> On 13 Jul 2026, at 6:57 PM, Peter Krempa <[email protected]> wrote: > > !-------------------------------------------------------------------| > CAUTION: External Email > > |-------------------------------------------------------------------! > > On Tue, Jun 23, 2026 at 06:26:03 +0000, Abhisek Panda wrote: >> To enable TLS-PSK-based authentication scheme, add support for >> instantiating the tls-creds-psk object through QEMU monitor. In order >> to remove the TLS-related objects from a QEMU instance, augment the >> qemuDomainDelTLSObjects handler to also consider the TLS-PSK object. >> >> Suggested-by: Tejus GK <[email protected]> >> Signed-off-by: Abhisek Panda <[email protected]> >> --- >> src/qemu/qemu_alias.c | 11 +++++ >> src/qemu/qemu_alias.h | 3 ++ >> src/qemu/qemu_hotplug.c | 58 ++++++++++++++++++++++++--- >> src/qemu/qemu_hotplug.h | 14 ++++++- >> src/qemu/qemu_migration_params.c | 69 ++++++++++++++++++++++++++++++-- >> src/qemu/qemu_migration_params.h | 8 ++++ >> 6 files changed, 152 insertions(+), 11 deletions(-) >> >> diff --git a/src/qemu/qemu_alias.c b/src/qemu/qemu_alias.c >> index b41794a5fa..a4894a681f 100644 >> --- a/src/qemu/qemu_alias.c >> +++ b/src/qemu/qemu_alias.c >> @@ -883,6 +883,17 @@ qemuAliasTLSx509ObjFromSrcAlias(const char *srcAlias) >> return g_strdup_printf("obj%s_tlsx509_0", srcAlias); >> } >> >> +/* qemuAliasTLSPSKObjFromSrcAlias >> + * @srcAlias: Pointer to a source alias string >> + * >> + * Generate and return a string to be used as the TLS PSK object alias >> + */ >> +char * >> +qemuAliasTLSPSKObjFromSrcAlias(const char *srcAlias) >> +{ >> + return g_strdup_printf("obj%s_tlspsk_0", srcAlias); >> +} >> + > > As noted in previous patch, there's just one TLS backend object possible > here so there isn't really need to encode what type is used in the alias > name. > > It'll simplify much of the rest of the patch. > > >> @@ -1881,6 +1885,48 @@ qemuDomainDelChardevTLSObjects(virQEMUDriver *driver, >> } >> >> >> +int >> +qemuDomainAddTLSPSKObjects(virDomainObj *vm, >> + virDomainAsyncJob asyncJob, >> + virJSONValue **tlsPSKProps) >> +{ >> + qemuDomainObjPrivate *priv = vm->privateData; >> + virErrorPtr orig_err; >> + >> + if (!tlsPSKProps) >> + return 0; >> + >> + if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) < 0) >> + return -1; >> + >> + if (tlsPSKProps && *tlsPSKProps && >> + qemuMonitorAddObject(priv->mon, tlsPSKProps, NULL) < 0) >> + goto error; >> + >> + qemuDomainObjExitMonitor(vm); >> + return 0; >> + >> + error: >> + virErrorPreserveLast(&orig_err); >> + qemuDomainObjExitMonitor(vm); >> + virErrorRestore(&orig_err); >> + return -1; >> +} >> + >> + >> +int >> +qemuDomainGetTLSPSKObjects(const char *tlsPSKdir, >> + bool tlsListen, >> + const char *alias, >> + virJSONValue **tlsPSKProps) >> +{ >> + if (qemuBuildTLSPSKBackendProps(tlsPSKdir, tlsListen, alias, >> tlsPSKProps) < 0) >> + return -1; >> + >> + return 0; >> +} > > Both of the above wrappers seem rather minimal and used from just one > place. I'd suggest you just move the code into > qemuMigrationParamsEnableTLSPSK instead. > > >> + >> + >> static int >> qemuDomainAttachRedirdevDevice(virQEMUDriver *driver, >> virDomainObj *vm, > > [...] > > >> diff --git a/src/qemu/qemu_migration_params.c >> b/src/qemu/qemu_migration_params.c >> index c91ae89c9b..846d97b4d1 100644 >> --- a/src/qemu/qemu_migration_params.c >> +++ b/src/qemu/qemu_migration_params.c > > [...] > >> @@ -1237,6 +1237,65 @@ qemuMigrationParamsEnableTLSx509(virQEMUDriver >> *driver, >> } >> >> >> +/* qemuMigrationParamsEnableTLSPSK >> + * @driver: pointer to qemu driver >> + * @vm: domain object >> + * @tlsListen: server or client >> + * @asyncJob: Migration job to join >> + * @tlsPSKAlias: alias to be generated for TLS-PSK object >> + * @migParams: migration parameters to set >> + * >> + * Create the TLS PSK objects for the migration and set the migParams value. >> + * >> + * Returns 0 on success, -1 on failure >> + */ >> +int >> +qemuMigrationParamsEnableTLSPSK(virQEMUDriver *driver, >> + virDomainObj *vm, >> + bool tlsListen, >> + int asyncJob, >> + char **tlsPSKAlias, >> + qemuMigrationParams *migParams) >> +{ >> + qemuDomainJobPrivate *jobPriv = vm->job->privateData; >> + g_autoptr(virJSONValue) tlsPSKProps = NULL; >> + g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver); >> + char uuidstr[VIR_UUID_STRING_BUFLEN]; >> + g_autofree char *dir_path = NULL; >> + >> + virUUIDFormat(vm->def->uuid, uuidstr); >> + dir_path = g_strdup_printf("%s/%s", cfg->stateDir, uuidstr); >> + >> + if (!jobPriv->migParams->params[QEMU_MIGRATION_PARAM_TLS_CREDS].set) { >> + virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s", >> + _("TLS migration is not supported with this QEMU >> binary")); > > At the point where qemu supports TLS PSK it surely supports TLS as whole > so this check is pointless. > > What you need instead is a capability check that the PSK backend object > is supported instead.
Since libvirt has now dropped support for QEMU < 7.2.0 and the tls-creds-psk object was introduced in QEMU 3.0, I feel that we do not need to perform a capability check. > > >> + return -1; >> + } >> + >> + if (!(*tlsPSKAlias = >> qemuAliasTLSPSKObjFromSrcAlias(QEMU_MIGRATION_TLS_ALIAS_BASE))) >> + return -1; >> + >> + if (qemuDomainGetTLSPSKObjects(dir_path, tlsListen, >> + *tlsPSKAlias, &tlsPSKProps) < 0) >> + return -1; >> + >> + /* Ensure the domain doesn't already have the TLS-PSK objects defined. >> + * This should prevent any issues just in case some cleanup wasn't >> + * properly completed (both src and dst use the same alias) or >> + * some other error path. */ >> + qemuDomainDelTLSObjects(vm, asyncJob, NULL, NULL, *tlsPSKAlias); >> + >> + if (qemuDomainAddTLSPSKObjects(vm, asyncJob, &tlsPSKProps) < 0) >> + return -1; >> + >> + if (qemuMigrationParamsSetString(migParams, >> QEMU_MIGRATION_PARAM_TLS_CREDS, >> + *tlsPSKAlias) < 0) >> + return -1; >> + >> + return 0; >> +} >> + >> + >> /* qemuMigrationParamsDisableTLS >> * @vm: domain object >> * @migParams: Pointer to a migration parameters block >> @@ -1281,8 +1340,8 @@ >> qemuMigrationParamsTLSHostnameIsSet(qemuMigrationParams *migParams)
