[libvirt] [PATCH v10 3/5] util: Add TLS attributes to virStorageSource
John Ferlan
jferlan at redhat.com
Wed Sep 27 15:45:53 UTC 2017
From: Ashish Mittal <Ashish.Mittal at veritas.com>
Add an optional virTristateBool haveTLS to virStorageSource to
manage whether a storage source will be using TLS.
Sample XML for a VxHS disk:
<disk type='network' device='disk'>
<driver name='qemu' type='raw' cache='none'/>
<source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
<host name='192.168.0.1' port='9999'/>
</source>
<target dev='vda' bus='virtio'/>
</disk>
Additionally add a tlsFromConfig boolean to control whether the TLS
setting was due to domain configuration or qemu.conf global setting
in order to decide whether to Format the haveTLS setting for either
a live or saved domain configuration file.
Update the qemuxml2xmltest in order to add a test to show the proper
parsing.
Also update the docs to describe the tls attribute.
Signed-off-by: Ashish Mittal <Ashish.Mittal at veritas.com>
Signed-off-by: John Ferlan <jferlan at redhat.com>
---
docs/formatdomain.html.in | 17 +++++-
docs/schemas/domaincommon.rng | 5 ++
src/conf/domain_conf.c | 64 ++++++++++++++++++----
src/conf/domain_conf.h | 3 +-
src/conf/snapshot_conf.c | 7 ++-
src/util/virstoragefile.c | 2 +
src/util/virstoragefile.h | 7 +++
...emuxml2argv-disk-drive-network-tlsx509-vxhs.xml | 32 +++++++++++
...uxml2xmlout-disk-drive-network-tlsx509-vxhs.xml | 34 ++++++++++++
tests/qemuxml2xmltest.c | 1 +
10 files changed, 154 insertions(+), 18 deletions(-)
create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index bfca7ed3a..3e10213b5 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -2531,10 +2531,21 @@
specified, the default LUN is zero.
</p>
- <p>
- For "vxhs" (<span class="since">since 3.8.0</span>), the
+ <p>For "vxhs" (<span class="since">since 3.8.0</span>), the
<code>name</code> is the UUID of the volume, assigned by the
- HyperScale server.
+ HyperScale server. Additionally, an optional attribute
+ <code>tls</code> (QEMU only) can be used to control whether a
+ VxHS block device would utilize a hypervisor configured TLS
+ X.509 certificate environment in order to encrypt the data
+ channel. For the QEMU hypervisor, usage of a TLS environment can
+ also be globally controlled on the host by the
+ <code>vxhs_tls</code> and <code>vxhs_tls_x509_cert_dir</code> or
+ <code>default_tls_x509_cert_dir</code> settings in the file
+ /etc/libvirt/qemu.conf. If <code>vxhs_tls</code> is enabled,
+ then unless the domain <code>tls</code> attribute is set to "no",
+ libvirt will use the host configured TLS environment. If the
+ <code>tls</code> attribute is set to "yes", then regardless of
+ the qemu.conf setting, TLS authentication will be attempted.
