4:48 p.m.
Some more cleanups for misplaced validation of config that I've noticed
when I was looking for the code validating floppies in my previous
series.
Peter Krempa (9):
qemuDomainValidateStorageSource: Rework protocol validation into a
switch statement
qemu: Move disk backend validation checks from
qemuProcessStartValidateDisks to qemuDomainValidateStorageSource
qemu: block: Drop code for 'vxhs' storage protocol
qemu.conf: Document options for VxHS block network protocol TLS config
as ignored
qemu: conf: Drop handling of 'vxhs' config options
qemu: Move logic from qemuProcessStartValidateShmem to
qemuValidateDomainDeviceDefShmem
qemu: Move checks for number of listening sockets of graphics to
validation code
qemuProcessStartValidateGraphics: Remove redundant checks for RDP
protocol features
qemuProcessStartValidateGraphics: Move RDP validation logic to
qemu_validate.c
src/qemu/libvirtd_qemu.aug | 2 +
src/qemu/qemu.conf.in | 42 +-----------
src/qemu/qemu_block.c | 41 +-----------
src/qemu/qemu_conf.c | 17 -----
src/qemu/qemu_conf.h | 4 --
src/qemu/qemu_domain.c | 112 +++++++++++++++----------------
src/qemu/qemu_process.c | 132 -------------------------------------
src/qemu/qemu_validate.c | 45 ++++++++++++-
tests/qemuxmlconftest.c | 4 --
tests/testutilsqemu.c | 2 -
10 files changed, 101 insertions(+), 300 deletions(-)
--
2.49.0
4:48 p.m.
New subject: [PATCH 1/9] qemuDomainValidateStorageSource: Rework protocol validation into a switch statement
From: Peter Krempa <pkrempa(a)redhat.com>
Move the validation of TFTP and NFS into a new switch statement which
will be used for validating also other protocol config in the future.
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/qemu_domain.c | 68 +++++++++++++++++++++++++++---------------
1 file changed, 44 insertions(+), 24 deletions(-)
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index cc3ab0a298..11f08b8ded 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -4525,34 +4525,54 @@ qemuDomainValidateStorageSource(virStorageSource *src,
return -1;
}
- /* TFTP protocol is not supported since QEMU 2.8.0 */
- if (actualType == VIR_STORAGE_TYPE_NETWORK &&
- src->protocol == VIR_STORAGE_NET_PROTOCOL_TFTP) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("'tftp' protocol is not supported with this QEMU
binary"));
- return -1;
- }
+ if (actualType == VIR_STORAGE_TYPE_NETWORK) {
+ switch ((virStorageNetProtocol) src->protocol) {
+ case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
+ case VIR_STORAGE_NET_PROTOCOL_VXHS:
+ case VIR_STORAGE_NET_PROTOCOL_HTTP:
+ case VIR_STORAGE_NET_PROTOCOL_HTTPS:
+ case VIR_STORAGE_NET_PROTOCOL_FTP:
+ case VIR_STORAGE_NET_PROTOCOL_FTPS:
+ case VIR_STORAGE_NET_PROTOCOL_ISCSI:
+ case VIR_STORAGE_NET_PROTOCOL_NBD:
+ case VIR_STORAGE_NET_PROTOCOL_RBD:
+ case VIR_STORAGE_NET_PROTOCOL_SSH:
+ case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
+ break;
- if (actualType == VIR_STORAGE_TYPE_NETWORK &&
- src->protocol == VIR_STORAGE_NET_PROTOCOL_NFS) {
- /* NFS protocol must have exactly one host */
- if (src->nhosts != 1) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("'nfs' protocol requires the usage of exactly
one host"));
- return -1;
- }
+ case VIR_STORAGE_NET_PROTOCOL_NFS:
+ /* NFS protocol must have exactly one host */
+ if (src->nhosts != 1) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("'nfs' protocol requires the usage of
exactly one host"));
+ return -1;
+ }
- /* NFS can only use a TCP protocol */
- if (src->hosts[0].transport != VIR_STORAGE_NET_HOST_TRANS_TCP) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("'nfs' host must use TCP protocol"));
+ /* NFS can only use a TCP protocol */
+ if (src->hosts[0].transport != VIR_STORAGE_NET_HOST_TRANS_TCP) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("'nfs' host must use TCP protocol"));
+ return -1;
+ }
+
+ /* NFS host cannot have a port */
+ if (src->hosts[0].port != 0) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("port cannot be specified in 'nfs' protocol
host"));
+ return -1;
+ }
+ break;
+
+ /* TFTP protocol is not supported since QEMU 2.8.0 */
+ case VIR_STORAGE_NET_PROTOCOL_TFTP:
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("storage protocol '%1$s' is not supported by
this QEMU"),
+ virStorageNetProtocolTypeToString(src->protocol));
return -1;
- }
- /* NFS host cannot have a port */
- if (src->hosts[0].port != 0) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("port cannot be specified in 'nfs' protocol
host"));
+ case VIR_STORAGE_NET_PROTOCOL_NONE:
+ case VIR_STORAGE_NET_PROTOCOL_LAST:
+ virReportEnumRangeError(virStorageNetProtocol, src->protocol);
return -1;
}
}
--
2.49.0
4:48 p.m.
