From nobody Thu Nov 12 15:08:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1793612916; cv=pass; d=zohomail.com; s=zohoarc; b=WsTUqpGBMMSFdiZJkNlbW3cmiqqGIiKegdjPTIT22h+PMYGodEs9xsIaSu3o9GlSFCkySyTf8yVe5mxPO4jt+pLIZ+kNTcQsg2jpgyCp9XvO2zDdbNXsUI41I58qkh0r+4xHkT3eP+VdyqBt/ZxgIKrr7YxhBK1F+LsR4heLwe8= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793612916; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=Kip6ME0y8KRmns8GxK9lopwwbGj5cVy7/QcZK91BTbQ=; b=LSlkhpvZG2Y4N9tSpdiEvZBLBi3plklpt7OOZx3olWK3UPVjUviSU4AvUgQs82UBbiMwtB583OCXYw33+MX3WL8QAmAt1pogWy+uBds04Ux6Cy5qlQhNdFGOwaIu8quYOpkJbl6+Zj+ITwultBSeATtHQYyGMd3AEs1eXx3fgLY= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 179361291603180.7143839294805; Mon, 2 Nov 2026 01:48:36 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id CF51B3F356; Mon, 2 Nov 2026 04:48:34 -0500 (EST) Received: from [172.19.199.19] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 11E4141D1F; Mon, 2 Nov 2026 04:44:41 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 63D213F308; Mon, 2 Nov 2026 04:44:18 -0500 (EST) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 8700D41ACF for ; Mon, 2 Nov 2026 04:34:52 -0500 (EST) Received: from pps.filterd (m0127840.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6A29AQTu215479 for ; Mon, 2 Nov 2026 01:34:51 -0800 Received: from cy7pr03cu001.outbound.protection.outlook.com (mail-westcentralusazon11020129.outbound.protection.outlook.com [40.93.198.129]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4hncnsk5wb-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 02 Nov 2026 01:34:51 -0800 (PST) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by MWHPR02MB11789.namprd02.prod.outlook.com (2603:10b6:303:2a9::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 09:33:14 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%5]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 09:33:14 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=Kip6ME0y8KRmns8GxK9lopwwbGj5cVy7/QcZK91BT bQ=; b=Pjlmfr4fcyz5sWlt/GYBPpWhcKwssmLU3EGBFpDO+D0pM1mzPEHtkteDB fQeBnrZDbF+INMsGeks1+p92MMTDYxYcK1kOmltBCkd0HGmG/6UByIkN5LdH20Dw ib/bAgY7gwVF+kKEY8KbO6rNX05JttPpyXuL/kFiGu0b43b7X0CJjoXUbQUL5qzh NXGdPqn6Kr2yUf/A4vtKekAmWBMiGT8uYnrVjNGgFJrj+qGZGj0OyFUvpWc5n2Ti TfTVgVCXpbHOkBv+zPklJpGL6+GobQ4ppc6UsJnHh4xt31UsSOxfYlbn4slEiqGx W6dJj0E7jWNVSJUoyybmQU9tgoNvA== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=xLggC1M4XXjE8EObcyji4ES6VjeqiTq0OdK2armAL1LvECHFvz6akjm1sdvsLkY6IR0i8rE123f4j4yZafchzGoKBkhvZCUBcOIfPAuXu1RpdONU3UXgy9v60TiN7AYp1PvUWvijo2EsqbIQQBgXfX1lc+2AGcj2lgNqxzHh5hvgJnNN2pQzl4nTMAur28qvsWSIdg2Q0x5M9cgNK2MzrO+V7LYEYNHJV1HSeeSzoA7hE6OZ/c8Hytu60t+XsT7SL71rvmF0H9YV8Mh3y0jwzwQCnfOy27p6+oXbQYx9ADZyf57UVrOntdi3L9aTVUNmL8S+tDoI4pQm1af1hxnXPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Kip6ME0y8KRmns8GxK9lopwwbGj5cVy7/QcZK91BTbQ=; b=wqDf2w1ayoLyXCCLDtKba5L0KlOjJqosZz28+LtpO/B5kpJUF7qq1mb9E7usS8c6TM4efkVQcq6dbcf9pMk9K2zpz3QfC/6E6dyeSyKSjDv1WB/26De6SCvx/zRxP1Sb6bEinQgHkH72O4X8OWEy2e4jHrqvS2xawsS1iRZGUHN93KhtGBTpBNlTcqzbOoJ/KXcOzsMmuXqk8H+SDvkMj2gNFryGKMpcuqaAAbNtaREBC2mrmH1KEwunnnQ6trtkiPyNfPFy19UeRMArF9UAgg8kBWL520J0j7DR6D5CByaj42+v4BSgelWKWVrMn3UEVA/HIK+y0tonYaeog2ccfg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Kip6ME0y8KRmns8GxK9lopwwbGj5cVy7/QcZK91BTbQ=; b=ez59Huv/LRWzDmLZ6BkIYdwD024j7lE03dlpx2t5LarnPAPJeIbNeGkMGIkceHJf35us2ICPne8rCqIX/lk8jzgCJl/HjCvQIrVqdOqEjszUgvIHNbGExk+uQaQJU+rtqvEZpZbzL+qh6knM5Tm4TfGHhoRLVaP8Ke3fbGioy2tMZMUMLToYMyFHjoigdi8YqYP0BtszHT3YTLdFqPmi8ANg13pGXLE7wQUbvaMusGJo9hUCL3AEYE3O87RKyxBSkNCKfJtQP/8qjrBdrh3N4jhdcnBfln/vAw8sfr3XcfFJg3S46V1rHX1hyae9PzehcBBq2lwiNy5u2qRZ0iLipg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nutanix.com; From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v5 1/8] conf: Add a configuration param for TLS-PSK Date: Mon, 2 Nov 2026 09:32:38 +0000 Message-ID: <20261102093300.44810-2-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20261102093300.44810-1-abhisek.panda1@nutanix.com> References: <20261102093300.44810-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ0PR05CA0115.namprd05.prod.outlook.com (2603:10b6:a03:334::30) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|MWHPR02MB11789:EE_ X-MS-Office365-Filtering-Correlation-Id: 33859088-121d-41bd-7276-08df38c4518a x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|376014|261021135927099003|261021121427099003|261022105027099003|261022075727099003|261009223027099003|261026121527099003|261026140227099003|261028144727099003|10067099003|56012099006|22082099003|18002099003|6133799003|3023799007; X-Microsoft-Antispam-Message-Info: Wr/mJqt3JImx3VD0S/z7TktfpAsag4VHhG5a0cuVNGNx82A05u2XlUOVdrQezakh5857NOsHCpP+hzvv2XaglvM9X1f1OEkT2JRRiUKOuYx9wiyRcsiQaPZBprdmThZMZL96Li3k16doSr03NBRbmkoNfgH/HUx5gCyxFicos/T4Z950l7yarieiLjAoU7+8At9/PaTjrn8UEnUQRhSWEg2M0K3hvMI+ekr4y1YH3n0jJyyf4re6OYK2ggvopyZV8PzqBTRloakiO1hUOxsRK2yze25fwLRqPT7L+UrCNFgZ+ioAfvLHlzuWTp+XG/JBcVJ6XB8dg4CtuGkNQKjNRxHjA7gQvzAo2TcsRIvEC8MbfJQPiK9QMTM/8YEt9O6/BzmRXCh3OdqpYwpWZ1+QyAWmUwyQgJjD5Lnzv/peZcbq8fGEIPG27QmdnFAOXejqsqOYB9qPMMStR7ZGBlSOf+bu6sKotni6J0gvRumZXQG4Y97YxNo3he/ihQ+LrUDSkVN//2NmvmgiptIyhP+xf5nWr3m07RBc076jtEYfVRn8d/g9+8sxIKa68bATzloSQH57NXYKML2vY8bKTfJwFRHc/IK13Rw9iyHMT6Xy9c3XxN3+fE/S7FzMm46ZLALdMNNHv28kmNRHSZpVIeppWurKp6E/EGxiJYEpvOOy7Qo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(376014)(261021135927099003)(261021121427099003)(261022105027099003)(261022075727099003)(261009223027099003)(261026121527099003)(261026140227099003)(261028144727099003)(10067099003)(56012099006)(22082099003)(18002099003)(6133799003)(3023799007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?W812osYQK/QMNleKRSMfS/Dys3/E3XE4MmRCUAT+tXqgsMHGacCGQmaRoZ8X?= =?us-ascii?Q?43aMZsuHCORmjTIJhYnRc3mwVqasto96j2dQ1DhnO3aDfGcHBZUIO1vq1AQv?= =?us-ascii?Q?+9dTk4LjWI0EBB9I/KbGz/TvowjCsXm5mWw7nocy+73C0jViYhGjKKKnf/Pi?= =?us-ascii?Q?QhGOq/dL4214oNAcmWtYcc/LPo5mO47i5q4EghU4WkAoxmXapRdT9q2pawDU?= =?us-ascii?Q?5BXH4kUkpnzaWI+abap76osSxB7c4/Ng+GeAkdX0qfIdPV+pmwfhOCRoFI5d?= =?us-ascii?Q?wmgaoiq86q5N5EcNOAkbJJI8c2XoNQArKlyjg/tk5kxvDYpdK5RFrTio2ZKw?= =?us-ascii?Q?ZS2nhcbOwug3uDgUK0LQIE2LhMMlCXYX/KR2i9OGeOukTLvyUj2VZBnwu/du?= =?us-ascii?Q?N4om455gsB+xxkK3ZsVP/vEq39N+qshaRIKwltHP8Q/QMOZSoKwbX2zeEHdr?= =?us-ascii?Q?WnHWfSFaeVrBv3yrqYXuLy2fmkITnXZf1ltsGj9+MpeGnCJ2OFEWzFMaMn65?= =?us-ascii?Q?lYc9p9gXUWlCM9kqedyYEjbAQwk6QY5+Aepfaj2P8yvbkmPJnDZg6dSBxiVh?= =?us-ascii?Q?Xq/+6wBTC+xwXOvs687272bqOJEW6K6NlfcSeE+6bScC4KND/zC/1MDv9srW?= =?us-ascii?Q?Mcli59ymY54FuiDMwntmdtIUI1P9q2YWDIK6ZmW2U+4ODwWs2zvrdeJCxknT?= =?us-ascii?Q?dms7pwULY0BtLkpvwfvnnlK5DiOwEvw2kDFWUWo/Gvoz5+V8j1XljRUPQrRE?= =?us-ascii?Q?4YExd6/1zyEQXJ/YIPta5jDrAdsHKspAdrGbF20yHi7hh4B3f25E2XqrVTer?= =?us-ascii?Q?0u+tyr3+kB+1DIqK1C5lHoq/YEXce84EsPJObPBguPD9WvX/bkxDx2C06KJI?= =?us-ascii?Q?jwcyNak5vBVzF0iKqegT/iSbRBK82T8u1OTo///3mwgHLgUX3+4ITs3O9NSf?= =?us-ascii?Q?1m83k2YBTysCMiukU/QbwBP1ylEkcRHI8J4u7l4zbAbOyu7X+c3okVS+xaoo?= =?us-ascii?Q?+jJWJ2SXAst28hSbrpafJ47G4rbDudi7sURwgBy5bQAgFhOaDtrC4g5gKsk2?= =?us-ascii?Q?rpz7RdlYlEXKsPwfUStRysdX1+2TLX0beKuu7nFkoQ/cmvWeusUHnOB4qOS2?= =?us-ascii?Q?jQG95i383BHyV6T+NbtwYBvKcPCkixATEa9PywetEAnulbLEcr/h2fEULT3Y?= =?us-ascii?Q?b8ZAZpXzU+BWkmGaoMm3v0PDXZaY6EGk4CbW7l1fYLA5DXof3YKJYxsStV4e?= =?us-ascii?Q?+698M07V5fOIwiklC8xItTcziDeJqS24yGBKczd/dH+InbA2set69M68SX2J?= =?us-ascii?Q?2XlA58tSxMz8uwMaTpaTGoiISFibCbBuTfTcaw19E0pxg+8KZu9GniLEBTOf?= =?us-ascii?Q?ogA2RHhlmdciE8js0Hxa8bEyLFFAJJGPF/3dpYkt0sg6t21QrQ6kgdS23jch?= =?us-ascii?Q?Ev8LCxWZ8VRDe1ZCnkpmOckJqmsmoXBDzEs1cXFPEuNX3yuw5yx5/mR1iM/E?= =?us-ascii?Q?WPU2J+lCsDelqY+kk6QeoXSWwzjmDeYQ6oLzocSJr0pjfPA0N9RQSe7r9wpU?= =?us-ascii?Q?A4ZfyLNSUrkNaCKjn5BFqZ/XBATazdpAmQdt4pjITniv4NBIWWqdDhxCSvK+?= =?us-ascii?Q?wcFfDbdV4dO1GholrkUHU3KAgrlRiCUTz81rLyAVtHx54eSqlx6vdluPkr1w?= =?us-ascii?Q?s6jc/DAMXx+ZIjh2O+OgBYL/svwkpzzgXji7EHlF9ZziWXh7QyY/WM6fsrTj?= =?us-ascii?Q?s7Vh4BO6AzZMqvUtmhUxScldslWFqNw=3D?= X-Exchange-RoutingPolicyChecked: hBEUfGBjwXImFMXXfvMHSxPl/bsBqSXQsQQv17EO0JYJvXL9d52uuktnjQJdX2dT6YYc6nCs56PjAyMH1tcvArLzEzi5q1iM4DOFvgm95wgp7OeE/vweTvnQ3RgO9gaVeSWIfXH6zOExc07Ld5wxmeLBIrT4xGhQc5f5JfFUirQzwoe6952GkvbnWOmaMuBbC/UD64JkqHlvYZEl1a+XZrLKVZOPKJuBjQQWwQcLQXH+HK7vpN40prFS6k2SDhfBoYy1OAEIF3jTYnIfbKONPPs40SWzLesTAnYO6w8Ln/1ZShqtr4mPnodLnIFqnyeiaALooCVMtBHrD0ObRPZiug== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 33859088-121d-41bd-7276-08df38c4518a X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 09:33:14.3504 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: QvysxCWnmlwMydjEsCnQWVINrnajeb3oXX7euASg0FGABHWHOjlcWwT5miPDxqhlh/MP8Gcqil5X7oGbXPNwTLiUlgCEmPTRrX7o7uy9N6c= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR02MB11789 X-Authority-Analysis: v=2.4 cv=Dt3Da2/+ c=1 sm=1 tr=0 ts=6ae8593b cx=c_pps a=jtbwDcC0Yi12le+aIJgOYg==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=zJRp6_cAMcgA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=_-M8LpHI31CeLmyZm6wg:22 a=64Cc0HZtAAAA:8 a=20KFwNOVAAAA:8 a=-2AbmpwzriJMpJNtN8kA:9 X-Proofpoint-GUID: dMgne0TC3eX1vytwQHs7zDwEGB2mRPCX X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfXwTV8T1c2vuj4 n/qJ50XBYAWT+54Na6drI1HA7M+J3sLWp9G1nsv1wEV43LLQsWwcnEnfhe1drwzcXl+XEm0PyeH gNrPrqe7UoaSTP3yl/S1bj4/e/C9IpSrsBj+3tI5R8VxOZbVArnhY4fOqc1pfswwgwzjboJUr3k F0Zjde623Xw5du4V2AvFlwCbjG6EZX9zwK9PmEwUQ9p1DEmDpIDxeCP/3MupCo5XbfYcALjuJm0 AL7Wsky0+3iZ9xx/JcPs63tGgPliTriBqfmoI6d1r/V+WXtZLcBcm2UIAl6giZuqJg04S5+AB68 23JqjBQ+rGPgEMlFyx19lq7HncuoycSV+xUsSVpOAOvzVuKYPfzrjNyReHgUDvH19bq2cTw+9ZW QfYDNQnwkYhAGy+Zs8SvJhrrqReEfoDtyU4Yvn1/jbdidIdofIjA3XzEHJPWf9/nP6nZ0F/wPsD hHJrgzlXpbIzwuSbkwA== X-Proofpoint-Spam-Info: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX+4E/rSGL1pVy hj4ruKpm+bEW2biKwZXBxFrRI31R0zXG4s0Ox+iVCRLYijUiJuAyd5wxFNiEKByVPWvmQ/9CcWZ q6sJX9S59i+d2kQzPOFeXtOAD0Waa2c= X-Proofpoint-ORIG-GUID: dMgne0TC3eX1vytwQHs7zDwEGB2mRPCX X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.138,FMLib:17.12.100.49 definitions=2026-11-02_03,2026-10-21_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: M42IU5SW4TWTSME4FM2JJ3Y3NIDAZ4TQ X-Message-ID-Hash: M42IU5SW4TWTSME4FM2JJ3Y3NIDAZ4TQ X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1793612919138154100 Content-Type: text/plain; charset="utf-8" For encrypted migration of VMs, QEMU provides the TLS-PSK authentication apart from TLS certificates. This mechanism relies on pre-shared keys (a secret key that is known to both sender and receiver prior to secure communication) for providing secure transfer of data. Libvirt handles the lifecycle of pre-shared keys, managing their generation, persistent storage, and cleanup. Add the "migrate_tls_psk_length" configuration attribute to qemu.conf to allow users to define the size of the pre-shared key. Signed-off-by: Abhisek Panda Reviewed-by: Peter Krempa --- src/qemu/libvirtd_qemu.aug | 1 + src/qemu/qemu.conf.in | 8 ++++++++ src/qemu/qemu_conf.c | 18 ++++++++++++++++++ src/qemu/qemu_conf.h | 1 + src/qemu/test_libvirtd_qemu.aug.in | 1 + 5 files changed, 29 insertions(+) diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug index dbcbbb04c0..fc61177ea0 100644 --- a/src/qemu/libvirtd_qemu.aug +++ b/src/qemu/libvirtd_qemu.aug @@ -71,6 +71,7 @@ module Libvirtd_qemu =3D | str_entry "migrate_tls_x509_secret_uuid" | str_entry "migrate_tls_priority" | bool_entry "migrate_tls_force" + | int_entry "migrate_tls_psk_length" =20 let backup_entry =3D str_entry "backup_tls_x509_cert_dir" | bool_entry "backup_tls_x509_verify" diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in index de14db6cde..4fdd655881 100644 --- a/src/qemu/qemu.conf.in +++ b/src/qemu/qemu.conf.in @@ -437,6 +437,14 @@ #migrate_tls_force =3D 0 =20 =20 +# The TLS-PSK authentication relies on pre-shared keys for providing secur= e transfer of data. +# When TLS-PSK is enabled for the migration operation, Libvirt manages the= lifecycle of the +# pre-shared key files. For the key generation process, users can specify = the pre-shared +# key size in bytes. The default value is set to 32 bytes. +# +#migrate_tls_psk_length =3D 32 + + # In order to override the default TLS certificate location for backup NBD # server certificates, supply a valid path to the certificate directory. I= f the # provided path does not exist, libvirtd will fail to start. If the path is diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 6d67939b6e..cca7776b80 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -77,6 +77,9 @@ VIR_LOG_INIT("qemu.qemu_conf"); #define QEMU_BACKUP_PORT_MIN 10809 #define QEMU_BACKUP_PORT_MAX 10872 =20 +#define QEMU_MIGRATE_TLS_PSK_LENGTH 32 +#define QEMU_MIGRATE_TLS_PSK_LENGTH_MAX 512 + VIR_ENUM_IMPL(virQEMUSchedCore, QEMU_SCHED_CORE_LAST, "none", @@ -616,6 +619,17 @@ virQEMUDriverConfigLoadSpecificTLSEntry(virQEMUDriverC= onfig *cfg, =20 #undef GET_CONFIG_TLS_CERTINFO_COMMON #undef GET_CONFIG_TLS_CERTINFO_SERVER + + if (virConfGetValueUInt(conf, "migrate_tls_psk_length", &cfg->migrateT= LSPSKLength) < 0) + return -1; + + if (cfg->migrateTLSPSKLength > QEMU_MIGRATE_TLS_PSK_LENGTH_MAX) { + virReportError(VIR_ERR_CONF_SYNTAX, + _("migrate_tls_psk_length must not be greater than = %1$d"), + QEMU_MIGRATE_TLS_PSK_LENGTH_MAX); + return -1; + } + return 0; } =20 @@ -1596,6 +1610,10 @@ virQEMUDriverConfigSetDefaults(virQEMUDriverConfig *= cfg) =20 #undef SET_TLS_VERIFY_DEFAULT =20 + if (cfg->migrateTLSPSKLength =3D=3D 0) { + cfg->migrateTLSPSKLength =3D QEMU_MIGRATE_TLS_PSK_LENGTH; + } + return 0; } =20 diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index 9faf6db206..b700829342 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -170,6 +170,7 @@ struct _virQEMUDriverConfig { char *migrateTLSx509secretUUID; char *migrateTLSpriority; bool migrateTLSForce; + unsigned int migrateTLSPSKLength; =20 char *backupTLSx509certdir; bool backupTLSx509verify; diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qe= mu.aug.in index c97d8d7081..9ba39815a6 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -45,6 +45,7 @@ module Test_libvirtd_qemu =3D { "migrate_tls_x509_secret_uuid" =3D "00000000-0000-0000-0000-000000000000= " } { "migrate_tls_priority" =3D "@SYSTEM" } { "migrate_tls_force" =3D "0" } +{ "migrate_tls_psk_length" =3D "32" } { "backup_tls_x509_cert_dir" =3D "/etc/pki/libvirt-backup" } { "backup_tls_x509_verify" =3D "1" } { "backup_tls_x509_secret_uuid" =3D "00000000-0000-0000-0000-000000000000"= } --=20 2.43.7 From nobody Thu Nov 12 15:08:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1793613072; cv=pass; d=zohomail.com; s=zohoarc; b=GGFJkDAS6ilaO7AtvbCUbzSi9AQCuGeHk2aI5ORP5XV4yUOJUG4UUpNjy7Ua4oVepMvz07fbsVpMTrNT7Uxj1JoWrWizMRqhzK7z11VT9uoxVxBW/cqR/GWzy/yrsegyvLvg6w8S7pFHOYhVS2vWsvVVJfEdj/gqQF9SdJdV2Jk= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793613072; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=3NkeNc0/2G2HkfjcfXG7PF+KyCt8VCTb0bVmr68nyek=; b=nRORkleywpF8GSzoDz0LcBJ7Djjy5y9I/aPApCdtmtpi/N2iWfW5qikJ82pHDp8xVUHzXJv8thmH3wnKs1VHOBPREq0gmhdYGF08nYZeBi5G8UlNdo38ny4MNTWWg5ULXbq6YJJ+BL+XDhHBboQlxaaQBdQSznRoUOlD/a8TiOU= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1793613072718344.75110815816026; Mon, 2 Nov 2026 01:51:12 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 93F0141ADC; Mon, 2 Nov 2026 04:51:11 -0500 (EST) Received: from [172.19.199.19] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 894F141D90; Mon, 2 Nov 2026 04:44:46 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 4FA7E41B55; Mon, 2 Nov 2026 04:44:21 -0500 (EST) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 35F4841C39 for ; Mon, 2 Nov 2026 04:34:53 -0500 (EST) Received: from pps.filterd (m0127840.