Bug 729874

Btw , we keep the same spice cert files when doing the testing on both the old libvirt version and the new libvirt version . And with the old libvirt version , the spice session could be kept . With the new libvirt version , spice session would be interrupted .

19:55:34.660: 24254: error : qemuDomainExtractTLSSubject:164 : internal
error cannot initialize cert object: ASN1 parser: Element was not found.

This error comes from 

    ret = gnutls_x509_crt_init(&cert);
    if (ret < 0) {
        qemuReportError(VIR_ERR_INTERNAL_ERROR,
                        _("cannot initialize cert object: %s"),
                        gnutls_strerror(ret));
        goto error;
    }

so it happens before checking the spice certificate.
gnutls_x509_crt_init is 

int
gnutls_x509_crt_init (gnutls_x509_crt_t * cert)
{
  gnutls_x509_crt_t tmp = gnutls_calloc (1, sizeof (gnutls_x509_crt_int));
  int result;

  if (!tmp)
    return GNUTLS_E_MEMORY_ERROR;

  result = asn1_create_element (_gnutls_get_pkix (),
                                "PKIX1.Certificate", &tmp->cert);
  if (result != ASN1_SUCCESS)
    {
      gnutls_assert ();
      gnutls_free (tmp);
      return _gnutls_asn2err (result);
    }

  /* If you add anything here, be sure to check if it has to be added
     to gnutls_x509_crt_import as well. */

  *cert = tmp;

  return 0;                     /* success */
}

it it seems it's failing in the asn1_create_element call. Given the error message, I'd guess that _gnutls_get_pkix() doesn't contain the "PKIX1.Certificate" element. _gnutls_get_pkix() is initialized in gnutls_global_init(), and doing a git grep on libvirt source, I can only find 2 occurrences:
src/rpc/virnettlscontext.c:    gnutls_global_init();
tests/virnettlscontexttest.c:    gnutls_global_init();

Could it be that a call to gnutls_global_init() is missing in libvirt? Or did I get misled somewhere on the way?

> Could it be that a call to gnutls_global_init() is missing in libvirt? Or did I
> get misled somewhere on the way?

This sounds like most likely cause. If  libvirtd itself is not configured to use TLS, they we could be missing the call to gnutls_global_init().

Patch sent upstream:

https://www.redhat.com/archives/libvir-list/2011-August/msg00785.html

Moving to POST:

http://post-office.corp.redhat.com/archives/rhvirt-patches/2011-August/msg00540.html


commit 4e9ad9a46dc8bb50e65c7b544072f66377fd54a7
Author: Michal Privoznik <mprivozn>
Date:   Thu Aug 18 10:44:08 2011 +0200

    daemon: initialize GnuTLS
    
    When spice_tls is set but listen_tls is not, we don't initialize
    GnuTLS library. So any later gnutls call (e.g. during migration,
    where we initialize a certificate) will access uninitialized GnuTLS
    internal structs and throws an error.
    
    Although, we might now initialize GnuTLS twice, it is safe according
    to the documentation:
    
        This function can be called many times,
        but will only do something the first time.
    
    This patch creates 2 functions: virNetTLSInit and virNetTLSDeinit
    with respect to written above.
    (cherry picked from commit 74c75671331d284e1f777f9692b72e9737520bf0)

verify pass on 
kernel-2.6.32-191.el6.x86_64
qemu-kvm-0.12.1.2-2.184.el6.x86_64
libvirt-0.9.4-5.el6.x86_64

After live migration, spice session is still alive and no error in libvirtd.log.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1513.html