IVM (Eduardo Otubo) - libvirt: introduce domainCreateWithFlags API (Eric Blake) - add 802.1Qbh and 802.1Qbg switches handling (Stefan Berger) - Support for VirtualBox version 3.2 (Jean-Baptiste Rouault) - Init script for handling guests on shutdown/boot (Jiri Denemark) - qemu: live migration with non-shared storage for kvm (Kenneth Nagin) Documentation: - html docs: add link to PHP bindings by Radek Hladik (Justin Clift) - virsh: document attach-disk better (Eric Blake) - bridge_driver.c: fix file description (Alan Pevec) - nwfilter: extensions of docs with (Stefan Berger) - Fix description of virStorageVolGetInfo() (Philipp Hahn) - virsh: improve help text for vol query commands (Justin Clift) - virsh: fixed trivial comment and debug message in vshCommandOptVolBy function (Justin Clift) - virsh: remove xen reference in header comment (Justin Clift) - virsh: add the volume commands to the virsh man page (Justin Clift) - virsh: fix minor virsh man page typos and formatting problems (Justin Clift) - Trivial virsh.pod additions --all for "list" command and similar (Justin Clift) - Add docs on drive <serial> element (Марк Коренберг) - daemon: sysconf: Update comment about VNC audio (Cole Robinson) - nwfilter: documentation (Stefan Berger) - docs: distribute more coding convention documentation (Eric Blake) - note a typo: VIR_MIGRATE_TUNNELLED should be VIR_MIGRATE_TUNNELED, (Jim Meyering) - datatypes: fix comment typo (Eric Blake) - Fix a typo in docs (Ersek Laszlo) - docs: hacking: explain why using curly braces well is important (Jim Meyering) Portability: - cgroup: Fix compilation broken on MinGW due to dirent->d_type (Ryota Ozaki) - parthelper: fix compilation without optimization (Eric Blake) - build: fix some mingw issues (Eric Blake) - build: avoid pthreads-win32 on mingw (Eric Blake) - build: fix cygwin build, correctly this time (Eric Blake) - build: fix up some compiler flags (Eric Blake) - build: avoid compile failure on linux kernels older than 2.6.19 (Jim Meyering) - libvirt_proxy: link with -lpthread if needed (Eric Blake) - build: allow older gettext (Eric Blake) - mingw32-libvirt.spec: bring up to date (Eric Blake) - avoid link error in tests using libvirt_util; due to pthread_sigmask (Jim Meyering) - configure.ac: Avoid uname, which breaks cross-compilation (Matthias Bolte) - mingw: Fix two undefined symbols (Matthias Bolte) - build: avoid compiler warning (Eric Blake) - build: prefer WIN32 over __MINGW32__ checks (Eric Blake) - dnsmasqReload: avoid mingw link failure (Eric Blake) - mingw: Fix symbol export (Matthias Bolte) Bug Fixes: - Avoid invoking the qemu monitor destroy callback if the constructor fails (Daniel P. Berrange) - cgroup: Add missing errno == ENOENT check in virCgroupRemoveRecursively (Ryota Ozaki) - Fix crash when detaching devices from qemu domains. (Chris Lalancette) - virFileResolveLink: guarantee an absolute path (Eric Blake) - phyp: don't steal storage management from other drivers (Eric Blake) - Avoid calling virStorageFileIsSharedFS with NULL (Laine Stump) - lxc: Fix virsh console doesn't work after restarting libvirtd (Ryota Ozaki) - lxc: Fix error handlings in lxcContainerRenameAndEnableInterfaces (Ryota Ozaki) - Set proper selinux label on image file during qemu domain restore (Laine Stump) - build: fix regression with libvirt-api.xml generation (Eric Blake) - Fix a reference leak for node devices. (Chris Lalancette) - Don't squash file permissions when migration fails (Daniel P. Berrange) - Fix migration in text mode and shared storage migration in json mode (Daniel P. Berrange) - Add missing parameter in python Disk IO error callback (Daniel P. Berrange) - Check for presence of qemu -nodefconfig option before using it (Laine Stump) - cgroup: Change virCgroupRemove to remove all descendant groups at first (Ryota Ozaki) - Fix reference handling leak on qemuMonitor (Daniel P. Berrange) - Don't leak open fd to virsh in libvirt-guests init script (Jiri Denemark) - nwfilter: fix loadable module support (Stefan Berger) - Do not free static buffer with UUID (Jiri Denemark) - qemu: Fix crash on failed VM startup (Cole Robinson) - Add several missing vir*Free calls in libvirtd's remote code (Matthias Bolte) - Fix enumeration of partitions in disks with a trailing digit in path (Daniel P. Berrange) - vbox: check getenv("DISPLAY") for NULL in vboxDomainDumpXML (Matthias Bolte) - Check getenv("PATH") for NULL in virFindFileInPath (Matthias Bolte) - Fix cgroup setup code to cope with root squashing NFS (Daniel P. Berrange) - Fix leaks in udev device add/remove v3 (David Allan) - Ensure that PCI device is reattached to host if hotadd fails (Daniel P. Berrange) - Don't raise errors in the selinux restore code (Daniel P. Berrange) - Fix check for errors in device_add command in QEMU text monitor (Daniel P. Berrange) - Network duplicate UUID/name checking (Daniel P. Berrange) - Storage pool duplicate UUID/name checking (Daniel P. Berrange) - Fix auto-adding of virtio serial controllers (Daniel P. Berrange) - Ensure UNIX domain sockets are removed on daemon shutdown (Daniel P. Berrange) - Fix AppArmor save/restore.Add stdin_path to qemudStartVMDaemon() args. (Jamie Strandboge) - Adjust block size used by dd to speed QEMU domain save operations. (Laine Stump) - Fix dereference of potentially freed pointer in qemudDomainSaveFlags (Laine Stump) - Update nodedev scsi_host data before use (David Allan) - Fix device destroy return value (David Allan) - storage: Check for invalid storage mode before opening (Cole Robinson) - Improve nodedev parent/child relationships (David Allan) - network: bridge: Don't start network if it collides with host routing (Cole Robinson) - Fix integer overflow in hotplug methods (Daniel P. Berrange) - Fix failing virGetHostname. (Chris Lalancette) - storage: Sanitize pool target paths (Cole Robinson) - Fix handling of disk backing stores with cgroups (Daniel P. Berrange) - Fix up basic migration. (Chris Lalancette) - qemu: Release bus address on PCI host device remove (Alex Williamson) - qemu: avoid corrupting guest info struct on host device PCI hot add (Alex Williamson) - Query block allocation extent from QEMU monitor (Daniel P. Berrange) - Don't overwrite virDomainAssignDef errors. (Chris Lalancette) - Fix race in finding available vnc port (Jim Fehlig) - qemu driver: fix version check typos (Chris Wright) - daemon: A few initscript corrections (Cole Robinson) - qemu: Properly cleanup in security startup error path (Cole Robinson) - qemudDomainMigrateFinish2: handle a case of virDomainSaveStatus failure (Jim Meyering) - Fix potential NULL dereference in remoteDomainMigratePrepare2 (Jiri Denemark) - qemudDomainRestore: handle a case of virDomainSaveStatus failure (Jim Meyering) - python: don't ignore virInitialize failure in module initialization (Jim Meyering) - tests: do not ignore virInitialize failure (Jim Meyering) - qemuMonitorTextMigrate: avoid leak on OOM-error path (Jim Meyering) - virNWFilterDefParseXML: avoid leak on error paths (Jim Meyering) - virDomainNetDefParseXML: avoid leak upon multiple "filterref" (Jim Meyering) - ebiptablesWriteToTempFile: don't close a negative file descriptor (Jim Meyering) - Protect against NULL pointer flaws in monitor usage (Daniel P. Berrange) - Fix multiple potential NULL pointer references in monitor usage (Daniel P. Berrange) - umlAutostartDomain: avoid NULL-deref upon virGetLastError failure (Jim Meyering) - x86ModelHasFeature: avoid NULL-dereference for unmatched CPU "feature" (Jim Meyering) - qemudDomainSetVcpus: avoid NULL-deref (Jim Meyering) - nwfilter: Add missing driver lock in qemu driver (Stefan Berger) - Fix a misuse of virAsprintf in qemudDomainMemoryPeek (Ryota Ozaki) - Don't reset user/group/security label on shared filesystems during migrate (Daniel P. Berrange) - Fix handling of disk backing stores with cgroups (Daniel P. Berrange) - Fix possible crash in handling IO Error event (Daniel P. Berrange) - Fix monitor ref counting when adding event handle (Jiri Denemark) - Remove watches before calling REMOTE_PROC_CLOSE (Jiri Denemark) - node_device: udev: Fix PCI product/vendor swappage (Cole Robinson) - virsh: schedinfo --set invalid=value would simply ignore the option (Jim Meyering) - Remove unused nwfilter field from struct remote_error (Matthew Booth) - util: fix va_start usage bug (Eric Blake) - Don't wipe generated iface target in active domains (Jiri Denemark) - Various fixes for the spec file (Daniel Veillard) - lxc: Check domain is active/inactive as required by operation (Jiri Denemark) - lxc: Make SetMemory work for active domains only (Jiri Denemark) - cgroup: Fix possible memory leak in virCgroupMakeGroup (Ryota Ozaki) - Fix memory leaks in cmdInterfaceEdit and cmdNWFilterEdit. (Laine Stump) - lxc: Fix failure on starting a domain with multiple interfaces (Ryota Ozaki) Improvements: - vbox: Let configure detect/set the XPCOMC directory (Matthias Bolte) - udev: Parse PCI devices even if libpciaccess fails (Cole Robinson) - qemu: Improve some qemu.conf error reporting (Cole Robinson) - util: virExec: Dispatch all errors raised after fork (Cole Robinson) - virsh: tweak help output for VSH_OT_DATA (Eric Blake) - Check for active PCI devices when doing nodedevice operations. (Chris Lalancette) - virsh: add new --details option to pool-list (Justin Clift) - Selectively ignore domainSetSecurityAllLabel failure in domain restore (Laine Stump) - use virStorageFileIsSharedFS utility function in qemudDomainSaveFlag (Laine Stump) - Enhance virStorageFileIsSharedFS (Laine Stump) - phyp: optimize use of sed (Eric Blake) - phyp: add storage management driver (Eduardo Otubo) - phyp: add rudimentary storage driver (Eduardo Otubo) - maint: add gnulib gettimeofday module (Eric Blake) - Avoid blocking all APIs during incoming migration (Daniel P. Berrange) - Set labelling for character devices in security drivers (Daniel P. Berrange) - Add API for iterating over all character devices (Daniel P. Berrange) - Adding Storage Management driver (style and indentation) (Eduardo Otubo) - esx: Add support for the controller element (Matthias Bolte) - Add optional model attribute to the controller element (Matthias Bolte) - Add wide SCSI bus disk address generation support (Matthias Bolte) - cgroup: Enable memory.use_hierarchy of cgroup for domain (Ryota Ozaki) - network: allow tftp port if tftp is defined (Alan Pevec) - Add '-nodefconfig' command line arg to QEMU (Daniel P. Berrange) - Make checks for inactive QEMU guest more robust (Daniel P. Berrange) - Improve some error messages about unsupported APIs/URIs (Daniel P. Berrange) - Index hashes by UUID instead of name (Jiri Denemark) - Allow one-or-more <boot dev="..."/> entries (Philipp Hahn) - virsh: add --uuid option to vol-pool (Justin Clift) - nwfilter: add XML attribute to control iptables state match (Stefan Berger) - virsh: ensure persistence and autostart are shown for dominfo and pool-info (Justin Clift) - nwfilter: use match target on incoming traffic (Stefan Berger) - macvtap: work-around for 2.6.32 and older kernels (Stefan Berger) - virsh: add pool support to vol-key command (Justin Clift) - esx: Update case insensitive .vmx tests (Matthias Bolte) - esx: Accept 'disk' as harddisk device type in .vmx files (Matthias Bolte) - virsh: mark autostart answers for translation (Justin Clift) - virsh: add start --paused support (Eric Blake) - qemu: support starting persistent domain paused (Eric Blake) - drivers: add virDomainCreateWithFlags if virDomainCreate exists (Eric Blake) - remote: protocol implementation for virDomainCreateWithFlags (Eric Blake) - uml: sanity check external data before using it (Eric Blake) - Improve error message for disabled client-side drivers (Matthias Bolte) - virsh: add snapshot backing store support to vol-create-as (Justin Clift) - esx: Add proxy query parameter (Matthias Bolte) - esx: Refactor esxUtil_ParseQuery's parameter handling (Matthias Bolte) - virsh: add new vol-pool command (Justin Clift) - virsh: add --paused option to create (Eric Blake) - qemu: allow creation of a paused domain (Eric Blake) - virDomainCreateXML: support new flag (Eric Blake) - Add multiIQN tests (David Allan) - Add multiiqn XML dump (David Allan) - Fix test breakage from virtio serial changes (Daniel P. Berrange) - Enable probing of VPC disk format type (Daniel P. Berrange) - Prefer UDEV to HAL drivers if both a compiled (Daniel P. Berrange) - Add support for setting socket MLS level in SELinux driver (Daniel J Walsh) - Fix error codes for missing storage pools (Daniel P. Berrange) - Include port number with virtio serial devices (Daniel P. Berrange) - Disable use of 'reason' field in block IO event in QEMU (Daniel P. Berrange) - Add stdin_path to qemudStartVMDaemon() args. (Jamie Strandboge) - Allocate buffer to hold xend response (Jim Fehlig) - phyp: Strict check when listing domains (Eduardo Otubo) - hostusb: Properly handle 'usbX' sysfs files (Cole Robinson) - Add --source-format argument to virsh pool-define-as and pool-create-as (Justin Clift) - Add --source-format argument to virsh pool-define-as and pool-create-as (Justin Clift) - build: fix VPATH 'make syntax-check' (Eric Blake) - qemu: Add a qemu.conf option for clearing capabilities (Cole Robinson) - macvtap: cannot support target device name (Stefan Berger) - Fix libvirt-guests init script (Jiri Denemark) - maint: new syntax-check rule to ensure that AUTHORS stays in sync (Jim Meyering) - maint: update AUTHORS with recent contributors (Eric Blake) - xen: Fix chardev listen sexpr formatting (Cole Robinson) - v2 of Cole's wlan support (David Allan) - Install, distribute and package domainsnapshot.rng (Matthias Bolte) - build: support 'make check' in pristine tree (Eric Blake) - esx: Expose host UUID in the capabilities XML (Matthias Bolte) - Pass pre-opened PCI device sysfs config file to QEMU (Alex Williamson) - xen-proxy build broken (Matthias Bolte) - esx: Add read-only storage pool access (Matthias Bolte) - libvirtd: diagnose invalid host UUID (Jim Meyering) - vepa: parsing for 802.1Qb{g|h} XML (Stefan Berger) - vepa+vsi: Introduce dependency on libnl (Stefan Berger) - Expose a host UUID in the capabilities XML (Daniel P. Berrange) - qemu: Allow using regular audio backends with VNC (Cole Robinson) - lxcSetSchedulerParameters: reverse order of tests; diagnose a failure (Jim Meyering) - libvirtd: start each diagnostic with "argv0: " (Jim Meyering) - libvirtd: mark strings for translation, including --help output (Jim Meyering) - build: force init scripts to rebuild on changed --prefix (Eric Blake) - build: Distribute the whole tests/qemuhelpdata directory (Matthias Bolte) - Add defines for QEMU_VNC_PORT_{MIN,MAX} and use them (Jim Fehlig) - Add simple bitmap operations to utils (Jim Fehlig) - daemon: Export SDL audio environment variables (Cole Robinson) - Autostart domains using virDomainObjStart (Jiri Denemark) - maint: update po/POTFILES.in (Jim Meyering) - maint: enforce policy wrt VIR_DEBUG and VIR_DEBUG0 (Jim Meyering) - maint: enforce policy wrt VIR_ERROR and VIR_ERROR0 (Jim Meyering) - maint: change "" in err ? err->message : "" to _("unknown error"), ... (Jim Meyering) - qemu: Use ShutdownVMDaemon for all startup cleanup paths (Cole Robinson) - Domain snapshot RNG and tests. (Chris Lalancette) - Fix up the python bindings for snapshotting. (Chris Lalancette) - qemu_conf.c: also recognize new first line of qemu -help output (Jim Meyering) - lxc_controller.c: don't ignore failed "accept" (Jim Meyering) - qemu: Don't deny ShutdownVMDaemon for non-running VMs (Cole Robinson) - libvirtd: don't ignore virInitialize failure (Jim Meyering) - maint: prohibit newline at end of diagnostic (Jim Meyering) - maint: remove unwanted newline at end of diagnostic (Jim Meyering) - build: distribute missing file (Eric Blake) - esx: Make esxVI_*_CastFromAnyType dynamically dispatched (Matthias Bolte) - esx: Allow esxVI_X_DynamicCast to be called successfully on X objects (Matthias Bolte) - tests: the remote_protocol check also accommodates older pdwtags (Jim Meyering) - maint: enforce no-markup policy wrt VIR_WARN-like macros (Jim Meyering) - Add support for SSE4.1 and SSE4.2 CPU features (Jiri Denemark) - maint: add more free-like functions to the list and deal with fallout (Jim Meyering) - maint: add virCgroupFree to the list of free-like functions (Jim Meyering) - qemudDomainSetVcpus: avoid NULL-deref on failed uuid look-up (Jim Meyering) - Add CIFS to the list of network file systems (Matthias Bolte) - Add VIR_STORAGE_POOL_INACCESSIBLE to denote inaccessible storage pools (Matthias Bolte) - qemu_conf: fix flag value (Eric Blake) - qemu: Clarify a couple error messages (Cole Robinson) - virFileResolveLink: fix return value (Eric Blake) - tests: Skip daemon-conf test if dir exceeds UNIX_PATH_MAX (Cole Robinson) - pci: Give an explicit error if device not found (Cole Robinson) - qemu: Report cmdline output if VM dies early (Cole Robinson) - qemu_driver: avoid NULL dereference (Jim Meyering) - Make domain save work when dynamic_ownership=0 (Daniel P. Berrange) - Add support for NIC hotplug using netdev_add in QEMU (Daniel P. Berrange) - build: update gnulib (Eric Blake) - tests: correct PATH in new test, for when running manually (Jim Meyering) - Add env variable for debugging gnutls usage (Daniel P. Berrange) - maint: allow VPATH use of remote_protocol-structs (Eric Blake) - help avoid accidental remote_protocol.x changes (Jim Meyering) - build: use LIBADD, not LDFLAGS, for adding libraries (Eric Blake) - Implement SCSI disk unplugging (Wolfgang Mauerer) - qemu: use better types (Eric Blake) - Refactor disk unplugging (Wolfgang Mauerer) - build: simplify checks for sched.h (Eric Blake) - build: use gnulib's sys/wait.h (Eric Blake) - build: use gnulib's uname (Eric Blake) - build: rely on gnulib's pthread module (Eric Blake) - rpmbuild: add ebtables & ip(6)tables dependency for rpm (Stefan Berger) - lxc: Use virDomainFindByUUID for domain lookup (Jiri Denemark) - nwfilter: skip some interfaces on filter update (Stefan Berger) - pass info where request stems from to have rules applied (Stefan Berger) - dnsmasq.c: Fix OOM error reporting (Matthias Bolte) - autobuild.sh: provide default prefix (Eric Blake) Cleanups: - lxc: Change VIR_ERROR to VIR_DEBUG for just a debugging message (Ryota Ozaki) - phyp: reduce scope of driver functions (Eric Blake) - Fix test case failure due to missing -nodefconfig (Daniel P. Berrange) - esx: Use bool instead of int where appropriated (Matthias Bolte) - Cleanup some LIBADD and CFLAGS (Matthias Bolte) - virsh: remove a doubled up include for errno.h (Justin Clift) - Misc cleanups (Jiri Denemark) - Remove unnecessary check for non-NULL uuid (Jiri Denemark) - qemu: reduce file padding requirements (Eric Blake) - virsh: change printf() calls to vshPrint() (Justin Clift) - phyp: sed cleanups (Eric Blake) - maint: simplify some ignore files (Eric Blake) - avoid syntax-check failure (Jim Meyering) - autobuild.sh: avoid bashism (Eric Blake) - bitmap: reject zero-size bitmap (Eric Blake) - build: depend on correct file (Eric Blake) - build: make cpp indentation conform (Jim Meyering) - hooks: fix typo (Paolo Smiraglia) - build: silence cppi warning, clarify vbox headers (Eric Blake) - xen: Remove unused function (Cole Robinson) - esx: Simplify goto usage (Matthias Bolte) - Use printf instead of echo -e in libvirt.spec.in (Matthias Bolte) - build: fix HTML errors in nwfilter docs (Eric Blake) - build: fix compilation without macvtap (Eric Blake) - tests: avoid new failure of the daemon-conf test (Jim Meyering) - storage: mpath: Fix incorrect VIR_ERROR use (Cole Robinson) - Allow nwfilter functions to be compiled with C++ (Chris Lalancette) - storage: Combine some duplicate code (Cole Robinson) - storage: mpath: Clean up some error handling (Cole Robinson) - Remove dead code after refactoring qemudDomainStart (Jiri Denemark) - build: fix cppi warnings (Eric Blake) - Remove isValidIfname. (Chris Lalancette) - Refactor qemudDomainStart (Jiri Denemark) - Factor out def assignment to existing domain from virDomainAssignDef (Jiri Denemark) - Refactor qemudDomainRestore (Jiri Denemark) - maint: don't mark VIR_DEBUG or VIR_DEBUG0 diagnostics for translation (Jim Meyering) - maint: more of same, but manual: convert VIR_ERROR("%s" to VIR_ERROR0( (Jim Meyering) - maint: VIR_ERROR/VIR_ERROR0: mark up the remaining ones manually (Jim Meyering) - maint: mark translatable string args of VIR_ERROR (Jim Meyering) - maint: mark translatable string args of VIR_ERROR0 (Jim Meyering) - maint: use VIR_ERROR0 rather than VIR_ERROR with a bare "%s" (Jim Meyering) - qemu: Remove explicit VNC XML cleanup (Cole Robinson) - Rename qemuBuildCommandLine tapfds -> vmfds. (Alex Williamson) - initialize "meta" in virStorageFileGetMetadata, not in each caller (Jim Meyering) - (qemu*DiskCgroup): avoid dead code (Jim Meyering) - maint: more VIR_WARN corrections: now manually (Jim Meyering) - maint: use VIR_WARN0("...") rather than VIR_WARN("%s", "...") (Jim Meyering) - maint: remove _(...) from VIR_WARN arg manually (Jim Meyering) - maint: don't mark VIR_WARN or VIR_WARN0 diagnostics for translation (Jim Meyering) - do not ignore qemuMonitorAddDrive failure; make uses identical (Jim Meyering) - ebtablesAddRemoveRule, iptablesAddRemoveRule: don't skip va_end (Jim Meyering) - linuxNodeInfoCPUPopulate: avoid used-uninitialized via a test (Jim Meyering) - lxcFreezeContainer: avoid test-after-deref of never-NULL pointer (Jim Meyering) - Remove debugging fprintf() calls (Daniel P. Berrange) - tests: use GPLv2+, not GPLv3 (Jim Meyering) - tests: adjust copyrights on scripts: s/FSF/Red Hat/ (Jim Meyering) - virsh: fix a typo in a diagnostic (Jim Meyering) - delMacvtap: typo fix (Eric Blake) - docs/Makefile.am: remove unnecessary subshells (Eric Blake) - maint: avoid spurious output if program not present (Eric Blake) - storage_encryption: silence clang warning (Eric Blake) - maint: whitespace cleanups (Eric Blake) - qemu: Fix warning about a non-literal format string (Matthias Bolte) - build: drop more redundant configure checks (Eric Blake) - build: silence a clang false positive (Eric Blake) Thanks to everybody who helped for this release by contributing changes or reporting issues ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

