Commit Graph

11719 Commits

Author SHA1 Message Date
Daniel P. Berrange
76d9f65644 Introduce two new methods for triggering controlled shutdown/reboot
The virDomainShutdownFlags and virDomainReboot APIs allow the caller
to request the operation is implemented via either acpi button press
or a guest agent. For containers, a couple of other methods make
sense, a message to /dev/initctl, and direct kill(SIGTERM|HUP) of
the container init process.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-30 19:19:38 +00:00
Daniel P. Berrange
dff4a753c4 Move reboot/shutdown flags combination check into QEMU driver
The fact that only the guest agent, or ACPI flag can be used
when requesting reboot/shutdown is merely a limitation of the
QEMU driver impl at this time. Thus it should not be in
libvirt.c code

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-30 19:18:27 +00:00
Daniel P. Berrange
c4ef575c97 Add APIs for talking to init via /dev/initctl
To be able todo controlled shutdown/reboot of containers an
API to talk to init via /dev/initctl is required. Fortunately
this is quite straightforward to implement, and is supported
by both sysvinit and systemd. Upstart support for /dev/initctl
is unclear.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-30 19:17:30 +00:00
Daniel P. Berrange
a21f51121d Ensure virDomainShutdownFlags logs flags parameter
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-30 19:16:48 +00:00
Daniel P. Berrange
07da0a6b54 Quote client identity in SASL whitelist log message
When seeing a message

 virNetSASLContextCheckIdentity:146 : SASL client admin not allowed in whitelist

it isn't immediately obvious that 'admin' is the identity
being checked. Quote the string to make it more obvious
2012-11-30 19:16:05 +00:00
Viktor Mihajlovski
3c465728bf qemu: Fix up the default machine type for QMP probing
The default machine type must be stored in the first element of
the caps->machineTypes array. This was done for help output
parsing but not for QMP probing.

Added a helper function qemuSetDefaultMachine to apply the same
fix up for both probing methods.

Further, it was necessary to set caps->nmachineTypes after QMP
probing.

Signed-off-by: Viktor Mihajlovski <mihajlov@linux.vnet.ibm.com>
2012-11-30 11:56:57 -07:00
Guido Günther
d01e427e01 Fix uninitialized variables
detecet by

	http://honk.sigxcpu.org:8001/job/libvirt-build/348/console
2012-11-30 19:12:06 +01:00
Eric Blake
3d7f6649e8 qemu: don't attempt undefined QMP commands
https://bugzilla.redhat.com/show_bug.cgi?id=872292

Libvirt should not attempt to call a QMP command that has not been
documented in qemu.git - if future qemu introduces a command by the
same name but with subtly different semantics, then libvirt will be
broken when trying to use that command.

We also had some code that could never be reached - some of our
commands have an alternate for new vs. old qemu HMP commands; but
if we are new enough to support QMP, we only need a fallback to
the new HMP counterpart, and don't need to try for a QMP counterpart
for the old HMP version.

See also this attempt to convert the three snapshot commands to QMP:
https://lists.gnu.org/archive/html/qemu-devel/2012-07/msg01597.html
although it looks like that will still not happen before qemu 1.3.
That thread eventually decided that qemu would use the name
'save-vm' rather than 'savevm', which mitigates the fact that
libvirt's attempt to use a QMP 'savevm' would be broken, but we
might not be as lucky on the other commands.

* src/qemu/qemu_monitor_json.c (qemuMonitorJSONSetCPU)
(qemuMonitorJSONAddDrive, qemuMonitorJSONDriveDel)
(qemuMonitorJSONCreateSnapshot, qemuMonitorJSONLoadSnapshot)
(qemuMonitorJSONDeleteSnapshot): Use only HMP fallback for now.
(qemuMonitorJSONAddHostNetwork, qemuMonitorJSONRemoveHostNetwork)
(qemuMonitorJSONAttachDrive, qemuMonitorJSONGetGuestDriveAddress):
Delete; QMP implies QEMU_CAPS_DEVICE, which prefers AddNetdev,
RemoveNetdev, and AddDrive anyways (qemu_hotplug.c has all callers).
* src/qemu/qemu_monitor.c (qemuMonitorAddHostNetwork)
(qemuMonitorRemoveHostNetwork, qemuMonitorAttachDrive): Reflect
deleted commands.
* src/qemu/qemu_monitor_json.h (qemuMonitorJSONAddHostNetwork)
(qemuMonitorJSONRemoveHostNetwork, qemuMonitorJSONAttachDrive):
Likewise.
2012-11-30 09:51:09 -07:00
Eric Blake
ddd103d342 storage: fix scsi detach regression with cgroup ACLs
https://bugzilla.redhat.com/show_bug.cgi?id=876828

Commit 38c4a9cc introduced a regression in hot unplugging of disks
from qemu, where cgroup device ACLs were no longer being revoked
(thankfully not a security hole: cgroup ACLs only prevent open()
of the disk; so reverting the ACL prevents future abuse but doesn't
stop abuse from an fd that was already opened before the ACL change).

