[libvirt] [PATCH v2 3/4] conf: Add support for modifying ssl validation for https/ftps disks
Peter Krempa
pkrempa at redhat.com
Fri Apr 28 11:10:26 UTC 2017
To allow turning of verification of SSL cerificates add a new element
<ssl> to the disk source XML which will allow configuring the validation
process using the 'verify' attribute.
---
docs/formatdomain.html.in | 9 +++++
docs/schemas/domaincommon.rng | 47 +++++++++++++++++++++-
src/conf/domain_conf.c | 21 +++++++++-
src/util/virstoragefile.h | 1 +
.../generic-disk-network-http.xml | 9 +++++
5 files changed, 84 insertions(+), 3 deletions(-)
diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index 03961fb4b..f3bf63d6c 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -2288,6 +2288,7 @@
<driver name='qemu' type='raw'/>
<source protocol="https" name="url_path">
<host name="hostname" port="443"/>
+ <ssl verify="no"/>
</source>
<target dev='hdf' bus='ide' tray='open'/>
<readonly/>
@@ -2628,6 +2629,14 @@
protocol. Supported for 'rbd' <span class="since">since 1.2.11
(QEMU only).</span>
</dd>
+ <dt><code>ssl</code></dt>
+ <dd>
+ For <code>https</code> and <code>ftps</code> accessed storage it's
+ possible to tweak the SSL transport parameters with this element.
+ The <code>verify</code> attribute allows to turn on or of SSL
+ certificate validation. Supported values are <code>yes</code> and
+ <code>no</code>. <span class="since">Since 3.3.0</span>
+ </dd>
</dl>
<p>
diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
index 6367c059c..ef09fa831 100644
--- a/docs/schemas/domaincommon.rng
+++ b/docs/schemas/domaincommon.rng
@@ -1556,12 +1556,37 @@
</element>
</define>
+ <define name="diskSourceNetworkProtocolSSLVerify">
+ <element name="ssl">
+ <attribute name="verify">
+ <ref name="virYesNo"/>
+ </attribute>
+ <empty/>
+ </element>
+ </define>
+
+ <define name="diskSourceNetworkProtocolHTTPS">
+ <element name="source">
+ <interleave>
+ <attribute name="protocol">
+ <choice>
+ <value>https</value>
+ </choice>
+ </attribute>
+ <attribute name="name"/>
+ <ref name="diskSourceNetworkHost"/>
+ <optional>
+ <ref name="diskSourceNetworkProtocolSSLVerify"/>
+ </optional>
+ </interleave>
+ </element>
+ </define>
+
<define name="diskSourceNetworkProtocolHTTP">
<element name="source">
<attribute name="protocol">
<choice>
<value>http</value>
- <value>https</value>
</choice>
</attribute>
<attribute name="name"/>
@@ -1569,6 +1594,23 @@
</element>
</define>
+ <define name="diskSourceNetworkProtocolFTPS">
+ <element name="source">
+ <interleave>
+ <attribute name="protocol">
+ <choice>
+ <value>ftps</value>
+ </choice>
+ </attribute>
+ <attribute name="name"/>
+ <ref name="diskSourceNetworkHost"/>
+ <optional>
+ <ref name="diskSourceNetworkProtocolSSLVerify"/>
+ </optional>
+ </interleave>
+ </element>
+ </define>
+
<define name="diskSourceNetworkProtocolSimple">
<element name="source">
<attribute name="protocol">
@@ -1576,7 +1618,6 @@
<value>sheepdog</value>
<value>iscsi</value>
<value>ftp</value>
- <value>ftps</value>
<value>tftp</value>
</choice>
</attribute>
@@ -1622,6 +1663,8 @@
<ref name="diskSourceNetworkProtocolGluster"/>
<ref name="diskSourceNetworkProtocolRBD"/>