1 0

[libvirt-users] (no subject)
by angelo alfano 05 Jul '10

05 Jul '10

Dear friend, Good day.I have a Japanese friend,His company is holding a promoting action, I hope you may join it,the company sell some electronic products such as motorbike,GPS notebook laptop,TV,cellphone,camera,psp. they are made in Korea,Japan and so on.the price is very low .if you want to buy it ,please visit ： www.oanls3.com/ and choose the products you like,and their company may handsel some small products as gift. if you are satisfied with the product after you receive it,please introduce it to your friends. thank you , have a nice day.

1 0

[libvirt-users] ESXi support
by adrian wyssen 03 Jul '10

03 Jul '10

Hello everyone, I want to use libvirt to manage an Vmware ESXi 4.0 server from within a virtual machine running on that server. I did not find any C examples using ESX(i). Can anyone give me some example code, because I am really new in this domain and I can't get started... I don't find any information about using libvirt with ESX(i), even if it is supposed to work with it. I thank you for any information. Adrian

2 1

[libvirt-users] ANNOUNCE: ruby-libvirt bindings 0.2.0
by Chris Lalancette 02 Jul '10

02 Jul '10

Hello all, I'm pleased to announce the release of 0.2.0 of the ruby-libvirt bindings. This release has a number of new features: - Updated Storage class, implementing pool.active?, pool.persistent?, pool.vol_create_xml_from - Updated Connect class, implementing conn.node_free_memory, conn.node_cells_free_memory, conn.node_get_security_model, conn.encrypted?, conn.libversion, and conn.secure? - Updated Network class, implementing network.active? and network.persistent? - Update Domain class, implementing conn.domain_xml_from_native, conn.domain_xml_to_native, dom.migrate_to_uri, dom.migrate_set_max_downtime, dom.managed_save, dom.has_managed_save?, dom.managed_save_remove, dom.security_label, dom.block_stats, dom.memory_stats, dom.blockinfo, dom.block_peek, dom.memory_peek, dom.active?, dom.persistent?, dom.snapshot_create_xml, dom.num_of_snapshots, dom.list_snapshots, dom.lookup_snapshot_by_name, dom.has_current_snapshot?, dom.revert_to_snapshot, dom.current_snapshot, snapshot.xml_desc, snapshot.delete, dom.job_info, and dom.abort_job - Implementation of the NodeDevice class - Implementation of the Secret class - Implementation of the NWFilter class - Implementation of the Interface class - Conversion of the development tree to git - New maintainer (me). David Lutterkort has agreed to transfer maintainership of the bindings over to me, since he is not actively involved in their development anymore. With the above list, almost all of the APIs up to and including libvirt 0.8.1 are covered. There are a few that I have not yet had time to implement; you can look at the list of FIXMEs in the source code to find them. I've uploaded new tarballs and source RPMs to: http://libvirt.org/ruby/download/ The new git repo is here: http://libvirt.org/git/?p=ruby-libvirt.git;a=summary The documentation for the new API's are here: http://libvirt.org/ruby/api/index.html If you have time, and are interested in the bindings, please give these new ones a whirl and let me know if they work for you. As usual, if you have any questions, problems, patches, or bug reports, feel free to email the libvirt development list (and CC me) so that I can take a look at them. -- Chris Lalancette