Commit 1b2ebf95 overlooked that there were two spots affected.

* src/qemu/qemu_hotplug.c (qemuDomainDetachDiskDevice):
Transfer backing chain before deletion.
* src/qemu/qemu_driver.c (qemuDomainDetachDeviceDiskLive): Fix
spacing (partly to ensure a different-looking patch).
2012-11-30 08:26:34 -07:00
Ján Tomko
4f9af0857c nwfilter: report an error on OOM
Also removed some unreachable code found by coverity:
libvirt-0.10.2/src/nwfilter/nwfilter_driver.c:259: unreachable: This
code cannot be reached: "nwfilterDriverUnlock(driver...".
2012-11-30 15:35:14 +01:00
Ján Tomko
e9d74a7a82 virsh: check the return value of virStoragePoolGetAutostart
On error, virStoragePoolGetAutostart would return -1 leaving autostart
untouched.

Removed the misleading debug message as well.

Error: CHECKED_RETURN (CWE-252):
libvirt-0.10.2/tools/virsh-pool.c:1386: unchecked_value: No check of the
    return value of "virStoragePoolGetAutostart(pool, &autostart)".
2012-11-30 15:35:14 +01:00
Peter Krempa
6c5c4b8d4d qemu: Refactor error reporting in qemu driver configuration parser
This patch adds two labels and gets rid of a ton of duplicated code.
This patch also fixes some error message and switches most of them to
proper error reporting functions.
2012-11-29 22:23:16 +01:00
Peter Krempa
7aba113ca7 qemu: Refactor config parameter retrieval
This patch adds macros to help retrieve configuration values from qemu
driver's configuration. Some configuration options are grouped
together in the process.
2012-11-29 21:54:16 +01:00
Laine Stump
753ff83a50 network: use dnsmasq --bind-dynamic when available
This bug resolves CVE-2012-3411, which is described in the following
bugzilla report:

  https://bugzilla.redhat.com/show_bug.cgi?id=833033

The following report is specifically for libvirt on Fedora:

  https://bugzilla.redhat.com/show_bug.cgi?id=874702

In short, a dnsmasq instance run with the intention of listening for
DHCP/DNS requests only on a libvirt virtual network (which is
constructed using a Linux host bridge) would also answer queries sent
from outside the virtualization host.

This patch takes advantage of a new dnsmasq option "--bind-dynamic",
which will cause the listening socket to be setup such that it will
only receive those requests that actually come in via the bridge
interface. In order for this behavior to actually occur, not only must
"--bind-interfaces" be replaced with "--bind-dynamic", but also all
"--listen-address" options must be replaced with a single
"--interface" option. Fully:

   --bind-interfaces --except-interface lo --listen-address x.x.x.x ...

(with --listen-address possibly repeated) is replaced with:

   --bind-dynamic --interface virbrX

Of course libvirt can't use this new option if the host's dnsmasq
doesn't have it, but we still want libvirt to function (because the
great majority of libvirt installations, which only have mode='nat'
networks using RFC1918 private address ranges (e.g. 192.168.122.0/24),
are immune to this vulnerability from anywhere beyond the local subnet
of the host), so we use the new dnsmasqCaps API to check if dnsmasq
supports the new option and, if not, we use the "old" option style
instead. In order to assure that this permissiveness doesn't lead to a
vulnerable system, we do check for non-private addresses in this case,
and refuse to start the network if both a) we are using the old-style
options, and b) the network has a publicly routable IP
address. Hopefully this will provide the proper balance of not being
disruptive to those not practically affected, and making sure that
those who *are* affected get their dnsmasq upgraded.

(--bind-dynamic was added to dnsmasq in upstream commit
54dd393f3938fc0c19088fbd319b95e37d81a2b0, which was included in
dnsmasq-2.63)
2012-11-29 15:02:39 -05:00
Laine Stump
bf402e77b6 util: new virSocketAddrIsPrivate function
This new function returns true if the given address is in the range of
any "private" or "local" networks as defined in RFC1918 (IPv4) or
RFC3484/RFC4193 (IPv6), otherwise they return false.

