From nobody Tue Aug 4 22:22:05 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1785315758; cv=pass; d=zohomail.com; s=zohoarc; b=OTyOiZNVs6e/x4GW77NQ6L0WxMVwIGHihddhfGWWtHzQgV2IqtO/sIg092qLilrXZEK9cC9lTVcN8mHt/dIqQEtCfvptTRM7z3ng5upaGHUDrym9PM3qbIVoNeMeGsYRV26TzuWQTEYK238kvBXzisxwEBt1Y3jP3hpG/3TDQdY= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785315758; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=r7y7pHtgCNS5DISAmPDjCPevDPMcW6y3s2c27/3Kd54=; b=IuMeUdyNYJPWNwVCCT+2weBq7+c8xT04vpwnxIaLl32VOH86w3UykrBYdYzAwDanQrAEjV+umvDv0iz0s39zBtZMGSihPW8PRKQUQtCc4iDKwvVRaaBEC0hC7L+Ob5fXllHXGFBbKxpBbNp07BLEnUieamN878hKGmI3+L43ij4= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1785315758055830.3396926460154; Wed, 29 Jul 2026 02:02:38 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id B4D3C41BB4; Wed, 29 Jul 2026 05:02:36 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id A7E1541995; Wed, 29 Jul 2026 05:00:21 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 15CCA419E5; Wed, 29 Jul 2026 05:00:12 -0400 (EDT) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 99BC741D3E for ; Wed, 29 Jul 2026 04:59:36 -0400 (EDT) Received: from pps.filterd (m0127841.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66T7cCc82332798 for ; Wed, 29 Jul 2026 01:59:36 -0700 Received: from co1pr03cu002.outbound.protection.outlook.com (mail-westus2azon11020101.outbound.protection.outlook.com [52.101.46.101]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fq2c7hg7m-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 29 Jul 2026 01:59:35 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by PH0PR02MB11606.namprd02.prod.outlook.com (2603:10b6:510:3b9::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 08:59:33 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%4]) with mapi id 15.21.0270.009; Wed, 29 Jul 2026 08:59:33 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=r7y7pHtgCNS5DISAmPDjCPevDPMcW6y3s2c27/3Kd 54=; b=LNFUAW0YXBhWTmi1ky2BgmZ7NVFzljmcy5zakzugT9DSbQB5v9cZM8yaD 838N90okBBB2MowaOjwCbMsfZWrBBeSe0AJ1J290oAqNo3OJWQwAgUAzvYDVmaYO oexioxYYN5WMx8qGJy49uLO2BSY9tCbmrNeQCXWUzt7cRLU4UTmVBPSo/EYvkUKN BRQYSEktzBYNcpy+rYa2rrffvXbmr95GD1YXOH1KRRH2jTfggWjLBibpKKOLB/nj AARfwotfQ9BVrjuLufxtG2tS3ZdYO2A1t0FJSvrk1Xj21I4c0MadtpDsK++zjE4+ FURZqjXS2bz9LoJnkDlmscf00A2vw== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=DEMVujmvj5BMfT+tJAWuzRv7DQDcuwrPes9mXKFDdcu7S2V+4DrbFJjmamEJlpJ4hjkbxAgjUNp6pusTpyDB3q2Lmn3D05vPYk/qutGiCeDo7a0yeS2NKOlP9suq5U+/L4KSiKCNjNZT5S882OSKKEe8lRhr2fgMGpD1q0HS6Umj5+u++GwTWSVDBKBpoAooQHxGH8IoTBNF0uLPe21e3NXrMCRr4HsSdTksXrw81O6qOcdP4eok2b1uZUBZfemBjZGd1HauL5zne6oprxr89r6mBy3IDi5QjPfe+9fIMfqzam1edvOR8vW4LwwfHci/706uUrSt+mFHcFp4XLAPrg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=r7y7pHtgCNS5DISAmPDjCPevDPMcW6y3s2c27/3Kd54=; b=lNf1kKnEyJFRTQPEaIJUiRgue7dFkM8141o6IC8rHmqA0UhX/LiSNFT/F463Cv3J14WHO6+w8HgFiHGOtceCSf7ux4W4OjByZ8uQ7zfkO0w/6diW40sCf8+OfDu290HoWCAaWvx4RUnp3/hZRoyk7Nm3IA6apDWaZUatTxxF1eMgcP+rf9wl6YAtvf1b24m1IXfXprj3utRz3vxfuMjUjUlwLO42keYdaTMYlNDW2gAXfvB5Uv+IEl1m0LoofMYAJaz1ZhNCzud57tVzz7kpFpHBoJYNbwgjWOnQnNBbhkoYW3hBB+ymR/X+C2wfNEtz6iQmE/7nNiwnsPoG51+Icw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=r7y7pHtgCNS5DISAmPDjCPevDPMcW6y3s2c27/3Kd54=; b=GPOJfDaYQZ0jR9oa9hT+BrzKtZzyDXIwnQ6RmSqV3GpR6sq0lwBMxoGm0rdx9tzJT74ZfKG3rKeIcaKD/EiXZhF9d5mTrsBqKH7mdE7XxDIqMHzcVIMdHoG/ZG5r6YJfA05o2stSlqa+YBGKwEMzKlQCMsGrcJ7oalibMP1gVlYI6LuPF6QGOCLCb+kbU9KCQMyQEWWcvGbfTIb7XHG+cam3J/GY0/90Eg84Mrvk1HQjdBOyV033rx4WXmn+jxtIo1oM/J6lz4KKCfjfuhVZ9DlAwavaovEEnoRKLj0J+Y5yZ3K0YlPe2LtDGxP7iCT8NP0haJ9BP1f4SLYxs5kZyQ== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v3 1/7] conf: Add a configuration param for TLS-PSK Date: Wed, 29 Jul 2026 08:58:53 +0000 Message-ID: <20260729085917.3243911-2-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> References: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: CY8PR02CA0011.namprd02.prod.outlook.com (2603:10b6:930:4d::6) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|PH0PR02MB11606:EE_ X-MS-Office365-Filtering-Correlation-Id: 59f81c14-e256-4aae-4efa-08deed4fb55e x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|6133799003|3023799007|56012099006|18002099003|22082099003|10067099003; X-Microsoft-Antispam-Message-Info: svbnkXtmnHdKVTJ2dqhp4FZE7fOEKdtHfGlOI9mq/4MsSjcI2scocjJ7ZAF4QB9IA98fBjcoMymf6SYCtw7COUWy7X470WbM9Hp+jY9ukyzgzJw624FrRzTt12tiLs/oswn5YRX1RzB4rWbXZ4k4Jtdwd3qQkJEd4Kz/CL4YhKXoBD9lsgrRV7hNFOaFstC+CatUsvgsuUO9tYZWCd/X+uWvMFVM4LqjIii6/Y9sGfjiSu1aZpBWrZiOO2m2f0IgTgPiUdJErcw1l5OZfZK9g2WxMwuOMOVJLNqW5zAOO/effkAWNcUdkNTz1POXwsWUSvpV2EDH1SAbGrE6q6YJ0ZNxFk3R9LcfdUAG2JD4md22ZBQSi/qmOrcPMPdqGHQ5c1+/Cdl7JmfAALstLfwIDyyS31wVvySN/kS0TFiOsY8mAbvflLS9sEieYzvDX7yZlFgsc6h6ri2gSzEnJjPS/BhEWL6SI5oILLuLJptRyUCddmvYP9Yqd0WjOvdf7LugbFWATG5fpOGtKlPv5+iHWxGuzHHYfaL5KAvlhMdzn8wNAtODF9WLiMx/7Cr0NnsfH3Qs/tjIvQxMrWnBuoGEnBa7UW2zPwW4cEDyOUwdWwElxGsctcV+VIrrEnx7gZ0btPOuRmgfi+RUSSb9+d3Bj4UKGh6kIi+Wr8irNLy+Oxg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(6133799003)(3023799007)(56012099006)(18002099003)(22082099003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?VxKQlU4R5Q75unLBB3cIJvEliDrESQgZxtjkqFGyR6kejxTEbBqZ4nDUBTkR?= =?us-ascii?Q?fRjA7gSu6tFX/T9BhSuqL0QbctUQdFzc1zEPn9pHso9OFENPOlHJa3KnLcMh?= =?us-ascii?Q?ym+fABqFlca5O8oKJMB6ciQGcdndUzOFSd4c10BEDozCyOK7/9rlKysgMvog?= =?us-ascii?Q?18QdSHzWrlTqvSRKVQo7PndL1vWVdMOV0eqoCPVE982glsJJ+ZZfZtYj/KMv?= =?us-ascii?Q?eMnb6IHgvPwhHrBwdLhpQB8f+9y7sb3t/uPRboZQaJOtEkhRN/Mxc4gCxRhi?= =?us-ascii?Q?3RZM37vadDr+b0uLIOphmr7BjanMh1teC6V+2+TdcJGOTo6LHQRbYIjvnicC?= =?us-ascii?Q?70Lp5LgXC+hFfpMdQIFXuJQmwrApszt8xQfLvXR1cvl0v0kqGBtZTgHIDIXI?= =?us-ascii?Q?89X4KnGdOvnKnPNnHq+lijI6EW4JMubCYQgYWtJfW5AhTygq4M43Q+0CdFns?= =?us-ascii?Q?qDG21FUKy+e4K1osrDdyoUpi17YQshQYAw1aQXtN3dFQJl7+BNxefQyZ/p1H?= =?us-ascii?Q?53crZq4lOti9yHlbhnLaBMusp6kYR15ve+kZefmWQNlklnUF0xVOSGZIntUF?= =?us-ascii?Q?LIpstvlf2Na/+XqPlyxvodZps8Zi3KDrnyvCT6LairXdGzkOGRyiQqGahmWG?= =?us-ascii?Q?q5E0SrRZpJdbLdysIuR8C0/sbYCEsui8gmea9BUqhwYUTnosrRjloeoMqjqM?= =?us-ascii?Q?EwiHKal60HZGJ2ohwkg5phvBeSx2okZBrl2tEpMmF+joGJ1hO/OdzdZ+ZQrS?= =?us-ascii?Q?jWPRaFG3yqgLc1CwsTBgVjKZaKi3dd8ACuoTFPC6qD7VN7gJ3IuQGZMCpNxS?= =?us-ascii?Q?HVd73I9h0rPXxOnlnL+1j3MiDIDVNM4NQ2PZXV+ElocGz3wjRZC+JUoZ+/Hv?= =?us-ascii?Q?aDzyjXaxL4NQWpRBzjnKwDOVYUyYcF57IwxWsjXzJ+BetSFhOdnWyKTbYlZU?= =?us-ascii?Q?+ZIk+MJjuNKXA5RJi+Ii6o7R4RgQaHheWeS9geowuwdb6akOFjTOwW89aw0n?= =?us-ascii?Q?oTeHNbo1thmq9nC0dEGqlXIkCkYUKhvxFSgIU/w+bQfOXWX/Ge4B7WY/cC4w?= =?us-ascii?Q?v3sn5KUJVb01zXX0FQ0+PBihwMTfeDrmHo655LJROIWEPdHOuIabg8X8wlGq?= =?us-ascii?Q?4NheNbjoKl+miX7/NusvfZ4FKbn5TQ8ryZwAUAfhmpKdyIhMLoSChWZIGmr5?= =?us-ascii?Q?BrmkCUFJv8R4bF/d4R1XtwkJHBh7HQkJTsSgSRXeEOvoKiWkBIWTDMYnnYSU?= =?us-ascii?Q?+hinChgsVRzB0w+H2Xm5bteoFNcomDEGeRsJY0uMjViMn+ILCBjdycRAqKyb?= =?us-ascii?Q?uS5XDk3mHd5LVEMFEVuWyvUBzIfcT/SYTMruYy71ucbzoIHZA/vGn1bvpxRW?= =?us-ascii?Q?DgrWnWVy4dGaverUHTnTrDNOonQoum01eBwttqLfpOi3m1GRqPGOHDBMwXJW?= =?us-ascii?Q?PRpMZ429efK/WydgCZPCzzto8U4IPQaNrE2rNQAAPJM7Mwnp8L6qjeDcGcdM?= =?us-ascii?Q?Dfdjzxy2zcfiC6LZoWPfNZJXBKPgMn8uEIRdjcbR5fZ6JifK5/AycJHhZtAA?= =?us-ascii?Q?3jAEHoykJMt3Wd6eE4kza7/MVkniJQ+Rn5cfj/t1WCWd31YFSiFx7lrYhXy+?= =?us-ascii?Q?SdfTGQugzh7i2qxFmbpp0a5Zy9fZNIP0vqutudhyTImIB2UZPBRl9cizgZGO?= =?us-ascii?Q?1AURWx6GBx077rhxjQt4varMW4gus+K2Lr+94Ur2N0aMsSMGff83dXvwH9E2?= =?us-ascii?Q?OEq29sEZ/uzc8JKsW2A4bPY2xOX/ttc=3D?= X-Exchange-RoutingPolicyChecked: lp+84ukoyGDelVR14UBUOU3qXaukOH9eK67M0t6IvwdJTJ8GOb+Edjgdx7dirtu1DAab73VuFP1S+jvRbJ/979W176F0soTyo0/h7DJylEAEqoC/A6hZkF+Wu7SznkdUUw6NnhGfzcXdhJgpsW2F/21Mypz3zKa6WwCh5zxT/+yQ48aathCPOe0qlS/zcj2+OewxCS4Dr+AGJul+hIG2j5avaRMv1cdB7BzXSJzyz3/qwzqIIkf3OpAQbo8THD5FqEna4g3mHRmllyuDJZt6z8HiOHd4zsWFE7v2IiMsIARNgkHMDdBTShIV/MPwRCUIaddZ8Tj9Uu03TupAMxIn3w== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 59f81c14-e256-4aae-4efa-08deed4fb55e X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jul 2026 08:59:33.5102 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: +E0ESZWbT01Gp/FeHQQfAA04pZW4HtH9Qx2+xaKWmK1Y3ozPt6eCNeflf3ys78GnyFHeN/izSgxfq/i0fs6oyJb+1uqPkPJdzqJIvdRECG8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR02MB11606 X-Authority-Analysis: v=2.4 cv=SMBykuvH c=1 sm=1 tr=0 ts=6a69c0f7 cx=c_pps a=hSUXT6xmpWUQcPkODs04Ug==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=jxMXjlTPpCISP5mWtjnE:22 a=64Cc0HZtAAAA:8 a=-2AbmpwzriJMpJNtN8kA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfXxNy6/hE2d0Hs dFLQSFCMzqWMDNs+3DkvwxK4oS1hF0MCq2nefxvECG72Uddy+IAZGZaTIXsy/inWtz1hF04U40Q AS+MN6EAXL4GyNhRcvBrGu/hQA+V0ds= X-Proofpoint-GUID: 77-uNyCnI2qRtsj0zZQhOweiXUVsux-b X-Proofpoint-ORIG-GUID: 77-uNyCnI2qRtsj0zZQhOweiXUVsux-b X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX0KSjC0aXhTNI eogwsfX8uE+HyaAKvhO8QzmdKfWXtl/F/KX4L31vyrpTct9YvJJRwuC06grdPYOAm5jygU39phe yQ7/dz5EgRDYJAlKoS+o9dcw5CG+0p7kjQ4DbqajHvf3uMYoMwZGiEr8tfsHu3OFB/9wSP50b2I voJSnYlW6VX38rHdCCIm+xy6EvQ1GnvQLngC/rxXPAcAKrHNDF7W92lJUXvOx1h0ePAUIlXBSx0 hAx7Vw9kw/XNL88U8o4mFSFI5GS3Wss/tLdphtSVtuDynbVYfHZFHW3jHVeL/6u0y8jGp3Lewe6 wBECuz7ZfK58qfIzR489/nZosBax9u1C57subGTXe2lphEV+iMGiTU2yaYQ+rwUZ83TPHEgYOXh nJWbi/Kmm64ciuKoyWigyl38BC3ErHqdIlDEMwO6uOMBeuaIV5ESx4w6aJPp4WLsJn5SkY6FlHU KZWGJtPA29O3amYrfmQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_03,2026-07-28_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: HFJXLOUQ4M7H634G57ITRAUFJ3OPOBDK X-Message-ID-Hash: HFJXLOUQ4M7H634G57ITRAUFJ3OPOBDK X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1785315758853158500 Content-Type: text/plain; charset="utf-8" For encrypted migration of VMs, QEMU provides the TLS-PSK authentication apart from TLS certificates. This mechanism relies on pre-shared keys (a secret key that is known to both sender and receiver prior to secure communication) for providing secure transfer of data. Libvirt handles the lifecycle of pre-shared keys, managing their generation, persistent storage, and cleanup. Add the "migrate_tls_psk_length" configuration attribute to qemu.conf to allow users to define the size of the pre-shared key. Signed-off-by: Abhisek Panda --- src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf.in | 8 ++++++++ src/qemu/qemu_conf.c | 18 ++++++++++++++++++ src/qemu/qemu_conf.h | 1 + src/qemu/test_libvirtd_qemu.aug.in | 1 + 5 files changed, 29 insertions(+) diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index 311992e441..d58f995282 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -68,6 +68,7 @@ module Libvirtd_qemu =3D | str_entry "migrate_tls_x509_secret_uuid" | str_entry "migrate_tls_priority" | bool_entry "migrate_tls_force" + | int_entry "migrate_tls_psk_length" =20 let backup_entry =3D str_entry "backup_tls_x509_cert_dir" | bool_entry "backup_tls_x509_verify" diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in index 97b0141cf6..7f36bd1a68 100644 --- a/src/qemu/qemu.conf.in +++ b/src/qemu/qemu.conf.in @@ -437,6 +437,14 @@ #migrate_tls_force =3D 0 =20 =20 +# The TLS-PSK authentication relies on pre-shared keys for providing secur= e transfer of data. +# When TLS-PSK is enabled for the migration operation, Libvirt manages the= lifecycle of the +# pre-shared key files. For the key generation process, users can specify = the pre-shared +# key size in bytes. The default value is set to 32 bytes. +# +#migrate_tls_psk_length =3D 32 + + # In order to override the default TLS certificate location for backup NBD # server certificates, supply a valid path to the certificate directory. I= f the # provided path does not exist, libvirtd will fail to start. If the path is diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index e30b146634..986f01ddcd 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -77,6 +77,9 @@ VIR_LOG_INIT("qemu.qemu_conf"); #define QEMU_BACKUP_PORT_MIN 10809 #define QEMU_BACKUP_PORT_MAX 10872 =20 +#define QEMU_MIGRATE_TLS_PSK_LENGTH 32 +#define QEMU_MIGRATE_TLS_PSK_LENGTH_MAX 512 + VIR_ENUM_IMPL(virQEMUSchedCore, QEMU_SCHED_CORE_LAST, "none", @@ -616,6 +619,17 @@ virQEMUDriverConfigLoadSpecificTLSEntry(virQEMUDriverC= onfig *cfg, =20 #undef GET_CONFIG_TLS_CERTINFO_COMMON #undef GET_CONFIG_TLS_CERTINFO_SERVER + + if (virConfGetValueUInt(conf, "migrate_tls_psk_length", &cfg->migrateT= LSPSKLength) < 0) + return -1; + + if (cfg->migrateTLSPSKLength > QEMU_MIGRATE_TLS_PSK_LENGTH_MAX) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("migrate_tls_psk_length must not be greater than = %1$d"), + QEMU_MIGRATE_TLS_PSK_LENGTH_MAX); + return -1; + } + return 0; } =20 @@ -1594,6 +1608,10 @@ virQEMUDriverConfigSetDefaults(virQEMUDriverConfig *= cfg) =20 #undef SET_TLS_VERIFY_DEFAULT =20 + if (cfg->migrateTLSPSKLength =3D=3D 0) { + cfg->migrateTLSPSKLength =3D QEMU_MIGRATE_TLS_PSK_LENGTH; + } + return 0; } =20 diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 1d29f35c5d..c18aedf59c 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -170,6 +170,7 @@ struct _virQEMUDriverConfig { char *migrateTLSx509secretUUID; char *migrateTLSpriority; bool migrateTLSForce; + unsigned int migrateTLSPSKLength; =20 char *backupTLSx509certdir; bool backupTLSx509verify; diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qe= mu.aug.in index c4cf9cf634..7e337825fd 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -45,6 +45,7 @@ module Test_libvirtd_qemu =3D { "migrate_tls_x509_secret_uuid" =3D "00000000-0000-0000-0000-000000000000= " } { "migrate_tls_priority" =3D "@SYSTEM" } { "migrate_tls_force" =3D "0" } +{ "migrate_tls_psk_length" =3D "32" } { "backup_tls_x509_cert_dir" =3D "/etc/pki/libvirt-backup" } { "backup_tls_x509_verify" =3D "1" } { "backup_tls_x509_secret_uuid" =3D "00000000-0000-0000-0000-000000000000"= } --=20 2.43.7 From nobody Tue Aug 4 22:22:05 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1785316380; cv=pass; d=zohomail.com; s=zohoarc; b=LtNnLmLf0Qyq9HpNv2UKlBeC9+4g5LO946GFGzF7RBk6FNf8l/b17QBgoPx6roG/AvLKvWPrBIEFVk+0L6nhLIHJ45a5DTcXx/G2cKqkA5ymRdMMZ/xrrC/rq86WcTKJJmHgJ+X4ZmK9GJK41jgtMz9mExtzBLtp1VcZ67TJPmY= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785316380; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=ZQW7vASLL19vVPwuN/IUwf1tzZRYF8T8FJo5c+dKQS8=; b=DM7emrQjHiVoHkBH7M4vsdLAYlIhXYQKgIIKr0PGlUSHufUqJRq5/x7q1V92Okr5mneLmmf6m0jd9qr4cVR7zI2qlu/5jX922rg3a5JcLaiXtQJLLhvvNc3rvdwydvWz6Db6t+Mb+oMqh7mWnNs0CPWOXgwQ8zhmZMk+EVE0nB8= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1785316380225883.7771169922642; Wed, 29 Jul 2026 02:13:00 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id E62A63FBC4; Wed, 29 Jul 2026 05:12:58 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 54A3243E62; Wed, 29 Jul 2026 05:01:47 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 81C8E41B57; Wed, 29 Jul 2026 05:01:03 -0400 (EDT) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 9DA3441B57 for ; Wed, 29 Jul 2026 04:59:39 -0400 (EDT) Received: from pps.filterd (m0127842.