mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-22 17:34:18 +03:00
qemu: domain: Add support for TLS for NBD
https://bugzilla.redhat.com/show_bug.cgi?id=1544869 Signed-off-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com>
This commit is contained in:
parent
ca108ab789
commit
8ac9db0e54
@ -2786,7 +2786,13 @@
|
||||
is mandatory to specify which volume/image will be used.
|
||||
</p>
|
||||
|
||||
<p>For "nbd", the <code>name</code> attribute is optional.
|
||||
<p>For "nbd", the <code>name</code> attribute is optional. TLS
|
||||
transport for NBD can be enabled by setting the <code>tls</code>
|
||||
attribute to <code>yes</code>. For the QEMU hypervisor, usage of
|
||||
a TLS environment can also be globally controlled on the host by
|
||||
the <code>nbd_tls</code> and <code>nbd_tls_x509_cert_dir</code> in
|
||||
/etc/libvirt/qemu.conf.
|
||||
('tls' <span class="since">Since 4.5.0</span>)
|
||||
</p>
|
||||
|
||||
<p>For "iscsi" (<span class="since">since 1.0.4</span>), the
|
||||
|
@ -1706,6 +1706,11 @@
|
||||
<optional>
|
||||
<attribute name="name"/>
|
||||
</optional>
|
||||
<optional>
|
||||
<attribute name="tls">
|
||||
<ref name="virYesNo"/>
|
||||
</attribute>
|
||||
</optional>
|
||||
<ref name="diskSourceNetworkHost"/>
|
||||
<optional>
|
||||
<ref name="encryption"/>
|
||||
|
@ -1388,6 +1388,11 @@ qemuDiskSourceNeedsProps(virStorageSourcePtr src,
|
||||
virQEMUCapsGet(qemuCaps, QEMU_CAPS_ISCSI_PASSWORD_SECRET))
|
||||
return true;
|
||||
|
||||
if (actualType == VIR_STORAGE_TYPE_NETWORK &&
|
||||
src->protocol == VIR_STORAGE_NET_PROTOCOL_NBD &&
|
||||
src->haveTLS == VIR_TRISTATE_BOOL_YES)
|
||||
return true;
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
|
@ -9962,6 +9962,34 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
|
||||
}
|
||||
|
||||
|
||||
static int
|
||||
qemuProcessPrepareStorageSourceTLSNBD(virStorageSourcePtr src,
|
||||
virQEMUDriverConfigPtr cfg,
|
||||
virQEMUCapsPtr qemuCaps)
|
||||
{
|
||||
if (src->haveTLS == VIR_TRISTATE_BOOL_ABSENT) {
|
||||
if (cfg->nbdTLS)
|
||||
src->haveTLS = VIR_TRISTATE_BOOL_YES;
|
||||
else
|
||||
src->haveTLS = VIR_TRISTATE_BOOL_NO;
|
||||
src->tlsFromConfig = true;
|
||||
}
|
||||
|
||||
if (src->haveTLS == VIR_TRISTATE_BOOL_YES) {
|
||||
if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_NBD_TLS)) {
|
||||
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
|
||||
_("this qemu does not support TLS transport for NBD"));
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (VIR_STRDUP(src->tlsCertdir, cfg->nbdTLSx509certdir) < 0)
|
||||
return -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
/* qemuProcessPrepareStorageSourceTLS:
|
||||
* @source: source for a disk
|
||||
* @cfg: driver configuration
|
||||
@ -9976,7 +10004,8 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
|
||||
static int
|
||||
qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
|
||||
virQEMUDriverConfigPtr cfg,
|
||||
const char *parentAlias)
|
||||
const char *parentAlias,
|
||||
virQEMUCapsPtr qemuCaps)
|
||||
{
|
||||
if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK)
|
||||
return 0;
|
||||
@ -9988,6 +10017,10 @@ qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
