[PATCH v9 2/4] util: Add TLS attributes to virStorageSource

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Ashish Mittal <Ashish.Mittal@xxxxxxxxxxx>

Add an optional virTristateBool haveTLS to virStorageSource to
manage whether a storage source will be using TLS.

Sample XML for a VxHS disk:

<disk type='network' device='disk'>
  <driver name='qemu' type='raw' cache='none'/>
  <source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
    <host name='192.168.0.1' port='9999'/>
  </source>
  <target dev='vda' bus='virtio'/>
</disk>

Additionally add a tlsFromConfig boolean to control whether the TLS
setting was due to domain configuration or qemu.conf global setting
in order to decide whether to Format the haveTLS setting for either
a live or saved domain configuration file.

Update the qemuxml2xmltest in order to add a test to show the proper
parsing.

Also update the docs to describe the tls attribute plus clean up the
description in the surrounding area to make the information a bit more
readable rather than one winding paragraph.

Signed-off-by: Ashish Mittal <Ashish.Mittal@xxxxxxxxxxx>
Signed-off-by: John Ferlan <jferlan@xxxxxxxxxx>
---
 docs/formatdomain.html.in                          | 40 ++++++++++++++++------
 docs/schemas/domaincommon.rng                      |  5 +++
 src/conf/domain_conf.c                             | 29 ++++++++++++++--
 src/util/virstoragefile.c                          |  2 ++
 src/util/virstoragefile.h                          |  7 ++++
 ...emuxml2argv-disk-drive-network-tlsx509-vxhs.xml | 32 +++++++++++++++++
 ...uxml2xmlout-disk-drive-network-tlsx509-vxhs.xml | 34 ++++++++++++++++++
 tests/qemuxml2xmltest.c                            |  1 +
 8 files changed, 138 insertions(+), 12 deletions(-)
 create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
 create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml

diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index 9ce4620c6..3e10213b5 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -2514,19 +2514,39 @@
               <dd>
               The <code>protocol</code> attribute specifies the protocol to
               access to the requested image. Possible values are "nbd",
-              "iscsi", "rbd", "sheepdog", "gluster" or "vxhs".  If the
-              <code>protocol</code> attribute is "rbd", "sheepdog", "gluster"
-              or "vxhs", an additional attribute <code>name</code> is
-              mandatory to specify which volume/image will be used. For "nbd",
-              the <code>name</code> attribute is optional. For "iscsi"
-              (<span class="since">since 1.0.4</span>), the <code>name</code>
-              attribute may include a logical unit number, separated from the
-              target's name by a slash (e.g.,
+              "iscsi", "rbd", "sheepdog", "gluster" or "vxhs".
+
+              <p>If the <code>protocol</code> attribute is "rbd", "sheepdog",
+              "gluster", or "vxhs", an additional attribute <code>name</code>
+              is mandatory to specify which volume/image will be used.
+              </p>
+
+              <p>For "nbd", the <code>name</code> attribute is optional.
+              </p>
+
+              <p>For "iscsi" (<span class="since">since 1.0.4</span>), the
+              <code>name</code> attribute may include a logical unit number,
+              separated from the target's name by a slash (e.g.,
               <code>iqn.2013-07.com.example:iscsi-pool/1</code>). If not
               specified, the default LUN is zero.
-              For "vxhs" (<span class="since">since 3.8.0</span>), the
+              </p>
+
+              <p>For "vxhs" (<span class="since">since 3.8.0</span>), the
               <code>name</code> is the UUID of the volume, assigned by the
-              HyperScale server.
+              HyperScale server. Additionally, an optional attribute
+              <code>tls</code> (QEMU only) can be used to control whether a
+              VxHS block device would utilize a hypervisor configured TLS
+              X.509 certificate environment in order to encrypt the data
+              channel. For the QEMU hypervisor, usage of a TLS environment can
+              also be globally controlled on the host by the
+              <code>vxhs_tls</code> and <code>vxhs_tls_x509_cert_dir</code> or
+              <code>default_tls_x509_cert_dir</code> settings in the file
+              /etc/libvirt/qemu.conf. If <code>vxhs_tls</code> is enabled,
+              then unless the domain <code>tls</code> attribute is set to "no",
+              libvirt will use the host configured TLS environment. If the
+              <code>tls</code> attribute is set to "yes", then regardless of
+              the qemu.conf setting, TLS authentication will be attempted.
+              </p>
               <span class="since">Since 0.8.7</span>
               </dd>
             <dt><code>volume</code></dt>
diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index 76852abb3..bac371ea3 100644
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -1644,6 +1644,11 @@
         </choice>
       </attribute>
       <attribute name="name"/>
+      <optional>
+        <attribute name="tls">
+          <ref name="virYesNo"/>
+        </attribute>
+      </optional>
       <ref name="diskSourceNetworkHost"/>
     </element>
   </define>
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index cc5e79b70..a568d9140 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -8114,6 +8114,7 @@ virDomainDiskSourceParse(xmlNodePtr node,
     int ret = -1;
     char *protocol = NULL;
     xmlNodePtr saveNode = ctxt->node;
+    char *haveTLS = NULL;
 
     ctxt->node = node;
 
@@ -8147,6 +8148,19 @@ virDomainDiskSourceParse(xmlNodePtr node,
             goto cleanup;
         }
 