New subject: [PATCH 2/9] qemu: Move disk backend validation checks from qemuProcessStartValidateDisks to qemuDomainValidateStorageSource
From: Peter Krempa <pkrempa(a)redhat.com>
Move the check forbidding VXHS disks and checking the NVME backend
capability to the validation code.
Remove the now unused qemuProcessStartValidateDisks.
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/qemu_domain.c | 9 ++++++++-
src/qemu/qemu_process.c | 35 -----------------------------------
2 files changed, 8 insertions(+), 36 deletions(-)
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 11f08b8ded..230dc86038 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -4453,6 +4453,13 @@ qemuDomainValidateStorageSource(virStorageSource *src,
}
}
+ if (actualType == VIR_STORAGE_TYPE_NVME &&
+ !virQEMUCapsGet(qemuCaps, QEMU_CAPS_DRIVE_NVME)) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("NVMe disks are not supported with this QEMU
binary"));
+ return -1;
+ }
+
if (src->pr &&
!virQEMUCapsGet(qemuCaps, QEMU_CAPS_PR_MANAGER_HELPER)) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
@@ -4528,7 +4535,6 @@ qemuDomainValidateStorageSource(virStorageSource *src,
if (actualType == VIR_STORAGE_TYPE_NETWORK) {
switch ((virStorageNetProtocol) src->protocol) {
case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
- case VIR_STORAGE_NET_PROTOCOL_VXHS:
case VIR_STORAGE_NET_PROTOCOL_HTTP:
case VIR_STORAGE_NET_PROTOCOL_HTTPS:
case VIR_STORAGE_NET_PROTOCOL_FTP:
@@ -4564,6 +4570,7 @@ qemuDomainValidateStorageSource(virStorageSource *src,
break;
/* TFTP protocol is not supported since QEMU 2.8.0 */
+ case VIR_STORAGE_NET_PROTOCOL_VXHS:
case VIR_STORAGE_NET_PROTOCOL_TFTP:
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
_("storage protocol '%1$s' is not supported by
this QEMU"),
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index 54b84922d6..c13a284473 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -5600,38 +5600,6 @@ qemuProcessStartValidateShmem(virDomainObj *vm)
}
-static int
-qemuProcessStartValidateDisks(virDomainObj *vm,
- virQEMUCaps *qemuCaps)
-{
- size_t i;
-
- for (i = 0; i < vm->def->ndisks; i++) {
- virDomainDiskDef *disk = vm->def->disks[i];
- virStorageSource *src = disk->src;
-
- /* This is a best effort check as we can only check if the command
- * option exists, but we cannot determine whether the running QEMU
- * was build with '--enable-vxhs'. */
- if (src->type == VIR_STORAGE_TYPE_NETWORK &&
- src->protocol == VIR_STORAGE_NET_PROTOCOL_VXHS) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("VxHS protocol is not supported with this QEMU
binary"));
- return -1;
- }
-
- if (src->type == VIR_STORAGE_TYPE_NVME &&
- !virQEMUCapsGet(qemuCaps, QEMU_CAPS_DRIVE_NVME)) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("NVMe disks are not supported with this QEMU
binary"));
- return -1;
- }
- }
-
- return 0;
-}
-
-
/* 250 parts per million (ppm) is a half of NTP threshold */
#define TSC_TOLERANCE 250
@@ -5768,9 +5736,6 @@ qemuProcessStartValidate(virQEMUDriver *driver,
}
}
- if (qemuProcessStartValidateDisks(vm, qemuCaps) < 0)
- return -1;
-
if (qemuProcessStartValidateTSC(driver, vm) < 0)
return -1;
--
2.49.0
4:48 p.m.
New subject: [PATCH 3/9] qemu: block: Drop code for 'vxhs' storage protocol
From: Peter Krempa <pkrempa(a)redhat.com>
qemu-5.2 dropped support for the 'vxhs' protocol. We require qemu-5.2
since commit ce48d584cc4 and thus the block code for vxhs is now dead.
