Re: [PATCH v9 2/4] util: Add TLS attributes to virStorageSource

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Sep 19, 2017 at 21:32:44 -0400, John Ferlan wrote:
> From: Ashish Mittal <Ashish.Mittal@xxxxxxxxxxx>
> 
> Add an optional virTristateBool haveTLS to virStorageSource to
> manage whether a storage source will be using TLS.
> 
> Sample XML for a VxHS disk:
> 
> <disk type='network' device='disk'>
>   <driver name='qemu' type='raw' cache='none'/>
>   <source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
>     <host name='192.168.0.1' port='9999'/>
>   </source>
>   <target dev='vda' bus='virtio'/>
> </disk>
> 
> Additionally add a tlsFromConfig boolean to control whether the TLS
> setting was due to domain configuration or qemu.conf global setting
> in order to decide whether to Format the haveTLS setting for either
> a live or saved domain configuration file.
> 
> Update the qemuxml2xmltest in order to add a test to show the proper
> parsing.
> 
> Also update the docs to describe the tls attribute plus clean up the
> description in the surrounding area to make the information a bit more
> readable rather than one winding paragraph.
> 
> Signed-off-by: Ashish Mittal <Ashish.Mittal@xxxxxxxxxxx>
> Signed-off-by: John Ferlan <jferlan@xxxxxxxxxx>
> ---
>  docs/formatdomain.html.in                          | 40 ++++++++++++++++------
>  docs/schemas/domaincommon.rng                      |  5 +++
>  src/conf/domain_conf.c                             | 29 ++++++++++++++--
>  src/util/virstoragefile.c                          |  2 ++
>  src/util/virstoragefile.h                          |  7 ++++
>  ...emuxml2argv-disk-drive-network-tlsx509-vxhs.xml | 32 +++++++++++++++++
>  ...uxml2xmlout-disk-drive-network-tlsx509-vxhs.xml | 34 ++++++++++++++++++
>  tests/qemuxml2xmltest.c                            |  1 +
>  8 files changed, 138 insertions(+), 12 deletions(-)
>  create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
>  create mode 100644 tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
> 
> diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
> index 9ce4620c6..3e10213b5 100644
> --- a/docs/formatdomain.html.in
> +++ b/docs/formatdomain.html.in
> @@ -2514,19 +2514,39 @@
>                <dd>
>                The <code>protocol</code> attribute specifies the protocol to
>                access to the requested image. Possible values are "nbd",
> -              "iscsi", "rbd", "sheepdog", "gluster" or "vxhs".  If the
> -              <code>protocol</code> attribute is "rbd", "sheepdog", "gluster"
> -              or "vxhs", an additional attribute <code>name</code> is
> -              mandatory to specify which volume/image will be used. For "nbd",
> -              the <code>name</code> attribute is optional. For "iscsi"
> -              (<span class="since">since 1.0.4</span>), the <code>name</code>
> -              attribute may include a logical unit number, separated from the
> -              target's name by a slash (e.g.,
> +              "iscsi", "rbd", "sheepdog", "gluster" or "vxhs".
> +
> +              <p>If the <code>protocol</code> attribute is "rbd", "sheepdog",
> +              "gluster", or "vxhs", an additional attribute <code>name</code>
> +              is mandatory to specify which volume/image will be used.
> +              </p>
> +
> +              <p>For "nbd", the <code>name</code> attribute is optional.
> +              </p>
> +
> +              <p>For "iscsi" (<span class="since">since 1.0.4</span>), the
> +              <code>name</code> attribute may include a logical unit number,
> +              separated from the target's name by a slash (e.g.,
>                <code>iqn.2013-07.com.example:iscsi-pool/1</code>). If not
>                specified, the default LUN is zero.
> -              For "vxhs" (<span class="since">since 3.8.0</span>), the
> +              </p>
> +
> +              <p>For "vxhs" (<span class="since">since 3.8.0</span>), the
>                <code>name</code> is the UUID of the volume, assigned by the
> -              HyperScale server.

Everything above is not really relevant to adding TLS to VxHS and thus
deserves a separate patch.

> +              HyperScale server. Additionally, an optional attribute
> +              <code>tls</code> (QEMU only) can be used to control whether a
> +              VxHS block device would utilize a hypervisor configured TLS
> +              X.509 certificate environment in order to encrypt the data
> +              channel. For the QEMU hypervisor, usage of a TLS environment can
> +              also be globally controlled on the host by the
> +              <code>vxhs_tls</code> and <code>vxhs_tls_x509_cert_dir</code> or
> +              <code>default_tls_x509_cert_dir</code> settings in the file
> +              /etc/libvirt/qemu.conf. If <code>vxhs_tls</code> is enabled,
> +              then unless the domain <code>tls</code> attribute is set to "no",
> +              libvirt will use the host configured TLS environment. If the
> +              <code>tls</code> attribute is set to "yes", then regardless of
> +              the qemu.conf setting, TLS authentication will be attempted.
> +              </p>
>                <span class="since">Since 0.8.7</span>
>                </dd>
>              <dt><code>volume</code></dt>

[...]

> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
> index cc5e79b70..a568d9140 100644
> --- a/src/conf/domain_conf.c
> +++ b/src/conf/domain_conf.c

[...]

> @@ -8147,6 +8148,19 @@ virDomainDiskSourceParse(xmlNodePtr node,
>              goto cleanup;
>          }
>  
> +        /* Check tls=yes|no domain setting for the block device
> +         * At present only VxHS. Other block devices may be added later */
> +        if (src->protocol == VIR_STORAGE_NET_PROTOCOL_VXHS &&
> +            (haveTLS = virXMLPropString(node, "tls"))) {
> +            if ((src->haveTLS =
> +                virTristateBoolTypeFromString(haveTLS)) <= 0) {
> +                virReportError(VIR_ERR_XML_ERROR,
> +                           _("unknown disk source 'tls' setting '%s'"),
> +                           haveTLS);
> +                goto cleanup;
> +            }
> +        }
> +
>          /* for historical reasons the volume name for gluster volume is stored
>           * as a part of the path. This is hard to work with when dealing with
>           * relative names. Split out the volume into a separate variable */

[...]

> @@ -21690,6 +21706,14 @@ virDomainDiskSourceFormatNetwork(virBufferPtr attrBuf,
>  
>      VIR_FREE(path);
>  
> +    if (src->haveTLS != VIR_TRISTATE_BOOL_ABSENT &&
> +        !(flags & VIR_DOMAIN_DEF_FORMAT_MIGRATABLE &&
> +          src->tlsFromConfig))
> +        virBufferAsprintf(attrBuf, " tls='%s'",
> +                          virTristateBoolTypeToString(src->haveTLS));
> +    if (flags & VIR_DOMAIN_DEF_FORMAT_STATUS)
> +        virBufferAsprintf(attrBuf, " tlsFromConfig='%d'", src->tlsFromConfig);

Why is this attribute formatted as a number? Also you don't really seem
to parse it.

Attachment: signature.asc
Description: PGP signature

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list

[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]
  Powered by Linux