Commit Graph

45091 Commits

Author SHA1 Message Date
Daniel P. Berrangé
c4fb52dc72 conf: use a hash table for storing nwfilter object list
The current use of an array for nwfilter objects requires
the caller to iterate over all elements to find a filter,
and also requires locking each filter.

Switching to a pair of hash tables enables O(1) lookups
both by name and uuid, with no locking required.

Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-17 11:39:53 +00:00
Daniel P. Berrangé
a19f1e7fc8 nwfilter: update comment about locking filter updates
The comment against the 'updateMutex' refers to a problem with
lock ordering when looking up filters in the virNWFilterObjList
which uses an array. That problem does indeed exist.

Unfortunately it claims that switching to a hash table would
solve the lock ordering problems during instantiation. That
is not correct because there is a second lock ordering
problem related to how we traverse related filters when
instantiating filters. Consider a set of filters:

  Filter A:
     Reference Filter C
     Reference Filter D

  Filter B:
     Reference Filter D
     Reference Filter C

In one example, we lock A, C, D, in the other example
we lock A, D, C.

Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-17 11:39:41 +00:00
Daniel P. Berrangé
a4947e8f63 nwfilter: fix crash when counting number of network filters
The virNWFilterObjListNumOfNWFilters method iterates over the
driver->nwfilters, accessing virNWFilterObj instances. As such
it needs to be protected against concurrent modification of
the driver->nwfilters object.

This API allows unprivileged users to connect, so users with
read-only access to libvirt can cause a denial of service
crash if they are able to race with a call of virNWFilterUndefine.
Since network filters are usually statically defined, this is
considered a low severity problem.

This is assigned CVE-2022-0897.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-03-17 11:32:07 +00:00
Martin Kletzander
92e00c7afc Add Alpine builds to CI
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
2022-03-17 11:28:40 +01:00
Boris Fiuczynski
8efdf5b083 nodedev: trigger mdev device definition update on udev add and remove
When nodedev objects are added and removed if possible check if mdev-types is
supported by the object and trigger a mdev device definition update to correct
the associated parent nodedevs.

Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Jonathon Jongsma <jjongsma@redhat.com>
2022-03-17 11:07:33 +01:00
Boris Fiuczynski
06aebe8f9a nodedev: update mdevs on parent change
The parent of the mdev definition can change due to the existance of the
parent device. The parents existance can e.g. depend on the device
driver load state.

Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Jonathon Jongsma <jjongsma@redhat.com>
2022-03-17 11:07:30 +01:00
Boris Fiuczynski
ccb3dc72b8 virnodedeviceobj: export virNodeDeviceObjHasCap
The function will be reused in the nodedev drivers udev handling.

Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Jonathon Jongsma <jjongsma@redhat.com>
2022-03-17 10:57:17 +01:00
Boris Fiuczynski
d8b9610bb0 nodedev: fix typo in mdevctl update warning
Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
Reviewed-by: Jonathon Jongsma <jjongsma@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-17 10:57:06 +01:00
Michal Privoznik
fcbb8e916b virnetdev: Use VIR_WITH_MUTEX_LOCK_GUARD in virNetDevGenerateName()
The virNetDevGenerateName() function uses a global array of
virNetDevGenName structs to find next unused name for network
device. This obviously needs some locking and in fact each member
of the array has its own lock. However, these members are not
virObjects, they are just plain structs, therefore
VIR_WITH_MUTEX_LOCK_GUARD() must be used instead of
VIR_WITH_OBJECT_LOCK_GUARD() to lock individual mutexes.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2022-03-17 09:45:38 +01:00
Kristina Hanicova
e5c10018c5 qemu: domainjob: Allow InitJob if cb is not set in qemuDomainObjInitJob()
This allows init job even if cb structure is not set. This patch
also includes slight rewriting of the function to make it look
cleaner when freeing resources, by allocating privateData at the
end.

Signed-off-by: Kristina Hanicova <khanicov@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 16:27:19 +01:00
Kristina Hanicova
965f872f92 qemu: domainjob: Allow operations if cb is not set in job structure
We should allow resetting / freeing / restoring / parsing /
formatting qemuDomainJobObj even if 'cb' attribute is not set.
This is theoretical for now, but the attribute must not be always
set in the future. It is sufficient to check if 'cb' exists
before dereferencing it.

This commit partially reverts af16e754cd.

Signed-off-by: Kristina Hanicova <khanicov@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 16:27:16 +01:00
Michal Privoznik
86dc94fbb6 qemu_cgroup: Don't deny devices from cgroupDeviceACL
On domain startup a couple of devices are allowed in the devices
controller no matter the domain configuration. The aim is to
allow devices crucial for QEMU or one of its libraries, or user
is passing through a device (e.g. through additional cmd line
arguments) and wants QEMU to access it.

However, during unplug it may happen that a device is configured
to use one of such devices and since we deny /dev nodes on
hotplug we would deny such device too. For example,
/dev/urandom belongs onto the list of implicit devices and users
can hotplug and hotunplug an RNG device with /dev/urandom as
backend.