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66T7c2DD577771 for ; Wed, 29 Jul 2026 01:59:39 -0700 Received: from bn1pr04cu002.outbound.protection.outlook.com (mail-eastus2azon11020081.outbound.protection.outlook.com [52.101.56.81]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fq460s7vw-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 29 Jul 2026 01:59:38 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by PH0PR02MB11606.namprd02.prod.outlook.com (2603:10b6:510:3b9::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 08:59:37 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%4]) with mapi id 15.21.0270.009; Wed, 29 Jul 2026 08:59:37 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=ZQW7vASLL19vVPwuN/IUwf1tzZRYF8T8FJo5c+dKQ S8=; b=nU2Wvw9341VxE1kENUWoWgi48/5YiZPo82n8DoSErQMol2nVggpAJ+I4F Vq5RkmR+7QHkxsVswIUjGAn8UkDXkvISbsP1fi9bN5dbJrS4QHrKx4OWfx4MZyaL nGKG9BdUPl7gd3AxIGddnsGL32zT7ifqTVHtq4xd54kx11789FoO9k9FmZpATVbu Z8BYche1rwy7ipKdafGInA3cxV4/EIw2yuYKux1E6ljMr14QxU9WRvB96QVBcGky Y1tqDk3zypwKiPOyKLKuKmBjP6fadl73+HRhzUTzgT/2X3V0NL7giHE/0k9RNy1n +4igmWPXDF+e6Xwvt3s+NVfLLKwrg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Pbz+jfgWLC92aNG6helQMQwjkx20h8VpMEOrS347DdpFRWezN5r86SoTn4NRkJHILoYH373a3z/M//zfqU8o6qeKIabTlUdYEOC6CuTkrJh0I0lr8spXkENoQZqSxbHTUrf50NyQMNjpJeXccYybuI5ncUgeRwkOTqo09xtTkC/aEL0eC6rKWIivX/tPdWy/GIDBuDIcDqB0/VPVZeWl0G50HyelpXRst+BIYzPmJtFv4btIkSiVqekN4WIhrdX49Ouks7SOVe/it5g1hFADwRKHgQ+TEM1L6P2NdI2nU7B2TGn8xS6boZ8lnp0VV1ZxWq1GZmFaX2QXLO+kD14laQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ZQW7vASLL19vVPwuN/IUwf1tzZRYF8T8FJo5c+dKQS8=; b=RiB//WVX9z6FU3XSfECv6oNZStPcszXd0hrSDoeBEwk3SIitAGI11l2MKJCsPrdegwCvuHDzQMr2fj0A//vxQDxVZ9Hu7dwjy6suOepMftLaX6WBW7WDw/0+Z7LT0oIvMG7KxPExH/rqwRVGnuH0esJqcRp7WylivRQQdu4B9DVvKRqr615c6CLI7oxqCuag8Wkyaqci3VhT8o/flUApf04Q2A4sx66zOr+Yzp3tqjz4rHwLbp8JIF49Upe2wCGJjJ4BMbqoDnl/JHXeJKA8FUpoGgTmZ+iaGz15BT8aNg+jNGyAYUhMEE0harQWfsQUTT+eZ885OZlRAOapDpm8dQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZQW7vASLL19vVPwuN/IUwf1tzZRYF8T8FJo5c+dKQS8=; b=DcjPeaVS4Qv3jl3ecNOf4/SdYfqQeapKBGd6Cwu2o+kjhnFVuAKi2JXj9myjsY/Rwg0bqJBgyVN/+BXw1vLP2D3LgfjFRtZnPwGpo4ewHYfCo3uWDXXvrY87S+R5TofbNTmMqvy+A22f4j5M1GtZ9foALVL0YJQ/pPZQKpauU6He0Ja0BMH3sYwdtgsSrLbvyadoRwP3UAhsHjKanAaJLOggWkkauHqJ+vQb+TU+bxzZwYjTuFXOu00LU5XKNuAH8TpcjCvkAzq+K03R2M9WAB8hqTeKiBSJ6giWkSwr0oM+AspJZvC7Iy6PCyFah5qNnJlAIJ06colG/JxEN1QtLg== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v3 2/7] qemu: Manage a pre-shared key's lifecycle Date: Wed, 29 Jul 2026 08:58:54 +0000 Message-ID: <20260729085917.3243911-3-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> References: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: CYXP220CA0008.NAMP220.PROD.OUTLOOK.COM (2603:10b6:930:ee::15) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|PH0PR02MB11606:EE_ X-MS-Office365-Filtering-Correlation-Id: 683f455d-c2e5-4148-db1c-08deed4fb79f x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|6133799003|3023799007|56012099006|18002099003|22082099003|10067099003; X-Microsoft-Antispam-Message-Info: s7lBjvPQVoj+jHFnduDuEodjXgCbi0IwrZi8Of+kZeuvAJdPZj2uYA2MAk8kvCkhXDUckaP2Dyww5Q2jrWkq7YlU+UZYaTIaMwa3dJa1zUhbFjnhpZgQP8HPzPX7VFI22yF+iBO3zbFeXqGTukdGl41FmpKdpiCHQ0bbmEl7PSKyBgGcAf1DokV0RY6baM4gt0rzTokIEEXuPY37xC73efSfwVQTt5nozw0hFL5naXEXM5R10fqx49/rzRO4AO39pY3rJ1ds9he76Er7S274oReHzLKH1GaYUfyZC3wdBmwkCejT0I5V/bUsIqmRfMfD0hMsGEvnk+XwKkF4S07L9mBImdssp6XdeA5tIqPegnDQFuRR4UZqcJWto2yskuTd9mEx7QOUElt1eqanmX5087YbMRf/OdDT1hzMN9aB+J9eyxjZS+vBZ2oO6vbpWxLglbiwg3ld1lAGZ80UcL/PKQlORhpfoMrSwGe4vnlsBECTXBSRreaIkXytEvjs5EOnjHivDIwxqh3dxkoBzpQDqV9XV+U6WZKQwEgSrV/gMpas3PyVAQX5/lYjaXavKtt8sBryMNN5rNtzSyQOj2uFT/zPNsyWGIIBHWYeyMpHaFon2FQzuDbRjKNYs+5A3Lo0PEIhj6jufRPCZRuzdpzEPWChEFc+FYyH8iOBTa/SbWM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(6133799003)(3023799007)(56012099006)(18002099003)(22082099003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Rm8JGjr5ZcK2qAdYIXC21z7nNr3Q7fvDDxvS4YpKxxgU9gKscqqEAaLj4WMq?= =?us-ascii?Q?G1kMXs0r199ld2F3IrR/IzTuQ5BCqz4rhZCd3IlggWodSIvHFRRdk+1TGdi6?= =?us-ascii?Q?FW8/xKYxcghXxSMk0aUxaOWwXwidf3iL49OVm45biE28n2m4vShJzG/f1zFH?= =?us-ascii?Q?vDqMVE6xSzyAlk9tkONUBriTP72XfpwmK2j2da79yvinhNUluDwHduLFDbDS?= =?us-ascii?Q?VxV6ve4pxjbsTRUOwscpIG7/0nWZTs8XlGDNTyMIQ9gnc8nJpjThuURQpFvC?= =?us-ascii?Q?69WehA1aJjxcvf/WQtethRBhW0NgrLiMr8JBhnuJnYhClZ1CxNNyRw8kqoU4?= =?us-ascii?Q?abXuWuRP5nzsYU6kUlrOqrASfRcdv0NP0UYjzq9yTAuk5SJyYhkpO4e2gbuZ?= =?us-ascii?Q?x6To6epg8JE09XeBf+QmOcxKmrx5jOr8vPmch/GNwbA4ehym6ZKZnu1A8w5R?= =?us-ascii?Q?5sBQ9LLr5lVtotdAFtfFYilK/O8vsYw337TxjfJJDlBO0rHmNfhKegHubVt0?= =?us-ascii?Q?oLJoenpKHuLVCZEGtetqU7hyg+YU+HvoNsoEO5u+w0OlJTvfXr9y8oO0BfHM?= =?us-ascii?Q?dO0hITj7RD+zZBjtuDgk1LP2KNBUUHcIdd1tjGdr1QGHRT34UZonuBtroIS9?= =?us-ascii?Q?FCC655Ng2h6dRo0S2je0tyE2lZFmrtXAiBoG4j4ohCm1g5pcSLDp0TMf21w1?= =?us-ascii?Q?YWzM+1lCxANY8EruRSP0G4n/nog3U7PeQROZvhBrIjK4Pzg3zPLxEQ9ZUtwr?= =?us-ascii?Q?j7mm1fgrFMvwmpZw0FyNi6sIcXJtNZ3zPMp1RmUuCAEn0VQsWGCUo0p0/H4m?= =?us-ascii?Q?JDm8zp+RhZwCLIYkU7AIaK0k9t02hA3FnUj4ricGINfnLI7Hrb/SC6MkLrCf?= =?us-ascii?Q?Pwsvvejoh83wQxTjmubHq5Rs4BOsemX0TIa18F3NtJsLH2t4buEFW0WoLO09?= =?us-ascii?Q?ufxskPFje3eyS+3AqJWVJT7Fi1jxXFE32N6YNvWqImnQnO6Iy4zn2PdgPbMn?= =?us-ascii?Q?9r1h+QIzMkSpKoilfpi9tXoucRIf+2KQ1zrfV2+uN9D+GdzQsa8jyH7990G8?= =?us-ascii?Q?K+MVt+/8hg7H6R9e0fmkGYKE9clP7GSwlizj/MxSQla0fwcKSMtmqp3tNm+N?= =?us-ascii?Q?GBm6iWOCIE4tWFsn5sH/XrWe36iCwUkhYwlPZnQ+hSlX6V6yU4UbUul+ll5y?= =?us-ascii?Q?Noja44OMsDTPjd2DJa9bljwIm3tbcZDi7koVeBrg44DD9m4KhhRKWAWeV2Gt?= =?us-ascii?Q?RgZIwEnZehlYjbh5Nk6a6I2AWy2WAvTTzJlRqgH9H+Wm2+CVZWcUXuQqHWyY?= =?us-ascii?Q?4QlKmVEDdxGDzz3+tV2lW0WW/EWPeGe9x7O5JUl0bslhWrbGMzf8sX10pdxh?= =?us-ascii?Q?joHHPK+Wwu/MN2BHWOIQ6UCTA0UILJnuX5bqJucMFIulcNgSGWwH+6UTsoO1?= =?us-ascii?Q?JmaEJModF5apiSSccunpiARFFA8IHzSR3YDgVtqO8zp1OwIJLm00sxERGFlJ?= =?us-ascii?Q?WdGzBPwcW+a0PYwqT1Z20AvGlPcMQ+ZEET1onU7597yUpSlEiuB5oCwxpqvD?= =?us-ascii?Q?obwfGIK2430Kfl3+qvnYWJzulbKHJ5w3ohwKeeCY4XW4AtyQpnWeI53tghhx?= =?us-ascii?Q?93JArBSowLnpNW+WYxPLVl6avJTufeVwIgWaNtiAuVUPhzZvwagjxkvZZxzA?= =?us-ascii?Q?PfgThRkejDvaS9cH6Xk+459BQJQnpF2fdSZh64ZJTE353JPfKjYaxRqLEN8X?= =?us-ascii?Q?Yv+u+vMARHaSXZeYq+ihwKGJjo38HEY=3D?= X-Exchange-RoutingPolicyChecked: Y/9DtycycvYt0Hlav39B21mnSNS37piMhDmc8xi8aJQLYrrH7glXl3SkSyox9WbuCOv6I9XEVUQBec3EXD4vtBhv2xgIDmNC+cJMaKYiD5RxxsFImWkOCPEK8K5EtbQTaDZjaHDAq5Vk1zg9XOutJyqzxUtEmQkLCEng0mreIfIq0YQ3bTRhe7TO+SVXKsV7eJHW/s6zvWfaWQ1VxEgtqacohnnc04I+S/Y6I+NdBzFI6O6B1WtfTKCda400Ln3JtTjkKnb512yEXja/X4fyIy1RuEA8Us5oUA5JQ4Oxw10H3joB7l1W8uFt73O5NbvvrJpyl/xVWNvqoNPnd2j4hQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 683f455d-c2e5-4148-db1c-08deed4fb79f X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jul 2026 08:59:37.2979 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 4NjSRAbjkuBfU063FD6f2QJe3NeSOgvd/KGoX5qEckdgZM87uB0xM3Y6y2CbrxM1e4MnhTnaX8RNuJeOtoRueJp3OxmFR2tEsO3wjrzELRU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR02MB11606 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX7w0kp6Dv/pGS 7rzYyEr16TkbAjvy+Wg0Mg614smPkDcL0fdzKQlLc046G/8yx+3K5zL5F+FfKUWJ7kkxOaJmPKN wM6cCNtYAZeVZW1X7sqfF1uhr+U6Atjq6o/+pHwtmwldY7wRvXJ8BhJyy/wX/9FQRlt4UxQIVev d3ASo5mrLIcCXsoPY3JpRpLqyym5/Z/IyMMVQYv9QEbyhz5fcWfoIMRMjAvEKZXg/7a0qm1WqFI 2e9CSDxaHRaAKEDaS9gwnrbH61gYNlvSIkUh9FEGTdWjUbvXcb6htKT7NqKYJ/FPXoquP784sVt kQuzTlIAHAfJrB777oMDEEJ5rOyatsvw8Wczj6Bzu5+ZCcUMty+isEik9sBMkdvt6ad0sj5VXrQ CFhUgAcApY1AjoEyKdbTHDjTXP2xKJbghbnfznEy1tV8+Tf6adZf20uJHPqqCSfXRU21dD9RDnN mGxhgA/SImm4m0Ab1og== X-Proofpoint-GUID: LLqTNSRKupD4eK-NbvFXLpgWOeQB7qWy X-Proofpoint-ORIG-GUID: LLqTNSRKupD4eK-NbvFXLpgWOeQB7qWy X-Authority-Analysis: v=2.4 cv=QJNYgALL c=1 sm=1 tr=0 ts=6a69c0fa cx=c_pps a=H8KQetTyUVx2NtQIo3bL5Q==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=VUi8bpU7OL1Oj2-RSIOF:22 a=64Cc0HZtAAAA:8 a=38_3UPSNbPqn1IfXAoIA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfXyzIDKhXaw2o4 +ei/sY+WHXsbko5cb7+Sp5qsCmAlsCOicmOe1JnYhNh4EW30yk8iGImibTIPvEKxDxPJ3b/YiSJ HUpdNYyJwHiDXW+GHwD3XRmbBdETl10= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_03,2026-07-28_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: SLOXSJLF3Z6ORITYEU4LB5PILDVQCJAH X-Message-ID-Hash: SLOXSJLF3Z6ORITYEU4LB5PILDVQCJAH X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1785316382459158500 Content-Type: text/plain; charset="utf-8" Libvirt falls back to the TLS-PSK-enabled VM migration, if the VIR_MIGRATE_TLS flag is set but the destination host lacks necessary X.509 credentials (ca-cert.pem, server-cert.pem and server-key.pem). The source host unconditionally adds the pre-shared key in the migration cookie if the VIR_MIGRATE_TLS flag is set. Upon parsing the migration cookie, the destination host checks for the presence of X.509 credentials and informs the source host whether to use TLS X.509 or TLS PSK during VM migration via the migration cookie. For a migration session, Libvirt generates a random key of the specified length, and then stores the content, "qemu:", at /$ID-$VMNAME/keys.psk on the source host. This is because QEMU's tls-creds-psk object does not accept a raw key string as a parameter, it only accepts a dir argument pointing to a directory from which it can read the key file. Subsequently, it sends the key to destination by embedding it within the migration cookie. The destination's Libvirt extracts the key from the migration cookie. Upon migration completion or any failure, both source and destination Libvirt must delete the directory containing the session's keys.psk. Signed-off-by: Abhisek Panda --- src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 6 ++ src/qemu/qemu_migration.c | 119 +++++++++++++++++++++++++++++ src/qemu/qemu_migration_cookie.c | 94 ++++++++++++++++++++++- src/qemu/qemu_migration_cookie.h | 5 ++ tests/qemumigrationcookiexmltest.c | 18 +++-- 9 files changed, 241 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 986f01ddcd..86571e8da6 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -168,6 +168,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->cacheDir =3D g_strdup_printf("%s/cache/qemu", root); cfg->libDir =3D g_strdup_printf("%s/lib/qemu", root); cfg->swtpmStorageDir =3D g_strdup_printf("%s/lib/swtpm", root); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/run/psk", root); =20 cfg->saveDir =3D g_strdup_printf("%s/save", cfg->libDir); cfg->snapshotDir =3D g_strdup_printf("%s/snapshot", cfg->libDir); @@ -187,6 +188,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->stateDir =3D g_strdup_printf("%s/libvirt/qemu", RUNSTATEDIR); cfg->swtpmStateDir =3D g_strdup_printf("%s/swtpm", cfg->stateDir); cfg->channelTargetDir =3D g_strdup_printf("%s/channel", cfg->state= Dir); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/psk", cfg->stateDir); =20 cfg->cacheDir =3D g_strdup_printf("%s/cache/libvirt/qemu", LOCALST= ATEDIR); =20 @@ -214,6 +216,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->stateDir =3D g_strdup_printf("%s/qemu/run", rundir); cfg->swtpmStateDir =3D g_strdup_printf("%s/swtpm", cfg->stateDir); cfg->channelTargetDir =3D g_strdup_printf("%s/channel", cfg->state= Dir); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/psk", cfg->stateDir); =20 cfg->configBaseDir =3D virGetUserConfigDirectory(); =20 @@ -375,6 +378,7 @@ static void virQEMUDriverConfigDispose(void *obj) g_free(cfg->dbusStateDir); g_free(cfg->rdpStateDir); g_free(cfg->vncStateDir); + g_free(cfg->tlsPSKStateDir); =20 g_free(cfg->libDir); g_free(cfg->cacheDir); diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index c18aedf59c..06a0b0770c 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -113,6 +113,7 @@ struct _virQEMUDriverConfig { char *dbusStateDir; char *rdpStateDir; char *vncStateDir; + char *tlsPSKStateDir; /* These two directories are ones QEMU processes use (so must match * the QEMU user/group */ char *libDir; diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index e1b805d906..41421214df 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -1992,6 +1992,7 @@ qemuDomainObjPrivateFree(void *data) virObjectUnref(priv->monConfig); g_free(priv->lockState); g_free(priv->origname); + g_free(priv->migTLSPSK); =20 virChrdevFree(priv->devs); =20 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 50ab492023..1feeb11bcd 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -148,6 +148,7 @@ struct _qemuDomainObjPrivate { char *origname; int nbdPort; /* Port used for migration with NBD */ unsigned short migrationPort; + char *migTLSPSK; /* Hex-encoded pre-shared key for TLS-PSK-enabled VM = migration session */ unsigned short backupNBDPort; int preMigrationState; unsigned long long preMigrationMemlock; /* Original RLIMIT_MEMLOCK in = case diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index bdc0cff66a..84b017b342 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -664,6 +664,12 @@ qemuStateInitialize(bool privileged, cfg->vncStateDir); goto error; } + if (virDirCreate(cfg->tlsPSKStateDir, 0700, cfg->user, cfg->group, + VIR_DIR_CREATE_ALLOW_EXIST) < 0) { + virReportSystemError(errno, _("Failed to create TLS PSK state dir = %1$s"), + cfg->tlsPSKStateDir); + goto error; + } =20 qemu_driver->inhibitor =3D virInhibitorNew( VIR_INHIBITOR_WHAT_SHUTDOWN, diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 4a43ab83b0..3d6e472443 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -59,6 +59,7 @@ #include "virprocess.h" #include "virdomainsnapshotobjlist.h" #include "virutil.h" +#include "virsecureerase.h" =20 #define VIR_FROM_THIS VIR_FROM_QEMU =20 @@ -1503,6 +1504,91 @@ qemuMigrationSrcIsAllowedHostdev(const virDomainDef = *def) } =20 =20 +static void +qemuMigrationDeletePSKDir(virQEMUDriver *driver, virDomainObj *vm) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + qemuDomainObjPrivate *priv =3D vm->privateData; + g_autofree char *dir_path =3D NULL; + g_autofree char *shortName =3D NULL; + + if (priv->migTLSPSK) { + virSecureEraseString(priv->migTLSPSK); + g_clear_pointer(&priv->migTLSPSK, g_free); + } + + if (!vm || !vm->def || !