Commit 7efe930e introduced interlock of snapshots and checkpoints,
but the check is executed prior to the snapshot API ACL check. This
means that an unauthorized user can see whether a VM exists if it has a
checkpoint.

Move the checks to proper places.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Commit 50dfabbb forgot to add this important bit on how to check that
all the changes to the XML actually worked.
Signed-off-by: NErik Skultety <eskultet@redhat.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>

A common operation in qemu_domain_address is comparing a
virPCIDeviceAddress and assigning domain, bus, slot and function
to a specific value. The former can be done with the existing
virPCIDeviceAddressEqual() helper, as long as we provide
a virPCIDeviceAddress to compare it to.

The later can be done by direct assignment of the now existing
virPCIDeviceAddress struct. The defined values of domain, bus,
slot and function will be assigned to info->addr.pci, the other
values are zeroed (which happens to be their default values too).
It's also worth noticing that all these assignments are being
conditioned by virDeviceInfoPCIAddressIsPresent() calls, thus it's
sensible to discard any non-zero values that might happen to exist
in @cont->info.addr, if we settled beforehand that @cont->info.addr
is not present or bogus.
Suggested-by: NErik Skultety <eskultet@redhat.com>
Signed-off-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: NErik Skultety <eskultet@redhat.com>

A few 'cleanup' labels gone after using VIR_AUTOFREE() on the
@addrStr variable.
Reviewed-by: NErik Skultety <eskultet@redhat.com>
Signed-off-by: NDaniel Henrique Barboza <danielhb413@gmail.com>

When the bridge re-attach handling was moved out of the network driver
and into the hypervisor driver (commit b806a60e) as a part of the
refactor to split the network driver into a separate daemon, the check
was accidentally changed to only check for type='bridge'. The check for
type in this case needs to check for type='network' as well.

(at the time we thought that the two types could be conflated for
interface actual type, but this turned out to be too problematic to
do).
Signed-off-by: NLaine Stump <laine@redhat.com>
Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com>

This fixes

    commit b7ed8ce9
    Author: Daniel P. Berrangé <berrange@redhat.com>
    Date:   Thu Jul 4 12:33:23 2019 +0100

      remote: introduce virtproxyd daemon to handle IP connectivity
Reviewed-by: NAndrea Bolognani <abologna@redhat.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>

The gnulib 'func' modules provides portability to compilers which lack
the '__func__' symbol. We only care about GCC and CLang compilers so do
not need this compatibility code.
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>

We removed use of the secure_getenv recently in

  commit 2b0d5976
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   Thu Aug 1 13:35:56 2019 +0100

    util: get rid of virGetEnv{Allow,Block}SUID functions
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>

Use the function directly rather than having a wrapper.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Call to qemuMonitorJSONHumanCommand directly from
qemuMonitorArbitraryCommand.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

It was necessary for fallback functions but last one was deleted in
d828b744.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

We don't need to escape the commands any more since we use QMP
passthrough, which means we can delete the functions.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Historically HMP commands needed to be escaped to work properly.

The backdoor for calling HMP commands via QMP must unescape them so that
arguments aren't messed up.

Since we now only support the QMP passthrough the escape->unescape dance
is pointless.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

The remaining HMP commands don't require fd passing so we can purge
filedescriptor passing support from qemuMonitorJSONHumanCommandWitFd and
rename it.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

qemuMonitorHMPCommandWithFd is only called via qemuMonitorHMPCommand
macro, so we can remove the macro and the extra unused cruft from the
function.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

The handlers for 'add-fd' and 'remove-fd' are unused now and riddled
with legacy cruft. Purge them.

Last use was removed in f2019083.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Check the disk SCSI address only when the disk actually is of
SCSI type.
Signed-off-by: NXu Yandong <xuyandong2@huawei.com>
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>

The macro VIR_DELETE_ELEMENT assume that the items being deleted
have already been cleared, so we must explicitly free domain name
from the list of domains using the shared device to prevent a
memory leak.
Signed-off-by: NXu Yandong <xuyandong2@huawei.com>
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>

When registering new callback for an event, the event loop timer
must be created and registered. The timer has domain event state
object as an opaque argument which must be ref()-ed but only if
the timer was being created and registered successfully. We must
not ref it every time the virObjectEventStateRegisterID() runs.
Signed-off-by: NXu Yandong <xuyandong2@huawei.com>
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>

In function remoteDeserializeDomainDiskErrors, there is a typo.
Signed-off-by: NXu Yandong <xuyandong2@huawei.com>
Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>
Signed-off-by: NJán Tomko <jtomko@redhat.com>

The colors are not based on the semantics of the message but rather
on the message itself. This means that the default human-perceived
semantics (red = bad, green = good) don't really apply and spotting a
color does not mean anythting.

This is amplified by the sheer amount of output which configure produces
and the fact that some of the messages have negative semantics or
additional output.

In case of any problem the user will have to go through everything
anyways as spotting a red or yellow line has 0 information value.

