Commit Graph

30248 Commits

Author SHA1 Message Date
John Ferlan
40f0e0348d storage: Remove storageBackendGenerateSecretData
Since we no longer support creating qcow2 encryption format
volumes, we no longer have to possibly create some secret and
have no real need for the function, so move the remaining
functionality to build the secret path back into the caller
storageBackendCreateQemuImg.

Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-26 14:02:43 -04:00
John Ferlan
9b753116f0 storage: Clean up storageBackendCreateQemuImgOpts
Since we only generate the @encinfo when there's a secret object
and thus we need to reference it in the options,

Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-26 14:02:43 -04:00
John Ferlan
9fe597dd09 storage: Clean up storageBackendCreateQemuImgCheckEncryption
Remove the checks for qcow encryption since both callers (create
and resize) would have already disallowed usage.

Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-26 14:02:43 -04:00
John Ferlan
8f83af6823 storage: Disallow create/resize of qcow2 encrypted images
https://bugzilla.redhat.com/show_bug.cgi?id=1526382

Since commit c4eedd793 disallowed qcow2 encrypted images to be
used for domains, it no longer makes sense to allow a qcow2
encrypted volume to be created or resized.

Add a test that will exhibit the failure of creation as well
as the xml2xml validation of the format still being correct.

Update the documentation to note the removal of the capability
to create and use qcow/default encrypted volumes.

Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-26 14:02:43 -04:00
John Ferlan
a02d879858 tests: Remove qcow2 encryption from storagevol tests
We're about to disallow creation of a qcow2 encrypted storage
volume, so let's remove the qcow encryption element from the
tests which are testing whether other format='qcow2' related
features work properly.

Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-26 14:02:43 -04:00
John Ferlan
af0e6580cd storage: Rename encryption info variable for clarity
Change from @enc to @encinfo leaving @enc for the vol->target.encryption
in the storageBackendCreateQemuImgSetOptions code path.

Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-26 14:02:43 -04:00
John Ferlan
23e9aa7297 tests: Add luks creation examples to storagevolxml2argvtest
Add the storagevolxml2xmltest "luks" and "luks-cipher" tests
to the storagevolxml2argvtest.

Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-26 14:02:43 -04:00
John Ferlan
b056e09b28 storage: Don't allow encryption secretPath to be NULL
Allowing a NULL @secretPath for virStorageBackendCreateQemuImgCmdFromVol
would result in a generated command line with a dangling "file=" output.
So let's make sure the @secretPath exists before processing.

This means we should pass a dummy path from the storage test.

Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-26 14:02:43 -04:00
Cole Robinson
5b603a7870 domain_addr: Fix weird comment format
Signed-off-by: Cole Robinson <crobinso@redhat.com>
2018-06-26 13:59:50 -04:00
Daniel P. Berrangé
f14c37ce4c nwfilter: convert virt drivers to use public API for nwfilter bindings
Remove the callbacks that the nwfilter driver registers with the domain
object config layer. Instead make the current helper methods call into
the public API for creating/deleting nwfilter bindings.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 18:17:23 +01:00
Daniel P. Berrangé
2d9318b6ce nwfilter: wire up new APIs for creating and deleting nwfilter bindings
This allows the virsh commands nwfilter-binding-create and
nwfilter-binding-delete to be used.

Note using these commands lets you delete filters that were
previously created automatically by the virt drivers, or add
filters for VM nics that were not there before. Generally it
is expected these new APIs will only be used by virt drivers.
It is the admin's responsibility to not shoot themselves in
the foot.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 18:17:21 +01:00
Daniel P. Berrangé
f61ea979a4 nwfilter: wire up new APIs for listing and querying filter bindings
Wire up the ListAll, LookupByPortDev and GetXMLDesc APIs to allow the
virsh nwfilter-binding-list & nwfilter-binding-dumpxml commands to
work.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 18:17:21 +01:00
Daniel P. Berrangé
3df907bfff nwfilter: remove virt driver callback layer for rebuilding filters
Now that the nwfilter driver keeps a list of bindings that it has
created, there is no need for the complex virt driver callbacks. It is
possible to simply iterate of the list of recorded filter bindings.

