To enable TLS-PSK-based authentication scheme, add support for instantiating the tls-creds-psk object through QEMU monitor. Suggested-by: Tejus GK <tejus.gk@nutanix.com> Signed-off-by: Abhisek Panda <abhisek.panda1@nutanix.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com> --- src/qemu/qemu_migration_params.c | 66 ++++++++++++++++++++++++++++++++ src/qemu/qemu_migration_params.h | 8 ++++ 2 files changed, 74 insertions(+) diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_params.c index d551ab9216..678bb5602b 100644 --- a/src/qemu/qemu_migration_params.c +++ b/src/qemu/qemu_migration_params.c @@ -31,6 +31,7 @@ #define LIBVIRT_QEMU_MIGRATION_PARAMSPRIV_H_ALLOW #include "qemu_migration_paramspriv.h" #include "qemu_monitor.h" +#include "qemu_command.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -1237,6 +1238,71 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, } +/* qemuMigrationParamsEnableTLSPSK + * @driver: pointer to qemu driver + * @vm: domain object + * @tlsListen: server or client + * @asyncJob: Migration job to join + * @tlsPSKAlias: alias to be generated for TLS-PSK object + * @migParams: migration parameters to set + * + * Create the TLS PSK objects for the migration and set the migParams value. + * + * Returns 0 on success, -1 on failure + */ +int +qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + qemuMigrationParams *migParams) +{ + qemuDomainObjPrivate *priv = vm->privateData; + g_autoptr(virJSONValue) tlsPSKProps = NULL; + g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver); + g_autofree char *key_dir_path = NULL; + g_autofree char *shortName = NULL; + virErrorPtr orig_err = NULL; + + if (!(shortName = virDomainDefGetShortName(vm->def))) + return -1; + + key_dir_path = g_strdup_printf("%s/%s", cfg->tlsPSKStateDir, shortName); + + if (!(*tlsAlias = qemuAliasTLSObjFromSrcAlias(QEMU_MIGRATION_TLS_ALIAS_BASE))) + return -1; + + if (qemuBuildTLSPSKBackendProps(key_dir_path, tlsListen, *tlsAlias, &tlsPSKProps) < 0) + return -1; + + /* Ensure the domain doesn't already have the TLS-PSK objects defined. + * This should prevent any issues just in case some cleanup wasn't + * properly completed (both src and dst use the same alias) or + * some other error path. */ + qemuDomainDelTLSObjects(vm, asyncJob, NULL, *tlsAlias); + + + /* Add the tls-creds-psk object to QEMU */ + if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) < 0) + return -1; + + if (qemuMonitorAddObject(priv->mon, &tlsPSKProps, NULL) < 0) { + virErrorPreserveLast(&orig_err); + qemuDomainObjExitMonitor(vm); + virErrorRestore(&orig_err); + return -1; + } + qemuDomainObjExitMonitor(vm); + + if (qemuMigrationParamsSetString(migParams, QEMU_MIGRATION_PARAM_TLS_CREDS, + *tlsAlias) < 0) + return -1; + + return 0; +} + + /* qemuMigrationParamsDisableTLS * @vm: domain object * @migParams: Pointer to a migration parameters block diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_params.h index 14e20fb71e..8774b4596c 100644 --- a/src/qemu/qemu_migration_params.h +++ b/src/qemu/qemu_migration_params.h @@ -123,6 +123,14 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver *driver, const char *hostname, qemuMigrationParams *migParams); +int +qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver, + virDomainObj *vm, + bool tlsListen, + int asyncJob, + char **tlsAlias, + qemuMigrationParams *migParams); + int qemuMigrationParamsDisableTLS(virDomainObj *vm, qemuMigrationParams *migParams); -- 2.43.7