These ranges are:

   192.168.0.0/16
   172.16.0.0/16
   10.0.0.0/24
   FC00::/7
   FEC0::/10
2012-11-29 15:02:39 -05:00
Laine Stump
719c2c7665 util: capabilities detection for dnsmasq
In order to optionally take advantage of new features in dnsmasq when
the host's version of dnsmasq supports them, but still be able to run
on hosts that don't support the new features, we need to be able to
detect the version of dnsmasq running on the host, and possibly
determine from the help output what options are in this dnsmasq.

This patch implements a greatly simplified version of the capabilities
code we already have for qemu. A dnsmasqCaps device can be created and
populated either from running a program on disk, reading a file with
the concatenated output of "dnsmasq --version; dnsmasq --help", or
examining a buffer in memory that contains the concatenated output of
those two commands. Simple functions to retrieve capabilities flags,
the version number, and the path of the binary are also included.

bridge_driver.c creates a single dnsmasqCaps object at driver startup,
and disposes of it at driver shutdown. Any time it must be used, the
dnsmasqCapsRefresh method is called - it checks the mtime of the
binary, and re-runs the checks if the binary has changed.

networkxml2argvtest.c creates 2 "artificial" dnsmasqCaps objects at
startup - one "restricted" (doesn't support --bind-dynamic) and one
"full" (does support --bind-dynamic). Some of the test cases use one
and some the other, to make sure both code pathes are tested.
2012-11-29 15:02:39 -05:00
Ján Tomko
892582f9de conf: fix uninitialized variable in virDomainListSnapshots
If allocation of names fails, list is uninitialized.
2012-11-29 10:10:08 -07:00
Ján Tomko
6e1fc35546 rpc: don't destroy xdr before creating it in virNetMessageEncodeHeader
On OOM, xdr_destroy got called even though it wasn't created yet.

Found by coverity:
Error: UNINIT (CWE-457):
    libvirt-0.10.2/src/rpc/virnetmessage.c:214: var_decl: Declaring
    variable "xdr" without initializer.
    libvirt-0.10.2/src/rpc/virnetmessage.c:219: cond_true: Condition
    "virReallocN(&msg->buffer, 1UL /* sizeof (*msg->buffer) */,
    msg->bufferLength) < 0", taking true branch
    libvirt-0.10.2/src/rpc/virnetmessage.c:221: goto: Jumping to label
    "cleanup"
    libvirt-0.10.2/src/rpc/virnetmessage.c:257: label: Reached label
    "cleanup"
    libvirt-0.10.2/src/rpc/virnetmessage.c:258: uninit_use: Using
    uninitialized value "xdr.x_ops".
2012-11-29 10:10:08 -07:00
Ján Tomko
8b235d4057 virsh: do timing even for unusable connections
Time values were uninitialized if the connection wasn't usable.
2012-11-29 10:10:08 -07:00
Ján Tomko
dc04b2a737 virsh: use correct sizeof when allocating cpumap
Found by coverity:
Error: SIZEOF_MISMATCH (CWE-569):
    libvirt-0.10.2/tools/virsh-domain.c:4754: suspicious_sizeof: Passing
    argument "8UL /* sizeof (cpumap) */" to function
    "_vshCalloc(vshControl *, size_t, size_t, char const *, int)" and
    then casting the return value to "unsigned char *" is suspicious.

