Commit Graph

29 Commits

Author SHA1 Message Date
Jim Meyering
53896e5f44 build: set STATIC_ANALYSIS when running via clang or coverity
* configure.ac (STATIC_ANALYSIS): Define when run via clang's
scan-build or coverity-prevent's cov-build.
Use the CLANG_CC and COVERITY_BUILD_COMMAND envvars as witnesses.
2010-04-14 20:10:18 +02:00
Stefan Berger
274f09cbc5 nwfilter: use virFindFileInPath for needed CLI tools
I am getting rid of determining the path to necessary CLI tools at
compile time. Instead, now the firewall driver has an initialization
function that uses virFindFileInPath() to determine the path to
necessary CLI tools and a shutdown function to free allocated memory.
The rest of the patch mostly deals with availability of the CLI tools
and to not call certain code blocks if a tool is not available and that
strings now have to be built slightly differently.
2010-04-14 06:29:55 -04:00
Daniel Veillard
bfcca58787 Release of libvirt-0.8.0
* configure.ac docs/news.html.in libvirt.spec.in src/libvirt_public.syms:
  updates for release of 0.8.0
* po/*.po po/libvirt.pot: updated a lar set of localizations, and merge
  the messages
2010-04-12 19:39:20 +02:00
Matthias Bolte
1787fdff57 Generate libvirt.def from libvirt.syms
The MinGW linker needs the libvirt.def file.
2010-04-08 20:12:09 +02:00
Daniel P. Berrange
3d3af08879 Fix Win32 portability problems
The network filter / snapshot / hooks code introduced some
non-portable pices that broke the win32 build

* configure.ac: Check for net/ethernet.h required by nwfile config
   parsing code
* src/conf/nwfilter_conf.c: Define ethernet protocol  constants
  if net/ethernet.h is missing
* src/util/hooks.c: Disable hooks build on Win32 since it lacks
  fork/exec/pipe
* src/util/threads-win32.c: Fix unchecked return value
* tools/virsh.c: Disable SIGPIPE on Win32 since it doesn't exist.
  Fix non-portable strftime() formats
2010-04-08 12:01:57 +01:00
Diego Elio Pettenò
9cea2af3fc Avoid searching for windres when not building for Windows
Just checking for a windres tool might hit even on Linux systems when
building for Linux (e.g.: when using Gentoo and having built binutils
with multitarget support), and will then fail to link properly at the
end of the build.

* configure.ac: Avoid searching for windres on non windows target
2010-04-08 11:52:46 +02:00
Stefan Berger
3bf24abc8c nwfilter: Support for learning a VM's IP address
This patch implements support for learning a VM's IP address. It uses
the pcap library to listen on the VM's backend network interface (tap)
or the physical ethernet device (macvtap) and tries to capture packets
with source or destination MAC address of the VM and learn from DHCP
Offers, ARP traffic, or first-sent IPv4 packet what the IP address of
the VM's interface is. This then allows to instantiate the network
traffic filtering rules without the user having to provide the IP
parameter somewhere in the filter description or in the interface
description as a parameter. This only supports to detect the parameter
IP, which is for the assumed single IPv4 address of a VM. There is not
support for interfaces that may have multiple  IP addresses (IP
aliasing) or IPv6 that may then require more than one valid IP address
to be detected. A VM can have multiple independent interfaces that each
uses a different IP address and in that case it will be attempted to
detect each one of the address independently.

So, when for example an interface description in the domain XML has
looked like this up to now:

    <interface type='bridge'>
      <source bridge='mybridge'/>
      <model type='virtio'/>
      <filterref filter='clean-traffic'>
        <parameter name='IP' value='10.2.3.4'/>
      </filterref>
    </interface>

you may omit the IP parameter:

    <interface type='bridge'>
      <source bridge='mybridge'/>
      <model type='virtio'/>
      <filterref filter='clean-traffic'/>
    </interface>

Internally I am walking the 'tree' of a VM's referenced network filters
and determine with the given variables which variables are missing. Now,
the above IP parameter may be missing and this causes a libvirt-internal
thread to be started that uses the pcap library's API to listen to the
backend interface  (in case of macvtap to the physical interface) in an
attempt to determine the missing IP parameter. If the backend interface
disappears the thread terminates assuming the VM was brought down. In
case of a macvtap device a timeout is being used to wait for packets
from the given VM (filtering by VM's interface MAC address). If the VM's
macvtap device disappeared the thread also terminates. In all other
cases it tries to determine the IP address of the VM and will then apply
the rules late on the given interface, which would have happened
immediately if the IP parameter had been explicitly given. In case an
error happens while the firewall rules are applied, the VM's backend
interface is 'down'ed preventing it to communicate. Reasons for failure
for applying the network firewall rules may that an ebtables/iptables
command failes or OOM errors. Essentially the same failure reasons may
occur as when the firewall rules are applied immediately on VM start,
except that due to the late application of the filtering rules the VM
now is already running and cannot be hindered anymore from starting.
Bringing down the whole VM would probably be considered too drastic.
While a VM's IP address is attempted to be determined only limited
updates to network filters are allowed. In particular it is prevented
that filters are modified in such a way that they would introduce new
variables.

