The following changes since commit 741e1a618b126e664f7b723e6fe1b7ace511caf7:

Merge remote-tracking branch 'remotes/stefanberger/tags/pull-tpm-2018-09-07-1' into staging (2018-09-24 18:12:54 +0100)

git://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request

for you to fetch changes up to 637fa44ab80c6b317adf1d117494325a95daad60:

curl: Make sslverify=off disable host as well as peer verification. (2018-09-24 23:46:05 -0400)

RBD and Curl patches

Jeff Cody (4):

block/rbd: pull out qemu_rbd_convert_options

block/rbd: Attempt to parse legacy filenames

block/rbd: add iotest for rbd legacy keyvalue filename parsing

block/rbd: add deprecation documentation for filename keyvalue pairs

Richard W.M. Jones (1):

curl: Make sslverify=off disable host as well as peer verification.

block/curl.c | 2 +

block/rbd.c | 90 ++++++++++++++++++++++++++++++++------

qemu-deprecated.texi | 15 +++++++

tests/qemu-iotests/231 | 62 ++++++++++++++++++++++++++

tests/qemu-iotests/231.out | 9 ++++

tests/qemu-iotests/group | 1 +

6 files changed, 165 insertions(+), 14 deletions(-)

create mode 100755 tests/qemu-iotests/231

create mode 100644 tests/qemu-iotests/231.out

2.17.1

From: "Richard W.M. Jones" <rjones@redhat.com>

The sslverify setting is supposed to turn off all TLS certificate

checks in libcurl. However because of the way we use it, it only

turns off peer certificate authenticity checks

(CURLOPT_SSL_VERIFYPEER). This patch makes it also turn off the check

that the server name in the certificate is the same as the server

you're connecting to (CURLOPT_SSL_VERIFYHOST).

We can use Google's server at 8.8.8.8 which happens to have a bad TLS

certificate to demonstrate this:

$ ./qemu-img create -q -f qcow2 -b 'json: { "file.sslverify": "off", "file.driver": "https", "file.url": "https://8.8.8.8/foo" }' /var/tmp/file.qcow2

qemu-img: /var/tmp/file.qcow2: CURL: Error opening file: SSL: no alternative certificate subject name matches target host name '8.8.8.8'

Could not open backing image to determine size.

With this patch applied, qemu-img connects to the server regardless of

the bad certificate:

$ ./qemu-img create -q -f qcow2 -b 'json: { "file.sslverify": "off", "file.driver": "https", "file.url": "https://8.8.8.8/foo" }' /var/tmp/file.qcow2

qemu-img: /var/tmp/file.qcow2: CURL: Error opening file: The requested URL returned error: 404 Not Found

(The 404 error is expected because 8.8.8.8 is not actually serving a

file called "/foo".)

Of course the default (without sslverify=off) remains to always check

the certificate:

$ ./qemu-img create -q -f qcow2 -b 'json: { "file.driver": "https", "file.url": "https://8.8.8.8/foo" }' /var/tmp/file.qcow2

qemu-img: /var/tmp/file.qcow2: CURL: Error opening file: SSL: no alternative certificate subject name matches target host name '8.8.8.8'

Could not open backing image to determine size.

Further information about the two settings is available here:

https://curl.haxx.se/libcurl/c/CURLOPT_SSL_VERIFYPEER.html

https://curl.haxx.se/libcurl/c/CURLOPT_SSL_VERIFYHOST.html

Signed-off-by: Richard W.M. Jones <rjones@redhat.com>

Message-id: 20180914095622.19698-1-rjones@redhat.com

Signed-off-by: Jeff Cody <jcody@redhat.com>

---

block/curl.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/block/curl.c b/block/curl.c

--- a/block/curl.c

+++ b/block/curl.c

@@ -XXX,XX +XXX,XX @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)

curl_easy_setopt(state->curl, CURLOPT_URL, s->url);

curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYPEER,

(long) s->sslverify);

+ curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYHOST,

+ s->sslverify ? 2L : 0L);

if (s->cookie) {

curl_easy_setopt(state->curl, CURLOPT_COOKIE, s->cookie);

}

2.17.1

Code movement to pull the conversion from Qdict to BlockdevOptionsRbd

into a helper function.

Reviewed-by: Eric Blake <eblake@redhat.com>

Reviewed-by: John Snow <jsnow@redhat.com>

Signed-off-by: Jeff Cody <jcody@redhat.com>

Message-id: 5b49a980f2cde6610ab1df41bb0277d00b5db893.1536704901.git.jcody@redhat.com

Signed-off-by: Jeff Cody <jcody@redhat.com>

block/rbd.c | 36 ++++++++++++++++++++++++------------

1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/block/rbd.c b/block/rbd.c

--- a/block/rbd.c

+++ b/block/rbd.c

@@ -XXX,XX +XXX,XX @@ failed_opts:

return r;

+static int qemu_rbd_convert_options(QDict *options, BlockdevOptionsRbd **opts,

+ Error **errp)

+{

+ Visitor *v;

+ Error *local_err = NULL;

+

+ /* Convert the remaining options into a QAPI object */

+ v = qobject_input_visitor_new_flat_confused(options, errp);

+ if (!v) {

+ visit_type_BlockdevOptionsRbd(v, NULL, opts, &local_err);

+ visit_free(v);

+

+ if (local_err) {

+ error_propagate(errp, local_err);

+ return 0;

+}

+

static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,

Error **errp)

BDRVRBDState *s = bs->opaque;

BlockdevOptionsRbd *opts = NULL;

- Visitor *v;

const QDictEntry *e;

Error *local_err = NULL;

char *keypairs, *secretid;

@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,

qdict_del(options, "password-secret");

}

- /* Convert the remaining options into a QAPI object */

- v = qobject_input_visitor_new_flat_confused(options, errp);

- if (!v) {

- r = -EINVAL;

- goto out;

- }

-

- visit_type_BlockdevOptionsRbd(v, NULL, &opts, &local_err);

- visit_free(v);

-

+ r = qemu_rbd_convert_options(options, &opts, &local_err);

if (local_err) {

error_propagate(errp, local_err);

- r = -EINVAL;

goto out;

}