Remove it.
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/qemu_block.c | 41 +----------------------------------------
src/qemu/qemu_domain.c | 37 +------------------------------------
2 files changed, 2 insertions(+), 76 deletions(-)
diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c
index b1f50b6c67..32568d4ae6 100644
--- a/src/qemu/qemu_block.c
+++ b/src/qemu/qemu_block.c
@@ -426,41 +426,6 @@ qemuBlockStorageSourceGetGlusterProps(virStorageSource *src,
}
-static virJSONValue *
-qemuBlockStorageSourceGetVxHSProps(virStorageSource *src,
- bool onlytarget)
-{
- g_autoptr(virJSONValue) server = NULL;
- const char *tlsAlias = src->tlsAlias;
- virJSONValue *ret = NULL;
-
- if (src->nhosts != 1) {
- virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
- _("VxHS protocol accepts only one host"));
- return NULL;
- }
-
- if (!(server =
qemuBlockStorageSourceBuildJSONInetSocketAddress(&src->hosts[0])))
- return NULL;
-
- if (onlytarget)
- tlsAlias = NULL;
-
- /* VxHS disk specification example:
- * { driver:"vxhs",
- * tls-creds:"objvirtio-disk0_tls0",
- * vdisk-id:"eb90327c-8302-4725-4e85ed4dc251",
- * server:{type:"tcp", host:"1.2.3.4", port:9999}}
- */
- ignore_value(virJSONValueObjectAdd(&ret,
- "S:tls-creds", tlsAlias,
- "s:vdisk-id", src->path,
- "a:server", &server, NULL));
-
- return ret;
-}
-
-
static virJSONValue *
qemuBlockStorageSourceGetNFSProps(virStorageSource *src)
{
@@ -1088,11 +1053,6 @@ qemuBlockStorageSourceGetBackendProps(virStorageSource *src,
return NULL;
break;
- case VIR_STORAGE_NET_PROTOCOL_VXHS:
- driver = "vxhs";
- if (!(fileprops = qemuBlockStorageSourceGetVxHSProps(src, onlytarget)))
- return NULL;
- break;
case VIR_STORAGE_NET_PROTOCOL_HTTP:
case VIR_STORAGE_NET_PROTOCOL_HTTPS:
@@ -1134,6 +1094,7 @@ qemuBlockStorageSourceGetBackendProps(virStorageSource *src,
return NULL;
break;
+ case VIR_STORAGE_NET_PROTOCOL_VXHS:
case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
_("unsupported disk protocol"));
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 230dc86038..ace42b516a 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -8798,40 +8798,6 @@ qemuDomainPrepareChardevSourceOne(virDomainDeviceDef *dev,
}
-static int
-qemuProcessPrepareStorageSourceTLSVxhs(virStorageSource *src,
- virQEMUDriverConfig *cfg,
- qemuDomainObjPrivate *priv,
- const char *parentAlias)
-{
- /* VxHS uses only client certificates and thus has no need for
- * the server-key.pem nor a secret that could be used to decrypt
- * the it, so no need to add a secinfo for a secret UUID. */
- if (src->haveTLS == VIR_TRISTATE_BOOL_ABSENT) {
- if (cfg->vxhsTLS)
- src->haveTLS = VIR_TRISTATE_BOOL_YES;
- else
- src->haveTLS = VIR_TRISTATE_BOOL_NO;
- src->tlsFromConfig = true;
- }
-
- if (src->haveTLS == VIR_TRISTATE_BOOL_YES) {
- src->tlsAlias = qemuAliasTLSObjFromSrcAlias(parentAlias);
- src->tlsCertdir = g_strdup(cfg->vxhsTLSx509certdir);
-
- if (cfg->vxhsTLSx509secretUUID) {
- qemuDomainStorageSourcePrivate *srcpriv =
qemuDomainStorageSourcePrivateFetch(src);
-
- if (!(srcpriv->tlsKeySecret = qemuDomainSecretInfoTLSNew(priv,
src->tlsAlias,
-
cfg->vxhsTLSx509secretUUID)))
- return -1;
- }
- }
-
- return 0;
-}
-
-
static int
qemuProcessPrepareStorageSourceTLSNBD(virStorageSource *src,
virQEMUDriverConfig *cfg,
@@ -8958,8 +8924,7 @@ qemuDomainPrepareStorageSourceTLS(virStorageSource *src,
switch ((virStorageNetProtocol) src->protocol) {
case VIR_STORAGE_NET_PROTOCOL_VXHS:
- if (qemuProcessPrepareStorageSourceTLSVxhs(src, cfg, priv, parentAlias) < 0)
- return -1;
+ /* vxhs is no longer supported */
break;
case VIR_STORAGE_NET_PROTOCOL_NBD:
--
2.49.0
4:49 p.m.