The fix is fortunately simple - just consult the list of implicit
devices before removing the device from the namespace.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2022-03-16 13:22:17 +01:00
Michal Privoznik
a388b32ffd qemu_cgroup: Introduce and use qemuCgroupDenyDevicePath()
In all cases virCgroupDenyDevicePath() is followed by
virDomainAuditCgroupPath(). Might as well pack that into one
function and call it.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2022-03-16 13:22:17 +01:00
Michal Privoznik
f0b3ae98c2 qemu_cgroup: Introduce and use qemuCgroupAllowDevicePath()
In all cases virCgroupAllowDevicePath() is followed by
virDomainAuditCgroupPath(). Might as well pack that into one
function and call it.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2022-03-16 13:22:17 +01:00
Michal Privoznik
bc51dac713 qemu_cgroup: Drop ENOENT special case for RNG devices
When allowing or denying RNG device in CGroups there's a special
check if the backend device exists (errno == ENOENT) in which
case success is returned to caller. This is in contrast with the
rest of the functions and in fact wrong too - if the backend
device doesn't exist then QEMU will fail opening it. Might as
well signal error here.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2022-03-16 13:22:17 +01:00
Tim Wiederhake
a29db4fbed storage: Use automatic mutex management
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 10:54:42 +01:00
Tim Wiederhake
69d793a0bc storage: Removing mutex locking in initialization and cleanup
These functions are only ever called in a single threaded
environment and the mutex would not have prevented concurrent
access anyway.

Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 10:54:39 +01:00
Tim Wiederhake
3d836f828a esx_vi: Use automatic mutex management
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 10:54:36 +01:00
Tim Wiederhake
12e19f172d esx_stream: Use automatic mutex management
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 10:54:33 +01:00
Tim Wiederhake
440a8d271d admin: Use automatic mutex management
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 10:54:30 +01:00
Tim Wiederhake
df8992c277 nodesuspend: Use automatic mutex management
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 10:54:28 +01:00
Tim Wiederhake
79e6bf3c45 netdev: Use automatic mutex management
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 10:54:25 +01:00
Tim Wiederhake
72adccb10e remote_daemon_dispatch: Use automatic mutex management
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 10:54:23 +01:00
Tim Wiederhake
2bfd03cc5d openvz: Use automatic mutex management
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 10:54:20 +01:00
Tim Wiederhake
3b5b1f9209 test: Use automatic mutex management
Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2022-03-16 10:54:05 +01:00
Michal Privoznik
22188790ca qemu_namespace: Be less aggressive in removing /dev nodes from namespace
When creating /dev nodes in a QEMU domain's namespace the first
thing we simply do is unlink() the path and create it again. This
aims to solve the case when a file changed type/major/minor in
the host and thus we need to reflect this in the guest's
namespace. Fair enough, except we can be a bit more clever about
it: firstly check whether the path doesn't already exist or isn't
already of the correct type/major/minor and do the
unlink+creation only if needed.

Currently, this is implemented only for symlinks and
block/character devices. For regular files/directories (which are
less common) this might be implemented one day, but not today.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-15 17:03:07 +01:00
Michal Privoznik
9d749998b3 qemu_namespace: Don't unlink paths from cgroupDeviceACL
When building namespace for a domain there are couple of devices
that are created independent of domain config (see
qemuDomainPopulateDevices()). The idea behind is that these
devices are crucial for QEMU or one of its libraries, or user is
passing through a device and wants us to create it in the
namespace too.  That's the reason that these devices are allowed
in the devices CGroup controller as well.

However, during unplug it may happen that a device is configured
to use one of such devices and since we remove /dev nodes on
hotplug we would remove such device too. For example,
/dev/urandom belongs onto the list of implicit devices and users
can hotplug and hotunplug an RNG device with /dev/urandom as
backend.

The fix is fortunately simple - just consult the list of implicit
devices before removing the device from the namespace.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-15 17:03:03 +01:00
Michal Privoznik
4aafdf1e1f virsh: Don't open code virshEnumComplete()
Now that we have a function that generates string list for given
enum, let's use that instead of open coding it.

Note, after this there are still some 'candidates' left (e.g,
virshNetworkEventNameCompleter(), or
virshNetworkUpdateCommandCompleter()). These are not converted
because either they don't have a convenient int2str function or
they don't start from the very beginning of the enum.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2022-03-15 13:36:58 +01:00
Michal Privoznik
d2e8718f3a virsh: Introduce virshEnumComplete()
We have plenty of completers which iterate over all values of
given enum and do nothing more than translate every member into
string (using corresponding virXXXTypeToString()).

