Ensure that the socket credentials we got back on BSD are valid before
using them.

When a client disconnects from libvirtd, all event callbacks
must be removed. This involves running the public API

  virConnectDomainEventDeregisterAny

This code does not run in normal API dispatch context, so no
identity was set. The result was that the access control drivers
denied the attempt to deregister callbacks. The callbacks thus
continued to trigger after the client was free'd causing fairly
predictable use of free memory & a crash.

This can be triggered by any client with readonly access when
the ACL drivers are active.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

It's possible to create a domain which will only use a TLS port
and will not have a non-TLS port set by using:
<graphics type='spice' autoport='yes' defaultMode='secure'/>
In such a setup, the 'graphics' node for the running domain will be:
<graphics type='spice' tlsPort='5900'
          autoport='yes' listen='127.0.0.1'
          defaultMode='secure'>

However, cmdDomDisplay loops over all the 'graphics' node, and it
ignores nodes which don't have a 'port' attribute. This means
'virsh domdisplay' will only return an empty string for domains
as the one above.

This commit looks for both 'port' and 'tlsPort' before deciding
to ignore a graphics node. It also makes sure 'port' is not printed
when it's not set.
This makes 'virsh domdisplay' return
'spice://127.0.0.1?tls-port=5900' for domains using only a TLS
port.
Signed-off-by: NChristophe Fergeau <cfergeau@redhat.com>

https://bugzilla.redhat.com/show_bug.cgi?id=1011330 (case A)

While activeScsiHostdevs and webSocketPorts were allocated in
qemuStateInitialize, they were not freed in qemuStateCleanup.
Signed-off-by: NJiri Denemark <jdenemar@redhat.com>

https://bugzilla.redhat.com/show_bug.cgi?id=1011330 (case D)

qemuProcessStart created two references to virQEMUDriverConfigPtr before
calling fork():

    cfg = virQEMUDriverGetConfig(driver);
    ...
    hookData.cfg = virObjectRef(cfg);

However, the child only unreferenced hookData.cfg and the parent only
removed the cfg reference. That said, we don't need to increment the
reference counter when assigning cfg to hookData. Both the child and the
parent will correctly remove the reference on cfg (the child will do
that through hookData).
Signed-off-by: NJiri Denemark <jdenemar@redhat.com>

Similar to commit 8f34f195.

* tests/Makefile.am (virnetserverclienttest_CFLAGS): Add XDR_CFLAGS.
Signed-off-by: NEric Blake <eblake@redhat.com>

Removed superfluous/wrong srcdir prefix.
Signed-off-by: NViktor Mihajlovski <mihajlov@linux.vnet.ibm.com>

https://bugzilla.redhat.com/show_bug.cgi?id=1012818

Commit 6d7d0b18 (in 1.1.2) added bounds
checking to virDomainGetJobStats. But even at that time the API was able
to return 20 parameters while the limit was set to 16.
Signed-off-by: NJiri Denemark <jdenemar@redhat.com>

s/becuase/because/
Signed-off-by: NChen Hanxiao <chenhanxiao@cn.fujitsu.com>

* src/lxc/lxc_controller.c (virLXCControllerSetupDisk): Fix typo.
* src/lxc/lxc_driver.c (lxcDomainAttachDeviceDiskLive): Likewise.
Signed-off-by: NEric Blake <eblake@redhat.com>

Caused by commit 012c25e8 splitting out a convenience library.

  CC       libvirtd_conf_la-libvirtd-config.lo
In file included from ../src/rpc/virnetmessage.h:24:0,
                 from ../src/rpc/virnetserverprogram.h:27,
                 from ../src/rpc/virnetserver.h:32,
                 from libvirtd-config.c:31:
../src/rpc/virnetprotocol.h:9:21: fatal error: rpc/rpc.h: No such file
or directory

* daemon/Makefile.am (libvirtd_conf_la_CFLAGS): Add XDR_CFLAGS.
Signed-off-by: NEric Blake <eblake@redhat.com>

Free dst before lxcDomainAttachDeviceDiskLive returns
Signed-off-by: NChen Hanxiao <chenhanxiao@cn.fujitsu.com>

The return value of virDomainControllerFind >=0 means that
the specific controller was found.
But some functions invoke it and treat 0 as not found.
This patch fix these incorrect invocation.
Signed-off-by: NChen Hanxiao <chenhanxiao@cn.fujitsu.com>

so "make check" can work for the distributed tarballs too.