New subject: [PATCH 4/9] qemu.conf: Document options for VxHS block network protocol TLS config as ignored
From: Peter Krempa <pkrempa(a)redhat.com>
qemu-5.2 dropped support for VxHS. As we now require at least qemu-6.2,
the qemu.conf option for setting up TLS for VxHS are no longer used.
Document them as such.
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/libvirtd_qemu.aug | 2 ++
src/qemu/qemu.conf.in | 42 +++-----------------------------------
2 files changed, 5 insertions(+), 39 deletions(-)
diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug
index bd744940d2..e1e479d72c 100644
--- a/src/qemu/libvirtd_qemu.aug
+++ b/src/qemu/libvirtd_qemu.aug
@@ -69,6 +69,8 @@ module Libvirtd_qemu =
| bool_entry "backup_tls_x509_verify"
| str_entry "backup_tls_x509_secret_uuid"
+ (* support for vxhs was removed from qemu and the examples were dopped from *)
+ (* qemu.conf but these need to stay *)
let vxhs_entry = bool_entry "vxhs_tls"
| str_entry "vxhs_tls_x509_cert_dir"
| str_entry "vxhs_tls_x509_secret_uuid"
diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in
index 502adbf5c3..042bb75b50 100644
--- a/src/qemu/qemu.conf.in
+++ b/src/qemu/qemu.conf.in
@@ -299,48 +299,12 @@
#chardev_tls_x509_secret_uuid = "00000000-0000-0000-0000-000000000000"
-# Enable use of TLS encryption for all VxHS network block devices that
-# don't specifically disable.
-#
-# When the VxHS network block device server is set up appropriately,
-# x509 certificates are required for authentication between the clients
-# (qemu processes) and the remote VxHS server.
-#
-# It is necessary to setup CA and issue the client certificate before
-# enabling this.
+# The support for VxHS network block protocol was removed in qemu-5.2 and
+# thus also dropped from libvirt's qemu driver. The following options which
+# were used to configure the TLS certificates for VxHS are thus ignored.
#
#vxhs_tls = 1
-
-
-# In order to override the default TLS certificate location for VxHS
-# backed storage, supply a valid path to the certificate directory.
-# This is used to authenticate the VxHS block device clients to the VxHS
-# server.
-#
-# If the provided path does not exist, libvirtd will fail to start.
-# If the path is not provided, but vxhs_tls = 1, then the
-# default_tls_x509_cert_dir path will be used.
-#
-# VxHS block device clients expect the client certificate and key to be
-# present in the certificate directory along with the CA master certificate.
-# If using the default environment, default_tls_x509_verify must be configured.
-# Since this is only a client the server-key.pem certificate is not needed.
-# Thus a VxHS directory must contain the following:
-#
-# ca-cert.pem - the CA master certificate
-# client-cert.pem - the client certificate signed with the ca-cert.pem
-# client-key.pem - the client private key
-#
#vxhs_tls_x509_cert_dir = "/etc/pki/libvirt-vxhs"
-
-
-# Uncomment and use the following option to override the default secret
-# UUID provided in the default_tls_x509_secret_uuid parameter.
-#
-# NB This default all-zeros UUID will not work. Replace it with the
-# output from the UUID for the TLS secret from a 'virsh secret-list'
-# command and then uncomment the entry
-#
#vxhs_tls_x509_secret_uuid = "00000000-0000-0000-0000-000000000000"
--
2.49.0
4:49 p.m.
New subject: [PATCH 5/9] qemu: conf: Drop handling of 'vxhs' config options
From: Peter Krempa <pkrempa(a)redhat.com>
Remove the config file handling for the config options we no longer use.
