1. 01 7月, 2016 2 次提交
  2. 03 12月, 2014 1 次提交
    • J
      Replace virNetworkFree with virObjectUnref · 121c09a9
      John Ferlan 提交于
      Since virNetworkFree will call virObjectUnref anyway, let's just use that
      directly so as to avoid the possibility that we inadvertently clear out
      a pending error message when using the public API.
      121c09a9
  3. 25 3月, 2014 1 次提交
  4. 18 3月, 2014 1 次提交
  5. 13 2月, 2014 1 次提交
    • E
      event: prepare client to track domain callbackID · caaf6ba1
      Eric Blake 提交于
      We want to convert over to server-side events, even for older
      APIs.  To do that, the client side of the remote driver wants
      to distinguish between legacy virConnectDomainEventRegister and
      normal virConnectDomainEventRegisterAny, while knowing the
      client callbackID and the server's serverID for both types of
      registration.  The client also needs to probe whether the
      server supports server-side filtering.  However, for ease of
      review, we don't actually use the new RPCs until a later patch.
      
      * src/conf/object_event_private.h (virObjectEventStateCallbackID):
      Add parameter.
      * src/conf/object_event.c (virObjectEventCallbackListAddID)
      (virObjectEventStateRegisterID): Separate legacy from callbackID.
      (virObjectEventStateCallbackID): Pass through parameter.
      (virObjectEventCallbackLookup): Let legacy and global domain
      lifecycle events share a common remoteID.
      * src/conf/network_event.c (virNetworkEventStateRegisterID):
      Update caller.
      * src/conf/domain_event.c (virDomainEventStateRegister)
      (virDomainEventStateRegisterID, virDomainEventStateDeregister):
      Likewise.
      (virDomainEventStateRegisterClient)
      (virDomainEventStateCallbackID): Implement new functions.
      * src/conf/domain_event.h (virDomainEventStateRegisterClient)
      (virDomainEventStateCallbackID): New prototypes.
      * src/remote/remote_driver.c (private_data): Add field.
      (doRemoteOpen): Probe server feature.
      (remoteConnectDomainEventRegister)
      (remoteConnectDomainEventRegisterAny): Use new function.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      caaf6ba1
  6. 05 2月, 2014 1 次提交
    • E
      event: move event filtering to daemon (regression fix) · 11f20e43
      Eric Blake 提交于
      https://bugzilla.redhat.com/show_bug.cgi?id=1058839
      
      Commit f9f56340 for CVE-2014-0028 almost had the right idea - we
      need to check the ACL rules to filter which events to send.  But
      it overlooked one thing: the event dispatch queue is running in
      the main loop thread, and therefore does not normally have a
      current virIdentityPtr.  But filter checks can be based on current
      identity, so when libvirtd.conf contains access_drivers=["polkit"],
      we ended up rejecting access for EVERY event due to failure to
      look up the current identity, even if it should have been allowed.
      
      Furthermore, even for events that are triggered by API calls, it
      is important to remember that the point of events is that they can
      be copied across multiple connections, which may have separate
      identities and permissions.  So even if events were dispatched
      from a context where we have an identity, we must change to the
      correct identity of the connection that will be receiving the
      event, rather than basing a decision on the context that triggered
      the event, when deciding whether to filter an event to a
      particular connection.
      
      If there were an easy way to get from virConnectPtr to the
      appropriate virIdentityPtr, then object_event.c could adjust the
      identity prior to checking whether to dispatch an event.  But
      setting up that back-reference is a bit invasive.  Instead, it
      is easier to delay the filtering check until lower down the
      stack, at the point where we have direct access to the RPC
      client object that owns an identity.  As such, this patch ends
      up reverting a large portion of the framework of commit f9f56340.
      We also have to teach 'make check' to special-case the fact that
      the event registration filtering is done at the point of dispatch,
      rather than the point of registration.  Note that even though we
      don't actually use virConnectDomainEventRegisterCheckACL (because
      the RegisterAny variant is sufficient), we still generate the
      function for the purposes of documenting that the filtering
      takes place.
      
