To enable TLS-PSK-based authentication scheme, add support for
instantiating the tls-creds-psk object through QEMU monitor.

Suggested-by: Tejus GK <tejus.gk@nutanix.com>
Signed-off-by: Abhisek Panda <abhisek.panda1@nutanix.com>
---
 src/qemu/qemu_migration_params.c | 66 ++++++++++++++++++++++++++++++++
 src/qemu/qemu_migration_params.h |  8 ++++
 2 files changed, 74 insertions(+)

diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_params.c
index d551ab9216..129f6540ec 100644
--- a/src/qemu/qemu_migration_params.c
+++ b/src/qemu/qemu_migration_params.c
@@ -31,6 +31,7 @@
 #define LIBVIRT_QEMU_MIGRATION_PARAMSPRIV_H_ALLOW
 #include "qemu_migration_paramspriv.h"
 #include "qemu_monitor.h"
+#include "qemu_command.h"
 
 #define VIR_FROM_THIS VIR_FROM_QEMU
 
@@ -1237,6 +1238,71 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver,
 }
 
 
+/* qemuMigrationParamsEnableTLSPSK
+ * @driver: pointer to qemu driver
+ * @vm: domain object
+ * @tlsListen: server or client
+ * @asyncJob: Migration job to join
+ * @tlsPSKAlias: alias to be generated for TLS-PSK object
+ * @migParams: migration parameters to set
+ *
+ * Create the TLS PSK objects for the migration and set the migParams value.
+ *
+ * Returns 0 on success, -1 on failure
+ */
+int
+qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver,
+                                virDomainObj *vm,
+                                bool tlsListen,
+                                int asyncJob,
+                                char **tlsAlias,
+                                qemuMigrationParams *migParams)
+{
+    qemuDomainObjPrivate *priv = vm->privateData;
+    g_autoptr(virJSONValue) tlsPSKProps = NULL;
+    g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
+    g_autofree char *key_dir_path = NULL;
+    g_autofree char *shortName = NULL;
+    virErrorPtr orig_err = NULL;
+
+    if (!vm || !vm->def || !(shortName = virDomainDefGetShortName(vm->def)))
+        return -1;
+
+    key_dir_path = g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName);
+
+    if (!(*tlsAlias = qemuAliasTLSObjFromSrcAlias(QEMU_MIGRATION_TLS_ALIAS_BASE)))
+        return -1;
+
+    if (qemuBuildTLSPSKBackendProps(key_dir_path, tlsListen, *tlsAlias, &tlsPSKProps) < 0)
+        return -1;
+
+    /* Ensure the domain doesn't already have the TLS-PSK objects defined.
+     * This should prevent any issues just in case some cleanup wasn't
+     * properly completed (both src and dst use the same alias) or
+     * some other error path. */
+    qemuDomainDelTLSObjects(vm, asyncJob, NULL, *tlsAlias);
+
+
+    /* Add the tls-creds-psk object to QEMU */
+    if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) < 0)
+        return -1;
+
+    if (qemuMonitorAddObject(priv->mon, &tlsPSKProps, NULL) < 0) {
+            virErrorPreserveLast(&orig_err);
+            qemuDomainObjExitMonitor(vm);
+            virErrorRestore(&orig_err);
+            return -1;
+    }
+    qemuDomainObjExitMonitor(vm);
+
+    if (qemuMigrationParamsSetString(migParams, QEMU_MIGRATION_PARAM_TLS_CREDS,
+                                     *tlsAlias) < 0)
+        return -1;
+
+    return 0;
+}
+
+
 /* qemuMigrationParamsDisableTLS
  * @vm: domain object
  * @migParams: Pointer to a migration parameters block
diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_params.h
index 14e20fb71e..8774b4596c 100644
--- a/src/qemu/qemu_migration_params.h
+++ b/src/qemu/qemu_migration_params.h
@@ -123,6 +123,14 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver,
                                  const char *hostname,
                                  qemuMigrationParams *migParams);
 
+int
+qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver,
+                                virDomainObj *vm,
+                                bool tlsListen,
+                                int asyncJob,
+                                char **tlsAlias,
+                                qemuMigrationParams *migParams);
+
 int
 qemuMigrationParamsDisableTLS(virDomainObj *vm,
                               qemuMigrationParams *migParams);
-- 
2.43.7

