[Libguestfs] [PATCH 2/2] v2v: Add --password-file parameter (RHBZ#1158526).

This allows you to send passwords to virt-v2v input modes without being interactive. --- v2v/cmdline.ml | 13 +++++++++- v2v/domainxml-c.c | 52 ++++++++++++++++++++++++++++++++----- v2v/domainxml.ml | 2 +- v2v/domainxml.mli | 4 +-- v2v/input_libvirt.ml | 12 ++++----- v2v/input_libvirt.mli | 4 +-- v2v/input_libvirt_other.ml | 8 +++--- v2v/input_libvirt_other.mli | 4 +-- v2v/input_libvirt_vcenter_https.ml | 29 +++++++++++++-------- v2v/input_libvirt_vcenter_https.mli | 2 +- v2v/input_libvirt_xen_ssh.ml | 6 ++--- v2v/input_libvirt_xen_ssh.mli | 2 +- v2v/input_libvirtxml.ml | 2 +- v2v/virt-v2v.pod | 10 ++++++- 14 files changed, 107 insertions(+), 43 deletions(-) diff --git a/v2v/cmdline.ml b/v2v/cmdline.ml index 6f8a964..9c3253e 100644 --- a/v2v/cmdline.ml +++ b/v2v/cmdline.ml @@ -42,6 +42,7 @@ let parse_cmdline () = let output_format = ref "" in let output_name = ref "" in let output_storage = ref "" in + let password_file = ref "" in let print_source = ref false in let qemu_boot = ref false in let quiet = ref false in @@ -165,6 +166,7 @@ let parse_cmdline () = "-of", Arg.Set_string output_format, "raw|qcow2 " ^ s_"Set output format"; "-on", Arg.Set_string output_name, "name " ^ s_"Rename guest when converting"; "-os", Arg.Set_string output_storage, "storage " ^ s_"Set output storage location"; + "--password-file", Arg.Set_string password_file, "file " ^ s_"Use password from file"; "--print-source", Arg.Set print_source, " " ^ s_"Print source and stop"; "--qemu-boot", Arg.Set qemu_boot, " " ^ s_"Boot in qemu (-o qemu only)"; "-q", Arg.Set quiet, " " ^ s_"Quiet output"; @@ -227,6 +229,7 @@ read the man page virt-v2v(1). let output_mode = !output_mode in let output_name = match !output_name with "" -> None | s -> Some s in let output_storage = !output_storage in + let password_file = match !password_file with "" -> None | s -> Some s in let print_source = !print_source in let qemu_boot = !qemu_boot in let quiet = !quiet in @@ -256,6 +259,14 @@ read the man page virt-v2v(1). exit 0 ); + (* Parse out the password from the password file. *) + let password = + match password_file with + | None -> None + | Some filename -> + let password = read_whole_file filename in + Some password in + (* Parsing of the argument(s) depends on the input mode. *) let input = match input_mode with @@ -278,7 +289,7 @@ read the man page virt-v2v(1). | [guest] -> guest | _ -> error (f_"expecting a libvirt guest name on the command line") in - Input_libvirt.input_libvirt verbose input_conn guest + Input_libvirt.input_libvirt verbose password input_conn guest | `LibvirtXML -> (* -i libvirtxml: Expecting a filename (XML file). *) diff --git a/v2v/domainxml-c.c b/v2v/domainxml-c.c index 8a55030..6fa8270 100644 --- a/v2v/domainxml-c.c +++ b/v2v/domainxml-c.c @@ -74,13 +74,47 @@ get_dom_state (virDomainPtr dom) return -1; } +/* See src/libvirt-auth.c for why we need this. */ +static int +libvirt_auth_default_wrapper (virConnectCredentialPtr cred, + unsigned int ncred, + void *passwordvp) +{ + const char *password = passwordvp; + unsigned int i; + + if (password) { + /* If --password-file was specified on the command line, and the + * libvirt handler is asking for a password, return that. + */ + for (i = 0; i < ncred; ++i) { + if (cred[i].type == VIR_CRED_PASSPHRASE) { + cred[i].result = strdup (password); + cred[i].resultlen = strlen (password); + } + else { + cred[i].result = NULL; + cred[i].resultlen = 0; + } + } + return 0; + } + else { + /* No --password-file so call the default handler. */ + return virConnectAuthPtrDefault->cb (cred, ncred, + virConnectAuthPtrDefault->cbdata); + } +} + value -v2v_dumpxml (value connv, value domnamev) +v2v_dumpxml (value passwordv, value connv, value domnamev) { - CAMLparam2 (connv, domnamev); + CAMLparam3 (passwordv, connv, domnamev); CAMLlocal1 (retv); + const char *password = NULL; const char *conn_uri = NULL; const char *domname; + virConnectAuth authdata; /* We have to assemble the error on the stack because a dynamic * string couldn't be freed. */ @@ -91,16 +125,20 @@ v2v_dumpxml (value connv, value domnamev) int is_test_uri = 0; char *xml; + if (passwordv != Val_int (0)) + password = String_val (Field (passwordv, 0)); /* Some password */ + if (connv != Val_int (0)) { conn_uri = String_val (Field (connv, 0)); /* Some conn */ is_test_uri = STRPREFIX (conn_uri, "test:"); } - /* We have to call the default authentication handler, not least - * since it handles all the PolicyKit crap. However it also makes - * coding this simpler. - */ - conn = virConnectOpenAuth (conn_uri, virConnectAuthPtrDefault, VIR_CONNECT_RO); + /* Set up authentication wrapper. */ + authdata = *virConnectAuthPtrDefault; + authdata.cb = libvirt_auth_default_wrapper; + authdata.cbdata = (void *) password; + + conn = virConnectOpenAuth (conn_uri, &authdata, VIR_CONNECT_RO); if (conn == NULL) { if (conn_uri) snprintf (errmsg, sizeof errmsg, diff --git a/v2v/domainxml.ml b/v2v/domainxml.ml index d240918..61ed5e0 100644 --- a/v2v/domainxml.ml +++ b/v2v/domainxml.ml @@ -18,5 +18,5 @@ (* [virsh dumpxml] but with non-broken authentication handling. *) -external dumpxml : ?conn:string -> string -> string = "v2v_dumpxml" +external dumpxml : ?password:string -> ?conn:string -> string -> string = "v2v_dumpxml" external pool_dumpxml : ?conn:string -> string -> string = "v2v_pool_dumpxml" diff --git a/v2v/domainxml.mli b/v2v/domainxml.mli index ced55ce..ffb1c46 100644 --- a/v2v/domainxml.mli +++ b/v2v/domainxml.mli @@ -23,8 +23,8 @@ password prompt to stdout, which is the same place we would be reading the XML from. This file works around this brokenness. *) -val dumpxml : ?conn:string -> string -> string -(** [dumpxml ?conn dom] returns the libvirt XML of domain [dom]. +val dumpxml : ?password:string -> ?conn:string -> string -> string +(** [dumpxml ?password ?conn dom] returns the libvirt XML of domain [dom]. The optional [?conn] parameter is the libvirt connection URI. [dom] may be a guest name or UUID. *) diff --git a/v2v/input_libvirt.ml b/v2v/input_libvirt.ml index 5d5c39f..6aa9bcd 100644 --- a/v2v/input_libvirt.ml +++ b/v2v/input_libvirt.ml @@ -27,10 +27,10 @@ open Types open Utils (* Choose the right subclass based on the URI. *) -let input_libvirt verbose libvirt_uri guest = +let input_libvirt verbose password libvirt_uri guest = match libvirt_uri with | None -> - Input_libvirt_other.input_libvirt_other verbose libvirt_uri guest + Input_libvirt_other.input_libvirt_other verbose password libvirt_uri guest | Some orig_uri -> let { Xml.uri_server = server; uri_scheme = scheme } as parsed_uri = @@ -45,15 +45,15 @@ let input_libvirt verbose libvirt_uri guest = | Some _, None (* No scheme? *) | Some _, Some "" -> - Input_libvirt_other.input_libvirt_other verbose libvirt_uri guest + Input_libvirt_other.input_libvirt_other verbose password libvirt_uri guest | Some server, Some ("esx"|"gsx"|"vpx" as scheme) -> (* vCenter