util: Add TLS attributes to virStorageSource

Add an optional virTristateBool haveTLS to virStorageSource to manage whether a storage source will be using TLS. Sample XML for a VxHS disk: <disk type='network' device='disk'> <driver name='qemu' type='raw' cache='none'/> <source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'> <host name='192.168.0.1' port='9999'/> </source> <target dev='vda' bus='virtio'/> </disk> Additionally add a tlsFromConfig boolean to control whether the TLS setting was due to domain configuration or qemu.conf global setting in order to decide whether to Format the haveTLS setting for either a live or saved domain configuration file. Update the qemuxml2xmltest in order to add a test to show the proper parsing. Also update the docs to describe the tls attribute. Signed-off-by: Ashish Mittal <Ashish.Mittal@veritas.com> Signed-off-by: John Ferlan <jferlan@redhat.com>
2017-08-30 11:35:34 -04:00 · 2017-08-30 11:35:34 -04:00 · f170548502
parent 70ad305275
commit f170548502
10 changed files with 154 additions and 18 deletions
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@ -2531,10 +2531,21 @@
              specified, the default LUN is zero.
              </p>

-              <p>
-              For "vxhs" (<span class="since">since 3.8.0</span>), the
+              <p>For "vxhs" (<span class="since">since 3.8.0</span>), the
              <code>name</code> is the UUID of the volume, assigned by the
-              HyperScale server.
+              HyperScale server. Additionally, an optional attribute
+              <code>tls</code> (QEMU only) can be used to control whether a
+              VxHS block device would utilize a hypervisor configured TLS
+              X.509 certificate environment in order to encrypt the data
+              channel. For the QEMU hypervisor, usage of a TLS environment can
+              also be globally controlled on the host by the
+              <code>vxhs_tls</code> and <code>vxhs_tls_x509_cert_dir</code> or
+              <code>default_tls_x509_cert_dir</code> settings in the file
+              /etc/libvirt/qemu.conf. If <code>vxhs_tls</code> is enabled,
+              then unless the domain <code>tls</code> attribute is set to "no",
+              libvirt will use the host configured TLS environment. If the
+              <code>tls</code> attribute is set to "yes", then regardless of
+              the qemu.conf setting, TLS authentication will be attempted.
              </p>
              <span class="since">Since 0.8.7</span>
              </dd>
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@ -1644,6 +1644,11 @@
        </choice>
      </attribute>
      <attribute name="name"/>
+      <optional>
+        <attribute name="tls">
+          <ref name="virYesNo"/>
+        </attribute>
+      </optional>
      <ref name="diskSourceNetworkHost"/>
    </element>
  </define>
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@ -8109,11 +8109,15 @@ virDomainDiskSourcePoolDefParse(xmlNodePtr node,
 int
 virDomainDiskSourceParse(xmlNodePtr node,
                         xmlXPathContextPtr ctxt,
-                         virStorageSourcePtr src)
+                         virStorageSourcePtr src,
+                         unsigned int flags)
 {
    int ret = -1;
    char *protocol = NULL;
    xmlNodePtr saveNode = ctxt->node;
+    char *haveTLS = NULL;
+    char *tlsCfg = NULL;
+    int tlsCfgVal;

    ctxt->node = node;

@ -8147,6 +8151,30 @@ virDomainDiskSourceParse(xmlNodePtr node,
            goto cleanup;
        }