This means that rebuilding filters no longer has to acquire any locks on
the virDomainObj objects, as they're never touched.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 18:17:20 +01:00
Daniel P. Berrangé
57f5621f46 nwfilter: keep track of active filter bindings
Currently the nwfilter driver does not keep any record of what filter
bindings it has active. This means that when it needs to recreate
filters, it has to rely on triggering callbacks provided by the virt
drivers. This introduces a hash table recording the virNWFilterBinding
objects so the driver has a record of all active filters.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 18:17:13 +01:00
Daniel P. Berrangé
ec7c01832c virsh: add manpage docs for nwfilter-binding commands.
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 18:16:50 +01:00
Anya Harter
c3427c4a85 qemu: Escape commas for qemuBuildSCSIiSCSIHostdevDrvStr
Add comma escaping for netsource. This is done here because
qemuBuildNetworkDriveStr has other external callers which
may not expect an escaped comma; however, this particular
command building path needs to perform the escaping for the
hostdev command line, so we do it now to ensure src->path
and src->host->name are covered.

Signed-off-by: Anya Harter <aharter@redhat.com>
2018-06-26 11:04:38 -04:00
Anya Harter
6b770f9a3b qemu: use virBuffer in qemuBuildSCSIiSCSIHostdevDrvStr
Instead of source to enable use of virBuffer functions in
string construction.

Signed-off-by: Anya Harter <aharter@redhat.com>
2018-06-26 11:04:38 -04:00
Michal Privoznik
2d5b332312 qemuDomainObjBeginJobInternal: Report agent job in error message
If a thread is unable to acquire a job (e.g. because of timeout)
an error is reported and the error message contains reference to
the other thread holding the job. Well, the error message should
report agent job too as it is yet another source of possible
failure.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2018-06-26 15:10:17 +02:00
Chen Hanxiao
9e6b432d01 set-lifecycle-action: add description of type and action
In [1], <type> are described as "on_poweroff", "on_reboot",
"on_crash". but we accept "poweroff", "reboot" and "crash".
This patch adds documentation for them.

[1]: https://libvirt.org/formatdomain.html#elementsEvents

Signed-off-by: Chen Hanxiao <chenhanxiao@gmail.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-26 14:10:17 +02:00
Daniel P. Berrangé
c21679fa3f conf: introduce a virNWFilterBindingObjListPtr struct
Introduce a new struct to act as the manager of a collection of
virNWFilterBindingObjPtr objects.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
191b4396d3 conf: introduce a virNWFilterBindingObjPtr struct
Introduce a new struct to act as the stateful owner of the
virNWFilterBindingDefPtr objects.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
c0fa7713b8 conf: report an error if nic needs filtering by no driver is present
If a <interface> includes a filter name but the nwfilter driver is not
present we silently do nothing. This is very bad, because an application
that thinks it is protected by malicious guest traffic will in fact be
vulnerable. Reporting an error gives the administrator the ability to
know there is a problem and fix it.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
fca9afa084 nwfilter: convert DHCP address snooping code to virNWFilterBindingDefPtr
Use the virNWFilterBindingDefPtr struct in the DHCP address snooping code
directly.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
5b6c02e292 nwfilter: convert IP address learning code to virNWFilterBindingDefPtr
Use the virNWFilterBindingDefPTr struct in the IP address learning code
directly.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
d1a7c08eb1 nwfilter: convert the gentech driver code to use virNWFilterBindingDefPtr
Use the virNWFilterBindingDefPtr struct in the gentech driver code
directly.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
278659fff6 virsh: add nwfilter binding commands
$ virsh nwfilter-binding-list
 Port Dev                              Filter
------------------------------------------------------------------
 vnet0                 clean-traffic
 vnet1                 clean-traffic

$ virsh nwfilter-binding-dumpxml vnet1
<filterbinding>
  <owner>
    <name>f25arm7</name>
    <uuid>12ac8b8c-4f23-4248-ae42-fdcd50c400fd</uuid>
  </owner>
  <portdev name='vnet1'/>
  <mac address='52:54:00:9d:81:b1'/>
  <filterref filter='clean-traffic'>
    <parameter name='MAC' value='52:54:00:9d:81:b1'/>
  </filterref>
</filterbinding>