over https *) Input_libvirt_vcenter_https.input_libvirt_vcenter_https - verbose libvirt_uri parsed_uri scheme server guest + verbose password libvirt_uri parsed_uri scheme server guest | Some server, Some ("xen+ssh" as scheme) -> (* Xen over SSH *) Input_libvirt_xen_ssh.input_libvirt_xen_ssh - verbose libvirt_uri parsed_uri scheme server guest + verbose password libvirt_uri parsed_uri scheme server guest (* Old virt-v2v also supported qemu+ssh://. However I am * deliberately not supporting this in new virt-v2v. Don't @@ -63,6 +63,6 @@ let input_libvirt verbose libvirt_uri guest = | Some _, Some _ -> (* Unknown remote scheme. *) warning (f_"no support for remote libvirt connections to '-ic %s'. The conversion may fail when it tries to read the source disks.") orig_uri; - Input_libvirt_other.input_libvirt_other verbose libvirt_uri guest + Input_libvirt_other.input_libvirt_other verbose password libvirt_uri guest let () = Modules_list.register_input_module "libvirt" diff --git a/v2v/input_libvirt.mli b/v2v/input_libvirt.mli index 1ed704b..bdd40b6 100644 --- a/v2v/input_libvirt.mli +++ b/v2v/input_libvirt.mli @@ -18,7 +18,7 @@ (** [-i libvirt] source. *) -val input_libvirt : bool -> string option -> string -> Types.input -(** [input_libvirt verbose libvirt_uri guest] creates and returns a +val input_libvirt : bool -> string option -> string option -> string -> Types.input +(** [input_libvirt verbose password libvirt_uri guest] creates and returns a new {!Types.input} object specialized for reading input from libvirt sources. *) diff --git a/v2v/input_libvirt_other.ml b/v2v/input_libvirt_other.ml index 9f3eedb..c704af6 100644 --- a/v2v/input_libvirt_other.ml +++ b/v2v/input_libvirt_other.ml @@ -43,7 +43,7 @@ let error_if_no_ssh_agent () = error (f_"ssh-agent authentication has not been set up ($SSH_AUTH_SOCK is not set). Please read \"INPUT FROM RHEL 5 XEN\" in the virt-v2v(1) man page.") (* Superclass. *) -class virtual input_libvirt verbose libvirt_uri guest = +class virtual input_libvirt verbose password libvirt_uri guest = object inherit input verbose @@ -58,9 +58,9 @@ end (* Subclass specialized for handling anything that's *not* VMware vCenter * or Xen. *) -class input_libvirt_other verbose libvirt_uri guest = +class input_libvirt_other verbose password libvirt_uri guest = object - inherit input_libvirt verbose libvirt_uri guest + inherit input_libvirt verbose password libvirt_uri guest method source () = if verbose then printf "input_libvirt_other: source()\n%!"; @@ -68,7 +68,7 @@ object (* Get the libvirt XML. This also checks (as a side-effect) * that the domain is not running. (RHBZ#1138586) *) - let xml = Domainxml.dumpxml ?conn:libvirt_uri guest in + let xml = Domainxml.dumpxml ?password ?conn:libvirt_uri guest in let source, disks = Input_libvirtxml.parse_libvirt_xml ~verbose xml in let disks = diff --git a/v2v/input_libvirt_other.mli b/v2v/input_libvirt_other.mli index 013d3bb..3eb82cb 100644 --- a/v2v/input_libvirt_other.mli +++ b/v2v/input_libvirt_other.mli @@ -21,10 +21,10 @@ val error_if_libvirt_backend : unit -> unit val error_if_no_ssh_agent : unit -> unit -class virtual input_libvirt : bool -> string option -> string -> object +class virtual input_libvirt : bool -> string option -> string option -> string -> object method as_options : string method virtual source : unit -> Types.source method adjust_overlay_parameters : Types.overlay -> unit end -val input_libvirt_other : bool -> string option -> string -> Types.input +val input_libvirt_other : bool -> string option -> string option -> string -> Types.input diff --git a/v2v/input_libvirt_vcenter_https.ml b/v2v/input_libvirt_vcenter_https.ml index ac373d3..7f93439 100644 --- a/v2v/input_libvirt_vcenter_https.ml +++ b/v2v/input_libvirt_vcenter_https.ml @@ -38,7 +38,7 @@ let readahead_for_copying = Some (64 * 1024 * 1024) *) let rec get_session_cookie = let session_cookie = ref "" in - fun verbose scheme uri sslverify url -> + fun verbose password scheme uri sslverify url -> if !session_cookie <> "" then Some !session_cookie else ( @@ -48,9 +48,15 @@ let rec get_session_cookie = "url", Some url; ] in let curl_args = - match uri.uri_user with - | Some user -> ("user", Some user) :: curl_args - | None -> curl_args in + match uri.uri_user, password with + | None, None -> curl_args + | None, Some _ -> + warning (f_"--password-file parameter ignored because 'user@' was not given in the URL"); + curl_args + | Some user, None -> + ("user", Some user) :: curl_args + | Some user, Some password -> + ("user", Some (user ^ ":" ^ password)) :: curl_args in let curl_args = if not sslverify then ("insecure", None) :: curl_args else curl_args in @@ -204,7 +210,7 @@ let get_datacenter uri scheme = *) let source_re = Str.regexp "^\\[\\(.*\\)\\] \\(.*\\)\\.vmdk$" -let map_source_to_uri ?readahead verbose uri scheme server path = +let map_source_to_uri ?readahead verbose password uri scheme server path = if not (Str.string_match source_re path 0) then path else ( @@ -237,7 +243,8 @@ let map_source_to_uri ?readahead verbose uri scheme server path = string_find query "no_verify=1" = -1 in (* Now we have to query the server to get the session cookie. *) - let session_cookie = get_session_cookie verbose scheme uri sslverify url in + let session_cookie = + get_session_cookie verbose password scheme uri sslverify url in (* Construct the JSON parameters. *) let json_params = [ @@ -274,9 +281,9 @@ let map_source_to_uri ?readahead verbose uri scheme server path = (* Subclass specialized for handling VMware vCenter over https. *) class input_libvirt_vcenter_https - verbose libvirt_uri parsed_uri scheme server guest = + verbose password libvirt_uri parsed_uri scheme server guest = object - inherit input_libvirt verbose libvirt_uri guest + inherit input_libvirt verbose password libvirt_uri guest val saved_source_paths = Hashtbl.create 13 @@ -290,7 +297,7 @@ object (* Get the libvirt XML. This also checks (as a side-effect) * that the domain is not running. (RHBZ#1138586) *) - let xml = Domainxml.dumpxml ?conn:libvirt_uri guest in + let xml = Domainxml.dumpxml ?password ?conn:libvirt_uri guest in let source, disks = parse_libvirt_xml ~verbose xml in (* Save the original source paths, so that we can remap them again @@ -314,7 +321,7 @@ object | { p_source_disk = disk; p_source = P_dont_rewrite } -> disk | { p_source_disk = disk; p_source = P_source_file path } -> let qemu_uri = map_source_to_uri ?readahead - verbose parsed_uri scheme server path in + verbose password parsed_uri scheme server path in (* The libvirt ESX driver doesn't normally specify a format, but * the format of the -flat file is *always* raw, so force it here. @@ -335,7 +342,7 @@ object let readahead = readahead_for_copying in let backing_qemu_uri = map_source_to_uri ?readahead - verbose parsed_uri scheme server orig_path in + verbose password parsed_uri scheme server orig_path in (* Rebase the qcow2 overlay to adjust the readahead parameter. *) let