mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-27 19:11:16 +00:00
conf: Add new secret type "tls"
Add a new secret usage type known as "tls" - it will handle adding the secret objects for various TLS objects that need to provide some sort of passphrase in order to access the credentials. The format is: <secret ephemeral='no' private='no'> <description>Sample TLS secret</description> <usage type='tls'> <name>mumblyfratz</name> </usage> </secret> Once defined and a passphrase set, future patches will allow the UUID to be set in the qemu.conf file and thus used as a secret for various TLS options such as a chardev serial TCP connection, a NBD client/server connection, and migration. Signed-off-by: John Ferlan <jferlan@redhat.com>
This commit is contained in:
parent
2c3223785c
commit
13350a17e4
@ -224,6 +224,10 @@
|
|||||||
<td>secret_usage_target</td>
|
<td>secret_usage_target</td>
|
||||||
<td>Name of the associated iSCSI target, if any</td>
|
<td>Name of the associated iSCSI target, if any</td>
|
||||||
</tr>
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>secret_usage_name</td>
|
||||||
|
<td>Name of the associated TLS secret, if any</td>
|
||||||
|
</tr>
|
||||||
</tbody>
|
</tbody>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
@ -41,8 +41,9 @@
|
|||||||
<dd>
|
<dd>
|
||||||
Specifies what this secret is used for. A mandatory
|
Specifies what this secret is used for. A mandatory
|
||||||
<code>type</code> attribute specifies the usage category, currently
|
<code>type</code> attribute specifies the usage category, currently
|
||||||
only <code>volume</code>, <code>ceph</code>, and <code>iscsi</code>
|
only <code>volume</code>, <code>ceph</code>, <code>iscsi</code>,
|
||||||
are defined. Specific usage categories are described below.
|
and <code>tls</code> are defined. Specific usage categories
|
||||||
|
are described below.
|
||||||
</dd>
|
</dd>
|
||||||
</dl>
|
</dl>
|
||||||
|
|
||||||
@ -271,5 +272,59 @@
|
|||||||
</auth>
|
</auth>
|
||||||
</pre>
|
</pre>
|
||||||
|
|
||||||
|
<h3><a name="tlsUsageType">Usage type "tls"</a></h3>
|
||||||
|
|
||||||
|
<p>
|
||||||
|
This secret may be used in order to provide the passphrase for the
|
||||||
|
private key used to provide TLS credentials.
|
||||||
|
The <code><usage type='tls'></code> element must contain a
|
||||||
|
single <code>name</code> element that specifies a usage name
|
||||||
|
for the secret.
|
||||||
|
<span class="since">Since 2.3.0</span>.
|
||||||
|
The following is an example of the expected XML and processing to
|
||||||
|
define the secret:
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<pre>
|
||||||
|
# cat tls-secret.xml
|
||||||
|
<secret ephemeral='no' private='yes'>
|
||||||
|
<description>sample tls secret</description>
|
||||||
|
<usage type='tls'>
|
||||||
|
<name>TLS_example</name>
|
||||||
|
</usage>
|
||||||
|
</secret>
|
||||||
|
|
||||||
|
# virsh secret-define tls-secret.xml
|
||||||
|
Secret 718c71bd-67b5-4a2b-87ec-a24e8ca200dc created
|
||||||
|
|
||||||
|
# virsh secret-list
|
||||||
|
UUID Usage
|
||||||
|
-----------------------------------------------------------
|
||||||
|
718c71bd-67b5-4a2b-87ec-a24e8ca200dc tls TLS_example
|
||||||
|
#
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
|
||||||
|
<p>
|
||||||
|
A secret may also be defined via the
|
||||||
|
<a href="html/libvirt-libvirt-secret.html#virSecretDefineXML">
|
||||||
|
<code>virSecretDefineXML</code></a> API.
|
||||||
|
|
||||||
|
Once the secret is defined, a secret value will need to be set. The
|
||||||
|
secret would be the passphrase used to access the TLS credentials.
|
||||||
|
The following is a simple example of using
|
||||||
|
<code>virsh secret-set-value</code> to set the secret value. The
|
||||||
|
<a href="html/libvirt-libvirt-secret.html#virSecretSetValue">
|
||||||
|
<code>virSecretSetValue</code></a> API may also be used to set
|
||||||
|
a more secure secret without using printable/readable characters.