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/qemu_conf.c | 17 -----------------
src/qemu/qemu_conf.h | 4 ----
tests/qemuxmlconftest.c | 4 ----
tests/testutilsqemu.c | 2 --
4 files changed, 27 deletions(-)
diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
index 8ffbcacaf2..9bf12fc179 100644
--- a/src/qemu/qemu_conf.c
+++ b/src/qemu/qemu_conf.c
@@ -385,9 +385,6 @@ static void virQEMUDriverConfigDispose(void *obj)
g_free(cfg->chardevTLSx509certdir);
g_free(cfg->chardevTLSx509secretUUID);
- g_free(cfg->vxhsTLSx509certdir);
- g_free(cfg->vxhsTLSx509secretUUID);
-
g_free(cfg->nbdTLSx509certdir);
g_free(cfg->nbdTLSx509secretUUID);
@@ -553,8 +550,6 @@ virQEMUDriverConfigLoadSpecificTLSEntry(virQEMUDriverConfig *cfg,
{
int rv;
- if (virConfGetValueBool(conf, "vxhs_tls", &cfg->vxhsTLS) < 0)
- return -1;
if (virConfGetValueBool(conf, "nbd_tls", &cfg->nbdTLS) < 0)
return -1;
if (virConfGetValueBool(conf, "chardev_tls", &cfg->chardevTLS) <
0)
@@ -591,8 +586,6 @@ virQEMUDriverConfigLoadSpecificTLSEntry(virQEMUDriverConfig *cfg,
GET_CONFIG_TLS_CERTINFO_COMMON(backup);
GET_CONFIG_TLS_CERTINFO_SERVER(backup);
- GET_CONFIG_TLS_CERTINFO_COMMON(vxhs);
-
GET_CONFIG_TLS_CERTINFO_COMMON(nbd);
#undef GET_CONFIG_TLS_CERTINFO_COMMON
@@ -1416,14 +1409,6 @@ virQEMUDriverConfigValidate(virQEMUDriverConfig *cfg)
return -1;
}
- if (cfg->vxhsTLSx509certdir &&
- !virFileExists(cfg->vxhsTLSx509certdir)) {
- virReportError(VIR_ERR_CONF_SYNTAX,
- _("vxhs_tls_x509_cert_dir directory '%1$s' does not
exist"),
- cfg->vxhsTLSx509certdir);
- return -1;
- }
-
if (cfg->nbdTLSx509certdir &&
!virFileExists(cfg->nbdTLSx509certdir)) {
virReportError(VIR_ERR_CONF_SYNTAX,
@@ -1452,7 +1437,6 @@ virQEMUDriverConfigSetDefaults(virQEMUDriverConfig *cfg)
SET_TLS_SECRET_UUID_DEFAULT(chardev);
SET_TLS_SECRET_UUID_DEFAULT(migrate);
SET_TLS_SECRET_UUID_DEFAULT(backup);
- SET_TLS_SECRET_UUID_DEFAULT(vxhs);
SET_TLS_SECRET_UUID_DEFAULT(nbd);
#undef SET_TLS_SECRET_UUID_DEFAULT
@@ -1481,7 +1465,6 @@ virQEMUDriverConfigSetDefaults(virQEMUDriverConfig *cfg)
SET_TLS_X509_CERT_DEFAULT(chardev);
SET_TLS_X509_CERT_DEFAULT(migrate);
SET_TLS_X509_CERT_DEFAULT(backup);
- SET_TLS_X509_CERT_DEFAULT(vxhs);
SET_TLS_X509_CERT_DEFAULT(nbd);
#undef SET_TLS_X509_CERT_DEFAULT
diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h
index f6b13c828d..1ce9dbe4a8 100644
--- a/src/qemu/qemu_conf.h
+++ b/src/qemu/qemu_conf.h
@@ -159,10 +159,6 @@ struct _virQEMUDriverConfig {
bool backupTLSx509verifyPresent;
char *backupTLSx509secretUUID;
- bool vxhsTLS;
- char *vxhsTLSx509certdir;
- char *vxhsTLSx509secretUUID;
-
bool nbdTLS;
char *nbdTLSx509certdir;
char *nbdTLSx509secretUUID;
diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c
index 9a29262d1b..0f1c935267 100644
--- a/tests/qemuxmlconftest.c
+++ b/tests/qemuxmlconftest.c
@@ -1593,16 +1593,12 @@ mymain(void)
DO_TEST_CAPS_LATEST("disk-network-source-auth");
DO_TEST_CAPS_LATEST("disk-network-source-curl");
DO_TEST_CAPS_LATEST("disk-network-nfs");
- driver.config->vxhsTLS = 1;
driver.config->nbdTLSx509secretUUID =
g_strdup("6fd3f62d-9fe7-4a4e-a869-7acd6376d8ea");
