* src/libvirt.c (virConnectGetLibVersion): Don't emit error on
success.

* src/esx/esx_vi_types.h: Filter through cppi.

* cfg.mk (msg_gen_function): Add xenapiSessionErrorHandler.
* po/POTFILES.in: Add src/xenapi/xenapi_driver.c
* src/xenapi/xenapi_driver.c: Mark strings for translation.
* src/xenapi/xenapi_utils.c (xenapiUtil_ParseQuery):

Check that interface names only contain valid characters. Blank them out
otherwise.
Valid characters in this code are currently a-z,A-Z,0-9, '-' and '_'.

The Python script generates the mappings based on the type descriptions
in the esx_vi_generator.input file.

This also improves the inheritance handling and allows to get rid of the
ugly, inflexible, and error prone _base/_super approach. Now every struct
that represents a SOAP type contains a _type member, that allows to
recreate C++-like dynamic dispatch for "method" calls in C.

* src/Makefile.am: adds a few missing header files in the associated
  file variables, it's needed otherwise the missing headers breaks
  compilation from a distribution tarball

more readable. Add some missing entries: ipv6 and icmpv6.

This patch changes the network filtering code to use libvirt's existing
IPv4 and IPv6 address parsers/printers rather than my self-written ones.

I am introducing a new function in network.c that counts the number of
bits in a netmask and ensures that the given address is indeed a netmask,
return -1 on error or values of 0-32 for IPv4 addresses and 0-128 for
IPv6 addresses. I then based the function checking for valid netmask
on invoking this function.

This patch adds IPv6 filtering support for the following protocols:
- tcp-ipv6
- udp-ipv6
- udplite-ipv6
- esp-ipv6
- ah-ipv6
- sctp-ipv6
- all-ipv6
- icmpv6

Many of the IPv4 data structure could be re-used for IPv6 support.
Since ip6tables also supports pretty much the same command line parameters
as iptables does, also much of the code could be re-used and now
command lines are invoked with the ip(6)tables tool parameter passed
through the functions as a parameter.

This patch removes the driver dependency from nwfilter_conf.c and moves
a callback function calling into the driver into
nwfilter_gentech_driver.c and passes a pointer to that callback function
upon initialization of nwfilter_conf.c.

This patch adds filtering support for the so-far missing protocols 'ah',
'esp' and 'udplite'.

Since the timers are defined to cover all possible config cases for
several different hypervisors, many of these possibilities generate an
error on qemu. Here is what is currently supported:

RTC: If the -rtc commandline option is available, allow setting
"clock=host"
     or "clock=vm" based on the rtc timer clock='host|guest' value. Also
     add "driftfix=slew" if the tickpolicy is 'catchup', or add nothing
if
     tickpolicy is 'delay'. (Other tickpolicies will raise an error).

     If -rtc isn't available, but -rtc-td-hack is, add that option
     if the tickpolicy is 'catchup', add -rtc-td-hack, if it is 'delay'
     add nothing, and if it's anything else, raise an error.

PIT: If -no-kvm-pit-reinjection is available, and tickpolicy is
     'delay', add that option. if tickpolicy is 'catchup', do
     nothing. Anything else --> raise an error.

     If -no-kvm-pit-reinjection *isn't* available, but -tdf is, when
     tickpolicy is 'catchup' add -tdf. If it's 'delay', do
     nothing. Anything else --> raise an error.

     If neither of those commandline options is available, and
     tickpolicy is anything other than 'delay' (or unspecified), raise
     an error.

HPET: If -no-hpet flag is available and present='no', add -no-hpet.
      If -no-hpet is not available, and present='yes', raise an error.
      If present is unspecified, the default is to do whatever this
      particular qemu does by default, so don't raise an error.

All other timer types are unsupported by QEMU, so they will raise an
error.

* src/qemu/qemu_conf.c: extend qemuBuildClockArgStr() to generate the
  command line arguments for the new options

* src/qemu/qemu_conf.h: define 4 new flags
* src/qemu/qemu_conf.c: check the help text of qemu for presence of
                        features indicated by each flag.
* tests/qemuhelptest.c: add appropriate flags into the masks for each test

This extension is described in

http://www.redhat.com/archives/libvir-list/2010-March/msg00304.html

Currently all attributes are optional, except name.

* src/conf/domain_conf.h: add data definition for virDomainTimerDef
  and add a list of them to virDomainClockDef
* src/conf/domain_conf.c: XML parser and formatter for a timer inside a clock
* src/libvirt_private.syms: add new Timer enum helper functions to symbols

The QEMU cpu affinity is used in NUMA scenarios to ensure that
guest memory is allocated from a specific node. Normally memory
is allocate on demand in vCPU threads, but when using hugepages
the initial thread leader allocates memory upfront. libvirt was
not setting affinity of the thread leader, or I/O threads. This
patch changes the code to set the process affinity in between
the fork()/exec() of QEMU. This ensures that every single QEMU
thread gets the affinity

* src/qemu/qemu_driver.c: Set affinity on entire QEMU process
  at startup

This patch adds a dummy nwfilter driver to the test driver so that the
int-overflow test passes without modifications.

This patch fixes the 'make check' runs for me which, under certain
circumstances and login configurations, did invoke popups requesting
authentication. I removed the parameter conn from being passed into the
error reporting function.

* src/conf/nwfilter_conf.h src/conf/nwfilter_conf.c: remove conn from
  error reporting parameters.

