diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 713d7aa88a..7f4de657c6 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -2786,7 +2786,13 @@ is mandatory to specify which volume/image will be used.

-

For "nbd", the name attribute is optional. +

For "nbd", the name attribute is optional. TLS + transport for NBD can be enabled by setting the tls + attribute to yes. For the QEMU hypervisor, usage of + a TLS environment can also be globally controlled on the host by + the nbd_tls and nbd_tls_x509_cert_dir in + /etc/libvirt/qemu.conf. + ('tls' Since 4.5.0)

For "iscsi" (since 1.0.4), the diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index b7404e1ce0..6379ab1e63 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -1706,6 +1706,11 @@ + + + + + diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index f4f958f278..a0f6d3ee6a 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -1388,6 +1388,11 @@ qemuDiskSourceNeedsProps(virStorageSourcePtr src, virQEMUCapsGet(qemuCaps, QEMU_CAPS_ISCSI_PASSWORD_SECRET)) return true; + if (actualType == VIR_STORAGE_TYPE_NETWORK && + src->protocol == VIR_STORAGE_NET_PROTOCOL_NBD && + src->haveTLS == VIR_TRISTATE_BOOL_YES) + return true; + return false; } diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 96793a5046..34be4c112b 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -9962,6 +9962,34 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src, } +static int +qemuProcessPrepareStorageSourceTLSNBD(virStorageSourcePtr src, + virQEMUDriverConfigPtr cfg, + virQEMUCapsPtr qemuCaps) +{ + if (src->haveTLS == VIR_TRISTATE_BOOL_ABSENT) { + if (cfg->nbdTLS) + src->haveTLS = VIR_TRISTATE_BOOL_YES; + else + src->haveTLS = VIR_TRISTATE_BOOL_NO; + src->tlsFromConfig = true; + } + + if (src->haveTLS == VIR_TRISTATE_BOOL_YES) { + if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_NBD_TLS)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("this qemu does not support TLS transport for NBD")); + return -1; + } + + if (VIR_STRDUP(src->tlsCertdir, cfg->nbdTLSx509certdir) < 0) + return -1; + } + + return 0; +} + + /* qemuProcessPrepareStorageSourceTLS: * @source: source for a disk * @cfg: driver configuration @@ -9976,7 +10004,8 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src, static int qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src, virQEMUDriverConfigPtr cfg, - const char *parentAlias) + const char *parentAlias, + virQEMUCapsPtr qemuCaps) { if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK) return 0; @@ -9988,6 +10017,10 @@ qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src, break; case VIR_STORAGE_NET_PROTOCOL_NBD: + if (qemuProcessPrepareStorageSourceTLSNBD(src, cfg, qemuCaps) < 0) + return -1; + break; + case VIR_STORAGE_NET_PROTOCOL_RBD: case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG: case VIR_STORAGE_NET_PROTOCOL_GLUSTER: @@ -12530,7 +12563,8 @@ qemuDomainPrepareDiskSourceLegacy(virDomainDiskDefPtr disk, if (qemuDomainPrepareStorageSourcePR(disk->src, priv, disk->info.alias) < 0) return -1; - if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias) < 0) + if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias, + priv->qemuCaps) < 0) return -1; return 0; diff --git a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args index 91d3a8a70a..970b8a32a6 100644 --- a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args +++ b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args @@ -43,4 +43,11 @@ id=virtio-disk1 \ file.server.host=192.168.0.3,file.server.port=9999,format=raw,if=none,\ id=drive-virtio-disk2,serial=eb90327c-8302-4725-9e1b-4e85ed4dc252,cache=none \ -device virtio-blk-pci,bus=pci.0,addr=0x6,drive=drive-virtio-disk2,\ -id=virtio-disk2 +id=virtio-disk2 \ +-object tls-creds-x509,id=objvirtio-disk3_tls0,dir=/etc/pki/qemu,\ +endpoint=client,verify-peer=yes \ +-drive file.driver=nbd,file.server.type=inet,file.server.host=example.com,\ +file.server.port=1234,file.tls-creds=objvirtio-disk3_tls0,format=raw,if=none,\ +id=drive-virtio-disk3,cache=none \ +-device virtio-blk-pci,bus=pci.0,addr=0x7,drive=drive-virtio-disk3,\ +id=virtio-disk3 diff --git a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml index a66e81f065..9f6f298b54 100644 --- a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml +++ b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml @@ -41,6 +41,14 @@ eb90327c-8302-4725-9e1b-4e85ed4dc252

+ + + + + + +
+ diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 64d112be36..14a994523f 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -1052,7 +1052,7 @@ mymain(void) DO_TEST("disk-drive-network-vxhs", QEMU_CAPS_VXHS); driver.config->vxhsTLS = 1; DO_TEST("disk-drive-network-tlsx509", QEMU_CAPS_VXHS, - QEMU_CAPS_OBJECT_TLS_CREDS_X509); + QEMU_CAPS_OBJECT_TLS_CREDS_X509, QEMU_CAPS_NBD_TLS); driver.config->vxhsTLS = 0; VIR_FREE(driver.config->vxhsTLSx509certdir); DO_TEST("disk-drive-no-boot", diff --git a/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml b/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml index 7053affd17..a9b8d32646 100644 --- a/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml +++ b/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml @@ -41,6 +41,14 @@ eb90327c-8302-4725-9e1b-4e85ed4dc252
+ + + + + + +
+