From nobody Mon Sep 14 04:53:02 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1788771530; cv=pass; d=zohomail.com; s=zohoarc; b=c0bPxPjXK+aaWskpOI4CbIRUm04wtBrsnijlFn8rRi32s+NaeeeRp7sf3bNV8Iw0/F5rJ8Y3bzDVt+E7uJxF2xujHzSFt2QJW9wbg6yvb7aW2MM/KHxx0GlE/gadRNKzW9tWKbQmyKF5fED1Ng5+7LUem7uzKUUtNxfBRbkoRRs= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788771530; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=Kip6ME0y8KRmns8GxK9lopwwbGj5cVy7/QcZK91BTbQ=; b=AB2HuanuWgZzWbZi7/+O2Z8eYK7RtJAZnAfzmrAhuf/X8qi/h+/E+fNv1f6XzPq75GRSaBi9VdYpJ75Ld4fejVePPwF2fymkswUiPVDjLitDRtK5xttLluRrLMwWXVWKuxuCN9QWvNLUToSobb6iqoYsPjKSWzXCmPWbz3fqLwQ= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1788771530488388.49209040339326; Mon, 7 Sep 2026 01:58:50 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 5A7BA3F383; Mon, 7 Sep 2026 04:58:48 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id D9B073F881 for ; Mon, 7 Sep 2026 04:57:01 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 641993F323; Mon, 7 Sep 2026 04:56:46 -0400 (EDT) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 877CC3F315 for ; Mon, 7 Sep 2026 04:56:43 -0400 (EDT) Received: from pps.filterd (m0127837.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6877AIJu3572286 for ; Mon, 7 Sep 2026 01:56:42 -0700 Received: from cy3pr05cu001.outbound.protection.outlook.com (mail-westcentralusazon11023104.outbound.protection.outlook.com [40.93.201.104]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4ggf05as62-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 07 Sep 2026 01:56:41 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SA1PR02MB11147.namprd02.prod.outlook.com (2603:10b6:806:4aa::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Mon, 7 Sep 2026 08:56:40 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%3]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 08:56:40 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=Kip6ME0y8KRmns8GxK9lopwwbGj5cVy7/QcZK91BT bQ=; b=O5GNvMgdvADXx5GkmWyoCKxYk01zakwz78AOJv7K6zHOw1nBRQcOk9e++ I2eU4HTjkwZdTjUDMi82eq/alHE1fmGEwxDgulrZiIAwPx9F4DfP6QVj2m2dmm1o PPf+z2kKL4oJnnFix8PB1ELQdWmQWgC4uhbV/Gn/I8hD/TL7GfOAqrHLtFa+qxko VxANVQ3KdnE1a27NFb1vL3eT3lx9hUrSyIdKZiOKIPfBRhrufJsrGsU3dn7mqZSQ HO28IaVQ+zpyNY22351bEBuutoTRC8xLoZfknw9MuNY3DT9G0SPTmwN6RDfH7HMF OHDXYpuz5HHCuAEtKvGoePZvCI7bg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=IMyZ3eh5Rgw1gOWCK3bJqAazk0ce4i+6++9WGAZC30FVRXBQduyesmhpH2KM6fAmKZMCcSjYtldxzwKtqfAw48WEl4QrXUA3yDy/xsKlveQdnEeTSuhXOVqUsh2rqInmRTyBJUPMuPmE5mR29auhiD4An5HKzeqoGiKjWbpJLC77JSrzK6hOh43AumcMJp9KY8E2lHInxQcWK2NntrJZA9Y9JA7mrJJ4PhG56HVg2KX4flfHAblz+RuaaGbME3xRGG74RxLxWaN6jc/s3H3pXgXDHKJ2d5m17C3NbQATeNzXdRVqRR49i20iKTq65yn2Rp6peLBDYcUmk1jb4mhqvQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Kip6ME0y8KRmns8GxK9lopwwbGj5cVy7/QcZK91BTbQ=; b=rqYThdYGjy7ts19goAUZ4k0y2xQmu/WQkLlZc4jjZwkSUyno3M5rVRGce5ODQ7x5F2Pl/aTVncnO7WIA0RGQRYJXNMf+K+/OAz2SG43+MVAgyc47T84FIJ4I9KlZaAWOhQgJTDX/NkX2Oizl/92p9TI4A/yAFSMRkxQ1x5J0N7YF9acfCzH60RRceO/J7X3F7HVhqVU6CxWoYSTACDXHYulkZBsepQuxPgQ9H3SWPlRKYwmOGFqqMp+0d6seUDuW0Bfao2FLj94FtJLX4VdbBJABcI0agg+i3HLCYwDu4MyhLmWPia3rgQOZg/tOcQF/4IHgjzNjfaIR4rAM+QoRSg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Kip6ME0y8KRmns8GxK9lopwwbGj5cVy7/QcZK91BTbQ=; b=qjRiyAKlHlSeqei51kDa5kAWr85m9Y+QyucBubEFDqhTedpJVT6IZjmokREWNGoSCSJyKyY93IbvSvnxih0W5RtDz7Eup/WnlNJ51l8tHlrKbBt2UhgVgVpMONUQ7TGblFvrHd3BA1EjusMt9SSj1a5lyEESRRo2SQD42Fc3QnQLTSMYfZfFzsK0WiGrptD8zaCqV4yEdOccgRQ2kvaot2J4+bFngVsbRXBn5EzTaWus/EQSsLQrcnKsC73ScD3W59BTjNbaRjnk40XqkCZrWliQB1NTdIIt0ui5Y7TfguVpXRIr3KZqBm9QQlfht/tMZ8OOgmocPAjBp5nBSWDfww== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v4 1/7] conf: Add a configuration param for TLS-PSK Date: Mon, 7 Sep 2026 08:55:19 +0000 Message-ID: <20260907085628.949946-2-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260907085628.949946-1-abhisek.panda1@nutanix.com> References: <20260907085628.949946-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BY1P220CA0022.NAMP220.PROD.OUTLOOK.COM (2603:10b6:a03:5c3::14) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SA1PR02MB11147:EE_ X-MS-Office365-Filtering-Correlation-Id: 7ae0047a-5c29-47db-e500-08df0cbdeede x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|10067099003|3023799007|22082099003|18002099003|6133799003|56012099006; X-Microsoft-Antispam-Message-Info: 5Vyx0429g/a/FkSAWjRDHGxoLb/cRpfDng6u5OWeDOuHQxFSIL7Je0hRBHRXOUndKc/pOdFAJ1STTmTeDpIflkVCfydnt/p/pHcaKVLBLEOSuWz/dL2WKtA1fTxRbCIaep63rkjUW7HlHsN6T7Z0KhaRb4uLK6vQBwiX9KQdJh6DVQTPAmMSw9Tu6Vv7FR6dh7siUnLUqNhZNqhS+YWxgctAttApJ+AVdwcjOLYPgj8HelgcK027XcwRBw0/VmkN0dQK2gIHzK3nCZ+kV9EwMee50aq1trWCBsU8iLFnMghMZkBqyuo0OHBImc+JCYZ21uQ9cHcdy/NvK0vsIXnKf4CNcpYyNIUmxPtugdFIrWSSm9Q5VT/A0UqmISBqKuAoJmJd8O/abOp5pzQiLJhMbYmoJuuAOw/5p+FYxDquor2e+/mDlX1ZU7e0w1a0n57O16tb0k7vITDLu3+qCswTtDIGpoMtBRMRXcuRGPtn4kV9BIqK3V9e9ygr5RWSp5n/mCKWv68n30ScCRSNDJxTTd/n8jts4dnKwl/vUOpYd3L5juMa7mqld1sjqk345jjHN2Vgk+npL/z2wxeJdBxJDn7Y3oPO0ILV+H63PSkqLxzgqxO9gfiv96YsCRElLZMc3y+505dAtJKboUNjcdzK8tUzYHh0OrnO2ChZYu895rI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(10067099003)(3023799007)(22082099003)(18002099003)(6133799003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+kqpJg8N8Tg1eDt4v0pcGaEZnDT2XkoC+ExaJNkG9jOLZlKPeY3yiTCGl0ar?= =?us-ascii?Q?E77/2XWS4wdewwMtrvZsTmKZhiNVMkLOdrje52L+NCzexKYJjsGSYpq0TXNU?= =?us-ascii?Q?mbDtGjOXK8nGTcMC9E3OUracEIUQzTYEZ8soQkhW3QYfC56eVhHt645TaIlh?= =?us-ascii?Q?e3BC6P/6nX4M+CXAWg6wantGTHYHYE86zBcPfueKPV7BH5jfezsqpkgdw3hC?= =?us-ascii?Q?6qd6EtLyHKi8Q5z6ehk+KxK+lGXcfzCS2fi26WPryC/wUFt9juWyfx97/dQ3?= =?us-ascii?Q?HRYUnIVpPZou/0+mKeMuMr4cri3DiQXXKcJfz34Z58FuuWvHYGjAF47ZEHtL?= =?us-ascii?Q?1UjHNHzdfwUvm7ftuOy02xTtGODSyrssBVb0SQPFeHuYtReOfhM9fnLOhCum?= =?us-ascii?Q?Y5k5dRwZHT8MnavqxSB+SzkhojYZ4xIfQ+myF5/2Q7QtRduLEUXW1FWp9eoH?= =?us-ascii?Q?rV+3ypG48kl4TdP/M151mqwlJHz/5MJc4iCBG/FM1oDhuh4ujOFBUWb8kFGS?= =?us-ascii?Q?RAc2qRFUNIgStAks5f7+CjSt1JziuvJGa0fbsWpYQ1QO/A01lvWttadCrcJ2?= =?us-ascii?Q?mYeVmL5E0YHo7YRUJlpgrI9+sGx0i7nQ9C8f3GjM9jep4QxeVaMYB5X+VfnI?= =?us-ascii?Q?EjqCdjnkBhOl/ZxKzl55QmZWBLP4SxrzienM2pgNg1T10yAvpWfy+TEZK6H0?= =?us-ascii?Q?/S3Jdl169s4yCsVgbm+iL1wnf+aA3taLnpR4FwLyfOng5XsMTrOlGVwV9OmE?= =?us-ascii?Q?X/RUhS66OkTxoRdOAC77xItJfEaSy1GkNp06bLoEf5dC+zgf72/UKaY1niQa?= =?us-ascii?Q?f8Dn3Lk0SSHWhcwjTfMbFnD0WpJdKd4ygz6EC1N5pdOW1+xXQB7W1R1cCxsF?= =?us-ascii?Q?zWlkdjln19qsHcWedGPk6RSfDgrQJBuqWDKVITd+fZ2ZdaAI+MMo1av+fbZF?= =?us-ascii?Q?i0KU9rlBEx5itLamev9GoVGll0RcBKmmT7eF168tRdU6NDAEf65McapSA0v2?= =?us-ascii?Q?9/YdL5+PmVtNJwhbLH2fqnbCoVomy20z44+ay9zhczaPPSGu7AinvkLb5rgO?= =?us-ascii?Q?34/w242DfRCNwUgDcTitzeq+ppFxclEkgSoCbsQF9pHwl4tbjkZPN3oGrBE5?= =?us-ascii?Q?XSGgdL70Mf3IZf8sGhZX3w2Mf1ZLhij2ouIFryt/531xyVs+F8+JTESbO+rj?= =?us-ascii?Q?GMhYjYxgaRn7fQcpJg6kzTPCF3rjABrpB/Kd+bvfYTbP7qZzb2vY1tz2Rywk?= =?us-ascii?Q?ow5AybafxAERNFx3utBCntNxcM87sRIaWrZBdcGTSyAmv35J8vBVDG4rCJk3?= =?us-ascii?Q?D4DrRfNHyMD8Tc666iLoe5VVaPMqxU1osFroTzga8FS/J71ybPHOZvNQCcfw?= =?us-ascii?Q?4owT8BcPG3rithiBf7GCsASAAt+JGTEd0QNSYtjAM8a9K/tO0Bu1p7QoPez9?= =?us-ascii?Q?9g01aH3ePm3RLGIlcRsHzL0pLHtmv0hUSgf4udcubkuFLZnGTSTiL1jsXwuT?= =?us-ascii?Q?Lj/qF6wztikfUt3+bsk0W+FT9CubF1p0Z6ixaP6QhzYxLdR5W/yCwgBsfM7+?= =?us-ascii?Q?TlWAmMu22rX7zcXWNJwfXUOgp/VvWHiPr+C59rfcVLWqFS6OKJPeOKt/cWI2?= =?us-ascii?Q?BRj7Tv/bnGZB4Gun2lIJC5mfGFOh5Ly9yAtqr4x2r0XjykC5OqQkSQRtRCF5?= =?us-ascii?Q?KneZDqx3YmykywH92egDjeXWc/D2k+4ebdylP9EDKtmDTdcGpJlK/ThjX+5T?= =?us-ascii?Q?IhbO6pBmQA3MUrR4NbKYjp/T5H2MEmE=3D?= X-Exchange-RoutingPolicyChecked: Z/4mooBvNCBYeSqusN3s+CCqa4nTL8x3K7GesNrsncUkwJfaXBGgTtkrHobQtch/Mh+cfn10hNy0zuVV2ewbWH/F/2MRrYIcQsi8DDvBbav7yj5vKcPQuK9u6QtKRNKJKaAHeBapWOqrNa+1KhO/+VLenSOxrNb00BvEsMSKo7B/vciSKt1Xlpko8vRZWj6EG2zJ27QOEUEu5SaVodIy0dvO+dDimx7tOX7axK66R7wwyeBu8i1D9t6wAPAFQcx6U7qmaSXRxT5SnHl5+11N/o1ggOvRFU4fXNB4aKT+yzZkqaFgUksj+Pl3alspPqZYxdLRZo58yuCrBqIHH8aRww== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7ae0047a-5c29-47db-e500-08df0cbdeede X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 08:56:40.6712 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jPnotHn2K5pEhQlPbbkzh2wNoIxEcH8wZIY4FXwtKBq8F61H/OnEwE5G+o5WQUwl6eKy4R2JIavHscOBrhFPw60NIxEOfEIh5hzZ4skm9yA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR02MB11147 X-Proofpoint-GUID: 502fe6nKhUaYKKpp8jU60iGEYCnRglfd X-Proofpoint-ORIG-GUID: 502fe6nKhUaYKKpp8jU60iGEYCnRglfd X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfX0lzoJpSc9Dw0 R4ALxt/ya/HQIh+E8yZ2jd9h6T9XgKTmxMi7BjUC0pt7x0SZYxw5i4Un+4HOYjSuCuUiULI9FOY mP4hFfNbi01yyT06HT7jV1xuBdwnTnXwjFDsF6EYPi4G1PBZgZVQd33srDe4C9ZwRKLChcvsViC EvWIlNmTjbPcIc//i36IEOE/t6XlfKRskLEcBscLdB0BBTRZiVsGMuSDcKnXo6Jfi1Ef9p5Dl4z NcdS6sXTzAgyWOEWWlZNGA3CH0KMEv8mvYFYrba9wVpd87FnU9Qwt7Sskc1QbNMBcwm8mQGth40 5efIzNsSl3eXh7IfJMe6tWH2BlHrEH4zoQWPCPr7q844TovrmtK6VWV3suA0OIPX+ET4irffaHo InafnkG00XU8x2T7IWh8SC/QNVkYAgO6qIR6xeAe4rmzhBxP2s1k0N63Kq1S9CwrimBZD+bdAJX zNmT6o12p84iVt5WE6Q== X-Authority-Analysis: v=2.4 cv=PoKjqQM3 c=1 sm=1 tr=0 ts=6a9e7c49 cx=c_pps a=0zbhqlog1HYD7RdPDvTXcw==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=VdqzKS8jKosA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=Ap8k9tRZuQ82DLYWQqG7:22 a=64Cc0HZtAAAA:8 a=20KFwNOVAAAA:8 a=-2AbmpwzriJMpJNtN8kA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfXxU27eLcY0ywt O3JmjNI4es7XMHqBC9glV6khMu5UvnD6uRUfIpEwqkrfUhik13lvqDJTEmbGP06nxaBTSxoMg3K Bb9svQjEi6wUw/YHJyrBSXAbHZdurQA= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-07_02,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: KXRDLD6LUBVGH2Z7EDP4CTGNCI6X4SXX X-Message-ID-Hash: KXRDLD6LUBVGH2Z7EDP4CTGNCI6X4SXX X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1788771537025158500 Content-Type: text/plain; charset="utf-8" For encrypted migration of VMs, QEMU provides the TLS-PSK authentication apart from TLS certificates. This mechanism relies on pre-shared keys (a secret key that is known to both sender and receiver prior to secure communication) for providing secure transfer of data. Libvirt handles the lifecycle of pre-shared keys, managing their generation, persistent storage, and cleanup. Add the "migrate_tls_psk_length" configuration attribute to qemu.conf to allow users to define the size of the pre-shared key. Signed-off-by: Abhisek Panda Reviewed-by: Peter Krempa --- src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf.in | 8 ++++++++ src/qemu/qemu_conf.c | 18 ++++++++++++++++++ src/qemu/qemu_conf.h | 1 + src/qemu/test_libvirtd_qemu.aug.in | 1 + 5 files changed, 29 insertions(+) diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index dbcbbb04c0..fc61177ea0 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -71,6 +71,7 @@ module Libvirtd_qemu =3D | str_entry "migrate_tls_x509_secret_uuid" | str_entry "migrate_tls_priority" | bool_entry "migrate_tls_force" + | int_entry "migrate_tls_psk_length" =20 let backup_entry =3D str_entry "backup_tls_x509_cert_dir" | bool_entry "backup_tls_x509_verify" diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in index de14db6cde..4fdd655881 100644 --- a/src/qemu/qemu.conf.in +++ b/src/qemu/qemu.conf.in @@ -437,6 +437,14 @@ #migrate_tls_force =3D 0 =20 =20 +# The TLS-PSK authentication relies on pre-shared keys for providing secur= e transfer of data. +# When TLS-PSK is enabled for the migration operation, Libvirt manages the= lifecycle of the +# pre-shared key files. For the key generation process, users can specify = the pre-shared +# key size in bytes. The default value is set to 32 bytes. +# +#migrate_tls_psk_length =3D 32 + + # In order to override the default TLS certificate location for backup NBD # server certificates, supply a valid path to the certificate directory. I= f the # provided path does not exist, libvirtd will fail to start. If the path is diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 6d67939b6e..cca7776b80 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -77,6 +77,9 @@ VIR_LOG_INIT("qemu.qemu_conf"); #define QEMU_BACKUP_PORT_MIN 10809 #define QEMU_BACKUP_PORT_MAX 10872 =20 +#define QEMU_MIGRATE_TLS_PSK_LENGTH 32 +#define QEMU_MIGRATE_TLS_PSK_LENGTH_MAX 512 + VIR_ENUM_IMPL(virQEMUSchedCore, QEMU_SCHED_CORE_LAST, "none", @@ -616,6 +619,17 @@ virQEMUDriverConfigLoadSpecificTLSEntry(virQEMUDriverC= onfig *cfg, =20 #undef GET_CONFIG_TLS_CERTINFO_COMMON #undef GET_CONFIG_TLS_CERTINFO_SERVER + + if (virConfGetValueUInt(conf, "migrate_tls_psk_length", &cfg->migrateT= LSPSKLength) < 0) + return -1; + + if (cfg->migrateTLSPSKLength > QEMU_MIGRATE_TLS_PSK_LENGTH_MAX) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("migrate_tls_psk_length must not be greater than = %1$d"), + QEMU_MIGRATE_TLS_PSK_LENGTH_MAX); + return -1; + } + return 0; } =20 @@ -1596,6 +1610,10 @@ virQEMUDriverConfigSetDefaults(virQEMUDriverConfig *= cfg) =20 #undef SET_TLS_VERIFY_DEFAULT =20 + if (cfg->migrateTLSPSKLength =3D=3D 0) { + cfg->migrateTLSPSKLength =3D QEMU_MIGRATE_TLS_PSK_LENGTH; + } + return 0; } =20 diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 9faf6db206..b700829342 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -170,6 +170,7 @@ struct _virQEMUDriverConfig { char *migrateTLSx509secretUUID; char *migrateTLSpriority; bool migrateTLSForce; + unsigned int migrateTLSPSKLength; =20 char *backupTLSx509certdir; bool backupTLSx509verify; diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qe= mu.aug.in index c97d8d7081..9ba39815a6 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -45,6 +45,7 @@ module Test_libvirtd_qemu =3D { "migrate_tls_x509_secret_uuid" =3D "00000000-0000-0000-0000-000000000000= " } { "migrate_tls_priority" =3D "@SYSTEM" } { "migrate_tls_force" =3D "0" } +{ "migrate_tls_psk_length" =3D "32" } { "backup_tls_x509_cert_dir" =3D "/etc/pki/libvirt-backup" } { "backup_tls_x509_verify" =3D "1" } { "backup_tls_x509_secret_uuid" =3D "00000000-0000-0000-0000-000000000000"= } --=20 2.43.7 From nobody Mon Sep 14 04:53:02 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1788772069; cv=pass; d=zohomail.com; s=zohoarc; b=C0/P625MSBtXo72k2WR4fkQ1ARrUKj86m+84716ln2+bYkG0ouvcsfFF4eE7hu/A0GG4BUPPxtT8mUQHPzqsy84eMKDgwPUrfknRGoNHJX+HOp/vc9035qrNuzSEBZ6QJy8hqkgrH3ZFLpnHYHTxPjg7olcztlqGNzmWte35sxc= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788772069; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=EBt0JV0m4m0uvUseMP7XJNSumWm4Vrm0Y0PbPcYLYOE=; b=FVT9wWKdh15Ffkr+drQbytufULePdazX55ysWrVQrHygaYcFFZw8Fq1bydHIm7QZq8hzXbZC2s+3/IyUo0k/jzT4qc93duimtLxlywwalFdOqYDh6oYXnrzM9919ccxMH37OXXEmy9gddDQ7O2BIz6AhDTyTkBn8w7I1Cvgb4uE= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1788772069436234.60277401500593; Mon, 7 Sep 2026 02:07:49 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id E474E41901; Mon, 7 Sep 2026 05:07:47 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 176FC41AEE for ; Mon, 7 Sep 2026 04:57:36 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id DA14E3F31D; Mon, 7 Sep 2026 04:56:49 -0400 (EDT) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id A2A113F31D for ; Mon, 7 Sep 2026 04:56:45 -0400 (EDT) Received: from pps.filterd (m0127837.