Commit Graph

45512 Commits

Author SHA1 Message Date
Michal Privoznik
c21e271d36 virsh: Properly terminate string list in virshDomainInterfaceSourceModeCompleter()
A completer must return a NULL terminated list of strings, which
means that when dealing with enums, it has to allocate one
pointer more than the value of VIR_XXX_LAST. But this is not
honoured in virshDomainInterfaceSourceModeCompleter() leading to
out of bounds read.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2022-03-15 13:36:43 +01:00
Peter Krempa
2804fa912f qemuBlockJobDiskNew: Remove misleading return value description
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
da48fff4b9 qemuMigrationSrcNBDStorageCopyOne: Refactor cleanup
Autofree the temporary string and shuffle around the success path to
avoid the 'cleanup' label.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
c1e2a134c8 NEWS: Mention that VIR_MIGRATE_PARAM_TLS_DESTINATION works now for non-shared storage migration
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
e8fa09d66b qemu: migration: Use 'VIR_MIGRATE_PARAM_TLS_DESTINATION' for the NBD connection
The NBD connection for non-shared storage migration can have the same
issue regarding TLS certificate name match as the migration connection
itself.

Propagate the configured name also for the NBD connections.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1901394
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
e6d1ed4a76 conf: Add support for setting expected TLS hostname for NBD disks
In cases when the hostname of the NBD server doesn't match the hostname
in the TLS certificate the new attribute 'tlsHostname' can be used to
override it.

Add the XML infrastructure and tests.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
e11f2eb7a8 qemu: Add support for 'tlsHostname' setting of virStorageSource
Add validation and formatting of the blockdev props.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
47abbe0fd7 storage_source: Add 'tlsHostname' field to virStorageSource
The value will be used to override the hostname used for validation of
TLS certificates.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
19faa6f01a qemuMigrationSrcRun: Fix misleading comment about NBD with TLS support
We do support non-shared storage migration with TLS now. Fix the comment
claiming otherwise.

Fixes: a8dc146a4d
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
fd6f49034d qemu: capabilities: Introduce QEMU_CAPS_BLOCKDEV_NBD_TLS_HOSTNAME
Detect that qemu can override TLS hostname setting for NBD clients.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
2c47088e76 tests: qemucapabilities: Update caps_7.0.0.x86_64
Update to commit v6.2.0-2296-g9f0369efb0

Notable changes:
  - 'tls-hostname' field for NBD client to override local hostname
  - machine types 'pc-i440fx-1.7' and older are now deprecated
  - 'snapshot-access' block driver added
  - The 'protocol' field of 'set_password' and 'expire_password'
    parameter is now an enum instead of a pure string allowing 'vnc' and
    'spice' as value and the arguments are also covered by the schema.
  - 'copy-before-write' block driver now has a 'bitmap' property
  - 'query-migrate' now reports 'precopy-bytes', 'downtime-bytes',
    'postcopy-bytes' for 'ram' and 'disk' statistics
  - RTC_CHANGE event now has a 'qom-path' property to identify the RTC
  - 'umip' cpu feature is now migratable
  - SGX property 'section-size' reinstated after regression

Changes in build setting:
  - fuse block export support now enabled

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Ján Tomko
5e055f8bcd docs: downloads: fix link to libvirt GitLab group
s/libvirt.org/libvirt/

Signed-off-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 14:29:31 +01:00
Peter Krempa
825476beda qemuSnapshotCreateActiveExternal: Remove duplicit assignment
The block of code pausing the VM assigns 'resume' to true but it's
already true because of the previous condition.

