From nobody Wed Sep 23 07:32:47 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1785316380; cv=pass; d=zohomail.com; s=zohoarc; b=LtNnLmLf0Qyq9HpNv2UKlBeC9+4g5LO946GFGzF7RBk6FNf8l/b17QBgoPx6roG/AvLKvWPrBIEFVk+0L6nhLIHJ45a5DTcXx/G2cKqkA5ymRdMMZ/xrrC/rq86WcTKJJmHgJ+X4ZmK9GJK41jgtMz9mExtzBLtp1VcZ67TJPmY= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785316380; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=ZQW7vASLL19vVPwuN/IUwf1tzZRYF8T8FJo5c+dKQS8=; b=DM7emrQjHiVoHkBH7M4vsdLAYlIhXYQKgIIKr0PGlUSHufUqJRq5/x7q1V92Okr5mneLmmf6m0jd9qr4cVR7zI2qlu/5jX922rg3a5JcLaiXtQJLLhvvNc3rvdwydvWz6Db6t+Mb+oMqh7mWnNs0CPWOXgwQ8zhmZMk+EVE0nB8= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1785316380225883.7771169922642; Wed, 29 Jul 2026 02:13:00 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id E62A63FBC4; Wed, 29 Jul 2026 05:12:58 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 54A3243E62; Wed, 29 Jul 2026 05:01:47 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 81C8E41B57; Wed, 29 Jul 2026 05:01:03 -0400 (EDT) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 9DA3441B57 for ; Wed, 29 Jul 2026 04:59:39 -0400 (EDT) Received: from pps.filterd (m0127842.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66T7c2DD577771 for ; Wed, 29 Jul 2026 01:59:39 -0700 Received: from bn1pr04cu002.outbound.protection.outlook.com (mail-eastus2azon11020081.outbound.protection.outlook.com [52.101.56.81]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fq460s7vw-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 29 Jul 2026 01:59:38 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by PH0PR02MB11606.namprd02.prod.outlook.com (2603:10b6:510:3b9::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 08:59:37 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%4]) with mapi id 15.21.0270.009; Wed, 29 Jul 2026 08:59:37 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=ZQW7vASLL19vVPwuN/IUwf1tzZRYF8T8FJo5c+dKQ S8=; b=nU2Wvw9341VxE1kENUWoWgi48/5YiZPo82n8DoSErQMol2nVggpAJ+I4F Vq5RkmR+7QHkxsVswIUjGAn8UkDXkvISbsP1fi9bN5dbJrS4QHrKx4OWfx4MZyaL nGKG9BdUPl7gd3AxIGddnsGL32zT7ifqTVHtq4xd54kx11789FoO9k9FmZpATVbu Z8BYche1rwy7ipKdafGInA3cxV4/EIw2yuYKux1E6ljMr14QxU9WRvB96QVBcGky Y1tqDk3zypwKiPOyKLKuKmBjP6fadl73+HRhzUTzgT/2X3V0NL7giHE/0k9RNy1n +4igmWPXDF+e6Xwvt3s+NVfLLKwrg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Pbz+jfgWLC92aNG6helQMQwjkx20h8VpMEOrS347DdpFRWezN5r86SoTn4NRkJHILoYH373a3z/M//zfqU8o6qeKIabTlUdYEOC6CuTkrJh0I0lr8spXkENoQZqSxbHTUrf50NyQMNjpJeXccYybuI5ncUgeRwkOTqo09xtTkC/aEL0eC6rKWIivX/tPdWy/GIDBuDIcDqB0/VPVZeWl0G50HyelpXRst+BIYzPmJtFv4btIkSiVqekN4WIhrdX49Ouks7SOVe/it5g1hFADwRKHgQ+TEM1L6P2NdI2nU7B2TGn8xS6boZ8lnp0VV1ZxWq1GZmFaX2QXLO+kD14laQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ZQW7vASLL19vVPwuN/IUwf1tzZRYF8T8FJo5c+dKQS8=; b=RiB//WVX9z6FU3XSfECv6oNZStPcszXd0hrSDoeBEwk3SIitAGI11l2MKJCsPrdegwCvuHDzQMr2fj0A//vxQDxVZ9Hu7dwjy6suOepMftLaX6WBW7WDw/0+Z7LT0oIvMG7KxPExH/rqwRVGnuH0esJqcRp7WylivRQQdu4B9DVvKRqr615c6CLI7oxqCuag8Wkyaqci3VhT8o/flUApf04Q2A4sx66zOr+Yzp3tqjz4rHwLbp8JIF49Upe2wCGJjJ4BMbqoDnl/JHXeJKA8FUpoGgTmZ+iaGz15BT8aNg+jNGyAYUhMEE0harQWfsQUTT+eZ885OZlRAOapDpm8dQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZQW7vASLL19vVPwuN/IUwf1tzZRYF8T8FJo5c+dKQS8=; b=DcjPeaVS4Qv3jl3ecNOf4/SdYfqQeapKBGd6Cwu2o+kjhnFVuAKi2JXj9myjsY/Rwg0bqJBgyVN/+BXw1vLP2D3LgfjFRtZnPwGpo4ewHYfCo3uWDXXvrY87S+R5TofbNTmMqvy+A22f4j5M1GtZ9foALVL0YJQ/pPZQKpauU6He0Ja0BMH3sYwdtgsSrLbvyadoRwP3UAhsHjKanAaJLOggWkkauHqJ+vQb+TU+bxzZwYjTuFXOu00LU5XKNuAH8TpcjCvkAzq+K03R2M9WAB8hqTeKiBSJ6giWkSwr0oM+AspJZvC7Iy6PCyFah5qNnJlAIJ06colG/JxEN1QtLg== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v3 