      Also note that I did not entirely delete the notion of a filter
      from object_event.c; I still plan on using that for my upcoming
      patch series for qemu monitor events in libvirt-qemu.so.  In
      other words, while this patch changes ACL filtering to live in
      remote.c and therefore we have no current client of the filtering
      in object_event.c, the notion of filtering in object_event.c is
      still useful down the road.
      
      * src/check-aclrules.pl: Exempt event registration from having to
      pass checkACL filter down call stack.
      * daemon/remote.c (remoteRelayDomainEventCheckACL)
      (remoteRelayNetworkEventCheckACL): New functions.
      (remoteRelay*Event*): Use new functions.
      * src/conf/domain_event.h (virDomainEventStateRegister)
      (virDomainEventStateRegisterID): Drop unused parameter.
      * src/conf/network_event.h (virNetworkEventStateRegisterID):
      Likewise.
      * src/conf/domain_event.c (virDomainEventFilter): Delete unused
      function.
      * src/conf/network_event.c (virNetworkEventFilter): Likewise.
      * src/libxl/libxl_driver.c: Adjust caller.
      * src/lxc/lxc_driver.c: Likewise.
      * src/network/bridge_driver.c: Likewise.
      * src/qemu/qemu_driver.c: Likewise.
      * src/remote/remote_driver.c: Likewise.
      * src/test/test_driver.c: Likewise.
      * src/uml/uml_driver.c: Likewise.
      * src/vbox/vbox_tmpl.c: Likewise.
      * src/xen/xen_driver.c: Likewise.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      11f20e43
  7. 16 1月, 2014 3 次提交
    • E
      event: filter global events by domain:getattr ACL [CVE-2014-0028] · f9f56340
      Eric Blake 提交于
      Ever since ACL filtering was added in commit 76397360 (v1.1.1), a
      user could still use event registration to obtain access to a
      domain that they could not normally access via virDomainLookup*
      or virConnectListAllDomains and friends.  We already have the
      framework in the RPC generator for creating the filter, and
      previous cleanup patches got us to the point that we can now
      wire the filter through the entire object event stack.
      
      Furthermore, whether or not domain:getattr is honored, use of
      global events is a form of obtaining a list of networks, which
      is covered by connect:search_domains added in a93cd08f (v1.1.0).
      Ideally, we'd have a way to enforce connect:search_domains when
      doing global registrations while omitting that check on a
      per-domain registration.  But this patch just unconditionally
      requires connect:search_domains, even when no list could be
      obtained, based on the following observations:
      1. Administrators are unlikely to grant domain:getattr for one
      or all domains while still denying connect:search_domains - a
      user that is able to manage domains will want to be able to
      manage them efficiently, but efficient management includes being
      able to list the domains they can access.  The idea of denying
      connect:search_domains while still granting access to individual
      domains is therefore not adding any real security, but just
      serves as a layer of obscurity to annoy the end user.
      2. In the current implementation, domain events are filtered
      on the client; the server has no idea if a domain filter was
      requested, and must therefore assume that all domain event
      requests are global.  Even if we fix the RPC protocol to
      allow for server-side filtering for newer client/server combos,
      making the connect:serach_domains ACL check conditional on
      whether the domain argument was NULL won't benefit older clients.
      Therefore, we choose to document that connect:search_domains
      is a pre-requisite to any domain event management.
      
      Network events need the same treatment, with the obvious
      change of using connect:search_networks and network:getattr.
      
