From nobody Sat May 18 10:07:47 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 216.205.24.124 as permitted sender) client-ip=216.205.24.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 216.205.24.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail(p=none dis=none) header.from=huawei.com ARC-Seal: i=1; a=rsa-sha256; t=1620456174; cv=none; d=zohomail.com; s=zohoarc; b=kFsEdHcuAbkuZkYPJ0tkij0MaMUZZw6s9aI1Jo638D6s9/vVs/6jOn6+PMzSODSu2aYHcOXrlZIU+tXZoJZgmL98/KqGY8+igm1TC6lV2cXVoZXIBvptqvura1QVJfRomzriATv8pwWWyiBXwSzSPBFZKUFYBtQ0wcWsMB0M6T0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1620456174; h=Content-Type:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=6Z92upQUZLcN2yz1R+/07aJ+vNuSv7JkvqAF6ZPidjU=; b=hD/bzt0cAHqx3BvoSvlo21QG35FFSGp6NdPkO+pOcr4pD2/FN2rB6goq462g1g+a5AljvEmcnp+bswww2BdhZjYf1ggiY5V6dw4R0xdz4E00bfXcK6g7hQC/Ca54rvjkBFK5g3Ogc+/OoLhVgNHgdYaUSr2pq29we4CrUtyvLMc= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 216.205.24.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by mx.zohomail.com with SMTPS id 162045617436741.43010435741894; Fri, 7 May 2021 23:42:54 -0700 (PDT) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-255-OGG2n4xkObuq-9PjPhlRfg-1; Sat, 08 May 2021 02:42:50 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 0D6A0800D62; Sat, 8 May 2021 06:42:42 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id F1E555C3FD; Sat, 8 May 2021 06:42:39 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id A756718005B6; Sat, 8 May 2021 06:42:33 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 1486gVm3000560 for ; Sat, 8 May 2021 02:42:31 -0400 Received: by smtp.corp.redhat.com (Postfix) id 05939205FA87; Sat, 8 May 2021 06:42:31 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast04.extmail.prod.ext.rdu2.redhat.com [10.11.55.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 012312077FC0 for ; Sat, 8 May 2021 06:42:27 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 422641066558 for ; Sat, 8 May 2021 06:42:27 +0000 (UTC) Received: from szxga05-in.huawei.com (szxga05-in.huawei.com [45.249.212.191]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-512-2V7-xF_eOY2ftSli5ssAIw-1; Sat, 08 May 2021 02:42:24 -0400 Received: from DGGEMS409-HUB.china.huawei.com (unknown [172.30.72.60]) by szxga05-in.huawei.com (SkyGuard) with ESMTP id 4Fcd326jlSzkXFR; Sat, 8 May 2021 14:39:42 +0800 (CST) Received: from localhost (10.174.149.15) by DGGEMS409-HUB.china.huawei.com (10.3.19.209) with Microsoft SMTP Server id 14.3.498.0; Sat, 8 May 2021 14:42:08 +0800 X-MC-Unique: OGG2n4xkObuq-9PjPhlRfg-1 X-MC-Unique: 2V7-xF_eOY2ftSli5ssAIw-1 From: Zheng Yan To: Subject: [PATCH] Introduce a new virDomainReloadTlsCertificates API Date: Sat, 8 May 2021 14:42:08 +0800 Message-ID: <1620456128-20892-1-git-send-email-yanzheng759@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.174.149.15] X-CFilter-Loop: Reflected X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-loop: libvir-list@redhat.com Cc: mprivozn@redhat.com, wangxinxin.wang@huawei.com, changzihao1@huawei.com, oscar.zhangbo@huawei.com, hexiaoyu3@huawei.com X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The new virDomainReloadTlsCertificates API is used to notify domain reload its certificates without restart, and avoid service interruption. Currently, only QEMU VNC TLS certificates are supported, but parameters and flags are also reserved for subsequent scenarios. Take reload QEMU VNC TLS certificates as an example, we can call: virDomainReloadTlsCertificates(domain, VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC, NULL, 0, 0); Then the specified QMP message would be send to QEMU: {"execute": "display-reload", "arguments":{"type": "vnc", "tls-certs": true= }} Refers: https://gitlab.com/qemu-project/qemu/-/commit/9cc07651655ee86eca41059f5ead8= c4e5607c734 --- include/libvirt/libvirt-domain.h | 20 +++++++++++ src/driver-hypervisor.h | 8 +++++ src/libvirt-domain.c | 58 ++++++++++++++++++++++++++++++++ src/libvirt_public.syms | 5 +++ src/qemu/qemu_driver.c | 40 ++++++++++++++++++++++ src/qemu/qemu_hotplug.c | 17 ++++++++++ src/qemu/qemu_hotplug.h | 4 +++ src/qemu/qemu_monitor.c | 27 +++++++++++++++ src/qemu/qemu_monitor.h | 3 ++ src/qemu/qemu_monitor_json.c | 27 +++++++++++++++ src/qemu/qemu_monitor_json.h | 4 +++ src/remote/remote_driver.c | 1 + src/remote/remote_protocol.x | 15 ++++++++- src/remote_protocol-structs | 10 ++++++ 14 files changed, 238 insertions(+), 1 deletion(-) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-dom= ain.h index e99bfb7654..357d3598a6 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -5152,4 +5152,24 @@ int virDomainStartDirtyRateCalc(virDomainPtr domain, int seconds, unsigned int flags); =20 +/** + * virDomainTlsCertificateType: + * the used scene of TLS certificates for doamin + */ +typedef enum { + VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC =3D 0, + VIR_DOMAIN_TLS_CERT_GRAPHICS_SPICE =3D 1, + +# ifdef VIR_ENUM_SENTINELS + VIR_DOMAIN_TLS_CERT_LAST +# endif +} virDomainTlsCertificateType; + +int +virDomainReloadTlsCertificates(virDomainPtr domain, + unsigned int type, + virTypedParameterPtr params, + int nparams, + unsigned int flags); + #endif /* LIBVIRT_DOMAIN_H */ diff --git a/src/driver-hypervisor.h b/src/driver-hypervisor.h index d642af8a37..d0d4976441 100644 --- a/src/driver-hypervisor.h +++ b/src/driver-hypervisor.h @@ -1410,6 +1410,13 @@ typedef int int seconds, unsigned int flags); =20 +typedef int +(*virDrvDomainReloadTlsCertificates)(virDomainPtr domain, + unsigned int type, + virTypedParameterPtr params, + int nparams, + unsigned int flags); + typedef struct _virHypervisorDriver virHypervisorDriver; =20 /** @@ -1676,4 +1683,5 @@ struct _virHypervisorDriver { virDrvDomainAuthorizedSSHKeysSet domainAuthorizedSSHKeysSet; virDrvDomainGetMessages domainGetMessages; virDrvDomainStartDirtyRateCalc domainStartDirtyRateCalc; + virDrvDomainReloadTlsCertificates domainReloadTlsCertificates; }; diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index 42c75f6cc5..1b6889ab49 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -13218,3 +13218,61 @@ virDomainStartDirtyRateCalc(virDomainPtr domain, virDispatchError(conn); return -1; } + +/** + * virDomainReloadTlsCertificates: + * @domain: a domain object. + * @type: a value of virDomainTlsCertificateType + * @params: pointer to TLS Certs parameter objects, must be NULL if not us= ed + * @nparams: number of TLS Certs parameter objects, must be 0 if not used + * @flags: extra flags; not used yet, so callers should always pass 0 + * + * Notify domain reload its certificates with specified 'type' + * + * Returns 0 in case of success, -1 otherwise. + */ +int +virDomainReloadTlsCertificates(virDomainPtr domain, + unsigned int type, + virTypedParameterPtr params, + int nparams, + unsigned int flags) +{ + virConnectPtr conn; + + VIR_DOMAIN_DEBUG(domain, "certificate type=3D%u, params=3D%p, nparams= =3D%d, flags=3D%x", + type, params, nparams, flags); + + virResetLastError(); + + virCheckDomainReturn(domain, -1); + conn =3D domain->conn; + + virCheckReadOnlyGoto(conn->flags, error); + virCheckNonNegativeArgGoto(nparams, error); + + if (type >=3D VIR_DOMAIN_TLS_CERT_LAST) { + virReportInvalidArg(type, + _("type must be less than %d"), + VIR_DOMAIN_TLS_CERT_LAST); + goto error; + } + + if (conn->driver->domainReloadTlsCertificates) { + int ret; + ret =3D conn->driver->domainReloadTlsCertificates(domain, + type, + params, + nparams, + flags); + if (ret < 0) + goto error; + return ret; + } + + virReportUnsupportedError(); + + error: + virDispatchError(domain->conn); + return -1; +} diff --git a/src/libvirt_public.syms b/src/libvirt_public.syms index 5678a13cda..30ff012958 100644 --- a/src/libvirt_public.syms +++ b/src/libvirt_public.syms @@ -896,4 +896,9 @@ LIBVIRT_7.3.0 { virNodeDeviceCreate; } LIBVIRT_7.2.0; =20 +LIBVIRT_7.4.0 { + global: + virDomainReloadTlsCertificates; +} LIBVIRT_7.3.0; + # .... define new API here using predicted next version number .... diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index c90d52edc0..422a350c65 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -20449,6 +20449,45 @@ qemuDomainStartDirtyRateCalc(virDomainPtr dom, return ret; } =20 +static int +qemuDomainReloadTlsCertificates(virDomainPtr domain, + unsigned int type, + virTypedParameterPtr params, + int nparams, + unsigned int flags) +{ + int ret =3D -1; + virQEMUDriver *driver =3D domain->conn->privateData; + virDomainObj *vm =3D qemuDomObjFromDomain(domain); + + if (!vm) + goto cleanup; + + virCheckNonNullArgGoto(params, cleanup); + if (nparams !=3D 0) { + virReportInvalidZeroArg(nparams); + goto cleanup; + } + virCheckFlagsGoto(0, cleanup); + + if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0) + goto cleanup; + + if (!virDomainObjIsActive(vm)) { + virReportError(VIR_ERR_OPERATION_INVALID, + "%s", _("domain is not running")); + goto endjob; + } + + ret =3D qemuDomainReloadTLSCerts(driver, vm, type); + + endjob: + qemuDomainObjEndJob(driver, vm); + + cleanup: + virDomainObjEndAPI(&vm); + return ret; +} =20 static virHypervisorDriver qemuHypervisorDriver =3D { .name =3D QEMU_DRIVER_NAME, @@ -20693,6 +20732,7 @@ static virHypervisorDriver qemuHypervisorDriver =3D= { .domainAuthorizedSSHKeysSet =3D qemuDomainAuthorizedSSHKeysSet, /* 6.1= 0.0 */ .domainGetMessages =3D qemuDomainGetMessages, /* 7.1.0 */ .domainStartDirtyRateCalc =3D qemuDomainStartDirtyRateCalc, /* 7.2.0 */ + .domainReloadTlsCertificates =3D qemuDomainReloadTlsCertificates, /* 7= .4.0 */ }; =20 =20 diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index a64cddb9e7..34dc035d73 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -6704,3 +6704,20 @@ qemuDomainSetVcpuInternal(virQEMUDriver *driver, virBitmapFree(livevcpus); return ret; } + +int qemuDomainReloadTLSCerts(virQEMUDriverPtr driver, + virDomainObjPtr vm, + unsigned int type) +{ + int ret =3D -1; + qemuDomainObjPrivate *priv =3D vm->privateData; + + qemuDomainObjEnterMonitor(driver, vm); + + ret =3D qemuMonitorDisplayReloadTLSCerts(priv->mon, type); + + if (qemuDomainObjExitMonitor(driver, vm) < 0) + ret =3D -1; + + return ret; +} diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h index df8f76f8d6..411741a688 100644 --- a/src/qemu/qemu_hotplug.h +++ b/src/qemu/qemu_hotplug.h @@ -160,3 +160,7 @@ int qemuHotplugAttachDBusVMState(virQEMUDriver *driver, int qemuHotplugRemoveDBusVMState(virQEMUDriver *driver, virDomainObj *vm, qemuDomainAsyncJob asyncJob); + +int qemuDomainReloadTLSCerts(virQEMUDriverPtr driver, + virDomainObjPtr vm, + unsigned int type); diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c index 1e6f892e08..11f8cc8670 100644 --- a/src/qemu/qemu_monitor.c +++ b/src/qemu/qemu_monitor.c @@ -4746,3 +4746,30 @@ qemuMonitorQueryDirtyRate(qemuMonitor *mon, =20 return qemuMonitorJSONQueryDirtyRate(mon, info); } + +static const char * +qemuMonitorTLSCertificateTypeToString(unsigned int type) +{ + switch (type) { + /* for now, only VNC is supported */ + case VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC: + return "vnc"; + default: + virReportError(VIR_ERR_INVALID_ARG, + _("unsupported qemu certificate type %u"), + type); + return NULL; + } +} + +int +qemuMonitorDisplayReloadTLSCerts(qemuMonitorPtr mon, unsigned int type) +{ + const char *certType =3D qemuMonitorTLSCertificateTypeToString(type); + if (!certType) + return -1; + + QEMU_CHECK_MONITOR(mon); + + return qemuMonitorJSONDisplayReload(mon, certType, true); +} diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h index 6a25def78b..f26f92fb51 100644 --- a/src/qemu/qemu_monitor.h +++ b/src/qemu/qemu_monitor.h @@ -1496,3 +1496,6 @@ struct _qemuMonitorDirtyRateInfo { int qemuMonitorQueryDirtyRate(qemuMonitor *mon, qemuMonitorDirtyRateInfo *info); + +int qemuMonitorDisplayReloadTLSCerts(qemuMonitorPtr mon, + unsigned int type); diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c index 46aa3330a8..9934613cc2 100644 --- a/src/qemu/qemu_monitor_json.c +++ b/src/qemu/qemu_monitor_json.c @@ -9446,3 +9446,30 @@ qemuMonitorJSONQueryDirtyRate(qemuMonitor *mon, =20 return qemuMonitorJSONExtractDirtyRateInfo(data, info); } + +int qemuMonitorJSONDisplayReload(qemuMonitorPtr mon, + const char *type, + bool tlsCerts) +{ + int ret =3D -1; + virJSONValuePtr reply =3D NULL; + virJSONValuePtr cmd =3D qemuMonitorJSONMakeCommand("display-reload", + "s:type", type, + "b:tls-certs", tlsCer= ts, + NULL); + if (!cmd) + return -1; + + if (qemuMonitorJSONCommand(mon, cmd, &reply) < 0) + goto cleanup; + + if (qemuMonitorJSONCheckError(cmd, reply) < 0) + goto cleanup; + + ret =3D 0; + + cleanup: + virJSONValueFree(cmd); + virJSONValueFree(reply); + return ret; +} diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h index 01a3ba25f1..73761d54f8 100644 --- a/src/qemu/qemu_monitor_json.h +++ b/src/qemu/qemu_monitor_json.h @@ -706,3 +706,7 @@ qemuMonitorJSONStartDirtyRateCalc(qemuMonitor *mon, int qemuMonitorJSONQueryDirtyRate(qemuMonitor *mon, qemuMonitorDirtyRateInfo *info); + +int qemuMonitorJSONDisplayReload(qemuMonitorPtr mon, + const char *type, + bool tlsCerts); diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 0c72d69933..0e6e4e3007 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -8566,6 +8566,7 @@ static virHypervisorDriver hypervisor_driver =3D { .domainAuthorizedSSHKeysSet =3D remoteDomainAuthorizedSSHKeysSet, /* 6= .10.0 */ .domainGetMessages =3D remoteDomainGetMessages, /* 7.1.0 */ .domainStartDirtyRateCalc =3D remoteDomainStartDirtyRateCalc, /* 7.2.0= */ + .domainReloadTlsCertificates =3D remoteDomainReloadTlsCertificates, /*= 7.4.0 */ }; =20 static virNetworkDriver network_driver =3D { diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index de69704b68..c13b3e1f5c 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -286,6 +286,8 @@ const REMOTE_DOMAIN_AUTHORIZED_SSH_KEYS_MAX =3D 2048; /* Upper limit on number of messages */ const REMOTE_DOMAIN_MESSAGES_MAX =3D 2048; =20 +/* Upper limit on list of TLS certificate parameters */ +const REMOTE_DOMAIN_RELOAD_TLS_CERT_PARAMETERS_MAX =3D 16; =20 /* UUID. VIR_UUID_BUFLEN definition comes from libvirt.h */ typedef opaque remote_uuid[VIR_UUID_BUFLEN]; @@ -3836,6 +3838,12 @@ struct remote_domain_start_dirty_rate_calc_args { unsigned int flags; }; =20 +struct remote_domain_reload_tls_certificates_args { + remote_nonnull_domain dom; + unsigned int type; + remote_typed_param params; + unsigned int flags; +}; =20 /*----- Protocol. -----*/ =20 @@ -6784,6 +6792,11 @@ enum remote_procedure { * @priority: high * @acl: node_device:start */ - REMOTE_PROC_NODE_DEVICE_CREATE =3D 430 + REMOTE_PROC_NODE_DEVICE_CREATE =3D 430, =20 + /** + * @generate: both + * @acl: domain:write + */ + REMOTE_PROC_DOMAIN_RELOAD_TLS_CERTIFICATES =3D 431 }; diff --git a/src/remote_protocol-structs b/src/remote_protocol-structs index 6b46328adc..799a8596ea 100644 --- a/src/remote_protocol-structs +++ b/src/remote_protocol-structs @@ -3192,6 +3192,15 @@ struct remote_domain_start_dirty_rate_calc_args { int seconds; u_int flags; }; +struct remote_domain_reload_tls_certificates_args { + remote_nonnull_domain dom; + u_int type; + struct { + u_int params_len; + remote_typed_param * params_val; + } params; + u_int flags; +}; enum remote_procedure { REMOTE_PROC_CONNECT_OPEN =3D 1, REMOTE_PROC_CONNECT_CLOSE =3D 2, @@ -3623,4 +3632,5 @@ enum remote_procedure { REMOTE_PROC_NODE_DEVICE_DEFINE_XML =3D 428, REMOTE_PROC_NODE_DEVICE_UNDEFINE =3D 429, REMOTE_PROC_NODE_DEVICE_CREATE =3D 430, + REMOTE_PROC_DOMAIN_RELOAD_TLS_CERTIFICATES =3D 431, }; --=20 2.25.1