2/7] qemu: Manage a pre-shared key's lifecycle Date: Wed, 29 Jul 2026 08:58:54 +0000 Message-ID: <20260729085917.3243911-3-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> References: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: CYXP220CA0008.NAMP220.PROD.OUTLOOK.COM (2603:10b6:930:ee::15) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|PH0PR02MB11606:EE_ X-MS-Office365-Filtering-Correlation-Id: 683f455d-c2e5-4148-db1c-08deed4fb79f x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|6133799003|3023799007|56012099006|18002099003|22082099003|10067099003; X-Microsoft-Antispam-Message-Info: s7lBjvPQVoj+jHFnduDuEodjXgCbi0IwrZi8Of+kZeuvAJdPZj2uYA2MAk8kvCkhXDUckaP2Dyww5Q2jrWkq7YlU+UZYaTIaMwa3dJa1zUhbFjnhpZgQP8HPzPX7VFI22yF+iBO3zbFeXqGTukdGl41FmpKdpiCHQ0bbmEl7PSKyBgGcAf1DokV0RY6baM4gt0rzTokIEEXuPY37xC73efSfwVQTt5nozw0hFL5naXEXM5R10fqx49/rzRO4AO39pY3rJ1ds9he76Er7S274oReHzLKH1GaYUfyZC3wdBmwkCejT0I5V/bUsIqmRfMfD0hMsGEvnk+XwKkF4S07L9mBImdssp6XdeA5tIqPegnDQFuRR4UZqcJWto2yskuTd9mEx7QOUElt1eqanmX5087YbMRf/OdDT1hzMN9aB+J9eyxjZS+vBZ2oO6vbpWxLglbiwg3ld1lAGZ80UcL/PKQlORhpfoMrSwGe4vnlsBECTXBSRreaIkXytEvjs5EOnjHivDIwxqh3dxkoBzpQDqV9XV+U6WZKQwEgSrV/gMpas3PyVAQX5/lYjaXavKtt8sBryMNN5rNtzSyQOj2uFT/zPNsyWGIIBHWYeyMpHaFon2FQzuDbRjKNYs+5A3Lo0PEIhj6jufRPCZRuzdpzEPWChEFc+FYyH8iOBTa/SbWM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(6133799003)(3023799007)(56012099006)(18002099003)(22082099003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Rm8JGjr5ZcK2qAdYIXC21z7nNr3Q7fvDDxvS4YpKxxgU9gKscqqEAaLj4WMq?= =?us-ascii?Q?G1kMXs0r199ld2F3IrR/IzTuQ5BCqz4rhZCd3IlggWodSIvHFRRdk+1TGdi6?= =?us-ascii?Q?FW8/xKYxcghXxSMk0aUxaOWwXwidf3iL49OVm45biE28n2m4vShJzG/f1zFH?= =?us-ascii?Q?vDqMVE6xSzyAlk9tkONUBriTP72XfpwmK2j2da79yvinhNUluDwHduLFDbDS?= =?us-ascii?Q?VxV6ve4pxjbsTRUOwscpIG7/0nWZTs8XlGDNTyMIQ9gnc8nJpjThuURQpFvC?= =?us-ascii?Q?69WehA1aJjxcvf/WQtethRBhW0NgrLiMr8JBhnuJnYhClZ1CxNNyRw8kqoU4?= =?us-ascii?Q?abXuWuRP5nzsYU6kUlrOqrASfRcdv0NP0UYjzq9yTAuk5SJyYhkpO4e2gbuZ?= =?us-ascii?Q?x6To6epg8JE09XeBf+QmOcxKmrx5jOr8vPmch/GNwbA4ehym6ZKZnu1A8w5R?= =?us-ascii?Q?5sBQ9LLr5lVtotdAFtfFYilK/O8vsYw337TxjfJJDlBO0rHmNfhKegHubVt0?= =?us-ascii?Q?oLJoenpKHuLVCZEGtetqU7hyg+YU+HvoNsoEO5u+w0OlJTvfXr9y8oO0BfHM?= =?us-ascii?Q?dO0hITj7RD+zZBjtuDgk1LP2KNBUUHcIdd1tjGdr1QGHRT34UZonuBtroIS9?= =?us-ascii?Q?FCC655Ng2h6dRo0S2je0tyE2lZFmrtXAiBoG4j4ohCm1g5pcSLDp0TMf21w1?= =?us-ascii?Q?YWzM+1lCxANY8EruRSP0G4n/nog3U7PeQROZvhBrIjK4Pzg3zPLxEQ9ZUtwr?= =?us-ascii?Q?j7mm1fgrFMvwmpZw0FyNi6sIcXJtNZ3zPMp1RmUuCAEn0VQsWGCUo0p0/H4m?= =?us-ascii?Q?JDm8zp+RhZwCLIYkU7AIaK0k9t02hA3FnUj4ricGINfnLI7Hrb/SC6MkLrCf?= =?us-ascii?Q?Pwsvvejoh83wQxTjmubHq5Rs4BOsemX0TIa18F3NtJsLH2t4buEFW0WoLO09?= =?us-ascii?Q?ufxskPFje3eyS+3AqJWVJT7Fi1jxXFE32N6YNvWqImnQnO6Iy4zn2PdgPbMn?= =?us-ascii?Q?9r1h+QIzMkSpKoilfpi9tXoucRIf+2KQ1zrfV2+uN9D+GdzQsa8jyH7990G8?= =?us-ascii?Q?K+MVt+/8hg7H6R9e0fmkGYKE9clP7GSwlizj/MxSQla0fwcKSMtmqp3tNm+N?= =?us-ascii?Q?GBm6iWOCIE4tWFsn5sH/XrWe36iCwUkhYwlPZnQ+hSlX6V6yU4UbUul+ll5y?= =?us-ascii?Q?Noja44OMsDTPjd2DJa9bljwIm3tbcZDi7koVeBrg44DD9m4KhhRKWAWeV2Gt?= =?us-ascii?Q?RgZIwEnZehlYjbh5Nk6a6I2AWy2WAvTTzJlRqgH9H+Wm2+CVZWcUXuQqHWyY?= =?us-ascii?Q?4QlKmVEDdxGDzz3+tV2lW0WW/EWPeGe9x7O5JUl0bslhWrbGMzf8sX10pdxh?= =?us-ascii?Q?joHHPK+Wwu/MN2BHWOIQ6UCTA0UILJnuX5bqJucMFIulcNgSGWwH+6UTsoO1?= =?us-ascii?Q?JmaEJModF5apiSSccunpiARFFA8IHzSR3YDgVtqO8zp1OwIJLm00sxERGFlJ?= =?us-ascii?Q?WdGzBPwcW+a0PYwqT1Z20AvGlPcMQ+ZEET1onU7597yUpSlEiuB5oCwxpqvD?= =?us-ascii?Q?obwfGIK2430Kfl3+qvnYWJzulbKHJ5w3ohwKeeCY4XW4AtyQpnWeI53tghhx?= =?us-ascii?Q?93JArBSowLnpNW+WYxPLVl6avJTufeVwIgWaNtiAuVUPhzZvwagjxkvZZxzA?