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6877AM923572347 for ; Mon, 7 Sep 2026 01:56:44 -0700 Received: from cy3pr05cu001.outbound.protection.outlook.com (mail-westcentralusazon11023075.outbound.protection.outlook.com [40.93.201.75]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4ggf05as65-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 07 Sep 2026 01:56:44 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SA1PR02MB11147.namprd02.prod.outlook.com (2603:10b6:806:4aa::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Mon, 7 Sep 2026 08:56:43 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%3]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 08:56:43 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=EBt0JV0m4m0uvUseMP7XJNSumWm4Vrm0Y0PbPcYLY OE=; b=PP08KRkp8KmZeRRVBqeb/+9YqOokNNaRo79BPSzWxP/o+YlW2E74RYDeX kuYUg0FGl6y8fVr5d5Jvc5p8zL/ZRDqTQfpvIY3AB9m9FZF2RgeO9UeLOPBjj4tn BJYZFGWLyUMIEldEqLBdn8JHKBxhXDROzE+5h+lCMzCK3ig3UU5L484QJfd3C4PP +qUtX2+R8mULigWoqPSvGwpBNHzLgCYy4sdSp+G4JHTSXypQSZumCivmqGZS4WID ClQ7WI+BEF3TpjuBvJEqivHyc336pp0F6/TdqxZiokSkFpvQoJIsY7ZCk5Wmh1KW mS4lJ2E93AZhab9O57X4sd68XLwwQ== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=awWJ8a3ChqgiF8gUj7k792F4M8DdJhO4EIVxXnT500qgnkDNA01TxWj+5wWu0tfGa9Y1fPYotEwFgnYDc+Xittkkz/5KzaAPYszrxrUQLdH/7Azt26t5L4AO5TRdgF2c2hyGD7CKDdUheAOZLdxrQU38uEiJ7hCaaUfP0Z4m3TqPPOJ1r1GRCdFE6sq/AvLw0VEFJr5zGgkTNJ6O/HhBOCyWSCFa41DoA6wsevlix7XY8xakcA6KBHbXO1+khEnflqCwB/J47RBS8M3bA+dlZT0+30ne5+xpcY8vzd4iSUxRAsBxCYO7P/VMyD+zgRbr18N71PiOIrSFVn6Bs4ct+A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EBt0JV0m4m0uvUseMP7XJNSumWm4Vrm0Y0PbPcYLYOE=; b=vN0Cc5ob6K/t1gCJvG8A6a9Ex1HNWElk8iXsZQ1TBn9dQqWVGA41oN94BJJbpXwxKzUna1896PJlkDDzDFqf+oGL4asFKNmDF7zbUBHmzv/fP376VJf9QCkS9uyuWfVEUEvWOyHmdRtWsAG75hfrojab5QOai7MpfhZwj8N37LBZFJhuH6c33IkRVoKVB+TzRPM7ZG03BDKj3pg5Mrh4NTZqQn4y8wQopMVV499jCTDCTy1PX7X2wcBM7xNmYSB+SbOc89fR2hBKJ2P8JyUxoqi32yeI/qxYZbKNFaq8A26OgMXvp6xMdB8RLzoV7LnQw4hK23Oz6H1Z5wxrvlgL/w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EBt0JV0m4m0uvUseMP7XJNSumWm4Vrm0Y0PbPcYLYOE=; b=XLaNn7GSg1q29UnV+l3Pb+Cy8hZnZvRXS/8Grvx6p5TiwqpcVYxtMCIDXFrPMKotU5SlKQ8AizuY/pognGtzom3eWHgZGXOsR9KWSS8EtVarJxXh0zA8XGbfm/8qldjSRpDGYIZzsFnISfxdsXhxZKpDPA7yjbsxh5JXR4GUbcBscxWJJzx22N7arJv2YRB/R0YCsiGQlIdgfcQcfpqFpQrFLNJpAJpomQrzxXJWcXsH35/FYYoq/OA/1roTtqZeN5OTtMPUQxpliW8M2Ywey6UhFDUlbprb4IL8sjSoKgiR2jfpk3fgp3tgCQj/v4XWijf00wnXHKBnyI28IMTD3A== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v4 2/7] qemu: Manage a pre-shared key's lifecycle Date: Mon, 7 Sep 2026 08:55:20 +0000 Message-ID: <20260907085628.949946-3-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260907085628.949946-1-abhisek.panda1@nutanix.com> References: <20260907085628.949946-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ0PR03CA0374.namprd03.prod.outlook.com (2603:10b6:a03:3a1::19) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SA1PR02MB11147:EE_ X-MS-Office365-Filtering-Correlation-Id: fcd34ae1-cca7-4c63-5116-08df0cbdf032 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|10067099003|3023799007|22082099003|18002099003|6133799003|56012099006; X-Microsoft-Antispam-Message-Info: QVBN8rIkpNGARhzTgwko60oHQKpqISwmyuG43Zfvitsd7nknbqstTJNucWIrDfXbxXNRIiRhB0nLpZ8oJl0gqst/Eqg4k2O3DQLod1jp50Bg6M6le1a2mdcS4vIlaeKZzKIcObceNEuvUytPOWNdwUlJ6pxkvk9M0H9x0hLo7gKhC1buFd5nGF04tfvYy+AK6Fr+IO8yWGMDYTMvxMjt8Xiw5H4jufMqPT5ehrVBm3BXdPEs3yty0hS1IhJ8xVDULRXaeDrRunTMQoWJx9IRjz2OQ2WQg8nGhjrONjBa51DcrQA6fue8xU6OqMaykX2HBhh9g1FTLsHwJkiyxVs2W+xjZj/ae38AryfKmqgmY/5h6FZSMRmuh7kv6nXDl03jTJkaPoMQeDLGL6iC5/DAzoQqiZVMz7rbvUJQxRSm+u4mh0h9j8GhLaMVLpx/LvqlLliTU7GvJQrVFRjl7U3jwqelmQrLBR7q8IDKxjQA8+/15IOL+S2hyBHDAS5Y5eAEMzlhS4w8qD07Qp6erMP2dirXuO8iEN9nB+OoaFxvcdGNI5SokX3NnLd6KQmxUyQsh1SekBfI/HmY07e/iiV1IiBXzBU4SqZ4AsX+xs3dZpdVJmLWORy9wlh7XuPqo5FK0v2nC8oS0MK4qWr8xcQ592V00nsyglSANEY3eSSft4o= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(10067099003)(3023799007)(22082099003)(18002099003)(6133799003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Y1OLwrM1oYIEG4KAWf6L0tmF4UuZ2rK80v6G7rZRjY8uzC4vNGw6j230/MCN?= =?us-ascii?Q?zhZ6r1ceV/IeKsvtL701RMLxt5lKU6hVwR6wEGMSn5hZCXtB7WpQY0DBgpBd?= =?us-ascii?Q?YSBZzUf2+GUv9GUzWAIqvDu4GhIR0NqVRzzxDj2Y2YidL5a897YqFjiBUt9S?= =?us-ascii?Q?ZsE0/w5eLVEJxZRJY3WHeX8rTGdsQuB/zIcW2xjQcdm84u+D5E1eLIJIrF/x?= =?us-ascii?Q?MFf1tqYy+ZkMmS2sVuGRFEL/FDIgTzwwKWv88uQq86GOVxt5uISNJPSa2Wvw?= =?us-ascii?Q?vBqTlVpbeYvBnJ1+BLr8bwEHQUXHnQ43I24g1MrIkRemk2eYzndK2XbGpKbd?= =?us-ascii?Q?Bg3mzIDPONmpXSEinQD6yS/MkO3js4T9Dch9xXtTSSVCuoc2v8pCx13DFpn2?= =?us-ascii?Q?pXah+XvoGeVfBbehjDZNO9svpyS3Azp0045Z32XdvFC1ObLTpu/3O7NW3Tg4?= =?us-ascii?Q?0MynhzAcZosyC52wQWFw8dayqtth15kHyHCuv5Q3FxZ6smPeTifwa2Yg1jJG?= =?us-ascii?Q?uN/esgxq2b0XBQke9xv4k2IQDuLQYIIjpXLxQxSSna5ZDRPKC19taAHF5J3D?= =?us-ascii?Q?CoKp+xDUXTLk4olV7OL+Bommt95CKIFQN/YRER/wIXR5HOTTyqWtxETPYCw3?= =?us-ascii?Q?aJEXtM2aGtSN6yzkH0Pqbu1A6lNfrvYM3lBjeyJZnrxx1ojebHwx2+6AutIu?= =?us-ascii?Q?nt1eWsrPTX8BJKAcgDy93xBmijs06SAZiNDDoWeVWx+gZ1ieE7M7LQeA/WCe?= =?us-ascii?Q?tIvG0tSMX5cqoeSBufj6FS77aHPu3dAuhp3yC6aJJWFOmbL5ExfVoDvCTGD7?= =?us-ascii?Q?aVYGqWpriJg6gepbqpqbnoWG64ZKrdufpT9VXyVuS1MNIYiy7nCjbntyeVTE?= =?us-ascii?Q?yUddBFx21Dv1dZ5EgXITWAJ12gK1Ssn87Me8CfCVQg8kcBG2R+X1EXh0oT5L?= =?us-ascii?Q?7gbhs+u9z7P0qnY7k+NA+zL9nPseixP7QdQ04KA+hHIjnQvnTx6h8e5+n2iu?= =?us-ascii?Q?jRk/Vw/5BFrkpBTiMiwtT0hG/4KL5HuPQRvO6EYNrx00+/Rgt/A6Bzunko+e?= =?us-ascii?Q?P/IpdZA3hkFA6V2CEEGVUGQfiGrO3mmtw7fjoIQ42CpGG2apNq7+LX0U4mhP?= =?us-ascii?Q?K4OoFUEd1fZdKP5vMH04cFRD7gAYUR2xwQ/diuzyTkLzG0BBjFAS4nklSV0o?= =?us-ascii?Q?tug9cX9wm3heE2qFKPcEoVez/+uYHN0zRCmbQYq3oR6StaVS7FSaOR2E0UsB?= =?us-ascii?Q?AkhMaJQZYE6yTiJ7OjEaCIqI5ywR77G7Q713WsslsQ+3kJsJSDCITdkXDjge?= =?us-ascii?Q?ePjLLMGwpsZjG4s9Fy9jjxqkgNqJUOvgZCpPDqfbFvljR4osUBMRGGJ0ipyC?= =?us-ascii?Q?NffSsNAv0RcIxrzRdJucWpILGTx9mU26VpndJRyj086wTj4FEmJkaNP+8Rsx?= =?us-ascii?Q?fmv0GXiZe6KT8MzV7Ojr3egcolDwfnmhYLzRs1ywhf8PQw1NrkPp/VRQNm7i?= =?us-ascii?Q?NLR2FBkI8Qkm7rPPzv39ZuCO4QoK1BX03Abpr1brpx0fLEzLHN1ddEDFzzbq?= =?us-ascii?Q?aS7TroohzEiCAS3VA+/iTQjY4Ea6zUeqWCH4U/f2sjXvNCIavp1WC4pNvESm?= =?us-ascii?Q?x3mLiRygjtOnE/eKNw52NUmMZTg+/FkLAyIKEHiYerPPQzpvHutSKJYVsW9Q?= =?us-ascii?Q?SzWWrXSPIfz3UcCqSa3K6TfyIE49V4LmHxs7d2tt8u55nT0KR1NPMsR9mfBV?= =?us-ascii?Q?3Bt0Q2405paS6tlTRYdUxayu15Kj1nM=3D?= X-Exchange-RoutingPolicyChecked: hVH4fxWrW3sO1dilVzzGpNPyr4iP/NrHcB5kbOECKgwKfxI9hfUF2D5dLh1/on/CFHHSLcYGUeehG2HSjr++nYiAfopxXC5KsvJqbAULL/os/VAkDwGalJWTFfMU//5h5Cw0q5VODz96lACmTzw4nAO1aOeL49nrW9vb3Yu3c15qvTDl7mkM8OjSZhnhl5MH2ScpTkpQxnoc3Gn6ma1eCLtUcfn0n2UjbSHmzE1DHmqqiDxzpPbPLDBCSfeS07ttzqq7U0DyPcegN9jO/PnjtmBU4cNhjkzvtSLyoHriZx9u3j7NbvSQQrPPgBNBSJZKGwDo/NPxbRoCmjJ4yOzk3g== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: fcd34ae1-cca7-4c63-5116-08df0cbdf032 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 08:56:42.9606 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UDqOowee6SD6ix9kGFO7cpePZS0xIFqS8/S/wO3ybAS88QrzbVZBS9XdBhMU8o8OXZqAMKw9l5Xm3FdEOlw/e44/1bwajgnHo9AVKk1E1ts= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR02MB11147 X-Proofpoint-GUID: VsbOKJwzHcq2w17FezG_YDfeJmQRKJoQ X-Proofpoint-ORIG-GUID: VsbOKJwzHcq2w17FezG_YDfeJmQRKJoQ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfX/qjd3alElUaA FFPn2s3crkQZXJIV/W93zbJqC7McFjz1Pvg2FY77yErWHPil3HW4tkpJB/7pznuWdxGOYNXQ6tC Hf4LdKaLUEoq8G5mSfKstCyvesdAzJXVoIreDNz+r+3vwSVyFOWvqsghj3j2FkPxxkql0HXwa0K W9LDk2zk5MLy+kkmGJEzE5NXzQxWvLCy3bTFwkQ2R722b7JtjUBSdwg3/eUPY1omTaNLbewIotG vQlGVKehK3vE/7HX/5E4THU2ug7iOvwHYD+Q+ms3jXz5T27ZWgPL/ZAmfYhprWXCdaTs26wa96O 9tvxkoLFjQRl6/RAaXuUlG2gMouAhsZrhGTvY+DwLAi4s6qIT0eZGentkSLBkCKwxT3YSQwinK4 crpnT9W4jd8HSuBnCxHLhraAIZ6rkj8DL/Pttoy26f/fIqluTQAqhKL/v8MsX6yZFpD+EXmhEcS htiAFFD6IAkZZDAxf0A== X-Authority-Analysis: v=2.4 cv=PoKjqQM3 c=1 sm=1 tr=0 ts=6a9e7c4c cx=c_pps a=bqsrm7XTco20ezpTcXdHqQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=VdqzKS8jKosA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=Ap8k9tRZuQ82DLYWQqG7:22 a=64Cc0HZtAAAA:8 a=_pYXvBbxKs0koP2ivk0A:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfXzYzMpzSPOwam pLEGDy3XBWiqBV6+WvCcuFl8FTU3w62R5no7sTvEGriVMRUZnxd+hzYcujckfzXbh6p9IXk0cq4 RHMTKSoFxwGM+0ZpDj9joFCnoeKmKqM= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-07_02,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: MONTMIRZYYMZ4DGOV3VOLY6UJREMPLAX X-Message-ID-Hash: MONTMIRZYYMZ4DGOV3VOLY6UJREMPLAX X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1788772070196158500 Content-Type: text/plain; charset="utf-8" Libvirt by default attempt to use the TLS-PSK-enabled VM migration, if the both source and destination support the tls-creds-psk object. The source host adds the pre-shared key in the migration cookie if the source supports the tls-creds-psk object. Upon parsing the migration cookie, the destination host checks for the same capability and informs the source host whether to use TLS X.509 or TLS PSK during VM migration via the migration cookie. For a migration session, Libvirt generates a random key of the specified length, and then stores the content, "qemu:", at /$ID-$VMNAME/keys.psk on the source host. This is because QEMU's tls-creds-psk object does not accept a raw key string as a parameter, it only accepts a dir argument pointing to a directory from which it can read the key file. Subsequently, it sends the key to destination by embedding it within the migration cookie. The destination's Libvirt extracts the key from the migration cookie. Upon migration completion or any failure, both source and destination Libvirt must delete the directory containing the session's keys.psk. Signed-off-by: Abhisek Panda --- src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_conf.c | 4 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 6 ++ src/qemu/qemu_migration.c | 98 +++++++++++++++++++ src/qemu/qemu_migration.h | 3 + src/qemu/qemu_migration_cookie.c | 79 ++++++++++++++- src/qemu/qemu_migration_cookie.h | 5 + src/qemu/qemu_process.c | 3 + .../caps_10.0.0_aarch64.xml | 1 + .../caps_10.0.0_ppc64.xml | 1 + .../caps_10.0.0_s390x.xml | 1 + .../caps_10.0.0_x86_64+amdsev.xml | 1 + .../caps_10.0.0_x86_64.xml | 1 + .../caps_10.1.0_s390x.xml | 1 + .../caps_10.1.0_x86_64+inteltdx.xml | 1 + .../caps_10.1.0_x86_64.xml | 1 + .../caps_10.2.0_aarch64.xml | 1 + .../caps_10.2.0_x86_64+mshv.xml | 1 + .../caps_10.2.0_x86_64.xml | 1 + .../caps_11.0.0_aarch64.xml | 1 + .../caps_11.0.0_s390x.xml | 1 + .../caps_11.0.0_x86_64+sgx.xml | 1 + .../caps_11.0.0_x86_64.xml | 1 + .../caps_11.1.0_aarch64.xml | 1 + .../caps_11.1.0_s390x.xml | 1 + .../caps_11.1.0_x86_64.xml | 1 + tests/qemucapabilitiesdata/caps_7.2.0_ppc.xml | 1 + .../caps_7.2.0_x86_64+hvf.xml | 1 + .../caps_7.2.0_x86_64.xml | 1 + .../caps_8.0.0_x86_64.xml | 1 + .../qemucapabilitiesdata/caps_8.1.0_s390x.xml | 1 + .../caps_8.1.0_x86_64.xml | 1 + .../caps_8.2.0_aarch64.xml | 1 + .../caps_8.2.0_armv7l.xml | 1 + .../caps_8.2.0_loongarch64.xml | 1 + .../qemucapabilitiesdata/caps_8.2.0_s390x.xml | 1 + .../caps_8.2.0_x86_64.xml | 1 + .../qemucapabilitiesdata/caps_9.0.0_sparc.xml | 1 + .../caps_9.0.0_x86_64.xml | 1 + .../caps_9.1.0_riscv64.xml | 1 + .../qemucapabilitiesdata/caps_9.1.0_s390x.xml | 1 + .../caps_9.1.0_x86_64.xml | 1 + .../caps_9.2.0_aarch64+hvf.xml | 1 + .../qemucapabilitiesdata/caps_9.2.0_s390x.xml | 1 + .../caps_9.2.0_x86_64+amdsev.xml | 1 + .../caps_9.2.0_x86_64.xml | 1 + tests/qemumigrationcookiexmltest.c | 12 ++- 51 files changed, 249 insertions(+), 5 deletions(-) diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c index bc2b0412dc..3db4710dee 100644 --- a/src/qemu/qemu_capabilities.c +++ b/src/qemu/qemu_capabilities.c @@ -776,6 +776,7 @@ VIR_ENUM_IMPL(virQEMUCaps, "arm-smmuv3.cmdqv", /* QEMU_CAPS_ARM_SMMUV3_CMDQV */ "iothread.poll-weight", /* QEMU_CAPS_IOTHREAD_POLL_WEIGHT */ "win-dmp.guest-aware", /* QEMU_CAPS_WIN_DMP_GUEST_AWARE */ + "tls-creds-psk", /* QEMU_CAPS_OBJECT_TLS_CREDS_PSK */ ); =20 =20 @@ -1490,6 +1491,7 @@ struct virQEMUCapsStringFlags virQEMUCapsObjectTypes[= ] =3D { { "uefi-vars-sysbus", QEMU_CAPS_DEVICE_UEFI_VARS }, { "monitor-qmp", QEMU_CAPS_OBJECT_MONITOR_QMP }, { "arm-smmuv3", QEMU_CAPS_DEVICE_ARM_SMMUV3 }, + { "tls-creds-psk", QEMU_CAPS_OBJECT_TLS_CREDS_PSK }, }; =20 =20 diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h index 28303fd8f0..1e432cdc41 100644 --- a/src/qemu/qemu_capabilities.h +++ b/src/qemu/qemu_capabilities.h @@ -750,6 +750,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for = syntax-check */ QEMU_CAPS_ARM_SMMUV3_CMDQV, /* arm-smmuv3.cmdqv */ QEMU_CAPS_IOTHREAD_POLL_WEIGHT, /* -object iothread.poll-weight */ QEMU_CAPS_WIN_DMP_GUEST_AWARE, /* 'win-dmp' is offered only to a guest= that can use it */ + QEMU_CAPS_OBJECT_TLS_CREDS_PSK, /* -object tls-creds-psk */ =20 QEMU_CAPS_LAST /* this must always be the last item */ } virQEMUCapsFlags; diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index cca7776b80..f5c5437c89 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -168,6 +168,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->cacheDir =3D g_strdup_printf("%s/cache/qemu", root); cfg->libDir =3D g_strdup_printf("%s/lib/qemu", root); cfg->swtpmStorageDir =3D g_strdup_printf("%s/lib/swtpm", root); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/run/psk", root); =20 cfg->saveDir =3D g_strdup_printf("%s/save", cfg->libDir); cfg->snapshotDir =3D g_strdup_printf("%s/snapshot", cfg->libDir); @@ -187,6 +188,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->stateDir =3D g_strdup_printf("%s/libvirt/qemu", RUNSTATEDIR); cfg->swtpmStateDir =3D g_strdup_printf("%s/swtpm", cfg->stateDir); cfg->channelTargetDir =3D g_strdup_printf("%s/channel", cfg->state= Dir); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/psk", cfg->stateDir); =20 cfg->cacheDir =3D g_strdup_printf("%s/cache/libvirt/qemu", LOCALST= ATEDIR); =20 @@ -214,6 +216,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->stateDir =3D g_strdup_printf("%s/qemu/run", rundir); cfg->swtpmStateDir =3D g_strdup_printf("%s/swtpm", cfg->stateDir); cfg->channelTargetDir =3D g_strdup_printf("%s/channel", cfg->state= Dir); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/psk", cfg->stateDir); =20 cfg->configBaseDir =3D virGetUserConfigDirectory(); =20 @@ -375,6 +378,7 @@ static void virQEMUDriverConfigDispose(void *obj) g_free(cfg->dbusStateDir); g_free(cfg->rdpStateDir); g_free(cfg->vncStateDir); + g_free(cfg->tlsPSKStateDir); =20 g_free(cfg->libDir); g_free(cfg->cacheDir); diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index b700829342..2db3440514 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -113,6 +113,7 @@ struct _virQEMUDriverConfig { char *dbusStateDir; char *rdpStateDir; char *vncStateDir; + char *tlsPSKStateDir; /* These two directories are ones QEMU processes use (so must match * the QEMU user/group */ char *libDir; diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index a4e5f92840..f4d470553d 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -1990,6 +1990,7 @@ qemuDomainObjPrivateFree(void *data) virObjectUnref(priv->monConfig); g_free(priv->lockState); g_free(priv->origname); + g_free(priv->migTLSPSK); =20 virChrdevFree(priv->devs); =20 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 23e99dc68c..053140f7ec 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -139,6 +139,7 @@ struct _qemuDomainObjPrivate { char *origname; int nbdPort; /* Port used for migration with NBD */ unsigned short migrationPort; + char *migTLSPSK; /* Hex-encoded pre-shared key for TLS-PSK-enabled VM = migration session */ unsigned short backupNBDPort; int preMigrationState; unsigned long long preMigrationMemlock; /* Original RLIMIT_MEMLOCK in = case diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 8498568623..5548d6f7bd 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -664,6 +664,12 @@ qemuStateInitialize(bool privileged, cfg->vncStateDir); goto error; } + if (virDirCreate(cfg->tlsPSKStateDir, 0700, cfg->user, cfg->group, + VIR_DIR_CREATE_ALLOW_EXIST) < 0) { + virReportSystemError(errno, _("Failed to create TLS PSK state dir = %1$s"), + cfg->tlsPSKStateDir); + goto error; + } =20 qemu_driver->inhibitor =3D virInhibitorNew( VIR_INHIBITOR_WHAT_SHUTDOWN, diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 4a43ab83b0..b9971286fd 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -59,6 +59,7 @@ #include "virprocess.h" #include "virdomainsnapshotobjlist.h" #include "virutil.h" +#include "virsecureerase.h" =20 #define VIR_FROM_THIS VIR_FROM_QEMU =20 @@ -1503,6 +1504,89 @@ qemuMigrationSrcIsAllowedHostdev(const virDomainDef = *def) } =20 =20 +void +qemuMigrationDeletePSKDir(virQEMUDriver *driver, virDomainObj *vm) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + qemuDomainObjPrivate *priv =3D vm->privateData; + g_autofree char *dir_path =3D NULL; + g_autofree char *shortName =3D NULL; + + if (priv->migTLSPSK) { + virSecureEraseString(priv->migTLSPSK); + g_clear_pointer(&priv->migTLSPSK, g_free); + } + + if (!