On 05/26/2016 12:12 AM, Amit Shah wrote: > From: "Daniel P. Berrange" <berra...@redhat.com> > > Define two new migration parameters to be used with TLS encryption. > The 'tls-creds' parameter provides the ID of an instance of the > 'tls-creds' object type, or rather a subclass such as 'tls-creds-x509'. > Providing these credentials will enable use of TLS on the migration > data stream. >
> +++ b/qapi-schema.json > +# @tls-hostname: hostname of the target host for the migration. This is > +# required when using x509 based TLS credentials and the > +# migration URI does not already include a hostname. For > +# example if using fd: or exec: based migration, the > +# hostname must be provided so that the server's x509 > +# certificate identity canbe validated. (Since 2.7) s/canbe/can be/ > +# > +# @tls-hostname: hostname of the target host for the migration. This is > +# required when using x509 based TLS credentials and the > +# migration URI does not already include a hostname. For > +# example if using fd: or exec: based migration, the > +# hostname must be provided so that the server's x509 > +# certificate identity canbe validated. (Since 2.7) and again > @@ -667,6 +702,21 @@ > # auto-converge detects that migration is not making > # progress. The default value is 10. (Since 2.7) > # > +# @tls-creds: ID of the 'tls-creds' object that provides credentials for > +# establishing a TLS connection over the migration data channel. > +# On the outgoing side of the migration, the credentials must > +# be for a 'client' endpoint, while for the incoming side the > +# credentials must be for a 'server' endpoint. Setting this > +# will enable TLS for all migrations. The default is unset, > +# resulting in unsecured migration at the QEMU level. (Since 2.6) Missed a swap to call out 2.7 > +# > +# @tls-hostname: hostname of the target host for the migration. This is > +# required when using x509 based TLS credentials and the > +# migration URI does not already include a hostname. For > +# example if using fd: or exec: based migration, the > +# hostname must be provided so that the server's x509 > +# certificate identity canbe validated. (Since 2.6) can be, 2.7 -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
signature.asc
Description: OpenPGP digital signature
