Commit Graph

3095 Commits

Author SHA1 Message Date
Matthias Bolte
4acab37f56 esx: Allow 'lsisas1068' as SCSI controller type
Extend tests to cover all SCSI controller types and document the
new type.

The lsisas1068 SCSI controller type was added in ESX 4.0. The VMX
parser reports an error when this controller type is present. This
makes virsh dumpxml fail for every domain that uses this controller
type.

This patch fixes this and adds lsisas1068 to the list of accepted
SCSI controller types.

Reported by Jonathan Kelley.
2010-04-08 12:05:51 +02:00
Matthias Bolte
fba503c368 esx: Report an error for invalid arguments in esxList(Defined)Domains 2010-04-08 11:58:33 +02:00
Stefan Berger
3bf24abc8c nwfilter: Support for learning a VM's IP address
This patch implements support for learning a VM's IP address. It uses
the pcap library to listen on the VM's backend network interface (tap)
or the physical ethernet device (macvtap) and tries to capture packets
with source or destination MAC address of the VM and learn from DHCP
Offers, ARP traffic, or first-sent IPv4 packet what the IP address of
the VM's interface is. This then allows to instantiate the network
traffic filtering rules without the user having to provide the IP
parameter somewhere in the filter description or in the interface
description as a parameter. This only supports to detect the parameter
IP, which is for the assumed single IPv4 address of a VM. There is not
support for interfaces that may have multiple  IP addresses (IP
aliasing) or IPv6 that may then require more than one valid IP address
to be detected. A VM can have multiple independent interfaces that each
uses a different IP address and in that case it will be attempted to
detect each one of the address independently.

So, when for example an interface description in the domain XML has
looked like this up to now:

    <interface type='bridge'>
      <source bridge='mybridge'/>
      <model type='virtio'/>
      <filterref filter='clean-traffic'>
        <parameter name='IP' value='10.2.3.4'/>
      </filterref>
    </interface>

you may omit the IP parameter:

    <interface type='bridge'>
      <source bridge='mybridge'/>
      <model type='virtio'/>
      <filterref filter='clean-traffic'/>
    </interface>

Internally I am walking the 'tree' of a VM's referenced network filters
and determine with the given variables which variables are missing. Now,
the above IP parameter may be missing and this causes a libvirt-internal
thread to be started that uses the pcap library's API to listen to the
backend interface  (in case of macvtap to the physical interface) in an
attempt to determine the missing IP parameter. If the backend interface
disappears the thread terminates assuming the VM was brought down. In
case of a macvtap device a timeout is being used to wait for packets
from the given VM (filtering by VM's interface MAC address). If the VM's
macvtap device disappeared the thread also terminates. In all other
cases it tries to determine the IP address of the VM and will then apply
the rules late on the given interface, which would have happened
immediately if the IP parameter had been explicitly given. In case an
error happens while the firewall rules are applied, the VM's backend
interface is 'down'ed preventing it to communicate. Reasons for failure
for applying the network firewall rules may that an ebtables/iptables
command failes or OOM errors. Essentially the same failure reasons may
occur as when the firewall rules are applied immediately on VM start,
except that due to the late application of the filtering rules the VM
now is already running and cannot be hindered anymore from starting.
Bringing down the whole VM would probably be considered too drastic.
While a VM's IP address is attempted to be determined only limited
updates to network filters are allowed. In particular it is prevented
that filters are modified in such a way that they would introduce new
variables.

A caveat: The algorithm does not know which one is the appropriate IP
address of a VM. If the VM spoofs an IP address in its first ARP traffic
or IPv4 packets its filtering rules will be instantiated for this IP
address, thus 'locking' it to the found IP address. So, it's still
'safer' to explicitly provide the IP address of a VM's interface in the
filter description if it is known beforehand.

