7:51 a.m.
From: Ashish Mittal <Ashish.Mittal(a)veritas.com>
Add an optional virTristateBool haveTLS to virStorageSource to
manage whether a storage source will be using TLS.
Sample XML for a VxHS disk:
<disk type='network' device='disk'>
<driver name='qemu' type='raw' cache='none'/>
<source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251'
tls='yes'>
<host name='192.168.0.1' port='9999'/>
</source>
<target dev='vda' bus='virtio'/>
</disk>
Additionally add a tlsFromConfig boolean to control whether the TLS
setting was due to domain configuration or qemu.conf global setting
in order to decide whether to Format the haveTLS setting for either
a live or saved domain configuration file.
Update the qemuxml2xmltest in order to add a test to show the proper
parsing.
Also update the docs to describe the tls attribute plus clean up the
description in the surrounding area to make the information a bit more
readable rather than one winding paragraph.
Signed-off-by: Ashish Mittal <Ashish.Mittal(a)veritas.com>
Signed-off-by: John Ferlan <jferlan(a)redhat.com>
---
docs/formatdomain.html.in | 40 ++++++++++++++++------
docs/schemas/domaincommon.rng | 5 +++
src/conf/domain_conf.c | 28 +++++++++++++--
src/util/virstoragefile.c | 2 ++
src/util/virstoragefile.h | 7 ++++
...emuxml2argv-disk-drive-network-tlsx509-vxhs.xml | 32 +++++++++++++++++
...uxml2xmlout-disk-drive-network-tlsx509-vxhs.xml | 34 ++++++++++++++++++
tests/qemuxml2xmltest.c | 1 +
8 files changed, 137 insertions(+), 12 deletions(-)
create mode 100644
tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
create mode 100644
tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index 446ffff4c..26c00674a 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -2520,19 +2520,39 @@
<dd>
The <code>protocol</code> attribute specifies the protocol to
access to the requested image. Possible values are "nbd",
- "iscsi", "rbd", "sheepdog",
"gluster" or "vxhs". If the
- <code>protocol</code> attribute is "rbd",
"sheepdog", "gluster"
- or "vxhs", an additional attribute <code>name</code>
is
- mandatory to specify which volume/image will be used. For "nbd",
- the <code>name</code> attribute is optional. For
"iscsi"
- (<span class="since">since 1.0.4</span>), the
<code>name</code>
- attribute may include a logical unit number, separated from the
- target's name by a slash (e.g.,
+ "iscsi", "rbd", "sheepdog",
"gluster" or "vxhs".
+
+ <p>If the <code>protocol</code> attribute is
"rbd", "sheepdog",
+ "gluster", or "vxhs", an additional attribute
<code>name</code>
+ is mandatory to specify which volume/image will be used.
+ </p>
+
+ <p>For "nbd", the <code>name</code> attribute
is optional.
+ </p>
+
+ <p>For "iscsi" (<span class="since">since
1.0.4</span>), the
+ <code>name</code> attribute may include a logical unit number,
+ separated from the target's name by a slash (e.g.,
<code>iqn.2013-07.com.example:iscsi-pool/1</code>). If not
specified, the default LUN is zero.
- For "vxhs" (<span class="since">since
3.8.0</span>), the
+ </p>
+
+ <p>For "vxhs" (<span class="since">since
3.8.0</span>), the
<code>name</code> is the UUID of the volume, assigned by the
- HyperScale server.
+ HyperScale server. Additionally, an optional attribute
+ <code>tls</code> (QEMU only) can be used to control whether a
+ VxHS block device would utilize a hypervisor configured TLS
+ X.509 certificate environment in order to encrypt the data
+ channel. For the QEMU hypervisor, usage of a TLS environment can
+ also be globally controlled on the host by the
+ <code>vxhs_tls</code> and
<code>vxhs_tls_x509_cert_dir</code> or
+ <code>default_tls_x509_cert_dir</code> settings in the file
+ /etc/libvirt/qemu.conf. If <code>vxhs_tls</code> is enabled,
+ then unless the domain <code>tls</code> attribute is set to
"no",
+ libvirt will use the host configured TLS environment. If the
+ <code>tls</code> attribute is set to "yes", then
regardless of
+ the qemu.conf setting, TLS authentication will be attempted.
