https://bugzilla.redhat.com/show_bug.cgi?id=1425757
The blockdev-add code provides a mechanism to sanely provide user
and password-secret arguments for iscsi without placing them on the
command line to be viewable by a 'ps -ef' type command or needing
to create separate -iscsi devices for each disk/volume found.
So modify the iSCSI command line building to check for the presence
of the capability in order properly setup and use the domain master
secret object to encrypt the password in a secret object and alter
the parameters for the command line to utilize.
Modify the xml2argvtest to exhibit the syntax for both disk and
hostdev configurations.
Signed-off-by: John Ferlan <jfer...@redhat.com>
---
src/qemu/qemu_block.c | 65 +++++++++++++++++++++-
src/qemu/qemu_command.c | 65 +++++++++++++++++-----
src/qemu/qemu_command.h | 3 +-
src/qemu/qemu_domain.c | 4 ++
src/qemu/qemu_hotplug.c | 50 ++++++++++++++++-
...xml2argv-disk-drive-network-iscsi-auth-AES.args | 41 ++++++++++++++
...uxml2argv-disk-drive-network-iscsi-auth-AES.xml | 43 ++++++++++++++
...ml2argv-hostdev-scsi-virtio-iscsi-auth-AES.args | 45 +++++++++++++++
...xml2argv-hostdev-scsi-virtio-iscsi-auth-AES.xml | 48 ++++++++++++++++
tests/qemuxml2argvtest.c | 10 ++++
10 files changed, 356 insertions(+), 18 deletions(-)
create mode 100644
tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-auth-AES.args
create mode 100644
tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-auth-AES.xml
create mode 100644
tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-virtio-iscsi-auth-AES.args
create mode 100644
tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-virtio-iscsi-auth-AES.xml
diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c
index 0761f89913..b32befb78d 100644
--- a/src/qemu/qemu_block.c
+++ b/src/qemu/qemu_block.c
@@ -560,6 +560,65 @@ qemuBlockStorageSourceGetVxHSProps(virStorageSourcePtr src)
}
+static virJSONValuePtr
+qemuBlockStorageSourceGetISCSIProps(virStorageSourcePtr src)
+{
+ const char *protocol = virStorageNetProtocolTypeToString(src->protocol);
+ char *target = NULL;
+ char *lunStr = NULL;
+ char *username = NULL;
+ char *objalias = NULL;
+ unsigned int lun = 0;
+ virJSONValuePtr ret = NULL;
+ qemuDomainStorageSourcePrivatePtr srcPriv =
+ QEMU_DOMAIN_STORAGE_SOURCE_PRIVATE(src);
+
+ /* { driver:"iscsi",
+ * transport:"tcp", ("iser" also possible)
+ * portal:"example.com",
+ * target:"iqn.2017-04.com.example:iscsi-disks",
+ * lun:1,
+ * user:"username",
+ * password-secret:"secret-alias",
+ * }
+ */
+
+ if (VIR_STRDUP(target, src->path) < 0)
+ goto cleanup;
+
+ /* Separate the target and lun */
+ if ((lunStr = strchr(target, '/'))) {
+ *(lunStr++) = '\0';
+ if (virStrToLong_ui(lunStr, NULL, 10, &lun) < 0) {
+ virReportError(VIR_ERR_INTERNAL_ERROR,
+ _("cannot parse target for lunStr '%s'"),
+ target);
+ goto cleanup;
+ }
+ }
+
+ if (src->auth) {
+ username = src->auth->username;
+ objalias = srcPriv->secinfo->s.aes.alias;
+ }
+
+ ignore_value(virJSONValueObjectCreate(&ret,
+ "s:driver", protocol,