(shortName =3D virDomainDefGetShortName(vm->def))) + return; + + dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName); + + if (virFileIsDir(dir_path) && + virFileDeleteTree(dir_path) < 0) + VIR_WARN("Failed to delete the directory %s containing the pre-sha= red keys for migration of domain %s", + dir_path, vm->def->name); +} + + +static int +qemuPersistTLSPSKHelper(int pskFD, + const char *pskPath, + const void *opaque) +{ + const char *key =3D opaque; + + if (safewrite(pskFD, "qemu:", 5) < 0 || + safewrite(pskFD, key, strlen(key)) < 0) { + virReportSystemError(errno, + _("Unable to write the pre-shared key to file= '%1$s'"), + pskPath); + return -1; + } + + return 0; +} + + +static int +qemuMigrationPersistPSK(virQEMUDriver *driver, virDomainObj *vm, const cha= r *tlsPSK) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + g_autofree char *dir_path =3D NULL; + g_autofree char *key_path =3D NULL; + g_autofree char *shortName =3D NULL; + + if (!(shortName =3D virDomainDefGetShortName(vm->def))) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not get the shortened domain name for doma= in: %1$s"), + vm->def->name); + return -1; + } + + dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName); + key_path =3D g_strdup_printf("%s/keys.psk", dir_path); + + if (virDirCreate(dir_path, 0700, cfg->user, cfg->group, + VIR_DIR_CREATE_ALLOW_EXIST) < 0) { + virReportSystemError(errno, + _("Could not create the directory %1$s for st= oring PSKs"), + dir_path); + goto error; + } + + if (virFileRewrite(key_path, S_IRUSR, cfg->user, + cfg->group, qemuPersistTLSPSKHelper, + tlsPSK) < 0) + goto error; + + return 0; + + error: + qemuMigrationDeletePSKDir(driver, vm); + return -1; +} + + static int qemuDomainGetMigrationBlockers(virDomainObj *vm, int asyncJob, @@ -2722,6 +2806,9 @@ qemuMigrationSrcBeginXML(virDomainObj *vm, if (priv->origCPU) cookieFlags |=3D QEMU_MIGRATION_COOKIE_CPU; =20 + if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_TLS_CREDS_PSK)) + cookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + if (!(flags & VIR_MIGRATE_OFFLINE)) cookieFlags |=3D QEMU_MIGRATION_COOKIE_CAPS; =20 @@ -2738,6 +2825,9 @@ qemuMigrationSrcBeginXML(virDomainObj *vm, cookieFlags) < 0) return NULL; =20 + if (mig->tlsPSK && qemuMigrationPersistPSK(driver, vm, mig->tlsPSK) < = 0) + return NULL; + if (xmlin) { g_autoptr(virDomainDef) def =3D NULL; =20 @@ -4232,6 +4322,8 @@ qemuMigrationSrcConfirmPhase(virQEMUDriver *driver, privJob->stats.mig.downtime =3D privMigJob->stats.mig.downtime; } =20 + qemuMigrationDeletePSKDir(driver, vm); + if (flags & VIR_MIGRATE_OFFLINE) return 0; =20 @@ -5274,6 +5366,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver, =20 error: virErrorPreserveLast(&orig_err); + qemuMigrationDeletePSKDir(driver, vm); =20 if (qemuDomainObjIsActive(vm)) { int reason; @@ -7029,6 +7122,8 @@ qemuMigrationDstFinishActive(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_STATS) < 0) VIR_WARN("Unable to encode migration cookie"); =20 + qemuMigrationDeletePSKDir(driver, vm); + qemuMigrationDstComplete(driver, vm, inPostCopy, VIR_ASYNC_JOB_MIGRATION_IN, vm->job); =20 @@ -7039,6 +7134,8 @@ qemuMigrationDstFinishActive(virQEMUDriver *driver, * overwrites it. */ virErrorPreserveLast(&orig_err); =20 + qemuMigrationDeletePSKDir(driver, vm); + if (qemuDomainObjIsActive(vm)) { if (doKill) { qemuProcessStop(vm, VIR_DOMAIN_SHUTOFF_FAILED, @@ -7197,6 +7294,7 @@ qemuMigrationProcessUnattended(virQEMUDriver *driver, else qemuMigrationSrcComplete(driver, vm, job); =20 + qemuMigrationDeletePSKDir(driver, vm); qemuMigrationJobFinish(vm); =20 if (!virDomainObjIsActive(vm)) diff --git a/src/qemu/qemu_migration.h b/src/qemu/qemu_migration.h index 7e9410e1f7..ce15f8024b 100644 --- a/src/qemu/qemu_migration.h +++ b/src/qemu/qemu_migration.h @@ -279,3 +279,6 @@ int qemuMigrationAnyRefreshStatus(virDomainObj *vm, virDomainAsyncJob asyncJob, virDomainJobStatus *status); + +void +qemuMigrationDeletePSKDir(virQEMUDriver *driver, virDomainObj *vm); diff --git a/src/qemu/qemu_migration_cookie.c b/src/qemu/qemu_migration_coo= kie.c index 7311a8294b..0cf1ab9590 100644 --- a/src/qemu/qemu_migration_cookie.c +++ b/src/qemu/qemu_migration_cookie.c @@ -20,6 +20,7 @@ =20 #include #include +#include =20 #include "locking/domain_lock.h" #include "virerror.h" @@ -27,6 +28,7 @@ #include "virnetdevopenvswitch.h" #include "virstring.h" #include "virutil.h" +#include "virsecureerase.h" =20 #include "qemu_domain.h" #include "qemu_migration_cookie.h" @@ -52,6 +54,7 @@ VIR_ENUM_IMPL(qemuMigrationCookieFlag, "allowReboot", "capabilities", "block-dirty-bitmaps", + "psk", ); =20 =20 @@ -165,6 +168,9 @@ qemuMigrationCookieFree(qemuMigrationCookie *mig) g_free(mig->name); g_free(mig->lockState); g_free(mig->lockDriver); + if (mig->tlsPSK) + virSecureEraseString(mig->tlsPSK); + g_free(mig->tlsPSK); g_clear_pointer(&mig->jobData, virDomainJobDataFree); virCPUDefFree(mig->cpu); qemuMigrationCookieCapsFree(mig->caps); @@ -575,6 +581,51 @@ qemuMigrationCookieAddCaps(qemuMigrationCookie *mig, } =20 =20 +static int +qemuMigrationCookieAddTLSPSK(qemuMigrationCookie *mig, + virQEMUDriver *driver, + virDomainObj *vm) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + qemuDomainObjPrivate *priv =3D vm->privateData; + gnutls_datum_t psk_key =3D {NULL, 0}; + g_autofree char *key =3D NULL; + size_t key_len; + int ret; + + /* Generate the pre-shared key exactly once for a migration session*/ + if (priv->migTLSPSK) { + mig->tlsPSK =3D g_strdup(priv->migTLSPSK); + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + return 0; + } + + ret =3D gnutls_key_generate(&psk_key, cfg->migrateTLSPSKLength); + if (ret < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Generation of a pre-shared key failed")); + return -1; + } + key_len =3D (psk_key.size*2) + 1; + key =3D g_new0(char, key_len); + + ret =3D gnutls_hex_encode(&psk_key, key, &key_len); + if (ret < 0) { + gnutls_free(psk_key.data); + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Hex encoding of a PSK key failed")); + return -1; + } + + priv->migTLSPSK =3D g_strdup(key); + mig->tlsPSK =3D g_steal_pointer(&key); + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + + gnutls_free(psk_key.data); + return 0; +} + + static void qemuMigrationCookieGraphicsXMLFormat(virBuffer *buf, qemuMigrationCookieGraphics *grap) @@ -890,6 +941,9 @@ qemuMigrationCookieXMLFormat(virQEMUDriver *driver, if (mig->flags & QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS) qemuMigrationCookieBlockDirtyBitmapsFormat(buf, mig->blockDirtyBit= maps); =20 + if ((mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) && mig->tlsPSK) + virBufferAsprintf(buf, "%s\n", mig-= >tlsPSK); + virBufferAdjustIndent(buf, -2); virBufferAddLit(buf, "\n"); return 0; @@ -1396,6 +1450,12 @@ qemuMigrationCookieXMLParse(qemuMigrationCookie *mig, qemuMigrationCookieBlockDirtyBitmapsParse(ctxt, mig) < 0) return -1; =20 + if (flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + mig->tlsPSK =3D virXPathString("string(./migration-key[1])", ctxt); + if (mig->tlsPSK) + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + } + return 0; } =20 @@ -1471,14 +1531,29 @@ qemuMigrationCookieFormat(qemuMigrationCookie *mig, qemuMigrationCookieAddCaps(mig, dom, party) < 0) return -1; =20 + if (flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + switch (party) { + case QEMU_MIGRATION_SOURCE: + if (qemuMigrationCookieAddTLSPSK(mig, driver, dom) < 0) + return -1; + break; + case QEMU_MIGRATION_DESTINATION: + if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_TLS_CREDS= _PSK)) { + if (mig->tlsPSK) + virSecureEraseString(mig->tlsPSK); + mig->flags &=3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; + g_clear_pointer(&mig->tlsPSK, g_free); + } + break; + } + } + if (qemuMigrationCookieXMLFormat(driver, priv->qemuCaps, &buf, mig) < = 0) return -1; =20 *cookieoutlen =3D virBufferUse(&buf) + 1; *cookieout =3D virBufferContentAndReset(&buf); =20 - VIR_DEBUG("cookielen=3D%d cookie=3D%s", *cookieoutlen, *cookieout); - return 0; } =20 diff --git a/src/qemu/qemu_migration_cookie.h b/src/qemu/qemu_migration_coo= kie.h index 254372234d..fd3b4c5a56 100644 --- a/src/qemu/qemu_migration_cookie.h +++ b/src/qemu/qemu_migration_cookie.h @@ -35,6 +35,7 @@ typedef enum { QEMU_MIGRATION_COOKIE_FLAG_ALLOW_REBOOT, QEMU_MIGRATION_COOKIE_FLAG_CAPS, QEMU_MIGRATION_COOKIE_FLAG_BLOCK_DIRTY_BITMAPS, + QEMU_MIGRATION_COOKIE_FLAG_TLS_PSK, =20 QEMU_MIGRATION_COOKIE_FLAG_LAST } qemuMigrationCookieFlags; @@ -53,6 +54,7 @@ typedef enum { QEMU_MIGRATION_COOKIE_CPU =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_CPU), QEMU_MIGRATION_COOKIE_CAPS =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_CAPS), QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS =3D (1 << QEMU_MIGRATION_COO= KIE_FLAG_BLOCK_DIRTY_BITMAPS), + QEMU_MIGRATION_COOKIE_TLS_PSK =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_TLS= _PSK), } qemuMigrationCookieFeatures; =20 typedef struct _qemuMigrationCookieGraphics qemuMigrationCookieGraphics; @@ -171,6 +173,9 @@ struct _qemuMigrationCookie { =20 /* If flags & QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS */ GSList *blockDirtyBitmaps; + + /* If flags & QEMU_MIGRATION_COOKIE_TLS_PSK */ + char *tlsPSK; }; =20 =20 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index aaa9046146..15be098c60 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -9413,6 +9413,9 @@ qemuProcessStop(virDomainObj *vm, /* Do this before we delete the tree and remove pidfile. */ qemuProcessKillManagedPRDaemon(vm); =20 + /* PSK files might be left at this point, clean them up */ + qemuMigrationDeletePSKDir(driver, vm); + qemuDomainCleanupRun(driver, vm); =20 qemuExtDevicesStop(driver, vm, !!(flags & VIR_QEMU_PROCESS_STOP_MIGRAT= ED)); diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml b/tests/qem= ucapabilitiesdata/caps_10.0.0_aarch64.xml index 48629e494d..432517e5bd 100644 --- a/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_10.0.0_aarch64.xml @@ -166,6 +166,7 @@ + 10000000 61700285 v10.0.0 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_ppc64.xml b/tests/qemuc= apabilitiesdata/caps_10.0.0_ppc64.xml index 70bf98c404..2d470cbb7c 100644 --- a/tests/qemucapabilitiesdata/caps_10.0.0_ppc64.xml +++ b/tests/qemucapabilitiesdata/caps_10.0.0_ppc64.xml @@ -170,6 +170,7 @@ + 10000000 42900285 v10.0.0 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_s390x.xml b/tests/qemuc= apabilitiesdata/caps_10.0.0_s390x.xml index 25d73b6e1d..7cb465678c 100644 --- a/tests/qemucapabilitiesdata/caps_10.0.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_10.0.0_s390x.xml @@ -137,6 +137,7 @@ + 10000000 39100285 v10.0.0 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml b/tes= ts/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml index 53fd51122c..d35d26ae26 100644 --- a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml +++ b/tests/qemucapabilitiesdata/caps_10.0.0_x86_64+amdsev.xml @@ -212,6 +212,7 @@ + 10000000 43100285 v10.0.0 diff --git a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml b/tests/qemu= capabilitiesdata/caps_10.0.0_x86_64.xml index ad3fe67638..1d9dd1386d 100644 --- a/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_10.0.0_x86_64.xml @@ -212,6 +212,7 @@ + 10000000 43100285 v10.0.0 diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml b/tests/qemuc= apabilitiesdata/caps_10.1.0_s390x.xml index 0d46b3b20e..106edc5b18 100644 --- a/tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_10.1.0_s390x.xml @@ -143,6 +143,7 @@ + 10001000 39100286 v10.1.0 diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml b/t= ests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml index 242215f7a8..75ba6c9535 100644 --- a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml +++ b/tests/qemucapabilitiesdata/caps_10.1.0_x86_64+inteltdx.xml @@ -196,6 +196,7 @@ + 10001000 43100286 v10.1.0 diff --git a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml b/tests/qemu= capabilitiesdata/caps_10.1.0_x86_64.xml index a2faddcced..657de2d18d 100644 --- a/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_10.1.0_x86_64.xml @@ -218,6 +218,7 @@ + 10001000 43100286 v10.1.0 diff --git a/tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml b/tests/qem= ucapabilitiesdata/caps_10.2.0_aarch64.xml index 3bbba5ddb1..2967d4dbc5 100644 --- a/tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_10.2.0_aarch64.xml @@ -187,6 +187,7 @@ + 10002000 61700287 v10.2.0 diff --git a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml b/tests= /qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml index 530c0366ea..1ca902042e 100644 --- a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml +++ b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64+mshv.xml @@ -206,6 +206,7 @@ + 10002000 43100287 v10.2.0 diff --git a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml b/tests/qemu= capabilitiesdata/caps_10.2.0_x86_64.xml index b2cd261b99..fe0900ad97 100644 --- a/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_10.2.0_x86_64.xml @@ -219,6 +219,7 @@ + 10002000 43100287 v10.2.0 diff --git a/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml b/tests/qem= ucapabilitiesdata/caps_11.0.0_aarch64.xml index d77884f401..a6d005b28c 100644 --- a/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_11.0.0_aarch64.xml @@ -190,6 +190,7 @@ + 11000000 61700286 v11.0.0 diff --git a/tests/qemucapabilitiesdata/caps_11.0.0_s390x.xml b/tests/qemuc= apabilitiesdata/caps_11.0.0_s390x.xml index 07ee859318..3ae8335f5e 100644 --- a/tests/qemucapabilitiesdata/caps_11.0.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_11.0.0_s390x.xml @@ -146,6 +146,7 @@ + 11000000 39100286 v11.0.0 diff --git a/tests/qemucapabilitiesdata/caps_11.0.0_x86_64+sgx.xml b/tests/= qemucapabilitiesdata/caps_11.0.0_x86_64+sgx.xml index 108f4b0b86..17c7ee8032 100644 --- a/tests/qemucapabilitiesdata/caps_11.0.0_x86_64+sgx.xml +++ b/tests/qemucapabilitiesdata/caps_11.0.0_x86_64+sgx.xml @@ -222,6 +222,7 @@ + 11000000 43100286 v11.0.0 diff --git a/tests/qemucapabilitiesdata/caps_11.0.0_x86_64.xml b/tests/qemu= capabilitiesdata/caps_11.0.0_x86_64.xml index 29fdaf20d8..c231e8a44f 100644 --- a/tests/qemucapabilitiesdata/caps_11.0.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_11.0.0_x86_64.xml @@ -221,6 +221,7 @@ + 11000000 43100286 v11.0.0 diff --git a/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml b/tests/qem= ucapabilitiesdata/caps_11.1.0_aarch64.xml index 31d4d2fd26..e2f9ad15bf 100644 --- a/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_11.1.0_aarch64.xml @@ -194,6 +194,7 @@ + 11001000 61700287 v11.1.0 diff --git a/tests/qemucapabilitiesdata/caps_11.1.0_s390x.xml b/tests/qemuc= apabilitiesdata/caps_11.1.0_s390x.xml index aae4dd0b80..3bc5c3670e 100644 --- a/tests/qemucapabilitiesdata/caps_11.1.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_11.1.0_s390x.xml @@ -149,6 +149,7 @@ + 11001000 39100287 v11.1.0 diff --git a/tests/qemucapabilitiesdata/caps_11.1.0_x86_64.xml b/tests/qemu= capabilitiesdata/caps_11.1.0_x86_64.xml index 05e6749a17..81b8c32317 100644 --- a/tests/qemucapabilitiesdata/caps_11.1.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_11.1.0_x86_64.xml @@ -224,6 +224,7 @@ + 11001000 43100287 v11.1.0 diff --git a/tests/qemucapabilitiesdata/caps_7.2.0_ppc.xml b/tests/qemucapa= bilitiesdata/caps_7.2.0_ppc.xml index bf67b3d295..ab8eea349d 100644 --- a/tests/qemucapabilitiesdata/caps_7.2.0_ppc.xml +++ b/tests/qemucapabilitiesdata/caps_7.2.0_ppc.xml @@ -146,6 +146,7 @@ + 7002000 0 qemu-7.2.0-6.fc37 diff --git a/tests/qemucapabilitiesdata/caps_7.2.0_x86_64+hvf.xml b/tests/q= emucapabilitiesdata/caps_7.2.0_x86_64+hvf.xml index f40d77baa5..1a7ee73a37 100644 --- a/tests/qemucapabilitiesdata/caps_7.2.0_x86_64+hvf.xml +++ b/tests/qemucapabilitiesdata/caps_7.2.0_x86_64+hvf.xml @@ -192,6 +192,7 @@ + 7002000 43100245 v7.2.0 diff --git a/tests/qemucapabilitiesdata/caps_7.2.0_x86_64.xml b/tests/qemuc= apabilitiesdata/caps_7.2.0_x86_64.xml index 8d44ed71e0..0f6bdd871b 100644 --- a/tests/qemucapabilitiesdata/caps_7.2.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_7.2.0_x86_64.xml @@ -192,6 +192,7 @@ + 7002000 43100245 v7.2.0 diff --git a/tests/qemucapabilitiesdata/caps_8.0.0_x86_64.xml b/tests/qemuc= apabilitiesdata/caps_8.0.0_x86_64.xml index fcbb68e415..906bd87967 100644 --- a/tests/qemucapabilitiesdata/caps_8.0.