Since version 4.1 ESX(i) can expose virtual serial devices over TCP.

Add support in the VMX handling code for this, add test cases to cover
it and add links to some documentation.

ESX supports two additional protocols: TELNETS and TLS. Add them to
the list of serial-over-TCP protocols.

The <vcpu cpuset=...> attribute has been available since commit
e193b5dd, but without documentation or RNG validation.

* docs/schemas/domain.rng (vcpu): Further validate cpuset.
* docs/formatdomain.html.in: Document it.
* src/conf/domain_conf.c: Fix typos.

phypBuildLpar expects that at least one disk element is provided.

Don't cat | sed, just sed.  Suggested by Eric Blake.

Description: Implement AppArmorSetSecurityHostdevLabel() and
AppArmorRestoreSecurityHostdevLabel() for hostdev and pcidev attach.

virt-aa-helper also has to be adjusted because *FileIterate() is used for pci
and usb devices and the corresponding XML for hot attached hostdev and pcidev
is not in the XML passed to virt-aa-helper. The new '-F filename' option is
added to append a rule to the profile as opposed to the existing '-f
filename', which rewrites the libvirt-<uuid>.files file anew. This new '-F'
option will append a rule to an existing libvirt-<uuid>.files if it exists,
otherwise it acts the same as '-f'.

load_profile() and reload_profile() have been adjusted to add an 'append'
argument, which when true will use '-F' instead of '-f' when executing
virt-aa-helper.

All existing calls to load_profile() and reload_profile() have been adjusted
to use the old behavior (ie append==false) except AppArmorSetSavedStateLabel()
where it made sense to use the new behavior.

This patch also adds tests for '-F'.

Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/640993

This patch adds a test case for testing the XML parser's and instantiator's
support of the comment attribute.

I am adding a row with information about the newly supported comment
attribute to each of the tables describing supported attributes of protocols.

Extend the nwfilter.rng schema to accept comment attributes for all protocol
types.

In this patch I am extending the rule instantiator to create the comment
node where supported, which is the case for iptables and ip6tables.

Since commands are written in the format

cmd='iptables ...-m comment --comment \"\" '

certain characters ('`) in the comment need to be escaped to
prevent comments from becoming commands themselves or cause other
forms of (bash) substitutions. I have tested this with various input and in
my tests the input made it straight into the comment. A test case for TCK
will be provided separately that tests this.

The patch below extends the XML parser and generator so that every protocol
now can have a comment node. Comments are limited to 256 characters.

Partial reversion of commit 76d87a59, now that bootstrap is smarter.

* .gnulib: Update to latest, for poll and bootstrap fixes.
* bootstrap: Resync from gnulib.
* autogen.sh: Drop redundant tool checks; bootstrap does them
better, by honoring environment variables.
* examples/domain-events/events-c/Makefile.am (INCLUDES)
(event_test_LDADD): Use gnulib library during build.
* bootstrap.conf (gnulib_tool_option_extras): Revert --libtool
addition, now that updated bootstrap does it for us.
Reported by Justin Clift.

When creating a new gust, the function phypBuildLpar() was not
checking for NULL values

src/phyp/phyp_driver.c: check the definition arguments to avoid a segmentation
  fault in phypBuildLpar()

This fixes a small logic bug, where passing --without-macvtap
on the configure line, or otherwise indicating a lack of
support for macvtap, causes configure to bail.

The configure script was breaking on MacOS X unless passed:

  --without-storage-mpath

This patch leverages Stefan Bergers earlier work for nwfilter,
so non-linux systems don't even attempt to build multipath.

In this patch I am reworking the logic around detecting virtual port support and requiring the libnl dependency.

- It requires --with-macvtap and displays an error in case of --without-macvtap --with-virtualport.
- It tests for availability of certain data in include files and displays an error in case the include file is not at the correct level and --with-virtualport was chosen
- displays 'checking' messages for macvtap and virtualport support and results
- libnl support is required when macvtap is found or requested; if libnl is not there, please supply without-macvtap

Prior to this patch, the ChangeLog generation was hard coded to use
"awk", when it should have been using the AWK variable set by our
build system.

This breaks compilation on a newly installed OS X system, where the
default path has the Mac (non GNU) awk in the default search PATH
before any installed GNU awk (gawk).

This reverses commit 04c3704e, which added a define to nwfilter to
allow libvirtd compilation on Mac OS X.  Stefan Bergers commit, 2e7294df,
is the proper solution, removing the requirement for nwfilter on non-Linux.

Mac OS X provides an "/Applications" folder, not an "/Application" folder,
so installed VirtualBox wasn't being detected by default.

This 1 character patch fixes this.

Since 554d82a2, conn is unused. Let's
drop it - but keep the signature of the constructor for backward
compatibility.

Don't compile the nwfilter driver (instantiating the rules) on other systems than Linux.