+ "s:portal", src->hosts[0].name,
+ "s:target", target,
+ "u:lun", lun,
+ "s:transport", "tcp",
+ "S:user", username,
+ "S:password-secret", objalias,
+ NULL));
+ goto cleanup;
+
+ cleanup:
+ VIR_FREE(target);
+ return ret;
+}
+
+
/**
* qemuBlockStorageSourceGetBackendProps:
* @src: disk source
@@ -600,10 +659,14 @@ qemuBlockStorageSourceGetBackendProps(virStorageSourcePtr
src)
return NULL;
break;
+ case VIR_STORAGE_NET_PROTOCOL_ISCSI:
+ if (!(fileprops = qemuBlockStorageSourceGetISCSIProps(src)))
+ return NULL;
+ break;
+
case VIR_STORAGE_NET_PROTOCOL_NBD:
case VIR_STORAGE_NET_PROTOCOL_RBD:
case VIR_STORAGE_NET_PROTOCOL_SHEEPDOG:
- case VIR_STORAGE_NET_PROTOCOL_ISCSI:
case VIR_STORAGE_NET_PROTOCOL_HTTP:
case VIR_STORAGE_NET_PROTOCOL_HTTPS:
case VIR_STORAGE_NET_PROTOCOL_FTP:
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 908c3d21a9..ce1304e5db 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -1312,7 +1312,8 @@ qemuDiskBusNeedsDeviceArg(int bus)
* the legacy representation.
*/
static bool
-qemuDiskSourceNeedsProps(virStorageSourcePtr src)
+qemuDiskSourceNeedsProps(virStorageSourcePtr src,
+ virQEMUCapsPtr qemuCaps)
{
int actualType = virStorageSourceGetActualType(src);
@@ -1325,6 +1326,11 @@ qemuDiskSourceNeedsProps(virStorageSourcePtr src)
src->protocol == VIR_STORAGE_NET_PROTOCOL_VXHS)
return true;
+ if (actualType == VIR_STORAGE_TYPE_NETWORK &&
+ src->protocol == VIR_STORAGE_NET_PROTOCOL_ISCSI &&
+ virQEMUCapsGet(qemuCaps, QEMU_CAPS_ISCSI_PASSWORD_SECRET))
+ return true;
+
return false;
}
@@ -1368,7 +1374,7 @@ qemuBuildDriveSourceStr(virDomainDiskDefPtr disk,
char *source = NULL;
int ret = -1;
- if (qemuDiskSourceNeedsProps(disk->src) &&
+ if (qemuDiskSourceNeedsProps(disk->src, qemuCaps) &&
!(srcprops = qemuDiskSourceGetProps(disk->src)))
goto cleanup;
@@ -1434,7 +1440,9 @@ qemuBuildDriveSourceStr(virDomainDiskDefPtr disk,
virBufferAsprintf(buf, "file.debug=%d,", cfg->glusterDebugLevel);
}
- if (secinfo && secinfo->type == VIR_DOMAIN_SECRET_INFO_TYPE_AES) {
+ if (secinfo && secinfo->type == VIR_DOMAIN_SECRET_INFO_TYPE_AES &&
+ disk->src->type == VIR_STORAGE_TYPE_NETWORK &&
+ disk->src->protocol == VIR_STORAGE_NET_PROTOCOL_RBD) {
/* NB: If libvirt starts using the more modern option based
* syntax to build the command line (e.g., "-drive driver=rbd,
* filename=%s,...") instead of the legacy model (e.g."-drive
@@ -4947,22 +4955,36 @@ qemuBuildSCSIHostHostdevDrvStr(virDomainHostdevDefPtr
dev)
}
static char *
-qemuBuildSCSIiSCSIHostdevDrvStr(virDomainHostdevDefPtr dev)
+qemuBuildSCSIiSCSIHostdevDrvStr(virDomainHostdevDefPtr dev,
+ virQEMUCapsPtr qemuCaps)
{
char *source = NULL;
char *netsource = NULL;
+ virJSONValuePtr srcprops = NULL;
virDomainHostdevSubsysSCSIPtr scsisrc = &dev->source.subsys.u.scsi;
virDomainHostdevSubsysSCSIiSCSIPtr iscsisrc = &scsisrc->u.iscsi;
qemuDomainStorageSourcePrivatePtr srcPriv =
QEMU_DOMAIN_STORAGE_SOURCE_PRIVATE(iscsisrc->src);
- /* Rather than pull what we think we want - use the network disk code */
- netsource = qemuBuildNetworkDriveStr(iscsisrc->src, srcPriv ?
