Bug 1901448
| Summary: | nbd+tls: Allow override of name used for verification of TLS certificate | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Peter Krempa <pkrempa> |
| Component: | qemu-kvm | Assignee: | Eric Blake <eblake> |
| qemu-kvm sub component: | NBD | QA Contact: | aihua liang <aliang> |
| Status: | CLOSED CURRENTRELEASE | Docs Contact: | |
| Severity: | medium | ||
| Priority: | medium | CC: | coli, eblake, fjin, hhan, jinzhao, juzhang, kkiwi, lmen, ngu, smitterl, virt-bugs, virt-maint, xiaohli, yafu |
| Version: | unspecified | Keywords: | Triaged |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1901394 | Environment: | |
| Last Closed: | 2022-05-13 06:29:22 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1901394 | ||
|
Description
Peter Krempa
2020-11-25 09:26:30 UTC
Version: qemu-kvm-5.1.0-15 Fixing this may also be a good time to get TLS working over Unix sockets in qemu. See the following thread for the last time it was discussed: https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg01334.html https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg01581.html I'm having a hard-time thinking in how to prioritize this... (In reply to Eric Blake from comment #2) > Fixing this may also be a good time to get TLS working over Unix sockets in > qemu. See the following thread for the last time it was discussed: > > https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg01334.html > https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg01581.html Are you suggesting that this may be a dependency for this work? Are you still the right person for this to be assigned to? Bulk update: Move RHEL-AV bugs to RHEL9. If necessary to resolve in RHEL8, then clone to the current RHEL8 release. Dan landed the following patches into upstream 7.0, plus accompanying testsuite improvements, that should address this:
Daniel P. Berrangé (5):
crypto: mandate a hostname when checking x509 creds on a client
block: pass desired TLS hostname through from block driver client
block/nbd: support override of hostname for TLS certificate validation
qemu-nbd: add --tls-hostname option for TLS certificate validation
block/nbd: don't restrict TLS usage to IP sockets
https://lists.gnu.org/archive/html/qemu-devel/2022-03/msg02398.html, commit fdee2c96923dfd38aa7a264abb7de6d403f81c4d
Test on qemu-kvm-6.2.0-11.el9, can reproduce this issue. #cat server.info organization = Red Hat cn = $dst_hostname tls_www_server encryption_key signing_key #virsh migrate rhel9 --desturi qemu+unix:///system?socket=/tmp/test.sock --live --verbose --copy-storage-all --tls --p2p --migrateuri tcp://$dst_hostip:49156 --tls-destination $dst_hostname error: internal error: unable to execute QEMU command 'blockdev-add': Certificate does not match the hostname $dst_hostip Test with qemu-kvm-7.0.0-1.el9 and without --disks-uri, don't hit this issue any more. In src: #virsh start rhel9 Domain 'rhel9' started # virsh list Id Name State ----------------------- 1 rhel9 running # virsh migrate rhel9 --desturi qemu+unix:///system?socket=/tmp/test.sock --live --verbose --copy-storage-all --tls --p2p --migrateuri tcp://10.73.114.14:49156 --tls-destination dell-per440-09.lab.eng.pek2.redhat.com Migration: [100 %] In dst: # virsh list Id Name State ----------------------- 1 rhel9 running Test with qemu-kvm-7.0.0-1.el9/libvirt-8.3.0-1.el9.x86_64 and --disks-uri, don't hit this issue any more. In src: # virsh start rhel9 Domain 'rhel9' started # virsh list Id Name State ----------------------- 1 rhel9 running # virsh migrate rhel9 --desturi qemu+unix:///system?socket=/tmp/test.sock --live --verbose --copy-storage-all --tls --p2p --migrateuri tcp://10.73.114.14:49156 --tls-destination dell-per440-09.lab.eng.pek2.redhat.com --disks-uri tcp://10.73.114.14:49157 Migration: [100 %] In dst: # virsh list Id Name State ----------------------- 1 rhel9 running |