qemu: domain: Add support for TLS for NBD

https://bugzilla.redhat.com/show_bug.cgi?id=1544869

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>

diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index 713d7aa88a21b7c42d8cd5b8c4b6ab25a145afbd..7f4de657c6afd952026b394229515c6037ea37fe 100644 (file)
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -2786,7 +2786,13 @@
               is mandatory to specify which volume/image will be used.
               </p>
 
-              <p>For "nbd", the <code>name</code> attribute is optional.
+              <p>For "nbd", the <code>name</code> attribute is optional. TLS
+              transport for NBD can be enabled by setting the <code>tls</code>
+              attribute to <code>yes</code>. For the QEMU hypervisor, usage of
+              a TLS environment can also be globally controlled on the host by
+              the <code>nbd_tls</code> and <code>nbd_tls_x509_cert_dir</code> in
+              /etc/libvirt/qemu.conf.
+              ('tls' <span class="since">Since 4.5.0</span>)
               </p>
 
               <p>For "iscsi" (<span class="since">since 1.0.4</span>), the

diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index b7404e1ce000cd26cfb56c31580b642cea593e41..6379ab1e63f9805982aecedd559b4fa7bff92ad1 100644 (file)
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -1706,6 +1706,11 @@
       <optional>
         <attribute name="name"/>
       </optional>
+      <optional>
+        <attribute name="tls">
+          <ref name="virYesNo"/>
+        </attribute>
+      </optional>
       <ref name="diskSourceNetworkHost"/>
       <optional>
         <ref name="encryption"/>

diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index f4f958f278fa6cd91ae0bb613cdbdcbc4cd2501d..a0f6d3ee6aa07d72eca32832ef1c2d907fd37166 100644 (file)
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -1388,6 +1388,11 @@ qemuDiskSourceNeedsProps(virStorageSourcePtr src,
         virQEMUCapsGet(qemuCaps, QEMU_CAPS_ISCSI_PASSWORD_SECRET))
         return true;
 
+    if (actualType == VIR_STORAGE_TYPE_NETWORK &&
+        src->protocol == VIR_STORAGE_NET_PROTOCOL_NBD &&
+        src->haveTLS == VIR_TRISTATE_BOOL_YES)
+        return true;
+
     return false;
 }
 

diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 96793a504663eb93b744ed00fea7d73a9487ed75..34be4c112b55d0a02e1d11837883200286aa8e9f 100644 (file)
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -9962,6 +9962,34 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
 }
 
 
+static int
+qemuProcessPrepareStorageSourceTLSNBD(virStorageSourcePtr src,
+                                      virQEMUDriverConfigPtr cfg,
+                                      virQEMUCapsPtr qemuCaps)
+{
+    if (src->haveTLS == VIR_TRISTATE_BOOL_ABSENT) {
+        if (cfg->nbdTLS)
+            src->haveTLS = VIR_TRISTATE_BOOL_YES;
+        else
+            src->haveTLS = VIR_TRISTATE_BOOL_NO;
+        src->tlsFromConfig = true;
+    }
+
+    if (src->haveTLS == VIR_TRISTATE_BOOL_YES) {
+        if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_NBD_TLS)) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                           _("this qemu does not support TLS transport for NBD"));
+            return -1;
+        }
+
+        if (VIR_STRDUP(src->tlsCertdir, cfg->nbdTLSx509certdir) < 0)
+            return -1;
+    }
+
+    return 0;
+}
+
+
 /* qemuProcessPrepareStorageSourceTLS:
  * @source: source for a disk
  * @cfg: driver configuration
@@ -9976,7 +10004,8 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
 static int
 qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
                                   virQEMUDriverConfigPtr cfg,
-                                  const char *parentAlias)
+                                  const char *parentAlias,
+                                  virQEMUCapsPtr qemuCaps)
 {
     if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK)
         return 0;
@@ -9988,6 +10017,10 @@ qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
         break;
 
     case VIR_STORAGE_NET_PROTOCOL_NBD:
+        if (qemuProcessPrepareStorageSourceTLSNBD(src, cfg, qemuCaps) < 0)
+            return -1;
+        break;
+
     case VIR_STORAGE_NET_PROTOCOL_RBD:
     case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
     case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
@@ -12530,7 +12563,8 @@ qemuDomainPrepareDiskSourceLegacy(virDomainDiskDefPtr disk,
     if (qemuDomainPrepareStorageSourcePR(disk->src, priv, disk->info.alias) < 0)
         return -1;
 