- driver.config->vxhsTLSx509secretUUID =
g_strdup("6fd3f62d-9fe7-4a4e-a869-7acd6376d8ea");
DO_TEST_CAPS_LATEST("disk-network-tlsx509-nbd");
DO_TEST_CAPS_VER_PARSE_ERROR("disk-network-tlsx509-nbd-hostname",
"6.2.0");
DO_TEST_CAPS_LATEST("disk-network-tlsx509-nbd-hostname");
DO_TEST_CAPS_LATEST("disk-network-http");
VIR_FREE(driver.config->nbdTLSx509secretUUID);
- VIR_FREE(driver.config->vxhsTLSx509secretUUID);
- driver.config->vxhsTLS = 0;
DO_TEST_CAPS_LATEST("disk-network-ssh");
DO_TEST_CAPS_LATEST("disk-no-boot");
DO_TEST_CAPS_LATEST("disk-nvme");
diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c
index 9038a37869..78ec521266 100644
--- a/tests/testutilsqemu.c
+++ b/tests/testutilsqemu.c
@@ -396,8 +396,6 @@ int qemuTestDriverInit(virQEMUDriver *driver)
cfg->rdpTLSx509certdir = g_strdup("/etc/pki/libvirt-rdp");
VIR_FREE(cfg->chardevTLSx509certdir);
cfg->chardevTLSx509certdir = g_strdup("/etc/pki/libvirt-chardev");
- VIR_FREE(cfg->vxhsTLSx509certdir);
- cfg->vxhsTLSx509certdir = g_strdup("/etc/pki/libvirt-vxhs");
VIR_FREE(cfg->nbdTLSx509certdir);
cfg->nbdTLSx509certdir = g_strdup("/etc/pki/libvirt-nbd");
VIR_FREE(cfg->migrateTLSx509certdir);
--
2.49.0
4:49 p.m.
New subject: [PATCH 6/9] qemu: Move logic from qemuProcessStartValidateShmem to qemuValidateDomainDeviceDefShmem
From: Peter Krempa <pkrempa(a)redhat.com>
Move the check to the appropriate central place.
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/qemu_process.c | 23 -----------------------
src/qemu/qemu_validate.c | 7 +++++++
2 files changed, 7 insertions(+), 23 deletions(-)
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index c13a284473..9fbb03ee8b 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -5580,26 +5580,6 @@ qemuProcessStartValidateGraphics(virDomainObj *vm)
}
-static int
-qemuProcessStartValidateShmem(virDomainObj *vm)
-{
- size_t i;
-
- for (i = 0; i < vm->def->nshmems; i++) {
- virDomainShmemDef *shmem = vm->def->shmems[i];
-
- if (strchr(shmem->name, '/')) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
- _("shmem name '%1$s' must not contain
'/'"),
- shmem->name);
- return -1;
- }
- }
-
- return 0;
-}
-
-
/* 250 parts per million (ppm) is a half of NTP threshold */
#define TSC_TOLERANCE 250
@@ -5707,9 +5687,6 @@ qemuProcessStartValidate(virQEMUDriver *driver,
if (qemuProcessStartValidateGraphics(vm) < 0)
return -1;
- if (qemuProcessStartValidateShmem(vm) < 0)
- return -1;
-
if (vm->def->cpu) {
if (virCPUValidateFeatures(vm->def->os.arch, vm->def->cpu) < 0)
return -1;
diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
index e45f636418..0e7dd3fc58 100644
--- a/src/qemu/qemu_validate.c
+++ b/src/qemu/qemu_validate.c
@@ -5472,6 +5472,13 @@ static int
qemuValidateDomainDeviceDefShmem(virDomainShmemDef *shmem,
virQEMUCaps *qemuCaps)
{
+ if (strchr(shmem->name, '/')) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("shmem name '%1$s' must not contain
'/'"),
+ shmem->name);
+ return -1;
+ }
+
if (shmem->size > 0) {
if (shmem->size < 1024 * 1024 ||
!VIR_IS_POW2(shmem->size)) {
--
2.49.0
4:49 p.m.
