Code movement to pull the conversion from Qdict to BlockdevOptionsRbd

into a helper function.

Reviewed-by: Eric Blake <eblake@redhat.com>

Reviewed-by: John Snow <jsnow@redhat.com>

Signed-off-by: Jeff Cody <jcody@redhat.com>

Message-id: 5b49a980f2cde6610ab1df41bb0277d00b5db893.1536704901.git.jcody@redhat.com

Signed-off-by: Jeff Cody <jcody@redhat.com>

---

block/rbd.c | 36 ++++++++++++++++++++++++------------

1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/block/rbd.c b/block/rbd.c

index XXXXXXX..XXXXXXX 100644

--- a/block/rbd.c

+++ b/block/rbd.c

@@ -XXX,XX +XXX,XX @@ failed_opts:

return r;

}

+static int qemu_rbd_convert_options(QDict *options, BlockdevOptionsRbd **opts,

+ Error **errp)

+{

+ Visitor *v;

+ Error *local_err = NULL;

+

+ /* Convert the remaining options into a QAPI object */

+ v = qobject_input_visitor_new_flat_confused(options, errp);

+ if (!v) {

+ return -EINVAL;

+ }

+

+ visit_type_BlockdevOptionsRbd(v, NULL, opts, &local_err);

+ visit_free(v);

+

+ if (local_err) {

+ error_propagate(errp, local_err);

+ return -EINVAL;

+ }

+

+ return 0;

+}

+

static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,

Error **errp)

{

BDRVRBDState *s = bs->opaque;

BlockdevOptionsRbd *opts = NULL;

- Visitor *v;

const QDictEntry *e;

Error *local_err = NULL;

char *keypairs, *secretid;

@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,

qdict_del(options, "password-secret");

}

- /* Convert the remaining options into a QAPI object */

- v = qobject_input_visitor_new_flat_confused(options, errp);

- if (!v) {

- r = -EINVAL;

- goto out;

- }

-

- visit_type_BlockdevOptionsRbd(v, NULL, &opts, &local_err);

- visit_free(v);

-

+ r = qemu_rbd_convert_options(options, &opts, &local_err);

if (local_err) {

error_propagate(errp, local_err);

- r = -EINVAL;

goto out;

}

--

2.17.1

This is a small test that will check for the ability to parse

both legacy and modern options for rbd.

The way the test is set up is for failure to occur, but without

having to wait to timeout on a non-existent rbd server. The error

messages in the success path show that the arguments were parsed.

The failure behavior prior to the patch series that has this test, is

qemu-img complaining about mandatory options (e.g. 'pool') not being

provided.

Reviewed-by: Eric Blake <eblake@redhat.com>

Signed-off-by: Jeff Cody <jcody@redhat.com>

Message-id: f830580e339b974a83ed4870d11adcdc17f49a47.1536704901.git.jcody@redhat.com

Signed-off-by: Jeff Cody <jcody@redhat.com>

---

tests/qemu-iotests/231 | 62 ++++++++++++++++++++++++++++++++++++++

tests/qemu-iotests/231.out | 9 ++++++

tests/qemu-iotests/group | 1 +

3 files changed, 72 insertions(+)

create mode 100755 tests/qemu-iotests/231

create mode 100644 tests/qemu-iotests/231.out

diff --git a/tests/qemu-iotests/231 b/tests/qemu-iotests/231

new file mode 100755

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/tests/qemu-iotests/231

@@ -XXX,XX +XXX,XX @@

+#!/bin/bash

+#

+# Test legacy and modern option parsing for rbd/ceph. This will not

+# actually connect to a ceph server, but rather looks for the appropriate

+# error message that indicates we parsed the options correctly.

+#

+# Copyright (C) 2018 Red Hat, Inc.

+#

+# This program is free software; you can redistribute it and/or modify

+# it under the terms of the GNU General Public License as published by

+# the Free Software Foundation; either version 2 of the License, or

+# (at your option) any later version.

+#

+# This program is distributed in the hope that it will be useful,

+# but WITHOUT ANY WARRANTY; without even the implied warranty of

+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

+# GNU General Public License for more details.

+#

+# You should have received a copy of the GNU General Public License

+# along with this program. If not, see <http://www.gnu.org/licenses/>.

+#

+

+# creator

+owner=jcody@redhat.com

+

+seq=`basename $0`

+echo "QA output created by $seq"

+

+here=`pwd`

+status=1    # failure is the default!

+

+_cleanup()

+{

+ rm "${BOGUS_CONF}"

+}

+trap "_cleanup; exit \$status" 0 1 2 3 15

+

+# get standard environment, filters and checks

+. ./common.rc

+. ./common.filter

+

+_supported_fmt generic

+_supported_proto rbd

+_supported_os Linux

+

+BOGUS_CONF=${TEST_DIR}/ceph-$$.conf

+touch "${BOGUS_CONF}"

+

+_filter_conf()

+{

+ sed -e "s#$BOGUS_CONF#BOGUS_CONF#g"

+}

+

+# We expect this to fail, with no monitor ip provided and a null conf file. Just want it

+# to fail in the right way.

