Re: [libvirt] [PATCH 00/21] Support NBD for tunnelled migration

On 08.01.2016 02:30, Jiri Denemark wrote: Hi. Here in virtuozzo we need to support encrypted migration in near future and want to be able to pass all migration traffic thru single socket too. So we upvote this patch if it matters. If technical implications are so high could we elaborate another approach to organize single socket encrypted migration? There is an RFC already - https://www.redhat.com/archives/libvir-list/2015-November/msg00294.html. However because it is probably too short and Jan's comments gives some hints too I'll rephrase it here. It is perfectly possible to organize external migration tunnel with current options. We can set migration uri to "127.0.0.1:port" and use VIR_MIGRATE_PARAM_LISTEN_ADDRESS equal to "127.0.0.1". This set of options would cause source qemu to migrate to "127.0.0.1:port" and destination qemu to handle migration on "127.0.0.1:port". Thus we can tunnel by forwarding "port" from source to destination. However if VM has non shared disks we can't do it. The problem is that port for disks migration will be choosen by destination side automatiacally and we have no possibility to organize an appropriate port forwarding beforehand. So the proposition is to add one more option, say VIR_MIGRATE_PARAM_NBD_PORT so that nbd port could be specified in migration command. This should not add much complexity.