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6A29AQTv215479 for ; Mon, 2 Nov 2026 01:34:52 -0800 Received: from cy7pr03cu001.outbound.protection.outlook.com (mail-westcentralusazon11020129.outbound.protection.outlook.com [40.93.198.129]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4hncnsk5wb-2 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 02 Nov 2026 01:34:51 -0800 (PST) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by MWHPR02MB11789.namprd02.prod.outlook.com (2603:10b6:303:2a9::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 09:33:16 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%5]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 09:33:16 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=3NkeNc0/2G2HkfjcfXG7PF+KyCt8VCTb0bVmr68ny ek=; b=ZlUjG0x5wDHie3yw7FOp/RwmYaI8E54IcrmI45wqkvZFt4tmrVCIs4/fk qacIy7oCP5OFq76MUY12hjkW7w166wAX4rtOR97CbUjgimGkM8dxP51LYdX5OyFQ RulNN3TR37hx0Ed9Eyh1gxgcpqWvaf03ZOWqb3oa9I5qw41EJskFgfpQOAKcMqEx HipX7N9MmlXJNh7KlMUPoWzaVPvs1khzCiYWRUaL3Y9JLre6/SSdAgmFHBLvz3fE NfZluPHtKF+NOK+zFjFg1RtNzE5E0yKbv16xTEVzcOAKpwDfsJWE870eV0PQf/4j 1+tdhxrNbg9kuNYpsqhWJj3w7n68A== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=syVnoSXy7ODCvpsM4CG3D0dYtd/l7yjamHv+tXd9n+MIX6vNaLdMnpfcwYfXG6HNEtft9vrNaf5jFjXMlVcYap6DJ3GwkZCt8auFhwd5Ui/UTjvpWYQpH53X+l+rG3+pASPRhna5DuWwQ8bbzNCP8zqdwPa+Yh3fYRsLNftmVdrFXKckTr2BSBvTMkRTHC50tsSepWQKlOkh9uRs+9IVbR8Tr+RNwsiwJglZrtzT4Av2mG5L0ybZgKraIA7Uuh8HRMXgLqfbKa5dUp2kVkSo3wPRPLGDvM7otko67Sj2F8xziWpHjSBd7WiDhMn+DgG6le4FATZci+ZVNg7AkKi5uw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3NkeNc0/2G2HkfjcfXG7PF+KyCt8VCTb0bVmr68nyek=; b=s0xSbWwDAb8sJiz/2GZDmggkpYR8IHhyGRjUsyXT6945nzkWRPWYK6OtGaTC6xBR0WBpDTv74Dx8chwO91preYSgA3jrFpwXXDmxPfqtg4m/CMQ8DOl3SQZuum5MllkwfDBeTfMXqaCPNuMhtZwLt4lFeUjQk+T97H339mcfBeW4Df/VHPJntl9auzDCmpJjEl20BxhuwBmyTJpKTRoY4KPNh3ZofUZK0qSra2YO1lMDwniOhamHqSKUWcf6gUcA6fggRnqzFd53GXe8WSB0Z9/YsIUP3MPoTIefNH2a4bjyagASWNLpHJq21nEGtn5MEmMJSf3luy1jMnQ4QcVxMg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3NkeNc0/2G2HkfjcfXG7PF+KyCt8VCTb0bVmr68nyek=; b=ksdo2uuGU5RKr75XwuKl4yMZH9AaDV94AosKJWhZvQMKzsEkeRVlpkjFyPFaKx6kSOM82Vi4CVin5FfgDgFDHlKk4Zq4ugkc9xO3bOABqLZMQHKdiZBGXkfCJ0XWKGkZkNzGUQR4T8BzMXfOmGjB7olEnqC9HdP4fmrT+MGBIrsGhwTQZUt/9ERe1vcoID5xv0xb91Ea5sAir2P/ej1nCbbygzOp1S1Nm8cMkwa11KPhHKVEgvsZ4dLbf0/e0zZnH9jfypmMnaPu5JaeJWrP4ywuhsitfHv7XSBfj3aA7fyoVZP2OBQgwrwuNeY6JSicU8EHoDUDJa1tfiVoODdFOQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nutanix.com; From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v5 2/8] qemu: Manage a pre-shared key's lifecycle Date: Mon, 2 Nov 2026 09:32:39 +0000 Message-ID: <20261102093300.44810-3-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20261102093300.44810-1-abhisek.panda1@nutanix.com> References: <20261102093300.44810-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ0PR05CA0179.namprd05.prod.outlook.com (2603:10b6:a03:339::34) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|MWHPR02MB11789:EE_ X-MS-Office365-Filtering-Correlation-Id: 404ec6ee-1dd0-4143-0214-08df38c452d9 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|376014|261021121427099003|261021123027099003|261022105027099003|261022075727099003|261009223327099003|261009220027099003|261009221227099003|261009221727099003|261009223027099003|261026121527099003|261026140227099003|261028144727099003|10067099003|56012099006|260925021311599003|260925021911599003|260925022911599003|22082099003|18002099003|6133799003|3023799007; X-Microsoft-Antispam-Message-Info: 5IWuMP2drzIhn+KKMJZfNhw6o7O5nmwEmo6tGKe8NwNzvkJbZNjefSor7JWfCtk5GgNxXVLFeXmfGAGqaxJe/UBvMNXDnqbjF/koTajd2ySKQrS6EoSMqc1KxVWj/kAXtiJJeeiezZwyUeriBD4JmgXt2vA6lidyWs6YJ1jBDqDkcOSbuThbPJIANE3ArS5Htxkn3uF+jSCbW/xzyrBf3bvY3ILgABG4DZMhkyulK5WimvUnSyIB446s4qLh9OsFiWyyXlM2kWF8ISNLET5p2FTusAR84oYCge181QU7ibSkrlVg1UoPZgXOOrxRFPKNBcvvOuhCGIl1fCIvNa7qHryuYHmtpxiKnKNyNDh8N5rA8mAagSneJF8GciB9Jml4/VJtYGW+AC1PbdKU15WfPhX4eAxYUdtSZPLj5NGzV9IjonmVnGw8YroxpKpE7HEDGv/kiua0KS+JojEIAkfBpWSj2MTk1lAR5hW7KxpvhmcT4JECB9tNGWzUmued1WvLWoj//Ml3gGcbekjKK4qax9a+iBRBwbByL8zLIUv4zEKvubkaG2fByqZBlEg4bljv64bILufWga57WQ2UZLzCYV56izbZWAQLrSPh7azFHjUcOMK9ep2RFMoca90oMX986L1aPEdDBcwXcz8Ye4z1ZMzf5t1Mrqx/yRQEqIm9iZw= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(376014)(261021121427099003)(261021123027099003)(261022105027099003)(261022075727099003)(261009223327099003)(261009220027099003)(261009221227099003)(261009221727099003)(261009223027099003)(261026121527099003)(261026140227099003)(261028144727099003)(10067099003)(56012099006)(260925021311599003)(260925021911599003)(260925022911599003)(22082099003)(18002099003)(6133799003)(3023799007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?hYaXmriHQbMj5Ov3amWBHjmBpVag1dWgHUGEHeeaBzZcE1aSIFhBrgrONc3s?= =?us-ascii?Q?nlaLoGjEuptrBT6KaE5337rqRXn0pqUaTEhCH/BlsbjMbamL8I8eHoAzg0IF?= =?us-ascii?Q?G+w3Sslb0iZr7Tfol5ikNDYgZ5oByusU+lJwynEHkTTtR1Ay4UvUhU3jT0Kz?= =?us-ascii?Q?hHsTmKVifkNn2b6YzOzaCObaMQM2JIHKLOv+UEy5/0K2v57YgtJDTvEZ5Brk?= =?us-ascii?Q?a/lK4KzkLwqL6vselaWr9YDswPoUBykFl0PP4pTyQJm4xV/QWOzADyZG6U/U?= =?us-ascii?Q?1y5bU/E2DxJKDDUQLQ3Xln0HDHO2ckcH8t/lb9Tq2PkE5DPfY3XkojfbwjpS?= =?us-ascii?Q?BRnLzcpCYzBxCZWMbG75TEllspxwToBN8ellwYBPCjMqaVww2drEQpZ0sf2B?= =?us-ascii?Q?8NAejYukQzw3NLEitiyuVWESeHYJeDwKgz4B/w08b249V4zPSLushhONEvZC?= =?us-ascii?Q?7o4FT1wrQIysexDmKxWaa146FUJLqbGIegx+zllzNkuhJkcQOukhPfbzFDnp?= =?us-ascii?Q?ctakFHw4iUKFMZcE9KHLHOAMvVMF09H6j0+oDXCsR4hF05mqMPLGc7lAUtfP?= =?us-ascii?Q?P5EAg9N8AnkgDKb/8ugmclew0gq2XMZlQfEpgNi5c1LLXGo2y+7H+QsmAJOv?= =?us-ascii?Q?/gjpPDCqwNvOGsTDXpysqiTg/nFc+9Uhi0QJFcKd6Ga7Xw+UbOsQx8itEoy/?= =?us-ascii?Q?Yx5qPncSgQjR577soMQElrmyAi0YBdNTnQls6LpS4lE7jLxKD7+/LthlgMVS?= =?us-ascii?Q?M5xCI+zRc03XdWaQFasYXQxmxNOW5b04eGqu3owyljSMLLw7u9pGtz2W1W7Q?= =?us-ascii?Q?pPl3nTrYrsbyoOGQ6i1g4xJ/KDtwiIvmA86tbGNxB4YBm+wtIbth5p/Ok6U1?= =?us-ascii?Q?I/ebhxbyeAMVNj+7cVl3AO0uZ8hha9BfbO3w5YXPc4+mNwPClMbyXg/qY1FO?= =?us-ascii?Q?A6goX59BIdZ6OunpeAT2ZFsgMXmmhZ2EfuyEjYAl/4QfijNnhodTdIjP7sqe?= =?us-ascii?Q?HeCqNidqQYYBYl5dgKalkeZmDPHxS7O7xdZBryC7RnfnkugjuanL+yYRpbG6?= =?us-ascii?Q?J7o6PNUGA9DT4WTL13CgYDEhiQ4yAxwLmSECxbUsB/G/EtYW+Y+oTD3/dW6b?= =?us-ascii?Q?fLdl7lTJc+axrg+Y79t1P0+EzPFfhO4TkJR/aMll81gTaHcaGW+dcYjeN8Qx?= =?us-ascii?Q?xwNldXK2yF1AynFlioUWuXvlrg2wPDQx4g70Qj+h6gGcRpucXdV5aOlBCi9z?= =?us-ascii?Q?iZnRYsJIFyEBESHxS1+/fKyupK86I2iFoi2bMduOt+gBJ+rabBQXouIkQgE+?= =?us-ascii?Q?fOPAsupMoLU7avW86wh7HufsddgBWPJnKE+DalFivbE7k4wQuzkmKs+mIVEC?= =?us-ascii?Q?tG9/0TR6BWoG2WLKBI9zwDxLfsrPWJbmCsH+ZlrDevy8VKVYuAud+gdhT2wO?= =?us-ascii?Q?P9+kgHwDsQrsQZE3SY5blJXi1TDdCwvwPokUXaIPzg1i+BtfkeEY9tTGKATm?= =?us-ascii?Q?/T7d+9S6ktZPuvhfNR4qFBMghoZd3KaKxhwn3w2OucxQDdHsNir8gSVT6k5m?= =?us-ascii?Q?WAPcymPNylTb2OrsAedOqKwWp53ws4aQ4UbZemx7tvQoy6eATJ+x6TkfWrsb?= =?us-ascii?Q?guhg+346oWSdb9t/MvwBbyEKQ+JiE6SkWv41xiLWlZyhjLKbP12TyyEVnzgX?= =?us-ascii?Q?zGvgJoKCCP0pMZQhBQrrI0uktfST/MtSAKsMDZY+Qf01EEd5cfM43JHQ9uvi?= =?us-ascii?Q?SR5Q6DabPElk1TyOabnRXhG7AnyZoFY=3D?= X-Exchange-RoutingPolicyChecked: DWUSY9MQ/rjkoQHpQDDoRAvPlkNfEodGxLruxC/zqLE4AvR9nS8793nJ/Q/6HGzL1ru56B2hk1ao9FvXRSUstpr3mwmibEDAQTTOPBh0yEv9z7E9Ref8j8wXLTwo8JLbqAOdYHLvhHNoC4zKwSTzvalEe/gC2+Jx45l1yuYtrbfIjiySdau4a2zXAnFM397yuQuGemyl2Fie3XrCmczyxDXqAqzWdVLhi4w3mwISp3QyfOp/BjN4S/jcRz4LOtnIIy3iH2gD5EOAG6NKeKm61ZO0RhDZs+ANqJGnbsnaMX3U5nhV1bYZ2BG9hr1DuonAfDGsiFfudmaepe0pv8TmJA== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 404ec6ee-1dd0-4143-0214-08df38c452d9 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 09:33:16.5592 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Ie+/PLgPCoExBL875UfII2oEbh9uiAKrsJDNM4Sk0RwuwxF5X0DrilkUj1HPZxXTZ3r4lQoiNDDkAv0jVAWuaWrD7eiM/FzfimC5Te62vls= X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR02MB11789 X-Authority-Analysis: v=2.4 cv=Dt3Da2/+ c=1 sm=1 tr=0 ts=6ae8593b cx=c_pps a=jtbwDcC0Yi12le+aIJgOYg==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=zJRp6_cAMcgA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=_-M8LpHI31CeLmyZm6wg:22 a=64Cc0HZtAAAA:8 a=nIUnP791aJ5e-PKSv1IA:9 X-Proofpoint-GUID: HOfQMNXsCNQf7xXi_D3GodGZYXLNP17f X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfXwJIymDVLqXaa DO9TSPHPzu6uscDSwMwv7rQaNLoYact680yr3h05TS5vgBF8DeQqtUw9s0gURw7MrgzGIxWJ1pr OwgjLtyhuWN/m4I/5iWvXrR3HzBqxPShhlIu5XqeqlBAnuVZP+Uin3tzwfGmj2v8EFiQ8C2+lCD tI7nZnmAwsr/4VryHYegZOj5hVhaTKRFX8tGlj0uW4PAj9uLd492b9n6Um363moRR//5UWfEcvX 5nKyskVltOJRvXtWV8/+N6f3kffYefr1M+2Yrg0R9IwjeEqeGWdqmqZmq7358lpzXx8Tp36Hljo 3c5+erwgEBLb0mSnX1RlQ4bsWB39sgi1+V4SIvm91/f5HIhrhiyNTuEJEL2GgO2PsGo1IbmaYN3 3C9gr8qj8+rNvkRBbdpEv4d1XxhvBGKHJMs+tCaT9TK/vfCayByTeg9ipou3tPowLnuF1MB5xol dv0vmc4vbLXWU/5PGqA== X-Proofpoint-Spam-Info: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfXxxtbvpiNWal0 Txs/XDeQtg+XKHDBpu4EAfhT7Qhma1dPpuvvO1BJJ09k+1cKLFa1rOfbbw6OdoQXLW064OK6AE7 BRKyUTxv14gL8frEY4+YC+Ja8Ir20n4= X-Proofpoint-ORIG-GUID: HOfQMNXsCNQf7xXi_D3GodGZYXLNP17f X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.138,FMLib:17.12.100.49 definitions=2026-11-02_03,2026-10-21_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: KWWNUODIBKFFB7OLL6OW7JIUT56QTBQS X-Message-ID-Hash: KWWNUODIBKFFB7OLL6OW7JIUT56QTBQS X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1793613075559154100 Content-Type: text/plain; charset="utf-8" Libvirt by default attempt to use the TLS-PSK-enabled VM migration. The source host adds the pre-shared key in the migration cookie. Upon parsing the migration cookie, the destination host informs the source host whether to use TLS X.509 or TLS PSK during VM migration via the migration cookie. For a migration session, Libvirt generates a random key of the specified length, and then stores the content, "qemu:", at /$ID-$VMNAME/keys.psk on the source host. This is because QEMU's tls-creds-psk object does not accept a raw key string as a parameter, it only accepts a dir argument pointing to a directory from which it can read the key file. Subsequently, it sends the key to destination by embedding it within the migration cookie. The destination's Libvirt extracts the key from the migration cookie. Upon migration completion or any failure, both source and destination Libvirt must delete the directory containing the session's keys.psk. Signed-off-by: Abhisek Panda --- src/qemu/qemu_conf.c | 4 ++ src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 1 + src/qemu/qemu_domain.h | 1 + src/qemu/qemu_driver.c | 6 ++ src/qemu/qemu_migration.c | 104 ++++++++++++++++++++++++++++- src/qemu/qemu_migration.h | 3 + src/qemu/qemu_migration_cookie.c | 67 ++++++++++++++++++- src/qemu/qemu_migration_cookie.h | 5 ++ src/qemu/qemu_process.c | 3 + tests/qemumigrationcookiexmltest.c | 12 +++- 11 files changed, 200 insertions(+), 7 deletions(-) diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index cca7776b80..f5c5437c89 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -168,6 +168,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->cacheDir =3D g_strdup_printf("%s/cache/qemu", root); cfg->libDir =3D g_strdup_printf("%s/lib/qemu", root); cfg->swtpmStorageDir =3D g_strdup_printf("%s/lib/swtpm", root); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/run/psk", root); =20 cfg->saveDir =3D g_strdup_printf("%s/save", cfg->libDir); cfg->snapshotDir =3D g_strdup_printf("%s/snapshot", cfg->libDir); @@ -187,6 +188,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->stateDir =3D g_strdup_printf("%s/libvirt/qemu", RUNSTATEDIR); cfg->swtpmStateDir =3D g_strdup_printf("%s/swtpm", cfg->stateDir); cfg->channelTargetDir =3D g_strdup_printf("%s/channel", cfg->state= Dir); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/psk", cfg->stateDir); =20 cfg->cacheDir =3D g_strdup_printf("%s/cache/libvirt/qemu", LOCALST= ATEDIR); =20 @@ -214,6 +216,7 @@ virQEMUDriverConfig *virQEMUDriverConfigNew(bool privil= eged, cfg->stateDir =3D g_strdup_printf("%s/qemu/run", rundir); cfg->swtpmStateDir =3D g_strdup_printf("%s/swtpm", cfg->stateDir); cfg->channelTargetDir =3D g_strdup_printf("%s/channel", cfg->state= Dir); + cfg->tlsPSKStateDir =3D g_strdup_printf("%s/psk", cfg->stateDir); =20 cfg->configBaseDir =3D virGetUserConfigDirectory(); =20 @@ -375,6 +378,7 @@ static void virQEMUDriverConfigDispose(void *obj) g_free(cfg->dbusStateDir); g_free(cfg->rdpStateDir); g_free(cfg->vncStateDir); + g_free(cfg->tlsPSKStateDir); =20 g_free(cfg->libDir); g_free(cfg->cacheDir); diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h index b700829342..2db3440514 100644 --- a/src/qemu/qemu_conf.h +++ b/src/qemu/qemu_conf.h @@ -113,6 +113,7 @@ struct _virQEMUDriverConfig { char *dbusStateDir; char *rdpStateDir; char *vncStateDir; + char *tlsPSKStateDir; /* These two directories are ones QEMU processes use (so must match * the QEMU user/group */ char *libDir; diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index a4e5f92840..f4d470553d 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -1990,6 +1990,7 @@ qemuDomainObjPrivateFree(void *data) virObjectUnref(priv->monConfig); g_free(priv->lockState); g_free(priv->origname); + g_free(priv->migTLSPSK); =20 virChrdevFree(priv->devs); =20 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index 23e99dc68c..053140f7ec 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -139,6 +139,7 @@ struct _qemuDomainObjPrivate { char *origname; int nbdPort; /* Port used for migration with NBD */ unsigned short migrationPort; + char *migTLSPSK; /* Hex-encoded pre-shared key for TLS-PSK-enabled VM = migration session */ unsigned short backupNBDPort; int preMigrationState; unsigned long long preMigrationMemlock; /* Original RLIMIT_MEMLOCK in = case diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 5922065897..c95a1978cf 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -664,6 +664,12 @@ qemuStateInitialize(bool privileged, cfg->vncStateDir); goto error; } + if (virDirCreate(cfg->tlsPSKStateDir, 0711, 0, 0, + VIR_DIR_CREATE_ALLOW_EXIST) < 0) { + virReportSystemError(errno, _("Failed to create TLS PSK state dir = %1$s"), + cfg->tlsPSKStateDir); + goto error; + } =20 qemu_driver->inhibitor =3D virInhibitorNew( VIR_INHIBITOR_WHAT_SHUTDOWN, diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 76661de09a..61d0cc5e00 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -59,6 +59,7 @@ #include "virprocess.h" #include "virdomainsnapshotobjlist.h" #include "virutil.h" +#include "virsecureerase.h" =20 #define VIR_FROM_THIS VIR_FROM_QEMU =20 @@ -1503,6 +1504,92 @@ qemuMigrationSrcIsAllowedHostdev(const virDomainDef = *def) } =20 =20 +void +qemuMigrationDeletePSKDir(virQEMUDriver *driver, virDomainObj *vm) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + qemuDomainObjPrivate *priv =3D vm->privateData; + g_autofree char *dir_path =3D NULL; + g_autofree char *shortName =3D NULL; + + if (priv->migTLSPSK) { + virSecureEraseString(priv->migTLSPSK); + g_clear_pointer(&priv->migTLSPSK, g_free); + } + + if (!(shortName =3D virDomainDefGetShortName(vm->def))) { + VIR_WARN("Could not get the shortened domain name for domain: %1$s= ", + vm->def->name); + return; + } + + dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName); + + if (virFileIsDir(dir_path) && + virFileDeleteTree(dir_path) < 0) + VIR_WARN("Failed to delete the directory %s containing the pre-sha= red keys for migration of domain %s", + dir_path, vm->def->name); +} + + +static int +qemuPersistTLSPSKHelper(int pskFD, + const char *pskPath, + const void *opaque) +{ + const char *key =3D opaque; + + if (safewrite(pskFD, "qemu:", 5) < 0 || + safewrite(pskFD, key, strlen(key)) < 0) { + virReportSystemError(errno, + _("Unable to write the pre-shared key to file= '%1$s'"), + pskPath); + return -1; + } + + return 0; +} + + +static int +qemuMigrationPersistPSK(virQEMUDriver *driver, virDomainObj *vm, const cha= r *tlsPSK) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + g_autofree char *dir_path =3D NULL; + g_autofree char *key_path =3D NULL; + g_autofree char *shortName =3D NULL; + + if (!(shortName =3D virDomainDefGetShortName(vm->def))) { + virReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not get the shortened domain name for doma= in: %1$s"), + vm->def->name); + return -1; + } + + dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName); + key_path =3D g_strdup_printf("%s/keys.psk", dir_path); + + if (virDirCreate(dir_path, 0711, 0, 0, + VIR_DIR_CREATE_ALLOW_EXIST) < 0) { + virReportSystemError(errno, + _("Could not create the directory %1$s for st= oring PSKs"), + dir_path); + goto error; + } + + if (virFileRewrite(key_path, S_IRUSR, cfg->user, + cfg->group, qemuPersistTLSPSKHelper, + tlsPSK) < 0) + goto error; + + return 0; + + error: + qemuMigrationDeletePSKDir(driver, vm); + return -1; +} + + static int qemuDomainGetMigrationBlockers(virDomainObj *vm, int asyncJob, @@ -2739,6 +2826,9 @@ qemuMigrationSrcBeginXML(virDomainObj *vm, cookieFlags) < 0) return NULL; =20 + if (mig->tlsPSK && qemuMigrationPersistPSK(driver, vm, mig->tlsPSK) < = 0) + return NULL; + if (xmlin) { g_autoptr(virDomainDef) def =3D NULL; =20 @@ -2802,7 +2892,7 @@ qemuMigrationSrcBeginPhase(virQEMUDriver *driver, unsigned int flags) { qemuDomainObjPrivate *priv =3D vm->privateData; - unsigned int cookieFlags =3D QEMU_MIGRATION_COOKIE_LOCKSTATE; + unsigned int cookieFlags =3D QEMU_MIGRATION_COOKIE_LOCKSTATE | QEMU_MI= GRATION_COOKIE_TLS_PSK; =20 VIR_DEBUG("driver=3D%p, vm=3D%p, xmlin=3D%s, dname=3D%s," " cookieout=3D%p, cookieoutlen=3D%p," @@ -4233,6 +4323,8 @@ qemuMigrationSrcConfirmPhase(virQEMUDriver *driver, privJob->stats.mig.downtime =3D privMigJob->stats.mig.downtime; } =20 + qemuMigrationDeletePSKDir(driver, vm); + if (flags & VIR_MIGRATE_OFFLINE) return 0; =20 @@ -5281,6 +5373,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver, =20 error: virErrorPreserveLast(&orig_err); + qemuMigrationDeletePSKDir(driver, vm); =20 if (qemuDomainObjIsActive(vm)) { int reason; @@ -6402,8 +6495,10 @@ qemuMigrationSrcPerformJob(virQEMUDriver *driver, } =20 endjob: - if (ret < 0) + if (ret < 0) { virErrorPreserveLast(&orig_err); + qemuMigrationDeletePSKDir(driver, vm); + } =20 if (virDomainObjIsFailedPostcopy(vm, vm->job)) { ignore_value(qemuMigrationJobSetPhase(vm, QEMU_MIGRATION_PHASE_POS= TCOPY_FAILED)); @@ -7041,6 +7136,8 @@ qemuMigrationDstFinishActive(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_STATS) < 0) VIR_WARN("Unable to encode migration cookie"); =20 + qemuMigrationDeletePSKDir(driver, vm); + qemuMigrationDstComplete(driver, vm, inPostCopy, VIR_ASYNC_JOB_MIGRATION_IN, vm->job); =20 @@ -7051,6 +7148,8 @@ qemuMigrationDstFinishActive(virQEMUDriver *driver, * overwrites it. */ virErrorPreserveLast(&orig_err); =20 + qemuMigrationDeletePSKDir(driver, vm); + if (qemuDomainObjIsActive(vm)) { if (doKill) { qemuProcessStop(vm, VIR_DOMAIN_SHUTOFF_FAILED, @@ -7209,6 +7308,7 @@ qemuMigrationProcessUnattended(virQEMUDriver *driver, else qemuMigrationSrcComplete(driver, vm, job); =20 + qemuMigrationDeletePSKDir(driver, vm); qemuMigrationJobFinish(vm); =20 if (!virDomainObjIsActive(vm)) diff --git a/src/qemu/qemu_migration.h b/src/qemu/qemu_migration.h index 7e9410e1f7..ce15f8024b 100644 --- a/src/qemu/qemu_migration.h +++ b/src/qemu/qemu_migration.h @@ -279,3 +279,6 @@ int qemuMigrationAnyRefreshStatus(virDomainObj *vm, virDomainAsyncJob asyncJob, virDomainJobStatus *status); + +void +qemuMigrationDeletePSKDir(virQEMUDriver *driver, virDomainObj *vm); diff --git a/src/qemu/qemu_migration_cookie.c b/src/qemu/qemu_migration_coo= kie.c index 7311a8294b..c6c912e3dc 100644 --- a/src/qemu/qemu_migration_cookie.c +++ b/src/qemu/qemu_migration_cookie.c @@ -20,6 +20,7 @@ =20 #include #include +#include =20 #include "locking/domain_lock.h" #include "virerror.h" @@ -27,6 +28,7 @@ #include "virnetdevopenvswitch.h" #include "virstring.h" #include "virutil.h" +#include "virsecureerase.h" =20 #include "qemu_domain.h" #include "qemu_migration_cookie.h" @@ -52,6 +54,7 @@ VIR_ENUM_IMPL(qemuMigrationCookieFlag, "allowReboot", "capabilities", "block-dirty-bitmaps", + "psk", ); =20 =20 @@ -165,6 +168,9 @@ qemuMigrationCookieFree(qemuMigrationCookie *mig) g_free(mig->name); g_free(mig->lockState); g_free(mig->lockDriver); + if (mig->tlsPSK) + virSecureEraseString(mig->tlsPSK); + g_free(mig->tlsPSK); g_clear_pointer(&mig->jobData, virDomainJobDataFree); virCPUDefFree(mig->cpu); qemuMigrationCookieCapsFree(mig->caps); @@ -575,6 +581,51 @@ qemuMigrationCookieAddCaps(qemuMigrationCookie *mig, } =20 =20 +static int +qemuMigrationCookieAddTLSPSK(qemuMigrationCookie *mig, + virQEMUDriver *driver, + virDomainObj *vm) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + qemuDomainObjPrivate *priv =3D vm->privateData; + gnutls_datum_t psk_key =3D {NULL, 0}; + g_autofree char *key =3D NULL; + size_t key_len; + int ret; + + /* Generate the pre-shared key exactly once for a migration session*/ + if (priv->migTLSPSK) { + mig->tlsPSK =3D g_strdup(priv->migTLSPSK); + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + return 0; + } + + ret =3D gnutls_key_generate(&psk_key, cfg->migrateTLSPSKLength); + if (ret < 0) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Generation of a pre-shared key failed")); + return -1; + } + key_len =3D (psk_key.size*2) + 1; + key =3D g_new0(char, key_len); + + ret =3D gnutls_hex_encode(&psk_key, key, &key_len); + if (ret < 0) { + gnutls_free(psk_key.data); + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Hex encoding of a PSK key failed")); + return -1; + } + + priv->migTLSPSK =3D g_strdup(key); + mig->tlsPSK =3D g_steal_pointer(&key); + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + + gnutls_free(psk_key.data); + return 0; +} + + static void qemuMigrationCookieGraphicsXMLFormat(virBuffer *buf, qemuMigrationCookieGraphics *grap) @@ -890,6 +941,9 @@ qemuMigrationCookieXMLFormat(virQEMUDriver *driver, if (mig->flags & QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS) qemuMigrationCookieBlockDirtyBitmapsFormat(buf, mig->blockDirtyBit= maps); =20 + if ((mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) && mig->tlsPSK) + virBufferAsprintf(buf, "%s\n", mig-= >tlsPSK); + virBufferAdjustIndent(buf, -2); virBufferAddLit(buf, "\n"); return 0; @@ -1396,6 +1450,12 @@ qemuMigrationCookieXMLParse(qemuMigrationCookie *mig, qemuMigrationCookieBlockDirtyBitmapsParse(ctxt, mig) < 0) return -1; =20 + if (flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + mig->tlsPSK =3D virXPathString("string(./migration-key[1])", ctxt); + if (mig->tlsPSK) + mig->flags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + } + return 0; } =20 @@ -1471,14 +1531,17 @@ qemuMigrationCookieFormat(qemuMigrationCookie *mig, qemuMigrationCookieAddCaps(mig, dom, party) < 0) return -1; =20 + if (flags & QEMU_MIGRATION_COOKIE_TLS_PSK && + party =3D=3D QEMU_MIGRATION_SOURCE && + qemuMigrationCookieAddTLSPSK(mig, driver, dom) < 0) + return -1; + if (qemuMigrationCookieXMLFormat(driver, priv->qemuCaps, &buf, mig) < = 0) return -1; =20 *cookieoutlen =3D virBufferUse(&buf) + 1; *cookieout =3D virBufferContentAndReset(&buf); =20 - VIR_DEBUG("cookielen=3D%d cookie=3D%s", *cookieoutlen, *cookieout); - return 0; } =20 diff --git a/src/qemu/qemu_migration_cookie.h b/src/qemu/qemu_migration_coo= kie.h index 254372234d..fd3b4c5a56 100644 --- a/src/qemu/qemu_migration_cookie.h +++ b/src/qemu/qemu_migration_cookie.h @@ -35,6 +35,7 @@ typedef enum { QEMU_MIGRATION_COOKIE_FLAG_ALLOW_REBOOT, QEMU_MIGRATION_COOKIE_FLAG_CAPS, QEMU_MIGRATION_COOKIE_FLAG_BLOCK_DIRTY_BITMAPS, + QEMU_MIGRATION_COOKIE_FLAG_TLS_PSK, =20 QEMU_MIGRATION_COOKIE_FLAG_LAST } qemuMigrationCookieFlags; @@ -53,6 +54,7 @@ typedef enum { QEMU_MIGRATION_COOKIE_CPU =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_CPU), QEMU_MIGRATION_COOKIE_CAPS =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_CAPS), QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS =3D (1 << QEMU_MIGRATION_COO= KIE_FLAG_BLOCK_DIRTY_BITMAPS), + QEMU_MIGRATION_COOKIE_TLS_PSK =3D (1 << QEMU_MIGRATION_COOKIE_FLAG_TLS= _PSK), } qemuMigrationCookieFeatures; =20 typedef struct _qemuMigrationCookieGraphics qemuMigrationCookieGraphics; @@ -171,6 +173,9 @@ struct _qemuMigrationCookie { =20 /* If flags & QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS */ GSList *blockDirtyBitmaps; + + /* If flags & QEMU_MIGRATION_COOKIE_TLS_PSK */ + char *tlsPSK; }; =20 =20 diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index 3f1960f314..a33cb874f2 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -9453,6 +9453,9 @@ qemuProcessStop(virDomainObj *vm, /* Do this before we delete the tree and remove pidfile. */ qemuProcessKillManagedPRDaemon(vm); =20 + /* PSK files might be left at this point, clean them up */ + qemuMigrationDeletePSKDir(driver, vm); + qemuDomainCleanupRun(driver, vm); =20 qemuExtDevicesStop(driver, vm, !!(flags & VIR_QEMU_PROCESS_STOP_MIGRAT= ED)); diff --git a/tests/qemumigrationcookiexmltest.c b/tests/qemumigrationcookie= xmltest.c index bc0f68b8c5..41846b8631 100644 --- a/tests/qemumigrationcookiexmltest.c +++ b/tests/qemumigrationcookiexmltest.c @@ -160,8 +160,12 @@ testQemuMigrationCookieParse(const void *opaque) return -1; } =20 - /* set all flags so that formatter attempts to format everything */ - data->cookie->flags =3D ~0; + /* Set all flags except QEMU_MIGRATION_COOKIE_TLS_PSK so that formatter + * attempts to format everything except the migration-key element. Thi= s is + * because the value of the migration-key element is randomly generate= d every time + * the migration cookie is constructed. + */ + data->cookie->flags =3D ~QEMU_MIGRATION_COOKIE_TLS_PSK; =20 if (qemuMigrationCookieXMLFormat(&driver, priv->qemuCaps, @@ -225,10 +229,12 @@ testQemuMigrationCookieDom2XML(const char *namesuffix, * - lockstate: internals are NULL in tests, causes crash * - nbd: monitor not present * - dirty bitmaps: monitor not present + * - tls-psk: a new key is generated every time the migration cook= ie is constructed, so we can't test it */ unsigned int cookiePopulateFlagMask =3D QEMU_MIGRATION_COOKIE_LOCK= STATE | QEMU_MIGRATION_COOKIE_NBD | - QEMU_MIGRATION_COOKIE_BLOCK_= DIRTY_BITMAPS; + QEMU_MIGRATION_COOKIE_BLOCK_= DIRTY_BITMAPS | + QEMU_MIGRATION_COOKIE_TLS_PS= K; data->cookiePopulateFlags =3D ~cookiePopulateFlagMask; } =20 --=20 2.43.7 From nobody Thu Nov 12 15:08:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1793612091; cv=pass; d=zohomail.com; s=zohoarc; b=ermwaM+m7b6/kZ32XGwifMqc0bCXykolqvg86VljtJXe56MKcBkJpg2G002mZi0pMjf7pYq8w1YUzA5mKxRE0YAPt7Pa9+zQ1SDILvTVBQR9dr2Oi0kU4/7hVuxT5Y5383azSnP2w3SgPu8r2sOvCkcygvchfSJQcwma3GvWzP8= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793612091; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=UUsdpH5WH3P7gThBEJ+c1SdbyJ6FBIYQmNFxk8zCjLk=; b=Ts9mbPoGla45cXwHh83tC+M5gE4S9R2gtGaGrVmLmctPdcp/oNxpZodFvOsWxtRkIjPkvILwJiuEuDfc7MX/6ApJlMkQPvd0Oe+0wIpauA+M5LE+vvQVM9rXvu2ocfhIst2N3lA5vXekZU8nJvEnOjzkZLs9iVz5fdHzktSM8D0= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1793612091068626.5845727617912; Mon, 2 Nov 2026 01:34:51 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id B573C41B65; Mon, 2 Nov 2026 04:34:48 -0500 (EST) Received: from [172.19.199.19] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 5FBDC41A36; Mon, 2 Nov 2026 04:33:39 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 8FBAA3F321; Mon, 2 Nov 2026 04:33:26 -0500 (EST) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 1663B3F292 for ; Mon, 2 Nov 2026 04:33:22 -0500 (EST) Received: from pps.filterd (m0127841.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6A29AIFB391770 for ; Mon, 2 Nov 2026 01:33:22 -0800 Received: from byapr05cu005.outbound.protection.outlook.com (mail-westusazon11020131.outbound.protection.outlook.com [52.101.85.131]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4hndv7u31x-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 02 Nov 2026 01:33:21 -0800 (PST) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SJ0PR02MB8734.namprd02.prod.outlook.com (2603:10b6:a03:3d3::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 09:33:19 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%5]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 09:33:18 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=UUsdpH5WH3P7gThBEJ+c1SdbyJ6FBIYQmNFxk8zCj Lk=; b=SKNcOUrfGkz7ZjUnHTU2nft4cRvkU1qFIOyQ3S85uurJEiZaF1XWaGAzz OfzuXC9h9njMjmiZZmQsoqCP+8yjPGGyNI50UGyQTJL0tgWIuVLW0SOmvI/cEqx6 P7wGexiDUGHrDiaMTAphONpPEgAjJoA9iqmGiMrBkM7f9bBX5aaiQCAH4UGC6aaB oAd89+Kdqmv5ctfeOjAEwnUkR3Xtl3siTPEoLMOKcLyo0kEmqGAENnZQOlTdy2PC 3y9W4ltptkDe7AO/O0dNBjrbriDgrcf7lcY3ZqAzxm0o9l4iKX5GwDF9fGjt6ElD ckd0aLsc+4lROL3rPM7ZdAwX+86sg== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=cmXDEjZtBWoiGFoy/QfUVzNO8nDHmCf2ndYKXbLcpRGUKJt292YVHRI2/N4zIx1CH/Kvpqyyy0h64T1VtTcMfYLYv9JSIkNCp1hnpVooVcHF+JLP+nLIh8HxR9ZSSWPMJyiUMuqtSoN9+mSZJHJDz72JoBdGrH61FI+db6Vfl/sJ+IxqZHY6Y/RabZE4/0EiUfsBjGORIn+1kxN3bnRWZlCYeZY56xCQE91V6ltkzbxPpBXLQkegJmvW3mW/hS84oV49QBzlRAdGqdpY7jSRSu5kWSHdHlkS/EbTFMUjPesb45VYBNLCfFGLanXkdNtTXdyGa2/zro7v8anu+edhnA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=UUsdpH5WH3P7gThBEJ+c1SdbyJ6FBIYQmNFxk8zCjLk=; b=esQzgArlNXRAT5c3txKgOjTbvUYDOQ84kpVrqUVxV71p53H/KuLbgS3HX7x2uc0EKx1//lvXuq2KOuWX/4amOdU+HXJn47MrVi+HIn7h+aNUOzmMURDV1logPuUKZUbTzwH6eSU+Ezc6ZFRRZHslVX4HuRY+m8YrSERC81i6oSjVDYYKy86cnirHDraf4iduJ4nePONolk9bCDBGb0+sa1uE/DCf30bag5TNY7ST0R2IOkK1Noqm37JukZWBsRIqX2Gk9r+5mwTWNnsU8kTb5OfwEJ/EuOH9YO3Fwa7sVKB5B8IkEQklJLV2fO7tDejWwTsSbcvJoQs4jcatSvTKsA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UUsdpH5WH3P7gThBEJ+c1SdbyJ6FBIYQmNFxk8zCjLk=; b=X7AOaM2AonSzF6TcBS2RW2GxcGqffBOtFjMFauYCVaq/6fBhD4FERX3cADmEz4eKVlOojd4RIuudZ4R+Xml2erZQaFDL3GGpF+nG1dBH9A2iYYleYFVEy1PTtGmU9AtdLbjnfHpv/kb/U30c2aC+jottjD/3i/mCiliADVqy1yH996pRfx44CPVsjSOe2xRcEAQCbxdwxkwq8Z0sHEaku5Dz5GZi73GCYjqzpcZmz6ygMmSVGHJzmrKuVxglFuq/MhKeWdxpllmjOg/89TFRKTfRjL7wWf/hEYMhdoQvPn5l9cmZ8J4Rg1veXz4kPwIKCQujmfDTsojxDbklugeayg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nutanix.com; From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v5 3/8] qemu: Add support to build the tls-creds-psk object Date: Mon, 2 Nov 2026 09:32:40 +0000 Message-ID: <20261102093300.44810-4-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20261102093300.44810-1-abhisek.panda1@nutanix.com> References: <20261102093300.44810-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ0PR05CA0009.namprd05.prod.outlook.com (2603:10b6:a03:33b::14) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SJ0PR02MB8734:EE_ X-MS-Office365-Filtering-Correlation-Id: c0ace239-614a-441d-2d55-08df38c453f0 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|366016|376014|261021121427099003|261022105027099003|261009223327099003|261009220027099003|261009223027099003|261009221727099003|261009221227099003|261026140227099003|261026121527099003|261028144727099003|10067099003|56012099006|22082099003|18002099003|6133799003; X-Microsoft-Antispam-Message-Info: yjSgWCo53hpbkgNjDy1A1UPRca5NoybnrzMTR2tPfbyDpjrbOw+b2yQh7cOjSh4e6QOcUt4bsV4LtRa4vCIXP2Q6qWLjQ3pZ0P/griBfFVSNG1iSxNQwA8F9wsfFfFZDybL6T3XHmQTreKTtNaYxnVHzR58IT0yTGfPuJBqxgEMHHgqYh+uJaj8gFrw8HXsPZSwR7ZbPWtejiuv2fQ5s6R4UqM1DdnkwznCTOrc/TntZCVZwZABf1Vp3Ll1zYGYRZVDSaAIaCc1+IhtFMbdFyUHOzL/ECrNtOIW7eUOZ/Jk2OfIRQcAdzJvo4qLFCLjbg2D2L7YJSrRYVN/3g3wR+3Dy+Cel8p6khoNSW3n2fz6n+5a2w94zXay0zOu6OOo9CeTvpl5WxTPUVd1P/KtLWH276DGNTiknsWjL/rkk8FU/FfZ4uif+exWLgp4ACuSVtyBdr+Av2R/yJRBMXA0nDfeqC1/KgRPuzmBCbh/aeKXMm+UPLyVH8JwbsHbweaKL1qTbKIpuHHS451XhjQ+M+xFfxo8zscC5UNHyX+qqT6Dp1CLDN6xFCdT7Z+mRKdj1otlRA4VP9QSbRvopEPGzdEkQ9NFjMTrhwjGWbOHVFSsI+u4M2+EotuQDU/1QBtPz848VRG2RKRyXL8+ZZzZfkwPwwly2phKPV0azxydQ0Hg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(366016)(376014)(261021121427099003)(261022105027099003)(261009223327099003)(261009220027099003)(261009223027099003)(261009221727099003)(261009221227099003)(261026140227099003)(261026121527099003)(261028144727099003)(10067099003)(56012099006)(22082099003)(18002099003)(6133799003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?kldOeREtLRQzNgtnbhslTszvzGQsH5QN2frf5m2mgD1nqBcesuSYdlYeybkL?= =?us-ascii?Q?e22hVx1DLYNyh2SO48zFY0S1aTx26p8ZlTv0Cae9KV5CwAnsGYkV5/9zGTCN?= =?us-ascii?Q?707huAfMI3sxbCwXEQWi43RNbPPeIrB1a8eTqheVt8bISjkul1H6MjaCCtQb?= =?us-ascii?Q?KPGW7/cZICj9xc3v/XlyfGQSPOfrB3A9jaHKvxSZawubE3AgdltJQvMbvCxV?= =?us-ascii?Q?AhzqYRipiTc37fHuqaJ+Smi7w+el5jJIcfTlqUDPn9/AGNEcw4jjUZI9+DuJ?= =?us-ascii?Q?enuU3GV8Gt9UlwVKMuUAaE+lHmivwvEkf/w/tquhgfuZQGzHPsaMDS4/lWuE?= =?us-ascii?Q?sSoDUGbPQ0pgCnjlr7AfNh7/V8/iKmcZFtT9WhJ/GVAr4mMKHL5iWtKayyXf?= =?us-ascii?Q?bRDlHOXaSMkHQe1XChudS6SzgLpnr6qJD0brTFPhbIKFJIeceHi7T6X1GHOr?= =?us-ascii?Q?8apu9OjLXxFL0YECB2rZCAhLllC3+HrwPMz9TvgeQ4zb1xQPRs5Y83KNTtsJ?= =?us-ascii?Q?Lqr9X6gZfo7Qh1u/3AZj25KM8zHa87YcGrhfoyEbJplJ09G00HKwCeWpWU4r?= =?us-ascii?Q?bVrNtcjph2BYl5qZNfcAFT2WoYOGzuFBjZA9s7PVkpFo6/XFbpGdqpI6AeDR?= =?us-ascii?Q?/18oaH0U9VpUjKW770DphWz6pDr2Gw3uVKJsKbynUGFxnrEfkL/ErhUiT3oF?= =?us-ascii?Q?l9grLmBby5GCzlEGnPwn6zCHl10tjqXatWgUjeX0stpypAfgTZsqY6HD7ys5?= =?us-ascii?Q?bYQvs4QLDJmfwbzrj1+SS61trb6NBcS/r7gEhjC8zPp/KH3HBC1G96JS0OX+?= =?us-ascii?Q?V3GGLJt94QWErRqihjYhUcTLLOkc0uSR9v4Zauu8z31I7h6CgPfreL34OEGm?= =?us-ascii?Q?LuFND2GQS45pV/9otspuAE70GqyDob2MEocFIH0Vjy0g1KT7g7vHfIZlp8re?= =?us-ascii?Q?tGnsomtI6ltk8D7K/TmA7Yc1AVI6IdRf6VvyvfKtZJx5LLi3vDpfseVf0bj2?= =?us-ascii?Q?xR1dilxqLEeKshyIpFbp562b5fYw+F1gs+uJXFXCXBSjwht2HokWVlFrDFjv?= =?us-ascii?Q?gSuVUsZ3vjC9S4C4poIVuVnVYsogZc0Rz7UW4n7nOcSIWNA7Ygoml6mmcKLi?= =?us-ascii?Q?uWsWu0WkP43Er1ovp3ZRIWRKncUnJXYUnFUMCo5yyrYHHydOWIgiFIWqplkY?= =?us-ascii?Q?IfW1T+SRtZSFnRJF9msn+I8URCxAKdjO7oxLrhFI/f1CSmufdgriZHFK60QZ?= =?us-ascii?Q?wQYZL6xR3WZGdY+PRwfYXvEtRU/05DPaZ9uyLXqeojlJGzhjw7tkq0wvgWwo?= =?us-ascii?Q?vFAeWJmVnjaDdc4ejl6jvVyQVk5gPZGQ5O1eznm1FKyq+WP7dzPsX1FE010M?= =?us-ascii?Q?U1iB+VTWxgMopis4CdYYXRgnVSvfzK3DyE/BKK0GfdXy1Gae2fGficT1addX?= =?us-ascii?Q?tcCmMj8ad//NDj0YZxVWB5FL4fj1IVWBbo4oHuZ3v4gX2r0gQPS+qZwC4XAu?= =?us-ascii?Q?EW3QxxvDAujiPk/TerkwuqxvsWt69oIA2xd6LXOneg88DwNa7VnFjvR34+Ha?= =?us-ascii?Q?19IfbmurrYcPK6ALWhsw79/yeEOLuvIDdb7f7wbuPdIKXwMBQ4TVJM28kUn2?= =?us-ascii?Q?8yarmavfZd6059lE3wmy8O4h6aCqwE1ohSmykX7dnBdDqdmbSrYe0IuXAlJY?= =?us-ascii?Q?j2olgkB82h+z1z9VIiHnvAY98BiXmjD4BaOHrvVGk0yr9t2JOejEZqi9jPRt?= =?us-ascii?Q?m+KAtyM2dLwt5zVT4dt5t4woj8NhEh8=3D?= X-Exchange-RoutingPolicyChecked: 0hzgPIDw0B/5gtj238cM2cb0bQOmGX4zPbSLrYsZi848g4D+duNoKVRfq/vRi385LZ9e6reonffjJ5Gp+6Pt34itItxGMC/4Wh4IqvkWtp92pqjsL72MiKQiQzTKz1y63sfuv6kN4XlbqqLYDuTZ/UYEeXH9Y2ifP03oHYUKzWIjJm7G/d/fCuh7jEdl06s5qMKZp6g6wpD+VmeNawcLc4OXLvHNohCgfDZLv0rQw41SKNFAATONceQVHQ5GEeIdEjL5egm0klb0i906CtVhMaM3p0QG3JSNwfO2eSvo8XFVKPKwy162cEOnVNLBDdlIa9bk0hnxlwQxLNVRV19xcQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: c0ace239-614a-441d-2d55-08df38c453f0 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 09:33:18.3898 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UUSClmtTTyfClsWp510EjRPMWgXoOYN/1REHV1KbNdLuG2KVjykJzUEKrpVm8uEceMTwLaybztYbGvgr6VAwURKEGMgsoUNyvUGP2jWidFY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR02MB8734 X-Authority-Analysis: v=2.4 cv=Wta+otfv c=1 sm=1 tr=0 ts=6ae858e1 cx=c_pps a=/Z3c8qHbY2P/IDgIPrWVhw==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=zJRp6_cAMcgA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=jxMXjlTPpCISP5mWtjnE:22 a=64Cc0HZtAAAA:8 a=20KFwNOVAAAA:8 a=-DOnkpEdNJLKZcUuXmsA:9 X-Proofpoint-ORIG-GUID: u9ZYFKHL_EnbadDR6TdZdX3F1ePgcH_m X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX6KC/qkoLIFMv HiDrZLHYoss7ChHHojJHDouCap8E02cYnQW964KbWN9loPAe4FGMpuXc/K/EFUPC6QOLygHl9s6 Vlj1S0ZL6GfAy8sp1pLSuuVpiV41OYEzkTCvpqOqIFTJjtFFxiVLKLufs/7UbyVNyJN6SAt2F3y JljRfG4xJf6sFOIgGcZIha94vCAdqTy3CinfmNyYSA9xNbGpc88Bju3RYV4LAYcQSvg1q4tHRKU T0KPvqspVjtfZCQy+vFl8qChBn2nBFPKcY97ZbGW8gbsu8lYJQS8y6NruNO6MVcgg+HURrMlxf0 aqLtsabzB146FEz8pm3UBBR44ImLNkZFjlCch3k0W2Bl807MYY3qMdyALXa6InB4unU3eaAK7Yd P0ep5jlDNbfzmfhoJwgIjr+ME7tEt9Z/VMWpcN58ggR4XHwMK2oQQA7eu7q62jIJ+x/uOiX8hZh loq4BMX+MJGgDKYsfTQ== X-Proofpoint-GUID: u9ZYFKHL_EnbadDR6TdZdX3F1ePgcH_m X-Proofpoint-Spam-Info: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX9dm20sSsDVxF 6yZyDgxIQIJ3X63ECX2lVVVd3pKH+2MRQFLXVcjvuq0VKj9MjTtqBlWv5UoEYpPYMkkBAWahaRN XcmBRLAy/DKmSBH+2H/b1sI1yLFnh0M= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.138,FMLib:17.12.100.49 definitions=2026-11-02_03,2026-10-21_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: FX5A4Y3ACH642HKBQVFSPMYFGQAQU3T7 X-Message-ID-Hash: FX5A4Y3ACH642HKBQVFSPMYFGQAQU3T7 X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1793612096581158500 Content-Type: text/plain; charset="utf-8" Build the tls-creds-psk object with the following params: id, dir, endpoint. Note: Libvirt generates a keys.psk file for each migration session that only contains the pre-shared key for the "qemu" user. Because QEMU defaults to using "qemu" as the username if the username attribute of the tls-creds-psk object is undefined. We intentionally do not set this attribute. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda Reviewed-by: Peter Krempa --- src/qemu/qemu_command.c | 26 ++++++++++++++++++++++++++ src/qemu/qemu_command.h | 7 +++++++ 2 files changed, 33 insertions(+) diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 9adb18be4f..d3c52df1e2 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1293,6 +1293,32 @@ qemuBuildTLSx509CommandLine(virCommand *cmd, } =20 =20 +/* qemuBuildTLSPSKBackendProps: + * @tlsPSKPath: path to the TLS-PSK credentials file + * @isListen: boolean listen for client or server setting + * @alias: alias for the TLS-PSK object + * @propsret: json properties to return + * + * Create a backend string for the tls-creds-psk object. + * + * Returns 0 on success, -1 on failure with error set. + */ +int +qemuBuildTLSPSKBackendProps(const char *tlsPSKPath, + bool isListen, + const char *alias, + virJSONValue **propsret) +{ + if (qemuMonitorCreateObjectProps(propsret, "tls-creds-psk", alias, + "s:dir", tlsPSKPath, + "s:endpoint", (isListen ? "server": "= client"), + NULL) < 0) + return -1; + + return 0; +} + + static int qemuBuildChardevCommand(virCommand *cmd, const virDomainChrSourceDef *dev, diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h index e34172fbff..92ae32d285 100644 --- a/src/qemu/qemu_command.h +++ b/src/qemu/qemu_command.h @@ -72,6 +72,13 @@ qemuBuildTLSx509BackendProps(const char *tlspath, const char *secalias, virJSONValue **propsret); =20 +/* Generate the object properties for a tls-creds-psk */ +int +qemuBuildTLSPSKBackendProps(const char *tlsPSKPath, + bool isListen, + const char *alias, + virJSONValue **propsret); + /* Open a UNIX socket for chardev FD passing */ int qemuOpenChrChardevUNIXSocket(const virDomainChrSourceDef *dev); --=20 2.43.7 From nobody Thu Nov 12 15:08:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1793612218; cv=pass; d=zohomail.com; s=zohoarc; b=LIQ4+8N9rviCauOCRssSHklf4qbwB3yFCt0NyhAaF0FyPsqqnrxUny7VqHNln90LEowqRX+5aSx9Zu7um/D6z85DXmddPOfOUuBWZ4NEywbWpmY+ap1ysT32koQM8TUQFuWIH3mky8ocfSamguqKyyjaU9TLyTX+qOs6J1CPqh8= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793612218; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=tid8hGAEfE/ft+BZyE+vKU4rmdhE8o82U+0au9WAWu0=; b=g702e+EL21CpKvcsh8T1bCyKKUuM0nnVQg8mCGe/9lkqV2oGWQaiO8n6EzJKyqzfe76WdswuJyeIkWf6ED4k3C6XsFg9fW/3GmTNRPiLNYyDh41LSL67rC9ZIe83MfGWboIFcDUhHI2I418Kaasl5ETyTcnhAmIUqq02fUE8QAY= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 17936122182921003.5212445642161; Mon, 2 Nov 2026 01:36:58 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 435C63F321; Mon, 2 Nov 2026 04:36:57 -0500 (EST) Received: from [172.19.199.19] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 325D241C14; Mon, 2 Nov 2026 04:33:48 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 202823F28B; Mon, 2 Nov 2026 04:33:27 -0500 (EST) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id CCBAC3F313 for ; Mon, 2 Nov 2026 04:33:23 -0500 (EST) Received: from pps.filterd (m0127838.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6A29Ad5B683262 for ; Mon, 2 Nov 2026 01:33:22 -0800 Received: from ph0pr06cu001.outbound.protection.outlook.com (mail-westus3azon11021073.outbound.protection.outlook.com [40.107.208.73]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4hnfvub0bn-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 02 Nov 2026 01:33:22 -0800 (PST) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SA2PR02MB7724.namprd02.prod.outlook.com (2603:10b6:806:136::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 09:33:20 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%5]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 09:33:20 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=tid8hGAEfE/ft+BZyE+vKU4rmdhE8o82U+0au9WAW u0=; b=2owSnVy+sLZPURMiUdY2i24nzwDJ2y2FrWQJT2L1sOclZcg6LFyPeA/KY LosYLYkXL6LoWXqUmpcF3VQxbWM34JvBUedXOYcCXU1zxp35QbmTKHFKbisySQRe NB8KbwYweP5BEsbsetodlCkTR1M22QtYXTtD1oEAktfqM/bAXgPhl1/AQheMWiCL aiNn40JR1BomrDNupHBlc2VFgcaOjyYX2cvtkjOKY16opnMVUTOAuabr+hFoVa8Z vEKmyXOTG2wsHjHsTUk71P5agzsUlD+ba/T6uJfb4kUNqy09yBAH3Isf+UzL6m4A Zc0bcCGnpF1SXQXyUtXpLO7VOkrIw== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=dGQAE+jvhUMl+PmBLszt5NARL0IfX9UO+sB5ehcJoiruPyIcv38DyDXEfyUcDkaczZsrsBjk3NQYGHhjvvcnQ2RXOjwQ2bvLws8HM+QX4y24o6tPE8ejFlsyPBASix//ToKGDoPYVvuOhVlM7OlRsYAlav8RrBul06B2f8r+MfI+rIjXwM2NWAPr6b8t+azcnCh8UERgwoPvr4D6JelYUj1FuJ2eahWHCz8iA8tpAIMpxG+oD3si674j4uaOxHCSXM6na+DF77LP3dFJkxemo2McWlVYqdejMvM3pJ0F6V1S94kQryoRUV1UfM/UKzLIYVDevo3u/s3LqV19P2SAAw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=tid8hGAEfE/ft+BZyE+vKU4rmdhE8o82U+0au9WAWu0=; b=L9sZj/VvKvtALAqwKZIsHK5qfGgt7QNRbERcyZqLkYCtu94tB0yCcTgaRcHiYcii1axdKLA6WwXBXw5G8E+FVZ1DF+GVxWOktE+F0egPIuF20pRA9OCUUAQVDkQcA0OFZBxlnoKExlgIGIWHVvkx1o6A6RNGlz5KsWvtXIRmKwHowcnVvNmlxYRZX/9JIeTHSv1RkUscHq4VLgSnYf4ZF1DueZOe2VwMxu7zG+QjNrcZKTUCeLNxrpHLTNoCsn9CmfDBiTtp8j7KBMiWhVHA2Jb53APNnrYQT/0a4DhWrJS9OgIwlf+K+uW4AtUsn8CUd/4xZjmljRGS+docAVw/Nw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tid8hGAEfE/ft+BZyE+vKU4rmdhE8o82U+0au9WAWu0=; b=rAM0lcXPZnQHfoA34XeVsauvAQvIZT6gXw3jtccbsh+QVfd5ITKTrm26fB2Y/QTD5/ecedRqQXNoh9PFcDwLW8vrh5kEsWyLt9YpeWOSaVxUPPB+g4LD60nC20KRskZ4niFTQ7BVgmgfz0TA7MjWrftyiKfQmFnEF9G3Q0VPd7HoG1SB1Wsm145SRIBDr0ThTO/Hb7UfdqQLnrNSih99+5rFKvUOkzXxniFq37pKbhJcfLQyTqkPcGUG26G1JTqg4pmFxe4hX+aENSM6V51WwBzBf/qvh8y3hRb4AeqQd1sSlsCigqgu3waBO70EWfN0WtW96TZrIiiV7dUowYEM+A== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nutanix.com; From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v5 4/8] qemu: rename tls-creds-x509 obj related functions Date: Mon, 2 Nov 2026 09:32:41 +0000 Message-ID: <20261102093300.44810-5-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20261102093300.44810-1-abhisek.panda1@nutanix.com> References: <20261102093300.44810-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ0PR03CA0072.namprd03.prod.outlook.com (2603:10b6:a03:331::17) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SA2PR02MB7724:EE_ X-MS-Office365-Filtering-Correlation-Id: ff0a3e58-e0cc-4c57-f914-08df38c45500 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|23010399003|366016|376014|56012099006|261009221227099003|261009223027099003|261028144727099003|261021121427099003|261021123027099003|261026121527099003|261022105027099003|261026140227099003|261022075727099003|10067099003|18002099003|22082099003|6133799003|3023799007; X-Microsoft-Antispam-Message-Info: 2fNdqqIXhkOTA3AmFPkUzGocRXbrcq+pQo2XEqmL+oiuvkxJZErv/kZ6zuJVocx9gAKsnEJhZZ+dcE5VK8f4CMq262iBOFUcq3sxHSkK3FocCRd01/eB7tvtTCoPfjdjJXhae9Rsbkgso6y8cLkNy38RWsYCC+DW0g87NTs05+y66UuURLXaWxcse0nwltMgKX9y0QsMRcFcAPPuXouoFTMCaY90NhYlA/YjeDsv7qy+oi4FGrINfMlwRaWv6liPWSHW7Z8Xpzrf1cSAK+cCSyJqzXABaUa8JxFlQEbmmyvAfH0YywulVyDypjf6Z5iljg1CQt1lQGqTFERW7psTInCKSn5zbyDIkW4kAgdf0tKQKIZldokN4R2FKjG1w4BLSrGuBIzmm6PreecH/AtuoqXKUzDYzOFmw/2HdeSrPPcGJuOwwL2xEvyBH9xk5lctwewifaWdpcHWUL5MxV3d9Bt1ZgiR4kxpZuv9emY0IsY37LyfR3LzWbAEIUOYEy/FGWtSK3na6ZMka1SZGieurqRS8LHvGxWzxVLuPEQvkuRGR+BwSLGxB8PUIuQQOt4y7UQk9/gv27PAsdSurqJx0cT83Jk9Qo1u/PoWdSLDLce0hRxUERaIjEz550TXjAoqpYuotn3B0tBRBxEPTH+Apo6rr0zNKo1xc/ezhXFBj98= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(23010399003)(366016)(376014)(56012099006)(261009221227099003)(261009223027099003)(261028144727099003)(261021121427099003)(261021123027099003)(261026121527099003)(261022105027099003)(261026140227099003)(261022075727099003)(10067099003)(18002099003)(22082099003)(6133799003)(3023799007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?utViCv2flXldROLhbGF4CAUhcAQVoLL9tgmIaANVFqVCo8i9Al9swwYRu0GY?= =?us-ascii?Q?PlNv/L3SvKveIXwLiEVrfFKHUopi9aM8zcp/3Q/qMwbRsPPsqIZD6fEYFgVB?= =?us-ascii?Q?kxfmqaFtTctLaZBCUdrn364hniaHE2TG7D6k+ta0QQDKZFyPu6OOcOcFASgn?= =?us-ascii?Q?fSwkSCvJH3bPFpRAQN5dvsOaABQtiFouvZJMtWFxTWtlOWgKGHNLNMYVr/D7?= =?us-ascii?Q?nebXh8nOeVPStqK9Aps3M58hAHcEOFr3Rjzoq1MXtv7WqtIOd6ivxmwr63m3?= =?us-ascii?Q?EWNQ9lUVnbeoQHqIuGuREWe92k+90NmtoLba+9u6KHdz21dKieQCNZ7hSt4g?= =?us-ascii?Q?IYeEmMmdF6b0fGIZlTXo6cMrokWu1ROk/i99xSXIhnwO03GLowh1SbGGTDc9?= =?us-ascii?Q?SrdyokNKoQhI12NOw8zkvjwI7JFockQ2WaVeeTvWjDOetAu46iEYwamsERkI?= =?us-ascii?Q?J4GSbaDoN0/aPVu6rHHvkM9L5vMZefjanzWbvY/koMzwsDFkCCJOw1yZB5yp?= =?us-ascii?Q?IdPWj91eHPwr20Dt/udos5KfPnU8pZJItsis8/ySOscA5OBKfTlERBjxwCHF?= =?us-ascii?Q?BrvOu6Cj7WmrUqm11FeE7LONwrl5o48UB31nbjARYK+nuzwL94Qx+xS6xja2?= =?us-ascii?Q?8FBmAJG95/GvqZTQpd/Mxo5gFlUac/yCEASiL5idmIC2gb23D7SOdQo4gQ91?= =?us-ascii?Q?MBuHzPpekSpH9tFqay3iEhjJ9KD0oGxGj/mj7AuKPfN6ZQ8JixkgU+0KrlPe?= =?us-ascii?Q?0wcegF7UdUFKsBXkGNxPrZz014HGLpgPC45N+F3aeDcvlJIXQpMiCNaD/XDL?= =?us-ascii?Q?hCCL1uOzm0aUM8fwg1UFX+dV4xx5VCcXyuvFGH2ETnENsI0V3oFDBZUaGFod?= =?us-ascii?Q?iA789CCZNHOqToisQflM3+6P1k+EicPR/R8QXw5Jamr8Yks6Px6axT/6Vl5q?= =?us-ascii?Q?irVZKhathILdONBy0uUwc5Mi80qTlAofjz9jMAQMV/ZlIlq6PLoVgQN5VaQ2?= =?us-ascii?Q?SEvVZ59uyACU48vdhUbSHh4FW/RQ3BCcvhi3ccDykdl9wulKyMrXP+uIWf2o?= =?us-ascii?Q?LVAnrqv+IlMu0jeOl2iTvSj6kKLgvHp+T0gGB9aiHWTX0SflXMa/TXOa6F+a?= =?us-ascii?Q?Ndyj4LH+Voo7lInB4w2WSyKqrrh6EJ2hDtb3wirAad6WHs/qMfVHSv5//EoK?= =?us-ascii?Q?EkEzpkYCjKmA54UEgf8QI8meqKvuu5scTYrxhAFknjAj3KH6nMLeKt3puhoM?= =?us-ascii?Q?rgtkG3pgj/mHF29qPwop7rHCyvrH912rNinA19NGUZsjVPE5mubo02d9ukOO?= =?us-ascii?Q?10gsbBkKztAtBHk29pfB6jLZACYG4AUmGXji4lH/2WzyVv+Ox5fxP+dNcxEB?= =?us-ascii?Q?qUMwjS7kwV17CYp8DaTFoW7iYp4V5ge6E5UKeTLCabhZgFhm1miVpN7BRBPw?= =?us-ascii?Q?iZNY3eSjUrPXpSpmKPZ77vozp6+gw5n9j5eA64TjqL67FbnEW7FLwsv7iLyh?= =?us-ascii?Q?FqQTytUoEdvErRjq8ubXeXmXXBGzuyMIzhUrQxp0xBd0/GJV6oTJc9iJZ1Bz?= =?us-ascii?Q?ATD5iqjvf4bdgYqVUxZYHtAGQOZVuYXL7s4CcKIatVlHG2hcHheNl3RaYV2m?= =?us-ascii?Q?BmSXp0IaZIAcYuHtyqGUwOfoX/lCBtgql8l6rnNvhEPZc5eet+gZExZfRjZG?= =?us-ascii?Q?7zBcrNhG5ZuYROd7tiMxD3fq8S7GC1mp25aspsjc7jAH9rGIP9m/CGX2PYKy?= =?us-ascii?Q?L2B93w+114+5WV6QyycKOXBXpeuEVrI=3D?= X-Exchange-RoutingPolicyChecked: 1gD6c4Pps02IVfK5M9TX0XGS7FLQjDgYi0HI0PTcCLDPOYyqti4rPbLpgagMhbyo03CTFkDOTj/k48JHEnQNijWFkLTwl/zP3cOI7aWr9kQekJADqruO/acnPDAx4WXzxYfMxMGa3Q9jZEdSeuOR0SnInRvKEdiQsEdTSCNE1tetSXX5KzGPsAZuuwBs2Cc+m8Ok/lFum+EupvJO0BNczrdxGUiwyp5/p9jPf3L6XQD8ZNP/oOpJ/QrnF7t/URvXgI2zllCXvuOKxtV1Jkv2U7SsMmyloN9j0piSREZLvkHeRWlWJuWHN03uNqFKPix2B7mVPZCeFH2oktVTyCYT5g== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: ff0a3e58-e0cc-4c57-f914-08df38c45500 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 09:33:20.1670 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Htygum794jscQ9jSs0TqUMJpgDr9hGYQWK8T31BSRXBSiTZtx7sxKhz0w/0G3QslaORhSpRG8MRsx09bITXWvcB2Hm4+/IWybLx29JcgH+w= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA2PR02MB7724 X-Proofpoint-ORIG-GUID: dPf3QlD5K8RgQUMugqoJ5NOnokxgHA7S X-Proofpoint-GUID: dPf3QlD5K8RgQUMugqoJ5NOnokxgHA7S X-Authority-Analysis: v=2.4 cv=EIaTQFZC c=1 sm=1 tr=0 ts=6ae858e2 cx=c_pps a=f2HnxUUJxMzVcYZpCdj5LQ==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=zJRp6_cAMcgA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=1L6crL_YRTbalZ11mEUO:22 a=64Cc0HZtAAAA:8 a=20KFwNOVAAAA:8 a=v6biFoHkGfcEids9QrgA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX3915RAJmBXc3 qRolpfmEDZCWoR3iAUCi98o28EMkzwLUs+rAHcYEOj7PjLWWFDiYZKgfc14Ng/hCMUnepgg6B9/ j3LpgksO8UqYHZejRQNjMVPB0revX+a/8MX+YY68ExqqsjgvmZqFkpxSsqqeOs+DI1p3NFsIPLI KJsRJmdCWYui7xxWag9pQGSX2+5JPmjWUCzHTQh/xO+l40V9ZHZaZZIUqmj4hHYnaKE5y82HVej gxrg/UoXTWKqFBmVBmChhNV/q+vD3W34/QyEEOKj6M7MUviyjo/G/PUJFPhf1woFok1T3c3FcnC uujQczQ0aNipBY5YVA9YekLCMnqtYeq5Qf82BJ6G8XviKv01YoFVF5qDUMlJeDXHbNaOpEPZTTC DvxFreXTwaxkZRdhJd4hsIxcXJBB8rsfUI7Qw12zOn6RwpnaT5dDAK9CU3OgphQI7eUDvEueOQb mgGYVjJp8E9wR+wppGA== X-Proofpoint-Spam-Info: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX19v9+x7+kU9W ngILsQrPbo4ZW5vIiwHHm/XV2FUhAuH913MbjaaUMEekPEIf9/cdLE4OdxENWg6GoEq3xE08U4a hUQa0HGvtomzAKhIrFDEGUSc8V7cLZ8= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.138,FMLib:17.12.100.49 definitions=2026-11-02_03,2026-10-21_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: JGSXFVKYYKICMDAVPA7FLF5OPGVESR3V X-Message-ID-Hash: JGSXFVKYYKICMDAVPA7FLF5OPGVESR3V X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1793612224800154100 Content-Type: text/plain; charset="utf-8" Append 'x509' to the function identifiers managing the tls-creds-x509 objects. This defines the functions' scope and prevents naming conflicts with the introduction of functions related to tls-creds-psk in subsequent commits. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda Reviewed-by: Peter Krempa --- src/qemu/qemu_hotplug.c | 40 ++++++++++++++++---------------- src/qemu/qemu_hotplug.h | 24 +++++++++---------- src/qemu/qemu_migration.c | 16 ++++++------- src/qemu/qemu_migration_params.c | 32 ++++++++++++------------- src/qemu/qemu_migration_params.h | 14 +++++------ 5 files changed, 63 insertions(+), 63 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 961885c0e2..5479ab1bce 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1735,10 +1735,10 @@ qemuDomainDelTLSObjects(virDomainObj *vm, =20 =20 int -qemuDomainAddTLSObjects(virDomainObj *vm, - virDomainAsyncJob asyncJob, - virJSONValue **secProps, - virJSONValue **tlsProps) +qemuDomainAddTLSx509Objects(virDomainObj *vm, + virDomainAsyncJob asyncJob, + virJSONValue **secProps, + virJSONValue **tlsProps) { qemuDomainObjPrivate *priv =3D vm->privateData; virErrorPtr orig_err; @@ -1772,14 +1772,14 @@ qemuDomainAddTLSObjects(virDomainObj *vm, =20 =20 int -qemuDomainGetTLSObjects(qemuDomainSecretInfo *secinfo, - const char *tlsCertdir, - bool tlsListen, - bool tlsVerify, - const char *tlsPriority, - const char *alias, - virJSONValue **tlsProps, - virJSONValue **secProps) +qemuDomainGetTLSx509Objects(qemuDomainSecretInfo *secinfo, + const char *tlsCertdir, + bool tlsListen, + bool tlsVerify, + const char *tlsPriority, + const char *alias, + virJSONValue **tlsProps, + virJSONValue **secProps) { const char *secAlias =3D NULL; =20 @@ -1830,18 +1830,18 @@ qemuDomainAddChardevTLSObjects(virQEMUDriver *drive= r, if (!