1 0

[libvirt-users] C API example
by steven765＠yahoo.com 02 Jul '10

02 Jul '10

Trying to build the hellolibvirt example. I get the project to compile okay but when I try to run it I get: Unable to connect to '/usr/local/var/run/libvirt/libivrt-sock Given libvirt --status says it's in /var/run/libvirt/libvirt-sock that makes sense. How do I make the git version run with my local copy? Or even better does anyone have any example projects that have the proper includes documented, seperate from the build tree? I'd like to just use the API not compile and deal with all of libvirt at the moment. Thanks a ton!

3 5

[libvirt-users] qemu+ssh auth with different identity files
by David W King 01 Jul '10

01 Jul '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm trying to get qemu+ssh auth working but I need to be able to specify an identity file to use for the ssh connection. Based on what I read at http://libvirt.org/remote.html I tried virsh -c "qemu+ssh://root@xhost1/system?command=/usr/bin/ssh%20-i%20/path/to/my/identity/file/id_rsa" list which returns error: cannot recv data: Connection reset by peer error: failed to connect to the hypervisor I've also tried virsh -c "qemu+ext://root@xhost1/system?command=/usr/bin/ssh%20-i%20/path/to/my/identity/file/id_rsa" list but that just seg faults right away. Is there something I'm missing or is there a better way to do this? ~david - -- David King Goshen College ITS davidwk(a)goshen.edu 574-535-7726 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkwsfgcACgkQH+/Vg7DylXZwNACgokhTalESNjigypXA2kAlP8gp etkAn3aEwJN1kJSPCkkIr09wBjwGD14r =lC67 -----END PGP SIGNATURE-----

1 0

[libvirt-users] Some missunderstanding in the wiki page
by Leopold Palomo-Avellaneda 01 Jul '10

01 Jul '10

Hi, I'm not in the list and I just would like to comment it to the comunity. So, if someone want to contact me, make CC to me in the reply. The wiki page [1] talk about networking, and show two typical configurations: "virtual network" and "shared physical device". The shared physical device has an error or something that could make confused, I think. What I want to say? In my case, I have a box with several nics, and I want to speciffy that ethX should be used exclusively but virtual domain X. The documentation is clear in this: The NAT based connectivity is useful for quick & easy deployments, or on machines with dynamic/sporadic networking connectivity. More advanced users will want to use full bridging, where the guest is connected directly to the LAN. The configuration (I have follow only the debian/ubuntu steps) shows that br0 has assigned an IP. I did the mistake to try to assign the same IP in the guest network configuration, I understand that, and obviously it doesn't work (duplicate IPs). So, to me, it would me more clear if the br0 interface has no IP. In my case, I have two nics: eth0 the interface for the host and eth1 for the guest. The eth1 part in my network/interfaces is: ... auto eth1 iface eth1 inet manual auto br0 iface br0 inet manual bridge_ports eth1 bridge_stp on bridge_maxwait 0 bridge_fd 0 ... and then in the guest you configure the IP as you want. In the host, eth1 (or whatever interface you bridge) has no IP, so it's not used, and the guest uses completely. What do you think? Regards, Leo [1] http://wiki.libvirt.org/page/Networking

2 3

[libvirt-users] SASL GSSAPI error "Key table entry not found"
by Adam Gray 01 Jul '10

01 Jul '10

My server and client are running Ubuntu Lucid, libvirt-bin 0.7.5-5ubuntu27, qemu-kvm-0.12.3+noroms-0ubuntu9 and I'm using virt-viewer-0.0.3-6ubuntu7.xul19 or virt-manager-0.8.2-2ubuntu8 to connect. I configured SASL2 to use GSSAPI for libvirt following the instructions in the libvirt docs, created a keytab with libvirt/my.fully.qualified.domain(a)MY-REALM.COM (has a dash fwiw) and pointed SASL2 and libvirt at /etc/krb5.keytab (changing the location of that doesn't seem to work for my version, but that's no biggie). So I sit on my client and run this: virsh -c qemu+tcp://my.fully.qualified.domain/system And I get this message on the client: error: authentication failed error: failed to connect to the hypervisor And this on the server logs: 16:37:35.278: error : remoteDispatchAuthSaslStart:3135 : sasl start failed -1 (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Key table entry not found)) For fun, I ran kdestroy and tried again and got this: error: Failed to start SASL negotiation: -1 (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credentials cache file '/tmp/krb5cc_1000' not found)) error: failed to connect to the hypervisor So at least the client seems to be presenting my ticket properly, but the server is either looking for the wrong keytab entry or I can't read very well. -adam

4 7

[libvirt-users] non-root user "virConnectOpen() faile" in libvirt-0.3
by Shenglan Wang 01 Jul '10

01 Jul '10

*Hello,* * * *My environment is "Xen3.1 in Fedora8" with "libvirt0.3 & python2.5". When I ran the following * *commands as a non-root user "nimbus":* $python >>> import libvirt >>> libvirt.open("xen:///") --------- Console --------- [nimbus@localhost-120 ~]$ python Python 2.5.1 (r251:54863, Oct 30 2007, 13:54:11) [GCC 4.1.2 20070925 (Red Hat 4.1.2-33)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import libvirt >>> libvirt.open("xen:///") Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python2.5/site-packages/libvirt.py", line 123, in open if ret is None:raise libvirtError('virConnectOpen() failed') libvirt.libvirtError: virConnectOpen() failed >>> *I encountered the error "virConnectOpen() failed". if I changed the user into root, it worked well. * *But I hava to use the non-root account "nimbus". I looked into the problem on the net, in order * *that non-root user could use libvirt as root user, someone suggested that I should modify the libvirt * *configuration file "/etc/libvirt/libvirtd.conf", but they didn't point out what field should be changed.* * * *I am puzzled about that problem. I have already changed the sudo file and the xen configuration * *file "/etc/xen/xend-config.sxp", which doesn't work at all. Could someome give me any tips? * --------- "/etc/xen/xend-config.sxp" --------- (xend-http-server yes) (xend-unix-server yes) (network-script network-bridge) * * *Thanks in advance!* * * *Cheers,* * * *Shenglan Wang*

1 0

[libvirt-users] how to match the ID of a LUN in a storage pool with the GUID on the target server
by Tom Georgoulias 01 Jul '10