Error: SIZEOF_MISMATCH (CWE-569):
    libvirt-0.10.2/tools/virsh-domain.c:4942: suspicious_sizeof: Passing
    argument "8UL /* sizeof (cpumap) */" to function
    "_vshCalloc(vshControl *, size_t, size_t, char const *, int)" and
    then casting the return value to "unsigned char *" is suspicious.
2012-11-29 10:10:08 -07:00
Ján Tomko
7730257db3 util: fix virBitmap allocation in virProcessInfoGetAffinity
Found by coverity:
Error: REVERSE_INULL (CWE-476):
    libvirt-0.10.2/src/util/processinfo.c:141: deref_ptr: Directly
    dereferencing pointer "map".
    libvirt-0.10.2/src/util/processinfo.c:142: check_after_deref:
    Null-checking "map" suggests that it may be null, but it has already
    been dereferenced on all paths leading to the check.
2012-11-29 10:10:08 -07:00
Ján Tomko
d5e8842538 conf: fix NULL check in virNetDevBandwidthParse
Found by coverity:
Error: REVERSE_INULL (CWE-476):
    libvirt-0.10.2/src/conf/netdev_bandwidth_conf.c:99: deref_ptr:
    Directly dereferencing pointer "node".
    libvirt-0.10.2/src/conf/netdev_bandwidth_conf.c:107:
    check_after_deref: Null-checking "node" suggests that it may be
    null, but it has already been dereferenced on all paths leading to
    the check.
2012-11-29 10:10:08 -07:00
Daniel P. Berrange
f4ea67f5b3 Turn some dual-state int parameters into booleans
The virStateInitialize method and several cgroups methods were
using an 'int privileged' parameter or similar for dual-state
values. These are better represented with the bool type.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-29 16:14:43 +00:00
Daniel P. Berrange
d442ee23bd Introduce a 'stop' method to virDriverState
To allow actions to be performed in libvirtd when the host
shuts down, or user session exits, introduce a 'stop'
method to virDriverState. This will do things like saving
the VM state to a file.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-29 16:14:36 +00:00
Daniel P. Berrange
992ed55fea Implement virDomainSendProcessSignal for LXC driver
Implement the new API for sending signals to processes in a guest
for the LXC driver. Only support sending signals to the init
process for now, because

 - The kernel does not appear to expose the mapping between
   container PID numbers and host PID numbers anywhere in the
   host OS namespace
 - There is no race-free way to validate whether a host PID
   corresponds to a process in a container.

* src/lxc/lxc_driver.c: Allow sending processes signals

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-29 15:50:12 +00:00
Daniel P. Berrange
d9a52520c7 Add a 'send-process-signal' command to virsh
* tools/virsh.c: Add send-process-signal
* tools/virsh.pod: Document new command

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-29 15:50:12 +00:00
Daniel P. Berrange
c51babd90e Specify remote protocol for virDomainSendProcessSignal
* src/remote/remote_protocol.x: message definition
* src/remote/remote_driver.c: Register driver function
* src/remote_protocol-structs: Test case

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-29 15:50:12 +00:00
Daniel P. Berrange
46c329bcc5 Add virDomainSendProcessSignal API
Add an API for sending signals to arbitrary processes in the
guest OS. This is primarily useful for container based virt,
but can be used for machine virt too, if there is a suitable
guest agent,

* include/libvirt/libvirt.h.in: Add virDomainSendProcessSignal
  and virDomainProcessSignal enum
* src/driver.h: Driver entry point
* src/libvirt.c, src/libvirt_public.syms: Impl for new API

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-29 15:50:12 +00:00
Jiri Denemark
c0ee3d3b54 qemu: Remove full stop from error messages 2012-11-29 14:16:48 +01:00
Guido Günther
d521119c09 Don't fail hard when we can't connect to the monitor
As of 1a50ba2cb0 we fail to connect to the
monitor instead of getting an exit status != 0 from qemu itself.  This
breaks capabilities probing for the non QMP case.
2012-11-29 13:54:44 +01:00
Michal Privoznik
5049b53689 libvirt.c: Fix wording and grammar in virDomainFSTrim
The documentation to this API has some defects from
grammar and wording POV. These were raised after I've
pushed the patches, so they are in a separate commit.
2012-11-29 09:30:58 +01:00
Osier Yang
33f49f211a node_memory: Fix bug of node_memory_tune
The 3 options accept 0, and merely checking for non-zero values
would cause wrong results.
2012-11-29 15:36:41 +08:00
Osier Yang
ebdbe25a97 node_memory: Do not fail if there is parameter unsupported
It makes no sense to fail the whole getting command if there is
a parameter unsupported by the kernel. This patch fixes it by
omitting the unsupported parameter for getMemoryParameters.

And for setMemoryParameters, this checks if there is an unsupported
parameter up front of the setting, and just returns failure if not
all parameters are supported.
2012-11-29 15:36:23 +08:00
Daniel P. Berrange
b7aba48bca Rename misc QEMU structs/enums to use normal naming style
Replace the following names

 * struct qemu_snap_remove  with virQEMUSnapRemovePtr
 * struct qemu_snap_reparent with virQEMUSnapReparentPtr
 * struct qemu_save_header with virQEMUSaveHeaderPtr
 * enum qemu_save_formats with virQEMUSaveFormat