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
ede0924eb4 remote: add support for nwfilter binding objects
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
099812f59d access: add nwfilter binding object permissions
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
b57a9aecaf nwfilter: export port binding concept in the public API
When the daemons are split there will need to be a way for the virt
drivers and/or network driver to create and delete bindings between
network ports and network filters. This defines a set of public APIs
that are suitable for managing this facility.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
41d619e99c schemas: add schema for nwfilter binding XML document
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
17b1ebf4ec conf: add support for parsing/formatting virNWFilterBindingDefPtr
A typical XML representation of the virNWFilterBindingDefPtr struct
looks like this:

  <filterbinding>
    <owner>
      <name>f25arm7</name>
      <uuid>12ac8b8c-4f23-4248-ae42-fdcd50c400fd</uuid>
    </owner>
    <portdev name='vnet1'/>
    <mac address='52:54:00:9d:81:b1'/>
    <filterref filter='clean-traffic'>
      <parameter name='MAC' value='52:54:00:9d:81:b1'/>
    </filterref>
  </filterbinding>

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
7c7880dd98 conf: move virNWFilterBindingDefPtr into its own files
There's no code sharing between virNWFilterDef and
virNWFilterBindingDefPtr types, so it is clearer if they live in
separate source files and headers.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
ce376228e9 conf: add missing virxml.h include for nwfilter_params.h
The nwfilter_params.h header references the xmlNodePtr type, so must
include the virxml.h header to get the libxml2 types defined.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Daniel P. Berrangé
ce1144960c conf: change virNWFilterBindingPtr to virNWFilterBindingDefPtr
We are going to want to expose the NWFilter binding concept in the
public API, so the virNWFilterBindingPtr type needs to be used there.
Our internal type will shortly gain an XML representation, so rename
it to virNWFilterBindingDefPtr which follows our normal conventions.

Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-26 11:22:07 +01:00
Andrea Bolognani
aa51063927 spec: Move SASL configuration file from -libs to -daemon
SASL authentication is configured server-side, so the sample
configuration file should be shipped along with the daemon
rather than with the libraries.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2018-06-26 10:57:54 +02:00
Andrea Bolognani
b8736ed87e news: Update for HPT maxpagesize feature
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2018-06-26 10:15:58 +02:00
Andrea Bolognani
a12e7a3944 qemu: Format HPT maxpagesize on the command line
This makes the feature fully functional.

https://bugzilla.redhat.com/show_bug.cgi?id=1571078

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2018-06-26 10:15:56 +02:00
Andrea Bolognani
0ee6f885e0 conf: Parse and format HPT maxpagesize
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2018-06-26 10:15:52 +02:00
Andrea Bolognani
15f9db5303 conf: Tweak HPT feature parsing and formatting
This doesn't seem very useful at the moment, but it will make
sense once we introduce another HPT-related setting.

The output XML is decoupled from the input XML in preparation
of future changes as well; while doing so, we can shave a few
lines off the latter.

This commit is best viewed with 'git show -w'.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2018-06-26 10:15:50 +02:00
Andrea Bolognani
c2fef631ba conf: Reintroduce virDomainDef::hpt_resizing
We're going to introduce a second HPT-related setting soon,
at which point using a single location to store everything is
no longer going to cut it.