* configure.ac: detect libpcap
* libvirt.spec.in: require libpcap[-devel] if qemu is built
* src/internal.h: add the new ATTRIBUTE_PACKED define
* src/Makefile.am src/libvirt_private.syms: add the new modules and symbols
* src/nwfilter/nwfilter_learnipaddr.[ch]: new module being added
* src/nwfilter/nwfilter_driver.c src/conf/nwfilter_conf.[ch]
  src/nwfilter/nwfilter_ebiptables_driver.[ch]
  src/nwfilter/nwfilter_gentech_driver.[ch]: plu the new functionality in
* tests/nwfilterxml2xmltest: extend testing
2010-04-07 23:12:21 +02:00
Jim Meyering
7be5c26d74 xenXMDomainDefineXML: remove dead store and useless/leaky virGetDomain
* src/xen/xm_internal.c (xenXMDomainDefineXML): Remove useless and
leak-inducing call to virGetDomain, as well as decl of now-unused local.
2010-04-07 21:49:15 +02:00
Jim Meyering
2cdf29eda9 createRawFileOpHook: avoid dead stores
* src/storage/storage_backend.c (createRawFileOpHook): Remove dead
stores and declaration of each stored-to variable.
2010-04-07 21:49:07 +02:00
Jim Meyering
5874c6de5c qemudDomainGetSecurityLabel: avoid dead store to "type"
* src/qemu/qemu_driver.c (qemudDomainGetSecurityLabel): Remove store
and declaration.
2010-04-07 21:48:55 +02:00
Jiri Denemark
e26997f62b Fix CPU comparison for x86 arch
When comparing a CPU to host CPU, the result would be
VIR_CPU_COMPARE_SUPERSET (or even VIR_CPU_COMPARE_INCOMPATIBLE if strict
match was required) even though the two CPUs were identical.
2010-04-07 21:33:04 +02:00
Jiri Denemark
ce4c82f116 Cleanup x86Compute()
No change in semantics.
2010-04-07 21:32:57 +02:00
Jiri Denemark
71d5686f78 Properly advertise cpuselection guest capability
There's no sense in advertising cpuselection capability when host CPU
is not properly detected and advertised in host capabilities.
2010-04-07 21:32:46 +02:00
Jiri Denemark
f599156641 Don't ignore guest CPU selection when unsupported by HV
When qemu libvirt driver doesn't support guest CPU selection with given
qemu binary, guests requiring specific CPU should fail to start instead
of being silently supplied with a default CPU.
2010-04-07 21:32:46 +02:00
Jim Meyering
60466abbd6 qemuDomainSnapshotLoad: avoid dead store
* src/qemu/qemu_driver.c (qemuDomainSnapshotLoad): Remove dead store
into "snap", as well as its declaration.
2010-04-07 20:39:50 +02:00
Eric Blake
dd1a186f77 maint: s/initialis/initializ/
git grep found 12 of the former but 100 of the latter in src/.

* src/remote/remote_driver.c (initialise_gnutls): Rename...
(initialize_gnutls): ...to this.
(doRemoteOpen): Adjust caller.
* src/xen/xen_driver.c (xenUnifiedOpen): Adjust output string.
* src/util/network.c: Adjust comments.
Suggested by Matthias Bolte.
2010-04-07 09:48:07 -06:00
Jim Meyering
3c8877e743 domain_event.c: don't deref NULL on an OOM error path
* src/conf/domain_event.c (virDomainEventGraphicsNewFromDom):
Return NULL when handling out-of-memory error, rather than
falling through with ev=NULL and then assigning to ev->member.
(virDomainEventGraphicsNewFromObj): Likewise.
2010-04-07 16:20:28 +02:00
Stefan Berger
f8352e221f nwfiler: fix due to non-symmetric src mac address match in iptables
The attached patch fixes a problem due to the mac match in iptables only
supporting --mac-source and no --mac-destination, thus it not being
symmetric. Therefore a rule like this one