(shortName =3D virDomainDefGetShortName(vm->de= f))) + return; + + dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName); + + if (virFileIsDir(dir_path) && + virFileDeleteTree(dir_path) < 0) + VIR_WARN("Failed to delete the directory %s containing the pre-sha= red keys for migration of domain %s", + dir_path, vm->def->name); +} + + +static int +qemuPersistTLSPSKHelper(int pskFD, + const char *pskPath, + const void *opaque) +{ + const char *key =3D opaque; + + if (safewrite(pskFD, "qemu:", 5) < 0 || + safewrite(pskFD, key, strlen(key)) < 0) { + virReportSystemError(errno, + _("Unable to write the pre-shared key to file= '%1$s'"), + pskPath); + return -1; + } + + return 0; +} + + +static int +qemuMigrationPersistPSK(virQEMUDriver *driver, virDomainObj *vm, const cha= r *tlsPSK) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + g_autofree char *dir_path =3D NULL; + g_autofree char *key_path =3D NULL; + g_autofree char *shortName =3D NULL; + + if (!vm || !vm->def || !(shortName =3D virDomainDefGetShortName(vm->de= f))) + return -1; + + dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName); + key_path =3D g_strdup_printf("%s/keys.psk", dir_path); + + if (virDirCreate(dir_path, 0700, cfg->user, cfg->group, + VIR_DIR_CREATE_ALLOW_EXIST) < 0) { + virReportSystemError(errno, + _("Could not create the directory %1$s for st= oring PSKs"), + dir_path); + goto error; + } + + if (tlsPSK) { + if (virFileRewrite(key_path, S_IRUSR, cfg->user, + cfg->group, qemuPersistTLSPSKHelper, + tlsPSK) < 0) + goto error; + } else { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("The pre-shared key for TLS-PSK migration is not = provided")); + goto error; + } + + return 0; + + error: + qemuMigrationDeletePSKDir(driver, vm); + return -1; +} + + static int qemuDomainGetMigrationBlockers(virDomainObj *vm, int asyncJob, @@ -2718,6 +2804,7 @@ qemuMigrationSrcBeginXML(virDomainObj *vm, qemuDomainObjPrivate *priv =3D vm->privateData; virQEMUDriver *driver =3D priv->driver; g_autoptr(qemuMigrationCookie) mig =3D NULL; + int ret; =20 if (priv->origCPU) cookieFlags |=3D QEMU_MIGRATION_COOKIE_CPU; @@ -2725,6 +2812,9 @@ qemuMigrationSrcBeginXML(virDomainObj *vm, if (!(flags & VIR_MIGRATE_OFFLINE)) cookieFlags |=3D QEMU_MIGRATION_COOKIE_CAPS; =20 + if (flags & VIR_MIGRATE_TLS) + cookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + if (!(mig =3D qemuMigrationCookieNew(vm->def, priv->origname))) return NULL; =20 @@ -2738,6 +2828,15 @@ qemuMigrationSrcBeginXML(virDomainObj *vm, cookieFlags) < 0) return NULL; =20 + if ((flags & VIR_MIGRATE_TLS) && mig->tlsPSK) { + ret =3D qemuMigrationPersistPSK(driver, vm, mig->tlsPSK); + if (ret < 0) { + virSecureEraseString(mig->tlsPSK); + g_clear_pointer(&mig->tlsPSK, g_free); + return NULL; + } + } + if (xmlin) { g_autoptr(virDomainDef) def =3D NULL; =20 @@ -4232,6 +4331,9 @@ qemuMigrationSrcConfirmPhase(virQEMUDriver *driver, privJob->stats.mig.downtime =3D privMigJob->stats.mig.downtime; } =20 + if (flags & VIR_MIGRATE_TLS) + qemuMigrationDeletePSKDir(driver, vm); + if (flags & VIR_MIGRATE_OFFLINE) return 0; =20 @@ -5275,6 +5377,9 @@ qemuMigrationSrcRun(virQEMUDriver *driver, error: virErrorPreserveLast(&orig_err); =20 + if (flags & VIR_MIGRATE_TLS) + qemuMigrationDeletePSKDir(driver, vm); + if (qemuDomainObjIsActive(vm)) { int reason; virDomainState state =3D virDomainObjGetState(vm, &reason); @@ -7029,6 +7134,9 @@ qemuMigrationDstFinishActive(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_STATS) < 0) VIR_WARN("Unable to encode migration cookie"); =20 + if (flags & VIR_MIGRATE_TLS) + qemuMigrationDeletePSKDir(driver, vm); + qemuMigrationDstComplete(driver, vm, inPostCopy, VIR_ASYNC_JOB_MIGRATION_IN, vm->job); =20 @@ -7039,6 +7147,9 @@ qemuMigrationDstFinishActive(virQEMUDriver *driver, * overwrites it. */ virErrorPreserveLast(&orig_err); =20 + if (flags & VIR_MIGRATE_TLS) + qemuMigrationDeletePSKDir(driver, vm); + if (qemuDomainObjIsActive(vm)) { if (doKill) { qemuProcessStop(vm, VIR_DOMAIN_SHUTOFF_FAILED, @@ -7197,6 +7308,14 @@ qemuMigrationProcessUnattended(virQEMUDriver *driver, else qemuMigrationSrcComplete(driver, vm, job); =20 + /* + * Attempt to clean up the directory containing the pre-shared keys + * for the domain. Since, we cannot determine if the migration has + * enabled the VIR_MIGRATE_TLS flag with pre-shared keys, we clean up + * the directory unconditionally. + */ + qemuMigrationDeletePSKDir(driver, vm); + qemuMigrationJobFinish(vm); =20 if (!virDomainObjIsActive(vm)) diff --git a/src/qemu/qemu_migration_cookie.c b/src/qemu/qemu_migration_coo= kie.c index 7311a8294b..1a7b9361da 100644 --- a/src/qemu/qemu_migration_cookie.c +++ b/src/qemu/qemu_migration_cookie.c @@ -20,13 +20,16 @@ =20 #include #include +#include =20 #include "locking/domain_lock.h" #include "virerror.h" +#include "virfile.h" #include "virlog.h" #include "virnetdevopenvswitch.h" #include "virstring.h" #include "virutil.h" +#include "virsecureerase.h" =20 #include "qemu_domain.h" #include "qemu_migration_cookie.h" @@ -52,6 +55,7 @@ VIR_ENUM_IMPL(qemuMigrationCookieFlag, "allowReboot", "capabilities", "block-dirty-bitmaps", + "psk", ); =20 =20 @@ -149,6 +153,17 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC(qemuMigrationBlockDirtyB= itmapsDisk, qemuMigrationBlockDirtyBitmapsDiskFree); =20 =20 +static bool +qemuMigrationServerCertsExists(virQEMUDriver *driver) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + g_autofree char *cacert_path =3D g_strdup_printf("%s/ca-cert.pem", cfg= ->migrateTLSx509certdir); + g_autofree char *key_path =3D g_strdup_printf("%s/server-key.pem", cfg= ->migrateTLSx509certdir); + g_autofree char *cert_path =3D g_strdup_printf("%s/server-cert.pem", c= fg->migrateTLSx509certdir); + return virFileExists(cacert_path) && virFileExists(key_path) && virFil= eExists(cert_path); +} + + void qemuMigrationCookieFree(qemuMigrationCookie *mig) { @@ -165,6 +180,9 @@ qemuMigrationCookieFree(qemuMigrationCookie *mig) g_free(mig->name); g_free(mig->lockState); g_free(mig->lockDriver); + if (mig->tlsPSK) + virSecureEraseString(mig->tlsPSK); + g_free(mig->tlsPSK); g_clear_pointer(&mig->jobData, virDomainJobDataFree); virCPUDefFree(mig->cpu); qemuMigrationCookieCapsFree(mig->caps); @@ -575,6 +593,51 @@ qemuMigrationCookieAddCaps(qemuMigrationCookie *mig, } =20 =20 +static int +qemuMigrationCookieAddTLSPSK(qemuMigrationCookie *mig, + virQEMUDriver *driver, + virDomainObj *vm) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + qemuDomainObjPrivate *priv =3D vm->privateData; + gnutls_datum_t psk_key =3D {NULL, 0}; + g_autofree char *key =3D NULL; + size_t key_len; + int ret; + + /* Generate the pre-shared key exactly once for a migration session*/ + if (priv->migTLSPSK) { + mig->tlsPSK =3D g_strdup(priv->migTLSPSK); + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + return 0; + } + + ret =3D gnutls_key_generate(&psk_key, cfg->migrateTLSPSKLength); + if (ret < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Generation of a pre-shared key failed")); + return -1; + } + key_len =3D (psk_key.size*2) + 1; + key =3D g_new0(char, key_len); + + ret =3D gnutls_hex_encode(&psk_key, key, &key_len); + if (ret < 0) { + gnutls_free(psk_key.data); + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Hex encoding of a PSK key failed")); + return -1; + } + + priv->migTLSPSK =3D g_strdup(key); + mig->tlsPSK =3D g_steal_pointer(&key); + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + + gnutls_free(psk_key.data); + return 0; +} + + static void qemuMigrationCookieGraphicsXMLFormat(virBuffer *buf, qemuMigrationCookieGraphics *grap) @@ -890,6 +953,9 @@ qemuMigrationCookieXMLFormat(virQEMUDriver *driver, if (mig->flags & QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS) qemuMigrationCookieBlockDirtyBitmapsFormat(buf, mig->blockDirtyBit= maps); =20 + if ((mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) && mig->tlsPSK) + virBufferAsprintf(buf, "%s\n", mig-= >tlsPSK); + virBufferAdjustIndent(buf, -2); virBufferAddLit(buf, "\n"); return 0; @@ -1396,6 +1462,12 @@ qemuMigrationCookieXMLParse(qemuMigrationCookie *mig, qemuMigrationCookieBlockDirtyBitmapsParse(ctxt, mig) < 0) return -1; =20 + if (flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + mig->tlsPSK =3D virXPathString("string(./migration-key[1])", ctxt); + if (mig->tlsPSK) + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + } + return 0; } =20 @@ -1471,14 +1543,17 @@ qemuMigrationCookieFormat(qemuMigrationCookie *mig, qemuMigrationCookieAddCaps(mig, dom, party) < 0) return -1; =20 + if (flags & QEMU_MIGRATION_COOKIE_TLS_PSK && + party =3D=3D QEMU_MIGRATION_SOURCE && + qemuMigrationCookieAddTLSPSK(mig, driver, dom) < 0) + return -1; + if (qemuMigrationCookieXMLFormat(driver, priv->qemuCaps, &buf, mig) < = 0) return -1; =20 *cookieoutlen =3D virBufferUse(&buf) + 1; *cookieout =3D virBufferContentAndReset(&buf); =20 - VIR_DEBUG("cookielen=3D%d cookie=3D%s", *cookieoutlen, *cookieout); - return 0; } =20 @@ -1494,6 +1569,7 @@ qemuMigrationCookieParse(virQEMUDriver *driver, unsigned int flags) { g_autoptr(qemuMigrationCookie) mig =3D NULL; + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); =20 /* Parse & validate incoming cookie (if any) */ if (cookiein && cookieinlen && @@ -1537,6 +1613,20 @@ qemuMigrationCookieParse(virQEMUDriver *driver, } } =20 + if (flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + if (!qemuMigrationServerCertsExists(driver)) { + if (!mig->tlsPSK) { + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("destination host has no X.509 certificat= es configured for migration and source host did not provide a pre-shared ke= y")); + return NULL; + } + } else { + virSecureEraseString(mig->tlsPSK); + mig->flags &=3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; + g_clear_pointer(&mig->tlsPSK, g_free); + } + } + if (vm && flags & QEMU_MIGRATION_COOKIE_STATS && mig->jobData && vm->j= ob->current) mig->jobData->operation =3D vm->job->current->operation; =20 diff --git a/src/qemu/qemu_migration_cookie.h b/src/qemu/qemu_migration_coo= kie.h index 254372234d..fd3b4c5a56 100644 --- a/src/qemu/qemu_migration_cookie.h +++ b/src/qemu/qemu_migration_cookie.h @@ -35,6 +35,7 @@ typedef enum { QEMU_MIGRATION_COOKIE_FLAG_ALLOW_REBOOT, QEMU_MIGRATION_COOKIE_FLAG_CAPS, QEMU_MIGRATION_COOKIE_FLAG_BLOCK_DIRTY_BITMAPS, + QEMU_MIGRATION_COOKIE_FLAG_TLS_PSK, =20 QEMU_MIGRATION_COOKIE_FLAG_LAST } qemuMigrationCookieFlags; @@ -53,6 +54,7 @@ typedef enum { QEMU_MIGRATION_COOKIE_CPU =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_CPU), QEMU_MIGRATION_COOKIE_CAPS =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_CAPS), QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS =3D (1 << QEMU_MIGRATION_COO= KIE_FLAG_BLOCK_DIRTY_BITMAPS), + QEMU_MIGRATION_COOKIE_TLS_PSK =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_TLS= _PSK), } qemuMigrationCookieFeatures; =20 typedef struct _qemuMigrationCookieGraphics qemuMigrationCookieGraphics; @@ -171,6 +173,9 @@ struct _qemuMigrationCookie { =20 /* If flags & QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS */ GSList *blockDirtyBitmaps; + + /* If flags & QEMU_MIGRATION_COOKIE_TLS_PSK */ + char *tlsPSK; }; =20 =20 diff --git a/tests/qemumigrationcookiexmltest.c b/tests/qemumigrationcookie= xmltest.c index bc0f68b8c5..adf2eb4d08 100644 --- a/tests/qemumigrationcookiexmltest.c +++ b/tests/qemumigrationcookiexmltest.c @@ -160,8 +160,12 @@ testQemuMigrationCookieParse(const void *opaque) return -1; } =20 - /* set all flags so that formatter attempts to format everything */ - data->cookie->flags =3D ~0; + /* Set all flags except QEMU_MIGRATION_COOKIE_TLS_PSK so that formatter + * attempts to format everything except the migration-key element. Thi= s is + * because the value of the migration-key element is randomly generate= d every time + * the migration cookie is constructed. + */ + data->cookie->flags =3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; =20 if (qemuMigrationCookieXMLFormat(&driver, priv->qemuCaps, @@ -225,15 +229,17 @@ testQemuMigrationCookieDom2XML(const char *namesuffix, * - lockstate: internals are NULL in tests, causes crash * - nbd: monitor not present * - dirty bitmaps: monitor not present + * - tls-psk: a new key is generated every time the migration cook= ie is constructed, so we can't test it */ unsigned int cookiePopulateFlagMask =3D QEMU_MIGRATION_COOKIE_LOCK= STATE | QEMU_MIGRATION_COOKIE_NBD | - QEMU_MIGRATION_COOKIE_BLOCK_= DIRTY_BITMAPS; + QEMU_MIGRATION_COOKIE_BLOCK_= DIRTY_BITMAPS | + QEMU_MIGRATION_COOKIE_TLS_PS= K; data->cookiePopulateFlags =3D ~cookiePopulateFlagMask; } =20 if (cookieParseFlags =3D=3D 0) - data->cookieParseFlags =3D ~0; + data->cookieParseFlags =3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; =20 data->inStatus =3D g_strconcat(abs_srcdir, "/", domxml, NULL); =20 @@ -279,7 +285,7 @@ testQemuMigrationCookieXML2XML(const char *name, int ret =3D 0; =20 if (cookieParseFlags =3D=3D 0) - data->cookieParseFlags =3D ~0; + data->cookieParseFlags =3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; =20 data->inStatus =3D g_strconcat(abs_srcdir, "/", statusxml, NULL); data->infile =3D g_strconcat(abs_srcdir, "/qemumigrationcookiexmldata/= ", @@ -381,7 +387,7 @@ testQemuMigrationCookieXML2XMLBitmaps(const char *name, int ret =3D 0; =20 if (cookieParseFlags =3D=3D 0) - data->cookieParseFlags =3D ~0; + data->cookieParseFlags =3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; =20 data->inStatus =3D g_strconcat(abs_srcdir, "/", statusxml, NULL); data->infile =3D g_strconcat(abs_srcdir, "/qemumigrationcookiexmldata/= ", --=20 2.43.7 From nobody Tue Aug 4 22:22:05 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1785315853; cv=pass; d=zohomail.com; s=zohoarc; b=Ewilbj1jmbZz2pKNY0Ixuqdt6ptTFhkrMui7eAPNf3EJ3uIlT/+wrIj1M1cFcF26MMJ0X8webVUiHF3LiCtmrqGPAjRXi7Ckzg7xw68vk4qUzqLKYggMV/JHR91PCAfJSqr3fgYxQb/KKCdoaQv3Hv0USoH96mexqhL31fht/Nw= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785315853; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=dVq09XVSs3Pkp4lMqWSYOhb23JRtr48QZSrQ5OKJ9ug=; b=Zn/BnPXIA2BgzG00HXL08UYMuie2c+FWt1IlqPcyPSj4U7NWGLejrP0HmFxG9nYOYkdtcXO86EBZrz4Xk9pda8X4z2LmB1qtCegtW4Ng2RGSKec6fXgBTN+S+1T9kwWz/LUP35jCldSxae2Q5baxCsg7EXoUIx8DW+ecuZsAUkY= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1785315853841203.86605909858633; Wed, 29 Jul 2026 02:04:13 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id ADEFE41CEA; Wed, 29 Jul 2026 05:04:12 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 03AA841BBE; Wed, 29 Jul 2026 05:01:14 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 64D434198C; Wed, 29 Jul 2026 05:01:00 -0400 (EDT) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 97F6F41BAF for ; Wed, 29 Jul 2026 04:59:42 -0400 (EDT) Received: from pps.filterd (m0127841.