= =?us-ascii?Q?PfgThRkejDvaS9cH6Xk+459BQJQnpF2fdSZh64ZJTE353JPfKjYaxRqLEN8X?= =?us-ascii?Q?Yv+u+vMARHaSXZeYq+ihwKGJjo38HEY=3D?= X-Exchange-RoutingPolicyChecked: Y/9DtycycvYt0Hlav39B21mnSNS37piMhDmc8xi8aJQLYrrH7glXl3SkSyox9WbuCOv6I9XEVUQBec3EXD4vtBhv2xgIDmNC+cJMaKYiD5RxxsFImWkOCPEK8K5EtbQTaDZjaHDAq5Vk1zg9XOutJyqzxUtEmQkLCEng0mreIfIq0YQ3bTRhe7TO+SVXKsV7eJHW/s6zvWfaWQ1VxEgtqacohnnc04I+S/Y6I+NdBzFI6O6B1WtfTKCda400Ln3JtTjkKnb512yEXja/X4fyIy1RuEA8Us5oUA5JQ4Oxw10H3joB7l1W8uFt73O5NbvvrJpyl/xVWNvqoNPnd2j4hQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 683f455d-c2e5-4148-db1c-08deed4fb79f X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jul 2026 08:59:37.2979 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 4NjSRAbjkuBfU063FD6f2QJe3NeSOgvd/KGoX5qEckdgZM87uB0xM3Y6y2CbrxM1e4MnhTnaX8RNuJeOtoRueJp3OxmFR2tEsO3wjrzELRU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR02MB11606 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX7w0kp6Dv/pGS 7rzYyEr16TkbAjvy+Wg0Mg614smPkDcL0fdzKQlLc046G/8yx+3K5zL5F+FfKUWJ7kkxOaJmPKN wM6cCNtYAZeVZW1X7sqfF1uhr+U6Atjq6o/+pHwtmwldY7wRvXJ8BhJyy/wX/9FQRlt4UxQIVev d3ASo5mrLIcCXsoPY3JpRpLqyym5/Z/IyMMVQYv9QEbyhz5fcWfoIMRMjAvEKZXg/7a0qm1WqFI 2e9CSDxaHRaAKEDaS9gwnrbH61gYNlvSIkUh9FEGTdWjUbvXcb6htKT7NqKYJ/FPXoquP784sVt kQuzTlIAHAfJrB777oMDEEJ5rOyatsvw8Wczj6Bzu5+ZCcUMty+isEik9sBMkdvt6ad0sj5VXrQ CFhUgAcApY1AjoEyKdbTHDjTXP2xKJbghbnfznEy1tV8+Tf6adZf20uJHPqqCSfXRU21dD9RDnN mGxhgA/SImm4m0Ab1og== X-Proofpoint-GUID: LLqTNSRKupD4eK-NbvFXLpgWOeQB7qWy X-Proofpoint-ORIG-GUID: LLqTNSRKupD4eK-NbvFXLpgWOeQB7qWy X-Authority-Analysis: v=2.4 cv=QJNYgALL c=1 sm=1 tr=0 ts=6a69c0fa cx=c_pps a=H8KQetTyUVx2NtQIo3bL5Q==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=VUi8bpU7OL1Oj2-RSIOF:22 a=64Cc0HZtAAAA:8 a=38_3UPSNbPqn1IfXAoIA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfXyzIDKhXaw2o4 +ei/sY+WHXsbko5cb7+Sp5qsCmAlsCOicmOe1JnYhNh4EW30yk8iGImibTIPvEKxDxPJ3b/YiSJ HUpdNYyJwHiDXW+GHwD3XRmbBdETl10= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_03,2026-07-28_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: SLOXSJLF3Z6ORITYEU4LB5PILDVQCJAH X-Message-ID-Hash: SLOXSJLF3Z6ORITYEU4LB5PILDVQCJAH X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1785316382459158500 Content-Type: text/plain; charset="utf-8" Libvirt falls back to the TLS-PSK-enabled VM migration, if the VIR_MIGRATE_TLS flag is set but the destination host lacks necessary X.509 credentials (ca-cert.pem, server-cert.pem and server-key.pem). The source host unconditionally adds the pre-shared key in the migration cookie if the VIR_MIGRATE_TLS flag is set. Upon parsing the migration cookie, the destination host checks for the presence of X.509 credentials and informs the source host whether to use TLS X.509 or TLS PSK during VM migration via the migration cookie. For a migration session, Libvirt generates a random key of the specified length, and then stores the content, "qemu:", at /$ID-$VMNAME/keys.psk on the source host. This is because QEMU's tls-creds-psk object does not accept a raw key string as a parameter, it only accepts a dir argument pointing to a directory from which it can read the key file. Subsequently, it sends the key to destination by embedding it within the migration cookie. The destination's Libvirt extracts the key from the migration cookie. Upon migration completion or any failure, both source and destination Libvirt must delete the directory containing the session's keys.psk. Signed-off-by: Abhisek Panda --- src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 6 ++ src/qemu/qemu_migration.c | 119 +++++++++++++++++++++++++++++ src/qemu/qemu_migration_cookie.c | 94 ++++++++++++++++++++++- src/qemu/qemu_migration_cookie.h | 5 ++ tests/qemumigrationcookiexmltest.c | 18 +++-- 9 files changed, 241 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 986f01ddcd..86571e8da6 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -168,6 +168,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->cacheDir =3D g_strdup_printf("%s/cache/qemu", root); cfg->libDir =3D g_strdup_printf("%s/lib/qemu", root); cfg->swtpmStorageDir =3D g_strdup_printf("%s/lib/swtpm", root); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/run/psk", root); =20 cfg->saveDir =3D g_strdup_printf("%s/save", cfg->libDir); cfg->snapshotDir =3D g_strdup_printf("%s/snapshot", cfg->libDir); @@ -187,6 +188,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->stateDir =3D g_strdup_printf("%s/libvirt/qemu", RUNSTATEDIR); cfg->swtpmStateDir =3D g_strdup_printf("%s/swtpm", cfg->stateDir); cfg->channelTargetDir =3D g_strdup_printf("%s/channel", cfg->state= Dir); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/psk", cfg->stateDir); =20 cfg->cacheDir =3D g_strdup_printf("%s/cache/libvirt/qemu", LOCALST= ATEDIR); =20 @@ -214,6 +216,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->stateDir =3D g_strdup_printf("%s/qemu/run", rundir); cfg->swtpmStateDir =3D g_strdup_printf("%s/swtpm", cfg->stateDir); cfg->channelTargetDir =3D g_strdup_printf("%s/channel", cfg->state= Dir); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/psk", cfg->stateDir); =20 cfg->configBaseDir =3D virGetUserConfigDirectory(); =20 @@ -375,6 +378,7 @@ static void virQEMUDriverConfigDispose(void *obj) g_free(cfg->dbusStateDir); g_free(cfg->rdpStateDir); g_free(cfg->vncStateDir); + g_free(cfg->tlsPSKStateDir); =20 g_free(cfg->libDir); g_free(cfg->cacheDir); diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index c18aedf59c..06a0b0770c 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -113,6 +113,7 @@ struct _virQEMUDriverConfig { char *dbusStateDir; char *rdpStateDir; char *vncStateDir; + char *tlsPSKStateDir; /* These two directories are ones QEMU processes use (so must match * the QEMU user/group */ char *libDir; diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index e1b805d906..41421214df 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -1992,6 +1992,7 @@ qemuDomainObjPrivateFree(void *data) virObjectUnref(priv->monConfig); g_free(priv->lockState); g_free(priv->origname); + g_free(priv->migTLSPSK); =20 virChrdevFree(priv->devs); =20 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 50ab492023..1feeb11bcd 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -148,6 +148,7 @@ struct _qemuDomainObjPrivate { char *origname; int nbdPort; /* Port used for migration with NBD */ unsigned short migrationPort; + char *migTLSPSK; /* Hex-encoded pre-shared key for TLS-PSK-enabled VM = migration session */ unsigned short backupNBDPort; int preMigrationState; unsigned long long preMigrationMemlock; /* Original RLIMIT_MEMLOCK in = case diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index bdc0cff66a..84b017b342 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -664,6 +664,12 @@ qemuStateInitialize(bool privileged, cfg->vncStateDir); goto error; } + if (virDirCreate(cfg->tlsPSKStateDir, 0700, cfg->user, cfg->group, + VIR_DIR_CREATE_ALLOW_EXIST) < 0) { + virReportSystemError(errno, _("Failed to create TLS PSK state dir = %1$s"), + cfg->tlsPSKStateDir); + goto error; + } =20 qemu_driver->inhibitor =3D virInhibitorNew( VIR_INHIBITOR_WHAT_SHUTDOWN, diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 