Commit e1226365 authored by Daniel P. Berrangé's avatar Daniel P. Berrangé Committed by Amit Shah
Browse files

migration: add support for encrypting data with TLS 



This extends the migration_set_incoming_channel and
migration_set_outgoing_channel methods so that they
will automatically wrap the QIOChannel in a
QIOChannelTLS instance if TLS credentials are configured
in the migration parameters.

This allows TLS to work for tcp, unix, fd and exec
migration protocols. It does not (currently) work for
RDMA since it does not use these APIs, but it is
unlikely that TLS would be desired with RDMA anyway
since it would degrade the performance to that seen
with TCP defeating the purpose of using RDMA.

On the target host, QEMU would be launched with a set
of TLS credentials for a server endpoint

 $ qemu-system-x86_64 -monitor stdio -incoming defer \
    -object tls-creds-x509,dir=/home/berrange/security/qemutls,endpoint=server,id=tls0 \
    ...other args...

To enable incoming TLS migration 2 monitor commands are
then used

  (qemu) migrate_set_str_parameter tls-creds tls0
  (qemu) migrate_incoming tcp:myhostname:9000

On the source host, QEMU is launched in a similar
manner but using client endpoint credentials

 $ qemu-system-x86_64 -monitor stdio \
    -object tls-creds-x509,dir=/home/berrange/security/qemutls,endpoint=client,id=tls0 \
    ...other args...

To enable outgoing TLS migration 2 monitor commands are
then used

  (qemu) migrate_set_str_parameter tls-creds tls0
  (qemu) migrate tcp:otherhostname:9000

Thanks to earlier improvements to error reporting,
TLS errors can be seen 'info migrate' when doing a
detached migration. For example:

  (qemu) info migrate
  capabilities: xbzrle: off rdma-pin-all: off auto-converge: off zero-blocks: off compress: off events: off x-postcopy-ram: off
  Migration status: failed
  total time: 0 milliseconds
  error description: TLS handshake failed: The TLS connection was non-properly terminated.

Or

  (qemu) info migrate
  capabilities: xbzrle: off rdma-pin-all: off auto-converge: off zero-blocks: off compress: off events: off x-postcopy-ram: off
  Migration status: failed
  total time: 0 milliseconds
  error description: Certificate does not match the hostname localhost

Reviewed-by: default avatarDr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: default avatarDaniel P. Berrange <berrange@redhat.com>
Message-Id: <1461751518-12128-27-git-send-email-berrange@redhat.com>
Signed-off-by: default avatarAmit Shah <amit.shah@redhat.com>
parent 69ef1f36

include/migration/migration.h

+11 −1
Original line number Diff line number Diff line
@@ -188,8 +188,18 @@ void qemu_start_incoming_migration(const char *uri, Error **errp); 
void migration_set_incoming_channel(MigrationState *s,

                                    QIOChannel *ioc);



void migration_tls_set_incoming_channel(MigrationState *s,

                                        QIOChannel *ioc,

                                        Error **errp);



void migration_set_outgoing_channel(MigrationState *s,

                                    QIOChannel *ioc);

                                    QIOChannel *ioc,

                                    const char *hostname);



void migration_tls_set_outgoing_channel(MigrationState *s,

                                        QIOChannel *ioc,

                                        const char *hostname,

                                        Error **errp);



uint64_t migrate_max_downtime(void);

migration/Makefile.objs

+1 −0
Original line number Diff line number Diff line 
common-obj-y += migration.o socket.o fd.o exec.o

common-obj-y += tls.o

common-obj-y += vmstate.o

common-obj-y += qemu-file.o

common-obj-y += qemu-file-channel.o

migration/exec.c

+1 −1
Original line number Diff line number Diff line
@@ -38,7 +38,7 @@ void exec_start_outgoing_migration(MigrationState *s, const char *command, Error 
        return;

    }



    migration_set_outgoing_channel(s, ioc);

    migration_set_outgoing_channel(s, ioc, NULL);

    object_unref(OBJECT(ioc));

}

migration/fd.c

+1 −1
Original line number Diff line number Diff line
@@ -38,7 +38,7 @@ void fd_start_outgoing_migration(MigrationState *s, const char *fdname, Error ** 
        return;

    }



    migration_set_outgoing_channel(s, ioc);

    migration_set_outgoing_channel(s, ioc, NULL);

    object_unref(OBJECT(ioc));

}

migration/migration.c

+34 −6
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ 
#include "exec/memory.h"

#include "exec/address-spaces.h"

#include "io/channel-buffer.h"

#include "io/channel-tls.h"



#define MAX_THROTTLE  (32 << 20)      /* Migration transfer speed throttling */
@@ -428,21 +429,48 @@ void process_incoming_migration(QEMUFile *f) 
void migration_set_incoming_channel(MigrationState *s,

                                    QIOChannel *ioc)

{

    QEMUFile *f = qemu_fopen_channel_input(ioc);

    trace_migration_set_incoming_channel(

        ioc, object_get_typename(OBJECT(ioc)));



    if (s->parameters.tls_creds &&

        !object_dynamic_cast(OBJECT(ioc),

                             TYPE_QIO_CHANNEL_TLS)) {

        Error *local_err = NULL;

        migration_tls_set_incoming_channel(s, ioc, &local_err);

        if (local_err) {

            error_report_err(local_err);

        }

    } else {

        QEMUFile *f = qemu_fopen_channel_input(ioc);

        process_incoming_migration(f);

    }

}





void migration_set_outgoing_channel(MigrationState *s,

                                    QIOChannel *ioc)

                                    QIOChannel *ioc,

                                    const char *hostname)

{

    trace_migration_set_outgoing_channel(

        ioc, object_get_typename(OBJECT(ioc)), hostname);



    if (s->parameters.tls_creds &&

        !object_dynamic_cast(OBJECT(ioc),

                             TYPE_QIO_CHANNEL_TLS)) {

        Error *local_err = NULL;

        migration_tls_set_outgoing_channel(s, ioc, hostname, &local_err);

        if (local_err) {

            migrate_fd_error(s, local_err);

            error_free(local_err);

        }

    } else {

        QEMUFile *f = qemu_fopen_channel_output(ioc);



        s->to_dst_file = f;



        migrate_fd_connect(s);

    }

}





/*