Right now this implements only 2 basic hooks:
- before the lxc control process is being launched
- after the lxc control process is terminated
the XML description of the domain is passed to the hook script stdin
/etc/libvirt/hook/lxc

* src/lxc/lxc_driver.c: implement synchronous script hooks for LXC
  at domain startup and end

Right now this implements only 2 basic hooks:
- before the qemu process is being launched
- after the qemu process is terminated
the XML description of the domain is passed to the hook script stdin
/etc/libvirt/hook/qemu

* src/qemu/qemu_driver.c: implement synchronous script hooks for QEmu
  at domain startup and end

This exports 3 basic routines:
  - virHookInitialize() initializing the hook support by looking for
    scripts availability
  - virHookPresent() used to test if there is a hook for a given driver
  - virHookCall() which actually calls a synchronous script hook with
    the needed parameters
Note that this doesn't expose any public API except for the locations
and arguments passed to the scripts

* src/Makefile.am: add the 2 new files
* src/util/hooks.h src/util/hooks.c: implements the 3 functions
* src/libvirt_private.syms: export the 3 symbols internally
* po/POTFILES.in: add src/util/hooks.c to translatables modules

* include/libvirt/virterror.h: add VIR_FROM_HOOK and VIR_ERR_HOOK_SCRIPT_FAILED
* src/util/virterror.c: associated strings

used to read the data from virExec stdout/err file descriptors

* src/util/util.c src/util/util.h: not static anymore and export it
* src/libvirt_private.syms: allow access internally

This flag is used in migration prepare step to send updated XML
definition of a guest.

Also ``virsh dumpxml --update-cpu [--inactive] guest'' command can be
used to see the updated CPU requirements.

Useful mainly for migration. cpuUpdate changes guest CPU requirements in
the following way:

- match == "strict" || match == "exact"
    - optional features which are supported by host CPU are changed into
      required features
    - optional features which are not supported by host CPU are disabled
    - all other features remain untouched
- match == "minimum"
    - match is changed into "exact"
    - optional features and all features not mentioned in guest CPU
      specification which are supported by host CPU become required
      features
    - other optional features are disabled
    - all other features remain untouched

This ensures that no feature will suddenly disappear from the guest
after migration.

When a domain is defined on host1, migrated to host2 and then migrated
back to host1, its current configuration would overwrite the libvirtd's
in-memory copy of persistent configuration of that domain. This is not
desired as we want to preserve the persistent configuration untouched.

This patch introduces new 'live' parameter to virDomainAssignDef.
Passing 'true' for 'live' means the configuration passed to
virDomainAssignDef describes a configuration of live instance of the
domain. This applies for saved domains which are being restored or for
incoming domains during migration.

All callers have been changed to pass the appropriate value.

* src/conf/nwfilter_conf.h: Indent cpp directives.
* src/conf/nwfilter_params.h: Likewise.
* src/datatypes.h: Likewise.
* src/nwfilter/nwfilter_driver.h: Likewise.
* src/nwfilter/nwfilter_ebiptables_driver.h: Likewise.
* src/nwfilter/nwfilter_gentech_driver.h: Likewise.

* Fixes per feedback from Dan and Daniel
* Added test datafiles
* Re-disabled JSON flags
* Added code to print the error policy attribute when generating XML
* Re-add empty tag

This patch adds support for L3/L4 filtering using iptables. This adds
support for 'tcp', 'udp', 'icmp', 'igmp', 'sctp' etc. filtering.

As mentioned in the introduction, a .c file provided by this patch
is #include'd into a .c file. This will need work, but should be alright
for review.
Signed-off-by: NStefan Berger <stefanb@us.ibm.com>

This patch adds IPv6 support for the ebtables layer. Since the parser
etc. are all parameterized, it was fairly easy to add this...
Signed-off-by: NStefan Berger <stefanb@us.ibm.com>

Add support for Qemu to have firewall rules applied and removed on VM
startup and shutdown respectively. This  patch also provides support for
the updating of a filter that causes all VMs that reference the filter
to have their ebtables/iptables rules updated.
Signed-off-by: NStefan Berger <stefanb@us.ibm.com>

This patch implements the core driver and provides
- management functionality for managing the filter XMLs
- compiling the internal filter representation into ebtables rules
- applying ebtables rules on a network (tap,macvtap) interface
- tearing down ebtables rules that were applied on behalf of an
interface
- updating of filters while VMs are running and causing the firewalls to
be rebuilt
- other bits and pieces
Signed-off-by: NStefan Berger <stefanb@us.ibm.com>

This patch adds XML processing for the network filter schema
and extends the domain XML processing to parse the top level
referenced filter along with potentially provided parameters
Signed-off-by: NStefan Berger <stefanb@us.ibm.com>
Signed-off-by: NGerhard Stenzel <gerhard.stenzel@de.ibm.com>

This patch adds the definition of the wire format for RPC calls
and implementation of the RPC client & server code
Signed-off-by: NStefan Berger <stefanb@us.ibm.com>

This patch adds the implementation of the public API for the network
filtering (ACL) extensions to libvirt.c .
Signed-off-by: NStefan Berger <stefanb@us.ibm.com>

This patch adds the internal API extensions for network filtering (ACL) support.
Signed-off-by: NStefan Berger <stefanb@us.ibm.com>

This patch adds recursive locks necessary due to the processing of
network filter XML that can reference other network filters, including
references that cause looks. Loops in the XML are prevented but their
detection requires recursive locks.
Signed-off-by: NStefan Berger <stefanb@us.ibm.com>

* Add types to switch; the switch is only exectuted for known types because of a preceding conditional, so this fix is merely to placate the compiler.