4a43ab83b0..3d6e472443 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -59,6 +59,7 @@ #include "virprocess.h" #include "virdomainsnapshotobjlist.h" #include "virutil.h" +#include "virsecureerase.h" =20 #define VIR_FROM_THIS VIR_FROM_QEMU =20 @@ -1503,6 +1504,91 @@ qemuMigrationSrcIsAllowedHostdev(const virDomainDef = *def) } =20 =20 +static void +qemuMigrationDeletePSKDir(virQEMUDriver *driver, virDomainObj *vm) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + qemuDomainObjPrivate *priv =3D vm->privateData; + g_autofree char *dir_path =3D NULL; + g_autofree char *shortName =3D NULL; + + if (priv->migTLSPSK) { + virSecureEraseString(priv->migTLSPSK); + g_clear_pointer(&priv->migTLSPSK, g_free); + } + + if (!vm || !vm->def || !(shortName =3D virDomainDefGetShortName(vm->de= f))) + return; + + dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName); + + if (virFileIsDir(dir_path) && + virFileDeleteTree(dir_path) < 0) + VIR_WARN("Failed to delete the directory %s containing the pre-sha= red keys for migration of domain %s", + dir_path, vm->def->name); +} + + +static int +qemuPersistTLSPSKHelper(int pskFD, + const char *pskPath, + const void *opaque) +{ + const char *key =3D opaque; + + if (safewrite(pskFD, "qemu:", 5) < 0 || + safewrite(pskFD, key, strlen(key)) < 0) { + virReportSystemError(errno, + _("Unable to write the pre-shared key to file= '%1$s'"), + pskPath); + return -1; + } + + return 0; +} + + +static int +qemuMigrationPersistPSK(virQEMUDriver *driver, virDomainObj *vm, const cha= r *tlsPSK) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + g_autofree char *dir_path =3D NULL; + g_autofree char *key_path =3D NULL; + g_autofree char *shortName =3D NULL; + + if (!vm || !vm->def || !(shortName =3D virDomainDefGetShortName(vm->de= f))) + return -1; + + dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName); + key_path =3D g_strdup_printf("%s/keys.psk", dir_path); + + if (virDirCreate(dir_path, 0700, cfg->user, cfg->group, + VIR_DIR_CREATE_ALLOW_EXIST) < 0) { + virReportSystemError(errno, + _("Could not create the directory %1$s for st= oring PSKs"), + dir_path); + goto error; + } + + if (tlsPSK) { + if (virFileRewrite(key_path, S_IRUSR, cfg->user, + cfg->group, qemuPersistTLSPSKHelper, + tlsPSK) < 0) + goto error; + } else { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("The pre-shared key for TLS-PSK migration is not = provided")); + goto error; + } + + return 0; + + error: + qemuMigrationDeletePSKDir(driver, vm); + return -1; +} + + static int qemuDomainGetMigrationBlockers(virDomainObj *vm, int asyncJob, @@ -2718,6 +2804,7 @@ qemuMigrationSrcBeginXML(virDomainObj *vm, qemuDomainObjPrivate *priv =3D vm->privateData; virQEMUDriver *driver =3D priv->driver; g_autoptr(qemuMigrationCookie) mig =3D NULL; + int ret; =20 if (priv->origCPU) cookieFlags |=3D QEMU_MIGRATION_COOKIE_CPU; @@ -2725,6 +2812,9 @@ qemuMigrationSrcBeginXML(virDomainObj *vm, if (!(flags & VIR_MIGRATE_OFFLINE)) cookieFlags |=3D QEMU_MIGRATION_COOKIE_CAPS; =20 + if (flags & VIR_MIGRATE_TLS) + cookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + if (!