Introduce a convenience function so that callers can pass just
VIR_XXX_LAST and virXXXTypeToString and the rest is taken care
of.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2022-03-15 13:36:56 +01:00
Michal Privoznik
c21e271d36 virsh: Properly terminate string list in virshDomainInterfaceSourceModeCompleter()
A completer must return a NULL terminated list of strings, which
means that when dealing with enums, it has to allocate one
pointer more than the value of VIR_XXX_LAST. But this is not
honoured in virshDomainInterfaceSourceModeCompleter() leading to
out of bounds read.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2022-03-15 13:36:43 +01:00
Peter Krempa
2804fa912f qemuBlockJobDiskNew: Remove misleading return value description
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
da48fff4b9 qemuMigrationSrcNBDStorageCopyOne: Refactor cleanup
Autofree the temporary string and shuffle around the success path to
avoid the 'cleanup' label.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
c1e2a134c8 NEWS: Mention that VIR_MIGRATE_PARAM_TLS_DESTINATION works now for non-shared storage migration
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
e8fa09d66b qemu: migration: Use 'VIR_MIGRATE_PARAM_TLS_DESTINATION' for the NBD connection
The NBD connection for non-shared storage migration can have the same
issue regarding TLS certificate name match as the migration connection
itself.

Propagate the configured name also for the NBD connections.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1901394
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
e6d1ed4a76 conf: Add support for setting expected TLS hostname for NBD disks
In cases when the hostname of the NBD server doesn't match the hostname
in the TLS certificate the new attribute 'tlsHostname' can be used to
override it.

Add the XML infrastructure and tests.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
e11f2eb7a8 qemu: Add support for 'tlsHostname' setting of virStorageSource
Add validation and formatting of the blockdev props.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
47abbe0fd7 storage_source: Add 'tlsHostname' field to virStorageSource
The value will be used to override the hostname used for validation of
TLS certificates.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
19faa6f01a qemuMigrationSrcRun: Fix misleading comment about NBD with TLS support
We do support non-shared storage migration with TLS now. Fix the comment
claiming otherwise.

Fixes: a8dc146a4d
Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
fd6f49034d qemu: capabilities: Introduce QEMU_CAPS_BLOCKDEV_NBD_TLS_HOSTNAME
Detect that qemu can override TLS hostname setting for NBD clients.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Peter Krempa
2c47088e76 tests: qemucapabilities: Update caps_7.0.0.x86_64
Update to commit v6.2.0-2296-g9f0369efb0

Notable changes:
  - 'tls-hostname' field for NBD client to override local hostname
  - machine types 'pc-i440fx-1.7' and older are now deprecated
  - 'snapshot-access' block driver added
  - The 'protocol' field of 'set_password' and 'expire_password'
    parameter is now an enum instead of a pure string allowing 'vnc' and
    'spice' as value and the arguments are also covered by the schema.
  - 'copy-before-write' block driver now has a 'bitmap' property
  - 'query-migrate' now reports 'precopy-bytes', 'downtime-bytes',
    'postcopy-bytes' for 'ram' and 'disk' statistics
  - RTC_CHANGE event now has a 'qom-path' property to identify the RTC
  - 'umip' cpu feature is now migratable
  - SGX property 'section-size' reinstated after regression

Changes in build setting:
  - fuse block export support now enabled

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 15:17:06 +01:00
Ján Tomko
5e055f8bcd docs: downloads: fix link to libvirt GitLab group
s/libvirt.org/libvirt/

Signed-off-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 14:29:31 +01:00
Peter Krempa
825476beda qemuSnapshotCreateActiveExternal: Remove duplicit assignment
The block of code pausing the VM assigns 'resume' to true but it's
already true because of the previous condition.

The code is deliberately kept in two blocks as upcoming changes will
modify both conditions.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
238fef920f conf: snapshot: Use proper types for snapshot location
Refactor the code to use proper types for the memory and disk snapshot
location and fix the parsing code to be compatible with an unsigned
type.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
5984e5e6fd virDomainSnapshotDefParse: Decouple parsing of memory snapshot config
Separate the steps of parsing the memory snapshot config from the
post-processing and validation code. The upcoming patch refactoring the
parsing will be simpler.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
8a5a096d72 virDomainSnapshotDefParse: Avoid 'memoryfile' temporary variable
Assign directly into the definition. The cleanup code can deal with
that.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
12b85a3611 virDomainSnapshotDefParse: Refactor cleanup
Use automatic memory cleanup, decrease scope of variables and remove the
'cleanup' label.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
c250ab90ac conf: snapshot: Remove VIR_DOMAIN_SNAPSHOT_PARSE_DISKS flag
All callers except the one in the 'esx' driver pass the flag. The 'esx'
driver has a check that 'def->ndisks' is zero after parsing the
definition. This means that we can simply always parse the disks.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
fc81be4bfa qemuDomainSnapshotForEachQcow2Raw: Act only on internal snapshots
Similarly to the external snapshot code the internal inactive snapshot
creation helper should act only when an internal snapshot of the disk is
required. For now the callers ensure that it's either _INTERNAL or _NO
when control reaches this function.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:50 +01:00
Peter Krempa
fe6e11e856 Rename VIR_DOMAIN_SNAPSHOT_LOCATION_NONE to VIR_DOMAIN_SNAPSHOT_LOCATION_NO
The string value associated to the enum is "no". Rename the enum
accordingly.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:49 +01:00
Peter Krempa
f17da1c24b conf: Move definition of 'virDomainSnapshotLocation'
The snapshot location enum is also needed for the disk definition so if
we house it inside domain_conf we can use the proper type for it.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-11 13:55:49 +01:00