1:51 p.m.
v2:
- added qemu.conf knobs
- added docs
- fixed test case for changes in ACKed patches
This applies on top of my branch collecting all ACKed postings of
recent blockdev-related work. Current version can be fetched by:
git fetch git://pipo.sk/pipo/libvirt.git blockdev-staging
Peter Krempa (3):
qemu: conf: Add qemu.conf knobs for setting up TLS for NBD
qemu: domain: Add support for TLS for NBD
tests: qemublock: Test NBD with TLS in the JSON generator
docs/formatdomain.html.in | 8 ++++-
docs/schemas/domaincommon.rng | 5 +++
src/qemu/libvirtd_qemu.aug | 4 +++
src/qemu/qemu.conf | 34 +++++++++++++++++++
src/qemu/qemu_command.c | 5 +++
src/qemu/qemu_conf.c | 15 +++++++++
src/qemu/qemu_conf.h | 3 ++
src/qemu/qemu_domain.c | 38 ++++++++++++++++++++--
src/qemu/test_libvirtd_qemu.aug.in | 2 ++
tests/qemublocktest.c | 1 +
.../xml2json/network-nbd-tls.json | 19 +++++++++++
.../qemublocktestdata/xml2json/network-nbd-tls.xml | 18 ++++++++++
.../disk-drive-network-tlsx509.args | 9 ++++-
.../disk-drive-network-tlsx509.xml | 8 +++++
tests/qemuxml2argvtest.c | 2 +-
.../disk-drive-network-tlsx509.xml | 8 +++++
16 files changed, 174 insertions(+), 5 deletions(-)
create mode 100644 tests/qemublocktestdata/xml2json/network-nbd-tls.json
create mode 100644 tests/qemublocktestdata/xml2json/network-nbd-tls.xml
--
2.16.2
1:51 p.m.
New subject: [libvirt] [PATCH v2 1/3] qemu: conf: Add qemu.conf knobs for setting up TLS for NBD
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/libvirtd_qemu.aug | 4 ++++
src/qemu/qemu.conf | 34 ++++++++++++++++++++++++++++++++++
src/qemu/qemu_conf.c | 15 +++++++++++++++
src/qemu/qemu_conf.h | 3 +++
src/qemu/test_libvirtd_qemu.aug.in | 2 ++
5 files changed, 58 insertions(+)
diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug
index 2dc16e91fd..679f48cbca 100644
--- a/src/qemu/libvirtd_qemu.aug
+++ b/src/qemu/libvirtd_qemu.aug
@@ -119,6 +119,9 @@ module Libvirtd_qemu =
let vxhs_entry = bool_entry "vxhs_tls"
| str_entry "vxhs_tls_x509_cert_dir"
+ let nbd_entry = bool_entry "nbd_tls"
+ | str_entry "nbd_tls_x509_cert_dir"
+
(* Each entry in the config is one of the following ... *)
let entry = default_tls_entry
| vnc_entry
@@ -138,6 +141,7 @@ module Libvirtd_qemu =
| gluster_debug_level_entry
| memory_entry
| vxhs_entry
+ | nbd_entry
let comment = [ label "#comment" . del /#[ \t]*/ "# " . store
/([^ \t\n][^\n]*)?/ . del /\n/ "\n" ]
let empty = [ label "#empty" . eol ]
diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf
index 31738ff19c..c8e1a62d1c 100644
--- a/src/qemu/qemu.conf
+++ b/src/qemu/qemu.conf
@@ -297,6 +297,40 @@
#vxhs_tls_x509_cert_dir = "/etc/pki/libvirt-vxhs"
+
+# Enable use of TLS encryption for all NBD disk devices that don't
+# specifically disable it.
+#
+# When the NBD server is set up appropriately, x509 certificates are required
+# for authentication between the client and the remote NBD server.
+#
+# It is necessary to setup CA and issue the client certificate before
+# enabling this.
+#
+#nbd_tls = 1
+
+
+# In order to override the default TLS certificate location for NBD
+# backed storage, supply a valid path to the certificate directory.