01 Jul '10

I've configured a libvirt storage pool using an iscsi target from a Sun 7310 storage appliance and am using the LUNs in this target as volumes for my KVM guests. The setup is very similar to what Daniel covered in a recent blog posting: http://berrange.com/posts/2010/05/05/provisioning-kvm-virtual-machines-on-i… It works great, but I can't figure out how to match the volume names & path IQNs within the storage pool to the GUIDs on the target. For example, here's what I see when I use the vol-info command: # virsh vol-list kvm-target Name Path ----------------------------------------- 6.0.0.0 /dev/disk/by-path/ip-X.X.X.X:3260-iscsi-iqn.1986-03.com.sun:02:<snipped>-lun-0 6.0.0.1 /dev/disk/by-path/ip-X.X.X.X:3260-iscsi-iqn.1986-03.com.sun:02:<snipped>-lun-1 The IQN matches the targets IQN, but when I browse the LUNs from the storage system I do not see a way to determine which of them is *-lun-0 and which is *-lun-1, I only see a GUID and an alias name that I created. Is there any way to get that info (or something else that will do the job) from a virsh command? Thanks in advance for any help. Tom

2 5

[libvirt-users] Are memoryPeek and blockPeek still not supported?
by steven765＠yahoo.com 01 Jul '10

01 Jul '10

Hi, I just tried x=dom.blockPeek('disk',5,0,buf,0) and it returns AtrributeError: 'module' object has no attribute 'virDomainBlockPeek' I found this bug submission from early 09: https://bugzilla.redhat.com/show_bug.cgi?format=multiple&id=492683 Is that still correct are they not implemented. Or did i screw up the command? Thanks, Steve

1 0

[libvirt-users] Better error codes when stopping a VM that is already stopped
by Guido Winkelmann 01 Jul '10

01 Jul '10

Hi, Sometimes when stopping a virtual domain using virDomainDestroy(), I come across a domain that is already stopped. (For example when someone already stopped the domain manually using virsh or because the guest OS issued a shutdown.) This is a special case that I absolutely need to catch and handle. Unfortunately, when this happens, and I call virGetLastError() afterwards, I always just get the error code VIR_ERR_OPERATION_INVALID, which doesn't look very precise to me... Two questions about this: Is the domain not running at that moment the only possible condition that can trigger this particular error code when calling virDomainDestroy()? Can't we have a more obvious/precise error code in that case, like VIR_ERR_DOMAIN_NOT_RUNNING or something like that? Guido Winkelmann

4 6

[libvirt-users] FYI: a short guide to libvirt & network filtering iptables/ebtables use
by Daniel P. Berrange 01 Jul '10

