1. 19 11月, 2011 40 次提交
    • E
      build: fix accidental POTFILES.in regression · cda8bd1a
      Eric Blake 提交于
      The original patch for commit 4789fb2e considered renaming a file,
      then backed out the name change, but forgot to back out the POTFILES.in
      change, resulting in 'make syntax-check' failure.
      cda8bd1a
    • E
      tests: test recent hash addition · 4af58342
      Eric Blake 提交于
      Excercise the new hash API, to ensure we avoid regressions.
      
      * tests/hashtest.c (testHashGetItems): New test.
      4af58342
    • S
      Add test cases for parsing of list values · d02ef4b8
      Stefan Berger 提交于
      This patch adds test cases for parsing of parameters with
      multiple occurrances of the same name.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      d02ef4b8
    • S
      Extend NWFilter parameter parser to cope with lists of values · 89513286
      Stefan Berger 提交于
      This patch modifies the NWFilter parameter parser to support multiple
      elements with the same name and to internally build a list of items.
      An example of the XML looks like this:
      
              <parameter name='TEST' value='10.1.2.3'/>
              <parameter name='TEST' value='10.2.3.4'/>
              <parameter name='TEST' value='10.1.1.1'/>
      
      The list of values is then stored in the newly introduced data type
      virNWFilterVarValue.
      
      The XML formatter is also adapted to print out all items in alphabetical
      order sorted by 'name'.
      
      This patch also fixes a bug in the XML schema on the way.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      89513286
    • S
      Create rules for each member of a list · c80296e2
      Stefan Berger 提交于
      This patch extends the NWFilter driver for Linux (ebiptables) to create
      rules for each member of a previously introduced list. If for example
      an attribute value (internally) looks like this:
      
      IP = [10.0.0.1, 10.0.0.2, 10.0.0.3]
      
      then 3 rules will be generated for a rule accessing the variable 'IP',
      one for each member of the list. The effect of this is that this now
      allows for filtering for multiple values in one field. This can then be
      used to support for filtering/allowing of multiple IP addresses per
      interface.
      
      An iterator is introduced that extracts each member of a list and
      puts it into a hash table which then is passed to the function creating
      a rule. For the above example the iterator would cause 3 loops.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      c80296e2
    • S
      Rework value part of name-value pairs · 581d1cea
      Stefan Berger 提交于
      NWFilters can be provided name-value pairs using the following
      XML notation:
      
            <filterref filter='xyz'>
              <parameter name='PORT' value='80'/>
              <parameter name='VAL' value='abc'/>
            </filterref>
      
      The internal representation currently is so that a name is stored as a
      string and the value as well. This patch now addresses the value part of it
      and introduces a data structure for storing a value either as a simple
      value or as an array for later support of lists.
      
      This patch adjusts all code that was handling the values in hash tables
      and makes it use the new data type.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      581d1cea
    • S
      Documentation about chains' priorities, lists of elements etc. · 1d8a00cd
      Stefan Berger 提交于
      This patch adds several aspects of documentation about the network filtering
      system:
      
      - chains, chains' priorities and chains' default priorities
      - talks about lists of elements, i.e., a variable assigned multiple values
        (part of already ACK-ed series)
      - already mentions the vlan, stp and mac chains added later on
        (https://www.redhat.com/archives/libvir-list/2011-October/msg01238.html)
      - mentions limitations of vlan filtering (when sent by VM) on Linux systems
       
      1d8a00cd
    • S
      Add test cases · f086b816
      Stefan Berger 提交于
      Add test case for the chain names with known prefixes and the chain
      priority.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      f086b816
    • S
      Interleave jumping into chains with filtering rules in 'root' table · 6aa99120
      Stefan Berger 提交于
      The previous patch extends the priority of filtering rules into negative
      numbers. We now use this possibility to interleave the jumping into
      chains with filtering rules to for example create the 'root' table of
      an interface with the following sequence of rules:
      
      Bridge chain: libvirt-I-vnet0, entries: 6, policy: ACCEPT
      -p IPv4 -j I-vnet0-ipv4
      -p ARP -j I-vnet0-arp
      -p ARP -j ACCEPT 
      -p 0x8035 -j I-vnet0-rarp
      -p 0x835 -j ACCEPT 
      -j DROP 
      
