- 16 3月, 2020 32 次提交
-
-
由 Peter Krempa 提交于
libguestfs abuses a quirk of qemu's parser to accept also other variants of the 'sslverify' field which would be valid on the command line but are not documented in the QMP schema. If we encounter the 'off' string instead of an boolean handle it rather than erroring out to continue support of pre-blockdev configurations. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Add support for parsing the recently added fields from backing file pseudo-protocol strings. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Pass in the correct fields. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Pass the alias of the secret object holding the cookie data as 'cookie-secret' to qemu. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Implement both commandline support and hotplug by adding the http cookie handling to 'qemuBlockStorageSourceAttachData' handling functions for it. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
QEMU's curl driver requires the cookies concatenated and allows themi to be passed in via a secret. Prepare the value for the secret and encrypt it. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
The http cookies can have potentially sensitive values and thus should not be leaked into the command line. This means that we'll need to instantiate a 'secret' object in qemu to pass the value encrypted. This patch adds infrastructure for storing of the alias in the status XML. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Allow disabling of SSL certificate validation for HTTPS and FTPS drives in qemu. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Upcoming patches will implement the support for sslverify, cookies, readahead, and timeout properties. Add a test file which will collect the cases. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Ensure that the new fields are allowed only when -blockdev is used or when they are in the detected part of the backing chain where qemu will handle them internally. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Some disk backends support configuring the readahead buffer or timeout for requests. Add the knobs to the XML. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Add possibility to specify one or more cookies for http based disks. This patch adds the config parser, storage and validation of the cookies. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
To allow turning off verification of SSL cerificates add a new element <ssl> to the disk source XML which will allow configuring the validation process using the 'verify' attribute. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
There are two last callers of this function. Replace them by qemuAliasForSecret and delete qemuDomainGetSecretAESAlias. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Originally there was only the secret for authentication so we didn't use any suffix to tell it apart. With the introduction of encryption we added a 'luks' suffix for the encryption secrets. Since encryption is really generic and authentication is not the only secret modify the aliases for the secrets to better describe what they are used for. This is possible as we store the disk secrets in the status XML thus only new machines will use the new secrets. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Replace qemuDomainGetSecretAESAlias by the new function so that we can reuse qemuDomainSecretAESSetupFromSecret also for setting up other kinds of objects. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Currently we don't have infrastructure to remember the secret aliases for hostdevs. Since an upcoming patch is going to change aliases for the disks, initialize the iscsi hostdevs separately so that we can keep the alias. At the same time let's use qemuAliasForSecret instead of qemuDomainGetSecretAESAlias when unplugging the iscsi hostdev. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
In order to be able to change the function generating the alias and thus also the aliases itself, we must hardcode the old format for the case of upgrading form libvirt which didn't record them in the status XML yet. Note that this code path is tested by 'tests/qemustatusxml2xmldata/disk-secinfo-upgrade-in.xml' Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
The naming of the variables was tied to what they are used for not what the alias represents. Since we'll need to use some of the aliases for another type of secrets fix the name so that it makes sense. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
qemuAliasForSecret is meant as a replacement qemuDomainGetSecretAESAlias with saner API. The sub-type we are creating the alias for is passed in as a string rather than the unflexible 'isLuks' boolean. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Daniel P. Berrangé 提交于