+        /* Check tls=yes|no domain setting for the block device
+         * At present only VxHS. Other block devices may be added later */
+        if (src->protocol == VIR_STORAGE_NET_PROTOCOL_VXHS &&
+            (haveTLS = virXMLPropString(node, "tls"))) {
+            if ((src->haveTLS =
+                virTristateBoolTypeFromString(haveTLS)) <= 0) {
+                virReportError(VIR_ERR_XML_ERROR,
+                           _("unknown disk source 'tls' setting '%s'"),
+                           haveTLS);
+                goto cleanup;
+            }
+        }
+
+        if ((flags & VIR_DOMAIN_DEF_PARSE_STATUS) &&
+            (tlsCfg = virXMLPropString(node, "tlsFromConfig"))) {
+            if (virStrToLong_i(tlsCfg, NULL, 10, &tlsCfgVal) < 0) {
+                virReportError(VIR_ERR_XML_ERROR,
+                               _("Invalid tlsFromConfig value: %s"),
+                               tlsCfg);
+                goto cleanup;
+            }
+            src->tlsFromConfig = !!tlsCfgVal;
+        }
+
        /* for historical reasons the volume name for gluster volume is stored
         * as a part of the path. This is hard to work with when dealing with
         * relative names. Split out the volume into a separate variable */
@ -8202,6 +8230,8 @@ virDomainDiskSourceParse(xmlNodePtr node,

 cleanup:
    VIR_FREE(protocol);
+    VIR_FREE(haveTLS);
+    VIR_FREE(tlsCfg);
    ctxt->node = saveNode;
    return ret;
 }
@ -8209,7 +8239,8 @@ virDomainDiskSourceParse(xmlNodePtr node,

 static int
 virDomainDiskBackingStoreParse(xmlXPathContextPtr ctxt,
-                               virStorageSourcePtr src)
+                               virStorageSourcePtr src,
+                               unsigned int flags)
 {
    virStorageSourcePtr backingStore = NULL;
    xmlNodePtr save_ctxt = ctxt->node;
@ -8258,8 +8289,8 @@ virDomainDiskBackingStoreParse(xmlXPathContextPtr ctxt,
        goto cleanup;
    }

-    if (virDomainDiskSourceParse(source, ctxt, backingStore) < 0 ||
-        virDomainDiskBackingStoreParse(ctxt, backingStore) < 0)
+    if (virDomainDiskSourceParse(source, ctxt, backingStore, flags) < 0 ||
+        virDomainDiskBackingStoreParse(ctxt, backingStore, flags) < 0)
        goto cleanup;

    src->backingStore = backingStore;
@ -8360,7 +8391,8 @@ virDomainDiskDefIotuneParse(virDomainDiskDefPtr def,
 static int
 virDomainDiskDefMirrorParse(virDomainDiskDefPtr def,
                            xmlNodePtr cur,
-                            xmlXPathContextPtr ctxt)
+                            xmlXPathContextPtr ctxt,
+                            unsigned int flags)
 {
    xmlNodePtr mirrorNode;
    char *mirrorFormat = NULL;
@ -8398,7 +8430,7 @@ virDomainDiskDefMirrorParse(virDomainDiskDefPtr def,
            goto cleanup;
        }

-        if (virDomainDiskSourceParse(mirrorNode, ctxt, def->mirror) < 0)
+        if (virDomainDiskSourceParse(mirrorNode, ctxt, def->mirror, flags) < 0)
            goto cleanup;
    } else {
        /* For back-compat reasons, we handle a file name
@ -8815,7 +8847,7 @@ virDomainDiskDefParseXML(virDomainXMLOptionPtr xmlopt,
        if (!source && virXMLNodeNameEqual(cur, "source")) {
            sourceNode = cur;

-            if (virDomainDiskSourceParse(cur, ctxt, def->src) < 0)
+            if (virDomainDiskSourceParse(cur, ctxt, def->src, flags) < 0)
                goto error;

            source = true;
@ -8871,7 +8903,7 @@ virDomainDiskDefParseXML(virDomainXMLOptionPtr xmlopt,
        } else if (!def->mirror &&
                   virXMLNodeNameEqual(cur, "mirror") &&
                   !(flags & VIR_DOMAIN_DEF_PARSE_INACTIVE)) {
-            if (virDomainDiskDefMirrorParse(def, cur, ctxt) < 0)
+            if (virDomainDiskDefMirrorParse(def, cur, ctxt, flags) < 0)
                goto error;
        } else if (!authdef &&
                   virXMLNodeNameEqual(cur, "auth")) {
@ -9126,7 +9158,7 @@ virDomainDiskDefParseXML(virDomainXMLOptionPtr xmlopt,
    product = NULL;

    if (!(flags & VIR_DOMAIN_DEF_PARSE_DISK_SOURCE)) {
-        if (virDomainDiskBackingStoreParse(ctxt, def->src) < 0)
+        if (virDomainDiskBackingStoreParse(ctxt, def->src, flags) < 0)
            goto error;
    }