<rule action='drop' direction='out'>
  <all match='no' srcmacaddr='$MAC'/>
</rule>

should only have the MAC match on traffic leaving the VM and not test
for the same source MAC address on traffic that the VM receives.
2010-04-07 06:28:16 -04:00
Jim Meyering
d33b87268d qemu_driver.c: don't close an arbitrary file descriptor
* src/qemu/qemu_driver.c (qemudStartVMDaemon): Initialize "logfile"
to ensure that we don't use it uninitialized -- thus closing an
arbitrary file descriptor -- in the cleanup block.
2010-04-07 11:19:16 +02:00
Daniel Veillard
2a788c6439 Fix a typo in comment 2010-04-07 10:30:28 +02:00
Jamie Strandboge
1a253b38e2 Improve virt-aa-helper to handle SDL graphics and cleanups
* src/security/virt-aa-helper.c: add support for SDL devices and 3
  code cleanups
2010-04-06 23:01:23 +02:00
Jamie Strandboge
1efb623674 Adjust virt-aa-helper to handle pci devices
* src/security/virt-aa-helper.c: adjust virt-aa-helper to handle pci
  devices. Update valid_path() to have an override array to check against,
  and add "/sys/devices/pci" to it. Then rename file_iterate_cb() to
  file_iterate_hostdev_cb() and create file_iterate_pci_cb() based on it
2010-04-06 23:01:23 +02:00
Jamie Strandboge
2aca94bfd3 Add backingstore support to apparmor
adjust virt-aa-helper to handle backing store
* src/security/virt-aa-helper.c: look for backing store metadata
  for disk definitions.
2010-04-06 23:01:23 +02:00
Jamie Strandboge
a331b909c5 Add VIR_DOMAIN_XML_INACTIVE flag when parsing domain XML
To avoid an error when hitting the <seclabel...> definition
* src/security/virt-aa-helper.c: add VIR_DOMAIN_XML_INACTIVE flag
  to virDomainDefParseString
2010-04-06 23:01:23 +02:00
Jamie Strandboge
ba32e11d41 virt-aa-helper should not fail if profile was removed
Don't exit with error if the user unloaded the profile outside of
 libvirt
* src/security/virt-aa-helper.c: check the exit error from apparmor_parser
  before exiting with a failure
2010-04-06 23:01:23 +02:00
Jamie Strandboge
e68792c112 Do nor clear caps when invoking virt-aa-helper
The calls to virExec() in security_apparmor.c when
invoking virt-aa-helper use VIR_EXEC_CLEAR_CAPS. When compiled without
libcap-ng, this is not a problem (it's effectively a no-op) but with
libcap-ng this causes MAC_ADMIN to be cleared. MAC_ADMIN is needed by
virt-aa-helper to manipulate apparmor profiles and without it VMs will
not start[1]. This patch calls virExec with the default VIR_EXEC_NONE
instead.
* src/security/security_apparmor.c: fallback to VIR_EXEC_NONE flags for
  virExec of virt_aa_helper
2010-04-06 23:01:23 +02:00
Matthias Bolte
94dcf953ff Fix 'avialable' typo
Reported by Paul Jenner
2010-04-06 22:57:39 +02:00
Matthias Bolte
0d7d699795 macvtap: Remove virConnectPtr from ReportError
Also rename ReportError to macvtapError.
2010-04-06 20:00:30 +02:00
Matthias Bolte
1870e70707 phyp: Remove virConnectPtr from PHYP_ERROR 2010-04-06 19:48:51 +02:00
Jim Meyering
ed510fce9c virterror.c: avoid erroneous case "fall-through"
* src/util/virterror.c (virErrorMsg): Insert missing "break;"
2010-04-06 19:34:20 +02:00
Matthias Bolte
028db0bf5d esx: Mark error messages for translation
Also define ESX_ERROR and ESX_VI_ERROR in a central place, instead of
defining them in each source file.

Add ESX_ERROR and ESX_VI_ERROR to the msg_gen_function list in cfg.mk.

Update po/POTFILES.in accordingly.
2010-04-06 19:24:24 +02:00
Matthias Bolte
dbfa2ff572 vbox: Mark all error messages for translation
Add vboxError to the msg_gen_function list in cfg.mk.
2010-04-06 19:02:58 +02:00
Stefan Berger
552bdb9b35 nwfilter: Fix instantiated layer 2 rules for 'inout' direction
With Eric Blake's suggestions applied.