+$QEMU_IMG info "json:{'file.driver':'rbd','file.filename':'rbd:rbd/bogus:conf=${BOGUS_CONF}'}" 2>&1 | _filter_conf

+$QEMU_IMG info "json:{'file.driver':'rbd','file.pool':'rbd','file.image':'bogus','file.conf':'${BOGUS_CONF}'}" 2>&1 | _filter_conf

+

+# success, all done

+echo "*** done"

+rm -f $seq.full

+status=0

diff --git a/tests/qemu-iotests/231.out b/tests/qemu-iotests/231.out

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/tests/qemu-iotests/231.out

@@ -XXX,XX +XXX,XX @@

+QA output created by 231

+qemu-img: RBD options encoded in the filename as keyvalue pairs is deprecated. Future versions may cease to parse these options in the future.

+unable to get monitor info from DNS SRV with service name: ceph-mon

+no monitors specified to connect to.

+qemu-img: Could not open 'json:{'file.driver':'rbd','file.filename':'rbd:rbd/bogus:conf=BOGUS_CONF'}': error connecting: No such file or directory

+unable to get monitor info from DNS SRV with service name: ceph-mon

+no monitors specified to connect to.

+qemu-img: Could not open 'json:{'file.driver':'rbd','file.pool':'rbd','file.image':'bogus','file.conf':'BOGUS_CONF'}': error connecting: No such file or directory

+*** done

diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group

index XXXXXXX..XXXXXXX 100644

--- a/tests/qemu-iotests/group

+++ b/tests/qemu-iotests/group

@@ -XXX,XX +XXX,XX @@

226 auto quick

227 auto quick

229 auto quick

+231 auto quick

--

2.17.1

Signed-off-by: Jeff Cody <jcody@redhat.com>

Message-id: 647f5b5ab7efd8bf567a504c832b1d2d6f719b23.1536704901.git.jcody@redhat.com

Signed-off-by: Jeff Cody <jcody@redhat.com>

---

qemu-deprecated.texi | 15 +++++++++++++++

1 file changed, 15 insertions(+)

diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi

index XXXXXXX..XXXXXXX 100644

--- a/qemu-deprecated.texi

+++ b/qemu-deprecated.texi

@@ -XXX,XX +XXX,XX @@ used instead.

In order to prevent QEMU from automatically opening an image's backing

chain, use ``"backing": null'' instead.

+@subsubsection rbd keyvalue pair encoded filenames: "" (since 3.1.0)

+

+Options for ``rbd'' should be specified according to its runtime options,

+like other block drivers. Legacy parsing of keyvalue pair encoded

+filenames is useful to open images with the old format for backing files;

+These image files should be updated to use the current format.

+

+Example of legacy encoding:

+

+@code{json:@{"file.driver":"rbd", "file.filename":"rbd:rbd/name"@}}

+

+The above, converted to the current supported format:

+

+@code{json:@{"file.driver":"rbd", "file.pool":"rbd", "file.image":"name"@}}

+

@subsection vio-spapr-device device options

@subsubsection "irq": "" (since 3.0.0)

--

2.17.1

From: "Richard W.M. Jones" <rjones@redhat.com>

The sslverify setting is supposed to turn off all TLS certificate

checks in libcurl. However because of the way we use it, it only

turns off peer certificate authenticity checks

(CURLOPT_SSL_VERIFYPEER). This patch makes it also turn off the check

that the server name in the certificate is the same as the server

you're connecting to (CURLOPT_SSL_VERIFYHOST).

We can use Google's server at 8.8.8.8 which happens to have a bad TLS

certificate to demonstrate this:

$ ./qemu-img create -q -f qcow2 -b 'json: { "file.sslverify": "off", "file.driver": "https", "file.url": "https://8.8.8.8/foo" }' /var/tmp/file.qcow2

qemu-img: /var/tmp/file.qcow2: CURL: Error opening file: SSL: no alternative certificate subject name matches target host name '8.8.8.8'

Could not open backing image to determine size.

With this patch applied, qemu-img connects to the server regardless of

the bad certificate:

$ ./qemu-img create -q -f qcow2 -b 'json: { "file.sslverify": "off", "file.driver": "https", "file.url": "https://8.8.8.8/foo" }' /var/tmp/file.qcow2

qemu-img: /var/tmp/file.qcow2: CURL: Error opening file: The requested URL returned error: 404 Not Found

(The 404 error is expected because 8.8.8.8 is not actually serving a

file called "/foo".)

Of course the default (without sslverify=off) remains to always check

the certificate:

$ ./qemu-img create -q -f qcow2 -b 'json: { "file.driver": "https", "file.url": "https://8.8.8.8/foo" }' /var/tmp/file.qcow2

qemu-img: /var/tmp/file.qcow2: CURL: Error opening file: SSL: no alternative certificate subject name matches target host name '8.8.8.8'

Could not open backing image to determine size.

Further information about the two settings is available here:

https://curl.haxx.se/libcurl/c/CURLOPT_SSL_VERIFYPEER.html

https://curl.haxx.se/libcurl/c/CURLOPT_SSL_VERIFYHOST.html

Signed-off-by: Richard W.M. Jones <rjones@redhat.com>

Message-id: 20180914095622.19698-1-rjones@redhat.com

Signed-off-by: Jeff Cody <jcody@redhat.com>

---

block/curl.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/block/curl.c b/block/curl.c

index XXXXXXX..XXXXXXX 100644

--- a/block/curl.c

+++ b/block/curl.c

@@ -XXX,XX +XXX,XX @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)

curl_easy_setopt(state->curl, CURLOPT_URL, s->url);

curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYPEER,

(long) s->sslverify);

+ curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYHOST,

+ s->sslverify ? 2L : 0L);

if (s->cookie) {

curl_easy_setopt(state->curl, CURLOPT_COOKIE, s->cookie);

}

--

2.17.1