</p>
<span class="since">Since 0.8.7</span>
</dd>
diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index 76852abb3..bac371ea3 100644
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -1644,6 +1644,11 @@
</choice>
</attribute>
<attribute name="name"/>
+ <optional>
+ <attribute name="tls">
+ <ref name="virYesNo"/>
+ </attribute>
+ </optional>
<ref name="diskSourceNetworkHost"/>
</element>
</define>
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index fd6d3120f..87192eb2d 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -8109,11 +8109,15 @@ virDomainDiskSourcePoolDefParse(xmlNodePtr node,
int
virDomainDiskSourceParse(xmlNodePtr node,
xmlXPathContextPtr ctxt,
- virStorageSourcePtr src)
+ virStorageSourcePtr src,
+ unsigned int flags)
{
int ret = -1;
char *protocol = NULL;
xmlNodePtr saveNode = ctxt->node;
+ char *haveTLS = NULL;
+ char *tlsCfg = NULL;
+ int tlsCfgVal;
ctxt->node = node;
@@ -8147,6 +8151,30 @@ virDomainDiskSourceParse(xmlNodePtr node,
goto cleanup;
}
+ /* Check tls=yes|no domain setting for the block device
+ * At present only VxHS. Other block devices may be added later */
+ if (src->protocol == VIR_STORAGE_NET_PROTOCOL_VXHS &&
+ (haveTLS = virXMLPropString(node, "tls"))) {
+ if ((src->haveTLS =
+ virTristateBoolTypeFromString(haveTLS)) <= 0) {
+ virReportError(VIR_ERR_XML_ERROR,
+ _("unknown disk source 'tls' setting '%s'"),
+ haveTLS);
+ goto cleanup;
+ }
+ }
+
+ if ((flags & VIR_DOMAIN_DEF_PARSE_STATUS) &&
+ (tlsCfg = virXMLPropString(node, "tlsFromConfig"))) {
+ if (virStrToLong_i(tlsCfg, NULL, 10, &tlsCfgVal) < 0) {
+ virReportError(VIR_ERR_XML_ERROR,
+ _("Invalid tlsFromConfig value: %s"),
+ tlsCfg);
+ goto cleanup;
+ }
+ src->tlsFromConfig = !!tlsCfgVal;
+ }
+
/* for historical reasons the volume name for gluster volume is stored
* as a part of the path. This is hard to work with when dealing with
* relative names. Split out the volume into a separate variable */
@@ -8202,6 +8230,8 @@ virDomainDiskSourceParse(xmlNodePtr node,
cleanup:
VIR_FREE(protocol);
+ VIR_FREE(haveTLS);
+ VIR_FREE(tlsCfg);
ctxt->node = saveNode;
return ret;
}
@@ -8209,7 +8239,8 @@ virDomainDiskSourceParse(xmlNodePtr node,
static int
virDomainDiskBackingStoreParse(xmlXPathContextPtr ctxt,
- virStorageSourcePtr src)
+ virStorageSourcePtr src,
+ unsigned int flags)
{
virStorageSourcePtr backingStore = NULL;
xmlNodePtr save_ctxt = ctxt->node;
@@ -8258,8 +8289,8 @@ virDomainDiskBackingStoreParse(xmlXPathContextPtr ctxt,
goto cleanup;
}
- if (virDomainDiskSourceParse(source, ctxt, backingStore) < 0 ||
- virDomainDiskBackingStoreParse(ctxt, backingStore) < 0)
+ if (virDomainDiskSourceParse(source, ctxt, backingStore, flags) < 0 ||
+ virDomainDiskBackingStoreParse(ctxt, backingStore, flags) < 0)
goto cleanup;
src->backingStore = backingStore;
@@ -8360,7 +8391,8 @@ virDomainDiskDefIotuneParse(virDomainDiskDefPtr def,
static int
virDomainDiskDefMirrorParse(virDomainDiskDefPtr def,
xmlNodePtr cur,
- xmlXPathContextPtr ctxt)
+ xmlXPathContextPtr ctxt,
+ unsigned int flags)
{
xmlNodePtr mirrorNode;
char *mirrorFormat = NULL;
@@ -8398,7 +8430,7 @@ virDomainDiskDefMirrorParse(virDomainDiskDefPtr def,
goto cleanup;
}
- if (virDomainDiskSourceParse(mirrorNode, ctxt, def->mirror) < 0)
+ if (virDomainDiskSourceParse(mirrorNode, ctxt, def->mirror, flags) < 0)
goto cleanup;
} else {
/* For back-compat reasons, we handle a file name
@@ -8815,7 +8847,7 @@ virDomainDiskDefParseXML(virDomainXMLOptionPtr xmlopt,
if (!source && virXMLNodeNameEqual(cur, "source")) {
sourceNode = cur;
- if (virDomainDiskSourceParse(cur, ctxt, def->src) < 0)
+ if (virDomainDiskSourceParse(cur, ctxt, def->src, flags) < 0)