New subject: [PATCH 7/9] qemu: Move checks for number of listening sockets of graphics to validation code
From: Peter Krempa <pkrempa(a)redhat.com>
Move the checks from 'qemuProcessStartValidateGraphics' to the
correspodning graphics validation functions in qemu_validate.c:
- qemuValidateDomainDeviceDefSPICEGraphics
- qemuValidateDomainDeviceDefVNCGraphics
- qemuValidateDomainDeviceDefRDPGraphics
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/qemu_process.c | 10 ----------
src/qemu/qemu_validate.c | 18 ++++++++++++++++++
2 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index 9fbb03ee8b..b99602c5ed 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -5537,19 +5537,9 @@ qemuProcessStartValidateGraphics(virDomainObj *vm)
switch (graphics->type) {
case VIR_DOMAIN_GRAPHICS_TYPE_VNC:
case VIR_DOMAIN_GRAPHICS_TYPE_SPICE:
- if (graphics->nListens > 1) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("QEMU does not support multiple listens for one
graphics device."));
- return -1;
- }
break;
case VIR_DOMAIN_GRAPHICS_TYPE_RDP:
- if (graphics->nListens > 1) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("qemu-rdp does not support multiple listens for one
graphics device."));
- return -1;
- }
if (graphics->data.rdp.multiUser) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("qemu-rdp doesn't support the
'multiUser' attribute."));
diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
index 0e7dd3fc58..1aa54bf59f 100644
--- a/src/qemu/qemu_validate.c
+++ b/src/qemu/qemu_validate.c
@@ -4425,6 +4425,12 @@ qemuValidateDomainDeviceDefSPICEGraphics(const virDomainGraphicsDef
*graphics,
virDomainGraphicsListenDef *glisten = NULL;
int tlsPort = graphics->data.spice.tlsPort;
+ if (graphics->nListens > 1) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("QEMU does not support multiple listens for one graphics
device."));
+ return -1;
+ }
+
glisten = virDomainGraphicsGetListen((virDomainGraphicsDef *)graphics, 0);
if (!glisten) {
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
@@ -4472,6 +4478,12 @@ static int
qemuValidateDomainDeviceDefVNCGraphics(const virDomainGraphicsDef *graphics,
virQEMUCaps *qemuCaps)
{
+ if (graphics->nListens > 1) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("QEMU does not support multiple listens for one graphics
device."));
+ return -1;
+ }
+
if (graphics->data.vnc.powerControl != VIR_TRISTATE_BOOL_ABSENT &&
!virQEMUCapsGet(qemuCaps, QEMU_CAPS_VNC_POWER_CONTROL)) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
@@ -4512,6 +4524,12 @@ qemuValidateDomainDeviceDefDBusGraphics(const virDomainGraphicsDef
*graphics,
static int
qemuValidateDomainDeviceDefRDPGraphics(const virDomainGraphicsDef *graphics)
{
+ if (graphics->nListens > 1) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("qemu-rdp does not support multiple listens for one
graphics device."));
+ return -1;
+ }
+
if (graphics->data.rdp.replaceUser) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("RDP doesn't support 'replaceUser'"));
--
2.49.0
4:49 p.m.
New subject: [PATCH 8/9] qemuProcessStartValidateGraphics: Remove redundant checks for RDP protocol features
From: Peter Krempa <pkrempa(a)redhat.com>
Both the 'replaceUser' and 'multiUser' field are already validated in
qemuValidateDomainDeviceDefRDPGraphics.
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/qemu_process.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index b99602c5ed..920adef7df 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -5540,16 +5540,6 @@ qemuProcessStartValidateGraphics(virDomainObj *vm)
break;
case VIR_DOMAIN_GRAPHICS_TYPE_RDP:
- if (graphics->data.rdp.multiUser) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("qemu-rdp doesn't support the
'multiUser' attribute."));
- return -1;
- }
- if (graphics->data.rdp.replaceUser) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("qemu-rdp doesn't support the
'replaceUser' attribute."));
- return -1;
- }
if (!virDomainDefHasDBus(vm->def, false)) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("qemu-rdp support requires a D-Bus bus graphics
device."));
--
2.49.0
4:49 p.m.
New subject: [PATCH 9/9] qemuProcessStartValidateGraphics: Move RDP validation logic to qemu_validate.c
From: Peter Krempa <pkrempa(a)redhat.com>
Move the rest of the RDP graphics validation code to
qemuValidateDomainDeviceDefRDPGraphics together with the rest of the
validation.