cmd = diff --git a/v2v/input_libvirt_vcenter_https.mli b/v2v/input_libvirt_vcenter_https.mli index 82dce53..800c6ab 100644 --- a/v2v/input_libvirt_vcenter_https.mli +++ b/v2v/input_libvirt_vcenter_https.mli @@ -18,4 +18,4 @@ (** [-i libvirt] when the source is VMware vCenter *) -val input_libvirt_vcenter_https : bool -> string option -> Xml.uri -> string -> string -> string -> Types.input +val input_libvirt_vcenter_https : bool -> string option -> string option -> Xml.uri -> string -> string -> string -> Types.input diff --git a/v2v/input_libvirt_xen_ssh.ml b/v2v/input_libvirt_xen_ssh.ml index e1600a0..cf5f1ae 100644 --- a/v2v/input_libvirt_xen_ssh.ml +++ b/v2v/input_libvirt_xen_ssh.ml @@ -30,9 +30,9 @@ open Input_libvirt_other open Printf (* Subclass specialized for handling Xen over SSH. *) -class input_libvirt_xen_ssh verbose libvirt_uri parsed_uri scheme server guest = +class input_libvirt_xen_ssh verbose password libvirt_uri parsed_uri scheme server guest = object - inherit input_libvirt verbose libvirt_uri guest + inherit input_libvirt verbose password libvirt_uri guest method source () = if verbose then @@ -45,7 +45,7 @@ object (* Get the libvirt XML. This also checks (as a side-effect) * that the domain is not running. (RHBZ#1138586) *) - let xml = Domainxml.dumpxml ?conn:libvirt_uri guest in + let xml = Domainxml.dumpxml ?password ?conn:libvirt_uri guest in let source, disks = parse_libvirt_xml ~verbose xml in (* Map the <source/> filename (which is relative to the remote diff --git a/v2v/input_libvirt_xen_ssh.mli b/v2v/input_libvirt_xen_ssh.mli index 85473ed..47eb62c 100644 --- a/v2v/input_libvirt_xen_ssh.mli +++ b/v2v/input_libvirt_xen_ssh.mli @@ -18,4 +18,4 @@ (** [-i libvirt] when the source is Xen *) -val input_libvirt_xen_ssh : bool -> string option -> Xml.uri -> string -> string -> string -> Types.input +val input_libvirt_xen_ssh : bool -> string option -> string option -> Xml.uri -> string -> string -> string -> Types.input diff --git a/v2v/input_libvirtxml.ml b/v2v/input_libvirtxml.ml index 85582fa..f06a1dd 100644 --- a/v2v/input_libvirtxml.ml +++ b/v2v/input_libvirtxml.ml @@ -170,7 +170,7 @@ let parse_libvirt_xml ~verbose xml = * XXX Quoting, although it's not needed for virt-p2v. *) let path = sprintf "nbd:%s:%d" host port in - add_disk path format target_dev (P_dont_rewrite) + add_disk path format target_dev P_dont_rewrite ) | "" -> () | protocol -> diff --git a/v2v/virt-v2v.pod b/v2v/virt-v2v.pod index bd83ee7..a6d01db 100644 --- a/v2v/virt-v2v.pod +++ b/v2v/virt-v2v.pod @@ -509,6 +509,13 @@ C<root>. You will get an error if virt-v2v is unable to mount/write to the Export Storage Domain. +=item B<--password-file> file + +Instead of asking for password(s) interactively, pass the password +through a file. Note the file should contain the whole password, +B<without any trailing newline>, and for security the file should have +mode C<0600> so that others cannot read it. + =item B<--print-source> Print information about the source guest and stop. This option is @@ -875,7 +882,8 @@ down). Note that you may be asked for the vCenter password I<twice>. This happens once because libvirt needs it, and a second time because -virt-v2v itself connects directly to the server. +virt-v2v itself connects directly to the server. Use +I<--password-file> to supply a password via a file. In this case the output flags are set to write the converted guest to a temporary directory as this is just an example, but you can also -- 2.0.4