- srcPriv->secinfo : NULL);
- if (!netsource)
- goto cleanup;
- if (virAsprintf(&source, "file=%s,if=none,format=raw", netsource) < 0)
- goto cleanup;
+ if (qemuDiskSourceNeedsProps(iscsisrc->src, qemuCaps)) {
+ if (!(srcprops = qemuDiskSourceGetProps(iscsisrc->src))) {
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+ _("failed to build the backend props"));
+ goto cleanup;
+ }
+
+ if (!(netsource = virQEMUBuildDriveCommandlineFromJSON(srcprops)))
+ goto cleanup;
+ if (virAsprintf(&source, "%s,if=none,format=raw", netsource) < 0)
+ goto cleanup;
+ } else {
+ /* Rather than pull what we think we want - use the network disk code
*/
+ if (!(netsource = qemuBuildNetworkDriveStr(iscsisrc->src, srcPriv ?
+ srcPriv->secinfo : NULL)))
+ goto cleanup;
+ if (virAsprintf(&source, "file=%s,if=none,format=raw", netsource) < 0)
+ goto cleanup;
+ }
cleanup:
VIR_FREE(netsource);
@@ -5008,7 +5030,8 @@ qemuBuildSCSIVHostHostdevDevStr(const virDomainDef *def,
}
char *
-qemuBuildSCSIHostdevDrvStr(virDomainHostdevDefPtr dev)
+qemuBuildSCSIHostdevDrvStr(virDomainHostdevDefPtr dev,
+ virQEMUCapsPtr qemuCaps)
{
virBuffer buf = VIR_BUFFER_INITIALIZER;
char *source = NULL;
@@ -5016,7 +5039,7 @@ qemuBuildSCSIHostdevDrvStr(virDomainHostdevDefPtr dev)
virDomainHostdevSubsysSCSIPtr scsisrc = &dev->source.subsys.u.scsi;
if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) {
- if (!(source = qemuBuildSCSIiSCSIHostdevDrvStr(dev)))
+ if (!(source = qemuBuildSCSIiSCSIHostdevDrvStr(dev, qemuCaps)))
goto error;
virBufferAsprintf(&buf, "%s", source);
} else {
@@ -5515,10 +5538,24 @@ qemuBuildHostdevCommandLine(virCommandPtr cmd,
/* SCSI */
if (virHostdevIsSCSIDevice(hostdev)) {
if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_DEVICE_SCSI_GENERIC)) {
+ virDomainHostdevSubsysSCSIPtr scsisrc =
+ &hostdev->source.subsys.u.scsi;
char *drvstr;
+ if (scsisrc->protocol ==
VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI) {
+ virDomainHostdevSubsysSCSIiSCSIPtr iscsisrc =
+ &scsisrc->u.iscsi;
+ qemuDomainStorageSourcePrivatePtr srcPriv =
+ QEMU_DOMAIN_STORAGE_SOURCE_PRIVATE(iscsisrc->src);
+
+ if (qemuBuildDiskSecinfoCommandLine(cmd, srcPriv ?