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66T7cIAX2332952 for ; Wed, 29 Jul 2026 01:59:42 -0700 Received: from bn1pr04cu002.outbound.protection.outlook.com (mail-eastus2azon11020098.outbound.protection.outlook.com [52.101.56.98]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fq2c7hg7t-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 29 Jul 2026 01:59:41 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by PH0PR02MB11606.namprd02.prod.outlook.com (2603:10b6:510:3b9::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 08:59:40 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%4]) with mapi id 15.21.0270.009; Wed, 29 Jul 2026 08:59:40 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=dVq09XVSs3Pkp4lMqWSYOhb23JRtr48QZSrQ5OKJ9 ug=; b=OeIBLsfMonxUWusN4WSej8Jg2o1MGh+3m2QpfHwT5FuhjJ55g6Fn/sYCY WlV/zttPPtOllgQD4gZ0JFT+8yWNS1eRX6wKOROxaXZwtjYW2xSjKr31DYNoIFgd EMido0UUBJQNxzYnImQZSeeJBVyJHx91B6t5n/Mpvdn8ibKQVoZ7loO7hSVrjWXw c5rDhVCD7wfCza8ad+WuKSzco/KAJ2C8ANYIv9a26iv4xSSG2dH6LPgFEGVhYanC oleOASNN6SrtvrrxHQVCFFPf/HfQKII0ZnEbcaIw96enWm5BE2BxMiYOVEfeFuP4 gSiK/+H7pvPpw56+9ob6pFerLlMcg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=g2TLZ/pdmNWAOrEOtTFO+8vIyR64D17sNIWHyVYvUNg7G17yuaU+B4do9QEpeocy53B9GIi8bKNK+TikR5CmDMLg+CFGYr1mgHmPhmLHzE7sh23+7z90fipgMK6jsbqWbE0VGMqEj+HJTxPybJeoIW78h6joI5lrn4TYOjTCn6mnoYnio6DAPOKQYd4Oe5KcTOmI1bhNEu2USd0JnNGoYEawe/lZBAIw9fVXR9ez78oTpK9JI43rOrzVn7dWAixTMQVTZS6eDR4Hlri6jKfpyY5EFCk4vfbriwXiN4D1aCvsrowkmZD564cAynEGQlQKcoY11J5PwyWi3l3FsceN7g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=dVq09XVSs3Pkp4lMqWSYOhb23JRtr48QZSrQ5OKJ9ug=; b=YCQy6W3ebzmbAzdcxPDShAzt7Bj2qYdEjUjFy/6tWM6yyl3HbrY+OP0pgmIfkTOK5qRJO8sOpqBoMy/xNhBiebF2gSTcdd/rdlxLX0bxfAZzc4Nxbs5nAxr25/DuuC4W5EccEpKLZRBle3ox12eMq3zZjhgNTHhQ+IQ1SHO4EDzRg2tvjr39816JdGE1kYbFcfTLGlOjJYcuPKopElOhW3PJy/5dQreJaoF2/P1hJ5L4UDCb10nQlo8AkhotxN74hE+AZg+552OwdV0t9qDxjFmjwVf28wOdhw2X3ecasy4uX+VNXb9iUKJIdip5g7xdKPnPzE7vwPNjtsb0YNJuCg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dVq09XVSs3Pkp4lMqWSYOhb23JRtr48QZSrQ5OKJ9ug=; b=NaDCGE6Lf9vUjYkPJcs9Y9VvgfFlHmwCIh1tnEkdRGI2Y+nXSwSIXYQu9trV63g64vf9cZio02R/PLafmilgX7/vWUO8hwg5KaGCKvCzp9GXXEySMxZg1Ej5YKOyMGIVlOaoljT10ous3fdwovetdWhYYXxVZuWYGWBI/xSYS88ozodoYLe1I9oGNJLdf0RIYB02QvT61b9ddDcTxmcWxBZkDHmKbQwtyF8apn+nTIBKDLit9CvdF0h4O4hkUXi5nfVbL/14uvt5oFDQt35BBEu5PxtFMEJeviktqV5g3f26wAJ3DuJ6KXBvuz1GgWdJrQf8mryz1qg5nYtVUcU8Ag== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v3 3/7] qemu: Add support to build the tls-creds-psk object Date: Wed, 29 Jul 2026 08:58:55 +0000 Message-ID: <20260729085917.3243911-4-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> References: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: CY5PR22CA0103.namprd22.prod.outlook.com (2603:10b6:930:65::25) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|PH0PR02MB11606:EE_ X-MS-Office365-Filtering-Correlation-Id: 5483372b-f085-4e7d-7940-08deed4fb99e x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|6133799003|56012099006|18002099003|22082099003|10067099003; X-Microsoft-Antispam-Message-Info: /n1Awu5BR+e0NlLIqkYwdEKaQ5d9r2O3T3oC/92TG+tpEw/MXjMTn3kBii4MPQxZryGfRM59bhm1hKpW49mGpCo4pAm7B+vItNTSkYXuoR+A/uOA/qj7E0tX7CkhpVXukAQU3bl4Iy/TwoPzWIIkNtSOtY757JPBHG88HnqgRIoRvhG9DJfrzRD4ryEgqFBIEHJmvrlA57Su/4CTwZTZkkCr7JxRQ82ziK7Qz3iaTy9tpUExPciRvgyXRHCbiOiJDMVQs/KnbjnjzU4JUyJNIKL/Dh9G2EmlKzNHwdf/2agbHEIu0zSTDrUGiv6ip3wi07r94xBv39WOMLRMnj24eFldScgXs4c4LqEHqfBrRIsjkW2lYFUpyNTvugQZynJnPGU0YMYkldr2bBrzhyLWagKn/OFafnwI2Olny9Tos7fjIwoJLAOQqMyAs5/hh0mPFhjSMJX93/0wd5iANpxgJQE5BdPkBHtXcd01a0qOsC/xiQWfpGIxJ6WosZW4JiId7QcArBL1z7KRpd72SH9O19uTQjukep5Q2WoJYPUYbm1xmcFgLHmHgt/gvtgw+Ro8f7FJB5fZi+5upC3Mx2sixKefIzai8cQhlne1rVOMHWWnIp1EQIW7TdKM3B1YVuqupx6gRdqWXko8S1VHj27z8m1zIc4L3DikHznOxZxKiBw= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(6133799003)(56012099006)(18002099003)(22082099003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?WlFWzK/90d8gKYXZDGOMa1bLUd1ntN29J5JYOAE3+gxCL/cKNf+NIO9ZTbCh?= =?us-ascii?Q?DSjka+AmWboZRbhyIVtIYmcOvTt3RrHrgpLXKqqkoJ3WwPjfNps327ASDRzE?= =?us-ascii?Q?TX/YmFVhHoHCK2jmKHba+4rm4TvhTv9gQ+do1Kqk+c/ixdDJe/kfEgnS7o6i?= =?us-ascii?Q?DdelVRq9O6y6VybxdKwu4r8gMoVtwCE22s54BaXD2v542WjpLvYZmmDSVLba?= =?us-ascii?Q?pdM+63ht5vir4//liFL0Zn/7TOvtbXAUvKvnkij8jwxfplNgQ3kSLaUGEaCd?= =?us-ascii?Q?u2eRbQhBtpaQCUqnsl6lrzUvmhHjq5lUGxCpJqBbbzF+XRfYs9jYHNDJxAqh?= =?us-ascii?Q?IROpJeuN4aNvomEYxy0i0Dp8jtJaOem7VrCMdqzJ3elR+oMRuPndSBiLPhJd?= =?us-ascii?Q?VF6a5YJiVYagIqA+/woZBCBJmaH5nvBropaeFz7oIgYd3DKANcq6JzW0gIeq?= =?us-ascii?Q?T4eurbkNDDaTE0iaL2SkgBJMkeGY00JWosmwwE347LHmORCA76zsNgB1qkio?= =?us-ascii?Q?2yqylAJ41Ir28OVDJyLuyKH1DesQbEBZl23AKXI+15ijUONx1lH+zI0ZvMl+?= =?us-ascii?Q?auzUNjJ7EqI48olYzuKdXpzi4HZZnUJV1fkvfAodxO2DKA7Q1iJjNXctLRmL?= =?us-ascii?Q?86w4lU/S4Ws+qxpHyzdsK9L12tBMCQxt1xxEiWkMv+9sawdwjicOIzlJj/L8?= =?us-ascii?Q?G0cZlJc7VAwKtaKC392eLUzrDaKqCGEGRKWX4PS9oOOe/w6lIgJh895GF0u1?= =?us-ascii?Q?h4tQdOvmk5xueUEwrZA4xlfmEQMuhJRK6LKRqW1I/ghaZcZ/7g9Dv/KD6Wn7?= =?us-ascii?Q?4D6YD5XbudmGPW5MKt6D5kUWw3EwhkOJ9d0xg+EbXhzm2UVlMam5TDwZY22Z?= =?us-ascii?Q?hNmK9w3OTa/ibE9F5HhxEhc2myB6oCXyz1pkl2bm741m9VjMk7PLwSC4sww0?= =?us-ascii?Q?zhV9AIrEN8y7b19kDLJzo5znDsjV3iscHnIAypzZSs2uEoAhuFHbE+3b0tcW?= =?us-ascii?Q?trnUWoqdU9L7+XUJc2fSV9OaqEdNTUjAkTTXvaFUs1noZbUjPTwZxbzpbwiq?= =?us-ascii?Q?/jsSNa/9J73UiTDar3BtpyvwuuUPYxm1+s6rr3Gds6NzKaVz4v8x1cEKdBRl?= =?us-ascii?Q?331iqdr0xOAlq5RbliR1R8N8U7XdhexqxUTx5xE4oQtDMnywQAeEGLibOsnH?= =?us-ascii?Q?nT630YyBD/9CpWO6ys7LnIzDxpB4jRuldiySQRlZ/c3VWztoIaeQBQ4GJn+M?= =?us-ascii?Q?IZos/yrXlgaFLSY/QFPw54TXzLO8RPTZuKtTUnUt/477ZX6e5dLR56KuctBQ?= =?us-ascii?Q?CJteHKe5VHWmLYhJrO+spG+kemEab8DVlMtdvlczZ/yPkGnapAu7MhKKLxX8?= =?us-ascii?Q?lMGpxca+ujzUXd5y2M0NqW1mEOVldEG0mOXN25o52Sz+0mjGp4kQa4kVe29E?= =?us-ascii?Q?p2tu+pMRLa9Y/vle6CZMWRm+NJSgPUKnnLvC1Ix0I9LDqpgksX9lGbCUmai6?= =?us-ascii?Q?FXS36rnoz/iFFvS5YqvDE1DXgadZUF/XXTud6JXPeo/4CUXe67UkMFqiB21d?= =?us-ascii?Q?T3wnXgtr0e599Bb0NSravGZq0MbpiXsja5spLK5rT+sOgUIwZDEDCG+Vg80O?= =?us-ascii?Q?P++OL2EXF4VH/kdy8LpFuWBVinVuOd4yr2Wn1t0F2iqCN6EADOK8KK+t6WBP?= =?us-ascii?Q?cFy27EKKXMXF2cwh/yim+k7kdNpCD0c0dkkMb6zg1e36+x7xbVEvXtSQG2XS?= =?us-ascii?Q?JcPeqkQpBdR2QWdgj8sVYBA4GwF6RhM=3D?= X-Exchange-RoutingPolicyChecked: qMbJmLP7ZvRECWR3c3uBMBKIcHPAn8DoJef/IcohXJyrmJ9YT7013ifAeHpf53ddHSb1jxQktHlfBjSirJXo5OXkPa5H0fE4ILeKgCuGgAA+1NLwCeMy/8exInU4JyR1ToD9xUUj/lC14t7AzSG8CQiOesKt3RyQpOkUEoVkmd09XpVS9bOBHbp2fXlr8srFJZeCQcFdk/YbDhYwwMFQ2W+F3yfCNFYl1ziWoOggOK9+7UHvNZhznHMK9bJiMIYsjy1b4Ie60/d6gCZSXZdwjr3XeAqSm2dZbuiXkhKlA/CwpCRbbcjvQ8EVkV0I3mSXvJR3HjhzLXCkmWOC4HVxeg== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5483372b-f085-4e7d-7940-08deed4fb99e X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jul 2026 08:59:40.6354 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: tsltzJHKKu1TjZB6ZPFy9IfUrnbJEZysfr+BEBU8MWWWBQYNIof6wyEas7IYL5pIoC62IYsFBA8ZPXCK0GFgNQSFyirRpFeQYwQMee63vI0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR02MB11606 X-Authority-Analysis: v=2.4 cv=SMBykuvH c=1 sm=1 tr=0 ts=6a69c0fd cx=c_pps a=+sLJoloK99bVPEAi26XZpw==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=jxMXjlTPpCISP5mWtjnE:22 a=64Cc0HZtAAAA:8 a=-DOnkpEdNJLKZcUuXmsA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX6PtwpSjDrOev MwAnMyANhpbNS90vetyd7b7LOW6UabEyC45LLQBDO8zmhtNWzLHEC/pxQIiOj2FNvr5aQKp97Ka C4FWyBec/Aik1QG34uiB3ijOvBoBxnk= X-Proofpoint-GUID: FUYnyGLC20xva9JRG6tzI80imdu4GTR8 X-Proofpoint-ORIG-GUID: FUYnyGLC20xva9JRG6tzI80imdu4GTR8 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX1ly0pFD79ZVo RmpH8Sdpilm45Mfo+GrvhqtZfLZgy7RmUm9a1XhWwD7qf67GXDv5VoQCGjE0aM22EzCaOA0o8rj Hl0dLvFlqtoLGSwPKeAC1KxkFvo04+D9zSgKQjPsRx6Qg9wKf/F84KIMPcvVpEJP5lv+1MFwt6q zOFuiloX63JvlpwMAg5ttGHLxHkdjlPGesmiTEPohUKEAqHn0hWxPxgg5xJSpLfIWpKg7mM51nW FizMpD4yBwrStVqbGQyOl50F4swOk2sPBUPy1pASJrbzibv27aFRtUBix6b0HN97j5NkPKtr511 nCfsD8pEQLVpOlb690eWGvcjuWQCMlWFLh+TUikOlxVs4cnUQRLEjXgGqO4eMc5jyTHPOEhyvJT AinKIYHkry0rGn+kxlY7odgkf39K87b49fUHn6l415raDhydx+RflfrEKFPvM2Z5j6FbRl9yoGC fbTCLcxVx49cVWvLtNQ== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_03,2026-07-28_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: 7UBKDU3QXTQF4JZCZVFCSAVFMOB3V433 X-Message-ID-Hash: 7UBKDU3QXTQF4JZCZVFCSAVFMOB3V433 X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1785315855664158500 Content-Type: text/plain; charset="utf-8" Build the tls-creds-psk object with the following params: id, dir, endpoint. Note: Libvirt generates a keys.psk file for each migration session that only contains the pre-shared key for the "qemu" user. Because QEMU defaults to using "qemu" as the username if the username attribute of the tls-creds-psk object is undefined. We intentionally do not set this attribute. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda --- src/qemu/qemu_command.c | 26 ++++++++++++++++++++++++++ src/qemu/qemu_command.h | 7 +++++++ 2 files changed, 33 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 95e2ea9a6b..b08dca4b66 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1293,6 +1293,32 @@ qemuBuildTLSx509CommandLine(virCommand *cmd, } =20 =20 +/* qemuBuildTLSPSKBackendProps: + * @tlsPSKPath: path to the TLS-PSK credentials file + * @isListen: boolean listen for client or server setting + * @alias: alias for the TLS-PSK object + * @propsret: json properties to return + * + * Create a backend string for the tls-creds-psk object. + * + * Returns 0 on success, -1 on failure with error set. + */ +int +qemuBuildTLSPSKBackendProps(const char *tlsPSKPath, + bool isListen, + const char *alias, + virJSONValue **propsret) +{ + if (qemuMonitorCreateObjectProps(propsret, "tls-creds-psk", alias, + "s:dir", tlsPSKPath, + "s:endpoint", (isListen ? "server": "= client"), + NULL) < 0) + return -1; + + return 0; +} + + static int qemuBuildChardevCommand(virCommand *cmd, const virDomainChrSourceDef *dev, diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index e34172fbff..92ae32d285 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -72,6 +72,13 @@ qemuBuildTLSx509BackendProps(const char *tlspath, const char *secalias, virJSONValue **propsret); =20 +/* Generate the object properties for a tls-creds-psk */ +int +qemuBuildTLSPSKBackendProps(const char *tlsPSKPath, + bool isListen, + const char *alias, + virJSONValue **propsret); + /* Open a UNIX socket for chardev FD passing */ int qemuOpenChrChardevUNIXSocket(const virDomainChrSourceDef *dev); --=20 2.43.7 From nobody Tue Aug 4 22:22:05 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1785316114; cv=pass; d=zohomail.com; s=zohoarc; b=cpRmNEYDJvfTDXhLvC1epkH8VAcd/JVdbd1HbYO8LpSBsieRcbxAA5dbqnmfPXOBMq1t7xwgzYK7uFxaqAXpFk7Kvl0xvbnqv+OLz1UmjiHkmdfyagJFWlEYQyc1dO3jFDrxQxQSfQdaRzwK1C5C4biwKJ+HPa92/+A1AMQq4yw= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785316114; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=d76H0UN7x/vC6Lpplj369DuCDHBmvjtsselWvHlvxBA=; b=e7CM+azSri3babrJoHku8PX1pknD1v015fUCPoVpryG/hODb32JIsQgPyzxIlkhvbz+WilTAnMAcqFo4Xfdck3xLL7y+MqN8pxag5XNzv096gaEHqAgBzZaUpP0s5mWjTOtlbokDbzHXVQvq6/VhIZaZSxTdiJXn6C4VYdw/rVQ= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 178531611435111.711742075828624; Wed, 29 Jul 2026 02:08:34 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 104FB3F93B; Wed, 29 Jul 2026 05:08:33 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 71EB243DC2; Wed, 29 Jul 2026 05:01:35 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 1CC544198C; Wed, 29 Jul 2026 05:01:02 -0400 (EDT) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 0DD9F41BB4 for ; Wed, 29 Jul 2026 04:59:47 -0400 (EDT) Received: from pps.filterd (m0127837.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66T7f4af2404579 for ; Wed, 29 Jul 2026 01:59:47 -0700 Received: from sn4pr2101cu001.outbound.protection.outlook.com (mail-southcentralusazon11022142.outbound.protection.outlook.com [40.93.195.142]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4fq0g7htf6-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 29 Jul 2026 01:59:46 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by PH0PR02MB11606.namprd02.prod.outlook.com (2603:10b6:510:3b9::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 08:59:45 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%4]) with mapi id 15.21.0270.009; Wed, 29 Jul 2026 08:59:45 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=d76H0UN7x/vC6Lpplj369DuCDHBmvjtsselWvHlvx BA=; b=UpFBcGvAcYzCBjoEfhAgiGgTqHZ3YxpK957RZJkru2SAlSYWz6QFUVyxy JcEXW5sqURVTcaL+CPD27fqHEcppLDW40T9eo2UBBnVT0q3lb6/B6YpX0tHRmu4z +q5FXASk32K4LH4SwLnIvIqOxtqfQt+9Yz8LWh2R6sclKpT7iU6GHXV9wTIy2RTE Um1YViwfAPEN89p45C0cF6lkN0sx+1o53JUuH/5ANm40sO1JvbuHOLNMvrqf4Xdj ZQKDTxCcn/lpKVEHX5iwAG1jwRxyijXq0JZBlIuYjLG97KaQdOG2p8wQUGXgaI1i 4XVGcDf9GUN7MRPbPN1wWucIZXyUQ== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=pTpJEo1Lv3mG6jRBF4BpYcOVwaeFADAcG8i741Sshdq9qmC5PQqcRaaMBDsdWqHRbugbh4Fn2Zy+wsl94GeZxS9/Nm5w7fIjP1XGUXl6l9+lLAIMYA3qoXDbW5jE0Iafs7/YzU6/g3bh8OJCepkbv8qXP3cM9ftEX2eU8B4ZfHjzQcnljOD1IFfiYtvCPHcTHyZfO32x4RwIU7gRPnpn5x8WuVilfjRXlFsGrtou42Ra5T7Ve1DT2bPzBFJVRDbw49O8KXypwr8fHpE+RGf/LfubbwxztV+LEMtrnZ1VifXoVcNGaNgKNVXNbk/urfO8DC4KBtKV22uSxBRYqOHuBg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=d76H0UN7x/vC6Lpplj369DuCDHBmvjtsselWvHlvxBA=; b=rEUl8loFFuao99qmJSpys9YLtP/MnGTF1mrywBWqSGksHtwVvsElog+U9/87xHx8oLLlo2TwN0QdtFgUcc7397/q50QC2Bu4XFhpKH9NTKMMDF2N5NiaYDq5HsDDOFn3K8AkFl/DP7qPB+IWwdgQGkoyqXWLaUD6iuw4ZbhqF1u2DzIQSPi3N/SNOr8IJWiYTswaTGfTVczrkhe6UDiY6RZww9+R0kyNnPBzPMl/F6HAODLAQZMAk7uOSMAXx/bci712JnwhZG9rR5LzI5p5R3SGJR3aiXqfFaloHqTDB8mBiZk3ThgEDi73WFiqcVzM4ZtGcZYG8aOimsBXJ07fzA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=d76H0UN7x/vC6Lpplj369DuCDHBmvjtsselWvHlvxBA=; b=kUJNmQWgxlXSoGDTBx5iIOBS38AjnxmYfqJikFkOP9Q1nc4J0EgiPMuR/87cjlDEFCcfiC4vhwPwa2ov/PgE3k4j0IZZFZEibwi54TXJUJcghvi4/s+atjH8/+u2nT/VqaSbcu/572uS3q9nYy4V5pmYEnoWHqa4COStpl1kd86B2jm7GPkkI/H1iJfnXgS9MjMy5/OhfvglNirKNh4qiIOMPoSbv88qeeXFNVKPC69FSL7Zrno+ZbRcdN9mrhv8tYqOyHtPdo8aR+eFXT2PBcq7YUA5gUBshqpUCwsT2GnUEBdP8PcvY5Wvzp9q3yDbXe3YDqq06qaRt3fypBLOYA== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v3 4/7] qemu: rename tls-creds-x509 obj related functions Date: Wed, 29 Jul 2026 08:58:56 +0000 Message-ID: <20260729085917.3243911-5-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> References: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: CY5PR17CA0007.namprd17.prod.outlook.com (2603:10b6:930:17::20) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|PH0PR02MB11606:EE_ X-MS-Office365-Filtering-Correlation-Id: 1d6302dd-2b19-44f2-8105-08deed4fbc43 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|6133799003|3023799007|56012099006|18002099003|22082099003|10067099003; X-Microsoft-Antispam-Message-Info: 3Sc1EGVcwquv4B+2zsaL5/EU4Yxsfr2++HcS4XzLWytxxnDyua6dVF63z3guR6Xqlyi+sM7KrQ1GWdNIKYZhj25nwchGFftx6cTU0SI+qWdaV76mcYgoSA4voFTbLYCuzXTb8fsPk3EQkwS7sjf6MqRtHaRQZC71i+TRfBrncZWFMscIbTN4grh13SNTbLVzeJtfPe4vebB/MOfAwXh4pOXOwBiSP7fH19/XzJ9AMv/wX9TEdDx2HBcL3bT7CN23IO1voqBjRYG1WfTPM1BO3+gNTF93zu2Uo1JEQdzTSNssHOEo07MEXoDOAZco3VIhVuIFYxxwAQtFUe1yYDnB0oYhAlX+WuVB8iaT3WsVLA2Aur1VpxlF//XAnvF1nxemwCW1NnOTgaHKhm3aXBLA4jQQxsHTXUck1bTtYQr0KH2kUev9i7lt+rk/O0mtjBrOcllH9MS23nQ5v1xgmysG7qdDTJd/LViHkam3TX8HSLl6NFhodpFSUgqmWiL96NitRH5p69XRT2UZv96E95nU8AxY9SbONLA14DWW2SpGrDmoLh5d0e0yvYdPrZiwPmG/rjfuNdE7KQa3cxSVVj9BmxNTEt52BlKLmAEjKapsZTluWOkSL8sC2sBGXf7IUBszBQr6DcL+uUFE0lzwD9QBBh6578QNYzW7+ObGKr2/pK8= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(6133799003)(3023799007)(56012099006)(18002099003)(22082099003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?BSRMZa7eFqAJNAPmMuqAlBr/Fr5CcbRNunwH+uCv8IqLToBSpV6Ewz67Jj1K?