Here are a few examples:

1) some 'no' messages are not a problem:

  checking minix/config.h presence... no

2) some 'no' messages are actually positive:

  checking for special C compiler options needed for large files... no

3) in some cases a 'yes' would mean that something is broken or needs
   workaround

  checking whether stat file-mode macros are broken... no
  checking whether wint_t is too small... no
  checking whether stdint.h predates C++11... no
  checking whether the inttypes.h PRIxNN macros are broken... no
  checking whether clang gives bogus warnings for -Wdouble-promotion... no
  checking whether gettimeofday clobbers localtime buffer... no

4) due to string match based colors extra text makes messages yellow

  checking for a traditional french locale... none
  checking for working nanosleep... no (mishandles large arguments)
  checking for library containing gethostbyname... none required
  checking whether mbrtowc handles incomplete characters... (cached) guessing yes

5) in some cases the yes/no is very context dependant

  checking whether pthread_rwlock_rdlock prefers a writer to a reader... no
  checking whether this build is done by a static analysis tool... no

6) detected paths to binaries and libs are yellow despite being present

  checking for objdump... objdump
  checking for atomic ops implementation... gcc

As of the reasons above I don't think the colorization of the configure
output helps users or developers to debug the build process and
thus is not worth the extra code or output clutter.

This reverts commit c98174ce.
ACKed-by: NMichal Prívozník <mprivozn@redhat.com>
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>

The colorization based on the string itself makes little to no sense as
the semantic meaning of the color (red = bad, green = good) is not
extracted from the semantics of the message:

1) If there is some additional string a 'yes' is marked yellow:

configure:       driver_modules: yes (CFLAGS='' LIBS='-ldl')

2) In some cases a 'no' is actually good:

configure:                  hal: no

3) Few good/recommended configuration options are still yellow:

configure:                 QEMU: qemu:qemu

while using 'root:root' would still be yellow.

4) fields dumping config (e.g. the warning flags line) is a giant blob
  of colored text which makes little sense

configure:        Warning Flags:  -fno-common -W -Wabsolute-value
-Waddress -Waddress-of-packed-member -Waggressive-loop-optimizations
-Wall -Wattribute-warning -Wattributes -Wbad-function-cast
-Wbool-compare -Wbool-operation -Wbuiltin-declaration-mismatch
-Wbuiltin-macro-redefined -Wcannot-profile -Wcast-align
-Wcast-align=strict -Wcast-function-type -Wchar-subscripts -Wclobbered
-Wcomment -Wcomments -Wcoverage-mismatch -Wcpp -Wdangling-else
-Wdate-time -Wdeprecated-declarations -Wdesignated-init
-Wdiscarded-array-qualifiers -Wdiscarded-qualifiers -Wdiv-by-zero
-Wdouble-promotion -Wduplicated-cond -Wduplicate-decl-speci ...

In addition if the idea is to switch to a more usable build system it
does not make sense to clutter the current one with more code.

This reverts commit 4b3ab5d2.
ACKed-by: NMichal Prívozník <mprivozn@redhat.com>
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>

Use VIR_AUTO* for temporary locals and get rid of the 'cleanup' label.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Use VIR_AUTOPTR for temporary locals and get rid of the cleanup label.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Refactor functions using these two object types together with
VIR_AUTOPTR.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Clean up functions which grab and free the context to use VIR_AUTOPTR.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Use VIR_AUTO* helpers to get rid of the convoluted cleanup path.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Add automatic cleanup for variables of xmlDoc and xmlXPathContext type
to remove the cleanup section.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

The wrapper reports libvirt errors for the libxml2 function so that
the same does not have to be repeated over and over.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJiri Denemark <jdenemar@redhat.com>

Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>

Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>

With a nice side-effect of fixing alignment.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>

Refactor the command code to use the new type.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>

I opted to alias the 'virDomainType' to 'virshDomain' so that it's
obvious in all cases that this is a virsh-only construct. This is also
somewhat consistent with virsh's use of 'virshDomainFree' wrapper for
the freeing function which actually accepts NULL.
Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>

Neither virThreadInitialize or virThreadOnExit do anything since we
dropped the Win32 threads impl, in favour of win-pthreads with:

  commit 0240d94c
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Wed Jan 22 16:17:10 2014 +0000

      Remove windows thread implementation in favour of pthreads
Reviewed-by: NJán Tomko <jtomko@redhat.com>
Reviewed-by: NDaniel Henrique Barboza <danielhb413@gmail.com>
Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>

This reverts commit 0cebb642.

This capability is not used anywhere and also it is not contained
in any release so it's safe to just remove it.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>

The fact that qemu is capable -netdev socket is not enough to
start a migratable domain. It also needs dbus-vmstate capability.
Since there are already some qemu releases which have
net-socket-dgram capability and don't have dbus-vmstate we need
to check for dbus-vmstate.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>

This reverts commit 929e0bd2.

I've mistakenly pushed wrong branch.
Signed-off-by: NMichal Privoznik <mprivozn@redhat.com>