> On 29 Jul 2026, at 2:28 PM, Abhisek Panda <[email protected]> wrote: > > QEMU provides the capability to encrypt the migration data stream using > two transport layer security (TLS) authentication schemes: X.509 > certificates and pre-shared keys (PSK). Currently, Libvirt only > supports the X.509-based TLS authentication scheme. In TLS X.509 > certificates, a set of live migrations utilize a fixed > set of static certificates for encrypted migration. In this > authentication scheme, users require to deploy a certificate authority > and monitor the certificate expiration window. In case certificates > are compromised all the future live migrations are vulnerable. > > To resolve this, this patch series introduce the support for pre-shared > key-based authentication scheme. This mechanism relies on symmetric > pre-shared keys (a secret key that is known to both sender and receiver > prior to secure communication) for providing secure transfer of data. > Libvirt solely manages the lifecycle of the ephemeral pre-shared keys, > including, generation, persistent storage, and cleanup. Libvirt > generates the key on the source machine, then transfers it to the > destination machine using the migration cookie. To allow users to > configure the size of the key, Libvirt provides the > migrate_tls_psk_length configuration parameter in qemu.conf. > > To avoid introduction of an additional VIR_MIGRATE_* flag, we rely on > existing the VIR_MIGRATE_TLS flag. If the VIR_MIGRATE_TLS flag > is set but the necessary X.509 credential files are missing on the > destination, then we fallback to using PSK-based authentication scheme > during migration. > > v3: > 1. Destination host decides which TLS authentication scheme to use. > 2. The directory of the key file is set to > <tls_psk_state_dir>/$ID-$VMNAME. > 3. Use the same alias for both tls-creds-x509 and tls-creds-psk > objects. > 4. Validate the length of the pre-shared key. > 5. Unit test to validate the pre-shared key in the migration cookie. > > v2: > 1. Libvirt manages the lifecycle of pre-shared keys. > 2. Transfer of keys to the destination via the migration cookie > 3. Remove the VIR_MIGRATE_TLS_PSK flag instead rely on > VIR_MIGRATE_TLS and availability of ca-cert.pem on source. > 4. Drop VIR_MIGRATE_PARAM_TLS_PSK_DIRECTORY, Libvirt solely manages > the pre-shared keys. > > Abhisek Panda (7): > conf: Add a configuration param for TLS-PSK > qemu: Manage a pre-shared key's lifecycle > qemu: Add support to build the tls-creds-psk object > qemu: rename tls-creds-x509 obj related functions > qemu: Manage tls-creds-psk object lifecycle > qemu: Set up the migrate TLS-PSK objects > tests: Add testing of pre-shared key lifecycle > > include/libvirt/libvirt-domain.h | 11 +- > src/qemu/libvirtd_qemu.aug | 1 + > src/qemu/qemu.conf.in | 8 ++ > src/qemu/qemu_command.c | 26 ++++ > src/qemu/qemu_command.h | 7 + > src/qemu/qemu_conf.c | 22 ++++ > src/qemu/qemu_conf.h | 2 + > src/qemu/qemu_domain.c | 1 + > src/qemu/qemu_domain.h | 1 + > src/qemu/qemu_driver.c | 6 + > src/qemu/qemu_hotplug.c | 40 +++--- > src/qemu/qemu_hotplug.h | 24 ++-- > src/qemu/qemu_migration.c | 202 +++++++++++++++++++++++++---- > src/qemu/qemu_migration_cookie.c | 94 +++++++++++++- > src/qemu/qemu_migration_cookie.h | 5 + > src/qemu/qemu_migration_params.c | 98 +++++++++++--- > src/qemu/qemu_migration_params.h | 22 +++- > src/qemu/test_libvirtd_qemu.aug.in | 1 + > tests/qemumigrationcookiexmltest.c | 141 +++++++++++++++++++- > tests/testutilsqemu.c | 12 ++ > 20 files changed, 631 insertions(+), 93 deletions(-) > > -- > 2.43.7 >
Ping for the series. Checking in to see if anyone has feedback on this patch set. Thanks and warm regards Dr. Abhisek Panda