A caveat: The algorithm does not know which one is the appropriate IP
address of a VM. If the VM spoofs an IP address in its first ARP traffic
or IPv4 packets its filtering rules will be instantiated for this IP
address, thus 'locking' it to the found IP address. So, it's still
'safer' to explicitly provide the IP address of a VM's interface in the
filter description if it is known beforehand.

* configure.ac: detect libpcap
* libvirt.spec.in: require libpcap[-devel] if qemu is built
* src/internal.h: add the new ATTRIBUTE_PACKED define
* src/Makefile.am src/libvirt_private.syms: add the new modules and symbols
* src/nwfilter/nwfilter_learnipaddr.[ch]: new module being added
* src/nwfilter/nwfilter_driver.c src/conf/nwfilter_conf.[ch]
  src/nwfilter/nwfilter_ebiptables_driver.[ch]
  src/nwfilter/nwfilter_gentech_driver.[ch]: plu the new functionality in
* tests/nwfilterxml2xmltest: extend testing
2010-04-07 23:12:21 +02:00
Eric Blake
a792bf240f build: more fallout from test -a
* cfg.mk (sc_prohibit_test_minus_ao): Also check for [.
* docs/Makefile.am (%.html, html/index.html): Avoid non-portable
test usage.
* libvirt.spec.in (%post): Likewise.
* tools/virt-pki-validate.in (servercert.pem): Likewise.
* configure.ac (LOGNAME): Use test, not [, in files processed by
autoconf.
Detected by Matthias Bolte.
2010-03-31 15:18:13 -06:00
Stefan Berger
bc2102104f Add ip6tables support for IPv6 filtering
This patch adds IPv6 filtering support for the following protocols:
- tcp-ipv6
- udp-ipv6
- udplite-ipv6
- esp-ipv6
- ah-ipv6
- sctp-ipv6
- all-ipv6
- icmpv6

Many of the IPv4 data structure could be re-used for IPv6 support.
Since ip6tables also supports pretty much the same command line parameters
as iptables does, also much of the code could be re-used and now
command lines are invoked with the ip(6)tables tool parameter passed
through the functions as a parameter.
2010-03-30 10:36:35 -04:00
Stefan Berger
e3a7137ac2 Add some examples filters
This patch adds some example filters to libvirt. They are automatically
installed into the proper directory for libvirt to pick them up.
2010-03-26 18:01:17 +00:00
Stefan Berger
1130085cf0 Extensions for iptables rules
This patch adds support for L3/L4 filtering using iptables. This adds
support for 'tcp', 'udp', 'icmp', 'igmp', 'sctp' etc. filtering.

As mentioned in the introduction, a .c file provided by this patch
is #include'd into a .c file. This will need work, but should be alright
for review.

Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
2010-03-26 18:01:17 +00:00
Stefan Berger
065b6571bf Core driver implementation with ebtables support
This patch implements the core driver and provides
- management functionality for managing the filter XMLs
- compiling the internal filter representation into ebtables rules
- applying ebtables rules on a network (tap,macvtap) interface
- tearing down ebtables rules that were applied on behalf of an
interface
- updating of filters while VMs are running and causing the firewalls to
be rebuilt
- other bits and pieces