01 Jul '10

I just wrote this to assist some Red Hat folks understanding what libvirt does with iptables, and thought it is useful info for the whole libvirt community. When I have time I'll adjust this content so that it can fit into the website in relevant pages/places. Firewall / network filtering in libvirt ======================================= There are three pieces of libvirt functionality which do network filtering of some type. At a high level they are: - The virtual network driver. This provides a isolated bridge device (ie no physical NICs enslaved). Guest TAP devices are attached to this bridge. Guests can talk to each other & the host, and optionally the wider world. - The QEMU driver MAC filtering This provides a generic filtering of MAC addresses to prevent the guest spoofing its MAC address. This is mostly obsoleted by the next item, so won't be discussed further. - The network filter driver This provides fully configurable, arbitrary network filtering of traffic on guest NICs. Generic rulesets are defined at the host level to control traffic in some manner. Rules sets are then associated with individual NICs of a guest. While not as expressive as directly using iptables/ebtables, this can still do nearly everything you would want to on a guest NIC filter. The virtual network driver ========================== The typical configuration for guests is to use bridging of the physical NIC on the host to connect the guest directly to the LAN. In RHEL6 there is also the possibility of using macvtap/sr-iov and VEPA connectivity. None of this stuff plays nicely with wireless NICs, since they will typically silently drop any traffic with a MAC address that doesn't match that of the physical NIC. Thus the virtual network driver in libvirt was invented. This takes the form of an isolated bridge device (ie one with no physical NICs enslaved). The TAP devices associated with the guest NICs are attached to the bridge device. This immediately allows guests on a single host to talk to each other and to the host OS (modulo host IPtables rules). libvirt then uses iptables to control what further connectivity is available. There are three configurations possible for a virtual network at time of writing - isolated: all off-node traffic is completely blocked - nat: outbound traffic to the LAN is allowed, but MASQUERADED - forward: outbound traffic to the LAN is allowed The latter 'forward' case requires the virtual network be on a separate sub-net from the main LAN, and that the LAN admin has configured routing for this subnet. In the future we intend to add support for IP subnetting and/or proxy-arp. This allows for the virtual network to use the same subnet as the main LAN & should avoid need for the LAN admin to configure special routing. Libvirt will optionally also provide DHCP services to the virtual network using DNSMASQ. In all cases, we need to allow DNS/DHCP queries to the host OS. Since we can't predict whether the host firewall setup is already allowing this, we insert 4 rules into the head of the INPUT chain target prot opt in out source destination ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 Note we have restricted our rules to just the bridge associated with the virutal network, to avoid opening undesirable holes in the host firewall wrt the LAN/WAN. The next rules depend on the type of connectivity allowed, and go in the main FORWARD chain: type=isolated ------------- Allow traffic between guests. Deny inbound. Deny outbound. target prot opt in out source destination ACCEPT all -- virbr1 virbr1 0.0.0.0/0 0.0.0.0/0 REJECT all -- * virbr1 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- virbr1 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable type=nat -------- Allow inbound related to an established connection. Allow outbound, but only from our expected subnet. Allow traffic between guests. Deny all other inbound. Deny all other outbound. target prot opt in out source destination ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 state RELATED,ESTABLISHED ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable type=routed ----------- Allow inbound, but only to our expected subnet. Allow outbound, but only from our expected subnet. Allow traffic between guests. Deny all other inbound. Deny all other outbound. target prot opt in out source destination ACCEPT all -- * virbr2 0.0.0.0/0 192.168.124.0/24 ACCEPT all -- virbr2 * 192.168.124.0/24 0.0.0.0/0 ACCEPT all -- virbr2 virbr2 0.0.0.0/0 0.0.0.0/0 REJECT all -- * virbr2 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable REJECT all -- virbr2 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Finally, with type=nat, there is also an entry in the POSTROUTING chain to apply masquerading target prot opt in out source destination MASQUERADE all -- * * 192.168.122.0/24 !192.168.122.0/24 The network filter driver ========================= This driver provides a fully configurable network filtering capability that leverages ebtables, iptables and ip6tables. This was written by the libvirt guys at IBM and although its XML schema is defined by libvirt, the conceptual model is closely aligned with the DMTF CIM schema for network filtering http://www.dmtf.org/standards/cim/cim_schema_v2230/CIM_Network.pdf The filters are managed in libvirt as a top level, standalone object. This allows the filters to then be referenced by any libvirt object that requires their functionality, instead tieing them only to use by guest NICs. In the current implementation, filters can be associated with individual guest NICs via the libvirt domain XML format. In the future we might allow filters to be associated with the virtual network objects. Further we're expecting to define a new 'virtual switch' object to remove the complexity of configuring bridge/sriov/vepa networking modes. This make also end up making use of network filters. There are a new set of virsh commands for managing network filters virsh nwfilter-define define or update a network filter from an XML file virsh nwfilter-undefine undefine a network filter virsh nwfilter-dumpxml network filter information in XML virsh nwfilter-list list network filters virsh nwfilter-edit edit XML configuration for a network filter There are equivalently named C APIs for each of these commands. As with all objects libvirt manages, network filters are configured using an XML format. At a high level the format looks like this: <filter name='no-spamming' chain='XXXX'> <uuid>d217f2d7-5a04-0e01-8b98-ec2743436b74</uuid> <rule ...> .... </rule> <filterref filter='XXXX'/> </filter> Every filter has a name and UUID which serve as unique identifiers. A filter can have zero-or-more <rule> elements which are used to actually define network controls. Filters can be arranged into a DAG, so zero-or-more <filterref/> elements are also allowed. Cycles in the graph are not allowed. The <rule> element is where all the interesting stuff happens. It has three attributes, an action, a traffic direction and an optional priority. eg <rule action='drop' direction='out' priority='500'> Within the rule there are a wide variety of elements allowed, which do protocol specific matching. Supported protocols currently include 'mac', 'arp', 'rarp', 'ip', 'ipv6', 'tcp/ip', 'icmp/ip', 'igmp/ip', 'udp/ip', 'udplite/ip' 'esp/ip', 'ah/ip', 'sctp/ip', 'tcp/ipv6', 'icmp/ipv6', 'igmp/ipv6', 'udp/ipv6', 'udplite/ipv6', 'esp/ipv6', 'ah/ipv6', 'sctp/ipv6'. Each protocol defines what is valid inside the <rule> element, the general pattern though is <protocol match='yes|no' attribute1='value1' attribute2='value2'/> so, eg a TCP protocol, matching ports 0-1023 would be expressed as: <tcp match='yes' srcportstart='0' srcportend='1023'/> Attributes can included references to variables defined by the object using the rule. So the guest XML format allows each NIC to have a MAC address and IP address defined. These are made available to filters via the variables $IP and $MAC. So to define a filter the prevents IP address spoofing we can simply match on source IP address != $IP <filter name='no-ip-spoofing' chain='ipv4'> <rule action='drop' direction='out'> <ip match='no' srcipaddr='$IP' /> </rule> </filter> I'm not going to go into details on all the other protocol matches you can do, because it'll take far too much space. You can read about the options here http://libvirt.org/formatnwfilter.html#nwfelemsRulesProto Out of the box in RHEL6/Fedora rawhide, libvirt ships with a set of default useful rules # virsh nwfilter-list UUID Name ---------------------------------------------------------------- 15b1ab2b-b1ac-1be2-ed49-2042caba4abb allow-arp 6c51a466-8d14-6d11-46b0-68b1a883d00f allow-dhcp 7517ad6c-bd90-37c8-26c9-4eabcb69848d allow-dhcp-server 3d38b406-7cf0-8335-f5ff-4b9add35f288 allow-incoming-ipv4 5ff06320-9228-2899-3db0-e32554933415 allow-ipv4 db0b1767-d62b-269b-ea96-0cc8b451144e clean-traffic f88f1932-debf-4aa1-9fbe-f10d3aa4bc95 no-arp-spoofing 772f112d-52e4-700c-0250-e178a3d91a7a no-ip-multicast 7ee20370-8106-765d-f7ff-8a60d5aaf30b no-ip-spoofing d5d3c490-c2eb-68b1-24fc-3ee362fc8af3 no-mac-broadcast fb57c546-76dc-a372-513f-e8179011b48a no-mac-spoofing dba10ea7-446d-76de-346f-335bd99c1d05 no-other-l2-traffic f5c78134-9da4-0c60-a9f0-fb37bc21ac1f no-other-rarp-traffic 7637e405-4ccf-42ac-5b41-14f8d03d8cf3 qemu-announce-self 9aed52e7-f0f3-343e-fe5c-7dcb27b594e5 qemu-announce-self-rarp Most of these are just building blocks. The interesting one here is 'clean-traffic'. This pulls together