(*tlsAlias =3D qemuAliasTLSObjFromSrcAlias(charAlias))) return -1; =20 - if (qemuDomainGetTLSObjects(secinfo, - cfg->chardevTLSx509certdir, - dev->data.tcp.listen, - cfg->chardevTLSx509verify, - cfg->chardevTLSpriority, - *tlsAlias, &tlsProps, &secProps) < 0) + if (qemuDomainGetTLSx509Objects(secinfo, + cfg->chardevTLSx509certdir, + dev->data.tcp.listen, + cfg->chardevTLSx509verify, + cfg->chardevTLSpriority, + *tlsAlias, &tlsProps, &secProps) < 0) return -1; =20 dev->data.tcp.tlscreds =3D true; =20 - if (qemuDomainAddTLSObjects(vm, VIR_ASYNC_JOB_NONE, - &secProps, &tlsProps) < 0) + if (qemuDomainAddTLSx509Objects(vm, VIR_ASYNC_JOB_NONE, + &secProps, &tlsProps) < 0) return -1; =20 return 0; diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h index 60ed0e174c..0c969ab7f0 100644 --- a/src/qemu/qemu_hotplug.h +++ b/src/qemu/qemu_hotplug.h @@ -31,20 +31,20 @@ qemuDomainDelTLSObjects(virDomainObj *vm, const char *tlsAlias); =20 int -qemuDomainAddTLSObjects(virDomainObj *vm, - virDomainAsyncJob asyncJob, - virJSONValue **secProps, - virJSONValue **tlsProps); +qemuDomainAddTLSx509Objects(virDomainObj *vm, + virDomainAsyncJob asyncJob, + virJSONValue **secProps, + virJSONValue **tlsProps); =20 int -qemuDomainGetTLSObjects(qemuDomainSecretInfo *secinfo, - const char *tlsCertdir, - bool tlsListen, - bool tlsVerify, - const char *tlsPriority, - const char *alias, - virJSONValue **tlsProps, - virJSONValue **secProps); +qemuDomainGetTLSx509Objects(qemuDomainSecretInfo *secinfo, + const char *tlsCertdir, + bool tlsListen, + bool tlsVerify, + const char *tlsPriority, + const char *alias, + virJSONValue **tlsProps, + virJSONValue **secProps); =20 int qemuDomainAttachDiskGeneric(virDomainObj *vm, diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index 61d0cc5e00..ce791bd3ba 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -3503,10 +3503,10 @@ qemuMigrationDstPrepareActive(virQEMUDriver *driver, /* Migrations using TLS need to add the "tls-creds-x509" object and * set the migration TLS parameters */ if (flags & VIR_MIGRATE_TLS) { - if (qemuMigrationParamsEnableTLS(driver, vm, true, - VIR_ASYNC_JOB_MIGRATION_IN, - &tlsAlias, NULL, - migParams) < 0) + if (qemuMigrationParamsEnableTLSx509(driver, vm, true, + VIR_ASYNC_JOB_MIGRATION_IN, + &tlsAlias, NULL, + migParams) < 0) goto error; } else { if (qemuMigrationParamsDisableTLS(vm, migParams) < 0) @@ -5168,10 +5168,10 @@ qemuMigrationSrcRun(virQEMUDriver *driver, spec->destType =3D=3D MIGRATION_DEST_FD) hostname =3D spec->dest.host.name; =20 - if (qemuMigrationParamsEnableTLS(driver, vm, false, - VIR_ASYNC_JOB_MIGRATION_OUT, - &tlsAlias, hostname, - migParams) < 0) + if (qemuMigrationParamsEnableTLSx509(driver, vm, false, + VIR_ASYNC_JOB_MIGRATION_OUT, + &tlsAlias, hostname, + migParams) < 0) goto error; } else { if (qemuMigrationParamsDisableTLS(vm, migParams) < 0) diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_par= ams.c index dd47516742..d551ab9216 100644 --- a/src/qemu/qemu_migration_params.c +++ b/src/qemu/qemu_migration_params.c @@ -1150,12 +1150,12 @@ qemuMigrationParamsSetString(qemuMigrationParams *m= igParams, } =20 =20 -/* qemuMigrationParamsEnableTLS +/* qemuMigrationParamsEnableTLSx509 * @driver: pointer to qemu driver * @vm: domain object * @tlsListen: server or client * @asyncJob: Migration job to join - * @tlsAlias: alias to be generated for TLS object + * @tlsAlias: alias to be generated for TLS X.509 object * @hostname: hostname of the migration destination * @migParams: migration parameters to set * @@ -1166,17 +1166,17 @@ qemuMigrationParamsSetString(qemuMigrationParams *m= igParams, * Returns 0 on success, -1 on failure */ int -qemuMigrationParamsEnableTLS(virQEMUDriver *driver, - virDomainObj *vm, - bool tlsListen, - int asyncJob, - char **tlsAlias, - const char *hostname, - qemuMigrationParams *migParams) +qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + const char *hostname, + qemuMigrationParams *migParams) { qemuDomainObjPrivate *priv =3D vm->privateData; qemuDomainJobPrivate *jobPriv =3D vm->job->privateData; - g_autoptr(virJSONValue) tlsProps =3D NULL; + g_autoptr(virJSONValue) tlsx509Props =3D NULL; g_autoptr(virJSONValue) secProps =3D NULL; g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); const char *secAlias =3D NULL; @@ -1205,11 +1205,11 @@ qemuMigrationParamsEnableTLS(virQEMUDriver *driver, if (!(*tlsAlias =3D qemuAliasTLSObjFromSrcAlias(QEMU_MIGRATION_TLS_ALI= AS_BASE))) return -1; =20 - if (qemuDomainGetTLSObjects(priv->migSecinfo, - cfg->migrateTLSx509certdir, tlsListen, - cfg->migrateTLSx509verify, - cfg->migrateTLSpriority, - *tlsAlias, &tlsProps, &secProps) < 0) + if (qemuDomainGetTLSx509Objects(priv->migSecinfo, + cfg->migrateTLSx509certdir, tlsListen, + cfg->migrateTLSx509verify, + cfg->migrateTLSpriority, + *tlsAlias, &tlsx509Props, &secProps) <= 0) return -1; =20 /* Ensure the domain doesn't already have the TLS objects defined... @@ -1218,7 +1218,7 @@ qemuMigrationParamsEnableTLS(virQEMUDriver *driver, * some other error path between now and perform . */ qemuDomainDelTLSObjects(vm, asyncJob, secAlias, *tlsAlias); =20 - if (qemuDomainAddTLSObjects(vm, asyncJob, &secProps, &tlsProps) < 0) + if (qemuDomainAddTLSx509Objects(vm, asyncJob, &secProps, &tlsx509Props= ) < 0) return -1; =20 if (qemuMigrationParamsSetString(migParams, diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_par= ams.h index b7a829b85a..14e20fb71e 100644 --- a/src/qemu/qemu_migration_params.h +++ b/src/qemu/qemu_migration_params.h @@ -115,13 +115,13 @@ qemuMigrationParamsApply(virDomainObj *vm, unsigned int apiFlags); =20 int -qemuMigrationParamsEnableTLS(virQEMUDriver *driver, - virDomainObj *vm, - bool tlsListen, - int asyncJob, - char **tlsAlias, - const char *hostname, - qemuMigrationParams *migParams); +qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + const char *hostname, + qemuMigrationParams *migParams); =20 int qemuMigrationParamsDisableTLS(virDomainObj *vm, --=20 2.43.7 From nobody Thu Nov 12 15:08:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1793612307; cv=pass; d=zohomail.com; s=zohoarc; b=OUbIEUHQXItiVXa7m3b+BYputyiZgIH0E1wdCfDcbBJGW4phRMnXKz0bYHz/732RluG9W7/fuSBbpqXgpLZGwr5w5zylzxAydbggRqcMepmky8L+oNKB9x/mKvMEIe/DTQsdq9VYKSQeQ+Fb8uwXCiAoKfzm8XzTMdBzqx8nmHA= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793612307; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=Capd/ARAvMcNejE6LkVHEWo156f8SkrHl0pJ/37gzdc=; b=CfcbW7qvtEm6QE4qi9OoEg2dZXCm9vequl73u2KbmqfP6xVqPD0VnUyy6V6Jdl/ic29cYkzcfTxcIOP+ur2chrnqJoi2uqxZiU46FUeWpWrfV6J9O6psfg2bLipfAmOt9qAywHQU5mMU/2KhPhCpXtal84QM9SxNqNaw+2OuIFk= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1793612307303604.3137630890812; Mon, 2 Nov 2026 01:38:27 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 017CB41AC7; Mon, 2 Nov 2026 04:38:25 -0500 (EST) Received: from [172.19.199.19] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 3CFC341B05; Mon, 2 Nov 2026 04:33:54 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 1928E3F28B; Mon, 2 Nov 2026 04:33:29 -0500 (EST) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 464643F28B for ; Mon, 2 Nov 2026 04:33:27 -0500 (EST) Received: from pps.filterd (m0127838.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6A29AjZd683376 for ; Mon, 2 Nov 2026 01:33:25 -0800 Received: from ph7pr06cu001.outbound.protection.outlook.com (mail-westus3azon11020102.outbound.protection.outlook.com [52.101.201.102]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4hnfvub0bt-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 02 Nov 2026 01:33:25 -0800 (PST) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by CH3PR02MB10536.namprd02.prod.outlook.com (2603:10b6:610:208::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 09:33:23 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%5]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 09:33:22 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=Capd/ARAvMcNejE6LkVHEWo156f8SkrHl0pJ/37gz dc=; b=kwAYqpsyAlFEFFeJxCGB4sgxJc2pkixkKeGraekIWR/57ihaU/YK4MOzv sMyQAIwJpCaedsJLcrgitkAs5on6pDa7ozoOap+tUJ/FBrsefRf6kfY+KMw/zenD AeCeG+MHB+1poNarZaXk1jiIEV+TEN3wGxzX+n2m0dKW+TePx/dd471nqVJuFDqh U5DXnmRAvmdXFSCNVmwsvUrGN9cV0VxhLZJlO4koBcK3KZ3c5ITy1cjKsZjA80sf saF/fOfVgQFQ5cJIPSGhoMQUeOS2Wt11KyUVkesm6FIElDTIJUPrZmNUMT9drgkK NoxC7GkqtLkQr++jzAkVYIwIWg+0w== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=sSwtKTZL35txl44vfgNHlVLbjkpknxT1HDxdv1D58c1CL0/80+Lg9q5EBDn02tATR6IaTYovpemeTtIzvvXrD623cNUh3uRKpqzgSfG583klSBysKXA6rR9gepgyBC1bO7x9ztzvkia0BscD9USB4MiDO1byiy7jVKFmAu/G8J/IdgZJN1Y2jyDJ4KDuveO1QF1iQD/9J3tdaieCQglYUIo5Aj9K9/h2+6vLCsI/rtCeks+s+WCYAWQTCv/Ij4tIadPJ9DMSh824EcBL9ryNavrAQiIVO8NUnb7NiZItb0FNbE26ZfpWyL/XIAom0f4i0PaLQEMfe3DoqhxV/BSYHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Capd/ARAvMcNejE6LkVHEWo156f8SkrHl0pJ/37gzdc=; b=beBtP4PuoQkSJdpbzSo+qZ1m41HTSG4sAWqXvVBbjOAF9w0JOp4O/Ls+oVs+U2dyd4jFSLixM3zAff17GG7NQ85r6nyb3DjblZPLiB/GgMFwzNyano7coTJY8iJwxbVVLT4kXVNoVZ4ds0fyROmj3WYkCpUu1ySN8xbBGgFBnK73bVSptS5PfhvBsj3IyM7yrEeOxvam+s+xiWu/lmb8u+lu5Vl3KzWtiS+oiTQJiLT8dS2Al5eUWf3uFLn8OrT7ft5Ji2EyEqvcmt8TCI6mtUuLB5mc8bVSgBsLLhNFZ8K5C3QhK7EtyrVThAMdbBqD1kfoXcsgCAlkA05VzmCsRQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Capd/ARAvMcNejE6LkVHEWo156f8SkrHl0pJ/37gzdc=; b=yRsgmyzxu7Di05R8jdMlIHmo0EZSTe2o0yuo9KhICPgkgpbFTkbAogw5pxUZc2lrNpjI39JUTkP6JlKLXDTofirhYVyYpwGbkOzYNEa5auDApYys810t7mmiRizrpeuxn5vEF4ViQFo6HNvsatma1q4F/aX2XPa5h76gZILuGPC5rOKxPZWwTQ9Ru+d3pQgNPbOqs65cWw8Xgmj/icrhiv1Kw5CSyYKzoXFdeueaCsJQ8hiuofw7nnXEZGAaktszusVDKrUwuR+KVG3FV/9WXNfo0hiIeM4Js+vx5JLBVNyuyghr6NWf87e4bcMpAWe604p9YH7AKtHpO7U92Y6MHg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nutanix.com; From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v5 5/8] qemu: Manage tls-creds-psk object lifecycle Date: Mon, 2 Nov 2026 09:32:42 +0000 Message-ID: <20261102093300.44810-6-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20261102093300.44810-1-abhisek.panda1@nutanix.com> References: <20261102093300.44810-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ0PR03CA0283.namprd03.prod.outlook.com (2603:10b6:a03:39e::18) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|CH3PR02MB10536:EE_ X-MS-Office365-Filtering-Correlation-Id: b4f3bbb4-53f0-4954-c6e9-08df38c45621 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|366016|56012099006|261009223027099003|261028144727099003|261021121427099003|261021123027099003|261026121527099003|261022075727099003|261022105027099003|261026140227099003|10067099003|18002099003|22082099003|3023799007; X-Microsoft-Antispam-Message-Info: 8loivqN2a8pCv66bKcy5L5+0z0U8Tur4PRCiqlP7mFFnUb/wmXZp0pgb+Xe4pRPn7xYW0eUwzTeUXaheJR+t6iAOwaIWSBTgTIlBrRR0WC8AUwMbBuWWyj5QhRWW5+PB8HSZiR/ej8gGan1Ce0uG0u8LaW8ugCZM35KlVoC4rUTWi56bV6KFnEDEQmCWEtZxnebmFvSGxB9EhJr4Mn6AkkmZ4g2gffprQAyw4Psi5zky+zvgvZua05bLjQ6H2FvqtXpaD6cQ7VDWEOjEdBhFjvuQ9n1DSsfht8g02YwwB2/YGOV+FVa74vOHjUV0Tk0ew1UhDW6TTDaPNFKe7eEW6osnWsVxlLPfC2x4XEnC6V2Wx4wNRHXVj1+Mb8mutjA84MDhfqTG8AYCQmaBTmDf0iNJAKxRZYiNdmY6xepiPr2TrtvBROr7uEJLgfUlmVANN2nW7wyfFmb5Rdamlz0ZjshaAisJUXVTAX5rRQBN+wRnPSdIArQlnYCp0cuaby4gftH7FDj9xUo2zQbGkZZT281aOyix3wcjUbPVWgrlFLutAeN9l/rEnHIcvoUM2bMSbiLMhJK7HkGIko4YO1YrKt62ejujS3/VMgA7RVswzjl2Bi/FLq/VpJUpVEeAzv4p17QOLoHBy4MdtBfmp+IKRzZg3ORBEz9Fm5vUDCmmLis= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(366016)(56012099006)(261009223027099003)(261028144727099003)(261021121427099003)(261021123027099003)(261026121527099003)(261022075727099003)(261022105027099003)(261026140227099003)(10067099003)(18002099003)(22082099003)(3023799007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?1KsGklwZxLiyXj1UbijXIhAwrwfy8CqkcQFP3va2tMo6UL7JoolNto+9/gg4?= =?us-ascii?Q?DbuCT3lcBWWMK2bSiSMSGqiIeckcWiuSqwoc9tdHWu7ojheZslEWbr/z5Dx6?= =?us-ascii?Q?rM3qyb+sweyy5Irtog59XscxQUMwovdghAqHhYbOGi6DH81wrmTjH073S/5c?= =?us-ascii?Q?mxzaZVYqbB1pDI2bk3M/SKOr1i36PmBONGo/+ceuyytkEBgB8sHJmn28Losy?= =?us-ascii?Q?DrUF8tb6sKA2XUKvd/NIyAOEVICRdpmnEu0AtwJ9N3gds+kZ4bNsWLQoF7wa?= =?us-ascii?Q?XNNHRS/Vpm7sSAO7BKjhuossq6EIR9mYtWRCpAnxtfx7uIzKRh+6Gmn8kPUM?= =?us-ascii?Q?lRKuSzJvUjbo51ZPKeSqnjNBBXRGw1LWzAFFPXB+DRsDh0d0dMbMUFzBOmDo?= =?us-ascii?Q?kubl3lhYX5u1d9m5xb+qS6iSFB9MyORtHZ1ighbHrGL1xBNd4TIgL0NUYf6f?= =?us-ascii?Q?8vIxcTFe4pX4RtWvk+bfNJwpiHLPFx3wG1jsb/brKaZOm+QZ9ROFKm8HyuqA?= =?us-ascii?Q?Y2dZhGxQldqa9yZ+Hd6/hZuEwyhoUpoQMf61D7mCZoyANBOEd2W18hYNnZEr?= =?us-ascii?Q?Su4hIfh2xzE5N65qLqgCNU36KYVqmDBST7r5/XwzdWk8yV6Cl9WvhuogNSwA?= =?us-ascii?Q?qs2aJgUKY8jSSNK3w+zyB13txW4HLRJJKsLLmeO2aXRl7FvUcIg7gp2u/38G?= =?us-ascii?Q?YbFVWMTnGDHPECDwct8hw9UZNtCfK4I3wRpt2Wp94U+eJQBqEg+SKg7/qTC9?= =?us-ascii?Q?0QEFy47yDDl1odBJ7MDlPek4DxQ1Tl1uEFIQ2IxKADXj5q4zlRc0SzE2+fKD?= =?us-ascii?Q?he/ofBttmvVysZGeE9MiHan7RtzzepPFKfcJ8siC84bYuIVxJ3AUGSgoRh0q?= =?us-ascii?Q?ChlQW8C2LKcxuvsl3D96j2Xfc9J81W5VeSEz+Rv5jBSNIRfL1REVfTyoHBIW?= =?us-ascii?Q?AwQX4zfgh6F8LvIfkBvnN2uwVoBf/wmgbvuSrE929E9d23cGH4SUYBKQQZvL?= =?us-ascii?Q?0JGjJcIjjtPZhTfUzCohob1sxp7o68k+DS0tUyBGCRPBm1Q/HFvpkb5LJs+3?= =?us-ascii?Q?v2p1i451ylanDdGyG8aLykxKrwCk+Fr7nSBzLEp751GrXcgppAg/OAmIpZ85?= =?us-ascii?Q?RXl9gRrQlN9X+flpPzleZ6zR1YREMuZ5kp13iLQy8NxaVu98XyqfMVAfJC15?= =?us-ascii?Q?txf0zgun5C1Kkr9DYHau6WrcJ5t4YtYD1d7H0lkqvtJKr/bpgAqSSGcECchI?= =?us-ascii?Q?B3xLQeyolxJ1FAbHGxVF0/b7li/YPoysgu3JkRk0DO/WkQmvn0nseTmpqsEE?= =?us-ascii?Q?DiuLt+SPQ5SUug83GGtSmOrKV+xkFWj7Oe6l0ZIP7M8WZYbslLaw/DNwzuq0?= =?us-ascii?Q?S6Znc9mNbJag5ItntaWNY8bjB8Ct7NO/o6ZXT78WVMBreR4LQk9YX1EDVuKA?= =?us-ascii?Q?lbsRsgkWylFMcGiU7VYz3DBbFRnadMqriqz/H0byv7NpSOlbIpRD0uO6sQTz?= =?us-ascii?Q?OlPotprXe9sL/gB66Qnx82kDrBz0TClNzDS6BKkzjrK6/dDOBc9xVC0/PSWj?= =?us-ascii?Q?8+wCFqSWcYQlrriyv+WUndU6dWaxttyxKG+Q1aCGb6MV8btukNTm7bCBCai6?= =?us-ascii?Q?nrYPb82BlePs9XP34OfZ2SbWI+lLDCZB/4kMuOf0/t/sYI+tnAneO+m0IOYF?= =?us-ascii?Q?KYucoT4d1iExt95yZXOoV92L+lLCcnNYYoNJNySgs+II+l8p+1oDOfaUloA7?= =?us-ascii?Q?FQeXBcJGgGyNIcEQfTDjMbfHvEi2J/U=3D?= X-Exchange-RoutingPolicyChecked: QwHwGAHiQUbtwsFw1rXsaxv5Xu2SyMxcuONiPAgjJc9V4EbLrDDFLS5w9ntrTG1l92Ft9fpEqXh2ArOWZBZsXuYnUrRrNe/7gNF3/fMViXpDZH/tQiKbBAtMijOlNKDWfUqHYifW3R9EcOH/d0qEpnmuclFHWjTXEexu4dq6ObtysNb7Odx/erkL7Xa0It0NCckOYAmNouwnmMFVRFWHUsMIEqFUvcZhKpTxC1zR+gFeDGnhpS5V9CEPtXp6Yf8RuZkP5EHbpnhv+b/No3563sVe/Kneye5L7ZGl1PConXbInX3AhiUO3M7bQta+xKhwqZOyp/gk62SfjzjMz0GTmA== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: b4f3bbb4-53f0-4954-c6e9-08df38c45621 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 09:33:22.0505 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: MFs7x60f6SKtfUpPOzVp9qDSdMkcW2UxhbQrbD36SP18aTpGbKdLmkrJ1d0nOGT6PQEGM3Hu5tGJLhKaduNxhnXE2XAfqJxfGPR55Krz13c= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR02MB10536 X-Proofpoint-ORIG-GUID: oM0P3SFuj-iOAfDubFB13YkCzRcPoc30 X-Proofpoint-GUID: oM0P3SFuj-iOAfDubFB13YkCzRcPoc30 X-Authority-Analysis: v=2.4 cv=EIaTQFZC c=1 sm=1 tr=0 ts=6ae858e5 cx=c_pps a=5886/XAhn54D+t2DuUGJPw==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=zJRp6_cAMcgA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=1L6crL_YRTbalZ11mEUO:22 a=64Cc0HZtAAAA:8 a=20KFwNOVAAAA:8 a=FkoMf_KoTue4cd8-psAA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX89qZ+2U+JL61 d51EUrPciwrEN8geMMyKnpE5POUa0v4oOY1NOXGgoEBrNHUBscQ311XDzOd90QhsAf2n/OYyB5G nNKxYbi2DRcwk22u6/eGNvh5ivvC8EJ5sDBQfuAE+L4NmEndsgngk3+qV+HLXjYh1cKvi9qpsoo MjNfv9nGhcexn7W8jww/VKHM57/gWvqR0iTlu9FSFeA0xhXA3ULBNCFvx1YUWWGSDhXCxSp2s74 XIyd6BpiCUKiEKj+rpuDVsImjbk5Eyks2TEP7ybA6Z/WJat/zJ0J0hY9Wz7vAcHha8UTbkicgg8 E4+oyp4buxzFe23BwwjM7pKjnUw4Tui/jkNP3HGyntxLXjgBeYQanhhYDWocngqhvC+YqbNTkWb ifGlvxzaxePl4+vLlwRnbXanfmC/YA3B9Dk61mvsz+9X1bG1+68g2qgS9TpW3sIh+rcM422Jaeq qOHLJCgl7OR1vJPUlBA== X-Proofpoint-Spam-Info: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX+ALhmBwmeV7K n9jBpNEjrWnUXDFFuinpsZlTNk9YwnhjzD4bZuyL2jbgXrcxjQqMrfD7X/ppgqD+LXvNMGJCTU4 TseibaZpODaPP32vW7X+3Ud8m6e3zNk= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.138,FMLib:17.12.100.49 definitions=2026-11-02_03,2026-10-21_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: W4PUH75AGKQ7EIPCKYFEQXTXIHBV2NHQ X-Message-ID-Hash: W4PUH75AGKQ7EIPCKYFEQXTXIHBV2NHQ X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1793612309152158500 Content-Type: text/plain; charset="utf-8" To enable TLS-PSK-based authentication scheme, add support for instantiating the tls-creds-psk object through QEMU monitor. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda Reviewed-by: Peter Krempa --- src/qemu/qemu_migration_params.c | 66 ++++++++++++++++++++++++++++++++ src/qemu/qemu_migration_params.h | 8 ++++ 2 files changed, 74 insertions(+) diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_par= ams.c index d551ab9216..678bb5602b 100644 --- a/src/qemu/qemu_migration_params.c +++ b/src/qemu/qemu_migration_params.c @@ -31,6 +31,7 @@ #define LIBVIRT_QEMU_MIGRATION_PARAMSPRIV_H_ALLOW #include "qemu_migration_paramspriv.h" #include "qemu_monitor.h" +#include "qemu_command.h" =20 #define VIR_FROM_THIS VIR_FROM_QEMU =20 @@ -1237,6 +1238,71 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driv= er, } =20 =20 +/* qemuMigrationParamsEnableTLSPSK + * @driver: pointer to qemu driver + * @vm: domain object + * @tlsListen: server or client + * @asyncJob: Migration job to join + * @tlsPSKAlias: alias to be generated for TLS-PSK object + * @migParams: migration parameters to set + * + * Create the TLS PSK objects for the migration and set the migParams valu= e. + * + * Returns 0 on success, -1 on failure + */ +int +qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + qemuMigrationParams *migParams) +{ + qemuDomainObjPrivate *priv =3D vm->privateData; + g_autoptr(virJSONValue) tlsPSKProps =3D NULL; + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); + g_autofree char *key_dir_path =3D NULL; + g_autofree char *shortName =3D NULL; + virErrorPtr orig_err =3D NULL; + + if (!(shortName =3D virDomainDefGetShortName(vm->def))) + return -1; + + key_dir_path =3D g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortNa= me); + + if (!