From nobody Sun Sep 20 12:48:34 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1785316011; cv=pass; d=zohomail.com; s=zohoarc; b=JIAfPGUD4+GW/UB8nietvE9btK1L5JsZAe/vLIqSy43HUc8DSuhHCkvomz7s3ZYhLpAjjbgiSUwWvA4cv1X2ZWDxF11BsWyf9mTxS+sov3qAQQrrguVFhHXvAvMCpuUD4QxavV6YyreKudkcgOesfd43liDwDb6QrEZDgxMYs4U= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785316011; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=CrN8dP9Chyz64LS0Cbktix/AuaSZrUGHOWSyI7YNN0w=; b=H/lPI3npOuH9gxnh447vgIGkwgyIptyj+hY0kPpaffFNRluR7mrZ1kr/Po+WWMOifhR52kFw3fCxhosB9q1UZsNe2FHAKLwHPuK6M/rwj1dQ3OSFKG/1uq2LuYlqnebmNKf/OvKMzIWwqD7e5rZ0Ryfxf5HzfgReIROtttpPzIg= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1785316011670618.2066582779395; Wed, 29 Jul 2026 02:06:51 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 7E37741BD8; Wed, 29 Jul 2026 05:06:50 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 76E0D423E5; Wed, 29 Jul 2026 05:01:27 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id C1BCD41BAF; Wed, 29 Jul 2026 05:01:01 -0400 (EDT) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 0534D41C7C for ; Wed, 29 Jul 2026 04:59:54 -0400 (EDT) Received: from pps.filterd (m0127843.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66T7cI4d2414198 for ; Wed, 29 Jul 2026 01:59:54 -0700 Received: from sn4pr2101cu001.outbound.protection.outlook.com (mail-southcentralusazon11022123.outbound.protection.outlook.com [40.93.195.123]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4fq1gjhn2x-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Wed, 29 Jul 2026 01:59:54 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by PH0PR02MB11606.namprd02.prod.outlook.com (2603:10b6:510:3b9::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Wed, 29 Jul 2026 08:59:52 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%4]) with mapi id 15.21.0270.009; Wed, 29 Jul 2026 08:59:52 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=CrN8dP9Chyz64LS0Cbktix/AuaSZrUGHOWSyI7YNN 0w=; b=YLR66ZQyp7kpCdwfwoycU4b4OK08a3Jg2JvJzJgh8smoC0YdqXXZm7IC1 czhBdWoeOcaIe37xoguoOfFHF8g5/1zH3cGLYRAvv5HB+Z3C3UKcU1HEu7bNW3hT 9Ql0zuD1tyZZFsKLgcFu633DNmA3ExNk/HWEDI6dnXo5fraOUod0yHvS0QuQHyvQ 0PkrVWuP5it4AvvL6cM06+0oz5+jkEh1sJwRCbreQZguigZlNgjphLjq9LjRA9Tm tA84VNB2C1+CU26V73Zbcr/QfX9rCPN2Ev4V1IJyZ9Sn9iJIPfWZQjxhVOFN5hP5 