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-11-28 18:17:31 +00:00
Daniel P. Berrange
4738c2a7e7 Replace 'struct qemud_driver *' with virQEMUDriverPtr
Remove the obsolete 'qemud' naming prefix and underscore
based type name. Introduce virQEMUDriverPtr as the replacement,
in common with LXC driver naming style
2012-11-28 18:17:25 +00:00
Laine Stump
012d69dff1 network: fix crash when portgroup has no name
This resolves: https://bugzilla.redhat.com/show_bug.cgi?id=879473

The name attribute is required for portgroup elements (yes, the RNG
specifies that), and there is code in libvirt that assumes it is
non-null.  Unfortunately, the portgroup parsing function wasn't
checking for lack of portgroup. One adverse result of this was that
attempts to update a network by adding a portgroup with no name would
cause libvirtd to segfault. For example:

   virsh net-update default add portgroup "<portgroup default='yes'/>"

This patch causes virNetworkPortGroupParseXML to fail if no name is
specified, thus avoiding any later problems.
2012-11-28 11:59:30 -05:00
Michal Privoznik
4ded3fb1c2 maint: Fix use of invalid reboot flags
Throughout the code, we've always used VIR_DOMAIN_SHUTDOWN* flags
even for virDomainReboot() API and its implementation. Fortunately,
the appropriate macros has the same value. But if we want to keep
things consistent, we should be using the correct macros. This
patch doesn't break anything, luckily.
2012-11-28 17:45:30 +01:00
Hu Tao
39ad0001ca build: more fix to avoid C99 for loop
see commit 7e5aa78d0f

* src/interface/interface_backend_udev.c: Declare variable sooner.
2012-11-28 09:34:51 -07:00
Eric Blake
89cf363061 nwfilter: drop dead code
Commit cb022152 went overboard and introduced a dead conditional
while trying to get rid of a potential NULL dereference.

* src/nwfilter/nwfilter_dhcpsnoop.c (virNWFilterSnoopReqNew):
Remove redundant conditional.
2012-11-28 09:21:33 -07:00
Ján Tomko
7794e02c56 util: check for NULL parameter in virFileWrapperFdCatchError
This reverts 8927c0e qemu: fix a crash when save file can't be opened
and allows virFileWrapperFdCatchError to be called with NULL instead.
2012-11-29 00:00:39 +08:00
Ján Tomko
0361917619 conf: snapshot: check return value of virDomainSnapshotObjListNum
If it's negative, this might result in a request to allocate lots of
memory.
2012-11-29 00:00:39 +08:00
Ján Tomko
34e5791332 conf: check the return value of virXPathNodeSet
In a few places, the return value could get passed to VIR_ALLOC_N without
being checked, resulting in a request to allocate a lot of memory if the
return value was negative.
2012-11-29 00:00:39 +08:00
Ján Tomko
924a6c7f6a virsh: fix error messages in iface-bridge
The error messages did not correspond to the attributes they printed.
2012-11-29 00:00:39 +08:00
Ján Tomko
7475ee0f75 libssh2_session: support DSS keys as well
Missing break in the switch.
2012-11-29 00:00:39 +08:00
Ján Tomko
28a6fd9396 cgroup: fix impossible overrun in virCgroupAddTaskController
The size of the controllers array is VIR_CGROUP_CONTROLLER_LAST, however
we only call it with values less than VIR_CGROUP_CONTROLLER_LAST.
2012-11-29 00:00:39 +08:00
Ján Tomko
cb02215252 nwfilter: fix NULL pointer check in virNWFilterSnoopReqNew
This can't lead to a crash since virNWFilterSnoopReqNew is only called
with a static array as the argument, but if we check for NULL we should
do it right.
2012-11-29 00:00:39 +08:00
Peter Krempa
d3337028f5 qemu: Fix error messages when dispatching guest agent commands
Error messages produced while dispatching guest agent commands didn't
have an apparent reference to the fact that they are dealing with guest
agent commands. This patch fixes up some of the messages to contain that
reference.
2012-11-28 16:36:34 +01:00
Peter Krempa
86727836c2 qemu: Drop word "either" from comments for agent monitor functions 2012-11-28 16:36:34 +01:00
Martin Kletzander
1d4f41fdbe virsh: Rewrite cmdDomDisplay
Just a little rewrite of the cmdDomDisplay function to make it
consistent and hopefully more readable.  This also fixes a problem
with password not being displayed for vnc even with the
"--include-password" option.
2012-11-28 16:22:10 +01:00
Michal Privoznik
47c724e54f virsh: Expose new virDomainFSTrim API
It's exposed under domfstrim command. Although the API
doesn't support specifying mount point yet, expose it
anyway.
2012-11-28 16:15:01 +01:00