(*tlsAlias =3D qemuAliasTLSObjFromSrcAlias(QEMU_MIGRATION_TLS_ALI= AS_BASE))) + return -1; + + if (qemuBuildTLSPSKBackendProps(key_dir_path, tlsListen, *tlsAlias, &t= lsPSKProps) < 0) + return -1; + + /* Ensure the domain doesn't already have the TLS-PSK objects defined. + * This should prevent any issues just in case some cleanup wasn't + * properly completed (both src and dst use the same alias) or + * some other error path. */ + qemuDomainDelTLSObjects(vm, asyncJob, NULL, *tlsAlias); + + + /* Add the tls-creds-psk object to QEMU */ + if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) < 0) + return -1; + + if (qemuMonitorAddObject(priv->mon, &tlsPSKProps, NULL) < 0) { + virErrorPreserveLast(&orig_err); + qemuDomainObjExitMonitor(vm); + virErrorRestore(&orig_err); + return -1; + } + qemuDomainObjExitMonitor(vm); + + if (qemuMigrationParamsSetString(migParams, QEMU_MIGRATION_PARAM_TLS_C= REDS, + *tlsAlias) < 0) + return -1; + + return 0; +} + + /* qemuMigrationParamsDisableTLS * @vm: domain object * @migParams: Pointer to a migration parameters block diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_par= ams.h index 14e20fb71e..8774b4596c 100644 --- a/src/qemu/qemu_migration_params.h +++ b/src/qemu/qemu_migration_params.h @@ -123,6 +123,14 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, const char *hostname, qemuMigrationParams *migParams); =20 +int +qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + qemuMigrationParams *migParams); + int qemuMigrationParamsDisableTLS(virDomainObj *vm, qemuMigrationParams *migParams); --=20 2.43.7 From nobody Thu Nov 12 15:08:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1793612419; cv=pass; d=zohomail.com; s=zohoarc; b=FH8O0BNA1+BG0XCMALxGWcU+rY0WV2uEB15ZDtska5pCs4kQXe3QuiaB1uTNFTwIUjH8/L5dOGD3vLwZ9WdgKzlZ3KskcVrzR2yWjzGeN13zXIKKoAjDfm14s+s+uXBsnr21PKOSxn2Q7RIWPaQ8sihZRElg23/3uHPB5MGVXp0= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793612419; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=zAyzYVB8Rcz2qlzWYpwD8qYOzWcF9Xbgm7L4NFfbuCI=; b=IRS7Nd74vqX2L7y8mzAHjnx04rxhNeaqODfvR49F0Yud8a0TB9M0I9mpaqfJacx+jC4kifKQd0cVaXG8kFeuRs789eSP+gyrtEa9peeexSSPx40ySKBaM7hSB9sSjIkcc9GwAKa48O/mprIqqyoxQptdtcRh4vH+pL7JMvxA3QI= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1793612419425600.2028879554825; Mon, 2 Nov 2026 01:40:19 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 2FFAB41BE3; Mon, 2 Nov 2026 04:40:18 -0500 (EST) Received: from [172.19.199.19] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id B774B41CFA; Mon, 2 Nov 2026 04:34:01 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 998A33F83E; Mon, 2 Nov 2026 04:33:30 -0500 (EST) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id E73EB3F321 for ; Mon, 2 Nov 2026 04:33:28 -0500 (EST) Received: from pps.filterd (m0127839.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6A29AKXi416934 for ; Mon, 2 Nov 2026 01:33:27 -0800 Received: from ph0pr06cu001.outbound.protection.outlook.com (mail-westus3azon11021122.outbound.protection.outlook.com [40.107.208.122]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4hnfdcu1gf-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 02 Nov 2026 01:33:27 -0800 (PST) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SN4PR02MB999461.namprd02.prod.outlook.com (2603:10b6:806:217::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 09:33:24 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%5]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 09:33:24 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=zAyzYVB8Rcz2qlzWYpwD8qYOzWcF9Xbgm7L4NFfbu CI=; b=1c1svGDCcQWqEdtL3NY9WQGRRQog2G2BXHsWElk5irGkISIvKNx61YDvp AYFTvvgCFrWe1d6zoQJ6WLVmc4KXnM5Yxuf2h+34h0rOHDpKeaga+Ge2R6wwLTvF KYWMM6JiRSqWIHuOYbayH3l4WVWjTg6Q2EVq9BspWzHDqTqlQH+yeSx0nKSSNBuc 0rIQHFMDmOEcddw5M/WMCD2t9ONKLsAxkC04huHXrXJgauAErTOlu6zneKGEnsSG SyJrYlSuACr5uYXcwYaT+M+yy+IhY6yWzrpyOPPdG759Qg7gBsoCyu/icSwlhpKr Z13KFFYbWCpJurtNqR4l/VX3E/A2g== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=yIKQOOOVNl6cUFs0R+ymD1XdT3IvpihExma1TekDIqElq6Vxy3/RvkJdtKxvYg4vegjusNPO8KU8Y22dvV6bNRHOKbJ1muEyI4RCk6680NGzUIELqh9nnkPylM4PFjbDZQNh7Xs7pxKw2Q7OSfSppV842nN+oKSlCqOKhnsUcEhtP2u1FaU1x1ETa/Y9Jh/kLmxaBz3eJKaDuw6sNwf22ucufZmjdA5BqUFlrRoKgAyfrq8n60ViBgpbzVmki61+Sr+XO4oK3tQAttebNpRTB9ms5o0YkPKymabgh8x3KPPAzGA9iwpW6FgBQyc8VjffMHYAJQ2yczjsI+uHyx7wXw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=zAyzYVB8Rcz2qlzWYpwD8qYOzWcF9Xbgm7L4NFfbuCI=; b=Bfu7QSofY4GFoyrGv/D8J7e07t+e6Mwm2IGV8CLYy49T6fu6Iys6k2mV9+oPv/bTHK/9gejZ/NwK3GVqiO447nyV25pJDYxGNU/TtAoYYhdWLvTaa3FVMUhzJ9indcXLw7cA98U7qIKZCRZ8CiIceSEQ+QT/aQooYJAxO+FjaRg/w/k2SygZd/RQjbwo1VeWZdAqkS7bgupjrXXu9gDqSC/wnF0HCTL9p7i+aokKruQgN4dA+HnSROUqLMjFUjmIvkiVMAhSV+uF2oBx9v+nJDqUlzWrgWk7zh4kN0B6mNwa+kW1Thl9+xgMYx/elgY42CQiGUCHrl+YyVEgQliWyQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zAyzYVB8Rcz2qlzWYpwD8qYOzWcF9Xbgm7L4NFfbuCI=; b=Ks4CQ5jRiNm3dwshgSvCafqprx8bsxr3N8m7XqSpU4kxe6sffsV3g4lG+Bq0OyUvHpa82S9i5zeSNgJ07gjNrW51CQEXMN9dzaLq1l/E2ApIZJqch+/lhiGANREJpvc/2CLERh0P3QtBwGS134mH34aqrH289/7PfvVxx44A6J9Bg8+1eIUbk/4E0yl30kD2Jst4VUSTwgntU8fAIN8sJph373bW0BRKLxwNtIYLbnYLjatgE4kgB6ghGvKxaGOONebBWgq2aq80zdA+fpW4h5gPHuB+dK+sZUWR22kgxCgqpIgyyfPzxT73NB5wVn9BcEJEXHLLERaEguUTL/EzUA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nutanix.com; From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v5 6/8] qemu: Set up the migrate TLS-PSK objects Date: Mon, 2 Nov 2026 09:32:43 +0000 Message-ID: <20261102093300.44810-7-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20261102093300.44810-1-abhisek.panda1@nutanix.com> References: <20261102093300.44810-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ0PR13CA0185.namprd13.prod.outlook.com (2603:10b6:a03:2c3::10) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SN4PR02MB999461:EE_ X-MS-Office365-Filtering-Correlation-Id: bae8bfeb-b5fb-4707-f43e-08df38c45764 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|1800799024|366016|261021123027099003|56012099006|261009223027099003|261009223327099003|261009221227099003|261009221727099003|261009220027099003|261028144727099003|261021121427099003|261026121527099003|261022075727099003|261026140227099003|261022105027099003|10067099003|18002099003|22082099003|3023799007; X-Microsoft-Antispam-Message-Info: rLKpYvo3uxXuPV6IVRE3QCaD14TNgtNUNCiwaYvgMxlEwAwC7CrSQhcZApjzeh4QoTiOD7s4EfWWQu5Fp1f6Pghv0pXH+YtvALwRbb7dbfalGcyeSYafuvTiLEqGhvVRHe1/YO4yrYeHHeDKKAJjQAZ+Zeha5kimJys2E6sL1AruCtD7C+jYMjUyufskmnv/7BdK3/qUW+jBHmSkKSOF7lGP0IPAWw+M6gl2htwhEbZA6i7HviPFl2nwUtyH2rCyswIVgjwdUrx9fkSjtu3YIXMP8Co6P5w2xTUrCve5+C1OZAiASqD2uFVstW66gDYDrXSRXtALrnNSHqCCRvgBQ1KsfEOuWxtTPTBnf997D4t5Y5xZ1Dm8vMzQCWnP9orJelbg+SrVPwhXS7gKbTbtsTGhq5YyQQpzFh7bC2u8diAiU9tRAOxmLwpeKJleJNVJYZjoMnM4LA3v7O+L7PzFpLS+pZXzRSTYx2OiRYjGCgGlApLaMkIeGPqyfeiRCL1kd3HxuAokA1R3GW8lTThEnseX+wAm4P5ZgP9MNoti80u3Zy9yBvoWQsgpkVeA8e+X0/qdXJMba0qmSuBck/8rbW0ZLfdtkRiNUZPxPuty075l1S2qUWMjNdD5PGJ/81OXMQ9EzSRWnR1L0oRVHqMBAPaJlpAiBTo3G1Pw+SJhCxo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(1800799024)(366016)(261021123027099003)(56012099006)(261009223027099003)(261009223327099003)(261009221227099003)(261009221727099003)(261009220027099003)(261028144727099003)(261021121427099003)(261026121527099003)(261022075727099003)(261026140227099003)(261022105027099003)(10067099003)(18002099003)(22082099003)(3023799007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?AIS9NtpsGNGcIrZcF1o6RhGdFaQfSQS6lvuDdCpN7YGW0k3D4g6f+HT2Dead?= =?us-ascii?Q?Wu1OLQitLV8Z3SHr7z5zuehtujyiyM6t4wd55SXKEBHEerp6Lh7WENOo9YvW?= =?us-ascii?Q?DpPSvIFTiPVjNDA1AUTx9n2E2bS12iF8qa/I6ZmDrMxi+y+0LOjL66b2yoOu?= =?us-ascii?Q?AIuG63urHMiClXbu284R6s7ycM6C/cI0DJrPTx/HTADn9zfgNa5qZ2LkM4N4?= =?us-ascii?Q?2ex7NUw9SCyVlluCJMkGR/4qgmPlzQI3mG7Fge6rC7RBcbLNrnsMpKHtSXSm?= =?us-ascii?Q?9ueEW5cNYnzjfZx7Jbz/nOl5CmmEeWDHCWV0lzX/5ZXvQDqOlAfsrBHZKlvI?= =?us-ascii?Q?PYdJ0uD2tcwO9ApcRfLL2ujIVBKoHyysuma9wS+IxbLRFxE1VVL75xKZ+kvK?= =?us-ascii?Q?JT30U5aC/DDyTgEOhpEdti4rIcEPlIDJMcuE1v/+GZEHZZW63+U1hucLp8fK?= =?us-ascii?Q?IqCawvJdCDwYDsePBAZCjAo73NfYsMbH0yqF/fSfEIreIOSN5qXjqCVHu+6p?= =?us-ascii?Q?Lu7lYML2/Ax+6xJQDPhPWDdcI8FvRK8Kte191/CVP8cBnreJZxtJ7fPKG6v3?= =?us-ascii?Q?A/CFNLUu4XxLAorqzaVsV78AMUHctD/BowSZkaQZzZMpWY7NLwBb0urGbRjJ?= =?us-ascii?Q?469Q1AtEFYGEK0hTRLUCqkJxvIFLB0Wv+ApliEpvcLZZEdN7jg66qCKNeGT7?= =?us-ascii?Q?JoQK6n9aymTq3BTO0+vrV2qcGNnboSfWb64eaOZtp65HfUiufFp4863jt0s3?= =?us-ascii?Q?vMz8+/h+pkS+aWgVpv9rRYTJwiEMikYyvqc7bY92XoPnuRxP942S6W5ZuRDq?= =?us-ascii?Q?LED3v2CzyAmhxw/6B8esJxCJtxGYHaZ7hkUAEdWpZBE2RDax/KZAtdoVzZF8?= =?us-ascii?Q?Ag2KqTW67TEPCoWAi2zp7CBjWwaKZClwns1wxSxtC+1N5JNA9rJCfoLwnu0i?= =?us-ascii?Q?AKwMj1ADETl+hxajet4SFFStWJR4x4pbc3RlPVNJSdxexmgU8iIfv5X+MxSY?= =?us-ascii?Q?laQyea9mcX42T7cAMEJRDTvldxa5/Dzivy2NY1QXn5SB3w7NiYcJS+fmPn6Y?= =?us-ascii?Q?DsfzedEVaCBJDdfw5vMIXyPhdZoKR1Sun13yRSb4mrPC0UpNla/O33wggSHb?= =?us-ascii?Q?RVZY5R9vxjunK/3dDRGnI2AN1xugqfktK8kDwdInk+FBc9JM63aNR/OA/s4V?= =?us-ascii?Q?otGPHTmMqCMYX0+hDnAeJGnaXeOcCP69qD6IApoEL4+0iFTKqvJADAwqiHjL?= =?us-ascii?Q?jLCL+EH+r/jQQrTjXF8H5S31lWgT0W0zJTz8McQ6+76VScU3FzC7dBL6gK1K?= =?us-ascii?Q?fXgwoYyHoL05ZyfZ9E+cwbkpOFrY8xxOIfirG5EobwFsKA7XvVkmxe5bsFBc?= =?us-ascii?Q?QNVDMyEBCcR78FOtMk8KU++2iUKoZbRvxxlz481AAnEF3ifhBCZZqv3oqfB2?= =?us-ascii?Q?dGAofJwAuH/WLbXN8hdmPdeSVdlKQ0y+r2oFW2AhJ1k405qSoIZzdt2FWX01?= =?us-ascii?Q?wx3K8+JhG1l1++gAxYs9vz2wUIe2D0LdQMItLgDY0ZQzxaOaNP9ZA1+5obQJ?= =?us-ascii?Q?1CgnWb5YoKUnUbtxgy5lY2bjLR23nlPZw0007FT1meNtN6V9YlhMBpx/Ti0F?= =?us-ascii?Q?ajJk0hZr1Uae2tNvg8g8VBfLpHMJCy/DkdDM7HdQw4aE2w7d3tYGrkMNxfS2?= =?us-ascii?Q?OxUbe/71WXbVG3IvN+i6LY5MWwiIXr8hg8AODZb1fglS0AQom7CrDqvfacnM?= =?us-ascii?Q?4sSscsEqHOk2akahWi43CC7nutzz4zY=3D?= X-Exchange-RoutingPolicyChecked: rHjJPuBGOH8gHOBvyx+4jEx4qrFDOHGhFGFS5E9+UrtkJunkSCFhSJ8n3j2AcBbI9amtpCRQxWPfUfCzTDOmYChD1ctbOrJWgQ+BpqCGH37v9/WiqvCykOgSX71ziVBg7vYWAbuyN5ipabZamN5oZXUPbKTaMqz6M1W5cu7/mySj2TAHRZUlu65yHtdz7mvrLyBmqm6BCI4DTYriQPDLQLhLcOr5WD6tOh1a/uNRv+cud4mzW0UXu9h0+6waLFcdOtRr07z37KP19znwfbuDmYjvftUq03omTv4YQrbppD2WtuoAQETip9kkrJCdkv8sj9HnOnJjdBNd2VXt+hfIKQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: bae8bfeb-b5fb-4707-f43e-08df38c45764 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 09:33:24.1672 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 7G5DFWi7xQgMjA2PFBxwrao04z/GKdFZDKu3XBPMIKs5kI1c3q8muBJuXl0b/9dOV+qHRv2gvF/CuXuDyYwuPYbODlS925zQVdyYJ5yayEY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN4PR02MB999461 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX2AtWdYjpmMu6 dXtJ2bOrm5ThE7jr/K/HbyiRvWiMO4WGjgYOg3E0Zii4kAajv9jP3RB1gbpmqDtpYE8GsYJ4yxS ZFdkrqGboMOVJQLzbMsEsdhVbFbY2jBLzLTFKf74ku0zZjnGStaEjxEiWYC1JEL39+166W1Lv6y TruG7klP8jrFizYdyQn92oBJDPRTbXa2j5dAF9YCwffml8Z/kts54I2nG3inCLNkEntJCvsmP5D Pbn+95n2CtwDH1F43QBnka0yGTPSlwNgJtc04BOCNXLymcKuJWsM1p5gkEPJknnFY82Q5LRp7fi 614n+UaQry6zz8KTMT1JxExCrQZB5mkTYJQ2C4r64E0syILV6nSoNgtTurAtdrx4+IyTKIBeXRG bH9d87IgIlMlua21Xc5AkyrVIFKvfvbcRkmg+6bChp1B2TwHr1C+wexiV/++l60fC/0lJuVeRyX JUx4wZdLG3czEGSYg1w== X-Proofpoint-GUID: tpFWnwjbbXA_Zg6RM3ythmLrSciT_o36 X-Proofpoint-Spam-Info: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfXzeN2AdSeEs0i uJoiuoCB+DJunTeLTkP7pEVAqTChMTnte3xxFaNcilPLzs0CKpxBXc2qWTre/L/+K0TpYnUAwv+ 8LL9+wYXIi2TC1345jQ3uOTQM4q0qZo= X-Proofpoint-ORIG-GUID: tpFWnwjbbXA_Zg6RM3ythmLrSciT_o36 X-Authority-Analysis: v=2.4 cv=fNCsTpae c=1 sm=1 tr=0 ts=6ae858e7 cx=c_pps a=zgkGZ2ZeoNE/JTKmChzXMw==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=zJRp6_cAMcgA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=y4UcunY2MAxhM4LwGdWI:22 a=64Cc0HZtAAAA:8 a=X2ZueTcw19blY-b0zkcA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.138,FMLib:17.12.100.49 definitions=2026-11-02_03,2026-10-21_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: MCXWHFYGE5SKCHPIZLYE4X5WFDFTTEQB X-Message-ID-Hash: MCXWHFYGE5SKCHPIZLYE4X5WFDFTTEQB X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1793612423658154100 Content-Type: text/plain; charset="utf-8" Enable TLS-PSK based secure migration, if the source provides the pre-shared key in the migration cookie else fall back to X.509-based secure migration. Suggested-by: Tejus GK Signed-off-by: Abhisek Panda --- include/libvirt/libvirt-domain.h | 10 ++++-- src/qemu/qemu_migration.c | 59 +++++++++++++++++++++++--------- 2 files changed, 49 insertions(+), 20 deletions(-) diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-dom= ain.h index 9ee153c6eb..f3e72065a9 100644 --- a/include/libvirt/libvirt-domain.h +++ b/include/libvirt/libvirt-domain.h @@ -1089,9 +1089,13 @@ typedef enum { VIR_MIGRATE_POSTCOPY =3D (1 << 15), =20 /* Setting the VIR_MIGRATE_TLS flag will cause the migration to attempt - * to use the TLS environment configured by the hypervisor in order to - * perform the migration. If incorrectly configured on either source or - * destination, the migration will fail. + * to use the TLS X.509 authentication mechanisms only if the TLS pre-= shared + * key (PSK) authentication mechanism is not provided by the source. + * If the certificate or the key files are incorrectly configured + * on either source or destination, then the migration will fail. + * + * Note: Since 12.7.0, Libvirt supports the TLS pre-shared key (PSK) a= uthentication + * mechanism along with the TLS X.509 authentication scheme. * * Since: 3.2.0 */ diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index ce791bd3ba..c958edef6a 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -3500,9 +3500,19 @@ qemuMigrationDstPrepareActive(virQEMUDriver *driver, /* Save original migration parameters */ qemuDomainSaveStatus(vm); =20 - /* Migrations using TLS need to add the "tls-creds-x509" object and - * set the migration TLS parameters */ - if (flags & VIR_MIGRATE_TLS) { + /* Migrations need to add the "tls-creds-psk" object whenever both + * sides support TLS-PSK authentication regardless of the + * VIR_MIGRATE_TLS flag. Otherwise, fall back to "tls-creds-x509" if + * VIR_MIGRATE_TLS is enabled. Finally, set the appropriate migration + * TLS parameters. */ + if ((mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) && mig->tlsPSK) { + if (qemuMigrationPersistPSK(driver, vm, mig->tlsPSK) < 0) + goto error; + if (qemuMigrationParamsEnableTLSPSK(driver, vm, true, + VIR_ASYNC_JOB_MIGRATION_IN, + &tlsAlias, migParams) < 0) + goto error; + } else if (flags & VIR_MIGRATE_TLS) { if (qemuMigrationParamsEnableTLSx509(driver, vm, true, VIR_ASYNC_JOB_MIGRATION_IN, &tlsAlias, NULL, @@ -3517,14 +3527,13 @@ qemuMigrationDstPrepareActive(virQEMUDriver *driver, flags & (VIR_MIGRATE_NON_SHARED_DISK | VIR_MIGRATE_NON_SHARED_INC)= ) { const char *nbdTLSAlias =3D NULL; =20 - if (flags & VIR_MIGRATE_TLS) { - if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_TLS)) { - virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", - _("QEMU NBD server does not support TLS tra= nsport")); - goto error; - } - + if (tlsAlias && virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_TLS))= { nbdTLSAlias =3D tlsAlias; + } else if ((flags & VIR_MIGRATE_TLS) && + !virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_TLS)) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("QEMU NBD server does not support TLS transpo= rt")); + goto error; } =20 if (qemuMigrationDstStartNBDServer(driver, vm, incoming->address, @@ -3612,7 +3621,7 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, qemuDomainObjPrivate *priv =3D NULL; g_autoptr(qemuMigrationCookie) mig =3D NULL; g_autofree char *xmlout =3D NULL; - unsigned int cookieFlags =3D 0; + unsigned int cookieFlags =3D QEMU_MIGRATION_COOKIE_TLS_PSK; bool taint_hook =3D false; =20 VIR_DEBUG("name=3D%s, origname=3D%s, protocol=3D%s, port=3D%hu, " @@ -3621,8 +3630,8 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, listenAddress, nbdPort, NULLSTR(nbdURI), flags); =20 if (!(flags & VIR_MIGRATE_OFFLINE)) { - cookieFlags =3D QEMU_MIGRATION_COOKIE_GRAPHICS | - QEMU_MIGRATION_COOKIE_CAPS; + cookieFlags |=3D QEMU_MIGRATION_COOKIE_GRAPHICS | + QEMU_MIGRATION_COOKIE_CAPS; } =20 /* Let migration hook filter domain XML */ @@ -3678,7 +3687,8 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_CPU_HOTPLUG= | QEMU_MIGRATION_COOKIE_CPU | QEMU_MIGRATION_COOKIE_CAPS | - QEMU_MIGRATION_COOKIE_BLOCK_DIRTY= _BITMAPS))) + QEMU_MIGRATION_COOKIE_BLOCK_DIRTY= _BITMAPS | + QEMU_MIGRATION_COOKIE_TLS_PSK))) goto cleanup; =20 if (!(vm =3D virDomainObjListAdd(driver->domains, def, @@ -5080,7 +5090,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver, VIR_AUTOCLOSE fd =3D -1; unsigned long restore_max_bandwidth =3D priv->migMaxBandwidth; virErrorPtr orig_err =3D NULL; - unsigned int cookieFlags =3D QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS; + unsigned int cookieFlags =3D QEMU_MIGRATION_COOKIE_BLOCK_DIRTY_BITMAPS= | QEMU_MIGRATION_COOKIE_TLS_PSK; bool abort_on_error =3D !!(flags & VIR_MIGRATE_ABORT_ON_ERROR); bool storageMigration =3D flags & (VIR_MIGRATE_NON_SHARED_DISK | VIR_M= IGRATE_NON_SHARED_INC); bool cancel =3D false; @@ -5159,7 +5169,12 @@ qemuMigrationSrcRun(virQEMUDriver *driver, /* Save original migration parameters */ qemuDomainSaveStatus(vm); =20 - if (flags & VIR_MIGRATE_TLS) { + if (mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) { + if (qemuMigrationParamsEnableTLSPSK(driver, vm, false, + VIR_ASYNC_JOB_MIGRATION_OUT, + &tlsAlias, migParams) < 0) + goto error; + } else if (flags & VIR_MIGRATE_TLS) { const char *hostname =3D NULL; =20 /* We need to add tls-hostname whenever QEMU itself does not @@ -5208,6 +5223,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver, if (storageMigration) { const char *host =3D ""; const char *tlsHostname =3D qemuMigrationParamsGetTLSHostname(migP= arams); + const char *nbdTLSAlias =3D NULL; =20 if (!mig->nbd) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", @@ -5220,13 +5236,22 @@ qemuMigrationSrcRun(virQEMUDriver *driver, host =3D spec->dest.host.name; } =20 + if (tlsAlias && virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_TLS))= { + nbdTLSAlias =3D tlsAlias; + } else if ((flags & VIR_MIGRATE_TLS) && + !virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_NBD_TLS)) { + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", + _("QEMU NBD client does not support TLS transpo= rt")); + goto error; + } + if (qemuMigrationSrcNBDStorageCopy(driver, vm, mig, host, priv->migMaxBandwidth, migrate_disks, migrate_disks_detect_zeroes, migrate_disks_target_zero, - dconn, tlsAlias, tlsHostname, + dconn, nbdTLSAlias, tlsHostname, nbdURI, flags) < 0) { goto error; } --=20 2.43.7 From nobody Thu Nov 12 15:08:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1793612529; cv=pass; d=zohomail.com; s=zohoarc; b=U4cD9+F1RyfhfHVzl/49wBBVFh7QeS2h/pCZ2hcegOi6w+89g1d7LEkO872b2XckqWyofGuFuGdIxoeQ23YwzdnHCsozVcyfdDcVtZmY7Rs9eHycRAkPYONh1bXW3pXvWH+BBcZL+v4n7E61rQv2XvejYPQekqssSEl3zX1SKMw= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793612529; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=aCXmgsJ+zcGHCSLxl85VG8CzQg9J6+T9LOe1kVWsEaY=; b=m3u52OQMGDltIRDATla30qIhgUwur8CzHNNfMvZzIwrOSAtCFyTOeTLXDqk+I6wwKlx6jfkbaH+1ZwTsyUjonyZD2fXrw56PgKNPzm42afcYDgkaXA/WlaXnwjWBV8hW5dL1BfC7SW8w9a7Ak7WqBDUR43PjTMQ+0za+njPMAVY= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1793612529497560.8527705554905; Mon, 2 Nov 2026 01:42:09 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id B765E41B74; Mon, 2 Nov 2026 04:42:07 -0500 (EST) Received: from [172.19.199.19] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id E08ED41D85; Mon, 2 Nov 2026 04:34:07 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 024E841A3B; Mon, 2 Nov 2026 04:33:31 -0500 (EST) Received: from mx0b-002c1b01.pphosted.com (mx0b-002c1b01.pphosted.com [148.163.155.