nu7iYL+ZCaZZZFB4LMFmLFwTfQfCg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=d83UY9FJVAkG+dpjvLG/Q6qjvvKfo8kU5SbV91V5YNUDQV/NnehFlGrCHTsCaK1SN/yhi+tAakp5i9TsjUNPMXzou3/7SYIMR1HJH99rxrzlhz6fjBnRS+sA0NCjfp04hMJhJQGiTnWQqZODHbWsY4TZ4Z1l3J+h9yKOxYWSToZvj+nj92KOPFXqV6X3cj07C1PxyHxtLYKxOnOKvtXTIs5MSH6pT/wpC5dXrf38BDxXLSkkxtpSZsSVe+JXzaYZ1PnnTbtrU8BryWEWQ1gfMEJxCytOq0IKG0/xyc8qI7ycXSzdQQif/a7jjYYBHqGz2htD7xvvfC9U+YurOZ8unA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=CrN8dP9Chyz64LS0Cbktix/AuaSZrUGHOWSyI7YNN0w=; b=Uvjxsk6TLr2OWViICtMu8/qKlgnZzVvf7myyS0ZBUO5PUUa8cVhWcO28uvWgepbihiBfCzzzPUDQFJECj2mezLgY88fKz4/sbsFEOvInyAf1576DVDySnLQ+zXrJW99pHfYKWl+nByTNL0NorKrJmcx2Dtj9z0bB9R6EJlCr63CHRV8rtF8PBoB/G7g0LsWS0KovJOgwXjKSOIJFA+BBWyPWYMKs5gouqKIvJR1WWU1TRVGSSQ7d0aXvKP4dIkxydTkbpcfvrPJiw0mkG7LLU5maQLgvNd62N65Oys+2wxXMeeJcMJK80Bh8XEI/ZoSVSiw1+S4yj5gvhuqAOtp8Og== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CrN8dP9Chyz64LS0Cbktix/AuaSZrUGHOWSyI7YNN0w=; b=da3tEdgjZyo2uVGA8sIJ5IhtMk1vfN6NUPniG82MxHLB4XSWiZ8d5w2brHUJI1kwII61pU1jAwFbYT4SucG4BIih23dugEZDMbX3LY/lfVYWukOz3Ln+hbFHzcqSDYxOdMTpLkOztdb0jcUG3eu0N+AfrIdNwDirepWphhVXNe/3RpYoBjWVK0tOHH08ZZ6zxECuuGWdvRjt74gw1Fvc/FvCk+dFuor64PX6hpWAAYyseuwHRzQoSDJrDN03eJKwm//2dtSI7wEOohPsfGsF5XnwZSWRq2OkG+iuAPWUotTuoCpaBYI2DcYhk78TKYP968cS22kCjHjaNW/J+ZRi4g== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v3 6/7] qemu: Set up the migrate TLS-PSK objects Date: Wed, 29 Jul 2026 08:58:58 +0000 Message-ID: <20260729085917.3243911-7-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> References: <20260729085917.3243911-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: CY5PR15CA0117.namprd15.prod.outlook.com (2603:10b6:930:68::11) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|PH0PR02MB11606:EE_ X-MS-Office365-Filtering-Correlation-Id: 8504d2be-f270-43e3-c90b-08deed4fc0d7 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|6133799003|3023799007|56012099006|18002099003|22082099003|10067099003; X-Microsoft-Antispam-Message-Info: hSIfrPlZy4xm3YvQtjW+c58jD1pWDbsNXgSU5XXajJWQwE2ZNqoTC6H1zZj+bVcHS/S7RzeP1a5ibMtnBlxWUDQsxhoYhAFT2psH0rNRtouWcqEfzICmBbBp/SaCbBZMu9J8NNYXsZgtpqXL3bjgDBxyp4GpGCUXipRfeMAZ3d1M/Rw7xQ9FM6QVhIALeZLHWnb6HmCBmViajiwH0gI0zfaj0wScq519G53R0Vg9GqTHtQnYuKm+E6y+3yTy33F+jh8uL1FXKTYZuzab52EwHn4Ljy7AxN9/zWRmCQFHFNQeSp5rFodTKi4eX/isDOKjgxg7eTdoBZKEadgcmUp0wIcTfNQmc3AKC1VFsZycnyuA10udKCbJMEl+Pnl3UNCRdLpt9KmLZj2b6tK6cJMhfjrcyopJYyjmZDJG0A/azNBl8FLdOX3Hh6KkENbT21HeWBlMgGt6G6EurnYVkx+uOUZcDcdFHKC8GHrtoTL3EtQ68Gix/0ce894eqy1US4XMcSWADMRoEIlrmXDWJ+nIYlHHbtNOW1BLTvh8r84V2ff8O9YHTBLE0IIf4XnQuSxcLvTkjQl5dbIM88RQL2h9K6MehHHuD3ebRIERRt00NhrVb5J1kwPaDnW419rA3DiXnrXpeIhbdxBajfB6iuLXVjk9M3LtHxJ/678UHf5qlYI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(6133799003)(3023799007)(56012099006)(18002099003)(22082099003)(10067099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?KifhDY1ppHCFTqRIx7FnfDjiYo0E2H8X+xPP/cF6AooZ3dKOa5yz58nAgCF1?