diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index 713d7aa88a..7f4de657c6 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -2786,7 +2786,13 @@
is mandatory to specify which volume/image will be used.
- For "nbd", the name
attribute is optional.
+
For "nbd", the name
attribute is optional. TLS
+ transport for NBD can be enabled by setting the tls
+ attribute to yes
. For the QEMU hypervisor, usage of
+ a TLS environment can also be globally controlled on the host by
+ the nbd_tls
and nbd_tls_x509_cert_dir
in
+ /etc/libvirt/qemu.conf.
+ ('tls' Since 4.5.0 )
For "iscsi" (since 1.0.4 ), the
diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index b7404e1ce0..6379ab1e63 100644
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -1706,6 +1706,11 @@
+
+
+
+
+
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index f4f958f278..a0f6d3ee6a 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -1388,6 +1388,11 @@ qemuDiskSourceNeedsProps(virStorageSourcePtr src,
virQEMUCapsGet(qemuCaps, QEMU_CAPS_ISCSI_PASSWORD_SECRET))
return true;
+ if (actualType == VIR_STORAGE_TYPE_NETWORK &&
+ src->protocol == VIR_STORAGE_NET_PROTOCOL_NBD &&
+ src->haveTLS == VIR_TRISTATE_BOOL_YES)
+ return true;
+
return false;
}
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 96793a5046..34be4c112b 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -9962,6 +9962,34 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
}
+static int
+qemuProcessPrepareStorageSourceTLSNBD(virStorageSourcePtr src,
+ virQEMUDriverConfigPtr cfg,
+ virQEMUCapsPtr qemuCaps)
+{
+ if (src->haveTLS == VIR_TRISTATE_BOOL_ABSENT) {
+ if (cfg->nbdTLS)
+ src->haveTLS = VIR_TRISTATE_BOOL_YES;
+ else
+ src->haveTLS = VIR_TRISTATE_BOOL_NO;
+ src->tlsFromConfig = true;
+ }
+
+ if (src->haveTLS == VIR_TRISTATE_BOOL_YES) {
+ if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_NBD_TLS)) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("this qemu does not support TLS transport for NBD"));
+ return -1;
+ }
+
+ if (VIR_STRDUP(src->tlsCertdir, cfg->nbdTLSx509certdir) < 0)
+ return -1;
+ }
+
+ return 0;
+}
+
+
/* qemuProcessPrepareStorageSourceTLS:
* @source: source for a disk
* @cfg: driver configuration
@@ -9976,7 +10004,8 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
static int
qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
virQEMUDriverConfigPtr cfg,
- const char *parentAlias)
+ const char *parentAlias,
+ virQEMUCapsPtr qemuCaps)
{
if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK)
return 0;
@@ -9988,6 +10017,10 @@ qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
break;
case VIR_STORAGE_NET_PROTOCOL_NBD:
+ if (qemuProcessPrepareStorageSourceTLSNBD(src, cfg, qemuCaps) < 0)
+ return -1;
+ break;
+
case VIR_STORAGE_NET_PROTOCOL_RBD:
case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
@@ -12530,7 +12563,8 @@ qemuDomainPrepareDiskSourceLegacy(virDomainDiskDefPtr disk,
if (qemuDomainPrepareStorageSourcePR(disk->src, priv, disk->info.alias) < 0)
return -1;
- if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias) < 0)
+ if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias,
+ priv->qemuCaps) < 0)
return -1;
return 0;
diff --git a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args
index 91d3a8a70a..970b8a32a6 100644
--- a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args
+++ b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args
@@ -43,4 +43,11 @@ id=virtio-disk1 \
file.server.host=192.168.0.3,file.server.port=9999,format=raw,if=none,\
id=drive-virtio-disk2,serial=eb90327c-8302-4725-9e1b-4e85ed4dc252,cache=none \
-device virtio-blk-pci,bus=pci.0,addr=0x6,drive=drive-virtio-disk2,\
-id=virtio-disk2
+id=virtio-disk2 \
+-object tls-creds-x509,id=objvirtio-disk3_tls0,dir=/etc/pki/qemu,\
+endpoint=client,verify-peer=yes \
+-drive file.driver=nbd,file.server.type=inet,file.server.host=example.com,\
+file.server.port=1234,file.tls-creds=objvirtio-disk3_tls0,format=raw,if=none,\
+id=drive-virtio-disk3,cache=none \
+-device virtio-blk-pci,bus=pci.0,addr=0x7,drive=drive-virtio-disk3,\
+id=virtio-disk3
diff --git a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml
index a66e81f065..9f6f298b54 100644
--- a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml
+++ b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml
@@ -41,6 +41,14 @@
eb90327c-8302-4725-9e1b-4e85ed4dc252
+
+
+
+
+
+
+
+
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index 64d112be36..14a994523f 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -1052,7 +1052,7 @@ mymain(void)
DO_TEST("disk-drive-network-vxhs", QEMU_CAPS_VXHS);
driver.config->vxhsTLS = 1;
DO_TEST("disk-drive-network-tlsx509", QEMU_CAPS_VXHS,
- QEMU_CAPS_OBJECT_TLS_CREDS_X509);
+ QEMU_CAPS_OBJECT_TLS_CREDS_X509, QEMU_CAPS_NBD_TLS);
driver.config->vxhsTLS = 0;
VIR_FREE(driver.config->vxhsTLSx509certdir);
DO_TEST("disk-drive-no-boot",
diff --git a/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml b/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml
index 7053affd17..a9b8d32646 100644
--- a/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml
+++ b/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml
@@ -41,6 +41,14 @@
eb90327c-8302-4725-9e1b-4e85ed4dc252
+
+
+
+
+
+
+
+