      The '-p ARP -j ACCEPT' rule now appears between the jumps.
      Since the 'arp' chain has been assigned priority -700 and the 'rarp'
      chain -600, the above ordering can now be achieved with the following
      rule:
      
        <rule action='accept' direction='out' priority='-650'>
          <mac protocolid='arp'/>
        </rule>
      
      This patch now sorts the commands generating the above shown jumps into
      chains and interleaves their execution with those for generating rules.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      6aa99120
    • S
      Extend rule priorities into negative numbers · f6e80a71
      Stefan Berger 提交于
      So far rules' priorities have only been valid in the range [0,1000].
      Now I am extending their priority into the range [-1000, 1000] for subsequently
      being able to sort rules and the access of (jumps into) chains following
      priorities.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      f6e80a71
    • S
      Enable chains with names having a known prefix · ea7c73a7
      Stefan Berger 提交于
      This patch enables chains that have a known prefix in their name.
      Known prefixes are: 'ipv4', 'ipv6', 'arp', 'rarp'. All prefixes
      are also protocols that can be evaluated on the ebtables level.
      
      Following the prefix they will be automatically connected to an interface's
      'root' chain and jumped into following the protocol they evaluate, i.e.,
      a table 'arp-xyz' will be accessed from the root table using
      
      ebtables -t nat -A <iface root table> -p arp -j I-<ifname>-arp-xyz
      
      thus generating a 'root' chain like this one here:
      
      Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT
      -p IPv4 -j O-vnet0-ipv4
      -p ARP -j O-vnet0-arp
      -p 0x8035 -j O-vnet0-rarp
      -p ARP -j O-vnet0-arp-xyz
      -j DROP 
      
      where the chain 'arp-xyz' is accessed for filtering of ARP packets.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      ea7c73a7
    • S
      Extend the filter XML to support priorities of chains · 2657822e
      Stefan Berger 提交于
      This patch extends the filter XML to support priorities of chains
      in the XML. An example would be:
      
      <filter name='allow-arpxyz' chain='arp-xyz' priority='200'>
      [...]
      </filter>
      
      The permitted values for priorities are [-1000, 1000].
      By setting the priority of a chain the order in which it is accessed
      from the interface root chain can be influenced.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      2657822e
    • S
      Use the actual names of chains in data structure · 19028ad6
      Stefan Berger 提交于
      Use the name of the chain rather than its type index (enum).
      This pushes the later enablement of chains with user-given names
      into the XML parser. For now we still only allow those names that
      are well known ('root', 'arp', 'rarp', 'ipv4' and 'ipv6').
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      19028ad6
    • S
      Use scripting for cleaning and renaming of chains · 4a410218
      Stefan Berger 提交于
      Use scripts for the renaming and cleaning up of chains. This allows us to get
      rid of some of the code that is only capable of renaming and removing chains
      whose names are hardcoded.
      
      A shell function 'collect_chains' is introduced that is given the name
      of an ebtables chain and then recursively determines the names of all
      chains that are accessed from this chain and its sub-chains using 'jumps'.
      
      The resulting list of chain names is then used to delete all the found
      chains by first flushing and then deleting them.
      
      The same function is also used for renaming temporary filters to their final
      names.
      
      I tested this with the bash and dash as script interpreters.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      4a410218
    • S
      Make filter creation in root table more flexible · be39b3e4
      Stefan Berger 提交于
      Use the previously introduced chain priorities to sort the chains for access
      from an interface's 'root' table and have them created in the proper order.
      This gets rid of a lot of code that was previously creating the chains in a 
      more hardcoded way.
      
      To determine what protocol a filter is used for evaluation do prefix-
      matching, i.e., the filter 'arp' is used to filter for the 'arp' protocol,
      'ipv4' for the 'ipv4' protocol and 'arp-xyz' will also be used to filter
      for the 'arp' protocol following the prefix 'arp' in its name.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      be39b3e4
    • S
      Introduce an internal priority for chains · 4df34ec3
      Stefan Berger 提交于
      For better handling of the sorting of chains introduce an internally used
      priority. Use a lookup table to store the priorities. For now their actual
      values do not matter just that the values cause the chains to be properly
      sorted through changes in the following patches. However, the values are
      chosen as negative so that once they are sorted along with filtering rules
      (whose priority may only be positive for now) they will always be instantiated
      before them (lower values cause instantiation before higher values). This
      is done to maintain backwards compatibility.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      4df34ec3
    • S
      Add function to get hash table's key/value pairs · e9640b99
      Stefan Berger 提交于
      Add a function to the virHashTable for getting an array of the hash table's
      key-value pairs and have the keys (optionally) sorted.
      Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
      e9640b99
    • D
      Add support for systemd init service · 4789fb2e
      Daniel P. Berrange 提交于
      This patch adds support for a systemd init service for libvirtd
      and libvirt-guests. The libvirtd.service is *not* written to use
      socket activation, since we want libvirtd to start on boot so it
      can do guest auto-start.
      