= =?us-ascii?Q?B0lS1GBlV5h6eAnXbxkPdx4ucibtIP1dkiYaTlS/Ajc7REmUl/5UbdSAvjK5?= =?us-ascii?Q?sZMtqMZygdSpmjKVqg3YDDus2PE41W2CX5D3lk1z+nuEnbBYJR3kkK2A+EyF?= =?us-ascii?Q?mPjzKmygW06j3slCczPC4+iwBFI/CXh7DRYADzi58dull3lVzvHuFmqwbvX7?= =?us-ascii?Q?46IbzPlcALZgXizYUghMbdd68CFfxFbEWhSewgo7uQB8xzgZXnnoZHEGF/yb?= =?us-ascii?Q?UaFcV0pq3Paru7nY7X032iIdQSi8NatdRjY+ktY6C5gcM6faIwmKoxDL9giN?= =?us-ascii?Q?DU/kWUtthZKk33T8+flJxNd2fPkbe6sn+16HCbdAAnzs6cwK8el2WX3c9TSP?= =?us-ascii?Q?jOE8qXvvq/r/ppyQ2p2XUzmUxHuxSWeioMmyQU3IvbWhs2RSePSQmELtREjD?= =?us-ascii?Q?BFoKNjyZgVcliXEBU4PdYJx1J8WVcCoHnn0ALycVXr79S3/v6RG6txliW6KY?= =?us-ascii?Q?TYdq460TjBhIYSBP/vKyCaNzoOfWbaDmpezwqO87DasFLvS03YVVd2kDei14?= =?us-ascii?Q?hJd3e4GzKW2tc9q6jsfn8pXAhtHJgDPmv6l+uXImDwEDgicWHw/4QlRnfRvq?= =?us-ascii?Q?dvtto9p9CcqVWNdrpWmpydY7jxt3XlRCiR+pQviBGSlGCs5AeteLDOvqNQh0?= =?us-ascii?Q?+OrKCtouWLt3X5SC66yAi+7b7AnLj5zuaSnQb/akeGcwRH2yL8AuRbYCVUYp?= =?us-ascii?Q?2tg7F3ei5s4f+z301a45qrDC0DAt3hsdaDs2spCUdzS2z1yfsRmaQk0/+DGr?= =?us-ascii?Q?DmVSsfTA8a06nSBX9y0AZyMBPr6EpAcV16FzDvlUeJ2y8C460iRauk0/haLB?= =?us-ascii?Q?4cE+JdOTQd37sD3S3mXzWgRRo7sSJE/NIyaHA5LZwxli0P9PtFHyG5JCscqa?= =?us-ascii?Q?uPhWFCSDfjmiPk2+X1fVOf3zdH1EHDuvKsYhowa+c9fl9tsVMxY8XUNc02Xp?= =?us-ascii?Q?tEPtRHnKotlWCDtCuSs3Keh/RPbJLj3Y6NaQDSPoPPrrNzHKmT2uOB8DPlGT?= =?us-ascii?Q?jhvur7/6wtUQRZ1WTMFib8tmE+r+M9sk+G09oTFnEzJoVMqW2RWsngtXJHCE?= =?us-ascii?Q?cTJH9dixWbPLuNeUs0zhGBlJXoq3eId3XvJBJ7AxYw/pB3DW6PilcS/YN1/l?= =?us-ascii?Q?S2B9DBSoMWUTcgHrqUg+x4YkrEGY4nHDQTSLBe8z/AEEpeoHbWl375IcNpn/?= =?us-ascii?Q?PRW8h/cJVbecPn1WLJO1Rp++UvT4F0zyKahMl1z8m7ZNYpiIfjOpX6RG2mpL?= =?us-ascii?Q?0kwToJLYe1q1QWU3JmT6HBTKHHbtuk6XxqZY2stUvoF1J90Ep7cSKMLHBsLB?= =?us-ascii?Q?HJcg08R/3L2RM765N5SWMlyLmLurrQ72vLn5xF1YPKodSy3+2OygmxqFY+D8?= =?us-ascii?Q?3qpXGkr9DsLTnhWuZe34xVc9Se8QWhaWqNIRYIWdFvfTj1pAVdijuL2uXBFz?= =?us-ascii?Q?1kq/tgesbGALpka4Rm/x4x0+IrMu5Z3U22IFUI3wAi6AuO3Jv+CCetiQ//mL?= =?us-ascii?Q?UKulNR8nzoGr1ixFOUfR8ze0Ror+wLeywWyncFlsETHvexqfGz251RtBFEuC?= =?us-ascii?Q?04LQLRyI+xWt3Cuk0BD7IFeoFGGzckGmYSdWlcmK9QTz6oOnkpZWMxcaNPow?= =?us-ascii?Q?D0qymd6LX3pgBgKQS+gZ6JrmoGXd1UrmBDlTW9CvORe8YCbLD6R1628VDrg5?= =?us-ascii?Q?roa3pVciF5IU8yqGqvL/AuHXT0pb2pw=3D?= X-Exchange-RoutingPolicyChecked: OirsTh2btfa0Fy3Mh4SV7LWsnZe0xfrPEkmznaf327mLP+3KW5F8nsHkhi7y2rnVgO6AMbbPyDYrfWpFsn8f+6GDFH4PuGhYWRIpOrOPkDKhGBnbEE1uX/xIPuga/+LnsGCWynVaMOjJ1/fPE3VOXBRW/tlXG+/OZrQ9YKp+9JUE7ZmjPkJge70xHGYhogtdOVVv33e44VBEPKZlzq1QtBkp00iMB31wRij5jf9MRP0UVDWB/p0mfg8M5mBHU4F9GRymKfmSWE0Ly7JiqFNQDbUx7YFJI8Hm6lLN5PgR1zrX3E5wYdkJqsrkbv25Wf0miINu2QiTWvamBV7ExShRsQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8504d2be-f270-43e3-c90b-08deed4fc0d7 