= =?us-ascii?Q?M/wBqJ1EN0wZ7wFfWSOu8sdCNuIV6TAKXNXL3uBBjg0SWz1WQ1l2w6psWFJi?= =?us-ascii?Q?do/LhJWDDlnOO0NkI8K0+M3cbEToWDNtHzewBzxXjY1sws+DaQ2KmG05T3Qd?= =?us-ascii?Q?9ACJdo/FEqE0gLf2SPM0UGEAde0h/4KbkeI+EM7ovS16/o1cTmD1JURJh9Zp?= =?us-ascii?Q?qq5HSw/j9UrwGooJSy5i4xU2bl6mC5r41kqVtifPgpkWLIXYPXnayz27sFi+?= =?us-ascii?Q?6ZDWZBEajoOFO3gMJXNwN4ICqRiFff8xZme9KhSssrTuJiGEHPy2g/k7Grlg?= =?us-ascii?Q?2E49il2hVYnkc5Pi92HqNZoziR7/fotRD5vowE4jeLUqfm3lDdnbKMmiyeYU?= =?us-ascii?Q?7jMLO1CAYjIBDkdhE0VMyRFYVyuPaK3DZW6sCs5tpXy5W79qxWqUwCT6ryjA?= =?us-ascii?Q?5xSH/a1O7WIvsTV9wbuwxzKjUYikozeoaGqhfmm5dqMqrMjxYuSAtwf1t8YK?= =?us-ascii?Q?//TcxfHFMuuUW2LJxOykT0/ZkvflvJAQYOaFm/7S+oS1spnzrn4b93e7pmw2?= =?us-ascii?Q?QnCE/+HeVY3UTjNU8AP8VXbZq0Sm/VD1yITpnZJcXtqGBKBu/UNIjLGaOodS?= =?us-ascii?Q?PeD6Mk6cR5MXghEKRYd/vsnMCcWfbgQtLqp8bgUYCOtSpt3aMG0/tjYwu2mj?= =?us-ascii?Q?ignYaTfmhLF8YlcqcYZYLqrb6OA1PMs4D+n49PvXALn2QrezIqIg/3TwtWGL?= =?us-ascii?Q?D/Qe7TWQCAgjlm2B5EmesjP9gyxrgpqXhno1Jcsmnj045g0SlWJwwCPBxkMw?= =?us-ascii?Q?tydap/wDqi7dwBn2fXYQ0CtnQTG90vGLBoFkTgwCyGFrIHYEToFLbJ3aFYWZ?= =?us-ascii?Q?NduexVDi0oClhthR0BvFfZ4bhm6Wn4wd5/5kmkzKwb6Lp/4AzP5GsiYURGjz?= =?us-ascii?Q?afQyRShVjNtXtlSZdGq/SduLg2nlrVYx4s10o2tMzImIavwZcZLDvMqFnWRz?= =?us-ascii?Q?ZtaExtNevCTuEiDt4m2ldb4B5Bd/JVp26x1hg9qkYRlmNXlbPqsjKRM3jsne?= =?us-ascii?Q?43QdHJQPw8FCBDBtSFBGKCk7dbckjhkqlMKo4v0JIqtPr1Xt+Mc8n+muXR5i?= =?us-ascii?Q?0729rdMuz9UXGiRFBsPsg+N71wA80x28iBlTu4hC2YM/CXxEP/0fNoJG05xk?= =?us-ascii?Q?mX8n4GoqB8j0l1wB5ItJ88r8UxdEa2u72HgNUcrY4zWha7lODBW0CAVxk98T?= =?us-ascii?Q?Iug76nLj1npOw8iW2BBcltT/DC9lDZPGgM1MijFTAQHOyJc10wKCS/aXGIyb?= =?us-ascii?Q?EKOwjoi+gxD5GxKAi8X4pOpoHnyRm6X2ihtpzw0hxxB7rTZw4v6UisqNApJV?= =?us-ascii?Q?YVvfbBVA3NaW1rnoMM43NML+IIrGGWxuvqqks8ciXVwoKg9Aa9yGUdmHU/en?= =?us-ascii?Q?wyNMUhmQdlMxuwzjUBf7BeSug239vvAoYyiGnzqJSx/klv6gAvHPaCETlUIi?= =?us-ascii?Q?488QXKVSR42V6YW2xsrKQ+xhwP04zjwhaUj2hhykXLFpLNvzuqD4PVoh5s37?= =?us-ascii?Q?bVOuX2T71AfLSw9rqUo1fSpSp2xE9vJmZIwKGXXxlm7+wYLPDTDvdbN80gj9?= =?us-ascii?Q?BxJ0m/wAazSj0Y2sgZGLqczKQOIrGQ4HWuIrcwDAXwwyjPuRw9MIDeUoHzuV?= =?us-ascii?Q?RNRd+cpLfSdfFOgrNd/7mCSIicsVdbgT6EIkaSfIoMytbA6uldqC46BRQP/K?= =?us-ascii?Q?7npQbsNTvv4VTtAQz6e3Azt9U0/BAdQ=3D?= X-Exchange-RoutingPolicyChecked: Ion6hYfxujw+wLMuGjxGcJMwYEg/PIBKM1a1mJZ74jWFNOTUpCaSkUm7M9fLEcGb80W/ieEenH8D8kShzdz94ebjB2iPb3c8MZllyWZ8QyNCZmchkogJ+5pHa748MIsQ8mPmkoye++L8mX26NK4eD6ynQzZPf9I2iClChSL6PgB2ZQYKj7BDS6iDDpT+t4fe6vRYoUtM5OO+n/U4jIoZ3BPJskQMZc9xd2COhyjCgLNEWUUUYIKioInnr9OQDd+zhLhKoPH7qNluB1jaZnJdoi8zW9un6dTL1NMjVOJnW2ouVVwhTV24uMPcKFNaTZ88Gy4p0Ni9igTj9gOwq7vfVQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1d6302dd-2b19-44f2-8105-08deed4fbc43 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jul 2026 08:59:45.0658 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: /JlQYz+jF6EpNLR9D4hxLCoZQ38Y1IKb+/vrSuy5RmH9pN6Hs4meFLfnq/KrPeS+nfabovCDnLBNlcTrB763veQyApCSdomYZSraCwJZ0sI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR02MB11606 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfXzhFGSMG6Z877 Jl+SQiprkQd2ATckcFGdCmFlubo6HFjL8Sq5OqqaVK0dGeXpkM44Dc7UhdLBRAF8kWw1KQIERIo zEjuPe3PFGAbXeICPHftYYCwJsQmT4Q= X-Proofpoint-ORIG-GUID: z7uZUOVF47Fg1NB5GdkUsSx0t3SKTw7_ X-Proofpoint-GUID: z7uZUOVF47Fg1NB5GdkUsSx0t3SKTw7_ X-Authority-Analysis: v=2.4 cv=FYAHAp+6 c=1 sm=1 tr=0 ts=6a69c102 cx=c_pps a=JRl+IjCvVGCyytsd+wv0WQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=Ap8k9tRZuQ82DLYWQqG7:22 a=64Cc0HZtAAAA:8 a=v6biFoHkGfcEids9QrgA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfXyGU9Dtwvsojn 7e+zUn7R8TLP1R3lFCf9ke3BasU5UyfUwnvn07bExwE5Z14K5csu08EMubXHbfGEcmHTad4Fe5x CcQBvgrxiRIe9hy8C0QjHabKEokPKj26wAcb96/9Sq8OYZsStIzGc73pdgMmgpguY7jgFRyWs8b FQc+qHc9yzzz1KEwoMbREszNs/epSrtbtXj+lTCiHM+ER+eg4zgwUMAdnFrMTtDd+UREP6PEgTB 3DS3XPm6GO9rqgmBlCWBOueJQNps4sDkd0+s0/RWV3voFRs9w2C6NruxuuCiSIO6QqxPFxUDXe9 qXGx3Hy/8D2hk112sJr1rSb0Hufw6eyuxqyODpxGN9moX3jeGWkjDLamUfhbjq3unwFjFE6A9hC 40dC0tKDEaRTKDLDPjhXywsyr/j59puFa5Q9N6b3S1NIjxZkcQUq1Ucv0S+jyJF2TSlhrv48RWa X38TMkjMYhIEPW+WHvw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_03,2026-07-28_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: GLRBTMSJN3SQFQTTWR6VPF7N22IXCJ6V X-Message-ID-Hash: GLRBTMSJN3SQFQTTWR6VPF7N22IXCJ6V X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1785316114888158500 Content-Type: text/plain; charset="utf-8" Append 'x509' to the function identifiers managing the tls-creds-x509 objects. This defines the functions' scope and prevents naming conflicts with the introduction of functions related to tls-creds-psk in subsequent commits. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda --- src/qemu/qemu_hotplug.c | 40 ++++++++++++++++---------------- src/qemu/qemu_hotplug.h | 24 +++++++++---------- src/qemu/qemu_migration.c | 16 ++++++------- src/qemu/qemu_migration_params.c | 32 ++++++++++++------------- src/qemu/qemu_migration_params.h | 14 +++++------ 5 files changed, 63 insertions(+), 63 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 5be567b510..a192ab1a0b 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1729,10 +1729,10 @@ qemuDomainDelTLSObjects(virDomainObj *vm, =20 =20 int -qemuDomainAddTLSObjects(virDomainObj *vm, - virDomainAsyncJob asyncJob, - virJSONValue **secProps, - virJSONValue **tlsProps) +qemuDomainAddTLSx509Objects(virDomainObj *vm, + virDomainAsyncJob asyncJob, + virJSONValue **secProps, + virJSONValue **tlsProps) { qemuDomainObjPrivate *priv =3D vm->privateData; virErrorPtr orig_err; @@ -1766,14 +1766,14 @@ qemuDomainAddTLSObjects(virDomainObj *vm, =20 =20 int -qemuDomainGetTLSObjects(qemuDomainSecretInfo *secinfo, - const char *tlsCertdir, - bool tlsListen, - bool tlsVerify, - const char *tlsPriority, - const char *alias, - virJSONValue **tlsProps, - virJSONValue **secProps) +qemuDomainGetTLSx509Objects(qemuDomainSecretInfo *secinfo, + const char *tlsCertdir, + bool tlsListen, + bool tlsVerify, + const char *tlsPriority, + const char *alias, + virJSONValue **tlsProps, + virJSONValue **secProps) { const char *secAlias =3D NULL; =20 @@ -1824,18 +1824,18 @@ qemuDomainAddChardevTLSObjects(virQEMUDriver *drive= r, if (!(*tlsAlias =3D qemuAliasTLSObjFromSrcAlias(charAlias))) return -1; =20 - if (qemuDomainGetTLSObjects(secinfo, - cfg->chardevTLSx509certdir, - dev->data.tcp.listen, - cfg->chardevTLSx509verify, - cfg->chardevTLSpriority, - *tlsAlias, &tlsProps, &secProps) < 0) + if (qemuDomainGetTLSx509Objects(secinfo, + cfg->chardevTLSx509certdir, + dev->data.tcp.listen, + cfg->chardevTLSx509verify, + cfg->chardevTLSpriority, + *tlsAlias, &tlsProps, &secProps) < 0) return -1; =20 dev->data.tcp.tlscreds =3D true; =20 - if (qemuDomainAddTLSObjects(vm, VIR_ASYNC_JOB_NONE, - &secProps, &tlsProps) < 0) + if (qemuDomainAddTLSx509Objects(vm, VIR_ASYNC_JOB_NONE, + &secProps, &tlsProps) < 0) return -1; =20 return 0; diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h index 60ed0e174c..0c969ab7f0 100644 --- a/src/qemu/qemu_hotplug.h +++ b/src/qemu/qemu_hotplug.h @@ -31,20 +31,20 @@ qemuDomainDelTLSObjects(virDomainObj *vm, const char *tlsAlias); =20 int -qemuDomainAddTLSObjects(virDomainObj *vm, - virDomainAsyncJob asyncJob, - virJSONValue **secProps, - virJSONValue **tlsProps); +qemuDomainAddTLSx509Objects(virDomainObj *vm, + virDomainAsyncJob asyncJob, + virJSONValue **secProps, + virJSONValue **tlsProps); =20 int -qemuDomainGetTLSObjects(qemuDomainSecretInfo *secinfo, - const char *tlsCertdir, - bool tlsListen, - bool tlsVerify, - const char *tlsPriority, - const char *alias, - virJSONValue **tlsProps, - virJSONValue **secProps); +qemuDomainGetTLSx509Objects(qemuDomainSecretInfo *secinfo, + const char *tlsCertdir, + bool tlsListen, + bool tlsVerify, + const char *tlsPriority, + const char *alias, + virJSONValue **tlsProps, + virJSONValue **secProps); =20 int qemuDomainAttachDiskGeneric(virDomainObj *vm, diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 3d6e472443..943478fe68 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -3511,10 +3511,10 @@ qemuMigrationDstPrepareActive(virQEMUDriver *driver, /* Migrations using TLS need to add the "tls-creds-x509" object and * set the migration TLS parameters */ if (flags & VIR_MIGRATE_TLS) { - if (qemuMigrationParamsEnableTLS(driver, vm, true, - VIR_ASYNC_JOB_MIGRATION_IN, - &tlsAlias, NULL, - migParams) < 0) + if (qemuMigrationParamsEnableTLSx509(driver, vm, true, + VIR_ASYNC_JOB_MIGRATION_IN, + &tlsAlias, NULL, + migParams) < 0) goto error; } else { if (qemuMigrationParamsDisableTLS(vm, migParams) < 0) @@ -5171,10 +5171,10 @@ qemuMigrationSrcRun(virQEMUDriver *driver, spec->destType =3D=3D MIGRATION_DEST_FD) hostname =3D spec->dest.host.name; =20 - if (qemuMigrationParamsEnableTLS(driver, vm, false, - VIR_ASYNC_JOB_MIGRATION_OUT, - &tlsAlias, hostname, - migParams) < 0) + if (qemuMigrationParamsEnableTLSx509(driver, vm, false, + VIR_ASYNC_JOB_MIGRATION_OUT, + &tlsAlias, hostname, + migParams) < 0) goto error; } else { if (qemuMigrationParamsDisableTLS(vm, migParams) < 0) diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_par= ams.c index dd47516742..d551ab9216 100644 --- a/src/qemu/qemu_migration_params.c +++ b/src/qemu/qemu_migration_params.c @@ -1150,12 +1150,12 @@ qemuMigrationParamsSetString(qemuMigrationParams *m= igParams, } =20 =20 -/* qemuMigrationParamsEnableTLS +/* qemuMigrationParamsEnableTLSx509 * @driver: pointer to qemu driver * @vm: domain object * @tlsListen: server or client * @asyncJob: Migration job to join - * @tlsAlias: alias to be generated for TLS object + * @tlsAlias: alias to be generated for TLS X.509 object * @hostname: hostname of the migration destination * @migParams: migration parameters to set * @@ -1166,17 +1166,17 @@ qemuMigrationParamsSetString(qemuMigrationParams *m= igParams, * Returns 0 on success, -1 on failure */ int -qemuMigrationParamsEnableTLS(virQEMUDriver *driver, - virDomainObj *vm, - bool tlsListen, - int asyncJob, - char **tlsAlias, - const char *hostname, - qemuMigrationParams *migParams) +qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + const char *hostname, + qemuMigrationParams *migParams) { qemuDomainObjPrivate *priv =3D vm->privateData; qemuDomainJobPrivate *jobPriv =3D vm->job->privateData; - g_autoptr(virJSONValue) tlsProps =3D NULL; + g_autoptr(virJSONValue) tlsx509Props =3D NULL; g_autoptr(virJSONValue) secProps =3D NULL; g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); const char *secAlias =3D NULL; @@ -1205,11 +1205,11 @@ qemuMigrationParamsEnableTLS(virQEMUDriver *driver, if (!(*tlsAlias =3D qemuAliasTLSObjFromSrcAlias(QEMU_MIGRATION_TLS_ALI= AS_BASE))) return -1; =20 - if (qemuDomainGetTLSObjects(priv->migSecinfo, - cfg->migrateTLSx509certdir, tlsListen, - cfg->migrateTLSx509verify, - cfg->migrateTLSpriority, - *tlsAlias, &tlsProps, &secProps) < 0) + if (qemuDomainGetTLSx509Objects(priv->migSecinfo, + cfg->migrateTLSx509certdir, tlsListen, + cfg->migrateTLSx509verify, + cfg->migrateTLSpriority, + *tlsAlias, &tlsx509Props, &secProps) <= 0) return -1; =20 /* Ensure the domain doesn't already have the TLS objects defined... @@ -1218,7 +1218,7 @@ qemuMigrationParamsEnableTLS(virQEMUDriver *driver, * some other error path between now and perform . */ qemuDomainDelTLSObjects(vm, asyncJob, secAlias, *tlsAlias); =20 - if (qemuDomainAddTLSObjects(vm, asyncJob, &secProps, &tlsProps) < 0) + if (qemuDomainAddTLSx509Objects(vm, asyncJob, &secProps, &tlsx509Props= ) < 0) return -1; =20 if (qemuMigrationParamsSetString(migParams, diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_par= ams.h index b7a829b85a..14e20fb71e 100644 --- a/src/qemu/qemu_migration_params.h +++ b/src/qemu/qemu_migration_params.h @@ -115,13 +115,13 @@ qemuMigrationParamsApply(virDomainObj *vm, unsigned int apiFlags); =20 int -qemuMigrationParamsEnableTLS(virQEMUDriver *driver, - virDomainObj *vm, - bool tlsListen, - int asyncJob, - char **tlsAlias, - const char *hostname, - qemuMigrationParams *migParams); +qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + const char *hostname, + qemuMigrationParams *migParams); =20 int qemuMigrationParamsDisableTLS(virDomainObj *vm, --=20 2.43.7 From nobody Tue Aug 4 22:22:05 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1785315927; cv=pass; d=zohomail.com; s=zohoarc; b=jQICFVks2mMu+bwRv+NcuJlNu7OBUgsoDTeO4lTosrjJcQDm8pk1vdxKZIWcUBzquOJcXJvbmZVvUf0WqIRb+AyjDmOplMfFzFLvrfp5JK32GgivMfrkQSvzqXQqHsMVArLK3f32+BTIiHuYEQxJg3baz8aMAnQH1Bj8LKCF1rs= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785315927; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=OI4KCXIowfTldCa7EDOI9ojBsuRK7x/cJkJPcryENWA=; b=MdztBT6jVaK/b4N5/Bx2cLCKRExeLtS/Ha7EWvCOHbWXxkyLRcOFkoSU7IVAmyX4c0If2Wdr/OVvqGbDdvpdN44LkQPyYJ6hyyWxVazvX5aFawovIm7W7SUBs8DHJviZfNPHfniCwNPRDn/0TxoNdmaRhD3IU8hrg0L/HkeOUvM= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1785315927135914.9344699432763; Wed, 29 Jul 2026 02:05:27 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 01D0C3F94D; Wed, 29 Jul 2026 05:05:25 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 847F841E39; Wed, 29 Jul 2026 05:01:22 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id ADE424190F; Wed, 29 Jul 2026 05:01:00 -0400 (EDT) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id B0FE941C9C for ; Wed, 29 Jul 2026 04:59:51 -0400 (EDT) Received: from pps.filterd (m0127840.