On Wed, Jul 29, 2026 at 08:58:57 +0000, Abhisek Panda wrote:
> To enable TLS-PSK-based authentication scheme, add support for
> instantiating the tls-creds-psk object through QEMU monitor.
> 
> Suggested-by: Tejus GK <tejus.gk@nutanix.com>
> Signed-off-by: Abhisek Panda <abhisek.panda1@nutanix.com>
> ---
>  src/qemu/qemu_migration_params.c | 66 ++++++++++++++++++++++++++++++++
>  src/qemu/qemu_migration_params.h |  8 ++++
>  2 files changed, 74 insertions(+)
> 
> diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_params.c
> index d551ab9216..129f6540ec 100644
> --- a/src/qemu/qemu_migration_params.c
> +++ b/src/qemu/qemu_migration_params.c
> @@ -31,6 +31,7 @@
>  #define LIBVIRT_QEMU_MIGRATION_PARAMSPRIV_H_ALLOW
>  #include "qemu_migration_paramspriv.h"
>  #include "qemu_monitor.h"
> +#include "qemu_command.h"
>  
>  #define VIR_FROM_THIS VIR_FROM_QEMU
>  
> @@ -1237,6 +1238,71 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver,
>  }
>  
>  
> +/* qemuMigrationParamsEnableTLSPSK
> + * @driver: pointer to qemu driver
> + * @vm: domain object
> + * @tlsListen: server or client
> + * @asyncJob: Migration job to join
> + * @tlsPSKAlias: alias to be generated for TLS-PSK object
> + * @migParams: migration parameters to set
> + *
> + * Create the TLS PSK objects for the migration and set the migParams value.
> + *
> + * Returns 0 on success, -1 on failure
> + */
> +int
> +qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver,
> +                                virDomainObj *vm,
> +                                bool tlsListen,
> +                                int asyncJob,
> +                                char **tlsAlias,
> +                                qemuMigrationParams *migParams)
> +{
> +    qemuDomainObjPrivate *priv = vm->privateData;
> +    g_autoptr(virJSONValue) tlsPSKProps = NULL;
> +    g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
> +    g_autofree char *key_dir_path = NULL;
> +    g_autofree char *shortName = NULL;
> +    virErrorPtr orig_err = NULL;
> +
> +    if (!vm || !vm->def || !(shortName = virDomainDefGetShortName(vm->def)))
> +        return -1;

Same as before; this would create a code path with no error. I'm fairly
certain that at the point where this will be called, both vm and vm->def
are guaranteed to exist.


> +
> +    key_dir_path = g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName);
> +
> +    if (!(*tlsAlias = qemuAliasTLSObjFromSrcAlias(QEMU_MIGRATION_TLS_ALIAS_BASE)))
> +        return -1;
> +
> +    if (qemuBuildTLSPSKBackendProps(key_dir_path, tlsListen, *tlsAlias, &tlsPSKProps) < 0)
> +        return -1;
> +
> +    /* Ensure the domain doesn't already have the TLS-PSK objects defined.
> +     * This should prevent any issues just in case some cleanup wasn't
> +     * properly completed (both src and dst use the same alias) or
> +     * some other error path. */
> +    qemuDomainDelTLSObjects(vm, asyncJob, NULL, *tlsAlias);
> +
> +
> +    /* Add the tls-creds-psk object to QEMU */
> +    if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) < 0)
> +        return -1;
> +
> +    if (qemuMonitorAddObject(priv->mon, &tlsPSKProps, NULL) < 0) {
> +            virErrorPreserveLast(&orig_err);
> +            qemuDomainObjExitMonitor(vm);
> +            virErrorRestore(&orig_err);
> +            return -1;

Block indented incorrectly.


> +    }
> +    qemuDomainObjExitMonitor(vm);
> +
> +    if (qemuMigrationParamsSetString(migParams, QEMU_MIGRATION_PARAM_TLS_CREDS,
> +                                     *tlsAlias) < 0)
> +        return -1;
> +
> +    return 0;
> +}
> +
> +
>  /* qemuMigrationParamsDisableTLS
>   * @vm: domain object
>   * @migParams: Pointer to a migration parameters blocka

With the 2 things above addressed:

Reviewed-by: Peter Krempa <pkrempa@redhat.com>