+ </p>
<span class="since">Since 0.8.7</span>
</dd>
<dt><code>volume</code></dt>
diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index 76852abb3..bac371ea3 100644
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -1644,6 +1644,11 @@
</choice>
</attribute>
<attribute name="name"/>
+ <optional>
+ <attribute name="tls">
+ <ref name="virYesNo"/>
+ </attribute>
+ </optional>
<ref name="diskSourceNetworkHost"/>
</element>
</define>
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index a43b25c31..3684454e8 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -8114,6 +8114,7 @@ virDomainDiskSourceParse(xmlNodePtr node,
int ret = -1;
char *protocol = NULL;
xmlNodePtr saveNode = ctxt->node;
+ char *haveTLS = NULL;
ctxt->node = node;
@@ -8147,6 +8148,19 @@ virDomainDiskSourceParse(xmlNodePtr node,
goto cleanup;
}
+ /* Check tls=yes|no domain setting for the block device
+ * At present only VxHS. Other block devices may be added later */
+ if (src->protocol == VIR_STORAGE_NET_PROTOCOL_VXHS &&
+ (haveTLS = virXMLPropString(node, "tls"))) {
+ if ((src->haveTLS =
+ virTristateBoolTypeFromString(haveTLS)) <= 0) {
+ virReportError(VIR_ERR_XML_ERROR,
+ _("unknown disk source 'tls' setting
'%s'"),
+ haveTLS);
+ goto cleanup;
+ }
+ }
+
/* for historical reasons the volume name for gluster volume is stored
* as a part of the path. This is hard to work with when dealing with
* relative names. Split out the volume into a separate variable */
@@ -8202,6 +8216,7 @@ virDomainDiskSourceParse(xmlNodePtr node,
cleanup:
VIR_FREE(protocol);
+ VIR_FREE(haveTLS);
ctxt->node = saveNode;
return ret;
}
@@ -21669,7 +21684,8 @@ virDomainSourceDefFormatSeclabel(virBufferPtr buf,
static int
virDomainDiskSourceFormatNetwork(virBufferPtr buf,
- virStorageSourcePtr src)
+ virStorageSourcePtr src,
+ unsigned int flags)
{
size_t n;
char *path = NULL;
@@ -21686,6 +21702,14 @@ virDomainDiskSourceFormatNetwork(virBufferPtr buf,
VIR_FREE(path);
+ if (src->haveTLS != VIR_TRISTATE_BOOL_ABSENT &&
+ !(flags & VIR_DOMAIN_DEF_FORMAT_MIGRATABLE &&
+ src->tlsFromConfig))
+ virBufferAsprintf(buf, " tls='%s'",
+ virTristateBoolTypeToString(src->haveTLS));
+ if (flags & VIR_DOMAIN_DEF_FORMAT_STATUS)
+ virBufferAsprintf(buf, " tlsFromConfig='%d'",
src->tlsFromConfig);
+
if (src->nhosts == 0 && !src->snapshot && !src->configFile)
{
virBufferAddLit(buf, "/>\n");
} else {
@@ -21760,7 +21784,7 @@ virDomainDiskSourceFormatInternal(virBufferPtr buf,
break;
case VIR_STORAGE_TYPE_NETWORK:
- if (virDomainDiskSourceFormatNetwork(buf, src) < 0)
+ if (virDomainDiskSourceFormatNetwork(buf, src, flags) < 0)
goto error;
break;
diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c
index ba2045369..35f468e35 100644
--- a/src/util/virstoragefile.c
+++ b/src/util/virstoragefile.c
@@ -2039,6 +2039,8 @@ virStorageSourceCopy(const virStorageSource *src,
ret->physical = src->physical;
ret->readonly = src->readonly;
ret->shared = src->shared;
+ ret->haveTLS = src->haveTLS;
+ ret->tlsFromConfig = src->tlsFromConfig;
/* storage driver metadata are not copied */
ret->drv = NULL;
diff --git a/src/util/virstoragefile.h b/src/util/virstoragefile.h
index f7e897f25..4817090fc 100644
--- a/src/util/virstoragefile.h
+++ b/src/util/virstoragefile.h
@@ -281,6 +281,13 @@ struct _virStorageSource {
/* metadata that allows identifying given storage source */