all the building blocks into one filter that you can then associate with a guest NIC. This stops the most common bad things a guest might try, IP spoofing, arp spoofing and MAC spoofing. To look at the rules for any of these just do virsh nwfilter-dumpxml FILTERNAME|UUID They are all stored in /etc/libvirt/nwfilter, but don't edit files there directly. Use 'virsh nwfilter-define' to update them. This ensures the guests have their iptables/ebtables rules recreated. To associate the clean-trafffic filter with a guest, edit the guest XML config and change the <interface> element to include a <filterref> and also specify the whitelisted <ip addres/> the guest is allowed to use <interface type='bridge'> <mac address='52:54:00:56:44:32'/> <source bridge='br1'/> <ip address='10.33.8.131'/> <target dev='vnet0'/> <model type='virtio'/> <filterref filter='clean-traffic'/> </interface> If no <ip address> is included, the network filter driver will activate its 'learning mode'. This uses libpcap to snoop on network traffic the guest sends and attempts to identify the first IP address it uses. It then locks traffic to this address. Obviously this isn't entirely secure, but it does offer some protection against the guest being trojaned once up & running. In the future we intend to enhance the learning mode so that it looks for DHCPOFFERS from a trusted DHCP server and only allows the offered IP address to be used. Now, how is all this implemented... The network filter driver uses a combination of ebtables, iptables and ip6tables, depending on which protocols are referenced in a filter. The out of the box 'clean-traffic' filter rules only require use of ebtables. If you want to do matching at tcp/udp/etc protocols (eg to add a new filter 'no-email-spamming' to block port 25), then iptables will also be used. The driver attempts to keep its rules separate from those that the host admin might already have configured. So the first thing it does with ebtables, is to add two hooks in POSTROUTING & PREROUTING chains, to redirect traffic to custom chains. These hooks match on the TAP device name of the guest NIC, so they should not interact badly with any administrator defined rules Bridge chain: PREROUTING, entries: 1, policy: ACCEPT -i vnet0 -j libvirt-I-vnet0 Bridge chain: POSTROUTING, entries: 1, policy: ACCEPT -o vnet0 -j libvirt-O-vnet0 To keep things managable & easy to follow, the driver will then create further sub-chains for each protocol then it needs to match against: Bridge chain: libvirt-I-vnet0, entries: 5, policy: ACCEPT -p IPv4 -j I-vnet0-ipv4 -p ARP -j I-vnet0-arp -p 0x8035 -j I-vnet0-rarp -p 0x835 -j ACCEPT -j DROP Bridge chain: libvirt-O-vnet0, entries: 4, policy: ACCEPT -p IPv4 -j O-vnet0-ipv4 -p ARP -j O-vnet0-arp -p 0x8035 -j O-vnet0-rarp -j DROP Finally, come the actual implementation of the filters. These example is showing the 'clean-traffic' filter implementation. I'm not going to explain what this is doing now :-) Bridge chain: I-vnet0-ipv4, entries: 2, policy: ACCEPT -s ! 52:54:0:56:44:32 -j DROP -p IPv4 --ip-src ! 10.33.8.131 -j DROP Bridge chain: O-vnet0-ipv4, entries: 1, policy: ACCEPT -j ACCEPT Bridge chain: I-vnet0-arp, entries: 6, policy: ACCEPT -s ! 52:54:0:56:44:32 -j DROP -p ARP --arp-mac-src ! 52:54:0:56:44:32 -j DROP -p ARP --arp-ip-src ! 10.33.8.131 -j DROP -p ARP --arp-op Request -j ACCEPT -p ARP --arp-op Reply -j ACCEPT -j DROP Bridge chain: O-vnet0-arp, entries: 5, policy: ACCEPT -p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:56:44:32 -j DROP -p ARP --arp-ip-dst ! 10.33.8.131 -j DROP -p ARP --arp-op Request -j ACCEPT -p ARP --arp-op Reply -j ACCEPT -j DROP Bridge chain: I-vnet0-rarp, entries: 2, policy: ACCEPT -p 0x8035 -s 52:54:0:56:44:32 -d Broadcast --arp-op Request_Reverse --arp-ip-src 0.0.0.0 --arp-ip-dst 0.0.0.0 --arp-mac-src 52:54:0:56:44:32 --arp-mac-dst 52:54:0:56:44:32 -j ACCEPT -j DROP Bridge chain: O-vnet0-rarp, entries: 2, policy: ACCEPT -p 0x8035 -d Broadcast --arp-op Request_Reverse --arp-ip-src 0.0.0.0 --arp-ip-dst 0.0.0.0 --arp-mac-src 52:54:0:56:44:32 --arp-mac-dst 52:54:0:56:44:32 -j ACCEPT -j DROP NB, we would have liked to include the prefix 'libvirt-' in all of our chain names, but unfortunately the kernel limits names to a very short maximum length. So only the first two custom chains can include that prefix. The others just include the TAP device name + protocol name. If I define a new filter 'no-spamming' and then add this to the 'clean-traffic' filter, I can illustrate how iptables usage works. # cat > /root/spamming.xml <<EOF <filter name='no-spamming' chain='root'> <uuid>d217f2d7-5a04-0e01-8b98-ec2743436b74</uuid> <rule action='drop' direction='out' priority='500'> <tcp dstportstart='25' dstportend='25'/> </rule> </filter> EOF # virsh nwfilter-define /root/spamming.xml # virsh nwfilter-edit clean-traffic ...add <filterref filter='no-spamming'/> All active guests immediately have their iptables/ebtables rules rebuilt. The network filter driver deals with iptables in a very similar way. First it separates out its rules from those the admin may have defined, by adding a couple of hooks into the INPUT/FORWARD chains Chain INPUT (policy ACCEPT 13M packets, 21G bytes) target prot opt in out source destination libvirt-host-in all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 5532K packets, 3010M bytes) target prot opt in out source destination libvirt-in all -- * * 0.0.0.0/0 0.0.0.0/0 libvirt-out all -- * * 0.0.0.0/0 0.0.0.0/0 libvirt-in-post all -- * * 0.0.0.0/0 0.0.0.0/0 These custom chains, then do matching based on the TAP device name, so they won't open holes in the admin defined matches for the LAN/WAN (if any). Chain libvirt-host-in (1 references) target prot opt in out source destination HI-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 Chain libvirt-in (1 references) target prot opt in out source destination FI-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 Chain libvirt-in-post (1 references) target prot opt in out source destination ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 Chain libvirt-out (1 references) target prot opt in out source destination FO-vnet0 all -- * * 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Finally, we can see the interesting bit which is the actual implementation of my filter to block port 25 access: Chain FI-vnet0 (1 references) target prot opt in out source destination DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 Chain FO-vnet0 (1 references) target prot opt in out source destination DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:25 Chain HI-vnet0 (1 references) target prot opt in out source destination DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 One thing in looking at this that you may notice is that if there are many guests all using the same filters, we will be duplicating the iptables rules over & over for each guest. This is merely a limitation of the current rules engine implementation. At the libvirt object modelling level you can clearly see we've designed the model so that filter rules are define in one place, and indirectly referenced by guests. Thus it should be possible to change the impl in the future so that we can share the actual iptables/ebtables rules for each guest to create a more scalable system. The stuff in current libvirt is more or less the very first working impl we've had of this stuff, so there's not been much optimization work yet. Also notice that at the XML level we don't expose the fact that we are using iptables or ebtables at all. The rule definition is done in terms of network protocols. Thus if we ever find a need, we could plug in an alternative implementation that calls out to a different firewall implementation instead of ebtables/iptables (providing that impl was suitably expressive of course) Finally, in terms of problems we have in deployment. The biggest problem is that if the admin does 'service iptables restart' all our work gets blown away. We've experimented with using lokkit to record our custom rules in a persistent config file, but that caused different problem. Admins who were not using lokkit for their config found that all their own rules got blown away. So we threw away our lokkit code. Instead we document that if you run 'service iptables restart', you need to send SIGHUP to libvirt to make it recreate its rules. Finally a reminder, that the main documentation we have on this is online at http://libvirt.org/formatnwfilter.html Regards, Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

1 0

[libvirt-users] VirtualBox driver : creating storage for a new machine
by Christian Patsch 29 Jun '10

29 Jun '10

Hi, Another thing I'm strugglin with: When creating a new domain from scratch using the proposed XML format in the documentation, everything works fine - basically. A problem that I'd like to solve now is that I would expect to be able to create new volumes within libvirt. I started with a basic XML file in order to define a pool, but virsh told me that creating pools is not supported by the VirtualBox hypervisor. >From the code and different hints I learned that there is only one pool with a dummy UUID, named "default-pool". Next I tried to create a new volume from a XML file, but the only thing I'm getting are segmentation faults. Has anybody used this approach successfully ? Otherwise I assume that I have to create the VDI files manually using VirtualBox GUI/VBoxManage or vboxshell.py. Thanks in advance, Regards, Christian

2 1