      The libvirt-guests.service is pretty lame, just exec'ing the
      original init script for now. Ideally we would factor out the
      functionality, into some shared tool.
      
      Instead of
      
        ./configure --with-init-script=redhat
      
      You can now do
      
        ./configure --with-init-script=systemd
      
      Or better still:
      
        ./configure --with-init-script=systemd+redhat
      
      We can also now support install of the upstart init script
      
      * configure.ac: Add systemd, and systemd+redhat options to
        --with-init-script option
      * daemon/Makefile.am: Install systemd services
      * daemon/libvirtd.sysconf: Add note about unused env variable
        with systemd
      * daemon/libvirtd.service.in: libvirtd systemd service unit
      * libvirt.spec.in: Add scripts to installing systemd services
        and migrating from legacy init scripts
      * tools/Makefile.am: Install systemd services
      * tools/libvirt-guests.init.sh: Rename to tools/libvirt-guests.init.in
      * tools/libvirt-guests.service.in: systemd service unit
      4789fb2e
    • D
      Add support for interfaces with type=direct to LXC · bfe952c9
      Daniel P. Berrange 提交于
      Support creation of macvlan devices for LXC containers. Do not
      allow setting of bandwidth controls or vport profiles due to the
      complication that there is no host side visible device to work
      with.
      
      * src/lxc/lxc_driver.c: Support type=direct interfaces
      bfe952c9
    • D
      Allow creation of plain macvlan devices · 6ec8288a
      Daniel P. Berrange 提交于
      Update virNetDevMacVLanCreateWithVPortProfile to allow creation
      of plain macvlan devices, as well as macvtap devices. The former
      is useful for LXC containers
      
      * src/qemu/qemu_command.c: Explicitly request a macvtap device
      * src/util/virnetdevmacvlan.c, src/util/virnetdevmacvlan.h: Add
        new flag to allow switching between macvlan and macvtap
        creation
      6ec8288a
    • D
      Refactor LXC network setup to allow future enhancements · f3b1b9b1
      Daniel P. Berrange 提交于
      The current lxcSetupInterfaces() method directly performs setup
      of the bridge devices. Since it will shortly need to also create
      macvlan devices, move the bridge related code into a separate
      method
      
      * src/lxc/lxc_driver.c: Split lxcSetupInterfaces() to create a
        new lxcSetupInterfaceBridge()
      f3b1b9b1
    • D
      Add missing 'const' annotations for internal domain conf helpers · 914d1b74
      Daniel P. Berrange 提交于
      The virDomainNetGetActualBridgeName and virDomainNetGetActualDirectDev
      methods both return strings that point to data in the virDomainDefPtr
      struct, and should therefore not be freed. The return values should
      thus be 'const char *' not 'char *'.
      
      * src/conf/domain_conf.c, src/conf/domain_conf.h: Mark const
      * src/network/bridge_driver.c: Update to use a const char *
      914d1b74
    • D
      Fix up ordering of private symbols file · 0c1587e1
      Daniel P. Berrange 提交于
      Fix ordering of symbols after re-arranging network device
      management API source files
      
      * src/libvirt_private.syms: Fix ordering
      0c1587e1
    • D
      Move ifaceMacvtapLinkDump and ifaceGetNthParent functions · 91904106
      Daniel P. Berrange 提交于
      Move the ifaceMacvtapLinkDump and ifaceGetNthParent functions
      into virnetdevvportprofile.c since they are specific to that
      code. This avoids polluting the headers with the Linux specific
      netlink data types
      