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66T7e8JA2080533 for ; Wed, 29 Jul 2026 01:59:50 -0700 Received: from sn4pr2101cu001.outbound.protection.outlook.com (mail-southcentralusazon11022095.outbound.protection.outlook.com [40.93.195.95]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4fpy74t38h-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 29 Jul 2026 01:59:50 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by PH0PR02MB11606.namprd02.prod.outlook.com (2603:10b6:510:3b9::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 08:59:49 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%4]) with mapi id 15.21.0270.009; Wed, 29 Jul 2026 08:59:49 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=OI4KCXIowfTldCa7EDOI9ojBsuRK7x/cJkJPcryEN WA=; b=KwIZB6YJryzy60Lz4hqhYpT8Z6usUe0cS4eHbj+Rstbpyt1KgO7Jy0myB //6sPDKjvLMZOfrYdNC12YyJ52g9cbmIjvGkr3Doz17l9PRjHkQCPuyw1WwD+91z Hbfq0XjXYd0AFZWkujYb67TV3bqguoBxEyRrnBR+ZTy4VeJ8JHKaYZ+JswMiRN3f Dt0hLHnBaz81Ax5c7ZudEuVj2u7wIp1dBOk/AJFCl7czsB4VxQ3EHpI9OZf/+2Bq N+ZaUFkrChSf3E0m2AQ5ZPvF4LYOa2v1llmuZVd28G+UArDMdWDH7CNNqOhfc1GP Mqd9brd+9B/p9XQA8uWGXIpWHdgXw== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=jy2UOY/T943HM2O+ZXfpYfrkQchD0PnoSw7uQ8LFFeTFe0c1kMfqd+ohaWeIEiVHgjYNGbWF5qQWI+shdlnU0jPiW2Ig6h8/lIImLJT7VT62lVNrGDSZwotEa0mo5n7fHq3ap92ELK41QzMayt65P2TlrqB/YB/NhkUXD+L0VnTNyM5wFLStpYLqNfdvLRSE6jfp0g8jL/egK5YdfLE4Wo2ZUA/ZdJa0q6B7lHaLlREEZVkS1Kedqk/fjYBhAspB11JR5hxVMSL+KPeJ0j6/anBg1EvbJLGbfYW/o1JQUWONnacAzFHjtY7uxGacLrh2n5YxOUROymRX3wYNFhh2Tw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OI4KCXIowfTldCa7EDOI9ojBsuRK7x/cJkJPcryENWA=; b=mv9ihHRxaYwCrP31cm6b5sAc0viMIknLIMx79OgPx2MFGspnHoTQTKRWTanC+MucRYNae8oHU0C1dnfxr4xi9qFcb+am/8pYuEeQyXR9lKJ3kc4pDOd4bjOT+se0X4DBKK4xB2TTrCsq0I3uzOH8MtCOlFt44nMb5NV2BTHwlQdzVIaS8aCPm2Ex1X2uOAUguhbZzsjsn0/NP4qn2HLwGnJmn6yCp4HIjk0P7E8N11HJC2xMrhsCcC2WvUOpU0eu0P6X/ZYJybVxR79KQ4OmMHRUEh4ntpPS1II5PuVW1PjZ3U0yMZSQrnC8jShfFHFZAod8krxoeve/ZCUfJpwH7A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OI4KCXIowfTldCa7EDOI9ojBsuRK7x/cJkJPcryENWA=; b=ls6INwwBXyvWCzl9r6SKyFwMEibceOBUz8sXMoq1q1V6/NCtb12MzHEhUVW0LuLAbGXm6oxto4LMQHYrpWx/iGI4RnHaAS3eqLTJQIdiH76cy3FryhjagZqygFg0gp7dQ9MlLjVY2i3So5EA5b2mniZXNeJkGjFOiQ0MfvggRf/WSo3EpUZ8dBS+rjS2ANhCzfjyc/a1YlfYSk+DhLLadKO6ByGyKkmNE8qhj/99w+DMrukXKYYHEijMHdvXIaznCoaP7rdtEPk648TquPuUQ790HffjM1goJ0q+yU7V5u3mC9UHtk5xvy3hLPk4swWL8JRbmkIyLFjtadSFliszDw== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v3 5/7] qemu: Manage tls-creds-psk object lifecycle Date: Wed, 29 Jul 2026 08:58:57 +0000 Message-ID: <20260729085917.3243911-6-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> References: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: CY5PR22CA0100.namprd22.prod.outlook.com (2603:10b6:930:65::28) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|PH0PR02MB11606:EE_ X-MS-Office365-Filtering-Correlation-Id: 1cb983de-4969-4e11-2c7f-08deed4fbe99 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|3023799007|56012099006|18002099003|22082099003|10067099003; X-Microsoft-Antispam-Message-Info: ZLPbK41xBWcJXFBg2fqdnxrRgYviW7EmQNoJS7Fxq8qxnYAlj4LDPr14iXCKKN7B364xvO3DhsY3PqS3shksTEKBCM66PFcn9VVLGACL0aV4kO+2r9WZ6ssWrDMZNrkkec8P3ZUugVs0lihsSSjp9nbn14VQ/SIUzqgeeW5jwycH6la/gXfyzWeCP9HLxUqNGm4lSMYIz2dBMdMBP1B959qdjwh8EJJ2671B0jbEyzZgrdH38DW6bKwTc25sn30IdPPlBBcg8yRSMK3K0Et+XZCPqoDL6iGoe2dBURrSPi0jTvmLNt8CuQ2xf40YbIcz+R1TUM5wLMcpkEVuCSar/9mHQKOVfsYRrD/MmIYsqXr6Qld4NYr7+dZIJY9NujPWoHrAjDoX3iow/T9AqCTgdbVlaK6lmSh/kzknQneTMcL2Yx4FCy7gpsOC9LAcN9yS1PJ31rKc3sZefwtGMIbCP3VItFq1oE4RB39EcLFxe1tw2NKxxlIedj7H6L6SMZCRgvzUAQwkyw9y9wC5R9h1XByTo9Fj0X5QqGbZiKUiYkog+jbNKbb9A7vKyI4M4n9YOAJPOYjO3zS4JIgEKbSNFEPTxW1Rn9Ygk7ogTnUfbmpMfJfGFxx3aRLpSq8N3ljukeYifgCgDUA0+SSaiVd4+W6qC6/FzM83TAxks7zSckY= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(3023799007)(56012099006)(18002099003)(22082099003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?IFI0GFAwu/P5PAJG+AIXQc88ZOTp5dnnZ4YnoXQhxShMbaAdfr7NCvWqvQKj?= =?us-ascii?Q?oyZCDwtnsMiWgMb0mKL2k19ckywmQ4Udmw/b9gBKMTmoZzRVw1hoMEM4pfgY?= =?us-ascii?Q?OpxymEIamAuTOEHssLFz+dGuIUXz3FvXwZJat7wX+/3beZAMe+yxhdWFDcSO?= =?us-ascii?Q?K7UbprEcUY5b+rS51nvpAK+qQ4DYT1m9D+vPt4FNkKP0QCY/PEybPAVHaaeF?= =?us-ascii?Q?dVKcWhi3rtEBX7Estk/FPvmzh3VPz51p/m3ENEH8WekMe1CMcl2UQWAcwCSQ?= =?us-ascii?Q?THBxEytN24Zm5eFsnArC/s9kVC73xsJbiE24KNV1p1Smhwt70pGyKcr/AGbU?= =?us-ascii?Q?y288/vqorBkCir7j5yz/mRP9tHXwVdwTGaD5HtZMuslAHhpd2v/8687DDUxR?= =?us-ascii?Q?x/sF/1pa5C3pOimPk3EGI6vWwuZXe++lqH9dYR0pjryi5G833DEW5sOU777f?= =?us-ascii?Q?NNFKh6kZYXPXme7c9pX4rNiwhsZX+q8H2071aHdLfKBaHqn9HRuvhy9eymra?= =?us-ascii?Q?dI+QLEe3JHG5TSdjIa8dxyPtosmrVf33209ukuB60c+8MfGdrlvq9fkz/Yeo?= =?us-ascii?Q?q2U7QNGTyLsihcWjNtkOLkhQ6xmdsaPFMGq+U5A8GRCFKGHs9zWDHa9Ehlyw?= =?us-ascii?Q?FVhvZjhk8OWjMhserhpUSeflKuIlkcKDD9VIGg2fb1/N7fOBpT2vU68F7Rdq?= =?us-ascii?Q?658IAICb5Koc/PjOiuAq8yNGe8ehPwFU/fPhAVtd06PGKN9apBxosBLc+DDV?= =?us-ascii?Q?V1nMTybOF50/NjgTLk9mLrrezwYPO3DbOAy5RE0JuYfkGesnAr9sPW17Mc0s?= =?us-ascii?Q?HU8tGK6Mg+/4IVbk3yUz4lI8WYpLbrvImk6QXFPZyvLAh5Ncx+H4Tw2RUBSA?= =?us-ascii?Q?BW5kF1JN3kpQTpGeGdoq/JPvZPa5W0OjvM8ZU2T2RE73/sIH1r/mBcwIzwli?= =?us-ascii?Q?RKe8DIEPbGHn6JvWAuaihTpiOPP4N9UoQG9aqKGa+Px4Iw0aYELaE4OrQELt?= =?us-ascii?Q?jqA5quDVvo2km3F4SPhDU3qzCxRSR+2YjAbpD6RfZF4s7O9Uhc9q2jN1q0Aw?= =?us-ascii?Q?GJhyaJdikRpOQidDKAEiA17FX/v+9KcipCtA40ZBkX/XZ3LYmzyczD+yZh8o?= =?us-ascii?Q?p0QXKX6U8dTu6ZxAAwOIU0UF6l3NkJVql5r1nGL19FMkmzuulafEFneNV77q?= =?us-ascii?Q?SwVIw/hz/md8X6/jRHn8MENAEP+QATm2noB09tGQxOfYFJLbiaqNmVRa5S0M?= =?us-ascii?Q?XuoLRRcJQ/Kg8Fj2jP7ep/9oqeuNmsEhgPPDBOmDiTtaieJtRweBe3SDDpov?= =?us-ascii?Q?7ENYqFP1Xv4CqMi5XhjsKxNLtmrv9iUzwT4WUA68PX0uocONNmUayoZ881/z?= =?us-ascii?Q?eJavMrQaBXe9Rb24jt9AxAtvsyAlhLa8VtrtfiglaeeKWwrF8qNJM+3qfah6?= =?us-ascii?Q?x5bONoeTWHZ2mFUmqs+Lmh6C7J9Tm60sfw2mgYVQTHRUOAdyGs0ef6UF38/b?= =?us-ascii?Q?5RPvu1+hYyWDeEjo2d1Kwmkg4Uewhc+WwA4GcpD9XCaCUb7XG54MwuyKrAov?= =?us-ascii?Q?iJxIMMgrXXVT7+THzGz/99OjHtEHLjabRpNGNk+p7D0QG7+Gvjxy/O4engs2?= =?us-ascii?Q?V53/RaW3RRsaG+nOKH0xiuqPFKqopoH6fSIaYYDngQw46x6qhFlr7jN+D+di?= =?us-ascii?Q?MhFsPwzGaq15DK1UNWmSmK+n+brEbkzcDc1anDvTWUgBC3Z8iReDmKR54gPz?= =?us-ascii?Q?2huMvs2tnCCd9EJwc/lC9Zw0krO9nho=3D?= X-Exchange-RoutingPolicyChecked: qOz33mm/IBnEtK5vTXo67PZ4wiB9d6MCDS7JXC2K6VhYVJipyTOQSDzF7xxnFp+BvkSueIBOMDHQXc4xF63v8OOFcOX0/8E9c6q4VUnFLu7ttzkJB16XqNNniC42J+cYMSCP6lmWvg/CIPnIaobIbYRnxzRCD9RiIHSY1s7uE2wwLOUdKvPwVaKRcQ2pw8V2FLV4EMTxk4H8p2M0L2SHG2HuyhTsPK9n3XyP02RNj7DujrFiOUIrRE+i32ypNsFQC7tYLOiuEJiaSp9CgnPjh9D5RyCtYxivUzuHgsg3ZqrcBep7l9rXWLD2MzB8gMHKImmzQ6hbOeekscSdY6bIlg== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1cb983de-4969-4e11-2c7f-08deed4fbe99 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jul 2026 08:59:48.9821 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: bpU6W5BQtPzWxPYy8MUBqHgiKMxtvDoE5KGqc3eniQN0GPm86mZbV9rjlA6zuqdGTL1Tbo04SahRqU22dm6nMXDpyfVhdwSIScpvuZ7Mv6k= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR02MB11606 X-Proofpoint-ORIG-GUID: gmT7rqe2I6qsNdj3kWpgpqibYEUhmrgy X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX1r0Kc1Iip3mv dhz+e4Qvejqky4oQD4umXWXiuXcCJE1a2OdcM2jEkqoJQ6t4vSLbTCubd+GmZaCm8h7wO3d1QVM 4GYg2f7cvVsxFVMeII1Tt4ggb2mnpdw= X-Authority-Analysis: v=2.4 cv=UIzt2ify c=1 sm=1 tr=0 ts=6a69c106 cx=c_pps a=ZO9zLbrfvwitr87ojz3Jng==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=_-M8LpHI31CeLmyZm6wg:22 a=64Cc0HZtAAAA:8 a=FkoMf_KoTue4cd8-psAA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX1IdorzhJYFu2 SZcX2LgHf3H2h8T757woKB1D4Dy4Fv2u0xgNVOBMcIN32YxuBd18Gc3p6gfr5i/nqSPbkQgvctb kdqVBGF13LQmhT6rjeMVlrTz/y9V0d4Aq5y4aaRDhF4D5NYaTwOEKvzgrjXyaLdeUnb9CmAuzMI 4Z0v1TxBdZI0+ZsweEFa7X98kFzJ5W5tWZQ3mJ8VgNGtQ/9FQJXTbmvfKJPR2aQRjAojR1i6GUk QQo8/Wz3OEpbg0OIs6w1KOoHLHtATZwZ5UyQkpjD6kQ08uH9xrCw7A3tpoEBEMVlZBl2ZkODb6a r2FCfILpMdr94yGYOpLcPXDHhzU8uKiGAhxgsZ8omIKIntomtTl9HVusdC6wnWLXIfgYHB8kiXB baxQ03d2tmShCH55lQz1ziOdkGC47ay1K5bXv/iEkc5pEJET5EspivkJFz1wrKOMgHYS0VrJfyZ Eqr1BW+D00TYInxC3gA== X-Proofpoint-GUID: gmT7rqe2I6qsNdj3kWpgpqibYEUhmrgy X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_03,2026-07-28_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: 42NTTCJK47WWZ3DVGTKZHLJHTJUG3LV7 X-Message-ID-Hash: 42NTTCJK47WWZ3DVGTKZHLJHTJUG3LV7 X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1785315928801158500 Content-Type: text/plain; charset="utf-8" To enable TLS-PSK-based authentication scheme, add support for instantiating the tls-creds-psk object through QEMU monitor. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda --- src/qemu/qemu_migration_params.c | 66 ++++++++++++++++++++++++++++++++ src/qemu/qemu_migration_params.h | 8 ++++ 2 files changed, 74 insertions(+) diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_par= ams.c index d551ab9216..129f6540ec 100644 --- a/src/qemu/qemu_migration_params.c +++ b/src/qemu/qemu_migration_params.c @@ -31,6 +31,7 @@ #define LIBVIRT_QEMU_MIGRATION_PARAMSPRIV_H_ALLOW #include "qemu_migration_paramspriv.h" #include "qemu_monitor.h" +#include "qemu_command.h" =20 #define VIR_FROM_THIS VIR_FROM_QEMU =20 @@ -1237,6 +1238,71 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driv= er, } =20 =20 +/* qemuMigrationParamsEnableTLSPSK + * @driver: pointer to qemu driver + * @vm: domain object + * @tlsListen: server or client + * @asyncJob: Migration job to join + * @tlsPSKAlias: alias to be generated for TLS-PSK object + * @migParams: migration parameters to set + * + * Create the TLS PSK objects for the migration and set the migParams valu= e. + * + * Returns 0 on success, -1 on failure + */ +int +qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + qemuMigrationParams *migParams) +{ + qemuDomainObjPrivate *priv =3D vm->privateData; + g_autoptr(virJSONValue) tlsPSKProps =3D NULL; + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + g_autofree char *key_dir_path =3D NULL; + g_autofree char *shortName =3D NULL; + virErrorPtr orig_err =3D NULL; + + if (!vm || !vm->def || !(shortName =3D virDomainDefGetShortName(vm->de= f))) + return -1; + + key_dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortNa= me); + + if (!(*tlsAlias =3D qemuAliasTLSObjFromSrcAlias(QEMU_MIGRATION_TLS_ALI= AS_BASE))) + return -1; + + if (qemuBuildTLSPSKBackendProps(key_dir_path, tlsListen, *tlsAlias, &t= lsPSKProps) < 0) + return -1; + + /* Ensure the domain doesn't already have the TLS-PSK objects defined. + * This should prevent any issues just in case some cleanup wasn't + * properly completed (both src and dst use the same alias) or + * some other error path. */ + qemuDomainDelTLSObjects(vm, asyncJob, NULL, *tlsAlias); + + + /* Add the tls-creds-psk object to QEMU */ + if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) < 0) + return -1; + + if (qemuMonitorAddObject(priv->mon, &tlsPSKProps, NULL) < 0) { + virErrorPreserveLast(&orig_err); + qemuDomainObjExitMonitor(vm); + virErrorRestore(&orig_err); + return -1; + } + qemuDomainObjExitMonitor(vm); + + if (qemuMigrationParamsSetString(migParams, QEMU_MIGRATION_PARAM_TLS_C= REDS, + *tlsAlias) < 0) + return -1; + + return 0; +} + + /* qemuMigrationParamsDisableTLS * @vm: domain object * @migParams: Pointer to a migration parameters block diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_par= ams.h index 14e20fb71e..8774b4596c 100644 --- a/src/qemu/qemu_migration_params.h +++ b/src/qemu/qemu_migration_params.h @@ -123,6 +123,14 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, const char *hostname, qemuMigrationParams *migParams); =20 +int +qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + qemuMigrationParams *migParams); + int qemuMigrationParamsDisableTLS(virDomainObj *vm, qemuMigrationParams *migParams); --=20 2.43.7 From nobody Tue Aug 4 22:22:05 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1785316011; cv=pass; d=zohomail.com; s=zohoarc; b=JIAfPGUD4+GW/UB8nietvE9btK1L5JsZAe/vLIqSy43HUc8DSuhHCkvomz7s3ZYhLpAjjbgiSUwWvA4cv1X2ZWDxF11BsWyf9mTxS+sov3qAQQrrguVFhHXvAvMCpuUD4QxavV6YyreKudkcgOesfd43liDwDb6QrEZDgxMYs4U= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785316011; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=CrN8dP9Chyz64LS0Cbktix/AuaSZrUGHOWSyI7YNN0w=; b=H/lPI3npOuH9gxnh447vgIGkwgyIptyj+hY0kPpaffFNRluR7mrZ1kr/Po+WWMOifhR52kFw3fCxhosB9q1UZsNe2FHAKLwHPuK6M/rwj1dQ3OSFKG/1uq2LuYlqnebmNKf/OvKMzIWwqD7e5rZ0Ryfxf5HzfgReIROtttpPzIg= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1785316011670618.2066582779395; Wed, 29 Jul 2026 02:06:51 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 7E37741BD8; Wed, 29 Jul 2026 05:06:50 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 76E0D423E5; Wed, 29 Jul 2026 05:01:27 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id C1BCD41BAF; Wed, 29 Jul 2026 05:01:01 -0400 (EDT) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 0534D41C7C for ; Wed, 29 Jul 2026 04:59:54 -0400 (EDT) Received: from pps.filterd (m0127843.