+        /* Check tls=yes|no domain setting for the block device
+         * At present only VxHS. Other block devices may be added later */
+        if (src->protocol == VIR_STORAGE_NET_PROTOCOL_VXHS &&
+            (haveTLS = virXMLPropString(node, "tls"))) {
+            if ((src->haveTLS =
+                virTristateBoolTypeFromString(haveTLS)) <= 0) {
+                virReportError(VIR_ERR_XML_ERROR,
+                           _("unknown disk source 'tls' setting '%s'"),
+                           haveTLS);
+                goto cleanup;
+            }
+        }
+
         /* for historical reasons the volume name for gluster volume is stored
          * as a part of the path. This is hard to work with when dealing with
          * relative names. Split out the volume into a separate variable */
@@ -8202,6 +8216,7 @@ virDomainDiskSourceParse(xmlNodePtr node,
 
  cleanup:
     VIR_FREE(protocol);
+    VIR_FREE(haveTLS);
     ctxt->node = saveNode;
     return ret;
 }
@@ -21673,7 +21688,8 @@ virDomainSourceDefFormatSeclabel(virBufferPtr buf,
 static int
 virDomainDiskSourceFormatNetwork(virBufferPtr attrBuf,
                                  virBufferPtr childBuf,
-                                 virStorageSourcePtr src)
+                                 virStorageSourcePtr src,
+                                 unsigned int flags)
 {
     size_t n;
     char *path = NULL;
@@ -21690,6 +21706,14 @@ virDomainDiskSourceFormatNetwork(virBufferPtr attrBuf,
 
     VIR_FREE(path);
 
+    if (src->haveTLS != VIR_TRISTATE_BOOL_ABSENT &&
+        !(flags & VIR_DOMAIN_DEF_FORMAT_MIGRATABLE &&
+          src->tlsFromConfig))
+        virBufferAsprintf(attrBuf, " tls='%s'",
+                          virTristateBoolTypeToString(src->haveTLS));
+    if (flags & VIR_DOMAIN_DEF_FORMAT_STATUS)
+        virBufferAsprintf(attrBuf, " tlsFromConfig='%d'", src->tlsFromConfig);
+
     for (n = 0; n < src->nhosts; n++) {
         virBufferAddLit(childBuf, "<host");
         virBufferEscapeString(childBuf, " name='%s'", src->hosts[n].name);
@@ -21754,7 +21778,8 @@ virDomainDiskSourceFormatInternal(virBufferPtr buf,
             break;
 
         case VIR_STORAGE_TYPE_NETWORK:
-            if (virDomainDiskSourceFormatNetwork(&attrBuf, &childBuf, src) < 0)
+            if (virDomainDiskSourceFormatNetwork(&attrBuf, &childBuf,
+                                                 src, flags) < 0)
                 goto error;
             break;
 
diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c
index ba2045369..35f468e35 100644
--- a/src/util/virstoragefile.c
+++ b/src/util/virstoragefile.c
@@ -2039,6 +2039,8 @@ virStorageSourceCopy(const virStorageSource *src,
     ret->physical = src->physical;
     ret->readonly = src->readonly;
     ret->shared = src->shared;
+    ret->haveTLS = src->haveTLS;
+    ret->tlsFromConfig = src->tlsFromConfig;
 
     /* storage driver metadata are not copied */
     ret->drv = NULL;
diff --git a/src/util/virstoragefile.h b/src/util/virstoragefile.h
index f7e897f25..4817090fc 100644
--- a/src/util/virstoragefile.h
+++ b/src/util/virstoragefile.h
@@ -281,6 +281,13 @@ struct _virStorageSource {
     /* metadata that allows identifying given storage source */
     char *nodeformat;  /* name of the format handler object */
     char *nodestorage; /* name of the storage object */
+
+    /* An optional setting to enable usage of TLS for the storage source */
+    int haveTLS; /* enum virTristateBool */
+
+    /* Indication whether the haveTLS value was altered due to qemu.conf
+     * setting when haveTLS is missing from the domain config file */
+    bool tlsFromConfig;
 };
 
 
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
new file mode 100644
index 000000000..61b5e2e79
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
@@ -0,0 +1,32 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219136</memory>
+  <currentMemory unit='KiB'>219136</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='i686' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <disk type='network' device='disk'>
+      <driver name='qemu' type='raw' cache='none'/>
+      <source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
+        <host name='192.168.0.1' port='9999'/>
+      </source>
+      <target dev='vda' bus='virtio'/>
+      <serial>eb90327c-8302-4725-9e1b-4e85ed4dc251</serial>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+    </disk>
+    <controller type='usb' index='0'/>
+    <controller type='pci' index='0' model='pci-root'/>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <memballoon model='none'/>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
new file mode 100644
index 000000000..16f0883e0
--- /dev/null
+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
@@ -0,0 +1,34 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219136</memory>
+  <currentMemory unit='KiB'>219136</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='i686' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <disk type='network' device='disk'>
+      <driver name='qemu' type='raw' cache='none'/>
+      <source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
+        <host name='192.168.0.1' port='9999'/>
+      </source>
+      <target dev='vda' bus='virtio'/>
+      <serial>eb90327c-8302-4725-9e1b-4e85ed4dc251</serial>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+    </disk>
+    <controller type='usb' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+    </controller>
+    <controller type='pci' index='0' model='pci-root'/>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <memballoon model='none'/>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c
index 80159386c..bf8eb46b1 100644
--- a/tests/qemuxml2xmltest.c
+++ b/tests/qemuxml2xmltest.c
@@ -475,6 +475,7 @@ mymain(void)
     DO_TEST("disk-drive-network-rbd-ceph-env", NONE);
     DO_TEST("disk-drive-network-sheepdog", NONE);
     DO_TEST("disk-drive-network-vxhs", NONE);
+    DO_TEST("disk-drive-network-tlsx509-vxhs", NONE);
     DO_TEST("disk-scsi-device",
             QEMU_CAPS_NODEFCONFIG, QEMU_CAPS_SCSI_LSI);
     DO_TEST("disk-scsi-vscsi", NONE);
-- 
2.13.5

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list



[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]
  Powered by Linux