      * src/util/interface.c, src/util/interface.h: Move
        ifaceMacvtapLinkDump and ifaceGetNthParent functions and delete
        remaining file
      * src/util/virnetdevvportprofile.c: Add ifaceMacvtapLinkDump
        and ifaceGetNthParent functions
      * src/network/bridge_driver.c, src/nwfilter/nwfilter_gentech_driver.c,
        src/nwfilter/nwfilter_learnipaddr.c, src/util/virnetdevmacvlan.c:
        Remove include of interface.h
      91904106
    • D
      Move functions for dealing with physical/virtual devices · 74b32b62
      Daniel P. Berrange 提交于
      Move virNetDevIsVirtualFunction, virNetDevGetVirtualFunctionIndex
      and virNetDevGetPhysicalFunction to virnetdev.c
      
      * src/util/interface.c, src/util/interface.h, src/util/virnetdev.c,
        src/util/virnetdev.h: Move APIs
      74b32b62
    • D
      Rename APIs for dealing with virtual/physical functions · 8f688c85
      Daniel P. Berrange 提交于
      Rename ifaceIsVirtualFunction to virNetDevIsVirtualFunction,
      ifaceGetVirtualFunctionIndex to virNetDevGetVirtualFunctionIndex
      and ifaceGetPhysicalFunction to virNetDevGetPhysicalFunction
      
      * src/util/interface.c, src/util/interface.h: Rename APIs
      * src/util/virnetdevvportprofile.c: Update for API rename
      8f688c85
    • D
      Move virNetDevValidateConfig to virnetdev.c · 5373cb74
      Daniel P. Berrange 提交于
      * src/util/interface.c, src/util/interface.h: Remove virNetDevValidateConfig
      * src/util/virnetdev.c, src/util/virnetdev.h: Add virNetDevValidateConfig
      5373cb74
    • D
      Rename ifaceCheck to virNetDevValidateConfig · 6e0c4dce
      Daniel P. Berrange 提交于
      Rename the ifaceCheck method to virNetDevValidateConfig and change
      so that it always raises an error and returns -1 on error.
      
      * src/util/interface.c, src/util/interface.h: Rename ifaceCheck
        to virNetDevValidateConfig
      * src/nwfilter/nwfilter_gentech_driver.c,
        src/nwfilter/nwfilter_learnipaddr.c: Update for API rename
      6e0c4dce
    • D
      Move virNetDevGetIPv4Address to virnetdev.c · 8e6cd414
      Daniel P. Berrange 提交于
      Move the virNetDevGetIPv4Address function to virnetdev.c
      
      * util/interface.c, util/interface.h: Remove virNetDevGetIPv4Address
      * util/virnetdev.c, util/virnetdev.h: Add virNetDevGetIPv4Address
      8e6cd414
    • D
      Rename ifaceGetIPAddress to virNetDevGetIPv4Address · 50f19085
      Daniel P. Berrange 提交于
      To match up with the existing virNetDevSetIPv4Address, rename
      ifaceGetIPAddress to virNetDevGetIPv4Address
      
      * util/interface.h, util/interface.c: Rename API
      * network/bridge_driver.c: Update for API rename
      50f19085
    • D
      Move virNetDevGetIndex & virNetDevGetVLanID to virnetdev.c · 00bba08d
      Daniel P. Berrange 提交于
      Move virNetDevGetIndex & virNetDevGetVLanID to virnetdev.c to
      suit their functional purpose
      
      * util/interface.c, util/interface.h: Remove virNetDevGetIndex &
        virNetDevGetVLanID
      * util/virnetdev.c, util/virnetdev.h: Add virNetDevGetIndex &
        virNetDevGetVLanID
      00bba08d
    • D
      Rename ifaceGetIndex and ifaceGetVLAN · ebbb6bd1
      Daniel P. Berrange 提交于
      Rename the ifaceGetIndex method to virNetDevGetIndex and
      ifaceGetVlanID to virNetDevGetVLanID. Also change the error
      reporting behaviour to always raise errors and return -1 on
      failure
      
      * util/interface.c, util/interface.h: Rename ifaceGetIndex
        and ifaceGetVLAN
      * nwfilter/nwfilter_gentech_driver.c, nwfilter/nwfilter_learnipaddr.c,
        nwfilter/nwfilter_learnipaddr.c, util/virnetdevvportprofile.c: Update
        for API renames and error handling changes
      ebbb6bd1
    • D
      Move MAC address replacement functions to virnetdev.c · 255917f5
      Daniel P. Berrange 提交于
      Move virNetDevReplaceMacAddress and virNetDevRestoreMacAddress
      to the virnetdev.c file where they naturally belong
      