@ -21673,7 +21705,8 @@ virDomainSourceDefFormatSeclabel(virBufferPtr buf,
 static int
 virDomainDiskSourceFormatNetwork(virBufferPtr attrBuf,
                                 virBufferPtr childBuf,
-                                 virStorageSourcePtr src)
+                                 virStorageSourcePtr src,
+                                 unsigned int flags)
 {
    size_t n;
    char *path = NULL;
@ -21690,6 +21723,14 @@ virDomainDiskSourceFormatNetwork(virBufferPtr attrBuf,

    VIR_FREE(path);

+    if (src->haveTLS != VIR_TRISTATE_BOOL_ABSENT &&
+        !(flags & VIR_DOMAIN_DEF_FORMAT_MIGRATABLE &&
+          src->tlsFromConfig))
+        virBufferAsprintf(attrBuf, " tls='%s'",
+                          virTristateBoolTypeToString(src->haveTLS));
+    if (flags & VIR_DOMAIN_DEF_FORMAT_STATUS)
+        virBufferAsprintf(attrBuf, " tlsFromConfig='%d'", src->tlsFromConfig);
+
    for (n = 0; n < src->nhosts; n++) {
        virBufferAddLit(childBuf, "<host");
        virBufferEscapeString(childBuf, " name='%s'", src->hosts[n].name);
@ -21754,7 +21795,8 @@ virDomainDiskSourceFormatInternal(virBufferPtr buf,
            break;

        case VIR_STORAGE_TYPE_NETWORK:
-            if (virDomainDiskSourceFormatNetwork(&attrBuf, &childBuf, src) < 0)
+            if (virDomainDiskSourceFormatNetwork(&attrBuf, &childBuf,
+                                                 src, flags) < 0)
                goto error;
            break;

--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@ -2995,7 +2995,8 @@ virDomainDiskDefPtr
 virDomainDiskRemoveByName(virDomainDefPtr def, const char *name);
 int virDomainDiskSourceParse(xmlNodePtr node,
                             xmlXPathContextPtr ctxt,
-                             virStorageSourcePtr src);
+                             virStorageSourcePtr src,
+                             unsigned int flags);

 int virDomainNetFindIdx(virDomainDefPtr def, virDomainNetDefPtr net);
 virDomainNetDefPtr virDomainNetFind(virDomainDefPtr def, const char *device);
--- a/src/conf/snapshot_conf.c
+++ b/src/conf/snapshot_conf.c
@ -109,7 +109,8 @@ void virDomainSnapshotDefFree(virDomainSnapshotDefPtr def)
 static int
 virDomainSnapshotDiskDefParseXML(xmlNodePtr node,
                                 xmlXPathContextPtr ctxt,
-                                 virDomainSnapshotDiskDefPtr def)
+                                 virDomainSnapshotDiskDefPtr def,
+                                 unsigned int flags)
 {
    int ret = -1;
    char *snapshot = NULL;
@ -154,7 +155,7 @@ virDomainSnapshotDiskDefParseXML(xmlNodePtr node,
    }

    if ((cur = virXPathNode("./source", ctxt)) &&
-        virDomainDiskSourceParse(cur, ctxt, def->src) < 0)
+        virDomainDiskSourceParse(cur, ctxt, def->src, flags) < 0)
        goto cleanup;