+ srcPriv->secinfo :
+ NULL) < 0)
+ return -1;
+ }
+
virCommandAddArg(cmd, "-drive");
- if (!(drvstr = qemuBuildSCSIHostdevDrvStr(hostdev)))
+ if (!(drvstr = qemuBuildSCSIHostdevDrvStr(hostdev, qemuCaps)))
return -1;
virCommandAddArg(cmd, drvstr);
VIR_FREE(drvstr);
diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h
index dd01a42a40..e51f4da5ff 100644
--- a/src/qemu/qemu_command.h
+++ b/src/qemu/qemu_command.h
@@ -151,7 +151,8 @@ char *qemuBuildUSBHostdevDevStr(const virDomainDef *def,
virDomainHostdevDefPtr dev,
virQEMUCapsPtr qemuCaps);
-char *qemuBuildSCSIHostdevDrvStr(virDomainHostdevDefPtr dev);
+char *qemuBuildSCSIHostdevDrvStr(virDomainHostdevDefPtr dev,
+ virQEMUCapsPtr qemuCaps);
char *qemuBuildSCSIHostdevDevStr(const virDomainDef *def,
virDomainHostdevDefPtr dev,
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index f4ce1ad71e..5021450fa1 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -1184,9 +1184,13 @@ qemuDomainSecretSetup(virConnectPtr conn,
virSecretLookupTypeDefPtr seclookupdef,
bool isLuks)
{
+ bool iscsiHasPS = virQEMUCapsGet(priv->qemuCaps,
+ QEMU_CAPS_ISCSI_PASSWORD_SECRET);
+
if (virCryptoHaveCipher(VIR_CRYPTO_CIPHER_AES256CBC) &&
virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_OBJECT_SECRET) &&
(usageType == VIR_SECRET_USAGE_TYPE_CEPH ||
+ (usageType == VIR_SECRET_USAGE_TYPE_ISCSI && iscsiHasPS) ||
usageType == VIR_SECRET_USAGE_TYPE_VOLUME ||
usageType == VIR_SECRET_USAGE_TYPE_TLS)) {
if (qemuDomainSecretAESSetup(conn, priv, secinfo, srcalias,
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index ad274a9959..b4984378ee 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -2259,6 +2259,7 @@ qemuDomainAttachHostSCSIDevice(virConnectPtr conn,
virDomainHostdevDefPtr hostdev)
{
size_t i;
+ int rv;
int ret = -1;
qemuDomainObjPrivatePtr priv = vm->privateData;
virErrorPtr orig_err;
@@ -2269,6 +2270,12 @@ qemuDomainAttachHostSCSIDevice(virConnectPtr conn,
bool teardownlabel = false;
bool teardowndevice = false;
bool driveAdded = false;
+ bool secobjAdded = false;
+ virJSONValuePtr secobjProps = NULL;
+ virDomainHostdevSubsysSCSIPtr scsisrc = &hostdev->source.subsys.u.scsi;
+ virDomainHostdevSubsysSCSIiSCSIPtr iscsisrc = &scsisrc->u.iscsi;
+ qemuDomainStorageSourcePrivatePtr srcPriv;
+ qemuDomainSecretInfoPtr secinfo;
if (!virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_DEVICE_SCSI_GENERIC)) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
@@ -2309,7 +2316,14 @@ qemuDomainAttachHostSCSIDevice(virConnectPtr conn,
if (qemuDomainSecretHostdevPrepare(conn, priv, hostdev) < 0)
goto cleanup;
- if (!(drvstr = qemuBuildSCSIHostdevDrvStr(hostdev)))
+ srcPriv = QEMU_DOMAIN_STORAGE_SOURCE_PRIVATE(iscsisrc->src);
+ secinfo = srcPriv->secinfo;
+ if (secinfo && secinfo->type == VIR_DOMAIN_SECRET_INFO_TYPE_AES) {
+ if (qemuBuildSecretInfoProps(secinfo, &secobjProps) < 0)
+ goto cleanup;
+ }
+
+ if (!(drvstr = qemuBuildSCSIHostdevDrvStr(hostdev, priv->qemuCaps)))