This mostly, but not completely, reverts 3dd1eb3b26.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2018-06-26 10:15:47 +02:00
Andrea Bolognani
90e6e0fae8 qemu: Add capability for the HPT maxpagesize feature
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2018-06-26 10:15:44 +02:00
Andrea Bolognani
0a527017c4 tests: Add replies for QEMU 3.0.0 on ppc64
Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2018-06-26 10:15:36 +02:00
Julio Faracco
794b576c2b util: fix mount issue by moving NULL value to "none" in syscall.
After running libvirt daemon with valgrind tools, some errors are
appearing when you try to start a domain. One example:

==18012== Syscall param mount(type) points to unaddressable byte(s)
==18012==    at 0x6FEE3CA: mount (syscall-template.S:78)
==18012==    by 0x531344D: virFileMoveMount (virfile.c:3828)
==18012==    by 0x27FE7675: qemuDomainBuildNamespace (qemu_domain.c:11501)
==18012==    by 0x2800C44E: qemuProcessHook (qemu_process.c:2870)
==18012==    by 0x52F7E1D: virExec (vircommand.c:726)
==18012==    by 0x52F7E1D: virCommandRunAsync (vircommand.c:2477)
==18012==    by 0x52F4EDD: virCommandRun (vircommand.c:2309)
==18012==    by 0x2800A731: qemuProcessLaunch (qemu_process.c:6235)
==18012==    by 0x2800D6B4: qemuProcessStart (qemu_process.c:6569)
==18012==    by 0x28074876: qemuDomainObjStart (qemu_driver.c:7314)
==18012==    by 0x280522EB: qemuDomainCreateWithFlags (qemu_driver.c:7367)
==18012==    by 0x55484BF: virDomainCreate (libvirt-domain.c:6531)
==18012==    by 0x12CDBD: remoteDispatchDomainCreate (remote_daemon_dispatch_stubs.h:4350)
==18012==    by 0x12CDBD: remoteDispatchDomainCreateHelper (remote_daemon_dispatch_stubs.h:4326)
==18012==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

Some documentation recommends to use "none" when you don't have a
filesystem type to use. Specially, for bind and move actions.

Signed-off-by: Julio Faracco <jcfaracco@gmail.com>
2018-06-26 08:05:57 +02:00
Eric Blake
0ec6343a06 snapshots: Clarify comments on snapshot role
Give some more details on what a snapshot is good for, to make
it easier to distinguish from the role of upcoming additions for
incremental backups.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: John Ferlan <jferlan@redhat.com>
2018-06-25 20:22:28 -05:00
Han Han
f78b73e68e docs: schema: Add missing <interleave> to devices
For input,hub,redirdev devices, their sub-elements should be interleaved.

input device: interleave for <driver>, <alias>, <address>
hub device: interleave for <alias>, <address>
redirdev device: interleave for <source>, <alias>, <address>, <boot>

Signed-off-by: Han Han <hhan@redhat.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-25 20:03:34 +02:00
w00251574
a03f5cddfc qemu: Fix memory leak in qemuDomainBlockJobSetSpeed()
fix 'device' leak in qemuDomainBlockJobSetSpeed

Signed-off-by: Jie Wang <wangjie88.huawei.com>
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-25 19:46:20 +02:00
w00251574
d63f1c6ad9 qemu: monitor: Fix memory leak in qemuMonitorJSONNBDServerStart()
Exiting early through the return path did result in 'port_str'
being leaked.

Signed-off-by: Jie Wang <wangjie88.huawei.com>
2018-06-25 19:41:40 +02:00
Daniel P. Berrangé
b0c6300fc4 qemu: ensure FDs passed to QEMU for chardevs have correct SELinux labels
The UNIX socket FDs were we passing to QEMU inherited a label based on
libvirtd's context. QEMU is thus denied ability to access the UNIX
socket. We need to use the security manager to change our current
context temporarily when creating the UNIX socket FD.

Reviewed-by: Laine Stump <laine@laine.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-06-25 17:28:38 +01:00
Kashyap Chamarthy
a2913aed53 docs: formatdomain: Mention that 'urandom' is the recommended RNG backend
Since libvirt 1.3.4, any RNG source is accepted for the 'random'
backend.  However, '/dev/urandom' is the _recommended_ source of
entropy. Therefore we should mention that in the docs.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2018-06-25 12:20:39 +02:00
Michal Privoznik
a0d6894af1 qemuDomainObjBeginJobInternal: Log agent job too
If a thread is unable to start a job (e.g. because of timeout)
a warning is printed into the logs. So far, the message does not
contain agent job info. Add it as it might help future debugging.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
2018-06-25 07:28:53 +02:00