<ref name="diskSourceNetworkProtocolHTTP"/>
+ <ref name="diskSourceNetworkProtocolHTTPS"/>
+ <ref name="diskSourceNetworkProtocolFTPS"/>
<ref name="diskSourceNetworkProtocolSimple"/>
</choice>
</define>
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index c40a5a7a6..ec45d89b7 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -7591,6 +7591,20 @@ virDomainDiskSourceParse(xmlNodePtr node,
if (virDomainStorageHostParse(node, &src->hosts, &src->nhosts) < 0)
goto cleanup;
+
+ if ((src->protocol == VIR_STORAGE_NET_PROTOCOL_HTTPS ||
+ src->protocol == VIR_STORAGE_NET_PROTOCOL_FTPS) &&
+ (tmp = virXPathString("string(./ssl/@verify)", ctxt))) {
+ int verify;
+ if ((verify = virTristateBoolTypeFromString(tmp)) < 0) {
+ virReportError(VIR_ERR_XML_ERROR,
+ _("invalid ssl verify mode '%s'"), tmp);
+ goto cleanup;
+ }
+ VIR_FREE(tmp);
+
+ src->sslverify = verify;
+ }
break;
case VIR_STORAGE_TYPE_VOLUME:
if (virDomainDiskSourcePoolDefParse(node, &src->srcpool) < 0)
@@ -20788,7 +20802,8 @@ virDomainDiskSourceFormatNetwork(virBufferPtr buf,
VIR_FREE(path);
- if (src->nhosts == 0 && !src->snapshot && !src->configFile) {
+ if (src->nhosts == 0 && !src->snapshot && !src->configFile &&
+ src->sslverify == VIR_TRISTATE_BOOL_ABSENT) {
virBufferAddLit(buf, "/>\n");
} else {
virBufferAddLit(buf, ">\n");
@@ -20810,6 +20825,10 @@ virDomainDiskSourceFormatNetwork(virBufferPtr buf,
virBufferEscapeString(buf, "<snapshot name='%s'/>\n", src->snapshot);
virBufferEscapeString(buf, "<config file='%s'/>\n", src->configFile);
+ if (src->sslverify != VIR_TRISTATE_BOOL_ABSENT)
+ virBufferAsprintf(buf, "<ssl verify='%s'/>\n",
+ virTristateBoolTypeToString(src->sslverify));
+
virBufferAdjustIndent(buf, -2);
virBufferAddLit(buf, "</source>\n");
}
diff --git a/src/util/virstoragefile.h b/src/util/virstoragefile.h
index 9ebfc1108..e995b97fe 100644
--- a/src/util/virstoragefile.h
+++ b/src/util/virstoragefile.h
@@ -238,6 +238,7 @@ struct _virStorageSource {
virStorageSourcePoolDefPtr srcpool;
virStorageAuthDefPtr auth;
virStorageEncryptionPtr encryption;
+ virTristateBool sslverify;
char *driverName;
int format; /* virStorageFileFormat in domain backing chains, but
diff --git a/tests/genericxml2xmlindata/generic-disk-network-http.xml b/tests/genericxml2xmlindata/generic-disk-network-http.xml
index 51c779502..2448af727 100644
--- a/tests/genericxml2xmlindata/generic-disk-network-http.xml
+++ b/tests/genericxml2xmlindata/generic-disk-network-http.xml
@@ -25,6 +25,7 @@
<driver name='qemu' type='raw'/>
<source protocol='https' name='test2.img'>
<host name='example.org'/>
+ <ssl verify='no'/>
</source>
<target dev='vdb' bus='virtio'/>
</disk>
@@ -35,6 +36,14 @@
</source>
<target dev='vdc' bus='virtio'/>
</disk>
+ <disk type='network' device='disk'>
+ <driver name='qemu' type='raw'/>
+ <source protocol='https' name='test4.img'>
+ <host name='example.org' port='1234'/>
+ <ssl verify='yes'/>
+ </source>
+ <target dev='vdd' bus='virtio'/>
+ </disk>
<controller type='usb' index='0'/>
<controller type='pci' index='0' model='pci-root'/>
<input type='mouse' bus='ps2'/>
--
2.12.2
More information about the libvir-list
mailing list