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 38F7D3F33B for ; Mon, 2 Nov 2026 04:33:29 -0500 (EST) Received: from pps.filterd (m0127842.ppops.net [127.0.0.1]) by mx0b-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6A29AE6i3104241 for ; Mon, 2 Nov 2026 01:33:28 -0800 Received: from bn1pr04cu002.outbound.protection.outlook.com (mail-eastus2azon11020073.outbound.protection.outlook.com [52.101.56.73]) by mx0b-002c1b01.pphosted.com (PPS) with ESMTPS id 4hnfncb088-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 02 Nov 2026 01:33:28 -0800 (PST) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by SAAPR02MB387404.namprd02.prod.outlook.com (2603:10b6:802:302::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 09:33:26 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%5]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 09:33:26 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=aCXmgsJ+zcGHCSLxl85VG8CzQg9J6+T9LOe1kVWsE aY=; b=Y+LDyQxc+dmF0tZhNcEVkm0WzYML2URmQIfCzQF0OYqptyx4895PLd4wY K5tScK6aOqLWRUZ4ScvtG1NjTA2A5U6bgmnQk75fo5T9lwMf8r2+CS3HU57vFsYn u/HtiK7zXxXGkNa6aTsumlMlaHmq95Do4BcY1CFDVeNPCcQnfSWF6bYa2l1REuAZ 3tDRgIdDzm3WDIC4+3TNt3Ki3xgy+ouJpHtzgRX/qyemFTkjQD2C5+gWRlDJ7//X LEpBu64VNlptkYHpqvPVwbzS6UoXX5RJaosH7az+N52yBgZhBhM9/gLvUUwU8/c1 cXnJb2tQKEAHOIKI9uvKsuBjwXgtQ== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=wA9LkeynBrqF65dwwA9xM1kg38juV0BBnPXVvSIAym3pM7rX92mrHZqluP4YpTk0Wgs4AOcvCt7NghdZcdwpiU4dcdlxWjE/AU6IEglnK6hXWhwJOiaZBONvIfpr38njBQhhZWmrIK0A4sgew2Bp1hCSDgdAly8PL4Tpzm2g/NvF4MAgolYlsoqfld4eeW5y6hwEf5OgN726TBIa6U1fVsYE2+DERdOsKsWNJxe8RYaMQ/4oDbHN+J167M1E2gSE184/91AYbh6U1oLRD25Rtosp4iOY8qk0eq/ZDUGwEtZFeXLqj1HfI2B0P/dWplMl0TsemEoZA16rROSFGyuIMA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=aCXmgsJ+zcGHCSLxl85VG8CzQg9J6+T9LOe1kVWsEaY=; b=iXSYf7VX6PXgsjDPjaI3HK47Y90d7tQo0QAgKYczsdipr0ViXIcIss5jWuHIiYvRjMT11F8dF+sFR2l0eaTwW6aoTIcllEBP2/KS73tVL51qF6DifLB3iXE40wu3EvGY3SXV8x8VW9lKhRKwcKl3Fwy28hLDX+cdx57ZMDFG5KL9JwgygbK4QHzdL4Y4KwX8hNhwjuGVc0GlshJNbuhWB62gK9EgLJ9+YyXievmQOTA+9IO2y/6l1EoBY1E4puHgFT6dh16Vtzty5+tRK9puZ/G/Qa7PGD9rXO96XkMXw+357tjkox8P3yi3QMlzgIhI/Vp+2w8E9OlFO7/0rmvmrg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=aCXmgsJ+zcGHCSLxl85VG8CzQg9J6+T9LOe1kVWsEaY=; b=OM8sh18/lobJxA/FGN3Gr5YsBQRcoBAm+8STBqfg6qIVH/ocWPVKLBTmALi3VnpaES7j1EupxHTgbqv0TKI/hE8mb7qGTSdG6EnRemLQdKVQvlJd+r0BL2gMaSqsgSs500Vz9urMzupx61tTuZ4MGj2TXVob9f3kpwMRUXQLU6lRtvDP5xawIAi5X9o4yvGSvGylu3qvegYH08NiEymzSRCkXMtZTeFAoVufpMCpXxp9CjUYeheP4xfA7w/Ie5OqDSsZK8fEwMg3rvDOKa42mx/VPIW7lWMNZNxgQC9VNbwiMc4z/Cb7+3qizhTFu53rwSa7k/PailoIE5SUFY9pXA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nutanix.com; From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v5 7/8] tests: Add testing of pre-shared key lifecycle Date: Mon, 2 Nov 2026 09:32:44 +0000 Message-ID: <20261102093300.44810-8-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20261102093300.44810-1-abhisek.panda1@nutanix.com> References: <20261102093300.44810-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SJ2PR07CA0011.namprd07.prod.outlook.com (2603:10b6:a03:505::20) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|SAAPR02MB387404:EE_ X-MS-Office365-Filtering-Correlation-Id: 54163c63-e7e4-4692-88a1-08df38c458a1 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|376014|23010399003|1800799024|6133799003|10067099003|22082099003|18002099003|3023799007|56012099006|5023799004|261026121527099003|261022105027099003|261026140227099003|261022075727099003|261009223027099003|261009221227099003|261028144727099003|261021121427099003; X-Microsoft-Antispam-Message-Info: j/dChgr2ZIUtiRtlY+ku3HytXR7JnKhtI6zfcljLovSwSr5X+zQh0hiBGMHZ4A8bo6sR1aomO+sJwwVuvRbsb74QnrsBmCAgpmjgTojUVxWwmw7EcNjeFktUWQrhTleertbHxnLLxbSNKKm5JAs5nOo67jheb9mvCmP2xMeBkbAH0Y3RM4H4zOEB5VzKdNpv1C8UDV9cRi7pvqmmA5oD2zgUXQ42I6f3MuuiyrWPihWdhRshdRLw/yKlD0CGL2G+kz+6q5TPO+EJuiCTJbYt+QxnSSa8e1gUIUaOO4X9mTckDfSR/w1ZqRN8P1zDVz8Z9XIHe+Ku1Wxruusol568p+L3IyzteML4edDg4/WRlq54IzMT0YmD4kS44MKPtSiRS7bdOzrWEoFsEeZprIDguBafQ5rCAo8tzBLuFRzLSx2SqNJKcxvHOBy92dZXjmQUqJw4srXYvEkbuhRporDBNlUgoi89bNikxH0jcvhmXwh81UEQMunO4OfgLBduGLpXYA/OG6bvK1/SGlgmp0WRd+Z0SmfzPY+pIxsAU5MWEq9UtzirJZbjUnd3TyBAy44STBK7iLd+rWWpmIIDDVuVnWV1r3uvyh8PslEiyQ/Jw4vTIP91BhewMGDSqIE4ZISWV31Y/zujpsebN1dw1iL6Mf2iqrZF57kbH86fpw7uaIE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(23010399003)(1800799024)(6133799003)(10067099003)(22082099003)(18002099003)(3023799007)(56012099006)(5023799004)(261026121527099003)(261022105027099003)(261026140227099003)(261022075727099003)(261009223027099003)(261009221227099003)(261028144727099003)(261021121427099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?LKsUG3dmiqwjtuWtbtS+PdvRJQ/4IwPmJDRNXXkD33Jb0Jx7LeCFMwmuU2pV?= =?us-ascii?Q?5N6ESlSyFphoXFrZEfdjgWJsqrukorFNUokXBMfzwJbXgkmiNq+V893ZAb7i?= =?us-ascii?Q?hhaJR1Jao55NKwRp2T8NCa1ffLVClsUNHIhf0ymONCkG3YoGWxzeIK3yUB5b?= =?us-ascii?Q?i7d0toRS58ckR31RPo5IBneEYQ1JWVVkCDDN0uKcsfs5e1RaasVnwDFsryun?= =?us-ascii?Q?p2BC5qRTNKt4Mg7FTqsGHfmekBQQvCnBuMYR/VIAi58m6Z1bOPAjYyhN+m9C?= =?us-ascii?Q?2Y001tq+SBs1/ZtccZjGNMVQbWpw6apVAnsUOwwGpCSoMUDHKbBle3PFww4+?= =?us-ascii?Q?TDTxo0emyqh8F4M86M9FINZGmclG6P1SGMGrE74cpaioqjNStfTUBd85zio8?= =?us-ascii?Q?ixzf9Qv5L7l3bpWfPzJrNy/nigyeQXlRmmDnwmVla/v2JfZWtsjTJJznbEg+?= =?us-ascii?Q?0BDlmXxiWcn4oZxgevZhjS6dhbXWblYcGNy7blbtlmdeS+ylJDA6nXgSaC45?= =?us-ascii?Q?janchSy0kYoVmDOeHU6JMo3yhxIrtlQa5m8vQ85Ex0G6sbmp+Pn4amgHLkpS?= =?us-ascii?Q?a2E4JpQwlkpvGvMdQg2jgVF74snQmvFICDar3RVW48+8FyO7mLYjajgHc2d5?= =?us-ascii?Q?qS/f6bs0Rone8fmVfWP6/k9fIQhkIM5Wo+8XSH4gGDURt2Up6HW2v16OCy5G?= =?us-ascii?Q?v1B/4fqIOkTnf+ZirxcTmWIZJG8RME/dg0+eeWLh3alRSe0E8FyteWWkgsEZ?= =?us-ascii?Q?vNNwTPi3oOGLNJjn/pI/LYJ0XoEkqyXLKh9/EP1fnS5ilYwd9VizA9+3v3+w?= =?us-ascii?Q?w9KQn87a3DFSKS25AkxNlVcV5UCaKYI4Q0P3LiGsSOGobVzNC1gVGWjbGRFv?= =?us-ascii?Q?qwznfAp0tprzxo8ypPActQbeafM5QzM6EySIBXxeJ9eP7T0XYkRLdKohC3+0?= =?us-ascii?Q?8Co+yTZpiPRfI4sau3/NiBi+35Rn6aKDifn2oWC3iVoxTyRLR8GFjghYDw8b?= =?us-ascii?Q?7hLhkabPkR5SHqGq9SyIu9wNK/YDdPRip353K8tGb1cXvt0/lVmTRwChCDCt?= =?us-ascii?Q?qtp0t52VdHcW5zByEOnricdOMReeiAR9Ai9tev/Mo95o2hukzZoZSO5gJzev?= =?us-ascii?Q?FLKvtb/fEuPHq8ATrhQMKr9teGxUvyxQm/VClpBUq9us3xbeAWTWYJ7zQKWF?= =?us-ascii?Q?7Ic0X+um2PTlmW156pzegd8FIxxjvVYSVOz2OEbRDHjaWSVioLc5yIt34Nki?= =?us-ascii?Q?V1MI6yaf3Vy4Sctbk6vRAhtIM2IbBk5rvFwudJwsaTaK3W6RfiDystAuECkc?= =?us-ascii?Q?RBaUamrYyJ0hYbudytGZcnI0suTzCYLtV9ZDKLZoRW2ynb/NsbRaWIFpwy+i?= =?us-ascii?Q?rsAOOCIsk3HI4gDOhBmplPrIyxTXBpZ14Lwg1rUE9nqPD611hbfbpsRrB+ql?= =?us-ascii?Q?5MXVu+lRf5uBAILoxIG21LqHtgHVcp7Na4C7V7id8P20jDnLzgW/jhrzNeEz?= =?us-ascii?Q?b9alpZ6SPM86qbzTpZWg3C1TwLViaoUZmORTd4x6MjkGPK81TqAv0GLcYWS2?= =?us-ascii?Q?GpJXVFQIVSlZiiyf+IHe56Ci4F6w3hO/iNVVnqBBqVoJdqm26U2vTsyVT3r5?= =?us-ascii?Q?5RdCPmZWfij7GGE6GTJRKU+ZgEucKBFdFwK5LrSorbw9fHxTX3YmJUfC9cPa?= =?us-ascii?Q?JlmG/wpkwXqVv46bhCrkkO27PsA7OTkqMabhXU4L0ZbJWoRT0fJ4ipkbNpLj?= =?us-ascii?Q?pVNPlP/mUwR0dTRUj6jdX8CZF/OfRg4=3D?= X-Exchange-RoutingPolicyChecked: MD8hbhTXesoRadg5K9rllcWhRYssEB3sH5+7CKjhuFmHeACv6mHj0GUTEc/jvf0FFDjJJlS4olRvZBpku5Znmg2Gy0N9cKIqdWsF3ydmvWKQgD1cv81z2PZz0Oq2jMUSaTY0ANmU49jGWad31fjUGg/bmgABkCgcG8y5mkBqEH3TIHjWB1/d12GsIn1LZdSXasqwBBk1EVuf3lODAZlr6FW8i6VPCe5XTawAPJu8UvMQxgHZ1GwkLV+4j2+ArcEjNw8OWjv7d12a41g3emk7YGQjBhumcRtoRoK4PAy1HG1ZD+BfF5ORnp/2iHmBLxiqDHgTHScfFduet7Aq5jG9qQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 54163c63-e7e4-4692-88a1-08df38c458a1 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 09:33:26.2512 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: zOmx22mAiUZaozx2JwARWas5dDHHnjUfogfIIqQtPg1X4VHwdAiJn3UQ/M5FthMv20qcyHuHy8WYE7MDIu/LqxFfRGCeFv/65AfrZpCX9o8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SAAPR02MB387404 X-Authority-Analysis: v=2.4 cv=ZJlCCn7b c=1 sm=1 tr=0 ts=6ae858e8 cx=c_pps a=jbJ28DYoiqYHDHWWOYDcbA==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=zJRp6_cAMcgA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=VUi8bpU7OL1Oj2-RSIOF:22 a=64Cc0HZtAAAA:8 a=m3rDw_47mjERg_1OAhcA:9 X-Proofpoint-ORIG-GUID: ZIY-YS7SCgyl0xkLEX2grSZEvI087xA5 X-Proofpoint-Spam-Info: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfXw6aDUjAU0RdR SgFfwtrJX/VbTe7NDEIFHUJ9p+Tz1fl6LTNJzln30zDvjMkrDoYiWB7v1ZS1yii8WttGBlp0Pj4 2RgYG2dTcNTIbl7nJxCmm4SeCcpo/nU= X-Proofpoint-GUID: ZIY-YS7SCgyl0xkLEX2grSZEvI087xA5 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX8fqdYU9kpHvq vjc0nMWEKU5htHRCQRjyccK6h7ADQO9pAdYCj8XkSc3Kp2DlVnawQTs4XuGOSNSJXsjZnF9Lwno Ud47Ig2UbdwgU3CTfDjxN04OFrAyD1WPdRW8bEqsqJd21+djm7SQ5R3PEiDxFvpNr1Gzrbkgome O2ow+PLDCngaW+pg7yRoWr2/Tae+7/LKuZMZl0PuKpfr6HBmq7xeZ+zaXZ9ABWx4/5QkT9fIoV4 y8Ku/AdggphM4Kn9Ca7jsse4SeDCQRK03MajVwv9+qi/t3D3ZZ1e6dbfoWp/DsRHYDtmoLQhu71 vYSPSFhwPJvIDN3hVNfXjmTLn6Gz1U1DQQAaYHUqQvz4BkjSMSKUXREnrT4lJTj1sphhaExLSjA xOnIRlyqloW8OPwBXywcrlYyCOyRkK64ucW6upCTKl99tChUb4FX1K5OAY57NieyxS3AgW2c8IX BCTCD50azkNdMCxA3AA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.138,FMLib:17.12.100.49 definitions=2026-11-02_03,2026-10-21_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: FEC3TFTD7ZRZOEHMIZHXR6F6HNZ337VB X-Message-ID-Hash: FEC3TFTD7ZRZOEHMIZHXR6F6HNZ337VB X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1793612533743158500 Content-Type: text/plain; charset="utf-8" In the case of TLS-PSK-enabled migration, Libvirt manages the lifecycle of the pre-shared key. Add a new test scenario to the migration cookie test suite to validate the generation of pre-shared key when the QEMU_MIGRATION_COOKIE_TLS_PSK flag is set. In addition, the test also checks the length and the hexadecimal encoding of the pre-shared key. Signed-off-by: Abhisek Panda --- tests/qemumigrationcookiexmltest.c | 123 +++++++++++++++++++++++++++++ tests/testutilsqemu.c | 12 +++ 2 files changed, 135 insertions(+) diff --git a/tests/qemumigrationcookiexmltest.c b/tests/qemumigrationcookie= xmltest.c index 41846b8631..60ca62f98a 100644 --- a/tests/qemumigrationcookiexmltest.c +++ b/tests/qemumigrationcookiexmltest.c @@ -16,6 +16,7 @@ =20 #include =20 +#include #include =20 #include @@ -92,6 +93,99 @@ testQemuMigrationCookieDataFree(struct testQemuMigration= CookieData *data) } =20 =20 +static int +testQemuMigrationCookiePSKValidate(const char *key) +{ + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(&driver); + size_t expected_key_len =3D 2 * cfg->migrateTLSPSKLength; /* The pre-s= hared key's length is 2 * PSK length */ + size_t i; + + if (!key) { + VIR_TEST_DEBUG("\nThe pre-shared key is not present in the migrati= on cookie."); + return -1; + } + + if (strlen(key) !=3D expected_key_len) { + VIR_TEST_DEBUG("\nThe length of the pre-shared key is incorrect."); + return -1; + } + + /* Check the characters of the key */ + for (i =3D 0; i < expected_key_len; i++) { + if (!g_ascii_isxdigit(key[i])) { + VIR_TEST_DEBUG("\nThe key contains non-hex characters"); + return -1; + } + } + + return 0; +} + + +static int +testQemuMigrationCookiePSKAttribute(const void *opaque) +{ + struct testQemuMigrationCookieData *data =3D (struct testQemuMigration= CookieData *) opaque; + g_autoptr(qemuMigrationCookie) cookie =3D NULL; + qemuDomainObjPrivate *priv; + + /* if the VM object parsing step failed there's nothing this test can = do */ + if (!data->vm) { + VIR_TEST_DEBUG("\nmissing VM object\n"); + return -1; + } + priv =3D data->vm->privateData; + + if (!(cookie =3D qemuMigrationCookieNew(data->vm->def, NULL))) + return -1; + + g_free(cookie->localHostname); + cookie->localHostname =3D g_strdup("hostname2"); + + if (virUUIDParse("8b3f4dc4-6a8e-5f9b-94a5-4c35babd8d95", cookie->local= Hostuuid) < 0) { + VIR_TEST_DEBUG("\nfailed to parse fake UUID"); + return -1; + } + + /* Format the migration cookie at the source */ + if (qemuMigrationCookieFormat(cookie, + &driver, + data->vm, + data->cookiePopulateParty, + &data->xmlstr, + &data->xmlstrlen, + data->cookiePopulateFlags) < 0) { + VIR_TEST_DEBUG("\nfailed to populate and format qemu migration coo= kie"); + return -1; + } + + /* Check for the element in the generated migration co= okie XML */ + if (!strstr(data->xmlstr, "")) { + VIR_TEST_DEBUG("\nthe migration cookie is missing the migration-ke= y element:\n%s\n", + data->xmlstr); + return -1; + } + + /* Parse the migration cookie at the destination */ + if (!(data->cookie =3D qemuMigrationCookieParse(&driver, + data->vm, + data->vm->def, + NULL, + priv->qemuCaps, + data->xmlstr, + data->xmlstrlen, + data->cookieParseFlags))= ) { + VIR_TEST_DEBUG("\nfailed to parse qemu migration cookie:\n%s\n", d= ata->xmlstr); + return -1; + } + + if (testQemuMigrationCookiePSKValidate(data->cookie->tlsPSK) < 0) + return -1; + + return 0; +} + + static int testQemuMigrationCookiePopulate(const void *opaque) { @@ -418,6 +512,32 @@ testQemuMigrationCookieXML2XMLBitmaps(const char *name, return ret; } =20 +/* tests the generation and persistence of the pre-shared keys */ +static int +testQemuMigrationCookiePSK(const char *domxml) +{ + struct testQemuMigrationCookieData *data =3D g_new0(struct testQemuMig= rationCookieData, 1); + int ret =3D 0; + + data->cookiePopulateFlags =3D QEMU_MIGRATION_COOKIE_TLS_PSK; + data->cookiePopulateParty =3D QEMU_MIGRATION_SOURCE; + data->cookieParseFlags =3D QEMU_MIGRATION_COOKIE_TLS_PSK; + data->inStatus =3D g_strconcat(abs_srcdir, "/", domxml, NULL); + + /* load status XML as domain object */ + if (testQemuMigrationCookieDomInit(data) < 0) + ret =3D -1; + + /* test PSK generation and persistence */ + if (virTestRun("qemumigrationcookie-psk-lifecycle", + testQemuMigrationCookiePSKAttribute, data) < 0) + ret =3D -1; + + testQemuMigrationCookieDataFree(data); + + return ret; +} + =20 static int mymain(void) @@ -448,6 +568,9 @@ mymain(void) if (testQemuMigrationCookieXML2XMLBitmaps("nbd-bitmaps", "qemustatusxm= l2xmldata/migration-out-nbd-bitmaps-in.xml", 0) < 0) ret =3D -1; =20 + if (testQemuMigrationCookiePSK("qemustatusxml2xmldata/modern-in.xml") = < 0) + ret =3D -1; + virBufferFreeAndReset(&testnamebuf); =20 cleanup: diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c index e5e3342b53..b0e0d41895 100644 --- a/tests/testutilsqemu.c +++ b/tests/testutilsqemu.c @@ -297,6 +297,7 @@ qemuTestCapsCacheInsert(virFileCache *cache, =20 #define STATEDIRTEMPLATE abs_builddir "/qemustatedir-XXXXXX" #define CONFIGDIRTEMPLATE abs_builddir "/qemuconfigdir-XXXXXX" +#define TLSPSKDIRTEMPLATE abs_builddir "/pskstatedir-XXXXXX" =20 int qemuTestDriverInit(virQEMUDriver *driver) { @@ -304,6 +305,7 @@ int qemuTestDriverInit(virQEMUDriver *driver) virSecurityManager *mgr =3D NULL; char statedir[] =3D STATEDIRTEMPLATE; char configdir[] =3D CONFIGDIRTEMPLATE; + char tlspskdir[] =3D TLSPSKDIRTEMPLATE; =20 memset(driver, 0, sizeof(*driver)); =20 @@ -328,6 +330,7 @@ int qemuTestDriverInit(virQEMUDriver *driver) * dirs. */ VIR_FREE(cfg->stateDir); VIR_FREE(cfg->configDir); + VIR_FREE(cfg->tlsPSKStateDir); =20 /* Override paths to ensure predictable output * @@ -367,6 +370,13 @@ int qemuTestDriverInit(virQEMUDriver *driver) =20 cfg->configDir =3D g_strdup(configdir); =20 + if (!g_mkdtemp(tlspskdir)) { + fprintf(stderr, "Cannot create fake tlsPSKStateDir"); + goto error; + } + + cfg->tlsPSKStateDir =3D g_strdup(tlspskdir); + driver->caps =3D testQemuCapsInit(); if (!driver->caps) goto error; @@ -433,6 +443,8 @@ int qemuTestDriverInit(virQEMUDriver *driver) =20 cfg->dumpGuestCore =3D false; =20 + cfg->migrateTLSPSKLength =3D 32; + driver->privileged =3D true; =20 return 0; --=20 2.43.7 From nobody Thu Nov 12 15:08:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass(p=none dis=none) header.from=nutanix.com ARC-Seal: i=2; a=rsa-sha256; t=1793612628; cv=pass; d=zohomail.com; s=zohoarc; b=ENDrgOwUjFBi4Uak28BAmP7Hc5sJStBwbSyAi4IYMHOysKYpkTD4lxLWHC32/amQm8/yr4KvpBRuirONALO8qGqPFEXTWniVvAeFE2VZmjqntfBJzL24J36veDhfFi+w1mQE7RlbvV6fF9lGYBdrPo1+7OXiyPSRtBwy12i2CuQ= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793612628; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=06qbM52juufkug7jHYdCJzv18z49ELCsa2WNewaJH18=; b=VCAE9IVS2zz+o8wIxY26sM10bY1FWUX3GbeUqxwPKVCldjV/8tDwug+r4HzgHfssnPxJ+fN3PmZBojs5Km20L+3osOYHru4AYr4V3b5AgPqT2nj8taDr0mxICUbpAb6YclJ+qFSrPuLqL5ytNavLEbuQXqbtWZOe6/oL4mseVIs= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; arc=pass (i=1 dmarc=pass fromdomain=nutanix.com); dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1793612628626977.5856180373318; Mon, 2 Nov 2026 01:43:48 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 0F94741974; Mon, 2 Nov 2026 04:43:46 -0500 (EST) Received: from [172.19.199.19] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 0D90941DCB; Mon, 2 Nov 2026 04:34:13 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 5439441ACD; Mon, 2 Nov 2026 04:33:42 -0500 (EST) Received: from mx0a-002c1b01.pphosted.com (mx0a-002c1b01.pphosted.com [148.163.151.