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_8.0.0_x86_64.xml @@ -195,6 +195,7 @@ + 8000000 43100244 v8.0.0 diff --git a/tests/qemucapabilitiesdata/caps_8.1.0_s390x.xml b/tests/qemuca= pabilitiesdata/caps_8.1.0_s390x.xml index 65f73d1af8..00f6087c30 100644 --- a/tests/qemucapabilitiesdata/caps_8.1.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_8.1.0_s390x.xml @@ -111,6 +111,7 @@ + 8001000 39100245 v8.1.0 diff --git a/tests/qemucapabilitiesdata/caps_8.1.0_x86_64.xml b/tests/qemuc= apabilitiesdata/caps_8.1.0_x86_64.xml index c730dd7174..7fac76e8ca 100644 --- a/tests/qemucapabilitiesdata/caps_8.1.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_8.1.0_x86_64.xml @@ -198,6 +198,7 @@ + 8001000 43100245 v8.1.0 diff --git a/tests/qemucapabilitiesdata/caps_8.2.0_aarch64.xml b/tests/qemu= capabilitiesdata/caps_8.2.0_aarch64.xml index 1f0f68092d..2d87411187 100644 --- a/tests/qemucapabilitiesdata/caps_8.2.0_aarch64.xml +++ b/tests/qemucapabilitiesdata/caps_8.2.0_aarch64.xml @@ -161,6 +161,7 @@ + 8002000 61700246 v8.2.0 diff --git a/tests/qemucapabilitiesdata/caps_8.2.0_armv7l.xml b/tests/qemuc= apabilitiesdata/caps_8.2.0_armv7l.xml index 254ec27545..bdefd4e8ec 100644 --- a/tests/qemucapabilitiesdata/caps_8.2.0_armv7l.xml +++ b/tests/qemucapabilitiesdata/caps_8.2.0_armv7l.xml @@ -168,6 +168,7 @@ + 8002000 0 qemu-8.2.0-7.fc39 diff --git a/tests/qemucapabilitiesdata/caps_8.2.0_loongarch64.xml b/tests/= qemucapabilitiesdata/caps_8.2.0_loongarch64.xml index 95eb2dfa21..aac15bba50 100644 --- a/tests/qemucapabilitiesdata/caps_8.2.0_loongarch64.xml +++ b/tests/qemucapabilitiesdata/caps_8.2.0_loongarch64.xml @@ -150,6 +150,7 @@ + 8002000 106300246 v8.2.0 diff --git a/tests/qemucapabilitiesdata/caps_8.2.0_s390x.xml b/tests/qemuca= pabilitiesdata/caps_8.2.0_s390x.xml index 45ab66ec29..d824393638 100644 --- a/tests/qemucapabilitiesdata/caps_8.2.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_8.2.0_s390x.xml @@ -114,6 +114,7 @@ + 8002000 39100246 v8.2.0 diff --git a/tests/qemucapabilitiesdata/caps_8.2.0_x86_64.xml b/tests/qemuc= apabilitiesdata/caps_8.2.0_x86_64.xml index b46505d24b..4b2a6e673a 100644 --- a/tests/qemucapabilitiesdata/caps_8.2.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_8.2.0_x86_64.xml @@ -201,6 +201,7 @@ + 8002000 43100246 v8.2.0 diff --git a/tests/qemucapabilitiesdata/caps_9.0.0_sparc.xml b/tests/qemuca= pabilitiesdata/caps_9.0.0_sparc.xml index 44ddfb0f76..4e18fc98aa 100644 --- a/tests/qemucapabilitiesdata/caps_9.0.0_sparc.xml +++ b/tests/qemucapabilitiesdata/caps_9.0.0_sparc.xml @@ -68,6 +68,7 @@ + 9000000 0 qemu-9.0.0-1.fc40 diff --git a/tests/qemucapabilitiesdata/caps_9.0.0_x86_64.xml b/tests/qemuc= apabilitiesdata/caps_9.0.0_x86_64.xml index 2f361bd1c8..e9e2903fef 100644 --- a/tests/qemucapabilitiesdata/caps_9.0.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_9.0.0_x86_64.xml @@ -205,6 +205,7 @@ + 9000000 43100245 v9.0.0 diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.xml b/tests/qemu= capabilitiesdata/caps_9.1.0_riscv64.xml index f04b2fd302..7c161c34de 100644 --- a/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.xml +++ b/tests/qemucapabilitiesdata/caps_9.1.0_riscv64.xml @@ -162,6 +162,7 @@ + 9001000 0 v9.1.0 diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml b/tests/qemuca= pabilitiesdata/caps_9.1.0_s390x.xml index 990fe255f6..dfef1fd20e 100644 --- a/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_9.1.0_s390x.xml @@ -127,6 +127,7 @@ + 9001000 39100246 v9.1.0 diff --git a/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml b/tests/qemuc= apabilitiesdata/caps_9.1.0_x86_64.xml index 07d7562c84..da4d536fbf 100644 --- a/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_9.1.0_x86_64.xml @@ -205,6 +205,7 @@ + 9001000 43100246 v9.1.0 diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_aarch64+hvf.xml b/tests/= qemucapabilitiesdata/caps_9.2.0_aarch64+hvf.xml index c9e85ff9b3..df8832ab7b 100644 --- a/tests/qemucapabilitiesdata/caps_9.2.0_aarch64+hvf.xml +++ b/tests/qemucapabilitiesdata/caps_9.2.0_aarch64+hvf.xml @@ -136,6 +136,7 @@ + 9002002 61700247 diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml b/tests/qemuca= pabilitiesdata/caps_9.2.0_s390x.xml index a8f830076e..9474236875 100644 --- a/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml +++ b/tests/qemucapabilitiesdata/caps_9.2.0_s390x.xml @@ -130,6 +130,7 @@ + 9002000 39100247 v9.2.0 diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.xml b/test= s/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.xml index f67222578d..999d86035b 100644 --- a/tests/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.xml +++ b/tests/qemucapabilitiesdata/caps_9.2.0_x86_64+amdsev.xml @@ -209,6 +209,7 @@ + 9002000 43100247 v9.2.0 diff --git a/tests/qemucapabilitiesdata/caps_9.2.0_x86_64.xml b/tests/qemuc= apabilitiesdata/caps_9.2.0_x86_64.xml index efd3eeb9c7..1f1b67be74 100644 --- a/tests/qemucapabilitiesdata/caps_9.2.0_x86_64.xml +++ b/tests/qemucapabilitiesdata/caps_9.2.0_x86_64.xml @@ -207,6 +207,7 @@ + 9002000 43100247 v9.2.0 diff --git a/tests/qemumigrationcookiexmltest.c b/tests/qemumigrationcookie= xmltest.c index bc0f68b8c5..41846b8631 100644 --- a/tests/qemumigrationcookiexmltest.c +++ b/tests/qemumigrationcookiexmltest.c @@ -160,8 +160,12 @@ testQemuMigrationCookieParse(const void *opaque) return -1; } =20 - /* set all flags so that formatter attempts to format everything */ - data->cookie->flags =3D ~0; + /* Set all flags except QEMU_MIGRATION_COOKIE_TLS_PSK so that formatter + * attempts to format everything except the migration-key element. Thi= s is + * because the value of the migration-key element is randomly generate= d every time + * the migration cookie is constructed. + */ + data->cookie->flags =3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; =20 if (qemuMigrationCookieXMLFormat(&driver, priv->qemuCaps, @@ -225,10 +229,12 @@ testQemuMigrationCookieDom2XML(const char *namesuffix, * - lockstate: internals are NULL in tests, causes crash * - nbd: monitor not present * - dirty bitmaps: monitor not present + * - tls-psk: a new key is generated every time the migration cook= ie is constructed, so we can't test it */ unsigned int cookiePopulateFlagMask =3D QEMU_MIGRATION_COOKIE_LOCK= STATE | QEMU_MIGRATION_COOKIE_NBD | - QEMU_MIGRATION_COOKIE_BLOCK_= DIRTY_BITMAPS; + QEMU_MIGRATION_COOKIE_BLOCK_= DIRTY_BITMAPS | + QEMU_MIGRATION_COOKIE_TLS_PS= K; data->cookiePopulateFlags =3D ~cookiePopulateFlagMask; } =20 --=20 2.43.7 From nobody Mon Sep 14 04:53:02 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1788771730; cv=pass; d=zohomail.com; s=zohoarc; b=cKIPx2UWrg+A3Y2SydL/jdzD0gRrywBCoKewjPbwg1lRr3Ji3+36DkD3Kvn/kpsqhnQkgJdkiYswzdrN+ggEk1Hc4fMoacnpF8+qlKhLbZvWCsI9DY8dO+8twsm53368Pp1KFvyDGR0XXYlq9akZMdL6CFUoXEU/CC2+/rwMglg= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788771730; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=obpQGhakZ3z/1DEjRFfY3tXNb2GV+REXm1R6kjlMgA4=; b=YNc622op6rUtSSpMdqA621Pcohu8/4/9GOx4tb6KRg9iUfA7pxcvPkb0tiZtpWwiIEhtUgugRfzMUiBWyqBHM4leC3sJZN8geTBOp9qyw4sp8k9ufE4D97Kq0P1VUW++5TYGoDy7V28XrHGTPqB1OXim70qf1dCMoEBIrlbdMs4= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 178877173031543.39545838395077; Mon, 7 Sep 2026 02:02:10 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 2CFD23F28B; Mon, 7 Sep 2026 05:02:09 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 1DD333F28B for ; Mon, 7 Sep 2026 04:57:24 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 59D7C3F31F; Mon, 7 Sep 2026 04:56:48 -0400 (EDT) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 580123F2F6 for ; Mon, 7 Sep 2026 04:56:47 -0400 (EDT) Received: from pps.filterd (m0127841.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68777xr43514257 for ; Mon, 7 Sep 2026 01:56:46 -0700 Received: from cy3pr05cu001.outbound.protection.outlook.com (mail-westcentralusazon11023108.outbound.protection.outlook.com [40.93.201.108]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4gggm5jptt-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 07 Sep 2026 01:56:46 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SA1PR02MB11147.namprd02.prod.outlook.com (2603:10b6:806:4aa::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Mon, 7 Sep 2026 08:56:45 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%3]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 08:56:45 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=obpQGhakZ3z/1DEjRFfY3tXNb2GV+REXm1R6kjlMg A4=; b=J7b0hQNmqSBe2nP+z9ffeQHaGhZ9Vp6AxZf6zP27GVoQsz3kTizaeq8CV fkDtXmHaQ367pc8wr7gQgd8sVg+Iuqlm31k7tx9yHffTZb697IZoB9MYWULEaap8 Bze0YHXwejipal+Jtkn4n6XOsDOpVit/yJxYhbPaTVSUp53CW+UdmY753UELCMY4 mjL6eklZ8d+rHPDvJmQvtWg+wH4bYjrCwygVDsvLM7kxY5QJ6pu+o9lLFT89pODh 7ucGhNF3lJ7jL3HK6n5HmEV1BMTq4JpfbtijmktKKtBqL3mZ/po1d41Bwr3KnrSz pWNs/zEeTe512MAnsCNVaEGBf1L1A== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=J/OkdgrcazfOPh+bP44Q7cpV4jOEKKXw/HZ/0t5vHWg4eSZQ2QQImPlferHVSkbxIYBfhaBmuP+k1XILH+tGP1Hf+2doaQ4xFT9eNEnAlsxgY29d83k6r7GHh9pLV8lex8W4ODhmG/LiFj1rN6uLHIq828kpdcXv7kEKmNGjU59CbQKDC0021BtO/C+L9hgClXe392LL9dhsD3hs6LqSwHS2q4EROpr6BJnL3MSdhTO6gbnWOw7MJYVnr5LzV5KjXp5FODdNqNGtfQcTEQkWd9YyUh3hjOPg3dbox+9HICgbKhbz23u5kSRUyWzr7GXJMxOxSNiml4KzT8zdi65O6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=obpQGhakZ3z/1DEjRFfY3tXNb2GV+REXm1R6kjlMgA4=; b=qe+/RL1qS6hDF3cq/cYReu7HtoNs4wb+QDhI4uUeHvHJNALAHen/2d6fv2JrgRLvTgxBItyzktiqyzLIokHPYkbgqQhi7/HTUoj5hXwUgF2LJZiKzQ1BQm+VXQeYu0guLTEKtTgWBNsXwYLAKtRb3aCarvoHTIvUMcKhHxHnpaTv9VKB6vpC7Zvg7X1U45CCo9xHk4TTk1ng/xzj4LRgXBV+I55bYni6ugF18nR5o6M7vI9OIvKXRnfmwYEsvIoTZMppjpkfzppPzIvSADSdPMJmcPlW46O1heASu5H3KXNsOL56X9hbaBpdAjkp+BpcMahXBeDt1SsI2FdEPFhH4Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=obpQGhakZ3z/1DEjRFfY3tXNb2GV+REXm1R6kjlMgA4=; b=MjxLLnvIZq8gMnXSMAIXTerzkBeNXcoZBcCW7mJYrrMeAfwOjfw7To2wOP6YybvlPBWDSKIDtp66KYUa88HLu7XfJn8Zz/r0w+OJVe1NXJ40o/5//vnZB6OvyQr1fxpUDGLlxH4LhMBzl2Va0V8eiwhIC4mZFAr6o49qPIiTO+FI/1pis8/xAFmeI8suBiPXM1llezSZ56ZvMVk8Uuuu8cV5Gz/jhbPp4IttBoEaOV7pShX1fuy7Yq73/8+BUPy5Xs73VQv+rDJTwewlDqCYMAOTyPdxXyajDDXzHlkd/F0dl/ObKi03XqG1zlMF1Fzp7g3+XuKjoCANKJgWHFZjLQ== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v4 3/7] qemu: Add support to build the tls-creds-psk object Date: Mon, 7 Sep 2026 08:55:21 +0000 Message-ID: <20260907085628.949946-4-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260907085628.949946-1-abhisek.panda1@nutanix.com> References: <20260907085628.949946-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ0PR05CA0153.namprd05.prod.outlook.com (2603:10b6:a03:339::8) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SA1PR02MB11147:EE_ X-MS-Office365-Filtering-Correlation-Id: 4ca48ab8-e210-4fd6-1dab-08df0cbdf16d x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|10067099003|22082099003|18002099003|6133799003|56012099006; X-Microsoft-Antispam-Message-Info: zJtwgU0/Y5RlbW4haVydOdnNfO+24Fahn3CRQL4nC1OcPIxSTljeycv4pX4nj0s6Gd+GWJu/KkB7+Wh0PHB5n/W1vWivLpteoI0tk7PpxaLEJbxNdjDxVXq3fFG77R0DVkNLIKzLaBm+XlLhv7GfXzqsmseTTKbQ6SQnUlFvUeuHKS+GMTLvQLsqp+IsW51K6RXJ9KHI7O4B336HQf08mulh4MoA8ZJaHxOiTKgIOlHXX1Ewofse4a1wS06b8le9C2JRmvDc0aJu643qGmlQJWjfNlauh0FVauf8WcVRx/Y8Kc4ktkjHON2UHr7q2yQ/+90g8ELHbLKgrDYTGB3f4G5XLFn6GWzB9zQeRskVk0lmUqTX+7Tb52c7OTG1T43S8jML0I/MTlzFV2IcAhzxhx83LaiTMWqA9zABR0OG/TeLr5HBvJL1m9w3JS+gVCROodbqlplOacZqrmX7uby3uDKaKD8mYDE7E/fQKjul/UdLWRw6yt0BQClPif9B7y9zFY6SVRQGgpoJmv7DNrBx9EqygU9x1ctbXBHI5/ida2s+IVzxMn/wLpHL01SRrIe0l9qxqTjvELBGn3aAn0HiADPmjXpD/5IY8F69t15bT8MjN5SiyIFXSy8Vs8KoqGrIP/zbFKgvgtRRF09ZOzb1ndBqsyLyDGQLJIKS0xsYr0k= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(10067099003)(22082099003)(18002099003)(6133799003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Cet4vseo9vPtf76W0+6JKbVsh0DoHOIL3wwM1jN0nDguMKj9fQ069y+76484?= =?us-ascii?Q?cXXyc1/G1abRj9hQ3FkWz2udWTm+mPwQ7thzzFcVwYskLnUzi28T004cuOkq?= =?us-ascii?Q?DS4vwHpEchpABjXgqn+y5bqyys1XrbmH+EpXNkN92PojXvTTbiwSLQYC7nyI?= =?us-ascii?Q?hZ8hpQvbdlCMz/99KQqvUIOFabeNjoJirCvPkrOasgi56WJzq4FoKy6qNwUb?= =?us-ascii?Q?rhCGZe7yebX8aTOYEzNkKiOVwFeElTeQPqerVaTq7JWTCVDz++tWLNqA2AKY?= =?us-ascii?Q?8dyYp65X7y8/UbWPqDvuAezDy/60Dl11+dkj0UUEITo76olkM3Fxu2s1/UW6?= =?us-ascii?Q?EqN9vvJAa/KN/dOAHHoXl6rjIoIA2TW9HUKlHubZfVxHC/jyAwiwOuaeZ1zT?= =?us-ascii?Q?fZcV3NxXf2kmsBa4oEvdBeQlWt6NrqzN3jsJAPMAfWikAtVabrgpbF3mxuNj?= =?us-ascii?Q?nsK5sXT7WEV5g02D29r/L6v9Q6oAtj30aB8tU5U4IH3SIQ2ouCUpkdnfHtTw?= =?us-ascii?Q?Uy4g+tsdNNI6JMPTioTg92Rs6tOILnlLfZ2waSYEAyL3G1SHBrb++aHRWElO?= =?us-ascii?Q?JNoaMKjYJ3oaqxoAvO6Xg1Jgu388LPRtlHBVSXC1eIYcDYvTtG5b6wpBfTk/?= =?us-ascii?Q?ok46WEkBzeSsFDgBNKNzPcCCYMZWdJA4Z4v8lc5/ZAKp01Ej377MbSTwIpF+?= =?us-ascii?Q?8gwofYhc/OEv2KJwSvwD3UcO3Q0IPP7MABhRsAAiuGNckeQovCLVpuevLv8q?= =?us-ascii?Q?29/6+f5fVvESE3bCkCD4n4ojRTuay4LOeAuAMMqWMKMf4KYk7IgG5qoFYJMK?= =?us-ascii?Q?qe2m84suV9Xv3A932mXlYZARLNWRRSrlPaevB8UOWpBH75jl01KeTu40Ow8g?= =?us-ascii?Q?7QHjijVwmSc8J7vLEgy1YkO8OV9XOuewc3qtHZFXC05RrVeEampQfd7eA8jW?= =?us-ascii?Q?RLMDPDPPlponNl2IQi9BSMMnOiy7HzmaC9O+k3+kjlGLmWVSHGnzNtLW8arv?= =?us-ascii?Q?a8kCnKPeRicoUGHMltUhjo36WB7k0VJuhwsdpg6M+sqse6qk09iOywR4+Ha4?= =?us-ascii?Q?LHBskSTybHYqqwIzIVEcwslnicAI2hv+zaQWraTMke2dFolRGamR4rm9xKAR?= =?us-ascii?Q?UZOmuIUxvJKYN+TIcnWBWF4B/wJqJSK4EoLCZ8sHd9VP50rMoArHpawspq7I?= =?us-ascii?Q?cqkGTbuuK0bAi8T2jJUvEIvF0VHFU+q8Sy+WHGa70o/JKUESXNKjHVvzTDJk?= =?us-ascii?Q?3kSzZ9IhI6pGB02ThqmOQ/OPfD+tRwKZ9NRxu7vFwKHiBKi4ADZpKaWK2h3m?= =?us-ascii?Q?0OJvTMyUAChKJbm/mIlu9TWGQmK4m5lgk7s7CDkxczF7J7z8C1wkD503FfqI?= =?us-ascii?Q?7YHGqci+cDOPjFJKDVKM8lNEJJ5hu3PTTN2kymSYNNExChyVa3rmXJ4BqzTY?= =?us-ascii?Q?MNka7wRlOAlzBQScTQxq0Ag5urrQVHSBoDV8WeCQVNJJdAUaN7n6Fo+MUNo8?= =?us-ascii?Q?enXyJERSrQ10kFE+vrNLCNjCoHZntPc+wXG+NZ3LZS0+ma4nMDWzG0uRhhEg?= =?us-ascii?Q?0Vjazyu2a7Ov1f06P+XJWhe6Da4dC2R7gscL/sjoAWLHt2G6Asjwl9lflIJp?= =?us-ascii?Q?J/XRqj4BN+Sm5c/9GdCBYAPvASynRj3u1gVEoXhu38qlIgUkPe8ZQsrI+U7C?= =?us-ascii?Q?5cFm/H+Gn1IfXLpWNqs6P9AzMufNUe12HyFPCRQQrd+7qVPQpVL7EvMZS9v+?= =?us-ascii?Q?wgmQf2LaXAqQNIXM0pJPB7WYGcXHM/g=3D?= X-Exchange-RoutingPolicyChecked: hHP1Ag8hoLLrqqlHiDyG8SXymbtvCcItSBMKvaVF+oHNND4c/FSSL5MWs6m2RXicixa2gVi/DvDcIUx/smt7CDsmyE50JqOWQUh8yoseyYJ0MBlSdUWJOSPZ2t+w0h9jhHnIwJLbButCFclr7T8Gh7z8tCEwpiHC9BWWUFUtw0vir2H5nYO/1SPLb9K05NwR5lMihvCfKzgOqAL99QUvC7Emrl1vazSr0FHrbOHua3xeZwBnxron7io2bxHbwd3yCx061sRhFFq8h1YrqjBXKTR7/F4m81ijXRoirfCA4vKC2Z95mfTH8wXYIhB+mhkxrTtW8n7WU1UL+lfHRvam0Q== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4ca48ab8-e210-4fd6-1dab-08df0cbdf16d X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 08:56:45.1437 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 3UN6zwLk3iC0esyQ8KPGQ+io6+iztKkrzGSwOD88uik0oamJxYSFRuJ/VgTW4rnMjiay/yPudjEaTXMhM4RKsj/o/1tHczKBNr+P4p6eiSk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR02MB11147 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfXxC/w0b4cVxiR uLcs6SkZIpw+BDDhbH4PBnEvIGp1FZupk2sRU2zDHvme0J769FtURySOlzKD9fd7FpvWL3+90DQ 3LR4LCyU0v1FA56dcJSo5aGzaI6Qg9ZqOQBywKncrpCGm1999+B24kc8yzeYrAxUUXVRKwJLec5 HieEppyEKLP9XWW0TkGXn/uUx3g6TZG2+oSTILvhOyEOssK0eZt5PhY1KxFcue6QuwSlyP3G/17 dxpu/hDV7sm0qqoHoldnsL7qFzrJrSftbYjuGEvF67cORde8llrtb4RJB6aUXstVqde0kYZwxx0 I8o93pUrmLvbUh5SO7hfqilqpz4MpR901W+weMD5ZkTkTgv34ru94rVIyjcC+IMvnJZK89ANGbL 3EV9Rjvjd9qBTUVL1xAS8jCPvlCWLix3Zp9g71WgPzhLfMIF6esl+NxFeLAaOdj+ugvfIQgfSKQ +3lwu0hXbTVVLWAfZvQ== X-Authority-Analysis: v=2.4 cv=F41nsKhN c=1 sm=1 tr=0 ts=6a9e7c4e cx=c_pps a=zpEXwJxT+I6ikN8M3JpNfg==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=VdqzKS8jKosA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=jxMXjlTPpCISP5mWtjnE:22 a=64Cc0HZtAAAA:8 a=20KFwNOVAAAA:8 a=-DOnkpEdNJLKZcUuXmsA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfX81VQSTT3KHsw V49ae7jnM4vHm/ih/frJe1x3afJEZXINrWunPlZdMfiTfMmN3K+qWVeZWgWr0wyeeZ8s4/3Isug MAkSICGuT/tPpLJ1Fs7PrW4Fvc4wIL0= X-Proofpoint-ORIG-GUID: 4Tk0fqAkmdSytcTqlQLNeh6kJfdPUHK0 X-Proofpoint-GUID: 4Tk0fqAkmdSytcTqlQLNeh6kJfdPUHK0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-07_02,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: 35LZDSOKPAOPRL5TLB6SOQAMAEBDNW4V X-Message-ID-Hash: 35LZDSOKPAOPRL5TLB6SOQAMAEBDNW4V X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1788771731927158500 Content-Type: text/plain; charset="utf-8" Build the tls-creds-psk object with the following params: id, dir, endpoint. Note: Libvirt generates a keys.psk file for each migration session that only contains the pre-shared key for the "qemu" user. Because QEMU defaults to using "qemu" as the username if the username attribute of the tls-creds-psk object is undefined. We intentionally do not set this attribute. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda Reviewed-by: Peter Krempa --- src/qemu/qemu_command.c | 26 ++++++++++++++++++++++++++ src/qemu/qemu_command.h | 7 +++++++ 2 files changed, 33 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index a07b915f4d..d065dd7350 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1293,6 +1293,32 @@ qemuBuildTLSx509CommandLine(virCommand *cmd, } =20 =20 +/* qemuBuildTLSPSKBackendProps: + * @tlsPSKPath: path to the TLS-PSK credentials file + * @isListen: boolean listen for client or server setting + * @alias: alias for the TLS-PSK object + * @propsret: json properties to return + * + * Create a backend string for the tls-creds-psk object. + * + * Returns 0 on success, -1 on failure with error set. + */ +int +qemuBuildTLSPSKBackendProps(const char *tlsPSKPath, + bool isListen, + const char *alias, + virJSONValue **propsret) +{ + if (qemuMonitorCreateObjectProps(propsret, "tls-creds-psk", alias, + "s:dir", tlsPSKPath, + "s:endpoint", (isListen ? "server": "= client"), + NULL) < 0) + return -1; + + return 0; +} + + static int qemuBuildChardevCommand(virCommand *cmd, const virDomainChrSourceDef *dev, diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index e34172fbff..92ae32d285 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -72,6 +72,13 @@ qemuBuildTLSx509BackendProps(const char *tlspath, const char *secalias, virJSONValue **propsret); =20 +/* Generate the object properties for a tls-creds-psk */ +int +qemuBuildTLSPSKBackendProps(const char *tlsPSKPath, + bool isListen, + const char *alias, + virJSONValue **propsret); + /* Open a UNIX socket for chardev FD passing */ int qemuOpenChrChardevUNIXSocket(const virDomainChrSourceDef *dev); --=20 2.43.7 From nobody Mon Sep 14 04:53:02 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1788772207; cv=pass; d=zohomail.com; s=zohoarc; b=lyhZiGcGlBt0IzMBKtoOVfjUXDW87vQ4vHJkCnSJEd0Dqbc4BsLV3nX3nvvf88M9qxEKJY4uZea7OevSf8X9fN1bqa72KqPTP9ouAyGyaMNqWSBMg2t69P534MA4G7tjS89OhscCefoTQtxrpikdlx2bMLByUqmYFeo1IkrjoKU= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788772207; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=iHnrfG7Agpl0wkHMuZjnKvyNfck2iGrEtK+88/tRqoY=; b=gpkKmEEdymFmdpkwwmrXc/1G7wP/ulksun5s8NuVGeQu4yr8XQWsEO0dPgmg5icS/DfQEEfRkqo5kO5vPoAznfBXcz3L0x2YpLE3Ia9VstytiTv0j0lCf7xa+qPa/qg1jJKsabs5caM6kOTU1WFBivyg5FKd2sTgzKOEiz3D0F0= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1788772207942831.0491250326484; Mon, 7 Sep 2026 02:10:07 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 718493F942; Mon, 7 Sep 2026 05:10:06 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 8483941B48 for ; Mon, 7 Sep 2026 04:57:43 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id F030C3F315; Mon, 7 Sep 2026 04:56:50 -0400 (EDT) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id A67783F2F4 for ; Mon, 7 Sep 2026 04:56:49 -0400 (EDT) Received: from pps.filterd (m0127842.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68777lF81869275 for ; Mon, 7 Sep 2026 01:56:49 -0700 Received: from cy3pr05cu001.outbound.protection.outlook.com (mail-westcentralusazon11023129.outbound.protection.outlook.com [40.93.201.129]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4ggjddam2d-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 07 Sep 2026 01:56:48 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SA1PR02MB11147.namprd02.prod.outlook.com (2603:10b6:806:4aa::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Mon, 7 Sep 2026 08:56:47 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%3]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 08:56:47 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=iHnrfG7Agpl0wkHMuZjnKvyNfck2iGrEtK+88/tRq oY=; b=Yc3a5lDUzToTgFnz8KqiCr+qqwB5RvXi3otKgeuI4lSaFN/6Tz7P/R0Bt x+f2lQ3eEpUrwEC5WQnBQSqv151cjpPIGgPpUWTekqW55C0gOYqn6VV59tI6ty0V glNTcdyx/GIbK0cQylxNyvCfyfVVYEDnKhfguTrjnmtzCx+R4P81lvKFcs88Nltz LFRxbiuC5khKZcYCInuwuftBDQkimvaNFsdLX+A04zh434ZlXIi7D0cDFTlbyDIv jOoB6dl8h2xuJRTo+81qem99NABsAr1H9SYQZguTN3QImGosvmHG7JjITOHMeq14 RS9dFB/UVFM5qpwAJrRtBn52Ep8uA== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=jL8VXNo0o9PpQmgKOF3alSVh66XrXWmcD4TqoeqYfZc36e+Ot4r/pynGTWQKag2I4imSvi/K0bYKwBZtmfjdjP3Iq3J4vUt6QXWrINbIuCiUNcBoaYqPHH9DYOrSmK7cVK2TImc8nB/CEZRAi1GSZqYfoKYLUz+GtursxU50nZfnczTS/hn/eDxRgFPRUwL+34Isri4zMjCPomEue7tzPCMQ/kqaUp3T896CllEdjkOMvL9b/7bjPj2Agj4hD6Y4zd0PFUtu0bNYMVDlf/mxN/6IGVatAN0a65vr4w0G+qwI5iO2DlpGZL0/2esDIvYZ5yenu8kBttWJLSFiuoC6LA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=iHnrfG7Agpl0wkHMuZjnKvyNfck2iGrEtK+88/tRqoY=; b=xcniYUH1oZBFhaVz+h98akx4pMJiWwKySErsceMDap5e1mSzwdk4CB9A3pyeFd4Qa3LmijTJghJTPyCyrWnE/g106w+55Vocm8l9Y3E6UFtXSJZVCLAx3Rr6lmtzwndlyngBeedpnVQAc2uWPw2et9oLnPzLg17/CFateoiG8A8rPS93UMPR9ZCNTRm3S017Z8j4B9ieU/19gaOBFnxz5Ty/bYnImQLoRjgIYN/ZP9ZhPOYYkpQW+T3YD9fif+pqsSNSfS/4hme4aEMgkfZSXsEhGkmYTUmmqbR4JppjGBFzNjzwuj2tMbfSvm0b0YSh9gfyMmWTn23gZUSE7OWnvA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iHnrfG7Agpl0wkHMuZjnKvyNfck2iGrEtK+88/tRqoY=; b=tdcgigqESQ46xNrXzXBoPrUojZXJ0bMPaQyoT+onDKX+VB3XPrQDYBVCiM6GYX9Trd7QNZFDj1wFiSbg6ht4ZLQntrssU+HmVpEEDlKgD/rSZEIZ2tPxLEgnujKlhyGqkbsLOaxx4PRIxIKI9Zdw/DQJUvtYFRt7JZjQi5eWOfJOFpBgFTSi2S9AqnuhG9JGPAa5N43CYTrr1n4/KdqPtq+Khq5zb5NEQh6y3BA7eZqIQe8hVDbyl2YpFdYYh9zxPeAxc9MM5LaGkZBK+U0MwJCPNdPqjKSPwhHOmJOHoB8AyJCUMBuNvqksWpip1X+ZxkLih5WTuLp0YTNuVSsYsA== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v4 4/7] qemu: rename tls-creds-x509 obj related functions Date: Mon, 7 Sep 2026 08:55:22 +0000 Message-ID: <20260907085628.949946-5-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260907085628.949946-1-abhisek.panda1@nutanix.com> References: <20260907085628.949946-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ0PR03CA0078.namprd03.prod.outlook.com (2603:10b6:a03:331::23) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SA1PR02MB11147:EE_ X-MS-Office365-Filtering-Correlation-Id: 9d8a4e82-9376-44a0-e228-08df0cbdf2e9 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|10067099003|3023799007|22082099003|18002099003|6133799003|56012099006; X-Microsoft-Antispam-Message-Info: jcpWEyrCUIjNcH06yF/ojtsb56x6Hr3nwfjGFrrXd4mz3zD48zFw2G6u/RfKrR9ov4m8cX8Tqvesc0dEp1mKWraZzfMn4z+VUppQOnkp/vyumd3d9ZHd6rU4eDUBy74j1jqHB0FvX9wUXYYCzGScQRX2nW3gE9vdhQ/Z2/TKeOc+gc4niBxxIqKdQZybp9XOb/RyQIMO5p88Oc3Gmq0vKvGGyZi2ePIYEiYuemmQQZ4djDvhw5w7PdN+cCk2TBLPYY6UZTN2B4OZ2lVu97NK5EY/SNE2JiJAlWvOzC8gXDSKNPvlKZPGNJ3o+k38UV7GkWT2cX2vVJLi8oLMwmFAQxamZ0OQZnT78HP67hHpDlMMJN0IWzQYK6ryNpIs4WH2AbhH0MsIerqypq4AxfAURmJ/t1ZvIBRVaemP1WiMojjIlcSZNgNMNFv5+dB9JJr36eZI5fUSIaV5efA9kA5Zj2Ka/y/YoFn3ZrDLQE3zs3FwCGdQljuWEDe+xRBn/MzZ7CyaZbCn1C10L5kg6B6V01I9hka/rDfoZ1djHghBZcKpj23oENPiWX2cOX3J9RaWxWHF5gM/FKYKrPxOAwgf7mVR5SS7STOjv5rSlK4dmkXGN26pIcM2yrEeATFT+KIlfxxu4YzCbaUnXk/X+LMtzezKCigrNjSVpCqA7Iwpm1c= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(10067099003)(3023799007)(22082099003)(18002099003)(6133799003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?rJ/ROfUoFernexFpRpPrKsBN4n4mEsb5xVobZnMySh9I95iQkSvu6/tPY/lm?= =?us-ascii?Q?upM3LtevTXHLojMyb1349OD9SBwdbvayKL/npi7ypW6XZjNTXsTsjJt/B+cf?= =?us-ascii?Q?cFRdCwWxP5UKELb8msQeB1mvsy7Ciu3rYfivtMM0dKclLPwZOnDJ0BV+Bhab?= =?us-ascii?Q?Ghj0q3ULJcfp++Q6F8ZyJYl1wOZ4/8xnaSD95nJOIPeTQa3ImrWK9iL40G1U?= =?us-ascii?Q?HMNGSVj3Fl426DV5a65OX73DkjAnxYQ/V3fkXu4AUVmQj/QbqQ3rYIYgUSLc?= =?us-ascii?Q?rv/Ay16U+M4C1KJH5r32s+0QM1hhHkAkBVfQICMIo6Y/X+Hn1Yv8o9XmQodS?= =?us-ascii?Q?0zjYjOnMDwWDqwwRVFj8XEkbYoUQ3CAZEOpgg3Bh/8jufyXhqYmbbGptN66s?= =?us-ascii?Q?9g576vgGbZarvYrVx6+gIE5gSAT6944RLYhE939V14u5ZF9gd//CiOmLNij4?= =?us-ascii?Q?ehW3R9kkO6DhapoV0t8WgEhJDb7HkeYSEGo1PXs2NhmyCv8QFAlhmBN5irif?= =?us-ascii?Q?Nkqs/CzWrB2ov4mV3U5PIiyoiqyl6uBTKWVR8XsVlv89e/Aw4bSgscj9KZhv?= =?us-ascii?Q?nP/68hqmMLG54PNJdc55F+3QoLfIU8qS8IW+BALf9UqiMeDg0WIvdl8BFrpu?= =?us-ascii?Q?HVAn29QgOnC0RZD0xKme5eAGYTcmE1cQx8aHUoUfgfMRNO7wEQ6u7HhG2vqH?= =?us-ascii?Q?3IBoukFbJdopIYQ53XJNFp7XgBHfPip6WiWS0Cjl5VMyhnRODLPYJVL+gyxU?= =?us-ascii?Q?EtbQ5a84FusmOPjjxxhdCl1In8ZpqrCTK80g59HsYKZOOdBd/NOU/dTy4I0+?= =?us-ascii?Q?jYFQzcGbPZCP14eX38j9+N2QF5IDqBRh343QqbmcEUG/e+Q+ZEdLj1fDZEOb?= =?us-ascii?Q?kTEh0lHcM0dZ/Ecp05Bc8uvpU2Z2nHSNgNAITT+FGTqYMyczSnXLmLdNI9XG?= =?us-ascii?Q?U+tBGYKlQEclM/0X3qAKhgx6VjFMF8q0RptJ9JrQ2oNSWCFL/FyP3cqpJJt8?= =?us-ascii?Q?jO9YQgDORL9pOtDoekpvYCxWuqvQ0n1/PF4g5r5xhtkz587l0djH2TsARskP?= =?us-ascii?Q?ey7FCtXo3m0R4AeNi71wVvnvx5NjjaSnY6877i5nkqMl+PxG8qD0Yd8aSKRb?= =?us-ascii?Q?Ajvnre+i4APFurscT7mGRDEk/WcLrAr6mxV/9YewvNo2dMt+WjjWmn/evGJe?= =?us-ascii?Q?VWJGwbOsrLMKtTvfJz57tXdcuseeXI44MH5fqvcNifoKrNjzwy6ZLSgkM3ny?= =?us-ascii?Q?/yB64xB4UgdNkTzW1lizzXftdISF1hTKzuZEmbK9ivP8h7K39HCgLr8u53zR?= =?us-ascii?Q?z0BxSkp9SJ6NHLtq6x6n1aERAGoQbThSkLWtGRuOHK+M6j4qZWQgXI/o46aA?= =?us-ascii?Q?CEWFQRU+HkDtOj7+qFRAjuJVDLGsMmraGDulAhv5gi0j+EauEQsB1+ig0uKQ?= =?us-ascii?Q?KXKlQXbQy+DfvsvCCJz5NC/tFHM92VabHm292RXDzNr0yOxnkTXH7bM8Xgve?= =?us-ascii?Q?1aLqMYnYbDoskwHu8tamSyfLDnBrJ7d1CmMvXLs9NjeraOggnURrn2mhVB4l?= =?us-ascii?Q?OyvogLO0/zzu37T4Wh7DJPkBedqRWUEhfV1ZL/tS6iWzlSai0pVzhx/AY3No?= =?us-ascii?Q?MICVhaI5XTGuPM9BGZ2JdMyeoNILjaKmwQh9DxERLGlh7XUddEQ5XaU5utH5?= =?us-ascii?Q?cHPOs9kB9OXnZFKqzgfAnZ/amNfDKYjXG72V0afmGfYroi6+KjGdwe5tuEhW?= =?us-ascii?Q?WHQM11yhyaIA7eeaOHjXS9lZ8A4Xno0=3D?= X-Exchange-RoutingPolicyChecked: dth4ed2EXOZUxL7jHf0QhvqdA59K19nOddSlxGWXy2p/ZP5LUVz2Gm8IuzpBCd7RD+m8vrFqNxtQQfWpJyaP+O3T0Y9UHChWg6wUk3VqrTe5wZpVKWH5q1XmLTaifUVArIhTWvCl1OsRhtpVoSBPtuhliwx8ngRgNnMYbX7/v8LwE7QJcq9Dt0semjTg+aMTVUsVRKPzrUhQXaEWSgyZcg7Iy7mv1Ow1g5i3TCl+9OnT2Bg+ZaPLe9f0d9KiYL/xR8RPq/C67wwupeVni4PhuTNIa3QPs+WAWnGI+028nq0v+CjMEMyPr/GFrxtR99EEiUlJ4jvWw57k+FV7XiOrDg== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9d8a4e82-9376-44a0-e228-08df0cbdf2e9 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 08:56:47.4846 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: NR8ks/kHUcYtUwtmIpusiQBxxVBFgZbylZb2SCT1fvEWa1MgvJuccBBmUgLuFhJbfo0YnZ4N+teEsK9x+sbCC0jKAiv4w3dfZXK2v7LXscY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR02MB11147 X-Proofpoint-ORIG-GUID: Xx1ARKwUspEbFSs6SUf-wmRvvsvZIgkn X-Authority-Analysis: v=2.4 cv=OdWoyBTY c=1 sm=1 tr=0 ts=6a9e7c50 cx=c_pps a=lqW1RW0eirZACo3QVwxAgA==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=VdqzKS8jKosA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=VUi8bpU7OL1Oj2-RSIOF:22 a=64Cc0HZtAAAA:8 a=20KFwNOVAAAA:8 a=v6biFoHkGfcEids9QrgA:9 X-Proofpoint-GUID: Xx1ARKwUspEbFSs6SUf-wmRvvsvZIgkn X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfX0yb0lSW+ekwU VTMnazrTdMGMHhBM2lq8idBA8keEGoH3rzpZ5DTZO6XzzXbhtFl+8WLSASlwZDUcd1itCFQkR8b njx09RMxbJSuu7YbML+OpP2WuQ/s/7iitRvWaHbzhbGqxJP/zYK15wdZPMA+7MuBAvg20NnTvhb XcxPHj6lZaEuygava3pwa6B98fCANdO2mMqzsAfGOH7LAK8gjObuE7hihtLMPuFVuPRbiCuuJTd uvK+3Y9QI9FOmcwb/w/0DOAIjviFvAWRra0Wj1gs2FdxR0qiNH5UDZwB6Ix3GCLu6VHluXzQMYb njwkyTfHTNSEJnlDlPCFr9KqqKHfEsqcE1CZxBVtZ7Oh0AYWsmGdwxdkDJQGYgI4Nquoeh1p8fA ED62mUFq+qfRghNaZK6bFRNHqMjmsRu0GESVAAX5Xwv3meZR7mZS0tyy7OurZfJgqIKl2+mOERY zpsvKBOh+ujjjolNyUA== X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfX+SMgtl0UIaCe E23FqZtaIHCe0jCoTxBD7rbPdhlJAtREnyWN6cynLCqnrg76TJ/qWgr56g4DQL1x+NRd6g+8Rwn GSZ6ldg+LFRfMeNsaZd9tcrWrcv2V+s= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-07_02,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: VCWJKBYM5YAFDA7WTQUFH5UVIEEQVP6F X-Message-ID-Hash: VCWJKBYM5YAFDA7WTQUFH5UVIEEQVP6F X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1788772209915158500 Content-Type: text/plain; charset="utf-8" Append 'x509' to the function identifiers managing the tls-creds-x509 objects. This defines the functions' scope and prevents naming conflicts with the introduction of functions related to tls-creds-psk in subsequent commits. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda Reviewed-by: Peter Krempa --- src/qemu/qemu_hotplug.c | 40 ++++++++++++++++---------------- src/qemu/qemu_hotplug.h | 24 +++++++++---------- src/qemu/qemu_migration.c | 16 ++++++------- src/qemu/qemu_migration_params.c | 32 ++++++++++++------------- src/qemu/qemu_migration_params.h | 14 +++++------ 5 files changed, 63 insertions(+), 63 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 961885c0e2..5479ab1bce 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1735,10 +1735,10 @@ qemuDomainDelTLSObjects(virDomainObj *vm, =20 =20 int -qemuDomainAddTLSObjects(virDomainObj *vm, - virDomainAsyncJob asyncJob, - virJSONValue **secProps, - virJSONValue **tlsProps) +qemuDomainAddTLSx509Objects(virDomainObj *vm, + virDomainAsyncJob asyncJob, + virJSONValue **secProps, + virJSONValue **tlsProps) { qemuDomainObjPrivate *priv =3D vm->privateData; virErrorPtr orig_err; @@ -1772,14 +1772,14 @@ qemuDomainAddTLSObjects(virDomainObj *vm, =20 =20 int -qemuDomainGetTLSObjects(qemuDomainSecretInfo *secinfo, - const char *tlsCertdir, - bool tlsListen, - bool tlsVerify, - const char *tlsPriority, - const char *alias, - virJSONValue **tlsProps, - virJSONValue **secProps) +qemuDomainGetTLSx509Objects(qemuDomainSecretInfo *secinfo, + const char *tlsCertdir, + bool tlsListen, + bool tlsVerify, + const char *tlsPriority, + const char *alias, + virJSONValue **tlsProps, + virJSONValue **secProps) { const char *secAlias =3D NULL; =20 @@ -1830,18 +1830,18 @@ qemuDomainAddChardevTLSObjects(virQEMUDriver *drive= r, if (!(*tlsAlias =3D qemuAliasTLSObjFromSrcAlias(charAlias))) return -1; =20 - if (qemuDomainGetTLSObjects(secinfo, - cfg->chardevTLSx509certdir, - dev->data.tcp.listen, - cfg->chardevTLSx509verify, - cfg->chardevTLSpriority, - *tlsAlias, &tlsProps, &secProps) < 0) + if (qemuDomainGetTLSx509Objects(secinfo, + cfg->chardevTLSx509certdir, + dev->data.tcp.listen, + cfg->chardevTLSx509verify, + cfg->chardevTLSpriority, + *tlsAlias, &tlsProps, &secProps) < 0) return -1; =20 dev->data.tcp.tlscreds =3D true; =20 - if (qemuDomainAddTLSObjects(vm, VIR_ASYNC_JOB_NONE, - &secProps, &tlsProps) < 0) + if (qemuDomainAddTLSx509Objects(vm, VIR_ASYNC_JOB_NONE, + &secProps, &tlsProps) < 0) return -1; =20 return 0; diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h index 60ed0e174c..0c969ab7f0 100644 --- a/src/qemu/qemu_hotplug.h +++ b/src/qemu/qemu_hotplug.h @@ -31,20 +31,20 @@ qemuDomainDelTLSObjects(virDomainObj *vm, const char *tlsAlias); =20 int -qemuDomainAddTLSObjects(virDomainObj *vm, - virDomainAsyncJob asyncJob, - virJSONValue **secProps, - virJSONValue **tlsProps); +qemuDomainAddTLSx509Objects(virDomainObj *vm, + virDomainAsyncJob asyncJob, + virJSONValue **secProps, + virJSONValue **tlsProps); =20 int -qemuDomainGetTLSObjects(qemuDomainSecretInfo *secinfo, - const char *tlsCertdir, - bool tlsListen, - bool tlsVerify, - const char *tlsPriority, - const char *alias, - virJSONValue **tlsProps, - virJSONValue **secProps); +qemuDomainGetTLSx509Objects(qemuDomainSecretInfo *secinfo, + const char *tlsCertdir, + bool tlsListen, + bool tlsVerify, + const char *tlsPriority, + const char *alias, + virJSONValue **tlsProps, + virJSONValue **secProps); =20 int qemuDomainAttachDiskGeneric(virDomainObj *vm, diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index b9971286fd..2fc8af9c15 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -3502,10 +3502,10 @@ qemuMigrationDstPrepareActive(virQEMUDriver *driver, /* Migrations using TLS need to add the "tls-creds-x509" object and * set the migration TLS parameters */ if (flags & VIR_MIGRATE_TLS) { - if (qemuMigrationParamsEnableTLS(driver, vm, true, - VIR_ASYNC_JOB_MIGRATION_IN, - &tlsAlias, NULL, - migParams) < 0) + if (qemuMigrationParamsEnableTLSx509(driver, vm, true, + VIR_ASYNC_JOB_MIGRATION_IN, + &tlsAlias, NULL, + migParams) < 0) goto error; } else { if (qemuMigrationParamsDisableTLS(vm, migParams) < 0) @@ -5161,10 +5161,10 @@ qemuMigrationSrcRun(virQEMUDriver *driver, spec->destType =3D=3D MIGRATION_DEST_FD) hostname =3D spec->dest.host.name; =20 - if (qemuMigrationParamsEnableTLS(driver, vm, false, - VIR_ASYNC_JOB_MIGRATION_OUT, - &tlsAlias, hostname, - migParams) < 0) + if (qemuMigrationParamsEnableTLSx509(driver, vm, false, + VIR_ASYNC_JOB_MIGRATION_OUT, + &tlsAlias, hostname, + migParams) < 0) goto error; } else { if (qemuMigrationParamsDisableTLS(vm, migParams) < 0) diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_par= ams.c index dd47516742..d551ab9216 100644 --- a/src/qemu/qemu_migration_params.c +++ b/src/qemu/qemu_migration_params.c @@ -1150,12 +1150,12 @@ qemuMigrationParamsSetString(qemuMigrationParams *m= igParams, } =20 =20 -/* qemuMigrationParamsEnableTLS +/* qemuMigrationParamsEnableTLSx509 * @driver: pointer to qemu driver * @vm: domain object * @tlsListen: server or client * @asyncJob: Migration job to join - * @tlsAlias: alias to be generated for TLS object + * @tlsAlias: alias to be generated for TLS X.509 object * @hostname: hostname of the migration destination * @migParams: migration parameters to set * @@ -1166,17 +1166,17 @@ qemuMigrationParamsSetString(qemuMigrationParams *m= igParams, * Returns 0 on success, -1 on failure */ int -qemuMigrationParamsEnableTLS(virQEMUDriver *driver, - virDomainObj *vm, - bool tlsListen, - int asyncJob, - char **tlsAlias, - const char *hostname, - qemuMigrationParams *migParams) +qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + const char *hostname, + qemuMigrationParams *migParams) { qemuDomainObjPrivate *priv =3D vm->privateData; qemuDomainJobPrivate *jobPriv =3D vm->job->privateData; - g_autoptr(virJSONValue) tlsProps =3D NULL; + g_autoptr(virJSONValue) tlsx509Props =3D NULL; g_autoptr(virJSONValue) secProps =3D NULL; g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); const char *secAlias =3D NULL; @@ -1205,11 +1205,11 @@ qemuMigrationParamsEnableTLS(virQEMUDriver *driver, if (!