We need the "$(space)" variable to contain a single whitespace character. We do this by assigning and then appending an empty string to the variable. Variable appends get separated by a single whitespace historically, but GNU make 4.3 introduced a behaviour regression. https://lists.gnu.org/archive/html/bug-make/2020-01/msg00057.html [quote] * WARNING: Backward-incompatibility! Previously appending using '+=' to an empty variable would result in a value starting with a space. Now the initial space is only added if the variable already contains some value. Similarly, appending an empty string does not add a trailing space. [/quote] This patch tries a new trick to get a single whitespace by getting make to expand two non-existant variables separated by a space. Reviewed-by: NEric Blake <eblake@redhat.com> Signed-off-by: NDaniel P. Berrangé <berrange@redhat.com>
-
由 Peter Krempa 提交于
Replace it by a direct call to qemuDomainSecretAESSetupFromSecret. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Split out the lookup of the secret from the secret driver into qemuDomainSecretAESSetupFromSecret so that we can also instantiate secret objects in qemu with data from other sources. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Rather than passing in an empty qemuDomainSecretInfoPtr allocate it in this function and return it. This is done by absorbing the check from qemuDomainSecretInfoNew and removing the internals of qemuDomainSecretInfoNew. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Use g_autofree for the ciphertext and init vector as they are not secret and thus don't have to be cleared and use g_new0 to allocate the iv for parity. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
The comment mentioned that the function resets migration params, but that is not true as of commit eb54cb47Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Use g_autofree instead of VIR_FREE and delete the comment mentioning possible failure to allocate memory. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Using a double pointer prevents the function from being used as the automatic cleanup function for the given type. Remove the double pointer use by replacing the calls with g_clear_pointer which ensures that the pointer is cleared. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Peter Krempa 提交于
Use g_new0 to completely avoid the 'cleanup' label. Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NJán Tomko <jtomko@redhat.com>
-
由 Daniel Henrique Barboza 提交于
POWER hosts does not implement CPU virtualization extensions like x86 or s390x. Instead, all bare-metal POWER hosts are considered to be virtualization ready. For POWER, the validation is done by checking if the virtualization module kvm_hv is loaded in the host. If not, we should warn the user about it. Signed-off-by: NDaniel Henrique Barboza <danielhb413@gmail.com> Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
-
由 Peter Krempa 提交于
Signed-off-by: NPeter Krempa <pkrempa@redhat.com> Reviewed-by: NKashyap Chamarthy <kchamart@redhat.com>
-
- 14 3月, 2020 8 次提交
-
-
由 Zhang Bo 提交于
Update the manpage for the 'server-update-tls' command Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com> Signed-off-by: NZhang Bo <oscar.zhangbo@huawei.com> Signed-off-by: NWu Qingliang <wuqingliang4@huawei.com>
-
由 Zhang Bo 提交于
wire-up virAdmServerUpdateTlsFiles API into virt-admin client. Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com> Signed-off-by: NZhang Bo <oscar.zhangbo@huawei.com> Signed-off-by: NWu Qingliang <wuqingliang4@huawei.com>
-
由 Zhang Bo 提交于
The server needs to use CA certificate, CRL, server certificate/key to complete the TLS handshake. If these files change, we needed to restart libvirtd for them to take effect. This API can update the TLS context *ONLINE* without restarting libvirtd. Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com> Signed-off-by: NZhang Bo <oscar.zhangbo@huawei.com> Signed-off-by: NWu Qingliang <wuqingliang4@huawei.com>
-
由 Zhang Bo 提交于
Prevent the handshake function from reading 'tlsCtxt' while updating 'tlsCtxt'. Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com> Signed-off-by: NZhang Bo <oscar.zhangbo@huawei.com> Signed-off-by: NWu Qingliang <wuqingliang4@huawei.com>
-
由 Zhang Bo 提交于
Add an API to update server's tls context. Reviewed-by: NDaniel P. Berrangé <berrange@redhat.com> Signed-off-by: NZhang Bo <oscar.zhangbo@huawei.com> Signed-off-by: NWu Qingliang <wuqingliang4@huawei.com>
-
由 Ján Tomko 提交于
Signed-off-by: NJán Tomko <jtomko@redhat.com> Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
-
由 Ján Tomko 提交于
This was only used to pull in virStrerror. Signed-off-by: NJán Tomko <jtomko@redhat.com> Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
-
由 Ján Tomko 提交于
Now that we use g_strerror exclusively, remove this unused function. Signed-off-by: NJán Tomko <jtomko@redhat.com> Reviewed-by: NMichal Privoznik <mprivozn@redhat.com>
-