goto cleanup;
if (!(drivealias = qemuAliasFromHostdev(hostdev)))
@@ -2323,6 +2337,15 @@ qemuDomainAttachHostSCSIDevice(virConnectPtr conn,
qemuDomainObjEnterMonitor(driver, vm);
+ if (secobjProps) {
+ rv = qemuMonitorAddObject(priv->mon, "secret", secinfo->s.aes.alias,
+ secobjProps);
+ secobjProps = NULL; /* qemuMonitorAddObject consumes */
+ if (rv < 0)
+ goto exit_monitor;
+ secobjAdded = true;
+ }
+
if (qemuMonitorAddDrive(priv->mon, drvstr) < 0)
goto exit_monitor;
driveAdded = true;
@@ -2340,7 +2363,6 @@ qemuDomainAttachHostSCSIDevice(virConnectPtr conn,
ret = 0;
cleanup:
- qemuDomainSecretHostdevDestroy(hostdev);
if (ret < 0) {
qemuHostdevReAttachSCSIDevices(driver, vm->def->name, &hostdev, 1);
if (teardowncgroup && qemuTeardownHostdevCgroup(vm, hostdev) < 0)
@@ -2352,6 +2374,8 @@ qemuDomainAttachHostSCSIDevice(virConnectPtr conn,
qemuDomainNamespaceTeardownHostdev(driver, vm, hostdev) < 0)
VIR_WARN("Unable to remove host device from /dev");
}
+ qemuDomainSecretHostdevDestroy(hostdev);
+ virJSONValueFree(secobjProps);
VIR_FREE(drivealias);
VIR_FREE(drvstr);
VIR_FREE(devstr);
@@ -2364,6 +2388,8 @@ qemuDomainAttachHostSCSIDevice(virConnectPtr conn,
"qemuMonitorAddDevice",
drvstr, devstr);
}
+ if (secobjAdded)
+ ignore_value(qemuMonitorDelObject(priv->mon, secinfo->s.aes.alias));
ignore_value(qemuDomainObjExitMonitor(driver, vm));
virErrorRestore(&orig_err);
@@ -3822,6 +3848,7 @@ qemuDomainRemoveHostDevice(virQEMUDriverPtr driver,
int ret = -1;
qemuDomainObjPrivatePtr priv = vm->privateData;
char *drivealias = NULL;
+ char *objAlias = NULL;
bool is_vfio = false;
VIR_DEBUG("Removing host device %s from domain %p %s",
@@ -3833,11 +3860,29 @@ qemuDomainRemoveHostDevice(virQEMUDriverPtr driver,
}
if (hostdev->source.subsys.type == VIR_DOMAIN_HOSTDEV_SUBSYS_TYPE_SCSI) {
+ virDomainHostdevSubsysSCSIPtr scsisrc = &hostdev->source.subsys.u.scsi;
+ virDomainHostdevSubsysSCSIiSCSIPtr iscsisrc = &scsisrc->u.iscsi;
+
if (!(drivealias = qemuAliasFromHostdev(hostdev)))
goto cleanup;
+ /* Look for the markers that the iSCSI hostdev was added with a
+ * secret object to manage the username/password. If present, let's
+ * attempt to remove the object as well. */
+ if (scsisrc->protocol == VIR_DOMAIN_HOSTDEV_SCSI_PROTOCOL_TYPE_ISCSI &&
+ virQEMUCapsGet(priv->qemuCaps, QEMU_CAPS_ISCSI_PASSWORD_SECRET) &&
+ qemuDomainSecretDiskCapable(iscsisrc->src)) {
+ if (!(objAlias = qemuDomainGetSecretAESAlias(hostdev->info->alias,
false)))
+ goto cleanup;
+ }
+
qemuDomainObjEnterMonitor(driver, vm);
qemuMonitorDriveDel(priv->mon, drivealias);
+
+ /* If it fails, then so be it - it was a best shot */
+ if (objAlias)
+ ignore_value(qemuMonitorDelObject(priv->mon, objAlias));
+
if (qemuDomainObjExitMonitor(driver, vm) < 0)
goto cleanup;
}
@@ -3909,6 +3954,7 @@ qemuDomainRemoveHostDevice(virQEMUDriverPtr driver,
cleanup:
VIR_FREE(drivealias);
+ VIR_FREE(objAlias);
virObjectUnref(cfg);
return ret;
}
diff --git
