[libvirt-users] Using Openvswitch and qemu:///session

[Laine Stump]

On 03/22/2016 02:29 PM, Predrag Ivanovic wrote:
> Hi.
>
> I'd like to use Openvswitch while running libvirt as an unprivileged user (qemu:///session).
> As expected, system session works just fine with OVS.
>
> When I try to start the domain from user session, with the relevant network part of the domain xml edited to use openvswitch, like this
> ---
>      <interface type='bridge'>
>        <mac address='52:54:00:4a:ef:bb'/>
>        <source bridge='ovs-br'/>
>        <virtualport type='openvswitch'>
>          <parameters interfaceid='33ec3d9d-a92a-468e-aa48-6c31f7882d6f'/>
>        </virtualport>
>        <target dev='veth0-ovs'/>
>        <model type='virtio'/>
>        <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
>      </interface>
> ---
> I get this error:
> ---
> start freebsd-10.3
> error: Failed to start domain freebsd-10.3
> error: internal error: /usr/lib/qemu/qemu-bridge-helper --use-vnet --br=ovs-br --fd=19: failed to communicate with bridge helper: Transport endpoint is not connected
> stderr=failed to add interface `tap0' to bridge `ovs-br': Operation not supported
> ---
> Now, if I understand correctly, this is Qemu, not libvirt error?
> Libvirt prepares the network, passes it to qemu-bridge-helper, which has no idea what to do with it, since it's not the regular bridge, and barfs?
>
> The reason I ask is because I saw calls to ovs-vsctl in the logs when I did the same thing using qemu:///system.
> My question (finally):
>   if I reconfigure OVS to not run as root:root, but as ovs:ovs, and add the user to that group,
> will libvirt/virsh automagically figure out that the user has permissions to run ovs-whatever and
> write permission to /var/run/openvswitch/db.sock, so there is no need for qemu-bridge-helper, and
> just set up the network, just like when system sesion is used, or is using qemu-bridge-helper the only option available for non-root users ?
>
> If it is, due to some Linux constraints, I'll curse a bit and migrate the domains  :)
>
> And, before I forget, I am using libvirt and qemu built from git master, and openvswitch-2.5.0

What you're trying to do isn't supported and won't work. the 
qemu:///session libvirtd runs as a normal user, and doesn't have the 
necessary permissions to create tap devices or connect them to either 
Linux host bridges or OVS bridges. qemu added the "qemu-bridge-helper" 
which is a suid binary that will create a tap device and connect it to 
the named Linux host bridge, and the person who wrote that helper also 
made a patch to libvirt to automatically call the qemu-bridge-helper 
when a request is made in a qemu:///session guest to connect to a 
bridge. Unfortunately, qemu-bridge-helper only knows how to connect to 
standard Linux host bridges, it knows nothing about OVS.

I believe there is an OVS compatibility module that makes the ioctl used 
to connect a tap device to a host bridge also work for OVS bridges. You 
may want to look into that. However, note that in that case you won't 
want the <virtualport type='openvswitch'> section in your guest config 
(as a matter of fact it is ignored in qemu:///session). This will mean 
that you won't be able to force a particular interfaceid, which may or 
may not be important to you.