+# This is used to authenticate the NBD block device clients to the NBD
+# server.
+#
+# If the provided path does not exist, libvirtd will fail to start.
+# If the path is not provided, but nbd_tls = 1, then the
+# default_tls_x509_cert_dir path will be used.
+#
+# NBD block device clients expect the client certificate and key to be
+# present in the certificate directory along with the CA certificate.
+# Since this is only a client the server-key.pem certificate is not needed.
+# Thus a NBD directory must contain the following:
+#
+# ca-cert.pem - the CA master certificate
+# client-cert.pem - the client certificate signed with the ca-cert.pem
+# client-key.pem - the client private key
+#
+#nbd_tls_x509_cert_dir = "/etc/pki/libvirt-nbd"
+
+
# In order to override the default TLS certificate location for migration
# certificates, supply a valid path to the certificate directory. If the
# provided path does not exist, libvirtd will fail to start. If the path is
diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
index 277ab833a8..5f35a49e91 100644
--- a/src/qemu/qemu_conf.c
+++ b/src/qemu/qemu_conf.c
@@ -279,6 +279,7 @@ virQEMUDriverConfigPtr virQEMUDriverConfigNew(bool privileged)
SET_TLS_X509_CERT_DEFAULT(chardev);
SET_TLS_X509_CERT_DEFAULT(migrate);
SET_TLS_X509_CERT_DEFAULT(vxhs);
+ SET_TLS_X509_CERT_DEFAULT(nbd);
#undef SET_TLS_X509_CERT_DEFAULT
@@ -378,6 +379,7 @@ static void virQEMUDriverConfigDispose(void *obj)
VIR_FREE(cfg->chardevTLSx509secretUUID);
VIR_FREE(cfg->vxhsTLSx509certdir);
+ VIR_FREE(cfg->nbdTLSx509certdir);
VIR_FREE(cfg->migrateTLSx509certdir);
VIR_FREE(cfg->migrateTLSx509secretUUID);
@@ -458,6 +460,7 @@ virQEMUDriverConfigTLSDirResetDefaults(virQEMUDriverConfigPtr cfg)
CHECK_RESET_CERT_DIR_DEFAULT(chardev);
CHECK_RESET_CERT_DIR_DEFAULT(migrate);
CHECK_RESET_CERT_DIR_DEFAULT(vxhs);
+ CHECK_RESET_CERT_DIR_DEFAULT(nbd);
return 0;
}
@@ -561,6 +564,10 @@ int virQEMUDriverConfigLoadFile(virQEMUDriverConfigPtr cfg,
goto cleanup;
if (virConfGetValueString(conf, "vxhs_tls_x509_cert_dir",
&cfg->vxhsTLSx509certdir) < 0)
goto cleanup;
+ if (virConfGetValueBool(conf, "nbd_tls", &cfg->nbdTLS) < 0)
+ goto cleanup;
+ if (virConfGetValueString(conf, "nbd_tls_x509_cert_dir",
&cfg->nbdTLSx509certdir) < 0)
+ goto cleanup;
#define GET_CONFIG_TLS_CERTINFO(val) \
do { \
@@ -992,6 +999,14 @@ virQEMUDriverConfigValidate(virQEMUDriverConfigPtr cfg)
return -1;
}
+ if (STRNEQ(cfg->nbdTLSx509certdir, SYSCONFDIR "/pki/qemu") &&
+ !virFileExists(cfg->nbdTLSx509certdir)) {
+ virReportError(VIR_ERR_CONF_SYNTAX,
+ _("nbd_tls_x509_cert_dir directory '%s' does not
exist"),
+ cfg->nbdTLSx509certdir);
+ return -1;
+ }
+
return 0;
}
diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h
index 7a63780c48..6d25c3e74f 100644
--- a/src/qemu/qemu_conf.h
+++ b/src/qemu/qemu_conf.h
@@ -207,6 +207,9 @@ struct _virQEMUDriverConfig {
bool vxhsTLS;
char *vxhsTLSx509certdir;
+
+ bool nbdTLS;
+ char *nbdTLSx509certdir;
};
/* Main driver state */
diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qemu.aug.in
index 95885e9f06..912161c272 100644
--- a/src/qemu/test_libvirtd_qemu.aug.in
+++ b/src/qemu/test_libvirtd_qemu.aug.in
@@ -27,6 +27,8 @@ module Test_libvirtd_qemu =
{ "chardev_tls_x509_secret_uuid" =
"00000000-0000-0000-0000-000000000000" }
{ "vxhs_tls" = "1" }
{ "vxhs_tls_x509_cert_dir" = "/etc/pki/libvirt-vxhs" }
+{ "nbd_tls" = "1" }
+{ "nbd_tls_x509_cert_dir" = "/etc/pki/libvirt-nbd" }
{ "migrate_tls_x509_cert_dir" = "/etc/pki/libvirt-migrate" }
{ "migrate_tls_x509_verify" = "1" }
{ "migrate_tls_x509_secret_uuid" =
"00000000-0000-0000-0000-000000000000" }
--
2.16.2
1:51 p.m.