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 232983F356 for ; Mon, 2 Nov 2026 04:33:31 -0500 (EST) Received: from pps.filterd (m0127840.ppops.net [127.0.0.1]) by mx0a-002c1b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6A29AQTm215479 for ; Mon, 2 Nov 2026 01:33:30 -0800 Received: from bn8pr05cu002.outbound.protection.outlook.com (mail-eastus2azon11021098.outbound.protection.outlook.com [52.101.57.98]) by mx0a-002c1b01.pphosted.com (PPS) with ESMTPS id 4hncnsk5tf-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT) for ; Mon, 02 Nov 2026 01:33:30 -0800 (PST) Received: from BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) by CY8PR02MB9059.namprd02.prod.outlook.com (2603:10b6:930:92::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 09:33:28 +0000 Received: from BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715]) by BN7PR02MB5329.namprd02.prod.outlook.com ([fe80::a3e:7534:76c8:6715%5]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 09:33:28 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s= proofpoint20171006; bh=06qbM52juufkug7jHYdCJzv18z49ELCsa2WNewaJH 18=; b=1OiJKixm15064PEqT6Tafo7/8PRgH6pfxPFtVu+FIesR6p+L5PMhvbquN Xw3NhsJQlWoPD7mLPoKiJQoO6lGLjpSDEMG+Oz8CWRUxUtpjGjjYzW/85pKrBDkJ VSft/eQbwchZzwmn1VhzkiJ2mR7O7xbK0QwUCGhYZsBJ8R4GIloHfRQoPVVMKybx 2EziIkExxE0FN12h+YI7I14y04Zi/1rO4d63y+iAv2+qbtpitvHPjSING1oYChay afmf5+5A3kbqs9IO4aw+SFqHzgXl+rVh3BC4EQ+oazuhvYH3MTiBOe0ZhAIez5oF LF5fiJ2qfPcmSYEKq3iOP5sG4bwtw== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SwX1cH0jPQUBRnyM5cOyhlMozTYDtdF75xDb7K3Nn5Q49wpO2F/b6MFgGo2IGqibX3VRGwH/yB6NQCfDMBjJhOdhg5P4Ctrp/81qqWOQfRRpyYOYcFxGSE5PlEjsVomCn/x4kaFN4ubRGCMYPCo8DLxLB7B4V4UPmfCCdXu088BvUPz1MjCaoG3r8q5k+vJm03gm42HMgZeo4PWJyIjpK9xEGXd5U3tvDivABiK9M24ezcCDO5FIihOpSmNQgaSY1WuWMTiy2XkT4HNErGiJHrbRyP9BBSGM8MVFpwoVXJHCjob6oq/weP9XpW5gYfeBrsxP0HtQGq5Y4zjXO9wEpw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=06qbM52juufkug7jHYdCJzv18z49ELCsa2WNewaJH18=; b=IXvV2ihHbeOZh3SGIzGvqGXkeyYcnDFKm8sI6bszK/Lwz051s6P9d274KBJkaJ2LVDD9pTAJOFQPQ7lTJ7ffNlnW/T5MTOGsKU8DYzIBxzuqq5OQPJS4HQUOnieORVQyWGCYWhjSTWDMYol4r0ehmmVF4HbVpBdPbKA6SKEaH7E5nYfoDXQvdnBR0C1ISqSW3cjyRP0wXFIYo5C4UUOYpkb7zekrxqK/wGu/ArKFVOlxAJ2E22NssK+qrfPCN7enp0TJc3tNn4/kH5cVrVNwtC89lvK7Lcx/2nFNcvu2s/p7KPDFS0rckJ/0X8xn690yl5SclcyeRKzV+7jpcomeNA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nutanix.com; dmarc=pass action=none header.from=nutanix.com; dkim=pass header.d=nutanix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nutanix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=06qbM52juufkug7jHYdCJzv18z49ELCsa2WNewaJH18=; b=qZOKgW3F5OxpYqLO3rQCjLrFSOpCOyPVYtpbFIwDPrTJt/X89XVqSYDhGqxOeuUNUuBV61EFA2fVtanYmJdJISzyBxhxDp6r4OTBv56D5T7DczDPy/1rOjkKXmWdc4cB6rWRd/1mUbG9TspfUiKBr9xyKdR5hUplhkqdie5pUoq+bmrb9i3TK/blNDVY20HD88dHBBzkTl9EFjanjDiI/hoOSyqZtjiHibM3ZUMb2j4NvRH2GdaQ4vRrrudBmjC/px9YCoZ2CLbgCkDVQYtvcVw/OhxGj11scKh3BR59BUxBFVjXbKqhuNh+rHNaBV/NHja2beRfjEgv/5CPv3fOhw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nutanix.com; From: Abhisek Panda To: devel@lists.libvirt.org Subject: [PATCH v5 8/8] qemu: Fix migrate_tls_force configuration param Date: Mon, 2 Nov 2026 09:32:45 +0000 Message-ID: <20261102093300.44810-9-abhisek.panda1@nutanix.com> X-Mailer: git-send-email 2.43.7 In-Reply-To: <20261102093300.44810-1-abhisek.panda1@nutanix.com> References: <20261102093300.44810-1-abhisek.panda1@nutanix.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BY3PR05CA0040.namprd05.prod.outlook.com (2603:10b6:a03:39b::15) To BN7PR02MB5329.namprd02.prod.outlook.com (2603:10b6:408:29::15) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PR02MB5329:EE_|CY8PR02MB9059:EE_ X-MS-Office365-Filtering-Correlation-Id: 998d735a-efbe-4e9e-1839-08df38c459c3 x-proofpoint-crosstenant: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|261021123027099003|56012099006|261009223327099003|261009221727099003|261009221227099003|261009223027099003|261009220027099003|261028144727099003|261021121427099003|261026121527099003|261022075727099003|261022105027099003|261026140227099003|10067099003|18002099003|22082099003|6133799003|3023799007; X-Microsoft-Antispam-Message-Info: Znf6E539fYIQqIrpDFYQXWdssppNfysbGIc2I0BkuN+DjRtO3F4e2z3hp3HEHs+Xo0y/fgKeXc1bTIbAOt6UoPbBlfm9r0K1RRXWo/dJRSeP4aDZcq+CFjfa37tIzIwN1rk8Rtw0UayvcZtZjfQvh4k1f8JJx1LaAfs/efsklYvYhnXDgMKKGsw1U/9WjI2s3IUag1XF6ycL/u8iWP1qYCManTYKT2Bw+x7XGSrzuUO9dg/n92IET6f/HzUEl/TGTjf8CVbKlFb7jBOhZ7/n5mAwz8X2BXxUJjIy5/178BmUhrgaYlLZBvsm+OlFoRuj0S7hucGb3kdMnULhA1yvqouyWWk7zgq3vvhAWdmANAsOLD/dLpVfRIITS9a9+hL2mgug9EuBBzlZQoJbxzuIlrmrcu6pMFjBrLVBnkuPBlbv4/C43RcD5YLqOl5QTVHUhad1PFR5HdGWhwNlEqxoS6/Ogav4e3WeTxK0mawzhQGCQq+dy7dGGcEJGMhyi0ujDr3m2wsJ68l4EzgVUceZo+ksnCCykQvJhqoKPF0ehzX/WoNdZXwUrSwA00m7NyZHY9ohsWFO7QGd5b0s4UT6Lsv6NFOJGPR3VwyvIxxDKBGVNNjdUKvKGMmyZL8Xe1pwG9TJUa2kyPjuRbfomop4PsaaZtkv8JRiv/cKYX44IJw= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN7PR02MB5329.namprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(261021123027099003)(56012099006)(261009223327099003)(261009221727099003)(261009221227099003)(261009223027099003)(261009220027099003)(261028144727099003)(261021121427099003)(261026121527099003)(261022075727099003)(261022105027099003)(261026140227099003)(10067099003)(18002099003)(22082099003)(6133799003)(3023799007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?d5dW/urKeb8HJq8waurodCjKrODA9YTzNeKjyhsTRdNfta+fyEqlHhThutvN?= =?us-ascii?Q?NrmiFp5aGeadYewCnjnxbcx17ZlgOP3Vjno0QUhrRn6RF57BHAoKs/YQmslJ?= =?us-ascii?Q?a4xFCGh/BuNwhvT2JyCA20IhH4HPrbQhKw7TbRiDP0114iFZLhJpHUyh+Cir?= =?us-ascii?Q?1BKJssZ0KUYsEWkWW85FkKP9DZqV7g+2zyBpBqEiCQWAe6poDZkiJlS1M+wU?= =?us-ascii?Q?bdPsml8jrOBZwvOaAwgyLGiEP8yn8FU0lQXMSlRIhQ16X/HNPsmmPB1xaz/Z?= =?us-ascii?Q?eAgoBFwRL6oehzuml1aXKcYr8ph9CRm1hHFneEPtQLBxGkxDk8n4h7UZd9qM?= =?us-ascii?Q?pGBNr+QS0VU3wzzKQEJqf/KgAdcnyfiGBzovB3oNxnVshNIn2Y0HNWsvxpbN?= =?us-ascii?Q?tWY5/FW6M9/XT9L6R6vFSJEJet+7XMHvGmWmdARoZ46wcQmS89MVufXzOUC3?= =?us-ascii?Q?+EtnCq5/OtIJ413vZiTor0on+gaEywd/pTyvn4cDvltT3bfb1FDZmiDyYVBc?= =?us-ascii?Q?4pL3xXjIkEzdUM+qhia1qcJU9fewpl67sLy0HlKmslFmRR5YsGkQTx9b/HH+?= =?us-ascii?Q?rwzPRNPV6AfiouSw2ioXtCnf+skRDtk/8PtznOqZWcCHZezyjaq29ndg9foU?= =?us-ascii?Q?qgTpFywexLTNlVrHdP1Vk4DtxRIvOmzAUZVTiVZEhzykSIMdPkv/Mdjululh?= =?us-ascii?Q?ICtTCUp2np7+vPO9OvUzu2oAy90HqGhfzUlQIu8JUspgl4q4eCy4FUvt0nVK?= =?us-ascii?Q?+2AHn4Q0Uk1aNmeWMXY+177gS18CFjsNE5tfe+pIOJRtzXO9MCPEL5wd7vt4?= =?us-ascii?Q?FVmFhp6v8U72M9d/9IrMohGgT8LqY5Aq8y7AU+TwS5kI/pz9sbiqqDdKHd0e?= =?us-ascii?Q?EmtJjsymYKRTNnQ4w11iMftk1CnxOY3Mr0BytoYi5sU2iGwWJxEp0PADB2TI?= =?us-ascii?Q?GR9ReKxw5zCUuOmgPlu7EUsq9wjSJq5SupTkqm6EharZQhbWZIaaX+YrnY6D?= =?us-ascii?Q?twdoARBSgu84U4nx7T6wLq1cU2TzDYAqzXsAFCAG5SqGwBxD2lC4R72qJ0CF?= =?us-ascii?Q?Upxr4AsB45vK+pphZbui0ij+3sjuVrQiXho1FFX172y6UU9vFtX6LxNPpTxl?= =?us-ascii?Q?m9wSMfV34Tf7oth62MxuyyPg4mgynDhICNbE9hVVjdHIRCNQJPf7l0txfXIr?= =?us-ascii?Q?ICl4nTmQtvWv8JqCADYPzlfKYgK2roWxbmv95bAfRPlY07FTDbPwKT5PfmNn?= =?us-ascii?Q?HIcPoHD2qWlASG/V8x5Xc2scWJ09U5sNMvIEuHOVAtJzW4YOHGRGRs0ebr6Y?= =?us-ascii?Q?QPzOnGL278FRoOhFuNj4UlmMM7Kc+66aMYPJzyvBW2nbgC8gsMT2X3LWtrA5?= =?us-ascii?Q?V6WscGhpvyXhVg9JlgN5n3GAejIP8TOW5llThKs7AFsjhNLdptJCojdE/Q9N?= =?us-ascii?Q?gmrItNz+IPP0TQiE3ZV+OVSML/BIuuKw4FgygLDcMRxuViil1gZsMKNR8Be1?= =?us-ascii?Q?jV89QzJSiG7ZBBEJXACYta3janKTuAjm7C9574X0Kzky+K0K4GJieBe6Rxzm?= =?us-ascii?Q?3vjQnLmMI+eXMBKrf+sB16i7tj/sSWC/cR1FDImElFS22qrxNOzz9jbNwF41?= =?us-ascii?Q?LOwWcPlk3nrPNsB83IAk9X1UIMqin0HPnoieudls632I1/qz+mRDYNyAkbcO?= =?us-ascii?Q?mNobboH82yeDPfFjqR5BHjlU7SBUJflYp7aSTBbwxza7LP4vJxnzfmkifID7?= =?us-ascii?Q?TjngCaYR80lguWZYt+7lj3VlwQc4ajY=3D?= X-Exchange-RoutingPolicyChecked: RTc+yOugtyM/CCZ+e0wvrsckkJkOmfvszBxhWcdFKu6Yi6TesqnKazKj497E+NrIYo1s9rYP/gnj7zbyI/tQik4Vy/0IDr6apI2ifC++gXNKX8D6Z/xmy933ASH2YEW4ip+030khP/W3sePIrvhErrdjGknhde6Ee8IpmhY0SrMihHnFRz0YeIY+zY/tKiM1B6o1OCTD8gdSW/W56xZmjH4lmhCIjynY6rCy8o/bAoFZTKQiG4PgOOhD6ZhgkDwB6bKij0iCJ7zHEF1RQwcDAx04VVB02+Qb8ING6zBgjtMgKNhA8VckyNCIh6eCC/TrxiMVZlTyONM2RborAKSfAQ== X-OriginatorOrg: nutanix.com X-MS-Exchange-CrossTenant-Network-Message-Id: 998d735a-efbe-4e9e-1839-08df38c459c3 X-MS-Exchange-CrossTenant-AuthSource: BN7PR02MB5329.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 09:33:28.1326 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: bb047546-786f-4de1-bd75-24e5b6f79043 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: puu1krfD8TNBa418hwJ6ixnJAc8F71doK8tfqoydieE1iI02q5RcGLZc8VEBXlGIwhgwOWhlr9K8MEzcndKvuRlEiLiPkdeOBVFiSop+itk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY8PR02MB9059 X-Authority-Analysis: v=2.4 cv=Dt3Da2/+ c=1 sm=1 tr=0 ts=6ae858ea cx=c_pps a=zHc5ipMoJZhVMviFMUShKw==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=zJRp6_cAMcgA:10 a=0kUYKlekyDsA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VofLwUrZ8Iiv6rRUPXIb:22 a=_-M8LpHI31CeLmyZm6wg:22 a=64Cc0HZtAAAA:8 a=YYagjlQMpiW18X9y0XEA:9 X-Proofpoint-GUID: 9oHhdmqN4Y8dxRK5ij3QHbORt7gIZfIk X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX4qni+gfDaMPW yjGxhn2TXqW0HvXZnWas6G4VLNkHMrdhdok1JN2k6/DBRqjbNf4n7M2CvFwDJF+285g6NcR/dwN 6MJti+AK6FCATvSw7XlfZrtlTn5ZC3GROsI+B88ID95Uavyl9U1mg3yVYfLJ2tCdTEQ9oCW+kfb vMjged+IA4eyPyrk9YuG57dDSfChDmFpDrUdTreEUido8uQPaVhHWZOGmzvIl9hF1GDxDzO2xeE UxOO0oO3ARhuuvEp5Uea12z1Ecy4rtRM0A1BN66ZBcZcysDTTZSnFBvUsd5ucH6gQHtB/BJR8fy N6ezECWAEoZmjWoeobfY9UP4vocfZ8LJ7Yrz5L8e4sD9WJxLbSCf4WJPDJZC1XF2DvBy6A2v1x7 /3qsO++T43nGJGb0i/rptD6MrJgdYOSbGFSNZkF98Eiyjh6q29P9ix2RNWk3J7gio6jc4PAjyWR Te0GzMsfvh5M4HK4R6w== X-Proofpoint-Spam-Info: AW1haW4tMjYxMTAyMDAzNyBTYWx0ZWRfX/x8EHDMLt3cN r5I8dP6dipuUgt+C0rOn1Szou4i5HkxZ0crf9Ims/PgOrqb31JwFXDBOT2EDLFlHEtNsOHM6we/ TxAlFPawqMI2IJEa3KdQuF2BQ6bIBjM= X-Proofpoint-ORIG-GUID: 9oHhdmqN4Y8dxRK5ij3QHbORt7gIZfIk X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.138,FMLib:17.12.100.49 definitions=2026-11-02_03,2026-10-21_02,2025-10-01_01 X-Proofpoint-Spam-Reason: safe Message-ID-Hash: WUZGCU2AQBY6USGXAOQUU4DKVCS4AXMC X-Message-ID-Hash: WUZGCU2AQBY6USGXAOQUU4DKVCS4AXMC X-MailFrom: abhisek.panda1@nutanix.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: tejus.gk@nutanix.com, mark.caveayland@nutanix.com, Abhisek Panda X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @nutanix.com) X-ZM-MESSAGEID: 1793612630686154100 Content-Type: text/plain; charset="utf-8" Use the migrate_tls_force configuration param to control whether encrypted migration is mandatory. When enabled, libvirt unconditionally attempts the TLS pre-shared key authentication mechanism during migration and fails the migration if the peer does not agree to it. When disabled, the TLS authentication mechanisms are used only when the VIR_MIGRATE_TLS flag is set; otherwise unencrypted migration remains permitted. Signed-off-by: Abhisek Panda --- src/qemu/qemu.conf.in | 12 ++++++---- src/qemu/qemu_migration.c | 48 +++++++++++++++++++-------------------- 2 files changed, 31 insertions(+), 29 deletions(-) diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in index 4fdd655881..80ba46aca8 100644 --- a/src/qemu/qemu.conf.in +++ b/src/qemu/qemu.conf.in @@ -429,10 +429,14 @@ #migrate_tls_priority =3D "@SYSTEM" =20 =20 -# By default TLS is requested using the VIR_MIGRATE_TLS flag, thus not req= uested -# automatically. Setting 'migate_tls_force' to "1" will prevent any migrat= ion -# which is not using VIR_MIGRATE_TLS to ensure higher level of security in -# deployments with TLS. +# Enforce TLS encryption for all domain migrations using either X.509 cert= ificates +# or pre-shared keys (PSK) authentication schemes. By default, Libvirt all= ows +# unencrypted migrations to proceed whenever the VIR_MIGRATE_TLS flag is n= ot +# explicitly set in migration. +# +# Enabling this option strictly prohibits unencrypted migrations to procee= d. +# If the destination fails to negotiate TLS, migration fails immediately +# rather than falling back to unencrypted migration. # #migrate_tls_force =3D 0 =20 diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c index c958edef6a..7716419a40 100644 --- a/src/qemu/qemu_migration.c +++ b/src/qemu/qemu_migration.c @@ -2892,7 +2892,8 @@ qemuMigrationSrcBeginPhase(virQEMUDriver *driver, unsigned int flags) { qemuDomainObjPrivate *priv =3D vm->privateData; - unsigned int cookieFlags =3D QEMU_MIGRATION_COOKIE_LOCKSTATE | QEMU_MI= GRATION_COOKIE_TLS_PSK; + unsigned int cookieFlags =3D QEMU_MIGRATION_COOKIE_LOCKSTATE; + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); =20 VIR_DEBUG("driver=3D%p, vm=3D%p, xmlin=3D%s, dname=3D%s," " cookieout=3D%p, cookieoutlen=3D%p," @@ -2958,6 +2959,9 @@ qemuMigrationSrcBeginPhase(virQEMUDriver *driver, return NULL; } =20 + if (cfg->migrateTLSForce || (flags & VIR_MIGRATE_TLS)) + cookieFlags |=3D QEMU_MIGRATION_COOKIE_TLS_PSK; + if (flags & (VIR_MIGRATE_NON_SHARED_DISK | VIR_MIGRATE_NON_SHARED_INC)= ) { if (flags & VIR_MIGRATE_TUNNELLED) { virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", @@ -3167,14 +3171,6 @@ qemuMigrationSrcBegin(virConnectPtr conn, g_autofree char *xml =3D NULL; char *ret =3D NULL; =20 - if (cfg->migrateTLSForce && - !(flags & VIR_MIGRATE_TUNNELLED) && - !(flags & VIR_MIGRATE_TLS)) { - virReportError(VIR_ERR_OPERATION_INVALID, "%s", - _("this libvirtd instance allows migration only wit= h VIR_MIGRATE_TLS flag")); - goto cleanup; - } - if (flags & VIR_MIGRATE_POSTCOPY_RESUME) { ret =3D qemuMigrationSrcBeginResumePhase(conn, vm, xmlin, cookieout, cookieoutlen, fl= ags); @@ -3623,6 +3619,7 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, g_autofree char *xmlout =3D NULL; unsigned int cookieFlags =3D QEMU_MIGRATION_COOKIE_TLS_PSK; bool taint_hook =3D false; + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); =20 VIR_DEBUG("name=3D%s, origname=3D%s, protocol=3D%s, port=3D%hu, " "listenAddress=3D%s, nbdPort=3D%d, nbdURI=3D%s, flags=3D0x%x= ", @@ -3691,6 +3688,14 @@ qemuMigrationDstPrepareFresh(virQEMUDriver *driver, QEMU_MIGRATION_COOKIE_TLS_PSK))) goto cleanup; =20 + if (!mig->tlsPSK && + cfg->migrateTLSForce && + !(flags & VIR_MIGRATE_TLS)) { + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("The destination host only supports encrypted mig= ration")); + goto cleanup; + } + if (!(vm =3D virDomainObjListAdd(driver->domains, def, driver->xmlopt, VIR_DOMAIN_OBJ_LIST_ADD_LIVE | @@ -3924,14 +3929,6 @@ qemuMigrationDstPrepareAny(virQEMUDriver *driver, return -1; } =20 - if (cfg->migrateTLSForce && - !(flags & VIR_MIGRATE_TUNNELLED) && - !(flags & VIR_MIGRATE_TLS)) { - virReportError(VIR_ERR_OPERATION_INVALID, "%s", - _("this libvirtd instance allows migration only wit= h VIR_MIGRATE_TLS flag")); - return -1; - } - if (flags & VIR_MIGRATE_POSTCOPY_RESUME) { return qemuMigrationDstPrepareResume(driver, dconn, cookiein, cook= ieinlen, cookieout, cookieoutlen, @@ -5085,6 +5082,7 @@ qemuMigrationSrcRun(virQEMUDriver *driver, int ret =3D -1; qemuDomainObjPrivate *priv =3D vm->privateData; g_autoptr(qemuMigrationCookie) mig =3D NULL; + g_autoptr(virQEMUDriverConfig) cfg =3D virQEMUDriverGetConfig(driver); g_autofree char *tlsAlias =3D NULL; qemuMigrationIOThread *iothread =3D NULL; VIR_AUTOCLOSE fd =3D -1; @@ -5158,6 +5156,14 @@ qemuMigrationSrcRun(virQEMUDriver *driver, if (qemuMigrationSrcGraphicsRelocate(vm, mig, graphicsuri) < 0) VIR_WARN("unable to provide data for graphics client relocation"); =20 + if (cfg->migrateTLSForce && + !(mig->flags & QEMU_MIGRATION_COOKIE_TLS_PSK) && + !(flags & VIR_MIGRATE_TLS)) { + virReportError(VIR_ERR_OPERATION_INVALID, "%s", + _("The source host only supports encrypted migratio= n")); + goto error; + } + if (mig->blockDirtyBitmaps && qemuMigrationSrcRunPrepareBlockDirtyBitmaps(vm, mig, migParams, fl= ags) < 0) goto error; @@ -6681,14 +6687,6 @@ qemuMigrationSrcPerform(virQEMUDriver *driver, NULLSTR(cookiein), cookieinlen, cookieout, cookieoutlen, flags, NULLSTR(dname), bandwidth, v3proto); =20 - if (cfg->migrateTLSForce && - !(flags & VIR_MIGRATE_TUNNELLED) && - !(flags & VIR_MIGRATE_TLS)) { - virReportError(VIR_ERR_OPERATION_INVALID, "%s", - _("this libvirtd instance allows migration only wit= h VIR_MIGRATE_TLS flag")); - return -1; - } - if ((flags & (VIR_MIGRATE_TUNNELLED | VIR_MIGRATE_PEER2PEER))) { if (cookieinlen) { virReportError(VIR_ERR_OPERATION_INVALID, --=20 2.43.7