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<pre>
|
||||||
|
# MYSECRET=`printf %s "letmein" | base64`
|
||||||
|
# virsh secret-set-value 718c71bd-67b5-4a2b-87ec-a24e8ca200dc $MYSECRET
|
||||||
|
Secret value set
|
||||||
|
|
||||||
|
</pre>
|
||||||
|
|
||||||
</body>
|
</body>
|
||||||
</html>
|
</html>
|
||||||
|
@ -36,6 +36,7 @@
|
|||||||
<ref name='usagevolume'/>
|
<ref name='usagevolume'/>
|
||||||
<ref name='usageceph'/>
|
<ref name='usageceph'/>
|
||||||
<ref name='usageiscsi'/>
|
<ref name='usageiscsi'/>
|
||||||
|
<ref name='usagetls'/>
|
||||||
<!-- More choices later -->
|
<!-- More choices later -->
|
||||||
</choice>
|
</choice>
|
||||||
</element>
|
</element>
|
||||||
@ -71,4 +72,13 @@
|
|||||||
</element>
|
</element>
|
||||||
</define>
|
</define>
|
||||||
|
|
||||||
|
<define name='usagetls'>
|
||||||
|
<attribute name='type'>
|
||||||
|
<value>tls</value>
|
||||||
|
</attribute>
|
||||||
|
<element name='name'>
|
||||||
|
<ref name='genericName'/>
|
||||||
|
</element>
|
||||||
|
</define>
|
||||||
|
|
||||||
</grammar>
|
</grammar>
|
||||||
|
@ -43,6 +43,7 @@ typedef enum {
|
|||||||
VIR_SECRET_USAGE_TYPE_VOLUME = 1,
|
VIR_SECRET_USAGE_TYPE_VOLUME = 1,
|
||||||
VIR_SECRET_USAGE_TYPE_CEPH = 2,
|
VIR_SECRET_USAGE_TYPE_CEPH = 2,
|
||||||
VIR_SECRET_USAGE_TYPE_ISCSI = 3,
|
VIR_SECRET_USAGE_TYPE_ISCSI = 3,
|
||||||
|
VIR_SECRET_USAGE_TYPE_TLS = 4,
|
||||||
|
|
||||||
# ifdef VIR_ENUM_SENTINELS
|
# ifdef VIR_ENUM_SENTINELS
|
||||||
VIR_SECRET_USAGE_TYPE_LAST
|
VIR_SECRET_USAGE_TYPE_LAST
|
||||||
|
@ -338,6 +338,19 @@ virAccessDriverPolkitCheckSecret(virAccessManagerPtr manager,
|
|||||||
virAccessPermSecretTypeToString(perm),
|
virAccessPermSecretTypeToString(perm),
|
||||||
attrs);
|
attrs);
|
||||||
} break;
|
} break;
|
||||||
|
case VIR_SECRET_USAGE_TYPE_TLS: {
|
||||||
|
const char *attrs[] = {
|
||||||
|
"connect_driver", driverName,
|
||||||
|
"secret_uuid", uuidstr,
|
||||||
|
"secret_usage_name", secret->usage.name,
|
||||||
|
NULL,
|
||||||
|
};
|
||||||
|
|
||||||
|
return virAccessDriverPolkitCheck(manager,
|
||||||
|
"secret",
|
||||||
|
virAccessPermSecretTypeToString(perm),
|
||||||
|
attrs);
|
||||||
|
} break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -30,6 +30,7 @@
|
|||||||
#include "secret_conf.h"
|
#include "secret_conf.h"
|
||||||
#include "virsecretobj.h"
|
#include "virsecretobj.h"
|
||||||
#include "virerror.h"
|
#include "virerror.h"
|
||||||
|
#include "virstring.h"
|
||||||
#include "virxml.h"
|
#include "virxml.h"
|
||||||
#include "viruuid.h"
|
#include "viruuid.h"
|
||||||
|
|
||||||
@ -38,7 +39,7 @@
|
|||||||
VIR_LOG_INIT("conf.secret_conf");
|
VIR_LOG_INIT("conf.secret_conf");
|
||||||
|
|
||||||
VIR_ENUM_IMPL(virSecretUsage, VIR_SECRET_USAGE_TYPE_LAST,
|
VIR_ENUM_IMPL(virSecretUsage, VIR_SECRET_USAGE_TYPE_LAST,
|
||||||
"none", "volume", "ceph", "iscsi")
|
"none", "volume", "ceph", "iscsi", "tls")
|
||||||
|
|
||||||
const char *
|
const char *
|
||||||
virSecretUsageIDForDef(virSecretDefPtr def)
|
virSecretUsageIDForDef(virSecretDefPtr def)
|
||||||
@ -56,6 +57,9 @@ virSecretUsageIDForDef(virSecretDefPtr def)
|
|||||||
case VIR_SECRET_USAGE_TYPE_ISCSI:
|
case VIR_SECRET_USAGE_TYPE_ISCSI:
|
||||||
return def->usage.target;
|
return def->usage.target;
|
||||||
|
|
||||||
|
case VIR_SECRET_USAGE_TYPE_TLS:
|
||||||
|
return def->usage.name;
|
||||||
|
|
||||||
default:
|
default:
|
||||||
return NULL;
|
return NULL;
|
||||||
}
|
}
|
||||||
@ -85,6 +89,10 @@ virSecretDefFree(virSecretDefPtr def)
|
|||||||
VIR_FREE(def->usage.target);
|
VIR_FREE(def->usage.target);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
case VIR_SECRET_USAGE_TYPE_TLS:
|
||||||
|
VIR_FREE(def->usage.name);
|
||||||
|
break;
|
||||||
|
|
||||||
default:
|
default:
|
||||||
VIR_ERROR(_("unexpected secret usage type %d"), def->usage_type);
|
VIR_ERROR(_("unexpected secret usage type %d"), def->usage_type);
|
||||||
break;
|
break;
|
||||||
@ -145,6 +153,15 @@ virSecretDefParseUsage(xmlXPathContextPtr ctxt,
|
|||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
case VIR_SECRET_USAGE_TYPE_TLS:
|
||||||
|
def->usage.name = virXPathString("string(./usage/name)", ctxt);
|
||||||
|
if (!def->usage.name) {
|
||||||
|
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
|
||||||
|
_("TLS usage specified, but name is missing"));
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
|
||||||
default:
|
default:
|
||||||
virReportError(VIR_ERR_INTERNAL_ERROR,
|
virReportError(VIR_ERR_INTERNAL_ERROR,
|
||||||
_("unexpected secret usage type %d"),
|
_("unexpected secret usage type %d"),
|
||||||
@ -297,6 +314,10 @@ virSecretDefFormatUsage(virBufferPtr buf,
|
|||||||
virBufferEscapeString(buf, "<target>%s</target>\n", def->usage.target);
|
virBufferEscapeString(buf, "<target>%s</target>\n", def->usage.target);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
case VIR_SECRET_USAGE_TYPE_TLS:
|
||||||
|
virBufferEscapeString(buf, "<name>%s</name>\n", def->usage.name);
|
||||||
|
break;
|
||||||
|
|
||||||
default:
|
default:
|
||||||
virReportError(VIR_ERR_INTERNAL_ERROR,
|
virReportError(VIR_ERR_INTERNAL_ERROR,
|
||||||
_("unexpected secret usage type %d"),
|
_("unexpected secret usage type %d"),
|
||||||
|
@ -40,6 +40,7 @@ struct _virSecretDef {
|
|||||||
char *volume; /* May be NULL */
|
char *volume; /* May be NULL */
|
||||||
char *ceph;
|
char *ceph;
|
||||||
char *target;
|
char *target;
|
||||||
|
char *name;
|
||||||
} usage;
|
} usage;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -237,6 +237,11 @@ virSecretObjSearchName(const void *payload,
|
|||||||
if (STREQ(secret->def->usage.target, data->usageID))
|
if (STREQ(secret->def->usage.target, data->usageID))
|
||||||
found = 1;
|
found = 1;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
case VIR_SECRET_USAGE_TYPE_TLS:
|
||||||
|
if (STREQ(secret->def->usage.name, data->usageID))
|
||||||
|
found = 1;
|
||||||
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
cleanup:
|
cleanup:
|
||||||
|
7
tests/secretxml2xmlin/usage-tls.xml
Normal file
7
tests/secretxml2xmlin/usage-tls.xml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
<secret ephemeral='no' private='no'>
|
||||||
|
<uuid>f52a81b2-424e-490c-823d-6bd4235bc572</uuid>
|
||||||
|
<description>Sample TLS Secret</description>
|
||||||
|
<usage type='tls'>
|
||||||
|
<name>mumblyfratz</name>
|
||||||
|
</usage>
|
||||||
|
</secret>
|
@ -80,6 +80,7 @@ mymain(void)
|
|||||||
DO_TEST("usage-volume");
|
DO_TEST("usage-volume");
|
||||||
DO_TEST("usage-ceph");
|
DO_TEST("usage-ceph");
|
||||||
DO_TEST("usage-iscsi");
|
DO_TEST("usage-iscsi");
|
||||||
|
DO_TEST("usage-tls");
|
||||||
|
|
||||||
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
|
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user