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66T7cI4d2414198 for ; Wed, 29 Jul 2026 01:59:54 -0700 Received: from sn4pr2101cu001.outbound.protection.outlook.com (mail-southcentralusazon11022123.outbound.protection.outlook.com [40.93.195.123]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fq1gjhn2x-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 29 Jul 2026 01:59:54 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by PH0PR02MB11606.namprd02.prod.outlook.com (2603:10b6:510:3b9::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 08:59:52 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%4]) with mapi id 15.21.0270.009; Wed, 29 Jul 2026 08:59:52 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=CrN8dP9Chyz64LS0Cbktix/AuaSZrUGHOWSyI7YNN 0w=; b=YLR66ZQyp7kpCdwfwoycU4b4OK08a3Jg2JvJzJgh8smoC0YdqXXZm7IC1 czhBdWoeOcaIe37xoguoOfFHF8g5/1zH3cGLYRAvv5HB+Z3C3UKcU1HEu7bNW3hT 9Ql0zuD1tyZZFsKLgcFu633DNmA3ExNk/HWEDI6dnXo5fraOUod0yHvS0QuQHyvQ 0PkrVWuP5it4AvvL6cM06+0oz5+jkEh1sJwRCbreQZguigZlNgjphLjq9LjRA9Tm tA84VNB2C1+CU26V73Zbcr/QfX9rCPN2Ev4V1IJyZ9Sn9iJIPfWZQjxhVOFN5hP5 nu7iYL+ZCaZZZFB4LMFmLFwTfQfCg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=d83UY9FJVAkG+dpjvLG/Q6qjvvKfo8kU5SbV91V5YNUDQV/NnehFlGrCHTsCaK1SN/yhi+tAakp5i9TsjUNPMXzou3/7SYIMR1HJH99rxrzlhz6fjBnRS+sA0NCjfp04hMJhJQGiTnWQqZODHbWsY4TZ4Z1l3J+h9yKOxYWSToZvj+nj92KOPFXqV6X3cj07C1PxyHxtLYKxOnOKvtXTIs5MSH6pT/wpC5dXrf38BDxXLSkkxtpSZsSVe+JXzaYZ1PnnTbtrU8BryWEWQ1gfMEJxCytOq0IKG0/xyc8qI7ycXSzdQQif/a7jjYYBHqGz2htD7xvvfC9U+YurOZ8unA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=CrN8dP9Chyz64LS0Cbktix/AuaSZrUGHOWSyI7YNN0w=; b=Uvjxsk6TLr2OWViICtMu8/qKlgnZzVvf7myyS0ZBUO5PUUa8cVhWcO28uvWgepbihiBfCzzzPUDQFJECj2mezLgY88fKz4/sbsFEOvInyAf1576DVDySnLQ+zXrJW99pHfYKWl+nByTNL0NorKrJmcx2Dtj9z0bB9R6EJlCr63CHRV8rtF8PBoB/G7g0LsWS0KovJOgwXjKSOIJFA+BBWyPWYMKs5gouqKIvJR1WWU1TRVGSSQ7d0aXvKP4dIkxydTkbpcfvrPJiw0mkG7LLU5maQLgvNd62N65Oys+2wxXMeeJcMJK80Bh8XEI/ZoSVSiw1+S4yj5gvhuqAOtp8Og== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CrN8dP9Chyz64LS0Cbktix/AuaSZrUGHOWSyI7YNN0w=; b=da3tEdgjZyo2uVGA8sIJ5IhtMk1vfN6NUPniG82MxHLB4XSWiZ8d5w2brHUJI1kwII61pU1jAwFbYT4SucG4BIih23dugEZDMbX3LY/lfVYWukOz3Ln+hbFHzcqSDYxOdMTpLkOztdb0jcUG3eu0N+AfrIdNwDirepWphhVXNe/3RpYoBjWVK0tOHH08ZZ6zxECuuGWdvRjt74gw1Fvc/FvCk+dFuor64PX6hpWAAYyseuwHRzQoSDJrDN03eJKwm//2dtSI7wEOohPsfGsF5XnwZSWRq2OkG+iuAPWUotTuoCpaBYI2DcYhk78TKYP968cS22kCjHjaNW/J+ZRi4g== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v3 6/7] qemu: Set up the migrate TLS-PSK objects Date: Wed, 29 Jul 2026 08:58:58 +0000 Message-ID: <20260729085917.3243911-7-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> References: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: CY5PR15CA0117.namprd15.prod.outlook.com (2603:10b6:930:68::11) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|PH0PR02MB11606:EE_ X-MS-Office365-Filtering-Correlation-Id: 8504d2be-f270-43e3-c90b-08deed4fc0d7 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|6133799003|3023799007|56012099006|18002099003|22082099003|10067099003; X-Microsoft-Antispam-Message-Info: hSIfrPlZy4xm3YvQtjW+c58jD1pWDbsNXgSU5XXajJWQwE2ZNqoTC6H1zZj+bVcHS/S7RzeP1a5ibMtnBlxWUDQsxhoYhAFT2psH0rNRtouWcqEfzICmBbBp/SaCbBZMu9J8NNYXsZgtpqXL3bjgDBxyp4GpGCUXipRfeMAZ3d1M/Rw7xQ9FM6QVhIALeZLHWnb6HmCBmViajiwH0gI0zfaj0wScq519G53R0Vg9GqTHtQnYuKm+E6y+3yTy33F+jh8uL1FXKTYZuzab52EwHn4Ljy7AxN9/zWRmCQFHFNQeSp5rFodTKi4eX/isDOKjgxg7eTdoBZKEadgcmUp0wIcTfNQmc3AKC1VFsZycnyuA10udKCbJMEl+Pnl3UNCRdLpt9KmLZj2b6tK6cJMhfjrcyopJYyjmZDJG0A/azNBl8FLdOX3Hh6KkENbT21HeWBlMgGt6G6EurnYVkx+uOUZcDcdFHKC8GHrtoTL3EtQ68Gix/0ce894eqy1US4XMcSWADMRoEIlrmXDWJ+nIYlHHbtNOW1BLTvh8r84V2ff8O9YHTBLE0IIf4XnQuSxcLvTkjQl5dbIM88RQL2h9K6MehHHuD3ebRIERRt00NhrVb5J1kwPaDnW419rA3DiXnrXpeIhbdxBajfB6iuLXVjk9M3LtHxJ/678UHf5qlYI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(6133799003)(3023799007)(56012099006)(18002099003)(22082099003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?KifhDY1ppHCFTqRIx7FnfDjiYo0E2H8X+xPP/cF6AooZ3dKOa5yz58nAgCF1?= =?us-ascii?Q?B0lS1GBlV5h6eAnXbxkPdx4ucibtIP1dkiYaTlS/Ajc7REmUl/5UbdSAvjK5?= =?us-ascii?Q?sZMtqMZygdSpmjKVqg3YDDus2PE41W2CX5D3lk1z+nuEnbBYJR3kkK2A+EyF?= =?us-ascii?Q?mPjzKmygW06j3slCczPC4+iwBFI/CXh7DRYADzi58dull3lVzvHuFmqwbvX7?= =?us-ascii?Q?46IbzPlcALZgXizYUghMbdd68CFfxFbEWhSewgo7uQB8xzgZXnnoZHEGF/yb?= =?us-ascii?Q?UaFcV0pq3Paru7nY7X032iIdQSi8NatdRjY+ktY6C5gcM6faIwmKoxDL9giN?= =?us-ascii?Q?DU/kWUtthZKk33T8+flJxNd2fPkbe6sn+16HCbdAAnzs6cwK8el2WX3c9TSP?= =?us-ascii?Q?jOE8qXvvq/r/ppyQ2p2XUzmUxHuxSWeioMmyQU3IvbWhs2RSePSQmELtREjD?= =?us-ascii?Q?BFoKNjyZgVcliXEBU4PdYJx1J8WVcCoHnn0ALycVXr79S3/v6RG6txliW6KY?= =?us-ascii?Q?TYdq460TjBhIYSBP/vKyCaNzoOfWbaDmpezwqO87DasFLvS03YVVd2kDei14?= =?us-ascii?Q?hJd3e4GzKW2tc9q6jsfn8pXAhtHJgDPmv6l+uXImDwEDgicWHw/4QlRnfRvq?= =?us-ascii?Q?dvtto9p9CcqVWNdrpWmpydY7jxt3XlRCiR+pQviBGSlGCs5AeteLDOvqNQh0?= =?us-ascii?Q?+OrKCtouWLt3X5SC66yAi+7b7AnLj5zuaSnQb/akeGcwRH2yL8AuRbYCVUYp?= =?us-ascii?Q?2tg7F3ei5s4f+z301a45qrDC0DAt3hsdaDs2spCUdzS2z1yfsRmaQk0/+DGr?= =?us-ascii?Q?DmVSsfTA8a06nSBX9y0AZyMBPr6EpAcV16FzDvlUeJ2y8C460iRauk0/haLB?= =?us-ascii?Q?4cE+JdOTQd37sD3S3mXzWgRRo7sSJE/NIyaHA5LZwxli0P9PtFHyG5JCscqa?= =?us-ascii?Q?uPhWFCSDfjmiPk2+X1fVOf3zdH1EHDuvKsYhowa+c9fl9tsVMxY8XUNc02Xp?= =?us-ascii?Q?tEPtRHnKotlWCDtCuSs3Keh/RPbJLj3Y6NaQDSPoPPrrNzHKmT2uOB8DPlGT?= =?us-ascii?Q?jhvur7/6wtUQRZ1WTMFib8tmE+r+M9sk+G09oTFnEzJoVMqW2RWsngtXJHCE?= =?us-ascii?Q?cTJH9dixWbPLuNeUs0zhGBlJXoq3eId3XvJBJ7AxYw/pB3DW6PilcS/YN1/l?= =?us-ascii?Q?S2B9DBSoMWUTcgHrqUg+x4YkrEGY4nHDQTSLBe8z/AEEpeoHbWl375IcNpn/?= =?us-ascii?Q?PRW8h/cJVbecPn1WLJO1Rp++UvT4F0zyKahMl1z8m7ZNYpiIfjOpX6RG2mpL?= =?us-ascii?Q?0kwToJLYe1q1QWU3JmT6HBTKHHbtuk6XxqZY2stUvoF1J90Ep7cSKMLHBsLB?= =?us-ascii?Q?HJcg08R/3L2RM765N5SWMlyLmLurrQ72vLn5xF1YPKodSy3+2OygmxqFY+D8?= =?us-ascii?Q?3qpXGkr9DsLTnhWuZe34xVc9Se8QWhaWqNIRYIWdFvfTj1pAVdijuL2uXBFz?= =?us-ascii?Q?1kq/tgesbGALpka4Rm/x4x0+IrMu5Z3U22IFUI3wAi6AuO3Jv+CCetiQ//mL?= =?us-ascii?Q?UKulNR8nzoGr1ixFOUfR8ze0Ror+wLeywWyncFlsETHvexqfGz251RtBFEuC?= =?us-ascii?Q?04LQLRyI+xWt3Cuk0BD7IFeoFGGzckGmYSdWlcmK9QTz6oOnkpZWMxcaNPow?= =?us-ascii?Q?D0qymd6LX3pgBgKQS+gZ6JrmoGXd1UrmBDlTW9CvORe8YCbLD6R1628VDrg5?= =?us-ascii?Q?roa3pVciF5IU8yqGqvL/AuHXT0pb2pw=3D?= X-Exchange-RoutingPolicyChecked: OirsTh2btfa0Fy3Mh4SV7LWsnZe0xfrPEkmznaf327mLP+3KW5F8nsHkhi7y2rnVgO6AMbbPyDYrfWpFsn8f+6GDFH4PuGhYWRIpOrOPkDKhGBnbEE1uX/xIPuga/+LnsGCWynVaMOjJ1/fPE3VOXBRW/tlXG+/OZrQ9YKp+9JUE7ZmjPkJge70xHGYhogtdOVVv33e44VBEPKZlzq1QtBkp00iMB31wRij5jf9MRP0UVDWB/p0mfg8M5mBHU4F9GRymKfmSWE0Ly7JiqFNQDbUx7YFJI8Hm6lLN5PgR1zrX3E5wYdkJqsrkbv25Wf0miINu2QiTWvamBV7ExShRsQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8504d2be-f270-43e3-c90b-08deed4fc0d7 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jul 2026 08:59:52.7585 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: RirIk8kHuki+NnXexsdhHEJMwh0aU62Jsn2rjUieHBX29LW6UOjVL7aCLGhrFaoVoktyHHruiH37YGvsus17nP/G7vrJ5GWFYjENj56MVpM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR02MB11606 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX7Xo1KA6kLWNk gE17De2Rm54GR5Pt2+IaOA7zgxV4LGgym0dAbKqtdqjCVNfSYkfC73+R2g6Ni1UubZZ6Z9hL27j gdcH/n54/DltIqQtBswpkXJe0xKiFYYj+NifB201fcKPzSE+7iNAr++HKT4D91SWo+HHDDsWj0p 8amdvEoC4hwIckRsYn+QbKbHPZfjzkUKA2RRaRnGxeAXqpibpypR/UIaObTO1LiDEoRO94jIXTy eMOyq+JumnTS+oIHDyrLyJZDDmN5q5TV2AvlfqQ34wSb0pbfaBaAj2ZhMtO7QihCtCTSNrr91hK 66rY4p9ho9n8k78RZ3FeyjVu0+4hab4XU1l0NFJbmUBN7OvZuxix2ydOk6DYXKE4O5tbhaQkeg1 7hdGK3288hokM053l8mbgG2GHwUMPXM7IdFCR3Fq1HMJmjncSX/ThMQkXFM8gYUFkAGNRaQ9toe HIHQ5UlhX544DHlMcig== X-Authority-Analysis: v=2.4 cv=bOsm5v+Z c=1 sm=1 tr=0 ts=6a69c10a cx=c_pps a=ZllXB5KXBtO1w8B7B7qn8g==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=dEe9Ve2bX-KnNSUMM2s9:22 a=64Cc0HZtAAAA:8 a=m9nVCRrcZDnXHdazAWUA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX8OBGz10UmAvL vGxjeSEe68W0maw64xsJMLJb0HJ1NXyhyaknTVoVsKKFlT54H460QU9J0eycZTLtBNxG5lvZHzy dzido6/Mpp8aGDDVO1tZPK5zJu9dZYM= X-Proofpoint-ORIG-GUID: RqG41DIb1E6FyUABEJKc6Vw-rKEWjEZV X-Proofpoint-GUID: RqG41DIb1E6FyUABEJKc6Vw-rKEWjEZV X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_03,2026-07-28_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: PIEB5ZJLJM5M4VKY2JBRRQKRR7GWFI5Z X-Message-ID-Hash: PIEB5ZJLJM5M4VKY2JBRRQKRR7GWFI5Z X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1785316012574158500 Content-Type: text/plain; charset="utf-8" Enable TLS-PSK based secure migration, if and only if the VIR_MIGRATE_TLS flag is set and the destination host lacks necessary X.509 credentials (ca-cert.pem, server-cert.pem and server-key.pem). Suggested-by: Tejus GK Signed-off-by: Abhisek Panda --- include/libvirt/libvirt-domain.h | 11 +++-- src/qemu/qemu_migration.c | 83 +++++++++++++++++++++----------- 2 files changed, 64 insertions(+), 30 deletions(-) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-dom= ain.h index 5b67f8f897..70d955fd31 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -1089,9 +1089,14 @@ typedef enum { VIR_MIGRATE_POSTCOPY =3D (1 << 15), =20 /* Setting the VIR_MIGRATE_TLS flag will cause the migration to attempt - * to use the TLS environment configured by the hypervisor in order to - * perform the migration. If incorrectly configured on either source or - * destination, the migration will fail. + * to use either the TLS X.509 or TLS pre-shared key (PSK) authenticat= ion + * mechanisms. If valid X.509 certificates and keys exist on the desti= nation host, + * then Libvirt will use TLS X.509 authentication. Otherwise, Libvirt = falls back to + * TLS PSK authentication. If the certificate or the key file is corru= pted or not + * properly configured on either source or destination, the migration = will fail. + * + * Note: Since 12.6.0, Libvirt supports the TLS pre-shared key (PSK) a= uthentication + * mechanism along with the TLS X.509 authentication scheme. * * Since: 3.2.0 */ diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 943478fe68..5e381b96e9 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -3508,14 +3508,28 @@ qemuMigrationDstPrepareActive(virQEMUDriver *driver, /* Save original migration parameters */ qemuDomainSaveStatus(vm); =20 - /* Migrations using TLS need to add the "tls-creds-x509" object and + /* Migrations using TLS need to add the "tls-creds-x509" object if the= cert files are + * present on the host, else fallback to adding the "tls-creds-psk" ob= ject. Additionally, * set the migration TLS parameters */ if (flags & VIR_MIGRATE_TLS) { - if (qemuMigrationParamsEnableTLSx509(driver, vm, true, - VIR_ASYNC_JOB_MIGRATION_IN, - &tlsAlias, NULL, - migParams) < 0) - goto error; + if (!mig->tlsPSK) { + if (qemuMigrationParamsEnableTLSx509(driver, vm, true, + VIR_ASYNC_JOB_MIGRATION_I= N, + &tlsAlias, NULL, + migParams) < 0) + goto error; + } else { + ret =3D qemuMigrationPersistPSK(driver, vm, mig->tlsPSK); + if (ret < 0) { + virSecureEraseString(mig->tlsPSK); + g_clear_pointer(&mig->tlsPSK, g_free); + goto error; + } + if (qemuMigrationParamsEnableTLSPSK(driver, vm, true, + VIR_ASYNC_JOB_MIGRATION_IN, + &tlsAlias, migParams) < 0) + goto error; + } } else { if (qemuMigrationParamsDisableTLS(vm, migParams) < 0) goto error; @@ -3622,6 +3636,13 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, g_autofree char *xmlout =3D NULL; unsigned int cookieFlags =3D 0; bool taint_hook =3D false; + unsigned int parseCookieFlags =3D QEMU_MIGRATION_COOKIE_LOCKSTATE | + QEMU_MIGRATION_COOKIE_NBD | + QEMU_MIGRATION_COOKIE_MEMORY_HOTPLUG | + QEMU_MIGRATION_COOKIE_CPU_HOTPLUG | + QEMU_MIGRATION_COOKIE_CPU | + QEMU_MIGRATION_COOKIE_CAPS | + QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITM= APS; =20 VIR_DEBUG("name=3D%s, origname=3D%s, protocol=3D%s, port=3D%hu, " "listenAddress=3D%s, nbdPort=3D%d, nbdURI=3D%s, flags=3D0x%x= ", @@ -3633,6 +3654,11 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_CAPS; } =20 + if (flags & VIR_MIGRATE_TLS) { + parseCookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + cookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + } + /* Let migration hook filter domain XML */ if (virHookPresent(VIR_HOOK_DRIVER_QEMU)) { g_autofree char *xml =3D NULL; @@ -3679,14 +3705,7 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, * domain list. Parsing/validation may fail and there's no * point in having the domain in the list at that point. */ if (!(mig =3D qemuMigrationCookieParse(driver, NULL, *def, origname, N= ULL, - cookiein, cookieinlen, - QEMU_MIGRATION_COOKIE_LOCKSTATE | - QEMU_MIGRATION_COOKIE_NBD | - QEMU_MIGRATION_COOKIE_MEMORY_HOTP= LUG | - QEMU_MIGRATION_COOKIE_CPU_HOTPLUG= | - QEMU_MIGRATION_COOKIE_CPU | - QEMU_MIGRATION_COOKIE_CAPS | - QEMU_MIGRATION_COOKIE_BLOCK_DIRTY= _BITMAPS))) + cookiein, cookieinlen, parseCooki= eFlags))) goto cleanup; =20 if (!(vm =3D virDomainObjListAdd(driver->domains, def, @@ -5112,6 +5131,9 @@ qemuMigrationSrcRun(virQEMUDriver *driver, if (storageMigration) cookieFlags |=3D QEMU_MIGRATION_COOKIE_NBD; =20 + if (flags & VIR_MIGRATE_TLS) + cookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + if (virLockManagerPluginUsesState(driver->lockManager) && !cookieout) { virReportError(VIR_ERR_INTERNAL_ERROR, @@ -5163,19 +5185,26 @@ qemuMigrationSrcRun(virQEMUDriver *driver, qemuDomainSaveStatus(vm); =20 if (flags & VIR_MIGRATE_TLS) { - const char *hostname =3D NULL; - - /* We need to add tls-hostname whenever QEMU itself does not - * connect directly to the destination. */ - if (spec->destType =3D=3D MIGRATION_DEST_CONNECT_HOST || - spec->destType =3D=3D MIGRATION_DEST_FD) - hostname =3D spec->dest.host.name; - - if (qemuMigrationParamsEnableTLSx509(driver, vm, false, - VIR_ASYNC_JOB_MIGRATION_OUT, - &tlsAlias, hostname, - migParams) < 0) - goto error; + if (mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + if (qemuMigrationParamsEnableTLSPSK(driver, vm, false, + VIR_ASYNC_JOB_MIGRATION_OU= T, + &tlsAlias, migParams) < 0) + goto error; + } else { + const char *hostname =3D NULL; + + /* We need to add tls-hostname whenever QEMU itself does not + * connect directly to the destination. */ + if (spec->destType =3D=3D MIGRATION_DEST_CONNECT_HOST || + spec->destType =3D=3D MIGRATION_DEST_FD) + hostname =3D spec->dest.host.name; + + if (qemuMigrationParamsEnableTLSx509(driver, vm, false, + VIR_ASYNC_JOB_MIGRATION_O= UT, + &tlsAlias, hostname, + migParams) < 0) + goto error; + } } else { if (qemuMigrationParamsDisableTLS(vm, migParams) < 0) goto error; --=20 2.43.7 From nobody Tue Aug 4 22:22:05 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1785316213; cv=pass; d=zohomail.com; s=zohoarc; b=DLtmW+hp8MhItMAyXpwFv7sXo7cv+z/8iajwzR2JfMJ6rrXzA1HUr/E2OXRcjkiYrj7J+I4qEcH4aQm90RbGFk+MKWT7Mqo9yl2aViF8/dnn28VU+7fkOdOl4dHw2KACDubLf3iSCRLVl2l7OrW0vDNDjPBKUEOQ+MUlPQtiSvU= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785316213; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=qI3EiDbOjALyguTIxWpIbnSu3kaV/Rz93MfNujBmNQk=; b=dUyU0vs9besaeyUy4/16LHMWG6Pc4LjdKcRWsXE1Q4YBpm0Gb2idHr37Rv7ZOASjJQFUjYooaGOJ9FMtszPKZ9gDkQkC7ZEJ0UFOXLii67EzrMvHv+AxWvBWPgLFEJdPpKIQ6WIpCiYBawD05/ONfqxPeSSbnDBVwA7WgG/CfDk= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1785316213908177.91920658452045; Wed, 29 Jul 2026 02:10:13 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id C0E7A41BA2; Wed, 29 Jul 2026 05:10:12 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 1971241D57; Wed, 29 Jul 2026 05:01:42 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 8F0DF41907; Wed, 29 Jul 2026 05:01:02 -0400 (EDT) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 2C4BE41C11 for ; Wed, 29 Jul 2026 04:59:58 -0400 (EDT) Received: from pps.filterd (m0127844.