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jul 2026 08:59:52.7585 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: RirIk8kHuki+NnXexsdhHEJMwh0aU62Jsn2rjUieHBX29LW6UOjVL7aCLGhrFaoVoktyHHruiH37YGvsus17nP/G7vrJ5GWFYjENj56MVpM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR02MB11606 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX7Xo1KA6kLWNk gE17De2Rm54GR5Pt2+IaOA7zgxV4LGgym0dAbKqtdqjCVNfSYkfC73+R2g6Ni1UubZZ6Z9hL27j gdcH/n54/DltIqQtBswpkXJe0xKiFYYj+NifB201fcKPzSE+7iNAr++HKT4D91SWo+HHDDsWj0p 8amdvEoC4hwIckRsYn+QbKbHPZfjzkUKA2RRaRnGxeAXqpibpypR/UIaObTO1LiDEoRO94jIXTy eMOyq+JumnTS+oIHDyrLyJZDDmN5q5TV2AvlfqQ34wSb0pbfaBaAj2ZhMtO7QihCtCTSNrr91hK 66rY4p9ho9n8k78RZ3FeyjVu0+4hab4XU1l0NFJbmUBN7OvZuxix2ydOk6DYXKE4O5tbhaQkeg1 7hdGK3288hokM053l8mbgG2GHwUMPXM7IdFCR3Fq1HMJmjncSX/ThMQkXFM8gYUFkAGNRaQ9toe HIHQ5UlhX544DHlMcig== X-Authority-Analysis: v=2.4 cv=bOsm5v+Z c=1 sm=1 tr=0 ts=6a69c10a cx=c_pps a=ZllXB5KXBtO1w8B7B7qn8g==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=RAioF0-LDSMA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=dEe9Ve2bX-KnNSUMM2s9:22 a=64Cc0HZtAAAA:8 a=m9nVCRrcZDnXHdazAWUA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI5MDA3MyBTYWx0ZWRfX8OBGz10UmAvL vGxjeSEe68W0maw64xsJMLJb0HJ1NXyhyaknTVoVsKKFlT54H460QU9J0eycZTLtBNxG5lvZHzy dzido6/Mpp8aGDDVO1tZPK5zJu9dZYM= X-Proofpoint-ORIG-GUID: RqG41DIb1E6FyUABEJKc6Vw-rKEWjEZV X-Proofpoint-GUID: RqG41DIb1E6FyUABEJKc6Vw-rKEWjEZV X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-29_03,2026-07-28_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: PIEB5ZJLJM5M4VKY2JBRRQKRR7GWFI5Z X-Message-ID-Hash: PIEB5ZJLJM5M4VKY2JBRRQKRR7GWFI5Z X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1785316012574158500 Content-Type: text/plain; charset="utf-8" Enable TLS-PSK based secure migration, if and only if the VIR_MIGRATE_TLS flag is set and the destination host lacks necessary X.509 credentials (ca-cert.pem, server-cert.pem and server-key.pem). Suggested-by: Tejus GK Signed-off-by: Abhisek Panda --- include/libvirt/libvirt-domain.h | 11 +++-- src/qemu/qemu_migration.c | 83 +++++++++++++++++++++----------- 2 files changed, 64 insertions(+), 30 deletions(-) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-dom= ain.h index 5b67f8f897..70d955fd31 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -1089,9 +1089,14 @@ typedef enum { VIR_MIGRATE_POSTCOPY =3D (1 << 15), =20 /* Setting the VIR_MIGRATE_TLS flag will cause the migration to attempt - * to use the TLS environment configured by the hypervisor in order to - * perform the migration. If