The nwfilter code uses ETH_ALEN, which isn't defined on MacOS X.
This is a simple workaround, to add it when missing.

The patch below reports a warning in the log if the generated ip(6)tables rules would not be effective due to the proc filesystem entries

    /proc/sys/net/bridge/bridge-nf-call-iptables
    /proc/sys/net/bridge/bridge-nf-call-ip6tables

containing a '0'. The warning tells the user what to do. I am rate-limiting the warning message to appear only every 10 seconds.

Description: Check for VIR_DOMAIN_CHR_TYPE in serial ports and add 'rw' for
defined serial ports, parallel ports and channels

Bug-Ubuntu: LP: #578527, LP: #609055

* docs/logging.html.in: Fix spelling and grammar.

* .gnulib: Update to latest.
* bootstrap.conf (gnulib_modules): Add new termios module.
(gnulib_tool_option_extras): Make libtool usage explicit.
* src/util/util.c (includes): Gnulib now guarantees termios.h.
* bootstrap: Resync from gnulib.

Add a test for this.

Reported by Frank Dirks.

pciFindStubDriver currently returns 0 in one of the error cases.
While it's correct...NULL is more readable.
Signed-off-by: NChris Wright <chrisw@redhat.com>

libvirt-guests init script should be started as late as possible during
host startup and stopped as early as possible during host shutdown to
make sure required services are already/still up and running at the time
libvirt-guests runs.

The addrToString methods were not coping with UNIX domain sockets
which have no normal host+port address. Hardcode special handling
for these so that SASL routines can work over UNIX sockets. Also
fix up SSF logic in remote client so that it presumes that a UNIX
socket is secure

* daemon/remote.c: Fix addrToString for UNIX sockets.
* src/remote/remote_driver.c: Fix addrToString for UNIX sockets
  and fix SSF logic to work for TLS + UNIX sockets in the same
  manner

Refactor some daemon code to facilitate the introductioin of static
probes, sanitizing function exit paths in many places

* daemon/libvirtd.c: Pass the dname string into remoteCheckDN
  to let caller deal with failure paths. Add separate exit paths
  to remoteCheckCertificate for auth failure vs denial. Merge
  all exit paths in qemudDispatchServer to one cleanup block
* daemon/remote.c: Add separate exit paths to SASL & PolicyKit
  functions for auth failure vs denial

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=635857.

* src/nodeinfo.c (cpu_online): Allow missing directory for all
CPUs, not just cpu0.
Signed-off-by: NEric Blake <eblake@redhat.com>

This patch fixes a bug appearing on big endian machines where the returned XML is not the one that is expected (see test/nwfilterxml2xmltest). The problem is due to for example the casting of pointers to unsigned integers to void * and then back to 16 bit integers.

Before this patch, the testsuite was noisy:

TEST: qemuargv2xmltest
      ........................................ 40
      ................20:41:28.046: warning : qemuParseCommandLine:6565 : unknown QEMU argument '-unknown', adding to the qemu namespace
20:41:28.046: warning : qemuParseCommandLine:6565 : unknown QEMU argument 'parameter', adding to the qemu namespace
.                        57  OK
PASS: qemuargv2xmltest

It's not a real failure (which is why the test was completing
successfully), so much as an intentional warning to the user that use
of the qemu namespace has the potential for undefined effects that
leaked through the default logging behavior.  After this patch series,
all tests can access any logged data, and this particular test can
explicitly check for the presence or absence of the warning, such that
the test output becomes:

TEST: qemuargv2xmltest
      ........................................ 40
      .................                        57  OK
PASS: qemuargv2xmltest

* tests/testutils.h (virtTestLogContentAndReset): New prototype.
* tests/testutils.c (struct virtTestLogData): New struct.
(virtTestLogOutput, virtTestLogClose, virtTestLogContentAndReset):
New functions.
(virtTestMain): Always capture log data emitted during tests.
* tests/qemuargv2xmltest.c (testCompareXMLToArgvHelper, mymain):
Use flag to mark which tests expect noisy stderr.
(testCompareXMLToArgvFiles): Add parameter to test whether stderr
was appropriately silent.

Since commit 107a7bd0, the extraFlags argument was unused.

* tests/qemuargv2xmltest.c (DO_TEST): Drop extraFlags argument.
Adjust all callers.

Tweaked the PolicyKit documentation improvement patch submitted
by Patrick Dignan.

Additionally, removed the reference to PolicyKit.conf, which is
no longer used by PolicyKit, plus added a link to the expanded
PolicyKit example page on the wiki.

Got sick of seeing the "validity error : ID Objects already defined"
errors, which this patch addresses.

* src/util/network.c (getIPv6Addr): Manually join s6_addr bytes,
instead of assuming s6_addr16 shorts.
Reported by Justin Clifton; solution suggested by Bruno Haible.

This is the simple fix Daniel Veillard suggested last year:

  http://www.redhat.com/archives/libvir-list/2009-May/msg00459.html