a/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-auth-AES.args
b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-auth-AES.args
new file mode 100644
index 0000000000..5bc5f4f477
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-auth-AES.args
@@ -0,0 +1,41 @@
+LC_ALL=C \
+PATH=/bin \
+HOME=/home/test \
+USER=test \
+LOGNAME=test \
+QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-i686 \
+-name QEMUGuest1 \
+-S \
+-object secret,id=masterKey0,format=raw,\
+file=/tmp/lib/domain--1-QEMUGuest1/master-key.aes \
+-M pc \
+-m 214 \
+-smp 1,sockets=1,cores=1,threads=1 \
+-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \
+-nographic \
+-nodefaults \
+-chardev
socket,id=charmonitor,path=/tmp/lib/domain--1-QEMUGuest1/monitor.sock,\
+server,nowait \
+-mon chardev=charmonitor,id=monitor,mode=readline \
+-no-acpi \
+-boot c \
+-usb \
+-object secret,id=virtio-disk0-secret0,\
+data=9eao5F8qtkGt+seB1HYivWIxbtwUu6MQtg1zpj/oDtUsPr1q8wBYM91uEHCn6j/1,\
+keyid=masterKey0,iv=AAECAwQFBgcICQoLDA0ODw==,format=base64 \
+-drive file.driver=iscsi,file.portal=example.org,\
+file.target=iqn.1992-01.com.example:storage,file.lun=1,file.transport=tcp,\
+file.user=myname,file.password-secret=virtio-disk0-secret0,format=raw,if=none,\
+id=drive-virtio-disk0 \
+-device virtio-blk-pci,bus=pci.0,addr=0x3,drive=drive-virtio-disk0,\
+id=virtio-disk0 \
+-object secret,id=virtio-disk1-secret0,\
+data=9eao5F8qtkGt+seB1HYivWIxbtwUu6MQtg1zpj/oDtUsPr1q8wBYM91uEHCn6j/1,\
+keyid=masterKey0,iv=AAECAwQFBgcICQoLDA0ODw==,format=base64 \
+-drive file.driver=iscsi,file.portal=example.org,\
+file.target=iqn.1992-01.com.example:storage,file.lun=2,file.transport=tcp,\
+file.user=myname,file.password-secret=virtio-disk1-secret0,format=raw,if=none,\
+id=drive-virtio-disk1 \
+-device virtio-blk-pci,bus=pci.0,addr=0x4,drive=drive-virtio-disk1,\
+id=virtio-disk1
diff --git
a/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-auth-AES.xml
b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-auth-AES.xml
new file mode 100644
index 0000000000..63919f1000
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-disk-drive-network-iscsi-auth-AES.xml
@@ -0,0 +1,43 @@
+<domain type='qemu'>
+ <name>QEMUGuest1</name>
+ <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid>
+ <memory unit='KiB'>219136</memory>
+ <currentMemory unit='KiB'>219136</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='i686' machine='pc'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>destroy</on_crash>
+ <devices>
+ <emulator>/usr/bin/qemu-system-i686</emulator>
+ <disk type='network' device='disk'>
+ <driver name='qemu' type='raw'/>
+ <auth username='myname'>
+ <secret type='iscsi' usage='mycluster_myname'/>
+ </auth>
+ <source protocol='iscsi' name='iqn.1992-01.com.example:storage/1'>
+ <host name='example.org' port='6000'/>
+ </source>
+ <target dev='vda' bus='virtio'/>
+ </disk>
+ <disk type='network' device='disk'>
+ <driver name='qemu' type='raw'/>