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66T7cMEj2297047 for ; Wed, 29 Jul 2026 01:59:57 -0700 Received: from sn4pr2101cu001.outbound.protection.outlook.com (mail-southcentralusazon11022128.outbound.protection.outlook.com [40.93.195.128]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fpg2xca89-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 29 Jul 2026 01:59:57 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by PH0PR02MB11606.namprd02.prod.outlook.com (2603:10b6:510:3b9::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 08:59:56 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%4]) with mapi id 15.21.0270.009; Wed, 29 Jul 2026 08:59:55 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=qI3EiDbOjALyguTIxWpIbnSu3kaV/Rz93MfNujBmN Qk=; b=lm4s98uZUmSDY+rlUqMOqq6rBVdZyvwAjAEzR4S67pXE/s+q48OmmU4wa qkOjmd3Vcho/MQ5DU7wpFsgEEsD1zNw1vLunpq0Nw2JWZv3bJZBdXAQmWCbVagWx eGXDN4kqSkComyXDw0wWRON+odLEKzMIE6aWkQxch+PC7VP2lUGc5ZDMLnK1CUFy VsApfr9V4NlBU+V4sOVaNBybpkDfs4SzFhwUKFvfI/mXC6Tr1v80aabgaJjxZ6a1 5BFNCT7MvFkv64gU97nQCQ7yaTJaSFVwwSHZECeU/KxVoOZbpGBx36nCPu46V4kA LzoL8J/rkoTqv1t70UgWzdVvatLMw== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=sMS3gTF9zMjKMyqzNzUweqT5qg6WsZRuJSK/kXnRu+Cl5zAl2KYikcJJUYGnhYf/rOsjKTov6zSs+XZ2d1Rc9pIA2bHE84nWuupRwYvCodfvh9G6weHHlEOsmjth2MDtGHVaAxJJ3mpp6y+j7RCyFhTy/jc1zYzE9DtKq2AvdU0uat9TV4HK2DjT01sxC78i4vnyl+BfJ/IITi6dJUAUeWtup1TU6OFS76vOvCR4csZYnHawfMNnpWpg201AgBz7S6DQyBAMiPyJFm3x/A7bukuOsjdnZd8iYj7IuXLYBgGFMnq60CMwhjLizl5e11A5c/UuijxppBArG/EsdEg1Nw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=qI3EiDbOjALyguTIxWpIbnSu3kaV/Rz93MfNujBmNQk=; b=ERzgJ3rrKBJNKadIOQoD/gJuMr9CPUsxAFqStcI6qjYYKUWQh8FOKMe+yCLLwngU3DhIGnPC47ntrjZHPaABZpPrebLmKn2pFeQtvb2avU92t2IgeU9Cwhb6KtjqYLhjlEKqhepxlCWb32W8KDSZNADZAGU/quSu7NJzYPCsHN3AUV+v6PWqO8fA0gGIGXOntCEqv6sx3SK2een3ZxbU3XwudddrjmXlXUmzjaJOCS6AKOWvrQMKmCV87cxKWcSVTQQGT6lXHVgIFFS9eh6yyKL4SnmQ5ZU17VzjjPVUU7meDPk5doIW7TtjzPpkJqKttVipwb4NlZtDW5K58MVndQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qI3EiDbOjALyguTIxWpIbnSu3kaV/Rz93MfNujBmNQk=; b=tLkUhavFysF0KTLOaQlJ7oNG6VgXExPhXVQTH1PH58cmANCrR/ZN1ZcoVnnJ2ktjlR+goj1xABgDqyL1TXPplswgVuqDILAUCt05JfkWPXSRYrWzrrtCxo87TpiypK0hjh0JzQTgn+QX8GiLGwJasBUbZY8F5PeNer/RPjkLOZBioS6d9bpYeLtTMRTU2pajoJQXBQ/SPXgRLkuH9Gm/pjjFzx5WGzoj3pHZPOdpW0clBWVUEQM3XIyoyddN/MBMiNq2gipfdybKdM3C694gIl69X8dZMXJ0sj5e4Asia50NcMCieo+x4v5DOwTqNO9zTumasy9aWE4lAfUzJM8zdA== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v3 7/7] tests: Add testing of pre-shared key lifecycle Date: Wed, 29 Jul 2026 08:58:59 +0000 Message-ID: <20260729085917.3243911-8-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> References: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: CY5P220CA0001.NAMP220.PROD.OUTLOOK.COM (2603:10b6:930:ed::12) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|PH0PR02MB11606:EE_ X-MS-Office365-Filtering-Correlation-Id: 996eec68-dd90-4360-d0f7-08deed4fc2b4 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|6133799003|3023799007|56012099006|5023799004|18002099003|22082099003|10067099003; X-Microsoft-Antispam-Message-Info: WWGeAkj2lvO8kWcmyQxdjKdPFxyTvkuZV2arA/WkvKrtTjPtueREod2medkaNo/Fe5GjipYNksM9l0EQv7flsX2RvoGCimMhDXHiYCCwiMitaD4DxXkteRZDgijX66k6ad11gN8NKSFiSyNBP2ypBxQaksEklEgrEZmm7nblHtXmnq38xHIuZtuyMlOfOceUyMtouiI5zfo7J1mMoL+UhCo1WNGZRLvFBrBfiaIIPQ0/fgHhAWwf6szdWaB352GBz5pDMkP9d/epjFhhBvXPf7m41fFLKVozfifC94XUBPAzDBHsI0ohF1FWk2cKnyRdT09r/OIzPz4l5qrvOIRM4PzJUWl51NV1aMi1VjguekDZB3hh8HxCA/xdCmRPkRF7r5SkMvWELBNnihRw5HzqQJJzDBrD9gzkOnIzwdNZWX7eBz/PJpHvYGmZGFomIlS+Kh6W41KYW15RXyY9GqO1GKYjNE6J9xWRl9La9zSm9TVL7Z2LHfIuQq2znpqFnxaydmrrYUEyvKvZpIJPpWgO6iT9nf7TMON7BMfBhcUY0WtXvGn22sApHJjetdLjhmNngeW/f5cYz7zjwQxGGy0ugbDaRfoVrDAbW0m4cges8y7oxlBIBxI8EwYConKf3Uxrsm2rL4wSzVPdviJAl4GJxQoh1EP1M5vUNmeZh3tRr1k= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(6133799003)(3023799007)(56012099006)(5023799004)(18002099003)(22082099003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?4O0ay6HvIk4M5snvzpE1dM6eo5njKPqClmSsT0+93xxN1pSad1gwobvQeuZj?= =?us-ascii?Q?InQmiCd94nyevURndquMCFzw0d1LJk6SxGlW+UbfBWRkTmMFQBtAl4viF6Gx?= =?us-ascii?Q?UYB59byFeqrHCj63Cet71jv66xHZtg4R44VyWMwZ0mS+4JEF2cxtK62JUSUj?= =?us-ascii?Q?ToauTWpHoKh8P4pZ0Az7TU++62rOst9I79E9zle5nCOTsUlVLDi/nMb2Gg7C?= =?us-ascii?Q?dabU06I8D0RQvqUUOEwuz5WOsMHigUVIPnrbUeS4hsOwwgTIxujitM7vB6Jo?= =?us-ascii?Q?ZnRFc4KiI1efUypOzb2PWmyK+UptQrPMEgAAUHQNxUrP5qEN6UfLksWI/UlY?= =?us-ascii?Q?t7M7RxQ3Dk31450Mrh9yWVJUClM1K9eS6PeuWIlzxwZX+24f+QnLPFr2MViZ?= =?us-ascii?Q?TWr/mINdE4QN4eHMVSIeD06lxdgxKEhZ7UDne561CXE8Dcc5pSuxrMwjpPDS?= =?us-ascii?Q?EXYR0t2TS7tX0ZY7rh+awbq28C/W1ObVYOntLzZ0xhGjg2vlGU/fpPxScOdY?= =?us-ascii?Q?9hruMMy8RN54p7uky0o1YnyVkHhgd2Jxr/xadIgdZHVwwfikjXZQ5bKFahf8?= =?us-ascii?Q?XxzXdTyajTw98XGRR4BPm1mTTXfwnkkZ+gF9eZKRx4Dh+DRPbNxA77vtu8dW?= =?us-ascii?Q?WNxboIy3quRoIaJEw/RYAmNqipiI2Seh0IFpx98DDoTfqsPGnUDZDM5vLKc5?= =?us-ascii?Q?k2cgnQbvl+Ch8YwvUJf5l5cr1VNeof7+PNyXnTsjR7vIh44v9CDP8DmruKgl?= =?us-ascii?Q?NFFI2napM2JBARsZrC9acuBUjnkweinIba1E980KNYm/v/PrC2fgC7rUfgvJ?= =?us-ascii?Q?wvVoq1lXPQ0RtF+nNuACGfBoBV3O3G374bqiuHRhyauOYzv2+Dm69d3PW/DX?= =?us-ascii?Q?tc2om2ikBe9SSStMoMhE1ESzb4fk387/aU11QczohvoKCgA7qQlg/BaH0HYD?= =?us-ascii?Q?Vrk+XhGHH1BMgBcQEOSVhYVH/swYF2+dsU0+sOYb569vvWlZRaZor2BvSF4Z?= =?us-ascii?Q?RjQKVHuEmlK8joreufCRpaePOi5ZZiN9P0Gtk5tIMFSw5H+M5s7BxvE2A3h9?= =?us-ascii?Q?Pf0ka286OSJNz9fHw/5BlLsDPoOJbRgJNRHbHBTdwaqT8gmKwfgTVMuvUxH9?= =?us-ascii?Q?+k+oVX65dKO8nG1O4CXyxpglLgsxz4xRliwL2WO9KBL3KqS0KQYEoTmnAokc?= =?us-ascii?Q?U45JfND2YczA5XyleX26sPqF1jWLwkBD6GQR0vYhvHujI7DdDw71O9A+k0L/?= =?us-ascii?Q?ayd0pyfjT13hQF7lMN1uAB7XpVvQ92oF1MxIyY+vmcuhVLlR2ZDZB5nTnRS7?= =?us-ascii?Q?/v91FWT3RXM5l4b01x0CwvVHHc+RkzE32tvRxGjon53GSiB4RvloimwbkzVr?= =?us-ascii?Q?UB+1+dcPAb31mDZjMvlBHGwq/G6kYcGjLcDDOzAMxVm5YGVZNcPbvoI17APL?= =?us-ascii?Q?XNSeouhFRS+vIuy5zBi7mguPGBqAQ4nTdyA0EnSqz79vQEhYVFSySHUFT3U2?= =?us-ascii?Q?kXvgm+ieosbUYCno6zw7ChTx7oroQrr3lyHvb3kp/nOhvkvoBNN+a/PiIN/B?= =?us-ascii?Q?qai6txlaZWx6OXZstV4ji94XvsJoAg/bWfkgFwlxn8j0jeUgp0XrqcM/GJC3?= =?us-ascii?Q?FHJ1NJm4O8cPkyqw5Un8o52Ojgqq+59rW+phMCz/A4u0dl+5vUnU+rZsUSmE?= =?us-ascii?Q?5wq7xINiDh0CL6d/pMBgMQGsSVN+Rf37/4EhazQ2FTsARS77k6Kc550q5rDk?= =?us-ascii?Q?sWuIzBk2L0jhwY+4kjBcibvvU/cv8SU=3D?= X-Exchange-RoutingPolicyChecked: Q4qL7z/Ou6iBqgzdiOTCdhqT412Q8qVWwEpy0ZABDqeyawgrnzpMGC1q3a3tmWkCWL926iBqDKvNxpWnEK9LBChogDkHE9vG6MnY4I7i++Y4e5brncv6Z1V/0JL/y9yqqOJVUIM32I0QiL5HdPaM1aCVaTwlKNLO8QRt5/n166b9RaznMiLEoeUJqDdKp3QZdyxj8FblWhYzyI35auEg3OiukcY/ISxWomj1FWduQ1favCyfmoTp4YBjlazXwUYBSfl1LPc4dKPGGl9eMfKkUBKAnPStyu7qC1SvkJxGOKgzrKAw6SI0JhSQB4mBD5phUcZ+QsDsq0lao+pfICp9vg== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 996eec68-dd90-4360-d0f7-08deed4fc2b4 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jul 2026 08:59:55.8724 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: lUv2eZvE0Sm1c6TCaT05usPqK8vZsV/2ptW6H1OKoTCbYfGTYOQB3sE8zsCVhQgPQq2+Oa6IoINy3qqDI7U6/IOE/i4UOpuCYX/nz3BWvVc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR02MB11606 X-Proofpoint-GUID: 3oRH6nuW2PB3xp_iStuKZbFsf-TlIe0x X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX1IZo5wlHYkE3 CCp1LMt7CRWPvHYhcH1/sXUuCC8TCXmRd5CN4BGOkiDtxCE+EnqNuMyJ634rc6SS9DrpqX8a25S uhaaXioOdNTmY+UJD8ZS2CYAgWFbNZM= X-Authority-Analysis: v=2.4 cv=faWdDUQF c=1 sm=1 tr=0 ts=6a69c10d cx=c_pps a=+WkigaN7fx4UYWmYucrQAQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=0LlEyIVc8U2lsR7dKhuH:22 a=64Cc0HZtAAAA:8 a=m3rDw_47mjERg_1OAhcA:9 X-Proofpoint-ORIG-GUID: 3oRH6nuW2PB3xp_iStuKZbFsf-TlIe0x X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX813nALbCXTPV Uh/MZnxtoXh1I6+z1YyETWbJawFurH/yj2t5YlSUc9i7/j9aEmSMAkL5jvlzuy3Nz9V3Ysq0z58 8kcEjgsVMReXBQ1mkr8yPD2Hl1i+gmq7NFwiIB5qQjHBPk9+3PiOA0tR000Lrq9kkdMeEuCHmTC l0WInnKiMfIPRTy2LOM+LFQFOA5ZlW5UR1SO/aVnfhOkifFbxMLLhxNatb0kVCg/Pl11ICJH84a eqKEi3nrjSvUrliyN0cfPLTsNMRDHVC6WkmpQhOHlfId3iID5mnIuWKre0BdKoYjOhmxyBdJmb9 xt+cNUE/6pwRk9pBESX2bXkfTodwwmHwlgRHlZA3U7jUOQLkNenZCDEgTvNbbNbMBZTo6sHiFAb wvBSiffYUoEruc0lFnFvhoo2gyYgJrJJS92xI+tzs5Kdg0obDu8TnPivI3D5w6HbQnhmvxa+UP+ LiMzvW62VK2uOm2JyYA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_03,2026-07-28_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: SWP7YNNUYEMVBDOANCYGP7XIYTKNSRQL X-Message-ID-Hash: SWP7YNNUYEMVBDOANCYGP7XIYTKNSRQL X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1785316215544158500 Content-Type: text/plain; charset="utf-8" In the case of TLS-PSK-enabled migration, Libvirt manages the lifecycle of the pre-shared key. Add a new test scenario to the migration cookie test suite to validate the generation of pre-shared key when the QEMU_MIGRATION_COOKIE_TLS_PSK flag is set. In addition, the test also checks the length and the hexadecimal encoding of the pre-shared key. Signed-off-by: Abhisek Panda --- tests/qemumigrationcookiexmltest.c | 123 +++++++++++++++++++++++++++++ tests/testutilsqemu.c | 12 +++ 2 files changed, 135 insertions(+) diff --git a/tests/qemumigrationcookiexmltest.c b/tests/qemumigrationcookie= xmltest.c index adf2eb4d08..0914793974 100644 --- a/tests/qemumigrationcookiexmltest.c +++ b/tests/qemumigrationcookiexmltest.c @@ -16,6 +16,7 @@ =20 #include =20 +#include #include =20 #include @@ -92,6 +93,99 @@ testQemuMigrationCookieDataFree(struct testQemuMigration= CookieData *data) } =20 =20 +static int +testQemuMigrationCookiePSKValidate(const char *key) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(&driver); + size_t expected_key_len =3D 2 * cfg->migrateTLSPSKLength; /* The pre-s= hared key's length is 2 * PSK length */ + size_t i; + + if (!key) { + VIR_TEST_DEBUG("\nThe pre-shared key is not present in the migrati= on cookie."); + return -1; + } + + if (strlen(key) !=3D expected_key_len) { + VIR_TEST_DEBUG("\nThe length of the pre-shared key is incorrect."); + return -1; + } + + /* Check the characters of the key */ + for (i =3D 0; i < expected_key_len; i++) { + if (!g_ascii_isxdigit(key[i])) { + VIR_TEST_DEBUG("\nThe key contains non-hex characters"); + return -1; + } + } + + return 0; +} + + +static int +testQemuMigrationCookiePSKAttribute(const void *opaque) +{ + struct testQemuMigrationCookieData *data =3D (struct testQemuMigration= CookieData *) opaque; + g_autoptr(qemuMigrationCookie) cookie =3D NULL; + qemuDomainObjPrivate *priv; + + /* if the VM object parsing step failed there's nothing this test can = do */ + if (!data->vm) { + VIR_TEST_DEBUG("\nmissing VM object\n"); + return -1; + } + priv =3D data->vm->privateData; + + if (!(cookie =3D qemuMigrationCookieNew(data->vm->def, NULL))) + return -1; + + g_free(cookie->localHostname); + cookie->localHostname =3D g_strdup("hostname2"); + + if (virUUIDParse("8b3f4dc4-6a8e-5f9b-94a5-4c35babd8d95", cookie->local= Hostuuid) < 0) { + VIR_TEST_DEBUG("\nfailed to parse fake UUID"); + return -1; + } + + /* Format the migration cookie at the source */ + if (qemuMigrationCookieFormat(cookie, + &driver, + data->vm, + data->cookiePopulateParty, + &data->xmlstr, + &data->xmlstrlen, + data->cookiePopulateFlags) < 0) { + VIR_TEST_DEBUG("\nfailed to populate and format qemu migration coo= kie"); + return -1; + } + + /* Check for the element in the generated migration co= okie XML */ + if (!strstr(data->xmlstr, "")) { + VIR_TEST_DEBUG("\nthe migration cookie is missing the migration-ke= y element:\n%s\n", + data->xmlstr); + return -1; + } + + /* Parse the migration cookie at the destination */ + if (!(data->cookie =3D qemuMigrationCookieParse(&driver, + data->vm, + data->vm->def, + NULL, + priv->qemuCaps, + data->xmlstr, + data->xmlstrlen, + data->cookieParseFlags))= ) { + VIR_TEST_DEBUG("\nfailed to parse qemu migration cookie:\n%s\n", d= ata->xmlstr); + return -1; + } + + if (testQemuMigrationCookiePSKValidate(data->cookie->tlsPSK) < 0) + return -1; + + return 0; +} + + static int testQemuMigrationCookiePopulate(const void *opaque) { @@ -418,6 +512,32 @@ testQemuMigrationCookieXML2XMLBitmaps(const char *name, return ret; } =20 +/* tests the generation and persistence of the pre-shared keys */ +static int +testQemuMigrationCookiePSK(const char *domxml) +{ + struct testQemuMigrationCookieData *data =3D g_new0(struct testQemuMig= rationCookieData, 1); + int ret =3D 0; + + data->cookiePopulateFlags =3D QEMU_MIGRATION_COOKIE_TLS_PSK; + data->cookiePopulateParty =3D QEMU_MIGRATION_SOURCE; + data->cookieParseFlags =3D QEMU_MIGRATION_COOKIE_TLS_PSK; + data->inStatus =3D g_strconcat(abs_srcdir, "/", domxml, NULL); + + /* load status XML as domain object */ + if (testQemuMigrationCookieDomInit(data) < 0) + ret =3D -1; + + /* test PSK generation and persistence */ + if (virTestRun("qemumigrationcookie-psk-lifecycle", + testQemuMigrationCookiePSKAttribute, data) < 0) + ret =3D -1; + + testQemuMigrationCookieDataFree(data); + + return ret; +} + =20 static int mymain(void) @@ -448,6 +568,9 @@ mymain(void) if (testQemuMigrationCookieXML2XMLBitmaps("nbd-bitmaps", "qemustatusxm= l2xmldata/migration-out-nbd-bitmaps-in.xml", 0) < 0) ret =3D -1; =20 + if (testQemuMigrationCookiePSK("qemustatusxml2xmldata/modern-in.xml") = < 0) + ret =3D -1; + virBufferFreeAndReset(&testnamebuf); =20 cleanup: diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c index e5e3342b53..b0e0d41895 100644 --- a/tests/testutilsqemu.c +++ b/tests/testutilsqemu.c @@ -297,6 +297,7 @@ qemuTestCapsCacheInsert(virFileCache *cache, =20 #define STATEDIRTEMPLATE abs_builddir "/qemustatedir-XXXXXX" #define CONFIGDIRTEMPLATE abs_builddir "/qemuconfigdir-XXXXXX" +#define TLSPSKDIRTEMPLATE abs_builddir "/pskstatedir-XXXXXX" =20 int qemuTestDriverInit(virQEMUDriver *driver) { @@ -304,6 +305,7 @@ int qemuTestDriverInit(virQEMUDriver *driver) virSecurityManager *mgr =3D NULL; char statedir[] =3D STATEDIRTEMPLATE; char configdir[] =3D CONFIGDIRTEMPLATE; + char tlspskdir[] =3D TLSPSKDIRTEMPLATE; =20 memset(driver, 0, sizeof(*driver)); =20 @@ -328,6 +330,7 @@ int qemuTestDriverInit(virQEMUDriver *driver) * dirs. */ VIR_FREE(cfg->stateDir); VIR_FREE(cfg->configDir); + VIR_FREE(cfg->tlsPSKStateDir); =20 /* Override paths to ensure predictable output * @@ -367,6 +370,13 @@ int qemuTestDriverInit(virQEMUDriver *driver) =20 cfg->configDir =3D g_strdup(configdir); =20 + if (!g_mkdtemp(tlspskdir)) { + fprintf(stderr, "Cannot create fake tlsPSKStateDir"); + goto error; + } + + cfg->tlsPSKStateDir =3D g_strdup(tlspskdir); + driver->caps =3D testQemuCapsInit(); if (!driver->caps) goto error; @@ -433,6 +443,8 @@ int qemuTestDriverInit(virQEMUDriver *driver) =20 cfg->dumpGuestCore =3D false; =20 + cfg->migrateTLSPSKLength =3D 32; + driver->privileged =3D true; =20 return 0; --=20 2.43.7