New subject: [libvirt] [PATCH v2 2/3] qemu: domain: Add support for TLS for NBD
https://bugzilla.redhat.com/show_bug.cgi?id=1544869
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
docs/formatdomain.html.in | 8 ++++-
docs/schemas/domaincommon.rng | 5 +++
src/qemu/qemu_command.c | 5 +++
src/qemu/qemu_domain.c | 38 ++++++++++++++++++++--
.../disk-drive-network-tlsx509.args | 9 ++++-
.../disk-drive-network-tlsx509.xml | 8 +++++
tests/qemuxml2argvtest.c | 2 +-
.../disk-drive-network-tlsx509.xml | 8 +++++
8 files changed, 78 insertions(+), 5 deletions(-)
diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index b5a6e33bfe..dccabe7f35 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -2786,7 +2786,13 @@
is mandatory to specify which volume/image will be used.
</p>
- <p>For "nbd", the <code>name</code> attribute
is optional.
+ <p>For "nbd", the <code>name</code> attribute
is optional. TLS
+ transport for NBD can be enabled by using the <code>tls</code>
+ attribute. For the QEMU hypervisor, usage of a TLS environment can
+ lso be globally controlled on the host by the
+ <code>nbd_tls</code> and
<code>nbd_tls_x509_cert_dir</code> in
+ /etc/libvirt/qemu.conf.
+ ('tls' <span class="since">Since
4.5.0</span>)
</p>
<p>For "iscsi" (<span class="since">since
1.0.4</span>), the
diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index 703a1bb6f8..ce2d1e91e0 100644
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -1706,6 +1706,11 @@
<optional>
<attribute name="name"/>
</optional>
+ <optional>
+ <attribute name="tls">
+ <ref name="virYesNo"/>
+ </attribute>
+ </optional>
<ref name="diskSourceNetworkHost"/>
<optional>
<ref name="encryption"/>
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index c75595ca6d..75c05f9e9a 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -1388,6 +1388,11 @@ qemuDiskSourceNeedsProps(virStorageSourcePtr src,
virQEMUCapsGet(qemuCaps, QEMU_CAPS_ISCSI_PASSWORD_SECRET))
return true;
+ if (actualType == VIR_STORAGE_TYPE_NETWORK &&
+ src->protocol == VIR_STORAGE_NET_PROTOCOL_NBD &&
+ src->haveTLS == VIR_TRISTATE_BOOL_YES)
+ return true;
+
return false;
}
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 873bcec50d..1bfa6a926a 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -9934,6 +9934,34 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
}
+static int
+qemuProcessPrepareStorageSourceTLSNBD(virStorageSourcePtr src,
+ virQEMUDriverConfigPtr cfg,
+ virQEMUCapsPtr qemuCaps)
+{
+ if (src->haveTLS == VIR_TRISTATE_BOOL_ABSENT) {
+ if (cfg->nbdTLS)
+ src->haveTLS = VIR_TRISTATE_BOOL_YES;
+ else
+ src->haveTLS = VIR_TRISTATE_BOOL_NO;
+ src->tlsFromConfig = true;
+ }
+
+ if (src->haveTLS == VIR_TRISTATE_BOOL_YES) {
+ if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_NBD_TLS)) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("this qemu does not support TLS transport for
NBD"));
+ return -1;
+ }
+
+ if (VIR_STRDUP(src->tlsCertdir, cfg->nbdTLSx509certdir) < 0)
+ return -1;
+ }
+
+ return 0;
+}
+
+
/* qemuProcessPrepareStorageSourceTLS:
* @source: source for a disk
* @cfg: driver configuration
@@ -9948,7 +9976,8 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
static int
qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
virQEMUDriverConfigPtr cfg,
- const char *parentAlias)
+ const char *parentAlias,
+ virQEMUCapsPtr qemuCaps)
{
if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK)
return 0;
@@ -9960,6 +9989,10 @@ qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
break;
case VIR_STORAGE_NET_PROTOCOL_NBD:
+ if (qemuProcessPrepareStorageSourceTLSNBD(src, cfg, qemuCaps) < 0)
+ return -1;
+ break;
+
case VIR_STORAGE_NET_PROTOCOL_RBD:
case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
@@ -12502,7 +12535,8 @@ qemuDomainPrepareDiskSourceLegacy(virDomainDiskDefPtr disk,
if (qemuDomainPrepareStorageSourcePR(disk->src, priv, disk->info.alias) <
0)
return -1;
- if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias) <
0)
+ if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias,
+ priv->qemuCaps) < 0)
return -1;
return 0;
diff --git a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args
b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args
index 91d3a8a70a..970b8a32a6 100644
--- a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args
+++ b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.args
@@ -43,4 +43,11 @@ id=virtio-disk1 \
file.server.host=192.168.0.3,file.server.port=9999,format=raw,if=none,\
id=drive-virtio-disk2,serial=eb90327c-8302-4725-9e1b-4e85ed4dc252,cache=none \
-device virtio-blk-pci,bus=pci.0,addr=0x6,drive=drive-virtio-disk2,\
-id=virtio-disk2
+id=virtio-disk2 \
+-object tls-creds-x509,id=objvirtio-disk3_tls0,dir=/etc/pki/qemu,\
+endpoint=client,verify-peer=yes \
+-drive file.driver=nbd,file.server.type=inet,file.server.host=example.com,\
+file.server.port=1234,file.tls-creds=objvirtio-disk3_tls0,format=raw,if=none,\
+id=drive-virtio-disk3,cache=none \
+-device virtio-blk-pci,bus=pci.0,addr=0x7,drive=drive-virtio-disk3,\
+id=virtio-disk3
diff --git a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml
b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml
index a66e81f065..9f6f298b54 100644
--- a/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml
+++ b/tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml
@@ -41,6 +41,14 @@
<serial>eb90327c-8302-4725-9e1b-4e85ed4dc252</serial>
<address type='pci' domain='0x0000' bus='0x00'
slot='0x06' function='0x0'/>
</disk>
+ <disk type='network' device='disk'>
+ <driver name='qemu' type='raw' cache='none'/>
+ <source protocol='nbd' tls='yes'>
+ <host name='example.com' port='1234'/>
+ </source>
+ <target dev='vdd' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00'
slot='0x07' function='0x0'/>
+ </disk>
<controller type='usb' index='0'/>
<controller type='pci' index='0' model='pci-root'/>
<input type='mouse' bus='ps2'/>
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index 2d41f78f8b..1d588e5dd1 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -1052,7 +1052,7 @@ mymain(void)
DO_TEST("disk-drive-network-vxhs", QEMU_CAPS_VXHS);
driver.config->vxhsTLS = 1;
DO_TEST("disk-drive-network-tlsx509", QEMU_CAPS_VXHS,
- QEMU_CAPS_OBJECT_TLS_CREDS_X509);
+ QEMU_CAPS_OBJECT_TLS_CREDS_X509, QEMU_CAPS_NBD_TLS);
driver.config->vxhsTLS = 0;
VIR_FREE(driver.config->vxhsTLSx509certdir);
DO_TEST("disk-drive-no-boot",