incorrectly configured on either source or - * destination, the migration will fail. + * to use either the TLS X.509 or TLS pre-shared key (PSK) authenticat= ion + * mechanisms. If valid X.509 certificates and keys exist on the desti= nation host, + * then Libvirt will use TLS X.509 authentication. Otherwise, Libvirt = falls back to + * TLS PSK authentication. If the certificate or the key file is corru= pted or not + * properly configured on either source or destination, the migration = will fail. + * + * Note: Since 12.6.0, Libvirt supports the TLS pre-shared key (PSK) a= uthentication + * mechanism along with the TLS X.509 authentication scheme. * * Since: 3.2.0 */ diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 943478fe68..5e381b96e9 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -3508,14 +3508,28 @@ qemuMigrationDstPrepareActive(virQEMUDriver *driver, /* Save original migration parameters */ qemuDomainSaveStatus(vm); =20 - /* Migrations using TLS need to add the "tls-creds-x509" object and + /* Migrations using TLS need to add the "tls-creds-x509" object if the= cert files are + * present on the host, else fallback to adding the "tls-creds-psk" ob= ject. Additionally, * set the migration TLS parameters */ if (flags & VIR_MIGRATE_TLS) { - if (qemuMigrationParamsEnableTLSx509(driver, vm, true, - VIR_ASYNC_JOB_MIGRATION_IN, - &tlsAlias, NULL, - migParams) < 0) - goto error; + if (!mig->tlsPSK) { + if (qemuMigrationParamsEnableTLSx509(driver, vm, true, + VIR_ASYNC_JOB_MIGRATION_I= N, + &tlsAlias, NULL, + migParams) < 0) + goto error; + } else { + ret =3D qemuMigrationPersistPSK(driver, vm, mig->tlsPSK); + if (ret < 0) { + virSecureEraseString(mig->tlsPSK); + g_clear_pointer(&mig->tlsPSK, g_free); + goto error; + } + if (qemuMigrationParamsEnableTLSPSK(driver, vm, true, + VIR_ASYNC_JOB_MIGRATION_IN, + &tlsAlias, migParams) < 0) + goto error; + } } else { if (qemuMigrationParamsDisableTLS(vm, migParams) < 0) goto error; @@ -3622,6 +3636,13 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, g_autofree char *xmlout =3D NULL; unsigned int cookieFlags =3D 0; bool taint_hook =3D false; + unsigned int parseCookieFlags =3D QEMU_MIGRATION_COOKIE_LOCKSTATE | + QEMU_MIGRATION_COOKIE_NBD | + QEMU_MIGRATION_COOKIE_MEMORY_HOTPLUG | + QEMU_MIGRATION_COOKIE_CPU_HOTPLUG | + QEMU_MIGRATION_COOKIE_CPU | + QEMU_MIGRATION_COOKIE_CAPS | + QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITM= APS; =20 VIR_DEBUG("name=3D%s, origname=3D%s, protocol=3D%s, port=3D%hu, " "listenAddress=3D%s, nbdPort=3D%d, nbdURI=3D%s, flags=3D0x%x= ", @@ -3633,6 +3654,11 