-    if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias) < 0)
+    if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias,
+                                          priv->qemuCaps) < 0)
         return -1;
 
     return 0;

diff --git a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args
index 91d3a8a70a77d6eea07d3200f53d87ea19d53eb8..970b8a32a6c3639f210be712bb86c92f770c11cd 100644 (file)
--- a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args
+++ b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args
@@ -43,4 +43,11 @@ id=virtio-disk1 \
 file.server.host=192.168.0.3,file.server.port=9999,format=raw,if=none,\
 id=drive-virtio-disk2,serial=eb90327c-8302-4725-9e1b-4e85ed4dc252,cache=none \
 -device virtio-blk-pci,bus=pci.0,addr=0x6,drive=drive-virtio-disk2,\
-id=virtio-disk2
+id=virtio-disk2 \
+-object tls-creds-x509,id=objvirtio-disk3_tls0,dir=/etc/pki/qemu,\
+endpoint=client,verify-peer=yes \
+-drive file.driver=nbd,file.server.type=inet,file.server.host=example.com,\
+file.server.port=1234,file.tls-creds=objvirtio-disk3_tls0,format=raw,if=none,\
+id=drive-virtio-disk3,cache=none \
+-device virtio-blk-pci,bus=pci.0,addr=0x7,drive=drive-virtio-disk3,\
+id=virtio-disk3

diff --git a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml
index a66e81f065f3b9d8ba6fe97ac6ac6a6fc9f3e67a..9f6f298b54f7e052b5dbe61185583574225cae2b 100644 (file)
--- a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml
+++ b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml
@@ -41,6 +41,14 @@
       <serial>eb90327c-8302-4725-9e1b-4e85ed4dc252</serial>
       <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
     </disk>
+    <disk type='network' device='disk'>
+      <driver name='qemu' type='raw' cache='none'/>
+      <source protocol='nbd' tls='yes'>
+        <host name='example.com' port='1234'/>
+      </source>
+      <target dev='vdd' bus='virtio'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+    </disk>
     <controller type='usb' index='0'/>
     <controller type='pci' index='0' model='pci-root'/>
     <input type='mouse' bus='ps2'/>

diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index 64d112be364eec367ceba4999ec375301483162b..14a994523f78ca1a4c02f2df6e875a9ff115c47a 100644 (file)
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -1052,7 +1052,7 @@ mymain(void)
     DO_TEST("disk-drive-network-vxhs", QEMU_CAPS_VXHS);
     driver.config->vxhsTLS = 1;
     DO_TEST("disk-drive-network-tlsx509", QEMU_CAPS_VXHS,
-            QEMU_CAPS_OBJECT_TLS_CREDS_X509);
+            QEMU_CAPS_OBJECT_TLS_CREDS_X509, QEMU_CAPS_NBD_TLS);
     driver.config->vxhsTLS = 0;
     VIR_FREE(driver.config->vxhsTLSx509certdir);
     DO_TEST("disk-drive-no-boot",

diff --git a/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml b/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml
index 7053affd176399b7b2f5f8d47d6ce95f8b340bcc..a9b8d3264673c54a1dcd9bc6e4c189efb53a887f 100644 (file)
--- a/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml
+++ b/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml
@@ -41,6 +41,14 @@
       <serial>eb90327c-8302-4725-9e1b-4e85ed4dc252</serial>
       <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
     </disk>
+    <disk type='network' device='disk'>
+      <driver name='qemu' type='raw' cache='none'/>
+      <source protocol='nbd' tls='yes'>
+        <host name='example.com' port='1234'/>
+      </source>
+      <target dev='vdd' bus='virtio'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+    </disk>
     <controller type='usb' index='0'>
       <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
     </controller>