      * src/access/viraccessperm.h
      (VIR_ACCESS_PERM_CONNECT_SEARCH_DOMAINS)
      (VIR_ACCESS_PERM_CONNECT_SEARCH_NETWORKS): Document additional
      effect of the permission.
      * src/conf/domain_event.h (virDomainEventStateRegister)
      (virDomainEventStateRegisterID): Add new parameter.
      * src/conf/network_event.h (virNetworkEventStateRegisterID):
      Likewise.
      * src/conf/object_event_private.h (virObjectEventStateRegisterID):
      Likewise.
      * src/conf/object_event.c (_virObjectEventCallback): Track a filter.
      (virObjectEventDispatchMatchCallback): Use filter.
      (virObjectEventCallbackListAddID): Register filter.
      * src/conf/domain_event.c (virDomainEventFilter): New function.
      (virDomainEventStateRegister, virDomainEventStateRegisterID):
      Adjust callers.
      * src/conf/network_event.c (virNetworkEventFilter): New function.
      (virNetworkEventStateRegisterID): Adjust caller.
      * src/remote/remote_protocol.x
      (REMOTE_PROC_CONNECT_DOMAIN_EVENT_REGISTER)
      (REMOTE_PROC_CONNECT_DOMAIN_EVENT_REGISTER_ANY)
      (REMOTE_PROC_CONNECT_NETWORK_EVENT_REGISTER_ANY): Generate a
      filter, and require connect:search_domains instead of weaker
      connect:read.
      * src/test/test_driver.c (testConnectDomainEventRegister)
      (testConnectDomainEventRegisterAny)
      (testConnectNetworkEventRegisterAny): Update callers.
      * src/remote/remote_driver.c (remoteConnectDomainEventRegister)
      (remoteConnectDomainEventRegisterAny): Likewise.
      * src/xen/xen_driver.c (xenUnifiedConnectDomainEventRegister)
      (xenUnifiedConnectDomainEventRegisterAny): Likewise.
      * src/vbox/vbox_tmpl.c (vboxDomainGetXMLDesc): Likewise.
      * src/libxl/libxl_driver.c (libxlConnectDomainEventRegister)
      (libxlConnectDomainEventRegisterAny): Likewise.
      * src/qemu/qemu_driver.c (qemuConnectDomainEventRegister)
      (qemuConnectDomainEventRegisterAny): Likewise.
      * src/uml/uml_driver.c (umlConnectDomainEventRegister)
      (umlConnectDomainEventRegisterAny): Likewise.
      * src/network/bridge_driver.c
      (networkConnectNetworkEventRegisterAny): Likewise.
      * src/lxc/lxc_driver.c (lxcConnectDomainEventRegister)
      (lxcConnectDomainEventRegisterAny): Likewise.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      f9f56340
    • E
      event: wire up RPC for server-side network event filtering · 8d9d098b
      Eric Blake 提交于
      We haven't had a release with network events yet, so we are free
      to fix the RPC so that it actually does what we want.  Doing
      client-side filtering of per-network events is inefficient if a
      connection is only interested in events on a single network out
      of hundreds available on the server.  But to do server-side
      per-network filtering, the server needs to know which network
      to filter on - so we need to pass an optional network over on
      registration.  Furthermore, it is possible to have a client with
      both a global and per-network filter; in the existing code, the
      server sends only one event and the client replicates to both
      callbacks.  But with server-side filtering, the server will send
      the event twice, so we need a way for the client to know which
      callbackID is sending an event, to ensure that the client can
      filter out events from a registration that does not match the
      callbackID from the server.  Likewise, the existing style of
      deregistering by eventID alone is fine; but in the new style,
      we have to remember which callbackID to delete.
      
      This patch fixes the RPC wire definition to contain all the
      needed pieces of information, and hooks into the server and
      client side improvements of the previous patches, in order to
      switch over to full server-side filtering of network events.
      Also, since we fixed this in time, all released versions of
      libvirtd that support network events also support per-network
      filtering, so we can hard-code that assumption into
      network_event.c.
      
      Converting domain events to server-side filtering will require
      the introduction of new RPC numbers, as well as a server
      feature bit that the client can use to tell whether to use
      old-style (server only supports global events) or new-style
      (server supports filtered events), so that is deferred to a
      later set of patches.
      
