Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
For regular migration libvirt uses the 'tls-hostname' field of 'MigrateSetParameters' QAPI struct to override the name which is used to validate the TLS certificate of the server against if the client wihes so.
For non-shared-storage migration libvirt exports the disks on the destination side via the builtin NBD server. The source part then blockdev-adds the NBD exports and uses the 'mirror' job to copy over the storage. Unfortunately the NBD client used by the block code doesn't allow us to do the same override as the migration code, which breaks migration in the cases where the name can't be matched without the override.
+++ This bug was initially created as a clone of Bug #1901394 +++
Description of problem:
When do vm migration with copy storage and tls enabled, --tls-destination doesn't take effect for disk migration
Version-Release number of selected component (if applicable):
libvirt-6.6.0-8
How reproducible:
100%
Steps to Reproduce:
1.Do vm migration with copy storage and tls enabled, specify the migrateuri, disksuri and tls destination:
# virsh migrate avocado-vt-vm1 qemu+unix://<dest host>/system --live --p2p --migrateuri tcp://10.16.218.252:49156 --tls --tls-destination <dest hostname> --copy-storage-all --disks-uri tcp://192.168.100.6:49156
error: internal error: unable to execute QEMU command 'blockdev-add': Certificate does not match the hostname 192.168.100.6
2.Do vm migration with copy storage and tls enabled, specify the migrateuri, tls destination
# virsh migrate avocado-vt-vm1 qemu+unix://<dest host>/system --live ---p2p --migrateuri tcp://10.16.218.252:49156 --tls --tls-destination <dest hostname> --copy-storage-all
error: internal error: unable to execute QEMU command 'blockdev-add': Certificate does not match the hostname 10.16.218.252
Test on qemu-kvm-6.2.0-11.el9, can reproduce this issue.
#cat server.info
organization = Red Hat
cn = $dst_hostname
tls_www_server
encryption_key
signing_key
#virsh migrate rhel9 --desturi qemu+unix:///system?socket=/tmp/test.sock --live --verbose --copy-storage-all --tls --p2p --migrateuri tcp://$dst_hostip:49156 --tls-destination $dst_hostname
error: internal error: unable to execute QEMU command 'blockdev-add': Certificate does not match the hostname $dst_hostip
Test with qemu-kvm-7.0.0-1.el9 and without --disks-uri, don't hit this issue any more.
In src:
#virsh start rhel9
Domain 'rhel9' started
# virsh list
Id Name State
-----------------------
1 rhel9 running
# virsh migrate rhel9 --desturi qemu+unix:///system?socket=/tmp/test.sock --live --verbose --copy-storage-all --tls --p2p --migrateuri tcp://10.73.114.14:49156 --tls-destination dell-per440-09.lab.eng.pek2.redhat.com
Migration: [100 %]
In dst:
# virsh list
Id Name State
-----------------------
1 rhel9 running
Test with qemu-kvm-7.0.0-1.el9/libvirt-8.3.0-1.el9.x86_64 and --disks-uri, don't hit this issue any more.
In src:
# virsh start rhel9
Domain 'rhel9' started
# virsh list
Id Name State
-----------------------
1 rhel9 running
# virsh migrate rhel9 --desturi qemu+unix:///system?socket=/tmp/test.sock --live --verbose --copy-storage-all --tls --p2p --migrateuri tcp://10.73.114.14:49156 --tls-destination dell-per440-09.lab.eng.pek2.redhat.com --disks-uri tcp://10.73.114.14:49157
Migration: [100 %]
In dst:
# virsh list
Id Name State
-----------------------
1 rhel9 running