Commit Graph

690 Commits

Author SHA1 Message Date
Andrea Bolognani
0e331942a0 maint: Post-release version bump to 5.5.0
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2019-06-03 17:19:28 +02:00
Andrea Bolognani
6716c997f6 docs: Install documentation under $(docdir)
At the moment we allow the user to specify exactly where
they want the HTML documentation to be installed with an
extreme level of precision through the --with-html-dir and
--with-html-subdir configure options.

Most of the time, of course, the user will stick with the
default, that is $(datadir)/doc/$(PACKAGE)-$(VERSION)/html.

So close to $(docdir)! Including the version number in
the path, specifically, seems entirely unnecessary since
different releases of libvirt are not going to be able to
coexist on the same system anyway.

Drop all these custom flexibilty for flexibilty's sake
shenaningans in favor of the standard, well understood
$(docdir).

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Acked-by: Michal Privoznik <mprivozn@redhat.com>
2019-05-13 12:02:13 +02:00
Michal Privoznik
1cdea0f929 maint: Post-release version bump to 5.4.0
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2019-05-04 23:39:23 +02:00
Andrea Bolognani
9d7b9cf166 Fix spelling for macOS
Though it used to be called "Mac OS X" and "OS X" in the past,
it was never "MacOS X" nor "OS-X", and it's just "macOS" now.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2019-04-15 11:09:10 +02:00
Ján Tomko
8bfb36db40 configure.ac: add foreign to AM_INIT_AUTOMAKE
We do not care about the portability warnings implied by the implicit
'gnu' option. Switch to 'foreign' to opt out of checking the files
present in the top directory to let us drop ChangeLog completely.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-03 13:30:47 +02:00
Ján Tomko
c94db5fef5 configure.ac: drop -Wno-obsolete from AM_INIT_AUTOMAKE
Even Ubuntu 16.04 has automake 1.11.
Now that we no longer cater to automake 1.9, drop the comment
as well as the -Wno-obsolete option, since it does not seem to generate
any warnings anymore.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-03 13:30:47 +02:00
Ján Tomko
d54a2c7738 configure: split AM_INIT_AUTOMAKE into multiple lines
Make it work better with git history.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-04-03 13:30:47 +02:00
Andrea Bolognani
241a0e8c8b maint: Post-release version bump to 5.3.0
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2019-04-03 09:44:33 +02:00
Cole Robinson
f38d553e2d configure: Remove --enable-test-coverage
We provide a custom configure option --enable-test-coverage and
'make cov' target to generate code coverage reports. However gnulib
already provides a 'make coverage' which 'just works' and doesn't
require a special configure option.

This drops our custom implementation in favor of 'make coverage'.
Reports are now output to cov/index.html

Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2019-03-14 20:47:15 -04:00
Peter Krempa
58afa434d7 maint: Post-release version bump to 5.1.0
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
2019-03-04 12:42:24 +01:00
Laine Stump
3b71f2e42d configure: selectively install a firewalld 'libvirt' zone
In the past (when both libvirt and firewalld used iptables), if either
libvirt's rules *OR* firewalld's rules accepted a packet, it would
be accepted. This was because libvirt and firewalld rules were
processed during the same kernel hook, and a single ACCEPT result
would terminate the rule traversal and cause the packet to be
accepted.

But now firewalld can use nftables for its backend, while libvirt's
firewall rules are still using iptables; iptables rules are still
processed, but at a different time during packet processing
(i.e. during a different hook) than the firewalld nftables rules. The
result is that a packet must be accepted by *BOTH* the libvirt
iptables rules *AND* the firewalld nftable rules in order to be
accepted.

This causes pain because

1) libvirt always adds rules to permit DNS and DHCP (and sometimes
TFTP) from guests to the host network's bridge interface. But
libvirt's bridges are in firewalld's "default" zone (which is usually
the zone called "public"). The public zone allows ssh, but doesn't
allow DNS, DHCP, or TFTP. So even though libvirt's rules allow the
DHCP and DNS traffic, the firewalld rules (now processed during a
different hook) dont, thus guests connected to libvirt's bridges can't
acquire an IP address from DHCP, nor can they make DNS queries to the
DNS server libvirt has setup on the host. (This could be solved by
modifying the default firewalld zone to allow DNS and DHCP, but that
would open *all* interfaces in the default zone to those services,
which is most likely not what the host's admin wants.)