Signed-off-by: Stefan Berger <stefanb@us.ibm.com>
2010-03-26 18:01:16 +00:00
Eric Blake
e07cf19fe5 build: don't use "test cond1 -o cond2": it's not portable
* configure.ac: Use "test cond1 || test cond2" instead.
* m4/compiler-flags.m4 (gl_COMPILER_FLAGS): Likewise.
* tests/test-lib.sh (verbose): Likewise.
2010-03-25 09:28:24 +01:00
Jim Meyering
7998714d60 build: don't use "test cond1 -a cond2" in configure: it's not portable
* configure.ac: Use "test cond1 && test cond2" instead.
2010-03-24 09:23:46 +01:00
Matthias Bolte
190aaa2627 Fix export of virConnectAuthPtrDefault for MinGW builds
Use the __declspec(dllexport/dllimport) stuff to export the symbol,
otherwise accessing virConnectAuthPtrDefault triggers a segfault.
2010-03-23 02:07:38 +01:00
Matthias Bolte
91da9a7689 Make sure uid_t and gid_t are available 2010-03-23 02:04:03 +01:00
Sharadha Prabhakar
eb9945d9ae xenapi: Initial commit of the new driver 2010-03-14 19:30:00 +01:00
Stefan Berger
d3b6fe5f9c macvtap build detection fix
* configure.ac: fix the header test used for macvtap availability
  detection
2010-03-09 14:14:48 +01:00
Daniel Veillard
703c165188 Release of libvirt-0.7.7
* configure.ac libvirt.spec.in: update with new version
* docs/news.html.in: add list of changes in 0.7.7
* po/*po*: updated spanish and russian localisations, rebuilt
2010-03-05 17:10:21 +01:00
Diego Elio Pettenò
c7434706a2 build: vbox: avoid build failure when linking with --no-add-needed
With the recent changes to the linking defaults in Fedora 13 (namely
enabling --no-add-needed behaviour by default), we have to pass the
dlopen()-providing libraries directly at the link of the module; use the
same AC_SEARCH_LIBS function as used before to look for it and add it to
the Makefile.
2010-03-04 17:25:22 +01:00
Diego Elio Pettenò
fd04fbaaaf build: avoid dlopen-related link failure on rawhide/F13
Instead of using AC_CHECK_LIB and hardcoding -ldl, search for the library
needed to get dlopen() and then use the cached value.
2010-03-04 17:25:22 +01:00
David Allan
b2111ba3cd Revert fs pool formatting
* We are reverting this patch pending a discussion of the right way to implement.
2010-02-26 03:33:27 -05:00
Jim Meyering
5365ff40d3 build: fix typos in makefile variable names
* configure.ac: Fix typos:
s/DRIVER_MODULES_CFLAGS/DRIVER_MODULE_CFLAGS/
s/DRIVER_MODULES_LIBS/DRIVER_MODULE_LIBS/
2010-02-25 10:48:58 +01:00
Jim Meyering
89bdf84bcd build: ensure that MKINSTALLDIRS is AC_SUBST-defined
since we're using gettext-0.14.1, which uses that now-obsolete
automake symbol.  Otherwise, make distcheck would fails like this:

    make[2]: Entering directory `/t/libvirt-0.7.6/_build/po'
    /bin/sh @MKINSTALLDIRS@ /t/libvirt-0.7.6/_inst/share
    /bin/sh: @MKINSTALLDIRS@: No such file or directory
    make[2]: *** [install-data-yes] Error 127

* configure.ac (MKINSTALLDIRS): Define.
For reference, we're currently hamstrung by our desire
to support RHEL5, which still uses gettext-0.14:
http://bugzilla.redhat.com/523713
2010-02-25 10:42:45 +01:00
Dave Allan
b738016b78 Format FS pools on creation
Create the filesystem on the partition used by the pool
* configure.ac: check for mkfs availability
* libvirt.spec.in: add extra require on util-linux for mkfs
* src/storage/storage_backend_fs.c: run mkfs with the expected
  fs type when creating a filesystem pool
2010-02-24 09:51:34 +01:00
Eric Blake
2bd559ff5d build: inform libtool of m4 directory
Silence a libtoolize warning.
*  configure.ac (AC_CONFIG_MACRO_DIR): Add.
2010-02-17 15:17:32 +01:00
Stefan Berger
fd5091db5f macvtap support for libvirt -- build support
This patch adds build support for libvirt checking for certain contents
of /usr/include/linux/if_link.h to see whether macvtap support is
compilable on that system. One can disable macvtap support in libvirt
via --without-macvtap passed to configure.
* configure.ac src/Makefile.am: new build support
* src/libvirt_macvtap.syms: list of exported symbols
* src/util/macvtap.c: empty module to not break compilation
2010-02-15 17:47:28 +01:00
Daniel Veillard
31a5ee922a Release of libvirt-0.7.6
* configure.ac docs/news.html.in libvirt.spec.in: version bump and doc
  updates
* po/*.po*: updated and regenerated the localizations
2010-02-03 18:16:25 +01:00
Eric Blake
eaa2fd6939 Start modernizing configure
* configure.ac: reanmed configura.in, use AC_CONFIG_HEADERS instead of
  AM_CONFIG_HEADER
2010-01-25 16:00:43 +01:00