+ <auth username='myname'>
+ <secret type='iscsi' usage='mycluster_myname'/>
+ </auth>
+ <source protocol='iscsi' name='iqn.1992-01.com.example:storage/2'>
+ <host name='example.org' port='6000'/>
+ </source>
+ <target dev='vdb' bus='virtio'/>
+ </disk>
+ <controller type='usb' index='0'/>
+ <controller type='pci' index='0' model='pci-root'/>
+ <input type='mouse' bus='ps2'/>
+ <input type='keyboard' bus='ps2'/>
+ <memballoon model='none'/>
+ </devices>
+</domain>
diff --git
a/tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-virtio-iscsi-auth-AES.args
b/tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-virtio-iscsi-auth-AES.args
new file mode 100644
index 0000000000..c6051ecb07
--- /dev/null
+++
b/tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-virtio-iscsi-auth-AES.args
@@ -0,0 +1,45 @@
+LC_ALL=C \
+PATH=/bin \
+HOME=/home/test \
+USER=test \
+LOGNAME=test \
+QEMU_AUDIO_DRV=none \
+/usr/bin/qemu-system-i686 \
+-name QEMUGuest2 \
+-S \
+-object secret,id=masterKey0,format=raw,\
+file=/tmp/lib/domain--1-QEMUGuest2/master-key.aes \
+-M pc \
+-m 214 \
+-smp 1,sockets=1,cores=1,threads=1 \
+-uuid c7a5fdbd-edaf-9466-926a-d65c16db1809 \
+-nographic \
+-nodefaults \
+-chardev
socket,id=charmonitor,path=/tmp/lib/domain--1-QEMUGuest2/monitor.sock,\
+server,nowait \
+-mon chardev=charmonitor,id=monitor,mode=readline \
+-no-acpi \
+-boot c \
+-device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x3 \
+-usb \
+-drive file=/dev/HostVG/QEMUGuest2,format=raw,if=none,id=drive-ide0-0-0 \
+-device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 \
+-object secret,id=hostdev0-secret0,\
+data=9eao5F8qtkGt+seB1HYivWIxbtwUu6MQtg1zpj/oDtUsPr1q8wBYM91uEHCn6j/1,\
+keyid=masterKey0,iv=AAECAwQFBgcICQoLDA0ODw==,format=base64 \
+-drive file.driver=iscsi,file.portal=example.org,\
+file.target=iqn.1992-01.com.example:storage,file.lun=1,file.transport=tcp,\
+file.user=myname,file.password-secret=hostdev0-secret0,if=none,format=raw,\
+id=drive-hostdev0 \
+-device scsi-generic,bus=scsi0.0,channel=0,scsi-id=2,lun=4,\
+drive=drive-hostdev0,id=hostdev0 \
+-object secret,id=hostdev1-secret0,\
+data=9eao5F8qtkGt+seB1HYivWIxbtwUu6MQtg1zpj/oDtUsPr1q8wBYM91uEHCn6j/1,\
+keyid=masterKey0,iv=AAECAwQFBgcICQoLDA0ODw==,format=base64 \
+-drive file.driver=iscsi,file.portal=example.org,\
+file.target=iqn.1992-01.com.example:storage,file.lun=2,file.transport=tcp,\
+file.user=myname,file.password-secret=hostdev1-secret0,if=none,format=raw,\
+id=drive-hostdev1 \
+-device scsi-generic,bus=scsi0.0,channel=0,scsi-id=2,lun=5,\
+drive=drive-hostdev1,id=hostdev1 \
+-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x4
diff --git
a/tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-virtio-iscsi-auth-AES.xml
b/tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-virtio-iscsi-auth-AES.xml
new file mode 100644
index 0000000000..0f63f98872
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-hostdev-scsi-virtio-iscsi-auth-AES.xml
