External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-22 03:12:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

qemu: migration: Forbid 'nbd' migration of non-shared storage if TLS is requested

Browse Source 
Since libvirt is currently not able to setup the NBD migration stream
secured by TLS we should not allow such migration since data would be
transferred unencrypted.

This will break compatibility of TLS migration if non-shared storage is
requested but the security implications are more severe.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
This commit is contained in:
Peter Krempa 2018-04-26 15:44:26 +02:00
parent ce5aebeacd
commit b2b2998a4b
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/qemu/qemu_migration.c
View File

@ -3339,6 +3339,16 @@ qemuMigrationSrcRun(virQEMUDriverPtr driver,
if (migrate_flags & (QEMU_MONITOR_MIGRATE_NON_SHARED_DISK |
QEMU_MONITOR_MIGRATE_NON_SHARED_INC)) {
if (mig->nbd) {
/* Currently libvirt does not support setting up of the NBD
* non-shared storage migration with TLS. As we need to honour the
* VIR_MIGRATE_TLS flag, we need to reject such migration until
* we implement TLS for NBD. */
if (flags & VIR_MIGRATE_TLS) {
virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s",
_("NBD migration with TLS is not supported"));
goto error;
}
/* This will update migrate_flags on success */
if (qemuMigrationSrcDriveMirror(driver, vm, mig,
spec->dest.host.name,