      * util/interface.c, util/interface.h: Remove
        virNetDevReplaceMacAddress and virNetDevRestoreMacAddress
      * util/virnetdev.c, util/virnetdev.h: Add
        virNetDevReplaceMacAddress and virNetDevRestoreMacAddress
      255917f5
    • D
      Rename interface MAC address replacement APIs · 10462d5c
      Daniel P. Berrange 提交于
      Rename ifaceReplaceMacAddress to virNetDevReplaceMacAddress
      and ifaceRestoreMacAddress to virNetDevRestoreMacAddress.
      
      * util/interface.c, util/interface.h, util/virnetdevmacvlan.c:
        Rename APIs
      10462d5c
    • D
      Move the low level macvlan creation APIs · d2fed854
      Daniel P. Berrange 提交于
      Move the low level macvlan creation APIs into the
      virnetdevmacvlan.c file where they more naturally
      belong
      
      * util/interface.c, util/interface.h: Remove virNetDevMacVLanCreate
        and virNetDevMacVLanDelete
      * util/virnetdevmacvlan.c, util/virnetdevmacvlan.h: Add
        virNetDevMacVLanCreate and virNetDevMacVLanDelete
      d2fed854
    • D
      Rename low level macvlan creation APIs · 57f0de4c
      Daniel P. Berrange 提交于
      Rename ifaceMacvtapLinkAdd to virNetDevMacVLanCreate and
      ifaceLinkDel to virNetDevMacVLanDelete. Strictly speaking
      the latter isn't restricted to macvlan devices, but that's
      the only use libvirt has for it.
      
      * util/interface.c, util/interface.h,
        util/virnetdevmacvlan.c: Rename APIs
      57f0de4c
    • D
      Rename high level macvlan creation APIs · 191090ae
      Daniel P. Berrange 提交于
      Rename virNetDevMacVLanCreate to virNetDevMacVLanCreateWithVPortProfile
      and virNetDevMacVLanDelete to virNetDevMacVLanDeleteWithVPortProfile
      
      To make way for renaming the other macvlan creation APIs in
      interface.c
      
      * util/virnetdevmacvlan.c, util/virnetdevmacvlan.h,
        qemu/qemu_command.c, qemu/qemu_hotplug.c, qemu/qemu_process.c:
        Rename APIs
      191090ae
    • D
      Rename and split the macvtap.c file · 896104c9
      Daniel P. Berrange 提交于
      Rename the macvtap.c file to virnetdevmacvlan.c to reflect its
      functionality. Move the port profile association code out into
      virnetdevvportprofile.c. Make the APIs available unconditionally
      to callers
      
      * src/util/macvtap.h: rename to src/util/virnetdevmacvlan.h,
      * src/util/macvtap.c: rename to src/util/virnetdevmacvlan.c
      * src/util/virnetdevvportprofile.c, src/util/virnetdevvportprofile.h:
        Pull in vport association code
      * src/Makefile.am, src/conf/domain_conf.h, src/qemu/qemu_conf.c,
        src/qemu/qemu_conf.h, src/qemu/qemu_driver.c: Update include
        paths & remove conditional compilation
      896104c9
    • D
      Rename Macvtap management APIs · 43925db7
      Daniel P. Berrange 提交于
      In preparation for code re-organization, rename the Macvtap
      management APIs to have the following patterns
      
        virNetDevMacVLanXXXXX     - macvlan/macvtap interface management
        virNetDevVPortProfileXXXX - virtual port profile management
      
      * src/util/macvtap.c, src/util/macvtap.h: Rename APIs
      * src/conf/domain_conf.c, src/network/bridge_driver.c,
        src/qemu/qemu_command.c, src/qemu/qemu_command.h,
        src/qemu/qemu_driver.c, src/qemu/qemu_hotplug.c,
        src/qemu/qemu_migration.c, src/qemu/qemu_process.c,
        src/qemu/qemu_process.h: Update for renamed APIs
      43925db7
    • D
      Fix use of uninitialized variable in QEMU driver · a7c6ce0d
      Daniel P. Berrange 提交于
      a7c6ce0d