@@ -0,0 +1,48 @@
+<domain type='qemu'>
+ <name>QEMUGuest2</name>
+ <uuid>c7a5fdbd-edaf-9466-926a-d65c16db1809</uuid>
+ <memory unit='KiB'>219100</memory>
+ <currentMemory unit='KiB'>219100</currentMemory>
+ <vcpu placement='static'>1</vcpu>
+ <os>
+ <type arch='i686' machine='pc'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>destroy</on_crash>
+ <devices>
+ <emulator>/usr/bin/qemu-system-i686</emulator>
+ <disk type='block' device='disk'>
+ <source dev='/dev/HostVG/QEMUGuest2'/>
+ <target dev='hda' bus='ide'/>
+ <address type='drive' controller='0' bus='0' target='0' unit='0'/>
+ </disk>
+ <controller type='scsi' index='0' model='virtio-scsi'/>
+ <controller type='usb' index='0'/>
+ <controller type='ide' index='0'/>
+ <controller type='pci' index='0' model='pci-root'/>
+ <input type='mouse' bus='ps2'/>
+ <input type='keyboard' bus='ps2'/>
+ <hostdev mode='subsystem' type='scsi' managed='yes'>
+ <source protocol='iscsi' name='iqn.1992-01.com.example:storage/1'>
+ <host name='example.org' port='3260'/>
+ <auth username='myname'>
+ <secret type='iscsi' usage='mycluster_myname'/>
+ </auth>
+ </source>
+ <address type='drive' controller='0' bus='0' target='2' unit='4'/>
+ </hostdev>
+ <hostdev mode='subsystem' type='scsi' managed='yes'>
+ <source protocol='iscsi' name='iqn.1992-01.com.example:storage/2'>
+ <host name='example.org' port='3260'/>
+ <auth username='myname'>
+ <secret type='iscsi' usage='mycluster_myname'/>
+ </auth>
+ </source>
+ <address type='drive' controller='0' bus='0' target='2' unit='5'/>
+ </hostdev>
+ <memballoon model='virtio'/>
+ </devices>
+</domain>
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index 2e07b85aa6..00fc16f8a2 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -933,6 +933,10 @@ mymain(void)
DO_TEST_PARSE_ERROR("disk-drive-network-iscsi-auth-secrettype-invalid",
NONE);
DO_TEST_PARSE_ERROR("disk-drive-network-iscsi-auth-wrong-secrettype",
NONE);
DO_TEST_PARSE_ERROR("disk-drive-network-source-auth-both", NONE);
+# ifdef HAVE_GNUTLS_CIPHER_ENCRYPT
+ DO_TEST("disk-drive-network-iscsi-auth-AES",
+ QEMU_CAPS_OBJECT_SECRET, QEMU_CAPS_ISCSI_PASSWORD_SECRET);
+# endif
DO_TEST("disk-drive-network-iscsi-lun",
QEMU_CAPS_NODEFCONFIG, QEMU_CAPS_VIRTIO_SCSI,
QEMU_CAPS_SCSI_BLOCK);
@@ -2335,6 +2339,12 @@ mymain(void)
DO_TEST("hostdev-scsi-virtio-iscsi-auth",
QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_VIRTIO_SCSI,
QEMU_CAPS_DEVICE_SCSI_GENERIC);
+# ifdef HAVE_GNUTLS_CIPHER_ENCRYPT
+ DO_TEST("hostdev-scsi-virtio-iscsi-auth-AES",
+ QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_VIRTIO_SCSI,
+ QEMU_CAPS_DEVICE_SCSI_GENERIC, QEMU_CAPS_OBJECT_SECRET,
+ QEMU_CAPS_ISCSI_PASSWORD_SECRET);
+# endif
DO_TEST("hostdev-scsi-vhost-scsi-ccw",
QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_DEVICE_VHOST_SCSI,
QEMU_CAPS_DEVICE_SCSI_GENERIC, QEMU_CAPS_VIRTIO_CCW);
--
2.13.6
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