diff --git a/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml
b/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml
index 7053affd17..a9b8d32646 100644
--- a/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml
+++ b/tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml
@@ -41,6 +41,14 @@
<serial>eb90327c-8302-4725-9e1b-4e85ed4dc252</serial>
<address type='pci' domain='0x0000' bus='0x00'
slot='0x06' function='0x0'/>
</disk>
+ <disk type='network' device='disk'>
+ <driver name='qemu' type='raw' cache='none'/>
+ <source protocol='nbd' tls='yes'>
+ <host name='example.com' port='1234'/>
+ </source>
+ <target dev='vdd' bus='virtio'/>
+ <address type='pci' domain='0x0000' bus='0x00'
slot='0x07' function='0x0'/>
+ </disk>
<controller type='usb' index='0'>
<address type='pci' domain='0x0000' bus='0x00'
slot='0x01' function='0x2'/>
</controller>
--
2.16.2
1:51 p.m.
New subject: [libvirt] [PATCH v2 3/3] tests: qemublock: Test NBD with TLS in the JSON generator
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
tests/qemublocktest.c | 1 +
tests/qemublocktestdata/xml2json/network-nbd-tls.json | 19 +++++++++++++++++++
tests/qemublocktestdata/xml2json/network-nbd-tls.xml | 18 ++++++++++++++++++
3 files changed, 38 insertions(+)
create mode 100644 tests/qemublocktestdata/xml2json/network-nbd-tls.json
create mode 100644 tests/qemublocktestdata/xml2json/network-nbd-tls.xml
diff --git a/tests/qemublocktest.c b/tests/qemublocktest.c
index d0cd834b05..0c335abc5b 100644
--- a/tests/qemublocktest.c
+++ b/tests/qemublocktest.c
@@ -486,6 +486,7 @@ mymain(void)
TEST_DISK_TO_JSON("file-backing_basic-cache-unsafe");
TEST_DISK_TO_JSON("network-qcow2-backing-chain-cache-unsafe");
TEST_DISK_TO_JSON("dir-fat-cache");
+ TEST_DISK_TO_JSON("network-nbd-tls");
TEST_DISK_TO_JSON("block-raw-noopts");
TEST_DISK_TO_JSON("block-raw-reservations");
diff --git a/tests/qemublocktestdata/xml2json/network-nbd-tls.json
b/tests/qemublocktestdata/xml2json/network-nbd-tls.json
new file mode 100644
index 0000000000..a1529a6c44
--- /dev/null
+++ b/tests/qemublocktestdata/xml2json/network-nbd-tls.json
@@ -0,0 +1,19 @@
+{
+ "node-name": "node-b-f",
+ "read-only": false,
+ "driver": "qcow2",
+ "file": "node-a-s",
+ "backing": null
+}
+{
+ "driver": "nbd",
+ "server": {
+ "type": "inet",
+ "host": "host1.example.com",
+ "port": "10809"
+ },
+ "tls-creds": "node-a-s-tls0",
+ "node-name": "node-a-s",
+ "read-only": false,
+ "discard": "unmap"
+}
diff --git a/tests/qemublocktestdata/xml2json/network-nbd-tls.xml
b/tests/qemublocktestdata/xml2json/network-nbd-tls.xml
new file mode 100644
index 0000000000..1330a5acc7
--- /dev/null
+++ b/tests/qemublocktestdata/xml2json/network-nbd-tls.xml
@@ -0,0 +1,18 @@
+<disk type='network' device='disk'>
+ <driver name='qemu' type='qcow2'/>
+ <source protocol='nbd' tls='yes'>
+ <host name='host1.example.com'/>
+ <privateData>
+ <nodenames>
+ <nodename type='storage' name='node-a-s'/>
+ <nodename type='format' name='node-b-f'/>
+ </nodenames>
+ <objects>
+ <TLSx509 alias='node-a-s-tls0'/>
+ </objects>
+ </privateData>
+ </source>
+ <backingStore/>
+ <target dev='vda' bus='virtio'/>
+ <alias name='virtio-disk0'/>
+</disk>
--
2.16.2
10:09 a.m.
