From: Peter Krempa Date: Fri, 13 Nov 2020 14:20:58 +0000 (+0100) Subject: qemu: conf: Enable 'migrate_tls_x509_verify' by default X-Git-Tag: v6.10.0-rc1~146 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=930583149c4701657a50686f200e475bd9e92a4a;p=thirdparty%2Flibvirt.git qemu: conf: Enable 'migrate_tls_x509_verify' by default The migration stream connection and also the NBD server for non-shared storage migration don't have any other form of client authentication on top of the TLS transport, so the only way to authenticate clients is to verify their certificate. Enable this option by defauilt when both 'migrate_tls_x509_verify' and 'default_tls_x509_verify' were not configured. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1879477 Signed-off-by: Peter Krempa Reviewed-by: Michal Privoznik Reviewed-by: Eric Blake --- diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf index 3979471f81..a12cae2533 100644 --- a/src/qemu/qemu.conf +++ b/src/qemu/qemu.conf @@ -385,7 +385,8 @@ # CA in the migrate_tls_x509_cert_dir (or default_tls_x509_cert_dir). # # If this option is not supplied, it will be set to the value of -# "default_tls_x509_verify". +# "default_tls_x509_verify". If "default_tls_x509_verify" is not supplied +# either, the default is "1". # #migrate_tls_x509_verify = 1 diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c index 044e4f19e8..25e9ed2ecd 100644 --- a/src/qemu/qemu_conf.c +++ b/src/qemu/qemu_conf.c @@ -1254,7 +1254,7 @@ virQEMUDriverConfigSetDefaults(virQEMUDriverConfigPtr cfg) SET_TLS_VERIFY_DEFAULT(vnc, false); SET_TLS_VERIFY_DEFAULT(chardev, true); - SET_TLS_VERIFY_DEFAULT(migrate, false); + SET_TLS_VERIFY_DEFAULT(migrate, true); SET_TLS_VERIFY_DEFAULT(backup, false); #undef SET_TLS_VERIFY_DEFAULT