(*tlsAlias =3D qemuAliasTLSObjFromSrcAlias(QEMU_MIGRATION_TLS_ALI= AS_BASE))) return -1; =20 - if (qemuDomainGetTLSObjects(priv->migSecinfo, - cfg->migrateTLSx509certdir, tlsListen, - cfg->migrateTLSx509verify, - cfg->migrateTLSpriority, - *tlsAlias, &tlsProps, &secProps) < 0) + if (qemuDomainGetTLSx509Objects(priv->migSecinfo, + cfg->migrateTLSx509certdir, tlsListen, + cfg->migrateTLSx509verify, + cfg->migrateTLSpriority, + *tlsAlias, &tlsx509Props, &secProps) <= 0) return -1; =20 /* Ensure the domain doesn't already have the TLS objects defined... @@ -1218,7 +1218,7 @@ qemuMigrationParamsEnableTLS(virQEMUDriver *driver, * some other error path between now and perform . */ qemuDomainDelTLSObjects(vm, asyncJob, secAlias, *tlsAlias); =20 - if (qemuDomainAddTLSObjects(vm, asyncJob, &secProps, &tlsProps) < 0) + if (qemuDomainAddTLSx509Objects(vm, asyncJob, &secProps, &tlsx509Props= ) < 0) return -1; =20 if (qemuMigrationParamsSetString(migParams, diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_par= ams.h index b7a829b85a..14e20fb71e 100644 --- a/src/qemu/qemu_migration_params.h +++ b/src/qemu/qemu_migration_params.h @@ -115,13 +115,13 @@ qemuMigrationParamsApply(virDomainObj *vm, unsigned int apiFlags); =20 int -qemuMigrationParamsEnableTLS(virQEMUDriver *driver, - virDomainObj *vm, - bool tlsListen, - int asyncJob, - char **tlsAlias, - const char *hostname, - qemuMigrationParams *migParams); +qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + const char *hostname, + qemuMigrationParams *migParams); =20 int qemuMigrationParamsDisableTLS(virDomainObj *vm, --=20 2.43.7 From nobody Mon Sep 14 04:53:02 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1788772278; cv=pass; d=zohomail.com; s=zohoarc; b=VJbn0DNgpu7yLaYeFuE2Q6qE6e5ghclzvEXQHFVox3n0PHK426tLHUmms0Zi3G2nSag7kUybCpGQYSYVhDRKvAJfuZ4HhGqQObA4lZgTHw6xgDYyQ+Q5r7HCLxiwLo0VhfQ1TvqKBAlYeJNqqZBbO9B1XZKjGjJNFSaq/xHGg0Y= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788772278; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=Capd/ARAvMcNejE6LkVHEWo156f8SkrHl0pJ/37gzdc=; b=PlPd5sCjmmDhUKHNbuA1+t/94qZpjzLNdarrIknp59GPnSFX7w+sRREF0MNIZ79Ca15j8xgwoweaPpKJBSHg4nkO2/+07kqF1zZF9b2TsY+Ve8DrOKkavILI20YLyiVlyK2e5z4zuNlaf16JyuvxARrXMIBd3ljeNhnyDNklqmA= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1788772278910153.80708970064597; Mon, 7 Sep 2026 02:11:18 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id B88603FBB5; Mon, 7 Sep 2026 05:11:17 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 5BE5B41BD2 for ; Mon, 7 Sep 2026 04:57:49 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 8610B3FB0D; Mon, 7 Sep 2026 04:56:57 -0400 (EDT) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id C4D373F315 for ; Mon, 7 Sep 2026 04:56:51 -0400 (EDT) Received: from pps.filterd (m0127837.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6877AMl83572344 for ; Mon, 7 Sep 2026 01:56:50 -0700 Received: from cy3pr05cu001.outbound.protection.outlook.com (mail-westcentralusazon11023110.outbound.protection.outlook.com [40.93.201.110]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4ggf05as6n-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 07 Sep 2026 01:56:50 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SA1PR02MB11147.namprd02.prod.outlook.com (2603:10b6:806:4aa::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Mon, 7 Sep 2026 08:56:49 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%3]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 08:56:49 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=Capd/ARAvMcNejE6LkVHEWo156f8SkrHl0pJ/37gz dc=; b=Jpmofih+CQcdKAuIuEfrzhKJvrtzKHvJrtzRsPW9Cm+l10qgJbgvaEYeG lonYxhMoL5ZIGeZPc3PMyRCicvEfu9KH8ZPIqJTqnOx4XSJEuiE66GpapE7Du7RN p6iyTWNMSVWr1dtUBMdsTkwgbflX+7jqpJHX6KoNCy2nTcnXswpw1ETi/Lq0CsXT XCtmI/0FqtdDxFRsWgj08k9hr8diBN+80c1KhNBgAruGzbj0h2LdV7WBVmxNVR22 XDmTW2oW0mZHNp73oMFnAtMswxN7x0Jely48xASl9NpD67v0QKD64vjWbxK/kno9 JzbH53pRgPNbTqo/cVQK/8SXahN6w== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=eQ2iHEmGyUY9lotZmr1GDdnOKSaPAemJcDhvD8RNqNKBITHx+wDnsYy7BUrF5134e8ksNzLvRom7jedKqiCO6vMK1HrvB9P0RhXCWVqSAMA2uSMbuI8kDK+BVKKVqHdlVAN0PeDuOP25yiTOjtXMg/md9kvXT3TE9l5snZNvBGTcYdzXOjlaI1foSXZ0dWvx6pWFRXgD5xWIzqFBbNVnHC8/YhZ7l+fUd1eGzqMs4yVPGXP1zBhOMbkpJ3NPd6TInkC3dQQdF9mn7gh1OWLXoZOVhjWJMpQ4KHPpuVHxBSR9ZAQTP6MLJW8KloaMUQVeQ2JjRZ/imxzZO+AK+36SVQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Capd/ARAvMcNejE6LkVHEWo156f8SkrHl0pJ/37gzdc=; b=YL9DR4YNq0ILr/rRWi5DK2/uBvY5yohSj15VifQ4ZeUyevifxuaHLuQCiN2VhlvTO6QZEpA80wfsHLjihSQvXyrWA7mmHfqo66Ltu4mJL/qfOA9KqpMZi0e+8RXbzizBM6DxdbA3g+wVyopxEmZ+pzlxVr20ZsW0F4hkmBSTyw42vD4bCAtlJsECNjaQRJv/9adO7+RMj71fvCvJYk/K85Ls5pLOLLTZtNi/JSm5Bzdrz3UTNu5ceRPQ4MGnxIH8Pzh6aRy+unZQqcP08LCWo+oWANAvZ5j5OsBEFESCAVukKftLkSe+4bE/cqHj+6fb+N3rB8Stc26akSITvj+fAg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Capd/ARAvMcNejE6LkVHEWo156f8SkrHl0pJ/37gzdc=; b=KP1ZKKxJ91/5g3UiB0vQBxymKXrsh2DU8zo14Md7xWS8Z3lSytcJHIHMhgFsa7GDvEfdpXgAihZS/7+8JIWbuZF5XScqDDwI4CiyzmPerClKlQmTSr1EpX4zS1etRHsXPEUKzPRuPGJmKRNDU9vmagJFx7pm6O8QlZncMDM4EW0nBbW+oyuWUJ984BPCkQmBykW4qvagQsR4ZIm2Ffi3dwJ2zPjT+4wXkjGMXsQ97E5DhPw04d5aO8dMAnDa0s28hkTJCGdcSq347RgTZ1So54d1tNxIG1Shg7jhX1i6BN9ciQl0PlNL7zFxAAXcDS0qWKYcUrveVOSUGnyED9JK0A== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v4 5/7] qemu: Manage tls-creds-psk object lifecycle Date: Mon, 7 Sep 2026 08:55:23 +0000 Message-ID: <20260907085628.949946-6-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260907085628.949946-1-abhisek.panda1@nutanix.com> References: <20260907085628.949946-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ0PR03CA0141.namprd03.prod.outlook.com (2603:10b6:a03:33c::26) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SA1PR02MB11147:EE_ X-MS-Office365-Filtering-Correlation-Id: d07fe881-eb37-4179-7e53-08df0cbdf3f6 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|10067099003|3023799007|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: O25cAq4SuuD6b5WRQFR0d1hoF/2vAIPM5Qj6BFPSBRFRFZmCmEC1G4/wvtfliQAVVf66251KbHIvwb56VGnNYIl7Rlb4u6KVfFic4bvqtcdtg44Wt+N0eHfTe/GSfz6U8V1lh4E3UjOB4OcTjXlI7Zsf2Qyy9dSQZGUWCLa6FuLHhjE6oAHawr/gED7dw8TCYb9dXSdpPltq9IxI0R7YyrcwR4Lx+KHc6b2trx0vAJPhcxyynSynubeWG3M4lEStFqYSjg4rfCwnzMaW1cNNrCrbkpb/XkJb+7jkZ7JZ9vi8V8bSfRa80vVMEzDVWgXhAgLRFeDZ1qLIcVwChA2rRbSTWNzbrTi3Eu4FVUAQPfiyvcHSJr3+3Ek+9dhbIz2H/wJcaiwZBymoL6BfdqZisI/G6nhqi9YffBYhak/DKZT6Ja+y0zR57FlkzINNhlBCJeVsU7E2yGwl+6PRdSZ2x2j4KOzg/0lX4Voxz7O1/TCJWXT9Anv+iWS4zYk6MRjk6MC5OZ7UCBZDPgZq8DvfdlHcZc1ra6sz7xtqQXOkOvoN0IjiGADo742I/xSGKU+cF5p2Q2K0TW8LWPCsH4v23Bvf56YAb+VqIyYF9uFTgCAGDRhFfhW7r83SCCSuj39q7me+ikoqw+sSXUZgo9nlOo8HnqxkZYMYcH239QpuE90= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(10067099003)(3023799007)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?nT5hjD+LuYLfvyFvfSTYiuzIYTLEQdcy3tWFcBFb85eahDfx6nEtGQzppBv5?= =?us-ascii?Q?1kd8xar15oR/eUj6+qRKyDiXXH0GCYr5N0folQzWj6faocx+QMR1hWPba7fz?= =?us-ascii?Q?49p8DBzGzFOKw1HPV7XkLTDAOK8+nkG+ArY4GkI8bUCGm5qcjzewYra3DqTt?= =?us-ascii?Q?8LZ8XdSoN0UhsgAAbQ80QHvakTCr+nwUnHIbLRmfPwpNeyji+0vfOT4klJIi?= =?us-ascii?Q?kaF9T6irLDu3WQg8m1XvHZQXPlXoH0IlibOibreJgg396T590RAw6L1x6gIX?= =?us-ascii?Q?gqfLW+7SEkX4PLkcPOF//ucj+V2ksexUG3W7aEnJ1yw3pvG9zhIBIYgVkP6O?= =?us-ascii?Q?KlQKxmwRnacIV0hs9a3An5NwKLxl+xl5LLb81kLGUlVnFv4MjBRWCVJZYbEE?= =?us-ascii?Q?RVFQx14OWuYDZLK41vVv9w8CJjvKjFU6df/PNXLb+xrfH+9n8x99iALAp6t1?= =?us-ascii?Q?KXbjck6LGl5srj2yXtoJSkGPu/MT/YVbH4CY6ryc7WQH0awQyRHLDv/xOK6M?= =?us-ascii?Q?9+SMTZ6bQawqBFDEGBEtNePYNEFTz+D8kP35VkncKM/xpnmzX6JDGDAihkGA?= =?us-ascii?Q?pzyIHnmccPtPTqVfG93re3OFXBVemBS4jDEMYNv8c9rz/SXFzF16gykjqsdN?= =?us-ascii?Q?Hsdt8D9zz+ZIvZAoiGcfGHJBaD7GVNOHhvO8y1sT2z7gawpIbLdgXgCagAvK?= =?us-ascii?Q?+SfwndrtnpsModh9LWg5fuTFKlrUgVF8PvbursVky3fYdjYjR1rGn4b4gTXG?= =?us-ascii?Q?hS8pBrL7hou6/yZ4nheEvzzRlQyAlpzk4wGS6WicIf/a1QTbGV0bORmgEgL7?= =?us-ascii?Q?kUDbnmLc4aokr83xBtvWXYfHz0xSQOGd9qr7KgXRUnmTLGPedvA4uaEwZ4cK?= =?us-ascii?Q?8rpCIWcizxFgdDBJU6lhm0SNsVzLX51S0hQ5s9O8PAPi3fSFNvhgwrNR/OZ9?= =?us-ascii?Q?0i+8NGdLXtdR541cVB3M7vEuGrCLVycx8OZLqjJWWMliyUXfVGsISnzfxYza?= =?us-ascii?Q?Fo1Qtb35rAQfmU/NwddkmXq9zazxrLz1XcDsY5QWmZ3v2beDEXWuSJRzlNyh?= =?us-ascii?Q?wkurFu4EVXdOnQzhRtPwojFQ8fERsbOF2NnZGaWkef6NdqdJnuS1g0ShsV6R?= =?us-ascii?Q?tBm7TaJkeqJsws5F2y1XLqc1r3EDMxBBAnNrR1zRyPNPyjkA+G8yMgE2ljmC?= =?us-ascii?Q?yZbshqlW3aBFzy9mHrFfhlMrKrbn95McDxmnZadKxt5oh2th9TRs6/ToRBp9?= =?us-ascii?Q?Dy0ctBt0PwxJr4tugoVjTOuvHwbp6r4ibGCDYLPEcuXkQgxk3aq37995+qvr?= =?us-ascii?Q?zzWZqVtDJ8KaoGuN7a6XdKfAasOKurLTh1sih4tOuzanRH/GJR/rCvoOoli0?= =?us-ascii?Q?qYTxyr1PcIOGAnEziTgJxJs16QZQ8+7H02eZ61tQdapSSGGVJdidOySfrMJe?= =?us-ascii?Q?Aq2BG+HzAIZV2qCGS/xWDq6q25JV08M2/wCNRzvzFdKwt+LRtbqXL6hrvT8q?= =?us-ascii?Q?KGQCACp2nzS+aHMFp+48iBL4tceNmqxHTve1cuHVZBo7dgzt8FqN4ZfZnsAq?= =?us-ascii?Q?qOMQgIXRGS7KqjBxBIel5RZljCwQoKcPOoomX2iXOslleSz0R5biCOSQF418?= =?us-ascii?Q?afXk0H7lKq8ednr52zyXmN0LtbYElrRjPUub5bJHchBciYMxG3cGkTuTnFs3?= =?us-ascii?Q?YfWZThrkldeJiXcA4JoO3Amy29U4xUf205y6Rzg0C34ZJJJkWgCchmDQ5Rxd?= =?us-ascii?Q?0t9AK2JQYyHXW5ybeGiPY8d8ASpG6d8=3D?= X-Exchange-RoutingPolicyChecked: FoCSdD8B+v7KoTLcQycmerwuyixAitrazlT+xAInNfxSVmGF9NY/lZjga/8TL9BFNV6BSpAFhpKrM3rAWY33hz0CnELJViZd03+seEj+l39u9+O1cIgKGF3dvcmVTJar+wPeSj5/sotLgdnqmLtdq3J3mU/Cx1m6gONi9afsbZr+KY4YI/53kLqZfhG8nBmgRou/K6+rCufKvV0U2RqMyp66vATnri8etJa8tDrKsRF+j+41nXrjA5OCFStA6MK2tsOmuMPi8t+JqJ1Ko4crVoUM0rqwanON5FsW6/wfToSS06oNslTerAmAg+fV3Lx3ST4GIOWVNdYQBOM8SU9wMw== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: d07fe881-eb37-4179-7e53-08df0cbdf3f6 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 08:56:49.2126 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: axbzW7dtkmzcyk50K5hEKbizyiwMkmEr079VgeyTqRuY9B251l9DwJ41HMASIblDB95XzSd8zaHSxeVxupnjYdWPpcTkxNGOlbIobKuZN0I= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR02MB11147 X-Proofpoint-GUID: PpwErzMjhOX-YMZ_o8_3M-U4gUU1JPPq X-Proofpoint-ORIG-GUID: PpwErzMjhOX-YMZ_o8_3M-U4gUU1JPPq X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfXwtqHCIKKVNrW JRXvrcuK8JX1OHDgHSZwvUAxSaXkakKc7ai2pX7xc3dYlDDqekfNfJZpIYfsMO4gI+nX9hUMKJD 2Hp3QNTSwx6UQLAfkIcRRhlEwHupkBATdHDFlt8l4I1y0hdDabDtBRcHnsUWH4+kQ/0DLURYUhV J6SnGogXErSAdkk+a5ek/9yRu/k1nICrsaWRhX9JPHSswmKSYnnKm39I/FDQkZPVmhtqw3WNH6l 9xOducrH71folPLjnXvAdt068D0xYyFFHr1YzxSQISYrhmrY40ah6oQFPbAy/AeyaPcDqp7c/V9 Rj2s0e58fOUt+i+OA4u/jafP+wYP6Brx7c09s0MPSlhLepMkswfl015B+VL3siTWSTK8errLv20 Z/tbTcxRSGU1AjISTjfgwT+NIEaBH2kgHOWZqN7K3q7hqfSz6kAJqGD3WUiRvS6jJBzDx/GVn+q ptj5XlyFzDHZ3ghv32w== X-Authority-Analysis: v=2.4 cv=PoKjqQM3 c=1 sm=1 tr=0 ts=6a9e7c52 cx=c_pps a=NP/xy1SyNTxufu9/jqGmNw==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=VdqzKS8jKosA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=Ap8k9tRZuQ82DLYWQqG7:22 a=64Cc0HZtAAAA:8 a=20KFwNOVAAAA:8 a=FkoMf_KoTue4cd8-psAA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfX8urxWoJYL7RT YyMejs3FiC12qadeYGZyvtTUw+Txt3Mm8jPCSkvAOqoo7YUHeMSGpmj3KhS3tpGAinsr5NLaIce i2HxTVtM22Kovoysv8dr/3EOmKDBYHU= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-07_02,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: NO2ZEHCXCTTJACJEPK5O4BWDY3HPQHBZ X-Message-ID-Hash: NO2ZEHCXCTTJACJEPK5O4BWDY3HPQHBZ X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1788772281124158500 Content-Type: text/plain; charset="utf-8" To enable TLS-PSK-based authentication scheme, add support for instantiating the tls-creds-psk object through QEMU monitor. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda Reviewed-by: Peter Krempa --- src/qemu/qemu_migration_params.c | 66 ++++++++++++++++++++++++++++++++ src/qemu/qemu_migration_params.h | 8 ++++ 2 files changed, 74 insertions(+) diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_par= ams.c index d551ab9216..678bb5602b 100644 --- a/src/qemu/qemu_migration_params.c +++ b/src/qemu/qemu_migration_params.c @@ -31,6 +31,7 @@ #define LIBVIRT_QEMU_MIGRATION_PARAMSPRIV_H_ALLOW #include "qemu_migration_paramspriv.h" #include "qemu_monitor.h" +#include "qemu_command.h" =20 #define VIR_FROM_THIS VIR_FROM_QEMU =20 @@ -1237,6 +1238,71 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driv= er, } =20 =20 +/* qemuMigrationParamsEnableTLSPSK + * @driver: pointer to qemu driver + * @vm: domain object + * @tlsListen: server or client + * @asyncJob: Migration job to join + * @tlsPSKAlias: alias to be generated for TLS-PSK object + * @migParams: migration parameters to set + * + * Create the TLS PSK objects for the migration and set the migParams valu= e. + * + * Returns 0 on success, -1 on failure + */ +int +qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + qemuMigrationParams *migParams) +{ + qemuDomainObjPrivate *priv =3D vm->privateData; + g_autoptr(virJSONValue) tlsPSKProps =3D NULL; + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + g_autofree char *key_dir_path =3D NULL; + g_autofree char *shortName =3D NULL; + virErrorPtr orig_err =3D NULL; + + if (!(shortName =3D virDomainDefGetShortName(vm->def))) + return -1; + + key_dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortNa= me); + + if (!