The code is deliberately kept in two blocks as upcoming changes will
modify both conditions.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
238fef920f conf: snapshot: Use proper types for snapshot location
Refactor the code to use proper types for the memory and disk snapshot
location and fix the parsing code to be compatible with an unsigned
type.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
5984e5e6fd virDomainSnapshotDefParse: Decouple parsing of memory snapshot config
Separate the steps of parsing the memory snapshot config from the
post-processing and validation code. The upcoming patch refactoring the
parsing will be simpler.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
8a5a096d72 virDomainSnapshotDefParse: Avoid 'memoryfile' temporary variable
Assign directly into the definition. The cleanup code can deal with
that.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
12b85a3611 virDomainSnapshotDefParse: Refactor cleanup
Use automatic memory cleanup, decrease scope of variables and remove the
'cleanup' label.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
c250ab90ac conf: snapshot: Remove VIR_DOMAIN_SNAPSHOT_PARSE_DISKS flag
All callers except the one in the 'esx' driver pass the flag. The 'esx'
driver has a check that 'def->ndisks' is zero after parsing the
definition. This means that we can simply always parse the disks.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
fc81be4bfa qemuDomainSnapshotForEachQcow2Raw: Act only on internal snapshots
Similarly to the external snapshot code the internal inactive snapshot
creation helper should act only when an internal snapshot of the disk is
required. For now the callers ensure that it's either _INTERNAL or _NO
when control reaches this function.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
fe6e11e856 Rename VIR_DOMAIN_SNAPSHOT_LOCATION_NONE to VIR_DOMAIN_SNAPSHOT_LOCATION_NO
The string value associated to the enum is "no". Rename the enum
accordingly.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:49 +01:00
Peter Krempa
f17da1c24b conf: Move definition of 'virDomainSnapshotLocation'
The snapshot location enum is also needed for the disk definition so if
we house it inside domain_conf we can use the proper type for it.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:49 +01:00
Peter Krempa
0146d70887 virStorageSource: Convert 'type' to proper enum
Use 'virStorageType' as type for the 'type' member and convert the code
to work properly.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:49 +01:00
Peter Krempa
b150c6cf31 virDomainSnapshotDiskDefParseXML: Automatically free temporary variables and remove cleanup
Refactor the function to avoid the cleanup section used to just free
memory associated with the parsed object.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:49 +01:00
Peter Krempa
8a0e9e106b qemuSnapshotCreateAlignDisks: Rewrite logic for selecting default memory snapshot mode
Use an if/else branch rather than a expression with a ternary operator.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:49 +01:00
Peter Krempa
a4752ce6ef qemuSnapshotDiskPrepareActiveExternal: Handle only external snapshots
Preparation steps ensure that the 'snapshot' field can only be
'VIR_DOMAIN_SNAPSHOT_LOCATION_NONE' or
VIR_DOMAIN_SNAPSHOT_LOCATION_EXTERNAL' at this point, but upcoming
patches will change that. Handle only external snapshots.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:49 +01:00
Peter Krempa
afd67eb793 virDomainDiskDefFormat: Refactor to virXMLFormatElement
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:49 +01:00
Ján Tomko
3ae5264365 docs: downloads: mark GitLab as the primary source
Document our usage of GitLab and the read-only mirrors.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-11 12:40:10 +01:00
Ján Tomko
bf34dee966 docs: downloads: remove reference to git://
With the introduction of smart HTTP protocol in git 1.6.6,
the only advantage of plain git:// over https:// is not
having the encryption overhead.

Remove the reference to git://, assuming the overhead
is neligible compared to the value of screen space
on the downloads page.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-11 12:40:09 +01:00
Ján Tomko
ed7affb2bf docs: downloads: remove links to libvirt.org mirrors
While the mirrors themselves are still available, the gitweb
interface on libvirt.org has been disabled.

The mirrors can still be accessible via, e.g.:

  git clone https://libvirt.org/git/libvirt-python.git

But such link gives a 404 error. Remove the links from the website
to avoid confusion.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-11 12:40:09 +01:00
Haonan Wang
35ba60be36 virsh: Provide completer for vol-wipe algorithms
Related issue: https://gitlab.com/libvirt/libvirt/-/issues/9

Signed-off-by: Haonan Wang <hnwanga1@gmail.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-11 09:10:24 +01:00
Peter Krempa
688a2c0897 docs: Convert 'testsuites' page to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 17:52:07 +01:00
Peter Krempa
0b2dec6af9 docs: Convert 'testtck' page to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 17:52:07 +01:00
Peter Krempa
1824ed94f7 docs: Convert 'pci-hotplug' page to rST
One internal reference was modified to work properly.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 17:52:07 +01:00
Peter Krempa
b4ae5dbe4a docs: Convert 'nss' page to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 17:52:07 +01:00
Peter Krempa
98ae4c3102 syntax-check: Don't check for non-reentrant functions in '.rst' files
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 17:52:07 +01:00
Peter Krempa
6c0f4c02b9 docs: Convert 'testapi' page to rST
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 17:52:07 +01:00
Peter Krempa
5042a5def6 docs: Convert 'contact' page to rST
Preserve the 'irc' and 'email' anchors.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 17:52:07 +01:00
Peter Krempa
11850158bd docs: Convert 'downloads' page to rST
The table was manually converted to a set of 'list-table'-s for better
experience of viewing the text.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 17:52:07 +01:00
Peter Krempa
49749fa832 docs: formatsnapshot: Remove empty 'seclabel' definition
The security label setting for the external images is part of the
'source' element and documented there. Remove the empty definition added
accidentally in commit ac88a8cfad