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_CAPS; } =20 + if (flags & VIR_MIGRATE_TLS) { + parseCookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + cookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + } + /* Let migration hook filter domain XML */ if (virHookPresent(VIR_HOOK_DRIVER_QEMU)) { g_autofree char *xml =3D NULL; @@ -3679,14 +3705,7 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, * domain list. Parsing/validation may fail and there's no * point in having the domain in the list at that point. */ if (!(mig =3D qemuMigrationCookieParse(driver, NULL, *def, origname, N= ULL, - cookiein, cookieinlen, - QEMU_MIGRATION_COOKIE_LOCKSTATE | - QEMU_MIGRATION_COOKIE_NBD | - QEMU_MIGRATION_COOKIE_MEMORY_HOTP= LUG | - QEMU_MIGRATION_COOKIE_CPU_HOTPLUG= | - QEMU_MIGRATION_COOKIE_CPU | - QEMU_MIGRATION_COOKIE_CAPS | - QEMU_MIGRATION_COOKIE_BLOCK_DIRTY= _BITMAPS))) + cookiein, cookieinlen, parseCooki= eFlags))) goto cleanup; =20 if (!(vm =3D virDomainObjListAdd(driver->domains, def, @@ -5112,6 +5131,9 @@ qemuMigrationSrcRun(virQEMUDriver *driver, if (storageMigration) cookieFlags |=3D QEMU_MIGRATION_COOKIE_NBD; =20 + if (flags & VIR_MIGRATE_TLS) + cookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + if (virLockManagerPluginUsesState(driver->lockManager) && !cookieout) { virReportError(VIR_ERR_INTERNAL_ERROR, @@ -5163,19 +5185,26 @@ qemuMigrationSrcRun(virQEMUDriver *driver, qemuDomainSaveStatus(vm); =20 if (flags & VIR_MIGRATE_TLS) { - const char *hostname =3D NULL; - - /* We need to add tls-hostname whenever QEMU itself does not - * connect directly to the destination. */ - if (spec->destType =3D=3D MIGRATION_DEST_CONNECT_HOST || - spec->destType =3D=3D MIGRATION_DEST_FD) - hostname =3D spec->dest.host.name; - - if (qemuMigrationParamsEnableTLSx509(driver, vm, false, - VIR_ASYNC_JOB_MIGRATION_OUT, - &tlsAlias, hostname, - migParams) < 0) - goto error; + if (mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + if (qemuMigrationParamsEnableTLSPSK(driver, vm, false, + VIR_ASYNC_JOB_MIGRATION_OU= T, + &tlsAlias, migParams) < 0) + goto error; + } else { + const char *hostname =3D NULL; + + /* We need to add tls-hostname whenever QEMU itself does not + * connect directly to the destination. */ + if (spec->destType =3D=3D MIGRATION_DEST_CONNECT_HOST || + spec->destType =3D=3D MIGRATION_DEST_FD) + hostname =3D spec->dest.host.name; + + if (qemuMigrationParamsEnableTLSx509(driver, vm, false, + VIR_ASYNC_JOB_MIGRATION_O= UT, + &tlsAlias, hostname, + migParams) < 0) + goto error; + } } else { if (qemuMigrationParamsDisableTLS(vm, migParams) < 0) goto error; --=20 2.43.7