2) Even though libvirt adds iptables rules to allow forwarded traffic
to pass the iptables hook, firewalld's higher level "rich rules" don't
yet have the ability to configure the acceptance of forwarded traffic
(traffic that is going somewhere beyond the host), so any traffic that
needs to be forwarded from guests to the network beyond the host is
rejected during the nftables hook by the default zone's "default
reject" policy (which rejects all traffic in the zone not specifically
allowed by the rules in the zone, whether that traffic is destined to
be forwarded or locally received by the host).

libvirt can't send "direct" nftables rules (firewalld only supports
direct/passthrough rules for iptables), so we can't solve this problem
by just sending explicit nftables rules instead of explicit iptables
rules (which, if it could be done, would place libvirt's rules in the
same hook as firewalld's native rules, and thus eliminate the need for
packets to be accepted by both libvirt's and firewalld's own rules).

However, we can take advantage of a quirk in firewalld zones that have
a default policy of "accept" (meaning any packet that doesn't match a
specific rule in the zone will be *accepted*) - this default accept will
also accept forwarded traffic (not just traffic destined for the host).

Of course we don't want to modify firewalld's default zone in that
way, because that would affect the filtering of traffic coming into
the host from other interfaces using that zone. Instead, we will
create a new zone called "libvirt". The libvirt zone will have a
default policy of accept so that forwarded traffic can pass and list
specific services that will be allowed into the host from guests (DNS,
DHCP, SSH, and TFTP).

But the same default accept policy that fixes forwarded traffic also
causes *all* traffic from guest to host to be accepted. To close this
new hole, the libvirt zone can take advantage of a new feature in
firewalld (currently slated for firewalld-0.7.0) - priorities for rich
rules - to add a low priority rule that rejects all local traffic (but
leaves alone all forwarded traffic).

So, our new zone will start with a list of services that are allowed
(dhcp, dns, tftp, and ssh to start, but configurable via any firewalld
management application, or direct editing of the zone file in
/etc/firewalld/zones/libvirt.xml), followed by a low priority
<reject/> rule (to reject all other traffic from guest to host), and
finally with a default policy of accept (to allow forwarded traffic).

This patch only creates the zonefile for the new zone, and implements
a configure.ac option to selectively enable/disable installation of
the new zone. A separate patch contains the necessary code to actually
place bridge interfaces in the libvirt zone.

Why do we need a configure option to disable installation of the new
libvirt zone? It uses a new firewalld attribute that sets the priority
of a rich rule; this feature first appears in firewalld-0.7.0 (unless
it has been backported to am earlier firewalld by a downstream
maintainer). If the file were installed on a system with firewalld
that didn't support rule priorities, firewalld would log an error
every time it restarted, causing confusion and lots of extra bug
reports.

So we add two new configure.ac switches to avoid polluting the system
logs with this error on systems that don't support rule priorities -
"--with-firewalld-zone" and "--without-firewalld-zone". A package
builder can use these to include/exclude the libvirt zone file in the
installation. If firewalld is enabled (--with-firewalld), the default
is --with-firewalld-zone, but it can be disabled during configure
(using --without-firewalld-zone). Targets that are using a firewalld
version too old to support the rule priority setting in the libvirt
zone file can simply add --without-firewalld-zone to their configure
commandline.

These switches only affect whether or not the libvirt zone file is
*installed* in /usr/lib/firewalld/zones, but have no effect on whether
or not libvirt looks for a zone called libvirt and tries to use it.

NB: firewalld zones can only be added to the permanent config of
firewalld, and won't be loaded/enabled until firewalld is restarted,
so at package install/upgrade time we have to restart firewalld. For
rpm-based distros, this is done in the libvirt.spec file by calling
the %firewalld_restart rpm macro, which is a part of the
firewalld-filesystem package. (For distros that don't use rpm
packages, the command "firewalld-cmd --reload" will have the same
effect).

Signed-off-by: Laine Stump <laine@laine.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2019-02-01 12:08:37 -05:00
Ján Tomko
ca13c64868 maint: Post-release version bump to 5.1.0
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2019-01-16 08:28:49 +01:00
Michal Privoznik
29682196d8 Drop UML driver
The driver is unmaintained, untested and severely broken for
quite some time now. Since nobody even reported any issue with it
let us drop it.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2018-12-17 17:52:46 +01:00
Andrea Bolognani
0ef33062ef maint: Post-release version bump to 5.0.0
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2018-12-03 14:13:19 +01:00
Michal Privoznik
18f90481cd Post-release version bump to 4.10.0
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2018-11-05 08:52:17 +01:00
Ján Tomko
d628f6dd4e configure: remove regexec and getgrnam_r checks
Introduced by:
commit 635ae38979
commit 1b745219c7
But their HAVE_ counterparts were never used.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2018-10-01 17:44:09 +02:00
Ján Tomko
b9384391d5 configure: do not check for kill
Introduced by:
commit 3c37a171a2
    Add check for kill() to fix build of cgroups on win32