      * src/conf/network_event.c (virNetworkEventStateRegisterClient):
      Assume server-side filtering.
      * src/remote/remote_protocol.x
      (remote_connect_network_event_register_any_args): Add network
      argument.
      (remote_connect_network_event_register_any_ret): Return callbackID
      instead of count.
      (remote_connect_network_event_deregister_any_args): Pass
      callbackID instead of eventID.
      (remote_connect_network_event_deregister_any_ret): Drop unused
      type.
      (remote_network_event_lifecycle_msg): Add callbackID.
      * daemon/remote.c
      (remoteDispatchConnectNetworkEventDeregisterAny): Drop unused arg,
      and deal with callbackID from client.
      (remoteRelayNetworkEventLifecycle): Pass callbackID.
      (remoteDispatchConnectNetworkEventRegisterAny): Likewise, and
      recognize non-NULL network.
      * src/remote/remote_driver.c
      (remoteConnectNetworkEventRegisterAny): Pass network, and track
      server side id.
      (remoteConnectNetworkEventDeregisterAny): Deregister by callback id.
      (remoteNetworkBuildEventLifecycle): Pass remote id to event queue.
      * src/remote_protocol-structs: Regenerate.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      8d9d098b
    • E
      event: add notion of remoteID for filtering client network events · a59097e5
      Eric Blake 提交于
      In order to mirror a server with per-object filtering, the client
      needs to track which server callbackID is servicing the client
      callback.  This patch introduces the notion of a serverID, as
      well as the plumbing to use it for network events, although the
      actual complexity of using per-object filtering in the remote
      driver is deferred to a later patch.
      
      * src/conf/object_event.h (virObjectEventStateEventID): Add parameter.
      (virObjectEventStateQueueRemote, virObjectEventStateSetRemote):
      New prototypes.
      (virObjectEventStateRegisterID): Move...
      * src/conf/object_event_private.h: ...here, and add parameter.
      (_virObjectEvent): Add field.
      * src/conf/network_event.h (virNetworkEventStateRegisterClient): New
      prototype.
      * src/conf/object_event.c (_virObjectEventCallback): Add field.
      (virObjectEventStateSetRemote): New function.
      (virObjectEventStateQueue): Make wrapper around...
      (virObjectEventStateQueueRemote): New function.
      (virObjectEventCallbackListCount): Tweak return count when remote
      id matching is used.
      (virObjectEventCallbackLookup, virObjectEventStateRegisterID):
      Tweak registration when remote id matching will be used.
      (virObjectEventNew): Default to no remote id.
      (virObjectEventCallbackListAddID): Likewise, but set remote id
      when one is available.
      (virObjectEventCallbackListRemoveID)
      (virObjectEventCallbackListMarkDeleteID): Adjust return value when
      remote id was set.
      (virObjectEventStateEventID): Query existing id.
      (virObjectEventDispatchMatchCallback): Require matching event id.
      (virObjectEventStateCallbackID): Adjust caller.
      * src/conf/network_event.c (virNetworkEventStateRegisterClient): New
      function.
      (virNetworkEventStateRegisterID): Update caller.
      * src/conf/domain_event.c (virDomainEventStateRegister)
      (virDomainEventStateRegisterID): Update callers.
      * src/remote/remote_driver.c
      (remoteConnectNetworkEventRegisterAny)
      (remoteConnectNetworkEventDeregisterAny)
      (remoteConnectDomainEventDeregisterAny): Likewise.
      (remoteEventQueue): Hoist earlier to avoid forward declaration,
      and add parameter.  Adjust all callers.
      * src/libvirt_private.syms (conf/object_event.h): Drop function.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      a59097e5
  8. 08 1月, 2014 2 次提交
    • E
      event: make network events easier to use without casts · 36dd0bd8
      Eric Blake 提交于
      While comparing network and domain events, I noticed that the
      test driver had to do a cast in one place and not the other.
      For consistency, we should hide the necessary casting as low
      as possible in the stack, with everything else using saner
      types.
      