|
||||
break;
|
||||
|
||||
case VIR_STORAGE_NET_PROTOCOL_NBD:
|
||||
if (qemuProcessPrepareStorageSourceTLSNBD(src, cfg, qemuCaps) < 0)
|
||||
return -1;
|
||||
break;
|
||||
|
||||
case VIR_STORAGE_NET_PROTOCOL_RBD:
|
||||
case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
|
||||
case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
|
||||
@ -12530,7 +12563,8 @@ qemuDomainPrepareDiskSourceLegacy(virDomainDiskDefPtr disk,
|
||||
if (qemuDomainPrepareStorageSourcePR(disk->src, priv, disk->info.alias) < 0)
|
||||
return -1;
|
||||
|
||||
if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias) < 0)
|
||||
if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias,
|
||||
priv->qemuCaps) < 0)
|
||||
return -1;
|
||||
|
||||
return 0;
|
||||
|
@ -43,4 +43,11 @@ id=virtio-disk1 \
|
||||
file.server.host=192.168.0.3,file.server.port=9999,format=raw,if=none,\
|
||||
id=drive-virtio-disk2,serial=eb90327c-8302-4725-9e1b-4e85ed4dc252,cache=none \
|
||||
-device virtio-blk-pci,bus=pci.0,addr=0x6,drive=drive-virtio-disk2,\
|
||||
id=virtio-disk2
|
||||
id=virtio-disk2 \
|
||||
-object tls-creds-x509,id=objvirtio-disk3_tls0,dir=/etc/pki/qemu,\
|
||||
endpoint=client,verify-peer=yes \
|
||||
-drive file.driver=nbd,file.server.type=inet,file.server.host=example.com,\
|
||||
file.server.port=1234,file.tls-creds=objvirtio-disk3_tls0,format=raw,if=none,\
|
||||
id=drive-virtio-disk3,cache=none \
|
||||
-device virtio-blk-pci,bus=pci.0,addr=0x7,drive=drive-virtio-disk3,\
|
||||
id=virtio-disk3
|
||||
|
@ -41,6 +41,14 @@
|
||||
<serial>eb90327c-8302-4725-9e1b-4e85ed4dc252</serial>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
|
||||
</disk>
|
||||
<disk type='network' device='disk'>
|
||||
<driver name='qemu' type='raw' cache='none'/>
|
||||
<source protocol='nbd' tls='yes'>
|
||||
<host name='example.com' port='1234'/>
|
||||
</source>
|
||||
<target dev='vdd' bus='virtio'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
|
||||
</disk>
|
||||
<controller type='usb' index='0'/>
|
||||
<controller type='pci' index='0' model='pci-root'/>
|
||||
<input type='mouse' bus='ps2'/>
|
||||
|
@ -1052,7 +1052,7 @@ mymain(void)
|
||||
DO_TEST("disk-drive-network-vxhs", QEMU_CAPS_VXHS);
|
||||
driver.config->vxhsTLS = 1;
|
||||
DO_TEST("disk-drive-network-tlsx509", QEMU_CAPS_VXHS,
|
||||
QEMU_CAPS_OBJECT_TLS_CREDS_X509);
|
||||
QEMU_CAPS_OBJECT_TLS_CREDS_X509, QEMU_CAPS_NBD_TLS);
|
||||
driver.config->vxhsTLS = 0;
|
||||
VIR_FREE(driver.config->vxhsTLSx509certdir);
|
||||
DO_TEST("disk-drive-no-boot",
|
||||
|
@ -41,6 +41,14 @@
|
||||
<serial>eb90327c-8302-4725-9e1b-4e85ed4dc252</serial>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
|
||||
</disk>
|
||||
<disk type='network' device='disk'>
|
||||
<driver name='qemu' type='raw' cache='none'/>
|
||||
<source protocol='nbd' tls='yes'>
|
||||
<host name='example.com' port='1234'/>
|
||||
</source>
|
||||
<target dev='vdd' bus='virtio'/>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
|
||||
</disk>
|
||||
<controller type='usb' index='0'>
|
||||
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
|
||||
</controller>
|
||||
|
Loading…
Reference in New Issue
Block a user