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 13:16:23 +01:00
Peter Krempa
7d78deca81 docs: formatsnapshot: Remove explicit listing of supported snapshot formats
In blockdev mode we support creating snapshots on all kinds of storage
that qemu allows us to format the image. Drop the part of the sentence
enumerating explicitly supported protocols.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 13:16:23 +01:00
Peter Krempa
025555236c docs: formatsnapshot: Move paragraphs describing 'disk' element together
There was another paragraph describing the attribute 'type' of the
'disk' element under the description of the subelements. Move it to the
top to get all relevant information in one place.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 13:16:23 +01:00
Peter Krempa
88525500ed docs: securityprocess: Don't claim that we have maint branches
The 'Branch fixing policy' paragraph claims that we have at least one
actively maintained stable branch which isn't currently the case.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 13:16:23 +01:00
Daniel P. Berrangé
a870801ae1 run: gracefully handle SIGHUP, SIGQUIT, SIGTERM
When using thue 'run' script to launch a daemon, it is intended to
temporarily stop the systemd units and re-start them again after.

When using this script over an SSH connection, it will get SIGHUP
if the connection goes away, and in this case it fails to re-start
the systemd units. We need to catch SIGHUP and turn it into a
normal python exception. For good measure we do the same for
SIGQUIT and SIGTERM too.  SIGINT already gets turned into an
exception by default which we handle.

Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-10 08:06:12 +00:00
Daniel P. Berrangé
a3a40903d9 run: include 'src' in $PATH for the daemons
Currently the 'run' script modifies $PATH to add the 'tools'
directly to pick up client programs. It fails to add the 'src'
directory to pick up the daemons.

Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-10 08:06:08 +00:00
Daniel P. Berrangé
ec8e185cd0 conf: remove misleading comments about access being 'lockless'
For the various structs storing lists of objects, the access
to the hash tables is not lockless. The mutex on the object
owning the hash table must be held.

Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-10 08:05:29 +00:00
Michal Privoznik
79c613ec8a virsh: fflush(stdout) after fputs()
We are not guaranteed that the string we are printing onto stdout
contains '\n' and thus that the stdout is flushed. In fact, I've
met this problem when virsh asked me whether I want to edit the
domain XML again (vshAskReedit()) but the prompt wasn't displayed
(as it does not contain a newline character) and virsh just sat
there waiting for my input, I sat there waiting for virsh's
output. Flush stdout after all fputs()-s  which do not flush
stdout.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-10 08:57:31 +01:00
Jonathon Jongsma
a5e659f071 qemu: support multiqueue for vdpa net device
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2024406

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
2022-03-09 16:23:02 -06:00
Martin Kletzander
3c052399ea news: Document that we build with musl
A bit of effort by me and Michal helped make this the case, and it helped us
uncover some potential issues.  I am not documenting it as supported or adding
an Alpine container into the CI, but since there were some distribution bugs
mentioning libvirt issues I thing it would be nice of us to notify those
distribution maintainers that read our release news.

Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-09 12:54:21 +01:00
Daniel P. Berrangé
2a95dbd03c nwfilter: drop support for legacy iptables conntrack direction
Long ago we adapted to Linux kernel changes which inverted the
behaviour of the conntrack --ctdir setting:

  commit a6a04ea47a
  Author: Stefan Berger <stefanb@us.ibm.com>
  Date:   Wed May 15 21:02:11 2013 -0400

    nwfilter: check for inverted ctdir

    Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the
    '--ctdir reply' and newer netfilter implementations now expect
    '--ctdir original' instead and vice-versa.
    We check for the kernel version and assume that all Linux kernels with version
    2.6.39 have the newer inverted logic.

    Any distro backporting the Linux kernel patch that inverts the --ctdir logic
    (Linux commit 96120d86f) must also backport this patch for Linux and
    adapt the kernel version being tested for.

    Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>

Given our supported platform targets, we no longer need to
consider a version of Linux before 2.6.39, so can drop
support for the old direction behaviour.

The test suite updates are triggered because that never
probed for the ctdir direction, and so the iptables syntax
generator unconditionally dropped the ctdir args.

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-09 11:37:32 +00:00
Daniel P. Berrangé
02b8045517 nwfilter: drop support for legacy iptables match syntax
Long ago we adapted to iptables changes by introducing support
for '-m conntrack':

  commit 06844ccbaa
  Author: Stefan Berger <stefanb@us.ibm.com>
  Date:   Tue Aug 6 20:30:46 2013 -0400

    nwfilter: Use -m conntrack rather than -m state

    Since iptables version 1.4.16 '-m state --state NEW' is converted to
    '-m conntrack --ctstate NEW'. Therefore, when encountering this or later
    versions of iptables use '-m conntrack --ctstate'.

Given our supported platform targets, we no longer need to
consider a version of iptables before 1.4.16, so can drop
support for the old syntax.

The test suite updates are triggered because that never
probed for the new syntax, and so unconditionally
generated the old syntax.

Reviewed-by: Laine Stump <laine@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-09 11:37:12 +00:00