      * src/conf/network_event.h (virNetworkEventStateRegisterID): Alter
      type.
      * src/conf/network_event.c (virNetworkEventStateRegisterID): Hoist
      cast here.
      * src/test/test_driver.c (testConnectNetworkEventRegisterAny):
      Simplify callers.
      * src/remote/remote_driver.c
      (remoteConnectNetworkEventRegisterAny): Likewise.
      * src/network/bridge_driver.c
      (networkConnectNetworkEventRegisterAny): Likewise.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      36dd0bd8
    • E
      event: don't turn offline domain into global event · e9568360
      Eric Blake 提交于
      If a user registers for a domain event filtered to a particular
      domain, but the persistent domain is offline at the time, then
      the code silently failed to set up the filter.  As a result,
      the event fires for all domains, rather than being filtered.
      Network events were immune, since they always passed an id
      0 argument.
      
      The key to this patch is realizing that
      virObjectEventDispatchMatchCallback() only cared about uuid;
      so refusing to create a meta for a negative id is pointless,
      and in fact, malloc'ing meta at all was overkill; instead,
      just directly store a uuid and a flag of whether to filter.
      
      Note that virObjectEventPtr still needs all fields of meta,
      because this is how we reconstruct a virDomainPtr inside the
      dispatch handler before calling the end user's callback
      pointer with the correct object, even though only the uuid
      portion of meta is used in deciding whether a callback
      matches the given event.  So while uuid is optional for
      callbacks, it is mandatory for events.
      
      The change to testDomainCreateXMLMixed is merely on the setup
      scenario (as you can't register for a domain unless it is either
      running or persistent).  I actually first wrote that test for
      this patch, then rebased it to also cover a prior patch (commit
      4221d64f), but had to adjust it for that patch to use Create
      instead of Define for setting up the domain long enough to
      register the event in order to work around this bug.  But while
      the setup is changed, the main body of the test is still about
      whether creation events fire as expected.
      
      * src/conf/object_event_private.h (_virObjectEventCallback):
      Replace meta with uuid and flag.
      (virObjectEventCallbackListAddID): Update signature.
      * src/conf/object_event.h (virObjectEventStateRegisterID):
      Likewise.
      * src/conf/object_event_private.h (virObjectEventNew): Document
      use of name and uuid in events.
      * src/conf/object_event.c (virObjectEventCallbackListAddID): Drop
      arguments that don't affect filtering.
      (virObjectEventCallbackListRemoveID)
      (virObjectEventDispatchMatchCallback)
      (virObjectEventStateRegisterID): Update clients.
      * src/conf/domain_event.c (virDomainEventCallbackListAdd)
      (virDomainEventStateRegisterID): Likewise.
      * src/conf/network_event.c (virNetworkEventStateRegisterID):
      Likewise.
      * tests/objecteventtest.c (testDomainCreateXMLMixed): Enhance test.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      e9568360
  9. 04 1月, 2014 1 次提交
    • E
      event: fix doc typos, and doc more public methods · 6742fb0b
      Eric Blake 提交于
      While working on events, I found a number of minor issues; I'm
      hoisting these to the front rather than doing it piecemeal in
      the patches where I first noticed bad or missing documentation.
      
      * src/conf/object_event.c: Fix grammar, document all parameters
      of public functions, wrap some long lines.
      * src/conf/object_event.h: Likewise.
      * src/conf/network_event.c: Likewise.
      * src/conf/domain_event.c: Likewise (except for the large number
      of event creation functions).
      * src/libvirt_private.cyms (conf/object_event.h): Split...
      (conf/network_event.h): ...to account for new file.
      Signed-off-by: NEric Blake <eblake@redhat.com>
      6742fb0b
  10. 14 12月, 2013 4 次提交
  11. 11 12月, 2013 1 次提交
    • C
      Added Network events API and virNetworkEventLifecycle. · 9ff38c54
      Cédric Bosdonnat 提交于
      Define the public API for (de-)registering network events
      and the callbacks for receiving lifecycle events. The lifecycle
      event includes a 'detail' parameter to match the domain lifecycle
      event data, but this is currently unused.
      
      The network events related code goes into its own set of internal
      files src/conf/network_event.[ch]
      9ff38c54