From nobody Sat Feb 7 08:02:20 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1490314434341471.7511066663835; Thu, 23 Mar 2017 17:13:54 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id B2528C049D5D; Fri, 24 Mar 2017 00:13:53 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 88D2D83EB9; Fri, 24 Mar 2017 00:13:53 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 133BF18523C4; Fri, 24 Mar 2017 00:13:51 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id v2NN2PM7022008 for ; Thu, 23 Mar 2017 19:02:26 -0400 Received: by smtp.corp.redhat.com (Postfix) id F0F00892C8; Thu, 23 Mar 2017 23:02:25 +0000 (UTC) Received: from localhost.localdomain.com (ovpn-116-76.phx2.redhat.com [10.3.116.76]) by smtp.corp.redhat.com (Postfix) with ESMTP id B13AB892C5 for ; Thu, 23 Mar 2017 23:02:24 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com B2528C049D5D Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=libvir-list-bounces@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com B2528C049D5D From: John Ferlan To: libvir-list@redhat.com Date: Thu, 23 Mar 2017 19:02:10 -0400 Message-Id: <20170323230211.20641-10-jferlan@redhat.com> In-Reply-To: <20170323230211.20641-1-jferlan@redhat.com> References: <20170323230211.20641-1-jferlan@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v4 09/10] qemu: Set up the migration TLS objects for source X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Fri, 24 Mar 2017 00:13:54 +0000 (UTC) X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" https://bugzilla.redhat.com/show_bug.cgi?id=3D1300769 If the migration flags indicate this migration will be using TLS, then while we have connection in the Begin phase check and setup the TLS environment that will be used by virMigrationRun during the Perform phase for the source to configure TLS. Processing adds an "-object tls-creds-x509,endpoint=3Dclient,..." and possibly an "-object secret,..." to handle the passphrase response. Then it sets the 'tls-creds' and possibly 'tls-hostname' migration parameters. The qemuMigrateCancel will clean up and reset the environment as it was originally found. Signed-off-by: John Ferlan --- src/qemu/qemu_migration.c | 51 +++++++++++++++++++++++++++++++++++++++++++= ++++ 1 file changed, 51 insertions(+) diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 29621c7..93cd04a 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -3448,6 +3448,7 @@ qemuMigrationBegin(virConnectPtr conn, unsigned long flags) { virQEMUDriverPtr driver =3D conn->privateData; + virQEMUDriverConfigPtr cfg =3D NULL; char *xml =3D NULL; qemuDomainAsyncJob asyncJob; =20 @@ -3481,6 +3482,12 @@ qemuMigrationBegin(virConnectPtr conn, nmigrate_disks, migrate_disks, fla= gs))) goto endjob; =20 + if (flags & VIR_MIGRATE_TLS) { + cfg =3D virQEMUDriverGetConfig(driver); + if (qemuMigrationCheckSetupTLS(conn, driver, cfg, vm, asyncJob) < = 0) + goto endjob; + } + if ((flags & VIR_MIGRATE_CHANGE_PROTECTION)) { /* We keep the job active across API calls until the confirm() cal= l. * This prevents any other APIs being invoked while migration is t= aking @@ -3497,6 +3504,7 @@ qemuMigrationBegin(virConnectPtr conn, } =20 cleanup: + virObjectUnref(cfg); virDomainObjEndAPI(&vm); return xml; =20 @@ -4957,8 +4965,11 @@ qemuMigrationRun(virQEMUDriverPtr driver, { int ret =3D -1; unsigned int migrate_flags =3D QEMU_MONITOR_MIGRATE_BACKGROUND; + virQEMUDriverConfigPtr cfg =3D NULL; qemuDomainObjPrivatePtr priv =3D vm->privateData; qemuMigrationCookiePtr mig =3D NULL; + char *tlsAlias =3D NULL; + char *secAlias =3D NULL; qemuMigrationIOThreadPtr iothread =3D NULL; int fd =3D -1; unsigned long migrate_speed =3D resource ? resource : priv->migMaxBand= width; @@ -5022,6 +5033,35 @@ qemuMigrationRun(virQEMUDriverPtr driver, if (qemuDomainMigrateGraphicsRelocate(driver, vm, mig, graphicsuri) < = 0) VIR_WARN("unable to provide data for graphics client relocation"); =20 + if (flags & VIR_MIGRATE_TLS) { + cfg =3D virQEMUDriverGetConfig(driver); + + /* Begin/CheckSetupTLS already set up migTLSAlias, the following + * assumes that and adds the TLS objects to the domain. */ + if (qemuMigrationAddTLSObjects(driver, vm, cfg, false, + QEMU_ASYNC_JOB_MIGRATION_OUT, + &tlsAlias, &secAlias, migParams) < = 0) + goto cleanup; + + /* We need to add tls-hostname whenever QEMU itself does not + * connect directly to the destination. */ + if (spec->destType =3D=3D MIGRATION_DEST_CONNECT_HOST || + spec->destType =3D=3D MIGRATION_DEST_FD) { + if (VIR_STRDUP(migParams->migrateTLSHostname, + spec->dest.host.name) < 0) + goto cleanup; + } else { + /* Be sure there's nothing from a previous migration */ + if (VIR_STRDUP(migParams->migrateTLSHostname, "") < 0) + goto cleanup; + } + } else { + if (qemuMigrationSetEmptyTLSParams(driver, vm, + QEMU_ASYNC_JOB_MIGRATION_OUT, + migParams) < 0) + goto cleanup; + } + if (migrate_flags & (QEMU_MONITOR_MIGRATE_NON_SHARED_DISK | QEMU_MONITOR_MIGRATE_NON_SHARED_INC)) { if (mig->nbd) { @@ -5202,6 +5242,14 @@ qemuMigrationRun(virQEMUDriverPtr driver, ret =3D -1; } =20 + if (qemuMigrationResetTLS(driver, vm, QEMU_ASYNC_JOB_MIGRATION_OUT, + tlsAlias, secAlias) < 0) + ret =3D -1; + + VIR_FREE(tlsAlias); + VIR_FREE(secAlias); + virObjectUnref(cfg); + if (spec->fwdType !=3D MIGRATION_FWD_DIRECT) { if (iothread && qemuMigrationStopTunnel(iothread, ret < 0) < 0) ret =3D -1; @@ -6906,6 +6954,9 @@ qemuMigrationCancel(virQEMUDriverPtr driver, if (qemuDomainObjExitMonitor(driver, vm) < 0 || (storage && !blockJobs= )) goto endsyncjob; =20 + ignore_value(qemuMigrationResetTLS(driver, vm, QEMU_ASYNC_JOB_NONE, + NULL, NULL)); + if (!storage) { ret =3D 0; goto cleanup; --=20 2.9.3 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list