Made redundant by:
commit 02f1fd41f6
    cgroup macros refactoring, part 1

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2018-10-01 17:44:09 +02:00
Ján Tomko
4d4ade13f3 configure: remove check for poll.h
Introduced by:
commit b38d045dea
    Remove use of sys/poll.h on mingw

Made redundant by:
  commit 0c97e70b74
    Update event loop example programs to demonstrate best practice

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2018-10-01 17:44:09 +02:00
Ján Tomko
1f14f13c3d configure: remove check for regex.h
Introduced by:
commit 542039fab0
    Fully support mingw builds

Made redundant by:
commit ec8a2d0327
    regex: gnulib guarantees that we have regex support

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2018-10-01 17:44:09 +02:00
Ján Tomko
6bb6595956 configure: remove duplicit check for sys/un.h
Commit 7c08fcc4 added this one.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2018-10-01 17:44:09 +02:00
Ján Tomko
ae118eb5f5 configure: sort AC_CHECK_HEADERS argument list
Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2018-10-01 17:44:09 +02:00
Ján Tomko
6a2bf49ddf configure: sort AC_CHECK_FUNCS_ONCE arguments
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2018-10-01 17:44:09 +02:00
Ján Tomko
ec686c9dc2 configure: split common header and function checks
Use one line per entry, to work better with line-based git history.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2018-10-01 17:44:09 +02:00
Ján Tomko
5b12336690 Post-release version bump to 4.9.0
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2018-10-01 17:44:09 +02:00
Peter Krempa
44f82ec276 Post-release version bump to 4.8.0
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
2018-09-04 08:07:17 +02:00
Ján Tomko
86db0db979 Revert "build: add --with-jansson"
This reverts commit 12b34f094e.

Jansson cannot parse QEMU's quirky JSON.
Revert back to yajl.

https://bugzilla.redhat.com/show_bug.cgi?id=1614569

Conflicts:
  configure.ac:
    Commit 8aa85e0b introduced LIBVIRT_*_LIBISCSI macros.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2018-08-13 15:50:01 +02:00
Clementine Hayat
f0bf1be3e7 storage: Introduce iscsi_direct pool type
Introducing the pool as a noop. Integration inside the build
system. Implementation will be in the following commits.

Signed-off-by: Clementine Hayat <clem@lse.epita.fr>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2018-08-06 12:23:55 +02:00
Clementine Hayat
8aa85e0bb7 configure: Introduce libiscsi in build system
The minimal required version is 1.18.0 because the synchrounous function
needed were introduced here.

Signed-off-by: Clementine Hayat <clem@lse.epita.fr>
2018-08-06 12:23:55 +02:00
Michal Privoznik
08e3863f0f Post-release version bump to 4.7.0
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2018-08-06 12:23:15 +02:00
Ján Tomko
12b34f094e build: add --with-jansson
Introduce the configure argument and check for Jansson >= 2.5

Signed-off-by: Ján Tomko <jtomko@redhat.com>
2018-07-18 17:54:17 +02:00
Julio Faracco
2e11298f93 configure: Adding XFS library/headers check.
This commit checks for xfs.h library to use XFS_IOC_CLONE which is
defined into that library file. So, after that it is possible to use
thie macro to create reflinks.

Signed-off-by: Julio Faracco <jcfaracco@gmail.com>
2018-07-06 16:56:55 +02:00
John Ferlan
abd253c963 Post-release version bump to 4.6.0
Signed-off-by: John Ferlan <jferlan@redhat.com>
2018-07-02 16:58:50 -04:00
Michal Privoznik
60d9ad6f1e configure: Require GnuTLS
We are building with GnuTLS everywhere because GnuTLS is widely
available. Also, it is desirable to prefer cryptographically
strong PRNG over "/dev/urandom" which is just a fallback.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-05 14:32:03 +02:00
Jiri Denemark
a1b43af0ba Post-release version bump to 4.5.0
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2018-06-04 23:13:13 +02:00
Ján Tomko
950c46f1a4 util: create virvsock.c
A file for vsock-related helper functions.
virVsockSetGuestCid to set an already-known CID,
virVsockAcquireGuestCid that will use the first available CID

https://bugzilla.redhat.com/show_bug.cgi?id=1291851

Signed-off-by: Ján Tomko <jtomko@redhat.com>
2018-05-29 15:42:03 +02:00
Daniel P. Berrangé
b71ce433bc configure: remove bogus LIBVIRT_GETTEXT macro reference
The LIBVIRT_GETTEXT macro was an artifact of patch development and
was later renamed to LIBVIRT_CHECK_NLS. This cruft causes configure
to print out