char *nodeformat; /* name of the format handler object */
char *nodestorage; /* name of the storage object */
+
+ /* An optional setting to enable usage of TLS for the storage source */
+ int haveTLS; /* enum virTristateBool */
+
+ /* Indication whether the haveTLS value was altered due to qemu.conf
+ * setting when haveTLS is missing from the domain config file */
+ bool tlsFromConfig;
};
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
new file mode 100644
index 000000000..61b5e2e79
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
@@ -0,0 +1,32 @@
+<domain type='qemu'>
+ <name>QEMUGuest1</name>
+ <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+ <memory unit='KiB'>219136</memory>
+ <currentMemory unit='KiB'>219136</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='i686' machine='pc'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>destroy</on_crash>
+ <devices>
+ <emulator>/usr/bin/qemu-system-x86_64</emulator>
+ <disk type='network' device='disk'>
+ <driver name='qemu' type='raw' cache='none'/>
+ <source protocol='vxhs'
name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
+ <host name='192.168.0.1' port='9999'/>
+ </source>
+ <target dev='vda' bus='virtio'/>
+ <serial>eb90327c-8302-4725-9e1b-4e85ed4dc251</serial>
+ <address type='pci' domain='0x0000' bus='0x00'
slot='0x04' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'/>
+ <controller type='pci' index='0' model='pci-root'/>
+ <input type='mouse' bus='ps2'/>
+ <input type='keyboard' bus='ps2'/>
+ <memballoon model='none'/>
+ </devices>
+</domain>
diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
b/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
new file mode 100644
index 000000000..16f0883e0
--- /dev/null
+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
@@ -0,0 +1,34 @@
+<domain type='qemu'>
+ <name>QEMUGuest1</name>
+ <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+ <memory unit='KiB'>219136</memory>
+ <currentMemory unit='KiB'>219136</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='i686' machine='pc'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>destroy</on_crash>
+ <devices>
+ <emulator>/usr/bin/qemu-system-x86_64</emulator>
+ <disk type='network' device='disk'>
+ <driver name='qemu' type='raw' cache='none'/>
+ <source protocol='vxhs'
name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
+ <host name='192.168.0.1' port='9999'/>
+ </source>
+ <target dev='vda' bus='virtio'/>
+ <serial>eb90327c-8302-4725-9e1b-4e85ed4dc251</serial>
+ <address type='pci' domain='0x0000' bus='0x00'
slot='0x04' function='0x0'/>
+ </disk>
+ <controller type='usb' index='0'>
+ <address type='pci' domain='0x0000' bus='0x00'
slot='0x01' function='0x2'/>
+ </controller>
+ <controller type='pci' index='0' model='pci-root'/>
+ <input type='mouse' bus='ps2'/>
+ <input type='keyboard' bus='ps2'/>
+ <memballoon model='none'/>
+ </devices>
+</domain>
diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c
index 8b7577fd3..f005163c4 100644
--- a/tests/qemuxml2xmltest.c
+++ b/tests/qemuxml2xmltest.c
@@ -475,6 +475,7 @@ mymain(void)
DO_TEST("disk-drive-network-rbd-ceph-env", NONE);
DO_TEST("disk-drive-network-sheepdog", NONE);
DO_TEST("disk-drive-network-vxhs", NONE);
+ DO_TEST("disk-drive-network-tlsx509-vxhs", NONE);
DO_TEST("disk-scsi-device",
QEMU_CAPS_NODEFCONFIG, QEMU_CAPS_SCSI_LSI);
DO_TEST("disk-scsi-vscsi", NONE);
--
2.13.5