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/qemu_process.c | 54 ----------------------------------------
src/qemu/qemu_validate.c | 20 +++++++++++++--
2 files changed, 18 insertions(+), 56 deletions(-)
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index 920adef7df..82cab3f76e 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -5509,57 +5509,6 @@ qemuProcessMakeDir(virQEMUDriver *driver,
}
-static bool
-virDomainDefHasDBus(const virDomainDef *def, bool p2p)
-{
- size_t i = 0;
-
- for (i = 0; i < def->ngraphics; i++) {
- virDomainGraphicsDef *graphics = def->graphics[i];
-
- if (graphics->type == VIR_DOMAIN_GRAPHICS_TYPE_DBUS) {
- return graphics->data.dbus.p2p == p2p;
- }
- }
-
- return false;
-}
-
-
-static int
-qemuProcessStartValidateGraphics(virDomainObj *vm)
-{
- size_t i;
-
- for (i = 0; i < vm->def->ngraphics; i++) {
- virDomainGraphicsDef *graphics = vm->def->graphics[i];
-
- switch (graphics->type) {
- case VIR_DOMAIN_GRAPHICS_TYPE_VNC:
- case VIR_DOMAIN_GRAPHICS_TYPE_SPICE:
- break;
-
- case VIR_DOMAIN_GRAPHICS_TYPE_RDP:
- if (!virDomainDefHasDBus(vm->def, false)) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
- _("qemu-rdp support requires a D-Bus bus graphics
device."));
- return -1;
- }
- break;
-
- case VIR_DOMAIN_GRAPHICS_TYPE_SDL:
- case VIR_DOMAIN_GRAPHICS_TYPE_DESKTOP:
- case VIR_DOMAIN_GRAPHICS_TYPE_EGL_HEADLESS:
- case VIR_DOMAIN_GRAPHICS_TYPE_DBUS:
- case VIR_DOMAIN_GRAPHICS_TYPE_LAST:
- break;
- }
- }
-
- return 0;
-}
-
-
/* 250 parts per million (ppm) is a half of NTP threshold */
#define TSC_TOLERANCE 250
@@ -5664,9 +5613,6 @@ qemuProcessStartValidate(virQEMUDriver *driver,
if (virDomainDefValidate(vm->def, 0, driver->xmlopt, qemuCaps) < 0)
return -1;
- if (qemuProcessStartValidateGraphics(vm) < 0)
- return -1;
-
if (vm->def->cpu) {
if (virCPUValidateFeatures(vm->def->os.arch, vm->def->cpu) < 0)
return -1;
diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
index 1aa54bf59f..de391ce34d 100644
--- a/src/qemu/qemu_validate.c
+++ b/src/qemu/qemu_validate.c
@@ -4522,8 +4522,11 @@ qemuValidateDomainDeviceDefDBusGraphics(const virDomainGraphicsDef
*graphics,
static int
-qemuValidateDomainDeviceDefRDPGraphics(const virDomainGraphicsDef *graphics)
+qemuValidateDomainDeviceDefRDPGraphics(const virDomainGraphicsDef *graphics,
+ const virDomainDef *def)
{
+ size_t i;
+
if (graphics->nListens > 1) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("qemu-rdp does not support multiple listens for one
graphics device."));
@@ -4546,6 +4549,19 @@ qemuValidateDomainDeviceDefRDPGraphics(const virDomainGraphicsDef
*graphics)
return -1;
}
+ for (i = 0; i < def->ngraphics; i++) {
+ virDomainGraphicsDef *g = def->graphics[i];
+
+ if (g->type == VIR_DOMAIN_GRAPHICS_TYPE_DBUS && g->data.dbus.p2p ==
false)
+ break;
+ }
+
+ if (i == def->ngraphics) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("qemu-rdp support requires a D-Bus bus graphics
device."));
+ return -1;
+ }
+
return 0;
}
@@ -4623,7 +4639,7 @@ qemuValidateDomainDeviceDefGraphics(const virDomainGraphicsDef
*graphics,
break;
case VIR_DOMAIN_GRAPHICS_TYPE_RDP:
- if (qemuValidateDomainDeviceDefRDPGraphics(graphics) < 0)
+ if (qemuValidateDomainDeviceDefRDPGraphics(graphics, def) < 0)
return -1;
break;
--
2.49.0
5:17 p.m.
On Tue, May 27, 2025 at 09:48:56AM +0200, Peter Krempa via Devel wrote:
Some more cleanups for misplaced validation of config that I've
noticed
when I was looking for the code validating floppies in my previous
series.
Peter Krempa (9):
qemuDomainValidateStorageSource: Rework protocol validation into a
switch statement
qemu: Move disk backend validation checks from
qemuProcessStartValidateDisks to qemuDomainValidateStorageSource
qemu: block: Drop code for 'vxhs' storage protocol
qemu.conf: Document options for VxHS block network protocol TLS config
as ignored
qemu: conf: Drop handling of 'vxhs' config options
qemu: Move logic from qemuProcessStartValidateShmem to
qemuValidateDomainDeviceDefShmem
qemu: Move checks for number of listening sockets of graphics to
validation code
qemuProcessStartValidateGraphics: Remove redundant checks for RDP
protocol features
qemuProcessStartValidateGraphics: Move RDP validation logic to
qemu_validate.c
Reviewed-by: Pavel Hrdina <phrdina(a)redhat.com>
4
days inactive
4
days old
10 comments
2 participants
participants (2)
-
Pavel Hrdina -
Peter Krempa