./configure: line 75084: LIBVIRT_GETTEXT: command not found

but fortunately this is non-fatal

Reported-by: Martin Kletzander <mkletzan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-05-03 17:06:19 +01:00
Ján Tomko
e7359ff36d Post-release version bump to 4.4.0
Signed-off-by: Ján Tomko <jtomko@redhat.com>
2018-05-02 14:35:05 +02:00
Daniel P. Berrangé
c0a8ea450d po: provide custom make rules for po file management
Historically we have relied on autopoint/gettextize to install a
standard po/Makefile.in.in. There is very limited scope for customizing
this and it also causes a bunch of extra stuff to be pulled into
configure.ac which potentially clashes with gnulib. Writing make rules
for po file management is no more difficult than any other rules libvirt
has, so stop using autopoint/gettextize.

Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-04-19 10:35:58 +01:00
Jim Fehlig
1dac5fbbbb Remove the xend driver
xend was deprecated in Xen 4.2 and removed from the Xen sources
before the Xen 4.5 release. The last Xen release to contain xend
was Xen 4.4, which was retired upstream in March 2017.

Remove xend support from libvirt since it is unrealistic to use
modern libvirt with ancient Xen.

Signed-off-by: Jim Fehlig <jfehlig@suse.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2018-04-09 11:38:05 -06:00
Michal Privoznik
0cd8068425 Post-release version bump to 4.3.0
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2018-04-01 12:32:36 +02:00
Rainer Müller
c28d837c0f build: Remove --with-xml-catalog-file option
After validation against XHTML 1.0 was dropped in f802c9de0,
the XML_CATALOG_FILE is not in use anymore. Therefore the checks in
configure can be removed.

Signed-off-by: Rainer Müller <raimue@codingfarm.de>
2018-03-25 19:49:25 +02:00
Andrea Bolognani
c229e01a1f configure: Allow (and prefer) Python 3
Our build process no longer depends on Python 2, so we can
finally allow Python 3 to satisfy our requirement for a Python
interpreter.

Since several distributions have now switched to installing
Python 3 by default and Python 2 is on its way out, prefer the
former when both are available.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2018-03-20 13:42:46 +01:00
Daniel P. Berrangé
11c0aadb38 Post-release version bump to 4.2.0
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-03-05 15:02:51 +00:00
Daniel P. Berrangé
3f055b5997 daemon: move logrotate files to src/remote/
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-02-22 12:26:57 +00:00
Daniel P. Berrangé
a1f6030def build: passing the "-z defs" linker flag to prevent undefined symbols
Undefined symbols are a bad thing in general because they can get
resolved in unexpected ways at runtime if multiple sources provide the
same symbol name. For example both glibc and libtirpc may provide XDR
symbols and we want to ensure that we resolve to libtirpc if that's what
we originally built against.

The toolchain maintainers thus strongly recommend that all applications
use the '-z defs' linker flag to prevent undefined symbols. This is
shortly becoming part of the default linker flags for RPMs. As an added
benefit this aligns Linux builds with Windows builds, where the linker
has never permitted undefined symbols.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2018-02-09 11:05:10 +00:00
Michal Privoznik
0b54c37d50 Post-release version bump to 4.1.0
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2018-01-19 14:26:53 +01:00
Michal Privoznik
f0d390bc16 tools: Provide bash autompletion file
The only purpose of this file is to be sourced. After that one
can use completion even for their bash:

  # virsh list --<TAB><TAB>
  --all                   --inactive ...

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2018-01-11 18:53:04 +01:00
Andrea Bolognani
6dde44c86f maint: Bump version number to 4.0.0
As documented in

  https://libvirt.org/downloads.html#schedule
  https://libvirt.org/downloads.html#numbering

the next release will happen in the middle of January 2018 and,
being the first release of a new year, will bring a brand new
major version number with it.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2017-12-05 11:17:45 +01:00
Michal Privoznik
c18c83a802 Post-release version bump to 3.11.0
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-12-05 07:31:54 +01:00
Jiri Denemark
37e18b0cc8 Post-release version bump to 3.10.0
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
2017-11-02 21:43:00 +01:00