goto error;
source = true;
@@ -8871,7 +8903,7 @@ virDomainDiskDefParseXML(virDomainXMLOptionPtr xmlopt,
} else if (!def->mirror &&
virXMLNodeNameEqual(cur, "mirror") &&
!(flags & VIR_DOMAIN_DEF_PARSE_INACTIVE)) {
- if (virDomainDiskDefMirrorParse(def, cur, ctxt) < 0)
+ if (virDomainDiskDefMirrorParse(def, cur, ctxt, flags) < 0)
goto error;
} else if (!authdef &&
virXMLNodeNameEqual(cur, "auth")) {
@@ -9126,7 +9158,7 @@ virDomainDiskDefParseXML(virDomainXMLOptionPtr xmlopt,
product = NULL;
if (!(flags & VIR_DOMAIN_DEF_PARSE_DISK_SOURCE)) {
- if (virDomainDiskBackingStoreParse(ctxt, def->src) < 0)
+ if (virDomainDiskBackingStoreParse(ctxt, def->src, flags) < 0)
goto error;
}
@@ -21673,7 +21705,8 @@ virDomainSourceDefFormatSeclabel(virBufferPtr buf,
static int
virDomainDiskSourceFormatNetwork(virBufferPtr attrBuf,
virBufferPtr childBuf,
- virStorageSourcePtr src)
+ virStorageSourcePtr src,
+ unsigned int flags)
{
size_t n;
char *path = NULL;
@@ -21690,6 +21723,14 @@ virDomainDiskSourceFormatNetwork(virBufferPtr attrBuf,
VIR_FREE(path);
+ if (src->haveTLS != VIR_TRISTATE_BOOL_ABSENT &&
+ !(flags & VIR_DOMAIN_DEF_FORMAT_MIGRATABLE &&
+ src->tlsFromConfig))
+ virBufferAsprintf(attrBuf, " tls='%s'",
+ virTristateBoolTypeToString(src->haveTLS));
+ if (flags & VIR_DOMAIN_DEF_FORMAT_STATUS)
+ virBufferAsprintf(attrBuf, " tlsFromConfig='%d'", src->tlsFromConfig);
+
for (n = 0; n < src->nhosts; n++) {
virBufferAddLit(childBuf, "<host");
virBufferEscapeString(childBuf, " name='%s'", src->hosts[n].name);
@@ -21754,7 +21795,8 @@ virDomainDiskSourceFormatInternal(virBufferPtr buf,
break;
case VIR_STORAGE_TYPE_NETWORK:
- if (virDomainDiskSourceFormatNetwork(&attrBuf, &childBuf, src) < 0)
+ if (virDomainDiskSourceFormatNetwork(&attrBuf, &childBuf,
+ src, flags) < 0)
goto error;
break;
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index e11ae5247..05a035a16 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -2995,7 +2995,8 @@ virDomainDiskDefPtr
virDomainDiskRemoveByName(virDomainDefPtr def, const char *name);
int virDomainDiskSourceParse(xmlNodePtr node,
xmlXPathContextPtr ctxt,
- virStorageSourcePtr src);
+ virStorageSourcePtr src,
+ unsigned int flags);
int virDomainNetFindIdx(virDomainDefPtr def, virDomainNetDefPtr net);
virDomainNetDefPtr virDomainNetFind(virDomainDefPtr def, const char *device);
diff --git a/src/conf/snapshot_conf.c b/src/conf/snapshot_conf.c
index 07706e0b2..f0e852c92 100644
--- a/src/conf/snapshot_conf.c
+++ b/src/conf/snapshot_conf.c
@@ -109,7 +109,8 @@ void virDomainSnapshotDefFree(virDomainSnapshotDefPtr def)
static int
virDomainSnapshotDiskDefParseXML(xmlNodePtr node,
xmlXPathContextPtr ctxt,
- virDomainSnapshotDiskDefPtr def)
+ virDomainSnapshotDiskDefPtr def,
+ unsigned int flags)
{
int ret = -1;
char *snapshot = NULL;
@@ -154,7 +155,7 @@ virDomainSnapshotDiskDefParseXML(xmlNodePtr node,
}
if ((cur = virXPathNode("./source", ctxt)) &&
- virDomainDiskSourceParse(cur, ctxt, def->src) < 0)
+ virDomainDiskSourceParse(cur, ctxt, def->src, flags) < 0)
goto cleanup;
if ((driver = virXPathString("string(./driver/@type)", ctxt))) {
@@ -348,7 +349,7 @@ virDomainSnapshotDefParse(xmlXPathContextPtr ctxt,
def->ndisks = n;
for (i = 0; i < def->ndisks; i++) {
if (virDomainSnapshotDiskDefParseXML(nodes[i], ctxt,
- &def->disks[i]) < 0)
+ &def->disks[i], flags) < 0)
goto cleanup;
}
VIR_FREE(nodes);
diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c
index 484a5c806..c0b9bcd8d 100644
--- a/src/util/virstoragefile.c
+++ b/src/util/virstoragefile.c
@@ -2040,6 +2040,8 @@ virStorageSourceCopy(const virStorageSource *src,
ret->physical = src->physical;
ret->readonly = src->readonly;