The following rule for direction 'in'

<rule direction='in' action='drop'>
  <mac srcmacaddr='1:2:3:4:5:6'/>
</rule>

drops all traffic from the given mac address.
The following rule for direction 'out'

<rule direction='out' action='drop'>
  <mac dstmacaddr='1:2:3:4:5:6'/>
</rule>

drops all traffic to the given mac address.
The following rule in direction 'inout'

<rule direction='inout' action='drop'>
  <mac srcmacaddr='1:2:3:4:5:6'/>
</rule>

now drops all traffic from and to the given MAC address.
So far it would have dropped traffic from the given MAC address
and outgoing traffic with the given source MAC address, which is not useful
since the packets will always have the VM's MAC address as source
MAC address. The attached patch fixes this.

This is the last bug I currently know of and want to fix.
2010-04-06 10:40:35 -04:00
Chris Lalancette
6f17a5d166 Fix up comments for isEncrypted, isSecure, domainIsActive,
and domainIsPersistent.

Signed-off-by: Chris Lalancette <clalance@redhat.com>
2010-04-06 09:51:24 -04:00
Chris Lalancette
fbf9fcbff4 Increase the number of available VNC ports.
When starting up qemu VNC autoport guests, we were
only looking through ports 5900 to 6000, meaning we
were limited to 100 total clients.  Increase that
limit to 65535 (the last available port), so we can
have up to 59635 VNC autoport guests.

Signed-off-by: Chris Lalancette <clalance@redhat.com>
2010-04-06 09:40:17 -04:00
Stefan Berger
f7d32ce260 This patch fixes some compilation issues for the RHEL5 build. I am also removing the IPV6 constant where it appears in the wrong place. 2010-04-06 06:29:00 -04:00
Matthias Bolte
84fa113217 Fix compiler warning about unused conn parameter
This only affects builds without NUMA support.
2010-04-06 11:47:28 +02:00
Matthias Bolte
fcd103bb2a openvz: Remove virConnectPtr from openvzError
Also remove unused enum values OPENVZ_WARN and OPENVZ_ERR.
2010-04-06 02:04:50 +02:00
Matthias Bolte
a4f9af057a one: Remove virConnectPtr from oneError 2010-04-06 02:03:36 +02:00
Matthias Bolte
a6c77af617 uml: Remove virConnectPtr from umlReportError 2010-04-06 02:03:34 +02:00
Matthias Bolte
e9125be594 Remove virConnectPtr from eventReportError 2010-04-06 02:02:24 +02:00
Matthias Bolte
5a19c24611 Remove virConnectPtr from virLibConnError 2010-04-06 02:01:51 +02:00
Matthias Bolte
b290e48cf7 xen: Remove virConnectPtr from xenUnifiedError 2010-04-06 01:56:01 +02:00
Matthias Bolte
6c175fa3d1 Remove virConnectPtr from nodeReportError 2010-04-06 01:47:51 +02:00
Matthias Bolte
8bd8bcaca8 netcf: Remove virConnectPtr from interfaceReportError 2010-04-06 01:47:02 +02:00
Matthias Bolte
7ece483dce xen: Remove virConnectPtr from virXenInotifyError 2010-04-06 01:46:42 +02:00
Matthias Bolte
67f34cd67b xen: Remove virConnectPtr from virXenStoreError 2010-04-06 01:46:02 +02:00
Matthias Bolte
68d5d96bce xen: Remove virConnectPtr from virXenError/virXenErrorFunc 2010-04-06 01:45:47 +02:00
Matthias Bolte
f2192637b0 xen: Remove virConnectPtr from virXMError 2010-04-06 01:44:51 +02:00
Matthias Bolte
5cec7af469 xen: Remove virConnectPtr from virXendError 2010-04-06 01:43:51 +02:00
Matthias Bolte
2127b42b46 proxy: Remove virConnectPtr from virProxyError 2010-04-06 01:43:23 +02:00
Matthias Bolte
a3884f8705 vbox: Remove virConnectPtr from vboxError 2010-04-06 01:41:58 +02:00
Matthias Bolte
1c91a0b44e test: Remove virConnectPtr from testError 2010-04-06 01:41:58 +02:00
Matthias Bolte
49411f029a Remove unnecessary trailing \n in log messages 2010-04-06 01:41:58 +02:00