New subject: [libvirt] [PATCH v2 1/3] qemu: conf: Add qemu.conf knobs for setting up TLS for NBD
On Thu, May 31, 2018 at 08:51:12PM +0200, Peter Krempa wrote:
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
src/qemu/libvirtd_qemu.aug | 4 ++++
src/qemu/qemu.conf | 34 ++++++++++++++++++++++++++++++++++
src/qemu/qemu_conf.c | 15 +++++++++++++++
src/qemu/qemu_conf.h | 3 +++
src/qemu/test_libvirtd_qemu.aug.in | 2 ++
5 files changed, 58 insertions(+)
Reviewed-by: Ján Tomko <jtomko(a)redhat.com>
Jano
10:11 a.m.
New subject: [libvirt] [PATCH v2 2/3] qemu: domain: Add support for TLS for NBD
On Thu, May 31, 2018 at 08:51:13PM +0200, Peter Krempa wrote:
https://bugzilla.redhat.com/show_bug.cgi?id=1544869
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
docs/formatdomain.html.in | 8 ++++-
docs/schemas/domaincommon.rng | 5 +++
src/qemu/qemu_command.c | 5 +++
src/qemu/qemu_domain.c | 38 ++++++++++++++++++++--
.../disk-drive-network-tlsx509.args | 9 ++++-
.../disk-drive-network-tlsx509.xml | 8 +++++
tests/qemuxml2argvtest.c | 2 +-
.../disk-drive-network-tlsx509.xml | 8 +++++
8 files changed, 78 insertions(+), 5 deletions(-)
diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index b5a6e33bfe..dccabe7f35 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -2786,7 +2786,13 @@
is mandatory to specify which volume/image will be used.
</p>
- <p>For "nbd", the <code>name</code> attribute
is optional.
+ <p>For "nbd", the <code>name</code> attribute
is optional. TLS
+ transport for NBD can be enabled by using the <code>tls</code>
can be enabled by setting the <code>tls</code> attribute to yes
+ attribute. For the QEMU hypervisor, usage of a TLS
environment can
+ lso be globally controlled on the host by the
+ <code>nbd_tls</code> and
<code>nbd_tls_x509_cert_dir</code> in
+ /etc/libvirt/qemu.conf.
+ ('tls' <span class="since">Since
4.5.0</span>)
</p>
<p>For "iscsi" (<span class="since">since
1.0.4</span>), the
Reviewed-by: Ján Tomko <jtomko(a)redhat.com>
Jano
10:11 a.m.
New subject: [libvirt] [PATCH v2 3/3] tests: qemublock: Test NBD with TLS in the JSON generator
On Thu, May 31, 2018 at 08:51:14PM +0200, Peter Krempa wrote:
Signed-off-by: Peter Krempa <pkrempa(a)redhat.com>
---
tests/qemublocktest.c | 1 +
tests/qemublocktestdata/xml2json/network-nbd-tls.json | 19 +++++++++++++++++++
tests/qemublocktestdata/xml2json/network-nbd-tls.xml | 18 ++++++++++++++++++
3 files changed, 38 insertions(+)
create mode 100644 tests/qemublocktestdata/xml2json/network-nbd-tls.json
create mode 100644 tests/qemublocktestdata/xml2json/network-nbd-tls.xml
Reviewed-by: Ján Tomko <jtomko(a)redhat.com>
Jano
2382
days inactive
2384
days old
6 comments
2 participants
participants (2)
-
Ján Tomko -
Peter Krempa