ret->shared = src->shared;
+ ret->haveTLS = src->haveTLS;
+ ret->tlsFromConfig = src->tlsFromConfig;
/* storage driver metadata are not copied */
ret->drv = NULL;
diff --git a/src/util/virstoragefile.h b/src/util/virstoragefile.h
index f7e897f25..4817090fc 100644
--- a/src/util/virstoragefile.h
+++ b/src/util/virstoragefile.h
@@ -281,6 +281,13 @@ struct _virStorageSource {
/* metadata that allows identifying given storage source */
char *nodeformat; /* name of the format handler object */
char *nodestorage; /* name of the storage object */
+
+ /* An optional setting to enable usage of TLS for the storage source */
+ int haveTLS; /* enum virTristateBool */
+
+ /* Indication whether the haveTLS value was altered due to qemu.conf
+ * setting when haveTLS is missing from the domain config file */
+ bool tlsFromConfig;
};
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
new file mode 100644
index 000000000..61b5e2e79
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
@@ -0,0 +1,32 @@
+<domain type='qemu'>
+ <name>QEMUGuest1</name>
+ <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+ <memory unit='KiB'>219136</memory>
+ <currentMemory unit='KiB'>219136</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='i686' machine='pc'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>destroy</on_crash>
+ <devices>
+ <emulator>/usr/bin/qemu-system-x86_64</emulator>
+ <disk type='network' device='disk'>
+ <driver name='qemu' type='raw' cache='none'/>
+ <source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
+ <host name='192.168.0.1' port='9999'/>
+ </source>
+ <target dev='vda' bus='virtio'/>
+ <serial>eb90327c-8302-4725-9e1b-4e85ed4dc251</serial>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'/>
+ <controller type='pci' index='0' model='pci-root'/>
+ <input type='mouse' bus='ps2'/>
+ <input type='keyboard' bus='ps2'/>
+ <memballoon model='none'/>
+ </devices>
+</domain>
diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
new file mode 100644
index 000000000..16f0883e0
--- /dev/null
+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
@@ -0,0 +1,34 @@
+<domain type='qemu'>
+ <name>QEMUGuest1</name>
+ <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+ <memory unit='KiB'>219136</memory>
+ <currentMemory unit='KiB'>219136</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='i686' machine='pc'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>destroy</on_crash>
+ <devices>
+ <emulator>/usr/bin/qemu-system-x86_64</emulator>
+ <disk type='network' device='disk'>
+ <driver name='qemu' type='raw' cache='none'/>
+ <source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
+ <host name='192.168.0.1' port='9999'/>
+ </source>
+ <target dev='vda' bus='virtio'/>
+ <serial>eb90327c-8302-4725-9e1b-4e85ed4dc251</serial>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'>
+ <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+ </controller>
+ <controller type='pci' index='0' model='pci-root'/>
+ <input type='mouse' bus='ps2'/>
+ <input type='keyboard' bus='ps2'/>
+ <memballoon model='none'/>
+ </devices>
+</domain>
diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c
index 4b2fbd990..2dba3607c 100644
--- a/tests/qemuxml2xmltest.c
+++ b/tests/qemuxml2xmltest.c
@@ -475,6 +475,7 @@ mymain(void)
DO_TEST("disk-drive-network-rbd-ceph-env", NONE);
DO_TEST("disk-drive-network-sheepdog", NONE);
DO_TEST("disk-drive-network-vxhs", NONE);
+ DO_TEST("disk-drive-network-tlsx509-vxhs", NONE);
DO_TEST("disk-scsi-device",
QEMU_CAPS_NODEFCONFIG, QEMU_CAPS_SCSI_LSI);
DO_TEST("disk-scsi-vscsi", NONE);
--
2.13.5
More information about the libvir-list
mailing list