(*tlsAlias =3D qemuAliasTLSObjFromSrcAlias(QEMU_MIGRATION_TLS_ALI= AS_BASE))) + return -1; + + if (qemuBuildTLSPSKBackendProps(key_dir_path, tlsListen, *tlsAlias, &t= lsPSKProps) < 0) + return -1; + + /* Ensure the domain doesn't already have the TLS-PSK objects defined. + * This should prevent any issues just in case some cleanup wasn't + * properly completed (both src and dst use the same alias) or + * some other error path. */ + qemuDomainDelTLSObjects(vm, asyncJob, NULL, *tlsAlias); + + + /* Add the tls-creds-psk object to QEMU */ + if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) < 0) + return -1; + + if (qemuMonitorAddObject(priv->mon, &tlsPSKProps, NULL) < 0) { + virErrorPreserveLast(&orig_err); + qemuDomainObjExitMonitor(vm); + virErrorRestore(&orig_err); + return -1; + } + qemuDomainObjExitMonitor(vm); + + if (qemuMigrationParamsSetString(migParams, QEMU_MIGRATION_PARAM_TLS_C= REDS, + *tlsAlias) < 0) + return -1; + + return 0; +} + + /* qemuMigrationParamsDisableTLS * @vm: domain object * @migParams: Pointer to a migration parameters block diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_par= ams.h index 14e20fb71e..8774b4596c 100644 --- a/src/qemu/qemu_migration_params.h +++ b/src/qemu/qemu_migration_params.h @@ -123,6 +123,14 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, const char *hostname, qemuMigrationParams *migParams); =20 +int +qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + qemuMigrationParams *migParams); + int qemuMigrationParamsDisableTLS(virDomainObj *vm, qemuMigrationParams *migParams); --=20 2.43.7 From nobody Mon Sep 14 04:53:02 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1788772365; cv=pass; d=zohomail.com; s=zohoarc; b=LV4zgwCtUAuSugbk/ul6CYIJPqcCCaWpmYHX98HxnXkH2XFNAr4juOzcWNN/BFUKRB94ZP80bQa+QUQJT+nIAOrCP+MOSKNIPKKwpyRiH4iPIsx4uODx2XpvDYdCTfivZdUs0qr7KOeuM9j/UiVAR2THCkPbTm9otWRsYMJcbcU= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788772365; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=J5g3kMUIguKVnhHAp/nP+X76jRyCXZQVfz3solH6yTk=; b=IU4JwDX5O0ibq6C2xHcg6an9V5aLZHrVmKtNDjLD3y6RIVYspGCK3UhALmkG5SVnL651eiU6eEphI71yTfI6fRVzDb4XcxEiZFviNM1HevqArSUPbDa2PPvCN9jBzfF95rbS9M9ia+KeIZCDK/BVGh4AXkxF34z1g4VrgVowjOA= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1788772365581321.46174274011173; Mon, 7 Sep 2026 02:12:45 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 437863FA30; Mon, 7 Sep 2026 05:12:44 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 595A141C35 for ; Mon, 7 Sep 2026 04:57:53 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 1263D418C7; Mon, 7 Sep 2026 04:57:11 -0400 (EDT) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 5A7653F935 for ; Mon, 7 Sep 2026 04:56:53 -0400 (EDT) Received: from pps.filterd (m0127843.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 68778FWX3640538 for ; Mon, 7 Sep 2026 01:56:52 -0700 Received: from cy3pr05cu001.outbound.protection.outlook.com (mail-westcentralusazon11023073.outbound.protection.outlook.com [40.93.201.73]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4ggh6etnuw-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 07 Sep 2026 01:56:52 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SA1PR02MB11147.namprd02.prod.outlook.com (2603:10b6:806:4aa::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Mon, 7 Sep 2026 08:56:51 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%3]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 08:56:51 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=J5g3kMUIguKVnhHAp/nP+X76jRyCXZQVfz3solH6y Tk=; b=jLUoysmCLPZ7NDCuWt65v7O9p/VtXKNwijA/Wr4sgoCzLW3siju02EwJh EYFTqsE8h2L87qIDQJHleXSVE6BdEbMEFmxvplLDdVLkD1r6BUUSS+kCDg84UE82 /2XnRDyzYVjQMiyyXLuBAPjIIaN2l2bw274qgzmH39Rhu0WjIxjGMUuSOB+vwm7O zhwqevIh1+Q60W4pHVGN3ywyxhFl6OFfoVdtNf73GgafId/lzNUamqVRnOajhtmk nAk1ztXW1IoZJzCL6f1k6TK1B+q4MVE9mx0OSJGmkVOMbMvvUdKPX4kf+mQ07xAD RgLcZuRz7ASCVOevrc5wy1wOREiBw== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=p+P7Mpxd/Nx8cDoFR0tsmU15zA8bwpqeC6akEvt1tud+4+4TpIhAXvgIrhvrtut6iN+3ygnyXxn+tVx5WzXEtP+NQAbWYNHG8c7spGm+Hd4NI1Alfp80LDNr/pfIHqG2wmLvWfUh7/yoDxr13DdmxDthoIhw2eJ14tXT3bZMcYQ4BSIpnJmtcvD3WpdPNLUFZwOOhESXWgA2jJHW/hEtMPq8Rxcx3ZEUQ3c2GKKCbF8aF1+ux5PhmZh+EzKmebnzdhfJnreXEmBtwDNKAiI9WN17e01GoOEaQWKGpwrCXF2ENbE74DGqX48xgNXqV1ItHiK5JbRccYqgVeeFq3F7dQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=J5g3kMUIguKVnhHAp/nP+X76jRyCXZQVfz3solH6yTk=; b=XCiSjunxkeFH6pdZq2GLWc8yXN1K61qf1+HFJ3T/o1esEP4sqm7Bwxs2iz3Vl6JHUVSRMu2xqAVEUhTBXjCstJy1dDbBe1rLyxyprdNOxw5xWdLrq62mIbF+StH4kE0zmlS3FhOMVCVf0hR63WqvHI4HZDFweKYISrmkJgOHir+VfqQtcFq4apl91eM5NJxfJotp6u0Ew85zc9os1f0Kw4JBF3MpWr+h1MGEHPC/pYrZEa4BURbf3ZrvF8EtoGYiEiz1YbgRlqY2g6q81fmdL4rkXs2eEyBQ8vFI5EOP3v3uAOK3qBBPMSKc5eszNGOw1TlOyb4D+I/AEcmFeaHJKA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=J5g3kMUIguKVnhHAp/nP+X76jRyCXZQVfz3solH6yTk=; b=qRlDbIFRVQ7O/5zSYWDeN6o7yIzM5X+PDjf9LlXVvMTBfcg7E+lRgeCYL0mqeAhbrp3Pi3mccQxy7m0XaM11KSiWIxsto8y4qMK4GO5FW5W3BoIQBePX64Vt//jf08pBUiyrHbb7BZaG3Y4ikSDsAwE39KI6LDpLitJGQwQcmz3uG7lBWvq4O0SUZQKMUpAXxQyrtmChEp+FB/8CPIqJfEtNyTlkIcHXWzhGrejthg0hNfjSqK/fcrs6dj69FeqgHjb64fPsOIqaeg7jXPVwTKbllWTPU/6SYFlYL/XeSH7S61k8+vd38U3MFzZSCxFUgf6vAPfYKGDIKQ9S+KiVQg== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v4 6/7] qemu: Set up the migrate TLS-PSK objects Date: Mon, 7 Sep 2026 08:55:24 +0000 Message-ID: <20260907085628.949946-7-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260907085628.949946-1-abhisek.panda1@nutanix.com> References: <20260907085628.949946-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BY5PR03CA0013.namprd03.prod.outlook.com (2603:10b6:a03:1e0::23) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SA1PR02MB11147:EE_ X-MS-Office365-Filtering-Correlation-Id: f1ab25e5-9a79-40a8-5efc-08df0cbdf50a x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|10067099003|3023799007|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: gkH++xpZRtKd688QMrLNOcYvfxcP3EbMkoWP5gr2c075kfHScf6LUn+rKDcuybI/4ZaiDpmtwFOxVBsVR4cbmr8F8yDlf9ixxpNgBi5vTU9eDMYWOSEV0QI0gi1ZGu0HfUH/l6ETHtgRp+kgGFwP+dtL7vK2XQE8PPJR2cFt+xW/P2aFO43FHQ6slDy64BYTPyxVbiaYV5NnCQcM+xo3K79qSrd06cNVDQwNUmWNej99060iVhEYoHDc+rkBONjs9x9A9iO2Lr4nQr8wwLTcr+e7TWNcAEQSG7BbGZABZ1QG3n1o6ZWSPaXeXVIebzXQtQniiEozapEnjyC6ULfCwlkqAIIvX8tk7qUa9UYlEbXoUpt3nxKlE4lp9zAeLH9W1+jk+QCoM9c9CnEElyic69d3CRcPFXFYlJmZcir1pH77w3gGtd7gqhmK5LADDHSthb21nUQkH5GJ+8EUrsTrjABuBVGflvidyGOAhp8aWEZ2MeOaQjJZZ5GS9YOkD/fCoHvbTXoSxHcZ8RntY3x1E0s+h8KTQf8A47JwQK6xj0pOlpGXNfj75zb7/q6q2u83UkeKgzo8W6FpT3EEiyoxCrsScTP7cuQbfk4WVs8x1+8xYexpYpK9T/N5avJkN0kLDfxLyHOVr6fpueqVTznX/v6DNDI5AaZcigXmGYU6/RQ= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(10067099003)(3023799007)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Cz3GSpEnQQ3TPQyHbo3f7oq+7JHpdmy3l4xAIGZdQdOqtNWrE/Yuwg9fskqI?= =?us-ascii?Q?8WqTSIEx+WSzPq/e9CN2hnxAgU2fuHHdkecoWnGvEy8GELhdIiSi+H2+BH68?= =?us-ascii?Q?2aHdZQcxIvoayHXlx/FeDWMyK7C39nGm/5gXU/97+VxsXE2GZ2BSMuKzx+KO?= =?us-ascii?Q?gs7uinbvVueVK7dwSERnmIA3quJC1ugat4vosukqGDopM/ag1uL1SMlrgMco?= =?us-ascii?Q?WOB42fYDmol6Ie0MZzwV3jL2YDSw8GjscRNmUhydBWpOq5RP2+eBLqGyQGaO?= =?us-ascii?Q?u/MTRVzuqvi+nzNItLCtql+PV3T3rkzrNel0kmV58jC63k44Yy5KWwlHd4r9?= =?us-ascii?Q?gzpt8n2LRRBfw6L7pjfgHpvK/2V4r5xEmv5g6oqvKjJ6wV62Ny8T/WCcSlvQ?= =?us-ascii?Q?kPCz9/carfhXUCX0a/pLLAj5r1hd3yTnSVkOmkgukI92Mg6ZvHPxM2OtV5Lc?= =?us-ascii?Q?/fUxlb44545RCPHJcbqrgACIQd05FUWVv2vxoHc5GOIuUzlrL6aDQuFtVpOl?= =?us-ascii?Q?l77RSHIZgrEW5tb20bGTw28lE232t+Gr5/FP+Q0MLsPBz8glNQQYCq36Kv5/?= =?us-ascii?Q?zARKkvKn7PQfZYBZFAOWWidrpgxBvoccHnE1SCcLO3BFuN3OznaSpYSN31cZ?= =?us-ascii?Q?NkJv4MrOV5Aldqd5e1eKj9njIwW9Moug84mh2Rek2XxiOJpF7Tt4fneDmZTq?= =?us-ascii?Q?imnKAHscQ8hx2n1njrf4xCrLtrFsN0530M6vBCFjrU0chXqglrKtBbd6T1KK?= =?us-ascii?Q?88b7NHkWrqabQHr04ps8bmA3V74V2YpVgx6HCBVxQ3npi05mgZ9Mn3PoIv3y?= =?us-ascii?Q?EcplmM6vLPZPCP7+D2wtWlqum8Gp8L4ZkHOXQD6shH2WpcDW0BNWseSyS1OL?= =?us-ascii?Q?Ul+BgxvXhspIT5jzySMzwqNUbCjtdg7Sd6qTqESkxWLp4F3NzndlgKEN+udZ?= =?us-ascii?Q?5OY34/v09MvKLdfNgA6EpqtiorMX5iIzeDd5KwNthxYLl/Cf0yexi0oCMkof?= =?us-ascii?Q?M36S1Ng+vyBMs+79TqOk6z33/5oVFSTdy4iS+GsTAHGHy86/o2FcgojuvocP?= =?us-ascii?Q?W6DLzKySOmQxKp3al3pn8FZ2H5NnInwfJS+6WSt1CWY8I0teT8nZ00jP54zF?= =?us-ascii?Q?GvgfcrxAk6MDG9Fq9BtRsJteqcU7cFs5NFR0+R30rIHQWNehvsHdqslJxBMh?= =?us-ascii?Q?62e7k52ymlG9GkKJhIHJbb5WDwdoLdjIVhLXWwAlz1zxL5g1nSCuGu9xSsB/?= =?us-ascii?Q?AK/UfQ8l1oImrZ2Zp02WuSD0vkNpT5JF8/9xU8Ni8xES1ee+zz2PXoX/zJp7?= =?us-ascii?Q?g8kXUGARa9E97Ia1ObWGAo0fV7cJ0K8htkSM82WAK8teZQcOBK4RBKYiatIl?= =?us-ascii?Q?irPUKvR+Mb22UfpbLY8hrPKECrpczO0Gczv7ELw5D0Cj4obwCXxo/o0+adV0?= =?us-ascii?Q?aRm+2kg9twDASaUpFHwxiStbRCHtOW8hMa2Sp4CxsD7CwFOz84Vsqc8wKULK?= =?us-ascii?Q?4O5AanlypFbelRfaYS7DuCh2QQKzWou7U5hZgx7sVXftJ2ohQ417LB9nFM/8?= =?us-ascii?Q?jGs9M6EtGyRtjHQKxWa1p3uw4nQ6WWN2BJalanacgCGMpErBO+ihYeKzOBWS?= =?us-ascii?Q?azImMER/2qEogUYyF/IuFYYwejniycIMEOcQhKbk53SEvpYGrYIXp/fVwIt4?= =?us-ascii?Q?PxiKa+DDvPRYtzQ5sGUqlLw31L+fz6Sr4qHMIMppnUCMR3Vlzxvokgrsp9Uj?= =?us-ascii?Q?53Pdg+B45POYxdGkmScoUN75NE8p49M=3D?= X-Exchange-RoutingPolicyChecked: nrr5oZXFQo+H7GLHvFKyh3q0nW1mJxH6DHqTQaVy5Cfdspc4+r1hKNaeIHVYcnlLqFni8iw6IZ3CPS9UeJ9OPMC0jDEK+tfOB+G4WQLtoCZqzo4aHcDe9dtQyL1+m3Tm4/wU8+9U9Q1vwwBleqJnpcVzoCniOlhZHr+L5hlpNR4w2OUjUA82Txt0ZU8Eyl/Z5fKrtx1QmyBo9JJlnnv1UeJLpdZfIxq7ySr2OSjJfFF2+wSRT6zkK+zzWrqaceU+r5lDTndL3PoPJyLMFUrgKj0nPnLTsRfjDpoiCAJP/4dz9WMWNyMLgZ8RwwJ9cJMeqkjV1P+voNAIsBcdCCz/UA== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: f1ab25e5-9a79-40a8-5efc-08df0cbdf50a X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 08:56:51.0060 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: xUd32tA3DXCCbWYl3aYMZdEsXX5/V7M6LzTv1Y7RK+5qIOQwQXlU8Bof46Bw20moKksAMLp56dQ55wTYvys10vY7MYvwMgE5TQkywjYrVUQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR02MB11147 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfX4/6jh3nxqFR+ 9WurXChhedD7toOJ+hJ/yn2lNalLOucygIaap7sd0DlVot62zzuctI2p941jybrfeQRi/Zihyoq 1LXwO/v9sqwFBWRPMtA8hSuohirWqxV1APe0X3oQw38I+LsP5qkQE7Wv19Om8vJmC80FXi7AP9N a5zU0n4tnbzbhW71Yqll6OL98BxRqmdo50U5gjyZjlHMIpimBBqC6tLAxf0DWYBmDeL/N33bMxz Sz+8Nv1Aq/sFIDTMbeGusDR5i1bjDbMNcBT0+r7Oh8BC1bca3gqSLyW95KXvwPSQKnu37OPifbs 3xq9pettOVQU5BGBd4zPc2oUQ6RB+RH9sP5RnDDNwtU2tAy39YsLX61iuyNc3TbiUSJ3ustq4yc wxOcTt+IxrOncrDtcuvvOvJEEKrK+StoRNMr8z0fKQyv7KfOVfW0+tqBtwNcx8X9sANCwdVS+ah HonAfWZgORS9ifq6Mag== X-Authority-Analysis: v=2.4 cv=I4hVgtgg c=1 sm=1 tr=0 ts=6a9e7c54 cx=c_pps a=GKgL0VAr1x+Lwu9ZGPB1HQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=VdqzKS8jKosA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=dEe9Ve2bX-KnNSUMM2s9:22 a=64Cc0HZtAAAA:8 a=nlbpdW82qpdnVSQSPHoA:9 X-Proofpoint-ORIG-GUID: fxxL_UrlR-iGl_N5KGJYoPrBB509qW0h X-Proofpoint-GUID: fxxL_UrlR-iGl_N5KGJYoPrBB509qW0h X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfXyrYKtb7Z9fGN FF3nY+efh8TOefgfGpW8w6+q00q5bdUMz3jNrSnHDKAiwygHnB/Vtq6aVv0EiMGeOE+Ob6wa2uk uZo0j5wTkw79AAV4kpgDSUtjtuQzbJY= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-07_02,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: NPTKZLMGMMGCOBI7TZPD2OZCYYJGDHA6 X-Message-ID-Hash: NPTKZLMGMMGCOBI7TZPD2OZCYYJGDHA6 X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1788772369373154100 Content-Type: text/plain; charset="utf-8" Enable TLS-PSK based secure migration, if and only if both source and destination supports the tls-creds-psk object. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda --- include/libvirt/libvirt-domain.h | 10 ++++-- src/qemu/qemu_migration.c | 56 ++++++++++++++++++++++++-------- 2 files changed, 49 insertions(+), 17 deletions(-) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-dom= ain.h index 99208137c3..2ec3956f8b 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -1089,9 +1089,13 @@ typedef enum { VIR_MIGRATE_POSTCOPY =3D (1 << 15), =20 /* Setting the VIR_MIGRATE_TLS flag will cause the migration to attempt - * to use the TLS environment configured by the hypervisor in order to - * perform the migration. If incorrectly configured on either source or - * destination, the migration will fail. + * to use the TLS X.509 authentication mechanisms only if the TLS pre-= shared + * key (PSK) authentication mechanism is not supported by either source + * or destination. If the certificate or the key files are incorrectly= configured + * on either source or destination, then the migration will fail. + * + * Note: Since 12.7.0, Libvirt supports the TLS pre-shared key (PSK) a= uthentication + * mechanism along with the TLS X.509 authentication scheme. * * Since: 3.2.0 */ diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 2fc8af9c15..e9c8ddc343 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -3499,9 +3499,19 @@ qemuMigrationDstPrepareActive(virQEMUDriver *driver, /* Save original migration parameters */ qemuDomainSaveStatus(vm); =20 - /* Migrations using TLS need to add the "tls-creds-x509" object and - * set the migration TLS parameters */ - if (flags & VIR_MIGRATE_TLS) { + /* Migrations need to add the "tls-creds-psk" object whenever both + * sides support TLS-PSK authentication regardless of the + * VIR_MIGRATE_TLS flag. Otherwise, fall back to "tls-creds-x509" if + * VIR_MIGRATE_TLS is enabled. Finally, set the appropriate migration + * TLS parameters. */ + if ((mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) && mig->tlsPSK) { + if (qemuMigrationPersistPSK(driver, vm, mig->tlsPSK) < 0) + goto error; + if (qemuMigrationParamsEnableTLSPSK(driver, vm, true, + VIR_ASYNC_JOB_MIGRATION_IN, + &tlsAlias, migParams) < 0) + goto error; + } else if (flags & VIR_MIGRATE_TLS) { if (qemuMigrationParamsEnableTLSx509(driver, vm, true, VIR_ASYNC_JOB_MIGRATION_IN, &tlsAlias, NULL, @@ -3516,14 +3526,13 @@ qemuMigrationDstPrepareActive(virQEMUDriver *driver, flags & (VIR_MIGRATE_NON_SHARED_DISK | VIR_MIGRATE_NON_SHARED_INC)= ) { const char *nbdTLSAlias =3D NULL; =20 - if (flags & VIR_MIGRATE_TLS) { - if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_TLS)) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("QEMU NBD server does not support TLS tra= nsport")); - goto error; - } - + if (tlsAlias && virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_TLS))= { nbdTLSAlias =3D tlsAlias; + } else if ((flags & VIR_MIGRATE_TLS) && + !virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_TLS)) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("QEMU NBD server does not support TLS transpo= rt")); + goto error; } =20 if (qemuMigrationDstStartNBDServer(driver, vm, incoming->address, @@ -3611,7 +3620,7 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, qemuDomainObjPrivate *priv =3D NULL; g_autoptr(qemuMigrationCookie) mig =3D NULL; g_autofree char *xmlout =3D NULL; - unsigned int cookieFlags =3D 0; + unsigned int cookieFlags =3D QEMU_MIGRATION_COOKIE_TLS_PSK; bool taint_hook =3D false; =20 VIR_DEBUG("name=3D%s, origname=3D%s, protocol=3D%s, port=3D%hu, " @@ -3677,7 +3686,8 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_CPU_HOTPLUG= | QEMU_MIGRATION_COOKIE_CPU | QEMU_MIGRATION_COOKIE_CAPS | - QEMU_MIGRATION_COOKIE_BLOCK_DIRTY= _BITMAPS))) + QEMU_MIGRATION_COOKIE_BLOCK_DIRTY= _BITMAPS | + QEMU_MIGRATION_COOKIE_TLS_PSK))) goto cleanup; =20 if (!(vm =3D virDomainObjListAdd(driver->domains, def, @@ -5102,6 +5112,9 @@ qemuMigrationSrcRun(virQEMUDriver *driver, if (storageMigration) cookieFlags |=3D QEMU_MIGRATION_COOKIE_NBD; =20 + if (virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_TLS_CREDS_PSK)) + cookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + if (virLockManagerPluginUsesState(driver->lockManager) && !cookieout) { virReportError(VIR_ERR_INTERNAL_ERROR, @@ -5152,7 +5165,12 @@ qemuMigrationSrcRun(virQEMUDriver *driver, /* Save original migration parameters */ qemuDomainSaveStatus(vm); =20 - if (flags & VIR_MIGRATE_TLS) { + if (mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + if (qemuMigrationParamsEnableTLSPSK(driver, vm, false, + VIR_ASYNC_JOB_MIGRATION_OUT, + &tlsAlias, migParams) < 0) + goto error; + } else if (flags & VIR_MIGRATE_TLS) { const char *hostname =3D NULL; =20 /* We need to add tls-hostname whenever QEMU itself does not @@ -5201,6 +5219,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver, if (storageMigration) { const char *host =3D ""; const char *tlsHostname =3D qemuMigrationParamsGetTLSHostname(migP= arams); + const char *nbdTLSAlias =3D NULL; =20 if (!mig->nbd) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -5213,13 +5232,22 @@ qemuMigrationSrcRun(virQEMUDriver *driver, host =3D spec->dest.host.name; } =20 + if (tlsAlias && virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_TLS))= { + nbdTLSAlias =3D tlsAlias; + } else if ((flags & VIR_MIGRATE_TLS) && + !virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_TLS)) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("QEMU NBD client does not support TLS transpo= rt")); + goto error; + } + if (qemuMigrationSrcNBDStorageCopy(driver, vm, mig, host, priv->migMaxBandwidth, migrate_disks, migrate_disks_detect_zeroes, migrate_disks_target_zero, - dconn, tlsAlias, tlsHostname, + dconn, nbdTLSAlias, tlsHostname, nbdURI, flags) < 0) { goto error; } --=20 2.43.7 From nobody Mon Sep 14 04:53:02 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1788772464; cv=pass; d=zohomail.com; s=zohoarc; b=HlRrzQM/7qe0uc2z/XB4J38Z5uFhLBj4MoXyyYcLcD6dKfOyoq/st5nbN5lSacXVv/y8UMxuXYTNDvOgFtqJstHXWp0iZz81vPpGIai4wOX5UwF9vX+5UXkMCXkxOt4CCRvGIWHtvrLefKWkcWS4o6MnmQf7b9Vroq5w9F66v4A= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788772464; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=aCXmgsJ+zcGHCSLxl85VG8CzQg9J6+T9LOe1kVWsEaY=; b=VY1w07fUfaElN6BgQiQOxmGYtWj53knL4AeQnCgUJJi46vJ/jDyL7sBgH3eaG87vUx9Jxnxb2C97qKYLE/JIjfDLkI6HiND1yu4k4e3MhiVKWqdWzsjq2Gv1byCr9EsluBQwR3GRsh3BFIJcJ/pC/Sufmf7xx3AupSw0JFI0QVk= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1788772464908624.4547038394179; Mon, 7 Sep 2026 02:14:24 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id F1B2141904; Mon, 7 Sep 2026 05:14:23 -0400 (EDT) Received: from [172.19.199.13] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 6183A41CBD for ; Mon, 7 Sep 2026 04:57:59 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 80E1741949; Mon, 7 Sep 2026 04:57:19 -0400 (EDT) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id BAD5B3F97A for ; Mon, 7 Sep 2026 04:56:55 -0400 (EDT) Received: from pps.filterd (m0127839.