(mig =3D qemuMigrationCookieNew(vm->def, priv->origname))) return NULL; =20 @@ -2738,6 +2828,15 @@ qemuMigrationSrcBeginXML(virDomainObj *vm, cookieFlags) < 0) return NULL; =20 + if ((flags & VIR_MIGRATE_TLS) && mig->tlsPSK) { + ret =3D qemuMigrationPersistPSK(driver, vm, mig->tlsPSK); + if (ret < 0) { + virSecureEraseString(mig->tlsPSK); + g_clear_pointer(&mig->tlsPSK, g_free); + return NULL; + } + } + if (xmlin) { g_autoptr(virDomainDef) def =3D NULL; =20 @@ -4232,6 +4331,9 @@ qemuMigrationSrcConfirmPhase(virQEMUDriver *driver, privJob->stats.mig.downtime =3D privMigJob->stats.mig.downtime; } =20 + if (flags & VIR_MIGRATE_TLS) + qemuMigrationDeletePSKDir(driver, vm); + if (flags & VIR_MIGRATE_OFFLINE) return 0; =20 @@ -5275,6 +5377,9 @@ qemuMigrationSrcRun(virQEMUDriver *driver, error: virErrorPreserveLast(&orig_err); =20 + if (flags & VIR_MIGRATE_TLS) + qemuMigrationDeletePSKDir(driver, vm); + if (qemuDomainObjIsActive(vm)) { int reason; virDomainState state =3D virDomainObjGetState(vm, &reason); @@ -7029,6 +7134,9 @@ qemuMigrationDstFinishActive(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_STATS) < 0) VIR_WARN("Unable to encode migration cookie"); =20 + if (flags & VIR_MIGRATE_TLS) + qemuMigrationDeletePSKDir(driver, vm); + qemuMigrationDstComplete(driver, vm, inPostCopy, VIR_ASYNC_JOB_MIGRATION_IN, vm->job); =20 @@ -7039,6 +7147,9 @@ qemuMigrationDstFinishActive(virQEMUDriver *driver, * overwrites it. */ virErrorPreserveLast(&orig_err); =20 + if (flags & VIR_MIGRATE_TLS) + qemuMigrationDeletePSKDir(driver, vm); + if (qemuDomainObjIsActive(vm)) { if (doKill) { qemuProcessStop(vm, VIR_DOMAIN_SHUTOFF_FAILED, @@ -7197,6 +7308,14 @@ qemuMigrationProcessUnattended(virQEMUDriver *driver, else qemuMigrationSrcComplete(driver, vm, job); =20 + /* + * Attempt to clean up the directory containing the pre-shared keys + * for the domain. Since, we cannot determine if the migration has + * enabled the VIR_MIGRATE_TLS flag with pre-shared keys, we clean up + * the directory unconditionally. + */ + qemuMigrationDeletePSKDir(driver, vm); + qemuMigrationJobFinish(vm); =20 if (!virDomainObjIsActive(vm)) diff --git a/src/qemu/qemu_migration_cookie.c b/src/qemu/qemu_migration_coo= kie.c index 7311a8294b..1a7b9361da 100644 --- a/src/qemu/qemu_migration_cookie.c +++ b/src/qemu/qemu_migration_cookie.c @@ -20,13 +20,16 @@ =20 #include #include +#include =20 #include "locking/domain_lock.h" #include "virerror.h" +#include "virfile.h" #include "virlog.h" #include "virnetdevopenvswitch.h" #include "virstring.h" #include "virutil.h" +#include "virsecureerase.h" =20 #include "qemu_domain.h" #include "qemu_migration_cookie.h" @@ -52,6 +55,7 @@ VIR_ENUM_IMPL(qemuMigrationCookieFlag, "allowReboot", "capabilities", "block-dirty-bitmaps", + "psk", ); =20 =20 @@ -149,6 +153,17 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC(qemuMigrationBlockDirtyB= itmapsDisk, qemuMigrationBlockDirtyBitmapsDiskFree); =20 =20 +static bool +qemuMigrationServerCertsExists(virQEMUDriver *driver) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + g_autofree char *cacert_path =3D g_strdup_printf("%s/ca-cert.pem", cfg= ->migrateTLSx509certdir); + g_autofree char *key_path =3D g_strdup_printf("%s/server-key.pem", cfg= ->migrateTLSx509certdir); + g_autofree char *cert_path =3D g_strdup_printf("%s/server-cert.pem", c= fg->migrateTLSx509certdir); + return virFileExists(cacert_path) && virFileExists(key_path) && virFil= eExists(cert_path); +} + + void qemuMigrationCookieFree(qemuMigrationCookie *mig) { @@ -165,6 +180,9 @@ qemuMigrationCookieFree(qemuMigrationCookie *mig) g_free(mig->name); g_free(mig->lockState); g_free(mig->lockDriver); + if (mig->tlsPSK) + virSecureEraseString(mig->tlsPSK); + g_free(mig->tlsPSK); g_clear_pointer(&mig->jobData, virDomainJobDataFree); virCPUDefFree(mig->cpu); qemuMigrationCookieCapsFree(mig->caps); @@ -575,6 +593,51 @@ qemuMigrationCookieAddCaps(qemuMigrationCookie *mig, } =20 =20 +static int +qemuMigrationCookieAddTLSPSK(qemuMigrationCookie *mig, + virQEMUDriver *driver, + virDomainObj *vm) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + qemuDomainObjPrivate *priv =3D vm->privateData; + gnutls_datum_t psk_key =3D {NULL, 0}; + g_autofree char *key =3D NULL; + size_t key_len; + int ret; + + /* Generate the pre-shared key exactly once for a migration session*/ + if (priv->migTLSPSK) { + mig->tlsPSK =3D g_strdup(priv->migTLSPSK); + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + return 0; + } + + ret =3D gnutls_key_generate(&psk_key, cfg->migrateTLSPSKLength); + if (ret < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Generation of a pre-shared key failed")); + return -1; + } + key_len =3D (psk_key.size*2) + 1; + key =3D g_new0(char, key_len); + + ret =3D gnutls_hex_encode(&psk_key, key, &key_len); + if (ret < 0) { + gnutls_free(psk_key.data); + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Hex encoding of a PSK key failed")); + return -1; + } + + priv->migTLSPSK =3D g_strdup(key); + mig->tlsPSK =3D g_steal_pointer(&key); + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + + gnutls_free(psk_key.data); + return 0; +} + + static void qemuMigrationCookieGraphicsXMLFormat(virBuffer *buf, qemuMigrationCookieGraphics *grap) @@ -890,6 +953,9 @@ qemuMigrationCookieXMLFormat(virQEMUDriver *driver, if (mig->flags & QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS) qemuMigrationCookieBlockDirtyBitmapsFormat(buf, mig->blockDirtyBit= maps); =20 + if ((mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) && mig->tlsPSK) + virBufferAsprintf(buf, "%s\n", mig-= >tlsPSK); + virBufferAdjustIndent(buf, -2); virBufferAddLit(buf, "\n"); return 0; @@ -1396,6 +1462,12 @@ qemuMigrationCookieXMLParse(qemuMigrationCookie *mig, qemuMigrationCookieBlockDirtyBitmapsParse(ctxt, mig) < 0) return -1; =20 + if (flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + mig->tlsPSK =3D virXPathString("string(./migration-key[1])", ctxt); + if (mig->tlsPSK) + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + } + return 0; } =20 @@ -1471,14 +1543,17 @@ qemuMigrationCookieFormat(qemuMigrationCookie *mig, qemuMigrationCookieAddCaps(mig, dom, party) < 0) return -1; =20 + if (flags & QEMU_MIGRATION_COOKIE_TLS_PSK && + party =3D=3D QEMU_MIGRATION_SOURCE && + qemuMigrationCookieAddTLSPSK(mig, driver, dom) < 0) + return -1; + if (qemuMigrationCookieXMLFormat(driver, priv->qemuCaps, &buf, mig) < = 0) return -1; =20 *cookieoutlen =3D virBufferUse(&buf) + 1; *cookieout =3D virBufferContentAndReset(&buf); =20 - VIR_DEBUG("cookielen=3D%d cookie=3D%s", *cookieoutlen, *cookieout); - return 0; } =20 @@ -1494,6 +1569,7 @@ qemuMigrationCookieParse(virQEMUDriver *driver, unsigned int flags) { g_autoptr(qemuMigrationCookie) mig =3D NULL; + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); =20 /* Parse & validate incoming cookie (if any) */ if (cookiein && cookieinlen && @@ -1537,6 +1613,20 @@ qemuMigrationCookieParse(virQEMUDriver *driver, } } =20 + if (flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + if (!qemuMigrationServerCertsExists(driver)) { + if (!mig->tlsPSK) { + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("destination host has no X.509 certificat= es configured for migration and source host did not provide a pre-shared ke= y")); + return NULL; + } + } else { + virSecureEraseString(mig->tlsPSK); + mig->flags &=3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; + g_clear_pointer(&mig->tlsPSK, g_free); + } + } + if (vm && flags & QEMU_MIGRATION_COOKIE_STATS && mig->jobData && vm->j= ob->current) mig->jobData->operation =3D vm->job->current->operation; =20 diff --git a/src/qemu/qemu_migration_cookie.h