    if ((driver = virXPathString("string(./driver/@type)", ctxt))) {
@ -348,7 +349,7 @@ virDomainSnapshotDefParse(xmlXPathContextPtr ctxt,
        def->ndisks = n;
        for (i = 0; i < def->ndisks; i++) {
            if (virDomainSnapshotDiskDefParseXML(nodes[i], ctxt,
-                                                 &def->disks[i]) < 0)
+                                                 &def->disks[i], flags) < 0)
                goto cleanup;
        }
        VIR_FREE(nodes);
--- a/src/util/virstoragefile.c
+++ b/src/util/virstoragefile.c
@ -2039,6 +2039,8 @@ virStorageSourceCopy(const virStorageSource *src,
    ret->physical = src->physical;
    ret->readonly = src->readonly;
    ret->shared = src->shared;
+    ret->haveTLS = src->haveTLS;
+    ret->tlsFromConfig = src->tlsFromConfig;

    /* storage driver metadata are not copied */
    ret->drv = NULL;
--- a/src/util/virstoragefile.h
+++ b/src/util/virstoragefile.h
@ -281,6 +281,13 @@ struct _virStorageSource {
    /* metadata that allows identifying given storage source */
    char *nodeformat;  /* name of the format handler object */
    char *nodestorage; /* name of the storage object */
+
+    /* An optional setting to enable usage of TLS for the storage source */
+    int haveTLS; /* enum virTristateBool */
+
+    /* Indication whether the haveTLS value was altered due to qemu.conf
+     * setting when haveTLS is missing from the domain config file */
+    bool tlsFromConfig;
 };


--- a/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
+++ b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-tlsx509-vxhs.xml
@ -0,0 +1,32 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219136</memory>
+  <currentMemory unit='KiB'>219136</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='i686' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <disk type='network' device='disk'>
+      <driver name='qemu' type='raw' cache='none'/>
+      <source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
+        <host name='192.168.0.1' port='9999'/>
+      </source>
+      <target dev='vda' bus='virtio'/>
+      <serial>eb90327c-8302-4725-9e1b-4e85ed4dc251</serial>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+    </disk>
+    <controller type='usb' index='0'/>
+    <controller type='pci' index='0' model='pci-root'/>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <memballoon model='none'/>
+  </devices>
+</domain>
--- a/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-disk-drive-network-tlsx509-vxhs.xml
@ -0,0 +1,34 @@
+<domain type='qemu'>
+  <name>QEMUGuest1</name>
+  <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+  <memory unit='KiB'>219136</memory>
+  <currentMemory unit='KiB'>219136</currentMemory>
+  <vcpu placement='static'>1</vcpu>
+  <os>
+    <type arch='i686' machine='pc'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <disk type='network' device='disk'>
+      <driver name='qemu' type='raw' cache='none'/>
+      <source protocol='vxhs' name='eb90327c-8302-4725-9e1b-4e85ed4dc251' tls='yes'>
+        <host name='192.168.0.1' port='9999'/>
+      </source>
+      <target dev='vda' bus='virtio'/>
+      <serial>eb90327c-8302-4725-9e1b-4e85ed4dc251</serial>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>
+    </disk>
+    <controller type='usb' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
+    </controller>
+    <controller type='pci' index='0' model='pci-root'/>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <memballoon model='none'/>
+  </devices>
+</domain>
--- a/tests/qemuxml2xmltest.c
+++ b/tests/qemuxml2xmltest.c
@ -475,6 +475,7 @@ mymain(void)
    DO_TEST("disk-drive-network-rbd-ceph-env", NONE);
    DO_TEST("disk-drive-network-sheepdog", NONE);
    DO_TEST("disk-drive-network-vxhs", NONE);
+    DO_TEST("disk-drive-network-tlsx509-vxhs", NONE);
    DO_TEST("disk-scsi-device",
            QEMU_CAPS_NODEFCONFIG, QEMU_CAPS_SCSI_LSI);
    DO_TEST("disk-scsi-vscsi", NONE);