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6877AouR3420417 for ; Mon, 7 Sep 2026 01:56:54 -0700 Received: from ph0pr06cu001.outbound.protection.outlook.com (mail-westus3azon11021077.outbound.protection.outlook.com [40.107.208.77]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4ggj5cjjys-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 07 Sep 2026 01:56:54 -0700 (PDT) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SA1PR02MB11147.namprd02.prod.outlook.com (2603:10b6:806:4aa::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Mon, 7 Sep 2026 08:56:53 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%3]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 08:56:53 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=aCXmgsJ+zcGHCSLxl85VG8CzQg9J6+T9LOe1kVWsE aY=; b=B1HFYX9InfObxbrBiVoO3KWSpAdpc1zIRA6mEwyJ8FrCcCD24pxsebTdh XXxws/R1W4ezxOD3n1q1JEKkuqu1VBmeYUSJTHuuwac9unuq5eAXR0IGMT4Ycq9O ZvrgPyUYeMTOOlijukwOh5oEwAesVq+310Cc/UpY56uzOY5JbVpeLfQfEspEl9PW yfqgyoEQ73XN8AxmeMzalDcD1uw1mplHdrWmNbONlBGp4hqxTNLGLWs8IwsfLvMA XzYti0wo+LkbQ56o9U+Eiy8h3sOrg1I8N08Lx3hRwPoev/lsnfpWBNh22XOhbSHj teu0H3qU7deUFW3sDdCtjgp4GKZTg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=GUMd+TQJUOSb2OLXg9WZL82nMXJNXH9tZfEd+oPTgYHGjSCicMXmQRxR0IHtKkzoyV5LDBw7MBpfPrNpayzgix19HsVpQSrfIoN6HMrror+MOLmkEExxsjROrAZDZniHUb1/AhPDKWOOROsgHoM3PIoDjUVqjaUvGjBBhSjpwTGVoPCNugIoNDdwm9Op6gb/v47EMYNMW0fg66i5qYGSQykUoGyVcXSTMwHVKhyvh7bv0JDybemAr6mNUBz6nhhHTF5bRzKhHZk8jNkKqvVlEOcaCAI7/GGeJY9RU0If7C2JzQEwEyfDggj0IWVnNVBHnJYM788b8k798+vgxC2Gqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=aCXmgsJ+zcGHCSLxl85VG8CzQg9J6+T9LOe1kVWsEaY=; b=c3GYMwnhxQA7jmFcm5o579fRWEqyt7yhgukTBsX/zE30WYKz55i0TmfWTHWh4BXzTpeYvlSm/NfcHlvsKVA+ZHzRps5wiw/3ZWFK/92mjbsWwMZsqO4H4erBN7Ec/C+E89qJO24BJ9j5IjqJNzXJLNf3cvFguxwxgnw/r7T2Ul3NtIlc3jWYS4ku9shmIplcPY5PiXw/PQp1gkWBrMqUOEiz97Q2SQ5LvCnFm2A9wgwS1MSctywQdVVliVe9rk64a/tdD31hW376F5VuYGhG1K5fJhmBxtr71K+UNv56qk7C9I2jl+d2Pxlxpya0AzHdG7FgaxkHfDD1zYmcaoq5Aw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aCXmgsJ+zcGHCSLxl85VG8CzQg9J6+T9LOe1kVWsEaY=; b=esYS68s5BC0tsngQxy4GEMkOT66RUlIefnP2xGW18XgYf8Elj+v7lCHNstQG66dcMq3aYRJNHl05XKs1Acr0HPXxya0PQsYqpV71ipBkQCVlfUy2DZSLMMmOI9bMolbqwLFHcHvWRqQMEQOQVIaUNbFJhyvg6Pyu3t/1NRxeO1L5X2hucj+OfJhWQ3fK+eTs0O9S3Gl7rx5BN+nbxV13PbuLKxr0lXWDzXOkKQDpB9bvWT3zeBd7edlXvGXHdP0segssLBwKfzMrJLhtv30/Qqcs0RSA2H7LiPNSGyqrNZe+8vqhmssN0rcVpvEbMyNq44tVGOV1CFaSZfTwefL15Q== From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v4 7/7] tests: Add testing of pre-shared key lifecycle Date: Mon, 7 Sep 2026 08:55:25 +0000 Message-ID: <20260907085628.949946-8-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20260907085628.949946-1-abhisek.panda1@nutanix.com> References: <20260907085628.949946-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BY3PR10CA0008.namprd10.prod.outlook.com (2603:10b6:a03:255::13) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SA1PR02MB11147:EE_ X-MS-Office365-Filtering-Correlation-Id: 795bce5f-f115-46d8-5594-08df0cbdf648 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|23010399003|376014|1800799024|10067099003|3023799007|22082099003|18002099003|6133799003|5023799004|56012099006; X-Microsoft-Antispam-Message-Info: nlfY0tKg6EN+uk7BUJql+QX5QxsdzQuCwiRtcL+nFqyVDVlkhDRzjBU83dw+l+mobretoxKJWyAD1AKDgsm/uny0fTQ2kwbIJpH4k3pNIxl+WbnNdrJxrHsO522OWNPlKHitPBRW9J3EwxDX5cmzxfwaw2506lTKsje5yupZ4Y26AZ4O/rg9vAB8op79xqC24iQVijLL45FEM8OkFzef27TK8fN1tz11nKynjtinID4PUi+1vamy5kc3RHJzTth1jxOqb+MB/7fCftt1Jy2hDIHhx+U1hh1EuaBXAwclihQI9ca0PgpN+aQRFcS9p1oRYHlIe5wnTIVBCelT8ZIgt0lGcXLLCgkwm9dE8XfduMR/Ia5hlrh19l4RKhVOkOtpKaPO8T0YbHKIsscW7o+29LTXchSukAsYHYoXSzXsdcE9g9oMuOYxw0ZRO0fuHP6qPTSMkeaondX8qB96SqEFbKPSjoQh5HEcM4zzEJQUvLKmMQGrxrtiriqohqKr3dRENNERaZQUCvkA3/AvrOpYPI+RSaXlCqQRuLlkjCUigfo/PZFDjqGXPBXmiXZRxKm8vFi1nzxmU9hi8RAietgWD/wBowGAH1zhTwaKjmYCkrd1Ah22G/AONOfKisFRE5l7s+XAzMZQLTamZKM73OiZpyElZlDEusjsKSCY+0jFIyI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(23010399003)(376014)(1800799024)(10067099003)(3023799007)(22082099003)(18002099003)(6133799003)(5023799004)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Ytt81j1fkJuNwVzp5+ozFHI+EbYndbdSYf6J5sUdAT7cnarU3HdPcvwuqwPg?= =?us-ascii?Q?TuhMqEWa5vf22/YxBV/qSV6pa+lQ61VLKIYLYW9zb3S9iHetZemY/ut7bAUZ?= =?us-ascii?Q?HwZmmU+aQhjGE3r+q2Z4pvUN/ApSn5UtfTZm2iNaTp8iKrsJX5Wl7SW6LUci?= =?us-ascii?Q?s6gazHdg1h5mxTie1TYsuW+VIR8cNeadu9oUT57KL++GlMlANUUt9X2F6w/I?= =?us-ascii?Q?5FsfzNucfyVvw4yjCIKsN3RH7nYZMzuoEMLxv5N0vHSe6xsrs0YxfO+3CFTH?= =?us-ascii?Q?G083Q1FOQ1Z6AmUHtfsMWo2ORpd81F909fK1gbbfEqEHolbvkXM76o7ABusy?= =?us-ascii?Q?ol66T6NqS7+PPt0g//kstBgZRSSJpbCIaCheRBxt/jziOwUnvwWRzMP0+JUV?= =?us-ascii?Q?RNkGmd+n+HpEcon+pTpcAsrIRI0aulvJC/Lxz/epUO31WM3jTFuW59LnpdRt?= =?us-ascii?Q?T25oesxpAcIaSjncNciHaqWALVRpVVQWmN/3bb1dP0RCJlbrTPJKjm89Pyl5?= =?us-ascii?Q?Ia0wmyTGrQla3tJ0F0P/q7dWoHuHDBznudxjTzstDCMJbqbqe/MWVw56cYzz?= =?us-ascii?Q?X6mjPsm61Qc+d5ChpyM0piqMDELfpeWcIChtCeuphT3kq0Uv6rMb/2wgKLb1?= =?us-ascii?Q?vcV4c3h/qOQ82Qs2vkR42s9ProrDOC5mQa8uma1AQQmUir3fFf2PowmmRlUw?= =?us-ascii?Q?0i/+MVTm35ty08bI0dkY8KjiOS0Z1/jneb3NeYa81O6+XMytS/LR7ZJWELb9?= =?us-ascii?Q?xadkYAMdjuQLnOivWAyh7gy2IF7GpOSPDleBYEKHBst2rNyQnpRqjckhLM1X?= =?us-ascii?Q?6eHU3wWkld1gMS77xf9d3om7PrUl+nLhu2ZuoE+WRJ4gsqpdfqjMSS2k/1V9?= =?us-ascii?Q?pqueVR88q9kkKc45kDgiyKucf42ozGLG3tyC80BOXnxz1Jg0a4Cg8PpTmYyl?= =?us-ascii?Q?gWHuNaLC7zJQJYS1FZjIV4I4G9WbE9Gv0uZdDB5wa4RAnI+Leh4Ks4cF9SAy?= =?us-ascii?Q?75h0+rKGBnXHg5tvrKJrGDKDiaPXO+JCPDy+jijpeiZoq33CbJYmAy79Dcz6?= =?us-ascii?Q?VmmKPH84/Z7XZ/I6NDAtlrls//34NrosNm6RFQPLXJifOCtFoIEQ4yYvERfL?= =?us-ascii?Q?c4boomm0stPnMHlayWpcWxip7QLHgbvV8Qdrgli5xAVqzJHS5/rPoqGzBHmK?= =?us-ascii?Q?wh52Tlmga9jfkAO7RqSmv83i8d2X/EXwLlNMY7hac2UeR9D4vTXoMqLh/UaQ?= =?us-ascii?Q?ayZEo/XWecshQ06XKO/wII9Y7fzoTqIsetpZeD8TUEoecvAtUdhDtaXCTMID?= =?us-ascii?Q?QaPm9m0YC5iVTEGFgREe5AXMgBZ2yEsZmJxOzRVY5npxH6dSLBa0ennfK+HF?= =?us-ascii?Q?FiJvHr/Uz5KsxD9XlpqkrIVEC3pEtNG+EjRKIdJwiFb5Rwzk2Tg5PuDWfGFO?= =?us-ascii?Q?WoJQmagxVF3dtR3TP/S8tWgpfllaKuUa0Kc5/M6NO2DZHMhkybHrAvsmElpF?= =?us-ascii?Q?jBXYMShcmnDpa63vuGns4m+ZBLN44tsgTyq37Dx0tNSz9BK7s8Ub9m9jzJyg?= =?us-ascii?Q?4GicHZ3ZT27FvGhL9DXCMzri2CGYWKn5HoyjP2u4P1e2xutxazCqCNbQpjWA?= =?us-ascii?Q?uCGnI0UXdXn0K/Ek4yJMpNpywrZArQwrDoT+i8Rz7o59JsCUiDl2ir6HY9d+?= =?us-ascii?Q?ss+l6Od6QECfSO2TaYeK7rAztFsOSt7b2x/A20nKxMNPyf2kEXi8IHJ8WZsI?= =?us-ascii?Q?lZIO7QCy9cEG1L5vkDAofE/x5GDhr9k=3D?= X-Exchange-RoutingPolicyChecked: Vkb/bwrklvIYLAEj5oLhntfWGeK1LE8QosUbVKdhgL+uZ54cTciE6epDfowf6xLllC6BoerUow6f67Ev+AIQ+alkVcpsJQJ3iiETrceYYFDT+HuBi1ksRkd3uNHK3eraejGJogyMi+bJwkSsB2uS5tzG8IIjt8NBCu6AFSn519q6piSN0h4lzSn8Q4osgwOFV5NqEOqhE8gGQvdB94ujIiIFJ835/uRfMcfd7BzCXo9vdbdTiJIXsIBiBF4k5rp7AHrIYzGZAlX7twQaKcb7Ff6cqnt5h73c9GftHZWPaPuuSONzsCmHmoIoTd0qNAsWUnXmgC3p6HoIEnEM2K8VdA== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 795bce5f-f115-46d8-5594-08df0cbdf648 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 08:56:53.0957 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: dhBC2URFl2NoyA0X9S9NZGal8mNi6shkyhNW2KB/jH5w7XEM0KVuTSr4CALJCc9U6DnKknUwlu30oKLgPf3YVOiaSIIkUYWS6WB7nzCUNGI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR02MB11147 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfX8Ax0A4vYAx3T mIwVvpLPzjo5S/eEzowcDLz7dQhn11JlzdwEjtE19a5yh6RFN5wzO4Rq1Tosq3832Q2hgbThjW9 dyQlvCURpAHJ65nGxUctxP9CxFU/KdY0MIakUXxdPHkMZnF5qQkg6fetNGgaO83/XLoN0P5WymL KTPndj0UQm4t8fcErqCw2MAsPqpo0rBs5Nr3refr2YbHIFXUY3uooP6Mfw8zhhEUOY/B7UicyQ5 FULUjdmSDE/sJHGhnBm8P6C4faz5AX3ZkDJZ/vnu8nL0BhPXuFJrWAxv9fQymlqtD14rdIGWFX8 H/Ienx3S+o/jaJ1cDmi40XwJsJhqIKGE66vPOvA7RgH+OXwMC/OBBpYG77blZCDJs+g/8fmww1U 18UuULHvaN5qpCHj7glz4F+n4Sumo61/NyqgpCEsqvfZfUkAhoYKNOyWMF84gbbWJWX1wEGa5/e FVxbhV4dK6OhfK3NRvw== X-Authority-Analysis: v=2.4 cv=F4JnsKhN c=1 sm=1 tr=0 ts=6a9e7c56 cx=c_pps a=56BXxs5GTVekWDSCh43ZEQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=VdqzKS8jKosA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=y4UcunY2MAxhM4LwGdWI:22 a=64Cc0HZtAAAA:8 a=m3rDw_47mjERg_1OAhcA:9 X-Proofpoint-GUID: wKweheW3JQZvmDEqWAYElNjP8Gmp_hGW X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA3MDA5NiBTYWx0ZWRfX7gtirnNw5u+7 jmg1EyYBlM76tdsy8LtCjHZldBVY9bRkW6F2XEZj/WRWMb+XXwJCx4Di9ykyBsY46c2KIOPwOH5 bnAqE12+tphPolOsdFol68Hz4OXDdp4= X-Proofpoint-ORIG-GUID: wKweheW3JQZvmDEqWAYElNjP8Gmp_hGW X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-09-07_02,2026-09-03_01,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: RE4HB4S7G3UAXBVP3BAZTDBGVRXLX7HY X-Message-ID-Hash: RE4HB4S7G3UAXBVP3BAZTDBGVRXLX7HY X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1788772468973154100 Content-Type: text/plain; charset="utf-8" In the case of TLS-PSK-enabled migration, Libvirt manages the lifecycle of the pre-shared key. Add a new test scenario to the migration cookie test suite to validate the generation of pre-shared key when the QEMU_MIGRATION_COOKIE_TLS_PSK flag is set. In addition, the test also checks the length and the hexadecimal encoding of the pre-shared key. Signed-off-by: Abhisek Panda --- tests/qemumigrationcookiexmltest.c | 123 +++++++++++++++++++++++++++++ tests/testutilsqemu.c | 12 +++ 2 files changed, 135 insertions(+) diff --git a/tests/qemumigrationcookiexmltest.c b/tests/qemumigrationcookie= xmltest.c index 41846b8631..60ca62f98a 100644 --- a/tests/qemumigrationcookiexmltest.c +++ b/tests/qemumigrationcookiexmltest.c @@ -16,6 +16,7 @@ =20 #include =20 +#include #include =20 #include @@ -92,6 +93,99 @@ testQemuMigrationCookieDataFree(struct testQemuMigration= CookieData *data) } =20 =20 +static int +testQemuMigrationCookiePSKValidate(const char *key) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(&driver); + size_t expected_key_len =3D 2 * cfg->migrateTLSPSKLength; /* The pre-s= hared key's length is 2 * PSK length */ + size_t i; + + if (!key) { + VIR_TEST_DEBUG("\nThe pre-shared key is not present in the migrati= on cookie."); + return -1; + } + + if (strlen(key) !=3D expected_key_len) { + VIR_TEST_DEBUG("\nThe length of the pre-shared key is incorrect."); + return -1; + } + + /* Check the characters of the key */ + for (i =3D 0; i < expected_key_len; i++) { + if (!g_ascii_isxdigit(key[i])) { + VIR_TEST_DEBUG("\nThe key contains non-hex characters"); + return -1; + } + } + + return 0; +} + + +static int +testQemuMigrationCookiePSKAttribute(const void *opaque) +{ + struct testQemuMigrationCookieData *data =3D (struct testQemuMigration= CookieData *) opaque; + g_autoptr(qemuMigrationCookie) cookie =3D NULL; + qemuDomainObjPrivate *priv; + + /* if the VM object parsing step failed there's nothing this test can = do */ + if (!data->vm) { + VIR_TEST_DEBUG("\nmissing VM object\n"); + return -1; + } + priv =3D data->vm->privateData; + + if (!(cookie =3D qemuMigrationCookieNew(data->vm->def, NULL))) + return -1; + + g_free(cookie->localHostname); + cookie->localHostname =3D g_strdup("hostname2"); + + if (virUUIDParse("8b3f4dc4-6a8e-5f9b-94a5-4c35babd8d95", cookie->local= Hostuuid) < 0) { + VIR_TEST_DEBUG("\nfailed to parse fake UUID"); + return -1; + } + + /* Format the migration cookie at the source */ + if (qemuMigrationCookieFormat(cookie, + &driver, + data->vm, + data->cookiePopulateParty, + &data->xmlstr, + &data->xmlstrlen, + data->cookiePopulateFlags) < 0) { + VIR_TEST_DEBUG("\nfailed to populate and format qemu migration coo= kie"); + return -1; + } + + /* Check for the element in the generated migration co= okie XML */ + if (!strstr(data->xmlstr, "")) { + VIR_TEST_DEBUG("\nthe migration cookie is missing the migration-ke= y element:\n%s\n", + data->xmlstr); + return -1; + } + + /* Parse the migration cookie at the destination */ + if (!(data->cookie =3D qemuMigrationCookieParse(&driver, + data->vm, + data->vm->def, + NULL, + priv->qemuCaps, + data->xmlstr, + data->xmlstrlen, + data->cookieParseFlags))= ) { + VIR_TEST_DEBUG("\nfailed to parse qemu migration cookie:\n%s\n", d= ata->xmlstr); + return -1; + } + + if (testQemuMigrationCookiePSKValidate(data->cookie->tlsPSK) < 0) + return -1; + + return 0; +} + + static int testQemuMigrationCookiePopulate(const void *opaque) { @@ -418,6 +512,32 @@ testQemuMigrationCookieXML2XMLBitmaps(const char *name, return ret; } =20 +/* tests the generation and persistence of the pre-shared keys */ +static int +testQemuMigrationCookiePSK(const char *domxml) +{ + struct testQemuMigrationCookieData *data =3D g_new0(struct testQemuMig= rationCookieData, 1); + int ret =3D 0; + + data->cookiePopulateFlags =3D QEMU_MIGRATION_COOKIE_TLS_PSK; + data->cookiePopulateParty =3D QEMU_MIGRATION_SOURCE; + data->cookieParseFlags =3D QEMU_MIGRATION_COOKIE_TLS_PSK; + data->inStatus =3D g_strconcat(abs_srcdir, "/", domxml, NULL); + + /* load status XML as domain object */ + if (testQemuMigrationCookieDomInit(data) < 0) + ret =3D -1; + + /* test PSK generation and persistence */ + if (virTestRun("qemumigrationcookie-psk-lifecycle", + testQemuMigrationCookiePSKAttribute, data) < 0) + ret =3D -1; + + testQemuMigrationCookieDataFree(data); + + return ret; +} + =20 static int mymain(void) @@ -448,6 +568,9 @@ mymain(void) if (testQemuMigrationCookieXML2XMLBitmaps("nbd-bitmaps", "qemustatusxm= l2xmldata/migration-out-nbd-bitmaps-in.xml", 0) < 0) ret =3D -1; =20 + if (testQemuMigrationCookiePSK("qemustatusxml2xmldata/modern-in.xml") = < 0) + ret =3D -1; + virBufferFreeAndReset(&testnamebuf); =20 cleanup: diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c index e5e3342b53..b0e0d41895 100644 --- a/tests/testutilsqemu.c +++ b/tests/testutilsqemu.c @@ -297,6 +297,7 @@ qemuTestCapsCacheInsert(virFileCache *cache, =20 #define STATEDIRTEMPLATE abs_builddir "/qemustatedir-XXXXXX" #define CONFIGDIRTEMPLATE abs_builddir "/qemuconfigdir-XXXXXX" +#define TLSPSKDIRTEMPLATE abs_builddir "/pskstatedir-XXXXXX" =20 int qemuTestDriverInit(virQEMUDriver *driver) { @@ -304,6 +305,7 @@ int qemuTestDriverInit(virQEMUDriver *driver) virSecurityManager *mgr =3D NULL; char statedir[] =3D STATEDIRTEMPLATE; char configdir[] =3D CONFIGDIRTEMPLATE; + char tlspskdir[] =3D TLSPSKDIRTEMPLATE; =20 memset(driver, 0, sizeof(*driver)); =20 @@ -328,6 +330,7 @@ int qemuTestDriverInit(virQEMUDriver *driver) * dirs. */ VIR_FREE(cfg->stateDir); VIR_FREE(cfg->configDir); + VIR_FREE(cfg->tlsPSKStateDir); =20 /* Override paths to ensure predictable output * @@ -367,6 +370,13 @@ int qemuTestDriverInit(virQEMUDriver *driver) =20 cfg->configDir =3D g_strdup(configdir); =20 + if (!g_mkdtemp(tlspskdir)) { + fprintf(stderr, "Cannot create fake tlsPSKStateDir"); + goto error; + } + + cfg->tlsPSKStateDir =3D g_strdup(tlspskdir); + driver->caps =3D testQemuCapsInit(); if (!driver->caps) goto error; @@ -433,6 +443,8 @@ int qemuTestDriverInit(virQEMUDriver *driver) =20 cfg->dumpGuestCore =3D false; =20 + cfg->migrateTLSPSKLength =3D 32; + driver->privileged =3D true; =20 return 0; --=20 2.43.7