qemu: domain: Add support for TLS for NBD

https://bugzilla.redhat.com/show_bug.cgi?id=1544869Signed-off-by: NPeter Krempa <pkrempa@redhat.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>

docs/formatdomain.html.in

@@ -2786,7 +2786,13 @@
               is mandatory to specify which volume/image will be used.
               </p>
 
-              <p>For "nbd", the <code>name</code> attribute is optional.
+              <p>For "nbd", the <code>name</code> attribute is optional. TLS
+              transport for NBD can be enabled by setting the <code>tls</code>
+              attribute to <code>yes</code>. For the QEMU hypervisor, usage of
+              a TLS environment can also be globally controlled on the host by
+              the <code>nbd_tls</code> and <code>nbd_tls_x509_cert_dir</code> in
+              /etc/libvirt/qemu.conf.
+              ('tls' <span class="since">Since 4.5.0</span>)
               </p>
 
               <p>For "iscsi" (<span class="since">since 1.0.4</span>), the

docs/schemas/domaincommon.rng

@@ -1706,6 +1706,11 @@
       <optional>
         <attribute name="name"/>
       </optional>
+      <optional>
+        <attribute name="tls">
+          <ref name="virYesNo"/>
+        </attribute>
+      </optional>
       <ref name="diskSourceNetworkHost"/>
       <optional>
         <ref name="encryption"/>

src/qemu/qemu_command.c

@@ -1388,6 +1388,11 @@ qemuDiskSourceNeedsProps(virStorageSourcePtr src,
         virQEMUCapsGet(qemuCaps, QEMU_CAPS_ISCSI_PASSWORD_SECRET))
         return true;
 
+    if (actualType == VIR_STORAGE_TYPE_NETWORK &&
+        src->protocol == VIR_STORAGE_NET_PROTOCOL_NBD &&
+        src->haveTLS == VIR_TRISTATE_BOOL_YES)
+        return true;
+
     return false;
 }
 

src/qemu/qemu_domain.c

@@ -9962,6 +9962,34 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
 }
 
 
+static int
+qemuProcessPrepareStorageSourceTLSNBD(virStorageSourcePtr src,
+                                      virQEMUDriverConfigPtr cfg,
+                                      virQEMUCapsPtr qemuCaps)
+{
+    if (src->haveTLS == VIR_TRISTATE_BOOL_ABSENT) {
+        if (cfg->nbdTLS)
+            src->haveTLS = VIR_TRISTATE_BOOL_YES;
+        else
+            src->haveTLS = VIR_TRISTATE_BOOL_NO;
+        src->tlsFromConfig = true;
+    }
+
+    if (src->haveTLS == VIR_TRISTATE_BOOL_YES) {
+        if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_NBD_TLS)) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+                           _("this qemu does not support TLS transport for NBD"));
+            return -1;
+        }
+
+        if (VIR_STRDUP(src->tlsCertdir, cfg->nbdTLSx509certdir) < 0)
+            return -1;
+    }
+
+    return 0;
+}
+
+
 /* qemuProcessPrepareStorageSourceTLS:
  * @source: source for a disk
  * @cfg: driver configuration
@@ -9976,7 +10004,8 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
 static int
 qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
                                   virQEMUDriverConfigPtr cfg,
-                                  const char *parentAlias)
+                                  const char *parentAlias,
+                                  virQEMUCapsPtr qemuCaps)
 {
     if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK)
         return 0;
@@ -9988,6 +10017,10 @@ qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
         break;
 
     case VIR_STORAGE_NET_PROTOCOL_NBD:
+        if (qemuProcessPrepareStorageSourceTLSNBD(src, cfg, qemuCaps) < 0)
+            return -1;
+        break;
+
     case VIR_STORAGE_NET_PROTOCOL_RBD:
     case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
     case VIR_STORAGE_NET_PROTOCOL_GLUSTER:
@@ -12530,7 +12563,8 @@ qemuDomainPrepareDiskSourceLegacy(virDomainDiskDefPtr disk,
     if (qemuDomainPrepareStorageSourcePR(disk->src, priv, disk->info.alias) < 0)
         return -1;
 
-    if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias) < 0)
+    if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias,
+                                          priv->qemuCaps) < 0)
         return -1;
 
     return 0;

tests/qemuxml2argvdata/disk-drive-network-tlsx509.args

@@ -43,4 +43,11 @@ id=virtio-disk1 \
 file.server.host=192.168.0.3,file.server.port=9999,format=raw,if=none,\
 id=drive-virtio-disk2,serial=eb90327c-8302-4725-9e1b-4e85ed4dc252,cache=none \
 -device virtio-blk-pci,bus=pci.0,addr=0x6,drive=drive-virtio-disk2,\
-id=virtio-disk2
+id=virtio-disk2 \
+-object tls-creds-x509,id=objvirtio-disk3_tls0,dir=/etc/pki/qemu,\
+endpoint=client,verify-peer=yes \
+-drive file.driver=nbd,file.server.type=inet,file.server.host=example.com,\
+file.server.port=1234,file.tls-creds=objvirtio-disk3_tls0,format=raw,if=none,\
+id=drive-virtio-disk3,cache=none \
+-device virtio-blk-pci,bus=pci.0,addr=0x7,drive=drive-virtio-disk3,\
+id=virtio-disk3

tests/qemuxml2argvdata/disk-drive-network-tlsx509.xml

@@ -41,6 +41,14 @@
       <serial>eb90327c-8302-4725-9e1b-4e85ed4dc252</serial>
       <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
     </disk>
+    <disk type='network' device='disk'>
+      <driver name='qemu' type='raw' cache='none'/>
+      <source protocol='nbd' tls='yes'>
+        <host name='example.com' port='1234'/>
+      </source>
+      <target dev='vdd' bus='virtio'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+    </disk>
     <controller type='usb' index='0'/>
     <controller type='pci' index='0' model='pci-root'/>
     <input type='mouse' bus='ps2'/>

tests/qemuxml2argvtest.c

@@ -1052,7 +1052,7 @@ mymain(void)
     DO_TEST("disk-drive-network-vxhs", QEMU_CAPS_VXHS);
     driver.config->vxhsTLS = 1;
     DO_TEST("disk-drive-network-tlsx509", QEMU_CAPS_VXHS,
-            QEMU_CAPS_OBJECT_TLS_CREDS_X509);
+            QEMU_CAPS_OBJECT_TLS_CREDS_X509, QEMU_CAPS_NBD_TLS);
     driver.config->vxhsTLS = 0;
     VIR_FREE(driver.config->vxhsTLSx509certdir);
     DO_TEST("disk-drive-no-boot",

tests/qemuxml2xmloutdata/disk-drive-network-tlsx509.xml

@@ -41,6 +41,14 @@
       <serial>eb90327c-8302-4725-9e1b-4e85ed4dc252</serial>
       <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
     </disk>
+    <disk type='network' device='disk'>
+      <driver name='qemu' type='raw' cache='none'/>
+      <source protocol='nbd' tls='yes'>
+        <host name='example.com' port='1234'/>
+      </source>
+      <target dev='vdd' bus='virtio'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>
+    </disk>
     <controller type='usb' index='0'>
       <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
     </controller>