Tweak some conditions and use correct typecasts in enums.

Since commit 297c99a5 an invalid source definition XML of a character
device that is used as backend for RNG devices, smartcards and redirdevs
causes crash of the daemon when parsing such a definition.

The device types mentioned above are not a part of a regular character
device but are backends for other types. Thus when parsing such device
NULL is passed as the argument @chr_def. Later when checking the
validity of the definition @chr_def was dereferenced when parsing a UNIX
socket backend with missing path of the socket and crashed the daemon.

Sample offending configuration:
  <devices>
  ...
    <rng model='virtio'>
      <backend model='egd' type='unix'>
        <source mode='bind' service='1024'/>
      </backend>
    </rng>
  </devices>

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1012196

- Move COPYING* to libvirt-client, so every package pulls them in
- Move AUTHORS ChangeLog.gz NEWS README TODO from -daemon to -docs
- Drop duplicate distribution of docs in -python

https://bugzilla.redhat.com/show_bug.cgi?id=977099

When passing in custom driver XML, allow a block like

<domain xmlns:test='http://libvirt.org/schemas/domain/test/1.0'>
  ...
  <test:runstate>5</test:runstate>
</domain>

This is only read at initial driver start time, and sets the initial
run state of the object. This is handy for UI testing.

It's only wired up for domains, since that's the only conf/
infrastructure that supports namespaces at the moment.

If an error occurs in virnetmessagetest it was possible it
would free uninitialized data.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virnetmessagetest code did not check for failure to
allocate the message object. This lead to a crash on OOM
in the test suite.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virportallocatortest did not check if the object
allocation failed in all cases. This lead to a crash
on OOM in the testsuite
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virlockspacetest.c did not check for failure to create
a lockspace, causing a crash on OOM
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virbuftest code did not check virBufferError before
accessing the buffer contents, resulting in a crash on
OOM conditions.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virDomainChrSourceDef variable should be memset to
0, so that the cleanup block does not free uninitialized
data on OOM.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The qemuMonitorCommonTestInit method did not allocate the
test object, so it should not free it upon failure. Doing
so causes a double free with the caller.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Don't leak the path string in qemuMonitorCommonTestNew if
an OOM occurs.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

For inexplicable reasons, the nwfilter XML parser is intentionally
ignoring errors that arise during parsing. As well as meaning that
users don't get any feedback on their XML mistakes, this will lead
it to silently drop data in OOM conditions.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Normally a lockspace resource is not freed while there are
active owners. During initial resource creation though, an
OOM error will trigger this scenario. virLockSpaceResourceFree
was not freeing the 'owners' field in this case.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If OOM or another error occurs in virJSONValueFromString the
parser state object will be leaked.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If OOM occurs in virJSONParserHandleStartMap it will free
a variable that is owned by another object. This leads to
a later double-free.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If virDBusMessageIterEncode hits an OOM condition it often
leaks the memory associated with the dbus iterator object
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The vmx2xmltest test would print all errors to stderr, which
is not helpful when running OOM tests, and differs from the
behaviour of other tests.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The code parsing comments in config files called virConfAddEntry
but did not check for failure. This caused the comment string to
leak on OOM.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virVMXFormatConfig called virVMXEscapeHexPipe but
forgot to check for OOM. This caused data to silently
be lost.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virStoragePoolDefParseSource method would set def->nhosts
before allocating def->hosts. If the allocation failed due to
OOM, the cleanup code would crash accessing out of bounds.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

If xenParseSxprPCI failed to expand the def->hostdevs array
due to OOM, it would free the hostdev instance twice.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The testCompareXMLToXMLHelper method clobbered the 'ret' variable
in several places leading to a failure to report OOM errors from
the test suite.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The virDomainSnapshotDefParse method assigned to def->ndisks
before allocating def->disks. Thus if an OOM occurred, the
cleanup code would access out of bounds.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

Several places in virInterfaceDefParseProtoIPv6 clobber the
default 'ret' return value. So when jumping to cleanup on
error, 'ret' may mistakenly be set to 0 instead of -1. This
caused failure to report OOM errors, meaning data was silently
lost during parsing.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>

The methods for obtaining the Xen dom ID cannot distinguish
between returning -1 due to an error and returning -1 due to
the domain being shutoff. Change them to return the dom ID
via an output parameter.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>