b/src/qemu/qemu_migration_coo= kie.h index 254372234d..fd3b4c5a56 100644 --- a/src/qemu/qemu_migration_cookie.h +++ b/src/qemu/qemu_migration_cookie.h @@ -35,6 +35,7 @@ typedef enum { QEMU_MIGRATION_COOKIE_FLAG_ALLOW_REBOOT, QEMU_MIGRATION_COOKIE_FLAG_CAPS, QEMU_MIGRATION_COOKIE_FLAG_BLOCK_DIRTY_BITMAPS, + QEMU_MIGRATION_COOKIE_FLAG_TLS_PSK, =20 QEMU_MIGRATION_COOKIE_FLAG_LAST } qemuMigrationCookieFlags; @@ -53,6 +54,7 @@ typedef enum { QEMU_MIGRATION_COOKIE_CPU =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_CPU), QEMU_MIGRATION_COOKIE_CAPS =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_CAPS), QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS =3D (1 << QEMU_MIGRATION_COO= KIE_FLAG_BLOCK_DIRTY_BITMAPS), + QEMU_MIGRATION_COOKIE_TLS_PSK =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_TLS= _PSK), } qemuMigrationCookieFeatures; =20 typedef struct _qemuMigrationCookieGraphics qemuMigrationCookieGraphics; @@ -171,6 +173,9 @@ struct _qemuMigrationCookie { =20 /* If flags & QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS */ GSList *blockDirtyBitmaps; + + /* If flags & QEMU_MIGRATION_COOKIE_TLS_PSK */ + char *tlsPSK; }; =20 =20 diff --git a/tests/qemumigrationcookiexmltest.c b/tests/qemumigrationcookie= xmltest.c index bc0f68b8c5..adf2eb4d08 100644 --- a/tests/qemumigrationcookiexmltest.c +++ b/tests/qemumigrationcookiexmltest.c @@ -160,8 +160,12 @@ testQemuMigrationCookieParse(const void *opaque) return -1; } =20 - /* set all flags so that formatter attempts to format everything */ - data->cookie->flags =3D ~0; + /* Set all flags except QEMU_MIGRATION_COOKIE_TLS_PSK so that formatter + * attempts to format everything except the migration-key element. Thi= s is + * because the value of the migration-key element is randomly generate= d every time + * the migration cookie is constructed. + */ + data->cookie->flags =3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; =20 if (qemuMigrationCookieXMLFormat(&driver, priv->qemuCaps, @@ -225,15 +229,17 @@ testQemuMigrationCookieDom2XML(const char *namesuffix, * - lockstate: internals are NULL in tests, causes crash * - nbd: monitor not present * - dirty bitmaps: monitor not present + * - tls-psk: a new key is generated every time the migration cook= ie is constructed, so we can't test it */ unsigned int cookiePopulateFlagMask =3D QEMU_MIGRATION_COOKIE_LOCK= STATE | QEMU_MIGRATION_COOKIE_NBD | - QEMU_MIGRATION_COOKIE_BLOCK_= DIRTY_BITMAPS; + QEMU_MIGRATION_COOKIE_BLOCK_= DIRTY_BITMAPS | + QEMU_MIGRATION_COOKIE_TLS_PS= K; data->cookiePopulateFlags =3D ~cookiePopulateFlagMask; } =20 if (cookieParseFlags =3D=3D 0) - data->cookieParseFlags =3D ~0; + data->cookieParseFlags =3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; =20 data->inStatus =3D g_strconcat(abs_srcdir, "/", domxml, NULL); =20 @@ -279,7 +285,7 @@ testQemuMigrationCookieXML2XML(const char *name, int ret =3D 0; =20 if (cookieParseFlags =3D=3D 0) - data->cookieParseFlags =3D ~0; + data->cookieParseFlags =3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; =20 data->inStatus =3D g_strconcat(abs_srcdir, "/", statusxml, NULL); data->infile =3D g_strconcat(abs_srcdir, "/qemumigrationcookiexmldata/= ", @@ -381,7 +387,7 @@ testQemuMigrationCookieXML2XMLBitmaps(const char *name, int ret =3D 0; =20 if (cookieParseFlags =3D=3D 0) - data->cookieParseFlags =3D ~0; + data->cookieParseFlags =3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; =20 data->inStatus =3D g_strconcat(abs_srcdir, "/", statusxml, NULL); data->infile =3D g_strconcat(abs_srcdir, "/qemumigrationcookiexmldata/= ", --=20 2.43.7